@alisio/core 0.1.0-alpha.9 → 0.1.0

package/dist/tools/goal.js

@@ -0,0 +1,126 @@
+/**
+ * `get_goal` and `update_goal`: the model's two handles on the session goal. Both are OPT-IN
+ * tools (`core/opt-in.ts`): a run only sees them while its session has an `active` goal and the
+ * agent is not the plan agent, so their descriptions cost no tokens anywhere else. The model can
+ * only report the goal `complete` or `blocked`, with evidence; pausing, resuming, editing,
+ * clearing and the budget belong to the user and have no tool.
+ *
+ * `effect: "internal"`: reporting changes Alisio's own bookkeeping, never the workspace.
+ */
+import { textResult } from "@alisio/sdk";
+import { formatTokenCount } from "../goal/budget.js";
+import { objectSchema } from "./standard.js";
+export const GET_GOAL_TOOL = "get_goal";
+export const UPDATE_GOAL_TOOL = "update_goal";
+const KINDS = ["file", "test", "log", "command", "denied", "other"];
+const MAX_EVIDENCE = 20;
+const MAX_DETAIL = 1000;
+const MAX_SUMMARY = 2000;
+/** The model-facing state (no internals, nothing the model could use to widen anything). */
+function brief(goal) {
+    return {
+        status: goal.status,
+        ...(goal.reason ? { reason: goal.reason } : {}),
+        objective: goal.objective,
+        tokens_used: goal.tokensUsed,
+        ...(goal.tokenBudget !== undefined
+            ? {
+                token_budget: goal.tokenBudget,
+                tokens_left: Math.max(0, goal.tokenBudget - goal.tokensUsed),
+            }
+            : { token_budget: null }),
+        turns_used: goal.turnsUsed,
+        max_turns: goal.maxTurns,
+        minutes_used: Math.round(goal.activeMs / 60_000),
+        max_minutes: Math.round(goal.maxWallMs / 60_000),
+    };
+}
+/** Parses the evidence list defensively (the schema is advisory for some providers). */
+export function parseEvidence(raw) {
+    if (!Array.isArray(raw) || !raw.length)
+        return "evidence must list at least one item.";
+    if (raw.length > MAX_EVIDENCE)
+        return `evidence has more than ${MAX_EVIDENCE} items.`;
+    const items = [];
+    for (const entry of raw) {
+        const item = entry;
+        const detail = typeof item?.detail === "string" ? item.detail.trim() : "";
+        if (!detail)
+            return "every evidence item needs a detail (a path, a test name, a log line).";
+        const kind = KINDS.find((candidate) => candidate === item.kind) ?? "other";
+        items.push({ kind, detail: detail.slice(0, MAX_DETAIL) });
+    }
+    return items;
+}
+export function registerGoalTools(registry, deps) {
+    const { goals } = deps;
+    const sessionOf = (session) => {
+        if (!session)
+            throw new Error("The goal tools need a session.");
+        return session;
+    };
+    registry.register({
+        name: GET_GOAL_TOOL,
+        effect: "internal",
+        description: "Read the session goal: objective, status and what is left of its budget and caps.",
+        inputSchema: objectSchema({}),
+        async execute(_input, context) {
+            const goal = goals.get(sessionOf(context.session));
+            if (!goal)
+                return textResult(JSON.stringify({ status: "none" }));
+            return textResult(JSON.stringify(brief(goal)));
+        },
+    });
+    registry.register({
+        name: UPDATE_GOAL_TOOL,
+        effect: "internal",
+        description: "Report the session goal complete or blocked. Needs evidence (files, tests, logs, commands). " +
+            "Use complete only when the objective is fully met and verified. A blocker must be reported " +
+            "again next turn before the goal stops, unless it is a permission denial (evidence kind denied). " +
+            "You cannot pause, resume, edit or clear the goal or change its budget.",
+        inputSchema: objectSchema({
+            status: { enum: ["complete", "blocked"] },
+            summary: { type: "string", minLength: 1, maxLength: MAX_SUMMARY },
+            evidence: {
+                type: "array",
+                minItems: 1,
+                maxItems: MAX_EVIDENCE,
+                items: objectSchema({ kind: { enum: [...KINDS] }, detail: { type: "string", maxLength: MAX_DETAIL } }, ["kind", "detail"]),
+            },
+        }, ["status", "summary", "evidence"]),
+        async execute(input, context) {
+            const sessionId = sessionOf(context.session);
+            const status = input.status === "complete" || input.status === "blocked" ? input.status : undefined;
+            if (!status)
+                return textResult(JSON.stringify({ ok: false, error: "status must be complete or blocked." }));
+            const summary = typeof input.summary === "string" ? input.summary.trim().slice(0, MAX_SUMMARY) : "";
+            if (!summary)
+                return textResult(JSON.stringify({ ok: false, error: "summary is required." }));
+            const evidence = parseEvidence(input.evidence);
+            if (typeof evidence === "string")
+                return textResult(JSON.stringify({ ok: false, error: evidence }));
+            const result = goals.report(sessionId, context.runId, { status, summary, evidence });
+            if (!result.ok)
+                return textResult(JSON.stringify({ ok: false, error: result.message }));
+            if (status === "complete")
+                return textResult(JSON.stringify({
+                    ok: true,
+                    status: "complete",
+                    note: "The goal is complete. Give the user a short final summary.",
+                }));
+            return textResult(JSON.stringify(result.stopped
+                ? {
+                    ok: true,
+                    status: "blocked",
+                    note: "The goal is blocked and will not continue until the user resumes it. Tell the user what you need.",
+                }
+                : {
+                    ok: true,
+                    status: "active",
+                    note: `Blocker recorded. If it still stands next turn, report it again with fresh evidence (${result.needed ?? 2} consecutive turns in total); otherwise keep working. Budget left: ${result.goal.tokenBudget !== undefined
+                        ? formatTokenCount(Math.max(0, result.goal.tokenBudget - result.goal.tokensUsed))
+                        : "no token budget"}.`,
+                }));
+        },
+    });
+}

package/dist/tools/search.d.ts

@@ -8,8 +8,8 @@
  *      A throwing plugin provider falls back to the built-in chain with a diagnostic, never a hard
  *      failure of the tool call.
  *   2. `websearch.provider` from config, when set: `"searxng"` (with a custom `searxngUrl`),
- *      `"duckduckgo-instant"`, `"tavily"`, `"brave"` or `"serpapi"` (the last three need an API key
- *      env var).
+ *      `"duckduckgo-instant"`, `"duckduckgo-html"`, `"tavily"`, `"brave"` or `"serpapi"` (the last
+ *      three need an API key env var).
  *   3. Nothing configured: a public SearXNG instance (see `DEFAULT_SEARXNG_URL`) — genuinely free
  *      and keyless, but empirically unreliable: while building this tool, nearly every public
  *      instance tried (searx.be and several others from https://searx.space) rate-limited or
@@ -23,7 +23,7 @@
  */
 import type { SearchProvider, SearchResult } from "@alisio/sdk";
 export interface WebsearchConfig {
-    provider?: "searxng" | "duckduckgo-instant" | "tavily" | "brave" | "serpapi" | "native";
+    provider?: "searxng" | "duckduckgo-instant" | "duckduckgo-html" | "tavily" | "brave" | "serpapi" | "native";
     /** Overrides the default public instance; self-hosted or another public instance. */
     searxngUrl?: string;
     /** Environment variable holding the API key for `tavily`, `brave` or `serpapi`. */
@@ -50,6 +50,20 @@ export declare function searxngProvider(baseUrl: string): SearchProvider;
  * search engine. Callers must not treat an empty result as "nothing found on the web".
  */
 export declare function duckDuckGoInstantProvider(): SearchProvider;
+/**
+ * Parses DuckDuckGo lite HTML into `SearchResult`s (exported so tests can exercise it without the
+ * network). Ignores every anchor that is not a `result-link` whose href starts with
+ * `//duckduckgo.com/l/?uddg=` — ads and related-search links never count. Snippets are taken from
+ * the `result-snippet` cell that follows each result and precedes the next one. Returns [] for a
+ * lite page that legitimately has no results.
+ */
+export declare function parseDuckDuckGoLiteHtml(html: string): SearchResult[];
+/**
+ * DuckDuckGo's keyless HTML "lite" endpoint: a real general web search (unlike the Instant Answer
+ * API), scraped without an API key or cookie machinery. Works when the default public SearXNG
+ * instance is bot-blocked. See `parseDuckDuckGoLiteHtml` for the HTML parsing contract.
+ */
+export declare function duckDuckGoHtmlProvider(): SearchProvider;
 export declare function tavilyProvider(apiKey: string): SearchProvider;
 export declare function braveProvider(apiKey: string): SearchProvider;
 export declare function serpApiProvider(apiKey: string): SearchProvider;

package/dist/tools/search.js

@@ -116,6 +116,150 @@ export function duckDuckGoInstantProvider() {
         },
     };
 }
+// --- DuckDuckGo lite (HTML) ---
+// The keyless `lite.duckduckgo.com/lite/` page answers a plain GET with real, general web-search
+// results (unlike the Instant Answer API). It is a scrape of HTML that DuckDuckGo may change at any
+// time, so the parser below is deliberately tolerant: only `result-link` anchors whose href goes
+// through the `//duckduckgo.com/l/?uddg=` redirector are trusted as results; ads/related links and
+// the surrounding table/div markup are ignored. Verified live (2026-09): the full
+// `html.duckduckgo.com/html/` endpoint returns HTTP 202 with a captcha challenge for automated
+// requests, while `lite.duckduckgo.com/lite/` answers HTTP 200 with results and no key.
+const DUCKDUCKGO_LITE_UA = "Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0";
+const DUCKDUCKGO_LITE_URL = "https://lite.duckduckgo.com/lite/";
+/** Minimal local HTML-entity decoder (no dependency): the common named ones plus numeric forms. */
+function decodeHtmlEntities(text) {
+    return text.replace(/&(#x?[0-9a-fA-F]+|amp|lt|gt|quot|apos|nbsp);/g, (raw, entity) => {
+        const lower = entity.toLowerCase();
+        if (lower === "amp")
+            return "&";
+        if (lower === "lt")
+            return "<";
+        if (lower === "gt")
+            return ">";
+        if (lower === "quot")
+            return '"';
+        if (lower === "apos")
+            return "'";
+        if (lower === "nbsp")
+            return "\u00a0";
+        try {
+            const code = lower.startsWith("#x")
+                ? parseInt(lower.slice(2), 16)
+                : lower.startsWith("#")
+                    ? parseInt(lower.slice(1), 10)
+                    : NaN;
+            return Number.isFinite(code) && code >= 0 && code <= 0x10ffff
+                ? String.fromCodePoint(code)
+                : raw;
+        }
+        catch {
+            return raw;
+        }
+    });
+}
+/** Strips tags and collapses whitespace, keeping the text usable as a title or snippet. */
+function htmlToText(fragment) {
+    return decodeHtmlEntities(fragment.replace(/<[^>]*>/g, ""))
+        .replace(/\s+/g, " ")
+        .trim();
+}
+const RESULT_LINK = /<a\b[^>]*class=['"]result-link['"][^>]*>([\s\S]*?)<\/a>/gi;
+const HREF_ATTR = /href\s*=\s*"([^"]*)"/i;
+const SNIPPET_CELL = /class=['"]result-snippet['"]>([\s\S]*?)<\/td>/gi;
+const UDDG_PARAM = /uddg=([^&"]+)/i;
+/**
+ * Parses DuckDuckGo lite HTML into `SearchResult`s (exported so tests can exercise it without the
+ * network). Ignores every anchor that is not a `result-link` whose href starts with
+ * `//duckduckgo.com/l/?uddg=` — ads and related-search links never count. Snippets are taken from
+ * the `result-snippet` cell that follows each result and precedes the next one. Returns [] for a
+ * lite page that legitimately has no results.
+ */
+export function parseDuckDuckGoLiteHtml(html) {
+    const anchors = [...html.matchAll(RESULT_LINK)];
+    const snippets = [...html.matchAll(SNIPPET_CELL)];
+    const results = [];
+    for (let i = 0; i < anchors.length; i++) {
+        const anchor = anchors[i];
+        const tag = anchor[0];
+        const href = HREF_ATTR.exec(tag)?.[1] ?? "";
+        if (!href.startsWith("//duckduckgo.com/l/?uddg="))
+            continue;
+        const raw = UDDG_PARAM.exec(href)?.[1];
+        let url = "";
+        if (raw) {
+            try {
+                url = decodeURIComponent(raw);
+            }
+            catch {
+                url = "";
+            }
+        }
+        if (!url)
+            continue;
+        const title = htmlToText(anchor[1] ?? "");
+        if (!title)
+            continue;
+        let snippet = "";
+        const limit = anchors[i + 1] ? anchors[i + 1].index : html.length;
+        for (const cell of snippets) {
+            if (cell.index !== undefined && cell.index > (anchor.index ?? 0) && cell.index < limit) {
+                snippet = htmlToText(cell[1] ?? "");
+                break;
+            }
+        }
+        results.push({ title, url, snippet });
+    }
+    return results;
+}
+/**
+ * DuckDuckGo's keyless HTML "lite" endpoint: a real general web search (unlike the Instant Answer
+ * API), scraped without an API key or cookie machinery. Works when the default public SearXNG
+ * instance is bot-blocked. See `parseDuckDuckGoLiteHtml` for the HTML parsing contract.
+ */
+export function duckDuckGoHtmlProvider() {
+    return {
+        id: "duckduckgo-html",
+        async search(query, options) {
+            const url = new URL(DUCKDUCKGO_LITE_URL);
+            url.searchParams.set("q", query);
+            url.searchParams.set("kl", "us-en");
+            let res;
+            try {
+                res = await fetch(url, {
+                    headers: { "User-Agent": DUCKDUCKGO_LITE_UA, Accept: "text/html" },
+                    // Never follow a redirect blindly: on this endpoint a redirect is a bot-check detour,
+                    // not a moved page, and following it would just land on a captcha.
+                    redirect: "error",
+                    signal: options?.signal,
+                });
+            }
+            catch (error) {
+                throw new Error(`DuckDuckGo lite search request failed: ${error instanceof Error ? error.message : String(error)}. The provider is duckduckgo-html (${DUCKDUCKGO_LITE_URL}); possible causes: a network ` +
+                    "failure, a redirect (treated as a bot-check detour), or rate limiting. Try again later " +
+                    "or switch websearch.provider via /settings.");
+            }
+            if (res.status !== 200) {
+                throw new Error(`DuckDuckGo lite search failed: HTTP ${res.status}. The endpoint may be showing a ` +
+                    "bot-check/captcha challenge instead of results (the full html.duckduckgo.com endpoint " +
+                    "returns HTTP 202 for automated requests). Try again later, or switch websearch.provider " +
+                    "via /settings (e.g. searxng with your own instance).");
+            }
+            const html = await res.text();
+            if (html.length <= 200) {
+                throw new Error("DuckDuckGo lite search returned an unexpectedly empty response (no HTML to parse); the " +
+                    "endpoint may be bot-blocked. Try again later or switch websearch.provider via /settings.");
+            }
+            if (!html.includes("result-link") &&
+                !html.includes("result-snippet") &&
+                !/action=['"]\/lite\/['"]/.test(html)) {
+                throw new Error("DuckDuckGo lite did not return recognizable DuckDuckGo lite HTML results; it may be " +
+                    "showing a bot-check/captcha challenge instead. Try again later or switch " +
+                    "websearch.provider via /settings.");
+            }
+            return parseDuckDuckGoLiteHtml(html).slice(0, 10);
+        },
+    };
+}
 export function tavilyProvider(apiKey) {
     return {
         id: "tavily",
@@ -197,6 +341,15 @@ function resolveBuiltin(config) {
             limitation: "DuckDuckGo's Instant Answer API only answers direct factual/infobox-style queries, not " +
                 "general web search. An empty result here does not mean nothing exists on the web.",
         };
+    if (provider === "duckduckgo-html")
+        return {
+            provider: duckDuckGoHtmlProvider(),
+            source: "duckduckgo-html",
+            limitation: "DuckDuckGo lite HTML provider: keyless and free, but it scrapes HTML DuckDuckGo may " +
+                "change at any time, and heavy automation can be bot-checked. Use it as a keyless fallback " +
+                "when the default public SearXNG instance is bot-blocked; self-hosted SearXNG remains the " +
+                "most reliable option.",
+        };
     if (provider === "native")
         throw new Error('websearch.provider is "native": search runs server-side through the model provider; ' +
             "this tool should never be registered or called in that mode.");

package/dist/tools/standard.d.ts

@@ -3,6 +3,7 @@ import type { Policy } from "../core/contracts.ts";
 import type { ToolRegistry } from "../core/registry.ts";
 import type { ProjectContext } from "../resources/context.ts";
 import type { Skills } from "../resources/skills.ts";
+import type { PathAccess } from "../runtime/access.ts";
 import { type WebsearchConfig } from "./search.ts";
 export declare const objectSchema: (properties: Record<string, unknown>, required?: string[]) => JsonSchema;
 export declare const hash: (text: string) => string;
@@ -19,4 +20,6 @@ execCtx?: {
         provider: SearchProvider;
         plugin: string;
     } | undefined;
-}): void;
+}, 
+/** Mediated path policy (workspace plus declared extra directories and external approval). */
+pathAccess?: PathAccess): void;

package/dist/tools/standard.js

@@ -1,10 +1,11 @@
 import { createHash } from "node:crypto";
 import { mkdir, rename, rm, stat, writeFile } from "node:fs/promises";
-import { dirname, relative } from "node:path";
+import { dirname, extname, relative } from "node:path";
 import { textResult, } from "@alisio/sdk";
+import { clipLines, unifiedPatch } from "../runtime/diff.js";
 import { fileSize, readHead, readText } from "../runtime/fs.js";
 import { safePath } from "../runtime/paths.js";
-import { isMissingCommand, RIPGREP_INSTALL_HINT, runProcess } from "../runtime/process.js";
+import { isMissingCommand, RIPGREP_INSTALL_HINT, runProcess, } from "../runtime/process.js";
 import { EXECUTE_TIMEOUT_MS, MAX_NESTED_CALLS, runExecute } from "./execute.js";
 import { searchWithFallback } from "./search.js";
 import { DEFAULT_TIMEOUT_SECONDS, MAX_RESPONSE_BYTES, MAX_TIMEOUT_SECONDS, webfetch, } from "./webfetch.js";
@@ -30,8 +31,8 @@ async function existing(path) {
         throw new Error("Editable files are limited to 1 MiB");
     return readText(path);
 }
-async function atomicWrite(root, path, content, expected) {
-    path = await safePath(root, path);
+async function atomicWrite(resolve, path, content, expected) {
+    path = await resolve(path);
     await mkdir(dirname(path), { recursive: true });
     const before = await existing(path);
     if (before === undefined ? expected !== null : hash(before) !== expected)
@@ -40,7 +41,7 @@ async function atomicWrite(root, path, content, expected) {
     try {
         const mode = before === undefined ? 0o644 : (await stat(path)).mode & 0o777;
         await writeFile(temporary, content, { mode });
-        await safePath(root, path);
+        await resolve(path);
         const now = await existing(path);
         if (now !== before)
             throw new Error("File changed while preparing write");
@@ -49,11 +50,71 @@ async function atomicWrite(root, path, content, expected) {
     finally {
         await rm(temporary, { force: true });
     }
+    return before;
+}
+/** Producer-side bounds of the web-only ui parts (spec §8.6). */
+const DIFF_LIMIT = 200 * 1024;
+const TERMINAL_LIMIT = 256 * 1024;
+/**
+ * Appends a display-only ui part after the tool's text (which stays the first part and is all
+ * that providers and headless output see, via `textProjection`).
+ */
+const withUi = (result, block) => block ? { ...result, content: [...result.content, { type: "ui", block }] } : result;
+/** A `diff` block of a file write, bounded to 200 KB at a line boundary. */
+function diffBlock(path, before, after) {
+    const patch = unifiedPatch(path, before, after);
+    if (!patch)
+        return undefined;
+    const { text, clipped } = clipLines(patch, DIFF_LIMIT);
+    const lang = extname(path).slice(1).toLowerCase();
+    return {
+        kind: "diff",
+        path,
+        patch: text,
+        ...(lang ? { lang } : {}),
+        ...(clipped ? { caption: `${path} (diff truncated to 200 KB)` } : {}),
+    };
+}
+/** A `terminal` block of a finished process: stdout then stderr, keeping the last 256 KB. */
+function terminalBlock(command, result, durationMs) {
+    const separator = result.stdout && result.stderr && !result.stdout.endsWith("\n") ? "\n" : "";
+    let output = `${result.stdout}${separator}${result.stderr}`;
+    const bytes = Buffer.byteLength(output);
+    const clipped = bytes > TERMINAL_LIMIT;
+    if (clipped)
+        output = Buffer.from(output)
+            .subarray(bytes - TERMINAL_LIMIT)
+            .toString("utf8")
+            .replace(/^\uFFFD+/, "");
+    return {
+        kind: "terminal",
+        command,
+        output,
+        exitCode: result.exitCode,
+        durationMs,
+        ...(result.truncated || clipped ? { truncated: true } : {}),
+    };
 }
 export function registerStandard(registry, workspace, skills, context, ui, 
 /** Live policy accessor for `execute`'s nested tool calls (bound once the runner exists). */
-execCtx, websearchCtx) {
+execCtx, websearchCtx, 
+/** Mediated path policy (workspace plus declared extra directories and external approval). */
+pathAccess) {
     const register = (tool) => registry.register(tool);
+    /**
+     * Resolves one tool path through the host-injected policy when present, then the captured
+     * `PathAccess`, and finally the workspace-only `safePath` (standalone fixtures/embedders).
+     */
+    const resolvePath = (context, path) => context.resolvePath
+        ? context.resolvePath(path)
+        : pathAccess
+            ? pathAccess.resolve(path, {
+                workspace: context.workspace,
+                ...(context.session ? { session: context.session } : {}),
+                ...(context.label ? { label: context.label } : {}),
+                signal: context.signal,
+            })
+            : safePath(context.workspace, path);
     const filePaths = (input) => typeof input.path === "string" ? [input.path] : [];
     register({
         name: "read_file",
@@ -66,7 +127,7 @@ execCtx, websearchCtx) {
         }, ["path"]),
         paths: filePaths,
         async execute(i, c) {
-            const path = await safePath(c.workspace, String(i.path));
+            const path = await resolvePath(c, String(i.path));
             const size = await fileSize(path);
             if (size === undefined)
                 throw new Error(`File not found: ${String(i.path)}`);
@@ -97,8 +158,8 @@ execCtx, websearchCtx) {
             const content = String(i.content);
             if (Buffer.byteLength(content) > 1_048_576)
                 throw new Error("Write exceeds 1 MiB");
-            await atomicWrite(c.workspace, String(i.path), content, i.expectedHash);
-            return textResult(JSON.stringify({ path: i.path, sha256: hash(content) }));
+            const before = await atomicWrite((path) => resolvePath(c, path), String(i.path), content, i.expectedHash);
+            return withUi(textResult(JSON.stringify({ path: i.path, sha256: hash(content) })), diffBlock(String(i.path), before, content));
         },
     });
     register({
@@ -108,15 +169,15 @@ execCtx, websearchCtx) {
         inputSchema: objectSchema({ path: str, oldText: { type: "string", minLength: 1 }, newText: str, expectedHash: str }, ["path", "oldText", "newText", "expectedHash"]),
         paths: filePaths,
         async execute(i, c) {
-            const path = await safePath(c.workspace, String(i.path)), before = await existing(path);
+            const path = await resolvePath(c, String(i.path)), before = await existing(path);
             if (before === undefined)
                 throw new Error("File not found");
             const needle = String(i.oldText), index = before.indexOf(needle);
             if (index < 0 || before.indexOf(needle, index + 1) >= 0)
                 throw new Error("Edit must match exactly one occurrence");
             const after = before.slice(0, index) + String(i.newText) + before.slice(index + needle.length);
-            await atomicWrite(c.workspace, path, after, String(i.expectedHash));
-            return textResult(JSON.stringify({ path: i.path, sha256: hash(after) }));
+            await atomicWrite((p) => resolvePath(c, p), path, after, String(i.expectedHash));
+            return withUi(textResult(JSON.stringify({ path: i.path, sha256: hash(after) })), diffBlock(String(i.path), before, after));
         },
     });
     register({
@@ -130,7 +191,7 @@ execCtx, websearchCtx) {
         }),
         paths: filePaths,
         async execute(i, c) {
-            const path = await safePath(c.workspace, String(i.path ?? "."));
+            const path = await resolvePath(c, String(i.path ?? "."));
             const result = await runRipgrep(["--files", "--glob", "!.git", "--glob", "!node_modules", "--", path], { cwd: c.workspace, signal: c.signal, maxBytes: 200_000 });
             if (result.exitCode > 1 && !result.truncated)
                 throw new Error(result.stderr);
@@ -156,7 +217,7 @@ execCtx, websearchCtx) {
         ]),
         paths: filePaths,
         async execute(i, c) {
-            const path = await safePath(c.workspace, String(i.path ?? "."));
+            const path = await resolvePath(c, String(i.path ?? "."));
             const r = await runRipgrep([
                 "--json",
                 "--max-count",
@@ -185,12 +246,15 @@ execCtx, websearchCtx) {
             timeoutMs: { type: "integer", minimum: 1, maximum: 120000 },
         }, ["command", "args"]),
         async execute(i, c) {
-            return textResult(JSON.stringify(await runProcess(String(i.command), i.args, {
+            const started = Date.now();
+            const result = await runProcess(String(i.command), i.args, {
                 cwd: c.workspace,
                 signal: c.signal,
                 timeoutMs: Number(i.timeoutMs ?? 30000),
                 onData: c.emit,
-            })));
+            });
+            const command = [String(i.command), ...i.args].join(" ");
+            return withUi(textResult(JSON.stringify(result)), terminalBlock(command, result, Date.now() - started));
         },
     });
     register({
@@ -199,9 +263,11 @@ execCtx, websearchCtx) {
         description: "Run an arbitrary shell command. Explicit process capability required; not sandboxed.",
         inputSchema: objectSchema({ command: str }, ["command"]),
         async execute(i, c) {
-            return textResult(JSON.stringify(await runProcess(process.platform === "win32" ? "cmd.exe" : "/bin/sh", process.platform === "win32"
+            const started = Date.now();
+            const result = await runProcess(process.platform === "win32" ? "cmd.exe" : "/bin/sh", process.platform === "win32"
                 ? ["/d", "/s", "/c", String(i.command)]
-                : ["-c", String(i.command)], { cwd: c.workspace, signal: c.signal, onData: c.emit })));
+                : ["-c", String(i.command)], { cwd: c.workspace, signal: c.signal, onData: c.emit });
+            return withUi(textResult(JSON.stringify(result)), terminalBlock(String(i.command), result, Date.now() - started));
         },
     });
     for (const [name, args] of [
@@ -412,6 +478,21 @@ execCtx, websearchCtx) {
                 emit: c.emit,
                 ...(c.session ? { session: c.session } : {}),
                 ...(c.label ? { label: c.label } : {}),
+                // Nested calls must never open a new external-directory prompt; only directories already
+                // approved for this session (or inside the workspace) are reachable.
+                ...(pathAccess
+                    ? {
+                        resolvePath: (path) => pathAccess.resolve(path, {
+                            workspace: c.workspace,
+                            ...(c.session ? { session: c.session } : {}),
+                            ...(c.label ? { label: c.label } : {}),
+                            signal: c.signal,
+                            interactive: false,
+                        }),
+                    }
+                    : c.resolvePath
+                        ? { resolvePath: c.resolvePath }
+                        : {}),
             });
             return textResult(JSON.stringify({ result: result ?? null }));
         },

package/dist/version.d.ts

@@ -1,7 +1,9 @@
 /**
  * Reads the @alisio/core package version at runtime so the MCP client metadata stays in sync
- * with the published package. Resolves the manifest relative to the module (`src/version.ts` →
- * `../package.json` in the source tree; `dist/version.js` → `../package.json` when installed).
- * Standalone binaries inject ALISIO_PACKAGE_VERSION at build time (scripts/binary-build.ts).
+ * with the published package. The manifest is resolved by walking UP from the module directory
+ * until a package.json with a string `version` is found (bounded, any depth: module, then up to
+ * 8 parents), so a deeply nested call site like `src/mcp/connector.ts` resolves the same
+ * manifest as `src/version.ts`. Standalone binaries inject ALISIO_PACKAGE_VERSION at build time
+ * (scripts/binary-build.ts).
  */
 export declare function loadVersion(fromHere: string): string;

package/dist/version.js

@@ -6,19 +6,48 @@ import { fileURLToPath } from "node:url";
  * A development marker, never a publish literal: it cannot silently desync from the package.
  */
 const FALLBACK = "dev";
+/**
+ * How many parent directories the loader walks up before giving up. Bounded so a missing
+ * manifest can never make the lookup climb an unbounded path.
+ */
+const MAX_PARENT_HOPS = 8;
+/**
+ * Walks up from `dir` looking for a package manifest. Returns the version of the nearest
+ * manifest that declares a string `version`. `undefined` when no manifest with a version is
+ * reached within the bound.
+ */
+function findManifestVersion(dir) {
+    let nearest;
+    let current = dir;
+    for (let hop = 0; hop <= MAX_PARENT_HOPS; hop++) {
+        try {
+            const parsed = JSON.parse(readFileSync(join(current, "package.json"), "utf8"));
+            if (typeof parsed.version === "string" && parsed.version)
+                nearest ??= parsed.version;
+        }
+        catch {
+            // No manifest here; keep walking up.
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            break; // Filesystem root.
+        current = parent;
+    }
+    return nearest;
+}
 /**
  * Reads the @alisio/core package version at runtime so the MCP client metadata stays in sync
- * with the published package. Resolves the manifest relative to the module (`src/version.ts` →
- * `../package.json` in the source tree; `dist/version.js` → `../package.json` when installed).
- * Standalone binaries inject ALISIO_PACKAGE_VERSION at build time (scripts/binary-build.ts).
+ * with the published package. The manifest is resolved by walking UP from the module directory
+ * until a package.json with a string `version` is found (bounded, any depth: module, then up to
+ * 8 parents), so a deeply nested call site like `src/mcp/connector.ts` resolves the same
+ * manifest as `src/version.ts`. Standalone binaries inject ALISIO_PACKAGE_VERSION at build time
+ * (scripts/binary-build.ts).
  */
 export function loadVersion(fromHere) {
     if (process.env.ALISIO_PACKAGE_VERSION)
         return process.env.ALISIO_PACKAGE_VERSION;
     try {
-        const manifest = join(dirname(fileURLToPath(fromHere)), "..", "package.json");
-        const parsed = JSON.parse(readFileSync(manifest, "utf8"));
-        return typeof parsed.version === "string" && parsed.version ? parsed.version : FALLBACK;
+        return findManifestVersion(dirname(fileURLToPath(fromHere))) ?? FALLBACK;
     }
     catch {
         return FALLBACK;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alisio/core",
-  "version": "0.1.0-alpha.9",
+  "version": "0.1.0",
   "description": "Embeddable provider-agnostic Alisio agent core: tool loop, context compaction, local tools, MCP, plugin host and SQLite session store. Runs on Node >=22.16 and Bun.",
   "author": "Gustavo Gutiérrez",
   "license": "MIT",
@@ -41,7 +41,7 @@
     "node": ">=22.16"
   },
   "dependencies": {
-    "@alisio/sdk": "0.1.0-alpha.5",
+    "@alisio/sdk": "0.1.0",
     "@mixmark-io/domino": "2.2.0",
     "@modelcontextprotocol/client": "2.1.0",
     "ajv": "8.20.0",