@cleocode/core 2026.6.13 → 2026.6.15

package/dist/tools/exec-code-agent-tool.d.ts

@@ -0,0 +1,179 @@
+/**
+ * `execute_code` agent tool — guarded code execution via a {@link PiExecutionEnv}
+ * (T11946 · M7 · epic T11456 · SG-TOOLS).
+ *
+ * The first M7 catalog increment: the ONE capability the existing ~18-tool set
+ * lacks — running a supplied code snippet. It adds NO new execution mechanism of
+ * its own; it routes EVERY run through the EXISTING per-run execution-env selector
+ * {@link import('../llm/pi/resolve-execution-env.js').resolveExecutionEnv}, which
+ * prefers the Gondolin micro-VM (`backend: 'gondolin'`) when the optional
+ * `@earendil-works/gondolin` package + `/dev/kvm` + QEMU are present, and SILENTLY
+ * DEGRADES to the always-available in-process deny-first
+ * {@link import('../llm/pi/pi-execution-env.js').GuardedExecutionEnv} otherwise.
+ * The snippet runs via `env.exec(...)` — NEVER a raw `child_process`.
+ *
+ * ## Why the selector, not a new primitive (Gate-11 + D11142)
+ *
+ * `resolveExecutionEnv` already owns the backend choice + the optional-dep
+ * degradation. Reusing it means:
+ *   - **Optional-dep safety (D11142):** this module has NO `import type` from
+ *     `@earendil-works/gondolin`; the selector loads that package lazily and ONLY
+ *     when the VM is chosen. `core` builds + runs + tests with gondolin ABSENT —
+ *     the in-process env runs. This module is import-time side-effect-free.
+ *   - **Gate-11 (Tools-vs-Skills):** the tool is DEFINED here under
+ *     `packages/core/src/tools`; it constructs NO new atomic primitive — it
+ *     consumes the existing `ExecutionEnv` seam + the existing `ToolGuard`.
+ *   - **Gate-13 (LLM chokepoint):** `execute_code` runs CODE, not an LLM call. It
+ *     constructs NO transport / client and reads no API key — there is no
+ *     chokepoint concern.
+ *
+ * ## Availability (mirrors `browser_*`)
+ *
+ * The tool is ALWAYS registered but its {@link AvailabilityCheck} returns `false`
+ * unless the run context advertises `capabilities.codeExec === true`. This mirrors
+ * the Playwright-gated `browser_*` family: registered-but-hidden until the host
+ * opts code execution in, so a loop that never enables it cannot invoke arbitrary
+ * code. (The in-process env is itself ALWAYS constructible — Gondolin is the
+ * preferred-but-optional upgrade — so the gate is a host POLICY switch, not an
+ * infra probe.)
+ *
+ * ## Egress denylist (AC2)
+ *
+ * Before a command reaches `env.exec`, the tool rejects a real-egress verb
+ * ({@link import('../llm/pi/pi-gondolin-env.js').DENIED_EXEC_PREFIXES} — `gh` /
+ * `git push` / `git remote` / `npm publish` / `cleo`) via the shared
+ * {@link import('../llm/pi/pi-gondolin-env.js').deniedEgressVerb} predicate. The
+ * Gondolin backend enforces this denylist itself; applying it HERE gives the
+ * in-process fallback the SAME egress posture (the guarded env's command denylist
+ * is policy-configured and may not include these verbs).
+ *
+ * @epic T11456
+ * @task T11946
+ * @see ../llm/pi/resolve-execution-env.js — the backend selector this tool reuses
+ * @see ../llm/pi/pi-execution-env.js — the in-process guarded `ExecutionEnv` fallback
+ * @see ./web-agent-tools.js — the `browser_*` optional-dep + capability-gated pattern mirrored here
+ */
+import type { PiExecutionEnv } from '../llm/pi/pi-execution-env.js';
+import { type ExecutionEnvBackend, type ResolveExecutionEnvOptions, type ResolveExecutionEnvSeams } from '../llm/pi/resolve-execution-env.js';
+import { type ToolGuard } from '../tools/guard.js';
+import type { AgentToolRegistry, AvailabilityCheck } from './agent-registry.js';
+/** The languages `execute_code` knows how to invoke (AC2). */
+export declare const EXEC_CODE_LANGUAGES: readonly ["python", "node", "bash", "sh"];
+/** One supported {@link EXEC_CODE_LANGUAGES} value. */
+export type ExecCodeLanguage = (typeof EXEC_CODE_LANGUAGES)[number];
+/**
+ * Available ONLY when the run context opts code execution in
+ * (`capabilities.codeExec === true`). Mirrors the `browser_*` family's
+ * `playwright`-gated predicate: the tool is ALWAYS registered (so the catalog is
+ * stable) but hidden by `available()` until the host advertises the capability, so
+ * a loop that never enables it cannot run arbitrary code.
+ */
+export declare const codeExecAvailable: AvailabilityCheck;
+/**
+ * Result of an {@link registerExecCodeAgentTool | execute_code} run — the captured
+ * process output plus the resolved language and backend, for the LLM and for
+ * structured logging. `exitCode` is `null` when the process was killed by a
+ * signal/timeout (the {@link PiExecResult} contract).
+ */
+export interface ExecCodeResult {
+    /** The language the snippet was run as. */
+    readonly language: ExecCodeLanguage;
+    /** Captured standard output. */
+    readonly stdout: string;
+    /** Captured standard error. */
+    readonly stderr: string;
+    /** Process exit code, or `null` when killed by signal/timeout. */
+    readonly exitCode: number | null;
+    /** The confinement backend that ran the snippet (`gondolin` or `in-process`). */
+    readonly backend: ExecutionEnvBackend;
+    /** Whether the run completed without a denial/transport error (`exec` returned ok). */
+    readonly ok: boolean;
+    /**
+     * Present only when `ok === false`: a stable code + message for why the run did
+     * not produce a process result (e.g. a denied egress verb, or the selected
+     * env's `exec` returned `Result.err`). NEVER carries a raw secret.
+     */
+    readonly error?: {
+        readonly code: string;
+        readonly message: string;
+    };
+}
+/**
+ * The selector seam {@link registerExecCodeAgentTool} resolves a
+ * {@link PiExecutionEnv} through. Defaults to the real
+ * {@link import('../llm/pi/resolve-execution-env.js').resolveExecutionEnv}.
+ *
+ * EXPORTED so the unit test can inject a fake selector that returns a fake
+ * `PiExecutionEnv` — asserting the selector IS called and its `exec` output is
+ * captured, WITHOUT a real Gondolin VM, QEMU, or subprocess. In production the
+ * default is the real selector (Gondolin when available, in-process guarded env
+ * otherwise — gondolin ABSENT in CI).
+ */
+export type ExecutionEnvResolver = (opts: ResolveExecutionEnvOptions, seams?: ResolveExecutionEnvSeams) => Promise<PiExecutionEnv>;
+/** Options for {@link registerExecCodeAgentTool} — all injectable for testing. */
+export interface ExecCodeAgentToolOptions {
+    /**
+     * The env selector. Defaults to the real
+     * {@link import('../llm/pi/resolve-execution-env.js').resolveExecutionEnv}. The
+     * test injects a fake that returns a fake `PiExecutionEnv` (no real VM/subprocess).
+     */
+    readonly resolveEnv?: ExecutionEnvResolver;
+    /**
+     * The confinement backend to PREFER. `'gondolin'` boots the micro-VM when the
+     * optional package + `/dev/kvm` + QEMU are present and DEGRADES to the in-process
+     * env otherwise (the CI / most-developer-machines path); `'in-process'` always
+     * resolves to the guarded env without probing the host. Defaults to `'gondolin'`
+     * — prefer the strongest available confinement, degrade silently.
+     */
+    readonly backend?: ExecutionEnvBackend;
+    /**
+     * The enforce-mode {@link ToolGuard} backing the in-process fallback. Defaults to
+     * a fresh `createToolGuard({ mode: 'enforce' })` per run. Injectable so a host
+     * can supply a guard with a project path allowlist + command denylist.
+     */
+    readonly guard?: ToolGuard;
+    /**
+     * The absolute workspace root the in-process fallback confines fs paths under.
+     * Defaults to the resolved project root (`resolveOrCwd(undefined)`, T9584 — never
+     * a bare `process.cwd()`). The VM backend confines to its own `/workspace`.
+     */
+    readonly workspaceRoot?: string;
+    /**
+     * The disposable seeded-copy host dir mounted RW at the VM's `/workspace`.
+     * REQUIRED only when a real Gondolin VM actually boots (`backend: 'gondolin'` AND
+     * available) — MUST be a `VACUUM INTO` snapshot dir, NEVER the live `.cleo` DBs.
+     * Ignored by the in-process fallback (the CI path).
+     */
+    readonly seededCopyDir?: string;
+}
+/**
+ * Build the command line for a `language` + `code` pair. Each interpreter runs the
+ * snippet from its inline-code flag (`python -c`, `node -e`, `bash -c`, `sh -c`)
+ * with the code passed as ONE single-quoted argument — no further shell expansion
+ * of the model's code into the command shape.
+ *
+ * @param language - The interpreter to run.
+ * @param code - The model-supplied snippet.
+ * @returns The command string handed to `env.exec`.
+ */
+export declare function buildExecCommand(language: ExecCodeLanguage, code: string): string;
+/**
+ * Register the `execute_code` tool into `registry`. Pure registration — no env is
+ * resolved, no VM is booted, no code runs here; all of that happens later inside
+ * the tool's `execute` through the injected (or default) selector. Import-time
+ * side-effect-free + optional-dep-safe (D11142).
+ *
+ * @param registry - The registry to populate.
+ * @param options - Injectable selector / backend / guard / workspace (for testing).
+ */
+export declare function registerExecCodeAgentTool(registry: AgentToolRegistry, options?: ExecCodeAgentToolOptions): void;
+/**
+ * Self-registration marker (AC1) — the identifier the
+ * {@link AgentToolRegistry.discover} bounded source scan greps for. Aliases
+ * {@link registerExecCodeAgentTool} so a future scan-dir discovery (or the
+ * built-in aggregator) can call it uniformly with the other agent-tool modules.
+ *
+ * @param registry - The registry to populate.
+ */
+export declare function registerAgentTools(registry: AgentToolRegistry): void;
+//# sourceMappingURL=exec-code-agent-tool.d.ts.map

package/dist/tools/exec-code-agent-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-code-agent-tool.d.ts","sourceRoot":"","sources":["../../src/tools/exec-code-agent-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEpE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAE9B,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAIhF,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,2CAA4C,CAAC;AAE7E,uDAAuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,iBAAgE,CAAC;AAEjG;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+BAA+B;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,uFAAuF;IACvF,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,0BAA0B,EAChC,KAAK,CAAC,EAAE,wBAAwB,KAC7B,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,kFAAkF;AAClF,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAeD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAYjF;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,wBAA6B,GACrC,IAAI,CAkHN;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAEpE"}

package/dist/tools/exec-code-agent-tool.js

@@ -0,0 +1,239 @@
+/**
+ * `execute_code` agent tool — guarded code execution via a {@link PiExecutionEnv}
+ * (T11946 · M7 · epic T11456 · SG-TOOLS).
+ *
+ * The first M7 catalog increment: the ONE capability the existing ~18-tool set
+ * lacks — running a supplied code snippet. It adds NO new execution mechanism of
+ * its own; it routes EVERY run through the EXISTING per-run execution-env selector
+ * {@link import('../llm/pi/resolve-execution-env.js').resolveExecutionEnv}, which
+ * prefers the Gondolin micro-VM (`backend: 'gondolin'`) when the optional
+ * `@earendil-works/gondolin` package + `/dev/kvm` + QEMU are present, and SILENTLY
+ * DEGRADES to the always-available in-process deny-first
+ * {@link import('../llm/pi/pi-execution-env.js').GuardedExecutionEnv} otherwise.
+ * The snippet runs via `env.exec(...)` — NEVER a raw `child_process`.
+ *
+ * ## Why the selector, not a new primitive (Gate-11 + D11142)
+ *
+ * `resolveExecutionEnv` already owns the backend choice + the optional-dep
+ * degradation. Reusing it means:
+ *   - **Optional-dep safety (D11142):** this module has NO `import type` from
+ *     `@earendil-works/gondolin`; the selector loads that package lazily and ONLY
+ *     when the VM is chosen. `core` builds + runs + tests with gondolin ABSENT —
+ *     the in-process env runs. This module is import-time side-effect-free.
+ *   - **Gate-11 (Tools-vs-Skills):** the tool is DEFINED here under
+ *     `packages/core/src/tools`; it constructs NO new atomic primitive — it
+ *     consumes the existing `ExecutionEnv` seam + the existing `ToolGuard`.
+ *   - **Gate-13 (LLM chokepoint):** `execute_code` runs CODE, not an LLM call. It
+ *     constructs NO transport / client and reads no API key — there is no
+ *     chokepoint concern.
+ *
+ * ## Availability (mirrors `browser_*`)
+ *
+ * The tool is ALWAYS registered but its {@link AvailabilityCheck} returns `false`
+ * unless the run context advertises `capabilities.codeExec === true`. This mirrors
+ * the Playwright-gated `browser_*` family: registered-but-hidden until the host
+ * opts code execution in, so a loop that never enables it cannot invoke arbitrary
+ * code. (The in-process env is itself ALWAYS constructible — Gondolin is the
+ * preferred-but-optional upgrade — so the gate is a host POLICY switch, not an
+ * infra probe.)
+ *
+ * ## Egress denylist (AC2)
+ *
+ * Before a command reaches `env.exec`, the tool rejects a real-egress verb
+ * ({@link import('../llm/pi/pi-gondolin-env.js').DENIED_EXEC_PREFIXES} — `gh` /
+ * `git push` / `git remote` / `npm publish` / `cleo`) via the shared
+ * {@link import('../llm/pi/pi-gondolin-env.js').deniedEgressVerb} predicate. The
+ * Gondolin backend enforces this denylist itself; applying it HERE gives the
+ * in-process fallback the SAME egress posture (the guarded env's command denylist
+ * is policy-configured and may not include these verbs).
+ *
+ * @epic T11456
+ * @task T11946
+ * @see ../llm/pi/resolve-execution-env.js — the backend selector this tool reuses
+ * @see ../llm/pi/pi-execution-env.js — the in-process guarded `ExecutionEnv` fallback
+ * @see ./web-agent-tools.js — the `browser_*` optional-dep + capability-gated pattern mirrored here
+ */
+import { z } from 'zod';
+import { DENIED_EXEC_PREFIXES, deniedEgressVerb } from '../llm/pi/pi-gondolin-env.js';
+import { resolveExecutionEnv as realResolveExecutionEnv, } from '../llm/pi/resolve-execution-env.js';
+import { getLogger } from '../logger.js';
+import { resolveOrCwd } from '../paths.js';
+import { createToolGuard } from '../tools/guard.js';
+const log = getLogger('tool-exec-code');
+/** The languages `execute_code` knows how to invoke (AC2). */
+export const EXEC_CODE_LANGUAGES = ['python', 'node', 'bash', 'sh'];
+/**
+ * Available ONLY when the run context opts code execution in
+ * (`capabilities.codeExec === true`). Mirrors the `browser_*` family's
+ * `playwright`-gated predicate: the tool is ALWAYS registered (so the catalog is
+ * stable) but hidden by `available()` until the host advertises the capability, so
+ * a loop that never enables it cannot run arbitrary code.
+ */
+export const codeExecAvailable = (ctx) => ctx.capabilities?.codeExec === true;
+/**
+ * Shell-quote a single argument for a POSIX `sh -c` / interpreter `-c`/`-e`
+ * invocation: wrap in single quotes and escape embedded single quotes. The code
+ * is UNTRUSTED model input, so it is passed as ONE quoted argument to the
+ * interpreter's `-c`/`-e` flag rather than interpolated into the command shape.
+ *
+ * @param value - The raw argument (the model-supplied code).
+ * @returns The single-quoted, shell-safe token.
+ */
+function singleQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * Build the command line for a `language` + `code` pair. Each interpreter runs the
+ * snippet from its inline-code flag (`python -c`, `node -e`, `bash -c`, `sh -c`)
+ * with the code passed as ONE single-quoted argument — no further shell expansion
+ * of the model's code into the command shape.
+ *
+ * @param language - The interpreter to run.
+ * @param code - The model-supplied snippet.
+ * @returns The command string handed to `env.exec`.
+ */
+export function buildExecCommand(language, code) {
+    const quoted = singleQuote(code);
+    switch (language) {
+        case 'python':
+            return `python -c ${quoted}`;
+        case 'node':
+            return `node -e ${quoted}`;
+        case 'bash':
+            return `bash -c ${quoted}`;
+        case 'sh':
+            return `sh -c ${quoted}`;
+    }
+}
+/**
+ * Register the `execute_code` tool into `registry`. Pure registration — no env is
+ * resolved, no VM is booted, no code runs here; all of that happens later inside
+ * the tool's `execute` through the injected (or default) selector. Import-time
+ * side-effect-free + optional-dep-safe (D11142).
+ *
+ * @param registry - The registry to populate.
+ * @param options - Injectable selector / backend / guard / workspace (for testing).
+ */
+export function registerExecCodeAgentTool(registry, options = {}) {
+    const resolveEnv = options.resolveEnv ?? realResolveExecutionEnv;
+    const backend = options.backend ?? 'gondolin';
+    registry.register({
+        name: 'execute_code',
+        // 'shell' — the run is a process invocation (its strongest side-effect surface).
+        class: 'shell',
+        description: 'Execute a code snippet in a guarded execution environment (Gondolin micro-VM ' +
+            'when available, in-process guarded sandbox otherwise) and capture its ' +
+            'stdout / stderr / exit code. Real-egress verbs (gh, git push, npm publish, ' +
+            'cleo) are denied. Available only when the run enables code execution.',
+        toolset: 'agent',
+        stateless: true,
+        available: codeExecAvailable,
+        parameters: z.object({
+            language: z
+                .enum(EXEC_CODE_LANGUAGES)
+                .describe('Interpreter to run the snippet with: python, node, bash, or sh.'),
+            code: z.string().describe('The source code / script to execute.'),
+            timeoutMs: z
+                .number()
+                .int()
+                .positive()
+                .optional()
+                .describe('Hard wall-time ceiling for the run, in milliseconds.'),
+        }),
+        execute: async (rawArgs) => {
+            // `rawArgs` is the schema-validated argument object (the dispatch engine
+            // re-validates against `parameters` before calling). Narrow defensively.
+            const language = rawArgs.language;
+            const code = String(rawArgs.code);
+            const timeoutMs = typeof rawArgs.timeoutMs === 'number' ? rawArgs.timeoutMs : undefined;
+            // AC2: deny a real-egress verb BEFORE the env runs it — same posture on the
+            // in-process fallback as on the Gondolin backend (whose own denylist is the
+            // shared DENIED_EXEC_PREFIXES list). The check runs against the SNIPPET
+            // itself (the leading verb the user wants to run), NOT the wrapped
+            // `bash -c '<snippet>'` command — whose argv-0 is always a benign
+            // interpreter (`bash`/`sh`/`python`/`node`). For a shell snippet (`bash`/`sh`)
+            // the code IS the command line, so `gh …`/`git push …`/`npm publish …` is
+            // caught; for `python`/`node` the same scan is a harmless extra net.
+            const denied = deniedEgressVerb(code);
+            if (denied !== null) {
+                return {
+                    language,
+                    stdout: '',
+                    stderr: '',
+                    exitCode: null,
+                    backend,
+                    ok: false,
+                    error: {
+                        code: 'E_EXEC_CODE_EGRESS_DENIED',
+                        message: `egress verb "${denied}" is denied (one of: ${DENIED_EXEC_PREFIXES.join(', ')})`,
+                    },
+                };
+            }
+            // Shape the interpreter command line (the snippet passed as ONE quoted
+            // argument to the interpreter's inline-code flag — no shell expansion of the
+            // model's code into the command shape).
+            const command = buildExecCommand(language, code);
+            // Resolve the per-run env through the SELECTOR (Gondolin if present, else the
+            // in-process guarded env). The selector owns the optional-dep degradation —
+            // this call works with gondolin ABSENT.
+            const guard = options.guard ?? createToolGuard({ mode: 'enforce' });
+            // `resolveOrCwd` resolves to the supplied root, else the project root (T9584
+            // — never a bare `process.cwd()` in core).
+            const workspaceRoot = resolveOrCwd(options.workspaceRoot);
+            const env = await resolveEnv({
+                backend,
+                guard,
+                workspaceRoot,
+                ...(options.seededCopyDir !== undefined ? { seededCopyDir: options.seededCopyDir } : {}),
+            });
+            try {
+                const result = await env.exec(command, {
+                    ...(timeoutMs !== undefined ? { timeout: timeoutMs } : {}),
+                });
+                if (!result.ok) {
+                    // `exec` never throws — a denial / failure is a typed Result.err. Surface
+                    // it as a non-ok run rather than a thrown executable error.
+                    return {
+                        language,
+                        stdout: '',
+                        stderr: '',
+                        exitCode: null,
+                        backend,
+                        ok: false,
+                        error: { code: result.error.code, message: result.error.message },
+                    };
+                }
+                return {
+                    language,
+                    stdout: result.value.stdout,
+                    stderr: result.value.stderr,
+                    exitCode: result.value.exitCode,
+                    backend,
+                    ok: true,
+                };
+            }
+            finally {
+                // Best-effort teardown — the env (VM or guarded) may own resources; cleanup
+                // never throws (the PiExecutionEnv contract).
+                try {
+                    await env.cleanup();
+                }
+                catch (err) {
+                    log.debug({ err }, 'execute_code: env cleanup failed (ignored)');
+                }
+            }
+        },
+    });
+}
+/**
+ * Self-registration marker (AC1) — the identifier the
+ * {@link AgentToolRegistry.discover} bounded source scan greps for. Aliases
+ * {@link registerExecCodeAgentTool} so a future scan-dir discovery (or the
+ * built-in aggregator) can call it uniformly with the other agent-tool modules.
+ *
+ * @param registry - The registry to populate.
+ */
+export function registerAgentTools(registry) {
+    registerExecCodeAgentTool(registry);
+}
+//# sourceMappingURL=exec-code-agent-tool.js.map

package/dist/tools/exec-code-agent-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec-code-agent-tool.js","sourceRoot":"","sources":["../../src/tools/exec-code-agent-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAIL,mBAAmB,IAAI,uBAAuB,GAC/C,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAkB,MAAM,mBAAmB,CAAC;AAGpE,MAAM,GAAG,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAExC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAU,CAAC;AAK7E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,KAAK,IAAI,CAAC;AAkFjG;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA0B,EAAE,IAAY;IACvE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,aAAa,MAAM,EAAE,CAAC;QAC/B,KAAK,MAAM;YACT,OAAO,WAAW,MAAM,EAAE,CAAC;QAC7B,KAAK,MAAM;YACT,OAAO,WAAW,MAAM,EAAE,CAAC;QAC7B,KAAK,IAAI;YACP,OAAO,SAAS,MAAM,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA2B,EAC3B,UAAoC,EAAE;IAEtC,MAAM,UAAU,GAAyB,OAAO,CAAC,UAAU,IAAI,uBAAuB,CAAC;IACvF,MAAM,OAAO,GAAwB,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC;IAEnE,QAAQ,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,cAAc;QACpB,iFAAiF;QACjF,KAAK,EAAE,OAAO;QACd,WAAW,EACT,+EAA+E;YAC/E,wEAAwE;YACxE,6EAA6E;YAC7E,uEAAuE;QACzE,OAAO,EAAE,OAAO;QAChB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,iBAAiB;QAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,mBAAmB,CAAC;iBACzB,QAAQ,CAAC,iEAAiE,CAAC;YAC9E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;YACjE,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,EAAE;iBACV,QAAQ,EAAE;iBACV,QAAQ,CAAC,sDAAsD,CAAC;SACpE,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,OAAO,EAA2B,EAAE;YAClD,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAA4B,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAExF,4EAA4E;YAC5E,4EAA4E;YAC5E,wEAAwE;YACxE,mEAAmE;YACnE,kEAAkE;YAClE,+EAA+E;YAC/E,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO;oBACL,QAAQ;oBACR,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,IAAI;oBACd,OAAO;oBACP,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,2BAA2B;wBACjC,OAAO,EAAE,gBAAgB,MAAM,wBAAwB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;qBAC1F;iBACF,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,6EAA6E;YAC7E,wCAAwC;YACxC,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAEjD,8EAA8E;YAC9E,4EAA4E;YAC5E,wCAAwC;YACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACpE,6EAA6E;YAC7E,2CAA2C;YAC3C,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC;gBAC3B,OAAO;gBACP,KAAK;gBACL,aAAa;gBACb,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzF,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE;oBACrC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,0EAA0E;oBAC1E,4DAA4D;oBAC5D,OAAO;wBACL,QAAQ;wBACR,MAAM,EAAE,EAAE;wBACV,MAAM,EAAE,EAAE;wBACV,QAAQ,EAAE,IAAI;wBACd,OAAO;wBACP,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;qBAClE,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,QAAQ;oBACR,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;oBAC3B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;oBAC3B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;oBAC/B,OAAO;oBACP,EAAE,EAAE,IAAI;iBACT,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,4EAA4E;gBAC5E,8CAA8C;gBAC9C,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;gBACtB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4CAA4C,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA2B;IAC5D,yBAAyB,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC"}

package/dist/tools/index.d.ts

@@ -48,10 +48,16 @@ export { BrowserSession, isPlaywrightAvailable, PLAYWRIGHT_INSTALL_HINT, type Pl
 export { registerBuiltinAgentTools } from './builtin-agent-tools.js';
 export { flattenZodIssues, formatToolResultForLlm, formatToolValueForLlm, MAX_TOOL_RESULT_CHARS, redactErrorMessage, TOOL_DISPATCH_ERROR_CODE, type ToolArgIssue, type ToolBudgetLimits, type ToolBudgetSnapshot, type ToolCall, ToolCallBudget, ToolDispatchEngine, type ToolDispatchEngineDeps, type ToolDispatchErrorKind, type ToolDispatchFailure, type ToolDispatchResult, type ToolDispatchSuccess, type ToolResultPayload, ToolTimeoutError, } from './dispatch.js';
 export { isForbiddenEnvName, type ScrubEnvOptions, scrubSubprocessEnv, TRUSTED_PATH, } from './env-scrub.js';
+export { buildExecCommand, codeExecAvailable, EXEC_CODE_LANGUAGES, type ExecCodeAgentToolOptions, type ExecCodeLanguage, type ExecCodeResult, type ExecutionEnvResolver, registerExecCodeAgentTool, } from './exec-code-agent-tool.js';
 export { createToolGuard, GUARD_ENFORCE_DEADLINE, GUARD_ENFORCE_FLIP_ENABLED, GuardDeniedError, type GuardMode, resolveDefaultGuardMode, type ToolGuard, type ToolGuardPolicy, } from './guard.js';
+export { buildMcpProxyTool, connectMcpServer, MCP_TRANSPORT_KINDS, type McpAgentToolOptions, type McpConnection, type McpRemoteTool, type McpToolCallResult, type McpTransport, type McpTransportKind, mcpToolName, registerMcpAgentTools, registerMcpConnectionTools, } from './mcp-agent-tool.js';
+export { type MediaAgentToolOptions, type MediaModelResult, multimodalAvailable, registerMediaAgentTools, } from './media-agent-tools.js';
+export { type MemoryAgentToolOptions, type MemoryOps, registerMemoryAgentTools, } from './memory-agent-tools.js';
 export { runPty } from './pty.js';
+export { type CronScheduleResult, registerScheduleAgentTools, type ScheduleAgentToolOptions, scheduleStoreAvailable, type TaskOps, } from './schedule-agent-tools.js';
 export { type ZodSchemaTool, zodSchemaToOpenAITool } from './schema-gen.js';
 export { defaultShellExecutor, type ShellExecutor } from './shell.js';
+export { type RunSkillResult, registerSkillAgentTool, type SkillAgentToolOptions, type SkillResolver, } from './skill-agent-tool.js';
 export { registerWebAgentTools, type WebAgentToolOptions } from './web-agent-tools.js';
 export { defaultHttpFetch, duckDuckGoBackend, extractTitle, fetchAndExtract, type HttpFetch, htmlToMarkdown, makeSearxngBackend, parseDuckDuckGoHtml, parseSearxngJson, resolveSearchBackends, runSearch, type WebSearchBackend, } from './web-search-backends.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,cAAc,yBAAyB,CAAC;AACxC,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAE7F,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EACV,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,cAAc,iBAAiB,CAAC;AAEhC,cAAc,wBAAwB,CAAC;AAMvC,OAAO,EACL,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAM7B,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EACtB,cAAc,EACd,aAAa,EACb,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,gBAAgB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAOrE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,QAAQ,EACb,cAAc,EACd,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAIvB,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,kBAAkB,EAClB,YAAY,GACb,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EAChB,KAAK,SAAS,EACd,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,KAAK,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAG5E,OAAO,EAAE,oBAAoB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,KAAK,SAAS,EACd,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,SAAS,EACT,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,cAAc,yBAAyB,CAAC;AACxC,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAE7F,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EACV,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,cAAc,iBAAiB,CAAC;AAEhC,cAAc,wBAAwB,CAAC;AAMvC,OAAO,EACL,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAM7B,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EACtB,cAAc,EACd,aAAa,EACb,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,gBAAgB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAOrE,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,QAAQ,EACb,cAAc,EACd,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAIvB,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,kBAAkB,EAClB,YAAY,GACb,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EAChB,KAAK,SAAS,EACd,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,WAAW,EACX,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACd,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EACL,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,KAAK,wBAAwB,EAC7B,sBAAsB,EACtB,KAAK,OAAO,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,KAAK,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAG5E,OAAO,EAAE,oBAAoB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EACL,KAAK,cAAc,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,KAAK,SAAS,EACd,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,SAAS,EACT,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC"}

package/dist/tools/index.js

@@ -75,16 +75,31 @@ export { flattenZodIssues, formatToolResultForLlm, formatToolValueForLlm, MAX_TO
 // allowlisted child env so daemon secrets never leak and a Pi-controlled loader
 // hook / PATH can never reach a spawned process.
 export { isForbiddenEnvName, scrubSubprocessEnv, TRUSTED_PATH, } from './env-scrub.js';
+// `execute_code` agent tool (T11946 · M7) — the `agent` toolset's guarded
+// code-execution capability. Routes every run through the existing
+// `resolveExecutionEnv` selector (Gondolin micro-VM when available, in-process
+// guarded `ExecutionEnv` otherwise — gondolin is OPTIONAL, so core builds with it
+// ABSENT). Registered always; available() hides it unless `capabilities.codeExec`.
+export { buildExecCommand, codeExecAvailable, EXEC_CODE_LANGUAGES, registerExecCodeAgentTool, } from './exec-code-agent-tool.js';
 // Atomic-tool guard chokepoint (E3 · T11407 · T11474) — the ONLY public route to
 // the fs/shell primitives. Raw primitives are intentionally not re-exported.
 export { createToolGuard, GUARD_ENFORCE_DEADLINE, GUARD_ENFORCE_FLIP_ENABLED, GuardDeniedError, resolveDefaultGuardMode, } from './guard.js';
+export { buildMcpProxyTool, connectMcpServer, MCP_TRANSPORT_KINDS, mcpToolName, registerMcpAgentTools, registerMcpConnectionTools, } from './mcp-agent-tool.js';
+// M7 agent-tool catalog (T11947–T11951) — memory / mcp / run_skill / cron-todo /
+// vision-media families. Each DEFINED here under `packages/core/src/tools`
+// (Gate-11) and CONSUMES an existing subsystem (BRAIN / skills / task store / E9
+// chokepoint) — no new store, no new loader, no raw provider client (Gate-13).
+export { multimodalAvailable, registerMediaAgentTools, } from './media-agent-tools.js';
+export { registerMemoryAgentTools, } from './memory-agent-tools.js';
 // PTY shell runner (T1741) — the terminal toolset's execution backend; lazily +
 // optionally loads `node-pty`, transparently degrading to non-PTY `spawn`.
 export { runPty } from './pty.js';
+export { registerScheduleAgentTools, scheduleStoreAvailable, } from './schedule-agent-tools.js';
 export { zodSchemaToOpenAITool } from './schema-gen.js';
 // Injectable shell executor (E3 · T11406) — threaded into the guard's
 // executeShell/runGit; substitutes the subprocess layer in tests/sandboxes.
 export { defaultShellExecutor } from './shell.js';
+export { registerSkillAgentTool, } from './skill-agent-tool.js';
 export { registerWebAgentTools } from './web-agent-tools.js';
 export { defaultHttpFetch, duckDuckGoBackend, extractTitle, fetchAndExtract, htmlToMarkdown, makeSearxngBackend, parseDuckDuckGoHtml, parseSearxngJson, resolveSearchBackends, runSearch, } from './web-search-backends.js';
 //# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,uFAAuF;AACvF,cAAc,yBAAyB,CAAC;AAExC,uFAAuF;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,uDAAuD;AACvD,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAMhE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,6EAA6E;AAC7E,cAAc,iBAAiB,CAAC;AAChC,iFAAiF;AACjF,cAAc,wBAAwB,CAAC;AACvC,0EAA0E;AAC1E,iFAAiF;AACjF,gFAAgF;AAChF,iFAAiF;AACjF,gCAAgC;AAChC,OAAO,EACL,sBAAsB,EAItB,iBAAiB,EACjB,gBAAgB,EAEhB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,iFAAiF;AACjF,oFAAoF;AACpF,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,OAAO,EACL,eAAe,EAEf,cAAc,EACd,aAAa,EACb,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,kFAAkF;AAClF,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,mFAAmF;AACnF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EAKxB,cAAc,EACd,kBAAkB,EAOlB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,kFAAkF;AAClF,gFAAgF;AAChF,iDAAiD;AACjD,OAAO,EACL,kBAAkB,EAElB,kBAAkB,EAClB,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,iFAAiF;AACjF,6EAA6E;AAC7E,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EAEhB,uBAAuB,GAGxB,MAAM,YAAY,CAAC;AACpB,gFAAgF;AAChF,2EAA2E;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAsB,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,OAAO,EAAE,oBAAoB,EAAsB,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAA4B,MAAM,sBAAsB,CAAC;AACvF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EAEf,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,SAAS,GAEV,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,uFAAuF;AACvF,cAAc,yBAAyB,CAAC;AAExC,uFAAuF;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,uDAAuD;AACvD,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAMhE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,6EAA6E;AAC7E,cAAc,iBAAiB,CAAC;AAChC,iFAAiF;AACjF,cAAc,wBAAwB,CAAC;AACvC,0EAA0E;AAC1E,iFAAiF;AACjF,gFAAgF;AAChF,iFAAiF;AACjF,gCAAgC;AAChC,OAAO,EACL,sBAAsB,EAItB,iBAAiB,EACjB,gBAAgB,EAEhB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,iFAAiF;AACjF,oFAAoF;AACpF,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,OAAO,EACL,eAAe,EAEf,cAAc,EACd,aAAa,EACb,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,kFAAkF;AAClF,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,mFAAmF;AACnF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EAKxB,cAAc,EACd,kBAAkB,EAOlB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,kFAAkF;AAClF,gFAAgF;AAChF,iDAAiD;AACjD,OAAO,EACL,kBAAkB,EAElB,kBAAkB,EAClB,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,0EAA0E;AAC1E,mEAAmE;AACnE,+EAA+E;AAC/E,kFAAkF;AAClF,mFAAmF;AACnF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EAKnB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,iFAAiF;AACjF,6EAA6E;AAC7E,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EAEhB,uBAAuB,GAGxB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EAOnB,WAAW,EACX,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,iFAAiF;AACjF,2EAA2E;AAC3E,iFAAiF;AACjF,+EAA+E;AAC/E,OAAO,EAGL,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,gFAAgF;AAChF,2EAA2E;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAEL,0BAA0B,EAE1B,sBAAsB,GAEvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAsB,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,OAAO,EAAE,oBAAoB,EAAsB,MAAM,YAAY,CAAC;AACtE,OAAO,EAEL,sBAAsB,GAGvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAA4B,MAAM,sBAAsB,CAAC;AACvF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EAEf,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,SAAS,GAEV,MAAM,0BAA0B,CAAC"}