@dexto/core 1.5.8 → 1.6.1

package/dist/tools/tool-manager.js

@@ -4,45 +4,41 @@ import {
   __runInitializers
 } from "../chunk-PTJYTZNU.js";
 var _ToolManager_decorators, _init;
-import { InternalToolsProvider } from "./internal-tools/provider.js";
 import { ToolError } from "./errors.js";
 import { ToolErrorCode } from "./error-codes.js";
 import { DextoRuntimeError } from "../errors/index.js";
 import { DextoLogComponent } from "../logger/v2/types.js";
+import { convertZodSchemaToJsonSchema } from "../utils/schema.js";
 import { ApprovalStatus, ApprovalType, DenialReason } from "../approval/types.js";
 import { InstrumentClass } from "../telemetry/decorators.js";
 import { extractToolCallMeta, wrapToolParametersSchema } from "./tool-call-metadata.js";
-import {
-  generateBashPatternKey,
-  generateBashPatternSuggestions,
-  isDangerousCommand
-} from "./bash-pattern-utils.js";
 import { isBackgroundTasksEnabled } from "../utils/env.js";
 _ToolManager_decorators = [InstrumentClass({
   prefix: "tool",
-  excludeMethods: [
-    "setPluginManager",
-    "setStateManager",
-    "getApprovalManager",
-    "getAllowedToolsProvider"
-  ]
+  excludeMethods: ["setHookSupport", "getApprovalManager", "getAllowedToolsProvider"]
 })];
 let _ToolManager = class _ToolManager {
   mcpManager;
-  internalToolsProvider;
+  agentTools = /* @__PURE__ */ new Map();
   approvalManager;
   allowedToolsProvider;
   approvalMode;
   agentEventBus;
   toolPolicies;
-  // Plugin support - set after construction to avoid circular dependencies
-  pluginManager;
+  toolExecutionContextFactory;
+  contributorContextFactory;
+  // Hook support - set after construction to avoid circular dependencies
+  hookManager;
   sessionManager;
   stateManager;
-  // Tool source prefixing - ALL tools get prefixed by source
+  workspaceManager;
+  currentWorkspace;
+  workspaceListenerAttached = false;
+  workspaceListenerAbort = new AbortController();
+  // Tool naming:
+  // - MCP tools are prefixed with `mcp--` for disambiguation.
+  // - Local tools use their `Tool.id` as-is (no internal/custom prefixing).
   static MCP_TOOL_PREFIX = "mcp--";
-  static INTERNAL_TOOL_PREFIX = "internal--";
-  static CUSTOM_TOOL_PREFIX = "custom--";
   // Tool caching for performance
   toolsCache = {};
   cacheValid = false;
@@ -55,7 +51,29 @@ let _ToolManager = class _ToolManager {
   sessionUserAutoApproveTools = /* @__PURE__ */ new Map();
   sessionDisabledTools = /* @__PURE__ */ new Map();
   globalDisabledTools = [];
-  constructor(mcpManager, approvalManager, allowedToolsProvider, approvalMode, agentEventBus, toolPolicies, options, logger) {
+  cleanupHandlers = /* @__PURE__ */ new Set();
+  cleanupStarted = false;
+  resolveLocalToolIdOrAlias(name) {
+    const direct = this.agentTools.get(name);
+    if (direct) return direct.id;
+    const lower = name.toLowerCase();
+    for (const tool of this.agentTools.values()) {
+      if (tool.id.toLowerCase() === lower) {
+        return tool.id;
+      }
+      if (tool.aliases?.some((alias) => alias.toLowerCase() === lower)) {
+        return tool.id;
+      }
+    }
+    return null;
+  }
+  normalizeToolPolicyPattern(pattern) {
+    if (pattern.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return pattern;
+    }
+    return this.resolveLocalToolIdOrAlias(pattern) ?? pattern;
+  }
+  constructor(mcpManager, approvalManager, allowedToolsProvider, approvalMode, agentEventBus, toolPolicies, tools, logger) {
     this.mcpManager = mcpManager;
     this.approvalManager = approvalManager;
     this.allowedToolsProvider = allowedToolsProvider;
@@ -63,18 +81,12 @@ let _ToolManager = class _ToolManager {
     this.agentEventBus = agentEventBus;
     this.toolPolicies = toolPolicies;
     this.logger = logger.createChild(DextoLogComponent.TOOLS);
-    if (options?.internalToolsConfig && options.internalToolsConfig.length > 0 || options?.customToolsConfig && options.customToolsConfig.length > 0) {
-      const internalToolsServices = {
-        ...options.internalToolsServices,
-        approvalManager
-      };
-      this.internalToolsProvider = new InternalToolsProvider(
-        internalToolsServices,
-        options.internalToolsConfig || [],
-        options.customToolsConfig || [],
-        this.logger
+    this.setTools(tools);
+    this.toolExecutionContextFactory = () => {
+      throw ToolError.configInvalid(
+        "ToolExecutionContextFactory not configured. DextoAgent.start() must configure tool execution context before tools can run."
       );
-    }
+    };
     this.setupNotificationListeners();
     this.logger.debug("ToolManager initialized");
   }
@@ -82,50 +94,78 @@ let _ToolManager = class _ToolManager {
    * Initialize the ToolManager and its components
    */
   async initialize() {
-    if (this.internalToolsProvider) {
-      await this.internalToolsProvider.initialize();
-    }
     this.logger.debug("ToolManager initialization complete");
   }
+  setTools(tools) {
+    this.agentTools.clear();
+    for (const tool of tools) {
+      this.agentTools.set(tool.id, tool);
+    }
+    this.invalidateCache();
+  }
+  setToolExecutionContextFactory(factory) {
+    this.toolExecutionContextFactory = factory;
+  }
+  registerCleanup(handler) {
+    this.cleanupHandlers.add(handler);
+  }
+  async cleanup() {
+    if (this.cleanupStarted) {
+      return;
+    }
+    this.cleanupStarted = true;
+    for (const handler of this.cleanupHandlers) {
+      try {
+        await handler();
+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        this.logger.warn(`ToolManager cleanup handler failed: ${err.message}`, {
+          color: "yellow"
+        });
+      }
+    }
+  }
   /**
-   * Set plugin support services (called after construction to avoid circular dependencies)
+   * Set hook support services (called after construction to avoid circular dependencies)
    */
-  setPluginSupport(pluginManager, sessionManager, stateManager) {
-    this.pluginManager = pluginManager;
+  setHookSupport(hookManager, sessionManager, stateManager) {
+    this.hookManager = hookManager;
     this.sessionManager = sessionManager;
     this.stateManager = stateManager;
-    this.logger.debug("Plugin support configured for ToolManager");
+    this.logger.debug("Hook support configured for ToolManager");
   }
   /**
-   * Set agent reference for custom tools (called after construction to avoid circular dependencies)
-   * Must be called before initialize() if custom tools are configured
+   * Set workspace manager for tool execution context propagation.
    */
-  setAgent(agent) {
-    if (this.internalToolsProvider) {
-      this.internalToolsProvider.setAgent(agent);
-      this.logger.debug("Agent reference configured for custom tools");
+  setWorkspaceManager(workspaceManager) {
+    this.workspaceManager = workspaceManager;
+    void this.refreshWorkspace();
+    if (!this.workspaceListenerAttached) {
+      this.workspaceListenerAttached = true;
+      this.agentEventBus.on(
+        "workspace:changed",
+        (payload) => {
+          this.currentWorkspace = payload.workspace ?? void 0;
+        },
+        { signal: this.workspaceListenerAbort.signal }
+      );
+      this.registerCleanup(() => {
+        if (!this.workspaceListenerAbort.signal.aborted) {
+          this.workspaceListenerAbort.abort();
+        }
+      });
     }
+    this.logger.debug("WorkspaceManager reference configured for ToolManager");
   }
-  /**
-   * Set prompt manager for invoke_skill tool (called after construction to avoid circular dependencies)
-   * Must be called before initialize() if invoke_skill tool is enabled
-   */
-  setPromptManager(promptManager) {
-    if (this.internalToolsProvider) {
-      this.internalToolsProvider.setPromptManager(promptManager);
-      this.logger.debug("PromptManager reference configured for invoke_skill tool");
+  async refreshWorkspace() {
+    if (!this.workspaceManager) {
+      return;
     }
-  }
-  /**
-   * Set task forker for context:fork skill execution (late-binding)
-   * Called by agent-spawner custom tool provider after RuntimeService is created.
-   * This enables invoke_skill to fork execution to an isolated subagent.
-   */
-  setTaskForker(taskForker) {
-    if (this.internalToolsProvider) {
-      this.internalToolsProvider.setTaskForker(taskForker);
+    try {
+      this.currentWorkspace = await this.workspaceManager.getWorkspace();
+    } catch (error) {
       this.logger.debug(
-        "TaskForker reference configured for invoke_skill (context:fork support)"
+        `Failed to refresh workspace context: ${error instanceof Error ? error.message : String(error)}`
       );
     }
   }
@@ -136,18 +176,21 @@ let _ToolManager = class _ToolManager {
    * This is ADDITIVE - other tools are NOT blocked, they just go through normal approval flow.
    *
    * @param sessionId The session ID
-   * @param autoApproveTools Array of tool names to auto-approve (e.g., ['custom--bash_exec', 'custom--read_file'])
+   * @param autoApproveTools Array of tool names to auto-approve (e.g., ['bash_exec', 'mcp--read_file'])
    */
   setSessionAutoApproveTools(sessionId, autoApproveTools) {
     if (autoApproveTools.length === 0) {
       this.clearSessionAutoApproveTools(sessionId);
       return;
     }
-    this.sessionAutoApproveTools.set(sessionId, autoApproveTools);
+    const normalized = autoApproveTools.map(
+      (pattern) => this.normalizeToolPolicyPattern(pattern)
+    );
+    this.sessionAutoApproveTools.set(sessionId, normalized);
     this.logger.info(
       `Session auto-approve tools set for '${sessionId}': ${autoApproveTools.length} tools`
     );
-    this.logger.debug(`Auto-approve tools: ${autoApproveTools.join(", ")}`);
+    this.logger.debug(`Auto-approve tools: ${normalized.join(", ")}`);
   }
   /**
    * Set session-level auto-approve tools chosen by the user.
@@ -157,11 +200,14 @@ let _ToolManager = class _ToolManager {
       this.clearSessionUserAutoApproveTools(sessionId);
       return;
     }
-    this.sessionUserAutoApproveTools.set(sessionId, autoApproveTools);
+    const normalized = autoApproveTools.map(
+      (pattern) => this.normalizeToolPolicyPattern(pattern)
+    );
+    this.sessionUserAutoApproveTools.set(sessionId, normalized);
     this.logger.info(
       `Session user auto-approve tools set for '${sessionId}': ${autoApproveTools.length} tools`
     );
-    this.logger.debug(`User auto-approve tools: ${autoApproveTools.join(", ")}`);
+    this.logger.debug(`User auto-approve tools: ${normalized.join(", ")}`);
   }
   /**
    * Clear session-level auto-approve tools chosen by the user.
@@ -338,39 +384,203 @@ let _ToolManager = class _ToolManager {
       }
     });
   }
-  // ==================== Bash Pattern Approval Helpers ====================
-  /**
-   * Check if a tool name represents a bash execution tool
-   */
-  isBashTool(toolName) {
-    return toolName === "bash_exec" || toolName === "internal--bash_exec" || toolName === "custom--bash_exec";
+  // ==================== Pattern Approval Helpers ====================
+  getToolApprovalPatternKeyFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.approval?.patternKey;
   }
-  /**
-   * Check if a bash command is covered by any approved pattern.
-   * Generates a pattern key from the command, then checks if it's covered by stored patterns.
-   *
-   * Returns approval info if covered, or pattern suggestions if not.
-   */
-  checkBashPatternApproval(command) {
-    const patternKey = generateBashPatternKey(command);
-    if (!patternKey) {
-      if (isDangerousCommand(command)) {
-        this.logger.debug(
-          `Skipping pattern generation for dangerous command: ${command.split(/\s+/)[0]}`
-        );
+  getToolSuggestApprovalPatternsFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.approval?.suggestPatterns;
+  }
+  getToolApprovalOverrideFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.approval?.override;
+  }
+  getToolApprovalOnGrantedFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.approval?.onGranted;
+  }
+  getToolPreviewFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.presentation?.preview;
+  }
+  getToolDescribeHeaderFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.presentation?.describeHeader;
+  }
+  getToolDescribeArgsFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.presentation?.describeArgs;
+  }
+  getToolDescribeResultFn(toolName) {
+    const tool = this.agentTools.get(toolName);
+    return tool?.presentation?.describeResult;
+  }
+  buildGenericToolPresentationSnapshot(toolName) {
+    const toTitleCase = (name) => name.replace(/[_-]+/g, " ").split(" ").filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+    const isMcp = toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX);
+    const fallbackTitle = (() => {
+      if (!isMcp) {
+        return toTitleCase(toolName);
+      }
+      const actualToolName = toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
+      const parts = actualToolName.split("--");
+      const toolPart = parts.length >= 2 ? parts.slice(1).join("--") : actualToolName;
+      return toTitleCase(toolPart);
+    })();
+    const snapshot = {
+      version: 1,
+      source: {
+        type: toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX) ? "mcp" : "local"
+      },
+      header: {
+        title: fallbackTitle
+      }
+    };
+    if (snapshot.source?.type === "mcp") {
+      const actualToolName = toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
+      const parts = actualToolName.split("--");
+      if (parts.length >= 2 && parts[0]) {
+        snapshot.source.mcpServerName = parts[0];
       }
-      return { approved: false, suggestedPatterns: [] };
     }
-    if (this.approvalManager.matchesBashPattern(patternKey)) {
-      return { approved: true };
+    return snapshot;
+  }
+  getToolPresentationSnapshotForToolCallEvent(toolName, args, toolCallId, sessionId) {
+    const fallback = this.buildGenericToolPresentationSnapshot(toolName);
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return fallback;
+    }
+    const describeHeader = this.getToolDescribeHeaderFn(toolName);
+    const describeArgs = this.getToolDescribeArgsFn(toolName);
+    if (!describeHeader && !describeArgs) {
+      return fallback;
+    }
+    try {
+      const validatedArgs = this.validateLocalToolArgs(toolName, args);
+      const context = this.buildToolExecutionContext({ sessionId, toolCallId });
+      const isPromiseLike = (value) => {
+        if (typeof value !== "object" || value === null) {
+          return false;
+        }
+        return typeof value.then === "function";
+      };
+      let nextSnapshot = fallback;
+      if (describeHeader) {
+        const header = describeHeader(validatedArgs, context);
+        if (!isPromiseLike(header) && header) {
+          nextSnapshot = {
+            ...nextSnapshot,
+            header: { ...nextSnapshot.header, ...header }
+          };
+        }
+      }
+      if (describeArgs) {
+        const argsPresentation = describeArgs(validatedArgs, context);
+        if (!isPromiseLike(argsPresentation) && argsPresentation) {
+          nextSnapshot = {
+            ...nextSnapshot,
+            args: argsPresentation
+          };
+        }
+      }
+      return nextSnapshot;
+    } catch (error) {
+      this.logger.debug(
+        `Tool presentation snapshot generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
+      );
+      return fallback;
+    }
+  }
+  async getToolPresentationSnapshotForCall(toolName, args, toolCallId, sessionId) {
+    const fallback = this.buildGenericToolPresentationSnapshot(toolName);
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return fallback;
+    }
+    const describeHeader = this.getToolDescribeHeaderFn(toolName);
+    const describeArgs = this.getToolDescribeArgsFn(toolName);
+    if (!describeHeader && !describeArgs) {
+      return fallback;
+    }
+    try {
+      const context = this.buildToolExecutionContext({ sessionId, toolCallId });
+      const describedHeader = describeHeader ? await Promise.resolve(describeHeader(args, context)) : null;
+      const describedArgs = describeArgs ? await Promise.resolve(describeArgs(args, context)) : null;
+      return {
+        ...fallback,
+        ...describedHeader ? { header: { ...fallback.header, ...describedHeader } } : {},
+        ...describedArgs ? { args: describedArgs } : {}
+      };
+    } catch (error) {
+      this.logger.debug(
+        `Tool presentation snapshot generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
+      );
+      return fallback;
+    }
+  }
+  async augmentSnapshotWithResult(toolName, snapshot, result, args, toolCallId, sessionId) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return snapshot;
+    }
+    const describeResult = this.getToolDescribeResultFn(toolName);
+    if (!describeResult) {
+      return snapshot;
+    }
+    try {
+      const context = this.buildToolExecutionContext({ sessionId, toolCallId });
+      const resultPresentation = await Promise.resolve(describeResult(result, args, context));
+      if (!resultPresentation) {
+        return snapshot;
+      }
+      return {
+        ...snapshot,
+        result: resultPresentation
+      };
+    } catch (error) {
+      this.logger.debug(
+        `Tool result presentation snapshot generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
+      );
+      return snapshot;
+    }
+  }
+  getToolPatternKey(toolName, args) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return null;
+    }
+    const getPatternKey = this.getToolApprovalPatternKeyFn(toolName);
+    if (!getPatternKey) {
+      return null;
+    }
+    try {
+      return getPatternKey(args);
+    } catch (error) {
+      this.logger.debug(
+        `Pattern key generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
+      );
+      return null;
+    }
+  }
+  getToolSuggestedPatterns(toolName, args) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return void 0;
+    }
+    const suggestPatterns = this.getToolSuggestApprovalPatternsFn(toolName);
+    if (!suggestPatterns) {
+      return void 0;
+    }
+    try {
+      const patterns = suggestPatterns(args);
+      return patterns.length > 0 ? patterns : void 0;
+    } catch (error) {
+      this.logger.debug(
+        `Pattern suggestion failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
+      );
+      return void 0;
     }
-    return {
-      approved: false,
-      suggestedPatterns: generateBashPatternSuggestions(command)
-    };
   }
   /**
-   * Auto-approve pending tool confirmation requests for the same tool.
+   * Auto-approve pending tool approval requests for the same tool.
    * Called after a user selects "remember choice" for a tool.
    * This handles the case where parallel tool calls come in before the first one is approved.
    *
@@ -380,14 +590,13 @@ let _ToolManager = class _ToolManager {
   autoApprovePendingToolRequests(toolName, sessionId) {
     const count = this.approvalManager.autoApprovePendingRequests(
       (request) => {
-        if (request.type !== ApprovalType.TOOL_CONFIRMATION) {
+        if (request.type !== ApprovalType.TOOL_APPROVAL) {
           return false;
         }
         if (request.sessionId !== sessionId) {
           return false;
         }
-        const metadata = request.metadata;
-        return metadata.toolName === toolName;
+        return request.metadata.toolName === toolName;
       },
       { rememberChoice: false }
       // Don't propagate remember choice to auto-approved requests
@@ -399,48 +608,86 @@ let _ToolManager = class _ToolManager {
     }
   }
   /**
-   * Auto-approve pending bash command requests that match a pattern.
-   * Called after a user selects "remember pattern" for a bash command.
-   * This handles the case where parallel bash commands come in before the first one is approved.
-   *
-   * @param pattern The bash pattern that was just remembered
-   * @param sessionId The session ID for context
+   * Auto-approve pending tool approval requests that are now covered by a remembered pattern.
+   * Called after a user selects "remember pattern" for a tool.
    */
-  autoApprovePendingBashRequests(pattern, sessionId) {
+  autoApprovePendingPatternRequests(toolName, sessionId) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return;
+    }
+    const getPatternKey = this.getToolApprovalPatternKeyFn(toolName);
+    if (!getPatternKey) {
+      return;
+    }
     const count = this.approvalManager.autoApprovePendingRequests(
       (request) => {
-        if (request.type !== ApprovalType.TOOL_CONFIRMATION) {
+        if (request.type !== ApprovalType.TOOL_APPROVAL) {
           return false;
         }
         if (request.sessionId !== sessionId) {
           return false;
         }
-        const metadata = request.metadata;
-        if (!this.isBashTool(metadata.toolName)) {
+        if (request.metadata.toolName !== toolName) {
           return false;
         }
-        const command = metadata.args?.command;
-        if (!command) {
+        const args = request.metadata.args;
+        if (typeof args !== "object" || args === null) {
           return false;
         }
-        const patternKey = generateBashPatternKey(command);
-        if (!patternKey) {
+        const argsRecord = args;
+        let patternKey;
+        try {
+          patternKey = getPatternKey(argsRecord);
+        } catch (error) {
+          this.logger.debug(
+            `Pattern key generation failed for '${toolName}': ${error instanceof Error ? error.message : String(error)}`
+          );
           return false;
         }
-        return this.approvalManager.matchesBashPattern(patternKey);
+        if (!patternKey) return false;
+        return this.approvalManager.matchesPattern(toolName, patternKey);
       },
       { rememberPattern: void 0 }
-      // Don't propagate pattern to auto-approved requests
+      // Don't propagate pattern choice to auto-approved requests
     );
     if (count > 0) {
       this.logger.info(
-        `Auto-approved ${count} parallel bash command(s) matching pattern '${pattern}'`
+        `Auto-approved ${count} parallel request(s) for tool '${toolName}' after user selected "remember pattern"`
       );
     }
   }
   getMcpManager() {
     return this.mcpManager;
   }
+  setContributorContextFactory(factory) {
+    this.contributorContextFactory = factory ?? void 0;
+  }
+  async buildContributorContext() {
+    const baseWorkspace = this.currentWorkspace ?? null;
+    const baseContext = {
+      mcpManager: this.mcpManager,
+      workspace: baseWorkspace
+    };
+    if (!this.contributorContextFactory) {
+      return baseContext;
+    }
+    try {
+      const overrides = await this.contributorContextFactory() ?? {};
+      const workspace = overrides.workspace !== void 0 ? overrides.workspace : baseWorkspace;
+      const environment = overrides.environment !== void 0 ? overrides.environment : baseContext.environment;
+      const mcpManager = overrides.mcpManager ?? baseContext.mcpManager;
+      return {
+        mcpManager,
+        workspace,
+        ...environment !== void 0 ? { environment } : {}
+      };
+    } catch (error) {
+      this.logger.warn(
+        `Failed to build contributor context: ${error instanceof Error ? error.message : String(error)}`
+      );
+      return baseContext;
+    }
+  }
   /**
    * Get all MCP tools (delegates to mcpManager.getAllTools())
    * This provides access to MCP tools while maintaining separation of concerns
@@ -448,11 +695,66 @@ let _ToolManager = class _ToolManager {
   async getMcpTools() {
     return await this.mcpManager.getAllTools();
   }
+  buildToolExecutionContext(options) {
+    const workspace = this.currentWorkspace;
+    const baseContext = {
+      sessionId: options.sessionId,
+      workspaceId: workspace?.id,
+      workspace,
+      abortSignal: options.abortSignal,
+      toolCallId: options.toolCallId,
+      logger: this.logger
+    };
+    return this.toolExecutionContextFactory(baseContext);
+  }
+  validateLocalToolArgs(toolName, args) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      return args;
+    }
+    const tool = this.agentTools.get(toolName);
+    if (!tool) {
+      return args;
+    }
+    const validationResult = tool.inputSchema.safeParse(args);
+    if (!validationResult.success) {
+      this.logger.error(
+        `\u274C Invalid arguments for tool ${toolName}: ${validationResult.error.message}`
+      );
+      throw ToolError.validationFailed(
+        toolName,
+        `Invalid arguments: ${validationResult.error.message}`
+      );
+    }
+    const validated = validationResult.data;
+    if (typeof validated !== "object" || validated === null || Array.isArray(validated)) {
+      throw ToolError.validationFailed(toolName, "Invalid arguments: expected an object");
+    }
+    return validated;
+  }
+  async executeLocalTool(toolName, args, sessionId, abortSignal, toolCallId) {
+    const tool = this.agentTools.get(toolName);
+    if (!tool) {
+      this.logger.error(`\u274C No local tool found: ${toolName}`);
+      this.logger.debug(
+        `Available local tools: ${Array.from(this.agentTools.keys()).join(", ")}`
+      );
+      throw ToolError.notFound(toolName);
+    }
+    try {
+      const context = this.buildToolExecutionContext({ sessionId, abortSignal, toolCallId });
+      const result = await tool.execute(args, context);
+      return result;
+    } catch (error) {
+      this.logger.error(`\u274C Local tool execution failed: ${toolName}`, {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      throw error;
+    }
+  }
   /**
-   * Build all tools from sources with universal prefixing
-   * ALL tools get prefixed by their source - no exceptions
+   * Build all tools from sources.
    *
-   * TODO: Rethink tool naming convention for more consistency
+   * TODO: Rethink MCP tool naming convention for more consistency.
    * Current issue: MCP tools have dynamic naming based on conflicts:
    * - No conflict: mcp--toolName
    * - With conflict: mcp--serverName--toolName
@@ -465,8 +767,6 @@ let _ToolManager = class _ToolManager {
   async buildAllTools() {
     const allTools = {};
     let mcpTools = {};
-    let internalTools = {};
-    let customTools = {};
     try {
       mcpTools = await this.mcpManager.getAllTools();
     } catch (error) {
@@ -475,38 +775,13 @@ let _ToolManager = class _ToolManager {
       );
       mcpTools = {};
     }
-    try {
-      internalTools = this.internalToolsProvider?.getInternalTools() || {};
-    } catch (error) {
-      this.logger.error(
-        `Failed to get internal tools: ${error instanceof Error ? error.message : String(error)}`
-      );
-      internalTools = {};
-    }
-    try {
-      customTools = this.internalToolsProvider?.getCustomTools() || {};
-    } catch (error) {
-      this.logger.error(
-        `Failed to get custom tools: ${error instanceof Error ? error.message : String(error)}`
-      );
-      customTools = {};
-    }
-    for (const [toolName, toolDef] of Object.entries(internalTools)) {
-      const qualifiedName = `${_ToolManager.INTERNAL_TOOL_PREFIX}${toolName}`;
-      allTools[qualifiedName] = {
-        ...toolDef,
-        name: qualifiedName,
-        description: `${toolDef.description || "No description provided"} (internal tool)`,
-        parameters: wrapToolParametersSchema(toolDef.parameters)
-      };
-    }
-    for (const [toolName, toolDef] of Object.entries(customTools)) {
-      const qualifiedName = `${_ToolManager.CUSTOM_TOOL_PREFIX}${toolName}`;
-      allTools[qualifiedName] = {
-        ...toolDef,
-        name: qualifiedName,
-        description: `${toolDef.description || "No description provided"} (custom tool)`,
-        parameters: wrapToolParametersSchema(toolDef.parameters)
+    for (const [toolName, tool] of this.agentTools) {
+      allTools[toolName] = {
+        name: toolName,
+        description: tool.description || "No description provided",
+        parameters: wrapToolParametersSchema(
+          convertZodSchemaToJsonSchema(tool.inputSchema, this.logger)
+        )
       };
     }
     for (const [toolName, toolDef] of Object.entries(mcpTools)) {
@@ -520,10 +795,9 @@ let _ToolManager = class _ToolManager {
     }
     const totalTools = Object.keys(allTools).length;
     const mcpCount = Object.keys(mcpTools).length;
-    const internalCount = Object.keys(internalTools).length;
-    const customCount = Object.keys(customTools).length;
+    const localCount = this.agentTools.size;
     this.logger.debug(
-      `\u{1F527} Unified tool discovery: ${totalTools} total tools (${mcpCount} MCP, ${internalCount} internal, ${customCount} custom)`
+      `\u{1F527} Unified tool discovery: ${totalTools} total tools (${mcpCount} MCP, ${localCount} local)`
     );
     return allTools;
   }
@@ -541,10 +815,11 @@ let _ToolManager = class _ToolManager {
     return this.toolsCache;
   }
   /**
-   * Execute a tool by routing based on universal prefix
-   * ALL tools must have source prefix - no exceptions
+   * Execute a tool by routing based on prefix:
+   * - MCP tools: `mcp--...`
+   * - Local tools: `Tool.id`
    *
-   * @param toolName The fully qualified tool name (e.g., "internal--edit_file")
+   * @param toolName Tool name (e.g., "edit_file", "mcp--filesystem--read_file")
    * @param args The arguments for the tool
    * @param toolCallId The unique tool call ID for tracking (from LLM or generated for direct calls)
    * @param sessionId Optional session ID for context
@@ -553,24 +828,39 @@ let _ToolManager = class _ToolManager {
   async executeTool(toolName, args, toolCallId, sessionId, abortSignal) {
     const { toolArgs: rawToolArgs, meta } = extractToolCallMeta(args);
     let toolArgs = rawToolArgs;
+    const callDescription = typeof meta.callDescription === "string" ? meta.callDescription : typeof rawToolArgs.description === "string" ? rawToolArgs.description : void 0;
     const backgroundTasksEnabled = isBackgroundTasksEnabled();
     this.logger.debug(`\u{1F527} Tool execution requested: '${toolName}' (toolCallId: ${toolCallId})`);
     this.logger.debug(`Tool args: ${JSON.stringify(toolArgs, null, 2)}`);
     if (sessionId) {
+      const presentationSnapshot = this.getToolPresentationSnapshotForToolCallEvent(
+        toolName,
+        toolArgs,
+        toolCallId,
+        sessionId
+      );
       this.agentEventBus.emit("llm:tool-call", {
         toolName,
+        presentationSnapshot,
         args: toolArgs,
+        ...callDescription !== void 0 && { callDescription },
         callId: toolCallId,
         sessionId
       });
     }
-    const { requireApproval, approvalStatus } = await this.handleToolApproval(
+    const {
+      requireApproval,
+      approvalStatus,
+      args: validatedToolArgs,
+      presentationSnapshot: callSnapshot
+    } = await this.handleToolApproval(
       toolName,
       toolArgs,
       toolCallId,
       sessionId,
-      meta.callDescription
+      callDescription
     );
+    toolArgs = validatedToolArgs;
     this.logger.debug(`\u2705 Tool execution approved: ${toolName}`);
     this.logger.info(
       `\u{1F527} Tool execution started for ${toolName}, sessionId: ${sessionId ?? "global"}`
@@ -583,13 +873,13 @@ let _ToolManager = class _ToolManager {
       });
     }
     const startTime = Date.now();
-    if (this.pluginManager && this.sessionManager && this.stateManager) {
+    if (this.hookManager && this.sessionManager && this.stateManager) {
       const beforePayload = {
         toolName,
         args: toolArgs,
         ...sessionId !== void 0 && { sessionId }
       };
-      const modifiedPayload = await this.pluginManager.executePlugins(
+      const modifiedPayload = await this.hookManager.executeHooks(
         "beforeToolCall",
         beforePayload,
         {
@@ -601,6 +891,14 @@ let _ToolManager = class _ToolManager {
         }
       );
       toolArgs = modifiedPayload.args;
+      try {
+        toolArgs = this.validateLocalToolArgs(toolName, toolArgs);
+      } catch (error) {
+        this.logger.error(
+          `Post-hook validation failed for tool '${toolName}': a beforeToolCall hook may have set invalid args`
+        );
+        throw error;
+      }
     }
     try {
       let result;
@@ -650,16 +948,7 @@ let _ToolManager = class _ToolManager {
         } else {
           result = await this.mcpManager.executeTool(actualToolName, toolArgs, sessionId);
         }
-      } else if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX)) {
-        this.logger.debug(`\u{1F527} Detected internal tool: '${toolName}'`);
-        const actualToolName = toolName.substring(_ToolManager.INTERNAL_TOOL_PREFIX.length);
-        if (actualToolName.length === 0) {
-          throw ToolError.invalidName(toolName, "tool name cannot be empty after prefix");
-        }
-        if (!this.internalToolsProvider) {
-          throw ToolError.internalToolsNotInitialized(toolName);
-        }
-        this.logger.debug(`\u{1F3AF} Internal routing: '${toolName}' -> '${actualToolName}'`);
+      } else {
         const runInBackground = backgroundTasksEnabled && meta.runInBackground === true && sessionId !== void 0;
         if (meta.runInBackground === true && !backgroundTasksEnabled) {
           this.logger.debug(
@@ -670,14 +959,14 @@ let _ToolManager = class _ToolManager {
         if (runInBackground) {
           const backgroundSessionId = sessionId;
           const { result: backgroundResult, promise } = registerBackgroundTask(
-            this.internalToolsProvider.executeTool(
-              actualToolName,
+            this.executeLocalTool(
+              toolName,
               toolArgs,
               backgroundSessionId,
               abortSignal,
               toolCallId
             ),
-            `Internal tool ${actualToolName}`
+            `Tool ${toolName}`
           );
           this.agentEventBus.emit("tool:background", {
             toolName,
@@ -692,88 +981,28 @@ let _ToolManager = class _ToolManager {
           });
           result = backgroundResult;
         } else {
-          result = await this.internalToolsProvider.executeTool(
-            actualToolName,
-            toolArgs,
-            sessionId,
-            abortSignal,
-            toolCallId
-          );
-        }
-      } else if (toolName.startsWith(_ToolManager.CUSTOM_TOOL_PREFIX)) {
-        this.logger.debug(`\u{1F527} Detected custom tool: '${toolName}'`);
-        const actualToolName = toolName.substring(_ToolManager.CUSTOM_TOOL_PREFIX.length);
-        if (actualToolName.length === 0) {
-          throw ToolError.invalidName(toolName, "tool name cannot be empty after prefix");
-        }
-        if (!this.internalToolsProvider) {
-          throw ToolError.internalToolsNotInitialized(toolName);
-        }
-        this.logger.debug(`\u{1F3AF} Custom routing: '${toolName}' -> '${actualToolName}'`);
-        const runInBackground = backgroundTasksEnabled && meta.runInBackground === true && sessionId !== void 0;
-        if (meta.runInBackground === true && !backgroundTasksEnabled) {
-          this.logger.debug(
-            "Background tool execution disabled; running synchronously instead.",
-            { toolName }
-          );
-        }
-        if (runInBackground) {
-          const backgroundSessionId = sessionId;
-          const { result: backgroundResult, promise } = registerBackgroundTask(
-            this.internalToolsProvider.executeTool(
-              actualToolName,
-              toolArgs,
-              backgroundSessionId,
-              abortSignal,
-              toolCallId
-            ),
-            `Custom tool ${actualToolName}`
-          );
-          this.agentEventBus.emit("tool:background", {
+          result = await this.executeLocalTool(
             toolName,
-            toolCallId: backgroundResult.taskId,
-            sessionId: backgroundSessionId,
-            description: backgroundResult.description,
-            promise,
-            ...meta.timeoutMs !== void 0 && { timeoutMs: meta.timeoutMs },
-            ...meta.notifyOnComplete !== void 0 && {
-              notifyOnComplete: meta.notifyOnComplete
-            }
-          });
-          result = backgroundResult;
-        } else {
-          result = await this.internalToolsProvider.executeTool(
-            actualToolName,
             toolArgs,
             sessionId,
             abortSignal,
             toolCallId
           );
         }
-      } else {
-        this.logger.debug(`\u{1F527} Detected tool without proper prefix: '${toolName}'`);
-        const stats = await this.getToolStats();
-        this.logger.error(
-          `\u274C Tool missing source prefix: '${toolName}' (expected '${_ToolManager.MCP_TOOL_PREFIX}*', '${_ToolManager.INTERNAL_TOOL_PREFIX}*', or '${_ToolManager.CUSTOM_TOOL_PREFIX}*')`
-        );
-        this.logger.debug(
-          `Available: ${stats.mcp} MCP, ${stats.internal} internal, ${stats.custom} custom tools`
-        );
-        throw ToolError.notFound(toolName);
       }
       const duration = Date.now() - startTime;
       this.logger.debug(`\u{1F3AF} Tool execution completed in ${duration}ms: '${toolName}'`);
       this.logger.info(
         `\u2705 Tool execution completed successfully for ${toolName} in ${duration}ms, sessionId: ${sessionId ?? "global"}`
       );
-      if (this.pluginManager && this.sessionManager && this.stateManager) {
+      if (this.hookManager && this.sessionManager && this.stateManager) {
         const afterPayload = {
           toolName,
           result,
           success: true,
           ...sessionId !== void 0 && { sessionId }
         };
-        const modifiedPayload = await this.pluginManager.executePlugins(
+        const modifiedPayload = await this.hookManager.executeHooks(
           "afterToolResult",
           afterPayload,
           {
@@ -786,8 +1015,17 @@ let _ToolManager = class _ToolManager {
         );
         result = modifiedPayload.result;
       }
+      const presentationSnapshot = await this.augmentSnapshotWithResult(
+        toolName,
+        callSnapshot,
+        result,
+        toolArgs,
+        toolCallId,
+        sessionId
+      );
       return {
         result,
+        ...presentationSnapshot !== void 0 && { presentationSnapshot },
         ...requireApproval && { requireApproval, approvalStatus }
       };
     } catch (error) {
@@ -795,14 +1033,14 @@ let _ToolManager = class _ToolManager {
       this.logger.error(
         `\u274C Tool execution failed for ${toolName} after ${duration}ms, sessionId: ${sessionId ?? "global"}: ${error instanceof Error ? error.message : String(error)}`
       );
-      if (this.pluginManager && this.sessionManager && this.stateManager) {
+      if (this.hookManager && this.sessionManager && this.stateManager) {
         const afterPayload = {
           toolName,
           result: error instanceof Error ? error.message : String(error),
           success: false,
           ...sessionId !== void 0 && { sessionId }
         };
-        await this.pluginManager.executePlugins("afterToolResult", afterPayload, {
+        await this.hookManager.executeHooks("afterToolResult", afterPayload, {
           sessionManager: this.sessionManager,
           mcpManager: this.mcpManager,
           toolManager: this,
@@ -814,30 +1052,20 @@ let _ToolManager = class _ToolManager {
     }
   }
   /**
-   * Check if a tool exists (must have proper source prefix)
+   * Check if a tool exists.
    */
   async hasTool(toolName) {
     if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
       const actualToolName = toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
       return this.mcpManager.getToolClient(actualToolName) !== void 0;
     }
-    if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX)) {
-      const actualToolName = toolName.substring(_ToolManager.INTERNAL_TOOL_PREFIX.length);
-      return this.internalToolsProvider?.hasInternalTool(actualToolName) ?? false;
-    }
-    if (toolName.startsWith(_ToolManager.CUSTOM_TOOL_PREFIX)) {
-      const actualToolName = toolName.substring(_ToolManager.CUSTOM_TOOL_PREFIX.length);
-      return this.internalToolsProvider?.hasCustomTool(actualToolName) ?? false;
-    }
-    return false;
+    return this.agentTools.has(toolName);
   }
   /**
    * Get tool statistics across all sources
    */
   async getToolStats() {
     let mcpTools = {};
-    let internalTools = {};
-    let customTools = {};
     try {
       mcpTools = await this.mcpManager.getAllTools();
     } catch (error) {
@@ -846,34 +1074,16 @@ let _ToolManager = class _ToolManager {
       );
       mcpTools = {};
     }
-    try {
-      internalTools = this.internalToolsProvider?.getInternalTools() || {};
-    } catch (error) {
-      this.logger.error(
-        `Failed to get internal tools for stats: ${error instanceof Error ? error.message : String(error)}`
-      );
-      internalTools = {};
-    }
-    try {
-      customTools = this.internalToolsProvider?.getCustomTools() || {};
-    } catch (error) {
-      this.logger.error(
-        `Failed to get custom tools for stats: ${error instanceof Error ? error.message : String(error)}`
-      );
-      customTools = {};
-    }
     const mcpCount = Object.keys(mcpTools).length;
-    const internalCount = Object.keys(internalTools).length;
-    const customCount = Object.keys(customTools).length;
+    const localCount = this.agentTools.size;
     return {
-      total: mcpCount + internalCount + customCount,
+      total: mcpCount + localCount,
       mcp: mcpCount,
-      internal: internalCount,
-      custom: customCount
+      local: localCount
     };
   }
   /**
-   * Get the source of a tool (mcp, internal, custom, or unknown)
+   * Get the source of a tool (mcp, local, or unknown).
    * @param toolName The name of the tool to check
    * @returns The source of the tool
    */
@@ -881,11 +1091,8 @@ let _ToolManager = class _ToolManager {
     if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX) && toolName.length > _ToolManager.MCP_TOOL_PREFIX.length) {
       return "mcp";
     }
-    if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX) && toolName.length > _ToolManager.INTERNAL_TOOL_PREFIX.length) {
-      return "internal";
-    }
-    if (toolName.startsWith(_ToolManager.CUSTOM_TOOL_PREFIX) && toolName.length > _ToolManager.CUSTOM_TOOL_PREFIX.length) {
-      return "custom";
+    if (this.agentTools.has(toolName)) {
+      return "local";
     }
     return "unknown";
   }
@@ -896,7 +1103,7 @@ let _ToolManager = class _ToolManager {
    * Examples:
    * - Policy "mcp--read_file" matches "mcp--read_file" (exact)
    * - Policy "mcp--read_file" matches "mcp--filesystem--read_file" (suffix)
-   * - Policy "internal--ask_user" matches "internal--ask_user" (exact only)
+   * - Policy "read_file" matches "read_file" (local tool exact only)
    *
    * @param toolName The fully qualified tool name (e.g., "mcp--filesystem--read_file")
    * @param policyPattern The policy pattern to match against (e.g., "mcp--read_file")
@@ -943,99 +1150,113 @@ let _ToolManager = class _ToolManager {
     );
   }
   /**
-   * Check if a tool has a custom approval override and handle it.
-   * Tools can implement getApprovalOverride() to request specialized approval flows
-   * (e.g., directory access approval for file tools) instead of default tool confirmation.
-   *
-   * @param toolName The fully qualified tool name
-   * @param args The tool arguments
-   * @param sessionId Optional session ID
-   * @returns { handled: true } if custom approval was processed, { handled: false } to continue normal flow
+   * Handle tool approval flow. Checks various precedence levels to determine
+   * if a tool should be auto-approved, denied, or requires manual approval.
    */
-  async checkCustomApprovalOverride(toolName, args, sessionId) {
-    let actualToolName;
-    if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX)) {
-      actualToolName = toolName.substring(_ToolManager.INTERNAL_TOOL_PREFIX.length);
-    } else if (toolName.startsWith(_ToolManager.CUSTOM_TOOL_PREFIX)) {
-      actualToolName = toolName.substring(_ToolManager.CUSTOM_TOOL_PREFIX.length);
-    }
-    if (!actualToolName || !this.internalToolsProvider) {
-      return { handled: false };
-    }
-    const tool = this.internalToolsProvider.getTool(actualToolName);
-    if (!tool?.getApprovalOverride) {
-      return { handled: false };
-    }
-    const approvalRequest = await tool.getApprovalOverride(args);
-    if (!approvalRequest) {
-      return { handled: false };
-    }
-    this.logger.debug(
-      `Tool '${toolName}' requested custom approval: type=${approvalRequest.type}`
-    );
-    if (sessionId && !approvalRequest.sessionId) {
-      approvalRequest.sessionId = sessionId;
-    }
-    const response = await this.approvalManager.requestApproval(approvalRequest);
-    if (response.status === ApprovalStatus.APPROVED) {
-      if (tool.onApprovalGranted) {
-        tool.onApprovalGranted(response);
-      }
+  async handleToolApproval(toolName, args, toolCallId, sessionId, callDescription) {
+    if (this.isInAlwaysDenyList(toolName)) {
       this.logger.info(
-        `Custom approval granted for '${toolName}', type=${approvalRequest.type}, session=${sessionId ?? "global"}`
+        `Tool '${toolName}' is in static deny list \u2013 blocking execution (session: ${sessionId ?? "global"})`
       );
-      return { handled: true };
+      throw ToolError.executionDenied(toolName, sessionId);
     }
-    this.logger.info(
-      `Custom approval denied for '${toolName}', type=${approvalRequest.type}, reason=${response.reason ?? "unknown"}`
+    const validatedArgs = this.validateLocalToolArgs(toolName, args);
+    const presentationSnapshot = await this.getToolPresentationSnapshotForCall(
+      toolName,
+      validatedArgs,
+      toolCallId,
+      sessionId
     );
-    if (approvalRequest.type === "directory_access") {
-      const metadata = approvalRequest.metadata;
-      throw ToolError.directoryAccessDenied(
-        metadata?.parentDir ?? "unknown directory",
-        sessionId
-      );
+    let directoryAccess;
+    let directoryAccessApprovalRequest;
+    if (!toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      const getApprovalOverride = this.getToolApprovalOverrideFn(toolName);
+      if (getApprovalOverride) {
+        const context = this.buildToolExecutionContext({ sessionId, toolCallId });
+        const approvalRequest = await getApprovalOverride(validatedArgs, context);
+        if (approvalRequest) {
+          if (approvalRequest.type === ApprovalType.DIRECTORY_ACCESS) {
+            const metadata = approvalRequest.metadata;
+            if (typeof metadata !== "object" || metadata === null || typeof metadata.path !== "string" || typeof metadata.parentDir !== "string" || typeof metadata.operation !== "string" || typeof metadata.toolName !== "string") {
+              throw ToolError.configInvalid(
+                `Tool '${toolName}' returned invalid directory access metadata`
+              );
+            }
+            directoryAccess = metadata;
+            directoryAccessApprovalRequest = approvalRequest;
+          } else {
+            this.logger.debug(
+              `Tool '${toolName}' requested custom approval: type=${approvalRequest.type}`
+            );
+            if (sessionId && !approvalRequest.sessionId) {
+              approvalRequest.sessionId = sessionId;
+            }
+            const response = await this.approvalManager.requestApproval(approvalRequest);
+            if (response.status === ApprovalStatus.APPROVED) {
+              const onGranted = this.getToolApprovalOnGrantedFn(toolName);
+              if (onGranted) {
+                await Promise.resolve(
+                  onGranted(response, context, approvalRequest)
+                );
+              }
+              this.logger.info(
+                `Custom approval granted for '${toolName}', type=${approvalRequest.type}, session=${sessionId ?? "global"}`
+              );
+              return {
+                requireApproval: true,
+                approvalStatus: "approved",
+                args: validatedArgs,
+                presentationSnapshot
+              };
+            }
+            this.logger.info(
+              `Custom approval denied for '${toolName}', type=${approvalRequest.type}, reason=${response.reason ?? "unknown"}`
+            );
+            throw ToolError.executionDenied(toolName, sessionId);
+          }
+        }
+      }
     }
-    throw ToolError.executionDenied(toolName, sessionId);
-  }
-  /**
-   * Handle tool approval flow. Checks various precedence levels to determine
-   * if a tool should be auto-approved, denied, or requires manual approval.
-   */
-  async handleToolApproval(toolName, args, toolCallId, sessionId, callDescription) {
-    const quickResult = await this.tryQuickApprovalResolution(toolName, args, sessionId);
+    const quickResult = await this.tryQuickApprovalResolution(
+      toolName,
+      validatedArgs,
+      sessionId,
+      directoryAccess
+    );
     if (quickResult !== null) {
-      return quickResult;
+      return { ...quickResult, args: validatedArgs, presentationSnapshot };
     }
-    return this.requestManualApproval(toolName, args, toolCallId, sessionId, callDescription);
+    const manualResult = await this.requestManualApproval(
+      toolName,
+      validatedArgs,
+      toolCallId,
+      sessionId,
+      directoryAccess,
+      directoryAccessApprovalRequest,
+      callDescription,
+      presentationSnapshot
+    );
+    return { ...manualResult, args: validatedArgs, presentationSnapshot };
   }
   /**
    * Try to resolve tool approval quickly based on policies and cached permissions.
    * Returns null if manual approval is needed.
    *
    * Precedence order (highest to lowest):
-   * 1. Static deny list (security - always blocks)
-   * 2. Custom approval override (tool-specific approval flows)
-   * 3. Session auto-approve (skill allowed-tools)
-   * 4. Static allow list
-   * 5. Dynamic "remembered" allowed list
-   * 6. Bash command patterns
-   * 7. Approval mode (auto-approve/auto-deny)
+   * 1. Directory access requirement (outside-root paths)
+   * 2. Session auto-approve (skill allowed-tools)
+   * 3. Static allow list
+   * 4. Dynamic "remembered" allowed list
+   * 5. Tool approval patterns
+   * 6. Approval mode (auto-approve/auto-deny)
    */
-  async tryQuickApprovalResolution(toolName, args, sessionId) {
-    if (this.isInAlwaysDenyList(toolName)) {
-      this.logger.info(
-        `Tool '${toolName}' is in static deny list \u2013 blocking execution (session: ${sessionId ?? "global"})`
-      );
-      throw ToolError.executionDenied(toolName, sessionId);
-    }
-    const customApprovalResult = await this.checkCustomApprovalOverride(
-      toolName,
-      args,
-      sessionId
-    );
-    if (customApprovalResult.handled) {
-      return { requireApproval: true, approvalStatus: "approved" };
+  async tryQuickApprovalResolution(toolName, args, sessionId, directoryAccess) {
+    if (directoryAccess) {
+      if (this.approvalMode === "auto-approve") {
+        this.approvalManager.addApprovedDirectory(directoryAccess.parentDir, "once");
+        return { requireApproval: false };
+      }
+      return null;
     }
     if (sessionId && this.isToolAutoApprovedForSession(sessionId, toolName)) {
       this.logger.info(
@@ -1055,17 +1276,12 @@ let _ToolManager = class _ToolManager {
       );
       return { requireApproval: false };
     }
-    if (this.isBashTool(toolName)) {
-      const command = args.command;
-      if (command) {
-        const bashResult = this.checkBashPatternApproval(command);
-        if (bashResult.approved) {
-          this.logger.info(
-            `Bash command '${command}' matched approved pattern \u2013 skipping confirmation.`
-          );
-          return { requireApproval: false };
-        }
-      }
+    const patternKey = this.getToolPatternKey(toolName, args);
+    if (patternKey && this.approvalManager.matchesPattern(toolName, patternKey)) {
+      this.logger.info(
+        `Tool '${toolName}' matched approved pattern key '${patternKey}' \u2013 skipping confirmation.`
+      );
+      return { requireApproval: false };
     }
     if (this.approvalMode === "auto-approve") {
       this.logger.debug(`\u{1F7E2} Auto-approving tool execution: ${toolName}`);
@@ -1081,9 +1297,9 @@ let _ToolManager = class _ToolManager {
    * Request manual approval from the user for a tool execution.
    * Generates preview, sends approval request, and handles the response.
    */
-  async requestManualApproval(toolName, args, toolCallId, sessionId, callDescription) {
+  async requestManualApproval(toolName, args, toolCallId, sessionId, directoryAccess, directoryAccessApprovalRequest, callDescription, presentationSnapshot) {
     this.logger.info(
-      `Tool confirmation requested for ${toolName}, sessionId: ${sessionId ?? "global"}`
+      `Tool approval requested for ${toolName}, sessionId: ${sessionId ?? "global"}`
     );
     try {
       const displayPreview = await this.generateToolPreview(
@@ -1092,16 +1308,27 @@ let _ToolManager = class _ToolManager {
         toolCallId,
         sessionId
       );
-      const suggestedPatterns = this.getBashSuggestedPatterns(toolName, args);
-      const response = await this.approvalManager.requestToolConfirmation({
+      const suggestedPatterns = this.getToolSuggestedPatterns(toolName, args);
+      const response = await this.approvalManager.requestToolApproval({
         toolName,
+        ...presentationSnapshot !== void 0 && { presentationSnapshot },
         toolCallId,
         args,
         ...callDescription !== void 0 && { description: callDescription },
         ...sessionId !== void 0 && { sessionId },
         ...displayPreview !== void 0 && { displayPreview },
+        ...directoryAccess !== void 0 && { directoryAccess },
         ...suggestedPatterns !== void 0 && { suggestedPatterns }
       });
+      if (response.status === ApprovalStatus.APPROVED && directoryAccessApprovalRequest !== void 0) {
+        const onGranted = this.getToolApprovalOnGrantedFn(toolName);
+        if (onGranted) {
+          const context = this.buildToolExecutionContext({ sessionId, toolCallId });
+          await Promise.resolve(
+            onGranted(response, context, directoryAccessApprovalRequest)
+          );
+        }
+      }
       if (response.status === ApprovalStatus.APPROVED && response.data) {
         await this.handleRememberChoice(toolName, response, sessionId);
       }
@@ -1109,12 +1336,12 @@ let _ToolManager = class _ToolManager {
         this.handleApprovalDenied(toolName, response, sessionId);
       }
       this.logger.info(
-        `Tool confirmation approved for ${toolName}, sessionId: ${sessionId ?? "global"}`
+        `Tool approval approved for ${toolName}, sessionId: ${sessionId ?? "global"}`
       );
       return { requireApproval: true, approvalStatus: "approved" };
     } catch (error) {
       this.logger.error(
-        `Tool confirmation error for ${toolName}: ${error instanceof Error ? error.message : String(error)}`
+        `Tool approval error for ${toolName}: ${error instanceof Error ? error.message : String(error)}`
       );
       throw error;
     }
@@ -1123,14 +1350,13 @@ let _ToolManager = class _ToolManager {
    * Generate a preview for the tool approval UI if the tool supports it.
    */
   async generateToolPreview(toolName, args, toolCallId, sessionId) {
-    const actualToolName = toolName.replace(/^internal--/, "").replace(/^custom--/, "");
-    const internalTool = this.internalToolsProvider?.getTool(actualToolName);
-    if (!internalTool?.generatePreview) {
+    const previewFn = this.getToolPreviewFn(toolName);
+    if (!previewFn) {
       return void 0;
     }
     try {
-      const context = { sessionId, toolCallId };
-      const preview = await internalTool.generatePreview(args, context);
+      const context = this.buildToolExecutionContext({ sessionId, toolCallId });
+      const preview = await previewFn(args, context);
       this.logger.debug(`Generated preview for ${toolName}`);
       return preview ?? void 0;
     } catch (previewError) {
@@ -1144,20 +1370,6 @@ let _ToolManager = class _ToolManager {
       return void 0;
     }
   }
-  /**
-   * Get suggested bash patterns for the approval UI.
-   */
-  getBashSuggestedPatterns(toolName, args) {
-    if (!this.isBashTool(toolName)) {
-      return void 0;
-    }
-    const command = args.command;
-    if (!command) {
-      return void 0;
-    }
-    const result = this.checkBashPatternApproval(command);
-    return result.suggestedPatterns?.length ? result.suggestedPatterns : void 0;
-  }
   /**
    * Handle "remember choice" or "remember pattern" when user approves a tool.
    */
@@ -1173,10 +1385,10 @@ let _ToolManager = class _ToolManager {
         `Tool '${toolName}' added to allowed tools for session '${allowSessionId ?? "global"}' (remember choice selected)`
       );
       this.autoApprovePendingToolRequests(toolName, allowSessionId);
-    } else if (rememberPattern && this.isBashTool(toolName)) {
-      this.approvalManager.addBashPattern(rememberPattern);
-      this.logger.info(`Bash pattern '${rememberPattern}' added for session approval`);
-      this.autoApprovePendingBashRequests(rememberPattern, sessionId);
+    } else if (rememberPattern && this.getToolApprovalPatternKeyFn(toolName)) {
+      this.approvalManager.addPattern(toolName, rememberPattern);
+      this.logger.info(`Pattern '${rememberPattern}' added for tool '${toolName}' approval`);
+      this.autoApprovePendingPatternRequests(toolName, sessionId);
     }
   }
   /**