Authorize

Usage: /authorize [scope] [tools] [ttl_seconds]

Grant authorization for Edit/Write operations in the current session. Backed
by node_authorize in omnimarket — logic lives in the node handler, this
skill is a thin UX wrapper.

What This Does

Invokes node_authorize, which writes a ModelAgentAuthorizationGrant to
$ONEX_STATE_DIR/session/authorization.json via a tempfile + os.replace
atomic swap. The PermissionRequest authorization gate hook reads
this file to auto-approve in-scope Edit/Write requests.

Grant schema (on-disk contract):

{
  "scope": ["src/**", "tests/**"],
  "granted_at": "2026-04-17T16:00:00+00:00",
  "expires_at": "2026-04-17T20:00:00+00:00",
  "tools": ["Edit", "Write"]
}

• expires_at: null — non-expiring grant (explicit opt-in via ttl_seconds=0).
• Missing file OR expires_at < now() both collapse to "no grant"; the hook
  falls through to the default PermissionRequest flow.

Invocation

Run the node directly via the ONEX node runner:

Use the deterministic node_authorize entrypoint with scope, tool, and
TTL arguments. The node runner returns the same typed authorization result
that the wrapper renders to the user.

Under a full Kafka runtime, the skill wrapper publishes a command envelope to
onex.cmd.omnimarket.authorize-start.v1; the node consumes it, writes the
file, and emits onex.evt.omnimarket.authorize-completed.v1. Under
RuntimeLocal (no infra), the handler runs in-process via
EventBusInmemory — the file is written either way.

File Location

$ONEX_STATE_DIR/session/authorization.json. The canonical relative path
constant is exported as AUTHORIZATION_FILE_RELATIVE_PATH from
omnimarket.nodes.node_authorize.models.model_agent_authorization_grant.

Reader Contract

Downstream consumers (Task 3 PermissionRequest hook, audit tooling) should
import load_grant_if_valid(path) from the same module. It returns None
for missing, malformed, or expired grants — callers make exactly one
decision.

Failure Modes

• ONEX_STATE_DIR unset — handler raises RuntimeError. Caller must export
  the env var before invocation (set at plugin install time).
• Disk write failure — handler removes the tempfile and re-raises; no
  partial authorization.json is ever observable.
• Second invocation — atomically replaces the prior grant.

Migration Note

The prior /tmp/omniclaude-auth/{session_id}.json scheme read by
plugins/onex/hooks/lib/auth_gate_adapter.py remains in place for the
PreToolUse gate until the Task 3 PermissionRequest hook ships.
This skill writes the authorization grant file; the PreToolUse adapter migration
is tracked under the unused-hooks epic.

Related

• Node: omnimarket/src/omnimarket/nodes/node_authorize/
• Principle: skills are thin wrappers over node logic; gates must be enforced, not merely informational