nolo-cli 0.1.32 → 0.1.34

package/agent-runtime/platformChatProvider.ts

@@ -3,23 +3,19 @@ import type {
   AgentRuntimeChatMessage,
   AgentRuntimeResult,
 } from "./types";
-import { pickAgentRuntimeInferenceOptions } from "./agentConfigOptions";
+import {
+  buildProviderExecutionPlan,
+  canUsePlatformChatProvider as canUsePlatformChatProviderFromEnv,
+  hasDirectOpenAiCompatibleProvider as hasDirectOpenAiCompatibleProviderFromEnv,
+  resolvePlatformAuthToken,
+  resolvePlatformServerUrl,
+  shouldUsePlatformProxyTransport,
+} from "./providerResolution";
 
 type EnvLike = Record<string, string | undefined>;
 
 const CHAT_PROXY_PATH = "/api/v1/chat";
 
-const PROVIDER_ENDPOINTS: Record<string, string> = {
-  deepinfra: "https://api.deepinfra.com/v1/openai/chat/completions",
-  deepseek: "https://api.deepseek.com/chat/completions",
-  fireworks: "https://api.fireworks.ai/inference/v1/chat/completions",
-  google: "https://generativelanguage.googleapis.com/v1beta/openai/chat/completions",
-  mistral: "https://api.mistral.ai/v1/chat/completions",
-  mimo: "https://token-plan-cn.xiaomimimo.com/v1/chat/completions",
-  openai: "https://api.openai.com/v1/chat/completions",
-  openrouter: "https://openrouter.ai/api/v1/chat/completions",
-};
-
 export type PlatformChatProviderConfig = {
   serverUrl: string;
   authToken: string;
@@ -29,46 +25,12 @@ export type PlatformChatProviderConfig = {
   endpoint: string;
   requestOptions: Record<string, number | string>;
   apiKey?: string;
+  apiKeyHeader?: string;
   apiSource?: string;
 };
 
 type PlatformChatTool = Record<string, unknown>;
 
-function trimTrailingSlash(value: string) {
-  return value.trim().replace(/\/+$/, "");
-}
-
-function resolveChatCompletionsEndpoint(value: string) {
-  const trimmed = trimTrailingSlash(value);
-  return trimmed.endsWith("/chat/completions")
-    ? trimmed
-    : `${trimmed}/chat/completions`;
-}
-
-function resolvePlatformServerUrl(env: EnvLike) {
-  return trimTrailingSlash(env.NOLO_SERVER || env.BASE_URL || "https://nolo.chat");
-}
-
-function resolvePlatformAuthToken(env: EnvLike) {
-  return env.AUTH_TOKEN || env.AUTH || env.BENCHMARK_AUTH_TOKEN || "";
-}
-
-function resolveProviderEndpoint(agentConfig: AgentRuntimeAgentConfig) {
-  const customProviderUrl = agentConfig.customProviderUrl?.trim();
-  if (customProviderUrl) return resolveChatCompletionsEndpoint(customProviderUrl);
-
-  const provider = agentConfig.provider?.trim().toLowerCase();
-  if (!provider) {
-    throw new Error("Platform chat provider requires agentConfig.provider.");
-  }
-
-  const endpoint = PROVIDER_ENDPOINTS[provider];
-  if (!endpoint) {
-    throw new Error(`Platform chat provider does not support provider "${provider}".`);
-  }
-  return endpoint;
-}
-
 function shouldDisableThinking(providerConfig: PlatformChatProviderConfig) {
   return (
     providerConfig.provider.toLowerCase() === "mimo" ||
@@ -90,19 +52,39 @@ export function resolvePlatformChatProviderConfig(args: {
   agentConfig: AgentRuntimeAgentConfig;
   env: EnvLike;
 }): PlatformChatProviderConfig {
-  const provider = args.agentConfig.provider || args.agentConfig.apiSource || "openai";
+  const plan = buildProviderExecutionPlan({
+    agentConfig: args.agentConfig,
+    env: args.env,
+    runtimeKind: "local",
+  });
+  if (plan.mode === "cli") {
+    throw new Error("Platform chat provider does not support cli agents.");
+  }
+  if (plan.transport === "direct") {
+    return {
+      serverUrl: resolvePlatformServerUrl(args.env),
+      authToken: resolvePlatformAuthToken(args.env),
+      agentKey: args.agentConfig.key,
+      model: plan.model,
+      provider: plan.provider,
+      endpoint: plan.endpoint,
+      requestOptions: plan.requestOptions,
+      ...(plan.apiKey ? { apiKey: plan.apiKey } : {}),
+      ...(plan.apiKeyHeader ? { apiKeyHeader: plan.apiKeyHeader } : {}),
+      ...(args.agentConfig.apiSource ? { apiSource: args.agentConfig.apiSource } : {}),
+    };
+  }
   return {
-    serverUrl: resolvePlatformServerUrl(args.env),
-    authToken: resolvePlatformAuthToken(args.env),
-    agentKey: args.agentConfig.key,
-    model: args.agentConfig.model || "gpt-4.1-mini",
-    provider,
-    endpoint: resolveProviderEndpoint(args.agentConfig),
-    requestOptions: pickAgentRuntimeInferenceOptions(args.agentConfig),
-    ...(typeof args.agentConfig.rawRecord?.apiKey === "string"
-      ? { apiKey: args.agentConfig.rawRecord.apiKey.trim() }
-      : {}),
-    ...(args.agentConfig.apiSource ? { apiSource: args.agentConfig.apiSource } : {}),
+    serverUrl: plan.serverUrl,
+    authToken: plan.authToken,
+    agentKey: plan.agentKey,
+    model: plan.model,
+    provider: plan.provider,
+    endpoint: plan.endpoint,
+    requestOptions: plan.requestOptions,
+    ...(plan.apiKey ? { apiKey: plan.apiKey } : {}),
+    ...(plan.apiKeyHeader ? { apiKeyHeader: plan.apiKeyHeader } : {}),
+    ...(plan.apiSource ? { apiSource: plan.apiSource } : {}),
   };
 }
 
@@ -123,6 +105,7 @@ export function buildPlatformChatCompletionRequest(args: {
     agentKey: args.providerConfig.agentKey,
     ...(args.providerConfig.apiSource ? { apiSource: args.providerConfig.apiSource } : {}),
     ...(args.providerConfig.apiKey ? { KEY: args.providerConfig.apiKey } : {}),
+    ...(args.providerConfig.apiKeyHeader ? { apiKeyHeader: args.providerConfig.apiKeyHeader } : {}),
   };
 
   return {
@@ -216,23 +199,17 @@ export function parsePlatformChatCompletionResponse(args: {
 }
 
 export function canUsePlatformChatProvider(env: EnvLike) {
-  return Boolean(resolvePlatformAuthToken(env));
+  return canUsePlatformChatProviderFromEnv(env);
 }
 
 export function hasDirectOpenAiCompatibleProvider(env: EnvLike) {
-  return Boolean(
-    env.NOLO_LOCAL_OPENAI_API_KEY ||
-      env.OPENAI_API_KEY ||
-      env.NOLO_LOCAL_OPENAI_BASE_URL ||
-      env.OPENAI_BASE_URL ||
-      env.OLLAMA_BASE_URL
-  );
+  return hasDirectOpenAiCompatibleProviderFromEnv(env);
 }
 
 function agentRequiresPlatformChatProvider(agentConfig?: AgentRuntimeAgentConfig) {
   if (agentConfig?.apiSource === "platform") return true;
-  if (agentConfig?.customProviderUrl?.trim()) return false;
-  return agentConfig?.rawRecord?.useServerProxy === true;
+  if (agentConfig?.apiSource === "custom" || agentConfig?.customProviderUrl?.trim()) return false;
+  return agentConfig?.useServerProxy === true;
 }
 
 export function shouldUsePlatformChatProvider(
@@ -240,8 +217,5 @@ export function shouldUsePlatformChatProvider(
   agentConfig?: AgentRuntimeAgentConfig
 ) {
   if (agentRequiresPlatformChatProvider(agentConfig)) return true;
-  if (agentConfig?.customProviderUrl?.trim()) return false;
-  if (env.NOLO_LOCAL_LLM === "platform") return true;
-  if (env.NOLO_LOCAL_LLM === "direct") return false;
-  return !hasDirectOpenAiCompatibleProvider(env) && canUsePlatformChatProvider(env);
+  return shouldUsePlatformProxyTransport(env, agentConfig);
 }

package/agent-runtime/providerResolution.ts

@@ -0,0 +1,244 @@
+import type { AgentRuntimeAgentConfig } from "./hostAdapter";
+import { pickAgentRuntimeInferenceOptions } from "./agentConfigOptions";
+
+type EnvLike = Record<string, string | undefined>;
+
+const PROVIDER_ENDPOINTS: Record<string, string> = {
+  deepinfra: "https://api.deepinfra.com/v1/openai/chat/completions",
+  deepseek: "https://api.deepseek.com/chat/completions",
+  fireworks: "https://api.fireworks.ai/inference/v1/chat/completions",
+  google: "https://generativelanguage.googleapis.com/v1beta/openai/chat/completions",
+  mistral: "https://api.mistral.ai/v1/chat/completions",
+  mimo: "https://token-plan-cn.xiaomimimo.com/v1/chat/completions",
+  openai: "https://api.openai.com/v1/chat/completions",
+  openrouter: "https://openrouter.ai/api/v1/chat/completions",
+};
+
+export type AgentProviderMode = "cli" | "platform" | "custom";
+export type ProviderExecutionTransport = "direct" | "proxy";
+
+type ProviderExecutionPlanBase = {
+  mode: AgentProviderMode;
+  transport: ProviderExecutionTransport;
+  model: string;
+  provider: string;
+  requestOptions: Record<string, number | string>;
+};
+
+export type CliProviderExecutionPlan = ProviderExecutionPlanBase & {
+  mode: "cli";
+  transport: "direct";
+  cliProvider: string;
+};
+
+export type DirectProviderExecutionPlan = ProviderExecutionPlanBase & {
+  mode: "platform" | "custom";
+  transport: "direct";
+  endpoint: string;
+  apiKey: string;
+  apiKeyHeader?: string;
+};
+
+export type ProxyProviderExecutionPlan = ProviderExecutionPlanBase & {
+  mode: "platform" | "custom";
+  transport: "proxy";
+  endpoint: string;
+  serverUrl: string;
+  authToken: string;
+  agentKey: string;
+  apiSource?: string;
+  apiKey?: string;
+  apiKeyHeader?: string;
+};
+
+export type ProviderExecutionPlan =
+  | CliProviderExecutionPlan
+  | DirectProviderExecutionPlan
+  | ProxyProviderExecutionPlan;
+
+export function trimTrailingSlash(value: string) {
+  return value.trim().replace(/\/+$/, "");
+}
+
+export function resolveChatCompletionsEndpoint(value: string) {
+  const trimmed = trimTrailingSlash(value);
+  return trimmed.endsWith("/chat/completions")
+    ? trimmed
+    : `${trimmed}/chat/completions`;
+}
+
+export function resolveOpenAiCompatibleBaseUrl(env: EnvLike) {
+  return env.NOLO_LOCAL_OPENAI_BASE_URL || env.OPENAI_BASE_URL || "https://api.openai.com/v1";
+}
+
+export function resolveOpenAiCompatibleApiKey(env: EnvLike) {
+  return env.OPENAI_API_KEY || env.NOLO_LOCAL_OPENAI_API_KEY || "";
+}
+
+export function resolvePlatformServerUrl(env: EnvLike) {
+  return trimTrailingSlash(env.NOLO_SERVER || env.BASE_URL || "https://nolo.chat");
+}
+
+export function resolvePlatformAuthToken(env: EnvLike) {
+  return env.AUTH_TOKEN || env.AUTH || env.BENCHMARK_AUTH_TOKEN || "";
+}
+
+export function canUsePlatformChatProvider(env: EnvLike) {
+  return Boolean(resolvePlatformAuthToken(env));
+}
+
+export function hasDirectOpenAiCompatibleProvider(env: EnvLike) {
+  return Boolean(
+    env.NOLO_LOCAL_OPENAI_API_KEY ||
+      env.OPENAI_API_KEY ||
+      env.NOLO_LOCAL_OPENAI_BASE_URL ||
+      env.OPENAI_BASE_URL ||
+      env.OLLAMA_BASE_URL
+  );
+}
+
+function resolvePlatformProviderEndpoint(agentConfig: AgentRuntimeAgentConfig) {
+  const customProviderUrl = agentConfig.customProviderUrl?.trim();
+  if (customProviderUrl) return resolveChatCompletionsEndpoint(customProviderUrl);
+
+  const provider = agentConfig.provider?.trim().toLowerCase();
+  if (!provider) {
+    throw new Error("Platform chat provider requires agentConfig.provider.");
+  }
+  const endpoint = PROVIDER_ENDPOINTS[provider];
+  if (!endpoint) {
+    throw new Error(`Platform chat provider does not support provider "${provider}".`);
+  }
+  return endpoint;
+}
+
+export function resolveAgentProviderMode(agentConfig: AgentRuntimeAgentConfig): AgentProviderMode {
+  if (agentConfig.apiSource === "cli" || agentConfig.provider === "cli" || agentConfig.cliProvider) {
+    return "cli";
+  }
+  if (agentConfig.apiSource === "custom" || agentConfig.customProviderUrl) {
+    return "custom";
+  }
+  return "platform";
+}
+
+export function shouldUsePlatformProxyTransport(
+  env: EnvLike,
+  agentConfig?: AgentRuntimeAgentConfig
+) {
+  if (agentConfig?.apiSource === "platform") return true;
+  if (agentConfig?.apiSource === "custom" || agentConfig?.customProviderUrl?.trim()) return false;
+  if (agentConfig?.useServerProxy === true) return true;
+  if (env.NOLO_LOCAL_LLM === "platform") return true;
+  if (env.NOLO_LOCAL_LLM === "direct") return false;
+  return !hasDirectOpenAiCompatibleProvider(env) && canUsePlatformChatProvider(env);
+}
+
+export function resolveProviderAuthHeaderName(args: {
+  endpoint: string;
+  apiKeyHeader?: string;
+}) {
+  const explicitHeader = args.apiKeyHeader?.trim();
+  if (explicitHeader) return explicitHeader;
+  if (/xiaomimimo\.com/i.test(args.endpoint)) return "api-key";
+  return "Authorization";
+}
+
+export function buildProviderAuthHeaders(args: {
+  endpoint: string;
+  apiKey: string;
+  apiKeyHeader?: string;
+}) {
+  if (!args.apiKey) return {};
+  const headerName = resolveProviderAuthHeaderName(args);
+  return headerName.toLowerCase() === "authorization"
+    ? { Authorization: `Bearer ${args.apiKey}` }
+    : { [headerName]: args.apiKey };
+}
+
+export function buildProviderExecutionPlan(args: {
+  agentConfig: AgentRuntimeAgentConfig;
+  env: EnvLike;
+  runtimeKind: "local" | "desktop" | "server";
+}): ProviderExecutionPlan {
+  const { agentConfig, env } = args;
+  const mode = resolveAgentProviderMode(agentConfig);
+  const model = agentConfig.model || "gpt-4.1-mini";
+  const requestOptions = pickAgentRuntimeInferenceOptions(agentConfig);
+
+  if (mode === "cli") {
+    return {
+      mode,
+      transport: "direct",
+      cliProvider: agentConfig.cliProvider || agentConfig.provider || "codex",
+      model,
+      provider: agentConfig.provider || "cli",
+      requestOptions,
+    };
+  }
+
+  if (mode === "custom") {
+    const endpoint = resolveChatCompletionsEndpoint(agentConfig.customProviderUrl || resolveOpenAiCompatibleBaseUrl(env));
+    const apiKey = agentConfig.apiKey?.trim() || agentConfig.apiKeyFromAgentKey?.trim() || "";
+    const apiKeyHeader = resolveProviderAuthHeaderName({
+      endpoint,
+      apiKeyHeader: agentConfig.apiKeyHeader,
+    });
+    if (agentConfig.useServerProxy) {
+      return {
+        mode,
+        transport: "proxy",
+        model,
+        provider: agentConfig.provider || "custom",
+        endpoint,
+        requestOptions,
+        serverUrl: resolvePlatformServerUrl(env),
+        authToken: resolvePlatformAuthToken(env),
+        agentKey: agentConfig.key,
+        ...(agentConfig.apiSource ? { apiSource: agentConfig.apiSource } : {}),
+        ...(apiKey ? { apiKey } : {}),
+        ...(apiKeyHeader ? { apiKeyHeader } : {}),
+      };
+    }
+    return {
+      mode,
+      transport: "direct",
+      model,
+      provider: agentConfig.provider || "custom",
+      endpoint,
+      requestOptions,
+      apiKey,
+      ...(apiKeyHeader ? { apiKeyHeader } : {}),
+    };
+  }
+
+  const provider = agentConfig.provider || agentConfig.apiSource || "openai";
+  const endpoint = shouldUsePlatformProxyTransport(env, agentConfig)
+    ? resolvePlatformProviderEndpoint(agentConfig)
+    : resolveChatCompletionsEndpoint(resolveOpenAiCompatibleBaseUrl(env));
+  if (shouldUsePlatformProxyTransport(env, agentConfig)) {
+    return {
+      mode,
+      transport: "proxy",
+      model,
+      provider,
+      endpoint,
+      requestOptions,
+      serverUrl: resolvePlatformServerUrl(env),
+      authToken: resolvePlatformAuthToken(env),
+      agentKey: agentConfig.key,
+      ...(agentConfig.apiSource ? { apiSource: agentConfig.apiSource } : {}),
+      ...(agentConfig.apiKey?.trim() ? { apiKey: agentConfig.apiKey.trim() } : {}),
+      ...(agentConfig.apiKeyHeader?.trim() ? { apiKeyHeader: agentConfig.apiKeyHeader.trim() } : {}),
+    };
+  }
+  return {
+    mode,
+    transport: "direct",
+    model,
+    provider: agentConfig.provider || "openai-compatible",
+    endpoint,
+    requestOptions,
+    apiKey: resolveOpenAiCompatibleApiKey(env),
+  };
+}

package/agent-runtime/runtimeToolPolicy.ts

@@ -1,5 +1,5 @@
 import type { AgentRuntimeAgentConfig } from "./hostAdapter";
-import type { AgentRuntimeToolPolicy } from "./types";
+import type { AgentRuntimeHost, AgentRuntimeToolPolicy } from "./types";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -46,6 +46,16 @@ export function normalizeAgentRuntimeToolPolicy(
   };
 }
 
+function runtimeBindingRecord(
+  runtimeBinding: unknown,
+): Record<string, unknown> | undefined {
+  return isRecord(runtimeBinding) ? runtimeBinding : undefined;
+}
+
+function runtimeToolNamesFromPolicy(policy: AgentRuntimeToolPolicy | undefined) {
+  return stringArray(policy?.runtimeTools);
+}
+
 export function mergeAgentRuntimeToolPolicies(
   base?: AgentRuntimeToolPolicy,
   override?: AgentRuntimeToolPolicy,
@@ -77,42 +87,80 @@ export function mergeAgentRuntimeToolPolicies(
   };
 }
 
-function runtimeBindingRecord(runtimeBinding: unknown): Record<string, unknown> | undefined {
-  return isRecord(runtimeBinding) ? runtimeBinding : undefined;
-}
-
-function runtimePolicyFromRuntimeBinding(runtimeBinding: unknown): AgentRuntimeToolPolicy | undefined {
-  const binding = runtimeBindingRecord(runtimeBinding);
-  if (!binding) return undefined;
-  return normalizeAgentRuntimeToolPolicy(binding.runtimeToolPolicy);
-}
-
-function runtimePolicySnapshotFromRuntimeBinding(runtimeBinding: unknown): AgentRuntimeToolPolicy | undefined {
-  const binding = runtimeBindingRecord(runtimeBinding);
-  if (!binding) return undefined;
-  return normalizeAgentRuntimeToolPolicy(binding.runtimeToolPolicySnapshot);
-}
-
 export function resolveRequestedRuntimeToolNames(args: {
-  agentConfig: Pick<AgentRuntimeAgentConfig, "toolNames" | "runtimeToolPolicy" | "runtimeBinding">;
+  agentConfig: Pick<
+    AgentRuntimeAgentConfig,
+    "toolNames" | "runtimeToolPolicy" | "runtimeBinding"
+  >;
 }) {
-  const agentPolicy = normalizeAgentRuntimeToolPolicy(args.agentConfig.runtimeToolPolicy);
-  const bindingPolicy = runtimePolicyFromRuntimeBinding(args.agentConfig.runtimeBinding);
-  const bindingSnapshotPolicy = runtimePolicySnapshotFromRuntimeBinding(args.agentConfig.runtimeBinding);
+  const runtimeBinding = runtimeBindingRecord(args.agentConfig.runtimeBinding);
+  const bindingPolicy = normalizeAgentRuntimeToolPolicy(
+    runtimeBinding?.runtimeToolPolicy,
+  );
+  const bindingSnapshotPolicy = normalizeAgentRuntimeToolPolicy(
+    runtimeBinding?.runtimeToolPolicySnapshot,
+  );
   return unique([
     ...stringArray(args.agentConfig.toolNames),
-    ...(agentPolicy?.runtimeTools ?? []),
-    ...(bindingPolicy?.runtimeTools ?? []),
-    ...(bindingSnapshotPolicy?.runtimeTools ?? []),
+    ...runtimeToolNamesFromPolicy(
+      normalizeAgentRuntimeToolPolicy(args.agentConfig.runtimeToolPolicy),
+    ),
+    ...runtimeToolNamesFromPolicy(bindingPolicy),
+    ...runtimeToolNamesFromPolicy(bindingSnapshotPolicy),
   ]);
 }
 
+function policyRequestsHostedWorkspace(policy: AgentRuntimeToolPolicy | undefined) {
+  if (!policy) return false;
+  const workspaceMode = policy.workspace?.mode;
+  return (
+    policy.shell?.enabled === true ||
+    policy.runtimeTools?.some((tool) => tool === "execShell") ||
+    workspaceMode === "lease" ||
+    workspaceMode === "task-worktree"
+  );
+}
+
+function applyWebRuntimeSafetyBaseline(
+  policy: AgentRuntimeToolPolicy | undefined,
+): AgentRuntimeToolPolicy | undefined {
+  if (!policyRequestsHostedWorkspace(policy)) return policy;
+  return mergeAgentRuntimeToolPolicies(
+    policy,
+    {
+      version: 1,
+      shell: {
+        commandPolicy: "approval",
+        networkPolicy: "default-deny",
+      },
+      isolation: {
+        mode: "os-sandbox",
+      },
+      audit: {
+        logToolCalls: true,
+        logShellCommands: true,
+        writeToDialog: true,
+      },
+    },
+  );
+}
+
 export function resolveEffectiveRuntimeToolPolicy(args: {
   agentConfig: Pick<AgentRuntimeAgentConfig, "runtimeToolPolicy" | "runtimeBinding">;
+  taskRunControl?: { runtimeToolPolicy?: unknown } | null;
+  host?: AgentRuntimeHost;
 }): AgentRuntimeToolPolicy | undefined {
-  const bindingSnapshot = runtimePolicySnapshotFromRuntimeBinding(args.agentConfig.runtimeBinding);
-  if (bindingSnapshot) return bindingSnapshot;
-  const topLevelPolicy = normalizeAgentRuntimeToolPolicy(args.agentConfig.runtimeToolPolicy);
-  if (topLevelPolicy) return topLevelPolicy;
-  return runtimePolicyFromRuntimeBinding(args.agentConfig.runtimeBinding);
+  const agentPolicy = normalizeAgentRuntimeToolPolicy(
+    args.agentConfig.runtimeToolPolicy ??
+      (isRecord(args.agentConfig.runtimeBinding)
+        ? args.agentConfig.runtimeBinding.runtimeToolPolicy
+        : undefined),
+  );
+  const taskPolicy = normalizeAgentRuntimeToolPolicy(
+    args.taskRunControl?.runtimeToolPolicy,
+  );
+  const effectivePolicy = mergeAgentRuntimeToolPolicies(agentPolicy, taskPolicy);
+  return args.host === "web"
+    ? applyWebRuntimeSafetyBaseline(effectivePolicy)
+    : effectivePolicy;
 }

package/agent-runtime/shellCommandPolicy.ts

@@ -0,0 +1,120 @@
+export type ShellCommandPolicyVerdict = "allowed" | "forbidden";
+
+export type ShellCommandPolicyResult =
+  | {
+      verdict: "allowed";
+    }
+  | {
+      verdict: "forbidden";
+      code: "destructive_action_requires_confirmation";
+      reason: string;
+      policy: {
+        capability: "destructive_action";
+        target: "shell_command";
+        detail: string;
+      };
+    };
+
+const DESTRUCTIVE_NEGATION_PATTERNS = [
+  "别删",
+  "别删除",
+  "不要删",
+  "不要删除",
+  "别乱删",
+  "别动",
+  "不要动",
+  "不要清理",
+  "不要清空",
+  "不要重置",
+  "don't delete",
+  "do not delete",
+  "don't remove",
+  "do not remove",
+  "without deleting",
+] as const;
+
+const EXPLICIT_DESTRUCTIVE_REQUEST_PATTERNS = [
+  "删除",
+  "删掉",
+  "移除",
+  "清理",
+  "清空",
+  "重置",
+  "drop",
+  "delete",
+  "remove",
+  "erase",
+  "clean up",
+  "reset",
+] as const;
+
+const SHELL_DESTRUCTIVE_PATTERNS = [
+  /\brm\s+(-[^\n\r]*\s+)?/i,
+  /\bremove-item\b/i,
+  /\bdel\s+\/?[a-z]*\s+/i,
+  /\berase\s+/i,
+  /\brmdir\s+/i,
+  /\brd\s+\/s\b/i,
+  /\bgit\s+reset\s+(--hard\b|--merge\b|--keep\b)/i,
+  /\bgit\s+clean\s+-[^\n\r]*f/i,
+  /\bgit\s+checkout\s+--\b/i,
+  /\bgit\s+restore\s+--source=/i,
+] as const;
+
+const normalizeUserInput = (value: unknown): string =>
+  typeof value === "string" ? value.trim().toLowerCase() : "";
+
+const containsAny = (text: string, patterns: readonly string[]): boolean =>
+  patterns.some((pattern) => text.includes(pattern));
+
+const hasExplicitDestructivePermission = (userInput: unknown): boolean => {
+  const normalized = normalizeUserInput(userInput);
+  if (!normalized) return false;
+  if (containsAny(normalized, DESTRUCTIVE_NEGATION_PATTERNS)) return false;
+  return containsAny(normalized, EXPLICIT_DESTRUCTIVE_REQUEST_PATTERNS);
+};
+
+const buildCombinedShellInput = (args: {
+  command?: unknown;
+  input?: unknown;
+}): string =>
+  [
+    typeof args.command === "string" ? args.command : "",
+    typeof args.input === "string" ? args.input : "",
+  ]
+    .filter(Boolean)
+    .join("\n");
+
+export function isDestructiveShellCommand(args: {
+  command?: unknown;
+  input?: unknown;
+}): boolean {
+  const combined = buildCombinedShellInput(args);
+  if (!combined.trim()) return false;
+  return SHELL_DESTRUCTIVE_PATTERNS.some((pattern) => pattern.test(combined));
+}
+
+export function evaluateShellCommandPolicy(args: {
+  command?: unknown;
+  input?: unknown;
+  userInput?: unknown;
+}): ShellCommandPolicyResult {
+  if (
+    isDestructiveShellCommand(args) &&
+    !hasExplicitDestructivePermission(args.userInput)
+  ) {
+    return {
+      verdict: "forbidden",
+      code: "destructive_action_requires_confirmation",
+      reason:
+        "当前运行默认禁止自动执行可能删除用户内容的 shell 命令。只有当用户在当前请求里明确要求删除/清理时，才能继续；否则请停止并先说明限制。",
+      policy: {
+        capability: "destructive_action",
+        target: "shell_command",
+        detail: "execShell destructive command",
+      },
+    };
+  }
+
+  return { verdict: "allowed" };
+}