@warlock.js/ai-workspace 5.43.0 → 5.44.0

package/cjs/index.cjs

@@ -30,6 +30,7 @@ let _warlock_js_ai = require("@warlock.js/ai");
 let node_path = require("node:path");
 node_path = __toESM(node_path, 1);
 let node_fs_promises = require("node:fs/promises");
+let node_fs = require("node:fs");
 let _warlock_js_fs = require("@warlock.js/fs");
 let node_child_process = require("node:child_process");
 let node_process = require("node:process");
@@ -89,6 +90,7 @@ var WorkspaceEditError = class extends _warlock_js_ai.AIError {
 		this.expectedHash = options.expectedHash;
 		this.actualHash = options.actualHash;
 		this.editIndex = options.editIndex;
+		this.hint = options.hint;
 		this.hunkIndex = options.hunkIndex;
 	}
 };
@@ -180,6 +182,810 @@ function isInsideJailLexically(policy, target) {
 	return (policy.allowPaths ?? []).some((allowRoot) => isInside(target, node_path.default.resolve(allowRoot)));
 }
 
+//#endregion
+//#region ../../packages/ai-workspace/src/output/spill-dir.ts
+/**
+* The absolute directory spill files go to, or `undefined` when the policy
+* has no `output.spillDir` (spilling is off).
+*/
+function resolveSpillDir(policy) {
+	const dir = policy.output?.spillDir;
+	return dir === void 0 ? void 0 : node_path.default.resolve(policy.cwd, dir);
+}
+
+//#endregion
+//#region ../../packages/ai-workspace/src/policy/powershell-aliases.ts
+const FAMILIES = [
+	{
+		canonical: "rm",
+		names: [
+			"remove-item",
+			"ri",
+			"rm",
+			"del",
+			"erase",
+			"rd",
+			"rmdir"
+		],
+		recurseFlag: "r",
+		forceFlag: "f",
+		params: [
+			["recurse", "recurse"],
+			["force", "force"],
+			["path", "operand"],
+			["literalpath", "operand"],
+			["whatif", "switch"],
+			["confirm", "switch"],
+			["filter", "value"],
+			["include", "value"],
+			["exclude", "value"],
+			["credential", "value"],
+			["stream", "value"]
+		]
+	},
+	{
+		canonical: "cp",
+		names: [
+			"copy-item",
+			"cpi",
+			"cp",
+			"copy"
+		],
+		recurseFlag: "r",
+		forceFlag: "f",
+		params: [
+			["recurse", "recurse"],
+			["force", "force"],
+			["path", "operand"],
+			["literalpath", "operand"],
+			["destination", "operand"],
+			["whatif", "switch"],
+			["confirm", "switch"],
+			["filter", "value"],
+			["include", "value"],
+			["exclude", "value"],
+			["credential", "value"]
+		]
+	},
+	{
+		canonical: "mv",
+		names: [
+			"move-item",
+			"mi",
+			"mv",
+			"move"
+		],
+		recurseFlag: "",
+		forceFlag: "f",
+		params: [
+			["force", "force"],
+			["path", "operand"],
+			["literalpath", "operand"],
+			["destination", "operand"],
+			["whatif", "switch"],
+			["confirm", "switch"],
+			["filter", "value"],
+			["include", "value"],
+			["exclude", "value"],
+			["credential", "value"]
+		]
+	},
+	{
+		canonical: "ls",
+		names: [
+			"get-childitem",
+			"gci",
+			"ls",
+			"dir"
+		],
+		recurseFlag: "R",
+		forceFlag: "a",
+		params: [
+			["recurse", "recurse"],
+			["force", "force"],
+			["path", "operand"],
+			["literalpath", "operand"],
+			["filter", "value"],
+			["include", "value"],
+			["exclude", "value"],
+			["depth", "value"],
+			["name", "switch"]
+		]
+	},
+	{
+		canonical: "cat",
+		names: [
+			"get-content",
+			"gc",
+			"cat",
+			"type"
+		],
+		recurseFlag: "",
+		forceFlag: "",
+		params: [
+			["path", "operand"],
+			["literalpath", "operand"],
+			["totalcount", "value"],
+			["tail", "value"],
+			["head", "value"],
+			["encoding", "value"],
+			["filter", "value"],
+			["include", "value"],
+			["exclude", "value"],
+			["force", "switch"],
+			["raw", "switch"],
+			["wait", "switch"]
+		]
+	},
+	{
+		canonical: "curl",
+		names: [
+			"invoke-webrequest",
+			"iwr",
+			"invoke-restmethod",
+			"irm",
+			"curl",
+			"wget"
+		],
+		recurseFlag: "",
+		forceFlag: "",
+		params: [
+			["uri", "operand"],
+			["outfile", "outfile"],
+			["method", "method"],
+			["headers", "value"],
+			["body", "value"],
+			["contenttype", "value"],
+			["useragent", "value"],
+			["credential", "value"],
+			["timeoutsec", "value"],
+			["proxy", "value"]
+		]
+	},
+	{
+		canonical: "kill",
+		names: [
+			"stop-process",
+			"spps",
+			"kill"
+		],
+		recurseFlag: "",
+		forceFlag: "9",
+		params: [
+			["id", "operand"],
+			["name", "operand"],
+			["force", "force"],
+			["inputobject", "value"],
+			["whatif", "switch"],
+			["confirm", "switch"]
+		]
+	}
+];
+const BY_NAME = /* @__PURE__ */ new Map();
+for (const family of FAMILIES) for (const name of family.names) BY_NAME.set(name, family);
+/** PowerShell reads an en dash, em dash or horizontal bar as the parameter dash too. */
+const FLAG_ORDER = "rRfa9";
+const DASH = /^[-–—―]/;
+/** Lowercase executable name used to look an alias up. */
+function aliasKey(first) {
+	return (first.split(/[\\/]/).pop() ?? first).replace(/\.(exe|cmd|bat|com)$/i, "").toLowerCase();
+}
+/** Split `-Name` / `-Name:value` into the lowercase name and the inline value. */
+function parameter(arg) {
+	if (!DASH.test(arg) || arg.length < 2) return null;
+	const body = arg.slice(1);
+	const colon = body.indexOf(":");
+	return colon === -1 ? { name: body.toLowerCase() } : {
+		name: body.slice(0, colon).toLowerCase(),
+		inline: body.slice(colon + 1)
+	};
+}
+/**
+* The canonical argv of a PowerShell command that uses an alias or cmdlet
+* name from the table (`Remove-Item -Recurse -Force x` → `["rm", "-rf", "x"]`),
+* or `undefined` when the command has no canonical form.
+*/
+function canonicalPowerShellArgv(argv) {
+	const family = BY_NAME.get(aliasKey(argv[0] ?? ""));
+	if (family === void 0) return;
+	let flags = "";
+	const operands = [];
+	const extras = [];
+	for (let index = 1; index < argv.length; index++) {
+		const arg = argv[index] ?? "";
+		const parsed = parameter(arg);
+		if (parsed === null) {
+			operands.push(arg);
+			continue;
+		}
+		const match = family.params.find(([name]) => parsed.name !== "" && name.startsWith(parsed.name));
+		if (match === void 0) continue;
+		const role = match[1];
+		if (role === "recurse") flags += family.recurseFlag;
+		else if (role === "force") flags += family.forceFlag;
+		else if (role === "switch") continue;
+		else {
+			const value = parsed.inline ?? argv[++index] ?? "";
+			if (role === "operand") operands.push(value);
+			else if (role === "outfile") extras.push("-o", value);
+			else if (role === "method") extras.push("-X", value);
+		}
+	}
+	const unique = [...FLAG_ORDER].filter((flag) => flags.includes(flag)).join("");
+	return [
+		family.canonical,
+		...unique !== "" ? [`-${unique}`] : [],
+		...extras,
+		...operands
+	];
+}
+/** The names PowerShell's `cd` goes by. */
+const POWERSHELL_CD_NAMES = /* @__PURE__ */ new Set([
+	"cd",
+	"sl",
+	"set-location",
+	"chdir"
+]);
+/** Directory stack commands, refused because the policy does not track them. */
+const POWERSHELL_DIRECTORY_STACK = /* @__PURE__ */ new Set([
+	"push-location",
+	"pushd",
+	"pop-location",
+	"popd"
+]);
+/**
+* Normalise a PowerShell `cd` to `[cd, directory]`: `-Path x`, `-LiteralPath x`
+* (and their prefixes, `-Path:x`) become the directory operand. Returns `null`
+* for any other parameter (`-PassThru`, `-StackName`, …).
+*/
+function normalizePowerShellCd(words) {
+	const first = words[0];
+	if (first === void 0) return null;
+	const operands = [];
+	for (let index = 1; index < words.length; index++) {
+		const word = words[index];
+		const parsed = word.quoted ? null : parameter(word.value);
+		if (parsed === null) {
+			operands.push(word);
+			continue;
+		}
+		const isPath = parsed.name.length >= 2 && "path".startsWith(parsed.name);
+		const isLiteral = parsed.name.length >= 1 && "literalpath".startsWith(parsed.name);
+		if (!isPath && !isLiteral) return null;
+		if (parsed.inline !== void 0) operands.push({
+			...word,
+			raw: parsed.inline,
+			value: parsed.inline
+		});
+		else {
+			const next = words[++index];
+			if (next === void 0) return null;
+			operands.push(next);
+		}
+	}
+	return [first, ...operands];
+}
+
+//#endregion
+//#region ../../packages/ai-workspace/src/policy/shell-interpreter.ts
+/** The real host: the running platform, `process.env.PATH`, and the filesystem. */
+function currentShellHost() {
+	return {
+		platform: process.platform,
+		pathEnv: process.env.PATH ?? process.env.Path,
+		isExecutable: (file) => {
+			try {
+				(0, node_fs.accessSync)(file, process.platform === "win32" ? node_fs.constants.F_OK : node_fs.constants.X_OK);
+				return true;
+			} catch {
+				return false;
+			}
+		}
+	};
+}
+/** The grammar a concrete interpreter reads on `platform`. */
+function dialectOf(interpreter, platform = process.platform) {
+	if (interpreter === "powershell") return "powershell";
+	if (interpreter === "cmd") return "cmd";
+	return interpreter === "sh" && platform === "win32" ? "cmd" : "posix";
+}
+/** The first of `names` found in the host's `PATH` (Windows: with `.exe`). */
+function findOnPath(names, host) {
+	const windows = host.platform === "win32";
+	const separator = windows ? ";" : ":";
+	const join = windows ? node_path.default.win32.join : node_path.default.posix.join;
+	const directories = (host.pathEnv ?? "").split(separator).filter((entry) => entry !== "");
+	for (const name of names) for (const directory of directories) {
+		const candidate = join(directory, windows ? `${name}.exe` : name);
+		if (host.isExecutable(candidate)) return candidate;
+	}
+}
+/** Git for Windows' `bash.exe`, derived from the `git` found on `PATH`. */
+function findGitBash(host) {
+	const git = findOnPath(["git"], host);
+	if (git === void 0) return;
+	const win = node_path.default.win32;
+	const roots = [win.dirname(win.dirname(git)), win.dirname(win.dirname(win.dirname(git)))];
+	for (const root of roots) for (const candidate of [win.join(root, "bin", "bash.exe"), win.join(root, "usr", "bin", "bash.exe")]) if (host.isExecutable(candidate)) return candidate;
+}
+/** The PowerShell executable names, newest first. */
+function powershellNames(host) {
+	return host.platform === "win32" ? ["pwsh", "powershell"] : ["pwsh"];
+}
+function powershellLabel(file) {
+	return file !== void 0 && /pwsh(\.exe)?$/i.test(file) ? "PowerShell 7 (pwsh)" : "PowerShell";
+}
+/**
+* Resolve a shell policy's `interpreter` (and `interpreterPath`) to the
+* concrete shell that will run lines, and the grammar they are checked with.
+*
+* `"auto"` picks `pwsh`, then Windows PowerShell, then Git Bash (found next to
+* `git`), then `cmd.exe` on Windows and `bash`, then `sh` elsewhere. An explicit interpreter whose executable
+* is not on `PATH` keeps its name and has no `file`, so the spawn reports the
+* missing shell instead of quietly running another one.
+*
+* @example
+* resolveShell({ interpreter: "auto" }, { platform: "win32", pathEnv: "C:\\bin", isExecutable })
+*/
+function resolveShell(shell, host = currentShellHost()) {
+	const requested = shell?.interpreter ?? "none";
+	const explicit = shell?.interpreterPath;
+	if (requested === "none") return {
+		interpreter: "none",
+		dialect: "posix",
+		label: "none"
+	};
+	let interpreter;
+	let file = explicit;
+	if (requested === "auto") {
+		if (explicit !== void 0) interpreter = /(^|[\\/])(pwsh|powershell)(\.exe)?$/i.test(explicit) ? "powershell" : /(^|[\\/])cmd(\.exe)?$/i.test(explicit) ? "cmd" : /(^|[\\/])bash(\.exe)?$/i.test(explicit) ? "bash" : "sh";
+		else if (host.platform === "win32") {
+			const powershell = findOnPath(powershellNames(host), host);
+			const gitBash = powershell === void 0 ? findGitBash(host) : void 0;
+			interpreter = powershell !== void 0 ? "powershell" : gitBash !== void 0 ? "bash" : "cmd";
+			file = powershell ?? gitBash;
+		} else {
+			const bash = findOnPath(["bash"], host);
+			interpreter = bash !== void 0 ? "bash" : "sh";
+			file = bash;
+		}
+	} else interpreter = requested;
+	if (file === void 0) {
+		if (interpreter === "powershell") file = findOnPath(powershellNames(host), host);
+		else if (interpreter === "bash") file = findOnPath(["bash"], host) ?? (host.platform === "win32" ? findGitBash(host) : void 0);
+		else if (interpreter === "cmd" && host.platform === "win32") file = process.env.ComSpec ?? "cmd.exe";
+	}
+	const labels = {
+		none: "none",
+		sh: host.platform === "win32" ? "cmd.exe" : "sh",
+		bash: "bash",
+		cmd: "cmd.exe",
+		powershell: powershellLabel(file)
+	};
+	return {
+		interpreter,
+		dialect: dialectOf(interpreter, host.platform),
+		...file !== void 0 ? { file } : {},
+		label: labels[interpreter]
+	};
+}
+
+//#endregion
+//#region ../../packages/ai-workspace/src/policy/powershell-parser.ts
+/**
+* Parser for the PowerShell dialect (`powershell -Command` / `pwsh -Command`).
+*
+* Like the other dialects it is deliberately conservative: it finds every
+* simple command a line would run and every redirection target, and refuses
+* what it cannot read with confidence. Supported: `;` and line breaks, `&&`,
+* `||`, `|`, `$( )` subexpressions (their commands are checked too), the call
+* operator `&` in front of a command, single and double
+* quotes (including the typographic quotes PowerShell treats as quotes),
+* backtick escapes, `$name` / `${name}` / `$env:NAME` variables (dynamic
+* words), and the redirections `>`, `>>`, `2>`, `2>>`, `*>`, `2>&1`.
+*
+* Refused: script blocks and braces, bare parentheses,
+* `@( )` / `@{ }` / splatting / here-strings, the stop-parsing token `--%`,
+* `<` redirection, comments, the comma operator, compound-statement
+* keywords (`if`, `foreach`, `function`, `try`, …), dot-sourcing, a `&` that
+* is not a call operator (background jobs), and type literals.
+*/
+/** Statement keywords that start a compound command; refused in command position. */
+const POWERSHELL_KEYWORDS = /* @__PURE__ */ new Set([
+	"if",
+	"elseif",
+	"else",
+	"switch",
+	"foreach",
+	"for",
+	"while",
+	"do",
+	"until",
+	"function",
+	"filter",
+	"workflow",
+	"param",
+	"begin",
+	"process",
+	"end",
+	"try",
+	"catch",
+	"finally",
+	"trap",
+	"data",
+	"class",
+	"enum",
+	"using",
+	"return",
+	"break",
+	"continue",
+	"throw",
+	"parallel",
+	"sequence",
+	"inlinescript"
+]);
+/** Characters PowerShell reads as a single quote. */
+const SINGLE_QUOTES = "'‘’‚‛";
+/** Characters PowerShell reads as a double quote. */
+const DOUBLE_QUOTES = "\"“”„";
+/** Variable-name characters after `$`. */
+const VARIABLE_CHAR = /[A-Za-z0-9_:?^$]/;
+/** Whether `char` (never the empty end-of-input string) is one of `set`. */
+function inSet(set, char) {
+	return char !== "" && set.includes(char);
+}
+var PowerShellRefusal = class extends Error {
+	constructor(reason, message) {
+		super(message);
+		this.reason = reason;
+	}
+};
+function unsupported$1(message) {
+	return new PowerShellRefusal("unsupported-syntax", message);
+}
+var PowerShellParser = class PowerShellParser {
+	constructor(src, commands = [], depth = 0) {
+		this.src = src;
+		this.commands = commands;
+		this.depth = depth;
+		this.pos = 0;
+	}
+	atEnd() {
+		return this.pos >= this.src.length;
+	}
+	peek(offset = 0) {
+		return this.src.charAt(this.pos + offset);
+	}
+	skipBlanks() {
+		while (this.peek() === " " || this.peek() === "	") this.pos++;
+	}
+	atLineBreak() {
+		return this.peek() === "\n" || this.peek() === "\r";
+	}
+	parseProgram(segments) {
+		while (true) {
+			this.skipBlanks();
+			if (this.atEnd()) {
+				if (segments.length === 0) throw unsupported$1("The command is empty.");
+				if (segments[segments.length - 1]?.operator === "&&" || segments[segments.length - 1]?.operator === "||") throw unsupported$1("The line ends with an operator but no command follows it.");
+				return;
+			}
+			const start = this.pos;
+			this.parsePipeline();
+			const end = this.pos;
+			this.skipBlanks();
+			const operator = this.readListOperator();
+			segments.push({
+				source: this.src.slice(start, end).trim(),
+				...operator !== null ? { operator } : {}
+			});
+			if (operator === null) {
+				if (!this.atEnd()) throw unsupported$1(`Unexpected \`${this.peek()}\`.`);
+				return;
+			}
+			if (operator === ";" || operator === "\n") while (this.peek() === " " || this.peek() === "	" || this.atLineBreak()) this.pos++;
+			else this.skipBlanks();
+		}
+	}
+	readListOperator() {
+		const char = this.peek();
+		if (char === "&" && this.peek(1) === "&") {
+			this.pos += 2;
+			return "&&";
+		}
+		if (char === "|" && this.peek(1) === "|") {
+			this.pos += 2;
+			return "||";
+		}
+		if (char === ";") {
+			this.pos++;
+			return ";";
+		}
+		if (this.atLineBreak()) {
+			while (this.atLineBreak()) this.pos++;
+			return "\n";
+		}
+		return null;
+	}
+	parsePipeline() {
+		this.parseCommand();
+		while (this.peek() === "|" && this.peek(1) !== "|") {
+			this.pos++;
+			this.skipBlanks();
+			if (this.atEnd() || this.atLineBreak() || this.peek() === ";") throw unsupported$1("The line ends with `|` but no command follows it.");
+			this.parseCommand();
+		}
+	}
+	atRedirectStart() {
+		const char = this.peek();
+		if (char === ">") return true;
+		return /[1-6*]/.test(char) && this.peek(1) === ">";
+	}
+	parseCommand() {
+		const start = this.pos;
+		const command = {
+			assignments: [],
+			words: [],
+			redirects: [],
+			source: ""
+		};
+		let callOperator = false;
+		if (this.peek() === "&" && this.peek(1) !== "&") {
+			callOperator = true;
+			this.pos++;
+			this.skipBlanks();
+		}
+		while (true) {
+			this.skipBlanks();
+			if (this.atEnd() || this.atLineBreak() || this.peek() === ";" || this.peek() === "|") break;
+			if (this.peek() === "&") {
+				if (this.peek(1) === "&") break;
+				throw unsupported$1("`&` is only supported as the call operator in front of a command (not as a background job).");
+			}
+			if (this.peek() === "<") throw unsupported$1("`<` is not supported in PowerShell command lines.");
+			if (this.atRedirectStart()) {
+				command.redirects.push(this.parseRedirect());
+				continue;
+			}
+			const word = this.parseWord();
+			command.words.push(word);
+			if (command.words.length === 1) this.checkCommandWord(word);
+		}
+		if (command.words.length === 0 && (callOperator || command.redirects.length === 0)) throw unsupported$1("The line has an empty command (two operators in a row?).");
+		command.source = this.src.slice(start, this.pos).trim();
+		this.commands.push(command);
+	}
+	checkCommandWord(word) {
+		if (word.raw.startsWith("[")) throw unsupported$1(`\`${word.raw}\` (a type literal) is not supported.`);
+		if (!word.quoted && word.value === ".") throw unsupported$1("Dot-sourcing (`. file`) runs a script in the current scope and is not supported.");
+		if (!word.quoted && POWERSHELL_KEYWORDS.has(word.value.toLowerCase())) throw unsupported$1(`\`${word.value}\` starts a PowerShell statement, which is not supported.`);
+	}
+	parseRedirect() {
+		let fd;
+		if (this.peek() === "*") this.pos++;
+		else if (/[1-6]/.test(this.peek())) {
+			fd = Number(this.peek());
+			this.pos++;
+		}
+		let op = ">";
+		if (this.peek(1) === ">") op = ">>";
+		this.pos += op.length;
+		if (op === ">" && this.peek() === "&") {
+			if (/[1-6]/.test(this.peek(1))) {
+				const target = {
+					raw: this.peek(1),
+					value: this.peek(1),
+					dynamic: false,
+					quoted: false
+				};
+				this.pos += 2;
+				return {
+					op: ">&",
+					...fd !== void 0 ? { fd } : {},
+					target,
+					type: "dup"
+				};
+			}
+			throw unsupported$1("Only `>&1`-style stream merges (`2>&1`) are supported.");
+		}
+		this.skipBlanks();
+		if (this.atEnd() || this.atLineBreak() || /[;&|<>]/.test(this.peek())) throw unsupported$1(`The redirection \`${op}\` has no target.`);
+		const target = this.parseWord();
+		return {
+			op,
+			...fd !== void 0 ? { fd } : {},
+			target,
+			type: "write"
+		};
+	}
+	parseWord() {
+		const start = this.pos;
+		let value = "";
+		let dynamic = false;
+		let quoted = false;
+		if (this.src.startsWith("--%", this.pos) && /[\s;|&]|^$/.test(this.src.charAt(this.pos + 3))) throw unsupported$1("The stop-parsing token `--%` is not supported.");
+		while (!this.atEnd()) {
+			const char = this.peek();
+			if (char === " " || char === "	" || char === "\n" || char === "\r" || char === ";" || char === "|" || char === "&" || char === ">" || char === "<") break;
+			if (inSet(SINGLE_QUOTES, char)) {
+				this.pos++;
+				quoted = true;
+				while (true) {
+					if (this.atEnd()) throw new PowerShellRefusal("unbalanced-quotes", "A single quote is never closed.");
+					const inner = this.peek();
+					if (inSet(SINGLE_QUOTES, inner)) {
+						if (inSet(SINGLE_QUOTES, this.peek(1))) {
+							value += this.peek(1);
+							this.pos += 2;
+							continue;
+						}
+						this.pos++;
+						break;
+					}
+					value += inner;
+					this.pos++;
+				}
+				continue;
+			}
+			if (inSet(DOUBLE_QUOTES, char)) {
+				this.pos++;
+				quoted = true;
+				while (true) {
+					if (this.atEnd()) throw new PowerShellRefusal("unbalanced-quotes", "A double quote is never closed.");
+					const inner = this.peek();
+					if (inSet(DOUBLE_QUOTES, inner)) {
+						if (inSet(DOUBLE_QUOTES, this.peek(1))) {
+							value += this.peek(1);
+							this.pos += 2;
+							continue;
+						}
+						this.pos++;
+						break;
+					}
+					if (inner === "`") {
+						const next = this.peek(1);
+						if (next !== "" && (inSet(DOUBLE_QUOTES, next) || next === "`" || next === "$")) {
+							value += next;
+							this.pos += 2;
+							continue;
+						}
+						throw unsupported$1("Only `\"`, `` ` `` and `$` can follow a backtick inside double quotes.");
+					}
+					if (inner === "$") {
+						const read = this.readVariable();
+						value += read;
+						dynamic = true;
+						continue;
+					}
+					value += inner;
+					this.pos++;
+				}
+				continue;
+			}
+			if (char === "`") {
+				const next = this.peek(1);
+				if (next === "" || next === "\n" || next === "\r") throw unsupported$1("A backtick at the end of a line (line continuation) is not supported.");
+				value += next;
+				quoted = true;
+				this.pos += 2;
+				continue;
+			}
+			if (char === "$") {
+				const wasLiteral = this.src.charAt(this.pos + 1);
+				if (wasLiteral === "" || !(wasLiteral === "{" || wasLiteral === "(" || VARIABLE_CHAR.test(wasLiteral))) {
+					value += "$";
+					this.pos++;
+					continue;
+				}
+				value += this.readVariable();
+				dynamic = true;
+				continue;
+			}
+			if (char === "@" && this.pos === start) {
+				const next = this.peek(1);
+				if (next === "(" || next === "{" || next === "'" || next === "\"" || /[A-Za-z_$]/.test(next)) throw unsupported$1("Arrays (`@( )`), hashtables, splatting (`@name`) and here-strings are not supported.");
+			}
+			if (char === "{" || char === "}") throw unsupported$1("Script blocks and braces are not supported.");
+			if (char === "(" || char === ")") throw unsupported$1("Parentheses (grouping and `$( )` subexpressions) are not supported; quote the text.");
+			if (char === ",") throw unsupported$1("The comma operator builds an array and is not supported; quote the text.");
+			if (char === "#" && this.pos === start) throw unsupported$1("Comments are not supported in a command line.");
+			if (char === "*" || char === "?" || char === "[" || char === "~" && this.pos === start) dynamic = true;
+			value += char;
+			this.pos++;
+		}
+		return {
+			raw: this.src.slice(start, this.pos),
+			value,
+			dynamic,
+			quoted
+		};
+	}
+	/**
+	* Parse a `$( … )` subexpression: its commands run, so they are collected
+	* (before the command that contains it) and checked like any other.
+	*/
+	parseSubexpression() {
+		if (this.depth >= 8) throw unsupported$1("`$( )` subexpressions are nested too deeply.");
+		const open = this.pos;
+		let level = 0;
+		let index = open;
+		for (; index < this.src.length; index++) {
+			const char = this.src.charAt(index);
+			if (inSet(SINGLE_QUOTES, char) || inSet(DOUBLE_QUOTES, char)) {
+				const set = inSet(SINGLE_QUOTES, char) ? SINGLE_QUOTES : DOUBLE_QUOTES;
+				index++;
+				while (index < this.src.length) {
+					const inner = this.src.charAt(index);
+					if (inner === "`" && set === DOUBLE_QUOTES) {
+						index += 2;
+						continue;
+					}
+					if (inSet(set, inner)) {
+						if (inSet(set, this.src.charAt(index + 1))) {
+							index += 2;
+							continue;
+						}
+						break;
+					}
+					index++;
+				}
+				continue;
+			}
+			if (char === "`") {
+				index++;
+				continue;
+			}
+			if (char === "(") level++;
+			else if (char === ")") {
+				level--;
+				if (level === 0) break;
+			}
+		}
+		if (level !== 0) throw new PowerShellRefusal("unbalanced-quotes", "A `$(` subexpression is never closed.");
+		const inner = this.src.slice(open + 1, index);
+		new PowerShellParser(inner, this.commands, this.depth + 1).parseProgram([]);
+		this.pos = index + 1;
+	}
+	/** Read `$name`, `${name}` or `$env:NAME` at the cursor; a `$(` is refused. */
+	readVariable() {
+		const begin = this.pos;
+		this.pos++;
+		if (this.peek() === "(") {
+			this.parseSubexpression();
+			return this.src.slice(begin, this.pos);
+		}
+		if (this.peek() === "{") {
+			const close = this.src.indexOf("}", this.pos);
+			if (close === -1) throw new PowerShellRefusal("unbalanced-quotes", "A `${` variable name is never closed.");
+			this.pos = close + 1;
+			return this.src.slice(begin, this.pos);
+		}
+		while (!this.atEnd() && VARIABLE_CHAR.test(this.peek())) this.pos++;
+		return this.src.slice(begin, this.pos);
+	}
+};
+/** Parse a PowerShell command line for the shell policy. Never throws. */
+function parsePowerShellLine(line) {
+	const segments = [];
+	const parser = new PowerShellParser(line);
+	try {
+		parser.parseProgram(segments);
+		return {
+			ok: true,
+			commands: parser.commands,
+			segments,
+			background: false
+		};
+	} catch (error) {
+		if (error instanceof PowerShellRefusal) return {
+			ok: false,
+			reason: error.reason,
+			message: error.message
+		};
+		throw error;
+	}
+}
+
 //#endregion
 //#region ../../packages/ai-workspace/src/policy/shell-parser.ts
 /** Deepest nesting of subshells and substitutions the parser accepts. */
@@ -947,6 +1753,7 @@ var CmdParser = class {
 */
 function parseShellLine(line, dialect) {
 	const segments = [];
+	if (dialect === "powershell") return parsePowerShellLine(line);
 	try {
 		if (dialect === "cmd") {
 			const commands = [];
@@ -1159,6 +1966,26 @@ const OPAQUE_RUNNERS = /* @__PURE__ */ new Set([
 	"stdbuf",
 	"flock"
 ]);
+/**
+* PowerShell cmdlets and aliases that run code or commands the policy cannot
+* see, or change what later names mean (lowercase).
+*/
+const POWERSHELL_OPAQUE = /* @__PURE__ */ new Set([
+	"iex",
+	"invoke-expression",
+	"invoke-command",
+	"icm",
+	"start-process",
+	"saps",
+	"start",
+	"add-type",
+	"set-alias",
+	"sal",
+	"new-alias",
+	"nal",
+	"invoke-item",
+	"ii"
+]);
 /** POSIX shell builtins that evaluate code or change how later names resolve. */
 const SHELL_OPAQUE_BUILTINS = /* @__PURE__ */ new Set([
 	"eval",
@@ -1251,7 +2078,7 @@ const MAX_WRAPPER_DEPTH = 8;
 const MAX_CD_CANDIDATES = 32;
 /** Longest command shown verbatim in a refusal before it is abbreviated. */
 const MAX_SHOWN_COMMAND = 48;
-/** The dialect shell mode parses on this platform. */
+/** The dialect `interpreter: "sh"` parses on this platform. */
 function shellDialect() {
 	return process.platform === "win32" ? "cmd" : "posix";
 }
@@ -1262,7 +2089,7 @@ function shellDialect() {
 * stripped). The cmd dialect splits Windows paths too.
 */
 function executableBasename(firstToken, dialect = "posix") {
-	return (dialect === "cmd" ? node_path.default.win32.basename(firstToken) : node_path.default.basename(firstToken)).replace(/\.(exe|cmd|bat|com)$/i, "");
+	return (dialect === "cmd" || dialect === "powershell" ? node_path.default.win32.basename(firstToken) : node_path.default.basename(firstToken)).replace(dialect === "powershell" ? /\.(exe|cmd|bat|com|ps1)$/i : /\.(exe|cmd|bat|com)$/i, "");
 }
 /** Show a command in a refusal, abbreviated at a word boundary when long. */
 function show(source) {
@@ -1306,25 +2133,75 @@ var Refusal = class extends Error {
 };
 /** Per-line checker state. */
 var LineChecker = class {
-	constructor(policy, shell, line, dialect) {
+	constructor(policy, shell, line, dialect, interpreter, remembered = []) {
 		this.policy = policy;
 		this.shell = shell;
 		this.line = line;
 		this.dialect = dialect;
+		this.interpreter = interpreter;
 		this.commands = [];
 		this.paths = [];
+		this.asks = [];
 		this.deny = new Set((shell.deny ?? []).map((name) => name.toLowerCase()));
 		this.allow = shell.allow ?? [];
 		this.patterns = (shell.denyPatterns ?? []).map(compilePattern);
-		this.interpreter = shell.interpreter ?? "none";
-		this.hasCommandRules = this.deny.size > 0 || this.patterns.length > 0 || shell.allowCommand !== void 0;
+		this.rules = (shell.rules ?? []).map((rule) => ({
+			rule,
+			pattern: compilePattern(rule.match)
+		}));
+		this.remembered = remembered.map(compilePattern);
+		this.askMode = shell.onAsk !== void 0;
+		this.hasCommandRules = this.deny.size > 0 || this.patterns.length > 0 || this.rules.length > 0 || shell.allowCommand !== void 0;
 	}
 	/** Whether argument hooks (`denyPatterns` / `allowCommand`) need literal argv. */
 	get hasArgumentHooks() {
 		return this.patterns.length > 0 || this.shell.allowCommand !== void 0;
 	}
 	get shellMode() {
-		return this.interpreter === "sh";
+		return this.interpreter !== "none";
+	}
+	/** The last rule that matches `argv` (later rules win). */
+	matchRule(argv) {
+		for (let index = this.rules.length - 1; index >= 0; index--) {
+			const compiled = this.rules[index];
+			if (compiled.pattern.test(argv, this.dialect)) return compiled.rule;
+		}
+	}
+	isRemembered(argv) {
+		return this.remembered.some((pattern) => pattern.test(argv, this.dialect));
+	}
+	/** Record a command that needs a decision (once per argv and reason). */
+	addAsk(argv, reason, rule) {
+		const key = `${reason}\u0000${argv.join("\0")}`;
+		if (this.asks.some((ask) => `${ask.reason}\u0000${ask.argv.join("\0")}` === key)) return;
+		this.asks.push({
+			argv: [...argv],
+			reason,
+			...rule !== void 0 ? { rule } : {}
+		});
+	}
+	/** Refuse when the matching rule denies. */
+	assertNotDenied(argv, rule) {
+		if (rule?.effect !== "deny") return;
+		const explanation = rule.reason !== void 0 && rule.reason.trim() !== "" ? ` ${rule.reason.trim()}` : "";
+		throw new Refusal("denied-pattern", `${show(argv.join(" "))} is denied by a workspace shell rule.${explanation}`, executableBasename(argv[0] ?? "", this.dialect));
+	}
+	/**
+	* Check the canonical form of a PowerShell alias (`Remove-Item -Recurse
+	* -Force x` as `rm -rf x`): deny, `denyPatterns`, `allowCommand` and the
+	* rules, but not the `allow` list (which names the spelling that was written).
+	*/
+	checkCanonical(argv) {
+		const key = executableBasename(argv[0] ?? "", this.dialect).toLowerCase();
+		if (this.deny.has(key)) throw new Refusal("denied-executable", `\`${key}\` is denied by the workspace shell policy (in ${show(argv.join(" "))}).`, key);
+		this.checkHooks(argv, true);
+		const rule = this.matchRule(argv);
+		this.assertNotDenied(argv, rule);
+		if (rule?.effect === "ask" && !this.isRemembered(argv)) this.addAsk(argv, "rule", rule);
+	}
+	/** Refuse a denied executable (used for `cd` spellings). */
+	assertExecutableNotDenied(key, argv) {
+		if (this.deny.has(key)) throw new Refusal("denied-executable", `\`${key}\` is denied by the workspace shell policy (in ${show(argv.join(" "))}).`, key);
 	}
 	/** Run `denyPatterns` and `allowCommand` on one argv. */
 	checkHooks(argv, nested) {
@@ -1372,15 +2249,34 @@ var LineChecker = class {
 			throw new Refusal("not-allowed", `\`${executable}\` is not in the workspace shell allowlist. Allowed commands: ${listed}${this.allow.length > 20 ? ", …" : ""}.`, executable);
 		}
 		this.checkHooks(argv, depth > 0);
+		const rule = this.matchRule(argv);
+		this.assertNotDenied(argv, rule);
 		this.commands.push([...argv]);
-		if (OPAQUE_RUNNERS.has(key) || this.shellMode && this.dialect === "posix" && SHELL_OPAQUE_BUILTINS.has(key) || this.shellMode && this.dialect === "cmd" && CMD_OPAQUE_BUILTINS.has(key)) {
+		const remembered = this.isRemembered(argv);
+		const approved = rule?.effect === "allow" || remembered || this.explicitlyAllowed(executable);
+		if (OPAQUE_RUNNERS.has(key) || this.shellMode && this.dialect === "posix" && SHELL_OPAQUE_BUILTINS.has(key) || this.shellMode && this.dialect === "cmd" && CMD_OPAQUE_BUILTINS.has(key) || this.shellMode && this.dialect === "powershell" && POWERSHELL_OPAQUE.has(key)) {
+			if (approved) return;
+			if (this.askMode || rule?.effect === "ask") {
+				this.addAsk(argv, "nested", rule);
+				return;
+			}
 			this.checkOpaque(executable, argv);
 			return;
 		}
 		if (this.shellMode && this.dialect === "posix" && ARITHMETIC_SENSITIVE_BUILTINS.has(key)) this.checkArithmeticSensitive(executable, argv, dynamic);
 		const ranges = this.unwrap(key, argv);
+		if (!approved && ranges === void 0) {
+			if (rule?.effect === "ask") this.addAsk(argv, "rule", rule);
+			else if (rule === void 0 && this.askMode && this.allow.length === 0) this.addAsk(argv, "rule");
+		} else if (!approved && rule?.effect === "ask") this.addAsk(argv, "rule", rule);
 		if (ranges === void 0) return;
-		if (ranges === null || depth >= MAX_WRAPPER_DEPTH) throw new Refusal("nested-command", `\`${executable}\` is used with options the workspace shell policy cannot read (in ${show(argv.join(" "))}). Run the inner command directly instead.`, executable);
+		if (ranges === null || depth >= MAX_WRAPPER_DEPTH) {
+			if (this.askMode) {
+				this.addAsk(argv, "nested", rule);
+				return;
+			}
+			throw new Refusal("nested-command", `\`${executable}\` is used with options the workspace shell policy cannot read (in ${show(argv.join(" "))}). Run the inner command directly instead.`, executable);
+		}
 		for (const [start, end] of ranges) this.checkArgv(argv.slice(start, end), dynamic.slice(start, end), depth + 1);
 	}
 	/**
@@ -1446,6 +2342,7 @@ var LineChecker = class {
 	}
 	/** Check a redirection target from every possible cwd. */
 	checkRedirectTarget(word, access, cwds) {
+		if (this.dialect === "powershell" && !word.quoted && word.value.toLowerCase() === "$null") return;
 		if (word.dynamic) throw new Refusal("unsupported-syntax", `The redirection target \`${word.raw}\` must be a literal path (no variables, globs or \`~\`).`);
 		const value = word.value;
 		if (this.dialect === "posix" && DEVICE_TARGETS.has(value) || this.dialect === "cmd" && CMD_DEVICE_TARGETS.has(value.toLowerCase())) return;
@@ -1638,11 +2535,17 @@ function argvModeRefusal(command) {
 	if (token === "(" || token === ")") return new Refusal("metacharacter", `\`${token}\` is not supported in argv mode: put it inside quotes to pass it as text.${suffix}`);
 	return new Refusal("metacharacter", `\`${token === "\n" ? "\\n" : token}\` is not supported in argv mode: run one command per call, and quote any argument that contains it.${suffix}`);
 }
-/** Check a shell-mode (`interpreter: "sh"`) line. */
+/** Check a shell-mode line. */
 function checkShellLine(checker, policy, command, dialect) {
 	if (/^[-+]/.test(command)) throw new Refusal("unsupported-syntax", "A command line may not start with `-` or `+`.");
 	const parsed = parseShellLine(command, dialect);
-	if (!parsed.ok) throw new Refusal(parsed.reason, `${parsed.message} The workspace shell policy only runs lines it can check.`);
+	if (!parsed.ok) {
+		if (checker.askMode) {
+			checker.addAsk([command], "unparsed");
+			return;
+		}
+		throw new Refusal(parsed.reason, `${parsed.message} The workspace shell policy only runs lines it can check.`);
+	}
 	if (parsed.background) throw new Refusal("unsupported-syntax", "`&` (run in the background) is not supported in a command line: start a long-running command with background: true instead.");
 	let cwds = [node_path.default.resolve(policy.cwd)];
 	for (const simple of parsed.commands) cwds = checkSimpleCommand(checker, simple, cwds, dialect);
@@ -1656,16 +2559,38 @@ function checkSimpleCommand(checker, simple, cwds, dialect) {
 	for (const redirect of simple.redirects) if (redirect.type === "read" || redirect.type === "write") checker.checkRedirectTarget(redirect.target, redirect.type, cwds);
 	const first = simple.words[0];
 	if (first === void 0) return cwds;
-	if (!first.dynamic && first.value.includes("=")) throw new Refusal("unsupported-syntax", `\`${first.raw}\` is not a plain command name or \`NAME=value\` assignment.`);
-	if (/^[-+]/.test(first.value)) throw new Refusal("unsupported-syntax", `\`${first.raw}\` is not a command name.`);
-	if (checker.hasArgumentHooks) {
-		const dynamic = simple.words.find((word) => word.dynamic);
-		if (dynamic !== void 0) throw new Refusal("unsupported-syntax", `\`${dynamic.raw}\` is decided when the line runs, so it cannot be checked against the workspace shell policy's command rules. Write the value literally (quote globs).`);
-	}
 	const executable = first.dynamic ? "" : executableBasename(first.value, dialect).toLowerCase();
-	if (executable === "cd") return checker.checkCd(simple.words, cwds);
-	if (dialect === "posix" && (executable === "pushd" || executable === "popd")) throw new Refusal("unsupported-syntax", `\`${executable}\` is not supported; use \`cd\`.`);
-	checker.checkArgv(simple.words.map((word) => word.dynamic ? word.raw : word.value), simple.words.map((word) => word.dynamic), 0);
+	const powershell = dialect === "powershell";
+	if (executable === "cd" || powershell && POWERSHELL_CD_NAMES.has(executable)) {
+		checker.assertExecutableNotDenied(executable, simple.words.map((word) => word.value));
+		if (powershell) {
+			const words = normalizePowerShellCd(simple.words);
+			if (words === null) throw new Refusal("unsupported-syntax", "`Set-Location` is supported with one directory (`-Path` / `-LiteralPath` or positional) only.", "cd");
+			return checker.checkCd(words, cwds);
+		}
+		return checker.checkCd(simple.words, cwds);
+	}
+	try {
+		if (!first.dynamic && first.value.includes("=")) throw new Refusal("unsupported-syntax", `\`${first.raw}\` is not a plain command name or \`NAME=value\` assignment.`);
+		if (/^[-+]/.test(first.value)) throw new Refusal("unsupported-syntax", `\`${first.raw}\` is not a command name.`);
+		if (checker.hasArgumentHooks) {
+			const dynamic = simple.words.find((word) => word.dynamic);
+			if (dynamic !== void 0) throw new Refusal("unsupported-syntax", `\`${dynamic.raw}\` is decided when the line runs, so it cannot be checked against the workspace shell policy's command rules. Write the value literally (quote globs).`);
+		}
+		if (dialect === "posix" && (executable === "pushd" || executable === "popd") || powershell && POWERSHELL_DIRECTORY_STACK.has(executable)) throw new Refusal("unsupported-syntax", `\`${executable}\` is not supported; use \`${powershell ? "Set-Location" : "cd"}\`.`);
+		const argv = simple.words.map((word) => word.dynamic ? word.raw : word.value);
+		checker.checkArgv(argv, simple.words.map((word) => word.dynamic), 0);
+		if (powershell) {
+			const canonical = canonicalPowerShellArgv(argv);
+			if (canonical !== void 0 && canonical.join("\0") !== argv.join("\0")) checker.checkCanonical(canonical);
+		}
+	} catch (error) {
+		if (error instanceof Refusal && error.reason === "unsupported-syntax" && checker.askMode) {
+			checker.addAsk(simple.words.map((word) => word.dynamic ? word.raw : word.value), "unparsed");
+			return cwds;
+		}
+		throw error;
+	}
 	return cwds;
 }
 /**
@@ -1693,35 +2618,44 @@ function checkSimpleCommand(checker, simple, cwds, dialect) {
 * checkShellCommand({ cwd, shell: { allow: ["git"] } }, "git add -A && git commit -m wip");
 * // { allowed: false, reason: "metacharacter", message: "`&&` is not supported in argv mode: run `git add -A`, then `git commit -m wip`, …" }
 */
-function checkShellCommand(policy, command) {
-	return checkShellCommandInDialect(policy, command, shellDialect());
+function checkShellCommand(policy, command, options) {
+	const resolved = options?.resolved ?? resolveShell(policy.shell, options?.host ?? currentShellHost());
+	return runCheck(policy, command, resolved.interpreter, resolved.dialect, options?.remembered);
 }
-/**
-* {@link checkShellCommand} with the shell-mode dialect chosen explicitly
-* instead of from the platform (used to test the cmd.exe rules anywhere).
-* Argv mode ignores `dialect`.
-*/
-function checkShellCommandInDialect(policy, command, dialect) {
+function runCheck(policy, command, interpreter, dialect, remembered) {
 	const shell = policy.shell;
 	if (!shell) return {
 		allowed: false,
 		reason: "not-allowed",
 		message: "The workspace has no shell policy, so no command may run.",
+		asks: [],
 		commands: [],
 		paths: []
 	};
-	const interpreter = shell.interpreter ?? "none";
-	const checker = new LineChecker(policy, shell, command, interpreter === "sh" ? dialect : "posix");
+	const shellMode = interpreter !== "none";
+	const checker = new LineChecker(policy, shell, command, shellMode ? dialect : "posix", interpreter, remembered);
 	try {
 		if (command.trim() === "") throw new Refusal("not-allowed", "The command is empty.");
-		if (interpreter === "sh") checkShellLine(checker, policy, command, dialect);
+		if (shellMode) checkShellLine(checker, policy, command, dialect);
 		else {
 			const argv = tokenizeCommand(command);
 			if (argv === null) throw argvModeRefusal(command);
 			checker.checkArgv(argv, argv.map(() => false), 0);
 		}
+		if (checker.asks.length > 0) {
+			const first = checker.asks[0];
+			return {
+				allowed: false,
+				reason: "approval-required",
+				message: `${show(first.argv.join(" "))} needs approval, and the workspace shell policy has no approval handler (shell.onAsk).${first.rule?.reason !== void 0 ? ` ${first.rule.reason}` : ""}`,
+				asks: checker.asks,
+				commands: checker.commands,
+				paths: checker.paths
+			};
+		}
 		return {
 			allowed: true,
+			asks: [],
 			commands: checker.commands,
 			paths: checker.paths
 		};
@@ -1733,11 +2667,34 @@ function checkShellCommandInDialect(policy, command, dialect) {
 			message: error.message,
 			...error.executable !== void 0 ? { executable: error.executable } : {},
 			...error.refusedPath !== void 0 ? { path: error.refusedPath } : {},
+			asks: [],
 			commands: checker.commands,
 			paths: checker.paths
 		};
 	}
 }
+/**
+* The simple commands a line would run (pipeline members, `&&` / `||` / `;`
+* parts, subshells and substitutions included), without checking anything.
+* A line the parser cannot read with confidence comes back with `opaque`
+* set to the reason and no commands.
+*
+* The line is read with the policy's shell dialect when its `interpreter`
+* is a shell, and with the platform's default shell otherwise.
+*
+* @example
+* classifyShellCommand("a | b"); // { commands: [["a"], ["b"]] }
+*/
+function classifyShellCommand(command, policy, host) {
+	const resolved = resolveShell(policy?.shell, host ?? currentShellHost());
+	const dialect = resolved.interpreter === "none" ? shellDialect() : resolved.dialect;
+	const parsed = parseShellLine(command, dialect);
+	if (!parsed.ok) return {
+		commands: [],
+		opaque: parsed.message
+	};
+	return { commands: parsed.commands.filter((simple) => simple.words.length > 0).map((simple) => simple.words.map((word) => word.dynamic ? word.raw : word.value)) };
+}
 
 //#endregion
 //#region ../../packages/ai-workspace/src/policy/policy.ts
@@ -1785,13 +2742,15 @@ async function canonicalize$1(target) {
 *
 * @param policy - The bounding policy (its `cwd` is the jail root).
 * @param inputPath - A workspace-relative or absolute path to resolve.
+* @param access - `"read"` also accepts the `output.spillDir` directory (only
+*   `readFile` asks for it); `"write"` (default) never does.
 * @returns The canonical absolute path plus its `/`-separated relative form.
 * @throws {WorkspacePolicyError} When the path escapes the jail or hits a deny glob.
 *
 * @example
 * const { absolutePath } = await resolveInJail(policy, "src/index.ts");
 */
-async function resolveInJail(policy, inputPath) {
+async function resolveInJail(policy, inputPath, access = "write") {
 	const jailRoot = await canonicalize$1(policy.cwd);
 	const absolutePath = await canonicalize$1(node_path.default.isAbsolute(inputPath) ? inputPath : node_path.default.join(policy.cwd, inputPath));
 	const insideCwd = isInside(absolutePath, jailRoot);
@@ -1804,6 +2763,11 @@ async function resolveInJail(policy, inputPath) {
 			break;
 		}
 	}
+	const spillDir = access === "read" && !insideCwd ? resolveSpillDir(policy) : void 0;
+	if (spillDir !== void 0 && isInside(absolutePath, await canonicalize$1(spillDir))) return {
+		absolutePath,
+		relativePath: ""
+	};
 	if (!insideCwd && !insideAllow) throw new WorkspacePolicyError(`Path "${inputPath}" resolves outside the workspace jail.`, {
 		type: "path-escape",
 		path: inputPath
@@ -1870,8 +2834,8 @@ function buildEnv(policy) {
 	return env;
 }
 /**
-* Variables removed from the environment of a shell-mode (`interpreter:
-* "sh"`) command: each changes how the shell itself starts, parses or
+* Variables removed from the environment of a shell-mode (`interpreter`
+* other than `"none"`) command: each changes how the shell itself starts, parses or
 * resolves the line (`ENV`/`BASH_ENV` run a startup file, `SHELLOPTS` +
 * `PS4` can run command substitutions, `BASH_FUNC_*` imports functions that
 * shadow commands, `CDPATH` moves `cd`, `IFS` re-splits words).
@@ -1893,7 +2857,7 @@ const SHELL_STARTUP_VARIABLES = /* @__PURE__ */ new Set([
 */
 function buildCommandEnv(policy) {
 	const env = buildEnv(policy);
-	if ((policy.shell?.interpreter ?? "none") !== "sh") return env;
+	if ((policy.shell?.interpreter ?? "none") === "none") return env;
 	for (const key of Object.keys(env)) {
 		const upper = key.toUpperCase();
 		if (SHELL_STARTUP_VARIABLES.has(upper) || upper.startsWith("BASH_FUNC_")) delete env[key];
@@ -2388,6 +3352,520 @@ function applyPatchWithOps(ops, input) {
 	});
 }
 
+//#endregion
+//#region ../../packages/ai-workspace/src/edit/match.ts
+/** Most lines of file text a miss hint shows. */
+const MAX_HINT_LINES = 12;
+/** Most characters of one line a miss hint shows. */
+const MAX_HINT_LINE_CHARS = 200;
+const FOLD_MAP = {
+	"‘": "'",
+	"’": "'",
+	"‚": "'",
+	"‛": "'",
+	"“": "\"",
+	"”": "\"",
+	"„": "\"",
+	"‟": "\"",
+	"‐": "-",
+	"‑": "-",
+	"‒": "-",
+	"–": "-",
+	"—": "-",
+	"―": "-",
+	"−": "-",
+	"\xA0": " ",
+	" ": " ",
+	" ": " ",
+	" ": " ",
+	" ": " ",
+	" ": " ",
+	" ": " "
+};
+/** Fold look-alike characters one for one, so string indexes stay aligned. */
+function foldUnicode(value) {
+	let out = "";
+	for (const char of value) out += FOLD_MAP[char] ?? char;
+	return out;
+}
+/** Every non-overlapping occurrence of `needle` in `haystack`. */
+function findAll(haystack, needle) {
+	const ranges = [];
+	if (needle === "") return ranges;
+	let from = 0;
+	for (;;) {
+		const index = haystack.indexOf(needle, from);
+		if (index === -1) return ranges;
+		ranges.push({
+			start: index,
+			end: index + needle.length
+		});
+		from = index + needle.length;
+	}
+}
+/** The file's dominant line ending. */
+function detectEol(content) {
+	const crlf = content.split("\r\n").length - 1;
+	return crlf > content.split("\n").length - 1 - crlf ? "\r\n" : "\n";
+}
+/** Convert any line endings in `text` to `eol`. */
+function withEol(text, eol) {
+	const normalised = text.replace(/\r\n/g, "\n");
+	return eol === "\n" ? normalised : normalised.replace(/\n/g, "\r\n");
+}
+/** An LF view of `content` plus the original index of each view character. */
+function lfView(content) {
+	if (!content.includes("\r\n")) return {
+		view: content,
+		map: null
+	};
+	let view = "";
+	const map = [];
+	for (let index = 0; index < content.length; index++) {
+		if (content[index] === "\r" && content[index + 1] === "\n") continue;
+		map.push(content[index] === "\n" && content[index - 1] === "\r" ? index - 1 : index);
+		view += content[index];
+	}
+	map.push(content.length);
+	return {
+		view,
+		map
+	};
+}
+/** Line-based search ignoring trailing whitespace, on already folded text. */
+function findByLines(view, needle) {
+	const needleLines = needle.split("\n");
+	const endsWithBreak = needleLines.length > 1 && needleLines[needleLines.length - 1] === "";
+	if (endsWithBreak) needleLines.pop();
+	const wanted = needleLines.map((line) => line.trimEnd());
+	if (wanted.every((line) => line === "")) return [];
+	const lines = view.split("\n");
+	const starts = [];
+	let offset = 0;
+	for (const line of lines) {
+		starts.push(offset);
+		offset += line.length + 1;
+	}
+	const ranges = [];
+	for (let index = 0; index + wanted.length <= lines.length;) {
+		let same = true;
+		for (let k = 0; k < wanted.length; k++) if ((lines[index + k] ?? "").trimEnd() !== wanted[k]) {
+			same = false;
+			break;
+		}
+		if (!same) {
+			index++;
+			continue;
+		}
+		const last = index + wanted.length - 1;
+		let end = (starts[last] ?? 0) + (lines[last] ?? "").length;
+		if (endsWithBreak && view[end] === "\n") end++;
+		ranges.push({
+			start: starts[index] ?? 0,
+			end
+		});
+		index += wanted.length;
+	}
+	return ranges;
+}
+/**
+* Find `oldString` in `content`. `"exact"` only looks for the text as given;
+* `"tiered"` walks the tiers described on {@link WorkspaceEditMatching} and
+* stops at the first one with a match. The ranges are always in the original
+* content, whatever view found them.
+*/
+function locateEdit(content, oldString, matching) {
+	const exact = findAll(content, oldString);
+	if (exact.length > 0 || matching === "exact") return {
+		tier: exact.length > 0 ? "exact" : null,
+		ranges: exact,
+		viaView: false
+	};
+	const { view, map } = lfView(content);
+	const needle = oldString.replace(/\r\n/g, "\n");
+	const back = (ranges) => map === null ? ranges : ranges.map((range) => ({
+		start: map[range.start] ?? content.length,
+		end: map[range.end] ?? content.length
+	}));
+	if (map !== null || needle !== oldString) {
+		const plain = findAll(view, needle);
+		if (plain.length > 0) return {
+			tier: "exact",
+			ranges: back(plain),
+			viaView: true
+		};
+	}
+	const foldedView = foldUnicode(view);
+	const foldedNeedle = foldUnicode(needle);
+	const folded = findAll(foldedView, foldedNeedle);
+	if (folded.length > 0) return {
+		tier: "unicode",
+		ranges: back(folded),
+		viaView: true
+	};
+	const lined = findByLines(foldedView, foldedNeedle);
+	if (lined.length > 0) return {
+		tier: "whitespace",
+		ranges: back(lined),
+		viaView: true
+	};
+	return {
+		tier: null,
+		ranges: [],
+		viaView: false
+	};
+}
+function clipLine(line) {
+	const flat = line.replace(/\r$/, "");
+	return flat.length > 200 ? `${flat.slice(0, 200)}…` : flat;
+}
+function tokens(line) {
+	return new Set(line.match(/[A-Za-z0-9_$]+/g) ?? []);
+}
+function similarity(left, right) {
+	if (left.size === 0 || right.size === 0) return 0;
+	let shared = 0;
+	for (const token of left) if (right.has(token)) shared++;
+	return shared / (left.size + right.size - shared);
+}
+/**
+* Explain a miss: either `newString` is already in the file (the edit was
+* probably applied), or the file text closest to `oldString`, at most
+* {@link MAX_HINT_LINES} lines of {@link MAX_HINT_LINE_CHARS} characters.
+* `undefined` when nothing is close.
+*/
+function describeMiss(content, oldString, newString, maxLines = 12) {
+	if (maxLines <= 0) return;
+	const lines = content.split("\n");
+	const present = newString.trim() === "" ? -1 : content.indexOf(newString);
+	if (present !== -1 && newString !== oldString) return `newString already present in the file (line ${content.slice(0, present).split("\n").length}); the edit may already have been applied.`;
+	const fileTokens = lines.map((line) => tokens(line));
+	const wanted = oldString.split("\n");
+	let best = {
+		score: 0,
+		fileLine: -1,
+		offset: 0
+	};
+	wanted.forEach((text, offset) => {
+		const own = tokens(text);
+		fileTokens.forEach((candidate, fileLine) => {
+			const score = similarity(own, candidate);
+			if (score > best.score) best = {
+				score,
+				fileLine,
+				offset
+			};
+		});
+	});
+	if (best.fileLine === -1 || best.score < .5) return;
+	const first = Math.max(0, best.fileLine - best.offset);
+	const count = Math.min(maxLines, 12, Math.max(1, wanted.length));
+	const shown = lines.slice(first, first + count).map((line, index) => `${first + index + 1}: ${clipLine(line)}`);
+	return `Closest text in the file (lines ${first + 1}-${first + shown.length}):\n${shown.join("\n")}`;
+}
+
+//#endregion
+//#region ../../packages/ai-workspace/src/edit/apply-replacement.ts
+/**
+* Apply one replacement to `content` under the edit rules: `oldString` must
+* be found (see {@link WorkspaceEditMatching}), and exactly once unless
+* `replaceAll` — a fuzzy match must always be unique, so a loose match never
+* rewrites several places at once.
+*/
+function applyReplacement(content, edit, inputPath, shownPath, options, editIndex) {
+	const { matching } = options;
+	const located = edit.oldString === "" ? null : locateEdit(content, edit.oldString, matching);
+	const count = located?.ranges.length ?? 0;
+	const which = editIndex === void 0 ? "" : `Edit ${editIndex + 1}: `;
+	const nothingApplied = editIndex === void 0 ? "" : " None of the edits were applied.";
+	const indexOption = editIndex === void 0 ? {} : { editIndex };
+	if (located === null || count === 0) {
+		let hint = describeMiss(content, edit.oldString, edit.newString, options.missHintLines);
+		if (hint !== void 0 && options.hintMaxBytes !== void 0) hint = Buffer.byteLength(hint, "utf8") > options.hintMaxBytes ? void 0 : hint;
+		throw new WorkspaceEditError(`${which}The text to replace was not found in "${inputPath}".` + (hint === void 0 ? "" : ` ${hint}`) + nothingApplied, {
+			type: "not-found",
+			path: shownPath,
+			matches: 0,
+			...hint !== void 0 ? { hint } : {},
+			...indexOption
+		});
+	}
+	const fuzzy = located.tier !== "exact";
+	if (count > 1 && (!edit.replaceAll || fuzzy)) {
+		const advice = fuzzy ? "include more surrounding context." : "pass replaceAll or include more surrounding context.";
+		throw new WorkspaceEditError(`${which}The text to replace is not unique in "${inputPath}" (${count} matches${fuzzy && located.viaView ? ", found by loose matching" : ""}); ${advice}${nothingApplied}`, {
+			type: "not-unique",
+			path: shownPath,
+			matches: count,
+			...indexOption
+		});
+	}
+	const eol = options.lineEndings === "lf" ? "\n" : options.lineEndings === "crlf" ? "\r\n" : matching === "tiered" ? detectEol(content) : void 0;
+	const replacement = eol === void 0 ? edit.newString : withEol(edit.newString, eol);
+	const ranges = edit.replaceAll ? located.ranges : located.ranges.slice(0, 1);
+	let out = "";
+	let cursor = 0;
+	for (const range of ranges) {
+		out += content.slice(cursor, range.start) + replacement;
+		cursor = range.end;
+	}
+	out += content.slice(cursor);
+	return {
+		content: out,
+		replacements: ranges.length,
+		...fuzzy ? { matchTier: located.tier } : {}
+	};
+}
+
+//#endregion
+//#region ../../packages/ai-workspace/src/hooks/after-edit.ts
+/** How long a hook may take when the policy sets no `afterEditTimeoutMs`. */
+const DEFAULT_HOOK_TIMEOUT_MS = 1e4;
+/** Longest diagnostics text kept when the policy sets no `afterEditMaxChars`. */
+const DEFAULT_MAX_CHARS = 4e3;
+function wrap(text) {
+	return `[diagnostics]\n${text}\n[/diagnostics]`;
+}
+/**
+* Run the policy's `afterEdit` hook for one call and return the text to put
+* on the result's `diagnostics`, or `undefined` when there is none. A throw
+* or a timeout yields "diagnostics unavailable"; it never rejects.
+*/
+async function runAfterEdit(policy, event) {
+	const hook = policy.hooks?.afterEdit;
+	if (hook === void 0 || event.paths.length === 0) return;
+	const timeoutMs = policy.hooks?.afterEditTimeoutMs ?? DEFAULT_HOOK_TIMEOUT_MS;
+	const maxChars = policy.hooks?.afterEditMaxChars ?? DEFAULT_MAX_CHARS;
+	let timer;
+	try {
+		const answer = await Promise.race([Promise.resolve().then(() => hook(event)), new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error("afterEdit hook timed out")), timeoutMs);
+		})]);
+		if (typeof answer !== "string" || answer.trim() === "") return;
+		const text = answer.trim();
+		return wrap(text.length > maxChars ? `${text.slice(0, maxChars)}\n[diagnostics truncated: showing ${maxChars} of ${text.length} characters]` : text);
+	} catch {
+		return wrap("diagnostics unavailable");
+	} finally {
+		clearTimeout(timer);
+	}
+}
+
+//#endregion
+//#region ../../packages/ai-workspace/src/output/spill.ts
+const DEFAULT_MAX_LINES = 2e3;
+const DEFAULT_MAX_BYTES = 51200;
+const DEFAULT_RETENTION_MS = 6048e5;
+const SPILL_NAME = /^spill-(\d+)-[a-z0-9]+-[a-z0-9_-]+\.txt$/;
+function byteLength(value) {
+	return Buffer.byteLength(value, "utf8");
+}
+/** The first `maxBytes` bytes of `value`, cut on a character boundary. */
+function headOf(value, maxBytes) {
+	const bytes = Buffer.from(value, "utf8");
+	if (bytes.byteLength <= maxBytes) return value;
+	let cut = Math.max(0, maxBytes);
+	while (cut > 0 && ((bytes[cut] ?? 0) & 192) === 128) cut--;
+	return bytes.subarray(0, cut).toString("utf8");
+}
+/** The last `maxBytes` bytes of `value`, cut on a character boundary. */
+function tailOf(value, maxBytes) {
+	const bytes = Buffer.from(value, "utf8");
+	if (bytes.byteLength <= maxBytes) return value;
+	let from = bytes.byteLength - Math.max(0, maxBytes);
+	while (from < bytes.byteLength && ((bytes[from] ?? 0) & 192) === 128) from++;
+	return bytes.subarray(from).toString("utf8");
+}
+/** Lines of `value`; a trailing line break does not add an empty line. */
+function splitLines(value) {
+	if (value === "") return [];
+	const lines = value.split("\n");
+	if (lines[lines.length - 1] === "") lines.pop();
+	return lines;
+}
+/** Pick lines from the front within `lines` / `bytes`; one oversized line is clipped. */
+function takeHead(lines, maxLines, maxBytes) {
+	const out = [];
+	let used = 0;
+	for (const line of lines) {
+		if (out.length >= maxLines) break;
+		const cost = byteLength(line) + 1;
+		if (used + cost > maxBytes) {
+			if (out.length === 0 && maxBytes > 0) out.push(headOf(line, maxBytes));
+			break;
+		}
+		out.push(line);
+		used += cost;
+	}
+	return out;
+}
+/** Pick lines from the back, same limits; the result is in file order. */
+function takeTail(lines, maxLines, maxBytes) {
+	const out = [];
+	let used = 0;
+	for (let index = lines.length - 1; index >= 0; index--) {
+		const line = lines[index] ?? "";
+		if (out.length >= maxLines) break;
+		const cost = byteLength(line) + 1;
+		if (used + cost > maxBytes) {
+			if (out.length === 0 && maxBytes > 0) out.push(tailOf(line, maxBytes));
+			break;
+		}
+		out.unshift(line);
+		used += cost;
+	}
+	return out;
+}
+/** Choose the lines to keep for `keep`; `headCount` lines come from the front. */
+function select(lines, keep, maxLines, maxBytes) {
+	if (keep === "head") return {
+		head: takeHead(lines, maxLines, maxBytes),
+		tail: []
+	};
+	if (keep === "tail") return {
+		head: [],
+		tail: takeTail(lines, maxLines, maxBytes)
+	};
+	const headLines = Math.ceil(maxLines / 2);
+	const headBytes = Math.ceil(maxBytes / 2);
+	const head = takeHead(lines, headLines, headBytes);
+	return {
+		head,
+		tail: takeTail(lines.slice(head.length), maxLines - head.length, maxBytes - headBytes)
+	};
+}
+/**
+* Keeps oversized command, search and read output from flooding the model:
+* with `output.spillDir` set it saves the full output to a file and returns
+* the part the policy keeps plus a pointer to it. One instance per ops layer;
+* it remembers the files it wrote so `dispose()` can remove them.
+*/
+var OutputSpiller = class {
+	constructor(backend, policy) {
+		this.backend = backend;
+		this.policy = policy;
+		this.created = [];
+		this.dir = resolveSpillDir(policy);
+		if (this.dir !== void 0 && this.retentionMs > 0) this.sweep();
+	}
+	/** True when `output.spillDir` is set. */
+	get enabled() {
+		return this.dir !== void 0;
+	}
+	/** The spill directory, when spilling is on. */
+	get spillDir() {
+		return this.dir;
+	}
+	get retentionMs() {
+		return this.policy.output?.retentionMs ?? DEFAULT_RETENTION_MS;
+	}
+	limits(cap) {
+		const configured = this.policy.output?.maxBytes ?? DEFAULT_MAX_BYTES;
+		return {
+			maxLines: Math.max(1, Math.floor(this.policy.output?.maxLines ?? DEFAULT_MAX_LINES)),
+			maxBytes: Math.max(1, Math.floor(cap === void 0 ? configured : Math.min(configured, cap)))
+		};
+	}
+	/** Remove spill files older than the retention (only files named like ours). */
+	async sweep() {
+		if (this.dir === void 0) return;
+		try {
+			const now = Date.now();
+			for (const file of await this.backend.list(this.dir)) {
+				const match = SPILL_NAME.exec(node_path.default.basename(file));
+				if (match !== null && now - Number(match[1]) > this.retentionMs) await this.backend.remove(file).catch(() => void 0);
+			}
+		} catch {}
+	}
+	/** Write `content` to a new spill file and return its absolute path. */
+	async write(label, content) {
+		if (this.dir === void 0) return;
+		try {
+			if (this.retentionMs > 0) await this.sweep();
+			const safe = label.toLowerCase().replace(/[^a-z0-9_-]+/g, "-") || "output";
+			const rand = Math.random().toString(36).slice(2, 8) || "x";
+			const file = node_path.default.join(this.dir, `spill-${Date.now()}-${rand}-${safe}.txt`);
+			await this.backend.mkdir(this.dir);
+			await this.backend.writeFile(file, content);
+			this.created.push(file);
+			return file;
+		} catch {
+			return;
+		}
+	}
+	/**
+	* Fit `value` to the policy. Returns it untouched when it fits. Over the
+	* limits with spilling on, the whole text is saved and the kept lines come
+	* back with a `[showing lines … of …; full output saved to …]` marker.
+	* `cap` is a tighter byte limit from elsewhere (`shell.maxOutputBytes`).
+	*/
+	async text(label, value, defaultKeep, cap) {
+		if (this.dir === void 0) return { value };
+		const { maxLines, maxBytes } = this.limits(cap);
+		const lines = splitLines(value);
+		const totalBytes = byteLength(value);
+		if (lines.length <= maxLines && totalBytes <= maxBytes) return { value };
+		const { head, tail } = select(lines, this.policy.output?.keep ?? defaultKeep, maxLines, maxBytes);
+		const file = await this.write(label, value);
+		const shown = head.length + tail.length;
+		const total = lines.length;
+		const where = file === void 0 ? "the rest was dropped" : `full output saved to ${file}`;
+		const marker = `[showing ${tail.length === 0 ? `lines 1-${head.length}` : head.length === 0 ? `lines ${total - tail.length + 1}-${total}` : `lines 1-${head.length} and ${total - tail.length + 1}-${total}`} of ${total}; ${where}]`;
+		const parts = [...head.length > 0 ? [head.join("\n")] : [], marker];
+		if (tail.length > 0) parts.push(tail.join("\n"));
+		return {
+			value: parts.join("\n"),
+			truncation: {
+				shown: { lines: shown },
+				total: {
+					lines: total,
+					bytes: totalBytes
+				},
+				...file !== void 0 ? { path: file } : {}
+			}
+		};
+	}
+	/**
+	* Fit a list of entries (one line each when rendered) to the policy; the
+	* rendered full list is what gets saved.
+	*/
+	async list(label, items, render, defaultKeep) {
+		if (this.dir === void 0) return { items };
+		const { maxLines, maxBytes } = this.limits(void 0);
+		const lines = items.map(render);
+		const totalBytes = lines.reduce((sum, line) => sum + byteLength(line) + 1, 0);
+		if (items.length <= maxLines && totalBytes <= maxBytes) return { items };
+		const { head, tail } = select(lines, this.policy.output?.keep ?? defaultKeep, maxLines, maxBytes);
+		const headCount = head.length;
+		const tailCount = tail.length;
+		const file = await this.write(label, lines.join("\n") + "\n");
+		return {
+			items: [...items.slice(0, headCount), ...items.slice(items.length - tailCount)],
+			truncation: {
+				shown: { lines: headCount + tailCount },
+				total: {
+					lines: items.length,
+					bytes: totalBytes
+				},
+				...file !== void 0 ? { path: file } : {}
+			}
+		};
+	}
+	/** Save the complete text of an output that was already cut elsewhere. */
+	async save(label, content) {
+		return this.write(label, content);
+	}
+	/** Remove expired files, and this run's own when `retentionMs` is `0`. */
+	async dispose() {
+		if (this.dir === void 0) return;
+		if (this.retentionMs === 0) {
+			for (const file of this.created.splice(0)) await this.backend.remove(file).catch(() => void 0);
+			return;
+		}
+		await this.sweep();
+	}
+};
+
 //#endregion
 //#region ../../packages/ai-workspace/src/shell-jobs.ts
 /** Finished commands kept for a last `shell_output` read before the oldest are pruned. */
@@ -2764,6 +4242,26 @@ var Ops = class {
 		this.policy = policy;
 		this.runtime = runtime;
 		this.pathLocks = /* @__PURE__ */ new Map();
+		this.resolvedShell = resolveShell(policy.shell);
+		this.approvals = runtime.approvals ?? [];
+		this.spiller = new OutputSpiller(backend, policy);
+	}
+	/** The edit-policy settings applied to every replacement. */
+	editOptions() {
+		const edit = this.policy.edit;
+		return {
+			matching: edit?.matching ?? "tiered",
+			missHintLines: edit?.missHintLines ?? 12,
+			lineEndings: edit?.lineEndings ?? "preserve",
+			...this.policy.read?.maxBytes !== void 0 ? { hintMaxBytes: this.policy.read.maxBytes } : {}
+		};
+	}
+	/** Run `afterEdit` for a call that wrote `paths`; `undefined` when there is no output. */
+	diagnosticsFor(tool, paths) {
+		return runAfterEdit(this.policy, {
+			paths,
+			tool
+		});
 	}
 	/** Run `task` after every earlier mutation of `absolutePath` has settled. */
 	async withPathLock(absolutePath, task) {
@@ -2808,7 +4306,7 @@ var Ops = class {
 		}
 	}
 	async readFile(inputPath, opts) {
-		const { absolutePath } = await resolveInJail(this.policy, inputPath);
+		const { absolutePath } = await resolveInJail(this.policy, inputPath, "read");
 		const raw = await this.backend.readFile(absolutePath);
 		const hash = _warlock_js_fs.fs.hash.string(raw);
 		const lines = raw.split("\n");
@@ -2817,10 +4315,29 @@ var Ops = class {
 		const limit = opts?.limit ?? this.policy.read?.defaultLines ?? DEFAULT_READ_LINES;
 		const maxBytes = this.policy.read?.maxBytes;
 		const startIndex = offset - 1;
-		const { content, returnedLines, bytesCapped } = numberWindow(lines.slice(startIndex, startIndex + Math.max(0, limit)), offset, maxBytes === void 0 ? void 0 : Math.max(0, Math.floor(maxBytes)));
+		const window = lines.slice(startIndex, startIndex + Math.max(0, limit));
+		const { content, returnedLines, bytesCapped } = numberWindow(window, offset, maxBytes === void 0 ? void 0 : Math.max(0, Math.floor(maxBytes)));
 		const endLine = offset + returnedLines - 1;
+		const spillDir = this.spiller.spillDir;
+		let spilled;
+		if (bytesCapped && spillDir !== void 0 && !isInside(absolutePath, spillDir)) {
+			const full = numberWindow(window, offset, void 0).content;
+			const file = await this.spiller.save("read_file", full);
+			if (file !== void 0) spilled = {
+				content: `${content}\n[showing lines 1-${returnedLines} of ${window.length}; full output saved to ${file}]`,
+				truncation: {
+					shown: { lines: returnedLines },
+					total: {
+						lines: window.length,
+						bytes: Buffer.byteLength(full, "utf8")
+					},
+					path: file
+				}
+			};
+		}
 		return {
-			content,
+			content: spilled?.content ?? content,
+			...spilled !== void 0 ? { truncation: spilled.truncation } : {},
 			startLine: offset,
 			endLine,
 			totalLines,
@@ -2831,8 +4348,8 @@ var Ops = class {
 		};
 	}
 	async writeFile(inputPath, content) {
-		const { absolutePath } = await resolveInJail(this.policy, inputPath);
-		return this.withPathLock(absolutePath, async () => {
+		const { absolutePath, relativePath } = await resolveInJail(this.policy, inputPath);
+		const written = await this.withPathLock(absolutePath, async () => {
 			const parent = node_path.default.dirname(absolutePath);
 			await this.backend.mkdir(parent);
 			await this.backend.writeFile(absolutePath, content);
@@ -2841,10 +4358,20 @@ var Ops = class {
 				bytesWritten: Buffer.byteLength(content, "utf8")
 			};
 		});
+		const diagnostics = await this.diagnosticsFor("write_file", [relativePath || inputPath]);
+		return {
+			...written,
+			...diagnostics !== void 0 ? { diagnostics } : {}
+		};
 	}
 	async editFile(input) {
 		const { absolutePath, relativePath } = await resolveInJail(this.policy, input.path);
-		return this.withPathLock(absolutePath, () => this.applyEdit(input, absolutePath, relativePath));
+		const result = await this.withPathLock(absolutePath, () => this.applyEdit(input, absolutePath, relativePath));
+		const diagnostics = await this.diagnosticsFor("edit_file", [result.path]);
+		return diagnostics === void 0 ? result : {
+			...result,
+			diagnostics
+		};
 	}
 	/** The read-check-replace-write of {@link editFile}, run under its path lock. */
 	async applyEdit(input, absolutePath, relativePath) {
@@ -2856,19 +4383,20 @@ var Ops = class {
 			expectedHash: input.expectHash,
 			actualHash: currentHash
 		});
-		const { content: updated, replacements } = applyReplacement(current, input, input.path, relativePath || input.path);
+		const { content: updated, replacements, matchTier } = applyReplacement(current, input, input.path, relativePath || input.path, this.editOptions());
 		await this.backend.writeFile(absolutePath, updated);
 		return {
 			path: relativePath || input.path,
 			replacements,
-			hash: _warlock_js_fs.fs.hash.string(updated)
+			hash: _warlock_js_fs.fs.hash.string(updated),
+			...matchTier !== void 0 ? { matchTier } : {}
 		};
 	}
 	async multiEdit(input) {
 		const { absolutePath, relativePath } = await resolveInJail(this.policy, input.path);
 		const shownPath = relativePath || input.path;
 		if (input.edits.length === 0 || input.edits.length > 100) throw new RangeError(`A multi-edit needs between 1 and ${100} edits (got ${input.edits.length}).`);
-		return this.withPathLock(absolutePath, async () => {
+		const result = await this.withPathLock(absolutePath, async () => {
 			const current = await this.backend.readFile(absolutePath);
 			const currentHash = _warlock_js_fs.fs.hash.string(current);
 			if (input.expectHash !== void 0 && input.expectHash !== currentHash) throw new WorkspaceEditError(`File "${input.path}" changed since it was read; none of the edits were applied.`, {
@@ -2879,21 +4407,40 @@ var Ops = class {
 			});
 			let content = current;
 			let replacements = 0;
+			let matchTier;
+			const options = this.editOptions();
 			input.edits.forEach((edit, editIndex) => {
-				const applied = applyReplacement(content, edit, input.path, shownPath, editIndex);
+				const applied = applyReplacement(content, edit, input.path, shownPath, options, editIndex);
 				content = applied.content;
 				replacements += applied.replacements;
+				if (applied.matchTier === "whitespace" || matchTier === void 0) matchTier = applied.matchTier ?? matchTier;
 			});
 			await this.backend.writeFile(absolutePath, content);
 			return {
 				path: shownPath,
 				edits: input.edits.length,
 				replacements,
-				hash: _warlock_js_fs.fs.hash.string(content)
+				hash: _warlock_js_fs.fs.hash.string(content),
+				...matchTier !== void 0 ? { matchTier } : {}
 			};
 		});
+		const diagnostics = await this.diagnosticsFor("multi_edit", [shownPath]);
+		return diagnostics === void 0 ? result : {
+			...result,
+			diagnostics
+		};
 	}
 	async applyPatch(input) {
+		const result = await this.runPatch(input);
+		if (result.dryRun) return result;
+		const paths = result.files.filter((file) => file.action !== "deleted").map((file) => file.path);
+		const diagnostics = await this.diagnosticsFor("apply_patch", paths);
+		return diagnostics === void 0 ? result : {
+			...result,
+			diagnostics
+		};
+	}
+	runPatch(input) {
 		return executePatch(input, {
 			resolve: (inputPath) => resolveInJail(this.policy, inputPath),
 			exists: (absolutePath) => this.backend.exists(absolutePath),
@@ -2913,9 +4460,14 @@ var Ops = class {
 	* (argv or shell mode), then — shell mode — every redirection target and
 	* `cd` directory against the jail with symlinks resolved.
 	*/
-	async assertCommandAllowed(command) {
-		const verdict = checkShellCommand(this.policy, command);
-		if (!verdict.allowed) throw new WorkspacePolicyError(verdict.message ?? `Command is not permitted by the workspace shell policy: ${command}`, {
+	async assertCommandAllowed(command, signal) {
+		const verdict = checkShellCommand(this.policy, command, {
+			remembered: this.approvals,
+			resolved: this.resolvedShell
+		});
+		const onAsk = this.policy.shell?.onAsk;
+		const needsApproval = !verdict.allowed && verdict.reason === "approval-required" && verdict.asks.length > 0;
+		if (!verdict.allowed && !(needsApproval && onAsk !== void 0)) throw new WorkspacePolicyError(verdict.message ?? `Command is not permitted by the workspace shell policy: ${command}`, {
 			type: "denied-command",
 			command,
 			...verdict.reason !== void 0 ? { reason: verdict.reason } : {},
@@ -2938,9 +4490,29 @@ var Ops = class {
 			reason: "not-allowed",
 			command
 		});
+		if (needsApproval && onAsk !== void 0) await this.askForApproval(command, verdict.asks, onAsk, signal);
+	}
+	/** Put the commands that need approval to `shell.onAsk`; refuse the line unless it says yes. */
+	async askForApproval(command, asks, onAsk, signal) {
+		let decision;
+		try {
+			decision = await onAsk({
+				command,
+				asks,
+				...signal ? { signal } : {}
+			});
+		} catch {
+			decision = void 0;
+		}
+		if (decision?.allow !== true) throw new WorkspacePolicyError(`Running ${asks.map((ask) => `\`${ask.argv.join(" ")}\``).join(", ")} was not approved.`, {
+			type: "denied-command",
+			reason: "approval-denied",
+			command
+		});
+		if (decision.remember !== void 0 && !this.approvals.includes(decision.remember)) this.approvals.push(decision.remember);
 	}
 	async exec(command, opts) {
-		await this.assertCommandAllowed(command);
+		await this.assertCommandAllowed(command, opts?.signal);
 		const signal = opts?.signal;
 		if (signal?.aborted) return {
 			exitCode: CANCELLED_BEFORE_START_EXIT_CODE,
@@ -2953,24 +4525,27 @@ var Ops = class {
 		const shell = this.policy.shell;
 		const timeoutMs = opts?.timeoutMs ?? shell?.timeoutMs;
 		const maxOutputBytes = shell?.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
-		const interpreter = shell?.interpreter ?? "none";
+		const interpreter = this.resolvedShell.interpreter;
 		const result = await this.backend.exec(command, {
 			cwd: this.policy.cwd,
 			timeoutMs,
 			env: buildCommandEnv(this.policy),
 			...signal ? { signal } : {},
-			...interpreter !== "none" ? { interpreter } : {}
+			...interpreter !== "none" ? { interpreter } : {},
+			...interpreter !== "none" && this.resolvedShell.file !== void 0 ? { interpreterPath: this.resolvedShell.file } : {}
 		});
-		const stdout = capOutput(result.stdout, maxOutputBytes);
-		const stderr = capOutput(result.stderr, maxOutputBytes);
+		const stdout = await this.fitStream("run_shell-stdout", result.stdout, maxOutputBytes);
+		const stderr = await this.fitStream("run_shell-stderr", result.stderr, maxOutputBytes);
 		const cancelled = result.cancelled === true;
+		const truncation = streamTruncation(stdout.truncation, stderr.truncation);
 		return {
 			exitCode: result.exitCode,
 			stdout: stdout.value,
 			stderr: stderr.value,
 			truncated: stdout.truncated || stderr.truncated,
 			timedOut: result.timedOut && !cancelled,
-			cancelled
+			cancelled,
+			...truncation !== void 0 ? { truncation } : {}
 		};
 	}
 	async startShell(command, opts) {
@@ -2988,7 +4563,8 @@ var Ops = class {
 			command
 		});
 		const shell = this.policy.shell;
-		const interpreter = shell?.interpreter ?? "none";
+		const interpreter = this.resolvedShell.interpreter;
+		const interpreterPath = interpreter !== "none" ? this.resolvedShell.file : void 0;
 		const timeoutMs = lowerOf(background.timeoutMs, opts?.timeoutMs);
 		const env = buildCommandEnv(this.policy);
 		return this.runtime.jobs.start({
@@ -3000,12 +4576,51 @@ var Ops = class {
 				cwd: this.policy.cwd,
 				env,
 				...interpreter !== "none" ? { interpreter } : {},
+				...interpreterPath !== void 0 ? { interpreterPath } : {},
 				onOutput
 			})
 		});
 	}
-	shellOutput(id, opts) {
-		return this.runtime.jobs.output(id, opts);
+	async shellOutput(id, opts) {
+		const result = await this.runtime.jobs.output(id, opts);
+		if (!this.spiller.enabled) return result;
+		const stdout = await this.spiller.text(`shell_output-${id}-stdout`, result.stdout, "head+tail");
+		const stderr = await this.spiller.text(`shell_output-${id}-stderr`, result.stderr, "head+tail");
+		const truncation = streamTruncation(stdout.truncation, stderr.truncation);
+		return truncation === void 0 ? result : {
+			...result,
+			stdout: stdout.value,
+			stderr: stderr.value,
+			truncated: true,
+			truncation
+		};
+	}
+	/**
+	* Fit one captured stream to the limits: spilled to a file when
+	* `output.spillDir` is set, otherwise clipped at `maxBytes` as always.
+	*/
+	async fitStream(label, value, maxBytes) {
+		if (this.spiller.enabled) {
+			const cap = this.policy.shell?.maxOutputBytes;
+			const spilled = await this.spiller.text(label, value, "head+tail", cap);
+			if (spilled.truncation !== void 0) return {
+				value: spilled.value,
+				truncated: true,
+				truncation: spilled.truncation
+			};
+		}
+		const capped = capOutput(value, maxBytes);
+		if (!capped.truncated) return capped;
+		return {
+			...capped,
+			truncation: {
+				shown: { lines: splitLines(capped.value).length },
+				total: {
+					lines: splitLines(value).length,
+					bytes: Buffer.byteLength(value, "utf8")
+				}
+			}
+		};
 	}
 	shellKill(id) {
 		return this.runtime.jobs.kill(id);
@@ -3013,8 +4628,9 @@ var Ops = class {
 	listShells() {
 		return this.runtime.jobs.list();
 	}
-	dispose() {
-		return this.runtime.jobs.dispose();
+	async dispose() {
+		await this.runtime.jobs.dispose();
+		await this.spiller.dispose();
 	}
 	async listDir(inputPath = ".", opts) {
 		const { absolutePath: root, relativePath: rootRelative } = await resolveInJail(this.policy, inputPath);
@@ -3118,16 +4734,32 @@ var Ops = class {
 						line: index + 1,
 						text: line
 					});
-					if (matches.length >= DEFAULT_MAX_GREP_MATCHES) return {
-						matches,
-						total: matches.length
-					};
+					if (matches.length >= DEFAULT_MAX_GREP_MATCHES) return this.fitMatches(matches);
 				}
 			}
 		}
-		return {
+		return this.fitMatches(matches);
+	}
+	/** Apply the `output` limits to a finished match list. */
+	async fitMatches(matches) {
+		const fitted = await this.spiller.list("grep", matches, (match) => `${match.path}:${match.line}:${match.text}`, "head");
+		return fitted.truncation === void 0 ? {
 			matches,
 			total: matches.length
+		} : {
+			matches: fitted.items,
+			total: matches.length,
+			truncated: true,
+			truncation: fitted.truncation
+		};
+	}
+	async globResult(pattern) {
+		const all = await this.glob(pattern);
+		const fitted = await this.spiller.list("glob", all, (entry) => entry, "head");
+		return fitted.truncation === void 0 ? { paths: all } : {
+			paths: fitted.items,
+			truncated: true,
+			truncation: fitted.truncation
 		};
 	}
 	async glob(pattern) {
@@ -3160,57 +4792,20 @@ var Ops = class {
 		return denyPaths !== void 0 && denyPaths.length > 0 && matchesAnyGlob(relativePath, denyPaths);
 	}
 };
+/** Combine per-stream truncation metadata; `undefined` when neither stream was clipped. */
+function streamTruncation(stdout, stderr) {
+	if (stdout === void 0 && stderr === void 0) return;
+	return {
+		...stdout !== void 0 ? { stdout } : {},
+		...stderr !== void 0 ? { stderr } : {}
+	};
+}
 /** The lower of two optional limits (either may be absent). */
 function lowerOf(policyLimit, requested) {
 	if (requested === void 0 || requested <= 0) return policyLimit;
 	return policyLimit === void 0 ? requested : Math.min(policyLimit, requested);
 }
 /**
-* Apply one exact-string replacement to `content` under the edit rules:
-* `oldString` must occur, and exactly once unless `replaceAll`.
-*/
-function applyReplacement(content, edit, inputPath, shownPath, editIndex) {
-	const occurrences = countOccurrences(content, edit.oldString);
-	const which = editIndex === void 0 ? "" : `Edit ${editIndex + 1}: `;
-	const nothingApplied = editIndex === void 0 ? "" : " None of the edits were applied.";
-	const indexOption = editIndex === void 0 ? {} : { editIndex };
-	if (occurrences === 0) throw new WorkspaceEditError(`${which}The text to replace was not found in "${inputPath}".${nothingApplied}`, {
-		type: "not-found",
-		path: shownPath,
-		matches: 0,
-		...indexOption
-	});
-	if (occurrences > 1 && !edit.replaceAll) throw new WorkspaceEditError(`${which}The text to replace is not unique in "${inputPath}" (${occurrences} matches); pass replaceAll or include more surrounding context.${nothingApplied}`, {
-		type: "not-unique",
-		path: shownPath,
-		matches: occurrences,
-		...indexOption
-	});
-	return {
-		content: edit.replaceAll ? content.split(edit.oldString).join(edit.newString) : replaceFirst(content, edit.oldString, edit.newString),
-		replacements: edit.replaceAll ? occurrences : 1
-	};
-}
-/** Count non-overlapping occurrences of `needle` in `haystack`. */
-function countOccurrences(haystack, needle) {
-	if (needle === "") return 0;
-	let count = 0;
-	let from = 0;
-	while (true) {
-		const index = haystack.indexOf(needle, from);
-		if (index === -1) break;
-		count++;
-		from = index + needle.length;
-	}
-	return count;
-}
-/** Replace the first occurrence of `needle` with `replacement`. */
-function replaceFirst(haystack, needle, replacement) {
-	const index = haystack.indexOf(needle);
-	if (index === -1) return haystack;
-	return haystack.slice(0, index) + replacement + haystack.slice(index + needle.length);
-}
-/**
 * Create the policy-enforced operation layer over a backend.
 *
 * The returned {@link WorkspaceOps} is the single seam both the
@@ -3337,25 +4932,39 @@ const POSIX_SHELL = "/bin/sh";
 *   `/s` keeps the line verbatim inside the outer quotes). The ops layer has
 *   already checked every command in the line.
 */
-function planSpawn(command, interpreter) {
-	if (interpreter === "sh") {
-		if (node_process.platform === "win32") return {
-			file: process.env.ComSpec ?? "cmd.exe",
-			args: [
-				"/d",
-				"/v:off",
-				"/s",
-				"/c",
-				`"${command}"`
-			],
-			windowsVerbatimArguments: true
-		};
-		return {
-			file: POSIX_SHELL,
-			args: ["-c", command],
-			windowsVerbatimArguments: false
-		};
-	}
+function planSpawn(command, interpreter, interpreterPath, hostPlatform = node_process.platform) {
+	if (interpreter === "powershell") return {
+		file: interpreterPath ?? (hostPlatform === "win32" ? "powershell.exe" : "pwsh"),
+		args: [
+			"-NoLogo",
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			command
+		],
+		windowsVerbatimArguments: false
+	};
+	if (interpreter === "bash") return {
+		file: interpreterPath ?? "bash",
+		args: ["-c", command],
+		windowsVerbatimArguments: false
+	};
+	if (interpreter === "cmd" || interpreter === "sh" && hostPlatform === "win32") return {
+		file: interpreterPath ?? process.env.ComSpec ?? "cmd.exe",
+		args: [
+			"/d",
+			"/v:off",
+			"/s",
+			"/c",
+			`"${command}"`
+		],
+		windowsVerbatimArguments: true
+	};
+	if (interpreter === "sh") return {
+		file: interpreterPath ?? POSIX_SHELL,
+		args: ["-c", command],
+		windowsVerbatimArguments: false
+	};
 	const argv = tokenizeCommand(command);
 	const executable = argv?.[0];
 	if (argv === null || executable === void 0) return { refused: "Command was not executed: it is empty, has unbalanced quotes, or contains unquoted shell metacharacters (;, &, |, `, $, <, >, parentheses). Commands run without a shell — pass metacharacters inside quotes as literal arguments, or run one command at a time." };
@@ -3511,7 +5120,7 @@ var LocalBackend = class {
 				});
 				return;
 			}
-			const plan = planSpawn(command, opts.interpreter ?? "none");
+			const plan = planSpawn(command, opts.interpreter ?? "none", opts.interpreterPath);
 			if ("refused" in plan) {
 				refuse(plan.refused);
 				return;
@@ -3585,7 +5194,7 @@ var LocalBackend = class {
 	* still-running tree is also killed when the Node process exits.
 	*/
 	start(command, opts) {
-		const plan = planSpawn(command, opts.interpreter ?? "none");
+		const plan = planSpawn(command, opts.interpreter ?? "none", opts.interpreterPath);
 		if ("refused" in plan) {
 			opts.onOutput("stderr", plan.refused);
 			return {
@@ -4310,6 +5919,7 @@ function makeGlobTool(ops, options) {
 		action: (input) => `Finding files matching ${input.pattern}`,
 		input: globInputSchema,
 		async execute(input) {
+			if (ops.globResult !== void 0) return ops.globResult(input.pattern);
 			return { paths: await ops.glob(input.pattern) };
 		}
 	});
@@ -4605,6 +6215,23 @@ function runShellInputSchema(background) {
 		}
 	} }, runShellJsonSchema(background));
 }
+const DIALECT_RULES = {
+	posix: "Use POSIX shell syntax: `;`, `&&`, `||`, pipes, quotes, `$( )` and redirections are supported, and every command in the line is checked. Compound statements (`if`, `for`), brace expansion, arithmetic and `&` are not.",
+	cmd: "Use cmd.exe syntax: `&&`, `||`, `&`, `|` and simple redirections are supported, and every command in the line is checked. `%` and `!` expansion, `^`, parentheses and `if` / `for` are not.",
+	powershell: "Use PowerShell syntax: `;`, `&&`, `||`, pipes, `$( )`, the call operator `&` and the redirections `>`, `>>`, `2>` and `2>&1` are supported, and every command in the line is checked (aliases such as `rm` and `Remove-Item` are treated alike). Script blocks, `Invoke-Expression`, here-strings, splatting and `if` / `foreach` are not."
+};
+const PLATFORM_NAMES = {
+	win32: "Windows",
+	darwin: "macOS",
+	linux: "Linux"
+};
+/** The sentence that names the shell and its syntax, or `""` in argv mode. */
+function shellSentence(options) {
+	const dialect = options?.shellDialect;
+	if (options?.shellLabel === void 0 || dialect === void 0 || dialect === "none") return "";
+	const platform = options.platform ?? process.platform;
+	return ` Commands run on ${PLATFORM_NAMES[platform] ?? platform} using ${options.shellLabel}. ` + DIALECT_RULES[dialect];
+}
 /** The lower of the model's timeout and the cap (either may be absent). */
 function cappedTimeout(requested, cap) {
 	if (requested === void 0) return cap;
@@ -4614,7 +6241,7 @@ function makeRunShellTool(ops, options) {
 	const background = options?.background === true;
 	return (0, _warlock_js_ai.tool)({
 		name: options?.name ?? DEFAULT_RUN_SHELL_TOOL_NAME,
-		description: "Run a shell command inside the workspace. Every command in it must be permitted by the shell policy; a refusal explains how to fix the command. Output is byte-capped and the run is time-limited. A non-zero exit code is returned as data, not an error." + (background ? " Pass background: true for a long-running command (dev server, watcher): it returns an id at once; read its output with shell_output and stop it with shell_kill." : ""),
+		description: "Run a shell command inside the workspace. Every command in it must be permitted by the shell policy; a refusal explains how to fix the command. Output is byte-capped and the run is time-limited. A non-zero exit code is returned as data, not an error." + shellSentence(options) + (background ? " Pass background: true for a long-running command (dev server, watcher): it returns an id at once; read its output with shell_output and stop it with shell_kill." : ""),
 		action: (input) => `Running \`${input.command}\``,
 		input: runShellInputSchema(background),
 		execute: async (input, ctx) => {
@@ -4674,8 +6301,9 @@ const runTestsInputSchema = withJsonSchema({ "~standard": {
 	}
 } }, RUN_TESTS_JSON_SCHEMA);
 /** Quote the test pattern as one literal argument for the line's interpreter. */
-function quotePattern(pattern, interpreter) {
-	if (interpreter === "sh" && process.platform !== "win32") return `'${pattern.replace(/'/g, "'\\''")}'`;
+function quotePattern(pattern, interpreter, dialect, platform = process.platform) {
+	if (dialect === "powershell" || interpreter === "powershell") return `'${pattern.replace(/['\u2018\u2019\u201A\u201B]/g, "$&$&")}'`;
+	if (interpreter === "bash" || interpreter === "sh" && platform !== "win32") return `'${pattern.replace(/'/g, "'\\''")}'`;
 	return `"${pattern}"`;
 }
 /**
@@ -4710,7 +6338,7 @@ function makeRunTestsTool(ops, options) {
 		action: (input) => input.pattern ? `Running tests matching "${input.pattern}"` : "Running tests",
 		input: runTestsInputSchema,
 		execute: (input, ctx) => {
-			const command = input.pattern ? `${baseCommand} ${quotePattern(input.pattern, options?.interpreter ?? "none")}` : baseCommand;
+			const command = input.pattern ? `${baseCommand} ${quotePattern(input.pattern, options?.interpreter ?? "none", options?.dialect, options?.platform)}` : baseCommand;
 			return ops.exec(command, ctx?.signal ? { signal: ctx.signal } : void 0);
 		}
 	});
@@ -5016,11 +6644,12 @@ function makeWriteFileTool(ops, options) {
 		description: "Write full content to a workspace file, creating it (and any parent directories) if absent and overwriting it otherwise. The write is atomic. Returns the bytes written and the new content hash.",
 		input: inputSchema,
 		async execute(input) {
-			const { hash, bytesWritten } = await ops.writeFile(input.path, input.content);
+			const { hash, bytesWritten, diagnostics } = await ops.writeFile(input.path, input.content);
 			return {
 				path: input.path,
 				bytesWritten,
-				hash
+				hash,
+				...diagnostics !== void 0 ? { diagnostics } : {}
 			};
 		}
 	});
@@ -5094,10 +6723,16 @@ var WorkspaceImpl = class WorkspaceImpl {
 		this.allowedTools = new Set(allowedTools);
 		this.state = state ?? {
 			jobs: new ShellJobs(),
-			todos: new TodoStore()
+			todos: new TodoStore(),
+			approvals: []
 		};
+		this.resolvedShell = resolveShell(policy.shell);
+		this.shell = { classify: (line) => classifyShellCommand(line, policy) };
 		const backend = selectBackend(policy);
-		this.ops = createOps(backend, policy, { jobs: this.state.jobs });
+		this.ops = createOps(backend, policy, {
+			jobs: this.state.jobs,
+			approvals: this.state.approvals
+		});
 		this.tools = this.buildTools();
 	}
 	/**
@@ -5111,7 +6746,7 @@ var WorkspaceImpl = class WorkspaceImpl {
 		const erase = (contract) => contract;
 		const shell = this.policy.shell;
 		const background = shell?.background !== void 0;
-		const interpreter = shell?.interpreter ?? "none";
+		const resolvedShell = this.resolvedShell;
 		const factories = {
 			readFile: (opts) => erase(makeReadFileTool(this.ops, opts)),
 			editFile: (opts) => erase(makeEditFileTool(this.ops, opts)),
@@ -5122,13 +6757,16 @@ var WorkspaceImpl = class WorkspaceImpl {
 			runShell: (opts) => erase(makeRunShellTool(this.ops, {
 				...opts?.name !== void 0 ? { name: opts.name } : {},
 				...shell?.timeoutMs !== void 0 ? { maxTimeoutMs: shell.timeoutMs } : {},
-				background
+				background,
+				...resolvedShell.interpreter !== "none" ? { shellLabel: resolvedShell.label } : {},
+				shellDialect: resolvedShell.interpreter === "none" ? "none" : resolvedShell.dialect
 			})),
 			shellOutput: (opts) => erase(makeShellOutputTool(this.ops, opts)),
 			shellKill: (opts) => erase(makeShellKillTool(this.ops, opts)),
 			runTests: (opts) => erase(makeRunTestsTool(this.ops, {
 				...opts,
-				interpreter
+				interpreter: resolvedShell.interpreter,
+				dialect: resolvedShell.dialect
 			})),
 			grep: (opts) => erase(makeGrepTool(this.ops, opts)),
 			glob: (opts) => erase(makeGlobTool(this.ops, opts)),
@@ -5311,6 +6949,7 @@ exports.applyHunks = applyHunks;
 exports.applyPatchWithOps = applyPatchWithOps;
 exports.buildEnv = buildEnv;
 exports.checkShellCommand = checkShellCommand;
+exports.classifyShellCommand = classifyShellCommand;
 exports.createLocalBackend = createLocalBackend;
 exports.createMockBackend = createMockBackend;
 exports.createOps = createOps;
@@ -5331,6 +6970,7 @@ exports.makeTodoWriteTool = makeTodoWriteTool;
 exports.makeWriteFileTool = makeWriteFileTool;
 exports.parsePatch = parsePatch;
 exports.resolveInJail = resolveInJail;
+exports.resolveShell = resolveShell;
 exports.tokenizeCommand = tokenizeCommand;
 exports.workspace = workspace;
 //# sourceMappingURL=index.cjs.map