fix: restore skill filtering by agent permissions (#7042)

2 files changed, 17 insertions, 19 deletions

diff --git a/packages/opencode/src/session/prompt.ts b/packages/opencode/src/session/prompt.ts
index 87b53f526..1f5fc9884 100644
--- a/packages/opencode/src/session/prompt.ts
+++ b/packages/opencode/src/session/prompt.ts
@@ -675,7 +675,7 @@ export namespace SessionPrompt {
       },
     })
 
-    for (const item of await ToolRegistry.tools(input.model.providerID)) {
+    for (const item of await ToolRegistry.tools(input.model.providerID, input.agent)) {
       const schema = ProviderTransform.schema(input.model, z.toJSONSchema(item.parameters))
       tools[item.id] = tool({
         id: item.id as any,
diff --git a/packages/opencode/src/tool/skill.ts b/packages/opencode/src/tool/skill.ts
index 24a727d30..386abdae7 100644
--- a/packages/opencode/src/tool/skill.ts
+++ b/packages/opencode/src/tool/skill.ts
@@ -3,31 +3,33 @@ import z from "zod"
 import { Tool } from "./tool"
 import { Skill } from "../skill"
 import { ConfigMarkdown } from "../config/markdown"
+import { PermissionNext } from "../permission/next"
 
-export const SkillTool = Tool.define("skill", async () => {
+const parameters = z.object({
+  name: z.string().describe("The skill identifier from available_skills (e.g., 'code-review' or 'category/helper')"),
+})
+
+export const SkillTool = Tool.define("skill", async (ctx) => {
   const skills = await Skill.all()
 
   // Filter skills by agent permissions if agent provided
-  /*
-    let accessibleSkills = skills
-    if (ctx?.agent) {
-      const permissions = ctx.agent.permission.skill
-      accessibleSkills = skills.filter((skill) => {
-        const action = Wildcard.all(skill.name, permissions)
-        return action !== "deny"
+  const agent = ctx?.agent
+  const accessibleSkills = agent
+    ? skills.filter((skill) => {
+        const rule = PermissionNext.evaluate("skill", skill.name, agent.permission)
+        return rule.action !== "deny"
       })
-    }
-    */
+    : skills
 
   const description =
-    skills.length === 0
+    accessibleSkills.length === 0
       ? "Load a skill to get detailed instructions for a specific task. No skills are currently available."
       : [
           "Load a skill to get detailed instructions for a specific task.",
           "Skills provide specialized knowledge and step-by-step guidance.",
           "Use this when a task matches an available skill's description.",
           "<available_skills>",
-          ...skills.flatMap((skill) => [
+          ...accessibleSkills.flatMap((skill) => [
             `  <skill>`,
             `    <name>${skill.name}</name>`,
             `    <description>${skill.description}</description>`,
@@ -38,12 +40,8 @@ export const SkillTool = Tool.define("skill", async () => {
 
   return {
     description,
-    parameters: z.object({
-      name: z
-        .string()
-        .describe("The skill identifier from available_skills (e.g., 'code-review' or 'category/helper')"),
-    }),
-    async execute(params, ctx) {
+    parameters,
+    async execute(params: z.infer<typeof parameters>, ctx) {
       const skill = await Skill.get(params.name)
 
       if (!skill) {