fengming 0.3.8 → 0.3.10

package/dist/target-id-BR2xJIkd.js

@@ -0,0 +1,107 @@
+import { a as normalizeLowercaseStringOrEmpty } from "./string-coerce-DKw2K5wM.js";
+import { i as formatErrorMessage, r as extractErrorCode } from "./errors-C_Wa6a5T.js";
+import "./string-coerce-runtime-BurriTLB.js";
+import "./errors-bTbwOddL.js";
+//#region extensions/browser/src/browser/profile-capabilities.ts
+function getBrowserProfileCapabilities(profile) {
+	if (profile.driver === "existing-session") return {
+		mode: "local-existing-session",
+		isRemote: false,
+		usesChromeMcp: true,
+		usesPersistentPlaywright: false,
+		supportsPerTabWs: false,
+		supportsJsonTabEndpoints: false,
+		supportsReset: false,
+		supportsManagedTabLimit: false
+	};
+	if (!profile.cdpIsLoopback) return {
+		mode: "remote-cdp",
+		isRemote: true,
+		usesChromeMcp: false,
+		usesPersistentPlaywright: true,
+		supportsPerTabWs: false,
+		supportsJsonTabEndpoints: false,
+		supportsReset: false,
+		supportsManagedTabLimit: false
+	};
+	return {
+		mode: "local-managed",
+		isRemote: false,
+		usesChromeMcp: false,
+		usesPersistentPlaywright: false,
+		supportsPerTabWs: true,
+		supportsJsonTabEndpoints: true,
+		supportsReset: true,
+		supportsManagedTabLimit: true
+	};
+}
+function resolveDefaultSnapshotFormat(params) {
+	if (params.explicitFormat) return params.explicitFormat;
+	if (params.mode === "efficient") return "ai";
+	if (getBrowserProfileCapabilities(params.profile).mode === "local-existing-session") return "ai";
+	return params.hasPlaywright ? "ai" : "aria";
+}
+function shouldUsePlaywrightForScreenshot(params) {
+	return !params.wsUrl || Boolean(params.ref) || Boolean(params.element);
+}
+function shouldUsePlaywrightForAriaSnapshot(params) {
+	return !params.wsUrl;
+}
+//#endregion
+//#region extensions/browser/src/browser/pw-ai-module.ts
+let pwAiModuleSoft = null;
+let pwAiModuleStrict = null;
+function isModuleNotFoundError(err) {
+	if (extractErrorCode(err) === "ERR_MODULE_NOT_FOUND") return true;
+	const msg = formatErrorMessage(err);
+	return msg.includes("Cannot find module") || msg.includes("Cannot find package") || msg.includes("Failed to resolve import") || msg.includes("Failed to resolve entry for package") || msg.includes("Failed to load url");
+}
+async function loadPwAiModule(mode) {
+	try {
+		return await import("./pw-ai-DYR-D7xR.js");
+	} catch (err) {
+		if (mode === "soft") return null;
+		if (isModuleNotFoundError(err)) return null;
+		throw err;
+	}
+}
+async function getPwAiModule(opts) {
+	if ((opts?.mode ?? "soft") === "soft") {
+		if (!pwAiModuleSoft) pwAiModuleSoft = loadPwAiModule("soft");
+		return await pwAiModuleSoft;
+	}
+	if (!pwAiModuleStrict) pwAiModuleStrict = loadPwAiModule("strict");
+	return await pwAiModuleStrict;
+}
+//#endregion
+//#region extensions/browser/src/browser/target-id.ts
+function resolveTargetIdFromTabs(input, tabs) {
+	const needle = input.trim();
+	if (!needle) return {
+		ok: false,
+		reason: "not_found"
+	};
+	const exact = tabs.find((t) => t.targetId === needle || t.suggestedTargetId === needle || t.tabId === needle || t.label === needle);
+	if (exact) return {
+		ok: true,
+		targetId: exact.targetId
+	};
+	const lower = normalizeLowercaseStringOrEmpty(needle);
+	const matches = tabs.map((t) => t.targetId).filter((id) => normalizeLowercaseStringOrEmpty(id).startsWith(lower));
+	const only = matches.length === 1 ? matches[0] : void 0;
+	if (only) return {
+		ok: true,
+		targetId: only
+	};
+	if (matches.length === 0) return {
+		ok: false,
+		reason: "not_found"
+	};
+	return {
+		ok: false,
+		reason: "ambiguous",
+		matches
+	};
+}
+//#endregion
+export { shouldUsePlaywrightForAriaSnapshot as a, resolveDefaultSnapshotFormat as i, getPwAiModule as n, shouldUsePlaywrightForScreenshot as o, getBrowserProfileCapabilities as r, resolveTargetIdFromTabs as t };

package/dist/task-registry-control.runtime.js

@@ -1,3 +1,3 @@
 import { t as getAcpSessionManager } from "./manager-DCAuiW21.js";
-import { i as killSubagentRunAdmin } from "./subagent-control-DP72sk-l.js";
+import { i as killSubagentRunAdmin } from "./subagent-control-DVqLHi9O.js";
 export { getAcpSessionManager, killSubagentRunAdmin };

package/dist/thread-bindings-8XNu5U2p.js

@@ -0,0 +1,228 @@
+import { c as normalizeOptionalString } from "./string-coerce-DKw2K5wM.js";
+import { n as normalizeAccountId } from "./account-id-B0YIFDpA.js";
+import { d as resolveAgentIdFromSessionKey } from "./session-key-CJf5_zWs.js";
+import { i as registerSessionBindingAdapter, o as unregisterSessionBindingAdapter } from "./session-binding-service-BjjMIxQb.js";
+import { c as resolveThreadBindingMaxAgeMsForChannel, o as resolveThreadBindingIdleTimeoutMsForChannel } from "./thread-bindings-policy-71TtGCov.js";
+import "./string-coerce-runtime-BurriTLB.js";
+import "./routing-B7t3bis6.js";
+import "./conversation-runtime-DDekWU-U.js";
+import { t as resolveThreadBindingConversationIdFromBindingId } from "./thread-binding-id-Bkm-THw-.js";
+//#region extensions/feishu/src/thread-bindings.ts
+const FEISHU_THREAD_BINDINGS_STATE_KEY = Symbol.for("openclaw.feishuThreadBindingsState");
+let state;
+function getState() {
+	if (!state) {
+		const globalStore = globalThis;
+		state = globalStore[FEISHU_THREAD_BINDINGS_STATE_KEY] ?? {
+			managersByAccountId: /* @__PURE__ */ new Map(),
+			bindingsByAccountConversation: /* @__PURE__ */ new Map()
+		};
+		globalStore[FEISHU_THREAD_BINDINGS_STATE_KEY] = state;
+	}
+	return state;
+}
+function resolveBindingKey(params) {
+	return `${params.accountId}:${params.conversationId}`;
+}
+function toSessionBindingTargetKind(raw) {
+	return raw === "subagent" ? "subagent" : "session";
+}
+function toFeishuTargetKind(raw) {
+	return raw === "subagent" ? "subagent" : "acp";
+}
+function toSessionBindingRecord(record, defaults) {
+	const idleExpiresAt = defaults.idleTimeoutMs > 0 ? record.lastActivityAt + defaults.idleTimeoutMs : void 0;
+	const maxAgeExpiresAt = defaults.maxAgeMs > 0 ? record.boundAt + defaults.maxAgeMs : void 0;
+	const expiresAt = idleExpiresAt != null && maxAgeExpiresAt != null ? Math.min(idleExpiresAt, maxAgeExpiresAt) : idleExpiresAt ?? maxAgeExpiresAt;
+	return {
+		bindingId: resolveBindingKey({
+			accountId: record.accountId,
+			conversationId: record.conversationId
+		}),
+		targetSessionKey: record.targetSessionKey,
+		targetKind: toSessionBindingTargetKind(record.targetKind),
+		conversation: {
+			channel: "feishu",
+			accountId: record.accountId,
+			conversationId: record.conversationId,
+			parentConversationId: record.parentConversationId
+		},
+		status: "active",
+		boundAt: record.boundAt,
+		expiresAt,
+		metadata: {
+			agentId: record.agentId,
+			label: record.label,
+			boundBy: record.boundBy,
+			deliveryTo: record.deliveryTo,
+			deliveryThreadId: record.deliveryThreadId,
+			lastActivityAt: record.lastActivityAt,
+			idleTimeoutMs: defaults.idleTimeoutMs,
+			maxAgeMs: defaults.maxAgeMs
+		}
+	};
+}
+function createFeishuThreadBindingManager(params) {
+	const accountId = normalizeAccountId(params.accountId);
+	const existing = getState().managersByAccountId.get(accountId);
+	if (existing) return existing;
+	const idleTimeoutMs = resolveThreadBindingIdleTimeoutMsForChannel({
+		cfg: params.cfg,
+		channel: "feishu",
+		accountId
+	});
+	const maxAgeMs = resolveThreadBindingMaxAgeMsForChannel({
+		cfg: params.cfg,
+		channel: "feishu",
+		accountId
+	});
+	const manager = {
+		accountId,
+		getByConversationId: (conversationId) => getState().bindingsByAccountConversation.get(resolveBindingKey({
+			accountId,
+			conversationId
+		})),
+		listBySessionKey: (targetSessionKey) => [...getState().bindingsByAccountConversation.values()].filter((record) => record.accountId === accountId && record.targetSessionKey === targetSessionKey),
+		bindConversation: ({ conversationId, parentConversationId, targetKind, targetSessionKey, metadata }) => {
+			const normalizedConversationId = conversationId.trim();
+			const normalizedTargetSessionKey = targetSessionKey.trim();
+			if (!normalizedConversationId || !normalizedTargetSessionKey) return null;
+			const existing = getState().bindingsByAccountConversation.get(resolveBindingKey({
+				accountId,
+				conversationId: normalizedConversationId
+			}));
+			const now = Date.now();
+			const record = {
+				accountId,
+				conversationId: normalizedConversationId,
+				parentConversationId: normalizeOptionalString(parentConversationId) ?? existing?.parentConversationId,
+				deliveryTo: typeof metadata?.deliveryTo === "string" && metadata.deliveryTo.trim() ? metadata.deliveryTo.trim() : existing?.deliveryTo,
+				deliveryThreadId: typeof metadata?.deliveryThreadId === "string" && metadata.deliveryThreadId.trim() ? metadata.deliveryThreadId.trim() : existing?.deliveryThreadId,
+				targetKind: toFeishuTargetKind(targetKind),
+				targetSessionKey: normalizedTargetSessionKey,
+				agentId: typeof metadata?.agentId === "string" && metadata.agentId.trim() ? metadata.agentId.trim() : existing?.agentId ?? resolveAgentIdFromSessionKey(normalizedTargetSessionKey),
+				label: typeof metadata?.label === "string" && metadata.label.trim() ? metadata.label.trim() : existing?.label,
+				boundBy: typeof metadata?.boundBy === "string" && metadata.boundBy.trim() ? metadata.boundBy.trim() : existing?.boundBy,
+				boundAt: now,
+				lastActivityAt: now
+			};
+			getState().bindingsByAccountConversation.set(resolveBindingKey({
+				accountId,
+				conversationId: normalizedConversationId
+			}), record);
+			return record;
+		},
+		touchConversation: (conversationId, at = Date.now()) => {
+			const key = resolveBindingKey({
+				accountId,
+				conversationId
+			});
+			const existingRecord = getState().bindingsByAccountConversation.get(key);
+			if (!existingRecord) return null;
+			const updated = {
+				...existingRecord,
+				lastActivityAt: at
+			};
+			getState().bindingsByAccountConversation.set(key, updated);
+			return updated;
+		},
+		unbindConversation: (conversationId) => {
+			const key = resolveBindingKey({
+				accountId,
+				conversationId
+			});
+			const existingRecord = getState().bindingsByAccountConversation.get(key);
+			if (!existingRecord) return null;
+			getState().bindingsByAccountConversation.delete(key);
+			return existingRecord;
+		},
+		unbindBySessionKey: (targetSessionKey) => {
+			const removed = [];
+			for (const record of getState().bindingsByAccountConversation.values()) {
+				if (record.accountId !== accountId || record.targetSessionKey !== targetSessionKey) continue;
+				getState().bindingsByAccountConversation.delete(resolveBindingKey({
+					accountId,
+					conversationId: record.conversationId
+				}));
+				removed.push(record);
+			}
+			return removed;
+		},
+		stop: () => {
+			for (const key of getState().bindingsByAccountConversation.keys()) if (key.startsWith(`${accountId}:`)) getState().bindingsByAccountConversation.delete(key);
+			getState().managersByAccountId.delete(accountId);
+			unregisterSessionBindingAdapter({
+				channel: "feishu",
+				accountId,
+				adapter: sessionBindingAdapter
+			});
+		}
+	};
+	const sessionBindingAdapter = {
+		channel: "feishu",
+		accountId,
+		capabilities: { placements: ["current"] },
+		bind: async (input) => {
+			if (input.conversation.channel !== "feishu" || input.placement === "child") return null;
+			const bound = manager.bindConversation({
+				conversationId: input.conversation.conversationId,
+				parentConversationId: input.conversation.parentConversationId,
+				targetKind: input.targetKind,
+				targetSessionKey: input.targetSessionKey,
+				metadata: input.metadata
+			});
+			return bound ? toSessionBindingRecord(bound, {
+				idleTimeoutMs,
+				maxAgeMs
+			}) : null;
+		},
+		listBySession: (targetSessionKey) => manager.listBySessionKey(targetSessionKey).map((entry) => toSessionBindingRecord(entry, {
+			idleTimeoutMs,
+			maxAgeMs
+		})),
+		resolveByConversation: (ref) => {
+			if (ref.channel !== "feishu") return null;
+			const found = manager.getByConversationId(ref.conversationId);
+			return found ? toSessionBindingRecord(found, {
+				idleTimeoutMs,
+				maxAgeMs
+			}) : null;
+		},
+		touch: (bindingId, at) => {
+			const conversationId = resolveThreadBindingConversationIdFromBindingId({
+				accountId,
+				bindingId
+			});
+			if (conversationId) manager.touchConversation(conversationId, at);
+		},
+		unbind: async (input) => {
+			if (input.targetSessionKey?.trim()) return manager.unbindBySessionKey(input.targetSessionKey.trim()).map((entry) => toSessionBindingRecord(entry, {
+				idleTimeoutMs,
+				maxAgeMs
+			}));
+			const conversationId = resolveThreadBindingConversationIdFromBindingId({
+				accountId,
+				bindingId: input.bindingId
+			});
+			if (!conversationId) return [];
+			const removed = manager.unbindConversation(conversationId);
+			return removed ? [toSessionBindingRecord(removed, {
+				idleTimeoutMs,
+				maxAgeMs
+			})] : [];
+		}
+	};
+	registerSessionBindingAdapter(sessionBindingAdapter);
+	getState().managersByAccountId.set(accountId, manager);
+	return manager;
+}
+function getFeishuThreadBindingManager(accountId) {
+	return getState().managersByAccountId.get(normalizeAccountId(accountId)) ?? null;
+}
+const testing = { resetFeishuThreadBindingsForTests() {
+	for (const manager of getState().managersByAccountId.values()) manager.stop();
+	getState().managersByAccountId.clear();
+	getState().bindingsByAccountConversation.clear();
+} };
+//#endregion
+export { getFeishuThreadBindingManager as n, testing as r, createFeishuThreadBindingManager as t };

package/dist/tool-Boeg0N5g.js

@@ -0,0 +1,143 @@
+import { n as resolvePreferredFengMingTmpDir } from "./tmp-fengming-dir-0p6iJKE-.js";
+import { b as readStringParam, c as imageResultFromFile, g as readPositiveIntegerParam, l as jsonResult, p as readFiniteNumberParam } from "./common-DSTX6z7j.js";
+import { t as callGatewayTool } from "./gateway-2Ilp04qq.js";
+import { i as resolveNodeIdFromList, t as listNodes } from "./nodes-utils-Df6RwiB5.js";
+import "./temp-path-BN8QrTE5.js";
+import "./agent-harness-runtime-RkTGiliR.js";
+import "./channel-actions-DJzt_5gv.js";
+import "./param-readers-FnpjqJVG.js";
+import { t as CanvasToolSchema } from "./tool-schema-xvXbVAKZ.js";
+import { n as normalizeCanvasSnapshotFileExtension, r as parseCanvasSnapshotPayload } from "./cli-helpers-BxtNTpsq.js";
+import path from "node:path";
+import fs from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+//#region extensions/canvas/src/tool.ts
+function readGatewayCallOptions(params) {
+	return {
+		gatewayUrl: readStringParam(params, "gatewayUrl", { trim: false }),
+		gatewayToken: readStringParam(params, "gatewayToken", { trim: false }),
+		timeoutMs: readPositiveIntegerParam(params, "timeoutMs")
+	};
+}
+async function resolveNodeId(opts, query, allowDefault = false) {
+	return resolveNodeIdFromList(await listNodes(opts), query, allowDefault);
+}
+async function writeBase64ToTempFile(params) {
+	const dir = resolvePreferredFengMingTmpDir();
+	await fs.mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	const ext = `.${normalizeCanvasSnapshotFileExtension(params.ext)}`;
+	const filePath = path.join(dir, `fengming-canvas-snapshot-${randomUUID()}${ext}`);
+	await fs.writeFile(filePath, Buffer.from(params.base64, "base64"));
+	return filePath;
+}
+function isPathInsideRoot(root, candidate) {
+	const relative = path.relative(root, candidate);
+	return relative === "" || !!relative && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+async function readJsonlFromPath(jsonlPath, workspaceDir) {
+	const trimmed = jsonlPath.trim();
+	if (!trimmed) return "";
+	const workspaceRoot = path.resolve(workspaceDir ?? process.cwd());
+	const resolved = path.resolve(workspaceRoot, trimmed);
+	const [workspaceReal, resolvedReal] = await Promise.all([fs.realpath(workspaceRoot), fs.realpath(resolved)]);
+	if (!isPathInsideRoot(workspaceReal, resolvedReal)) throw new Error("jsonlPath outside workspace");
+	return await fs.readFile(resolvedReal, "utf8");
+}
+function resolveCanvasImageSanitizationLimits(config) {
+	const configured = config?.agents?.defaults?.imageMaxDimensionPx;
+	if (typeof configured !== "number" || !Number.isFinite(configured)) return {};
+	return { maxDimensionPx: Math.max(1, Math.floor(configured)) };
+}
+function createCanvasTool(options) {
+	const imageSanitization = resolveCanvasImageSanitizationLimits(options?.config);
+	return {
+		label: "Canvas",
+		name: "canvas",
+		description: "Control node canvases (present/hide/navigate/eval/snapshot/A2UI). Use snapshot to capture the rendered UI.",
+		parameters: CanvasToolSchema,
+		execute: async (_toolCallId, args) => {
+			const params = args;
+			const action = readStringParam(params, "action", { required: true });
+			const gatewayOpts = readGatewayCallOptions(params);
+			const nodeId = await resolveNodeId(gatewayOpts, readStringParam(params, "node", { trim: true }), true);
+			const invoke = async (command, invokeParams) => await callGatewayTool("node.invoke", gatewayOpts, {
+				nodeId,
+				command,
+				params: invokeParams,
+				idempotencyKey: randomUUID()
+			});
+			switch (action) {
+				case "present": {
+					const placement = {
+						x: readFiniteNumberParam(params, "x"),
+						y: readFiniteNumberParam(params, "y"),
+						width: readFiniteNumberParam(params, "width"),
+						height: readFiniteNumberParam(params, "height")
+					};
+					const invokeParams = {};
+					const presentTarget = readStringParam(params, "target", { trim: true }) ?? readStringParam(params, "url", { trim: true });
+					if (presentTarget) invokeParams.url = presentTarget;
+					if (Number.isFinite(placement.x) || Number.isFinite(placement.y) || Number.isFinite(placement.width) || Number.isFinite(placement.height)) invokeParams.placement = placement;
+					await invoke("canvas.present", invokeParams);
+					return jsonResult({ ok: true });
+				}
+				case "hide":
+					await invoke("canvas.hide", void 0);
+					return jsonResult({ ok: true });
+				case "navigate":
+					await invoke("canvas.navigate", { url: readStringParam(params, "url", { trim: true }) ?? readStringParam(params, "target", {
+						required: true,
+						trim: true,
+						label: "url"
+					}) });
+					return jsonResult({ ok: true });
+				case "eval": {
+					const result = (await invoke("canvas.eval", { javaScript: readStringParam(params, "javaScript", { required: true }) }))?.payload?.result;
+					if (result) return {
+						content: [{
+							type: "text",
+							text: result
+						}],
+						details: { result }
+					};
+					return jsonResult({ ok: true });
+				}
+				case "snapshot": {
+					const formatRaw = typeof params.outputFormat === "string" && params.outputFormat.trim() ? params.outputFormat.trim().toLowerCase() : "png";
+					const payload = parseCanvasSnapshotPayload((await invoke("canvas.snapshot", {
+						format: formatRaw === "jpg" || formatRaw === "jpeg" ? "jpeg" : "png",
+						maxWidth: readPositiveIntegerParam(params, "maxWidth"),
+						quality: readFiniteNumberParam(params, "quality", {
+							min: 0,
+							max: 1
+						})
+					}))?.payload);
+					return await imageResultFromFile({
+						label: "canvas:snapshot",
+						path: await writeBase64ToTempFile({
+							base64: payload.base64,
+							ext: payload.format === "jpeg" ? "jpg" : payload.format
+						}),
+						details: { format: payload.format },
+						imageSanitization
+					});
+				}
+				case "a2ui_push": {
+					const jsonl = typeof params.jsonl === "string" && params.jsonl.trim() ? params.jsonl : typeof params.jsonlPath === "string" && params.jsonlPath.trim() ? await readJsonlFromPath(params.jsonlPath, options?.workspaceDir) : "";
+					if (!jsonl.trim()) throw new Error("jsonl or jsonlPath required");
+					await invoke("canvas.a2ui.pushJSONL", { jsonl });
+					return jsonResult({ ok: true });
+				}
+				case "a2ui_reset":
+					await invoke("canvas.a2ui.reset", void 0);
+					return jsonResult({ ok: true });
+				default: throw new Error(`Unknown action: ${action}`);
+			}
+		}
+	};
+}
+//#endregion
+export { createCanvasTool };

package/dist/tool-dispatch-BhLLaL2g.js

@@ -0,0 +1,155 @@
+import { r as logVerbose } from "./globals-BMM_rcFF.js";
+import { a as resolveGatewayMessageChannel } from "./message-channel-normalize-CaOaCinb.js";
+import "./message-channel-DcN_7tYD.js";
+import { a as collectExplicitDenylist, c as hasRestrictiveAllowPolicy, h as resolveToolProfilePolicy, i as collectExplicitAllowlist, l as mergeAlsoAllowPolicy, u as replaceWithEffectiveToolAllowlist } from "./tool-policy-Dv92jaRW.js";
+import { n as resolveSandboxRuntimeStatus } from "./runtime-status-FKnO8P0l.js";
+import { t as createFengMingTools } from "./fengming-tools-DBLsJfsf.js";
+import { o as resolveSubagentCapabilityStore, t as isSubagentEnvelopeSession } from "./subagent-capabilities-BPtXB0Jr.js";
+import { i as resolveInheritedToolPolicyForSession, n as resolveEffectiveToolPolicy, o as resolveSubagentToolPolicyForSession, r as resolveGroupToolPolicy } from "./agent-tools.policy-CAz43ea3.js";
+import { t as resolveSenderToolPolicy } from "./sender-tool-policy-fy2YY1NL.js";
+import { i as getPluginToolMeta } from "./tools-C7700Vu-.js";
+import { n as buildDefaultToolPolicyPipelineSteps, t as applyToolPolicyPipeline } from "./tool-policy-pipeline-BtDchKz0.js";
+//#region src/skills/runtime/tool-dispatch.ts
+/**
+* Policy-enforcement seam for skill `command-dispatch: tool` invocations.
+* Keep this aligned with the normal tool surfaces so GHSA-mhm4-93fw-4qr2
+* stays closed across allow/deny, group, sandbox, and subagent policy layers.
+*/
+function resolveSkillDispatchTools(params) {
+	const channel = resolveGatewayMessageChannel(params.message.surface) ?? resolveGatewayMessageChannel(params.message.provider) ?? void 0;
+	const { agentId: resolvedAgentId, globalPolicy, globalProviderPolicy, agentPolicy, agentProviderPolicy, profile, providerProfile, profileAlsoAllow, providerProfileAlsoAllow } = resolveEffectiveToolPolicy({
+		config: params.cfg,
+		sessionKey: params.sessionKey,
+		agentId: params.agentId,
+		modelProvider: params.provider,
+		modelId: params.model
+	});
+	const profilePolicy = resolveToolProfilePolicy(profile);
+	const providerProfilePolicy = resolveToolProfilePolicy(providerProfile);
+	const profilePolicyWithAlsoAllow = mergeAlsoAllowPolicy(profilePolicy, profileAlsoAllow);
+	const providerProfilePolicyWithAlsoAllow = mergeAlsoAllowPolicy(providerProfilePolicy, providerProfileAlsoAllow);
+	const groupId = params.sessionEntry?.groupId ?? params.groupId;
+	const groupPolicy = resolveGroupToolPolicy({
+		config: params.cfg,
+		sessionKey: params.sessionKey,
+		spawnedBy: params.sessionEntry?.spawnedBy,
+		messageProvider: channel,
+		groupId,
+		groupChannel: params.sessionEntry?.groupChannel,
+		groupSpace: params.sessionEntry?.space,
+		accountId: params.message.accountId,
+		senderId: params.message.senderId ?? params.senderId,
+		senderName: params.message.senderName,
+		senderUsername: params.message.senderUsername,
+		senderE164: params.message.senderE164
+	});
+	const senderPolicy = resolveSenderToolPolicy({
+		config: params.cfg,
+		agentId: resolvedAgentId,
+		messageProvider: channel,
+		senderId: params.message.senderId ?? params.senderId,
+		senderName: params.message.senderName,
+		senderUsername: params.message.senderUsername,
+		senderE164: params.message.senderE164
+	});
+	const sandboxRuntime = resolveSandboxRuntimeStatus({
+		cfg: params.cfg,
+		sessionKey: params.sessionKey
+	});
+	const sandboxPolicy = sandboxRuntime.sandboxed ? sandboxRuntime.toolPolicy : void 0;
+	const subagentStore = resolveSubagentCapabilityStore(params.sessionKey, { cfg: params.cfg });
+	const subagentPolicy = isSubagentEnvelopeSession(params.sessionKey, {
+		cfg: params.cfg,
+		store: subagentStore
+	}) ? resolveSubagentToolPolicyForSession(params.cfg, params.sessionKey, { store: subagentStore }) : void 0;
+	const inheritedToolPolicy = resolveInheritedToolPolicyForSession(params.cfg, params.sessionKey, { store: subagentStore });
+	const explicitPolicyList = [
+		profilePolicy,
+		providerProfilePolicy,
+		globalPolicy,
+		globalProviderPolicy,
+		agentPolicy,
+		agentProviderPolicy,
+		groupPolicy,
+		senderPolicy,
+		sandboxPolicy,
+		subagentPolicy,
+		inheritedToolPolicy
+	];
+	const inheritedToolAllowlist = [];
+	const beforeToolCallHookContext = params.skillCommand ? {
+		cwd: params.workspaceDir,
+		workspaceDir: params.workspaceDir,
+		...params.sessionEntry?.skillsSnapshot ? { skillsSnapshot: params.sessionEntry.skillsSnapshot } : {},
+		skillCommand: {
+			commandName: params.skillCommand.name,
+			skillName: params.skillCommand.skillName,
+			skillSource: params.skillCommand.skillSource ?? "unknown",
+			...params.skillCommand.toolName ? { toolName: params.skillCommand.toolName } : {}
+		}
+	} : void 0;
+	const policyFiltered = applyToolPolicyPipeline({
+		tools: createFengMingTools({
+			agentSessionKey: params.sessionKey,
+			agentChannel: channel,
+			agentAccountId: params.message.accountId,
+			agentTo: params.message.originatingTo ?? params.message.to,
+			agentThreadId: params.message.messageThreadId ?? void 0,
+			agentGroupId: groupId,
+			agentGroupChannel: params.sessionEntry?.groupChannel,
+			agentGroupSpace: params.sessionEntry?.space,
+			agentMemberRoleIds: params.message.memberRoleIds,
+			agentDir: params.agentDir,
+			workspaceDir: params.workspaceDir,
+			config: params.cfg,
+			allowGatewaySubagentBinding: true,
+			sandboxed: sandboxRuntime.sandboxed,
+			requesterAgentIdOverride: params.agentId,
+			requesterSenderId: params.senderId,
+			sessionId: params.sessionEntry?.sessionId,
+			currentChannelId: params.currentChannelId,
+			...beforeToolCallHookContext ? { beforeToolCallHookContext } : {},
+			modelProvider: params.provider,
+			modelId: params.model,
+			pluginToolAllowlist: collectExplicitAllowlist(explicitPolicyList),
+			pluginToolDenylist: collectExplicitDenylist(explicitPolicyList),
+			inheritedToolAllowlist,
+			inheritedToolDenylist: collectExplicitDenylist(explicitPolicyList)
+		}),
+		toolMeta: (tool) => getPluginToolMeta(tool),
+		warn: logVerbose,
+		steps: [
+			...buildDefaultToolPolicyPipelineSteps({
+				profilePolicy: profilePolicyWithAlsoAllow,
+				profile,
+				profileUnavailableCoreWarningAllowlist: profilePolicy?.allow,
+				providerProfilePolicy: providerProfilePolicyWithAlsoAllow,
+				providerProfile,
+				providerProfileUnavailableCoreWarningAllowlist: providerProfilePolicy?.allow,
+				globalPolicy,
+				globalProviderPolicy,
+				agentPolicy,
+				agentProviderPolicy,
+				groupPolicy,
+				senderPolicy,
+				agentId: resolvedAgentId
+			}),
+			{
+				policy: sandboxPolicy,
+				label: "sandbox tools.allow"
+			},
+			{
+				policy: subagentPolicy,
+				label: "subagent tools.allow"
+			},
+			{
+				policy: inheritedToolPolicy,
+				label: "inherited tools"
+			}
+		]
+	});
+	if (explicitPolicyList.some(hasRestrictiveAllowPolicy)) replaceWithEffectiveToolAllowlist(inheritedToolAllowlist, policyFiltered);
+	return policyFiltered;
+}
+//#endregion
+export { resolveSkillDispatchTools };