@warlock.js/ai-workspace 5.43.0 → 5.44.0

package/esm/index.d.mts

@@ -1,4 +1,8 @@
+import { WorkspaceEditMatchTier, WorkspaceEditMatching } from "./edit/match.mjs";
+import { WorkspaceOutputKeep, WorkspaceOutputPolicy, WorkspaceTruncation } from "./contracts/workspace-output.type.mjs";
 import { ApplyPatchFileResult, ApplyPatchInput, ApplyPatchResult, EditFileInput, EditFileResult, ExecOptions, GlobInput, GlobResult, GrepInput, GrepMatch, GrepResult, ListDirEntry, ListDirEntryType, ListDirInput, ListDirOptions, ListDirResult, MultiEditInput, MultiEditOperation, MultiEditResult, ReadFileInput, ReadFileResult, RunShellBackgroundResult, RunShellInput, RunShellResult, RunTestsInput, ShellJobInfo, ShellJobStatus, ShellKillInput, ShellOutputInput, ShellOutputOptions, ShellOutputResult, StartShellOptions, TodoListResult, TodoWriteInput, WorkspaceTodo, WorkspaceTodoInput, WorkspaceTodoStatus, WorkspaceToolName, WriteFileInput, WriteFileResult } from "./contracts/tool-io.type.mjs";
+import { WorkspaceCommandDecision, WorkspaceCommandRule, WorkspaceShellAsk, WorkspaceShellAskDecision, WorkspaceShellAskReason, WorkspaceShellAskRequest, WorkspaceShellClassification, WorkspaceShellOnAsk } from "./contracts/shell-approval.type.mjs";
+import { WorkspaceAfterEditEvent, WorkspaceEditLineEndings, WorkspaceEditPolicy, WorkspaceEditTool, WorkspaceHooks } from "./contracts/workspace-edit.type.mjs";
 import { WorkspaceAllowCommand, WorkspaceBackendType, WorkspaceBackgroundPolicy, WorkspaceCommandCheckContext, WorkspaceCommandPattern, WorkspaceListPolicy, WorkspacePolicy, WorkspaceReadPolicy, WorkspaceShellInterpreter, WorkspaceShellPolicy } from "./contracts/workspace-policy.type.mjs";
 import { WorkspaceBackend, WorkspaceBackendExecOptions, WorkspaceBackendExecResult, WorkspaceBackendProcess, WorkspaceBackendStartOptions, WorkspaceBackendStat, WorkspaceOutputStream } from "./contracts/workspace-backend.contract.mjs";
 import { WorkspaceOps } from "./contracts/workspace-ops.contract.mjs";
@@ -6,7 +10,8 @@ import { Workspace, WorkspaceTools } from "./contracts/workspace.contract.mjs";
 import "./contracts/index.mjs";
 import { WorkspaceEditError, WorkspaceEditErrorOptions, WorkspaceEditFailure, WorkspaceJobError, WorkspaceJobErrorOptions, WorkspaceJobFailure, WorkspacePolicyError, WorkspacePolicyErrorOptions, WorkspacePolicyViolation, WorkspaceShellRefusalReason } from "./errors.mjs";
 import { ResolvedPath, buildEnv, isCommandAllowed, resolveInJail } from "./policy/policy.mjs";
-import { WorkspaceShellCheck, WorkspaceShellPath, WorkspaceShellPathAccess, checkShellCommand } from "./policy/shell-check.mjs";
+import { ResolvedShell, ResolvedShellInterpreter, ShellHost, resolveShell } from "./policy/shell-interpreter.mjs";
+import { WorkspaceShellCheck, WorkspaceShellPath, WorkspaceShellPathAccess, checkShellCommand, classifyShellCommand } from "./policy/shell-check.mjs";
 import { ArgvAnalysis, analyzeArgvCommand, tokenizeCommand } from "./policy/tokenize-command.mjs";
 import { applyPatchWithOps } from "./patch/apply-patch-generic.mjs";
 import { FilePatch, FilePatchKind, PatchHunk, PatchLine, parsePatch } from "./patch/parse-patch.mjs";
@@ -29,5 +34,5 @@ import { TodoStore } from "./todos.mjs";
 import { makeTodoReadTool, makeTodoWriteTool } from "./tools/todo.mjs";
 import { makeWriteFileTool } from "./tools/write-file.mjs";
 import { workspace } from "./workspace.mjs";
-export { type ApplyPatchFileResult, type ApplyPatchInput, type ApplyPatchResult, type ArgvAnalysis, type EditFileInput, type EditFileResult, type ExecOptions, type FilePatch, type FilePatchKind, type GlobInput, type GlobResult, type GrepInput, type GrepMatch, type GrepResult, type ListDirEntry, type ListDirEntryType, type ListDirInput, type ListDirOptions, type ListDirResult, type MakeGlobToolOptions, type MakeGrepToolOptions, type MakeRunShellToolOptions, type MakeRunTestsToolOptions, type MockBackendSeed, type MockExecResult, type MultiEditInput, type MultiEditOperation, type MultiEditResult, type PatchHunk, type PatchLine, type ReadFileInput, type ReadFileResult, type ResolvedPath, type RunShellBackgroundResult, type RunShellInput, type RunShellResult, type RunTestsInput, type ShellJobInfo, type ShellJobStatus, type ShellKillInput, type ShellOutputInput, type ShellOutputOptions, type ShellOutputResult, type StartShellOptions, type TodoListResult, TodoStore, type TodoWriteInput, type Workspace, type WorkspaceAllowCommand, type WorkspaceBackend, type WorkspaceBackendExecOptions, type WorkspaceBackendExecResult, type WorkspaceBackendProcess, type WorkspaceBackendStartOptions, type WorkspaceBackendStat, type WorkspaceBackendType, type WorkspaceBackgroundPolicy, type WorkspaceCommandCheckContext, type WorkspaceCommandPattern, WorkspaceEditError, type WorkspaceEditErrorOptions, type WorkspaceEditFailure, WorkspaceJobError, type WorkspaceJobErrorOptions, type WorkspaceJobFailure, type WorkspaceListPolicy, type WorkspaceOps, type WorkspaceOutputStream, type WorkspacePolicy, WorkspacePolicyError, type WorkspacePolicyErrorOptions, type WorkspacePolicyViolation, type WorkspaceReadPolicy, type WorkspaceShellCheck, type WorkspaceShellInterpreter, type WorkspaceShellPath, type WorkspaceShellPathAccess, type WorkspaceShellPolicy, type WorkspaceShellRefusalReason, type WorkspaceTodo, type WorkspaceTodoInput, type WorkspaceTodoStatus, type WorkspaceToolName, type WorkspaceTools, type WriteFileInput, type WriteFileResult, analyzeArgvCommand, applyHunks, applyPatchWithOps, buildEnv, checkShellCommand, createLocalBackend, createMockBackend, createOps, isCommandAllowed, makeApplyPatchTool, makeEditFileTool, makeGlobTool, makeGrepTool, makeListDirTool, makeMultiEditTool, makeReadFileTool, makeRunShellTool, makeRunTestsTool, makeShellKillTool, makeShellOutputTool, makeTodoReadTool, makeTodoWriteTool, makeWriteFileTool, parsePatch, resolveInJail, tokenizeCommand, workspace };
+export { type ApplyPatchFileResult, type ApplyPatchInput, type ApplyPatchResult, type ArgvAnalysis, type EditFileInput, type EditFileResult, type ExecOptions, type FilePatch, type FilePatchKind, type GlobInput, type GlobResult, type GrepInput, type GrepMatch, type GrepResult, type ListDirEntry, type ListDirEntryType, type ListDirInput, type ListDirOptions, type ListDirResult, type MakeGlobToolOptions, type MakeGrepToolOptions, type MakeRunShellToolOptions, type MakeRunTestsToolOptions, type MockBackendSeed, type MockExecResult, type MultiEditInput, type MultiEditOperation, type MultiEditResult, type PatchHunk, type PatchLine, type ReadFileInput, type ReadFileResult, type ResolvedPath, type ResolvedShell, type ResolvedShellInterpreter, type RunShellBackgroundResult, type RunShellInput, type RunShellResult, type RunTestsInput, type ShellHost, type ShellJobInfo, type ShellJobStatus, type ShellKillInput, type ShellOutputInput, type ShellOutputOptions, type ShellOutputResult, type StartShellOptions, type TodoListResult, TodoStore, type TodoWriteInput, type Workspace, type WorkspaceAfterEditEvent, type WorkspaceAllowCommand, type WorkspaceBackend, type WorkspaceBackendExecOptions, type WorkspaceBackendExecResult, type WorkspaceBackendProcess, type WorkspaceBackendStartOptions, type WorkspaceBackendStat, type WorkspaceBackendType, type WorkspaceBackgroundPolicy, type WorkspaceCommandCheckContext, type WorkspaceCommandDecision, type WorkspaceCommandPattern, type WorkspaceCommandRule, WorkspaceEditError, type WorkspaceEditErrorOptions, type WorkspaceEditFailure, type WorkspaceEditLineEndings, type WorkspaceEditMatchTier, type WorkspaceEditMatching, type WorkspaceEditPolicy, type WorkspaceEditTool, type WorkspaceHooks, WorkspaceJobError, type WorkspaceJobErrorOptions, type WorkspaceJobFailure, type WorkspaceListPolicy, type WorkspaceOps, type WorkspaceOutputKeep, type WorkspaceOutputPolicy, type WorkspaceOutputStream, type WorkspacePolicy, WorkspacePolicyError, type WorkspacePolicyErrorOptions, type WorkspacePolicyViolation, type WorkspaceReadPolicy, type WorkspaceShellAsk, type WorkspaceShellAskDecision, type WorkspaceShellAskReason, type WorkspaceShellAskRequest, type WorkspaceShellCheck, type WorkspaceShellClassification, type WorkspaceShellInterpreter, type WorkspaceShellOnAsk, type WorkspaceShellPath, type WorkspaceShellPathAccess, type WorkspaceShellPolicy, type WorkspaceShellRefusalReason, type WorkspaceTodo, type WorkspaceTodoInput, type WorkspaceTodoStatus, type WorkspaceToolName, type WorkspaceTools, type WorkspaceTruncation, type WriteFileInput, type WriteFileResult, analyzeArgvCommand, applyHunks, applyPatchWithOps, buildEnv, checkShellCommand, classifyShellCommand, createLocalBackend, createMockBackend, createOps, isCommandAllowed, makeApplyPatchTool, makeEditFileTool, makeGlobTool, makeGrepTool, makeListDirTool, makeMultiEditTool, makeReadFileTool, makeRunShellTool, makeRunTestsTool, makeShellKillTool, makeShellOutputTool, makeTodoReadTool, makeTodoWriteTool, makeWriteFileTool, parsePatch, resolveInJail, resolveShell, tokenizeCommand, workspace };
 import "./workspace.mjs";

package/esm/index.mjs

@@ -1,6 +1,7 @@
 import { WorkspaceEditError, WorkspaceJobError, WorkspacePolicyError } from "./errors.mjs";
+import { resolveShell } from "./policy/shell-interpreter.mjs";
 import { analyzeArgvCommand, tokenizeCommand } from "./policy/tokenize-command.mjs";
-import { checkShellCommand } from "./policy/shell-check.mjs";
+import { checkShellCommand, classifyShellCommand } from "./policy/shell-check.mjs";
 import { buildEnv, isCommandAllowed, resolveInJail } from "./policy/policy.mjs";
 import { applyHunks } from "./patch/apply-hunks.mjs";
 import { parsePatch } from "./patch/parse-patch.mjs";
@@ -24,4 +25,4 @@ import { makeTodoReadTool, makeTodoWriteTool } from "./tools/todo.mjs";
 import { makeWriteFileTool } from "./tools/write-file.mjs";
 import { workspace } from "./workspace.mjs";
 
-export { TodoStore, WorkspaceEditError, WorkspaceJobError, WorkspacePolicyError, analyzeArgvCommand, applyHunks, applyPatchWithOps, buildEnv, checkShellCommand, createLocalBackend, createMockBackend, createOps, isCommandAllowed, makeApplyPatchTool, makeEditFileTool, makeGlobTool, makeGrepTool, makeListDirTool, makeMultiEditTool, makeReadFileTool, makeRunShellTool, makeRunTestsTool, makeShellKillTool, makeShellOutputTool, makeTodoReadTool, makeTodoWriteTool, makeWriteFileTool, parsePatch, resolveInJail, tokenizeCommand, workspace };
+export { TodoStore, WorkspaceEditError, WorkspaceJobError, WorkspacePolicyError, analyzeArgvCommand, applyHunks, applyPatchWithOps, buildEnv, checkShellCommand, classifyShellCommand, createLocalBackend, createMockBackend, createOps, isCommandAllowed, makeApplyPatchTool, makeEditFileTool, makeGlobTool, makeGrepTool, makeListDirTool, makeMultiEditTool, makeReadFileTool, makeRunShellTool, makeRunTestsTool, makeShellKillTool, makeShellOutputTool, makeTodoReadTool, makeTodoWriteTool, makeWriteFileTool, parsePatch, resolveInJail, resolveShell, tokenizeCommand, workspace };

package/esm/ops.d.mts

@@ -1,4 +1,4 @@
-import { WorkspacePolicy } from "./contracts/workspace-policy.type.mjs";
+import { WorkspaceCommandPattern, WorkspacePolicy } from "./contracts/workspace-policy.type.mjs";
 import { WorkspaceBackend } from "./contracts/workspace-backend.contract.mjs";
 import { WorkspaceOps } from "./contracts/workspace-ops.contract.mjs";
 import "./contracts/index.mjs";
@@ -18,6 +18,8 @@ import { ShellJobs } from "./shell-jobs.mjs";
 export interface OpsRuntime {
   /** The workspace's background commands. */
   jobs: ShellJobs;
+  /** Patterns the host approved with `remember`, shared by every view of the workspace. */
+  approvals?: WorkspaceCommandPattern[];
 }
 /**
  * Create the policy-enforced operation layer over a backend.

package/esm/ops.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"ops.d.mts","names":[],"sources":["../../../../../../../packages/ai-workspace/src/ops.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAiMiB;;EAEf,MAAM;;;;;;;;;;;;;;;;;;;;;wBAouBQ,UACd,SAAS,kBACT,QAAQ,iBACR,UAAU,aACT"}
+{"version":3,"file":"ops.d.mts","names":[],"sources":["../../../../../../../packages/ai-workspace/src/ops.ts"],"mappings":";;;;;;;;;;;;;;;;;iBA0MiB;;EAEf,MAAM;;EAEN,YAAY;;;;;;;;;;;;;;;;;;;;;wBA23BE,UACd,SAAS,kBACT,QAAQ,iBACR,UAAU,aACT"}

package/esm/ops.mjs

@@ -1,8 +1,12 @@
 import { WorkspaceEditError, WorkspacePolicyError } from "./errors.mjs";
 import { globToRegExp, isInside, matchesAnyGlob } from "./policy/jail.mjs";
+import { resolveShell } from "./policy/shell-interpreter.mjs";
 import { checkShellCommand } from "./policy/shell-check.mjs";
 import { buildCommandEnv, resolveInJail } from "./policy/policy.mjs";
 import { executePatch } from "./patch/execute-patch.mjs";
+import { applyReplacement } from "./edit/apply-replacement.mjs";
+import { runAfterEdit } from "./hooks/after-edit.mjs";
+import { OutputSpiller, splitLines } from "./output/spill.mjs";
 import { ShellJobs } from "./shell-jobs.mjs";
 import path from "node:path";
 import { fs } from "@warlock.js/fs";
@@ -139,6 +143,26 @@ var Ops = class {
 		this.policy = policy;
 		this.runtime = runtime;
 		this.pathLocks = /* @__PURE__ */ new Map();
+		this.resolvedShell = resolveShell(policy.shell);
+		this.approvals = runtime.approvals ?? [];
+		this.spiller = new OutputSpiller(backend, policy);
+	}
+	/** The edit-policy settings applied to every replacement. */
+	editOptions() {
+		const edit = this.policy.edit;
+		return {
+			matching: edit?.matching ?? "tiered",
+			missHintLines: edit?.missHintLines ?? 12,
+			lineEndings: edit?.lineEndings ?? "preserve",
+			...this.policy.read?.maxBytes !== void 0 ? { hintMaxBytes: this.policy.read.maxBytes } : {}
+		};
+	}
+	/** Run `afterEdit` for a call that wrote `paths`; `undefined` when there is no output. */
+	diagnosticsFor(tool, paths) {
+		return runAfterEdit(this.policy, {
+			paths,
+			tool
+		});
 	}
 	/** Run `task` after every earlier mutation of `absolutePath` has settled. */
 	async withPathLock(absolutePath, task) {
@@ -183,7 +207,7 @@ var Ops = class {
 		}
 	}
 	async readFile(inputPath, opts) {
-		const { absolutePath } = await resolveInJail(this.policy, inputPath);
+		const { absolutePath } = await resolveInJail(this.policy, inputPath, "read");
 		const raw = await this.backend.readFile(absolutePath);
 		const hash = fs.hash.string(raw);
 		const lines = raw.split("\n");
@@ -192,10 +216,29 @@ var Ops = class {
 		const limit = opts?.limit ?? this.policy.read?.defaultLines ?? DEFAULT_READ_LINES;
 		const maxBytes = this.policy.read?.maxBytes;
 		const startIndex = offset - 1;
-		const { content, returnedLines, bytesCapped } = numberWindow(lines.slice(startIndex, startIndex + Math.max(0, limit)), offset, maxBytes === void 0 ? void 0 : Math.max(0, Math.floor(maxBytes)));
+		const window = lines.slice(startIndex, startIndex + Math.max(0, limit));
+		const { content, returnedLines, bytesCapped } = numberWindow(window, offset, maxBytes === void 0 ? void 0 : Math.max(0, Math.floor(maxBytes)));
 		const endLine = offset + returnedLines - 1;
+		const spillDir = this.spiller.spillDir;
+		let spilled;
+		if (bytesCapped && spillDir !== void 0 && !isInside(absolutePath, spillDir)) {
+			const full = numberWindow(window, offset, void 0).content;
+			const file = await this.spiller.save("read_file", full);
+			if (file !== void 0) spilled = {
+				content: `${content}\n[showing lines 1-${returnedLines} of ${window.length}; full output saved to ${file}]`,
+				truncation: {
+					shown: { lines: returnedLines },
+					total: {
+						lines: window.length,
+						bytes: Buffer.byteLength(full, "utf8")
+					},
+					path: file
+				}
+			};
+		}
 		return {
-			content,
+			content: spilled?.content ?? content,
+			...spilled !== void 0 ? { truncation: spilled.truncation } : {},
 			startLine: offset,
 			endLine,
 			totalLines,
@@ -206,8 +249,8 @@ var Ops = class {
 		};
 	}
 	async writeFile(inputPath, content) {
-		const { absolutePath } = await resolveInJail(this.policy, inputPath);
-		return this.withPathLock(absolutePath, async () => {
+		const { absolutePath, relativePath } = await resolveInJail(this.policy, inputPath);
+		const written = await this.withPathLock(absolutePath, async () => {
 			const parent = path.dirname(absolutePath);
 			await this.backend.mkdir(parent);
 			await this.backend.writeFile(absolutePath, content);
@@ -216,10 +259,20 @@ var Ops = class {
 				bytesWritten: Buffer.byteLength(content, "utf8")
 			};
 		});
+		const diagnostics = await this.diagnosticsFor("write_file", [relativePath || inputPath]);
+		return {
+			...written,
+			...diagnostics !== void 0 ? { diagnostics } : {}
+		};
 	}
 	async editFile(input) {
 		const { absolutePath, relativePath } = await resolveInJail(this.policy, input.path);
-		return this.withPathLock(absolutePath, () => this.applyEdit(input, absolutePath, relativePath));
+		const result = await this.withPathLock(absolutePath, () => this.applyEdit(input, absolutePath, relativePath));
+		const diagnostics = await this.diagnosticsFor("edit_file", [result.path]);
+		return diagnostics === void 0 ? result : {
+			...result,
+			diagnostics
+		};
 	}
 	/** The read-check-replace-write of {@link editFile}, run under its path lock. */
 	async applyEdit(input, absolutePath, relativePath) {
@@ -231,19 +284,20 @@ var Ops = class {
 			expectedHash: input.expectHash,
 			actualHash: currentHash
 		});
-		const { content: updated, replacements } = applyReplacement(current, input, input.path, relativePath || input.path);
+		const { content: updated, replacements, matchTier } = applyReplacement(current, input, input.path, relativePath || input.path, this.editOptions());
 		await this.backend.writeFile(absolutePath, updated);
 		return {
 			path: relativePath || input.path,
 			replacements,
-			hash: fs.hash.string(updated)
+			hash: fs.hash.string(updated),
+			...matchTier !== void 0 ? { matchTier } : {}
 		};
 	}
 	async multiEdit(input) {
 		const { absolutePath, relativePath } = await resolveInJail(this.policy, input.path);
 		const shownPath = relativePath || input.path;
 		if (input.edits.length === 0 || input.edits.length > 100) throw new RangeError(`A multi-edit needs between 1 and ${100} edits (got ${input.edits.length}).`);
-		return this.withPathLock(absolutePath, async () => {
+		const result = await this.withPathLock(absolutePath, async () => {
 			const current = await this.backend.readFile(absolutePath);
 			const currentHash = fs.hash.string(current);
 			if (input.expectHash !== void 0 && input.expectHash !== currentHash) throw new WorkspaceEditError(`File "${input.path}" changed since it was read; none of the edits were applied.`, {
@@ -254,21 +308,40 @@ var Ops = class {
 			});
 			let content = current;
 			let replacements = 0;
+			let matchTier;
+			const options = this.editOptions();
 			input.edits.forEach((edit, editIndex) => {
-				const applied = applyReplacement(content, edit, input.path, shownPath, editIndex);
+				const applied = applyReplacement(content, edit, input.path, shownPath, options, editIndex);
 				content = applied.content;
 				replacements += applied.replacements;
+				if (applied.matchTier === "whitespace" || matchTier === void 0) matchTier = applied.matchTier ?? matchTier;
 			});
 			await this.backend.writeFile(absolutePath, content);
 			return {
 				path: shownPath,
 				edits: input.edits.length,
 				replacements,
-				hash: fs.hash.string(content)
+				hash: fs.hash.string(content),
+				...matchTier !== void 0 ? { matchTier } : {}
 			};
 		});
+		const diagnostics = await this.diagnosticsFor("multi_edit", [shownPath]);
+		return diagnostics === void 0 ? result : {
+			...result,
+			diagnostics
+		};
 	}
 	async applyPatch(input) {
+		const result = await this.runPatch(input);
+		if (result.dryRun) return result;
+		const paths = result.files.filter((file) => file.action !== "deleted").map((file) => file.path);
+		const diagnostics = await this.diagnosticsFor("apply_patch", paths);
+		return diagnostics === void 0 ? result : {
+			...result,
+			diagnostics
+		};
+	}
+	runPatch(input) {
 		return executePatch(input, {
 			resolve: (inputPath) => resolveInJail(this.policy, inputPath),
 			exists: (absolutePath) => this.backend.exists(absolutePath),
@@ -288,9 +361,14 @@ var Ops = class {
 	* (argv or shell mode), then — shell mode — every redirection target and
 	* `cd` directory against the jail with symlinks resolved.
 	*/
-	async assertCommandAllowed(command) {
-		const verdict = checkShellCommand(this.policy, command);
-		if (!verdict.allowed) throw new WorkspacePolicyError(verdict.message ?? `Command is not permitted by the workspace shell policy: ${command}`, {
+	async assertCommandAllowed(command, signal) {
+		const verdict = checkShellCommand(this.policy, command, {
+			remembered: this.approvals,
+			resolved: this.resolvedShell
+		});
+		const onAsk = this.policy.shell?.onAsk;
+		const needsApproval = !verdict.allowed && verdict.reason === "approval-required" && verdict.asks.length > 0;
+		if (!verdict.allowed && !(needsApproval && onAsk !== void 0)) throw new WorkspacePolicyError(verdict.message ?? `Command is not permitted by the workspace shell policy: ${command}`, {
 			type: "denied-command",
 			command,
 			...verdict.reason !== void 0 ? { reason: verdict.reason } : {},
@@ -313,9 +391,29 @@ var Ops = class {
 			reason: "not-allowed",
 			command
 		});
+		if (needsApproval && onAsk !== void 0) await this.askForApproval(command, verdict.asks, onAsk, signal);
+	}
+	/** Put the commands that need approval to `shell.onAsk`; refuse the line unless it says yes. */
+	async askForApproval(command, asks, onAsk, signal) {
+		let decision;
+		try {
+			decision = await onAsk({
+				command,
+				asks,
+				...signal ? { signal } : {}
+			});
+		} catch {
+			decision = void 0;
+		}
+		if (decision?.allow !== true) throw new WorkspacePolicyError(`Running ${asks.map((ask) => `\`${ask.argv.join(" ")}\``).join(", ")} was not approved.`, {
+			type: "denied-command",
+			reason: "approval-denied",
+			command
+		});
+		if (decision.remember !== void 0 && !this.approvals.includes(decision.remember)) this.approvals.push(decision.remember);
 	}
 	async exec(command, opts) {
-		await this.assertCommandAllowed(command);
+		await this.assertCommandAllowed(command, opts?.signal);
 		const signal = opts?.signal;
 		if (signal?.aborted) return {
 			exitCode: CANCELLED_BEFORE_START_EXIT_CODE,
@@ -328,24 +426,27 @@ var Ops = class {
 		const shell = this.policy.shell;
 		const timeoutMs = opts?.timeoutMs ?? shell?.timeoutMs;
 		const maxOutputBytes = shell?.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
-		const interpreter = shell?.interpreter ?? "none";
+		const interpreter = this.resolvedShell.interpreter;
 		const result = await this.backend.exec(command, {
 			cwd: this.policy.cwd,
 			timeoutMs,
 			env: buildCommandEnv(this.policy),
 			...signal ? { signal } : {},
-			...interpreter !== "none" ? { interpreter } : {}
+			...interpreter !== "none" ? { interpreter } : {},
+			...interpreter !== "none" && this.resolvedShell.file !== void 0 ? { interpreterPath: this.resolvedShell.file } : {}
 		});
-		const stdout = capOutput(result.stdout, maxOutputBytes);
-		const stderr = capOutput(result.stderr, maxOutputBytes);
+		const stdout = await this.fitStream("run_shell-stdout", result.stdout, maxOutputBytes);
+		const stderr = await this.fitStream("run_shell-stderr", result.stderr, maxOutputBytes);
 		const cancelled = result.cancelled === true;
+		const truncation = streamTruncation(stdout.truncation, stderr.truncation);
 		return {
 			exitCode: result.exitCode,
 			stdout: stdout.value,
 			stderr: stderr.value,
 			truncated: stdout.truncated || stderr.truncated,
 			timedOut: result.timedOut && !cancelled,
-			cancelled
+			cancelled,
+			...truncation !== void 0 ? { truncation } : {}
 		};
 	}
 	async startShell(command, opts) {
@@ -363,7 +464,8 @@ var Ops = class {
 			command
 		});
 		const shell = this.policy.shell;
-		const interpreter = shell?.interpreter ?? "none";
+		const interpreter = this.resolvedShell.interpreter;
+		const interpreterPath = interpreter !== "none" ? this.resolvedShell.file : void 0;
 		const timeoutMs = lowerOf(background.timeoutMs, opts?.timeoutMs);
 		const env = buildCommandEnv(this.policy);
 		return this.runtime.jobs.start({
@@ -375,12 +477,51 @@ var Ops = class {
 				cwd: this.policy.cwd,
 				env,
 				...interpreter !== "none" ? { interpreter } : {},
+				...interpreterPath !== void 0 ? { interpreterPath } : {},
 				onOutput
 			})
 		});
 	}
-	shellOutput(id, opts) {
-		return this.runtime.jobs.output(id, opts);
+	async shellOutput(id, opts) {
+		const result = await this.runtime.jobs.output(id, opts);
+		if (!this.spiller.enabled) return result;
+		const stdout = await this.spiller.text(`shell_output-${id}-stdout`, result.stdout, "head+tail");
+		const stderr = await this.spiller.text(`shell_output-${id}-stderr`, result.stderr, "head+tail");
+		const truncation = streamTruncation(stdout.truncation, stderr.truncation);
+		return truncation === void 0 ? result : {
+			...result,
+			stdout: stdout.value,
+			stderr: stderr.value,
+			truncated: true,
+			truncation
+		};
+	}
+	/**
+	* Fit one captured stream to the limits: spilled to a file when
+	* `output.spillDir` is set, otherwise clipped at `maxBytes` as always.
+	*/
+	async fitStream(label, value, maxBytes) {
+		if (this.spiller.enabled) {
+			const cap = this.policy.shell?.maxOutputBytes;
+			const spilled = await this.spiller.text(label, value, "head+tail", cap);
+			if (spilled.truncation !== void 0) return {
+				value: spilled.value,
+				truncated: true,
+				truncation: spilled.truncation
+			};
+		}
+		const capped = capOutput(value, maxBytes);
+		if (!capped.truncated) return capped;
+		return {
+			...capped,
+			truncation: {
+				shown: { lines: splitLines(capped.value).length },
+				total: {
+					lines: splitLines(value).length,
+					bytes: Buffer.byteLength(value, "utf8")
+				}
+			}
+		};
 	}
 	shellKill(id) {
 		return this.runtime.jobs.kill(id);
@@ -388,8 +529,9 @@ var Ops = class {
 	listShells() {
 		return this.runtime.jobs.list();
 	}
-	dispose() {
-		return this.runtime.jobs.dispose();
+	async dispose() {
+		await this.runtime.jobs.dispose();
+		await this.spiller.dispose();
 	}
 	async listDir(inputPath = ".", opts) {
 		const { absolutePath: root, relativePath: rootRelative } = await resolveInJail(this.policy, inputPath);
@@ -493,16 +635,32 @@ var Ops = class {
 						line: index + 1,
 						text: line
 					});
-					if (matches.length >= DEFAULT_MAX_GREP_MATCHES) return {
-						matches,
-						total: matches.length
-					};
+					if (matches.length >= DEFAULT_MAX_GREP_MATCHES) return this.fitMatches(matches);
 				}
 			}
 		}
-		return {
+		return this.fitMatches(matches);
+	}
+	/** Apply the `output` limits to a finished match list. */
+	async fitMatches(matches) {
+		const fitted = await this.spiller.list("grep", matches, (match) => `${match.path}:${match.line}:${match.text}`, "head");
+		return fitted.truncation === void 0 ? {
 			matches,
 			total: matches.length
+		} : {
+			matches: fitted.items,
+			total: matches.length,
+			truncated: true,
+			truncation: fitted.truncation
+		};
+	}
+	async globResult(pattern) {
+		const all = await this.glob(pattern);
+		const fitted = await this.spiller.list("glob", all, (entry) => entry, "head");
+		return fitted.truncation === void 0 ? { paths: all } : {
+			paths: fitted.items,
+			truncated: true,
+			truncation: fitted.truncation
 		};
 	}
 	async glob(pattern) {
@@ -535,57 +693,20 @@ var Ops = class {
 		return denyPaths !== void 0 && denyPaths.length > 0 && matchesAnyGlob(relativePath, denyPaths);
 	}
 };
+/** Combine per-stream truncation metadata; `undefined` when neither stream was clipped. */
+function streamTruncation(stdout, stderr) {
+	if (stdout === void 0 && stderr === void 0) return;
+	return {
+		...stdout !== void 0 ? { stdout } : {},
+		...stderr !== void 0 ? { stderr } : {}
+	};
+}
 /** The lower of two optional limits (either may be absent). */
 function lowerOf(policyLimit, requested) {
 	if (requested === void 0 || requested <= 0) return policyLimit;
 	return policyLimit === void 0 ? requested : Math.min(policyLimit, requested);
 }
 /**
-* Apply one exact-string replacement to `content` under the edit rules:
-* `oldString` must occur, and exactly once unless `replaceAll`.
-*/
-function applyReplacement(content, edit, inputPath, shownPath, editIndex) {
-	const occurrences = countOccurrences(content, edit.oldString);
-	const which = editIndex === void 0 ? "" : `Edit ${editIndex + 1}: `;
-	const nothingApplied = editIndex === void 0 ? "" : " None of the edits were applied.";
-	const indexOption = editIndex === void 0 ? {} : { editIndex };
-	if (occurrences === 0) throw new WorkspaceEditError(`${which}The text to replace was not found in "${inputPath}".${nothingApplied}`, {
-		type: "not-found",
-		path: shownPath,
-		matches: 0,
-		...indexOption
-	});
-	if (occurrences > 1 && !edit.replaceAll) throw new WorkspaceEditError(`${which}The text to replace is not unique in "${inputPath}" (${occurrences} matches); pass replaceAll or include more surrounding context.${nothingApplied}`, {
-		type: "not-unique",
-		path: shownPath,
-		matches: occurrences,
-		...indexOption
-	});
-	return {
-		content: edit.replaceAll ? content.split(edit.oldString).join(edit.newString) : replaceFirst(content, edit.oldString, edit.newString),
-		replacements: edit.replaceAll ? occurrences : 1
-	};
-}
-/** Count non-overlapping occurrences of `needle` in `haystack`. */
-function countOccurrences(haystack, needle) {
-	if (needle === "") return 0;
-	let count = 0;
-	let from = 0;
-	while (true) {
-		const index = haystack.indexOf(needle, from);
-		if (index === -1) break;
-		count++;
-		from = index + needle.length;
-	}
-	return count;
-}
-/** Replace the first occurrence of `needle` with `replacement`. */
-function replaceFirst(haystack, needle, replacement) {
-	const index = haystack.indexOf(needle);
-	if (index === -1) return haystack;
-	return haystack.slice(0, index) + replacement + haystack.slice(index + needle.length);
-}
-/**
 * Create the policy-enforced operation layer over a backend.
 *
 * The returned {@link WorkspaceOps} is the single seam both the