nolo-cli 0.173.0-alpha.3 → 0.175.0-alpha.1

package/{chunk-IVPXG433.js → chunk-FGSVT353.js}

@@ -15723,11 +15723,334 @@ async function invokeCapability(capabilityOrName, input, ctx = {}) {
 }
 
 // packages/agent-runtime/localWorkspaceTools.ts
-import { existsSync as existsSync4 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
 import { createHash as createHash4 } from "node:crypto";
-import { lstat, mkdir, readdir as readdir2, readFile as readFile3, realpath, stat as stat3, writeFile } from "node:fs/promises";
+
+// packages/agent-runtime/visualRenderer.node.ts
+import { createRequire } from "node:module";
+import { existsSync as existsSync4 } from "node:fs";
+import { mkdir, realpath, stat, readFile, writeFile } from "node:fs/promises";
+import { dirname as dirname2, isAbsolute as isAbsolute2, relative as relative2, win32 } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { lookup as lookup2 } from "node:dns/promises";
+import { isIP } from "node:net";
+function isVisualPathOutside(rel) {
+  return rel === ".." || /^\.\.[\\/]/.test(rel) || isAbsolute2(rel) || win32.isAbsolute(rel);
+}
+async function validateVisualUrl(input, workspaceRoot) {
+  const url = new URL(input);
+  if (url.protocol === "file:") {
+    const [root, path] = await Promise.all([realpath(workspaceRoot), realpath(fileURLToPath(url))]);
+    const rel = relative2(root, path);
+    if (isVisualPathOutside(rel)) throw new Error("Renderer file URL is outside workspaceRoot.");
+    if (!(await stat(path)).isFile()) throw new Error("Renderer file URL must point to a file, not a directory.");
+    return pathToFileURL(path);
+  }
+  if (!["http:", "https:"].includes(url.protocol)) throw new Error("Renderer URL must use http:, https:, or file:.");
+  await assertVisualNetworkHost(url.hostname);
+  return url;
+}
+async function assertVisualNetworkHost(host) {
+  const hostname = host.replace(/^\[|\]$/g, "");
+  const addresses = isIP(hostname) ? [{ address: hostname }] : await lookup2(hostname, { all: true });
+  for (const { address } of addresses) {
+    const normalized = new URL(`http://${address.includes(":") ? `[${address}]` : address}`).hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    const mapped = normalized.match(/^::ffff:([a-f0-9]+):([a-f0-9]+)$/);
+    const ipv4 = mapped ? `${parseInt(mapped[1], 16) >> 8}.${parseInt(mapped[1], 16) & 255}.${parseInt(mapped[2], 16) >> 8}.${parseInt(mapped[2], 16) & 255}` : normalized;
+    const octets = ipv4.split(".").map(Number);
+    if (ipv4.startsWith("169.254.") || normalized === "fd00:ec2::254" || /^fe[89ab][0-9a-f]:/.test(normalized) || ipv4 === "100.100.100.200") {
+      throw new Error(`Renderer denies metadata/link-local address: ${hostname}`);
+    }
+    const privateV4 = octets.length === 4 && (octets[0] === 10 || octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31 || octets[0] === 192 && octets[1] === 168 || octets[0] === 100 && octets[1] >= 64 && octets[1] <= 127);
+    const privateV6 = /^(fc|fd)[a-f0-9]{2}:/.test(normalized);
+    if ((privateV4 || privateV6) && process.env.NOLO_VISUAL_RENDERER_ALLOW_PRIVATE !== "1") {
+      throw new Error(`Renderer denies private address (LAN access requires NOLO_VISUAL_RENDERER_ALLOW_PRIVATE=1): ${hostname}`);
+    }
+    if (ipv4 === "0.0.0.0" || normalized === "::" || octets.length === 4 && octets[0] >= 224 || normalized.startsWith("ff")) {
+      throw new Error(`Renderer denies non-unicast address: ${hostname}`);
+    }
+  }
+}
+var VisualResourceError = class extends Error {
+  detectedAt = performance.now();
+};
+var VisualRenderSemaphore = class {
+  constructor(limit) {
+    this.limit = limit;
+  }
+  active = 0;
+  queue = [];
+  async run(task) {
+    if (this.active >= this.limit) await new Promise((resolve6) => this.queue.push(resolve6));
+    else this.active++;
+    try {
+      return await task();
+    } finally {
+      const next = this.queue.shift();
+      if (next) next();
+      else this.active--;
+    }
+  }
+};
+var configuredConcurrency = Number(process.env.NOLO_VISUAL_RENDERER_CONCURRENCY ?? 2);
+var renderSlots = new VisualRenderSemaphore(Number.isFinite(configuredConcurrency) ? Math.max(1, Math.min(2, Math.floor(configuredConcurrency))) : 2);
+var require2 = createRequire(import.meta.url);
+function visualRendererCapability() {
+  if (process.env.NOLO_VISUAL_RENDERER_DISABLED === "1") return { available: false, reason: "Platform renderer disabled by NOLO_VISUAL_RENDERER_DISABLED=1 on this runtime host." };
+  try {
+    const { chromium } = require2("playwright");
+    const executablePath = [chromium.executablePath(), resolveExecutableOnPath("google-chrome"), resolveExecutableOnPath("chromium"), resolveExecutableOnPath("chromium-browser")].find((path) => !!path && existsSync4(path));
+    if (!executablePath) return { available: false, reason: "No Chromium renderer installed. Install Playwright Chromium (playwright install chromium) or system Chromium/Google Chrome on the runtime host." };
+    return { available: true, chromium, executablePath };
+  } catch {
+    return { available: false, reason: "Platform renderer unavailable: install the platform Playwright dependency and Chromium on the runtime host (not a workspace npm script)." };
+  }
+}
+async function renderVisualPage(args2) {
+  const capability = visualRendererCapability();
+  if (!capability.available) throw new Error(capability.reason);
+  const url = await validateVisualUrl(args2.url, args2.workspaceRoot);
+  return renderSlots.run(async () => {
+    const timeout4 = Math.max(1, Math.min(args2.timeoutMs ?? 2e4, 2e4));
+    const deadline = Date.now() + timeout4;
+    const browser = await capability.chromium.launch({ executablePath: capability.executablePath, headless: true, timeout: timeout4 });
+    let timer;
+    try {
+      const page = await browser.newPage({ viewport: { width: 1440, height: 1e3 }, serviceWorkers: "block" });
+      const localOrigin = "https://nolo-workspace.invalid";
+      const localFile = url.protocol === "file:";
+      let routeError;
+      let rejectRoute;
+      const routeFailure = new Promise((_, reject) => {
+        rejectRoute = reject;
+      });
+      await page.route("**/*", async (route) => {
+        try {
+          const requestUrl = new URL(route.request().url());
+          if (localFile && requestUrl.origin === localOrigin) {
+            const file = await validateVisualUrl(`file://${requestUrl.pathname}`, args2.workspaceRoot);
+            const path = fileURLToPath(file);
+            const type = path.endsWith(".html") ? "text/html; charset=utf-8" : path.endsWith(".css") ? "text/css; charset=utf-8" : path.endsWith(".js") ? "application/javascript; charset=utf-8" : void 0;
+            await route.fulfill({ body: await readFile(path), ...type ? { contentType: type } : {} });
+          } else {
+            await validateVisualUrl(requestUrl.href, args2.workspaceRoot);
+            if (requestUrl.protocol === "file:") throw new Error("Direct file requests are forbidden.");
+            let next = requestUrl;
+            for (let hop = 0; ; hop++) {
+              await validateVisualUrl(next.href, args2.workspaceRoot);
+              const response = await route.fetch({ url: next.href, maxRedirects: 0, timeout: Math.max(1, deadline - Date.now()) });
+              const location = response.headers()["location"];
+              if ([301, 302, 303, 307, 308].includes(response.status()) && location) {
+                if (hop >= 10) throw new Error("Renderer redirect limit exceeded.");
+                next = new URL(location, next);
+                if (!["http:", "https:"].includes(next.protocol)) throw new Error("Renderer redirects must use http(s).");
+                continue;
+              }
+              await route.fulfill({ response });
+              break;
+            }
+          }
+        } catch (error) {
+          routeError = new VisualResourceError(error instanceof Error ? error.message : String(error));
+          const closing = page.close({ runBeforeUnload: false }).catch(() => {
+          });
+          rejectRoute(routeError);
+          await Promise.all([closing, route.abort().catch(() => {
+          })]);
+        }
+      });
+      const work = async () => {
+        page.setDefaultTimeout(timeout4);
+        await page.goto(localFile ? `${localOrigin}${url.pathname}` : url.href, { waitUntil: "load", timeout: timeout4 });
+        await page.locator(args2.waitSelector).first().waitFor({ state: "visible" });
+        if (args2.scrollSelector) await page.locator(args2.scrollSelector).first().scrollIntoViewIfNeeded();
+        const targetSelector = args2.focusSelector ?? args2.waitSelector;
+        await page.locator(targetSelector).first().scrollIntoViewIfNeeded();
+        if (args2.expectText) await page.getByText(args2.expectText, { exact: false }).first().waitFor({ state: "visible" });
+        const screenshot = await page.screenshot({ type: "png", timeout: timeout4 });
+        const metrics = await page.evaluate(({ waitSelector, scrollSelector, targetSelector: targetSelector2 }) => {
+          const target = document.querySelector(targetSelector2);
+          const rect = target.getBoundingClientRect();
+          const style = getComputedStyle(target);
+          return {
+            waitCount: document.querySelectorAll(waitSelector).length,
+            scrollCount: scrollSelector ? document.querySelectorAll(scrollSelector).length : null,
+            focusCount: document.querySelectorAll(targetSelector2).length,
+            targetText: target.textContent?.trim().slice(0, 240) ?? "",
+            targetRect: Object.fromEntries(["width", "height", "left", "right", "top", "bottom"].map((key) => [key, Math.round(rect[key])])),
+            targetComputed: Object.fromEntries(["display", "visibility", "opacity", "position", "width", "height", "pointerEvents"].map((key) => [key, style[key]])),
+            bodyTextSample: document.body.innerText.slice(0, 500)
+          };
+        }, { waitSelector: args2.waitSelector, scrollSelector: args2.scrollSelector, targetSelector });
+        if (routeError) throw routeError;
+        const result4 = { ...metrics, pageUrl: localFile ? url.href : page.url(), title: await page.title(), viewport: page.viewportSize(), renderer: "platform-playwright", capturedAt: (/* @__PURE__ */ new Date()).toISOString() };
+        if (Date.now() >= deadline) throw new Error("Renderer timed out before screenshot persistence.");
+        if (timer) clearTimeout(timer);
+        await mkdir(dirname2(args2.screenshotPath), { recursive: true });
+        await writeFile(args2.screenshotPath, screenshot);
+        return result4;
+      };
+      return await Promise.race([routeFailure, work(), new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`Renderer timed out after ${timeout4}ms.`)), Math.max(1, deadline - Date.now()));
+      })]);
+    } finally {
+      if (timer) clearTimeout(timer);
+      await browser.close();
+    }
+  });
+}
+
+// packages/agent-runtime/hostWindowCapture.ts
+import { spawn as spawn2 } from "node:child_process";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var HOST_CAPTURE_TIMEOUT_MS = 9e3;
+var UNAVAILABLE = "\u5F53\u524D\u73AF\u5883\u65E0\u53EF\u7528\u622A\u5C4F\u6743\u9650/\u670D\u52A1";
+var PORTAL_SCRIPT = String.raw`
+import json, signal
+from gi.repository import Gio, GLib
+bus = Gio.bus_get_sync(Gio.BusType.SESSION, None)
+loop = GLib.MainLoop()
+handle = None
+finished = False
+result = None
+responses = {}
+def response(conn, sender, path, interface, name, parameters, data):
+    global result, finished
+    responses[path] = parameters.unpack()
+    if handle == path:
+        result = responses[path]
+        finished = True
+        loop.quit()
+def stop(*args):
+    loop.quit()
+    return False
+subscription = bus.signal_subscribe('org.freedesktop.portal.Desktop', 'org.freedesktop.portal.Request', 'Response', None, None, Gio.DBusSignalFlags.NONE, response, None)
+signal.signal(signal.SIGTERM, stop)
+try:
+    options = {'interactive': GLib.Variant('b', True), 'handle_token': GLib.Variant('s', 'nolo_capture')}
+    handle = bus.call_sync('org.freedesktop.portal.Desktop', '/org/freedesktop/portal/desktop', 'org.freedesktop.portal.Screenshot', 'Screenshot', GLib.Variant('(sa{sv})', ('', options)), GLib.VariantType.new('(o)'), Gio.DBusCallFlags.NONE, 7000, None).unpack()[0]
+    if handle in responses:
+        result = responses[handle]
+        finished = True
+    else:
+        GLib.timeout_add(8000, stop)
+        loop.run()
+    if result is None:
+        print(json.dumps({'error': 'portal response timeout'}), flush=True)
+    else:
+        code, values = result
+        print(json.dumps({'code': code, 'uri': values.get('uri')}), flush=True)
+finally:
+    if handle and not finished:
+        try:
+            bus.call_sync('org.freedesktop.portal.Desktop', handle, 'org.freedesktop.portal.Request', 'Close', None, None, Gio.DBusCallFlags.NONE, 200, None)
+        except Exception:
+            pass
+    bus.signal_unsubscribe(subscription)
+`;
+var capturePortalScreenshot = (signal) => new Promise((resolve6, reject) => {
+  const child = spawn2("/usr/bin/python3", ["-c", PORTAL_SCRIPT], { stdio: ["ignore", "pipe", "pipe"] });
+  let stdout = "";
+  let stderr = "";
+  const stop = () => {
+    child.kill("SIGTERM");
+  };
+  signal.addEventListener("abort", stop, { once: true });
+  if (signal.aborted) stop();
+  child.stdout.on("data", (data) => {
+    stdout = (stdout + data).slice(-16384);
+  });
+  child.stderr.on("data", (data) => {
+    stderr = (stderr + data).slice(-4096);
+  });
+  child.once("error", reject);
+  child.once("close", (code) => {
+    signal.removeEventListener("abort", stop);
+    if (signal.aborted) return reject(new Error("portal capture timeout"));
+    if (code !== 0) return reject(new Error(stderr.trim() || `portal helper exited ${code}`));
+    try {
+      resolve6(JSON.parse(stdout));
+    } catch {
+      reject(new Error("invalid portal response"));
+    }
+  });
+});
+function createHostWindowCapture(options = {}) {
+  const concurrency = Math.max(1, Math.min(2, Math.floor(options.concurrency || 1)));
+  const timeoutMs = Math.max(1, Math.min(HOST_CAPTURE_TIMEOUT_MS, options.timeoutMs || HOST_CAPTURE_TIMEOUT_MS));
+  let active = 0;
+  const waiters = [];
+  function acquire(signal) {
+    return new Promise((resolve6, reject) => {
+      const abort = () => {
+        const index = waiters.indexOf(start);
+        if (index >= 0) waiters.splice(index, 1);
+        reject(new Error("portal capture timeout (queue)"));
+      };
+      const start = () => {
+        signal.removeEventListener("abort", abort);
+        active++;
+        resolve6();
+      };
+      if (signal.aborted) return abort();
+      if (active < concurrency) start();
+      else {
+        waiters.push(start);
+        signal.addEventListener("abort", abort, { once: true });
+      }
+    });
+  }
+  return async () => {
+    const controller = new AbortController();
+    let timer;
+    const work = async () => {
+      await acquire(controller.signal);
+      try {
+        const reply = await (options.portal ?? capturePortalScreenshot)(controller.signal);
+        if (controller.signal.aborted) throw new Error("portal capture timeout");
+        if (reply.error) throw new Error(reply.error);
+        if (reply.code !== 0) throw new Error(reply.code === 1 ? "portal denied/cancelled (Response 1)" : `portal failed (Response ${reply.code})`);
+        if (!reply.uri) throw new Error("portal returned no file URI");
+        const uri = new URL(reply.uri);
+        if (uri.protocol !== "file:" || uri.hostname && uri.hostname !== "localhost") throw new Error("portal returned a non-local file URI");
+        const path = fileURLToPath2(uri);
+        const image = await (options.readImage ?? readLocalImage)(path);
+        if (!image.images?.length) throw new Error("portal image could not be decoded");
+        const dimensions = /\[image (\d+x\d+) (\d+) bytes/.exec(image.content);
+        if (!dimensions) throw new Error("invalid image summary");
+        return {
+          ...image,
+          content: `[screenshot ${dimensions[1]} ${Math.round(Number(dimensions[2]) / 1024)}KB \u2192 ${path}]
+\u6765\u6E90\uFF1A\u5BBF\u4E3B portal \u5168\u5C4F/\u4EA4\u4E92\u9009\u62E9\u7ED3\u679C\uFF1Bportal \u672A\u63D0\u4F9B\u5E94\u7528/\u7A97\u53E3\u8EAB\u4EFD\uFF0C\u65E0\u6CD5\u786E\u8BA4\u7A97\u53E3\u540D\u3002`
+        };
+      } finally {
+        active--;
+        waiters.shift()?.();
+      }
+    };
+    try {
+      return await Promise.race([
+        work(),
+        new Promise((_, reject) => {
+          timer = setTimeout(() => {
+            controller.abort();
+            reject(new Error("portal capture timeout"));
+          }, timeoutMs);
+        })
+      ]);
+    } catch (error) {
+      return { content: `${UNAVAILABLE}\uFF1A${error instanceof Error ? error.message : String(error)}` };
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+}
+var captureHostWindow = createHostWindowCapture();
+
+// packages/agent-runtime/localWorkspaceTools.ts
+import { lstat, mkdir as mkdir2, readdir as readdir2, readFile as readFile4, realpath as realpath2, stat as stat4, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname as dirname2, isAbsolute as isAbsolute2, relative as relative3, resolve as resolve4, sep } from "node:path";
+import { dirname as dirname3, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve4, sep } from "node:path";
 import { spawn as spawnChildProcess3 } from "node:child_process";
 
 // packages/core/readRangeLedger.ts
@@ -15763,15 +16086,15 @@ function isLineRangeCovered(request3, covered) {
 }
 
 // packages/agent-runtime/fileTextSearch.ts
-import { readdir, readFile as readFile2, stat as stat2 } from "node:fs/promises";
-import { basename, relative as relative2, resolve as resolve3 } from "node:path";
+import { readdir, readFile as readFile3, stat as stat3 } from "node:fs/promises";
+import { basename, relative as relative3, resolve as resolve3 } from "node:path";
 import { spawn as spawnChildProcess2 } from "node:child_process";
 
 // packages/agent-runtime/gitignore.ts
-import { readFile, stat } from "node:fs/promises";
+import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
 import { resolve as resolve2 } from "node:path";
 async function readRootGitignorePatterns(workspaceRoot) {
-  const content = await readFile(resolve2(workspaceRoot, ".gitignore"), "utf8").catch(() => null);
+  const content = await readFile2(resolve2(workspaceRoot, ".gitignore"), "utf8").catch(() => null);
   if (content === null) return [];
   return content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#") && !line.startsWith("!")).flatMap((line) => {
     const unanchored = line.replace(/^\//, "");
@@ -15782,7 +16105,7 @@ async function readRootGitignorePatterns(workspaceRoot) {
 }
 async function hasRootGitignore(workspaceRoot) {
   try {
-    await stat(resolve2(workspaceRoot, ".gitignore"));
+    await stat2(resolve2(workspaceRoot, ".gitignore"));
     return true;
   } catch {
     return false;
@@ -15791,7 +16114,7 @@ async function hasRootGitignore(workspaceRoot) {
 
 // packages/agent-runtime/fileTextSearch.ts
 var normalizePath = (value) => value.replaceAll("\\", "/");
-var pathFor = (root, file, absolute = false) => absolute ? normalizePath(file) : normalizePath(relative2(root, file) || basename(file));
+var pathFor = (root, file, absolute = false) => absolute ? normalizePath(file) : normalizePath(relative3(root, file) || basename(file));
 var COMMAND_LIMIT_HEADROOM = 1;
 async function runCommand(binary, args2, cwd, maxResults) {
   const recordLimit = maxResults === void 0 ? 0 : Math.max(0, maxResults) + COMMAND_LIMIT_HEADROOM;
@@ -15851,7 +16174,7 @@ async function decorate(root, raw, context3, absolute = false) {
     let lines = cache.get(x.file);
     if (!lines) {
       try {
-        lines = (await readFile2(x.file, "utf8")).split(/\r\n|\r|\n/);
+        lines = (await readFile3(x.file, "utf8")).split(/\r\n|\r|\n/);
       } catch {
         continue;
       }
@@ -15880,13 +16203,13 @@ function globMatch(pattern, value) {
   const r = new RegExp(`^${source}$`);
   return r.test(value) || r.test(basename(value));
 }
-var defaultReadTextFile = (filePath) => readFile2(filePath, "utf8").catch(() => "");
+var defaultReadTextFile = (filePath) => readFile3(filePath, "utf8").catch(() => "");
 async function jsSearch(o, targetPath) {
   const max4 = o.maxResults ?? Number.MAX_SAFE_INTEGER;
   const excludes = o.exclude ?? [];
   const readText = o.readTextFile ?? defaultReadTextFile;
   const files = [];
-  const targetStat = await stat2(targetPath).catch(() => null);
+  const targetStat = await stat3(targetPath).catch(() => null);
   if (!targetStat) return { matches: [], totalMatches: 0, truncated: false, engine: "js" };
   const ignorePatterns = o.includeIgnored ? [] : await readRootGitignorePatterns(o.root);
   const isIgnored = (rel) => ignorePatterns.some((pattern) => globMatch(pattern, rel));
@@ -15932,7 +16255,7 @@ var COMMAND_ENGINES = [
 ];
 async function searchFileTextMatches(o) {
   const targetPath = resolve3(o.root, o.target || ".");
-  const targetStat = await stat2(targetPath).catch(() => null);
+  const targetStat = await stat3(targetPath).catch(() => null);
   if (!targetStat) return { matches: [], totalMatches: 0, truncated: false, engine: "js" };
   if (targetStat.isFile()) return jsSearch(o, targetPath);
   const run2 = o.runCommand ?? runCommand, max4 = o.maxResults;
@@ -16241,6 +16564,7 @@ function runTasks(args2) {
 var WORKSPACE_TOOL_NAMES = [
   "readFile",
   "read_image",
+  "captureHostWindow",
   "writeFile",
   "editFile",
   "globFiles",
@@ -16397,7 +16721,7 @@ function buildCaptureVisualStateTool() {
     type: "function",
     function: {
       name: "captureVisualState",
-      description: "Capture a real local app screenshot and DOM/computed-style metrics for a selected UI state.",
+      description: "Render a URL to an image and DOM/computed-style metrics using platform Playwright/Chromium on the runtime host. Requires an installed renderer; never runs workspace scripts.",
       parameters: {
         type: "object",
         properties: {
@@ -16546,6 +16870,16 @@ function buildTaskStopTool() {
   };
 }
 function buildWorkspaceToolDefinition(toolName) {
+  if (toolName === "captureHostWindow") {
+    return {
+      type: "function",
+      function: {
+        name: "captureHostWindow",
+        description: "Capture the host desktop through the Screenshot portal (interactive permission/selection may appear). Returns an image or a fail-closed reason within 9s. Portal does not identify the application/window: never infer a window name. Linux host requires /usr/bin/python3 with Gio. No arguments.",
+        parameters: { type: "object", properties: {}, additionalProperties: false }
+      }
+    };
+  }
   if (toolName === "read_image") {
     return {
       type: "function",
@@ -16668,6 +17002,7 @@ function buildLocalWorkspaceOpenAiTools(args2) {
   const declaredTools = new Set(args2.toolNames ?? []);
   return WORKSPACE_TOOL_NAMES.filter((toolName) => {
     if (!declaredTools.has(toolName)) return false;
+    if (toolName === "captureVisualState" && !visualRendererCapability().available) return false;
     if (!args2.exposeShellTools && SHELL_TOOL_NAMES.includes(toolName)) {
       return false;
     }
@@ -16682,11 +17017,11 @@ function parseWorkspaceToolArguments(raw) {
   }
 }
 function normalizeWorkspaceRelativePath(args2) {
-  const relativePath = relative3(args2.workspaceRoot, args2.targetPath);
+  const relativePath = relative4(args2.workspaceRoot, args2.targetPath);
   return relativePath || ".";
 }
 function isPathInsideWorkspace(args2) {
-  const relativePath = relative3(args2.workspaceRoot, args2.targetPath);
+  const relativePath = relative4(args2.workspaceRoot, args2.targetPath);
   return relativePath === "" || !relativePath.startsWith("..") && !relativePath.includes(`..${sep}`);
 }
 var PATH_FIELD_ALIASES = ["path", "file_path", "filePath", "filename", "file", "target_file", "targetFile", "file_to_read", "fileToRead", "target_path", "read_path", "path_to_read", "pathToRead"];
@@ -16950,77 +17285,11 @@ function readVisualStateCaptureArgs(args2) {
     metricsPath
   };
 }
-async function readWorkspacePackageScripts(workspaceRoot) {
-  try {
-    const raw = await readFile3(resolve4(workspaceRoot, "package.json"), "utf8");
-    const parsed = JSON.parse(raw);
-    const scripts = parsed && typeof parsed === "object" && parsed.scripts && typeof parsed.scripts === "object" ? Object.keys(parsed.scripts).sort() : [];
-    return { scripts };
-  } catch (error) {
-    return {
-      scripts: [],
-      error: toErrorMessage(error)
-    };
-  }
-}
-function formatAvailableScripts(scripts) {
-  return scripts.length ? scripts.join(", ") : "(none)";
-}
-async function runWorkspacePackageScript(args2) {
-  const script = args2.script.trim();
-  if (!script) throw new Error("package script name is required.");
-  const extraArgs = args2.extraArgs ?? [];
-  const packageScripts = await readWorkspacePackageScripts(args2.workspaceRoot);
-  if (!packageScripts.scripts.includes(script)) {
-    return {
-      content: [
-        `script not found: ${script}`,
-        `available scripts: ${formatAvailableScripts(packageScripts.scripts)}`,
-        ...packageScripts.error ? [`package.json read error: ${packageScripts.error}`] : []
-      ].join("\n"),
-      metadata: {
-        script,
-        exitCode: 1,
-        reason: "script-not-found",
-        availableScripts: packageScripts.scripts,
-        ...packageScripts.error ? { packageJsonError: packageScripts.error } : {}
-      }
-    };
-  }
-  const result4 = await runWorkspaceCommand({
-    workspaceRoot: args2.workspaceRoot,
-    command: ["bun", "run", script, ...extraArgs.length ? ["--", ...extraArgs] : []],
-    timeoutMs: args2.commandTimeoutMs
-  });
-  return {
-    content: result4.content,
-    metadata: {
-      script,
-      args: extraArgs,
-      exitCode: result4.exitCode,
-      reason: result4.exitCode === 0 ? "ok" : "script-failed",
-      timedOut: result4.timedOut,
-      stdoutTail: result4.stdout.trim().slice(-4e3),
-      stderrTail: result4.stderr.trim().slice(-4e3)
-    }
-  };
-}
-function parseLastJsonObject(text2) {
-  const trimmed = text2.trim();
-  for (let index = trimmed.lastIndexOf("{"); index >= 0; index = trimmed.lastIndexOf("{", index - 1)) {
-    try {
-      const parsed = JSON.parse(trimmed.slice(index));
-      return parsed && typeof parsed === "object" ? parsed : null;
-    } catch {
-    }
-  }
-  return null;
-}
 function resolveRipgrepBinary(env = process.env) {
   const fromEnv = asOptionalTrimmedString(env.NOLO_BUNDLED_RG);
   if (fromEnv) {
     try {
-      if (existsSync4(fromEnv)) return fromEnv;
+      if (existsSync5(fromEnv)) return fromEnv;
     } catch {
     }
   }
@@ -17028,8 +17297,8 @@ function resolveRipgrepBinary(env = process.env) {
 }
 var SEARCH_OUTPUT_CHAR_LIMIT = 2e4;
 function isPathInsideRoot(root, targetPath) {
-  const rel = relative3(resolve4(root), resolve4(targetPath));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute2(rel);
+  const rel = relative4(resolve4(root), resolve4(targetPath));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute3(rel);
 }
 async function resolveRuntimeOwnedSpillPath(targetPath) {
   const spillRoot = resolveNoloStateDir("spills");
@@ -17037,7 +17306,7 @@ async function resolveRuntimeOwnedSpillPath(targetPath) {
   const rootStat = await lstat(spillRoot).catch(() => void 0);
   if (rootStat?.isDirectory() !== true) return null;
   try {
-    const [realRoot, realTarget] = await Promise.all([realpath(spillRoot), realpath(targetPath)]);
+    const [realRoot, realTarget] = await Promise.all([realpath2(spillRoot), realpath2(targetPath)]);
     return isPathInsideRoot(realRoot, realTarget) ? realTarget : null;
   } catch {
     return null;
@@ -17137,7 +17406,7 @@ async function readFileTool(args2) {
     allowRuntimeOwnedSpill: true,
     ...args2.confirmExternalFileAccess ? { confirmExternalFileAccess: args2.confirmExternalFileAccess } : {}
   });
-  const content = await readFile3(absolutePath, "utf8");
+  const content = await readFile4(absolutePath, "utf8");
   const activity = extractActivity(parsed);
   const sliced = sliceReadFileContent({
     content,
@@ -17221,8 +17490,8 @@ async function writeFileTool(args2) {
     requestedPath,
     ...args2.confirmExternalFileAccess ? { confirmExternalFileAccess: args2.confirmExternalFileAccess } : {}
   });
-  await mkdir(dirname2(absolutePath), { recursive: true });
-  await writeFile(absolutePath, content, "utf8");
+  await mkdir2(dirname3(absolutePath), { recursive: true });
+  await writeFile2(absolutePath, content, "utf8");
   const relativePath = normalizeWorkspaceRelativePath({
     workspaceRoot: resolve4(args2.workspaceRoot),
     targetPath: absolutePath
@@ -17330,7 +17599,7 @@ async function editFileTool(args2) {
     requestedPath,
     ...args2.confirmExternalFileAccess ? { confirmExternalFileAccess: args2.confirmExternalFileAccess } : {}
   });
-  const content = await readFile3(absolutePath, "utf8");
+  const content = await readFile4(absolutePath, "utf8");
   const { count: replacementCount, result: nextContent } = countAndReplaceEolTolerant({
     content,
     oldText,
@@ -17344,7 +17613,7 @@ async function editFileTool(args2) {
 ${hint}` : "")
     );
   }
-  await writeFile(absolutePath, nextContent, "utf8");
+  await writeFile2(absolutePath, nextContent, "utf8");
   const relativePath = normalizeWorkspaceRelativePath({
     workspaceRoot: resolve4(args2.workspaceRoot),
     targetPath: absolutePath
@@ -17387,8 +17656,8 @@ async function listWorkspaceEntries(args2) {
     for (const name of names) {
       if (truncated) break;
       const absolutePath = resolve4(dirPath, name);
-      const info = await stat3(absolutePath);
-      const relativePath = relative3(args2.dirPath, absolutePath) || ".";
+      const info = await stat4(absolutePath);
+      const relativePath = relative4(args2.dirPath, absolutePath) || ".";
       const isDirectory = info.isDirectory();
       entries.push(isDirectory ? `${relativePath}/` : relativePath);
       if (args2.maxResults && entries.length >= args2.maxResults) {
@@ -17600,59 +17869,52 @@ async function resolveVisualStateBaseUrl(args2) {
   return DEFAULT_LOCAL_API_ORIGIN;
 }
 async function captureVisualStateTool(args2) {
-  const parsed = parseWorkspaceToolArguments(args2.call.arguments);
-  const captureArgs = readVisualStateCaptureArgs(parsed);
-  const baseUrl = await resolveVisualStateBaseUrl({
-    explicitBaseUrl: captureArgs.baseUrl
-  });
-  const extraArgs = [
-    "--base",
-    baseUrl,
-    "--path",
-    captureArgs.path,
-    "--wait-selector",
-    captureArgs.waitSelector,
-    ...captureArgs.scrollSelector ? ["--scroll-selector", captureArgs.scrollSelector] : [],
-    ...captureArgs.focusSelector ? ["--focus-selector", captureArgs.focusSelector] : [],
-    ...captureArgs.expectText ? ["--expect-text", captureArgs.expectText] : [],
-    "--screenshot",
-    captureArgs.screenshotPath,
-    "--metrics",
-    captureArgs.metricsPath
-  ];
-  const result4 = await runWorkspacePackageScript({
-    workspaceRoot: args2.workspaceRoot,
-    script: "probe:visual-review",
-    extraArgs,
-    commandTimeoutMs: args2.commandTimeoutMs
-  });
-  const metrics = parseLastJsonObject(String(result4.metadata?.stdoutTail ?? result4.content));
-  return {
-    content: [
-      `pageUrl: ${typeof metrics?.pageUrl === "string" ? metrics.pageUrl : ""}`,
-      `screenshotPath: ${captureArgs.screenshotPath}`,
-      `metricsPath: ${captureArgs.metricsPath}`,
-      `waitSelector: ${captureArgs.waitSelector}`,
-      ...captureArgs.focusSelector ? [`focusSelector: ${captureArgs.focusSelector}`] : [],
-      ...captureArgs.expectText ? [`expectText: ${captureArgs.expectText}`] : [],
-      "",
-      result4.content
-    ].join("\n").trim(),
-    metadata: {
-      ...result4.metadata,
-      script: "probe:visual-review",
-      args: extraArgs,
-      baseUrl,
-      path: captureArgs.path,
-      waitSelector: captureArgs.waitSelector,
-      scrollSelector: captureArgs.scrollSelector,
-      focusSelector: captureArgs.focusSelector,
-      expectText: captureArgs.expectText,
-      screenshotPath: captureArgs.screenshotPath,
-      metricsPath: captureArgs.metricsPath,
-      ...metrics ?? {}
-    }
-  };
+  try {
+    const parsed = parseWorkspaceToolArguments(args2.call.arguments);
+    const captureArgs = readVisualStateCaptureArgs(parsed);
+    const capability = visualRendererCapability();
+    if (!capability.available) return { content: `captureVisualState unavailable: ${capability.reason}`, metadata: { ok: false, rendererAvailable: false } };
+    const baseUrl = await resolveVisualStateBaseUrl({ explicitBaseUrl: captureArgs.baseUrl });
+    const pageUrl = new URL(captureArgs.path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`).href;
+    const screenshotPath = resolveRequestedWorkspacePath(args2.workspaceRoot, captureArgs.screenshotPath);
+    const metricsPath = resolveRequestedWorkspacePath(args2.workspaceRoot, captureArgs.metricsPath);
+    const rendered = await renderVisualPage({ ...captureArgs, workspaceRoot: args2.workspaceRoot, url: pageUrl, screenshotPath, timeoutMs: args2.commandTimeoutMs });
+    const metrics = {
+      ...captureArgs,
+      ...rendered,
+      scrollSelector: captureArgs.scrollSelector ?? null,
+      focusSelector: captureArgs.focusSelector ?? null,
+      expectText: captureArgs.expectText ?? null
+    };
+    await mkdir2(dirname3(metricsPath), { recursive: true });
+    await writeFile2(metricsPath, JSON.stringify(metrics, null, 2));
+    const image = await readLocalImage(screenshotPath);
+    return {
+      content: [
+        `pageUrl: ${metrics.pageUrl}`,
+        `screenshotPath: ${captureArgs.screenshotPath}`,
+        `metricsPath: ${captureArgs.metricsPath}`,
+        `waitSelector: ${captureArgs.waitSelector}`,
+        ...captureArgs.focusSelector ? [`focusSelector: ${captureArgs.focusSelector}`] : [],
+        ...captureArgs.expectText ? [`expectText: ${captureArgs.expectText}`] : [],
+        image.content.replace("[image ", "[screenshot ").replace(/(\d+) bytes/, (_, bytes) => `${Math.ceil(Number(bytes) / 1024)}KB`)
+      ].join("\n"),
+      images: image.images,
+      metadata: {
+        ...captureArgs,
+        ...metrics,
+        ok: true,
+        exitCode: 0,
+        baseUrl,
+        script: null,
+        args: [],
+        compatibilityVersion: 2,
+        compatibilityNote: "Platform rendering replaces workspace scripts; script/args/stdoutTail no longer describe a subprocess. Existing page metrics and path fields are retained."
+      }
+    };
+  } catch (error) {
+    return { content: `captureVisualState failed: ${toErrorMessage(error)}`, metadata: { ok: false } };
+  }
 }
 async function execShellTool(args2) {
   return invokeCapability(
@@ -18023,6 +18285,16 @@ function createLocalWorkspaceToolExecutors(args2) {
       ...fileAccess,
       ...args2.resolveRipgrepBinary ? { resolveRipgrepBinary: args2.resolveRipgrepBinary } : {}
     }),
+    captureHostWindow: async (call) => {
+      let parsed;
+      try {
+        parsed = JSON.parse(call.arguments || "{}");
+      } catch {
+        return { content: "captureHostWindow accepts an empty JSON object" };
+      }
+      if (!isRecord(parsed) || Object.keys(parsed).length) return { content: "captureHostWindow accepts no arguments" };
+      return captureHostWindow();
+    },
     read_image: async (call) => {
       const parsed = parseWorkspaceToolArguments(call.arguments);
       if (Object.keys(parsed).some((key) => key !== "path")) throw new Error("read_image accepts exactly one path");
@@ -21893,11 +22165,11 @@ async function readNoloProcessStream(readable) {
 async function runNoloWorkspaceCliTool(call, args2) {
   const cliArgs = buildNoloWorkspaceCommandArgs(call);
   const bunSpawn = globalThis.Bun?.spawn;
-  const spawn2 = args2.spawn ?? (typeof bunSpawn === "function" ? bunSpawn : nodeSpawnFallback);
+  const spawn3 = args2.spawn ?? (typeof bunSpawn === "function" ? bunSpawn : nodeSpawnFallback);
   const execPath = args2.processExecPath ?? process.execPath;
   const entrypoint = args2.cliEntrypoint;
   const cmd = entrypoint && entrypoint !== execPath ? [execPath, entrypoint, ...cliArgs] : [execPath, ...cliArgs];
-  const proc = spawn2({
+  const proc = spawn3({
     cmd,
     stdout: "pipe",
     stderr: "pipe",
@@ -22623,17 +22895,17 @@ function createDevinProvider(options) {
 }
 
 // packages/agent-runtime/executionLeaseValidation.ts
-import { isAbsolute as isAbsolute3, relative as relative4, resolve as resolve5 } from "node:path";
+import { isAbsolute as isAbsolute4, relative as relative5, resolve as resolve5 } from "node:path";
 function withinRoot(root, child) {
-  if (!isAbsolute3(root) || !isAbsolute3(child)) return false;
+  if (!isAbsolute4(root) || !isAbsolute4(child)) return false;
   const canonicalRoot = resolve5(root);
   const canonicalChild = resolve5(child);
-  const suffix = relative4(canonicalRoot, canonicalChild);
-  return suffix === "" || suffix !== ".." && !suffix.startsWith("../") && !suffix.startsWith("..\\") && !isAbsolute3(suffix);
+  const suffix = relative5(canonicalRoot, canonicalChild);
+  return suffix === "" || suffix !== ".." && !suffix.startsWith("../") && !suffix.startsWith("..\\") && !isAbsolute4(suffix);
 }
 function subsetOf(allowed, actual) {
   return actual.every(
-    (root) => isAbsolute3(root) && allowed.some((parent) => withinRoot(parent, root))
+    (root) => isAbsolute4(root) && allowed.some((parent) => withinRoot(parent, root))
   );
 }
 function validateConfiguredRootExecutionLease(ticket, lease) {