nolo-cli 0.33.0-alpha.2 → 0.33.0-alpha.21

package/{chunk-LOD75GOS.js → chunk-REOW4YJX.js}

@@ -7,14 +7,30 @@ import {
   providerHttpFailure,
   readSseFrames,
   throwIfChatCompletionStreamFailed
-} from "./chunk-RAZOLMJR.js";
+} from "./chunk-EQ6HOWEJ.js";
 import {
   sanitizeForOutbound
 } from "./chunk-T27IEBNQ.js";
 import {
-  parseToolArgumentsJson,
-  resolveHistoricalToolContentCap
-} from "./chunk-6PO2SYCS.js";
+  buildExecShellToolDefinition,
+  buildWorkspaceShellCommand,
+  buildWorkspaceShellEscapeBlockedResult,
+  createGlob,
+  deriveLabel,
+  evaluateExecShellDestructiveGuard,
+  extractActivity,
+  findWorkspaceShellEscapeToken,
+  getProcessRegistry,
+  invokeCapability,
+  isSpawnFailureError,
+  readNodeStream,
+  resolveExecutableOnPath,
+  resolveHistoricalToolContentCap,
+  runWorkspaceCommand,
+  spawnToWebStreams,
+  truncateToolOutput,
+  waitForNodeProcessExit
+} from "./chunk-YH3FPBG6.js";
 import {
   createThinkParserState,
   createToolCallAccumulator,
@@ -25,7 +41,7 @@ import {
 import {
   requiresBareImageUrl,
   toBareImageUrlMessages
-} from "./chunk-5SBK2MTI.js";
+} from "./chunk-ZKUATCEY.js";
 import {
   convertMessagesToResponsesInput,
   extractReasoningFromResponseOutput,
@@ -39,7 +55,7 @@ import {
 import {
   buildProviderAuthHeaders,
   buildProviderExecutionPlan
-} from "./chunk-AFV4FOT2.js";
+} from "./chunk-OQVRTSZ5.js";
 import {
   NOLO_WORKSPACE_TOOL_NAMES,
   buildNoloWorkspaceCommandArgs,
@@ -64,24 +80,15 @@ import {
   dialogMessageKey,
   dialogMessageRange
 } from "./chunk-KMSZPTM6.js";
-import {
-  asOptionalFiniteNumber
-} from "./chunk-WWC7I6TA.js";
 import {
   asTrimmedNonEmptyStringArray
 } from "./chunk-I42VC5KR.js";
-import {
-  asTrimmedLowercaseString
-} from "./chunk-QSJ3HFEF.js";
 import {
   asTrimmedString
 } from "./chunk-3EUW3WEO.js";
 import {
   asOptionalPositiveFiniteNumber
 } from "./chunk-U6VC4MU4.js";
-import {
-  isRecord
-} from "./chunk-KUG52IAP.js";
 import {
   normalizeServerOrigin
 } from "./chunk-CF7PE763.js";
@@ -1033,219 +1040,6 @@ function createHybridRecordStore(deps) {
   };
 }
 
-// packages/agent-runtime/shellCommandPolicy.ts
-var DESTRUCTIVE_NEGATION_PATTERNS = [
-  "\u522B\u5220",
-  "\u522B\u5220\u9664",
-  "\u4E0D\u8981\u5220",
-  "\u4E0D\u8981\u5220\u9664",
-  "\u522B\u4E71\u5220",
-  "\u522B\u52A8",
-  "\u4E0D\u8981\u52A8",
-  "\u4E0D\u8981\u6E05\u7406",
-  "\u4E0D\u8981\u6E05\u7A7A",
-  "\u4E0D\u8981\u91CD\u7F6E",
-  "don't delete",
-  "do not delete",
-  "don't remove",
-  "do not remove",
-  "without deleting"
-];
-var EXPLICIT_DESTRUCTIVE_REQUEST_PATTERNS = [
-  "\u5220\u9664",
-  "\u5220\u6389",
-  "\u79FB\u9664",
-  "\u6E05\u7406",
-  "\u6E05\u7A7A",
-  "\u91CD\u7F6E",
-  "drop",
-  "delete",
-  "remove",
-  "erase",
-  "clean up",
-  "reset"
-];
-var SHELL_DESTRUCTIVE_PATTERNS = [
-  /\brm\s+(-[^\n\r]*\s+)?/i,
-  /\bremove-item\b/i,
-  /\bdel\s+\/?[a-z]*\s+/i,
-  /\berase\s+/i,
-  /\brmdir\s+/i,
-  /\brd\s+\/s\b/i,
-  /\bgit\s+reset\s+(--hard\b|--merge\b|--keep\b)/i,
-  /\bgit\s+clean\s+-[^\n\r]*f/i,
-  /\bgit\s+checkout\s+--\b/i,
-  /\bgit\s+restore\s+--source=/i
-];
-var SHELL_STRING_EXECUTION_PATTERNS = [
-  /\b(?:ba|da|z|k)?sh\b/i,
-  /\beval\b/i,
-  /\bexec\b/i,
-  /\bxargs\b/i,
-  /\bsource\s/i,
-  /\b(?:node|deno|bun)\s+(?:-\S+\s+)*(?:-e|--eval)\b/i,
-  /\bpython[\d.]*\s+(?:-\S+\s+)*-c\b/i,
-  /\b(?:perl|ruby)\s+(?:-\S+\s+)*-e\b/i
-];
-var stripQuotedSegments = (text) => {
-  let out = "";
-  let i = 0;
-  while (i < text.length) {
-    const ch = text[i];
-    if (ch === "\\") {
-      out += text.slice(i, i + 2);
-      i += 2;
-    } else if (ch === "'") {
-      const end = text.indexOf("'", i + 1);
-      if (end === -1) return out + text.slice(i);
-      out += "''";
-      i = end + 1;
-    } else if (ch === '"') {
-      let j = i + 1;
-      while (j < text.length && text[j] !== '"') {
-        j += text[j] === "\\" ? 2 : 1;
-      }
-      if (j >= text.length) return out + text.slice(i);
-      out += '""';
-      i = j + 1;
-    } else {
-      out += ch;
-      i += 1;
-    }
-  }
-  return out;
-};
-var normalizeUserInput = (value) => asTrimmedLowercaseString(value);
-var containsAny = (text, patterns) => patterns.some((pattern) => text.includes(pattern));
-var hasExplicitDestructivePermission = (userInput) => {
-  const normalized = normalizeUserInput(userInput);
-  if (!normalized) return false;
-  if (containsAny(normalized, DESTRUCTIVE_NEGATION_PATTERNS)) return false;
-  return containsAny(normalized, EXPLICIT_DESTRUCTIVE_REQUEST_PATTERNS);
-};
-var SHELL_COMMAND_ARG_ALIASES = [
-  "command",
-  "runCommand",
-  "run_command",
-  "terminalCommand",
-  "terminal_command",
-  "runInBash",
-  "run_in_bash",
-  "executeCommand",
-  "execute_command",
-  "execShell",
-  "bash",
-  "cmd"
-];
-var resolveShellCommandArg = (args) => {
-  if (!args) return void 0;
-  for (const key of SHELL_COMMAND_ARG_ALIASES) {
-    const value = args[key];
-    if (value != null) return value;
-  }
-  return void 0;
-};
-var buildCombinedShellInput = (args) => {
-  const command = resolveShellCommandArg(args);
-  return [
-    typeof command === "string" ? command : "",
-    typeof args.input === "string" ? args.input : ""
-  ].filter(Boolean).join("\n");
-};
-function resolveScannableShellInput(args) {
-  const combined = buildCombinedShellInput(args);
-  if (!combined.trim()) return void 0;
-  return SHELL_STRING_EXECUTION_PATTERNS.some(
-    (pattern) => pattern.test(combined)
-  ) ? combined : stripQuotedSegments(combined);
-}
-function isDestructiveShellCommand(args) {
-  const scannable = resolveScannableShellInput(args);
-  if (scannable === void 0) return false;
-  return SHELL_DESTRUCTIVE_PATTERNS.some((pattern) => pattern.test(scannable));
-}
-var LONG_RUNNING_COMMAND_PATTERNS = [
-  /\b(run|npm|yarn|pnpm|bun|npx)\s+(run\s+)?(dev|serve|start|watch)\b/i,
-  /(^|[\s=&|;])--watch\b/i,
-  /\bvite\b.*\b(dev|serve)\b/i,
-  /\bwebpack\b.*(?:--watch|serve)\b/i,
-  /\bnodemon\b/i,
-  /\bgatsby\b.*\b(develop|serve)\b/i,
-  /\bnext\b.*\b(dev|start)\b/i,
-  /\belectron\b.*\bdev\b/i,
-  /\bforever\b/i,
-  /\bpm2\b.*\bstart\b/i
-];
-function isLongRunningShellCommand(args) {
-  const scannable = resolveScannableShellInput(args);
-  if (scannable === void 0) return false;
-  return LONG_RUNNING_COMMAND_PATTERNS.some((pattern) => pattern.test(scannable));
-}
-var IMMEDIATE_DETACH_COMMAND_PATTERNS = [
-  /\btail\s+(?:-\S*[fF]\S*|--follow)\b/,
-  /\bwatch\s+\S/,
-  /\bwhile\s+(?:true|:|\[\s*true\s*\])\s*;\s*do\b/
-];
-var IMMEDIATE_DETACH_SLEEP_THRESHOLD_SECONDS = 5;
-var SLEEP_PREFIX_PATTERN = /^(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*(?:nohup\s+|time\s+)*sleep\s+(\S+)/;
-function parseSleepDurationSeconds(token) {
-  const match = /^(\d+(?:\.\d+)?)(s|m|h|d)?$/i.exec(token);
-  if (!match) return void 0;
-  const value = Number(match[1]);
-  if (!Number.isFinite(value)) return void 0;
-  const unit = (match[2] ?? "s").toLowerCase();
-  const factor = unit === "m" ? 60 : unit === "h" ? 3600 : unit === "d" ? 86400 : 1;
-  return value * factor;
-}
-function isLongSleepCommand(scannable) {
-  const match = SLEEP_PREFIX_PATTERN.exec(scannable.trim());
-  if (!match) return false;
-  const durationToken = match[1] ?? "";
-  if (/^inf(inity)?$/i.test(durationToken)) return true;
-  const seconds = parseSleepDurationSeconds(durationToken);
-  if (seconds === void 0) return true;
-  return seconds > IMMEDIATE_DETACH_SLEEP_THRESHOLD_SECONDS;
-}
-function isImmediateDetachShellCommand(args) {
-  const scannable = resolveScannableShellInput(args);
-  if (scannable === void 0) return false;
-  return isLongSleepCommand(scannable) || LONG_RUNNING_COMMAND_PATTERNS.some((pattern) => pattern.test(scannable)) || IMMEDIATE_DETACH_COMMAND_PATTERNS.some(
-    (pattern) => pattern.test(scannable)
-  );
-}
-function evaluateShellCommandPolicy(args) {
-  if (isDestructiveShellCommand(args) && !hasExplicitDestructivePermission(args.userInput)) {
-    return {
-      verdict: "forbidden",
-      permissionDecision: "ask",
-      code: "destructive_action_requires_confirmation",
-      reason: "\u5F53\u524D\u8FD0\u884C\u9ED8\u8BA4\u7981\u6B62\u81EA\u52A8\u6267\u884C\u53EF\u80FD\u5220\u9664\u7528\u6237\u5185\u5BB9\u7684 shell \u547D\u4EE4\u3002\u53EA\u6709\u5F53\u7528\u6237\u5728\u5F53\u524D\u8BF7\u6C42\u91CC\u660E\u786E\u8981\u6C42\u5220\u9664/\u6E05\u7406\u65F6\uFF0C\u624D\u80FD\u7EE7\u7EED\uFF1B\u5426\u5219\u8BF7\u505C\u6B62\u5E76\u5148\u8BF4\u660E\u9650\u5236\u3002",
-      permissionRequest: {
-        id: "permission-shell-destructive-action",
-        tool: "execShell",
-        action: "destructive_shell_command",
-        title: "\u786E\u8BA4\u6267\u884C\u7834\u574F\u6027 shell \u547D\u4EE4",
-        body: "\u8BE5\u547D\u4EE4\u53EF\u80FD\u5220\u9664\u6216\u91CD\u7F6E\u7528\u6237\u5185\u5BB9\uFF0C\u9700\u8981\u7528\u6237\u660E\u786E\u786E\u8BA4\u540E\u624D\u80FD\u6267\u884C\u3002",
-        suggestedRule: {
-          scope: "once",
-          pattern: { capability: "destructive_action", target: "shell_command" }
-        }
-      },
-      policy: {
-        capability: "destructive_action",
-        target: "shell_command",
-        detail: "execShell destructive command"
-      }
-    };
-  }
-  const longRunningHint = isLongRunningShellCommand(args);
-  return {
-    verdict: "allowed",
-    permissionDecision: "allow",
-    ...longRunningHint ? { longRunningHint: true } : {}
-  };
-}
-
 // packages/agent-runtime/localToolPolicy.ts
 var NEVER_LOCAL_TOOLS = /* @__PURE__ */ new Set([
   "deleteSpaces",
@@ -1290,20 +1084,6 @@ function normalizeLocalToolName(toolName) {
     String(toolName ?? "").replace(/^functions\./, "").trim()
   );
 }
-function parseShellCommandPayload(rawArguments) {
-  return parseToolArgumentsJson(rawArguments);
-}
-function toDisplayCommand(command) {
-  if (typeof command === "string") {
-    const trimmed = command.trim();
-    return trimmed ? trimmed : void 0;
-  }
-  if (Array.isArray(command)) {
-    const joined = command.map((item) => typeof item === "string" ? item : String(item)).filter((item) => item.length > 0).join(" ").trim();
-    return joined ? joined : void 0;
-  }
-  return void 0;
-}
 function isRestrictedLocalToolMode(env) {
   return env.NOLO_LOCAL_TOOL_MODE === "restricted";
 }
@@ -1353,7 +1133,6 @@ function resolveLocalToolPolicy(args) {
     reason: `${toolName} is not enabled for local runtime runs. The agent must declare the tool in its manifest; in restricted mode (NOLO_LOCAL_TOOL_MODE=restricted) non-default tools also require adding to NOLO_LOCAL_ALLOWED_TOOLS (e.g. NOLO_LOCAL_ALLOWED_TOOLS=someCustomTool) and restarting the session so the env var loads.`
   };
 }
-var ABORT_AWARE_LOCAL_TOOLS = /* @__PURE__ */ new Set(["execShell", "controlAgentRun"]);
 async function executeLocalToolWithPolicy(args) {
   const decision = resolveLocalToolPolicy({
     env: args.env,
@@ -1365,66 +1144,37 @@ async function executeLocalToolWithPolicy(args) {
   if (!executor) {
     throw new Error(`${decision.toolName} is allowed by policy but no local executor is registered.`);
   }
-  const effectiveExecutor = args.abortSignal && ABORT_AWARE_LOCAL_TOOLS.has(decision.toolName) && args.executors ? (call) => executor(call, {
-    abortSignal: args.abortSignal,
-    detachMs: args.detachMs
-  }) : executor;
-  const guardEnabled = args.enableDestructiveShellGuard !== false;
-  if (decision.toolName === "execShell" && !args.confirmed && guardEnabled) {
-    const parsed = parseShellCommandPayload(args.call.arguments);
-    const rawCommand = resolveShellCommandArg(parsed);
-    if (isDestructiveShellCommand({ command: rawCommand, input: parsed.input })) {
-      const command = toDisplayCommand(rawCommand);
-      const request = {
-        id: "permission-shell-destructive-action",
-        tool: "execShell",
-        action: "destructive_shell_command",
-        title: "\u786E\u8BA4\u6267\u884C\u7834\u574F\u6027 shell \u547D\u4EE4",
-        body: "\u8BE5\u547D\u4EE4\u53EF\u80FD\u5220\u9664\u6216\u91CD\u7F6E\u7528\u6237\u5185\u5BB9\uFF0C\u9700\u8981\u7528\u6237\u660E\u786E\u786E\u8BA4\u540E\u624D\u80FD\u6267\u884C\u3002",
-        ...command ? { command } : {},
-        suggestedRule: {
-          scope: "once",
-          pattern: { capability: "destructive_action", target: "shell_command" }
-        }
-      };
-      const buildBlockedError = (reason) => {
-        const error = new Error(reason);
-        error.code = "destructive_action_requires_confirmation";
-        error.policy = {
-          capability: "destructive_action",
-          target: "shell_command",
-          detail: "execShell destructive command"
-        };
-        error.permissionRequest = request;
-        return error;
-      };
-      if (!args.confirmDestructiveAction) {
-        if (args.blockDestructiveWithoutConfirmation) {
-          throw buildBlockedError(
-            "destructive shell command blocked: no confirmation channel available"
-          );
-        }
-        return effectiveExecutor({
-          ...args.call,
-          name: decision.toolName
-        });
-      }
-      const confirmed = await args.confirmDestructiveAction(request);
-      if (!confirmed) {
-        throw buildBlockedError(
-          "destructive shell command blocked: user declined confirmation"
-        );
+  const opts = {
+    ...args.abortSignal ? { abortSignal: args.abortSignal } : {},
+    ...args.detachMs !== void 0 ? { detachMs: args.detachMs } : {},
+    ...args.confirmed !== void 0 ? { confirmed: args.confirmed } : {},
+    ...args.enableDestructiveShellGuard !== void 0 ? { enableDestructiveShellGuard: args.enableDestructiveShellGuard } : {},
+    ...args.confirmDestructiveAction ? { confirmDestructiveAction: args.confirmDestructiveAction } : {},
+    ...args.blockDestructiveWithoutConfirmation !== void 0 ? { blockDestructiveWithoutConfirmation: args.blockDestructiveWithoutConfirmation } : {}
+  };
+  if (decision.toolName === "execShell") {
+    let parsedInput = args.call.arguments;
+    if (typeof parsedInput === "string") {
+      try {
+        parsedInput = JSON.parse(parsedInput);
+      } catch {
+        parsedInput = { command: parsedInput };
       }
     }
+    await evaluateExecShellDestructiveGuard(parsedInput, opts);
+    opts.confirmed = true;
   }
-  return effectiveExecutor({
-    ...args.call,
-    name: decision.toolName
-  });
+  return executor(
+    {
+      ...args.call,
+      name: decision.toolName
+    },
+    opts
+  );
 }
 
 // packages/agent-runtime/localWorkspaceTools.ts
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
 import { dirname, relative, resolve, sep } from "node:path";
@@ -1462,244 +1212,6 @@ function isLineRangeCovered(request, covered) {
   return open > request.endLine;
 }
 
-// packages/agent-runtime/runtimeCompat.ts
-import { existsSync, readdirSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { spawn } from "node:child_process";
-var IS_WINDOWS = process.platform === "win32";
-function isExecutableFile(candidate) {
-  if (!existsSync(candidate)) return false;
-  try {
-    return statSync(candidate).isFile();
-  } catch {
-    return false;
-  }
-}
-function resolveExecutableOnPath(name) {
-  if (IS_WINDOWS && !/\.[a-z]+$/i.test(name)) {
-    const exts = (process.env.PATHEXT || ".EXE;.CMD;.BAT").split(";").filter(Boolean);
-    for (const ext of exts) {
-      const found = resolveExecutableOnPath(name + ext);
-      if (found) return found;
-    }
-    return null;
-  }
-  const pathEnv = process.env.PATH ?? "";
-  const sep2 = pathEnv.includes(";") && IS_WINDOWS ? ";" : ":";
-  const pathDirs = pathEnv.split(sep2).filter(Boolean);
-  const fallbackDirs = IS_WINDOWS ? [] : [
-    "/opt/homebrew/bin",
-    "/usr/local/bin",
-    "/usr/bin",
-    "/bin",
-    `${process.env.HOME ?? ""}/.local/bin`
-  ].filter(Boolean);
-  for (const dir of [...pathDirs, ...fallbackDirs]) {
-    const candidate = join(dir, name);
-    if (isExecutableFile(candidate)) return candidate;
-  }
-  return null;
-}
-function createGlob(pattern) {
-  const regex = globToRegExp(pattern);
-  return {
-    match(path) {
-      return regex.test(path);
-    },
-    scanSync(opts) {
-      const dot = opts.dot ?? false;
-      const results = [];
-      walkDir(opts.cwd, "", dot, results);
-      return results.filter((rel) => regex.test(rel));
-    }
-  };
-}
-function walkDir(dir, prefix, dot, out) {
-  let entries;
-  try {
-    entries = readdirSync(dir, { withFileTypes: true, encoding: "utf8" });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    const name = String(entry.name);
-    if (!dot && name.startsWith(".")) continue;
-    const rel = prefix ? `${prefix}/${name}` : name;
-    const full = join(dir, name);
-    if (entry.isDirectory()) {
-      walkDir(full, rel, dot, out);
-    } else if (entry.isFile()) {
-      out.push(rel);
-    }
-  }
-}
-function globToRegExp(pattern) {
-  const trailingDir = pattern.endsWith("/");
-  const src = trailingDir ? pattern.slice(0, -1) : pattern;
-  const anchored = src.startsWith("/");
-  const body = anchored ? src.slice(1) : src;
-  let regex = "^";
-  if (!anchored) regex += "(?:.*/)?";
-  regex += convertBody(body);
-  if (trailingDir) {
-    regex += "(?:/.*)?";
-  }
-  regex += "$";
-  return new RegExp(regex);
-}
-function convertBody(p) {
-  let out = "";
-  let i = 0;
-  while (i < p.length) {
-    const c = p[i];
-    if (c === "*") {
-      if (p[i + 1] === "*") {
-        i += 2;
-        if (p[i] === "/") {
-          out += "(?:.*/)?";
-          i += 1;
-        } else {
-          out += ".*";
-        }
-      } else {
-        out += "[^/]*";
-        i += 1;
-      }
-    } else if (c === "?") {
-      out += "[^/]";
-      i += 1;
-    } else if (c === "[") {
-      out += "[";
-      i += 1;
-      if (p[i] === "!") {
-        out += "^";
-        i += 1;
-      }
-      while (i < p.length && p[i] !== "]") {
-        out += p[i] === "\\" ? "\\\\" : p[i];
-        i += 1;
-      }
-      if (p[i] === "]") {
-        out += "]";
-        i += 1;
-      }
-    } else if (c === "{") {
-      let depth = 1;
-      let j = i + 1;
-      let bodyStr = "";
-      while (j < p.length && depth > 0) {
-        if (p[j] === "{") depth += 1;
-        else if (p[j] === "}") depth -= 1;
-        if (depth > 0) bodyStr += p[j];
-        j += 1;
-      }
-      const alts = bodyStr.split(",").map((alt) => convertBody(alt));
-      out += `(?:${alts.join("|")})`;
-      i = j;
-    } else {
-      out += escapeRegexChar(c);
-      i += 1;
-    }
-  }
-  return out;
-}
-function escapeRegexChar(c) {
-  if ("\\^$.|+()".includes(c)) {
-    return `\\${c}`;
-  }
-  return c;
-}
-function spawnToWebStreams(options) {
-  const [command, ...args] = options.cmd;
-  const child = spawn(command, args, {
-    env: options.env,
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  const exited = new Promise((resolve2) => {
-    child.on("exit", (code) => resolve2(code ?? 1));
-    child.on("error", () => resolve2(127));
-  });
-  const toWeb = (stream) => {
-    if (!stream) return null;
-    return stream.toWeb?.() ?? new ReadableStream({
-      start(controller) {
-        stream.on("data", (chunk) => controller.enqueue(new Uint8Array(chunk)));
-        stream.on("end", () => controller.close());
-        stream.on("error", (e) => controller.error(e));
-      }
-    });
-  };
-  return {
-    stdout: toWeb(child.stdout),
-    stderr: toWeb(child.stderr),
-    exited
-  };
-}
-
-// packages/agent-runtime/processRegistry.ts
-var ProcessRegistry = class {
-  processes = /* @__PURE__ */ new Map();
-  add(proc) {
-    this.processes.set(proc.pid, {
-      pid: proc.pid,
-      pgid: proc.pgid,
-      command: proc.command,
-      label: proc.label,
-      startedAt: Date.now(),
-      status: "running",
-      persist: proc.persist ?? false
-    });
-  }
-  list() {
-    return Array.from(this.processes.values()).map((proc) => ({ ...proc }));
-  }
-  get(pid) {
-    const item = this.processes.get(pid);
-    return item ? { ...item } : void 0;
-  }
-  kill(pid, signal = "SIGTERM") {
-    const item = this.processes.get(pid);
-    if (!item) return false;
-    if (item.status === "running") {
-      try {
-        process.kill(-item.pgid, signal);
-      } catch {
-      }
-      item.status = "stopped";
-      return true;
-    }
-    return false;
-  }
-  stopAll(signal = "SIGTERM", opts) {
-    for (const item of this.processes.values()) {
-      if (item.status === "running" && (opts?.includePersist || !item.persist)) {
-        try {
-          process.kill(-item.pgid, signal);
-        } catch {
-        }
-        item.status = "stopped";
-      }
-    }
-  }
-  markExited(pid, exitCode) {
-    const item = this.processes.get(pid);
-    if (item && item.status === "running") {
-      item.exitCode = exitCode;
-      item.status = exitCode === 0 ? "exited" : "failed";
-    }
-  }
-  clear() {
-    this.processes.clear();
-  }
-};
-var registry = null;
-function getProcessRegistry() {
-  if (!registry) {
-    registry = new ProcessRegistry();
-  }
-  return registry;
-}
-
 // packages/agent-runtime/localWorkspaceToolDefs.ts
 var WORKSPACE_TOOL_NAMES = [
   "listFiles",
@@ -1723,15 +1235,6 @@ var REMOVED_WORKSPACE_TOOL_NAMES = /* @__PURE__ */ new Set([
   "gitCommit",
   "commitWorkspace"
 ]);
-function tokenizeShellPrefix(command) {
-  const tokens = [];
-  const pattern = /"([^"]*)"|'([^']*)'|([^\s"'|;&<>]+)/g;
-  let match;
-  while (match = pattern.exec(command)) {
-    tokens.push(match[1] ?? match[2] ?? match[3] ?? "");
-  }
-  return tokens;
-}
 function buildWorkspacePathProperty() {
   return {
     type: "string",
@@ -2105,26 +1608,7 @@ function buildCaptureVisualStateTool() {
   };
 }
 function buildExecShellTool(toolName) {
-  return {
-    type: "function",
-    function: {
-      name: toolName,
-      description: `Execute a shell command from the workspace root. Prefer one compound command (e.g. 'git status && git diff --stat') to perform complete verification in one step instead of multiple small roundtrips. Do not cd into guessed paths; commands already run from the workspace root. Commands block until exit. Long-running commands (sleep over ${IMMEDIATE_DETACH_SLEEP_THRESHOLD_SECONDS}s, dev servers, watchers) automatically detach to background returning {detached: true, pid, label}; for persistent services, prefer launchProcess.`,
-      parameters: {
-        type: "object",
-        properties: {
-          command: {
-            type: "string",
-            description: "Shell command to run (non-empty)."
-          },
-          cmd: {
-            type: "string",
-            description: "Compatibility alias for command."
-          }
-        }
-      }
-    }
-  };
+  return buildExecShellToolDefinition(toolName);
 }
 function buildLaunchProcessTool() {
   return {
@@ -2166,73 +1650,6 @@ function buildListProcessesTool() {
     }
   };
 }
-function wrapPowerShellCommand(command) {
-  return [
-    "[Console]::InputEncoding=[System.Text.Encoding]::UTF8",
-    "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8",
-    "$OutputEncoding=[System.Text.Encoding]::UTF8",
-    "$PSStyle.OutputRendering='PlainText'",
-    command
-  ].join("; ");
-}
-function findPowerShellExecutable() {
-  return resolveExecutableOnPath("pwsh") || resolveExecutableOnPath("powershell.exe") || resolveExecutableOnPath("powershell");
-}
-function buildPowerShellCommand(command) {
-  const executable = findPowerShellExecutable();
-  if (!executable) throw new Error("PowerShell is not available on this machine.");
-  return [
-    executable,
-    "-NoLogo",
-    "-NoProfile",
-    "-NonInteractive",
-    "-ExecutionPolicy",
-    "Bypass",
-    "-Command",
-    wrapPowerShellCommand(command)
-  ];
-}
-function buildBashCommand(command) {
-  const executable = resolveExecutableOnPath("bash") || resolveExecutableOnPath("sh");
-  if (!executable) throw new Error("bash/sh is not available on this machine.");
-  return [executable, "-lc", command];
-}
-function buildWorkspaceShellCommand(args) {
-  if (args.shell === "powershell") return buildPowerShellCommand(args.command);
-  if (args.shell === "bash") return buildBashCommand(args.command);
-  return process.platform === "win32" ? buildPowerShellCommand(args.command) : buildBashCommand(args.command);
-}
-function findWorkspaceShellEscapeToken(command) {
-  const tokens = tokenizeShellPrefix(command);
-  for (const token of tokens) {
-    if (token === ".." || token.startsWith("../") || token.startsWith("..\\") || token.includes("/../") || token.includes("\\..\\")) {
-      return token;
-    }
-    if (token === "~" || token.startsWith("~/") || token.startsWith("~\\")) {
-      return token;
-    }
-    if (token === "/" || token.startsWith("/") || /^[A-Za-z]:[\\/]/.test(token) || token.startsWith("\\\\")) {
-      return token;
-    }
-  }
-  return null;
-}
-function buildWorkspaceShellEscapeBlockedResult(args) {
-  return {
-    content: [
-      "workspace_shell_escape_blocked",
-      `blockedToken: ${args.token}`,
-      `command: ${args.command}`,
-      "Use paths relative to the authorized folder only.",
-      "exitCode: 126"
-    ].join("\n"),
-    metadata: {
-      exitCode: 126,
-      workspaceShellEscapeBlocked: true,
-      blockedToken: args.token
-    }
-  };
-}
 function buildWorkspaceToolDefinition(toolName, args) {
   if (toolName === "listFiles") {
     return buildListWorkspaceFilesTool({
@@ -2277,9 +1694,6 @@ function filterDeclaredWorkspaceToolNames(args) {
 }
 
 // packages/agent-runtime/localWorkspaceTools.ts
-var EXEC_SHELL_TIMEOUT_ENV = "NOLO_EXEC_SHELL_TIMEOUT_MS";
-var EXEC_SHELL_DETACH_ENV = "NOLO_EXEC_SHELL_DETACH_MS";
-var DEFAULT_EXEC_SHELL_DETACH_MS = 12e4;
 var DEFAULT_LOCAL_API_ORIGIN = "http://127.0.0.1:38123";
 var ALWAYS_EXCLUDED_GLOBS = [
   "*.tsbuildinfo",
@@ -2312,168 +1726,6 @@ function readBoolean(parsed, key) {
   }
   return void 0;
 }
-function resolveExecShellTimeoutMs(override) {
-  const fromOverride = asOptionalPositiveFiniteNumber(override);
-  if (fromOverride !== void 0) return fromOverride;
-  const raw = process.env[EXEC_SHELL_TIMEOUT_ENV];
-  if (raw === void 0) return void 0;
-  return asOptionalPositiveFiniteNumber(Number(raw));
-}
-function resolveDetachMs(override) {
-  if (typeof override === "number" && Number.isFinite(override) && override >= 0) {
-    return override;
-  }
-  const raw = process.env[EXEC_SHELL_DETACH_ENV];
-  if (raw === void 0) return DEFAULT_EXEC_SHELL_DETACH_MS;
-  const parsed = asOptionalPositiveFiniteNumber(Number(raw));
-  return parsed === void 0 ? DEFAULT_EXEC_SHELL_DETACH_MS : parsed;
-}
-function extractInteractiveGhAuthCommand(command) {
-  const tokens = tokenizeShellPrefix(command);
-  if (tokens[0] !== "gh" || tokens[1] !== "auth") return null;
-  const subcommand = tokens[2];
-  if (subcommand !== "login" && subcommand !== "refresh") return null;
-  if (tokens.includes("--help")) return null;
-  const result = ["gh", "auth", subcommand];
-  for (let index = 3; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (!token) continue;
-    if (token === "-h" || token === "--hostname" || token === "-s" || token === "--scopes" || token === "--remove-scopes" || token === "-r") {
-      const value = tokens[index + 1];
-      if (value) {
-        result.push(token, value);
-        index += 1;
-      }
-      continue;
-    }
-    if (token === "--clipboard" || token === "-c" || token === "--insecure-storage" || token === "--reset-scopes") {
-      result.push(token);
-      continue;
-    }
-    if (token.startsWith("--hostname=") || token.startsWith("--scopes=") || token.startsWith("--remove-scopes=")) {
-      result.push(token);
-      continue;
-    }
-  }
-  return result.join(" ");
-}
-function splitShellWords(command) {
-  return tokenizeShellPrefix(command);
-}
-function buildInteractiveCommandBlockedResult(command) {
-  const argv = splitShellWords(command);
-  return {
-    content: [
-      "action_gate: handoff",
-      `command: ${command}`,
-      "Run this in the current TUI terminal, then resume the agent turn.",
-      "exitCode: 130"
-    ].join("\n"),
-    metadata: {
-      exitCode: 130,
-      timedOut: false,
-      actionGate: {
-        id: `gate-${Date.now().toString(36)}-terminal-handoff`,
-        kind: "handoff",
-        title: "This command requires an interactive terminal.",
-        body: "Complete it in the terminal, then nolo will continue.",
-        payload: {
-          command: argv,
-          displayCommand: command
-        }
-      },
-      reason: "interactive-command-requires-terminal"
-    }
-  };
-}
-function extractActivityRefs(rawRefs) {
-  if (!Array.isArray(rawRefs)) return void 0;
-  const refs = rawRefs.flatMap((entry) => {
-    if (!isRecord(entry)) return [];
-    if (entry.type === "file") {
-      const path = readTrimmedString(entry.path);
-      return path ? [{ type: "file", path }] : [];
-    }
-    if (entry.type === "terminal") {
-      const id = readTrimmedString(entry.id);
-      const label = readTrimmedString(entry.label);
-      return id || label ? [{ type: "terminal", ...id ? { id } : {}, ...label ? { label } : {} }] : [];
-    }
-    if (entry.type === "url") {
-      const url = readTrimmedString(entry.url);
-      const label = readTrimmedString(entry.label);
-      return url ? [{ type: "url", url, ...label ? { label } : {} }] : [];
-    }
-    return [];
-  });
-  return refs.length ? refs : void 0;
-}
-function extractActivityAction(rawAction) {
-  if (!isRecord(rawAction)) return void 0;
-  const title = readTrimmedString(rawAction.title);
-  if (!title) return void 0;
-  const kind = readTrimmedString(rawAction.kind);
-  const detail = readTrimmedString(rawAction.detail);
-  const refs = extractActivityRefs(rawAction.refs);
-  return {
-    title,
-    ...kind ? { kind } : {},
-    ...detail ? { detail } : {},
-    ...refs ? { refs } : {}
-  };
-}
-function extractActivityPhase(rawPhase) {
-  if (!isRecord(rawPhase)) return void 0;
-  const title = readTrimmedString(rawPhase.title);
-  if (!title) return void 0;
-  const id = readTrimmedString(rawPhase.id) || title.toLowerCase().replace(/\s+/g, "-");
-  const index = asOptionalFiniteNumber(rawPhase.index);
-  const total = asOptionalFiniteNumber(rawPhase.total);
-  const status = rawPhase.status === "pending" || rawPhase.status === "running" || rawPhase.status === "success" || rawPhase.status === "failed" ? rawPhase.status : void 0;
-  return {
-    id,
-    title,
-    ...index !== void 0 ? { index } : {},
-    ...total !== void 0 ? { total } : {},
-    ...status ? { status } : {}
-  };
-}
-function extractActivityPlan(rawPlan) {
-  if (!isRecord(rawPlan)) return void 0;
-  if (!Array.isArray(rawPlan.phases)) return void 0;
-  const phases = rawPlan.phases.flatMap((entry, index) => {
-    const phase = extractActivityPhase(entry);
-    if (!phase) return [];
-    return [{
-      id: phase.id,
-      title: phase.title,
-      index: phase.index ?? index + 1,
-      ...phase.status ? { status: phase.status } : {}
-    }];
-  });
-  if (phases.length === 0) return void 0;
-  const title = readTrimmedString(rawPlan.title);
-  return {
-    ...title ? { title } : {},
-    phases
-  };
-}
-function extractActivity(parsed) {
-  const raw = parsed._activity;
-  if (!isRecord(raw)) return void 0;
-  const nestedAction = extractActivityAction(raw.action);
-  const legacyAction = extractActivityAction(raw);
-  const action = nestedAction || legacyAction;
-  const phase = extractActivityPhase(raw.phase);
-  const plan = extractActivityPlan(raw.plan);
-  if (!action && !plan) return void 0;
-  return {
-    ...action ? action : {},
-    ...phase ? { phase } : {},
-    ...nestedAction ? { action: nestedAction } : {},
-    ...plan ? { plan } : {}
-  };
-}
 function buildLocalWorkspaceToolset(args) {
   const exposeShellTools = args.exposeShellTools === true;
   if (args.useDeclaredToolNamesOnly) {
@@ -2929,22 +2181,6 @@ async function runWorkspacePackageScript(args) {
     }
   };
 }
-function truncateToolOutput(value, limit = 2e4) {
-  if (value.length <= limit) return value;
-  const approxMarkerLen = 40;
-  if (limit <= approxMarkerLen) return value.slice(0, limit);
-  const remaining = limit - approxMarkerLen;
-  const headSize = Math.floor(remaining * 0.3);
-  const tailSize = remaining - headSize;
-  const head = value.slice(0, headSize);
-  const tail = value.slice(-tailSize);
-  const actualRemoved = value.length - headSize - tailSize;
-  return `${head}
-
-[... truncated ${actualRemoved} chars ...]
-
-${tail}`;
-}
 function parseLastJsonObject(text) {
   const trimmed = text.trim();
   for (let index = trimmed.lastIndexOf("{"); index >= 0; index = trimmed.lastIndexOf("{", index - 1)) {
@@ -2956,57 +2192,11 @@ function parseLastJsonObject(text) {
   }
   return null;
 }
-function readNodeStream(stream) {
-  if (!stream) return Promise.resolve("");
-  return new Promise((resolveRead, rejectRead) => {
-    const chunks = [];
-    stream.on("data", (chunk) => {
-      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
-    });
-    stream.on("error", rejectRead);
-    stream.on("end", () => resolveRead(Buffer.concat(chunks).toString("utf8")));
-  });
-}
-function waitForNodeProcessExit(proc) {
-  return new Promise((resolveExit, rejectExit) => {
-    proc.once("error", rejectExit);
-    proc.once("close", (code, signal) => {
-      if (typeof code === "number") {
-        resolveExit(code);
-        return;
-      }
-      resolveExit(signal ? 1 : 0);
-    });
-  });
-}
-function isSpawnFailureError(error) {
-  if (!error || typeof error !== "object") return false;
-  const err = error;
-  if (err.code === "ENOENT") return true;
-  const message = toErrorMessage(error).toLowerCase();
-  return message.includes("enoent") || message.includes("executable not found") || message.includes("spawn") && message.includes("not found");
-}
-function spawnFailedCommandResult(error, outputLimit) {
-  const stderr = `spawn failed: ${toErrorMessage(error)}
-`;
-  return {
-    stdout: "",
-    stderr,
-    exitCode: 127,
-    timedOut: false,
-    spawnFailed: true,
-    content: truncateToolOutput(
-      [`stderr:
-${stderr.trim()}`, "exitCode: 127"].filter(Boolean).join("\n\n"),
-      outputLimit
-    )
-  };
-}
 function resolveRipgrepBinary(env = process.env) {
   const fromEnv = asOptionalTrimmedString(env.NOLO_BUNDLED_RG);
   if (fromEnv) {
     try {
-      if (existsSync2(fromEnv)) return fromEnv;
+      if (existsSync(fromEnv)) return fromEnv;
     } catch {
     }
   }
@@ -3015,178 +2205,6 @@ function resolveRipgrepBinary(env = process.env) {
 function resolveGrepBinary() {
   return resolveExecutableOnPath("grep");
 }
-async function runWorkspaceCommand(args) {
-  const timeoutMs = asOptionalPositiveFiniteNumber(args.timeoutMs);
-  const detached = process.platform !== "win32";
-  const command = [
-    ...args.commandPrefix ?? [],
-    ...args.command
-  ];
-  const proc = spawnChildProcess(command[0] ?? "", command.slice(1), {
-    cwd: resolve(args.workspaceRoot),
-    stdio: [
-      args.stdin === void 0 ? "ignore" : "pipe",
-      "pipe",
-      "pipe"
-    ],
-    detached
-  });
-  if (args.stdin !== void 0 && proc.stdin) {
-    proc.stdin.write(args.stdin);
-    proc.stdin.end();
-  }
-  const exitPromise = waitForNodeProcessExit(proc);
-  const cleanupChildOnHostSignal = (signal) => {
-    if (typeof proc.pid === "number") {
-      try {
-        process.kill(-proc.pid, signal);
-      } catch {
-      }
-    }
-  };
-  if (detached) {
-    process.once("SIGHUP", cleanupChildOnHostSignal);
-    process.once("SIGTERM", cleanupChildOnHostSignal);
-    process.once("SIGINT", cleanupChildOnHostSignal);
-  }
-  const detachSignalCleanup = () => {
-    if (!detached) return;
-    process.removeListener("SIGHUP", cleanupChildOnHostSignal);
-    process.removeListener("SIGTERM", cleanupChildOnHostSignal);
-    process.removeListener("SIGINT", cleanupChildOnHostSignal);
-  };
-  exitPromise.then(detachSignalCleanup, detachSignalCleanup);
-  const stdoutPromise = readNodeStream(proc.stdout);
-  const stderrPromise = readNodeStream(proc.stderr);
-  const killChild = (signal) => {
-    if (detached && typeof proc.pid === "number") {
-      try {
-        process.kill(-proc.pid, signal);
-        return;
-      } catch {
-      }
-    }
-    try {
-      proc.kill(signal);
-    } catch {
-    }
-  };
-  let timeout;
-  let detachTimer;
-  const timeoutResult = Symbol("timeout");
-  const abortResult = Symbol("abort");
-  const detachResult = Symbol("detach");
-  let abortListener;
-  const abortPromise = args.abortSignal ? new Promise((resolveAbort) => {
-    if (args.abortSignal.aborted) {
-      resolveAbort(abortResult);
-      return;
-    }
-    abortListener = () => resolveAbort(abortResult);
-    args.abortSignal.addEventListener("abort", abortListener, { once: true });
-  }) : null;
-  const effectiveDetachMs = resolveDetachMs(args.detachMs);
-  const detachPromise = new Promise((r) => {
-    detachTimer = setTimeout(() => r(detachResult), effectiveDetachMs);
-  });
-  const racers = [exitPromise];
-  if (timeoutMs) {
-    racers.push(
-      new Promise((resolveTimeout) => {
-        timeout = setTimeout(() => resolveTimeout(timeoutResult), timeoutMs);
-      })
-    );
-  }
-  if (abortPromise) racers.push(abortPromise);
-  racers.push(detachPromise);
-  let raceWinner;
-  try {
-    raceWinner = await Promise.race(racers);
-  } catch (error) {
-    if (timeout) clearTimeout(timeout);
-    if (detachTimer) clearTimeout(detachTimer);
-    if (abortListener && args.abortSignal) {
-      args.abortSignal.removeEventListener("abort", abortListener);
-    }
-    detachSignalCleanup();
-    if (isSpawnFailureError(error)) {
-      return spawnFailedCommandResult(error, args.outputLimit);
-    }
-    throw error;
-  }
-  if (timeout) clearTimeout(timeout);
-  if (detachTimer) clearTimeout(detachTimer);
-  if (abortListener && args.abortSignal) {
-    args.abortSignal.removeEventListener("abort", abortListener);
-  }
-  const timedOut = raceWinner === timeoutResult;
-  const aborted = raceWinner === abortResult;
-  const didDetach = raceWinner === detachResult;
-  if (timedOut || aborted) {
-    killChild("SIGTERM");
-    await Promise.race([
-      exitPromise.catch(() => 124),
-      new Promise((resolveKill) => setTimeout(resolveKill, 500))
-    ]);
-    killChild("SIGKILL");
-  }
-  if (didDetach) {
-    exitPromise.catch(() => {
-    });
-    const pid = typeof proc.pid === "number" ? proc.pid : 0;
-    const label = deriveLabel(args.command.join(" "));
-    const pgid = pid;
-    const registry2 = getProcessRegistry();
-    registry2.add({ pid, pgid, command: args.command.join(" "), label });
-    proc.on("close", (code) => {
-      detachSignalCleanup();
-      registry2.markExited(pid, code ?? 1);
-    });
-    const immediate = effectiveDetachMs === 0;
-    const reason = immediate ? `command looks long-running; moved to background immediately (pid=${pid}, label=${label})` : `command detached to background after ${effectiveDetachMs}ms (pid=${pid}, label=${label})`;
-    return {
-      stdout: "",
-      stderr: `${reason}
-Use listProcesses to inspect or stop it.`,
-      exitCode: 0,
-      timedOut: false,
-      detached: true,
-      pid,
-      label,
-      content: JSON.stringify({
-        detached: true,
-        pid,
-        label,
-        status: "running",
-        ...immediate ? { reason: "long-running-command" } : {}
-      })
-    };
-  }
-  const [stdout, rawStderr] = await Promise.all([
-    stdoutPromise,
-    stderrPromise
-  ]);
-  const exitCode = aborted ? 130 : timedOut ? 124 : Number(raceWinner);
-  const stderr = aborted ? `${rawStderr.trim() ? `${rawStderr.trim()}
-` : ""}command aborted by signal
-` : timedOut ? `${rawStderr.trim() ? `${rawStderr.trim()}
-` : ""}command timed out after ${timeoutMs ?? "unknown"}ms
-` : rawStderr;
-  return {
-    stdout,
-    stderr,
-    exitCode,
-    timedOut,
-    aborted,
-    content: truncateToolOutput([
-      stdout.trim() ? `stdout:
-${stdout.trim()}` : "",
-      stderr.trim() ? `stderr:
-${stderr.trim()}` : "",
-      `exitCode: ${exitCode}`
-    ].filter(Boolean).join("\n\n"), args.outputLimit)
-  };
-}
 async function runWorkspaceCommandLimitedLines(args) {
   const command = [
     ...args.commandPrefix ?? [],
@@ -4045,63 +3063,24 @@ async function captureVisualStateTool(args) {
   };
 }
 async function execShellTool(args) {
-  const parsed = parseWorkspaceToolArguments(args.call.arguments);
-  const command = requireShellCommand(parsed, args.call.name);
-  if (args.restrictToWorkspace) {
-    const escapeToken = findWorkspaceShellEscapeToken(command);
-    if (escapeToken) {
-      return buildWorkspaceShellEscapeBlockedResult({ command, token: escapeToken });
-    }
-  }
-  const interactiveAuthCommand = extractInteractiveGhAuthCommand(command);
-  if (interactiveAuthCommand) {
-    const activity2 = extractActivity(parsed);
-    const blocked = buildInteractiveCommandBlockedResult(interactiveAuthCommand);
-    return {
-      ...blocked,
-      metadata: {
-        ...blocked.metadata,
-        ...activity2 ? { activity: activity2 } : {}
-      }
-    };
-  }
-  const result = await runWorkspaceCommand({
-    workspaceRoot: args.workspaceRoot,
-    command: buildWorkspaceShellCommand({
-      toolName: args.call.name,
-      command,
-      shell: parsed.shell
-    }),
-    timeoutMs: resolveExecShellTimeoutMs(args.commandTimeoutMs),
-    outputLimit: args.commandOutputLimit,
-    commandPrefix: args.commandPrefix,
-    abortSignal: args.abortSignal,
-    // Commands that clearly never exit (long sleeps, tail -f, watch, dev
-    // servers, infinite loops) are promoted to background immediately so the
-    // turn — and the user's conversation — keeps going. Everything else keeps
-    // the caller/env detach grace window.
-    detachMs: isImmediateDetachShellCommand({ command }) ? 0 : args.detachMs
-  });
-  const activity = extractActivity(parsed);
-  return {
-    content: result.content,
-    metadata: {
-      command,
-      exitCode: result.exitCode,
-      timedOut: result.timedOut,
-      ...result.aborted ? { aborted: true } : {},
-      ...result.detached ? { detached: true, pid: result.pid, label: result.label, status: "running" } : {},
-      ...activity ? { activity } : {}
+  return invokeCapability(
+    "execShell",
+    args.call.arguments,
+    {
+      workspaceRoot: args.workspaceRoot,
+      commandTimeoutMs: args.commandTimeoutMs,
+      commandOutputLimit: args.commandOutputLimit,
+      commandPrefix: args.commandPrefix,
+      restrictToWorkspace: args.restrictToWorkspace,
+      abortSignal: args.abortSignal,
+      detachMs: args.detachMs,
+      confirmed: args.confirmed,
+      enableDestructiveShellGuard: args.enableDestructiveShellGuard,
+      confirmDestructiveAction: args.confirmDestructiveAction,
+      blockDestructiveWithoutConfirmation: args.blockDestructiveWithoutConfirmation,
+      onInvoke: args.onInvoke
     }
-  };
-}
-function deriveLabel(command) {
-  const trimmed = command.trim();
-  if (!trimmed) return "process";
-  const tokens = trimmed.split(/\s+/);
-  const lastToken = tokens[tokens.length - 1] ?? trimmed;
-  const labelCandidate = lastToken.split(/[/\\]/).pop() || lastToken;
-  return labelCandidate || trimmed;
+  );
 }
 async function launchProcessTool(args) {
   const parsed = parseWorkspaceToolArguments(args.call.arguments);
@@ -4138,8 +3117,8 @@ async function launchProcessTool(args) {
     };
   }
   const pgid = detached ? pid : pid;
-  const registry2 = getProcessRegistry();
-  registry2.add({ pid, pgid, command, label, persist });
+  const registry = getProcessRegistry();
+  registry.add({ pid, pgid, command, label, persist });
   const cleanupChildOnHostSignal = (signal) => {
     try {
       if (detached) {
@@ -4161,7 +3140,7 @@ async function launchProcessTool(args) {
       process.removeListener("SIGTERM", cleanupChildOnHostSignal);
       process.removeListener("SIGINT", cleanupChildOnHostSignal);
     }
-    registry2.markExited(pid, code ?? 1);
+    registry.markExited(pid, code ?? 1);
   });
   const activity = extractActivity(parsed);
   const resultData = { pid, label, status: "running" };
@@ -4241,7 +3220,12 @@ function createLocalWorkspaceToolExecutors(args) {
       commandPrefix: args.commandPrefix,
       restrictToWorkspace: args.restrictShellToWorkspace,
       abortSignal: opts?.abortSignal ?? args.abortSignal,
-      detachMs: opts?.detachMs ?? args.detachMs
+      detachMs: opts?.detachMs ?? args.detachMs,
+      confirmed: opts?.confirmed,
+      enableDestructiveShellGuard: opts?.enableDestructiveShellGuard,
+      confirmDestructiveAction: opts?.confirmDestructiveAction,
+      blockDestructiveWithoutConfirmation: opts?.blockDestructiveWithoutConfirmation,
+      onInvoke: opts?.onInvoke
     }),
     launchProcess: (call) => launchProcessTool({
       call,
@@ -4280,11 +3264,11 @@ async function readNoloProcessStream(readable) {
 async function runNoloWorkspaceCliTool(call, args) {
   const cliArgs = buildNoloWorkspaceCommandArgs(call);
   const bunSpawn = globalThis.Bun?.spawn;
-  const spawn2 = args.spawn ?? (typeof bunSpawn === "function" ? bunSpawn : nodeSpawnFallback);
+  const spawn = args.spawn ?? (typeof bunSpawn === "function" ? bunSpawn : nodeSpawnFallback);
   const execPath = args.processExecPath ?? process.execPath;
   const entrypoint = args.cliEntrypoint;
   const cmd = entrypoint && entrypoint !== execPath ? [execPath, entrypoint, ...cliArgs] : [execPath, ...cliArgs];
-  const proc = spawn2({
+  const proc = spawn({
     cmd,
     stdout: "pipe",
     stderr: "pipe",
@@ -4386,10 +3370,10 @@ function buildLoadSkillExecutor(args) {
         metadata: { loadSkill: true, resolved: false }
       };
     }
-    const { resolveSkillByName } = await import("./skillDiscovery-KLLKXPUO.js");
+    const { resolveSkillByName } = await import("./skillDiscovery-AYBKAG6X.js");
     const resolved = resolveSkillByName(args.cwd, name);
     if (!resolved) {
-      const { resolveCodingBuiltinSlug, buildCodingSkillContentBySlug } = await import("./codingSkills-DY5MINPG.js");
+      const { resolveCodingBuiltinSlug, buildCodingSkillContentBySlug } = await import("./codingSkills-5VOV3JVB.js");
       const builtinSlug = resolveCodingBuiltinSlug(name);
       if (builtinSlug) {
         const body = buildCodingSkillContentBySlug(builtinSlug);
@@ -4424,7 +3408,7 @@ ${body}`,
   };
 }
 async function formatUnknownSkillMessage(cwd, requestedName) {
-  const { discoverSkills } = await import("./skillDiscovery-KLLKXPUO.js");
+  const { discoverSkills } = await import("./skillDiscovery-AYBKAG6X.js");
   let available = [];
   try {
     available = discoverSkills(cwd).map((s) => s.name);
@@ -4456,13 +3440,10 @@ export {
   shouldCacheHybridRemoteRecord,
   parseSyncServersEnv,
   createHybridRecordStore,
-  isDestructiveShellCommand,
-  evaluateShellCommandPolicy,
   resolveLocalToolPolicy,
   executeLocalToolWithPolicy,
   filterRetainedLedgerRecords,
   isLineRangeCovered,
-  getProcessRegistry,
   buildLocalWorkspaceToolset,
   buildLocalWorkspacePolicyToolNames,
   buildLocalWorkspaceOpenAiTools,