nolo-cli 0.33.0-alpha.8 → 0.33.0-alpha.9

package/{chunk-NKFMFT4W.js → chunk-AN7DGYMW.js}

@@ -7,14 +7,14 @@ import {
   providerHttpFailure,
   readSseFrames,
   throwIfChatCompletionStreamFailed
-} from "./chunk-CHYAYZJH.js";
+} from "./chunk-RJKIB55Y.js";
 import {
   sanitizeForOutbound
 } from "./chunk-T27IEBNQ.js";
 import {
   parseToolArgumentsJson,
   resolveHistoricalToolContentCap
-} from "./chunk-OOK2ZT5F.js";
+} from "./chunk-D5JI6VDM.js";
 import {
   createThinkParserState,
   createToolCallAccumulator,
@@ -25,7 +25,7 @@ import {
 import {
   requiresBareImageUrl,
   toBareImageUrlMessages
-} from "./chunk-5SBK2MTI.js";
+} from "./chunk-ZWS6DUHX.js";
 import {
   convertMessagesToResponsesInput,
   extractReasoningFromResponseOutput,
@@ -1246,222 +1246,6 @@ function evaluateShellCommandPolicy(args) {
   };
 }
 
-// packages/agent-runtime/localToolPolicy.ts
-var NEVER_LOCAL_TOOLS = /* @__PURE__ */ new Set([
-  "deleteSpaces",
-  "updateAgent",
-  "updateSelf",
-  "createAgent"
-]);
-var REMOVED_LOCAL_TOOLS = /* @__PURE__ */ new Set([
-  "gitStatus",
-  "gitDiff",
-  "gitCreateBranch",
-  "gitAdd",
-  "gitCommit",
-  "commitWorkspace"
-]);
-var DEFAULT_LOCAL_TOOLS = /* @__PURE__ */ new Set([
-  "listFiles",
-  "readFile",
-  "writeFile",
-  "editFile",
-  "globFiles",
-  "searchFiles",
-  "execShell",
-  "launchProcess",
-  "listProcesses",
-  // Scheduling tools: forking/observing sub-agents is a declared capability
-  // of capable agents, and the blast radius is strictly narrower than
-  // execShell (already default-enabled). Requiring an env allowlist for these
-  // while execShell is open by default inverted the risk model and forced every
-  // new local user to hand-edit .env files before sub-agent tasks worked.
-  "startAgentRun",
-  "controlAgentRun"
-]);
-function parseToolAllowlist(value) {
-  return (value ?? "").split(",").flatMap((item) => {
-    const trimmed = item.trim();
-    return trimmed ? [trimmed] : [];
-  });
-}
-function normalizeLocalToolName(toolName) {
-  return canonicalizeToolName(
-    String(toolName ?? "").replace(/^functions\./, "").trim()
-  );
-}
-function parseShellCommandPayload(rawArguments) {
-  return parseToolArgumentsJson(rawArguments);
-}
-function toDisplayCommand(command) {
-  if (typeof command === "string") {
-    const trimmed = command.trim();
-    return trimmed ? trimmed : void 0;
-  }
-  if (Array.isArray(command)) {
-    const joined = command.map((item) => typeof item === "string" ? item : String(item)).filter((item) => item.length > 0).join(" ").trim();
-    return joined ? joined : void 0;
-  }
-  return void 0;
-}
-function isRestrictedLocalToolMode(env) {
-  return env.NOLO_LOCAL_TOOL_MODE === "restricted";
-}
-function resolveLocalToolPolicy(args) {
-  const toolName = normalizeLocalToolName(args.toolName);
-  const restrictedMode = isRestrictedLocalToolMode(args.env);
-  if (!toolName) {
-    return {
-      allowed: false,
-      toolName,
-      reason: "Tool name is required."
-    };
-  }
-  if (NEVER_LOCAL_TOOLS.has(toolName)) {
-    return {
-      allowed: false,
-      toolName,
-      reason: `${toolName} is blocked by the local runtime safety policy.`
-    };
-  }
-  if (REMOVED_LOCAL_TOOLS.has(toolName)) {
-    return {
-      allowed: false,
-      toolName,
-      reason: `${toolName} has been removed from the local runtime tool surface. Use execShell in shell-enabled workspace runs when shell is needed.`
-    };
-  }
-  const allowedByEnv = new Set(parseToolAllowlist(args.env.NOLO_LOCAL_ALLOWED_TOOLS));
-  const agentTools = new Set(
-    (args.agentToolNames ?? []).flatMap((item) => {
-      const normalized = normalizeLocalToolName(item);
-      return normalized ? [normalized] : [];
-    })
-  );
-  if (!restrictedMode && agentTools.has(toolName)) {
-    return { allowed: true, toolName };
-  }
-  if (DEFAULT_LOCAL_TOOLS.has(toolName) && agentTools.has(toolName)) {
-    return { allowed: true, toolName };
-  }
-  if (allowedByEnv.has(toolName) && agentTools.has(toolName)) {
-    return { allowed: true, toolName };
-  }
-  return {
-    allowed: false,
-    toolName,
-    reason: `${toolName} is not enabled for local runtime runs. The agent must declare the tool in its manifest; in restricted mode (NOLO_LOCAL_TOOL_MODE=restricted) non-default tools also require adding to NOLO_LOCAL_ALLOWED_TOOLS (e.g. NOLO_LOCAL_ALLOWED_TOOLS=someCustomTool) and restarting the session so the env var loads.`
-  };
-}
-var ABORT_AWARE_LOCAL_TOOLS = /* @__PURE__ */ new Set(["execShell", "controlAgentRun"]);
-async function executeLocalToolWithPolicy(args) {
-  const decision = resolveLocalToolPolicy({
-    env: args.env,
-    agentToolNames: args.agentToolNames,
-    toolName: args.call.name
-  });
-  if (!decision.allowed) throw new Error(decision.reason);
-  const executor = args.executors?.[decision.toolName];
-  if (!executor) {
-    throw new Error(`${decision.toolName} is allowed by policy but no local executor is registered.`);
-  }
-  const effectiveExecutor = args.abortSignal && ABORT_AWARE_LOCAL_TOOLS.has(decision.toolName) && args.executors ? (call) => executor(call, {
-    abortSignal: args.abortSignal,
-    detachMs: args.detachMs
-  }) : executor;
-  const guardEnabled = args.enableDestructiveShellGuard !== false;
-  if (decision.toolName === "execShell" && !args.confirmed && guardEnabled) {
-    const parsed = parseShellCommandPayload(args.call.arguments);
-    const rawCommand = resolveShellCommandArg(parsed);
-    if (isDestructiveShellCommand({ command: rawCommand, input: parsed.input })) {
-      const command = toDisplayCommand(rawCommand);
-      const request = {
-        id: "permission-shell-destructive-action",
-        tool: "execShell",
-        action: "destructive_shell_command",
-        title: "\u786E\u8BA4\u6267\u884C\u7834\u574F\u6027 shell \u547D\u4EE4",
-        body: "\u8BE5\u547D\u4EE4\u53EF\u80FD\u5220\u9664\u6216\u91CD\u7F6E\u7528\u6237\u5185\u5BB9\uFF0C\u9700\u8981\u7528\u6237\u660E\u786E\u786E\u8BA4\u540E\u624D\u80FD\u6267\u884C\u3002",
-        ...command ? { command } : {},
-        suggestedRule: {
-          scope: "once",
-          pattern: { capability: "destructive_action", target: "shell_command" }
-        }
-      };
-      const buildBlockedError = (reason) => {
-        const error = new Error(reason);
-        error.code = "destructive_action_requires_confirmation";
-        error.policy = {
-          capability: "destructive_action",
-          target: "shell_command",
-          detail: "execShell destructive command"
-        };
-        error.permissionRequest = request;
-        return error;
-      };
-      if (!args.confirmDestructiveAction) {
-        if (args.blockDestructiveWithoutConfirmation) {
-          throw buildBlockedError(
-            "destructive shell command blocked: no confirmation channel available"
-          );
-        }
-        return effectiveExecutor({
-          ...args.call,
-          name: decision.toolName
-        });
-      }
-      const confirmed = await args.confirmDestructiveAction(request);
-      if (!confirmed) {
-        throw buildBlockedError(
-          "destructive shell command blocked: user declined confirmation"
-        );
-      }
-    }
-  }
-  return effectiveExecutor({
-    ...args.call,
-    name: decision.toolName
-  });
-}
-
-// packages/agent-runtime/localWorkspaceTools.ts
-import { existsSync as existsSync2 } from "node:fs";
-import { createHash } from "node:crypto";
-import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
-import { dirname, relative, resolve, sep } from "node:path";
-import { spawnSync, spawn as spawnChildProcess } from "node:child_process";
-
-// packages/core/readRangeLedger.ts
-function filterRetainedLedgerRecords(records, retainedCap) {
-  return records.filter((record) => record.chars <= retainedCap);
-}
-function isValidRange(range) {
-  return Number.isInteger(range.startLine) && Number.isInteger(range.endLine) && range.endLine >= range.startLine;
-}
-function mergeLineRanges(ranges) {
-  const sorted = ranges.filter(isValidRange).slice().sort((a, b) => a.startLine - b.startLine);
-  const merged = [];
-  for (const range of sorted) {
-    const last = merged[merged.length - 1];
-    if (last && range.startLine <= last.endLine + 1) {
-      last.endLine = Math.max(last.endLine, range.endLine);
-    } else {
-      merged.push({ startLine: range.startLine, endLine: range.endLine });
-    }
-  }
-  return merged;
-}
-function isLineRangeCovered(request, covered) {
-  if (!isValidRange(request)) return false;
-  let open = request.startLine;
-  for (const range of mergeLineRanges(covered)) {
-    if (range.endLine < open) continue;
-    if (range.startLine > open) return false;
-    open = range.endLine + 1;
-    if (open > request.endLine) return true;
-  }
-  return open > request.endLine;
-}
-
 // packages/agent-runtime/runtimeCompat.ts
 import { existsSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
@@ -1636,70 +1420,6 @@ function spawnToWebStreams(options) {
   };
 }
 
-// packages/agent-runtime/processRegistry.ts
-var ProcessRegistry = class {
-  processes = /* @__PURE__ */ new Map();
-  add(proc) {
-    this.processes.set(proc.pid, {
-      pid: proc.pid,
-      pgid: proc.pgid,
-      command: proc.command,
-      label: proc.label,
-      startedAt: Date.now(),
-      status: "running",
-      persist: proc.persist ?? false
-    });
-  }
-  list() {
-    return Array.from(this.processes.values()).map((proc) => ({ ...proc }));
-  }
-  get(pid) {
-    const item = this.processes.get(pid);
-    return item ? { ...item } : void 0;
-  }
-  kill(pid, signal = "SIGTERM") {
-    const item = this.processes.get(pid);
-    if (!item) return false;
-    if (item.status === "running") {
-      try {
-        process.kill(-item.pgid, signal);
-      } catch {
-      }
-      item.status = "stopped";
-      return true;
-    }
-    return false;
-  }
-  stopAll(signal = "SIGTERM", opts) {
-    for (const item of this.processes.values()) {
-      if (item.status === "running" && (opts?.includePersist || !item.persist)) {
-        try {
-          process.kill(-item.pgid, signal);
-        } catch {
-        }
-        item.status = "stopped";
-      }
-    }
-  }
-  markExited(pid, exitCode) {
-    const item = this.processes.get(pid);
-    if (item && item.status === "running") {
-      item.exitCode = exitCode;
-      item.status = exitCode === 0 ? "exited" : "failed";
-    }
-  }
-  clear() {
-    this.processes.clear();
-  }
-};
-var registry = null;
-function getProcessRegistry() {
-  if (!registry) {
-    registry = new ProcessRegistry();
-  }
-  return registry;
-}
-
 // packages/agent-runtime/localWorkspaceToolDefs.ts
 var WORKSPACE_TOOL_NAMES = [
   "listFiles",
@@ -2105,26 +1825,7 @@ function buildCaptureVisualStateTool() {
   };
 }
 function buildExecShellTool(toolName) {
-  return {
-    type: "function",
-    function: {
-      name: toolName,
-      description: `Execute a shell command from the workspace root. Prefer one compound command (e.g. 'git status && git diff --stat') to perform complete verification in one step instead of multiple small roundtrips. Do not cd into guessed paths; commands already run from the workspace root. Commands block until exit. Long-running commands (sleep over ${IMMEDIATE_DETACH_SLEEP_THRESHOLD_SECONDS}s, dev servers, watchers) automatically detach to background returning {detached: true, pid, label}; for persistent services, prefer launchProcess.`,
-      parameters: {
-        type: "object",
-        properties: {
-          command: {
-            type: "string",
-            description: "Shell command to run (non-empty)."
-          },
-          cmd: {
-            type: "string",
-            description: "Compatibility alias for command."
-          }
-        }
-      }
-    }
-  };
+  return buildExecShellToolDefinition(toolName);
 }
 function buildLaunchProcessTool() {
   return {
@@ -2276,6 +1977,109 @@ function filterDeclaredWorkspaceToolNames(args) {
   );
 }
 
+// packages/agent-runtime/localWorkspaceTools.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { createHash } from "node:crypto";
+import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
+import { dirname, relative, resolve, sep } from "node:path";
+import { spawnSync, spawn as spawnChildProcess } from "node:child_process";
+
+// packages/core/readRangeLedger.ts
+function filterRetainedLedgerRecords(records, retainedCap) {
+  return records.filter((record) => record.chars <= retainedCap);
+}
+function isValidRange(range) {
+  return Number.isInteger(range.startLine) && Number.isInteger(range.endLine) && range.endLine >= range.startLine;
+}
+function mergeLineRanges(ranges) {
+  const sorted = ranges.filter(isValidRange).slice().sort((a, b) => a.startLine - b.startLine);
+  const merged = [];
+  for (const range of sorted) {
+    const last = merged[merged.length - 1];
+    if (last && range.startLine <= last.endLine + 1) {
+      last.endLine = Math.max(last.endLine, range.endLine);
+    } else {
+      merged.push({ startLine: range.startLine, endLine: range.endLine });
+    }
+  }
+  return merged;
+}
+function isLineRangeCovered(request, covered) {
+  if (!isValidRange(request)) return false;
+  let open = request.startLine;
+  for (const range of mergeLineRanges(covered)) {
+    if (range.endLine < open) continue;
+    if (range.startLine > open) return false;
+    open = range.endLine + 1;
+    if (open > request.endLine) return true;
+  }
+  return open > request.endLine;
+}
+
+// packages/agent-runtime/processRegistry.ts
+var ProcessRegistry = class {
+  processes = /* @__PURE__ */ new Map();
+  add(proc) {
+    this.processes.set(proc.pid, {
+      pid: proc.pid,
+      pgid: proc.pgid,
+      command: proc.command,
+      label: proc.label,
+      startedAt: Date.now(),
+      status: "running",
+      persist: proc.persist ?? false
+    });
+  }
+  list() {
+    return Array.from(this.processes.values()).map((proc) => ({ ...proc }));
+  }
+  get(pid) {
+    const item = this.processes.get(pid);
+    return item ? { ...item } : void 0;
+  }
+  kill(pid, signal = "SIGTERM") {
+    const item = this.processes.get(pid);
+    if (!item) return false;
+    if (item.status === "running") {
+      try {
+        process.kill(-item.pgid, signal);
+      } catch {
+      }
+      item.status = "stopped";
+      return true;
+    }
+    return false;
+  }
+  stopAll(signal = "SIGTERM", opts) {
+    for (const item of this.processes.values()) {
+      if (item.status === "running" && (opts?.includePersist || !item.persist)) {
+        try {
+          process.kill(-item.pgid, signal);
+        } catch {
+        }
+        item.status = "stopped";
+      }
+    }
+  }
+  markExited(pid, exitCode) {
+    const item = this.processes.get(pid);
+    if (item && item.status === "running") {
+      item.exitCode = exitCode;
+      item.status = exitCode === 0 ? "exited" : "failed";
+    }
+  }
+  clear() {
+    this.processes.clear();
+  }
+};
+var registry = null;
+function getProcessRegistry() {
+  if (!registry) {
+    registry = new ProcessRegistry();
+  }
+  return registry;
+}
+
 // packages/agent-runtime/localWorkspaceTools.ts
 var EXEC_SHELL_TIMEOUT_ENV = "NOLO_EXEC_SHELL_TIMEOUT_MS";
 var EXEC_SHELL_DETACH_ENV = "NOLO_EXEC_SHELL_DETACH_MS";
@@ -4032,69 +3836,33 @@ async function captureVisualStateTool(args) {
       ...result.metadata,
       script: "probe:visual-review",
       args: extraArgs,
-      baseUrl,
-      path: captureArgs.path,
-      waitSelector: captureArgs.waitSelector,
-      scrollSelector: captureArgs.scrollSelector,
-      focusSelector: captureArgs.focusSelector,
-      expectText: captureArgs.expectText,
-      screenshotPath: captureArgs.screenshotPath,
-      metricsPath: captureArgs.metricsPath,
-      ...metrics ?? {}
-    }
-  };
-}
-async function execShellTool(args) {
-  const parsed = parseWorkspaceToolArguments(args.call.arguments);
-  const command = requireShellCommand(parsed, args.call.name);
-  if (args.restrictToWorkspace) {
-    const escapeToken = findWorkspaceShellEscapeToken(command);
-    if (escapeToken) {
-      return buildWorkspaceShellEscapeBlockedResult({ command, token: escapeToken });
-    }
-  }
-  const interactiveAuthCommand = extractInteractiveGhAuthCommand(command);
-  if (interactiveAuthCommand) {
-    const activity2 = extractActivity(parsed);
-    const blocked = buildInteractiveCommandBlockedResult(interactiveAuthCommand);
-    return {
-      ...blocked,
-      metadata: {
-        ...blocked.metadata,
-        ...activity2 ? { activity: activity2 } : {}
-      }
-    };
-  }
-  const result = await runWorkspaceCommand({
-    workspaceRoot: args.workspaceRoot,
-    command: buildWorkspaceShellCommand({
-      toolName: args.call.name,
-      command,
-      shell: parsed.shell
-    }),
-    timeoutMs: resolveExecShellTimeoutMs(args.commandTimeoutMs),
-    outputLimit: args.commandOutputLimit,
-    commandPrefix: args.commandPrefix,
-    abortSignal: args.abortSignal,
-    // Commands that clearly never exit (long sleeps, tail -f, watch, dev
-    // servers, infinite loops) are promoted to background immediately so the
-    // turn — and the user's conversation — keeps going. Everything else keeps
-    // the caller/env detach grace window.
-    detachMs: isImmediateDetachShellCommand({ command }) ? 0 : args.detachMs
-  });
-  const activity = extractActivity(parsed);
-  return {
-    content: result.content,
-    metadata: {
-      command,
-      exitCode: result.exitCode,
-      timedOut: result.timedOut,
-      ...result.aborted ? { aborted: true } : {},
-      ...result.detached ? { detached: true, pid: result.pid, label: result.label, status: "running" } : {},
-      ...activity ? { activity } : {}
+      baseUrl,
+      path: captureArgs.path,
+      waitSelector: captureArgs.waitSelector,
+      scrollSelector: captureArgs.scrollSelector,
+      focusSelector: captureArgs.focusSelector,
+      expectText: captureArgs.expectText,
+      screenshotPath: captureArgs.screenshotPath,
+      metricsPath: captureArgs.metricsPath,
+      ...metrics ?? {}
     }
   };
 }
+async function execShellTool(args) {
+  const normalized = execShellCapability.normalizeInput(args.call.arguments);
+  return execShellCapability.invoke(
+    {
+      workspaceRoot: args.workspaceRoot,
+      commandTimeoutMs: args.commandTimeoutMs,
+      commandOutputLimit: args.commandOutputLimit,
+      commandPrefix: args.commandPrefix,
+      restrictToWorkspace: args.restrictToWorkspace,
+      abortSignal: args.abortSignal,
+      detachMs: args.detachMs
+    },
+    normalized
+  );
+}
 function deriveLabel(command) {
   const trimmed = command.trim();
   if (!trimmed) return "process";
@@ -4255,6 +4023,313 @@ function createLocalWorkspaceToolExecutors(args) {
   };
 }
 
+// packages/agent-runtime/capabilities/execShellCapability.ts
+function buildExecShellToolDefinition(toolName = "execShell") {
+  return {
+    type: "function",
+    function: {
+      name: toolName,
+      description: `Execute a shell command from the workspace root. Prefer one compound command (e.g. 'git status && git diff --stat') to perform complete verification in one step instead of multiple small roundtrips. Do not cd into guessed paths; commands already run from the workspace root. Commands block until exit. Long-running commands (sleep over ${IMMEDIATE_DETACH_SLEEP_THRESHOLD_SECONDS}s, dev servers, watchers) automatically detach to background returning {detached: true, pid, label}; for persistent services, prefer launchProcess.`,
+      parameters: {
+        type: "object",
+        properties: {
+          command: {
+            type: "string",
+            description: "Shell command to run (non-empty)."
+          },
+          cmd: {
+            type: "string",
+            description: "Compatibility alias for command."
+          }
+        }
+      }
+    }
+  };
+}
+function normalizeExecShellInput(input) {
+  if (input === null || input === void 0) {
+    throw new Error("execShell requires a non-empty command.");
+  }
+  if (typeof input === "string") {
+    const trimmed = input.trim();
+    if (!trimmed) {
+      throw new Error("execShell requires a non-empty command.");
+    }
+    if (trimmed.startsWith("{") && trimmed.endsWith("}")) {
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (parsed && typeof parsed === "object") {
+          return normalizeExecShellInput(parsed);
+        }
+      } catch {
+      }
+    }
+    return { command: trimmed };
+  }
+  if (typeof input === "object") {
+    const record = input;
+    let rawCommand = resolveShellCommandArg(record);
+    if (typeof rawCommand !== "string" || !rawCommand.trim()) {
+      const fallback = record.command ?? record.cmd;
+      if (typeof fallback === "string" && fallback.trim()) {
+        rawCommand = fallback;
+      }
+    }
+    const command = typeof rawCommand === "string" ? rawCommand.trim() : "";
+    if (!command) {
+      throw new Error("execShell requires a non-empty command.");
+    }
+    const activity = extractActivity(record);
+    return {
+      ...record,
+      command,
+      ...record.shell !== void 0 ? { shell: record.shell } : {},
+      ...activity ? { activity } : {}
+    };
+  }
+  throw new Error("execShell requires a non-empty command.");
+}
+var execShellCapability = {
+  name: "execShell",
+  getToolDefinition(toolName = "execShell") {
+    return buildExecShellToolDefinition(toolName);
+  },
+  normalizeInput(input) {
+    return normalizeExecShellInput(input);
+  },
+  async invoke(ctx, input) {
+    const normalized = input && typeof input === "object" && typeof input.command === "string" && input.command.trim() ? input : normalizeExecShellInput(input);
+    const command = normalized.command;
+    const workspaceRoot = ctx.workspaceRoot || process.cwd();
+    if (ctx.restrictToWorkspace) {
+      const escapeToken = findWorkspaceShellEscapeToken(command);
+      if (escapeToken) {
+        return buildWorkspaceShellEscapeBlockedResult({ command, token: escapeToken });
+      }
+    }
+    const interactiveAuthCommand = extractInteractiveGhAuthCommand(command);
+    if (interactiveAuthCommand) {
+      const blocked = buildInteractiveCommandBlockedResult(interactiveAuthCommand);
+      return {
+        ...blocked,
+        metadata: {
+          ...blocked.metadata,
+          ...normalized.activity ? { activity: normalized.activity } : {}
+        }
+      };
+    }
+    const result = await runWorkspaceCommand({
+      workspaceRoot,
+      command: buildWorkspaceShellCommand({
+        toolName: "execShell",
+        command,
+        shell: normalized.shell
+      }),
+      timeoutMs: resolveExecShellTimeoutMs(ctx.commandTimeoutMs),
+      outputLimit: ctx.commandOutputLimit,
+      commandPrefix: ctx.commandPrefix,
+      abortSignal: ctx.abortSignal,
+      detachMs: isImmediateDetachShellCommand({ command }) ? 0 : ctx.detachMs
+    });
+    return {
+      content: result.content,
+      metadata: {
+        command,
+        exitCode: result.exitCode,
+        timedOut: result.timedOut,
+        ...result.aborted ? { aborted: true } : {},
+        ...result.detached ? { detached: true, pid: result.pid, label: result.label, status: "running" } : {},
+        ...normalized.activity ? { activity: normalized.activity } : {}
+      }
+    };
+  }
+};
+
+// packages/agent-runtime/localToolPolicy.ts
+var NEVER_LOCAL_TOOLS = /* @__PURE__ */ new Set([
+  "deleteSpaces",
+  "updateAgent",
+  "updateSelf",
+  "createAgent"
+]);
+var REMOVED_LOCAL_TOOLS = /* @__PURE__ */ new Set([
+  "gitStatus",
+  "gitDiff",
+  "gitCreateBranch",
+  "gitAdd",
+  "gitCommit",
+  "commitWorkspace"
+]);
+var DEFAULT_LOCAL_TOOLS = /* @__PURE__ */ new Set([
+  "listFiles",
+  "readFile",
+  "writeFile",
+  "editFile",
+  "globFiles",
+  "searchFiles",
+  "execShell",
+  "launchProcess",
+  "listProcesses",
+  // Scheduling tools: forking/observing sub-agents is a declared capability
+  // of capable agents, and the blast radius is strictly narrower than
+  // execShell (already default-enabled). Requiring an env allowlist for these
+  // while execShell is open by default inverted the risk model and forced every
+  // new local user to hand-edit .env files before sub-agent tasks worked.
+  "startAgentRun",
+  "controlAgentRun"
+]);
+function parseToolAllowlist(value) {
+  return (value ?? "").split(",").flatMap((item) => {
+    const trimmed = item.trim();
+    return trimmed ? [trimmed] : [];
+  });
+}
+function normalizeLocalToolName(toolName) {
+  return canonicalizeToolName(
+    String(toolName ?? "").replace(/^functions\./, "").trim()
+  );
+}
+function parseShellCommandPayload(rawArguments) {
+  try {
+    const normalized = normalizeExecShellInput(rawArguments);
+    return {
+      command: normalized.command,
+      input: normalized.input
+    };
+  } catch {
+    return parseToolArgumentsJson(typeof rawArguments === "string" ? rawArguments : "");
+  }
+}
+function toDisplayCommand(command) {
+  if (typeof command === "string") {
+    const trimmed = command.trim();
+    return trimmed ? trimmed : void 0;
+  }
+  if (Array.isArray(command)) {
+    const joined = command.map((item) => typeof item === "string" ? item : String(item)).filter((item) => item.length > 0).join(" ").trim();
+    return joined ? joined : void 0;
+  }
+  return void 0;
+}
+function isRestrictedLocalToolMode(env) {
+  return env.NOLO_LOCAL_TOOL_MODE === "restricted";
+}
+function resolveLocalToolPolicy(args) {
+  const toolName = normalizeLocalToolName(args.toolName);
+  const restrictedMode = isRestrictedLocalToolMode(args.env);
+  if (!toolName) {
+    return {
+      allowed: false,
+      toolName,
+      reason: "Tool name is required."
+    };
+  }
+  if (NEVER_LOCAL_TOOLS.has(toolName)) {
+    return {
+      allowed: false,
+      toolName,
+      reason: `${toolName} is blocked by the local runtime safety policy.`
+    };
+  }
+  if (REMOVED_LOCAL_TOOLS.has(toolName)) {
+    return {
+      allowed: false,
+      toolName,
+      reason: `${toolName} has been removed from the local runtime tool surface. Use execShell in shell-enabled workspace runs when shell is needed.`
+    };
+  }
+  const allowedByEnv = new Set(parseToolAllowlist(args.env.NOLO_LOCAL_ALLOWED_TOOLS));
+  const agentTools = new Set(
+    (args.agentToolNames ?? []).flatMap((item) => {
+      const normalized = normalizeLocalToolName(item);
+      return normalized ? [normalized] : [];
+    })
+  );
+  if (!restrictedMode && agentTools.has(toolName)) {
+    return { allowed: true, toolName };
+  }
+  if (DEFAULT_LOCAL_TOOLS.has(toolName) && agentTools.has(toolName)) {
+    return { allowed: true, toolName };
+  }
+  if (allowedByEnv.has(toolName) && agentTools.has(toolName)) {
+    return { allowed: true, toolName };
+  }
+  return {
+    allowed: false,
+    toolName,
+    reason: `${toolName} is not enabled for local runtime runs. The agent must declare the tool in its manifest; in restricted mode (NOLO_LOCAL_TOOL_MODE=restricted) non-default tools also require adding to NOLO_LOCAL_ALLOWED_TOOLS (e.g. NOLO_LOCAL_ALLOWED_TOOLS=someCustomTool) and restarting the session so the env var loads.`
+  };
+}
+var ABORT_AWARE_LOCAL_TOOLS = /* @__PURE__ */ new Set(["execShell", "controlAgentRun"]);
+async function executeLocalToolWithPolicy(args) {
+  const decision = resolveLocalToolPolicy({
+    env: args.env,
+    agentToolNames: args.agentToolNames,
+    toolName: args.call.name
+  });
+  if (!decision.allowed) throw new Error(decision.reason);
+  const executor = args.executors?.[decision.toolName];
+  if (!executor) {
+    throw new Error(`${decision.toolName} is allowed by policy but no local executor is registered.`);
+  }
+  const effectiveExecutor = args.abortSignal && ABORT_AWARE_LOCAL_TOOLS.has(decision.toolName) && args.executors ? (call) => executor(call, {
+    abortSignal: args.abortSignal,
+    detachMs: args.detachMs
+  }) : executor;
+  const guardEnabled = args.enableDestructiveShellGuard !== false;
+  if (decision.toolName === "execShell" && !args.confirmed && guardEnabled) {
+    const parsed = parseShellCommandPayload(args.call.arguments);
+    const rawCommand = resolveShellCommandArg(parsed);
+    if (isDestructiveShellCommand({ command: rawCommand, input: parsed.input })) {
+      const command = toDisplayCommand(rawCommand);
+      const request = {
+        id: "permission-shell-destructive-action",
+        tool: "execShell",
+        action: "destructive_shell_command",
+        title: "\u786E\u8BA4\u6267\u884C\u7834\u574F\u6027 shell \u547D\u4EE4",
+        body: "\u8BE5\u547D\u4EE4\u53EF\u80FD\u5220\u9664\u6216\u91CD\u7F6E\u7528\u6237\u5185\u5BB9\uFF0C\u9700\u8981\u7528\u6237\u660E\u786E\u786E\u8BA4\u540E\u624D\u80FD\u6267\u884C\u3002",
+        ...command ? { command } : {},
+        suggestedRule: {
+          scope: "once",
+          pattern: { capability: "destructive_action", target: "shell_command" }
+        }
+      };
+      const buildBlockedError = (reason) => {
+        const error = new Error(reason);
+        error.code = "destructive_action_requires_confirmation";
+        error.policy = {
+          capability: "destructive_action",
+          target: "shell_command",
+          detail: "execShell destructive command"
+        };
+        error.permissionRequest = request;
+        return error;
+      };
+      if (!args.confirmDestructiveAction) {
+        if (args.blockDestructiveWithoutConfirmation) {
+          throw buildBlockedError(
+            "destructive shell command blocked: no confirmation channel available"
+          );
+        }
+        return effectiveExecutor({
+          ...args.call,
+          name: decision.toolName
+        });
+      }
+      const confirmed = await args.confirmDestructiveAction(request);
+      if (!confirmed) {
+        throw buildBlockedError(
+          "destructive shell command blocked: user declined confirmation"
+        );
+      }
+    }
+  }
+  return effectiveExecutor({
+    ...args.call,
+    name: decision.toolName
+  });
+}
+
 // packages/cli/client/localDialogRecords.ts
 var localDialogMessageRecordToRuntimeMessage = dialogMessageRecordToAgentRuntimeMessage;
 function buildLocalDialogWritePlan(args) {
@@ -4458,8 +4533,6 @@ export {
   createHybridRecordStore,
   isDestructiveShellCommand,
   evaluateShellCommandPolicy,
-  resolveLocalToolPolicy,
-  executeLocalToolWithPolicy,
   filterRetainedLedgerRecords,
   isLineRangeCovered,
   getProcessRegistry,
@@ -4467,6 +4540,8 @@ export {
   buildLocalWorkspacePolicyToolNames,
   buildLocalWorkspaceOpenAiTools,
   createLocalWorkspaceToolExecutors,
+  resolveLocalToolPolicy,
+  executeLocalToolWithPolicy,
   localDialogMessageRecordToRuntimeMessage,
   buildLocalDialogWritePlan,
   buildNoloWorkspaceCliToolExecutors,