skillscript-runtime 0.19.16 → 0.20.0

package/dist/runtime-env-resolver.d.ts

@@ -39,8 +39,12 @@ export interface RuntimeEnvConfig {
     absoluteTimeoutMs?: number;
     maxRecursionDepth?: number;
     shellAllowlist?: string[];
+    fsAllowlist?: string[];
     eventIngressEnabled?: boolean;
     eventIngressAuthToken?: string;
+    securedMode?: boolean;
+    approvalKeyFile?: string;
+    approvalPublicKeyFile?: string;
 }
 /**
  * Read all `SKILLSCRIPT_*` env vars from the supplied env (defaults to

package/dist/runtime-env-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-env-resolver.d.ts","sourceRoot":"","sources":["../src/runtime-env-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,WAAW,gBAAgB;IAE/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAEjC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuElG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAIhG;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,SAAS,CAGvG"}
+{"version":3,"file":"runtime-env-resolver.d.ts","sourceRoot":"","sources":["../src/runtime-env-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,WAAW,gBAAgB;IAE/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAEjC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAkGlG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAIhG;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,SAAS,CAGvG"}

package/dist/runtime-env-resolver.js

@@ -99,6 +99,16 @@ export function resolveRuntimeConfigFromEnv(env = process.env) {
             .map((b) => b.trim())
             .filter((b) => b.length > 0);
     }
+    // SKILLSCRIPT_FS_ALLOWLIST — comma-separated filesystem roots that file_read /
+    // file_write may touch (Gate #7 third allowlist). Same parse + default-deny
+    // semantics as the shell allowlist.
+    const fsAllowlistRaw = env["SKILLSCRIPT_FS_ALLOWLIST"];
+    if (fsAllowlistRaw !== undefined) {
+        config.fsAllowlist = fsAllowlistRaw
+            .split(",")
+            .map((p) => p.trim())
+            .filter((p) => p.length > 0);
+    }
     // SKILLSCRIPT_EVENT_INGRESS_ENABLED — boolean
     const ingressRaw = env["SKILLSCRIPT_EVENT_INGRESS_ENABLED"];
     if (ingressRaw === "true")
@@ -109,6 +119,23 @@ export function resolveRuntimeConfigFromEnv(env = process.env) {
     const tokenRaw = env["SKILLSCRIPT_EVENT_INGRESS_AUTH_TOKEN"];
     if (typeof tokenRaw === "string" && tokenRaw !== "")
         config.eventIngressAuthToken = tokenRaw;
+    // SKILLSCRIPT_SECURED_MODE — boolean. The Gate #7 approval boundary: when on,
+    // only v3-signed skills execute effectfully.
+    const securedRaw = env["SKILLSCRIPT_SECURED_MODE"];
+    if (securedRaw === "true")
+        config.securedMode = true;
+    else if (securedRaw === "false")
+        config.securedMode = false;
+    // SKILLSCRIPT_APPROVAL_KEY_FILE — path to the operator's Ed25519 PRIVATE key
+    // (read only by the approve flow; the runtime never loads it).
+    const keyFileRaw = env["SKILLSCRIPT_APPROVAL_KEY_FILE"];
+    if (typeof keyFileRaw === "string" && keyFileRaw !== "")
+        config.approvalKeyFile = keyFileRaw;
+    // SKILLSCRIPT_APPROVAL_PUBLIC_KEY_FILE — path to the Ed25519 PUBLIC key
+    // (non-secret; the runtime reads it to verify v3 tokens).
+    const pubFileRaw = env["SKILLSCRIPT_APPROVAL_PUBLIC_KEY_FILE"];
+    if (typeof pubFileRaw === "string" && pubFileRaw !== "")
+        config.approvalPublicKeyFile = pubFileRaw;
     return config;
 }
 /**

package/dist/runtime-env-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-env-resolver.js","sourceRoot":"","sources":["../src/runtime-env-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAsBH;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9E,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,sCAAsC;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,kCAAkC;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACxC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;QAAE,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC;IAEzE,kDAAkD;IAClD,MAAM,SAAS,GAAG,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE;QAAE,MAAM,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAElG,6DAA6D;IAC7D,MAAM,SAAS,GAAG,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACzD,IAAI,SAAS,KAAK,MAAM;QAAE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;SACrD,IAAI,SAAS,KAAK,OAAO;QAAE,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC;IAEjE,2CAA2C;IAC3C,MAAM,aAAa,GAAG,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC5D,IAAI,aAAa,KAAK,MAAM;QAAE,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;SACxD,IAAI,aAAa,KAAK,OAAO;QAAE,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;IAEpE,sDAAsD;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,mBAAmB,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,qDAAqD;IACrD,MAAM,UAAU,GAAG,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC;IACjE,CAAC;IAED,0DAA0D;IAC1D,MAAM,UAAU,GAAG,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,4DAA4D;IAC5D,qEAAqE;IACrE,gEAAgE;IAChE,2CAA2C;IAC3C,MAAM,YAAY,GAAG,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACxD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,cAAc,GAAG,YAAY;aACjC,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,8CAA8C;IAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,mCAAmC,CAAC,CAAC;IAC5D,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC;SACxD,IAAI,UAAU,KAAK,OAAO;QAAE,MAAM,CAAC,mBAAmB,GAAG,KAAK,CAAC;IAEpE,sEAAsE;IACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAC7D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;QAAE,MAAM,CAAC,qBAAqB,GAAG,QAAQ,CAAC;IAE7F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAI,QAAuB,EAAE,OAAsB,EAAE,QAAW;IAC3F,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC1C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAI,QAAuB,EAAE,OAAsB;IACtF,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"runtime-env-resolver.js","sourceRoot":"","sources":["../src/runtime-env-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AA4BH;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9E,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,sCAAsC;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,kCAAkC;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACxC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;QAAE,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC;IAEzE,kDAAkD;IAClD,MAAM,SAAS,GAAG,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE;QAAE,MAAM,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAElG,6DAA6D;IAC7D,MAAM,SAAS,GAAG,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACzD,IAAI,SAAS,KAAK,MAAM;QAAE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;SACrD,IAAI,SAAS,KAAK,OAAO;QAAE,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC;IAEjE,2CAA2C;IAC3C,MAAM,aAAa,GAAG,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC5D,IAAI,aAAa,KAAK,MAAM;QAAE,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;SACxD,IAAI,aAAa,KAAK,OAAO;QAAE,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;IAEpE,sDAAsD;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,mBAAmB,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,qDAAqD;IACrD,MAAM,UAAU,GAAG,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC;IACjE,CAAC;IAED,0DAA0D;IAC1D,MAAM,UAAU,GAAG,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,4DAA4D;IAC5D,qEAAqE;IACrE,gEAAgE;IAChE,2CAA2C;IAC3C,MAAM,YAAY,GAAG,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACxD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,cAAc,GAAG,YAAY;aACjC,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,oCAAoC;IACpC,MAAM,cAAc,GAAG,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACvD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,WAAW,GAAG,cAAc;aAChC,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,8CAA8C;IAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,mCAAmC,CAAC,CAAC;IAC5D,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC;SACxD,IAAI,UAAU,KAAK,OAAO;QAAE,MAAM,CAAC,mBAAmB,GAAG,KAAK,CAAC;IAEpE,sEAAsE;IACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAC7D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;QAAE,MAAM,CAAC,qBAAqB,GAAG,QAAQ,CAAC;IAE7F,8EAA8E;IAC9E,6CAA6C;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;SAChD,IAAI,UAAU,KAAK,OAAO;QAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;IAE5D,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACxD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE;QAAE,MAAM,CAAC,eAAe,GAAG,UAAU,CAAC;IAE7F,wEAAwE;IACxE,0DAA0D;IAC1D,MAAM,UAAU,GAAG,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAC/D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE;QAAE,MAAM,CAAC,qBAAqB,GAAG,UAAU,CAAC;IAEnG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAI,QAAuB,EAAE,OAAsB,EAAE,QAAW;IAC3F,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC1C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAI,QAAuB,EAAE,OAAsB;IACtF,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/runtime.d.ts

@@ -54,6 +54,24 @@ export interface ExecuteContext {
     fallbackSkillExecutor?: (skillName: string, vars: Record<string, unknown>) => Promise<ExecuteResult>;
     /** Mechanical-only preview: `$` ops skip real dispatch and bind a placeholder. */
     mechanical?: boolean;
+    /**
+     * v1.0 Gate #7 — the effect capability. In SECURED mode, effectful ops
+     * (egress/mutation: `$`, shell, file_write, notify) and output-routing
+     * delivery dispatch ONLY when this is true. Minted exclusively by a verified
+     * approval at load time (or set unconditionally when the boundary is OFF).
+     * Source-mode / unapproved bodies run without it → effects refused at the
+     * dispatch choke, regardless of mechanical's (incomplete) suppression.
+     * Read alongside `isSecuredMode()`; in unsecured mode it is ignored entirely
+     * (zero behavior change when the boundary is off).
+     */
+    effectsAuthorized?: boolean;
+    /**
+     * v1.0 Gate #7 — the filesystem path allowlist (third allowlist; mirrors
+     * shellAllowlist). file_read/file_write may only touch paths under one of
+     * these operator-owned roots. DEFAULT-DENY: undefined → all file ops refused.
+     * Independent of the approval gate — even an approved skill is path-bounded.
+     */
+    fsAllowlist?: string[];
     /**
      * Runtime absolute timeout (milliseconds) — the built-in fallback when no
      * per-op, skill, or connector default applies. Per ERD §6 decision 7,

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAuB,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,EAAgB,eAAe,EAAE,WAAW,EAAY,MAAM,uBAAuB,CAAC;AAKlG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAwBzD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+HAA+H;IAC/H,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrF,qGAAqG;IACrG,qBAAqB,CAAC,EAAE,CACtB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,kFAAkF;IAClF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,sEAAsE;IACtE,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,kGAAkG;IAClG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB;;;;OAIG;IACH,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;;;;OAQG;IACH,qBAAqB,EAAE,0BAA0B,EAAE,CAAC;IACpD;;;;;;;OAOG;IACH,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,OAAO,GAAG,UAAU,CAAC;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;IAC7C,OAAO,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAiGD;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,KAAK,EAAE,MAAM,EAAE,EACf,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,aAAa,CAAC,CAgQxB;AA6pCD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAYxF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAgDlF;AAmCD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAY3E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAMjD;AAsHD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAsB/E"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAuB,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,EAAgB,eAAe,EAAE,WAAW,EAAY,MAAM,uBAAuB,CAAC;AAKlG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AA4BzD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+HAA+H;IAC/H,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrF,qGAAqG;IACrG,qBAAqB,CAAC,EAAE,CACtB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,kFAAkF;IAClF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,sEAAsE;IACtE,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,kGAAkG;IAClG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB;;;;OAIG;IACH,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;;;;OAQG;IACH,qBAAqB,EAAE,0BAA0B,EAAE,CAAC;IACpD;;;;;;;OAOG;IACH,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,OAAO,GAAG,UAAU,CAAC;IAClC,OAAO,EAAE,eAAe,CAAC;IACzB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;IAC7C,OAAO,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAiGD;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,KAAK,EAAE,MAAM,EAAE,EACf,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,aAAa,CAAC,CAoQxB;AAusCD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAYxF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAiDlF;AAmCD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAY3E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAMjD;AAwID;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAsB/E"}

package/dist/runtime.js

@@ -6,7 +6,9 @@ import { validateQualifiedDispatch } from "./dispatch-validate.js";
 import { spawn } from "node:child_process";
 import { readFile as fsReadFile, writeFile as fsWriteFile, mkdir as fsMkdir } from "node:fs/promises";
 import { dirname as pathDirname } from "node:path";
-import { OpError, ConnectorNotFoundError, OpTimeoutError, UnsafeShellDisabledError, ShellBinaryNotAllowedError, UnresolvedVariableError, TypeMismatchError, MissingSkillReferenceError, UnconfirmedMutationError, messageOf, } from "./errors.js";
+import { OpError, ConnectorNotFoundError, OpTimeoutError, UnsafeShellDisabledError, ShellBinaryNotAllowedError, UnresolvedVariableError, TypeMismatchError, MissingSkillReferenceError, UnconfirmedMutationError, SecuredModeEffectError, FilePathNotAllowedError, messageOf, } from "./errors.js";
+import { isPathUnderAllowedRoot } from "./safe-path.js";
+import { isSecuredMode } from "./approval.js";
 import { classifyMutation, authorizationGranted, buildAuthorizationSuggestion, } from "./mutation-gate.js";
 import { TraceBuilder, shouldTraceFire } from "./trace.js";
 /**
@@ -277,7 +279,11 @@ export async function execute(parsed, initialVars, order, ctx) {
     // `wake_skipped`.
     const agentDeliveryReceipts = [];
     const agentWakeReceipts = [];
-    if (ctx.mechanical !== true) {
+    // v1.0 Gate #7 — output-routing is an effectful egress; gate it with the same
+    // capability as the op-level choke. In secured mode an unapproved body cannot
+    // deliver to an agent/template, even though its emit-to-transcript ran.
+    const deliveryAuthorized = !(isSecuredMode() && ctx.effectsAuthorized !== true);
+    if (ctx.mechanical !== true && deliveryAuthorized) {
         for (const decl of outputDecls) {
             if (decl.target === undefined)
                 continue;
@@ -423,7 +429,37 @@ function extractOpConnector(op) {
         return op.mcpConnector ?? "primary";
     return undefined;
 }
+/**
+ * v1.0 Gate #7 — the complete effectful op set the capability gate covers. The
+ * principle: an unapproved skill must not touch EXTERNAL STATE at all — neither
+ * egress/mutation NOR ingress (a read it can then `emit` back to the caller is an
+ * exfiltration channel; the file_read-then-emit of the operator's private key is
+ * the canonical attack). So every op that crosses the process boundary is gated:
+ *   `$`         — all external MCP dispatch (connector / data_read / data_write / llm)
+ *   `shell`     — process spawn
+ *   `file_read` — reads any host file the runtime can (exfil source) [v1.0 add]
+ *   `file_write`— local mutation
+ *   `notify`    — agent delivery
+ * Output-routing delivery is gated separately at the execute() tail.
+ * Excluded (pure compute / transcript, no boundary crossing): `$set`/`$append`
+ * (local vars), `?`/`emit` (transcript of already-known values), `foreach`/`if`
+ * (control flow — nested ops each traverse this check), `inline` (compile-resolved
+ * + gated at compile). Note `emit` stays ungated: emitting a COMPUTED value is
+ * harmless; the exfil risk was the READ feeding it, which is now gated.
+ */
+function isEffectfulOpKind(kind) {
+    return kind === "$" || kind === "shell" || kind === "file_read" || kind === "file_write" || kind === "notify";
+}
 async function execOpInner(op, vars, emissions, fallbacks, ctx, targetName, skillTimeoutSec, absoluteTimeoutMs, traceBuilder, authState = { skillAutonomous: false }) {
+    // v1.0 Gate #7 — complete-mediation choke. Every effectful op (egress/mutation)
+    // physically traverses this point; in secured mode it may dispatch ONLY when
+    // the execution was authorized by a verified approval. Source-mode/Draft/forged
+    // bodies arrive with effectsAuthorized unset → refused here, regardless of
+    // mechanical's (incomplete) suppression. Non-effectful ops ($set/$append/?/emit/
+    // foreach/if/inline/file_read) pass through. No-op when the boundary is OFF.
+    if (isEffectfulOpKind(op.kind) && isSecuredMode() && ctx.effectsAuthorized !== true) {
+        throw new SecuredModeEffectError(op.kind, targetName);
+    }
     switch (op.kind) {
         case "$set": {
             // v0.5.0 item 3 — `$set X = "...$(REF)..."` now resolves $(REF) at
@@ -648,6 +684,12 @@ async function execOpInner(op, vars, emissions, fallbacks, ctx, targetName, skil
                     vars.set(op.outputVar, placeholder);
                 return { lastBoundVar: op.outputVar ?? flatKey, lastValue: placeholder };
             }
+            // v1.0 Gate #7 — filesystem path allowlist (operator boundary, default-deny).
+            // Canonicalizes (realpath) before the under-root check so `..`/symlinks can't
+            // evade. Independent of the approval gate — even an approved skill is bounded.
+            if (!isPathUnderAllowedRoot(path, ctx.fsAllowlist)) {
+                throw new FilePathNotAllowedError("file_read", path, ctx.fsAllowlist, targetName);
+            }
             let content;
             try {
                 content = await fsReadFile(path, "utf8");
@@ -696,6 +738,11 @@ async function execOpInner(op, vars, emissions, fallbacks, ctx, targetName, skil
                 emissions.push(`Would write file: ${path} (${content.length} chars; mechanical: true preview).`);
                 return { lastBoundVar: null, lastValue: undefined };
             }
+            // v1.0 Gate #7 — filesystem path allowlist (operator boundary, default-deny).
+            // Checked BEFORE mkdir/write so a denied path never even creates a directory.
+            if (!isPathUnderAllowedRoot(path, ctx.fsAllowlist)) {
+                throw new FilePathNotAllowedError("file_write", path, ctx.fsAllowlist, targetName);
+            }
             try {
                 await fsMkdir(pathDirname(path), { recursive: true });
                 await fsWriteFile(path, content, "utf8");
@@ -1482,6 +1529,7 @@ export function substituteRuntime(text, vars) {
         let value = resolveRef(ref, vars);
         const specs = parseFilterChain(filterChain);
         for (const spec of specs) {
+            const arg = interpolateFilterArg(spec.arg, vars);
             if (spec.name === "fallback") {
                 // v0.19.12 — empty-aware. Matches the $-op trailer's
                 // emptiness predicate (closes Perry's `9d8ff1b1`).
@@ -1489,14 +1537,14 @@ export function substituteRuntime(text, vars) {
                 const isEmptyArray = Array.isArray(value) && value.length === 0;
                 const isNullish = value === null || value === undefined;
                 if (isNullish || isEmptyString || isEmptyArray) {
-                    value = spec.arg ?? "";
+                    value = arg ?? "";
                 }
                 continue;
             }
             if (value === undefined) {
                 throw new UnresolvedVariableError(ref, "?");
             }
-            value = applyFilter(stringifyValue(value), spec.name, spec.arg);
+            value = applyFilter(stringifyValue(value), spec.name, arg);
         }
         if (value === undefined) {
             throw new UnresolvedVariableError(ref, "?");
@@ -1575,6 +1623,24 @@ export function stringifyValue(v) {
         return v[MECHANICAL_PLACEHOLDER];
     return JSON.stringify(v);
 }
+/**
+ * v1.0 (fix list 33bf53d3 P1.1): interpolate `${VAR}` / `$(VAR)` refs inside a
+ * filter argument before the filter runs, so `|contains:"${KW}"` tests the
+ * value of KW rather than the literal string "${KW}". Pre-fix the arg was taken
+ * verbatim and silently failed to match (round-1 cold-author finding — broke
+ * `cold-feed-filter`'s KEYWORD parameterization). Bounded recursion: the arg is
+ * a small literal, so one `substituteRuntime` pass resolves the inner ref (the
+ * result is not re-scanned). No-op when the arg has no ref, or when no `vars`
+ * scope is in play. Unresolved refs inside the arg fail loud (UnresolvedVariableError),
+ * consistent with every other substitution site.
+ */
+function interpolateFilterArg(arg, vars) {
+    if (arg === undefined || vars === undefined)
+        return arg;
+    if (!arg.includes("$"))
+        return arg; // fast path: no ref possible
+    return substituteRuntime(arg, vars);
+}
 // v0.3.4 — filter chain support in conditions. Each `(REF)(|filter)?`
 // becomes `(REF)(|filter)*` matching substituteRuntime's chain pattern.
 // v0.7.0 — loose-bracket form `\$[({]...[)}]` accepts both `$(REF)` and
@@ -1598,7 +1664,7 @@ const IN = /^\s*\$[({]([A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*)((?:\s*\|\s*[A-Za-z_]\w*(
  * the recurring "filter chain works in substitution but not conditions"
  * gap named in dev-log §14.
  */
-function applyFilterChain(value, chain) {
+function applyFilterChain(value, chain, vars) {
     if (chain === undefined || chain === "")
         return value;
     const specs = parseFilterChain(chain);
@@ -1606,7 +1672,7 @@ function applyFilterChain(value, chain) {
     for (const spec of specs) {
         if (spec.name === "fallback")
             continue;
-        s = applyFilter(s, spec.name, spec.arg);
+        s = applyFilter(s, spec.name, interpolateFilterArg(spec.arg, vars));
     }
     return s;
 }
@@ -1615,18 +1681,19 @@ function applyFilterChain(value, chain) {
  * undefined-ness through so `|fallback:"X"` can consume an unresolved ref.
  * Used by EQ / CMP / IN paths in evalSimpleCondition. v0.5.0 item 4.
  */
-function applyFilterChainCondition(value, chain) {
+function applyFilterChainCondition(value, chain, vars) {
     const specs = parseFilterChain(chain);
     let current = value;
     for (const spec of specs) {
+        const arg = interpolateFilterArg(spec.arg, vars);
         if (spec.name === "fallback") {
             if (current === undefined)
-                current = spec.arg ?? "";
+                current = arg ?? "";
             continue;
         }
         if (current === undefined)
             current = "";
-        current = applyFilter(stringifyValue(current), spec.name, spec.arg);
+        current = applyFilter(stringifyValue(current), spec.name, arg);
     }
     if (current === undefined)
         current = "";
@@ -1745,7 +1812,7 @@ function evalSimpleCondition(cond, vars) {
     if (t) {
         const val = resolveRef(t[1], vars);
         const chain = t[2];
-        const filtered = chain && val !== undefined ? applyFilterChain(stringifyValue(val), chain) : val;
+        const filtered = chain && val !== undefined ? applyFilterChain(stringifyValue(val), chain, vars) : val;
         return isTruthy(filtered);
     }
     const e = EQ.exec(cond);
@@ -1754,7 +1821,7 @@ function evalSimpleCondition(cond, vars) {
         const val = resolveRef(ref, vars);
         // v0.5.0 item 4: condition-aware chain threading so `|default:"X"`
         // consumes undefined refs in conditional context too.
-        const final = applyFilterChainCondition(val, chain);
+        const final = applyFilterChainCondition(val, chain, vars);
         return op === "==" ? final === lit : final !== lit;
     }
     const eRef = EQ_REF.exec(cond);
@@ -1762,15 +1829,15 @@ function evalSimpleCondition(cond, vars) {
         const [, lhsRef, lhsChain, op, rhsRef, rhsChain] = eRef;
         const lhsVal = resolveRef(lhsRef, vars);
         const rhsVal = resolveRef(rhsRef, vars);
-        const lhsFinal = applyFilterChainCondition(lhsVal, lhsChain);
-        const rhsFinal = applyFilterChainCondition(rhsVal, rhsChain);
+        const lhsFinal = applyFilterChainCondition(lhsVal, lhsChain, vars);
+        const rhsFinal = applyFilterChainCondition(rhsVal, rhsChain, vars);
         return op === "==" ? lhsFinal === rhsFinal : lhsFinal !== rhsFinal;
     }
     const cmp = CMP.exec(cond);
     if (cmp) {
         const [, ref, chain, op, lit] = cmp;
         const val = resolveRef(ref, vars);
-        const final = applyFilterChainCondition(val, chain);
+        const final = applyFilterChainCondition(val, chain, vars);
         return compareNumeric(final, op, lit, `$(${ref}${chain ? chain : ""})`);
     }
     const cmpRef = CMP_REF.exec(cond);
@@ -1778,8 +1845,8 @@ function evalSimpleCondition(cond, vars) {
         const [, lhsRef, lhsChain, op, rhsRef, rhsChain] = cmpRef;
         const lhsVal = resolveRef(lhsRef, vars);
         const rhsVal = resolveRef(rhsRef, vars);
-        const lhsFinal = applyFilterChainCondition(lhsVal, lhsChain);
-        const rhsFinal = applyFilterChainCondition(rhsVal, rhsChain);
+        const lhsFinal = applyFilterChainCondition(lhsVal, lhsChain, vars);
+        const rhsFinal = applyFilterChainCondition(rhsVal, rhsChain, vars);
         const refDesc = `$(${lhsRef}) ${op} $(${rhsRef})`;
         return compareNumeric(lhsFinal, op, rhsFinal, refDesc);
     }
@@ -1829,7 +1896,7 @@ function evalSimpleCondition(cond, vars) {
         const lhsVal = resolveRef(lhsRef, vars);
         if (lhsVal === undefined)
             return false;
-        const lhsStr = applyFilterChain(stringifyValue(lhsVal), lhsChain);
+        const lhsStr = applyFilterChain(stringifyValue(lhsVal), lhsChain, vars);
         const found = rhsVal.some((item) => stringifyValue(item) === lhsStr);
         return notKey !== undefined ? !found : found;
     }