@synergenius/flow-weaver-pack-weaver 0.9.199 → 0.9.201

package/src/bot/provider-shim.ts

@@ -0,0 +1,218 @@
+/**
+ * Provider Shim — bridges callPlatformWithMessages to ANY provider.
+ *
+ * ## Why this exists
+ *
+ * Node-types (plan-task, review-result, etc.) call `callPlatformWithMessages`
+ * which checks `globalThis.__fw_llm_provider__`. This global is normally set
+ * by the platform via IPC (pack-worker-entry.mjs). When running WITHOUT the
+ * platform (CLI standalone, benchmarks, tests), it's missing and all AI calls
+ * throw "Platform AI provider not available".
+ *
+ * ## MCP Bridge
+ *
+ * The CLI session with --tools "" has zero built-in tools. Pack tools must be
+ * registered via MCP bridge so the model can call them as structured tool_use
+ * (not text). The shim creates a lightweight MCP bridge per worker using
+ * core's createMcpBridge with the pack's tool definitions and executor.
+ *
+ * ## Concurrency model
+ *
+ * The swarm runs multiple workers concurrently. Each worker calls runWorkflow
+ * which needs its own CLI session (its own `claude -p` process). We use
+ * AsyncLocalStorage to track the current worker ID so the single global shim
+ * can route each `.chat()` call to the correct per-worker CLI session.
+ *
+ * DO NOT overwrite `globalThis.__fw_llm_provider__` per worker — that causes
+ * race conditions where the last writer wins and all other workers share one
+ * session, producing zero-token ghost runs.
+ *
+ * ## DO NOT
+ *
+ * - Do NOT try to make individual nodes dispatch based on provider type.
+ * - Do NOT call callCliAsync directly — it's single-turn text-only.
+ * - Do NOT store per-worker shims on the global — use setActiveWorkerId().
+ */
+
+import { AsyncLocalStorage } from 'node:async_hooks';
+import type { BotProviderConfig } from './types.js';
+import type { AiTool, ChatMessage } from './ai-client.js';
+import type { McpBridge } from '@synergenius/flow-weaver/agent';
+
+export interface ProviderShim {
+  chat: (
+    messages: ChatMessage[],
+    options?: { model?: string; maxTokens?: number; tools?: AiTool[] },
+  ) => Promise<{
+    content: string;
+    toolCalls?: Array<{ id: string; name: string; arguments: Record<string, unknown> }>;
+    thinking?: string;
+    usage?: Record<string, unknown>;
+  }>;
+}
+
+/**
+ * AsyncLocalStorage for the current worker ID.
+ * The runner sets this before each workflow execution so the routing shim
+ * dispatches .chat() to the correct per-worker CLI session.
+ */
+const workerIdStorage = new AsyncLocalStorage<string>();
+
+/** Run a function with the given worker ID in the async context. */
+export function runWithWorkerId<T>(workerId: string, fn: () => T): T {
+  return workerIdStorage.run(workerId, fn);
+}
+
+/** Get the current worker ID from the async context. */
+export function getActiveWorkerId(): string | undefined {
+  return workerIdStorage.getStore();
+}
+
+// Per-worker MCP bridges — created once, reused across chat() calls
+const bridges = new Map<string, McpBridge>();
+
+/**
+ * Get or create an MCP bridge for the given worker/project.
+ * The bridge registers pack tools (read_file, write_file, run_shell, etc.)
+ * as MCP tools so the CLI session model can call them via structured tool_use.
+ */
+async function getOrCreateBridge(cwd: string, bridgeKey: string): Promise<McpBridge> {
+  const existing = bridges.get(bridgeKey);
+  if (existing) return existing;
+
+  const { createMcpBridge } = await import('@synergenius/flow-weaver/agent');
+  const { WEAVER_TOOLS, createWeaverExecutor } = await import('./weaver-tools.js');
+
+  const executor = createWeaverExecutor(cwd);
+  const bridge = await createMcpBridge(
+    WEAVER_TOOLS,
+    executor,
+    undefined, // no tool event callback — audit emits are handled by plan-task
+  );
+
+  bridges.set(bridgeKey, bridge);
+  return bridge;
+}
+
+/**
+ * Build a routing shim that dispatches .chat() calls to per-worker CLI sessions.
+ * One instance is installed on globalThis; it reads the current worker ID from
+ * AsyncLocalStorage to select the right session.
+ */
+export function buildProviderShim(
+  providerConfig: BotProviderConfig,
+  projectDir?: string,
+): ProviderShim {
+  return {
+    async chat(messages, options) {
+      const { getOrCreateCliSession } = await import(
+        '@synergenius/flow-weaver/agent'
+      );
+
+      const cwd = projectDir ?? process.cwd();
+      const model = options?.model ?? providerConfig.model ?? 'claude-sonnet-4-6';
+      const workerId = getActiveWorkerId();
+      const sessionKey = workerId ? `shim:${cwd}:${workerId}` : `shim:${cwd}`;
+      const bridgeKey = workerId ? `bridge:${cwd}:${workerId}` : `bridge:${cwd}`;
+
+      // Create MCP bridge so the CLI session has pack tools registered
+      const bridge = await getOrCreateBridge(cwd, bridgeKey);
+
+      const { getCliSessionConfig } = await import('@synergenius/flow-weaver/agent');
+      const session = getOrCreateCliSession(sessionKey, getCliSessionConfig({
+        binPath: (providerConfig.options?.binPath as string | undefined),
+        cwd,
+        model,
+        mcpConfigPath: bridge.configPath,
+        appendSystemPrompt: 'You are Weaver, an AI workflow bot. Use the provided tools to complete tasks. Never attempt to use built-in tools.',
+      }));
+
+      if (!session.ready) await session.spawn();
+
+      // Build prompt from messages
+      const prompt = messages
+        .map((m: ChatMessage) => {
+          if (m.role === 'system') return '';
+          if (m.role === 'user') return typeof m.content === 'string' ? m.content : JSON.stringify(m.content);
+          if (m.role === 'tool') return `Tool result (${(m as unknown as Record<string, unknown>).tool_use_id ?? 'unknown'}): ${m.content}`;
+          return '';
+        })
+        .filter(Boolean)
+        .join('\n');
+
+      const systemMsg = messages.find(m => m.role === 'system');
+      const systemPrompt = typeof systemMsg?.content === 'string' ? systemMsg.content : undefined;
+
+      // Collect stream events into the platform response shape
+      let content = '';
+      let thinking = '';
+      const toolCalls: Array<{ id: string; name: string; arguments: Record<string, unknown> }> = [];
+      const pendingTools = new Map<string, { id: string; name: string }>();
+      let usage: { input_tokens: number; output_tokens: number } | undefined;
+
+      for await (const event of session.send(prompt, systemPrompt)) {
+        switch (event.type) {
+          case 'text_delta':
+            content += event.text;
+            break;
+          case 'thinking_delta':
+            thinking += event.text;
+            break;
+          case 'tool_use_start':
+            pendingTools.set(event.id, { id: event.id, name: event.name });
+            break;
+          case 'tool_use_end':
+            toolCalls.push({
+              id: event.id,
+              name: pendingTools.get(event.id)?.name ?? 'unknown',
+              arguments: event.arguments,
+            });
+            pendingTools.delete(event.id);
+            break;
+          case 'usage':
+            usage = { input_tokens: event.promptTokens, output_tokens: event.completionTokens };
+            break;
+        }
+      }
+
+      return {
+        content,
+        toolCalls: toolCalls.length > 0 ? toolCalls : undefined,
+        thinking: thinking || undefined,
+        usage,
+      };
+    },
+  };
+}
+
+/**
+ * Install the provider shim as `globalThis.__fw_llm_provider__`.
+ * No-op if the platform already set it (avoids overriding IPC proxy).
+ * Called ONCE — the shim routes per-worker via AsyncLocalStorage.
+ */
+export async function installProviderShim(
+  providerConfig: BotProviderConfig,
+  projectDir?: string,
+): Promise<void> {
+  if ((globalThis as Record<string, unknown>).__fw_llm_provider__) return;
+
+  // Kill any cached CLI sessions from previous runs that may have different
+  // options. The cache now validates options via fingerprint, but a clean
+  // start is still safest.
+  try {
+    const { killAllCliSessions } = await import('@synergenius/flow-weaver/agent');
+    killAllCliSessions();
+  } catch { /* non-fatal */ }
+
+  (globalThis as Record<string, unknown>).__fw_llm_provider__ = buildProviderShim(providerConfig, projectDir);
+}
+
+/**
+ * Clean up all MCP bridges (for shutdown).
+ */
+export function cleanupBridges(): void {
+  for (const [, bridge] of bridges) {
+    bridge.cleanup();
+  }
+  bridges.clear();
+}

package/src/bot/runner.ts

@@ -36,6 +36,8 @@ import { RunStore } from './run-store.js';
 import { CostTracker } from './cost-tracker.js';
 import { CostStore } from './cost-store.js';
 import { runRegistry } from './run-registry.js';
+import { buildProviderShim, installProviderShim, runWithWorkerId, getActiveWorkerId } from './provider-shim.js';
+export { buildProviderShim };
 
 function resolveApproval(
   approval: BotConfig['approval'],
@@ -246,6 +248,18 @@ export async function runWorkflow(
     /** Bot slot that executes this run. */
     botId?: string;
   },
+): Promise<WorkflowResult> {
+  // Wrap in AsyncLocalStorage context so the provider shim routes
+  // .chat() calls to the correct per-worker CLI session.
+  if (options?.botId) {
+    return runWithWorkerId(options.botId, () => runWorkflowInner(filePath, options));
+  }
+  return runWorkflowInner(filePath, options);
+}
+
+async function runWorkflowInner(
+  filePath: string,
+  options?: Parameters<typeof runWorkflow>[1],
 ): Promise<WorkflowResult> {
   const absPath = path.resolve(filePath);
   const verbose = options?.verbose ?? false;
@@ -293,6 +307,15 @@ export async function runWorkflow(
 
   const provider = await createProvider(providerConfig);
 
+  // Install provider shim so callPlatformWithMessages works for ALL providers.
+  // See src/bot/provider-shim.ts for full documentation on why this is needed.
+  // Use params.projectDir (workspace) when available (swarm runs), else workflow dir.
+  // Install ONE routing shim on the global. The shim uses AsyncLocalStorage
+  // to read the current worker ID and dispatch to per-worker CLI sessions.
+  // See src/bot/provider-shim.ts for full documentation.
+  const shimDir = (options?.params?.projectDir as string) ?? path.dirname(absPath);
+  installProviderShim(providerConfig, shimDir);
+
   const costTracker = new CostTracker(providerConfig.model ?? 'unknown', providerConfig.name);
   // Track cost per AI call, emit to EventLog for live streaming (throttled to 1/sec)
   let lastCostEmit = 0;
@@ -309,25 +332,47 @@ export async function runWorkflow(
       });
     }
   };
-  // Set global usage callback so callPlatform (used by node types) can report
-  // token usage to the CostTracker. This bridges the gap between direct callAI
-  // calls in node types and the runner's cost tracking infrastructure.
-  (globalThis as Record<string, unknown>).__fw_ai_usage_callback__ = (
-    model: string,
-    usage: { inputTokens: number; outputTokens: number },
-  ) => {
-    costTracker.track('platform-call', model, usage);
-    const now = Date.now();
-    if (options?.eventLog && now - lastCostEmit >= 1000) {
-      lastCostEmit = now;
-      const summary = costTracker.getRunSummary();
-      options.eventLog.emit({
-        type: 'cost-update',
-        timestamp: now,
-        data: { totalCost: summary.totalCost, totalInputTokens: summary.totalInputTokens, totalOutputTokens: summary.totalOutputTokens },
-      });
-    }
-  };
+  // Set global usage callback. Uses AsyncLocalStorage (via getActiveWorkerId)
+  // to route usage to the correct worker's CostTracker in concurrent swarm mode.
+  // The callback is set once and routes per-worker — NOT overwritten per worker.
+  if (!(globalThis as Record<string, unknown>).__fw_ai_usage_callback__) {
+    // Map of workerId → { costTracker, eventLog, lastCostEmit }
+    const workerTrackers = new Map<string, { costTracker: CostTracker; eventLog?: typeof options extends { eventLog?: infer E } ? E : never; lastCostEmit: number }>();
+    (globalThis as Record<string, unknown>).__fw_ai_usage_callback__ = (
+      model: string,
+      usage: { inputTokens: number; outputTokens: number },
+    ) => {
+      const workerId = getActiveWorkerId() ?? '__default__';
+      const tracker = workerTrackers.get(workerId);
+      if (!tracker) return;
+      tracker.costTracker.track('platform-call', model, usage);
+      const now = Date.now();
+      if (tracker.eventLog && now - tracker.lastCostEmit >= 1000) {
+        tracker.lastCostEmit = now;
+        const summary = tracker.costTracker.getRunSummary();
+        (tracker.eventLog as any).emit({
+          type: 'cost-update',
+          timestamp: now,
+          data: { totalCost: summary.totalCost, totalInputTokens: summary.totalInputTokens, totalOutputTokens: summary.totalOutputTokens },
+        });
+      }
+    };
+    (globalThis as Record<string, unknown>).__fw_usage_trackers__ = workerTrackers;
+  }
+  // Register this worker's tracker
+  const workerId = getActiveWorkerId() ?? '__default__';
+  const workerTrackers = (globalThis as Record<string, unknown>).__fw_usage_trackers__ as Map<string, { costTracker: CostTracker; eventLog?: unknown; lastCostEmit: number }>;
+  workerTrackers.set(workerId, { costTracker, eventLog: options?.eventLog, lastCostEmit: 0 });
+
+  // Set global stream event callback so callCliAsync (used by node types)
+  // emits conversation events (thinking_delta, text_delta, tool_use_start, etc.)
+  // to the EventLog for the InstanceStreamView to consume.
+  if (options?.eventLog) {
+    const { setStreamEventCallback } = await import('./ai-client.js');
+    setStreamEventCallback((event) => {
+      options.eventLog!.emit(event);
+    });
+  }
 
   const channels = notifyConfigs.map(
     (c) => new WebhookNotificationChannel(c, options?.onNotificationError),
@@ -632,7 +677,10 @@ export async function runWorkflow(
     registryPromiseResolve?.();
     try { options?.eventLog?.done(); } catch { /* already done or no log */ }
     teardownAuditLogger();
-    delete (globalThis as Record<string, unknown>).__fw_ai_usage_callback__;
+    // Unregister this worker's tracker — don't delete the globals (other workers may still be active)
+    const cleanupWorkerId = getActiveWorkerId() ?? '__default__';
+    const cleanupTrackers = (globalThis as Record<string, unknown>).__fw_usage_trackers__ as Map<string, unknown> | undefined;
+    cleanupTrackers?.delete(cleanupWorkerId);
   }
 }
 

package/src/bot/step-executor.ts

@@ -7,7 +7,9 @@ import { promisify } from 'node:util';
 const execAsync = promisify(exec);
 import { runCommand } from '@synergenius/flow-weaver';
 import { BLOCKED_SHELL_PATTERNS } from './safety.js';
-import { OP_WRITE_FILE, OP_READ_FILE, OP_PATCH_FILE, OP_LIST_FILES, OP_RUN_SHELL, OP_TASK_CREATE, OP_RESPOND, OP_NO_OP, OP_NOOP, OP_DONE, OP_COMPLETE, OP_CREATE_WORKFLOW, OP_MODIFY_SOURCE, OP_IMPLEMENT_NODE, OP_REMEMBER, OP_RECALL, normalizeOperation } from './operations.js';
+import { OP_WRITE_FILE, OP_READ_FILE, OP_PATCH_FILE, OP_LIST_FILES, OP_RUN_SHELL, OP_TASK_CREATE, OP_RESPOND, OP_NO_OP, OP_NOOP, OP_DONE, OP_COMPLETE, OP_CREATE_WORKFLOW, OP_MODIFY_SOURCE, OP_IMPLEMENT_NODE, OP_REMEMBER, OP_RECALL, OP_TSC_CHECK, OP_RUN_TESTS, normalizeOperation } from './operations.js';
+import { isBlockedUrl } from './safety.js';
+import { execFileSync } from 'node:child_process';
 import { TaskStore } from './task-store.js';
 import type { CreateTaskInput } from './task-types.js';
 
@@ -55,8 +57,17 @@ export function resetPlanFileCounter(): void {
 // ---------------------------------------------------------------------------
 
 function assertSafePath(filePath: string, projectDir: string): void {
-  const resolved = path.resolve(projectDir, filePath);
+  // Normalize absolute paths that fall inside projectDir to relative.
+  // Models sometimes generate absolute paths from context they see in prompts.
   const resolvedBase = path.resolve(projectDir);
+  let normalizedPath = filePath;
+  if (path.isAbsolute(filePath)) {
+    const absPath = path.resolve(filePath);
+    if (absPath.startsWith(resolvedBase + path.sep) || absPath === resolvedBase) {
+      normalizedPath = path.relative(resolvedBase, absPath) || '.';
+    }
+  }
+  const resolved = path.resolve(projectDir, normalizedPath);
   if (!resolved.startsWith(resolvedBase + path.sep) && resolved !== resolvedBase) {
     throw new Error(
       `Path traversal blocked: "${filePath}" resolves outside project directory.`,
@@ -418,135 +429,25 @@ export async function executeStep(
     // Task management — create subtasks for recursive swarm execution
     // -----------------------------------------------------------------
     case OP_TASK_CREATE: {
-      const title = (args.title as string) ?? '';
-      if (!title) return { blocked: true, blockReason: 'task_create requires a "title" argument. Expected: { title: "...", description: "...", parentId: "@self", assignedProfile: "developer|reviewer|ops|orchestrator" }' };
-
-      const store = new TaskStore(projectDir);
-
-      // Validate assignedProfile: must be a valid slug (lowercase alphanumeric + hyphens)
-      const rawProfile = args.assignedProfile as string | undefined;
-      let assignedProfile: string | undefined;
-      if (rawProfile !== undefined && rawProfile !== null) {
-        if (typeof rawProfile !== 'string' || !rawProfile.trim()) {
-          return { blocked: true, blockReason: 'task_create: assignedProfile must be a non-empty string.' };
-        }
-        if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(rawProfile)) {
-          return { blocked: true, blockReason: `task_create: assignedProfile "${rawProfile}" is not a valid slug (use lowercase alphanumeric with hyphens).` };
-        }
-        assignedProfile = rawProfile;
-      }
-
-      // Validate complexity against enum, default to 'simple' if invalid
-      const VALID_COMPLEXITIES = new Set(['trivial', 'simple', 'moderate', 'complex']);
-      const rawComplexity = args.complexity as string | undefined;
-      const complexity: 'trivial' | 'simple' | 'moderate' | 'complex' =
-        rawComplexity && VALID_COMPLEXITIES.has(rawComplexity)
-          ? (rawComplexity as 'trivial' | 'simple' | 'moderate' | 'complex')
-          : 'simple';
-
-      // Validate priority: coerce to number, default to 0 if NaN
-      const rawPriority = Number(args.priority);
-      const priority = Number.isFinite(rawPriority) ? rawPriority : 0;
-
-      // Validate parentId — must reference an existing task
-      const rawParentId = args.parentId as string | undefined;
-      let parentId: string | undefined;
-      if (rawParentId) {
-        // Resolve through symbolicIdMap first (in case it's a title or symbolic ref)
-        const resolved = symbolicIdMap?.[rawParentId] ?? rawParentId;
-        const parentTask = await store.get(resolved);
-        if (!parentTask) {
-          return { blocked: true, blockReason: `task_create: parentId "${rawParentId}" does not match any existing task. Use the exact Task ID from the prompt.` };
-        }
-        parentId = resolved;
+      // Use shared handler for validation, @self resolution, dedup, acceptance parsing
+      const { handleTaskCreate } = await import('./task-create-handler.js');
+      const createResult = await handleTaskCreate(args as any, projectDir, symbolicIdMap);
+      if (createResult.blocked) {
+        return { blocked: true, blockReason: createResult.blockReason };
       }
-
-      // Idempotent: if a task with the same title and parentId already exists, return it
-      // instead of creating a duplicate. This prevents retry loops from producing duplicates.
-      if (parentId) {
-        const existing = (await store.list()).find(
-          t => t.parentId === parentId && t.title.toLowerCase() === title.toLowerCase(),
-        );
-        if (existing) {
-          if (symbolicIdMap) {
-            const symbolicKey = (args.symbolicId as string) ?? (args.id as string);
-            if (symbolicKey) symbolicIdMap[symbolicKey] = existing.id;
-            symbolicIdMap[title] = existing.id;
-          }
-          return { output: `Task "${title}" already exists (${existing.id}), skipped duplicate.` };
-        }
-      }
-
-      // Resolve symbolic IDs in dependsOn through the map
-      const rawDeps = (args.dependsOn as string[]) ?? [];
-      const resolvedDeps = symbolicIdMap
-        ? rawDeps.map(dep => symbolicIdMap[dep] ?? dep)
-        : rawDeps;
-
-      // Parse acceptance criteria if provided
-      const rawAcceptance = args.acceptance as Record<string, unknown> | undefined;
-      const acceptance = rawAcceptance?.checks ? {
-        checks: (rawAcceptance.checks as Array<{ name: string; command: string }>).map(c => ({
-          name: String(c.name ?? ''),
-          command: String(c.command ?? ''),
-        })).filter(c => c.name && c.command),
-      } : undefined;
-
-      const input: CreateTaskInput = {
-        title,
-        description: (args.description as string) ?? title,
-        complexity,
-        priority,
-        parentId,
-        dependsOn: resolvedDeps,
-        assignedProfile,
-        acceptance,
-      };
-
-      // Support inline subtasks
-      const subtasksArg = args.subtasks as Array<Record<string, unknown>> | undefined;
-      if (subtasksArg?.length) {
-        // Validate subtask titles are non-empty
-        for (let i = 0; i < subtasksArg.length; i++) {
-          const subTitle = (subtasksArg[i].title as string) ?? '';
-          if (!subTitle.trim()) {
-            return { blocked: true, blockReason: `task_create: subtask[${i}] has an empty title. All subtasks must have non-empty titles.` };
-          }
-        }
-
-        input.subtasks = subtasksArg.map((s) => {
-          const subComplexity = s.complexity as string | undefined;
-          const subPriority = Number(s.priority);
-          return {
-            title: (s.title as string) ?? '',
-            description: (s.description as string) ?? '',
-            complexity: subComplexity && VALID_COMPLEXITIES.has(subComplexity)
-              ? (subComplexity as 'trivial' | 'simple' | 'moderate' | 'complex')
-              : 'simple',
-            priority: Number.isFinite(subPriority) ? subPriority : 0,
-            assignedProfile: (s.assignedProfile as string) ?? assignedProfile ?? 'developer',
-            dependsOn: symbolicIdMap
-              ? ((s.dependsOn as string[]) ?? []).map(dep => symbolicIdMap[dep] ?? dep)
-              : (s.dependsOn as string[]) ?? [],
-            acceptance: s.acceptance ? { checks: ((s.acceptance as Record<string, unknown>).checks as Array<{name:string,command:string}>).map(c => ({name:String(c.name),command:String(c.command)})).filter(c=>c.name&&c.command) } : undefined,
-          };
-        });
+      if (!createResult.taskId) {
+        // Dedup — task already existed
+        return { output: createResult.output };
       }
 
-      const task = await store.create(input);
-
-      // Register symbolic ID → real ID mapping.
-      // Also map the title so the AI can reference tasks by title in dependsOn.
-      if (symbolicIdMap) {
-        const symbolicKey = (args.symbolicId as string) ?? (args.id as string);
-        if (symbolicKey) symbolicIdMap[symbolicKey] = task.id;
-        // Title-based mapping — the AI often uses task titles as dependency references
-        symbolicIdMap[title] = task.id;
-      }
+      const store = new TaskStore(projectDir);
+      const title = String(args.title ?? '');
 
-      const subtasks = task.isParent ? await store.getSubtasks(task.id) : [];
-      const ids = [task.id, ...subtasks.map(s => s.id)];
-      return { output: `Created task "${title}" (${task.id})${subtasks.length ? ` with ${subtasks.length} subtasks` : ''}. IDs: ${ids.join(', ')}` };
+      // Shared handler already created the task — return result
+      const task = await store.get(createResult.taskId!);
+      const subtasks = task?.isParent ? await store.getSubtasks(createResult.taskId!) : [];
+      const ids = [createResult.taskId!, ...subtasks.map(s => s.id)];
+      return { output: `Created task "${title}" (${createResult.taskId})${subtasks.length ? ` with ${subtasks.length} subtasks` : ''}. IDs: ${ids.join(', ')}` };
     }
 
     // -----------------------------------------------------------------
@@ -591,6 +492,47 @@ export async function executeStep(
       return { output: response || undefined };
     }
 
+    // -----------------------------------------------------------------
+    // TypeScript check + test runner (same as weaver-tools.ts handlers)
+    // -----------------------------------------------------------------
+    case OP_TSC_CHECK: {
+      try {
+        const output = execFileSync('npx', ['tsc', '--noEmit', '--pretty'], {
+          cwd: projectDir, encoding: 'utf-8', timeout: 60_000, stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return { output: output.trim() || 'No TypeScript errors.' };
+      } catch (err: any) {
+        return { output: (err.stdout ?? err.message ?? '').slice(0, 5000) };
+      }
+    }
+
+    case OP_RUN_TESTS: {
+      const pattern = args.pattern ? String(args.pattern) : '';
+      try {
+        const testArgs = ['vitest', 'run', '--reporter', 'verbose'];
+        if (pattern) testArgs.push(pattern);
+        const output = execFileSync('npx', testArgs, {
+          cwd: projectDir, encoding: 'utf-8', timeout: 120_000, stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return { output: output.slice(0, 5000) };
+      } catch (err: any) {
+        return { output: (err.stdout ?? err.stderr ?? err.message ?? '').slice(0, 5000) };
+      }
+    }
+
+    case 'web_fetch': {
+      const url = String(args.url ?? '');
+      if (!url) return { output: 'Error: url is required', blocked: true, blockReason: 'Missing url argument' };
+      if (isBlockedUrl(url)) return { output: 'Blocked: cannot fetch internal/localhost URLs.', blocked: true, blockReason: 'Blocked URL' };
+      try {
+        const resp = await fetch(url, { method: (args.method as string) ?? 'GET', signal: AbortSignal.timeout(15_000) });
+        const text = await resp.text();
+        return { output: text.slice(0, 10_000) };
+      } catch (err: any) {
+        return { output: `Fetch error: ${err.message}` };
+      }
+    }
+
     default: {
       const result = await runCommand(operation, { ...args, cwd: projectDir });
       return {