docs: require OpenProse remote import consent

joshavant · joshavant · commit 259877dccf1c · 2026-06-24T16:36:48.000-05:00
diff --git a/docs/prose.md b/docs/prose.md
@@ -71,6 +71,11 @@ OpenProse registers `/prose` as a user-invocable skill command:
 `/prose run <handle/slug>` resolves to `https://p.prose.md/<handle>/<slug>`.
 Direct URLs are fetched as-is using the `web_fetch` tool.
 
+Top-level remote runs are explicit. Remote imports inside a `.prose` program are
+transitive code dependencies: before OpenProse fetches any remote `use` target,
+it shows the resolved import list and requires the operator to reply exactly
+`approve remote prose imports` for that run.
+
 ## What it can do
 
 - Multi-agent research and synthesis with explicit parallelism.
@@ -167,9 +172,12 @@ User-level persistent agents live at:
 
 ## Security
 
-Treat `.prose` files like code. Review them before running. Use OpenClaw tool
-allowlists and approval gates to control side effects. For deterministic,
-approval-gated workflows, compare with [Lobster](/tools/lobster).
+Treat `.prose` files like code. Review them before running, including remote
+`use` imports. Top-level `/prose run https://...` requests are explicit, but
+transitive remote imports require per-run approval before they are fetched or
+executed. Use OpenClaw tool allowlists and approval gates to control side
+effects. For deterministic, approval-gated workflows, compare with
+[Lobster](/tools/lobster).
 
 ## Related
 
diff --git a/extensions/open-prose/skills/prose/SKILL.md b/extensions/open-prose/skills/prose/SKILL.md
@@ -89,13 +89,27 @@ prose run alice/code-review
 2. Fetch the `.prose` content
 3. Load the VM and execute as normal
 
-This same resolution applies to `use` statements inside `.prose` files:
+Top-level remote runs are explicit user requests. Transitive imports inside a
+program are different: treat every remote `use` target as a code dependency that
+needs operator consent before it is fetched or executed.
+
+This same resolution applies to `use` statements inside `.prose` files, but the
+VM must fail closed until the operator approves the remote dependency list:
 
 ```prose
 use "https://example.com/my-program.prose"  # Direct URL
 use "alice/research" as research             # Registry shorthand
 ```
 
+When a program contains any remote `use` target (`http://`, `https://`, or
+registry shorthand):
+
+1. Collect and display the exact resolved remote targets.
+2. Explain that these are transitive code dependencies for this run.
+3. Ask the operator to reply exactly `approve remote prose imports` to continue.
+4. Do not fetch, parse, register, or execute those imports unless that exact
+   approval is given in this run.
+
 ---
 
 ## File Locations
diff --git a/extensions/open-prose/skills/prose/compiler.md b/extensions/open-prose/skills/prose/compiler.md
@@ -339,21 +339,24 @@ Please provide final recommendations.
 
 ## Use Statements (Program Composition)
 
-Use statements import other OpenProse programs from the registry at `p.prose.md`, enabling modular workflows.
+Use statements import other OpenProse programs from registry paths or direct
+HTTP(S) URLs, enabling modular workflows.
 
 ### Syntax
 
 ```prose
 use "@handle/slug"
 use "@handle/slug" as alias
+use "https://example.com/program.prose" as alias
 ```
 
 ### Path Format
 
-Import paths follow the format `@handle/slug`:
+Import paths are either registry references or direct HTTP(S) URLs:
 
-- `@handle` identifies the program author/organization
-- `slug` is the program name
+- `@handle/slug` identifies a program author/organization and slug.
+- `handle/slug` resolves to the same registry host used by the runtime.
+- `https://example.com/program.prose` fetches that exact URL after approval.
 
 An optional alias (`as name`) allows referencing by a shorter name.
 
@@ -371,26 +374,32 @@ use "@bob/critique" as critic
 
 When the OpenProse VM encounters a `use` statement:
 
-1. Fetch the program from `https://p.prose.md/@handle/slug`
-2. Parse the program to extract its contract (inputs/outputs)
-3. Register the program in the Import Registry
+1. Resolve the import target.
+2. If the target is remote (`http://`, `https://`, or registry shorthand), pause
+   before fetching and require the operator to approve the full remote import
+   list with `approve remote prose imports` for this run.
+3. Fetch the program only after approval.
+4. Parse the program to extract its contract (inputs/outputs).
+5. Register the program in the Import Registry.
 
 ### Validation Rules
 
 | Check                 | Severity | Message                                |
 | --------------------- | -------- | -------------------------------------- |
 | Empty path            | Error    | Use path cannot be empty               |
-| Invalid path format   | Error    | Path must be @handle/slug format       |
+| Invalid path format   | Error    | Path must be registry path or URL      |
 | Duplicate import      | Error    | Program already imported               |
 | Missing alias for dup | Error    | Alias required when importing multiple |
 
 ### Execution Semantics
 
 Use statements are processed before any agent definitions or sessions. The OpenProse VM:
 
-1. Fetches and validates all imported programs at the start of execution
-2. Extracts input/output contracts from each program
-3. Registers programs in the Import Registry for later invocation
+1. Resolves all imported program targets at the start of execution.
+2. Requires operator approval before fetching any remote imports.
+3. Fetches and validates approved imported programs.
+4. Extracts input/output contracts from each program.
+5. Registers programs in the Import Registry for later invocation.
 
 ---
 
diff --git a/extensions/open-prose/skills/prose/guidance/system-prompt.md b/extensions/open-prose/skills/prose/guidance/system-prompt.md
@@ -162,8 +162,10 @@ For general programming tasks, please use a general-purpose agent instance.
 ## Execution Algorithm (Simplified)
 
 1. Parse program structure (use statements, inputs, agents, blocks)
-2. Bind inputs from caller or prompt user if missing
-3. For each statement in order:
+2. Resolve `use` imports. If any import is remote, require the operator to
+   approve the full list with `approve remote prose imports` before fetching.
+3. Bind inputs from caller or prompt user if missing
+4. For each statement in order:
    - `session` → Task tool call, await result
    - `resume` → Load memory, Task tool call, await result
    - `let/const` → Execute RHS, bind result
@@ -172,8 +174,8 @@ For general programming tasks, please use a general-purpose agent instance.
    - `try/catch` → Execute try, catch on error, always finally
    - `choice/if` → Evaluate conditions, execute matching branch
    - `do block` → Push frame, bind args, execute body, pop frame
-4. Collect output bindings
-5. Return outputs to caller
+5. Collect output bindings
+6. Return outputs to caller
 
 ## Remember
 
diff --git a/extensions/open-prose/skills/prose/prose.md b/extensions/open-prose/skills/prose/prose.md
@@ -63,6 +63,13 @@ use "https://example.com/my-program.prose"  # Direct URL
 use "alice/research" as research             # Registry shorthand
 ```
 
+Top-level remote runs are explicit user requests. Remote `use` statements are
+transitive code dependencies. Before fetching any remote `use` target, collect
+the exact resolved targets, show them to the operator, and require the operator
+to reply exactly `approve remote prose imports` for this run. If approval is not
+given, abort the run before fetching, parsing, registering, or executing the
+remote imports.
+
 ---
 
 ## Why This Is a VM
@@ -113,18 +120,18 @@ When you execute a `.prose` program, you ARE the virtual machine. This is not a
 
 Traditional dependency injection containers wire up components from configuration. You do the same—but with understanding:
 
-| Declared Primitive          | Your Responsibility                                        |
-| --------------------------- | ---------------------------------------------------------- |
-| `use "handle/slug" as name` | Fetch program from p.prose.md, register in Import Registry |
-| `input topic: "..."`        | Bind value from caller, make available as variable         |
-| `output findings = ...`     | Mark value as output, return to caller on completion       |
-| `agent researcher:`         | Register this agent template for later use                 |
-| `session: researcher`       | Resolve the agent, merge properties, spawn the session     |
-| `resume: captain`           | Load agent memory, spawn session with memory context       |
-| `context: { a, b }`         | Wire the outputs of `a` and `b` into this session's input  |
-| `parallel:` branches        | Coordinate concurrent execution, collect results           |
-| `block review(topic):`      | Store this reusable component, invoke when called          |
-| `name(input: value)`        | Invoke imported program with inputs, receive outputs       |
+| Declared Primitive          | Your Responsibility                                                     |
+| --------------------------- | ----------------------------------------------------------------------- |
+| `use "handle/slug" as name` | Resolve import, require approval if remote, register in Import Registry |
+| `input topic: "..."`        | Bind value from caller, make available as variable                      |
+| `output findings = ...`     | Mark value as output, return to caller on completion                    |
+| `agent researcher:`         | Register this agent template for later use                              |
+| `session: researcher`       | Resolve the agent, merge properties, spawn the session                  |
+| `resume: captain`           | Load agent memory, spawn session with memory context                    |
+| `context: { a, b }`         | Wire the outputs of `a` and `b` into this session's input               |
+| `parallel:` branches        | Coordinate concurrent execution, collect results                        |
+| `block review(topic):`      | Store this reusable component, invoke when called                       |
+| `name(input: value)`        | Invoke imported program with inputs, receive outputs                    |
 
 You are the container that holds these declarations and wires them together at runtime. The program declares _what_; you determine _how_ to connect them.
 
@@ -698,7 +705,9 @@ Query the database to access the content.
 
 ## Program Composition
 
-Programs can import and invoke other programs, enabling modular workflows. Programs are fetched from the registry at `p.prose.md`.
+Programs can import and invoke other programs, enabling modular workflows.
+Registry and direct-URL imports are remote code dependencies and require
+operator approval before fetching.
 
 ### Importing Programs
 
@@ -709,15 +718,20 @@ use "alice/research"
 use "bob/critique" as critic
 ```
 
-The import path follows the format `handle/slug`. An optional alias (`as name`) allows referencing by a shorter name.
+The import path can be a registry reference (`handle/slug`) or a direct HTTP(S)
+URL. An optional alias (`as name`) allows referencing by a shorter name.
 
 ### Program URL Resolution
 
 When the VM encounters a `use` statement:
 
-1. Fetch the program from `https://p.prose.md/handle/slug`
-2. Parse the program to extract its contract (inputs/outputs)
-3. Register the program in the Import Registry
+1. Resolve the import target.
+2. If the target is remote (`http://`, `https://`, or registry shorthand), pause
+   before fetching and require the operator to approve the full remote import
+   list with `approve remote prose imports` for this run.
+3. Fetch the program only after approval.
+4. Parse the program to extract its contract (inputs/outputs).
+5. Register the program in the Import Registry.
 
 ### Input Declarations
 
@@ -1156,11 +1170,13 @@ Before spawning, substitute `{varname}` with variable values.
 
 ```
 function execute(program, inputs?):
-  1. Collect all use statements, fetch and register imports
-  2. Collect all input declarations, bind values from caller
-  3. Collect all agent definitions
-  4. Collect all block definitions
-  5. For each statement in order:
+  1. Collect all use statements, resolve import targets
+  2. If remote imports are present, require operator approval before fetch
+  3. Fetch approved imports and register them
+  4. Collect all input declarations, bind values from caller
+  5. Collect all agent definitions
+  6. Collect all block definitions
+  7. For each statement in order:
      - If session: spawn via Task, await result
      - If resume: load memory, spawn via Task, await result
      - If let/const: execute RHS, bind result
@@ -1219,7 +1235,7 @@ When passing context to sessions:
 
 The OpenProse VM:
 
-1. **Imports** programs from `p.prose.md` via `use` statements
+1. **Imports** approved programs via `use` statements
 2. **Binds** inputs from caller to program variables
 3. **Parses** the program structure
 4. **Collects** definitions (agents, blocks)
diff --git a/extensions/open-prose/skills/prose/state/in-context.md b/extensions/open-prose/skills/prose/state/in-context.md
@@ -210,6 +210,8 @@ For variable resolution across scopes:
 
 ```
 [Import] Importing: @alice/research
+   Remote dependency requires approval: https://p.prose.md/@alice/research
+   Operator approved: approve remote prose imports
    Fetching from: https://p.prose.md/@alice/research
    Inputs expected: [topic, depth]
    Outputs provided: [findings, sources]
