vgxness 1.20.3 → 1.20.5

package/dist/mcp/schema.js

@@ -50,6 +50,11 @@ export const SUPPORTED_VGX_MCP_TOOL_NAMES = [
     'vgxness_run_list',
     'vgxness_run_get',
     'vgxness_run_preflight',
+    'vgxness_run_task_grant_create',
+    'vgxness_run_task_grant_list',
+    'vgxness_run_task_grant_get',
+    'vgxness_run_task_grant_revoke',
+    'vgxness_run_task_grant_preview_match',
     'vgxness_run_start',
     'vgxness_run_checkpoint',
     'vgxness_run_finalize',
@@ -108,6 +113,11 @@ export const EXPOSED_VGX_MCP_TOOL_NAMES = [
     'run_list',
     'run_get',
     'run_preflight',
+    'run_task_grant_create',
+    'run_task_grant_list',
+    'run_task_grant_get',
+    'run_task_grant_revoke',
+    'run_task_grant_preview_match',
     'run_start',
     'run_checkpoint',
     'run_finalize',
@@ -132,6 +142,8 @@ const agentModes = ['agent', 'subagent'];
 const memoryTypes = ['architecture', 'decision', 'bugfix', 'pattern', 'config', 'discovery', 'learning', 'preference', 'manual'];
 const activityKinds = ['prompt', 'tool_call', 'artifact', 'summary', 'error'];
 const runStatuses = ['created', 'planned', 'running', 'needs-human', 'completed', 'failed', 'blocked', 'cancelled'];
+const taskGrantStatuses = ['active', 'revoked', 'expired', 'exhausted'];
+const taskGrantCategories = ['shell', 'test-run', 'git'];
 const finalRunStatuses = ['completed', 'failed', 'blocked', 'cancelled'];
 const runOutcomes = ['success', 'partial', 'failure', 'blocked', 'cancelled'];
 const payloadModes = ['compact', 'verbose'];
@@ -142,6 +154,63 @@ const skillSourceKinds = ['path', 'url', 'inline'];
 const skillUsageOutcomes = ['selected', 'injected', 'helped', 'failed', 'neutral'];
 const skillAttachmentTargetTypes = ['agent', 'subagent', 'workflow-phase', 'provider-adapter', 'intent-signal'];
 const jsonRecordSchema = z.record(z.string(), z.unknown());
+const explicitRequestInputSchema = z
+    .object({
+    version: z.literal(1),
+    actor: z
+        .object({
+        type: z.literal('human'),
+        id: z.string().min(1).optional(),
+        displayName: z.string().min(1).optional(),
+    })
+        .strict(),
+    request: z
+        .object({
+        id: z.string().min(1).optional(),
+        source: z.enum(['chat', 'mcp', 'cli', 'provider', 'unknown']),
+        utteranceRef: z.string().min(1).optional(),
+        excerpt: z.string().min(1).optional(),
+        requestedAt: z.string().min(1),
+        sessionId: z.string().min(1).optional(),
+        runId: z.string().min(1).optional(),
+    })
+        .strict(),
+    requestedOperation: z
+        .object({
+        category: z.enum(permissionCategories),
+        operation: z.string().min(1),
+        commandId: z.string().min(1).optional(),
+        providerToolName: z.string().min(1).optional(),
+        targetPath: z.string().min(1).optional(),
+        targetPaths: z.array(z.string().min(1)).optional(),
+        cwd: z.string().min(1).optional(),
+        workspaceRoot: z.string().min(1).optional(),
+        scopeSummary: z.string().min(1),
+    })
+        .strict(),
+    riskAttributes: z
+        .object({
+        destructive: z.boolean().optional(),
+        privileged: z.boolean().optional(),
+        external: z.boolean().optional(),
+        ambiguous: z.boolean().optional(),
+        secrets: z.boolean().optional(),
+        providerConfigMutation: z.boolean().optional(),
+        globalConfigMutation: z.boolean().optional(),
+        network: z.boolean().optional(),
+        install: z.boolean().optional(),
+    })
+        .strict(),
+    parser: z
+        .object({
+        exact: z.boolean(),
+        confidence: z.enum(['high', 'medium', 'low']).optional(),
+        ambiguityReasons: z.array(z.string().min(1)).optional(),
+        expansionReasons: z.array(z.string().min(1)).optional(),
+    })
+        .strict(),
+})
+    .strict();
 const skillLifecycleActorSchema = z
     .object({
     type: z.enum(['human', 'agent', 'system']),
@@ -163,6 +232,26 @@ const providerChangePlanTypes = ['opencode-mcp-install', 'claude-mcp-install', '
 const sddPhaseInputSchema = z.union([z.enum(sddPhases), z.literal('apply')]);
 const sddPhaseSchema = z.enum(sddPhases);
 const jsonValueSchema = z.lazy(() => z.union([z.string(), z.number().finite(), z.boolean(), z.null(), z.array(jsonValueSchema), z.record(z.string(), jsonValueSchema)]));
+const taskGrantHumanActorInputSchema = z
+    .object({
+    type: z.literal('human'),
+    id: z.string().min(1),
+    displayName: z.string().min(1).optional(),
+})
+    .strict();
+const taskGrantRevocationActorInputSchema = z
+    .object({
+    type: z.enum(['human', 'system']),
+    id: z.string().min(1),
+    displayName: z.string().min(1).optional(),
+})
+    .strict();
+const taskGrantCommandPolicyInputSchema = z
+    .object({
+    kind: z.literal('allowlisted-command-ids'),
+    ids: z.array(z.string().min(1)).min(1),
+})
+    .strict();
 const providerEvidenceOutputSchema = z
     .object({
     staticManifestKnown: z.boolean(),
@@ -810,6 +899,10 @@ export const VGX_MCP_TOOL_INPUT_SCHEMAS = {
         agentId: z.string().min(1).optional(),
         workspaceRoot: z.string().min(1).optional(),
         targetPath: z.string().min(1).optional(),
+        taskFingerprint: z.string().min(1).optional(),
+        commandId: z.string().min(1).optional(),
+        cwd: z.string().min(1).optional(),
+        targetPaths: z.array(z.string().min(1)).optional(),
         providerToolName: z.string().min(1).optional(),
         agent: z
             .object({
@@ -824,8 +917,59 @@ export const VGX_MCP_TOOL_INPUT_SCHEMAS = {
         external: z.boolean().optional(),
         privileged: z.boolean().optional(),
         ambiguous: z.boolean().optional(),
+        providerConfigMutation: z.boolean().optional(),
+        globalConfigMutation: z.boolean().optional(),
+        explicitRequest: explicitRequestInputSchema.optional(),
     })
         .passthrough(),
+    vgxness_run_task_grant_create: z
+        .object({
+        runId: z.string().min(1),
+        agentId: z.string().min(1),
+        taskFingerprint: z.string().min(1),
+        categories: z.array(z.enum(taskGrantCategories)).min(1),
+        externalRoots: z.array(z.string().min(1)).min(1),
+        cwdPatterns: z.array(z.string().min(1)).optional(),
+        commandPolicy: taskGrantCommandPolicyInputSchema,
+        expiresAt: z.string().min(1),
+        maxUses: z.number().int().positive(),
+        createdBy: taskGrantHumanActorInputSchema,
+        creationReason: z.string().min(1),
+        approvedScopeSummary: z.string().min(1),
+    })
+        .strict(),
+    vgxness_run_task_grant_list: z
+        .object({
+        runId: z.string().min(1).optional(),
+        agentId: z.string().min(1).optional(),
+        status: z.enum(taskGrantStatuses).optional(),
+        limit: z.number().int().min(1).max(100).optional(),
+    })
+        .strict(),
+    vgxness_run_task_grant_get: z
+        .object({
+        grantId: z.string().min(1),
+    })
+        .strict(),
+    vgxness_run_task_grant_revoke: z
+        .object({
+        grantId: z.string().min(1),
+        actor: taskGrantRevocationActorInputSchema,
+        reason: z.string().min(1),
+    })
+        .strict(),
+    vgxness_run_task_grant_preview_match: z
+        .object({
+        runId: z.string().min(1),
+        agentId: z.string().min(1).optional(),
+        taskFingerprint: z.string().min(1),
+        category: z.enum(permissionCategories),
+        operation: z.string().min(1),
+        workspaceRoot: z.string().min(1).optional(),
+        cwd: z.string().min(1),
+        targetPaths: z.array(z.string().min(1)).optional(),
+    })
+        .strict(),
     vgxness_run_start: z
         .object({
         project: z.string().min(1),

package/dist/mcp/stdio-server.js

@@ -93,6 +93,12 @@ function descriptionForTool(publicToolName) {
         return 'Human-only mutating SDD reopen gate; records an explicit human decision to reopen an artifact and must not be called by agents on their own behalf. Use only after human instruction, then revise or re-review the phase.';
     if (publicToolName === 'run_preflight')
         return 'Agent-callable advisory/planning-only run preflight; evaluates permissions, records a plan, and returns a workspace strategy recommendation, but does not execute the checked shell/git/install/network/provider/secrets operation and does not create branches, worktrees, or pull requests. Use it to decide whether human approval or a separate executor step is required.';
+    if (publicToolName === 'run_task_grant_create')
+        return 'Human-approved lifecycle tool that creates a task-scoped command grant for bounded allowlisted external command operations.';
+    if (publicToolName === 'run_task_grant_list' || publicToolName === 'run_task_grant_get' || publicToolName === 'run_task_grant_preview_match')
+        return 'Read-only task-scoped command grant lifecycle tool; does not execute commands, write provider config, or consume grant usage.';
+    if (publicToolName === 'run_task_grant_revoke')
+        return 'Revokes a task-scoped command grant with an explicit human or system actor and reason.';
     const toolName = toInternalVgxMcpToolName(publicToolName);
     return `VGX control-plane tool ${toolName}`;
 }

package/dist/mcp/validation.js

@@ -2,6 +2,7 @@ import { isRiskyPermissionCategory, permissionCategories } from '../permissions/
 import { parseOperationRetryPolicy } from '../runs/operation-retry.js';
 import { normalizeSddPhaseInput, sddPhases } from '../sdd/schema.js';
 import { workflowIds } from '../workflows/schema.js';
+import { commandAllowlistIds } from '../workflows/command-allowlist-adapter.js';
 import { supportedTypeMessage, verificationChangeTypes } from '../verification/index.js';
 import { errorEnvelope, isVgxMcpToolName, } from './schema.js';
 const scopes = ['project', 'personal'];
@@ -9,6 +10,8 @@ const agentModes = ['agent', 'subagent'];
 const memoryTypes = ['architecture', 'decision', 'bugfix', 'pattern', 'config', 'discovery', 'learning', 'preference', 'manual'];
 const activityKinds = ['prompt', 'tool_call', 'artifact', 'summary', 'error'];
 const runStatuses = ['created', 'planned', 'running', 'needs-human', 'completed', 'failed', 'blocked', 'cancelled'];
+const taskGrantStatuses = ['active', 'revoked', 'expired', 'exhausted'];
+const taskGrantCategories = ['shell', 'test-run', 'git'];
 const finalRunStatuses = ['completed', 'failed', 'blocked', 'cancelled'];
 const runOutcomes = ['success', 'partial', 'failure', 'blocked', 'cancelled'];
 const permissionDecisions = ['allow', 'ask', 'deny'];
@@ -132,6 +135,16 @@ export function validateVgxMcpToolCall(call) {
             return validationSuccess(tool.value, validateRunGetInput(input, tool.value));
         case 'vgxness_run_preflight':
             return validationSuccess(tool.value, validateRunPreflightInput(input, tool.value));
+        case 'vgxness_run_task_grant_create':
+            return validationSuccess(tool.value, validateRunTaskGrantCreateInput(input, tool.value));
+        case 'vgxness_run_task_grant_list':
+            return validationSuccess(tool.value, validateRunTaskGrantListInput(input, tool.value));
+        case 'vgxness_run_task_grant_get':
+            return validationSuccess(tool.value, validateRunTaskGrantGetInput(input, tool.value));
+        case 'vgxness_run_task_grant_revoke':
+            return validationSuccess(tool.value, validateRunTaskGrantRevokeInput(input, tool.value));
+        case 'vgxness_run_task_grant_preview_match':
+            return validationSuccess(tool.value, validateRunTaskGrantPreviewMatchInput(input, tool.value));
         case 'vgxness_run_start':
             return validationSuccess(tool.value, validateRunStartInput(input, tool.value));
         case 'vgxness_run_checkpoint':
@@ -1565,6 +1578,10 @@ function validateRunPreflightInput(input, tool) {
         'agentId',
         'workspaceRoot',
         'targetPath',
+        'taskFingerprint',
+        'commandId',
+        'cwd',
+        'targetPaths',
         'providerToolName',
         'agent',
         'sandboxStrategy',
@@ -1572,6 +1589,9 @@ function validateRunPreflightInput(input, tool) {
         'external',
         'privileged',
         'ambiguous',
+        'providerConfigMutation',
+        'globalConfigMutation',
+        'explicitRequest',
     ]);
     if (!record.ok)
         return record;
@@ -1590,15 +1610,20 @@ function validateRunPreflightInput(input, tool) {
         return workflow;
     if (workflow.value !== undefined)
         result.workflow = workflow.value;
-    const copied = copyOptionalStrings(result, record.value, tool, ['phase', 'agentId', 'workspaceRoot', 'targetPath', 'providerToolName']);
+    const copied = copyOptionalStrings(result, record.value, tool, ['phase', 'agentId', 'workspaceRoot', 'targetPath', 'taskFingerprint', 'commandId', 'cwd', 'providerToolName']);
     if (!copied.ok)
         return copied;
+    const targetPaths = readOptionalStringArray(record.value, 'targetPaths', tool);
+    if (!targetPaths.ok)
+        return targetPaths;
+    if (targetPaths.value !== undefined)
+        result.targetPaths = targetPaths.value;
     const sandboxStrategy = readOptionalOneOf(record.value, 'sandboxStrategy', ['worktree'], tool);
     if (!sandboxStrategy.ok)
         return sandboxStrategy;
     if (sandboxStrategy.value !== undefined)
         result.sandboxStrategy = sandboxStrategy.value;
-    const booleans = copyOptionalBooleans(result, record.value, tool, ['destructive', 'external', 'privileged', 'ambiguous']);
+    const booleans = copyOptionalBooleans(result, record.value, tool, ['destructive', 'external', 'privileged', 'ambiguous', 'providerConfigMutation', 'globalConfigMutation']);
     if (!booleans.ok)
         return booleans;
     if (record.value.agent !== undefined) {
@@ -1607,6 +1632,12 @@ function validateRunPreflightInput(input, tool) {
             return agent;
         result.agent = agent.value;
     }
+    if (record.value.explicitRequest !== undefined) {
+        const explicitRequest = readExplicitRequest(record.value.explicitRequest, tool);
+        if (!explicitRequest.ok)
+            return explicitRequest;
+        result.explicitRequest = explicitRequest.value;
+    }
     if (isRiskyPermissionCategory(result.category)) {
         if (result.phase !== undefined && result.agentId === undefined && result.agent === undefined) {
             return validationFailure(`VGX-managed preflight for risky category ${result.category} requires agentId when phase metadata is provided`, tool);
@@ -1617,6 +1648,270 @@ function validateRunPreflightInput(input, tool) {
     }
     return { ok: true, value: result };
 }
+function readExplicitRequest(value, tool) {
+    const record = asRecord(value, tool, 'explicitRequest must be an object');
+    if (!record.ok)
+        return record;
+    const unexpected = Object.keys(record.value).find((key) => !['version', 'actor', 'request', 'requestedOperation', 'riskAttributes', 'parser'].includes(key));
+    if (unexpected !== undefined)
+        return validationFailure(`Unexpected explicitRequest field: ${unexpected}`, tool);
+    if (record.value.version !== 1)
+        return validationFailure('explicitRequest.version must be 1', tool);
+    const actor = readExplicitRequestActor(record.value.actor, tool);
+    if (!actor.ok)
+        return actor;
+    const request = readExplicitRequestRequest(record.value.request, tool);
+    if (!request.ok)
+        return request;
+    const requestedOperation = readExplicitRequestedOperation(record.value.requestedOperation, tool);
+    if (!requestedOperation.ok)
+        return requestedOperation;
+    const riskAttributes = readExplicitRiskAttributes(record.value.riskAttributes, tool);
+    if (!riskAttributes.ok)
+        return riskAttributes;
+    const parser = readExplicitParser(record.value.parser, tool);
+    if (!parser.ok)
+        return parser;
+    return { ok: true, value: { version: 1, actor: actor.value, request: request.value, requestedOperation: requestedOperation.value, riskAttributes: riskAttributes.value, parser: parser.value } };
+}
+function readExplicitRequestActor(value, tool) {
+    const record = asRecord(value, tool, 'explicitRequest.actor must be an object');
+    if (!record.ok)
+        return record;
+    const unexpected = Object.keys(record.value).find((key) => !['type', 'id', 'displayName'].includes(key));
+    if (unexpected !== undefined)
+        return validationFailure(`Unexpected explicitRequest.actor field: ${unexpected}`, tool);
+    const type = readRequiredOneOf(record.value, 'type', ['human'], tool);
+    if (!type.ok)
+        return type;
+    const actor = { type: type.value };
+    const copied = copyOptionalStrings(actor, record.value, tool, ['id', 'displayName']);
+    if (!copied.ok)
+        return copied;
+    return { ok: true, value: actor };
+}
+function readExplicitRequestRequest(value, tool) {
+    const record = asRecord(value, tool, 'explicitRequest.request must be an object');
+    if (!record.ok)
+        return record;
+    const unexpected = Object.keys(record.value).find((key) => !['id', 'source', 'utteranceRef', 'excerpt', 'requestedAt', 'sessionId', 'runId'].includes(key));
+    if (unexpected !== undefined)
+        return validationFailure(`Unexpected explicitRequest.request field: ${unexpected}`, tool);
+    const source = readRequiredOneOf(record.value, 'source', ['chat', 'mcp', 'cli', 'provider', 'unknown'], tool);
+    if (!source.ok)
+        return source;
+    const requestedAt = readNonEmptyString(record.value, 'requestedAt', tool);
+    if (!requestedAt.ok)
+        return requestedAt;
+    if (!validIsoTimestamp(requestedAt.value))
+        return validationFailure('explicitRequest.request.requestedAt must be a valid ISO timestamp', tool);
+    const request = { source: source.value, requestedAt: requestedAt.value };
+    const copied = copyOptionalStrings(request, record.value, tool, ['id', 'utteranceRef', 'excerpt', 'sessionId', 'runId']);
+    if (!copied.ok)
+        return copied;
+    return { ok: true, value: request };
+}
+function readExplicitRequestedOperation(value, tool) {
+    const record = asRecord(value, tool, 'explicitRequest.requestedOperation must be an object');
+    if (!record.ok)
+        return record;
+    const unexpected = Object.keys(record.value).find((key) => !['category', 'operation', 'commandId', 'providerToolName', 'targetPath', 'targetPaths', 'cwd', 'workspaceRoot', 'scopeSummary'].includes(key));
+    if (unexpected !== undefined)
+        return validationFailure(`Unexpected explicitRequest.requestedOperation field: ${unexpected}`, tool);
+    const category = readRequiredOneOf(record.value, 'category', permissionCategories, tool);
+    if (!category.ok)
+        return category;
+    const operation = readNonEmptyString(record.value, 'operation', tool);
+    if (!operation.ok)
+        return operation;
+    const scopeSummary = readNonEmptyString(record.value, 'scopeSummary', tool);
+    if (!scopeSummary.ok)
+        return scopeSummary;
+    const requestedOperation = { category: category.value, operation: operation.value, scopeSummary: scopeSummary.value };
+    const copied = copyOptionalStrings(requestedOperation, record.value, tool, ['commandId', 'providerToolName', 'targetPath', 'cwd', 'workspaceRoot']);
+    if (!copied.ok)
+        return copied;
+    const targetPaths = readOptionalStringArray(record.value, 'targetPaths', tool);
+    if (!targetPaths.ok)
+        return targetPaths;
+    if (targetPaths.value !== undefined)
+        requestedOperation.targetPaths = targetPaths.value;
+    return { ok: true, value: requestedOperation };
+}
+function readExplicitRiskAttributes(value, tool) {
+    const record = asRecord(value, tool, 'explicitRequest.riskAttributes must be an object');
+    if (!record.ok)
+        return record;
+    const fields = ['destructive', 'privileged', 'external', 'ambiguous', 'secrets', 'providerConfigMutation', 'globalConfigMutation', 'network', 'install'];
+    const unexpected = Object.keys(record.value).find((key) => !fields.includes(key));
+    if (unexpected !== undefined)
+        return validationFailure(`Unexpected explicitRequest.riskAttributes field: ${unexpected}`, tool);
+    const riskAttributes = {};
+    const copied = copyOptionalBooleans(riskAttributes, record.value, tool, fields);
+    if (!copied.ok)
+        return copied;
+    return { ok: true, value: riskAttributes };
+}
+function readExplicitParser(value, tool) {
+    const record = asRecord(value, tool, 'explicitRequest.parser must be an object');
+    if (!record.ok)
+        return record;
+    const unexpected = Object.keys(record.value).find((key) => !['exact', 'confidence', 'ambiguityReasons', 'expansionReasons'].includes(key));
+    if (unexpected !== undefined)
+        return validationFailure(`Unexpected explicitRequest.parser field: ${unexpected}`, tool);
+    if (typeof record.value.exact !== 'boolean')
+        return validationFailure('explicitRequest.parser.exact must be a boolean', tool);
+    const parser = { exact: record.value.exact };
+    const confidence = readOptionalOneOf(record.value, 'confidence', ['high', 'medium', 'low'], tool);
+    if (!confidence.ok)
+        return confidence;
+    if (confidence.value !== undefined)
+        parser.confidence = confidence.value;
+    const ambiguityReasons = readOptionalStringArray(record.value, 'ambiguityReasons', tool);
+    if (!ambiguityReasons.ok)
+        return ambiguityReasons;
+    if (ambiguityReasons.value !== undefined)
+        parser.ambiguityReasons = ambiguityReasons.value;
+    const expansionReasons = readOptionalStringArray(record.value, 'expansionReasons', tool);
+    if (!expansionReasons.ok)
+        return expansionReasons;
+    if (expansionReasons.value !== undefined)
+        parser.expansionReasons = expansionReasons.value;
+    return { ok: true, value: parser };
+}
+function validIsoTimestamp(value) {
+    const timestamp = Date.parse(value);
+    return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value;
+}
+function validateRunTaskGrantCreateInput(input, tool) {
+    const record = inputRecord(input, tool, [
+        'runId',
+        'agentId',
+        'taskFingerprint',
+        'categories',
+        'externalRoots',
+        'cwdPatterns',
+        'commandPolicy',
+        'expiresAt',
+        'maxUses',
+        'createdBy',
+        'creationReason',
+        'approvedScopeSummary',
+    ]);
+    if (!record.ok)
+        return record;
+    const result = {};
+    const copied = copyRequiredStrings(result, record.value, tool, ['runId', 'agentId', 'taskFingerprint', 'expiresAt', 'creationReason', 'approvedScopeSummary']);
+    if (!copied.ok)
+        return copied;
+    const categories = readRequiredOneOfArray(record.value, 'categories', taskGrantCategories, tool);
+    if (!categories.ok)
+        return categories;
+    result.categories = categories.value;
+    const externalRoots = readRequiredStringArray(record.value, 'externalRoots', tool);
+    if (!externalRoots.ok)
+        return externalRoots;
+    result.externalRoots = externalRoots.value;
+    const cwdPatterns = readOptionalStringArray(record.value, 'cwdPatterns', tool);
+    if (!cwdPatterns.ok)
+        return cwdPatterns;
+    if (cwdPatterns.value !== undefined)
+        result.cwdPatterns = cwdPatterns.value;
+    const commandPolicy = readTaskGrantCommandPolicy(record.value.commandPolicy, tool);
+    if (!commandPolicy.ok)
+        return commandPolicy;
+    result.commandPolicy = commandPolicy.value;
+    const createdBy = readTaskGrantActor(record.value.createdBy, tool, ['human']);
+    if (!createdBy.ok)
+        return createdBy;
+    result.createdBy = createdBy.value;
+    if (typeof record.value.maxUses !== 'number' || !Number.isSafeInteger(record.value.maxUses) || record.value.maxUses < 1)
+        return validationFailure('maxUses must be a positive safe integer', tool);
+    result.maxUses = record.value.maxUses;
+    const expiresAt = Date.parse(result.expiresAt ?? '');
+    if (!Number.isFinite(expiresAt) || new Date(expiresAt).toISOString() !== result.expiresAt)
+        return validationFailure('expiresAt must be a valid ISO date', tool);
+    const expiryDelta = expiresAt - Date.now();
+    if (expiryDelta <= 0)
+        return validationFailure('expiresAt must be in the future', tool);
+    if (expiryDelta > 24 * 60 * 60 * 1000)
+        return validationFailure('expiresAt must be within 24 hours', tool);
+    return { ok: true, value: result };
+}
+function validateRunTaskGrantListInput(input, tool) {
+    const record = inputRecord(input, tool, ['runId', 'agentId', 'status', 'limit']);
+    if (!record.ok)
+        return record;
+    const result = {};
+    const copied = copyOptionalStrings(result, record.value, tool, ['runId', 'agentId']);
+    if (!copied.ok)
+        return copied;
+    const status = readOptionalOneOf(record.value, 'status', taskGrantStatuses, tool);
+    if (!status.ok)
+        return status;
+    if (status.value !== undefined)
+        result.status = status.value;
+    const limit = readOptionalBoundedLimit(record.value, tool);
+    if (!limit.ok)
+        return limit;
+    if (limit.value !== undefined)
+        result.limit = limit.value;
+    return { ok: true, value: result };
+}
+function validateRunTaskGrantGetInput(input, tool) {
+    const record = inputRecord(input, tool, ['grantId']);
+    if (!record.ok)
+        return record;
+    const grantId = readNonEmptyString(record.value, 'grantId', tool);
+    if (!grantId.ok)
+        return grantId;
+    return { ok: true, value: { grantId: grantId.value } };
+}
+function validateRunTaskGrantRevokeInput(input, tool) {
+    const record = inputRecord(input, tool, ['grantId', 'actor', 'reason']);
+    if (!record.ok)
+        return record;
+    const grantId = readNonEmptyString(record.value, 'grantId', tool);
+    if (!grantId.ok)
+        return grantId;
+    const reason = readNonEmptyString(record.value, 'reason', tool);
+    if (!reason.ok)
+        return reason;
+    const actor = readTaskGrantActor(record.value.actor, tool, ['human', 'system']);
+    if (!actor.ok)
+        return actor;
+    return { ok: true, value: { grantId: grantId.value, actor: actor.value, reason: reason.value } };
+}
+function validateRunTaskGrantPreviewMatchInput(input, tool) {
+    const record = inputRecord(input, tool, ['runId', 'agentId', 'taskFingerprint', 'category', 'operation', 'workspaceRoot', 'cwd', 'targetPaths']);
+    if (!record.ok)
+        return record;
+    const runId = readNonEmptyString(record.value, 'runId', tool);
+    if (!runId.ok)
+        return runId;
+    const taskFingerprint = readNonEmptyString(record.value, 'taskFingerprint', tool);
+    if (!taskFingerprint.ok)
+        return taskFingerprint;
+    const category = readRequiredOneOf(record.value, 'category', permissionCategories, tool);
+    if (!category.ok)
+        return category;
+    const operation = readNonEmptyString(record.value, 'operation', tool);
+    if (!operation.ok)
+        return operation;
+    const cwd = readNonEmptyString(record.value, 'cwd', tool);
+    if (!cwd.ok)
+        return cwd;
+    const result = { runId: runId.value, taskFingerprint: taskFingerprint.value, category: category.value, operation: operation.value, cwd: cwd.value };
+    const copied = copyOptionalStrings(result, record.value, tool, ['agentId', 'workspaceRoot']);
+    if (!copied.ok)
+        return copied;
+    const targetPaths = readOptionalStringArray(record.value, 'targetPaths', tool);
+    if (!targetPaths.ok)
+        return targetPaths;
+    if (targetPaths.value !== undefined)
+        result.targetPaths = targetPaths.value;
+    return { ok: true, value: result };
+}
 function validateRunStartInput(input, tool) {
     const record = inputRecord(input, tool, ['project', 'userIntent', 'workflow', 'phase', 'selectedAgentId', 'providerAdapter', 'model']);
     if (!record.ok)
@@ -1905,6 +2200,68 @@ function readRequiredOneOf(record, field, values, tool) {
         return validationFailure(`${field} must be one of: ${values.join(', ')}`, tool);
     return { ok: true, value: value.value };
 }
+function readRequiredOneOfArray(record, field, values, tool) {
+    const array = readRequiredStringArray(record, field, tool);
+    if (!array.ok)
+        return array;
+    for (const item of array.value) {
+        if (!values.includes(item))
+            return validationFailure(`${field} must contain only: ${values.join(', ')}`, tool);
+    }
+    return { ok: true, value: array.value };
+}
+function readRequiredStringArray(record, field, tool) {
+    if (record[field] === undefined)
+        return validationFailure(`${field} is required`, tool);
+    const values = readOptionalStringArray(record, field, tool);
+    if (!values.ok)
+        return values;
+    if (values.value === undefined || values.value.length === 0)
+        return validationFailure(`${field} must contain at least one item`, tool);
+    if (new Set(values.value).size !== values.value.length)
+        return validationFailure(`${field} must be unique`, tool);
+    return { ok: true, value: values.value };
+}
+function readTaskGrantCommandPolicy(value, tool) {
+    const record = asRecord(value, tool, 'commandPolicy must be an object');
+    if (!record.ok)
+        return record;
+    const unexpected = Object.keys(record.value).find((key) => !['kind', 'ids'].includes(key));
+    if (unexpected !== undefined)
+        return validationFailure(`Unexpected commandPolicy field: ${unexpected}`, tool);
+    const kind = readRequiredOneOf(record.value, 'kind', ['allowlisted-command-ids'], tool);
+    if (!kind.ok)
+        return kind;
+    const ids = readRequiredStringArray(record.value, 'ids', tool);
+    if (!ids.ok)
+        return ids;
+    const known = new Set(commandAllowlistIds());
+    for (const id of ids.value)
+        if (!known.has(id))
+            return validationFailure(`Unknown allowlisted command id: ${id}`, tool);
+    return { ok: true, value: { kind: kind.value, ids: ids.value } };
+}
+function readTaskGrantActor(value, tool, allowedTypes) {
+    const record = asRecord(value, tool, 'actor must be an object');
+    if (!record.ok)
+        return record;
+    const unexpected = Object.keys(record.value).find((key) => !['type', 'id', 'displayName'].includes(key));
+    if (unexpected !== undefined)
+        return validationFailure(`Unexpected actor field: ${unexpected}`, tool);
+    const type = readRequiredOneOf(record.value, 'type', allowedTypes, tool);
+    if (!type.ok)
+        return type;
+    const id = readNonEmptyString(record.value, 'id', tool);
+    if (!id.ok)
+        return id;
+    const actor = { type: type.value, id: id.value };
+    const displayName = readOptionalNonEmptyString(record.value, 'displayName', tool);
+    if (!displayName.ok)
+        return displayName;
+    if (displayName.value !== undefined)
+        actor.displayName = displayName.value;
+    return { ok: true, value: actor };
+}
 function readOptionalOneOf(record, field, values, tool) {
     if (record[field] === undefined)
         return { ok: true, value: undefined };

package/dist/memory/sqlite/migrations/019_task_scoped_command_grants.sql

@@ -0,0 +1,37 @@
+CREATE TABLE IF NOT EXISTS task_scoped_command_grants (
+  id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  task_fingerprint TEXT NOT NULL,
+
+  categories_json TEXT NOT NULL,
+  external_roots_json TEXT NOT NULL,
+  canonical_external_roots_json TEXT NOT NULL,
+  cwd_patterns_json TEXT,
+  command_policy_json TEXT NOT NULL,
+
+  expires_at TEXT NOT NULL,
+  max_uses INTEGER NOT NULL,
+  used_count INTEGER NOT NULL DEFAULT 0,
+  status TEXT NOT NULL,
+
+  created_by_json TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+
+  revoked_by_json TEXT,
+  revoked_at TEXT,
+  revoke_reason TEXT,
+
+  audit_json TEXT NOT NULL,
+
+  FOREIGN KEY(run_id) REFERENCES runs(id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_task_scoped_command_grants_run
+  ON task_scoped_command_grants(run_id);
+
+CREATE INDEX IF NOT EXISTS idx_task_scoped_command_grants_match
+  ON task_scoped_command_grants(run_id, agent_id, task_fingerprint, status);
+
+CREATE INDEX IF NOT EXISTS idx_task_scoped_command_grants_status
+  ON task_scoped_command_grants(status);