@kabmo-labs/kabmo 0.0.0-stage → 0.0.1

package/marketplace/plugins/command-runner/src/server/detectors/detectors.test.ts

@@ -0,0 +1,267 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Every parser, against the shapes that actually break a naive implementation.
+ *
+ * The comment at the top of `detectors/` promises that a parser is shallow on
+ * purpose and that the cases which break a regex are the ones unit-tested. This
+ * is where that promise is kept, and each test names the SHAPE rather than the
+ * regex — so a reader can tell what the test is defending.
+ *
+ * The sources split by family (`js.ts`, `make.ts`, `python.ts`, `native.ts`), and
+ * this file is deliberately one file rather than four: the interesting cases are
+ * cross-family comparisons (which file wins a shared name, which toolchain lists
+ * verbs versus declares them), and splitting them would hide those.
+ */
+
+import { describe, expect, test } from 'bun:test';
+
+import { detectorFor } from './table';
+import { stripJsonComments } from './jsonc';
+import type { Detector, DetectorContext } from './types';
+
+/**
+ * The detector that owns a file, by assertion — a missing row is a failure.
+ *
+ * The PATH is offered as well as the basename, because a `paths` row
+ * (`.cargo/config.toml`) is claimed by its path and not by its basename — that is
+ * the whole point of the suffix match.
+ */
+function detector(filename: string): Detector {
+  const found = detectorFor(filename, filename);
+  if (!found) throw new Error(`no detector claims ${filename}`);
+  return found;
+}
+
+/** A context whose directory reads answer whatever a test supplies. */
+function ctx(overrides: Partial<DetectorContext> = {}): DetectorContext {
+  return { file: '', dir: '', entries: () => [], dirs: () => [], ...overrides };
+}
+
+/** The command names a parse produced. */
+function names(text: string, filename: string, context: DetectorContext = ctx()): string[] {
+  return detector(filename)
+    .parse(text, context)
+    .map((command) => command.name);
+}
+
+/** The labels a parse produced. */
+function labels(text: string, filename: string, context: DetectorContext = ctx()): string[] {
+  return detector(filename)
+    .parse(text, context)
+    .map((command) => command.label);
+}
+
+describe('the make parser', () => {
+  test('lists targets and skips dot-targets', () => {
+    const text = ['.PHONY: build test', 'build:', '\techo build', 'test:', '\techo test'].join('\n');
+    expect(names(text, 'Makefile')).toEqual(['build', 'test']);
+  });
+
+  test('a variable assignment containing a colon is not a command', () => {
+    // `SRC := a:b` — the bug a bare `^(\w+):` rule produces.
+    expect(names(['SRC := a:b', 'OTHER = x', 'build:', '\techo'].join('\n'), 'Makefile')).toEqual(['build']);
+  });
+
+  test('a pattern rule is not a command', () => {
+    expect(names('%.o: %.c\n\tcc -c $<', 'Makefile')).toEqual([]);
+  });
+
+  test('an indented continuation is not a new target', () => {
+    expect(names(['build: deps \\', '  other:', '\techo'].join('\n'), 'Makefile')).toEqual(['build']);
+  });
+
+  test('a duplicate target is listed once', () => {
+    expect(names('build:\nbuild: extra', 'Makefile')).toEqual(['build']);
+  });
+});
+
+describe('the justfile parser', () => {
+  test('lists recipes and skips assignments and attribute blocks', () => {
+    const text = ['set shell := ["bash", "-c"]', '', '[private]', 'helper:', '  echo hi', '', 'build:', '  echo build'].join('\n');
+    // `helper` IS a recipe (`just helper` runs it); `[private]` only keeps it out
+    // of the default list, and a runner that hid it would refuse a command that
+    // works. What must NOT be listed is the assignment and the attribute block.
+    expect(names(text, 'justfile')).toEqual(['helper', 'build']);
+  });
+
+  test('a recipe with arguments is still a recipe', () => {
+    expect(names('deploy env="prod":\n  echo', 'justfile')).toEqual(['deploy']);
+  });
+});
+
+describe('the Taskfile parser', () => {
+  test('lists every task key, and nothing for a file without tasks', () => {
+    expect(names('version: "3"\ntasks:\n  build:\n    cmds: [x]\n  test:\n    cmds: [y]', 'Taskfile.yml')).toEqual(['build', 'test']);
+    expect(names('version: "3"', 'Taskfile.yml')).toEqual([]);
+  });
+});
+
+describe('the package.json parser', () => {
+  test('lists every script through the RESOLVED runner', () => {
+    // The runner is not the file's own business — it is a lockfile walk — so it
+    // arrives on the context and the label is what proves it was used.
+    expect(labels('{"scripts":{"dev":"x","test":"y"}}', 'package.json', ctx({ runner: 'pnpm' }))).toEqual([
+      'pnpm run dev',
+      'pnpm run test',
+    ]);
+  });
+
+  test('falls back to bun when no runner was resolved', () => {
+    expect(labels('{"scripts":{"dev":"x"}}', 'package.json')).toEqual(['bun run dev']);
+  });
+
+  test('a file with no scripts lists nothing', () => {
+    expect(names('{"name":"x"}', 'package.json')).toEqual([]);
+  });
+
+  test('a scripts value that is not an object lists nothing', () => {
+    expect(names('{"scripts":"nope"}', 'package.json')).toEqual([]);
+  });
+});
+
+describe('the deno parser', () => {
+  test('lists tasks, and reads a file that carries comments', () => {
+    // `deno.jsonc` allows comments and trailing commas, so `JSON.parse` alone
+    // rejects a valid file — the whole reason the JSONC reader exists.
+    const text = ['{', '  // the build pipeline', '  "tasks": {', '    "build": "deno task build",', '  },', '}'].join('\n');
+    expect(labels(text, 'deno.jsonc')).toEqual(['deno task build']);
+  });
+
+  test('a comment inside a STRING is not a comment', () => {
+    // The measured failure of a naive `/\/\/.*$/`: this import map's URL lost its
+    // scheme and became `"https:`.
+    const text = '{ "imports": { "x": "https://deno.land/x/mod.ts" } }';
+    expect(JSON.parse(stripJsonComments(text))).toEqual({ imports: { x: 'https://deno.land/x/mod.ts' } });
+  });
+});
+
+describe('the pyproject parser', () => {
+  test('reads every declared task table, each with its own runner', () => {
+    const text = [
+      '[tool.poe.tasks]',
+      'build = "python -m build"',
+      '',
+      '[tool.pdm.scripts]',
+      'lint = "ruff check"',
+      '',
+      '[tool.taskipy.tasks]',
+      'test = "pytest"',
+    ].join('\n');
+    expect(labels(text, 'pyproject.toml')).toEqual(['poe build', 'pdm run lint', 'task test']);
+  });
+
+  test('a hatch env qualifies its scripts, except the default env', () => {
+    const text = ['[tool.hatch.envs.default.scripts]', 'build = "x"', '', '[tool.hatch.envs.docs.scripts]', 'serve = "y"'].join('\n');
+    expect(labels(text, 'pyproject.toml')).toEqual(['hatch run build', 'hatch run docs:serve']);
+  });
+
+  test('project.scripts is NOT read: those are installed entry points', () => {
+    // Running one requires the package installed into the environment first, so
+    // a row that fails until you have done something else is worse than no row.
+    expect(names('[project.scripts]\napp = "pkg:main"', 'pyproject.toml')).toEqual([]);
+  });
+});
+
+describe('the Pipfile parser', () => {
+  test('reads [scripts] through pipenv', () => {
+    expect(labels('[scripts]\nbuild = "python -m build"', 'Pipfile')).toEqual(['pipenv run build']);
+  });
+});
+
+describe('the Django parser', () => {
+  test('lists the framework verbs, named with the interpreter that runs them', () => {
+    const listed = labels('', 'manage.py');
+    expect(listed).toContain('python manage.py migrate');
+    expect(listed).toContain('python manage.py runserver');
+  });
+});
+
+describe('the Compose parser', () => {
+  test('lists two rows per service, not one per verb', () => {
+    const text = 'services:\n  web:\n    image: nginx\n  db:\n    image: pg';
+    expect(labels(text, 'compose.yml')).toEqual([
+      'docker compose up web',
+      'docker compose logs -f web',
+      'docker compose up db',
+      'docker compose logs -f db',
+    ]);
+  });
+
+  test('a file with no services lists nothing', () => {
+    expect(names('version: "3"', 'docker-compose.yml')).toEqual([]);
+  });
+});
+
+describe('the go parser', () => {
+  test('lists the cmd/<name> packages beside the module', () => {
+    // The only detector that reads a DIRECTORY: `go.mod` declares no commands.
+    expect(labels('module example.com/app', 'go.mod', ctx({ dirs: () => ['server', 'worker'] }))).toEqual([
+      'go run ./cmd/server',
+      'go run ./cmd/worker',
+      'go run .',
+    ]);
+  });
+
+  test('a module with no cmd/ lists nothing', () => {
+    // Usually a library: `go run .` would be a row that fails.
+    expect(names('module example.com/lib', 'go.mod')).toEqual([]);
+  });
+});
+
+describe('the cargo parser', () => {
+  test('lists cargo verbs plus every [[bin]] target', () => {
+    const text = '[package]\nname = "app"\n\n[[bin]]\nname = "server"\npath = "src/main.rs"';
+    const listed = labels(text, 'Cargo.toml');
+    expect(listed).toContain('cargo build');
+    expect(listed).toContain('cargo run --bin server');
+  });
+
+  test('reads [alias] from the cargo config, matched on the path', () => {
+    expect(labels('[alias]\nbr = "build --release"', '.cargo/config.toml')).toEqual(['cargo br']);
+  });
+});
+
+describe('the composer parser', () => {
+  test('lists scripts through composer', () => {
+    expect(labels('{"scripts":{"test":"phpunit"}}', 'composer.json')).toEqual(['composer run-script test']);
+  });
+
+  test('adds the artisan verbs only when artisan is BESIDE the composer.json', () => {
+    // Laravel is recognised by the file that IS the app's entry point, read from
+    // the directory — a `composer.json` alone could be any PHP package.
+    const text = '{"scripts":{"test":"phpunit"}}';
+    expect(labels(text, 'composer.json')).toEqual(['composer run-script test']);
+    expect(labels(text, 'composer.json', ctx({ entries: () => ['artisan'] }))).toContain('php artisan migrate');
+  });
+});
+
+describe('the Gradle and Maven parsers', () => {
+  test('prefers the committed WRAPPER over the machine PATH', () => {
+    const text = 'plugins {}';
+    expect(labels(text, 'build.gradle')).toContain('gradle build');
+    expect(labels(text, 'build.gradle', ctx({ entries: () => ['gradlew'] }))).toContain('./gradlew build');
+  });
+
+  test('Maven uses mvnw when it ships one', () => {
+    expect(labels('<project/>', 'pom.xml', ctx({ entries: () => ['mvnw'] }))).toContain('./mvnw package');
+  });
+
+  test('reads a `task <name>` declaration, which the file itself states', () => {
+    expect(labels('task integrationTest {\n}', 'build.gradle')).toContain('gradle integrationTest');
+  });
+});
+
+describe('the mix parser', () => {
+  test('reads the project aliases out of the aliases block', () => {
+    const text = ['defp aliases do', '  [', '    setup: ["deps.get"],', '    "db.reset": ["ecto.drop"]', '  ]', 'end'].join('\n');
+    expect(labels(text, 'mix.exs')).toEqual(['mix setup', 'mix db.reset']);
+  });
+
+  test('a file with no aliases lists nothing', () => {
+    expect(names('def project do\nend', 'mix.exs')).toEqual([]);
+  });
+});

package/marketplace/plugins/command-runner/src/server/detectors/js.ts

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The JavaScript / TypeScript ecosystem.
+ *
+ * `package.json` is the one source here whose commands need something the file
+ * does not carry: WHICH package manager runs them. That is `needsRunner`, and the
+ * walk lives in `scan.ts` — the detector only formats the argv.
+ *
+ * `deno.jsonc`/`deno.json` declares `tasks` the same way, but the runner is never
+ * ambiguous: `deno task` is the only thing that runs them.
+ */
+
+import { field, keys, cmd, type Detector } from './types';
+import { parseJsonc } from './jsonc';
+import type { Command } from '../../protocol';
+
+/** `package.json` scripts: every key of `scripts`, through the resolved runner. */
+function parsePackage(text: string, ctx: Parameters<Detector['parse']>[1]): Command[] {
+  const scripts = field(parseJsonc(text), 'scripts');
+  // Bun last: a runner that guessed `npm run` in a Bun repo would be wrong on the
+  // repositories this user opens most (see `package-manager.ts`).
+  const runner = ctx.runner ?? 'bun';
+  return keys(scripts).map((name) => cmd(name, [runner, 'run', name]));
+}
+
+/** `deno.jsonc` / `deno.json` tasks. */
+function parseDeno(text: string): Command[] {
+  return keys(field(parseJsonc(text), 'tasks')).map((name) => cmd(name, ['deno', 'task', name]));
+}
+
+export const JS_DETECTORS: readonly Detector[] = [
+  { kind: 'package', filenames: ['package.json'], needsRunner: true, parse: parsePackage },
+  { kind: 'deno', filenames: ['deno.jsonc', 'deno.json'], parse: parseDeno },
+];

package/marketplace/plugins/command-runner/src/server/detectors/jsonc.ts

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * JSON with comments, for `deno.jsonc`.
+ *
+ * Deno's config allows `//` and `/* *​/` comments and trailing commas, so
+ * `JSON.parse` rejects a perfectly valid file — and the failure would surface as
+ * "Could not read deno.jsonc", which reads like a broken file rather than a
+ * format this does not handle.
+ *
+ * The stripper is STRING-AWARE, and that is the whole difficulty: a naive
+ * `/\/\/.*$/gm` cuts a URL in half. `"https://deno.land/x"` would become
+ * `"https:` — measured against a real import map, where the comment regex ate
+ * the scheme. So the scan tracks whether it is inside a string, and honours
+ * backslash escapes, before it ever looks for a comment.
+ *
+ * A trailing comma is left to the caller: `JSON.parse` rejects it, and removing
+ * commas correctly means knowing they are not inside a string either — which this
+ * already tracks, so it is done here for the same reason.
+ */
+
+/** Strip `//` and comment markers outside strings, plus trailing commas. */
+export function stripJsonComments(text: string): string {
+  let out = '';
+  let inString = false;
+  let escaped = false;
+
+  for (let i = 0; i < text.length; i += 1) {
+    const char = text[i]!;
+
+    if (inString) {
+      out += char;
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') inString = false;
+      continue;
+    }
+
+    if (char === '"') {
+      inString = true;
+      out += char;
+      continue;
+    }
+
+    // A line comment runs to the end of the line, keeping the newline so the
+    // offsets a parse error reports still point at the right line.
+    if (char === '/' && text[i + 1] === '/') {
+      while (i < text.length && text[i] !== '\n') i += 1;
+      out += '\n';
+      continue;
+    }
+
+    if (char === '/' && text[i + 1] === '*') {
+      i += 2;
+      while (i < text.length && !(text[i] === '*' && text[i + 1] === '/')) i += 1;
+      i += 1; // land on the closing `/`
+      continue;
+    }
+
+    out += char;
+  }
+
+  // A trailing comma is valid JSONC and invalid JSON: drop a comma whose next
+  // non-space character closes an object or array.
+  return out.replace(/,(\s*[}\]])/g, '$1');
+}
+
+/** Parse JSON that may carry comments, falling back to plain JSON first. */
+export function parseJsonc(text: string): unknown {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return JSON.parse(stripJsonComments(text));
+  }
+}

package/marketplace/plugins/command-runner/src/server/detectors/make.ts

@@ -0,0 +1,82 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The task files: `Makefile`, `justfile`, `Taskfile.yml`.
+ *
+ * These are the sources whose parsers carry the real difficulty, because the
+ * syntax is a language rather than a document:
+ *
+ * - `.PHONY` and other dot-targets are not commands;
+ * - `SRC := a:b` is a variable assignment that CONTAINS a colon, so a bare
+ *   `^(\w+):` rule lists `SRC` as a command;
+ * - a pattern rule (`%.o: %.c`) is a rule, not a runnable target;
+ * - a `justfile`'s `set shell :=` is an assignment, and `[attributes]` is not a
+ *   recipe.
+ *
+ * Every case above appears in real files and is unit-tested by name.
+ */
+
+import { field, keys, cmd, type Detector } from './types';
+import type { Command } from '../../protocol';
+
+/** A dot-target, a pattern rule or an empty name is not a command. */
+const NOT_A_TARGET = /^\./;
+
+/** `Makefile` targets: `name:` not followed by `=`, no `%` in the name. */
+function parseMake(text: string): Command[] {
+  const out: Command[] = [];
+  const seen = new Set<string>();
+  for (const raw of text.split('\n')) {
+    // A continuation line belongs to the previous rule; skipping it here is what
+    // keeps `foo: bar \` from listing `baz:` on the next line as its own target.
+    if (raw.startsWith('\t') || raw.startsWith(' ')) continue;
+    const line = raw.trimEnd();
+    // `?=` `:=` `+=` `=` are assignments, whatever precedes them.
+    const match = /^([A-Za-z0-9._-]+)\s*:(?!=)/.exec(line);
+    if (!match) continue;
+    const name = match[1];
+    if (NOT_A_TARGET.test(name)) continue;
+    // A pattern rule (`%.o: %.c`) is a rule, not something to run by name.
+    if (name.includes('%') || line.includes('%')) continue;
+    if (seen.has(name)) continue;
+    seen.add(name);
+    out.push(cmd(name, ['make', name]));
+  }
+  return out;
+}
+
+/** `justfile` recipes: `name:` (with optional args) at column zero. */
+function parseJust(text: string): Command[] {
+  const out: Command[] = [];
+  const seen = new Set<string>();
+  for (const raw of text.split('\n')) {
+    // Indented lines are recipe BODIES; `[attributes]` and comments are not
+    // recipes either.
+    if (raw.startsWith(' ') || raw.startsWith('\t')) continue;
+    const line = raw.trim();
+    if (!line || line.startsWith('#') || line.startsWith('[')) continue;
+    // `set shell := …` and `x := y` are assignments, not recipes.
+    if (line.includes(':=')) continue;
+    const match = /^@?([A-Za-z0-9_-]+)(?:\s+[^:]*)?:\s*(?:#.*)?$/.exec(line);
+    if (!match) continue;
+    const name = match[1];
+    if (seen.has(name)) continue;
+    seen.add(name);
+    out.push(cmd(name, ['just', name]));
+  }
+  return out;
+}
+
+/** `Taskfile.yml` tasks: every key of `tasks`. */
+function parseTaskfile(text: string): Command[] {
+  return keys(field(Bun.YAML.parse(text), 'tasks')).map((name) => cmd(name, ['task', name]));
+}
+
+export const MAKE_DETECTORS: readonly Detector[] = [
+  { kind: 'make', filenames: ['Makefile', 'makefile', 'GNUmakefile'], parse: parseMake },
+  { kind: 'just', filenames: ['justfile', 'Justfile', '.justfile'], parse: parseJust },
+  { kind: 'task', filenames: ['Taskfile.yml', 'Taskfile.yaml'], parse: parseTaskfile },
+];

package/marketplace/plugins/command-runner/src/server/detectors/native.ts

@@ -0,0 +1,153 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Go, Rust, PHP, Java and Elixir.
+ *
+ * Five ecosystems with five different answers to "where are the commands", and
+ * the differences are why each is its own detector rather than one generic "look
+ * for a build file":
+ *
+ * - **Go** has no task file at all. `go.mod` proves the toolchain and the
+ *   commands are the `cmd/<name>` PACKAGES beside it, which is why this is the
+ *   only detector that reads a directory.
+ * - **Rust** is `cargo`'s own verbs plus the `[[bin]]` targets in `Cargo.toml`;
+ *   a project's own command NAMES live in `.cargo/config.toml`'s `[alias]`, which
+ *   is a second file and therefore a second row.
+ * - **PHP** is `composer.json`'s `scripts` plus Laravel's `artisan`, whose
+ *   commands are knowable only by running it.
+ * - **Java** is the Gradle or Maven wrapper, and the WRAPPER is what is read: a
+ *   repository that ships `./gradlew` wants that, not whatever `gradle` the
+ *   machine happens to have.
+ * - **Elixir** is `mix.exs`'s own `aliases`, which is where a project declares
+ *   its commands.
+ */
+
+import { join } from 'node:path';
+
+import { at, field, keys, cmd, standardVerbs, type Detector, type DetectorContext } from './types';
+import { parseJsonc } from './jsonc';
+import type { Command } from '../../protocol';
+
+/** `cargo`'s stable verbs. */
+const CARGO_VERBS = ['build', 'run', 'test', 'check', 'clippy', 'fmt', 'bench', 'doc'] as const;
+/** Laravel's `artisan` verbs: the framework's own stable set. */
+const ARTISAN_VERBS = [
+  'serve',
+  'migrate',
+  'migrate:fresh',
+  'db:seed',
+  'make:model',
+  'make:controller',
+  'make:migration',
+  'test',
+  'queue:work',
+  'tinker',
+  'route:list',
+] as const;
+/** Gradle's stable tasks. */
+const GRADLE_VERBS = ['build', 'test', 'run', 'clean', 'check', 'assemble', 'publish'] as const;
+/** Maven's. */
+const MAVEN_VERBS = ['compile', 'test', 'package', 'verify', 'install', 'clean', 'deploy'] as const;
+
+/**
+ * `go.mod`: the `cmd/<name>` packages beside it.
+ *
+ * A `main` package at the module ROOT is the other common shape and is a command
+ * too, but naming it needs each `.go` file read for `package main` — a parser for
+ * the language rather than a table row. The directory convention is what Go's own
+ * tooling documents, so that is what is read; the root is offered only alongside
+ * a `cmd/`, because a module with no `cmd/` is usually a library.
+ */
+function parseGo(text: string, ctx: DetectorContext): Command[] {
+  const moduleName = /^\s*module\s+(\S+)/m.exec(text)?.[1]?.split('/').pop() ?? '';
+  const names = ctx.dirs(join(ctx.dir, 'cmd'));
+  const out = names.map((name) => cmd(name, ['go', 'run', `./cmd/${name}`]));
+  if (names.length > 0 && moduleName) out.push(cmd(`run ${moduleName}`, ['go', 'run', '.']));
+  return out;
+}
+
+/** `Cargo.toml`: cargo's verbs, plus every `[[bin]]` target. */
+function parseCargo(text: string): Command[] {
+  const out = standardVerbs(['cargo'], CARGO_VERBS);
+  const bins = at(Bun.TOML.parse(text), ['bin']);
+  if (!Array.isArray(bins)) return out;
+  for (const entry of bins) {
+    const name = field(entry, 'name');
+    // `cargo run --bin <name>` — the project's OWN command name, so it is a row.
+    if (typeof name === 'string' && name) out.push(cmd(name, ['cargo', 'run', '--bin', name]));
+  }
+  return out;
+}
+
+/** `.cargo/config.toml`: the `[alias]` table, which is a project's own verbs. */
+function parseCargoConfig(text: string): Command[] {
+  return keys(at(Bun.TOML.parse(text), ['alias'])).map((name) => cmd(name, ['cargo', name]));
+}
+
+/** `composer.json` scripts, plus `artisan` when this is a Laravel app. */
+function parseComposer(text: string, ctx: DetectorContext): Command[] {
+  const out = keys(field(parseJsonc(text), 'scripts')).map((name) => cmd(name, ['composer', 'run-script', name]));
+  // Laravel is recognised by the file that IS the app's entry point.
+  if (ctx.entries(ctx.dir).includes('artisan')) out.push(...standardVerbs(['php', 'artisan'], ARTISAN_VERBS));
+  return out;
+}
+
+/** `artisan` alone, for an app whose `composer.json` declares no scripts. */
+function parseArtisan(): Command[] {
+  return standardVerbs(['php', 'artisan'], ARTISAN_VERBS);
+}
+
+/**
+ * `build.gradle` / `pom.xml`: the project's own WRAPPER when it ships one.
+ *
+ * A repository that commits `./gradlew` wants the wrapper — it pins the Gradle
+ * version the build was written for — so the script's presence decides the
+ * prefix rather than the machine's PATH.
+ */
+function gradleCommands(text: string, ctx: DetectorContext, kind: 'gradle' | 'maven'): Command[] {
+  const wrapper = kind === 'gradle' ? 'gradlew' : 'mvnw';
+  const hasWrapper = ctx.entries(ctx.dir).includes(wrapper);
+  const prefix = hasWrapper ? [`./${wrapper}`] : [kind === 'gradle' ? 'gradle' : 'mvn'];
+
+  if (kind === 'maven') return standardVerbs(prefix, MAVEN_VERBS);
+
+  // Gradle's own tasks are declared in the build script, but reading them
+  // honestly means RUNNING gradle. The stable set is listed instead, and the
+  // label names the wrapper so the row runs the pinned version. A `task <name>`
+  // declaration is still read, because it is a name the file itself states.
+  const declared = [...text.matchAll(/^\s*task\s+([A-Za-z0-9_-]+)/gm)].map((match) => match[1]!);
+  return [...standardVerbs(prefix, GRADLE_VERBS), ...declared.map((name) => cmd(name, [...prefix, name]))];
+}
+
+/** `mix.exs`: the project's own `aliases`. */
+function parseMix(text: string): Command[] {
+  // The file is ELIXIR CODE, so this is a regex over the `aliases do … end`
+  // block rather than an evaluation: reading a list of names is not worth
+  // executing a project's code for.
+  const block = /aliases\s+do([\s\S]*?)\n\s*end/.exec(text)?.[1];
+  if (!block) return [];
+  const out: Command[] = [];
+  for (const match of block.matchAll(/^\s*"?([A-Za-z0-9_.:]+)"?\s*:/gm)) {
+    out.push(cmd(match[1]!, ['mix', match[1]!]));
+  }
+  return out;
+}
+
+export const NATIVE_DETECTORS: readonly Detector[] = [
+  { kind: 'go', filenames: ['go.mod'], parse: parseGo },
+  { kind: 'rust', filenames: ['Cargo.toml'], parse: parseCargo },
+  // A SUFFIX match: `config.toml` alone is far too common a name to claim.
+  { kind: 'rust', filenames: [], paths: ['.cargo/config.toml'], parse: parseCargoConfig },
+  { kind: 'php', filenames: ['composer.json'], parse: parseComposer },
+  { kind: 'php', filenames: ['artisan'], parse: parseArtisan },
+  {
+    kind: 'java',
+    filenames: ['build.gradle', 'build.gradle.kts'],
+    parse: (text, ctx) => gradleCommands(text, ctx, 'gradle'),
+  },
+  { kind: 'java', filenames: ['pom.xml'], parse: (text, ctx) => gradleCommands(text, ctx, 'maven') },
+  { kind: 'elixir', filenames: ['mix.exs'], parse: parseMix },
+];