@dexto/core 1.5.8 → 1.6.0

package/dist/tools/tool-manager.js

@@ -4,45 +4,40 @@ import {
   __runInitializers
 } from "../chunk-PTJYTZNU.js";
 var _ToolManager_decorators, _init;
-import { InternalToolsProvider } from "./internal-tools/provider.js";
 import { ToolError } from "./errors.js";
 import { ToolErrorCode } from "./error-codes.js";
 import { DextoRuntimeError } from "../errors/index.js";
 import { DextoLogComponent } from "../logger/v2/types.js";
+import { convertZodSchemaToJsonSchema } from "../utils/schema.js";
 import { ApprovalStatus, ApprovalType, DenialReason } from "../approval/types.js";
 import { InstrumentClass } from "../telemetry/decorators.js";
 import { extractToolCallMeta, wrapToolParametersSchema } from "./tool-call-metadata.js";
-import {
-  generateBashPatternKey,
-  generateBashPatternSuggestions,
-  isDangerousCommand
-} from "./bash-pattern-utils.js";
 import { isBackgroundTasksEnabled } from "../utils/env.js";
 _ToolManager_decorators = [InstrumentClass({
   prefix: "tool",
-  excludeMethods: [
-    "setPluginManager",
-    "setStateManager",
-    "getApprovalManager",
-    "getAllowedToolsProvider"
-  ]
+  excludeMethods: ["setHookSupport", "getApprovalManager", "getAllowedToolsProvider"]
 })];
 let _ToolManager = class _ToolManager {
   mcpManager;
-  internalToolsProvider;
+  agentTools = /* @__PURE__ */ new Map();
   approvalManager;
   allowedToolsProvider;
   approvalMode;
   agentEventBus;
   toolPolicies;
-  // Plugin support - set after construction to avoid circular dependencies
-  pluginManager;
+  toolExecutionContextFactory;
+  // Hook support - set after construction to avoid circular dependencies
+  hookManager;
   sessionManager;
   stateManager;
-  // Tool source prefixing - ALL tools get prefixed by source
+  workspaceManager;
+  currentWorkspace;
+  workspaceListenerAttached = false;
+  workspaceListenerAbort = new AbortController();
+  // Tool naming:
+  // - MCP tools are prefixed with `mcp--` for disambiguation.
+  // - Local tools use their `Tool.id` as-is (no internal/custom prefixing).
   static MCP_TOOL_PREFIX = "mcp--";
-  static INTERNAL_TOOL_PREFIX = "internal--";
-  static CUSTOM_TOOL_PREFIX = "custom--";
   // Tool caching for performance
   toolsCache = {};
   cacheValid = false;
@@ -55,7 +50,29 @@ let _ToolManager = class _ToolManager {
   sessionUserAutoApproveTools = /* @__PURE__ */ new Map();
   sessionDisabledTools = /* @__PURE__ */ new Map();
   globalDisabledTools = [];
-  constructor(mcpManager, approvalManager, allowedToolsProvider, approvalMode, agentEventBus, toolPolicies, options, logger) {
+  cleanupHandlers = /* @__PURE__ */ new Set();
+  cleanupStarted = false;
+  resolveLocalToolIdOrAlias(name) {
+    const direct = this.agentTools.get(name);
+    if (direct) return direct.id;
+    const lower = name.toLowerCase();
+    for (const tool of this.agentTools.values()) {
+      if (tool.id.toLowerCase() === lower) {
+        return tool.id;
+      }
+      if (tool.aliases?.some((alias) => alias.toLowerCase() === lower)) {
+        return tool.id;
+      }
+    }
+    return null;
+  }
+  normalizeToolPolicyPattern(pattern) {
+    if (pattern.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return pattern;
+    }
+    return this.resolveLocalToolIdOrAlias(pattern) ?? pattern;
+  }
+  constructor(mcpManager, approvalManager, allowedToolsProvider, approvalMode, agentEventBus, toolPolicies, tools, logger) {
     this.mcpManager = mcpManager;
     this.approvalManager = approvalManager;
     this.allowedToolsProvider = allowedToolsProvider;
@@ -63,18 +80,12 @@ let _ToolManager = class _ToolManager {
     this.agentEventBus = agentEventBus;
     this.toolPolicies = toolPolicies;
     this.logger = logger.createChild(DextoLogComponent.TOOLS);
-    if (options?.internalToolsConfig && options.internalToolsConfig.length > 0 || options?.customToolsConfig && options.customToolsConfig.length > 0) {
-      const internalToolsServices = {
-        ...options.internalToolsServices,
-        approvalManager
-      };
-      this.internalToolsProvider = new InternalToolsProvider(
-        internalToolsServices,
-        options.internalToolsConfig || [],
-        options.customToolsConfig || [],
-        this.logger
+    this.setTools(tools);
+    this.toolExecutionContextFactory = () => {
+      throw ToolError.configInvalid(
+        "ToolExecutionContextFactory not configured. DextoAgent.start() must configure tool execution context before tools can run."
       );
-    }
+    };
     this.setupNotificationListeners();
     this.logger.debug("ToolManager initialized");
   }
@@ -82,50 +93,78 @@ let _ToolManager = class _ToolManager {
    * Initialize the ToolManager and its components
    */
   async initialize() {
-    if (this.internalToolsProvider) {
-      await this.internalToolsProvider.initialize();
-    }
     this.logger.debug("ToolManager initialization complete");
   }
+  setTools(tools) {
+    this.agentTools.clear();
+    for (const tool of tools) {
+      this.agentTools.set(tool.id, tool);
+    }
+    this.invalidateCache();
+  }
+  setToolExecutionContextFactory(factory) {
+    this.toolExecutionContextFactory = factory;
+  }
+  registerCleanup(handler) {
+    this.cleanupHandlers.add(handler);
+  }
+  async cleanup() {
+    if (this.cleanupStarted) {
+      return;
+    }
+    this.cleanupStarted = true;
+    for (const handler of this.cleanupHandlers) {
+      try {
+        await handler();
+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        this.logger.warn(`ToolManager cleanup handler failed: ${err.message}`, {
+          color: "yellow"
+        });
+      }
+    }
+  }
   /**
-   * Set plugin support services (called after construction to avoid circular dependencies)
+   * Set hook support services (called after construction to avoid circular dependencies)
    */
-  setPluginSupport(pluginManager, sessionManager, stateManager) {
-    this.pluginManager = pluginManager;
+  setHookSupport(hookManager, sessionManager, stateManager) {
+    this.hookManager = hookManager;
     this.sessionManager = sessionManager;
     this.stateManager = stateManager;
-    this.logger.debug("Plugin support configured for ToolManager");
+    this.logger.debug("Hook support configured for ToolManager");
   }
   /**
-   * Set agent reference for custom tools (called after construction to avoid circular dependencies)
-   * Must be called before initialize() if custom tools are configured
+   * Set workspace manager for tool execution context propagation.
    */
-  setAgent(agent) {
-    if (this.internalToolsProvider) {
-      this.internalToolsProvider.setAgent(agent);
-      this.logger.debug("Agent reference configured for custom tools");
+  setWorkspaceManager(workspaceManager) {
+    this.workspaceManager = workspaceManager;
+    void this.refreshWorkspace();
+    if (!this.workspaceListenerAttached) {
+      this.workspaceListenerAttached = true;
+      this.agentEventBus.on(
+        "workspace:changed",
+        (payload) => {
+          this.currentWorkspace = payload.workspace ?? void 0;
+        },
+        { signal: this.workspaceListenerAbort.signal }
+      );
+      this.registerCleanup(() => {
+        if (!this.workspaceListenerAbort.signal.aborted) {
+          this.workspaceListenerAbort.abort();
+        }
+      });
     }
+    this.logger.debug("WorkspaceManager reference configured for ToolManager");
   }
-  /**
-   * Set prompt manager for invoke_skill tool (called after construction to avoid circular dependencies)
-   * Must be called before initialize() if invoke_skill tool is enabled
-   */
-  setPromptManager(promptManager) {
-    if (this.internalToolsProvider) {
-      this.internalToolsProvider.setPromptManager(promptManager);
-      this.logger.debug("PromptManager reference configured for invoke_skill tool");
+  async refreshWorkspace() {
+    if (!this.workspaceManager) {
+      return;
     }
-  }
-  /**
-   * Set task forker for context:fork skill execution (late-binding)
-   * Called by agent-spawner custom tool provider after RuntimeService is created.
-   * This enables invoke_skill to fork execution to an isolated subagent.
-   */
-  setTaskForker(taskForker) {
-    if (this.internalToolsProvider) {
-      this.internalToolsProvider.setTaskForker(taskForker);
+    try {
+      this.currentWorkspace = await this.workspaceManager.getWorkspace();
+    } catch (error) {
       this.logger.debug(
-        "TaskForker reference configured for invoke_skill (context:fork support)"
+        `Failed to refresh workspace context: ${error instanceof Error ? error.message : String(error)}`
       );
     }
   }
@@ -136,18 +175,21 @@ let _ToolManager = class _ToolManager {
    * This is ADDITIVE - other tools are NOT blocked, they just go through normal approval flow.
    *
    * @param sessionId The session ID
-   * @param autoApproveTools Array of tool names to auto-approve (e.g., ['custom--bash_exec', 'custom--read_file'])
+   * @param autoApproveTools Array of tool names to auto-approve (e.g., ['bash_exec', 'mcp--read_file'])
    */
   setSessionAutoApproveTools(sessionId, autoApproveTools) {
     if (autoApproveTools.length === 0) {
       this.clearSessionAutoApproveTools(sessionId);
       return;
     }
-    this.sessionAutoApproveTools.set(sessionId, autoApproveTools);
+    const normalized = autoApproveTools.map(
+      (pattern) => this.normalizeToolPolicyPattern(pattern)
+    );
+    this.sessionAutoApproveTools.set(sessionId, normalized);
     this.logger.info(
       `Session auto-approve tools set for '${sessionId}': ${autoApproveTools.length} tools`
     );
-    this.logger.debug(`Auto-approve tools: ${autoApproveTools.join(", ")}`);
+    this.logger.debug(`Auto-approve tools: ${normalized.join(", ")}`);
   }
   /**
    * Set session-level auto-approve tools chosen by the user.
@@ -157,11 +199,14 @@ let _ToolManager = class _ToolManager {
       this.clearSessionUserAutoApproveTools(sessionId);
       return;
     }
-    this.sessionUserAutoApproveTools.set(sessionId, autoApproveTools);
+    const normalized = autoApproveTools.map(
+      (pattern) => this.normalizeToolPolicyPattern(pattern)
+    );
+    this.sessionUserAutoApproveTools.set(sessionId, normalized);
     this.logger.info(
       `Session user auto-approve tools set for '${sessionId}': ${autoApproveTools.length} tools`
     );
-    this.logger.debug(`User auto-approve tools: ${autoApproveTools.join(", ")}`);
+    this.logger.debug(`User auto-approve tools: ${normalized.join(", ")}`);
   }
   /**
    * Clear session-level auto-approve tools chosen by the user.
@@ -338,39 +383,44 @@ let _ToolManager = class _ToolManager {
       }
     });
   }
-  // ==================== Bash Pattern Approval Helpers ====================
-  /**
-   * Check if a tool name represents a bash execution tool
-   */
-  isBashTool(toolName) {
-    return toolName === "bash_exec" || toolName === "internal--bash_exec" || toolName === "custom--bash_exec";
+  // ==================== Pattern Approval Helpers ====================
+  getToolPatternKey(toolName, args) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return null;
+    }
+    const tool = this.agentTools.get(toolName);
+    if (!tool?.getApprovalPatternKey) {
+      return null;
+    }
+    try {
+      return tool.getApprovalPatternKey(args);
+    } catch (error) {
+      this.logger.debug(
+        `Pattern key generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
+      );
+      return null;
+    }
   }
-  /**
-   * Check if a bash command is covered by any approved pattern.
-   * Generates a pattern key from the command, then checks if it's covered by stored patterns.
-   *
-   * Returns approval info if covered, or pattern suggestions if not.
-   */
-  checkBashPatternApproval(command) {
-    const patternKey = generateBashPatternKey(command);
-    if (!patternKey) {
-      if (isDangerousCommand(command)) {
-        this.logger.debug(
-          `Skipping pattern generation for dangerous command: ${command.split(/\s+/)[0]}`
-        );
-      }
-      return { approved: false, suggestedPatterns: [] };
+  getToolSuggestedPatterns(toolName, args) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return void 0;
     }
-    if (this.approvalManager.matchesBashPattern(patternKey)) {
-      return { approved: true };
+    const tool = this.agentTools.get(toolName);
+    if (!tool?.suggestApprovalPatterns) {
+      return void 0;
+    }
+    try {
+      const patterns = tool.suggestApprovalPatterns(args);
+      return patterns.length > 0 ? patterns : void 0;
+    } catch (error) {
+      this.logger.debug(
+        `Pattern suggestion failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
+      );
+      return void 0;
     }
-    return {
-      approved: false,
-      suggestedPatterns: generateBashPatternSuggestions(command)
-    };
   }
   /**
-   * Auto-approve pending tool confirmation requests for the same tool.
+   * Auto-approve pending tool approval requests for the same tool.
    * Called after a user selects "remember choice" for a tool.
    * This handles the case where parallel tool calls come in before the first one is approved.
    *
@@ -380,7 +430,7 @@ let _ToolManager = class _ToolManager {
   autoApprovePendingToolRequests(toolName, sessionId) {
     const count = this.approvalManager.autoApprovePendingRequests(
       (request) => {
-        if (request.type !== ApprovalType.TOOL_CONFIRMATION) {
+        if (request.type !== ApprovalType.TOOL_APPROVAL) {
           return false;
         }
         if (request.sessionId !== sessionId) {
@@ -399,42 +449,86 @@ let _ToolManager = class _ToolManager {
     }
   }
   /**
-   * Auto-approve pending bash command requests that match a pattern.
-   * Called after a user selects "remember pattern" for a bash command.
-   * This handles the case where parallel bash commands come in before the first one is approved.
-   *
-   * @param pattern The bash pattern that was just remembered
-   * @param sessionId The session ID for context
+   * Auto-approve pending tool approval requests that are now covered by a remembered pattern.
+   * Called after a user selects "remember pattern" for a tool.
    */
-  autoApprovePendingBashRequests(pattern, sessionId) {
+  autoApprovePendingPatternRequests(toolName, sessionId) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return;
+    }
+    const tool = this.agentTools.get(toolName);
+    const getPatternKey = tool?.getApprovalPatternKey;
+    if (!getPatternKey) {
+      return;
+    }
     const count = this.approvalManager.autoApprovePendingRequests(
       (request) => {
-        if (request.type !== ApprovalType.TOOL_CONFIRMATION) {
+        if (request.type !== ApprovalType.TOOL_APPROVAL) {
           return false;
         }
         if (request.sessionId !== sessionId) {
           return false;
         }
         const metadata = request.metadata;
-        if (!this.isBashTool(metadata.toolName)) {
+        if (metadata.toolName !== toolName) {
           return false;
         }
-        const command = metadata.args?.command;
-        if (!command) {
+        const args = metadata.args;
+        if (typeof args !== "object" || args === null) {
           return false;
         }
-        const patternKey = generateBashPatternKey(command);
-        if (!patternKey) {
+        let patternKey;
+        try {
+          patternKey = getPatternKey(args);
+        } catch (error) {
+          this.logger.debug(
+            `Pattern key generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
+          );
           return false;
         }
-        return this.approvalManager.matchesBashPattern(patternKey);
+        if (!patternKey) return false;
+        return this.approvalManager.matchesPattern(toolName, patternKey);
       },
       { rememberPattern: void 0 }
-      // Don't propagate pattern to auto-approved requests
+      // Don't propagate pattern choice to auto-approved requests
     );
     if (count > 0) {
       this.logger.info(
-        `Auto-approved ${count} parallel bash command(s) matching pattern '${pattern}'`
+        `Auto-approved ${count} parallel request(s) for tool '${toolName}' after user selected "remember pattern"`
+      );
+    }
+  }
+  /**
+   * Auto-approve pending directory access requests that match a newly approved directory access request.
+   *
+   * This handles the case where parallel file operations request directory approval concurrently.
+   */
+  autoApprovePendingDirectoryAccessRequests(options) {
+    const count = this.approvalManager.autoApprovePendingRequests(
+      (request) => {
+        if (request.type !== ApprovalType.DIRECTORY_ACCESS) {
+          return false;
+        }
+        if (request.sessionId !== options.sessionId) {
+          return false;
+        }
+        const metadata = request.metadata;
+        if (typeof metadata?.parentDir !== "string" || metadata.parentDir !== options.parentDir) {
+          return false;
+        }
+        if (options.rememberDirectory) {
+          return true;
+        }
+        if (typeof metadata?.operation !== "string" || typeof metadata?.toolName !== "string") {
+          return false;
+        }
+        return metadata.operation === options.operation && metadata.toolName === options.toolName;
+      },
+      { rememberDirectory: false }
+    );
+    if (count > 0) {
+      this.logger.info(
+        `Auto-approved ${count} parallel request(s) for directory '${options.parentDir}' after directory access was approved`
       );
     }
   }
@@ -448,11 +542,66 @@ let _ToolManager = class _ToolManager {
   async getMcpTools() {
     return await this.mcpManager.getAllTools();
   }
+  buildToolExecutionContext(options) {
+    const workspace = this.currentWorkspace;
+    const baseContext = {
+      sessionId: options.sessionId,
+      workspaceId: workspace?.id,
+      workspace,
+      abortSignal: options.abortSignal,
+      toolCallId: options.toolCallId,
+      logger: this.logger
+    };
+    return this.toolExecutionContextFactory(baseContext);
+  }
+  validateLocalToolArgsOrThrow(toolName, args) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return args;
+    }
+    const tool = this.agentTools.get(toolName);
+    if (!tool) {
+      return args;
+    }
+    const validationResult = tool.inputSchema.safeParse(args);
+    if (!validationResult.success) {
+      this.logger.error(
+        `\u274C Invalid arguments for tool ${toolName}: ${validationResult.error.message}`
+      );
+      throw ToolError.validationFailed(
+        toolName,
+        `Invalid arguments: ${validationResult.error.message}`
+      );
+    }
+    const validated = validationResult.data;
+    if (typeof validated !== "object" || validated === null || Array.isArray(validated)) {
+      throw ToolError.validationFailed(toolName, "Invalid arguments: expected an object");
+    }
+    return validated;
+  }
+  async executeLocalTool(toolName, args, sessionId, abortSignal, toolCallId) {
+    const tool = this.agentTools.get(toolName);
+    if (!tool) {
+      this.logger.error(`\u274C No local tool found: ${toolName}`);
+      this.logger.debug(
+        `Available local tools: ${Array.from(this.agentTools.keys()).join(", ")}`
+      );
+      throw ToolError.notFound(toolName);
+    }
+    try {
+      const context = this.buildToolExecutionContext({ sessionId, abortSignal, toolCallId });
+      const result = await tool.execute(args, context);
+      return result;
+    } catch (error) {
+      this.logger.error(`\u274C Local tool execution failed: ${toolName}`, {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      throw error;
+    }
+  }
   /**
-   * Build all tools from sources with universal prefixing
-   * ALL tools get prefixed by their source - no exceptions
+   * Build all tools from sources.
    *
-   * TODO: Rethink tool naming convention for more consistency
+   * TODO: Rethink MCP tool naming convention for more consistency.
    * Current issue: MCP tools have dynamic naming based on conflicts:
    * - No conflict: mcp--toolName
    * - With conflict: mcp--serverName--toolName
@@ -465,8 +614,6 @@ let _ToolManager = class _ToolManager {
   async buildAllTools() {
     const allTools = {};
     let mcpTools = {};
-    let internalTools = {};
-    let customTools = {};
     try {
       mcpTools = await this.mcpManager.getAllTools();
     } catch (error) {
@@ -475,38 +622,13 @@ let _ToolManager = class _ToolManager {
       );
       mcpTools = {};
     }
-    try {
-      internalTools = this.internalToolsProvider?.getInternalTools() || {};
-    } catch (error) {
-      this.logger.error(
-        `Failed to get internal tools: ${error instanceof Error ? error.message : String(error)}`
-      );
-      internalTools = {};
-    }
-    try {
-      customTools = this.internalToolsProvider?.getCustomTools() || {};
-    } catch (error) {
-      this.logger.error(
-        `Failed to get custom tools: ${error instanceof Error ? error.message : String(error)}`
-      );
-      customTools = {};
-    }
-    for (const [toolName, toolDef] of Object.entries(internalTools)) {
-      const qualifiedName = `${_ToolManager.INTERNAL_TOOL_PREFIX}${toolName}`;
-      allTools[qualifiedName] = {
-        ...toolDef,
-        name: qualifiedName,
-        description: `${toolDef.description || "No description provided"} (internal tool)`,
-        parameters: wrapToolParametersSchema(toolDef.parameters)
-      };
-    }
-    for (const [toolName, toolDef] of Object.entries(customTools)) {
-      const qualifiedName = `${_ToolManager.CUSTOM_TOOL_PREFIX}${toolName}`;
-      allTools[qualifiedName] = {
-        ...toolDef,
-        name: qualifiedName,
-        description: `${toolDef.description || "No description provided"} (custom tool)`,
-        parameters: wrapToolParametersSchema(toolDef.parameters)
+    for (const [toolName, tool] of this.agentTools) {
+      allTools[toolName] = {
+        name: toolName,
+        description: tool.description || "No description provided",
+        parameters: wrapToolParametersSchema(
+          convertZodSchemaToJsonSchema(tool.inputSchema, this.logger)
+        )
       };
     }
     for (const [toolName, toolDef] of Object.entries(mcpTools)) {
@@ -520,10 +642,9 @@ let _ToolManager = class _ToolManager {
     }
     const totalTools = Object.keys(allTools).length;
     const mcpCount = Object.keys(mcpTools).length;
-    const internalCount = Object.keys(internalTools).length;
-    const customCount = Object.keys(customTools).length;
+    const localCount = this.agentTools.size;
     this.logger.debug(
-      `\u{1F527} Unified tool discovery: ${totalTools} total tools (${mcpCount} MCP, ${internalCount} internal, ${customCount} custom)`
+      `\u{1F527} Unified tool discovery: ${totalTools} total tools (${mcpCount} MCP, ${localCount} local)`
     );
     return allTools;
   }
@@ -541,10 +662,11 @@ let _ToolManager = class _ToolManager {
     return this.toolsCache;
   }
   /**
-   * Execute a tool by routing based on universal prefix
-   * ALL tools must have source prefix - no exceptions
+   * Execute a tool by routing based on prefix:
+   * - MCP tools: `mcp--...`
+   * - Local tools: `Tool.id`
    *
-   * @param toolName The fully qualified tool name (e.g., "internal--edit_file")
+   * @param toolName Tool name (e.g., "edit_file", "mcp--filesystem--read_file")
    * @param args The arguments for the tool
    * @param toolCallId The unique tool call ID for tracking (from LLM or generated for direct calls)
    * @param sessionId Optional session ID for context
@@ -554,23 +676,30 @@ let _ToolManager = class _ToolManager {
     const { toolArgs: rawToolArgs, meta } = extractToolCallMeta(args);
     let toolArgs = rawToolArgs;
     const backgroundTasksEnabled = isBackgroundTasksEnabled();
+    const toolDisplayName = this.agentTools.get(toolName)?.displayName;
     this.logger.debug(`\u{1F527} Tool execution requested: '${toolName}' (toolCallId: ${toolCallId})`);
     this.logger.debug(`Tool args: ${JSON.stringify(toolArgs, null, 2)}`);
     if (sessionId) {
       this.agentEventBus.emit("llm:tool-call", {
         toolName,
+        ...toolDisplayName !== void 0 && { toolDisplayName },
         args: toolArgs,
         callId: toolCallId,
         sessionId
       });
     }
-    const { requireApproval, approvalStatus } = await this.handleToolApproval(
+    const {
+      requireApproval,
+      approvalStatus,
+      args: validatedToolArgs
+    } = await this.handleToolApproval(
       toolName,
       toolArgs,
       toolCallId,
       sessionId,
       meta.callDescription
     );
+    toolArgs = validatedToolArgs;
     this.logger.debug(`\u2705 Tool execution approved: ${toolName}`);
     this.logger.info(
       `\u{1F527} Tool execution started for ${toolName}, sessionId: ${sessionId ?? "global"}`
@@ -583,13 +712,13 @@ let _ToolManager = class _ToolManager {
       });
     }
     const startTime = Date.now();
-    if (this.pluginManager && this.sessionManager && this.stateManager) {
+    if (this.hookManager && this.sessionManager && this.stateManager) {
       const beforePayload = {
         toolName,
         args: toolArgs,
         ...sessionId !== void 0 && { sessionId }
       };
-      const modifiedPayload = await this.pluginManager.executePlugins(
+      const modifiedPayload = await this.hookManager.executeHooks(
         "beforeToolCall",
         beforePayload,
         {
@@ -601,6 +730,14 @@ let _ToolManager = class _ToolManager {
         }
       );
       toolArgs = modifiedPayload.args;
+      try {
+        toolArgs = this.validateLocalToolArgsOrThrow(toolName, toolArgs);
+      } catch (error) {
+        this.logger.error(
+          `Post-hook validation failed for tool '${toolName}': a beforeToolCall hook may have set invalid args`
+        );
+        throw error;
+      }
     }
     try {
       let result;
@@ -650,16 +787,7 @@ let _ToolManager = class _ToolManager {
         } else {
           result = await this.mcpManager.executeTool(actualToolName, toolArgs, sessionId);
         }
-      } else if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX)) {
-        this.logger.debug(`\u{1F527} Detected internal tool: '${toolName}'`);
-        const actualToolName = toolName.substring(_ToolManager.INTERNAL_TOOL_PREFIX.length);
-        if (actualToolName.length === 0) {
-          throw ToolError.invalidName(toolName, "tool name cannot be empty after prefix");
-        }
-        if (!this.internalToolsProvider) {
-          throw ToolError.internalToolsNotInitialized(toolName);
-        }
-        this.logger.debug(`\u{1F3AF} Internal routing: '${toolName}' -> '${actualToolName}'`);
+      } else {
         const runInBackground = backgroundTasksEnabled && meta.runInBackground === true && sessionId !== void 0;
         if (meta.runInBackground === true && !backgroundTasksEnabled) {
           this.logger.debug(
@@ -670,14 +798,14 @@ let _ToolManager = class _ToolManager {
         if (runInBackground) {
           const backgroundSessionId = sessionId;
           const { result: backgroundResult, promise } = registerBackgroundTask(
-            this.internalToolsProvider.executeTool(
-              actualToolName,
+            this.executeLocalTool(
+              toolName,
               toolArgs,
               backgroundSessionId,
               abortSignal,
               toolCallId
             ),
-            `Internal tool ${actualToolName}`
+            `Tool ${toolName}`
           );
           this.agentEventBus.emit("tool:background", {
             toolName,
@@ -692,88 +820,28 @@ let _ToolManager = class _ToolManager {
           });
           result = backgroundResult;
         } else {
-          result = await this.internalToolsProvider.executeTool(
-            actualToolName,
-            toolArgs,
-            sessionId,
-            abortSignal,
-            toolCallId
-          );
-        }
-      } else if (toolName.startsWith(_ToolManager.CUSTOM_TOOL_PREFIX)) {
-        this.logger.debug(`\u{1F527} Detected custom tool: '${toolName}'`);
-        const actualToolName = toolName.substring(_ToolManager.CUSTOM_TOOL_PREFIX.length);
-        if (actualToolName.length === 0) {
-          throw ToolError.invalidName(toolName, "tool name cannot be empty after prefix");
-        }
-        if (!this.internalToolsProvider) {
-          throw ToolError.internalToolsNotInitialized(toolName);
-        }
-        this.logger.debug(`\u{1F3AF} Custom routing: '${toolName}' -> '${actualToolName}'`);
-        const runInBackground = backgroundTasksEnabled && meta.runInBackground === true && sessionId !== void 0;
-        if (meta.runInBackground === true && !backgroundTasksEnabled) {
-          this.logger.debug(
-            "Background tool execution disabled; running synchronously instead.",
-            { toolName }
-          );
-        }
-        if (runInBackground) {
-          const backgroundSessionId = sessionId;
-          const { result: backgroundResult, promise } = registerBackgroundTask(
-            this.internalToolsProvider.executeTool(
-              actualToolName,
-              toolArgs,
-              backgroundSessionId,
-              abortSignal,
-              toolCallId
-            ),
-            `Custom tool ${actualToolName}`
-          );
-          this.agentEventBus.emit("tool:background", {
+          result = await this.executeLocalTool(
             toolName,
-            toolCallId: backgroundResult.taskId,
-            sessionId: backgroundSessionId,
-            description: backgroundResult.description,
-            promise,
-            ...meta.timeoutMs !== void 0 && { timeoutMs: meta.timeoutMs },
-            ...meta.notifyOnComplete !== void 0 && {
-              notifyOnComplete: meta.notifyOnComplete
-            }
-          });
-          result = backgroundResult;
-        } else {
-          result = await this.internalToolsProvider.executeTool(
-            actualToolName,
             toolArgs,
             sessionId,
             abortSignal,
             toolCallId
           );
         }
-      } else {
-        this.logger.debug(`\u{1F527} Detected tool without proper prefix: '${toolName}'`);
-        const stats = await this.getToolStats();
-        this.logger.error(
-          `\u274C Tool missing source prefix: '${toolName}' (expected '${_ToolManager.MCP_TOOL_PREFIX}*', '${_ToolManager.INTERNAL_TOOL_PREFIX}*', or '${_ToolManager.CUSTOM_TOOL_PREFIX}*')`
-        );
-        this.logger.debug(
-          `Available: ${stats.mcp} MCP, ${stats.internal} internal, ${stats.custom} custom tools`
-        );
-        throw ToolError.notFound(toolName);
       }
       const duration = Date.now() - startTime;
       this.logger.debug(`\u{1F3AF} Tool execution completed in ${duration}ms: '${toolName}'`);
       this.logger.info(
         `\u2705 Tool execution completed successfully for ${toolName} in ${duration}ms, sessionId: ${sessionId ?? "global"}`
       );
-      if (this.pluginManager && this.sessionManager && this.stateManager) {
+      if (this.hookManager && this.sessionManager && this.stateManager) {
         const afterPayload = {
           toolName,
           result,
           success: true,
           ...sessionId !== void 0 && { sessionId }
         };
-        const modifiedPayload = await this.pluginManager.executePlugins(
+        const modifiedPayload = await this.hookManager.executeHooks(
           "afterToolResult",
           afterPayload,
           {
@@ -788,6 +856,7 @@ let _ToolManager = class _ToolManager {
       }
       return {
         result,
+        ...toolDisplayName !== void 0 && { toolDisplayName },
         ...requireApproval && { requireApproval, approvalStatus }
       };
     } catch (error) {
@@ -795,14 +864,14 @@ let _ToolManager = class _ToolManager {
       this.logger.error(
         `\u274C Tool execution failed for ${toolName} after ${duration}ms, sessionId: ${sessionId ?? "global"}: ${error instanceof Error ? error.message : String(error)}`
       );
-      if (this.pluginManager && this.sessionManager && this.stateManager) {
+      if (this.hookManager && this.sessionManager && this.stateManager) {
         const afterPayload = {
           toolName,
           result: error instanceof Error ? error.message : String(error),
           success: false,
           ...sessionId !== void 0 && { sessionId }
         };
-        await this.pluginManager.executePlugins("afterToolResult", afterPayload, {
+        await this.hookManager.executeHooks("afterToolResult", afterPayload, {
           sessionManager: this.sessionManager,
           mcpManager: this.mcpManager,
           toolManager: this,
@@ -814,30 +883,20 @@ let _ToolManager = class _ToolManager {
     }
   }
   /**
-   * Check if a tool exists (must have proper source prefix)
+   * Check if a tool exists.
    */
   async hasTool(toolName) {
     if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
       const actualToolName = toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
       return this.mcpManager.getToolClient(actualToolName) !== void 0;
     }
-    if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX)) {
-      const actualToolName = toolName.substring(_ToolManager.INTERNAL_TOOL_PREFIX.length);
-      return this.internalToolsProvider?.hasInternalTool(actualToolName) ?? false;
-    }
-    if (toolName.startsWith(_ToolManager.CUSTOM_TOOL_PREFIX)) {
-      const actualToolName = toolName.substring(_ToolManager.CUSTOM_TOOL_PREFIX.length);
-      return this.internalToolsProvider?.hasCustomTool(actualToolName) ?? false;
-    }
-    return false;
+    return this.agentTools.has(toolName);
   }
   /**
    * Get tool statistics across all sources
    */
   async getToolStats() {
     let mcpTools = {};
-    let internalTools = {};
-    let customTools = {};
     try {
       mcpTools = await this.mcpManager.getAllTools();
     } catch (error) {
@@ -846,34 +905,16 @@ let _ToolManager = class _ToolManager {
       );
       mcpTools = {};
     }
-    try {
-      internalTools = this.internalToolsProvider?.getInternalTools() || {};
-    } catch (error) {
-      this.logger.error(
-        `Failed to get internal tools for stats: ${error instanceof Error ? error.message : String(error)}`
-      );
-      internalTools = {};
-    }
-    try {
-      customTools = this.internalToolsProvider?.getCustomTools() || {};
-    } catch (error) {
-      this.logger.error(
-        `Failed to get custom tools for stats: ${error instanceof Error ? error.message : String(error)}`
-      );
-      customTools = {};
-    }
     const mcpCount = Object.keys(mcpTools).length;
-    const internalCount = Object.keys(internalTools).length;
-    const customCount = Object.keys(customTools).length;
+    const localCount = this.agentTools.size;
     return {
-      total: mcpCount + internalCount + customCount,
+      total: mcpCount + localCount,
       mcp: mcpCount,
-      internal: internalCount,
-      custom: customCount
+      local: localCount
     };
   }
   /**
-   * Get the source of a tool (mcp, internal, custom, or unknown)
+   * Get the source of a tool (mcp, local, or unknown).
    * @param toolName The name of the tool to check
    * @returns The source of the tool
    */
@@ -881,11 +922,8 @@ let _ToolManager = class _ToolManager {
     if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX) && toolName.length > _ToolManager.MCP_TOOL_PREFIX.length) {
       return "mcp";
     }
-    if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX) && toolName.length > _ToolManager.INTERNAL_TOOL_PREFIX.length) {
-      return "internal";
-    }
-    if (toolName.startsWith(_ToolManager.CUSTOM_TOOL_PREFIX) && toolName.length > _ToolManager.CUSTOM_TOOL_PREFIX.length) {
-      return "custom";
+    if (this.agentTools.has(toolName)) {
+      return "local";
     }
     return "unknown";
   }
@@ -896,7 +934,7 @@ let _ToolManager = class _ToolManager {
    * Examples:
    * - Policy "mcp--read_file" matches "mcp--read_file" (exact)
    * - Policy "mcp--read_file" matches "mcp--filesystem--read_file" (suffix)
-   * - Policy "internal--ask_user" matches "internal--ask_user" (exact only)
+   * - Policy "read_file" matches "read_file" (local tool exact only)
    *
    * @param toolName The fully qualified tool name (e.g., "mcp--filesystem--read_file")
    * @param policyPattern The policy pattern to match against (e.g., "mcp--read_file")
@@ -947,26 +985,21 @@ let _ToolManager = class _ToolManager {
    * Tools can implement getApprovalOverride() to request specialized approval flows
    * (e.g., directory access approval for file tools) instead of default tool confirmation.
    *
-   * @param toolName The fully qualified tool name
+   * @param toolName Tool name
    * @param args The tool arguments
    * @param sessionId Optional session ID
    * @returns { handled: true } if custom approval was processed, { handled: false } to continue normal flow
    */
-  async checkCustomApprovalOverride(toolName, args, sessionId) {
-    let actualToolName;
-    if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX)) {
-      actualToolName = toolName.substring(_ToolManager.INTERNAL_TOOL_PREFIX.length);
-    } else if (toolName.startsWith(_ToolManager.CUSTOM_TOOL_PREFIX)) {
-      actualToolName = toolName.substring(_ToolManager.CUSTOM_TOOL_PREFIX.length);
-    }
-    if (!actualToolName || !this.internalToolsProvider) {
+  async checkCustomApprovalOverride(toolName, args, toolCallId, sessionId) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
       return { handled: false };
     }
-    const tool = this.internalToolsProvider.getTool(actualToolName);
+    const tool = this.agentTools.get(toolName);
     if (!tool?.getApprovalOverride) {
       return { handled: false };
     }
-    const approvalRequest = await tool.getApprovalOverride(args);
+    const context = this.buildToolExecutionContext({ sessionId, toolCallId });
+    const approvalRequest = await tool.getApprovalOverride(args, context);
     if (!approvalRequest) {
       return { handled: false };
     }
@@ -979,7 +1012,23 @@ let _ToolManager = class _ToolManager {
     const response = await this.approvalManager.requestApproval(approvalRequest);
     if (response.status === ApprovalStatus.APPROVED) {
       if (tool.onApprovalGranted) {
-        tool.onApprovalGranted(response);
+        tool.onApprovalGranted(response, context, approvalRequest);
+      }
+      if (approvalRequest.type === ApprovalType.DIRECTORY_ACCESS) {
+        const metadata = approvalRequest.metadata;
+        const parentDir = typeof metadata?.parentDir === "string" ? metadata.parentDir : null;
+        const operation = typeof metadata?.operation === "string" ? metadata.operation : null;
+        if (parentDir && operation) {
+          const data = response.data;
+          const rememberDirectory = data?.rememberDirectory ?? false;
+          this.autoApprovePendingDirectoryAccessRequests({
+            parentDir,
+            operation,
+            sessionId,
+            toolName,
+            rememberDirectory
+          });
+        }
       }
       this.logger.info(
         `Custom approval granted for '${toolName}', type=${approvalRequest.type}, session=${sessionId ?? "global"}`
@@ -1003,11 +1052,24 @@ let _ToolManager = class _ToolManager {
    * if a tool should be auto-approved, denied, or requires manual approval.
    */
   async handleToolApproval(toolName, args, toolCallId, sessionId, callDescription) {
-    const quickResult = await this.tryQuickApprovalResolution(toolName, args, sessionId);
+    const validatedArgs = this.validateLocalToolArgsOrThrow(toolName, args);
+    const quickResult = await this.tryQuickApprovalResolution(
+      toolName,
+      validatedArgs,
+      toolCallId,
+      sessionId
+    );
     if (quickResult !== null) {
-      return quickResult;
+      return { ...quickResult, args: validatedArgs };
     }
-    return this.requestManualApproval(toolName, args, toolCallId, sessionId, callDescription);
+    const manualResult = await this.requestManualApproval(
+      toolName,
+      validatedArgs,
+      toolCallId,
+      sessionId,
+      callDescription
+    );
+    return { ...manualResult, args: validatedArgs };
   }
   /**
    * Try to resolve tool approval quickly based on policies and cached permissions.
@@ -1019,10 +1081,10 @@ let _ToolManager = class _ToolManager {
    * 3. Session auto-approve (skill allowed-tools)
    * 4. Static allow list
    * 5. Dynamic "remembered" allowed list
-   * 6. Bash command patterns
+   * 6. Tool approval patterns
    * 7. Approval mode (auto-approve/auto-deny)
    */
-  async tryQuickApprovalResolution(toolName, args, sessionId) {
+  async tryQuickApprovalResolution(toolName, args, toolCallId, sessionId) {
     if (this.isInAlwaysDenyList(toolName)) {
       this.logger.info(
         `Tool '${toolName}' is in static deny list \u2013 blocking execution (session: ${sessionId ?? "global"})`
@@ -1032,6 +1094,7 @@ let _ToolManager = class _ToolManager {
     const customApprovalResult = await this.checkCustomApprovalOverride(
       toolName,
       args,
+      toolCallId,
       sessionId
     );
     if (customApprovalResult.handled) {
@@ -1055,17 +1118,12 @@ let _ToolManager = class _ToolManager {
       );
       return { requireApproval: false };
     }
-    if (this.isBashTool(toolName)) {
-      const command = args.command;
-      if (command) {
-        const bashResult = this.checkBashPatternApproval(command);
-        if (bashResult.approved) {
-          this.logger.info(
-            `Bash command '${command}' matched approved pattern \u2013 skipping confirmation.`
-          );
-          return { requireApproval: false };
-        }
-      }
+    const patternKey = this.getToolPatternKey(toolName, args);
+    if (patternKey && this.approvalManager.matchesPattern(toolName, patternKey)) {
+      this.logger.info(
+        `Tool '${toolName}' matched approved pattern key '${patternKey}' \u2013 skipping confirmation.`
+      );
+      return { requireApproval: false };
     }
     if (this.approvalMode === "auto-approve") {
       this.logger.debug(`\u{1F7E2} Auto-approving tool execution: ${toolName}`);
@@ -1083,18 +1141,20 @@ let _ToolManager = class _ToolManager {
    */
   async requestManualApproval(toolName, args, toolCallId, sessionId, callDescription) {
     this.logger.info(
-      `Tool confirmation requested for ${toolName}, sessionId: ${sessionId ?? "global"}`
+      `Tool approval requested for ${toolName}, sessionId: ${sessionId ?? "global"}`
     );
     try {
+      const toolDisplayName = this.agentTools.get(toolName)?.displayName;
       const displayPreview = await this.generateToolPreview(
         toolName,
         args,
         toolCallId,
         sessionId
       );
-      const suggestedPatterns = this.getBashSuggestedPatterns(toolName, args);
-      const response = await this.approvalManager.requestToolConfirmation({
+      const suggestedPatterns = this.getToolSuggestedPatterns(toolName, args);
+      const response = await this.approvalManager.requestToolApproval({
         toolName,
+        ...toolDisplayName !== void 0 && { toolDisplayName },
         toolCallId,
         args,
         ...callDescription !== void 0 && { description: callDescription },
@@ -1109,12 +1169,12 @@ let _ToolManager = class _ToolManager {
         this.handleApprovalDenied(toolName, response, sessionId);
       }
       this.logger.info(
-        `Tool confirmation approved for ${toolName}, sessionId: ${sessionId ?? "global"}`
+        `Tool approval approved for ${toolName}, sessionId: ${sessionId ?? "global"}`
       );
       return { requireApproval: true, approvalStatus: "approved" };
     } catch (error) {
       this.logger.error(
-        `Tool confirmation error for ${toolName}: ${error instanceof Error ? error.message : String(error)}`
+        `Tool approval error for ${toolName}: ${error instanceof Error ? error.message : String(error)}`
       );
       throw error;
     }
@@ -1123,14 +1183,13 @@ let _ToolManager = class _ToolManager {
    * Generate a preview for the tool approval UI if the tool supports it.
    */
   async generateToolPreview(toolName, args, toolCallId, sessionId) {
-    const actualToolName = toolName.replace(/^internal--/, "").replace(/^custom--/, "");
-    const internalTool = this.internalToolsProvider?.getTool(actualToolName);
-    if (!internalTool?.generatePreview) {
+    const tool = this.agentTools.get(toolName);
+    if (!tool?.generatePreview) {
       return void 0;
     }
     try {
-      const context = { sessionId, toolCallId };
-      const preview = await internalTool.generatePreview(args, context);
+      const context = this.buildToolExecutionContext({ sessionId, toolCallId });
+      const preview = await tool.generatePreview(args, context);
       this.logger.debug(`Generated preview for ${toolName}`);
       return preview ?? void 0;
     } catch (previewError) {
@@ -1144,20 +1203,6 @@ let _ToolManager = class _ToolManager {
       return void 0;
     }
   }
-  /**
-   * Get suggested bash patterns for the approval UI.
-   */
-  getBashSuggestedPatterns(toolName, args) {
-    if (!this.isBashTool(toolName)) {
-      return void 0;
-    }
-    const command = args.command;
-    if (!command) {
-      return void 0;
-    }
-    const result = this.checkBashPatternApproval(command);
-    return result.suggestedPatterns?.length ? result.suggestedPatterns : void 0;
-  }
   /**
    * Handle "remember choice" or "remember pattern" when user approves a tool.
    */
@@ -1173,10 +1218,10 @@ let _ToolManager = class _ToolManager {
         `Tool '${toolName}' added to allowed tools for session '${allowSessionId ?? "global"}' (remember choice selected)`
       );
       this.autoApprovePendingToolRequests(toolName, allowSessionId);
-    } else if (rememberPattern && this.isBashTool(toolName)) {
-      this.approvalManager.addBashPattern(rememberPattern);
-      this.logger.info(`Bash pattern '${rememberPattern}' added for session approval`);
-      this.autoApprovePendingBashRequests(rememberPattern, sessionId);
+    } else if (rememberPattern && this.agentTools.get(toolName)?.getApprovalPatternKey) {
+      this.approvalManager.addPattern(toolName, rememberPattern);
+      this.logger.info(`Pattern '${rememberPattern}' added for tool '${toolName}' approval`);
+      this.autoApprovePendingPatternRequests(toolName, sessionId);
     }
   }
   /**