skillscript-runtime 0.15.7 → 0.16.1

package/dist/lint.js

@@ -257,11 +257,11 @@ const UNDECLARED_VAR = {
         for (const [targetName, target] of ctx.parsed.targets) {
             const reported = new Set(); // dedupe per target
             for (const op of target.ops) {
-                // `@ unsafe` ops use bash `$(...)` syntax — handled by
+                // Unsafe `shell` ops use bash `$(...)` syntax — handled by
                 // unsafe-shell-ambiguous-subst, which offers the dual rewrite
                 // (`$$(NAME)` for bash, `$(KNOWN_VAR)` for skillscript). Skip here
                 // to avoid double-reporting.
-                if (op.kind === "@" && op.policy === "unsafe")
+                if (op.kind === "shell" && op.policy === "unsafe")
                     continue;
                 for (const ref of extractVarRefs(op)) {
                     // Heuristic: dotted refs (targetname.output, MEMORY.field) pass
@@ -321,9 +321,9 @@ const MALFORMED_OP_GRAMMAR = {
     id: "malformed-op-grammar",
     severity: "error",
     description: "An op line failed parser grammar validation. Surfaces parse errors that originate from op-specific shape.",
-    remediation: "Check the op's syntax against the language reference. Common cases: `>` and `~` need `key=value ... -> VAR`; `& skill arg=value -> VAR` for skill invocations.",
+    remediation: "Check the op's syntax against the language reference. `$ tool key=value ... -> VAR` for MCP dispatch; `verb(kwarg=value, ...) [-> VAR]` for runtime intrinsics.",
     check: (ctx) => ctx.parsed.parseErrors
-        .filter((msg) => /Malformed `[~>&$@!?]/.test(msg))
+        .filter((msg) => /Malformed `\$|Malformed function-call|Legacy `[~>&@!?]/.test(msg))
         .map((msg) => ({
         rule: "malformed-op-grammar",
         severity: "error",
@@ -430,40 +430,6 @@ const UNKNOWN_SKILL_REFERENCE = {
         return findings;
     },
 };
-// v0.2.12 Bug 26. Tier-2 warning when a `>` retrieval op carries kwargs
-// outside the documented set. Cold author wrote `since=1h` (hallucinated
-// time-window predicate) and the kwarg passed silently. The documented
-// kwarg set is mode/query/limit/connector/fallback plus filter shapes
-// the connector advertises via staticCapabilities (out of band here).
-const KNOWN_RETRIEVAL_KWARGS = new Set(["mode", "query", "limit", "connector", "fallback"]);
-const UNKNOWN_RETRIEVAL_ARG = {
-    id: "unknown-retrieval-arg",
-    severity: "warning",
-    description: "A `>` retrieval op carries a kwarg outside the documented set (mode/query/limit/connector/fallback).",
-    remediation: "Remove the kwarg, or check it against your DataStore connector's documentation — extras pass through to the connector but unrecognized ones often indicate hallucinated syntax.",
-    check: (ctx) => {
-        const findings = [];
-        for (const [targetName, target] of ctx.parsed.targets) {
-            walkOps(target.ops, (op) => {
-                if (op.kind !== ">")
-                    return;
-                const extras = op.retrievalParams?.extra ?? {};
-                for (const k of Object.keys(extras)) {
-                    if (KNOWN_RETRIEVAL_KWARGS.has(k))
-                        continue;
-                    findings.push({
-                        rule: "unknown-retrieval-arg",
-                        severity: "warning",
-                        message: `\`>\` op in target '${targetName}' carries unknown kwarg '${k}'. Documented kwargs: ${Array.from(KNOWN_RETRIEVAL_KWARGS).join(", ")}. If '${k}' is a connector-specific filter, confirm it against the connector's docs.`,
-                        block: targetName,
-                        extras: { unknown_kwarg: k },
-                    });
-                }
-            });
-        }
-        return findings;
-    },
-};
 // v0.4.0 — `$ name.tool` references a connector name not registered.
 // `connectorNames` is the authoritative list from the Registry (passed
 // through LintOptions); when undefined (caller doesn't know what's
@@ -685,11 +651,19 @@ const UNVERIFIED_QUALIFIED_TOOL = {
 // the lint message didn't explain the layering. Now: if all sites have
 // fallback → info with layering explanation; if any site lacks it → error
 // (unchanged).
+// v0.16.0 — bare-form `$ <tool>` is reserved for runtime-intrinsic ops + tools
+// whose name name-matches a registered MCP connector (the typed-contract pattern,
+// e.g. `$ llm prompt=...` dispatches to the `llm` connector). Substrate-specific
+// MCP tool dispatch (e.g. `amp_olsen_task`) MUST use named form `$ <connector>.<tool>`
+// — no more "primary fallback" leniency. Closes the discipline-only-contract gap
+// where adopters wrote bare-form expecting `primary` and silent-failed on cron-fired
+// paths when primary wasn't registered.
+const BARE_FORM_INTRINSICS = new Set(["execute_skill", "json_parse"]);
 const UNWIRED_PRIMARY_CONNECTOR = {
     id: "unwired-primary-connector",
     severity: "error",
-    description: "A bare `$ TOOL` op (no connector prefix) routes to either (a) a wired connector matching the op name, or (b) the `primary` connector's tool dispatch. Neither resolves. Demoted to advisory when every call site declares `(fallback: ...)` (v0.9.4.1).",
-    remediation: "For skill authors (in-skill fix): qualify the op as `$ <connector>.<tool>` against a wired connector, OR pick a `tool` name that matches a wired connector name (e.g., `$ llm prompt=...` if `llm` is wired), OR add `(fallback: \"...\")` to every call site to acknowledge dispatch-time guarding. For runtime operators (config fix): wire a connector whose name matches the bare op (the v0.7.2 canonical pattern — e.g., `llm` / `memory` auto-wire by default in bundled deployments), or add a `primary` entry to connectors.json that handles the tool.",
+    description: "A bare `$ TOOL` op (no connector prefix) routes only to (a) a runtime-intrinsic op or (b) a wired connector whose name matches the op name. v0.16.0 removed the `primary` fallback — substrate-specific MCP tools require named form `$ <connector>.<tool>`.",
+    remediation: "Use named form `$ <connector>.<tool>` for substrate-specific MCP dispatch (e.g., `$ amp.amp_olsen_task` instead of `$ amp_olsen_task`). Bare form is reserved for runtime intrinsics (`execute_skill`, `json_parse`) and typed-contract ops where the tool name matches a wired connector (e.g., `$ llm prompt=...` if `llm` is wired).",
     check: (ctx) => {
         if (ctx.mcpConnectorNames === undefined)
             return [];
@@ -700,22 +674,17 @@ const UNWIRED_PRIMARY_CONNECTOR = {
             walkOps(target.ops, (op) => {
                 if (op.kind !== "$" || op.mcpConnector !== undefined)
                     return;
-                // Built-in intercepts that don't need a connector at all.
                 const m = /^([A-Za-z_][\w:-]*)/.exec(op.body);
                 if (m === null)
                     return;
                 const toolName = m[1];
-                if (toolName === "execute_skill" || toolName === "json_parse")
+                if (BARE_FORM_INTRINSICS.has(toolName))
                     return;
-                // v0.7.3 name-match: if the bare op name matches a wired
-                // connector, the runtime dispatch resolver routes there directly.
-                // (Mirrors `runtime.ts` `$` op dispatch — kept in sync with that
-                // fix to prevent the v0.7.2-shape regression of lint-fails-then-
-                // user-never-reaches-runtime.)
+                // Name-match: bare op name matches a wired connector → typed-contract
+                // pattern (e.g., `$ llm` against wired `llm` connector). Runtime
+                // dispatch resolver routes directly.
                 if (ctx.mcpConnectorNames.includes(toolName))
                     return;
-                if (ctx.mcpConnectorNames.includes("primary"))
-                    return;
                 const key = `${targetName}:${toolName}`;
                 const hasFallback = op.fallback !== undefined;
                 const existing = groups.get(key);
@@ -742,7 +711,7 @@ const UNWIRED_PRIMARY_CONNECTOR = {
                 findings.push({
                     rule: "unwired-primary-connector",
                     severity: "error",
-                    message: `\`$ ${toolName}\` in target '${targetName}' is a bare tool op — no connector named '${toolName}' wired and no \`primary\` fallback. Wired connectors: ${wired}.`,
+                    message: `\`$ ${toolName}\` in target '${targetName}' is bare-form but '${toolName}' is not a runtime intrinsic AND doesn't match any wired MCP connector. Bare form is reserved for typed-contract / intrinsic ops. Use named form \`$ <connector>.${toolName}\` for substrate-specific MCP dispatch. Wired connectors: ${wired}.`,
                     block: targetName,
                     extras: { tool: toolName },
                 });
@@ -809,14 +778,6 @@ const UNPARSED_JSON_FIELD_ACCESS = {
                     for (const b of op.ifBranches)
                         reportIfMatches(b.cond, targetName);
                 }
-                if (op.retrievalParams !== undefined) {
-                    reportIfMatches(op.retrievalParams.query, targetName);
-                    for (const v of Object.values(op.retrievalParams.extra))
-                        reportIfMatches(String(v), targetName);
-                }
-                if (op.localModelParams !== undefined) {
-                    reportIfMatches(op.localModelParams.prompt, targetName);
-                }
                 if (op.ampParams !== undefined) {
                     for (const v of Object.values(op.ampParams.args))
                         reportIfMatches(v, targetName);
@@ -892,26 +853,60 @@ const DISABLED_SKILL_REFERENCE = {
         return findings;
     },
 };
-/** Patterns that strongly suggest a credential in plaintext. Conservative — false positives are noisy, false negatives are dangerous, so we err on the side of catching obvious cases. */
-const CREDENTIAL_ARG_PATTERN = /\b(apikey|api_key|token|secret|password|passwd|pwd|auth_token|access_token|bearer)\s*=/i;
+// Credential detection covers two surfaces:
+//
+//   1. KEY shape — identifier names that conventionally hold secrets,
+//      followed by `=` or `:` (covers MCP-tool kwargs, HTTP headers like
+//      `Authorization: Bearer ...`, connector config k:v pairs).
+//
+//   2. VALUE shape — recognizable token prefixes/structures (Bearer
+//      tokens, OpenAI `sk-` keys, GitHub `ghp_` tokens, JWT `eyJ.X.Y`).
+//      Catches credentials in unnamed positions (e.g., literal Bearer
+//      token in a shell command body).
+//
+// Tier-2 (warning) — broader patterns mean some false positives are
+// expected. False positives are noisy; false negatives are dangerous.
+const CREDENTIAL_KEY_PATTERN = /\b(api[_-]?key|token|secret|password|passwd|pwd|auth(?:[_-]?token)?|access[_-]?token|bearer|client[_-]?secret|private[_-]?key|signing[_-]?key|refresh[_-]?token|connection[_-]?string|vault[_-]?token|db[_-]?password)\s*[:=]/i;
+const CREDENTIAL_VALUE_PATTERN = /(?:Bearer\s+[A-Za-z0-9_.~+/=-]{20,}|\bsk-[A-Za-z0-9_-]{20,}|\bghp_[A-Za-z0-9]{20,}|\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)/;
+function findsCredential(text) {
+    return CREDENTIAL_KEY_PATTERN.test(text) || CREDENTIAL_VALUE_PATTERN.test(text);
+}
 const CREDENTIAL_IN_ARGS = {
     id: "credential-in-args",
-    severity: "error",
-    description: "A `$` op carries arg values that match credential-like patterns. Credentials don't belong in skill source.",
-    remediation: "Move credentials to per-connector config (env vars, mounted secrets). Skill args should reference operator-managed values, not embed them.",
+    severity: "warning",
+    description: "An op or `# Vars:` default appears to carry credential-like content. Credentials don't belong in skill source.",
+    remediation: "Move credentials to per-connector config (env vars in connectors.json, mounted secrets). Skill source should reference operator-managed values via `# Requires: user-var:NAME -> VAR`, not embed them.",
     check: (ctx) => {
         const findings = [];
+        const reported = new Set();
+        const emit = (where, snippet, block) => {
+            const key = `${where}:${snippet.slice(0, 60)}`;
+            if (reported.has(key))
+                return;
+            reported.add(key);
+            findings.push({
+                rule: "credential-in-args",
+                severity: "warning",
+                message: `${where}: credential-like content detected ('${snippet.slice(0, 60).replace(/\n/g, " ")}${snippet.length > 60 ? "..." : ""}').`,
+                ...(block !== undefined ? { block } : {}),
+            });
+        };
+        // # Vars: default values — author-written, often where adopters paste secrets by mistake.
+        for (const v of ctx.parsed.vars) {
+            if (v.default !== undefined && findsCredential(v.default)) {
+                emit(`# Vars: ${v.name} default`, v.default);
+            }
+        }
+        // Op bodies + value-bearing fields across all op kinds.
         for (const [targetName, target] of ctx.parsed.targets) {
             walkOps(target.ops, (op) => {
-                if (op.kind !== "$")
-                    return;
-                if (CREDENTIAL_ARG_PATTERN.test(op.body)) {
-                    findings.push({
-                        rule: "credential-in-args",
-                        severity: "error",
-                        message: `\`$\` op in target '${targetName}' appears to carry credential-like arg ('${op.body.slice(0, 40)}...').`,
-                        block: targetName,
-                    });
+                // Op body — covers $, shell, emit, $set body, foreach list, etc.
+                if (op.body !== undefined && findsCredential(op.body)) {
+                    emit(`Op '${op.kind}' in target '${targetName}'`, op.body, targetName);
+                }
+                // Mutation-statement value (setValue holds the RHS of $set / $append).
+                if (op.setValue !== undefined && findsCredential(op.setValue)) {
+                    emit(`'${op.kind}' value in target '${targetName}'`, op.setValue, targetName);
                 }
             });
         }
@@ -1013,11 +1008,11 @@ const MISSING_SKILLSTORE_FOR_DATA_REF = {
         const findings = [];
         for (const [targetName, target] of ctx.parsed.targets) {
             for (const op of target.ops) {
-                if (op.kind === "&") {
+                if (op.kind === "inline") {
                     findings.push({
                         rule: "missing-skillstore-for-data-ref",
                         severity: "error",
-                        message: `Skill references skill '${op.ampParams?.skillName ?? "(unknown)"}' via \`&\`, but lint was invoked without a SkillStore (call site: ${ctx.callSite}). Data-skill inlining will silently skip; the \`&\` op will survive into the runtime and error.`,
+                        message: `Skill references skill '${op.ampParams?.skillName ?? "(unknown)"}' via \`inline(...)\`, but lint was invoked without a SkillStore (call site: ${ctx.callSite}). Data-skill inlining will silently skip; the \`inline\` op will survive into the runtime and error.`,
                         block: targetName,
                         extras: { call_site: ctx.callSite },
                     });
@@ -1088,7 +1083,7 @@ const UNSAFE_SHELL_AMBIGUOUS_SUBST = {
         for (const [targetName, target] of ctx.parsed.targets) {
             const reported = new Set();
             walkOps(target.ops, (op) => {
-                if (op.kind !== "@" || op.policy !== "unsafe")
+                if (op.kind !== "shell" || op.policy !== "unsafe")
                     return;
                 const re = new RegExp(REF_RE.source, "g");
                 let m;
@@ -1128,6 +1123,81 @@ const UNSAFE_SHELL_AMBIGUOUS_SUBST = {
         return findings;
     },
 };
+// Sibling to unsafe-shell-ambiguous-subst: that rule catches refs that
+// AREN'T declared (potential bash command-sub collision); this rule
+// catches refs that ARE declared but are inlined raw into bash, missing
+// the `|shell` escape filter. Author intent is "substitute this variable"
+// but they haven't told the runtime to bash-escape it — variable values
+// containing spaces or shell metacharacters break the command silently
+// or, worse, become injectable.
+const UNSAFE_SHELL_UNESCAPED_SUBST = {
+    id: "unsafe-shell-unescaped-subst",
+    severity: "warning",
+    description: "An `unsafe=true` shell op interpolates a declared variable into a bash command body without the `|shell` escape filter. Variable values containing whitespace or shell metacharacters break the command or become injectable.",
+    remediation: "Add the `|shell` filter on every interpolation: `${VAR|shell}` produces a single bash-quoted token. The filter exists for exactly this case — it's the canonical escape for unsafe-shell substitution.",
+    check: (ctx) => {
+        const declared = new Set();
+        for (const v of ctx.parsed.vars)
+            declared.add(v.name);
+        for (const r of ctx.parsed.requires)
+            declared.add(r.target);
+        for (const target of ctx.parsed.targets.values()) {
+            const collect = (op) => {
+                if (op.setName !== undefined)
+                    declared.add(op.setName);
+                if (op.outputVar !== undefined)
+                    declared.add(op.outputVar);
+                if (op.foreachIter !== undefined)
+                    declared.add(op.foreachIter);
+            };
+            walkOps(target.ops, collect);
+            if (target.elseBlock !== undefined)
+                walkOps(target.elseBlock, collect);
+        }
+        const findings = [];
+        // Match both `${VAR|filters}` and `$(VAR|filters)` forms. Capture the
+        // var name + the filter chain. Single `$` only — `$$(...)` is the
+        // bash-literal escape, not a skillscript substitution.
+        const REF_RE = /(?<!\$)\$(?:\{([^|}\s]+)((?:\|\s*[A-Za-z_]\w*(?:\s*:\s*"[^"]*")?)*)\}|\(([^|)\s]+)((?:\|\s*[A-Za-z_]\w*(?:\s*:\s*"[^"]*")?)*)\))/g;
+        for (const [targetName, target] of ctx.parsed.targets) {
+            const reported = new Set();
+            walkOps(target.ops, (op) => {
+                if (op.kind !== "shell" || op.policy !== "unsafe")
+                    return;
+                const re = new RegExp(REF_RE.source, "g");
+                let m;
+                while ((m = re.exec(op.body)) !== null) {
+                    const varName = (m[1] ?? m[3]);
+                    const chain = (m[2] ?? m[4]) ?? "";
+                    // Skip dotted refs (structured access — author's responsibility).
+                    if (varName.includes("."))
+                        continue;
+                    // Skip ambient refs — runtime-injected, author can't filter them.
+                    if (AMBIENT_VARS.includes(varName))
+                        continue;
+                    // Skip refs whose ROOT identifier isn't declared (those fire as
+                    // `unsafe-shell-ambiguous-subst` or `undeclared-var` instead).
+                    if (!declared.has(varName))
+                        continue;
+                    // The cure: a `|shell` filter in the chain.
+                    if (/\|\s*shell\b/.test(chain))
+                        continue;
+                    if (reported.has(varName))
+                        continue;
+                    reported.add(varName);
+                    findings.push({
+                        rule: "unsafe-shell-unescaped-subst",
+                        severity: "warning",
+                        message: `\`\${${varName}}\` interpolated into \`shell(command=..., unsafe=true)\` body in target '${targetName}' without the \`|shell\` escape filter. Variable values with spaces or shell metacharacters will break the command or become injectable. Rewrite as \`\${${varName}|shell}\`.`,
+                        block: targetName,
+                        extras: { var_name: varName },
+                    });
+                }
+            });
+        }
+        return findings;
+    },
+};
 const UNSAFE_SHELL_OP = {
     id: "unsafe-shell-op",
     severity: "warning",
@@ -1137,7 +1207,7 @@ const UNSAFE_SHELL_OP = {
         const findings = [];
         for (const [targetName, target] of ctx.parsed.targets) {
             walkOps(target.ops, (op) => {
-                if (op.kind === "@" && op.policy === "unsafe") {
+                if (op.kind === "shell" && op.policy === "unsafe") {
                     findings.push({
                         rule: "unsafe-shell-op",
                         severity: "warning",
@@ -1173,7 +1243,7 @@ const UNSAFE_SHELL_DISABLED = {
         const findings = [];
         for (const [targetName, target] of ctx.parsed.targets) {
             walkOps(target.ops, (op) => {
-                if (op.kind === "@" && op.policy === "unsafe") {
+                if (op.kind === "shell" && op.policy === "unsafe") {
                     findings.push({
                         rule: "unsafe-shell-disabled",
                         severity: "error",
@@ -1202,8 +1272,8 @@ const UNSAFE_SHELL_DISABLED = {
 const UNCONFIRMED_MUTATION = {
     id: "unconfirmed-mutation",
     severity: "warning",
-    description: "A mutation-class op runs without author authorization. Mutation classes: `$ tool` with mutating-name shape (write/update/delete/...); `$ data_write` MCP dispatch; `file_write(...)` function-call op. Silent when the skill declares `# Autonomous: true` (v0.4.2), when a preceding `??` / `ask(...)` confirmation gates the op, or (v0.7.0+) when the op carries `approved=\"reason\"` per-op authorization.",
-    remediation: "Three ways to authorize: (1) add `# Autonomous: true` at the skill header for cron/agent-fired skills; (2) add a preceding `??` / `ask(prompt=\"...\")` confirmation op in the same target; (3) v0.7.0+: pass `approved=\"reason\"` kwarg on the mutation op itself (any non-empty string; presence is what matters, value not parsed semantically).",
+    description: "A mutation-class op runs without author authorization. Mutation classes: `$ tool` with mutating-name shape (write/update/delete/...); `$ data_write` MCP dispatch; `file_write(...)` function-call op. Silent when the skill declares `# Autonomous: true` or when the op carries `approved=\"reason\"` per-op authorization.",
+    remediation: "Two ways to authorize: (1) add `# Autonomous: true` at the skill header for cron/agent-fired skills; (2) pass `approved=\"reason\"` kwarg on the mutation op itself (any non-empty string; presence is what matters, value not parsed semantically).",
     check: (ctx) => {
         const skillAutonomous = ctx.parsed.autonomous === true;
         // v0.4.2 — `# Autonomous: true` skills are unattended by design;
@@ -1214,12 +1284,8 @@ const UNCONFIRMED_MUTATION = {
             return [];
         const findings = [];
         for (const [targetName, target] of ctx.parsed.targets) {
-            const authState = { skillAutonomous, sawConfirm: false };
+            const authState = { skillAutonomous };
             for (const op of target.ops) {
-                // v0.7.0+: ask(prompt=...) parses to kind "??" in the AST, so the
-                // same check captures both legacy `??` and canonical `ask()`.
-                if (op.kind === "??")
-                    authState.sawConfirm = true;
                 if (authorizationGranted(op, authState))
                     continue;
                 const classification = classifyMutation(op);
@@ -1229,7 +1295,7 @@ const UNCONFIRMED_MUTATION = {
                     findings.push({
                         rule: "unconfirmed-mutation",
                         severity: "warning",
-                        message: `\`file_write(path="${classification.detail}")\` in target '${targetName}' is a mutation op without authorization. Add \`approved="..."\` kwarg, precede with \`ask(...)\`, or declare \`# Autonomous: true\`.`,
+                        message: `\`file_write(path="${classification.detail}")\` in target '${targetName}' is a mutation op without authorization. Add \`approved="..."\` kwarg or declare \`# Autonomous: true\`.`,
                         block: targetName,
                         extras: { op_kind: "file_write", path: classification.detail },
                     });
@@ -1238,7 +1304,7 @@ const UNCONFIRMED_MUTATION = {
                     findings.push({
                         rule: "unconfirmed-mutation",
                         severity: "warning",
-                        message: `\`$\` op in target '${targetName}' invokes '${classification.detail}' (mutating shape) without authorization. Add \`approved="..."\` kwarg, precede with \`ask(...)\`, or declare \`# Autonomous: true\`.`,
+                        message: `\`$\` op in target '${targetName}' invokes '${classification.detail}' (mutating shape) without authorization. Add \`approved="..."\` kwarg or declare \`# Autonomous: true\`.`,
                         block: targetName,
                         extras: { tool_name: classification.detail },
                     });
@@ -1248,41 +1314,6 @@ const UNCONFIRMED_MUTATION = {
         return findings;
     },
 };
-const MODEL_CONTENTION = {
-    id: "model-contention",
-    severity: "warning",
-    description: "Skill body has a `$` op dispatching async batch work on a model + a downstream `~ model=X` synchronous call to the same model. The runtime serializes per-model; the sync call queues behind the batch.",
-    remediation: "Use distinct models for async vs sync work: e.g., `gemma2` for batch + `qwen` for the interactive verdict. See ERD §3 model selection convention.",
-    check: (ctx) => {
-        const findings = [];
-        // Heuristic: collect ~ op model names per target. Flag if any $ op
-        // in the same target dispatches a batch-classification-shaped tool
-        // (name contains "olsen", "scan", "batch", "classify"). Conservative.
-        for (const [targetName, target] of ctx.parsed.targets) {
-            const syncModels = new Set();
-            walkOps(target.ops, (op) => {
-                if (op.kind === "~" && op.localModelParams?.model)
-                    syncModels.add(op.localModelParams.model);
-            });
-            if (syncModels.size === 0)
-                return findings;
-            walkOps(target.ops, (op) => {
-                if (op.kind !== "$")
-                    return;
-                const toolName = op.body.split(/\s+/)[0] ?? "";
-                if (/scan|batch|classify|atomize/i.test(toolName)) {
-                    findings.push({
-                        rule: "model-contention",
-                        severity: "warning",
-                        message: `Target '${targetName}' dispatches batch work via '${toolName}' AND uses sync \`~ model=...\` — possible model contention on the same backend.`,
-                        block: targetName,
-                    });
-                }
-            });
-        }
-        return findings;
-    },
-};
 const DRAFT_WITH_TRIGGER = {
     id: "draft-with-trigger",
     severity: "warning",
@@ -1523,7 +1554,7 @@ const OUTPUT_AGENT_TARGET_NO_EMIT = {
             return findings;
         let hasEmit = false;
         for (const [, target] of ctx.parsed.targets) {
-            walkOps(target.ops, (op) => { if (op.kind === "!")
+            walkOps(target.ops, (op) => { if (op.kind === "emit")
                 hasEmit = true; });
             if (hasEmit)
                 break;
@@ -2055,12 +2086,8 @@ function buildBindingOrigins(parsed) {
             if (op.outputVar !== undefined) {
                 if (op.kind === "$")
                     origins.set(op.outputVar, { kind: "op-output", op: "$" });
-                else if (op.kind === "~")
-                    origins.set(op.outputVar, { kind: "op-output", op: "~" });
-                else if (op.kind === ">")
-                    origins.set(op.outputVar, { kind: "op-output", op: ">" });
-                else if (op.kind === "@")
-                    origins.set(op.outputVar, { kind: "op-output", op: "@" });
+                else if (op.kind === "shell")
+                    origins.set(op.outputVar, { kind: "op-output", op: "shell" });
             }
             if (op.kind === "foreach" && op.foreachIter !== undefined) {
                 origins.set(op.foreachIter, { kind: "foreach-iter" });
@@ -2136,14 +2163,13 @@ const UNQUOTED_SUBSTITUTION_IN_KWARG_VALUE = {
                         });
                     }
                 }
-                else if (op.kind === "@") {
-                    // v0.7.2 — legacy @ shell op. Tokenize the body the same way the
-                    // runtime would (whitespace-separated, quotes respected), then
-                    // flag any token that is a bare unquoted substitution. Quoted
-                    // tokens (`"${VAR}"` / `'${VAR}'`) are safe.
+                else if (op.kind === "shell") {
+                    // Tokenize the shell body the same way the runtime would
+                    // (whitespace-separated, quotes respected), then flag any token
+                    // that is a bare unquoted substitution. Quoted tokens
+                    // (`"${VAR}"` / `'${VAR}'`) are safe.
                     const tokens = tokenizeKeywordArgs(op.body);
                     for (const tok of tokens) {
-                        // Skip quoted tokens — the quotes protect against whitespace split.
                         if ((tok.startsWith('"') && tok.endsWith('"')) || (tok.startsWith("'") && tok.endsWith("'")))
                             continue;
                         if (!(tok.startsWith("$(") || tok.startsWith("${")))
@@ -2156,16 +2182,16 @@ const UNQUOTED_SUBSTITUTION_IN_KWARG_VALUE = {
                         const origin = origins.get(rootVar);
                         if (!isOriginSuspect(origin))
                             continue;
-                        const dedupKey = `${targetName}:@:${varName}`;
+                        const dedupKey = `${targetName}:shell:${varName}`;
                         if (reported.has(dedupKey))
                             continue;
                         reported.add(dedupKey);
                         findings.push({
                             rule: "unquoted-substitution-in-kwarg-value",
                             severity: "warning",
-                            message: `\`@ ... \${${varName}}\` shell arg in target '${targetName}': unquoted substitution. ${describeOriginRisk(origin)} Wrap as \`"\${${varName}}"\` to prevent silent word-splitting if the value contains whitespace.`,
+                            message: `\`shell(command="... \${${varName}} ...")\` in target '${targetName}': unquoted substitution. ${describeOriginRisk(origin)} Wrap as \`"\${${varName}}"\` to prevent silent word-splitting if the value contains whitespace.`,
                             block: targetName,
-                            extras: { var_name: varName, origin: origin.kind, op: "@" },
+                            extras: { var_name: varName, origin: origin.kind, op: "shell" },
                         });
                     }
                 }
@@ -2188,86 +2214,6 @@ function describeOriginRisk(origin) {
             return `Variable is a \`foreach\` iterator — element type unknown statically.`;
     }
 }
-/**
- * v0.7.1 — tier-2 visibility nudge for legacy symbol-form ops (`~`, `>`,
- * `@`, `!`, `??`, `&`). The parser still accepts these during the v0.7.x
- * grace period; the runtime dispatches them as before. This rule surfaces
- * the canonical replacement so authors editing skills see the migration
- * path. Tier-1 promotion (refuse-to-compile) lands in v0.8 or v0.9 once
- * the adopter ecosystem confirms migration is settled.
- *
- * The `$ tool` op is NOT flagged — that shape is canonical (MCP dispatch
- * marker). Only the 6 symbol ops that became function-call ops in v0.7.0.
- */
-const DEPRECATED_SYMBOL_OP_REPLACEMENT = {
-    // v0.7.2: bridge classes ship default-wired so `$ llm` / `$ data_read` work
-    // out of the box in default deployments. Suggestions are load-bearing
-    // (no more "(or your wired connector name)" caveat).
-    "~": "$ llm prompt=\"...\" [maxTokens=N] [model=\"...\"] -> R",
-    ">": "$ data_read mode=\"fts|semantic|rerank\" query=\"...\" limit=N -> R",
-    "@": "shell(command=\"...\") [-> R]",
-    "!": "emit(text=\"...\")",
-    "??": "ask(prompt=\"...\") -> R",
-    "&": "inline(skill=\"...\")   (or execute_skill(skill_name=\"...\", ...) -> R for procedural composition)",
-};
-const DEPRECATED_SYMBOL_OP = {
-    id: "deprecated-symbol-op",
-    severity: "warning",
-    description: "An op uses the legacy symbol form deprecated in v0.7.0.",
-    remediation: "Rewrite to the canonical v0.7.0 form (see message). All legacy ops continue to compile during the grace period; tier-1 promotion (refuse-to-compile) lands in v0.8/v0.9. See CHANGELOG.md `## 0.7.0 — Migration` for the full rewrite rules.",
-    check: (ctx) => {
-        const findings = [];
-        for (const [targetName, target] of ctx.parsed.targets) {
-            const reported = new Set();
-            walkOps(target.ops, (op) => {
-                const replacement = DEPRECATED_SYMBOL_OP_REPLACEMENT[op.kind];
-                if (replacement === undefined)
-                    return;
-                // v0.7.1: skip ops authored in canonical function-call form. The
-                // parser collapses both `! x` and `emit(text="x")` to kind "!",
-                // so without the sourceForm marker the lint would fire on
-                // canonical code. Source-form marker preserves which surface
-                // the author wrote.
-                if (op.sourceForm === "function-call")
-                    return;
-                // Dedupe per-kind-per-target — one nudge per legacy op type per
-                // target is plenty; further occurrences don't add signal.
-                const key = `${targetName}:${op.kind}`;
-                if (reported.has(key))
-                    return;
-                reported.add(key);
-                findings.push({
-                    rule: "deprecated-symbol-op",
-                    severity: "warning",
-                    message: `Op '${op.kind}' in target '${targetName}' is deprecated in v0.7.0. Rewrite as: \`${replacement}\``,
-                    block: targetName,
-                    extras: { legacy_op: op.kind, canonical_replacement: replacement },
-                });
-            });
-            if (target.elseBlock !== undefined) {
-                walkOps(target.elseBlock, (op) => {
-                    const replacement = DEPRECATED_SYMBOL_OP_REPLACEMENT[op.kind];
-                    if (replacement === undefined)
-                        return;
-                    if (op.sourceForm === "function-call")
-                        return;
-                    const key = `${targetName}:else:${op.kind}`;
-                    if (reported.has(key))
-                        return;
-                    reported.add(key);
-                    findings.push({
-                        rule: "deprecated-symbol-op",
-                        severity: "warning",
-                        message: `Op '${op.kind}' in target '${targetName}' (else block) is deprecated in v0.7.0. Rewrite as: \`${replacement}\``,
-                        block: targetName,
-                        extras: { legacy_op: op.kind, canonical_replacement: replacement },
-                    });
-                });
-            }
-        }
-        return findings;
-    },
-};
 /**
  * v0.7.1 — tier-2 visibility nudge for legacy `$(VAR)` substitution form.
  * Canonical v0.7.0+ form is `${VAR}`. Parser/runtime accept both during
@@ -2381,7 +2327,6 @@ const RULES = [
     RESERVED_KEYWORD,
     UNKNOWN_SKILL_REFERENCE,
     UNKNOWN_TEMPLATE_REFERENCE,
-    UNKNOWN_RETRIEVAL_ARG,
     UNKNOWN_CONNECTOR,
     UNKNOWN_CONNECTOR_CLASS,
     UNWIRED_PRIMARY_CONNECTOR,
@@ -2399,14 +2344,13 @@ const RULES = [
     MISSING_SKILLSTORE_FOR_DATA_REF,
     // Tier-2 (warning)
     DEPRECATED_QUESTION,
-    DEPRECATED_SYMBOL_OP,
     DEPRECATED_SUBSTITUTION_SHAPE,
     UNSAFE_SHELL_AMBIGUOUS_SUBST,
+    UNSAFE_SHELL_UNESCAPED_SUBST,
     UNSAFE_SHELL_OP,
     UNSAFE_SHELL_DISABLED,
     UNCONFIRMED_MUTATION,
     UNQUOTED_SUBSTITUTION_IN_KWARG_VALUE,
-    MODEL_CONTENTION,
     DRAFT_WITH_TRIGGER,
     REFERENCE_TO_DISABLED_SKILL,
     UNUSED_AUGMENTING_HEADER,
@@ -2457,9 +2401,9 @@ function collectAmpRefsFromOps(ops) {
         out.push({ name, via });
     };
     walkOps(ops, (op) => {
-        if (op.kind === "&" && op.ampParams !== undefined)
-            emit(op.ampParams.skillName, "&");
-        // v0.2.11 Bug 7: $ execute_skill is also a composition primitive.
+        if (op.kind === "inline" && op.ampParams !== undefined)
+            emit(op.ampParams.skillName, "inline");
+        // `$ execute_skill` is also a composition primitive.
         if (op.kind === "$" && /^execute_skill\b/.test(op.body)) {
             // v0.15.2 — accept either `name` or `skill_name` (back-compat alias).
             const m = /\b(?:skill_name|name)\s*=\s*(?:"([^"]+)"|'([^']+)'|([A-Za-z_][\w-]*))/.exec(op.body);
@@ -2520,11 +2464,6 @@ function extractVarRefsWithFilter(op) {
 }
 function collectOpText(op) {
     let text = op.body;
-    if (op.retrievalParams !== undefined) {
-        text += " " + op.retrievalParams.query + " " + Object.values(op.retrievalParams.extra).join(" ");
-    }
-    if (op.localModelParams !== undefined)
-        text += " " + op.localModelParams.prompt;
     if (op.setValue !== undefined)
         text += " " + op.setValue;
     if (op.foreachList !== undefined)