[hetaoBackend]

Change

After the private-runtime read guard was introduced, bundled skills under .builtin-skills and the active agent's skills under agents/<agent>/skills unexpectedly required approval when reading their references or templates in default/auto permission modes.

Recognize these roots in both the private-state guard and the facade's read-only allow paths. Keep other agents' private roots, runtime state, similarly named sibling directories, and credential/private-state symlink targets behind approval. Full-access behavior is unchanged.

Validation

• New default/auto regression cases failed before the fix (ask instead of allow); all 142 permission facade tests pass after the fix. Coverage includes read/grep/glob/list, global/builtin/active-agent roots, permission modes, private-state isolation, and file/root symlinks.
• Full pnpm verify on committed fdf164510ece1404ac6127491b25db25bb31979c on macOS arm64 / Node 26: all 14 gates passed. The initial shared-dependency setup failed the sandbox manifest lookup; installing the frozen lockfile into this worktree resolved it, and the complete profile passed on rerun.
• No live-model, interactive terminal/Desktop, Windows, or Linux acceptance was performed locally; offline facade coverage does not establish those boundaries.

Publication and contribution checks

• I have permission to contribute these changes under the existing applicable licenses; existing notices are preserved.
• No credentials, account data, real user content, internal source history, or private review material is included.
• Only existing files were edited; the existing test file is already registered and source inventory validation passes.
• This restores intended resource-read behavior without adding user configuration; no documentation contract changes are required.

Maintainer handoff

Publication scope and licensing are unchanged. Shared-source port: complete. Merge/release remains a maintainer action.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}