@duckmind/dm-linux-x64 0.65.5 → 0.65.7

package/extensions/dm-lens/clients/installer/index.js

@@ -16,9 +16,14 @@ import {
 const _installerRequire = createRequire(import.meta.url);
 import { createGunzip } from "node:zlib";
 import { TRANSIENT_MAX_COOLDOWN_MS } from "../dispatch/runners/utils/availability-policy.js";
-import { recordDegradationOnce } from "../degradation-ledger.js";
+import {
+  getDegradationLedgerGeneration,
+  recordDegradationOnce
+} from "../degradation-ledger.js";
 import { commitDurableStoreAsync } from "../durable-store.js";
 import { getGlobalDmLensDir } from "../file-utils.js";
+import { createGenerationMap } from "../generation-guard.js";
+import { resolveToolCwd } from "../tool-cwd.js";
 import {
   allAvailableGlobalBinDirs,
   installArgs,
@@ -29,7 +34,13 @@ import {
   resetSafeSpawnWindowsCommandCache,
   safeSpawnAsync
 } from "../safe-spawn.js";
+import {
+  createBoundedOutputSink,
+  DEFAULT_MAX_OUTPUT_BYTES
+} from "../spawn-output-cap.js";
+import { probeToolAsync } from "../tool-probe.js";
 import { logSessionStart } from "../sessionstart-logger.js";
+import { resolveGitHubToken } from "../zizmor-config.js";
 const TOOLS_DIR = path.join(getGlobalDmLensDir(), "tools");
 const INSTALL_LOCK_PATH = path.join(TOOLS_DIR, ".install.lock");
 const activeInstallLocks = new Set;
@@ -136,6 +147,131 @@ const OS_ARCH_ZIP_ASSETS = {
   darwin: { x64: "darwin_amd64.zip", arm64: "darwin_arm64.zip" },
   win32: { x64: "windows_amd64.zip", arm64: "windows_arm64.zip" }
 };
+function managedPackageFormatterTool(spec) {
+  return {
+    id: spec.id,
+    name: spec.name,
+    checkCommand: spec.id,
+    checkArgs: ["--version"],
+    installStrategy: spec.installStrategy,
+    packageName: spec.packageName,
+    binaryName: spec.id
+  };
+}
+const MANAGED_PACKAGE_FORMATTERS = [
+  { id: "black", name: "Black", installStrategy: "pip", packageName: "black" },
+  {
+    id: "cmake-format",
+    name: "cmake-format",
+    installStrategy: "pip",
+    packageName: "cmakelang[yaml]"
+  },
+  { id: "oxfmt", name: "oxfmt", installStrategy: "npm", packageName: "oxfmt" }
+];
+function managedGitHubFormatterTool(spec) {
+  return {
+    id: spec.id,
+    name: spec.name,
+    checkCommand: spec.id,
+    checkArgs: ["--version"],
+    installStrategy: "github",
+    binaryName: spec.id,
+    github: {
+      repo: `${spec.owner}/${spec.repo}`,
+      assetMatch: spec.assetPattern,
+      ...spec.binaryInArchive && { binaryInArchive: spec.binaryInArchive },
+      ...spec.kind === "phar" && { launcher: "php" },
+      ...spec.kind === "jar" && { launcher: "java" }
+    }
+  };
+}
+const MANAGED_GITHUB_FORMATTERS = [
+  {
+    id: "typstyle",
+    name: "typstyle",
+    owner: "typstyle-rs",
+    repo: "typstyle",
+    assetPattern: archAssetMatch({
+      linux: {
+        x64: "typstyle-x86_64-unknown-linux-gnu",
+        arm64: "typstyle-aarch64-unknown-linux-gnu"
+      },
+      darwin: {
+        x64: "typstyle-x86_64-apple-darwin",
+        arm64: "typstyle-aarch64-apple-darwin"
+      },
+      win32: {
+        x64: "typstyle-x86_64-pc-windows-msvc.exe",
+        arm64: "typstyle-aarch64-pc-windows-msvc.exe"
+      }
+    }),
+    kind: "binary"
+  },
+  {
+    id: "stylua",
+    name: "StyLua",
+    owner: "JohnnyMorganz",
+    repo: "StyLua",
+    assetPattern: archAssetMatch({
+      linux: { x64: "linux-x86_64.zip", arm64: "linux-aarch64.zip" },
+      darwin: { x64: "macos-x86_64.zip", arm64: "macos-aarch64.zip" },
+      win32: { x64: "windows-x86_64.zip" }
+    }),
+    kind: "binary",
+    binaryInArchive: "stylua"
+  },
+  {
+    id: "php-cs-fixer",
+    name: "PHP CS Fixer",
+    owner: "PHP-CS-Fixer",
+    repo: "PHP-CS-Fixer",
+    assetPattern: (platform) => platform === "linux" || platform === "darwin" || platform === "win32" ? "php-cs-fixer.phar" : undefined,
+    kind: "phar"
+  },
+  {
+    id: "cljfmt",
+    name: "cljfmt",
+    owner: "weavejester",
+    repo: "cljfmt",
+    assetPattern: (platform, arch) => {
+      if (platform === "linux")
+        return arch === "arm64" ? "standalone.jar" : "linux-amd64-static.tar.gz";
+      if (platform === "darwin")
+        return "standalone.jar";
+      if (platform === "win32")
+        return "win-amd64.zip";
+      return;
+    },
+    kind: "jar",
+    binaryInArchive: "cljfmt"
+  }
+];
+const MANAGED_MAVEN_FORMATTERS = [
+  {
+    id: "google-java-format",
+    name: "google-java-format",
+    groupId: "com.google.googlejavaformat",
+    artifactId: "google-java-format",
+    version: "1.27.0",
+    classifier: "all-deps"
+  }
+];
+function managedMavenFormatterTool(spec) {
+  return {
+    id: spec.id,
+    name: spec.name,
+    checkCommand: spec.id,
+    checkArgs: ["--version"],
+    installStrategy: "maven",
+    binaryName: spec.id,
+    maven: {
+      groupId: spec.groupId,
+      artifactId: spec.artifactId,
+      version: spec.version,
+      classifier: spec.classifier
+    }
+  };
+}
 export const TOOLS = [
   {
     id: "typescript-language-server",
@@ -143,7 +279,7 @@ export const TOOLS = [
     checkCommand: "typescript-language-server",
     checkArgs: ["--version"],
     installStrategy: "npm",
-    packageName: "typescript-language-server",
+    packageName: "typescript-language-server@5.3.0",
     binaryName: "typescript-language-server"
   },
   {
@@ -173,6 +309,7 @@ export const TOOLS = [
     packageName: "prettier",
     binaryName: "prettier"
   },
+  ...MANAGED_PACKAGE_FORMATTERS.map(managedPackageFormatterTool),
   {
     id: "ruff",
     name: "Ruff",
@@ -227,7 +364,7 @@ export const TOOLS = [
     checkCommand: "jscpd",
     checkArgs: ["--version"],
     installStrategy: "npm",
-    packageName: "jscpd@5.0.12",
+    packageName: "jscpd@5.3.0",
     binaryName: "jscpd"
   },
   {
@@ -304,7 +441,8 @@ export const TOOLS = [
     checkArgs: ["--version"],
     installStrategy: "pip",
     packageName: "cmake-language-server",
-    binaryName: "cmake-language-server"
+    binaryName: "cmake-language-server",
+    pipConstraints: ["pygls<2"]
   },
   {
     id: "yaml-language-server",
@@ -331,7 +469,7 @@ export const TOOLS = [
     checkCommand: "vscode-html-language-server",
     checkArgs: ["--version"],
     installStrategy: "npm",
-    packageName: "vscode-html-languageserver-bin",
+    packageName: "vscode-langservers-extracted",
     binaryName: "vscode-html-language-server"
   },
   {
@@ -411,7 +549,7 @@ export const TOOLS = [
     checkCommand: "vscode-css-language-server",
     checkArgs: ["--version"],
     installStrategy: "npm",
-    packageName: "vscode-css-languageserver",
+    packageName: "vscode-langservers-extracted",
     binaryName: "vscode-css-language-server"
   },
   {
@@ -428,6 +566,7 @@ export const TOOLS = [
     name: "Intelephense",
     checkCommand: "intelephense",
     checkArgs: ["--version"],
+    verification: "package-entry",
     installStrategy: "npm",
     packageName: "intelephense",
     binaryName: "intelephense"
@@ -548,6 +687,8 @@ export const TOOLS = [
       }
     }
   },
+  ...MANAGED_GITHUB_FORMATTERS.map(managedGitHubFormatterTool),
+  ...MANAGED_MAVEN_FORMATTERS.map(managedMavenFormatterTool),
   {
     id: "rust-analyzer",
     name: "rust-analyzer",
@@ -718,7 +859,7 @@ export const TOOLS = [
           return arch === "arm64" ? undefined : `${base}/lua-language-server-${version}-win32-x64.zip`;
         return;
       },
-      kind: "zip",
+      kind: (platform) => platform === "win32" ? "zip" : "tgz",
       stripComponents: 0,
       treeMarker: "bin"
     }
@@ -1017,6 +1158,32 @@ export const TOOLS = [
       binaryInArchive: "gleam"
     }
   },
+  {
+    id: "tinymist",
+    name: "Tinymist",
+    checkCommand: "tinymist",
+    checkArgs: ["--version"],
+    installStrategy: "github",
+    binaryName: "tinymist",
+    github: {
+      repo: "Myriad-Dreamin/tinymist",
+      assetMatch: archAssetMatch({
+        linux: {
+          x64: "tinymist-x86_64-unknown-linux-gnu.tar.gz",
+          arm64: "tinymist-aarch64-unknown-linux-gnu.tar.gz"
+        },
+        darwin: {
+          x64: "tinymist-x86_64-apple-darwin.tar.gz",
+          arm64: "tinymist-aarch64-apple-darwin.tar.gz"
+        },
+        win32: {
+          x64: "tinymist-x86_64-pc-windows-msvc.zip",
+          arm64: "tinymist-aarch64-pc-windows-msvc.zip"
+        }
+      }),
+      binaryInArchive: "tinymist"
+    }
+  },
   {
     id: "marksman",
     name: "Marksman",
@@ -1258,26 +1425,10 @@ function isAstGrepVersionOutput(output) {
   return /\bast[- ]grep\b/i.test(output);
 }
 async function verifyAstGrepProbePath(binPath) {
-  return new Promise((resolve) => {
-    let proc;
-    try {
-      proc = spawn(binPath, ["--version"], {
-        stdio: ["ignore", "pipe", "pipe"],
-        shell: process.platform === "win32" && /\.(cmd|bat)$/i.test(binPath),
-        timeout: 5000
-      });
-    } catch {
-      resolve(false);
-      return;
-    }
-    let output = "";
-    proc.stdout?.on("data", (data) => output += data);
-    proc.stderr?.on("data", (data) => output += data);
-    proc.on("exit", (code) => {
-      resolve(code === 0 && isAstGrepVersionOutput(output));
-    });
-    proc.on("error", () => resolve(false));
+  const result = await probeToolAsync(binPath, ["--version"], {
+    timeout: 5000
   });
+  return !result.error && result.status === 0 && isAstGrepVersionOutput(`${result.stdout}${result.stderr}`);
 }
 export async function checkProbeCache(toolId) {
   const cache = await readProbeCache();
@@ -1404,7 +1555,7 @@ export function isLspTransportRequiredError(output) {
   return /Connection (?:input|output) stream is not set|Use arguments of createConnection/i.test(output);
 }
 const lspTransportRequiredMatcher = /Connection (?:input|output) stream is not set|Use arguments of createConnection/i;
-function parsePinnedVersion(packageName) {
+export function parsePinnedVersion(packageName) {
   const at = packageName.lastIndexOf("@");
   if (at <= 0)
     return;
@@ -1414,7 +1565,54 @@ function extractVersionToken(output) {
   return output.match(/\d+\.\d+\.\d+(?:[-+][\w.]+)?/)?.[0];
 }
 const lastManagedInstallVersion = new Map;
-export async function verifyToolBinary(binPath, onVersionOutput, onTransient, timeoutMs = 1e4, verificationArgs = ["--version"]) {
+export function packageEntryVerification(tool) {
+  return tool.verification === "package-entry" ? tool.packageName : undefined;
+}
+export async function verifyNpmPackageEntry(binPath, packageName) {
+  const nodeModulesDir = path.dirname(path.dirname(binPath));
+  const pinned = parsePinnedVersion(packageName);
+  const bareName = pinned ? packageName.slice(0, -(pinned.length + 1)) : packageName;
+  const packageDir = path.join(nodeModulesDir, ...bareName.split("/"));
+  const shimName = path.basename(binPath).replace(/\.(cmd|exe|ps1|bat)$/i, "").toLowerCase();
+  const fail = (reason) => {
+    logSessionStart(`auto-install verify: failed for ${binPath} (check=package-entry, kind=${reason})`);
+    return false;
+  };
+  try {
+    const shim = statSync(binPath);
+    if (!shim.isFile() || shim.size === 0)
+      return fail("shim-not-a-file");
+  } catch {
+    return fail("shim-missing");
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(await fs.readFile(path.join(packageDir, "package.json"), "utf8"));
+  } catch {
+    return fail("package-json-unreadable");
+  }
+  if (typeof manifest.version !== "string" || !manifest.version) {
+    return fail("package-json-no-version");
+  }
+  const bin = manifest.bin;
+  const entry = typeof bin === "string" ? bin : bin && typeof bin === "object" ? Object.entries(bin).find(([name]) => name.toLowerCase() === shimName)?.[1] : undefined;
+  if (typeof entry !== "string" || !entry) {
+    return fail("package-json-no-entry");
+  }
+  try {
+    const stat = statSync(path.join(packageDir, entry));
+    if (!stat.isFile() || stat.size === 0)
+      return fail("entry-not-a-file");
+  } catch {
+    return fail("entry-missing");
+  }
+  logSessionStart(`auto-install verify: succeeded for ${binPath} (check=package-entry, version=${manifest.version}, entry=${entry})`);
+  return true;
+}
+export async function verifyToolBinary(binPath, onVersionOutput, onTransient, timeoutMs = 1e4, verificationArgs = ["--version"], packageEntryOf, onInconclusive) {
+  if (packageEntryOf !== undefined) {
+    return verifyNpmPackageEntry(binPath, packageEntryOf);
+  }
   const isWindows = installerPlatform() === "win32";
   const hasKnownWindowsExt = /\.(cmd|exe|ps1)$/i.test(binPath);
   let execPath = isWindows && !hasKnownWindowsExt ? `${binPath}.cmd` : binPath;
@@ -1452,6 +1650,14 @@ ${result.stderr}`;
     }
     if (result.signal !== undefined || result.spawnFailure)
       onTransient?.();
+    if (result.outputTruncated && result.signal === undefined && !result.spawnFailure) {
+      onInconclusive?.();
+      recordDegradationOnce({
+        kind: "installer-verification-inconclusive",
+        subject: binPath,
+        reason: `transport-required marker unresolved in truncated output (${verificationArgs.join(" ")})`
+      });
+    }
     const kind = result.spawnFailure?.kind ?? (result.signal ? `killed-signal=${result.signal}` : result.error ? "spawn-error" : "exit-nonzero");
     logSessionStart(`auto-install verify: failed for ${binPath} (check=${verificationArgs.join(" ")}, kind=${kind}${result.status !== null ? `, exit=${result.status}` : ""})`);
     return false;
@@ -1485,26 +1691,11 @@ export async function getAllToolStatuses() {
       status.installed = true;
       status.source = "global-path";
       status.path = tool.checkCommand;
-      const versionResult = await new Promise((resolve) => {
-        let proc;
-        try {
-          proc = spawn(tool.checkCommand, ["--version"], {
-            stdio: ["ignore", "pipe", "pipe"],
-            shell: process.platform === "win32",
-            timeout: 5000
-          });
-        } catch {
-          resolve("");
-          return;
-        }
-        let out = "";
-        proc.stdout?.on("data", (d) => out += d);
-        proc.stderr?.on("data", (d) => out += d);
-        proc.on("exit", () => resolve(out.trim().split(`
-`)[0]?.slice(0, 30) || ""));
-        proc.on("error", () => resolve(""));
+      const probe = await probeToolAsync(tool.checkCommand, ["--version"], {
+        timeout: 5000
       });
-      status.version = versionResult || undefined;
+      status.version = `${probe.stdout}${probe.stderr}`.trim().split(`
+`)[0]?.slice(0, 30) || undefined;
       statuses.push(status);
       continue;
     }
@@ -1542,7 +1733,7 @@ export async function getAllToolStatuses() {
     const localPath = installerPlatform() === "win32" ? `${localBase}.cmd` : localBase;
     try {
       await fs.access(localPath);
-      if (await verifyToolBinary(localPath, undefined, undefined, getToolVerificationTimeout(tool), tool.checkArgs)) {
+      if (await verifyToolBinary(localPath, undefined, undefined, getToolVerificationTimeout(tool), tool.checkArgs, packageEntryVerification(tool))) {
         status.installed = true;
         status.source = "dm-lens-auto";
         status.path = localPath;
@@ -1635,7 +1826,7 @@ async function getToolPathResolved(toolId, onTransient) {
     const cmdPath = `${localBase}.cmd`;
     try {
       await fs.access(cmdPath);
-      if (await verifyToolBinary(cmdPath, recordVersion, onTransient, getToolVerificationTimeout(tool), tool.checkArgs)) {
+      if (await verifyToolBinary(cmdPath, recordVersion, onTransient, getToolVerificationTimeout(tool), tool.checkArgs, packageEntryVerification(tool))) {
         return cmdPath;
       }
       logSessionStart(`auto-install verify: ${cmdPath} exists but is broken, will reinstall`);
@@ -1643,7 +1834,7 @@ async function getToolPathResolved(toolId, onTransient) {
     const exePath = `${localBase}.exe`;
     try {
       await fs.access(exePath);
-      if (await verifyToolBinary(exePath, recordVersion, onTransient, getToolVerificationTimeout(tool), tool.checkArgs)) {
+      if (await verifyToolBinary(exePath, recordVersion, onTransient, getToolVerificationTimeout(tool), tool.checkArgs, packageEntryVerification(tool))) {
         return exePath;
       }
       logSessionStart(`auto-install verify: ${exePath} exists but is broken, will reinstall`);
@@ -1652,7 +1843,7 @@ async function getToolPathResolved(toolId, onTransient) {
   if (installerPlatform() !== "win32") {
     try {
       await fs.access(localBase);
-      if (await verifyToolBinary(localBase, recordVersion, onTransient, getToolVerificationTimeout(tool), tool.checkArgs)) {
+      if (await verifyToolBinary(localBase, recordVersion, onTransient, getToolVerificationTimeout(tool), tool.checkArgs, packageEntryVerification(tool))) {
         return localBase;
       }
       logSessionStart(`auto-install verify: ${localBase} exists but is broken, will reinstall`);
@@ -1671,8 +1862,24 @@ async function getToolPathResolved(toolId, onTransient) {
     if (githubPath)
       return githubPath;
   }
-  if (await isCommandAvailable(tool.checkCommand, tool.checkArgs)) {
-    return tool.checkCommand;
+  if (await isCommandAvailable(tool.checkCommand)) {
+    if (packageEntryVerification(tool) !== undefined)
+      return tool.checkCommand;
+    let probeStalled = false;
+    const verified = await verifyToolBinary(tool.checkCommand, undefined, () => {
+      probeStalled = true;
+      onTransient();
+    }, getToolVerificationTimeout(tool), tool.checkArgs, undefined, () => {
+      probeStalled = true;
+    });
+    if (verified || probeStalled)
+      return tool.checkCommand;
+    recordDegradationOnce({
+      kind: "installer-path-candidate-unrunnable",
+      subject: toolId,
+      reason: `${tool.checkCommand} on PATH failed its own check (${tool.checkArgs.join(" ")}); ignoring PATH for this tool`
+    });
+    logSessionStart(`auto-install ${toolId}: PATH candidate ${tool.checkCommand} failed ${tool.checkArgs.join(" ")} — ignoring PATH, trying managed install`);
   }
   if (tool.installStrategy === "npm") {
     const npmPath = await findNpmGlobalToolPath(tool.binaryName || tool.id, onTransient, tool.checkArgs, getToolVerificationTimeout(tool));
@@ -1727,6 +1934,13 @@ function getGitHubInstalledBinaryName(binaryName, platform, assetName) {
     return `${binaryName}.cmd`;
   return `${binaryName}.exe`;
 }
+function launcherForGitHubAsset(spec, assetName) {
+  if (spec.launcher === "php" && assetName.endsWith(".phar"))
+    return "php";
+  if (spec.launcher === "java" && assetName.endsWith(".jar"))
+    return "java";
+  return;
+}
 function getArchiveBinaryCandidates(binaryName, platform, assetName) {
   if (platform !== "win32")
     return [binaryName];
@@ -1787,12 +2001,14 @@ async function getNpmGlobalBinCandidates(onTransient) {
   return dirs;
 }
 async function findPipUserToolPath(binaryName, onTransient, verificationArgs = ["--version"], verificationTimeoutMs = 1e4) {
-  const isWindows = process.platform === "win32";
-  const userBaseCandidates = await getPythonUserBaseCandidates();
+  const isWindows = installerPlatform() === "win32";
+  const userBaseCandidates = [
+    path.join(getGlobalDmLensDir(), "pip-tools"),
+    path.join(getGlobalDmLensDir(), "pip-user"),
+    ...await getPythonUserBaseCandidates()
+  ];
   for (const userBase of userBaseCandidates) {
-    const scriptDirs = [
-      path.join(userBase, isWindows ? "Scripts" : "bin")
-    ];
+    const scriptDirs = [pipScriptsDir(userBase, installerPlatform())];
     if (isWindows) {
       try {
         const children = await fs.readdir(userBase, { withFileTypes: true });
@@ -1823,6 +2039,23 @@ async function findPipUserToolPath(binaryName, onTransient, verificationArgs = [
   }
   return;
 }
+export function userBaseProbeResult(command, code, stdout) {
+  if (stdout.truncated) {
+    recordDegradationOnce({
+      kind: "spawn-output-cap-truncated",
+      subject: `user-base-probe:${command}`,
+      reason: `\`${command} -m site --user-base\` reached the ${DEFAULT_MAX_OUTPUT_BYTES}-byte default cap after ${stdout.observedBytes} bytes; the probed user base is unusable`,
+      metadata: {
+        capBytes: DEFAULT_MAX_OUTPUT_BYTES,
+        capSource: "default",
+        observedBytes: stdout.observedBytes,
+        killed: false
+      }
+    });
+    return "";
+  }
+  return code === 0 ? stdout.text.trim() : "";
+}
 async function getPythonUserBaseCandidates() {
   const candidates = [];
   const seen = new Set;
@@ -1861,19 +2094,49 @@ async function getPythonUserBaseCandidates() {
         resolve("");
         return;
       }
-      let stdout = "";
-      proc.stdout?.on("data", (data) => stdout += data);
-      proc.on("exit", (code) => resolve(code === 0 ? stdout.trim() : ""));
+      const stdout = createBoundedOutputSink();
+      proc.stdout?.on("data", (data) => stdout.append(data));
+      proc.on("exit", (code) => resolve(userBaseProbeResult(probe.command, code, stdout)));
       proc.on("error", () => resolve(""));
     });
     add(userBase);
   }
   return candidates;
 }
-function githubApiAuthHeaders() {
-  const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+async function githubApiAuthHeaders() {
+  const token = await resolveGitHubToken();
   return token ? { Authorization: `Bearer ${token}` } : {};
 }
+
+class HttpStatusError extends Error {
+  statusCode;
+  constructor(statusCode, url) {
+    super(url ? `HTTP ${statusCode} for ${url}` : `HTTP ${statusCode}`);
+    this.name = "HttpStatusError";
+    this.statusCode = statusCode;
+  }
+}
+
+class GitHubHttpError extends HttpStatusError {
+  anonymousRateLimitExhausted;
+  constructor(statusCode, requestHeaders, responseHeaders) {
+    super(statusCode);
+    this.name = "GitHubHttpError";
+    this.message = `GitHub API HTTP ${statusCode}`;
+    this.anonymousRateLimitExhausted = statusCode === 403 && !Object.keys(requestHeaders).some((key) => key.toLowerCase() === "authorization") && readHeader(responseHeaders, "x-ratelimit-remaining") === "0";
+  }
+}
+function readHeader(headers, name) {
+  const entry = Object.entries(headers).find(([key]) => key.toLowerCase() === name.toLowerCase())?.[1];
+  return Array.isArray(entry) ? entry[0]?.trim() : entry?.trim();
+}
+function isGitHubApiUrl(url) {
+  try {
+    return new URL(url).host.toLowerCase() === "api.github.com";
+  } catch {
+    return false;
+  }
+}
 function sameHost(a, b) {
   try {
     return new URL(a).host === new URL(b).host;
@@ -1901,7 +2164,7 @@ function httpsGetWithMeta(url, maxRedirects = 5, headers = {}) {
       }
       if (res.statusCode !== 200) {
         res.resume();
-        return reject(new Error(`HTTP ${res.statusCode} for ${url}`));
+        return reject(isGitHubApiUrl(url) ? new GitHubHttpError(res.statusCode ?? 0, headers, res.headers) : new HttpStatusError(res.statusCode ?? 0, url));
       }
       const chunks = [];
       res.on("data", (chunk) => chunks.push(chunk));
@@ -1952,10 +2215,18 @@ async function installGitHubTool(tool, prefetchedRelease) {
   } else {
     logSessionStart(`github-install ${tool.id}: fetching release metadata from ${spec.repo}`);
     try {
-      const body = await httpsGet(`https://api.github.com/repos/${spec.repo}/releases/latest`, 5, githubApiAuthHeaders());
+      const body = await httpsGet(`https://api.github.com/repos/${spec.repo}/releases/latest`, 5, await githubApiAuthHeaders());
       releaseJson = JSON.parse(body.toString("utf8"));
     } catch (err) {
-      logSessionStart(`github-install ${tool.id}: release fetch failed: ${err.message}`);
+      const reason = err instanceof GitHubHttpError && err.anonymousRateLimitExhausted ? "GitHub API rate limit exhausted; authenticate with `gh auth login` or set GITHUB_TOKEN/GH_TOKEN and retry" : `release fetch failed: ${err.message}`;
+      if (err instanceof GitHubHttpError && err.anonymousRateLimitExhausted) {
+        recordDegradationOnce({
+          kind: "github-api-rate-limit",
+          subject: tool.id,
+          reason
+        });
+      }
+      logSessionStart(`github-install ${tool.id}: ${reason}`);
       return;
     }
   }
@@ -1986,10 +2257,33 @@ async function installGitHubTool(tool, prefetchedRelease) {
   const binaryName = tool.binaryName ?? tool.id;
   const isWindows = platform === "win32";
   const finalBinaryName = getGitHubInstalledBinaryName(binaryName, platform, asset.name);
-  const destPath = path.join(GITHUB_BIN_DIR, finalBinaryName);
+  let destPath = path.join(GITHUB_BIN_DIR, finalBinaryName);
   const assetName = asset.name;
+  const launcherRuntime = launcherForGitHubAsset(spec, assetName);
+  if (launcherRuntime && !await isCommandAvailable(launcherRuntime, ["--version"])) {
+    logSessionStart(`github-install ${tool.id}: ${launcherRuntime} not found — asset requires a runtime launcher`);
+    return;
+  }
   try {
-    if (assetName.endsWith(".gz") && !assetName.endsWith(".tar.gz")) {
+    if (launcherRuntime) {
+      const assetPath = path.join(GITHUB_BIN_DIR, `${tool.id}${assetName.endsWith(".phar") ? ".phar" : ".jar"}`);
+      await writeFileAtomicAsync(assetPath, assetBuffer, {
+        bestEffort: false,
+        mode: 488
+      });
+      const launcherName = isWindows ? `${binaryName}.bat` : binaryName;
+      destPath = path.join(GITHUB_BIN_DIR, launcherName);
+      const runtimeTarget = assetName.endsWith(".phar") ? `${tool.id}.phar` : `${tool.id}.jar`;
+      const command = isWindows ? `@echo off\r
+${launcherRuntime} "%~dp0${runtimeTarget}" %*\r
+` : `#!/bin/sh
+exec ${launcherRuntime} "$(dirname "$0")/${runtimeTarget}" "$@"
+`;
+      await writeFileAtomicAsync(destPath, command, {
+        bestEffort: false,
+        mode: isWindows ? undefined : 488
+      });
+    } else if (assetName.endsWith(".gz") && !assetName.endsWith(".tar.gz")) {
       const decompressed = await new Promise((resolve, reject) => {
         const gunzip = createGunzip();
         const chunks = [];
@@ -2107,11 +2401,17 @@ export function npmToolNeedsPostinstall(packageName) {
   return NEEDS_POSTINSTALL.has(packageName);
 }
 export function getRefreshableManagedNpmTools() {
+  const seenPackages = new Set;
   return getRefreshableManagedTools().filter((candidate) => candidate.strategy === "npm").map((candidate) => ({
     toolId: candidate.toolId,
     packageName: candidate.packageName,
     binaryName: candidate.binaryName
-  }));
+  })).filter((candidate) => {
+    if (seenPackages.has(candidate.packageName))
+      return false;
+    seenPackages.add(candidate.packageName);
+    return true;
+  });
 }
 function mavenCoordinate(spec) {
   return [
@@ -2139,7 +2439,8 @@ export function getRefreshableManagedTools() {
           checkArgs: tool.checkArgs,
           packageName: tool.packageName,
           binaryName: tool.binaryName,
-          verificationTimeoutMs: tool.verificationTimeoutMs
+          verificationTimeoutMs: tool.verificationTimeoutMs,
+          packageEntryOf: packageEntryVerification(tool)
         });
         break;
       }
@@ -2228,7 +2529,7 @@ async function probeManagedToolVersion(tool) {
   if (!cached?.path || !existsSync(cached.path))
     return;
   try {
-    const result = await safeSpawnAsync(cached.path, tool.checkArgs, {
+    const result = await probeToolAsync(cached.path, tool.checkArgs, {
       timeout: getToolVerificationTimeout(tool),
       input: "",
       ignoreAmbientSignal: true,
@@ -2306,14 +2607,22 @@ async function refreshGitHubManagedTool(tool, known) {
   let response;
   try {
     response = await httpsGetWithMeta(`https://api.github.com/repos/${spec.repo}/releases/latest`, 5, {
-      ...githubApiAuthHeaders(),
+      ...await githubApiAuthHeaders(),
       ...known.etag ? { "If-None-Match": known.etag } : {}
     });
   } catch (err) {
+    const reason = err instanceof GitHubHttpError && err.anonymousRateLimitExhausted ? "GitHub API rate limit exhausted; authenticate with `gh auth login` or set GITHUB_TOKEN/GH_TOKEN and retry" : `release query failed: ${err.message}`;
+    if (err instanceof GitHubHttpError && err.anonymousRateLimitExhausted) {
+      recordDegradationOnce({
+        kind: "github-api-rate-limit",
+        subject: tool.id,
+        reason
+      });
+    }
     return {
       ok: false,
       unchanged: true,
-      reason: `release query failed: ${err.message}`
+      reason
     };
   }
   if (response.statusCode === 304) {
@@ -2397,7 +2706,9 @@ async function refreshPackageManagerManagedTool(tool) {
     return { ok: false, unchanged: true, reason: "no package name" };
   }
   const previous = await probeManagedToolVersion(tool);
-  const installed = tool.installStrategy === "pip" ? await installPipTool(tool.packageName, { upgrade: true }) : await installGemTool(tool.packageName);
+  const installed = tool.installStrategy === "pip" ? await installPipTool(tool.id, tool.packageName, tool.binaryName ?? tool.id, {
+    upgrade: true
+  }) : await installGemTool(tool.id, tool.packageName);
   if (!installed) {
     return {
       ok: false,
@@ -2523,9 +2834,32 @@ exec java -jar "$(dirname "$0")/${tool.id}.jar" "$@"
     return;
   }
 }
-export function resolveArchiveUrl(spec, platform = process.platform, arch = process.arch) {
+export function resolveArchiveUrl(spec, platform = installerPlatform(), arch = process.arch) {
   return typeof spec.url === "function" ? spec.url(platform, arch) : spec.url;
 }
+export function resolveArchiveKind(spec, platform = installerPlatform(), arch = process.arch) {
+  return typeof spec.kind === "function" ? spec.kind(platform, arch) : spec.kind;
+}
+function recordArchiveExtractionDegradation(toolId, format, reason) {
+  recordDegradationOnce({
+    kind: "managed-tool-install",
+    subject: `${toolId}:${format}`,
+    reason: `archive extraction ${reason}`
+  });
+}
+async function stripExtractedArchiveRoot(dir, components) {
+  for (let i = 0;i < components; i++) {
+    const entries = await fs.readdir(dir, { withFileTypes: true });
+    const [entry] = entries;
+    if (entries.length !== 1 || !entry?.isDirectory())
+      return false;
+    const root = path.join(dir, entry.name);
+    for (const child of await fs.readdir(root))
+      await fs.rename(path.join(root, child), path.join(dir, child));
+    await fs.rm(root, { recursive: true, force: true });
+  }
+  return true;
+}
 export async function swapExtractedDir(toolId, tmpDir, finalDir) {
   const backupDir = `${finalDir}.rollback`;
   await fs.rm(backupDir, { recursive: true, force: true });
@@ -2563,8 +2897,10 @@ async function installArchiveTool(tool) {
   if (!spec)
     return;
   const binaryName = tool.binaryName ?? tool.id;
-  const isWindows = process.platform === "win32";
-  const url = resolveArchiveUrl(spec);
+  const platform = installerPlatform();
+  const isWindows = platform === "win32";
+  const archiveKind = resolveArchiveKind(spec, platform, process.arch);
+  const url = resolveArchiveUrl(spec, platform, process.arch);
   if (!url) {
     logSessionStart(`archive-install ${tool.id}: no archive for ${process.platform}/${process.arch} — unsupported, skipping`);
     return;
@@ -2580,7 +2916,7 @@ async function installArchiveTool(tool) {
   }
   const extractName = tool.id;
   const tmpExtractName = `${extractName}.refresh-tmp`;
-  const archiveName = `${tool.id}.download.${spec.kind === "zip" ? "zip" : "tgz"}`;
+  const archiveName = `${tool.id}.download.${archiveKind === "zip" ? "zip" : "tgz"}`;
   const extractDir = path.join(TOOLS_DIR, extractName);
   const tmpExtractDir = path.join(TOOLS_DIR, tmpExtractName);
   const tmpArchive = path.join(TOOLS_DIR, archiveName);
@@ -2590,27 +2926,38 @@ async function installArchiveTool(tool) {
     await fs.mkdir(tmpExtractDir, { recursive: true });
     await fs.writeFile(tmpArchive, archiveBuffer);
     const stripComponents = spec.stripComponents ?? 1;
-    const tarArgs = [
-      spec.kind === "tgz" ? "-xzf" : "-xf",
+    const extractionArgs = archiveKind === "zip" && isWindows ? [
+      "-NoProfile",
+      "-Command",
+      `Expand-Archive -LiteralPath '${archiveName}' -DestinationPath '${tmpExtractName}' -Force`
+    ] : archiveKind === "zip" ? ["-q", "-o", archiveName, "-d", tmpExtractName] : [
+      "-xzf",
       archiveName,
       "-C",
       tmpExtractName,
       ...stripComponents > 0 ? [`--strip-components=${stripComponents}`] : []
     ];
-    const tarBin = isWindows ? `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\tar.exe` : "tar";
-    const extractResult = await safeSpawnAsync(tarBin, tarArgs, {
+    const extractor = archiveKind === "zip" && isWindows ? `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe` : archiveKind === "zip" ? "unzip" : isWindows ? `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\tar.exe` : "tar";
+    const extractionResult = await safeSpawnAsync(extractor, extractionArgs, {
       cwd: TOOLS_DIR,
       timeout: 120000,
       ignoreAmbientSignal: true,
       lifetimeCoupled: true
     });
     const extracted = {
-      ok: extractResult.status === 0,
-      stderr: extractResult.error?.message ?? extractResult.stderr
+      ok: extractionResult.status === 0,
+      reason: extractionResult.spawnFailure?.kind === "tool-not-found" ? "extractor-unavailable" : extractionResult.spawnFailure ? "extractor-error" : "extractor-exit"
     };
     await fs.rm(tmpArchive, { force: true });
     if (!extracted.ok) {
-      logSessionStart(`archive-install ${tool.id}: extraction failed: ${extracted.stderr} — keeping installed version`);
+      recordArchiveExtractionDegradation(tool.id, archiveKind, extracted.reason);
+      logSessionStart(`archive-install ${tool.id}: ${archiveKind} extraction failed (${extracted.reason}) — keeping installed version`);
+      await fs.rm(tmpExtractDir, { recursive: true, force: true }).catch(() => {});
+      return;
+    }
+    if (archiveKind === "zip" && !await stripExtractedArchiveRoot(tmpExtractDir, stripComponents)) {
+      recordArchiveExtractionDegradation(tool.id, archiveKind, "layout-invalid");
+      logSessionStart(`archive-install ${tool.id}: ${archiveKind} layout invalid — keeping installed version`);
       await fs.rm(tmpExtractDir, { recursive: true, force: true }).catch(() => {});
       return;
     }
@@ -2619,7 +2966,8 @@ async function installArchiveTool(tool) {
       try {
         await fs.access(tmpMarker);
       } catch {
-        logSessionStart(`archive-install ${tool.id}: tree marker not found at ${tmpMarker} after extraction — keeping installed version`);
+        recordArchiveExtractionDegradation(tool.id, archiveKind, "marker-missing");
+        logSessionStart(`archive-install ${tool.id}: ${archiveKind} marker missing after extraction — keeping installed version`);
         await fs.rm(tmpExtractDir, { recursive: true, force: true }).catch(() => {});
         return;
       }
@@ -2634,7 +2982,8 @@ async function installArchiveTool(tool) {
     try {
       await fs.access(tmpResolvedInner);
     } catch {
-      logSessionStart(`archive-install ${tool.id}: launcher not found at ${tmpResolvedInner} after extraction — keeping installed version`);
+      recordArchiveExtractionDegradation(tool.id, archiveKind, "launcher-missing");
+      logSessionStart(`archive-install ${tool.id}: ${archiveKind} launcher missing after extraction — keeping installed version`);
       await fs.rm(tmpExtractDir, { recursive: true, force: true }).catch(() => {});
       return;
     }
@@ -2665,7 +3014,19 @@ exec "${resolvedInner}" "$@"
     return;
   }
 }
-async function installNpmTool(packageName, binaryName, verificationArgs = ["--version"], verificationTimeoutMs = 1e4) {
+function recordPackageManagerInstallException(toolId, strategyLabel, packageName, err) {
+  const message = boundInstallError(err.message);
+  logSessionStart(`auto-install ${strategyLabel} ${packageName}: exception: ${message}`);
+  installFailureReasons.set(toolId, message);
+  return;
+}
+const INSTALL_ERROR_LINE_LIMIT = 1000;
+const INSTALL_CANDIDATE_ERROR_LIMIT = 200;
+function boundInstallError(value, limit = INSTALL_ERROR_LINE_LIMIT) {
+  const line = value.replace(/[\r\n]+/g, " ").trim();
+  return line.length > limit ? `${line.slice(0, limit - 3)}...` : line;
+}
+async function installNpmTool(toolId, packageName, binaryName, verificationArgs = ["--version"], verificationTimeoutMs = 1e4, packageEntryOf) {
   try {
     await fs.mkdir(TOOLS_DIR, { recursive: true });
     const packageJsonPath = path.join(TOOLS_DIR, "package.json");
@@ -2725,11 +3086,15 @@ async function installNpmTool(packageName, binaryName, verificationArgs = ["--ve
     debugLog(`Verifying ${binaryName}...`);
     let isValid = false;
     let lastAttemptTransient = false;
+    let lastAttemptInconclusive = false;
     for (let attempt = 1;attempt <= 3; attempt++) {
       lastAttemptTransient = false;
+      lastAttemptInconclusive = false;
       isValid = await verifyToolBinary(binPath, undefined, () => {
         lastAttemptTransient = true;
-      }, verificationTimeoutMs, verificationArgs);
+      }, verificationTimeoutMs, verificationArgs, packageEntryOf, () => {
+        lastAttemptInconclusive = true;
+      });
       if (isValid)
         break;
       if (attempt < 3) {
@@ -2737,6 +3102,13 @@ async function installNpmTool(packageName, binaryName, verificationArgs = ["--ve
         await new Promise((r) => setTimeout(r, 1000 * attempt));
       }
     }
+    if (!isValid && lastAttemptInconclusive) {
+      if (await verifyNpmPackageEntry(binPath, packageName)) {
+        logSessionStart(`auto-install ${packageName}: verification inconclusive (output truncated before the transport-required marker) but the installed tree is intact; keeping installation for re-probe`);
+        return;
+      }
+      logSessionStart(`auto-install ${packageName}: verification inconclusive AND the installed tree is incomplete; cleaning up so the next install can repair it`);
+    }
     if (!isValid && lastAttemptTransient) {
       logSessionStart(`auto-install ${packageName}: verification inconclusive (transient); keeping installation for re-probe`);
       return;
@@ -2756,49 +3128,184 @@ async function installNpmTool(packageName, binaryName, verificationArgs = ["--ve
     }
     return binPath;
   } catch (err) {
-    logSessionStart(`auto-install npm ${packageName}: exception: ${err.message}`);
-    return;
+    return recordPackageManagerInstallException(toolId, "npm", packageName, err);
   }
 }
-async function installPipTool(packageName, options = {}) {
+export function pipCommandCandidates() {
+  return process.platform === "win32" ? ["pip", "py", "python"] : ["pip3", "pip", "python3", "python"];
+}
+export function pipScriptsDir(base, platform = installerPlatform()) {
+  return path.join(base, platform === "win32" ? "Scripts" : "bin");
+}
+const pipPep668LoggedRefusals = createGenerationMap("installer-pep668-log");
+async function pipConstraintEnvFor(toolId) {
+  const constraints = TOOLS.find((t) => t.id === toolId)?.pipConstraints;
+  if (!constraints || constraints.length === 0)
+    return {};
+  const directories = [
+    path.join(getGlobalDmLensDir(), "pip-constraints"),
+    path.join(os.tmpdir(), "dm-lens-pip-constraints")
+  ];
+  const directory = directories.find((candidate) => !/\s/.test(candidate));
+  if (!directory) {
+    recordDegradationOnce({
+      kind: "pip-constraint-path-unusable",
+      subject: toolId,
+      reason: `no whitespace-free directory for the constraints file (tried ${directories.join(", ")}); installing unconstrained`
+    });
+    return {};
+  }
+  const file = path.join(directory, `${toolId}.txt`);
   try {
-    const isWindows = process.platform === "win32";
-    const verb = options.upgrade ? ["install", "-U", "--user"] : ["install", "--user"];
-    const pipCandidates = isWindows ? [
-      { command: "pip", args: [...verb, packageName] },
-      {
-        command: "py",
-        args: ["-m", "pip", ...verb, packageName]
-      },
-      {
-        command: "python",
-        args: ["-m", "pip", ...verb, packageName]
-      }
-    ] : [
-      { command: "pip3", args: [...verb, packageName] },
-      { command: "pip", args: [...verb, packageName] },
-      {
-        command: "python3",
-        args: ["-m", "pip", ...verb, packageName]
-      },
-      {
-        command: "python",
-        args: ["-m", "pip", ...verb, packageName]
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    await writeFileAtomicAsync(file, `${constraints.join(`
+`)}
+`, {
+      bestEffort: false
+    });
+  } catch (err) {
+    recordDegradationOnce({
+      kind: "pip-constraint-file-unwritable",
+      subject: toolId,
+      reason: `${file}: ${err instanceof Error ? err.message : String(err)}`
+    });
+    return {};
+  }
+  logSessionStart(`auto-install pip ${toolId}: constraining resolution with ${constraints.join(", ")} (${file})`);
+  return { PIP_CONSTRAINT: file, UV_CONSTRAINT: file };
+}
+async function installPipTool(toolId, packageName, binaryName, options = {}) {
+  try {
+    const isWindows = installerPlatform() === "win32";
+    const verb = options.upgrade ? ["install", "-U"] : ["install"];
+    const pipConstraintEnv = await pipConstraintEnvFor(toolId);
+    const pipCandidates = pipCommandCandidates().map((command) => ({
+      command,
+      args: command === "pip" || command === "pip3" ? [...verb, packageName] : ["-m", "pip", ...verb, packageName]
+    }));
+    const pep668 = /externally-managed-environment/i;
+    const refuse = (strategy, reason) => {
+      if (!pep668.test(reason))
+        return;
+      const subject = `${toolId}:${strategy}`;
+      recordDegradationOnce({
+        kind: "pip-pep668-strategy-refused",
+        subject,
+        reason
+      });
+      const logKey = `${getDegradationLedgerGeneration()}:${subject}`;
+      if (pipPep668LoggedRefusals.current(logKey) === 0) {
+        pipPep668LoggedRefusals.bump(logKey);
+        logSessionStart(`auto-install pip ${packageName}: ${strategy} refused by PEP 668 (${boundInstallError(reason)})`);
       }
-    ];
-    let lastError = "";
-    for (const candidate of pipCandidates) {
-      const pipResult = await safeSpawnAsync(candidate.command, candidate.args, {
+    };
+    const succeeded = (strategy, binaryPath) => {
+      recordDegradationOnce({
+        kind: "pip-install-strategy-succeeded",
+        subject: `${toolId}:${strategy}`,
+        reason: binaryPath
+      });
+      return binaryPath;
+    };
+    const run = (command, args, env) => {
+      const spawnEnv = Object.keys(pipConstraintEnv).length > 0 ? { ...env ?? process.env, ...pipConstraintEnv } : env;
+      return safeSpawnAsync(command, args, {
         timeout: 120000,
         ignoreAmbientSignal: true,
-        lifetimeCoupled: true
+        lifetimeCoupled: true,
+        cwd: resolveToolCwd("runner", toolId, getGlobalDmLensDir(), {
+          cwd: getGlobalDmLensDir(),
+          suppressTelemetry: true
+        }).cwd,
+        ...spawnEnv ? { env: spawnEnv } : {}
       });
-      const outcome = {
-        ok: pipResult.status === 0,
-        error: (pipResult.error?.message ?? pipResult.stderr).trim()
-      };
-      if (outcome.ok) {
-        const userBaseResult = await new Promise((resolve) => {
+    };
+    const addBinToPath = async (binDir) => {
+      try {
+        await fs.access(binDir);
+      } catch {
+        return;
+      }
+      const currentPath = process.env.PATH || process.env.Path || "";
+      const separator = isWindows ? ";" : path.delimiter;
+      if (!currentPath.toLowerCase().split(separator).includes(binDir.toLowerCase())) {
+        const updatedPath = `${binDir}${separator}${currentPath}`;
+        process.env.PATH = updatedPath;
+        if (isWindows)
+          process.env.Path = updatedPath;
+      }
+      const names = isWindows ? [`${binaryName}.exe`, `${binaryName}.cmd`, binaryName] : [binaryName];
+      for (const name of names) {
+        const candidate = path.join(binDir, name);
+        try {
+          await fs.access(candidate);
+          return candidate;
+        } catch {}
+      }
+      return;
+    };
+    if (await isCommandAvailable("pipx")) {
+      const result = await run("pipx", options.upgrade ? ["upgrade", packageName] : ["install", "--force", packageName]);
+      const error = (result.error?.message ?? result.stderr).trim();
+      if (result.status === 0) {
+        const location = await run("pipx", [
+          "environment",
+          "--value",
+          "PIPX_BIN_DIR"
+        ]);
+        const binDir = location.status === 0 && location.stdout.trim() ? location.stdout.trim() : path.join(os.homedir(), ".local", "bin");
+        const binaryPath = await addBinToPath(binDir);
+        if (binaryPath)
+          return succeeded("pipx", binaryPath);
+        throw new Error(`pipx installed ${packageName} but ${binaryName} is not resolvable`);
+      }
+      refuse("pipx", error);
+    }
+    const pythonCandidates = pipCandidates.filter(({ command }) => command === "python3" || command === "python" || command === "py");
+    const pythonAvailability = await Promise.all(pythonCandidates.map(({ command }) => isCommandAvailable(command)));
+    const availablePythonCandidates = pythonCandidates.filter((_, index) => pythonAvailability[index]);
+    const venvRoot = path.join(getGlobalDmLensDir(), "pip-tools");
+    for (const candidate of availablePythonCandidates) {
+      const venvBin = pipScriptsDir(venvRoot, installerPlatform());
+      let venvPip = path.join(venvBin, isWindows ? "pip.exe" : "pip");
+      try {
+        await fs.access(venvPip);
+      } catch {
+        const created = await run(candidate.command, ["-m", "venv", venvRoot]);
+        const error = (created.error?.message ?? created.stderr).trim();
+        if (created.status !== 0) {
+          refuse("venv", error || "python venv module unavailable");
+          continue;
+        }
+      }
+      try {
+        await fs.access(venvPip);
+      } catch {
+        venvPip = path.join(venvBin, isWindows ? "pip.cmd" : "pip3");
+        try {
+          await fs.access(venvPip);
+        } catch {
+          continue;
+        }
+      }
+      const result = await run(venvPip, [...verb, packageName]);
+      const error = (result.error?.message ?? result.stderr).trim();
+      if (result.status === 0) {
+        const binaryPath = await addBinToPath(venvBin);
+        if (binaryPath)
+          return succeeded("venv", binaryPath);
+        throw new Error(`venv installed ${packageName} but ${binaryName} is not resolvable`);
+      }
+      refuse("venv", error);
+    }
+    const candidateErrors = [];
+    let userRefused = false;
+    for (const candidate of pipCandidates) {
+      const args = candidate.command === "pip" || candidate.command === "pip3" ? [...verb, "--user", packageName] : ["-m", "pip", ...verb, "--user", packageName];
+      const result = await run(candidate.command, args);
+      const error = (result.error?.message ?? result.stderr).trim();
+      if (result.status === 0) {
+        const base = await new Promise((resolve) => {
           let probe;
           try {
             probe = spawn(candidate.command, ["-m", "site", "--user-base"], {
@@ -2809,66 +3316,52 @@ async function installPipTool(packageName, options = {}) {
             resolve("");
             return;
           }
-          let stdout = "";
-          probe.stdout?.on("data", (data) => stdout += data);
-          probe.on("exit", (code) => {
-            if (code === 0)
-              resolve(stdout.trim());
-            else
-              resolve("");
-          });
+          const stdout = createBoundedOutputSink();
+          probe.stdout?.on("data", (data) => stdout.append(data));
+          probe.on("exit", (code) => resolve(userBaseProbeResult(candidate.command, code, stdout)));
           probe.on("error", () => resolve(""));
         });
-        if (userBaseResult) {
-          const candidateScriptDirs = [
-            path.join(userBaseResult, isWindows ? "Scripts" : "bin")
-          ];
-          if (isWindows) {
-            try {
-              const children = await fs.readdir(userBaseResult, {
-                withFileTypes: true
-              });
-              for (const entry of children) {
-                if (!entry.isDirectory())
-                  continue;
-                if (!/^python\d+$/i.test(entry.name))
-                  continue;
-                candidateScriptDirs.push(path.join(userBaseResult, entry.name, "Scripts"));
-              }
-            } catch {}
-          }
-          const currentPath = process.env.PATH || process.env.Path || process.env.path || "";
-          const separator = isWindows ? ";" : ":";
-          const normalizedPath = currentPath.toLowerCase().split(separator).map((p) => p.trim());
-          for (const scriptsDir of candidateScriptDirs) {
-            try {
-              await fs.access(scriptsDir);
-              if (!normalizedPath.includes(scriptsDir.toLowerCase())) {
-                const existingPath = process.env.PATH || process.env.Path || process.env.path || "";
-                const updatedPath = `${scriptsDir}${separator}${existingPath}`;
-                process.env.PATH = updatedPath;
-                if (isWindows) {
-                  process.env.Path = updatedPath;
-                }
-                debugLog(`Added pip user scripts dir to PATH: ${scriptsDir}`);
-              }
-            } catch {
-              debugLog(`pip user scripts dir not accessible: ${scriptsDir}`);
-            }
-          }
-        }
-        return packageName;
+        const binaryPath = base ? await addBinToPath(pipScriptsDir(base, installerPlatform())) : undefined;
+        return succeeded("user", binaryPath ?? packageName);
+      }
+      const candidateError = `${candidate.command} ${args.join(" ")}: ${boundInstallError(error, INSTALL_CANDIDATE_ERROR_LIMIT)}`;
+      candidateErrors.push(candidateError);
+      if (pep668.test(error)) {
+        userRefused = true;
+        refuse("user", error);
       }
-      lastError = `${candidate.command} ${candidate.args.join(" ")}: ${outcome.error}`;
-      debugLog(`[pip-fallback] ${lastError}`);
     }
-    throw new Error(`Failed to install ${packageName}: no usable pip command found (${lastError || "unknown error"})`);
+    if (!userRefused)
+      throw new Error(`pip install failed: ${candidateErrors.join(" | ") || "unknown error"}`);
+    const privateBase = path.join(getGlobalDmLensDir(), "pip-user");
+    const privateEnv = { ...process.env, PYTHONUSERBASE: privateBase };
+    for (const candidate of pipCandidates) {
+      const args = candidate.command === "pip" || candidate.command === "pip3" ? [...verb, "--user", "--break-system-packages", packageName] : [
+        "-m",
+        "pip",
+        ...verb,
+        "--user",
+        "--break-system-packages",
+        packageName
+      ];
+      const result = await run(candidate.command, args, privateEnv);
+      const error = (result.error?.message ?? result.stderr).trim();
+      if (result.status !== 0) {
+        const candidateError = `${candidate.command} ${args.join(" ")}: ${boundInstallError(error, INSTALL_CANDIDATE_ERROR_LIMIT)}`;
+        candidateErrors.push(candidateError);
+        continue;
+      }
+      const binaryPath = await addBinToPath(pipScriptsDir(privateBase, installerPlatform()));
+      if (binaryPath)
+        return succeeded("private-prefix", binaryPath);
+      throw new Error(`private-prefix pip installed ${packageName} but ${binaryName} is not resolvable`);
+    }
+    throw new Error(`pip install failed: ${candidateErrors.join(" | ") || "unknown error"}`);
   } catch (err) {
-    logSessionStart(`auto-install pip ${packageName}: exception: ${err.message}`);
-    return;
+    return recordPackageManagerInstallException(toolId, "pip", packageName, err);
   }
 }
-async function installGemTool(packageName) {
+async function installGemTool(toolId, packageName) {
   try {
     const gemResult = await safeSpawnAsync("gem", ["install", packageName, "--no-document"], {
       timeout: 120000,
@@ -2884,8 +3377,7 @@ async function installGemTool(packageName) {
     }
     return packageName;
   } catch (err) {
-    logSessionStart(`auto-install gem ${packageName}: exception: ${err.message}`);
-    return;
+    return recordPackageManagerInstallException(toolId, "gem", packageName, err);
   }
 }
 async function stampInstallResolution(toolId) {
@@ -2934,7 +3426,7 @@ export async function installTool(toolId) {
       case "npm": {
         if (!tool.packageName || !tool.binaryName)
           return false;
-        const npmPath = await installNpmTool(tool.packageName, tool.binaryName, tool.checkArgs, getToolVerificationTimeout(tool));
+        const npmPath = await installNpmTool(tool.id, tool.packageName, tool.binaryName, tool.checkArgs, getToolVerificationTimeout(tool), packageEntryVerification(tool));
         if (npmPath !== undefined) {
           await import("./managed-tool-refresh.js").then((m) => m.stampManagedToolInstalled(tool.id, tool.packageName)).catch(() => {});
         }
@@ -2943,18 +3435,24 @@ export async function installTool(toolId) {
       case "pip": {
         if (!tool.packageName)
           return false;
-        const pipPath = await installPipTool(tool.packageName);
+        const pipPath = await installPipTool(tool.id, tool.packageName, tool.binaryName ?? tool.id);
         return finishInstallAttempt(tool.id, pipPath !== undefined, startedAt);
       }
       case "gem": {
         if (!tool.packageName)
           return false;
-        const gemPath = await installGemTool(tool.packageName);
+        const gemPath = await installGemTool(tool.id, tool.packageName);
         return finishInstallAttempt(tool.id, gemPath !== undefined, startedAt);
       }
       case "github": {
         if (!tool.github)
           return false;
+        if (!tool.github.assetMatch(process.platform, process.arch)) {
+          const reason = `unsupported platform=${process.platform} arch=${process.arch}`;
+          noteInstallAttempt(tool.id, "unavailable", reason);
+          logSessionStart(`auto-install ${tool.id}: ${reason}`);
+          return false;
+        }
         const ghPath = await installGitHubTool(tool);
         return finishInstallAttempt(tool.id, ghPath !== undefined, startedAt);
       }
@@ -2967,6 +3465,12 @@ export async function installTool(toolId) {
       case "archive": {
         if (!tool.archive)
           return false;
+        if (!resolveArchiveUrl(tool.archive)) {
+          const reason = `unsupported platform=${process.platform} arch=${process.arch}`;
+          noteInstallAttempt(tool.id, "unavailable", reason);
+          logSessionStart(`auto-install ${tool.id}: ${reason}`);
+          return false;
+        }
         const archivePath = await installArchiveTool(tool);
         return finishInstallAttempt(tool.id, archivePath !== undefined, startedAt);
       }
@@ -3191,6 +3695,8 @@ export function getToolInstallStrategy(toolId) {
   return TOOLS.find((tool) => tool.id === toolId)?.installStrategy;
 }
 export const GITHUB_TOOLS = [
+  "cljfmt",
+  "php-cs-fixer",
   "shellcheck",
   "shfmt",
   "rust-analyzer",
@@ -3213,6 +3719,8 @@ export const GITHUB_TOOLS = [
   "clojure-lsp",
   "cue",
   "gleam",
+  "typstyle",
+  "tinymist",
   "marksman",
   "expert"
 ];
@@ -3220,6 +3728,10 @@ export function resolveGitHubAsset(toolId, platform, arch) {
   const tool = TOOLS.find((t) => t.id === toolId);
   return tool?.github?.assetMatch(platform, arch);
 }
+export function resolveGitHubAssetLauncher(toolId, _platform, assetName) {
+  const tool = TOOLS.find((t) => t.id === toolId);
+  return tool?.github ? launcherForGitHubAsset(tool.github, assetName) : undefined;
+}
 export function resolveGitHubInstalledBinaryName(toolId, platform, assetName) {
   const tool = TOOLS.find((t) => t.id === toolId);
   if (!tool)