@pixelzx/genesis 2026.6.27 → 2026.6.28

package/dist/bash-tools-BCSXSkhx.js

@@ -0,0 +1,2853 @@
+import { i as formatErrorMessage } from "./errors-CufR9eHH.js";
+import { a as normalizeLowercaseStringOrEmpty, c as normalizeOptionalString, s as normalizeOptionalLowercaseString } from "./string-coerce-DPP_aYVc.js";
+import { c as escapeRegExp } from "./utils-CWrkFsp0.js";
+import { s as sanitizeHostExecEnvWithDiagnostics } from "./host-env-security-PtrzxCxY.js";
+import { a as logWarn, r as logInfo } from "./logger-BbnBrdB_.js";
+import { K as getShellPathFromLoginShell, q as resolveShellEnvFallbackTimeoutMs } from "./io-Cy5vajWd.js";
+import { i as isCronSessionKey, o as isSubagentSessionKey, s as parseAgentSessionKey } from "./session-key-utils-DDwuwYKT.js";
+import { u as resolveAgentIdFromSessionKey } from "./session-key-CI3KvTQC.js";
+import { d as resolveApprovalAuditCandidatePath } from "./exec-safe-bin-trust-DMrCONj2.js";
+import { t as killProcessTree } from "./kill-tree-BbGiB2xY.js";
+import { c as isGatewayMessageChannel, u as normalizeMessageChannel } from "./message-channel-8hna3ogc.js";
+import { i as normalizeDeliveryContext } from "./delivery-context.shared-DnaA0DbE.js";
+import { b as EXEC_TOOL_DISPLAY_SUMMARY, x as PROCESS_TOOL_DISPLAY_SUMMARY } from "./tool-policy-BIGITEMh.js";
+import { C as formatExecDeniedUserMessage, T as parseExecApprovalResultText, u as sanitizeUserFacingText, w as isExecDeniedResultText } from "./sanitize-user-facing-text-DKqUCgHB.js";
+import { o as failedTextResult, v as textResult } from "./common-C4_5xEM_.js";
+import { t as callGatewayTool } from "./gateway-ClYGJe6R.js";
+import { t as splitShellArgs } from "./shell-argv-BaDMAO0_.js";
+import { c as describeInterpreterInlineEval, f as analyzeShellCommand, l as detectInterpreterInlineEvalArgv, n as evaluateShellAllowlist, p as buildEnforcedShellCommand } from "./exec-approvals-allowlist-BBW7JMg0.js";
+import { r as resolveExecSafeBinRuntimePolicy } from "./exec-safe-bin-runtime-policy-DUcKpnC_.js";
+import { C as requiresExecApproval, D as resolveExecApprovalsFromFile, E as resolveExecApprovals, _ as normalizeExecTarget, a as addDurableCommandApproval, b as recordAllowlistMatchesUse, f as minSecurity, g as normalizeExecSecurity, l as loadExecApprovals, m as normalizeExecAsk, s as hasDurableExecApproval, u as maxAsk, v as persistAllowAlwaysPatterns, w as resolveExecApprovalAllowedDecisions } from "./exec-approvals-D0DTIzDT.js";
+import { n as describeProcessTool, t as describeExecTool } from "./bash-tools.descriptions-DzPYV0Li.js";
+import { n as processSchema, t as execSchema } from "./bash-tools.schemas-B8_wOdjn.js";
+import "./delivery-context-Pj68kbuc.js";
+import { n as getDiagnosticSessionState } from "./diagnostic-session-state-BzRMvtlj.js";
+import { i as resolveNodeIdFromList, t as listNodes } from "./nodes-utils-qg-Bmmy5.js";
+import { t as sendMessage } from "./message-Bk0q8DmN.js";
+import { t as resolveExternalBestEffortDeliveryTarget } from "./best-effort-delivery-CPpGc0xQ.js";
+import { t as formatDurationCompact } from "./format-duration-D7ua_Cv_.js";
+import { a as coerceEnv, c as readEnvInt, d as sliceLogLines, f as truncateMiddle, i as clampWithDefault, l as resolveSandboxWorkdir, n as buildSandboxEnv, o as deriveSessionName, s as pad, u as resolveWorkdir } from "./bash-tools.shared-tggOw0Pu.js";
+import { f as resolveExecApprovalInitiatingSurfaceState, s as buildExecApprovalUnavailableReplyPayload } from "./exec-approval-reply-BhbjoK1B.js";
+import { i as normalizePathPrepend, t as applyPathPrepend } from "./path-prepend-DR8e0z7b.js";
+import { t as getProcessSupervisor } from "./supervisor-DaRbw4Gw.js";
+import { C as setJobTtlMs, S as markExited, _ as getFinishedSession, a as DEFAULT_PENDING_MAX_OUTPUT, b as listRunningSessions, c as createApprovalSlug, f as resolveApprovalRunningNoticeMs, g as drainSession, h as deleteSession, i as DEFAULT_PATH, m as runExecProcess, n as DEFAULT_APPROVAL_TIMEOUT_MS, o as applyShellPath, p as resolveExecTarget, r as DEFAULT_MAX_OUTPUT, s as buildApprovalPendingMessage, t as DEFAULT_APPROVAL_REQUEST_TIMEOUT_MS, u as normalizeNotifyOutput, v as getSession, w as tail, x as markBackgrounded, y as listFinishedSessions } from "./bash-tools.exec-runtime-CVOp5fHn.js";
+import { a as parseModelRiskVerdict, i as mergeSafeguardVerdicts, n as evaluateExecSafeguard, r as isAmbiguousForModel } from "./exec-safeguard-DMM6KaOP.js";
+import { t as parsePreparedSystemRunPayload } from "./system-run-approval-context-CmtECXC_.js";
+import { n as recordCommandPoll, r as resetCommandPollCount } from "./command-poll-backoff-BzCxMvUa.js";
+import path from "node:path";
+import crypto from "node:crypto";
+//#region src/agents/bash-tools.exec-approval-request.ts
+function buildExecApprovalRequestToolParams(params) {
+	return {
+		id: params.id,
+		...params.command ? { command: params.command } : {},
+		...params.commandArgv ? { commandArgv: params.commandArgv } : {},
+		systemRunPlan: params.systemRunPlan,
+		env: params.env,
+		cwd: params.cwd,
+		nodeId: params.nodeId,
+		host: params.host,
+		security: params.security,
+		ask: params.ask,
+		agentId: params.agentId,
+		resolvedPath: params.resolvedPath,
+		sessionKey: params.sessionKey,
+		turnSourceChannel: params.turnSourceChannel,
+		turnSourceTo: params.turnSourceTo,
+		turnSourceAccountId: params.turnSourceAccountId,
+		turnSourceThreadId: params.turnSourceThreadId,
+		timeoutMs: DEFAULT_APPROVAL_TIMEOUT_MS,
+		twoPhase: true
+	};
+}
+function parseDecision(value) {
+	if (!value || typeof value !== "object") return {
+		present: false,
+		value: null
+	};
+	if (!Object.hasOwn(value, "decision")) return {
+		present: false,
+		value: null
+	};
+	const decision = value.decision;
+	return {
+		present: true,
+		value: typeof decision === "string" ? decision : null
+	};
+}
+function parseString(value) {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function parseExpiresAtMs(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+async function registerExecApprovalRequest(params) {
+	const registrationResult = await callGatewayTool("exec.approval.request", { timeoutMs: DEFAULT_APPROVAL_REQUEST_TIMEOUT_MS }, buildExecApprovalRequestToolParams(params), { expectFinal: false });
+	const decision = parseDecision(registrationResult);
+	const id = parseString(registrationResult?.id) ?? params.id;
+	const expiresAtMs = parseExpiresAtMs(registrationResult?.expiresAtMs) ?? Date.now() + DEFAULT_APPROVAL_TIMEOUT_MS;
+	if (decision.present) return {
+		id,
+		expiresAtMs,
+		finalDecision: decision.value
+	};
+	return {
+		id,
+		expiresAtMs
+	};
+}
+async function waitForExecApprovalDecision(id) {
+	try {
+		return parseDecision(await callGatewayTool("exec.approval.waitDecision", { timeoutMs: DEFAULT_APPROVAL_REQUEST_TIMEOUT_MS }, { id })).value;
+	} catch (err) {
+		if (normalizeLowercaseStringOrEmpty(String(err)).includes("approval expired or not found")) return null;
+		throw err;
+	}
+}
+async function resolveRegisteredExecApprovalDecision(params) {
+	if (params.preResolvedDecision !== void 0) return params.preResolvedDecision ?? null;
+	return await waitForExecApprovalDecision(params.approvalId);
+}
+function buildExecApprovalRequesterContext(params) {
+	return {
+		agentId: params.agentId,
+		sessionKey: params.sessionKey
+	};
+}
+function buildExecApprovalTurnSourceContext(params) {
+	return {
+		turnSourceChannel: params.turnSourceChannel,
+		turnSourceTo: params.turnSourceTo,
+		turnSourceAccountId: params.turnSourceAccountId,
+		turnSourceThreadId: params.turnSourceThreadId
+	};
+}
+function buildHostApprovalDecisionParams(params) {
+	return {
+		id: params.approvalId,
+		command: params.command,
+		commandArgv: params.commandArgv,
+		systemRunPlan: params.systemRunPlan,
+		env: params.env,
+		cwd: params.workdir,
+		nodeId: params.nodeId,
+		host: params.host,
+		security: params.security,
+		ask: params.ask,
+		...buildExecApprovalRequesterContext({
+			agentId: params.agentId,
+			sessionKey: params.sessionKey
+		}),
+		resolvedPath: params.resolvedPath,
+		...buildExecApprovalTurnSourceContext(params)
+	};
+}
+async function registerExecApprovalRequestForHost(params) {
+	return await registerExecApprovalRequest(buildHostApprovalDecisionParams(params));
+}
+async function registerExecApprovalRequestForHostOrThrow(params) {
+	try {
+		return await registerExecApprovalRequestForHost(params);
+	} catch (err) {
+		throw new Error(`Exec approval registration failed: ${String(err)}`, { cause: err });
+	}
+}
+//#endregion
+//#region src/agents/bash-tools.exec-approval-followup.ts
+function buildExecDeniedFollowupPrompt(resultText) {
+	return [
+		"An async command did not run.",
+		"Do not run the command again.",
+		"There is no new command output.",
+		"Do not mention, summarize, or reuse output from any earlier run in this session.",
+		"",
+		"Exact completion details:",
+		resultText.trim(),
+		"",
+		"Reply to the user in a helpful way.",
+		"Explain that the command did not run and why.",
+		"Do not claim there is new command output."
+	].join("\n");
+}
+function formatUnknownError(error) {
+	if (error instanceof Error) return error.message;
+	if (typeof error === "string") return error;
+	try {
+		return JSON.stringify(error);
+	} catch {
+		return "unknown error";
+	}
+}
+function buildExecApprovalFollowupPrompt(resultText) {
+	const trimmed = resultText.trim();
+	if (isExecDeniedResultText(trimmed)) return buildExecDeniedFollowupPrompt(trimmed);
+	return [
+		"An async command the user already approved has completed.",
+		"Do not run the command again.",
+		"If the task requires more steps, continue from this result before replying to the user.",
+		"Only ask the user for help if you are actually blocked.",
+		"",
+		"Exact completion details:",
+		trimmed,
+		"",
+		"Continue the task if needed, then reply to the user in a helpful way.",
+		"If it succeeded, share the relevant output.",
+		"If it failed, explain what went wrong."
+	].join("\n");
+}
+function shouldSuppressExecDeniedFollowup(sessionKey) {
+	return isSubagentSessionKey(sessionKey) || isCronSessionKey(sessionKey);
+}
+function formatDirectExecApprovalFollowupText(resultText, opts = {}) {
+	const parsed = parseExecApprovalResultText(resultText);
+	if (parsed.kind === "other" && !parsed.raw) return null;
+	if (parsed.kind === "denied") return opts.allowDenied ? formatExecDeniedUserMessage(parsed.raw) : null;
+	if (parsed.kind === "finished") {
+		const metadata = normalizeLowercaseStringOrEmpty(parsed.metadata);
+		const body = sanitizeUserFacingText(parsed.body, { errorContext: !metadata.includes("code 0") }).trim();
+		let prefix = "";
+		if (!body) prefix = metadata.includes("code 0") ? "Background command finished." : metadata.includes("signal") ? "Background command stopped unexpectedly." : "Background command finished with an error.";
+		return body ? `${prefix ? `${prefix}\n\n` : ""}${body}` : prefix || null;
+	}
+	if (parsed.kind === "completed") return sanitizeUserFacingText(parsed.body, { errorContext: true }).trim() || "Background command finished.";
+	return sanitizeUserFacingText(parsed.raw, { errorContext: true }).trim() || null;
+}
+function buildSessionResumeFallbackPrefix() {
+	return "Automatic session resume failed, so sending the status directly.\n\n";
+}
+function canDirectSendDeniedFollowup(sessionError) {
+	return sessionError !== null;
+}
+function buildAgentFollowupArgs(params) {
+	const { deliveryTarget, sessionOnlyOriginChannel } = params;
+	return {
+		sessionKey: params.sessionKey,
+		message: buildExecApprovalFollowupPrompt(params.resultText),
+		deliver: deliveryTarget.deliver,
+		...deliveryTarget.deliver ? { bestEffortDeliver: true } : {},
+		channel: deliveryTarget.deliver ? deliveryTarget.channel : sessionOnlyOriginChannel,
+		to: deliveryTarget.deliver ? deliveryTarget.to : sessionOnlyOriginChannel ? params.turnSourceTo : void 0,
+		accountId: deliveryTarget.deliver ? deliveryTarget.accountId : sessionOnlyOriginChannel ? params.turnSourceAccountId : void 0,
+		threadId: deliveryTarget.deliver ? deliveryTarget.threadId : sessionOnlyOriginChannel ? params.turnSourceThreadId : void 0,
+		idempotencyKey: `exec-approval-followup:${params.approvalId}`
+	};
+}
+async function sendDirectFollowupFallback(params) {
+	const directText = formatDirectExecApprovalFollowupText(params.resultText, { allowDenied: canDirectSendDeniedFollowup(params.sessionError) });
+	if (!params.deliveryTarget.deliver || !directText) return false;
+	const prefix = params.sessionError ? buildSessionResumeFallbackPrefix() : "";
+	await sendMessage({
+		channel: params.deliveryTarget.channel,
+		to: params.deliveryTarget.to ?? "",
+		accountId: params.deliveryTarget.accountId,
+		threadId: params.deliveryTarget.threadId,
+		content: `${prefix}${directText}`,
+		agentId: void 0,
+		idempotencyKey: `exec-approval-followup:${params.approvalId}`
+	});
+	return true;
+}
+async function sendExecApprovalFollowup(params) {
+	const sessionKey = params.sessionKey?.trim();
+	const resultText = params.resultText.trim();
+	if (!resultText) return false;
+	const isDenied = isExecDeniedResultText(resultText);
+	if (isDenied && shouldSuppressExecDeniedFollowup(sessionKey)) return false;
+	const deliveryTarget = resolveExternalBestEffortDeliveryTarget({
+		channel: params.turnSourceChannel,
+		to: params.turnSourceTo,
+		accountId: params.turnSourceAccountId,
+		threadId: params.turnSourceThreadId
+	});
+	const normalizedTurnSourceChannel = normalizeMessageChannel(params.turnSourceChannel);
+	const sessionOnlyOriginChannel = normalizedTurnSourceChannel && isGatewayMessageChannel(normalizedTurnSourceChannel) ? normalizedTurnSourceChannel : void 0;
+	let sessionError = null;
+	if (sessionKey) try {
+		await callGatewayTool("agent", { timeoutMs: 6e4 }, buildAgentFollowupArgs({
+			approvalId: params.approvalId,
+			sessionKey,
+			resultText,
+			deliveryTarget,
+			sessionOnlyOriginChannel,
+			turnSourceTo: params.turnSourceTo,
+			turnSourceAccountId: params.turnSourceAccountId,
+			turnSourceThreadId: params.turnSourceThreadId
+		}), { expectFinal: true });
+		return true;
+	} catch (err) {
+		sessionError = err;
+	}
+	if (await sendDirectFollowupFallback({
+		approvalId: params.approvalId,
+		deliveryTarget,
+		resultText,
+		sessionError
+	})) return true;
+	if (sessionError) throw new Error(`Session followup failed: ${formatUnknownError(sessionError)}`);
+	if (isDenied) return false;
+	throw new Error("Session key or deliverable origin route is required");
+}
+const loggedExecApprovalFollowupFailures = /* @__PURE__ */ new Set();
+function rememberExecApprovalFollowupFailureKey(key) {
+	if (loggedExecApprovalFollowupFailures.has(key)) return false;
+	loggedExecApprovalFollowupFailures.add(key);
+	if (loggedExecApprovalFollowupFailures.size > 256) {
+		const oldestKey = loggedExecApprovalFollowupFailures.values().next().value;
+		if (typeof oldestKey === "string") loggedExecApprovalFollowupFailures.delete(oldestKey);
+	}
+	return true;
+}
+function isHeadlessExecTrigger(trigger) {
+	return trigger === "cron";
+}
+function createExecApprovalPendingState(params) {
+	return {
+		warningText: params.warnings.length ? `${params.warnings.join("\n")}\n\n` : "",
+		expiresAtMs: Date.now() + params.timeoutMs,
+		preResolvedDecision: void 0
+	};
+}
+function createExecApprovalRequestState(params) {
+	return {
+		...createExecApprovalPendingState({
+			warnings: params.warnings,
+			timeoutMs: params.timeoutMs
+		}),
+		noticeSeconds: Math.max(1, Math.round(params.approvalRunningNoticeMs / 1e3))
+	};
+}
+function createExecApprovalRequestContext(params) {
+	const approvalId = crypto.randomUUID();
+	return {
+		...createExecApprovalRequestState({
+			warnings: params.warnings,
+			timeoutMs: params.timeoutMs,
+			approvalRunningNoticeMs: params.approvalRunningNoticeMs
+		}),
+		approvalId,
+		approvalSlug: params.createApprovalSlug(approvalId),
+		contextKey: `exec:${approvalId}`
+	};
+}
+function createDefaultExecApprovalRequestContext(params) {
+	return createExecApprovalRequestContext({
+		warnings: params.warnings,
+		timeoutMs: DEFAULT_APPROVAL_TIMEOUT_MS,
+		approvalRunningNoticeMs: params.approvalRunningNoticeMs,
+		createApprovalSlug: params.createApprovalSlug
+	});
+}
+function resolveBaseExecApprovalDecision(params) {
+	if (params.decision === "deny") return {
+		approvedByAsk: false,
+		deniedReason: "user-denied",
+		timedOut: false
+	};
+	if (!params.decision) {
+		if (params.askFallback === "full") return {
+			approvedByAsk: true,
+			deniedReason: null,
+			timedOut: true
+		};
+		if (params.askFallback === "deny") return {
+			approvedByAsk: false,
+			deniedReason: "approval-timeout",
+			timedOut: true
+		};
+		return {
+			approvedByAsk: false,
+			deniedReason: null,
+			timedOut: true
+		};
+	}
+	return {
+		approvedByAsk: false,
+		deniedReason: null,
+		timedOut: false
+	};
+}
+function resolveExecHostApprovalContext(params) {
+	const approvals = resolveExecApprovals(params.agentId, {
+		security: params.security,
+		ask: params.ask
+	});
+	const hostSecurity = minSecurity(params.security, approvals.agent.security);
+	const hostAsk = maxAsk(params.ask, approvals.agent.ask);
+	const askFallback = minSecurity(hostSecurity, approvals.agent.askFallback);
+	if (hostSecurity === "deny") throw new Error(`exec denied: host=${params.host} security=deny`);
+	return {
+		approvals,
+		hostSecurity,
+		hostAsk,
+		askFallback
+	};
+}
+async function resolveApprovalDecisionOrUndefined(params) {
+	try {
+		return await resolveRegisteredExecApprovalDecision({
+			approvalId: params.approvalId,
+			preResolvedDecision: params.preResolvedDecision
+		});
+	} catch {
+		params.onFailure();
+		return;
+	}
+}
+function resolveExecApprovalUnavailableState(params) {
+	const initiatingSurface = resolveExecApprovalInitiatingSurfaceState({
+		channel: params.turnSourceChannel,
+		accountId: params.turnSourceAccountId
+	});
+	return {
+		initiatingSurface,
+		sentApproverDms: false,
+		unavailableReason: params.preResolvedDecision === null ? "no-approval-route" : initiatingSurface.kind === "disabled" ? "initiating-platform-disabled" : initiatingSurface.kind === "unsupported" ? "initiating-platform-unsupported" : null
+	};
+}
+async function createAndRegisterDefaultExecApprovalRequest(params) {
+	const { approvalId, approvalSlug, warningText, expiresAtMs: defaultExpiresAtMs, preResolvedDecision: defaultPreResolvedDecision } = createDefaultExecApprovalRequestContext({
+		warnings: params.warnings,
+		approvalRunningNoticeMs: params.approvalRunningNoticeMs,
+		createApprovalSlug: params.createApprovalSlug
+	});
+	const registration = await params.register(approvalId);
+	const preResolvedDecision = registration.finalDecision;
+	const { initiatingSurface, sentApproverDms, unavailableReason } = resolveExecApprovalUnavailableState({
+		turnSourceChannel: params.turnSourceChannel,
+		turnSourceAccountId: params.turnSourceAccountId,
+		preResolvedDecision
+	});
+	return {
+		approvalId,
+		approvalSlug,
+		warningText,
+		expiresAtMs: registration.expiresAtMs ?? defaultExpiresAtMs,
+		preResolvedDecision: registration.finalDecision === void 0 ? defaultPreResolvedDecision : registration.finalDecision,
+		initiatingSurface,
+		sentApproverDms,
+		unavailableReason
+	};
+}
+function buildDefaultExecApprovalRequestArgs(params) {
+	return {
+		warnings: params.warnings,
+		approvalRunningNoticeMs: params.approvalRunningNoticeMs,
+		createApprovalSlug: params.createApprovalSlug,
+		turnSourceChannel: params.turnSourceChannel,
+		turnSourceAccountId: params.turnSourceAccountId
+	};
+}
+function buildExecApprovalFollowupTarget(params) {
+	return {
+		approvalId: params.approvalId,
+		sessionKey: params.sessionKey,
+		turnSourceChannel: params.turnSourceChannel,
+		turnSourceTo: params.turnSourceTo,
+		turnSourceAccountId: params.turnSourceAccountId,
+		turnSourceThreadId: params.turnSourceThreadId
+	};
+}
+function createExecApprovalDecisionState(params) {
+	const baseDecision = resolveBaseExecApprovalDecision({
+		decision: params.decision ?? null,
+		askFallback: params.askFallback
+	});
+	return {
+		baseDecision,
+		approvedByAsk: baseDecision.approvedByAsk,
+		deniedReason: baseDecision.deniedReason
+	};
+}
+function enforceStrictInlineEvalApprovalBoundary(params) {
+	if (!params.baseDecision.timedOut || !params.requiresInlineEvalApproval || !params.approvedByAsk) return {
+		approvedByAsk: params.approvedByAsk,
+		deniedReason: params.deniedReason
+	};
+	return {
+		approvedByAsk: false,
+		deniedReason: params.deniedReason ?? "approval-timeout"
+	};
+}
+function shouldResolveExecApprovalUnavailableInline(params) {
+	return isHeadlessExecTrigger(params.trigger) && params.unavailableReason === "no-approval-route" && params.preResolvedDecision === null;
+}
+function buildHeadlessExecApprovalDeniedMessage(params) {
+	return [
+		`exec denied: ${params.trigger === "cron" ? "Cron runs" : "Headless runs"} cannot wait for interactive exec approval.`,
+		`Effective host exec policy: security=${params.security} ask=${params.ask} askFallback=${params.askFallback}`,
+		"Stricter values from tools.exec and ~/.genesis/exec-approvals.json both apply.",
+		"Fix one of these:",
+		"- align both files to security=\"full\" and ask=\"off\" for trusted local automation",
+		"- keep allowlist mode and add an explicit allowlist entry for this command",
+		"- enable Web UI, terminal UI, or chat exec approvals and rerun interactively",
+		"Tip: run \"genesis doctor\" and \"genesis approvals get --gateway\" to inspect the effective policy."
+	].join("\n");
+}
+async function sendExecApprovalFollowupResult(target, resultText, deps = {}) {
+	const send = deps.sendExecApprovalFollowup ?? sendExecApprovalFollowup;
+	const warn = deps.logWarn ?? logWarn;
+	await send({
+		approvalId: target.approvalId,
+		sessionKey: target.sessionKey,
+		turnSourceChannel: target.turnSourceChannel,
+		turnSourceTo: target.turnSourceTo,
+		turnSourceAccountId: target.turnSourceAccountId,
+		turnSourceThreadId: target.turnSourceThreadId,
+		resultText
+	}).catch((error) => {
+		const message = formatErrorMessage(error);
+		if (!rememberExecApprovalFollowupFailureKey(`${target.approvalId}:${message}`)) return;
+		warn(`exec approval followup dispatch failed (id=${target.approvalId}): ${message}`);
+	});
+}
+function buildExecApprovalPendingToolResult(params) {
+	const allowedDecisions = params.allowedDecisions ?? resolveExecApprovalAllowedDecisions();
+	return {
+		content: [{
+			type: "text",
+			text: params.unavailableReason !== null ? buildExecApprovalUnavailableReplyPayload({
+				warningText: params.warningText,
+				reason: params.unavailableReason,
+				channel: params.initiatingSurface.channel,
+				channelLabel: params.initiatingSurface.channelLabel,
+				accountId: params.initiatingSurface.accountId,
+				sentApproverDms: params.sentApproverDms
+			}).text ?? "" : buildApprovalPendingMessage({
+				warningText: params.warningText,
+				approvalSlug: params.approvalSlug,
+				approvalId: params.approvalId,
+				allowedDecisions,
+				command: params.command,
+				cwd: params.cwd,
+				host: params.host,
+				nodeId: params.nodeId
+			})
+		}],
+		details: params.unavailableReason !== null ? {
+			status: "approval-unavailable",
+			reason: params.unavailableReason,
+			channel: params.initiatingSurface.channel,
+			channelLabel: params.initiatingSurface.channelLabel,
+			accountId: params.initiatingSurface.accountId,
+			sentApproverDms: params.sentApproverDms,
+			host: params.host,
+			command: params.command,
+			cwd: params.cwd,
+			nodeId: params.nodeId,
+			warningText: params.warningText
+		} : {
+			status: "approval-pending",
+			approvalId: params.approvalId,
+			approvalSlug: params.approvalSlug,
+			expiresAtMs: params.expiresAtMs,
+			allowedDecisions,
+			host: params.host,
+			command: params.command,
+			cwd: params.cwd,
+			nodeId: params.nodeId,
+			warningText: params.warningText
+		}
+	};
+}
+//#endregion
+//#region src/agents/bash-tools.exec-host-gateway.ts
+function hasGatewayAllowlistMiss(params) {
+	return params.hostSecurity === "allowlist" && (!params.analysisOk || !params.allowlistSatisfied) && !params.durableApprovalSatisfied;
+}
+async function processGatewayAllowlist(params) {
+	const { approvals, hostSecurity, hostAsk, askFallback } = resolveExecHostApprovalContext({
+		agentId: params.agentId,
+		security: params.security,
+		ask: params.ask,
+		host: "gateway"
+	});
+	const allowlistEval = evaluateShellAllowlist({
+		command: params.command,
+		allowlist: approvals.allowlist,
+		safeBins: params.safeBins,
+		safeBinProfiles: params.safeBinProfiles,
+		cwd: params.workdir,
+		env: params.env,
+		platform: process.platform,
+		trustedSafeBinDirs: params.trustedSafeBinDirs
+	});
+	const allowlistMatches = allowlistEval.allowlistMatches;
+	const analysisOk = allowlistEval.analysisOk;
+	const allowlistSatisfied = hostSecurity === "allowlist" && analysisOk ? allowlistEval.allowlistSatisfied : false;
+	const durableApprovalSatisfied = hasDurableExecApproval({
+		analysisOk,
+		segmentAllowlistEntries: allowlistEval.segmentAllowlistEntries,
+		allowlist: approvals.allowlist,
+		commandText: params.command
+	});
+	const inlineEvalHit = params.strictInlineEval === true ? allowlistEval.segments.map((segment) => detectInterpreterInlineEvalArgv(segment.resolution?.effectiveArgv ?? segment.argv)).find((entry) => entry !== null) ?? null : null;
+	if (inlineEvalHit) params.warnings.push(`Warning: strict inline-eval mode requires explicit approval for ${describeInterpreterInlineEval(inlineEvalHit)}.`);
+	let enforcedCommand;
+	let allowlistPlanUnavailableReason = null;
+	if (hostSecurity === "allowlist" && analysisOk && allowlistSatisfied) {
+		const enforced = buildEnforcedShellCommand({
+			command: params.command,
+			segments: allowlistEval.segments,
+			platform: process.platform
+		});
+		if (!enforced.ok || !enforced.command) allowlistPlanUnavailableReason = enforced.reason ?? "unsupported platform";
+		else enforcedCommand = enforced.command;
+	}
+	const recordMatchedAllowlistUse = (resolvedPath) => recordAllowlistMatchesUse({
+		approvals: approvals.file,
+		agentId: params.agentId,
+		matches: allowlistMatches,
+		command: params.command,
+		resolvedPath
+	});
+	const hasHeredocSegment = allowlistEval.segments.some((segment) => segment.argv.some((token) => token.startsWith("<<")));
+	const requiresHeredocApproval = hostSecurity === "allowlist" && analysisOk && allowlistSatisfied && hasHeredocSegment;
+	const requiresInlineEvalApproval = inlineEvalHit !== null;
+	const requiresAllowlistPlanApproval = hostSecurity === "allowlist" && analysisOk && allowlistSatisfied && !enforcedCommand && allowlistPlanUnavailableReason !== null;
+	const requiresAsk = requiresExecApproval({
+		ask: hostAsk,
+		security: hostSecurity,
+		analysisOk,
+		allowlistSatisfied,
+		durableApprovalSatisfied
+	}) || requiresAllowlistPlanApproval || requiresHeredocApproval || requiresInlineEvalApproval;
+	if (requiresHeredocApproval) params.warnings.push("Warning: heredoc execution requires explicit approval in allowlist mode.");
+	if (requiresAllowlistPlanApproval) params.warnings.push(`Warning: allowlist auto-execution is unavailable on ${process.platform}; explicit approval is required.`);
+	if (requiresAsk) {
+		const requestArgs = buildDefaultExecApprovalRequestArgs({
+			warnings: params.warnings,
+			approvalRunningNoticeMs: params.approvalRunningNoticeMs,
+			createApprovalSlug,
+			turnSourceChannel: params.turnSourceChannel,
+			turnSourceAccountId: params.turnSourceAccountId
+		});
+		const registerGatewayApproval = async (approvalId) => await registerExecApprovalRequestForHostOrThrow({
+			approvalId,
+			command: params.command,
+			env: params.requestedEnv,
+			workdir: params.workdir,
+			host: "gateway",
+			security: hostSecurity,
+			ask: hostAsk,
+			...buildExecApprovalRequesterContext({
+				agentId: params.agentId,
+				sessionKey: params.sessionKey
+			}),
+			resolvedPath: resolveApprovalAuditCandidatePath(allowlistEval.segments[0]?.resolution ?? null, params.workdir),
+			...buildExecApprovalTurnSourceContext(params)
+		});
+		const { approvalId, approvalSlug, warningText, expiresAtMs, preResolvedDecision, initiatingSurface, sentApproverDms, unavailableReason } = await createAndRegisterDefaultExecApprovalRequest({
+			...requestArgs,
+			register: registerGatewayApproval
+		});
+		if (shouldResolveExecApprovalUnavailableInline({
+			trigger: params.trigger,
+			unavailableReason,
+			preResolvedDecision
+		})) {
+			const { baseDecision, approvedByAsk, deniedReason } = createExecApprovalDecisionState({
+				decision: preResolvedDecision,
+				askFallback
+			});
+			const strictInlineEvalDecision = enforceStrictInlineEvalApprovalBoundary({
+				baseDecision,
+				approvedByAsk,
+				deniedReason,
+				requiresInlineEvalApproval
+			});
+			if (strictInlineEvalDecision.deniedReason || !strictInlineEvalDecision.approvedByAsk) throw new Error(buildHeadlessExecApprovalDeniedMessage({
+				trigger: params.trigger,
+				host: "gateway",
+				security: hostSecurity,
+				ask: hostAsk,
+				askFallback
+			}));
+			recordMatchedAllowlistUse(resolveApprovalAuditCandidatePath(allowlistEval.segments[0]?.resolution ?? null, params.workdir));
+			return {
+				execCommandOverride: enforcedCommand,
+				allowWithoutEnforcedCommand: enforcedCommand === void 0
+			};
+		}
+		const resolvedPath = resolveApprovalAuditCandidatePath(allowlistEval.segments[0]?.resolution ?? null, params.workdir);
+		const effectiveTimeout = typeof params.timeoutSec === "number" ? params.timeoutSec : params.defaultTimeoutSec;
+		const followupTarget = buildExecApprovalFollowupTarget({
+			approvalId,
+			sessionKey: params.notifySessionKey ?? params.sessionKey,
+			turnSourceChannel: params.turnSourceChannel,
+			turnSourceTo: params.turnSourceTo,
+			turnSourceAccountId: params.turnSourceAccountId,
+			turnSourceThreadId: params.turnSourceThreadId
+		});
+		(async () => {
+			const decision = await resolveApprovalDecisionOrUndefined({
+				approvalId,
+				preResolvedDecision,
+				onFailure: () => void sendExecApprovalFollowupResult(followupTarget, `Exec denied (gateway id=${approvalId}, approval-request-failed): ${params.command}`)
+			});
+			if (decision === void 0) return;
+			const { baseDecision, approvedByAsk: initialApprovedByAsk, deniedReason: initialDeniedReason } = createExecApprovalDecisionState({
+				decision,
+				askFallback
+			});
+			let approvedByAsk = initialApprovedByAsk;
+			let deniedReason = initialDeniedReason;
+			if (baseDecision.timedOut && askFallback === "allowlist") if (!analysisOk || !allowlistSatisfied) deniedReason = "approval-timeout (allowlist-miss)";
+			else approvedByAsk = true;
+			else if (decision === "allow-once") approvedByAsk = true;
+			else if (decision === "allow-always") {
+				approvedByAsk = true;
+				if (!requiresInlineEvalApproval) {
+					if (persistAllowAlwaysPatterns({
+						approvals: approvals.file,
+						agentId: params.agentId,
+						segments: allowlistEval.segments,
+						cwd: params.workdir,
+						env: params.env,
+						platform: process.platform,
+						strictInlineEval: params.strictInlineEval === true
+					}).length === 0) addDurableCommandApproval(approvals.file, params.agentId, params.command);
+				}
+			}
+			({approvedByAsk, deniedReason} = enforceStrictInlineEvalApprovalBoundary({
+				baseDecision,
+				approvedByAsk,
+				deniedReason,
+				requiresInlineEvalApproval
+			}));
+			if (!approvedByAsk && hasGatewayAllowlistMiss({
+				hostSecurity,
+				analysisOk,
+				allowlistSatisfied,
+				durableApprovalSatisfied
+			})) deniedReason = deniedReason ?? "allowlist-miss";
+			if (deniedReason) {
+				await sendExecApprovalFollowupResult(followupTarget, `Exec denied (gateway id=${approvalId}, ${deniedReason}): ${params.command}`);
+				return;
+			}
+			recordMatchedAllowlistUse(resolvedPath ?? void 0);
+			let run = null;
+			try {
+				run = await runExecProcess({
+					command: params.command,
+					execCommand: enforcedCommand,
+					workdir: params.workdir,
+					env: params.env,
+					sandbox: void 0,
+					containerWorkdir: null,
+					usePty: params.pty,
+					warnings: params.warnings,
+					maxOutput: params.maxOutput,
+					pendingMaxOutput: params.pendingMaxOutput,
+					notifyOnExit: false,
+					notifyOnExitEmptySuccess: false,
+					scopeKey: params.scopeKey,
+					sessionKey: params.notifySessionKey ?? params.sessionKey,
+					timeoutSec: effectiveTimeout
+				});
+			} catch {
+				await sendExecApprovalFollowupResult(followupTarget, `Exec denied (gateway id=${approvalId}, spawn-failed): ${params.command}`);
+				return;
+			}
+			markBackgrounded(run.session);
+			const outcome = await run.promise;
+			const output = normalizeNotifyOutput(tail(outcome.aggregated || "", 400));
+			const exitLabel = outcome.timedOut ? "timeout" : `code ${outcome.exitCode ?? "?"}`;
+			await sendExecApprovalFollowupResult(followupTarget, output ? `Exec finished (gateway id=${approvalId}, session=${run.session.id}, ${exitLabel})\n${output}` : `Exec finished (gateway id=${approvalId}, session=${run.session.id}, ${exitLabel})`);
+		})();
+		return { pendingResult: buildExecApprovalPendingToolResult({
+			host: "gateway",
+			command: params.command,
+			cwd: params.workdir,
+			warningText,
+			approvalId,
+			approvalSlug,
+			expiresAtMs,
+			initiatingSurface,
+			sentApproverDms,
+			unavailableReason,
+			allowedDecisions: resolveExecApprovalAllowedDecisions({ ask: hostAsk })
+		}) };
+	}
+	if (hasGatewayAllowlistMiss({
+		hostSecurity,
+		analysisOk,
+		allowlistSatisfied,
+		durableApprovalSatisfied
+	})) throw new Error("exec denied: allowlist miss");
+	recordMatchedAllowlistUse(resolveApprovalAuditCandidatePath(allowlistEval.segments[0]?.resolution ?? null, params.workdir));
+	return { execCommandOverride: enforcedCommand };
+}
+//#endregion
+//#region src/infra/node-shell.ts
+function buildNodeShellCommand(command, platform) {
+	if (normalizeLowercaseStringOrEmpty((platform ?? "").trim()).startsWith("win")) return [
+		"cmd.exe",
+		"/d",
+		"/s",
+		"/c",
+		command
+	];
+	return [
+		"/bin/sh",
+		"-lc",
+		command
+	];
+}
+//#endregion
+//#region src/agents/bash-tools.exec-host-node.ts
+async function executeNodeHostCommand(params) {
+	const { hostSecurity, hostAsk, askFallback } = resolveExecHostApprovalContext({
+		agentId: params.agentId,
+		security: params.security,
+		ask: params.ask,
+		host: "node"
+	});
+	if (params.boundNode && params.requestedNode && params.boundNode !== params.requestedNode) throw new Error(`exec node not allowed (bound to ${params.boundNode})`);
+	const nodeQuery = params.boundNode || params.requestedNode;
+	const nodes = await listNodes({});
+	if (nodes.length === 0) throw new Error("exec host=node requires a paired node (none available). This requires a companion app or node host.");
+	let nodeId;
+	try {
+		nodeId = resolveNodeIdFromList(nodes, nodeQuery, !nodeQuery);
+	} catch (err) {
+		if (!nodeQuery && String(err).includes("node required")) throw new Error("exec host=node requires a node id when multiple nodes are available (set tools.exec.node or exec.node).", { cause: err });
+		throw err;
+	}
+	const nodeInfo = nodes.find((entry) => entry.nodeId === nodeId);
+	if (!(Array.isArray(nodeInfo?.commands) ? nodeInfo?.commands?.includes("system.run") : false)) throw new Error("exec host=node requires a node that supports system.run (companion app or node host).");
+	const argv = buildNodeShellCommand(params.command, nodeInfo?.platform);
+	const prepared = parsePreparedSystemRunPayload((await callGatewayTool("node.invoke", { timeoutMs: 15e3 }, {
+		nodeId,
+		command: "system.run.prepare",
+		params: {
+			command: argv,
+			rawCommand: params.command,
+			...params.workdir != null ? { cwd: params.workdir } : {},
+			agentId: params.agentId,
+			sessionKey: params.sessionKey
+		},
+		idempotencyKey: crypto.randomUUID()
+	}))?.payload);
+	if (!prepared) throw new Error("invalid system.run.prepare response");
+	const runArgv = prepared.plan.argv;
+	const runRawCommand = prepared.plan.commandText;
+	const runCwd = prepared.plan.cwd ?? params.workdir;
+	const runAgentId = prepared.plan.agentId ?? params.agentId;
+	const runSessionKey = prepared.plan.sessionKey ?? params.sessionKey;
+	const nodeEnv = params.requestedEnv ? { ...params.requestedEnv } : void 0;
+	const baseAllowlistEval = evaluateShellAllowlist({
+		command: params.command,
+		allowlist: [],
+		safeBins: /* @__PURE__ */ new Set(),
+		cwd: params.workdir,
+		env: params.env,
+		platform: nodeInfo?.platform,
+		trustedSafeBinDirs: params.trustedSafeBinDirs
+	});
+	let analysisOk = baseAllowlistEval.analysisOk;
+	let allowlistSatisfied = false;
+	let durableApprovalSatisfied = false;
+	const inlineEvalHit = params.strictInlineEval === true ? baseAllowlistEval.segments.map((segment) => detectInterpreterInlineEvalArgv(segment.resolution?.effectiveArgv ?? segment.argv)).find((entry) => entry !== null) ?? null : null;
+	if (inlineEvalHit) params.warnings.push(`Warning: strict inline-eval mode requires explicit approval for ${describeInterpreterInlineEval(inlineEvalHit)}.`);
+	if ((hostAsk === "always" || hostSecurity === "allowlist") && analysisOk) try {
+		const approvalsSnapshot = await callGatewayTool("exec.approvals.node.get", { timeoutMs: 1e4 }, { nodeId });
+		const approvalsFile = approvalsSnapshot && typeof approvalsSnapshot === "object" ? approvalsSnapshot.file : void 0;
+		if (approvalsFile && typeof approvalsFile === "object") {
+			const resolved = resolveExecApprovalsFromFile({
+				file: approvalsFile,
+				agentId: params.agentId,
+				overrides: { security: "full" }
+			});
+			const allowlistEval = evaluateShellAllowlist({
+				command: params.command,
+				allowlist: resolved.allowlist,
+				safeBins: /* @__PURE__ */ new Set(),
+				cwd: params.workdir,
+				env: params.env,
+				platform: nodeInfo?.platform,
+				trustedSafeBinDirs: params.trustedSafeBinDirs
+			});
+			durableApprovalSatisfied = hasDurableExecApproval({
+				analysisOk: allowlistEval.analysisOk,
+				segmentAllowlistEntries: allowlistEval.segmentAllowlistEntries,
+				allowlist: resolved.allowlist,
+				commandText: runRawCommand
+			});
+			allowlistSatisfied = allowlistEval.allowlistSatisfied;
+			analysisOk = allowlistEval.analysisOk;
+		}
+	} catch {}
+	const requiresAsk = requiresExecApproval({
+		ask: hostAsk,
+		security: hostSecurity,
+		analysisOk,
+		allowlistSatisfied,
+		durableApprovalSatisfied
+	}) || inlineEvalHit !== null;
+	const invokeTimeoutMs = Math.max(1e4, (typeof params.timeoutSec === "number" ? params.timeoutSec : params.defaultTimeoutSec) * 1e3 + 5e3);
+	const buildInvokeParams = (approvedByAsk, approvalDecision, runId, suppressNotifyOnExit) => ({
+		nodeId,
+		command: "system.run",
+		params: {
+			command: runArgv,
+			rawCommand: runRawCommand,
+			systemRunPlan: prepared.plan,
+			cwd: runCwd,
+			env: nodeEnv,
+			timeoutMs: typeof params.timeoutSec === "number" ? params.timeoutSec * 1e3 : void 0,
+			agentId: runAgentId,
+			sessionKey: runSessionKey,
+			approved: approvedByAsk,
+			approvalDecision: approvalDecision === "allow-always" && inlineEvalHit !== null ? "allow-once" : approvalDecision ?? void 0,
+			runId: runId ?? void 0,
+			suppressNotifyOnExit: suppressNotifyOnExit === true || params.notifyOnExit === false ? true : void 0
+		},
+		idempotencyKey: crypto.randomUUID()
+	});
+	let inlineApprovedByAsk = false;
+	let inlineApprovalDecision = null;
+	let inlineApprovalId;
+	if (requiresAsk) {
+		const requestArgs = buildDefaultExecApprovalRequestArgs({
+			warnings: params.warnings,
+			approvalRunningNoticeMs: params.approvalRunningNoticeMs,
+			createApprovalSlug,
+			turnSourceChannel: params.turnSourceChannel,
+			turnSourceAccountId: params.turnSourceAccountId
+		});
+		const registerNodeApproval = async (approvalId) => await registerExecApprovalRequestForHostOrThrow({
+			approvalId,
+			systemRunPlan: prepared.plan,
+			env: nodeEnv,
+			workdir: runCwd,
+			host: "node",
+			nodeId,
+			security: hostSecurity,
+			ask: hostAsk,
+			...buildExecApprovalRequesterContext({
+				agentId: runAgentId,
+				sessionKey: runSessionKey
+			}),
+			...buildExecApprovalTurnSourceContext(params)
+		});
+		const { approvalId, approvalSlug, warningText, expiresAtMs, preResolvedDecision, initiatingSurface, sentApproverDms, unavailableReason } = await createAndRegisterDefaultExecApprovalRequest({
+			...requestArgs,
+			register: registerNodeApproval
+		});
+		if (shouldResolveExecApprovalUnavailableInline({
+			trigger: params.trigger,
+			unavailableReason,
+			preResolvedDecision
+		})) {
+			const { baseDecision, approvedByAsk, deniedReason } = createExecApprovalDecisionState({
+				decision: preResolvedDecision,
+				askFallback
+			});
+			const strictInlineEvalDecision = enforceStrictInlineEvalApprovalBoundary({
+				baseDecision,
+				approvedByAsk,
+				deniedReason,
+				requiresInlineEvalApproval: inlineEvalHit !== null
+			});
+			if (strictInlineEvalDecision.deniedReason || !strictInlineEvalDecision.approvedByAsk) throw new Error(buildHeadlessExecApprovalDeniedMessage({
+				trigger: params.trigger,
+				host: "node",
+				security: hostSecurity,
+				ask: hostAsk,
+				askFallback
+			}));
+			inlineApprovedByAsk = strictInlineEvalDecision.approvedByAsk;
+			inlineApprovalDecision = strictInlineEvalDecision.approvedByAsk ? "allow-once" : null;
+			inlineApprovalId = approvalId;
+		} else {
+			const followupTarget = buildExecApprovalFollowupTarget({
+				approvalId,
+				sessionKey: params.notifySessionKey ?? params.sessionKey,
+				turnSourceChannel: params.turnSourceChannel,
+				turnSourceTo: params.turnSourceTo,
+				turnSourceAccountId: params.turnSourceAccountId,
+				turnSourceThreadId: params.turnSourceThreadId
+			});
+			(async () => {
+				const decision = await resolveApprovalDecisionOrUndefined({
+					approvalId,
+					preResolvedDecision,
+					onFailure: () => void sendExecApprovalFollowupResult(followupTarget, `Exec denied (node=${nodeId} id=${approvalId}, approval-request-failed): ${params.command}`)
+				});
+				if (decision === void 0) return;
+				const { baseDecision, approvedByAsk: initialApprovedByAsk, deniedReason: initialDeniedReason } = createExecApprovalDecisionState({
+					decision,
+					askFallback
+				});
+				let approvedByAsk = initialApprovedByAsk;
+				let approvalDecision = null;
+				let deniedReason = initialDeniedReason;
+				if (baseDecision.timedOut && askFallback === "full" && approvedByAsk) approvalDecision = "allow-once";
+				else if (decision === "allow-once") {
+					approvedByAsk = true;
+					approvalDecision = "allow-once";
+				} else if (decision === "allow-always") {
+					approvedByAsk = true;
+					approvalDecision = "allow-always";
+				}
+				({approvedByAsk, deniedReason} = enforceStrictInlineEvalApprovalBoundary({
+					baseDecision,
+					approvedByAsk,
+					deniedReason,
+					requiresInlineEvalApproval: inlineEvalHit !== null
+				}));
+				if (deniedReason) approvalDecision = null;
+				if (deniedReason) {
+					await sendExecApprovalFollowupResult(followupTarget, `Exec denied (node=${nodeId} id=${approvalId}, ${deniedReason}): ${params.command}`);
+					return;
+				}
+				try {
+					const raw = await callGatewayTool("node.invoke", { timeoutMs: invokeTimeoutMs }, buildInvokeParams(approvedByAsk, approvalDecision, approvalId, true));
+					const payload = raw?.payload && typeof raw.payload === "object" ? raw.payload : {};
+					const output = normalizeNotifyOutput([
+						payload.stdout,
+						payload.stderr,
+						payload.error
+					].filter(Boolean).join("\n").slice(-400));
+					const exitLabel = payload.timedOut ? "timeout" : `code ${payload.exitCode ?? "?"}`;
+					await sendExecApprovalFollowupResult(followupTarget, output ? `Exec finished (node=${nodeId} id=${approvalId}, ${exitLabel})\n${output}` : `Exec finished (node=${nodeId} id=${approvalId}, ${exitLabel})`);
+				} catch {
+					await sendExecApprovalFollowupResult(followupTarget, `Exec denied (node=${nodeId} id=${approvalId}, invoke-failed): ${params.command}`);
+				}
+			})();
+			return buildExecApprovalPendingToolResult({
+				host: "node",
+				command: params.command,
+				cwd: params.workdir,
+				warningText,
+				approvalId,
+				approvalSlug,
+				expiresAtMs,
+				initiatingSurface,
+				sentApproverDms,
+				unavailableReason,
+				allowedDecisions: resolveExecApprovalAllowedDecisions({ ask: hostAsk }),
+				nodeId
+			});
+		}
+	}
+	const startedAt = Date.now();
+	const raw = await callGatewayTool("node.invoke", { timeoutMs: invokeTimeoutMs }, buildInvokeParams(inlineApprovedByAsk, inlineApprovalDecision, inlineApprovalId));
+	const payload = raw && typeof raw === "object" ? raw.payload : void 0;
+	const payloadObj = payload && typeof payload === "object" ? payload : {};
+	const stdout = typeof payloadObj.stdout === "string" ? payloadObj.stdout : "";
+	const stderr = typeof payloadObj.stderr === "string" ? payloadObj.stderr : "";
+	const errorText = typeof payloadObj.error === "string" ? payloadObj.error : "";
+	const success = typeof payloadObj.success === "boolean" ? payloadObj.success : false;
+	const exitCode = typeof payloadObj.exitCode === "number" ? payloadObj.exitCode : null;
+	return {
+		content: [{
+			type: "text",
+			text: stdout || stderr || errorText || ""
+		}],
+		details: {
+			status: success ? "completed" : "failed",
+			exitCode,
+			durationMs: Date.now() - startedAt,
+			aggregated: [
+				stdout,
+				stderr,
+				errorText
+			].filter(Boolean).join("\n"),
+			cwd: params.workdir
+		}
+	};
+}
+//#endregion
+//#region src/agents/bash-tools.exec.ts
+function buildExecForegroundResult(params) {
+	const warningText = params.warningText?.trim() ? `${params.warningText}\n\n` : "";
+	if (params.outcome.status === "failed") return failedTextResult(`${warningText}${params.outcome.reason}`, {
+		status: "failed",
+		exitCode: params.outcome.exitCode ?? null,
+		durationMs: params.outcome.durationMs,
+		aggregated: params.outcome.aggregated,
+		timedOut: params.outcome.timedOut,
+		cwd: params.cwd
+	});
+	return textResult(`${warningText}${params.outcome.aggregated || "(no output)"}`, {
+		status: "completed",
+		exitCode: params.outcome.exitCode,
+		durationMs: params.outcome.durationMs,
+		aggregated: params.outcome.aggregated,
+		cwd: params.cwd
+	});
+}
+const PREFLIGHT_ENV_OPTIONS_WITH_VALUES = new Set([
+	"-C",
+	"-S",
+	"-u",
+	"--argv0",
+	"--block-signal",
+	"--chdir",
+	"--default-signal",
+	"--ignore-signal",
+	"--split-string",
+	"--unset"
+]);
+const SKIPPABLE_SCRIPT_PREFLIGHT_FS_ERROR_CODES = new Set([
+	"EACCES",
+	"EISDIR",
+	"ELOOP",
+	"EINVAL",
+	"ENAMETOOLONG",
+	"ENOENT",
+	"ENOTDIR",
+	"EPERM"
+]);
+function getNodeErrorCode(error) {
+	if (typeof error !== "object" || error === null || !("code" in error)) return;
+	return String(error.code);
+}
+let fsSafeModulePromise;
+async function loadFsSafeModule() {
+	fsSafeModulePromise ??= import("./fs-safe-BKyLKWBX.js");
+	return await fsSafeModulePromise;
+}
+function shouldSkipScriptPreflightPathError(error, SafeOpenError) {
+	if (error instanceof SafeOpenError) return true;
+	const errorCode = getNodeErrorCode(error);
+	return !!(errorCode && SKIPPABLE_SCRIPT_PREFLIGHT_FS_ERROR_CODES.has(errorCode));
+}
+function resolvePreflightRelativePath(params) {
+	const root = path.resolve(params.rootDir);
+	const candidate = path.resolve(params.absPath);
+	const relative = path.relative(root, candidate);
+	if (/^\.\.(?:[\\/]|$)/u.test(relative) || path.isAbsolute(relative)) return null;
+	return /^~(?:$|[\\/])/u.test(relative) ? `.${path.sep}${relative}` : relative;
+}
+function isShellEnvAssignmentToken(token) {
+	return /^[A-Za-z_][A-Za-z0-9_]*=.*$/u.test(token);
+}
+function isEnvExecutableToken(token) {
+	if (!token) return false;
+	const base = normalizeOptionalLowercaseString(token.split(/[\\/]/u).at(-1)) ?? "";
+	return (base.endsWith(".exe") ? base.slice(0, -4) : base) === "env";
+}
+function stripPreflightEnvPrefix(argv) {
+	if (argv.length === 0) return argv;
+	let idx = 0;
+	while (idx < argv.length && isShellEnvAssignmentToken(argv[idx])) idx += 1;
+	if (!isEnvExecutableToken(argv[idx])) return argv;
+	idx += 1;
+	while (idx < argv.length) {
+		const token = argv[idx];
+		if (token === "--") {
+			idx += 1;
+			break;
+		}
+		if (isShellEnvAssignmentToken(token)) {
+			idx += 1;
+			continue;
+		}
+		if (!token.startsWith("-") || token === "-") break;
+		idx += 1;
+		const option = token.split("=", 1)[0];
+		if (PREFLIGHT_ENV_OPTIONS_WITH_VALUES.has(option) && !token.includes("=") && idx < argv.length) idx += 1;
+	}
+	return argv.slice(idx);
+}
+function findFirstPythonScriptArg(tokens) {
+	const optionsWithSeparateValue = new Set([
+		"-W",
+		"-X",
+		"-Q",
+		"--check-hash-based-pycs"
+	]);
+	for (let i = 0; i < tokens.length; i += 1) {
+		const token = tokens[i];
+		if (token === "--") {
+			const next = tokens[i + 1];
+			return normalizeLowercaseStringOrEmpty(next).endsWith(".py") ? next : null;
+		}
+		if (token === "-") return null;
+		if (token === "-c" || token === "-m") return null;
+		if ((token.startsWith("-c") || token.startsWith("-m")) && token.length > 2) return null;
+		if (optionsWithSeparateValue.has(token)) {
+			i += 1;
+			continue;
+		}
+		if (token.startsWith("-")) continue;
+		return normalizeLowercaseStringOrEmpty(token).endsWith(".py") ? token : null;
+	}
+	return null;
+}
+function findNodeScriptArgs(tokens) {
+	const optionsWithSeparateValue = new Set([
+		"-r",
+		"--require",
+		"--import"
+	]);
+	const preloadScripts = [];
+	let entryScript = null;
+	let hasInlineEvalOrPrint = false;
+	for (let i = 0; i < tokens.length; i += 1) {
+		const token = tokens[i];
+		if (token === "--") {
+			if (!hasInlineEvalOrPrint && !entryScript) {
+				const next = tokens[i + 1];
+				if (normalizeLowercaseStringOrEmpty(next).endsWith(".js")) entryScript = next;
+			}
+			break;
+		}
+		if (token === "-e" || token === "-p" || token === "--eval" || token === "--print" || token.startsWith("--eval=") || token.startsWith("--print=") || (token.startsWith("-e") || token.startsWith("-p")) && token.length > 2) {
+			hasInlineEvalOrPrint = true;
+			if (token === "-e" || token === "-p" || token === "--eval" || token === "--print") i += 1;
+			continue;
+		}
+		if (optionsWithSeparateValue.has(token)) {
+			const next = tokens[i + 1];
+			if (normalizeLowercaseStringOrEmpty(next).endsWith(".js")) preloadScripts.push(next);
+			i += 1;
+			continue;
+		}
+		if (token.startsWith("-r") && token.length > 2 || token.startsWith("--require=") || token.startsWith("--import=")) {
+			const inlineValue = token.startsWith("-r") ? token.slice(2) : token.slice(token.indexOf("=") + 1);
+			if (normalizeLowercaseStringOrEmpty(inlineValue).endsWith(".js")) preloadScripts.push(inlineValue);
+			continue;
+		}
+		if (token.startsWith("-")) continue;
+		if (!hasInlineEvalOrPrint && !entryScript && normalizeLowercaseStringOrEmpty(token).endsWith(".js")) entryScript = token;
+		break;
+	}
+	const targets = [...preloadScripts];
+	if (entryScript) targets.push(entryScript);
+	return targets;
+}
+function extractInterpreterScriptTargetFromArgv(argv) {
+	if (!argv || argv.length === 0) return null;
+	let commandIdx = 0;
+	while (commandIdx < argv.length && /^[A-Za-z_][A-Za-z0-9_]*=.*$/u.test(argv[commandIdx])) commandIdx += 1;
+	const executable = normalizeOptionalLowercaseString(argv[commandIdx]);
+	if (!executable) return null;
+	const args = argv.slice(commandIdx + 1);
+	if (/^python(?:3(?:\.\d+)?)?$/i.test(executable)) {
+		const script = findFirstPythonScriptArg(args);
+		if (script) return {
+			kind: "python",
+			relOrAbsPaths: [script]
+		};
+		return null;
+	}
+	if (executable === "node") {
+		const scripts = findNodeScriptArgs(args);
+		if (scripts.length > 0) return {
+			kind: "node",
+			relOrAbsPaths: scripts
+		};
+		return null;
+	}
+	return null;
+}
+function extractInterpreterScriptPathsFromSegment(rawSegment) {
+	const argv = splitShellArgs(rawSegment.trim());
+	if (!argv || argv.length === 0) return [];
+	return extractInterpreterScriptTargetFromArgv(stripPreflightEnvPrefix(/^(?:if|then|do|elif|else|while|until|time)$/i.test(argv[0] ?? "") ? argv.slice(1) : argv))?.relOrAbsPaths ?? [];
+}
+function extractScriptTargetFromCommand(command) {
+	const raw = command.trim();
+	const splitShellArgsPreservingBackslashes = (value) => {
+		const tokens = [];
+		let buf = "";
+		let inSingle = false;
+		let inDouble = false;
+		const pushToken = () => {
+			if (buf.length > 0) {
+				tokens.push(buf);
+				buf = "";
+			}
+		};
+		for (let i = 0; i < value.length; i += 1) {
+			const ch = value[i];
+			if (inSingle) {
+				if (ch === "'") inSingle = false;
+				else buf += ch;
+				continue;
+			}
+			if (inDouble) {
+				if (ch === "\"") inDouble = false;
+				else buf += ch;
+				continue;
+			}
+			if (ch === "'") {
+				inSingle = true;
+				continue;
+			}
+			if (ch === "\"") {
+				inDouble = true;
+				continue;
+			}
+			if (/\s/.test(ch)) {
+				pushToken();
+				continue;
+			}
+			buf += ch;
+		}
+		if (inSingle || inDouble) return null;
+		pushToken();
+		return tokens;
+	};
+	const candidateArgv = process.platform === "win32" && /(?:^|[\s"'`])(?:[A-Za-z]:\\|\\\\|[^\s"'`|&;()<>]+\\[^\s"'`|&;()<>]+)/.test(raw) ? [splitShellArgsPreservingBackslashes(raw)] : [splitShellArgs(raw)];
+	for (const argv of candidateArgv) {
+		const attempts = [argv, argv ? stripPreflightEnvPrefix(argv) : null];
+		for (const attempt of attempts) {
+			const target = extractInterpreterScriptTargetFromArgv(attempt);
+			if (target) return target;
+		}
+	}
+	return null;
+}
+function extractUnquotedShellText(raw) {
+	let out = "";
+	let inSingle = false;
+	let inDouble = false;
+	let escaped = false;
+	for (let i = 0; i < raw.length; i += 1) {
+		const ch = raw[i];
+		if (escaped) {
+			if (!inSingle && !inDouble) out += `\\${ch}`;
+			escaped = false;
+			continue;
+		}
+		if (!inSingle && ch === "\\") {
+			escaped = true;
+			continue;
+		}
+		if (inSingle) {
+			if (ch === "'") inSingle = false;
+			continue;
+		}
+		if (inDouble) {
+			const next = raw[i + 1];
+			if (ch === "\\" && next && /[\\'"$`\n\r]/.test(next)) {
+				i += 1;
+				continue;
+			}
+			if (ch === "\"") inDouble = false;
+			continue;
+		}
+		if (ch === "'") {
+			inSingle = true;
+			continue;
+		}
+		if (ch === "\"") {
+			inDouble = true;
+			continue;
+		}
+		out += ch;
+	}
+	if (escaped || inSingle || inDouble) return null;
+	return out;
+}
+function splitShellSegmentsOutsideQuotes(rawText, params) {
+	const segments = [];
+	let buf = "";
+	let inSingle = false;
+	let inDouble = false;
+	let escaped = false;
+	const pushSegment = () => {
+		if (buf.trim().length > 0) segments.push(buf);
+		buf = "";
+	};
+	for (let i = 0; i < rawText.length; i += 1) {
+		const ch = rawText[i];
+		const next = rawText[i + 1];
+		if (escaped) {
+			buf += ch;
+			escaped = false;
+			continue;
+		}
+		if (!inSingle && ch === "\\") {
+			buf += ch;
+			escaped = true;
+			continue;
+		}
+		if (inSingle) {
+			buf += ch;
+			if (ch === "'") inSingle = false;
+			continue;
+		}
+		if (inDouble) {
+			buf += ch;
+			if (ch === "\"") inDouble = false;
+			continue;
+		}
+		if (ch === "'") {
+			inSingle = true;
+			buf += ch;
+			continue;
+		}
+		if (ch === "\"") {
+			inDouble = true;
+			buf += ch;
+			continue;
+		}
+		if (ch === "\n" || ch === "\r") {
+			pushSegment();
+			continue;
+		}
+		if (ch === ";") {
+			pushSegment();
+			continue;
+		}
+		if (ch === "&" && next === "&") {
+			pushSegment();
+			i += 1;
+			continue;
+		}
+		if (ch === "|" && next === "|") {
+			pushSegment();
+			i += 1;
+			continue;
+		}
+		if (params.splitPipes && ch === "|") {
+			pushSegment();
+			continue;
+		}
+		buf += ch;
+	}
+	pushSegment();
+	return segments;
+}
+function isInterpreterExecutable(executable) {
+	if (!executable) return false;
+	return /^python(?:3(?:\.\d+)?)?$/i.test(executable) || executable === "node";
+}
+function hasUnescapedSequence(raw, sequence) {
+	if (sequence.length === 0) return false;
+	let escaped = false;
+	for (let i = 0; i < raw.length; i += 1) {
+		const ch = raw[i];
+		if (escaped) {
+			escaped = false;
+			continue;
+		}
+		if (ch === "\\") {
+			escaped = true;
+			continue;
+		}
+		if (raw.startsWith(sequence, i)) return true;
+	}
+	return false;
+}
+function hasUnquotedScriptHint(raw) {
+	let inSingle = false;
+	let inDouble = false;
+	let escaped = false;
+	let token = "";
+	const flushToken = () => {
+		const normalizedToken = normalizeLowercaseStringOrEmpty(token);
+		if (normalizedToken.endsWith(".py") || normalizedToken.endsWith(".js")) return true;
+		token = "";
+		return false;
+	};
+	for (let i = 0; i < raw.length; i += 1) {
+		const ch = raw[i];
+		if (escaped) {
+			if (!inSingle && !inDouble) token += ch;
+			escaped = false;
+			continue;
+		}
+		if (!inSingle && ch === "\\") {
+			escaped = true;
+			continue;
+		}
+		if (inSingle) {
+			if (ch === "'") inSingle = false;
+			continue;
+		}
+		if (inDouble) {
+			if (ch === "\"") inDouble = false;
+			continue;
+		}
+		if (ch === "'") {
+			if (flushToken()) return true;
+			inSingle = true;
+			continue;
+		}
+		if (ch === "\"") {
+			if (flushToken()) return true;
+			inDouble = true;
+			continue;
+		}
+		if (/\s/u.test(ch) || "|&;()<>".includes(ch)) {
+			if (flushToken()) return true;
+			continue;
+		}
+		token += ch;
+	}
+	return flushToken();
+}
+function resolveLeadingShellSegmentExecutable(rawSegment) {
+	const argv = splitShellArgs((extractUnquotedShellText(rawSegment) ?? rawSegment).trim());
+	if (!argv || argv.length === 0) return;
+	const withoutLeadingKeyword = /^(?:if|then|do|elif|else|while|until|time)$/i.test(argv[0] ?? "") ? argv.slice(1) : argv;
+	if (withoutLeadingKeyword.length === 0) return;
+	const normalizedArgv = stripPreflightEnvPrefix(withoutLeadingKeyword);
+	let commandIdx = 0;
+	while (commandIdx < normalizedArgv.length && /^[A-Za-z_][A-Za-z0-9_]*=.*$/u.test(normalizedArgv[commandIdx] ?? "")) commandIdx += 1;
+	return normalizeOptionalLowercaseString(normalizedArgv[commandIdx]);
+}
+function analyzeInterpreterHeuristicsFromUnquoted(raw) {
+	const hasPython = splitShellSegmentsOutsideQuotes(raw, { splitPipes: true }).some((segment) => /^python(?:3(?:\.\d+)?)?$/i.test(resolveLeadingShellSegmentExecutable(segment) ?? ""));
+	const hasNode = splitShellSegmentsOutsideQuotes(raw, { splitPipes: true }).some((segment) => resolveLeadingShellSegmentExecutable(segment) === "node");
+	const hasProcessSubstitution = hasUnescapedSequence(raw, "<(") || hasUnescapedSequence(raw, ">(");
+	return {
+		hasPython,
+		hasNode,
+		hasComplexSyntax: hasUnescapedSequence(raw, "|") || hasUnescapedSequence(raw, "&&") || hasUnescapedSequence(raw, "||") || hasUnescapedSequence(raw, ";") || raw.includes("\n") || raw.includes("\r") || hasUnescapedSequence(raw, "$(") || hasUnescapedSequence(raw, "`") || hasProcessSubstitution,
+		hasProcessSubstitution,
+		hasScriptHint: hasUnquotedScriptHint(raw)
+	};
+}
+function extractShellWrappedCommandPayload(executable, args) {
+	if (!executable) return null;
+	const executableBase = normalizeOptionalLowercaseString(executable.split(/[\\/]/u).at(-1)) ?? "";
+	const normalizedExecutable = executableBase.endsWith(".exe") ? executableBase.slice(0, -4) : executableBase;
+	if (!/^(?:bash|dash|fish|ksh|sh|zsh)$/i.test(normalizedExecutable)) return null;
+	const shortOptionsWithSeparateValue = new Set(["-O", "-o"]);
+	for (let i = 0; i < args.length; i += 1) {
+		const arg = args[i];
+		if (arg === "--") return null;
+		if (arg === "-c") return args[i + 1] ?? null;
+		if (/^-[A-Za-z]+$/u.test(arg)) {
+			if (arg.includes("c")) return args[i + 1] ?? null;
+			if (shortOptionsWithSeparateValue.has(arg)) i += 1;
+			continue;
+		}
+		if (/^--[A-Za-z0-9][A-Za-z0-9-]*(?:=.*)?$/u.test(arg)) {
+			if (!arg.includes("=")) {
+				const next = args[i + 1];
+				if (next && next !== "--" && !next.startsWith("-")) i += 1;
+			}
+			continue;
+		}
+		return null;
+	}
+	return null;
+}
+function shouldFailClosedInterpreterPreflight(command) {
+	const raw = command.trim();
+	const rawArgv = splitShellArgs(raw);
+	const argv = rawArgv ? stripPreflightEnvPrefix(rawArgv) : null;
+	let commandIdx = 0;
+	if (argv) while (commandIdx < argv.length && /^[A-Za-z_][A-Za-z0-9_]*=.*$/u.test(argv[commandIdx] ?? "")) commandIdx += 1;
+	const directExecutable = normalizeOptionalLowercaseString(argv?.[commandIdx]);
+	const args = argv ? argv.slice(commandIdx + 1) : [];
+	const isDirectInterpreterCommand = Boolean(directExecutable && /^python(?:3(?:\.\d+)?)?$/i.test(directExecutable)) || directExecutable === "node";
+	const topLevel = analyzeInterpreterHeuristicsFromUnquoted(extractUnquotedShellText(raw) ?? raw);
+	const shellWrappedPayload = extractShellWrappedCommandPayload(directExecutable, args);
+	const nestedUnquoted = shellWrappedPayload ? extractUnquotedShellText(shellWrappedPayload) ?? shellWrappedPayload : "";
+	const nested = shellWrappedPayload ? analyzeInterpreterHeuristicsFromUnquoted(nestedUnquoted) : {
+		hasPython: false,
+		hasNode: false,
+		hasComplexSyntax: false,
+		hasProcessSubstitution: false,
+		hasScriptHint: false
+	};
+	const hasInterpreterInvocationInSegment = (rawSegment) => isInterpreterExecutable(resolveLeadingShellSegmentExecutable(rawSegment));
+	const isScriptExecutingInterpreterCommand = (rawCommand) => {
+		const argv = splitShellArgs(rawCommand.trim());
+		if (!argv || argv.length === 0) return false;
+		const withoutLeadingKeyword = /^(?:if|then|do|elif|else|while|until|time)$/i.test(argv[0] ?? "") ? argv.slice(1) : argv;
+		if (withoutLeadingKeyword.length === 0) return false;
+		const normalizedArgv = stripPreflightEnvPrefix(withoutLeadingKeyword);
+		let commandIdx = 0;
+		while (commandIdx < normalizedArgv.length && /^[A-Za-z_][A-Za-z0-9_]*=.*$/u.test(normalizedArgv[commandIdx] ?? "")) commandIdx += 1;
+		const executable = normalizeOptionalLowercaseString(normalizedArgv[commandIdx]);
+		if (!executable) return false;
+		const args = normalizedArgv.slice(commandIdx + 1);
+		if (/^python(?:3(?:\.\d+)?)?$/i.test(executable)) {
+			const pythonInfoOnlyFlags = new Set([
+				"-V",
+				"--version",
+				"-h",
+				"--help"
+			]);
+			if (args.some((arg) => pythonInfoOnlyFlags.has(arg))) return false;
+			if (args.some((arg) => arg === "-c" || arg === "-m" || arg.startsWith("-c") || arg.startsWith("-m") || arg === "--check-hash-based-pycs")) return false;
+			return true;
+		}
+		if (executable === "node") {
+			const nodeInfoOnlyFlags = new Set([
+				"-v",
+				"--version",
+				"-h",
+				"--help",
+				"-c",
+				"--check"
+			]);
+			if (args.some((arg) => nodeInfoOnlyFlags.has(arg))) return false;
+			if (args.some((arg) => arg === "-e" || arg === "-p" || arg === "--eval" || arg === "--print" || arg.startsWith("--eval=") || arg.startsWith("--print=") || (arg.startsWith("-e") || arg.startsWith("-p")) && arg.length > 2)) return false;
+			return true;
+		}
+		return false;
+	};
+	const hasScriptHintInSegment = (segment) => extractInterpreterScriptPathsFromSegment(segment).length > 0 || hasUnquotedScriptHint(segment);
+	const hasInterpreterAndScriptHintInSameSegment = (rawText) => {
+		return splitShellSegmentsOutsideQuotes(rawText, { splitPipes: true }).some((segment) => {
+			if (!isScriptExecutingInterpreterCommand(segment)) return false;
+			return hasScriptHintInSegment(segment);
+		});
+	};
+	const hasInterpreterPipelineScriptHintInSameSegment = (rawText) => {
+		return splitShellSegmentsOutsideQuotes(rawText, { splitPipes: false }).some((segment) => {
+			if (!splitShellSegmentsOutsideQuotes(segment, { splitPipes: true }).slice(1).some((pipelineCommand) => isScriptExecutingInterpreterCommand(pipelineCommand))) return false;
+			return hasScriptHintInSegment(segment);
+		});
+	};
+	const hasInterpreterSegmentScriptHint = hasInterpreterAndScriptHintInSameSegment(raw) || shellWrappedPayload !== null && hasInterpreterAndScriptHintInSameSegment(shellWrappedPayload);
+	const hasInterpreterPipelineScriptHint = hasInterpreterPipelineScriptHintInSameSegment(raw) || shellWrappedPayload !== null && hasInterpreterPipelineScriptHintInSameSegment(shellWrappedPayload);
+	const hasShellWrappedInterpreterSegmentScriptHint = shellWrappedPayload !== null && hasInterpreterAndScriptHintInSameSegment(shellWrappedPayload);
+	const hasShellWrappedInterpreterInvocation = (nested.hasPython || nested.hasNode) && (hasShellWrappedInterpreterSegmentScriptHint || nested.hasScriptHint || nested.hasComplexSyntax || nested.hasProcessSubstitution);
+	const hasTopLevelInterpreterInvocation = splitShellSegmentsOutsideQuotes(raw, { splitPipes: true }).some((segment) => hasInterpreterInvocationInSegment(segment));
+	return {
+		hasInterpreterInvocation: isDirectInterpreterCommand || hasShellWrappedInterpreterInvocation || hasTopLevelInterpreterInvocation,
+		hasComplexSyntax: topLevel.hasComplexSyntax || hasShellWrappedInterpreterInvocation,
+		hasProcessSubstitution: topLevel.hasProcessSubstitution || nested.hasProcessSubstitution,
+		hasInterpreterSegmentScriptHint,
+		hasInterpreterPipelineScriptHint,
+		isDirectInterpreterCommand
+	};
+}
+async function validateScriptFileForShellBleed(params) {
+	const target = extractScriptTargetFromCommand(params.command);
+	if (!target) {
+		const { hasInterpreterInvocation, hasComplexSyntax, hasProcessSubstitution, hasInterpreterSegmentScriptHint, hasInterpreterPipelineScriptHint, isDirectInterpreterCommand } = shouldFailClosedInterpreterPreflight(params.command);
+		if (hasInterpreterInvocation && hasComplexSyntax && (hasInterpreterSegmentScriptHint || hasInterpreterPipelineScriptHint || hasProcessSubstitution && isDirectInterpreterCommand)) throw new Error("exec preflight: complex interpreter invocation detected; refusing to run without script preflight validation. Use a direct `python <file>.py` or `node <file>.js` command.");
+		return;
+	}
+	const { SafeOpenError, readFileWithinRoot } = await loadFsSafeModule();
+	for (const relOrAbsPath of target.relOrAbsPaths) {
+		const absPath = path.isAbsolute(relOrAbsPath) ? path.resolve(relOrAbsPath) : path.resolve(params.workdir, relOrAbsPath);
+		const relativePath = resolvePreflightRelativePath({
+			rootDir: params.workdir,
+			absPath
+		});
+		if (!relativePath) continue;
+		let content;
+		try {
+			content = (await readFileWithinRoot({
+				rootDir: params.workdir,
+				relativePath,
+				nonBlockingRead: true,
+				allowSymlinkTargetWithinRoot: true,
+				maxBytes: 512 * 1024
+			})).buffer.toString("utf-8");
+		} catch (error) {
+			if (shouldSkipScriptPreflightPathError(error, SafeOpenError)) continue;
+			throw error;
+		}
+		const first = /\$[A-Z_][A-Z0-9_]{1,}/g.exec(content);
+		if (first) {
+			const idx = first.index;
+			const line = content.slice(0, idx).split("\n").length;
+			const token = first[0];
+			throw new Error([
+				`exec preflight: detected likely shell variable injection (${token}) in ${target.kind} script: ${path.basename(absPath)}:${line}.`,
+				target.kind === "python" ? `In Python, use os.environ.get(${JSON.stringify(token.slice(1))}) instead of raw ${token}.` : `In Node.js, use process.env[${JSON.stringify(token.slice(1))}] instead of raw ${token}.`,
+				"(If this is inside a string literal on purpose, escape it or restructure the code.)"
+			].join("\n"));
+		}
+		if (target.kind === "node") {
+			const firstNonEmpty = content.split(/\r?\n/).map((l) => l.trim()).find((l) => l.length > 0);
+			if (firstNonEmpty && /^NODE\b/.test(firstNonEmpty)) throw new Error(`exec preflight: JS file starts with shell syntax (${firstNonEmpty}). This looks like a shell command, not JavaScript.`);
+		}
+	}
+}
+function shouldSkipExecScriptPreflight(params) {
+	return params.host === "gateway" && params.security === "full" && params.ask === "off";
+}
+function parseExecApprovalShellCommand(raw) {
+	const match = raw.trimStart().match(/^\/approve(?:@[^\s]+)?\s+([A-Za-z0-9][A-Za-z0-9._:-]*)\s+(allow-once|allow-always|always|deny)\b/i);
+	if (!match) return null;
+	return {
+		approvalId: match[1],
+		decision: normalizeLowercaseStringOrEmpty(match[2]) === "always" ? "allow-always" : normalizeLowercaseStringOrEmpty(match[2])
+	};
+}
+function rejectExecApprovalShellCommand(command) {
+	const isEnvAssignmentToken = (token) => /^[A-Za-z_][A-Za-z0-9_]*=.*$/u.test(token);
+	const shellWrappers = new Set([
+		"bash",
+		"dash",
+		"fish",
+		"ksh",
+		"sh",
+		"zsh"
+	]);
+	const commandStandaloneOptions = new Set([
+		"-p",
+		"-v",
+		"-V"
+	]);
+	const envOptionsWithValues = new Set([
+		"-C",
+		"-S",
+		"-u",
+		"--argv0",
+		"--block-signal",
+		"--chdir",
+		"--default-signal",
+		"--ignore-signal",
+		"--split-string",
+		"--unset"
+	]);
+	const execOptionsWithValues = new Set(["-a"]);
+	const execStandaloneOptions = new Set(["-c", "-l"]);
+	const sudoOptionsWithValues = new Set([
+		"-C",
+		"-D",
+		"-g",
+		"-p",
+		"-R",
+		"-T",
+		"-U",
+		"-u",
+		"--chdir",
+		"--close-from",
+		"--group",
+		"--host",
+		"--other-user",
+		"--prompt",
+		"--role",
+		"--type",
+		"--user"
+	]);
+	const sudoStandaloneOptions = new Set([
+		"-A",
+		"-E",
+		"--askpass",
+		"--preserve-env"
+	]);
+	const extractEnvSplitStringPayload = (argv) => {
+		const remaining = [...argv];
+		while (remaining[0] && isEnvAssignmentToken(remaining[0])) remaining.shift();
+		if (remaining[0] !== "env") return [];
+		remaining.shift();
+		const payloads = [];
+		while (remaining.length > 0) {
+			while (remaining[0] && isEnvAssignmentToken(remaining[0])) remaining.shift();
+			const token = remaining[0];
+			if (!token) break;
+			if (token === "--") {
+				remaining.shift();
+				continue;
+			}
+			if (!token.startsWith("-") || token === "-") break;
+			const option = remaining.shift();
+			const normalized = option.split("=", 1)[0];
+			if (normalized === "-S" || normalized === "--split-string") {
+				const value = option.includes("=") ? option.slice(option.indexOf("=") + 1) : remaining.shift();
+				if (value?.trim()) payloads.push(value);
+				continue;
+			}
+			if (envOptionsWithValues.has(normalized) && !option.includes("=") && remaining[0]) remaining.shift();
+		}
+		return payloads;
+	};
+	const stripApprovalCommandPrefixes = (argv) => {
+		const remaining = [...argv];
+		while (remaining.length > 0) {
+			while (remaining[0] && isEnvAssignmentToken(remaining[0])) remaining.shift();
+			const token = remaining[0];
+			if (!token) break;
+			if (token === "--") {
+				remaining.shift();
+				continue;
+			}
+			if (token === "env") {
+				remaining.shift();
+				while (remaining.length > 0) {
+					while (remaining[0] && isEnvAssignmentToken(remaining[0])) remaining.shift();
+					const envToken = remaining[0];
+					if (!envToken) break;
+					if (envToken === "--") {
+						remaining.shift();
+						continue;
+					}
+					if (!envToken.startsWith("-") || envToken === "-") break;
+					const option = remaining.shift();
+					const normalized = option.split("=", 1)[0];
+					if (envOptionsWithValues.has(normalized) && !option.includes("=") && remaining[0]) remaining.shift();
+				}
+				continue;
+			}
+			if (token === "command" || token === "builtin") {
+				remaining.shift();
+				while (remaining[0]?.startsWith("-")) {
+					const option = remaining.shift();
+					if (option === "--") break;
+					if (!commandStandaloneOptions.has(option.split("=", 1)[0])) continue;
+				}
+				continue;
+			}
+			if (token === "exec") {
+				remaining.shift();
+				while (remaining[0]?.startsWith("-")) {
+					const option = remaining.shift();
+					if (option === "--") break;
+					const normalized = option.split("=", 1)[0];
+					if (execStandaloneOptions.has(normalized)) continue;
+					if (execOptionsWithValues.has(normalized) && !option.includes("=") && remaining[0]) remaining.shift();
+				}
+				continue;
+			}
+			if (token === "sudo") {
+				remaining.shift();
+				while (remaining[0]?.startsWith("-")) {
+					const option = remaining.shift();
+					if (option === "--") break;
+					const normalized = option.split("=", 1)[0];
+					if (sudoStandaloneOptions.has(normalized)) continue;
+					if (sudoOptionsWithValues.has(normalized) && !option.includes("=") && remaining[0]) remaining.shift();
+				}
+				continue;
+			}
+			break;
+		}
+		return remaining;
+	};
+	const extractShellWrapperPayload = (argv) => {
+		const [commandName, ...rest] = argv;
+		if (!commandName || !shellWrappers.has(path.basename(commandName))) return [];
+		for (let i = 0; i < rest.length; i += 1) {
+			const token = rest[i];
+			if (!token) continue;
+			if (token === "-c" || token === "-lc" || token === "-ic" || token === "-xc") return rest[i + 1] ? [rest[i + 1]] : [];
+			if (/^-[^-]*c[^-]*$/u.test(token)) return rest[i + 1] ? [rest[i + 1]] : [];
+		}
+		return [];
+	};
+	const buildCandidates = (argv) => {
+		const envSplitCandidates = extractEnvSplitStringPayload(argv).flatMap((payload) => {
+			const innerArgv = splitShellArgs(payload);
+			return innerArgv ? buildCandidates(innerArgv) : [payload];
+		});
+		const stripped = stripApprovalCommandPrefixes(argv);
+		const shellWrapperCandidates = extractShellWrapperPayload(stripped).flatMap((payload) => {
+			const innerArgv = splitShellArgs(payload);
+			return innerArgv ? buildCandidates(innerArgv) : [payload];
+		});
+		return [
+			...stripped.length > 0 ? [stripped.join(" ")] : [],
+			...envSplitCandidates,
+			...shellWrapperCandidates
+		];
+	};
+	const rawCommand = command.trim();
+	const analysis = analyzeShellCommand({ command: rawCommand });
+	const candidates = analysis.ok ? analysis.segments.flatMap((segment) => buildCandidates(segment.argv)) : rawCommand.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).flatMap((line) => {
+		const argv = splitShellArgs(line);
+		return argv ? buildCandidates(argv) : [line];
+	});
+	for (const candidate of candidates) {
+		if (!parseExecApprovalShellCommand(candidate)) continue;
+		throw new Error(["exec cannot run /approve commands.", "Show the /approve command to the user as chat text, or route it through the approval command handler instead of shell execution."].join(" "));
+	}
+}
+function createExecTool(defaults) {
+	const defaultBackgroundMs = clampWithDefault(defaults?.backgroundMs ?? readEnvInt("PI_BASH_YIELD_MS"), 1e4, 10, 12e4);
+	const allowBackground = defaults?.allowBackground ?? true;
+	const defaultTimeoutSec = typeof defaults?.timeoutSec === "number" && defaults.timeoutSec > 0 ? defaults.timeoutSec : 1800;
+	const defaultPathPrepend = normalizePathPrepend(defaults?.pathPrepend);
+	const { safeBins, safeBinProfiles, trustedSafeBinDirs, unprofiledSafeBins, unprofiledInterpreterSafeBins } = resolveExecSafeBinRuntimePolicy({
+		local: {
+			safeBins: defaults?.safeBins,
+			safeBinTrustedDirs: defaults?.safeBinTrustedDirs,
+			safeBinProfiles: defaults?.safeBinProfiles
+		},
+		onWarning: (message) => {
+			logInfo(message);
+		}
+	});
+	if (unprofiledSafeBins.length > 0) logInfo(`exec: ignoring unprofiled safeBins entries (${unprofiledSafeBins.toSorted().join(", ")}); use allowlist or define tools.exec.safeBinProfiles.<bin>`);
+	if (unprofiledInterpreterSafeBins.length > 0) logInfo(`exec: interpreter/runtime binaries in safeBins (${unprofiledInterpreterSafeBins.join(", ")}) are unsafe without explicit hardened profiles; prefer allowlist entries`);
+	const notifyOnExit = defaults?.notifyOnExit !== false;
+	const notifyOnExitEmptySuccess = defaults?.notifyOnExitEmptySuccess === true;
+	const notifySessionKey = normalizeOptionalString(defaults?.sessionKey);
+	const notifyDeliveryContext = normalizeDeliveryContext({
+		channel: defaults?.messageProvider,
+		to: defaults?.currentChannelId,
+		accountId: defaults?.accountId,
+		threadId: defaults?.currentThreadTs
+	});
+	const approvalRunningNoticeMs = resolveApprovalRunningNoticeMs(defaults?.approvalRunningNoticeMs);
+	const parsedAgentSession = parseAgentSessionKey(defaults?.sessionKey);
+	const agentId = defaults?.agentId ?? (parsedAgentSession ? resolveAgentIdFromSessionKey(defaults?.sessionKey) : void 0);
+	return {
+		name: "exec",
+		label: "exec",
+		displaySummary: EXEC_TOOL_DISPLAY_SUMMARY,
+		get description() {
+			return describeExecTool({
+				agentId,
+				hasCronTool: defaults?.hasCronTool === true
+			});
+		},
+		parameters: execSchema,
+		execute: async (_toolCallId, args, signal, onUpdate) => {
+			const params = args;
+			if (!params.command) throw new Error("Provide a command to start.");
+			const maxOutput = DEFAULT_MAX_OUTPUT;
+			const pendingMaxOutput = DEFAULT_PENDING_MAX_OUTPUT;
+			const warnings = [];
+			let execCommandOverride;
+			const backgroundRequested = params.background === true;
+			const yieldRequested = typeof params.yieldMs === "number";
+			if (!allowBackground && (backgroundRequested || yieldRequested)) warnings.push("Warning: background execution is disabled; running synchronously.");
+			const yieldWindow = allowBackground ? backgroundRequested ? 0 : clampWithDefault(params.yieldMs ?? defaultBackgroundMs, defaultBackgroundMs, 10, 12e4) : null;
+			const elevatedDefaults = defaults?.elevated;
+			const elevatedAllowed = Boolean(elevatedDefaults?.enabled && elevatedDefaults.allowed);
+			const elevatedDefaultMode = elevatedDefaults?.defaultLevel === "full" ? "full" : elevatedDefaults?.defaultLevel === "ask" ? "ask" : elevatedDefaults?.defaultLevel === "on" ? "ask" : "off";
+			const effectiveDefaultMode = elevatedAllowed ? elevatedDefaultMode : "off";
+			const elevatedMode = typeof params.elevated === "boolean" ? params.elevated ? elevatedDefaultMode === "full" ? "full" : "ask" : "off" : effectiveDefaultMode;
+			const elevatedRequested = elevatedMode !== "off";
+			if (elevatedRequested) {
+				if (!elevatedDefaults?.enabled || !elevatedDefaults.allowed) {
+					const runtime = defaults?.sandbox ? "sandboxed" : "direct";
+					const gates = [];
+					const contextParts = [];
+					const provider = normalizeOptionalString(defaults?.messageProvider);
+					const sessionKey = normalizeOptionalString(defaults?.sessionKey);
+					if (provider) contextParts.push(`provider=${provider}`);
+					if (sessionKey) contextParts.push(`session=${sessionKey}`);
+					if (!elevatedDefaults?.enabled) gates.push("enabled (tools.elevated.enabled / agents.list[].tools.elevated.enabled)");
+					else gates.push("allowFrom (tools.elevated.allowFrom.<provider> / agents.list[].tools.elevated.allowFrom.<provider>)");
+					throw new Error([
+						`elevated is not available right now (runtime=${runtime}).`,
+						`Failing gates: ${gates.join(", ")}`,
+						contextParts.length > 0 ? `Context: ${contextParts.join(" ")}` : void 0,
+						"Fix-it keys:",
+						"- tools.elevated.enabled",
+						"- tools.elevated.allowFrom.<provider>",
+						"- agents.list[].tools.elevated.enabled",
+						"- agents.list[].tools.elevated.allowFrom.<provider>"
+					].filter(Boolean).join("\n"));
+				}
+			}
+			if (elevatedRequested) logInfo(`exec: elevated command ${truncateMiddle(params.command, 120)}`);
+			const target = resolveExecTarget({
+				configuredTarget: defaults?.host,
+				requestedTarget: normalizeExecTarget(params.host),
+				elevatedRequested,
+				sandboxAvailable: Boolean(defaults?.sandbox)
+			});
+			const host = target.effectiveHost;
+			const approvalDefaults = loadExecApprovals().defaults;
+			const configuredSecurity = defaults?.security ?? approvalDefaults?.security ?? (host === "sandbox" ? "deny" : "full");
+			let security = minSecurity(configuredSecurity, normalizeExecSecurity(params.security) ?? configuredSecurity);
+			if (elevatedRequested && elevatedMode === "full") security = "full";
+			const configuredAsk = defaults?.ask ?? approvalDefaults?.ask ?? "off";
+			let ask = maxAsk(configuredAsk, normalizeExecAsk(params.ask) ?? configuredAsk);
+			const bypassApprovals = elevatedRequested && elevatedMode === "full";
+			if (bypassApprovals) ask = "off";
+			if (defaults?.safeguard?.enabled !== false) {
+				const safeguardAnalysis = analyzeShellCommand({ command: params.command });
+				let verdict = evaluateExecSafeguard(safeguardAnalysis, { rawCommand: params.command });
+				const evaluateModel = defaults?.safeguard?.evaluateCommandImpact;
+				if (evaluateModel && verdict.risk !== "high" && isAmbiguousForModel(safeguardAnalysis)) {
+					const timeoutMs = Math.max(1, Math.floor(defaults?.safeguard?.timeoutSeconds ?? 20)) * 1e3;
+					const controller = new AbortController();
+					const onOuterAbort = () => controller.abort();
+					signal?.addEventListener("abort", onOuterAbort, { once: true });
+					const timer = setTimeout(() => controller.abort(), timeoutMs);
+					try {
+						const modelVerdict = parseModelRiskVerdict(await evaluateModel(params.command, controller.signal));
+						if (modelVerdict) verdict = mergeSafeguardVerdicts(verdict, modelVerdict);
+					} catch {} finally {
+						clearTimeout(timer);
+						signal?.removeEventListener("abort", onOuterAbort);
+					}
+				}
+				if (verdict.risk === "high") throw new Error([
+					"Safeguard blocked this command: predicted high system impact.",
+					`Reasons: ${verdict.reasons.join("; ")}`,
+					"This command was not run. If it is genuinely required, run it yourself or adjust tools.exec.safeguard."
+				].join("\n"));
+				if (verdict.risk === "medium" && !bypassApprovals) {
+					ask = "always";
+					warnings.push(`Safeguard: medium-risk command requires approval (${verdict.reasons.join("; ")}).`);
+				}
+			}
+			const sandbox = host === "sandbox" ? defaults?.sandbox : void 0;
+			if (target.selectedTarget === "sandbox" && !sandbox) throw new Error(["exec host=sandbox requires a sandbox runtime for this session.", "Enable sandbox mode (`agents.defaults.sandbox.mode=\"non-main\"` or `\"all\"`) or use host=auto/gateway/node."].join("\n"));
+			const explicitWorkdir = normalizeOptionalString(params.workdir);
+			const defaultWorkdir = normalizeOptionalString(defaults?.cwd);
+			let workdir;
+			let containerWorkdir = sandbox?.containerWorkdir;
+			if (sandbox) {
+				const resolved = await resolveSandboxWorkdir({
+					workdir: explicitWorkdir ?? defaultWorkdir ?? process.cwd(),
+					sandbox,
+					warnings
+				});
+				workdir = resolved.hostWorkdir;
+				containerWorkdir = resolved.containerWorkdir;
+			} else if (host === "node") workdir = explicitWorkdir;
+			else workdir = resolveWorkdir(explicitWorkdir ?? defaultWorkdir ?? process.cwd(), warnings);
+			rejectExecApprovalShellCommand(params.command);
+			const inheritedBaseEnv = coerceEnv(process.env);
+			const hostEnvResult = host === "sandbox" ? null : sanitizeHostExecEnvWithDiagnostics({
+				baseEnv: inheritedBaseEnv,
+				overrides: params.env,
+				blockPathOverrides: true
+			});
+			if (hostEnvResult && params.env && (hostEnvResult.rejectedOverrideBlockedKeys.length > 0 || hostEnvResult.rejectedOverrideInvalidKeys.length > 0)) {
+				const blockedKeys = hostEnvResult.rejectedOverrideBlockedKeys;
+				const invalidKeys = hostEnvResult.rejectedOverrideInvalidKeys;
+				const pathBlocked = blockedKeys.includes("PATH");
+				if (pathBlocked && blockedKeys.length === 1 && invalidKeys.length === 0) throw new Error("Security Violation: Custom 'PATH' variable is forbidden during host execution.");
+				if (blockedKeys.length === 1 && invalidKeys.length === 0) throw new Error(`Security Violation: Environment variable '${blockedKeys[0]}' is forbidden during host execution.`);
+				const details = [];
+				if (blockedKeys.length > 0) details.push(`blocked override keys: ${blockedKeys.join(", ")}`);
+				if (invalidKeys.length > 0) details.push(`invalid non-portable override keys: ${invalidKeys.join(", ")}`);
+				const suffix = details.join("; ");
+				if (pathBlocked) throw new Error(`Security Violation: Custom 'PATH' variable is forbidden during host execution (${suffix}).`);
+				throw new Error(`Security Violation: ${suffix}.`);
+			}
+			const env = sandbox && host === "sandbox" ? buildSandboxEnv({
+				defaultPath: DEFAULT_PATH,
+				paramsEnv: params.env,
+				sandboxEnv: sandbox.env,
+				containerWorkdir: containerWorkdir ?? sandbox.containerWorkdir
+			}) : hostEnvResult?.env ?? inheritedBaseEnv;
+			if (!sandbox && host === "gateway" && !params.env?.PATH) applyShellPath(env, getShellPathFromLoginShell({
+				env: process.env,
+				timeoutMs: resolveShellEnvFallbackTimeoutMs(process.env)
+			}));
+			if (host === "node" && defaultPathPrepend.length > 0) warnings.push("Warning: tools.exec.pathPrepend is ignored for host=node. Configure PATH on the node host/service instead.");
+			else applyPathPrepend(env, defaultPathPrepend);
+			if (host === "node") return executeNodeHostCommand({
+				command: params.command,
+				workdir,
+				env,
+				requestedEnv: params.env,
+				requestedNode: params.node?.trim(),
+				boundNode: defaults?.node?.trim(),
+				sessionKey: defaults?.sessionKey,
+				turnSourceChannel: defaults?.messageProvider,
+				turnSourceTo: defaults?.currentChannelId,
+				turnSourceAccountId: defaults?.accountId,
+				turnSourceThreadId: defaults?.currentThreadTs,
+				agentId,
+				security,
+				ask,
+				strictInlineEval: defaults?.strictInlineEval,
+				trigger: defaults?.trigger,
+				timeoutSec: params.timeout,
+				defaultTimeoutSec,
+				approvalRunningNoticeMs,
+				warnings,
+				notifySessionKey,
+				notifyOnExit,
+				trustedSafeBinDirs
+			});
+			if (!workdir) throw new Error("exec internal error: local execution requires a resolved workdir");
+			if (host === "gateway" && !bypassApprovals) {
+				const gatewayResult = await processGatewayAllowlist({
+					command: params.command,
+					workdir,
+					env,
+					requestedEnv: params.env,
+					pty: params.pty === true && !sandbox,
+					timeoutSec: params.timeout,
+					defaultTimeoutSec,
+					security,
+					ask,
+					safeBins,
+					safeBinProfiles,
+					strictInlineEval: defaults?.strictInlineEval,
+					trigger: defaults?.trigger,
+					agentId,
+					sessionKey: defaults?.sessionKey,
+					turnSourceChannel: defaults?.messageProvider,
+					turnSourceTo: defaults?.currentChannelId,
+					turnSourceAccountId: defaults?.accountId,
+					turnSourceThreadId: defaults?.currentThreadTs,
+					scopeKey: defaults?.scopeKey,
+					warnings,
+					notifySessionKey,
+					approvalRunningNoticeMs,
+					maxOutput,
+					pendingMaxOutput,
+					trustedSafeBinDirs
+				});
+				if (gatewayResult.pendingResult) return gatewayResult.pendingResult;
+				execCommandOverride = gatewayResult.execCommandOverride;
+				if (gatewayResult.allowWithoutEnforcedCommand) execCommandOverride = void 0;
+			}
+			const explicitTimeoutSec = typeof params.timeout === "number" ? params.timeout : null;
+			const effectiveTimeout = allowBackground && explicitTimeoutSec === null && (backgroundRequested || yieldRequested) ? null : explicitTimeoutSec ?? defaultTimeoutSec;
+			const getWarningText = () => warnings.length ? `${warnings.join("\n")}\n\n` : "";
+			const usePty = params.pty === true && !sandbox;
+			if (!shouldSkipExecScriptPreflight({
+				host,
+				security,
+				ask
+			})) await validateScriptFileForShellBleed({
+				command: params.command,
+				workdir
+			});
+			const run = await runExecProcess({
+				command: params.command,
+				execCommand: execCommandOverride,
+				workdir,
+				env,
+				sandbox,
+				containerWorkdir,
+				usePty,
+				warnings,
+				maxOutput,
+				pendingMaxOutput,
+				notifyOnExit,
+				notifyOnExitEmptySuccess,
+				scopeKey: defaults?.scopeKey,
+				sessionKey: notifySessionKey,
+				notifyDeliveryContext,
+				timeoutSec: effectiveTimeout,
+				onUpdate
+			});
+			let yielded = false;
+			let yieldTimer = null;
+			const onAbortSignal = () => {
+				run.disableUpdates();
+				if (yielded || run.session.backgrounded) return;
+				run.kill();
+			};
+			if (signal?.aborted) onAbortSignal();
+			else if (signal) signal.addEventListener("abort", onAbortSignal, { once: true });
+			return new Promise((resolve, reject) => {
+				const resolveRunning = () => resolve({
+					content: [{
+						type: "text",
+						text: `${getWarningText()}Command still running (session ${run.session.id}, pid ${run.session.pid ?? "n/a"}). Use process (list/poll/log/write/kill/clear/remove) for follow-up.`
+					}],
+					details: {
+						status: "running",
+						sessionId: run.session.id,
+						pid: run.session.pid ?? void 0,
+						startedAt: run.startedAt,
+						cwd: run.session.cwd,
+						tail: run.session.tail
+					}
+				});
+				const onYieldNow = () => {
+					if (yieldTimer) clearTimeout(yieldTimer);
+					if (yielded) return;
+					yielded = true;
+					markBackgrounded(run.session);
+					resolveRunning();
+				};
+				if (allowBackground && yieldWindow !== null) if (yieldWindow === 0) onYieldNow();
+				else yieldTimer = setTimeout(() => {
+					if (yielded) return;
+					yielded = true;
+					markBackgrounded(run.session);
+					resolveRunning();
+				}, yieldWindow);
+				run.promise.then((outcome) => {
+					if (yieldTimer) clearTimeout(yieldTimer);
+					if (yielded || run.session.backgrounded) return;
+					resolve(buildExecForegroundResult({
+						outcome,
+						cwd: run.session.cwd,
+						warningText: getWarningText()
+					}));
+				}).catch((err) => {
+					if (yieldTimer) clearTimeout(yieldTimer);
+					if (yielded || run.session.backgrounded) return;
+					reject(err);
+				});
+			});
+		}
+	};
+}
+const execTool = createExecTool();
+//#endregion
+//#region src/agents/pty-keys.ts
+const ESC = "\x1B";
+const CR = "\r";
+const TAB = "	";
+const BACKSPACE = "";
+const BRACKETED_PASTE_START = `${ESC}[200~`;
+const BRACKETED_PASTE_END = `${ESC}[201~`;
+/** SS3 sequences for DECCKM application cursor key mode (smkx). */
+const DECCKM_SS3_KEYS = {
+	up: `${ESC}OA`,
+	down: `${ESC}OB`,
+	right: `${ESC}OC`,
+	left: `${ESC}OD`,
+	home: `${ESC}OH`,
+	end: `${ESC}OF`
+};
+const namedKeyMap = new Map([
+	["enter", CR],
+	["return", CR],
+	["tab", TAB],
+	["escape", ESC],
+	["esc", ESC],
+	["space", " "],
+	["bspace", BACKSPACE],
+	["backspace", BACKSPACE],
+	["up", `${ESC}[A`],
+	["down", `${ESC}[B`],
+	["right", `${ESC}[C`],
+	["left", `${ESC}[D`],
+	["home", `${ESC}[1~`],
+	["end", `${ESC}[4~`],
+	["pageup", `${ESC}[5~`],
+	["pgup", `${ESC}[5~`],
+	["ppage", `${ESC}[5~`],
+	["pagedown", `${ESC}[6~`],
+	["pgdn", `${ESC}[6~`],
+	["npage", `${ESC}[6~`],
+	["insert", `${ESC}[2~`],
+	["ic", `${ESC}[2~`],
+	["delete", `${ESC}[3~`],
+	["del", `${ESC}[3~`],
+	["dc", `${ESC}[3~`],
+	["btab", `${ESC}[Z`],
+	["f1", `${ESC}OP`],
+	["f2", `${ESC}OQ`],
+	["f3", `${ESC}OR`],
+	["f4", `${ESC}OS`],
+	["f5", `${ESC}[15~`],
+	["f6", `${ESC}[17~`],
+	["f7", `${ESC}[18~`],
+	["f8", `${ESC}[19~`],
+	["f9", `${ESC}[20~`],
+	["f10", `${ESC}[21~`],
+	["f11", `${ESC}[23~`],
+	["f12", `${ESC}[24~`],
+	["kp/", `${ESC}Oo`],
+	["kp*", `${ESC}Oj`],
+	["kp-", `${ESC}Om`],
+	["kp+", `${ESC}Ok`],
+	["kp7", `${ESC}Ow`],
+	["kp8", `${ESC}Ox`],
+	["kp9", `${ESC}Oy`],
+	["kp4", `${ESC}Ot`],
+	["kp5", `${ESC}Ou`],
+	["kp6", `${ESC}Ov`],
+	["kp1", `${ESC}Oq`],
+	["kp2", `${ESC}Or`],
+	["kp3", `${ESC}Os`],
+	["kp0", `${ESC}Op`],
+	["kp.", `${ESC}On`],
+	["kpenter", `${ESC}OM`]
+]);
+const modifiableNamedKeys = new Set([
+	"up",
+	"down",
+	"left",
+	"right",
+	"home",
+	"end",
+	"pageup",
+	"pgup",
+	"ppage",
+	"pagedown",
+	"pgdn",
+	"npage",
+	"insert",
+	"ic",
+	"delete",
+	"del",
+	"dc"
+]);
+function hasCursorModeSensitiveKeys(request) {
+	return request.keys?.some((raw) => {
+		const token = raw.trim();
+		if (!token) return false;
+		const parsed = parseModifiers(token);
+		if (hasAnyModifier(parsed.mods)) return false;
+		return normalizeLowercaseStringOrEmpty(parsed.base) in DECCKM_SS3_KEYS;
+	}) ?? false;
+}
+function encodeKeySequence(request, cursorKeyMode) {
+	const warnings = [];
+	let data = "";
+	if (request.literal) data += request.literal;
+	if (request.hex?.length) for (const raw of request.hex) {
+		const byte = parseHexByte(raw);
+		if (byte === null) {
+			warnings.push(`Invalid hex byte: ${raw}`);
+			continue;
+		}
+		data += String.fromCharCode(byte);
+	}
+	if (request.keys?.length) for (const token of request.keys) data += encodeKeyToken(token, warnings, cursorKeyMode);
+	return {
+		data,
+		warnings
+	};
+}
+function encodePaste(text, bracketed = true) {
+	if (!bracketed) return text;
+	return `${BRACKETED_PASTE_START}${text}${BRACKETED_PASTE_END}`;
+}
+function encodeKeyToken(raw, warnings, cursorKeyMode) {
+	const token = raw.trim();
+	if (!token) return "";
+	if (token.length === 2 && token.startsWith("^")) {
+		const ctrl = toCtrlChar(token[1]);
+		if (ctrl) return ctrl;
+	}
+	const parsed = parseModifiers(token);
+	const base = parsed.base;
+	const baseLower = normalizeLowercaseStringOrEmpty(base);
+	if (baseLower === "tab" && parsed.mods.shift) return `${ESC}[Z`;
+	if (modifiableNamedKeys.has(baseLower) && cursorKeyMode === "application" && !hasAnyModifier(parsed.mods)) {
+		const ss3Seq = DECCKM_SS3_KEYS[baseLower];
+		if (ss3Seq) return ss3Seq;
+	}
+	const baseSeq = namedKeyMap.get(baseLower);
+	if (baseSeq) {
+		let seq = baseSeq;
+		if (modifiableNamedKeys.has(baseLower) && hasAnyModifier(parsed.mods)) {
+			const mod = xtermModifier(parsed.mods);
+			if (mod > 1) {
+				const modified = applyXtermModifier(seq, mod);
+				if (modified) {
+					seq = modified;
+					return seq;
+				}
+			}
+		}
+		if (parsed.mods.alt) return `${ESC}${seq}`;
+		return seq;
+	}
+	if (base.length === 1) return applyCharModifiers(base, parsed.mods);
+	if (parsed.hasModifiers) warnings.push(`Unknown key "${base}" for modifiers; sending literal.`);
+	return base;
+}
+function parseModifiers(token) {
+	const mods = {
+		ctrl: false,
+		alt: false,
+		shift: false
+	};
+	let rest = token;
+	let sawModifiers = false;
+	while (rest.length > 2 && rest[1] === "-") {
+		const mod = normalizeLowercaseStringOrEmpty(rest[0]);
+		if (mod === "c") mods.ctrl = true;
+		else if (mod === "m") mods.alt = true;
+		else if (mod === "s") mods.shift = true;
+		else break;
+		sawModifiers = true;
+		rest = rest.slice(2);
+	}
+	return {
+		mods,
+		base: rest,
+		hasModifiers: sawModifiers
+	};
+}
+function applyCharModifiers(char, mods) {
+	let value = char;
+	if (mods.shift && value.length === 1 && /[a-z]/.test(value)) value = value.toUpperCase();
+	if (mods.ctrl) {
+		const ctrl = toCtrlChar(value);
+		if (ctrl) value = ctrl;
+	}
+	if (mods.alt) value = `${ESC}${value}`;
+	return value;
+}
+function toCtrlChar(char) {
+	if (char.length !== 1) return null;
+	if (char === "?") return "";
+	const code = char.toUpperCase().charCodeAt(0);
+	if (code >= 64 && code <= 95) return String.fromCharCode(code & 31);
+	return null;
+}
+function xtermModifier(mods) {
+	let mod = 1;
+	if (mods.shift) mod += 1;
+	if (mods.alt) mod += 2;
+	if (mods.ctrl) mod += 4;
+	return mod;
+}
+function applyXtermModifier(sequence, modifier) {
+	const escPattern = escapeRegExp(ESC);
+	const csiNumber = new RegExp(`^${escPattern}\\[(\\d+)([~A-Z])$`);
+	const csiArrow = new RegExp(`^${escPattern}\\[(A|B|C|D|H|F)$`);
+	const numberMatch = sequence.match(csiNumber);
+	if (numberMatch) return `${ESC}[${numberMatch[1]};${modifier}${numberMatch[2]}`;
+	const arrowMatch = sequence.match(csiArrow);
+	if (arrowMatch) return `${ESC}[1;${modifier}${arrowMatch[1]}`;
+	return null;
+}
+function hasAnyModifier(mods) {
+	return mods.ctrl || mods.alt || mods.shift;
+}
+function parseHexByte(raw) {
+	const lower = normalizeLowercaseStringOrEmpty(raw);
+	const normalized = lower.startsWith("0x") ? lower.slice(2) : lower;
+	if (!/^[0-9a-f]{1,2}$/.test(normalized)) return null;
+	const value = Number.parseInt(normalized, 16);
+	if (Number.isNaN(value) || value < 0 || value > 255) return null;
+	return value;
+}
+//#endregion
+//#region src/agents/bash-tools.process-send-keys.ts
+function failText$1(text) {
+	return {
+		content: [{
+			type: "text",
+			text
+		}],
+		details: { status: "failed" }
+	};
+}
+async function writeToStdin(stdin, data) {
+	await new Promise((resolve, reject) => {
+		stdin.write(data, (err) => {
+			if (err) reject(err);
+			else resolve();
+		});
+	});
+}
+async function handleProcessSendKeys(params) {
+	const request = {
+		keys: params.keys,
+		hex: params.hex,
+		literal: params.literal
+	};
+	if (params.session.cursorKeyMode === "unknown" && hasCursorModeSensitiveKeys(request)) return failText$1(`Session ${params.sessionId} cursor key mode is not known yet. Poll or log until startup output appears, then retry send-keys.`);
+	const { data, warnings } = encodeKeySequence(request, params.session.cursorKeyMode === "unknown" ? void 0 : params.session.cursorKeyMode);
+	if (!data) return failText$1("No key data provided.");
+	await writeToStdin(params.stdin, data);
+	return {
+		content: [{
+			type: "text",
+			text: `Sent ${data.length} bytes to session ${params.sessionId}.` + (warnings.length ? `\nWarnings:\n- ${warnings.join("\n- ")}` : "")
+		}],
+		details: {
+			status: "running",
+			sessionId: params.sessionId,
+			name: deriveSessionName(params.session.command)
+		}
+	};
+}
+//#endregion
+//#region src/agents/bash-tools.process.ts
+const DEFAULT_LOG_TAIL_LINES = 200;
+function resolveLogSliceWindow(offset, limit) {
+	const usingDefaultTail = offset === void 0 && limit === void 0;
+	return {
+		effectiveOffset: offset,
+		effectiveLimit: typeof limit === "number" && Number.isFinite(limit) ? limit : usingDefaultTail ? DEFAULT_LOG_TAIL_LINES : void 0,
+		usingDefaultTail
+	};
+}
+function defaultTailNote(totalLines, usingDefaultTail) {
+	if (!usingDefaultTail || totalLines <= DEFAULT_LOG_TAIL_LINES) return "";
+	return `\n\n[showing last ${DEFAULT_LOG_TAIL_LINES} of ${totalLines} lines; pass offset/limit to page]`;
+}
+const MAX_POLL_WAIT_MS = 12e4;
+function resolvePollWaitMs(value) {
+	if (typeof value === "number" && Number.isFinite(value)) return Math.max(0, Math.min(MAX_POLL_WAIT_MS, Math.floor(value)));
+	if (typeof value === "string") {
+		const parsed = Number.parseInt(value.trim(), 10);
+		if (Number.isFinite(parsed)) return Math.max(0, Math.min(MAX_POLL_WAIT_MS, parsed));
+	}
+	return 0;
+}
+function failText(text) {
+	return {
+		content: [{
+			type: "text",
+			text
+		}],
+		details: { status: "failed" }
+	};
+}
+function recordPollRetrySuggestion(sessionId, hasNewOutput) {
+	try {
+		return recordCommandPoll(getDiagnosticSessionState({ sessionId }), sessionId, hasNewOutput);
+	} catch {
+		return;
+	}
+}
+function resetPollRetrySuggestion(sessionId) {
+	try {
+		resetCommandPollCount(getDiagnosticSessionState({ sessionId }), sessionId);
+	} catch {}
+}
+function createProcessTool(defaults) {
+	if (defaults?.cleanupMs !== void 0) setJobTtlMs(defaults.cleanupMs);
+	const scopeKey = defaults?.scopeKey;
+	const supervisor = getProcessSupervisor();
+	const isInScope = (session) => !scopeKey || session?.scopeKey === scopeKey;
+	const cancelManagedSession = (sessionId) => {
+		const record = supervisor.getRecord(sessionId);
+		if (!record || record.state === "exited") return false;
+		supervisor.cancel(sessionId, "manual-cancel");
+		return true;
+	};
+	const terminateSessionFallback = (session) => {
+		const pid = session.pid ?? session.child?.pid;
+		if (typeof pid !== "number" || !Number.isFinite(pid) || pid <= 0) return false;
+		killProcessTree(pid);
+		return true;
+	};
+	return {
+		name: "process",
+		label: "process",
+		displaySummary: PROCESS_TOOL_DISPLAY_SUMMARY,
+		description: describeProcessTool({ hasCronTool: defaults?.hasCronTool === true }),
+		parameters: processSchema,
+		execute: async (_toolCallId, args, _signal, _onUpdate) => {
+			const params = args;
+			if (params.action === "list") {
+				const running = listRunningSessions().filter((s) => isInScope(s)).map((s) => ({
+					sessionId: s.id,
+					status: "running",
+					pid: s.pid ?? void 0,
+					startedAt: s.startedAt,
+					runtimeMs: Date.now() - s.startedAt,
+					cwd: s.cwd,
+					command: s.command,
+					name: deriveSessionName(s.command),
+					tail: s.tail,
+					truncated: s.truncated
+				}));
+				const finished = listFinishedSessions().filter((s) => isInScope(s)).map((s) => ({
+					sessionId: s.id,
+					status: s.status,
+					startedAt: s.startedAt,
+					endedAt: s.endedAt,
+					runtimeMs: s.endedAt - s.startedAt,
+					cwd: s.cwd,
+					command: s.command,
+					name: deriveSessionName(s.command),
+					tail: s.tail,
+					truncated: s.truncated,
+					exitCode: s.exitCode ?? void 0,
+					exitSignal: s.exitSignal ?? void 0
+				}));
+				return {
+					content: [{
+						type: "text",
+						text: [...running, ...finished].toSorted((a, b) => b.startedAt - a.startedAt).map((s) => {
+							const label = s.name ? truncateMiddle(s.name, 80) : truncateMiddle(s.command, 120);
+							return `${s.sessionId} ${pad(s.status, 9)} ${formatDurationCompact(s.runtimeMs) ?? "n/a"} :: ${label}`;
+						}).join("\n") || "No running or recent sessions."
+					}],
+					details: {
+						status: "completed",
+						sessions: [...running, ...finished]
+					}
+				};
+			}
+			if (!params.sessionId) return {
+				content: [{
+					type: "text",
+					text: "sessionId is required for this action."
+				}],
+				details: { status: "failed" }
+			};
+			const session = getSession(params.sessionId);
+			const finished = getFinishedSession(params.sessionId);
+			const scopedSession = isInScope(session) ? session : void 0;
+			const scopedFinished = isInScope(finished) ? finished : void 0;
+			const failedResult = (text) => ({
+				content: [{
+					type: "text",
+					text
+				}],
+				details: { status: "failed" }
+			});
+			const resolveBackgroundedWritableStdin = () => {
+				if (!scopedSession) return {
+					ok: false,
+					result: failedResult(`No active session found for ${params.sessionId}`)
+				};
+				if (!scopedSession.backgrounded) return {
+					ok: false,
+					result: failedResult(`Session ${params.sessionId} is not backgrounded.`)
+				};
+				const stdin = scopedSession.stdin ?? scopedSession.child?.stdin;
+				if (!stdin || stdin.destroyed) return {
+					ok: false,
+					result: failedResult(`Session ${params.sessionId} stdin is not writable.`)
+				};
+				return {
+					ok: true,
+					session: scopedSession,
+					stdin
+				};
+			};
+			const writeToStdin = async (stdin, data) => {
+				await new Promise((resolve, reject) => {
+					stdin.write(data, (err) => {
+						if (err) reject(err);
+						else resolve();
+					});
+				});
+			};
+			const runningSessionResult = (session, text) => ({
+				content: [{
+					type: "text",
+					text
+				}],
+				details: {
+					status: "running",
+					sessionId: params.sessionId,
+					name: deriveSessionName(session.command)
+				}
+			});
+			switch (params.action) {
+				case "poll": {
+					if (!scopedSession) {
+						if (scopedFinished) {
+							resetPollRetrySuggestion(params.sessionId);
+							return {
+								content: [{
+									type: "text",
+									text: (scopedFinished.tail || `(no output recorded${scopedFinished.truncated ? " — truncated to cap" : ""})`) + `\n\nProcess exited with ${scopedFinished.exitSignal ? `signal ${scopedFinished.exitSignal}` : `code ${scopedFinished.exitCode ?? 0}`}.`
+								}],
+								details: {
+									status: scopedFinished.status === "completed" ? "completed" : "failed",
+									sessionId: params.sessionId,
+									exitCode: scopedFinished.exitCode ?? void 0,
+									aggregated: scopedFinished.aggregated,
+									name: deriveSessionName(scopedFinished.command)
+								}
+							};
+						}
+						resetPollRetrySuggestion(params.sessionId);
+						return failText(`No session found for ${params.sessionId}`);
+					}
+					if (!scopedSession.backgrounded) return failText(`Session ${params.sessionId} is not backgrounded.`);
+					const pollWaitMs = resolvePollWaitMs(params.timeout);
+					if (pollWaitMs > 0 && !scopedSession.exited) {
+						const deadline = Date.now() + pollWaitMs;
+						while (!scopedSession.exited && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, Math.max(0, Math.min(250, deadline - Date.now()))));
+					}
+					const { stdout, stderr } = drainSession(scopedSession);
+					const exited = scopedSession.exited;
+					const exitCode = scopedSession.exitCode ?? 0;
+					const exitSignal = scopedSession.exitSignal ?? void 0;
+					if (exited) {
+						const status = exitCode === 0 && exitSignal == null ? "completed" : "failed";
+						markExited(scopedSession, scopedSession.exitCode ?? null, scopedSession.exitSignal ?? null, status);
+					}
+					const status = exited ? exitCode === 0 && exitSignal == null ? "completed" : "failed" : "running";
+					const output = [stdout.trimEnd(), stderr.trimEnd()].filter(Boolean).join("\n").trim();
+					const hasNewOutput = output.length > 0;
+					const retryInMs = exited ? void 0 : recordPollRetrySuggestion(params.sessionId, hasNewOutput);
+					if (exited) resetPollRetrySuggestion(params.sessionId);
+					return {
+						content: [{
+							type: "text",
+							text: (output || "(no new output)") + (exited ? `\n\nProcess exited with ${exitSignal ? `signal ${exitSignal}` : `code ${exitCode}`}.` : "\n\nProcess still running.")
+						}],
+						details: {
+							status,
+							sessionId: params.sessionId,
+							exitCode: exited ? exitCode : void 0,
+							aggregated: scopedSession.aggregated,
+							name: deriveSessionName(scopedSession.command),
+							...typeof retryInMs === "number" ? { retryInMs } : {}
+						}
+					};
+				}
+				case "log":
+					if (scopedSession) {
+						if (!scopedSession.backgrounded) return {
+							content: [{
+								type: "text",
+								text: `Session ${params.sessionId} is not backgrounded.`
+							}],
+							details: { status: "failed" }
+						};
+						const window = resolveLogSliceWindow(params.offset, params.limit);
+						const { slice, totalLines, totalChars } = sliceLogLines(scopedSession.aggregated, window.effectiveOffset, window.effectiveLimit);
+						const logDefaultTailNote = defaultTailNote(totalLines, window.usingDefaultTail);
+						return {
+							content: [{
+								type: "text",
+								text: (slice || "(no output yet)") + logDefaultTailNote
+							}],
+							details: {
+								status: scopedSession.exited ? "completed" : "running",
+								sessionId: params.sessionId,
+								total: totalLines,
+								totalLines,
+								totalChars,
+								truncated: scopedSession.truncated,
+								name: deriveSessionName(scopedSession.command)
+							}
+						};
+					}
+					if (scopedFinished) {
+						const window = resolveLogSliceWindow(params.offset, params.limit);
+						const { slice, totalLines, totalChars } = sliceLogLines(scopedFinished.aggregated, window.effectiveOffset, window.effectiveLimit);
+						const status = scopedFinished.status === "completed" ? "completed" : "failed";
+						const logDefaultTailNote = defaultTailNote(totalLines, window.usingDefaultTail);
+						return {
+							content: [{
+								type: "text",
+								text: (slice || "(no output recorded)") + logDefaultTailNote
+							}],
+							details: {
+								status,
+								sessionId: params.sessionId,
+								total: totalLines,
+								totalLines,
+								totalChars,
+								truncated: scopedFinished.truncated,
+								exitCode: scopedFinished.exitCode ?? void 0,
+								exitSignal: scopedFinished.exitSignal ?? void 0,
+								name: deriveSessionName(scopedFinished.command)
+							}
+						};
+					}
+					return {
+						content: [{
+							type: "text",
+							text: `No session found for ${params.sessionId}`
+						}],
+						details: { status: "failed" }
+					};
+				case "write": {
+					const resolved = resolveBackgroundedWritableStdin();
+					if (!resolved.ok) return resolved.result;
+					await writeToStdin(resolved.stdin, params.data ?? "");
+					if (params.eof) resolved.stdin.end();
+					return runningSessionResult(resolved.session, `Wrote ${(params.data ?? "").length} bytes to session ${params.sessionId}${params.eof ? " (stdin closed)" : ""}.`);
+				}
+				case "send-keys": {
+					const resolved = resolveBackgroundedWritableStdin();
+					if (!resolved.ok) return resolved.result;
+					return await handleProcessSendKeys({
+						sessionId: params.sessionId,
+						session: resolved.session,
+						stdin: resolved.stdin,
+						keys: params.keys,
+						hex: params.hex,
+						literal: params.literal
+					});
+				}
+				case "submit": {
+					const resolved = resolveBackgroundedWritableStdin();
+					if (!resolved.ok) return resolved.result;
+					await writeToStdin(resolved.stdin, "\r");
+					return runningSessionResult(resolved.session, `Submitted session ${params.sessionId} (sent CR).`);
+				}
+				case "paste": {
+					const resolved = resolveBackgroundedWritableStdin();
+					if (!resolved.ok) return resolved.result;
+					const payload = encodePaste(params.text ?? "", params.bracketed !== false);
+					if (!payload) return {
+						content: [{
+							type: "text",
+							text: "No paste text provided."
+						}],
+						details: { status: "failed" }
+					};
+					await writeToStdin(resolved.stdin, payload);
+					return runningSessionResult(resolved.session, `Pasted ${params.text?.length ?? 0} chars to session ${params.sessionId}.`);
+				}
+				case "kill": {
+					if (!scopedSession) return failText(`No active session found for ${params.sessionId}`);
+					if (!scopedSession.backgrounded) return failText(`Session ${params.sessionId} is not backgrounded.`);
+					const canceled = cancelManagedSession(scopedSession.id);
+					if (!canceled) {
+						if (!terminateSessionFallback(scopedSession)) return failText(`Unable to terminate session ${params.sessionId}: no active supervisor run or process id.`);
+						markExited(scopedSession, null, "SIGKILL", "failed");
+					}
+					resetPollRetrySuggestion(params.sessionId);
+					return {
+						content: [{
+							type: "text",
+							text: canceled ? `Termination requested for session ${params.sessionId}.` : `Killed session ${params.sessionId}.`
+						}],
+						details: {
+							status: "failed",
+							name: scopedSession ? deriveSessionName(scopedSession.command) : void 0
+						}
+					};
+				}
+				case "clear":
+					if (scopedFinished) {
+						resetPollRetrySuggestion(params.sessionId);
+						deleteSession(params.sessionId);
+						return {
+							content: [{
+								type: "text",
+								text: `Cleared session ${params.sessionId}.`
+							}],
+							details: { status: "completed" }
+						};
+					}
+					return {
+						content: [{
+							type: "text",
+							text: `No finished session found for ${params.sessionId}`
+						}],
+						details: { status: "failed" }
+					};
+				case "remove":
+					if (scopedSession) {
+						const canceled = cancelManagedSession(scopedSession.id);
+						if (canceled) {
+							scopedSession.backgrounded = false;
+							deleteSession(params.sessionId);
+						} else {
+							if (!terminateSessionFallback(scopedSession)) return failText(`Unable to remove session ${params.sessionId}: no active supervisor run or process id.`);
+							markExited(scopedSession, null, "SIGKILL", "failed");
+							deleteSession(params.sessionId);
+						}
+						resetPollRetrySuggestion(params.sessionId);
+						return {
+							content: [{
+								type: "text",
+								text: canceled ? `Removed session ${params.sessionId} (termination requested).` : `Removed session ${params.sessionId}.`
+							}],
+							details: {
+								status: "failed",
+								name: scopedSession ? deriveSessionName(scopedSession.command) : void 0
+							}
+						};
+					}
+					if (scopedFinished) {
+						resetPollRetrySuggestion(params.sessionId);
+						deleteSession(params.sessionId);
+						return {
+							content: [{
+								type: "text",
+								text: `Removed session ${params.sessionId}.`
+							}],
+							details: { status: "completed" }
+						};
+					}
+					return {
+						content: [{
+							type: "text",
+							text: `No session found for ${params.sessionId}`
+						}],
+						details: { status: "failed" }
+					};
+			}
+			return {
+				content: [{
+					type: "text",
+					text: `Unknown action ${params.action}`
+				}],
+				details: { status: "failed" }
+			};
+		}
+	};
+}
+const processTool = createProcessTool();
+//#endregion
+export { execTool as i, processTool as n, createExecTool as r, createProcessTool as t };