Host executes tools from read skills after realm verification

[lukemelia]

Linear: CS-12047

Stacked on #5485 (event-sourced prompt injection) — the pull model's execution leg. When the model calls a tool it discovered by reading a skill file, the host resolves and executes it with the declaring skill's indexed frontmatter as the authority, never the bot's event alone.

Trust model

The bot's discoveredTools annotation is strictly a lookup hint. message-builder re-derives the codeRef from the named skill's realm-indexed frontmatter, loaded via loadSkillSource through the store with the user's own permissions, and accepts it only when the indexed declaration's computed functionName matches the call. Consequences, each surfacing through the existing unrecognized-command invalid-result path:

• a forged annotation can point at a skill but can't make it declare a tool it doesn't have;
• a skill the user can't read (403) or that no longer exists resolves nothing;
• a tool the skill has since removed no longer matches.

requiresApproval comes from the same verified declaration (absent → approval required), so approval prompting and auto-execute behave identically to enabled skills.

Shape

• skill-tools.ts: findDiscoveredToolSkillUrl(events, functionName) — the latest readRealmFile result event naming the function wins, matching how prompt assembly picks the freshest read.
• message-builder.ts: when the enabled-skills scan finds no match, the fallback runs the lookup + verification above; the resolved MessageTool then flows through the existing validate/approve/execute machinery unchanged.

Testing

Two acceptance tests in tools-test:

• a tool from a read (never enabled) skill renders an Apply button (approval required), executes on click, and round-trips an applied result event;
• an annotation naming a skill that doesn't declare the tool resolves nothing — the request goes invalid with the unrecognized-command reason and the tool never executes.

The lost-read-access case shares the same code path (loadSkillSource returns undefined for anything the store can't read as a skill), so it isn't separately simulated. Type-check and lint pass; host suite runs in CI.

🤖 Generated with Claude Code

[github-actions]

Preview deployments

• Host staging preview

• Host production preview

Host Test Results

    1 files      1 suites   3h 2m 22s ⏱️
3 472 tests 3 457 ✅ 15 💤 0 ❌
3 491 runs  3 476 ✅ 15 💤 0 ❌

Results for commit fe8413b.

Realm Server Test Results

    1 files      1 suites   11m 5s ⏱️
1 816 tests 1 816 ✅ 0 💤 0 ❌
1 895 runs  1 895 ✅ 0 💤 0 ❌

Results for commit fe8413b.

[Copilot]

Pull request overview

This PR extends the host’s tool-resolution path so that when the model calls a tool it previously discovered via readRealmFile (i.e. from a skill that was read but never enabled in the room), the host can still resolve and execute it only after re-deriving the tool from the declaring skill’s realm-indexed frontmatter (treating the event annotation as a lookup hint, not authority).

Changes:

• Add findDiscoveredToolSkillUrl(events, functionName) to locate the declaring skill URL from the latest data.discoveredTools tool-result event.
• Update MessageBuilder to fall back to discovered-skill lookup + verification when no enabled-skill tool matches the request.
• Add acceptance tests covering (1) read-skill tool requires approval and executes on Apply, and (2) forged “declaring skill” hints that don’t actually declare the tool are rejected.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
packages/host/tests/acceptance/tools-test.gts	Adds markdown skill fixtures plus acceptance coverage for executing tools discovered via readRealmFile and rejecting forged hints.
packages/host/app/lib/skill-tools.ts	Introduces findDiscoveredToolSkillUrl to extract the declaring skill URL hint from prior tool-result events.
packages/host/app/lib/matrix-classes/message-builder.ts	Adds a fallback tool-resolution path that loads/verifies the declaring skill’s indexed tool declaration before execution.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.