nolo-cli 0.32.0 → 0.33.0-alpha.10

package/{chunk-DLWCWUNW.js → chunk-64OVNZXE.js}

@@ -1,17 +1,19 @@
 import {
   applyChatCompletionDelta,
+  applyResponsesToolEvent,
+  createResponsesToolAccumulator,
+  finalizeResponsesToolCalls,
   flushChatCompletionStream,
   providerHttpFailure,
   readSseFrames,
   throwIfChatCompletionStreamFailed
-} from "./chunk-7S54ZGF6.js";
+} from "./chunk-RJKIB55Y.js";
 import {
   sanitizeForOutbound
 } from "./chunk-T27IEBNQ.js";
 import {
-  parseToolArgumentsJson,
   resolveHistoricalToolContentCap
-} from "./chunk-AYMOSAHE.js";
+} from "./chunk-BFPSVRCQ.js";
 import {
   createThinkParserState,
   createToolCallAccumulator,
@@ -22,24 +24,35 @@ import {
 import {
   requiresBareImageUrl,
   toBareImageUrlMessages
-} from "./chunk-3UGKATZQ.js";
+} from "./chunk-ZWS6DUHX.js";
 import {
+  convertMessagesToResponsesInput,
+  extractReasoningFromResponseOutput,
+  extractTextFromResponseOutput,
+  extractToolCallsFromResponseOutput,
+  getUsageRequestOptions,
   shouldStripReasoningContentForOutbound,
-  toOpenAiCompatibleMessages
-} from "./chunk-D34RI6NI.js";
+  toOpenAiCompatibleMessages,
+  toResponsesTools
+} from "./chunk-NNWHHCVP.js";
 import {
   buildProviderAuthHeaders,
   buildProviderExecutionPlan
-} from "./chunk-UDA3ZYLW.js";
-import {
-  buildDialogFallbackTitleFromUserInput
-} from "./chunk-2MBTWINN.js";
+} from "./chunk-7YYHKBJP.js";
 import {
   NOLO_WORKSPACE_TOOL_NAMES,
   buildNoloWorkspaceCommandArgs,
+  noloPositiveIntegerString,
   noloStringArg,
-  parseNoloWorkspaceToolArguments
-} from "./chunk-D2BPX6DQ.js";
+  parseNoloWorkspaceToolArguments,
+  resolveNoloDialogInput
+} from "./chunk-ADLYMQB6.js";
+import {
+  buildDialogFallbackTitleFromUserInput
+} from "./chunk-2MBTWINN.js";
+import {
+  canonicalizeToolName
+} from "./chunk-ZZ2MH7LE.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
@@ -47,17 +60,18 @@ import {
   asRecordOrEmpty
 } from "./chunk-KX6YBIHG.js";
 import {
-  asTrimmedLowercaseString
-} from "./chunk-QSJ3HFEF.js";
-import {
-  normalizeServerOrigin
-} from "./chunk-CF7PE763.js";
-import {
-  dialogMessageKey
-} from "./chunk-WHLVPK32.js";
+  dialogMessageKey,
+  dialogMessageRange
+} from "./chunk-KMSZPTM6.js";
 import {
   asOptionalFiniteNumber
 } from "./chunk-WWC7I6TA.js";
+import {
+  asTrimmedNonEmptyStringArray
+} from "./chunk-I42VC5KR.js";
+import {
+  asTrimmedLowercaseString
+} from "./chunk-QSJ3HFEF.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
@@ -68,11 +82,8 @@ import {
   isRecord
 } from "./chunk-KUG52IAP.js";
 import {
-  canonicalizeToolName
-} from "./chunk-3AUWC6EM.js";
-import {
-  asTrimmedNonEmptyStringArray
-} from "./chunk-I42VC5KR.js";
+  normalizeServerOrigin
+} from "./chunk-CF7PE763.js";
 import {
   asOptionalTrimmedString
 } from "./chunk-G3SUCT4W.js";
@@ -142,8 +153,173 @@ function parseSseDataLineObject(line) {
   return parsed && typeof parsed === "object" ? parsed : null;
 }
 
+// packages/integrations/openai/responsesRequestBody.ts
+function buildResponsesRequestBody(body, model) {
+  const tools = Array.isArray(body.tools) ? toResponsesTools(body.tools) : void 0;
+  const reasoningEffort = body.reasoning && typeof body.reasoning === "object" ? void 0 : typeof body.reasoning_effort === "string" && body.reasoning_effort.trim() ? body.reasoning_effort : void 0;
+  return {
+    ...body,
+    model,
+    input: Array.isArray(body.input) && body.input.length > 0 ? body.input : convertMessagesToResponsesInput(body.messages ?? []),
+    ...Array.isArray(body.tools) ? { tools: tools ?? void 0 } : {},
+    ...typeof body.max_tokens === "number" ? { max_output_tokens: body.max_tokens } : {},
+    ...reasoningEffort ? { reasoning: { effort: reasoningEffort } } : {},
+    messages: void 0,
+    max_tokens: void 0,
+    reasoning_effort: void 0,
+    tool_choice: void 0
+  };
+}
+
+// packages/agent-runtime/responsesSseStream.ts
+function toResponsesStreamFailure(raw, fallbackPrefix = "Responses") {
+  if (!raw || typeof raw !== "object") return void 0;
+  const err = raw;
+  const reason = typeof err.reason === "string" ? err.reason : void 0;
+  const message = typeof err.message === "string" && err.message ? err.message : reason ? `${fallbackPrefix} upstream ended incomplete: ${reason}.` : "";
+  if (!message) return void 0;
+  const code = typeof err.code === "string" ? err.code : reason;
+  return {
+    ...code ? { code } : {},
+    ...typeof err.type === "string" ? { type: err.type } : {},
+    message
+  };
+}
+function responsesStreamFailureStatus(failure) {
+  const marker = `${failure.code ?? ""} ${failure.type ?? ""}`.toLowerCase();
+  if (marker.includes("overload") || marker.includes("service_unavailable")) return 503;
+  if (marker.includes("rate_limit") || marker.includes("usage_limit")) return 429;
+  return 502;
+}
+var codexStreamFailureStatus = responsesStreamFailureStatus;
+function createResponsesStreamCollector(callbacks) {
+  let content = "";
+  let reasoning = "";
+  const toolCallsAcc = createResponsesToolAccumulator();
+  let usage;
+  let failure;
+  let completedResponse;
+  const processEvent = (ev) => {
+    const type = String(ev.type ?? "");
+    if (type === "error") {
+      failure = failure ?? toResponsesStreamFailure(ev.error, callbacks?.fallbackPrefix);
+      return;
+    }
+    if (type === "response.failed" || type === "response.incomplete") {
+      const response = ev.response;
+      failure = failure ?? toResponsesStreamFailure(response?.error, callbacks?.fallbackPrefix) ?? toResponsesStreamFailure(response?.incomplete_details, callbacks?.fallbackPrefix) ?? {
+        code: type === "response.incomplete" ? "response_incomplete" : "response_failed",
+        message: `${callbacks?.fallbackPrefix ?? "Responses"} upstream ended with ${type}.`
+      };
+      return;
+    }
+    if (type === "response.output_text.delta" && typeof ev.delta === "string") {
+      content += ev.delta;
+      callbacks?.onTextDelta?.(ev.delta);
+      return;
+    }
+    if ((type === "response.reasoning_text.delta" || type === "response.reasoning.delta") && typeof ev.delta === "string") {
+      reasoning += ev.delta;
+      callbacks?.onReasoningDelta?.(ev.delta);
+      return;
+    }
+    if (type === "response.output_item.added" || type === "response.output_item.done" || type === "response.function_call_arguments.delta" || type === "response.function_call_arguments.done") {
+      applyResponsesToolEvent(toolCallsAcc, ev);
+      return;
+    }
+    if (type === "response.completed") {
+      const response = ev.response;
+      if (response) {
+        completedResponse = response;
+        const u = response.usage;
+        if (u) {
+          const prompt = typeof u.input_tokens === "number" ? u.input_tokens : typeof u.prompt_tokens === "number" ? u.prompt_tokens : 0;
+          const completion = typeof u.output_tokens === "number" ? u.output_tokens : typeof u.completion_tokens === "number" ? u.completion_tokens : 0;
+          const total = typeof u.total_tokens === "number" ? u.total_tokens : prompt + completion;
+          usage = {
+            prompt_tokens: prompt,
+            completion_tokens: completion,
+            total_tokens: total
+          };
+        }
+      }
+    }
+  };
+  const finalize = () => {
+    let finalToolCalls = finalizeResponsesToolCalls(toolCallsAcc);
+    if (finalToolCalls.length === 0 && completedResponse) {
+      finalToolCalls = extractToolCallsFromResponseOutput(completedResponse);
+    }
+    if (!content && completedResponse) {
+      content = extractTextFromResponseOutput(completedResponse);
+    }
+    if (!reasoning && completedResponse) {
+      reasoning = extractReasoningFromResponseOutput(completedResponse);
+    }
+    return {
+      content,
+      ...reasoning ? { reasoning_content: reasoning } : {},
+      ...finalToolCalls.length > 0 ? { tool_calls: finalToolCalls } : {},
+      ...usage ? { usage } : {},
+      finish_reason: finalToolCalls.length > 0 ? "tool_calls" : "stop",
+      stream_complete: true,
+      ...failure ? { failure } : {}
+    };
+  };
+  return {
+    processEvent,
+    finalize
+  };
+}
+function aggregateResponsesStream(events, options) {
+  const collector = createResponsesStreamCollector({ fallbackPrefix: options?.fallbackPrefix ?? "Codex" });
+  for (const ev of events) {
+    collector.processEvent(ev);
+  }
+  const finalized = collector.finalize();
+  return {
+    text: finalized.content,
+    toolCalls: finalized.tool_calls ?? [],
+    usage: finalized.usage,
+    failure: finalized.failure
+  };
+}
+async function readResponsesSseCompletion(args) {
+  const collector = createResponsesStreamCollector({
+    onTextDelta: args.onTextDelta,
+    onReasoningDelta: args.onReasoningDelta,
+    fallbackPrefix: args.fallbackPrefix ?? "Responses"
+  });
+  for await (const frame of readSseFrames(args.response)) {
+    for (const line of frame.split("\n")) {
+      const parsed = parseSseDataLineObject(line);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        collector.processEvent(parsed);
+      }
+    }
+  }
+  const result = collector.finalize();
+  if (result.failure) {
+    const status = responsesStreamFailureStatus(result.failure);
+    const err = new Error(result.failure.message);
+    err.status = status;
+    err.code = result.failure.code;
+    err.type = result.failure.type;
+    throw err;
+  }
+  return result;
+}
+
 // packages/agent-runtime/openAiCompatibleProvider.ts
+function isOpenAiResponsesEndpoint(endpoint) {
+  return endpoint.includes("/responses");
+}
+function resolveOpenAiCompatibleWire(config) {
+  if (config.wire) return config.wire;
+  return isOpenAiResponsesEndpoint(config.endpoint) ? "responses" : "chat.completions";
+}
 function buildOpenAiCompatibleChatCompletionRequest(args) {
+  const isResponses = resolveOpenAiCompatibleWire(args.providerConfig) === "responses";
   const shouldStripReasoning = shouldStripReasoningContentForOutbound(
     args.providerConfig.provider,
     args.providerConfig.model
@@ -152,7 +328,7 @@ function buildOpenAiCompatibleChatCompletionRequest(args) {
   const messages = toOpenAiCompatibleMessages(sanitizedMessages, {
     stripReasoningContent: shouldStripReasoning
   });
-  const body = {
+  const rawBody = {
     model: args.providerConfig.model,
     messages: requiresBareImageUrl({
       endpoint: args.providerConfig.endpoint,
@@ -162,8 +338,9 @@ function buildOpenAiCompatibleChatCompletionRequest(args) {
     stream: args.stream ?? false,
     ...args.providerConfig.requestOptions,
     ...args.tools && args.tools.length > 0 ? { tools: args.tools } : {},
-    ...args.stream ? { stream_options: { include_usage: true } } : {}
+    ...!isResponses && args.stream ? getUsageRequestOptions(args.providerConfig.provider, { api: "chat-completions" }) : {}
   };
+  const body = isResponses ? buildResponsesRequestBody(rawBody, args.providerConfig.model) : rawBody;
   const endpoint = args.providerConfig.endpoint;
   const headers = {
     "Content-Type": "application/json",
@@ -183,6 +360,28 @@ function buildOpenAiCompatibleChatCompletionRequest(args) {
     }
   };
 }
+function parseOpenAiCompatibleResponsesResponse(args) {
+  const content = extractTextFromResponseOutput(args.data);
+  const reasoning = extractReasoningFromResponseOutput(args.data);
+  const tool_calls = extractToolCallsFromResponseOutput(args.data);
+  const u = args.data?.usage;
+  const usage = u && typeof u === "object" ? {
+    prompt_tokens: typeof u.input_tokens === "number" ? u.input_tokens : typeof u.prompt_tokens === "number" ? u.prompt_tokens : 0,
+    completion_tokens: typeof u.output_tokens === "number" ? u.output_tokens : typeof u.completion_tokens === "number" ? u.completion_tokens : 0,
+    total_tokens: typeof u.total_tokens === "number" ? u.total_tokens : (u.input_tokens ?? 0) + (u.output_tokens ?? 0)
+  } : void 0;
+  return {
+    content,
+    model: args.providerConfig.model,
+    provider: args.providerConfig.provider,
+    ...tool_calls.length > 0 ? { tool_calls } : {},
+    ...reasoning ? { reasoning_content: reasoning } : {},
+    finish_reason: tool_calls.length > 0 ? "tool_calls" : "stop",
+    stream_complete: true,
+    ...usage ? { usage } : {},
+    trace: args.trace
+  };
+}
 function parseOpenAiCompatibleChatCompletionResponse(args) {
   const choiceMessage = args.data?.choices?.[0]?.message ?? {};
   const rawContent = String(choiceMessage?.content ?? "");
@@ -236,6 +435,7 @@ async function readOpenAiCompatibleSseCompletion(args) {
   };
 }
 async function executeOpenAiCompatibleChatCompletion(args) {
+  const isResponses = resolveOpenAiCompatibleWire(args.providerConfig) === "responses";
   const send = async (apiKey2) => {
     const request = buildOpenAiCompatibleChatCompletionRequest({
       providerConfig: apiKey2 === args.providerConfig.apiKey ? args.providerConfig : { ...args.providerConfig, apiKey: apiKey2 },
@@ -272,6 +472,24 @@ async function executeOpenAiCompatibleChatCompletion(args) {
   const contentType = res.headers.get("content-type") ?? "";
   const isEventStream = contentType.includes("text/event-stream");
   if (isEventStream) {
+    if (isResponses) {
+      const streamed2 = await readResponsesSseCompletion({
+        response: res,
+        ...args.onTextDelta ? { onTextDelta: args.onTextDelta } : {},
+        ...args.onReasoningDelta ? { onReasoningDelta: args.onReasoningDelta } : {}
+      });
+      return {
+        content: streamed2.content,
+        model: args.providerConfig.model,
+        provider: args.providerConfig.provider,
+        ...streamed2.tool_calls ? { tool_calls: streamed2.tool_calls } : {},
+        ...streamed2.reasoning_content ? { reasoning_content: streamed2.reasoning_content } : {},
+        ...streamed2.usage ? { usage: streamed2.usage } : {},
+        ...streamed2.stream_complete ? { stream_complete: true } : {},
+        ...streamed2.finish_reason ? { finish_reason: streamed2.finish_reason } : {},
+        trace: args.messages
+      };
+    }
     const streamed = await readOpenAiCompatibleSseCompletion({
       response: res,
       ...args.onTextDelta ? { onTextDelta: args.onTextDelta } : {},
@@ -296,6 +514,13 @@ async function executeOpenAiCompatibleChatCompletion(args) {
   } catch {
     data = {};
   }
+  if (isResponses) {
+    return parseOpenAiCompatibleResponsesResponse({
+      providerConfig: args.providerConfig,
+      data,
+      trace: args.messages
+    });
+  }
   return parseOpenAiCompatibleChatCompletionResponse({
     providerConfig: args.providerConfig,
     data,
@@ -1020,6 +1245,80 @@ function evaluateShellCommandPolicy(args) {
   };
 }
 
+// packages/agent-runtime/capabilities/capabilityPolicy.ts
+function toDisplayCommand(command) {
+  if (typeof command === "string") {
+    const trimmed = command.trim();
+    return trimmed ? trimmed : void 0;
+  }
+  if (Array.isArray(command)) {
+    const joined = command.map((item) => typeof item === "string" ? item : String(item)).filter((item) => item.length > 0).join(" ").trim();
+    return joined ? joined : void 0;
+  }
+  return void 0;
+}
+function buildDestructiveShellPermissionRequest(command) {
+  return {
+    id: "permission-shell-destructive-action",
+    tool: "execShell",
+    action: "destructive_shell_command",
+    title: "\u786E\u8BA4\u6267\u884C\u7834\u574F\u6027 shell \u547D\u4EE4",
+    body: "\u8BE5\u547D\u4EE4\u53EF\u80FD\u5220\u9664\u6216\u91CD\u7F6E\u7528\u6237\u5185\u5BB9\uFF0C\u9700\u8981\u7528\u6237\u660E\u786E\u786E\u8BA4\u540E\u624D\u80FD\u6267\u884C\u3002",
+    ...command ? { command } : {},
+    suggestedRule: {
+      scope: "once",
+      pattern: { capability: "destructive_action", target: "shell_command" }
+    }
+  };
+}
+function buildDestructiveShellBlockedError(reason, request) {
+  const error = new Error(reason);
+  error.code = "destructive_action_requires_confirmation";
+  error.policy = {
+    capability: "destructive_action",
+    target: "shell_command",
+    detail: "execShell destructive command"
+  };
+  error.permissionRequest = request;
+  return error;
+}
+async function evaluateExecShellDestructiveGuard(input, ctx) {
+  const guardEnabled = ctx.enableDestructiveShellGuard !== false;
+  if (!guardEnabled || ctx.confirmed) {
+    return;
+  }
+  const rawCommand = resolveShellCommandArg(
+    typeof input === "object" && input !== null ? input : { command: input }
+  );
+  const extraInput = typeof input === "object" && input !== null ? input.input : void 0;
+  if (!isDestructiveShellCommand({ command: rawCommand, input: extraInput })) {
+    return;
+  }
+  const displayCommand = toDisplayCommand(rawCommand);
+  const request = buildDestructiveShellPermissionRequest(displayCommand);
+  if (!ctx.confirmDestructiveAction) {
+    if (ctx.blockDestructiveWithoutConfirmation) {
+      throw buildDestructiveShellBlockedError(
+        "destructive shell command blocked: no confirmation channel available",
+        request
+      );
+    }
+    return;
+  }
+  const confirmed = await ctx.confirmDestructiveAction(request);
+  if (!confirmed) {
+    throw buildDestructiveShellBlockedError(
+      "destructive shell command blocked: user declined confirmation",
+      request
+    );
+  }
+}
+async function evaluateCapabilityPolicy(capability, normalizedInput, ctx) {
+  if (capability.name === "execShell") {
+    await evaluateExecShellDestructiveGuard(normalizedInput, ctx);
+  }
+}
+
 // packages/agent-runtime/localToolPolicy.ts
 var NEVER_LOCAL_TOOLS = /* @__PURE__ */ new Set([
   "deleteSpaces",
@@ -1064,20 +1363,6 @@ function normalizeLocalToolName(toolName) {
     String(toolName ?? "").replace(/^functions\./, "").trim()
   );
 }
-function parseShellCommandPayload(rawArguments) {
-  return parseToolArgumentsJson(rawArguments);
-}
-function toDisplayCommand(command) {
-  if (typeof command === "string") {
-    const trimmed = command.trim();
-    return trimmed ? trimmed : void 0;
-  }
-  if (Array.isArray(command)) {
-    const joined = command.map((item) => typeof item === "string" ? item : String(item)).filter((item) => item.length > 0).join(" ").trim();
-    return joined ? joined : void 0;
-  }
-  return void 0;
-}
 function isRestrictedLocalToolMode(env) {
   return env.NOLO_LOCAL_TOOL_MODE === "restricted";
 }
@@ -1127,7 +1412,6 @@ function resolveLocalToolPolicy(args) {
     reason: `${toolName} is not enabled for local runtime runs. The agent must declare the tool in its manifest; in restricted mode (NOLO_LOCAL_TOOL_MODE=restricted) non-default tools also require adding to NOLO_LOCAL_ALLOWED_TOOLS (e.g. NOLO_LOCAL_ALLOWED_TOOLS=someCustomTool) and restarting the session so the env var loads.`
   };
 }
-var ABORT_AWARE_LOCAL_TOOLS = /* @__PURE__ */ new Set(["execShell", "controlAgentRun"]);
 async function executeLocalToolWithPolicy(args) {
   const decision = resolveLocalToolPolicy({
     env: args.env,
@@ -1139,70 +1423,41 @@ async function executeLocalToolWithPolicy(args) {
   if (!executor) {
     throw new Error(`${decision.toolName} is allowed by policy but no local executor is registered.`);
   }
-  const effectiveExecutor = args.abortSignal && ABORT_AWARE_LOCAL_TOOLS.has(decision.toolName) && args.executors ? (call) => executor(call, {
-    abortSignal: args.abortSignal,
-    detachMs: args.detachMs
-  }) : executor;
-  const guardEnabled = args.enableDestructiveShellGuard !== false;
-  if (decision.toolName === "execShell" && !args.confirmed && guardEnabled) {
-    const parsed = parseShellCommandPayload(args.call.arguments);
-    const rawCommand = resolveShellCommandArg(parsed);
-    if (isDestructiveShellCommand({ command: rawCommand, input: parsed.input })) {
-      const command = toDisplayCommand(rawCommand);
-      const request = {
-        id: "permission-shell-destructive-action",
-        tool: "execShell",
-        action: "destructive_shell_command",
-        title: "\u786E\u8BA4\u6267\u884C\u7834\u574F\u6027 shell \u547D\u4EE4",
-        body: "\u8BE5\u547D\u4EE4\u53EF\u80FD\u5220\u9664\u6216\u91CD\u7F6E\u7528\u6237\u5185\u5BB9\uFF0C\u9700\u8981\u7528\u6237\u660E\u786E\u786E\u8BA4\u540E\u624D\u80FD\u6267\u884C\u3002",
-        ...command ? { command } : {},
-        suggestedRule: {
-          scope: "once",
-          pattern: { capability: "destructive_action", target: "shell_command" }
-        }
-      };
-      const buildBlockedError = (reason) => {
-        const error = new Error(reason);
-        error.code = "destructive_action_requires_confirmation";
-        error.policy = {
-          capability: "destructive_action",
-          target: "shell_command",
-          detail: "execShell destructive command"
-        };
-        error.permissionRequest = request;
-        return error;
-      };
-      if (!args.confirmDestructiveAction) {
-        if (args.blockDestructiveWithoutConfirmation) {
-          throw buildBlockedError(
-            "destructive shell command blocked: no confirmation channel available"
-          );
-        }
-        return effectiveExecutor({
-          ...args.call,
-          name: decision.toolName
-        });
-      }
-      const confirmed = await args.confirmDestructiveAction(request);
-      if (!confirmed) {
-        throw buildBlockedError(
-          "destructive shell command blocked: user declined confirmation"
-        );
+  const opts = {
+    ...args.abortSignal ? { abortSignal: args.abortSignal } : {},
+    ...args.detachMs !== void 0 ? { detachMs: args.detachMs } : {},
+    ...args.confirmed !== void 0 ? { confirmed: args.confirmed } : {},
+    ...args.enableDestructiveShellGuard !== void 0 ? { enableDestructiveShellGuard: args.enableDestructiveShellGuard } : {},
+    ...args.confirmDestructiveAction ? { confirmDestructiveAction: args.confirmDestructiveAction } : {},
+    ...args.blockDestructiveWithoutConfirmation !== void 0 ? { blockDestructiveWithoutConfirmation: args.blockDestructiveWithoutConfirmation } : {}
+  };
+  if (decision.toolName === "execShell") {
+    let parsedInput = args.call.arguments;
+    if (typeof parsedInput === "string") {
+      try {
+        parsedInput = JSON.parse(parsedInput);
+      } catch {
+        parsedInput = { command: parsedInput };
       }
     }
+    await evaluateExecShellDestructiveGuard(parsedInput, opts);
+    opts.confirmed = true;
   }
-  return effectiveExecutor({
-    ...args.call,
-    name: decision.toolName
-  });
+  return executor(
+    {
+      ...args.call,
+      name: decision.toolName
+    },
+    opts
+  );
 }
 
 // packages/agent-runtime/localWorkspaceTools.ts
 import { existsSync as existsSync2 } from "node:fs";
 import { createHash } from "node:crypto";
 import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
-import { dirname, relative, resolve, sep } from "node:path";
-import { spawnSync, spawn as spawnChildProcess } from "node:child_process";
+import { dirname, relative, resolve as resolve2, sep } from "node:path";
+import { spawnSync, spawn as spawnChildProcess2 } from "node:child_process";
 
 // packages/core/readRangeLedger.ts
 function filterRetainedLedgerRecords(records, retainedCap) {
@@ -1389,9 +1644,9 @@ function spawnToWebStreams(options) {
     env: options.env,
     stdio: ["ignore", "pipe", "pipe"]
   });
-  const exited = new Promise((resolve2) => {
-    child.on("exit", (code) => resolve2(code ?? 1));
-    child.on("error", () => resolve2(127));
+  const exited = new Promise((resolve3) => {
+    child.on("exit", (code) => resolve3(code ?? 1));
+    child.on("error", () => resolve3(127));
   });
   const toWeb = (stream) => {
     if (!stream) return null;
@@ -1474,65 +1729,674 @@ function getProcessRegistry() {
   return registry;
 }
 
-// packages/agent-runtime/localWorkspaceToolDefs.ts
-var WORKSPACE_TOOL_NAMES = [
-  "listFiles",
-  "readFile",
-  "writeFile",
-  "editFile",
-  "globFiles",
-  "searchFiles",
-  "captureVisualState",
-  "execShell",
-  "launchProcess",
-  "listProcesses"
-];
-var SHELL_TOOL_NAMES = ["execShell", "launchProcess", "listProcesses"];
-var WORKSPACE_TOOL_NAME_SET = new Set(WORKSPACE_TOOL_NAMES);
-var REMOVED_WORKSPACE_TOOL_NAMES = /* @__PURE__ */ new Set([
-  "gitStatus",
-  "gitDiff",
-  "gitCreateBranch",
-  "gitAdd",
-  "gitCommit",
-  "commitWorkspace"
-]);
-function tokenizeShellPrefix(command) {
-  const tokens = [];
-  const pattern = /"([^"]*)"|'([^']*)'|([^\s"'|;&<>]+)/g;
-  let match;
-  while (match = pattern.exec(command)) {
-    tokens.push(match[1] ?? match[2] ?? match[3] ?? "");
-  }
-  return tokens;
+// packages/agent-runtime/workspaceShell.ts
+import { resolve } from "node:path";
+import { spawn as spawnChildProcess } from "node:child_process";
+var EXEC_SHELL_TIMEOUT_ENV = "NOLO_EXEC_SHELL_TIMEOUT_MS";
+var EXEC_SHELL_DETACH_ENV = "NOLO_EXEC_SHELL_DETACH_MS";
+var DEFAULT_EXEC_SHELL_DETACH_MS = 12e4;
+function readTrimmedString(value) {
+  return asOptionalTrimmedString(value);
 }
-function buildWorkspacePathProperty() {
+function extractActivityRefs(rawRefs) {
+  if (!Array.isArray(rawRefs)) return void 0;
+  const refs = rawRefs.flatMap((entry) => {
+    if (typeof entry === "string" && entry.trim()) {
+      return [{ type: "file", path: entry.trim() }];
+    }
+    if (!isRecord(entry)) return [];
+    const path = readTrimmedString(entry.path);
+    if (path) return [{ type: "file", path }];
+    const terminalId = readTrimmedString(entry.id);
+    const terminalLabel = readTrimmedString(entry.label);
+    if (entry.type === "terminal" || terminalId || terminalLabel) {
+      return [{
+        type: "terminal",
+        ...terminalId ? { id: terminalId } : {},
+        ...terminalLabel ? { label: terminalLabel } : {}
+      }];
+    }
+    if (entry.type === "url" || typeof entry.url === "string") {
+      const url = readTrimmedString(entry.url);
+      const label = readTrimmedString(entry.label);
+      return url ? [{ type: "url", url, ...label ? { label } : {} }] : [];
+    }
+    return [];
+  });
+  return refs.length ? refs : void 0;
+}
+function extractActivityAction(rawAction) {
+  if (!isRecord(rawAction)) return void 0;
+  const title = readTrimmedString(rawAction.title);
+  if (!title) return void 0;
+  const kind = readTrimmedString(rawAction.kind);
+  const detail = readTrimmedString(rawAction.detail);
+  const refs = extractActivityRefs(rawAction.refs);
   return {
-    type: "string",
-    minLength: 1,
-    description: "Path relative to the workspace root. Defaults to workspace root when omitted."
+    title,
+    ...kind ? { kind } : {},
+    ...detail ? { detail } : {},
+    ...refs ? { refs } : {}
   };
 }
-function buildListWorkspaceDescription(variant) {
-  if (variant === "brief") {
-    return "List files and directories inside a workspace directory.";
-  }
-  if (variant === "workflow") {
-    return "List directory overview inside workspace. Then use globFiles for path patterns, searchFiles for text discovery, and readFile for content.";
-  }
-  if (variant === "antiShell") {
-    return "List directory overview inside workspace. Prefer listFiles over shell ls/find commands.";
-  }
-  return "List files and directories inside a workspace folder. Defaults to shallow overview (depth 1).";
-}
-function buildListWorkspaceParameters(variant) {
-  const path = buildWorkspacePathProperty();
-  const maxDepth = {
-    type: "integer",
-    description: "Maximum directory depth to include. Defaults to 1 for the requested directory only."
+function extractActivityPhase(rawPhase) {
+  if (!isRecord(rawPhase)) return void 0;
+  const title = readTrimmedString(rawPhase.title);
+  if (!title) return void 0;
+  const id = readTrimmedString(rawPhase.id) || title.toLowerCase().replace(/\s+/g, "-");
+  const index = asOptionalFiniteNumber(rawPhase.index);
+  const total = asOptionalFiniteNumber(rawPhase.total);
+  const status = rawPhase.status === "pending" || rawPhase.status === "running" || rawPhase.status === "success" || rawPhase.status === "failed" ? rawPhase.status : void 0;
+  return {
+    id,
+    title,
+    ...index !== void 0 ? { index } : {},
+    ...total !== void 0 ? { total } : {},
+    ...status ? { status } : {}
   };
-  const maxResults = {
-    type: "integer",
+}
+function extractActivityPlan(rawPlan) {
+  if (!isRecord(rawPlan)) return void 0;
+  if (!Array.isArray(rawPlan.phases)) return void 0;
+  const phases = rawPlan.phases.flatMap((entry, index) => {
+    const phase = extractActivityPhase(entry);
+    if (!phase) return [];
+    return [{
+      id: phase.id,
+      title: phase.title,
+      index: phase.index ?? index + 1,
+      ...phase.status ? { status: phase.status } : {}
+    }];
+  });
+  if (phases.length === 0) return void 0;
+  const title = readTrimmedString(rawPlan.title);
+  return {
+    ...title ? { title } : {},
+    phases
+  };
+}
+function extractActivity(parsed) {
+  const raw = parsed._activity;
+  if (!isRecord(raw)) return void 0;
+  const nestedAction = extractActivityAction(raw.action);
+  const legacyAction = extractActivityAction(raw);
+  const action = nestedAction || legacyAction;
+  const phase = extractActivityPhase(raw.phase);
+  const plan = extractActivityPlan(raw.plan);
+  if (!action && !plan) return void 0;
+  return {
+    ...action ? action : {},
+    ...phase ? { phase } : {},
+    ...nestedAction ? { action: nestedAction } : {},
+    ...plan ? { plan } : {}
+  };
+}
+function tokenizeShellPrefix(command) {
+  const tokens = [];
+  const pattern = /"([^"]*)"|'([^']*)'|([^\s"'|;&<>]+)/g;
+  let match;
+  while (match = pattern.exec(command)) {
+    tokens.push(match[1] ?? match[2] ?? match[3] ?? "");
+  }
+  return tokens;
+}
+function wrapPowerShellCommand(command) {
+  return [
+    "[Console]::InputEncoding=[System.Text.Encoding]::UTF8",
+    "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8",
+    "$OutputEncoding=[System.Text.Encoding]::UTF8",
+    "$PSStyle.OutputRendering='PlainText'",
+    command
+  ].join("; ");
+}
+function findPowerShellExecutable() {
+  return resolveExecutableOnPath("pwsh") || resolveExecutableOnPath("powershell.exe") || resolveExecutableOnPath("powershell");
+}
+function buildPowerShellCommand(command) {
+  const executable = findPowerShellExecutable();
+  if (!executable) throw new Error("PowerShell is not available on this machine.");
+  return [
+    executable,
+    "-NoLogo",
+    "-NoProfile",
+    "-NonInteractive",
+    "-ExecutionPolicy",
+    "Bypass",
+    "-Command",
+    wrapPowerShellCommand(command)
+  ];
+}
+function buildBashCommand(command) {
+  const executable = resolveExecutableOnPath("bash") || resolveExecutableOnPath("sh");
+  if (!executable) throw new Error("bash/sh is not available on this machine.");
+  return [executable, "-lc", command];
+}
+function buildWorkspaceShellCommand(args) {
+  if (args.shell === "powershell") return buildPowerShellCommand(args.command);
+  if (args.shell === "bash") return buildBashCommand(args.command);
+  return process.platform === "win32" ? buildPowerShellCommand(args.command) : buildBashCommand(args.command);
+}
+function findWorkspaceShellEscapeToken(command) {
+  const tokens = tokenizeShellPrefix(command);
+  for (const token of tokens) {
+    if (token === ".." || token.startsWith("../") || token.startsWith("..\\") || token.includes("/../") || token.includes("\\..\\")) {
+      return token;
+    }
+    if (token === "~" || token.startsWith("~/") || token.startsWith("~\\")) {
+      return token;
+    }
+    if (token === "/" || token.startsWith("/") || /^[A-Za-z]:[\\/]/.test(token) || token.startsWith("\\\\")) {
+      return token;
+    }
+  }
+  return null;
+}
+function buildWorkspaceShellEscapeBlockedResult(args) {
+  return {
+    content: [
+      "workspace_shell_escape_blocked",
+      `blockedToken: ${args.token}`,
+      `command: ${args.command}`,
+      "Use paths relative to the authorized folder only.",
+      "exitCode: 126"
+    ].join("\n"),
+    metadata: {
+      exitCode: 126,
+      workspaceShellEscapeBlocked: true,
+      blockedToken: args.token
+    }
+  };
+}
+function extractInteractiveGhAuthCommand(command) {
+  const tokens = tokenizeShellPrefix(command);
+  if (tokens[0] !== "gh" || tokens[1] !== "auth") return null;
+  const subcommand = tokens[2];
+  if (subcommand !== "login" && subcommand !== "refresh") return null;
+  if (tokens.includes("--help")) return null;
+  const result = ["gh", "auth", subcommand];
+  for (let index = 3; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (!token) continue;
+    if (token === "-h" || token === "--hostname" || token === "-s" || token === "--scopes" || token === "--remove-scopes" || token === "-r") {
+      const value = tokens[index + 1];
+      if (value) {
+        result.push(token, value);
+        index += 1;
+      }
+      continue;
+    }
+    if (token === "--clipboard" || token === "-c" || token === "--insecure-storage" || token === "--reset-scopes") {
+      result.push(token);
+      continue;
+    }
+    if (token.startsWith("--hostname=") || token.startsWith("--scopes=") || token.startsWith("--remove-scopes=")) {
+      result.push(token);
+      continue;
+    }
+  }
+  return result.join(" ");
+}
+function buildInteractiveCommandBlockedResult(command) {
+  const argv = tokenizeShellPrefix(command);
+  return {
+    content: [
+      "action_gate: handoff",
+      `command: ${command}`,
+      "Run this in the current TUI terminal, then resume the agent turn.",
+      "exitCode: 130"
+    ].join("\n"),
+    metadata: {
+      exitCode: 130,
+      timedOut: false,
+      actionGate: {
+        id: `gate-${Date.now().toString(36)}-terminal-handoff`,
+        kind: "handoff",
+        title: "This command requires an interactive terminal.",
+        body: "Complete it in the terminal, then nolo will continue.",
+        payload: {
+          command: argv,
+          displayCommand: command
+        }
+      },
+      reason: "interactive-command-requires-terminal"
+    }
+  };
+}
+function resolveExecShellTimeoutMs(override) {
+  const fromOverride = asOptionalPositiveFiniteNumber(override);
+  if (fromOverride !== void 0) return fromOverride;
+  const raw = process.env[EXEC_SHELL_TIMEOUT_ENV];
+  if (raw === void 0) return void 0;
+  return asOptionalPositiveFiniteNumber(Number(raw));
+}
+function resolveDetachMs(override) {
+  if (typeof override === "number" && Number.isFinite(override) && override >= 0) {
+    return override;
+  }
+  const raw = process.env[EXEC_SHELL_DETACH_ENV];
+  if (raw === void 0) return DEFAULT_EXEC_SHELL_DETACH_MS;
+  const parsed = asOptionalPositiveFiniteNumber(Number(raw));
+  return parsed === void 0 ? DEFAULT_EXEC_SHELL_DETACH_MS : parsed;
+}
+function truncateToolOutput(value, limit = 2e4) {
+  if (value.length <= limit) return value;
+  const approxMarkerLen = 40;
+  if (limit <= approxMarkerLen) return value.slice(0, limit);
+  const remaining = limit - approxMarkerLen;
+  const headSize = Math.floor(remaining * 0.3);
+  const tailSize = remaining - headSize;
+  const head = value.slice(0, headSize);
+  const tail = value.slice(-tailSize);
+  const actualRemoved = value.length - headSize - tailSize;
+  return `${head}
+
+[... truncated ${actualRemoved} chars ...]
+
+${tail}`;
+}
+function readNodeStream(stream) {
+  if (!stream) return Promise.resolve("");
+  return new Promise((resolveStream, rejectStream) => {
+    const chunks = [];
+    stream.on("data", (chunk) => {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    });
+    stream.on("error", rejectStream);
+    stream.on("end", () => {
+      resolveStream(Buffer.concat(chunks).toString("utf8"));
+    });
+  });
+}
+function waitForNodeProcessExit(proc) {
+  return new Promise((resolveExit, rejectExit) => {
+    proc.on("error", rejectExit);
+    proc.on("close", (code) => {
+      resolveExit(code ?? 0);
+    });
+  });
+}
+function deriveLabel(command) {
+  const trimmed = command.trim();
+  if (!trimmed) return "process";
+  const tokens = trimmed.split(/\s+/);
+  const lastToken = tokens[tokens.length - 1] ?? trimmed;
+  const labelCandidate = lastToken.split(/[/\\]/).pop() || lastToken;
+  return labelCandidate || trimmed;
+}
+function isSpawnFailureError(error) {
+  if (!error || typeof error !== "object") return false;
+  const err = error;
+  if (err.code === "ENOENT") return true;
+  const message = toErrorMessage(error).toLowerCase();
+  return message.includes("enoent") || message.includes("executable not found") || message.includes("spawn") && message.includes("not found");
+}
+function spawnFailedCommandResult(error, outputLimit) {
+  const stderr = `spawn failed: ${toErrorMessage(error)}
+`;
+  return {
+    stdout: "",
+    stderr,
+    exitCode: 127,
+    timedOut: false,
+    spawnFailed: true,
+    content: truncateToolOutput(
+      [`stderr:
+${stderr.trim()}`, "exitCode: 127"].filter(Boolean).join("\n\n"),
+      outputLimit
+    )
+  };
+}
+async function runWorkspaceCommand(args) {
+  const timeoutMs = asOptionalPositiveFiniteNumber(args.timeoutMs);
+  const detached = process.platform !== "win32";
+  const command = [
+    ...args.commandPrefix ?? [],
+    ...args.command
+  ];
+  const proc = spawnChildProcess(command[0] ?? "", command.slice(1), {
+    cwd: resolve(args.workspaceRoot),
+    stdio: [
+      args.stdin === void 0 ? "ignore" : "pipe",
+      "pipe",
+      "pipe"
+    ],
+    detached
+  });
+  if (args.stdin !== void 0 && proc.stdin) {
+    proc.stdin.write(args.stdin);
+    proc.stdin.end();
+  }
+  const exitPromise = waitForNodeProcessExit(proc);
+  const cleanupChildOnHostSignal = (signal) => {
+    if (typeof proc.pid === "number") {
+      try {
+        process.kill(-proc.pid, signal);
+      } catch {
+      }
+    }
+  };
+  if (detached) {
+    process.once("SIGHUP", cleanupChildOnHostSignal);
+    process.once("SIGTERM", cleanupChildOnHostSignal);
+    process.once("SIGINT", cleanupChildOnHostSignal);
+  }
+  const detachSignalCleanup = () => {
+    if (!detached) return;
+    process.removeListener("SIGHUP", cleanupChildOnHostSignal);
+    process.removeListener("SIGTERM", cleanupChildOnHostSignal);
+    process.removeListener("SIGINT", cleanupChildOnHostSignal);
+  };
+  exitPromise.then(detachSignalCleanup, detachSignalCleanup);
+  const stdoutPromise = readNodeStream(proc.stdout);
+  const stderrPromise = readNodeStream(proc.stderr);
+  const killChild = (signal) => {
+    if (detached && typeof proc.pid === "number") {
+      try {
+        process.kill(-proc.pid, signal);
+        return;
+      } catch {
+      }
+    }
+    try {
+      proc.kill(signal);
+    } catch {
+    }
+  };
+  let timeout;
+  let detachTimer;
+  const timeoutResult = Symbol("timeout");
+  const abortResult = Symbol("abort");
+  const detachResult = Symbol("detach");
+  let abortListener;
+  const abortPromise = args.abortSignal ? new Promise((resolveAbort) => {
+    if (args.abortSignal.aborted) {
+      resolveAbort(abortResult);
+      return;
+    }
+    abortListener = () => resolveAbort(abortResult);
+    args.abortSignal.addEventListener("abort", abortListener, { once: true });
+  }) : null;
+  const effectiveDetachMs = resolveDetachMs(args.detachMs);
+  const detachPromise = new Promise((resolveDetach) => {
+    detachTimer = setTimeout(() => resolveDetach(detachResult), effectiveDetachMs);
+  });
+  const exitOrTimeoutPromise = timeoutMs ? Promise.race([
+    exitPromise,
+    new Promise((resolveTimeout) => {
+      timeout = setTimeout(() => resolveTimeout(timeoutResult), timeoutMs);
+    })
+  ]) : exitPromise;
+  const raceCandidates = [
+    exitOrTimeoutPromise,
+    detachPromise
+  ];
+  if (abortPromise) {
+    raceCandidates.push(abortPromise);
+  }
+  let raceWinner;
+  try {
+    raceWinner = await Promise.race(raceCandidates);
+  } catch (error) {
+    if (timeout) clearTimeout(timeout);
+    if (detachTimer) clearTimeout(detachTimer);
+    if (abortListener && args.abortSignal) {
+      args.abortSignal.removeEventListener("abort", abortListener);
+    }
+    if (isSpawnFailureError(error)) {
+      return spawnFailedCommandResult(error, args.outputLimit);
+    }
+    throw error;
+  }
+  if (timeout) clearTimeout(timeout);
+  if (detachTimer) clearTimeout(detachTimer);
+  if (abortListener && args.abortSignal) {
+    args.abortSignal.removeEventListener("abort", abortListener);
+  }
+  const timedOut = raceWinner === timeoutResult;
+  const aborted = raceWinner === abortResult;
+  const detachedProcess = raceWinner === detachResult;
+  if (timedOut || aborted) {
+    killChild("SIGTERM");
+    const forceKillTimer = setTimeout(() => {
+      killChild("SIGKILL");
+    }, 500);
+    try {
+      await exitPromise;
+    } catch {
+    } finally {
+      clearTimeout(forceKillTimer);
+    }
+  }
+  if (detachedProcess) {
+    exitPromise.catch(() => {
+    });
+    const pid = typeof proc.pid === "number" ? proc.pid : 0;
+    const label = deriveLabel(args.command.join(" "));
+    const pgid = pid;
+    const registry2 = getProcessRegistry();
+    registry2.add({ pid, pgid, command: args.command.join(" "), label });
+    proc.on("close", (code) => {
+      detachSignalCleanup();
+      registry2.markExited(pid, code ?? 1);
+    });
+    const immediate = effectiveDetachMs === 0;
+    const reason = immediate ? `command looks long-running; moved to background immediately (pid=${pid}, label=${label})` : `command detached to background after ${effectiveDetachMs}ms (pid=${pid}, label=${label})`;
+    return {
+      stdout: "",
+      stderr: `${reason}
+Use listProcesses to inspect or stop it.`,
+      exitCode: 0,
+      timedOut: false,
+      detached: true,
+      pid,
+      label,
+      content: JSON.stringify({
+        detached: true,
+        pid,
+        label,
+        status: "running",
+        ...immediate ? { reason: "long-running-command" } : {}
+      })
+    };
+  }
+  const [stdout, rawStderr] = await Promise.all([
+    stdoutPromise,
+    stderrPromise
+  ]);
+  const exitCode = aborted ? 130 : timedOut ? 124 : Number(raceWinner);
+  const stderr = aborted ? `${rawStderr.trim() ? `${rawStderr.trim()}
+` : ""}command aborted by signal
+` : timedOut ? `${rawStderr.trim() ? `${rawStderr.trim()}
+` : ""}command timed out after ${timeoutMs ?? "unknown"}ms
+` : rawStderr;
+  return {
+    stdout,
+    stderr,
+    exitCode,
+    timedOut,
+    aborted,
+    content: truncateToolOutput([
+      stdout.trim() ? `stdout:
+${stdout.trim()}` : "",
+      stderr.trim() ? `stderr:
+${stderr.trim()}` : "",
+      `exitCode: ${exitCode}`
+    ].filter(Boolean).join("\n\n"), args.outputLimit)
+  };
+}
+
+// packages/agent-runtime/capabilities/execShellCapability.ts
+function buildExecShellToolDefinition(toolName = "execShell") {
+  return {
+    type: "function",
+    function: {
+      name: toolName,
+      description: `Execute a shell command from the workspace root. Prefer one compound command (e.g. 'git status && git diff --stat') to perform complete verification in one step instead of multiple small roundtrips. Do not cd into guessed paths; commands already run from the workspace root. Commands block until exit. Long-running commands (sleep over ${IMMEDIATE_DETACH_SLEEP_THRESHOLD_SECONDS}s, dev servers, watchers) automatically detach to background returning {detached: true, pid, label}; for persistent services, prefer launchProcess.`,
+      parameters: {
+        type: "object",
+        properties: {
+          command: {
+            type: "string",
+            description: "Shell command to run (non-empty)."
+          },
+          cmd: {
+            type: "string",
+            description: "Compatibility alias for command."
+          }
+        }
+      }
+    }
+  };
+}
+function normalizeExecShellInput(input) {
+  if (input === null || input === void 0) {
+    throw new Error("execShell requires a non-empty command.");
+  }
+  if (typeof input === "string") {
+    const trimmed = input.trim();
+    if (!trimmed) {
+      throw new Error("execShell requires a non-empty command.");
+    }
+    if (trimmed.startsWith("{") && trimmed.endsWith("}")) {
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (parsed && typeof parsed === "object") {
+          return normalizeExecShellInput(parsed);
+        }
+      } catch {
+      }
+    }
+    return { command: trimmed };
+  }
+  if (typeof input === "object") {
+    const record = input;
+    let rawCommand = resolveShellCommandArg(record);
+    if (typeof rawCommand !== "string" || !rawCommand.trim()) {
+      const fallback = record.command ?? record.cmd;
+      if (typeof fallback === "string" && fallback.trim()) {
+        rawCommand = fallback;
+      }
+    }
+    const command = typeof rawCommand === "string" ? rawCommand.trim() : "";
+    if (!command) {
+      throw new Error("execShell requires a non-empty command.");
+    }
+    const activity = extractActivity(record);
+    return {
+      command,
+      ...record.shell !== void 0 ? { shell: record.shell } : {},
+      ...activity ? { activity } : {},
+      ...record.input !== void 0 ? { input: record.input } : {}
+    };
+  }
+  throw new Error("execShell requires a non-empty command.");
+}
+var execShellCapability = {
+  name: "execShell",
+  getToolDefinition(toolName = "execShell") {
+    return buildExecShellToolDefinition(toolName);
+  },
+  normalizeInput(input) {
+    return normalizeExecShellInput(input);
+  },
+  async invoke(ctx, normalized) {
+    const workspaceRoot = ctx.workspaceRoot || process.cwd();
+    const command = normalized.command;
+    if (ctx.restrictToWorkspace) {
+      const escapeToken = findWorkspaceShellEscapeToken(command);
+      if (escapeToken) {
+        return buildWorkspaceShellEscapeBlockedResult({ command, token: escapeToken });
+      }
+    }
+    const interactiveAuthCommand = extractInteractiveGhAuthCommand(command);
+    if (interactiveAuthCommand) {
+      const blocked = buildInteractiveCommandBlockedResult(interactiveAuthCommand);
+      return {
+        ...blocked,
+        metadata: {
+          ...blocked.metadata,
+          ...normalized.activity ? { activity: normalized.activity } : {}
+        }
+      };
+    }
+    const result = await runWorkspaceCommand({
+      workspaceRoot,
+      command: buildWorkspaceShellCommand({
+        toolName: "execShell",
+        command,
+        shell: normalized.shell
+      }),
+      timeoutMs: resolveExecShellTimeoutMs(ctx.commandTimeoutMs),
+      outputLimit: ctx.commandOutputLimit,
+      commandPrefix: ctx.commandPrefix,
+      abortSignal: ctx.abortSignal,
+      detachMs: isImmediateDetachShellCommand({ command }) ? 0 : ctx.detachMs,
+      stdin: typeof normalized.input === "string" ? normalized.input : void 0
+    });
+    return {
+      content: result.content,
+      metadata: {
+        command,
+        exitCode: result.exitCode,
+        timedOut: result.timedOut,
+        ...result.aborted ? { aborted: true } : {},
+        ...result.detached ? { detached: true, pid: result.pid, label: result.label, status: "running" } : {},
+        ...normalized.activity ? { activity: normalized.activity } : {}
+      }
+    };
+  }
+};
+
+// packages/agent-runtime/localWorkspaceToolDefs.ts
+var WORKSPACE_TOOL_NAMES = [
+  "listFiles",
+  "readFile",
+  "writeFile",
+  "editFile",
+  "globFiles",
+  "searchFiles",
+  "captureVisualState",
+  "execShell",
+  "launchProcess",
+  "listProcesses"
+];
+var SHELL_TOOL_NAMES = ["execShell", "launchProcess", "listProcesses"];
+var WORKSPACE_TOOL_NAME_SET = new Set(WORKSPACE_TOOL_NAMES);
+var REMOVED_WORKSPACE_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "gitStatus",
+  "gitDiff",
+  "gitCreateBranch",
+  "gitAdd",
+  "gitCommit",
+  "commitWorkspace"
+]);
+function buildWorkspacePathProperty() {
+  return {
+    type: "string",
+    minLength: 1,
+    description: "Path relative to the workspace root. Defaults to workspace root when omitted."
+  };
+}
+function buildListWorkspaceDescription(variant) {
+  if (variant === "brief") {
+    return "List files and directories inside a workspace directory.";
+  }
+  if (variant === "workflow") {
+    return "List directory overview inside workspace. Then use globFiles for path patterns, searchFiles for text discovery, and readFile for content.";
+  }
+  if (variant === "antiShell") {
+    return "List directory overview inside workspace. Prefer listFiles over shell ls/find commands.";
+  }
+  return "List files and directories inside a workspace folder. Defaults to shallow overview (depth 1).";
+}
+function buildListWorkspaceParameters(variant) {
+  const path = buildWorkspacePathProperty();
+  const maxDepth = {
+    type: "integer",
+    description: "Maximum directory depth to include. Defaults to 1 for the requested directory only."
+  };
+  const maxResults = {
+    type: "integer",
     description: "Maximum number of entries to return. Use a small value for large directories."
   };
   const entryType = {
@@ -1879,26 +2743,7 @@ function buildCaptureVisualStateTool() {
   };
 }
 function buildExecShellTool(toolName) {
-  return {
-    type: "function",
-    function: {
-      name: toolName,
-      description: `Execute a shell command from the workspace root. Prefer one compound command (e.g. 'git status && git diff --stat') to perform complete verification in one step instead of multiple small roundtrips. Do not cd into guessed paths; commands already run from the workspace root. Commands block until exit. Long-running commands (sleep over ${IMMEDIATE_DETACH_SLEEP_THRESHOLD_SECONDS}s, dev servers, watchers) automatically detach to background returning {detached: true, pid, label}; for persistent services, prefer launchProcess.`,
-      parameters: {
-        type: "object",
-        properties: {
-          cmd: {
-            type: "string",
-            description: "Shell command to run (non-empty)."
-          },
-          command: {
-            type: "string",
-            description: "Compatibility alias for cmd."
-          }
-        }
-      }
-    }
-  };
+  return buildExecShellToolDefinition(toolName);
 }
 function buildLaunchProcessTool() {
   return {
@@ -1922,88 +2767,21 @@ function buildLaunchProcessTool() {
             description: "Keep process alive after session/conversation closes. Defaults to false."
           }
         },
-        required: ["command"]
-      }
-    }
-  };
-}
-function buildListProcessesTool() {
-  return {
-    type: "function",
-    function: {
-      name: "listProcesses",
-      description: "List active background processes launched via launchProcess. Returns {pid, label, command, status, startedAt, persist}[].",
-      parameters: {
-        type: "object",
-        properties: {}
-      }
-    }
-  };
-}
-function wrapPowerShellCommand(command) {
-  return [
-    "[Console]::InputEncoding=[System.Text.Encoding]::UTF8",
-    "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8",
-    "$OutputEncoding=[System.Text.Encoding]::UTF8",
-    "$PSStyle.OutputRendering='PlainText'",
-    command
-  ].join("; ");
-}
-function findPowerShellExecutable() {
-  return resolveExecutableOnPath("pwsh") || resolveExecutableOnPath("powershell.exe") || resolveExecutableOnPath("powershell");
-}
-function buildPowerShellCommand(command) {
-  const executable = findPowerShellExecutable();
-  if (!executable) throw new Error("PowerShell is not available on this machine.");
-  return [
-    executable,
-    "-NoLogo",
-    "-NoProfile",
-    "-NonInteractive",
-    "-ExecutionPolicy",
-    "Bypass",
-    "-Command",
-    wrapPowerShellCommand(command)
-  ];
-}
-function buildBashCommand(command) {
-  const executable = resolveExecutableOnPath("bash") || resolveExecutableOnPath("sh");
-  if (!executable) throw new Error("bash/sh is not available on this machine.");
-  return [executable, "-lc", command];
-}
-function buildWorkspaceShellCommand(args) {
-  if (args.shell === "powershell") return buildPowerShellCommand(args.command);
-  if (args.shell === "bash") return buildBashCommand(args.command);
-  return process.platform === "win32" ? buildPowerShellCommand(args.command) : buildBashCommand(args.command);
-}
-function findWorkspaceShellEscapeToken(command) {
-  const tokens = tokenizeShellPrefix(command);
-  for (const token of tokens) {
-    if (token === ".." || token.startsWith("../") || token.startsWith("..\\") || token.includes("/../") || token.includes("\\..\\")) {
-      return token;
-    }
-    if (token === "~" || token.startsWith("~/") || token.startsWith("~\\")) {
-      return token;
-    }
-    if (token === "/" || token.startsWith("/") || /^[A-Za-z]:[\\/]/.test(token) || token.startsWith("\\\\")) {
-      return token;
+        required: ["command"]
+      }
     }
-  }
-  return null;
+  };
 }
-function buildWorkspaceShellEscapeBlockedResult(args) {
+function buildListProcessesTool() {
   return {
-    content: [
-      "workspace_shell_escape_blocked",
-      `blockedToken: ${args.token}`,
-      `command: ${args.command}`,
-      "Use paths relative to the authorized folder only.",
-      "exitCode: 126"
-    ].join("\n"),
-    metadata: {
-      exitCode: 126,
-      workspaceShellEscapeBlocked: true,
-      blockedToken: args.token
+    type: "function",
+    function: {
+      name: "listProcesses",
+      description: "List active background processes launched via launchProcess. Returns {pid, label, command, status, startedAt, persist}[].",
+      parameters: {
+        type: "object",
+        properties: {}
+      }
     }
   };
 }
@@ -2050,10 +2828,24 @@ function filterDeclaredWorkspaceToolNames(args) {
   );
 }
 
+// packages/agent-runtime/capabilities/capabilitySdk.ts
+var BUILTIN_CAPABILITIES = [
+  execShellCapability
+];
+async function invokeCapability(capabilityOrName, input, ctx = {}) {
+  const capability = typeof capabilityOrName === "string" ? BUILTIN_CAPABILITIES.find((c) => c.name === capabilityOrName) : capabilityOrName;
+  if (!capability) {
+    throw new Error(`Capability "${String(capabilityOrName)}" not found.`);
+  }
+  const normalizedInput = capability.normalizeInput(input);
+  await evaluateCapabilityPolicy(capability, normalizedInput, ctx);
+  if (ctx.onInvoke) {
+    await ctx.onInvoke(capability.name, normalizedInput);
+  }
+  return capability.invoke(ctx, normalizedInput);
+}
+
 // packages/agent-runtime/localWorkspaceTools.ts
-var EXEC_SHELL_TIMEOUT_ENV = "NOLO_EXEC_SHELL_TIMEOUT_MS";
-var EXEC_SHELL_DETACH_ENV = "NOLO_EXEC_SHELL_DETACH_MS";
-var DEFAULT_EXEC_SHELL_DETACH_MS = 12e4;
 var DEFAULT_LOCAL_API_ORIGIN = "http://127.0.0.1:38123";
 var ALWAYS_EXCLUDED_GLOBS = [
   "*.tsbuildinfo",
@@ -2073,7 +2865,7 @@ var ALWAYS_EXCLUDED_GLOBS = [
 ];
 var DEFAULT_SEARCH_MAX_RESULTS = 200;
 var SEARCH_OUTPUT_CHAR_LIMIT = 2e4;
-function readTrimmedString(value) {
+function readTrimmedString2(value) {
   return asOptionalTrimmedString(value);
 }
 function readBoolean(parsed, key) {
@@ -2086,168 +2878,6 @@ function readBoolean(parsed, key) {
   }
   return void 0;
 }
-function resolveExecShellTimeoutMs(override) {
-  const fromOverride = asOptionalPositiveFiniteNumber(override);
-  if (fromOverride !== void 0) return fromOverride;
-  const raw = process.env[EXEC_SHELL_TIMEOUT_ENV];
-  if (raw === void 0) return void 0;
-  return asOptionalPositiveFiniteNumber(Number(raw));
-}
-function resolveDetachMs(override) {
-  if (typeof override === "number" && Number.isFinite(override) && override >= 0) {
-    return override;
-  }
-  const raw = process.env[EXEC_SHELL_DETACH_ENV];
-  if (raw === void 0) return DEFAULT_EXEC_SHELL_DETACH_MS;
-  const parsed = asOptionalPositiveFiniteNumber(Number(raw));
-  return parsed === void 0 ? DEFAULT_EXEC_SHELL_DETACH_MS : parsed;
-}
-function extractInteractiveGhAuthCommand(command) {
-  const tokens = tokenizeShellPrefix(command);
-  if (tokens[0] !== "gh" || tokens[1] !== "auth") return null;
-  const subcommand = tokens[2];
-  if (subcommand !== "login" && subcommand !== "refresh") return null;
-  if (tokens.includes("--help")) return null;
-  const result = ["gh", "auth", subcommand];
-  for (let index = 3; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (!token) continue;
-    if (token === "-h" || token === "--hostname" || token === "-s" || token === "--scopes" || token === "--remove-scopes" || token === "-r") {
-      const value = tokens[index + 1];
-      if (value) {
-        result.push(token, value);
-        index += 1;
-      }
-      continue;
-    }
-    if (token === "--clipboard" || token === "-c" || token === "--insecure-storage" || token === "--reset-scopes") {
-      result.push(token);
-      continue;
-    }
-    if (token.startsWith("--hostname=") || token.startsWith("--scopes=") || token.startsWith("--remove-scopes=")) {
-      result.push(token);
-      continue;
-    }
-  }
-  return result.join(" ");
-}
-function splitShellWords(command) {
-  return tokenizeShellPrefix(command);
-}
-function buildInteractiveCommandBlockedResult(command) {
-  const argv = splitShellWords(command);
-  return {
-    content: [
-      "action_gate: handoff",
-      `command: ${command}`,
-      "Run this in the current TUI terminal, then resume the agent turn.",
-      "exitCode: 130"
-    ].join("\n"),
-    metadata: {
-      exitCode: 130,
-      timedOut: false,
-      actionGate: {
-        id: `gate-${Date.now().toString(36)}-terminal-handoff`,
-        kind: "handoff",
-        title: "This command requires an interactive terminal.",
-        body: "Complete it in the terminal, then nolo will continue.",
-        payload: {
-          command: argv,
-          displayCommand: command
-        }
-      },
-      reason: "interactive-command-requires-terminal"
-    }
-  };
-}
-function extractActivityRefs(rawRefs) {
-  if (!Array.isArray(rawRefs)) return void 0;
-  const refs = rawRefs.flatMap((entry) => {
-    if (!isRecord(entry)) return [];
-    if (entry.type === "file") {
-      const path = readTrimmedString(entry.path);
-      return path ? [{ type: "file", path }] : [];
-    }
-    if (entry.type === "terminal") {
-      const id = readTrimmedString(entry.id);
-      const label = readTrimmedString(entry.label);
-      return id || label ? [{ type: "terminal", ...id ? { id } : {}, ...label ? { label } : {} }] : [];
-    }
-    if (entry.type === "url") {
-      const url = readTrimmedString(entry.url);
-      const label = readTrimmedString(entry.label);
-      return url ? [{ type: "url", url, ...label ? { label } : {} }] : [];
-    }
-    return [];
-  });
-  return refs.length ? refs : void 0;
-}
-function extractActivityAction(rawAction) {
-  if (!isRecord(rawAction)) return void 0;
-  const title = readTrimmedString(rawAction.title);
-  if (!title) return void 0;
-  const kind = readTrimmedString(rawAction.kind);
-  const detail = readTrimmedString(rawAction.detail);
-  const refs = extractActivityRefs(rawAction.refs);
-  return {
-    title,
-    ...kind ? { kind } : {},
-    ...detail ? { detail } : {},
-    ...refs ? { refs } : {}
-  };
-}
-function extractActivityPhase(rawPhase) {
-  if (!isRecord(rawPhase)) return void 0;
-  const title = readTrimmedString(rawPhase.title);
-  if (!title) return void 0;
-  const id = readTrimmedString(rawPhase.id) || title.toLowerCase().replace(/\s+/g, "-");
-  const index = asOptionalFiniteNumber(rawPhase.index);
-  const total = asOptionalFiniteNumber(rawPhase.total);
-  const status = rawPhase.status === "pending" || rawPhase.status === "running" || rawPhase.status === "success" || rawPhase.status === "failed" ? rawPhase.status : void 0;
-  return {
-    id,
-    title,
-    ...index !== void 0 ? { index } : {},
-    ...total !== void 0 ? { total } : {},
-    ...status ? { status } : {}
-  };
-}
-function extractActivityPlan(rawPlan) {
-  if (!isRecord(rawPlan)) return void 0;
-  if (!Array.isArray(rawPlan.phases)) return void 0;
-  const phases = rawPlan.phases.flatMap((entry, index) => {
-    const phase = extractActivityPhase(entry);
-    if (!phase) return [];
-    return [{
-      id: phase.id,
-      title: phase.title,
-      index: phase.index ?? index + 1,
-      ...phase.status ? { status: phase.status } : {}
-    }];
-  });
-  if (phases.length === 0) return void 0;
-  const title = readTrimmedString(rawPlan.title);
-  return {
-    ...title ? { title } : {},
-    phases
-  };
-}
-function extractActivity(parsed) {
-  const raw = parsed._activity;
-  if (!isRecord(raw)) return void 0;
-  const nestedAction = extractActivityAction(raw.action);
-  const legacyAction = extractActivityAction(raw);
-  const action = nestedAction || legacyAction;
-  const phase = extractActivityPhase(raw.phase);
-  const plan = extractActivityPlan(raw.plan);
-  if (!action && !plan) return void 0;
-  return {
-    ...action ? action : {},
-    ...phase ? { phase } : {},
-    ...nestedAction ? { action: nestedAction } : {},
-    ...plan ? { plan } : {}
-  };
-}
 function buildLocalWorkspaceToolset(args) {
   const exposeShellTools = args.exposeShellTools === true;
   if (args.useDeclaredToolNamesOnly) {
@@ -2650,7 +3280,7 @@ function readVisualStateCaptureArgs(args) {
 }
 async function readWorkspacePackageScripts(workspaceRoot) {
   try {
-    const raw = await readFile(resolve(workspaceRoot, "package.json"), "utf8");
+    const raw = await readFile(resolve2(workspaceRoot, "package.json"), "utf8");
     const parsed = JSON.parse(raw);
     const scripts = parsed && typeof parsed === "object" && parsed.scripts && typeof parsed.scripts === "object" ? Object.keys(parsed.scripts).sort() : [];
     return { scripts };
@@ -2685,97 +3315,35 @@ async function runWorkspacePackageScript(args) {
       }
     };
   }
-  const result = await runWorkspaceCommand({
-    workspaceRoot: args.workspaceRoot,
-    command: ["bun", "run", script, ...extraArgs.length ? ["--", ...extraArgs] : []],
-    timeoutMs: args.commandTimeoutMs
-  });
-  return {
-    content: result.content,
-    metadata: {
-      script,
-      args: extraArgs,
-      exitCode: result.exitCode,
-      reason: result.exitCode === 0 ? "ok" : "script-failed",
-      timedOut: result.timedOut,
-      stdoutTail: result.stdout.trim().slice(-4e3),
-      stderrTail: result.stderr.trim().slice(-4e3)
-    }
-  };
-}
-function truncateToolOutput(value, limit = 2e4) {
-  if (value.length <= limit) return value;
-  const approxMarkerLen = 40;
-  if (limit <= approxMarkerLen) return value.slice(0, limit);
-  const remaining = limit - approxMarkerLen;
-  const headSize = Math.floor(remaining * 0.3);
-  const tailSize = remaining - headSize;
-  const head = value.slice(0, headSize);
-  const tail = value.slice(-tailSize);
-  const actualRemoved = value.length - headSize - tailSize;
-  return `${head}
-
-[... truncated ${actualRemoved} chars ...]
-
-${tail}`;
-}
-function parseLastJsonObject(text) {
-  const trimmed = text.trim();
-  for (let index = trimmed.lastIndexOf("{"); index >= 0; index = trimmed.lastIndexOf("{", index - 1)) {
-    try {
-      const parsed = JSON.parse(trimmed.slice(index));
-      return parsed && typeof parsed === "object" ? parsed : null;
-    } catch {
-    }
-  }
-  return null;
-}
-function readNodeStream(stream) {
-  if (!stream) return Promise.resolve("");
-  return new Promise((resolveRead, rejectRead) => {
-    const chunks = [];
-    stream.on("data", (chunk) => {
-      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
-    });
-    stream.on("error", rejectRead);
-    stream.on("end", () => resolveRead(Buffer.concat(chunks).toString("utf8")));
-  });
-}
-function waitForNodeProcessExit(proc) {
-  return new Promise((resolveExit, rejectExit) => {
-    proc.once("error", rejectExit);
-    proc.once("close", (code, signal) => {
-      if (typeof code === "number") {
-        resolveExit(code);
-        return;
-      }
-      resolveExit(signal ? 1 : 0);
-    });
-  });
-}
-function isSpawnFailureError(error) {
-  if (!error || typeof error !== "object") return false;
-  const err = error;
-  if (err.code === "ENOENT") return true;
-  const message = toErrorMessage(error).toLowerCase();
-  return message.includes("enoent") || message.includes("executable not found") || message.includes("spawn") && message.includes("not found");
-}
-function spawnFailedCommandResult(error, outputLimit) {
-  const stderr = `spawn failed: ${toErrorMessage(error)}
-`;
+  const result = await runWorkspaceCommand({
+    workspaceRoot: args.workspaceRoot,
+    command: ["bun", "run", script, ...extraArgs.length ? ["--", ...extraArgs] : []],
+    timeoutMs: args.commandTimeoutMs
+  });
   return {
-    stdout: "",
-    stderr,
-    exitCode: 127,
-    timedOut: false,
-    spawnFailed: true,
-    content: truncateToolOutput(
-      [`stderr:
-${stderr.trim()}`, "exitCode: 127"].filter(Boolean).join("\n\n"),
-      outputLimit
-    )
+    content: result.content,
+    metadata: {
+      script,
+      args: extraArgs,
+      exitCode: result.exitCode,
+      reason: result.exitCode === 0 ? "ok" : "script-failed",
+      timedOut: result.timedOut,
+      stdoutTail: result.stdout.trim().slice(-4e3),
+      stderrTail: result.stderr.trim().slice(-4e3)
+    }
   };
 }
+function parseLastJsonObject(text) {
+  const trimmed = text.trim();
+  for (let index = trimmed.lastIndexOf("{"); index >= 0; index = trimmed.lastIndexOf("{", index - 1)) {
+    try {
+      const parsed = JSON.parse(trimmed.slice(index));
+      return parsed && typeof parsed === "object" ? parsed : null;
+    } catch {
+    }
+  }
+  return null;
+}
 function resolveRipgrepBinary(env = process.env) {
   const fromEnv = asOptionalTrimmedString(env.NOLO_BUNDLED_RG);
   if (fromEnv) {
@@ -2789,185 +3357,13 @@ function resolveRipgrepBinary(env = process.env) {
 function resolveGrepBinary() {
   return resolveExecutableOnPath("grep");
 }
-async function runWorkspaceCommand(args) {
-  const timeoutMs = asOptionalPositiveFiniteNumber(args.timeoutMs);
-  const detached = process.platform !== "win32";
-  const command = [
-    ...args.commandPrefix ?? [],
-    ...args.command
-  ];
-  const proc = spawnChildProcess(command[0] ?? "", command.slice(1), {
-    cwd: resolve(args.workspaceRoot),
-    stdio: [
-      args.stdin === void 0 ? "ignore" : "pipe",
-      "pipe",
-      "pipe"
-    ],
-    detached
-  });
-  if (args.stdin !== void 0 && proc.stdin) {
-    proc.stdin.write(args.stdin);
-    proc.stdin.end();
-  }
-  const exitPromise = waitForNodeProcessExit(proc);
-  const cleanupChildOnHostSignal = (signal) => {
-    if (typeof proc.pid === "number") {
-      try {
-        process.kill(-proc.pid, signal);
-      } catch {
-      }
-    }
-  };
-  if (detached) {
-    process.once("SIGHUP", cleanupChildOnHostSignal);
-    process.once("SIGTERM", cleanupChildOnHostSignal);
-    process.once("SIGINT", cleanupChildOnHostSignal);
-  }
-  const detachSignalCleanup = () => {
-    if (!detached) return;
-    process.removeListener("SIGHUP", cleanupChildOnHostSignal);
-    process.removeListener("SIGTERM", cleanupChildOnHostSignal);
-    process.removeListener("SIGINT", cleanupChildOnHostSignal);
-  };
-  exitPromise.then(detachSignalCleanup, detachSignalCleanup);
-  const stdoutPromise = readNodeStream(proc.stdout);
-  const stderrPromise = readNodeStream(proc.stderr);
-  const killChild = (signal) => {
-    if (detached && typeof proc.pid === "number") {
-      try {
-        process.kill(-proc.pid, signal);
-        return;
-      } catch {
-      }
-    }
-    try {
-      proc.kill(signal);
-    } catch {
-    }
-  };
-  let timeout;
-  let detachTimer;
-  const timeoutResult = Symbol("timeout");
-  const abortResult = Symbol("abort");
-  const detachResult = Symbol("detach");
-  let abortListener;
-  const abortPromise = args.abortSignal ? new Promise((resolveAbort) => {
-    if (args.abortSignal.aborted) {
-      resolveAbort(abortResult);
-      return;
-    }
-    abortListener = () => resolveAbort(abortResult);
-    args.abortSignal.addEventListener("abort", abortListener, { once: true });
-  }) : null;
-  const effectiveDetachMs = resolveDetachMs(args.detachMs);
-  const detachPromise = new Promise((r) => {
-    detachTimer = setTimeout(() => r(detachResult), effectiveDetachMs);
-  });
-  const racers = [exitPromise];
-  if (timeoutMs) {
-    racers.push(
-      new Promise((resolveTimeout) => {
-        timeout = setTimeout(() => resolveTimeout(timeoutResult), timeoutMs);
-      })
-    );
-  }
-  if (abortPromise) racers.push(abortPromise);
-  racers.push(detachPromise);
-  let raceWinner;
-  try {
-    raceWinner = await Promise.race(racers);
-  } catch (error) {
-    if (timeout) clearTimeout(timeout);
-    if (detachTimer) clearTimeout(detachTimer);
-    if (abortListener && args.abortSignal) {
-      args.abortSignal.removeEventListener("abort", abortListener);
-    }
-    detachSignalCleanup();
-    if (isSpawnFailureError(error)) {
-      return spawnFailedCommandResult(error, args.outputLimit);
-    }
-    throw error;
-  }
-  if (timeout) clearTimeout(timeout);
-  if (detachTimer) clearTimeout(detachTimer);
-  if (abortListener && args.abortSignal) {
-    args.abortSignal.removeEventListener("abort", abortListener);
-  }
-  const timedOut = raceWinner === timeoutResult;
-  const aborted = raceWinner === abortResult;
-  const didDetach = raceWinner === detachResult;
-  if (timedOut || aborted) {
-    killChild("SIGTERM");
-    await Promise.race([
-      exitPromise.catch(() => 124),
-      new Promise((resolveKill) => setTimeout(resolveKill, 500))
-    ]);
-    killChild("SIGKILL");
-  }
-  if (didDetach) {
-    exitPromise.catch(() => {
-    });
-    const pid = typeof proc.pid === "number" ? proc.pid : 0;
-    const label = deriveLabel(args.command.join(" "));
-    const pgid = pid;
-    const registry2 = getProcessRegistry();
-    registry2.add({ pid, pgid, command: args.command.join(" "), label });
-    proc.on("close", (code) => {
-      detachSignalCleanup();
-      registry2.markExited(pid, code ?? 1);
-    });
-    const immediate = effectiveDetachMs === 0;
-    const reason = immediate ? `command looks long-running; moved to background immediately (pid=${pid}, label=${label})` : `command detached to background after ${effectiveDetachMs}ms (pid=${pid}, label=${label})`;
-    return {
-      stdout: "",
-      stderr: `${reason}
-Use listProcesses to inspect or stop it.`,
-      exitCode: 0,
-      timedOut: false,
-      detached: true,
-      pid,
-      label,
-      content: JSON.stringify({
-        detached: true,
-        pid,
-        label,
-        status: "running",
-        ...immediate ? { reason: "long-running-command" } : {}
-      })
-    };
-  }
-  const [stdout, rawStderr] = await Promise.all([
-    stdoutPromise,
-    stderrPromise
-  ]);
-  const exitCode = aborted ? 130 : timedOut ? 124 : Number(raceWinner);
-  const stderr = aborted ? `${rawStderr.trim() ? `${rawStderr.trim()}
-` : ""}command aborted by signal
-` : timedOut ? `${rawStderr.trim() ? `${rawStderr.trim()}
-` : ""}command timed out after ${timeoutMs ?? "unknown"}ms
-` : rawStderr;
-  return {
-    stdout,
-    stderr,
-    exitCode,
-    timedOut,
-    aborted,
-    content: truncateToolOutput([
-      stdout.trim() ? `stdout:
-${stdout.trim()}` : "",
-      stderr.trim() ? `stderr:
-${stderr.trim()}` : "",
-      `exitCode: ${exitCode}`
-    ].filter(Boolean).join("\n\n"), args.outputLimit)
-  };
-}
 async function runWorkspaceCommandLimitedLines(args) {
   const command = [
     ...args.commandPrefix ?? [],
     ...args.command
   ];
-  const proc = spawnChildProcess(command[0] ?? "", command.slice(1), {
-    cwd: resolve(args.workspaceRoot),
+  const proc = spawnChildProcess2(command[0] ?? "", command.slice(1), {
+    cwd: resolve2(args.workspaceRoot),
     stdio: ["ignore", "pipe", "pipe"],
     detached: false
   });
@@ -3058,8 +3454,8 @@ async function runWorkspaceCommandLimitedLines(args) {
   };
 }
 async function resolveLocalWorkspaceToolPath(args) {
-  const workspaceRoot = resolve(args.workspaceRoot);
-  const targetPath = resolve(workspaceRoot, args.requestedPath);
+  const workspaceRoot = resolve2(args.workspaceRoot);
+  const targetPath = resolve2(workspaceRoot, args.requestedPath);
   if (!isPathInsideWorkspace({ workspaceRoot, targetPath })) {
     if (args.confirmExternalFileAccess) {
       const request = {
@@ -3151,7 +3547,7 @@ async function readFileTool(args) {
   });
   const isTruncated = sliced.truncated || truncatedRead.truncatedByCharLimit;
   const relativePath = normalizeWorkspaceRelativePath({
-    workspaceRoot: resolve(args.workspaceRoot),
+    workspaceRoot: resolve2(args.workspaceRoot),
     targetPath: absolutePath
   });
   const force = parsed.force === true;
@@ -3218,7 +3614,7 @@ async function writeFileTool(args) {
   await mkdir(dirname(absolutePath), { recursive: true });
   await writeFile(absolutePath, content, "utf8");
   const relativePath = normalizeWorkspaceRelativePath({
-    workspaceRoot: resolve(args.workspaceRoot),
+    workspaceRoot: resolve2(args.workspaceRoot),
     targetPath: absolutePath
   });
   const activity = extractActivity(parsed);
@@ -3274,7 +3670,7 @@ async function editFileTool(args) {
   }
   await writeFile(absolutePath, nextContent, "utf8");
   const relativePath = normalizeWorkspaceRelativePath({
-    workspaceRoot: resolve(args.workspaceRoot),
+    workspaceRoot: resolve2(args.workspaceRoot),
     targetPath: absolutePath
   });
   const activity = extractActivity(parsed);
@@ -3300,11 +3696,11 @@ async function listWorkspaceEntries(args) {
     const names = (await readdir(dirPath)).sort((left, right) => left.localeCompare(right));
     for (const name of names) {
       if (truncated) break;
-      const absolutePath = resolve(dirPath, name);
+      const absolutePath = resolve2(dirPath, name);
       const info = await stat(absolutePath);
       visitedEntries += 1;
       const relativePath = normalizeWorkspaceRelativePath({
-        workspaceRoot: resolve(args.workspaceRoot),
+        workspaceRoot: resolve2(args.workspaceRoot),
         targetPath: absolutePath
       });
       const isDirectory = info.isDirectory();
@@ -3383,7 +3779,7 @@ async function searchFilesTool(args) {
     ...args.confirmExternalFileAccess ? { confirmExternalFileAccess: args.confirmExternalFileAccess } : {}
   });
   const relativeSearchPath = normalizeWorkspaceRelativePath({
-    workspaceRoot: resolve(args.workspaceRoot),
+    workspaceRoot: resolve2(args.workspaceRoot),
     targetPath: searchPath
   });
   const rgBinary = (args.resolveRipgrepBinary ?? resolveRipgrepBinary)();
@@ -3537,7 +3933,7 @@ async function searchFilesTool(args) {
 }
 async function hasRootGitignore(workspaceRoot) {
   try {
-    await stat(resolve(workspaceRoot, ".gitignore"));
+    await stat(resolve2(workspaceRoot, ".gitignore"));
     return true;
   } catch {
     return false;
@@ -3545,7 +3941,7 @@ async function hasRootGitignore(workspaceRoot) {
 }
 async function readRootGitignorePatterns(workspaceRoot) {
   try {
-    const content = await readFile(resolve(workspaceRoot, ".gitignore"), "utf8");
+    const content = await readFile(resolve2(workspaceRoot, ".gitignore"), "utf8");
     return content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#") && !line.startsWith("!")).map((line) => {
       const unanchored = line.replace(/^\//, "");
       return unanchored.endsWith("/") ? `${unanchored}**` : unanchored;
@@ -3614,7 +4010,7 @@ async function scanWorkspaceTextMatches(args) {
   for (const file of files) {
     let content = "";
     try {
-      content = await readFile(resolve(args.workspaceRoot, file), "utf8");
+      content = await readFile(resolve2(args.workspaceRoot, file), "utf8");
     } catch {
       continue;
     }
@@ -3659,7 +4055,7 @@ async function globFilesTool(args) {
     ...args.confirmExternalFileAccess ? { confirmExternalFileAccess: args.confirmExternalFileAccess } : {}
   });
   const relativeSearchPath = normalizeWorkspaceRelativePath({
-    workspaceRoot: resolve(args.workspaceRoot),
+    workspaceRoot: resolve2(args.workspaceRoot),
     targetPath: searchPath
   });
   const pathPrefix = relativeSearchPath === "." ? "" : `${relativeSearchPath.replace(/\/+$/, "")}/`;
@@ -3819,63 +4215,24 @@ async function captureVisualStateTool(args) {
   };
 }
 async function execShellTool(args) {
-  const parsed = parseWorkspaceToolArguments(args.call.arguments);
-  const command = requireShellCommand(parsed, args.call.name);
-  if (args.restrictToWorkspace) {
-    const escapeToken = findWorkspaceShellEscapeToken(command);
-    if (escapeToken) {
-      return buildWorkspaceShellEscapeBlockedResult({ command, token: escapeToken });
-    }
-  }
-  const interactiveAuthCommand = extractInteractiveGhAuthCommand(command);
-  if (interactiveAuthCommand) {
-    const activity2 = extractActivity(parsed);
-    const blocked = buildInteractiveCommandBlockedResult(interactiveAuthCommand);
-    return {
-      ...blocked,
-      metadata: {
-        ...blocked.metadata,
-        ...activity2 ? { activity: activity2 } : {}
-      }
-    };
-  }
-  const result = await runWorkspaceCommand({
-    workspaceRoot: args.workspaceRoot,
-    command: buildWorkspaceShellCommand({
-      toolName: args.call.name,
-      command,
-      shell: parsed.shell
-    }),
-    timeoutMs: resolveExecShellTimeoutMs(args.commandTimeoutMs),
-    outputLimit: args.commandOutputLimit,
-    commandPrefix: args.commandPrefix,
-    abortSignal: args.abortSignal,
-    // Commands that clearly never exit (long sleeps, tail -f, watch, dev
-    // servers, infinite loops) are promoted to background immediately so the
-    // turn — and the user's conversation — keeps going. Everything else keeps
-    // the caller/env detach grace window.
-    detachMs: isImmediateDetachShellCommand({ command }) ? 0 : args.detachMs
-  });
-  const activity = extractActivity(parsed);
-  return {
-    content: result.content,
-    metadata: {
-      command,
-      exitCode: result.exitCode,
-      timedOut: result.timedOut,
-      ...result.aborted ? { aborted: true } : {},
-      ...result.detached ? { detached: true, pid: result.pid, label: result.label, status: "running" } : {},
-      ...activity ? { activity } : {}
+  return invokeCapability(
+    "execShell",
+    args.call.arguments,
+    {
+      workspaceRoot: args.workspaceRoot,
+      commandTimeoutMs: args.commandTimeoutMs,
+      commandOutputLimit: args.commandOutputLimit,
+      commandPrefix: args.commandPrefix,
+      restrictToWorkspace: args.restrictToWorkspace,
+      abortSignal: args.abortSignal,
+      detachMs: args.detachMs,
+      confirmed: args.confirmed,
+      enableDestructiveShellGuard: args.enableDestructiveShellGuard,
+      confirmDestructiveAction: args.confirmDestructiveAction,
+      blockDestructiveWithoutConfirmation: args.blockDestructiveWithoutConfirmation,
+      onInvoke: args.onInvoke
     }
-  };
-}
-function deriveLabel(command) {
-  const trimmed = command.trim();
-  if (!trimmed) return "process";
-  const tokens = trimmed.split(/\s+/);
-  const lastToken = tokens[tokens.length - 1] ?? trimmed;
-  const labelCandidate = lastToken.split(/[/\\]/).pop() || lastToken;
-  return labelCandidate || trimmed;
+  );
 }
 async function launchProcessTool(args) {
   const parsed = parseWorkspaceToolArguments(args.call.arguments);
@@ -3886,7 +4243,7 @@ async function launchProcessTool(args) {
       return buildWorkspaceShellEscapeBlockedResult({ command, token: escapeToken });
     }
   }
-  const labelArg = readTrimmedString(parsed.label);
+  const labelArg = readTrimmedString2(parsed.label);
   const label = labelArg || deriveLabel(command);
   const persist = readBoolean(parsed, "persist");
   const fullCommand = buildWorkspaceShellCommand({
@@ -3899,8 +4256,8 @@ async function launchProcessTool(args) {
     ...fullCommand
   ];
   const detached = process.platform !== "win32";
-  const proc = spawnChildProcess(cmdArgs[0] ?? "", cmdArgs.slice(1), {
-    cwd: resolve(args.workspaceRoot),
+  const proc = spawnChildProcess2(cmdArgs[0] ?? "", cmdArgs.slice(1), {
+    cwd: resolve2(args.workspaceRoot),
     stdio: ["ignore", "pipe", "pipe"],
     detached
   });
@@ -4015,7 +4372,12 @@ function createLocalWorkspaceToolExecutors(args) {
       commandPrefix: args.commandPrefix,
       restrictToWorkspace: args.restrictShellToWorkspace,
       abortSignal: opts?.abortSignal ?? args.abortSignal,
-      detachMs: opts?.detachMs ?? args.detachMs
+      detachMs: opts?.detachMs ?? args.detachMs,
+      confirmed: opts?.confirmed,
+      enableDestructiveShellGuard: opts?.enableDestructiveShellGuard,
+      confirmDestructiveAction: opts?.confirmDestructiveAction,
+      blockDestructiveWithoutConfirmation: opts?.blockDestructiveWithoutConfirmation,
+      onInvoke: opts?.onInvoke
     }),
     launchProcess: (call) => launchProcessTool({
       call,
@@ -4029,6 +4391,23 @@ function createLocalWorkspaceToolExecutors(args) {
   };
 }
 
+// packages/cli/client/localDialogRecords.ts
+var localDialogMessageRecordToRuntimeMessage = dialogMessageRecordToAgentRuntimeMessage;
+function buildLocalDialogWritePlan(args) {
+  return buildAgentRuntimeDialogWritePlan({
+    input: args.input,
+    userId: args.userId,
+    now: args.now,
+    createId: args.createId,
+    existingDialog: args.existingDialog,
+    runtimeHost: "cli",
+    runtimeMetadata: {
+      ...args.cwd ? { worktreePath: args.cwd } : {}
+    },
+    ...args.titleOverride ? { titleOverride: args.titleOverride } : {}
+  });
+}
+
 // packages/agent-runtime/noloWorkspaceTools.node.ts
 async function readNoloProcessStream(readable) {
   if (!readable) return "";
@@ -4065,10 +4444,67 @@ async function runNoloWorkspaceCliTool(call, args) {
     }
   };
 }
+async function readDialogInProcess(call, store, env) {
+  const args = parseNoloWorkspaceToolArguments(call.arguments);
+  const dialogInput = noloStringArg(args.dialog ?? args.dialogId ?? args.id);
+  if (!dialogInput) throw new Error("readDialog requires dialog.");
+  const mode = noloStringArg(args.mode);
+  if (mode && mode !== "full" && mode !== "status") {
+    throw new Error(`readDialog mode must be "full" or "status", got "${mode}".`);
+  }
+  const userId = noloStringArg(args.user ?? args.userId ?? args.owner) || env?.NOLO_LOCAL_USER_ID || env?.NOLO_USER_ID || "";
+  const { dbKey: dialogKey, dialogId } = resolveNoloDialogInput(dialogInput, userId);
+  const meta = await store.read(dialogKey, { remote: false });
+  if (mode === "status") {
+    const result2 = {
+      dialogId,
+      dialogKey,
+      meta,
+      status: meta?.status ?? null,
+      runtimeCheckpoint: meta?.runtimeCheckpoint ?? null,
+      source: "in-process"
+    };
+    return {
+      content: JSON.stringify(result2, null, 2),
+      metadata: { noloWorkspaceTool: true, readDialog: true, inProcess: true, mode: "status" }
+    };
+  }
+  const limitNum = noloPositiveIntegerString(args.limit);
+  const limit = limitNum ? Number(limitNum) : void 0;
+  const rawMessages = [];
+  if (store.iterator) {
+    const { start, end } = dialogMessageRange(dialogId);
+    for await (const [, value] of store.iterator({ gte: start, lte: end })) {
+      const message = localDialogMessageRecordToRuntimeMessage(value);
+      if (message) {
+        rawMessages.push(message);
+      } else if (value) {
+        rawMessages.push(value);
+      }
+    }
+  }
+  const messages = limit !== void 0 && rawMessages.length > limit ? rawMessages.slice(rawMessages.length - limit) : rawMessages;
+  const result = {
+    dialogId,
+    dialogKey,
+    meta,
+    messages,
+    messagesCount: messages.length,
+    source: "in-process"
+  };
+  return {
+    content: JSON.stringify(result, null, 2),
+    metadata: { noloWorkspaceTool: true, readDialog: true, inProcess: true }
+  };
+}
 function buildNoloWorkspaceCliToolExecutors(args) {
   const executors = {};
   for (const toolName of NOLO_WORKSPACE_TOOL_NAMES) {
     if (toolName === "loadSkill") continue;
+    if (toolName === "readDialog" && args.store) {
+      executors[toolName] = (call) => readDialogInProcess(call, args.store, args.env);
+      continue;
+    }
     executors[toolName] = (call) => runNoloWorkspaceCliTool(call, args);
   }
   return executors;
@@ -4086,10 +4522,10 @@ function buildLoadSkillExecutor(args) {
         metadata: { loadSkill: true, resolved: false }
       };
     }
-    const { resolveSkillByName } = await import("./skillDiscovery-5U6RYAHN.js");
+    const { resolveSkillByName } = await import("./skillDiscovery-KLLKXPUO.js");
     const resolved = resolveSkillByName(args.cwd, name);
     if (!resolved) {
-      const { resolveCodingBuiltinSlug, buildCodingSkillContentBySlug } = await import("./codingSkills-V35TRR4Y.js");
+      const { resolveCodingBuiltinSlug, buildCodingSkillContentBySlug } = await import("./codingSkills-DY5MINPG.js");
       const builtinSlug = resolveCodingBuiltinSlug(name);
       if (builtinSlug) {
         const body = buildCodingSkillContentBySlug(builtinSlug);
@@ -4124,7 +4560,7 @@ ${body}`,
   };
 }
 async function formatUnknownSkillMessage(cwd, requestedName) {
-  const { discoverSkills } = await import("./skillDiscovery-5U6RYAHN.js");
+  const { discoverSkills } = await import("./skillDiscovery-KLLKXPUO.js");
   let available = [];
   try {
     available = discoverSkills(cwd).map((s) => s.name);
@@ -4144,6 +4580,8 @@ export {
   isAgentCoolingDown,
   parseSseDataLineJson,
   parseSseDataLineObject,
+  codexStreamFailureStatus,
+  aggregateResponsesStream,
   buildOpenAiCompatibleChatCompletionRequest,
   parseOpenAiCompatibleChatCompletionResponse,
   readOpenAiCompatibleSseCompletion,
@@ -4165,6 +4603,8 @@ export {
   buildLocalWorkspacePolicyToolNames,
   buildLocalWorkspaceOpenAiTools,
   createLocalWorkspaceToolExecutors,
+  localDialogMessageRecordToRuntimeMessage,
+  buildLocalDialogWritePlan,
   buildNoloWorkspaceCliToolExecutors,
   buildLoadSkillExecutor
 };