nolo-cli 0.1.29 → 0.1.31

package/agent-runtime/localWorkspaceTools.ts

@@ -5,6 +5,7 @@ import type {
   AgentRuntimeToolCallInput,
   AgentRuntimeToolResult,
 } from "./types";
+import type { HostRuntimeConfig } from "./hostRuntimeConfig";
 
 type LocalWorkspaceToolArgs = {
   workspaceRoot: string;
@@ -18,9 +19,13 @@ type WorkspaceFileArgs = {
   oldText?: unknown;
   newText?: unknown;
   expectedReplacements?: unknown;
+  edits?: unknown;
+  offset?: unknown;
+  limit?: unknown;
   query?: unknown;
   command?: unknown;
   cmd?: unknown;
+  timeout?: unknown;
   patch?: unknown;
   script?: unknown;
   args?: unknown;
@@ -74,6 +79,13 @@ const DEFAULT_LOCAL_CODING_TOOL_NAMES = [
   "searchFiles",
 ] as const;
 
+const DEFAULT_LOCAL_CODING_TOOL_NAMES_WITH_SHELL = [
+  "readFile",
+  "writeFile",
+  "editFile",
+  "execShell",
+] as const;
+
 const SHELL_TOOL_NAMES = ["execShell"] as const;
 const WORKSPACE_TOOL_NAME_SET = new Set<string>(WORKSPACE_TOOL_NAMES);
 const REMOVED_WORKSPACE_TOOL_NAMES = new Set([
@@ -115,11 +127,19 @@ function buildReadWorkspaceFileTool(): OpenAiCompatibleTool {
     function: {
       name: "readWorkspaceFile",
       description:
-        "Read a UTF-8 text file inside the workspace. Read before editing when you need the current content or exact text for replaceWorkspaceText; skip unnecessary reads for trivial known writes.",
+        "Read a UTF-8 text file inside the workspace. Read before editing when you need the current content or exact text for replaceWorkspaceText; skip unnecessary reads for trivial known writes. Use offset and limit to page large files by line range.",
       parameters: {
         type: "object",
         properties: {
           path: buildWorkspacePathProperty(),
+          offset: {
+            type: "integer",
+            description: "Optional zero-based starting line offset.",
+          },
+          limit: {
+            type: "integer",
+            description: "Optional maximum number of lines to return.",
+          },
         },
         required: ["path"],
       },
@@ -172,8 +192,26 @@ function buildReplaceWorkspaceTextTool(): OpenAiCompatibleTool {
             type: "integer",
             description: "Expected replacement count. Defaults to 1.",
           },
+          edits: {
+            type: "array",
+            description: "Optional batch exact-text replacements applied against the original file snapshot.",
+            items: {
+              type: "object",
+              properties: {
+                oldText: {
+                  type: "string",
+                  description: "Exact text currently present in the file.",
+                },
+                newText: {
+                  type: "string",
+                  description: "Replacement text to write in place of oldText.",
+                },
+              },
+              required: ["oldText", "newText"],
+            },
+          },
         },
-        required: ["path", "oldText", "newText"],
+        required: ["path"],
       },
     },
   };
@@ -316,7 +354,7 @@ function buildExecShellTool(toolName: string): OpenAiCompatibleTool {
     function: {
       name: toolName,
       description:
-        "Run a shell command in the local workspace. Commands already execute from the workspace root; do not cd into guessed paths such as /workspace, /repo, /home/user, or /home/user/workspace. Prefer one command that performs a complete verification or related git operation instead of many tiny commands. For branch setup, prefer idempotent commands such as git switch -C <branch> when replacing or recreating a benchmark branch is acceptable. Use portable POSIX commands for macOS/BSD shells; avoid GNU-only flags such as cat -A. Do not use cat -A. Do not use brittle byte-offset commands such as xxd -s -32. For separator lines, use echo or printf '%s\\n'. For text-file content or trailing-newline checks, prefer readFile over shell byte inspection when that tool is available. Do not run repeated git status, git log, git rev-parse, or branch checks after a successful command already returned the needed clean status and commit information; use one final verification command. If a command fails, use the error output to adjust the next command rather than repeating the same shape.",
+        "Run a shell command in the local workspace. Use execShell for ls, rg/grep, find, and git inspection when shell is available. Commands already execute from the workspace root; do not cd into guessed paths such as /workspace, /repo, /home/user, or /home/user/workspace. Prefer one command that performs a complete verification or related git operation instead of many tiny commands. For branch setup, prefer idempotent commands such as git switch -C <branch> when replacing or recreating a benchmark branch is acceptable. Use portable POSIX commands for macOS/BSD shells; avoid GNU-only flags such as cat -A. Do not use cat -A. Do not use brittle byte-offset commands such as xxd -s -32. For separator lines, use echo or printf '%s\\n'. For text-file content or trailing-newline checks, prefer readFile over shell byte inspection when that tool is available. Do not run repeated git status, git log, git rev-parse, or branch checks after a successful command already returned the needed clean status and commit information; use one final verification command. If a command fails, use the error output to adjust the next command rather than repeating the same shape. When output is truncated, the tool returns a workspace temp path for the full output.",
       parameters: {
         type: "object",
         properties: {
@@ -328,6 +366,10 @@ function buildExecShellTool(toolName: string): OpenAiCompatibleTool {
             type: "string",
             description: "Shell command to run.",
           },
+          timeout: {
+            type: "integer",
+            description: "Optional timeout in milliseconds. The runtime clamps values above its configured maximum.",
+          },
         },
       },
     },
@@ -452,18 +494,28 @@ function filterDeclaredWorkspaceToolNames(args: {
   return (args.toolNames ?? []).filter((toolName) =>
     WORKSPACE_TOOL_NAME_SET.has(toolName) &&
     !REMOVED_WORKSPACE_TOOL_NAMES.has(toolName) &&
-    (args.exposeShellTools || !SHELL_TOOL_NAMES.includes(toolName as any))
+      (args.exposeShellTools || !SHELL_TOOL_NAMES.includes(toolName as any))
   );
 }
 
+export function resolveLocalWorkspaceShellToolExposure(args: {
+  declaredToolNames?: string[];
+  hostRuntimeConfig?: Pick<HostRuntimeConfig, "capabilities">;
+}) {
+  return args.hostRuntimeConfig?.capabilities.allowShell === true &&
+    (args.declaredToolNames ?? []).includes("execShell");
+}
+
 export function buildLocalWorkspaceToolset(args: {
   declaredToolNames?: string[];
   exposeShellTools?: boolean;
 }) {
   const exposeShellTools = args.exposeShellTools === true;
+  const defaultToolNames = exposeShellTools
+    ? DEFAULT_LOCAL_CODING_TOOL_NAMES_WITH_SHELL
+    : DEFAULT_LOCAL_CODING_TOOL_NAMES;
   const toolNames = removeRedundantWorkspaceToolAliases(new Set([
-    ...DEFAULT_LOCAL_CODING_TOOL_NAMES,
-    ...(exposeShellTools ? SHELL_TOOL_NAMES : []),
+    ...defaultToolNames,
     ...filterDeclaredWorkspaceToolNames({
       toolNames: args.declaredToolNames,
       exposeShellTools,
@@ -538,6 +590,31 @@ function requireWorkspaceToolPath(args: WorkspaceFileArgs) {
   return requestedPath;
 }
 
+function readOptionalNonNegativeIntegerArg(value: unknown, label: string) {
+  if (value === undefined) return undefined;
+  const number = Number(value);
+  if (!Number.isInteger(number) || number < 0) {
+    throw new Error(`${label} must be a non-negative integer.`);
+  }
+  return number;
+}
+
+function readOptionalPositiveIntegerArg(value: unknown, label: string) {
+  if (value === undefined) return undefined;
+  const number = Number(value);
+  if (!Number.isInteger(number) || number < 1) {
+    throw new Error(`${label} must be a positive integer.`);
+  }
+  return number;
+}
+
+function readWorkspaceReadWindow(args: WorkspaceFileArgs) {
+  return {
+    offset: readOptionalNonNegativeIntegerArg(args.offset, "readWorkspaceFile offset") ?? 0,
+    limit: readOptionalPositiveIntegerArg(args.limit, "readWorkspaceFile limit"),
+  };
+}
+
 function requireWorkspaceFileContent(args: WorkspaceFileArgs) {
   if (typeof args.content !== "string") {
     throw new Error("writeWorkspaceFile requires string content.");
@@ -559,6 +636,37 @@ function requireWorkspaceNewText(args: WorkspaceFileArgs) {
   return args.newText;
 }
 
+type WorkspaceStructuredEdit = {
+  oldText: string;
+  newText: string;
+};
+
+function readWorkspaceStructuredEdits(args: WorkspaceFileArgs) {
+  if (args.edits === undefined) return null;
+  if (!Array.isArray(args.edits) || args.edits.length === 0) {
+    throw new Error("editFile edits must be a non-empty array.");
+  }
+  return args.edits.map((entry, index) => {
+    if (!entry || typeof entry !== "object") {
+      throw new Error(`editFile edits[${index}] must be an object.`);
+    }
+    const oldText = typeof (entry as Record<string, unknown>).oldText === "string"
+      ? ((entry as Record<string, unknown>).oldText as string)
+      : "";
+    if (!oldText) {
+      throw new Error(`editFile edits[${index}] oldText must be a non-empty string.`);
+    }
+    const newTextValue = (entry as Record<string, unknown>).newText;
+    if (typeof newTextValue !== "string") {
+      throw new Error(`editFile edits[${index}] newText must be a string.`);
+    }
+    return {
+      oldText,
+      newText: newTextValue,
+    };
+  });
+}
+
 function readExpectedReplacementCount(args: WorkspaceFileArgs) {
   if (args.expectedReplacements === undefined) return 1;
   const value = Number(args.expectedReplacements);
@@ -579,6 +687,79 @@ function pluralizeReplacement(count: number) {
   return count === 1 ? "replacement" : "replacements";
 }
 
+function findUniqueEditRange(args: {
+  content: string;
+  oldText: string;
+  requestedPath: string;
+  index: number;
+}) {
+  const start = args.content.indexOf(args.oldText);
+  if (start < 0) {
+    throw new Error(`editFile edits[${args.index}] oldText was not found in ${args.requestedPath}.`);
+  }
+  if (args.content.indexOf(args.oldText, start + 1) >= 0) {
+    throw new Error(
+      `editFile edits[${args.index}] oldText must match exactly once in ${args.requestedPath}.`
+    );
+  }
+  return {
+    start,
+    end: start + args.oldText.length,
+  };
+}
+
+function countLineNumberAtOffset(args: {
+  content: string;
+  offset: number;
+}) {
+  let lineNumber = 1;
+  for (let index = 0; index < args.offset; index += 1) {
+    if (args.content[index] === "\n") {
+      lineNumber += 1;
+    }
+  }
+  return lineNumber;
+}
+
+function applyWorkspaceStructuredEdits(args: {
+  content: string;
+  edits: WorkspaceStructuredEdit[];
+  requestedPath: string;
+}) {
+  const ranges = args.edits.map((edit, index) => ({
+    ...edit,
+    index,
+    ...findUniqueEditRange({
+      content: args.content,
+      oldText: edit.oldText,
+      requestedPath: args.requestedPath,
+      index,
+    }),
+  })).sort((left, right) => left.start - right.start);
+  for (let index = 1; index < ranges.length; index += 1) {
+    if (ranges[index]!.start < ranges[index - 1]!.end) {
+      throw new Error(`editFile edits overlap in ${args.requestedPath}.`);
+    }
+  }
+  let nextContent = args.content;
+  for (const range of [...ranges].sort((left, right) => right.start - left.start)) {
+    nextContent =
+      nextContent.slice(0, range.start) +
+      range.newText +
+      nextContent.slice(range.end);
+  }
+  return {
+    nextContent,
+    firstChangedLine: ranges.length > 0
+      ? countLineNumberAtOffset({
+          content: args.content,
+          offset: ranges[0]!.start,
+        })
+      : 1,
+    replacements: ranges.length,
+  };
+}
+
 function requireWorkspaceSearchQuery(args: WorkspaceFileArgs) {
   const query = typeof args.query === "string" ? args.query.trim() : "";
   if (!query) throw new Error("searchWorkspace requires a non-empty query.");
@@ -607,6 +788,10 @@ function requirePackageScript(args: WorkspaceFileArgs) {
   return script;
 }
 
+function readShellTimeoutMs(args: WorkspaceFileArgs) {
+  return readOptionalPositiveIntegerArg(args.timeout, "execShell timeout");
+}
+
 function requireVisualWaitSelector(args: WorkspaceFileArgs) {
   const selector = typeof args.waitSelector === "string" ? args.waitSelector.trim() : "";
   if (!selector) throw new Error("captureVisualState requires a non-empty waitSelector.");
@@ -666,9 +851,38 @@ function formatAvailableScripts(scripts: string[]) {
   return scripts.length ? scripts.join(", ") : "(none)";
 }
 
+function splitContentIntoLines(content: string) {
+  if (!content) return [];
+  const lines: string[] = [];
+  let start = 0;
+  for (let index = 0; index < content.length; index += 1) {
+    if (content[index] !== "\n") continue;
+    lines.push(content.slice(start, index + 1));
+    start = index + 1;
+  }
+  if (start < content.length) {
+    lines.push(content.slice(start));
+  }
+  return lines;
+}
+
+function appendReadContinuationHint(content: string, hint: string) {
+  if (!content) return hint;
+  return content.endsWith("\n") ? `${content}\n${hint}` : `${content}\n\n${hint}`;
+}
+
 function truncateToolOutput(value: string, limit = 20_000) {
-  if (value.length <= limit) return value;
-  return `${value.slice(0, limit)}\n\n[truncated ${value.length - limit} chars]`;
+  if (value.length <= limit) {
+    return { content: value, truncated: false };
+  }
+  return {
+    content: `${value.slice(0, limit)}\n\n[truncated ${value.length - limit} chars]`,
+    truncated: true,
+  };
+}
+
+function sanitizeWorkspaceTempName(value: string) {
+  return value.replace(/[^a-zA-Z0-9._-]+/g, "_");
 }
 
 function parseLastJsonObject(text: string): Record<string, unknown> | null {
@@ -768,16 +982,20 @@ async function runWorkspaceCommand(args: {
   const stderr = timedOut
     ? `${rawStderr.trim() ? `${rawStderr.trim()}\n` : ""}command timed out after ${timeoutMs}ms\n`
     : rawStderr;
+  const fullContent = [
+    stdout.trim() ? `stdout:\n${stdout.trim()}` : "",
+    stderr.trim() ? `stderr:\n${stderr.trim()}` : "",
+    `exitCode: ${exitCode}`,
+  ].filter(Boolean).join("\n\n");
+  const summarizedContent = truncateToolOutput(fullContent);
   return {
     stdout,
     stderr,
     exitCode,
     timedOut,
-    content: truncateToolOutput([
-      stdout.trim() ? `stdout:\n${stdout.trim()}` : "",
-      stderr.trim() ? `stderr:\n${stderr.trim()}` : "",
-      `exitCode: ${exitCode}`,
-    ].filter(Boolean).join("\n\n")),
+    fullContent,
+    outputTruncated: summarizedContent.truncated,
+    content: summarizedContent.content,
   };
 }
 
@@ -799,19 +1017,46 @@ async function readWorkspaceFileTool(args: {
 }): Promise<AgentRuntimeToolResult> {
   const parsed = parseWorkspaceToolArguments(args.call.arguments);
   const requestedPath = requireWorkspaceToolPath(parsed);
+  const readWindow = readWorkspaceReadWindow(parsed);
   const absolutePath = resolveLocalWorkspaceToolPath({
     workspaceRoot: args.workspaceRoot,
     requestedPath,
   });
   const content = await readFile(absolutePath, "utf8");
+  const lines = splitContentIntoLines(content);
+  const lineOffset = Math.min(readWindow.offset, lines.length);
+  const endLineIndex = readWindow.limit === undefined
+    ? lines.length
+    : Math.min(lineOffset + readWindow.limit, lines.length);
+  const pagedContent = lines.slice(lineOffset, endLineIndex).join("");
+  const returnedLineCount = endLineIndex - lineOffset;
+  const truncated = readWindow.limit !== undefined && endLineIndex < lines.length;
+  const toolContent = truncated && returnedLineCount > 0
+    ? appendReadContinuationHint(
+        pagedContent,
+        `[readFile truncated: returned lines ${lineOffset + 1}-${endLineIndex} of ${lines.length}; ` +
+          `call readFile again with offset ${endLineIndex}.]`
+      )
+    : pagedContent;
+  const relativePath = normalizeWorkspaceRelativePath({
+    workspaceRoot: resolve(args.workspaceRoot),
+    targetPath: absolutePath,
+  });
   return {
-    content,
+    content: readWindow.offset === 0 && readWindow.limit === undefined ? content : toolContent,
     metadata: {
-      path: normalizeWorkspaceRelativePath({
-        workspaceRoot: resolve(args.workspaceRoot),
-        targetPath: absolutePath,
-      }),
-      bytes: Buffer.byteLength(content),
+      path: relativePath,
+      bytes: Buffer.byteLength(readWindow.offset === 0 && readWindow.limit === undefined ? content : pagedContent),
+      ...(readWindow.offset !== 0 || readWindow.limit !== undefined
+        ? {
+            offset: readWindow.offset,
+            ...(readWindow.limit !== undefined ? { limit: readWindow.limit } : {}),
+            returnedLineCount,
+            totalLineCount: lines.length,
+            truncated,
+            ...(truncated ? { nextOffset: endLineIndex } : {}),
+          }
+        : {}),
     },
   };
 }
@@ -848,14 +1093,37 @@ async function replaceWorkspaceTextTool(args: {
 }): Promise<AgentRuntimeToolResult> {
   const parsed = parseWorkspaceToolArguments(args.call.arguments);
   const requestedPath = requireWorkspaceToolPath(parsed);
-  const oldText = requireWorkspaceOldText(parsed);
-  const newText = requireWorkspaceNewText(parsed);
-  const expectedReplacements = readExpectedReplacementCount(parsed);
+  const structuredEdits = readWorkspaceStructuredEdits(parsed);
   const absolutePath = resolveLocalWorkspaceToolPath({
     workspaceRoot: args.workspaceRoot,
     requestedPath,
   });
   const content = await readFile(absolutePath, "utf8");
+  const relativePath = normalizeWorkspaceRelativePath({
+    workspaceRoot: resolve(args.workspaceRoot),
+    targetPath: absolutePath,
+  });
+  if (structuredEdits) {
+    const result = applyWorkspaceStructuredEdits({
+      content,
+      edits: structuredEdits,
+      requestedPath,
+    });
+    await writeFile(absolutePath, result.nextContent, "utf8");
+    return {
+      content: `applied ${result.replacements} edit${result.replacements === 1 ? "" : "s"} in ${relativePath}`,
+      metadata: {
+        path: relativePath,
+        replacements: result.replacements,
+        editCount: structuredEdits.length,
+        bytes: Buffer.byteLength(result.nextContent),
+        firstChangedLine: result.firstChangedLine,
+      },
+    };
+  }
+  const oldText = requireWorkspaceOldText(parsed);
+  const newText = requireWorkspaceNewText(parsed);
+  const expectedReplacements = readExpectedReplacementCount(parsed);
   const replacementCount = countExactTextOccurrences({ content, oldText });
   if (replacementCount !== expectedReplacements) {
     throw new Error(
@@ -865,10 +1133,6 @@ async function replaceWorkspaceTextTool(args: {
   }
   const nextContent = content.split(oldText).join(newText);
   await writeFile(absolutePath, nextContent, "utf8");
-  const relativePath = normalizeWorkspaceRelativePath({
-    workspaceRoot: resolve(args.workspaceRoot),
-    targetPath: absolutePath,
-  });
   return {
     content: `replaced ${replacementCount} occurrence${replacementCount === 1 ? "" : "s"} in ${relativePath}`,
     metadata: {
@@ -1162,7 +1426,20 @@ async function previewLifecycleTool(args: {
   const summary = parseLastJsonObject(String(result.metadata?.stdoutTail ?? result.content)) ?? {};
   return {
     content: [
-      typeof summary.previewUrl === "string" ? `previewUrl: ${summary.previewUrl}` : "",
+      typeof summary.preferredPreviewUrl === "string"
+        ? `preferredPreviewUrl: ${summary.preferredPreviewUrl}`
+        : "",
+      typeof summary.assignedPreviewUrl === "string"
+        ? `assignedPreviewUrl: ${summary.assignedPreviewUrl}`
+        : typeof summary.previewUrl === "string"
+          ? `assignedPreviewUrl: ${summary.previewUrl}`
+          : "",
+      typeof summary.previewUrlVerified === "boolean"
+        ? `previewUrlVerified: ${String(summary.previewUrlVerified)}`
+        : "",
+      typeof summary.previewVerificationReason === "string"
+        ? `previewVerificationReason: ${summary.previewVerificationReason}`
+        : "",
       typeof summary.localApiOrigin === "string" ? `localApiOrigin: ${summary.localApiOrigin}` : "",
       typeof summary.serverDbPath === "string" ? `serverDbPath: ${summary.serverDbPath}` : "",
       "",
@@ -1184,6 +1461,13 @@ async function execShellTool(args: {
 }): Promise<AgentRuntimeToolResult> {
   const parsed = parseWorkspaceToolArguments(args.call.arguments);
   const command = requireShellCommand(parsed, args.call.name);
+  const requestedTimeoutMs = readShellTimeoutMs(parsed);
+  const timeoutMs = requestedTimeoutMs === undefined
+    ? args.commandTimeoutMs
+    : Math.min(
+        requestedTimeoutMs,
+        args.commandTimeoutMs ?? DEFAULT_WORKSPACE_COMMAND_TIMEOUT_MS,
+      );
   const result = await runWorkspaceCommand({
     workspaceRoot: args.workspaceRoot,
     command: buildWorkspaceShellCommand({
@@ -1191,12 +1475,31 @@ async function execShellTool(args: {
       command,
       shell: parsed.shell,
     }),
-    timeoutMs: args.commandTimeoutMs,
+    timeoutMs,
     commandPrefix: args.commandPrefix,
   });
+  let fullOutputPath: string | undefined;
+  if (result.outputTruncated) {
+    const relativeOutputPath = `.tmp/agent-runtime/execShell/${sanitizeWorkspaceTempName(args.call.id)}.log`;
+    const absoluteOutputPath = resolve(args.workspaceRoot, relativeOutputPath);
+    await mkdir(dirname(absoluteOutputPath), { recursive: true });
+    await writeFile(absoluteOutputPath, result.fullContent, "utf8");
+    fullOutputPath = normalizeWorkspaceRelativePath({
+      workspaceRoot: resolve(args.workspaceRoot),
+      targetPath: absoluteOutputPath,
+    });
+  }
   return {
-    content: result.content,
-    metadata: { exitCode: result.exitCode, timedOut: result.timedOut },
+    content: fullOutputPath
+      ? `${result.content}\n\n[full output saved to ${fullOutputPath}]`
+      : result.content,
+    metadata: {
+      exitCode: result.exitCode,
+      timedOut: result.timedOut,
+      timeoutMs: timeoutMs ?? DEFAULT_WORKSPACE_COMMAND_TIMEOUT_MS,
+      ...(result.outputTruncated ? { outputTruncated: true } : {}),
+      ...(fullOutputPath ? { fullOutputPath } : {}),
+    },
   };
 }
 

package/agent-runtime/platformChatProvider.ts

@@ -230,7 +230,9 @@ export function hasDirectOpenAiCompatibleProvider(env: EnvLike) {
 }
 
 function agentRequiresPlatformChatProvider(agentConfig?: AgentRuntimeAgentConfig) {
-  return agentConfig?.apiSource === "platform" || agentConfig?.rawRecord?.useServerProxy === true;
+  if (agentConfig?.apiSource === "platform") return true;
+  if (agentConfig?.customProviderUrl?.trim()) return false;
+  return agentConfig?.rawRecord?.useServerProxy === true;
 }
 
 export function shouldUsePlatformChatProvider(
@@ -238,6 +240,7 @@ export function shouldUsePlatformChatProvider(
   agentConfig?: AgentRuntimeAgentConfig
 ) {
   if (agentRequiresPlatformChatProvider(agentConfig)) return true;
+  if (agentConfig?.customProviderUrl?.trim()) return false;
   if (env.NOLO_LOCAL_LLM === "platform") return true;
   if (env.NOLO_LOCAL_LLM === "direct") return false;
   return !hasDirectOpenAiCompatibleProvider(env) && canUsePlatformChatProvider(env);

package/agent-runtime/runtimeToolPolicy.ts

@@ -1,5 +1,5 @@
 import type { AgentRuntimeAgentConfig } from "./hostAdapter";
-import type { AgentRuntimeHost, AgentRuntimeToolPolicy } from "./types";
+import type { AgentRuntimeToolPolicy } from "./types";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -77,57 +77,42 @@ export function mergeAgentRuntimeToolPolicies(
   };
 }
 
-function policyRequestsHostedWorkspace(policy: AgentRuntimeToolPolicy | undefined) {
-  if (!policy) return false;
-  const workspaceMode = policy.workspace?.mode;
-  return (
-    policy.shell?.enabled === true ||
-    policy.runtimeTools?.some((tool) => tool === "execShell") ||
-    workspaceMode === "lease" ||
-    workspaceMode === "task-worktree"
-  );
+function runtimeBindingRecord(runtimeBinding: unknown): Record<string, unknown> | undefined {
+  return isRecord(runtimeBinding) ? runtimeBinding : undefined;
 }
 
-function applyWebRuntimeSafetyBaseline(
-  policy: AgentRuntimeToolPolicy | undefined,
-): AgentRuntimeToolPolicy | undefined {
-  if (!policyRequestsHostedWorkspace(policy)) return policy;
-  return mergeAgentRuntimeToolPolicies(
-    policy,
-    {
-      version: 1,
-      shell: {
-        commandPolicy: "approval",
-        networkPolicy: "default-deny",
-      },
-      isolation: {
-        mode: "os-sandbox",
-      },
-      audit: {
-        logToolCalls: true,
-        logShellCommands: true,
-        writeToDialog: true,
-      },
-    },
-  );
+function runtimePolicyFromRuntimeBinding(runtimeBinding: unknown): AgentRuntimeToolPolicy | undefined {
+  const binding = runtimeBindingRecord(runtimeBinding);
+  if (!binding) return undefined;
+  return normalizeAgentRuntimeToolPolicy(binding.runtimeToolPolicy);
+}
+
+function runtimePolicySnapshotFromRuntimeBinding(runtimeBinding: unknown): AgentRuntimeToolPolicy | undefined {
+  const binding = runtimeBindingRecord(runtimeBinding);
+  if (!binding) return undefined;
+  return normalizeAgentRuntimeToolPolicy(binding.runtimeToolPolicySnapshot);
+}
+
+export function resolveRequestedRuntimeToolNames(args: {
+  agentConfig: Pick<AgentRuntimeAgentConfig, "toolNames" | "runtimeToolPolicy" | "runtimeBinding">;
+}) {
+  const agentPolicy = normalizeAgentRuntimeToolPolicy(args.agentConfig.runtimeToolPolicy);
+  const bindingPolicy = runtimePolicyFromRuntimeBinding(args.agentConfig.runtimeBinding);
+  const bindingSnapshotPolicy = runtimePolicySnapshotFromRuntimeBinding(args.agentConfig.runtimeBinding);
+  return unique([
+    ...stringArray(args.agentConfig.toolNames),
+    ...(agentPolicy?.runtimeTools ?? []),
+    ...(bindingPolicy?.runtimeTools ?? []),
+    ...(bindingSnapshotPolicy?.runtimeTools ?? []),
+  ]);
 }
 
 export function resolveEffectiveRuntimeToolPolicy(args: {
   agentConfig: Pick<AgentRuntimeAgentConfig, "runtimeToolPolicy" | "runtimeBinding">;
-  taskRunControl?: { runtimeToolPolicy?: unknown } | null;
-  host?: AgentRuntimeHost;
 }): AgentRuntimeToolPolicy | undefined {
-  const agentPolicy = normalizeAgentRuntimeToolPolicy(
-    args.agentConfig.runtimeToolPolicy ??
-      (isRecord(args.agentConfig.runtimeBinding)
-        ? args.agentConfig.runtimeBinding.runtimeToolPolicy
-        : undefined),
-  );
-  const taskPolicy = normalizeAgentRuntimeToolPolicy(
-    args.taskRunControl?.runtimeToolPolicy,
-  );
-  const effectivePolicy = mergeAgentRuntimeToolPolicies(agentPolicy, taskPolicy);
-  return args.host === "web"
-    ? applyWebRuntimeSafetyBaseline(effectivePolicy)
-    : effectivePolicy;
+  const bindingSnapshot = runtimePolicySnapshotFromRuntimeBinding(args.agentConfig.runtimeBinding);
+  if (bindingSnapshot) return bindingSnapshot;
+  const topLevelPolicy = normalizeAgentRuntimeToolPolicy(args.agentConfig.runtimeToolPolicy);
+  if (topLevelPolicy) return topLevelPolicy;
+  return runtimePolicyFromRuntimeBinding(args.agentConfig.runtimeBinding);
 }