mocode-ai 0.7.0 → 0.7.2

package/dist/tools/builtins/run-command.js

@@ -1,6 +1,6 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { MAX_OUTPUT } from '../constants.js';
-import { getSandboxRoot, filterEnv, isCommandDenied } from '../../sandbox/index.js';
+import { getSandboxRoot, filterEnv, isCommandDenied, jailResolve } from '../../sandbox/index.js';
 import { t } from '../../i18n/index.js';
 const OUTPUT_HEAD_LIMIT = Math.floor(MAX_OUTPUT * 0.4);
 const OUTPUT_TAIL_LIMIT = MAX_OUTPUT - OUTPUT_HEAD_LIMIT;
@@ -25,6 +25,119 @@ class BoundedCommandOutput {
         return `${this.head}\n${t('command.outputTruncated', { count: removed })}\n${this.tail}`;
     }
 }
+/** Execute a command with the same sandbox, output cap and cancellation semantics as run_command. */
+export async function runCommandRaw(command, timeout = 120000, signal, cwd) {
+    const startedAt = Date.now();
+    const deny = isCommandDenied(command);
+    if (deny) {
+        return { status: 'denied', exitCode: null, output: `错误:${deny}`, durationMs: 0 };
+    }
+    let executionCwd = getSandboxRoot() ?? process.cwd();
+    if (cwd) {
+        try {
+            executionCwd = jailResolve(cwd);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return { status: 'denied', exitCode: null, output: `错误:${message}`, durationMs: 0 };
+        }
+    }
+    return new Promise((done) => {
+        const isWin = process.platform === 'win32';
+        const child = spawn(isWin ? 'cmd.exe' : 'bash', isWin ? ['/d', '/s', '/c', command] : ['-c', command], {
+            cwd: executionCwd,
+            env: filterEnv(process.env),
+            // Without this, Node re-quotes cmd.exe arguments and `node -e "..."` can become
+            // a string literal that exits 0, causing false-positive validation on Windows.
+            windowsVerbatimArguments: isWin,
+        });
+        const output = new BoundedCommandOutput();
+        let finished = false;
+        let timer;
+        const killTree = () => {
+            try {
+                if (isWin) {
+                    if (child.pid != null) {
+                        spawnSync('taskkill', ['/PID', String(child.pid), '/T', '/F'], { stdio: 'ignore' });
+                    }
+                }
+                else {
+                    child.kill('SIGTERM');
+                }
+            }
+            catch {
+                // Process already exited or best-effort termination failed.
+            }
+        };
+        const finish = (result) => {
+            if (finished)
+                return;
+            finished = true;
+            if (timer)
+                clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+            done({ ...result, durationMs: Date.now() - startedAt });
+        };
+        const onAbort = () => {
+            killTree();
+            finish({ status: 'aborted', exitCode: null, output: output.render().trim() });
+        };
+        const onChunk = (chunk) => output.append(chunk.toString('utf8'));
+        child.stdout.on('data', onChunk);
+        child.stderr.on('data', onChunk);
+        child.on('error', (error) => {
+            finish({ status: 'spawn_error', exitCode: null, output: error.message });
+        });
+        child.on('close', (code) => {
+            finish({
+                status: code === 0 ? 'passed' : 'failed',
+                exitCode: code,
+                output: output.render().trim(),
+            });
+        });
+        timer = setTimeout(() => {
+            killTree();
+            finish({ status: 'timed_out', exitCode: null, output: output.render().trim() });
+        }, timeout);
+        if (signal) {
+            if (signal.aborted)
+                onAbort();
+            else
+                signal.addEventListener('abort', onAbort, { once: true });
+        }
+    });
+}
+/** Preserve the public run_command text protocol while exposing structured status internally. */
+export function formatCommandResult(result) {
+    const output = result.output.trim();
+    if (result.status === 'denied')
+        return result.output;
+    if (result.status === 'aborted')
+        return `${t('command.interrupted')}\n${output}`;
+    if (result.status === 'timed_out')
+        return `${t('command.timedOut')}\n${output}`;
+    if (result.status === 'spawn_error')
+        return t('command.executionFailed', { message: result.output });
+    return `${t('command.exitCode', { code: result.exitCode ?? 'null' })}\n${output || t('toolSummary.noOutput')}`;
+}
+/** Convert the raw process status into the common structured tool contract. */
+function commandOutcome(result) {
+    const output = formatCommandResult(result);
+    switch (result.status) {
+        case 'passed':
+            return { status: 'success', code: 'OK', retryable: false, output, durationMs: result.durationMs };
+        case 'aborted':
+            return { status: 'aborted', code: 'ABORTED', retryable: false, output, durationMs: result.durationMs };
+        case 'denied':
+            return { status: 'denied', code: 'SANDBOX_DENIED', retryable: false, output, durationMs: result.durationMs };
+        case 'timed_out':
+            return { status: 'error', code: 'TIMEOUT', retryable: false, output, durationMs: result.durationMs };
+        case 'failed':
+            return { status: 'error', code: 'PROCESS_FAILED', retryable: false, output, durationMs: result.durationMs };
+        case 'spawn_error':
+            return { status: 'error', code: 'EXECUTION_ERROR', retryable: false, output, durationMs: result.durationMs };
+    }
+}
 // ---------- run_command ----------
 export const runCommandTool = {
     name: 'run_command',
@@ -41,70 +154,6 @@ export const runCommandTool = {
     async execute(args, ctx) {
         const command = String(args.command);
         const timeout = Number(args.timeout ?? 120000);
-        // 沙箱 best-effort:灾难性文件操作 denylist(非安全边界,只挡误操作;真隔离需 OS jailer)。
-        const deny = isCommandDenied(command);
-        if (deny)
-            return `错误:${deny}`;
-        return new Promise((done) => {
-            const isWin = process.platform === 'win32';
-            // 沙箱 best-effort:cwd 钉死 sandbox root(相对路径写落在牢内)+ env 脱敏(剥 *KEY/*TOKEN 等,防 LLM_API_KEY 泄子进程)
-            const child = spawn(isWin ? 'cmd.exe' : 'bash', isWin ? ['/c', command] : ['-c', command], { cwd: getSandboxRoot() ?? process.cwd(), env: filterEnv(process.env) });
-            const output = new BoundedCommandOutput();
-            let finished = false;
-            let timer;
-            // 杀整棵进程树。child.kill() 在 Windows 只杀 cmd.exe、npm 等子进程会孤儿继续跑(占锁、污染下一步),
-            // 故 Win 用 taskkill /T /F 树杀;Unix child.kill('SIGTERM')(bash -c 通常转发给前台子进程,best-effort)。
-            const killTree = () => {
-                try {
-                    if (isWin) {
-                        if (child.pid != null) {
-                            spawnSync('taskkill', ['/PID', String(child.pid), '/T', '/F'], {
-                                stdio: 'ignore',
-                            });
-                        }
-                    }
-                    else {
-                        child.kill('SIGTERM');
-                    }
-                }
-                catch {
-                    // 进程已退出 / kill 失败:忽略(close 事件会兜底 finish)
-                }
-            };
-            // abort(用户 Ctrl+C,经 executeTool ctx.signal 透传)→ 杀子进程树 + 返[已中断]
-            const onAbort = () => {
-                killTree();
-                finish(`${t('command.interrupted')}\n${output.render().trim()}`);
-            };
-            const finish = (s) => {
-                if (finished)
-                    return;
-                finished = true;
-                clearTimeout(timer);
-                ctx?.signal?.removeEventListener('abort', onAbort);
-                done(s);
-            };
-            const onChunk = (chunk) => {
-                output.append(chunk.toString('utf8'));
-            };
-            child.stdout.on('data', onChunk);
-            child.stderr.on('data', onChunk);
-            child.on('error', (e) => finish(t('command.executionFailed', { message: e.message })));
-            child.on('close', (code) => {
-                const result = output.render().trim();
-                finish(`${t('command.exitCode', { code: code ?? 'null' })}\n${result || t('toolSummary.noOutput')}`);
-            });
-            timer = setTimeout(() => {
-                killTree();
-                finish(`${t('command.timedOut')}\n${output.render().trim()}`);
-            }, timeout);
-            // 外部 abort signal:已 aborted 即时杀(防御;agent 循环顶检查通常会先拦),否则挂监听
-            if (ctx?.signal) {
-                if (ctx.signal.aborted)
-                    onAbort();
-                else
-                    ctx.signal.addEventListener('abort', onAbort, { once: true });
-            }
-        });
+        return commandOutcome(await runCommandRaw(command, timeout, ctx?.signal));
     },
 };

package/dist/tools/builtins/task.js

@@ -1,12 +1,13 @@
 import { spawnAgent } from '../../agent/spawn.js';
 import { MAX_OUTPUT } from '../constants.js';
 import { t } from '../../i18n/index.js';
+import { isSubAgentEnabled } from '../../config/index.js';
 // ---------- task ----------
 // 派生子 agent 执行独立子任务。子 agent 有独立 history(不污染主对话),
 // 可受限工具子集 + 低步数上限,最终摘要回灌主 history 供主 agent 继续。
 //
-// 适用:并行探查多个文件 / 分而治之的复杂任务 / 隔离上下文避免子任务工具噪声撑爆主窗口。
-// 子 agent 中间过程不写主屏,只返回最终摘要;主 agent 据摘要决定下一步。
+// 适用:分而治之的复杂任务 / 隔离上下文避免子任务工具噪声撑爆主窗口。
+// 多个 task 在共享工作区期间由 capability scheduler 串行执行；隔离 workspace 落地后再开放并行写。
 export const taskTool = {
     name: 'task',
     risk: 'dangerous',
@@ -35,6 +36,8 @@ export const taskTool = {
         required: ['prompt'],
     },
     async execute(args, ctx) {
+        if (!isSubAgentEnabled())
+            return t('task.disabled');
         const prompt = String(args.prompt ?? '');
         if (!prompt)
             return t('task.missingPrompt');

package/dist/tools/builtins/write-file.js

@@ -1,5 +1,6 @@
 import { writeFile, mkdir } from 'node:fs/promises';
 import { resolve, dirname } from 'node:path';
+import { verifyWrittenFile } from '../../verification/postconditions.js';
 // ---------- write_file ----------
 export const writeFileTool = {
     name: 'write_file',
@@ -19,6 +20,17 @@ export const writeFileTool = {
         const full = resolve(path);
         await mkdir(dirname(full), { recursive: true });
         await writeFile(full, content, 'utf8');
-        return `已写入 ${path} (${content.length} 字符)`;
+        const postcondition = await verifyWrittenFile(full, content);
+        if (postcondition.status === 'failed') {
+            return {
+                status: 'error',
+                code: 'POSTCONDITION_FAILED',
+                retryable: true,
+                output: postcondition.diagnostics
+                    .map((item) => `[${item.code ?? 'V0_FAILED'}] ${item.file ?? path}: ${item.message}`)
+                    .join('\n'),
+            };
+        }
+        return `已写入 ${path} (${content.length} 字符, sha256=${postcondition.actualHash})`;
     },
 };

package/dist/tools/constants.js

@@ -1,5 +1,5 @@
 /** 工具共享的截断 / 上限 / 忽略规则。 */
-import { isMemoryEnabled } from '../config/index.js';
+import { isMemoryEnabled, isSubAgentEnabled } from '../config/index.js';
 export const MAX_FILE_LINES = 2000;
 export const MAX_OUTPUT = 20000;
 export const MAX_RESULTS = 100;
@@ -54,3 +54,7 @@ export function getPlanDisabledTools() {
     next.delete('memory_forget');
     return next;
 }
+/** auto/plan 共用的运行时功能开关防线；关闭时即使模型幻觉调用也不得执行。 */
+export function getRuntimeDisabledTools() {
+    return isSubAgentEnabled() ? new Set() : new Set(['task']);
+}

package/dist/tools/registry.js

@@ -1,7 +1,9 @@
 import { builtinTools } from './builtins/index.js';
-import { beginPathMutation, beginWorkspaceMutation, endPathMutation, endWorkspaceMutation, } from '../rollback/index.js';
+import { beginPathMutation, beginWorkspaceMutation, endPathMutation, endWorkspaceMutation, getCurrentTurnMutationState, } from '../rollback/index.js';
 import { enforceSandbox } from '../sandbox/index.js';
+import { resolveResourceLockRequests, toolResourceLockManager } from './resource-lock.js';
 import { t } from '../i18n/index.js';
+import { isToolErrorOutput } from './result.js';
 /**
  * 可扩展工具注册表。数组实例始终稳定，使已经持有 tools 引用的 agent/LLM 能看到运行时新增工具。
  * 扩展按 source 替换，MCP 重连或配置刷新不会累积旧工具。
@@ -33,55 +35,155 @@ function rebuildTools() {
     }
     tools.splice(0, tools.length, ...next);
 }
+const DEFAULT_CAPABILITIES = Object.freeze({
+    effect: 'unknown',
+    concurrency: 'serial',
+    retry: 'never',
+});
+export function findTool(name) {
+    return tools.find((tool) => tool.name === name);
+}
+/** 缺少声明或找不到工具时返回保守能力，绝不把未知扩展并发执行。 */
+export function getToolCapabilities(toolOrName) {
+    const tool = typeof toolOrName === 'string' ? findTool(toolOrName) : toolOrName;
+    return tool?.capabilities ?? DEFAULT_CAPABILITIES;
+}
+export function getToolResourceKeys(toolOrName, args) {
+    const capabilities = getToolCapabilities(toolOrName);
+    try {
+        return capabilities.resources?.(args) ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+/** resource-locked write 是可生成文件 diff/按路径记 rollback 的文件 mutation。 */
+export function isFileMutationTool(name) {
+    const capabilities = getToolCapabilities(name);
+    return capabilities.effect === 'write' && capabilities.concurrency === 'resource-locked';
+}
+function isStructuredOutcome(value) {
+    return typeof value === 'object' && value !== null &&
+        typeof value.status === 'string' && typeof value.code === 'string' &&
+        typeof value.retryable === 'boolean' && typeof value.output === 'string';
+}
+function normalizeOutcome(value, capabilities, durationMs, changedFiles) {
+    if (isStructuredOutcome(value)) {
+        return {
+            ...value,
+            durationMs: value.durationMs ?? durationMs,
+            changedFiles: value.changedFiles ?? changedFiles,
+        };
+    }
+    const failed = isToolErrorOutput(value);
+    return {
+        status: failed ? 'error' : 'success',
+        code: failed ? 'EXECUTION_ERROR' : 'OK',
+        retryable: failed && capabilities.retry !== 'never',
+        output: value,
+        changedFiles,
+        durationMs,
+    };
+}
+function terminalOutcome(status, code, output, startedAt, changedFiles = []) {
+    return {
+        status,
+        code,
+        retryable: false,
+        output,
+        changedFiles,
+        durationMs: Date.now() - startedAt,
+    };
+}
 /**
- * 按名调度工具,统一 try/catch + JSON 解析,返回字符串而非抛错。
- * signal 透传给 tool.execute(经 ctx):长任务工具(run_command/web_fetch)abort 即时取消,
- * 让用户 Ctrl+C 能跟手中断工具执行(而非等命令跑完 / 超时)。
- * opts.dropContext:上下文剔除回调(drop_context 工具用),透传给 tool.execute 经 ctx。
+ * 结构化工具调度入口。永不抛错；旧字符串工具在此归一化为 ToolOutcome。
+ * 权限仍由 Agent 在展示工具头之前预检，保持现有交互时序。
  */
-export async function executeTool(name, argsRaw, signal, opts) {
-    const tool = tools.find((t) => t.name === name);
-    if (!tool)
-        return t('toolError.unknown', { name });
+export async function executeToolOutcome(name, argsRaw, signal, opts) {
+    const startedAt = Date.now();
+    if (signal?.aborted) {
+        return terminalOutcome('aborted', 'ABORTED', t('command.interrupted'), startedAt);
+    }
+    const tool = findTool(name);
+    if (!tool) {
+        return terminalOutcome('error', 'UNKNOWN_TOOL', t('toolError.unknown', { name }), startedAt);
+    }
     let args;
     try {
         args = argsRaw.trim() ? JSON.parse(argsRaw) : {};
     }
     catch {
-        return t('toolError.invalidJson', { name, arguments: argsRaw });
+        return terminalOutcome('error', 'INVALID_JSON', t('toolError.invalidJson', { name, arguments: argsRaw }), startedAt);
     }
+    const capabilities = getToolCapabilities(tool);
+    let mutationVersionBefore;
+    let capturedPath;
     try {
-        // 沙箱先重写/校验路径，保证快照与实际执行目标完全一致。
-        const sbErr = enforceSandbox(name, args);
-        if (sbErr)
-            return sbErr;
-        const pathCapture = (name === 'write_file' || name === 'edit_file') &&
-            typeof args.path === 'string' &&
-            args.path
-            ? beginPathMutation(args.path)
-            : null;
-        // shell 与 MCP 的副作用无法从参数可靠推断：以工作区前后状态识别实际改动。
-        // task 本身不扫描；其子 agent 共享当前轮，并在各自真实写工具处记账。
-        const workspaceCapture = name === 'run_command' || name.startsWith('mcp__')
-            ? beginWorkspaceMutation()
-            : null;
-        try {
-            return await tool.execute(args, {
-                signal,
-                dropContext: opts?.dropContext,
-            });
-        }
-        finally {
-            if (pathCapture)
-                endPathMutation(pathCapture, name);
-            if (workspaceCapture)
-                endWorkspaceMutation(workspaceCapture, name);
+        const sandboxError = enforceSandbox(name, args);
+        if (sandboxError) {
+            return terminalOutcome('denied', 'SANDBOX_DENIED', sandboxError, startedAt);
         }
+        const requests = resolveResourceLockRequests(capabilities, args);
+        return await toolResourceLockManager.withLocks(requests, signal, async () => {
+            // Diff 等执行前观察必须发生在真正持锁之后；同路径排队调用才能看到前序写入结果。
+            opts?.onLockAcquired?.(args);
+            const mutationBefore = getCurrentTurnMutationState();
+            mutationVersionBefore = mutationBefore.version;
+            const pathCapture = isFileMutationTool(name) && typeof args.path === 'string' && args.path
+                ? beginPathMutation(args.path)
+                : null;
+            capturedPath = pathCapture?.path;
+            // 进程和未知扩展可能间接改动任意文件；其 workspace lock 同时隔离全盘捕获。
+            const workspaceCapture = capabilities.effect === 'process' || capabilities.effect === 'unknown'
+                ? beginWorkspaceMutation()
+                : null;
+            let raw;
+            try {
+                raw = await tool.execute(args, {
+                    signal,
+                    dropContext: opts?.dropContext,
+                });
+            }
+            finally {
+                if (pathCapture)
+                    endPathMutation(pathCapture, name);
+                if (workspaceCapture)
+                    endWorkspaceMutation(workspaceCapture, name);
+            }
+            const mutationAfter = getCurrentTurnMutationState();
+            const changedFiles = mutationAfter.version !== mutationBefore.version
+                ? pathCapture
+                    ? mutationAfter.changedFiles
+                        .filter((item) => item.path === pathCapture.path)
+                        .map((item) => item.path)
+                    : mutationAfter.changedFiles.map((item) => item.path)
+                : [];
+            if (signal?.aborted) {
+                return terminalOutcome('aborted', 'ABORTED', String(isStructuredOutcome(raw) ? raw.output : raw), startedAt, changedFiles);
+            }
+            return normalizeOutcome(raw, capabilities, Date.now() - startedAt, changedFiles);
+        });
     }
-    catch (e) {
-        return t('toolError.execution', {
+    catch (error) {
+        const mutationAfter = getCurrentTurnMutationState();
+        const changedFiles = mutationVersionBefore !== undefined &&
+            mutationAfter.version !== mutationVersionBefore
+            ? capturedPath
+                ? mutationAfter.changedFiles
+                    .filter((item) => item.path === capturedPath)
+                    .map((item) => item.path)
+                : mutationAfter.changedFiles.map((item) => item.path)
+            : [];
+        if (signal?.aborted || (error instanceof Error && error.name === 'AbortError')) {
+            return terminalOutcome('aborted', 'ABORTED', t('command.interrupted'), startedAt, changedFiles);
+        }
+        return terminalOutcome('error', 'EXECUTION_ERROR', t('toolError.execution', {
             name,
-            message: e instanceof Error ? e.message : String(e),
-        });
+            message: error instanceof Error ? error.message : String(error),
+        }), startedAt, changedFiles);
     }
 }
+/** 字符串兼容入口：现有调用方、TUI 和 LLM history 无需同步迁移。 */
+export async function executeTool(name, argsRaw, signal, opts) {
+    return (await executeToolOutcome(name, argsRaw, signal, opts)).output;
+}

package/dist/tools/resource-lock.js

@@ -0,0 +1,148 @@
+import { normalize } from 'node:path';
+import { jailResolve } from '../sandbox/index.js';
+function abortError() {
+    const error = new Error('Resource lock acquisition aborted');
+    error.name = 'AbortError';
+    return error;
+}
+function requestConflicts(a, b) {
+    if (a.scope === 'workspace' || b.scope === 'workspace') {
+        if (a.mode === 'write' || b.mode === 'write')
+            return true;
+        return false;
+    }
+    return a.key === b.key && (a.mode === 'write' || b.mode === 'write');
+}
+function claimsConflict(a, b) {
+    return a.requests.some((left) => b.requests.some((right) => requestConflicts(left, right)));
+}
+/** Fair, abort-aware multi-resource read/write lock shared by all agent loops. */
+export class ResourceLockManager {
+    active = new Set();
+    waiting = [];
+    acquire(requests, signal) {
+        if (signal?.aborted)
+            return Promise.reject(abortError());
+        const normalized = dedupeRequests(requests);
+        if (normalized.length === 0)
+            return Promise.resolve(() => undefined);
+        return new Promise((resolve, reject) => {
+            const waiter = { requests: normalized, resolve, reject, signal };
+            if (signal) {
+                waiter.onAbort = () => {
+                    const index = this.waiting.indexOf(waiter);
+                    if (index < 0)
+                        return;
+                    this.waiting.splice(index, 1);
+                    signal.removeEventListener('abort', waiter.onAbort);
+                    reject(abortError());
+                    this.dispatch();
+                };
+                signal.addEventListener('abort', waiter.onAbort, { once: true });
+            }
+            this.waiting.push(waiter);
+            this.dispatch();
+        });
+    }
+    async withLocks(requests, signal, action) {
+        const release = await this.acquire(requests, signal);
+        try {
+            return await action();
+        }
+        finally {
+            release();
+        }
+    }
+    dispatch() {
+        const blocked = [];
+        for (let index = 0; index < this.waiting.length;) {
+            const waiter = this.waiting[index];
+            const conflictsActive = [...this.active].some((claim) => claimsConflict(waiter, claim));
+            const conflictsEarlier = blocked.some((claim) => claimsConflict(waiter, claim));
+            if (conflictsActive || conflictsEarlier) {
+                blocked.push(waiter);
+                index++;
+                continue;
+            }
+            this.waiting.splice(index, 1);
+            if (waiter.onAbort)
+                waiter.signal?.removeEventListener('abort', waiter.onAbort);
+            const claim = { requests: waiter.requests };
+            this.active.add(claim);
+            let released = false;
+            waiter.resolve(() => {
+                if (released)
+                    return;
+                released = true;
+                this.active.delete(claim);
+                this.dispatch();
+            });
+        }
+    }
+}
+function dedupeRequests(requests) {
+    const byKey = new Map();
+    for (const request of requests) {
+        const identity = `${request.scope}:${request.key}`;
+        const existing = byKey.get(identity);
+        if (!existing || request.mode === 'write')
+            byKey.set(identity, request);
+    }
+    return [...byKey.values()].sort((a, b) => `${a.scope}:${a.key}`.localeCompare(`${b.scope}:${b.key}`));
+}
+/** Stable lock identity: sandbox realpath plus Windows case/separator normalization. */
+export function canonicalFileResourceKey(input) {
+    let canonical = normalize(jailResolve(input));
+    if (process.platform === 'win32')
+        canonical = canonical.toLowerCase();
+    return `file:${canonical}`;
+}
+function modeFor(effect) {
+    return effect === 'read' ? 'read' : 'write';
+}
+const workspaceWrite = () => [{
+        key: 'workspace',
+        scope: 'workspace',
+        mode: 'write',
+    }];
+/** Resolve declared logical resources. Any ambiguity fails closed to a workspace write lock. */
+export function resolveResourceLockRequests(capabilities, args) {
+    if (capabilities.delegatesResourceLocks)
+        return [];
+    if (capabilities.effect === 'process' || capabilities.effect === 'unknown') {
+        return workspaceWrite();
+    }
+    let keys;
+    try {
+        keys = capabilities.resources?.(args) ?? [];
+    }
+    catch {
+        return workspaceWrite();
+    }
+    if (keys.length === 0) {
+        return capabilities.effect === 'network' ? [] : workspaceWrite();
+    }
+    const mode = modeFor(capabilities.effect);
+    const requests = [];
+    try {
+        for (const key of keys) {
+            if (typeof key !== 'string' || key.trim().length === 0)
+                return workspaceWrite();
+            if (key === 'workspace') {
+                requests.push({ key, scope: 'workspace', mode });
+            }
+            else if (key.startsWith('file:') && key.length > 5) {
+                requests.push({ key: canonicalFileResourceKey(key.slice(5)), scope: 'resource', mode });
+            }
+            else {
+                // Non-file logical resources are still lockable, but never treated as filesystem paths.
+                requests.push({ key, scope: 'resource', mode });
+            }
+        }
+    }
+    catch {
+        return workspaceWrite();
+    }
+    return dedupeRequests(requests);
+}
+export const toolResourceLockManager = new ResourceLockManager();