nolo-cli 0.1.32 → 0.1.33

package/agent-runtime/localWorkspaceTools.ts

@@ -5,7 +5,6 @@ import type {
   AgentRuntimeToolCallInput,
   AgentRuntimeToolResult,
 } from "./types";
-import type { HostRuntimeConfig } from "./hostRuntimeConfig";
 
 type LocalWorkspaceToolArgs = {
   workspaceRoot: string;
@@ -19,13 +18,9 @@ type WorkspaceFileArgs = {
   oldText?: unknown;
   newText?: unknown;
   expectedReplacements?: unknown;
-  edits?: unknown;
-  offset?: unknown;
-  limit?: unknown;
   query?: unknown;
   command?: unknown;
   cmd?: unknown;
-  timeout?: unknown;
   patch?: unknown;
   script?: unknown;
   args?: unknown;
@@ -79,13 +74,6 @@ const DEFAULT_LOCAL_CODING_TOOL_NAMES = [
   "searchFiles",
 ] as const;
 
-const DEFAULT_LOCAL_CODING_TOOL_NAMES_WITH_SHELL = [
-  "readFile",
-  "writeFile",
-  "editFile",
-  "execShell",
-] as const;
-
 const SHELL_TOOL_NAMES = ["execShell"] as const;
 const WORKSPACE_TOOL_NAME_SET = new Set<string>(WORKSPACE_TOOL_NAMES);
 const REMOVED_WORKSPACE_TOOL_NAMES = new Set([
@@ -127,19 +115,11 @@ function buildReadWorkspaceFileTool(): OpenAiCompatibleTool {
     function: {
       name: "readWorkspaceFile",
       description:
-        "Read a UTF-8 text file inside the workspace. Read before editing when you need the current content or exact text for replaceWorkspaceText; skip unnecessary reads for trivial known writes. Use offset and limit to page large files by line range.",
+        "Read a UTF-8 text file inside the workspace. Read before editing when you need the current content or exact text for replaceWorkspaceText; skip unnecessary reads for trivial known writes.",
       parameters: {
         type: "object",
         properties: {
           path: buildWorkspacePathProperty(),
-          offset: {
-            type: "integer",
-            description: "Optional zero-based starting line offset.",
-          },
-          limit: {
-            type: "integer",
-            description: "Optional maximum number of lines to return.",
-          },
         },
         required: ["path"],
       },
@@ -192,26 +172,8 @@ function buildReplaceWorkspaceTextTool(): OpenAiCompatibleTool {
             type: "integer",
             description: "Expected replacement count. Defaults to 1.",
           },
-          edits: {
-            type: "array",
-            description: "Optional batch exact-text replacements applied against the original file snapshot.",
-            items: {
-              type: "object",
-              properties: {
-                oldText: {
-                  type: "string",
-                  description: "Exact text currently present in the file.",
-                },
-                newText: {
-                  type: "string",
-                  description: "Replacement text to write in place of oldText.",
-                },
-              },
-              required: ["oldText", "newText"],
-            },
-          },
         },
-        required: ["path"],
+        required: ["path", "oldText", "newText"],
       },
     },
   };
@@ -354,7 +316,7 @@ function buildExecShellTool(toolName: string): OpenAiCompatibleTool {
     function: {
       name: toolName,
       description:
-        "Run a shell command in the local workspace. Use execShell for ls, rg/grep, find, and git inspection when shell is available. Commands already execute from the workspace root; do not cd into guessed paths such as /workspace, /repo, /home/user, or /home/user/workspace. Prefer one command that performs a complete verification or related git operation instead of many tiny commands. For branch setup, prefer idempotent commands such as git switch -C <branch> when replacing or recreating a benchmark branch is acceptable. Use portable POSIX commands for macOS/BSD shells; avoid GNU-only flags such as cat -A. Do not use cat -A. Do not use brittle byte-offset commands such as xxd -s -32. For separator lines, use echo or printf '%s\\n'. For text-file content or trailing-newline checks, prefer readFile over shell byte inspection when that tool is available. Do not run repeated git status, git log, git rev-parse, or branch checks after a successful command already returned the needed clean status and commit information; use one final verification command. If a command fails, use the error output to adjust the next command rather than repeating the same shape. When output is truncated, the tool returns a workspace temp path for the full output.",
+        "Run a shell command in the local workspace. Commands already execute from the workspace root; do not cd into guessed paths such as /workspace, /repo, /home/user, or /home/user/workspace. Prefer one command that performs a complete verification or related git operation instead of many tiny commands. For branch setup, prefer idempotent commands such as git switch -C <branch> when replacing or recreating a benchmark branch is acceptable. Use portable POSIX commands for macOS/BSD shells; avoid GNU-only flags such as cat -A. Do not use cat -A. Do not use brittle byte-offset commands such as xxd -s -32. For separator lines, use echo or printf '%s\\n'. For text-file content or trailing-newline checks, prefer readFile over shell byte inspection when that tool is available. Do not run repeated git status, git log, git rev-parse, or branch checks after a successful command already returned the needed clean status and commit information; use one final verification command. If a command fails, use the error output to adjust the next command rather than repeating the same shape.",
       parameters: {
         type: "object",
         properties: {
@@ -366,10 +328,6 @@ function buildExecShellTool(toolName: string): OpenAiCompatibleTool {
             type: "string",
             description: "Shell command to run.",
           },
-          timeout: {
-            type: "integer",
-            description: "Optional timeout in milliseconds. The runtime clamps values above its configured maximum.",
-          },
         },
       },
     },
@@ -494,28 +452,18 @@ function filterDeclaredWorkspaceToolNames(args: {
   return (args.toolNames ?? []).filter((toolName) =>
     WORKSPACE_TOOL_NAME_SET.has(toolName) &&
     !REMOVED_WORKSPACE_TOOL_NAMES.has(toolName) &&
-      (args.exposeShellTools || !SHELL_TOOL_NAMES.includes(toolName as any))
+    (args.exposeShellTools || !SHELL_TOOL_NAMES.includes(toolName as any))
   );
 }
 
-export function resolveLocalWorkspaceShellToolExposure(args: {
-  declaredToolNames?: string[];
-  hostRuntimeConfig?: Pick<HostRuntimeConfig, "capabilities">;
-}) {
-  return args.hostRuntimeConfig?.capabilities.allowShell === true &&
-    (args.declaredToolNames ?? []).includes("execShell");
-}
-
 export function buildLocalWorkspaceToolset(args: {
   declaredToolNames?: string[];
   exposeShellTools?: boolean;
 }) {
   const exposeShellTools = args.exposeShellTools === true;
-  const defaultToolNames = exposeShellTools
-    ? DEFAULT_LOCAL_CODING_TOOL_NAMES_WITH_SHELL
-    : DEFAULT_LOCAL_CODING_TOOL_NAMES;
   const toolNames = removeRedundantWorkspaceToolAliases(new Set([
-    ...defaultToolNames,
+    ...DEFAULT_LOCAL_CODING_TOOL_NAMES,
+    ...(exposeShellTools ? SHELL_TOOL_NAMES : []),
     ...filterDeclaredWorkspaceToolNames({
       toolNames: args.declaredToolNames,
       exposeShellTools,
@@ -590,31 +538,6 @@ function requireWorkspaceToolPath(args: WorkspaceFileArgs) {
   return requestedPath;
 }
 
-function readOptionalNonNegativeIntegerArg(value: unknown, label: string) {
-  if (value === undefined) return undefined;
-  const number = Number(value);
-  if (!Number.isInteger(number) || number < 0) {
-    throw new Error(`${label} must be a non-negative integer.`);
-  }
-  return number;
-}
-
-function readOptionalPositiveIntegerArg(value: unknown, label: string) {
-  if (value === undefined) return undefined;
-  const number = Number(value);
-  if (!Number.isInteger(number) || number < 1) {
-    throw new Error(`${label} must be a positive integer.`);
-  }
-  return number;
-}
-
-function readWorkspaceReadWindow(args: WorkspaceFileArgs) {
-  return {
-    offset: readOptionalNonNegativeIntegerArg(args.offset, "readWorkspaceFile offset") ?? 0,
-    limit: readOptionalPositiveIntegerArg(args.limit, "readWorkspaceFile limit"),
-  };
-}
-
 function requireWorkspaceFileContent(args: WorkspaceFileArgs) {
   if (typeof args.content !== "string") {
     throw new Error("writeWorkspaceFile requires string content.");
@@ -636,37 +559,6 @@ function requireWorkspaceNewText(args: WorkspaceFileArgs) {
   return args.newText;
 }
 
-type WorkspaceStructuredEdit = {
-  oldText: string;
-  newText: string;
-};
-
-function readWorkspaceStructuredEdits(args: WorkspaceFileArgs) {
-  if (args.edits === undefined) return null;
-  if (!Array.isArray(args.edits) || args.edits.length === 0) {
-    throw new Error("editFile edits must be a non-empty array.");
-  }
-  return args.edits.map((entry, index) => {
-    if (!entry || typeof entry !== "object") {
-      throw new Error(`editFile edits[${index}] must be an object.`);
-    }
-    const oldText = typeof (entry as Record<string, unknown>).oldText === "string"
-      ? ((entry as Record<string, unknown>).oldText as string)
-      : "";
-    if (!oldText) {
-      throw new Error(`editFile edits[${index}] oldText must be a non-empty string.`);
-    }
-    const newTextValue = (entry as Record<string, unknown>).newText;
-    if (typeof newTextValue !== "string") {
-      throw new Error(`editFile edits[${index}] newText must be a string.`);
-    }
-    return {
-      oldText,
-      newText: newTextValue,
-    };
-  });
-}
-
 function readExpectedReplacementCount(args: WorkspaceFileArgs) {
   if (args.expectedReplacements === undefined) return 1;
   const value = Number(args.expectedReplacements);
@@ -687,79 +579,6 @@ function pluralizeReplacement(count: number) {
   return count === 1 ? "replacement" : "replacements";
 }
 
-function findUniqueEditRange(args: {
-  content: string;
-  oldText: string;
-  requestedPath: string;
-  index: number;
-}) {
-  const start = args.content.indexOf(args.oldText);
-  if (start < 0) {
-    throw new Error(`editFile edits[${args.index}] oldText was not found in ${args.requestedPath}.`);
-  }
-  if (args.content.indexOf(args.oldText, start + 1) >= 0) {
-    throw new Error(
-      `editFile edits[${args.index}] oldText must match exactly once in ${args.requestedPath}.`
-    );
-  }
-  return {
-    start,
-    end: start + args.oldText.length,
-  };
-}
-
-function countLineNumberAtOffset(args: {
-  content: string;
-  offset: number;
-}) {
-  let lineNumber = 1;
-  for (let index = 0; index < args.offset; index += 1) {
-    if (args.content[index] === "\n") {
-      lineNumber += 1;
-    }
-  }
-  return lineNumber;
-}
-
-function applyWorkspaceStructuredEdits(args: {
-  content: string;
-  edits: WorkspaceStructuredEdit[];
-  requestedPath: string;
-}) {
-  const ranges = args.edits.map((edit, index) => ({
-    ...edit,
-    index,
-    ...findUniqueEditRange({
-      content: args.content,
-      oldText: edit.oldText,
-      requestedPath: args.requestedPath,
-      index,
-    }),
-  })).sort((left, right) => left.start - right.start);
-  for (let index = 1; index < ranges.length; index += 1) {
-    if (ranges[index]!.start < ranges[index - 1]!.end) {
-      throw new Error(`editFile edits overlap in ${args.requestedPath}.`);
-    }
-  }
-  let nextContent = args.content;
-  for (const range of [...ranges].sort((left, right) => right.start - left.start)) {
-    nextContent =
-      nextContent.slice(0, range.start) +
-      range.newText +
-      nextContent.slice(range.end);
-  }
-  return {
-    nextContent,
-    firstChangedLine: ranges.length > 0
-      ? countLineNumberAtOffset({
-          content: args.content,
-          offset: ranges[0]!.start,
-        })
-      : 1,
-    replacements: ranges.length,
-  };
-}
-
 function requireWorkspaceSearchQuery(args: WorkspaceFileArgs) {
   const query = typeof args.query === "string" ? args.query.trim() : "";
   if (!query) throw new Error("searchWorkspace requires a non-empty query.");
@@ -788,10 +607,6 @@ function requirePackageScript(args: WorkspaceFileArgs) {
   return script;
 }
 
-function readShellTimeoutMs(args: WorkspaceFileArgs) {
-  return readOptionalPositiveIntegerArg(args.timeout, "execShell timeout");
-}
-
 function requireVisualWaitSelector(args: WorkspaceFileArgs) {
   const selector = typeof args.waitSelector === "string" ? args.waitSelector.trim() : "";
   if (!selector) throw new Error("captureVisualState requires a non-empty waitSelector.");
@@ -851,38 +666,9 @@ function formatAvailableScripts(scripts: string[]) {
   return scripts.length ? scripts.join(", ") : "(none)";
 }
 
-function splitContentIntoLines(content: string) {
-  if (!content) return [];
-  const lines: string[] = [];
-  let start = 0;
-  for (let index = 0; index < content.length; index += 1) {
-    if (content[index] !== "\n") continue;
-    lines.push(content.slice(start, index + 1));
-    start = index + 1;
-  }
-  if (start < content.length) {
-    lines.push(content.slice(start));
-  }
-  return lines;
-}
-
-function appendReadContinuationHint(content: string, hint: string) {
-  if (!content) return hint;
-  return content.endsWith("\n") ? `${content}\n${hint}` : `${content}\n\n${hint}`;
-}
-
 function truncateToolOutput(value: string, limit = 20_000) {
-  if (value.length <= limit) {
-    return { content: value, truncated: false };
-  }
-  return {
-    content: `${value.slice(0, limit)}\n\n[truncated ${value.length - limit} chars]`,
-    truncated: true,
-  };
-}
-
-function sanitizeWorkspaceTempName(value: string) {
-  return value.replace(/[^a-zA-Z0-9._-]+/g, "_");
+  if (value.length <= limit) return value;
+  return `${value.slice(0, limit)}\n\n[truncated ${value.length - limit} chars]`;
 }
 
 function parseLastJsonObject(text: string): Record<string, unknown> | null {
@@ -982,20 +768,16 @@ async function runWorkspaceCommand(args: {
   const stderr = timedOut
     ? `${rawStderr.trim() ? `${rawStderr.trim()}\n` : ""}command timed out after ${timeoutMs}ms\n`
     : rawStderr;
-  const fullContent = [
-    stdout.trim() ? `stdout:\n${stdout.trim()}` : "",
-    stderr.trim() ? `stderr:\n${stderr.trim()}` : "",
-    `exitCode: ${exitCode}`,
-  ].filter(Boolean).join("\n\n");
-  const summarizedContent = truncateToolOutput(fullContent);
   return {
     stdout,
     stderr,
     exitCode,
     timedOut,
-    fullContent,
-    outputTruncated: summarizedContent.truncated,
-    content: summarizedContent.content,
+    content: truncateToolOutput([
+      stdout.trim() ? `stdout:\n${stdout.trim()}` : "",
+      stderr.trim() ? `stderr:\n${stderr.trim()}` : "",
+      `exitCode: ${exitCode}`,
+    ].filter(Boolean).join("\n\n")),
   };
 }
 
@@ -1017,46 +799,19 @@ async function readWorkspaceFileTool(args: {
 }): Promise<AgentRuntimeToolResult> {
   const parsed = parseWorkspaceToolArguments(args.call.arguments);
   const requestedPath = requireWorkspaceToolPath(parsed);
-  const readWindow = readWorkspaceReadWindow(parsed);
   const absolutePath = resolveLocalWorkspaceToolPath({
     workspaceRoot: args.workspaceRoot,
     requestedPath,
   });
   const content = await readFile(absolutePath, "utf8");
-  const lines = splitContentIntoLines(content);
-  const lineOffset = Math.min(readWindow.offset, lines.length);
-  const endLineIndex = readWindow.limit === undefined
-    ? lines.length
-    : Math.min(lineOffset + readWindow.limit, lines.length);
-  const pagedContent = lines.slice(lineOffset, endLineIndex).join("");
-  const returnedLineCount = endLineIndex - lineOffset;
-  const truncated = readWindow.limit !== undefined && endLineIndex < lines.length;
-  const toolContent = truncated && returnedLineCount > 0
-    ? appendReadContinuationHint(
-        pagedContent,
-        `[readFile truncated: returned lines ${lineOffset + 1}-${endLineIndex} of ${lines.length}; ` +
-          `call readFile again with offset ${endLineIndex}.]`
-      )
-    : pagedContent;
-  const relativePath = normalizeWorkspaceRelativePath({
-    workspaceRoot: resolve(args.workspaceRoot),
-    targetPath: absolutePath,
-  });
   return {
-    content: readWindow.offset === 0 && readWindow.limit === undefined ? content : toolContent,
+    content,
     metadata: {
-      path: relativePath,
-      bytes: Buffer.byteLength(readWindow.offset === 0 && readWindow.limit === undefined ? content : pagedContent),
-      ...(readWindow.offset !== 0 || readWindow.limit !== undefined
-        ? {
-            offset: readWindow.offset,
-            ...(readWindow.limit !== undefined ? { limit: readWindow.limit } : {}),
-            returnedLineCount,
-            totalLineCount: lines.length,
-            truncated,
-            ...(truncated ? { nextOffset: endLineIndex } : {}),
-          }
-        : {}),
+      path: normalizeWorkspaceRelativePath({
+        workspaceRoot: resolve(args.workspaceRoot),
+        targetPath: absolutePath,
+      }),
+      bytes: Buffer.byteLength(content),
     },
   };
 }
@@ -1093,37 +848,14 @@ async function replaceWorkspaceTextTool(args: {
 }): Promise<AgentRuntimeToolResult> {
   const parsed = parseWorkspaceToolArguments(args.call.arguments);
   const requestedPath = requireWorkspaceToolPath(parsed);
-  const structuredEdits = readWorkspaceStructuredEdits(parsed);
+  const oldText = requireWorkspaceOldText(parsed);
+  const newText = requireWorkspaceNewText(parsed);
+  const expectedReplacements = readExpectedReplacementCount(parsed);
   const absolutePath = resolveLocalWorkspaceToolPath({
     workspaceRoot: args.workspaceRoot,
     requestedPath,
   });
   const content = await readFile(absolutePath, "utf8");
-  const relativePath = normalizeWorkspaceRelativePath({
-    workspaceRoot: resolve(args.workspaceRoot),
-    targetPath: absolutePath,
-  });
-  if (structuredEdits) {
-    const result = applyWorkspaceStructuredEdits({
-      content,
-      edits: structuredEdits,
-      requestedPath,
-    });
-    await writeFile(absolutePath, result.nextContent, "utf8");
-    return {
-      content: `applied ${result.replacements} edit${result.replacements === 1 ? "" : "s"} in ${relativePath}`,
-      metadata: {
-        path: relativePath,
-        replacements: result.replacements,
-        editCount: structuredEdits.length,
-        bytes: Buffer.byteLength(result.nextContent),
-        firstChangedLine: result.firstChangedLine,
-      },
-    };
-  }
-  const oldText = requireWorkspaceOldText(parsed);
-  const newText = requireWorkspaceNewText(parsed);
-  const expectedReplacements = readExpectedReplacementCount(parsed);
   const replacementCount = countExactTextOccurrences({ content, oldText });
   if (replacementCount !== expectedReplacements) {
     throw new Error(
@@ -1133,6 +865,10 @@ async function replaceWorkspaceTextTool(args: {
   }
   const nextContent = content.split(oldText).join(newText);
   await writeFile(absolutePath, nextContent, "utf8");
+  const relativePath = normalizeWorkspaceRelativePath({
+    workspaceRoot: resolve(args.workspaceRoot),
+    targetPath: absolutePath,
+  });
   return {
     content: `replaced ${replacementCount} occurrence${replacementCount === 1 ? "" : "s"} in ${relativePath}`,
     metadata: {
@@ -1426,20 +1162,7 @@ async function previewLifecycleTool(args: {
   const summary = parseLastJsonObject(String(result.metadata?.stdoutTail ?? result.content)) ?? {};
   return {
     content: [
-      typeof summary.preferredPreviewUrl === "string"
-        ? `preferredPreviewUrl: ${summary.preferredPreviewUrl}`
-        : "",
-      typeof summary.assignedPreviewUrl === "string"
-        ? `assignedPreviewUrl: ${summary.assignedPreviewUrl}`
-        : typeof summary.previewUrl === "string"
-          ? `assignedPreviewUrl: ${summary.previewUrl}`
-          : "",
-      typeof summary.previewUrlVerified === "boolean"
-        ? `previewUrlVerified: ${String(summary.previewUrlVerified)}`
-        : "",
-      typeof summary.previewVerificationReason === "string"
-        ? `previewVerificationReason: ${summary.previewVerificationReason}`
-        : "",
+      typeof summary.previewUrl === "string" ? `previewUrl: ${summary.previewUrl}` : "",
       typeof summary.localApiOrigin === "string" ? `localApiOrigin: ${summary.localApiOrigin}` : "",
       typeof summary.serverDbPath === "string" ? `serverDbPath: ${summary.serverDbPath}` : "",
       "",
@@ -1461,13 +1184,6 @@ async function execShellTool(args: {
 }): Promise<AgentRuntimeToolResult> {
   const parsed = parseWorkspaceToolArguments(args.call.arguments);
   const command = requireShellCommand(parsed, args.call.name);
-  const requestedTimeoutMs = readShellTimeoutMs(parsed);
-  const timeoutMs = requestedTimeoutMs === undefined
-    ? args.commandTimeoutMs
-    : Math.min(
-        requestedTimeoutMs,
-        args.commandTimeoutMs ?? DEFAULT_WORKSPACE_COMMAND_TIMEOUT_MS,
-      );
   const result = await runWorkspaceCommand({
     workspaceRoot: args.workspaceRoot,
     command: buildWorkspaceShellCommand({
@@ -1475,31 +1191,12 @@ async function execShellTool(args: {
       command,
       shell: parsed.shell,
     }),
-    timeoutMs,
+    timeoutMs: args.commandTimeoutMs,
     commandPrefix: args.commandPrefix,
   });
-  let fullOutputPath: string | undefined;
-  if (result.outputTruncated) {
-    const relativeOutputPath = `.tmp/agent-runtime/execShell/${sanitizeWorkspaceTempName(args.call.id)}.log`;
-    const absoluteOutputPath = resolve(args.workspaceRoot, relativeOutputPath);
-    await mkdir(dirname(absoluteOutputPath), { recursive: true });
-    await writeFile(absoluteOutputPath, result.fullContent, "utf8");
-    fullOutputPath = normalizeWorkspaceRelativePath({
-      workspaceRoot: resolve(args.workspaceRoot),
-      targetPath: absoluteOutputPath,
-    });
-  }
   return {
-    content: fullOutputPath
-      ? `${result.content}\n\n[full output saved to ${fullOutputPath}]`
-      : result.content,
-    metadata: {
-      exitCode: result.exitCode,
-      timedOut: result.timedOut,
-      timeoutMs: timeoutMs ?? DEFAULT_WORKSPACE_COMMAND_TIMEOUT_MS,
-      ...(result.outputTruncated ? { outputTruncated: true } : {}),
-      ...(fullOutputPath ? { fullOutputPath } : {}),
-    },
+    content: result.content,
+    metadata: { exitCode: result.exitCode, timedOut: result.timedOut },
   };
 }
 

package/agent-runtime/platformChatProvider.ts

@@ -230,9 +230,7 @@ export function hasDirectOpenAiCompatibleProvider(env: EnvLike) {
 }
 
 function agentRequiresPlatformChatProvider(agentConfig?: AgentRuntimeAgentConfig) {
-  if (agentConfig?.apiSource === "platform") return true;
-  if (agentConfig?.customProviderUrl?.trim()) return false;
-  return agentConfig?.rawRecord?.useServerProxy === true;
+  return agentConfig?.apiSource === "platform" || agentConfig?.rawRecord?.useServerProxy === true;
 }
 
 export function shouldUsePlatformChatProvider(
@@ -240,7 +238,6 @@ export function shouldUsePlatformChatProvider(
   agentConfig?: AgentRuntimeAgentConfig
 ) {
   if (agentRequiresPlatformChatProvider(agentConfig)) return true;
-  if (agentConfig?.customProviderUrl?.trim()) return false;
   if (env.NOLO_LOCAL_LLM === "platform") return true;
   if (env.NOLO_LOCAL_LLM === "direct") return false;
   return !hasDirectOpenAiCompatibleProvider(env) && canUsePlatformChatProvider(env);

package/agent-runtime/runtimeToolPolicy.ts

@@ -1,5 +1,5 @@
 import type { AgentRuntimeAgentConfig } from "./hostAdapter";
-import type { AgentRuntimeToolPolicy } from "./types";
+import type { AgentRuntimeHost, AgentRuntimeToolPolicy } from "./types";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -77,42 +77,57 @@ export function mergeAgentRuntimeToolPolicies(
   };
 }
 
-function runtimeBindingRecord(runtimeBinding: unknown): Record<string, unknown> | undefined {
-  return isRecord(runtimeBinding) ? runtimeBinding : undefined;
+function policyRequestsHostedWorkspace(policy: AgentRuntimeToolPolicy | undefined) {
+  if (!policy) return false;
+  const workspaceMode = policy.workspace?.mode;
+  return (
+    policy.shell?.enabled === true ||
+    policy.runtimeTools?.some((tool) => tool === "execShell") ||
+    workspaceMode === "lease" ||
+    workspaceMode === "task-worktree"
+  );
 }
 
-function runtimePolicyFromRuntimeBinding(runtimeBinding: unknown): AgentRuntimeToolPolicy | undefined {
-  const binding = runtimeBindingRecord(runtimeBinding);
-  if (!binding) return undefined;
-  return normalizeAgentRuntimeToolPolicy(binding.runtimeToolPolicy);
-}
-
-function runtimePolicySnapshotFromRuntimeBinding(runtimeBinding: unknown): AgentRuntimeToolPolicy | undefined {
-  const binding = runtimeBindingRecord(runtimeBinding);
-  if (!binding) return undefined;
-  return normalizeAgentRuntimeToolPolicy(binding.runtimeToolPolicySnapshot);
-}
-
-export function resolveRequestedRuntimeToolNames(args: {
-  agentConfig: Pick<AgentRuntimeAgentConfig, "toolNames" | "runtimeToolPolicy" | "runtimeBinding">;
-}) {
-  const agentPolicy = normalizeAgentRuntimeToolPolicy(args.agentConfig.runtimeToolPolicy);
-  const bindingPolicy = runtimePolicyFromRuntimeBinding(args.agentConfig.runtimeBinding);
-  const bindingSnapshotPolicy = runtimePolicySnapshotFromRuntimeBinding(args.agentConfig.runtimeBinding);
-  return unique([
-    ...stringArray(args.agentConfig.toolNames),
-    ...(agentPolicy?.runtimeTools ?? []),
-    ...(bindingPolicy?.runtimeTools ?? []),
-    ...(bindingSnapshotPolicy?.runtimeTools ?? []),
-  ]);
+function applyWebRuntimeSafetyBaseline(
+  policy: AgentRuntimeToolPolicy | undefined,
+): AgentRuntimeToolPolicy | undefined {
+  if (!policyRequestsHostedWorkspace(policy)) return policy;
+  return mergeAgentRuntimeToolPolicies(
+    policy,
+    {
+      version: 1,
+      shell: {
+        commandPolicy: "approval",
+        networkPolicy: "default-deny",
+      },
+      isolation: {
+        mode: "os-sandbox",
+      },
+      audit: {
+        logToolCalls: true,
+        logShellCommands: true,
+        writeToDialog: true,
+      },
+    },
+  );
 }
 
 export function resolveEffectiveRuntimeToolPolicy(args: {
   agentConfig: Pick<AgentRuntimeAgentConfig, "runtimeToolPolicy" | "runtimeBinding">;
+  taskRunControl?: { runtimeToolPolicy?: unknown } | null;
+  host?: AgentRuntimeHost;
 }): AgentRuntimeToolPolicy | undefined {
-  const bindingSnapshot = runtimePolicySnapshotFromRuntimeBinding(args.agentConfig.runtimeBinding);
-  if (bindingSnapshot) return bindingSnapshot;
-  const topLevelPolicy = normalizeAgentRuntimeToolPolicy(args.agentConfig.runtimeToolPolicy);
-  if (topLevelPolicy) return topLevelPolicy;
-  return runtimePolicyFromRuntimeBinding(args.agentConfig.runtimeBinding);
+  const agentPolicy = normalizeAgentRuntimeToolPolicy(
+    args.agentConfig.runtimeToolPolicy ??
+      (isRecord(args.agentConfig.runtimeBinding)
+        ? args.agentConfig.runtimeBinding.runtimeToolPolicy
+        : undefined),
+  );
+  const taskPolicy = normalizeAgentRuntimeToolPolicy(
+    args.taskRunControl?.runtimeToolPolicy,
+  );
+  const effectivePolicy = mergeAgentRuntimeToolPolicies(agentPolicy, taskPolicy);
+  return args.host === "web"
+    ? applyWebRuntimeSafetyBaseline(effectivePolicy)
+    : effectivePolicy;
 }