@gajae-code/coding-agent 0.11.4 → 0.11.6

package/src/internal-urls/local-protocol.ts

@@ -1,14 +1,35 @@
+import { createHash, randomUUID } from "node:crypto";
+import * as fsSync from "node:fs";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { exactRemoveDirectoryTree, type NativeDirectoryTreeSnapshot, snapshotDirectoryTree } from "@gajae-code/natives";
 import { isEnoent } from "@gajae-code/utils";
 import { AgentRegistry } from "../registry/agent-registry";
 import { parseInternalUrl } from "./parse";
 import { validateRelativePath } from "./skill-protocol";
 import type { InternalResource, InternalUrl, ProtocolHandler } from "./types";
 
+export interface ManagedLegacyLocalMigrationEntry {
+	readonly relativePath: string;
+	readonly kind: "directory" | "file";
+	readonly bytes?: Uint8Array;
+	readonly sha256?: string;
+}
+
+/** Opaque authority for a managed session's legacy `local` artifact tree. */
+export interface ManagedLegacyLocalMigrationSource {
+	capture(): Promise<{
+		readonly snapshot: NativeDirectoryTreeSnapshot;
+		readonly entries: readonly ManagedLegacyLocalMigrationEntry[];
+	} | null>;
+	retire(snapshot: NativeDirectoryTreeSnapshot): void;
+}
+
 export interface LocalProtocolOptions {
 	getArtifactsDir?: () => string | null;
+	isManagedDestination?: () => boolean;
+	getManagedLegacyLocalMigrationSource?: () => ManagedLegacyLocalMigrationSource | null;
 	getSessionId?: () => string | null;
 }
 
@@ -45,6 +66,7 @@ async function listFilesRecursively(rootPath: string): Promise<string[]> {
 		const entries = await fs.readdir(absoluteDir, { withFileTypes: true });
 
 		for (const entry of entries) {
+			if (entry.name === LEGACY_MIGRATION_MARKER) continue;
 			const entryPath = path.join(relativeDir, entry.name);
 			if (entry.isDirectory()) {
 				pending.push(entryPath);
@@ -108,20 +130,404 @@ function extractRelativePath(url: InternalUrl): string {
 	return decoded;
 }
 
-export function resolveLocalRoot(options: LocalProtocolOptions): string {
+function safeSessionId(options: LocalProtocolOptions): string {
+	const sessionId = (options.getSessionId?.() ?? "session").replace(/[^a-zA-Z0-9_.-]/g, "_");
+	return sessionId === "" || sessionId === "." || sessionId === ".." ? "session" : sessionId;
+}
+
+async function assertDirectoryNotSymlink(directoryPath: string): Promise<void> {
+	const stat = await fs.lstat(directoryPath);
+	if (!stat.isDirectory() || stat.isSymbolicLink()) {
+		throw new Error("Unsafe local:// root");
+	}
+}
+
+const LEGACY_MIGRATION_MARKER = ".gjc-local-legacy-migrated-v1";
+const MAX_LEGACY_LOCAL_BYTES = 64 * 1024 * 1024;
+
+interface LegacyEntrySnapshot {
+	readonly relativePath: string;
+	readonly dev: bigint;
+	readonly ino: bigint;
+	readonly size: bigint;
+	readonly digest?: string;
+	readonly bytes?: Buffer;
+}
+interface LegacyIdentityStat {
+	readonly dev: bigint;
+	readonly ino: bigint;
+	readonly size: bigint;
+}
+
+function matchesSnapshot(stat: LegacyIdentityStat, snapshot: LegacyEntrySnapshot): boolean {
+	return stat.dev === snapshot.dev && stat.ino === snapshot.ino && stat.size === snapshot.size;
+}
+
+async function snapshotDirectory(directoryPath: string, relativePath: string): Promise<LegacyEntrySnapshot> {
+	const stat = await fs.lstat(directoryPath, { bigint: true });
+	if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("Unsafe legacy local:// migration source");
+	return { relativePath, dev: stat.dev, ino: stat.ino, size: stat.size };
+}
+
+async function snapshotRegularFile(filePath: string, relativePath: string): Promise<LegacyEntrySnapshot> {
+	const before = await fs.lstat(filePath, { bigint: true });
+	if (!before.isFile() || before.isSymbolicLink()) throw new Error("Unsafe legacy local:// migration source");
+	const flags = fsSync.constants.O_RDONLY | (process.platform === "win32" ? 0 : (fsSync.constants.O_NOFOLLOW ?? 0));
+	const handle = await fs.open(filePath, flags);
+	try {
+		const opened = await handle.stat({ bigint: true });
+		const identity = { relativePath, dev: before.dev, ino: before.ino, size: before.size };
+		if (!opened.isFile() || !matchesSnapshot(opened, identity))
+			throw new Error("Legacy local:// migration source changed during capture");
+		const bytes = await handle.readFile();
+		const after = await fs.lstat(filePath, { bigint: true });
+		if (!matchesSnapshot(after, identity)) throw new Error("Legacy local:// migration source changed during capture");
+		return { ...identity, digest: createHash("sha256").update(bytes).digest("hex"), bytes };
+	} finally {
+		await handle.close();
+	}
+}
+
+function manifestsMatch(left: readonly LegacyEntrySnapshot[], right: readonly LegacyEntrySnapshot[]): boolean {
+	return (
+		left.length === right.length &&
+		left.every(
+			(entry, index) =>
+				entry.relativePath === right[index]?.relativePath &&
+				entry.dev === right[index]?.dev &&
+				entry.ino === right[index]?.ino &&
+				entry.size === right[index]?.size &&
+				entry.digest === right[index]?.digest,
+		)
+	);
+}
+
+async function captureLegacyManifest(root: string): Promise<readonly LegacyEntrySnapshot[]> {
+	const manifest: LegacyEntrySnapshot[] = [];
+	let copiedBytes = 0n;
+	const captureDirectory = async (directoryPath: string, relativePath: string): Promise<void> => {
+		const directory = await snapshotDirectory(directoryPath, relativePath);
+		manifest.push(directory);
+		const entries = (await fs.readdir(directoryPath, { withFileTypes: true })).sort((a, b) =>
+			a.name.localeCompare(b.name),
+		);
+		for (const entry of entries) {
+			const entryPath = path.join(directoryPath, entry.name);
+			const entryRelativePath = path.join(relativePath, entry.name);
+			if (entry.name === LEGACY_MIGRATION_MARKER) throw new Error("Unsafe legacy local:// migration source");
+			if (entry.isDirectory()) await captureDirectory(entryPath, entryRelativePath);
+			else {
+				const file = await snapshotRegularFile(entryPath, entryRelativePath);
+				copiedBytes += file.size;
+				if (copiedBytes > BigInt(MAX_LEGACY_LOCAL_BYTES))
+					throw new Error("Legacy local:// migration exceeds the safe size limit");
+				manifest.push(file);
+			}
+		}
+		const after = await fs.lstat(directoryPath, { bigint: true });
+		if (!matchesSnapshot(after, directory))
+			throw new Error("Legacy local:// migration source changed during capture");
+	};
+	await captureDirectory(root, "");
+	return manifest;
+}
+
+async function copyLegacyManifest(
+	source: string,
+	destination: string,
+	manifest: readonly LegacyEntrySnapshot[],
+): Promise<void> {
+	for (const entry of manifest) {
+		if (entry.relativePath === "") {
+			await fs.mkdir(destination, { mode: 0o700 });
+			continue;
+		}
+		const from = path.join(source, entry.relativePath);
+		const to = path.join(destination, entry.relativePath);
+		if (entry.digest === undefined) {
+			await fs.mkdir(to, { mode: 0o700 });
+			continue;
+		}
+		const captured = await snapshotRegularFile(from, entry.relativePath);
+		if (captured.digest !== entry.digest || !matchesSnapshot(captured, entry))
+			throw new Error("Legacy local:// migration source changed during capture");
+		if (entry.bytes === undefined) throw new Error("Legacy local:// migration snapshot is incomplete");
+		await fs.writeFile(to, entry.bytes, { mode: 0o600, flag: "wx" });
+		const copied = await fs.readFile(to);
+		if (createHash("sha256").update(copied).digest("hex") !== entry.digest)
+			throw new Error("Legacy local:// migration destination verification failed");
+	}
+}
+
+async function retireLegacyTree(legacyRoot: string, manifest: readonly LegacyEntrySnapshot[]): Promise<void> {
+	const root = manifest[0];
+	if (root?.relativePath !== "") throw new Error("Legacy local:// migration manifest has no root");
+	const before = await fs.lstat(legacyRoot, { bigint: true });
+	if (!matchesSnapshot(before, root)) throw new Error("Legacy local:// migration source changed during retirement");
+	const captured = snapshotDirectoryTree(legacyRoot);
+	if (!captured.ok || !captured.snapshot) {
+		throw new Error(`Legacy local:// migration retirement snapshot failed: ${captured.code ?? "unknown"}`);
+	}
+	if (captured.snapshot.entries.length !== manifest.length) {
+		throw new Error("Legacy local:// migration retirement manifest changed");
+	}
+	const expected = new Map(manifest.map(entry => [entry.relativePath.replaceAll(path.sep, "/"), entry]));
+	for (const entry of captured.snapshot.entries) {
+		const original = expected.get(entry.relativePath);
+		if (
+			!original ||
+			entry.dev !== original.dev.toString() ||
+			entry.ino !== original.ino.toString() ||
+			entry.size !== original.size.toString() ||
+			(entry.kind === "file" ? entry.sha256 !== original.digest : original.digest !== undefined)
+		) {
+			throw new Error("Legacy local:// migration retirement authority differs from copied manifest");
+		}
+	}
+	const removed = exactRemoveDirectoryTree(legacyRoot, captured.snapshot);
+	if (!removed.ok) throw new Error(`Legacy local:// migration retirement failed: ${removed.code}`);
+}
+async function migrateManagedLegacyLocal(
+	source: ManagedLegacyLocalMigrationSource,
+	localRoot: string,
+	scratchParent: string,
+	marker: string,
+): Promise<void> {
+	const captured = await source.capture();
+	if (!captured) {
+		await fs.writeFile(marker, "absent\n", { mode: 0o600, flag: "wx" });
+		return;
+	}
+	let copiedBytes = 0;
+	for (const entry of captured.entries) {
+		if (entry.kind === "file") {
+			if (!entry.bytes || !entry.sha256) throw new Error("Legacy local:// migration snapshot is incomplete");
+			copiedBytes += entry.bytes.byteLength;
+			if (copiedBytes > MAX_LEGACY_LOCAL_BYTES)
+				throw new Error("Legacy local:// migration exceeds the safe size limit");
+		}
+	}
+	const staging = path.join(scratchParent, `.gjc-local-migration-${randomUUID()}`);
+	const installed: Array<{ readonly path: string; readonly dev: bigint; readonly ino: bigint }> = [];
+	let installedMarker: { readonly dev: bigint; readonly ino: bigint } | null = null;
+	try {
+		await fs.mkdir(staging, { mode: 0o700 });
+		for (const entry of captured.entries) {
+			if (entry.relativePath === "") continue;
+			const target = path.join(staging, entry.relativePath);
+			if (entry.kind === "directory") await fs.mkdir(target, { mode: 0o700 });
+			else {
+				await fs.writeFile(target, entry.bytes!, { mode: 0o600, flag: "wx" });
+				const copied = await fs.readFile(target);
+				if (createHash("sha256").update(copied).digest("hex") !== entry.sha256)
+					throw new Error("Legacy local:// migration destination verification failed");
+			}
+		}
+		for (const entry of await fs.readdir(staging)) {
+			const destination = path.join(localRoot, entry);
+			try {
+				await fs.lstat(destination);
+				throw new Error("Legacy local:// migration destination is ambiguous");
+			} catch (error) {
+				if (!isEnoent(error)) throw error;
+			}
+			await fs.rename(path.join(staging, entry), destination);
+			const identity = await fs.lstat(destination, { bigint: true });
+			installed.push({ path: destination, dev: identity.dev, ino: identity.ino });
+		}
+		await fs.writeFile(marker, "verified\n", { mode: 0o600, flag: "wx" });
+		const markerIdentity = await fs.lstat(marker, { bigint: true });
+		installedMarker = { dev: markerIdentity.dev, ino: markerIdentity.ino };
+		source.retire(captured.snapshot);
+	} catch (error) {
+		const currentMarker = await fs.lstat(marker, { bigint: true }).catch(() => null);
+		if (installedMarker && currentMarker?.dev === installedMarker.dev && currentMarker.ino === installedMarker.ino)
+			await fs.rm(marker, { force: true });
+		for (const destination of installed.reverse()) {
+			const current = await fs.lstat(destination.path, { bigint: true }).catch(() => null);
+			if (current?.dev === destination.dev && current.ino === destination.ino)
+				await fs.rm(destination.path, { recursive: true, force: true });
+		}
+		throw error;
+	} finally {
+		await fs.rm(staging, { recursive: true, force: true });
+	}
+}
+
+async function readMigrationMarker(marker: string): Promise<boolean> {
+	try {
+		const snapshot = await snapshotRegularFile(marker, LEGACY_MIGRATION_MARKER);
+		if (snapshot.size > 32n || snapshot.bytes === undefined) throw new Error("Unsafe local:// migration marker");
+		const value = snapshot.bytes.toString("utf8");
+		if (value !== "verified\n" && value !== "absent\n") throw new Error("Unsafe local:// migration marker");
+		return true;
+	} catch (error) {
+		if (isEnoent(error)) return false;
+		throw error;
+	}
+}
+
+async function migrateLegacyLocal(
+	options: LocalProtocolOptions,
+	localRoot: string,
+	scratchParent: string,
+): Promise<void> {
+	const marker = path.join(localRoot, LEGACY_MIGRATION_MARKER);
+	if (await readMigrationMarker(marker)) return;
+	const managedSource = options.getManagedLegacyLocalMigrationSource?.();
+	if (managedSource) {
+		await migrateManagedLegacyLocal(managedSource, localRoot, scratchParent, marker);
+		return;
+	}
 	const artifactsDir = options.getArtifactsDir?.();
-	if (artifactsDir) {
-		return path.resolve(artifactsDir, "local");
+	if (!artifactsDir) {
+		await fs.writeFile(marker, "absent\n", { mode: 0o600, flag: "wx" });
+		return;
+	}
+	const legacyRoot = path.resolve(artifactsDir, "local");
+	let manifest: readonly LegacyEntrySnapshot[];
+	try {
+		manifest = await captureLegacyManifest(legacyRoot);
+	} catch (error) {
+		if (isEnoent(error)) {
+			await fs.writeFile(marker, "absent\n", { mode: 0o600, flag: "wx" });
+			return;
+		}
+		throw error;
 	}
+	const staging = path.join(scratchParent, `.gjc-local-migration-${randomUUID()}`);
+	try {
+		await copyLegacyManifest(legacyRoot, staging, manifest);
+		const verifiedManifest = await captureLegacyManifest(legacyRoot);
+		if (!manifestsMatch(verifiedManifest, manifest))
+			throw new Error("Legacy local:// migration source changed during capture");
+		for (const entry of await fs.readdir(staging)) {
+			try {
+				await fs.lstat(path.join(localRoot, entry));
+				throw new Error("Legacy local:// migration destination is ambiguous");
+			} catch (error) {
+				if (!isEnoent(error)) throw error;
+			}
+			await fs.rename(path.join(staging, entry), path.join(localRoot, entry));
+		}
+		await retireLegacyTree(legacyRoot, manifest);
+		await fs.writeFile(marker, "verified\n", { mode: 0o600, flag: "wx" });
+	} finally {
+		await fs.rm(staging, { recursive: true, force: true });
+	}
+}
+
+const initializedLocalRoots = new Set<string>();
+
+/**
+ * Completes the mandatory legacy migration gate for a local root.
+ * Call and await this before using the synchronous path resolver for reads or writes.
+ */
+function explicitLocalRoot(options: LocalProtocolOptions): string | null {
+	if (options.isManagedDestination?.()) return null;
+	const artifactsDir = options.getArtifactsDir?.();
+	return artifactsDir ? path.resolve(artifactsDir, "local") : null;
+}
 
-	const sessionId = options.getSessionId?.() ?? "session";
-	const safeSessionId = sessionId.replace(/[^a-zA-Z0-9_.-]/g, "_");
-	return path.join(os.tmpdir(), "gjc-local", safeSessionId);
+async function initializeExplicitLocalRoot(localRoot: string): Promise<string> {
+	await fs.mkdir(path.dirname(localRoot), { recursive: true });
+	await assertDirectoryNotSymlink(path.dirname(localRoot));
+	await fs.mkdir(localRoot, { recursive: true });
+	await assertDirectoryNotSymlink(localRoot);
+	return await fs.realpath(localRoot);
+}
+
+function initializeExplicitLocalRootSync(localRoot: string): string {
+	fsSync.mkdirSync(path.dirname(localRoot), { recursive: true });
+	const parentStat = fsSync.lstatSync(path.dirname(localRoot));
+	if (!parentStat.isDirectory() || parentStat.isSymbolicLink()) throw new Error("Unsafe local:// root");
+	fsSync.mkdirSync(localRoot, { recursive: true });
+	const rootStat = fsSync.lstatSync(localRoot);
+	if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw new Error("Unsafe local:// root");
+	return fsSync.realpathSync(localRoot);
+}
+
+export async function initializeLocalRoot(options: LocalProtocolOptions): Promise<string> {
+	const explicitRoot = explicitLocalRoot(options);
+	if (explicitRoot) return await initializeExplicitLocalRoot(explicitRoot);
+	const localRoot = path.resolve(resolveLocalRoot(options));
+	const scratchParent = path.dirname(localRoot);
+
+	await fs.mkdir(scratchParent, { recursive: true, mode: 0o700 });
+	await assertDirectoryNotSymlink(scratchParent);
+	try {
+		await fs.mkdir(localRoot, { mode: 0o700 });
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "EEXIST") {
+			await assertDirectoryNotSymlink(localRoot);
+		} else {
+			throw error;
+		}
+	}
+	await assertDirectoryNotSymlink(localRoot);
+	await migrateLegacyLocal(options, localRoot, scratchParent);
+
+	const resolvedScratchParent = await fs.realpath(scratchParent);
+	const resolvedLocalRoot = await fs.realpath(localRoot);
+	ensureWithinRoot(resolvedLocalRoot, resolvedScratchParent);
+	if (resolvedLocalRoot === resolvedScratchParent) {
+		throw new Error("Unsafe local:// root");
+	}
+	initializedLocalRoots.add(resolvedLocalRoot);
+	return resolvedLocalRoot;
+}
+
+function initializeLocalRootSyncWhenLegacyAbsent(options: LocalProtocolOptions, localRoot: string): void {
+	const explicitRoot = explicitLocalRoot(options);
+	if (explicitRoot) {
+		initializeExplicitLocalRootSync(explicitRoot);
+		return;
+	}
+	if (initializedLocalRoots.has(localRoot)) return;
+	const scratchParent = path.dirname(localRoot);
+	fsSync.mkdirSync(scratchParent, { recursive: true, mode: 0o700 });
+	const parentStat = fsSync.lstatSync(scratchParent);
+	if (!parentStat.isDirectory() || parentStat.isSymbolicLink()) throw new Error("Unsafe local:// root");
+	try {
+		fsSync.mkdirSync(localRoot, { mode: 0o700 });
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+	}
+	const rootStat = fsSync.lstatSync(localRoot);
+	if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw new Error("Unsafe local:// root");
+	const marker = path.join(localRoot, LEGACY_MIGRATION_MARKER);
+	try {
+		const value = fsSync.readFileSync(marker, "utf8");
+		if (value !== "verified\n" && value !== "absent\n") throw new Error("Unsafe local:// migration marker");
+		initializedLocalRoots.add(localRoot);
+		return;
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+	}
+	if (options.getManagedLegacyLocalMigrationSource?.()) {
+		throw new Error("local:// legacy migration must complete before path resolution");
+	}
+	const artifactsDir = options.getArtifactsDir?.();
+	if (artifactsDir && fsSync.existsSync(path.resolve(artifactsDir, "local"))) {
+		throw new Error("local:// legacy migration must complete before path resolution");
+	}
+	try {
+		fsSync.writeFileSync(marker, "absent\n", { mode: 0o600, flag: "wx" });
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+		if (fsSync.readFileSync(marker, "utf8") !== "absent\n") throw new Error("Unsafe local:// migration marker");
+	}
+	initializedLocalRoots.add(localRoot);
+}
+
+export function resolveLocalRoot(options: LocalProtocolOptions): string {
+	return explicitLocalRoot(options) ?? path.join(os.tmpdir(), "gjc-local", safeSessionId(options));
 }
 
 export function resolveLocalUrlToPath(input: string | InternalUrl, options: LocalProtocolOptions): string {
 	const url = typeof input === "string" ? parseLocalUrl(input) : input;
 	const localRoot = path.resolve(resolveLocalRoot(options));
+	initializeLocalRootSyncWhenLegacyAbsent(options, localRoot);
 	const relativePath = extractRelativePath(url);
 
 	if (!relativePath) {
@@ -177,6 +583,7 @@ export class LocalProtocolHandler implements ProtocolHandler {
 	static resetOverrideForTests(): void {
 		LocalProtocolHandler.#override = undefined;
 		LocalProtocolHandler.#ownedOverrides = [];
+		initializedLocalRoots.clear();
 	}
 
 	/**
@@ -199,6 +606,8 @@ export class LocalProtocolHandler implements ProtocolHandler {
 		if (!sessionManager) return undefined;
 		return {
 			getArtifactsDir: () => sessionManager.getArtifactsDir(),
+			isManagedDestination: () => sessionManager.isManagedDestination(),
+			getManagedLegacyLocalMigrationSource: () => sessionManager.getManagedLegacyLocalMigrationSource(),
 			getSessionId: () => sessionManager.getSessionId(),
 		};
 	}
@@ -209,18 +618,7 @@ export class LocalProtocolHandler implements ProtocolHandler {
 			throw new Error("No session - local:// unavailable");
 		}
 
-		const localRoot = path.resolve(resolveLocalRoot(opts));
-		await fs.mkdir(localRoot, { recursive: true });
-
-		let resolvedRoot: string;
-		try {
-			resolvedRoot = await fs.realpath(localRoot);
-		} catch (error) {
-			if (isEnoent(error)) {
-				throw new Error("Unable to initialize local:// root");
-			}
-			throw error;
-		}
+		const resolvedRoot = await initializeLocalRoot(opts);
 
 		const relativePath = extractRelativePath(url);
 		const targetPath = relativePath ? path.resolve(resolvedRoot, relativePath) : resolvedRoot;

package/src/lsp/index.ts

@@ -461,88 +461,6 @@ async function waitForDiagnostics(
 	return getAcceptedDiagnostics(client.diagnostics.get(uri), expectedDocumentVersion, allowUnversioned) ?? [];
 }
 
-/** Project type detection result */
-interface ProjectType {
-	type: "rust" | "typescript" | "go" | "python" | "unknown";
-	command?: string[];
-	description: string;
-}
-
-/** Detect project type from root markers */
-function detectProjectType(cwd: string): ProjectType {
-	// Check for Rust (Cargo.toml)
-	if (fs.existsSync(path.join(cwd, "Cargo.toml"))) {
-		return { type: "rust", command: ["cargo", "check", "--message-format=short"], description: "Rust (cargo check)" };
-	}
-
-	// Check for TypeScript (tsconfig.json)
-	if (fs.existsSync(path.join(cwd, "tsconfig.json"))) {
-		return { type: "typescript", command: ["npx", "tsc", "--noEmit"], description: "TypeScript (tsc --noEmit)" };
-	}
-
-	// Check for Go (go.mod)
-	if (fs.existsSync(path.join(cwd, "go.mod"))) {
-		return { type: "go", command: ["go", "build", "./..."], description: "Go (go build)" };
-	}
-
-	// Check for Python (pyproject.toml or pyrightconfig.json)
-	if (fs.existsSync(path.join(cwd, "pyproject.toml")) || fs.existsSync(path.join(cwd, "pyrightconfig.json"))) {
-		return { type: "python", command: ["pyright"], description: "Python (pyright)" };
-	}
-
-	return { type: "unknown", description: "Unknown project type" };
-}
-
-/** Run workspace diagnostics command and parse output */
-async function runWorkspaceDiagnostics(
-	cwd: string,
-	signal?: AbortSignal,
-): Promise<{ output: string; projectType: ProjectType }> {
-	throwIfAborted(signal);
-	const projectType = detectProjectType(cwd);
-	if (!projectType.command) {
-		return {
-			output: `Cannot detect project type. Supported: Rust (Cargo.toml), TypeScript (tsconfig.json), Go (go.mod), Python (pyproject.toml)`,
-			projectType,
-		};
-	}
-	const proc = Bun.spawn(projectType.command, {
-		cwd,
-		stdout: "pipe",
-		stderr: "pipe",
-		windowsHide: true,
-	});
-	const abortHandler = () => {
-		proc.kill();
-	};
-	if (signal) {
-		signal.addEventListener("abort", abortHandler, { once: true });
-	}
-
-	try {
-		const [stdout, stderr] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text()]);
-		await proc.exited;
-		throwIfAborted(signal);
-		const combined = (stdout + stderr).trim();
-		if (!combined) {
-			return { output: "No issues found", projectType };
-		}
-		// Limit output length
-		const lines = combined.split("\n");
-		if (lines.length > 50) {
-			return { output: `${lines.slice(0, 50).join("\n")}\n... and ${lines.length - 50} more lines`, projectType };
-		}
-		return { output: combined, projectType };
-	} catch (e) {
-		if (signal?.aborted) {
-			throw new ToolAbortError();
-		}
-		return { output: `Failed to run ${projectType.command.join(" ")}: ${e}`, projectType };
-	} finally {
-		signal?.removeEventListener("abort", abortHandler);
-	}
-}
-
 /** Result from getDiagnosticsForFile */
 export interface FileDiagnosticsResult {
 	/** Name of the LSP server used (if available) */
@@ -1235,16 +1153,14 @@ export class LspTool implements AgentTool<typeof lspSchema, LspToolDetails, Them
 		// Diagnostics can be batch or single-file - queries all applicable servers
 		if (action === "diagnostics") {
 			if (file === "*") {
-				// `*` => run workspace diagnostics across all configured servers
-				const result = await runWorkspaceDiagnostics(this.session.cwd, signal);
 				return {
 					content: [
 						{
 							type: "text",
-							text: `Workspace diagnostics (${result.projectType.description}):\n${result.output}`,
+							text: "Workspace build diagnostics are unavailable via lsp. Use a concrete file path or glob for language-server diagnostics, and use an execution-authorized tool to run build or typecheck commands.",
 						},
 					],
-					details: { action, success: true, request: params },
+					details: { action, success: false, request: params },
 				};
 			}
 
@@ -1253,7 +1169,7 @@ export class LspTool implements AgentTool<typeof lspSchema, LspToolDetails, Them
 					content: [
 						{
 							type: "text",
-							text: "Error: file parameter required. Use `*` for workspace-wide diagnostics or a path/glob for specific files.",
+							text: "Error: file parameter required. Use a concrete file path or glob for diagnostics.",
 						},
 					],
 					details: { action, success: false, request: params },
@@ -1281,7 +1197,7 @@ export class LspTool implements AgentTool<typeof lspSchema, LspToolDetails, Them
 			const allServerNames = new Set<string>();
 			if (truncatedGlobTargets) {
 				results.push(
-					`${theme.status.warning} Pattern matched more than ${MAX_GLOB_DIAGNOSTIC_TARGETS} files; showing first ${MAX_GLOB_DIAGNOSTIC_TARGETS}. Narrow the glob or use workspace diagnostics.`,
+					`${theme.status.warning} Pattern matched more than ${MAX_GLOB_DIAGNOSTIC_TARGETS} files; showing first ${MAX_GLOB_DIAGNOSTIC_TARGETS}. Narrow the glob for broader coverage.`,
 				);
 			}