@xopcai/xopc 0.0.243 → 0.0.245

package/dist/src/agent/tools/exec-command.d.ts

@@ -1,9 +1,14 @@
 import type { AgentTool } from '@earendil-works/pi-agent-core';
 import type { TurnOutcomeDeliverable } from '@xopcai/gateway-contract';
+import type { CommandIsolation } from '../commands/command-isolation.js';
+import { type CommandStatus } from '../commands/command-registry.js';
 export interface ExecCommandDetails {
     command: string;
     cwd: string;
-    status: 'success' | 'failed' | 'timed_out' | 'blocked';
+    status: CommandStatus | 'blocked';
+    id?: string;
+    logPath?: string;
+    logTruncated?: boolean;
     exitCode: number | null;
     durationMs: number;
     timedOut: boolean;
@@ -27,6 +32,8 @@ export interface ExecCommandUpdateDetails {
 }
 export interface CreateExecCommandToolOptions {
     /** Env var names allowed through prepareSafeToolEnv even if they match secret heuristics. */
+    getCommandIsolation?: () => CommandIsolation | undefined;
+    getSessionKey?: () => string | undefined;
     getSkillPassthroughEnvVarNames?: () => string[];
     prepareEnv?: (baseEnv: Record<string, string>, cwd: string) => Promise<Record<string, string>>;
 }

package/dist/src/agent/tools/exec-command.js

@@ -1,76 +1,32 @@
+import { commandRegistry, commandTimeout } from "../commands/command-registry.js";
 import { formatSize, truncateTail } from "./truncate.js";
 import { evaluateExecPolicy } from "../sandbox/exec-policy.js";
 import { publishArtifactPaths } from "./publish-artifacts.js";
 import { resolve } from "node:path";
-import { spawn } from "node:child_process";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/exec-command.ts
-const MAX_COMMAND_TIMEOUT_MS = 14400 * 1e3;
-const DEFAULT_TIMEOUT_MS = 1800 * 1e3;
 const DEFAULT_MAX_OUTPUT_CHARS = 5e4;
-const STREAM_DELTA_MAX_CHARS = 16e3;
 const ExecCommandSchema = Type.Object({
 	cmd: Type.String({ description: "Shell command to execute." }),
 	cwd: Type.Optional(Type.String({ description: "Working directory. Relative paths are resolved under the agent workspace." })),
 	timeoutMs: Type.Optional(Type.Number({ description: "Command timeout in milliseconds. Defaults to 1800000 (30m) and is capped at 14400000 (4h)." })),
 	maxOutputChars: Type.Optional(Type.Number({ description: "Maximum characters returned to the model. UI streaming still receives output deltas." })),
+	yieldTimeMs: Type.Optional(Type.Number({
+		minimum: 0,
+		maximum: 6e4,
+		description: "Return a running job after this wait; manage it with managed_job. Omit to wait for completion. Cannot be combined with outputs."
+	})),
 	outputs: Type.Optional(Type.Array(Type.String({ minLength: 1 }), {
 		maxItems: 50,
 		description: "Final user-facing files created by this command. Relative paths resolve under the effective cwd and are persisted as chat deliverables after a successful command."
 	}))
 });
-function clampTimeoutMs(raw) {
-	return Math.min(MAX_COMMAND_TIMEOUT_MS, Math.max(1e3, Math.floor(typeof raw === "number" && Number.isFinite(raw) ? raw : DEFAULT_TIMEOUT_MS)));
-}
 function clampMaxOutputChars(raw) {
 	return Math.max(1e3, Math.min(5e5, Math.floor(typeof raw === "number" && Number.isFinite(raw) ? raw : DEFAULT_MAX_OUTPUT_CHARS)));
 }
-function commandStatus(exitCode, timedOut) {
-	if (timedOut) return "timed_out";
-	if (exitCode === 0) return "success";
-	return "failed";
-}
-function appendBoundedTail(current, chunk, maxChars) {
-	const combined = current + chunk;
-	if (combined.length <= maxChars) return {
-		value: combined,
-		truncated: false
-	};
-	return {
-		value: combined.slice(-maxChars),
-		truncated: true
-	};
-}
-function terminateProcessTree(proc) {
-	if (!proc.pid) return;
-	if (process.platform === "win32") {
-		const killer = spawn("taskkill", [
-			"/pid",
-			String(proc.pid),
-			"/t",
-			"/f"
-		], {
-			stdio: "ignore",
-			windowsHide: true
-		});
-		killer.once("error", () => {
-			try {
-				proc.kill("SIGKILL");
-			} catch {}
-		});
-		killer.unref();
-		return;
-	}
-	try {
-		process.kill(-proc.pid, "SIGKILL");
-		return;
-	} catch {}
-	try {
-		proc.kill("SIGKILL");
-	} catch {}
-}
 function commandFailureHint(details) {
-	if (details.status === "success") return void 0;
+	if (details.status === "success" || details.status === "running") return void 0;
+	if (details.status === "cancelled") return "The command was cancelled. Inspect its partial output before deciding whether to restart.";
 	if (details.status === "timed_out") return "The command timed out. Re-run a narrower command, increase timeoutMs if the long run is expected, or inspect partial output before retrying.";
 	if (details.exitCode !== 0 && details.stderr.trim()) return "The command failed. Inspect stderr first, fix the underlying issue, then re-run the narrowest relevant verification command.";
 	if (details.exitCode !== 0 && details.stdout.trim()) return "The command failed. Inspect stdout for the failure location, then re-run the narrowest relevant verification command.";
@@ -80,7 +36,7 @@ function formatOutputForModel(details, maxOutputChars) {
 	let prefix = "";
 	if (details.timedOut) prefix += `Command timed out after ${Math.round(details.durationMs / 1e3)}s\n`;
 	if (details.exitCode !== 0 && details.exitCode != null) prefix += `Command exited with code ${details.exitCode}\n`;
-	if (details.captureTruncated) prefix += `Earlier command output was discarded after ${formatSize(details.totalOutputBytes)}; showing the latest captured output.\n`;
+	if (details.captureTruncated) prefix += `Earlier command output was discarded from model context after ${formatSize(details.totalOutputBytes)}; showing the latest captured output.\n`;
 	const truncation = truncateTail(details.aggregatedOutput, { maxBytes: Math.min(maxOutputChars, DEFAULT_MAX_OUTPUT_CHARS) });
 	let text = `${prefix}${truncation.content}`.trimEnd();
 	if (!text) text = "(no output)";
@@ -109,7 +65,8 @@ function createExecCommandTool(workspaceCwd, options) {
 		idempotent: false,
 		finalGuardRelevant: true,
 		async execute(toolCallId, params, signal, onUpdate) {
-			const command = (params.cmd ?? params.command ?? "").trim();
+			const command = (params.cmd ?? "").trim();
+			if (params.yieldTimeMs !== void 0 && params.outputs?.length) throw new Error("yieldTimeMs cannot be combined with outputs; publish files after the job completes.");
 			if (!command) return {
 				content: [{
 					type: "text",
@@ -163,127 +120,78 @@ function createExecCommandTool(workspaceCwd, options) {
 					}
 				};
 			}
-			const timeoutMs = Math.min(clampTimeoutMs(params.timeoutMs), policy.timeoutMs);
+			const timeoutMs = commandTimeout(params.timeoutMs, policy.timeoutMs);
 			const maxOutputChars = clampMaxOutputChars(params.maxOutputChars);
-			const startTime = Date.now();
 			const runtimeEnv = options?.prepareEnv ? await options.prepareEnv(policy.sanitizedEnv, policy.effectiveCwd) : policy.sanitizedEnv;
-			let stdout = "";
-			let stderr = "";
-			let aggregatedOutput = "";
-			let totalOutputBytes = 0;
-			let captureTruncated = false;
-			let timedOut = false;
-			let settled = false;
-			return new Promise((resolveTool) => {
-				const proc = spawn(command, [], {
-					shell: true,
-					detached: process.platform !== "win32",
-					cwd: policy.effectiveCwd,
-					env: {
-						...runtimeEnv,
-						COLUMNS: "200"
-					}
-				});
-				const publishDelta = (stream, raw) => {
-					const text = raw.toString();
-					if (!text) return;
-					totalOutputBytes += Buffer.byteLength(text);
-					if (stream === "stdout") {
-						const next = appendBoundedTail(stdout, text, maxOutputChars);
-						stdout = next.value;
-						captureTruncated ||= next.truncated;
-					} else {
-						const next = appendBoundedTail(stderr, text, maxOutputChars);
-						stderr = next.value;
-						captureTruncated ||= next.truncated;
-					}
-					const nextAggregate = appendBoundedTail(aggregatedOutput, text, maxOutputChars);
-					aggregatedOutput = nextAggregate.value;
-					captureTruncated ||= nextAggregate.truncated;
-					const delta = text.length > STREAM_DELTA_MAX_CHARS ? `${text.slice(0, STREAM_DELTA_MAX_CHARS)}\n[stream delta truncated]` : text;
-					onUpdate?.({
-						content: [],
-						details: {
-							kind: "command_output_delta",
-							command,
-							cwd: policy.effectiveCwd,
-							stream,
-							delta
-						}
-					});
-				};
-				const finish = async (exitCode, errorText) => {
-					if (settled) return;
-					settled = true;
-					clearTimeout(timeout);
-					signal?.removeEventListener("abort", abort);
-					if (errorText) {
-						totalOutputBytes += Buffer.byteLength(errorText);
-						const nextStderr = appendBoundedTail(stderr, errorText, maxOutputChars);
-						stderr = nextStderr.value;
-						const nextAggregate = appendBoundedTail(aggregatedOutput, errorText, maxOutputChars);
-						aggregatedOutput = nextAggregate.value;
-						captureTruncated ||= nextStderr.truncated || nextAggregate.truncated;
-					}
-					const durationMs = Date.now() - startTime;
-					const baseDetails = {
+			const owner = options?.getSessionKey?.() ?? workspaceCwd;
+			const registry = commandRegistry();
+			let commandResult = await registry.start({
+				workspace: workspaceCwd,
+				isolation: options?.getCommandIsolation?.(),
+				owner,
+				command,
+				cwd: policy.effectiveCwd,
+				env: {
+					...runtimeEnv,
+					COLUMNS: "200"
+				},
+				timeoutMs,
+				maxOutputChars,
+				signal,
+				snapshot: true,
+				onOutput: (stream, delta) => onUpdate?.({
+					content: [],
+					details: {
+						kind: "command_output_delta",
 						command,
 						cwd: policy.effectiveCwd,
-						status: commandStatus(exitCode, timedOut),
-						exitCode,
-						durationMs,
-						timedOut,
-						truncated: false,
-						outputBytes: Buffer.byteLength(aggregatedOutput),
-						totalOutputBytes,
-						captureTruncated,
-						stdout,
-						stderr,
-						aggregatedOutput
-					};
-					baseDetails.failureHint = commandFailureHint(baseDetails);
-					const formatted = formatOutputForModel(baseDetails, maxOutputChars);
-					const details = {
-						...baseDetails,
-						truncated: formatted.truncated,
-						truncatedBy: formatted.truncatedBy,
-						outputBytes: formatted.outputBytes
-					};
-					let resultText = formatted.text;
-					if (details.status === "success" && params.outputs?.length) {
-						details.artifacts = await publishArtifactPaths({
-							paths: params.outputs,
-							baseDir: policy.effectiveCwd,
-							workspaceRoot: workspaceCwd,
-							toolCallId
-						});
-						const published = details.artifacts.filter((item) => item.availability === "available").length;
-						const failed = details.artifacts.length - published;
-						resultText += `\n\nArtifacts: ${published} published${failed > 0 ? `, ${failed} failed` : ""}.`;
+						stream,
+						delta
 					}
-					resolveTool({
-						content: [{
-							type: "text",
-							text: resultText
-						}],
-						details
-					});
-				};
-				const abort = () => {
-					timedOut = true;
-					terminateProcessTree(proc);
-				};
-				const timeout = setTimeout(() => {
-					timedOut = true;
-					terminateProcessTree(proc);
-				}, timeoutMs);
-				if (signal?.aborted) abort();
-				else signal?.addEventListener("abort", abort, { once: true });
-				proc.stdout?.on("data", (data) => publishDelta("stdout", data));
-				proc.stderr?.on("data", (data) => publishDelta("stderr", data));
-				proc.on("error", (err) => void finish(null, `Error: ${err.message}`));
-				proc.on("close", (code) => void finish(code));
+				})
 			});
+			try {
+				do
+					commandResult = await registry.wait(owner, commandResult.id, params.yieldTimeMs ?? 6e4, signal);
+				while (params.yieldTimeMs === void 0 && commandResult.status === "running");
+			} catch (error) {
+				if (!signal?.aborted) throw error;
+				commandResult = await registry.cancel(owner, commandResult.id);
+			}
+			const baseDetails = {
+				...commandResult,
+				truncated: false,
+				outputBytes: Buffer.byteLength(commandResult.aggregatedOutput)
+			};
+			baseDetails.failureHint = commandFailureHint(baseDetails);
+			const formatted = formatOutputForModel(baseDetails, maxOutputChars);
+			const details = {
+				...baseDetails,
+				truncated: formatted.truncated,
+				truncatedBy: formatted.truncatedBy,
+				outputBytes: formatted.outputBytes
+			};
+			let resultText = formatted.text;
+			if (details.status === "running") resultText += `\n\nCommand is running (jobId: ${details.id}). Use managed_job wait/status/stdin/cancel.`;
+			if (details.logPath) resultText += `\n\nLog: ${details.logPath}${details.logTruncated ? " (truncated)" : ""}`;
+			if (details.status === "success" && params.outputs?.length) {
+				details.artifacts = await publishArtifactPaths({
+					paths: params.outputs,
+					baseDir: policy.effectiveCwd,
+					workspaceRoot: workspaceCwd,
+					toolCallId
+				});
+				const published = details.artifacts.filter((item) => item.availability === "available").length;
+				const failed = details.artifacts.length - published;
+				resultText += `\n\nArtifacts: ${published} published${failed > 0 ? `, ${failed} failed` : ""}.`;
+			}
+			return {
+				content: [{
+					type: "text",
+					text: resultText
+				}],
+				details
+			};
 		}
 	};
 }

package/dist/src/agent/tools/executor.js

@@ -1,5 +1,6 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { commandTimeout } from "../commands/command-registry.js";
 import { DEFAULT_TOOL_EXECUTION_TIMEOUT_MS, TimeoutError, executeWithTimeout } from "../lifecycle/timeout-wrapper.js";
 import { withRetry } from "../../infra/retry.js";
 import { ToolConcurrencyController, resolveToolLockMode } from "./concurrency.js";
@@ -41,8 +42,14 @@ async function executeToolWithProtection(tool, toolCallId, params, signal, onUpd
 		const onParentAbort = () => controller.abort(signal?.reason);
 		if (signal?.aborted) onParentAbort();
 		else signal?.addEventListener("abort", onParentAbort, { once: true });
-		const execute = () => tool.execute(toolCallId, params, controller.signal, onUpdate);
-		return (fullConfig.enableTimeout ? executeWithTimeout(execute, {
+		const policyDeadline = fullConfig.resolveTimeoutMs?.(toolName);
+		const commandDeadlineField = toolName === "exec_command" ? "timeoutMs" : toolName === "managed_job" && params.action === "start" ? "maxRuntimeMs" : void 0;
+		const executionParams = commandDeadlineField && policyDeadline ? {
+			...params,
+			[commandDeadlineField]: Math.min(commandTimeout(params[commandDeadlineField]), policyDeadline)
+		} : params;
+		const execute = () => tool.execute(toolCallId, executionParams, controller.signal, onUpdate);
+		return (fullConfig.enableTimeout && toolName !== "exec_command" ? executeWithTimeout(execute, {
 			toolName,
 			timeoutMs: resolveTimeoutMs(tool, fullConfig),
 			description: `Executing ${toolName}`,

package/dist/src/agent/tools/factory.js

@@ -5,7 +5,9 @@ import { isXopcDatabaseOpen } from "../../storage/sqlite/connection.js";
 import { getSessionTaskPlan, setSessionTaskPlan } from "../../storage/sqlite/session-task-plan-repository.js";
 import "../../storage/sqlite/index.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
+import { resolveEffectiveAgentConfigForSession } from "../../config/agent-profile.js";
 import { wrapToolsWithProtection } from "./executor.js";
+import { EXTERNAL_TOOL_NAMES } from "../external-tools/gateway-tools.js";
 import { buildRuntimeEnvironment } from "../../runtime-tools/environment.js";
 import { createDefaultExternalToolGatewayTools } from "../external-tools/index.js";
 import { createReadFileTool } from "./read.js";
@@ -36,9 +38,8 @@ import { resolveBrowserBackendFromConfig } from "../../browser/backend-from-conf
 import { checkBrowserReadiness } from "../../browser/readiness.js";
 import { CdpSupervisor } from "../../browser/cdp-supervisor.js";
 import "../../browser/index.js";
-import "./delegate-tool.js";
+import { createDelegateTool } from "./delegate-tool.js";
 import { createWorkflowTool } from "./workflow-tool.js";
-import "./execute-code-tool.js";
 import { createAutomationTool } from "./automation-tool.js";
 import { createBrowserRecipeTool } from "./browser-recipe-tool.js";
 import { createXopcUseTool } from "./xopc-use-tool.js";
@@ -53,6 +54,8 @@ import { createImageTool } from "./image-tool.js";
 import { createImageGenerateTool } from "./image-generate-tool.js";
 import "./index.js";
 import { createBrowserUseTool } from "./browser/tool/browser-use-tool.js";
+import { createReviewWorkspaceTool } from "./review-workspace.js";
+import { createLanguageDiagnosticsTool } from "./language-diagnostics.js";
 import { createWorkflowCatalog } from "../workflow/catalog.js";
 import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
 import { createTextToSpeechTool } from "./tts-tool.js";
@@ -70,7 +73,7 @@ const CLARIFY_SUPPORTED_CHANNELS = new Set([
 	"telegram",
 	"cli"
 ]);
-var AgentToolsFactory = class {
+var AgentToolsFactory = class AgentToolsFactory {
 	browserManager = null;
 	/** One dialog/console supervisor per chat session (browser tab). */
 	browserTaskSupervisors = /* @__PURE__ */ new Map();
@@ -193,6 +196,10 @@ var AgentToolsFactory = class {
 			agentId: options?.agentId ?? (cfg ? resolveDefaultAgentId(cfg) : "main")
 		});
 		const agentId = options?.agentId;
+		const getCommandIsolation = () => {
+			const config = this.deps.getConfig?.();
+			return config ? resolveEffectiveAgentConfigForSession(config, this.deps.getCurrentContext()?.sessionKey ?? `agent:${agentId ?? "main"}:internal`).config.runtime.commandIsolation : void 0;
+		};
 		const externalTools = createDefaultExternalToolGatewayTools({
 			workspace,
 			getConfig: () => this.deps.getConfig?.(),
@@ -271,10 +278,18 @@ var AgentToolsFactory = class {
 			grep,
 			find,
 			createExecCommandTool(workspace, {
+				getCommandIsolation,
+				getSessionKey: () => this.deps.getCurrentContext()?.sessionKey,
 				getSkillPassthroughEnvVarNames: this.deps.getSkillPassthroughEnvVarNames,
 				prepareEnv: this.prepareRuntimeEnv
 			}),
-			createManagedJobTool(workspace, () => this.deps.getCurrentContext()?.sessionKey, this.deps.getSkillPassthroughEnvVarNames, this.prepareRuntimeEnv),
+			createReviewWorkspaceTool(workspace),
+			createLanguageDiagnosticsTool(workspace, {
+				getCommandIsolation,
+				getSessionKey: () => this.deps.getCurrentContext()?.sessionKey,
+				prepareEnv: this.prepareRuntimeEnv
+			}),
+			createManagedJobTool(workspace, () => this.deps.getCurrentContext()?.sessionKey, this.deps.getSkillPassthroughEnvVarNames, this.prepareRuntimeEnv, getCommandIsolation),
 			createWebSearchTool(() => this.deps.getConfig?.()),
 			createWebFetchTool(() => this.deps.getConfig?.()),
 			createWebExtractTool({ getConfig: () => this.deps.getConfig?.() }),
@@ -345,7 +360,37 @@ var AgentToolsFactory = class {
 				getConfig: () => this.deps.getConfig?.(),
 				startWorkflowRun: this.deps.getWorkflowRunService ? (params) => this.deps.getWorkflowRunService().startWorkflowRun(params) : void 0
 			})] : [],
-			...[],
+			...primary ? [createDelegateTool({
+				workspace,
+				getSubagentModel: () => {
+					const m = (options?.getPrimaryModel ?? this.deps.getPrimaryModel)?.();
+					if (!m) throw new Error("No primary model configured for delegate_task");
+					return m;
+				},
+				bus: this.deps.bus,
+				getConfig: () => this.deps.getConfig?.(),
+				getCurrentContext: () => this.deps.getCurrentContext?.() ?? null,
+				toolExecutorConfig: this.deps.toolExecutorConfig,
+				buildChildTools: (childOpts) => {
+					return new AgentToolsFactory({
+						workspace: childOpts.workspace,
+						bus: childOpts.bus,
+						getCurrentContext: () => null,
+						getConfig: childOpts.getConfig,
+						getPrimaryModel: () => childOpts.model,
+						toolExecutorConfig: childOpts.toolExecutorConfig
+					}).createAllTools({
+						workspace: childOpts.workspace,
+						getPrimaryModel: () => childOpts.model,
+						agentId: options?.agentId ?? childOpts.agentId,
+						disabledTools: new Set([
+							EXTERNAL_TOOL_NAMES.search,
+							EXTERNAL_TOOL_NAMES.describe,
+							EXTERNAL_TOOL_NAMES.execute
+						])
+					});
+				}
+			})] : [],
 			...optionalTools
 		], disabled);
 	}

package/dist/src/agent/tools/find.d.ts

@@ -1,17 +1,14 @@
+import { type Static } from '@sinclair/typebox';
 import type { AgentTool } from '@earendil-works/pi-agent-core';
-import { type TruncationResult } from './truncate.js';
-export type FindToolInput = {
-    pattern: string;
-    path?: string;
-    limit?: number;
-};
+declare const findSchema: import("@sinclair/typebox").TObject<{
+    pattern: import("@sinclair/typebox").TString;
+    path: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    limit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+}>;
 export interface FindToolDetails {
-    truncation?: TruncationResult;
-    resultLimitReached?: number;
+    truncated: boolean;
 }
-/**
- * Find tool - Search for files by glob pattern
- */
+export type FindToolInput = Static<typeof findSchema>;
 export declare function createFindTool(cwd: string): AgentTool;
-/** Default find tool using process.cwd() */
-export declare const findTool: AgentTool;
+export declare const findTool: AgentTool<import("typebox").TSchema, any>;
+export {};

package/dist/src/agent/tools/find.js

@@ -1,97 +1,50 @@
-import { DEFAULT_MAX_BYTES, formatSize, truncateHead } from "./truncate.js";
+import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
 import { resolveToCwd } from "../../utils/helpers.js";
-import path from "path";
-import { existsSync } from "fs";
+import { repositorySearch } from "./repository-search.js";
 import { Type } from "@sinclair/typebox";
-import { globSync } from "glob";
 //#region src/agent/tools/find.ts
 const findSchema = Type.Object({
-	pattern: Type.String({ description: "Glob pattern to match files, e.g. '*.ts', '**/*.json', or 'src/**/*.spec.ts'" }),
-	path: Type.Optional(Type.String({ description: "Directory to search in (default: current directory)" })),
-	limit: Type.Optional(Type.Number({ description: "Maximum number of results (default: 1000)" }))
+	pattern: Type.String({ description: "Glob pattern, e.g. *.ts or src/**/*.json" }),
+	path: Type.Optional(Type.String()),
+	limit: Type.Optional(Type.Integer({
+		minimum: 1,
+		maximum: 1e4
+	}))
 });
-const DEFAULT_LIMIT = 1e3;
-/**
-* Find tool - Search for files by glob pattern
-*/
 function createFindTool(cwd) {
 	return {
 		name: "find",
-		label: "📁 find",
-		description: "Find files by glob pattern (e.g., *.ts, **/*.json).",
+		label: "Find files",
 		parameters: findSchema,
+		description: "Find files by glob with ripgrep; respects .gitignore and skips .git and node_modules. Results are relative to the search directory.",
 		supportsParallel: true,
 		idempotent: true,
-		execute: async (_toolCallId, params, signal) => {
-			try {
-				const p = params;
-				const searchPath = resolveToCwd(p.path || ".", cwd);
-				const effectiveLimit = p.limit || DEFAULT_LIMIT;
-				if (!existsSync(searchPath)) return {
-					content: [{
-						type: "text",
-						text: `Error: Path not found: ${searchPath}`
-					}],
-					details: {}
-				};
-				if (signal?.aborted) return {
-					content: [{
-						type: "text",
-						text: "Operation aborted"
-					}],
-					details: {}
-				};
-				const filePaths = globSync(p.pattern, {
-					cwd: searchPath,
-					dot: true,
-					ignore: ["**/node_modules/**", "**/.git/**"]
-				});
-				if (filePaths.length === 0) return {
-					content: [{
-						type: "text",
-						text: "No files found matching pattern"
-					}],
-					details: {}
-				};
-				const relativized = filePaths.map((p) => {
-					if (p.startsWith(searchPath)) return p.slice(searchPath.length + 1);
-					return path.relative(searchPath, p);
-				});
-				relativized.sort();
-				const resultLimitReached = relativized.length >= effectiveLimit;
-				const truncation = truncateHead((resultLimitReached ? relativized.slice(0, effectiveLimit) : relativized).join("\n"), { maxLines: Number.MAX_SAFE_INTEGER });
-				let resultOutput = truncation.content;
-				const details = {};
-				const notices = [];
-				if (resultLimitReached) {
-					notices.push(`${effectiveLimit} results limit reached`);
-					details.resultLimitReached = effectiveLimit;
-				}
-				if (truncation.truncated) {
-					notices.push(`${formatSize(DEFAULT_MAX_BYTES)} limit reached`);
-					details.truncation = truncation;
-				}
-				if (notices.length > 0) resultOutput += `\n\n[${notices.join(". ")}]`;
-				return {
-					content: [{
-						type: "text",
-						text: resultOutput
-					}],
-					details: Object.keys(details).length > 0 ? details : void 0
-				};
-			} catch (error) {
-				return {
-					content: [{
-						type: "text",
-						text: `Error during find: ${error instanceof Error ? error.message : String(error)}`
-					}],
-					details: {}
-				};
-			}
+		async execute(_id, params, signal) {
+			const path = resolveToCwd(params.path || ".", cwd);
+			const policy = evaluateFilePolicy({
+				operation: "read",
+				path,
+				workspaceRoot: cwd
+			});
+			if (!policy.allowed) throw new Error(policy.reason);
+			const result = await repositorySearch(path, [
+				"--files",
+				"--glob",
+				params.pattern
+			], signal);
+			const limit = Math.min(1e4, Math.max(1, params.limit ?? 1e3));
+			const lines = result.output.trimEnd().split("\n").filter(Boolean).sort();
+			const truncated = result.truncated || lines.length > limit;
+			return {
+				content: [{
+					type: "text",
+					text: (lines.slice(0, limit).join("\n") || "No files found matching pattern") + (truncated ? "\n[Results truncated; narrow the glob.]" : "")
+				}],
+				details: { truncated }
+			};
 		}
 	};
 }
-/** Default find tool using process.cwd() */
 const findTool = createFindTool(process.cwd());
 //#endregion
 export { createFindTool, findTool };

package/dist/src/agent/tools/grep.d.ts

@@ -1,22 +1,18 @@
+import { type Static } from '@sinclair/typebox';
 import type { AgentTool } from '@earendil-works/pi-agent-core';
-import { type TruncationResult } from './truncate.js';
-export type GrepToolInput = {
-    pattern: string;
-    path?: string;
-    glob?: string;
-    ignoreCase?: boolean;
-    literal?: boolean;
-    context?: number;
-    limit?: number;
-};
+declare const grepSchema: import("@sinclair/typebox").TObject<{
+    pattern: import("@sinclair/typebox").TString;
+    path: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    glob: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    ignoreCase: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+    literal: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+    context: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+    limit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+}>;
 export interface GrepToolDetails {
-    truncation?: TruncationResult;
-    matchLimitReached?: number;
-    linesTruncated?: boolean;
+    truncated: boolean;
 }
-/**
- * Grep tool - Search file contents for a pattern
- */
+export type GrepToolInput = Static<typeof grepSchema>;
 export declare function createGrepTool(cwd: string): AgentTool;
-/** Default grep tool using process.cwd() */
-export declare const grepTool: AgentTool;
+export declare const grepTool: AgentTool<import("typebox").TSchema, any>;
+export {};