nolo-cli 0.185.0-alpha.3 → 0.186.0-alpha.1

package/{chunk-IOQHM7ID.js → chunk-4ALQFIFF.js}

@@ -185,7 +185,7 @@ import {
 } from "./chunk-ZWQUWF6W.js";
 import {
   buildDialogSummaryLayer
-} from "./chunk-VEA7H5FG.js";
+} from "./chunk-Q6RMLYSA.js";
 import {
   buildUserResponseLanguageContext
 } from "./chunk-4VJAC32I.js";
@@ -5222,8 +5222,8 @@ var runPromiseExitWith = (context3) => {
   const runFork3 = runForkWith(context3);
   return (effect, options) => {
     const fiber3 = runFork3(effect, options);
-    return new Promise((resolve6) => {
-      fiber3.addObserver((exit3) => resolve6(exit3));
+    return new Promise((resolve7) => {
+      fiber3.addObserver((exit3) => resolve7(exit3));
     });
   };
 };
@@ -5340,8 +5340,8 @@ var Latch = class {
     return this._isOpen;
   }
 };
-var makeLatchUnsafe = (open) => new Latch(open ?? false);
-var makeLatch = (open) => sync(() => makeLatchUnsafe(open));
+var makeLatchUnsafe = (open2) => new Latch(open2 ?? false);
+var makeLatch = (open2) => sync(() => makeLatchUnsafe(open2));
 var tracer = /* @__PURE__ */ withFiber((fiber3) => succeed3(fiber3.getRef(Tracer)));
 var withTracer = /* @__PURE__ */ dual(2, (effect, tracer3) => provideService(effect, Tracer, tracer3));
 var withTracerEnabled = /* @__PURE__ */ provideService(TracerEnabled);
@@ -12209,8 +12209,8 @@ var toReadableStreamWith = /* @__PURE__ */ dual((args2) => isStream(args2[0]), (
       });
     },
     pull() {
-      return new Promise((resolve6) => {
-        currentResolve = resolve6;
+      return new Promise((resolve7) => {
+        currentResolve = resolve7;
         latch.openUnsafe();
       });
     },
@@ -12357,16 +12357,79 @@ function runAbortableWithTimeout(args2) {
 
 // packages/agent-runtime/observationStream.ts
 var DEFAULT_OBSERVATION_QUEUE_CAPACITY = 1024;
+var DEFAULT_OBSERVATION_QUEUE_BYTE_CAPACITY = 2 * 1024 * 1024;
+var OBSERVATION_EVENT_BYTE_FALLBACK = 1024;
+var UTF8_ENCODER = typeof TextEncoder !== "undefined" ? new TextEncoder() : void 0;
+var observeByteLength = (text2) => {
+  const nodeBuffer = globalThis.Buffer;
+  if (typeof nodeBuffer?.byteLength === "function") {
+    return nodeBuffer.byteLength(text2, "utf8");
+  }
+  if (UTF8_ENCODER) {
+    return UTF8_ENCODER.encode(text2).byteLength;
+  }
+  return text2.length;
+};
+var measureObservationEventBytes = (event) => {
+  try {
+    const serialized = JSON.stringify(event);
+    return typeof serialized === "string" ? observeByteLength(serialized) : OBSERVATION_EVENT_BYTE_FALLBACK;
+  } catch {
+    return OBSERVATION_EVENT_BYTE_FALLBACK;
+  }
+};
+var resolveByteCapacity = (raw) => {
+  if (raw === null) return null;
+  if (raw === void 0) return DEFAULT_OBSERVATION_QUEUE_BYTE_CAPACITY;
+  if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) {
+    return DEFAULT_OBSERVATION_QUEUE_BYTE_CAPACITY;
+  }
+  return Math.floor(raw);
+};
 function createLocalLoopObservationBoundary(initialCallbacks, options) {
   const rawCapacity = options?.capacity;
   const capacity = typeof rawCapacity === "number" && Number.isFinite(rawCapacity) && rawCapacity >= 1 ? Math.floor(rawCapacity) : DEFAULT_OBSERVATION_QUEUE_CAPACITY;
   const strategy = options?.strategy ?? "sliding";
+  const byteCapacity = strategy === "unbounded" ? null : resolveByteCapacity(options?.byteCapacity);
+  const byteBudgetEnabled = byteCapacity !== null;
   let queue;
   let cachedStream;
   let closed = false;
   let totalEmitted = 0;
   let dropped = 0;
   let peakSize = 0;
+  const shadowSizes = [];
+  let shadowHead = 0;
+  let bufferedBytes = 0;
+  let peakBytes = 0;
+  let droppedByBytesCount = 0;
+  const shadowLength = () => shadowSizes.length - shadowHead;
+  const compactShadow = () => {
+    if (shadowHead > 0 && shadowHead * 2 >= shadowSizes.length) {
+      shadowSizes.splice(0, shadowHead);
+      shadowHead = 0;
+    }
+  };
+  const syncShadow = (activeQueue) => {
+    const liveSize = Queue_exports.sizeUnsafe(activeQueue);
+    while (shadowLength() > liveSize) {
+      bufferedBytes -= shadowSizes[shadowHead++] ?? 0;
+    }
+    if (bufferedBytes < 0) bufferedBytes = 0;
+    compactShadow();
+    return liveSize;
+  };
+  const evictOldestForBytes = (activeQueue, incomingBytes) => {
+    if (byteCapacity === null) return;
+    while (shadowLength() > 0 && bufferedBytes + incomingBytes > byteCapacity) {
+      const taken = Queue_exports.takeUnsafe(activeQueue);
+      if (taken === void 0 || !Exit_exports.isSuccess(taken)) break;
+      bufferedBytes -= shadowSizes[shadowHead++] ?? 0;
+      droppedByBytesCount++;
+    }
+    if (bufferedBytes < 0) bufferedBytes = 0;
+    compactShadow();
+  };
   const callbackList = [];
   if (initialCallbacks) {
     callbackList.push(initialCallbacks);
@@ -12395,13 +12458,27 @@ function createLocalLoopObservationBoundary(initialCallbacks, options) {
     const envelope = "event" in envelopeOrEvent && typeof envelopeOrEvent.event === "object" && envelopeOrEvent.event !== null && "kind" in envelopeOrEvent.event ? envelopeOrEvent : { event: envelopeOrEvent };
     const { event, bridge } = envelope;
     if (queue) {
-      const preSize = Queue_exports.sizeUnsafe(queue) ?? 0;
-      const offered = Queue_exports.offerUnsafe(queue, event);
-      if (strategy === "dropping" && !offered) {
+      const eventBytes = byteBudgetEnabled ? measureObservationEventBytes(event) : 0;
+      const liveSize = syncShadow(queue);
+      const rejectedByBytes = strategy === "dropping" && liveSize > 0 && byteCapacity !== null ? bufferedBytes + eventBytes > byteCapacity : false;
+      if (strategy === "sliding" && byteBudgetEnabled) {
+        evictOldestForBytes(queue, eventBytes);
+      }
+      const preSize = Queue_exports.sizeUnsafe(queue);
+      const offered = rejectedByBytes ? false : Queue_exports.offerUnsafe(queue, event);
+      if (offered) {
+        shadowSizes.push(eventBytes);
+        bufferedBytes += eventBytes;
+        if (bufferedBytes > peakBytes) peakBytes = bufferedBytes;
+      }
+      if (rejectedByBytes) {
+        droppedByBytesCount++;
+      } else if (strategy === "dropping" && !offered) {
         dropped++;
       } else if (strategy === "sliding" && preSize >= capacity && offered) {
         dropped++;
       }
+      syncShadow(queue);
       const postSize = Queue_exports.sizeUnsafe(queue) ?? 0;
       if (postSize > peakSize) {
         peakSize = postSize;
@@ -12444,9 +12521,10 @@ function createLocalLoopObservationBoundary(initialCallbacks, options) {
   const close2 = () => {
     if (closed) return;
     closed = true;
-    if (dropped > 0) {
+    const totalDropped = dropped + droppedByBytesCount;
+    if (totalDropped > 0) {
       console.warn(
-        `[observationStream] stream buffer overflow: dropped ${dropped}/${totalEmitted} events (strategy=${strategy}, capacity=${capacity})`
+        `[observationStream] stream buffer overflow: dropped ${totalDropped}/${totalEmitted} events (strategy=${strategy}, capacity=${capacity}, byteCapacity=${byteCapacity ?? "off"}, droppedByCount=${dropped}, droppedByBytes=${droppedByBytesCount}, peakBytes=${peakBytes})`
       );
     }
     if (queue) {
@@ -12463,14 +12541,26 @@ function createLocalLoopObservationBoundary(initialCallbacks, options) {
     if (!queue) return 0;
     return Queue_exports.sizeUnsafe(queue) ?? 0;
   };
-  const droppedCount = () => dropped;
+  const droppedCount = () => dropped + droppedByBytesCount;
+  const bufferedBytesOfQueue = () => {
+    if (!queue) return 0;
+    syncShadow(queue);
+    return bufferedBytes;
+  };
+  const droppedByBytes = () => droppedByBytesCount;
   const getMetrics = () => ({
     totalEmitted,
-    droppedCount: dropped,
+    droppedCount: dropped + droppedByBytesCount,
     peakSize,
     capacity,
     strategy
   });
+  const getByteMetrics = () => ({
+    byteCapacity,
+    bufferedBytes: bufferedBytesOfQueue(),
+    peakBytes,
+    droppedByBytes: droppedByBytesCount
+  });
   return {
     get queue() {
       return getOrCreateQueue();
@@ -12487,8 +12577,11 @@ function createLocalLoopObservationBoundary(initialCallbacks, options) {
     attachCallbacks,
     isQueueActive,
     queueSize,
+    bufferedBytes: bufferedBytesOfQueue,
     droppedCount,
-    getMetrics
+    droppedByBytes,
+    getMetrics,
+    getByteMetrics
   };
 }
 
@@ -12864,6 +12957,144 @@ function scrubObjectSecrets(val) {
   return val;
 }
 
+// packages/agent-runtime/toolOutputSanitizer.ts
+var SANITIZE_REPLACEMENT_CHAR = "\uFFFD";
+var MAX_CONTROL_SEQUENCE_CHARS = 256;
+var ESC = 27;
+var BEL = 7;
+var LINE_FEED = 10;
+var TAB = 9;
+var DEL = 127;
+var C1_DCS = 144;
+var C1_SOS = 152;
+var C1_CSI = 155;
+var C1_ST = 156;
+var C1_OSC = 157;
+var C1_PM = 158;
+var C1_APC = 159;
+var HIGH_SURROGATE_MIN = 55296;
+var HIGH_SURROGATE_MAX = 56319;
+var LOW_SURROGATE_MIN = 56320;
+var LOW_SURROGATE_MAX = 57343;
+var NEEDS_SANITIZE_RE = new RegExp("[\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f]|\\p{Cs}", "u");
+function isC1Introducer(code) {
+  return code === C1_CSI || code === C1_OSC || code === C1_DCS || code === C1_SOS || code === C1_PM || code === C1_APC;
+}
+var UNTERMINATED_SEQUENCE = -1;
+function skipCsiBody(text2, start, limit) {
+  let i = start;
+  while (i < limit) {
+    const code = text2.charCodeAt(i);
+    if (code >= 64 && code <= 126) return i + 1;
+    if (code >= 32 && code <= 63) {
+      i += 1;
+      continue;
+    }
+    return i;
+  }
+  return UNTERMINATED_SEQUENCE;
+}
+function skipControlStringBody(text2, start, limit) {
+  const length = text2.length;
+  let i = start;
+  while (i < limit) {
+    const code = text2.charCodeAt(i);
+    if (code === BEL || code === C1_ST) return i + 1;
+    if (code === ESC && i + 1 < length && text2.charCodeAt(i + 1) === 92) {
+      return Math.min(i + 2, limit);
+    }
+    i += 1;
+  }
+  return UNTERMINATED_SEQUENCE;
+}
+function skipEscapeSequence(text2, escIndex) {
+  const length = text2.length;
+  const limit = Math.min(length, escIndex + MAX_CONTROL_SEQUENCE_CHARS);
+  const leadIndex = escIndex + 1;
+  if (leadIndex >= length) return leadIndex;
+  const lead = text2.charCodeAt(leadIndex);
+  if (lead === 91) {
+    const csiEnd = skipCsiBody(text2, leadIndex + 1, limit);
+    return csiEnd === UNTERMINATED_SEQUENCE ? escIndex + 1 : csiEnd;
+  }
+  if (lead === 93 || lead === 80 || lead === 88 || lead === 94 || lead === 95) {
+    const stringEnd = skipControlStringBody(text2, leadIndex + 1, limit);
+    return stringEnd === UNTERMINATED_SEQUENCE ? escIndex + 1 : stringEnd;
+  }
+  let j = leadIndex;
+  while (j < limit && text2.charCodeAt(j) >= 32 && text2.charCodeAt(j) <= 47) {
+    j += 1;
+  }
+  if (j < limit) {
+    const final = text2.charCodeAt(j);
+    if (final >= 48 && final <= 126) return j + 1;
+  }
+  return escIndex + 1;
+}
+function skipC1Sequence(text2, index) {
+  const limit = Math.min(text2.length, index + MAX_CONTROL_SEQUENCE_CHARS);
+  const code = text2.charCodeAt(index);
+  const bodyEnd = code === C1_CSI ? skipCsiBody(text2, index + 1, limit) : skipControlStringBody(text2, index + 1, limit);
+  return bodyEnd === UNTERMINATED_SEQUENCE ? index + 1 : bodyEnd;
+}
+function sanitizeToolOutputText(text2) {
+  if (typeof text2 !== "string" || text2.length === 0) return text2;
+  if (!NEEDS_SANITIZE_RE.test(text2)) return text2;
+  const out = [];
+  const length = text2.length;
+  let plainStart = 0;
+  let i = 0;
+  const dropRange = (end3) => {
+    if (plainStart < i) out.push(text2.slice(plainStart, i));
+    i = end3;
+    plainStart = end3;
+  };
+  while (i < length) {
+    const code = text2.charCodeAt(i);
+    if (code === LINE_FEED || code === TAB) {
+      i += 1;
+      continue;
+    }
+    if (code === ESC) {
+      dropRange(skipEscapeSequence(text2, i));
+      continue;
+    }
+    if (isC1Introducer(code)) {
+      dropRange(skipC1Sequence(text2, i));
+      continue;
+    }
+    if (code < 32 || code === DEL || code >= 128 && code <= 159) {
+      dropRange(i + 1);
+      continue;
+    }
+    if (code >= HIGH_SURROGATE_MIN && code <= HIGH_SURROGATE_MAX) {
+      const low = text2.charCodeAt(i + 1);
+      if (low >= LOW_SURROGATE_MIN && low <= LOW_SURROGATE_MAX) {
+        i += 2;
+        continue;
+      }
+      if (plainStart < i) out.push(text2.slice(plainStart, i));
+      out.push(SANITIZE_REPLACEMENT_CHAR);
+      i += 1;
+      plainStart = i;
+      continue;
+    }
+    if (code >= LOW_SURROGATE_MIN && code <= LOW_SURROGATE_MAX) {
+      if (plainStart < i) out.push(text2.slice(plainStart, i));
+      out.push(SANITIZE_REPLACEMENT_CHAR);
+      i += 1;
+      plainStart = i;
+      continue;
+    }
+    i += 1;
+  }
+  if (plainStart < length) out.push(text2.slice(plainStart));
+  return out.join("");
+}
+function sanitizeToolOutputContent(content) {
+  return typeof content === "string" ? sanitizeToolOutputText(content) : content;
+}
+
 // packages/agent-runtime/providerMessageProjection.ts
 var TOOL_DURATION_METADATA_KEY = "toolExecMs";
 var OBSERVATION_ONLY_METADATA_KEYS = /* @__PURE__ */ new Set([
@@ -12871,7 +13102,8 @@ var OBSERVATION_ONLY_METADATA_KEYS = /* @__PURE__ */ new Set([
   TOOL_HAD_IMAGES
 ]);
 function formatToolMessageContent(args2) {
-  const scrubbedContent = scrubSecrets(args2.content).cleaned;
+  const sanitizedContent = sanitizeToolOutputText(args2.content ?? "");
+  const scrubbedContent = scrubSecrets(sanitizedContent).cleaned;
   if (args2.toolName !== "globFiles" && args2.toolName !== "codeSearch" && args2.toolName !== "readFile" || !args2.metadata || Object.keys(args2.metadata).length === 0) {
     return scrubbedContent;
   }
@@ -13040,7 +13272,8 @@ function compactToolMetadata(metadata) {
   return Object.keys(selected).length > 0 ? clipCompactText(JSON.stringify(selected), 1200) : "";
 }
 function projectToolContentForProvider(args2) {
-  const content = args2.content;
+  const rawContent = args2.content;
+  const content = typeof rawContent === "string" ? sanitizeToolOutputText(rawContent) : rawContent;
   if (typeof content !== "string") return content;
   const metadataText = compactToolMetadata(args2.metadata);
   const embeddedMetadataIndex = metadataText ? content.indexOf("\n\n[tool metadata]\n") : -1;
@@ -13065,7 +13298,7 @@ ${metadataText}` : "";
   let clipped = clipToolText(contentForProjection, initialBudget, headRatio);
   const wasClipped = clipped.length < contentForProjection.trim().length;
   const needsProjection = wasClipped || Boolean(metadataSuffix) || embeddedMetadataIndex >= 0;
-  if (!needsProjection) return args2.content;
+  if (!needsProjection) return content;
   let spillNote = "";
   if (wasClipped) {
     try {
@@ -14107,8 +14340,8 @@ function resolveExecutableOnPath(name) {
     return null;
   }
   const pathEnv = process.env.PATH ?? "";
-  const sep2 = pathEnv.includes(";") && IS_WINDOWS ? ";" : ":";
-  const pathDirs = pathEnv.split(sep2).filter(Boolean);
+  const sep3 = pathEnv.includes(";") && IS_WINDOWS ? ";" : ":";
+  const pathDirs = pathEnv.split(sep3).filter(Boolean);
   const fallbackDirs = IS_WINDOWS ? [] : [
     "/opt/homebrew/bin",
     "/usr/local/bin",
@@ -14237,9 +14470,9 @@ function spawnToWebStreams(options) {
     env: options.env,
     stdio: ["ignore", "pipe", "pipe"]
   });
-  const exited = new Promise((resolve6) => {
-    child.on("exit", (code) => resolve6(code ?? 1));
-    child.on("error", () => resolve6(127));
+  const exited = new Promise((resolve7) => {
+    child.on("exit", (code) => resolve7(code ?? 1));
+    child.on("error", () => resolve7(127));
   });
   const toWeb = (stream) => {
     if (!stream) return null;
@@ -15733,8 +15966,8 @@ import { createHash as createHash4 } from "node:crypto";
 // packages/agent-runtime/visualRenderer.node.ts
 import { createRequire } from "node:module";
 import { existsSync as existsSync4 } from "node:fs";
-import { mkdir, realpath, stat, readFile, writeFile } from "node:fs/promises";
-import { dirname as dirname2, isAbsolute as isAbsolute2, relative as relative2, win32 } from "node:path";
+import { realpath, stat, readFile } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, relative as relative2, win32 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { lookup as lookup2 } from "node:dns/promises";
 import { isIP } from "node:net";
@@ -15785,7 +16018,7 @@ var VisualRenderSemaphore = class {
   active = 0;
   queue = [];
   async run(task) {
-    if (this.active >= this.limit) await new Promise((resolve6) => this.queue.push(resolve6));
+    if (this.active >= this.limit) await new Promise((resolve7) => this.queue.push(resolve7));
     else this.active++;
     try {
       return await task();
@@ -15816,6 +16049,9 @@ async function renderVisualPage(args2) {
       throw new Error(`renderVisualPage: ${field} is required (expected a non-empty string)`);
     }
   }
+  if (typeof args2.persistScreenshot !== "function") {
+    throw new Error("renderVisualPage: persistScreenshot is required (expected a function that stores the PNG bytes)");
+  }
   if (!isAbsolute2(args2.workspaceRoot)) {
     throw new Error("renderVisualPage: workspaceRoot must be an absolute path");
   }
@@ -15915,8 +16151,7 @@ async function renderVisualPage(args2) {
         const result4 = { ...metrics, pageUrl: localFile ? url.href : page.url(), title: await page.title(), viewport: page.viewportSize(), renderer: "platform-playwright", capturedAt: (/* @__PURE__ */ new Date()).toISOString() };
         if (Date.now() >= deadline) throw new Error("Renderer timed out before screenshot persistence.");
         if (timer) clearTimeout(timer);
-        await mkdir(dirname2(args2.screenshotPath), { recursive: true });
-        await writeFile(args2.screenshotPath, screenshot);
+        await args2.persistScreenshot(screenshot);
         return result4;
       };
       return await Promise.race([routeFailure, work(), new Promise((_, reject) => {
@@ -15977,7 +16212,7 @@ finally:
             pass
     bus.signal_unsubscribe(subscription)
 `;
-var capturePortalScreenshot = (signal) => new Promise((resolve6, reject) => {
+var capturePortalScreenshot = (signal) => new Promise((resolve7, reject) => {
   const child = spawn2("/usr/bin/python3", ["-c", PORTAL_SCRIPT], { stdio: ["ignore", "pipe", "pipe"] });
   let stdout = "";
   let stderr = "";
@@ -15998,7 +16233,7 @@ var capturePortalScreenshot = (signal) => new Promise((resolve6, reject) => {
     if (signal.aborted) return reject(new Error("portal capture timeout"));
     if (code !== 0) return reject(new Error(stderr.trim() || `portal helper exited ${code}`));
     try {
-      resolve6(JSON.parse(stdout));
+      resolve7(JSON.parse(stdout));
     } catch {
       reject(new Error("invalid portal response"));
     }
@@ -16010,7 +16245,7 @@ function createHostWindowCapture(options = {}) {
   let active = 0;
   const waiters = [];
   function acquire(signal) {
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve7, reject) => {
       const abort = () => {
         const index = waiters.indexOf(start);
         if (index >= 0) waiters.splice(index, 1);
@@ -16019,7 +16254,7 @@ function createHostWindowCapture(options = {}) {
       const start = () => {
         signal.removeEventListener("abort", abort);
         active++;
-        resolve6();
+        resolve7();
       };
       if (signal.aborted) return abort();
       if (active < concurrency) start();
@@ -16075,9 +16310,9 @@ function createHostWindowCapture(options = {}) {
 var captureHostWindow = createHostWindowCapture();
 
 // packages/agent-runtime/localWorkspaceTools.ts
-import { lstat, mkdir as mkdir2, readdir as readdir2, readFile as readFile4, realpath as realpath2, stat as stat4, writeFile as writeFile2 } from "node:fs/promises";
+import { lstat as lstat2, readdir as readdir2, readFile as readFile4, realpath as realpath3, stat as stat4 } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname as dirname3, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve4, sep } from "node:path";
+import { dirname as dirname3, relative as relative5, resolve as resolve5, sep as sep2 } from "node:path";
 import { spawn as spawnChildProcess3 } from "node:child_process";
 
 // packages/core/readRangeLedger.ts
@@ -16102,14 +16337,14 @@ function mergeLineRanges(ranges) {
 }
 function isLineRangeCovered(request3, covered) {
   if (!isValidRange(request3)) return false;
-  let open = request3.startLine;
+  let open2 = request3.startLine;
   for (const range3 of mergeLineRanges(covered)) {
-    if (range3.endLine < open) continue;
-    if (range3.startLine > open) return false;
-    open = range3.endLine + 1;
-    if (open > request3.endLine) return true;
+    if (range3.endLine < open2) continue;
+    if (range3.startLine > open2) return false;
+    open2 = range3.endLine + 1;
+    if (open2 > request3.endLine) return true;
   }
-  return open > request3.endLine;
+  return open2 > request3.endLine;
 }
 
 // packages/agent-runtime/fileTextSearch.ts
@@ -16346,7 +16581,7 @@ function resolveCleanupReport(evidence, previousStatus) {
 }
 var TERMINAL_EVENT_TYPES = /* @__PURE__ */ new Set(["exited", "killed"]);
 function defaultSleep(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 function defaultSignalSender(pid, signal) {
   process.kill(pid, signal);
@@ -16953,6 +17188,308 @@ function filterDeclaredWorkspaceToolNames(args2) {
   );
 }
 
+// packages/agent-runtime/workspacePathGuard.ts
+import { constants as fsConstants } from "node:fs";
+import { lstat, mkdir, open, readlink, realpath as realpath2 } from "node:fs/promises";
+import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute3, join as join5, relative as relative4, resolve as resolve4, sep } from "node:path";
+function isPathInsideRoot(root, targetPath) {
+  const rel = relative4(resolve4(root), resolve4(targetPath));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute3(rel);
+}
+function isNotFoundError(error) {
+  const code = error?.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+}
+async function realpathAllowMissing(targetPath) {
+  const tail = [];
+  let current = resolve4(targetPath);
+  for (; ; ) {
+    try {
+      const real = await realpath2(current);
+      return {
+        realPath: tail.length === 0 ? real : join5(real, ...tail.slice().reverse()),
+        exists: tail.length === 0
+      };
+    } catch (error) {
+      if (!isNotFoundError(error)) return null;
+      const parent = dirname2(current);
+      if (parent === current) return null;
+      tail.push(basename2(current));
+      current = parent;
+    }
+  }
+}
+async function resolveWorkspaceSafePath(args2) {
+  const requested = args2.requestedPath ?? args2.targetPath;
+  const lexicalRoot = resolve4(args2.workspaceRoot);
+  const targetPath = resolve4(args2.targetPath);
+  const lexicalInside = args2.lexicalInside ?? isPathInsideRoot(lexicalRoot, targetPath);
+  const [physicalRoot, resolved] = await Promise.all([
+    realpath2(lexicalRoot).catch(() => null),
+    realpathAllowMissing(targetPath)
+  ]);
+  if (resolved === null) {
+    return lexicalInside ? { ok: false, error: "path_unresolvable", target: requested } : {
+      ok: true,
+      requested,
+      path: targetPath,
+      realPath: targetPath,
+      exists: false,
+      lexicalInside,
+      insideWorkspace: false,
+      allowedRoots: [targetPath]
+    };
+  }
+  if (physicalRoot === null) {
+    return {
+      ok: true,
+      requested,
+      path: targetPath,
+      realPath: resolved.realPath,
+      exists: resolved.exists,
+      lexicalInside,
+      insideWorkspace: lexicalInside,
+      allowedRoots: [lexicalRoot]
+    };
+  }
+  const insideWorkspace = isPathInsideRoot(physicalRoot, resolved.realPath);
+  if (lexicalInside && !insideWorkspace) {
+    return { ok: false, error: "path_outside_workspace", target: requested };
+  }
+  return {
+    ok: true,
+    requested,
+    path: targetPath,
+    realPath: resolved.realPath,
+    exists: resolved.exists,
+    lexicalInside,
+    insideWorkspace,
+    allowedRoots: insideWorkspace ? [physicalRoot] : [resolved.realPath]
+  };
+}
+function workspacePathGuardError(failure, note) {
+  const detail = failure.error === "path_outside_workspace" ? `${failure.error}: ${failure.target} (resolves outside the workspace boundary)` : `${failure.error}: ${failure.target} (cannot be resolved to a physical path)`;
+  const error = new Error(note ? `${detail} \u2014 ${note}` : detail);
+  error.code = failure.error;
+  error.target = failure.target;
+  return error;
+}
+var FD_LINK_ROOTS = ["/proc/self/fd", "/dev/fd"];
+var O_NOFOLLOW = fsConstants.O_NOFOLLOW ?? 0;
+var O_DIRECTORY = fsConstants.O_DIRECTORY ?? 0;
+async function resolveOpenedFilePath(handle) {
+  for (const root of FD_LINK_ROOTS) {
+    try {
+      const linked = await readlink(`${root}/${handle.fd}`);
+      if (isAbsolute3(linked)) return linked.replace(/ \(deleted\)$/, "");
+    } catch {
+    }
+  }
+  return null;
+}
+function assertPathInsideApproval(physicalPath, guard) {
+  if (guard.allowedRoots.some((root) => isPathInsideRoot(root, physicalPath))) return;
+  throw workspacePathGuardError({
+    ok: false,
+    error: "path_outside_workspace",
+    target: guard.requested
+  });
+}
+async function assertOpenedFileInsideApproval(handle, guard) {
+  const openedPath = await resolveOpenedFilePath(handle);
+  if (openedPath === null) return;
+  assertPathInsideApproval(openedPath, guard);
+}
+async function readGuardApprovedFile(guard) {
+  const handle = await open(guard.path, "r");
+  try {
+    await assertOpenedFileInsideApproval(handle, guard);
+    return await handle.readFile({ encoding: "utf8" });
+  } finally {
+    await handle.close();
+  }
+}
+async function ensureGuardApprovedDirectory(guard) {
+  const before = await realpathAllowMissing(guard.path);
+  if (before === null) {
+    throw workspacePathGuardError({
+      ok: false,
+      error: "path_unresolvable",
+      target: guard.requested
+    });
+  }
+  assertPathInsideApproval(before.realPath, guard);
+  let createdByPinnedWalk = false;
+  if (!before.exists) {
+    createdByPinnedWalk = await createMissingDirectoryChain(guard);
+  }
+  const after = await realpathAllowMissing(guard.path);
+  if (after === null) {
+    throw workspacePathGuardError({
+      ok: false,
+      error: "path_unresolvable",
+      target: guard.requested
+    });
+  }
+  if (!guard.allowedRoots.some((root) => isPathInsideRoot(root, after.realPath))) {
+    throw workspacePathGuardError(
+      { ok: false, error: "path_outside_workspace", target: guard.requested },
+      createdByPinnedWalk ? "directory creation had already run; verify the filesystem for empty directories created outside the workspace" : "directory creation had already run for a path component swapped during the operation"
+    );
+  }
+  let handle;
+  try {
+    handle = await open(guard.path, "r");
+  } catch {
+    return;
+  }
+  try {
+    await assertOpenedFileInsideApproval(handle, guard);
+  } finally {
+    await handle.close();
+  }
+}
+async function openPinnedDirectory(dirPath, guard) {
+  let handle;
+  try {
+    handle = await open(dirPath, fsConstants.O_RDONLY | O_DIRECTORY);
+  } catch (error) {
+    if (isNotFoundError(error)) return null;
+    throw error;
+  }
+  try {
+    await assertOpenedFileInsideApproval(handle, guard);
+  } catch (error) {
+    await handle.close();
+    throw error;
+  }
+  for (const root of FD_LINK_ROOTS) {
+    let probe;
+    try {
+      probe = await open(`${root}/${handle.fd}`, fsConstants.O_RDONLY);
+      return { handle, fdRoot: root };
+    } catch {
+    } finally {
+      await probe?.close();
+    }
+  }
+  await handle.close();
+  return null;
+}
+async function createMissingDirectoryChain(guard) {
+  const missing = [];
+  let existing = resolve4(guard.path);
+  for (; ; ) {
+    try {
+      await lstat(existing);
+      break;
+    } catch (error) {
+      if (!isNotFoundError(error)) throw error;
+      const parent = dirname2(existing);
+      if (parent === existing) {
+        throw workspacePathGuardError({
+          ok: false,
+          error: "path_unresolvable",
+          target: guard.requested
+        });
+      }
+      missing.push(existing);
+      existing = parent;
+    }
+  }
+  if (!guard.insideWorkspace) {
+    await mkdir(guard.path, { recursive: true });
+    return false;
+  }
+  let pinned = await openPinnedDirectory(existing, guard);
+  if (pinned === null) {
+    await mkdir(guard.path, { recursive: true });
+    return false;
+  }
+  try {
+    for (const target of missing.slice().reverse()) {
+      const name = basename2(target);
+      if (!name || name === "." || name === "..") {
+        throw workspacePathGuardError({
+          ok: false,
+          error: "path_unresolvable",
+          target: guard.requested
+        });
+      }
+      const childPath = `${pinned.fdRoot}/${pinned.handle.fd}/${name}`;
+      try {
+        await mkdir(childPath);
+      } catch (error) {
+        if (error?.code !== "EEXIST") throw error;
+      }
+      const child = await open(childPath, fsConstants.O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
+      try {
+        await assertOpenedFileInsideApproval(child, guard);
+      } catch (error) {
+        await child.close();
+        throw error;
+      }
+      await pinned.handle.close();
+      pinned = { handle: child, fdRoot: pinned.fdRoot };
+    }
+  } finally {
+    await pinned.handle.close();
+  }
+  return true;
+}
+async function openGuardApprovedWriteHandle(guard) {
+  let info;
+  try {
+    info = await lstat(guard.path);
+  } catch (error) {
+    if (!isNotFoundError(error)) throw error;
+    info = null;
+  }
+  if (info?.isSymbolicLink()) {
+    throw workspacePathGuardError({
+      ok: false,
+      error: "path_outside_workspace",
+      target: guard.requested
+    });
+  }
+  try {
+    return await open(
+      guard.path,
+      fsConstants.O_WRONLY | fsConstants.O_CREAT | O_NOFOLLOW,
+      438
+    );
+  } catch (error) {
+    if (error?.code === "ELOOP") {
+      throw workspacePathGuardError({
+        ok: false,
+        error: "path_outside_workspace",
+        target: guard.requested
+      });
+    }
+    throw error;
+  }
+}
+async function writeGuardApprovedBytes(guard, content) {
+  const handle = await openGuardApprovedWriteHandle(guard);
+  try {
+    await assertOpenedFileInsideApproval(handle, guard);
+    await handle.truncate(0);
+    if (typeof content === "string") {
+      await handle.writeFile(content, { encoding: "utf8" });
+    } else {
+      await handle.writeFile(content);
+    }
+  } finally {
+    await handle.close();
+  }
+}
+async function writeGuardApprovedFile(guard, content) {
+  await writeGuardApprovedBytes(guard, content);
+}
+async function writeGuardApprovedBinaryFile(guard, content) {
+  await writeGuardApprovedBytes(guard, content);
+}
+
 // packages/agent-runtime/localWorkspaceTools.ts
 async function hasRootGitignore2(workspaceRoot) {
   return hasRootGitignore(workspaceRoot);
@@ -17053,12 +17590,12 @@ function parseWorkspaceToolArguments(raw) {
   }
 }
 function normalizeWorkspaceRelativePath(args2) {
-  const relativePath = relative4(args2.workspaceRoot, args2.targetPath);
+  const relativePath = relative5(args2.workspaceRoot, args2.targetPath);
   return relativePath || ".";
 }
 function isPathInsideWorkspace(args2) {
-  const relativePath = relative4(args2.workspaceRoot, args2.targetPath);
-  return relativePath === "" || !relativePath.startsWith("..") && !relativePath.includes(`..${sep}`);
+  const relativePath = relative5(args2.workspaceRoot, args2.targetPath);
+  return relativePath === "" || !relativePath.startsWith("..") && !relativePath.includes(`..${sep2}`);
 }
 var PATH_FIELD_ALIASES = ["path", "file_path", "filePath", "filename", "file", "target_file", "targetFile", "file_to_read", "fileToRead", "target_path", "read_path", "path_to_read", "pathToRead"];
 var OLD_TEXT_FIELD_ALIASES = ["oldText", "old_string", "oldString", "search", "search_string", "find", "match"];
@@ -17332,17 +17869,13 @@ function resolveRipgrepBinary(env = process.env) {
   return resolveExecutableOnPath("rg");
 }
 var SEARCH_OUTPUT_CHAR_LIMIT = 2e4;
-function isPathInsideRoot(root, targetPath) {
-  const rel = relative4(resolve4(root), resolve4(targetPath));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute3(rel);
-}
 async function resolveRuntimeOwnedSpillPath(targetPath) {
   const spillRoot = resolveNoloStateDir("spills");
   if (!isPathInsideRoot(spillRoot, targetPath)) return null;
-  const rootStat = await lstat(spillRoot).catch(() => void 0);
+  const rootStat = await lstat2(spillRoot).catch(() => void 0);
   if (rootStat?.isDirectory() !== true) return null;
   try {
-    const [realRoot, realTarget] = await Promise.all([realpath2(spillRoot), realpath2(targetPath)]);
+    const [realRoot, realTarget] = await Promise.all([realpath3(spillRoot), realpath3(targetPath)]);
     return isPathInsideRoot(realRoot, realTarget) ? realTarget : null;
   } catch {
     return null;
@@ -17350,16 +17883,23 @@ async function resolveRuntimeOwnedSpillPath(targetPath) {
 }
 function expandHomePath(requestedPath) {
   if (requestedPath === "~") return homedir();
-  if (requestedPath.startsWith("~/")) return resolve4(homedir(), requestedPath.slice(2));
+  if (requestedPath.startsWith("~/")) return resolve5(homedir(), requestedPath.slice(2));
   return requestedPath;
 }
 function resolveRequestedWorkspacePath(workspaceRoot, requestedPath) {
-  return resolve4(resolve4(workspaceRoot), expandHomePath(requestedPath));
+  return resolve5(resolve5(workspaceRoot), expandHomePath(requestedPath));
 }
-async function resolveLocalWorkspaceToolPath(args2) {
-  const workspaceRoot = resolve4(args2.workspaceRoot);
+async function resolveLocalWorkspaceToolApproval(args2) {
+  const workspaceRoot = resolve5(args2.workspaceRoot);
   const targetPath = resolveRequestedWorkspacePath(workspaceRoot, args2.requestedPath);
   const insideWorkspace = isPathInsideWorkspace({ workspaceRoot, targetPath });
+  const guard = await resolveWorkspaceSafePath({
+    workspaceRoot,
+    targetPath,
+    requestedPath: args2.requestedPath,
+    lexicalInside: insideWorkspace
+  });
+  if (!guard.ok) throw workspacePathGuardError(guard);
   const trustedSpillPath = !insideWorkspace && args2.allowRuntimeOwnedSpill === true ? await resolveRuntimeOwnedSpillPath(targetPath) : null;
   if (!insideWorkspace && trustedSpillPath === null) {
     if (args2.confirmExternalFileAccess) {
@@ -17386,7 +17926,20 @@ async function resolveLocalWorkspaceToolPath(args2) {
       }
     }
   }
-  return trustedSpillPath ?? targetPath;
+  if (trustedSpillPath !== null) {
+    return {
+      ...guard,
+      path: trustedSpillPath,
+      realPath: trustedSpillPath,
+      insideWorkspace: false,
+      allowedRoots: [trustedSpillPath]
+    };
+  }
+  return guard;
+}
+async function resolveLocalWorkspaceToolPath(args2) {
+  const approval = await resolveLocalWorkspaceToolApproval(args2);
+  return approval.path;
 }
 var READ_FILE_MAX_CHAR_LIMIT = 32e3;
 function defensivelyTruncateReadFile(args2) {
@@ -17436,13 +17989,14 @@ async function readFileTool(args2) {
   const parsed = parseWorkspaceToolArguments(args2.call.arguments);
   const requestedPath = requireWorkspaceToolPath(parsed);
   const { warnings, ...sliceArgs } = readFileSliceArgs(parsed);
-  const absolutePath = await resolveLocalWorkspaceToolPath({
+  const approval = await resolveLocalWorkspaceToolApproval({
     workspaceRoot: args2.workspaceRoot,
     requestedPath,
     allowRuntimeOwnedSpill: true,
     ...args2.confirmExternalFileAccess ? { confirmExternalFileAccess: args2.confirmExternalFileAccess } : {}
   });
-  const content = await readFile4(absolutePath, "utf8");
+  const absolutePath = approval.path;
+  const content = await readGuardApprovedFile(approval);
   const activity = extractActivity(parsed);
   const sliced = sliceReadFileContent({
     content,
@@ -17454,7 +18008,7 @@ async function readFileTool(args2) {
   });
   const isTruncated = sliced.truncated || truncatedRead.truncatedByCharLimit;
   const relativePath = normalizeWorkspaceRelativePath({
-    workspaceRoot: resolve4(args2.workspaceRoot),
+    workspaceRoot: resolve5(args2.workspaceRoot),
     targetPath: absolutePath
   });
   const force = parsed.force === true;
@@ -17517,19 +18071,29 @@ async function readFileTool(args2) {
   }
   return { content: truncatedRead.content, metadata };
 }
+async function ensureGuardedParentDirectory(args2) {
+  const directoryGuard = await resolveWorkspaceSafePath({
+    workspaceRoot: args2.workspaceRoot,
+    targetPath: dirname3(args2.fileApproval.path),
+    requestedPath: args2.fileApproval.requested
+  });
+  if (!directoryGuard.ok) throw workspacePathGuardError(directoryGuard);
+  await ensureGuardApprovedDirectory(directoryGuard);
+}
 async function writeFileTool(args2) {
   const parsed = parseWorkspaceToolArguments(args2.call.arguments);
   const requestedPath = requireWorkspaceToolPath(parsed);
   const content = requireWorkspaceFileContent(parsed);
-  const absolutePath = await resolveLocalWorkspaceToolPath({
+  const approval = await resolveLocalWorkspaceToolApproval({
     workspaceRoot: args2.workspaceRoot,
     requestedPath,
     ...args2.confirmExternalFileAccess ? { confirmExternalFileAccess: args2.confirmExternalFileAccess } : {}
   });
-  await mkdir2(dirname3(absolutePath), { recursive: true });
-  await writeFile2(absolutePath, content, "utf8");
+  const absolutePath = approval.path;
+  await ensureGuardedParentDirectory({ workspaceRoot: args2.workspaceRoot, fileApproval: approval });
+  await writeGuardApprovedFile(approval, content);
   const relativePath = normalizeWorkspaceRelativePath({
-    workspaceRoot: resolve4(args2.workspaceRoot),
+    workspaceRoot: resolve5(args2.workspaceRoot),
     targetPath: absolutePath
   });
   const activity = extractActivity(parsed);
@@ -17630,12 +18194,13 @@ async function editFileTool(args2) {
   const oldText = requireWorkspaceOldText(parsed);
   const newText = requireWorkspaceNewText(parsed);
   const expectedReplacements = readExpectedReplacementCount(parsed);
-  const absolutePath = await resolveLocalWorkspaceToolPath({
+  const approval = await resolveLocalWorkspaceToolApproval({
     workspaceRoot: args2.workspaceRoot,
     requestedPath,
     ...args2.confirmExternalFileAccess ? { confirmExternalFileAccess: args2.confirmExternalFileAccess } : {}
   });
-  const content = await readFile4(absolutePath, "utf8");
+  const absolutePath = approval.path;
+  const content = await readGuardApprovedFile(approval);
   const { count: replacementCount, result: nextContent } = countAndReplaceEolTolerant({
     content,
     oldText,
@@ -17649,9 +18214,9 @@ async function editFileTool(args2) {
 ${hint}` : "")
     );
   }
-  await writeFile2(absolutePath, nextContent, "utf8");
+  await writeGuardApprovedFile(approval, nextContent);
   const relativePath = normalizeWorkspaceRelativePath({
-    workspaceRoot: resolve4(args2.workspaceRoot),
+    workspaceRoot: resolve5(args2.workspaceRoot),
     targetPath: absolutePath
   });
   const activity = extractActivity(parsed);
@@ -17691,9 +18256,9 @@ async function listWorkspaceEntries(args2) {
     const names = (await readdir2(dirPath)).sort((left, right) => left.localeCompare(right));
     for (const name of names) {
       if (truncated) break;
-      const absolutePath = resolve4(dirPath, name);
+      const absolutePath = resolve5(dirPath, name);
       const info = await stat4(absolutePath);
-      const relativePath = relative4(args2.dirPath, absolutePath) || ".";
+      const relativePath = relative5(args2.dirPath, absolutePath) || ".";
       const isDirectory = info.isDirectory();
       entries.push(isDirectory ? `${relativePath}/` : relativePath);
       if (args2.maxResults && entries.length >= args2.maxResults) {
@@ -17720,7 +18285,7 @@ async function internalSearchWorkspace(args2) {
     allowRuntimeOwnedSpill: true,
     ...args2.confirmExternalFileAccess ? { confirmExternalFileAccess: args2.confirmExternalFileAccess } : {}
   });
-  const workspaceRoot = resolve4(args2.workspaceRoot);
+  const workspaceRoot = resolve5(args2.workspaceRoot);
   const inside = isPathInsideWorkspace({ workspaceRoot, targetPath: searchPath });
   const result4 = await searchFileTextMatches({
     root: inside ? workspaceRoot : searchPath,
@@ -17800,7 +18365,7 @@ async function globFilesTool(args2) {
     ...args2.confirmExternalFileAccess ? { confirmExternalFileAccess: args2.confirmExternalFileAccess } : {}
   });
   const relativeSearchPath = normalizeWorkspaceRelativePath({
-    workspaceRoot: resolve4(args2.workspaceRoot),
+    workspaceRoot: resolve5(args2.workspaceRoot),
     targetPath: searchPath
   });
   const pathPrefix = relativeSearchPath === "." ? "" : `${relativeSearchPath.replace(/\/+$/, "")}/`;
@@ -17904,6 +18469,26 @@ async function resolveVisualStateBaseUrl(args2) {
   if (args2.explicitBaseUrl) return args2.explicitBaseUrl;
   return DEFAULT_LOCAL_API_ORIGIN;
 }
+async function persistApprovedScreenshot(args2) {
+  const fresh = await resolveWorkspaceSafePath({
+    workspaceRoot: args2.workspaceRoot,
+    targetPath: args2.approval.path,
+    requestedPath: args2.approval.requested
+  });
+  if (!fresh.ok) throw workspacePathGuardError(fresh);
+  if (!fresh.insideWorkspace) {
+    throw workspacePathGuardError({
+      ok: false,
+      error: "path_outside_workspace",
+      target: args2.approval.requested
+    });
+  }
+  await ensureGuardedParentDirectory({
+    workspaceRoot: args2.workspaceRoot,
+    fileApproval: fresh
+  });
+  await writeGuardApprovedBinaryFile(fresh, args2.bytes);
+}
 async function captureVisualStateTool(args2) {
   try {
     const parsed = parseWorkspaceToolArguments(args2.call.arguments);
@@ -17912,9 +18497,40 @@ async function captureVisualStateTool(args2) {
     if (!capability.available) return { content: `captureVisualState unavailable: ${capability.reason}`, metadata: { ok: false, rendererAvailable: false } };
     const baseUrl = await resolveVisualStateBaseUrl({ explicitBaseUrl: captureArgs.baseUrl });
     const pageUrl = new URL(captureArgs.path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`).href;
-    const screenshotPath = resolveRequestedWorkspacePath(args2.workspaceRoot, captureArgs.screenshotPath);
-    const metricsPath = resolveRequestedWorkspacePath(args2.workspaceRoot, captureArgs.metricsPath);
-    const rendered = await renderVisualPage({ ...captureArgs, workspaceRoot: args2.workspaceRoot, url: pageUrl, screenshotPath, timeoutMs: args2.commandTimeoutMs });
+    const fileApprovalArgs = args2.confirmExternalFileAccess ? { confirmExternalFileAccess: args2.confirmExternalFileAccess } : {};
+    const screenshotApproval = await resolveLocalWorkspaceToolApproval({
+      workspaceRoot: args2.workspaceRoot,
+      requestedPath: captureArgs.screenshotPath,
+      ...fileApprovalArgs
+    });
+    if (!screenshotApproval.insideWorkspace) {
+      throw new Error(
+        `captureVisualState screenshotPath must stay inside the workspace: ${captureArgs.screenshotPath}`
+      );
+    }
+    const metricsApproval = await resolveLocalWorkspaceToolApproval({
+      workspaceRoot: args2.workspaceRoot,
+      requestedPath: captureArgs.metricsPath,
+      ...fileApprovalArgs
+    });
+    await ensureGuardedParentDirectory({
+      workspaceRoot: args2.workspaceRoot,
+      fileApproval: screenshotApproval
+    });
+    await ensureGuardedParentDirectory({
+      workspaceRoot: args2.workspaceRoot,
+      fileApproval: metricsApproval
+    });
+    const screenshotPath = screenshotApproval.path;
+    const metricsPath = metricsApproval.path;
+    const rendered = await renderVisualPage({
+      ...captureArgs,
+      workspaceRoot: args2.workspaceRoot,
+      url: pageUrl,
+      screenshotPath,
+      timeoutMs: args2.commandTimeoutMs,
+      persistScreenshot: (bytes) => persistApprovedScreenshot({ workspaceRoot: args2.workspaceRoot, approval: screenshotApproval, bytes })
+    });
     const metrics = {
       ...captureArgs,
       ...rendered,
@@ -17922,8 +18538,7 @@ async function captureVisualStateTool(args2) {
       focusSelector: captureArgs.focusSelector ?? null,
       expectText: captureArgs.expectText ?? null
     };
-    await mkdir2(dirname3(metricsPath), { recursive: true });
-    await writeFile2(metricsPath, JSON.stringify(metrics, null, 2));
+    await writeGuardApprovedFile(metricsApproval, JSON.stringify(metrics, null, 2));
     const image = await readLocalImage(screenshotPath);
     return {
       content: [
@@ -18047,7 +18662,7 @@ async function launchProcessTool(args2) {
   ];
   const detached = process.platform !== "win32";
   const proc = spawnChildProcess3(cmdArgs[0] ?? "", cmdArgs.slice(1), {
-    cwd: resolve4(args2.workspaceRoot),
+    cwd: resolve5(args2.workspaceRoot),
     stdio: ["ignore", "pipe", "pipe"],
     detached
   });
@@ -18383,14 +18998,18 @@ function createLocalWorkspaceToolExecutors(args2) {
     captureVisualState: (call) => captureVisualStateTool({
       call,
       workspaceRoot: args2.workspaceRoot,
-      commandTimeoutMs: args2.commandTimeoutMs
+      commandTimeoutMs: args2.commandTimeoutMs,
+      ...fileAccess
     }),
     execShell: (call, opts) => execShellTool({
       call,
       workspaceRoot: args2.workspaceRoot,
       commandTimeoutMs: args2.commandTimeoutMs,
       commandOutputLimit: args2.commandOutputLimit,
-      commandPrefix: args2.commandPrefix,
+      commandPrefix: [
+        ...args2.execShellCommandPrefix ?? [],
+        ...args2.commandPrefix ?? []
+      ],
       restrictToWorkspace: args2.restrictShellToWorkspace,
       abortSignal: opts?.abortSignal ?? args2.abortSignal,
       detachMs: opts?.detachMs ?? args2.detachMs,
@@ -18812,6 +19431,10 @@ function projectSafeToolObservationMetadata(metadata) {
   if (typeof metadata.lineCount === "number") safe.lineCount = metadata.lineCount;
   return Object.keys(safe).length > 0 ? safe : void 0;
 }
+function sanitizeToolResultContent(result4) {
+  const content = sanitizeToolOutputContent(result4.content);
+  return content === result4.content ? result4 : { ...result4, content };
+}
 function summarizeToolResult(content, metadata) {
   const parts2 = [];
   const exitCode = metadata?.exitCode;
@@ -19038,6 +19661,7 @@ ${toolResult.content}` : toolResult.content,
         toolResult = replacement;
       }
     }
+    toolResult = sanitizeToolResultContent(toolResult);
     const finishedAt = Date.now();
     const summary = summarizeToolResult(toolResult.content, toolResult.metadata);
     const safeMetadata = projectSafeToolObservationMetadata(toolResult.metadata);
@@ -19103,7 +19727,7 @@ ${toolResult.content}` : toolResult.content,
       }
     };
   }
-  return { toolResult, toolExecMs };
+  return { toolResult: sanitizeToolResultContent(toolResult), toolExecMs };
 }
 
 // packages/agent-runtime/turnTranscript.ts
@@ -19564,16 +20188,16 @@ async function maybeAutoCompactLocalHistory(args2) {
       (error) => ({ kind: "provider-error", error })
     );
     const guards = [];
-    if (timeoutMs) guards.push(new Promise((resolve6) => {
+    if (timeoutMs) guards.push(new Promise((resolve7) => {
       timeoutHandle = setTimeout(() => {
         requestController.abort();
-        resolve6({ kind: "timeout" });
+        resolve7({ kind: "timeout" });
       }, timeoutMs);
     }));
-    if (args2.abortSignal) guards.push(new Promise((resolve6) => {
+    if (args2.abortSignal) guards.push(new Promise((resolve7) => {
       abortListener = () => {
         requestController.abort(args2.abortSignal?.reason);
-        resolve6({ kind: "aborted" });
+        resolve7({ kind: "aborted" });
       };
       args2.abortSignal?.addEventListener("abort", abortListener, { once: true });
       if (args2.abortSignal?.aborted) abortListener();
@@ -22218,6 +22842,10 @@ function createHybridRecordStore(deps) {
   };
 }
 
+// packages/agent-runtime/sandboxCommandPrefix.ts
+var DEFAULT_SANDBOX_TMPFS_SIZE_BYTES = 128 * 1024 * 1024;
+var BWRAP_PROBE_TTL_MS = 5 * 6e4;
+
 // packages/cli/client/localDialogRecords.ts
 var localDialogMessageRecordToRuntimeMessage = dialogMessageRecordToAgentRuntimeMessage;
 function buildLocalDialogWritePlan(args2) {
@@ -22354,7 +22982,7 @@ function buildLoadSkillExecutor(args2) {
         metadata: { loadSkill: true, resolved: false }
       };
     }
-    const { resolveSkillByName } = await import("./skillDiscovery-QC35EQY4.js");
+    const { resolveSkillByName } = await import("./skillDiscovery-F3TMVQOJ.js");
     const resolved = resolveSkillByName(args2.cwd, name);
     if (!resolved) {
       const { resolveBuiltinSkillByName } = await import("./builtinSkillRegistry-RR35BY57.js");
@@ -22400,7 +23028,7 @@ ${body}`,
   };
 }
 async function formatUnknownSkillMessage(cwd, requestedName) {
-  const { discoverSkills } = await import("./skillDiscovery-QC35EQY4.js");
+  const { discoverSkills } = await import("./skillDiscovery-F3TMVQOJ.js");
   let available = [];
   try {
     available = discoverSkills(cwd).map((s) => s.name);
@@ -22972,17 +23600,17 @@ function createDevinProvider(options) {
 }
 
 // packages/agent-runtime/executionLeaseValidation.ts
-import { isAbsolute as isAbsolute4, relative as relative5, resolve as resolve5 } from "node:path";
+import { isAbsolute as isAbsolute5, relative as relative6, resolve as resolve6 } from "node:path";
 function withinRoot(root, child) {
-  if (!isAbsolute4(root) || !isAbsolute4(child)) return false;
-  const canonicalRoot = resolve5(root);
-  const canonicalChild = resolve5(child);
-  const suffix = relative5(canonicalRoot, canonicalChild);
-  return suffix === "" || suffix !== ".." && !suffix.startsWith("../") && !suffix.startsWith("..\\") && !isAbsolute4(suffix);
+  if (!isAbsolute5(root) || !isAbsolute5(child)) return false;
+  const canonicalRoot = resolve6(root);
+  const canonicalChild = resolve6(child);
+  const suffix = relative6(canonicalRoot, canonicalChild);
+  return suffix === "" || suffix !== ".." && !suffix.startsWith("../") && !suffix.startsWith("..\\") && !isAbsolute5(suffix);
 }
 function subsetOf(allowed, actual) {
   return actual.every(
-    (root) => isAbsolute4(root) && allowed.some((parent) => withinRoot(parent, root))
+    (root) => isAbsolute5(root) && allowed.some((parent) => withinRoot(parent, root))
   );
 }
 function validateConfiguredRootExecutionLease(ticket, lease) {