nolo-cli 0.173.0-alpha.2 → 0.174.0-alpha.1

package/{chunk-IVPXG433.js → chunk-IFRQFQ2C.js}

@@ -15723,11 +15723,187 @@ async function invokeCapability(capabilityOrName, input, ctx = {}) {
 }
 
 // packages/agent-runtime/localWorkspaceTools.ts
-import { existsSync as existsSync4 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
 import { createHash as createHash4 } from "node:crypto";
-import { lstat, mkdir, readdir as readdir2, readFile as readFile3, realpath, stat as stat3, writeFile } from "node:fs/promises";
+
+// packages/agent-runtime/visualRenderer.node.ts
+import { createRequire } from "node:module";
+import { existsSync as existsSync4 } from "node:fs";
+import { mkdir, realpath, stat, readFile, writeFile } from "node:fs/promises";
+import { dirname as dirname2, isAbsolute as isAbsolute2, relative as relative2, win32 } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { lookup as lookup2 } from "node:dns/promises";
+import { isIP } from "node:net";
+function isVisualPathOutside(rel) {
+  return rel === ".." || /^\.\.[\\/]/.test(rel) || isAbsolute2(rel) || win32.isAbsolute(rel);
+}
+async function validateVisualUrl(input, workspaceRoot) {
+  const url = new URL(input);
+  if (url.protocol === "file:") {
+    const [root, path] = await Promise.all([realpath(workspaceRoot), realpath(fileURLToPath(url))]);
+    const rel = relative2(root, path);
+    if (isVisualPathOutside(rel)) throw new Error("Renderer file URL is outside workspaceRoot.");
+    if (!(await stat(path)).isFile()) throw new Error("Renderer file URL must point to a file, not a directory.");
+    return pathToFileURL(path);
+  }
+  if (!["http:", "https:"].includes(url.protocol)) throw new Error("Renderer URL must use http:, https:, or file:.");
+  await assertVisualNetworkHost(url.hostname);
+  return url;
+}
+async function assertVisualNetworkHost(host) {
+  const hostname = host.replace(/^\[|\]$/g, "");
+  const addresses = isIP(hostname) ? [{ address: hostname }] : await lookup2(hostname, { all: true });
+  for (const { address } of addresses) {
+    const normalized = new URL(`http://${address.includes(":") ? `[${address}]` : address}`).hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    const mapped = normalized.match(/^::ffff:([a-f0-9]+):([a-f0-9]+)$/);
+    const ipv4 = mapped ? `${parseInt(mapped[1], 16) >> 8}.${parseInt(mapped[1], 16) & 255}.${parseInt(mapped[2], 16) >> 8}.${parseInt(mapped[2], 16) & 255}` : normalized;
+    const octets = ipv4.split(".").map(Number);
+    if (ipv4.startsWith("169.254.") || normalized === "fd00:ec2::254" || /^fe[89ab][0-9a-f]:/.test(normalized) || ipv4 === "100.100.100.200") {
+      throw new Error(`Renderer denies metadata/link-local address: ${hostname}`);
+    }
+    const privateV4 = octets.length === 4 && (octets[0] === 10 || octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31 || octets[0] === 192 && octets[1] === 168 || octets[0] === 100 && octets[1] >= 64 && octets[1] <= 127);
+    const privateV6 = /^(fc|fd)[a-f0-9]{2}:/.test(normalized);
+    if ((privateV4 || privateV6) && process.env.NOLO_VISUAL_RENDERER_ALLOW_PRIVATE !== "1") {
+      throw new Error(`Renderer denies private address (LAN access requires NOLO_VISUAL_RENDERER_ALLOW_PRIVATE=1): ${hostname}`);
+    }
+    if (ipv4 === "0.0.0.0" || normalized === "::" || octets.length === 4 && octets[0] >= 224 || normalized.startsWith("ff")) {
+      throw new Error(`Renderer denies non-unicast address: ${hostname}`);
+    }
+  }
+}
+var VisualResourceError = class extends Error {
+  detectedAt = performance.now();
+};
+var VisualRenderSemaphore = class {
+  constructor(limit) {
+    this.limit = limit;
+  }
+  active = 0;
+  queue = [];
+  async run(task) {
+    if (this.active >= this.limit) await new Promise((resolve6) => this.queue.push(resolve6));
+    else this.active++;
+    try {
+      return await task();
+    } finally {
+      const next = this.queue.shift();
+      if (next) next();
+      else this.active--;
+    }
+  }
+};
+var configuredConcurrency = Number(process.env.NOLO_VISUAL_RENDERER_CONCURRENCY ?? 2);
+var renderSlots = new VisualRenderSemaphore(Number.isFinite(configuredConcurrency) ? Math.max(1, Math.min(2, Math.floor(configuredConcurrency))) : 2);
+var require2 = createRequire(import.meta.url);
+function visualRendererCapability() {
+  if (process.env.NOLO_VISUAL_RENDERER_DISABLED === "1") return { available: false, reason: "Platform renderer disabled by NOLO_VISUAL_RENDERER_DISABLED=1 on this runtime host." };
+  try {
+    const { chromium } = require2("playwright");
+    const executablePath = [chromium.executablePath(), resolveExecutableOnPath("google-chrome"), resolveExecutableOnPath("chromium"), resolveExecutableOnPath("chromium-browser")].find((path) => !!path && existsSync4(path));
+    if (!executablePath) return { available: false, reason: "No Chromium renderer installed. Install Playwright Chromium (playwright install chromium) or system Chromium/Google Chrome on the runtime host." };
+    return { available: true, chromium, executablePath };
+  } catch {
+    return { available: false, reason: "Platform renderer unavailable: install the platform Playwright dependency and Chromium on the runtime host (not a workspace npm script)." };
+  }
+}
+async function renderVisualPage(args2) {
+  const capability = visualRendererCapability();
+  if (!capability.available) throw new Error(capability.reason);
+  const url = await validateVisualUrl(args2.url, args2.workspaceRoot);
+  return renderSlots.run(async () => {
+    const timeout4 = Math.max(1, Math.min(args2.timeoutMs ?? 2e4, 2e4));
+    const deadline = Date.now() + timeout4;
+    const browser = await capability.chromium.launch({ executablePath: capability.executablePath, headless: true, timeout: timeout4 });
+    let timer;
+    try {
+      const page = await browser.newPage({ viewport: { width: 1440, height: 1e3 }, serviceWorkers: "block" });
+      const localOrigin = "https://nolo-workspace.invalid";
+      const localFile = url.protocol === "file:";
+      let routeError;
+      let rejectRoute;
+      const routeFailure = new Promise((_, reject) => {
+        rejectRoute = reject;
+      });
+      await page.route("**/*", async (route) => {
+        try {
+          const requestUrl = new URL(route.request().url());
+          if (localFile && requestUrl.origin === localOrigin) {
+            const file = await validateVisualUrl(`file://${requestUrl.pathname}`, args2.workspaceRoot);
+            const path = fileURLToPath(file);
+            const type = path.endsWith(".html") ? "text/html; charset=utf-8" : path.endsWith(".css") ? "text/css; charset=utf-8" : path.endsWith(".js") ? "application/javascript; charset=utf-8" : void 0;
+            await route.fulfill({ body: await readFile(path), ...type ? { contentType: type } : {} });
+          } else {
+            await validateVisualUrl(requestUrl.href, args2.workspaceRoot);
+            if (requestUrl.protocol === "file:") throw new Error("Direct file requests are forbidden.");
+            let next = requestUrl;
+            for (let hop = 0; ; hop++) {
+              await validateVisualUrl(next.href, args2.workspaceRoot);
+              const response = await route.fetch({ url: next.href, maxRedirects: 0, timeout: Math.max(1, deadline - Date.now()) });
+              const location = response.headers()["location"];
+              if ([301, 302, 303, 307, 308].includes(response.status()) && location) {
+                if (hop >= 10) throw new Error("Renderer redirect limit exceeded.");
+                next = new URL(location, next);
+                if (!["http:", "https:"].includes(next.protocol)) throw new Error("Renderer redirects must use http(s).");
+                continue;
+              }
+              await route.fulfill({ response });
+              break;
+            }
+          }
+        } catch (error) {
+          routeError = new VisualResourceError(error instanceof Error ? error.message : String(error));
+          const closing = page.close({ runBeforeUnload: false }).catch(() => {
+          });
+          rejectRoute(routeError);
+          await Promise.all([closing, route.abort().catch(() => {
+          })]);
+        }
+      });
+      const work = async () => {
+        page.setDefaultTimeout(timeout4);
+        await page.goto(localFile ? `${localOrigin}${url.pathname}` : url.href, { waitUntil: "load", timeout: timeout4 });
+        await page.locator(args2.waitSelector).first().waitFor({ state: "visible" });
+        if (args2.scrollSelector) await page.locator(args2.scrollSelector).first().scrollIntoViewIfNeeded();
+        const targetSelector = args2.focusSelector ?? args2.waitSelector;
+        await page.locator(targetSelector).first().scrollIntoViewIfNeeded();
+        if (args2.expectText) await page.getByText(args2.expectText, { exact: false }).first().waitFor({ state: "visible" });
+        const screenshot = await page.screenshot({ type: "png", timeout: timeout4 });
+        const metrics = await page.evaluate(({ waitSelector, scrollSelector, targetSelector: targetSelector2 }) => {
+          const target = document.querySelector(targetSelector2);
+          const rect = target.getBoundingClientRect();
+          const style = getComputedStyle(target);
+          return {
+            waitCount: document.querySelectorAll(waitSelector).length,
+            scrollCount: scrollSelector ? document.querySelectorAll(scrollSelector).length : null,
+            focusCount: document.querySelectorAll(targetSelector2).length,
+            targetText: target.textContent?.trim().slice(0, 240) ?? "",
+            targetRect: Object.fromEntries(["width", "height", "left", "right", "top", "bottom"].map((key) => [key, Math.round(rect[key])])),
+            targetComputed: Object.fromEntries(["display", "visibility", "opacity", "position", "width", "height", "pointerEvents"].map((key) => [key, style[key]])),
+            bodyTextSample: document.body.innerText.slice(0, 500)
+          };
+        }, { waitSelector: args2.waitSelector, scrollSelector: args2.scrollSelector, targetSelector });
+        if (routeError) throw routeError;
+        const result4 = { ...metrics, pageUrl: localFile ? url.href : page.url(), title: await page.title(), viewport: page.viewportSize(), renderer: "platform-playwright", capturedAt: (/* @__PURE__ */ new Date()).toISOString() };
+        if (Date.now() >= deadline) throw new Error("Renderer timed out before screenshot persistence.");
+        if (timer) clearTimeout(timer);
+        await mkdir(dirname2(args2.screenshotPath), { recursive: true });
+        await writeFile(args2.screenshotPath, screenshot);
+        return result4;
+      };
+      return await Promise.race([routeFailure, work(), new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`Renderer timed out after ${timeout4}ms.`)), Math.max(1, deadline - Date.now()));
+      })]);
+    } finally {
+      if (timer) clearTimeout(timer);
+      await browser.close();
+    }
+  });
+}
+
+// packages/agent-runtime/localWorkspaceTools.ts
+import { lstat, mkdir as mkdir2, readdir as readdir2, readFile as readFile4, realpath as realpath2, stat as stat4, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname as dirname2, isAbsolute as isAbsolute2, relative as relative3, resolve as resolve4, sep } from "node:path";
+import { dirname as dirname3, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve4, sep } from "node:path";
 import { spawn as spawnChildProcess3 } from "node:child_process";
 
 // packages/core/readRangeLedger.ts
@@ -15763,15 +15939,15 @@ function isLineRangeCovered(request3, covered) {
 }
 
 // packages/agent-runtime/fileTextSearch.ts
-import { readdir, readFile as readFile2, stat as stat2 } from "node:fs/promises";
-import { basename, relative as relative2, resolve as resolve3 } from "node:path";
+import { readdir, readFile as readFile3, stat as stat3 } from "node:fs/promises";
+import { basename, relative as relative3, resolve as resolve3 } from "node:path";
 import { spawn as spawnChildProcess2 } from "node:child_process";
 
 // packages/agent-runtime/gitignore.ts
-import { readFile, stat } from "node:fs/promises";
+import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
 import { resolve as resolve2 } from "node:path";
 async function readRootGitignorePatterns(workspaceRoot) {
-  const content = await readFile(resolve2(workspaceRoot, ".gitignore"), "utf8").catch(() => null);
+  const content = await readFile2(resolve2(workspaceRoot, ".gitignore"), "utf8").catch(() => null);
   if (content === null) return [];
   return content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#") && !line.startsWith("!")).flatMap((line) => {
     const unanchored = line.replace(/^\//, "");
@@ -15782,7 +15958,7 @@ async function readRootGitignorePatterns(workspaceRoot) {
 }
 async function hasRootGitignore(workspaceRoot) {
   try {
-    await stat(resolve2(workspaceRoot, ".gitignore"));
+    await stat2(resolve2(workspaceRoot, ".gitignore"));
     return true;
   } catch {
     return false;
@@ -15791,7 +15967,7 @@ async function hasRootGitignore(workspaceRoot) {
 
 // packages/agent-runtime/fileTextSearch.ts
 var normalizePath = (value) => value.replaceAll("\\", "/");
-var pathFor = (root, file, absolute = false) => absolute ? normalizePath(file) : normalizePath(relative2(root, file) || basename(file));
+var pathFor = (root, file, absolute = false) => absolute ? normalizePath(file) : normalizePath(relative3(root, file) || basename(file));
 var COMMAND_LIMIT_HEADROOM = 1;
 async function runCommand(binary, args2, cwd, maxResults) {
   const recordLimit = maxResults === void 0 ? 0 : Math.max(0, maxResults) + COMMAND_LIMIT_HEADROOM;
@@ -15851,7 +16027,7 @@ async function decorate(root, raw, context3, absolute = false) {
     let lines = cache.get(x.file);
     if (!lines) {
       try {
-        lines = (await readFile2(x.file, "utf8")).split(/\r\n|\r|\n/);
+        lines = (await readFile3(x.file, "utf8")).split(/\r\n|\r|\n/);
       } catch {
         continue;
       }
@@ -15880,13 +16056,13 @@ function globMatch(pattern, value) {
   const r = new RegExp(`^${source}$`);
   return r.test(value) || r.test(basename(value));
 }
-var defaultReadTextFile = (filePath) => readFile2(filePath, "utf8").catch(() => "");
+var defaultReadTextFile = (filePath) => readFile3(filePath, "utf8").catch(() => "");
 async function jsSearch(o, targetPath) {
   const max4 = o.maxResults ?? Number.MAX_SAFE_INTEGER;
   const excludes = o.exclude ?? [];
   const readText = o.readTextFile ?? defaultReadTextFile;
   const files = [];
-  const targetStat = await stat2(targetPath).catch(() => null);
+  const targetStat = await stat3(targetPath).catch(() => null);
   if (!targetStat) return { matches: [], totalMatches: 0, truncated: false, engine: "js" };
   const ignorePatterns = o.includeIgnored ? [] : await readRootGitignorePatterns(o.root);
   const isIgnored = (rel) => ignorePatterns.some((pattern) => globMatch(pattern, rel));
@@ -15932,7 +16108,7 @@ var COMMAND_ENGINES = [
 ];
 async function searchFileTextMatches(o) {
   const targetPath = resolve3(o.root, o.target || ".");
-  const targetStat = await stat2(targetPath).catch(() => null);
+  const targetStat = await stat3(targetPath).catch(() => null);
   if (!targetStat) return { matches: [], totalMatches: 0, truncated: false, engine: "js" };
   if (targetStat.isFile()) return jsSearch(o, targetPath);
   const run2 = o.runCommand ?? runCommand, max4 = o.maxResults;
@@ -16397,7 +16573,7 @@ function buildCaptureVisualStateTool() {
     type: "function",
     function: {
       name: "captureVisualState",
-      description: "Capture a real local app screenshot and DOM/computed-style metrics for a selected UI state.",
+      description: "Render a URL to an image and DOM/computed-style metrics using platform Playwright/Chromium on the runtime host. Requires an installed renderer; never runs workspace scripts.",
       parameters: {
         type: "object",
         properties: {
@@ -16668,6 +16844,7 @@ function buildLocalWorkspaceOpenAiTools(args2) {
   const declaredTools = new Set(args2.toolNames ?? []);
   return WORKSPACE_TOOL_NAMES.filter((toolName) => {
     if (!declaredTools.has(toolName)) return false;
+    if (toolName === "captureVisualState" && !visualRendererCapability().available) return false;
     if (!args2.exposeShellTools && SHELL_TOOL_NAMES.includes(toolName)) {
       return false;
     }
@@ -16682,11 +16859,11 @@ function parseWorkspaceToolArguments(raw) {
   }
 }
 function normalizeWorkspaceRelativePath(args2) {
-  const relativePath = relative3(args2.workspaceRoot, args2.targetPath);
+  const relativePath = relative4(args2.workspaceRoot, args2.targetPath);
   return relativePath || ".";
 }
 function isPathInsideWorkspace(args2) {
-  const relativePath = relative3(args2.workspaceRoot, args2.targetPath);
+  const relativePath = relative4(args2.workspaceRoot, args2.targetPath);
   return relativePath === "" || !relativePath.startsWith("..") && !relativePath.includes(`..${sep}`);
 }
 var PATH_FIELD_ALIASES = ["path", "file_path", "filePath", "filename", "file", "target_file", "targetFile", "file_to_read", "fileToRead", "target_path", "read_path", "path_to_read", "pathToRead"];
@@ -16950,77 +17127,11 @@ function readVisualStateCaptureArgs(args2) {
     metricsPath
   };
 }
-async function readWorkspacePackageScripts(workspaceRoot) {
-  try {
-    const raw = await readFile3(resolve4(workspaceRoot, "package.json"), "utf8");
-    const parsed = JSON.parse(raw);
-    const scripts = parsed && typeof parsed === "object" && parsed.scripts && typeof parsed.scripts === "object" ? Object.keys(parsed.scripts).sort() : [];
-    return { scripts };
-  } catch (error) {
-    return {
-      scripts: [],
-      error: toErrorMessage(error)
-    };
-  }
-}
-function formatAvailableScripts(scripts) {
-  return scripts.length ? scripts.join(", ") : "(none)";
-}
-async function runWorkspacePackageScript(args2) {
-  const script = args2.script.trim();
-  if (!script) throw new Error("package script name is required.");
-  const extraArgs = args2.extraArgs ?? [];
-  const packageScripts = await readWorkspacePackageScripts(args2.workspaceRoot);
-  if (!packageScripts.scripts.includes(script)) {
-    return {
-      content: [
-        `script not found: ${script}`,
-        `available scripts: ${formatAvailableScripts(packageScripts.scripts)}`,
-        ...packageScripts.error ? [`package.json read error: ${packageScripts.error}`] : []
-      ].join("\n"),
-      metadata: {
-        script,
-        exitCode: 1,
-        reason: "script-not-found",
-        availableScripts: packageScripts.scripts,
-        ...packageScripts.error ? { packageJsonError: packageScripts.error } : {}
-      }
-    };
-  }
-  const result4 = await runWorkspaceCommand({
-    workspaceRoot: args2.workspaceRoot,
-    command: ["bun", "run", script, ...extraArgs.length ? ["--", ...extraArgs] : []],
-    timeoutMs: args2.commandTimeoutMs
-  });
-  return {
-    content: result4.content,
-    metadata: {
-      script,
-      args: extraArgs,
-      exitCode: result4.exitCode,
-      reason: result4.exitCode === 0 ? "ok" : "script-failed",
-      timedOut: result4.timedOut,
-      stdoutTail: result4.stdout.trim().slice(-4e3),
-      stderrTail: result4.stderr.trim().slice(-4e3)
-    }
-  };
-}
-function parseLastJsonObject(text2) {
-  const trimmed = text2.trim();
-  for (let index = trimmed.lastIndexOf("{"); index >= 0; index = trimmed.lastIndexOf("{", index - 1)) {
-    try {
-      const parsed = JSON.parse(trimmed.slice(index));
-      return parsed && typeof parsed === "object" ? parsed : null;
-    } catch {
-    }
-  }
-  return null;
-}
 function resolveRipgrepBinary(env = process.env) {
   const fromEnv = asOptionalTrimmedString(env.NOLO_BUNDLED_RG);
   if (fromEnv) {
     try {
-      if (existsSync4(fromEnv)) return fromEnv;
+      if (existsSync5(fromEnv)) return fromEnv;
     } catch {
     }
   }
@@ -17028,8 +17139,8 @@ function resolveRipgrepBinary(env = process.env) {
 }
 var SEARCH_OUTPUT_CHAR_LIMIT = 2e4;
 function isPathInsideRoot(root, targetPath) {
-  const rel = relative3(resolve4(root), resolve4(targetPath));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute2(rel);
+  const rel = relative4(resolve4(root), resolve4(targetPath));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute3(rel);
 }
 async function resolveRuntimeOwnedSpillPath(targetPath) {
   const spillRoot = resolveNoloStateDir("spills");
@@ -17037,7 +17148,7 @@ async function resolveRuntimeOwnedSpillPath(targetPath) {
   const rootStat = await lstat(spillRoot).catch(() => void 0);
   if (rootStat?.isDirectory() !== true) return null;
   try {
-    const [realRoot, realTarget] = await Promise.all([realpath(spillRoot), realpath(targetPath)]);
+    const [realRoot, realTarget] = await Promise.all([realpath2(spillRoot), realpath2(targetPath)]);
     return isPathInsideRoot(realRoot, realTarget) ? realTarget : null;
   } catch {
     return null;
@@ -17137,7 +17248,7 @@ async function readFileTool(args2) {
     allowRuntimeOwnedSpill: true,
     ...args2.confirmExternalFileAccess ? { confirmExternalFileAccess: args2.confirmExternalFileAccess } : {}
   });
-  const content = await readFile3(absolutePath, "utf8");
+  const content = await readFile4(absolutePath, "utf8");
   const activity = extractActivity(parsed);
   const sliced = sliceReadFileContent({
     content,
@@ -17221,8 +17332,8 @@ async function writeFileTool(args2) {
     requestedPath,
     ...args2.confirmExternalFileAccess ? { confirmExternalFileAccess: args2.confirmExternalFileAccess } : {}
   });
-  await mkdir(dirname2(absolutePath), { recursive: true });
-  await writeFile(absolutePath, content, "utf8");
+  await mkdir2(dirname3(absolutePath), { recursive: true });
+  await writeFile2(absolutePath, content, "utf8");
   const relativePath = normalizeWorkspaceRelativePath({
     workspaceRoot: resolve4(args2.workspaceRoot),
     targetPath: absolutePath
@@ -17330,7 +17441,7 @@ async function editFileTool(args2) {
     requestedPath,
     ...args2.confirmExternalFileAccess ? { confirmExternalFileAccess: args2.confirmExternalFileAccess } : {}
   });
-  const content = await readFile3(absolutePath, "utf8");
+  const content = await readFile4(absolutePath, "utf8");
   const { count: replacementCount, result: nextContent } = countAndReplaceEolTolerant({
     content,
     oldText,
@@ -17344,7 +17455,7 @@ async function editFileTool(args2) {
 ${hint}` : "")
     );
   }
-  await writeFile(absolutePath, nextContent, "utf8");
+  await writeFile2(absolutePath, nextContent, "utf8");
   const relativePath = normalizeWorkspaceRelativePath({
     workspaceRoot: resolve4(args2.workspaceRoot),
     targetPath: absolutePath
@@ -17387,8 +17498,8 @@ async function listWorkspaceEntries(args2) {
     for (const name of names) {
       if (truncated) break;
       const absolutePath = resolve4(dirPath, name);
-      const info = await stat3(absolutePath);
-      const relativePath = relative3(args2.dirPath, absolutePath) || ".";
+      const info = await stat4(absolutePath);
+      const relativePath = relative4(args2.dirPath, absolutePath) || ".";
       const isDirectory = info.isDirectory();
       entries.push(isDirectory ? `${relativePath}/` : relativePath);
       if (args2.maxResults && entries.length >= args2.maxResults) {
@@ -17600,59 +17711,52 @@ async function resolveVisualStateBaseUrl(args2) {
   return DEFAULT_LOCAL_API_ORIGIN;
 }
 async function captureVisualStateTool(args2) {
-  const parsed = parseWorkspaceToolArguments(args2.call.arguments);
-  const captureArgs = readVisualStateCaptureArgs(parsed);
-  const baseUrl = await resolveVisualStateBaseUrl({
-    explicitBaseUrl: captureArgs.baseUrl
-  });
-  const extraArgs = [
-    "--base",
-    baseUrl,
-    "--path",
-    captureArgs.path,
-    "--wait-selector",
-    captureArgs.waitSelector,
-    ...captureArgs.scrollSelector ? ["--scroll-selector", captureArgs.scrollSelector] : [],
-    ...captureArgs.focusSelector ? ["--focus-selector", captureArgs.focusSelector] : [],
-    ...captureArgs.expectText ? ["--expect-text", captureArgs.expectText] : [],
-    "--screenshot",
-    captureArgs.screenshotPath,
-    "--metrics",
-    captureArgs.metricsPath
-  ];
-  const result4 = await runWorkspacePackageScript({
-    workspaceRoot: args2.workspaceRoot,
-    script: "probe:visual-review",
-    extraArgs,
-    commandTimeoutMs: args2.commandTimeoutMs
-  });
-  const metrics = parseLastJsonObject(String(result4.metadata?.stdoutTail ?? result4.content));
-  return {
-    content: [
-      `pageUrl: ${typeof metrics?.pageUrl === "string" ? metrics.pageUrl : ""}`,
-      `screenshotPath: ${captureArgs.screenshotPath}`,
-      `metricsPath: ${captureArgs.metricsPath}`,
-      `waitSelector: ${captureArgs.waitSelector}`,
-      ...captureArgs.focusSelector ? [`focusSelector: ${captureArgs.focusSelector}`] : [],
-      ...captureArgs.expectText ? [`expectText: ${captureArgs.expectText}`] : [],
-      "",
-      result4.content
-    ].join("\n").trim(),
-    metadata: {
-      ...result4.metadata,
-      script: "probe:visual-review",
-      args: extraArgs,
-      baseUrl,
-      path: captureArgs.path,
-      waitSelector: captureArgs.waitSelector,
-      scrollSelector: captureArgs.scrollSelector,
-      focusSelector: captureArgs.focusSelector,
-      expectText: captureArgs.expectText,
-      screenshotPath: captureArgs.screenshotPath,
-      metricsPath: captureArgs.metricsPath,
-      ...metrics ?? {}
-    }
-  };
+  try {
+    const parsed = parseWorkspaceToolArguments(args2.call.arguments);
+    const captureArgs = readVisualStateCaptureArgs(parsed);
+    const capability = visualRendererCapability();
+    if (!capability.available) return { content: `captureVisualState unavailable: ${capability.reason}`, metadata: { ok: false, rendererAvailable: false } };
+    const baseUrl = await resolveVisualStateBaseUrl({ explicitBaseUrl: captureArgs.baseUrl });
+    const pageUrl = new URL(captureArgs.path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`).href;
+    const screenshotPath = resolveRequestedWorkspacePath(args2.workspaceRoot, captureArgs.screenshotPath);
+    const metricsPath = resolveRequestedWorkspacePath(args2.workspaceRoot, captureArgs.metricsPath);
+    const rendered = await renderVisualPage({ ...captureArgs, workspaceRoot: args2.workspaceRoot, url: pageUrl, screenshotPath, timeoutMs: args2.commandTimeoutMs });
+    const metrics = {
+      ...captureArgs,
+      ...rendered,
+      scrollSelector: captureArgs.scrollSelector ?? null,
+      focusSelector: captureArgs.focusSelector ?? null,
+      expectText: captureArgs.expectText ?? null
+    };
+    await mkdir2(dirname3(metricsPath), { recursive: true });
+    await writeFile2(metricsPath, JSON.stringify(metrics, null, 2));
+    const image = await readLocalImage(screenshotPath);
+    return {
+      content: [
+        `pageUrl: ${metrics.pageUrl}`,
+        `screenshotPath: ${captureArgs.screenshotPath}`,
+        `metricsPath: ${captureArgs.metricsPath}`,
+        `waitSelector: ${captureArgs.waitSelector}`,
+        ...captureArgs.focusSelector ? [`focusSelector: ${captureArgs.focusSelector}`] : [],
+        ...captureArgs.expectText ? [`expectText: ${captureArgs.expectText}`] : [],
+        image.content.replace("[image ", "[screenshot ").replace(/(\d+) bytes/, (_, bytes) => `${Math.ceil(Number(bytes) / 1024)}KB`)
+      ].join("\n"),
+      images: image.images,
+      metadata: {
+        ...captureArgs,
+        ...metrics,
+        ok: true,
+        exitCode: 0,
+        baseUrl,
+        script: null,
+        args: [],
+        compatibilityVersion: 2,
+        compatibilityNote: "Platform rendering replaces workspace scripts; script/args/stdoutTail no longer describe a subprocess. Existing page metrics and path fields are retained."
+      }
+    };
+  } catch (error) {
+    return { content: `captureVisualState failed: ${toErrorMessage(error)}`, metadata: { ok: false } };
+  }
 }
 async function execShellTool(args2) {
   return invokeCapability(
@@ -22623,17 +22727,17 @@ function createDevinProvider(options) {
 }
 
 // packages/agent-runtime/executionLeaseValidation.ts
-import { isAbsolute as isAbsolute3, relative as relative4, resolve as resolve5 } from "node:path";
+import { isAbsolute as isAbsolute4, relative as relative5, resolve as resolve5 } from "node:path";
 function withinRoot(root, child) {
-  if (!isAbsolute3(root) || !isAbsolute3(child)) return false;
+  if (!isAbsolute4(root) || !isAbsolute4(child)) return false;
   const canonicalRoot = resolve5(root);
   const canonicalChild = resolve5(child);
-  const suffix = relative4(canonicalRoot, canonicalChild);
-  return suffix === "" || suffix !== ".." && !suffix.startsWith("../") && !suffix.startsWith("..\\") && !isAbsolute3(suffix);
+  const suffix = relative5(canonicalRoot, canonicalChild);
+  return suffix === "" || suffix !== ".." && !suffix.startsWith("../") && !suffix.startsWith("..\\") && !isAbsolute4(suffix);
 }
 function subsetOf(allowed, actual) {
   return actual.every(
-    (root) => isAbsolute3(root) && allowed.some((parent) => withinRoot(parent, root))
+    (root) => isAbsolute4(root) && allowed.some((parent) => withinRoot(parent, root))
   );
 }
 function validateConfiguredRootExecutionLease(ticket, lease) {

package/{chunk-EVW2U6RH.js → chunk-XOTLB33F.js}

@@ -1,7 +1,7 @@
 import {
   createCliLocalRuntimeAdapter,
   summarizeEndpoint
-} from "./chunk-2OWYKHKI.js";
+} from "./chunk-DRQTD2FX.js";
 import {
   t
 } from "./chunk-TDX2L4W2.js";
@@ -10,7 +10,7 @@ import {
 } from "./chunk-KXIJYPVC.js";
 import {
   runLocalAgentTurn
-} from "./chunk-IVPXG433.js";
+} from "./chunk-IFRQFQ2C.js";
 import {
   applyToolSurfaceConstraints
 } from "./chunk-2GRXE3YJ.js";