@probelabs/visor 0.1.131 → 0.1.132

package/dist/sdk/{chunk-MQ57AB4U.mjs → chunk-XGI47XIH.mjs}

@@ -28,7 +28,7 @@ import {
 import {
   config_exports,
   init_config
-} from "./chunk-LQ5B4T6L.mjs";
+} from "./chunk-U3BLLEW3.mjs";
 import {
   ExecutionJournal,
   checkLoopBudget,
@@ -37,11 +37,11 @@ import {
   init_routing,
   init_snapshot_store,
   snapshot_store_exports
-} from "./chunk-2GCSK3PD.mjs";
+} from "./chunk-BGBXLPLL.mjs";
 import {
   FailureConditionEvaluator,
   init_failure_condition_evaluator
-} from "./chunk-EBTD2D4L.mjs";
+} from "./chunk-27RV5RR2.mjs";
 import {
   addEvent,
   emitNdjsonFallback,
@@ -52,7 +52,7 @@ import {
   setSpanAttributes,
   trace_helpers_exports,
   withActiveSpan
-} from "./chunk-N4I6ZDCJ.mjs";
+} from "./chunk-VG7FWDC2.mjs";
 import {
   addDiagramBlock,
   init_metrics
@@ -1049,7 +1049,7 @@ ${this.escapeXml(processedFallbackDiff)}
       <user>${this.escapeXml(String(m.user || ""))}</user>
       <text>${this.escapeXml(String(m.text || ""))}</text>
       <timestamp>${this.escapeXml(String(m.timestamp || ""))}</timestamp>
-      <origin>${this.escapeXml(String(m.origin || ""))}</origin>
+      <origin>${this.escapeXml(String(m.origin || ""))}</origin>${this.formatFilesXml(m.files)}
     </message>`;
             }
             xml += `
@@ -1061,7 +1061,7 @@ ${this.escapeXml(processedFallbackDiff)}
     <user>${this.escapeXml(String(current.user || ""))}</user>
     <text>${this.escapeXml(String(current.text || ""))}</text>
     <timestamp>${this.escapeXml(String(current.timestamp || ""))}</timestamp>
-    <origin>${this.escapeXml(String(current.origin || ""))}</origin>
+    <origin>${this.escapeXml(String(current.origin || ""))}</origin>${this.formatFilesXml(current.files)}
   </current>
 </slack_context>`;
           return xml;
@@ -1069,6 +1069,25 @@ ${this.escapeXml(processedFallbackDiff)}
           return "";
         }
       }
+      /** Render file attachment metadata as XML fragment for a message. */
+      formatFilesXml(files) {
+        if (!Array.isArray(files) || files.length === 0) return "";
+        let xml = `
+      <files>`;
+        for (const f of files) {
+          xml += `
+        <file>
+          <name>${this.escapeXml(String(f.name || ""))}</name>
+          <mimetype>${this.escapeXml(String(f.mimetype || ""))}</mimetype>
+          <filetype>${this.escapeXml(String(f.filetype || ""))}</filetype>
+          <url>${this.escapeXml(String(f.url_private || f.permalink || ""))}</url>
+          <size>${f.size || 0}</size>
+        </file>`;
+        }
+        xml += `
+      </files>`;
+        return xml;
+      }
       /**
        * Build a normalized ConversationContext for GitHub (PR/issue + comments)
        * using the same contract as Slack's ConversationContext. This is exposed
@@ -1574,6 +1593,9 @@ ${"=".repeat(60)}
           if (this.config.enableTasks !== void 0) {
             options.enableTasks = this.config.enableTasks;
           }
+          if (this.config.enableExecutePlan !== void 0) {
+            options.enableExecutePlan = this.config.enableExecutePlan;
+          }
           if (this.config.retry) {
             options.retry = this.config.retry;
           }
@@ -1600,6 +1622,9 @@ ${"=".repeat(60)}
           if (this.config.completionPrompt !== void 0) {
             options.completionPrompt = this.config.completionPrompt;
           }
+          if (this.config.concurrencyLimiter) {
+            options.concurrencyLimiter = this.config.concurrencyLimiter;
+          }
           try {
             const cfgAny = this.config;
             const allowedFolders = cfgAny.allowedFolders;
@@ -2018,7 +2043,22 @@ ${"=".repeat(60)}
           log("\u{1F4CB} Full response preview:", response);
         }
         try {
-          let reviewData;
+          let reviewData = void 0;
+          const RAW_OUTPUT_RE = /\n<<<RAW_OUTPUT>>>\n([\s\S]*?)\n<<<END_RAW_OUTPUT>>>/g;
+          const rawOutputBlocks = [];
+          let responseForParsing = response;
+          {
+            let rawMatch;
+            while ((rawMatch = RAW_OUTPUT_RE.exec(response)) !== null) {
+              rawOutputBlocks.push(rawMatch[1]);
+            }
+            if (rawOutputBlocks.length > 0) {
+              responseForParsing = response.replace(RAW_OUTPUT_RE, "");
+              log(
+                `\u{1F4E6} Extracted ${rawOutputBlocks.length} RAW_OUTPUT blocks (${rawOutputBlocks.reduce((s, b) => s + b.length, 0)} chars) from response`
+              );
+            }
+          }
           if (_schema === "plain" || !_schema) {
             log(
               `\u{1F4CB} ${_schema === "plain" ? "Plain" : "No"} schema detected - treating raw response as text output`
@@ -2035,7 +2075,7 @@ ${"=".repeat(60)}
           }
           {
             log("\u{1F50D} Extracting JSON from AI response...");
-            const sanitizedResponse = response.replace(/^\uFEFF/, "").replace(/[\u200B-\u200D\uFEFF\u00A0]/g, "").replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "").trim();
+            const sanitizedResponse = responseForParsing.replace(/^\uFEFF/, "").replace(/[\u200B-\u200D\uFEFF\u00A0]/g, "").replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "").trim();
             try {
               reviewData = JSON.parse(sanitizedResponse);
               log("\u2705 Successfully parsed direct JSON response");
@@ -2043,22 +2083,48 @@ ${"=".repeat(60)}
             } catch (parseErr) {
               const errMsg = parseErr instanceof Error ? parseErr.message : String(parseErr);
               log(`\u{1F50D} Direct JSON parsing failed: ${errMsg}`);
-              if (response.toLowerCase().includes("i cannot") || response.toLowerCase().includes("unable to")) {
-                console.error("\u{1F6AB} AI refused to analyze - returning refusal as output");
-                const trimmed2 = response.trim();
+              let recovered = false;
+              const trailingMatch = errMsg.match(/after JSON at position (\d+)/);
+              if (trailingMatch) {
+                const pos = parseInt(trailingMatch[1], 10);
+                try {
+                  reviewData = JSON.parse(sanitizedResponse.substring(0, pos));
+                  const trailing = sanitizedResponse.substring(pos).trim();
+                  if (trailing && reviewData && typeof reviewData === "object" && typeof reviewData.text === "string") {
+                    reviewData.text = reviewData.text + "\n\n" + trailing;
+                    log(
+                      `\u2705 Recovered JSON and appended ${trailing.length} chars of trailing content to text field`
+                    );
+                  } else {
+                    log(`\u2705 Recovered JSON by trimming trailing content at position ${pos}`);
+                  }
+                  if (debugInfo) debugInfo.jsonParseSuccess = true;
+                  recovered = true;
+                } catch {
+                }
+              }
+              if (!recovered) {
+                if (response.toLowerCase().includes("i cannot") || response.toLowerCase().includes("unable to")) {
+                  console.error("\u{1F6AB} AI refused to analyze - returning refusal as output");
+                  const trimmed2 = responseForParsing.trim();
+                  const out = trimmed2 ? { text: trimmed2 } : {};
+                  if (rawOutputBlocks.length > 0) out._rawOutput = rawOutputBlocks.join("\n\n");
+                  return {
+                    issues: [],
+                    output: out,
+                    debug: debugInfo
+                  };
+                }
+                log("\u{1F527} Treating response as plain text (no JSON extraction)");
+                const trimmed = responseForParsing.trim();
+                const fallbackOut = { text: trimmed };
+                if (rawOutputBlocks.length > 0) fallbackOut._rawOutput = rawOutputBlocks.join("\n\n");
                 return {
                   issues: [],
-                  output: trimmed2 ? { text: trimmed2 } : {},
+                  output: fallbackOut,
                   debug: debugInfo
                 };
               }
-              log("\u{1F527} Treating response as plain text (no JSON extraction)");
-              const trimmed = response.trim();
-              return {
-                issues: [],
-                output: { text: trimmed },
-                debug: debugInfo
-              };
             }
           }
           const looksLikeTextOutput = reviewData && typeof reviewData === "object" && typeof reviewData.text === "string" && String(reviewData.text).trim().length > 0;
@@ -2106,6 +2172,9 @@ ${"=".repeat(60)}
                 out.text = fallbackText;
               }
             }
+            if (rawOutputBlocks.length > 0) {
+              out._rawOutput = rawOutputBlocks.join("\n\n");
+            }
             const result2 = {
               // Keep issues empty for custom-schema rendering; consumers read from output.*
               issues: [],
@@ -2953,7 +3022,7 @@ function workflowInputsToJsonSchema(inputs) {
     required: required.length > 0 ? required : void 0
   };
 }
-function createWorkflowToolDefinition(workflow, argsOverrides) {
+function createWorkflowToolDefinition(workflow, argsOverrides, nameOverride) {
   const baseSchema = workflowInputsToJsonSchema(workflow.inputs);
   let inputSchema = baseSchema;
   if (argsOverrides && baseSchema && typeof baseSchema === "object") {
@@ -2971,7 +3040,7 @@ function createWorkflowToolDefinition(workflow, argsOverrides) {
     };
   }
   return {
-    name: workflow.id,
+    name: nameOverride || workflow.id,
     description: workflow.description || `Execute the ${workflow.name} workflow`,
     inputSchema,
     // Workflow tools don't have an exec command - they're executed specially
@@ -2999,7 +3068,7 @@ async function executeWorkflowAsTool(workflowId, args, context2, argsOverrides)
     ...args,
     ...argsOverrides
   };
-  const { WorkflowCheckProvider: WorkflowCheckProvider2 } = await import("./workflow-check-provider-57KAR4Y4.mjs");
+  const { WorkflowCheckProvider: WorkflowCheckProvider2 } = await import("./workflow-check-provider-4NFWH6YO.mjs");
   const provider = new WorkflowCheckProvider2();
   const checkConfig = {
     type: "workflow",
@@ -3021,6 +3090,16 @@ async function executeWorkflowAsTool(workflowId, args, context2, argsOverrides)
   );
   logger.debug(`[WorkflowToolExecutor] Workflow '${workflowId}' output preview: ${outputPreview}`);
   if (output !== void 0) {
+    if (output && typeof output === "object" && typeof output._rawOutput === "string") {
+      const rawOutput = output._rawOutput;
+      const cleanOutput = { ...output };
+      delete cleanOutput._rawOutput;
+      const jsonStr = JSON.stringify(cleanOutput, null, 2);
+      logger.debug(
+        `[WorkflowToolExecutor] Wrapping _rawOutput (${rawOutput.length} chars) in RAW_OUTPUT delimiters for '${workflowId}'`
+      );
+      return jsonStr + "\n<<<RAW_OUTPUT>>>\n" + rawOutput + "\n<<<END_RAW_OUTPUT>>>";
+    }
     return output;
   }
   if (result.content) {
@@ -3045,7 +3124,7 @@ function resolveWorkflowToolFromItem(item) {
       logger.warn(`[WorkflowToolExecutor] Workflow '${item.workflow}' not found in registry`);
       return void 0;
     }
-    return createWorkflowToolDefinition(workflow, item.args);
+    return createWorkflowToolDefinition(workflow, item.args, item.name);
   }
   return void 0;
 }
@@ -8711,7 +8790,7 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
           }
         }
         try {
-          const { evaluateTransitions } = await import("./routing-OXQKETSA.mjs");
+          const { evaluateTransitions } = await import("./routing-F4FOWVKF.mjs");
           const transTarget = await evaluateTransitions(
             onFinish.transitions,
             forEachParent,
@@ -8771,7 +8850,7 @@ async function executeCheckWithForEachItems2(checkId, forEachParent, forEachItem
             `[LevelDispatch] Error evaluating on_finish transitions for ${forEachParent}: ${e instanceof Error ? e.message : String(e)}`
           );
         }
-        const { evaluateGoto: evaluateGoto2 } = await import("./routing-OXQKETSA.mjs");
+        const { evaluateGoto: evaluateGoto2 } = await import("./routing-F4FOWVKF.mjs");
         if (context2.debug) {
           logger.info(
             `[LevelDispatch] Evaluating on_finish.goto_js for forEach parent: ${forEachParent}`
@@ -10027,7 +10106,7 @@ async function renderTemplateContent2(checkId, checkConfig, reviewSummary) {
     const fs11 = await import("fs/promises");
     const path14 = await import("path");
     const schemaRaw = checkConfig.schema || "plain";
-    const schema = typeof schemaRaw === "string" ? schemaRaw : "code-review";
+    const schema = typeof schemaRaw === "string" && !schemaRaw.includes("{{") && !schemaRaw.includes("{%") ? schemaRaw : typeof schemaRaw === "object" ? "code-review" : "plain";
     let templateContent;
     if (checkConfig.template && checkConfig.template.content) {
       templateContent = String(checkConfig.template.content);
@@ -11714,6 +11793,17 @@ function buildEngineContextForRun(workingDirectory, config, prInfo, debug, maxPa
   }
   const journal = new ExecutionJournal();
   const memory = MemoryStore.getInstance(clonedConfig.memory);
+  let sharedConcurrencyLimiter = void 0;
+  if (clonedConfig.max_ai_concurrency && _DelegationManager) {
+    sharedConcurrencyLimiter = new _DelegationManager({
+      maxConcurrent: clonedConfig.max_ai_concurrency,
+      maxPerSession: 999
+      // No per-session limit needed for global AI gating
+    });
+    logger.debug(
+      `[EngineContext] Created shared AI concurrency limiter (max: ${clonedConfig.max_ai_concurrency})`
+    );
+  }
   return {
     mode: "state-machine",
     config: clonedConfig,
@@ -11726,6 +11816,7 @@ function buildEngineContextForRun(workingDirectory, config, prInfo, debug, maxPa
     event: prInfo.eventType,
     debug,
     maxParallelism,
+    sharedConcurrencyLimiter,
     failFast,
     requestedChecks: requestedChecks && requestedChecks.length > 0 ? requestedChecks : void 0,
     // Store prInfo for later access (e.g., in getOutputHistorySnapshot)
@@ -11772,6 +11863,7 @@ async function initializeWorkspace(context2) {
     return context2;
   }
 }
+var _DelegationManager;
 var init_build_engine_context = __esm({
   "src/state-machine/context/build-engine-context.ts"() {
     "use strict";
@@ -11780,6 +11872,14 @@ var init_build_engine_context = __esm({
     init_human_id();
     init_logger();
     init_workspace_manager();
+    _DelegationManager = null;
+    try {
+      const probe = __require("@probelabs/probe");
+      if (probe && typeof probe.DelegationManager === "function") {
+        _DelegationManager = probe.DelegationManager;
+      }
+    } catch {
+    }
   }
 });
 
@@ -11923,7 +12023,7 @@ var init_state_machine_execution_engine = __esm({
           try {
             const map = options?.webhookContext?.webhookData;
             if (map) {
-              const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-ZOLEYDKM.mjs");
+              const { CheckProviderRegistry: CheckProviderRegistry2 } = await import("./check-provider-registry-7TCA3NSG.mjs");
               const reg = CheckProviderRegistry2.getInstance();
               const p = reg.getProvider("http_input");
               if (p && typeof p.setWebhookContext === "function") p.setWebhookContext(map);
@@ -12036,7 +12136,7 @@ var init_state_machine_execution_engine = __esm({
           logger.info("[StateMachine] Using state machine engine");
         }
         if (!config) {
-          const { ConfigManager } = await import("./config-4EG7IQIU.mjs");
+          const { ConfigManager } = await import("./config-FMIIATKX.mjs");
           const configManager = new ConfigManager();
           config = await configManager.getDefaultConfig();
           logger.debug("[StateMachine] Using default configuration (no config provided)");
@@ -12101,7 +12201,7 @@ var init_state_machine_execution_engine = __esm({
           try {
             const webhookData = this.executionContext?.webhookContext?.webhookData;
             if (webhookData instanceof Map) {
-              const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-PJVKWSYX.mjs");
+              const { extractSlackContext: extractSlackContext2 } = await import("./schedule-tool-handler-VFES42DD.mjs");
               const slackCtx = extractSlackContext2(webhookData);
               if (slackCtx) {
                 const payload = Array.from(webhookData.values())[0];
@@ -12130,7 +12230,7 @@ var init_state_machine_execution_engine = __esm({
         if (Array.isArray(configWithTagFilter.frontends) && configWithTagFilter.frontends.length > 0) {
           try {
             const { EventBus } = await import("./event-bus-5K3Y2FCS.mjs");
-            const { FrontendsHost } = await import("./host-VA3ET7N6.mjs");
+            const { FrontendsHost } = await import("./host-U7V54J2H.mjs");
             const bus = new EventBus();
             context2.eventBus = bus;
             frontendsHost = new FrontendsHost(bus, logger);
@@ -12480,9 +12580,9 @@ var init_state_machine_execution_engine = __esm({
        * @returns Array of failure condition evaluation results
        */
       async evaluateFailureConditions(checkName, reviewSummary, config, previousOutputs, authorAssociation) {
-        const { FailureConditionEvaluator: FailureConditionEvaluator2 } = await import("./failure-condition-evaluator-GLHZZF47.mjs");
+        const { FailureConditionEvaluator: FailureConditionEvaluator2 } = await import("./failure-condition-evaluator-PNONVBXD.mjs");
         const evaluator = new FailureConditionEvaluator2();
-        const { addEvent: addEvent3 } = await import("./trace-helpers-R2ETIEC2.mjs");
+        const { addEvent: addEvent3 } = await import("./trace-helpers-RDPXIN4S.mjs");
         const { addFailIfTriggered } = await import("./metrics-I6A7IHG4.mjs");
         const checkConfig = config.checks?.[checkName];
         if (!checkConfig) {
@@ -13593,7 +13693,7 @@ var init_ai_check_provider = __esm({
     init_sandbox();
     init_schedule_tool();
     init_schedule_tool_handler();
-    AICheckProvider = class extends CheckProvider {
+    AICheckProvider = class _AICheckProvider extends CheckProvider {
       aiReviewService;
       liquidEngine;
       sandbox = null;
@@ -14175,6 +14275,9 @@ ${preview}`);
           if (aiAny2.enableTasks !== void 0) {
             aiConfig.enableTasks = aiAny2.enableTasks;
           }
+          if (aiAny2.enableExecutePlan !== void 0) {
+            aiConfig.enableExecutePlan = aiAny2.enableExecutePlan;
+          }
           if (aiAny2.allowEdit !== void 0) {
             aiConfig.allowEdit = aiAny2.allowEdit;
           }
@@ -14303,6 +14406,10 @@ ${preview}`);
         if (config.ai_max_iterations !== void 0 && aiConfig.maxIterations === void 0) {
           aiConfig.maxIterations = config.ai_max_iterations;
         }
+        const sharedLimiter = sessionInfo?._parentContext?.sharedConcurrencyLimiter;
+        if (sharedLimiter) {
+          aiConfig.concurrencyLimiter = sharedLimiter;
+        }
         const policyEngine = sessionInfo?._parentContext?.policyEngine;
         if (policyEngine) {
           try {
@@ -14316,13 +14423,10 @@ ${preview}`);
               if (decision.capabilities.allowEdit === false) aiConfig.allowEdit = false;
               if (decision.capabilities.allowBash === false) aiConfig.allowBash = false;
               if (decision.capabilities.allowedTools) {
-                if (aiConfig.allowedTools) {
-                  aiConfig.allowedTools = aiConfig.allowedTools.filter(
-                    (t) => decision.capabilities.allowedTools.includes(t)
-                  );
-                } else {
-                  aiConfig.allowedTools = decision.capabilities.allowedTools;
-                }
+                aiConfig.allowedTools = _AICheckProvider.intersectAllowedTools(
+                  aiConfig.allowedTools,
+                  decision.capabilities.allowedTools
+                );
               }
             }
           } catch (err) {
@@ -14443,7 +14547,8 @@ ${preview}`);
           if (cfg.workflow && typeof cfg.workflow === "string") {
             workflowEntriesFromMcp.push({
               workflow: cfg.workflow,
-              args: cfg.inputs
+              args: cfg.inputs,
+              name: serverName
             });
             mcpEntriesToRemove.push(serverName);
             logger.debug(
@@ -14584,6 +14689,27 @@ ${preview}`);
             );
           }
         }
+        const allowedToolsJsExpr = config.ai_allowed_tools_js;
+        if (allowedToolsJsExpr && _dependencyResults) {
+          try {
+            const dynamicAllowedTools = this.evaluateAllowedToolsJs(
+              allowedToolsJsExpr,
+              prInfo,
+              _dependencyResults,
+              config
+            );
+            if (dynamicAllowedTools !== null) {
+              aiConfig.allowedTools = dynamicAllowedTools;
+              this.logDebug(
+                `[AI Provider] ai_allowed_tools_js evaluated to: ${JSON.stringify(dynamicAllowedTools)}`
+              );
+            }
+          } catch (error) {
+            logger.error(
+              `[AICheckProvider] Failed to evaluate ai_allowed_tools_js: ${error instanceof Error ? error.message : "Unknown error"}`
+            );
+          }
+        }
         const templateContext = {
           pr: {
             number: prInfo.number,
@@ -15087,6 +15213,65 @@ ${processedPrompt}` : processedPrompt;
           return {};
         }
       }
+      /**
+       * Evaluate ai_allowed_tools_js expression to dynamically compute allowed tools list.
+       * Returns a string array of tool names, or null if the expression returns a non-array.
+       */
+      evaluateAllowedToolsJs(expression, prInfo, dependencyResults, config) {
+        if (!this.sandbox) {
+          this.sandbox = createSecureSandbox();
+        }
+        const outputs = {};
+        for (const [checkId, result] of dependencyResults.entries()) {
+          const summary = result;
+          outputs[checkId] = summary.output !== void 0 ? summary.output : summary;
+        }
+        const jsContext = {
+          outputs,
+          inputs: config.inputs || {},
+          pr: {
+            number: prInfo.number,
+            title: prInfo.title,
+            description: prInfo.body,
+            author: prInfo.author,
+            branch: prInfo.head,
+            base: prInfo.base,
+            authorAssociation: prInfo.authorAssociation
+          },
+          files: prInfo.files?.map((f) => ({
+            filename: f.filename,
+            status: f.status,
+            additions: f.additions,
+            deletions: f.deletions,
+            changes: f.changes
+          })) || [],
+          env: this.buildSafeEnv(),
+          memory: config.__memoryAccessor || {}
+        };
+        try {
+          const result = compileAndRun(this.sandbox, expression, jsContext, {
+            injectLog: true,
+            wrapFunction: true,
+            logPrefix: "[ai_allowed_tools_js]"
+          });
+          if (!Array.isArray(result)) {
+            logger.warn(
+              `[AICheckProvider] ai_allowed_tools_js must return an array, got ${typeof result}`
+            );
+            return null;
+          }
+          const tools = result.filter((item) => typeof item === "string");
+          logger.debug(
+            `[AICheckProvider] ai_allowed_tools_js evaluated to ${tools.length} tools: ${tools.join(", ")}`
+          );
+          return tools;
+        } catch (error) {
+          logger.error(
+            `[AICheckProvider] Failed to evaluate ai_allowed_tools_js: ${error instanceof Error ? error.message : "Unknown error"}`
+          );
+          return null;
+        }
+      }
       /**
        * Build a safe subset of environment variables for sandbox access.
        * Excludes sensitive keys like API keys, secrets, tokens.
@@ -15148,6 +15333,22 @@ ${processedPrompt}` : processedPrompt;
         }
         return tools;
       }
+      /**
+       * Intersect config-level allowedTools with policy-level allowedTools.
+       * When the config list contains glob patterns ("*", "!" exclusions),
+       * it is passed through unchanged — ProbeAgent resolves those patterns.
+       * Literal tool name lists are intersected normally.
+       */
+      static intersectAllowedTools(configTools, policyTools) {
+        if (!configTools) {
+          return policyTools;
+        }
+        const hasGlobs = configTools.some((t) => t === "*" || t.startsWith("!"));
+        if (hasGlobs) {
+          return configTools;
+        }
+        return configTools.filter((t) => policyTools.includes(t));
+      }
       getSupportedConfigKeys() {
         return [
           "type",
@@ -15163,6 +15364,7 @@ ${processedPrompt}` : processedPrompt;
           "ai.mcpServers",
           "ai.enableDelegate",
           "ai.enableTasks",
+          "ai.enableExecutePlan",
           // legacy persona/prompt keys supported in config
           "ai_persona",
           "ai_prompt_type",
@@ -15184,6 +15386,7 @@ ${processedPrompt}` : processedPrompt;
           "ai_custom_tools",
           "ai_custom_tools_js",
           "ai_bash_config_js",
+          "ai_allowed_tools_js",
           "env"
         ];
       }
@@ -17531,19 +17734,7 @@ var init_command_check_provider = __esm({
             }
           }
           const timeoutMs = config.timeout || 6e4;
-          const normalizeNodeEval = (cmd) => {
-            const re = /^(?<prefix>\s*(?:\/usr\/bin\/env\s+)?node(?:\.exe)?\s+(?:-e|--eval)\s+)(['"])([\s\S]*?)\2(?<suffix>\s|$)/;
-            const m = cmd.match(re);
-            if (!m || !m.groups) return cmd;
-            const prefix = m.groups.prefix;
-            const quote = m[2];
-            const code = m[3];
-            const suffix = m.groups.suffix || "";
-            if (!code.includes("\n")) return cmd;
-            const escaped = code.replace(/\n/g, "\\n");
-            return cmd.replace(re, `${prefix}${quote}${escaped}${quote}${suffix}`);
-          };
-          const safeCommand = normalizeNodeEval(renderedCommand);
+          const safeCommand = renderedCommand;
           const parentContext = context2?._parentContext;
           const workingDirectory = parentContext?.workingDirectory;
           const workspaceEnabled = parentContext?.workspace?.isEnabled?.();
@@ -39747,6 +39938,20 @@ var init_workflow_check_provider = __esm({
             `[WorkflowProvider] Workflow '${workflow.id}' has null/undefined outputs: [${nullOutputs.join(", ")}]. This may indicate value_js expressions are not finding expected data.`
           );
         }
+        if (!outputs._rawOutput) {
+          const rawParts = [];
+          for (const stepOutput of Object.values(outputsMap)) {
+            if (stepOutput && typeof stepOutput === "object" && typeof stepOutput._rawOutput === "string") {
+              rawParts.push(stepOutput._rawOutput);
+            }
+          }
+          if (rawParts.length > 0) {
+            outputs._rawOutput = rawParts.join("\n\n");
+            logger.debug(
+              `[WorkflowProvider] Propagated _rawOutput from steps (${rawParts.length} blocks, ${outputs._rawOutput.length} chars)`
+            );
+          }
+        }
         return outputs;
       }
       /**
@@ -39893,4 +40098,4 @@ undici/lib/fetch/body.js:
 undici/lib/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-MQ57AB4U.mjs.map
+//# sourceMappingURL=chunk-XGI47XIH.mjs.map