@mcoda/codali 0.1.134 → 0.1.135-codali.4

package/dist/tools/filesystem/FileTools.js

@@ -1,18 +1,36 @@
-import { promises as fs } from "node:fs";
+import { promises as fs, realpathSync } from "node:fs";
 import path from "node:path";
-const resolveWorkspacePath = (context, targetPath) => {
+const resolveWorkspacePath = async (context, targetPath) => {
     const resolved = path.resolve(context.workspaceRoot, targetPath);
     if (context.allowOutsideWorkspace) {
         return resolved;
     }
     const relative = path.relative(context.workspaceRoot, resolved);
-    if (relative.startsWith("..") || path.isAbsolute(relative)) {
+    if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
         throw new Error("Path is outside the workspace root");
     }
-    return resolved;
+    const root = await fs.realpath(context.workspaceRoot);
+    let existing = resolved;
+    const suffix = [];
+    while (true) {
+        try {
+            const real = await fs.realpath(existing);
+            const actual = path.join(real, ...suffix.reverse());
+            const rel = path.relative(root, actual);
+            if (rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel))
+                throw new Error("Symlink path is outside the workspace root");
+            return actual;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT" || existing === path.dirname(existing))
+                throw error;
+            suffix.push(path.basename(existing));
+            existing = path.dirname(existing);
+        }
+    }
 };
 const toRelative = (context, targetPath) => {
-    return path.relative(context.workspaceRoot, targetPath) || ".";
+    return path.relative(realpathSync.native(context.workspaceRoot), targetPath) || ".";
 };
 const normalizeScope = (value) => {
     const normalized = path.posix.normalize(value.replace(/\\/g, "/")).replace(/^\/+/, "");
@@ -66,10 +84,11 @@ export const createFileTools = () => {
             },
             handler: async (args, context) => {
                 const { path: target } = args;
-                const resolved = resolveWorkspacePath(context, target);
+                const resolved = await resolveWorkspacePath(context, target);
                 assertPathScope(context, resolved, context.allowedReadPaths, "read");
+                await context.checkPath?.(resolved, "read");
                 const content = await fs.readFile(resolved, "utf8");
-                return { output: content };
+                return { output: content, data: { path: toRelative(context, resolved) } };
             },
         },
         {
@@ -87,8 +106,9 @@ export const createFileTools = () => {
             },
             handler: async (args, context) => {
                 const { path: target, content } = args;
-                const resolved = resolveWorkspacePath(context, target);
+                const resolved = await resolveWorkspacePath(context, target);
                 assertPathScope(context, resolved, context.allowedWritePaths, "write");
+                await context.checkPath?.(resolved, "write");
                 await fs.mkdir(path.dirname(resolved), { recursive: true });
                 await fs.writeFile(resolved, content, "utf8");
                 if (context.recordTouchedFile) {
@@ -111,7 +131,7 @@ export const createFileTools = () => {
             },
             handler: async (args, context) => {
                 const { path: target = ".", maxDepth = 2 } = args ?? {};
-                const resolved = resolveWorkspacePath(context, target);
+                const resolved = await resolveWorkspacePath(context, target);
                 assertPathScope(context, resolved, context.allowedReadPaths, "read");
                 const entries = await listFilesRecursive(resolved, maxDepth);
                 const relativeEntries = entries.map((entry) => toRelative(context, entry));
@@ -132,7 +152,7 @@ export const createFileTools = () => {
             },
             handler: async (args, context) => {
                 const { path: target } = args;
-                const resolved = resolveWorkspacePath(context, target);
+                const resolved = await resolveWorkspacePath(context, target);
                 assertPathScope(context, resolved, context.allowedReadPaths, "read");
                 const stats = await fs.stat(resolved);
                 const info = {

package/dist/tools/shell/AsyncProcess.d.ts

@@ -0,0 +1,19 @@
+import { type ToolContext, type ToolHandlerResult } from "../ToolTypes.js";
+export declare const safeProcessEnvironment: () => NodeJS.ProcessEnv;
+/** Host executor settings, never populated from model-supplied tool arguments. */
+export interface ProcessEnvironment {
+    HOME?: string;
+    TMPDIR?: string;
+    PATH?: string;
+    CARGO_HOME?: string;
+    XDG_CACHE_HOME?: string;
+    PYTHONPYCACHEPREFIX?: string;
+    PYTHONUSERBASE?: string;
+    SDKROOT?: string;
+    DEVELOPER_DIR?: string;
+    GIT_CONFIG_NOSYSTEM?: string;
+    GIT_CONFIG_GLOBAL?: string;
+    GIT_ATTR_NOSYSTEM?: string;
+}
+export declare const runProcess: (command: string, args: string[], context: ToolContext, environment?: ProcessEnvironment) => Promise<ToolHandlerResult>;
+//# sourceMappingURL=AsyncProcess.d.ts.map

package/dist/tools/shell/AsyncProcess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AsyncProcess.d.ts","sourceRoot":"","sources":["../../../src/tools/shell/AsyncProcess.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAG/F,eAAO,MAAM,sBAAsB,QAAO,MAAM,CAAC,UAGhD,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACpG,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IACzC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACtF;AAED,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,MAAM,MAAM,EAAE,EAAE,SAAS,WAAW,EAAE,cAAa,kBAAuB,KAAG,OAAO,CAAC,iBAAiB,CAgDjJ,CAAC"}

package/dist/tools/shell/AsyncProcess.js

@@ -0,0 +1,94 @@
+import { spawn } from "node:child_process";
+import { StringDecoder } from "node:string_decoder";
+import { ToolExecutionError } from "../ToolTypes.js";
+import { resolveShellWorkingDirectory } from "./ShellWorkingDirectory.js";
+export const safeProcessEnvironment = () => Object.fromEntries(["PATH", "LANG", "LC_ALL", "LC_CTYPE", "TERM", "TZ", "TMPDIR", "SYSTEMROOT", "WINDIR", "COMSPEC", "PATHEXT"]
+    .filter(key => process.env[key] !== undefined).map(key => [key, process.env[key]]));
+export const runProcess = (command, args, context, environment = {}) => {
+    context.signal?.throwIfAborted();
+    const timeoutMs = context.shellTimeoutMs ?? 120000;
+    const maxBytes = context.shellMaxOutputBytes ?? 1048576;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || !Number.isSafeInteger(maxBytes) || maxBytes <= 0)
+        throw new Error("Invalid process limits");
+    const cwd = resolveShellWorkingDirectory(context.workspaceRoot, context.shellWorkingDirectory);
+    return new Promise((resolve, reject) => {
+        const group = process.platform !== "win32";
+        const env = safeProcessEnvironment();
+        for (const key of ["HOME", "TMPDIR", "PATH", "CARGO_HOME", "XDG_CACHE_HOME", "PYTHONPYCACHEPREFIX", "PYTHONUSERBASE", "SDKROOT", "DEVELOPER_DIR", "GIT_CONFIG_NOSYSTEM", "GIT_CONFIG_GLOBAL", "GIT_ATTR_NOSYSTEM"])
+            if (typeof environment[key] === "string")
+                env[key] = environment[key];
+        const child = spawn(command, args, { cwd, env, detached: group, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+        let stdout = "";
+        let stderr = "";
+        let captured = 0;
+        let truncated = false;
+        let timedOut = false;
+        const decoders = { stdout: new StringDecoder("utf8"), stderr: new StringDecoder("utf8") };
+        let escalation;
+        const kill = (signal) => {
+            if (!child.pid)
+                return;
+            try {
+                if (group)
+                    process.kill(-child.pid, signal);
+                else
+                    child.kill(signal);
+            }
+            catch (error) {
+                if (error.code !== "ESRCH")
+                    child.kill(signal);
+            }
+        };
+        const stop = () => { kill("SIGTERM"); escalation ?? (escalation = setTimeout(() => kill("SIGKILL"), 1000)); escalation.unref(); };
+        const timeout = setTimeout(() => { timedOut = true; stop(); }, timeoutMs);
+        const append = (stream, text) => {
+            if (stream === "stdout")
+                stdout += text;
+            else
+                stderr += text;
+            if (text) {
+                try {
+                    context.onOutput?.(stream, text);
+                }
+                catch { /* Rendering cannot abandon process cleanup. */ }
+            }
+        };
+        const collect = (stream, chunk) => {
+            const remaining = Math.max(0, maxBytes - captured);
+            if (chunk.length > remaining)
+                truncated = true;
+            const text = decoders[stream].write(chunk.subarray(0, remaining));
+            captured += Math.min(chunk.length, remaining);
+            append(stream, text);
+        };
+        child.stdout.on("data", (chunk) => collect("stdout", chunk));
+        child.stderr.on("data", (chunk) => collect("stderr", chunk));
+        context.signal?.addEventListener("abort", stop, { once: true });
+        if (context.signal?.aborted)
+            stop();
+        const cleanup = () => { clearTimeout(timeout); if (escalation)
+            clearTimeout(escalation); context.signal?.removeEventListener("abort", stop); };
+        child.once("error", error => { cleanup(); reject(error); });
+        child.once("close", (exitCode, signal) => {
+            cleanup();
+            append("stdout", decoders.stdout.end());
+            append("stderr", decoders.stderr.end());
+            if (group)
+                kill("SIGKILL");
+            const details = { command, args, cwd, exitCode, signal, stdout, stderr, truncated, timedOut };
+            if (context.signal?.aborted) {
+                reject(context.signal.reason ?? new Error("Process cancelled"));
+                return;
+            }
+            if (timedOut) {
+                reject(new ToolExecutionError("tool_timeout", "Process deadline exceeded", { retryable: false, details }));
+                return;
+            }
+            if (exitCode !== 0 || signal) {
+                reject(new ToolExecutionError("tool_execution_failed", stderr || stdout || `Process terminated (${signal ?? exitCode})`, { retryable: false, details }));
+                return;
+            }
+            resolve({ output: (stdout || stderr) + (truncated ? "\n[output truncated]" : ""), data: details });
+        });
+    });
+};

package/dist/tools/shell/DarwinRuntimeLibraries.d.ts

@@ -0,0 +1,13 @@
+import type { HostRuntimeMount } from "./HostToolchain.js";
+interface LoadCommands {
+    libraries: string[];
+    rpaths: string[];
+}
+/** Inspect installed binaries, never execute a runtime or import repository code. */
+export declare const inspectMachOLibraries: (files: string[]) => Map<string, LoadCommands>;
+export declare const parseMachOLoadCommands: (output: string, files: string[]) => Map<string, LoadCommands>;
+/** Admit only concrete native dependencies, including symlink spellings used by
+ * dyld. Never grant a package-manager prefix, home, or arbitrary library folder. */
+export declare const discoverDarwinRuntimeLibraries: (executable: string, extensionFiles: string[], workspace: string, home: string, inspect?: (files: string[]) => Map<string, LoadCommands>) => HostRuntimeMount[];
+export {};
+//# sourceMappingURL=DarwinRuntimeLibraries.d.ts.map

package/dist/tools/shell/DarwinRuntimeLibraries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DarwinRuntimeLibraries.d.ts","sourceRoot":"","sources":["../../../src/tools/shell/DarwinRuntimeLibraries.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,UAAU,YAAY;IAAG,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;CAAE;AAIjE,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,GAAI,OAAO,MAAM,EAAE,KAAG,GAAG,CAAC,MAAM,EAAE,YAAY,CAM/E,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,EAAE,KAAG,GAAG,CAAC,MAAM,EAAE,YAAY,CAoBhG,CAAC;AAUF;oFACoF;AACpF,eAAO,MAAM,8BAA8B,GACzC,YAAY,MAAM,EAAE,gBAAgB,MAAM,EAAE,EAAE,WAAW,MAAM,EAAE,MAAM,MAAM,EAC7E,UAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,MAAM,EAAE,YAAY,CAAyB,KAC9E,gBAAgB,EAiDlB,CAAC"}

package/dist/tools/shell/DarwinRuntimeLibraries.js

@@ -0,0 +1,130 @@
+import { closeSync, openSync, readSync, realpathSync, statSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+const within = (file, root) => file === root || file.startsWith(`${root}${path.sep}`);
+const systemLibrary = (file) => within(file, "/usr/lib") || within(file, "/System");
+/** Inspect installed binaries, never execute a runtime or import repository code. */
+export const inspectMachOLibraries = (files) => {
+    const result = spawnSync("/usr/bin/otool", ["-l", ...files], {
+        cwd: os.tmpdir(), env: { PATH: "/usr/bin:/bin" }, timeout: 3000, maxBuffer: 4 * 1024 * 1024, encoding: "utf8",
+    });
+    if (result.status !== 0)
+        throw new Error("Cannot inspect installed runtime libraries");
+    return parseMachOLoadCommands(result.stdout, files);
+};
+export const parseMachOLoadCommands = (output, files) => {
+    const allowed = new Set(files);
+    const result = new Map();
+    let current;
+    let command = "";
+    for (const line of output.split("\n")) {
+        if (!/^\s/.test(line) && line.endsWith(":")) {
+            const file = line.slice(0, -1).replace(/ \(architecture [^)]+\)$/, "");
+            current = allowed.has(file) ? result.get(file) ?? { libraries: [], rpaths: [] } : undefined;
+            if (current)
+                result.set(file, current);
+            command = "";
+        }
+        else if (/^Load command \d+$/.test(line))
+            command = "";
+        else if (current) {
+            const kind = line.match(/^\s+cmd (LC_[A-Z_]+)\s*$/);
+            if (kind)
+                command = kind[1];
+            const value = line.match(/^\s+(?:name|path) (.+) \(offset \d+\)\s*$/)?.[1];
+            if (value && command === "LC_RPATH")
+                current.rpaths.push(value);
+            else if (value && ["LC_LOAD_DYLIB", "LC_LOAD_WEAK_DYLIB", "LC_REEXPORT_DYLIB", "LC_LOAD_UPWARD_DYLIB"].includes(command))
+                current.libraries.push(value);
+        }
+    }
+    if (files.some(file => !result.has(file)))
+        throw new Error("Incomplete runtime library inspection");
+    return result;
+};
+const nativeFile = (file) => {
+    if (!statSync(file).isFile())
+        return false;
+    const fd = openSync(file, "r");
+    const header = Buffer.alloc(4);
+    try {
+        if (readSync(fd, header, 0, 4, 0) !== 4)
+            return false;
+    }
+    finally {
+        closeSync(fd);
+    }
+    return ["feedface", "feedfacf", "cefaedfe", "cffaedfe", "cafebabe", "bebafeca", "cafebabf", "bfbafeca"].includes(header.toString("hex"));
+};
+/** Admit only concrete native dependencies, including symlink spellings used by
+ * dyld. Never grant a package-manager prefix, home, or arbitrary library folder. */
+export const discoverDarwinRuntimeLibraries = (executable, extensionFiles, workspace, home, inspect = inspectMachOLibraries) => {
+    const mounts = new Map();
+    const visited = new Set();
+    const initial = [...new Set([executable, ...extensionFiles])];
+    const safe = (file) => {
+        if (!path.isAbsolute(file) || /[\r\n\0]/.test(file))
+            throw new Error("Invalid runtime library path");
+        const resolved = realpathSync(file);
+        if (within(file, workspace) || within(resolved, workspace) || resolved === home || !nativeFile(resolved)) {
+            throw new Error("Runtime library is not an installed native file");
+        }
+        return resolved;
+    };
+    let pending = initial.map(file => ({ file: safe(file), inherited: [] }));
+    let executableRpaths = [];
+    const expand = (value, loader) => {
+        if (value === "@loader_path")
+            return path.dirname(loader);
+        if (value === "@executable_path")
+            return path.dirname(executable);
+        if (value.startsWith("@loader_path/"))
+            return path.resolve(path.dirname(loader), value.slice(13));
+        if (value.startsWith("@executable_path/"))
+            return path.resolve(path.dirname(executable), value.slice(17));
+        return path.isAbsolute(value) ? path.normalize(value) : undefined;
+    };
+    for (let depth = 0; pending.length; depth++) {
+        if (depth >= 12 || visited.size + pending.length > 256)
+            throw new Error("Runtime library graph exceeds discovery limit");
+        const files = [...new Set(pending.map(item => item.file))];
+        const inspected = inspect(files);
+        const next = [];
+        for (const { file, inherited } of pending) {
+            if (visited.has(file))
+                continue;
+            visited.add(file);
+            const info = inspected.get(file);
+            if (!info)
+                throw new Error("Missing runtime library metadata");
+            const rpaths = info.rpaths.map(value => expand(value, file)).filter((value) => value !== undefined);
+            if (file === executable)
+                executableRpaths = rpaths;
+            const searchRoots = [...rpaths, ...inherited, ...executableRpaths];
+            for (const library of info.libraries) {
+                const candidates = library.startsWith("@rpath/") ? searchRoots.map(root => path.resolve(root, library.slice(7))) : [expand(library, file)];
+                for (const candidate of candidates) {
+                    if (!candidate)
+                        continue;
+                    if (systemLibrary(candidate))
+                        break; // May exist only in the system dyld cache.
+                    let resolved;
+                    try {
+                        resolved = safe(candidate);
+                    }
+                    catch {
+                        continue;
+                    } // Missing optional libraries stay inaccessible.
+                    for (const alias of [candidate, resolved])
+                        mounts.set(alias, { readOnlyRoot: alias, directory: false });
+                    if (!visited.has(resolved) && !next.some(item => item.file === resolved))
+                        next.push({ file: resolved, inherited: searchRoots });
+                    break;
+                }
+            }
+        }
+        pending = next;
+    }
+    return [...mounts.values()];
+};

package/dist/tools/shell/HostToolchain.d.ts

@@ -0,0 +1,19 @@
+export interface HostRuntimeMount {
+    readOnlyRoot: string;
+    directory: boolean;
+}
+export interface HostRuntime extends HostRuntimeMount {
+    name: string;
+    executable: string;
+    support?: HostRuntimeMount[];
+    environment?: {
+        SDKROOT: string;
+        DEVELOPER_DIR: string;
+    };
+}
+/** Discover known user-installed language tools. The workspace can neither
+ * supply this PATH nor turn its own package.json into a trusted runtime mount.
+ * Mounts are single binaries or matching package roots, never the user's home. */
+export declare const discoverHostToolchain: (workspaceRoot: string, searchPath?: string) => HostRuntime[];
+export declare const extraRuntimeMounts: (runtimes: HostRuntime[]) => HostRuntimeMount[];
+//# sourceMappingURL=HostToolchain.d.ts.map

package/dist/tools/shell/HostToolchain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HostToolchain.d.ts","sourceRoot":"","sources":["../../../src/tools/shell/HostToolchain.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,gBAAgB;IAAG,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;CAAE;AAC/E,MAAM,WAAW,WAAY,SAAQ,gBAAgB;IACnD,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC/D,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAkID;;kFAEkF;AAClF,eAAO,MAAM,qBAAqB,GAAI,eAAe,MAAM,EAAE,mBAAmC,KAAG,WAAW,EA0D7G,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,UAAU,WAAW,EAAE,KAAG,gBAAgB,EAM5E,CAAC"}

package/dist/tools/shell/HostToolchain.js

@@ -0,0 +1,266 @@
+import { accessSync, closeSync, constants, existsSync, openSync, readFileSync, readdirSync, readSync, realpathSync, statSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { discoverDarwinRuntimeLibraries } from "./DarwinRuntimeLibraries.js";
+const packages = { npm: ["npm"], pnpm: ["pnpm", "@pnpm/exe"], yarn: ["yarn", "@yarnpkg/cli", "@yarnpkg/cli-dist"] };
+const within = (file, root) => file === root || file.startsWith(`${root}${path.sep}`);
+const systemPath = (file) => ["/usr", "/bin", "/sbin", "/System"].some(root => within(file, root));
+const executableBinary = (file) => {
+    const fd = openSync(file, "r");
+    const bytes = Buffer.alloc(4);
+    try {
+        if (readSync(fd, bytes, 0, 4, 0) !== 4)
+            return false;
+    }
+    finally {
+        closeSync(fd);
+    }
+    return ["7f454c46", "feedface", "feedfacf", "cefaedfe", "cffaedfe", "cafebabe", "bebafeca", "cafebabf", "bfbafeca"].includes(bytes.toString("hex"));
+};
+const rustTools = new Set(["cargo", "rustc", "rustdoc"]);
+/** Resolve a rustup proxy without executing it or consulting repository overrides.
+ * Only an already-installed, host-selected toolchain can become a runtime mount. */
+const resolveRustProxy = (name, executable, home) => {
+    if (!rustTools.has(name))
+        return executable;
+    let proxy = path.basename(executable) === "rustup";
+    if (!proxy && existsSync(path.join(path.dirname(executable), "rustup"))) {
+        const actual = statSync(executable);
+        const rustup = statSync(path.join(path.dirname(executable), "rustup"));
+        proxy = actual.dev === rustup.dev && actual.ino === rustup.ino;
+        // Some installers copy proxies instead of linking them. Compare all bytes;
+        // a filename or matching binary header alone does not identify rustup.
+        if (!proxy && actual.size === rustup.size && actual.size <= 64 * 1024 * 1024) {
+            const digest = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
+            proxy = digest(executable) === digest(path.join(path.dirname(executable), "rustup"));
+        }
+    }
+    if (!proxy && statSync(executable).size <= 16384 && !executableBinary(executable)) {
+        // Package managers may wrap rustup in a small shell script. Do not execute
+        // it: identify the adjacent native libexec proxies, then select host state.
+        const packageRoot = path.dirname(path.dirname(executable));
+        const nativeProxy = path.join(packageRoot, "libexec", "bin", name);
+        const nativeRustup = path.join(packageRoot, "libexec", "bin", "rustup");
+        if (existsSync(nativeProxy) && existsSync(nativeRustup)
+            && within(realpathSync.native(nativeProxy), packageRoot) && within(realpathSync.native(nativeRustup), packageRoot)
+            && executableBinary(nativeRustup)) {
+            const target = statSync(nativeProxy);
+            const manager = statSync(nativeRustup);
+            proxy = target.dev === manager.dev && target.ino === manager.ino;
+            if (!proxy && target.size === manager.size && target.size <= 64 * 1024 * 1024) {
+                const digest = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
+                proxy = digest(nativeProxy) === digest(nativeRustup);
+            }
+        }
+    }
+    if (!proxy)
+        return executable;
+    const rustup = process.env.RUSTUP_HOME ?? path.join(home, ".rustup");
+    if (!path.isAbsolute(rustup))
+        throw new Error("Rustup home must be absolute");
+    const settings = path.join(rustup, "settings.toml");
+    const configured = process.env.RUSTUP_TOOLCHAIN || (statSync(settings).size <= 16384
+        ? readFileSync(settings, "utf8").match(/^default_toolchain\s*=\s*"([A-Za-z0-9_.-]+)"\s*$/m)?.[1] : undefined);
+    if (!configured || !/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(configured))
+        throw new Error("No installed host Rust toolchain selected");
+    const toolchains = path.join(rustup, "toolchains");
+    const matches = existsSync(path.join(toolchains, configured)) ? [configured]
+        : readdirSync(toolchains).filter(entry => entry.startsWith(`${configured}-`));
+    if (matches.length !== 1)
+        throw new Error("Rust toolchain selection is unavailable or ambiguous");
+    const root = realpathSync.native(path.join(toolchains, matches[0]));
+    const target = realpathSync.native(path.join(root, "bin", name));
+    if (!within(target, root))
+        throw new Error("Rust tool executable escapes selected toolchain");
+    return target;
+};
+const languageRuntime = (name, executable, workspace, home) => {
+    if (!executableBinary(executable) || path.basename(path.dirname(executable)) !== "bin")
+        return undefined;
+    const prefix = path.dirname(path.dirname(executable));
+    if (prefix === home || within(workspace, prefix) || within(prefix, workspace) || prefix === path.parse(prefix).root)
+        return undefined;
+    const runtime = { name, executable, readOnlyRoot: executable, directory: false, support: [] };
+    const add = (file) => {
+        const resolved = realpathSync.native(file);
+        if (!within(resolved, prefix))
+            throw new Error("Runtime support path escapes installation");
+        runtime.support.push({ readOnlyRoot: resolved, directory: statSync(resolved).isDirectory() });
+    };
+    if (rustTools.has(name)) {
+        const library = path.join(prefix, "lib");
+        if (!readdirSync(path.join(library, "rustlib")).some(file => /^manifest-rustc(?:-|$)/.test(file)))
+            return undefined;
+        add(library);
+        return runtime;
+    }
+    if (name === "python" || name === "python3") {
+        let standardLibrary = false;
+        const extensions = [];
+        for (const lib of ["lib", "lib64"]) {
+            const directory = path.join(prefix, lib);
+            if (!existsSync(directory))
+                continue;
+            for (const entry of readdirSync(directory)) {
+                const file = path.join(directory, entry);
+                if (/^python3\.\d+t?$/.test(entry) && existsSync(path.join(file, "os.py")) && existsSync(path.join(file, "encodings", "__init__.py"))) {
+                    add(file);
+                    standardLibrary = true;
+                    const dynamic = path.join(file, "lib-dynload");
+                    if (process.platform === "darwin" && existsSync(dynamic)) {
+                        for (const entry of readdirSync(dynamic).filter(entry => /\.(?:so|dylib)$/.test(entry))) {
+                            const extension = realpathSync.native(path.join(dynamic, entry));
+                            if (!within(extension, prefix))
+                                throw new Error("Python extension escapes installation");
+                            extensions.push(extension);
+                        }
+                    }
+                }
+                else if (/^libpython3\.\d+t?(?:\.so(?:\.[\d.]+)?|(?:\.\d+)*\.dylib)$/.test(entry))
+                    add(file);
+            }
+        }
+        if (standardLibrary && process.platform === "darwin")
+            runtime.support.push(...discoverDarwinRuntimeLibraries(executable, extensions, workspace, home));
+        return standardLibrary ? runtime : undefined;
+    }
+    return undefined;
+};
+/** xcrun only locates installed host tools here; it never compiles repository code.
+ * Mount the selected developer installation, not /Applications or a user's home. */
+const darwinDeveloperTools = (workspace, home) => {
+    if (process.platform !== "darwin")
+        return [];
+    try {
+        const environment = { PATH: "/usr/bin:/bin", ...(process.env.DEVELOPER_DIR ? { DEVELOPER_DIR: process.env.DEVELOPER_DIR } : {}) };
+        const query = (command, args) => {
+            const result = spawnSync(command, args, { env: environment, cwd: os.tmpdir(), timeout: 3000, encoding: "utf8", maxBuffer: 16384 });
+            if (result.status !== 0)
+                throw new Error("Developer tool lookup failed");
+            return realpathSync.native(result.stdout.trim());
+        };
+        const developer = realpathSync.native(process.env.DEVELOPER_DIR ?? query("/usr/bin/xcode-select", ["--print-path"]));
+        if (developer === home || developer === path.parse(developer).root || within(workspace, developer) || within(developer, workspace))
+            return [];
+        const sdk = query("/usr/bin/xcrun", ["--sdk", "macosx", "--show-sdk-path"]);
+        if (!within(sdk, developer) || !existsSync(path.join(sdk, "SDKSettings.plist")))
+            return [];
+        // /usr/bin/git is an Apple launcher that may invoke xcodebuild and inspect
+        // files outside Developer. Select native Git within the same trusted root.
+        return ["cc", "ar", "git"].map(name => {
+            const executable = query("/usr/bin/xcrun", ["--find", name === "cc" ? "clang" : name]);
+            if (!within(executable, developer) || !executableBinary(executable))
+                throw new Error("Developer tool escapes selected installation");
+            return { name, executable, readOnlyRoot: developer, directory: true, environment: { SDKROOT: sdk, DEVELOPER_DIR: developer } };
+        });
+    }
+    catch {
+        return [];
+    }
+};
+/** Discover known user-installed language tools. The workspace can neither
+ * supply this PATH nor turn its own package.json into a trusted runtime mount.
+ * Mounts are single binaries or matching package roots, never the user's home. */
+export const discoverHostToolchain = (workspaceRoot, searchPath = process.env.PATH ?? "") => {
+    const workspace = realpathSync.native(workspaceRoot);
+    const home = realpathSync.native(os.homedir());
+    const result = darwinDeveloperTools(workspace, home);
+    for (const name of ["node", "npm", "pnpm", "yarn", "bun", "python3", "python", "rustc", "cargo", "rustdoc", "cc", "ar"]) {
+        if (result.some(runtime => runtime.name === name))
+            continue;
+        const candidates = name === "node" ? [process.execPath] : searchPath.split(path.delimiter).filter(Boolean).map(directory => path.resolve(directory, name));
+        for (const candidate of candidates) {
+            try {
+                let executable = realpathSync.native(candidate);
+                if (within(candidate, workspace) || within(executable, workspace))
+                    continue;
+                executable = resolveRustProxy(name, executable, home);
+                if (within(executable, workspace))
+                    continue;
+                accessSync(executable, constants.X_OK);
+                if (!statSync(executable).isFile())
+                    continue;
+                if (systemPath(executable)) {
+                    result.push({ name, executable, readOnlyRoot: executable, directory: false });
+                    break;
+                }
+                if (rustTools.has(name) || name === "python" || name === "python3") {
+                    const runtime = languageRuntime(name, executable, workspace, home);
+                    if (runtime) {
+                        result.push(runtime);
+                        break;
+                    }
+                    continue;
+                }
+                if (executableBinary(executable)) {
+                    result.push({ name, executable, readOnlyRoot: executable, directory: false });
+                    break;
+                }
+                // Package managers also install .bin shell shims. Never execute the shim:
+                // select the known adjacent package's declared JS entry point, which is
+                // validated by the same package-root checks as a normal symlink below.
+                if (packages[name] && path.basename(path.dirname(candidate)) === ".bin" && !/\.[cm]?js$/.test(executable)) {
+                    for (const packageName of packages[name]) {
+                        try {
+                            const packageRoot = realpathSync.native(path.resolve(path.dirname(candidate), "..", packageName));
+                            if (within(packageRoot, workspace) || within(workspace, packageRoot) || packageRoot === home)
+                                continue;
+                            const manifest = path.join(packageRoot, "package.json");
+                            if (statSync(manifest).size > 65536)
+                                continue;
+                            const metadata = JSON.parse(readFileSync(manifest, "utf8"));
+                            const bin = typeof metadata.bin === "string" ? metadata.bin : metadata.bin?.[name];
+                            if (metadata.name !== packageName || !bin)
+                                continue;
+                            const target = realpathSync.native(path.resolve(packageRoot, bin));
+                            if (!within(target, packageRoot) || !/\.[cm]?js$/.test(target) || !statSync(target).isFile())
+                                continue;
+                            accessSync(target, constants.X_OK);
+                            executable = target;
+                            break;
+                        }
+                        catch { /* Another allowed package layout may exist. */ }
+                    }
+                }
+                if (!packages[name] || !/\.[cm]?js$/.test(executable))
+                    continue;
+                let directory = path.dirname(executable);
+                let matched;
+                for (let depth = 0; depth < 6 && directory !== path.parse(directory).root && directory !== home; depth++, directory = path.dirname(directory)) {
+                    if (within(workspace, directory) || within(directory, workspace))
+                        break;
+                    const manifest = path.join(directory, "package.json");
+                    if (!existsSync(manifest))
+                        continue;
+                    if (statSync(manifest).size > 65536)
+                        break;
+                    const metadata = JSON.parse(readFileSync(manifest, "utf8"));
+                    if (!metadata.name || !packages[name].includes(metadata.name))
+                        break;
+                    const bin = typeof metadata.bin === "string" ? metadata.bin : metadata.bin?.[name];
+                    if (!bin || realpathSync.native(path.resolve(directory, bin)) !== executable)
+                        break;
+                    matched = { name, executable, readOnlyRoot: directory, directory: true };
+                    break;
+                }
+                if (matched) {
+                    result.push(matched);
+                    break;
+                }
+            }
+            catch { /* An unavailable or unverified candidate is not mounted. */ }
+        }
+    }
+    return result;
+};
+export const extraRuntimeMounts = (runtimes) => {
+    const mounts = new Map();
+    for (const runtime of runtimes)
+        for (const mount of [runtime, ...runtime.support ?? []]) {
+            if (!systemPath(mount.readOnlyRoot))
+                mounts.set(mount.readOnlyRoot, mount);
+        }
+    return [...mounts.values()];
+};