@theokit/sdk 5.5.0 → 5.6.0

package/dist/{agent-YWSIHHFM.cjs → agent-47NS6ZVL.cjs}

@@ -1,16 +1,16 @@
 'use strict';
 
-var chunkUKJJRU7C_cjs = require('./chunk-UKJJRU7C.cjs');
+var chunkGCHZMH42_cjs = require('./chunk-GCHZMH42.cjs');
 require('./chunk-KVSAY6NZ.cjs');
 require('./chunk-DZG77WU7.cjs');
 require('./chunk-BUUUWQMB.cjs');
-require('./chunk-Z2JFX372.cjs');
-require('./chunk-VY6NKMOA.cjs');
+require('./chunk-VUHXC74Q.cjs');
+require('./chunk-7IZKTQ5G.cjs');
 require('./chunk-BV2MWEMV.cjs');
 require('./chunk-D6POWE7E.cjs');
 require('./chunk-GHX4P3V2.cjs');
 require('./chunk-TMKTSYDS.cjs');
-require('./chunk-NQTNSHSB.cjs');
+require('./chunk-GFFBXSQT.cjs');
 require('./chunk-7FDKWDA2.cjs');
 require('./chunk-C4ZQPWXJ.cjs');
 require('./chunk-FUSDYC2B.cjs');
@@ -19,7 +19,7 @@ require('./chunk-24SYBZPL.cjs');
 require('./chunk-QOGNZMHD.cjs');
 require('./chunk-YIFFF23U.cjs');
 require('./chunk-2ZPEDVLM.cjs');
-require('./chunk-IU5N5224.cjs');
+require('./chunk-EIOMN5VA.cjs');
 require('./chunk-KRD3GQAA.cjs');
 require('./chunk-RQMCOFAI.cjs');
 require('./chunk-MUUQ2WFJ.cjs');
@@ -28,8 +28,8 @@ require('./chunk-YSTXFWQE.cjs');
 require('./chunk-FRITRLZQ.cjs');
 require('./chunk-NQTD6QOW.cjs');
 require('./chunk-NINIJCHU.cjs');
-require('./chunk-QATRS7JD.cjs');
-require('./chunk-LOHMT36V.cjs');
+require('./chunk-MYJGWS2J.cjs');
+require('./chunk-LD6HASA5.cjs');
 require('./chunk-IJ7M6GOG.cjs');
 require('./chunk-7A6535RA.cjs');
 require('./chunk-SA6K24NB.cjs');
@@ -43,9 +43,9 @@ require('./chunk-BJUJT5ED.cjs');
 require('./chunk-ZF2LDKQQ.cjs');
 require('./chunk-HCT4HPCL.cjs');
 require('./chunk-JLRLCBJ4.cjs');
-require('./chunk-AYA65JA5.cjs');
-require('./chunk-43YXGD3P.cjs');
-require('./chunk-HW7SEELD.cjs');
+require('./chunk-RWPLWMCZ.cjs');
+require('./chunk-TY56BKSK.cjs');
+require('./chunk-QRVS2PRE.cjs');
 require('./chunk-ATT276RD.cjs');
 require('./chunk-3EE6LVWT.cjs');
 require('./chunk-ANMJJD6D.cjs');
@@ -61,7 +61,7 @@ require('./chunk-6LHQPOMI.cjs');
 
 Object.defineProperty(exports, "Agent", {
   enumerable: true,
-  get: function () { return chunkUKJJRU7C_cjs.Agent; }
+  get: function () { return chunkGCHZMH42_cjs.Agent; }
 });
-//# sourceMappingURL=agent-YWSIHHFM.cjs.map
-//# sourceMappingURL=agent-YWSIHHFM.cjs.map
+//# sourceMappingURL=agent-47NS6ZVL.cjs.map
+//# sourceMappingURL=agent-47NS6ZVL.cjs.map

package/dist/{agent-YWSIHHFM.cjs.map → agent-47NS6ZVL.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-YWSIHHFM.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-47NS6ZVL.cjs"}

package/dist/{agent-DyB_lzrx.d.cts → agent-82d_DrCL.d.cts}

@@ -224,6 +224,10 @@ interface Skill$1 {
     source: string;
     category?: string;
     dependencies?: string[];
+    /** `disable-model-invocation: true` — the model is never told this skill exists. */
+    disableModelInvocation?: boolean;
+    /** `user-invocable: false` — carried for a host that has a picker; this SDK has no such surface. */
+    userInvocable?: boolean;
 }
 
 /**
@@ -1051,9 +1055,14 @@ type CompatSource = "claude-code" | "theokit" | CompatSourceAdapter;
  * Reusing the skills you already wrote for another product is a reasonable thing to want, and it is
  * not a reason to hand that product's directory the right to run commands.
  *
+ * `context` is the foreign root's INSTRUCTIONS — `.claude/rules/*.md`. Same risk class as `skills`:
+ * text a cloned repository wrote, entering the system prompt as if the consumer had written it. It
+ * was missing until usetheokit/theokit-sdk#652, so the four surfaces above failed closed while this
+ * one was admitted by a path that consulted no grant at all.
+ *
  * @public
  */
-type CompatSurface = "hooks" | "plugins" | "skills" | "subagents";
+type CompatSurface = "context" | "hooks" | "plugins" | "skills" | "subagents";
 /**
  * A foreign source admitted to named surfaces only.
  *
@@ -1980,4 +1989,4 @@ interface ListResult<T> {
     nextCursor?: string;
 }
 
-export { type SettingSource as $, type AgentOptions as A, type BudgetTracker as B, type CloudOptions as C, type MemoryProviderAgentRef as D, type MemoryProviderFactory as E, type MemoryProviderHandle as F, type GetAgentOptions as G, type HookName as H, type InlineSkill as I, type MemoryProviderInitOptions as J, type PluginContext as K, type LocalOptions as L, type MemorySettings as M, type PluginHookDisposer as N, type PostAssistantReplyContext as O, type Plugin as P, type PostToolCallContext as Q, type PreToolCallContext as R, type SystemPromptResolver as S, type PreUserSendContext as T, type PreUserSendResult as U, type ProviderTransform as V, type ProviderTransformContext as W, type RecordSessionSummaryArgs as X, type SessionLifecycleContext as Y, type SessionRecord as Z, type SessionStore as _, type AgentDefinition as a, Skill as a0, type SkillsResolver as a1, type SkillsResolverContext as a2, type SystemPromptContext as a3, type SystemPromptMemoryFact as a4, type TelemetrySettings as a5, type ToolCallSummary as a6, type ToolResultTransformContext as a7, type TransformContext as a8, type SkillsSettings as b, type ListAgentsOptions as c, type ListResult as d, type SDKAgentInfo as e, type ListRunsOptions as f, type GetRunOptions as g, type AgentOperationOptions as h, type AgentDescription as i, type ProviderProfile as j, type MemoryProvider as k, type PreToolCallDecision as l, type ActiveMemoryPassArgs as m, type ActiveMemoryPassResult as n, type AgentSubagentDescription as o, type AgentToolDescription as p, type BudgetCheck as q, type BudgetTotal as r, type BudgetUsageEvent as s, type BuiltinToolName as t, type CloudEnv as u, type CloudRepo as v, type CompatSource as w, type CompatSourceAdapter as x, type CompatSurface as y, type CreateSkillSpec as z };
+export { type SessionStore as $, type AgentOptions as A, type BudgetTracker as B, type CloudOptions as C, type CreateSkillSpec as D, type MemoryProviderAgentRef as E, type MemoryProviderFactory as F, type GetAgentOptions as G, type HookName as H, type InlineSkill as I, type MemoryProviderHandle as J, type MemoryProviderInitOptions as K, type LocalOptions as L, type MemorySettings as M, type PluginContext as N, type PluginHookDisposer as O, type Plugin as P, type PostAssistantReplyContext as Q, type PostToolCallContext as R, type SystemPromptResolver as S, type PreToolCallContext as T, type PreUserSendContext as U, type PreUserSendResult as V, type ProviderTransform as W, type ProviderTransformContext as X, type RecordSessionSummaryArgs as Y, type SessionLifecycleContext as Z, type SessionRecord as _, type AgentDefinition as a, type SettingSource as a0, Skill as a1, type SkillsResolver as a2, type SkillsResolverContext as a3, type SystemPromptContext as a4, type SystemPromptMemoryFact as a5, type TelemetrySettings as a6, type ToolCallSummary as a7, type ToolResultTransformContext as a8, type TransformContext as a9, type SkillsSettings as b, type ListAgentsOptions as c, type ListResult as d, type SDKAgentInfo as e, type ListRunsOptions as f, type GetRunOptions as g, type AgentOperationOptions as h, type AgentDescription as i, type ProviderProfile as j, type Skill$1 as k, type MemoryProvider as l, type PreToolCallDecision as m, type ActiveMemoryPassArgs as n, type ActiveMemoryPassResult as o, type AgentSubagentDescription as p, type AgentToolDescription as q, type BudgetCheck as r, type BudgetTotal as s, type BudgetUsageEvent as t, type BuiltinToolName as u, type CloudEnv as v, type CloudRepo as w, type CompatSource as x, type CompatSourceAdapter as y, type CompatSurface as z };

package/dist/{agent-CjMVbhhY.d.ts → agent-G6g-uwcB.d.ts}

@@ -224,6 +224,10 @@ interface Skill$1 {
     source: string;
     category?: string;
     dependencies?: string[];
+    /** `disable-model-invocation: true` — the model is never told this skill exists. */
+    disableModelInvocation?: boolean;
+    /** `user-invocable: false` — carried for a host that has a picker; this SDK has no such surface. */
+    userInvocable?: boolean;
 }
 
 /**
@@ -1051,9 +1055,14 @@ type CompatSource = "claude-code" | "theokit" | CompatSourceAdapter;
  * Reusing the skills you already wrote for another product is a reasonable thing to want, and it is
  * not a reason to hand that product's directory the right to run commands.
  *
+ * `context` is the foreign root's INSTRUCTIONS — `.claude/rules/*.md`. Same risk class as `skills`:
+ * text a cloned repository wrote, entering the system prompt as if the consumer had written it. It
+ * was missing until usetheokit/theokit-sdk#652, so the four surfaces above failed closed while this
+ * one was admitted by a path that consulted no grant at all.
+ *
  * @public
  */
-type CompatSurface = "hooks" | "plugins" | "skills" | "subagents";
+type CompatSurface = "context" | "hooks" | "plugins" | "skills" | "subagents";
 /**
  * A foreign source admitted to named surfaces only.
  *
@@ -1980,4 +1989,4 @@ interface ListResult<T> {
     nextCursor?: string;
 }
 
-export { type SettingSource as $, type AgentOptions as A, type BudgetTracker as B, type CloudOptions as C, type MemoryProviderAgentRef as D, type MemoryProviderFactory as E, type MemoryProviderHandle as F, type GetAgentOptions as G, type HookName as H, type InlineSkill as I, type MemoryProviderInitOptions as J, type PluginContext as K, type LocalOptions as L, type MemorySettings as M, type PluginHookDisposer as N, type PostAssistantReplyContext as O, type Plugin as P, type PostToolCallContext as Q, type PreToolCallContext as R, type SystemPromptResolver as S, type PreUserSendContext as T, type PreUserSendResult as U, type ProviderTransform as V, type ProviderTransformContext as W, type RecordSessionSummaryArgs as X, type SessionLifecycleContext as Y, type SessionRecord as Z, type SessionStore as _, type AgentDefinition as a, Skill as a0, type SkillsResolver as a1, type SkillsResolverContext as a2, type SystemPromptContext as a3, type SystemPromptMemoryFact as a4, type TelemetrySettings as a5, type ToolCallSummary as a6, type ToolResultTransformContext as a7, type TransformContext as a8, type SkillsSettings as b, type ListAgentsOptions as c, type ListResult as d, type SDKAgentInfo as e, type ListRunsOptions as f, type GetRunOptions as g, type AgentOperationOptions as h, type AgentDescription as i, type ProviderProfile as j, type MemoryProvider as k, type PreToolCallDecision as l, type ActiveMemoryPassArgs as m, type ActiveMemoryPassResult as n, type AgentSubagentDescription as o, type AgentToolDescription as p, type BudgetCheck as q, type BudgetTotal as r, type BudgetUsageEvent as s, type BuiltinToolName as t, type CloudEnv as u, type CloudRepo as v, type CompatSource as w, type CompatSourceAdapter as x, type CompatSurface as y, type CreateSkillSpec as z };
+export { type SessionStore as $, type AgentOptions as A, type BudgetTracker as B, type CloudOptions as C, type CreateSkillSpec as D, type MemoryProviderAgentRef as E, type MemoryProviderFactory as F, type GetAgentOptions as G, type HookName as H, type InlineSkill as I, type MemoryProviderHandle as J, type MemoryProviderInitOptions as K, type LocalOptions as L, type MemorySettings as M, type PluginContext as N, type PluginHookDisposer as O, type Plugin as P, type PostAssistantReplyContext as Q, type PostToolCallContext as R, type SystemPromptResolver as S, type PreToolCallContext as T, type PreUserSendContext as U, type PreUserSendResult as V, type ProviderTransform as W, type ProviderTransformContext as X, type RecordSessionSummaryArgs as Y, type SessionLifecycleContext as Z, type SessionRecord as _, type AgentDefinition as a, type SettingSource as a0, Skill as a1, type SkillsResolver as a2, type SkillsResolverContext as a3, type SystemPromptContext as a4, type SystemPromptMemoryFact as a5, type TelemetrySettings as a6, type ToolCallSummary as a7, type ToolResultTransformContext as a8, type TransformContext as a9, type SkillsSettings as b, type ListAgentsOptions as c, type ListResult as d, type SDKAgentInfo as e, type ListRunsOptions as f, type GetRunOptions as g, type AgentOperationOptions as h, type AgentDescription as i, type ProviderProfile as j, type Skill$1 as k, type MemoryProvider as l, type PreToolCallDecision as m, type ActiveMemoryPassArgs as n, type ActiveMemoryPassResult as o, type AgentSubagentDescription as p, type AgentToolDescription as q, type BudgetCheck as r, type BudgetTotal as s, type BudgetUsageEvent as t, type BuiltinToolName as u, type CloudEnv as v, type CloudRepo as w, type CompatSource as x, type CompatSourceAdapter as y, type CompatSurface as z };

package/dist/{agent-G3T7Q3SQ.js → agent-JJZM2VIK.js}

@@ -1,14 +1,14 @@
-export { Agent } from './chunk-ODBID5TG.js';
+export { Agent } from './chunk-2UXQASTX.js';
 import './chunk-K2VMFZQ5.js';
 import './chunk-2QKV4CGK.js';
 import './chunk-K2BQQ445.js';
-import './chunk-7SZAV6QG.js';
-import './chunk-S6B5XYC3.js';
+import './chunk-7MMTZBTT.js';
+import './chunk-N2KAIZ5D.js';
 import './chunk-2SFBB54R.js';
 import './chunk-55GB6JYQ.js';
 import './chunk-H73MEMQB.js';
 import './chunk-OR6XIWLB.js';
-import './chunk-SADXXGWU.js';
+import './chunk-BZ3YMAMP.js';
 import './chunk-AAEZSPTC.js';
 import './chunk-KZSKIUXZ.js';
 import './chunk-UBR5PWD7.js';
@@ -17,7 +17,7 @@ import './chunk-XB4GI5RZ.js';
 import './chunk-24MGQDK3.js';
 import './chunk-2WXHA33T.js';
 import './chunk-HKCKOAIO.js';
-import './chunk-N6OOOYFZ.js';
+import './chunk-HUDNLFY4.js';
 import './chunk-KVNWIAO4.js';
 import './chunk-SVQIW5RJ.js';
 import './chunk-FD2UT76F.js';
@@ -26,8 +26,8 @@ import './chunk-FJWQP6EE.js';
 import './chunk-NAF4L3T6.js';
 import './chunk-CFE6QF2Q.js';
 import './chunk-6X6ID4MO.js';
-import './chunk-LX7SEXOQ.js';
-import './chunk-2XRAWOZZ.js';
+import './chunk-CA5VUAP3.js';
+import './chunk-5NELQ6LB.js';
 import './chunk-SAGRF4IB.js';
 import './chunk-EH6XD3FY.js';
 import './chunk-UKMBRMGT.js';
@@ -41,9 +41,9 @@ import './chunk-TA3K7SBK.js';
 import './chunk-Q5EWJPRY.js';
 import './chunk-EIQFAOFD.js';
 import './chunk-3JHIFQ4I.js';
-import './chunk-O7L7M42F.js';
-import './chunk-NSLHPAC7.js';
-import './chunk-JNAA4G4H.js';
+import './chunk-T3ZDEYTJ.js';
+import './chunk-X7EUUHXU.js';
+import './chunk-UOLBAPDM.js';
 import './chunk-6M2OIS4Y.js';
 import './chunk-R7WIIPUR.js';
 import './chunk-XYFGKVZ7.js';
@@ -54,5 +54,5 @@ import './chunk-V22DZIXO.js';
 import './chunk-NJWYQWDL.js';
 import './chunk-ALUN2B4W.js';
 import './chunk-CZJ6Q7CW.js';
-//# sourceMappingURL=agent-G3T7Q3SQ.js.map
-//# sourceMappingURL=agent-G3T7Q3SQ.js.map
+//# sourceMappingURL=agent-JJZM2VIK.js.map
+//# sourceMappingURL=agent-JJZM2VIK.js.map

package/dist/{agent-G3T7Q3SQ.js.map → agent-JJZM2VIK.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-G3T7Q3SQ.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-JJZM2VIK.js"}

package/dist/{chunk-ODBID5TG.js → chunk-2UXQASTX.js}

@@ -1,21 +1,21 @@
 import { submit, emitRunEvent } from './chunk-K2VMFZQ5.js';
 import { enqueueSessionWrite, hydrateSession, persistTurnToTranscript, flushSessionWrites, appendSessionMessage, getSessionMessages, discardSession, clearSession } from './chunk-2QKV4CGK.js';
-import { IndexManager } from './chunk-7SZAV6QG.js';
-import { loadHookConfig, warnOnce, currentPersonalityContext, warnPersonalitySwitchInsideFork } from './chunk-S6B5XYC3.js';
+import { IndexManager } from './chunk-7MMTZBTT.js';
+import { warnFailureOnce, loadHookConfig, warnOnce, currentPersonalityContext, warnPersonalitySwitchInsideFork } from './chunk-N2KAIZ5D.js';
 import { extractCodePlugins } from './chunk-2SFBB54R.js';
 import { createOpenAiCompatibleRuntime } from './chunk-55GB6JYQ.js';
 import { persistActiveMemoryTranscript } from './chunk-OR6XIWLB.js';
-import { writeSessionSummary, resolveMemoryRoot, MEMORY_KINDS, appendFact, readFacts, legacyMemoryJsonPath, memoryMdPath, appendFactToMarkdown } from './chunk-SADXXGWU.js';
+import { writeSessionSummary, resolveMemoryRoot, MEMORY_KINDS, appendFact, readFacts, legacyMemoryJsonPath, memoryMdPath, appendFactToMarkdown } from './chunk-BZ3YMAMP.js';
 import { FsSessionStore } from './chunk-AAEZSPTC.js';
 import { discoverProviderPlugins, validateApiKeyShape, getConfiguredBaseUrl, httpRequest, isFixtureApiKey, presentProviderCredentialEnvVars, buildDefaultSummarizer, shouldUseRealLocalRuntime, parseSseStream, CircuitBreaker, resolveRunProvider, mergeExplicitApiKey, resolveProviderChain, abortError, tryFirstEvent, relayStream, renderToolResultContentText } from './chunk-KZSKIUXZ.js';
 import { resolveChildEnv } from './chunk-HKCKOAIO.js';
-import { DEFAULT_MAX_BYTES_PER_FILE, runDiscovery, truncateWithMarker } from './chunk-N6OOOYFZ.js';
+import { DEFAULT_MAX_BYTES_PER_FILE, runDiscovery, truncateWithMarker } from './chunk-HUDNLFY4.js';
 import { readVersionedJson, writeVersionedJson } from './chunk-SVQIW5RJ.js';
 import { toJsonSchema } from './chunk-7I5Z3UBJ.js';
 import { sanitizeToolInput } from './chunk-FJWQP6EE.js';
 import { withInheritedSubAgentCredentials, subAgentToolsFromDefinitions } from './chunk-CFE6QF2Q.js';
 import { setAgentFacade } from './chunk-6X6ID4MO.js';
-import { escapeBlockBody, buildSkillsBlock, discoverSkills, stripSkillFrontmatter } from './chunk-LX7SEXOQ.js';
+import { escapeBlockBody, buildSkillsBlock, discoverSkills, stripSkillFrontmatter } from './chunk-CA5VUAP3.js';
 import { withToolWhitelist, checkToolWhitelist } from './chunk-SAGRF4IB.js';
 import { validateArtifactPath, PathTraversalError, safePathJoin } from './chunk-EH6XD3FY.js';
 import { insideRoot, atOrInsideRoot } from './chunk-UKMBRMGT.js';
@@ -24,9 +24,9 @@ import { expandTilde, defaultBaseDir } from './chunk-JOFVLOFY.js';
 import { withFileLock } from './chunk-TA3K7SBK.js';
 import { withCwdMutex } from './chunk-Q5EWJPRY.js';
 import { sweepStaleAtomicTemps, atomicWriteJson } from './chunk-3JHIFQ4I.js';
-import { loadSubagents, pluginBundleDirs } from './chunk-O7L7M42F.js';
-import { reportUndeclaredSources, theokitConfigRoot, undefinedVariablesIn, getTheokitHome, adapterForConfigPath, projectConfigRoots, pluginBundleRoots } from './chunk-NSLHPAC7.js';
-import { readWorkspaceDir, parseSimpleYaml } from './chunk-JNAA4G4H.js';
+import { loadSubagents, pluginBundleDirs } from './chunk-T3ZDEYTJ.js';
+import { reportUndeclaredSources, theokitConfigRoot, undefinedVariablesIn, getTheokitHome, adapterForConfigPath, adaptersForSurface, projectConfigRoots, pluginBundleRoots } from './chunk-X7EUUHXU.js';
+import { readWorkspaceDir, parseSimpleYaml } from './chunk-UOLBAPDM.js';
 import { resolveEffectiveContextWindow, CONTEXT_WINDOW_FLOOR, CONTEXT_WINDOW_MARGIN } from './chunk-6M2OIS4Y.js';
 import { parseModelId } from './chunk-R7WIIPUR.js';
 import { getProviderProfile } from './chunk-XYFGKVZ7.js';
@@ -38,6 +38,7 @@ import { stat, mkdir, readFile, readdir, access, unlink } from 'fs/promises';
 import { randomUUID, createHash } from 'crypto';
 import { join, dirname, resolve, relative, isAbsolute } from 'path';
 import { existsSync, readFileSync } from 'fs';
+import { platform } from 'process';
 import { spawn } from 'child_process';
 import { z } from 'zod';
 import { createRequire } from 'module';
@@ -2550,6 +2551,116 @@ function readCompatConfigFile(cwd) {
 function resolveCompatSources(options, cwd) {
   return options.local?.compatSources ?? readCompatConfigFile(cwd);
 }
+var KNOWN_KEYS = /* @__PURE__ */ new Set([
+  "disableAllHooks",
+  "disableSkillShellExecution",
+  "permissions",
+  "permissionMode"
+]);
+function managedSettingsPathFor(root) {
+  if (root !== void 0) return join(root, "claude-code", "managed-settings.json");
+  if (platform === "darwin") {
+    return "/Library/Application Support/ClaudeCode/managed-settings.json";
+  }
+  if (platform === "win32") {
+    const programData = process.env.PROGRAMDATA ?? "C:\\ProgramData";
+    return join(programData, "ClaudeCode", "managed-settings.json");
+  }
+  return "/etc/claude-code/managed-settings.json";
+}
+function readManagedSettings(root) {
+  const path = managedSettingsPathFor(root);
+  const parsed = readPolicyDocument(path);
+  if (parsed === void 0) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    applyPolicyKey(out, key, value, path);
+  }
+  return out;
+}
+function readPolicyDocument(path) {
+  if (!existsSync(path)) return void 0;
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (cause) {
+    diagFailure(
+      `[theokit-sdk] ${path} exists and could not be read (${cause.message}) \u2014 NO operator policy is being applied. Fix the permissions or remove the file.
+`
+    );
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (cause) {
+    diagFailure(
+      `[theokit-sdk] ${path} is not valid JSON (${cause.message}) \u2014 NO operator policy is being applied.
+`
+    );
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    diagFailure(
+      `[theokit-sdk] ${path} is not a JSON object \u2014 NO operator policy is being applied.
+`
+    );
+    return void 0;
+  }
+  return parsed;
+}
+var PERMISSION_MODES = ["default", "plan", "acceptEdits", "bypass"];
+function applyPolicyKey(out, key, value, path) {
+  if (!KNOWN_KEYS.has(key)) {
+    decline(path, key, "this runtime does not enforce it");
+    return;
+  }
+  if (key === "permissionMode") {
+    const mode = readMode(value, path);
+    if (mode !== void 0) out.permissionMode = mode;
+    return;
+  }
+  if (key === "permissions") {
+    const rules = readRuleLists(value, path);
+    if (rules !== void 0) out.permissions = rules;
+    return;
+  }
+  const flag = readBoolean(value, key, path);
+  if (flag === void 0) return;
+  if (key === "disableAllHooks") out.disableAllHooks = flag;
+  if (key === "disableSkillShellExecution") out.disableSkillShellExecution = flag;
+}
+function decline(path, key, reason) {
+  diagFailure(`[theokit-sdk] ${path} declares "${key}" \u2014 ${reason}. It is NOT being applied.
+`);
+}
+function readMode(value, path) {
+  if (typeof value === "string" && PERMISSION_MODES.includes(value)) {
+    return value;
+  }
+  decline(
+    path,
+    "permissionMode",
+    `${JSON.stringify(value)} is not one of ${PERMISSION_MODES.join(", ")}`
+  );
+  return void 0;
+}
+function readRuleLists(value, path) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    return value;
+  }
+  decline(
+    path,
+    "permissions",
+    `it is ${Array.isArray(value) ? "an array" : typeof value}, not an object of rule lists`
+  );
+  return void 0;
+}
+function readBoolean(value, key, path) {
+  if (typeof value === "boolean") return value;
+  decline(path, key, `it is ${typeof value}, not a boolean`);
+  return void 0;
+}
 function spawnAndCollect(options) {
   return new Promise((resolve) => {
     const timeoutMs = options.timeoutMs ?? 3e4;
@@ -2600,16 +2711,26 @@ function spawnAndCollect(options) {
 
 // src/internal/runtime/hooks/hooks-executor.ts
 var HooksExecutor = class {
-  constructor(cwd, compatSources = [], gate = void 0) {
+  constructor(cwd, compatSources = [], gate = void 0, policy = {}) {
     this.cwd = cwd;
     this.compatSources = compatSources;
     this.gate = gate;
+    this.policy = policy;
   }
   cwd;
   compatSources;
   gate;
+  policy;
   config = {};
   async initialize(settingSourcesIncludeProject) {
+    if (readManagedSettings(this.policy.managedSettingsRoot).disableAllHooks === true) {
+      warnFailureOnce(
+        "hooks-disabled-by-policy",
+        "[theokit-sdk] hooks: an operator policy (managed-settings.json) declares disableAllHooks \u2014 NO hook will run, including any this project declared."
+      );
+      this.config = {};
+      return;
+    }
     if (!settingSourcesIncludeProject) {
       this.config = {};
       return;
@@ -2681,7 +2802,7 @@ var HooksExecutor = class {
       cwd: this.cwd,
       ...Object.keys(env).length > 0 ? { env } : {},
       timeoutMs,
-      stdin: JSON.stringify(payload)
+      stdin: JSON.stringify(stdinPayloadFor(payload, command, this.cwd))
     });
     const failure = this.decisionFromFailure(result, command, env, timeoutMs);
     return failure ?? parseDecisionFromStdout(result.stdout);
@@ -2695,9 +2816,16 @@ var HooksExecutor = class {
    * spawned.
    */
   decisionFromFailure(result, command, env, timeoutMs) {
-    if (result.timedOut) return { decision: "deny", reason: `Hook timed out after ${timeoutMs}ms` };
+    if (result.timedOut)
+      return {
+        decision: "deny",
+        reason: `Hook timed out after ${timeoutMs}ms`
+      };
     if (result.spawnError !== void 0) {
-      return { decision: "deny", reason: `Hook spawn failed: ${result.spawnError.message}` };
+      return {
+        decision: "deny",
+        reason: `Hook spawn failed: ${result.spawnError.message}`
+      };
     }
     if (result.exitCode === 0) return void 0;
     const stderr = result.stderr.trim();
@@ -2710,6 +2838,16 @@ var HooksExecutor = class {
     };
   }
 };
+function stdinPayloadFor(payload, command, cwd) {
+  return {
+    ...payload,
+    cwd,
+    ...command.sourceEvent === void 0 ? {} : { hook_event_name: command.sourceEvent },
+    ...payload.tool === void 0 ? {} : { tool_name: payload.tool },
+    ...payload.input === void 0 ? {} : { tool_input: payload.input },
+    ...payload.output === void 0 ? {} : { tool_response: payload.output }
+  };
+}
 function runtimeEnvFor(sourcePath, cwd) {
   if (sourcePath === void 0) return {};
   return adapterForConfigPath(sourcePath)?.runtimeEnv(cwd) ?? {};
@@ -2717,19 +2855,35 @@ function runtimeEnvFor(sourcePath, cwd) {
 function parseDecisionFromStdout(stdout) {
   const trimmed = stdout.trim();
   if (trimmed.length === 0) return { decision: "allow" };
+  let parsed;
   try {
-    const parsed = JSON.parse(trimmed);
-    if (parsed.decision === "deny" || parsed.decision === "feedback") {
-      const result = { decision: parsed.decision };
-      if (parsed.reason !== void 0) result.reason = parsed.reason;
-      if (parsed.feedback !== void 0) result.feedback = parsed.feedback;
-      return result;
-    }
-    if (parsed.decision === "allow") return { decision: "allow" };
+    parsed = JSON.parse(trimmed);
   } catch {
     return { decision: "feedback", feedback: trimmed };
   }
-  return { decision: "allow" };
+  return nestedDecision(parsed) ?? flatDecision(parsed) ?? { decision: "allow" };
+}
+function nestedDecision(parsed) {
+  const nested = parsed.hookSpecificOutput;
+  if (nested?.permissionDecision === "allow") return { decision: "allow" };
+  if (nested?.permissionDecision !== "deny" && nested?.permissionDecision !== "ask") {
+    return void 0;
+  }
+  const result = { decision: "deny" };
+  if (nested.permissionDecisionReason !== void 0) {
+    result.reason = nested.permissionDecisionReason;
+  }
+  return result;
+}
+function flatDecision(parsed) {
+  if (parsed.decision === "allow") return { decision: "allow" };
+  if (parsed.decision !== "deny" && parsed.decision !== "block" && parsed.decision !== "feedback") {
+    return void 0;
+  }
+  const result = parsed.decision === "feedback" ? { decision: "feedback" } : { decision: "deny" };
+  if (parsed.reason !== void 0) result.reason = parsed.reason;
+  if (parsed.feedback !== void 0) result.feedback = parsed.feedback;
+  return result;
 }
 
 // src/internal/runtime/lifecycle/context-budget-event.ts
@@ -3043,7 +3197,15 @@ async function buildSystemPromptContext(inputs, userText, memoryFacts, manager =
     agentId: inputs.agentId,
     cwd: inputs.workspaceCwd,
     model: inputs.model,
-    skills: skills.map((skill) => ({ name: skill.name, description: skill.description })),
+    // This is the ONLY place the model learns which skills exist, which is what makes
+    // `disable-model-invocation` enforceable rather than decorative. The scaffold had been writing
+    // authorization frontmatter that the parser discarded, so the default was disclose-all.
+    //
+    // A disclosure rule, not an execution rule: `skills.get(name)` still resolves a hidden skill,
+    // because a caller naming one has already made the decision this field keeps away from the
+    // model. Widening it to execution would break the case the field is FOR — a side-effecting
+    // skill a human may run and the model may not propose.
+    skills: skills.filter((skill) => skill.disableModelInvocation !== true).map((skill) => ({ name: skill.name, description: skill.description })),
     userMessage: userText,
     memory: memoryFacts.map((fact) => ({ text: fact.text }))
   };
@@ -4067,14 +4229,24 @@ var ContextSourceFrontmatterSchema = z.object({
 
 // src/internal/runtime/context/context-manager.ts
 var FileContextManager = class {
-  constructor(cwd, settings, settingSourcesIncludeProject) {
+  /**
+   * @param compatSources - What the consumer declared in `local.compatSources` (or
+   * `.theokit/config.json`), as `resolveCompatSources` resolved it. `undefined` means the caller
+   * did not thread the declaration through at all and every dialect runs — the pre-#652 behaviour,
+   * kept so an internal caller constructing this directly does not silently lose content. An empty
+   * ARRAY is different and is the fix: it means the consumer declared no foreign dialect, so
+   * `.claude/rules/*.md` does not reach the prompt.
+   */
+  constructor(cwd, settings, settingSourcesIncludeProject, compatSources) {
     this.cwd = cwd;
     this.settings = settings;
     this.settingSourcesIncludeProject = settingSourcesIncludeProject;
+    this.compatSources = compatSources;
   }
   cwd;
   settings;
   settingSourcesIncludeProject;
+  compatSources;
   state;
   /**
    * The in-scope file set used by the most recent `refresh`. Tracked so
@@ -4083,6 +4255,19 @@ var FileContextManager = class {
    * snapshot untouched, at zero per-send cost.
    */
   lastScope = [];
+  /**
+   * The dialect kinds granted the `context` surface, or `undefined` when nothing was declared to
+   * this instance.
+   *
+   * Routed through `adaptersForSurface` rather than reading `.kind` off the declarations, so the
+   * three fail-closed rules #524 established govern this surface identically to the other four: a
+   * bare string admits everything, an object with no `import` admits nothing, and an unrecognised
+   * surface name narrows rather than widens.
+   */
+  grantedContextDialects() {
+    if (this.compatSources === void 0) return void 0;
+    return adaptersForSurface(this.compatSources, "context").map((a) => a.kind);
+  }
   async initialize() {
     if (!this.settingSourcesIncludeProject && this.settings.manager !== "file") {
       this.state = { config: { sources: [] }, loadedSources: [] };
@@ -4110,11 +4295,16 @@ var FileContextManager = class {
     const legacy = await loadSources(config, this.cwd);
     const maxBytesPerFile = this.settings.maxBytesPerFile ?? DEFAULT_MAX_BYTES_PER_FILE;
     const maxBytesTotal = this.settings.maxBytesTotal ?? DEFAULT_MAX_BYTES_TOTAL;
+    const granted = this.grantedContextDialects();
     const discovered = await runDiscovery({
       cwd: this.cwd,
       maxBytesPerFile,
       skipLegacyTheokitContext: true,
-      touchedFiles
+      touchedFiles,
+      // #652 — the grant this path never consulted. Without it, a consumer who enabled project
+      // scope for its OWN `.theokit/` also received a cloned repository's `.claude/rules/*.md`,
+      // through a door the hooks/skills/subagents/plugins gate does not cover.
+      ...granted === void 0 ? {} : { declaredCompatKinds: granted }
     });
     const legacyAsAggregator = legacy.filter((src) => src.status !== "excluded").map((src) => ({
       id: src.name,
@@ -4509,7 +4699,12 @@ function buildContext(args, out) {
   out.context = new FileContextManager(
     args.workspaceCwd,
     args.options.context,
-    args.settingSourcesIncludeProject
+    args.settingSourcesIncludeProject,
+    // #652 — the same declaration `buildSkills` and `buildPlugins` already pass. Omitting it here
+    // is what let a foreign root's instructions into the system prompt while its skills, subagents,
+    // hooks and plugins were correctly withheld: four surfaces failing closed and a fifth nobody
+    // had wired to the gate.
+    resolveCompatSources(args.options, args.workspaceCwd)
   );
 }
 function buildProviders(args, out) {
@@ -9157,7 +9352,7 @@ async function* localAgentStreamToCompletion(agent, message, options) {
 async function localAgentFork(parent, options) {
   const { forkAgentImpl } = await import('./fork-agent-S2EPIML7.js');
   const { getAgentFacade } = await import('./agent-factory-registry-ZVTABLEY.js');
-  const { withPersonalityContext } = await import('./context-3HPU754C.js');
+  const { withPersonalityContext } = await import('./context-J5BJ3LBS.js');
   const create = getAgentFacade().create;
   return withPersonalityContext(
     { slug: parent.personalitySlugSnapshot, isFork: true },
@@ -10934,7 +11129,7 @@ var Agent = class _Agent {
    */
   static async describe(agentId) {
     const agent = await getRegisteredAgentOrThrow(agentId);
-    const { loadSubagents: loadSubagents2 } = await import('./subagents-loader-AIVDQ2D5.js');
+    const { loadSubagents: loadSubagents2 } = await import('./subagents-loader-CJFYQQU2.js');
     const settingSources = agent.options.local?.settingSources;
     const subagents = await loadSubagents2(
       agent.cwd ?? process.cwd(),
@@ -11040,6 +11235,6 @@ async function openLocalStore(reg) {
   return { cwd, model, store: new FsSessionStore2({ baseDir, cwd }) };
 }
 
-export { Agent, AgentBuilder, DEFAULT_AGENTIC_MODEL_ID, MEMORY_EMBEDDING_ADAPTERS, Tool, ToolError, UsageAccumulator, computeCost, generateCronId, getPricingEntry, openRouterMemoryEmbeddingProviderAdapter, resolveSessionDir };
-//# sourceMappingURL=chunk-ODBID5TG.js.map
-//# sourceMappingURL=chunk-ODBID5TG.js.map
+export { Agent, AgentBuilder, DEFAULT_AGENTIC_MODEL_ID, MEMORY_EMBEDDING_ADAPTERS, Tool, ToolError, UsageAccumulator, computeCost, generateCronId, getPricingEntry, managedSettingsPathFor, openRouterMemoryEmbeddingProviderAdapter, readManagedSettings, resolveSessionDir };
+//# sourceMappingURL=chunk-2UXQASTX.js.map
+//# sourceMappingURL=chunk-2UXQASTX.js.map