nolo-cli 0.103.0-alpha.2 → 0.104.0-alpha.2

package/{chunk-IONPPCL5.js → chunk-EEGDMATE.js}

@@ -18,6 +18,70 @@ import {
   publicAgentKey
 } from "./chunk-M2EJHDJP.js";
 
+// packages/ai/agent/quotaSnapshot.ts
+function findTightestQuotaWindow(quota, now = Date.now()) {
+  if (!quota || !Array.isArray(quota.windows) || quota.windows.length === 0) {
+    return void 0;
+  }
+  let best;
+  let bestScore = -Infinity;
+  for (const w of quota.windows) {
+    let score = 0;
+    if (typeof w.utilization === "number" && w.utilization >= 0) {
+      score = 500 + Math.min(w.utilization, 1) * 500;
+    } else if (typeof w.remaining === "number" && typeof w.limit === "number" && w.limit > 0) {
+      const util = Math.max(0, 1 - w.remaining / w.limit);
+      score = 500 + util * 500;
+    } else if (typeof w.resetAt === "number" && w.resetAt > now) {
+      score = 200;
+    } else if (typeof w.remaining === "number") {
+      score = 100;
+    }
+    if (score > bestScore) {
+      bestScore = score;
+      best = w;
+    }
+  }
+  return best ?? quota.windows[0];
+}
+function formatQuotaSummary(quota, now = Date.now(), options) {
+  const tightest = findTightestQuotaWindow(quota, now);
+  if (!tightest) return void 0;
+  const compact = options?.compact === true;
+  const parts = [];
+  if (typeof tightest.utilization === "number") {
+    const pct = Math.round(tightest.utilization * 100);
+    parts.push(`${pct}%\u5DF2\u7528`);
+  } else if (typeof tightest.remaining === "number") {
+    if (typeof tightest.limit === "number") {
+      parts.push(`${tightest.remaining}/${tightest.limit}${tightest.unit ? ` ${tightest.unit}` : ""}`);
+    } else {
+      parts.push(`\u4F59${tightest.remaining}${tightest.unit ? ` ${tightest.unit}` : ""}`);
+    }
+  }
+  if (compact) return parts.length > 0 ? parts[0] : void 0;
+  if (tightest.scope && tightest.scope !== "user" && tightest.scope !== "project" && tightest.scope !== tightest.unit) {
+    parts.push(tightest.scope);
+  }
+  if (typeof tightest.resetAt === "number" && tightest.resetAt > now) {
+    const diffSec = Math.round((tightest.resetAt - now) / 1e3);
+    if (diffSec < 60) {
+      parts.push(`${diffSec}s\u540E\u91CD\u7F6E`);
+    } else if (diffSec < 3600) {
+      parts.push(`${Math.round(diffSec / 60)}m\u540E\u91CD\u7F6E`);
+    } else if (diffSec < 86400) {
+      const hours = (diffSec / 3600).toFixed(1).replace(/\.0$/, "");
+      parts.push(`${hours}h\u540E\u91CD\u7F6E`);
+    } else {
+      const days = (diffSec / 86400).toFixed(1).replace(/\.0$/, "");
+      parts.push(`${days}d\u540E\u91CD\u7F6E`);
+    }
+  }
+  if (parts.length === 0) return void 0;
+  if (parts.length === 1 && parts[0] === tightest.scope) return void 0;
+  return parts.join(" \xB7 ");
+}
+
 // packages/cli/agentListHelpers.ts
 function parseAgentRecordId(privateKey, explicitId) {
   if (explicitId) return explicitId;
@@ -239,6 +303,7 @@ async function decorateAgentsWithPublicStatusAcrossServers(args) {
 }
 
 export {
+  formatQuotaSummary,
   normalizeListedAgent,
   toSafeListedAgentSummary,
   parseAgentListArgs,

package/{chunk-XVZ22N6C.js → chunk-FQUHIG5X.js}

@@ -14,7 +14,7 @@ import {
 } from "./chunk-AGGIDPCZ.js";
 import {
   runLlm
-} from "./chunk-3N3W7KBB.js";
+} from "./chunk-YY7I6GQ3.js";
 import {
   cleanupCliSessionForDialog
 } from "./chunk-TOP2VXOR.js";
@@ -19371,7 +19371,7 @@ var messageSlice = createSliceWithThunks({
             runtimeOptions: args.runtimeOptions
           });
           if (agentKeyToUse) {
-            const { streamAgentChatTurn } = await import("./agentSlice-SICQBMCM.js");
+            const { streamAgentChatTurn } = await import("./agentSlice-6LBOYNKN.js");
             await dispatch(
               streamAgentChatTurn({
                 agentKey: agentKeyToUse,
@@ -20507,7 +20507,7 @@ var deleteDialogThunk = async (payload, thunkApi) => {
   }
   if (isCurrentDialog) {
     await thunkApi.dispatch(resetMsgs());
-    const { clearPendingAttachments: clearPendingAttachments2 } = await import("./dialogSlice-LEO27SQG.js");
+    const { clearPendingAttachments: clearPendingAttachments2 } = await import("./dialogSlice-HSGREZGA.js");
     dispatch(clearPendingAttachments2());
   }
   return { dialogKey, isCurrentDialog, attachmentPlan };
@@ -20515,15 +20515,15 @@ var deleteDialogThunk = async (payload, thunkApi) => {
 
 // packages/chat/dialog/dialogSlice.ts
 var runCreateDialogAction = async (args, thunkApi) => {
-  const { createDialogAction } = await import("./createDialogAction-GFKRXTK4.js");
+  const { createDialogAction } = await import("./createDialogAction-TDFOINOY.js");
   return createDialogAction(args, thunkApi);
 };
 var runCreateAgentAutomationAction = async (args, thunkApi) => {
-  const { createAgentAutomationAction } = await import("./createAgentAutomationAction-ODGL2YGP.js");
+  const { createAgentAutomationAction } = await import("./createAgentAutomationAction-M5NDEIC6.js");
   return createAgentAutomationAction(args, thunkApi);
 };
 var runUpdateDialogTitleAction = async (args, thunkApi) => {
-  const { updateDialogTitleAction } = await import("./updateDialogTitleAction-6MBTD4UE.js");
+  const { updateDialogTitleAction } = await import("./updateDialogTitleAction-GF5T3VMK.js");
   return updateDialogTitleAction(args, thunkApi);
 };
 var runAddDialogAgentAction = async (args, thunkApi) => {
@@ -20547,7 +20547,7 @@ var runSetDialogExtraReferencesAction = async (args, thunkApi) => {
   return setDialogExtraReferencesAction(args, thunkApi);
 };
 var runHandleSendMessageAction = async (args, thunkApi) => {
-  const { handleSendMessageAction } = await import("./handleSendMessageAction-YB6KQFJS.js");
+  const { handleSendMessageAction } = await import("./handleSendMessageAction-FEHCWMN2.js");
   return handleSendMessageAction(args, thunkApi);
 };
 function clearDialogState() {
@@ -20560,7 +20560,7 @@ var createPageAndAddReference = createAsyncThunk(
   async (payload, { dispatch, getState, rejectWithValue }) => {
     const { slateData, jsonData, title, type, fileId, groupId, dialogKey } = payload;
     try {
-      const { createDocState } = await import("./docStore-MNX5MHA5.js");
+      const { createDocState } = await import("./docStore-IIS36NGG.js");
       const pageKey = await createDocState(
         { slateData, title },
         { dispatch, getState }

package/{chunk-TQBHNYVR.js → chunk-H66KLASO.js}

@@ -81,10 +81,10 @@ import {
 } from "./chunk-VF4K2QE6.js";
 import {
   createDocState
-} from "./chunk-B3TVQ6PI.js";
+} from "./chunk-W324THOB.js";
 import {
   createDialogAction
-} from "./chunk-DNUUJ45N.js";
+} from "./chunk-3ZW5ZJMM.js";
 import {
   DEFAULT_COLLAPSED_CATEGORIES,
   addContentToSpace,
@@ -102,7 +102,7 @@ import {
   updateContentCategory,
   updateContentTitle,
   writeStoredCollapsedCategories
-} from "./chunk-OZGZPSEG.js";
+} from "./chunk-A6FMKU7M.js";
 import {
   getCurrentSpaceId,
   getCurrentSpaceIdRaw,
@@ -124,14 +124,14 @@ import {
   selectMsgById,
   uiAskChoiceFunc,
   uiAskChoiceFunctionSchema
-} from "./chunk-XVZ22N6C.js";
+} from "./chunk-FQUHIG5X.js";
 import {
   createAgent,
   deleteServerSyncedCredential,
   runLlm,
   streamAgentChatTurn,
   updateAgent
-} from "./chunk-3N3W7KBB.js";
+} from "./chunk-YY7I6GQ3.js";
 import {
   getActiveDialogKey,
   selectCurrentDialogKey,
@@ -3945,7 +3945,7 @@ async function deleteDialogsFunc(args, thunkApi) {
   const deletedDialogIds = [];
   const deletedDialogKeys = [];
   const failures = [];
-  const { deleteDialog: deleteDialog2 } = await import("./dialogSlice-LEO27SQG.js");
+  const { deleteDialog: deleteDialog2 } = await import("./dialogSlice-HSGREZGA.js");
   for (const target of targets) {
     try {
       await thunkApi.dispatch(deleteDialog2(target.dbKey)).unwrap();
@@ -14906,7 +14906,7 @@ var executeToolRun = createAsyncThunk(
     if (!executionInput) {
       throw new Error(`ToolRun ${id} has no input to execute with.`);
     }
-    const { findToolExecutor: findToolExecutor2 } = await import("./tools-NF5AB34X.js");
+    const { findToolExecutor: findToolExecutor2 } = await import("./tools-Q6IBBG33.js");
     const { executor } = findToolExecutor2(run.toolName);
     toolRunStarted({
       id: run.id,
@@ -17413,7 +17413,7 @@ async function updateDocFunc(args, thunkApi) {
       updated_at: (/* @__PURE__ */ new Date()).toISOString()
     };
     await dispatch(write({ data: updatedPageData, customKey: id })).unwrap();
-    const { getDocState, applyExternalDocUpdate } = await import("./docStore-MNX5MHA5.js");
+    const { getDocState, applyExternalDocUpdate } = await import("./docStore-IIS36NGG.js");
     if (getDocState().pageKey === id) {
       applyExternalDocUpdate({
         slateData: finalSlateData,

package/{chunk-6VFARHZW.js → chunk-LC43IGO4.js}

@@ -64,6 +64,7 @@ import {
   applyToolSurfaceConstraints,
   buildDialogReadEnvelope,
   buildNoloWorkspaceCommandArgs,
+  buildNoloWorkspaceOpenAiTools,
   createStreamingDialogReadProjector,
   noloPositiveIntegerString,
   noloStringArg,
@@ -15652,132 +15653,6 @@ async function evaluateCapabilityPolicy(capability, normalizedInput, ctx) {
   }
 }
 
-// packages/agent-runtime/localToolPolicy.ts
-var NEVER_LOCAL_TOOLS = /* @__PURE__ */ new Set([
-  "deleteSpaces",
-  "updateAgent",
-  "updateSelf",
-  "createAgent"
-]);
-var DEFAULT_LOCAL_TOOLS = /* @__PURE__ */ new Set([
-  "readFile",
-  "writeFile",
-  "editFile",
-  "globFiles",
-  "execShell",
-  "launchProcess",
-  "listProcesses",
-  // ProcessTask follow-up tools. Same tier as listProcesses: they observe/stop
-  // tasks the agent itself already spawned, so their blast radius is strictly
-  // narrower than launchProcess (which is default-enabled). Model-facing
-  // follow-ups are taskWait/taskStop only — lifecycle history (taskLogs) stays
-  // runtime-internal.
-  "taskWait",
-  "taskStop",
-  // Scheduling tools: forking/observing sub-agents is a declared capability
-  // of capable agents, and the blast radius is strictly narrower than
-  // execShell (already default-enabled). Requiring an env allowlist for these
-  // while execShell is open by default inverted the risk model and forced every
-  // new local user to hand-edit .env files before sub-agent tasks worked.
-  "startAgentRun",
-  "controlAgentRun"
-]);
-function parseToolAllowlist(value) {
-  return (value ?? "").split(",").flatMap((item) => {
-    const trimmed = item.trim();
-    return trimmed ? [trimmed] : [];
-  });
-}
-function normalizeLocalToolName(toolName) {
-  return canonicalizeToolName(
-    String(toolName ?? "").replace(/^functions\./, "").trim()
-  );
-}
-function isRestrictedLocalToolMode(env) {
-  return env.NOLO_LOCAL_TOOL_MODE === "restricted";
-}
-function resolveLocalToolPolicy(args2) {
-  const toolName = normalizeLocalToolName(args2.toolName);
-  const restrictedMode = isRestrictedLocalToolMode(args2.env);
-  if (!toolName) {
-    return {
-      allowed: false,
-      toolName,
-      reason: "Tool name is required."
-    };
-  }
-  if (NEVER_LOCAL_TOOLS.has(toolName)) {
-    return {
-      allowed: false,
-      toolName,
-      reason: `${toolName} is blocked by the local runtime safety policy.`
-    };
-  }
-  const allowedByEnv = new Set(parseToolAllowlist(args2.env.NOLO_LOCAL_ALLOWED_TOOLS));
-  const agentTools = new Set(
-    (args2.agentToolNames ?? []).flatMap((item) => {
-      const normalized = normalizeLocalToolName(item);
-      return normalized ? [normalized] : [];
-    })
-  );
-  if (!restrictedMode && agentTools.has(toolName)) {
-    return { allowed: true, toolName };
-  }
-  if (DEFAULT_LOCAL_TOOLS.has(toolName) && agentTools.has(toolName)) {
-    return { allowed: true, toolName };
-  }
-  if (allowedByEnv.has(toolName) && agentTools.has(toolName)) {
-    return { allowed: true, toolName };
-  }
-  return {
-    allowed: false,
-    toolName,
-    reason: `${toolName} is not enabled for local runtime runs. The agent must declare the tool in its manifest; in restricted mode (NOLO_LOCAL_TOOL_MODE=restricted) non-default tools also require adding to NOLO_LOCAL_ALLOWED_TOOLS (e.g. NOLO_LOCAL_ALLOWED_TOOLS=someCustomTool) and restarting the session so the env var loads.`
-  };
-}
-async function executeLocalToolWithPolicy(args2) {
-  if (args2.runToolNames !== void 0 && !args2.runToolNames.includes(normalizeLocalToolName(args2.call.name))) {
-    throw new Error(`${args2.call.name} is outside the final run tool surface.`);
-  }
-  const decision = resolveLocalToolPolicy({
-    env: args2.env,
-    agentToolNames: args2.agentToolNames,
-    toolName: args2.call.name
-  });
-  if (!decision.allowed) throw new Error(decision.reason);
-  const executor = args2.executors?.[decision.toolName];
-  if (!executor) {
-    throw new Error(`${decision.toolName} is allowed by policy but no local executor is registered.`);
-  }
-  const opts = {
-    ...args2.abortSignal ? { abortSignal: args2.abortSignal } : {},
-    ...args2.detachMs !== void 0 ? { detachMs: args2.detachMs } : {},
-    ...args2.confirmed !== void 0 ? { confirmed: args2.confirmed } : {},
-    ...args2.enableDestructiveShellGuard !== void 0 ? { enableDestructiveShellGuard: args2.enableDestructiveShellGuard } : {},
-    ...args2.confirmDestructiveAction ? { confirmDestructiveAction: args2.confirmDestructiveAction } : {},
-    ...args2.blockDestructiveWithoutConfirmation !== void 0 ? { blockDestructiveWithoutConfirmation: args2.blockDestructiveWithoutConfirmation } : {}
-  };
-  if (decision.toolName === "execShell") {
-    let parsedInput = args2.call.arguments;
-    if (typeof parsedInput === "string") {
-      try {
-        parsedInput = JSON.parse(parsedInput);
-      } catch {
-        parsedInput = { command: parsedInput };
-      }
-    }
-    await evaluateExecShellDestructiveGuard(parsedInput, opts);
-    opts.confirmed = true;
-  }
-  return executor(
-    {
-      ...args2.call,
-      name: decision.toolName
-    },
-    opts
-  );
-}
-
 // packages/agent-runtime/localWorkspaceTools.ts
 import { existsSync as existsSync3 } from "node:fs";
 import { createHash as createHash3 } from "node:crypto";
@@ -19312,6 +19187,290 @@ function createLocalWorkspaceToolExecutors(args2) {
   };
 }
 
+// packages/agent-runtime/toolArgumentGate.ts
+var FIELD_ALIAS_GROUPS = [
+  // localWorkspaceTools.ts:336 导出常量（readFile/writeFile/editFile/globFiles）
+  PATH_FIELD_ALIASES,
+  // localWorkspaceTools.ts:339-340 导出常量（editFile）
+  OLD_TEXT_FIELD_ALIASES,
+  NEW_TEXT_FIELD_ALIASES,
+  // localWorkspaceTools.ts:733 `args.cmd || args.command`（launchProcess）；
+  // launchProcess 的 required ["command"] 见 localWorkspaceToolDefs.ts:283。
+  // 注：execShell 的 schema 无 required（command 在 executor 层强制，
+  // capabilities/execShellCapability.ts:42 声明 cmd 兼容字段），本组对它不产生拦截。
+  ["command", "cmd"],
+  // localWorkspaceTools.ts:698-699 `args.pattern ?? args.glob`（globFiles）
+  ["pattern", "glob"],
+  // noloWorkspaceTools.ts:492 `args.dialog ?? args.dialogId ?? args.id`（readDialog）
+  ["dialog", "dialogId", "id"],
+  // noloWorkspaceTools.ts:545 `args.agent ?? args.agentKey ?? args.id`（readAgent）
+  ["agent", "agentKey", "id"],
+  // noloWorkspaceTools.ts:552 `args.space ?? args.spaceId ?? args.id`（readSpace）
+  ["space", "spaceId", "id"],
+  // noloWorkspaceTools.ts:561/567 `args.doc ?? args.docKey ?? args.pageKey ?? args.key`
+  // （readDoc / readSkillDoc）
+  ["doc", "docKey", "pageKey", "key"],
+  // noloWorkspaceTools.node.ts:238 `parsed.name ?? parsed.skillName ?? parsed.skill`（loadSkill）
+  ["name", "skillName", "skill"],
+  // noloWorkspaceTools.ts:593 `args.table ?? args.tableId ?? args.metaKey`（queryTableRows）
+  ["table", "tableId", "metaKey"]
+];
+var TYPE_MATCHERS = {
+  string: (value) => typeof value === "string",
+  // 数字字符串视为可接受：executor 普遍 Number()/clamp 宽松处理，拦截会误报。
+  number: (value) => typeof value === "number" || typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value)),
+  integer: (value) => typeof value === "number" || typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value)),
+  boolean: (value) => typeof value === "boolean" || value === "true" || value === "false",
+  object: (value) => typeof value === "object" && value !== null && !Array.isArray(value),
+  array: (value) => Array.isArray(value)
+};
+function describeValueType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function isAliasSatisfied(args2, field) {
+  for (const group of FIELD_ALIAS_GROUPS) {
+    if (!group.includes(field)) continue;
+    if (group.some((alias) => args2[alias] !== void 0)) return true;
+  }
+  return false;
+}
+function readRequiredFields(parameters) {
+  const required = parameters.required;
+  if (!Array.isArray(required)) return [];
+  return required.filter((field) => typeof field === "string");
+}
+function readProperties(parameters) {
+  const properties = parameters.properties;
+  if (!properties || typeof properties !== "object" || Array.isArray(properties)) {
+    return {};
+  }
+  return properties;
+}
+function validateToolArguments(args2) {
+  const { toolName, rawArguments, parameters } = args2;
+  if (!parameters || typeof parameters !== "object" || Array.isArray(parameters)) {
+    return { ok: true, args: {} };
+  }
+  const schema = parameters;
+  const requiredFields = readRequiredFields(schema);
+  const properties = readProperties(schema);
+  if (requiredFields.length === 0 && Object.keys(properties).length === 0) {
+    return { ok: true, args: {} };
+  }
+  const raw = typeof rawArguments === "string" ? rawArguments.trim() : "";
+  let record = {};
+  if (raw !== "") {
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return { ok: true, args: {} };
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return { ok: true, args: {} };
+    }
+    record = parsed;
+  }
+  for (const field of requiredFields) {
+    if (record[field] !== void 0) continue;
+    if (isAliasSatisfied(record, field)) continue;
+    return {
+      ok: false,
+      message: `${toolName} \u53C2\u6570\u6821\u9A8C\u5931\u8D25\uFF1A\u7F3A\u5C11\u5FC5\u586B\u53C2\u6570 "${field}"\u3002\u8BF7\u8865\u4E0A\u540E\u91CD\u65B0\u8C03\u7528 ${toolName}\u3002`
+    };
+  }
+  for (const [field, spec] of Object.entries(properties)) {
+    const value = record[field];
+    if (value === void 0 || value === null) continue;
+    if (!spec || typeof spec !== "object" || Array.isArray(spec)) continue;
+    const declared = spec.type;
+    if (typeof declared !== "string") continue;
+    const matcher = TYPE_MATCHERS[declared];
+    if (!matcher) continue;
+    if (!matcher(value)) {
+      return {
+        ok: false,
+        message: `${toolName} \u53C2\u6570\u6821\u9A8C\u5931\u8D25\uFF1A\u53C2\u6570 "${field}" \u5E94\u4E3A ${declared}\uFF0C\u5B9E\u9645\u6536\u5230 ${describeValueType(value)}\u3002\u8BF7\u4FEE\u6B63\u540E\u91CD\u65B0\u8C03\u7528 ${toolName}\u3002`
+      };
+    }
+  }
+  return { ok: true, args: record };
+}
+function buildToolParametersIndex(tools) {
+  const index = /* @__PURE__ */ new Map();
+  for (const tool of tools) {
+    if (!tool || typeof tool !== "object") continue;
+    const fn3 = tool.function;
+    if (!fn3 || typeof fn3 !== "object") continue;
+    const name = fn3.name;
+    const parameters = fn3.parameters;
+    if (typeof name === "string" && name && parameters !== void 0) {
+      index.set(name, parameters);
+    }
+  }
+  return index;
+}
+var cachedAgentRuntimeIndex = null;
+function getAgentRuntimeToolParametersIndex() {
+  if (cachedAgentRuntimeIndex) return cachedAgentRuntimeIndex;
+  const index = /* @__PURE__ */ new Map();
+  try {
+    const workspaceTools = buildLocalWorkspaceOpenAiTools({
+      toolNames: [...WORKSPACE_TOOL_NAMES],
+      exposeShellTools: true
+    });
+    for (const [name, parameters] of buildToolParametersIndex(workspaceTools)) {
+      index.set(name, parameters);
+    }
+    const noloTools = buildNoloWorkspaceOpenAiTools({
+      toolNames: [...NOLO_WORKSPACE_TOOL_NAMES]
+    });
+    for (const [name, parameters] of buildToolParametersIndex(noloTools)) {
+      index.set(name, parameters);
+    }
+  } catch {
+  }
+  cachedAgentRuntimeIndex = index;
+  return index;
+}
+
+// packages/agent-runtime/localToolPolicy.ts
+var NEVER_LOCAL_TOOLS = /* @__PURE__ */ new Set([
+  "deleteSpaces",
+  "updateAgent",
+  "updateSelf",
+  "createAgent"
+]);
+var DEFAULT_LOCAL_TOOLS = /* @__PURE__ */ new Set([
+  "readFile",
+  "writeFile",
+  "editFile",
+  "globFiles",
+  "execShell",
+  "launchProcess",
+  "listProcesses",
+  // ProcessTask follow-up tools. Same tier as listProcesses: they observe/stop
+  // tasks the agent itself already spawned, so their blast radius is strictly
+  // narrower than launchProcess (which is default-enabled). Model-facing
+  // follow-ups are taskWait/taskStop only — lifecycle history (taskLogs) stays
+  // runtime-internal.
+  "taskWait",
+  "taskStop",
+  // Scheduling tools: forking/observing sub-agents is a declared capability
+  // of capable agents, and the blast radius is strictly narrower than
+  // execShell (already default-enabled). Requiring an env allowlist for these
+  // while execShell is open by default inverted the risk model and forced every
+  // new local user to hand-edit .env files before sub-agent tasks worked.
+  "startAgentRun",
+  "controlAgentRun"
+]);
+function parseToolAllowlist(value) {
+  return (value ?? "").split(",").flatMap((item) => {
+    const trimmed = item.trim();
+    return trimmed ? [trimmed] : [];
+  });
+}
+function normalizeLocalToolName(toolName) {
+  return canonicalizeToolName(
+    String(toolName ?? "").replace(/^functions\./, "").trim()
+  );
+}
+function isRestrictedLocalToolMode(env) {
+  return env.NOLO_LOCAL_TOOL_MODE === "restricted";
+}
+function resolveLocalToolPolicy(args2) {
+  const toolName = normalizeLocalToolName(args2.toolName);
+  const restrictedMode = isRestrictedLocalToolMode(args2.env);
+  if (!toolName) {
+    return {
+      allowed: false,
+      toolName,
+      reason: "Tool name is required."
+    };
+  }
+  if (NEVER_LOCAL_TOOLS.has(toolName)) {
+    return {
+      allowed: false,
+      toolName,
+      reason: `${toolName} is blocked by the local runtime safety policy.`
+    };
+  }
+  const allowedByEnv = new Set(parseToolAllowlist(args2.env.NOLO_LOCAL_ALLOWED_TOOLS));
+  const agentTools = new Set(
+    (args2.agentToolNames ?? []).flatMap((item) => {
+      const normalized = normalizeLocalToolName(item);
+      return normalized ? [normalized] : [];
+    })
+  );
+  if (!restrictedMode && agentTools.has(toolName)) {
+    return { allowed: true, toolName };
+  }
+  if (DEFAULT_LOCAL_TOOLS.has(toolName) && agentTools.has(toolName)) {
+    return { allowed: true, toolName };
+  }
+  if (allowedByEnv.has(toolName) && agentTools.has(toolName)) {
+    return { allowed: true, toolName };
+  }
+  return {
+    allowed: false,
+    toolName,
+    reason: `${toolName} is not enabled for local runtime runs. The agent must declare the tool in its manifest; in restricted mode (NOLO_LOCAL_TOOL_MODE=restricted) non-default tools also require adding to NOLO_LOCAL_ALLOWED_TOOLS (e.g. NOLO_LOCAL_ALLOWED_TOOLS=someCustomTool) and restarting the session so the env var loads.`
+  };
+}
+async function executeLocalToolWithPolicy(args2) {
+  if (args2.runToolNames !== void 0 && !args2.runToolNames.includes(normalizeLocalToolName(args2.call.name))) {
+    throw new Error(`${args2.call.name} is outside the final run tool surface.`);
+  }
+  const decision = resolveLocalToolPolicy({
+    env: args2.env,
+    agentToolNames: args2.agentToolNames,
+    toolName: args2.call.name
+  });
+  if (!decision.allowed) throw new Error(decision.reason);
+  const executor = args2.executors?.[decision.toolName];
+  if (!executor) {
+    throw new Error(`${decision.toolName} is allowed by policy but no local executor is registered.`);
+  }
+  const parametersSchema = args2.toolParametersIndex?.get(decision.toolName);
+  if (parametersSchema !== void 0) {
+    const gate = validateToolArguments({
+      toolName: decision.toolName,
+      rawArguments: args2.call.arguments,
+      parameters: parametersSchema
+    });
+    if (!gate.ok) throw new Error(gate.message);
+  }
+  const opts = {
+    ...args2.abortSignal ? { abortSignal: args2.abortSignal } : {},
+    ...args2.detachMs !== void 0 ? { detachMs: args2.detachMs } : {},
+    ...args2.confirmed !== void 0 ? { confirmed: args2.confirmed } : {},
+    ...args2.enableDestructiveShellGuard !== void 0 ? { enableDestructiveShellGuard: args2.enableDestructiveShellGuard } : {},
+    ...args2.confirmDestructiveAction ? { confirmDestructiveAction: args2.confirmDestructiveAction } : {},
+    ...args2.blockDestructiveWithoutConfirmation !== void 0 ? { blockDestructiveWithoutConfirmation: args2.blockDestructiveWithoutConfirmation } : {}
+  };
+  if (decision.toolName === "execShell") {
+    let parsedInput = args2.call.arguments;
+    if (typeof parsedInput === "string") {
+      try {
+        parsedInput = JSON.parse(parsedInput);
+      } catch {
+        parsedInput = { command: parsedInput };
+      }
+    }
+    await evaluateExecShellDestructiveGuard(parsedInput, opts);
+    opts.confirmed = true;
+  }
+  return executor(
+    {
+      ...args2.call,
+      name: decision.toolName
+    },
+    opts
+  );
+}
+
 // packages/cli/client/localDialogRecords.ts
 var localDialogMessageRecordToRuntimeMessage = dialogMessageRecordToAgentRuntimeMessage;
 function buildLocalDialogWritePlan(args2) {
@@ -20016,7 +20175,7 @@ function buildGeminiGenerateContentRequest(args2) {
   const toolsResult = convertOpenAiToolsToGemini(args2.tools);
   if (toolsResult) {
     request3.tools = toolsResult;
-    request3.toolConfig = { functionCallingConfig: { mode: "VALIDATED" } };
+    request3.toolConfig = { functionCallingConfig: { mode: "AUTO" } };
   }
   const generationConfig = {};
   if (typeof args2.maxTokens === "number" && args2.maxTokens > 0) {
@@ -20065,7 +20224,7 @@ function buildCloudCodeAssistPayload(args2) {
   );
   if (tools) {
     request3.tools = tools;
-    request3.toolConfig = { functionCallingConfig: { mode: "VALIDATED" } };
+    request3.toolConfig = { functionCallingConfig: { mode: "AUTO" } };
   }
   const generationConfig = {};
   if (profile?.maxOutputTokens) {
@@ -20792,8 +20951,6 @@ export {
   createHybridRecordStore,
   isDestructiveShellCommand,
   evaluateShellCommandPolicy,
-  resolveLocalToolPolicy,
-  executeLocalToolWithPolicy,
   filterRetainedLedgerRecords,
   isLineRangeCovered,
   getProcessRegistry,
@@ -20804,6 +20961,10 @@ export {
   internalSearchWorkspace,
   internalListWorkspaceEntries,
   createLocalWorkspaceToolExecutors,
+  buildToolParametersIndex,
+  getAgentRuntimeToolParametersIndex,
+  resolveLocalToolPolicy,
+  executeLocalToolWithPolicy,
   localDialogMessageRecordToRuntimeMessage,
   buildLocalDialogWritePlan,
   buildNoloWorkspaceCliToolExecutors,