@alisio/core 0.1.0-alpha.16 → 0.1.0-alpha.18

package/dist/runtime/store.js

@@ -1,5 +1,16 @@
 import { textResult, } from "@alisio/sdk";
 import { openDatabase } from "./sqlite.js";
+/** Whether a process id belongs to a live process (EPERM still means alive). */
+function alive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e.code !== "ESRCH";
+    }
+}
+const TERMINAL_RUN = "('completed','turns_exceeded','failed','cancelled','interrupted')";
 export class SQLiteStore {
     db;
     constructor(path) {
@@ -45,12 +56,61 @@ export class SQLiteStore {
                 this.db.exec("CREATE INDEX IF NOT EXISTS sessions_parent ON sessions(parent_id)");
                 this.db.exec("INSERT OR IGNORE INTO schema_migrations VALUES(3)");
             });
+        if (!has(4))
+            this.db.transaction(() => {
+                // v4 (additive): run journal, workspace UI metadata, blob index and nullable columns.
+                this.db.exec(`CREATE TABLE IF NOT EXISTS runs(
+            id TEXT PRIMARY KEY,
+            session TEXT NOT NULL REFERENCES sessions(id),
+            status TEXT NOT NULL,
+            request_id TEXT,
+            correlation_id TEXT,
+            owner_pid INTEGER,
+            model TEXT,
+            created_at INTEGER NOT NULL,
+            started_at INTEGER,
+            ended_at INTEGER,
+            error TEXT,
+            usage TEXT);
+          CREATE UNIQUE INDEX IF NOT EXISTS runs_request ON runs(session, request_id) WHERE request_id IS NOT NULL;
+          CREATE INDEX IF NOT EXISTS runs_session ON runs(session, created_at);
+          CREATE TABLE IF NOT EXISTS workspaces(
+            path TEXT PRIMARY KEY,
+            label TEXT,
+            pinned INTEGER NOT NULL DEFAULT 0,
+            last_opened_at INTEGER);
+          CREATE TABLE IF NOT EXISTS blobs(
+            hash TEXT PRIMARY KEY,
+            mime TEXT NOT NULL,
+            size INTEGER NOT NULL,
+            width INTEGER,
+            height INTEGER,
+            created_at INTEGER NOT NULL);`);
+                const add = (table, name, type) => {
+                    const columns = this.db.prepare(`PRAGMA table_info(${table})`).all();
+                    if (!columns.some((c) => c.name === name))
+                        this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${name} ${type}`);
+                };
+                add("sessions", "pinned", "INTEGER NOT NULL DEFAULT 0");
+                add("sessions", "archived_at", "INTEGER");
+                add("events", "created_at", "INTEGER");
+                add("events", "correlation_id", "TEXT");
+                add("tool_calls", "run_id", "TEXT");
+                add("tool_calls", "name", "TEXT");
+                add("tool_calls", "effect", "TEXT");
+                add("tool_calls", "started_at", "INTEGER");
+                add("tool_calls", "ended_at", "INTEGER");
+                this.db.exec(`CREATE INDEX IF NOT EXISTS events_session ON events(session, seq);
+          CREATE INDEX IF NOT EXISTS messages_session ON messages(session, seq);
+          INSERT OR IGNORE INTO schema_migrations VALUES(4);`);
+            });
     }
     create(workspace, provider, model) {
         const id = crypto.randomUUID();
+        const now = Date.now();
         this.db
-            .prepare("INSERT INTO sessions(id,workspace,provider,model) VALUES(?,?,?,?)")
-            .run(id, workspace, provider, model);
+            .prepare("INSERT INTO sessions(id,workspace,provider,model,created_at,updated_at) VALUES(?,?,?,?,?,?)")
+            .run(id, workspace, provider, model, now, now);
         return { id, workspace, provider, model };
     }
     row(r) {
@@ -68,6 +128,8 @@ export class SQLiteStore {
             ...(r.options ? { options: JSON.parse(String(r.options)) } : {}),
             ...(r.created_at ? { createdAt: Number(r.created_at) } : {}),
             ...(r.updated_at ? { updatedAt: Number(r.updated_at) } : {}),
+            ...(r.pinned ? { pinned: true } : {}),
+            ...(r.archived_at ? { archivedAt: Number(r.archived_at) } : {}),
         };
     }
     get(id) {
@@ -147,6 +209,10 @@ export class SQLiteStore {
         this.db
             .prepare("INSERT INTO messages(session,body) VALUES(?,?)")
             .run(id, JSON.stringify(message));
+        this.touch(id);
+    }
+    touch(id) {
+        this.db.prepare("UPDATE sessions SET updated_at=? WHERE id=?").run(Date.now(), id);
     }
     setModel(id, model) {
         if (!model.trim())
@@ -201,15 +267,30 @@ export class SQLiteStore {
             .prepare("UPDATE sessions SET locked_pid=NULL WHERE id=? AND locked_pid=?")
             .run(id, process.pid);
     }
-    beginCall(id, call) {
+    beginCall(id, call, meta = {}) {
         this.db
-            .prepare("INSERT INTO tool_calls(session,call_id,status) VALUES(?,?,'pending')")
-            .run(id, call.id);
+            .prepare("INSERT INTO tool_calls(session,call_id,status,run_id,name,effect,started_at) VALUES(?,?,'pending',?,?,?,?)")
+            .run(id, call.id, meta.runId ?? null, call.name, meta.effect ?? null, Date.now());
     }
     endCall(id, call, result) {
         this.db
-            .prepare("INSERT INTO tool_calls(session,call_id,status,result) VALUES(?,?,'completed',?) ON CONFLICT(session,call_id) DO UPDATE SET status='completed',result=excluded.result")
-            .run(id, call.id, JSON.stringify(result));
+            .prepare("INSERT INTO tool_calls(session,call_id,status,result,name,ended_at) VALUES(?,?,'completed',?,?,?) ON CONFLICT(session,call_id) DO UPDATE SET status='completed',result=excluded.result,ended_at=excluded.ended_at,name=COALESCE(tool_calls.name,excluded.name)")
+            .run(id, call.id, JSON.stringify(result), call.name, Date.now());
+    }
+    /**
+     * Calls of a session with one effect (for example `write`), oldest first. Needs the v4
+     * `effect`/`run_id`/`started_at` columns; rows written by older versions have no effect.
+     */
+    effectCalls(session, effect) {
+        const rows = this.db
+            .prepare("SELECT call_id,name,run_id,started_at FROM tool_calls WHERE session=? AND effect=? ORDER BY started_at, rowid")
+            .all(session, effect);
+        return rows.map((row) => ({
+            callId: row.call_id,
+            name: row.name ?? "",
+            ...(row.run_id ? { runId: row.run_id } : {}),
+            ...(row.started_at != null ? { startedAt: Number(row.started_at) } : {}),
+        }));
     }
     /** Rich (ui/image) parts persist as part of the serialized result and replay verbatim. */
     callResult(id, callId) {
@@ -244,10 +325,210 @@ export class SQLiteStore {
             }
         });
     }
-    event(id, runId, type, data) {
-        this.db
-            .prepare("INSERT INTO events(session,run_id,type,body) VALUES(?,?,?,?)")
-            .run(id, runId, type, JSON.stringify(data));
+    /** Persists a durable event and returns its global `events.seq`. */
+    event(id, runId, type, data, meta = {}) {
+        const { lastInsertRowid } = this.db
+            .prepare("INSERT INTO events(session,run_id,type,body,created_at,correlation_id) VALUES(?,?,?,?,?,?)")
+            .run(id, runId, type, JSON.stringify(data), Date.now(), meta.correlationId ?? null);
+        return Number(lastInsertRowid);
+    }
+    runRow(r) {
+        return {
+            id: String(r.id),
+            session: String(r.session),
+            status: r.status,
+            ...(r.request_id != null ? { requestId: String(r.request_id) } : {}),
+            ...(r.correlation_id != null ? { correlationId: String(r.correlation_id) } : {}),
+            ...(r.owner_pid != null ? { ownerPid: Number(r.owner_pid) } : {}),
+            ...(r.model != null ? { model: String(r.model) } : {}),
+            createdAt: Number(r.created_at),
+            ...(r.started_at != null ? { startedAt: Number(r.started_at) } : {}),
+            ...(r.ended_at != null ? { endedAt: Number(r.ended_at) } : {}),
+            ...(r.error != null ? { error: String(r.error) } : {}),
+            ...(r.usage != null ? { usage: JSON.parse(String(r.usage)) } : {}),
+        };
+    }
+    runById(id) {
+        const row = this.db.prepare("SELECT * FROM runs WHERE id=?").get(id);
+        return row ? this.runRow(row) : undefined;
+    }
+    beginRun(input) {
+        return this.db.transaction(() => {
+            const status = input.status ?? "running";
+            const now = Date.now();
+            const existing = this.runById(input.id);
+            if (existing) {
+                if (existing.status === "queued" && status === "running")
+                    this.db
+                        .prepare("UPDATE runs SET status='running', started_at=?, owner_pid=?, model=COALESCE(?,model) WHERE id=?")
+                        .run(now, process.pid, input.model ?? null, input.id);
+                return { run: this.runById(input.id), created: false };
+            }
+            if (input.requestId !== undefined) {
+                const retried = this.runByRequest(input.session, input.requestId);
+                if (retried)
+                    return { run: retried, created: false };
+            }
+            this.db
+                .prepare(`INSERT INTO runs(id,session,status,request_id,correlation_id,owner_pid,model,created_at,started_at)
+           VALUES(?,?,?,?,?,?,?,?,?)`)
+                .run(input.id, input.session, status, input.requestId ?? null, input.correlationId ?? null, process.pid, input.model ?? null, now, status === "running" ? now : null);
+            return { run: this.runById(input.id), created: true };
+        });
+    }
+    endRun(id, input) {
+        const now = Date.now();
+        this.db.transaction(() => {
+            this.db
+                .prepare(`UPDATE runs SET status=?, ended_at=?, error=?, usage=COALESCE(?,usage)
+           WHERE id=? AND status NOT IN ${TERMINAL_RUN}`)
+                .run(input.status, now, input.error ?? null, input.usage ? JSON.stringify(input.usage) : null, id);
+            const run = this.runById(id);
+            if (run)
+                this.touch(run.session);
+        });
+    }
+    runByRequest(session, requestId) {
+        const row = this.db
+            .prepare("SELECT * FROM runs WHERE session=? AND request_id=?")
+            .get(session, requestId);
+        return row ? this.runRow(row) : undefined;
+    }
+    runs(session, options = {}) {
+        return this.db
+            .prepare("SELECT * FROM runs WHERE session=? ORDER BY created_at DESC, rowid DESC LIMIT ?")
+            .all(session, options.limit ?? 100)
+            .map((r) => this.runRow(r));
+    }
+    interruptRuns() {
+        const rows = this.db
+            .prepare("SELECT id, owner_pid FROM runs WHERE status IN ('queued','running')")
+            .all();
+        let count = 0;
+        for (const row of rows) {
+            // Runs of this process (another Application in it) or of another live process stay.
+            if (row.owner_pid && (row.owner_pid === process.pid || alive(row.owner_pid)))
+                continue;
+            this.endRun(row.id, { status: "interrupted" });
+            count++;
+        }
+        return count;
+    }
+    /**
+     * A page of messages by `seq`. With `after`, the first `limit` rows after it; otherwise the
+     * newest `limit` rows (before `before` when given). Items are always in ascending order.
+     */
+    messagesPage(session, options = {}) {
+        const limit = Math.max(1, Math.min(options.limit ?? 100, 1000));
+        const active = options.compacted ? "" : " AND compacted=0";
+        const rows = (options.after !== undefined
+            ? this.db
+                .prepare(`SELECT seq,body,compacted FROM messages WHERE session=? AND seq>?${active} ORDER BY seq LIMIT ?`)
+                .all(session, options.after, limit + 1)
+            : this.db
+                .prepare(`SELECT seq,body,compacted FROM messages WHERE session=? AND seq<?${active} ORDER BY seq DESC LIMIT ?`)
+                .all(session, options.before ?? Number.MAX_SAFE_INTEGER, limit + 1));
+        const hasMore = rows.length > limit;
+        const page = rows.slice(0, limit);
+        if (options.after === undefined)
+            page.reverse();
+        return {
+            items: page.map((r) => ({
+                seq: Number(r.seq),
+                message: JSON.parse(r.body),
+                compacted: !!r.compacted,
+            })),
+            hasMore,
+        };
+    }
+    /** Durable events of a session after `after` (a previous `eventId`), ascending. */
+    eventsPage(session, options = {}) {
+        const limit = Math.max(1, Math.min(options.limit ?? 500, 5000));
+        const rows = this.db
+            .prepare("SELECT seq,run_id,type,body,created_at,correlation_id FROM events WHERE session=? AND seq>? AND seq<? ORDER BY seq LIMIT ?")
+            .all(session, options.after ?? 0, options.before ?? Number.MAX_SAFE_INTEGER, limit + 1);
+        return {
+            items: rows.slice(0, limit).map((r) => ({
+                eventId: String(r.seq),
+                runId: String(r.run_id),
+                type: String(r.type),
+                data: r.body == null ? undefined : JSON.parse(String(r.body)),
+                ...(r.created_at != null ? { createdAt: Number(r.created_at) } : {}),
+                ...(r.correlation_id != null ? { correlationId: String(r.correlation_id) } : {}),
+            })),
+            hasMore: rows.length > limit,
+        };
+    }
+    /**
+     * Known workspaces for web clients: the workspaces of root sessions plus the ones recorded with
+     * `recordWorkspace` (v4 `workspaces` table), with their UI metadata and root-session count.
+     */
+    workspaces() {
+        const rows = this.db
+            .prepare(`SELECT p.path, w.label, COALESCE(w.pinned, 0) AS pinned, w.last_opened_at,
+           (SELECT count(*) FROM sessions s WHERE s.workspace=p.path AND s.parent_id IS NULL) AS sessions
+         FROM (SELECT workspace AS path FROM sessions WHERE parent_id IS NULL AND workspace IS NOT NULL
+               UNION SELECT path FROM workspaces) p
+         LEFT JOIN workspaces w ON w.path=p.path
+         ORDER BY p.path`)
+            .all();
+        return rows.map((r) => ({
+            path: String(r.path),
+            ...(r.label != null ? { label: String(r.label) } : {}),
+            pinned: !!r.pinned,
+            ...(r.last_opened_at != null ? { lastOpenedAt: Number(r.last_opened_at) } : {}),
+            sessions: Number(r.sessions ?? 0),
+        }));
+    }
+    /** Records a workspace and patches its UI metadata (`label: null` clears the label). */
+    recordWorkspace(path, patch = {}) {
+        this.db.transaction(() => {
+            this.db.prepare("INSERT OR IGNORE INTO workspaces(path) VALUES(?)").run(path);
+            if (patch.label !== undefined)
+                this.db.prepare("UPDATE workspaces SET label=? WHERE path=?").run(patch.label, path);
+            if (patch.pinned !== undefined)
+                this.db
+                    .prepare("UPDATE workspaces SET pinned=? WHERE path=?")
+                    .run(patch.pinned ? 1 : 0, path);
+            if (patch.lastOpenedAt !== undefined)
+                this.db
+                    .prepare("UPDATE workspaces SET last_opened_at=? WHERE path=?")
+                    .run(patch.lastOpenedAt, path);
+        });
+    }
+    /**
+     * Patches web-facing session metadata: title, pin, archive flag and `options` (shallow-merged
+     * into the stored options object). Does not touch the run-relevant columns.
+     */
+    updateSessionMeta(id, patch) {
+        this.db.transaction(() => {
+            const current = this.get(id);
+            if (patch.title !== undefined)
+                this.db.prepare("UPDATE sessions SET title=? WHERE id=?").run(patch.title, id);
+            if (patch.pinned !== undefined)
+                this.db.prepare("UPDATE sessions SET pinned=? WHERE id=?").run(patch.pinned ? 1 : 0, id);
+            if (patch.archived !== undefined)
+                this.db
+                    .prepare("UPDATE sessions SET archived_at=? WHERE id=?")
+                    .run(patch.archived ? Date.now() : null, id);
+            if (patch.options)
+                this.db
+                    .prepare("UPDATE sessions SET options=? WHERE id=?")
+                    .run(JSON.stringify({ ...(current.options ?? {}), ...patch.options }), id);
+        });
+    }
+    /** `MAX(events.seq)` of a session (0 without events): the web snapshot cursor. */
+    lastEventId(session) {
+        const row = this.db
+            .prepare("SELECT MAX(seq) AS seq FROM events WHERE session=?")
+            .get(session);
+        return Number(row?.seq ?? 0);
+    }
+    /** The pid of another live process holding the session lock, if any. */
+    lockedBy(id) {
+        const row = this.db.prepare("SELECT locked_pid FROM sessions WHERE id=?").get(id);
+        const pid = row?.locked_pid;
+        return pid && pid !== process.pid && alive(pid) ? pid : undefined;
     }
     getState(plugin, key) {
         const row = this.db

package/dist/tools/execute.d.ts

@@ -10,6 +10,11 @@ export interface ExecuteDeps {
     emit: (data: unknown) => void;
     session?: string;
     label?: string;
+    /**
+     * Non-interactive path resolver for nested calls: the snippet can only use directories this
+     * session already has; it never triggers a new external-directory approval prompt.
+     */
+    resolvePath?: (path: string) => Promise<string>;
     /** Overrides `EXECUTE_TIMEOUT_MS`, mainly for tests. */
     timeoutMs?: number;
 }

package/dist/tools/execute.js

@@ -53,6 +53,7 @@ export async function runExecute(code, deps) {
             emit: deps.emit,
             ...(deps.session ? { session: deps.session } : {}),
             ...(deps.label ? { label: deps.label } : {}),
+            ...(deps.resolvePath ? { resolvePath: deps.resolvePath } : {}),
         });
         const text = result.content
             .filter((p) => p.type === "text")

package/dist/tools/standard.d.ts

@@ -3,6 +3,7 @@ import type { Policy } from "../core/contracts.ts";
 import type { ToolRegistry } from "../core/registry.ts";
 import type { ProjectContext } from "../resources/context.ts";
 import type { Skills } from "../resources/skills.ts";
+import type { PathAccess } from "../runtime/access.ts";
 import { type WebsearchConfig } from "./search.ts";
 export declare const objectSchema: (properties: Record<string, unknown>, required?: string[]) => JsonSchema;
 export declare const hash: (text: string) => string;
@@ -19,4 +20,6 @@ execCtx?: {
         provider: SearchProvider;
         plugin: string;
     } | undefined;
-}): void;
+}, 
+/** Mediated path policy (workspace plus declared extra directories and external approval). */
+pathAccess?: PathAccess): void;

package/dist/tools/standard.js

@@ -1,10 +1,11 @@
 import { createHash } from "node:crypto";
 import { mkdir, rename, rm, stat, writeFile } from "node:fs/promises";
-import { dirname, relative } from "node:path";
+import { dirname, extname, relative } from "node:path";
 import { textResult, } from "@alisio/sdk";
+import { clipLines, unifiedPatch } from "../runtime/diff.js";
 import { fileSize, readHead, readText } from "../runtime/fs.js";
 import { safePath } from "../runtime/paths.js";
-import { isMissingCommand, RIPGREP_INSTALL_HINT, runProcess } from "../runtime/process.js";
+import { isMissingCommand, RIPGREP_INSTALL_HINT, runProcess, } from "../runtime/process.js";
 import { EXECUTE_TIMEOUT_MS, MAX_NESTED_CALLS, runExecute } from "./execute.js";
 import { searchWithFallback } from "./search.js";
 import { DEFAULT_TIMEOUT_SECONDS, MAX_RESPONSE_BYTES, MAX_TIMEOUT_SECONDS, webfetch, } from "./webfetch.js";
@@ -30,8 +31,8 @@ async function existing(path) {
         throw new Error("Editable files are limited to 1 MiB");
     return readText(path);
 }
-async function atomicWrite(root, path, content, expected) {
-    path = await safePath(root, path);
+async function atomicWrite(resolve, path, content, expected) {
+    path = await resolve(path);
     await mkdir(dirname(path), { recursive: true });
     const before = await existing(path);
     if (before === undefined ? expected !== null : hash(before) !== expected)
@@ -40,7 +41,7 @@ async function atomicWrite(root, path, content, expected) {
     try {
         const mode = before === undefined ? 0o644 : (await stat(path)).mode & 0o777;
         await writeFile(temporary, content, { mode });
-        await safePath(root, path);
+        await resolve(path);
         const now = await existing(path);
         if (now !== before)
             throw new Error("File changed while preparing write");
@@ -49,11 +50,71 @@ async function atomicWrite(root, path, content, expected) {
     finally {
         await rm(temporary, { force: true });
     }
+    return before;
+}
+/** Producer-side bounds of the web-only ui parts (spec §8.6). */
+const DIFF_LIMIT = 200 * 1024;
+const TERMINAL_LIMIT = 256 * 1024;
+/**
+ * Appends a display-only ui part after the tool's text (which stays the first part and is all
+ * that providers and headless output see, via `textProjection`).
+ */
+const withUi = (result, block) => block ? { ...result, content: [...result.content, { type: "ui", block }] } : result;
+/** A `diff` block of a file write, bounded to 200 KB at a line boundary. */
+function diffBlock(path, before, after) {
+    const patch = unifiedPatch(path, before, after);
+    if (!patch)
+        return undefined;
+    const { text, clipped } = clipLines(patch, DIFF_LIMIT);
+    const lang = extname(path).slice(1).toLowerCase();
+    return {
+        kind: "diff",
+        path,
+        patch: text,
+        ...(lang ? { lang } : {}),
+        ...(clipped ? { caption: `${path} (diff truncated to 200 KB)` } : {}),
+    };
+}
+/** A `terminal` block of a finished process: stdout then stderr, keeping the last 256 KB. */
+function terminalBlock(command, result, durationMs) {
+    const separator = result.stdout && result.stderr && !result.stdout.endsWith("\n") ? "\n" : "";
+    let output = `${result.stdout}${separator}${result.stderr}`;
+    const bytes = Buffer.byteLength(output);
+    const clipped = bytes > TERMINAL_LIMIT;
+    if (clipped)
+        output = Buffer.from(output)
+            .subarray(bytes - TERMINAL_LIMIT)
+            .toString("utf8")
+            .replace(/^\uFFFD+/, "");
+    return {
+        kind: "terminal",
+        command,
+        output,
+        exitCode: result.exitCode,
+        durationMs,
+        ...(result.truncated || clipped ? { truncated: true } : {}),
+    };
 }
 export function registerStandard(registry, workspace, skills, context, ui, 
 /** Live policy accessor for `execute`'s nested tool calls (bound once the runner exists). */
-execCtx, websearchCtx) {
+execCtx, websearchCtx, 
+/** Mediated path policy (workspace plus declared extra directories and external approval). */
+pathAccess) {
     const register = (tool) => registry.register(tool);
+    /**
+     * Resolves one tool path through the host-injected policy when present, then the captured
+     * `PathAccess`, and finally the workspace-only `safePath` (standalone fixtures/embedders).
+     */
+    const resolvePath = (context, path) => context.resolvePath
+        ? context.resolvePath(path)
+        : pathAccess
+            ? pathAccess.resolve(path, {
+                workspace: context.workspace,
+                ...(context.session ? { session: context.session } : {}),
+                ...(context.label ? { label: context.label } : {}),
+                signal: context.signal,
+            })
+            : safePath(context.workspace, path);
     const filePaths = (input) => typeof input.path === "string" ? [input.path] : [];
     register({
         name: "read_file",
@@ -66,7 +127,7 @@ execCtx, websearchCtx) {
         }, ["path"]),
         paths: filePaths,
         async execute(i, c) {
-            const path = await safePath(c.workspace, String(i.path));
+            const path = await resolvePath(c, String(i.path));
             const size = await fileSize(path);
             if (size === undefined)
                 throw new Error(`File not found: ${String(i.path)}`);
@@ -97,8 +158,8 @@ execCtx, websearchCtx) {
             const content = String(i.content);
             if (Buffer.byteLength(content) > 1_048_576)
                 throw new Error("Write exceeds 1 MiB");
-            await atomicWrite(c.workspace, String(i.path), content, i.expectedHash);
-            return textResult(JSON.stringify({ path: i.path, sha256: hash(content) }));
+            const before = await atomicWrite((path) => resolvePath(c, path), String(i.path), content, i.expectedHash);
+            return withUi(textResult(JSON.stringify({ path: i.path, sha256: hash(content) })), diffBlock(String(i.path), before, content));
         },
     });
     register({
@@ -108,15 +169,15 @@ execCtx, websearchCtx) {
         inputSchema: objectSchema({ path: str, oldText: { type: "string", minLength: 1 }, newText: str, expectedHash: str }, ["path", "oldText", "newText", "expectedHash"]),
         paths: filePaths,
         async execute(i, c) {
-            const path = await safePath(c.workspace, String(i.path)), before = await existing(path);
+            const path = await resolvePath(c, String(i.path)), before = await existing(path);
             if (before === undefined)
                 throw new Error("File not found");
             const needle = String(i.oldText), index = before.indexOf(needle);
             if (index < 0 || before.indexOf(needle, index + 1) >= 0)
                 throw new Error("Edit must match exactly one occurrence");
             const after = before.slice(0, index) + String(i.newText) + before.slice(index + needle.length);
-            await atomicWrite(c.workspace, path, after, String(i.expectedHash));
-            return textResult(JSON.stringify({ path: i.path, sha256: hash(after) }));
+            await atomicWrite((p) => resolvePath(c, p), path, after, String(i.expectedHash));
+            return withUi(textResult(JSON.stringify({ path: i.path, sha256: hash(after) })), diffBlock(String(i.path), before, after));
         },
     });
     register({
@@ -130,7 +191,7 @@ execCtx, websearchCtx) {
         }),
         paths: filePaths,
         async execute(i, c) {
-            const path = await safePath(c.workspace, String(i.path ?? "."));
+            const path = await resolvePath(c, String(i.path ?? "."));
             const result = await runRipgrep(["--files", "--glob", "!.git", "--glob", "!node_modules", "--", path], { cwd: c.workspace, signal: c.signal, maxBytes: 200_000 });
             if (result.exitCode > 1 && !result.truncated)
                 throw new Error(result.stderr);
@@ -156,7 +217,7 @@ execCtx, websearchCtx) {
         ]),
         paths: filePaths,
         async execute(i, c) {
-            const path = await safePath(c.workspace, String(i.path ?? "."));
+            const path = await resolvePath(c, String(i.path ?? "."));
             const r = await runRipgrep([
                 "--json",
                 "--max-count",
@@ -185,12 +246,15 @@ execCtx, websearchCtx) {
             timeoutMs: { type: "integer", minimum: 1, maximum: 120000 },
         }, ["command", "args"]),
         async execute(i, c) {
-            return textResult(JSON.stringify(await runProcess(String(i.command), i.args, {
+            const started = Date.now();
+            const result = await runProcess(String(i.command), i.args, {
                 cwd: c.workspace,
                 signal: c.signal,
                 timeoutMs: Number(i.timeoutMs ?? 30000),
                 onData: c.emit,
-            })));
+            });
+            const command = [String(i.command), ...i.args].join(" ");
+            return withUi(textResult(JSON.stringify(result)), terminalBlock(command, result, Date.now() - started));
         },
     });
     register({
@@ -199,9 +263,11 @@ execCtx, websearchCtx) {
         description: "Run an arbitrary shell command. Explicit process capability required; not sandboxed.",
         inputSchema: objectSchema({ command: str }, ["command"]),
         async execute(i, c) {
-            return textResult(JSON.stringify(await runProcess(process.platform === "win32" ? "cmd.exe" : "/bin/sh", process.platform === "win32"
+            const started = Date.now();
+            const result = await runProcess(process.platform === "win32" ? "cmd.exe" : "/bin/sh", process.platform === "win32"
                 ? ["/d", "/s", "/c", String(i.command)]
-                : ["-c", String(i.command)], { cwd: c.workspace, signal: c.signal, onData: c.emit })));
+                : ["-c", String(i.command)], { cwd: c.workspace, signal: c.signal, onData: c.emit });
+            return withUi(textResult(JSON.stringify(result)), terminalBlock(String(i.command), result, Date.now() - started));
         },
     });
     for (const [name, args] of [
@@ -412,6 +478,21 @@ execCtx, websearchCtx) {
                 emit: c.emit,
                 ...(c.session ? { session: c.session } : {}),
                 ...(c.label ? { label: c.label } : {}),
+                // Nested calls must never open a new external-directory prompt; only directories already
+                // approved for this session (or inside the workspace) are reachable.
+                ...(pathAccess
+                    ? {
+                        resolvePath: (path) => pathAccess.resolve(path, {
+                            workspace: c.workspace,
+                            ...(c.session ? { session: c.session } : {}),
+                            ...(c.label ? { label: c.label } : {}),
+                            signal: c.signal,
+                            interactive: false,
+                        }),
+                    }
+                    : c.resolvePath
+                        ? { resolvePath: c.resolvePath }
+                        : {}),
             });
             return textResult(JSON.stringify({ result: result ?? null }));
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alisio/core",
-  "version": "0.1.0-alpha.16",
+  "version": "0.1.0-alpha.18",
   "description": "Embeddable provider-agnostic Alisio agent core: tool loop, context compaction, local tools, MCP, plugin host and SQLite session store. Runs on Node >=22.16 and Bun.",
   "author": "Gustavo Gutiérrez",
   "license": "MIT",
@@ -41,7 +41,7 @@
     "node": ">=22.16"
   },
   "dependencies": {
-    "@alisio/sdk": "0.1.0-alpha.11",
+    "@alisio/sdk": "0.1.0-alpha.15",
     "@mixmark-io/domino": "2.2.0",
     "@modelcontextprotocol/client": "2.1.0",
     "ajv": "8.20.0",