minimal-agent 0.13.0 → 0.14.0

package/src/team/auth.ts

@@ -0,0 +1,298 @@
+/** Minimal, opt-in team credential store.  Standalone startup never imports or
+ * reads it; only explicit team commands / online-model resolution do. */
+import { chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { getConfigFilePath } from '../config/configFile.js';
+import type { OnlineModelAvailability } from './onlineToolContract.js';
+
+const TEAM_REQUEST_TIMEOUT_MS = Math.max(
+  3_000,
+  Math.min(
+    60_000,
+    Number(process.env.MINIMAL_AGENT_TEAM_REQUEST_TIMEOUT_MS ?? 15_000),
+  ),
+);
+
+export interface TeamCredentials {
+  serverUrl: string;
+  deviceToken: string;
+  deviceLabel?: string;
+  updatedAt: number;
+}
+
+export interface OnlineModelCatalogItem {
+  id: string;
+  displayName: string;
+  model: string;
+  apiFormat: 'openai' | 'anthropic';
+  contextWindow: number;
+  maxTokens: number;
+  supportsVision: boolean;
+  capabilities?: { vision: boolean; tools: boolean; structuredOutput: boolean };
+  isDefault: boolean;
+  maxToolCategories: string[];
+  defaultToolCategories: string[];
+  availability?: OnlineModelAvailability;
+}
+
+export interface TeamAccountSubscription {
+  status: string;
+  planName: string;
+  billingInterval: string;
+  requestLimit: number;
+  inputTokenLimit: number;
+  outputTokenLimit: number;
+  requestCount: number;
+  inputTokens: number;
+  outputTokens: number;
+}
+
+function authPath(): string {
+  return join(dirname(getConfigFilePath()), 'team-auth.json');
+}
+
+export function normalizeTeamServerUrl(value: string): string {
+  const url = new URL(value.trim());
+  if (url.protocol !== 'https:' && url.protocol !== 'http:')
+    throw new Error('团队服务器必须使用 http(s) 地址');
+  const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+  const isLocalDevelopmentHost =
+    hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1';
+  if (
+    url.protocol === 'http:' &&
+    !isLocalDevelopmentHost &&
+    process.env.KAKADEAI_ALLOW_HTTP_TEAM_SERVER !== '1'
+  ) {
+    throw new Error(
+      '团队服务器必须使用 HTTPS（开发环境可使用本机地址或显式允许 HTTP）',
+    );
+  }
+  url.search = '';
+  url.hash = '';
+  return url.toString().replace(/\/$/, '');
+}
+
+export async function loadTeamCredentials(
+  expectedServerUrl?: string,
+): Promise<TeamCredentials | null> {
+  const rawServerUrl = process.env.KAKADEAI_SOCIAL_SERVER_URL;
+  // The Desktop shell deliberately injects an empty value in standalone mode.
+  // An empty environment value is an explicit opt-out and must not fall back
+  // to a stale team-auth.json left by an earlier team-mode run.
+  if (rawServerUrl !== undefined && !rawServerUrl.trim()) return null;
+  const serverUrl = rawServerUrl?.trim() ?? expectedServerUrl?.trim();
+  if (
+    rawServerUrl?.trim() &&
+    expectedServerUrl?.trim() &&
+    normalizeTeamServerUrl(rawServerUrl) !==
+      normalizeTeamServerUrl(expectedServerUrl)
+  )
+    return null;
+  const deviceToken = process.env.KAKADEAI_TEAM_DEVICE_TOKEN?.trim();
+  if (serverUrl && deviceToken) {
+    return {
+      serverUrl: normalizeTeamServerUrl(serverUrl),
+      deviceToken,
+      ...(process.env.KAKADEAI_TEAM_DEVICE_LABEL
+        ? { deviceLabel: process.env.KAKADEAI_TEAM_DEVICE_LABEL }
+        : {}),
+      updatedAt: Date.now(),
+    };
+  }
+  try {
+    const raw = JSON.parse(
+      await readFile(authPath(), 'utf8'),
+    ) as Partial<TeamCredentials>;
+    if (!raw.serverUrl || !raw.deviceToken) return null;
+    const storedServerUrl = normalizeTeamServerUrl(raw.serverUrl);
+    if (serverUrl && storedServerUrl !== normalizeTeamServerUrl(serverUrl))
+      return null;
+    return {
+      serverUrl: storedServerUrl,
+      deviceToken: raw.deviceToken,
+      ...(raw.deviceLabel ? { deviceLabel: raw.deviceLabel } : {}),
+      updatedAt: Number(raw.updatedAt) || 0,
+    };
+  } catch {
+    return null;
+  }
+}
+
+export async function saveTeamCredentials(
+  value: TeamCredentials,
+): Promise<void> {
+  const path = authPath();
+  await mkdir(dirname(path), { recursive: true });
+  const temporary = `${path}.${process.pid}.tmp`;
+  await writeFile(
+    temporary,
+    `${JSON.stringify({ ...value, serverUrl: normalizeTeamServerUrl(value.serverUrl) }, null, 2)}\n`,
+    { mode: 0o600 },
+  );
+  await chmod(temporary, 0o600).catch(() => {});
+  await rename(temporary, path);
+  await chmod(path, 0o600).catch(() => {});
+}
+
+export async function clearTeamCredentials(): Promise<void> {
+  const path = authPath();
+  await writeFile(path, '{}\n', { mode: 0o600 }).catch(() => {});
+}
+
+/**
+ * Revoke exactly the credentials supplied by the caller, then clear the local
+ * copy. A null value is deliberately local-only: silently discovering an old
+ * team-auth.json here could make standalone logout contact a historical
+ * server. Callers that want remote revocation must first load credentials
+ * against the currently configured server.
+ */
+export async function revokeTeamCredentials(
+  credentials: TeamCredentials | null,
+): Promise<void> {
+  if (credentials?.serverUrl && credentials.deviceToken) {
+    await fetch(`${credentials.serverUrl}/api/auth/device/logout`, {
+      method: 'POST',
+      headers: { authorization: `Bearer ${credentials.deviceToken}` },
+    }).catch(() => {});
+  }
+  await clearTeamCredentials();
+}
+
+export async function fetchOnlineModels(
+  credentials: TeamCredentials,
+): Promise<OnlineModelCatalogItem[]> {
+  const response = await fetch(`${credentials.serverUrl}/api/models`, {
+    headers: { authorization: `Bearer ${credentials.deviceToken}` },
+    signal: AbortSignal.timeout(TEAM_REQUEST_TIMEOUT_MS),
+  });
+  const body = (await response.json().catch(() => ({}))) as {
+    models?: OnlineModelCatalogItem[];
+    error?: string;
+    code?: string;
+  };
+  if (!response.ok) {
+    const code =
+      body.code ??
+      (response.status === 401
+        ? 'DEVICE_REVOKED'
+        : response.status === 403
+          ? 'MODEL_UNAVAILABLE'
+          : `HTTP_${response.status}`);
+    throw new Error(
+      `[${code}] ${body.error ?? `读取在线模型失败（${response.status}）`}`,
+    );
+  }
+  return (body.models ?? []).filter((model) => typeof model.id === 'string');
+}
+
+export async function fetchTeamSubscription(
+  credentials: TeamCredentials,
+): Promise<TeamAccountSubscription | null> {
+  const response = await fetch(
+    `${credentials.serverUrl}/api/account/subscription`,
+    {
+      headers: { authorization: `Bearer ${credentials.deviceToken}` },
+      signal: AbortSignal.timeout(TEAM_REQUEST_TIMEOUT_MS),
+    },
+  );
+  const body = (await response.json().catch(() => ({}))) as {
+    subscription?: TeamAccountSubscription | null;
+    error?: string;
+  };
+  if (!response.ok)
+    throw new Error(body.error ?? `读取订阅失败（${response.status}）`);
+  return body.subscription ?? null;
+}
+
+export async function fetchTeamUsage(
+  credentials: TeamCredentials,
+): Promise<unknown[]> {
+  const response = await fetch(`${credentials.serverUrl}/api/account/usage`, {
+    headers: { authorization: `Bearer ${credentials.deviceToken}` },
+    signal: AbortSignal.timeout(TEAM_REQUEST_TIMEOUT_MS),
+  });
+  const body = (await response.json().catch(() => ({}))) as {
+    usage?: unknown[];
+    error?: string;
+  };
+  if (!response.ok)
+    throw new Error(body.error ?? `读取用量失败（${response.status}）`);
+  return body.usage ?? [];
+}
+
+export async function resolveOnlineModel(
+  modelId: string,
+  expectedServerUrl?: string,
+): Promise<{
+  credentials: TeamCredentials;
+  model: OnlineModelCatalogItem;
+} | null> {
+  const credentials = await loadTeamCredentials(expectedServerUrl);
+  if (!credentials) return null;
+  const models = await fetchOnlineModels(credentials);
+  const model = models.find((item) => item.id === modelId);
+  return model ? { credentials, model } : null;
+}
+
+export async function beginTeamLogin(
+  serverUrl: string,
+  deviceLabel = 'minimal-agent',
+): Promise<{ authorizeUrl: string; complete: () => Promise<TeamCredentials> }> {
+  const normalized = normalizeTeamServerUrl(serverUrl);
+  const start = await fetch(`${normalized}/api/auth/device/start`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ clientLabel: deviceLabel }),
+    signal: AbortSignal.timeout(TEAM_REQUEST_TIMEOUT_MS),
+  });
+  const authorization = (await start.json().catch(() => ({}))) as {
+    requestId?: string;
+    deviceCode?: string;
+    authorizeUrl?: string;
+    error?: string;
+  };
+  if (
+    !start.ok ||
+    !authorization.requestId ||
+    !authorization.deviceCode ||
+    !authorization.authorizeUrl
+  )
+    throw new Error(authorization.error ?? '无法发起团队登录');
+  return {
+    authorizeUrl: authorization.authorizeUrl,
+    complete: async () => {
+      const deadline = Date.now() + 10 * 60_000;
+      while (Date.now() < deadline) {
+        const poll = await fetch(
+          `${normalized}/api/auth/device/poll?requestId=${encodeURIComponent(authorization.requestId!)}`,
+          {
+            headers: {
+              'x-kakadeai-device-code': authorization.deviceCode!,
+            },
+            signal: AbortSignal.timeout(TEAM_REQUEST_TIMEOUT_MS),
+          },
+        );
+        const result = (await poll.json().catch(() => ({}))) as {
+          state?: string;
+          deviceToken?: string;
+          error?: string;
+        };
+        if (result.state === 'approved' && result.deviceToken) {
+          const credentials: TeamCredentials = {
+            serverUrl: normalized,
+            deviceToken: result.deviceToken,
+            deviceLabel,
+            updatedAt: Date.now(),
+          };
+          await saveTeamCredentials(credentials);
+          return credentials;
+        }
+        if (result.state === 'expired')
+          throw new Error('浏览器授权已过期，请重新登录');
+        if (!poll.ok && result.error) throw new Error(result.error);
+        await new Promise((resolve) => setTimeout(resolve, 1500));
+      }
+      throw new Error('等待浏览器授权超时');
+    },
+  };
+}

package/src/team/cli.js

@@ -0,0 +1,105 @@
+import { configService } from '../config/configService.js';
+import { beginTeamLogin, clearTeamCredentials, fetchOnlineModels, fetchTeamSubscription, fetchTeamUsage, loadTeamCredentials, revokeTeamCredentials, } from './auth.js';
+async function openBrowser(url) {
+    const command = process.platform === 'darwin'
+        ? ['open', url]
+        : process.platform === 'win32'
+            ? ['cmd', '/c', 'start', '', url]
+            : ['xdg-open', url];
+    try {
+        Bun.spawn({ cmd: command, stdout: 'ignore', stderr: 'ignore' });
+    }
+    catch {
+        /* URL is printed as a reliable fallback */
+    }
+}
+async function configuredCredentials() {
+    const configured = await configService.resolveTeamServerUrl();
+    return configured.value ? loadTeamCredentials(configured.value) : null;
+}
+/** Returns true when argv was a team command and has been fully handled. */
+export async function runTeamCommand(args) {
+    const topLevel = args[0] === 'login' || args[0] === 'logout' || args[0] === 'status';
+    if (args[0] !== 'team' && !topLevel)
+        return false;
+    const action = topLevel ? args[0] : (args[1] ?? 'status');
+    if (action === 'status') {
+        const credentials = await configuredCredentials();
+        if (!credentials)
+            console.log('团队在线模型：未登录（单机模式不受影响）');
+        else {
+            try {
+                const models = await fetchOnlineModels(credentials);
+                console.log(`团队服务器：${credentials.serverUrl}\n设备授权：有效\n可用在线模型：${models.length}`);
+            }
+            catch (error) {
+                console.log(`团队服务器：${credentials.serverUrl}\n设备授权：不可用（${error instanceof Error ? error.message : String(error)}）`);
+            }
+        }
+        return true;
+    }
+    if (action === 'logout') {
+        // Resolve against the currently configured server first.  If standalone
+        // mode has no server configured, a stale team-auth.json must only be
+        // cleared locally and must never trigger a request to an old server.
+        const configured = await configService.resolveTeamServerUrl();
+        if (configured.value) {
+            const credentials = await loadTeamCredentials(configured.value);
+            if (credentials)
+                await revokeTeamCredentials(credentials);
+            else
+                await clearTeamCredentials();
+        }
+        else {
+            // No configured server is the standalone boundary. Do not let
+            // revokeTeamCredentials() discover and contact a stale auth file.
+            await clearTeamCredentials();
+        }
+        console.log('已清除本机团队设备授权；本地模型配置和 Session 未受影响。');
+        return true;
+    }
+    if (action === 'models') {
+        const credentials = await configuredCredentials();
+        if (!credentials) {
+            console.log('未登录团队服务器；当前仅使用本机模型。');
+            return true;
+        }
+        const models = await fetchOnlineModels(credentials);
+        for (const model of models)
+            console.log(`${model.displayName} · ${model.model}${model.isDefault ? ' · 默认' : ''}${model.availability?.reason ? ` · ${model.availability.reason}` : ''}`);
+        return true;
+    }
+    if (action === 'usage') {
+        const credentials = await configuredCredentials();
+        if (!credentials) {
+            console.log('未登录团队服务器。');
+            return true;
+        }
+        const subscription = await fetchTeamSubscription(credentials);
+        console.log(subscription
+            ? `订阅：${subscription.planName} · ${subscription.status}\n请求：${subscription.requestCount}/${subscription.requestLimit}\n输入 Token：${subscription.inputTokens}/${subscription.inputTokenLimit}\n输出 Token：${subscription.outputTokens}/${subscription.outputTokenLimit}`
+            : '当前没有有效订阅');
+        const usage = await fetchTeamUsage(credentials);
+        console.log(`模型用量记录：${usage.length} 条`);
+        return true;
+    }
+    if (action === 'login') {
+        const explicit = topLevel ? undefined : args[2];
+        const resolved = explicit
+            ? undefined
+            : await configService.resolveTeamServerUrl();
+        const serverUrl = explicit ?? resolved?.value;
+        if (!serverUrl)
+            throw new Error('KakadeAI 登录服务暂时不可用，请稍后重试');
+        if (!explicit)
+            console.log(`使用 KakadeAI 服务（${resolved.source === 'env' ? '环境变量覆盖' : resolved.source === 'config' ? '本机配置' : '内置默认'}）`);
+        const login = await beginTeamLogin(serverUrl, 'minimal-agent CLI');
+        console.log(`请在浏览器完成登录并允许此设备：\n${login.authorizeUrl}`);
+        await openBrowser(login.authorizeUrl);
+        const credentials = await login.complete();
+        const models = await fetchOnlineModels(credentials);
+        console.log(`团队登录完成，可用在线模型：${models.length}`);
+        return true;
+    }
+    throw new Error('用法：minimal-agent login|logout|status 或 minimal-agent team [login|logout|status|models|usage]');
+}

package/src/team/cli.ts

@@ -0,0 +1,122 @@
+import { configService } from '../config/configService.js';
+import {
+  beginTeamLogin,
+  clearTeamCredentials,
+  fetchOnlineModels,
+  fetchTeamSubscription,
+  fetchTeamUsage,
+  loadTeamCredentials,
+  revokeTeamCredentials,
+} from './auth.js';
+
+async function openBrowser(url: string): Promise<void> {
+  const command =
+    process.platform === 'darwin'
+      ? ['open', url]
+      : process.platform === 'win32'
+        ? ['cmd', '/c', 'start', '', url]
+        : ['xdg-open', url];
+  try {
+    Bun.spawn({ cmd: command, stdout: 'ignore', stderr: 'ignore' });
+  } catch {
+    /* URL is printed as a reliable fallback */
+  }
+}
+
+async function configuredCredentials() {
+  const configured = await configService.resolveTeamServerUrl();
+  return configured.value ? loadTeamCredentials(configured.value) : null;
+}
+
+/** Returns true when argv was a team command and has been fully handled. */
+export async function runTeamCommand(args: string[]): Promise<boolean> {
+  const topLevel =
+    args[0] === 'login' || args[0] === 'logout' || args[0] === 'status';
+  if (args[0] !== 'team' && !topLevel) return false;
+  const action = topLevel ? args[0] : (args[1] ?? 'status');
+  if (action === 'status') {
+    const credentials = await configuredCredentials();
+    if (!credentials) console.log('团队在线模型：未登录（单机模式不受影响）');
+    else {
+      try {
+        const models = await fetchOnlineModels(credentials);
+        console.log(
+          `团队服务器：${credentials.serverUrl}\n设备授权：有效\n可用在线模型：${models.length}`,
+        );
+      } catch (error) {
+        console.log(
+          `团队服务器：${credentials.serverUrl}\n设备授权：不可用（${error instanceof Error ? error.message : String(error)}）`,
+        );
+      }
+    }
+    return true;
+  }
+  if (action === 'logout') {
+    // Resolve against the currently configured server first.  If standalone
+    // mode has no server configured, a stale team-auth.json must only be
+    // cleared locally and must never trigger a request to an old server.
+    const configured = await configService.resolveTeamServerUrl();
+    if (configured.value) {
+      const credentials = await loadTeamCredentials(configured.value);
+      if (credentials) await revokeTeamCredentials(credentials);
+      else await clearTeamCredentials();
+    } else {
+      // No configured server is the standalone boundary. Do not let
+      // revokeTeamCredentials() discover and contact a stale auth file.
+      await clearTeamCredentials();
+    }
+    console.log('已清除本机团队设备授权；本地模型配置和 Session 未受影响。');
+    return true;
+  }
+  if (action === 'models') {
+    const credentials = await configuredCredentials();
+    if (!credentials) {
+      console.log('未登录团队服务器；当前仅使用本机模型。');
+      return true;
+    }
+    const models = await fetchOnlineModels(credentials);
+    for (const model of models)
+      console.log(
+        `${model.displayName} · ${model.model}${model.isDefault ? ' · 默认' : ''}${model.availability?.reason ? ` · ${model.availability.reason}` : ''}`,
+      );
+    return true;
+  }
+  if (action === 'usage') {
+    const credentials = await configuredCredentials();
+    if (!credentials) {
+      console.log('未登录团队服务器。');
+      return true;
+    }
+    const subscription = await fetchTeamSubscription(credentials);
+    console.log(
+      subscription
+        ? `订阅：${subscription.planName} · ${subscription.status}\n请求：${subscription.requestCount}/${subscription.requestLimit}\n输入 Token：${subscription.inputTokens}/${subscription.inputTokenLimit}\n输出 Token：${subscription.outputTokens}/${subscription.outputTokenLimit}`
+        : '当前没有有效订阅',
+    );
+    const usage = await fetchTeamUsage(credentials);
+    console.log(`模型用量记录：${usage.length} 条`);
+    return true;
+  }
+  if (action === 'login') {
+    const explicit = topLevel ? undefined : args[2];
+    const resolved = explicit
+      ? undefined
+      : await configService.resolveTeamServerUrl();
+    const serverUrl = explicit ?? resolved?.value;
+    if (!serverUrl) throw new Error('KakadeAI 登录服务暂时不可用，请稍后重试');
+    if (!explicit)
+      console.log(
+        `使用 KakadeAI 服务（${resolved!.source === 'env' ? '环境变量覆盖' : resolved!.source === 'config' ? '本机配置' : '内置默认'}）`,
+      );
+    const login = await beginTeamLogin(serverUrl, 'minimal-agent CLI');
+    console.log(`请在浏览器完成登录并允许此设备：\n${login.authorizeUrl}`);
+    await openBrowser(login.authorizeUrl);
+    const credentials = await login.complete();
+    const models = await fetchOnlineModels(credentials);
+    console.log(`团队登录完成，可用在线模型：${models.length}`);
+    return true;
+  }
+  throw new Error(
+    '用法：minimal-agent login|logout|status 或 minimal-agent team [login|logout|status|models|usage]',
+  );
+}

package/src/team/onlineToolContract.js

@@ -0,0 +1,64 @@
+export const ONLINE_TOOL_CATEGORIES = [
+    'workspace',
+    'web',
+    'computer',
+    'subagents',
+    'integrations',
+];
+export const ONLINE_TOOL_CATEGORY_BY_NAME = {
+    Read: 'workspace',
+    Edit: 'workspace',
+    MultiEdit: 'workspace',
+    Write: 'workspace',
+    NotebookEdit: 'workspace',
+    Glob: 'workspace',
+    Grep: 'workspace',
+    LSP: 'workspace',
+    Bash: 'workspace',
+    PowerShell: 'workspace',
+    ApplyPatch: 'workspace',
+    Trash: 'workspace',
+    EnterWorktree: 'workspace',
+    ExitWorktree: 'workspace',
+    TerminalCapture: 'workspace',
+    TaskCreate: 'workspace',
+    TaskGet: 'workspace',
+    TaskUpdate: 'workspace',
+    TaskList: 'workspace',
+    TaskOutput: 'workspace',
+    TaskStop: 'workspace',
+    PresentResult: 'workspace',
+    Snip: 'workspace',
+    RecallMemory: 'workspace',
+    RememberMemory: 'workspace',
+    UpdateMemory: 'workspace',
+    ListMemories: 'workspace',
+    ForgetMemory: 'workspace',
+    SetPersona: 'workspace',
+    ClearPersona: 'workspace',
+    ConfirmMemory: 'workspace',
+    ReviewMemories: 'workspace',
+    SearchConversations: 'workspace',
+    AskUserQuestion: 'workspace',
+    Skill: 'workspace',
+    WebSearch: 'web',
+    WebFetch: 'web',
+    WebBrowser: 'web',
+    BrowserBatch: 'web',
+    BrowserCDP: 'web',
+    Download: 'web',
+    ComputerUse: 'computer',
+    Agent: 'subagents',
+    AgentMessage: 'subagents',
+    AgentList: 'subagents',
+    AgentWait: 'subagents',
+    AgentInterrupt: 'subagents',
+    AgentFollowup: 'subagents',
+    Advisor: 'subagents',
+    AdvisorDecision: 'subagents',
+    GenerateImage: 'integrations',
+    GenerateSpeech: 'integrations',
+};
+export function onlineToolCategory(name) {
+    return ONLINE_TOOL_CATEGORY_BY_NAME[name];
+}

package/src/team/onlineToolContract.ts

@@ -0,0 +1,109 @@
+/**
+ * Versioned-by-package contract for tools that may be described to the
+ * remote inference gateway.  The server imports this allow-list as well as
+ * the local Agent, so a newly registered local/plugin tool fails closed until
+ * it is deliberately added here.
+ */
+export type OnlineToolCategory =
+  | 'workspace'
+  | 'web'
+  | 'computer'
+  | 'subagents'
+  | 'integrations';
+
+/**
+ * Shared availability vocabulary for the server catalog and local clients.
+ * `offline` and `disabled` are retained as client-side fallback states; the
+ * server uses the more specific states when it can determine the cause.
+ */
+export type OnlineModelAvailabilityState =
+  | 'available'
+  | 'quota_exhausted'
+  | 'concurrency_exceeded'
+  | 'not_authorized'
+  | 'model_disabled'
+  | 'server_offline'
+  | 'device_expired'
+  | 'offline'
+  | 'disabled';
+
+export interface OnlineModelAvailability {
+  state: OnlineModelAvailabilityState;
+  reason?: string;
+  remainingRequests?: number;
+  remainingInputTokens?: number;
+  remainingOutputTokens?: number;
+  activeRequests?: number;
+  maxConcurrent?: number;
+}
+
+export const ONLINE_TOOL_CATEGORIES = [
+  'workspace',
+  'web',
+  'computer',
+  'subagents',
+  'integrations',
+] as const satisfies readonly OnlineToolCategory[];
+
+export const ONLINE_TOOL_CATEGORY_BY_NAME = {
+  Read: 'workspace',
+  Edit: 'workspace',
+  MultiEdit: 'workspace',
+  Write: 'workspace',
+  NotebookEdit: 'workspace',
+  Glob: 'workspace',
+  Grep: 'workspace',
+  LSP: 'workspace',
+  Bash: 'workspace',
+  PowerShell: 'workspace',
+  ApplyPatch: 'workspace',
+  Trash: 'workspace',
+  EnterWorktree: 'workspace',
+  ExitWorktree: 'workspace',
+  TerminalCapture: 'workspace',
+  TaskCreate: 'workspace',
+  TaskGet: 'workspace',
+  TaskUpdate: 'workspace',
+  TaskList: 'workspace',
+  TaskOutput: 'workspace',
+  TaskStop: 'workspace',
+  PresentResult: 'workspace',
+  Snip: 'workspace',
+  RecallMemory: 'workspace',
+  RememberMemory: 'workspace',
+  UpdateMemory: 'workspace',
+  ListMemories: 'workspace',
+  ForgetMemory: 'workspace',
+  SetPersona: 'workspace',
+  ClearPersona: 'workspace',
+  ConfirmMemory: 'workspace',
+  ReviewMemories: 'workspace',
+  SearchConversations: 'workspace',
+  AskUserQuestion: 'workspace',
+  Skill: 'workspace',
+  WebSearch: 'web',
+  WebFetch: 'web',
+  WebBrowser: 'web',
+  BrowserBatch: 'web',
+  BrowserCDP: 'web',
+  Download: 'web',
+  ComputerUse: 'computer',
+  Agent: 'subagents',
+  AgentMessage: 'subagents',
+  AgentList: 'subagents',
+  AgentWait: 'subagents',
+  AgentInterrupt: 'subagents',
+  AgentFollowup: 'subagents',
+  Advisor: 'subagents',
+  AdvisorDecision: 'subagents',
+  GenerateImage: 'integrations',
+  GenerateSpeech: 'integrations',
+} as const satisfies Readonly<Record<string, OnlineToolCategory>>;
+
+export function onlineToolCategory(
+  name: string,
+): OnlineToolCategory | undefined {
+  return ONLINE_TOOL_CATEGORY_BY_NAME[
+    name as keyof typeof ONLINE_TOOL_CATEGORY_BY_NAME
+  ];
+}