open-multi-agent-kit 0.93.0 → 0.94.0

package/dist/core/agent-session.js

@@ -16,36 +16,31 @@ import { createHash, randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname } from "node:path";
 import { isDeepStrictEqual } from "node:util";
-import { repairTranscriptIntegrity, } from "omk-agent-core";
 import { clampThinkingLevel, cleanupSessionResources, getSupportedThinkingLevels, isContextOverflow, modelsAreEqual, resetApiProviders, streamSimple, } from "omk-ai";
 import { theme } from "../modes/interactive/theme/theme.js";
 import { stripFrontmatter } from "../utils/frontmatter.js";
 import { resolvePath } from "../utils/paths.js";
-import { sanitizeBinaryOutput } from "../utils/shell.js";
+import { getShellConfig } from "../utils/shell.js";
 import { sleep } from "../utils/sleep.js";
 import { createAdaptorchBridge } from "./adaptorch-bridge.js";
 import { applyCategoryTimeoutDefaults, resolveAgentToolSettings, resolveToolTimeoutCategory, } from "./agent-tool-settings.js";
 import { formatNoApiKeyFoundMessage, formatNoModelSelectedMessage } from "./auth-guidance.js";
 import { parseBangInvocation } from "./bang-skill-invocation.js";
-import { executeBashWithOperations } from "./bash-executor.js";
-import { classifyShellCommand } from "./command-safety.js";
 import { getCompactionHeadroomThreshold } from "./compaction/compaction.js";
 import { createCompactionHysteresisConfig, createCompactionHysteresisState, stepCompactionHysteresis, } from "./compaction/hysteresis.js";
 import { calculateContextTokens, collectEntriesForBranchSummary, compact, estimateContextTokens, estimateProjectedContextTokens, generateBranchSummary, prepareCompaction, resolveCompactionModel, } from "./compaction/index.js";
 import { compactionEmitWillRetry } from "./compaction/resume-policy.js";
-import { createCompactionEnvelope, createCompactionSourceIdentity, createCompactionTransaction, decideCompactionCommit, evaluateCompactionBarrier, validateCompactionEnvelope, } from "./compaction/transaction.js";
 import { estimateToolResultReserve, } from "./context-budget-reserved-tokens.js";
 import { applyContextCacheInvalidation, createContextCacheInvalidationSnapshot, } from "./context-budget-v2-cache-invalidation.js";
 import { createMemoryContextBudgetCacheProviderV2 } from "./context-budget-v2-cache-provider.js";
 import { DEFAULT_THINKING_LEVEL } from "./defaults.js";
 import { exportSessionToHtml } from "./export-html/index.js";
 import { createToolHtmlRenderer } from "./export-html/tool-renderer.js";
-import { buildBlockedBashResult, evaluateCommandGate, isCommandSafetyAssumeYesEnabled, } from "./extensions/builtin/command-safety-gate.js";
 import { ExtensionRunner, wrapRegisteredTools, } from "./extensions/index.js";
 import { emitSessionShutdownEvent } from "./extensions/runner.js";
 import { assertTextChatModelForCompletion } from "./grok-harness.js";
 import { grokPlaybookAppendForProvider } from "./grok-playbook.js";
-import { assertLoadoutAccess, decideLoadoutAccess } from "./loadout-access-policy.js";
+import { decideLoadoutAccess } from "./loadout-access-policy.js";
 import { findExactModelReferenceMatch } from "./model-resolver.js";
 import { expandPromptTemplate } from "./prompt-templates.js";
 import { isContentSafetyStopMessage, isStickySafetyModel, isTransientProviderErrorMessage, pickFailoverCandidate, resolveProviderResilience, stickySafetyBlockMessage, } from "./provider-resilience.js";
@@ -54,8 +49,9 @@ import { classifyTaskV4, resolveThinkingLevelV4WithUncertainty } from "./reasoni
 import { redactSensitiveText } from "./redaction.js";
 import { appendRouterFeedbackRecord, } from "./router-feedback-collector.js";
 import { RunJournalStore } from "./run-journal-store.js";
-import { detectSandboxBackend } from "./sandbox/backend.js";
-import { inspectSessionIntegrity } from "./session-integrity.js";
+import { SessionBashRuntime } from "./session-bash-runtime.js";
+import { SessionBashService } from "./session-bash-service.js";
+import { SessionCompactionService } from "./session-compaction-service.js";
 import { CURRENT_SESSION_VERSION, getLatestCompactionEntry } from "./session-manager.js";
 import { classifySessionTermination, } from "./session-termination.js";
 import { createSyntheticSourceInfo } from "./source-info.js";
@@ -63,6 +59,8 @@ import { buildSystemPrompt } from "./system-prompt.js";
 import { createLocalBashOperations } from "./tools/bash.js";
 import { createAllToolDefinitions } from "./tools/index.js";
 import { createToolDefinitionFromAgentTool } from "./tools/tool-definition-wrapper.js";
+import { createVerifiedBashOperations } from "./verified-bash-adapter.js";
+import { resolveSessionWorkspaceScope } from "./verified-bash-runtime.js";
 /**
  * Parse a skill block from message text.
  * Returns null if the text doesn't contain a skill block.
@@ -120,17 +118,6 @@ function toolNameSetsEqual(left, right) {
     return (normalizedLeft.length === normalizedRight.length &&
         normalizedLeft.every((toolName, index) => toolName === normalizedRight[index]));
 }
-function isSandboxDeniedError(error) {
-    return error instanceof Error && error.message.startsWith("sandbox: shell denied");
-}
-function buildSandboxDeniedBashResult(reason) {
-    return {
-        output: reason,
-        exitCode: 1,
-        cancelled: false,
-        truncated: false,
-    };
-}
 function snapshotContractError(reason) {
     return new Error(`Finalized message replacement must be a plain serializable snapshot: ${reason}`);
 }
@@ -290,10 +277,8 @@ export class AgentSession {
     // not re-pick the same candidate (claude-opus-5 → grok → grok → grok loop fix).
     _refusedModels = new Set();
     // Bash execution state
-    _bashAbortController = undefined;
-    _pendingBashMessages = [];
-    _configuredBashSandboxPreflight = undefined;
-    _detectedBashSandboxBackend = undefined;
+    _bashService;
+    _compactionService;
     // Extension system
     _extensionRunner;
     _turnIndex = 0;
@@ -325,6 +310,7 @@ export class AgentSession {
     _replayLedger;
     _replayGoalId;
     _replayLaneId;
+    _bashRuntime;
     _transcriptRepair;
     _sessionRiskLevel = "normal";
     _workspaceMutationCount = 0;
@@ -363,7 +349,6 @@ export class AgentSession {
         this._excludedToolNames = config.excludedToolNames ? new Set(config.excludedToolNames) : undefined;
         this._baseToolsOverride = config.baseToolsOverride;
         this._loadoutAccessPolicy = config.loadoutAccessPolicy;
-        this._configuredBashSandboxPreflight = config.bashSandboxPreflight;
         this._sessionStartEvent = config.sessionStartEvent ?? { type: "session_start", reason: "startup" };
         this._transcriptRepair = config.transcriptRepair;
         this._replayLedger = config.replayLedger;
@@ -372,6 +357,37 @@ export class AgentSession {
         if (this._replayLedger && this._replayGoalId !== this._replayLedger.getLedger().goalId) {
             throw new Error("AgentSession replayGoalId does not match the replay ledger goal id");
         }
+        this._bashRuntime = new SessionBashRuntime({
+            cwd: this._cwd,
+            getExecutionCwd: () => this.sessionManager.getCwd(),
+            getSessionFile: () => this.sessionManager.getSessionFile(),
+            replayLedger: this._replayLedger,
+            replayGoalId: this._replayGoalId,
+            replayLaneId: this._replayLaneId,
+            configuredSandboxPreflight: config.bashSandboxPreflight,
+            appendReplayEvent: (type, payload) => this._appendReplayEvent(type, payload),
+        });
+        this._bashService = new SessionBashService({
+            settings: this.settingsManager,
+            runtime: this._bashRuntime,
+            loadoutPolicy: this._loadoutAccessPolicy,
+            getCwd: () => this.sessionManager.getCwd(),
+            emit: (event) => this._emit(event),
+            isStreaming: () => this.isStreaming,
+            pushMessage: (message) => this.agent.state.messages.push(message),
+            appendMessage: (message) => this.sessionManager.appendMessage(message),
+        });
+        this._compactionService = new SessionCompactionService({
+            sessionManager: this.sessionManager,
+            pendingToolCallIds: () => this.agent.state.pendingToolCalls,
+            getUserMessageText: (message) => this._getUserMessageText(message),
+            cwd: this._cwd,
+            invalidateContextBudget: () => this._invalidateContextBudgetCache({ type: "transcriptRepair" }),
+            refreshAgentMessages: () => {
+                this.agent.state.messages = this.sessionManager.buildSessionContext().messages;
+            },
+            recordCommit: () => this._recordCompactionCommitForHysteresis(),
+        });
         const sessionFile = this.sessionManager.getSessionFile();
         this._runJournalStore = RunJournalStore.open({
             ...(sessionFile ? { journalPath: `${sessionFile}.runjournal` } : {}),
@@ -465,6 +481,10 @@ export class AgentSession {
         });
         this._replayLedger.persist();
     }
+    /** Lazy verified-bash executor bound to this session's replay ledger (default-on path). */
+    _getVerifiedEvidenceExecutor() {
+        return this._bashRuntime.verifiedEvidenceExecutor();
+    }
     /** Append one required durable audit record. Persistence failures propagate. */
     _appendRunJournalAudit(event, details) {
         this._runJournalStore.audit({
@@ -754,12 +774,7 @@ export class AgentSession {
         }
     }
     _getBashSandboxPreflight(override) {
-        const preflight = override ?? this._configuredBashSandboxPreflight;
-        if (!preflight || preflight.policy.mode === "off" || preflight.backend) {
-            return preflight;
-        }
-        this._detectedBashSandboxBackend ??= detectSandboxBackend();
-        return { ...preflight, backend: this._detectedBashSandboxBackend };
+        return this._bashRuntime.sandboxPreflight(override);
     }
     async _getRequiredRequestAuth(model) {
         const result = await this._modelRegistry.getApiKeyAndHeaders(model);
@@ -2361,230 +2376,11 @@ export class AgentSession {
     // =========================================================================
     // Compaction
     // =========================================================================
-    _captureCompactionState() {
-        return this.sessionManager.withCompactionCommitLock(() => this._captureCompactionStateLocked());
-    }
-    _captureCompactionStateLocked() {
-        const sessionFile = this.sessionManager.getSessionFile();
-        const bytes = sessionFile && existsSync(sessionFile)
-            ? new Uint8Array(readFileSync(sessionFile))
-            : new TextEncoder().encode(`${[this.sessionManager.getHeader(), ...this.sessionManager.getEntries()]
-                .filter((entry) => entry !== null)
-                .map((entry) => JSON.stringify(entry))
-                .join("\n")}\n`);
-        const report = inspectSessionIntegrity(bytes, { activeLeafId: this.sessionManager.getLeafId() });
-        const branchEntries = report.activeBranch;
-        let latestCompactionIndex = -1;
-        for (let index = branchEntries.length - 1; index >= 0; index -= 1) {
-            if (branchEntries[index]?.type === "compaction") {
-                latestCompactionIndex = index;
-                break;
-            }
-        }
-        const latestCompaction = branchEntries[latestCompactionIndex];
-        const firstKeptIndex = latestCompaction?.type === "compaction"
-            ? branchEntries.findIndex((entry) => entry.id === latestCompaction.firstKeptEntryId)
-            : -1;
-        const sourceEntries = branchEntries.slice(latestCompactionIndex < 0 ? 0 : firstKeptIndex < 0 ? latestCompactionIndex : firstKeptIndex);
-        const firstEntry = sourceEntries[0];
-        const lastEntry = sourceEntries.at(-1);
-        if (!firstEntry || !lastEntry || report.activeLeafId === null) {
-            const barrier = evaluateCompactionBarrier(report, [...this.agent.state.pendingToolCalls]);
-            if (barrier.status !== "ready")
-                throw this._barrierError(barrier);
-            throw new Error("Nothing to compact: the active session branch is empty");
-        }
-        const revision = this.sessionManager.getDurableHeadToken();
-        const source = createCompactionSourceIdentity({
-            sessionId: revision.sessionId,
-            entryIds: sourceEntries.map((entry) => entry.id),
-            firstEntryId: firstEntry.id,
-            lastEntryId: lastEntry.id,
-            sourceSha256: createHash("sha256")
-                .update(sourceEntries.map((entry) => JSON.stringify(entry)).join("\n"), "utf8")
-                .digest("hex"),
-            activeLeafId: report.activeLeafId,
-            messageCount: report.activeMessages.length,
-        });
-        return { report, branchEntries, revision, source };
-    }
-    _captureCompactionProvenance(capture) {
-        let latestIntent = "Continue the current session";
-        for (let index = capture.report.activeMessages.length - 1; index >= 0; index -= 1) {
-            const message = capture.report.activeMessages[index];
-            if (message?.role !== "user")
-                continue;
-            const candidate = sanitizeBinaryOutput(redactSensitiveText(this._getUserMessageText(message)).trim())
-                .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/gu, "")
-                .slice(0, 16_384);
-            if (candidate.length > 0)
-                latestIntent = candidate;
-            break;
-        }
-        const modelHistory = capture.branchEntries
-            .flatMap((entry) => {
-            if (entry.type === "model_change") {
-                return [{ entryId: entry.id, provider: entry.provider, modelId: entry.modelId }];
-            }
-            if (entry.type === "message" && entry.message.role === "assistant") {
-                return [{ entryId: entry.id, provider: entry.message.provider, modelId: entry.message.model }];
-            }
-            return [];
-        })
-            .slice(-256);
-        const customEntryIds = (customType) => capture.branchEntries
-            .filter((entry) => entry.type === "custom" && entry.customType === customType)
-            .map((entry) => entry.id);
-        return {
-            latestIntent,
-            openTasks: [],
-            laneIds: customEntryIds("lane"),
-            acceptancePredicateIds: customEntryIds("acceptance_predicate"),
-            evidenceReceiptIds: customEntryIds("evidence_receipt"),
-            blockerReasons: [],
-            repairEventIds: [
-                ...customEntryIds("transcript_repaired"),
-                ...customEntryIds("compaction_transcript_repaired"),
-            ],
-            branch: null,
-            worktree: this._cwd,
-            modelHistory,
-            nextAction: latestIntent.slice(0, 4096) || "Continue the current session",
-        };
-    }
-    _barrierError(barrier) {
-        if (barrier.status === "defer") {
-            return new Error(`Compaction deferred until the transcript closes (${barrier.reason})`);
-        }
-        return new Error(`Compaction failed closed on transcript integrity (${barrier.reason}). Run the session doctor before retrying.`);
-    }
-    _evaluateCompactionBarrier(capture, includeMissingTailAsPending, excludedPendingIds = new Set()) {
-        const pending = new Set([...this.agent.state.pendingToolCalls].filter((toolCallId) => !excludedPendingIds.has(toolCallId)));
-        if (includeMissingTailAsPending) {
-            for (const issue of capture.report.transcript?.issues ?? []) {
-                if (issue.kind === "missing_result")
-                    pending.add(issue.toolCallId);
-            }
-        }
-        return evaluateCompactionBarrier(capture.report, [...pending]);
-    }
-    _repairEmergencyCompactionTail(capture) {
-        const barrier = this._evaluateCompactionBarrier(capture, true);
-        if (barrier.status !== "defer" || barrier.reason !== "missing_active_tail_results") {
-            if (barrier.status !== "ready")
-                throw this._barrierError(barrier);
-            return { capture, repairedToolCallIds: new Set() };
-        }
-        const repairedMessages = repairTranscriptIntegrity([...capture.report.activeMessages], "Tool result missing; synthesized to close an emergency compaction barrier");
-        const inserted = repairedMessages.slice(capture.report.activeMessages.length);
-        const repairedToolCallIds = new Set();
-        for (const message of inserted) {
-            if (message.role !== "toolResult") {
-                throw new Error("Emergency compaction repair produced a non-tool result");
-            }
-            const toolResult = message;
-            repairedToolCallIds.add(toolResult.toolCallId);
-            this.sessionManager.appendMessage(toolResult);
-        }
-        this.sessionManager.appendCustomEntry("compaction_transcript_repaired", {
-            insertedToolCallIds: [...repairedToolCallIds],
-            reason: "emergency_compaction",
-        });
-        this._invalidateContextBudgetCache({ type: "transcriptRepair" });
-        const closedCapture = this._captureCompactionState();
-        const closedBarrier = this._evaluateCompactionBarrier(closedCapture, false, repairedToolCallIds);
-        if (closedBarrier.status !== "ready")
-            throw this._barrierError(closedBarrier);
-        this.agent.state.messages = this.sessionManager.buildSessionContext().messages;
-        return { capture: closedCapture, repairedToolCallIds };
-    }
-    _priorCommittedCompactionSourceDigests() {
-        const digests = [];
-        for (const entry of this.sessionManager.getEntries()) {
-            if (entry.type !== "compaction" || typeof entry.details !== "object" || entry.details === null)
-                continue;
-            if (!Object.hasOwn(entry.details, "compactionEnvelope"))
-                continue;
-            const envelope = validateCompactionEnvelope(Reflect.get(entry.details, "compactionEnvelope"));
-            if (envelope.summary !== entry.summary) {
-                throw new Error(`Compaction entry ${entry.id} has invalid provenance. Run the session doctor.`);
-            }
-            digests.push(envelope.source.sourceSha256);
-        }
-        return digests;
-    }
     _beginCompactionTransaction(compactionModel, emergency) {
-        let capture = this._captureCompactionState();
-        if (emergency) {
-            capture = this._repairEmergencyCompactionTail(capture).capture;
-        }
-        else {
-            const barrier = this._evaluateCompactionBarrier(capture, false);
-            if (barrier.status !== "ready")
-                throw this._barrierError(barrier);
-        }
-        const transaction = createCompactionTransaction({
-            transactionId: randomUUID(),
-            baseRevision: capture.revision,
-            source: capture.source,
-            createdAt: new Date().toISOString(),
-            model: { provider: compactionModel.provider, id: compactionModel.id },
-            preserved: this._captureCompactionProvenance(capture),
-        });
-        if (this._priorCommittedCompactionSourceDigests().includes(transaction.source.sourceSha256)) {
-            throw new Error("This exact compaction source was already compacted");
-        }
-        return { capture, transaction };
-    }
-    _detailsWithCompactionEnvelope(details, envelope) {
-        if (typeof details === "object" && details !== null && !Array.isArray(details)) {
-            return { ...details, compactionEnvelope: envelope };
-        }
-        return {
-            compactionEnvelope: envelope,
-            ...(details === undefined ? {} : { resultDetails: details }),
-        };
+        return this._compactionService.beginTransaction(compactionModel, emergency);
     }
     _commitCompaction(begun, result, fromExtension) {
-        if (!begun.transaction.source.entryIds.includes(result.firstKeptEntryId)) {
-            throw new Error("Compaction first-kept entry is outside the captured source");
-        }
-        const committed = this.sessionManager.withCompactionCommitLock(() => {
-            const current = this._captureCompactionState();
-            const barrier = this._evaluateCompactionBarrier(current, false);
-            const decision = decideCompactionCommit({
-                transaction: begun.transaction,
-                currentRevision: current.revision,
-                currentSource: current.source,
-                barrier,
-                priorCommittedSourceDigests: this._priorCommittedCompactionSourceDigests(),
-            });
-            switch (decision.decision) {
-                case "duplicate":
-                    throw new Error("This exact compaction source was already compacted");
-                case "stale":
-                    throw new Error(`Session changed during compaction (${decision.reason}); generated summary was discarded`);
-                case "defer":
-                case "fail_closed":
-                    throw this._barrierError(barrier);
-                case "commit": {
-                    const envelope = createCompactionEnvelope({
-                        transaction: begun.transaction,
-                        decision,
-                        summary: result.summary,
-                        summarySha256: createHash("sha256").update(result.summary, "utf8").digest("hex"),
-                    });
-                    const entryId = this.sessionManager.appendCompaction(result.summary, result.firstKeptEntryId, result.tokensBefore, this._detailsWithCompactionEnvelope(result.details, envelope), fromExtension);
-                    const entry = this.sessionManager.getEntry(entryId);
-                    if (!entry || entry.type !== "compaction") {
-                        throw new Error("Compaction commit did not produce a compaction entry");
-                    }
-                    return { entry, envelope };
-                }
-            }
-        });
-        this._recordCompactionCommitForHysteresis();
-        return committed;
+        return this._compactionService.commit(begun, result, fromExtension);
     }
     _pendingToolResultReserve(settings) {
         const pendingIds = this.agent.state.pendingToolCalls;
@@ -3432,6 +3228,29 @@ export class AgentSession {
                     commandPrefix: shellCommandPrefix,
                     shellPath,
                     ...(loadoutAccessGuard ? { loadoutAccessGuard } : {}),
+                    ...(() => {
+                        const sandboxPolicy = this._getBashSandboxPreflight();
+                        return sandboxPolicy ? { sandboxPolicy } : {};
+                    })(),
+                    ...(() => {
+                        const evidenceExecutor = this._getVerifiedEvidenceExecutor();
+                        if (!evidenceExecutor || !this._replayGoalId)
+                            return {};
+                        const { shell } = getShellConfig(shellPath);
+                        const inner = createLocalBashOperations({
+                            ...(shellPath !== undefined ? { shellPath } : {}),
+                            sandboxPolicy: this._getBashSandboxPreflight(),
+                        });
+                        return {
+                            operations: createVerifiedBashOperations(inner, {
+                                evidenceExecutor,
+                                goalId: this._replayGoalId,
+                                ...(this._replayLaneId !== undefined ? { laneId: this._replayLaneId } : {}),
+                                shell,
+                                workspaceScope: resolveSessionWorkspaceScope(this._cwd),
+                            }),
+                        };
+                    })(),
                 },
                 edit: loadoutWriteOptions,
                 write: loadoutWriteOptions,
@@ -3451,7 +3270,7 @@ export class AgentSession {
         this._applyExtensionBindings(this._extensionRunner);
         const defaultActiveToolNames = this._baseToolsOverride
             ? Object.keys(this._baseToolsOverride)
-            : ["read", "bash", "edit", "write"];
+            : ["read", "bash", "edit", "write", "diagnostics"];
         const baseActiveToolNames = options.activeToolNames ?? defaultActiveToolNames;
         this._refreshToolRegistry({
             activeToolNames: baseActiveToolNames,
@@ -3685,123 +3504,35 @@ export class AgentSession {
      * @param options.sandboxPolicy Trusted sandbox preflight for local bash execution (never sourced from RPC payloads)
      */
     async executeBash(command, onChunk, options) {
-        // Apply command prefix if configured (e.g., "shopt -s expand_aliases" for alias support)
-        const prefix = this.settingsManager.getShellCommandPrefix();
-        const shellPath = this.settingsManager.getShellPath();
-        const resolvedCommand = prefix ? `${prefix}\n${command}` : command;
-        if (this._loadoutAccessPolicy) {
-            assertLoadoutAccess((request) => decideLoadoutAccess(this._loadoutAccessPolicy, request), { operation: "execute", toolName: "bash", command: resolvedCommand });
-        }
-        // Non-negotiable safety floor for headless callers (RPC bash): hard-deny
-        // block-tier commands before any shell is spawned.
-        if (options?.safetyGate === "headless") {
-            const floorVerdict = classifyShellCommand(command);
-            if (floorVerdict.risk === "block") {
-                throw new Error(`OMK §0.1 safety floor blocked bash: [${floorVerdict.rule}] ${floorVerdict.reason}`);
-            }
-        }
-        // Command-safety parity for non-interactive callers (RPC bash). Interactive
-        // `!`/`!!` bash is gated earlier through the user_bash extension event, which
-        // keeps its prompt-based approval semantics, so it does not pass safetyGate and
-        // is never double-prompted here. confirm/block-tier verdicts deny headlessly;
-        // the EFFECTIVE command (after the shell command prefix) is classified.
-        if (options?.safetyGate === "headless") {
-            const decision = await evaluateCommandGate(resolvedCommand, {
-                hasUI: false,
-                headlessConfirmPolicy: isCommandSafetyAssumeYesEnabled() ? "allow" : "deny",
-            });
-            if (decision?.deny) {
-                const blocked = buildBlockedBashResult(decision.reason);
-                this.recordBashResult(command, blocked, options);
-                return blocked;
-            }
-        }
-        this._bashAbortController = new AbortController();
-        try {
-            try {
-                const result = await executeBashWithOperations(resolvedCommand, this.sessionManager.getCwd(), options?.operations ??
-                    createLocalBashOperations({
-                        shellPath,
-                        sandboxPolicy: this._getBashSandboxPreflight(options?.sandboxPolicy),
-                    }), {
-                    onChunk: (delta) => {
-                        onChunk?.(delta);
-                        this._emit({ type: "bash_execution_update", id: options?.id, delta });
-                    },
-                    signal: this._bashAbortController.signal,
-                });
-                this.recordBashResult(command, result, options);
-                return result;
-            }
-            catch (error) {
-                if (!isSandboxDeniedError(error)) {
-                    throw error;
-                }
-                const blocked = buildSandboxDeniedBashResult(error.message);
-                this.recordBashResult(command, blocked, options);
-                return blocked;
-            }
-        }
-        finally {
-            this._bashAbortController = undefined;
-        }
+        return this._bashService.executeBash(command, onChunk, options);
     }
     /**
      * Record a bash execution result in session history.
      * Used by executeBash and by extensions that handle bash execution themselves.
      */
     recordBashResult(command, result, options) {
-        const bashMessage = {
-            role: "bashExecution",
-            command,
-            output: result.output,
-            exitCode: result.exitCode,
-            cancelled: result.cancelled,
-            truncated: result.truncated,
-            fullOutputPath: result.fullOutputPath,
-            timestamp: Date.now(),
-            excludeFromContext: options?.excludeFromContext,
-        };
-        // If agent is streaming, defer adding to avoid breaking tool_use/tool_result ordering
-        if (this.isStreaming) {
-            // Queue for later - will be flushed on agent_end
-            this._pendingBashMessages.push(bashMessage);
-        }
-        else {
-            // Add to agent state immediately
-            this.agent.state.messages.push(bashMessage);
-            // Save to session
-            this.sessionManager.appendMessage(bashMessage);
-        }
+        this._bashService.recordBashResult(command, result, options);
     }
     /**
      * Cancel running bash command.
      */
     abortBash() {
-        this._bashAbortController?.abort();
+        this._bashService.abortBash();
     }
     /** Whether a bash command is currently running */
     get isBashRunning() {
-        return this._bashAbortController !== undefined;
+        return this._bashService.isBashRunning;
     }
     /** Whether there are pending bash messages waiting to be flushed */
     get hasPendingBashMessages() {
-        return this._pendingBashMessages.length > 0;
+        return this._bashService.hasPendingBashMessages;
     }
     /**
      * Flush pending bash messages to agent state and session.
      * Called after agent turn completes to maintain proper message ordering.
      */
     _flushPendingBashMessages() {
-        if (this._pendingBashMessages.length === 0)
-            return;
-        for (const bashMessage of this._pendingBashMessages) {
-            // Add to agent state
-            this.agent.state.messages.push(bashMessage);
-            // Save to session
-            this.sessionManager.appendMessage(bashMessage);
-        }
-        this._pendingBashMessages = [];
+        this._bashService.flushPending();
     }
     // =========================================================================
     // Session Management