chainlesschain 0.162.175 → 0.162.177

package/src/runtime/agent-core.js

@@ -16,14 +16,14 @@
 
 import fs from "fs";
 import path from "path";
-import { execSync, spawn, spawnSync } from "child_process";
+import broker from "../lib/process-execution-broker/index.js";
 import os from "os";
 import sharedCodingAgentPolicy from "./coding-agent-policy.cjs";
 import sharedShellPolicy from "./coding-agent-shell-policy.cjs";
 import sharedPermissionRules from "../lib/permission-rules.cjs";
 import sharedSettingsHooks from "../lib/settings-hooks.cjs";
-import sharedHookRunner from "../lib/hook-runner.cjs";
-import sharedHookEvents from "../lib/settings-hook-events.cjs";
+import sharedHookRunner from "../lib/hook-runner.js";
+import sharedHookEvents from "../lib/settings-hook-events.js";
 import { mergeProviderOptions } from "../lib/provider-options.js";
 import { applyCredentialProxy } from "../lib/credential-proxy.js";
 import { describeBackgroundCommand } from "../lib/terminal-context.js";
@@ -47,6 +47,7 @@ import {
 import {
   getCodingAgentFunctionToolDefinitions,
   listCodingAgentToolNames,
+  getCodingAgentToolPolicy,
 } from "./coding-agent-contract.js";
 import { createToolContext } from "../tools/tool-context.js";
 import { createToolTelemetryRecord } from "../tools/tool-telemetry.js";
@@ -78,6 +79,12 @@ import {
   imageUrlBlockToAnthropic,
 } from "../lib/image-input.js";
 import { executeToolSearch, gateDeferredMcpCall } from "./mcp-tool-search.js";
+import { emitHooksV2Event } from "../lib/hooks-v2-producers.js";
+import {
+  admitTool,
+  buildToolAttribution,
+} from "../lib/agent-tool-admission.js";
+import { evaluateUnattendedShellAction } from "../lib/unattended-action-policy.js";
 
 /**
  * Names of MCP servers currently mounted by an in-flight run_skill call.
@@ -105,6 +112,33 @@ const {
   withDeliveryId,
 } = sharedHookEvents;
 
+const searchProcessRunner = broker.execSync.bind(broker);
+const runCodeProcessRunner = broker.execFileSync.bind(broker);
+
+export const _agentToolProcessDeps = {
+  runSearch: searchProcessRunner,
+  runCode: runCodeProcessRunner,
+};
+
+function runSearchProcess(command, options = {}) {
+  return _agentToolProcessDeps.runSearch(command, {
+    ...options,
+    origin: "agent-core:search-files",
+    policy: "allow",
+    scope: "agent-core",
+  });
+}
+
+function runCodeProcess(file, args, options = {}, origin = "run-code") {
+  return _agentToolProcessDeps.runCode(file, args, {
+    ...options,
+    origin: `agent-core:${origin}`,
+    policy: "allow",
+    scope: "agent-core",
+    shell: false,
+  });
+}
+
 // ─── Background shell tasks ────────────────────────────────────────────────
 //
 // run_shell is synchronous (execSync) and capped at a foreground timeout, which
@@ -223,25 +257,54 @@ function _releaseBgChildHandles(task) {
   }
 }
 
+const backgroundTaskRunner = broker.spawn.bind(broker);
+const backgroundTaskSyncRunner = broker.spawnSync.bind(broker);
+
+export const _backgroundProcessDeps = {
+  run: backgroundTaskRunner,
+  runSync: backgroundTaskSyncRunner,
+};
+
+export function _runBackgroundTaskkill(pid, { sync = false } = {}) {
+  const args = ["/pid", String(pid), "/T", "/F"];
+  const options = {
+    windowsHide: true,
+    origin: "agent-core:background-taskkill",
+    policy: "allow",
+    scope: "agent-core",
+  };
+  return sync
+    ? _backgroundProcessDeps.runSync("taskkill", args, options)
+    : _backgroundProcessDeps.run("taskkill", args, options);
+}
+
+const gitProcessRunner = broker.spawnSync.bind(broker);
+
+export const _gitProcessDeps = {
+  run: gitProcessRunner,
+};
+
 function _killTask(task) {
   const child = task?.child;
   if (!child || child.killed || task?.status !== "running") return false;
   try {
     if (process.platform === "win32") {
       if (child.pid) {
-        const tk = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
-          windowsHide: true,
-        });
-        // A spawn that fails to launch emits an async 'error' event — with no
-        // listener Node rethrows it as an UNCAUGHT exception (the try/catch
-        // here can't catch the async emit), crashing the CLI. Handle it and
-        // fall back to a direct kill.
-        tk.on("error", () => {
+        const tk = _runBackgroundTaskkill(child.pid);
+        const fallbackDirectKill = () => {
           try {
-            child.kill();
+            if (!child.killed) child.kill("SIGKILL");
           } catch {
             /* already dead */
           }
+        };
+        // A launch failure emits 'error'; a permissions/policy failure instead
+        // launches taskkill successfully and exits non-zero. Both must fall
+        // back or the background command remains alive while teardown reports
+        // success.
+        tk.once("error", fallbackDirectKill);
+        tk.once("close", (code) => {
+          if (code !== 0) fallbackDirectKill();
         });
       } else {
         child.kill();
@@ -302,9 +365,13 @@ function _killTaskSync(task) {
   try {
     if (process.platform === "win32") {
       if (child.pid) {
-        spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
-          windowsHide: true,
-        });
+        const killed = _runBackgroundTaskkill(child.pid, { sync: true });
+        if (killed.error || killed.status !== 0) {
+          // Restricted runners can execute taskkill but receive a non-zero
+          // access/policy result. Direct termination is the synchronous
+          // last-resort for the child handle we own.
+          child.kill("SIGKILL");
+        }
       } else {
         child.kill();
       }
@@ -470,8 +537,9 @@ async function runSettingsPreToolUseHooks(name, args, context, cwd) {
     ? await runCommandHooksParallel(matched, payload, {
         cwd,
         event: "PreToolUse",
+        broker,
       })
-    : runCommandHooks(matched, payload, { cwd, event: "PreToolUse" });
+    : runCommandHooks(matched, payload, { cwd, event: "PreToolUse", broker });
   if (outcome.decision === "block") {
     return { blocked: true, reason: outcome.reason, hook: outcome.hook };
   }
@@ -552,6 +620,7 @@ function runSettingsPermissionRequestHooks(name, args, context, cwd, reason) {
     cwd,
     event: "PermissionRequest",
     mergeStrict: _hookStrictMergeEnabled(),
+    broker,
   });
   // Precedence: deny > ask > allow > defer. The runner normalizes deny/block →
   // "block" and short-circuits block/ask, but it COLLAPSES an "allow" into the
@@ -683,6 +752,21 @@ export function reloadSkills() {
 let _cachedPython = null;
 let _cachedEnvInfo = null;
 
+const environmentProbeRunner = broker.execFileSync.bind(broker);
+
+export const _environmentProcessDeps = {
+  run: environmentProbeRunner,
+};
+
+function runEnvironmentProbe(file, args, options = {}) {
+  return _environmentProcessDeps.run(file, args, {
+    ...options,
+    origin: "agent-core:environment-probe",
+    policy: "allow",
+    scope: "agent-core",
+  });
+}
+
 /**
  * Get cached Python interpreter info (reuses cli-anything-bridge detection).
  * @returns {{ found: boolean, command?: string, version?: string }}
@@ -706,7 +790,7 @@ export function getEnvironmentInfo() {
   let pipAvailable = false;
   if (py.found) {
     try {
-      execSync(`${py.command} -m pip --version`, {
+      runEnvironmentProbe(py.command, ["-m", "pip", "--version"], {
         encoding: "utf-8",
         timeout: 10000,
         stdio: ["pipe", "pipe", "pipe"],
@@ -719,7 +803,7 @@ export function getEnvironmentInfo() {
 
   let nodeVersion = null;
   try {
-    nodeVersion = execSync("node --version", {
+    nodeVersion = runEnvironmentProbe(process.execPath, ["--version"], {
       encoding: "utf-8",
       timeout: 5000,
     }).trim();
@@ -729,7 +813,7 @@ export function getEnvironmentInfo() {
 
   let gitAvailable = false;
   try {
-    execSync("git --version", {
+    runEnvironmentProbe("git", ["--version"], {
       encoding: "utf-8",
       timeout: 5000,
       stdio: ["pipe", "pipe", "pipe"],
@@ -770,6 +854,7 @@ You have access to tools that let you read files, write files, edit files, run s
 Key behaviors:
 - When asked to modify code, read the file first, then edit it
 - When asked to create something, use write_file to create it
+- When asked to remove or rename a file, use delete_file or move_file so the filesystem intent is explicit and reviewable
 - When asked to run/test something, use run_shell to execute it
 - For long-running commands (builds, full test suites, dev servers) set run_shell { run_in_background: true } to get a task_id back immediately, then poll output and completion with check_shell { task_id }. Kill a backgrounded server with check_shell { task_id, kill: true } when finished
 - When asked about git status, diff, log, or other repository operations, use the git tool instead of run_shell
@@ -926,6 +1011,9 @@ export function buildSystemPrompt(cwd, opts = {}) {
     const personaSkills = allSkills.filter(
       (s) => s.category === "persona" && s.activation === "auto",
     );
+    if (typeof opts.onSkillsLoaded === "function") {
+      opts.onSkillsLoaded(personaSkills);
+    }
     for (const p of personaSkills) {
       if (p.body?.trim()) {
         prompt += `\n\n## Persona: ${p.displayName}\n${p.body}`;
@@ -1016,8 +1104,21 @@ const IDE_DIFF_EDIT_TOOLS = new Set([
   "write_file",
   "edit_file",
   "edit_file_hashed",
+  "delete_file",
+  "move_file",
+]);
+const GUARDED_FILE_MUTATION_TOOLS = new Set([
+  ...IDE_DIFF_EDIT_TOOLS,
+  "notebook_edit",
 ]);
 
+function fileMutationPaths(name, args = {}) {
+  return [
+    args.path,
+    ...(name === "move_file" ? [args.target_path] : []),
+  ].filter(Boolean);
+}
+
 /**
  * Quote-aware shell tokenizer (mirrors gateways/ws `tokenizeCommand`). The `git`
  * tool runs the model-supplied command via argv (spawnSync, NO shell), so a
@@ -1086,12 +1187,11 @@ function applyLiteralEdit(content, oldStr, newStr, replaceAll) {
 /**
  * Compute the content an edit tool WOULD write, without writing it — the
  * left/right sides for an IDE diff review. Mirrors the corresponding
- * executeToolInner cases exactly (write_file / edit_file / edit_file_hashed,
- * the latter via the same pure replaceByHash). Returns
- * `{ filePath, newContent, originalText|null }` or null when the edit cannot
- * be computed (missing file, anchor/old_string miss, bad args) — the caller
- * then falls back to the normal confirmation path so the tool can produce its
- * own diagnostics.
+ * executeToolInner cases exactly (write/edit/delete/move; hashed edits use the
+ * same pure replaceByHash). Returns an explicit operation plus the left/right
+ * text and optional rename destination, or null when the proposal cannot be
+ * computed — the caller then falls back to normal confirmation so the tool can
+ * produce its own diagnostics.
  */
 export function computeProposedEdit(name, args = {}, cwd = process.cwd()) {
   try {
@@ -1099,10 +1199,49 @@ export function computeProposedEdit(name, args = {}, cwd = process.cwd()) {
     const filePath = path.resolve(cwd, args.path);
     if (name === "write_file") {
       if (typeof args.content !== "string") return null;
-      const originalText = fs.existsSync(filePath)
-        ? fs.readFileSync(filePath, "utf8")
-        : "";
-      return { filePath, newContent: args.content, originalText };
+      const exists = fs.existsSync(filePath);
+      const originalText = exists ? fs.readFileSync(filePath, "utf8") : "";
+      return {
+        filePath,
+        newContent: args.content,
+        originalText,
+        operation: exists ? "modify" : "create",
+      };
+    }
+    if (name === "delete_file") {
+      if (!fs.existsSync(filePath) || fs.statSync(filePath).isDirectory()) {
+        return null;
+      }
+      const originalText = fs.readFileSync(filePath, "utf8");
+      return {
+        filePath,
+        newContent: "",
+        originalText,
+        operation: "delete",
+      };
+    }
+    if (name === "move_file") {
+      if (
+        !args.target_path ||
+        !fs.existsSync(filePath) ||
+        fs.statSync(filePath).isDirectory()
+      ) {
+        return null;
+      }
+      const targetPath = path.resolve(cwd, args.target_path);
+      if (targetPath === filePath || fs.existsSync(targetPath)) return null;
+      const targetDir = path.dirname(targetPath);
+      if (!fs.existsSync(targetDir) || !fs.statSync(targetDir).isDirectory()) {
+        return null;
+      }
+      const originalText = fs.readFileSync(filePath, "utf8");
+      return {
+        filePath,
+        targetPath,
+        newContent: originalText,
+        originalText,
+        operation: "rename",
+      };
     }
     if (name === "edit_file") {
       if (!fs.existsSync(filePath)) return null;
@@ -1124,7 +1263,12 @@ export function computeProposedEdit(name, args = {}, cwd = process.cwd()) {
       // No match, or a non-unique match without replace_all → the edit will be
       // rejected, so show no (misleading) diff and let the tool report it.
       if (count === 0 || (count > 1 && !replaceAll)) return null;
-      return { filePath, newContent, originalText: content };
+      return {
+        filePath,
+        newContent,
+        originalText: content,
+        operation: "modify",
+      };
     }
     if (name === "edit_file_hashed") {
       if (!fs.existsSync(filePath)) return null;
@@ -1136,7 +1280,12 @@ export function computeProposedEdit(name, args = {}, cwd = process.cwd()) {
         newLine: args.new_line,
       });
       if (!result.success) return null;
-      return { filePath, newContent: result.content, originalText: original };
+      return {
+        filePath,
+        newContent: result.content,
+        originalText: original,
+        operation: "modify",
+      };
     }
   } catch {
     // unreadable file etc. → no proposal, normal path handles it
@@ -1184,6 +1333,11 @@ async function tryIdeDiffApprovalForEdit(
       modifiedText: proposal.newContent,
       originalText: proposal.originalText,
       title: `cc agent: ${name} ${path.basename(proposal.filePath)}`,
+      operation: proposal.operation,
+      targetPath: proposal.targetPath,
+      sessionId: context.sessionId || null,
+      turnId: context.turnId || null,
+      toolUseId: context.toolCallId || null,
     });
     if (verdict?.outcome === "accepted") {
       // When the reviewer amended the proposal in the diff before accepting,
@@ -1196,24 +1350,32 @@ async function tryIdeDiffApprovalForEdit(
           : null;
       return {
         outcome: "accepted",
-        result: {
-          success: true,
-          path: proposal.filePath,
-          appliedVia: "ide-diff",
-          ...(amendments
-            ? { userEdited: true, userAmendments: amendments }
-            : {}),
-          policy: { decision: "allow", rule, via: "ide-diff" },
-        },
+        result: attachDiffReviewAudit(
+          {
+            success: true,
+            path: proposal.filePath,
+            operation: proposal.operation,
+            ...(proposal.targetPath ? { targetPath: proposal.targetPath } : {}),
+            appliedVia: "ide-diff",
+            ...(amendments
+              ? { userEdited: true, userAmendments: amendments }
+              : {}),
+            policy: { decision: "allow", rule, via: "ide-diff" },
+          },
+          verdict.audit,
+        ),
       };
     }
     if (verdict?.outcome === "rejected") {
       return {
         outcome: "rejected",
-        result: {
-          error: `[Permission] "${name}" was rejected in the IDE diff review (${source}: ${rule}).`,
-          policy: { decision: "deny", rule, via: "ide-diff" },
-        },
+        result: attachDiffReviewAudit(
+          {
+            error: `[Permission] "${name}" was rejected in the IDE diff review (${source}: ${rule}).`,
+            policy: { decision: "deny", rule, via: "ide-diff" },
+          },
+          verdict.audit,
+        ),
       };
     }
     if (verdict?.outcome === "changes-requested") {
@@ -1225,14 +1387,17 @@ async function tryIdeDiffApprovalForEdit(
         "The user requested changes in the IDE diff review (no specific notes).";
       return {
         outcome: "changes-requested",
-        result: {
-          error:
-            `[IDE review] "${name}" was NOT applied — the user requested changes:\n` +
-            `${feedback}\n` +
-            "Revise the edit to address this feedback, then propose it again.",
-          policy: { decision: "deny", rule, via: "ide-diff-review" },
-          reviewComments: verdict.comments,
-        },
+        result: attachDiffReviewAudit(
+          {
+            error:
+              `[IDE review] "${name}" was NOT applied — the user requested changes:\n` +
+              `${feedback}\n` +
+              "Revise the edit to address this feedback, then propose it again.",
+            policy: { decision: "deny", rule, via: "ide-diff-review" },
+            reviewComments: verdict.comments,
+          },
+          verdict.audit,
+        ),
       };
     }
   } catch (_err) {
@@ -1241,6 +1406,20 @@ async function tryIdeDiffApprovalForEdit(
   return null;
 }
 
+/**
+ * Keep the audit available to stream/WS ledger consumers without serializing
+ * it into the model-facing tool result (which would waste context tokens).
+ */
+function attachDiffReviewAudit(result, audit) {
+  if (!result || typeof result !== "object" || !audit) return result;
+  Object.defineProperty(result, "_diffReviewAudit", {
+    value: audit,
+    enumerable: false,
+    configurable: true,
+  });
+  return result;
+}
+
 /**
  * Execute a single tool call with plan-mode filtering and hook pipeline.
  *
@@ -1264,6 +1443,56 @@ export async function executeTool(name, args, context = {}) {
       : null;
   const runtimeDescriptor =
     getRuntimeToolDescriptor(name) || localToolDescriptor;
+  const admission = context.toolAdmission;
+  if (admission?.enforce === true) {
+    const override =
+      admission.tools && typeof admission.tools === "object"
+        ? admission.tools[name] || {}
+        : {};
+    const tier =
+      override.tier ||
+      runtimeDescriptor?.tier ||
+      getCodingAgentToolPolicy(name)?.tier ||
+      (localToolDescriptor ? "extension" : "mvp");
+    const decision = admitTool({
+      tool: name,
+      tier,
+      capabilityGranted:
+        override.capabilityGranted ?? admission.capabilityGranted,
+      policyAllowed:
+        override.policyAllowed ??
+        (context.hostManagedToolPolicy
+          ? (context.hostManagedToolPolicy?.tools ||
+              context.hostManagedToolPolicy?.toolPolicies ||
+              {})[name]?.allowed !== false
+          : admission.policyAllowed),
+      permissionGranted:
+        override.permissionGranted ?? admission.permissionGranted,
+      budgetOk: override.budgetOk ?? admission.budgetOk,
+      uiSupported: override.uiSupported ?? admission.uiSupported,
+    });
+    const attribution = buildToolAttribution({
+      tool: name,
+      source:
+        override.source ||
+        runtimeDescriptor?.source ||
+        localToolDescriptor?.source ||
+        admission.source ||
+        null,
+      version: override.version || runtimeDescriptor?.version || null,
+      scope: override.scope || localToolDescriptor?.scope || null,
+      callId: context.toolCallId || null,
+      decision,
+    });
+    if (!decision.admitted) {
+      return {
+        error: `[Tool Admission] Tool "${name}" was not admitted: ${decision.unmet.join(", ")}.`,
+        toolAttribution: attribution,
+        policy: { decision: "blocked", via: "tool-admission" },
+      };
+    }
+    context = { ...context, toolAttribution: attribution };
+  }
   const toolContext = createToolContext({
     toolName: runtimeDescriptor?.name || name,
     cwd,
@@ -1397,26 +1626,29 @@ export async function executeTool(name, args, context = {}) {
   // An explicit settings `allow` rule is the only bypass (exact user
   // pre-authorization); headless without a confirmer fails closed.
   if (
-    (name === "write_file" ||
-      name === "edit_file" ||
-      name === "notebook_edit") &&
-    settingsVerdict.decision !== "allow" &&
-    args?.path
+    GUARDED_FILE_MUTATION_TOOLS.has(name) &&
+    settingsVerdict.decision !== "allow"
   ) {
     const { sensitiveFileReason, autoExecConfigReason } =
       await import("../lib/sensitive-file-guard.js");
-    const sensReason =
-      sensitiveFileReason(args.path) || autoExecConfigReason(args.path);
-    if (sensReason) {
+    const guarded = fileMutationPaths(name, args)
+      .map((candidatePath) => ({
+        path: candidatePath,
+        reason:
+          sensitiveFileReason(candidatePath) ||
+          autoExecConfigReason(candidatePath),
+      }))
+      .find((candidate) => candidate.reason);
+    if (guarded) {
       const ok = await requestInteractivePermission(name, args, context, cwd, {
         tool: name,
         args,
         rule: null,
-        reason: `sensitive file: ${sensReason}`,
+        reason: `sensitive file: ${guarded.reason}`,
       });
       if (!ok) {
         return {
-          error: `[Sensitive File] Writing "${args.path}" requires confirmation (${sensReason}) — denied. Add a settings allow rule to pre-authorize.`,
+          error: `[Sensitive File] Mutating "${guarded.path}" requires confirmation (${guarded.reason}) — denied. Add a settings allow rule to pre-authorize.`,
           policy: { decision: "ask", via: "sensitive-file" },
         };
       }
@@ -1430,25 +1662,27 @@ export async function executeTool(name, args, context = {}) {
   // sensitive-file guard: confirm-first, an explicit settings `allow` rule is
   // the only bypass, headless without a confirmer fails closed.
   if (
-    (name === "write_file" ||
-      name === "edit_file" ||
-      name === "notebook_edit") &&
-    settingsVerdict.decision !== "allow" &&
-    args?.path
+    GUARDED_FILE_MUTATION_TOOLS.has(name) &&
+    settingsVerdict.decision !== "allow"
   ) {
     const { sessionStorePathReason } =
       await import("../lib/session-store-guard.js");
-    const storeReason = sessionStorePathReason(args.path, { cwd });
-    if (storeReason) {
+    const guarded = fileMutationPaths(name, args)
+      .map((candidatePath) => ({
+        path: candidatePath,
+        reason: sessionStorePathReason(candidatePath, { cwd }),
+      }))
+      .find((candidate) => candidate.reason);
+    if (guarded) {
       const ok = await requestInteractivePermission(name, args, context, cwd, {
         tool: name,
         args,
         rule: null,
-        reason: `session store: ${storeReason}`,
+        reason: `session store: ${guarded.reason}`,
       });
       if (!ok) {
         return {
-          error: `[Session Store] Writing "${args.path}" would modify a session transcript (${storeReason}) — denied. Add a settings allow rule to pre-authorize.`,
+          error: `[Session Store] Mutating "${guarded.path}" would modify a session transcript (${guarded.reason}) — denied. Add a settings allow rule to pre-authorize.`,
           policy: { decision: "ask", via: "session-store-guard" },
         };
       }
@@ -1532,31 +1766,42 @@ export async function executeTool(name, args, context = {}) {
     }
   }
 
-  // Plan mode: check if tool is allowed (a settings `allow` rule pre-authorizes)
+  // Plan mode: settings/host allow rules may help exploration, but they cannot
+  // widen the immutable tool set issued when the user approved the plan.
+  const executionLockActive = planManager.executionLock != null;
   if (
     planManager.isActive() &&
-    !ruleAllowed &&
+    (!ruleAllowed || executionLockActive) &&
     !(name === "git" && isReadOnlyGitCommand(args.command)) &&
     !planManager.isToolAllowed(name) &&
-    !(isExternalHostTool && hostToolPolicy?.allowed === true) &&
-    !localReadOnlyAllowedInPlanMode
+    !(
+      !executionLockActive &&
+      isExternalHostTool &&
+      hostToolPolicy?.allowed === true
+    ) &&
+    !(!executionLockActive && localReadOnlyAllowedInPlanMode)
   ) {
-    planManager.addPlanItem({
-      title: `${name}: ${formatToolArgs(name, args)}`,
-      tool: name,
-      params: args,
-      estimatedImpact:
-        name === "run_shell" ||
-        name === "run_code" ||
-        name === "git" ||
-        localToolDescriptor?.riskLevel === "high"
-          ? "high"
-          : name === "write_file" || localToolDescriptor?.riskLevel === "medium"
-            ? "medium"
-            : "low",
-    });
+    if (!executionLockActive) {
+      planManager.addPlanItem({
+        title: `${name}: ${formatToolArgs(name, args)}`,
+        tool: name,
+        params: args,
+        estimatedImpact:
+          name === "run_shell" ||
+          name === "run_code" ||
+          name === "git" ||
+          localToolDescriptor?.riskLevel === "high"
+            ? "high"
+            : GUARDED_FILE_MUTATION_TOOLS.has(name) ||
+                localToolDescriptor?.riskLevel === "medium"
+              ? "medium"
+              : "low",
+      });
+    }
     return {
-      error: `[Plan Mode] Tool "${name}" is blocked during planning. It has been added to the plan. Use /plan approve to execute.`,
+      error: executionLockActive
+        ? `[Plan Execution Lock] Tool "${name}" was not in the approved tool set. Request a plan revision before using it.`
+        : `[Plan Mode] Tool "${name}" is blocked during planning. It has been added to the plan. Use /plan approve to execute.`,
     };
   }
 
@@ -1636,6 +1881,8 @@ export async function executeTool(name, args, context = {}) {
       settingsHooks: context.settingsHooks || null,
       signal: context.signal || null,
       backgroundSubAgents: context.backgroundSubAgents || null,
+      toolAdmission: context.toolAdmission || null,
+      unattendedActionPolicy: context.unattendedActionPolicy || null,
     });
   } catch (err) {
     if (hookDb) {
@@ -1663,6 +1910,9 @@ export async function executeTool(name, args, context = {}) {
   });
   if (toolResult && typeof toolResult === "object") {
     toolResult.toolTelemetryRecord = telemetryRecord;
+    if (context.toolAttribution) {
+      toolResult.toolAttribution = context.toolAttribution;
+    }
   }
 
   // PostToolUse hook
@@ -1717,6 +1967,7 @@ export async function executeTool(name, args, context = {}) {
           const outcome = runCommandHooks(sync, payload, {
             cwd,
             event: "PostToolUse",
+            broker,
           });
           if (outcome.decision === "block" && outcome.reason) {
             toolResult.hookFeedback = outcome.reason;
@@ -1725,7 +1976,7 @@ export async function executeTool(name, args, context = {}) {
         // Fire-and-forget the async hooks onto the REPL-owned supervisor when
         // one is wired; results/rewakes drain into the next turn's context.
         if (asyncHooks.length > 0 && context.hookSupervisor) {
-          context.hookSupervisor.dispatch(asyncHooks, payload, { cwd });
+          context.hookSupervisor.dispatch(asyncHooks, payload, { cwd, broker });
         }
       }
     } catch (_err) {
@@ -2433,6 +2684,8 @@ async function executeToolInner(
     signal = null,
     backgroundSubAgents = null,
     subAgentUsageSink = null,
+    toolAdmission = null,
+    unattendedActionPolicy = null,
     // Hook-envelope tracing: this run's trace id, threaded into child loops
     // (spawn_sub_agent / isolated run_skill) as their parent_id.
     hookTraceId = null,
@@ -2599,6 +2852,86 @@ async function executeToolInner(
       );
     }
 
+    case "delete_file": {
+      if (!args.path) {
+        return attachDescriptor({ error: "path is required" });
+      }
+      const filePath = path.resolve(cwd, args.path);
+      if (!fs.existsSync(filePath)) {
+        return attachDescriptor({ error: `File not found: ${filePath}` });
+      }
+      if (fs.lstatSync(filePath).isDirectory()) {
+        return attachDescriptor({
+          error: `Refusing to delete a directory: ${filePath}`,
+        });
+      }
+      const stale = _checkFileFreshness(filePath);
+      if (stale) return attachDescriptor({ error: stale });
+      fs.unlinkSync(filePath);
+      _fileObservedMtimes.delete(filePath);
+      return attachDescriptor({
+        success: true,
+        path: filePath,
+        operation: "delete",
+      });
+    }
+
+    case "move_file": {
+      if (!args.path || !args.target_path) {
+        return attachDescriptor({
+          error: "path and target_path are required",
+        });
+      }
+      const filePath = path.resolve(cwd, args.path);
+      const targetPath = path.resolve(cwd, args.target_path);
+      if (filePath === targetPath) {
+        return attachDescriptor({
+          error: "Source and target paths are the same",
+        });
+      }
+      if (!fs.existsSync(filePath)) {
+        return attachDescriptor({ error: `File not found: ${filePath}` });
+      }
+      if (fs.lstatSync(filePath).isDirectory()) {
+        return attachDescriptor({
+          error: `Refusing to move a directory: ${filePath}`,
+        });
+      }
+      if (fs.existsSync(targetPath)) {
+        return attachDescriptor({
+          error: `Move target already exists: ${targetPath}`,
+        });
+      }
+      const targetDir = path.dirname(targetPath);
+      if (!fs.existsSync(targetDir) || !fs.statSync(targetDir).isDirectory()) {
+        return attachDescriptor({
+          error: `Move target directory not found: ${targetDir}`,
+        });
+      }
+      const stale = _checkFileFreshness(filePath);
+      if (stale) return attachDescriptor({ error: stale });
+      fs.renameSync(filePath, targetPath);
+      _fileObservedMtimes.delete(filePath);
+      _recordFileObservation(targetPath);
+      return attachDescriptor(
+        await _withSubtreeInstructions(
+          await _withPostEditDiagnostics(
+            {
+              success: true,
+              path: filePath,
+              targetPath,
+              operation: "rename",
+            },
+            targetPath,
+            cwd,
+            additionalDirectories,
+          ),
+          targetPath,
+          cwd,
+        ),
+      );
+    }
+
     case "notebook_edit": {
       const filePath = path.resolve(cwd, args.path);
       if (!fs.existsSync(filePath)) {
@@ -2763,6 +3096,23 @@ async function executeToolInner(
     }
 
     case "run_shell": {
+      if (unattendedActionPolicy?.unattended === true) {
+        const unattendedVerdict = evaluateUnattendedShellAction(args.command, {
+          ...unattendedActionPolicy,
+          attended: false,
+        });
+        if (!unattendedVerdict.allow) {
+          return attachDescriptor({
+            error: `[Unattended Action] ${unattendedVerdict.reason}; shell command was not run.`,
+            unattendedAction: {
+              actionClass: unattendedVerdict.actionClass || null,
+              ...unattendedVerdict,
+            },
+            policy: { decision: "deny", via: "unattended-action-policy" },
+          });
+        }
+      }
+
       const shellPolicyOpts = {
         ...(shellPolicyOverrides
           ? { overrideRuleIds: shellPolicyOverrides }
@@ -2877,6 +3227,28 @@ async function executeToolInner(
           : {}
         : { shell: shellInv.kind };
 
+      // PATH-based plugin binaries need explicit provenance at the Broker
+      // boundary; otherwise a trusted plugin executable is indistinguishable
+      // from an ambient system command in the process audit log.
+      let pluginBinProvenance = null;
+      try {
+        const { resolvePluginBinCommand } =
+          await import("../lib/plugin-runtime/bin.js");
+        pluginBinProvenance = resolvePluginBinCommand(args.command, { cwd });
+      } catch {
+        pluginBinProvenance = null;
+      }
+      const processOrigin = pluginBinProvenance
+        ? "plugin:bin"
+        : "tool:run_shell";
+      const processProvenance = pluginBinProvenance
+        ? {
+            pluginId: pluginBinProvenance.pluginId,
+            pluginVersion: pluginBinProvenance.pluginVersion,
+            pluginSource: pluginBinProvenance.pluginSource,
+          }
+        : {};
+
       // Background: spawn, register, return a task_id immediately. The agent
       // polls output + completion via check_shell. No timeout — that's the whole
       // point of backgrounding (builds, test suites, dev servers).
@@ -2936,9 +3308,16 @@ async function executeToolInner(
           };
           // PowerShell route: explicit argv (shell:false above); default route
           // is the historical spawn(command, {shell:true}) byte-for-byte.
+          const brokerOpts = {
+            ...bgSpawnOpts,
+            origin: processOrigin,
+            policy: "allow",
+            scope: "agent",
+            ...processProvenance,
+          };
           const child = shellInv.useDefaultShell
-            ? spawn(args.command, bgSpawnOpts)
-            : spawn(shellInv.file, shellInv.argv, bgSpawnOpts);
+            ? broker.spawn(args.command, [], brokerOpts)
+            : broker.spawn(shellInv.file, shellInv.argv, brokerOpts);
           task.child = child;
           if (child.stdout) {
             child.stdout.setEncoding("utf8");
@@ -3111,15 +3490,22 @@ async function executeToolInner(
           }).env,
         };
         let output;
+        const brokerExecOpts = {
+          ...fgExecOpts,
+          origin: processOrigin,
+          policy: "allow",
+          scope: "agent",
+          ...processProvenance,
+        };
         if (shellInv.useDefaultShell) {
-          output = execSync(args.command, fgExecOpts);
+          output = broker.execSync(args.command, brokerExecOpts);
         } else {
           // PowerShell route: explicit argv, no intermediate default shell.
           // Reproduce execSync's contract so the shared catch shapes errors
           // identically: throw on spawn error; throw an Error carrying
           // status/stdout/stderr on non-zero exit.
-          const res = spawnSync(shellInv.file, shellInv.argv, {
-            ...fgExecOpts,
+          const res = broker.spawnSync(shellInv.file, shellInv.argv, {
+            ...brokerExecOpts,
             windowsHide: true,
           });
           if (res.error) throw res.error;
@@ -3238,12 +3624,15 @@ async function executeToolInner(
       // command-execution bypass for a prompt-injected agent. Quoted args (a
       // commit message) keep their content via the quote-aware tokenizer.
       const gitArgs = tokenizeShellWords(normalizedCommand);
-      const res = spawnSync("git", gitArgs, {
+      const res = _gitProcessDeps.run("git", gitArgs, {
         cwd: args.cwd || cwd,
         encoding: "utf8",
         timeout: 60000,
         maxBuffer: 1024 * 1024,
         windowsHide: true,
+        origin: "agent-core:git-command",
+        policy: "allow",
+        scope: "agent-core",
       });
       const readOnly = isReadOnlyGitCommand(normalizedCommand);
       if (res.error) {
@@ -3351,6 +3740,7 @@ async function executeToolInner(
           signal,
           backgroundSubAgents,
           subAgentUsageSink,
+          toolAdmission,
         }),
       );
     }
@@ -3843,7 +4233,7 @@ async function executeToolInner(
         };
         try {
           if (!fs.existsSync(root)) continue;
-          const output = execSync(cmd, {
+          const output = runSearchProcess(cmd, {
             cwd: root,
             encoding: "utf8",
             timeout: 10000,
@@ -4057,6 +4447,7 @@ async function executeToolInner(
           task: `Execute the "${args.skill_name}" skill with input: ${(args.input || "").substring(0, 200)}`,
           allowedTools: ["read_file", "search_files", "list_dir"],
           hookParentTraceId: hookTraceId || null,
+          toolAdmission,
           cwd,
           onUsage: skillUsageSink
             ? (u) => {
@@ -4113,7 +4504,7 @@ async function executeToolInner(
             onWarn: (msg) => {
               // Non-fatal — logged as warning, skipped servers captured
               // in mountResult.skipped.
-              // eslint-disable-next-line no-console
+
               console.warn(msg);
             },
           });
@@ -4448,7 +4839,7 @@ async function _executeRunCode(args, cwd) {
     const start = Date.now();
     let output;
     try {
-      output = execSync(`${interpreter} "${scriptPath}"`, {
+      output = runCodeProcess(interpreter, [scriptPath], {
         cwd,
         encoding: "utf8",
         timeout: timeoutSec * 1000,
@@ -4548,12 +4939,18 @@ async function _executeRunCode(args, cwd) {
 
           // Attempt pip install
           try {
-            execSync(`${interpreter} -m pip install ${packageName}`, {
-              encoding: "utf-8",
-              timeout: 120000,
-              maxBuffer: 2 * 1024 * 1024,
-              stdio: ["pipe", "pipe", "pipe"],
-            });
+            runCodeProcess(
+              interpreter,
+              ["-m", "pip", "install", packageName],
+              {
+                cwd,
+                encoding: "utf-8",
+                timeout: 120000,
+                maxBuffer: 2 * 1024 * 1024,
+                stdio: ["pipe", "pipe", "pipe"],
+              },
+              "run-code-install",
+            );
             recordInstallAudit({
               package: packageName,
               interpreter,
@@ -4564,12 +4961,17 @@ async function _executeRunCode(args, cwd) {
 
             // Retry execution
             const retryStart = Date.now();
-            const retryOutput = execSync(`${interpreter} "${scriptPath}"`, {
-              cwd,
-              encoding: "utf8",
-              timeout: timeoutSec * 1000,
-              maxBuffer: 5 * 1024 * 1024,
-            });
+            const retryOutput = runCodeProcess(
+              interpreter,
+              [scriptPath],
+              {
+                cwd,
+                encoding: "utf8",
+                timeout: timeoutSec * 1000,
+                maxBuffer: 5 * 1024 * 1024,
+              },
+              "run-code-retry",
+            );
             const retryDuration = Date.now() - retryStart;
 
             return {
@@ -5290,10 +5692,29 @@ async function _executeSpawnSubAgent(args, ctx) {
     // seeded with the mode's tier gates the child's run_shell / browser_act;
     // absent (ungated) for a plain default spawn = byte-identical.
     ...(childApprovalGate ? { approvalGate: childApprovalGate } : {}),
+    ...(ctx.toolAdmission ? { toolAdmission: ctx.toolAdmission } : {}),
   });
   subCtxRef = subCtx;
 
   const emit = (type, payload) => {
+    if (type === "sub-agent.started") {
+      emitHooksV2Event("TaskCreated", {
+        task_id: subCtx.id,
+        session_id: parentSessionId,
+        role: subCtx.role,
+        task: subCtx.task,
+        background: payload?.background === true,
+      });
+    } else if (type === "sub-agent.completed" || type === "sub-agent.failed") {
+      emitHooksV2Event("TaskCompleted", {
+        task_id: subCtx.id,
+        session_id: parentSessionId,
+        role: subCtx.role,
+        status: type === "sub-agent.failed" ? "failed" : "completed",
+        error: payload?.error || null,
+        completed_at: payload?.completedAt || null,
+      });
+    }
     if (!interaction || typeof interaction.emit !== "function") return;
     try {
       interaction.emit(type, {
@@ -6915,6 +7336,12 @@ export async function* agentLoop(messages, options) {
     hostManagedToolPolicy: options.hostManagedToolPolicy || null,
     externalToolDescriptors: options.externalToolDescriptors || null,
     externalToolExecutors: options.externalToolExecutors || null,
+    // Optional session-level Extension Tier gate. Hosts that can provide
+    // capability/policy/permission/budget/UI signals opt in with
+    // { enforce: true }; omitting it preserves the CLI's existing per-call
+    // permission pipeline for backwards compatibility.
+    toolAdmission: options.toolAdmission || null,
+    unattendedActionPolicy: options.unattendedActionPolicy || null,
     // MCP tool DEFINITIONS the LLM sees (mcp__server__tool). Threaded here so a
     // spawn can inherit the parent's MCP tools into the child (filtered by the
     // contract's mcpServers allow-list). Otherwise consumed only at agentLoop.
@@ -7607,11 +8034,11 @@ export async function* agentLoop(messages, options) {
         } catch {
           toolArgs = {};
         }
-        const promise = executeTool(
-          call.function.name,
-          toolArgs,
-          toolContext,
-        ).then(
+        const promise = executeTool(call.function.name, toolArgs, {
+          ...toolContext,
+          toolCallId: call.id,
+          turnId: `${runId}:t${budget.consumed}`,
+        }).then(
           (result) => ({ result, error: null }),
           (err) => ({ result: { error: err.message }, error: err.message }),
         );
@@ -7724,7 +8151,12 @@ export async function* agentLoop(messages, options) {
           recorder,
           "agent.tool",
           { "tool.name": toolName, ...(toolIdAttrs || {}) },
-          () => executeTool(toolName, toolArgs, toolContext),
+          () =>
+            executeTool(toolName, toolArgs, {
+              ...toolContext,
+              toolCallId: call.id,
+              turnId: `${runId}:t${budget.consumed}`,
+            }),
           (span, r) => {
             span.setAttribute(
               "tool.is_error",
@@ -7819,6 +8251,10 @@ export function formatToolArgs(name, args) {
       return args.path;
     case "edit_file_hashed":
       return `${args.path} @${args.anchor_hash}`;
+    case "delete_file":
+      return args.path;
+    case "move_file":
+      return `${args.path} → ${args.target_path}`;
     case "run_shell":
       return args.run_in_background
         ? `${args.command} (background)`