@leg3ndy/otto-bridge 0.9.2 → 1.0.0

package/dist/executors/native_macos.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { mkdir, readFile, readdir, rename, stat, writeFile } from "node:fs/promises";
+import { mkdir, readFile, readdir, realpath, rename, stat, unlink, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import process from "node:process";
@@ -8,6 +8,9 @@ import { loadManagedBridgeExtensionState, saveManagedBridgeExtensionState, } fro
 import { postDeviceJson, uploadDeviceJobArtifact } from "../http.js";
 import { WHATSAPP_WEB_URL, WhatsAppBackgroundBrowser, } from "../whatsapp_background.js";
 import { verifyExpectedWhatsAppMessage } from "../whatsapp_verification.js";
+import { parseJobRuntimeManifest, runtimeExpectedArtifactIdForActionIndex, runtimeStepIdForActionIndex, } from "../runtime_contract.js";
+import { applyStructuredUpdateToText, parseStructuredPatch, } from "../agentic_runtime/patch/structured_patch.js";
+import { assertActionAllowedByWorkspacePolicy, assertCwdInsideWorkspace, assertPathInsideWorkspace, buildWorkspaceMemory, expandUserPathLike, resolveWorkspaceContext, } from "../agentic_runtime/workspace/manager.js";
 const KNOWN_APPS = [
     { canonical: "Safari", patterns: [/\bsafari\b/i] },
     { canonical: "Google Chrome", patterns: [/\bgoogle chrome\b/i, /\bchrome\b/i] },
@@ -47,6 +50,16 @@ const FILE_SEARCH_SKIP_DIRS = new Set([
     "Library",
     ".Trash",
 ]);
+const RUN_TEST_PROFILES = new Set([
+    "pytest",
+    "npm_test",
+    "pnpm_test",
+    "yarn_test",
+    "bun_test",
+    "lint",
+    "build",
+]);
+const PACKAGE_MANAGER_PRIORITY = ["pnpm", "yarn", "bun", "npm"];
 const GENERIC_VISUAL_STOP_WORDS = new Set([
     "o",
     "a",
@@ -675,20 +688,7 @@ function mimeTypeFromPath(filePath) {
     return "application/octet-stream";
 }
 function expandUserPath(value) {
-    const trimmed = value.trim();
-    if (!trimmed) {
-        return os.homedir();
-    }
-    if (trimmed === "~") {
-        return os.homedir();
-    }
-    if (trimmed.startsWith("~/")) {
-        return path.join(os.homedir(), trimmed.slice(2));
-    }
-    if (path.isAbsolute(trimmed)) {
-        return trimmed;
-    }
-    return path.resolve(process.cwd(), trimmed);
+    return expandUserPathLike(value, process.cwd());
 }
 function clipText(value, maxLength) {
     if (value.length <= maxLength) {
@@ -1044,6 +1044,245 @@ function parseStructuredActions(job) {
             }
             continue;
         }
+        if (type === "write_json_file" || type === "write_json" || type === "save_json_file" || type === "save_json") {
+            const targetPath = asString(action.path)
+                || asString(action.destination)
+                || asString(action.file_path)
+                || (asString(action.filename) ? "~/Desktop" : "");
+            const data = ("data" in action ? action.data : ("json" in action ? action.json : ("content" in action ? action.content : undefined)));
+            if (targetPath && data !== undefined) {
+                actions.push({
+                    type: "write_json_file",
+                    path: targetPath,
+                    data,
+                    filename: asString(action.filename) || asString(action.file_name) || asString(action.name) || undefined,
+                    pretty: action.pretty !== false,
+                });
+            }
+            continue;
+        }
+        if (type === "apply_patch" || type === "patch_apply" || type === "edit_patch") {
+            const patch = asString(action.patch) || asString(action.content) || asString(action.diff);
+            const cwd = asString(action.cwd) || asString(action.path);
+            if (patch && cwd) {
+                const targetFiles = Array.isArray(action.target_files)
+                    ? action.target_files
+                        .map((item) => asString(item))
+                        .filter((item) => Boolean(item))
+                    : [];
+                actions.push({
+                    type: "apply_patch",
+                    cwd,
+                    patch,
+                    target_files: targetFiles.length > 0 ? targetFiles : undefined,
+                });
+            }
+            continue;
+        }
+        if (type === "mkdir" || type === "make_directory" || type === "create_directory") {
+            const directoryPath = asString(action.path) || asString(action.destination) || asString(action.directory_path);
+            if (directoryPath) {
+                actions.push({
+                    type: "mkdir",
+                    path: directoryPath,
+                    create_parents: action.create_parents !== false,
+                });
+            }
+            continue;
+        }
+        if (type === "move_file" || type === "move_path" || type === "rename_file") {
+            const sourcePath = asString(action.source_path) || asString(action.source) || asString(action.path);
+            const destinationPath = asString(action.destination_path) || asString(action.destination) || asString(action.target_path) || asString(action.target);
+            if (sourcePath && destinationPath) {
+                actions.push({
+                    type: "move_file",
+                    source_path: sourcePath,
+                    destination_path: destinationPath,
+                    overwrite: action.overwrite === true,
+                });
+            }
+            continue;
+        }
+        if (type === "git_clone" || type === "clone_repo" || type === "repo_clone") {
+            const repository = asString(action.repository) || asString(action.repo) || asString(action.url) || asString(action.remote);
+            const destinationPath = asString(action.destination_path) || asString(action.destination) || asString(action.path) || asString(action.target_path);
+            const depth = typeof action.depth === "number" ? Math.max(1, Math.min(1_000, Math.round(action.depth))) : undefined;
+            if (repository && destinationPath) {
+                actions.push({
+                    type: "git_clone",
+                    repository,
+                    destination_path: destinationPath,
+                    branch: asString(action.branch) || asString(action.ref) || undefined,
+                    depth,
+                });
+            }
+            continue;
+        }
+        if (type === "git_fetch" || type === "fetch_repo" || type === "repo_fetch") {
+            const cwd = asString(action.cwd) || asString(action.repo_path) || asString(action.repository_path) || asString(action.workspace_path) || asString(action.path);
+            if (cwd) {
+                actions.push({
+                    type: "git_fetch",
+                    cwd,
+                    remote: asString(action.remote) || undefined,
+                    prune: action.prune === true,
+                    tags: action.tags === true,
+                });
+            }
+            continue;
+        }
+        if (type === "git_checkout" || type === "checkout_branch" || type === "switch_branch") {
+            const cwd = asString(action.cwd) || asString(action.repo_path) || asString(action.repository_path) || asString(action.workspace_path) || asString(action.path);
+            const target = asString(action.target) || asString(action.branch) || asString(action.ref) || asString(action.target_ref);
+            if (cwd && target) {
+                actions.push({
+                    type: "git_checkout",
+                    cwd,
+                    target,
+                    start_point: asString(action.start_point) || asString(action.startPoint) || asString(action.from_ref) || undefined,
+                    create_branch: action.create_branch === true || action.new_branch === true,
+                    detach: action.detach === true,
+                });
+            }
+            continue;
+        }
+        if (type === "git_rebase" || type === "rebase_branch") {
+            const cwd = asString(action.cwd) || asString(action.repo_path) || asString(action.repository_path) || asString(action.workspace_path) || asString(action.path);
+            const target = asString(action.target) || asString(action.upstream) || asString(action.branch) || asString(action.ref);
+            if (cwd && target) {
+                actions.push({
+                    type: "git_rebase",
+                    cwd,
+                    target,
+                    autostash: action.autostash === true,
+                });
+            }
+            continue;
+        }
+        if (type === "git_merge" || type === "merge_branch") {
+            const cwd = asString(action.cwd) || asString(action.repo_path) || asString(action.repository_path) || asString(action.workspace_path) || asString(action.path);
+            const target = asString(action.target) || asString(action.branch) || asString(action.ref) || asString(action.source_branch);
+            if (cwd && target) {
+                actions.push({
+                    type: "git_merge",
+                    cwd,
+                    target,
+                    ff_only: action.ff_only === true,
+                    no_ff: action.no_ff === true,
+                    message: asString(action.message) || asString(action.merge_message) || undefined,
+                });
+            }
+            continue;
+        }
+        if (type === "git_tag" || type === "create_tag") {
+            const cwd = asString(action.cwd) || asString(action.repo_path) || asString(action.repository_path) || asString(action.workspace_path) || asString(action.path);
+            const name = asString(action.name) || asString(action.tag) || asString(action.tag_name);
+            if (cwd && name) {
+                actions.push({
+                    type: "git_tag",
+                    cwd,
+                    name,
+                    target: asString(action.target) || asString(action.ref) || undefined,
+                    annotated: action.annotated === true,
+                    message: asString(action.message) || asString(action.annotation) || undefined,
+                });
+            }
+            continue;
+        }
+        if (type === "git_add" || type === "git_stage" || type === "stage_files" || type === "stage_changes") {
+            const cwd = asString(action.cwd) || asString(action.repo_path) || asString(action.repository_path) || asString(action.workspace_path) || asString(action.path);
+            if (cwd) {
+                const rawPaths = Array.isArray(action.paths)
+                    ? action.paths
+                        .map((item) => asString(item))
+                        .filter((item) => Boolean(item))
+                    : [];
+                const fallbackTargetPath = asString(action.target_path) || asString(action.file_path) || asString(action.pathspec);
+                actions.push({
+                    type: "git_add",
+                    cwd,
+                    all: action.all === true || action.stage_all === true || (rawPaths.length === 0 && !fallbackTargetPath),
+                    paths: rawPaths.length > 0 ? rawPaths : (fallbackTargetPath ? [fallbackTargetPath] : undefined),
+                });
+            }
+            continue;
+        }
+        if (type === "git_commit" || type === "commit_changes" || type === "git_commit_changes") {
+            const cwd = asString(action.cwd) || asString(action.repo_path) || asString(action.repository_path) || asString(action.workspace_path) || asString(action.path);
+            const message = asString(action.message) || asString(action.commit_message) || asString(action.summary);
+            if (cwd && message) {
+                actions.push({
+                    type: "git_commit",
+                    cwd,
+                    message,
+                    allow_empty: action.allow_empty === true,
+                });
+            }
+            continue;
+        }
+        if (type === "git_push" || type === "push_changes" || type === "git_push_branch") {
+            const cwd = asString(action.cwd) || asString(action.repo_path) || asString(action.repository_path) || asString(action.workspace_path) || asString(action.path);
+            if (cwd) {
+                actions.push({
+                    type: "git_push",
+                    cwd,
+                    remote: asString(action.remote) || undefined,
+                    branch: asString(action.branch) || asString(action.ref) || undefined,
+                    set_upstream: action.set_upstream === true,
+                });
+            }
+            continue;
+        }
+        if (type === "git_status" || type === "repo_status") {
+            const cwd = asString(action.cwd) || asString(action.path);
+            if (cwd) {
+                actions.push({
+                    type: "git_status",
+                    cwd,
+                    include_untracked: action.include_untracked !== false,
+                });
+            }
+            continue;
+        }
+        if (type === "git_diff" || type === "repo_diff") {
+            const cwd = asString(action.cwd) || asString(action.path);
+            if (cwd) {
+                const rawPaths = Array.isArray(action.paths)
+                    ? action.paths
+                        .map((item) => asString(item))
+                        .filter((item) => Boolean(item))
+                    : [];
+                const fallbackTargetPath = asString(action.target_path);
+                actions.push({
+                    type: "git_diff",
+                    cwd,
+                    staged: action.staged === true || action.cached === true,
+                    base_ref: asString(action.base_ref) || asString(action.base) || undefined,
+                    paths: rawPaths.length > 0 ? rawPaths : (fallbackTargetPath ? [fallbackTargetPath] : undefined),
+                    max_chars: typeof action.max_chars === "number" ? Math.max(1_000, Math.min(20_000, action.max_chars)) : undefined,
+                });
+            }
+            continue;
+        }
+        if (type === "run_tests" || type === "tests" || type === "test_command") {
+            const command = asString(action.command) || asString(action.cmd);
+            const profileCandidate = asString(action.profile) || asString(action.preset) || "";
+            const normalizedProfile = profileCandidate.toLowerCase().replace(/[-\s]+/g, "_");
+            const profile = RUN_TEST_PROFILES.has(normalizedProfile) ? normalizedProfile : undefined;
+            const cwd = asString(action.cwd) || asString(action.path);
+            if ((command || profile) && cwd) {
+                actions.push({
+                    type: "run_tests",
+                    command: command || undefined,
+                    profile,
+                    cwd,
+                    timeout_seconds: typeof action.timeout_seconds === "number"
+                        ? Math.max(5, Math.min(1_800, Math.round(action.timeout_seconds)))
+                        : undefined,
+                });
+            }
+            continue;
+        }
         if (type === "list_files" || type === "ls") {
             const filePath = asString(action.path) || "~";
             const limit = typeof action.limit === "number" ? Math.max(1, Math.min(5_000, action.limit)) : undefined;
@@ -1080,6 +1319,13 @@ function parseStructuredActions(job) {
             }
             continue;
         }
+        if (type === "delete_file" || type === "remove_file") {
+            const filePath = asString(action.path) || asString(action.target_path);
+            if (filePath) {
+                actions.push({ type: "delete_file", path: filePath });
+            }
+            continue;
+        }
         if (type === "set_volume" || type === "volume") {
             const rawLevel = Number(action.level);
             if (Number.isFinite(rawLevel)) {
@@ -1249,6 +1495,46 @@ function extractActions(job) {
     }
     return deriveActionsFromText(job);
 }
+function bindStepReporter(reporter, stepId) {
+    const normalizedStepId = String(stepId || "").trim() || undefined;
+    const withStepId = (options) => ({
+        ...(options || {}),
+        stepId: String(options?.stepId || normalizedStepId || "").trim() || undefined,
+    });
+    return {
+        accepted: (options) => reporter.accepted(withStepId(options)),
+        progress: (progressPercent, progressMessage, options) => reporter.progress(progressPercent, progressMessage, withStepId(options)),
+        confirmRequired: (progressMessage, confirmationContext, options) => reporter.confirmRequired(progressMessage, confirmationContext, withStepId(options)),
+        completed: (result, options) => reporter.completed(result, withStepId(options)),
+        failed: (errorMessage, result, options) => reporter.failed(errorMessage, result, withStepId(options)),
+    };
+}
+function appendInlineRuntimeArtifact(artifacts, runtimeManifest, actionIndex, kind, payload, stepId) {
+    const artifactId = runtimeExpectedArtifactIdForActionIndex(runtimeManifest, actionIndex, kind);
+    if (!artifactId) {
+        return;
+    }
+    const metadata = asRecord(payload.metadata);
+    const artifact = {
+        ...payload,
+        id: String(payload.id || artifactId).trim() || artifactId,
+        artifact_id: artifactId,
+        kind,
+        metadata: {
+            ...metadata,
+            expected_artifact_id: artifactId,
+            inline: true,
+            action_index: actionIndex,
+            step_id: String(stepId || "").trim() || undefined,
+        },
+    };
+    const existingIndex = artifacts.findIndex((item) => (String(item.artifact_id || item.id || "").trim() === artifactId));
+    if (existingIndex >= 0) {
+        artifacts[existingIndex] = artifact;
+        return;
+    }
+    artifacts.push(artifact);
+}
 export class NativeMacOSJobExecutor {
     bridgeConfig;
     cancelledJobs = new Set();
@@ -1273,6 +1559,14 @@ export class NativeMacOSJobExecutor {
             throw new Error("The native-macos executor only runs on macOS");
         }
         const actions = extractActions(job);
+        const runtimeManifest = parseJobRuntimeManifest(job);
+        const stepWorkerIdById = new Map(runtimeManifest.steps
+            .filter((step) => step.step_id)
+            .map((step) => [step.step_id, step.worker_id || undefined]));
+        const workspaceContext = await resolveWorkspaceContext({
+            workspaceContext: runtimeManifest.workspaceContext,
+            actions,
+        });
         if (actions.length === 0) {
             throw new Error("Otto Bridge native-macos could not derive a supported local action from this request");
         }
@@ -1285,39 +1579,307 @@ export class NativeMacOSJobExecutor {
             const decision = await reporter.confirmRequired(confirmation.message, {
                 actions,
                 executor: "native-macos",
+            }, {
+                stepId: runtimeManifest.approvalStepId,
             });
             if (decision.action !== "approve") {
                 throw new JobCancelledError(job.job_id);
             }
         }
-        try {
-            const completionNotes = [];
-            const artifacts = [];
-            const resultPayload = {
-                executor: "native-macos",
+        const completionNotes = [];
+        const artifacts = [];
+        const hookTrace = [];
+        const resultPayload = {
+            executor: "native-macos",
+            actions,
+            artifacts,
+            action_summaries: completionNotes,
+            runtime_hook_trace: hookTrace,
+        };
+        if (runtimeManifest.commandPacks.length > 0) {
+            resultPayload.command_packs = runtimeManifest.commandPacks;
+            artifacts.push({
+                id: `command_packs.${job.job_id}`,
+                kind: "command_packs",
+                summary: `Command packs declarados para este job: ${runtimeManifest.commandPacks.map((item) => item.pack_id).join(", ")}.`,
+                metadata: {
+                    pack_count: runtimeManifest.commandPacks.length,
+                    selected_pack_ids: runtimeManifest.commandPacks.filter((item) => item.selected === true).map((item) => item.pack_id),
+                },
+            });
+        }
+        if (runtimeManifest.workerProfiles.length > 0) {
+            resultPayload.worker_profiles = runtimeManifest.workerProfiles;
+            artifacts.push({
+                id: `worker_profiles.${job.job_id}`,
+                kind: "worker_profiles",
+                summary: `Perfis declarados para este job: ${runtimeManifest.workerProfiles.map((item) => item.worker_id).join(", ")}.`,
+                metadata: {
+                    worker_count: runtimeManifest.workerProfiles.length,
+                    worker_ids: runtimeManifest.workerProfiles.map((item) => item.worker_id),
+                },
+            });
+        }
+        if (runtimeManifest.workerExecution.length > 0) {
+            resultPayload.worker_execution = runtimeManifest.workerExecution;
+            artifacts.push({
+                id: `worker_execution.${job.job_id}`,
+                kind: "worker_execution",
+                summary: `Policies declaradas para ${runtimeManifest.workerExecution.length} workers deste job.`,
+                metadata: {
+                    worker_count: runtimeManifest.workerExecution.length,
+                    worker_ids: runtimeManifest.workerExecution.map((item) => item.worker_id),
+                },
+            });
+        }
+        if (runtimeManifest.instructionUpdate) {
+            resultPayload.instruction_update = runtimeManifest.instructionUpdate;
+            artifacts.push({
+                id: `instruction_update.${job.job_id}`,
+                kind: "instruction_update",
+                summary: runtimeManifest.instructionUpdate.reason || "Instruction updater declarado para este job.",
+                metadata: {
+                    updater_id: runtimeManifest.instructionUpdate.updater_id,
+                    selected: runtimeManifest.instructionUpdate.selected === true,
+                    target_count: runtimeManifest.instructionUpdate.target_paths.length,
+                },
+            });
+        }
+        if (runtimeManifest.validationLadder) {
+            resultPayload.validation_ladder = runtimeManifest.validationLadder;
+            artifacts.push({
+                id: `validation_ladder.${job.job_id}`,
+                kind: "validation_ladder",
+                summary: runtimeManifest.validationLadder.summary || "Validation ladder declarada para este job.",
+                metadata: {
+                    ladder_id: runtimeManifest.validationLadder.ladder_id,
+                    stage_count: runtimeManifest.validationLadder.stages.length,
+                    selected_command_pack_id: runtimeManifest.validationLadder.selected_command_pack_id || undefined,
+                },
+            });
+        }
+        if (runtimeManifest.hookBus) {
+            resultPayload.hook_bus = runtimeManifest.hookBus;
+            artifacts.push({
+                id: `hook_bus.${job.job_id}`,
+                kind: "hook_bus",
+                summary: runtimeManifest.hookBus.summary || "Hook bus declarado para este job.",
+                metadata: {
+                    event_count: runtimeManifest.hookBus.events.length,
+                    sink_count: runtimeManifest.hookBus.sinks.length,
+                },
+            });
+        }
+        if (workspaceContext) {
+            resultPayload.workspace_context = {
+                workspace_id: workspaceContext.workspaceId,
+                repo_root: workspaceContext.repoRoot || undefined,
+                default_cwd: workspaceContext.defaultCwd,
+                summary: workspaceContext.summary,
+                roots: workspaceContext.roots,
+                targets: workspaceContext.targets,
+                workspace_policy: workspaceContext.workspacePolicy || undefined,
+            };
+            artifacts.push({
+                id: `workspace_context.${workspaceContext.workspaceId}`,
+                kind: "workspace_context",
+                summary: workspaceContext.summary,
+                metadata: {
+                    workspace_id: workspaceContext.workspaceId,
+                    repo_root: workspaceContext.repoRoot || undefined,
+                    root_count: workspaceContext.roots.length,
+                    target_count: workspaceContext.targets.length,
+                    policy_profile_id: workspaceContext.workspacePolicy?.profile_id || undefined,
+                },
+            });
+            if (workspaceContext.instructionBundle) {
+                resultPayload.instruction_bundle = workspaceContext.instructionBundle;
+                artifacts.push({
+                    id: `instruction_bundle.${workspaceContext.workspaceId}`,
+                    kind: "instruction_bundle",
+                    summary: workspaceContext.instructionBundle.summary,
+                    metadata: {
+                        workspace_id: workspaceContext.workspaceId,
+                        source_count: workspaceContext.instructionBundle.source_count,
+                        digest: workspaceContext.instructionBundle.digest,
+                    },
+                });
+            }
+            if (workspaceContext.repoManifest) {
+                resultPayload.repo_manifest = workspaceContext.repoManifest;
+                artifacts.push({
+                    id: `repo_manifest.${workspaceContext.workspaceId}`,
+                    kind: "repo_manifest",
+                    summary: workspaceContext.repoManifest.summary,
+                    metadata: {
+                        workspace_id: workspaceContext.workspaceId,
+                        scoped_root_path: workspaceContext.repoManifest.scoped_root_path,
+                        detected_repo_root: workspaceContext.repoManifest.detected_repo_root || undefined,
+                        repo_root_within_workspace: workspaceContext.repoManifest.repo_root_within_workspace,
+                        repo_name: workspaceContext.repoManifest.repo_name,
+                        vcs: workspaceContext.repoManifest.vcs,
+                        manifest_file_count: workspaceContext.repoManifest.manifest_files.length,
+                        lockfile_count: workspaceContext.repoManifest.lockfiles.length,
+                        package_managers: workspaceContext.repoManifest.package_managers,
+                    },
+                });
+            }
+            if (workspaceContext.workspaceIndex) {
+                resultPayload.workspace_index = workspaceContext.workspaceIndex;
+                artifacts.push({
+                    id: `workspace_index.${workspaceContext.workspaceId}`,
+                    kind: "workspace_index",
+                    summary: workspaceContext.workspaceIndex.summary,
+                    metadata: {
+                        workspace_id: workspaceContext.workspaceId,
+                        base_path: workspaceContext.workspaceIndex.base_path,
+                        scanned_directory_count: workspaceContext.workspaceIndex.scanned_directory_count,
+                        scanned_file_count: workspaceContext.workspaceIndex.scanned_file_count,
+                        truncated: workspaceContext.workspaceIndex.truncated,
+                        key_file_count: workspaceContext.workspaceIndex.key_files.length,
+                    },
+                });
+            }
+            if (workspaceContext.workspacePolicy) {
+                resultPayload.workspace_policy = workspaceContext.workspacePolicy;
+                artifacts.push({
+                    id: `workspace_policy.${workspaceContext.workspaceId}`,
+                    kind: "workspace_policy",
+                    summary: workspaceContext.workspacePolicy.summary,
+                    metadata: {
+                        workspace_id: workspaceContext.workspaceId,
+                        profile_id: workspaceContext.workspacePolicy.profile_id,
+                        allow_shell: workspaceContext.workspacePolicy.allow_shell,
+                        allow_code_write: workspaceContext.workspacePolicy.allow_code_write,
+                        allow_destructive: workspaceContext.workspacePolicy.allow_destructive,
+                        allow_release: workspaceContext.workspacePolicy.allow_release,
+                        blocked_action_count: workspaceContext.workspacePolicy.blocked_action_types.length,
+                    },
+                });
+            }
+        }
+        const attachWorkspaceMemory = (jobStatus) => {
+            if (!workspaceContext) {
+                return;
+            }
+            const workspaceMemory = buildWorkspaceMemory({
+                workspaceId: workspaceContext.workspaceId,
+                workspace: workspaceContext,
+                priorMemory: workspaceContext.workspaceMemory,
                 actions,
                 artifacts,
-                action_summaries: completionNotes,
-            };
+                jobId: job.job_id,
+                jobStatus,
+            });
+            resultPayload.workspace_memory = workspaceMemory;
+            artifacts.push({
+                id: `workspace_memory.${workspaceContext.workspaceId}`,
+                kind: "workspace_memory",
+                summary: workspaceMemory.summary,
+                metadata: {
+                    workspace_id: workspaceContext.workspaceId,
+                    job_count: workspaceMemory.job_count,
+                    latest_job_id: workspaceMemory.latest_job_id || undefined,
+                    latest_job_status: workspaceMemory.latest_job_status || undefined,
+                    recent_action_count: workspaceMemory.recent_action_types.length,
+                    recent_target_count: workspaceMemory.recent_target_paths.length,
+                    recent_artifact_kind_count: workspaceMemory.recent_artifact_kinds.length,
+                },
+            });
+        };
+        let currentActionStepId;
+        const appendHookEvent = (eventType, options) => {
+            hookTrace.push({
+                hook_id: `hook.${String(hookTrace.length + 1).padStart(3, "0")}`,
+                event_type: eventType,
+                recorded_at: new Date().toISOString(),
+                source: "bridge_runtime",
+                graph_id: runtimeManifest.graphId || undefined,
+                step_id: options?.stepId || undefined,
+                worker_id: (options?.stepId ? stepWorkerIdById.get(options.stepId) : undefined) || undefined,
+                message: options?.message || undefined,
+                metadata: options?.metadata || undefined,
+            });
+        };
+        try {
             for (let index = 0; index < actions.length; index += 1) {
                 this.assertNotCancelled(job.job_id);
                 const action = actions[index];
                 const progressPercent = Math.max(10, Math.round(((index + 1) / actions.length) * 100));
+                currentActionStepId = runtimeStepIdForActionIndex(runtimeManifest, index);
+                const stepReporter = bindStepReporter(reporter, currentActionStepId);
+                if (workspaceContext) {
+                    assertActionAllowedByWorkspacePolicy(workspaceContext, action.type);
+                }
+                appendHookEvent("pre_tool_use", {
+                    stepId: currentActionStepId,
+                    message: `Preparando ${action.type}.`,
+                    metadata: {
+                        action_type: action.type,
+                        action_index: index,
+                    },
+                });
+                const reportActionProgress = async (progressMessage) => {
+                    await stepReporter.progress(progressPercent, progressMessage);
+                };
+                const appendActionArtifact = (kind, payload) => {
+                    appendInlineRuntimeArtifact(artifacts, runtimeManifest, index, kind, payload, currentActionStepId);
+                };
                 if (action.type === "open_app") {
-                    await reporter.progress(progressPercent, `Abrindo ${action.app} no macOS`);
+                    await reportActionProgress(`Abrindo ${action.app} no macOS`);
                     await this.openApp(action.app);
+                    resultPayload.last_app_action = {
+                        action: "open_app",
+                        app: action.app,
+                        focused: true,
+                    };
+                    appendActionArtifact("app_state", {
+                        summary: `${action.app} foi aberto no macOS.`,
+                        app: action.app,
+                    });
                     completionNotes.push(`${action.app} foi aberto no macOS.`);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
                     continue;
                 }
                 if (action.type === "focus_app") {
-                    await reporter.progress(progressPercent, `Trazendo ${action.app} para frente`);
+                    await reportActionProgress(`Trazendo ${action.app} para frente`);
                     await this.focusApp(action.app);
+                    resultPayload.last_app_action = {
+                        action: "focus_app",
+                        app: action.app,
+                        focused: true,
+                    };
+                    appendActionArtifact("app_state", {
+                        summary: `${action.app} ficou em foco no macOS.`,
+                        app: action.app,
+                    });
                     completionNotes.push(`${action.app} ficou em foco no macOS.`);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
                     continue;
                 }
                 if (action.type === "press_shortcut") {
-                    await reporter.progress(progressPercent, `Enviando atalho ${action.shortcut}`);
+                    await reportActionProgress(`Enviando atalho ${action.shortcut}`);
                     const shortcutResult = await this.pressShortcut(action.shortcut);
+                    resultPayload.last_shortcut = {
+                        shortcut: action.shortcut,
+                        performed: shortcutResult.performed,
+                        reason: shortcutResult.reason || null,
+                    };
+                    appendActionArtifact("app_state", {
+                        summary: shortcutResult.performed
+                            ? `Atalho ${action.shortcut} enviado no macOS.`
+                            : (shortcutResult.reason || `O atalho ${action.shortcut} foi pulado.`),
+                        shortcut: action.shortcut,
+                        performed: shortcutResult.performed,
+                    });
                     if (action.shortcut.startsWith("media_")) {
                         const mediaSummaryMap = {
                             media_next: "Acionei o comando de próxima mídia no macOS.",
@@ -1339,14 +1901,23 @@ export class NativeMacOSJobExecutor {
                     continue;
                 }
                 if (action.type === "create_note") {
-                    await reporter.progress(progressPercent, "Criando nota no Notes");
+                    await reportActionProgress("Criando nota no Notes");
                     const noteTitle = await this.createNote(action.text, action.title);
+                    resultPayload.note = {
+                        title: noteTitle,
+                        text_preview: clipText(action.text, 180),
+                    };
+                    appendActionArtifact("local_note", {
+                        summary: `Nota criada no Notes: ${noteTitle}`,
+                        title: noteTitle,
+                        mime_type: "text/plain",
+                    });
                     completionNotes.push(`Nota criada no Notes: ${noteTitle}`);
                     continue;
                 }
                 if (action.type === "type_text") {
                     const typingApp = this.lastActiveApp || await this.getFrontmostAppName();
-                    await reporter.progress(progressPercent, `Digitando texto em ${typingApp || "app ativo"}`);
+                    await reportActionProgress(`Digitando texto em ${typingApp || "app ativo"}`);
                     const typed = await this.guidedTypeText(action.text, typingApp || undefined);
                     if (!typed.ok) {
                         throw new Error(typed.reason || "Nao consegui digitar o texto no app ativo.");
@@ -1358,6 +1929,15 @@ export class NativeMacOSJobExecutor {
                         attempts: typed.attempts,
                         text_preview: clipText(action.text, 180),
                     };
+                    appendActionArtifact("typed_text", {
+                        summary: typed.verified
+                            ? `Digitei e confirmei o texto no ${typed.app || "app ativo"}.`
+                            : `Digitei o texto no ${typed.app || "app ativo"}.`,
+                        mime_type: "text/plain",
+                        app: typed.app || null,
+                        verified: typed.verified,
+                        text_preview: clipText(action.text, 180),
+                    });
                     this.lastVisualTargetDescription = null;
                     this.lastVisualTargetApp = null;
                     completionNotes.push(typed.verified
@@ -1366,14 +1946,16 @@ export class NativeMacOSJobExecutor {
                     continue;
                 }
                 if (action.type === "take_screenshot") {
-                    await reporter.progress(progressPercent, "Capturando screenshot do Mac");
+                    await reportActionProgress("Capturando screenshot do Mac");
                     const screenshotPath = await this.takeScreenshot(action.path);
                     const uploadable = await this.buildUploadableImage(screenshotPath);
+                    const expectedArtifactId = runtimeExpectedArtifactIdForActionIndex(runtimeManifest, index, "screenshot");
                     const screenshotArtifact = await this.uploadArtifactForJob(job.job_id, uploadable.path, {
                         kind: "screenshot",
                         mimeTypeOverride: uploadable.mimeType,
                         fileNameOverride: uploadable.filename,
                         metadata: {
+                            expected_artifact_id: expectedArtifactId || undefined,
                             visible_in_chat: true,
                             width: uploadable.dimensions?.width || undefined,
                             height: uploadable.dimensions?.height || undefined,
@@ -1393,14 +1975,14 @@ export class NativeMacOSJobExecutor {
                     continue;
                 }
                 if (action.type === "read_frontmost_page") {
-                    await reporter.progress(progressPercent, `Lendo a pagina ativa em ${action.app || "Safari"}`);
+                    await reportActionProgress(`Lendo a pagina ativa em ${action.app || "Safari"}`);
                     const page = await this.readFrontmostPage(action.app || "Safari");
                     this.lastReadFrontmostPage = {
                         app: action.app || "Safari",
                         ...page,
                     };
                     if (!page.text && this.bridgeConfig?.apiBaseUrl && this.bridgeConfig?.deviceToken) {
-                        await reporter.progress(progressPercent, "Safari bloqueou leitura direta; vou analisar a pagina pela tela");
+                        await reportActionProgress("Safari bloqueou leitura direta; vou analisar a pagina pela tela");
                         const screenshotPath = await this.takeScreenshot();
                         const uploadable = await this.buildUploadableImage(screenshotPath);
                         const artifact = await this.uploadArtifactForJob(job.job_id, uploadable.path, {
@@ -1429,73 +2011,424 @@ export class NativeMacOSJobExecutor {
                         }
                     }
                     resultPayload.page = page;
+                    appendActionArtifact("page_snapshot", {
+                        summary: `Li a pagina ${page.title || page.url || "ativa"} no navegador.`,
+                        mime_type: "text/plain",
+                        title: page.title || undefined,
+                        path: page.url || undefined,
+                    });
                     completionNotes.push(`Li a pagina ${page.title || page.url || "ativa"} no navegador.`);
                     continue;
                 }
                 if (action.type === "browser_context") {
-                    await reporter.progress(progressPercent, "Lendo o contexto do navegador ativo");
+                    await reportActionProgress("Lendo o contexto do navegador ativo");
                     const browserContext = await this.collectBrowserContext(action.app, action.include_text === true, action.include_tabs === true);
                     resultPayload.browser_context = browserContext;
                     resultPayload.summary = browserContext.summary;
+                    appendActionArtifact("browser_context", {
+                        summary: browserContext.summary,
+                        title: browserContext.title || undefined,
+                        path: browserContext.url || undefined,
+                    });
                     completionNotes.push(browserContext.summary);
                     continue;
                 }
                 if (action.type === "app_status") {
-                    await reporter.progress(progressPercent, "Lendo os apps ativos do Mac");
+                    await reportActionProgress("Lendo os apps ativos do Mac");
                     const appStatus = await this.collectAppStatus(action.app, action.include_frontmost === true, action.include_running_apps === true, action.include_top_processes === true);
                     resultPayload.app_status = appStatus;
                     resultPayload.summary = appStatus.summary;
+                    appendActionArtifact("app_status", {
+                        summary: appStatus.summary,
+                        app: action.app || appStatus.frontmost_app || undefined,
+                    });
                     completionNotes.push(appStatus.summary);
                     continue;
                 }
                 if (action.type === "filesystem_inspect") {
-                    await reporter.progress(progressPercent, `Inspecionando ${action.path}`);
-                    const filesystem = await this.inspectFilesystemPath(action.path, action.include_children === true, action.include_preview === true, action.limit);
+                    await reportActionProgress(`Inspecionando ${action.path}`);
+                    const filesystem = await this.inspectFilesystemPath(action.path, action.include_children === true, action.include_preview === true, action.limit, workspaceContext);
                     resultPayload.filesystem = filesystem;
                     resultPayload.summary = filesystem.summary;
+                    appendActionArtifact("filesystem_snapshot", {
+                        summary: filesystem.summary,
+                        path: filesystem.resolved_path,
+                    });
                     completionNotes.push(filesystem.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
                     continue;
                 }
                 if (action.type === "read_file") {
-                    await reporter.progress(progressPercent, `Lendo ${action.path}`);
-                    const fileContent = await this.readLocalFileSnapshot(action.path, action.max_chars);
+                    await reportActionProgress(`Lendo ${action.path}`);
+                    const fileContent = await this.readLocalFileSnapshot(action.path, action.max_chars, workspaceContext);
                     resultPayload.read_file = fileContent;
                     resultPayload.summary = fileContent.summary;
+                    appendActionArtifact("file_content", {
+                        summary: fileContent.summary,
+                        path: fileContent.resolved_path,
+                        mime_type: fileContent.mime_type,
+                        filename: fileContent.name,
+                    });
                     completionNotes.push(fileContent.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
                     continue;
                 }
                 if (action.type === "trash_path") {
-                    await reporter.progress(progressPercent, `Movendo ${action.path} para a Lixeira`);
-                    const trashed = await this.movePathToTrashSnapshot(action.path);
+                    await reportActionProgress(`Movendo ${action.path} para a Lixeira`);
+                    const trashed = await this.movePathToTrashSnapshot(action.path, workspaceContext);
                     resultPayload.trash_path = trashed;
                     resultPayload.summary = trashed.summary;
+                    appendActionArtifact("trash_receipt", {
+                        summary: trashed.summary,
+                        path: trashed.trashed_path,
+                        filename: trashed.name,
+                    });
                     completionNotes.push(trashed.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "delete_file") {
+                    await reportActionProgress(`Apagando arquivo local ${action.path}`);
+                    const deleted = await this.deleteLocalFileSnapshot(action.path, workspaceContext);
+                    resultPayload.delete_file = deleted;
+                    resultPayload.summary = deleted.summary;
+                    appendActionArtifact("delete_receipt", {
+                        summary: deleted.summary,
+                        path: deleted.resolved_path,
+                        filename: deleted.name,
+                    });
+                    completionNotes.push(deleted.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
                     continue;
                 }
                 if (action.type === "write_text_file") {
                     const targetLabel = action.filename ? `${action.path}/${action.filename}` : action.path;
-                    await reporter.progress(progressPercent, `Escrevendo arquivo de texto em ${targetLabel}`);
+                    await reportActionProgress(`Escrevendo arquivo de texto em ${targetLabel}`);
                     const resolvedContent = this.resolveWriteTextFileContent(action);
                     if (!resolvedContent) {
                         throw new Error("Nenhum texto foi informado para gravar no arquivo local.");
                     }
-                    const written = await this.writeTextFileSnapshot(action.path, resolvedContent.content, action.filename, action.append === true, resolvedContent.source);
+                    const written = await this.writeTextFileSnapshot(action.path, resolvedContent.content, action.filename, action.append === true, resolvedContent.source, workspaceContext);
                     resultPayload.write_text_file = written;
                     resultPayload.summary = written.summary;
+                    appendActionArtifact("local_file", {
+                        summary: written.summary,
+                        path: written.resolved_path,
+                        filename: written.name,
+                        mime_type: written.mime_type,
+                    });
+                    completionNotes.push(written.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "write_json_file") {
+                    const targetLabel = action.filename ? `${action.path}/${action.filename}` : action.path;
+                    await reportActionProgress(`Escrevendo arquivo JSON em ${targetLabel}`);
+                    const written = await this.writeJsonFileSnapshot(action.path, action.data, action.filename, action.pretty !== false, workspaceContext);
+                    resultPayload.write_json_file = written;
+                    resultPayload.summary = written.summary;
+                    appendActionArtifact("local_file", {
+                        summary: written.summary,
+                        path: written.resolved_path,
+                        filename: written.name,
+                        mime_type: written.mime_type,
+                    });
                     completionNotes.push(written.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "apply_patch") {
+                    await reportActionProgress(`Aplicando patch local em ${action.cwd}`);
+                    const patchSet = await this.applyPatchSnapshot(action.patch, action.cwd, workspaceContext);
+                    resultPayload.patch_set = patchSet;
+                    resultPayload.summary = patchSet.summary;
+                    appendActionArtifact("patch_set", {
+                        summary: patchSet.summary,
+                        path: patchSet.resolved_cwd,
+                        mime_type: "application/json",
+                    });
+                    completionNotes.push(patchSet.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "mkdir") {
+                    await reportActionProgress(`Criando pasta em ${action.path}`);
+                    const created = await this.createDirectorySnapshot(action.path, action.create_parents !== false, workspaceContext);
+                    resultPayload.mkdir = created;
+                    resultPayload.summary = created.summary;
+                    appendActionArtifact("directory_receipt", {
+                        summary: created.summary,
+                        path: created.resolved_path,
+                        filename: created.name,
+                    });
+                    completionNotes.push(created.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "move_file") {
+                    await reportActionProgress(`Movendo item local de ${action.source_path} para ${action.destination_path}`);
+                    const moved = await this.moveLocalPathSnapshot(action.source_path, action.destination_path, action.overwrite === true, workspaceContext);
+                    resultPayload.move_file = moved;
+                    resultPayload.summary = moved.summary;
+                    appendActionArtifact("move_receipt", {
+                        summary: moved.summary,
+                        path: moved.resolved_destination_path,
+                        filename: moved.name,
+                    });
+                    completionNotes.push(moved.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "git_clone") {
+                    await reportActionProgress(`Clonando repositório em ${action.destination_path}`);
+                    const gitClone = await this.gitCloneSnapshot(action.repository, action.destination_path, {
+                        branch: action.branch,
+                        depth: action.depth,
+                    }, workspaceContext);
+                    resultPayload.git_clone = gitClone;
+                    resultPayload.summary = gitClone.summary;
+                    appendActionArtifact("git_clone_receipt", {
+                        summary: gitClone.summary,
+                        path: gitClone.repo_root || gitClone.resolved_destination_path,
+                        mime_type: "application/json",
+                    });
+                    completionNotes.push(gitClone.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: gitClone.cloned ? "completed" : "failed" },
+                    });
+                    continue;
+                }
+                if (action.type === "git_fetch") {
+                    await reportActionProgress(`Atualizando refs remotos do Git em ${action.cwd}`);
+                    const gitFetch = await this.gitFetchSnapshot(action.cwd, {
+                        remote: action.remote,
+                        prune: action.prune === true,
+                        tags: action.tags === true,
+                    }, workspaceContext);
+                    resultPayload.git_fetch = gitFetch;
+                    resultPayload.summary = gitFetch.summary;
+                    appendActionArtifact("git_fetch_receipt", {
+                        summary: gitFetch.summary,
+                        path: gitFetch.repo_root || gitFetch.resolved_cwd,
+                        mime_type: "application/json",
+                    });
+                    completionNotes.push(gitFetch.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: gitFetch.fetched === false ? "failed" : "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "git_checkout") {
+                    await reportActionProgress(`Trocando branch local em ${action.cwd}`);
+                    const gitCheckout = await this.gitCheckoutSnapshot(action.cwd, {
+                        target: action.target,
+                        startPoint: action.start_point,
+                        createBranch: action.create_branch === true,
+                        detach: action.detach === true,
+                    }, workspaceContext);
+                    resultPayload.git_checkout = gitCheckout;
+                    resultPayload.summary = gitCheckout.summary;
+                    appendActionArtifact("git_checkout_receipt", {
+                        summary: gitCheckout.summary,
+                        path: gitCheckout.repo_root || gitCheckout.resolved_cwd,
+                        mime_type: "application/json",
+                    });
+                    completionNotes.push(gitCheckout.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: gitCheckout.switched === false ? "failed" : "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "git_rebase") {
+                    await reportActionProgress(`Rebaseando a branch atual em ${action.cwd}`);
+                    const gitRebase = await this.gitRebaseSnapshot(action.cwd, {
+                        target: action.target,
+                        autostash: action.autostash === true,
+                    }, workspaceContext);
+                    resultPayload.git_rebase = gitRebase;
+                    resultPayload.summary = gitRebase.summary;
+                    appendActionArtifact("git_rebase_receipt", {
+                        summary: gitRebase.summary,
+                        path: gitRebase.repo_root || gitRebase.resolved_cwd,
+                        mime_type: "application/json",
+                    });
+                    completionNotes.push(gitRebase.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: gitRebase.rebased === false ? "failed" : "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "git_merge") {
+                    await reportActionProgress(`Mesclando ${action.target} em ${action.cwd}`);
+                    const gitMerge = await this.gitMergeSnapshot(action.cwd, {
+                        target: action.target,
+                        ffOnly: action.ff_only === true,
+                        noFf: action.no_ff === true,
+                        message: action.message,
+                    }, workspaceContext);
+                    resultPayload.git_merge = gitMerge;
+                    resultPayload.summary = gitMerge.summary;
+                    appendActionArtifact("git_merge_receipt", {
+                        summary: gitMerge.summary,
+                        path: gitMerge.repo_root || gitMerge.resolved_cwd,
+                        mime_type: "application/json",
+                    });
+                    completionNotes.push(gitMerge.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: gitMerge.merged === false ? "failed" : "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "git_tag") {
+                    await reportActionProgress(`Criando a tag ${action.name} em ${action.cwd}`);
+                    const gitTag = await this.gitTagSnapshot(action.cwd, {
+                        name: action.name,
+                        target: action.target,
+                        annotated: action.annotated === true,
+                        message: action.message,
+                    }, workspaceContext);
+                    resultPayload.git_tag = gitTag;
+                    resultPayload.summary = gitTag.summary;
+                    appendActionArtifact("git_tag_receipt", {
+                        summary: gitTag.summary,
+                        path: gitTag.repo_root || gitTag.resolved_cwd,
+                        mime_type: "application/json",
+                    });
+                    completionNotes.push(gitTag.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: gitTag.created === false ? "failed" : "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "git_add") {
+                    await reportActionProgress(`Preparando stage do Git em ${action.cwd}`);
+                    const gitAdd = await this.gitAddSnapshot(action.cwd, {
+                        paths: action.paths,
+                        all: action.all === true,
+                    }, workspaceContext);
+                    resultPayload.git_add = gitAdd;
+                    resultPayload.summary = gitAdd.summary;
+                    appendActionArtifact("git_stage_receipt", {
+                        summary: gitAdd.summary,
+                        path: gitAdd.repo_root || gitAdd.resolved_cwd,
+                        mime_type: "application/json",
+                    });
+                    completionNotes.push(gitAdd.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: gitAdd.error_message ? "failed" : "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "git_commit") {
+                    await reportActionProgress(`Criando commit local em ${action.cwd}`);
+                    const gitCommit = await this.gitCommitSnapshot(action.cwd, action.message, action.allow_empty === true, workspaceContext);
+                    resultPayload.git_commit = gitCommit;
+                    resultPayload.summary = gitCommit.summary;
+                    appendActionArtifact("git_commit_receipt", {
+                        summary: gitCommit.summary,
+                        path: gitCommit.repo_root || gitCommit.resolved_cwd,
+                        mime_type: "application/json",
+                    });
+                    completionNotes.push(gitCommit.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: gitCommit.committed === false ? "failed" : "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "git_push") {
+                    await reportActionProgress(`Enviando branch local para o remote em ${action.cwd}`);
+                    const gitPush = await this.gitPushSnapshot(action.cwd, {
+                        remote: action.remote,
+                        branch: action.branch,
+                        setUpstream: action.set_upstream === true,
+                    }, workspaceContext);
+                    resultPayload.git_push = gitPush;
+                    resultPayload.summary = gitPush.summary;
+                    appendActionArtifact("git_push_receipt", {
+                        summary: gitPush.summary,
+                        path: gitPush.repo_root || gitPush.resolved_cwd,
+                        mime_type: "application/json",
+                    });
+                    completionNotes.push(gitPush.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: gitPush.pushed === false ? "failed" : "completed" },
+                    });
                     continue;
                 }
                 if (action.type === "list_files") {
-                    await reporter.progress(progressPercent, `Listando arquivos em ${action.path}`);
-                    const listing = await this.listLocalFilesSnapshot(action.path, action.limit);
+                    await reportActionProgress(`Listando arquivos em ${action.path}`);
+                    const listing = await this.listLocalFilesSnapshot(action.path, action.limit, workspaceContext);
                     resultPayload.file_listing = listing;
                     resultPayload.summary = listing.summary;
+                    appendActionArtifact("file_listing", {
+                        summary: listing.summary,
+                        path: listing.resolved_path,
+                    });
                     completionNotes.push(listing.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
                     continue;
                 }
                 if (action.type === "count_files") {
-                    await reporter.progress(progressPercent, `Contando arquivos em ${action.path}`);
-                    const counted = await this.countLocalFiles(action.path, action.extensions, action.recursive !== false);
+                    await reportActionProgress(`Contando arquivos em ${action.path}`);
+                    const counted = await this.countLocalFiles(action.path, action.extensions, action.recursive !== false, workspaceContext);
                     completionNotes.push(`Encontrei ${counted.total} arquivo${counted.total === 1 ? "" : "s"} ${counted.extensionsLabel} em ${counted.path}.`);
                     resultPayload.file_count = {
                         total: counted.total,
@@ -1503,48 +2436,161 @@ export class NativeMacOSJobExecutor {
                         extensions: counted.extensions,
                         recursive: counted.recursive,
                     };
+                    appendActionArtifact("file_count", {
+                        summary: `Encontrei ${counted.total} arquivo${counted.total === 1 ? "" : "s"} ${counted.extensionsLabel} em ${counted.path}.`,
+                        path: counted.path,
+                    });
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
                     continue;
                 }
                 if (action.type === "system_status") {
-                    await reporter.progress(progressPercent, "Lendo CPU, memoria, disco e bateria do Mac");
+                    await reportActionProgress("Lendo CPU, memoria, disco e bateria do Mac");
                     const systemStatus = await this.collectSystemStatus(action.sections, action.include_top_processes === true);
                     resultPayload.system_status = systemStatus;
                     resultPayload.summary = systemStatus.summary;
+                    appendActionArtifact("system_status", {
+                        summary: systemStatus.summary,
+                    });
                     completionNotes.push(systemStatus.summary);
                     continue;
                 }
-                if (action.type === "run_shell") {
-                    await reporter.progress(progressPercent, `Rodando comando local: ${action.command}`);
-                    const shellOutput = await this.runShellCommand(action.command, action.cwd);
-                    completionNotes.push(`Saida de \`${action.command}\`:\n${shellOutput}`);
+                if (action.type === "git_status") {
+                    await reportActionProgress(`Lendo o estado do Git em ${action.cwd}`);
+                    const gitStatus = await this.gitStatusSnapshot(action.cwd, action.include_untracked !== false, workspaceContext);
+                    resultPayload.git_status = gitStatus;
+                    resultPayload.summary = gitStatus.summary;
+                    appendActionArtifact("git_status_report", {
+                        summary: gitStatus.summary,
+                        path: gitStatus.repo_root || gitStatus.resolved_cwd,
+                        mime_type: "application/json",
+                    });
+                    completionNotes.push(gitStatus.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
                     continue;
                 }
-                if (action.type === "set_volume") {
-                    await reporter.progress(progressPercent, `Ajustando volume para ${action.level}%`);
-                    await this.setVolume(action.level);
-                    completionNotes.push(`Volume ajustado para ${action.level}% no macOS.`);
+                if (action.type === "git_diff") {
+                    await reportActionProgress(`Lendo o diff do Git em ${action.cwd}`);
+                    const gitDiff = await this.gitDiffSnapshot(action.cwd, {
+                        staged: action.staged === true,
+                        baseRef: action.base_ref,
+                        paths: action.paths,
+                        maxChars: action.max_chars,
+                    }, workspaceContext);
+                    resultPayload.git_diff = gitDiff;
+                    resultPayload.summary = gitDiff.summary;
+                    appendActionArtifact("git_diff_report", {
+                        summary: gitDiff.summary,
+                        path: gitDiff.repo_root || gitDiff.resolved_cwd,
+                        mime_type: "text/plain",
+                    });
+                    completionNotes.push(gitDiff.summary);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
                     continue;
                 }
-                if (action.type === "scroll_view") {
-                    const scrollApp = action.app || this.lastActiveApp || await this.getFrontmostAppName();
-                    if (scrollApp) {
-                        await reporter.progress(progressPercent, `Trazendo ${scrollApp} para frente antes de rolar a tela`);
-                        await this.focusApp(scrollApp);
-                    }
-                    const directionLabel = action.direction === "up" ? "cima" : "baixo";
-                    await reporter.progress(progressPercent, `Rolando a tela para ${directionLabel}`);
-                    await this.scrollView(action.direction, action.amount, action.steps);
-                    resultPayload.last_scroll = {
+                if (action.type === "run_tests") {
+                    await reportActionProgress(`Rodando testes em ${action.cwd}`);
+                    appendHookEvent("validation_ladder_started", {
+                        stepId: currentActionStepId,
+                        message: "Validation ladder iniciada.",
+                        metadata: {
+                            requested_profile: action.profile || undefined,
+                            ladder_id: runtimeManifest.validationLadder?.ladder_id || undefined,
+                        },
+                    });
+                    const testReport = await this.runTestsSnapshot(action.command, action.cwd, action.timeout_seconds, workspaceContext, action.profile, runtimeManifest);
+                    resultPayload.test_report = testReport;
+                    resultPayload.summary = testReport.summary;
+                    appendActionArtifact("test_report", {
+                        summary: testReport.summary,
+                        path: testReport.resolved_cwd,
+                        mime_type: "text/plain",
+                    });
+                    completionNotes.push(testReport.summary);
+                    appendHookEvent("validation_ladder_completed", {
+                        stepId: currentActionStepId,
+                        message: testReport.summary,
+                        metadata: {
+                            requested_profile: action.profile || undefined,
+                            stage_count: testReport.stage_count || 0,
+                            failed_stage_id: testReport.failed_stage_id || undefined,
+                            passed: testReport.passed,
+                        },
+                    });
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: testReport.passed ? "completed" : "failed" },
+                    });
+                    continue;
+                }
+                if (action.type === "run_shell") {
+                    await reportActionProgress(`Rodando comando local: ${action.command}`);
+                    const shellOutput = await this.runShellCommand(action.command, action.cwd, workspaceContext);
+                    resultPayload.shell_result = {
+                        command: action.command,
+                        cwd: workspaceContext ? assertCwdInsideWorkspace(workspaceContext, action.cwd) : (action.cwd || null),
+                        output: shellOutput,
+                    };
+                    appendActionArtifact("shell_result", {
+                        summary: `Comando executado: ${action.command}`,
+                        mime_type: "text/plain",
+                    });
+                    completionNotes.push(`Saida de \`${action.command}\`:\n${shellOutput}`);
+                    appendHookEvent("post_tool_use", {
+                        stepId: currentActionStepId,
+                        message: `${action.type} concluido.`,
+                        metadata: { action_type: action.type, status: "completed" },
+                    });
+                    continue;
+                }
+                if (action.type === "set_volume") {
+                    await reportActionProgress(`Ajustando volume para ${action.level}%`);
+                    await this.setVolume(action.level);
+                    resultPayload.device_state = {
+                        volume_level: action.level,
+                    };
+                    appendActionArtifact("device_state_change", {
+                        summary: `Volume ajustado para ${action.level}% no macOS.`,
+                    });
+                    completionNotes.push(`Volume ajustado para ${action.level}% no macOS.`);
+                    continue;
+                }
+                if (action.type === "scroll_view") {
+                    const scrollApp = action.app || this.lastActiveApp || await this.getFrontmostAppName();
+                    if (scrollApp) {
+                        await reportActionProgress(`Trazendo ${scrollApp} para frente antes de rolar a tela`);
+                        await this.focusApp(scrollApp);
+                    }
+                    const directionLabel = action.direction === "up" ? "cima" : "baixo";
+                    await reportActionProgress(`Rolando a tela para ${directionLabel}`);
+                    await this.scrollView(action.direction, action.amount, action.steps);
+                    resultPayload.last_scroll = {
                         direction: action.direction,
                         amount: action.amount || "medium",
                         steps: action.steps || 1,
                         app: scrollApp || null,
                     };
+                    appendActionArtifact("viewport_change", {
+                        summary: `Rolei a tela para ${directionLabel} no macOS.`,
+                        app: scrollApp || null,
+                    });
                     completionNotes.push(`Rolei a tela para ${directionLabel} no macOS.`);
                     continue;
                 }
                 if (action.type === "whatsapp_send_message") {
-                    await reporter.progress(progressPercent, `Abrindo a conversa do WhatsApp com ${action.contact}`);
+                    await reportActionProgress(`Abrindo a conversa do WhatsApp com ${action.contact}`);
                     await this.ensureWhatsAppWebReady();
                     const selected = await this.selectWhatsAppConversation(action.contact);
                     if (!selected) {
@@ -1554,7 +2600,7 @@ export class NativeMacOSJobExecutor {
                         messages: [],
                         summary: "",
                     }));
-                    await reporter.progress(progressPercent, `Enviando a mensagem para ${action.contact} no WhatsApp`);
+                    await reportActionProgress(`Enviando a mensagem para ${action.contact} no WhatsApp`);
                     await this.sendWhatsAppMessage(action.text);
                     await delay(900);
                     const afterSend = await this.readWhatsAppVisibleConversation(action.contact, Math.max(12, beforeSend.messages.length + 4)).catch(() => null);
@@ -1565,17 +2611,22 @@ export class NativeMacOSJobExecutor {
                         messages: afterSend?.messages || [],
                         summary: afterSend?.summary || "",
                     };
+                    appendActionArtifact("message_delivery", {
+                        summary: `Enviei no WhatsApp para ${action.contact}: ${clipText(action.text, 180)}`,
+                        contact: action.contact,
+                    });
                     const verification = await this.verifyWhatsAppLastMessageAgainstBaseline(action.text, beforeSend.messages);
                     if (!verification.ok) {
                         resultPayload.summary = verification.reason || `Nao consegui confirmar o envio da mensagem para ${action.contact} no WhatsApp.`;
-                        await reporter.failed(verification.reason || `Nao consegui confirmar o envio da mensagem para ${action.contact} no WhatsApp.`, resultPayload);
+                        attachWorkspaceMemory("failed");
+                        await stepReporter.failed(verification.reason || `Nao consegui confirmar o envio da mensagem para ${action.contact} no WhatsApp.`, resultPayload);
                         return;
                     }
                     completionNotes.push(`Enviei no WhatsApp para ${action.contact}: ${clipText(action.text, 180)}`);
                     continue;
                 }
                 if (action.type === "whatsapp_read_chat") {
-                    await reporter.progress(progressPercent, `Abrindo a conversa do WhatsApp com ${action.contact}`);
+                    await reportActionProgress(`Abrindo a conversa do WhatsApp com ${action.contact}`);
                     await this.ensureWhatsAppWebReady();
                     const selected = await this.selectWhatsAppConversation(action.contact);
                     if (!selected) {
@@ -1588,17 +2639,21 @@ export class NativeMacOSJobExecutor {
                         contact: action.contact,
                         messages: chat.messages,
                     };
+                    appendActionArtifact("message_snapshot", {
+                        summary: `Mensagens visiveis no WhatsApp com ${action.contact}.`,
+                        contact: action.contact,
+                    });
                     completionNotes.push(`Mensagens visiveis no WhatsApp com ${action.contact}:\n${chat.summary}`);
                     continue;
                 }
                 if (action.type === "click_visual_target") {
                     const browserApp = await this.resolveLikelyBrowserApp(action.app);
                     if (browserApp) {
-                        await reporter.progress(progressPercent, `Trazendo ${browserApp} para frente antes do clique`);
+                        await reportActionProgress(`Trazendo ${browserApp} para frente antes do clique`);
                         await this.focusApp(browserApp);
                     }
                     else if (action.app) {
-                        await reporter.progress(progressPercent, `Trazendo ${action.app} para frente antes do clique`);
+                        await reportActionProgress(`Trazendo ${action.app} para frente antes do clique`);
                         await this.focusApp(action.app);
                     }
                     const targetDescriptions = isSpotifySafariDomOnlyStep(action.description)
@@ -1614,7 +2669,7 @@ export class NativeMacOSJobExecutor {
                         const isSpotifySafariStep = browserApp === "Safari" && isSpotifySafariDomOnlyStep(targetDescription);
                         const verificationPrompt = isSpotifySafariStep ? undefined : action.verification_prompt;
                         if (isSpotifySafariStep) {
-                            await reporter.progress(progressPercent, `Tentando concluir ${targetDescription} pelo DOM do Spotify no Safari`);
+                            await reportActionProgress(`Tentando concluir ${targetDescription} pelo DOM do Spotify no Safari`);
                             const spotifyDomResult = await this.executeSpotifySafariDomStep(targetDescription, initialBrowserState);
                             if (spotifyDomResult.ok) {
                                 this.rememberSatisfiedSpotifyStep(targetDescription, !!spotifyDomResult.confirmedPlaying);
@@ -1640,7 +2695,7 @@ export class NativeMacOSJobExecutor {
                         }
                         const nativeMediaTransport = extractNativeMediaTransportCommand(targetDescription);
                         if (nativeMediaTransport) {
-                            await reporter.progress(progressPercent, `Tentando controle de mídia nativo do macOS para ${targetDescription}`);
+                            await reportActionProgress(`Tentando controle de mídia nativo do macOS para ${targetDescription}`);
                             try {
                                 await this.triggerMacOSMediaTransport(nativeMediaTransport);
                                 let validated = false;
@@ -1651,7 +2706,7 @@ export class NativeMacOSJobExecutor {
                                     validationReason = browserValidation.reason;
                                 }
                                 if (!validated && verificationPrompt) {
-                                    const verification = await this.validateVisualClickWithVision(job.job_id, targetDescription, verificationPrompt, progressPercent, reporter, artifacts, "native_media_transport_result");
+                                    const verification = await this.validateVisualClickWithVision(job.job_id, targetDescription, verificationPrompt, progressPercent, stepReporter, artifacts, "native_media_transport_result");
                                     if (verification.unavailable) {
                                         lastFailureReason = verification.reason;
                                         break;
@@ -1672,14 +2727,14 @@ export class NativeMacOSJobExecutor {
                                     break;
                                 }
                                 lastFailureReason = validationReason || `O controle de mídia nativo do macOS nao confirmou ${targetDescription}.`;
-                                await reporter.progress(progressPercent, "O controle de mídia nativo nao foi suficiente; vou tentar DOM/OCR");
+                                await reportActionProgress("O controle de mídia nativo nao foi suficiente; vou tentar DOM/OCR");
                             }
                             catch (error) {
                                 lastFailureReason = error instanceof Error ? error.message : String(error);
                             }
                         }
                         if (browserApp === "Safari") {
-                            await reporter.progress(progressPercent, `Tentando localizar ${targetDescription} diretamente no Safari`);
+                            await reportActionProgress(`Tentando localizar ${targetDescription} diretamente no Safari`);
                             const domClick = await this.trySafariDomClick(targetDescription);
                             if (domClick?.clicked) {
                                 let validated = false;
@@ -1690,7 +2745,7 @@ export class NativeMacOSJobExecutor {
                                     validationReason = browserValidation.reason;
                                 }
                                 if (!validated && verificationPrompt) {
-                                    const verification = await this.validateVisualClickWithVision(job.job_id, targetDescription, verificationPrompt, progressPercent, reporter, artifacts, "dom_click_result");
+                                    const verification = await this.validateVisualClickWithVision(job.job_id, targetDescription, verificationPrompt, progressPercent, stepReporter, artifacts, "dom_click_result");
                                     if (verification.unavailable) {
                                         lastFailureReason = verification.reason;
                                         break;
@@ -1724,7 +2779,7 @@ export class NativeMacOSJobExecutor {
                         const visualBeforeState = browserApp
                             ? await this.captureBrowserPageState(browserApp).catch(() => initialBrowserState)
                             : initialBrowserState;
-                        await reporter.progress(progressPercent, `Capturando a tela para localizar ${targetDescription}`);
+                        await reportActionProgress(`Capturando a tela para localizar ${targetDescription}`);
                         let screenshotPath = await this.takeScreenshot();
                         const ocrClick = await this.tryLocalOcrClick(screenshotPath, targetDescription);
                         if (ocrClick.clicked) {
@@ -1736,7 +2791,7 @@ export class NativeMacOSJobExecutor {
                                 validationReason = browserValidation.reason;
                             }
                             if (!validated && verificationPrompt) {
-                                const verification = await this.validateVisualClickWithVision(job.job_id, targetDescription, verificationPrompt, progressPercent, reporter, artifacts, "local_ocr_click_result");
+                                const verification = await this.validateVisualClickWithVision(job.job_id, targetDescription, verificationPrompt, progressPercent, stepReporter, artifacts, "local_ocr_click_result");
                                 if (verification.unavailable) {
                                     lastFailureReason = verification.reason;
                                     break;
@@ -1765,7 +2820,7 @@ export class NativeMacOSJobExecutor {
                                 break;
                             }
                             lastFailureReason = validationReason || `O clique por OCR local em ${targetDescription} nao teve efeito confirmavel.`;
-                            await reporter.progress(progressPercent, "OCR local nao confirmou o clique; vou tentar visão remota");
+                            await reportActionProgress("OCR local nao confirmou o clique; vou tentar visão remota");
                             screenshotPath = await this.takeScreenshot();
                         }
                         else if (ocrClick.reason) {
@@ -1806,7 +2861,7 @@ export class NativeMacOSJobExecutor {
                             }
                             continue;
                         }
-                        await reporter.progress(progressPercent, `Clicando em ${targetDescription}`);
+                        await reportActionProgress(`Clicando em ${targetDescription}`);
                         const scaledX = width > 0 && originalWidth > 0 ? (location.x / width) * originalWidth : location.x;
                         const scaledY = height > 0 && originalHeight > 0 ? (location.y / height) * originalHeight : location.y;
                         await this.clickPoint(scaledX, scaledY);
@@ -1817,7 +2872,7 @@ export class NativeMacOSJobExecutor {
                             strategy: "visual_locator",
                         };
                         if (verificationPrompt) {
-                            const verification = await this.validateVisualClickWithVision(job.job_id, targetDescription, verificationPrompt, progressPercent, reporter, artifacts, "visual_click_result");
+                            const verification = await this.validateVisualClickWithVision(job.job_id, targetDescription, verificationPrompt, progressPercent, stepReporter, artifacts, "visual_click_result");
                             if (verification.unavailable) {
                                 lastFailureReason = verification.reason;
                                 break;
@@ -1843,19 +2898,22 @@ export class NativeMacOSJobExecutor {
                     if (!clickSucceeded) {
                         throw new Error(lastFailureReason || `Nao consegui concluir o clique visual para ${action.description}.`);
                     }
+                    appendActionArtifact("interaction_result", {
+                        summary: `Localizei e cliquei em ${action.description}.`,
+                    });
                     continue;
                 }
                 if (action.type === "drag_visual_target") {
                     const dragApp = await this.resolveLikelyBrowserApp(action.app);
                     if (dragApp) {
-                        await reporter.progress(progressPercent, `Trazendo ${dragApp} para frente antes do arraste`);
+                        await reportActionProgress(`Trazendo ${dragApp} para frente antes do arraste`);
                         await this.focusApp(dragApp);
                     }
                     else if (action.app) {
-                        await reporter.progress(progressPercent, `Trazendo ${action.app} para frente antes do arraste`);
+                        await reportActionProgress(`Trazendo ${action.app} para frente antes do arraste`);
                         await this.focusApp(action.app);
                     }
-                    await reporter.progress(progressPercent, `Capturando a tela para localizar ${action.source_description} e ${action.target_description}`);
+                    await reportActionProgress(`Capturando a tela para localizar ${action.source_description} e ${action.target_description}`);
                     const screenshotPath = await this.takeScreenshot();
                     const sourcePoint = await this.resolveVisualTargetPoint(job.job_id, screenshotPath, action.source_description, artifacts, "drag_source");
                     const targetPoint = await this.resolveVisualTargetPoint(job.job_id, screenshotPath, action.target_description, artifacts, "drag_target");
@@ -1865,18 +2923,29 @@ export class NativeMacOSJobExecutor {
                     if (!targetPoint) {
                         throw new Error(`Nao consegui localizar ${action.target_description} com confianca suficiente para concluir o arraste.`);
                     }
-                    await reporter.progress(progressPercent, `Arrastando ${action.source_description} para ${action.target_description}`);
+                    await reportActionProgress(`Arrastando ${action.source_description} para ${action.target_description}`);
                     await this.dragPoint(sourcePoint.x, sourcePoint.y, targetPoint.x, targetPoint.y);
                     resultPayload.last_drag = {
                         source: sourcePoint,
                         target: targetPoint,
                     };
+                    appendActionArtifact("interaction_result", {
+                        summary: `Arrastei ${action.source_description} para ${action.target_description}.`,
+                    });
                     completionNotes.push(`Arrastei ${action.source_description} para ${action.target_description}.`);
                     continue;
                 }
-                await reporter.progress(progressPercent, `Abrindo ${action.url}${action.app ? ` em ${action.app}` : ""}`);
+                await reportActionProgress(`Abrindo ${action.url}${action.app ? ` em ${action.app}` : ""}`);
                 await this.openUrl(action.url, action.app);
                 await delay(1200);
+                resultPayload.last_navigation = {
+                    url: action.url,
+                    app: action.app || null,
+                };
+                appendActionArtifact("navigation_result", {
+                    summary: `${humanizeUrl(action.url)} foi aberto${action.app ? ` em ${action.app}` : ""}.`,
+                    path: action.url,
+                });
                 completionNotes.push(`${humanizeUrl(action.url)} foi aberto${action.app ? ` em ${action.app}` : ""}.`);
             }
             const summary = completionNotes.length > 0
@@ -1884,8 +2953,47 @@ export class NativeMacOSJobExecutor {
                 : (actions.length === 1
                     ? this.describeAction(actions[0])
                     : `${actions.length} ações executadas no macOS`);
+            attachWorkspaceMemory("completed");
+            if (hookTrace.length > 0) {
+                artifacts.push({
+                    id: `runtime_hook_trace.${job.job_id}`,
+                    kind: "runtime_hook_trace",
+                    summary: `Hook trace do runtime com ${hookTrace.length} eventos.`,
+                    metadata: {
+                        event_count: hookTrace.length,
+                        graph_id: runtimeManifest.graphId || undefined,
+                    },
+                });
+            }
             resultPayload.summary = summary;
-            await reporter.completed(resultPayload);
+            await reporter.completed(resultPayload, {
+                stepId: runtimeManifest.finalizeStepId,
+            });
+        }
+        catch (error) {
+            if (error instanceof JobCancelledError) {
+                throw error;
+            }
+            const detail = error instanceof Error ? error.message : String(error);
+            attachWorkspaceMemory("failed");
+            if (hookTrace.length > 0 && !artifacts.some((artifact) => artifact.id === `runtime_hook_trace.${job.job_id}`)) {
+                artifacts.push({
+                    id: `runtime_hook_trace.${job.job_id}`,
+                    kind: "runtime_hook_trace",
+                    summary: `Hook trace do runtime com ${hookTrace.length} eventos.`,
+                    metadata: {
+                        event_count: hookTrace.length,
+                        graph_id: runtimeManifest.graphId || undefined,
+                    },
+                });
+            }
+            await reporter.failed(detail || "Otto Bridge native-macos failed", {
+                ...resultPayload,
+                summary: String(resultPayload.summary || detail || "").trim() || undefined,
+            }, {
+                stepId: currentActionStepId || runtimeManifest.executionStepId,
+            });
+            return;
         }
         finally {
             this.cancelledJobs.delete(job.job_id);
@@ -2376,7 +3484,10 @@ return appNames as text
         status.summary = this.buildAppStatusSummary(status);
         return status;
     }
-    async resolveFilesystemInspectPath(targetPath) {
+    async resolveFilesystemInspectPath(targetPath, workspaceContext) {
+        if (workspaceContext) {
+            return assertPathInsideWorkspace(workspaceContext, targetPath);
+        }
         const expanded = expandUserPath(targetPath);
         try {
             await stat(expanded);
@@ -2403,8 +3514,8 @@ return appNames as text
             return 0;
         }
     }
-    async inspectFilesystemPath(targetPath, includeChildren = true, includePreview = false, limit = 8) {
-        const resolved = await this.resolveFilesystemInspectPath(targetPath);
+    async inspectFilesystemPath(targetPath, includeChildren = true, includePreview = false, limit = 8, workspaceContext) {
+        const resolved = await this.resolveFilesystemInspectPath(targetPath, workspaceContext);
         const entryStat = await stat(resolved);
         const itemName = path.basename(resolved) || resolved;
         if (entryStat.isDirectory()) {
@@ -5140,8 +6251,8 @@ if let output = String(data: data, encoding: .utf8) {
         }
         return clipTextPreview(loaded.content || "(arquivo vazio)", maxChars);
     }
-    async readLocalFileSnapshot(filePath, chunkSizeChars = 4000) {
-        const resolved = await this.resolveReadableFilePath(filePath);
+    async readLocalFileSnapshot(filePath, chunkSizeChars = 4000, workspaceContext) {
+        const resolved = await this.resolveReadableFilePath(filePath, workspaceContext);
         const entryStat = await stat(resolved);
         const loaded = await this.loadReadableFileContent(resolved);
         const fileName = path.basename(resolved) || resolved;
@@ -5179,7 +6290,10 @@ if let output = String(data: data, encoding: .utf8) {
             summary: `Li ${filePath} por completo (${content.length} caracteres em ${chunks.length} bloco${chunks.length === 1 ? "" : "s"}).`,
         };
     }
-    async resolveTrashTargetPath(targetPath) {
+    async resolveTrashTargetPath(targetPath, workspaceContext) {
+        if (workspaceContext) {
+            return assertPathInsideWorkspace(workspaceContext, targetPath);
+        }
         const resolved = expandUserPath(targetPath);
         try {
             await stat(resolved);
@@ -5268,8 +6382,8 @@ if let output = String(data: data, encoding: .utf8) {
             }
         }
     }
-    async movePathToTrashSnapshot(targetPath) {
-        const resolved = await this.resolveTrashTargetPath(targetPath);
+    async movePathToTrashSnapshot(targetPath, workspaceContext) {
+        const resolved = await this.resolveTrashTargetPath(targetPath, workspaceContext);
         const entryStat = await stat(resolved);
         const trashDir = path.join(os.homedir(), ".Trash");
         await mkdir(trashDir, { recursive: true });
@@ -5293,39 +6407,55 @@ if let output = String(data: data, encoding: .utf8) {
             summary: `${kind === "directory" ? "Mandei a pasta" : kind === "file" ? "Mandei o arquivo" : "Mandei o item"} ${name} para a Lixeira.`,
         };
     }
-    async resolveWritableTextFilePath(targetPath, filename) {
-        const expanded = expandUserPath(targetPath);
+    async resolveWritableTextFilePath(targetPath, filename, workspaceContext) {
+        const expanded = workspaceContext
+            ? expandUserPathLike(targetPath, workspaceContext.defaultCwd)
+            : expandUserPath(targetPath);
         const requestedFilename = filename ? sanitizeFileName(filename) : null;
         if (requestedFilename) {
             try {
                 const existingStat = await stat(expanded);
                 if (existingStat.isDirectory()) {
-                    return path.join(expanded, requestedFilename);
+                    const resolvedDirectoryPath = path.join(expanded, requestedFilename);
+                    return workspaceContext
+                        ? assertPathInsideWorkspace(workspaceContext, resolvedDirectoryPath)
+                        : resolvedDirectoryPath;
                 }
             }
             catch {
                 // Continue below and treat the target as a direct file path.
             }
             if (String(targetPath || "").trimEnd().endsWith(path.sep)) {
-                return path.join(expanded, requestedFilename);
+                const resolvedDirectoryPath = path.join(expanded, requestedFilename);
+                return workspaceContext
+                    ? assertPathInsideWorkspace(workspaceContext, resolvedDirectoryPath)
+                    : resolvedDirectoryPath;
             }
         }
         try {
             const existingStat = await stat(expanded);
             if (existingStat.isDirectory()) {
-                return path.join(expanded, sanitizeFileName("otto-note.txt"));
+                const fallbackDirectoryPath = path.join(expanded, sanitizeFileName("otto-note.txt"));
+                return workspaceContext
+                    ? assertPathInsideWorkspace(workspaceContext, fallbackDirectoryPath)
+                    : fallbackDirectoryPath;
             }
         }
         catch {
             // Continue below and treat the target as a direct file path.
         }
         if (String(targetPath || "").trimEnd().endsWith(path.sep)) {
-            return path.join(expanded, sanitizeFileName("otto-note.txt"));
+            const fallbackDirectoryPath = path.join(expanded, sanitizeFileName("otto-note.txt"));
+            return workspaceContext
+                ? assertPathInsideWorkspace(workspaceContext, fallbackDirectoryPath)
+                : fallbackDirectoryPath;
         }
-        return expanded;
+        return workspaceContext
+            ? assertPathInsideWorkspace(workspaceContext, expanded)
+            : expanded;
     }
-    async writeTextFileSnapshot(targetPath, text, filename, append = false, source) {
-        const resolved = await this.resolveWritableTextFilePath(targetPath, filename);
+    async writeTextFileSnapshot(targetPath, text, filename, append = false, source, workspaceContext) {
+        const resolved = await this.resolveWritableTextFilePath(targetPath, filename, workspaceContext);
         const parentDir = path.dirname(resolved);
         await mkdir(parentDir, { recursive: true });
         await writeFile(resolved, text, {
@@ -5350,6 +6480,281 @@ if let output = String(data: data, encoding: .utf8) {
             summary: `${append ? "Atualizei" : "Escrevi"} ${String(text || "").length} caractere${String(text || "").length === 1 ? "" : "s"} em ${resolved}.`,
         };
     }
+    async writeJsonFileSnapshot(targetPath, data, filename, pretty = true, workspaceContext) {
+        const serialized = JSON.stringify(data, null, pretty ? 2 : 0);
+        if (typeof serialized !== "string") {
+            throw new Error("Nao consegui serializar o JSON pedido para gravar no arquivo local.");
+        }
+        const resolved = await this.resolveWritableTextFilePath(targetPath, filename, workspaceContext);
+        const parentDir = path.dirname(resolved);
+        await mkdir(parentDir, { recursive: true });
+        await writeFile(resolved, serialized, { encoding: "utf8", flag: "w" });
+        const entryStat = await stat(resolved);
+        const name = path.basename(resolved) || resolved;
+        return {
+            captured_at: new Date().toISOString(),
+            path: targetPath,
+            resolved_path: resolved,
+            name,
+            mime_type: "application/json; charset=utf-8",
+            size_bytes: entryStat.size,
+            modified_at: entryStat.mtime.toISOString(),
+            content_char_count: serialized.length,
+            content_preview: clipTextPreview(serialized || "{}", 240),
+            pretty,
+            summary: `Gravei ${serialized.length} caractere${serialized.length === 1 ? "" : "s"} de JSON em ${resolved}.`,
+        };
+    }
+    resolvePatchTargetPath(targetPath, resolvedCwd, workspaceContext) {
+        return workspaceContext
+            ? assertPathInsideWorkspace(workspaceContext, targetPath, { baseCwd: resolvedCwd })
+            : expandUserPathLike(targetPath, resolvedCwd);
+    }
+    countTextLines(value) {
+        const normalized = String(value || "").replace(/\r\n/g, "\n");
+        if (!normalized) {
+            return 0;
+        }
+        const trimmed = normalized.endsWith("\n") ? normalized.slice(0, -1) : normalized;
+        return trimmed ? trimmed.split("\n").length : 0;
+    }
+    async applyPatchOperationSnapshot(operation, resolvedCwd, workspaceContext) {
+        if (operation.type === "add") {
+            const resolvedPath = this.resolvePatchTargetPath(operation.path, resolvedCwd, workspaceContext);
+            try {
+                await stat(resolvedPath);
+                throw new Error(`O apply_patch nao pode adicionar ${resolvedPath} porque o arquivo ja existe.`);
+            }
+            catch (error) {
+                if (error?.code !== "ENOENT") {
+                    throw error;
+                }
+            }
+            await mkdir(path.dirname(resolvedPath), { recursive: true });
+            const fileContent = operation.content_lines.length > 0 ? `${operation.content_lines.join("\n")}\n` : "";
+            await writeFile(resolvedPath, fileContent, "utf8");
+            return {
+                path: operation.path,
+                resolved_path: resolvedPath,
+                status: "added",
+                added_line_count: operation.content_lines.length,
+                deleted_line_count: 0,
+            };
+        }
+        if (operation.type === "delete") {
+            const resolvedPath = this.resolvePatchTargetPath(operation.path, resolvedCwd, workspaceContext);
+            const entryStat = await stat(resolvedPath);
+            if (entryStat.isDirectory()) {
+                throw new Error(`O apply_patch nao suporta remover pastas: ${resolvedPath}.`);
+            }
+            let deletedLineCount = 0;
+            try {
+                deletedLineCount = this.countTextLines(await readFile(resolvedPath, "utf8"));
+            }
+            catch {
+                deletedLineCount = 0;
+            }
+            await unlink(resolvedPath);
+            return {
+                path: operation.path,
+                resolved_path: resolvedPath,
+                status: "deleted",
+                added_line_count: 0,
+                deleted_line_count: deletedLineCount,
+            };
+        }
+        const resolvedSourcePath = this.resolvePatchTargetPath(operation.path, resolvedCwd, workspaceContext);
+        const originalText = await readFile(resolvedSourcePath, "utf8");
+        const applied = applyStructuredUpdateToText(originalText, operation);
+        const resolvedDestinationPath = operation.move_to
+            ? this.resolvePatchTargetPath(operation.move_to, resolvedCwd, workspaceContext)
+            : resolvedSourcePath;
+        if (operation.move_to && resolvedDestinationPath !== resolvedSourcePath) {
+            try {
+                await stat(resolvedDestinationPath);
+                throw new Error(`O apply_patch nao pode mover para ${resolvedDestinationPath} porque o destino ja existe.`);
+            }
+            catch (error) {
+                if (error?.code !== "ENOENT") {
+                    throw error;
+                }
+            }
+            await mkdir(path.dirname(resolvedDestinationPath), { recursive: true });
+            await writeFile(resolvedDestinationPath, applied.text, "utf8");
+            await unlink(resolvedSourcePath);
+            return {
+                path: operation.move_to || operation.path,
+                resolved_path: resolvedDestinationPath,
+                status: "moved",
+                previous_path: operation.path,
+                resolved_previous_path: resolvedSourcePath,
+                added_line_count: applied.addedLineCount,
+                deleted_line_count: applied.deletedLineCount,
+            };
+        }
+        await writeFile(resolvedSourcePath, applied.text, "utf8");
+        return {
+            path: operation.path,
+            resolved_path: resolvedSourcePath,
+            status: "updated",
+            added_line_count: applied.addedLineCount,
+            deleted_line_count: applied.deletedLineCount,
+        };
+    }
+    async applyPatchSnapshot(patchText, cwd, workspaceContext) {
+        const resolvedCwd = this.resolveWorkspaceExecutionCwd(cwd, workspaceContext);
+        const parsed = parseStructuredPatch(patchText);
+        if (parsed.operations.length === 0) {
+            throw new Error("O apply_patch nao recebeu nenhuma operacao valida.");
+        }
+        const files = [];
+        for (const operation of parsed.operations) {
+            files.push(await this.applyPatchOperationSnapshot(operation, resolvedCwd, workspaceContext));
+        }
+        const addedCount = files.filter((item) => item.status === "added").length;
+        const updatedCount = files.filter((item) => item.status === "updated").length;
+        const deletedCount = files.filter((item) => item.status === "deleted").length;
+        const movedCount = files.filter((item) => item.status === "moved").length;
+        const changedFiles = uniqueStrings(files.map((item) => item.path));
+        const changedFileCount = files.length;
+        const summary = changedFileCount === 0
+            ? `O patch em ${resolvedCwd} nao gerou mudancas persistidas.`
+            : `Apliquei um patch em ${resolvedCwd} com ${changedFileCount} arquivo${changedFileCount === 1 ? "" : "s"} alterado${changedFileCount === 1 ? "" : "s"} (${addedCount} adicionados, ${updatedCount} atualizados, ${deletedCount} removidos, ${movedCount} movidos).`;
+        return {
+            captured_at: new Date().toISOString(),
+            cwd,
+            resolved_cwd: resolvedCwd,
+            patch_char_count: parsed.patch_char_count,
+            operation_count: parsed.operations.length,
+            changed_file_count: changedFileCount,
+            added_count: addedCount,
+            updated_count: updatedCount,
+            deleted_count: deletedCount,
+            moved_count: movedCount,
+            changed_files: changedFiles,
+            files,
+            summary,
+        };
+    }
+    async createDirectorySnapshot(targetPath, createParents = true, workspaceContext) {
+        const resolved = workspaceContext
+            ? assertPathInsideWorkspace(workspaceContext, targetPath)
+            : expandUserPath(targetPath);
+        let existedBefore = false;
+        try {
+            const existingStat = await stat(resolved);
+            if (!existingStat.isDirectory()) {
+                throw new Error(`Ja existe um item em ${resolved}, mas ele nao e uma pasta.`);
+            }
+            existedBefore = true;
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT") {
+                throw error;
+            }
+        }
+        await mkdir(resolved, { recursive: createParents });
+        const directoryStat = await stat(resolved);
+        return {
+            captured_at: new Date().toISOString(),
+            path: targetPath,
+            resolved_path: resolved,
+            name: path.basename(resolved) || resolved,
+            created: !existedBefore,
+            existed_before: existedBefore,
+            modified_at: directoryStat.mtime.toISOString(),
+            summary: existedBefore
+                ? `A pasta ${resolved} ja existia e ficou pronta para uso.`
+                : `Criei a pasta ${resolved} no macOS.`,
+        };
+    }
+    async resolveMoveDestinationPath(sourceResolvedPath, destinationPath, workspaceContext) {
+        const expanded = workspaceContext
+            ? assertPathInsideWorkspace(workspaceContext, destinationPath)
+            : expandUserPath(destinationPath);
+        try {
+            const destinationStat = await stat(expanded);
+            if (destinationStat.isDirectory()) {
+                const nestedDestination = path.join(expanded, path.basename(sourceResolvedPath));
+                return workspaceContext
+                    ? assertPathInsideWorkspace(workspaceContext, nestedDestination)
+                    : nestedDestination;
+            }
+        }
+        catch {
+            // Continue below.
+        }
+        if (String(destinationPath || "").trimEnd().endsWith(path.sep)) {
+            const nestedDestination = path.join(expanded, path.basename(sourceResolvedPath));
+            return workspaceContext
+                ? assertPathInsideWorkspace(workspaceContext, nestedDestination)
+                : nestedDestination;
+        }
+        return expanded;
+    }
+    async moveLocalPathSnapshot(sourcePath, destinationPath, overwrite = false, workspaceContext) {
+        const resolvedSourcePath = workspaceContext
+            ? assertPathInsideWorkspace(workspaceContext, sourcePath)
+            : expandUserPath(sourcePath);
+        const sourceStat = await stat(resolvedSourcePath);
+        const resolvedDestinationPath = await this.resolveMoveDestinationPath(resolvedSourcePath, destinationPath, workspaceContext);
+        await mkdir(path.dirname(resolvedDestinationPath), { recursive: true });
+        let overwritten = false;
+        try {
+            const destinationStat = await stat(resolvedDestinationPath);
+            if (!overwrite) {
+                throw new Error(`Ja existe um item em ${resolvedDestinationPath}. Defina overwrite=true se quiser substituir esse arquivo.`);
+            }
+            if (destinationStat.isDirectory()) {
+                throw new Error(`Ja existe uma pasta em ${resolvedDestinationPath}.`);
+            }
+            await unlink(resolvedDestinationPath);
+            overwritten = true;
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT") {
+                throw error;
+            }
+        }
+        await rename(resolvedSourcePath, resolvedDestinationPath);
+        const itemKind = sourceStat.isDirectory()
+            ? "directory"
+            : sourceStat.isFile()
+                ? "file"
+                : "other";
+        return {
+            captured_at: new Date().toISOString(),
+            source_path: sourcePath,
+            resolved_source_path: resolvedSourcePath,
+            destination_path: destinationPath,
+            resolved_destination_path: resolvedDestinationPath,
+            name: path.basename(resolvedDestinationPath) || resolvedDestinationPath,
+            item_kind: itemKind,
+            overwritten,
+            summary: `Movi ${itemKind === "directory" ? "a pasta" : "o item"} ${path.basename(resolvedSourcePath)} para ${resolvedDestinationPath}.`,
+        };
+    }
+    async deleteLocalFileSnapshot(targetPath, workspaceContext) {
+        const resolvedPath = workspaceContext
+            ? assertPathInsideWorkspace(workspaceContext, targetPath)
+            : expandUserPath(targetPath);
+        const entryStat = await stat(resolvedPath);
+        if (entryStat.isDirectory()) {
+            throw new Error("delete_file so suporta arquivos por enquanto. Use trash_path para pastas.");
+        }
+        const itemKind = entryStat.isFile() ? "file" : "other";
+        await unlink(resolvedPath);
+        return {
+            captured_at: new Date().toISOString(),
+            path: targetPath,
+            resolved_path: resolvedPath,
+            name: path.basename(resolvedPath) || resolvedPath,
+            item_kind: itemKind,
+            size_bytes: entryStat.size,
+            modified_at: entryStat.mtime.toISOString(),
+            summary: `Apaguei o arquivo ${resolvedPath} no macOS.`,
+        };
+    }
     resolveWriteTextFileContent(action) {
         const explicitText = [action.text, action.content, action.body]
             .map((value) => String(value || "").trim())
@@ -5366,7 +6771,10 @@ if let output = String(data: data, encoding: .utf8) {
         }
         return null;
     }
-    async resolveReadableFilePath(filePath) {
+    async resolveReadableFilePath(filePath, workspaceContext) {
+        if (workspaceContext) {
+            return assertPathInsideWorkspace(workspaceContext, filePath);
+        }
         const resolved = expandUserPath(filePath);
         try {
             await stat(resolved);
@@ -5435,8 +6843,10 @@ if let output = String(data: data, encoding: .utf8) {
         }
         return null;
     }
-    async listLocalFilesSnapshot(directoryPath, limit) {
-        const resolved = expandUserPath(directoryPath);
+    async listLocalFilesSnapshot(directoryPath, limit, workspaceContext) {
+        const resolved = workspaceContext
+            ? assertPathInsideWorkspace(workspaceContext, directoryPath)
+            : expandUserPath(directoryPath);
         const allEntries = await readdir(resolved, { withFileTypes: true });
         const sortedEntries = allEntries.sort((left, right) => {
             if (left.isDirectory() !== right.isDirectory()) {
@@ -5485,8 +6895,10 @@ if let output = String(data: data, encoding: .utf8) {
             summary,
         };
     }
-    async countLocalFiles(directoryPath, extensions, recursive = true) {
-        const resolved = expandUserPath(directoryPath);
+    async countLocalFiles(directoryPath, extensions, recursive = true, workspaceContext) {
+        const resolved = workspaceContext
+            ? assertPathInsideWorkspace(workspaceContext, directoryPath)
+            : expandUserPath(directoryPath);
         const normalizedExtensions = Array.from(new Set((extensions || [])
             .map((extension) => String(extension || "").trim().toLowerCase().replace(/^\./, ""))
             .filter(Boolean)));
@@ -5761,11 +7173,1174 @@ if let output = String(data: data, encoding: .utf8) {
         status.summary = this.buildSystemStatusSummary(status);
         return status;
     }
-    async runShellCommand(command, cwd) {
+    resolveWorkspaceExecutionCwd(cwd, workspaceContext) {
+        return workspaceContext
+            ? assertCwdInsideWorkspace(workspaceContext, cwd)
+            : (cwd ? expandUserPath(cwd) : process.cwd());
+    }
+    summarizeGitCommandError(result, fallback) {
+        const combined = [result.stdout.trim(), result.stderr.trim()].filter(Boolean).join("\n").trim();
+        return clipText(combined || fallback, 4_000);
+    }
+    async probeGitRepository(cwd, workspaceContext) {
+        const resolvedCwd = this.resolveWorkspaceExecutionCwd(cwd, workspaceContext);
+        const capturedAt = new Date().toISOString();
+        const repoProbe = await this.runCommandCapture("/usr/bin/git", ["rev-parse", "--show-toplevel"], {
+            cwd: resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        if (repoProbe.exitCode !== 0) {
+            return {
+                capturedAt,
+                resolvedCwd,
+                isRepo: false,
+            };
+        }
+        const repoRoot = repoProbe.stdout.trim() || resolvedCwd;
+        const branchProbe = await this.runCommandCapture("/usr/bin/git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+            cwd: resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const trackingProbe = await this.runCommandCapture("/usr/bin/git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], {
+            cwd: resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        return {
+            capturedAt,
+            resolvedCwd,
+            isRepo: true,
+            repoRoot,
+            currentBranch: branchProbe.exitCode === 0 ? (branchProbe.stdout.trim() || undefined) : undefined,
+            trackingRef: trackingProbe.exitCode === 0 ? (trackingProbe.stdout.trim() || undefined) : undefined,
+        };
+    }
+    async pathExists(candidatePath) {
+        try {
+            await stat(candidatePath);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    parseGitFetchUpdatedRefs(output) {
+        const updatedRefs = [];
+        for (const rawLine of output.split(/\r?\n/)) {
+            const line = rawLine.trim();
+            if (!line || !line.includes("->")) {
+                continue;
+            }
+            const refMatch = line.match(/->\s+(.+)$/);
+            if (refMatch?.[1]) {
+                updatedRefs.push(refMatch[1].trim());
+            }
+        }
+        return uniqueStrings(updatedRefs);
+    }
+    async resolveWorkspacePackageManager(resolvedCwd, workspaceContext) {
+        const manifestPackageManagers = uniqueStrings(workspaceContext?.repoManifest?.package_managers || []);
+        for (const packageManager of PACKAGE_MANAGER_PRIORITY) {
+            if (manifestPackageManagers.includes(packageManager)) {
+                return packageManager;
+            }
+        }
+        if (await this.pathExists(path.join(resolvedCwd, "pnpm-lock.yaml"))) {
+            return "pnpm";
+        }
+        if (await this.pathExists(path.join(resolvedCwd, "yarn.lock"))) {
+            return "yarn";
+        }
+        if (await this.pathExists(path.join(resolvedCwd, "bun.lockb"))) {
+            return "bun";
+        }
+        if (await this.pathExists(path.join(resolvedCwd, "package-lock.json")) || await this.pathExists(path.join(resolvedCwd, "package.json"))) {
+            return "npm";
+        }
+        return undefined;
+    }
+    detectWorkspaceValidationStacks(resolvedCwd, workspaceContext) {
+        const detected = new Set();
+        const manifestFiles = uniqueStrings(workspaceContext?.repoManifest?.manifest_files || []);
+        const packageManagers = uniqueStrings(workspaceContext?.repoManifest?.package_managers || []);
+        if (packageManagers.length > 0 || manifestFiles.includes("package.json")) {
+            detected.add("node");
+        }
+        if (manifestFiles.includes("pyproject.toml") || manifestFiles.includes("requirements.txt")) {
+            detected.add("python");
+        }
+        if (detected.size === 0) {
+            detected.add("node");
+        }
+        return Array.from(detected);
+    }
+    resolveValidationLadderStages(manifest, resolvedCwd, workspaceContext) {
+        const ladder = manifest?.validationLadder;
+        if (!ladder || !Array.isArray(ladder.stages) || ladder.stages.length === 0) {
+            return [];
+        }
+        const stacks = this.detectWorkspaceValidationStacks(resolvedCwd, workspaceContext);
+        const selectedStages = ladder.stages
+            .filter((stage) => {
+            if (!stage.profile) {
+                return false;
+            }
+            if (!stage.stack_tags || stage.stack_tags.length === 0) {
+                return true;
+            }
+            return stage.stack_tags.some((tag) => stacks.includes(tag));
+        })
+            .sort((left, right) => (left.order || 0) - (right.order || 0))
+            .map((stage) => ({
+            stage_id: stage.stage_id,
+            title: stage.title,
+            profile: stage.profile,
+        }));
+        const seenProfiles = new Set();
+        return selectedStages.filter((stage) => {
+            if (seenProfiles.has(stage.profile)) {
+                return false;
+            }
+            seenProfiles.add(stage.profile);
+            return true;
+        });
+    }
+    async resolveRunTestsCommand(command, profile, resolvedCwd, workspaceContext) {
+        const explicitCommand = asString(command);
+        if (explicitCommand) {
+            return {
+                command: explicitCommand,
+                resolvedCommand: explicitCommand,
+                profile,
+            };
+        }
+        if (!profile) {
+            throw new Error("Nenhum comando ou profile de validacao foi informado para run_tests.");
+        }
+        if (profile === "auto") {
+            throw new Error("O profile auto precisa ser resolvido pela validation ladder antes de executar run_tests.");
+        }
+        if (profile === "pytest") {
+            const localPytest = path.join(resolvedCwd, ".venv", "bin", "pytest");
+            if (await this.pathExists(localPytest)) {
+                return {
+                    command: "./.venv/bin/pytest -q",
+                    resolvedCommand: "./.venv/bin/pytest -q",
+                    profile,
+                };
+            }
+            if (await this.pathExists(path.join(resolvedCwd, "pyproject.toml"))
+                || await this.pathExists(path.join(resolvedCwd, "pytest.ini"))
+                || await this.pathExists(path.join(resolvedCwd, "requirements.txt"))) {
+                return {
+                    command: "python -m pytest -q",
+                    resolvedCommand: "python -m pytest -q",
+                    profile,
+                };
+            }
+            return {
+                command: "pytest -q",
+                resolvedCommand: "pytest -q",
+                profile,
+            };
+        }
+        if (profile === "node_test") {
+            const packageManager = await this.resolveWorkspacePackageManager(resolvedCwd, workspaceContext);
+            if (!packageManager) {
+                throw new Error(`Nao encontrei um package manager suportado para resolver o profile ${profile} em ${resolvedCwd}.`);
+            }
+            const resolvedCommand = packageManager === "yarn"
+                ? "yarn test"
+                : packageManager === "bun"
+                    ? "bun test"
+                    : `${packageManager} test`;
+            return {
+                command: resolvedCommand,
+                resolvedCommand,
+                profile,
+            };
+        }
+        if (profile === "npm_test") {
+            return { command: "npm test", resolvedCommand: "npm test", profile };
+        }
+        if (profile === "pnpm_test") {
+            return { command: "pnpm test", resolvedCommand: "pnpm test", profile };
+        }
+        if (profile === "yarn_test") {
+            return { command: "yarn test", resolvedCommand: "yarn test", profile };
+        }
+        if (profile === "bun_test") {
+            return { command: "bun test", resolvedCommand: "bun test", profile };
+        }
+        if (profile === "typecheck") {
+            const localTsc = path.join(resolvedCwd, "node_modules", ".bin", "tsc");
+            if (await this.pathExists(localTsc) && await this.pathExists(path.join(resolvedCwd, "tsconfig.json"))) {
+                return {
+                    command: "./node_modules/.bin/tsc --noEmit",
+                    resolvedCommand: "./node_modules/.bin/tsc --noEmit",
+                    profile,
+                };
+            }
+            const packageManager = await this.resolveWorkspacePackageManager(resolvedCwd, workspaceContext);
+            if (packageManager) {
+                const resolvedCommand = packageManager === "yarn"
+                    ? "yarn typecheck"
+                    : packageManager === "bun"
+                        ? "bun run typecheck"
+                        : `${packageManager} run typecheck`;
+                return {
+                    command: resolvedCommand,
+                    resolvedCommand,
+                    profile,
+                };
+            }
+            throw new Error(`Nao encontrei um comando de typecheck suportado para ${resolvedCwd}.`);
+        }
+        const packageManager = await this.resolveWorkspacePackageManager(resolvedCwd, workspaceContext);
+        if (!packageManager) {
+            throw new Error(`Nao encontrei um package manager suportado para resolver o profile ${profile} em ${resolvedCwd}.`);
+        }
+        const scriptName = profile === "lint" ? "lint" : "build";
+        const resolvedCommand = packageManager === "yarn"
+            ? `yarn ${scriptName}`
+            : packageManager === "bun"
+                ? `bun run ${scriptName}`
+                : `${packageManager} run ${scriptName}`;
+        return {
+            command: resolvedCommand,
+            resolvedCommand,
+            profile,
+        };
+    }
+    async resolveGitPathspecsForRepo(repoRoot, resolvedCwd, rawPaths, workspaceContext) {
+        const canonicalRepoRoot = await realpath(repoRoot).catch(() => repoRoot);
+        const cleanedPaths = uniqueStrings((rawPaths || []).map((item) => asString(item)).filter(Boolean));
+        const pathspecs = [];
+        for (const rawPath of cleanedPaths) {
+            const resolvedPath = workspaceContext
+                ? assertPathInsideWorkspace(workspaceContext, rawPath, { baseCwd: resolvedCwd })
+                : expandUserPathLike(rawPath, resolvedCwd);
+            const canonicalResolvedPath = await realpath(resolvedPath).catch(() => resolvedPath);
+            const relativePath = path.relative(canonicalRepoRoot, canonicalResolvedPath) || ".";
+            if (relativePath.startsWith("..") || path.isAbsolute(relativePath)) {
+                throw new Error(`O caminho ${rawPath} fica fora do repositório Git ativo (${repoRoot}).`);
+            }
+            pathspecs.push(relativePath === "" ? "." : relativePath.split(path.sep).join("/"));
+        }
+        return uniqueStrings(pathspecs);
+    }
+    async gitCloneSnapshot(repository, destinationPath, options, workspaceContext) {
+        const capturedAt = new Date().toISOString();
+        const resolvedDestinationPath = workspaceContext
+            ? assertPathInsideWorkspace(workspaceContext, destinationPath)
+            : expandUserPathLike(destinationPath);
+        const resolvedParentCwd = workspaceContext
+            ? assertCwdInsideWorkspace(workspaceContext, path.dirname(resolvedDestinationPath))
+            : path.dirname(resolvedDestinationPath);
+        const cloneArgs = ["clone"];
+        if (options.depth && options.depth > 0) {
+            cloneArgs.push("--depth", String(options.depth));
+        }
+        const cloneBranch = asString(options.branch) || "";
+        if (cloneBranch) {
+            cloneArgs.push("--branch", cloneBranch);
+        }
+        cloneArgs.push(repository, resolvedDestinationPath);
+        const cloneResult = await this.runCommandCapture("/usr/bin/git", cloneArgs, {
+            cwd: resolvedParentCwd,
+            allowNonZeroExit: true,
+        });
+        if (cloneResult.exitCode !== 0) {
+            return {
+                captured_at: capturedAt,
+                repository,
+                destination_path: destinationPath,
+                resolved_destination_path: resolvedDestinationPath,
+                resolved_parent_cwd: resolvedParentCwd,
+                branch: asString(options.branch) || undefined,
+                depth: options.depth,
+                cloned: false,
+                error_message: this.summarizeGitCommandError(cloneResult, "O Git recusou a operacao de clone."),
+                summary: `O Git recusou o clone para ${path.basename(resolvedDestinationPath) || resolvedDestinationPath}.`,
+            };
+        }
+        const repo = await this.probeGitRepository(resolvedDestinationPath, workspaceContext);
+        const shaProbe = await this.runCommandCapture("/usr/bin/git", ["rev-parse", "HEAD"], {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const commitSha = shaProbe.exitCode === 0 ? (shaProbe.stdout.trim() || undefined) : undefined;
+        return {
+            captured_at: capturedAt,
+            repository,
+            destination_path: destinationPath,
+            resolved_destination_path: resolvedDestinationPath,
+            resolved_parent_cwd: resolvedParentCwd,
+            branch: asString(options.branch) || undefined,
+            depth: options.depth,
+            cloned: true,
+            repo_root: repo.repoRoot || repo.resolvedCwd,
+            current_branch: repo.currentBranch,
+            commit_sha: commitSha,
+            summary: `Clonei o repositorio em ${path.basename(resolvedDestinationPath) || resolvedDestinationPath}.`,
+        };
+    }
+    async gitFetchSnapshot(cwd, options, workspaceContext) {
+        const repo = await this.probeGitRepository(cwd, workspaceContext);
+        if (!repo.isRepo) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: false,
+                remote: options.remote,
+                prune: options.prune === true,
+                tags: options.tags === true,
+                fetched: false,
+                updated_ref_count: 0,
+                updated_refs: [],
+                summary: `${repo.resolvedCwd} nao parece ser um repositorio Git.`,
+            };
+        }
+        const fetchArgs = ["fetch"];
+        if (options.prune === true) {
+            fetchArgs.push("--prune");
+        }
+        if (options.tags === true) {
+            fetchArgs.push("--tags");
+        }
+        const fetchRemote = asString(options.remote) || (repo.trackingRef ? repo.trackingRef.split("/", 1)[0] : "") || "";
+        if (fetchRemote) {
+            fetchArgs.push(fetchRemote, `+refs/heads/*:refs/remotes/${fetchRemote}/*`);
+        }
+        const fetchResult = await this.runCommandCapture("/usr/bin/git", fetchArgs, {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const gitOutput = [fetchResult.stdout.trim(), fetchResult.stderr.trim()].filter(Boolean).join("\n").trim();
+        if (fetchResult.exitCode !== 0) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: true,
+                repo_root: repo.repoRoot,
+                current_branch: repo.currentBranch,
+                remote: asString(options.remote) || undefined,
+                prune: options.prune === true,
+                tags: options.tags === true,
+                fetched: false,
+                tracking_ref: repo.trackingRef,
+                updated_ref_count: 0,
+                updated_refs: [],
+                error_message: clipText(gitOutput || "O Git recusou a operacao de fetch.", 4_000),
+                summary: `O Git recusou o fetch em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`,
+            };
+        }
+        const updatedRefs = this.parseGitFetchUpdatedRefs(gitOutput);
+        const updatedRefCount = updatedRefs.length;
+        return {
+            captured_at: repo.capturedAt,
+            cwd,
+            resolved_cwd: repo.resolvedCwd,
+            is_repo: true,
+            repo_root: repo.repoRoot,
+            current_branch: repo.currentBranch,
+            remote: asString(options.remote) || undefined,
+            prune: options.prune === true,
+            tags: options.tags === true,
+            fetched: true,
+            tracking_ref: repo.trackingRef,
+            updated_ref_count: updatedRefCount,
+            updated_refs: updatedRefs,
+            summary: updatedRefCount > 0
+                ? `Atualizei ${updatedRefCount} ref${updatedRefCount === 1 ? "" : "s"} remota${updatedRefCount === 1 ? "" : "s"} em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`
+                : `Rodei o fetch do repositorio ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`,
+        };
+    }
+    async gitCheckoutSnapshot(cwd, options, workspaceContext) {
+        const repo = await this.probeGitRepository(cwd, workspaceContext);
+        if (!repo.isRepo) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: false,
+                target: options.target,
+                start_point: options.startPoint,
+                create_branch: options.createBranch === true,
+                detach: options.detach === true,
+                switched: false,
+                created_branch: false,
+                detached_head: false,
+                summary: `${repo.resolvedCwd} nao parece ser um repositorio Git.`,
+            };
+        }
+        const checkoutArgs = ["checkout"];
+        if (options.detach === true) {
+            checkoutArgs.push("--detach", options.target);
+        }
+        else if (options.createBranch === true) {
+            checkoutArgs.push("-b", options.target);
+            const startPoint = asString(options.startPoint) || "";
+            if (startPoint) {
+                checkoutArgs.push(startPoint);
+            }
+        }
+        else {
+            checkoutArgs.push(options.target);
+        }
+        const checkoutResult = await this.runCommandCapture("/usr/bin/git", checkoutArgs, {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        if (checkoutResult.exitCode !== 0) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: true,
+                repo_root: repo.repoRoot,
+                current_branch: repo.currentBranch,
+                target: options.target,
+                start_point: options.startPoint,
+                create_branch: options.createBranch === true,
+                detach: options.detach === true,
+                switched: false,
+                created_branch: false,
+                detached_head: false,
+                error_message: this.summarizeGitCommandError(checkoutResult, "O Git recusou a operacao de checkout."),
+                summary: `O Git recusou o checkout em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`,
+            };
+        }
+        const updatedRepo = await this.probeGitRepository(repo.resolvedCwd, workspaceContext);
+        const shaProbe = await this.runCommandCapture("/usr/bin/git", ["rev-parse", "HEAD"], {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const headSha = shaProbe.exitCode === 0 ? (shaProbe.stdout.trim() || undefined) : undefined;
+        const detachedHead = updatedRepo.currentBranch === "HEAD" || options.detach === true;
+        const repoLabel = path.basename(updatedRepo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd;
+        const summary = detachedHead
+            ? `Coloquei ${repoLabel} em detached HEAD em ${options.target}.`
+            : options.createBranch === true
+                ? `Criei e troquei para a branch ${options.target} em ${repoLabel}.`
+                : `Troquei para ${options.target} em ${repoLabel}.`;
+        return {
+            captured_at: repo.capturedAt,
+            cwd,
+            resolved_cwd: repo.resolvedCwd,
+            is_repo: true,
+            repo_root: updatedRepo.repoRoot,
+            current_branch: updatedRepo.currentBranch,
+            target: options.target,
+            start_point: options.startPoint,
+            create_branch: options.createBranch === true,
+            detach: options.detach === true,
+            switched: true,
+            created_branch: options.createBranch === true,
+            detached_head: detachedHead,
+            head_sha: headSha,
+            summary,
+        };
+    }
+    async gitRebaseSnapshot(cwd, options, workspaceContext) {
+        const repo = await this.probeGitRepository(cwd, workspaceContext);
+        if (!repo.isRepo) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: false,
+                target: options.target,
+                autostash: options.autostash === true,
+                rebased: false,
+                summary: `${repo.resolvedCwd} nao parece ser um repositorio Git.`,
+            };
+        }
+        const rebaseArgs = ["rebase"];
+        if (options.autostash === true) {
+            rebaseArgs.push("--autostash");
+        }
+        rebaseArgs.push(options.target);
+        const rebaseResult = await this.runCommandCapture("/usr/bin/git", rebaseArgs, {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        if (rebaseResult.exitCode !== 0) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: true,
+                repo_root: repo.repoRoot,
+                current_branch: repo.currentBranch,
+                target: options.target,
+                autostash: options.autostash === true,
+                rebased: false,
+                error_message: this.summarizeGitCommandError(rebaseResult, "O Git recusou a operacao de rebase."),
+                summary: `O Git recusou o rebase em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`,
+            };
+        }
+        const updatedRepo = await this.probeGitRepository(repo.resolvedCwd, workspaceContext);
+        const shaProbe = await this.runCommandCapture("/usr/bin/git", ["rev-parse", "HEAD"], {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const headSha = shaProbe.exitCode === 0 ? (shaProbe.stdout.trim() || undefined) : undefined;
+        return {
+            captured_at: repo.capturedAt,
+            cwd,
+            resolved_cwd: repo.resolvedCwd,
+            is_repo: true,
+            repo_root: updatedRepo.repoRoot,
+            current_branch: updatedRepo.currentBranch,
+            target: options.target,
+            autostash: options.autostash === true,
+            rebased: true,
+            head_sha: headSha,
+            summary: `Rebaseei a branch atual sobre ${options.target} em ${path.basename(updatedRepo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`,
+        };
+    }
+    async gitMergeSnapshot(cwd, options, workspaceContext) {
+        const repo = await this.probeGitRepository(cwd, workspaceContext);
+        if (!repo.isRepo) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: false,
+                target: options.target,
+                ff_only: options.ffOnly === true,
+                no_ff: options.noFf === true,
+                merged: false,
+                fast_forward: false,
+                summary: `${repo.resolvedCwd} nao parece ser um repositorio Git.`,
+            };
+        }
+        const mergeArgs = ["merge"];
+        if (options.ffOnly === true) {
+            mergeArgs.push("--ff-only");
+        }
+        else if (options.noFf === true) {
+            mergeArgs.push("--no-ff");
+        }
+        const mergeMessage = asString(options.message) || "";
+        if (mergeMessage) {
+            mergeArgs.push("-m", mergeMessage);
+        }
+        mergeArgs.push(options.target);
+        const mergeResult = await this.runCommandCapture("/usr/bin/git", mergeArgs, {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const gitOutput = [mergeResult.stdout.trim(), mergeResult.stderr.trim()].filter(Boolean).join("\n").trim();
+        if (mergeResult.exitCode !== 0) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: true,
+                repo_root: repo.repoRoot,
+                current_branch: repo.currentBranch,
+                target: options.target,
+                ff_only: options.ffOnly === true,
+                no_ff: options.noFf === true,
+                merged: false,
+                fast_forward: false,
+                error_message: clipText(gitOutput || "O Git recusou a operacao de merge.", 4_000),
+                summary: `O Git recusou o merge em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`,
+            };
+        }
+        const shaProbe = await this.runCommandCapture("/usr/bin/git", ["rev-parse", "HEAD"], {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const commitSha = shaProbe.exitCode === 0 ? (shaProbe.stdout.trim() || undefined) : undefined;
+        const updatedRepo = await this.probeGitRepository(repo.resolvedCwd, workspaceContext);
+        const fastForward = /fast-forward/i.test(gitOutput);
+        return {
+            captured_at: repo.capturedAt,
+            cwd,
+            resolved_cwd: repo.resolvedCwd,
+            is_repo: true,
+            repo_root: updatedRepo.repoRoot,
+            current_branch: updatedRepo.currentBranch,
+            target: options.target,
+            ff_only: options.ffOnly === true,
+            no_ff: options.noFf === true,
+            merged: true,
+            fast_forward: fastForward,
+            commit_sha: commitSha,
+            summary: `Mesclei ${options.target} em ${path.basename(updatedRepo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`,
+        };
+    }
+    async gitTagSnapshot(cwd, options, workspaceContext) {
+        const repo = await this.probeGitRepository(cwd, workspaceContext);
+        if (!repo.isRepo) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: false,
+                name: options.name,
+                target: options.target,
+                annotated: options.annotated === true,
+                message: asString(options.message) || undefined,
+                created: false,
+                summary: `${repo.resolvedCwd} nao parece ser um repositorio Git.`,
+            };
+        }
+        const annotated = options.annotated === true || Boolean(asString(options.message));
+        const tagArgs = ["tag"];
+        if (annotated) {
+            tagArgs.push("-a", options.name);
+            const annotation = asString(options.message) || `tag: ${options.name}`;
+            tagArgs.push("-m", annotation);
+        }
+        else {
+            tagArgs.push(options.name);
+        }
+        const tagTarget = asString(options.target) || "";
+        if (tagTarget) {
+            tagArgs.push(tagTarget);
+        }
+        const tagResult = await this.runCommandCapture("/usr/bin/git", tagArgs, {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        if (tagResult.exitCode !== 0) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: true,
+                repo_root: repo.repoRoot,
+                current_branch: repo.currentBranch,
+                name: options.name,
+                target: options.target,
+                annotated,
+                message: asString(options.message) || undefined,
+                created: false,
+                error_message: this.summarizeGitCommandError(tagResult, "O Git recusou a criacao da tag."),
+                summary: `O Git recusou a criacao da tag ${options.name} em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`,
+            };
+        }
+        const tagProbe = await this.runCommandCapture("/usr/bin/git", ["rev-parse", options.name], {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const tagRef = tagProbe.exitCode === 0 ? (tagProbe.stdout.trim() || undefined) : undefined;
+        return {
+            captured_at: repo.capturedAt,
+            cwd,
+            resolved_cwd: repo.resolvedCwd,
+            is_repo: true,
+            repo_root: repo.repoRoot,
+            current_branch: repo.currentBranch,
+            name: options.name,
+            target: options.target,
+            annotated,
+            message: asString(options.message) || undefined,
+            created: true,
+            tag_ref: tagRef,
+            summary: `Criei a tag ${options.name} em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`,
+        };
+    }
+    parseGitStatusBranchLine(branchLine) {
+        const line = branchLine.replace(/^##\s*/, "").trim();
+        if (!line) {
+            return { ahead: 0, behind: 0 };
+        }
+        const relationMatch = line.match(/^([^.\s]+)(?:\.\.\.([^\s]+))?(?:\s+\[(.+)\])?$/);
+        const currentBranch = relationMatch?.[1]?.trim() || (line.startsWith("HEAD") ? "HEAD" : undefined);
+        const upstreamBranch = relationMatch?.[2]?.trim() || undefined;
+        const relation = relationMatch?.[3] || "";
+        const aheadMatch = relation.match(/ahead\s+(\d+)/i);
+        const behindMatch = relation.match(/behind\s+(\d+)/i);
+        return {
+            currentBranch,
+            upstreamBranch,
+            ahead: aheadMatch ? Number(aheadMatch[1]) : 0,
+            behind: behindMatch ? Number(behindMatch[1]) : 0,
+        };
+    }
+    parseGitStatusEntries(lines) {
+        return lines
+            .map((line) => line.trimEnd())
+            .filter(Boolean)
+            .map((line) => {
+            const stagedStatus = line.slice(0, 1) || " ";
+            const unstagedStatus = line.slice(1, 2) || " ";
+            const payload = line.slice(3).trim();
+            if (!payload) {
+                return null;
+            }
+            const renameMatch = payload.match(/^(.*?)\s+->\s+(.*)$/);
+            return {
+                path: (renameMatch?.[2] || payload).trim(),
+                staged_status: stagedStatus,
+                unstaged_status: unstagedStatus,
+                original_path: renameMatch?.[1]?.trim() || undefined,
+            };
+        })
+            .filter((item) => item !== null);
+    }
+    async gitAddSnapshot(cwd, options, workspaceContext) {
+        const repo = await this.probeGitRepository(cwd, workspaceContext);
+        const stagedAll = options.all === true || !(options.paths && options.paths.length > 0);
+        const requestedPaths = uniqueStrings((options.paths || []).map((item) => asString(item)).filter(Boolean));
+        if (!repo.isRepo) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: false,
+                staged_all: stagedAll,
+                path_count: requestedPaths.length,
+                staged_count: 0,
+                staged_paths: [],
+                summary: `${repo.resolvedCwd} nao parece ser um repositorio Git.`,
+            };
+        }
+        const pathspecs = stagedAll
+            ? []
+            : await this.resolveGitPathspecsForRepo(repo.repoRoot || repo.resolvedCwd, repo.resolvedCwd, requestedPaths, workspaceContext);
+        const addArgs = ["add"];
+        if (stagedAll || pathspecs.length === 0) {
+            addArgs.push("--all");
+        }
+        if (pathspecs.length > 0) {
+            addArgs.push("--", ...pathspecs);
+        }
+        const addResult = await this.runCommandCapture("/usr/bin/git", addArgs, {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        if (addResult.exitCode !== 0) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: true,
+                repo_root: repo.repoRoot,
+                current_branch: repo.currentBranch,
+                staged_all: stagedAll,
+                path_count: pathspecs.length,
+                staged_count: 0,
+                staged_paths: [],
+                error_message: this.summarizeGitCommandError(addResult, "O Git recusou a operacao de stage."),
+                summary: `O Git recusou a preparacao do stage em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`,
+            };
+        }
+        const nameOnlyArgs = ["diff", "--cached", "--name-only"];
+        if (pathspecs.length > 0) {
+            nameOnlyArgs.push("--", ...pathspecs);
+        }
+        const stagedResult = await this.runCommandCapture("/usr/bin/git", nameOnlyArgs, {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const stagedPaths = uniqueStrings(stagedResult.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
+        const stagedCount = stagedPaths.length;
+        const summary = stagedCount === 0
+            ? stagedAll
+                ? `Nao havia mudancas novas para stage em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`
+                : `Nenhum dos caminhos pedidos gerou stage novo em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`
+            : stagedAll
+                ? `Preparei o stage das mudancas atuais em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`
+                : `Preparei o stage de ${stagedCount} caminho${stagedCount === 1 ? "" : "s"} em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`;
+        return {
+            captured_at: repo.capturedAt,
+            cwd,
+            resolved_cwd: repo.resolvedCwd,
+            is_repo: true,
+            repo_root: repo.repoRoot,
+            current_branch: repo.currentBranch,
+            staged_all: stagedAll,
+            path_count: pathspecs.length,
+            staged_count: stagedCount,
+            staged_paths: stagedPaths,
+            summary,
+        };
+    }
+    async gitCommitSnapshot(cwd, message, allowEmpty, workspaceContext) {
+        const repo = await this.probeGitRepository(cwd, workspaceContext);
+        if (!repo.isRepo) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: false,
+                message,
+                allow_empty: allowEmpty,
+                committed: false,
+                nothing_to_commit: false,
+                summary: `${repo.resolvedCwd} nao parece ser um repositorio Git.`,
+            };
+        }
+        const commitArgs = allowEmpty
+            ? ["commit", "--allow-empty", "-m", message]
+            : ["commit", "-m", message];
+        const commitResult = await this.runCommandCapture("/usr/bin/git", commitArgs, {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        if (commitResult.exitCode !== 0) {
+            const gitError = this.summarizeGitCommandError(commitResult, "O Git recusou a operacao de commit.");
+            const nothingToCommit = /nothing to commit|no changes added to commit|working tree clean/i.test(gitError);
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: true,
+                repo_root: repo.repoRoot,
+                current_branch: repo.currentBranch,
+                message,
+                allow_empty: allowEmpty,
+                committed: false,
+                nothing_to_commit: nothingToCommit,
+                error_message: nothingToCommit ? undefined : gitError,
+                summary: nothingToCommit
+                    ? `Nao havia mudancas staged para criar um commit em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`
+                    : `O Git recusou a criacao do commit em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`,
+            };
+        }
+        const shaProbe = await this.runCommandCapture("/usr/bin/git", ["rev-parse", "HEAD"], {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const commitSha = shaProbe.exitCode === 0 ? (shaProbe.stdout.trim() || undefined) : undefined;
+        return {
+            captured_at: repo.capturedAt,
+            cwd,
+            resolved_cwd: repo.resolvedCwd,
+            is_repo: true,
+            repo_root: repo.repoRoot,
+            current_branch: repo.currentBranch,
+            message,
+            allow_empty: allowEmpty,
+            committed: true,
+            nothing_to_commit: false,
+            commit_sha: commitSha,
+            summary: `Criei um commit local${commitSha ? ` (${commitSha.slice(0, 12)})` : ""} em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`,
+        };
+    }
+    async gitPushSnapshot(cwd, options, workspaceContext) {
+        const repo = await this.probeGitRepository(cwd, workspaceContext);
+        if (!repo.isRepo) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: false,
+                remote: options.remote,
+                branch: options.branch,
+                set_upstream: options.setUpstream === true,
+                pushed: false,
+                up_to_date: false,
+                summary: `${repo.resolvedCwd} nao parece ser um repositorio Git.`,
+            };
+        }
+        const branch = asString(options.branch) || repo.currentBranch || undefined;
+        const configuredRemote = asString(options.remote) || "";
+        const effectiveRemote = configuredRemote || (repo.trackingRef ? repo.trackingRef.split("/", 1)[0] : "");
+        const pushArgs = ["push"];
+        if (options.setUpstream === true) {
+            pushArgs.push("--set-upstream");
+        }
+        if (effectiveRemote) {
+            pushArgs.push(effectiveRemote);
+        }
+        if (branch && effectiveRemote) {
+            pushArgs.push(branch);
+        }
+        const pushResult = await this.runCommandCapture("/usr/bin/git", pushArgs, {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const gitOutput = [pushResult.stdout.trim(), pushResult.stderr.trim()].filter(Boolean).join("\n").trim();
+        if (pushResult.exitCode !== 0) {
+            return {
+                captured_at: repo.capturedAt,
+                cwd,
+                resolved_cwd: repo.resolvedCwd,
+                is_repo: true,
+                repo_root: repo.repoRoot,
+                current_branch: repo.currentBranch,
+                remote: effectiveRemote || undefined,
+                branch,
+                set_upstream: options.setUpstream === true,
+                pushed: false,
+                up_to_date: false,
+                tracking_ref: repo.trackingRef,
+                error_message: clipText(gitOutput || "O Git recusou a operacao de push.", 4_000),
+                summary: `O Git recusou o push em ${path.basename(repo.repoRoot || repo.resolvedCwd) || repo.resolvedCwd}.`,
+            };
+        }
+        const trackingProbe = await this.runCommandCapture("/usr/bin/git", ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"], {
+            cwd: repo.resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const trackingRef = trackingProbe.exitCode === 0
+            ? (trackingProbe.stdout.trim() || undefined)
+            : (repo.trackingRef || (effectiveRemote && branch ? `${effectiveRemote}/${branch}` : undefined));
+        const upToDate = /everything up-to-date/i.test(gitOutput);
+        const remoteLabel = effectiveRemote || (trackingRef ? trackingRef.split("/", 1)[0] : "");
+        const branchLabel = branch || repo.currentBranch || "branch atual";
+        return {
+            captured_at: repo.capturedAt,
+            cwd,
+            resolved_cwd: repo.resolvedCwd,
+            is_repo: true,
+            repo_root: repo.repoRoot,
+            current_branch: repo.currentBranch,
+            remote: remoteLabel || undefined,
+            branch: branch || undefined,
+            set_upstream: options.setUpstream === true,
+            pushed: !upToDate,
+            up_to_date: upToDate,
+            tracking_ref: trackingRef,
+            summary: upToDate
+                ? `A branch ${branchLabel} ja estava sincronizada${remoteLabel ? ` com ${remoteLabel}` : ""}.`
+                : `Enviei a branch ${branchLabel}${remoteLabel ? ` para ${remoteLabel}` : ""}.`,
+        };
+    }
+    async gitStatusSnapshot(cwd, includeUntracked, workspaceContext) {
+        const resolvedCwd = this.resolveWorkspaceExecutionCwd(cwd, workspaceContext);
+        const capturedAt = new Date().toISOString();
+        const repoProbe = await this.runCommandCapture("/usr/bin/git", ["rev-parse", "--show-toplevel"], {
+            cwd: resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        if (repoProbe.exitCode !== 0) {
+            return {
+                captured_at: capturedAt,
+                cwd,
+                resolved_cwd: resolvedCwd,
+                is_repo: false,
+                ahead: 0,
+                behind: 0,
+                include_untracked: includeUntracked,
+                is_clean: true,
+                entry_count: 0,
+                staged_count: 0,
+                modified_count: 0,
+                deleted_count: 0,
+                renamed_count: 0,
+                untracked_count: 0,
+                entries: [],
+                summary: `${resolvedCwd} nao parece ser um repositorio Git.`,
+            };
+        }
+        const repoRoot = repoProbe.stdout.trim() || resolvedCwd;
+        const statusResult = await this.runCommandCapture("/usr/bin/git", [
+            "status",
+            "--short",
+            "--branch",
+            "--porcelain=v1",
+            includeUntracked ? "--untracked-files=all" : "--untracked-files=no",
+        ], {
+            cwd: resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const lines = statusResult.stdout.split(/\r?\n/).filter((line) => line.trim().length > 0);
+        const branchLine = lines[0]?.startsWith("##") ? lines[0] : "";
+        const entries = this.parseGitStatusEntries(branchLine ? lines.slice(1) : lines);
+        const branchInfo = this.parseGitStatusBranchLine(branchLine);
+        const stagedCount = entries.filter((entry) => ![" ", "?"].includes(entry.staged_status)).length;
+        const modifiedCount = entries.filter((entry) => entry.staged_status === "M" || entry.unstaged_status === "M").length;
+        const deletedCount = entries.filter((entry) => entry.staged_status === "D" || entry.unstaged_status === "D").length;
+        const renamedCount = entries.filter((entry) => entry.staged_status === "R" || entry.unstaged_status === "R").length;
+        const untrackedCount = entries.filter((entry) => entry.staged_status === "?" && entry.unstaged_status === "?").length;
+        const isClean = entries.length === 0;
+        const currentBranch = branchInfo.currentBranch;
+        const summary = isClean
+            ? `O repositorio ${path.basename(repoRoot) || repoRoot} esta limpo${currentBranch ? ` na branch ${currentBranch}` : ""}.`
+            : `O repositorio ${path.basename(repoRoot) || repoRoot}${currentBranch ? ` na branch ${currentBranch}` : ""} tem ${entries.length} arquivo${entries.length === 1 ? "" : "s"} alterado${entries.length === 1 ? "" : "s"} (${stagedCount} staged, ${modifiedCount} modificados, ${untrackedCount} untracked).`;
+        return {
+            captured_at: capturedAt,
+            cwd,
+            resolved_cwd: resolvedCwd,
+            is_repo: true,
+            repo_root: repoRoot,
+            current_branch: currentBranch,
+            upstream_branch: branchInfo.upstreamBranch,
+            ahead: branchInfo.ahead,
+            behind: branchInfo.behind,
+            include_untracked: includeUntracked,
+            is_clean: isClean,
+            entry_count: entries.length,
+            staged_count: stagedCount,
+            modified_count: modifiedCount,
+            deleted_count: deletedCount,
+            renamed_count: renamedCount,
+            untracked_count: untrackedCount,
+            entries,
+            summary,
+        };
+    }
+    async gitDiffSnapshot(cwd, options, workspaceContext) {
+        const resolvedCwd = this.resolveWorkspaceExecutionCwd(cwd, workspaceContext);
+        const capturedAt = new Date().toISOString();
+        const repoProbe = await this.runCommandCapture("/usr/bin/git", ["rev-parse", "--show-toplevel"], {
+            cwd: resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const staged = options.staged === true;
+        const baseRef = asString(options.baseRef) || undefined;
+        if (repoProbe.exitCode !== 0) {
+            return {
+                captured_at: capturedAt,
+                cwd,
+                resolved_cwd: resolvedCwd,
+                is_repo: false,
+                staged,
+                base_ref: baseRef,
+                has_diff: false,
+                file_count: 0,
+                changed_files: [],
+                stat: "",
+                diff: "",
+                diff_char_count: 0,
+                truncated: false,
+                summary: `${resolvedCwd} nao parece ser um repositorio Git.`,
+            };
+        }
+        const repoRoot = repoProbe.stdout.trim() || resolvedCwd;
+        const diffArgs = ["diff", "--no-color"];
+        if (staged) {
+            diffArgs.push("--cached");
+        }
+        if (baseRef) {
+            diffArgs.push(baseRef);
+        }
+        const scopedPaths = (options.paths || [])
+            .map((item) => asString(item))
+            .filter((item) => Boolean(item));
+        const pathArgs = scopedPaths.length > 0 ? ["--", ...scopedPaths] : [];
+        const statResult = await this.runCommandCapture("/usr/bin/git", [...diffArgs, "--stat", ...pathArgs], {
+            cwd: resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const nameOnlyResult = await this.runCommandCapture("/usr/bin/git", [...diffArgs, "--name-only", ...pathArgs], {
+            cwd: resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const rawDiffResult = await this.runCommandCapture("/usr/bin/git", [...diffArgs, "--unified=3", ...pathArgs], {
+            cwd: resolvedCwd,
+            allowNonZeroExit: true,
+        });
+        const changedFiles = uniqueStrings(nameOnlyResult.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
+        const rawDiff = rawDiffResult.stdout.trim();
+        const maxChars = Math.max(1_000, Math.min(options.maxChars || 12_000, 20_000));
+        const clippedDiff = clipText(rawDiff || "(sem diff textual)", maxChars);
+        const summary = changedFiles.length === 0
+            ? `Nao encontrei diff ${staged ? "staged " : ""}pendente em ${path.basename(repoRoot) || repoRoot}.`
+            : `Encontrei diff ${staged ? "staged " : ""}com ${changedFiles.length} arquivo${changedFiles.length === 1 ? "" : "s"} alterado${changedFiles.length === 1 ? "" : "s"} em ${path.basename(repoRoot) || repoRoot}.`;
+        return {
+            captured_at: capturedAt,
+            cwd,
+            resolved_cwd: resolvedCwd,
+            is_repo: true,
+            repo_root: repoRoot,
+            staged,
+            base_ref: baseRef,
+            has_diff: changedFiles.length > 0,
+            file_count: changedFiles.length,
+            changed_files: changedFiles,
+            stat: statResult.stdout.trim(),
+            diff: clippedDiff,
+            diff_char_count: rawDiff.length,
+            truncated: clippedDiff.length < rawDiff.length,
+            summary,
+        };
+    }
+    async runTestsSnapshot(command, cwd, timeoutSeconds = 900, workspaceContext, profile, runtimeManifest) {
+        const resolvedCwd = this.resolveWorkspaceExecutionCwd(cwd, workspaceContext);
+        const capturedAt = new Date().toISOString();
+        const timeoutMs = Math.max(5_000, Math.min(timeoutSeconds * 1000, 1_800_000));
+        const ladderStages = !command && (profile === "auto" || !profile)
+            ? this.resolveValidationLadderStages(runtimeManifest, resolvedCwd, workspaceContext)
+            : [];
+        const stagesToRun = ladderStages.length > 0
+            ? ladderStages
+            : [{ stage_id: profile || "explicit_command", title: undefined, profile }];
+        const stageSnapshots = [];
+        for (const stage of stagesToRun) {
+            const startedAt = Date.now();
+            const resolvedTestCommand = await this.resolveRunTestsCommand(command, stage.profile, resolvedCwd, workspaceContext);
+            const result = await this.runCommandCapture("/bin/zsh", ["-lc", resolvedTestCommand.resolvedCommand], {
+                cwd: resolvedCwd,
+                allowNonZeroExit: true,
+                timeoutMs,
+            });
+            const combined = [result.stdout.trim(), result.stderr.trim()].filter(Boolean).join("\n");
+            const output = clipText(combined || "(sem saida)", 16_000);
+            const passed = result.exitCode === 0 && result.timedOut !== true;
+            const durationMs = Math.max(1, Date.now() - startedAt);
+            const summary = result.timedOut
+                ? `A etapa ${stage.stage_id} em ${path.basename(resolvedCwd) || resolvedCwd} excedeu o limite de tempo.`
+                : passed
+                    ? `A etapa ${stage.stage_id} em ${path.basename(resolvedCwd) || resolvedCwd} passou com sucesso.`
+                    : `A etapa ${stage.stage_id} em ${path.basename(resolvedCwd) || resolvedCwd} falhou com exit code ${result.exitCode}.`;
+            stageSnapshots.push({
+                stage_id: stage.stage_id,
+                title: stage.title,
+                profile: resolvedTestCommand.profile,
+                command: resolvedTestCommand.command,
+                resolved_command: resolvedTestCommand.resolvedCommand,
+                passed,
+                exit_code: result.exitCode,
+                timed_out: result.timedOut,
+                duration_ms: durationMs,
+                output,
+                output_char_count: combined.length,
+                summary,
+            });
+            if (!passed) {
+                break;
+            }
+            if (command) {
+                break;
+            }
+        }
+        const firstStage = stageSnapshots[0];
+        const failedStage = stageSnapshots.find((stage) => !stage.passed);
+        const overallPassed = stageSnapshots.length > 0 && failedStage === undefined;
+        const combinedOutput = clipText(stageSnapshots
+            .map((stage) => `# ${stage.stage_id}\n${stage.output}`)
+            .join("\n\n")
+            || "(sem saida)", 16_000);
+        const totalDurationMs = stageSnapshots.reduce((total, stage) => total + stage.duration_ms, 0);
+        const resolvedCommandLabel = stageSnapshots.map((stage) => stage.resolved_command).join(" && ");
+        const summary = failedStage
+            ? failedStage.summary
+            : `As ${stageSnapshots.length === 1 ? "validacao" : "validacoes"} em ${path.basename(resolvedCwd) || resolvedCwd} passaram com sucesso.`;
+        return {
+            captured_at: capturedAt,
+            cwd,
+            resolved_cwd: resolvedCwd,
+            command: command || (firstStage?.command || resolvedCommandLabel || "validation_ladder"),
+            profile: profile || firstStage?.profile,
+            resolved_command: resolvedCommandLabel || firstStage?.resolved_command || "",
+            passed: overallPassed,
+            exit_code: failedStage?.exit_code ?? firstStage?.exit_code ?? 0,
+            timed_out: failedStage?.timed_out ?? firstStage?.timed_out ?? false,
+            duration_ms: totalDurationMs || firstStage?.duration_ms || 1,
+            output: combinedOutput,
+            output_char_count: combinedOutput.length,
+            summary,
+            selected_ladder_id: ladderStages.length > 0 ? runtimeManifest?.validationLadder?.ladder_id : undefined,
+            stage_count: stageSnapshots.length,
+            failed_stage_id: failedStage?.stage_id,
+            stages: stageSnapshots,
+        };
+    }
+    async runShellCommand(command, cwd, workspaceContext) {
         if (!isSafeShellCommand(command)) {
             throw new Error("Nenhum comando shell foi informado para execucao local.");
         }
-        const resolvedCwd = cwd ? expandUserPath(cwd) : process.cwd();
+        const resolvedCwd = this.resolveWorkspaceExecutionCwd(cwd || "", workspaceContext);
         const { stdout, stderr } = await this.runCommandCapture("/bin/zsh", ["-lc", command], {
             cwd: resolvedCwd,
         });
@@ -5832,15 +8407,66 @@ if let output = String(data: data, encoding: .utf8) {
         if (action.type === "write_text_file") {
             return `Arquivo de texto escrito em ${action.filename ? `${action.path}/${action.filename}` : action.path}`;
         }
+        if (action.type === "write_json_file") {
+            return `Arquivo JSON escrito em ${action.filename ? `${action.path}/${action.filename}` : action.path}`;
+        }
+        if (action.type === "apply_patch") {
+            return `Patch aplicado em ${action.cwd}`;
+        }
+        if (action.type === "mkdir") {
+            return `Pasta criada em ${action.path}`;
+        }
+        if (action.type === "move_file") {
+            return `Item movido de ${action.source_path} para ${action.destination_path}`;
+        }
+        if (action.type === "git_clone") {
+            return `Repositorio Git clonado em ${action.destination_path}`;
+        }
+        if (action.type === "git_fetch") {
+            return `Fetch do Git executado em ${action.cwd}`;
+        }
+        if (action.type === "git_checkout") {
+            return `Checkout do Git executado em ${action.cwd}`;
+        }
+        if (action.type === "git_rebase") {
+            return `Rebase do Git executado em ${action.cwd}`;
+        }
+        if (action.type === "git_merge") {
+            return `Merge do Git executado em ${action.cwd}`;
+        }
+        if (action.type === "git_tag") {
+            return `Tag ${action.name} criada em ${action.cwd}`;
+        }
+        if (action.type === "git_add") {
+            return `Stage do Git preparado em ${action.cwd}`;
+        }
+        if (action.type === "git_commit") {
+            return `Commit local criado em ${action.cwd}`;
+        }
+        if (action.type === "git_push") {
+            return `Push do Git executado em ${action.cwd}`;
+        }
         if (action.type === "list_files") {
             return `Arquivos listados em ${action.path}`;
         }
+        if (action.type === "delete_file") {
+            return `Arquivo apagado em ${action.path}`;
+        }
         if (action.type === "count_files") {
             return `Arquivos contados em ${action.path}`;
         }
         if (action.type === "system_status") {
             return "Status do macOS coletado";
         }
+        if (action.type === "git_status") {
+            return `Estado do Git lido em ${action.cwd}`;
+        }
+        if (action.type === "git_diff") {
+            return `Diff do Git lido em ${action.cwd}`;
+        }
+        if (action.type === "run_tests") {
+            return `Validacao ${action.profile || "local"} executada em ${action.cwd}`;
+        }
         if (action.type === "run_shell") {
             return `Comando ${action.command} executado no macOS`;
         }
@@ -5875,9 +8501,31 @@ if let output = String(data: data, encoding: .utf8) {
         });
         this.activeChild = child;
         try {
-            const { stdout, stderr } = await new Promise((resolve, reject) => {
+            const { stdout, stderr, exitCode, timedOut } = await new Promise((resolve, reject) => {
                 let stdout = "";
                 let stderr = "";
+                let timedOut = false;
+                let settled = false;
+                const timeoutMs = options?.timeoutMs;
+                const timer = timeoutMs && timeoutMs > 0
+                    ? setTimeout(() => {
+                        timedOut = true;
+                        child.kill("SIGTERM");
+                        setTimeout(() => {
+                            try {
+                                child.kill("SIGKILL");
+                            }
+                            catch {
+                                // Process already exited.
+                            }
+                        }, 1000).unref();
+                    }, timeoutMs)
+                    : null;
+                const clearTimer = () => {
+                    if (timer) {
+                        clearTimeout(timer);
+                    }
+                };
                 if (options?.stdin !== undefined) {
                     child.stdin.write(options.stdin);
                     child.stdin.end();
@@ -5892,21 +8540,36 @@ if let output = String(data: data, encoding: .utf8) {
                     stderr += String(chunk);
                 });
                 child.on("error", (error) => {
+                    if (settled) {
+                        return;
+                    }
+                    settled = true;
+                    clearTimer();
                     reject(error);
                 });
                 child.on("close", (code) => {
-                    if (code === 0) {
-                        resolve({ stdout, stderr });
+                    if (settled) {
+                        return;
+                    }
+                    settled = true;
+                    clearTimer();
+                    const normalizedExitCode = typeof code === "number" ? code : (timedOut ? 124 : 1);
+                    if (timedOut && options?.allowNonZeroExit !== true) {
+                        reject(new Error(`${command} ${args.join(" ")} timed out after ${timeoutMs}ms`));
+                        return;
+                    }
+                    if (normalizedExitCode === 0 || options?.allowNonZeroExit === true) {
+                        resolve({ stdout, stderr, exitCode: normalizedExitCode, timedOut });
                         return;
                     }
-                    reject(new Error(`${command} ${args.join(" ")} failed: ${stderr.trim() || stdout.trim() || `exit code ${code ?? "unknown"}`}`));
+                    reject(new Error(`${command} ${args.join(" ")} failed: ${stderr.trim() || stdout.trim() || `exit code ${normalizedExitCode}`}`));
                 });
             });
             const stderrText = stderr.trim();
             if (stderrText) {
                 console.warn(`[otto-bridge] ${command} stderr=${stderrText}`);
             }
-            return { stdout, stderr };
+            return { stdout, stderr, exitCode, timedOut };
         }
         catch (error) {
             const detail = error instanceof Error ? error.message : String(error);