omnimancer-cli 0.2.13__tar.gz → 0.2.19__tar.gz

{omnimancer_cli-0.2.13/omnimancer_cli.egg-info → omnimancer_cli-0.2.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: omnimancer-cli
-Version: 0.2.13
+Version: 0.2.19
 Summary: A unified command-line interface for multiple AI language models
 Author-email: Kellan Strong <kellan@jite.ai>
 License: MIT

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/omnimancer/cli/headless.py

@@ -255,6 +255,26 @@ class HeadlessRunner:
         if enhanced is not None:
             enhanced.set_approval_callback(_approve)
 
+    @staticmethod
+    def _enable_full_trust(agent_engine: Any) -> None:
+        """Relax the hard security layers for unattended full-trust runs.
+
+        Auto-approval alone is not enough: the command argument sanitizer
+        (pipes, &&, redirects), the forbidden-command list, the sensitive
+        filename patterns (*key*, *token*, .env, ...), and the 30s default
+        command timeout all block operations before/outside the approval
+        step, so a --dangerously-skip-permissions run still could not do real
+        work. The caller (e.g. a CI or agent container) is the security
+        boundary; hard-restricted system paths (~/.ssh, /etc, ...) stay
+        blocked.
+        """
+        executor = getattr(agent_engine, "executor", None)
+        if executor is not None and hasattr(executor, "set_full_trust"):
+            executor.set_full_trust(True)
+        file_system = getattr(agent_engine, "file_system", None)
+        if file_system is not None and hasattr(file_system, "set_full_trust"):
+            file_system.set_full_trust(True)
+
     async def run(self, prompt: str) -> int:
         agent_engine = getattr(self._engine, "agent_engine", None)
         if not agent_engine:
@@ -263,6 +283,7 @@ class HeadlessRunner:
 
         if self._no_approval:
             self._enable_auto_approval(agent_engine)
+            self._enable_full_trust(agent_engine)
 
         model = self._engine.config_manager.get_config().default_provider or "unknown"
         self._emitter.emit_init(model)

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/omnimancer/cli/tool_handler.py

@@ -150,6 +150,18 @@ class ToolHandler:
         return list(CODING_AGENT_TOOLS)
 
     async def execute_tool_call(self, tool_call: ToolCall) -> ToolResult:
+        # ToolCall normalizes JSON-string arguments on construction; anything
+        # still not a dict here is malformed — tell the model instead of
+        # crashing on args.get(...) inside a handler.
+        if not isinstance(tool_call.arguments, dict):
+            return ToolResult(
+                content="",
+                error=(
+                    f"Malformed arguments for {tool_call.name}: expected a "
+                    f"JSON object, got: {str(tool_call.arguments)[:200]}. "
+                    "Re-issue the call with the parameters as a JSON object."
+                ),
+            )
         try:
             # Read and Edit need post-processing / multi-step logic.
             if tool_call.name in _EDIT_TOOLS:

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/omnimancer/core/agent/file_system_manager.py

@@ -79,6 +79,14 @@ class FileSystemManager:
         # Operation tracking
         self.active_operations: Dict[str, Dict[str, Any]] = {}
 
+    def set_full_trust(self, enabled: bool) -> None:
+        """Enable/disable full-trust mode on the underlying security manager.
+
+        In full trust, sensitive name patterns (.env, *key*, *token*, ...)
+        stop blocking reads/writes; hard-restricted system paths still deny.
+        """
+        self.security.set_full_trust(enabled)
+
     async def _request_approval_if_needed(self, operation: Operation) -> bool:
         """Request approval for operation if approval manager is configured."""
         if not self.require_approval or not self.approval_manager:
@@ -242,14 +250,51 @@ class FileSystemManager:
         """
         Simple boolean check for file existence.
 
+        Performs a lightweight path-validation check followed by an async
+        filesystem probe.  Unlike :meth:`check_file_exists`, this method does
+        *not* invoke the full security-audit pipeline (permission logging, risk
+        assessment, approval workflow).  It is intended for high-frequency
+        callers (e.g. batch operations) that need a fast boolean answer.
+
+        .. warning::
+            This method enforces path-level access controls — hard-restricted
+            system paths (``/etc``, ``~/.ssh``, cloud-credential stores, etc.)
+            and sensitive-name patterns are still blocked via
+            :meth:`~omnimancer.core.security.permission_controller.PermissionController.validate_path_access`.
+            However, it skips the per-operation audit-log entries produced by
+            :meth:`~omnimancer.core.security.SecurityManager.secure_file_access`.
+            Do not use this method where per-access audit trails are required.
+
         Args:
-            path: Path to check for existence
+            path: Path to check for existence.
 
         Returns:
-            True if file exists and is accessible, False otherwise
+            True if the path passes security validation and exists on the
+            filesystem; False if the path is security-denied or does not exist.
         """
-        result = await self.check_file_exists(path)
-        return result["exists"] and result["error"] is None
+        try:
+            resolved = Path(path).resolve()
+        except (OSError, ValueError) as e:
+            logger.warning("file_exists: invalid path %r: %s", path, e)
+            return False
+
+        # Validate path against security policy without invoking the expensive
+        # audit pipeline.  This blocks hard-restricted system paths and
+        # sensitive-name patterns (e.g. /etc, ~/.ssh, *.db) the same way the
+        # full pipeline would.
+        if not self.security.permissions.validate_path_access(str(resolved), "read"):
+            logger.warning(
+                "file_exists: access denied by security policy for %s", resolved
+            )
+            return False
+
+        try:
+            exists = bool(await aiofiles.os.path.exists(resolved))
+            logger.debug("file_exists: %s → %s", resolved, exists)
+            return exists
+        except OSError as e:
+            logger.warning("file_exists: OS error checking %s: %s", resolved, e)
+            return False
 
     async def write_file_with_confirmation(
         self,

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/omnimancer/core/agent/program_executor.py

@@ -86,6 +86,10 @@ class CommandValidator:
     """Validates commands against security policies."""
 
     def __init__(self) -> None:
+        # Full-trust mode (unattended headless runs where an outer sandbox is
+        # the security boundary): argument sanitization is skipped so shell
+        # constructs (pipes, &&, redirects) reach the shell executor intact.
+        self.full_trust = False
         self.command_categories = {
             CommandCategory.SAFE_READ: {
                 "ls",
@@ -295,6 +299,11 @@ class CommandValidator:
 
     def validate_command_args(self, command: str, args: List[str]) -> List[str]:
         """Validate and sanitize command arguments."""
+        # Full trust: commands run via the shell on purpose — pipes, &&, and
+        # redirects are legitimate agent usage there.
+        if self.full_trust:
+            return list(args)
+
         import re
 
         # Define dangerous shell metacharacters and patterns

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/omnimancer/core/agent_managers.py

@@ -159,6 +159,10 @@ class ProgramExecutor(BaseManager):
         }
         self.timeout_seconds = self.default_config.timeout_seconds
 
+        # Full-trust mode (unattended headless runs where an outer sandbox is
+        # the security boundary) — see set_full_trust().
+        self.full_trust = False
+
     async def execute_operation(self, operation: Operation) -> OperationResult:
         """Execute command operation using enhanced executor.
 
@@ -261,6 +265,22 @@ class ProgramExecutor(BaseManager):
         """Terminate a running command."""
         return await self.enhanced_executor.terminate_command(execution_id)
 
+    def set_full_trust(self, enabled: bool) -> None:
+        """Enable full-trust mode for unattended runs.
+
+        The caller (e.g. a headless agent inside a container) is the security
+        boundary: the forbidden-command list and argument sanitization stop
+        blocking, and the default per-command timeout is raised so real build/
+        test runs can finish. Explicit per-operation timeouts are still honored.
+        """
+        self.full_trust = enabled
+        if enabled:
+            self.timeout_seconds = 600
+            self.default_config.timeout_seconds = 600
+        validator = getattr(self.enhanced_executor, "validator", None)
+        if validator is not None:
+            validator.full_trust = enabled
+
     def _validate_command(self, command: str) -> bool:
         """
         Validate command for backward compatibility with tests.
@@ -278,6 +298,10 @@ class ProgramExecutor(BaseManager):
             Security is provided through the approval system's risk assessment
             and user confirmation. Only explicitly dangerous commands are blocked.
         """
+        # Full trust: forbidden-command blocking is disabled.
+        if self.full_trust:
+            return True
+
         # Extract the base command (first word)
         base_command = command.strip().split()[0] if command.strip() else ""
 

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/omnimancer/core/models.py

@@ -113,6 +113,29 @@ class ToolCall:
     # Provider-assigned call id (OpenAI protocol pairs results to calls by id).
     id: Optional[str] = None
 
+    def __post_init__(self) -> None:
+        """Normalize arguments that arrive as a JSON-encoded string.
+
+        OpenAI-protocol servers send ``function.arguments`` as a JSON string,
+        and some models double-encode it. A value that doesn't decode to an
+        object is left as-is so the tool handler can report it to the model.
+        """
+        import json
+
+        if self.arguments is None:
+            self.arguments = {}
+            return
+        decoded: Any = self.arguments
+        for _ in range(2):
+            if not isinstance(decoded, str):
+                break
+            try:
+                decoded = json.loads(decoded)
+            except ValueError:
+                return
+        if isinstance(decoded, dict):
+            self.arguments = decoded
+
 
 @dataclass
 class ToolResultRecord:

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/omnimancer/core/security/permission_controller.py

@@ -46,6 +46,11 @@ class PermissionController:
         self.allowed_commands = self._get_default_allowed_commands()
         self.permission_rules = self._get_default_permission_rules()
 
+        # Full-trust mode (unattended headless runs where an outer sandbox is
+        # the security boundary): sensitive name patterns and the command
+        # allowlist stop blocking. Hard-restricted paths still deny.
+        self.full_trust = False
+
         # Initialize approval memory storage
         self._approval_memory: Dict[str, Dict[str, Any]] = {}
 
@@ -193,11 +198,16 @@ class PermissionController:
             # Normalize path
             normalized_path = str(Path(path).resolve())
 
-            # Hard-restricted paths are denied regardless of approval.
+            # Hard-restricted paths are denied regardless of approval —
+            # including full-trust mode.
             for restricted in self.restricted_paths:
                 if self._path_matches_pattern(normalized_path, restricted):
                     return False
 
+            # Full trust treats every operation as explicitly allowed.
+            if self.full_trust:
+                allow_sensitive = True
+
             # Sensitive name patterns are denied unless explicitly allowed.
             if not allow_sensitive:
                 for pattern in self.sensitive_patterns:
@@ -238,6 +248,11 @@ class PermissionController:
 
     def validate_command(self, command: str) -> bool:
         """Validate if command execution is allowed."""
+        # Full trust: the allowlist and pattern checks stop blocking — the
+        # outer sandbox is the security boundary.
+        if self.full_trust:
+            return True
+
         # Extract base command (first word)
         base_command = command.strip().split()[0]
 

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/omnimancer/core/security/security_manager.py

@@ -327,6 +327,17 @@ class SecurityManager:
             result["stderr"] = f"Security manager error: {str(e)}"
             return result
 
+    def set_full_trust(self, enabled: bool) -> None:
+        """Enable/disable full-trust mode on the permission controller.
+
+        Full trust is for unattended runs (e.g. headless agents inside a
+        container) where the caller is the security boundary: sensitive name
+        patterns and the command allowlist stop blocking operations. The
+        hard-restricted system paths in PermissionController.restricted_paths
+        still deny.
+        """
+        self.permissions.full_trust = enabled
+
     async def secure_file_access(
         self,
         file_path: str,

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/omnimancer/providers/azure.py

@@ -363,19 +363,23 @@ class AzureProvider(BaseProvider):
 
             if choices and len(choices) > 0:
                 message = choices[0].get("message", {})
-                content = message.get("content", "")
+                # Tool-call responses carry "content": null — coalesce to "".
+                content = message.get("content") or ""
                 usage = data.get("usage", {})
 
-                # Extract tool calls if present
+                # Extract tool calls if present. The wire protocol sends
+                # function.arguments as a JSON string; ToolCall normalizes
+                # it to a dict on construction.
                 tool_calls = []
                 if "tool_calls" in message:
-                    for tool_call in message["tool_calls"]:
+                    for i, tool_call in enumerate(message["tool_calls"]):
                         if tool_call.get("type") == "function":
                             function = tool_call.get("function", {})
                             tool_calls.append(
                                 ToolCall(
                                     name=function.get("name", ""),
                                     arguments=function.get("arguments", {}),
+                                    id=tool_call.get("id") or f"call_{i}",
                                 )
                             )
 

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/omnimancer/providers/mistral.py

@@ -324,19 +324,23 @@ class MistralProvider(BaseProvider):
 
             if choices and len(choices) > 0:
                 message = choices[0].get("message", {})
-                content = message.get("content", "")
+                # Tool-call responses carry "content": null — coalesce to "".
+                content = message.get("content") or ""
                 usage = data.get("usage", {})
 
-                # Extract tool calls if present
+                # Extract tool calls if present. The wire protocol sends
+                # function.arguments as a JSON string; ToolCall normalizes
+                # it to a dict on construction.
                 tool_calls = []
                 if "tool_calls" in message:
-                    for tool_call in message["tool_calls"]:
+                    for i, tool_call in enumerate(message["tool_calls"]):
                         if tool_call.get("type") == "function":
                             function = tool_call.get("function", {})
                             tool_calls.append(
                                 ToolCall(
                                     name=function.get("name", ""),
                                     arguments=function.get("arguments", {}),
+                                    id=tool_call.get("id") or f"call_{i}",
                                 )
                             )
 

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/omnimancer/providers/openai.py

@@ -332,7 +332,8 @@ class OpenAIProvider(BaseProvider):
 
             if choices and len(choices) > 0:
                 message = choices[0].get("message", {})
-                content = message.get("content", "")
+                # Tool-call responses carry "content": null — coalesce to "".
+                content = message.get("content") or ""
                 usage = data.get("usage", {})
 
                 return ChatResponse(
@@ -462,18 +463,16 @@ class OpenAIProvider(BaseProvider):
                 tool_calls = None
                 raw_tool_calls = msg.get("tool_calls")
                 if raw_tool_calls:
-                    import json
-
                     tool_calls = []
                     for i, tc in enumerate(raw_tool_calls):
                         func = tc.get("function", {})
-                        args = func.get("arguments", "{}")
-                        if isinstance(args, str):
-                            args = json.loads(args)
                         tool_calls.append(
                             ToolCall(
+                                # ToolCall normalizes JSON-string arguments
+                                # (including double-encoded ones) on
+                                # construction.
                                 name=func.get("name", ""),
-                                arguments=args,
+                                arguments=func.get("arguments", {}),
                                 # Some OpenAI-compatible servers omit ids;
                                 # synthesize one so results can pair to calls.
                                 id=tc.get("id") or f"call_{i}",

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/omnimancer/providers/openrouter.py

@@ -377,7 +377,9 @@ class OpenRouterProvider(BaseProvider):
 
             if choices and len(choices) > 0:
                 message = choices[0].get("message", {})
-                content = message.get("content", "")
+                # Tool-call responses carry "content": null — coalesce to ""
+                # so the fallback-warning concatenation below can't TypeError.
+                content = message.get("content") or ""
                 usage = data.get("usage", {})
 
                 # Extract model used (OpenRouter may route to different models)
@@ -446,19 +448,24 @@ class OpenRouterProvider(BaseProvider):
 
             if choices and len(choices) > 0:
                 message = choices[0].get("message", {})
-                content = message.get("content", "")
+                # Tool-call responses carry "content": null — coalesce to ""
+                # so the fallback-warning concatenation below can't TypeError.
+                content = message.get("content") or ""
                 usage = data.get("usage", {})
 
-                # Extract tool calls if present
+                # Extract tool calls if present. The wire protocol sends
+                # function.arguments as a JSON string; ToolCall normalizes
+                # it to a dict on construction.
                 tool_calls = []
                 if "tool_calls" in message:
-                    for tool_call in message["tool_calls"]:
+                    for i, tool_call in enumerate(message["tool_calls"]):
                         if tool_call.get("type") == "function":
                             function = tool_call.get("function", {})
                             tool_calls.append(
                                 ToolCall(
                                     name=function.get("name", ""),
                                     arguments=function.get("arguments", {}),
+                                    id=tool_call.get("id") or f"call_{i}",
                                 )
                             )
 

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/omnimancer/providers/xai.py

@@ -327,19 +327,23 @@ class XAIProvider(BaseProvider):
 
             if choices and len(choices) > 0:
                 message = choices[0].get("message", {})
-                content = message.get("content", "")
+                # Tool-call responses carry "content": null — coalesce to "".
+                content = message.get("content") or ""
                 usage = data.get("usage", {})
 
-                # Extract tool calls if present
+                # Extract tool calls if present. The wire protocol sends
+                # function.arguments as a JSON string; ToolCall normalizes
+                # it to a dict on construction.
                 tool_calls = []
                 if "tool_calls" in message:
-                    for tool_call in message["tool_calls"]:
+                    for i, tool_call in enumerate(message["tool_calls"]):
                         if tool_call.get("type") == "function":
                             function = tool_call.get("function", {})
                             tool_calls.append(
                                 ToolCall(
                                     name=function.get("name", ""),
                                     arguments=function.get("arguments", {}),
+                                    id=tool_call.get("id") or f"call_{i}",
                                 )
                             )
 

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19/omnimancer_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: omnimancer-cli
-Version: 0.2.13
+Version: 0.2.19
 Summary: A unified command-line interface for multiple AI language models
 Author-email: Kellan Strong <kellan@jite.ai>
 License: MIT

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "omnimancer-cli"
-version = "0.2.13"
+version = "0.2.19"
 description = "A unified command-line interface for multiple AI language models"
 readme = "README.md"
 requires-python = ">=3.10"

{omnimancer_cli-0.2.13 → omnimancer_cli-0.2.19}/tests/test_models.py

@@ -591,68 +591,117 @@ class TestStreamEvent:
 
         event = StreamEvent(type=StreamEventType.ERROR, error="Connection lost")
         assert event.error == "Connection lost"
-
-
-class TestParseDescribedToolCalls:
-    """parse_described_tool_calls recovers calls a model emitted as text.
-
-    Weak models mimic the "[Called tools: ...]" history notation instead of
-    issuing native tool calls; the parser turns that text back into ToolCall
-    objects so the agent loop can keep going.
-    """
-
-    def test_round_trips_describe_output(self):
-        from omnimancer.core.models import (
-            ToolCall,
-            describe_tool_calls,
-            parse_described_tool_calls,
-        )
-
-        calls = [
-            ToolCall(name="Grep", arguments={"pattern": "auth", "glob": "*.ts"}),
-            ToolCall(name="Read", arguments={"file_path": "/src/main.py"}),
-        ]
-        parsed = parse_described_tool_calls(describe_tool_calls(calls))
-
-        assert [(c.name, c.arguments) for c in parsed] == [
-            (c.name, c.arguments) for c in calls
-        ]
-
-    def test_plain_text_returns_empty(self):
-        from omnimancer.core.models import parse_described_tool_calls
-
-        assert parse_described_tool_calls("The auth flow looks correct.") == []
-        assert parse_described_tool_calls("") == []
-        assert parse_described_tool_calls(None) == []
-
-    def test_nested_json_with_braces_and_commas(self):
-        from omnimancer.core.models import parse_described_tool_calls
-
-        text = (
-            '[Called tools: Grep({"glob": "*.{ts,tsx}", '
-            '"output_mode": "files_with_matches", '
-            '"pattern": "AUTH_SESSION_KEY|automarketer_auth_session"})]'
-        )
-        parsed = parse_described_tool_calls(text)
-
-        assert len(parsed) == 1
-        assert parsed[0].name == "Grep"
-        assert parsed[0].arguments["glob"] == "*.{ts,tsx}"
-
-    def test_marker_embedded_in_other_text(self):
-        from omnimancer.core.models import parse_described_tool_calls
-
-        text = (
-            "Let me search for that.\n"
-            '[Called tools: Bash({"command": "git log --oneline -5"})]'
-        )
-        parsed = parse_described_tool_calls(text)
-
-        assert len(parsed) == 1
-        assert parsed[0].name == "Bash"
-        assert parsed[0].arguments == {"command": "git log --oneline -5"}
-
-    def test_malformed_json_is_skipped(self):
-        from omnimancer.core.models import parse_described_tool_calls
-
-        assert parse_described_tool_calls("[Called tools: Grep({'bad': json})]") == []
+
+
+class TestParseDescribedToolCalls:
+    """parse_described_tool_calls recovers calls a model emitted as text.
+
+    Weak models mimic the "[Called tools: ...]" history notation instead of
+    issuing native tool calls; the parser turns that text back into ToolCall
+    objects so the agent loop can keep going.
+    """
+
+    def test_round_trips_describe_output(self):
+        from omnimancer.core.models import (
+            ToolCall,
+            describe_tool_calls,
+            parse_described_tool_calls,
+        )
+
+        calls = [
+            ToolCall(name="Grep", arguments={"pattern": "auth", "glob": "*.ts"}),
+            ToolCall(name="Read", arguments={"file_path": "/src/main.py"}),
+        ]
+        parsed = parse_described_tool_calls(describe_tool_calls(calls))
+
+        assert [(c.name, c.arguments) for c in parsed] == [
+            (c.name, c.arguments) for c in calls
+        ]
+
+    def test_plain_text_returns_empty(self):
+        from omnimancer.core.models import parse_described_tool_calls
+
+        assert parse_described_tool_calls("The auth flow looks correct.") == []
+        assert parse_described_tool_calls("") == []
+        assert parse_described_tool_calls(None) == []
+
+    def test_nested_json_with_braces_and_commas(self):
+        from omnimancer.core.models import parse_described_tool_calls
+
+        text = (
+            '[Called tools: Grep({"glob": "*.{ts,tsx}", '
+            '"output_mode": "files_with_matches", '
+            '"pattern": "AUTH_SESSION_KEY|automarketer_auth_session"})]'
+        )
+        parsed = parse_described_tool_calls(text)
+
+        assert len(parsed) == 1
+        assert parsed[0].name == "Grep"
+        assert parsed[0].arguments["glob"] == "*.{ts,tsx}"
+
+    def test_marker_embedded_in_other_text(self):
+        from omnimancer.core.models import parse_described_tool_calls
+
+        text = (
+            "Let me search for that.\n"
+            '[Called tools: Bash({"command": "git log --oneline -5"})]'
+        )
+        parsed = parse_described_tool_calls(text)
+
+        assert len(parsed) == 1
+        assert parsed[0].name == "Bash"
+        assert parsed[0].arguments == {"command": "git log --oneline -5"}
+
+    def test_malformed_json_is_skipped(self):
+        from omnimancer.core.models import parse_described_tool_calls
+
+        assert parse_described_tool_calls("[Called tools: Grep({'bad': json})]") == []
+
+
+class TestToolCallArgumentNormalization:
+    """ToolCall normalizes arguments that arrive as JSON-encoded strings.
+
+    OpenAI-protocol servers send function.arguments as a JSON string (and
+    some models double-encode it). Providers that passed the raw value
+    through crashed the tool handler with "'str' object has no attribute
+    'get'".
+    """
+
+    def test_json_string_arguments_become_dict(self):
+        from omnimancer.core.models import ToolCall
+
+        tc = ToolCall(name="Glob", arguments='{"pattern": "**/*.py"}')
+        assert tc.arguments == {"pattern": "**/*.py"}
+
+    def test_double_encoded_arguments_become_dict(self):
+        import json
+
+        from omnimancer.core.models import ToolCall
+
+        double = json.dumps(json.dumps({"pattern": "TODO"}))
+        tc = ToolCall(name="Grep", arguments=double)
+        assert tc.arguments == {"pattern": "TODO"}
+
+    def test_none_arguments_become_empty_dict(self):
+        from omnimancer.core.models import ToolCall
+
+        tc = ToolCall(name="Read", arguments=None)
+        assert tc.arguments == {}
+
+    def test_dict_arguments_unchanged(self):
+        from omnimancer.core.models import ToolCall
+
+        tc = ToolCall(name="Read", arguments={"file_path": "/src/main.py"})
+        assert tc.arguments == {"file_path": "/src/main.py"}
+
+    def test_unparseable_string_left_for_handler_to_report(self):
+        from omnimancer.core.models import ToolCall
+
+        tc = ToolCall(name="Glob", arguments="not json at all")
+        assert tc.arguments == "not json at all"
+
+    def test_non_object_json_left_for_handler_to_report(self):
+        from omnimancer.core.models import ToolCall
+
+        tc = ToolCall(name="Glob", arguments="[1, 2, 3]")
+        assert tc.arguments == "[1, 2, 3]"