Function run_agent 

pub fn run_agent(
    files: &[(PathBuf, TaskFile)],
    name: &str,
    args: &[String],
    cwd: &Path,
) -> Result<Output, RunError>

The agent gate: run name for an MCP or agent surface, captured, failing closed. Enforced, in order:

• The nearest definition of name across the layered files must carry Agent: allow, else RunError::NotAllowed. A nearer non-allowed definition shadows a farther allowed one (still NotAllowed), and a name that resolves nowhere is NotAllowed too: the agent never learns whether a hidden job exists.
• The target must not raw-template a declared arg into its script via {{ arg }} (the agent controls the value), else RunError::Injects. The author must read the value from the environment instead.
• The Requires: chain is resolved within the target’s own file, not by the cross-file nearest-wins scan run uses. The author who wrote Agent: allow vouched for their file’s jobs; a nearer, untrusted task file in the invocation directory must not be able to shadow a dependency and run attacker-controlled code through an allowed entry point. A dependency is never independently callable and never listed.

Only the target receives args; dependencies run argless with author-controlled defaults, so the target is the sole injection surface.