autohand-cli 0.8.3 → 0.9.1

package/dist/{chunk-K2C56QGS.cjs → chunk-D546G7DA.cjs}

@@ -1,34 +1,53 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class; var _class2; var _class3;
 
-var _chunkMERYP6AMcjs = require('./chunk-MERYP6AM.cjs');
+var _chunkHXQREVTAcjs = require('./chunk-HXQREVTA.cjs');
+
+
+var _chunkNQZH5CR2cjs = require('./chunk-NQZH5CR2.cjs');
 
 
 var _chunk4JNNTOGFcjs = require('./chunk-4JNNTOGF.cjs');
 
 
+var _chunkW5QLA6WPcjs = require('./chunk-W5QLA6WP.cjs');
+
+
+
+
+var _chunkJ5HE6CUMcjs = require('./chunk-J5HE6CUM.cjs');
+
+
+var _chunkWTB7AFL6cjs = require('./chunk-WTB7AFL6.cjs');
+
+
+var _chunkWBU4Q4GScjs = require('./chunk-WBU4Q4GS.cjs');
+
+
+var _chunkLFDPTJYFcjs = require('./chunk-LFDPTJYF.cjs');
+
 
 
+var _chunkWJYFLQ7Gcjs = require('./chunk-WJYFLQ7G.cjs');
 
 
-var _chunkRKJTGGMUcjs = require('./chunk-RKJTGGMU.cjs');
 
 
 
-var _chunkZYQMLKOKcjs = require('./chunk-ZYQMLKOK.cjs');
 
+var _chunkWKRDBCP2cjs = require('./chunk-WKRDBCP2.cjs');
 
 
 
-var _chunkU55TWFJIcjs = require('./chunk-U55TWFJI.cjs');
+var _chunkCK4HAHVYcjs = require('./chunk-CK4HAHVY.cjs');
 
 
-var _chunkSEKD5FH3cjs = require('./chunk-SEKD5FH3.cjs');
 
 
-var _chunkULQ6MDSJcjs = require('./chunk-ULQ6MDSJ.cjs');
+var _chunk2VHB43IXcjs = require('./chunk-2VHB43IX.cjs');
 
 
-var _chunkLJFUXC56cjs = require('./chunk-LJFUXC56.cjs');
+
+var _chunkKASXKDF2cjs = require('./chunk-KASXKDF2.cjs');
 
 // src/core/actionExecutor.ts
 var _chalk = require('chalk'); var _chalk2 = _interopRequireDefault(_chalk);
@@ -515,8 +534,8 @@ function tokenize(code, language) {
   return tokens;
 }
 function colorToken(token) {
-  if (_chunkU55TWFJIcjs.isThemeInitialized.call(void 0, )) {
-    const theme = _chunkU55TWFJIcjs.getTheme.call(void 0, );
+  if (_chunk2VHB43IXcjs.isThemeInitialized.call(void 0, )) {
+    const theme = _chunk2VHB43IXcjs.getTheme.call(void 0, );
     switch (token.type) {
       case "keyword":
         return theme.fg("syntaxKeyword", token.value);
@@ -596,88 +615,6 @@ async function removeDependency(cwd, name, options = {}) {
   }
 }
 
-// src/actions/command.ts
-var _child_process = require('child_process');
-
-function runCommand(cmd, args, cwd, options = {}) {
-  if (!cmd || typeof cmd !== "string") {
-    return Promise.reject(new Error("Command is required and must be a string"));
-  }
-  return new Promise((resolve, reject) => {
-    const workDir = options.directory ? _path.join.call(void 0, cwd, options.directory) : cwd;
-    const spawnOptions = {
-      cwd: workDir,
-      shell: _nullishCoalesce(options.shell, () => ( false)),
-      env: {
-        ...process.env,
-        AUTOHAND_CLI: "1",
-        ...options.env
-      }
-    };
-    if (options.background) {
-      spawnOptions.detached = true;
-      spawnOptions.stdio = ["ignore", "pipe", "pipe"];
-    }
-    let child;
-    try {
-      child = _child_process.spawn.call(void 0, cmd, args, spawnOptions);
-    } catch (error) {
-      const err = error;
-      if (err.code === "ENOENT") {
-        reject(new Error(`Command not found: ${cmd}`));
-      } else {
-        reject(error);
-      }
-      return;
-    }
-    if (options.background) {
-      child.unref();
-      resolve({
-        stdout: "",
-        stderr: "",
-        code: null,
-        backgroundPid: child.pid,
-        signal: null
-      });
-      return;
-    }
-    let stdout = "";
-    let stderr = "";
-    let timeoutId;
-    if (options.timeout && options.timeout > 0) {
-      timeoutId = setTimeout(() => {
-        child.kill("SIGTERM");
-      }, options.timeout);
-    }
-    _optionalChain([child, 'access', _ => _.stdout, 'optionalAccess', _2 => _2.on, 'call', _3 => _3("data", (chunk) => {
-      const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-      stdout += text;
-      _optionalChain([options, 'access', _4 => _4.onStdout, 'optionalCall', _5 => _5(text)]);
-    })]);
-    _optionalChain([child, 'access', _6 => _6.stderr, 'optionalAccess', _7 => _7.on, 'call', _8 => _8("data", (chunk) => {
-      const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-      stderr += text;
-      _optionalChain([options, 'access', _9 => _9.onStderr, 'optionalCall', _10 => _10(text)]);
-    })]);
-    child.once("error", (error) => {
-      if (timeoutId) clearTimeout(timeoutId);
-      if (error.code === "ENOENT") {
-        reject(new Error(`Command not found: ${cmd}`));
-      } else {
-        reject(error);
-      }
-    });
-    child.once("close", (code, signal) => {
-      if (timeoutId) clearTimeout(timeoutId);
-      resolve({ stdout, stderr, code, signal });
-    });
-  });
-}
-var SHELL_PATTERN = /[|><;&`]|\$[({A-Za-z_]|&&|\|\||[*?](?![\w./-]*$)/;
-function needsShell(cmd) {
-  return SHELL_PATTERN.test(cmd);
-}
-
 // src/actions/metadata.ts
 var _crypto = require('crypto'); var _crypto2 = _interopRequireDefault(_crypto);
 
@@ -688,12 +625,7 @@ async function listDirectoryTree(root, options = {}) {
   const maxEntries = _nullishCoalesce(options.maxEntries, () => ( 200));
   const workspaceRoot = _nullishCoalesce(options.workspaceRoot, () => ( root));
   const result = [];
-  const resolvedRoot = _path2.default.resolve(root);
-  const resolvedWorkspace = _path2.default.resolve(workspaceRoot);
-  if (!resolvedRoot.startsWith(resolvedWorkspace)) {
-    throw new Error(`Path ${root} is outside the workspace root.`);
-  }
-  const ignoreFilter = new (0, _chunkLJFUXC56cjs.GitIgnoreParser)(workspaceRoot);
+  const ignoreFilter = new (0, _chunkHXQREVTAcjs.GitIgnoreParser)(workspaceRoot);
   async function walk(current, prefix, currentDepth) {
     if (result.length >= maxEntries) {
       return;
@@ -759,7 +691,7 @@ async function checksumFile(root, relativePath, algorithm = "sha256") {
 }
 
 // src/actions/git.ts
-
+var _child_process = require('child_process');
 var GIT_SAFETY = {
   /** Branches where force push is blocked */
   PROTECTED_BRANCHES: ["main", "master", "develop", "production", "staging"],
@@ -768,7 +700,7 @@ var GIT_SAFETY = {
 };
 function getCurrentBranch(cwd) {
   const result = _child_process.spawnSync.call(void 0, "git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd, encoding: "utf8" });
-  return _optionalChain([result, 'access', _11 => _11.stdout, 'optionalAccess', _12 => _12.trim, 'call', _13 => _13()]) || "";
+  return _optionalChain([result, 'access', _ => _.stdout, 'optionalAccess', _2 => _2.trim, 'call', _3 => _3()]) || "";
 }
 function getCommitsAhead(cwd, remote = "origin", branch) {
   const currentBranch = branch || getCurrentBranch(cwd);
@@ -777,7 +709,7 @@ function getCommitsAhead(cwd, remote = "origin", branch) {
     cwd,
     encoding: "utf8"
   });
-  return parseInt(_optionalChain([result, 'access', _14 => _14.stdout, 'optionalAccess', _15 => _15.trim, 'call', _16 => _16()]) || "0", 10) || 0;
+  return parseInt(_optionalChain([result, 'access', _4 => _4.stdout, 'optionalAccess', _5 => _5.trim, 'call', _6 => _6()]) || "0", 10) || 0;
 }
 function applyGitPatch(cwd, patch) {
   const result = _child_process.spawnSync.call(void 0, "git", ["apply", "-"], {
@@ -797,6 +729,13 @@ function diffFile(cwd, file) {
   }
   return result.stdout || "No diff";
 }
+function diffWorkspace(cwd) {
+  const result = _child_process.spawnSync.call(void 0, "git", ["diff"], { cwd, encoding: "utf8" });
+  if (result.status !== 0) {
+    throw new Error(result.stderr || "git diff failed");
+  }
+  return result.stdout || "No diff";
+}
 function checkoutFile(cwd, file) {
   const result = _child_process.spawnSync.call(void 0, "git", ["checkout", "--", file], { cwd, encoding: "utf8" });
   if (result.status !== 0) {
@@ -833,7 +772,7 @@ function gitDiffRange(cwd, options = {}) {
   if (options.range) {
     args.push(options.range);
   }
-  if (_optionalChain([options, 'access', _17 => _17.paths, 'optionalAccess', _18 => _18.length])) {
+  if (_optionalChain([options, 'access', _7 => _7.paths, 'optionalAccess', _8 => _8.length])) {
     args.push("--", ...options.paths);
   }
   const result = _child_process.spawnSync.call(void 0, "git", args, { cwd, encoding: "utf8" });
@@ -1132,7 +1071,7 @@ function getAutoCommitInfo(cwd) {
       diffSummary: ""
     };
   }
-  const changes = _optionalChain([statusResult, 'access', _19 => _19.stdout, 'optionalAccess', _20 => _20.trim, 'call', _21 => _21(), 'access', _22 => _22.split, 'call', _23 => _23("\n"), 'access', _24 => _24.filter, 'call', _25 => _25(Boolean)]) || [];
+  const changes = _optionalChain([statusResult, 'access', _9 => _9.stdout, 'optionalAccess', _10 => _10.trim, 'call', _11 => _11(), 'access', _12 => _12.split, 'call', _13 => _13("\n"), 'access', _14 => _14.filter, 'call', _15 => _15(Boolean)]) || [];
   if (changes.length === 0) {
     return {
       canCommit: false,
@@ -1160,7 +1099,7 @@ function getAutoCommitInfo(cwd) {
     }
   }
   const diffStatResult = _child_process.spawnSync.call(void 0, "git", ["diff", "--stat", "HEAD"], { cwd, encoding: "utf8" });
-  const diffSummary = _optionalChain([diffStatResult, 'access', _26 => _26.stdout, 'optionalAccess', _27 => _27.trim, 'call', _28 => _28()]) || "";
+  const diffSummary = _optionalChain([diffStatResult, 'access', _16 => _16.stdout, 'optionalAccess', _17 => _17.trim, 'call', _18 => _18()]) || "";
   const suggestedMessage = generateCommitMessage(added, modified, deleted, renamed);
   return {
     canCommit: true,
@@ -1215,7 +1154,7 @@ function generateCommitMessage(added, modified, deleted, renamed) {
 }
 function executeAutoCommit(cwd, message, stageAll = true) {
   const statusResult = _child_process.spawnSync.call(void 0, "git", ["status", "--porcelain"], { cwd, encoding: "utf8" });
-  const changes = _optionalChain([statusResult, 'access', _29 => _29.stdout, 'optionalAccess', _30 => _30.trim, 'call', _31 => _31(), 'access', _32 => _32.split, 'call', _33 => _33("\n"), 'access', _34 => _34.filter, 'call', _35 => _35(Boolean)]) || [];
+  const changes = _optionalChain([statusResult, 'access', _19 => _19.stdout, 'optionalAccess', _20 => _20.trim, 'call', _21 => _21(), 'access', _22 => _22.split, 'call', _23 => _23("\n"), 'access', _24 => _24.filter, 'call', _25 => _25(Boolean)]) || [];
   if (stageAll) {
     const addResult = _child_process.spawnSync.call(void 0, "git", ["add", "-A"], { cwd, encoding: "utf8" });
     if (addResult.status !== 0) {
@@ -1235,7 +1174,7 @@ function executeAutoCommit(cwd, message, stageAll = true) {
     };
   }
   const hashResult = _child_process.spawnSync.call(void 0, "git", ["rev-parse", "--short", "HEAD"], { cwd, encoding: "utf8" });
-  const commitHash = _optionalChain([hashResult, 'access', _36 => _36.stdout, 'optionalAccess', _37 => _37.trim, 'call', _38 => _38()]);
+  const commitHash = _optionalChain([hashResult, 'access', _26 => _26.stdout, 'optionalAccess', _27 => _27.trim, 'call', _28 => _28()]);
   return {
     success: true,
     message: `Committed ${changes.length} file(s): ${commitHash}`,
@@ -1363,6 +1302,9 @@ var DEFAULT_TEMPLATES = [
   }
 ];
 var WorktreeManager = class {
+  
+  
+  
   constructor(cwd) {
     this.repoRoot = this.findGitRoot(cwd);
     this.repoName = _path2.default.basename(this.repoRoot);
@@ -1446,7 +1388,7 @@ var WorktreeManager = class {
     if (result.status !== 0) {
       throw new Error(result.stderr || "Failed to create worktree");
     }
-    if (_optionalChain([template, 'optionalAccess', _39 => _39.setupCommands]) && options.runSetup !== false) {
+    if (_optionalChain([template, 'optionalAccess', _29 => _29.setupCommands]) && options.runSetup !== false) {
       for (const cmd of template.setupCommands) {
         await this.runInWorktree(worktreePath, cmd);
       }
@@ -1460,7 +1402,7 @@ var WorktreeManager = class {
     const absolutePath = _path2.default.isAbsolute(worktreePath) ? worktreePath : _path2.default.resolve(this.repoRoot, worktreePath);
     const worktrees = this.list();
     const wt = worktrees.find((w) => w.path === absolutePath);
-    const branchToDelete = _optionalChain([wt, 'optionalAccess', _40 => _40.branch]);
+    const branchToDelete = _optionalChain([wt, 'optionalAccess', _30 => _30.branch]);
     const args = ["worktree", "remove"];
     if (options.force) {
       args.push("--force");
@@ -1825,10 +1767,96 @@ var WorktreeManager = class {
   }
 };
 
+// src/actions/notebook.ts
+function createNotebookCell(cellType, source) {
+  if (cellType === "code") {
+    return {
+      cell_type: "code",
+      source,
+      metadata: {},
+      outputs: [],
+      execution_count: null
+    };
+  }
+  return {
+    cell_type: "markdown",
+    source,
+    metadata: {}
+  };
+}
+function resolveCellIndex(notebook, input) {
+  if (typeof input.cell_index === "number") {
+    return input.cell_index;
+  }
+  if (input.cell_id) {
+    const index = notebook.cells.findIndex((cell) => cell.id === input.cell_id);
+    if (index === -1) {
+      throw new Error(`Notebook cell "${input.cell_id}" not found.`);
+    }
+    return index;
+  }
+  return -1;
+}
+function applyNotebookEdit(rawContent, input) {
+  if (!input.path.endsWith(".ipynb")) {
+    throw new Error("notebook_edit only supports .ipynb files.");
+  }
+  let notebook;
+  try {
+    notebook = JSON.parse(rawContent);
+  } catch (e7) {
+    throw new Error(`Notebook ${input.path} is not valid JSON.`);
+  }
+  if (!Array.isArray(notebook.cells)) {
+    throw new Error(`Notebook ${input.path} does not contain a valid cells array.`);
+  }
+  const editMode = _nullishCoalesce(input.edit_mode, () => ( "replace"));
+  const index = resolveCellIndex(notebook, input);
+  if (editMode === "insert") {
+    if (!input.cell_type) {
+      throw new Error('notebook_edit insert requires "cell_type".');
+    }
+    if (typeof input.new_source !== "string") {
+      throw new Error('notebook_edit insert requires "new_source".');
+    }
+    const insertAt = index >= 0 ? index + 1 : notebook.cells.length;
+    notebook.cells.splice(insertAt, 0, createNotebookCell(input.cell_type, input.new_source));
+    return {
+      updated: `${JSON.stringify(notebook, null, 2)}
+`,
+      summary: `Inserted notebook cell at index ${insertAt} in ${input.path}.`
+    };
+  }
+  if (index < 0 || index >= notebook.cells.length) {
+    throw new Error('notebook_edit requires a valid "cell_index" or "cell_id".');
+  }
+  if (editMode === "delete") {
+    notebook.cells.splice(index, 1);
+    return {
+      updated: `${JSON.stringify(notebook, null, 2)}
+`,
+      summary: `Deleted notebook cell ${index} in ${input.path}.`
+    };
+  }
+  if (typeof input.new_source !== "string") {
+    throw new Error('notebook_edit replace requires "new_source".');
+  }
+  const target = notebook.cells[index];
+  target.source = input.new_source;
+  if (input.cell_type) {
+    target.cell_type = input.cell_type;
+  }
+  return {
+    updated: `${JSON.stringify(notebook, null, 2)}
+`,
+    summary: `Updated notebook cell ${index} in ${input.path}.`
+  };
+}
+
 // src/core/customCommands.ts
 
 
-var COMMANDS_DIR = _chunkSEKD5FH3cjs.AUTOHAND_PATHS.commands;
+var COMMANDS_DIR = _chunkKASXKDF2cjs.AUTOHAND_PATHS.commands;
 async function loadCustomCommand(name) {
   const filePath = _path2.default.join(COMMANDS_DIR, `${sanitizeName(name)}.json`);
   if (!await _fsextra2.default.pathExists(filePath)) {
@@ -1968,7 +1996,7 @@ async function fetchGitHubInfo(parsed) {
     stars: data.stargazers_count,
     language: data.language,
     defaultBranch: data.default_branch,
-    license: _optionalChain([data, 'access', _41 => _41.license, 'optionalAccess', _42 => _42.spdx_id]) || null
+    license: _optionalChain([data, 'access', _31 => _31.license, 'optionalAccess', _32 => _32.spdx_id]) || null
   };
 }
 async function fetchGitLabInfo(parsed) {
@@ -2220,7 +2248,7 @@ async function runGh(args) {
         return;
       }
       const error = err;
-      if (error.code === "ENOENT" || _optionalChain([error, 'access', _43 => _43.message, 'optionalAccess', _44 => _44.includes, 'call', _45 => _45("command not found")])) {
+      if (error.code === "ENOENT" || _optionalChain([error, 'access', _33 => _33.message, 'optionalAccess', _34 => _34.includes, 'call', _35 => _35("command not found")])) {
         reject(new Error("gh CLI is not installed. Install it from https://cli.github.com"));
         return;
       }
@@ -2308,14 +2336,139 @@ async function getUser() {
 
 // src/core/toolsRegistry.ts
 
+var _promises = require('fs/promises'); var _promises2 = _interopRequireDefault(_promises);
 
-var ToolsRegistry = class {
-  constructor(toolsDir = _chunkSEKD5FH3cjs.AUTOHAND_PATHS.tools) {
-    this.toolsDir = toolsDir;
-    this.metaToolCache = /* @__PURE__ */ new Map();
+
+// src/core/metaTools/schema.ts
+
+var _zod = require('zod');
+var META_TOOL_SCHEMA_VERSION = 1;
+var META_TOOL_NAME_PATTERN = /^[a-z][a-z0-9_]*$/;
+var META_TOOL_SCOPES = ["user", "project"];
+var JsonSchemaObject = _zod.z.record(_zod.z.string(), _zod.z.unknown()).refine((value) => value.type === "object", 'parameters must be a JSON Schema object with type "object"');
+var MetaToolCreateInputSchema = _zod.z.object({
+  name: _zod.z.string().trim().regex(META_TOOL_NAME_PATTERN, "name must be snake_case and start with a lowercase letter"),
+  description: _zod.z.string().trim().min(1).max(300),
+  parameters: JsonSchemaObject,
+  handler: _zod.z.string().trim().min(1).max(2e3),
+  source: _zod.z.enum(["agent", "user"]).default("agent"),
+  scope: _zod.z.enum(META_TOOL_SCOPES).default("user")
+});
+var MetaToolDefinitionSchema = MetaToolCreateInputSchema.extend({
+  schemaVersion: _zod.z.literal(META_TOOL_SCHEMA_VERSION),
+  createdAt: _zod.z.string().min(1),
+  updatedAt: _zod.z.string().min(1).optional(),
+  fingerprint: _zod.z.string().min(16),
+  disabled: _zod.z.boolean().optional()
+});
+function canonicalize(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalize).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalize(record[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function fingerprintMetaTool(input) {
+  return _crypto.createHash.call(void 0, "sha256").update(canonicalize({
+    name: input.name,
+    description: input.description,
+    parameters: input.parameters,
+    handler: input.handler
+  })).digest("hex");
+}
+function normalizeMetaToolDefinition(candidate) {
+  if (!candidate || typeof candidate !== "object") {
+    return null;
   }
+  const value = candidate;
+  const source = value.source === "user" ? "user" : "agent";
+  const scope = value.scope === "project" ? "project" : "user";
+  const definition = {
+    ...value,
+    schemaVersion: _nullishCoalesce(value.schemaVersion, () => ( META_TOOL_SCHEMA_VERSION)),
+    source,
+    scope,
+    createdAt: typeof value.createdAt === "string" ? value.createdAt : (/* @__PURE__ */ new Date(0)).toISOString()
+  };
+  const parsedCreateInput = MetaToolCreateInputSchema.safeParse(definition);
+  if (!parsedCreateInput.success) {
+    return null;
+  }
+  const parsed = MetaToolDefinitionSchema.safeParse({
+    ...definition,
+    fingerprint: typeof value.fingerprint === "string" ? value.fingerprint : fingerprintMetaTool(parsedCreateInput.data)
+  });
+  return parsed.success ? parsed.data : null;
+}
+
+// src/core/metaTools/safety.ts
+var DANGEROUS_PATTERNS = [
+  { pattern: /rm\s+(-[rf]+\s+)*\/(?!\w)/i, description: "rm with root path" },
+  { pattern: /rm\s+.*--no-preserve-root/i, description: "rm --no-preserve-root" },
+  { pattern: /dd\s+.*(?:of|if)=\/dev\/[sh]d/i, description: "dd to disk device" },
+  { pattern: /mkfs\./i, description: "filesystem format" },
+  { pattern: /wipefs/i, description: "disk wipe" },
+  { pattern: /\bsudo\s/i, description: "sudo command" },
+  { pattern: /\bsu\s+-?\s*\w/i, description: "su command" },
+  { pattern: /chmod\s+[0-7]*7[0-7]*/i, description: "world-writable chmod" },
+  { pattern: /chown\s+root/i, description: "chown to root" },
+  { pattern: /curl\s+.*\|\s*(ba)?sh/i, description: "curl | bash" },
+  { pattern: /wget\s+.*\|\s*(ba)?sh/i, description: "wget | sh" },
+  { pattern: /\beval\s+[`$]/i, description: "eval with expansion" },
+  { pattern: /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/i, description: "fork bomb" },
+  { pattern: /while\s+true.*do.*done/i, description: "infinite loop" },
+  { pattern: /nc\s+.*-e\s*\/bin/i, description: "netcat reverse shell" },
+  { pattern: /ncat\s+.*-e\s*\/bin/i, description: "ncat reverse shell" },
+  { pattern: /bash\s+-i\s+>&?\s*\/dev\/tcp/i, description: "bash reverse shell" },
+  { pattern: /iptables\s+-F/i, description: "flush firewall rules" },
+  { pattern: /gpg\s+.*--encrypt.*-r\s+\S+\s+\//i, description: "gpg encrypt root" }
+];
+function assertSafeMetaToolHandler(handler) {
+  for (const { pattern, description } of DANGEROUS_PATTERNS) {
+    if (pattern.test(handler)) {
+      throw new Error(`Handler contains dangerous pattern: ${description}`);
+    }
+  }
+}
+
+// src/core/toolsRegistry.ts
+function locationKey(scope, name) {
+  return `${scope}:${name}`;
+}
+function normalizeLocations(input) {
+  if (Array.isArray(input)) {
+    return input;
+  }
+  return [{ scope: "user", dir: _nullishCoalesce(input, () => ( _chunkKASXKDF2cjs.AUTOHAND_PATHS.tools)) }];
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function createToolsRegistry(workspaceRoot, userToolsDir = _chunkKASXKDF2cjs.AUTOHAND_PATHS.tools) {
+  const locations = workspaceRoot ? [
+    { scope: "project", dir: _path2.default.join(workspaceRoot, _chunkKASXKDF2cjs.PROJECT_DIR_NAME, "tools") },
+    { scope: "user", dir: userToolsDir }
+  ] : [{ scope: "user", dir: userToolsDir }];
+  return new ToolsRegistry(locations);
+}
+var ToolsRegistry = (_class = class {
+  __init() {this.metaToolCache = /* @__PURE__ */ new Map()}
+  __init2() {this.metaToolRecords = /* @__PURE__ */ new Map()}
+  __init3() {this.diagnostics = []}
+  constructor(locations) {;_class.prototype.__init.call(this);_class.prototype.__init2.call(this);_class.prototype.__init3.call(this);
+    this.locations = normalizeLocations(locations);
+  }
+  
   async initialize() {
-    await _fsextra2.default.ensureDir(this.toolsDir);
+    this.metaToolCache.clear();
+    this.metaToolRecords.clear();
+    this.diagnostics = [];
+    for (const location of this.locations) {
+      await _fsextra2.default.ensureDir(location.dir);
+    }
     await this.loadMetaToolDefinitions();
   }
   async listTools(builtIns) {
@@ -2341,20 +2494,41 @@ var ToolsRegistry = class {
       entries.push({
         name: tool.name,
         description: tool.description,
-        source: "meta"
+        source: "meta",
+        scope: tool.scope,
+        disabled: tool.disabled,
+        createdAt: tool.createdAt,
+        schemaVersion: tool.schemaVersion,
+        handlerPreview: tool.handler.length > 140 ? `${tool.handler.slice(0, 137)}...` : tool.handler,
+        reuseHint: `Use ${tool.name} instead of creating another tool for: ${tool.description}`
       });
       seen.add(name);
     }
     return entries;
   }
   async saveMetaTool(definition) {
-    const fullDef = {
-      ...definition,
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    const filePath = _path2.default.join(this.toolsDir, `${definition.name}.json`);
-    await _fsextra2.default.writeJson(filePath, fullDef, { spaces: 2 });
-    this.metaToolCache.set(definition.name, fullDef);
+    const fullDef = normalizeMetaToolDefinition(definition);
+    if (!fullDef) {
+      throw new Error(`Invalid meta-tool definition for "${definition.name}"`);
+    }
+    assertSafeMetaToolHandler(fullDef.handler);
+    const location = this.getLocationForScope(fullDef.scope);
+    const filePath = _path2.default.join(location.dir, `${fullDef.name}.json`);
+    const release = await this.acquireLock(location.dir, fullDef.name);
+    try {
+      const existing = await this.readDefinition(filePath);
+      if (existing) {
+        if (existing.fingerprint === fullDef.fingerprint) {
+          this.upsertRecord(existing, filePath);
+          return existing;
+        }
+        throw new Error(`Meta-tool "${fullDef.name}" already exists in ${fullDef.scope} scope`);
+      }
+      await this.writeDefinition(filePath, fullDef);
+    } finally {
+      await release();
+    }
+    this.upsertRecord(fullDef, filePath);
     return fullDef;
   }
   getMetaTool(name) {
@@ -2366,6 +2540,71 @@ var ToolsRegistry = class {
   getAllMetaTools() {
     return Array.from(this.metaToolCache.values());
   }
+  listMetaTools(options = {}) {
+    if (!options.includeDisabled) {
+      return this.getAllMetaTools();
+    }
+    return Array.from(this.metaToolRecords.values()).map((record) => record.definition);
+  }
+  getDiagnostics() {
+    return [...this.diagnostics];
+  }
+  async deleteMetaTool(name, scope) {
+    const record = this.findRecord(name, scope);
+    if (!record) {
+      throw new Error(`Meta-tool "${name}" not found`);
+    }
+    await _fsextra2.default.remove(record.filePath);
+    this.deleteRecord(record.definition);
+    return record.definition;
+  }
+  async setMetaToolDisabled(name, disabled, scope) {
+    const record = this.findRecord(name, scope);
+    if (!record) {
+      throw new Error(`Meta-tool "${name}" not found`);
+    }
+    const updated = {
+      ...record.definition,
+      disabled,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await this.writeDefinition(record.filePath, updated);
+    this.upsertRecord(updated, record.filePath);
+    this.rebuildActiveCache();
+    return updated;
+  }
+  async renameMetaTool(name, newName, scope) {
+    if (!META_TOOL_NAME_PATTERN.test(newName)) {
+      throw new Error("new name must be snake_case and start with a lowercase letter");
+    }
+    const record = this.findRecord(name, scope);
+    if (!record) {
+      throw new Error(`Meta-tool "${name}" not found`);
+    }
+    if (this.findRecord(newName)) {
+      throw new Error(`Meta-tool "${newName}" already exists`);
+    }
+    const renamed = {
+      ...record.definition,
+      name: newName,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const normalized = normalizeMetaToolDefinition({
+      ...renamed,
+      fingerprint: fingerprintMetaTool(renamed)
+    });
+    if (!normalized) {
+      throw new Error(`Invalid meta-tool definition for "${newName}"`);
+    }
+    const location = this.getLocationForScope(normalized.scope);
+    const nextFilePath = _path2.default.join(location.dir, `${newName}.json`);
+    await this.writeDefinition(nextFilePath, normalized);
+    await _fsextra2.default.remove(record.filePath);
+    this.deleteRecord(record.definition);
+    this.upsertRecord(normalized, nextFilePath);
+    this.rebuildActiveCache();
+    return normalized;
+  }
   toToolDefinitions() {
     return this.getAllMetaTools().map((tool) => {
       const params = tool.parameters;
@@ -2381,163 +2620,375 @@ var ToolsRegistry = class {
     });
   }
   async loadMetaToolDefinitions() {
-    try {
-      const exists = await _fsextra2.default.pathExists(this.toolsDir);
-      if (!exists) {
-        return;
-      }
-      const files = await _fsextra2.default.readdir(this.toolsDir);
-      for (const file of files) {
-        if (!file.endsWith(".json")) {
+    for (const location of this.locations) {
+      try {
+        const exists = await _fsextra2.default.pathExists(location.dir);
+        if (!exists) {
           continue;
         }
-        const fullPath = _path2.default.join(this.toolsDir, file);
-        try {
-          const data = await _fsextra2.default.readJson(fullPath);
-          if (this.isValidMetaTool(data)) {
-            this.metaToolCache.set(data.name, data);
+        const files = await _fsextra2.default.readdir(location.dir);
+        for (const file of files) {
+          if (!file.endsWith(".json")) {
+            continue;
+          }
+          const fullPath = _path2.default.join(location.dir, file);
+          try {
+            const data = normalizeMetaToolDefinition({
+              ...await _fsextra2.default.readJson(fullPath),
+              scope: location.scope
+            });
+            if (data) {
+              assertSafeMetaToolHandler(data.handler);
+              this.metaToolRecords.set(locationKey(data.scope, data.name), { definition: data, filePath: fullPath });
+            } else {
+              this.diagnostics.push({ file: fullPath, reason: "invalid meta-tool definition" });
+            }
+          } catch (error) {
+            const reason = error instanceof Error ? error.message : "invalid meta-tool file";
+            this.diagnostics.push({ file: fullPath, reason });
           }
-        } catch (e7) {
         }
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : "tools directory could not be read";
+        this.diagnostics.push({ file: location.dir, reason });
       }
-    } catch (e8) {
     }
+    this.rebuildActiveCache();
   }
-  isValidMetaTool(candidate) {
-    if (!candidate || typeof candidate !== "object") {
-      return false;
+  getLocationForScope(scope) {
+    const location = this.locations.find((candidate) => candidate.scope === scope);
+    if (!location) {
+      throw new Error(`No tools directory configured for ${scope} scope`);
     }
-    const value = candidate;
-    return typeof value.name === "string" && typeof value.description === "string" && typeof value.handler === "string" && typeof value.parameters === "object";
+    return location;
   }
-};
+  async readDefinition(filePath) {
+    if (!await _fsextra2.default.pathExists(filePath)) {
+      return null;
+    }
+    return normalizeMetaToolDefinition(await _fsextra2.default.readJson(filePath));
+  }
+  async writeDefinition(filePath, definition) {
+    const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+    try {
+      await _fsextra2.default.ensureDir(_path2.default.dirname(filePath));
+      await _fsextra2.default.outputFile(tempPath, `${JSON.stringify(definition, null, 2)}
+`, { mode: 384 });
+      const handle = await _promises2.default.open(tempPath, "r");
+      try {
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await _promises2.default.rename(tempPath, filePath);
+    } catch (error) {
+      await _fsextra2.default.remove(tempPath).catch(() => {
+      });
+      throw error;
+    }
+  }
+  async acquireLock(dir, name) {
+    await _fsextra2.default.ensureDir(dir);
+    const lockPath = _path2.default.join(dir, `${name}.lock`);
+    for (let attempt = 0; attempt < 40; attempt++) {
+      try {
+        const handle = await _promises2.default.open(lockPath, "wx", 384);
+        await handle.close();
+        return async () => {
+          await _fsextra2.default.remove(lockPath).catch(() => {
+          });
+        };
+      } catch (error) {
+        const code = typeof error === "object" && error && "code" in error ? error.code : void 0;
+        if (code === "EEXIST") {
+          await delay(25);
+          continue;
+        }
+        throw error;
+      }
+    }
+    throw new Error(`Timed out waiting for meta-tool lock "${name}"`);
+  }
+  upsertRecord(definition, filePath) {
+    this.metaToolRecords.set(locationKey(definition.scope, definition.name), { definition, filePath });
+    this.rebuildActiveCache();
+  }
+  deleteRecord(definition) {
+    this.metaToolRecords.delete(locationKey(definition.scope, definition.name));
+    this.rebuildActiveCache();
+  }
+  findRecord(name, scope) {
+    if (scope) {
+      return this.metaToolRecords.get(locationKey(scope, name));
+    }
+    for (const location of this.locations) {
+      const record = this.metaToolRecords.get(locationKey(location.scope, name));
+      if (record) {
+        return record;
+      }
+    }
+    return void 0;
+  }
+  rebuildActiveCache() {
+    this.metaToolCache.clear();
+    for (const location of this.locations) {
+      for (const record of this.metaToolRecords.values()) {
+        if (record.definition.scope !== location.scope || record.definition.disabled) {
+          continue;
+        }
+        if (!this.metaToolCache.has(record.definition.name)) {
+          this.metaToolCache.set(record.definition.name, record.definition);
+        }
+      }
+    }
+  }
+}, _class);
 
-// src/core/SecurityScanner.ts
-var SecurityScanner = class {
-  constructor() {
-    /**
-     * Built-in secret detection patterns
-     */
-    this.patterns = [
-      // AWS
-      {
-        name: "AWS Access Key",
-        regex: /AKIA[0-9A-Z]{16}/,
-        severity: "high",
-        description: "AWS Access Key ID"
-      },
-      // GitHub
-      {
-        name: "GitHub Token",
-        regex: /ghp_[a-zA-Z0-9]{36}/,
-        severity: "high",
-        description: "GitHub Personal Access Token"
-      },
-      {
-        name: "GitHub OAuth",
-        regex: /gho_[a-zA-Z0-9]{36}/,
-        severity: "high",
-        description: "GitHub OAuth Token"
-      },
-      {
-        name: "GitHub App Token",
-        regex: /ghu_[a-zA-Z0-9]{36}/,
-        severity: "high",
-        description: "GitHub App User Token"
-      },
-      // OpenAI / Anthropic
-      {
-        name: "OpenAI Key",
-        regex: /sk-proj-[a-zA-Z0-9]{32,}/,
-        severity: "high",
-        description: "OpenAI Project API Key"
-      },
-      {
-        name: "Anthropic Key",
-        regex: /sk-ant-api[a-zA-Z0-9-]{32,}/,
-        severity: "high",
-        description: "Anthropic API Key"
-      },
-      // Google
-      {
-        name: "Google API Key",
-        regex: /AIzaSy[0-9A-Za-z-_]{33}/,
-        severity: "high",
-        description: "Google API Key"
-      },
-      // Stripe
-      {
-        name: "Stripe Live Key",
-        regex: /sk_live_[0-9a-zA-Z]{24,}/,
-        severity: "high",
-        description: "Stripe Live Secret Key"
-      },
-      {
-        name: "Stripe Test Key",
-        regex: /sk_test_[0-9a-zA-Z]{24,}/,
-        severity: "low",
-        description: "Stripe Test Secret Key"
-      },
-      // Private Keys
-      {
-        name: "Private Key",
-        regex: /-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,
-        severity: "high",
-        description: "Private Key File"
-      },
-      // Database URLs with credentials
-      {
-        name: "Database URL",
-        regex: /(postgres|postgresql|mysql|mongodb|redis):\/\/[^:]+:[^@]+@/,
-        severity: "high",
-        description: "Database URL with credentials"
-      },
-      // JWT Tokens
-      {
-        name: "JWT Token",
-        regex: /eyJ[a-zA-Z0-9]{10,}\.eyJ[a-zA-Z0-9]{10,}\.[a-zA-Z0-9_-]{10,}/,
-        severity: "medium",
-        description: "JSON Web Token"
-      },
-      // Generic patterns (lower priority)
-      {
-        name: "Generic API Key",
-        regex: /[aA][pP][iI][-_]?[kK][eE][yY]\s*[:=]\s*['"][a-zA-Z0-9]{16,}['"]/,
-        severity: "medium",
-        description: "Generic API Key Assignment"
-      },
-      {
-        name: "Generic Secret",
-        regex: /[sS][eE][cC][rR][eE][tT]\s*[:=]\s*['"][^'"]{8,}['"]/,
-        severity: "medium",
-        description: "Generic Secret Assignment"
-      },
-      {
-        name: "Password Assignment",
-        regex: /[pP][aA][sS][sS][wW][oO][rR][dD]\s*[:=]\s*['"][^'"]{4,}['"]/,
-        severity: "medium",
-        description: "Password Assignment"
+// src/core/metaTools/MetaToolService.ts
+var STOP_WORDS = /* @__PURE__ */ new Set([
+  "a",
+  "an",
+  "and",
+  "by",
+  "for",
+  "from",
+  "in",
+  "of",
+  "on",
+  "the",
+  "to",
+  "with",
+  "find",
+  "search",
+  "list",
+  "get",
+  "show",
+  "analyze",
+  "count",
+  "run",
+  "quick",
+  "tool",
+  "tools",
+  "file",
+  "files",
+  "codebase",
+  "workspace",
+  "source",
+  "across"
+]);
+function normalizeHandler(handler) {
+  return handler.trim().replace(/\s+/g, " ");
+}
+function tokenize2(value) {
+  const tokens = value.toLowerCase().split(/[^a-z0-9]+/).map((token) => token.endsWith("s") ? token.slice(0, -1) : token).filter((token) => token.length > 1 && !STOP_WORDS.has(token));
+  return new Set(tokens);
+}
+function overlapRatio(left, right) {
+  if (left.size === 0 || right.size === 0) {
+    return 0;
+  }
+  let intersection = 0;
+  for (const token of left) {
+    if (right.has(token)) {
+      intersection++;
+    }
+  }
+  return intersection / Math.min(left.size, right.size);
+}
+function isSimilarTool(candidate, existing) {
+  const candidateNameTokens = tokenize2(candidate.name);
+  const existingNameTokens = tokenize2(existing.name);
+  if (overlapRatio(candidateNameTokens, existingNameTokens) >= 0.75) {
+    return true;
+  }
+  const candidateDescriptionTokens = tokenize2(candidate.description);
+  const existingDescriptionTokens = tokenize2(_nullishCoalesce(existing.description, () => ( "")));
+  return overlapRatio(candidateDescriptionTokens, existingDescriptionTokens) >= 0.75;
+}
+var MetaToolService = class {
+  constructor(registry) {
+    this.registry = registry;
+  }
+  
+  async createMetaTool(input, registeredTools) {
+    const parsed = MetaToolCreateInputSchema.safeParse(input);
+    if (!parsed.success) {
+      throw new Error(`Invalid meta-tool definition: ${_nullishCoalesce(_optionalChain([parsed, 'access', _36 => _36.error, 'access', _37 => _37.issues, 'access', _38 => _38[0], 'optionalAccess', _39 => _39.message]), () => ( "unknown validation error"))}`);
+    }
+    const definitionInput = parsed.data;
+    assertSafeMetaToolHandler(definitionInput.handler);
+    const fingerprint = fingerprintMetaTool(definitionInput);
+    const existingByName = this.registry.getMetaTool(definitionInput.name);
+    if (existingByName) {
+      if (existingByName.fingerprint === fingerprint) {
+        return {
+          status: "existing",
+          definition: existingByName,
+          message: `Meta-tool "${definitionInput.name}" already exists with the same definition.`
+        };
       }
+      throw new Error(`Cannot create meta-tool "${definitionInput.name}": already exists with a different definition`);
+    }
+    const registeredNameConflict = registeredTools.find((tool) => tool.name === definitionInput.name);
+    if (registeredNameConflict) {
+      throw new Error(`Cannot create meta-tool "${definitionInput.name}": conflicts with existing tool`);
+    }
+    for (const existing of this.registry.getAllMetaTools()) {
+      if (normalizeHandler(existing.handler) === normalizeHandler(definitionInput.handler)) {
+        throw new Error(`Cannot create meta-tool "${definitionInput.name}": same handler already exists as "${existing.name}"`);
+      }
+    }
+    const existingTools = [
+      ...registeredTools,
+      ...this.registry.getAllMetaTools().map((tool) => ({
+        name: tool.name,
+        description: tool.description
+      }))
     ];
-    /**
-     * Placeholder patterns to ignore (false positives)
-     * These must be exact matches or specific patterns, not substrings
-     */
-    this.placeholderPatterns = [
-      /your[-_]?api[-_]?key/i,
-      /your[-_]?secret/i,
-      /\*\*\*/,
-      /\.\.\.$/,
-      /-example/i,
-      /placeholder/i,
-      /sk-xxx$/i,
-      /sk-your/i,
-      /<your[-_]?key[-_]?here>/i,
-      /\$\{[A-Z_]+\}/,
-      // Environment variable placeholders
-      /process\.env\./
-    ];
+    const similar = existingTools.find((tool) => tool.name !== definitionInput.name && isSimilarTool(definitionInput, tool));
+    if (similar) {
+      throw new Error(`Cannot create meta-tool "${definitionInput.name}": similar existing tool "${similar.name}" should be reused`);
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const saved = await this.registry.saveMetaTool({
+      ...definitionInput,
+      schemaVersion: 1,
+      createdAt: now,
+      updatedAt: now,
+      fingerprint
+    });
+    return {
+      status: "created",
+      definition: saved,
+      message: `Created meta-tool "${saved.name}" - available in this and future sessions`
+    };
   }
+};
+
+// src/core/SecurityScanner.ts
+var SecurityScanner = (_class2 = class {constructor() { _class2.prototype.__init4.call(this);_class2.prototype.__init5.call(this); }
+  /**
+   * Built-in secret detection patterns
+   */
+  __init4() {this.patterns = [
+    // AWS
+    {
+      name: "AWS Access Key",
+      regex: /AKIA[0-9A-Z]{16}/,
+      severity: "high",
+      description: "AWS Access Key ID"
+    },
+    // GitHub
+    {
+      name: "GitHub Token",
+      regex: /ghp_[a-zA-Z0-9]{36}/,
+      severity: "high",
+      description: "GitHub Personal Access Token"
+    },
+    {
+      name: "GitHub OAuth",
+      regex: /gho_[a-zA-Z0-9]{36}/,
+      severity: "high",
+      description: "GitHub OAuth Token"
+    },
+    {
+      name: "GitHub App Token",
+      regex: /ghu_[a-zA-Z0-9]{36}/,
+      severity: "high",
+      description: "GitHub App User Token"
+    },
+    // OpenAI / Anthropic
+    {
+      name: "OpenAI Key",
+      regex: /sk-proj-[a-zA-Z0-9]{32,}/,
+      severity: "high",
+      description: "OpenAI Project API Key"
+    },
+    {
+      name: "Anthropic Key",
+      regex: /sk-ant-api[a-zA-Z0-9-]{32,}/,
+      severity: "high",
+      description: "Anthropic API Key"
+    },
+    // Google
+    {
+      name: "Google API Key",
+      regex: /AIzaSy[0-9A-Za-z-_]{33}/,
+      severity: "high",
+      description: "Google API Key"
+    },
+    // Stripe
+    {
+      name: "Stripe Live Key",
+      regex: /sk_live_[0-9a-zA-Z]{24,}/,
+      severity: "high",
+      description: "Stripe Live Secret Key"
+    },
+    {
+      name: "Stripe Test Key",
+      regex: /sk_test_[0-9a-zA-Z]{24,}/,
+      severity: "low",
+      description: "Stripe Test Secret Key"
+    },
+    // Private Keys
+    {
+      name: "Private Key",
+      regex: /-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,
+      severity: "high",
+      description: "Private Key File"
+    },
+    // Database URLs with credentials
+    {
+      name: "Database URL",
+      regex: /(postgres|postgresql|mysql|mongodb|redis):\/\/[^:]+:[^@]+@/,
+      severity: "high",
+      description: "Database URL with credentials"
+    },
+    // JWT Tokens
+    {
+      name: "JWT Token",
+      regex: /eyJ[a-zA-Z0-9]{10,}\.eyJ[a-zA-Z0-9]{10,}\.[a-zA-Z0-9_-]{10,}/,
+      severity: "medium",
+      description: "JSON Web Token"
+    },
+    // Generic patterns (lower priority)
+    {
+      name: "Generic API Key",
+      regex: /[aA][pP][iI][-_]?[kK][eE][yY]\s*[:=]\s*['"][a-zA-Z0-9]{16,}['"]/,
+      severity: "medium",
+      description: "Generic API Key Assignment"
+    },
+    {
+      name: "Generic Secret",
+      regex: /[sS][eE][cC][rR][eE][tT]\s*[:=]\s*['"][^'"]{8,}['"]/,
+      severity: "medium",
+      description: "Generic Secret Assignment"
+    },
+    {
+      name: "Password Assignment",
+      regex: /[pP][aA][sS][sS][wW][oO][rR][dD]\s*[:=]\s*['"][^'"]{4,}['"]/,
+      severity: "medium",
+      description: "Password Assignment"
+    }
+  ]}
+  /**
+   * Placeholder patterns to ignore (false positives)
+   * These must be exact matches or specific patterns, not substrings
+   */
+  __init5() {this.placeholderPatterns = [
+    /your[-_]?api[-_]?key/i,
+    /your[-_]?secret/i,
+    /\*\*\*/,
+    /\.\.\.$/,
+    /-example/i,
+    /placeholder/i,
+    /sk-xxx$/i,
+    /sk-your/i,
+    /<your[-_]?key[-_]?here>/i,
+    /\$\{[A-Z_]+\}/,
+    // Environment variable placeholders
+    /process\.env\./
+  ]}
   /**
    * Scan git diff for secrets
    * @param diff - Git diff output
@@ -2697,7 +3148,9 @@ var SecurityScanner = class {
       lines.push("");
     }
     if (result.blockedCount > 0) {
-      lines.push(`[BLOCKED] ${result.blockedCount} high-severity secrets found`);
+      lines.push(
+        `[BLOCKED] ${result.blockedCount} high-severity secrets found`
+      );
       lines.push("          Remove secrets before committing.");
       lines.push("          Consider using environment variables instead.");
     } else if (result.warningCount > 0) {
@@ -2716,7 +3169,7 @@ var SecurityScanner = class {
     const redacted = secret.slice(0, 4) + "*".repeat(secret.length - 8) + secret.slice(-4);
     return line.replace(secret, redacted);
   }
-};
+}, _class2);
 
 // src/core/actionExecutor.ts
 
@@ -2725,8 +3178,9 @@ var SecurityScanner = class {
 
 
 var PlanFileStorage = class {
+  
   constructor() {
-    this.plansDir = _chunkSEKD5FH3cjs.AUTOHAND_PATHS.plans;
+    this.plansDir = _chunkKASXKDF2cjs.AUTOHAND_PATHS.plans;
   }
   /**
    * Get the plans directory path
@@ -2859,10 +3313,22 @@ var PlanFileStorage = class {
 
 // src/core/actionExecutor.ts
 
-var ActionExecutor = class _ActionExecutor {
-  constructor(deps) {
+var GOAL_TOOL_TYPES = /* @__PURE__ */ new Set([
+  "get_goal",
+  "create_goal",
+  "create_goal_from_template",
+  "update_goal",
+  "clear_goal",
+  "list_goal_templates",
+  "enqueue_goal",
+  "list_goal_queue",
+  "start_queued_goal",
+  "dequeue_goal",
+  "remove_queued_goal"
+]);
+var ActionExecutor = (_class3 = class _ActionExecutor {
+  constructor(deps) {;_class3.prototype.__init6.call(this);_class3.prototype.__init7.call(this);_class3.prototype.__init8.call(this);_class3.prototype.__init9.call(this);
     this.deps = deps;
-    this.searchCache = /* @__PURE__ */ new Map();
     this.runtime = deps.runtime;
     this.files = deps.files;
     this.resolveWorkspacePath = deps.resolveWorkspacePath;
@@ -2870,17 +3336,94 @@ var ActionExecutor = class _ActionExecutor {
     this.projectManager = deps.projectManager;
     this.sessionId = deps.sessionId;
     this.logExploration = deps.onExploration;
-    this.toolsRegistry = _nullishCoalesce(deps.toolsRegistry, () => ( new ToolsRegistry()));
+    this.toolsRegistry = _nullishCoalesce(deps.toolsRegistry, () => ( createToolsRegistry(deps.runtime.workspaceRoot)));
+    this.metaToolService = _nullishCoalesce(deps.metaToolService, () => ( new MetaToolService(this.toolsRegistry)));
     this.getRegisteredTools = _nullishCoalesce(deps.getRegisteredTools, () => ( (() => [])));
-    this.permissionManager = _nullishCoalesce(deps.permissionManager, () => ( new (0, _chunkMERYP6AMcjs.PermissionManager)(deps.runtime.config.permissions)));
+    this.permissionManager = _nullishCoalesce(deps.permissionManager, () => ( new (0, _chunkW5QLA6WPcjs.PermissionManager)(deps.runtime.config.permissions)));
     this.memoryManager = deps.memoryManager;
     this.onToolOutput = deps.onToolOutput;
     this.onFileModified = deps.onFileModified;
     this.onAskFollowup = deps.onAskFollowup;
     this.onPlanCreated = deps.onPlanCreated;
     this.onPermissionRequest = deps.onPermissionRequest;
+    this.onReviewHook = deps.onReviewHook;
+    this.onModalPause = deps.onModalPause;
+    this.onRequestDirectoryAccess = deps.onRequestDirectoryAccess;
+    this.onLiveCommandStart = deps.onLiveCommandStart;
+    this.onLiveCommandOutput = deps.onLiveCommandOutput;
+    this.onLiveCommandRemove = deps.onLiveCommandRemove;
+    this.onMetaToolCreated = deps.onMetaToolCreated;
     this.securityScanner = new SecurityScanner();
   }
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  __init6() {this.searchCache = /* @__PURE__ */ new Map()}
+  __init7() {this.fffSearchProviderPromise = null}
+  __init8() {this.fffSearchWorkspaceRoot = null}
+  __init9() {this.fffSearchIdleTimer = null}
+  static __initStatic() {this.FFF_SEARCH_IDLE_TTL_MS = 6e4}
+  shouldDisplayToolOutput() {
+    return _optionalChain([this, 'access', _40 => _40.runtime, 'access', _41 => _41.config, 'access', _42 => _42.ui, 'optionalAccess', _43 => _43.silentToolOutput]) !== true;
+  }
+  async getFFFSearchProvider() {
+    if (this.fffSearchIdleTimer) {
+      clearTimeout(this.fffSearchIdleTimer);
+      this.fffSearchIdleTimer = null;
+    }
+    const workspaceRoot = this.runtime.workspaceRoot;
+    if (this.fffSearchProviderPromise && this.fffSearchWorkspaceRoot === workspaceRoot) {
+      return this.fffSearchProviderPromise;
+    }
+    if (this.fffSearchProviderPromise) {
+      this.fffSearchProviderPromise.then((provider) => provider.destroy()).catch(() => {
+      });
+    }
+    const { FFFSearchProvider } = await Promise.resolve().then(() => _interopRequireWildcard(require("./fffSearchProvider-W6627E2V.cjs")));
+    this.fffSearchWorkspaceRoot = workspaceRoot;
+    this.fffSearchProviderPromise = FFFSearchProvider.create(workspaceRoot);
+    return this.fffSearchProviderPromise;
+  }
+  scheduleFFFSearchProviderCleanup() {
+    if (!this.fffSearchProviderPromise) {
+      return;
+    }
+    if (this.fffSearchIdleTimer) {
+      clearTimeout(this.fffSearchIdleTimer);
+    }
+    this.fffSearchIdleTimer = setTimeout(() => {
+      const providerPromise = this.fffSearchProviderPromise;
+      this.fffSearchProviderPromise = null;
+      this.fffSearchWorkspaceRoot = null;
+      this.fffSearchIdleTimer = null;
+      _optionalChain([providerPromise, 'optionalAccess', _44 => _44.then, 'call', _45 => _45((provider) => provider.destroy()), 'access', _46 => _46.catch, 'call', _47 => _47(() => {
+      })]);
+    }, _ActionExecutor.FFF_SEARCH_IDLE_TTL_MS);
+    _optionalChain([this, 'access', _48 => _48.fffSearchIdleTimer, 'access', _49 => _49.unref, 'optionalCall', _50 => _50()]);
+  }
   /**
    * Check permission hooks before prompting user.
    * Returns true if allowed, false if denied/blocked, undefined if should ask user.
@@ -2890,7 +3433,7 @@ var ActionExecutor = class _ActionExecutor {
       return {};
     }
     const hookResponse = await this.onPermissionRequest(context);
-    if (!_optionalChain([hookResponse, 'optionalAccess', _46 => _46.decision])) {
+    if (!_optionalChain([hookResponse, 'optionalAccess', _51 => _51.decision])) {
       return {};
     }
     switch (hookResponse.decision) {
@@ -2906,7 +3449,10 @@ var ActionExecutor = class _ActionExecutor {
     }
   }
   async execute(action, context) {
-    if (this.runtime.options.dryRun && action.type !== "search" && action.type !== "plan") {
+    if (GOAL_TOOL_TYPES.has(action.type) && !_chunkWJYFLQ7Gcjs.isGoalFeatureEnabled.call(void 0, this.runtime.config)) {
+      return _chunkWJYFLQ7Gcjs.GOAL_FEATURE_DISABLED_MESSAGE;
+    }
+    if (this.runtime.options.dryRun && !["fff_grep", "fff_find", "find", "search", "search_with_context", "semantic_search", "glob", "plan"].includes(action.type)) {
       return "Dry-run mode: skipped mutation";
     }
     switch (action.type) {
@@ -2931,7 +3477,7 @@ var ActionExecutor = class _ActionExecutor {
           console.log(_chalk2.default.gray(`
 \u{1F9F9} Cleaned up ${cleanedCount} plan(s) older than 30 days`));
         }
-        const planModeManager = _chunkULQ6MDSJcjs.getPlanModeManager.call(void 0, );
+        const planModeManager = _chunkLFDPTJYFcjs.getPlanModeManager.call(void 0, );
         if (planModeManager.isEnabled() && this.onAskFollowup) {
           const refreshedPlanIds = await storage.listPlans();
           const incompletePlans = [];
@@ -3101,11 +3647,15 @@ ${steps.map((s) => `${s.number}. ${s.description}`).join("\n")}`;
           const receivedKeys = Object.keys(action).filter((k) => k !== "type").join(", ") || "none";
           throw new Error(`write_file requires a "path" argument. Received arguments: [${receivedKeys}]`);
         }
+        if (action.contents === void 0 && action.content === void 0) {
+          return 'Error: write_file requires "contents" argument.';
+        }
         const filePath = this.resolveWorkspacePath(action.path);
         const fs7 = await Promise.resolve().then(() => _interopRequireWildcard(require("fs-extra")));
         const exists = this.files.root && await fs7.pathExists(filePath);
         const oldContent = exists ? await this.files.readFile(action.path) : "";
         const newContent = _nullishCoalesce(this.pickText(action.contents, action.content), () => ( ""));
+        let resultOutput = null;
         if (!exists) {
           const permContext = {
             tool: "write_file",
@@ -3151,16 +3701,18 @@ ${steps.map((s) => `${s.number}. ${s.description}`).join("\n")}`;
               }
             }
           }
+          resultOutput = this.formatDiffPreview("", newContent, action.path);
         } else if (oldContent === newContent) {
           return `No changes needed for ${action.path} (content identical)`;
         } else {
           console.log(_chalk2.default.cyan(`
 \u{1F4DD} ${action.path}:`));
           this.showDiff(oldContent, newContent, action.path);
+          resultOutput = this.formatDiffPreview(oldContent, newContent, action.path);
         }
         await this.files.writeFile(action.path, newContent);
-        _optionalChain([this, 'access', _47 => _47.onFileModified, 'optionalCall', _48 => _48(action.path)]);
-        return exists ? `Updated ${action.path}` : `Created ${action.path}`;
+        _optionalChain([this, 'access', _52 => _52.onFileModified, 'optionalCall', _53 => _53(action.path, exists ? "modify" : "create")]);
+        return _nullishCoalesce(resultOutput, () => ( (exists ? `Updated ${action.path}` : `Created ${action.path}`)));
       }
       case "append_file": {
         if (!action.path) {
@@ -3173,17 +3725,17 @@ ${steps.map((s) => `${s.number}. ${s.description}`).join("\n")}`;
 \u{1F4DD} ${action.path}:`));
         this.showDiff(oldContent, newContent, action.path);
         await this.files.appendFile(action.path, addition);
-        _optionalChain([this, 'access', _49 => _49.onFileModified, 'optionalCall', _50 => _50(action.path)]);
-        return `Appended to ${action.path}`;
+        _optionalChain([this, 'access', _54 => _54.onFileModified, 'optionalCall', _55 => _55(action.path, "modify")]);
+        return this.formatDiffPreview(oldContent, newContent, action.path);
       }
       case "apply_patch": {
         if (!action.path) {
-          throw new Error('apply_patch requires a "path" argument.');
+          return 'Error: apply_patch requires a "path" argument.';
         }
         const oldContent = await this.files.readFile(action.path).catch(() => "");
         const patch = this.pickText(action.patch, action.diff);
         if (!patch) {
-          throw new Error("apply_patch requires patch or diff content.");
+          return 'Error: apply_patch requires a "patch" argument.';
         }
         console.log(_chalk2.default.cyan(`
 \u{1F527} ${action.path}:`));
@@ -3191,58 +3743,148 @@ ${steps.map((s) => `${s.number}. ${s.description}`).join("\n")}`;
         await this.files.applyPatch(action.path, patch);
         const newContent = await this.files.readFile(action.path);
         this.showDiff(oldContent, newContent, action.path);
-        _optionalChain([this, 'access', _51 => _51.onFileModified, 'optionalCall', _52 => _52(action.path)]);
-        return `Patched ${action.path}`;
+        _optionalChain([this, 'access', _56 => _56.onFileModified, 'optionalCall', _57 => _57(action.path, "modify")]);
+        return this.formatDiffPreview(oldContent, newContent, action.path);
+      }
+      case "notebook_edit": {
+        if (!action.path) {
+          throw new Error('notebook_edit requires a "path" argument.');
+        }
+        const current = await this.files.readFile(action.path);
+        const { updated, summary } = applyNotebookEdit(current, action);
+        await this.files.writeFile(action.path, updated);
+        _optionalChain([this, 'access', _58 => _58.onFileModified, 'optionalCall', _59 => _59(action.path, "modify")]);
+        return summary;
       }
       case "tools_registry": {
         const tools = await this.toolsRegistry.listTools(this.getRegisteredTools());
         return JSON.stringify(tools, null, 2);
       }
-      case "search": {
-        const cacheKey = `search:${action.query}:${action.path || ""}`;
-        if (this.searchCache.has(cacheKey)) {
-          return `[Cached] ${this.searchCache.get(cacheKey)}`;
-        }
-        const hits = this.files.search(action.query, action.path);
-        this.recordExploration("search", action.query);
-        const result = hits.slice(0, 10).map((hit) => `${hit.file}:${hit.line}: ${hit.text}`).join("\n");
-        this.searchCache.set(cacheKey, result);
-        return result;
+      case "get_goal": {
+        const manager = new (0, _chunkNQZH5CR2cjs.GoalManager)(this.runtime.workspaceRoot);
+        return JSON.stringify(await manager.getSnapshot(), null, 2);
       }
-      case "search_with_context": {
-        const cacheKey = `search_ctx:${action.query}:${action.path || ""}:${action.limit || ""}:${action.context || ""}`;
-        if (this.searchCache.has(cacheKey)) {
-          return `[Cached] ${this.searchCache.get(cacheKey)}`;
-        }
-        this.recordExploration("search", action.query);
-        const result = this.files.searchWithContext(action.query, {
-          limit: action.limit,
-          context: action.context,
-          relativePath: action.path
+      case "list_goal_templates": {
+        const manager = new (0, _chunkNQZH5CR2cjs.GoalManager)(this.runtime.workspaceRoot);
+        return JSON.stringify(await manager.listTemplates(), null, 2);
+      }
+      case "create_goal": {
+        const manager = new (0, _chunkNQZH5CR2cjs.GoalManager)(this.runtime.workspaceRoot);
+        const created = await manager.createGoal({
+          objective: action.objective,
+          tokenBudget: action.token_budget,
+          timeBudgetSeconds: action.time_budget_seconds,
+          minTokensBeforeWrapUp: action.min_tokens_before_wrap_up,
+          minTimeSecondsBeforeWrapUp: action.min_time_seconds_before_wrap_up
         });
-        this.searchCache.set(cacheKey, result);
-        return result;
+        return formatGoalToolResult(created);
       }
-      case "semantic_search": {
-        const cacheKey = `semantic:${action.query}:${action.path || ""}:${action.limit || ""}:${action.window || ""}`;
-        if (this.searchCache.has(cacheKey)) {
-          return `[Cached] ${this.searchCache.get(cacheKey)}`;
+      case "create_goal_from_template": {
+        const manager = new (0, _chunkNQZH5CR2cjs.GoalManager)(this.runtime.workspaceRoot);
+        const resolution = await Promise.resolve().then(() => _interopRequireWildcard(require("./templates-ARG2VRWW.cjs"))).then((mod) => mod.resolveGoalTemplateByName(
+          this.runtime.workspaceRoot,
+          action.template,
+          _nullishCoalesce(action.flags, () => ( {})),
+          _nullishCoalesce(action.args, () => ( ""))
+        ));
+        if (!resolution.ok) {
+          return `Error: ${"notTemplate" in resolution ? `Unknown goal template '${action.template}'.` : resolution.error}`;
         }
-        const results = this.files.semanticSearch(action.query, {
-          limit: action.limit,
-          window: action.window,
-          relativePath: action.path
+        const created = await manager.createGoal({
+          objective: resolution.template.objective,
+          tokenBudget: action.token_budget,
+          timeBudgetSeconds: action.time_budget_seconds,
+          minTokensBeforeWrapUp: action.min_tokens_before_wrap_up,
+          minTimeSecondsBeforeWrapUp: action.min_time_seconds_before_wrap_up
+        }, { replace: true });
+        return formatGoalToolResult(created);
+      }
+      case "update_goal": {
+        const manager = new (0, _chunkNQZH5CR2cjs.GoalManager)(this.runtime.workspaceRoot);
+        const updated = await manager.updateGoal({
+          objective: action.objective,
+          status: parseGoalStatus(action.status),
+          tokenBudget: action.token_budget,
+          timeBudgetSeconds: action.time_budget_seconds,
+          minTokensBeforeWrapUp: action.min_tokens_before_wrap_up,
+          minTimeSecondsBeforeWrapUp: action.min_time_seconds_before_wrap_up
         });
-        if (!results.length) {
-          this.searchCache.set(cacheKey, "No matches found.");
-          return "No matches found.";
+        return formatGoalToolResult(updated);
+      }
+      case "clear_goal": {
+        const manager = new (0, _chunkNQZH5CR2cjs.GoalManager)(this.runtime.workspaceRoot);
+        return formatGoalToolResult(await manager.clearGoal());
+      }
+      case "enqueue_goal": {
+        const manager = new (0, _chunkNQZH5CR2cjs.GoalManager)(this.runtime.workspaceRoot);
+        return formatGoalToolResult(await manager.enqueueGoal({
+          objective: action.objective,
+          source: "tool",
+          tokenBudget: action.token_budget,
+          timeBudgetSeconds: action.time_budget_seconds,
+          minTokensBeforeWrapUp: action.min_tokens_before_wrap_up,
+          minTimeSecondsBeforeWrapUp: action.min_time_seconds_before_wrap_up
+        }));
+      }
+      case "list_goal_queue": {
+        const manager = new (0, _chunkNQZH5CR2cjs.GoalManager)(this.runtime.workspaceRoot);
+        const snapshot = await manager.getSnapshot();
+        return JSON.stringify({ goal: snapshot.goal, queue: snapshot.queue }, null, 2);
+      }
+      case "start_queued_goal": {
+        const manager = new (0, _chunkNQZH5CR2cjs.GoalManager)(this.runtime.workspaceRoot);
+        return formatGoalToolResult(await manager.startQueuedGoal());
+      }
+      case "dequeue_goal": {
+        const manager = new (0, _chunkNQZH5CR2cjs.GoalManager)(this.runtime.workspaceRoot);
+        return formatGoalToolResult(await manager.dequeueGoal({
+          rationale: action.rationale,
+          authority: action.authority
+        }));
+      }
+      case "remove_queued_goal": {
+        const manager = new (0, _chunkNQZH5CR2cjs.GoalManager)(this.runtime.workspaceRoot);
+        const queueId = _nullishCoalesce(action.queueId, () => ( action.queue_id));
+        if (!queueId) return "Error: remove_queued_goal requires queueId.";
+        return formatGoalToolResult(await manager.removeQueuedGoal(queueId));
+      }
+      case "tool_search": {
+        const query = _optionalChain([action, 'access', _60 => _60.query, 'optionalAccess', _61 => _61.trim, 'call', _62 => _62()]);
+        if (!query) {
+          throw new Error('tool_search requires a non-empty "query" argument.');
         }
-        const result = results.map((hit) => `${_chalk2.default.cyan(hit.file)}
-${hit.snippet}`).join("\n\n");
-        this.searchCache.set(cacheKey, result);
-        return result;
+        const limit = Math.max(1, _nullishCoalesce(action.limit, () => ( 10)));
+        const tools = await this.toolsRegistry.listTools(this.getRegisteredTools());
+        const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
+        const scored = tools.map((tool) => {
+          const haystack = `${tool.name} ${tool.description}`.toLowerCase();
+          let score = 0;
+          for (const term of terms) {
+            if (tool.name.toLowerCase() === term) {
+              score += 10;
+            } else if (tool.name.toLowerCase().includes(term)) {
+              score += 6;
+            }
+            if (haystack.includes(term)) {
+              score += 2;
+            }
+          }
+          return { tool, score };
+        }).filter((entry) => entry.score > 0).sort((a, b) => b.score - a.score || a.tool.name.localeCompare(b.tool.name)).slice(0, limit).map((entry) => entry.tool);
+        return JSON.stringify(scored, null, 2);
       }
+      case "find":
+        return this.executeFind(action);
+      case "glob":
+        return this.executeGlob(action);
+      case "fff_grep":
+        return this.executeFFFGrep(action);
+      case "fff_find":
+        return this.executeFFFFind(action);
       case "create_directory": {
+        if (!action.path) {
+          return 'Error: create_directory requires a "path" argument.';
+        }
         await this.files.createDirectory(action.path);
         return `Created directory ${action.path}`;
       }
@@ -3257,14 +3899,24 @@ ${hit.snippet}`).join("\n\n");
         if (!confirmed) {
           return `Skipped deleting ${action.path}`;
         }
+        const oldDeleteContent = await this.files.readFile(action.path).catch(() => null);
         await this.files.deletePath(action.path);
-        return `Deleted ${action.path}`;
+        if (oldDeleteContent !== null) {
+          console.log(_chalk2.default.cyan(`
+\u{1F5D1}\uFE0F ${action.path}:`));
+          this.showDiff(oldDeleteContent, "", action.path);
+          _optionalChain([this, 'access', _63 => _63.onFileModified, 'optionalCall', _64 => _64(action.path, "delete")]);
+          return this.formatDiffPreview(oldDeleteContent, "", action.path);
+        }
+        _optionalChain([this, 'access', _65 => _65.onFileModified, 'optionalCall', _66 => _66(action.path, "delete")]);
+        return `Deleted directory ${action.path}`;
       }
       case "rename_path": {
         if (!action.from || !action.to) {
           throw new Error('rename_path requires "from" and "to" arguments.');
         }
         await this.files.renamePath(action.from, action.to);
+        _optionalChain([this, 'access', _67 => _67.onFileModified, 'optionalCall', _68 => _68(action.to, "create")]);
         return `Renamed ${action.from} -> ${action.to}`;
       }
       case "copy_path": {
@@ -3272,9 +3924,16 @@ ${hit.snippet}`).join("\n\n");
           throw new Error('copy_path requires "from" and "to" arguments.');
         }
         await this.files.copyPath(action.from, action.to);
+        _optionalChain([this, 'access', _69 => _69.onFileModified, 'optionalCall', _70 => _70(action.to, "create")]);
         return `Copied ${action.from} -> ${action.to}`;
       }
       case "search_replace": {
+        if (!action.path) {
+          return 'Error: search_replace requires a "path" argument.';
+        }
+        if (!action.blocks) {
+          return 'Error: search_replace requires a "blocks" argument.';
+        }
         const content = await this.files.readFile(action.path);
         const result = this.applySearchReplaceBlocks(content, action.blocks);
         if (content !== result) {
@@ -3282,54 +3941,116 @@ ${hit.snippet}`).join("\n\n");
 \u{1F504} ${action.path}:`));
           this.showDiff(content, result, action.path);
           await this.files.writeFile(action.path, result);
-          _optionalChain([this, 'access', _53 => _53.onFileModified, 'optionalCall', _54 => _54(action.path)]);
+          _optionalChain([this, 'access', _71 => _71.onFileModified, 'optionalCall', _72 => _72(action.path, "modify")]);
+          return this.formatDiffPreview(content, result, action.path);
         }
-        return `Updated ${action.path}`;
+        return `No changes needed for ${action.path} (content identical)`;
       }
       case "format_file": {
         if (!action.path) {
           throw new Error('format_file requires a "path" argument.');
         }
+        const oldFormatContent = await this.files.readFile(action.path).catch(() => "");
         await this.files.formatFile(action.path, (contents, file) => _chunk4JNNTOGFcjs.applyFormatter.call(void 0, action.formatter, contents, file));
-        return `Formatted ${action.path} (${action.formatter})`;
+        const newFormatContent = await this.files.readFile(action.path).catch(() => "");
+        if (oldFormatContent !== newFormatContent) {
+          console.log(_chalk2.default.cyan(`
+\u{1F3A8} ${action.path}:`));
+          this.showDiff(oldFormatContent, newFormatContent, action.path);
+          _optionalChain([this, 'access', _73 => _73.onFileModified, 'optionalCall', _74 => _74(action.path, "modify")]);
+          return this.formatDiffPreview(oldFormatContent, newFormatContent, action.path);
+        }
+        return `No changes needed (already formatted): ${action.path}`;
       }
       case "run_command": {
         if (!action.command || typeof action.command !== "string") {
           return 'Error: run_command requires a "command" argument (string)';
         }
         const shouldStreamOutput = Boolean(
-          this.onToolOutput && _optionalChain([context, 'optionalAccess', _55 => _55.toolCallId]) && !action.background && process.env.AUTOHAND_STREAM_TOOL_OUTPUT === "1"
+          this.onToolOutput && _optionalChain([context, 'optionalAccess', _75 => _75.toolCallId]) && !action.background && process.env.AUTOHAND_STREAM_TOOL_OUTPUT === "1"
         );
         const emitOutput = (stream, data) => {
           if (!shouldStreamOutput) {
             return;
           }
-          _optionalChain([this, 'access', _56 => _56.onToolOutput, 'optionalCall', _57 => _57({
+          _optionalChain([this, 'access', _76 => _76.onToolOutput, 'optionalCall', _77 => _77({
             tool: action.type,
-            toolCallId: _optionalChain([context, 'optionalAccess', _58 => _58.toolCallId]),
+            toolCallId: _optionalChain([context, 'optionalAccess', _78 => _78.toolCallId]),
             stream,
             data
           })]);
         };
         const cmdStr = `${action.command} ${(_nullishCoalesce(action.args, () => ( []))).join(" ")}`.trim();
+        if (action.interactive) {
+          const onModalPause = this.onModalPause;
+          if (onModalPause) {
+            return await onModalPause(async () => {
+              let result2;
+              try {
+                result2 = await _chunkWTB7AFL6cjs.runCommand.call(void 0, 
+                  cmdStr,
+                  [],
+                  this.runtime.workspaceRoot,
+                  {
+                    directory: action.directory,
+                    shell: true,
+                    interactive: true
+                  }
+                );
+              } catch (err) {
+                const error = err;
+                if (error.code === "ENOENT" || error.message.includes("Command not found")) {
+                  return `Error: Command not found: "${action.command}". Make sure it is installed and available on your PATH.`;
+                }
+                return `Error running "${cmdStr}": ${error.message}`;
+              }
+              const header2 = action.description ? `$ ${action.description}
+> ${cmdStr}` : `$ ${cmdStr}`;
+              const dirInfo2 = action.directory ? `[dir: ${action.directory}]` : "";
+              const parts2 = [dirInfo2 ? `${header2} ${dirInfo2}` : header2];
+              if (result2.code !== 0) {
+                parts2.push(`(exit code: ${result2.code})`);
+              }
+              return parts2.join("\n");
+            });
+          }
+        }
         let result;
-        const useShell = needsShell(action.command);
-        const shellCmd = useShell ? `${action.command} ${(_nullishCoalesce(action.args, () => ( []))).join(" ")}`.trim() : action.command;
-        const shellArgs = useShell ? [] : _nullishCoalesce(action.args, () => ( []));
+        const shellCmd = cmdStr;
+        const liveCommandId = !action.background && this.shouldDisplayToolOutput() ? _optionalChain([this, 'access', _79 => _79.onLiveCommandStart, 'optionalCall', _80 => _80(cmdStr)]) : void 0;
+        const hasLiveDisplay = Boolean(liveCommandId);
+        const emitLiveOutput = (stream, data) => {
+          if (!hasLiveDisplay || !liveCommandId) {
+            return;
+          }
+          _optionalChain([this, 'access', _81 => _81.onLiveCommandOutput, 'optionalCall', _82 => _82(liveCommandId, stream, data)]);
+        };
         try {
-          result = await runCommand(
+          result = await _chunkWTB7AFL6cjs.runCommand.call(void 0, 
             shellCmd,
-            shellArgs,
+            [],
             this.runtime.workspaceRoot,
             {
               directory: action.directory,
               background: action.background,
-              shell: useShell,
-              onStdout: (chunk) => emitOutput("stdout", chunk),
-              onStderr: (chunk) => emitOutput("stderr", chunk)
+              shell: true,
+              onStdout: (chunk) => {
+                emitOutput("stdout", chunk);
+                emitLiveOutput("stdout", chunk);
+              },
+              onStderr: (chunk) => {
+                emitOutput("stderr", chunk);
+                emitLiveOutput("stderr", chunk);
+              }
             }
           );
+          if (liveCommandId) {
+            _optionalChain([this, 'access', _83 => _83.onLiveCommandRemove, 'optionalCall', _84 => _84(liveCommandId)]);
+          }
         } catch (err) {
+          if (liveCommandId) {
+            _optionalChain([this, 'access', _85 => _85.onLiveCommandRemove, 'optionalCall', _86 => _86(liveCommandId)]);
+          }
           const error = err;
           if (error.code === "ENOENT" || error.message.includes("Command not found")) {
             return `Error: Command not found: "${action.command}". Make sure it is installed and available on your PATH.`;
@@ -3349,12 +4070,100 @@ ${hit.snippet}`).join("\n\n");
         }
         return parts.join("\n");
       }
+      case "shell": {
+        if (!action.command || typeof action.command !== "string") {
+          return 'Error: shell requires a "command" argument (string)';
+        }
+        const cmdStr = `${action.command} ${(_nullishCoalesce(action.args, () => ( []))).join(" ")}`.trim();
+        const commandId = this.shouldDisplayToolOutput() ? _optionalChain([this, 'access', _87 => _87.onLiveCommandStart, 'optionalCall', _88 => _88(cmdStr)]) : void 0;
+        const hasLiveDisplay = Boolean(commandId);
+        if (hasLiveDisplay) {
+          const liveId = commandId;
+          try {
+            const result2 = await _chunkWBU4Q4GScjs.executeStreamingShellCommand.call(void 0, 
+              cmdStr,
+              this.runtime.workspaceRoot,
+              {
+                onStdout: (chunk) => this.onLiveCommandOutput(liveId, "stdout", chunk),
+                onStderr: (chunk) => this.onLiveCommandOutput(liveId, "stderr", chunk),
+                preferPty: process.stdin.isTTY && process.stdout.isTTY,
+                columns: process.stdout.columns,
+                rows: process.stdout.rows,
+                background: action.background
+              }
+            );
+            this.onLiveCommandRemove(liveId);
+            const header2 = action.description ? `$ ${action.description}
+> ${cmdStr}` : `$ ${cmdStr}`;
+            const dirInfo2 = action.directory ? `[dir: ${action.directory}]` : "";
+            const parts2 = [dirInfo2 ? `${header2} ${dirInfo2}` : header2];
+            if (result2.output) parts2.push(result2.output);
+            if (result2.error) parts2.push(result2.error);
+            if (result2.backgroundPid) parts2.push(`[Background PID: ${result2.backgroundPid}]`);
+            return parts2.join("\n");
+          } catch (err) {
+            this.onLiveCommandRemove(liveId);
+            const error = err;
+            return `Error running "${cmdStr}": ${error.message}`;
+          }
+        }
+        let result;
+        try {
+          result = await _chunkWTB7AFL6cjs.runCommand.call(void 0, 
+            cmdStr,
+            [],
+            this.runtime.workspaceRoot,
+            {
+              directory: action.directory,
+              shell: true,
+              background: action.background
+            }
+          );
+        } catch (err) {
+          const error = err;
+          if (error.code === "ENOENT" || error.message.includes("Command not found")) {
+            return `Error: Command not found: "${action.command}". Make sure it is installed and available on your PATH.`;
+          }
+          return `Error running "${cmdStr}": ${error.message}`;
+        }
+        const header = action.description ? `$ ${action.description}
+> ${cmdStr}` : `$ ${cmdStr}`;
+        const dirInfo = action.directory ? `[dir: ${action.directory}]` : "";
+        const parts = [
+          dirInfo ? `${header} ${dirInfo}` : header,
+          result.stdout,
+          result.stderr
+        ].filter(Boolean);
+        return parts.join("\n");
+      }
       case "add_dependency": {
+        const fseAdd = (await Promise.resolve().then(() => _interopRequireWildcard(require("fs-extra")))).default;
+        const pkgPathAdd = `${this.runtime.workspaceRoot}/package.json`;
+        const oldPkgAdd = await fseAdd.readFile(pkgPathAdd, "utf-8").catch(() => "");
         await addDependency(this.runtime.workspaceRoot, action.name, action.version, { dev: action.dev });
+        const newPkgAdd = await fseAdd.readFile(pkgPathAdd, "utf-8").catch(() => "");
+        if (oldPkgAdd !== newPkgAdd) {
+          console.log(_chalk2.default.cyan(`
+\u{1F4E6} package.json:`));
+          this.showDiff(oldPkgAdd, newPkgAdd, "package.json");
+          _optionalChain([this, 'access', _89 => _89.onFileModified, 'optionalCall', _90 => _90("package.json", "modify")]);
+          return this.formatDiffPreview(oldPkgAdd, newPkgAdd, "package.json");
+        }
         return `Added dependency ${action.name}@${action.version}${action.dev ? " (dev)" : ""}`;
       }
       case "remove_dependency": {
+        const fseRm = (await Promise.resolve().then(() => _interopRequireWildcard(require("fs-extra")))).default;
+        const pkgPathRm = `${this.runtime.workspaceRoot}/package.json`;
+        const oldPkgRm = await fseRm.readFile(pkgPathRm, "utf-8").catch(() => "");
         await removeDependency(this.runtime.workspaceRoot, action.name, { dev: action.dev });
+        const newPkgRm = await fseRm.readFile(pkgPathRm, "utf-8").catch(() => "");
+        if (oldPkgRm !== newPkgRm) {
+          console.log(_chalk2.default.cyan(`
+\u{1F4E6} package.json:`));
+          this.showDiff(oldPkgRm, newPkgRm, "package.json");
+          _optionalChain([this, 'access', _91 => _91.onFileModified, 'optionalCall', _92 => _92("package.json", "modify")]);
+          return this.formatDiffPreview(oldPkgRm, newPkgRm, "package.json");
+        }
         return `Removed dependency ${action.name}${action.dev ? " (dev)" : ""}`;
       }
       case "list_tree": {
@@ -3383,11 +4192,7 @@ ${hit.snippet}`).join("\n\n");
         return `${_nullishCoalesce(action.algorithm, () => ( "sha256"))} ${action.path}: ${sum}`;
       }
       case "git_diff": {
-        if (!action.path) {
-          throw new Error('git_diff requires a "path" argument.');
-        }
-        this.resolveWorkspacePath(action.path);
-        const rawDiff = diffFile(this.runtime.workspaceRoot, action.path);
+        const rawDiff = action.path ? (this.resolveWorkspacePath(action.path), diffFile(this.runtime.workspaceRoot, action.path)) : diffWorkspace(this.runtime.workspaceRoot);
         return this.colorizeGitDiff(rawDiff);
       }
       case "git_checkout": {
@@ -3395,8 +4200,17 @@ ${hit.snippet}`).join("\n\n");
           throw new Error('git_checkout requires a "path" argument.');
         }
         this.resolveWorkspacePath(action.path);
+        const oldCheckoutContent = await this.files.readFile(action.path).catch(() => "");
         checkoutFile(this.runtime.workspaceRoot, action.path);
-        return `Restored ${action.path} from git.`;
+        const newCheckoutContent = await this.files.readFile(action.path).catch(() => "");
+        if (oldCheckoutContent !== newCheckoutContent) {
+          console.log(_chalk2.default.cyan(`
+\u21A9\uFE0F ${action.path}:`));
+          this.showDiff(oldCheckoutContent, newCheckoutContent, action.path);
+          _optionalChain([this, 'access', _93 => _93.onFileModified, 'optionalCall', _94 => _94(action.path, "modify")]);
+          return this.formatDiffPreview(oldCheckoutContent, newCheckoutContent, action.path);
+        }
+        return `Restored ${action.path} from git (no changes).`;
       }
       case "git_status":
         return gitStatus(this.runtime.workspaceRoot);
@@ -3666,8 +4480,10 @@ ${result.removed.map((p) => `  - ${p}`).join("\n")}`;
         console.log(_chalk2.default.cyan("Suggested commit message:"));
         console.log(_chalk2.default.white(`   ${commitMessage}`));
         console.log();
+        const normalizedYolo = _chunkJ5HE6CUMcjs.normalizeYoloInput.call(void 0, this.runtime.options.yolo);
+        const yoloAllowsCommit = normalizedYolo && _chunkJ5HE6CUMcjs.isToolAllowedByYolo.call(void 0, "auto_commit", _chunkJ5HE6CUMcjs.parseYoloPattern.call(void 0, normalizedYolo));
         const autoApproveCommit = Boolean(
-          this.runtime.options.yes || process.env.CI === "1" || process.env.AUTOHAND_NON_INTERACTIVE === "1"
+          this.runtime.options.unrestricted || this.runtime.options.yes || yoloAllowsCommit || process.env.CI === "1" || process.env.AUTOHAND_NON_INTERACTIVE === "1"
         );
         if (autoApproveCommit) {
           console.log(_chalk2.default.gray("Auto-commit approval enabled; committing without prompt."));
@@ -3682,26 +4498,36 @@ ${result.removed.map((p) => `  - ${p}`).join("\n")}`;
           return result2.message;
         }
         const options = [
-          { label: "Yes - commit with this message", value: "y" },
+          { label: `Yes - commit with this message`, value: "y" },
           { label: "Edit - modify the message", value: "e" },
           { label: "No - cancel commit", value: "n" }
         ];
-        const modalResult = await _chunkZYQMLKOKcjs.showModal.call(void 0, {
-          title: "Commit with this message?",
-          options
-        });
-        if (!modalResult || modalResult.value === "n") {
+        const runModal = async () => {
+          const modalResult = await _chunkCK4HAHVYcjs.showModal.call(void 0, {
+            title: `Commit with this message?
+
+"${commitMessage}"`,
+            options
+          });
+          if (!modalResult || modalResult.value === "n") {
+            return { cancelled: true, editedMessage: null };
+          }
+          if (modalResult.value === "e") {
+            const editedMessage = await _chunkCK4HAHVYcjs.showInput.call(void 0, {
+              title: "Enter commit message:",
+              defaultValue: commitMessage
+            });
+            return { cancelled: false, editedMessage };
+          }
+          return { cancelled: false, editedMessage: null };
+        };
+        const modalOutcome = this.onModalPause ? await this.onModalPause(runModal) : await runModal();
+        if (modalOutcome.cancelled) {
           console.log(_chalk2.default.yellow("Commit cancelled."));
           return "Commit cancelled by user";
         }
-        if (modalResult.value === "e") {
-          const editedMessage = await _chunkZYQMLKOKcjs.showInput.call(void 0, {
-            title: "Enter commit message:",
-            defaultValue: commitMessage
-          });
-          if (editedMessage) {
-            commitMessage = editedMessage;
-          }
+        if (modalOutcome.editedMessage) {
+          commitMessage = modalOutcome.editedMessage;
         }
         const result = executeAutoCommit(this.runtime.workspaceRoot, commitMessage, action.stage_all !== false);
         if (result.success) {
@@ -3735,6 +4561,12 @@ ${result.removed.map((p) => `  - ${p}`).join("\n")}`;
       case "custom_command":
         return this.executeCustomCommand(action);
       case "multi_file_edit": {
+        if (!action.file_path) {
+          return 'Error: multi_file_edit requires a "file_path" argument.';
+        }
+        if (!action.edits || !Array.isArray(action.edits)) {
+          return 'Error: multi_file_edit requires an "edits" argument (array).';
+        }
         const oldContent = await this.files.readFile(action.file_path);
         let newContent = oldContent;
         console.log(_chalk2.default.cyan(`
@@ -3775,14 +4607,20 @@ ${result.removed.map((p) => `  - ${p}`).join("\n")}`;
               }
             }
             if (firstIndex === -1) {
-              console.log(_chalk2.default.red(`  \u2717 Edit ${i + 1}: Could not find text to replace`));
-              console.log(_chalk2.default.gray(`    Looking for (${edit.old_string.length} chars):`));
-              console.log(_chalk2.default.gray(`    "${edit.old_string.substring(0, 80)}${edit.old_string.length > 80 ? "..." : ""}"`));
               const similar = this.findSimilarText(newContent, edit.old_string);
               if (similar) {
-                console.log(_chalk2.default.yellow(`    Did you mean:`));
-                console.log(_chalk2.default.yellow(`    "${similar.substring(0, 80)}${similar.length > 80 ? "..." : ""}"`));
+                const similarIndex = newContent.indexOf(similar);
+                if (similarIndex !== -1) {
+                  newContent = newContent.substring(0, similarIndex) + edit.new_string + newContent.substring(similarIndex + similar.length);
+                  console.log(_chalk2.default.yellow(`  \u26A0 Edit ${i + 1}: Applied with fuzzy match (whitespace/indentation differed)`));
+                  console.log(_chalk2.default.gray(`    Original search: "${edit.old_string.substring(0, 60)}${edit.old_string.length > 60 ? "..." : ""}"`));
+                  console.log(_chalk2.default.gray(`    Matched: "${similar.substring(0, 60)}${similar.length > 60 ? "..." : ""}"`));
+                  continue;
+                }
               }
+              console.log(_chalk2.default.red(`  \u2717 Edit ${i + 1}: Could not find text to replace`));
+              console.log(_chalk2.default.gray(`    Looking for (${edit.old_string.length} chars):`));
+              console.log(_chalk2.default.gray(`    "${edit.old_string.substring(0, 80)}${edit.old_string.length > 80 ? "..." : ""}"`));
               if (edit.old_string.length < 100) {
                 const nonAscii = edit.old_string.match(/[^\x20-\x7E\n\r\t]/g);
                 if (nonAscii && nonAscii.length > 0) {
@@ -3798,9 +4636,10 @@ ${result.removed.map((p) => `  - ${p}`).join("\n")}`;
         if (oldContent !== newContent) {
           this.showDiff(oldContent, newContent, action.file_path);
           await this.files.writeFile(action.file_path, newContent);
-          _optionalChain([this, 'access', _59 => _59.onFileModified, 'optionalCall', _60 => _60(action.file_path)]);
+          _optionalChain([this, 'access', _95 => _95.onFileModified, 'optionalCall', _96 => _96(action.file_path, "modify")]);
+          return this.formatDiffPreview(oldContent, newContent, action.file_path);
         }
-        return `Applied ${action.edits.length} edit(s) to ${action.file_path}`;
+        return `No changes needed for ${action.file_path} (content identical)`;
       }
       case "todo_write": {
         const todoPath = ".autohand/agents/tasks/todos.json";
@@ -3810,17 +4649,17 @@ ${result.removed.map((p) => `  - ${p}`).join("\n")}`;
         }
         const validTasks = action.tasks.filter((task) => {
           if (!task) return false;
-          const hasId = !!task.id;
           const hasContent = !!(task.content || task.title);
-          return hasId && hasContent;
+          return hasContent;
         });
-        const normalizedTasks = validTasks.map((task) => {
+        const normalizedTasks = validTasks.map((task, index) => {
           const content = task.content || task.title || "";
           const title = content;
           return {
             ...task,
             // Preserve extra properties like priority, tags, etc.
-            id: task.id,
+            id: task.id || `task-${Date.now()}-${index}`,
+            // Auto-generate id if missing
             title,
             content,
             // Keep original content field
@@ -3831,24 +4670,51 @@ ${result.removed.map((p) => `  - ${p}`).join("\n")}`;
         });
         const allTodos = normalizedTasks;
         await this.files.writeFile(todoPath, JSON.stringify(allTodos, null, 2));
-        console.log(_chalk2.default.cyan("\n\u{1F4CB} Task Progress:"));
+        _optionalChain([this, 'access', _97 => _97.onFileModified, 'optionalCall', _98 => _98(todoPath, "modify")]);
         const total = allTodos.length;
-        const completed = allTodos.filter((t) => t.status === "completed").length;
+        if (total === 0) {
+          console.log(_chalk2.default.dim("\n\u{1F4CB} Task list cleared"));
+          console.log();
+          return "Task list cleared (0 tasks)";
+        }
+        const completedTasks = allTodos.filter((t) => t.status === "completed");
         const inProgress = allTodos.filter((t) => t.status === "in_progress");
-        const pending = allTodos.filter((t) => t.status === "pending").length;
-        const percent = total > 0 ? Math.round(completed / total * 100) : 0;
+        const pendingTasks = allTodos.filter((t) => t.status === "pending");
+        const completed = completedTasks.length;
+        const pending = pendingTasks.length;
+        const percent = Math.round(completed / total * 100);
         const barWidth = 20;
         const filled = Math.round(barWidth * percent / 100);
         const bar = "\u2588".repeat(filled) + "\u2591".repeat(barWidth - filled);
-        console.log(`  ${_chalk2.default.green(bar)} ${percent}%`);
-        console.log(_chalk2.default.gray(`  ${completed} done \xB7 ${inProgress.length} in progress \xB7 ${pending} pending`));
+        const titleOf = (task) => {
+          const title = _nullishCoalesce(task.title, () => ( task.content));
+          return typeof title === "string" && title.trim().length > 0 ? title : "Untitled task";
+        };
+        const outputLines = [
+          _chalk2.default.cyan("\n\u{1F4CB} Task Progress:"),
+          `  ${_chalk2.default.green(bar)} ${percent}%`,
+          _chalk2.default.gray(`  ${completed} done \xB7 ${inProgress.length} in progress \xB7 ${pending} pending`)
+        ];
+        if (completedTasks.length > 0) {
+          outputLines.push("", _chalk2.default.green("  \u2705 Completed Tasks:"));
+          for (const task of completedTasks) {
+            outputLines.push(_chalk2.default.green(`    \u2713 ${titleOf(task)}`));
+          }
+        }
         if (inProgress.length > 0) {
-          console.log(_chalk2.default.yellow("\n  \u{1F504} Active Tasks:"));
+          outputLines.push("", _chalk2.default.yellow("  \u{1F504} Active Tasks:"));
           for (const task of inProgress) {
-            console.log(`    \u2022 ${task.title || task.content}`);
+            outputLines.push(_chalk2.default.yellow(`    \u2022 ${titleOf(task)}`));
           }
         }
-        console.log();
+        if (pendingTasks.length > 0) {
+          outputLines.push("", _chalk2.default.cyan("  \u23F3 Pending Tasks:"));
+          for (const task of pendingTasks) {
+            outputLines.push(_chalk2.default.dim(`    \u25CB ${titleOf(task)}`));
+          }
+        }
+        console.log(`${outputLines.join("\n")}
+`);
         return `Updated task list: ${percent}% complete (${completed}/${total})`;
       }
       case "save_memory": {
@@ -3876,58 +4742,21 @@ ${result.removed.map((p) => `  - ${p}`).join("\n")}`;
         return formatted;
       }
       case "create_meta_tool": {
-        if (!action.name || !action.description || !action.handler) {
-          throw new Error("create_meta_tool requires name, description, and handler");
-        }
-        const builtInNames = this.getRegisteredTools().map((t) => t.name);
-        if (builtInNames.includes(action.name)) {
-          throw new Error(`Cannot create meta-tool "${action.name}": conflicts with built-in tool`);
-        }
-        const dangerousPatterns = [
-          // Destructive file operations
-          { pattern: /rm\s+(-[rf]+\s+)*\/(?!\w)/i, description: "rm with root path" },
-          { pattern: /rm\s+.*--no-preserve-root/i, description: "rm --no-preserve-root" },
-          { pattern: /dd\s+.*(?:of|if)=\/dev\/[sh]d/i, description: "dd to disk device" },
-          { pattern: /mkfs\./i, description: "filesystem format" },
-          { pattern: /wipefs/i, description: "disk wipe" },
-          // Privilege escalation
-          { pattern: /\bsudo\s/i, description: "sudo command" },
-          { pattern: /\bsu\s+-?\s*\w/i, description: "su command" },
-          { pattern: /chmod\s+[0-7]*7[0-7]*/i, description: "world-writable chmod" },
-          { pattern: /chown\s+root/i, description: "chown to root" },
-          // Remote code execution
-          { pattern: /curl\s+.*\|\s*(ba)?sh/i, description: "curl | bash" },
-          { pattern: /wget\s+.*\|\s*(ba)?sh/i, description: "wget | sh" },
-          { pattern: /\beval\s+[`$]/i, description: "eval with expansion" },
-          // Fork bomb and resource exhaustion
-          { pattern: /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/i, description: "fork bomb" },
-          { pattern: /while\s+true.*do.*done/i, description: "infinite loop" },
-          // Reverse shell indicators
-          { pattern: /nc\s+.*-e\s*\/bin/i, description: "netcat reverse shell" },
-          { pattern: /ncat\s+.*-e\s*\/bin/i, description: "ncat reverse shell" },
-          { pattern: /bash\s+-i\s+>&?\s*\/dev\/tcp/i, description: "bash reverse shell" },
-          // Dangerous network operations
-          { pattern: /iptables\s+-F/i, description: "flush firewall rules" },
-          // Crypto operations that could lock out user
-          { pattern: /gpg\s+.*--encrypt.*-r\s+\S+\s+\//i, description: "gpg encrypt root" }
-        ];
-        for (const { pattern, description } of dangerousPatterns) {
-          if (pattern.test(action.handler)) {
-            throw new Error(`Handler contains dangerous pattern: ${description}`);
-          }
-        }
-        await this.toolsRegistry.saveMetaTool({
+        const result = await this.metaToolService.createMetaTool({
           name: action.name,
           description: action.description,
           parameters: _nullishCoalesce(action.parameters, () => ( { type: "object", properties: {} })),
           handler: action.handler,
-          source: "agent"
-        });
+          source: "agent",
+          scope: _nullishCoalesce(action.scope, () => ( "user"))
+        }, this.getRegisteredTools());
+        const metaTool = result.definition;
+        _optionalChain([this, 'access', _99 => _99.onMetaToolCreated, 'optionalCall', _100 => _100(metaTool)]);
         console.log(_chalk2.default.green(`
-\u{1F527} Created meta-tool: ${action.name}`));
+\u{1F527} ${result.status === "created" ? "Created" : "Reused"} meta-tool: ${metaTool.name}`));
         console.log(_chalk2.default.gray(`   ${action.description}`));
         console.log(_chalk2.default.gray(`   Handler: ${action.handler}`));
-        return `Created meta-tool "${action.name}" - available in this and future sessions`;
+        return result.message;
       }
       // Web Search Operations
       case "web_search": {
@@ -3936,11 +4765,11 @@ ${result.removed.map((p) => `  - ${p}`).join("\n")}`;
         }
         console.log(_chalk2.default.cyan(`
 \u{1F50D} Searching web: "${action.query}"...`));
-        const results = await _chunkRKJTGGMUcjs.webSearch.call(void 0, action.query, {
+        const results = await _chunkWKRDBCP2cjs.webSearch.call(void 0, action.query, {
           maxResults: action.max_results,
           searchType: action.search_type
         });
-        const formatted = _chunkRKJTGGMUcjs.formatSearchResults.call(void 0, results);
+        const formatted = _chunkWKRDBCP2cjs.formatSearchResults.call(void 0, results);
         console.log(_chalk2.default.gray(formatted.split("\n").slice(0, 10).join("\n")));
         if (results.length > 3) {
           console.log(_chalk2.default.gray("   ..."));
@@ -3953,7 +4782,7 @@ ${result.removed.map((p) => `  - ${p}`).join("\n")}`;
         }
         console.log(_chalk2.default.cyan(`
 \u{1F310} Fetching: ${action.url}...`));
-        const content = await _chunkRKJTGGMUcjs.fetchUrl.call(void 0, action.url, {
+        const content = await _chunkWKRDBCP2cjs.fetchUrl.call(void 0, action.url, {
           maxLength: action.max_length
         });
         const preview = content.slice(0, 500);
@@ -3967,11 +4796,11 @@ ${result.removed.map((p) => `  - ${p}`).join("\n")}`;
         const registryLabel = action.registry ? ` (${action.registry})` : "";
         console.log(_chalk2.default.cyan(`
 \u{1F4E6} Getting package info: ${action.package_name}${action.version ? `@${action.version}` : ""}${registryLabel}...`));
-        const info = await _chunkRKJTGGMUcjs.getPackageInfo.call(void 0, action.package_name, {
+        const info = await _chunkWKRDBCP2cjs.getPackageInfo.call(void 0, action.package_name, {
           registry: action.registry,
           version: action.version
         });
-        const formatted = _chunkRKJTGGMUcjs.formatPackageInfo.call(void 0, info);
+        const formatted = _chunkWKRDBCP2cjs.formatPackageInfo.call(void 0, info);
         console.log(_chalk2.default.gray(formatted));
         return formatted;
       }
@@ -4023,7 +4852,7 @@ ${result.removed.map((p) => `  - ${p}`).join("\n")}`;
         const query = _nullishCoalesce(action.query, () => ( ""));
         console.log(_chalk2.default.cyan(`
 Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...`));
-        const { searchCommunitySkills } = await Promise.resolve().then(() => _interopRequireWildcard(require("./skills-PG542VEB.cjs")));
+        const { searchCommunitySkills } = await Promise.resolve().then(() => _interopRequireWildcard(require("./skills-ZROBG3RZ.cjs")));
         const result = await searchCommunitySkills(query, {
           category: action.category,
           limit: action.limit
@@ -4049,17 +4878,17 @@ Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...
             label: `${options.length + 1}. Other (type your own answer)`,
             value: "__other__"
           });
-          const result = await _chunkZYQMLKOKcjs.showModal.call(void 0, {
+          const result = await _chunkCK4HAHVYcjs.showModal.call(void 0, {
             title: "Select an answer:",
             options
           });
-          const selected = _optionalChain([result, 'optionalAccess', _61 => _61.value]);
+          const selected = _optionalChain([result, 'optionalAccess', _101 => _101.value]);
           if (!selected) {
             console.log(_chalk2.default.yellow("\nAnswer cancelled.\n"));
             return "<answer>No answer provided</answer>";
           }
           if (selected === "__other__") {
-            const answer = await _chunkZYQMLKOKcjs.showInput.call(void 0, {
+            const answer = await _chunkCK4HAHVYcjs.showInput.call(void 0, {
               title: "Your answer:"
             });
             if (!answer) {
@@ -4076,7 +4905,7 @@ Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...
 `));
           return `<answer>${selected}</answer>`;
         } else {
-          const answer = await _chunkZYQMLKOKcjs.showInput.call(void 0, {
+          const answer = await _chunkCK4HAHVYcjs.showInput.call(void 0, {
             title: "Your answer:"
           });
           const finalAnswer = answer || "No answer provided";
@@ -4086,6 +4915,32 @@ Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...
           return `<answer>${finalAnswer}</answer>`;
         }
       }
+      // Code review tool
+      // Directory access tool
+      case "request_directory_access": {
+        return this.executeRequestDirectoryAccess(action);
+      }
+      case "code_review": {
+        return this.executeCodeReview(action);
+      }
+      // Browser tools — forwarded to Chrome extension via RPC
+      case "browser_screenshot":
+      case "browser_click":
+      case "browser_type":
+      case "browser_navigate":
+      case "browser_scroll":
+      case "browser_find_element":
+      case "browser_press_key":
+      case "browser_get_page_context":
+      case "browser_get_element":
+      case "browser_wait_for_element":
+      case "browser_read_network":
+      case "browser_read_console":
+      case "browser_get_tabs":
+      case "browser_get_tab_groups":
+      case "browser_execute_js": {
+        return this.executeBrowserTool(action);
+      }
       default: {
         const actionType = action.type;
         const metaTool = this.toolsRegistry.getMetaTool(actionType);
@@ -4096,6 +4951,145 @@ Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...
       }
     }
   }
+  async executeBrowserTool(action) {
+    const { type, ...params } = action;
+    const toolName = type;
+    const { invokeBrowserTool } = await Promise.resolve().then(() => _interopRequireWildcard(require("./browserToolBridge-BXRQB4B4.cjs")));
+    return invokeBrowserTool(toolName, params);
+  }
+  async executeRequestDirectoryAccess(action) {
+    const path8 = await Promise.resolve().then(() => _interopRequireWildcard(require("path")));
+    const fs7 = (await Promise.resolve().then(() => _interopRequireWildcard(require("fs-extra")))).default;
+    const { checkWorkspaceSafety } = await Promise.resolve().then(() => _interopRequireWildcard(require("./workspaceSafety-MDJGHK6D.cjs")));
+    const resolvedPath = path8.resolve(action.path);
+    if (!await fs7.pathExists(resolvedPath)) {
+      return `Error: Directory does not exist: ${resolvedPath}`;
+    }
+    const stats = await fs7.stat(resolvedPath);
+    if (!stats.isDirectory()) {
+      return `Error: Path is not a directory: ${resolvedPath}`;
+    }
+    const safetyResult = checkWorkspaceSafety(resolvedPath);
+    if (!safetyResult.safe) {
+      return `Error: Unsafe directory: ${resolvedPath}. ${safetyResult.reason}`;
+    }
+    const workspaceRoot = this.runtime.workspaceRoot;
+    const additionalDirs = this.files.getAllowedDirectories();
+    if (resolvedPath === workspaceRoot || additionalDirs.includes(resolvedPath)) {
+      return `Directory is already accessible: ${resolvedPath}`;
+    }
+    const normalizedResolved = resolvedPath.endsWith(path8.sep) ? resolvedPath.slice(0, -1) : resolvedPath;
+    const normalizedWorkspace = workspaceRoot.endsWith(path8.sep) ? workspaceRoot.slice(0, -1) : workspaceRoot;
+    if (normalizedResolved.startsWith(normalizedWorkspace + path8.sep)) {
+      return `Directory is already within workspace: ${resolvedPath}`;
+    }
+    for (const dir of additionalDirs) {
+      const normalizedDir = dir.endsWith(path8.sep) ? dir.slice(0, -1) : dir;
+      if (normalizedResolved.startsWith(normalizedDir + path8.sep) || normalizedResolved === normalizedDir) {
+        return `Directory is already accessible: ${resolvedPath}`;
+      }
+    }
+    if (this.onRequestDirectoryAccess) {
+      const result = await this.onRequestDirectoryAccess(resolvedPath, action.reason);
+      if (result) {
+        this.files.addAdditionalDirectory(resolvedPath);
+        return `Access granted to directory: ${resolvedPath}
+
+You can now use file tools (read_file, write_file, glob, find, etc.) to work with files in this directory.`;
+      } else {
+        return `Access denied to directory: ${resolvedPath}`;
+      }
+    }
+    const normalizedYolo = _chunkJ5HE6CUMcjs.normalizeYoloInput.call(void 0, this.runtime.options.yolo);
+    if (normalizedYolo) {
+      this.files.addAdditionalDirectory(resolvedPath);
+      return `Access auto-granted (yolo mode) to directory: ${resolvedPath}
+
+You can now use file tools (read_file, write_file, glob, find, etc.) to work with files in this directory.`;
+    }
+    if (this.runtime.options.unrestricted || this.runtime.options.yes) {
+      this.files.addAdditionalDirectory(resolvedPath);
+      return `Access auto-granted to directory: ${resolvedPath}
+
+You can now use file tools (read_file, write_file, glob, find, etc.) to work with files in this directory.`;
+    }
+    return `Directory access required: ${resolvedPath}
+
+To grant access, use:
+  /add-dir ${resolvedPath}
+
+Or restart with:
+  --add-dir ${resolvedPath}`;
+  }
+  async executeCodeReview(action) {
+    const targetPath = action.path ? this.resolveWorkspacePath(action.path) : this.runtime.workspaceRoot;
+    const scope = action.scope || "full";
+    await _optionalChain([this, 'access', _102 => _102.onReviewHook, 'optionalCall', _103 => _103("review:start", {
+      reviewPath: targetPath,
+      reviewScope: scope,
+      reviewInstructions: action.instructions
+    })]);
+    try {
+      let context = "";
+      if (scope === "diff") {
+        const { execFile: execFile2 } = await Promise.resolve().then(() => _interopRequireWildcard(require("child_process")));
+        const { promisify } = await Promise.resolve().then(() => _interopRequireWildcard(require("util")));
+        const execFileAsync = promisify(execFile2);
+        const result2 = await execFileAsync("git", ["diff", "--stat"], {
+          cwd: this.runtime.workspaceRoot,
+          encoding: "utf8"
+        }).catch(() => null);
+        context = _optionalChain([result2, 'optionalAccess', _104 => _104.stdout]) || "No uncommitted changes found.";
+      } else if (scope === "file" && action.path) {
+        const fse = (await Promise.resolve().then(() => _interopRequireWildcard(require("fs-extra")))).default;
+        context = await fse.readFile(targetPath, "utf-8").catch(() => `Could not read ${targetPath}`);
+      } else {
+        const { execFile: execFile2 } = await Promise.resolve().then(() => _interopRequireWildcard(require("child_process")));
+        const { promisify } = await Promise.resolve().then(() => _interopRequireWildcard(require("util")));
+        const execFileAsync = promisify(execFile2);
+        const tree = await execFileAsync("find", [
+          targetPath,
+          "-maxdepth",
+          "3",
+          "-type",
+          "f",
+          "-not",
+          "-path",
+          "*/node_modules/*",
+          "-not",
+          "-path",
+          "*/.git/*"
+        ], {
+          cwd: this.runtime.workspaceRoot,
+          encoding: "utf8"
+        }).catch(() => null);
+        context = _optionalChain([tree, 'optionalAccess', _105 => _105.stdout]) || "";
+      }
+      const result = [
+        `Code review initiated for: ${targetPath}`,
+        `Scope: ${scope}`,
+        action.instructions ? `Focus: ${action.instructions}` : "",
+        "",
+        "Project structure:",
+        context.slice(0, 5e3)
+      ].filter(Boolean).join("\n");
+      await _optionalChain([this, 'access', _106 => _106.onReviewHook, 'optionalCall', _107 => _107("review:completed", {
+        reviewPath: targetPath,
+        reviewScope: scope,
+        reviewInstructions: action.instructions
+      })]);
+      return result;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      await _optionalChain([this, 'access', _108 => _108.onReviewHook, 'optionalCall', _109 => _109("review:failed", {
+        reviewPath: targetPath,
+        reviewScope: scope,
+        reviewInstructions: action.instructions,
+        reviewError: message
+      })]);
+      return `Review failed: ${message}`;
+    }
+  }
   pickText(...values) {
     for (const value of values) {
       if (typeof value === "string") {
@@ -4109,7 +5103,7 @@ Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...
    * Identifies imports, classes, functions, and key sections with line numbers.
    */
   extractFileOutline(lines, filePath) {
-    const ext = _optionalChain([filePath, 'access', _62 => _62.split, 'call', _63 => _63("."), 'access', _64 => _64.pop, 'call', _65 => _65(), 'optionalAccess', _66 => _66.toLowerCase, 'call', _67 => _67()]) || "";
+    const ext = _optionalChain([filePath, 'access', _110 => _110.split, 'call', _111 => _111("."), 'access', _112 => _112.pop, 'call', _113 => _113(), 'optionalAccess', _114 => _114.toLowerCase, 'call', _115 => _115()]) || "";
     const outline = [];
     const patterns = {
       ts: [
@@ -4192,11 +5186,127 @@ Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...
     }
     return result.length > 0 ? result.join("\n") : "No structure detected";
   }
+  executeFind(action) {
+    console.warn(_chalk2.default.yellow("[DEPRECATED] The `find` tool is deprecated. Use `fff_grep` instead. Will be removed in v0.9.0."));
+    const mode = _nullishCoalesce(action.mode, () => ( (action.context && action.context > 0 ? "context" : "exact")));
+    const cacheKey = `find:${mode}:${action.query}:${action.path || ""}:${action.limit || ""}:${action.context || ""}:${action.window || ""}`;
+    if (this.searchCache.has(cacheKey)) {
+      return `[Cached] ${this.searchCache.get(cacheKey)}`;
+    }
+    this.recordExploration("search", action.query);
+    if (mode === "semantic") {
+      const results = this.files.semanticSearch(action.query, {
+        limit: action.limit,
+        window: action.window,
+        relativePath: action.path
+      });
+      if (!results.length) {
+        this.searchCache.set(cacheKey, "No matches found.");
+        return "No matches found.";
+      }
+      const result2 = results.map((hit) => `${_chalk2.default.cyan(hit.file)}
+${hit.snippet}`).join("\n\n");
+      this.searchCache.set(cacheKey, result2);
+      return result2;
+    }
+    if (mode === "context") {
+      const result2 = this.files.searchWithContext(action.query, {
+        limit: action.limit,
+        context: action.context,
+        relativePath: action.path
+      });
+      this.searchCache.set(cacheKey, result2);
+      return result2;
+    }
+    const hits = this.files.search(action.query, action.path);
+    const result = hits.slice(0, _nullishCoalesce(action.limit, () => ( 10))).map((hit) => `${hit.file}:${hit.line}: ${hit.text}`).join("\n");
+    this.searchCache.set(cacheKey, result);
+    return result;
+  }
+  async executeGlob(action) {
+    console.warn(_chalk2.default.yellow("[DEPRECATED] The `glob` tool is deprecated. Use `fff_find` instead. Will be removed in v0.9.0."));
+    const { resolveRipgrepCommand } = await Promise.resolve().then(() => _interopRequireWildcard(require("./ripgrep-67SCU2BA.cjs")));
+    const rgPath = resolveRipgrepCommand();
+    const searchPath = action.path ? this.resolveWorkspacePath(action.path) : this.runtime.workspaceRoot;
+    const limit = _nullishCoalesce(action.limit, () => ( 100));
+    const args = ["--files"];
+    const patterns = _nullishCoalesce(action.patterns, () => ( (action.pattern ? [action.pattern] : ["**/*"])));
+    for (const p of patterns) {
+      args.push("--glob", p);
+    }
+    args.push(searchPath);
+    const { execFile: execFile2 } = await Promise.resolve().then(() => _interopRequireWildcard(require("child_process")));
+    const { promisify } = await Promise.resolve().then(() => _interopRequireWildcard(require("util")));
+    const execFileAsync = promisify(execFile2);
+    try {
+      const result = await execFileAsync(rgPath, args, {
+        cwd: this.runtime.workspaceRoot,
+        encoding: "utf8",
+        maxBuffer: 10 * 1024 * 1024
+      });
+      const files = result.stdout.trim().split("\n").filter(Boolean);
+      if (files.length === 0) {
+        return "No files found matching the pattern.";
+      }
+      const fse = (await Promise.resolve().then(() => _interopRequireWildcard(require("fs-extra")))).default;
+      const withStats = await Promise.all(
+        files.map(async (f) => {
+          try {
+            const stat = await fse.stat(f);
+            return { file: f, mtime: stat.mtimeMs };
+          } catch (e8) {
+            return { file: f, mtime: 0 };
+          }
+        })
+      );
+      withStats.sort((a, b) => b.mtime - a.mtime);
+      const sorted = withStats.map((s) => s.file);
+      const limited = sorted.slice(0, limit);
+      const header = `Found ${files.length} file${files.length === 1 ? "" : "s"}${files.length > limit ? ` (showing first ${limit})` : ""}`;
+      this.recordExploration("list", _nullishCoalesce(_nullishCoalesce(action.pattern, () => ( _optionalChain([action, 'access', _116 => _116.patterns, 'optionalAccess', _117 => _117.join, 'call', _118 => _118(", ")]))), () => ( "*")));
+      return `${header}
+${limited.join("\n")}`;
+    } catch (error) {
+      const exitCode = _optionalChain([error, 'optionalAccess', _119 => _119.code]);
+      if (exitCode === 1 || exitCode === "1") {
+        return "No files found matching the pattern.";
+      }
+      throw error;
+    }
+  }
+  async executeFFFGrep(action) {
+    const provider = await this.getFFFSearchProvider();
+    try {
+      return await provider.grep({
+        query: action.query,
+        path: action.path,
+        exclude: action.exclude,
+        caseSensitive: action.caseSensitive,
+        beforeContext: action.beforeContext,
+        afterContext: action.afterContext,
+        classifyDefinitions: action.classifyDefinitions,
+        limit: action.limit
+      });
+    } finally {
+      this.scheduleFFFSearchProviderCleanup();
+    }
+  }
+  async executeFFFFind(action) {
+    const provider = await this.getFFFSearchProvider();
+    try {
+      return await provider.fileSearch({
+        query: action.query,
+        limit: action.limit
+      });
+    } finally {
+      this.scheduleFFFSearchProviderCleanup();
+    }
+  }
   recordExploration(kind, target) {
     if (!target) {
       return;
     }
-    _optionalChain([this, 'access', _68 => _68.logExploration, 'optionalCall', _69 => _69({ kind, target })]);
+    _optionalChain([this, 'access', _120 => _120.logExploration, 'optionalCall', _121 => _121({ kind, target })]);
   }
   async executeCustomCommand(action) {
     const existing = await loadCustomCommand(action.name);
@@ -4226,19 +5336,13 @@ Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...
       }
       await saveCustomCommand(definition);
     }
-    const result = await runCommand(definition.command, _nullishCoalesce(definition.args, () => ( [])), this.runtime.workspaceRoot);
+    const result = await _chunkWTB7AFL6cjs.runCommand.call(void 0, definition.command, _nullishCoalesce(definition.args, () => ( [])), this.runtime.workspaceRoot);
     return [`$ ${definition.command} ${(_nullishCoalesce(definition.args, () => ( []))).join(" ")}`, result.stdout, result.stderr].filter(Boolean).join("\n");
   }
   isDestructiveCommand(command) {
     const lowered = command.toLowerCase();
     return lowered.includes("rm ") || lowered.includes("sudo ") || lowered.includes("dd ");
   }
-  static {
-    /**
-     * Shell metacharacters that could enable command injection
-     */
-    this.SHELL_METACHARACTERS = /[|;&$`><(){}[\]!#*?~'"\\]/;
-  }
   /**
    * Safely escape a value for shell interpolation
    * Uses single quotes which prevent all shell expansion except for single quotes themselves
@@ -4259,21 +5363,62 @@ Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...
       if (value === void 0 || value === null) {
         throw new Error(`Missing required parameter "${paramName}" for meta-tool "${metaTool.name}"`);
       }
-      const stringValue = String(value);
-      let safeValue;
-      if (_ActionExecutor.SHELL_METACHARACTERS.test(stringValue)) {
-        safeValue = this.shellEscape(stringValue);
-        console.log(_chalk2.default.yellow(`   \u26A0 Parameter "${paramName}" contains shell metacharacters, escaped for safety`));
-      } else {
-        safeValue = stringValue;
-      }
+      const safeValue = this.shellEscape(String(value));
+      command = command.replace(new RegExp(`(["'])\\{\\{${paramName}\\}\\}\\1`, "g"), safeValue);
       command = command.replace(new RegExp(`\\{\\{${paramName}\\}\\}`, "g"), safeValue);
     }
     console.log(_chalk2.default.cyan(`
 \u{1F527} Running meta-tool: ${metaTool.name}`));
     console.log(_chalk2.default.gray(`   $ ${command}`));
-    const result = await runCommand(command, [], this.runtime.workspaceRoot, { shell: true });
-    return [`$ ${command}`, result.stdout, result.stderr].filter(Boolean).join("\n");
+    const permissionContext = {
+      tool: "run_command",
+      command,
+      description: `Meta-tool ${metaTool.name}: ${metaTool.description}`
+    };
+    const decision = this.permissionManager.checkPermission(permissionContext);
+    if (decision.reason === "blacklisted" || decision.reason === "mode_restricted" || decision.reason === "pattern_denied" || decision.reason === "not_in_available" || decision.reason === "excluded" || decision.reason === "deny_list" || decision.reason === "session_deny_list" || decision.reason === "project_deny_list" || decision.reason === "user_deny_list") {
+      return `Blocked: Cannot run meta-tool ${metaTool.name} (${decision.reason})`;
+    }
+    if (!decision.allowed) {
+      const hookResult = await this.checkPermissionHook({
+        tool: "run_command",
+        command,
+        args
+      });
+      if (hookResult.blocked) {
+        return `Blocked: ${hookResult.reason}`;
+      }
+      if (hookResult.allowed !== void 0) {
+        await this.permissionManager.recordDecision(permissionContext, hookResult.allowed);
+        if (!hookResult.allowed) {
+          return `Denied: ${_nullishCoalesce(hookResult.reason, () => ( `meta-tool ${metaTool.name}`))}`;
+        }
+      } else {
+        const confirmed = await this.confirmDangerousAction(
+          `Run meta-tool ${metaTool.name}?`,
+          { tool: "run_command", command }
+        );
+        await this.permissionManager.recordDecision(permissionContext, confirmed);
+        if (!confirmed) {
+          return `Skipped running meta-tool ${metaTool.name}`;
+        }
+      }
+    }
+    const result = await _chunkWTB7AFL6cjs.runCommand.call(void 0, command, [], this.runtime.workspaceRoot, {
+      shell: true,
+      timeout: 12e4
+    });
+    const stdout = this.truncateMetaToolOutput(result.stdout);
+    const stderr = this.truncateMetaToolOutput(result.stderr);
+    return [`$ ${command}`, stdout, stderr].filter(Boolean).join("\n");
+  }
+  truncateMetaToolOutput(output) {
+    const limit = 2e5;
+    if (output.length <= limit) {
+      return output;
+    }
+    return `${output.slice(0, limit)}
+[meta-tool output truncated at ${limit} characters]`;
   }
   applySearchReplaceBlocks(content, blocks) {
     let result = content;
@@ -4368,17 +5513,17 @@ Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...
         score += 2;
       }
       if (score > 0 && (!bestMatch || score > bestMatch.score)) {
-        bestMatch = { line: line.trim(), score };
+        bestMatch = { line: line.trim(), originalLine: line, score };
       }
     }
-    return bestMatch && bestMatch.score >= 2 ? bestMatch.line : null;
+    return bestMatch && bestMatch.score >= 2 ? bestMatch.originalLine : null;
   }
   /**
    * Colorize raw git diff output with green for additions and red for removals
    */
   colorizeGitDiff(diffOutput) {
-    const useTheme = _chunkU55TWFJIcjs.isThemeInitialized.call(void 0, );
-    const theme = useTheme ? _chunkU55TWFJIcjs.getTheme.call(void 0, ) : null;
+    const useTheme = _chunk2VHB43IXcjs.isThemeInitialized.call(void 0, );
+    const theme = useTheme ? _chunk2VHB43IXcjs.getTheme.call(void 0, ) : null;
     if (!diffOutput || diffOutput === "No diff") {
       return theme ? theme.fg("muted", "No changes") : _chalk2.default.gray("No changes");
     }
@@ -4387,12 +5532,12 @@ Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...
     const colorizedLines = [];
     let additions = 0;
     let deletions = 0;
-    const addedColor = _optionalChain([theme, 'optionalAccess', _70 => _70.getColor, 'call', _71 => _71("diffAdded")]) || "#4caf50";
-    const removedColor = _optionalChain([theme, 'optionalAccess', _72 => _72.getColor, 'call', _73 => _73("diffRemoved")]) || "#f44336";
-    const contextColor = _optionalChain([theme, 'optionalAccess', _74 => _74.getColor, 'call', _75 => _75("diffContext")]) || "#9e9e9e";
-    const accentColor = _optionalChain([theme, 'optionalAccess', _76 => _76.getColor, 'call', _77 => _77("accent")]) || "#00bcd4";
-    const addedRgb = _chunkU55TWFJIcjs.hexToRgb.call(void 0, addedColor);
-    const removedRgb = _chunkU55TWFJIcjs.hexToRgb.call(void 0, removedColor);
+    const addedColor = _optionalChain([theme, 'optionalAccess', _122 => _122.getColor, 'call', _123 => _123("diffAdded")]) || "#4caf50";
+    const removedColor = _optionalChain([theme, 'optionalAccess', _124 => _124.getColor, 'call', _125 => _125("diffRemoved")]) || "#f44336";
+    const contextColor = _optionalChain([theme, 'optionalAccess', _126 => _126.getColor, 'call', _127 => _127("diffContext")]) || "#9e9e9e";
+    const accentColor = _optionalChain([theme, 'optionalAccess', _128 => _128.getColor, 'call', _129 => _129("accent")]) || "#00bcd4";
+    const addedRgb = _chunk2VHB43IXcjs.hexToRgb.call(void 0, addedColor);
+    const removedRgb = _chunk2VHB43IXcjs.hexToRgb.call(void 0, removedColor);
     const addBgR = addedRgb ? Math.floor(addedRgb.r * 0.15) : 30;
     const addBgG = addedRgb ? Math.floor(addedRgb.g * 0.2) : 50;
     const addBgB = addedRgb ? Math.floor(addedRgb.b * 0.15) : 30;
@@ -4457,12 +5602,16 @@ Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...
     }
   }
   showDiff(oldContent, newContent, filePath) {
+    console.log(this.formatDiffPreview(oldContent, newContent, filePath));
+    console.log();
+  }
+  formatDiffPreview(oldContent, newContent, filePath) {
     const diff = _diff.diffLines.call(void 0, oldContent, newContent);
     const contextLines = 3;
     const lang = filePath ? detectLanguage(filePath) : "text";
     const shouldHighlight = lang !== "text";
-    const useTheme = _chunkU55TWFJIcjs.isThemeInitialized.call(void 0, );
-    const theme = useTheme ? _chunkU55TWFJIcjs.getTheme.call(void 0, ) : null;
+    const useTheme = _chunk2VHB43IXcjs.isThemeInitialized.call(void 0, );
+    const theme = useTheme ? _chunk2VHB43IXcjs.getTheme.call(void 0, ) : null;
     let additions = 0;
     let deletions = 0;
     for (const part of diff) {
@@ -4473,10 +5622,11 @@ Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...
     const termWidth = process.stdout.columns || 100;
     const addText = additions === 1 ? "1 line" : `${additions} lines`;
     const delText = deletions === 1 ? "1 line" : `${deletions} lines`;
+    const outputLines = [];
     if (theme) {
-      console.log(theme.fg("muted", `  Added ${theme.fg("diffAdded", addText)}, removed ${theme.fg("diffRemoved", delText)}`));
+      outputLines.push(theme.fg("muted", `  Added ${theme.fg("diffAdded", addText)}, removed ${theme.fg("diffRemoved", delText)}`));
     } else {
-      console.log(_chalk2.default.gray(`  Added ${_chalk2.default.green(addText)}, removed ${_chalk2.default.red(delText)}`));
+      outputLines.push(_chalk2.default.gray(`  Added ${_chalk2.default.green(addText)}, removed ${_chalk2.default.red(delText)}`));
     }
     const hunks = [];
     let currentHunk = null;
@@ -4559,48 +5709,69 @@ Searching skills: "${query}"${action.category ? ` [${action.category}]` : ""}...
           const removedColor = theme.getColor("diffRemoved");
           const contextColor = theme.getColor("diffContext");
           if (change.type === "add") {
-            const addedRgb = _chunkU55TWFJIcjs.hexToRgb.call(void 0, addedColor);
+            const addedRgb = _chunk2VHB43IXcjs.hexToRgb.call(void 0, addedColor);
             const bgR = addedRgb ? Math.floor(addedRgb.r * 0.15) : 30;
             const bgG = addedRgb ? Math.floor(addedRgb.g * 0.2) : 50;
             const bgB = addedRgb ? Math.floor(addedRgb.b * 0.15) : 30;
             const prefix = _chalk2.default.bgHex(addedColor).black(` ${lineNumStr} + `);
             const content = _chalk2.default.bgRgb(bgR, bgG, bgB)(` ${highlighted} `.padEnd(Math.max(termWidth - 10, change.line.length + 2)));
-            console.log(prefix + content);
+            outputLines.push(prefix + content);
           } else if (change.type === "remove") {
-            const removedRgb = _chunkU55TWFJIcjs.hexToRgb.call(void 0, removedColor);
+            const removedRgb = _chunk2VHB43IXcjs.hexToRgb.call(void 0, removedColor);
             const bgR = removedRgb ? Math.floor(removedRgb.r * 0.25) : 60;
             const bgG = removedRgb ? Math.floor(removedRgb.g * 0.15) : 30;
             const bgB = removedRgb ? Math.floor(removedRgb.b * 0.15) : 30;
             const prefix = _chalk2.default.bgHex(removedColor).white(` ${lineNumStr} - `);
             const content = _chalk2.default.bgRgb(bgR, bgG, bgB)(` ${highlighted} `.padEnd(Math.max(termWidth - 10, change.line.length + 2)));
-            console.log(prefix + content);
+            outputLines.push(prefix + content);
           } else {
-            console.log(_chalk2.default.hex(contextColor)(` ${lineNumStr}   `) + ` ${highlighted}`);
+            outputLines.push(_chalk2.default.hex(contextColor)(` ${lineNumStr}   `) + ` ${highlighted}`);
           }
         } else {
           if (change.type === "add") {
             const prefix = _chalk2.default.bgGreen.black(` ${lineNumStr} + `);
             const content = _chalk2.default.bgRgb(30, 50, 30)(` ${highlighted} `.padEnd(Math.max(termWidth - 10, change.line.length + 2)));
-            console.log(prefix + content);
+            outputLines.push(prefix + content);
           } else if (change.type === "remove") {
             const prefix = _chalk2.default.bgRed.white(` ${lineNumStr} - `);
             const content = _chalk2.default.bgRgb(60, 30, 30)(` ${highlighted} `.padEnd(Math.max(termWidth - 10, change.line.length + 2)));
-            console.log(prefix + content);
+            outputLines.push(prefix + content);
           } else {
-            console.log(_chalk2.default.gray(` ${lineNumStr}   `) + ` ${highlighted}`);
+            outputLines.push(_chalk2.default.gray(` ${lineNumStr}   `) + ` ${highlighted}`);
           }
         }
       }
     }
-    console.log();
+    return outputLines.join("\n");
   }
-};
+}, _class3.__initStatic(), _class3);
+function parseGoalStatus(value) {
+  if (!value) return void 0;
+  if (value === "active" || value === "paused" || value === "complete" || value === "budgetLimited") {
+    return value;
+  }
+  return void 0;
+}
+function formatGoalToolResult(result) {
+  return JSON.stringify({
+    ok: result.ok,
+    message: result.message,
+    goal: result.goal,
+    queue: result.queue,
+    queued: result.queued,
+    started: result.started,
+    dequeued: result.dequeued,
+    removed: result.removed,
+    telemetry: result.telemetry
+  }, null, 2);
+}
+
 
 
 
 
 
-exports.getAutoCommitInfo = getAutoCommitInfo; exports.ToolsRegistry = ToolsRegistry; exports.ActionExecutor = ActionExecutor;
+exports.getAutoCommitInfo = getAutoCommitInfo; exports.WorktreeManager = WorktreeManager; exports.createToolsRegistry = createToolsRegistry; exports.ActionExecutor = ActionExecutor;
 /**
  * @license
  * Copyright 2025 Autohand AI LLC