tool-execution

Imported from Local-Agent-X/Local-Agent-X (src/tool-execution/AGENTS.md). Install upstream with npx skills add Local-Agent-X/Local-Agent-X --skill tool-execution. Copyright stays with the author.

tool-execution

Owns: The dispatch pipeline every model-issued tool call passes through — resolve → policy (Ari + rule packs) → approval → sandbox → audit. Does not own: Tool definitions and the registry → src/tools/; policy rows → src/tool-policy/; the kernel itself → src/ari-kernel/. Entry: index.ts — executeToolCalls / dispatchSingleToolCall for model calls; executeHarnessCommand (harness-exec.ts) for harness-initiated shell (build-verify, spec-probes): kill switch + audit only, no policy/approval/RBAC.

Invariants

• Never call a tool's execute from outside this module: the gates in pre-dispatch.ts and enforce-policy.ts are what make policy, Ari, approval and RBAC apply.
• Gate order in enforce-policy.ts (securityAndValidationGates) is load-bearing: name resolution runs before the kernel, so an unknown name reads as "not a tool", not as a kernel fault.
• A kernel-gated tool with no ARI_ACTION_MAP row falls through to action exec, which the kernel schema rejects — a hard block under ariRequired.
• Model-supplied _-prefixed args are dropped (internal-args.ts); only SESSION_SCOPED_TOOLS get the trusted _sessionId, only OPERATION_SCOPED_TOOLS get _operationId.

Coupled to

Tests

npx vitest run src/tool-execution (PowerShell on Windows)