@event4u/agent-config 16.2.0 → 16.3.0

package/dist/cli-delegate/{chunk-YJ72UIAK.js → chunk-NQ7WT43P.js}

@@ -13,209 +13,9 @@ import {
 import {
   read_lockfile
 } from "./chunk-T7L2QK3K.js";
-
-// src/scripts/_lib/secret_detector.ts
-var ENTROPY_MIN_TOKEN_LENGTH = 20;
-var BASE64_ENTROPY_THRESHOLD = 4.5;
-var HEX_ENTROPY_THRESHOLD = 3;
-var RULES = [
-  { rule: "anthropic-api-key", kind: "anthropic-api-key", regex: /sk-ant-[A-Za-z0-9_-]{20,}/g },
-  { rule: "anthropic-project-key", kind: "anthropic-api-key", regex: /sk-proj-[A-Za-z0-9_-]{20,}/g },
-  { rule: "aws-access-key", kind: "aws-access-key", regex: /AKIA[0-9A-Z]{16}/g },
-  { rule: "google-api-key", kind: "google-api-key", regex: /AIza[0-9A-Za-z_-]{35}/g },
-  { rule: "github-pat", kind: "github-pat", regex: /ghp_[0-9A-Za-z]{36}/g },
-  // Fine-grained PATs (github_pat_…) were a measured detector gap: the
-  // 2026-07-28 adversarial corpus pass flagged them as missed positives.
-  { rule: "github-fine-grained-pat", kind: "github-pat", regex: /github_pat_[0-9A-Za-z_]{22,}/g },
-  {
-    rule: "jwt",
-    kind: "jwt",
-    regex: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
-  },
-  // Extensions.
-  { rule: "stripe-secret-key", kind: "stripe-secret-key", regex: /sk_(?:live|test)_[0-9A-Za-z]{16,}/g },
-  { rule: "slack-token", kind: "slack-token", regex: /xox[baprs]-[0-9A-Za-z-]{10,}/g },
-  { rule: "pem-private-key", kind: "pem-private-key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
-  {
-    rule: "db-connection-uri",
-    kind: "db-connection-uri",
-    regex: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]+@/g
-  },
-  {
-    rule: "generic-assignment",
-    kind: "generic-assignment",
-    regex: /(?:password|passwd|pwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token)\s*[:=]\s*['"]?([^'"\s]{8,})['"]?/gi,
-    valueGroup: 1
-  }
-];
-var SECRET_ALLOW = /secret-allow/;
-var PLACEHOLDER_PATTERNS = [
-  /x{4,}/i,
-  /example/i,
-  /changeme/i,
-  /your[_-].*here/i,
-  /<[^>]+>/,
-  /\.\.\./,
-  /^your[_-]/i,
-  /placeholder/i
-];
-var DATA_URI = /data:[\w.+-]+\/[\w.+-]+;base64,/i;
-var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
-var KEYWORD_CONTEXT = /password|secret|token|api[_-]?key|credential/i;
-var ENTROPY_TOKEN = /[A-Za-z0-9+=_-]{20,}/g;
-var IS_HEX = /^[0-9a-fA-F]+$/;
-var HASH_HEX_LENGTHS = /* @__PURE__ */ new Set([32, 40, 64]);
-function isAllSameChar(value) {
-  return value.length > 0 && /^(.)\1*$/.test(value);
-}
-var GENERIC_MIN_LENGTH = 16;
-var GENERIC_MIN_ENTROPY = 3.3;
-var CODE_EXPR = /[()$`{}<>[\];,]|->|=>|\.\w/;
-function looksLikeSecretValue(value) {
-  if (value.length < GENERIC_MIN_LENGTH) {
-    return false;
-  }
-  if (CODE_EXPR.test(value)) {
-    return false;
-  }
-  const hasDigit = /[0-9]/.test(value);
-  const mixedCase = /[a-z]/.test(value) && /[A-Z]/.test(value);
-  if (!hasDigit && !mixedCase) {
-    return false;
-  }
-  return shannonEntropy(value) >= GENERIC_MIN_ENTROPY;
-}
-function isPlaceholderValue(value, pathHint) {
-  if (pathHint !== void 0) {
-    if (pathHint.endsWith(".example") || pathHint.endsWith(".sample") || pathHint.includes(".env.example")) {
-      return true;
-    }
-  }
-  if (isAllSameChar(value)) {
-    return true;
-  }
-  return PLACEHOLDER_PATTERNS.some((p) => p.test(value));
-}
-function maskSecret(value) {
-  const front = value.slice(0, 4);
-  const back = value.length > 6 ? value.slice(-2) : "";
-  if (front.length + back.length >= value.length) {
-    return `${value.slice(0, 1)}\u2026`;
-  }
-  return `${front}\u2026${back}`;
-}
-function shannonEntropy(value) {
-  const freq = /* @__PURE__ */ new Map();
-  for (const ch of value) {
-    freq.set(ch, (freq.get(ch) ?? 0) + 1);
-  }
-  const n = value.length;
-  let entropy = 0;
-  for (const count of freq.values()) {
-    const p = count / n;
-    entropy -= p * Math.log2(p);
-  }
-  return entropy;
-}
-function overlaps(spans, start, end) {
-  return spans.some(([s, e]) => start < e && s < end);
-}
-function scanText(text, opts = {}) {
-  const pathHint = opts.path;
-  const findings = [];
-  const lines = text.split(/\r\n|\r|\n/);
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    const lineNo = i + 1;
-    if (SECRET_ALLOW.test(line)) {
-      continue;
-    }
-    const covered = [];
-    for (const rule of RULES) {
-      rule.regex.lastIndex = 0;
-      let m;
-      while ((m = rule.regex.exec(line)) !== null) {
-        const value = rule.valueGroup !== void 0 ? m[rule.valueGroup] : m[0];
-        if (value === void 0) {
-          if (m.index === rule.regex.lastIndex) {
-            rule.regex.lastIndex += 1;
-          }
-          continue;
-        }
-        if (rule.rule === "generic-assignment" && !looksLikeSecretValue(value)) {
-          if (m.index === rule.regex.lastIndex) {
-            rule.regex.lastIndex += 1;
-          }
-          continue;
-        }
-        const valueStart = m.index + m[0].indexOf(value);
-        const confidence = isPlaceholderValue(value, pathHint) ? "low" : "high";
-        findings.push({
-          rule: rule.rule,
-          kind: rule.kind,
-          line: lineNo,
-          column: valueStart + 1,
-          masked: maskSecret(value),
-          confidence
-        });
-        covered.push([valueStart, valueStart + value.length]);
-        if (m.index === rule.regex.lastIndex) {
-          rule.regex.lastIndex += 1;
-        }
-      }
-    }
-    if (!DATA_URI.test(line)) {
-      const hasKeyword = KEYWORD_CONTEXT.test(line);
-      ENTROPY_TOKEN.lastIndex = 0;
-      let tm;
-      while ((tm = ENTROPY_TOKEN.exec(line)) !== null) {
-        const token = tm[0];
-        const start = tm.index;
-        const end = start + token.length;
-        if (token.length < ENTROPY_MIN_TOKEN_LENGTH) {
-          continue;
-        }
-        if (overlaps(covered, start, end)) {
-          continue;
-        }
-        if (UUID.test(token)) {
-          continue;
-        }
-        if (/^sha(?:256|384|512)-/.test(token)) {
-          continue;
-        }
-        const entropy = shannonEntropy(token);
-        const isHex = IS_HEX.test(token);
-        if (isHex && HASH_HEX_LENGTHS.has(token.length)) {
-          continue;
-        }
-        let confidence = null;
-        if (isHex) {
-          if (entropy >= HEX_ENTROPY_THRESHOLD && hasKeyword) {
-            confidence = "high";
-          }
-        } else if (entropy >= BASE64_ENTROPY_THRESHOLD) {
-          confidence = hasKeyword ? "high" : "medium";
-        }
-        if (confidence === null) {
-          continue;
-        }
-        if (isPlaceholderValue(token, pathHint)) {
-          confidence = "low";
-        }
-        findings.push({
-          rule: "entropy",
-          kind: "high-entropy-string",
-          line: lineNo,
-          column: start + 1,
-          masked: maskSecret(token),
-          confidence
-        });
-      }
-    }
-  }
-  return findings;
-}
+import {
+  scanText
+} from "./chunk-KB5FZ655.js";
 
 // src/scripts/_lib/subagent_capsule.ts
 var EPISTEMIC_STATES = ["verified", "assumed", "gap"];
@@ -561,10 +361,57 @@ function validateAssumption(input, label = "assumption") {
 }
 
 // src/scripts/before_complete_hook.ts
-import fs from "node:fs";
-import path from "node:path";
+import fs4 from "node:fs";
+import path4 from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+// src/scripts/_lib/hook_settings.ts
+import * as fs from "node:fs";
+import * as path from "node:path";
+var SETTINGS_FILE = ".agent-settings.yml";
+function hookSectionValue(root, section, key) {
+  const file = path.join(root, SETTINGS_FILE);
+  let text;
+  try {
+    if (!fs.statSync(file).isFile()) return "";
+    text = fs.readFileSync(file, "utf-8");
+  } catch {
+    return "";
+  }
+  const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const sectionPattern = new RegExp(`^(\\s+)${esc(section)}\\s*:\\s*$`);
+  const keyPattern = new RegExp(`^\\s+${esc(key)}\\s*:\\s*(.+)$`);
+  let inHooks = false;
+  let sectionIndent = null;
+  const indentOf = (line) => line.length - line.replace(/^\s+/, "").length;
+  for (const raw of text.split(/\r\n|\r|\n/)) {
+    const line = raw.replace(/\s+$/, "");
+    if (!line || line.replace(/^\s+/, "").startsWith("#")) continue;
+    if (!(line.startsWith(" ") || line.startsWith("	"))) {
+      inHooks = /^hooks\s*:\s*$/.test(line);
+      sectionIndent = null;
+      continue;
+    }
+    if (inHooks) {
+      const opened = sectionPattern.exec(line);
+      if (opened) {
+        sectionIndent = opened[1].length;
+        continue;
+      }
+      if (sectionIndent !== null && indentOf(line) <= sectionIndent) {
+        sectionIndent = null;
+      }
+    }
+    if (sectionIndent !== null) {
+      const m = keyPattern.exec(line);
+      if (m) {
+        return (m[1] ?? "").replace(/\s+#.*$/, "").trim().replace(/^["']|["']$/g, "");
+      }
+    }
+  }
+  return "";
+}
+
 // src/scripts/_lib/verification_command.ts
 var VERIFY_BINARIES = /* @__PURE__ */ new Set([
   "vitest",
@@ -733,6 +580,187 @@ function mightBeVerification(command) {
   return _WIDE_CANDIDATE_RE.test(command);
 }
 
+// src/scripts/_lib/touched_file_quality.ts
+import { spawnSync } from "node:child_process";
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
+var OUTPUT_HEAD_LINES = 20;
+var DEFAULT_TIMEOUT_MS = 3e4;
+var JS_EXTENSIONS = [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mts", ".cts"];
+var SCOPED_FORMS = /* @__PURE__ */ new Map([
+  ["npx eslint .", { argv: ["npx", "eslint"], extensions: JS_EXTENSIONS, check_form: false }],
+  [
+    "vendor/bin/phpstan analyse",
+    { argv: ["vendor/bin/phpstan", "analyse"], extensions: [".php"], check_form: false }
+  ],
+  // `vendor/bin/pint` REWRITES source. `--test` is its check form: same tool,
+  // same rules, reports instead of writing. Risk 3 of the roadmap is that this
+  // module reformats the consumer's tree; this row plus the fixture that proves
+  // no file changed is the mitigation.
+  [
+    "vendor/bin/pint",
+    { argv: ["vendor/bin/pint", "--test"], extensions: [".php"], check_form: true }
+  ],
+  ["ruff check", { argv: ["ruff", "check"], extensions: [".py"], check_form: false }],
+  ["mypy .", { argv: ["mypy"], extensions: [".py"], check_form: false }]
+]);
+var MUTATING_WITHOUT_CHECK_FORM = /* @__PURE__ */ new Set([]);
+function extensionOf(file) {
+  const base = path2.basename(file);
+  const dot = base.lastIndexOf(".");
+  return dot <= 0 ? "" : base.slice(dot).toLowerCase();
+}
+function planQualityRuns(commands, files) {
+  return commands.map((source_command) => {
+    if (MUTATING_WITHOUT_CHECK_FORM.has(source_command)) {
+      return { source_command, argv: null, files: [], skipped: "mutating" };
+    }
+    const spec = SCOPED_FORMS.get(source_command);
+    if (spec === void 0) {
+      return { source_command, argv: null, files: [], skipped: "unscoped" };
+    }
+    const matched = spec.extensions.length === 0 ? [...files] : files.filter((f) => spec.extensions.includes(extensionOf(f)));
+    if (matched.length === 0) {
+      return { source_command, argv: null, files: [], skipped: "no_files" };
+    }
+    return { source_command, argv: [...spec.argv, ...matched], files: matched, skipped: null };
+  });
+}
+function renderCommand(argv) {
+  return argv.join(" ");
+}
+function headLines(text, limit) {
+  if (text === "") return [];
+  return text.split(/\r\n|\r|\n/).filter((line, i, all) => !(line === "" && i === all.length - 1)).slice(0, limit);
+}
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "+00:00");
+}
+function defaultSpawn(argv, cwd, timeout_ms) {
+  const [head, ...rest] = argv;
+  if (head === void 0) return { status: null, output: "", enoent: true };
+  const res = spawnSync(head, rest, {
+    cwd,
+    timeout: timeout_ms,
+    encoding: "utf-8",
+    // No shell. The argv comes from a committed table, and a shell would
+    // make a file path with a space into an injection surface.
+    shell: false,
+    maxBuffer: 4 * 1024 * 1024
+  });
+  const enoent = res.error !== void 0 && res.error.code === "ENOENT";
+  const output2 = `${res.stdout ?? ""}${res.stderr ?? ""}`;
+  return { status: res.status, output: output2, enoent };
+}
+function runTouchedFileQuality(opts) {
+  const timeout_ms = opts.timeout_ms ?? DEFAULT_TIMEOUT_MS;
+  const spawn = opts.spawn ?? defaultSpawn;
+  const out = [];
+  for (const plan of planQualityRuns(opts.commands, opts.files)) {
+    if (plan.argv === null) {
+      out.push({
+        command: plan.source_command,
+        source_command: plan.source_command,
+        exit_code: null,
+        output_head: [],
+        skipped: plan.skipped,
+        files: [],
+        at: now()
+      });
+      continue;
+    }
+    let status = null;
+    let output2 = "";
+    let enoent = false;
+    try {
+      const res = spawn(plan.argv, opts.root, timeout_ms);
+      status = res.status;
+      output2 = res.output;
+      enoent = res.enoent;
+    } catch {
+      enoent = true;
+    }
+    const absent = enoent || status === 127;
+    out.push({
+      command: renderCommand(plan.argv),
+      source_command: plan.source_command,
+      exit_code: absent ? null : status,
+      output_head: absent ? [] : headLines(output2, OUTPUT_HEAD_LINES),
+      skipped: absent ? "absent" : null,
+      files: plan.files,
+      at: now()
+    });
+  }
+  return out;
+}
+var WARN_LINE_MAX_BYTES = 200;
+function advisoryLine(runs) {
+  const failed = runs.find((r) => r.skipped === null && r.exit_code !== null && r.exit_code !== 0);
+  if (failed === void 0) return null;
+  const file = failed.files[0] ?? "(no file)";
+  const more = failed.files.length > 1 ? ` (+${String(failed.files.length - 1)} more)` : "";
+  const line = `touched-file quality: ${failed.source_command} exited ${String(failed.exit_code)} on ${file}${more}`;
+  return truncateToBytes(line, WARN_LINE_MAX_BYTES);
+}
+function truncateToBytes(text, max) {
+  const buf = Buffer.from(text, "utf-8");
+  if (buf.length <= max) return text;
+  let end = max;
+  while (end > 0 && (buf[end] ?? 0) >= 128 && (buf[end] ?? 0) < 192) end -= 1;
+  return buf.subarray(0, end).toString("utf-8");
+}
+function touchedFilesAtStop(root, session_id, gitStatus = defaultGitStatus) {
+  let recorded;
+  try {
+    const raw = fs2.readFileSync(
+      path2.join(root, "agents", "state", "minimal-safe-diff.json"),
+      "utf-8"
+    );
+    const decoded = JSON.parse(raw);
+    if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) {
+      return { files: [], source: "none" };
+    }
+    const state = decoded;
+    if (state["session_id"] !== session_id || session_id === "") {
+      return { files: [], source: "none" };
+    }
+    const touched = state["files_touched_this_turn"];
+    if (!Array.isArray(touched)) return { files: [], source: "none" };
+    recorded = touched.filter((x) => typeof x === "string");
+  } catch {
+    return { files: [], source: "none" };
+  }
+  const changed = new Set(gitStatus(root));
+  const files = recorded.filter((f) => changed.has(normalizePath(f)));
+  return { files, source: "minimal-safe-diff\u2229worktree" };
+}
+function normalizePath(p) {
+  return p.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function defaultGitStatus(root) {
+  const res = spawnSync("git", ["status", "--porcelain", "-z"], {
+    cwd: root,
+    encoding: "utf-8",
+    timeout: 1e4,
+    shell: false,
+    maxBuffer: 4 * 1024 * 1024
+  });
+  if (res.status !== 0 || typeof res.stdout !== "string") return [];
+  return parsePorcelainZ(res.stdout);
+}
+function parsePorcelainZ(stdout) {
+  const out = [];
+  const parts = stdout.split("\0");
+  for (let i = 0; i < parts.length; i += 1) {
+    const entry = parts[i];
+    if (entry === void 0 || entry.length < 4) continue;
+    const status = entry.slice(0, 2);
+    out.push(normalizePath(entry.slice(3)));
+    if (status.startsWith("R") || status.startsWith("C")) i += 1;
+  }
+  return out;
+}
+
 // src/scripts/_lib/verification_evidence.ts
 var INSTRUMENT_GAP_REASONS = /* @__PURE__ */ new Set([
   "exit_code_unavailable",
@@ -1029,9 +1057,814 @@ function describeRecordFinding(failed, reasons) {
 }
 var NO_RED_EVIDENCE_REASON = "a completion claim over production code this turn changed, with a test file touched but `no_red_evidence` \u2014 no recorded run shows that test target failing and then passing after the last edit. A test never seen red has unknown sensitivity: run it against the unfixed code, watch it fail for the intended reason, then fix and re-run";
 
+// src/agent-src/templates/scripts/work_engine/stack/runner.ts
+import * as fs3 from "node:fs";
+import * as path3 from "node:path";
+var BEHAVIOR_UNKNOWN = "unknown";
+var SPEED_FAST = "fast";
+var SPEED_SLOW = "slow";
+var SPEED_E2E = "e2e";
+var HIGH = "HIGH";
+var MEDIUM = "MEDIUM";
+var LOW = "LOW";
+var _MANIFESTS = [
+  "composer.json",
+  "package.json",
+  "pyproject.toml",
+  "go.mod",
+  "Cargo.toml",
+  "Makefile",
+  "Taskfile.yml",
+  "Taskfile.yaml",
+  "Gemfile",
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  // `settings.gradle[.kts]` is a Gradle signal `_jvm_build` acts on, so it
+  // must be in the key: a settings-only multi-project root emits a junit row
+  // and would otherwise report the greenfield `mtime: 0` forever.
+  "settings.gradle",
+  "settings.gradle.kts",
+  "global.json",
+  "Directory.Build.props"
+];
+var _DOTNET_PROJECT_EXTS = [".sln", ".slnx", ".csproj", ".fsproj", ".vbproj"];
+var _DOTNET_TEST_STACK = /Microsoft\.NET\.Test\.Sdk|xunit|nunit|mstest/i;
+var _DOTNET_SCAN_DEPTH = 2;
+var _DOTNET_MAX_PROJECTS = 50;
+var _DOTNET_SOLUTION_EXTS = [".sln", ".slnx"];
+function _has_dotnet_solution(dir) {
+  try {
+    return fs3.readdirSync(dir, { withFileTypes: true }).some((e) => e.isFile() && _DOTNET_SOLUTION_EXTS.includes(path3.extname(e.name).toLowerCase()));
+  } catch {
+    return false;
+  }
+}
+var _BEHAVIOR_MARKERS = [
+  "pnpm-workspace.yaml",
+  "requirements.txt",
+  "gems.rb",
+  ".rspec",
+  "behat.yml",
+  "behat.yaml",
+  "behat.yml.dist",
+  "behat.dist.yml",
+  "cucumber.js",
+  "cucumber.cjs",
+  "cucumber.mjs",
+  "cucumber.json"
+];
+var RunnerResult = class {
+  ecosystem;
+  runner;
+  command;
+  speed;
+  confidence;
+  basis;
+  constructor(ecosystem, runner, command, speed = SPEED_FAST, confidence = HIGH, basis = "") {
+    this.ecosystem = ecosystem;
+    this.runner = runner;
+    this.command = command;
+    this.speed = speed;
+    this.confidence = confidence;
+    this.basis = basis;
+  }
+};
+var BehaviorRunnerResult = class {
+  constructor(ecosystem, runner, command, scope_root, confidence = HIGH, basis = "", conflict = []) {
+    this.ecosystem = ecosystem;
+    this.runner = runner;
+    this.command = command;
+    this.scope_root = scope_root;
+    this.confidence = confidence;
+    this.basis = basis;
+    this.conflict = conflict;
+  }
+  ecosystem;
+  runner;
+  command;
+  scope_root;
+  confidence;
+  basis;
+  conflict;
+};
+var ToolchainResult = class {
+  ecosystems;
+  runners;
+  selected;
+  quality;
+  confidence;
+  mtime;
+  /**
+   * Per-scope behavior inventory — detection only, deliberately NOT merged
+   * into `runners` nor reachable from `selected`, so nothing is ever run
+   * BECAUSE this axis detected it.
+   *
+   * That is a claim about reachability, not about execution, and the two
+   * came apart in review: for four of the eight labels the behavior command
+   * is byte-identical to a native command already in `selected` —
+   * `pytest-bdd`/`pytest`, `cucumber-jvm`/`jvm.command`, and both
+   * `reqnroll` and `specflow`/`dotnet test`. Those native rows are
+   * SPEED_FAST, so the suite does run by default; it runs as the native
+   * runner's work, which this axis neither caused nor can prevent. Stating
+   * it as "reported, never run" overreached in exactly the half a reader
+   * would act on.
+   */
+  behavior_runners;
+  constructor(args) {
+    this.ecosystems = args.ecosystems;
+    this.runners = args.runners;
+    this.selected = args.selected;
+    this.quality = args.quality;
+    this.confidence = args.confidence;
+    this.mtime = args.mtime;
+    this.behavior_runners = args.behavior_runners ?? [];
+  }
+  /**
+   * Serialise to the auto-generated project-config shape.
+   *
+   * Written to `agents/runtime/state/toolchain.json` by
+   * {@link write_config} so the per-stack commands are captured once and
+   * re-read cheaply (keyed on `mtime`) instead of re-detected every turn.
+   */
+  to_config() {
+    return {
+      ecosystems: [...this.ecosystems],
+      confidence: this.confidence,
+      // `mtime` is a Python float; wrap so `write_config`'s serialiser
+      // renders an integral value as `N.0` (Python float repr).
+      mtime: pyFloat(this.mtime),
+      runners: this.runners.map((r) => ({
+        ecosystem: r.ecosystem,
+        runner: r.runner,
+        command: r.command,
+        speed: r.speed,
+        confidence: r.confidence,
+        basis: r.basis
+      })),
+      selected: this.selected.map((r) => r.command),
+      quality: [...this.quality],
+      behavior_runners: this.behavior_runners.map((r) => ({
+        ecosystem: r.ecosystem,
+        runner: r.runner,
+        command: r.command,
+        scope_root: r.scope_root,
+        confidence: r.confidence,
+        basis: r.basis,
+        conflict: [...r.conflict]
+      }))
+    };
+  }
+};
+function resolve_toolchain(project_root, opts = {}) {
+  const include_slow = opts.include_slow ?? false;
+  const include_e2e = opts.include_e2e ?? false;
+  const php_only = opts.php_only ?? false;
+  const runners = [];
+  const quality = [];
+  const composer = _read_json(path3.join(project_root, "composer.json"));
+  const pkg = _read_json(path3.join(project_root, "package.json"));
+  const has_composer = _is_file(path3.join(project_root, "composer.json"));
+  const has_package = _is_file(path3.join(project_root, "package.json"));
+  const pyproject_text = _read_text(path3.join(project_root, "pyproject.toml"));
+  const has_python = Boolean(pyproject_text) || _is_file(path3.join(project_root, "requirements.txt")) || _is_file(path3.join(project_root, "setup.cfg")) || _is_file(path3.join(project_root, "pytest.ini"));
+  const has_go = _is_file(path3.join(project_root, "go.mod"));
+  const has_cargo = _is_file(path3.join(project_root, "Cargo.toml"));
+  const gemfile_text = _ruby_gemfile_text(project_root);
+  const jvm = _jvm_build(project_root);
+  const dotnet_basis = _dotnet_basis(project_root);
+  const wrappers = _task_runner_wrappers(project_root, pkg);
+  if (has_composer) {
+    runners.push(..._php_runners(project_root, composer, wrappers));
+    quality.push(..._php_quality(project_root, composer, wrappers));
+  }
+  if (has_package) {
+    runners.push(..._js_runners(pkg, wrappers, _package_manager(project_root, pkg)));
+    quality.push(..._js_quality(pkg, wrappers));
+  }
+  if (has_python) {
+    runners.push(..._python_runners(pyproject_text));
+    quality.push(..._python_quality(pyproject_text));
+  }
+  if (has_go) {
+    runners.push(
+      new RunnerResult("go", "go-test", "go test ./...", SPEED_FAST, HIGH, "go.mod present")
+    );
+    quality.push("go vet ./...");
+  }
+  if (has_cargo) {
+    runners.push(
+      new RunnerResult("rust", "cargo-test", "cargo test", SPEED_FAST, HIGH, "Cargo.toml present")
+    );
+    quality.push("cargo clippy");
+  }
+  runners.push(..._ruby_runners(project_root, gemfile_text));
+  if (jvm !== null) {
+    runners.push(..._jvm_runners(jvm));
+  }
+  if (dotnet_basis !== null) {
+    runners.push(..._dotnet_runners(dotnet_basis));
+  }
+  const ecosystems = _dictFromKeys(runners.map((r) => r.ecosystem));
+  const selected = _apply_guard(runners, { include_slow, include_e2e, php_only });
+  const confidence = _overall_confidence(runners);
+  const scopes = _behavior_scopes(project_root);
+  return new ToolchainResult({
+    ecosystems,
+    runners: [...runners],
+    selected: [...selected],
+    quality: _dictFromKeys(quality),
+    confidence,
+    // Computed ONCE and threaded into both consumers: workspace discovery
+    // reads a manifest and lists per glob parent, and both the cache probe
+    // and the behavior axis need the same list.
+    mtime: latest_manifest_mtime(project_root, scopes),
+    behavior_runners: resolve_behavior_runners(project_root, scopes)
+  });
+}
+function latest_manifest_mtime(project_root, scopes) {
+  const mtimes = [];
+  const names = [..._MANIFESTS, ..._BEHAVIOR_MARKERS];
+  for (const scope of scopes ?? _behavior_scopes(project_root)) {
+    const dir = scope === "." ? project_root : path3.join(project_root, scope);
+    for (const name of names) {
+      const p = path3.join(dir, name);
+      if (_is_file(p)) {
+        mtimes.push(_stat_mtime(p));
+      }
+    }
+  }
+  return mtimes.length > 0 ? Math.max(...mtimes) : 0;
+}
+function _php_runners(root, composer, wrappers) {
+  const deps = _all_dependencies(composer, "require", "require-dev");
+  if ("pestphp/pest" in deps || _is_file(path3.join(root, "vendor", "bin", "pest"))) {
+    const cmd2 = wrappers["php-test"] || "vendor/bin/pest";
+    const basis = "pestphp/pest" in deps ? "pestphp/pest in composer require" : "vendor/bin/pest present";
+    return [new RunnerResult("php", "pest", cmd2, SPEED_FAST, HIGH, basis)];
+  }
+  if (_is_file(path3.join(root, "artisan"))) {
+    const cmd2 = wrappers["php-test"] || "php artisan test";
+    return [new RunnerResult("php", "phpunit", cmd2, SPEED_FAST, HIGH, "artisan present (Laravel)")];
+  }
+  if ("phpunit/phpunit" in deps || _is_file(path3.join(root, "vendor", "bin", "phpunit"))) {
+    const cmd2 = wrappers["php-test"] || "vendor/bin/phpunit";
+    return [new RunnerResult("php", "phpunit", cmd2, SPEED_FAST, HIGH, "phpunit/phpunit detected")];
+  }
+  const cmd = wrappers["php-test"] || "vendor/bin/phpunit";
+  return [
+    new RunnerResult(
+      "php",
+      "phpunit",
+      cmd,
+      SPEED_FAST,
+      MEDIUM,
+      "composer.json present, no explicit runner"
+    )
+  ];
+}
+function _js_runners(pkg, wrappers, manager) {
+  const deps = _all_dependencies(
+    pkg,
+    "dependencies",
+    "devDependencies",
+    "peerDependencies",
+    "optionalDependencies"
+  );
+  const scripts = _isDict(pkg.scripts) ? pkg.scripts : {};
+  const pm_test = wrappers["js-test"];
+  const out = [];
+  if ("vitest" in deps) {
+    const cmd = pm_test && _script_uses(scripts, "test", "vitest") ? pm_test : "npx vitest run";
+    out.push(new RunnerResult("js", "vitest", cmd, SPEED_FAST, HIGH, "vitest in package deps"));
+  } else if ("jest" in deps) {
+    const cmd = pm_test && _script_uses(scripts, "test", "jest") ? pm_test : "npx jest";
+    out.push(new RunnerResult("js", "jest", cmd, SPEED_FAST, HIGH, "jest in package deps"));
+  } else if (pm_test) {
+    out.push(
+      new RunnerResult(
+        "js",
+        "jest",
+        pm_test,
+        SPEED_FAST,
+        MEDIUM,
+        "package.json test script, runner unclear"
+      )
+    );
+  }
+  if ("@playwright/test" in deps || "playwright" in deps) {
+    const cmd = _script_command(scripts, ["test:e2e", "e2e", "playwright"], manager) || "npx playwright test";
+    out.push(
+      new RunnerResult("js", "playwright", cmd, SPEED_E2E, HIGH, "@playwright/test in package deps")
+    );
+  } else if ("cypress" in deps) {
+    const cmd = _script_command(scripts, ["test:e2e", "e2e", "cypress"], manager) || "npx cypress run";
+    out.push(new RunnerResult("js", "cypress", cmd, SPEED_E2E, HIGH, "cypress in package deps"));
+  }
+  const slow_cmd = _script_command(scripts, ["test:slow", "test:integration"], manager);
+  if (slow_cmd) {
+    out.push(
+      new RunnerResult(
+        "js",
+        "vitest" in deps ? "vitest" : "jest",
+        slow_cmd,
+        SPEED_SLOW,
+        MEDIUM,
+        "test:slow/integration script"
+      )
+    );
+  }
+  return out;
+}
+function _python_runners(pyproject_text) {
+  if (pyproject_text.includes("pytest") || pyproject_text === "") {
+    const conf = pyproject_text.includes("pytest") ? HIGH : MEDIUM;
+    const basis = pyproject_text.includes("pytest") ? "pytest in pyproject" : "python project, no explicit runner";
+    return [new RunnerResult("python", "pytest", "pytest", SPEED_FAST, conf, basis)];
+  }
+  return [
+    new RunnerResult("python", "pytest", "pytest", SPEED_FAST, MEDIUM, "python project, no explicit runner")
+  ];
+}
+function _ruby_gemfile_text(dir) {
+  let present = false;
+  for (const name of ["Gemfile", "gems.rb"]) {
+    const full = path3.join(dir, name);
+    present = present || _is_file(full);
+    const text = _read_text(full);
+    if (text !== "") {
+      return { text, file: name, present: true };
+    }
+  }
+  return { text: "", file: "", present };
+}
+function _gem_declared(text, gem) {
+  return new RegExp(`^[ \\t]*gem[ \\t]+["']${gem}(-[A-Za-z0-9_-]+)?["']`, "m").test(text);
+}
+function _ruby_runners(root, gemfile) {
+  const dot_rspec = _is_file(path3.join(root, ".rspec"));
+  const spec_helper = _is_file(path3.join(root, "spec", "spec_helper.rb"));
+  const in_gemfile = _gem_declared(gemfile.text, "rspec");
+  if (!in_gemfile && !dot_rspec && !spec_helper) {
+    return [];
+  }
+  const basis = in_gemfile ? `rspec in ${gemfile.file}` : dot_rspec ? ".rspec present" : "spec/spec_helper.rb present";
+  const cmd = gemfile.present ? "bundle exec rspec" : "rspec";
+  return [new RunnerResult("ruby", "rspec", cmd, SPEED_FAST, HIGH, basis)];
+}
+function _jvm_build(root) {
+  const pom = _read_text(path3.join(root, "pom.xml"));
+  if (pom !== "") {
+    const wrapper = _is_file(path3.join(root, "mvnw"));
+    return { tool: "maven", text: pom, command: wrapper ? "./mvnw test" : "mvn test" };
+  }
+  const gradleFile = ["build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts"].find(
+    (n) => _is_file(path3.join(root, n))
+  );
+  if (gradleFile !== void 0) {
+    const wrapper = _is_file(path3.join(root, "gradlew"));
+    return {
+      tool: "gradle",
+      text: _read_text(path3.join(root, "build.gradle")) + "\n" + _read_text(path3.join(root, "build.gradle.kts")),
+      command: wrapper ? "./gradlew test" : "gradle test"
+    };
+  }
+  return null;
+}
+function _jvm_runners(build) {
+  const named = /\bjunit\b/i.test(build.text);
+  const conf = named ? HIGH : MEDIUM;
+  const basis = named ? `junit in the ${build.tool} build file` : `${build.tool} build file present, no explicit runner`;
+  return [new RunnerResult("jvm", "junit", build.command, SPEED_FAST, conf, basis)];
+}
+function _dotnet_basis(root) {
+  let names;
+  try {
+    names = fs3.readdirSync(root, { withFileTypes: true }).filter((e) => e.isFile()).map((e) => e.name).sort();
+  } catch {
+    names = [];
+  }
+  const target = names.find((n) => _DOTNET_PROJECT_EXTS.includes(path3.extname(n).toLowerCase()));
+  if (target === void 0) {
+    return null;
+  }
+  return _DOTNET_TEST_STACK.test(_dotnet_project_text(root)) ? { basis: "test stack named in a .NET project file", confidence: HIGH } : { basis: `${target} present, no test stack named`, confidence: MEDIUM };
+}
+function _dotnet_runners(found) {
+  return [
+    new RunnerResult(
+      "dotnet",
+      "dotnet-test",
+      "dotnet test",
+      SPEED_FAST,
+      found.confidence,
+      found.basis
+    )
+  ];
+}
+function resolve_behavior_runners(project_root, scopes) {
+  const out = [];
+  for (const scope of scopes ?? _behavior_scopes(project_root)) {
+    const dir = scope === "." ? project_root : path3.join(project_root, scope);
+    const rows = _behavior_runners_in_scope(dir, scope);
+    for (const ecosystem of _dictFromKeys(rows.map((r) => r.ecosystem))) {
+      const found = rows.filter((r) => r.ecosystem === ecosystem);
+      const names = [...new Set(found.map((r) => r.runner))].sort();
+      if (names.length <= 1) {
+        out.push(found[0]);
+        continue;
+      }
+      out.push(
+        new BehaviorRunnerResult(
+          ecosystem,
+          BEHAVIOR_UNKNOWN,
+          "",
+          scope,
+          LOW,
+          `two ${ecosystem} behavior runners in one scope (${names.join(", ")}) \u2014 refusing to choose, as the frontend detector refuses between mutually exclusive workspaces`,
+          names
+        )
+      );
+    }
+  }
+  return out;
+}
+function _behavior_runners_in_scope(dir, scope) {
+  const out = [];
+  const at = (n) => path3.join(dir, n);
+  const row = (ecosystem, runner, command, basis) => {
+    out.push(new BehaviorRunnerResult(ecosystem, runner, command, scope, HIGH, basis));
+  };
+  const php_deps = _all_dependencies(_read_json(at("composer.json")), "require", "require-dev");
+  const behat_config = ["behat.yml", "behat.yaml", "behat.yml.dist", "behat.dist.yml"].find(
+    (n) => _is_file(at(n))
+  );
+  if ("behat/behat" in php_deps || behat_config !== void 0) {
+    const declared = "behat/behat" in php_deps;
+    const basis = declared ? "behat/behat in the composer manifest" : `${behat_config} present`;
+    row("php", "behat", declared ? "vendor/bin/behat" : "behat", basis);
+  }
+  const js_deps = _all_dependencies(
+    _read_json(at("package.json")),
+    "dependencies",
+    "devDependencies"
+  );
+  const cucumber_config = ["cucumber.js", "cucumber.cjs", "cucumber.mjs", "cucumber.json"].find(
+    (n) => _is_file(at(n))
+  );
+  if ("@cucumber/cucumber" in js_deps || "cucumber" in js_deps || cucumber_config !== void 0) {
+    const dep = "@cucumber/cucumber" in js_deps ? "@cucumber/cucumber" : "cucumber";
+    const declared = dep in js_deps;
+    const basis = declared ? `${dep} in package deps` : `${cucumber_config} present`;
+    row("js", "cucumber-js", declared ? "npx cucumber-js" : "cucumber-js", basis);
+  }
+  const py_text = [_read_text(at("pyproject.toml")), _read_text(at("requirements.txt"))].join("\n");
+  if (_PY_BEHAVE.test(py_text)) {
+    row("python", "behave", "behave", "behave declared as a python dependency");
+  }
+  if (_PY_BDD.test(py_text)) {
+    row("python", "pytest-bdd", "pytest", "pytest-bdd declared as a python dependency");
+  }
+  const gemfile = _ruby_gemfile_text(dir);
+  const cucumber_gem = _gem_declared(gemfile.text, "cucumber");
+  if (cucumber_gem || _is_file(path3.join(dir, "features", "support", "env.rb"))) {
+    const basis = cucumber_gem ? `cucumber in ${gemfile.file}` : "features/support/env.rb present";
+    const cmd = gemfile.present ? "bundle exec cucumber" : "cucumber";
+    row("ruby", "cucumber-ruby", cmd, basis);
+  }
+  const jvm = _jvm_build(dir);
+  if (jvm !== null && /io\.cucumber|cucumber-java|cucumber-junit/i.test(jvm.text)) {
+    row("jvm", "cucumber-jvm", jvm.command, `cucumber in the ${jvm.tool} build file`);
+  }
+  const dotnet_text = _dotnet_project_text(dir);
+  if (/\bReqnroll\b/i.test(dotnet_text)) {
+    row("dotnet", "reqnroll", "dotnet test", "Reqnroll in a project file");
+  }
+  if (/\bSpecFlow\b/i.test(dotnet_text)) {
+    row("dotnet", "specflow", "dotnet test", "SpecFlow in a project file");
+  }
+  return out;
+}
+function _dotnet_project_text(dir) {
+  const texts = [];
+  const solution = _has_dotnet_solution(dir);
+  const walk = (at, depth) => {
+    if (texts.length >= _DOTNET_MAX_PROJECTS) {
+      return;
+    }
+    let entries;
+    try {
+      entries = fs3.readdirSync(at, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    let hit = false;
+    for (const e of entries) {
+      if (!e.isFile() || !_DOTNET_PROJECT_EXTS.includes(path3.extname(e.name).toLowerCase())) {
+        continue;
+      }
+      if (_DOTNET_SOLUTION_EXTS.includes(path3.extname(e.name).toLowerCase())) {
+        continue;
+      }
+      if (texts.length >= _DOTNET_MAX_PROJECTS) {
+        return;
+      }
+      texts.push(_read_text(path3.join(at, e.name)));
+      hit = true;
+    }
+    if (hit || !solution || depth >= _DOTNET_SCAN_DEPTH) {
+      return;
+    }
+    for (const e of entries) {
+      if (e.isDirectory() && !e.name.startsWith(".") && e.name !== "node_modules") {
+        walk(path3.join(at, e.name), depth + 1);
+      }
+    }
+  };
+  walk(dir, 0);
+  return texts.join("\n");
+}
+var _MAX_BEHAVIOR_SCOPES = 200;
+var _PY_BEHAVE = /^[ \t]*["']?behave["']?[ \t]*(?:$|[=<>~!,;[#])/m;
+var _PY_BDD = /^[ \t]*["']?pytest-bdd["']?[ \t]*(?:$|[=<>~!,;[#])/m;
+function _pnpm_packages(text) {
+  const out = [];
+  let inPackages = false;
+  const push = (raw) => {
+    const v = raw.replace(/\s+#.*$/, "").trim().replace(/^['"]|['"]$/g, "").trim();
+    if (v !== "") out.push(v);
+  };
+  for (const line of text.split(/\r?\n/)) {
+    if (line.trim() === "" || /^\s*#/.test(line)) {
+      continue;
+    }
+    const key = /^([A-Za-z0-9_-]+)\s*:(.*)$/.exec(line);
+    if (key) {
+      inPackages = key[1] === "packages";
+      const rest = (key[2] ?? "").trim();
+      if (inPackages && rest.startsWith("[")) {
+        for (const part of rest.replace(/^\[|\]$/g, "").split(",")) {
+          push(part);
+        }
+        inPackages = false;
+      }
+      continue;
+    }
+    if (!inPackages) {
+      continue;
+    }
+    const item = /^\s*-\s*(.+?)\s*$/.exec(line);
+    if (item && item[1] !== void 0) {
+      push(item[1]);
+    }
+  }
+  return out;
+}
+function _excluded_scope(name) {
+  return name.split("/").some((seg) => seg.startsWith(".") || seg === "node_modules");
+}
+function _behavior_scopes(project_root) {
+  const globs = [];
+  const pkg = _read_json(path3.join(project_root, "package.json"));
+  const ws = pkg["workspaces"];
+  if (Array.isArray(ws)) {
+    globs.push(...ws.filter((g) => typeof g === "string"));
+  } else if (_isDict(ws) && Array.isArray(ws["packages"])) {
+    globs.push(...ws["packages"].filter((g) => typeof g === "string"));
+  }
+  globs.push(..._pnpm_packages(_read_text(path3.join(project_root, "pnpm-workspace.yaml"))));
+  const scopes = ["."];
+  for (const raw of globs) {
+    if (scopes.length >= _MAX_BEHAVIOR_SCOPES) {
+      break;
+    }
+    const g = raw.replace(/^\.\//, "").replace(/\/+$/, "");
+    if (g === "" || g.startsWith("!") || g.startsWith("/") || g.includes("..")) {
+      continue;
+    }
+    if (_excluded_scope(g)) {
+      continue;
+    }
+    if (g.endsWith("/*")) {
+      const parent = g.slice(0, -2);
+      let children;
+      try {
+        children = fs3.readdirSync(path3.join(project_root, parent), { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      children.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+      for (const c of children) {
+        if (scopes.length >= _MAX_BEHAVIOR_SCOPES) {
+          break;
+        }
+        if (c.isDirectory() && !_excluded_scope(c.name)) {
+          scopes.push(`${parent}/${c.name}`);
+        }
+      }
+    } else if (!g.includes("*")) {
+      try {
+        if (fs3.lstatSync(path3.join(project_root, g)).isDirectory()) {
+          scopes.push(g);
+        }
+      } catch {
+      }
+    }
+  }
+  return _dictFromKeys(scopes);
+}
+function _php_quality(root, composer, _wrappers) {
+  const deps = _all_dependencies(composer, "require", "require-dev");
+  const out = [];
+  if ("phpstan/phpstan" in deps || _is_file(path3.join(root, "vendor", "bin", "phpstan"))) {
+    out.push("vendor/bin/phpstan analyse");
+  }
+  if ("laravel/pint" in deps || _is_file(path3.join(root, "vendor", "bin", "pint"))) {
+    out.push("vendor/bin/pint");
+  }
+  return out;
+}
+function _js_quality(pkg, _wrappers) {
+  const deps = _all_dependencies(
+    pkg,
+    "dependencies",
+    "devDependencies",
+    "peerDependencies",
+    "optionalDependencies"
+  );
+  const out = [];
+  if ("typescript" in deps) {
+    out.push("npx tsc --noEmit");
+  }
+  if ("eslint" in deps) {
+    out.push("npx eslint .");
+  }
+  return out;
+}
+function _python_quality(pyproject_text) {
+  const out = [];
+  if (pyproject_text.includes("ruff")) {
+    out.push("ruff check");
+  }
+  if (pyproject_text.includes("mypy")) {
+    out.push("mypy .");
+  }
+  return out;
+}
+function _task_runner_wrappers(root, pkg) {
+  const out = {};
+  const makefile = _read_text(path3.join(root, "Makefile"));
+  const taskfile = _read_text(path3.join(root, "Taskfile.yml")) || _read_text(path3.join(root, "Taskfile.yaml"));
+  if (makefile && _reSearch(/^test\s*:/m, makefile)) {
+    out["php-test"] = "make test";
+  } else if (taskfile && _reSearch(/^\s*test\s*:/m, taskfile)) {
+    out["php-test"] = "task test";
+  }
+  const scripts = _isDict(pkg.scripts) ? pkg.scripts : {};
+  if (_isDict(scripts) && "test" in scripts) {
+    out["js-test"] = `${_package_manager(root, pkg)} test`;
+  }
+  return out;
+}
+var LOCKFILE_MANAGERS = [
+  ["pnpm-lock.yaml", "pnpm"],
+  ["yarn.lock", "yarn"],
+  ["bun.lock", "bun"],
+  ["bun.lockb", "bun"],
+  ["package-lock.json", "npm"]
+];
+function _resolve_package_manager(root, pkg) {
+  const declared = pkg === void 0 ? void 0 : pkg["packageManager"];
+  if (typeof declared === "string" && declared.trim() !== "") {
+    const name = declared.trim().split("@")[0];
+    if (name !== "") {
+      return { manager: name, via: "packageManager", finding: "" };
+    }
+  }
+  const present = LOCKFILE_MANAGERS.filter(([file]) => _is_file(path3.join(root, file)));
+  const distinct = [...new Set(present.map(([, mgr]) => mgr))];
+  if (distinct.length > 1) {
+    return {
+      manager: null,
+      via: "ambiguous",
+      finding: `two package-manager lockfiles present (${present.map(([f]) => f).join(", ")}) and no \`packageManager\` declaration \u2014 report both and stop, per monorepo-workspace SKILL.md \xA7 1`
+    };
+  }
+  if (distinct.length === 1) {
+    const mgr = distinct[0];
+    return { manager: mgr, via: mgr, finding: "" };
+  }
+  return { manager: "npm", via: "npm", finding: "" };
+}
+function _package_manager(root, pkg) {
+  return _resolve_package_manager(root, pkg).manager ?? "npm";
+}
+function _apply_guard(runners, opts) {
+  const out = [];
+  for (const r of runners) {
+    if (opts.php_only && r.ecosystem !== "php") {
+      continue;
+    }
+    if (r.speed === SPEED_E2E && !opts.include_e2e) {
+      continue;
+    }
+    if (r.speed === SPEED_SLOW && !opts.include_slow) {
+      continue;
+    }
+    out.push(r);
+  }
+  return out;
+}
+function _overall_confidence(runners) {
+  if (runners.length === 0) {
+    return LOW;
+  }
+  if (runners.some((r) => r.confidence === HIGH)) {
+    return HIGH;
+  }
+  return MEDIUM;
+}
+function _read_json(p) {
+  if (!_is_file(p)) {
+    return {};
+  }
+  let payload;
+  try {
+    payload = JSON.parse(fs3.readFileSync(p, { encoding: "utf-8" }));
+  } catch {
+    return {};
+  }
+  return _isDict(payload) ? payload : {};
+}
+function _read_text(p) {
+  if (!_is_file(p)) {
+    return "";
+  }
+  try {
+    return fs3.readFileSync(p, { encoding: "utf-8" });
+  } catch {
+    return "";
+  }
+}
+function _all_dependencies(manifest, ...keys) {
+  const merged = {};
+  for (const key of keys) {
+    const section = manifest[key];
+    if (_isDict(section)) {
+      Object.assign(merged, section);
+    }
+  }
+  return merged;
+}
+function _script_uses(scripts, name, tool) {
+  const value = scripts[name];
+  return typeof value === "string" && value.includes(tool);
+}
+function _script_command(scripts, names, manager) {
+  for (const name of names) {
+    if (typeof scripts[name] === "string") {
+      return `${manager} run ${name}`;
+    }
+  }
+  return "";
+}
+function _is_file(p) {
+  try {
+    return fs3.statSync(p).isFile();
+  } catch {
+    return false;
+  }
+}
+function _stat_mtime(p) {
+  try {
+    return Number(fs3.statSync(p, { bigint: true }).mtimeNs) / 1e9;
+  } catch {
+    return 0;
+  }
+}
+function _isDict(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function _reSearch(pattern, text) {
+  return pattern.test(text);
+}
+function _dictFromKeys(seq) {
+  return [...new Set(seq)];
+}
+var _PyFloat = class {
+  value;
+  constructor(value) {
+    this.value = value;
+  }
+};
+function pyFloat(value) {
+  return new _PyFloat(value);
+}
+
 // src/scripts/before_complete_hook.ts
-var STATE_FILE = path.join("agents", "state", "verify-before-complete.json");
-var STATE_DIR = path.join("agents", "state", "verify-before-complete");
+var STATE_FILE = path4.join("agents", "state", "verify-before-complete.json");
+var STATE_DIR = path4.join("agents", "state", "verify-before-complete");
 var STATE_RETENTION_DAYS = 7;
 function statePathFor(session_id) {
   return session_state_file(STATE_DIR, session_id);
@@ -1080,9 +1913,55 @@ function _empty_state() {
     // a reader must never have to distinguish "no runs yet" from "key absent".
     verification_runs: [],
     edits_this_turn: 0,
+    // NOTE — `quality_runs` and `quality_files_source` are deliberately ABSENT
+    // here, against the convention `verification_runs` above follows.
+    //
+    // That convention ("present in the empty state so a reader never has to tell
+    // 'no runs yet' from 'key absent'") is the right default and it loses to a
+    // stronger one: the roadmap's first acceptance criterion is that with
+    // `touched_file_quality: off` the record is BYTE-IDENTICAL to the base ref.
+    // Seeding two keys would break that for every install that never opted in,
+    // and "the default-off feature changed my state file" is exactly the kind of
+    // silent shape drift a consumer cannot audit. The convention's cost here is
+    // zero, because the only reader of these keys is 2.1's analysis, which counts
+    // stops — and a stop with no key is a stop where the pass did not run, which
+    // is a distinction it needs rather than one it must not make.
     checked_at: _now()
   };
 }
+function readTouchedFileQualityMode(consumer_root) {
+  const raw = hookSectionValue(consumer_root, "verify_before_complete", "touched_file_quality");
+  return raw === "shadow" || raw === "warn" ? raw : "off";
+}
+function collectTouchedFileQuality(consumer_root, session_id) {
+  let touched;
+  try {
+    touched = touchedFilesAtStop(consumer_root, session_id);
+  } catch {
+    return null;
+  }
+  if (touched.files.length === 0) {
+    return { runs: [], source: touched.source };
+  }
+  let commands = [];
+  try {
+    commands = resolve_toolchain(consumer_root).quality;
+  } catch {
+    commands = [];
+  }
+  try {
+    return {
+      runs: runTouchedFileQuality({
+        root: consumer_root,
+        commands,
+        files: touched.files
+      }),
+      source: touched.source
+    };
+  } catch {
+    return null;
+  }
+}
 function _extract_command(payload) {
   const toolRaw = payload["tool_name"] || payload["toolName"] || payload["tool"];
   if (!(typeof toolRaw === "string" && COMMAND_TOOLS.has(toolRaw))) {
@@ -1195,6 +2074,7 @@ function _cap_runs(runs) {
   return [head, ...tail];
 }
 var _ERROR_EXIT_PREFIX = /^Error:\s*Exit code\s*(\d+)/i;
+var _BARE_EXIT_PREFIX = /^\s*Exit code\s*(\d+)/i;
 var _NO_EXIT = { code: null, source: null, interrupted: false };
 function _numeric_exit_field(obj) {
   for (const key of ["exit_code", "exitCode", "returncode", "returnCode", "status_code"]) {
@@ -1206,26 +2086,46 @@ function _numeric_exit_field(obj) {
   }
   return null;
 }
-function _extract_exit_reading(payload) {
+var FAILURE_EVENT_NAMES = /* @__PURE__ */ new Set(["PostToolUseFailure"]);
+function _is_failure_event(payload, envelope) {
+  for (const v of [payload["hook_event_name"], envelope["native_event"]]) {
+    if (typeof v !== "string" || v === "") continue;
+    if (FAILURE_EVENT_NAMES.has(v)) return true;
+    if (/failure$/i.test(v)) return true;
+  }
+  return false;
+}
+function _extract_exit_reading(payload, failure_event = false) {
+  const seal = (r) => failure_event && r.code === 0 ? { code: null, source: null, interrupted: r.interrupted } : r;
   const direct = _numeric_exit_field(payload);
-  if (direct !== null) return { code: direct, source: "field", interrupted: false };
+  if (direct !== null) return seal({ code: direct, source: "field", interrupted: false });
+  const interrupted_top = payload["is_interrupt"] === true;
+  const err = payload["error"];
+  if (typeof err === "string") {
+    if (interrupted_top) return { code: null, source: null, interrupted: true };
+    const bare = _BARE_EXIT_PREFIX.exec(err) ?? _ERROR_EXIT_PREFIX.exec(err);
+    if (bare?.[1] !== void 0) {
+      return seal({ code: Number(bare[1]), source: "error_prefix", interrupted: false });
+    }
+  }
+  if (interrupted_top) return { code: null, source: null, interrupted: true };
   for (const key of ["tool_response", "toolResponse", "result", "output"]) {
     const v = payload[key];
     if (typeof v === "string") {
       const m = _ERROR_EXIT_PREFIX.exec(v);
       if (m?.[1] !== void 0) {
-        return { code: Number(m[1]), source: "error_prefix", interrupted: false };
+        return seal({ code: Number(m[1]), source: "error_prefix", interrupted: false });
       }
       continue;
     }
     if (v === null || typeof v !== "object" || Array.isArray(v)) continue;
     const obj = v;
     const nested = _numeric_exit_field(obj);
-    if (nested !== null) return { code: nested, source: "field", interrupted: false };
+    if (nested !== null) return seal({ code: nested, source: "field", interrupted: false });
     if (obj["interrupted"] === true) return { code: null, source: null, interrupted: true };
     const hasStream = typeof obj["stdout"] === "string" || typeof obj["stderr"] === "string";
     if (obj["interrupted"] === false && hasStream) {
-      return { code: 0, source: "response_shape", interrupted: false };
+      return seal({ code: 0, source: "response_shape", interrupted: false });
     }
   }
   return _NO_EXIT;
@@ -1247,10 +2147,15 @@ function _extract_run_streams(payload) {
   }
   const topOut = payload["stdout"] ?? payload["output"];
   const topErr = payload["stderr"];
-  return {
-    stdout: typeof topOut === "string" ? topOut : "",
-    stderr: typeof topErr === "string" ? topErr : ""
-  };
+  if (typeof topOut === "string" || typeof topErr === "string") {
+    return {
+      stdout: typeof topOut === "string" ? topOut : "",
+      stderr: typeof topErr === "string" ? topErr : ""
+    };
+  }
+  const errText = payload["error"];
+  if (typeof errText === "string") return { stdout: errText, stderr: "" };
+  return { stdout: "", stderr: "" };
 }
 function _reset_turn(state, session_id) {
   state["session_id"] = session_id || state["session_id"] || "";
@@ -1259,6 +2164,8 @@ function _reset_turn(state, session_id) {
   state["verified_this_turn"] = false;
   state["verification_runs"] = [];
   state["edits_this_turn"] = 0;
+  delete state["quality_runs"];
+  delete state["quality_files_source"];
   state["ci_saw_pending"] = false;
   state["nonevidence_this_turn"] = 0;
   return state;
@@ -1273,7 +2180,7 @@ function _asInt(v) {
   const n = Number(v);
   return Number.isFinite(n) ? Math.trunc(n) : 0;
 }
-function _update(state, event, envelope) {
+function _update(state, event, envelope, quality = null) {
   const session_id = envelope["session_id"] || state["session_id"] || "";
   if (session_id && session_id !== state["session_id"]) {
     state["session_id"] = session_id;
@@ -1281,6 +2188,8 @@ function _update(state, event, envelope) {
     state["ci_last"] = null;
     state = _reset_turn(state, session_id);
   }
+  const platform = envelope["platform"];
+  if (typeof platform === "string" && platform) state["platform"] = platform;
   let payload = envelope["payload"];
   if (!(typeof payload === "object" && payload !== null && !Array.isArray(payload))) {
     payload = {};
@@ -1332,7 +2241,7 @@ function _update(state, event, envelope) {
     }
     if (cmd && mightBeVerification(cmd)) {
       const streams = _extract_run_streams(pl);
-      const exit = _extract_exit_reading(pl);
+      const exit = _extract_exit_reading(pl, _is_failure_event(pl, envelope));
       const runs = Array.isArray(state["verification_runs"]) ? [...state["verification_runs"]] : [];
       runs.push({
         command: cmd.slice(0, 512),
@@ -1356,6 +2265,10 @@ function _update(state, event, envelope) {
     }
   } else if (event === "stop") {
     state["last_stop_at"] = _now();
+    if (quality !== null) {
+      state["quality_runs"] = quality.runs;
+      state["quality_files_source"] = quality.source;
+    }
   }
   state["checked_at"] = _now();
   return state;
@@ -1384,10 +2297,12 @@ function run(stdin_text, options) {
     }
     return 0;
   }
-  const target = path.join(consumer_root, statePathFor(session_id));
+  const target = path4.join(consumer_root, statePathFor(session_id));
+  const quality_mode = event === "stop" ? readTouchedFileQualityMode(consumer_root) : "off";
+  const quality = quality_mode === "off" ? null : collectTouchedFileQuality(consumer_root, session_id);
   let state = {};
   const outcome = update_json_under_lock(target, (loaded) => {
-    state = _update({ ..._empty_state(), ...loaded }, event, envelope);
+    state = _update({ ..._empty_state(), ...loaded }, event, envelope, quality);
     return state;
   });
   if (outcome === "failed") {
@@ -1397,13 +2312,20 @@ function run(stdin_text, options) {
     return 0;
   }
   if (event === "session_start" || event === "user_prompt_submit") {
-    prune_legacy_state_file(path.join(consumer_root, STATE_FILE));
+    prune_legacy_state_file(path4.join(consumer_root, STATE_FILE));
     prune_stale_session_states(
-      path.join(consumer_root, STATE_DIR),
+      path4.join(consumer_root, STATE_DIR),
       Date.now(),
       STATE_RETENTION_DAYS
     );
   }
+  if (quality_mode === "warn" && quality !== null) {
+    const line = advisoryLine(quality.runs);
+    if (line !== null) {
+      process.stderr.write(`${line}
+`);
+    }
+  }
   if (verbose) {
     process.stderr.write(
       `verify-before-complete-hook: event=${event} verified_this_turn=${pyRepr(state["verified_this_turn"])} verifications_this_turn=${pyRepr(state["verifications_this_turn"])}
@@ -1447,7 +2369,7 @@ function main(argv) {
 function readTurnRunState(workspaceRoot, session_id) {
   if (!has_stable_session_id(session_id)) return null;
   try {
-    const raw = fs.readFileSync(path.join(workspaceRoot, statePathFor(session_id)), "utf-8");
+    const raw = fs4.readFileSync(path4.join(workspaceRoot, statePathFor(session_id)), "utf-8");
     const decoded = JSON.parse(raw);
     if (!owns_session_state(decoded, session_id)) return null;
     if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) return null;
@@ -1468,13 +2390,13 @@ function _isCliEntry() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL(path4.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs.realpathSync(fileURLToPath(import.meta.url));
-    const argv = fs.realpathSync(path.resolve(process.argv[1]));
+    const here = fs4.realpathSync(fileURLToPath(import.meta.url));
+    const argv = fs4.realpathSync(path4.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -1487,8 +2409,8 @@ if (isCliEntry) {
 
 // src/scripts/_lib/turn_end_refusals.ts
 import * as crypto from "node:crypto";
-import * as fs2 from "node:fs";
-import * as path2 from "node:path";
+import * as fs5 from "node:fs";
+import * as path5 from "node:path";
 var DETECTOR_IDS = [
   "promissory",
   "language",
@@ -1497,19 +2419,19 @@ var DETECTOR_IDS = [
   "pending-decision",
   "untested"
 ];
-var REFUSAL_STATE_REL = path2.join("agents", "runtime", "state", "turn-end-gate");
+var REFUSAL_STATE_REL = path5.join("agents", "runtime", "state", "turn-end-gate");
 function refusalStateDir(workspaceRoot) {
-  return path2.join(workspaceRoot, REFUSAL_STATE_REL);
+  return path5.join(workspaceRoot, REFUSAL_STATE_REL);
 }
 function deriveSessionKey(sessionId) {
   return crypto.createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
 }
 function sessionRefusalFile(workspaceRoot, sessionKey) {
-  return path2.join(refusalStateDir(workspaceRoot), `${sessionKey}.json`);
+  return path5.join(refusalStateDir(workspaceRoot), `${sessionKey}.json`);
 }
 function readSessionCounts(workspaceRoot, sessionId) {
   try {
-    const raw = fs2.readFileSync(
+    const raw = fs5.readFileSync(
       sessionRefusalFile(workspaceRoot, deriveSessionKey(sessionId)),
       "utf-8"
     );
@@ -1620,7 +2542,7 @@ function emptyRetryCounts() {
 var SHADOW_MAX_ROWS = 200;
 var SHADOW_SUFFIX = ".shadow.json";
 function sessionShadowFile(workspaceRoot, sessionKey) {
-  return path2.join(refusalStateDir(workspaceRoot), `${sessionKey}${SHADOW_SUFFIX}`);
+  return path5.join(refusalStateDir(workspaceRoot), `${sessionKey}${SHADOW_SUFFIX}`);
 }
 function parseShadowRecord(raw) {
   let decoded;
@@ -1645,7 +2567,9 @@ function parseShadowRecord(raw) {
     if (typeof turn !== "number" || !Number.isFinite(turn)) continue;
     if (typeof at !== "string") continue;
     if (layer !== "stop_hook_active" && layer !== "refused_turn") continue;
-    rows.push({ detector: det, turn, at, layer });
+    const setByRaw = ro["set_by"];
+    const set_by = setByRaw === "ours" || setByRaw === "foreign" || setByRaw === "unknown" ? setByRaw : "unknown";
+    rows.push({ detector: det, turn, at, layer, set_by });
   }
   const num = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0;
   const observed = o["retries_observed"];
@@ -1665,8 +2589,15 @@ function parseShadowRecord(raw) {
 }
 function foldShadow(prev, input) {
   const rows = [...prev?.would_refuse_again ?? []];
+  const set_by = input.setBy ?? "unknown";
   for (const d of input.detectors) {
-    rows.push({ detector: d, turn: input.turnOrdinal, at: input.at, layer: input.layer });
+    rows.push({
+      detector: d,
+      turn: input.turnOrdinal,
+      at: input.at,
+      layer: input.layer,
+      set_by
+    });
   }
   let dropped = prev?.dropped ?? 0;
   if (rows.length > SHADOW_MAX_ROWS) {
@@ -1684,27 +2615,37 @@ function foldShadow(prev, input) {
     last_at: input.at
   };
 }
+function shadowSetBy(workspaceRoot, sessionKey) {
+  let raw;
+  try {
+    raw = fs5.readFileSync(sessionRefusalFile(workspaceRoot, sessionKey), "utf-8");
+  } catch (err) {
+    const code = err?.code;
+    return code === "ENOENT" ? "foreign" : "unknown";
+  }
+  return parseRecord(raw) === null ? "unknown" : "ours";
+}
 var REFUSAL_STATE_MAX_AGE_DAYS = 90;
 function pruneAgedRefusalState(workspaceRoot, opts = {}) {
   const maxAgeDays = opts.maxAgeDays ?? REFUSAL_STATE_MAX_AGE_DAYS;
-  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const now2 = opts.now ?? /* @__PURE__ */ new Date();
   const dir = refusalStateDir(workspaceRoot);
   const result = { scanned: 0, pruned: 0, kept: 0 };
   let entries;
   try {
-    entries = fs2.readdirSync(dir);
+    entries = fs5.readdirSync(dir);
   } catch {
     return result;
   }
-  const cutoffMs = now.getTime() - maxAgeDays * 24 * 60 * 60 * 1e3;
+  const cutoffMs = now2.getTime() - maxAgeDays * 24 * 60 * 60 * 1e3;
   for (const name of entries) {
     if (!name.endsWith(".json")) continue;
     result.scanned += 1;
-    const file = path2.join(dir, name);
+    const file = path5.join(dir, name);
     if (name.endsWith(SHADOW_SUFFIX)) {
       let shadow = null;
       try {
-        shadow = parseShadowRecord(fs2.readFileSync(file, "utf-8"));
+        shadow = parseShadowRecord(fs5.readFileSync(file, "utf-8"));
       } catch {
         shadow = null;
       }
@@ -1712,7 +2653,7 @@ function pruneAgedRefusalState(workspaceRoot, opts = {}) {
       if (!Number.isFinite(shadowAt)) {
         let mtime = NaN;
         try {
-          mtime = fs2.statSync(file).mtimeMs;
+          mtime = fs5.statSync(file).mtimeMs;
         } catch {
           mtime = NaN;
         }
@@ -1725,7 +2666,7 @@ function pruneAgedRefusalState(workspaceRoot, opts = {}) {
         continue;
       }
       try {
-        fs2.unlinkSync(file);
+        fs5.unlinkSync(file);
         result.pruned += 1;
       } catch {
         result.kept += 1;
@@ -1734,7 +2675,7 @@ function pruneAgedRefusalState(workspaceRoot, opts = {}) {
     }
     let rec = null;
     try {
-      rec = parseRecord(fs2.readFileSync(file, "utf-8"));
+      rec = parseRecord(fs5.readFileSync(file, "utf-8"));
     } catch {
       rec = null;
     }
@@ -1748,7 +2689,7 @@ function pruneAgedRefusalState(workspaceRoot, opts = {}) {
       continue;
     }
     try {
-      fs2.unlinkSync(file);
+      fs5.unlinkSync(file);
       result.pruned += 1;
     } catch {
       result.kept += 1;
@@ -1783,5 +2724,6 @@ export {
   sessionShadowFile,
   parseShadowRecord,
   foldShadow,
+  shadowSetBy,
   pruneAgedRefusalState
 };