refactor(core): scope skill bypass to tool context

packages/core/src/session/runner/llm.ts

@@ -369,6 +369,9 @@ const layer = Layer.effect(
         toolChoice: stepLimitReached ? "none" : undefined,
         webSocket: "session",
       })
+      const userRequests = loaded.messages
+        .findLast((message) => message.type === "user")
+        ?.skills?.map((skill) => ({ action: "skill", resource: skill.id }))
       yield* diagnosePromptCache(session.id, prepared.request)
       const executeTool = (input: Parameters<typeof prepared.executeTool>[0]) => {
         if (stepLimitReached) return new Tool.Error({ message: "Tools are disabled after the maximum agent steps" })
@@ -457,6 +460,7 @@ const layer = Layer.effect(
                     agent: agent.id,
                     messageID: assistantMessageID,
                     call: event,
+                    userRequests,
                     // Progress is ephemeral, not durable history: nothing to order.
                     progress: (update) => publisher.progress(event.id, update),
                   }),

packages/core/src/tool.ts

@@ -37,6 +37,7 @@ export interface Snapshot {
     readonly agent: Agent.ID
     readonly messageID: SessionMessage.ID
     readonly call: ToolCall
+    readonly userRequests?: Tool.Context["userRequests"]
     readonly progress?: (update: Tool.Metadata) => Effect.Effect<void>
   }) => Effect.Effect<Tool.Result & { readonly content: ReadonlyArray<Tool.Content> }, Tool.Error>
 }
@@ -234,6 +235,7 @@ const layer = Layer.effect(
                 readonly agent: Agent.ID
                 readonly messageID: SessionMessage.ID
                 readonly call: ToolCall
+                readonly userRequests?: Tool.Context["userRequests"]
                 readonly progress?: (update: Tool.Metadata) => Effect.Effect<void>
               }) => {
                 const context: Tool.Context = {
@@ -241,6 +243,7 @@ const layer = Layer.effect(
                   agent: input.agent,
                   messageID: input.messageID,
                   id: Tool.CallID.make(input.call.id),
+                  ...(input.userRequests?.length ? { userRequests: input.userRequests } : {}),
                   progress: input.progress ?? (() => Effect.void),
                 }
                 if (input.call.name === "execute" && codemodeTool)

packages/core/src/tool/plugin/skill.ts

@@ -51,14 +51,15 @@ export const Plugin = {
               const skill = current.find((skill) => skill.id === input.id)
               if (!skill) return yield* unableToLoad(input.id)
               return yield* Effect.gen(function* () {
-                yield* permission.assert({
-                  action: name,
-                  resources: [skill.id],
-                  save: [skill.id],
-                  sessionID: context.sessionID,
-                  agent: context.agent,
-                  source: { type: "tool", messageID: context.messageID, id: context.id },
-                })
+                if (!context.userRequests?.some((request) => request.action === name && request.resource === skill.id))
+                  yield* permission.assert({
+                    action: name,
+                    resources: [skill.id],
+                    save: [skill.id],
+                    sessionID: context.sessionID,
+                    agent: context.agent,
+                    source: { type: "tool", messageID: context.messageID, id: context.id },
+                  })
                 const directory = path.dirname(skill.location)
                 const files =
                   path.basename(skill.location) === "SKILL.md"

packages/core/test/tool-skill.test.ts

@@ -131,12 +131,25 @@ describe("SkillTool", () => {
               yield* executeTool(registry, {
                 sessionID,
                 ...toolIdentity,
+                userRequests: [{ action: "skill", resource: "other" }],
                 call: { type: "tool-call", id: "call-denied-skill", name: "skill", input: { id: "effect" } },
               }),
             ).toEqual({
               status: "error",
               error: { type: "permission.rejected", message: "Permission denied: skill" },
             })
+            expect(
+              yield* executeTool(registry, {
+                sessionID,
+                ...toolIdentity,
+                userRequests: [{ action: "skill", resource: "effect" }],
+                call: { type: "tool-call", id: "call-user-skill", name: "skill", input: { id: "effect" } },
+              }),
+            ).toMatchObject({
+              status: "completed",
+              content: [{ type: "text", text: Skill.toModelOutput(info, [reference]) }],
+            })
+            expect(assertions).toHaveLength(3)
             deny = false
             const flat = Skill.Info.make({
               id: Skill.ID.make("public"),

packages/schema/src/tool.ts

@@ -16,6 +16,7 @@ export interface Context {
   readonly agent: Agent.ID
   readonly messageID: SessionMessage.ID
   readonly id: CallID
+  readonly userRequests?: ReadonlyArray<{ readonly action: string; readonly resource: string }>
   readonly progress: (update: Metadata) => Effect.Effect<void>
 }