Skip to content

Navigation Menu

Appearance settings

View all features
- BY COMPANY SIZE
  Enterprises
  Small and medium teams
  Startups
  Nonprofits
- BY USE CASE
  App Modernization
  DevSecOps
  DevOps
  CI/CD
  View all use cases
- BY INDUSTRY
  Healthcare
  Financial services
  Manufacturing
  Government
  View all industries
View all solutions
- EXPLORE BY TOPIC
  AI
  Software Development
  DevOps
  Security
  View all topics
- EXPLORE BY TYPE
  Customer stories
  Events & webinars
  Ebooks & reports
  Business insights
  GitHub Skills
- SUPPORT & SERVICES
  Documentation
  Customer support
  Community forum
  Trust center
  Partners
View all resources
- COMMUNITY
  GitHub SponsorsFund open source developers
- PROGRAMS
  Security Lab
  Maintainer Community
  GitHub Stars
  Archive Program
- REPOSITORIES
  Topics
  Trending
  Collections
- ENTERPRISE SOLUTIONS
  Enterprise platformAI-powered developer platform
- AVAILABLE ADD-ONS
  GitHub Advanced SecurityEnterprise-grade security features
  Copilot for BusinessEnterprise-grade AI features
  Premium SupportEnterprise-grade 24/7 support
Pricing

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

shellicar / claude-cli Public

Notifications You must be signed in to change notification settings
Fork 3
Star 0

Code
Issues 13
Pull requests 11
Actions
Security and quality
Insights

Additional navigation options

Code
Issues
Pull requests
Actions
Security and quality
Insights

Add Tools V2 (Orchestrate): a composable tool engine alongside V1 - #487

#487

Open

shellicar wants to merge 149 commits into

mainshellicar/claude-cli:mainfrom

feature/orchestrateshellicar/claude-cli:feature/orchestrateCopy head branch name to clipboard

Conversation Commits149 (149)Checks Files changed

Open

Add Tools V2 (Orchestrate): a composable tool engine alongside V1#487
shellicar wants to merge 149 commits into
mainfrom
feature/orchestrate

Commits

Commits on Sep 12, 2026

Add orchestrate-core, the proven composable-tool execution engine
shellicar
committed
cdb2232
Add a genuinely lazy Find leaf for Orchestrate
shellicar
committed
c776952
Add a lazy Match leaf for Orchestrate, without V1's kind branch
shellicar
committed
560b938
Add Head, Tail, Range, and Read leaves, completing Pipe's six stages
shellicar
committed
7817d36
Add the real Program leaf, backed by exec-core's Executor
shellicar
committed
d7949d8
Rename Orchestrate's Leaf to ToolV2 and collapse the wire schema into one self-describing ToolsV2Registry
shellicar
committed
070d530
Move showStderr from the tool definition onto the stage, since any node can write meaningful stderr
shellicar
committed
7eeaa90
Wire Tools V2 into the wire tools list and QueryRunner dispatch, bypassing V1's registry and permission matrix entirely
shellicar
committed
c5c2926
Add the V2 Paths tool and retire Pipe from the catalogue, resolving the V1/V2 Find name collision
shellicar
committed
5fe3eb0
Fix a live bug: V2 approval requests were auto-rejected as tool-not-found by V1's permission matrix
shellicar
committed
d4c42a5
Note that Git_* migration is blocked on feature/git-tool landing on main
shellicar
committed
3f5c308
Build the unified policy resolver core: tool/input/path matching, ordered first-match resolution, strictest-wins folding
shellicar
committed
531efb1
Carry a message on the policy resolution, so a deny tells Claude why, same as RuleConfig does today
shellicar
committed
6be837f
Stop matchInput/resolve reaching into a tool's raw input for program/args — take an already-extracted Command instead
shellicar
committed
d989de1
Match a tool's real input fields structurally (program, args, verbatim) instead of an invented, Exec-owned vocabulary
shellicar
committed
5c618cc
Fix matchesValue: a plain list against an array is now equivalent to anyOf, and allOf/anyOf/suffix combine instead of the first one winning
shellicar
committed
0a94fff
Prove allOf/anyOf combined with suffix can never match, since one needs an array and the other a string
shellicar
committed
d212e1a
Cover the no-exe suffix rule in the composed policy integration test
shellicar
committed
1c008e2
Add an explicit basename pattern so program matching catches a full path (/bin/rm), opt-in per field rather than stripping every scalar unconditionally
shellicar
committed
716e8e7
Add maxLength, and normalise CLI flag conventions in allOf/anyOf; prove full parity against every real ExecV3 defaultRules entry
shellicar
committed
64021b0
Test that command rules and path zones compose for one call, resolveSet against the real policy, and that rule order is load-bearing
shellicar
committed
0500aa9
Cover the identified Policy gaps: empty-pattern guard, $HOME, non-object input, three-way rule combination, message interpolation edge cases, resolveSet all-ask and tie-breaking
shellicar
committed
0e341f2
Give Program feature parity with ExecV3: literal stdin, file redirect, timeout, ANSI stripping; fix a real bug where a trailing line with no newline was silently dropped
shellicar
committed
e150c9e
Fix the PipeConsumerGone deadlock: wrap the generator so return() triggers the abort synchronously instead of waiting on a promise nothing else settles
shellicar
committed
2ca8b82
Reject an empty program and a dangling op on the last stage — pin down behaviour that was previously only accidental, not tested
shellicar
committed
2b6d744
Cover the remaining ExecV3 composition scenarios: sequential-after-skip, precedence, 3-stage pipe, no-pipefail
shellicar
committed
2ca9c7f
Add validatePolicy (the three cases: wrong shape, dead against a loaded tool, inert against an unloaded one) and PolicyStore, which only updates on a valid policy
shellicar
committed
dc52aca
Add the top-level policy config field, backed by the proven default ACL; not wired into approval yet
shellicar
committed
82b2045
Wire Policy into real V2 approval: gated stages resolve against config.policy first, human-ask only fires for an ask verdict
shellicar
committed
773aa9c
Update our ToolsV2Service/PolicyStore/IOrchestrateEngine registrations to the new @shellicar/core-di API after the main rebase
shellicar
committed
6ee2096
Give policy its own independent watch and notice, mirroring tools.rules: invalid/recovered/changed, spliced into the primary view
shellicar
committed
55d204a
Distinguish denied from skipped, carry the denial message through to the model, and stop a piped stage from running against a denied producer's non-existent output
shellicar
committed
c0b30b2
Mark V2 tool path fields with isPath and extract them via collectPaths, so Policy's path-scoped rules ($PWD, *) can actually match
shellicar
committed
5811d08
Fix resolve(): the wildcard path rule (path: '*') was being skipped when paths was empty, defeating the one rule meant to catch everything
shellicar
committed
653e435
Add the unified V2 Delete tool (files and directories in one, no kind branch, same principle as Match)
shellicar
committed
6737314
Fix resolve(): a rule silent on this operation now falls through to the next matching rule, instead of silently resolving to ask
shellicar
committed
58a62e1
Send the gated stage's own resolved input on a V2 approval request, not just the piped batch (which was empty for any producer stage)
shellicar
committed
75f1fa6
Read and Delete now take paths only via their own marked field, never an implicit upstream read — matches find | xargs rm, not a nonexistent find | rm
shellicar
committed
031c551
Make Read.paths/Delete.files optional at the schema level — required broke every Xargs-fed call, since toStage() parses eagerly before Xargs injects anything
shellicar
committed
fb11e7f
Log every V2 policy resolution under one grep-able message name (policy_resolution), so a wrong verdict is debuggable from the log instead of re-derived by hand
shellicar
committed
2e0fc04
Make Program.cwd optional, defaulting to the injected IFileSystem's own cwd() via a new resolveDefaults hook — not baked into the schema, which must stay free of runtime dependencies
shellicar
committed
7f9e314
Fix resolveDefaults tests to compare the precise value against actual, not the whole object with the field accessed only at the assertion
shellicar
committed
e972376
Split multi-assertion tests and name expected/actual throughout policyGatedApproval.spec.ts, per the testing/typescript skills
shellicar
committed
8725345
Update the plan with tonight's priorities: fix ESC-cancel, design tool rendering, port more V1 tools to V2; mark approval rendering done
shellicar
committed
66fd64c
Correct the plan: full V1/V2 tool gap analysis, file tools + Ref are the urgent V2 port, remove a fabricated ExecV3/file-tools note
shellicar
committed
adb82ad
Add the V2 Ref tool, sharing the same RefStore V1's automatic ref-swap writes to — Ref | Match filters a huge stored ref without pulling it all into context first
shellicar
committed
687867b
When a tool name exists in both V1 and V2, send only the V2 entry — the API rejects duplicate tool names outright
shellicar
committed
b9a6520
Add the V2 CreateFile tool, same overwrite semantics as V1
shellicar
committed
65ed7e8
Add the V2 AppendFile tool
shellicar
committed
0c845bb
Add the V2 EditFile tool, reusing V1's applyEdits/generateDiff/validateEdits verbatim; diff emitted as lines instead of one JSON string
shellicar
committed
ad3f56b
Extract applyTextEdits/sortBottomToTop into one shared module, removing the duplicate copies in V1 and V2 EditFile
shellicar
committed
156362d
Extract the whole EditFile operation (read/sort/validate/apply/diff/write) into one shared performEdit function used by both V1 and V2
shellicar
committed
a42b8af
Extract performCreateFile and RefStore.getSlice, removing the remaining duplicated logic between V1 and V2 CreateFile/Ref
shellicar
committed
5e736d2
ESC now cancels a running Orchestrate/Program call instead of only marking the query cancelled
shellicar
committed
d3a2740
Linting
shellicar
committed
fdd9e89
Split V1's ReadFile into V2 Read (text) and a new V2 ReadBinaryFile (PDF/image, excluded from Orchestrate stages)
shellicar
committed
0d52c32
Replace the TS tools' blockLifetime/IToolBlockNotifier mechanism with a real per-block DI scope
shellicar
committed
afaff93
Register IOrchestrateEngine in the cancel-before-approval test's own service wiring
shellicar
committed
5a4a2b0
Document the known core-di eagerSingletons/IServiceProvider gap in container.ts, pending an upstream fix
shellicar
committed
d886c5d
Bump core-di/core-di-engine to 5.0.0-alpha.5 (fixes the eagerSingletons/IServiceProvider bug); disable build.ts's validate() until its own remaining false-positive is fixed
shellicar
committed
1f69642
Port the Memory tools (WriteMemory/ReadMemory/SearchMemory/DeleteMemory/MemoryTypes) to V2, reusing V1's schemas and IMemoryStore directly
shellicar
committed
bb6c474
Port the History tools (SearchHistory/ReadHistory) to V2, extracting the shared query/mapping logic out of V1 first
shellicar
committed
b74a686
Port the Skill tool to V2, reusing V1's resolveSkills/splitFrontmatter directly
shellicar
committed
9af9739
Add escalate as an Operation sibling to the fs.* tiers, never pre-trustable by ApprovalGrant
shellicar
committed
735a0cc
Port GitHub/AzureDevOps/Az to V2 using the new escalate operation, extracting shared specs out of V1 first
shellicar
committed
f1e8c01
Add IOrchestrateEngine.runBatch, owning the whole V2 approval flow and per-batch DI scope
shellicar
committed
97fe8d2
Port TsDiagnostics/TsHover/TsReferences/TsDefinition to Tools V2
shellicar
committed
f0c758c
Fold tsserver's own failure message into TsServerClient's thrown errors
shellicar
committed
ec80a6f
Extract tsServerFailureMessage and test it directly, no real tsserver needed
shellicar
committed
938edaa
Label a V2 approval prompt with its stage position (stage 2 of 3) inside a multi-stage Orchestrate pipeline
shellicar
committed
8f0d5cb
matchesPath resolves both sides against cwd itself, so a relative path can match $PWD
shellicar
committed
0e2fdda
Resolve a V2 tool's isPath fields on a throwaway copy at run() time, never mutating the record
shellicar
committed
3de3e2b
Render an Orchestrate call as its pipeline shape (tool(arg) | tool(arg)), same as Pipe
shellicar
committed
7569f64
Let a tool declare its own display summary instead of a central function guessing at every tool's shape
shellicar
committed
a9a6cec
Find's own summarize keeps its Find(...) wrapper, matching how other tools display
shellicar
committed
7b2d418
Show only Ref's size, drop the id/hint from its summary line
shellicar
committed
9511e93
Report a gated stage's real position in the pipeline, not its position among stages that asked
shellicar
committed
b50eefd
Mint a uuid per approval and correlate on the real tool_use id
shellicar
committed
56de3b7
Judge each of a call's paths on its own, and take the conjunction
shellicar
committed
fb2ae3f
Take the strictest verdict with a loop rather than a reduce
shellicar
committed
b894d45
Update the Az test fakes to the identity-config shape
shellicar
committed
66bb7c9
Drop a dead Xargs batch on the skip path, and judge policy against the injected cwd and clock
shellicar
committed
82f6cd3
Run Program under the env provider, and expand $VAR in its args
shellicar
committed
db90af0
Expose captureAs, and make a capture a real variable for the rest of the call
shellicar
committed
d631bf4
Name the configured Azure accounts when one has to be chosen
shellicar
committed
3125c4c
Resolve a reference against captures alone, and ship a policy with no opinions in it
shellicar
committed
449052e
Match a path pattern segment by segment, so a glob anywhere in it works
shellicar
committed
7904aca
Judge a policy path with the glob matcher, and hold it to POSIX on slashes
shellicar
committed
7ebcdf5
Bring V1 ReadFile back, and keep a second cancel escalating across the whole round
shellicar
committed
8b0eaf4
Hand a piped stage's stream to the next stage, so a consumer that stops early stops the producer
shellicar
committed
c573030
Let a tool name the field Xargs fills, and judge a pipeline's shape before running it
shellicar
committed
349bcd6
Frame a tsserver message by its byte length, so a symbol documented with an em dash still answers
shellicar
committed
ef4b491
Record the tsserver framing fix
shellicar
committed
f7c32ce
Report what each stage produced, so an empty result says which stage found nothing
shellicar
committed
d4a1849
Report the signal a stage died of, and settle every open stream however execute exits
shellicar
committed
f3d88cf
Hold a running process's output in one bounded buffer, and read it only when asked
shellicar
committed
6ad07ae
State how far a stage may run ahead of its reader, as tests
shellicar
committed
b2aed79
Let a stage run ahead of its reader by one buffer, and stop it there
shellicar
committed
254d307
Drop Program's output limits, now that a producer is bounded by its reader
shellicar
committed
9202258
Judge a stage on what it will really do, and keep a captured value out of everything but the process
shellicar
committed
5e49b5c
Say which part of a stage a captured value must stay out of, and which part it reaches
shellicar
committed
34a9048
Show that a flag arriving through a variable escapes a rule matching on arguments
shellicar
committed
e68b7e0
Decide on the command a stage will really run, and publish the one the caller wrote
shellicar
committed
d5995cd
Put every stage to the decision, instead of letting a tool exempt itself
shellicar
committed
2b4b3d5
Refuse a call that sets an environment variable deciding what runs, and let a rule name one
shellicar
committed
57b664f
Judge what a call does, so a redirect is a write and its file is nameable in a rule
shellicar
committed
8e154c6
Bound what a run will hold, so a producer that never ends is still stopped
shellicar
committed
e9be318
Make the shorthand match what it stands for, and stop trusting a frame without limit
shellicar
committed
0fc5335
Match a path the way the filesystem does, so a rule is not evaded by typing it differently
shellicar
committed
d6bf575
Decide about the file the kernel will open, not the name it was reached by
shellicar
committed
7e98cd5
Refuse a capture that names an environment variable deciding what runs
shellicar
committed
756eb3c
Delete what cannot run, and the comments that defended it
shellicar
committed
1103976
Make a caller say which machine it is matching a path on
shellicar
committed
606e8d3
Buffer a stage with a stream, and bound it by what it holds rather than what the values say
shellicar
committed
d4eba3f
Work out a call's stages once, so what was checked is what runs
shellicar
committed
6f6ef9e
Wait for a stage to finish tearing down before saying how it went
shellicar
committed
646041b
Carry bytes between every stage, so one mechanism streams and Node counts it
shellicar
committed
a786d69
Cut the comments that argue with the code instead of describing it
shellicar
committed
5facb02
Drop the type parameter and imports the byte contract left behind
shellicar
committed
a7e7342
Pin a pipeline's behaviour against real processes, not against fakes that answer themselves
shellicar
committed
dd7f96b
Hold a stage's output in the stage's own stream, and nowhere else
shellicar
committed
dcbc3b2
Say what a channel between two stages does, and delete the engine that grew around lines
shellicar
committed
313d63e
Hold bytes between two stages, bounded by how far ahead the writer may be
shellicar
committed
20249d6
Say where one argument ends and the next begins
shellicar
committed
1a35809
Split bytes into arguments at a newline, and nowhere else
shellicar
committed
9b55bce
Say what a run does with its stages, and what each one may end as
shellicar
committed
5cfc0b6
Record what an approver was shown against the stage it was shown for
shellicar
committed
bb09ee6
Let a delay have elapsed before anything asked for one
shellicar
committed
f0ca104
Run a list of stages, each ending exactly one way
shellicar
committed
3d73b00
Drop an unused binding
shellicar
committed
ef8d1dd
Say what cancelling, capturing and feeding an argument list do
shellicar
committed
1b7ec55
Bind a name in a stage of its own, rather than annotating the stage that produced the value
shellicar
committed
fa9b455
Let the receiving tool say where an argument list goes
shellicar
committed
d300dc8
Stop a run when told, bind a name to what came before, and feed the next stage a list
shellicar
committed
3557a7a
Say what a stage has to say, and where that goes
shellicar
committed
c970564
Collect what a stage had to say, against the stage that said it
shellicar
committed
7b0f932
Show what a stage captured when it is worth reading, and let the call say otherwise
shellicar
committed
92502e7
Say what may be sent as a document or an image, and what must be read as text instead
shellicar
committed
5ea5990
Say where something that is not text goes, and what carries its type
shellicar
committed
02eb9b3
Carry back what is not text, with the type its tool knows it to be
shellicar
committed
9fd0e0e
Say what a command does with each of its four ports
shellicar
committed
0b3e06b
Say what was given and what came back, rather than building the plumbing in each test
shellicar
committed
b46bb7f
Run a command over the four ports: bytes down, stderr captured, exit as the outcome
shellicar
committed
59254df
Walk a directory a path at a time, and say how much of it could not be read
shellicar
committed
e468b16
Take the first N lines, and stop reading once they are had
shellicar
committed
1521ca4
Take the last N lines
shellicar
committed
ecdd900
Take the lines between two bounds, and stop at the upper one
shellicar
committed
15f1485
Keep the lines that match, and the lines around them
shellicar
committed
925c475
Repair the lockfile the rebase merged into an inconsistent state
shellicar
committed
d72a354

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.