@cydm/pie 2.7.8 → 2.7.9

package/dist/chunks/{chunk-P22SYVGO.js → chunk-AX5QEIKP.js}

@@ -2,7 +2,7 @@ import { createRequire as __createRequire } from "node:module"; const require =
 import {
   Agent,
   getToolCallerIdentity
-} from "./chunk-W5B3OXHQ.js";
+} from "./chunk-5SP2H5QK.js";
 import {
   AssistantMessageEventStream,
   FileSystemGateway,
@@ -12,7 +12,7 @@ import {
   getPlatformConfig,
   hashText,
   streamSimple
-} from "./chunk-2FEDB5GR.js";
+} from "./chunk-SMGBZQI5.js";
 import {
   Type
 } from "./chunk-XXGYUYXI.js";
@@ -899,6 +899,11 @@ function shouldPreserveExecutionStateForUserText(text) {
   return CONTINUE_PATTERNS.some((pattern) => pattern.test(trimmed));
 }
 
+// ../../packages/shared-headless-capabilities/src/capability.ts
+function defineSharedCapability(definition) {
+  return definition;
+}
+
 // ../../packages/shared-headless-capabilities/src/tool-policy.ts
 var BUILTIN_TOOL_CAPABILITY_METADATA = {
   search_context: { riskClass: "read_only", concurrencySafe: true, permissionScope: "session", availableInPlanMode: true, allowedForSubagentByDefault: false, maxOutputChars: 2e4 },
@@ -971,13 +976,51 @@ function getSubagentToolPolicyDecision(tool) {
 }
 var DEFAULT_PLAN_MODE_TOOL_NAMES = Object.entries(BUILTIN_TOOL_CAPABILITY_METADATA).filter(([, metadata]) => metadata.availableInPlanMode).map(([name]) => name);
 
-// ../../packages/shared-headless-capabilities/src/capability.ts
-function defineSharedCapability(definition) {
-  return definition;
+// ../../packages/shared-headless-capabilities/src/plan.ts
+var import_shell_quote = __toESM(require_shell_quote(), 1);
+
+// ../../packages/shared-headless-capabilities/src/shell-resolution.ts
+function defaultShellKindForPlatform(platform = process.platform) {
+  return platform === "win32" ? "powershell" : "bash";
+}
+function resolveRequestShellKind(shell, platform = process.platform) {
+  if (shell === "bash" || shell === "powershell" || shell === "cmd") return shell;
+  return defaultShellKindForPlatform(platform);
 }
 
 // ../../packages/shared-headless-capabilities/src/plan.ts
-var import_shell_quote = __toESM(require_shell_quote(), 1);
+var PLAN_POWERSHELL_READ_COMMANDS = new Set([
+  "Get-Content",
+  "Get-ChildItem",
+  "Get-Item",
+  "Get-Location",
+  "Get-Date",
+  "Get-Command",
+  "Select-String",
+  "Measure-Object",
+  "Compare-Object",
+  "Test-Path"
+].map((name) => name.toLowerCase()));
+var PLAN_POWERSHELL_READ_ALIASES = /* @__PURE__ */ new Set(["cat", "ls", "pwd", "echo", "sort"]);
+var PLAN_POWERSHELL_SAFE_PARAMETERS = /^(?:-(?:Raw|TotalCount|Head|Tail|First|Last|Wait|LiteralPath|Path|Name|Pattern|Recurse|Filter|Include|Exclude|SimpleMatch|CaseSensitive|Quiet|Word|Line|Character|Encoding|ErrorAction|WarningAction))$/i;
+var PLAN_POWERSHELL_SEPARATORS = /[;\n\r\t]|[<>]{1,2}|\||&&|\|\|/;
+var PLAN_POWERSHELL_NON_ASCII = /[^\x20-\x7E]/;
+var PLAN_POWERSHELL_UNSAFE_TOKENS = /\$\(|`|%\{|[(){}\[\]]|\bsource\b|\.\s+[/~]|\b(bash|sh|zsh|pwsh|powershell|cmd|npm|npx|node|python3?|git)\b/i;
+function isPlanModeSafePowerShellCommand(command) {
+  const trimmed = command.trim();
+  if (!trimmed) return false;
+  if (PLAN_POWERSHELL_NON_ASCII.test(command)) return false;
+  if (PLAN_POWERSHELL_SEPARATORS.test(trimmed)) return false;
+  if (PLAN_POWERSHELL_UNSAFE_TOKENS.test(trimmed)) return false;
+  const tokens = trimmed.split(/\s+/).filter(Boolean);
+  const head = tokens[0].toLowerCase();
+  if (!head) return false;
+  if (!PLAN_POWERSHELL_READ_COMMANDS.has(head) && !PLAN_POWERSHELL_READ_ALIASES.has(head)) return false;
+  for (const token of tokens.slice(1)) {
+    if (token.startsWith("-") && !PLAN_POWERSHELL_SAFE_PARAMETERS.test(token)) return false;
+  }
+  return true;
+}
 var SIMPLE_READ_COMMANDS = /* @__PURE__ */ new Set(["pwd", "ls", "cat", "head", "tail", "wc", "grep", "rg", "which", "type", "echo", "printf", "cd", "true", "false", "tree", "jq", "stat", "file", "du", "df", "basename", "dirname", "date", "uname", "sort", "uniq", "cut", "column", "shasum", "printenv"]);
 var GIT_READ_SUBCOMMANDS = /* @__PURE__ */ new Set(["status", "log", "diff", "show", "rev-parse", "ls-files", "ls-tree", "blame", "describe", "shortlog", "merge-base"]);
 var UNSAFE_GIT_FLAGS = /^(?:-c|--config-env|--exec|--output|--ext-diff|--textconv)(?:=|$)/;
@@ -1095,7 +1138,21 @@ function isReadOnlySegment(words) {
   }
   if (program === "uniq") return isReadOnlyUniq(args);
   if (program === "date") {
-    return args.every((arg) => arg.startsWith("-") || arg.startsWith("+"));
+    const safeFlags = /* @__PURE__ */ new Set(["-u", "--utc", "--universal", "--help", "--version", "--debug"]);
+    const valueFlags = /* @__PURE__ */ new Set(["-d", "--date", "-f", "--file", "-r", "--reference"]);
+    const valueLongFlags = /^(?:--date|--file|--reference|--iso-8601|--rfc-email|--rfc-2822|--rfc-3339)=/;
+    for (let index = 0; index < args.length; index += 1) {
+      const arg = args[index];
+      if (arg.startsWith("+")) continue;
+      if (safeFlags.has(arg) || valueLongFlags.test(arg)) continue;
+      if (valueFlags.has(arg)) {
+        if (index + 1 >= args.length) return false;
+        index += 1;
+        continue;
+      }
+      return false;
+    }
+    return true;
   }
   if (program === "jq") {
     return true;
@@ -1154,7 +1211,9 @@ ${inlineMatch[1]}`;
   }
   return items;
 }
-function isPlanModeSafeCommand(command) {
+function isPlanModeSafeCommand(command, shell = "bash") {
+  if (shell === "powershell") return isPlanModeSafePowerShellCommand(command);
+  if (shell === "cmd") return false;
   const trimmed = command.trim();
   if (!trimmed || /[$`\n\r\0]/.test(trimmed)) return false;
   if (/\{[^{}]*\}/.test(trimmed) || /\{\s*,/.test(trimmed)) return false;
@@ -1994,14 +2053,6 @@ function projectHostContextBlock(block, registry) {
     };
   }
 }
-function leadingHostContextBlock(message) {
-  if (message.role !== "user") return void 0;
-  const content = message.content;
-  if (!Array.isArray(content) || content.length === 0) return void 0;
-  const first = content[0];
-  if (!isHostContextBlock(first)) return void 0;
-  return first;
-}
 function projectionSeparator(projectionText) {
   return projectionText.endsWith("\n") && !projectionText.endsWith("\n\n") ? "" : "\n\n";
 }
@@ -2009,23 +2060,40 @@ function projectHostEnvelopes(messages, registry, onProjection) {
   let changed = false;
   const next = [];
   for (const message of messages) {
-    const block = leadingHostContextBlock(message);
-    if (!block) {
+    if (message.role !== "user") {
       next.push(message);
       continue;
     }
-    const outcome = projectHostContextBlock(block, registry);
-    onProjection?.(outcome);
     const content = message.content;
-    const rest = content.slice(1);
-    const separator = projectionSeparator(outcome.text);
+    if (!Array.isArray(content)) {
+      next.push(message);
+      continue;
+    }
+    let blockCount = 0;
+    while (blockCount < content.length && isHostContextBlock(content[blockCount])) blockCount += 1;
+    if (blockCount === 0) {
+      next.push(message);
+      continue;
+    }
+    const outcomes = [];
+    for (let i = 0; i < blockCount; i++) {
+      const outcome = projectHostContextBlock(content[i], registry);
+      outcomes.push(outcome);
+      onProjection?.(outcome);
+    }
+    const rest = content.slice(blockCount);
+    let text = outcomes[outcomes.length - 1].text;
+    for (let i = outcomes.length - 2; i >= 0; i--) {
+      text = `${outcomes[i].text}${projectionSeparator(outcomes[i].text)}${text}`;
+    }
+    const separator = projectionSeparator(outcomes[outcomes.length - 1].text);
     const first = rest[0];
     let projectedContent;
     if (first && first.type === "text" && typeof first.text === "string") {
-      const merged = first.text.trim().length > 0 ? `${outcome.text}${separator}${first.text}` : outcome.text;
+      const merged = first.text.trim().length > 0 ? `${text}${separator}${first.text}` : text;
       projectedContent = [{ ...first, text: merged }, ...rest.slice(1)];
     } else {
-      projectedContent = [{ type: "text", text: outcome.text }, ...rest];
+      projectedContent = [{ type: "text", text }, ...rest];
     }
     next.push({ ...message, content: projectedContent });
     changed = true;
@@ -8160,7 +8228,10 @@ function withSubagentRunContext(stream, hooks) {
 ${SUBAGENT_FINALIZATION_HINT}` } : context, options);
   };
 }
-function isRetryableSubagentFailure(message) {
+function isRetryableSubagentFailureFrom(facts) {
+  if (facts.retryable === false) return false;
+  if (facts.replayClass === "stream_lost" || facts.replayClass === "stream_lost_partial") return true;
+  const message = facts.errorMessage ?? "";
   const remoteClosure = /SSE stream (?:aborted|closed before end|ended before response completed)/i.test(message);
   const classificationText = message.replace(/econnaborted/ig, "").replace(/SSE stream aborted/ig, "remote stream closed");
   if (/\b(?:400|401|403|404|422|429)\b|quota|weekly|monthly|limit reached|exhausted|unauthorized|authentication|invalid|protocol|stopReason=length|token limit|abort/i.test(classificationText)) return false;
@@ -8178,6 +8249,13 @@ function cancellableBackoff(ms, signal) {
     if (signal?.aborted) finish();
   });
 }
+function factsOf(error) {
+  if (error instanceof Error) {
+    const carrier = error;
+    return { errorMessage: error.message, retryable: carrier.retryable, replayClass: carrier.replayClass };
+  }
+  return { errorMessage: String(error) };
+}
 function withSubagentResponseRecovery(stream, backoffMs = 2e3, onRetry, onActivity, hooks) {
   return async (model, context, options) => {
     for (let attempt = 0; ; attempt++) {
@@ -8225,7 +8303,7 @@ function withSubagentResponseRecovery(stream, backoffMs = 2e3, onRetry, onActivi
         message = terminal;
       } catch (error) {
         finishUsage?.();
-        if (!options?.signal?.aborted && attempt < 2 && isRetryableSubagentFailure(error instanceof Error ? error.message : String(error))) {
+        if (!options?.signal?.aborted && attempt < 2 && isRetryableSubagentFailureFrom(factsOf(error))) {
           try {
             onRetry?.();
           } catch {
@@ -8236,7 +8314,7 @@ function withSubagentResponseRecovery(stream, backoffMs = 2e3, onRetry, onActivi
         throw error;
       }
       if (options?.signal?.aborted) throw new Error("Subagent aborted by parent");
-      if (message.stopReason === "error" && attempt < 2 && isRetryableSubagentFailure(message.errorMessage ?? "")) {
+      if (message.stopReason === "error" && attempt < 2 && isRetryableSubagentFailureFrom({ errorMessage: message.errorMessage, retryable: message.retryable, replayClass: message.replayClass })) {
         try {
           onRetry?.();
         } catch {
@@ -8385,8 +8463,16 @@ var PROTECTED_POSIX_PATHS = /* @__PURE__ */ new Set([
   "/Volumes"
 ]);
 var POWERSHELL_DESTRUCTIVE_PATTERNS = [
-  { pattern: /\bRemove-Item\b[^;\n|]*(?:-Recurse|-Force)/i, warning: "may recursively or forcefully remove files", commandClass: "filesystem_write" },
-  { pattern: /\bRemove-Item\b[^;\n|]*(?:HKLM:|HKCU:|Registry::)/i, warning: "may remove registry entries", commandClass: "infra_destructive" },
+  // PowerShell resolves these aliases before execution. The classifier must
+  // treat the aliases exactly like their canonical cmdlets; otherwise a
+  // guarded shell can run `ri -Recurse -Force` without the confirmation that
+  // `Remove-Item -Recurse -Force` receives.
+  { pattern: /\b(?:Remove-Item|ri|rm|rmdir|del|erase|rd)\b[^;\n|]*(?:-Recurse|-Force)\b/i, warning: "may recursively or forcefully remove files", commandClass: "filesystem_write" },
+  { pattern: /\b(?:Remove-Item|ri|rm|rmdir|del|erase|rd)\b[^;\n|]*(?:HKLM:|HKCU:|Registry::)/i, warning: "may remove registry entries", commandClass: "infra_destructive" },
+  // These write aliases are not all destructive in the recursive-delete sense,
+  // but they can overwrite or create arbitrary files. Keep them behind the
+  // same explicit shell confirmation boundary as other PowerShell writes.
+  { pattern: /\b(?:Set-Content|sc|set|Add-Content|ac|add|New-Item|ni|md|mkdir|Copy-Item|cpi|cp|copy|Move-Item|mi|mv|move|Rename-Item|rni|ren)\b/i, warning: "may write or overwrite files", commandClass: "filesystem_write" },
   { pattern: /\b(Set-ExecutionPolicy|Start-Process\b[^;\n|]*-Verb\s+RunAs)\b/i, warning: "may change execution policy or request elevation", commandClass: "privilege_escalation" },
   { pattern: /\b(Stop-Computer|Restart-Computer)\b/i, warning: "may stop or restart the machine", commandClass: "infra_destructive" },
   { pattern: /(^|[;|&\n])\s*(?:Invoke-Expression|iex)\b/i, warning: "evaluates a dynamically constructed string as code", commandClass: "privilege_escalation" },
@@ -8411,9 +8497,6 @@ function lastPipelineCommand(command) {
   const segments = command.split("|").map((part) => part.trim()).filter(Boolean);
   return segments[segments.length - 1] || command;
 }
-function classifyBashCommand(command, options) {
-  return classifyShellCommand(command, "bash", options);
-}
 function splitShellSegments(command) {
   const segments = [];
   let current = "";
@@ -8595,6 +8678,66 @@ function resolveStaticCwdTarget(target, cwd, root) {
   if (resolved !== normalizedRoot && !isStrictDescendant(resolved, normalizedRoot)) return void 0;
   return resolved;
 }
+var DYNAMIC_EXECUTION_WARNING = "may execute nested shell or interpreter code";
+function executableName(word) {
+  const normalized = word.replace(/\\/g, "/").toLowerCase();
+  const base = normalized.slice(normalized.lastIndexOf("/") + 1);
+  return base.endsWith(".exe") ? base.slice(0, -4) : base;
+}
+function hasDynamicExecutionInvocation(words) {
+  if (words.length === 0) return false;
+  const program = executableName(words[0]);
+  if (program === "env" || program === "command" || program === "exec") {
+    let index = 1;
+    while (index < words.length && (words[index].startsWith("-") || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[index]))) index += 1;
+    return index < words.length && hasDynamicExecutionInvocation(words.slice(index));
+  }
+  if (["bash", "sh", "zsh", "dash", "ksh", "fish"].includes(program)) {
+    return words.slice(1).some((word) => /^-[^-]*c$/i.test(word) || /^--command(?:=|$)/i.test(word));
+  }
+  if (["pwsh", "powershell"].includes(program)) {
+    return words.slice(1).some((word) => /^-(?:c|command|encodedcommand|e|file)(?:=|$)/i.test(word));
+  }
+  if (program === "cmd") {
+    return words.slice(1).some((word) => /^\/(?:c|k)$/i.test(word));
+  }
+  if (["python", "python3", "python2", "perl", "ruby"].includes(program)) {
+    return words.slice(1).some((word) => /^(?:-c|-e|-m)$/i.test(word));
+  }
+  if (program === "node") {
+    return words.slice(1).some((word) => /^(?:-e|--eval|-p|--print|-r|--require)$/i.test(word));
+  }
+  if (program === "find") {
+    return words.slice(1).some((word) => /^-(?:exec|execdir|ok|okdir)$/.test(word));
+  }
+  if (program === "rg") {
+    return words.slice(1).some((word) => /^--pre(?:=|$)|^--pre-glob(?:=|$)/.test(word));
+  }
+  if (program === "xargs") {
+    const optionsWithValues = /* @__PURE__ */ new Set(["-a", "-d", "-E", "-I", "-L", "-n", "-P", "-s"]);
+    let index = 1;
+    while (index < words.length && words[index].startsWith("-")) {
+      if (optionsWithValues.has(words[index])) index += 1;
+      index += 1;
+    }
+    return index < words.length && hasDynamicExecutionInvocation(words.slice(index));
+  }
+  return false;
+}
+function dynamicExecutionWarnings(command) {
+  const warnings = [];
+  for (const segment of splitShellSegments(command)) {
+    const words = splitShellWords(segment);
+    if (words) {
+      if (hasDynamicExecutionInvocation(words)) warnings.push(DYNAMIC_EXECUTION_WARNING);
+      continue;
+    }
+    if (/^(?:[A-Za-z]:[\\/]|[./])?(?:bash|sh|zsh|dash|ksh|fish|pwsh|powershell|cmd|python\d*|node|perl|ruby)\b[^|;&\n]*(?:\s-c(?:\s|$)|\s--?(?:command|encodedcommand|eval|execute|file)(?:[=\s]|$)|\s\/(?:c|k)(?:\s|$))/i.test(segment.trim())) {
+      warnings.push(DYNAMIC_EXECUTION_WARNING);
+    }
+  }
+  return [...new Set(warnings)];
+}
 function isStaticallyScopedRecursiveForceRemove(command, options) {
   if (!options?.cwd) return false;
   const root = options.sandboxRoot || options.cwd;
@@ -8636,6 +8779,12 @@ function classifyShellCommand(command, shell = "bash", options) {
       destructive = true;
     }
   }
+  const dynamicWarnings = dynamicExecutionWarnings(command);
+  if (dynamicWarnings.length > 0) {
+    warnings.push(...dynamicWarnings);
+    commandClass = "unknown_shell";
+    destructive = true;
+  }
   for (const entry of destructivePatterns) {
     if (entry.pattern.test(command)) {
       warnings.push(entry.warning);
@@ -8811,7 +8960,8 @@ function wrapBashGuard(tool, plan) {
 Subagent guarded mode blocks destructive shell commands while preserving the parent's execution checks. Destructive commands are blocked; normal diagnostic, search, test, and build commands are allowed.`,
     execute: async (toolCallId, params, signal, onUpdate) => {
       const command = typeof params?.command === "string" ? params.command : "";
-      const classification = classifyBashCommand(command);
+      const shell = resolveRequestShellKind(params?.shell);
+      const classification = classifyShellCommand(command, shell);
       if (classification.destructive) {
         const reason = `destructive shell command blocked for subagent: ${classification.riskWarnings.join("; ")}`;
         plan.toolsExcluded.push({ name: tool.name, reason });
@@ -9427,7 +9577,11 @@ ${DELEGATION_REPORT_INSTRUCTION}`;
         throw new Error(`Subagent output token limit reached (stopReason=length): the provider cut the final response before the report was produced${messages.some(messageHasOwnText) ? " (earlier-turn narration discarded)" : ", no text response"}. The output/thinking budget was too small for this task at its reasoning level. Rerun with a narrower task or a lower thinkingLevel.`);
       }
       const detail = terminalError ? `: ${terminalError.slice(0, 200)}` : "";
-      throw new Error(`Subagent response failed (provider/transport failure before the report was produced, stopReason=${terminalStopReason ?? "none"}${collectedResponse ? ", partial transcript discarded" : ", no text response"})${detail}`);
+      const failure = new Error(`Subagent response failed (provider/transport failure before the report was produced, stopReason=${terminalStopReason ?? "none"}${collectedResponse ? ", partial transcript discarded" : ", no text response"})${detail}`);
+      const carrier = failure;
+      carrier.retryable = lastAssistant?.retryable;
+      carrier.replayClass = lastAssistant?.replayClass;
+      throw failure;
     }
     let response;
     if (!collectedResponse) {
@@ -9445,6 +9599,7 @@ ${DELEGATION_REPORT_INSTRUCTION}`;
     }
     const durationMs = Date.now() - startTime;
     task.status = "completed";
+    task.failure = void 0;
     observeDelegationPhase(task.observation, "completed");
     task.result = response;
     task.details = {
@@ -9471,6 +9626,12 @@ ${DELEGATION_REPORT_INSTRUCTION}`;
     observeDelegationPhase(task.observation, timedOut ? "deadline" : signal?.aborted ? "cancelled" : "failed");
     phaseProgress(task.observation.phase);
     task.error = errorMessage.slice(0, 2e3);
+    const failureCarrier = error;
+    if (failureCarrier && (failureCarrier.retryable !== void 0 || failureCarrier.replayClass !== void 0)) {
+      task.failure = { ...failureCarrier.retryable !== void 0 ? { retryable: failureCarrier.retryable } : {}, ...failureCarrier.replayClass !== void 0 ? { replayClass: failureCarrier.replayClass } : {} };
+    } else {
+      task.failure = void 0;
+    }
     task.report ??= parseDelegationReport(void 0, task.id);
     task.parentHandoffRequired = isParentHandoffRequired(task);
     task.completedAt = Date.now();
@@ -9807,7 +9968,7 @@ ${SPAWN_USAGE_HINT}` }],
         await run(task, toolContext.reportProgress, signal);
         if (task.wasRecall || task.mode !== "read" || task.status !== "failed" || !task.error) return;
         if (signal?.aborted) return;
-        if (!isRetryableSubagentFailure(task.error)) return;
+        if (!isRetryableSubagentFailureFrom({ errorMessage: task.error, retryable: task.failure?.retryable, replayClass: task.failure?.replayClass })) return;
         observeDelegationPhase(task.observation, "task_replay");
         const settleMs = Math.max(0, (deps.transientRetryBackoffMs ?? 2e3) * 10);
         toolContext.reportProgress?.({ message: `[${task.name}] Provider/transport failure \u2014 replaying the read task once after ${Math.round(settleMs / 1e3)}s`, increment: 0 });
@@ -9815,6 +9976,7 @@ ${SPAWN_USAGE_HINT}` }],
         if (signal.aborted) {
           task.status = "cancelled";
           task.error = "Subagent cancelled during replay backoff";
+          task.failure = void 0;
           observeDelegationPhase(task.observation, "cancelled");
           task.completedAt = Date.now();
           return;
@@ -9824,6 +9986,7 @@ ${SPAWN_USAGE_HINT}` }],
         task.runtimeEvidence = [];
         task.reportedEvidence = [];
         task.error = void 0;
+        task.failure = void 0;
         task.report = void 0;
         task.result = void 0;
         task.details = void 0;
@@ -9877,6 +10040,10 @@ ${SPAWN_USAGE_HINT}` }],
             observation: task.observation,
             parentHandoffRequired: task.parentHandoffRequired,
             failureReason: task.error,
+            // Structured provider verdict so the parent model can distinguish
+            // stream loss (safe to re-dispatch; no tool calls executed) from hard
+            // provider vetoes (auth/quota/config — not recoverable here).
+            failure: task.failure,
             details: task.details
           })),
           totalDuration,
@@ -10534,6 +10701,164 @@ function createAskUserCapability() {
   };
 }
 
+// ../../packages/shared-headless-capabilities/src/policy-enforcer.ts
+var POLICY_ENFORCED = /* @__PURE__ */ Symbol.for("pie.capabilityPolicy.enforced");
+function evaluateToolPermission(tool, context = {}) {
+  const mode = context.mode ?? "normal";
+  const metadata = getToolCapabilityMetadata(tool);
+  const base = describeToolPolicyDecision(tool, mode);
+  if (!metadata && mode === "normal") {
+    return {
+      disposition: "allow",
+      allowed: true,
+      reason: "unclassified_tool",
+      policyReason: "unclassified_tool",
+      mode,
+      yoloMode: context.yoloMode
+    };
+  }
+  if (!metadata || !base.allowed) {
+    return {
+      disposition: "deny",
+      allowed: false,
+      reason: base.reason ?? "tool not allowed by runtime policy",
+      policyReason: base.reason ?? "tool not allowed by runtime policy",
+      mode,
+      yoloMode: context.yoloMode,
+      riskClass: metadata?.riskClass,
+      permissionScope: metadata?.permissionScope,
+      requiresPermission: metadata?.requiresPermission
+    };
+  }
+  const requiresConfirmation = Boolean(metadata.highRisk || metadata.requiresPermission);
+  if (!requiresConfirmation || context.yoloMode || context.confirmationPolicy === "allow") {
+    return {
+      disposition: "allow",
+      allowed: true,
+      mode,
+      yoloMode: context.yoloMode,
+      riskClass: metadata.riskClass,
+      permissionScope: metadata.permissionScope,
+      requiresPermission: requiresConfirmation
+    };
+  }
+  if (context.confirmationPolicy === "deny" || mode === "subagent") {
+    const reason = mode === "subagent" ? "subagent cannot request interactive permission" : "permission confirmation is unavailable";
+    return {
+      disposition: "deny",
+      allowed: false,
+      reason,
+      policyReason: reason,
+      mode,
+      yoloMode: context.yoloMode,
+      riskClass: metadata.riskClass,
+      permissionScope: metadata.permissionScope,
+      requiresPermission: true
+    };
+  }
+  return {
+    disposition: "confirm",
+    allowed: false,
+    reason: "permission confirmation required",
+    policyReason: "permission confirmation required",
+    mode,
+    yoloMode: context.yoloMode,
+    riskClass: metadata.riskClass,
+    permissionScope: metadata.permissionScope,
+    requiresPermission: true
+  };
+}
+function blockedResult(toolName, decision) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: `Blocked ${toolName}: ${decision.reason ?? decision.policyReason ?? "permission denied"}`
+      }
+    ],
+    details: { permissionDecision: decision },
+    isError: true
+  };
+}
+function planModeShellCommandBlocked(target, args) {
+  const metadata = getToolCapabilityMetadata(target);
+  if (!metadata?.executesShell) return void 0;
+  const command = args?.command;
+  if (typeof command !== "string") {
+    return `Plan mode: shell tool received no command to validate. Use plan_scratch for temporary drafts, submit the finished plan with plan_submit, or toggle Plan mode off (/tools/plan) to execute.`;
+  }
+  const shell = resolveRequestShellKind(args?.shell);
+  if (isPlanModeSafeCommand(command, shell)) return void 0;
+  return `Plan mode: command "${command}" is not a read-only ${shell} command. Use plan_scratch for temporary drafts, submit the finished plan with plan_submit, or toggle Plan mode off (/tools/plan) to execute.`;
+}
+function mergePermissionDetails(details, decision) {
+  if (details && typeof details === "object" && !Array.isArray(details)) {
+    const record = details;
+    if (record.permissionDecision) {
+      return { ...record, capabilityPolicyDecision: decision };
+    }
+    return { ...record, permissionDecision: decision };
+  }
+  return { permissionDecision: decision };
+}
+function createPolicyEnforcedTool(tool, options = {}) {
+  const marker = tool[POLICY_ENFORCED];
+  const intactWrapper = !!marker && marker.wrapperExecute === tool.execute;
+  if (intactWrapper && marker.getContext === options.getContext && marker.permissionProvider === options.permissionProvider) {
+    return tool;
+  }
+  const target = intactWrapper ? marker.base : tool;
+  const wrapped = {
+    ...target,
+    execute: async (toolCallId, args, signal, onUpdate) => {
+      let decision = evaluateToolPermission(target, options.getContext?.());
+      if (decision.disposition === "confirm") {
+        const approved = await options.permissionProvider?.confirm({ toolName: target.name, args, decision }).catch(() => false);
+        if (!approved) {
+          return blockedResult(target.name, {
+            ...decision,
+            disposition: "deny",
+            reason: "permission denied by user",
+            policyReason: "permission denied by user"
+          });
+        }
+        decision = {
+          ...decision,
+          disposition: "allow",
+          allowed: true,
+          reason: void 0,
+          policyReason: void 0
+        };
+      }
+      if (!decision.allowed) return blockedResult(target.name, decision);
+      const planShellReason = (options.getContext?.().mode ?? "normal") === "plan" ? planModeShellCommandBlocked(target, args) : void 0;
+      if (planShellReason) {
+        return blockedResult(target.name, {
+          ...decision,
+          allowed: false,
+          reason: planShellReason,
+          policyReason: "plan_mode_non_read_only_shell_command"
+        });
+      }
+      const result = await target.execute(toolCallId, args, signal, onUpdate);
+      return {
+        ...result,
+        details: mergePermissionDetails(result.details, decision)
+      };
+    }
+  };
+  wrapped[POLICY_ENFORCED] = {
+    getContext: options.getContext,
+    permissionProvider: options.permissionProvider,
+    wrapperExecute: wrapped.execute,
+    base: target
+  };
+  return wrapped;
+}
+function createPolicyEnforcedTools(tools, options = {}) {
+  return tools.map((tool) => createPolicyEnforcedTool(tool, options));
+}
+
 // ../../packages/shared-headless-capabilities/src/builtin/fs/read.ts
 import * as nodePath from "node:path";
 
@@ -16937,144 +17262,6 @@ function maybeAdvanceTodoExecutionState(state, signal) {
   };
 }
 
-// ../../packages/shared-headless-capabilities/src/policy-enforcer.ts
-var POLICY_ENFORCED = /* @__PURE__ */ Symbol.for("pie.capabilityPolicy.enforced");
-function evaluateToolPermission(tool, context = {}) {
-  const mode = context.mode ?? "normal";
-  const metadata = getToolCapabilityMetadata(tool);
-  const base = describeToolPolicyDecision(tool, mode);
-  if (!metadata && mode === "normal") {
-    return {
-      disposition: "allow",
-      allowed: true,
-      reason: "unclassified_tool",
-      policyReason: "unclassified_tool",
-      mode,
-      yoloMode: context.yoloMode
-    };
-  }
-  if (!metadata || !base.allowed) {
-    return {
-      disposition: "deny",
-      allowed: false,
-      reason: base.reason ?? "tool not allowed by runtime policy",
-      policyReason: base.reason ?? "tool not allowed by runtime policy",
-      mode,
-      yoloMode: context.yoloMode,
-      riskClass: metadata?.riskClass,
-      permissionScope: metadata?.permissionScope,
-      requiresPermission: metadata?.requiresPermission
-    };
-  }
-  const requiresConfirmation = Boolean(metadata.highRisk || metadata.requiresPermission);
-  if (!requiresConfirmation || context.yoloMode || context.confirmationPolicy === "allow") {
-    return {
-      disposition: "allow",
-      allowed: true,
-      mode,
-      yoloMode: context.yoloMode,
-      riskClass: metadata.riskClass,
-      permissionScope: metadata.permissionScope,
-      requiresPermission: requiresConfirmation
-    };
-  }
-  if (context.confirmationPolicy === "deny" || mode === "subagent") {
-    const reason = mode === "subagent" ? "subagent cannot request interactive permission" : "permission confirmation is unavailable";
-    return {
-      disposition: "deny",
-      allowed: false,
-      reason,
-      policyReason: reason,
-      mode,
-      yoloMode: context.yoloMode,
-      riskClass: metadata.riskClass,
-      permissionScope: metadata.permissionScope,
-      requiresPermission: true
-    };
-  }
-  return {
-    disposition: "confirm",
-    allowed: false,
-    reason: "permission confirmation required",
-    policyReason: "permission confirmation required",
-    mode,
-    yoloMode: context.yoloMode,
-    riskClass: metadata.riskClass,
-    permissionScope: metadata.permissionScope,
-    requiresPermission: true
-  };
-}
-function blockedResult(toolName, decision) {
-  return {
-    content: [
-      {
-        type: "text",
-        text: `Blocked ${toolName}: ${decision.reason ?? decision.policyReason ?? "permission denied"}`
-      }
-    ],
-    details: { permissionDecision: decision },
-    isError: true
-  };
-}
-function mergePermissionDetails(details, decision) {
-  if (details && typeof details === "object" && !Array.isArray(details)) {
-    const record = details;
-    if (record.permissionDecision) {
-      return { ...record, capabilityPolicyDecision: decision };
-    }
-    return { ...record, permissionDecision: decision };
-  }
-  return { permissionDecision: decision };
-}
-function createPolicyEnforcedTool(tool, options = {}) {
-  const marker = tool[POLICY_ENFORCED];
-  const intactWrapper = !!marker && marker.wrapperExecute === tool.execute;
-  if (intactWrapper && marker.getContext === options.getContext && marker.permissionProvider === options.permissionProvider) {
-    return tool;
-  }
-  const target = intactWrapper ? marker.base : tool;
-  const wrapped = {
-    ...target,
-    execute: async (toolCallId, args, signal, onUpdate) => {
-      let decision = evaluateToolPermission(target, options.getContext?.());
-      if (decision.disposition === "confirm") {
-        const approved = await options.permissionProvider?.confirm({ toolName: target.name, args, decision }).catch(() => false);
-        if (!approved) {
-          return blockedResult(target.name, {
-            ...decision,
-            disposition: "deny",
-            reason: "permission denied by user",
-            policyReason: "permission denied by user"
-          });
-        }
-        decision = {
-          ...decision,
-          disposition: "allow",
-          allowed: true,
-          reason: void 0,
-          policyReason: void 0
-        };
-      }
-      if (!decision.allowed) return blockedResult(target.name, decision);
-      const result = await target.execute(toolCallId, args, signal, onUpdate);
-      return {
-        ...result,
-        details: mergePermissionDetails(result.details, decision)
-      };
-    }
-  };
-  wrapped[POLICY_ENFORCED] = {
-    getContext: options.getContext,
-    permissionProvider: options.permissionProvider,
-    wrapperExecute: wrapped.execute,
-    base: target
-  };
-  return wrapped;
-}
-function createPolicyEnforcedTools(tools, options = {}) {
-  return tools.map((tool) => createPolicyEnforcedTool(tool, options));
-}
-
 // ../../packages/shared-headless-capabilities/src/system-prompt-tools.ts
 function normalizeDescription(description) {
   const text = String(description || "").replace(/\s+/g, " ").trim();
@@ -19494,10 +19681,9 @@ export {
   supersedeExecutionState,
   shouldPreserveExecutionStateForUserText,
   BUILTIN_TOOL_CAPABILITY_METADATA,
-  getToolCapabilityMetadata,
   isToolAllowedInPlanMode,
+  defaultShellKindForPlatform,
   extractPlanTodoItems,
-  isPlanModeSafeCommand,
   markCompletedPlanSteps,
   createPlanCapability,
   modalityForReadFileUnderstandingKind,