pi-roundtable 0.9.12 → 0.10.0

package/examples/fake-surface.ts

@@ -1,5 +1,6 @@
 import {
 	type Approval,
+	type ApprovedBy,
 	type ChannelKey,
 	type ChatSurface,
 	definePlugin,
@@ -9,6 +10,7 @@ import {
 	type Prompts,
 	parseChannelKey,
 	TIERS,
+	type Tier,
 } from "pi-roundtable";
 
 /** A prompt the surface showed, open until someone it is for answers it. */
@@ -19,6 +21,18 @@ interface Asked {
 	open: boolean;
 }
 
+/** Who may answer an open prompt and what happens when they do. */
+interface Answering {
+	/** The principals who may answer it: the speaker, or the approvers the call named. */
+	principals: readonly string[];
+	owners: boolean;
+	/** The lowest tier an answer needs, when the principals are the approvers'. */
+	minTier?: Tier;
+	/** Hears who approved it. */
+	approved?(by: ApprovedBy): void;
+	settle(answer: Approval): void;
+}
+
 /**
  * A chat surface connects the host to one chat network. This one is an in-memory chat: its
  * channels are the keys that start with `fake:`, and it records what the host asks of it. A real
@@ -32,10 +46,7 @@ export class FakeSurface implements ChatSurface {
 	readonly stops: string[] = [];
 	readonly asked: Asked[] = [];
 	/** Who may answer each open prompt, and how it settles. */
-	readonly #answering = new Map<
-		string,
-		{ principalId?: string; owners: boolean; settle(answer: Approval): void }
-	>();
+	readonly #answering = new Map<string, Answering>();
 	#deliver: ((message: InboundMessage) => void) | undefined;
 
 	/** The host hands over its router; every message the network reports goes to it. */
@@ -81,42 +92,88 @@ export class FakeSurface implements ChatSurface {
 	 * How a turn asks to approve a held action or answers a question. The scope names who may
 	 * answer: its speaker when their tier holds the call, and the owners unless the conversation
 	 * is private, where a call above the speaker's tier goes to no one and comes back `unavailable` at once.
+	 * Where the call names approvers and the conversation is shared, they answer it instead of the
+	 * speaker, at the tier it needs. A private conversation's person alone answers it, and only if
+	 * named or an owner; for any other the call comes back `unavailable` at once.
 	 */
 	prompts(channel: ChannelKey, scope?: PromptScope): Prompts {
 		return {
-			confirm: async (title, _message, signal, minTier = "owner") => {
+			confirm: async (
+				title,
+				_message,
+				signal,
+				minTier = "owner",
+				_wait,
+				_details,
+				options,
+			) => {
+				const owners = scope?.escalate !== "none";
+				const named = options?.approvers;
+				// Alone with the bot, the person answers for themselves, if the call is theirs to approve:
+				// they are named, or an owner.
+				if (
+					named &&
+					!owners &&
+					scope?.tier !== "owner" &&
+					!named.includes(scope?.principalId ?? "")
+				)
+					return "unavailable";
+				const shared = owners ? named : undefined;
 				const theirs =
 					scope !== undefined &&
 					TIERS.indexOf(scope.tier) >= TIERS.indexOf(minTier);
-				const owners = scope?.escalate !== "none";
-				if (!theirs && !owners) return "unavailable";
+				const principals = shared ?? (theirs ? [scope.principalId] : []);
+				if (principals.length === 0 && !owners) return "unavailable";
 				return this.#ask(channel, title, signal, {
-					...(theirs ? { principalId: scope.principalId } : {}),
+					principals,
 					owners,
+					...(shared ? { minTier } : {}),
+					...(options?.approvedBy ? { approved: options.approvedBy } : {}),
 				});
 			},
 			ask: async () => undefined,
 		};
 	}
 
-	/** Someone answers an open prompt; it settles only when it is theirs to answer. */
+	/**
+	 * Someone answers an open prompt; it settles only when it is theirs to answer. `name` and
+	 * `speakerId` say who they are to a call that asks who approved it.
+	 */
 	answer(
 		id: string,
-		who: { principalId: string; owner?: boolean },
+		who: {
+			principalId: string;
+			owner?: boolean;
+			tier?: Tier;
+			name?: string;
+			speakerId?: string;
+		},
 		approved: boolean,
 	): void {
 		const open = this.#answering.get(id);
 		if (!open) return;
-		const theirs = open.principalId === who.principalId;
-		if (theirs || (who.owner && open.owners))
-			open.settle(approved ? "approved" : "declined");
+		// An answer that does not say its tier is not accepted where a tier is needed.
+		const tierOk =
+			!open.minTier ||
+			(who.tier !== undefined &&
+				TIERS.indexOf(who.tier) >= TIERS.indexOf(open.minTier));
+		const theirs = open.principals.includes(who.principalId) && tierOk;
+		if (!theirs && !(who.owner && open.owners)) return;
+		if (approved)
+			open.approved?.({
+				principalId: who.principalId,
+				speakerId: who.speakerId ?? who.principalId,
+				name: who.name ?? who.principalId,
+				...(who.owner ? { owner: true as const } : {}),
+			});
+		open.settle(approved ? "approved" : "declined");
 	}
 
 	#ask(
 		channel: ChannelKey,
 		title: string,
 		signal: AbortSignal | undefined,
-		audience: { principalId?: string; owners: boolean },
+		audience: Omit<Answering, "settle">,
 	): Promise<Approval> {
 		const asked = {
 			id: `q${this.asked.length + 1}`,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable",
-	"version": "0.9.12",
+	"version": "0.10.0",
 	"description": "A plugin-driven Pi agent server for one owner, reached through Discord or the web",
 	"type": "module",
 	"license": "MIT",

package/src/cli/checks/identity.ts

@@ -1,7 +1,10 @@
 import type { SQL } from "bun";
 import { LEGACY_ACCESS } from "../../core/config/access.ts";
 import type { ResolvedConfig } from "../../core/config/config.ts";
-import type { AccessRules } from "../../core/identity/access-policy.ts";
+import {
+	type AccessRules,
+	provisioningOf,
+} from "../../core/identity/access-policy.ts";
 import { identityOf, parseIdentity } from "../../core/identity/actor-facts.ts";
 import { declaredConflict } from "../../core/identity/config-owner.ts";
 import { backfillLine } from "../../core/identity/identity-plugin.ts";
@@ -42,9 +45,35 @@ export function surfacesOf(
 	return surfaces;
 }
 
+/** Whether a tier admits anyone on Discord: everyone there, or an identity or role of its own. */
+function admitsDiscord(
+	tier: AccessRules["members"] | AccessRules["admins"],
+): boolean {
+	if (!tier) return false;
+	const { everyone } = tier;
+	if (everyone === true) return true;
+	if (Array.isArray(everyone) && everyone.includes("discord")) return true;
+	return [...(tier.identities ?? []), ...(tier.roles ?? [])].some((entry) =>
+		entry.startsWith("discord:"),
+	);
+}
+
+/** The effective provisioning mode, one word, or one per surface (those the host talks through and those the map names) when it differs by surface. */
+function provisioningSummary(
+	rule: AccessRules["provisioning"],
+	surfaces: readonly string[],
+): string {
+	if (typeof rule === "string") return rule;
+	const named = [...new Set([...surfaces, ...Object.keys(rule)])];
+	return named
+		.map((surface) => `${surface} ${provisioningOf(rule, surface)}`)
+		.join(", ");
+}
+
 /**
  * Whom the configuration serves: the owners by name, a warning when `everyone: true` admits
- * everyone on every surface of a host with more than one, and a note when it is written in the
+ * everyone on every surface of a host with more than one, a warning when admins or members are admitted on
+ * Discord and `discord.agentSpeakers` is not `"owners"`, and a note when it is written in the
  * deprecated 0.8 form. It reads no database, so `start` runs it too.
  */
 export async function checkAccess(project: Project): Promise<Result> {
@@ -55,17 +84,56 @@ export async function checkAccess(project: Project): Promise<Result> {
 	const broad = (["admins", "members"] as const).filter(
 		(tier) => config.access[tier]?.everyone === true,
 	);
-	if (broad.length > 0 && surfaces.length > 1)
-		return warn(
+	const summary = provisioningSummary(config.access.provisioning, surfaces);
+	const rule = config.access.provisioning;
+	const unknown =
+		typeof rule === "string"
+			? []
+			: Object.keys(rule).filter((key) => !surfaces.includes(key));
+	const problems: string[] = [];
+	const fixes: string[] = [];
+	if (unknown.length > 0) {
+		problems.push(
+			`access.provisioning names ${list(unknown.map((key) => JSON.stringify(key)))}, which ${unknown.length === 1 ? "is" : "are"} not a surface this host talks through (${list(surfaces)}); a surface the map leaves out is linked.`,
+		);
+		fixes.push(
+			`Fix the spelling of the surface name in access.provisioning, or remove it.`,
+		);
+	}
+	if (broad.length > 0 && surfaces.length > 1) {
+		problems.push(
 			`${list(broad.map((tier) => `access.${tier}.everyone`))} ${broad.length === 1 ? "is" : "are"} true, which admits everyone on every surface: ${list(surfaces)}.`,
+		);
+		fixes.push(
 			`Name the surfaces where everyone may talk, such as everyone: ["discord"], and admit the others by identity or by role, such as roles: ["web:role:<name>"].`,
 		);
+	}
+	const discordTiers = (["admins", "members"] as const).filter((tier) =>
+		admitsDiscord(config.access[tier]),
+	);
+	if (
+		config.discord &&
+		config.discord.agentSpeakers !== "owners" &&
+		discordTiers.length > 0
+	) {
+		problems.push(
+			`${list(discordTiers.map((tier) => `access.${tier}`))} admit${discordTiers.length === 1 ? "s" : ""} Discord speakers, and discord.agentSpeakers is not "owners": their turns in the agents' channels run in the agent's home session, shared with the owners, so they can read earlier owner conversation and shell output and leave history that owner turns inherit.`,
+		);
+		fixes.push(
+			`Set discord.agentSpeakers to "owners" (their messages still reach owner turns as channel context), or stop admitting Discord in ${list(discordTiers.map((tier) => `access.${tier}`))}.`,
+		);
+	}
+	if (problems.length > 0)
+		return warn(
+			`${problems.join(" ")} (provisioning ${summary})`,
+			fixes.join(" "),
+		);
 	const owners = config.access.owners;
 	const legacy = config.deprecations.includes(LEGACY_ACCESS)
 		? "; written as the 0.8 owner and speakers, which roundtable upgrade rewrites as access"
 		: "";
 	return ok(
-		`${owners.length} ${owners.length === 1 ? "owner" : "owners"}, ${list(owners.map((owner) => owner.name))}${legacy}`,
+		`${owners.length} ${owners.length === 1 ? "owner" : "owners"}, ${list(owners.map((owner) => owner.name))}${legacy}; provisioning ${summary}`,
 	);
 }
 

package/src/core/agents/agent-claim.ts

@@ -41,6 +41,11 @@ export const OWNER_TARGET: BackgroundTarget = PERSONAL_TARGET;
 export interface AgentClaimOptions {
 	/** The owner, as forwarded messages name them. */
 	owner: OwnerIdentity;
+	/**
+	 * Who is answered in the agents' and groups' channels: `"everyone"` (default) every speaker the
+	 * router resolved, `"owners"` only the owner tier; a webhook's report is the same either way.
+	 */
+	speakers?: "everyone" | "owners";
 	team: Pick<
 		DiscordAgentTeam,
 		| "guildId"
@@ -134,6 +139,8 @@ export function agentClaim(options: AgentClaimOptions): ChannelClaim {
 			// Who may talk to the agents, and at which tier, the router resolved through the identity service.
 			const { speaker } = message;
 			if (message.authorIsBot || !speaker) return undefined;
+			if (options.speakers === "owners" && speaker.tier !== "owner")
+				return undefined;
 			const { channel, messageId } = message;
 			const forwarder = addressee(speaker, options.owner);
 			return {
@@ -200,6 +207,11 @@ export function agentClaim(options: AgentClaimOptions): ChannelClaim {
 					reason:
 						"a background turn reaches the agent server through the router, which says whom it runs as",
 				};
+			if (options.speakers === "owners" && speaker.tier !== "owner")
+				return {
+					status: "skipped",
+					reason: 'the agent server answers owners only (speakers: "owners")',
+				};
 			return outcome(
 				await team.answerBackground(
 					turn.channel,

package/src/core/agents/team-turns.ts

@@ -13,6 +13,7 @@ import { splitReply } from "../presentation/reply-splitter.ts";
 import { thinkingLine } from "../presentation/thinking-line.ts";
 import { withReplyFiles } from "../reply-files.ts";
 import { endOf, settleTurn } from "../routing/settle-turn.ts";
+import { mayApproveNamed } from "../runtime/extensions/held-calls.ts";
 import { type Speaker, tierAtLeast } from "../speakers.ts";
 import { toolTiers } from "../tool-tiers.ts";
 import { AgentMessages } from "./agent-messages.ts";
@@ -144,19 +145,25 @@ export class TeamTurns {
 	}
 
 	/**
-	 * Whether the speaker may approve the held actions by a message: an owner, as the agents'
-	 * channels are shared, or the principal whose turn held them (by their id, for actions held
-	 * before 0.9), when their tier now holds every tool. Nobody else in the channel may.
+	 * Whether the speaker may approve the held actions by a message, call by call: an owner, as the
+	 * agents' channels are shared, or, for a call whose tool named its approvers, one of those
+	 * principals, or, for any other call, the principal whose turn held them (by their id, for
+	 * actions held before 0.9). Their tier must now hold every call. Nobody else in the channel
+	 * may, so a call that named approvers is not its speaker's to approve unless named. The gate
+	 * checks the named approvers again when the turn begins, whoever asked for the release.
 	 */
 	#mayApprove(speaker: Speaker, pending: PendingConfirmation): boolean {
 		const theirs =
 			pending.principalId !== undefined
 				? speaker.principalId === pending.principalId
 				: speaker.id === pending.speakerId;
-		if (speaker.tier !== "owner" && !theirs) return false;
 		const tiers = this.#options.toolTiers ?? toolTiers();
+		// Nothing held names an approver to go by: only the owners and the speaker whose turn held it.
+		if (pending.calls.length === 0) return speaker.tier === "owner" || theirs;
 		return pending.calls.every(
 			(call) =>
+				(speaker.tier === "owner" ||
+					(call.approverIds ? mayApproveNamed(speaker, call) : theirs)) &&
 				tiers.allows(speaker.tier, call.tool) &&
 				(!call.minTier || tierAtLeast(speaker.tier, call.minTier)),
 		);

package/src/core/builtin/agent-server.ts

@@ -64,6 +64,11 @@ export interface AgentServerOptions {
 	 * see `AgentSessions.memory`.
 	 */
 	memory?: "everyone" | "owners";
+	/**
+	 * Who the agents answer in their channels and groups' channels: `"everyone"` (the default) or
+	 * `"owners"`, which leaves a speaker below the owner tier unanswered.
+	 */
+	speakers?: "everyone" | "owners";
 	/** The prompt every agent starts with, and the one for speakers other than the owner. */
 	prompts: { shared: string; guest?: string };
 	/** The listener the avatar pictures are served on. */
@@ -283,6 +288,7 @@ export function agentServerPlugin(
 				channels: [
 					agentClaim({
 						owner: options.owner,
+						...(options.speakers ? { speakers: options.speakers } : {}),
 						team: built,
 						runtime: running,
 						surface: context.surfaces,

package/src/core/config/access.ts

@@ -3,6 +3,8 @@ import {
 	type AccessRules,
 	type AccessTier,
 	checkAccessRules,
+	type Provisioning,
+	type ProvisioningRule,
 	rulesOfSpeakerMap,
 } from "../identity/access-policy.ts";
 import { parseIdentity } from "../identity/actor-facts.ts";
@@ -11,12 +13,14 @@ import type { Logger } from "../log.ts";
 import type { TierMembers } from "../speakers.ts";
 import type { Pronouns, ResolvedConfig, RoundtableConfig } from "./config.ts";
 import {
+	either,
 	type Field,
 	guarded,
 	integer,
 	list,
 	oneOf,
 	optional,
+	record,
 	shape,
 	text,
 } from "./schema.ts";
@@ -48,10 +52,19 @@ export interface AccessConfig {
 	owners: readonly AccessOwnerConfig[];
 	admins?: AccessTierConfig;
 	members?: AccessTierConfig;
-	/** `admitted` (default): someone the rules admit gets a principal at first contact, and a 0.8 speaker claims theirs; `linked`: only identities linked with the CLI, or the owners' configured ones, are served, and no one claims a 0.8 principal. */
-	provisioning?: "admitted" | "linked";
+	/**
+	 * `admitted` (default): someone the rules admit gets a principal at first contact, and a 0.8 speaker claims theirs; `linked`: only identities linked with the CLI, or the owners' configured ones, are served, and no one claims a 0.8 principal.
+	 * A map gives a mode per surface, such as `{ web: "admitted", discord: "linked" }`; a surface it leaves out is `linked`, so a misspelled surface cannot admit everyone.
+	 */
+	provisioning?: ProvisioningRule;
 	/** How many days someone whose tier comes only from the rules may go unseen before their background turns are refused; default 30. */
 	backgroundStaleDays?: number;
+	/**
+	 * Lets people link their own account of these identity providers, such as `["discord"]`, to
+	 * their principal through the `IDENTITY_LINKS` service a plugin reads; without it no such
+	 * service exists. A principal that holds the owner role cannot be linked this way.
+	 */
+	selfLink?: { providers: readonly string[] };
 }
 
 const everyone: Field<boolean | string[]> = guarded(
@@ -80,8 +93,14 @@ export const accessShape = shape({
 	),
 	admins: optional(tierShape),
 	members: optional(tierShape),
-	provisioning: optional(oneOf<"admitted" | "linked">("admitted", "linked")),
+	provisioning: optional(
+		either(
+			oneOf<Provisioning>("admitted", "linked"),
+			record(oneOf<Provisioning>("admitted", "linked")),
+		),
+	),
 	backgroundStaleDays: optional(integer(1, 36_500)),
+	selfLink: optional(shape({ providers: list(text) })),
 });
 
 /** The days an unseen principal's background turns keep their last tier, by default. */
@@ -124,6 +143,7 @@ export function rulesOfAccess(config: AccessConfig): AccessRules {
 		...(members ? { members } : {}),
 		provisioning: config.provisioning ?? "admitted",
 		backgroundStaleDays: config.backgroundStaleDays ?? BACKGROUND_STALE_DAYS,
+		...(config.selfLink ? { selfLink: config.selfLink } : {}),
 	});
 }
 

package/src/core/config/adapters.ts

@@ -38,6 +38,12 @@ export interface DiscordConfig {
 	 * no memory tools, and never makes claude-bridge refuse the owner afterwards.
 	 */
 	agentMemory?: "everyone" | "owners";
+	/**
+	 * Who may talk to the agents in their channels and groups' channels: `"everyone"` (default)
+	 * lets every speaker the access rules admit, `"owners"` only the owners, so a member's message
+	 * there starts no turn. An outside webhook's post in an agent's channel is reported as before.
+	 */
+	agentSpeakers?: "everyone" | "owners";
 	/**
 	 * What a turn addressed to the assistant in a server channel reads of the messages posted there
 	 * since its last post, mentions or not; on with the defaults when left out. `false` turns it off
@@ -67,6 +73,7 @@ export interface ResolvedDiscord {
 	admin: boolean;
 	refusalHint?: string;
 	agentMemory?: "everyone" | "owners";
+	agentSpeakers?: "everyone" | "owners";
 	/** As configured: `{}` when left out, so the defaults apply, or `false`. */
 	channelContext: NonNullable<DiscordConfig["channelContext"]>;
 	freshMarker?: string | false;
@@ -90,6 +97,9 @@ export function resolvedDiscord(
 		...(discord.agentMemory === undefined
 			? {}
 			: { agentMemory: discord.agentMemory }),
+		...(discord.agentSpeakers === undefined
+			? {}
+			: { agentSpeakers: discord.agentSpeakers }),
 		channelContext: discord.channelContext ?? {},
 		...(discord.freshMarker === undefined
 			? {}
@@ -116,6 +126,7 @@ export const discordShape = shape({
 	admin: optional(bool),
 	refusalHint: optional(text),
 	agentMemory: optional(oneOf<"everyone" | "owners">("everyone", "owners")),
+	agentSpeakers: optional(oneOf<"everyone" | "owners">("everyone", "owners")),
 	channelContext: optional(orOff(channelContextShape)),
 	freshMarker: optional(orOff(text)),
 	cardGraceSeconds: optional(integer(1, 86_400)),

package/src/core/config/schema.ts

@@ -103,6 +103,20 @@ export const record = <T>(item: Field<T>): Field<Record<string, T>> => ({
 	},
 });
 
+/** A string `string` accepts, or an object `object` accepts: one field that is written either way. */
+export const either = <A extends string, B extends object>(
+	string: Field<A>,
+	object: Field<B>,
+): Field<A | B> => ({
+	describe: `${string.describe}, or ${object.describe}`,
+	check: (value, path) => {
+		if (typeof value === "string") return string.check(value, path);
+		if (typeof value !== "object" || value === null || Array.isArray(value))
+			throw wrong(path, `${string.describe}, or ${object.describe}`, value);
+		return object.check(value, path);
+	},
+});
+
 /** A value a caller-supplied predicate accepts, such as a plugin object. */
 export const guarded = <T>(
 	describe: string,

package/src/core/define-roundtable.ts

@@ -200,6 +200,7 @@ function discordAssembly(
 			shellUser: userInfo().username,
 			prompts: { shared: sharedPrompt, guest },
 			...(discord.agentMemory ? { memory: discord.agentMemory } : {}),
+			...(discord.agentSpeakers ? { speakers: discord.agentSpeakers } : {}),
 			avatarListener: "public",
 			// resolveConfig refuses Discord without a public address.
 			avatarUrl: config.http?.publicUrl ?? "",

package/src/core/define.ts

@@ -8,6 +8,7 @@ import type { ReplyFile } from "./domain/conversation.ts";
 import { PluginError } from "./errors.ts";
 import { type HoldRule, isPromise } from "./holds.ts";
 import { messages } from "./i18n/index.ts";
+import type { ApprovedBy } from "./interactions/prompts.ts";
 import { type RoundtablePlugin, refuseRemovedFields } from "./plugin.ts";
 import type { AgentTurnScope, ChannelKey, SessionTool } from "./sessions.ts";
 import {
@@ -42,6 +43,13 @@ export interface ToolTurn {
 	 * when it is undefined.
 	 */
 	origin?: string;
+	/**
+	 * Who approved the call, for a call that was held: the person who pressed its card, or whose
+	 * message confirmed it, including a card answered after the turn stopped waiting. Undefined for
+	 * a call that ran without a hold, and for one a surface released without saying who; a tool
+	 * that must know the approver fails closed when it is undefined.
+	 */
+	approvedBy?: ApprovedBy;
 	/**
 	 * What the client that started the turn can do for this tool, such as run a function in the
 	 * browser the person chats from; undefined for a turn whose transport gives none, such as a
@@ -107,6 +115,20 @@ export interface ToolSpec<Schema extends TObject> {
 		args: Static<Schema>,
 		turn: ToolTurn,
 	) => string | undefined | Promise<string | undefined>;
+	/**
+	 * The principal ids that may approve this call when it is held, instead of the speaker whose
+	 * turn makes it, looked up as that turn like `hold` (same wait, same `turn.signal`, and it
+	 * must change nothing). Each needs the call's tier when they answer, and the owners may still
+	 * approve it. An empty list leaves the owners alone. A rejection or a timeout leaves the owners
+	 * alone too. Only these and the owners approve the call, by a card or by a message that
+	 * confirms it, even after a restart: the speaker whose turn made it may not unless named, and in
+	 * a private conversation, whose person alone answers, the call is refused unless they are named
+	 * or an owner. The approver reaches `run` as `turn.approvedBy`.
+	 */
+	approvers?: (
+		args: Static<Schema>,
+		turn: ToolTurn,
+	) => Promise<readonly string[]>;
 	run(args: Static<Schema>, turn: ToolTurn): Promise<ToolOutput> | ToolOutput;
 }
 
@@ -164,12 +186,12 @@ export function defineTool<Schema extends TObject>(
 					label: name,
 					description: spec.description,
 					parameters: spec.parameters,
-					execute: async (_toolCallId, params, signal) => {
+					execute: async (toolCallId, params, signal) => {
 						try {
 							return toolOutput(
 								await spec.run(
 									params as Static<Schema>,
-									toolTurn(context, signal),
+									toolTurn(context, signal, toolCallId),
 								),
 							);
 						} catch (error) {
@@ -181,22 +203,38 @@ export function defineTool<Schema extends TObject>(
 			},
 		}),
 	};
-	const hold = spec.hold;
+	const { hold, approvers } = spec;
 	const contribution = {
 		name,
 		minTier: spec.minTier,
 		agent: spec.agent ?? true,
 		session,
 	};
-	if (!hold) return contribution;
+	if (!hold && !approvers) return contribution;
 	return {
 		...contribution,
 		hold: {
 			name: `tool:${name}`,
 			describe: (tool, input) =>
-				tool === name ? holdWithoutTurn(name, hold, input) : undefined,
+				hold && tool === name ? holdWithoutTurn(name, hold, input) : undefined,
 			describeInTurn: (tool, input, _context, turn) =>
-				tool === name ? hold(input as Static<Schema>, turn) : undefined,
+				hold && tool === name ? hold(input as Static<Schema>, turn) : undefined,
+			...(approvers
+				? {
+						// The tool names approvers for its own calls only, so another tool's call with
+						// computed arguments in a precheck script is not made owner-only by it.
+						mayName: (tool: string) => tool === name,
+						approversInTurn: (
+							tool: string,
+							input: Record<string, unknown>,
+							_context: unknown,
+							turn: ToolTurn,
+						) =>
+							tool === name
+								? approvers(input as Static<Schema>, turn)
+								: undefined,
+					}
+				: {}),
 		},
 	};
 }