pi-roundtable 0.7.11 → 0.7.13

package/CHANGELOG.md

@@ -5,6 +5,20 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.7.13] - 2026-10-03
+
+### Changed
+
+- Behavior change: a precheck script's MCP calls follow the hold rules. Saving a script reads its `mcp.call` and `mcp.json` calls (server and tool written as strings, `mcp` used for nothing else, or the script is refused) and judges each with the host's hold rules; if any is held, the `schedule_create` or `schedule_update` call is itself held for the owner through the confirmation gate, once, and the scheduled runs do not ask again. The schedule keeps the tools its script may call (`Schedule.precheckTools`, `NewSchedule.precheckTools`, `ScheduleChange.precheckTools`, the type `PrecheckTool`) in a nullable `precheck_tools` column (the new `schedules-precheck-tools` migration); the runner gets them as `PrecheckScriptContext.tools` and must refuse every other call; `schedule_list` shows them, marking those the owner approved. A script saved before has no recorded tools: its first run reads them, runs it if none is held, and otherwise wakes the agent to save it again.
+- Behavior change: `PrecheckScriptRunner` needs `toolName(server, tool)`, the name the hold rules know a script's call by.
+- `HoldRule` takes an optional `mayHold(tool)`, for a rule whose verdict depends on the input, and an optional `approvalTier(tool, input, context)`, the lowest tier that may approve a call it holds when higher than the tool's own; `HoldCheck` (and `holdChain`'s) gains `mayHold` and `approvalTier`. A held call keeps that tier (`HeldCall.minTier`), and both its approval card and a confirming message require it, so saving a script whose runs send mail needs whoever may approve sending mail, not only whoever may schedule. `ScheduleToolContext` takes `holds`.
+
+## [0.7.12] - 2026-10-03
+
+### Fixed
+
+- pi-roundtable-sandbox: a host compactor's time shrinks with the turn's, and an error event in the middle of a successful model stream is logged; see its changelog.
+
 ## [0.7.11] - 2026-10-03
 
 ### Added

package/docs/plugins.md

@@ -501,6 +501,10 @@ export const cleanup = definePlugin({
 ```
 <!-- /example -->
 
+A rule whose verdict depends on the input, such as one that holds only a `delete` action, can also answer `mayHold(tool)`: whether it may hold some call of that tool.
+It is asked when the input is not known yet, as for a [precheck script](#precheck-scripts-prechecks-the-agent-writes)'s call whose arguments are computed when it runs; a rule without it is judged by `describe` with an empty input.
+A rule whose held call stands for others can answer `approvalTier(tool, input, context)`: the lowest tier that may approve it when higher than the tool's own. The held call keeps it as `minTier`, and both its card and a confirming message require it.
+
 ### `prompt`: text added to every agent turn
 
 Each section's `build` gets the agent, the speaker (undefined between turns), and the turn's scope.
@@ -812,6 +816,13 @@ pi-roundtable-sandbox's `precheckScriptRunner` runs each script in a sealed cont
 - When the host stops, the scheduler aborts running scripts and waits up to 15 seconds for the runner to clean up; a precheck that ends then starts no turn.
 - Without a runner, the tools neither take nor mention `precheck_script`, a script is refused with the registered names, and a schedule that already has one wakes with `### Precheck failed: script`, never a silent skip.
 
+A script's MCP calls follow the hold rules as the agent's own calls do.
+When a script is saved, the core reads its `mcp.call(server, tool, args)` and `mcp.json(...)` calls; server and tool must be written as strings, and `mcp` may be used for nothing else.
+The runner's `toolName(server, tool)` gives the name the hold rules know each tool by, and each call is judged by its arguments when they are written out, or otherwise by `describe` with an empty input and the rules' `mayHold`.
+If any call is held, saving the script is itself a held action, approved or refused through the confirmation gate like any other, so it is approved once, by someone who may approve each of those calls, and the scheduled runs do not ask again.
+The schedule keeps the tools it may call as `precheckTools` (`PrecheckTool`, its held ones marked), the runner gets them as the context's `tools` and must refuse every other call, and `schedule_list` shows them.
+A script saved before 0.7.13 has no recorded tools: its first run reads them, runs it if none is held, and otherwise wakes the agent to save it again for approval.
+
 
 ### `migrations` and `context.database()`: tables of your own
 
@@ -2524,6 +2535,7 @@ Import from the entries listed below; source area files are internal.
 | `PrecheckScope` | `pi-roundtable` | type |
 | `PrecheckScriptContext` | `pi-roundtable` | type |
 | `PrecheckScriptRunner` | `pi-roundtable` | type |
+| `PrecheckTool` | `pi-roundtable` | type |
 | `PRECHECK_SCRIPT_CHARS` | `pi-roundtable` | value |
 | `SKILLS` | `pi-roundtable` | value |
 | `Schedule` | `pi-roundtable` | type |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable",
-	"version": "0.7.11",
+	"version": "0.7.13",
 	"description": "A plugin-driven Pi agent server for Discord",
 	"type": "module",
 	"license": "MIT",
@@ -56,6 +56,7 @@
 	},
 	"dependencies": {
 		"@babel/parser": "7.29.9",
+		"@babel/types": "7.29.8",
 		"@earendil-works/pi-ai": ">=0.99.2 <2",
 		"@earendil-works/pi-coding-agent": ">=0.99.2 <2",
 		"canvas": "3.2.3",

package/src/core/agents/team-turns.ts

@@ -12,7 +12,7 @@ import { splitReply } from "../presentation/reply-splitter.ts";
 import { thinkingLine } from "../presentation/thinking-line.ts";
 import { withReplyFiles } from "../reply-files.ts";
 import { endOf, settleTurn } from "../routing/settle-turn.ts";
-import type { Speaker } from "../speakers.ts";
+import { type Speaker, tierAtLeast } from "../speakers.ts";
 import { toolTiers } from "../tool-tiers.ts";
 import { AgentMessages } from "./agent-messages.ts";
 import type { Agent } from "./agent-store.ts";
@@ -145,7 +145,11 @@ export class TeamTurns {
 	/** Whether the speaker's tier holds every tool of the held actions. */
 	#mayApprove(speaker: Speaker, pending: PendingConfirmation): boolean {
 		const tiers = this.#options.toolTiers ?? toolTiers();
-		return pending.calls.every((call) => tiers.allows(speaker.tier, call.tool));
+		return pending.calls.every(
+			(call) =>
+				tiers.allows(speaker.tier, call.tool) &&
+				(!call.minTier || tierAtLeast(speaker.tier, call.minTier)),
+		);
 	}
 
 	#agentOf(channel: ChannelKey): Agent {

package/src/core/builtin/modules.ts

@@ -14,6 +14,7 @@ import {
 } from "../modules/delegation/delegator.ts";
 import { WebResearchWorker } from "../modules/delegation/web-research-worker.ts";
 import { notifyExtension } from "../modules/notify/notify.ts";
+import { precheckScriptHoldRule } from "../modules/schedules/precheck-tools.ts";
 import { Scheduler } from "../modules/schedules/scheduler.ts";
 import { schedulesExtension } from "../modules/schedules/schedules.ts";
 import type { RoundtablePlugin } from "../plugin.ts";
@@ -77,7 +78,14 @@ export function modulesPlugin(options: ModulesOptions): RoundtablePlugin {
 	return {
 		name: "modules",
 		provides: [BACKGROUND_TURNS, DELEGATION],
-		setup: ({ conversations, services, logger, surfaces }) => {
+		setup: ({
+			conversations,
+			services,
+			logger,
+			surfaces,
+			sessions,
+			toolTiers,
+		}) => {
 			const schedules = services.get(SCHEDULES);
 			// Absent when a plugin list leaves the prechecks plugin out: then none can be attached.
 			const prechecks = services.find(PRECHECKS);
@@ -117,6 +125,14 @@ export function modulesPlugin(options: ModulesOptions): RoundtablePlugin {
 				services: [
 					{ name: "delegator", busy: () => delegator.runningChannels() },
 				],
+				// Saving a precheck script that calls a held tool waits for the owner, as the call would.
+				holdRules: [
+					precheckScriptHoldRule({
+						prechecks: () => prechecks,
+						holds: () => sessions().holds,
+						tiers: () => toolTiers,
+					}),
+				],
 				sessionTools: [
 					fixed("notify", () => notifyExtension(connection, owner)),
 					fixed("schedules", (session) =>
@@ -126,6 +142,7 @@ export function modulesPlugin(options: ModulesOptions): RoundtablePlugin {
 								owner: { id: owner.id, name: owner.name },
 								channelFor: ownerChannelFor,
 								...(prechecks ? { prechecks } : {}),
+								holds: () => sessions().holds,
 							},
 							session.homeChannel,
 							served(session),
@@ -160,13 +177,14 @@ export function modulesPlugin(options: ModulesOptions): RoundtablePlugin {
 export function schedulerPlugin(): RoundtablePlugin {
 	return {
 		name: "schedules",
-		setup: ({ conversations, services, env, logger, surfaces }) => {
+		setup: ({ conversations, services, env, logger, surfaces, sessions }) => {
 			const schedules = services.get(SCHEDULES);
 			const prechecks = services.find(PRECHECKS);
 			const scheduler = new Scheduler({
 				store: schedules,
 				runner: services.get(BACKGROUND_TURNS),
 				...(prechecks ? { prechecks } : {}),
+				holds: () => sessions().holds,
 				// The bot's own message: the surface drops it, so it starts no turn.
 				notify: (schedule, note) =>
 					surfaces.sendReply(schedule.channel, {

package/src/core/domain/conversation.ts

@@ -1,5 +1,6 @@
 import type { InboundMessage } from "../contract/channels.ts";
 import type { ChannelKey } from "../sessions.ts";
+import type { Tier } from "../speakers.ts";
 
 export { QUEUED_MARK, STEERED_MARK } from "../contract/channels.ts";
 export type { ChannelKey, InboundMessage };
@@ -16,6 +17,8 @@ export interface HeldCall {
 	input: string;
 	/** What the call would do, in plain words. */
 	action: string;
+	/** The lowest tier that may approve it, when higher than its tool's own; see `HoldRule.approvalTier`. */
+	minTier?: Tier;
 }
 
 export interface PendingConfirmation {

package/src/core/holds.ts

@@ -1,4 +1,5 @@
 import { PluginError } from "./errors.ts";
+import { type Tier, tierAtLeast } from "./speakers.ts";
 
 /** What a hold rule knows about the session making the call. */
 export interface HoldContext {
@@ -17,14 +18,49 @@ export interface HoldRule {
 		input: Record<string, unknown>,
 		context: HoldContext,
 	): string | undefined;
+	/**
+	 * Whether this rule may hold some call of `tool`, for a rule whose verdict depends on the input
+	 * (such as an action argument). Asked when the input is not known yet, as for a precheck
+	 * script's call whose arguments are computed when it runs; a rule without it is judged by
+	 * `describe` with an empty input.
+	 */
+	mayHold?(tool: string): boolean;
+	/**
+	 * The lowest tier that may approve a call this rule holds, when it is higher than the tool's own:
+	 * for a call that stands for others, such as saving a script whose runs make held calls.
+	 */
+	approvalTier?(
+		tool: string,
+		input: Record<string, unknown>,
+		context: HoldContext,
+	): Tier | undefined;
 }
 
 /** The description of a call that must be approved first, or undefined to let it run. */
-export type HoldCheck = (
+export type HoldCheck = ((
 	tool: string,
 	input: Record<string, unknown>,
 	context: HoldContext,
-) => string | undefined;
+) => string | undefined) & {
+	/** The name of a rule that may hold some call of `tool` whatever its input; see `HoldRule.mayHold`. */
+	mayHold?(tool: string): string | undefined;
+	/** The highest tier any rule requires to approve the call; see `HoldRule.approvalTier`. */
+	approvalTier?(
+		tool: string,
+		input: Record<string, unknown>,
+		context: HoldContext,
+	): Tier | undefined;
+};
+
+/** The higher of two tiers; undefined only when both are. */
+export function higherTier(
+	a: Tier | undefined,
+	b: Tier | undefined,
+): Tier | undefined {
+	if (!a) return b;
+	if (!b) return a;
+	return tierAtLeast(a, b) ? a : b;
+}
 
 /** Asks the rules in order; the first description holds the call. */
 export function holdChain(rules: readonly HoldRule[]): HoldCheck {
@@ -36,11 +72,19 @@ export function holdChain(rules: readonly HoldRule[]): HoldCheck {
 			);
 		names.add(rule.name);
 	}
-	return (tool, input, context) => {
+	const check: HoldCheck = (tool, input, context) => {
 		for (const rule of rules) {
 			const description = rule.describe(tool, input, context);
 			if (description !== undefined) return description;
 		}
 		return undefined;
 	};
+	check.mayHold = (tool) => rules.find((rule) => rule.mayHold?.(tool))?.name;
+	check.approvalTier = (tool, input, context) =>
+		rules.reduce<Tier | undefined>(
+			(tier, rule) =>
+				higherTier(tier, rule.approvalTier?.(tool, input, context)),
+			undefined,
+		);
+	return check;
 }

package/src/core/i18n/schedules.ts

@@ -53,6 +53,13 @@ export function schedulesEn(ctx: CatalogContext) {
 			`Checked first by its own precheck script (${chars} characters)`,
 		schedulePrecheckNote: (id: number, title: string, note: string) =>
 			`-# Schedule #${id} ${title}, skipped by its precheck: ${note.replace(/\n+/g, "\n-# ")}`,
+		precheckScriptHeld: (
+			schedule: { title?: string; id?: number },
+			held: readonly string[],
+		) =>
+			`save schedule ${schedule.title ? `"${schedule.title}" ` : schedule.id === undefined ? "" : `#${schedule.id} `}with a precheck script that, each time it runs, may: ${held.join("; ")}`,
+		precheckToolMayHold: (tool: string, rule: string) =>
+			`call ${tool}, which the ${rule} rule may hold depending on its input`,
 		scheduleChoice: (id: number, title: string, recurrence: string) =>
 			`#${id} ${title} (${recurrence})`,
 		scheduleTitle: "Schedules",
@@ -97,6 +104,13 @@ export function schedulesZhTW(
 			`先由自訂的預檢腳本判斷（${chars} 字元）`,
 		schedulePrecheckNote: (id: number, title: string, note: string) =>
 			`-# 排程 #${id} ${title} 經預檢略過：${note.replace(/\n+/g, "\n-# ")}`,
+		precheckScriptHeld: (
+			schedule: { title?: string; id?: number },
+			held: readonly string[],
+		) =>
+			`儲存排程${schedule.title ? `「${schedule.title}」` : schedule.id === undefined ? "" : ` #${schedule.id} `}，它的預檢腳本每次執行都可能：${held.join("；")}`,
+		precheckToolMayHold: (tool: string, rule: string) =>
+			`呼叫 ${tool}（規則 ${rule} 會依輸入決定是否需要確認）`,
 		scheduleChoice: (id: number, title: string, recurrence: string) =>
 			`#${id} ${title}（${recurrence}）`,
 		scheduleTitle: "排程",

package/src/core/modules/schedules/precheck-tools.ts

@@ -0,0 +1,387 @@
+import { parse } from "@babel/parser";
+import type { Node, Program } from "@babel/types";
+import { ScheduleError } from "../../domain/errors.ts";
+import {
+	type HoldCheck,
+	type HoldContext,
+	type HoldRule,
+	higherTier,
+} from "../../holds.ts";
+import { messages } from "../../i18n/index.ts";
+import type { Tier } from "../../speakers.ts";
+import type { ToolTiers } from "../../tool-tiers.ts";
+import type { PrecheckRegistry } from "./prechecks.ts";
+
+/**
+ * An MCP tool a schedule's precheck script may call, as approved when the script was saved. The
+ * runner lets the script call nothing else.
+ */
+export interface PrecheckTool {
+	server: string;
+	tool: string;
+	/** What the host's hold rules said a call of it would do; set, the owner approved it on saving the script. */
+	held?: string;
+}
+
+/** One `mcp.call` or `mcp.json` in a script, with its arguments when they are written out literally. */
+export interface PrecheckScriptCall {
+	server: string;
+	tool: string;
+	/** Undefined when the script computes them, so they are known only when it runs. */
+	args?: Record<string, unknown>;
+}
+
+const NOT_LITERAL = Symbol("not literal");
+
+/** A value written out in the script itself. */
+type Literal =
+	| string
+	| number
+	| boolean
+	| null
+	| Literal[]
+	| { [key: string]: Literal };
+
+/** The value of an expression written out as JSON-like literals, or NOT_LITERAL. */
+function literal(node: Node | null | undefined): Literal | typeof NOT_LITERAL {
+	if (!node) return NOT_LITERAL;
+	switch (node.type) {
+		case "StringLiteral":
+		case "NumericLiteral":
+		case "BooleanLiteral":
+			return node.value;
+		case "NullLiteral":
+			return null;
+		case "TemplateLiteral":
+			return node.expressions.length === 0
+				? node.quasis.map((q) => q.value.cooked ?? q.value.raw).join("")
+				: NOT_LITERAL;
+		case "UnaryExpression":
+			return node.operator === "-" && node.argument.type === "NumericLiteral"
+				? -node.argument.value
+				: NOT_LITERAL;
+		case "ArrayExpression": {
+			const items: Literal[] = [];
+			for (const item of node.elements) {
+				const value =
+					item && item.type !== "SpreadElement" ? literal(item) : NOT_LITERAL;
+				if (value === NOT_LITERAL) return NOT_LITERAL;
+				items.push(value);
+			}
+			return items;
+		}
+		case "ObjectExpression": {
+			const entries: [string, Literal][] = [];
+			for (const property of node.properties) {
+				if (property.type !== "ObjectProperty" || property.computed)
+					return NOT_LITERAL;
+				const key =
+					property.key.type === "Identifier"
+						? property.key.name
+						: property.key.type === "StringLiteral"
+							? property.key.value
+							: undefined;
+				const value = literal(property.value);
+				if (key === undefined || value === NOT_LITERAL) return NOT_LITERAL;
+				entries.push([key, value]);
+			}
+			return Object.fromEntries(entries);
+		}
+		default:
+			return NOT_LITERAL;
+	}
+}
+
+const REACH =
+	"a precheck script may use mcp only as mcp.call(server, tool, args) or mcp.json(server, tool, args), with server and tool written as strings, after taking it from the context as ({ mcp }) or const { mcp } = context";
+
+function isNode(value: unknown): value is Node {
+	return (
+		typeof value === "object" &&
+		value !== null &&
+		typeof (value as { type?: unknown }).type === "string"
+	);
+}
+
+/** Every node under `node`, with the key it sits under in its parent. */
+function* walk(
+	node: Node,
+	parent?: Node,
+	key?: string,
+): Generator<[Node, Node | undefined, string | undefined]> {
+	yield [node, parent, key];
+	for (const [childKey, value] of Object.entries(node)) {
+		if (
+			childKey === "loc" ||
+			childKey === "leadingComments" ||
+			childKey === "trailingComments" ||
+			childKey === "innerComments"
+		)
+			continue;
+		if (Array.isArray(value)) {
+			for (const item of value)
+				if (isNode(item)) yield* walk(item, node, childKey);
+		} else if (isNode(value)) yield* walk(value, node, childKey);
+	}
+}
+
+/** The longest precheck script a schedule may carry, in characters. */
+export const PRECHECK_SCRIPT_CHARS = 8_000;
+
+/**
+ * Reads a precheck script without running it: a JavaScript module within the size limit whose
+ * default export is what the runner calls, and the MCP calls it makes. Server and tool must be
+ * written as strings, and `mcp` may be used only for those calls, so the calls are known before it
+ * runs; anything else throws ScheduleError with what to fix. The runner still lets the script call
+ * only the tools approved for it.
+ */
+export function readPrecheckScript(script: unknown): {
+	script: string;
+	calls: PrecheckScriptCall[];
+} {
+	if (typeof script !== "string" || !script.trim())
+		throw new ScheduleError(
+			"precheck_script must be a JavaScript module with a default export",
+		);
+	if (script.length > PRECHECK_SCRIPT_CHARS)
+		throw new ScheduleError(
+			`precheck_script is ${script.length} characters; keep it within ${PRECHECK_SCRIPT_CHARS}`,
+		);
+	let program: Program;
+	try {
+		program = parse(script, {
+			sourceType: "module",
+			errorRecovery: false,
+		}).program;
+	} catch (error) {
+		throw new ScheduleError(
+			`precheck_script does not parse as a JavaScript module: ${error instanceof Error ? error.message || error.name : String(error)}`,
+		);
+	}
+	const exportsDefault = program.body.some(
+		(node) =>
+			node.type === "ExportDefaultDeclaration" ||
+			(node.type === "ExportNamedDeclaration" &&
+				node.specifiers.some((specifier) =>
+					specifier.exported.type === "Identifier"
+						? specifier.exported.name === "default"
+						: specifier.exported.value === "default",
+				)),
+	);
+	if (!exportsDefault)
+		throw new ScheduleError(
+			"precheck_script needs a default export: export default async (context) => ({ wake: false, note }) or ({ wake: true, context })",
+		);
+	return { script, calls: mcpCalls(program) };
+}
+
+/** Checks a precheck script without running it, as `readPrecheckScript` does; returns it. */
+export function checkPrecheckScript(script: unknown): string {
+	return readPrecheckScript(script).script;
+}
+
+function mcpCalls(program: Program): PrecheckScriptCall[] {
+	const calls: PrecheckScriptCall[] = [];
+	const allowed = new Set<Node>();
+	for (const [node] of walk(program)) {
+		if (
+			node.type !== "CallExpression" ||
+			node.callee.type !== "MemberExpression" ||
+			node.callee.computed ||
+			node.callee.object.type !== "Identifier" ||
+			node.callee.object.name !== "mcp" ||
+			node.callee.property.type !== "Identifier" ||
+			!["call", "json"].includes(node.callee.property.name)
+		)
+			continue;
+		const [serverArg, toolArg, argsArg, ...rest] = node.arguments;
+		const server = literal(serverArg);
+		const tool = literal(toolArg);
+		if (typeof server !== "string" || typeof tool !== "string")
+			throw new ScheduleError(
+				`precheck_script computes a server or tool name for mcp.${node.callee.property.name}; ${REACH}`,
+			);
+		if (rest.length > 0)
+			throw new ScheduleError(
+				`precheck_script passes mcp.${node.callee.property.name} more than three arguments; ${REACH}`,
+			);
+		const args = argsArg === undefined ? {} : literal(argsArg);
+		calls.push({
+			server,
+			tool,
+			...(args !== NOT_LITERAL &&
+			typeof args === "object" &&
+			args !== null &&
+			!Array.isArray(args)
+				? { args }
+				: {}),
+		});
+		allowed.add(node.callee.object);
+	}
+	for (const [node, parent, key] of walk(program)) {
+		if (node.type === "Identifier") {
+			if (node.name === "arguments" || node.name === "eval")
+				throw new ScheduleError(
+					`precheck_script may not use ${node.name}; ${REACH}`,
+				);
+			if (node.name !== "mcp" || allowed.has(node)) continue;
+			// `{ mcp }` taken from the context, under its own name.
+			if (
+				parent?.type === "ObjectProperty" &&
+				key === "value" &&
+				parent.key.type === "Identifier" &&
+				parent.key.name === "mcp" &&
+				!parent.computed
+			)
+				continue;
+			// A property key named mcp, such as the `mcp` of `{ mcp }`, is no use of it.
+			if (
+				parent?.type === "ObjectProperty" &&
+				key === "key" &&
+				!parent.computed
+			)
+				continue;
+			if (parent?.type === "MemberExpression" && key === "property") {
+				if (!parent.computed)
+					throw new ScheduleError(
+						`precheck_script reads .mcp from an object; ${REACH}`,
+					);
+				continue;
+			}
+			throw new ScheduleError(
+				`precheck_script uses mcp other than in a call; ${REACH}`,
+			);
+		}
+		if (
+			node.type === "ObjectProperty" &&
+			!node.computed &&
+			node.key.type === "Identifier" &&
+			node.key.name === "mcp" &&
+			parent?.type === "ObjectPattern" &&
+			!(node.value.type === "Identifier" && node.value.name === "mcp")
+		)
+			throw new ScheduleError(`precheck_script renames mcp; ${REACH}`);
+		if (
+			node.type === "MemberExpression" &&
+			node.computed &&
+			node.property.type === "StringLiteral" &&
+			node.property.value === "mcp"
+		)
+			throw new ScheduleError(`precheck_script reads ["mcp"]; ${REACH}`);
+		if (
+			node.type === "MemberExpression" &&
+			node.computed &&
+			node.object.type === "Identifier" &&
+			node.object.name === "mcp"
+		)
+			throw new ScheduleError(`precheck_script uses mcp[...]; ${REACH}`);
+	}
+	return calls;
+}
+
+/**
+ * The tools a script calls, each with what the host's hold rules say a call of it would do. A call
+ * whose arguments are computed is judged by an empty input, or by a rule that says it may hold it.
+ */
+export function precheckScriptTools(
+	script: unknown,
+	options: {
+		toolName: (server: string, tool: string) => string;
+		holds: HoldCheck;
+		context?: HoldContext;
+	},
+): PrecheckTool[] {
+	const tools = new Map<string, PrecheckTool>();
+	for (const call of readPrecheckScript(script).calls) {
+		const name = options.toolName(call.server, call.tool);
+		const context = options.context ?? {};
+		let held: string | undefined;
+		if (call.args) held = options.holds(name, call.args, context);
+		else {
+			held = options.holds(name, {}, context);
+			const rule =
+				held === undefined ? options.holds.mayHold?.(name) : undefined;
+			if (rule !== undefined) held = messages().precheckToolMayHold(name, rule);
+		}
+		const key = `${call.server}\u0000${call.tool}`;
+		const known = tools.get(key);
+		if (!known)
+			tools.set(key, {
+				server: call.server,
+				tool: call.tool,
+				...(held ? { held } : {}),
+			});
+		else if (held && !known.held) known.held = held;
+	}
+	return [...tools.values()];
+}
+
+const SCHEDULE_TOOLS = new Set(["schedule_create", "schedule_update"]);
+
+/**
+ * Holds saving a precheck script that calls a held tool, so it is approved once, as each of its
+ * calls would be, by someone who could approve those calls; the scheduled runs then do not ask
+ * again. Contributed by the schedule tools' plugin; `holds` is the host's whole chain and `tiers`
+ * the host's tool tiers, read when a call is judged.
+ */
+export function precheckScriptHoldRule(options: {
+	prechecks: () => Partial<Pick<PrecheckRegistry, "scriptRunner">> | undefined;
+	holds: () => HoldCheck;
+	tiers?: () => ToolTiers;
+}): HoldRule {
+	let judging = false;
+	/** The held tools a script being saved calls, by the names the hold rules know them by. */
+	const heldCalls = (
+		tool: string,
+		input: Record<string, unknown>,
+		context: HoldContext,
+	): { name: string; held: string }[] => {
+		const script = input.precheck_script;
+		if (!SCHEDULE_TOOLS.has(tool) || typeof script !== "string" || judging)
+			return [];
+		const runner = options.prechecks()?.scriptRunner?.();
+		if (!runner) return [];
+		judging = true;
+		try {
+			return precheckScriptTools(script, {
+				toolName: (server, name) => runner.toolName(server, name),
+				holds: options.holds(),
+				context,
+			}).flatMap((t) =>
+				t.held
+					? [{ name: runner.toolName(t.server, t.tool), held: t.held }]
+					: [],
+			);
+		} catch {
+			// The tool refuses the script itself, with the reason.
+			return [];
+		} finally {
+			judging = false;
+		}
+	};
+	return {
+		name: "precheck-scripts",
+		describe(tool, input, context) {
+			const held = heldCalls(tool, input, context);
+			if (held.length === 0) return undefined;
+			return messages().precheckScriptHeld(
+				{
+					...(typeof input.title === "string" && input.title
+						? { title: input.title }
+						: {}),
+					...(typeof input.id === "number" ? { id: input.id } : {}),
+				},
+				held.map((call) => call.held),
+			);
+		},
+		// Whoever approves must be able to approve each held call the script makes.
+		approvalTier(tool, input, context) {
+			const tiers = options.tiers?.();
+			return heldCalls(tool, input, context).reduce<Tier | undefined>(
+				(tier, call) =>
+					higherTier(tier, tiers ? tiers.minTier(call.name) : "owner"),
+				undefined,
+			);
+		},
+	};
+}

package/src/core/modules/schedules/prechecks.ts

@@ -1,6 +1,4 @@
-import { parse } from "@babel/parser";
 import type { ChannelKey } from "../../domain/conversation.ts";
-import { ScheduleError } from "../../domain/errors.ts";
 import { PluginError } from "../../errors.ts";
 import type { Tier } from "../../speakers.ts";
 import type { Schedule } from "./schedule-store.ts";
@@ -8,8 +6,10 @@ import type { Schedule } from "./schedule-store.ts";
 /** How long a precheck may run before it counts as failed, unless it sets its own `timeoutMs`. */
 export const PRECHECK_TIMEOUT_MS = 60_000;
 
-/** The longest precheck script a schedule may carry, in characters. */
-export const PRECHECK_SCRIPT_CHARS = 8_000;
+export {
+	checkPrecheckScript,
+	PRECHECK_SCRIPT_CHARS,
+} from "./precheck-tools.ts";
 
 /** What a finding names a schedule's own script by, in its heading and status. */
 export const SCRIPT_PRECHECK = "script";
@@ -69,6 +69,8 @@ export interface PrecheckScope {
 
 /** What a schedule's precheck script runs with when its schedule falls due. */
 export interface PrecheckScriptContext extends PrecheckContext {
+	/** The MCP tools the script may call, as approved when it was saved; the runner must refuse every other call. */
+	tools: readonly { server: string; tool: string }[];
 	/** The host's IANA time zone, such as `Asia/Taipei`. */
 	timeZone: string;
 	/** The date in that zone when it fired, `YYYY-MM-DD`, so a script never reads a UTC date by mistake. */
@@ -88,6 +90,12 @@ export interface PrecheckScriptRunner {
 	): PrecheckResult | Promise<PrecheckResult>;
 	/** How long a script may run; default 60 seconds. A timeout counts as a throw. */
 	timeoutMs?: number;
+	/**
+	 * The name the host's hold rules know a script's `mcp.call(server, tool)` by: the name its own
+	 * agent calls that tool by. A script that calls a tool its rules hold needs the owner's approval
+	 * to be saved.
+	 */
+	toolName(server: string, tool: string): string;
 	/**
 	 * How to write a script for a schedule in this scope, and what it may call there, shown to the
 	 * model by schedule_list.
@@ -134,10 +142,11 @@ export function memoryPrecheckRegistry(): PrecheckRegistry {
 				);
 			if (
 				typeof given?.run !== "function" ||
-				typeof given.describe !== "function"
+				typeof given.describe !== "function" ||
+				typeof given.toolName !== "function"
 			)
 				throw new PluginError(
-					"a precheck script runner needs run and describe functions.",
+					"a precheck script runner needs run, describe, and toolName functions.",
 				);
 			if (
 				given.timeoutMs !== undefined &&
@@ -180,47 +189,6 @@ export function memoryPrecheckRegistry(): PrecheckRegistry {
 	};
 }
 
-/**
- * Checks a precheck script without running it: a JavaScript module within the size limit whose
- * default export is what the runner calls. Throws ScheduleError with what to fix.
- */
-export function checkPrecheckScript(script: unknown): string {
-	if (typeof script !== "string" || !script.trim())
-		throw new ScheduleError(
-			"precheck_script must be a JavaScript module with a default export",
-		);
-	if (script.length > PRECHECK_SCRIPT_CHARS)
-		throw new ScheduleError(
-			`precheck_script is ${script.length} characters; keep it within ${PRECHECK_SCRIPT_CHARS}`,
-		);
-	let program: ReturnType<typeof parse>["program"];
-	try {
-		program = parse(script, {
-			sourceType: "module",
-			errorRecovery: false,
-		}).program;
-	} catch (error) {
-		throw new ScheduleError(
-			`precheck_script does not parse as a JavaScript module: ${errorText(error)}`,
-		);
-	}
-	const exportsDefault = program.body.some(
-		(node) =>
-			node.type === "ExportDefaultDeclaration" ||
-			(node.type === "ExportNamedDeclaration" &&
-				node.specifiers.some((specifier) =>
-					specifier.exported.type === "Identifier"
-						? specifier.exported.name === "default"
-						: specifier.exported.value === "default",
-				)),
-	);
-	if (!exportsDefault)
-		throw new ScheduleError(
-			"precheck_script needs a default export: export default async (context) => ({ wake: false, note }) or ({ wake: true, context })",
-		);
-	return script;
-}
-
 function errorText(error: unknown): string {
 	return error instanceof Error ? error.message || error.name : String(error);
 }

package/src/core/modules/schedules/schedule-store.ts

@@ -4,6 +4,7 @@ import type { ChannelKey } from "../../domain/conversation.ts";
 import { ScheduleError } from "../../domain/errors.ts";
 import type { ScheduleStore } from "../../services.ts";
 import type { Tier } from "../../speakers.ts";
+import type { PrecheckTool } from "./precheck-tools.ts";
 import type { Recurrence } from "./recurrence.ts";
 
 export interface Schedule {
@@ -24,6 +25,11 @@ export interface Schedule {
 	precheck?: string;
 	/** The precheck script an agent wrote for it, run in the host's sandbox; a schedule has a name or a script, not both. */
 	precheckScript?: string;
+	/**
+	 * The MCP tools its script may call, with those the owner approved as held when it was saved;
+	 * absent for a script saved before tools were recorded, which must be saved again if it calls a held tool.
+	 */
+	precheckTools?: PrecheckTool[];
 	lastRun?: Date;
 	lastStatus?: string;
 }
@@ -42,6 +48,8 @@ export interface NewSchedule {
 	precheck?: string;
 	/** A precheck script, run in the host's sandbox before each turn; not with `precheck`. */
 	precheckScript?: string;
+	/** The tools the script may call, as approved; required with `precheckScript`. */
+	precheckTools?: PrecheckTool[];
 }
 
 export interface ScheduleChange {
@@ -53,6 +61,8 @@ export interface ScheduleChange {
 	precheck?: string | null;
 	/** A precheck script to run before each turn; null removes it. */
 	precheckScript?: string | null;
+	/** The tools a new script may call, as approved; required with a new `precheckScript`. */
+	precheckTools?: PrecheckTool[];
 }
 
 interface Row {
@@ -70,6 +80,7 @@ interface Row {
 	created_at: Date;
 	precheck: string | null;
 	precheck_script: string | null;
+	precheck_tools: string | null;
 	last_run: Date | null;
 	last_status: string | null;
 }
@@ -90,6 +101,10 @@ function toSchedule(row: Row): Schedule {
 		createdAt: row.created_at,
 		...(row.precheck ? { precheck: row.precheck } : {}),
 		...(row.precheck_script ? { precheckScript: row.precheck_script } : {}),
+		...(row.precheck_script && row.precheck_tools
+			? // pi-lens-ignore: unchecked-throwing-call — this store wrote the JSON; a corrupt row should fail loudly
+				{ precheckTools: JSON.parse(row.precheck_tools) as PrecheckTool[] }
+			: {}),
 		...(row.last_run ? { lastRun: row.last_run } : {}),
 		...(row.last_status ? { lastStatus: row.last_status } : {}),
 	};
@@ -145,6 +160,13 @@ export class PgScheduleStore implements ScheduleStore {
 					await sql`ALTER TABLE schedules ADD COLUMN IF NOT EXISTS precheck_script text`;
 				},
 			},
+			{
+				// Scripts saved before have none, and their tools are checked when they next run.
+				name: "schedules-precheck-tools",
+				up: async (sql) => {
+					await sql`ALTER TABLE schedules ADD COLUMN IF NOT EXISTS precheck_tools text`;
+				},
+			},
 		];
 	}
 
@@ -158,13 +180,18 @@ export class PgScheduleStore implements ScheduleStore {
 			throw new ScheduleError(
 				"a schedule has a precheck or a precheck script, not both",
 			);
+		if (schedule.precheckScript && !schedule.precheckTools)
+			throw new ScheduleError(
+				"a precheck script is saved with the tools it may call",
+			);
 		const rows: Row[] = await this.#sql`
 			INSERT INTO schedules (channel_key, mode, title, prompt, recurrence, next_run,
-				created_by_id, created_by_name, created_tier, precheck, precheck_script)
+				created_by_id, created_by_name, created_tier, precheck, precheck_script, precheck_tools)
 			VALUES (${schedule.channel}, ${schedule.target}, ${schedule.title}, ${schedule.prompt},
 				${JSON.stringify(schedule.recurrence)}, ${schedule.nextRun},
 				${schedule.createdById}, ${schedule.createdByName}, ${schedule.createdTier},
-				${schedule.precheck ?? null}, ${schedule.precheckScript ?? null})
+				${schedule.precheck ?? null}, ${schedule.precheckScript ?? null},
+				${schedule.precheckScript ? JSON.stringify(schedule.precheckTools) : null})
 			RETURNING *`;
 		const [row] = rows;
 		if (!row) throw new Error("the schedule insert returned no row");
@@ -212,6 +239,18 @@ export class PgScheduleStore implements ScheduleStore {
 			: change.precheckScript === undefined
 				? (current.precheckScript ?? null)
 				: change.precheckScript;
+		if (change.precheckScript && !change.precheckTools)
+			throw new ScheduleError(
+				"a precheck script is saved with the tools it may call",
+			);
+		// A new script brings its own tools; one kept keeps its tools; no script, no tools.
+		const precheckTools = !precheckScript
+			? null
+			: change.precheckScript
+				? JSON.stringify(change.precheckTools)
+				: current.precheckTools
+					? JSON.stringify(current.precheckTools)
+					: null;
 		const rows: Row[] = await this.#sql`
 			UPDATE schedules SET
 				title = ${change.title ?? current.title},
@@ -219,7 +258,8 @@ export class PgScheduleStore implements ScheduleStore {
 				recurrence = ${JSON.stringify(change.recurrence ?? current.recurrence)},
 				next_run = ${change.nextRun ?? current.nextRun},
 				precheck = ${precheck},
-				precheck_script = ${precheckScript}
+				precheck_script = ${precheckScript},
+				precheck_tools = ${precheckTools}
 			WHERE id = ${id}
 			RETURNING *`;
 		return rows[0] ? toSchedule(rows[0]) : undefined;

package/src/core/modules/schedules/schedule-tools.ts

@@ -1,13 +1,14 @@
 import type { BackgroundTarget } from "../../contract/channels.ts";
 import type { ChannelKey } from "../../domain/conversation.ts";
 import { ScheduleError } from "../../domain/errors.ts";
+import type { HoldCheck } from "../../holds.ts";
 import { messages } from "../../i18n/index.ts";
 import type { ScheduleStore } from "../../services.ts";
 import type { ScheduleToolName } from "../../shared/schedule-tools.ts";
 import { type Tier, tierAtLeast } from "../../speakers.ts";
 import { timeZone, zonedStamp } from "../../time.ts";
+import { type PrecheckTool, precheckScriptTools } from "./precheck-tools.ts";
 import {
-	checkPrecheckScript,
 	PRECHECK_SCRIPT_CHARS,
 	type PrecheckFinding,
 	type PrecheckRegistry,
@@ -44,6 +45,11 @@ export interface ScheduleToolContext {
 	 */
 	prechecks?: Pick<PrecheckRegistry, "get" | "list"> &
 		Partial<Pick<PrecheckRegistry, "scriptRunner">>;
+	/**
+	 * The host's hold rules, which mark the tools a saved script calls that the owner approved.
+	 * The approval itself is the confirmation gate's, over this very call.
+	 */
+	holds?: () => HoldCheck;
 }
 
 /** The limits of the context's target; a target without them may not schedule. */
@@ -95,15 +101,41 @@ function precheckName(ctx: ScheduleToolContext, value: unknown): string {
 	return name;
 }
 
-/** A precheck script the host's sandbox runs; refused when the host has no runner for scripts. */
-function precheckScript(ctx: ScheduleToolContext, value: unknown): string {
-	if (!ctx.prechecks?.scriptRunner?.()) {
+/**
+ * A precheck script the host's sandbox runs, with the tools it calls: those the hold rules hold
+ * were approved by the owner through the confirmation gate before this call ran. Refused when the
+ * host has no runner for scripts.
+ */
+function precheckScript(
+	ctx: ScheduleToolContext,
+	value: unknown,
+): { script: string; tools: PrecheckTool[] } {
+	const runner = ctx.prechecks?.scriptRunner?.();
+	if (!runner) {
 		const names = (ctx.prechecks?.list() ?? []).map((p) => p.name);
 		throw new ScheduleError(
 			`this host runs no precheck scripts; ${names.length ? `attach a registered precheck instead: ${names.join(", ")}` : "it registers no prechecks either"}`,
 		);
 	}
-	return checkPrecheckScript(value);
+	const script = typeof value === "string" ? value : "";
+	const tools = precheckScriptTools(value, {
+		toolName: (server, tool) => runner.toolName(server, tool),
+		holds: ctx.holds?.() ?? (() => undefined),
+	});
+	return { script, tools };
+}
+
+/** The tools a script may call, the owner's approvals marked. */
+function toolsText(tools: readonly PrecheckTool[] | undefined): string {
+	if (!tools)
+		return "not recorded; saved before tools were, so it must be saved again if it calls a held tool";
+	if (tools.length === 0) return "none";
+	return tools
+		.map(
+			(t) =>
+				`${t.server}/${t.tool}${t.held ? ` (approved by the owner: ${t.held})` : ""}`,
+		)
+		.join(", ");
 }
 
 /** The prechecks a schedule may name or write, for schedule_list; empty when the host offers neither. */
@@ -181,7 +213,7 @@ function line(schedule: Schedule): string {
 	const precheck = schedule.precheck
 		? `; precheck ${schedule.precheck}`
 		: schedule.precheckScript
-			? `; precheck script (${schedule.precheckScript.length} characters)`
+			? `; precheck script (${schedule.precheckScript.length} characters; tools: ${toolsText(schedule.precheckTools)})`
 			: "";
 	const last = schedule.lastRun
 		? `; last run ${zonedStamp(schedule.lastRun)} (${schedule.lastStatus ?? "?"})`
@@ -246,7 +278,9 @@ export async function callScheduleTool(
 				createdByName: ctx.author.name,
 				createdTier: ctx.author.tier ?? "owner",
 				...(precheck ? { precheck } : {}),
-				...(script ? { precheckScript: script } : {}),
+				...(script
+					? { precheckScript: script.script, precheckTools: script.tools }
+					: {}),
 			});
 			const checked = precheck
 				? `; precheck ${precheck} runs first`
@@ -293,11 +327,12 @@ export async function callScheduleTool(
 			if (input.precheck !== undefined)
 				change.precheck =
 					input.precheck === null ? null : precheckName(ctx, input.precheck);
-			if (input.precheck_script !== undefined)
-				change.precheckScript =
-					input.precheck_script === null
-						? null
-						: precheckScript(ctx, input.precheck_script);
+			if (input.precheck_script === null) change.precheckScript = null;
+			else if (input.precheck_script !== undefined) {
+				const script = precheckScript(ctx, input.precheck_script);
+				change.precheckScript = script.script;
+				change.precheckTools = script.tools;
+			}
 			if (change.precheck) change.precheckScript = null;
 			if (change.precheckScript) change.precheck = null;
 			if (Object.keys(change).length === 0)

package/src/core/modules/schedules/scheduler.ts

@@ -1,7 +1,9 @@
 import type { ScheduledOutcome } from "../../contract/channels.ts";
+import type { HoldCheck } from "../../holds.ts";
 import type { Logger } from "../../log.ts";
 import type { ScheduleStore } from "../../services.ts";
 import { timeZone, zonedStamp } from "../../time.ts";
+import { type PrecheckTool, precheckScriptTools } from "./precheck-tools.ts";
 import {
 	type Precheck,
 	type PrecheckFinding,
@@ -36,6 +38,11 @@ export interface SchedulerOptions {
 	/** The host's prechecks and script runner; without them, a schedule that has one runs with that as its error. */
 	prechecks?: Pick<PrecheckRegistry, "get"> &
 		Partial<Pick<PrecheckRegistry, "scriptRunner">>;
+	/**
+	 * The host's hold rules, read when a script saved before its tools were recorded runs: it runs
+	 * only if it calls no held tool. Without them, such a script does not run.
+	 */
+	holds?: () => HoldCheck;
 	/** Posts a skipping precheck's note in the schedule's channel as the bot's own message, which starts no turn. */
 	notify?: (schedule: Schedule, note: string) => Promise<void>;
 	logger: Logger;
@@ -214,6 +221,8 @@ export class Scheduler {
 		const runner = prechecks?.scriptRunner?.();
 		if (!runner)
 			return "this host has no precheck script runner, so the script did not run";
+		const tools = this.#tools(schedule, script, runner.toolName.bind(runner));
+		if (typeof tools === "string") return tools;
 		const zone = timeZone();
 		return {
 			name: SCRIPT_PRECHECK,
@@ -226,10 +235,40 @@ export class Scheduler {
 					...context,
 					timeZone: zone,
 					today: zonedStamp(firedAt).slice(0, 10),
+					tools: tools.map(({ server, tool }) => ({ server, tool })),
 				}),
 		};
 	}
 
+	/**
+	 * The tools a script may call: those approved when it was saved, or, for a script saved before
+	 * they were recorded, those it calls when none of them is held. Otherwise why it cannot run.
+	 */
+	#tools(
+		schedule: Schedule,
+		script: string,
+		toolName: (server: string, tool: string) => string,
+	): PrecheckTool[] | string {
+		if (schedule.precheckTools) return schedule.precheckTools;
+		const save =
+			"save it again with schedule_update, so the owner can approve the tools it calls";
+		const holds = this.#options.holds?.();
+		if (!holds)
+			return `this script was saved before its tools were recorded, and this host cannot check them; ${save}`;
+		let tools: PrecheckTool[];
+		try {
+			tools = precheckScriptTools(script, { toolName, holds });
+		} catch (error) {
+			return `this script was saved before its tools were recorded and cannot be checked now (${error instanceof Error ? error.message : String(error)}); fix it and ${save}`;
+		}
+		const held = tools.flatMap((t) =>
+			t.held ? [`${t.server}/${t.tool}`] : [],
+		);
+		if (held.length > 0)
+			return `this script was saved before its tools were recorded and calls tools that need the owner's approval (${held.join(", ")}), so it did not run; ${save}`;
+		return tools;
+	}
+
 	/** Runs the schedule's precheck; a missing one fails like a throw, so the turn still runs. */
 	async #precheck(
 		schedule: Schedule,

package/src/core/modules/schedules/schedules.ts

@@ -3,6 +3,7 @@ import { Type } from "typebox";
 import { OWNER_TARGET } from "../../agents/agent-claim.ts";
 import type { ChannelKey } from "../../domain/conversation.ts";
 import { ScheduleError } from "../../domain/errors.ts";
+import type { HoldCheck } from "../../holds.ts";
 import { activeLocale } from "../../i18n/index.ts";
 import type { OwnerIdentity } from "../../identity.ts";
 import {
@@ -30,6 +31,8 @@ export interface OwnerSchedules {
 	/** The host's prechecks a schedule may name, and the runner of scripts it may carry; without them, none can be attached. */
 	prechecks?: Pick<PrecheckRegistry, "get" | "list"> &
 		Partial<Pick<PrecheckRegistry, "scriptRunner">>;
+	/** The host's hold rules, which mark a saved script's approved tools. */
+	holds?: () => HoldCheck;
 }
 
 /** Finds another agent's channel, for reading its schedules; throws ScheduleError when there is none. */
@@ -62,7 +65,7 @@ export function schedulesExtension(
 	/** The person the running turn is for; their schedules run at their tier. */
 	speaker: () => Speaker | undefined = () => undefined,
 ): ExtensionFactory {
-	const { store, owner, channelFor, prechecks } = schedules;
+	const { store, owner, channelFor, prechecks, holds } = schedules;
 	const defs = scheduleToolSpecs({
 		locale: activeLocale(),
 		timeZone: timeZone(),
@@ -85,6 +88,7 @@ export function schedulesExtension(
 						author: speaker() ?? owner,
 						now: new Date(),
 						...(prechecks ? { prechecks } : {}),
+						...(holds ? { holds } : {}),
 					},
 					spec.name,
 					input,

package/src/core/runtime/extensions/confirmation-gate.ts

@@ -4,7 +4,7 @@ import type {
 	PendingConfirmation,
 } from "../../domain/conversation.ts";
 import type { OwnerPrompts } from "../../domain/owner-prompts.ts";
-import type { HoldCheck } from "../../holds.ts";
+import { type HoldCheck, higherTier } from "../../holds.ts";
 import { messages } from "../../i18n/index.ts";
 import { type OwnerIdentity, ownerWords } from "../../identity.ts";
 import type { ToolTiers } from "../../tool-tiers.ts";
@@ -141,7 +141,7 @@ export class ConfirmationGate {
 			messages().confirmTitle(ask.asker),
 			approvalCard(call),
 			ask.signal,
-			this.#tiers?.minTier(call.tool),
+			higherTier(this.#tiers?.minTier(call.tool), call.minTier),
 		);
 		if (answer === "approved") return { approvedOnCard: true };
 		if (answer === "declined") {
@@ -156,13 +156,17 @@ export class ConfirmationGate {
 
 	/** The call when it needs the owner's confirmation and no approval releases it. */
 	#needing(tool: string, input: Record<string, unknown>): HeldCall | undefined {
-		const action = this.#holds(
-			tool,
-			input,
-			this.#workspace === undefined ? {} : { workspace: this.#workspace },
-		);
+		const context =
+			this.#workspace === undefined ? {} : { workspace: this.#workspace };
+		const action = this.#holds(tool, input, context);
 		if (!action) return undefined;
-		const call: HeldCall = { tool, input: canonicalJson(input), action };
+		const minTier = this.#holds.approvalTier?.(tool, input, context);
+		const call: HeldCall = {
+			tool,
+			input: canonicalJson(input),
+			action,
+			...(minTier ? { minTier } : {}),
+		};
 		const approved = this.#approved.findIndex(
 			(c) => c.tool === call.tool && c.input === call.input,
 		);

package/src/core/testing/prechecks.ts

@@ -69,6 +69,8 @@ export function fakeScriptRunner(
 	answer: FakeScriptAnswer,
 	options: {
 		describe?: (scope: PrecheckScope) => string;
+		/** The name hold rules know a script's call by; default `${server}-${tool}`. */
+		toolName?: (server: string, tool: string) => string;
 		timeoutMs?: number;
 	} = {},
 ): FakeScriptRunner {
@@ -79,6 +81,7 @@ export function fakeScriptRunner(
 			? {}
 			: { timeoutMs: options.timeoutMs }),
 		describe: options.describe ?? (() => "A test script runner."),
+		toolName: options.toolName ?? ((server, tool) => `${server}-${tool}`),
 		run: async (script, context) => {
 			calls.push({ script, context });
 			if (answer instanceof Error) throw answer;

package/src/index.ts

@@ -126,6 +126,7 @@ export type {
 	PromptMemory,
 } from "./core/modules/memory/owner-memory-store.ts";
 export { MEMORY_KINDS } from "./core/modules/memory/owner-memory-store.ts";
+export type { PrecheckTool } from "./core/modules/schedules/precheck-tools.ts";
 export type {
 	Precheck,
 	PrecheckContext,