@theokit/sdk 5.5.0 → 5.6.0

package/dist/{chunk-UKJJRU7C.cjs → chunk-GCHZMH42.cjs}

@@ -2,22 +2,22 @@
 
 var chunkKVSAY6NZ_cjs = require('./chunk-KVSAY6NZ.cjs');
 var chunkDZG77WU7_cjs = require('./chunk-DZG77WU7.cjs');
-var chunkZ2JFX372_cjs = require('./chunk-Z2JFX372.cjs');
-var chunkVY6NKMOA_cjs = require('./chunk-VY6NKMOA.cjs');
+var chunkVUHXC74Q_cjs = require('./chunk-VUHXC74Q.cjs');
+var chunk7IZKTQ5G_cjs = require('./chunk-7IZKTQ5G.cjs');
 var chunkBV2MWEMV_cjs = require('./chunk-BV2MWEMV.cjs');
 var chunkD6POWE7E_cjs = require('./chunk-D6POWE7E.cjs');
 var chunkTMKTSYDS_cjs = require('./chunk-TMKTSYDS.cjs');
-var chunkNQTNSHSB_cjs = require('./chunk-NQTNSHSB.cjs');
+var chunkGFFBXSQT_cjs = require('./chunk-GFFBXSQT.cjs');
 var chunk7FDKWDA2_cjs = require('./chunk-7FDKWDA2.cjs');
 var chunkC4ZQPWXJ_cjs = require('./chunk-C4ZQPWXJ.cjs');
 var chunk2ZPEDVLM_cjs = require('./chunk-2ZPEDVLM.cjs');
-var chunkIU5N5224_cjs = require('./chunk-IU5N5224.cjs');
+var chunkEIOMN5VA_cjs = require('./chunk-EIOMN5VA.cjs');
 var chunkRQMCOFAI_cjs = require('./chunk-RQMCOFAI.cjs');
 var chunkAA27GEYS_cjs = require('./chunk-AA27GEYS.cjs');
 var chunkYSTXFWQE_cjs = require('./chunk-YSTXFWQE.cjs');
 var chunkNQTD6QOW_cjs = require('./chunk-NQTD6QOW.cjs');
 var chunkNINIJCHU_cjs = require('./chunk-NINIJCHU.cjs');
-var chunkQATRS7JD_cjs = require('./chunk-QATRS7JD.cjs');
+var chunkMYJGWS2J_cjs = require('./chunk-MYJGWS2J.cjs');
 var chunkIJ7M6GOG_cjs = require('./chunk-IJ7M6GOG.cjs');
 var chunk7A6535RA_cjs = require('./chunk-7A6535RA.cjs');
 var chunkSA6K24NB_cjs = require('./chunk-SA6K24NB.cjs');
@@ -26,9 +26,9 @@ var chunkGZV6AVRL_cjs = require('./chunk-GZV6AVRL.cjs');
 var chunkBJUJT5ED_cjs = require('./chunk-BJUJT5ED.cjs');
 var chunkZF2LDKQQ_cjs = require('./chunk-ZF2LDKQQ.cjs');
 var chunkJLRLCBJ4_cjs = require('./chunk-JLRLCBJ4.cjs');
-var chunkAYA65JA5_cjs = require('./chunk-AYA65JA5.cjs');
-var chunk43YXGD3P_cjs = require('./chunk-43YXGD3P.cjs');
-var chunkHW7SEELD_cjs = require('./chunk-HW7SEELD.cjs');
+var chunkRWPLWMCZ_cjs = require('./chunk-RWPLWMCZ.cjs');
+var chunkTY56BKSK_cjs = require('./chunk-TY56BKSK.cjs');
+var chunkQRVS2PRE_cjs = require('./chunk-QRVS2PRE.cjs');
 var chunkATT276RD_cjs = require('./chunk-ATT276RD.cjs');
 var chunk3EE6LVWT_cjs = require('./chunk-3EE6LVWT.cjs');
 var chunkANMJJD6D_cjs = require('./chunk-ANMJJD6D.cjs');
@@ -40,6 +40,7 @@ var promises = require('fs/promises');
 var crypto = require('crypto');
 var path = require('path');
 var fs = require('fs');
+var process$1 = require('process');
 var child_process = require('child_process');
 var zod = require('zod');
 var module$1 = require('module');
@@ -383,7 +384,7 @@ function serializeAgents(agents2) {
   return out;
 }
 function registryPath(cwd) {
-  return path.join(chunk43YXGD3P_cjs.theokitConfigRoot(cwd), REGISTRY_RELATIVE_SUFFIX);
+  return path.join(chunkTY56BKSK_cjs.theokitConfigRoot(cwd), REGISTRY_RELATIVE_SUFFIX);
 }
 async function loadRegistry(cwd) {
   void chunkJLRLCBJ4_cjs.sweepStaleAtomicTemps(registryPath(cwd)).catch(() => void 0);
@@ -818,7 +819,7 @@ async function readLegacyFacts(jsonPath) {
 }
 async function writeMigratedFacts(cwd, jsonPath, facts) {
   try {
-    for (const fact of facts) await chunkNQTNSHSB_cjs.appendFactToMarkdown(cwd, fact);
+    for (const fact of facts) await chunkGFFBXSQT_cjs.appendFactToMarkdown(cwd, fact);
     await promises.unlink(jsonPath).catch(() => void 0);
     chunk6LHQPOMI_cjs.diag(`[theokit-sdk] migrated ${facts.length} fact(s) from ${jsonPath} to MEMORY.md
 `);
@@ -835,11 +836,11 @@ async function migrateLegacyJson(cwd, config) {
   const key = `${cwd}::${config.namespace ?? "default"}::${config.scope ?? "agent"}::${config.userId ?? "default"}`;
   if (migrationRun.has(key)) return { migrated: false, factCount: 0, reason: "already-migrated" };
   migrationRun.add(key);
-  const jsonPath = chunkNQTNSHSB_cjs.legacyMemoryJsonPath(cwd, config);
+  const jsonPath = chunkGFFBXSQT_cjs.legacyMemoryJsonPath(cwd, config);
   if (!await fileExists(jsonPath)) {
     return { migrated: false, factCount: 0, reason: "no-legacy-json" };
   }
-  if (await fileExists(chunkNQTNSHSB_cjs.memoryMdPath(chunkNQTNSHSB_cjs.resolveMemoryRoot(cwd, config)))) {
+  if (await fileExists(chunkGFFBXSQT_cjs.memoryMdPath(chunkGFFBXSQT_cjs.resolveMemoryRoot(cwd, config)))) {
     chunk6LHQPOMI_cjs.diag(
       `[theokit-sdk] memory migration skipped: both MEMORY.md and legacy JSON exist at ${jsonPath}; leaving both intact
 `
@@ -868,19 +869,19 @@ function unstoredRememberWarning(message) {
   if (isMemoryWritePrompt(message) && extractMemoryFact(message).length > 0) return void 0;
   const trimmed = message.trim();
   const quoted = trimmed.length > QUOTED_MESSAGE_MAX ? `${trimmed.slice(0, QUOTED_MESSAGE_MAX)}\u2026` : trimmed;
-  return `[theokit-sdk] NOTHING WAS STORED \u2014 this message does not match the memory capture pattern: ${JSON.stringify(quoted)}. Supported: "Remember: <fact>" or "Remember (${chunkNQTNSHSB_cjs.MEMORY_KINDS.join("|")}): <fact>". It still reaches the session transcript, so a follow-up may answer from it \u2014 that is search over transcripts, not a durable memory.`;
+  return `[theokit-sdk] NOTHING WAS STORED \u2014 this message does not match the memory capture pattern: ${JSON.stringify(quoted)}. Supported: "Remember: <fact>" or "Remember (${chunkGFFBXSQT_cjs.MEMORY_KINDS.join("|")}): <fact>". It still reaches the session transcript, so a follow-up may answer from it \u2014 that is search over transcripts, not a durable memory.`;
 }
 function extractMemoryKind(message) {
   const match = REMEMBER_PATTERN.exec(message);
   const declared = match?.[1];
   if (declared === void 0) return void 0;
   const lowered = declared.toLowerCase();
-  return chunkNQTNSHSB_cjs.MEMORY_KINDS.includes(lowered) ? lowered : void 0;
+  return chunkGFFBXSQT_cjs.MEMORY_KINDS.includes(lowered) ? lowered : void 0;
 }
 async function readMemoryFacts(cwd, config) {
   if (!config.enabled) return [];
   await migrateLegacyJson(cwd, config);
-  return chunkNQTNSHSB_cjs.readFacts(cwd, config);
+  return chunkGFFBXSQT_cjs.readFacts(cwd, config);
 }
 async function appendMemoryFact(cwd, config, fact) {
   if (!config.enabled) return;
@@ -889,7 +890,7 @@ async function appendMemoryFact(cwd, config, fact) {
     text: chunk6LHQPOMI_cjs.redactSecrets(fact.text),
     ...fact.kind === void 0 ? {} : { kind: fact.kind }
   };
-  await chunkNQTNSHSB_cjs.appendFact(cwd, config, sanitized);
+  await chunkGFFBXSQT_cjs.appendFact(cwd, config, sanitized);
 }
 
 // src/internal/runtime/fixtures/fixture-scripts.ts
@@ -2122,14 +2123,14 @@ async function readState(filePath) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    chunkVY6NKMOA_cjs.warnOnce(
+    chunk7IZKTQ5G_cjs.warnOnce(
       "personality-store-json-parse",
       "[theokit-sdk] personality.json is malformed; treating as empty"
     );
     return emptyState();
   }
   if (!isStateV1(parsed)) {
-    chunkVY6NKMOA_cjs.warnOnce(
+    chunk7IZKTQ5G_cjs.warnOnce(
       "personality-store-bad-version",
       `[theokit-sdk] personality.json has unknown version; treating as empty (file kept untouched)`
     );
@@ -2160,7 +2161,7 @@ var PersonalityStore = class {
       try {
         await this.#persist(agentId, slug);
       } catch (err) {
-        chunkVY6NKMOA_cjs.warnOnce(
+        chunk7IZKTQ5G_cjs.warnOnce(
           `personality-store-persist-failure-${agentId}`,
           `[theokit-sdk] personality persist failed for ${chunk6LHQPOMI_cjs.redactSecrets(agentId)}: ${chunk6LHQPOMI_cjs.redactSecrets(
             err.message
@@ -2177,7 +2178,7 @@ var PersonalityStore = class {
     try {
       state = await readState(filePath);
     } catch (err) {
-      chunkVY6NKMOA_cjs.warnOnce(
+      chunk7IZKTQ5G_cjs.warnOnce(
         `personality-store-hydrate-failure-${agentId}`,
         `[theokit-sdk] personality hydrate failed for ${chunk6LHQPOMI_cjs.redactSecrets(agentId)}: ${chunk6LHQPOMI_cjs.redactSecrets(
           err.message
@@ -2206,7 +2207,7 @@ var PersonalityStore = class {
     });
   }
   #filePath() {
-    return path.join(chunk43YXGD3P_cjs.getTheokitHome(this.#cwd), FILE_NAME);
+    return path.join(chunkTY56BKSK_cjs.getTheokitHome(this.#cwd), FILE_NAME);
   }
 };
 
@@ -2523,7 +2524,7 @@ function removeAll(arr, toRemove) {
   }
 }
 function readCompatConfigFile(cwd) {
-  const path$1 = path.join(chunk43YXGD3P_cjs.theokitConfigRoot(cwd), "config.json");
+  const path$1 = path.join(chunkTY56BKSK_cjs.theokitConfigRoot(cwd), "config.json");
   if (!fs.existsSync(path$1)) return [];
   let raw;
   try {
@@ -2553,6 +2554,116 @@ function readCompatConfigFile(cwd) {
 function resolveCompatSources(options, cwd) {
   return options.local?.compatSources ?? readCompatConfigFile(cwd);
 }
+var KNOWN_KEYS = /* @__PURE__ */ new Set([
+  "disableAllHooks",
+  "disableSkillShellExecution",
+  "permissions",
+  "permissionMode"
+]);
+function managedSettingsPathFor(root) {
+  if (root !== void 0) return path.join(root, "claude-code", "managed-settings.json");
+  if (process$1.platform === "darwin") {
+    return "/Library/Application Support/ClaudeCode/managed-settings.json";
+  }
+  if (process$1.platform === "win32") {
+    const programData = process.env.PROGRAMDATA ?? "C:\\ProgramData";
+    return path.join(programData, "ClaudeCode", "managed-settings.json");
+  }
+  return "/etc/claude-code/managed-settings.json";
+}
+function readManagedSettings(root) {
+  const path = managedSettingsPathFor(root);
+  const parsed = readPolicyDocument(path);
+  if (parsed === void 0) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    applyPolicyKey(out, key, value, path);
+  }
+  return out;
+}
+function readPolicyDocument(path) {
+  if (!fs.existsSync(path)) return void 0;
+  let raw;
+  try {
+    raw = fs.readFileSync(path, "utf8");
+  } catch (cause) {
+    chunk6LHQPOMI_cjs.diagFailure(
+      `[theokit-sdk] ${path} exists and could not be read (${cause.message}) \u2014 NO operator policy is being applied. Fix the permissions or remove the file.
+`
+    );
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (cause) {
+    chunk6LHQPOMI_cjs.diagFailure(
+      `[theokit-sdk] ${path} is not valid JSON (${cause.message}) \u2014 NO operator policy is being applied.
+`
+    );
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    chunk6LHQPOMI_cjs.diagFailure(
+      `[theokit-sdk] ${path} is not a JSON object \u2014 NO operator policy is being applied.
+`
+    );
+    return void 0;
+  }
+  return parsed;
+}
+var PERMISSION_MODES = ["default", "plan", "acceptEdits", "bypass"];
+function applyPolicyKey(out, key, value, path) {
+  if (!KNOWN_KEYS.has(key)) {
+    decline(path, key, "this runtime does not enforce it");
+    return;
+  }
+  if (key === "permissionMode") {
+    const mode = readMode(value, path);
+    if (mode !== void 0) out.permissionMode = mode;
+    return;
+  }
+  if (key === "permissions") {
+    const rules = readRuleLists(value, path);
+    if (rules !== void 0) out.permissions = rules;
+    return;
+  }
+  const flag = readBoolean(value, key, path);
+  if (flag === void 0) return;
+  if (key === "disableAllHooks") out.disableAllHooks = flag;
+  if (key === "disableSkillShellExecution") out.disableSkillShellExecution = flag;
+}
+function decline(path, key, reason) {
+  chunk6LHQPOMI_cjs.diagFailure(`[theokit-sdk] ${path} declares "${key}" \u2014 ${reason}. It is NOT being applied.
+`);
+}
+function readMode(value, path) {
+  if (typeof value === "string" && PERMISSION_MODES.includes(value)) {
+    return value;
+  }
+  decline(
+    path,
+    "permissionMode",
+    `${JSON.stringify(value)} is not one of ${PERMISSION_MODES.join(", ")}`
+  );
+  return void 0;
+}
+function readRuleLists(value, path) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    return value;
+  }
+  decline(
+    path,
+    "permissions",
+    `it is ${Array.isArray(value) ? "an array" : typeof value}, not an object of rule lists`
+  );
+  return void 0;
+}
+function readBoolean(value, key, path) {
+  if (typeof value === "boolean") return value;
+  decline(path, key, `it is ${typeof value}, not a boolean`);
+  return void 0;
+}
 function spawnAndCollect(options) {
   return new Promise((resolve) => {
     const timeoutMs = options.timeoutMs ?? 3e4;
@@ -2603,21 +2714,31 @@ function spawnAndCollect(options) {
 
 // src/internal/runtime/hooks/hooks-executor.ts
 var HooksExecutor = class {
-  constructor(cwd, compatSources = [], gate = void 0) {
+  constructor(cwd, compatSources = [], gate = void 0, policy = {}) {
     this.cwd = cwd;
     this.compatSources = compatSources;
     this.gate = gate;
+    this.policy = policy;
   }
   cwd;
   compatSources;
   gate;
+  policy;
   config = {};
   async initialize(settingSourcesIncludeProject) {
+    if (readManagedSettings(this.policy.managedSettingsRoot).disableAllHooks === true) {
+      chunk7IZKTQ5G_cjs.warnFailureOnce(
+        "hooks-disabled-by-policy",
+        "[theokit-sdk] hooks: an operator policy (managed-settings.json) declares disableAllHooks \u2014 NO hook will run, including any this project declared."
+      );
+      this.config = {};
+      return;
+    }
     if (!settingSourcesIncludeProject) {
       this.config = {};
       return;
     }
-    this.config = await chunkVY6NKMOA_cjs.loadHookConfig(this.cwd, this.compatSources);
+    this.config = await chunk7IZKTQ5G_cjs.loadHookConfig(this.cwd, this.compatSources);
   }
   /** Fire every hook registered for `event` and aggregate the decisions. */
   async run(payload) {
@@ -2684,7 +2805,7 @@ var HooksExecutor = class {
       cwd: this.cwd,
       ...Object.keys(env).length > 0 ? { env } : {},
       timeoutMs,
-      stdin: JSON.stringify(payload)
+      stdin: JSON.stringify(stdinPayloadFor(payload, command, this.cwd))
     });
     const failure = this.decisionFromFailure(result, command, env, timeoutMs);
     return failure ?? parseDecisionFromStdout(result.stdout);
@@ -2698,14 +2819,21 @@ var HooksExecutor = class {
    * spawned.
    */
   decisionFromFailure(result, command, env, timeoutMs) {
-    if (result.timedOut) return { decision: "deny", reason: `Hook timed out after ${timeoutMs}ms` };
+    if (result.timedOut)
+      return {
+        decision: "deny",
+        reason: `Hook timed out after ${timeoutMs}ms`
+      };
     if (result.spawnError !== void 0) {
-      return { decision: "deny", reason: `Hook spawn failed: ${result.spawnError.message}` };
+      return {
+        decision: "deny",
+        reason: `Hook spawn failed: ${result.spawnError.message}`
+      };
     }
     if (result.exitCode === 0) return void 0;
     const stderr = result.stderr.trim();
     const base = stderr.length > 0 ? stderr : `Hook exited with code ${result.exitCode}`;
-    const missing = chunk43YXGD3P_cjs.undefinedVariablesIn(command.command, env);
+    const missing = chunkTY56BKSK_cjs.undefinedVariablesIn(command.command, env);
     if (missing.length === 0) return { decision: "deny", reason: base };
     return {
       decision: "deny",
@@ -2713,26 +2841,52 @@ var HooksExecutor = class {
     };
   }
 };
+function stdinPayloadFor(payload, command, cwd) {
+  return {
+    ...payload,
+    cwd,
+    ...command.sourceEvent === void 0 ? {} : { hook_event_name: command.sourceEvent },
+    ...payload.tool === void 0 ? {} : { tool_name: payload.tool },
+    ...payload.input === void 0 ? {} : { tool_input: payload.input },
+    ...payload.output === void 0 ? {} : { tool_response: payload.output }
+  };
+}
 function runtimeEnvFor(sourcePath, cwd) {
   if (sourcePath === void 0) return {};
-  return chunk43YXGD3P_cjs.adapterForConfigPath(sourcePath)?.runtimeEnv(cwd) ?? {};
+  return chunkTY56BKSK_cjs.adapterForConfigPath(sourcePath)?.runtimeEnv(cwd) ?? {};
 }
 function parseDecisionFromStdout(stdout) {
   const trimmed = stdout.trim();
   if (trimmed.length === 0) return { decision: "allow" };
+  let parsed;
   try {
-    const parsed = JSON.parse(trimmed);
-    if (parsed.decision === "deny" || parsed.decision === "feedback") {
-      const result = { decision: parsed.decision };
-      if (parsed.reason !== void 0) result.reason = parsed.reason;
-      if (parsed.feedback !== void 0) result.feedback = parsed.feedback;
-      return result;
-    }
-    if (parsed.decision === "allow") return { decision: "allow" };
+    parsed = JSON.parse(trimmed);
   } catch {
     return { decision: "feedback", feedback: trimmed };
   }
-  return { decision: "allow" };
+  return nestedDecision(parsed) ?? flatDecision(parsed) ?? { decision: "allow" };
+}
+function nestedDecision(parsed) {
+  const nested = parsed.hookSpecificOutput;
+  if (nested?.permissionDecision === "allow") return { decision: "allow" };
+  if (nested?.permissionDecision !== "deny" && nested?.permissionDecision !== "ask") {
+    return void 0;
+  }
+  const result = { decision: "deny" };
+  if (nested.permissionDecisionReason !== void 0) {
+    result.reason = nested.permissionDecisionReason;
+  }
+  return result;
+}
+function flatDecision(parsed) {
+  if (parsed.decision === "allow") return { decision: "allow" };
+  if (parsed.decision !== "deny" && parsed.decision !== "block" && parsed.decision !== "feedback") {
+    return void 0;
+  }
+  const result = parsed.decision === "feedback" ? { decision: "feedback" } : { decision: "deny" };
+  if (parsed.reason !== void 0) result.reason = parsed.reason;
+  if (parsed.feedback !== void 0) result.feedback = parsed.feedback;
+  return result;
 }
 
 // src/internal/runtime/lifecycle/context-budget-event.ts
@@ -2824,7 +2978,7 @@ async function runPostRunLifecycle(inputs) {
       cwd: workspaceCwd,
       // Resolved once, here, and handed to both writers. Recomputing it inside either one is how
       // the summary ended up in a directory the indexer never scanned (#463).
-      memoryRoot: chunkNQTNSHSB_cjs.resolveMemoryRoot(workspaceCwd, inputs.memory),
+      memoryRoot: chunkGFFBXSQT_cjs.resolveMemoryRoot(workspaceCwd, inputs.memory),
       runId: result.id,
       agentId,
       userText,
@@ -2836,7 +2990,7 @@ async function runPostRunLifecycle(inputs) {
       if (memoryProvider?.recordSessionSummary !== void 0) {
         await memoryProvider.recordSessionSummary(summaryArgs);
       } else {
-        await chunkNQTNSHSB_cjs.writeSessionSummary(summaryArgs);
+        await chunkGFFBXSQT_cjs.writeSessionSummary(summaryArgs);
       }
     } catch (cause) {
       const message = cause instanceof Error ? cause.message : String(cause);
@@ -2888,15 +3042,15 @@ var SkillsManager = class {
   }
   async refresh() {
     const roots = this.skillsDir === void 0 ? [
-      ...chunk43YXGD3P_cjs.projectConfigRoots(this.cwd, this.compatSources, "skills").map(
+      ...chunkTY56BKSK_cjs.projectConfigRoots(this.cwd, this.compatSources, "skills").map(
         (root) => path.join(root, "skills")
       ),
-      ...(await chunkAYA65JA5_cjs.pluginBundleDirs(this.cwd, this.compatSources)).map((b) => path.join(b, "skills"))
+      ...(await chunkRWPLWMCZ_cjs.pluginBundleDirs(this.cwd, this.compatSources)).map((b) => path.join(b, "skills"))
     ] : [this.skillsDir];
     const discovered = [];
     const seen = /* @__PURE__ */ new Set();
     for (const root of roots) {
-      for (const skill of await chunkQATRS7JD_cjs.discoverSkills(root, {
+      for (const skill of await chunkMYJGWS2J_cjs.discoverSkills(root, {
         onInvalidSkill: (info) => {
           chunk6LHQPOMI_cjs.diag(`[theokit-sdk] skill ${info.name} skipped (${info.code}): ${info.message}
 `);
@@ -2927,7 +3081,7 @@ var SkillsManager = class {
   async get(name) {
     const skill = this.skills.find((s) => s.name === name);
     if (skill === void 0) return void 0;
-    const instructions = typeof skill.instructions === "string" ? skill.instructions : chunkQATRS7JD_cjs.stripSkillFrontmatter(await promises.readFile(skill.source, "utf8"));
+    const instructions = typeof skill.instructions === "string" ? skill.instructions : chunkMYJGWS2J_cjs.stripSkillFrontmatter(await promises.readFile(skill.source, "utf8"));
     const references = skill.references;
     return {
       name: skill.name,
@@ -3046,7 +3200,15 @@ async function buildSystemPromptContext(inputs, userText, memoryFacts, manager =
     agentId: inputs.agentId,
     cwd: inputs.workspaceCwd,
     model: inputs.model,
-    skills: skills.map((skill) => ({ name: skill.name, description: skill.description })),
+    // This is the ONLY place the model learns which skills exist, which is what makes
+    // `disable-model-invocation` enforceable rather than decorative. The scaffold had been writing
+    // authorization frontmatter that the parser discarded, so the default was disclose-all.
+    //
+    // A disclosure rule, not an execution rule: `skills.get(name)` still resolves a hidden skill,
+    // because a caller naming one has already made the decision this field keeps away from the
+    // model. Widening it to execution would break the case the field is FOR — a side-effecting
+    // skill a human may run and the model may not propose.
+    skills: skills.filter((skill) => skill.disableModelInvocation !== true).map((skill) => ({ name: skill.name, description: skill.description })),
     userMessage: userText,
     memory: memoryFacts.map((fact) => ({ text: fact.text }))
   };
@@ -3106,7 +3268,7 @@ var ActiveMemoryPromptProvider = class {
     if (ctx.activeMemorySummary === void 0 || ctx.activeMemorySummary.length === 0) {
       return Promise.resolve(void 0);
     }
-    const body = chunkQATRS7JD_cjs.escapeBlockBody(ctx.activeMemorySummary);
+    const body = chunkMYJGWS2J_cjs.escapeBlockBody(ctx.activeMemorySummary);
     return Promise.resolve(`<active-memory>
 ${body}
 </active-memory>`);
@@ -3159,7 +3321,7 @@ function formatSource(name, tokens) {
   if (tokens.length === 0) {
     return `  <source name="${escapeAttribute(name)}" />`;
   }
-  const body = chunkQATRS7JD_cjs.escapeBlockBody(tokens.join(" "));
+  const body = chunkMYJGWS2J_cjs.escapeBlockBody(tokens.join(" "));
   return `  <source name="${escapeAttribute(name)}">
     ${body}
   </source>`;
@@ -3183,7 +3345,7 @@ var MemoryPromptProvider = class {
     if (ctx.memory.length === 0) return Promise.resolve(void 0);
     const lines = ctx.memory.map((fact) => {
       const tag = fact.observations === 1 ? "[unconfirmed] " : "";
-      return `  - ${tag}${chunkQATRS7JD_cjs.escapeBlockBody(fact.text)}`;
+      return `  - ${tag}${chunkMYJGWS2J_cjs.escapeBlockBody(fact.text)}`;
     });
     return Promise.resolve(`${MEMORY_GUIDANCE}
 <memory>
@@ -3207,7 +3369,7 @@ var SkillsPromptProvider = class {
   priority = 20;
   contribute(ctx) {
     if (ctx.skillsAutoInject === false) return Promise.resolve(void 0);
-    return Promise.resolve(chunkQATRS7JD_cjs.buildSkillsBlock(ctx.skills));
+    return Promise.resolve(chunkMYJGWS2J_cjs.buildSkillsBlock(ctx.skills));
   }
 };
 
@@ -3475,7 +3637,7 @@ var HISTOGRAM_NAMES = {
 };
 function safeRequire(moduleName) {
   try {
-    const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-UKJJRU7C.cjs', document.baseURI).href)));
+    const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-GCHZMH42.cjs', document.baseURI).href)));
     return r(moduleName);
   } catch {
     return void 0;
@@ -3718,7 +3880,7 @@ var cachedOtel;
 function loadOtel() {
   if (cachedOtel === void 0) {
     try {
-      const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-UKJJRU7C.cjs', document.baseURI).href)));
+      const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-GCHZMH42.cjs', document.baseURI).href)));
       const mod = r("@opentelemetry/api");
       cachedOtel = mod;
     } catch {
@@ -3955,7 +4117,7 @@ async function loadMarkdownEntities(opts) {
     const raw = await promises.readFile(resolved.source, "utf8").catch(() => null);
     if (raw === null) continue;
     const split = splitFrontmatter(raw, resolved.source, errorCodePrefix);
-    const fields = chunkHW7SEELD_cjs.parseSimpleYaml(split.frontmatter);
+    const fields = chunkQRVS2PRE_cjs.parseSimpleYaml(split.frontmatter);
     const parsed = schema.safeParse(fields);
     if (!parsed.success) {
       throw new chunkJ7J7J2GN_cjs.ConfigurationError(
@@ -4037,7 +4199,7 @@ function applyAggregateCap(sources, maxTotal) {
     }
     const remaining = maxTotal - totalBytes;
     if (remaining > 0) {
-      const { finalContent } = chunkIU5N5224_cjs.truncateWithMarker(s.content, remaining);
+      const { finalContent } = chunkEIOMN5VA_cjs.truncateWithMarker(s.content, remaining);
       kept.push({ ...s, content: finalContent, truncated: true });
       totalBytes = maxTotal;
     } else {
@@ -4070,14 +4232,24 @@ var ContextSourceFrontmatterSchema = zod.z.object({
 
 // src/internal/runtime/context/context-manager.ts
 var FileContextManager = class {
-  constructor(cwd, settings, settingSourcesIncludeProject) {
+  /**
+   * @param compatSources - What the consumer declared in `local.compatSources` (or
+   * `.theokit/config.json`), as `resolveCompatSources` resolved it. `undefined` means the caller
+   * did not thread the declaration through at all and every dialect runs — the pre-#652 behaviour,
+   * kept so an internal caller constructing this directly does not silently lose content. An empty
+   * ARRAY is different and is the fix: it means the consumer declared no foreign dialect, so
+   * `.claude/rules/*.md` does not reach the prompt.
+   */
+  constructor(cwd, settings, settingSourcesIncludeProject, compatSources) {
     this.cwd = cwd;
     this.settings = settings;
     this.settingSourcesIncludeProject = settingSourcesIncludeProject;
+    this.compatSources = compatSources;
   }
   cwd;
   settings;
   settingSourcesIncludeProject;
+  compatSources;
   state;
   /**
    * The in-scope file set used by the most recent `refresh`. Tracked so
@@ -4086,6 +4258,19 @@ var FileContextManager = class {
    * snapshot untouched, at zero per-send cost.
    */
   lastScope = [];
+  /**
+   * The dialect kinds granted the `context` surface, or `undefined` when nothing was declared to
+   * this instance.
+   *
+   * Routed through `adaptersForSurface` rather than reading `.kind` off the declarations, so the
+   * three fail-closed rules #524 established govern this surface identically to the other four: a
+   * bare string admits everything, an object with no `import` admits nothing, and an unrecognised
+   * surface name narrows rather than widens.
+   */
+  grantedContextDialects() {
+    if (this.compatSources === void 0) return void 0;
+    return chunkTY56BKSK_cjs.adaptersForSurface(this.compatSources, "context").map((a) => a.kind);
+  }
   async initialize() {
     if (!this.settingSourcesIncludeProject && this.settings.manager !== "file") {
       this.state = { config: { sources: [] }, loadedSources: [] };
@@ -4111,13 +4296,18 @@ var FileContextManager = class {
     this.lastScope = [...touchedFiles];
     const config = await loadContextConfig(this.cwd);
     const legacy = await loadSources(config, this.cwd);
-    const maxBytesPerFile = this.settings.maxBytesPerFile ?? chunkIU5N5224_cjs.DEFAULT_MAX_BYTES_PER_FILE;
+    const maxBytesPerFile = this.settings.maxBytesPerFile ?? chunkEIOMN5VA_cjs.DEFAULT_MAX_BYTES_PER_FILE;
     const maxBytesTotal = this.settings.maxBytesTotal ?? DEFAULT_MAX_BYTES_TOTAL;
-    const discovered = await chunkIU5N5224_cjs.runDiscovery({
+    const granted = this.grantedContextDialects();
+    const discovered = await chunkEIOMN5VA_cjs.runDiscovery({
       cwd: this.cwd,
       maxBytesPerFile,
       skipLegacyTheokitContext: true,
-      touchedFiles
+      touchedFiles,
+      // #652 — the grant this path never consulted. Without it, a consumer who enabled project
+      // scope for its OWN `.theokit/` also received a cloned repository's `.claude/rules/*.md`,
+      // through a door the hooks/skills/subagents/plugins gate does not cover.
+      ...granted === void 0 ? {} : { declaredCompatKinds: granted }
     });
     const legacyAsAggregator = legacy.filter((src) => src.status !== "excluded").map((src) => ({
       id: src.name,
@@ -4172,8 +4362,8 @@ var FileContextManager = class {
   }
 };
 async function loadContextConfig(cwd) {
-  const mdDir = path.join(chunk43YXGD3P_cjs.theokitConfigRoot(cwd), "context");
-  const jsonPath = path.join(chunk43YXGD3P_cjs.theokitConfigRoot(cwd), "context.json");
+  const mdDir = path.join(chunkTY56BKSK_cjs.theokitConfigRoot(cwd), "context");
+  const jsonPath = path.join(chunkTY56BKSK_cjs.theokitConfigRoot(cwd), "context.json");
   const mdEntities = await loadMarkdownEntities({
     dir: mdDir,
     schema: ContextSourceFrontmatterSchema,
@@ -4182,7 +4372,7 @@ async function loadContextConfig(cwd) {
   });
   if (mdEntities.length > 0) {
     if (fs.existsSync(jsonPath)) {
-      chunkVY6NKMOA_cjs.warnOnce(
+      chunk7IZKTQ5G_cjs.warnOnce(
         "context-both-present",
         "[theokit-sdk] both .theokit/context/ and .theokit/context.json detected \u2014 using markdown; remove context.json"
       );
@@ -4192,7 +4382,7 @@ async function loadContextConfig(cwd) {
     };
   }
   if (!fs.existsSync(jsonPath)) return { sources: [] };
-  chunkVY6NKMOA_cjs.warnOnce(
+  chunk7IZKTQ5G_cjs.warnOnce(
     "context-json-deprecated",
     // Names no command: `theokit-migrate-config` was unpublished with the `bin` entry, and a warning
     // that tells you to run something the package does not ship is worse than one that tells you
@@ -4333,13 +4523,13 @@ var PluginsManager = class {
   }
   async refresh() {
     this.plugins = [];
-    for (const pluginsRoot of chunk43YXGD3P_cjs.pluginBundleRoots(this.cwd, this.compatSources)) {
+    for (const pluginsRoot of chunkTY56BKSK_cjs.pluginBundleRoots(this.cwd, this.compatSources)) {
       await this.refreshRoot(pluginsRoot);
     }
   }
   // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: MD-first + JSON fallback + CLI location + both-present detection per plugin folder — branch table is clearer inlined.
   async refreshRoot(pluginsRoot) {
-    const entries = await chunkHW7SEELD_cjs.readWorkspaceDir(pluginsRoot, "plugins_read_error", "plugins directory");
+    const entries = await chunkQRVS2PRE_cjs.readWorkspaceDir(pluginsRoot, "plugins_read_error", "plugins directory");
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       const folderName = entry.name;
@@ -4355,13 +4545,13 @@ var PluginsManager = class {
       const jsonPath = path.join(pluginsRoot, folderName, "plugin.json");
       const metadata = fs.existsSync(mdPath) ? await loadPluginManifestFromMarkdown(this.cwd, pluginsRoot, folderName) : await loadPluginManifestFromJson(this.cwd, jsonPath, folderName);
       if (fs.existsSync(mdPath) && fs.existsSync(jsonPath)) {
-        chunkVY6NKMOA_cjs.warnOnce(
+        chunk7IZKTQ5G_cjs.warnOnce(
           `plugin-${folderName}-both`,
           `[theokit-sdk] both ${folderName}/PLUGIN.md and ${folderName}/plugin.json detected \u2014 using markdown; remove plugin.json`
         );
       }
       if (!fs.existsSync(mdPath) && fs.existsSync(jsonPath)) {
-        chunkVY6NKMOA_cjs.warnOnce(
+        chunk7IZKTQ5G_cjs.warnOnce(
           "plugin-json-deprecated",
           // Same reason as the context.json warning: the CLI it used to name is no longer published.
           "[theokit-sdk] plugin.json manifests are deprecated; replace each with a PLUGIN.md"
@@ -4512,7 +4702,12 @@ function buildContext(args, out) {
   out.context = new FileContextManager(
     args.workspaceCwd,
     args.options.context,
-    args.settingSourcesIncludeProject
+    args.settingSourcesIncludeProject,
+    // #652 — the same declaration `buildSkills` and `buildPlugins` already pass. Omitting it here
+    // is what let a foreign root's instructions into the system prompt while its skills, subagents,
+    // hooks and plugins were correctly withheld: four surfaces failing closed and a fifth nobody
+    // had wired to the gate.
+    resolveCompatSources(args.options, args.workspaceCwd)
   );
 }
 function buildProviders(args, out) {
@@ -5607,7 +5802,7 @@ function stripThinkBlocks(content) {
 function resolveSystemPromptWithMemoryAdditions(systemPrompt, additions) {
   if (additions === void 0 || additions.length === 0) return systemPrompt;
   const block = `<active-memory>
-${chunkQATRS7JD_cjs.escapeBlockBody(additions)}
+${chunkMYJGWS2J_cjs.escapeBlockBody(additions)}
 </active-memory>`;
   if (systemPrompt === void 0 || systemPrompt.length === 0) return block;
   return `${block}
@@ -7251,7 +7446,7 @@ function applyPersonalityFilter(exposedTools, whitelist, opts) {
     if (exposedSet.has(name)) continue;
     const hint = suggestClosest(name, exposedSet);
     const message = hint !== void 0 ? `[theokit-sdk] personality "${opts?.personalityName ?? "?"}" references unknown tool "${name}"; did you mean "${hint}"?` : `[theokit-sdk] personality "${opts?.personalityName ?? "?"}" references unknown tool "${name}" (not exposed)`;
-    chunkVY6NKMOA_cjs.warnOnce(
+    chunk7IZKTQ5G_cjs.warnOnce(
       `personality-tool-missing|${opts?.agentId ?? "?"}|${opts?.personalityName ?? "?"}|${name}`,
       message
     );
@@ -7700,7 +7895,7 @@ async function dispatchLocalRun(args) {
   });
 }
 async function readProjectMcpServers(cwd) {
-  const path$1 = path.join(chunk43YXGD3P_cjs.theokitConfigRoot(cwd), "mcp.json");
+  const path$1 = path.join(chunkTY56BKSK_cjs.theokitConfigRoot(cwd), "mcp.json");
   try {
     const raw = await promises.readFile(path$1, "utf8");
     const parsed = JSON.parse(raw);
@@ -7942,7 +8137,7 @@ async function reloadLocalAgent(agent) {
   if (agent.context !== void 0) await agent.context.refresh();
   if (agent.skillsManager !== void 0) await agent.skillsManager.refresh();
   if (agent.pluginsManager !== void 0) await agent.pluginsManager.refresh();
-  return await chunkAYA65JA5_cjs.loadSubagents(
+  return await chunkRWPLWMCZ_cjs.loadSubagents(
     agent.workspaceCwd,
     agent.settingSourcesIncludeProject,
     agent.options.agents
@@ -8188,7 +8383,7 @@ async function finalize(args, queryMode, result) {
   };
   args.cache?.set(args.userText, queryMode, result, tenantCtx);
   if (args.persistTranscripts === true && args.cwd !== void 0) {
-    await chunkTMKTSYDS_cjs.persistActiveMemoryTranscript(args.memoryRoot ?? chunkNQTNSHSB_cjs.resolveMemoryRoot(args.cwd), {
+    await chunkTMKTSYDS_cjs.persistActiveMemoryTranscript(args.memoryRoot ?? chunkGFFBXSQT_cjs.resolveMemoryRoot(args.cwd), {
       runId: args.runId ?? `run-${Date.now()}`,
       startedAtMs: Date.now() - result.durationMs,
       userText: args.userText,
@@ -8779,7 +8974,7 @@ var LocalAgentMemory = class {
       const openOpts = { cwd: this.workspaceCwd, memoryRoot };
       if (embedding !== void 0) openOpts.embedding = embedding;
       if (cfg?.backend !== void 0) openOpts.backend = cfg.backend;
-      this.index = await chunkZ2JFX372_cjs.IndexManager.open(openOpts);
+      this.index = await chunkVUHXC74Q_cjs.IndexManager.open(openOpts);
       await this.index.sync();
       this.toolsCache = [
         createMemorySearchTool({ index: this.index }),
@@ -8823,7 +9018,7 @@ var LocalAgentMemory = class {
    * and the active-memory transcript writer. Three separate resolutions is how they drifted (#463).
    */
   memoryRoot() {
-    this.memoryRootCache ??= chunkNQTNSHSB_cjs.resolveMemoryRoot(this.workspaceCwd, this.options.memory);
+    this.memoryRootCache ??= chunkGFFBXSQT_cjs.resolveMemoryRoot(this.workspaceCwd, this.options.memory);
     return this.memoryRootCache;
   }
   buildActiveMemoryOptions(cfg) {
@@ -8938,7 +9133,7 @@ function createLocalAgentMemoryProvider(opts) {
       return { facts: [], systemPromptAdditions: summary };
     },
     async recordSessionSummary(args) {
-      await chunkNQTNSHSB_cjs.writeSessionSummary(args);
+      await chunkGFFBXSQT_cjs.writeSessionSummary(args);
     },
     async sync(handle) {
       const state = handle[INTERNAL_LAM_KEY];
@@ -8976,7 +9171,7 @@ var PersonalityRegistry = class _PersonalityRegistry {
    * @internal
    */
   static async load(cwd) {
-    const projectDir = path.join(chunk43YXGD3P_cjs.theokitConfigRoot(cwd), PERSONALITIES_SUFFIX);
+    const projectDir = path.join(chunkTY56BKSK_cjs.theokitConfigRoot(cwd), PERSONALITIES_SUFFIX);
     const userDir = path.join(os.homedir(), USER_SUBDIR);
     const [userEntities, projectEntities] = await Promise.all([
       loadMarkdownEntities({
@@ -9028,7 +9223,7 @@ function addEntity(byName, entity, origin, collisionMap) {
     );
   }
   if (origin === "project" && collisionMap?.has(fm.name)) {
-    chunkVY6NKMOA_cjs.warnOnce(
+    chunk7IZKTQ5G_cjs.warnOnce(
       `personality-collision-${fm.name}`,
       `[theokit-sdk] personality "${fm.name}" overridden by project preset`
     );
@@ -9078,14 +9273,14 @@ async function performPersonalitySwitch(args) {
 
 // src/internal/local-agent/local-agent-personality-extensions.ts
 function resolveActivePersonalityPreset(args) {
-  const forkCtx = chunkVY6NKMOA_cjs.currentPersonalityContext();
+  const forkCtx = chunk7IZKTQ5G_cjs.currentPersonalityContext();
   const slug = forkCtx !== void 0 ? forkCtx.slug : args.personalityStore.active(args.agentId);
   if (slug === void 0) return void 0;
   return args.personalityRegistry?.get(slug);
 }
 async function ensurePersonalityRegistryIfNeeded(args) {
   if (args.personalityRegistry !== void 0) return args.personalityRegistry;
-  const forkSlug = chunkVY6NKMOA_cjs.currentPersonalityContext()?.slug;
+  const forkSlug = chunk7IZKTQ5G_cjs.currentPersonalityContext()?.slug;
   const ownSlug = args.personalityStore.active(args.agentId);
   if (forkSlug === void 0 && ownSlug === void 0) return void 0;
   return await PersonalityRegistry.load(args.workspaceCwd);
@@ -9098,8 +9293,8 @@ function applyPersonalityOverlay(preset, base) {
 ${preset.systemPrompt}`;
 }
 async function localAgentUsePersonality(agent, name, opts) {
-  if (chunkVY6NKMOA_cjs.currentPersonalityContext() !== void 0) {
-    chunkVY6NKMOA_cjs.warnPersonalitySwitchInsideFork(agent.agentId);
+  if (chunk7IZKTQ5G_cjs.currentPersonalityContext() !== void 0) {
+    chunk7IZKTQ5G_cjs.warnPersonalitySwitchInsideFork(agent.agentId);
     return null;
   }
   if (agent.personalityRegistry === void 0) {
@@ -9160,7 +9355,7 @@ async function* localAgentStreamToCompletion(agent, message, options) {
 async function localAgentFork(parent, options) {
   const { forkAgentImpl } = await import('./fork-agent-WAEQI2DL.cjs');
   const { getAgentFacade } = await import('./agent-factory-registry-UU46BUMU.cjs');
-  const { withPersonalityContext } = await import('./context-JTGSBJT6.cjs');
+  const { withPersonalityContext } = await import('./context-HR4KMXMA.cjs');
   const create = getAgentFacade().create;
   return withPersonalityContext(
     { slug: parent.personalitySlugSnapshot, isFork: true },
@@ -9953,7 +10148,7 @@ var LocalAgent = class {
     if (sub.plugins !== void 0) this.plugins = sub.plugins;
     reportUnknownLocalOptions(options.local);
     const compatSources = resolveCompatSources(options, this.workspaceCwd);
-    chunk43YXGD3P_cjs.reportUndeclaredSources(this.workspaceCwd, compatSources);
+    chunkTY56BKSK_cjs.reportUndeclaredSources(this.workspaceCwd, compatSources);
     this.hooksExecutor = new HooksExecutor(this.workspaceCwd, compatSources, options.local?.hooks);
     this.defaultMemoryProviderForLoop = createLocalAgentMemoryProvider({
       agentOptions: options,
@@ -9981,7 +10176,7 @@ var LocalAgent = class {
     if (this.pluginsManager !== void 0) await this.pluginsManager.initialize();
     const codePlugins = chunkBV2MWEMV_cjs.extractCodePlugins(this.options.plugins);
     await this.pluginManagerCode.initialize(codePlugins);
-    this.resolvedSubagents = await chunkAYA65JA5_cjs.loadSubagents(
+    this.resolvedSubagents = await chunkRWPLWMCZ_cjs.loadSubagents(
       this.workspaceCwd,
       this.settingSourcesIncludeProject,
       this.options.agents,
@@ -10937,7 +11132,7 @@ var Agent = class _Agent {
    */
   static async describe(agentId) {
     const agent = await getRegisteredAgentOrThrow(agentId);
-    const { loadSubagents: loadSubagents2 } = await import('./subagents-loader-DN4LETGL.cjs');
+    const { loadSubagents: loadSubagents2 } = await import('./subagents-loader-MOO7DC4E.cjs');
     const settingSources = agent.options.local?.settingSources;
     const subagents = await loadSubagents2(
       agent.cwd ?? process.cwd(),
@@ -11053,7 +11248,9 @@ exports.UsageAccumulator = UsageAccumulator;
 exports.computeCost = computeCost;
 exports.generateCronId = generateCronId;
 exports.getPricingEntry = getPricingEntry;
+exports.managedSettingsPathFor = managedSettingsPathFor;
 exports.openRouterMemoryEmbeddingProviderAdapter = openRouterMemoryEmbeddingProviderAdapter;
+exports.readManagedSettings = readManagedSettings;
 exports.resolveSessionDir = resolveSessionDir;
-//# sourceMappingURL=chunk-UKJJRU7C.cjs.map
-//# sourceMappingURL=chunk-UKJJRU7C.cjs.map
+//# sourceMappingURL=chunk-GCHZMH42.cjs.map
+//# sourceMappingURL=chunk-GCHZMH42.cjs.map