# Authorize

> Grant work authorization for Edit/Write operations in this session

- Skill: `omninode-ai/authorize` (Agent Skill)
- Install (CLI): `npx skillmds@latest add omninode-ai/authorize`
- Raw SKILL.md: https://api.skillmd.com/api/skills/omninode-ai/authorize/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: OmniNode-ai (https://skillmd.com/u/omninode-ai)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/omninode-ai/authorize

---


# Authorize

**Usage:** `/authorize [scope] [tools] [ttl_seconds]`

Grant authorization for Edit/Write operations in the current session. Backed
by `node_authorize` in omnimarket — logic lives in the node handler, this
skill is a thin UX wrapper.

## What This Does

Invokes `node_authorize`, which writes a `ModelAgentAuthorizationGrant` to
`$ONEX_STATE_DIR/session/authorization.json` via a tempfile + `os.replace`
atomic swap. The PermissionRequest authorization gate hook reads
this file to auto-approve in-scope Edit/Write requests.

**Grant schema (on-disk contract):**

```json
{
  "scope": ["src/**", "tests/**"],
  "granted_at": "2026-04-17T16:00:00+00:00",
  "expires_at": "2026-04-17T20:00:00+00:00",
  "tools": ["Edit", "Write"]
}
```

- `expires_at: null` — non-expiring grant (explicit opt-in via `ttl_seconds=0`).
- Missing file OR `expires_at < now()` both collapse to "no grant"; the hook
  falls through to the default PermissionRequest flow.

## Invocation

Run the node directly via the ONEX node runner:

Use the deterministic `node_authorize` entrypoint with scope, tool, and
TTL arguments. The node runner returns the same typed authorization result
that the wrapper renders to the user.

Under a full Kafka runtime, the skill wrapper publishes a command envelope to
`onex.cmd.omnimarket.authorize-start.v1`; the node consumes it, writes the
file, and emits `onex.evt.omnimarket.authorize-completed.v1`. Under
`RuntimeLocal` (no infra), the handler runs in-process via
`EventBusInmemory` — the file is written either way.

## File Location

`$ONEX_STATE_DIR/session/authorization.json`. The canonical relative path
constant is exported as `AUTHORIZATION_FILE_RELATIVE_PATH` from
`omnimarket.nodes.node_authorize.models.model_agent_authorization_grant`.

## Reader Contract

Downstream consumers (Task 3 PermissionRequest hook, audit tooling) should
import `load_grant_if_valid(path)` from the same module. It returns `None`
for missing, malformed, or expired grants — callers make exactly one
decision.

## Failure Modes

- `ONEX_STATE_DIR` unset — handler raises `RuntimeError`. Caller must export
  the env var before invocation (set at plugin install time).
- Disk write failure — handler removes the tempfile and re-raises; no
  partial `authorization.json` is ever observable.
- Second invocation — atomically replaces the prior grant.

## Migration Note

The prior `/tmp/omniclaude-auth/{session_id}.json` scheme read by
`plugins/onex/hooks/lib/auth_gate_adapter.py` remains in place for the
PreToolUse gate until the Task 3 PermissionRequest hook ships.
This skill writes the authorization grant file; the PreToolUse adapter migration
is tracked under the unused-hooks epic.

## Related

- Node: `omnimarket/src/omnimarket/nodes/node_authorize/`
- Principle: skills are thin wrappers over node logic; gates must be enforced, not merely informational