4 Commits

Author	SHA1	Message	Date
Patrick Buckley	bcb8c5ab88	fix(skills): harden task_agent / persona / skill activation from whole-PR review ... Two independent multi-agent reviews of the branch (high, then max effort) found authority-confinement and robustness defects the per-step reviews could not see. This commit addresses every confirmed finding. task_agent turned out to be the surface that lagged its siblings on nearly every axis. Risk gate (most severe): - task_agent(skill=...) never enforced the high/critical-risk PRINCIPAL-load- only gate that skills(load) / spawn_workstream / spawn_batch enforce, so a model could route around it by delegating activation to a sub-agent. Enforce it inline in _prepare_task on the row already fetched (no re-query, no drift between get_skill_by_name and get_prompt_template_by_name). - _high_risk_skill_denied now fails CLOSED on a storage fault: deny, never wave the skill through. Denying (not returning "") also keeps spawn_batch's per-row partial-success intact under a transient blip. - (first round) extracted _high_risk_skill_denied onto spawn_workstream / spawn_batch, closing the coordinator-side bypass. Persona confinement (Principle 7 attenuation on the task_agent edge): - A restrictive persona now attenuates the sub-agent's TOOLS, not just its identity text — the tool lever is frozen into the item and filtered before _run_agent. - Honor ALL FOUR persona levers on the sub-agent, not two: a child persona's mcp-off and memory-off levers now drop MCP tools (mcp__* + read_resource / use_prompt) and the memory tool, matching a main session under the persona. - Cap the sub-agent by the PARENT session's own persona grant too, so a restricted principal cannot escalate authority by spawning. - Add persona to the task_agent judge/audit func_args projection (policy + audit parity with spawn). - Persona-resolution failures defer to a clean tool error (try/except mirroring _validate_child_persona) instead of an opaque "internal error". Substitution / capability: - substitute_args=False for capability contexts (defaults, task_agent) so a literal $ARGUMENTS / $N in a body is preserved, not blanked; env vars still resolve. The literal-$ARGUMENTS scan is deferred behind that guard (skipped on every capability render). - Drop the CLAUDE_SKILL_DIR alias (canonical TURNSTONE_SKILL_DIR only). That name also lives in bash, where turnstone-as-a-node-inside-Claude-Code must not shadow the host's value; claiming it in the prompt but deferring in bash diverged the two surfaces (a review finding). turnstone now claims it in neither surface. The CLAUDE_SESSION_ID / CLAUDE_EFFORT prompt aliases stay (pure prompt values, no bash-namespace collision). Skills-as-context: - DEFAULT (always-on) skills stay in the identity system message — the standing baseline, never a mid-session cache-bust; only a NAMED applied skill moves to the user-role capability message. This shrinks the pending model-adherence eval surface to the named-skill move alone. Cleanups: consolidate a duplicated rationale comment; correct the now-stale "task agents are not persona-filtered" note. PRE-MERGE GATE unchanged: the §7 Q1 model-adherence eval (named-skill move, this branch vs main) is not runnable in-tree and must clear before merge.	2026-07-03 19:16:36 -07:00
Patrick Buckley	3568a6db50	refactor(skills): unify skill-body substitution across invocation contexts ... Skill-body placeholder substitution diverged by invocation context: interactive load, default skills, and spawn-child ran the full render + spec-substitute, while task_agent (_exec_task) ran _render_template only -- so $ARGUMENTS and ${...} env placeholders rendered literally on that one path. Introduce _render_skill_body as the single render+substitute path and route interactive load, defaults, and task_agent through it, so a skill reading ${TURNSTONE_EFFORT} or $ARGUMENTS resolves identically wherever it runs. A sub-agent has no invocation args, so bare $ARGUMENTS and the positional $N / $ARGUMENTS[N] forms resolve to empty there -- matching the defaults and spawn-child paths, not the old verbatim passthrough. - Add ${TURNSTONE_*} as the canonical vendor-neutral spelling for the env placeholders (SESSION_ID, EFFORT, SKILL_DIR); keep ${CLAUDE_*} as a permanent back-compat alias so imported skills keep resolving. - Bash env: export TURNSTONE_SKILL_DIR and SKILL_RESOURCES_DIR unconditionally, but add CLAUDE_SKILL_DIR only when the host has not set it, so turnstone does not shadow a real value when it runs as a node inside Claude Code. - Materialize skill resources before substituting the body, so ${TURNSTONE_SKILL_DIR} resolves to the concrete bundle path on the interactive path. Sub-agent resource materialization and moving identity to a first-class persona are left to follow-ups; ${TURNSTONE_SKILL_DIR} stays literal on the task_agent path for now (unchanged from prior behavior).	2026-07-03 19:16:36 -07:00
Patrick Buckley	06e16de066	chore(skills): drop Anthropic attribution from SKILL.md spec references ... Two related cleanups landed together because they touch the same surface (skill-spec uplift PRs #569/#570/#571/#572): 1. Wording: replace "Anthropic spec" / "Anthropic Claude Code skill spec" with "SKILL.md spec" across admin UI tooltips, code comments, test docstrings, migration 056's module docstring, and the user-facing `arguments` description in tools/skills.json. Renames a parser test `test_anthropic_tags` -> `test_nested_metadata_tags` and consolidates a parse-API test of the same shape; fixture author renamed `Anthropic` -> `Acme` to keep the fixture neutral. Legitimate provider/SDK/API references (provider name, api.anthropic.com, `_anthropic.py`, capability comments) are intentionally untouched. 2. Admin UX: in the Create + Edit Skill modals, six fields per modal (Compatibility, Paths, Hide-from-skill-picker, Arguments, Argument hint, Activation) had long uppercase label-hint spans crammed into the visible label. Migrated each to the existing `.settings-help-btn` + `.settings-help-popover` pattern already used in the Settings tab — short label + inline `?` button that opens a styled popover with proper `<code>` formatting for technical tokens. Pattern reuse required two small generalisations in admin.js: * `_toggleSettingsHelp` now looks up the popover via a new `data-help-target="<id>"` attribute first, falling back to the settings-tab `.settings-label-col` ancestor lookup. * `_closeAllSettingsHelp` mirrors the same dual-path lookup when resetting `aria-expanded`, so modal buttons don't get stuck on `aria-expanded="true"` after another popover opens. * Added a document-delegated click handler that fires only for buttons with `data-help-target`; existing per-button binding in the settings-tab render path is unchanged. CSS: `.settings-help-btn` now paints its `?` via `::after` with the button's own `font-size: 0`, so prettier-introduced whitespace inside the new HTML buttons can't off-center the glyph. The same rule applies to existing admin.js-generated buttons (text content hidden, pseudo identical). Small additions for `.settings-help-popover code` / `strong` styling so technical tokens render with the same monospace pill treatment used elsewhere in skill UI. Known follow-ups (intentionally NOT in this PR): * Migrate the settings-tab `_renderSettingRow` button assembly to the empty-`<button>` + `data-help-target` form so the per-button addEventListener loop can be dropped in favour of pure document delegation, and the `font-size: 0` rule stops being a workaround for two markup styles. * The 12 new popover blocks are duplicated verbatim between the Create and Edit modals (same as the rest of the create/edit modal pair). A small renderer that emits popovers from a shared data object would eliminate the drift risk but is unrelated cleanup.	2026-05-24 14:56:43 -07:00
Patrick Buckley	9309162ac0	feat(skills): wire \$ARGUMENTS / \$N / \$<name> / \${CLAUDE_*} substitution (#572) ... Implements the Anthropic Claude Code skill spec's placeholder substitution end to end. The renderer in ``_substitute_skill_args`` handles every spec form except ``\${CLAUDE_SKILL_DIR}`` (deferred): * ``\$ARGUMENTS`` — full args string as the user/model typed it * ``\$ARGUMENTS[N]`` / ``\$N`` — Nth positional arg, ``shlex.split``-parsed * ``\$<name>`` — named arg from the SKILL.md ``arguments:`` list * ``\${CLAUDE_SESSION_ID}`` / ``\${CLAUDE_EFFORT}`` — session state Substitution is single-pass (one combined regex, one ``re.sub``). Append rule: when args are passed but the body has no bare ``\$ARGUMENTS``, append ``ARGUMENTS: …`` at the end. ## Surface * Parser: ``arguments:`` (list/space-delim) + ``argument-hint:`` (str) extracted into ``ParsedSkill``. * Install: persists both to the pre-allocated columns from migration 056 (PR #574). Install path clamps ``argument_hint`` to 128 chars to match the admin-create cap (untrusted upstream source). * Admin: ``CreateSkillRequest`` / ``UpdateSkillRequest`` accept both fields; create + edit modals get inputs; parse-preview echoes. * Renderer: ``_substitute_skill_args`` runs AFTER ``_render_template`` in ``_load_skills`` so user-supplied args containing ``{{var}}`` can't be re-expanded by the legacy renderer. * Session: ``_skill_arguments`` plumbed through ``__init__``, ``set_skill``, and ``_save_config`` so a resumed workstream re-renders with the original arg payload. * Model tool: ``skills(action='load')`` accepts an ``arguments`` string. Approval label includes a SHA-256 digest of the args so a once- approved skill name can't grant cover for a future payload; preview surfaces the args inline. ## ``/review`` findings (addressed) * ``\${CLAUDE_EFFORT}`` referenced ``self._reasoning_effort`` — wrong attribute; the real one is ``self.reasoning_effort``. Always rendered empty. Fixed. * Two-pass layering let user args containing ``{{var}}`` re-expand. Render order reversed. * ``_skill_arguments`` wasn't in ``_save_config`` — resumed workstreams silently lost their payload. Added. * Approval label omitted ``arguments``. Digest + preview added. * Install path didn't bound ``argument_hint``. Clamped. * Added ``_skill_arg_names`` decode tests + "load same skill, different args → re-render" invariant test. ## Copilot review findings (addressed) * ``skills.json`` tool description was inaccurate about ``shlex`` stripping quotes and "empty string disables substitution". Rewrote to match actual behaviour. * Named-argument regex was stricter than parser/storage contract. ``arguments: [issue-number]`` would partial-match ``\$issue-number`` as ``\$issue``, leaving ``-number`` as stray text. Broadened the regex to ``[A-Za-z_][A-Za-z0-9_]*`` AND added validation at ``_skill_arg_names`` decode time so names not matching the regex are dropped with a warning. ## Tests * ``tests/test_substitute_skill_args.py`` — placeholder forms, single-pass guarantee, append-at-end rule, shell-quoted input, unbalanced-quote fallback, uppercase + underscore-prefix names * ``tests/test_skill_parser.py::TestArgumentsAndHint`` — parser extraction * ``tests/test_skill_parse_api.py`` — HTTP parse-preview echoes both fields * ``tests/test_skill_discovery_api.py::test_install_seeds_arguments_and_argument_hint`` — install round-trip * ``tests/test_skills_tool.py::test_load_forwards_arguments_to_set_skill`` + ``test_load_same_skill_different_args_triggers_resub`` — wire path through prepare → exec → set_skill * ``tests/test_skills_tool.py::TestSkillArgNames`` — storage decode helper including the hyphen/dot/leading-digit filter	2026-05-23 17:48:16 -07:00