@ouro.bot/cli 0.1.0-alpha.99 → 0.1.0-alpha.991

package/dist/repertoire/tools.js

@@ -1,19 +1,48 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.goInwardTool = exports.noResponseTool = exports.finalAnswerTool = exports.tools = void 0;
+exports.ToolSelectionError = exports.surfaceToolDef = exports.speakTool = exports.restTool = exports.ponderTool = exports.observeTool = exports.settleTool = exports.tools = exports.SANCTUARY_OWNER_ADDITIONS = exports.SANCTUARY_MCP_PROVIDED_TOOLS = void 0;
+exports.toolSelectionSchemas = toolSelectionSchemas;
+exports.selectToolsForChannel = selectToolsForChannel;
 exports.getToolsForChannel = getToolsForChannel;
-exports.isConfirmationRequired = isConfirmationRequired;
+exports.reduceToolSelection = reduceToolSelection;
+exports.resolveToolDefinition = resolveToolDefinition;
+exports.approvalPolicyForToolName = approvalPolicyForToolName;
+exports.classifyApprovalForInvocation = classifyApprovalForInvocation;
+exports.approvalPolicyForInvocation = approvalPolicyForInvocation;
+exports.shellRiskProfile = shellRiskProfile;
+exports.riskProfileForTool = riskProfileForTool;
+exports.riskProfileForToolName = riskProfileForToolName;
+exports.preflightToolCall = preflightToolCall;
+exports.executeTool = executeTool;
 exports.execTool = execTool;
 exports.summarizeArgs = summarizeArgs;
+exports.buildToolResultSummary = buildToolResultSummary;
+const node_util_1 = require("node:util");
 const tools_base_1 = require("./tools-base");
 const tools_teams_1 = require("./tools-teams");
 const tools_bluebubbles_1 = require("./tools-bluebubbles");
 const ado_semantic_1 = require("./ado-semantic");
 const tools_github_1 = require("./tools-github");
+const tools_bundle_1 = require("./tools-bundle");
 const runtime_1 = require("../nerves/runtime");
 const guardrails_1 = require("./guardrails");
 const identity_1 = require("../heart/identity");
-const safe_workspace_1 = require("../heart/safe-workspace");
+const store_1 = require("../commerce/store");
+const tools_surface_1 = require("./tools-surface");
+const mcp_tools_1 = require("./mcp-tools");
+const tool_arguments_1 = require("./tool-arguments");
+const tools_voice_1 = require("./tools-voice");
+const shell_sessions_1 = require("./shell-sessions");
+const tools_unraid_1 = require("./tools-unraid");
+const tools_flow_1 = require("./tools-flow");
+const tools_steward_policy_1 = require("./tools-steward-policy");
+const tools_house_care_1 = require("./tools-house-care");
+const tools_shepherd_1 = require("./tools-shepherd");
+const steward_policy_1 = require("../heart/steward-policy");
+const relationship_authorization_1 = require("./relationship-authorization");
+const tool_approval_1 = require("../heart/tool-approval");
+const tools_voice_local_1 = require("./tools-voice-local");
+const tools_sanctuary_host_1 = require("./tools-sanctuary-host");
 function safeGetAgentRoot() {
     try {
         return (0, identity_1.getAgentRoot)();
@@ -22,17 +51,75 @@ function safeGetAgentRoot() {
         return undefined;
     }
 }
+const SANCTUARY_RELATIONSHIP_BASE_TOOLS = new Set([
+    "external_event_disposition",
+    "query_active_work",
+    "save_friend_note",
+    "telegram_contact_manage",
+    "query_cares",
+    "care_manage",
+    "await_condition",
+    "report_failure",
+    "resolve_await",
+    "cancel_await",
+    "list_recent_attachments",
+    "materialize_attachment",
+    "describe_image",
+    "send_message",
+]);
+/**
+ * Sanctuary tool names that the packaged owner profile authorizes but that are
+ * supplied at runtime by the packaged `media` MCP server rather than by a native
+ * definition. They resolve only when an MCP manager is attached to the turn, so
+ * containment audits that select tools without one must exclude them before
+ * comparing the profile against the resolved schema list.
+ */
+exports.SANCTUARY_MCP_PROVIDED_TOOLS = new Set([
+    "media_search", "media_request", "media_request_status",
+    "media_diagnose_and_fix", "media_chain_health", "media_play_or_resolve",
+    "media_search_now", "media_queue", "media_blocklist_stalled", "media_episodes", "media_indexer_search", "media_release_search", "media_release_grab", "media_blocklist", "media_manual_import", "media_quality_profile", "media_fill_missing",
+]);
+/** Channels a Sanctuary turn can arrive on from the host itself, not from a remote party. */
+const SANCTUARY_LOCAL_CHANNELS = new Set(["inner", "cli", "mcp"]);
+exports.SANCTUARY_OWNER_ADDITIONS = new Set([
+    "shell", "shell_status", "shell_tail", "read_file", "write_file", "edit_file", "glob", "grep",
+    "web_search", "search_facts", "consult_diary", "consult_notes", "get_friend_note",
+    "session_summary", "query_session", "set_reasoning_effort", "restart_runtime", "revive_sense",
+]);
+/** The bundle sync tools, granted to the Sanctuary owner alone. */
+const SANCTUARY_OWNER_SYNC_TOOLS = new Set(["bundle_push", "bundle_pull_rebase"]);
 // Re-export types and constants used by the rest of the codebase
 var tools_base_2 = require("./tools-base");
 Object.defineProperty(exports, "tools", { enumerable: true, get: function () { return tools_base_2.tools; } });
-Object.defineProperty(exports, "finalAnswerTool", { enumerable: true, get: function () { return tools_base_2.finalAnswerTool; } });
-Object.defineProperty(exports, "noResponseTool", { enumerable: true, get: function () { return tools_base_2.noResponseTool; } });
-Object.defineProperty(exports, "goInwardTool", { enumerable: true, get: function () { return tools_base_2.goInwardTool; } });
+Object.defineProperty(exports, "settleTool", { enumerable: true, get: function () { return tools_base_2.settleTool; } });
+Object.defineProperty(exports, "observeTool", { enumerable: true, get: function () { return tools_base_2.observeTool; } });
+Object.defineProperty(exports, "ponderTool", { enumerable: true, get: function () { return tools_base_2.ponderTool; } });
+Object.defineProperty(exports, "restTool", { enumerable: true, get: function () { return tools_base_2.restTool; } });
+Object.defineProperty(exports, "speakTool", { enumerable: true, get: function () { return tools_base_2.speakTool; } });
+// Re-export surface tool schema for consumers (e.g. heart/core.ts)
+var tools_surface_2 = require("./tools-surface");
+Object.defineProperty(exports, "surfaceToolDef", { enumerable: true, get: function () { return tools_surface_2.surfaceToolDef; } });
 // All tool definitions in a single registry
-const allDefinitions = [...tools_base_1.baseToolDefinitions, ...tools_bluebubbles_1.bluebubblesToolDefinitions, ...tools_teams_1.teamsToolDefinitions, ...ado_semantic_1.adoSemanticToolDefinitions, ...tools_github_1.githubToolDefinitions];
-function baseToolsForCapabilities() {
-    // Use baseToolDefinitions at call time so dynamically-added tools are included
-    return tools_base_1.baseToolDefinitions.map((d) => d.tool);
+const additionalDefinitions = [...tools_bluebubbles_1.bluebubblesToolDefinitions, ...tools_teams_1.teamsToolDefinitions, ...ado_semantic_1.adoSemanticToolDefinitions, ...tools_github_1.githubToolDefinitions, ...tools_bundle_1.bundleToolDefinitions, ...tools_voice_1.voiceToolDefinitions, ...tools_unraid_1.unraidToolDefinitions, tools_steward_policy_1.stewardPolicyToolDefinition, ...tools_house_care_1.houseCareToolDefinitions, tools_surface_1.surfaceToolDefinition, ...tools_shepherd_1.shepherdToolDefinitions];
+const COMMERCE_AUTHORITY_TOOLS = new Set(["stripe_create_card", "flight_hold", "flight_book"]);
+class ToolSelectionError extends Error {
+}
+exports.ToolSelectionError = ToolSelectionError;
+function assertUniqueToolSchemas(tools) {
+    const seen = new Set();
+    for (const tool of tools) {
+        if (seen.has(tool.function.name)) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error", component: "tools", event: "tool.selection_collision",
+                message: "tool selection contains an ambiguous name", meta: { name: tool.function.name },
+            });
+            throw new ToolSelectionError(`tool selection collision: ${tool.function.name}`);
+        }
+        seen.add(tool.function.name);
+    }
+}
+function toolSelectionSchemas(selection) {
+    return [...selection.ordinary.map((definition) => definition.tool), ...selection.engine];
 }
 // Apply a single tool preference to a tool schema, returning a new object.
 function applyPreference(tool, pref) {
@@ -44,117 +131,387 @@ function applyPreference(tool, pref) {
         },
     };
 }
-// Filter out tools whose requiredCapability is not in the provider's capability set.
-// Uses baseToolDefinitions at call time so dynamically-added tools are included.
-// Only base tools can have requiredCapability (integration tools do not).
-function filterByCapability(toolList, providerCapabilities) {
-    return toolList.filter((tool) => {
-        const def = tools_base_1.baseToolDefinitions.find((d) => d.tool.function.name === tool.function.name);
-        if (!def?.requiredCapability)
-            return true;
-        return providerCapabilities?.has(def.requiredCapability) === true;
-    });
-}
-// Return the appropriate tools list based on channel capabilities.
-// Base tools (no integration) are always included.
-// Teams/integration tools are included only if their integration is in availableIntegrations.
-// When toolPreferences is provided, matching preferences are appended to tool descriptions.
-// When providerCapabilities is provided, tools with requiredCapability are filtered.
-function getToolsForChannel(capabilities, toolPreferences, _context, providerCapabilities) {
-    const baseTools = baseToolsForCapabilities();
-    const bluebubblesTools = capabilities?.channel === "bluebubbles"
-        ? tools_bluebubbles_1.bluebubblesToolDefinitions.map((d) => d.tool)
-        : [];
-    let result;
-    if (!capabilities || capabilities.availableIntegrations.length === 0) {
-        result = [...baseTools, ...bluebubblesTools];
+function selectToolsForChannel(capabilities, toolPreferences, _context, providerCapabilities, mcpManager, _chatModel, context) {
+    const relationship = context?.relationshipAuthorization;
+    const profileId = relationship?.profileId;
+    // Every Sanctuary turn that reaches the agent from outside the host (Telegram, A2A,
+    // any future remote sense) is relationship-scoped: without a known capability
+    // profile it gets no tools at all. Only the Butler's own local channels (its inner
+    // loop and the host-local CLI/MCP) keep the unscoped tool set.
+    const channel = capabilities?.channel;
+    const remote = channel !== undefined && !SANCTUARY_LOCAL_CHANNELS.has(channel);
+    const sanctuary = (context?.agentName === "sanctuary" && (relationship !== undefined || remote))
+        || profileId?.startsWith("sanctuary-") === true;
+    const owner = profileId === "sanctuary-owner";
+    // A trusted peer agent acting for the owner gets the owner's chat tool menu. Host
+    // execution and approval-gated routine actions stay Telegram-owner-only: the host
+    // tool is only ever added on the Telegram channel, and the peer profile omits them.
+    const ownerLike = owner || profileId === "sanctuary-agent-peer";
+    const knownSanctuaryProfile = relationship !== undefined && (ownerLike || profileId === "sanctuary-household" || profileId === "sanctuary-event");
+    const mcp = mcpManager ? (0, mcp_tools_1.mcpToolsAsDefinitions)(mcpManager) : [];
+    const native = [...tools_base_1.baseToolDefinitions, ...additionalDefinitions];
+    assertUniqueToolSchemas([
+        ...native.map((definition) => definition.tool), tools_sanctuary_host_1.rootHostToolDefinition.tool, ...mcp.map((definition) => definition.tool),
+        tools_flow_1.ponderTool, tools_flow_1.restTool, tools_flow_1.observeTool, tools_flow_1.settleTool, tools_flow_1.speakTool,
+    ]);
+    let ordinary;
+    if (sanctuary) {
+        ordinary = knownSanctuaryProfile
+            ? [
+                ...tools_base_1.baseToolDefinitions.filter((definition) => SANCTUARY_RELATIONSHIP_BASE_TOOLS.has(definition.tool.function.name)
+                    || (ownerLike && exports.SANCTUARY_OWNER_ADDITIONS.has(definition.tool.function.name))),
+                ...tools_unraid_1.unraidToolDefinitions, tools_steward_policy_1.stewardPolicyToolDefinition, ...(ownerLike ? tools_house_care_1.houseCareToolDefinitions : []),
+                ...(owner ? tools_bundle_1.bundleToolDefinitions.filter((definition) => SANCTUARY_OWNER_SYNC_TOOLS.has(definition.tool.function.name)) : []),
+                ...(ownerLike ? mcp : []),
+            ]
+            : [];
     }
     else {
-        const available = new Set(capabilities.availableIntegrations);
-        const channelDefs = [...tools_teams_1.teamsToolDefinitions, ...ado_semantic_1.adoSemanticToolDefinitions, ...tools_github_1.githubToolDefinitions];
-        // Include tools whose integration is available, plus channel tools with no integration gate (e.g. teams_send_message)
-        const integrationDefs = channelDefs.filter((d) => d.integration ? available.has(d.integration) : capabilities.channel === "teams");
-        if (!toolPreferences || Object.keys(toolPreferences).length === 0) {
-            result = [...baseTools, ...bluebubblesTools, ...integrationDefs.map((d) => d.tool)];
-        }
-        else {
-            // Build a map of integration -> preference text for fast lookup
-            const prefMap = new Map();
-            for (const [key, value] of Object.entries(toolPreferences)) {
-                prefMap.set(key, value);
-            }
-            // Apply preferences to matching integration tools (new objects, no mutation)
-            // d.integration is guaranteed truthy -- integrationDefs are pre-filtered above
-            const enrichedIntegrationTools = integrationDefs.map((d) => {
-                const pref = prefMap.get(d.integration);
-                return pref ? applyPreference(d.tool, pref) : d.tool;
+        const available = new Set(capabilities?.availableIntegrations ?? []);
+        const integrations = [...tools_teams_1.teamsToolDefinitions, ...ado_semantic_1.adoSemanticToolDefinitions, ...tools_github_1.githubToolDefinitions]
+            .filter((definition) => available.size > 0 || definition.tool.function.name === "teams_send_image")
+            .filter((definition) => definition.integration ? available.has(definition.integration) : capabilities?.channel === "teams")
+            .map((definition) => {
+            const preference = definition.integration ? toolPreferences?.[definition.integration] : undefined;
+            return preference ? { ...definition, tool: applyPreference(definition.tool, preference) } : definition;
+        });
+        ordinary = [
+            ...tools_base_1.baseToolDefinitions,
+            // The Shepherd tools exist only for an agent that turned the sense on in agent.json.
+            ...((0, tools_shepherd_1.shepherdToolsEnabled)(context?.agentRoot ?? safeGetAgentRoot()) ? tools_shepherd_1.shepherdToolDefinitions : []),
+            ...(capabilities?.channel === "bluebubbles" ? tools_bluebubbles_1.bluebubblesToolDefinitions : []),
+            ...(capabilities?.channel === "voice" ? tools_voice_1.voiceToolDefinitions : []),
+            ...((0, tools_voice_local_1.localAudioToolGate)({ ...context, context: _context }).ok ? [tools_voice_local_1.voiceLocalAudioToolDefinition] : []),
+            ...integrations, ...mcp,
+        ];
+    }
+    const hostTool = capabilities?.channel === "telegram"
+        ? (0, tools_sanctuary_host_1.selectRootHostTool)({ ...context, context: _context ?? context?.context }, providerCapabilities)
+        : undefined;
+    if (hostTool)
+        ordinary.push(hostTool);
+    const inner = capabilities?.channel === "inner";
+    // The Butler's own scheduled turns (the daily house-care await) carry no relationship, so they cannot take the owner profile's menu.
+    if (inner && !sanctuary && context?.agentName === "sanctuary")
+        ordinary.push(...tools_house_care_1.houseCareToolDefinitions);
+    const habit = context?.habitSession;
+    if (inner) {
+        const canSend = habit?.toolPolicy.outwardMessagingAllowed === true && habit.toolPolicy.grantedTools.includes("send_message");
+        ordinary = ordinary.filter((definition) => canSend || definition.tool.function.name !== "send_message");
+        if (!habit || (habit.toolPolicy.outwardMessagingAllowed && habit.toolPolicy.grantedTools.includes("surface"))) {
+            ordinary.push(tools_surface_1.surfaceToolDefinition);
+        }
+    }
+    ordinary = ordinary.filter((definition) => (definition.tool.function.name !== "teams_send_image" || (!context?.noSend && !context?.habitSession && !context?.autonomousTurnKind))
+        &&
+            (!relationship || relationship.advertisedToolNames.includes(definition.tool.function.name))
+        && (!definition.requiredCapability || providerCapabilities?.has(definition.requiredCapability) === true));
+    const engine = [
+        ...(context?.noSend ? [] : [tools_flow_1.ponderTool]),
+        ...(inner ? [tools_flow_1.restTool] : [tools_flow_1.observeTool, tools_flow_1.settleTool]),
+        ...(capabilities?.chatStyle ? [tools_flow_1.speakTool] : []),
+    ].filter((tool) => (!sanctuary || (knownSanctuaryProfile && tool.function.name !== "observe"))
+        && (!relationship || relationship.advertisedToolNames.includes(tool.function.name))
+        && (!context?.allowedEngineTools || context.allowedEngineTools.includes(tool.function.name)));
+    return Object.freeze({
+        ordinary: Object.freeze(ordinary.map((definition) => definition === hostTool ? definition : Object.freeze({
+            ...definition,
+            tool: (0, tool_arguments_1.freezeToolValue)(structuredClone(definition.tool)),
+            ...(definition.riskProfile && typeof definition.riskProfile !== "function"
+                ? { riskProfile: (0, tool_arguments_1.freezeToolValue)(structuredClone(definition.riskProfile)) } : {}),
+            ...(definition.terminalProjection ? { terminalProjection: (0, tool_arguments_1.freezeToolValue)(structuredClone(definition.terminalProjection)) } : {}),
+        }))),
+        engine: Object.freeze(engine.map((tool) => (0, tool_arguments_1.freezeToolValue)(tool))),
+    });
+}
+function getToolsForChannel(...args) {
+    return toolSelectionSchemas(selectToolsForChannel(...args));
+}
+function reduceToolSelection(selection, requested) {
+    assertUniqueToolSchemas(requested);
+    const canonical = toolSelectionSchemas(selection);
+    for (const tool of requested) {
+        const match = canonical.find((candidate) => candidate.function.name === tool.function.name);
+        if (!match || !(0, node_util_1.isDeepStrictEqual)(match, tool)) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn", component: "tools", event: "tool.selection_rejected",
+                message: "tool override is not an exact canonical reduction", meta: { name: tool.function.name },
             });
-            result = [...baseTools, ...bluebubblesTools, ...enrichedIntegrationTools];
+            throw new ToolSelectionError(`tool selection is not a canonical reduction: ${tool.function.name}`);
         }
     }
-    return filterByCapability(result, providerCapabilities);
+    const names = new Set(requested.map((tool) => tool.function.name));
+    return Object.freeze({ ordinary: Object.freeze(selection.ordinary.filter((definition) => names.has(definition.tool.function.name))), engine: selection.engine });
 }
-// Check whether a tool requires user confirmation before execution.
-// Reads from ToolDefinition.confirmationRequired instead of a separate Set.
-function isConfirmationRequired(toolName) {
-    const def = allDefinitions.find((d) => d.tool.function.name === toolName);
-    return def?.confirmationRequired === true;
+function resolveToolDefinition(toolName, selection) {
+    return (selection?.ordinary ?? [...tools_base_1.baseToolDefinitions, ...additionalDefinitions]).find((definition) => definition.tool.function.name === toolName);
 }
-function normalizeGuardArgs(name, args) {
-    if ((name === "read_file" || name === "write_file" || name === "edit_file") && args.path) {
-        return {
-            ...args,
-            path: (0, safe_workspace_1.resolveSafeRepoPath)({ requestedPath: args.path }).resolvedPath,
+function approvalPolicyForToolName(name, args, selection) {
+    return resolveToolDefinition(name, selection)?.approvalPolicy?.(args) ?? { kind: "not_required" };
+}
+async function routineActionInvocation(args, ctx) {
+    const agentRoot = ctx?.agentRoot;
+    const relationship = ctx?.relationshipAuthorization;
+    const sanctuary = ctx?.sanctuary;
+    const target = typeof args?.container === "string" ? args.container : "";
+    const authorization = await (0, relationship_authorization_1.authorizeRoutineActionRequester)(ctx, args);
+    if (!authorization.allowed)
+        return { kind: "denied", reason: authorization.reason };
+    const currentRequester = (0, tools_base_1.routineActionRequester)(ctx, authorization.requester.kind === "owner_event" ? { friendId: authorization.requester.friendId, target: authorization.requester.target } : undefined);
+    if (!ctx || !agentRoot || ctx.agentRoot !== agentRoot || ctx.relationshipAuthorization !== relationship || ctx.sanctuary !== sanctuary
+        || args.container !== target || Object.keys(args).length !== 1 || !(0, node_util_1.isDeepStrictEqual)(currentRequester, authorization.requester))
+        return { kind: "denied", reason: "routine request binding changed after authorization" };
+    const key = `unraid.restart:${target}`;
+    const decision = (0, steward_policy_1.inspectRoutineActionGrant)(agentRoot, { key, action: "unraid.container.restart", target, requester: authorization.requester, authorizationVersion: authorization.profileVersion });
+    if (!decision.allowed)
+        return decision.approvalFallback ? null : { kind: "denied", reason: decision.reason };
+    return Object.freeze({ kind: "standing", agentRoot, key, target, expectedPolicyVersion: decision.policyVersion, expectedDesiredStateVersion: decision.desiredStateVersion, expectedGrantVersion: decision.grantVersion, requester: structuredClone(decision.requester), authorizationVersion: decision.authorizationVersion });
+}
+async function classifyApprovalForInvocation(name, args, ctx) {
+    const fallback = approvalPolicyForToolName(name, args, ctx?.toolSelection);
+    if (name !== "unraid_restart_container" || fallback.kind !== "required")
+        return { policy: fallback };
+    const routineActionSelection = await routineActionInvocation(args, ctx);
+    return routineActionSelection ? { policy: { kind: "not_required" }, routineActionSelection } : { policy: fallback };
+}
+async function approvalPolicyForInvocation(name, args, ctx) {
+    // An approval requirement is not execution authority; dispatch needs the full classification.
+    return (await classifyApprovalForInvocation(name, args, ctx)).policy;
+}
+const findDefinition = resolveToolDefinition;
+const READ_ONLY_OURO_SHELL_COMMANDS = new Set([
+    "help",
+    "-h",
+    "--help",
+    "-v",
+    "--version",
+    "status",
+    "whoami",
+    "versions",
+    "changelog",
+    "mailbox",
+    "inner",
+    "thoughts",
+    "check",
+    "session list",
+    "mcp list",
+    "config models",
+    "auth verify",
+    "vault status",
+    "vault config status",
+    "vault item status",
+    "vault item list",
+]);
+function shellTokens(command) {
+    return command.trim().split(/\s+/).filter(Boolean);
+}
+function ouroShellRiskReason(command) {
+    const tokens = shellTokens(command);
+    if (tokens[0] !== "ouro")
+        return null;
+    const first = tokens[1] ?? "";
+    const second = tokens[2] ?? "";
+    const third = tokens[3] ?? "";
+    const twoWord = second ? `${first} ${second}` : first;
+    const threeWord = third ? `${twoWord} ${third}` : twoWord;
+    if (READ_ONLY_OURO_SHELL_COMMANDS.has(threeWord)
+        || READ_ONLY_OURO_SHELL_COMMANDS.has(twoWord)
+        || READ_ONLY_OURO_SHELL_COMMANDS.has(first)) {
+        return null;
+    }
+    const hint = first === "restart_runtime"
+        ? " Hint: use the restart_runtime tool instead of shell."
+        : "";
+    return `ouro CLI command may mutate runtime/config state or be unavailable from shell.${hint}`;
+}
+function shellRiskProfile(args) {
+    const command = String(args.command);
+    const destructive = (0, shell_sessions_1.detectDestructivePatterns)(command);
+    if (destructive.length > 0) {
+        return { mutates: "external_side_effect", risk: "high", reason: `destructive shell pattern: ${destructive.join(", ")}` };
+    }
+    const ouroRiskReason = ouroShellRiskReason(command);
+    if (ouroRiskReason) {
+        return { mutates: "external_side_effect", risk: "high", reason: ouroRiskReason };
+    }
+    if (/(^|\s)(rm|mv|cp|touch|mkdir|rmdir)\b/.test(command)
+        || /(^|\s)(npm|pnpm|yarn)\s+(install|add|remove|update|upgrade)\b/.test(command)
+        || /(^|\s)git\s+(add|apply|checkout|clean|commit|merge|pull|push|rebase|reset|restore|switch)\b/.test(command)
+        || /(^|\s)(sed\s+-i|perl\s+-pi)\b/.test(command)
+        || /(^|\s)(tee|truncate)\b/.test(command)
+        || /(^|[^<])>>?\s*\S+/.test(command)) {
+        return { mutates: "external_side_effect", risk: "high", reason: "shell command appears to mutate files, packages, git state, or external state" };
+    }
+    return { mutates: "none", risk: "low" };
+}
+function riskProfileForTool(def, name, args) {
+    if (name === "shell")
+        return shellRiskProfile(args);
+    if (typeof def.riskProfile === "function")
+        return def.riskProfile(args);
+    return def.riskProfile ?? { mutates: "none", risk: "low" };
+}
+function riskProfileForToolName(name, args, selection) {
+    const def = findDefinition(name, selection);
+    return def ? riskProfileForTool(def, name, args) : null;
+}
+function orientationHoldMessage(name, profile, reason) {
+    return `orientation hold: ${reason} Available: orientation_get plus read-only inspection tools like trip_status, query_session, read_config, read_file, grep, search_facts, consult_diary, and consult_notes. Resolve the referent/correction, then retry ${name} if the action is still correct. Blocked ${mutationKindsFor(profile).join(", ")}. ${profile.reason}.`;
+}
+function mutationKindsFor(profile) {
+    const mutates = profile.mutates;
+    return typeof mutates === "string" ? [mutates] : [...mutates];
+}
+function orientationPolicyBlocks(profile, blockedMutationKinds) {
+    if (profile.risk !== "high")
+        return false;
+    return mutationKindsFor(profile).some((kind) => blockedMutationKinds.includes(kind));
+}
+async function preflightToolCall(name, args, ctx) {
+    try {
+        const selection = ctx?.toolSelection;
+        const def = findDefinition(name, selection);
+        const schema = def?.tool ?? selection?.engine.find((tool) => tool.function.name === name);
+        if (!schema) {
+            (0, runtime_1.emitNervesEvent)({ level: "error", event: "tool.error", component: "tools", message: "unknown or unselected tool requested", meta: { name } });
+            return { kind: "rejected_before_handler", text: `unknown: ${name}` };
+        }
+        if (name === tools_sanctuary_host_1.rootHostToolDefinition.tool.function.name)
+            await (0, tools_sanctuary_host_1.authorizeRootHostToolInvocation)(ctx, def, args);
+        if (selection || ctx?.relationshipAuthorization) {
+            const validation = (0, tool_arguments_1.validateAdvertisedToolArguments)(JSON.stringify(args), schema.function.parameters ?? {});
+            if (!validation.ok)
+                return { kind: "rejected_before_handler", text: `invalid tool arguments: ${validation.reason}` };
+        }
+        (0, tool_arguments_1.assertRelationshipToolOwner)(ctx);
+        if (name === "unraid_restart_container" && ctx?.routineActionSelection?.kind === "denied") {
+            return { kind: "rejected_before_handler", text: (0, tools_base_1.routineActionDenied)(ctx.routineActionSelection.reason) };
+        }
+        const relationship = ctx?.relationshipAuthorization;
+        const decision = name === tools_sanctuary_host_1.rootHostToolDefinition.tool.function.name ? undefined : await relationship?.authorizeTool(name, args);
+        if (decision && (!decision.allowed || !relationship.advertisedToolNames.includes(name)
+            || (decision.profileId !== undefined && decision.profileId !== relationship.profileId))) {
+            const reason = decision.allowed ? "current relationship selection changed" : decision.reason;
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn", event: "tool.relationship_authorization_block", component: "tools",
+                message: "relationship authorization blocked tool execution", meta: { name, reason },
+            });
+            return { kind: "rejected_before_handler", text: `relationship authorization required: ${reason}` };
+        }
+        const currentSelection = ctx?.selectCurrentTools?.()
+            ?? (name === tools_sanctuary_host_1.rootHostToolDefinition.tool.function.name ? selection
+                : relationship?.profileId?.startsWith("sanctuary-") || (relationship && ctx?.agentName === "sanctuary")
+                    ? selectToolsForChannel(undefined, undefined, undefined, undefined, undefined, undefined, ctx)
+                    : undefined);
+        const current = currentSelection ? findDefinition(name, currentSelection) : def?.mcpBinding ? def : findDefinition(name);
+        const currentSchema = current?.tool ?? currentSelection?.engine.find((tool) => tool.function.name === name)
+            ?? (!currentSelection ? selection?.engine.find((tool) => tool.function.name === name) : undefined);
+        if (!currentSchema || !(0, node_util_1.isDeepStrictEqual)(schema, currentSchema)
+            || (def && (!current || (def.mcpBinding
+                ? !current.mcpBinding || current.mcpBinding.manager !== def.mcpBinding.manager || !(0, node_util_1.isDeepStrictEqual)(current.mcpBinding, def.mcpBinding)
+                : current.handler !== def.handler)))) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn", event: "tool.selection_rejected", component: "tools",
+                message: "selected tool is no longer current", meta: { name },
+            });
+            return { kind: "rejected_before_handler", text: `rejected: ${name} changed or is no longer available in the current tool selection` };
+        }
+        if (def?.mcpBinding) {
+            if (!ctx?.agentName || !ctx.agentRoot)
+                throw new mcp_tools_1.McpCallRejectedError("MCP requires an explicit owner");
+            await def.mcpBinding.manager.validateToolBinding(def.mcpBinding, { agentName: ctx.agentName, agentRoot: ctx.agentRoot });
+        }
+        if (!def)
+            return { kind: "ready" };
+        const risk = riskProfileForTool(def, name, args);
+        const orientationPolicy = ctx?.orientationFrame?.actionPolicy;
+        if (orientationPolicy?.mode === "correction_hold" && orientationPolicyBlocks(risk, orientationPolicy.blockedMutationKinds)) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn", event: "tool.orientation_hold_block", component: "tools",
+                message: "orientation hold blocked high-risk tool execution",
+                meta: { name, mutates: mutationKindsFor(risk), reason: orientationPolicy.reason },
+            });
+            return { kind: "rejected_before_handler", text: orientationHoldMessage(name, risk, orientationPolicy.reason) };
+        }
+        const group = ctx?.context && "isGroupChat" in ctx.context ? ctx.context.isGroupChat : undefined;
+        const guardContext = {
+            readPaths: tools_base_1.editFileReadTracker, trustLevel: ctx?.context?.friend?.trustLevel,
+            agentRoot: ctx?.agentRoot ?? safeGetAgentRoot(), friendId: ctx?.context?.friend?.id,
+            friendKind: ctx?.context?.friend?.kind, channel: ctx?.context?.channel?.channel,
+            ...(def?.mcpServer ? { mcpServerName: def.mcpServer } : {}),
+            ...(typeof group === "boolean" ? { isGroupChat: group } : {}),
         };
+        const guard = (0, guardrails_1.guardInvocation)(name, args, guardContext);
+        if (!guard.allowed) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn", event: "tool.guardrail_block", component: "tools",
+                message: "guardrail blocked tool execution", meta: { name, reason: guard.reason },
+            });
+            return { kind: "rejected_before_handler", text: guard.reason };
+        }
+        return { kind: "ready", definition: def, agentRoot: guardContext.agentRoot, friendId: guardContext.friendId };
+    }
+    catch (error) {
+        const text = error instanceof Error ? error.message : String(error);
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn", event: "tool.selection_rejected", component: "tools",
+            message: "tool preflight failed before execution", meta: { name, reason: text.slice(0, 2000) },
+        });
+        return { kind: "rejected_before_handler", text: `rejected: ${text.slice(0, 2000)}`, error };
     }
-    return args;
 }
-async function execTool(name, args, ctx) {
+async function executeTool(name, args, ctx, executor) {
     (0, runtime_1.emitNervesEvent)({
-        event: "tool.start",
-        component: "tools",
-        message: "tool execution started",
+        event: "tool.start", component: "tools", message: "tool execution started",
         meta: { name, ...(name === "shell" && args.command ? { command: args.command } : {}) },
     });
-    // Look up from combined registry
-    const def = allDefinitions.find((d) => d.tool.function.name === name);
-    if (!def) {
-        (0, runtime_1.emitNervesEvent)({
-            level: "error",
-            event: "tool.error",
-            component: "tools",
-            message: "unknown tool requested",
-            meta: { name },
-        });
-        return `unknown: ${name}`;
-    }
-    // Guardrail check: structural + trust-level
-    const guardContext = {
-        readPaths: tools_base_1.editFileReadTracker,
-        trustLevel: ctx?.context?.friend?.trustLevel,
-        agentRoot: safeGetAgentRoot(),
-    };
-    const guardArgs = normalizeGuardArgs(name, args);
-    const guardResult = (0, guardrails_1.guardInvocation)(name, guardArgs, guardContext);
-    if (!guardResult.allowed) {
+    const prepared = await preflightToolCall(name, args, ctx);
+    if (prepared.kind !== "ready")
+        return prepared;
+    const def = prepared.definition;
+    if (!def)
+        return { kind: "rejected_before_handler", text: `rejected: ${name} is owned by the engine` };
+    const guardContext = prepared;
+    const guardArgs = args;
+    const commerceReservation = COMMERCE_AUTHORITY_TOOLS.has(name) && guardContext.agentRoot
+        ? (0, store_1.reserveCommerceAuthority)({
+            agentRoot: guardContext.agentRoot,
+            token: guardArgs.commerce_authority,
+            toolName: name,
+            args: guardArgs,
+            friendId: guardContext.friendId,
+        })
+        : null;
+    if (commerceReservation && !commerceReservation.ok) {
         (0, runtime_1.emitNervesEvent)({
             level: "warn",
             event: "tool.guardrail_block",
             component: "tools",
             message: "guardrail blocked tool execution",
-            meta: { name, reason: guardResult.reason },
+            meta: { name, reason: commerceReservation.reason },
         });
-        return guardResult.reason;
+        return { kind: "rejected_before_handler", text: `commerce authority required: ${commerceReservation.reason}` };
     }
+    const authorizedContext = ctx;
+    const toolContext = commerceReservation?.ok
+        ? {
+            ...authorizedContext,
+            agentRoot: guardContext.agentRoot,
+            commerceAuthority: {
+                checkoutId: commerceReservation.checkoutId,
+                reservationToken: commerceReservation.reservationToken,
+            },
+        }
+        : authorizedContext;
     try {
-        const result = await def.handler(args, ctx);
+        const result = await (executor ? executor(name, args, toolContext) : def.handler(args, toolContext));
         (0, runtime_1.emitNervesEvent)({
             event: "tool.end",
             component: "tools",
             message: "tool execution finished",
             meta: { name, success: true },
         });
-        return result;
+        return { kind: "handler_succeeded", text: result };
     }
     catch (error) {
         (0, runtime_1.emitNervesEvent)({
@@ -164,9 +521,39 @@ async function execTool(name, args, ctx) {
             message: error instanceof Error ? error.message : String(error),
             meta: { name },
         });
-        throw error;
+        const text = error instanceof Error ? error.message : String(error);
+        return {
+            kind: error instanceof mcp_tools_1.McpCallRejectedError ? "rejected_before_handler"
+                : error instanceof mcp_tools_1.McpToolExecutionError ? error.kind
+                    : error instanceof tool_approval_1.ApprovalExecutionFailedError ? "handler_failed"
+                        : riskProfileForTool(def, name, args).risk === "high" ? "handler_indeterminate" : "handler_failed",
+            text: text.slice(0, 2000), error,
+        };
+    }
+    finally {
+        if (commerceReservation?.ok && guardContext.agentRoot) {
+            try {
+                (0, store_1.releaseReservedCommerceAuthority)({
+                    agentRoot: guardContext.agentRoot,
+                    checkoutId: commerceReservation.checkoutId,
+                    reservationToken: commerceReservation.reservationToken,
+                    toolName: name,
+                    friendId: guardContext.friendId,
+                });
+            }
+            catch {
+                /* v8 ignore next -- external tool result/error should not be masked by best-effort reservation cleanup @preserve */
+            }
+        }
     }
 }
+async function execTool(name, args, ctx, executor) {
+    // Keep the legacy handler type without coercing schema-validated JSON values.
+    const result = await executeTool(name, args, ctx, executor);
+    if ("error" in result && !(result.error instanceof mcp_tools_1.McpToolExecutionError))
+        throw result.error;
+    return result.text;
+}
 function summarizeKeyValues(args, keys, maxValueLength = 60) {
     const parts = [];
     for (const key of keys) {
@@ -187,66 +574,46 @@ function summarizeUnknownArgs(args) {
         return "";
     return summarizeKeyValues(args, keys);
 }
-function summarizeArgs(name, args) {
-    // Check teams tools first
-    const teamsSummary = (0, tools_teams_1.summarizeTeamsArgs)(name, args);
-    if (teamsSummary !== undefined)
-        return teamsSummary;
-    // Check github tools
-    const githubSummary = (0, tools_github_1.summarizeGithubArgs)(name, args);
-    if (githubSummary !== undefined)
-        return githubSummary;
-    // Base tools
-    if (name === "read_file" || name === "write_file")
-        return summarizeKeyValues(args, ["path"]);
-    if (name === "edit_file")
-        return summarizeKeyValues(args, ["path"]);
-    if (name === "glob")
-        return summarizeKeyValues(args, ["pattern", "cwd"]);
-    if (name === "grep")
-        return summarizeKeyValues(args, ["pattern", "path", "include"]);
-    if (name === "shell")
-        return summarizeKeyValues(args, ["command"]);
-    if (name === "load_skill")
-        return summarizeKeyValues(args, ["name"]);
-    if (name === "coding_spawn")
-        return summarizeKeyValues(args, ["runner", "workdir", "taskRef"]);
-    if (name === "coding_status")
-        return summarizeKeyValues(args, ["sessionId"]);
-    if (name === "coding_tail")
-        return summarizeKeyValues(args, ["sessionId"]);
-    if (name === "coding_send_input")
-        return summarizeKeyValues(args, ["sessionId", "input"]);
-    if (name === "coding_kill")
-        return summarizeKeyValues(args, ["sessionId"]);
-    if (name === "bluebubbles_set_reply_target")
-        return summarizeKeyValues(args, ["target", "threadOriginatorGuid"]);
-    if (name === "set_reasoning_effort")
-        return summarizeKeyValues(args, ["level"]);
-    if (name === "claude")
-        return summarizeKeyValues(args, ["prompt"]);
-    if (name === "web_search")
-        return summarizeKeyValues(args, ["query"]);
-    if (name === "memory_search")
-        return summarizeKeyValues(args, ["query"]);
-    if (name === "memory_save")
-        return summarizeKeyValues(args, ["text", "about"]);
-    if (name === "get_friend_note")
-        return summarizeKeyValues(args, ["friendId"]);
-    if (name === "save_friend_note") {
-        return summarizeKeyValues(args, ["type", "key", "content"]);
-    }
-    if (name === "bridge_manage")
-        return summarizeKeyValues(args, ["action", "bridgeId", "objective", "friendId", "channel", "key"]);
-    if (name === "ado_backlog_list")
-        return summarizeKeyValues(args, ["organization", "project"]);
-    if (name === "ado_batch_update")
-        return summarizeKeyValues(args, ["organization", "project"]);
-    if (name === "ado_create_epic" || name === "ado_create_issue")
-        return summarizeKeyValues(args, ["organization", "project", "title"]);
-    if (name === "ado_move_items")
-        return summarizeKeyValues(args, ["organization", "project", "workItemIds"]);
-    if (name === "ado_restructure_backlog")
-        return summarizeKeyValues(args, ["organization", "project"]);
+function summarizeArgs(name, args, selection) {
+    const def = findDefinition(name, selection);
+    if (def && def.summaryKeys !== undefined) {
+        return summarizeKeyValues(args, def.summaryKeys);
+    }
     return summarizeUnknownArgs(args);
 }
+/**
+ * Build an enriched tool result summary for display on remote channels.
+ * For recognized tools, includes result-derived info (diff stats, exit codes, etc.).
+ * Falls back to arg-based summary for unrecognized tools.
+ */
+function buildToolResultSummary(name, args, _result, success, selection) {
+    switch (name) {
+        case "edit_file": {
+            if (!success)
+                return summarizeArgs(name, args, selection);
+            const addedLines = (args.new_string ?? "").split("\n").length;
+            const removedLines = (args.old_string ?? "").split("\n").length;
+            return `+${addedLines} -${removedLines} lines in ${args.path ?? "unknown"}`;
+        }
+        case "shell": {
+            const cmd = args.command ?? "?";
+            const exitCode = success ? 0 : 1;
+            return `$ ${cmd} (exit ${exitCode})`;
+        }
+        case "read_file":
+            return `path=${args.path ?? "unknown"}`;
+        case "write_file":
+            return `path=${args.path ?? "unknown"}`;
+        case "glob":
+            return `pattern=${args.pattern ?? "?"} ${args.cwd ? `cwd=${args.cwd}` : ""}`.trim();
+        case "grep":
+            return `pattern=${args.pattern ?? "?"} ${args.path ? `path=${args.path}` : ""}`.trim();
+        case "coding_spawn": {
+            const taskRef = args.taskRef ?? "unknown";
+            const status = success ? "spawned" : "failed";
+            return `${taskRef} -> ${status}`;
+        }
+        default:
+            return summarizeArgs(name, args, selection);
+    }
+}