chainlesschain 0.162.197 → 0.162.200

package/src/lib/skill-loader.js

@@ -32,6 +32,23 @@ import { normalizeSkillPaths } from "./skill-path-scope.js";
 import { discoverPluginSkillLayers } from "./plugin-runtime/skills.js";
 import settingsLoader from "./settings-loader.cjs";
 import contextSourceLedger from "./context-source-ledger.js";
+import {
+  createAbortError,
+  isAbortError,
+  raceWithAbort,
+  throwIfAborted,
+} from "./abort-utils.js";
+import {
+  admitSkillPrompt,
+  assertSkillFileSize,
+  createSkillDiscoveryBudget,
+  debitSkillDiscoveryBudget,
+  debitSkillDiscoveryEntry,
+  debitSkillPromptBudget,
+  HOST_SKILL_LIMITS,
+  isSkillBudgetError,
+  resolveSkillLimits,
+} from "./skill-budget.js";
 import {
   assertControlledSkillExecution,
   captureSkillExecutionSnapshot,
@@ -43,9 +60,20 @@ import {
   skillReauthorizationError,
   skillTrustRequiredError,
 } from "./skill-execution-identity.js";
+import { getSkillExecutionAuthority } from "./skill-execution-authority.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
+/**
+ * Revoke every Skill execution authorization sharing this CLI state home.
+ * The durable generation is advanced before success is returned. Existing
+ * local leases are aborted synchronously; other local hosts observe it through
+ * their active-lease poller and at every authority-sensitive transition.
+ */
+export function revokeSkillExecutionAuthorizations(options = {}) {
+  return getSkillExecutionAuthority().revoke(options);
+}
+
 /**
  * Whether the bundled (built-in) skill layer should be hidden — Claude-Code
  * 2.1.169 `disableBundledSkills` parity. Precedence: explicit option >
@@ -108,7 +136,7 @@ export const LAYER_NAMES = [
 
 /** Max directory depth to descend when scanning a skill layer for nested
  *  `<group>/<skill>/SKILL.md` layouts (infinite-recursion / deep-tree guard). */
-export const MAX_SKILL_NEST_DEPTH = 5;
+export const MAX_SKILL_NEST_DEPTH = HOST_SKILL_LIMITS.maxSkillNestDepth;
 
 // Frontmatter keys (camelCased) that are semantically strings and are consumed
 // with string methods; they must never be number/boolean-coerced. `version` is
@@ -235,7 +263,12 @@ export function parseSkillMd(content) {
  * body is deliberately not retained during discovery; it is materialized by
  * CLISkillLoader.materializeSkill() only when a persona or run_skill needs it.
  */
-function readSkillFrontmatter(skillMd, maxBytes = 256 * 1024) {
+function readSkillFrontmatter(skillMd, maxBytes = 256 * 1024, limits = {}) {
+  const before = fs.lstatSync(skillMd);
+  if (before.isSymbolicLink() || !before.isFile()) {
+    throw new TypeError("SKILL.md must be a regular, non-symlink file");
+  }
+  assertSkillFileSize("SKILL.md", before.size, limits);
   const fd = fs.openSync(skillMd, "r");
   const chunks = [];
   let total = 0;
@@ -341,6 +374,8 @@ export class CLISkillLoader {
   constructor({
     contextLedger = contextSourceLedger,
     reauthorizeSkill = null,
+    executionAuthority = null,
+    limits = {},
     // Only package-owned, immutable-at-install sources are trusted by
     // default. The historical "managed" layer is actually the user-writable
     // <userData>/skills directory (and `skill add --global` writes there), so
@@ -354,8 +389,22 @@ export class CLISkillLoader {
     this._bodyCache = new Map();
     this._contextLedger = contextLedger;
     this._reauthorizeSkill = reauthorizeSkill;
+    this._executionAuthority =
+      executionAuthority || getSkillExecutionAuthority();
+    if (
+      typeof this._executionAuthority.readGeneration !== "function" ||
+      typeof this._executionAuthority.acquireLease !== "function" ||
+      typeof this._executionAuthority.assertGeneration !== "function" ||
+      typeof this._executionAuthority.revoke !== "function"
+    ) {
+      throw new TypeError(
+        "executionAuthority must implement the Skill authority API",
+      );
+    }
+    this._limits = resolveSkillLimits(limits);
     this._trustedExecutionSources = new Set(trustedExecutionSources);
     this._authorizedExecutionDigests = new Map();
+    this._executionAuthorityGeneration = null;
     this._cacheStats = {
       descriptorScans: 0,
       descriptorCacheHits: 0,
@@ -366,6 +415,100 @@ export class CLISkillLoader {
     };
   }
 
+  getLimits() {
+    return this._limits;
+  }
+
+  _syncExecutionAuthorityGeneration() {
+    const authorityGeneration = this._executionAuthority.readGeneration();
+    if (this._executionAuthorityGeneration !== authorityGeneration) {
+      this._authorizedExecutionDigests.clear();
+      this._executionAuthorityGeneration = authorityGeneration;
+    }
+    return this._executionAuthorityGeneration;
+  }
+
+  _assertExecutionAuthorityGeneration(expectedGeneration) {
+    this._executionAuthority.assertGeneration(expectedGeneration);
+    this._syncExecutionAuthorityGeneration();
+  }
+
+  /**
+   * Acquire a durable-generation lease for one authorization or controlled
+   * execution. Same-home revocation aborts the returned signal and fences any
+   * later transition under an old digest decision.
+   */
+  acquireSkillExecution(skill, context = {}) {
+    if (!skill || typeof skill !== "object") {
+      throw new TypeError("A discovered skill descriptor is required");
+    }
+    throwIfAborted(context.signal, "Skill execution was interrupted");
+    this._syncExecutionAuthorityGeneration();
+    const authorityLease = this._executionAuthority.acquireLease({
+      skillId: String(skill.id || skill.dirName || "unknown"),
+    });
+    const generation = authorityLease.generation;
+    let released = false;
+    let parentAbortListener = null;
+    const release = () => {
+      if (released) return;
+      released = true;
+      authorityLease.release();
+      if (parentAbortListener) {
+        try {
+          context.signal?.removeEventListener?.("abort", parentAbortListener);
+        } catch {
+          // Lease retirement must remain idempotent even for a malformed host
+          // signal implementation.
+        }
+      }
+    };
+    const assertActive = () => {
+      throwIfAborted(authorityLease.signal, "Skill execution was interrupted");
+      this._assertExecutionAuthorityGeneration(generation);
+    };
+
+    if (context.signal?.addEventListener) {
+      parentAbortListener = () => {
+        authorityLease.abort(
+          context.signal.reason ||
+            createAbortError("Skill execution was interrupted"),
+        );
+      };
+      try {
+        context.signal.addEventListener("abort", parentAbortListener, {
+          once: true,
+        });
+      } catch (error) {
+        release();
+        throw error;
+      }
+      // Close the same pre-check/listener-registration race handled by
+      // raceWithAbort for Promise consumers.
+      if (context.signal.aborted) parentAbortListener();
+    }
+    try {
+      assertActive();
+    } catch (error) {
+      release();
+      throw error;
+    }
+    return Object.freeze({
+      generation: String(generation),
+      signal: authorityLease.signal,
+      assertActive,
+      release,
+    });
+  }
+
+  revokeExecutionAuthorizations(options = {}) {
+    this._syncExecutionAuthorityGeneration();
+    const clearedLocalAuthorizations = this._authorizedExecutionDigests.size;
+    const result = this._executionAuthority.revoke(options);
+    this._syncExecutionAuthorityGeneration();
+    return Object.freeze({ ...result, clearedLocalAuthorizations });
+  }
+
   _skillReauthorizationRequest(
     skill,
     snapshot,
@@ -393,9 +536,11 @@ export class CLISkillLoader {
       discoveredDigest: skill.executionIdentity?.contentDigest || null,
       currentDigest: snapshot.contentDigest,
       componentDigests: Object.freeze({ ...snapshot.componentDigests }),
+      executionAuthorityGeneration: String(this._executionAuthorityGeneration),
       loadedBecause: context.loadedBecause || "explicit",
       sessionId: context.sessionId || null,
       turnId: context.turnId || null,
+      signal: context.signal || null,
     });
   }
 
@@ -421,10 +566,16 @@ export class CLISkillLoader {
    * materializeSkillForExecution after the await, closing the prompt-time race.
    */
   async _authorizeSkillExecutionDigest(skill, context = {}) {
+    throwIfAborted(
+      context.signal,
+      "Skill execution authorization was interrupted",
+    );
+    const authorizationGeneration = this._syncExecutionAuthorityGeneration();
     const snapshot = captureSkillExecutionSnapshot({
       skillDir: skill.skillDir,
       skillId: skill.id,
       source: skill.source,
+      limits: this._limits,
     });
     const discovered = skill.executionIdentity;
     if (
@@ -448,6 +599,7 @@ export class CLISkillLoader {
       isSkillExecutionContext(context) &&
       skill.hasHandler === true &&
       !this._trustedExecutionSources.has(String(skill.source || ""));
+    this._assertExecutionAuthorityGeneration(authorizationGeneration);
     const previouslyAuthorizedDigest = this._authorizedExecutionDigests.get(
       snapshot.identityDigest,
     );
@@ -466,17 +618,28 @@ export class CLISkillLoader {
 
     let decision;
     try {
-      decision = await this._reauthorizeSkill(
-        this._skillReauthorizationRequest(skill, snapshot, context, {
-          firstUseAuthorization,
-          contentChanged,
-          previouslyAuthorizedDigest,
-        }),
+      decision = await raceWithAbort(
+        this._reauthorizeSkill(
+          this._skillReauthorizationRequest(skill, snapshot, context, {
+            firstUseAuthorization,
+            contentChanged,
+            previouslyAuthorizedDigest,
+          }),
+        ),
+        context.signal,
+        "Skill execution authorization was interrupted",
       );
     } catch (cause) {
+      if (context.signal?.aborted || isAbortError(cause)) throw cause;
       throw skillReauthorizationError(skill, cause);
     }
-    if (decision !== true && decision?.authorized !== true) {
+    const authorized = decision === true || decision?.authorized === true;
+    throwIfAborted(
+      context.signal,
+      "Skill execution authorization was interrupted",
+    );
+    this._assertExecutionAuthorityGeneration(authorizationGeneration);
+    if (!authorized) {
       this._throwSkillAuthorizationDenial(skill, snapshot, {
         firstUseAuthorization,
         contentChanged,
@@ -490,11 +653,27 @@ export class CLISkillLoader {
   }
 
   async materializeSkillForExecution(skill, context = {}) {
-    const executionContext = { ...context, forExecution: true };
-    await this._authorizeSkillExecutionDigest(skill, executionContext);
-    // Re-capture and re-check after a potentially human-blocking async prompt.
-    // materializeSkill recognizes only the exact digest authorized above.
-    return this.materializeSkill(skill, executionContext);
+    const executionLease = this.acquireSkillExecution(skill, {
+      signal: context.signal,
+    });
+    const executionContext = {
+      ...context,
+      forExecution: true,
+      signal: executionLease.signal,
+    };
+    try {
+      executionLease.assertActive();
+      await this._authorizeSkillExecutionDigest(skill, executionContext);
+      executionLease.assertActive();
+      // Re-capture and re-check after a potentially human-blocking async
+      // prompt. materializeSkill recognizes only the exact digest authorized
+      // above.
+      const materialized = this.materializeSkill(skill, executionContext);
+      executionLease.assertActive();
+      return materialized;
+    } finally {
+      executionLease.release();
+    }
   }
 
   /**
@@ -619,9 +798,10 @@ export class CLISkillLoader {
    * @param {string} layer - Layer name for source tracking
    * @returns {object[]} Array of skill metadata
    */
-  _loadFromDir(dir, layer) {
+  _loadFromDir(dir, layer, discoveryBudget = null) {
     const skills = [];
-    this._collectSkills(dir, layer, skills, 0);
+    const budget = discoveryBudget || createSkillDiscoveryBudget(this._limits);
+    this._collectSkills(dir, layer, skills, 0, budget);
     return skills;
   }
 
@@ -632,79 +812,102 @@ export class CLISkillLoader {
    * descended into, so nested layouts like `.claude/skills/<group>/<skill>/`
    * load too (Claude-Code 2.1.178 nested-skills parity). Depth-capped.
    */
-  _collectSkills(dir, layer, out, depth) {
+  _collectSkills(dir, layer, out, depth, discoveryBudget) {
     if (!dir || !fs.existsSync(dir)) return;
-    let entries;
+    let directory;
     try {
-      entries = fs.readdirSync(dir, { withFileTypes: true });
+      directory = fs.opendirSync(dir);
     } catch {
       return; // Directory unreadable
     }
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      const skillDir = path.join(dir, entry.name);
-      const skillMd = path.join(skillDir, "SKILL.md");
-      if (!fs.existsSync(skillMd)) {
-        // Grouping folder → descend (bounded) to find nested skills.
-        if (depth < MAX_SKILL_NEST_DEPTH) {
-          this._collectSkills(skillDir, layer, out, depth + 1);
+    try {
+      let entry;
+      while ((entry = directory.readSync()) !== null) {
+        debitSkillDiscoveryEntry(discoveryBudget);
+        if (!entry.isDirectory()) continue;
+        const skillDir = path.join(dir, entry.name);
+        const skillMd = path.join(skillDir, "SKILL.md");
+        if (!fs.existsSync(skillMd)) {
+          // Grouping folder → descend (bounded) to find nested skills.
+          if (depth < this._limits.maxSkillNestDepth) {
+            this._collectSkills(
+              skillDir,
+              layer,
+              out,
+              depth + 1,
+              discoveryBudget,
+            );
+          }
+          continue;
         }
-        continue;
-      }
-      try {
-        const data = readSkillFrontmatter(skillMd);
-        const stat = fs.statSync(skillMd);
-        const id = data.name || entry.name;
-        const isolation = data.isolation === true;
-        const snapshot = captureSkillExecutionSnapshot({
-          skillDir,
-          skillId: id,
-          source: layer,
-        });
-        const hasHandler = snapshot.handlerPresent;
-
-        out.push({
-          id,
-          displayName: data.displayName || entry.name,
-          description: data.description || "",
-          version: data.version || "1.0.0",
-          category: data.category || "uncategorized",
-          activation: data.activation || "manual",
-          tags: data.tags || [],
-          userInvocable: data.userInvocable !== false,
-          handler: data.handler || null,
-          capabilities: data.capabilities || [],
-          os: data.os || [],
-          // CLI pack extended fields
-          executionMode: data.executionMode || null,
-          cliDomain: data.cliDomain || null,
-          cliVersionHash: data.cliVersionHash || null,
-          // Optional per-directory path-scope: when set, the skill is only
-          // surfaced/runnable under a matching subtree (large-monorepo lazy
-          // context). null (the default) = applies everywhere.
-          paths: normalizeSkillPaths(data),
-          dirName: entry.name,
-          hasHandler,
-          isolation,
-          executionIdentity: executionIdentityMetadata(snapshot),
-          executionAuthority: describeSkillExecutionAuthority({
+        try {
+          const data = readSkillFrontmatter(
+            skillMd,
+            Math.min(256 * 1024, this._limits.maxSkillFileBytes),
+            this._limits,
+          );
+          const stat = fs.statSync(skillMd);
+          const id = data.name || entry.name;
+          const isolation = data.isolation === true;
+          const snapshot = captureSkillExecutionSnapshot({
+            skillDir,
+            skillId: id,
+            source: layer,
+            limits: this._limits,
+          });
+          debitSkillDiscoveryBudget(
+            discoveryBudget,
+            snapshot.componentFileCount,
+            snapshot.componentBytes,
+          );
+          const hasHandler = snapshot.handlerPresent;
+
+          out.push({
+            id,
+            displayName: data.displayName || entry.name,
+            description: data.description || "",
+            version: data.version || "1.0.0",
+            category: data.category || "uncategorized",
+            activation: data.activation || "manual",
+            tags: data.tags || [],
+            userInvocable: data.userInvocable !== false,
+            handler: data.handler || null,
+            capabilities: data.capabilities || [],
+            os: data.os || [],
+            // CLI pack extended fields
+            executionMode: data.executionMode || null,
+            cliDomain: data.cliDomain || null,
+            cliVersionHash: data.cliVersionHash || null,
+            // Optional per-directory path-scope: when set, the skill is only
+            // surfaced/runnable under a matching subtree (large-monorepo lazy
+            // context). null (the default) = applies everywhere.
+            paths: normalizeSkillPaths(data),
+            dirName: entry.name,
             hasHandler,
             isolation,
-          }),
-          // Two-tier loading: discovery retains only the descriptor. The body
-          // and embedded MCP declarations are populated on first use.
-          body: null,
-          bodyLoaded: false,
-          mcpServers: [],
-          source: layer,
-          skillDir: snapshot.rootRealPath,
-          skillMdPath: path.join(snapshot.rootRealPath, "SKILL.md"),
-          skillFileBytes: snapshot.skillFileBytes,
-          skillFileMtimeMs: stat.mtimeMs,
-        });
-      } catch {
-        // Skip malformed skill files
+            executionIdentity: executionIdentityMetadata(snapshot),
+            executionAuthority: describeSkillExecutionAuthority({
+              hasHandler,
+              isolation,
+            }),
+            // Two-tier loading: discovery retains only the descriptor. The body
+            // and embedded MCP declarations are populated on first use.
+            body: null,
+            bodyLoaded: false,
+            mcpServers: [],
+            source: layer,
+            skillDir: snapshot.rootRealPath,
+            skillMdPath: path.join(snapshot.rootRealPath, "SKILL.md"),
+            skillFileBytes: snapshot.skillFileBytes,
+            skillFileMtimeMs: stat.mtimeMs,
+          });
+        } catch (error) {
+          if (isSkillBudgetError(error)) throw error;
+          // Skip malformed skill files
+        }
       }
+    } finally {
+      directory.closeSync();
     }
   }
 
@@ -715,6 +918,11 @@ export class CLISkillLoader {
    * size/mtime metadata, and provenance records never include source content.
    */
   materializeSkill(skill, context = {}) {
+    throwIfAborted(
+      context.signal,
+      "Skill execution materialization was interrupted",
+    );
+    const authorizationGeneration = this._syncExecutionAuthorityGeneration();
     if (!skill || !skill.skillMdPath) {
       throw new TypeError("A discovered skill descriptor is required");
     }
@@ -723,6 +931,7 @@ export class CLISkillLoader {
       skillDir: skill.skillDir,
       skillId: skill.id,
       source: skill.source,
+      limits: this._limits,
     });
     const discovered = skill.executionIdentity;
     if (
@@ -745,6 +954,7 @@ export class CLISkillLoader {
       isSkillExecutionContext(context) &&
       skill.hasHandler === true &&
       !this._trustedExecutionSources.has(String(skill.source || ""));
+    this._assertExecutionAuthorityGeneration(authorizationGeneration);
     const previouslyAuthorizedDigest = this._authorizedExecutionDigests.get(
       snapshot.identityDigest,
     );
@@ -772,6 +982,7 @@ export class CLISkillLoader {
           }),
         );
       } catch (cause) {
+        if (context.signal?.aborted || isAbortError(cause)) throw cause;
         throw skillReauthorizationError(skill, cause);
       }
       if (decision && typeof decision.then === "function") {
@@ -794,6 +1005,11 @@ export class CLISkillLoader {
           snapshot.contentDigest,
         );
       }
+      throwIfAborted(
+        context.signal,
+        "Skill execution authorization was interrupted",
+      );
+      this._assertExecutionAuthorityGeneration(authorizationGeneration);
       if (executionRequiresTrust) {
         this._authorizedExecutionDigests.set(
           snapshot.identityDigest,
@@ -805,6 +1021,7 @@ export class CLISkillLoader {
       skill.hasHandler === true &&
       this._trustedExecutionSources.has(String(skill.source || ""))
     ) {
+      this._assertExecutionAuthorityGeneration(authorizationGeneration);
       this._authorizedExecutionDigests.set(
         snapshot.identityDigest,
         snapshot.contentDigest,
@@ -816,6 +1033,7 @@ export class CLISkillLoader {
     if (String(runtimeId) !== String(skill.id)) {
       throw skillIdentityChangedError(skill);
     }
+    const promptMeasurement = admitSkillPrompt(parsed.body, this._limits);
     const runtimeIsolation = parsed.data.isolation === true;
     skill.handler = parsed.data.handler || null;
     skill.capabilities = parsed.data.capabilities || [];
@@ -844,6 +1062,8 @@ export class CLISkillLoader {
         mcpServers: parseSkillMcpServers(body),
         rawChars: body.length,
         estimatedTokens: estimateSkillTokens(body),
+        promptBytes: promptMeasurement.bytes,
+        promptTokenUpperBound: promptMeasurement.tokenUpperBound,
       };
       this._bodyCache.set(skill.skillMdPath, cached);
       this._cacheStats.bodyCacheMisses += 1;
@@ -1040,6 +1260,7 @@ export class CLISkillLoader {
     }
     const layers = this.getLayerPaths();
     const skillMap = new Map();
+    const discoveryBudget = createSkillDiscoveryBudget(this._limits);
     // Claude-Code `disableBundledSkills`: hide the built-in layer so only
     // user/workspace/Claude-Code-portable skills load.
     const dropBundled = bundledSkillsDisabled(options);
@@ -1049,7 +1270,7 @@ export class CLISkillLoader {
       if (!exists) continue;
       if (dropBundled && (layer === "bundled" || layer === "cli-bundled"))
         continue;
-      const skills = this._loadFromDir(layerPath, layer);
+      const skills = this._loadFromDir(layerPath, layer, discoveryBudget);
       for (const skill of skills) {
         skillMap.set(skill.id, skill);
       }
@@ -1071,11 +1292,16 @@ export class CLISkillLoader {
     if (allSkillsDisabled(options)) return [];
     const dropBundled = bundledSkillsDisabled(options);
     const out = [];
+    const discoveryBudget = createSkillDiscoveryBudget(this._limits);
     for (const { layer, path: layerPath, exists } of this.getLayerPaths()) {
       if (!exists) continue;
       if (dropBundled && (layer === "bundled" || layer === "cli-bundled"))
         continue;
-      for (const skill of this._loadFromDir(layerPath, layer)) {
+      for (const skill of this._loadFromDir(
+        layerPath,
+        layer,
+        discoveryBudget,
+      )) {
         out.push({
           id: skill.id,
           layer: skill.source || layer,
@@ -1103,15 +1329,25 @@ export class CLISkillLoader {
    * @returns {object[]} skills with category "persona" and activation "auto"
    */
   getAutoActivatedPersonas(context = {}) {
+    const promptBudget = {
+      limits: this._limits,
+      bytes: 0,
+      tokens: 0,
+    };
     return this.getResolvedSkills()
       .filter((s) => s.category === "persona" && s.activation === "auto")
-      .map((skill) =>
-        this.materializeSkill(skill, {
+      .map((skill) => {
+        const materialized = this.materializeSkill(skill, {
           ...context,
           loadedBecause: context.loadedBecause || "persona_auto",
           bodyIncluded: true,
-        }),
-      );
+        });
+        debitSkillPromptBudget(
+          promptBudget,
+          admitSkillPrompt(materialized.body, this._limits),
+        );
+        return materialized;
+      });
   }
 
   /**

package/src/lib/skill-mcp.js

@@ -27,6 +27,11 @@
  * Pure functions only (except mount/unmount which take an MCPClient dep).
  */
 
+import {
+  MCP_STDIO_LOCAL_CODE_TRUST_REQUIRED_CODE,
+  issueMcpStdioExecutionAuthority,
+} from "./mcp-stdio-execution-authority.js";
+
 /**
  * Parse MCP server declarations from a SKILL.md body.
  * Returns an empty array if no `mcp-servers` code block is present.
@@ -103,6 +108,7 @@ export function validateMcpServerConfig(entry) {
  * @param {object} skill - Skill metadata with `mcpServers` array
  * @param {object} [opts]
  * @param {(msg: string, err?: Error) => void} [opts.onWarn] - Warning hook
+ * @param {(request: object) => boolean|Promise<boolean>} [opts.approveLocalCodeExecution]
  * @returns {Promise<{ mounted: string[], skipped: Array<{ name: string, error: string }> }>}
  */
 export async function mountSkillMcpServers(mcpClient, skill, opts = {}) {
@@ -130,8 +136,44 @@ export async function mountSkillMcpServers(mcpClient, skill, opts = {}) {
       }
       continue;
     }
+    let approved = false;
+    try {
+      approved =
+        typeof opts.approveLocalCodeExecution === "function" &&
+        (await opts.approveLocalCodeExecution({
+          skillId: skill?.id || skill?.name || null,
+          serverName: normalized.name,
+          command: normalized.command,
+          args: [...normalized.args],
+          cwd: normalized.cwd || null,
+          envKeys: Object.keys(normalized.env || {}).sort(),
+        })) === true;
+    } catch (error) {
+      const message = error?.message || String(error);
+      skipped.push({ name: normalized.name, error: message });
+      opts.onWarn?.(
+        `[skill-mcp] Local-code approval failed for "${normalized.name}": ${message}`,
+        error,
+      );
+      continue;
+    }
+    if (!approved) {
+      const message = `${MCP_STDIO_LOCAL_CODE_TRUST_REQUIRED_CODE}: skill MCP server requires explicit local-code approval`;
+      skipped.push({ name: normalized.name, error: message });
+      opts.onWarn?.(
+        `[skill-mcp] Skipped "${normalized.name}" for skill "${skill?.id || skill?.name}": ${message}`,
+      );
+      continue;
+    }
     try {
-      await mcpClient.connect(normalized.name, normalized);
+      const config = { ...normalized };
+      config.mcpStdioExecutionAuthority = issueMcpStdioExecutionAuthority({
+        serverName: normalized.name,
+        config,
+        approvalKind: "explicit-config",
+        approvalSource: `skill:${skill?.id || skill?.name || "unknown"}:${normalized.name}`,
+      });
+      await mcpClient.connect(normalized.name, config);
       mounted.push(normalized.name);
     } catch (err) {
       const message = err?.message || String(err);