@qvac/harness 1.0.0-rc.1 → 1.0.0-rc.3

package/dist-lib/lib/tools/exec.js

@@ -1,21 +1,13 @@
-import fs from 'fs';
-import path from 'path';
 import { createHash } from 'crypto';
-import b4a from 'b4a';
 import { AbortedError } from '../helpers/race-abort.js';
-import { checkPdfBuildSource, checkBareLengthArgs, checkPptxBuildSource, checkPythonSource, checkUnstagedRead, createPythonAdapter, isPythonLanguage, parseInputs, parseOutputs, parsePackages, parseWorkdir, pinned, runsThroughPyodide, sandboxInstallError, unwrapPythonSource } from './exec/adapters/python/python-adapter.js';
-import { pythonCreateEffect } from './exec/adapters/python/create-effect.js';
-import { namedHosts } from './exec/adapters/python/named-hosts.js';
-import { pythonReachesNetwork } from './exec/adapters/python/net-shim.js';
 import { createShellAdapter } from './exec/adapters/shell/shell-adapter.js';
-import { routeObsidianCommand } from './exec/obsidian/route.js';
+import { isPythonLanguage } from './exec/python-source.js';
 import { MAX_OUTPUT_CHARS_LIMIT } from './exec/runner.js';
 import { bareBin, firstCommandToken, sanitizeCommand } from './exec/scope.js';
-import { FILES_NEED_PYTHON_ERROR, isPythonSourceShaped, PACKAGES_NEED_PYTHON_ERROR, pythonRedirectError, startsLikePython, videoToolError } from './exec/shell-guidance.js';
+import { LANGUAGE_UNAVAILABLE_ERROR, PYTHON_UNAVAILABLE_ERROR, SHELL_DOWNLOAD_NOTE, shellOnlyError, videoToolError } from './exec/shell-guidance.js';
 import { shellArgv } from './exec/shell-argv.js';
 import { bareRuntime } from './exec/bare-runtime.js';
 import { canonicalDenyRoots, defaultRealpath, hostPath, resolveKey } from './fs/scope.js';
-import { unquoteArg } from './model-args.js';
 import { settingsEnv } from './skills/skill-settings.js';
 import { checkCliOps } from './skills/cli-schema.js';
 function parsePositiveInt(value, name, max) {
@@ -50,291 +42,67 @@ function shellEffect(command, toolOps) {
     }
     return matched.every((op) => op.annotation(argv) === 'read') ? 'read' : 'write';
 }
-function resolveExecution({ adapters, fallback }, args, ctx) {
-    for (const adapter of adapters) {
-        const plan = adapter.resolve(args, ctx);
-        if (plan) {
-            return plan;
-        }
-    }
-    return fallback.resolve(args, ctx);
-}
-function isPresent(value) {
-    return value !== undefined && value !== null;
-}
-function checkFileArgs(args, python) {
-    if (!python && (isPresent(args.inputs) || isPresent(args.outputs))) {
-        return FILES_NEED_PYTHON_ERROR;
-    }
-    const inputs = parseInputs(args.inputs);
-    if (inputs && 'error' in inputs) {
-        return inputs.error;
-    }
-    const outputs = parseOutputs(args.outputs);
-    if (outputs && 'error' in outputs) {
-        return outputs.error;
-    }
-    if (!python) {
-        return null;
-    }
-    const workdir = parseWorkdir(args.workdir);
-    return workdir && typeof workdir === 'object' ? workdir.error : null;
-}
-function truncateLabel(text) {
-    return text.length > 120 ? `${text.slice(0, 120)}…` : text;
-}
-const CONNECT_ANSWER_MS = 60_000;
-function connectAsker(askUser) {
-    return async (host) => {
-        let timer;
-        const late = new Promise((resolve) => {
-            timer = setTimeout(() => resolve(null), CONNECT_ANSWER_MS);
-        });
-        try {
-            const answer = await Promise.race([
-                askUser({
-                    question: `This Python run wants to connect to ${host}, which its approved code does not name. Allow it for this run?`,
-                    options: ['Allow', 'Deny']
-                }),
-                late
-            ]);
-            return /^allow/i.test((answer ?? '').trim());
-        }
-        finally {
-            clearTimeout(timer);
-        }
-    };
-}
-function networkPrefix(source) {
-    const hosts = namedHosts(source);
-    if (hosts.length === 0) {
-        return ' · network: no host named in the code';
-    }
-    return ` · network: ${hosts.join(', ')}`;
-}
-function packageSuffix(args) {
-    if (!Array.isArray(args.packages) || args.packages.length === 0)
-        return '';
-    const count = args.packages.length;
-    return ` (+${count} pkg${count === 1 ? '' : 's'}: ${truncateLabel(args.packages.join(', '))})`;
-}
-function uploadOrdinal(inputs, index) {
-    return inputs.slice(0, index + 1).filter((i) => i.attachmentId === undefined).length;
-}
-function fileSuffix(args) {
-    const inputs = parseInputs(args.inputs);
-    const outputs = parseOutputs(args.outputs);
-    const from = Array.isArray(inputs) && inputs.length > 0
-        ? ` ← ${inputs.length} file${inputs.length === 1 ? '' : 's'} (${truncateLabel(inputs
-            .map((i, n) => `${i.attachmentId ?? `upload-${uploadOrdinal(inputs, n)}`}→${i.path}`)
-            .join(', '))})`
-        : '';
-    const to = Array.isArray(outputs) && outputs.length > 0 ? ` → ${truncateLabel(outputs.join(', '))}` : '';
-    return `${from}${to}`;
-}
 function stringList(value) {
     if (!Array.isArray(value))
         return undefined;
     return value.filter((v) => typeof v === 'string');
 }
-function commandRequiredError(args, network) {
-    const staged = Array.isArray(args.inputs) || Array.isArray(args.outputs);
-    if (staged) {
-        return ('command is required: keep these same inputs/outputs and add either command (the bare ' +
-            'python source) or script + scriptArgs exactly as the loaded skill reference shows');
-    }
-    const packages = stringList(args.packages);
-    const impossible = videoToolError('', { packages, python: true, network });
-    if (impossible) {
-        return impossible;
-    }
-    if (packages?.length) {
-        return `command is required: call exec again with language "python", packages: ${JSON.stringify(packages.map(pinned))} and the Python source that uses them in command. Installing and running are the same one call.`;
-    }
-    return 'command is required';
-}
-function parseScriptArgs(value) {
-    if (Array.isArray(value)) {
-        return value.map(String);
-    }
-    if (typeof value === 'string' && value.trim().startsWith('[')) {
-        try {
-            const parsed = JSON.parse(value);
-            if (Array.isArray(parsed)) {
-                return parsed.map(String);
-            }
-        }
-        catch {
+function firstAnswer(languages, answer) {
+    for (const language of languages) {
+        const found = answer(language);
+        if (found) {
+            return found;
         }
     }
-    return [];
+    return null;
 }
-function normalizeScriptCall(rawArgs) {
-    let script = typeof rawArgs.script === 'string' ? unquoteArg(rawArgs.script) : '';
-    let scriptArgs = parseScriptArgs(rawArgs.scriptArgs);
-    if (!script || script.includes('\n')) {
-        return { script, scriptArgs };
-    }
-    if (script.includes(' ')) {
-        const tokens = script.split(/\s+/).filter(Boolean);
-        script = tokens[0] ?? '';
-        if (!scriptArgs.length) {
-            scriptArgs = tokens.slice(1);
+function resolveCall(rawArgs, languages) {
+    const name = languageName(rawArgs.language);
+    const ordered = [...languages].sort((a, b) => Number(b.name === name) - Number(a.name === name));
+    for (const language of ordered) {
+        const call = language.call(rawArgs);
+        if (call) {
+            return 'error' in call ? call : { ...call, language };
         }
     }
-    if (!script.startsWith('scripts/') && !script.includes('/')) {
-        script = `scripts/${script}`;
+    if (isPythonLanguage(rawArgs.language)) {
+        return { error: PYTHON_UNAVAILABLE_ERROR };
     }
-    return { script, scriptArgs };
+    return namesShell(rawArgs.language) ? { args: rawArgs } : { error: LANGUAGE_UNAVAILABLE_ERROR };
 }
-export function resolveScriptRun(rawArgs, skillsDir) {
-    const { script, scriptArgs } = normalizeScriptCall(rawArgs);
-    if (!script) {
-        if (scriptArgs.length) {
-            return {
-                error: 'scriptArgs need `script`: pass the scripts/*.py path exactly as the skill instructions name it'
-            };
-        }
-        return null;
-    }
-    if (script.includes('\n')) {
-        return {
-            args: { ...rawArgs, language: 'python', command: script, script: undefined },
-            trusted: false
-        };
-    }
-    if (!script.startsWith('scripts/') || !script.endsWith('.py')) {
-        return {
-            error: 'script takes a scripts/*.py path bundled with a skill, not a command line — ' +
-                `run a shell command by passing it in \`command\` instead. Got: ${String(rawArgs.script)}`
-        };
-    }
-    const skill = typeof rawArgs.skill === 'string' ? unquoteArg(rawArgs.skill) : '';
-    if (!skill) {
-        return { error: 'script runs need the owning skill name in `skill`' };
-    }
-    if (!skillsDir) {
-        return { error: 'script execution is not available on this device' };
-    }
-    if (String(rawArgs.command ?? '').trim()) {
-        return { error: 'pass either command or script, never both' };
-    }
-    const segments = [...skill.split('/'), ...script.split('/')];
-    if (segments.some((segment) => segment === '' || segment === '..' || segment.includes('\\'))) {
-        return { error: `script not found in skill ${skill}: ${script}` };
-    }
-    let source;
-    try {
-        const scriptPath = path.join(skillsDir, skill, script);
-        const regularPath = () => {
-            let current = skillsDir;
-            for (const segment of segments) {
-                current = path.join(current, segment);
-                if (fs.lstatSync(current).isSymbolicLink()) {
-                    return false;
-                }
-            }
-            return true;
-        };
-        if (!regularPath()) {
-            return { error: `script not found in skill ${skill}: ${script}` };
-        }
-        const before = fs.statSync(scriptPath);
-        if (!before.isFile()) {
-            return { error: `script not found in skill ${skill}: ${script}` };
-        }
-        const fd = fs.openSync(scriptPath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
-        try {
-            const opened = fs.fstatSync(fd);
-            if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino) {
-                return { error: `script not found in skill ${skill}: ${script}` };
-            }
-            source = readScriptSource(fd);
-            const current = fs.statSync(scriptPath);
-            if (!regularPath() || current.dev !== opened.dev || current.ino !== opened.ino) {
-                return { error: `script not found in skill ${skill}: ${script}` };
-            }
-        }
-        finally {
-            fs.closeSync(fd);
-        }
-    }
-    catch {
-        return { error: `script not found in skill ${skill}: ${script}` };
-    }
-    const staged = stagingGap(rawArgs, scriptArgs);
-    if (staged) {
-        return { error: staged };
-    }
-    const argv = JSON.stringify([script.slice('scripts/'.length), ...scriptArgs]);
-    const command = `import sys\nsys.argv = ${argv}\n${source}`;
-    return { args: { ...rawArgs, language: 'python', command, scriptArgs }, trusted: true };
+function languageName(language) {
+    return typeof language === 'string' ? language.trim().toLowerCase() : '';
 }
-function readScriptSource(fd) {
-    const chunks = [];
-    while (true) {
-        const buffer = b4a.allocUnsafe(8192);
-        const length = fs.readSync(fd, buffer);
-        if (length === 0) {
-            break;
-        }
-        chunks.push(buffer.subarray(0, length));
-    }
-    return b4a.toString(b4a.concat(chunks), 'utf8');
+const SHELL_NAMES = new Set(['', 'shell', 'bash', 'sh', 'zsh']);
+function namesShell(language) {
+    return SHELL_NAMES.has(languageName(language));
 }
-const SCRIPT_FILE_ARG = /^[\w][\w.-]*\.(pdf|txt|md|csv|docx|xlsx|pptx|png|jpe?g)$/i;
-function stagingGap(rawArgs, scriptArgs) {
-    const inputs = parseInputs(rawArgs.inputs);
-    const outputs = parseOutputs(rawArgs.outputs);
-    const known = new Set([
-        ...(Array.isArray(inputs) ? inputs.map((input) => input.path) : []),
-        ...(Array.isArray(outputs) ? outputs : [])
-    ]);
-    const missing = scriptArgs.filter((arg) => SCRIPT_FILE_ARG.test(arg) && !known.has(arg));
-    if (!missing.length) {
-        return null;
-    }
-    return (`scriptArgs name ${missing.map((name) => `"${name}"`).join(', ')} but the working directory ` +
-        'starts empty: stage each existing file in inputs [{ attachmentId, path }] and declare each ' +
-        'produced file in outputs');
+const NOT_SHELL = ['packages', 'inputs', 'outputs', 'script'];
+function shellStray(args) {
+    const name = NOT_SHELL.find((each) => args[each] !== undefined && args[each] !== null);
+    return name
+        ? `${name} is not an argument here: a shell call takes only command, workdir, timeoutMs and maxOutputChars`
+        : null;
 }
-function scriptLabel(args) {
-    const { script, scriptArgs } = normalizeScriptCall(args);
-    const argsSuffix = scriptArgs.length ? ` ${scriptArgs.join(' ')}` : '';
-    return `python script ${unquoteArg(args.skill ?? '?')}/${script}${argsSuffix}`;
+function loadRun(call, skillsDir) {
+    return call.bundled ? call.bundled.load(skillsDir) : { args: call.args, trusted: false };
 }
 const WORKDIR_NO_ROOTS_ERROR = 'workdir is not available: no directories are granted to this device, so a working directory ' +
     'cannot be validated. Omit workdir and use absolute paths in the command.';
-function withInferredLanguage(args, disablePyodide) {
-    if (disablePyodide || isPythonLanguage(args.language))
-        return args;
-    const command = String(args.command ?? '').trim();
-    const declared = (stringList(args.packages) ?? []).length > 0 && startsLikePython(command);
-    const wrapped = unwrapPythonSource(command) !== null;
-    return isPythonSourceShaped(command) || declared || wrapped
-        ? { ...args, language: 'python' }
-        : args;
-}
-function checkExecutionScope(args, { toolOps, disablePyodide, sandbox, network }) {
+function checkExecutionScope(args, language, { toolOps, sandbox, languages }) {
+    if (language) {
+        return language.scope(args, { sandbox });
+    }
     const command = String(args.command ?? '').trim();
     const video = videoToolError(command, {
         packages: stringList(args.packages),
-        python: runsThroughPyodide(args.language, disablePyodide),
-        network
+        python: false,
+        network: languages.some((each) => each.online({ sandbox }))
     });
-    if (video) {
-        return video;
-    }
-    if (runsThroughPyodide(args.language, disablePyodide)) {
-        return null;
-    }
-    if (!disablePyodide) {
-        const redirect = pythonRedirectError(command, sandbox);
-        if (redirect) {
-            return redirect;
-        }
-    }
-    return checkShellScope(command, toolOps);
+    return (video ??
+        firstAnswer(languages, (each) => each.redirect(args, { sandbox })) ??
+        shellOnlyError(command) ??
+        checkShellScope(command, toolOps));
 }
 async function skillsEnv(skillSettings, ctx) {
     const skills = ctx?.skills ?? [];
@@ -347,57 +115,44 @@ async function skillsEnv(skillSettings, ctx) {
     }
     return Object.keys(env).length > 0 ? env : undefined;
 }
-export function createExecTool({ policyVersion, spawn, killProcess, loadPyodide, disablePyodide = false, pythonNetwork = !disablePyodide && pythonReachesNetwork(), credentialStore, skillSettings, realpath = defaultRealpath, deniedRoots, skillsDir } = {}) {
-    const adapters = [createPythonAdapter(disablePyodide, loadPyodide, pythonNetwork)];
-    const fallback = createShellAdapter({ spawn, killProcess, loadRuntime: bareRuntime });
+function execSchema(languages) {
+    const text = languages.map((language) => language.text);
+    const runs = (each) => text.map((t) => `, or ${each(t)}`).join('');
+    const language = text.length
+        ? {
+            language: {
+                type: 'string',
+                description: `Optional runtime. ${text.map((t) => t.language).join(' ')} Default is shell.`
+            }
+        }
+        : {};
+    const promptLanguage = text.length
+        ? {
+            language: {
+                type: 'string',
+                enum: ['shell', ...languages.map((each) => each.name)],
+                description: `${text.map((t) => t.prompt.language).join('; ')}; default shell.`
+            }
+        }
+        : {};
+    const workdir = text.length
+        ? ` on the shell path${text.map((t) => `, ${t.workdir}`).join('')}`
+        : '';
     return {
-        name: 'exec',
-        policyVersion: createHash('sha256')
-            .update(JSON.stringify({
-            version: 1,
-            policyVersion: policyVersion ?? null,
-            disablePyodide,
-            deniedRoots: [...(deniedRoots ?? [])].sort(),
-            skillsDir: skillsDir ?? null
-        }))
-            .digest('hex'),
-        toolset: 'exec',
-        description: "Execute a shell command on the user's device, or Python via in-process Pyodide. " +
+        description: `Execute a shell command on the user's device${runs((t) => t.runs)}. ` +
             'One program per call: chaining, pipes, redirection and shell expansion are rejected. ' +
             'Returns stdout, stderr, and exit code. ' +
-            'For Python: pass language="python" with the bare Python source in command — the first line of ' +
-            'command is the first line of the program, there is no shell or interpreter to invoke, and ' +
-            'packages are declared in packages rather than installed. ' +
-            'When a loaded skill names a bundled script, run it by passing skill and script (with scriptArgs) ' +
-            'instead of command — never retype a script as source. ' +
+            text.map((t) => `${t.guide} `).join('') +
             'Prefer one-shot commands; do not use for long-running daemons.',
         parameters: {
             type: 'object',
             properties: {
-                command: {
-                    type: 'string',
-                    description: 'Shell command, or — when language is python — the Python source itself, ' +
-                        'whose first line is the first line of the program (no shell, no interpreter, no quoting)'
-                },
-                language: {
-                    type: 'string',
-                    description: 'Optional runtime. "python" runs command as Python via in-process Pyodide. Default is shell.'
-                },
-                packages: {
-                    type: 'array',
-                    description: 'Optional array of PyPI package names (strings) to install (via micropip) before the code runs. Only with language "python".'
-                },
-                inputs: {
-                    type: 'array',
-                    description: 'Optional chat attachments to place in the working directory before the code runs, as objects {attachmentId, path}. path is a bare file name (no directories). Omit attachmentId to stage the image the user attached to their latest message. Any other uploaded file — PDF, .docx, .xlsx, .pptx — is staged by attachmentId, copied verbatim from the [Attached file "…"] line on the user\'s message; ids also come from earlier tool results. Only with language "python".'
-                },
-                outputs: {
-                    type: 'array',
-                    description: 'Optional bare file names (strings) the code writes in the working directory; each is attached to the chat when the run succeeds. Only with language "python".'
-                },
+                command: { type: 'string', description: `Shell command${runs((t) => t.command)}` },
+                ...language,
+                ...Object.assign({}, ...text.map((t) => t.properties)),
                 workdir: {
                     type: 'string',
-                    description: 'Optional working directory: a host path on the shell path, a bare directory name inside the in-memory Python filesystem with language "python".'
+                    description: `Optional working directory: a host path${workdir}.`
                 },
                 timeoutMs: {
                     type: 'number',
@@ -405,167 +160,132 @@ export function createExecTool({ policyVersion, spawn, killProcess, loadPyodide,
                 },
                 maxOutputChars: {
                     type: 'number',
-                    description: 'Optional stdout/stderr cap in characters (default 8192, max 65536). Raise when reading long content, e.g. a full note.'
-                },
-                script: {
-                    type: 'string',
-                    description: 'Run a python script bundled with a loaded skill instead of passing source: a scripts/*.py path exactly as the skill instructions name it (e.g. "scripts/extract_text.py"). Requires skill; leave command unset; pass arguments in scriptArgs and stage files via inputs/outputs as the instructions show.'
-                },
-                skill: {
-                    type: 'string',
-                    description: 'With script: the name of the skill that bundles the script (e.g. "pdf").'
-                },
-                scriptArgs: {
-                    type: 'array',
-                    description: 'With script: string arguments handed to the script as its command line, in order.'
+                    description: 'Optional stdout/stderr cap in characters (default 8192, max 65536); longer output keeps its start and end. Raise when reading long content, e.g. a full note.'
                 }
             },
             required: []
         },
         prompt: {
-            description: "Run one program on the user's device: a shell command, or Python source in `command` with " +
-                'language="python". Chaining, pipes, redirection and shell expansion are rejected. ' +
-                'Returns stdout, stderr, exit code. Run a script ' +
-                'bundled with a loaded skill via `skill`+`script`+`scriptArgs`, never as retyped source.',
+            description: `Run one program on the user's device: a shell command${runs((t) => t.prompt.runs)}. ` +
+                'Chaining, pipes, redirection and shell expansion are rejected. ' +
+                `Returns stdout, stderr, exit code.${text.map((t) => ` ${t.prompt.guide}`).join('')}`,
             parameters: {
                 type: 'object',
                 properties: {
                     command: {
                         type: 'string',
-                        description: 'Shell command, or bare Python source when language="python".'
-                    },
-                    language: {
-                        type: 'string',
-                        enum: ['shell', 'python'],
-                        description: '"python" runs `command` as Python; default shell.'
-                    },
-                    packages: { type: 'array', description: 'python only: PyPI packages to install.' },
-                    inputs: {
-                        type: 'array',
-                        description: 'python only: attachments to stage as {attachmentId, path}, path a bare file name; ' +
-                            'omit attachmentId for the latest attached image.'
-                    },
-                    outputs: {
-                        type: 'array',
-                        description: 'Only with language "python": bare file names the code writes; attached on success.'
+                        description: `Shell command${runs((t) => t.prompt.command)}.`
                     },
+                    ...promptLanguage,
+                    ...Object.assign({}, ...text.map((t) => t.prompt.properties)),
                     workdir: { type: 'string' },
                     timeoutMs: { type: 'number', description: 'default 120000, max 600000.' },
                     maxOutputChars: {
                         type: 'number',
-                        description: 'stdout/stderr cap (default 8192, max 65536); raise for long content.'
-                    },
-                    script: {
-                        type: 'string',
-                        description: 'Run a python script bundled with a loaded skill instead of passing source: a scripts/*.py ' +
-                            'path exactly as the skill instructions name it (e.g. "scripts/extract_text.py"). Requires ' +
-                            '`skill`; leave `command` unset. Never a command line — shell commands go in `command`.'
-                    },
-                    skill: {
-                        type: 'string',
-                        description: 'With script: the name of the skill that bundles it (e.g. "pdf").'
-                    },
-                    scriptArgs: { type: 'array', description: 'With script: string arguments in order.' }
+                        description: 'stdout/stderr cap (default 8192, max 65536), keeping start and end; raise for long content.'
+                    }
                 },
                 required: []
             }
-        },
+        }
+    };
+}
+export function createExecTool({ policyVersion, spawn, killProcess, shell: composedShell, languages = [], routes = [], skillSettings, realpath = defaultRealpath, deniedRoots, skillsDir } = {}) {
+    const shell = composedShell ??
+        createShellAdapter({
+            spawn,
+            killProcess,
+            loadRuntime: bareRuntime,
+            downloadNote: [SHELL_DOWNLOAD_NOTE, ...languages.map((each) => each.text.download)]
+                .filter(Boolean)
+                .join(' ')
+        });
+    const commandRequired = (args, scope, language) => firstAnswer(languages, (each) => each.redirect(args, scope)) ??
+        (language ? null : shellStray(args)) ??
+        'command is required';
+    return {
+        name: 'exec',
+        policyVersion: createHash('sha256')
+            .update(JSON.stringify({
+            version: 2,
+            policyVersion: policyVersion ?? null,
+            shell: shell.name,
+            languages: languages.map((each) => each.name),
+            routes: routes.map((each) => each.name),
+            deniedRoots: [...(deniedRoots ?? [])].sort(),
+            skillsDir: skillsDir ?? null
+        }))
+            .digest('hex'),
+        toolset: 'exec',
+        addons: { 'bare-subprocess': bareRuntime },
+        ...execSchema(languages),
         autoApprove: false,
         effect(rawArgs, ctx) {
-            const args = withInferredLanguage(rawArgs, disablePyodide);
-            if (typeof args.script === 'string' && args.script.trim() && !args.script.includes('\n')) {
+            const call = resolveCall(rawArgs, languages);
+            if ('error' in call) {
+                return 'write';
+            }
+            if (call.bundled) {
                 return 'read';
             }
-            if (runsThroughPyodide(args.language, disablePyodide)) {
-                return pythonCreateEffect(args);
+            if (call.language) {
+                return call.language.effect(call.args);
             }
-            return shellEffect(String(args.command ?? '').trim(), ctx?.toolOps);
+            return shellEffect(String(call.args.command ?? '').trim(), ctx?.toolOps);
         },
         validate(args, ctx) {
-            const scriptRun = resolveScriptRun(args, skillsDir);
-            if (scriptRun && 'error' in scriptRun) {
-                return scriptRun.error;
+            const call = resolveCall(args, languages);
+            if ('error' in call) {
+                return call.error;
             }
-            const rawArgs = withInferredLanguage(scriptRun ? scriptRun.args : args, disablePyodide);
+            const run = loadRun(call, skillsDir);
+            if ('error' in run) {
+                return run.error;
+            }
+            const { language } = call;
+            const rawArgs = run.args;
+            const sandbox = ctx?.sandboxMode === true;
             const command = String(rawArgs.command ?? '').trim();
             if (!command) {
-                return commandRequiredError(rawArgs, pythonNetwork && ctx?.sandboxMode !== true);
+                return commandRequired(rawArgs, { sandbox }, language);
             }
-            const scopeError = checkExecutionScope(rawArgs, {
+            const scopeError = checkExecutionScope(rawArgs, language, {
                 toolOps: ctx?.toolOps,
-                disablePyodide,
-                sandbox: ctx?.sandboxMode === true,
-                network: pythonNetwork && ctx?.sandboxMode !== true
+                sandbox,
+                languages
             });
             if (scopeError) {
                 return scopeError;
             }
-            const python = runsThroughPyodide(rawArgs.language, disablePyodide);
             const workdirGiven = rawArgs.workdir !== undefined && rawArgs.workdir !== null;
-            if (workdirGiven && !python && (ctx?.fsRoots ?? []).length === 0) {
+            if (workdirGiven && !language && (ctx?.fsRoots ?? []).length === 0) {
                 return WORKDIR_NO_ROOTS_ERROR;
             }
-            if (python) {
-                const outputs = parseOutputs(rawArgs.outputs);
-                if (outputs && 'error' in outputs) {
-                    return outputs.error;
-                }
-                const packages = parsePackages(rawArgs.packages);
-                if (packages && 'error' in packages) {
-                    return packages.error;
-                }
-                const refusal = ctx?.sandboxMode === true ? sandboxInstallError(command, packages) : null;
-                if (refusal) {
-                    return refusal;
-                }
-                if (!scriptRun || !scriptRun.trusted) {
-                    const sourceError = checkPythonSource(command);
-                    if (sourceError) {
-                        return sourceError;
-                    }
-                    const pptxError = checkPptxBuildSource(unwrapPythonSource(command) ?? command, outputs, packages);
-                    if (pptxError) {
-                        return pptxError;
-                    }
-                    const pdfError = checkPdfBuildSource(unwrapPythonSource(command) ?? command, outputs, packages);
-                    if (pdfError) {
-                        return pdfError;
-                    }
-                    const bareLength = checkBareLengthArgs(unwrapPythonSource(command) ?? command, packages);
-                    if (bareLength) {
-                        return bareLength;
-                    }
-                    const inputs = parseInputs(rawArgs.inputs);
-                    const unstagedRead = checkUnstagedRead(unwrapPythonSource(command) ?? command, Array.isArray(inputs) ? inputs : undefined);
-                    if (unstagedRead) {
-                        return unstagedRead;
-                    }
-                }
-            }
-            const parsed = parsePackages(rawArgs.packages);
-            if (parsed && 'error' in parsed) {
-                return parsed.error;
-            }
-            if (parsed && !python) {
-                return PACKAGES_NEED_PYTHON_ERROR;
+            if (language) {
+                return language.validate(rawArgs, {
+                    sandbox,
+                    trusted: run.trusted,
+                    toolNames: ctx?.toolNames
+                });
             }
-            return checkFileArgs(rawArgs, python);
+            return firstAnswer(languages, (each) => each.strays(rawArgs)) ?? shellStray(rawArgs);
         },
         resource(rawArgs, ctx) {
-            const args = withInferredLanguage(rawArgs, disablePyodide);
-            const script = typeof args.script === 'string' ? args.script : '';
-            if (script.trim() && !script.includes('\n')) {
-                return { kind: 'command', label: scriptLabel(args) };
+            const call = resolveCall(rawArgs, languages);
+            if ('error' in call) {
+                return null;
+            }
+            if (call.bundled) {
+                return { kind: 'command', label: call.bundled.label };
             }
-            const command = String(args.command ?? '').trim() || script.trim();
+            const { args } = call;
+            const command = String(args.command ?? '').trim();
             if (!command) {
                 return null;
             }
             const workdir = typeof args.workdir === 'string' && args.workdir.trim() ? args.workdir.trim() : null;
-            const source = unwrapPythonSource(command) ?? command;
-            const online = pythonNetwork && ctx?.sandboxMode !== true;
-            const body = runsThroughPyodide(args.language, disablePyodide)
-                ? `python${online ? networkPrefix(source) : ''}${packageSuffix(args)}${fileSuffix(args)}: ${source.slice(0, 120)}`
+            const body = call.language
+                ? call.language.label(args, { sandbox: ctx?.sandboxMode === true })
                 : command;
             return {
                 kind: 'command',
@@ -573,20 +293,25 @@ export function createExecTool({ policyVersion, spawn, killProcess, loadPyodide,
             };
         },
         async execute(args, ctx) {
-            const scriptRun = resolveScriptRun(args, skillsDir);
-            if (scriptRun && 'error' in scriptRun) {
-                return { error: scriptRun.error };
+            const call = resolveCall(args, languages);
+            if ('error' in call) {
+                return { error: call.error };
             }
-            const rawArgs = withInferredLanguage(scriptRun ? scriptRun.args : args, disablePyodide);
+            const run = loadRun(call, skillsDir);
+            if ('error' in run) {
+                return { error: run.error };
+            }
+            const { language } = call;
+            const rawArgs = run.args;
+            const sandbox = ctx?.sandboxMode === true;
             const command = String(rawArgs.command ?? '').trim();
             if (!command) {
-                return { error: commandRequiredError(rawArgs, pythonNetwork && ctx?.sandboxMode !== true) };
+                return { error: commandRequired(rawArgs, { sandbox }, language) };
             }
-            const scopeError = checkExecutionScope(rawArgs, {
+            const scopeError = checkExecutionScope(rawArgs, language, {
                 toolOps: ctx?.toolOps,
-                disablePyodide,
-                sandbox: ctx?.sandboxMode === true,
-                network: pythonNetwork && ctx?.sandboxMode !== true
+                sandbox,
+                languages
             });
             if (scopeError) {
                 return { error: scopeError };
@@ -594,14 +319,13 @@ export function createExecTool({ policyVersion, spawn, killProcess, loadPyodide,
             const workdir = rawArgs.workdir === undefined || rawArgs.workdir === null
                 ? undefined
                 : String(rawArgs.workdir);
-            const onShellPath = !runsThroughPyodide(rawArgs.language, disablePyodide);
+            const deny = await canonicalDenyRoots(deniedRoots, realpath);
             let cwd = workdir;
-            if (workdir !== undefined && onShellPath) {
+            if (workdir !== undefined && !language) {
                 const roots = ctx?.fsRoots ?? [];
                 if (roots.length === 0) {
                     return { error: WORKDIR_NO_ROOTS_ERROR };
                 }
-                const deny = await canonicalDenyRoots(deniedRoots, realpath);
                 const resolved = await resolveKey(workdir, roots, { realpath, deny });
                 if ('error' in resolved) {
                     return { error: resolved.error };
@@ -634,22 +358,18 @@ export function createExecTool({ policyVersion, spawn, killProcess, loadPyodide,
             if (maxOutputChars && typeof maxOutputChars === 'object') {
                 return maxOutputChars;
             }
-            if (!isPythonLanguage(rawArgs.language)) {
-                const obsidian = await routeObsidianCommand(command, ctx, {
-                    credentialStore,
-                    spawn,
-                    killProcess,
-                    loadRuntime: spawn ? undefined : bareRuntime,
+            const route = language ? undefined : routes.find((each) => each.claims(command));
+            if (route) {
+                return route.run(command, ctx, {
                     timeoutMs: timeout,
-                    maxOutputChars
+                    maxOutputChars,
+                    signal: ctx?.signal,
+                    runtime: spawn ? async () => ({ spawn, killProcess }) : bareRuntime
                 });
-                if (obsidian) {
-                    return obsidian;
-                }
             }
             const skillEnv = skillSettings ? await skillsEnv(skillSettings, ctx) : undefined;
             try {
-                const execution = resolveExecution({ adapters, fallback }, rawArgs, {
+                const context = {
                     attach: ctx?.attach,
                     fetchAttachment: ctx?.fetchAttachment,
                     turnImages: ctx?.turnImages,
@@ -657,14 +377,18 @@ export function createExecTool({ policyVersion, spawn, killProcess, loadPyodide,
                     sandboxMode: ctx?.sandboxMode,
                     toolNames: ctx?.toolNames,
                     approval: ctx?.approval,
-                    confirmConnect: ctx?.askUser ? connectAsker(ctx.askUser) : undefined
-                });
+                    askUser: ctx?.askUser,
+                    writeRoots: (ctx?.fsWriteRoots ?? []).flatMap((each) => each.kind === 'local' ? [each.root] : []),
+                    deniedRoots: deny
+                };
+                const execution = language?.resolve(rawArgs, context) ?? shell.resolve(rawArgs, context);
                 return await execution.run({
                     cwd,
                     timeoutMs: timeout,
                     maxOutputChars,
                     signal: ctx?.signal,
-                    env: skillEnv
+                    env: skillEnv,
+                    spill: ctx?.spill
                 });
             }
             catch (err) {