@opengsd/gsd-core 1.9.1 → 1.11.0

package/gsd-core/bin/lib/core-utils.cjs

@@ -23,7 +23,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdModule = require("./phase-id.cjs");
-const { comparePhaseNum } = phaseIdModule;
+const { comparePhaseNum, scopeToPhase } = phaseIdModule;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
 const { findContextMdIn } = planningWorkspace;
@@ -72,17 +72,30 @@ function extractOneLinerFromBody(content) {
     if (!content)
         return null;
     const normalized = content.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
-    const body = normalized.replace(/^---\n[\s\S]*?\n---\n*/, '');
-    const match = body.match(/^#[^\n]*\n+\*\*([^*\n]+)\*\*([^\n]*)/m);
-    if (!match)
-        return null;
-    const boldInner = match[1].trim();
-    const afterBold = match[2];
-    if (/:\s*$/.test(boldInner)) {
-        const prose = afterBold.trim();
-        return prose.length > 0 ? prose : null;
+    const body = normalized.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n*/, '');
+    // #3170: anchor to a summary-shaped heading (Summary / Overview /
+    // Accomplishments) so an incidental first heading (a rule list, task
+    // breakdown, deviation note) does not contribute its first bold run as the
+    // deliverable one-liner. Iterate headings in document order and extract from
+    // the first summary-shaped one that has a bold run; fall back to null (not the
+    // wrong text) when no such heading exists.
+    const headingRe = /^#+\s*([^\n]*)\n+\*\*([^*\n]+)\*\*([^\n]*)/gm;
+    let match;
+    while ((match = headingRe.exec(body)) !== null) {
+        if (!/summary|overview|accomplish/i.test(match[1]))
+            continue;
+        const boldInner = match[2].trim();
+        const afterBold = match[3];
+        if (/:\s*$/.test(boldInner)) {
+            const prose = afterBold.trim();
+            if (prose.length > 0)
+                return prose;
+        }
+        else if (boldInner.length > 0) {
+            return boldInner;
+        }
     }
-    return boldInner.length > 0 ? boldInner : null;
+    return null;
 }
 // ─── Misc utilities ───────────────────────────────────────────────────────────
 function pathExistsInternal(cwd, targetPath) {
@@ -98,29 +111,119 @@ function pathExistsInternal(cwd, targetPath) {
 function generateSlugInternal(text) {
     if (!text)
         return null;
-    return text.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').substring(0, 60);
-}
-// ─── Phase file helpers ──────────────────────────────────────────────────────
-/** Filter a file list to just PLAN.md / *-PLAN.md entries. */
-function filterPlanFiles(files) {
-    return files.filter(f => f.endsWith('-PLAN.md') || f === 'PLAN.md');
+    // #2849: strip leading/trailing hyphens AFTER truncation, not only before.
+    // .substring(0, 60) can land on a separator, re-introducing a trailing hyphen
+    // the strip step exists to prevent. Truncation cannot add a leading hyphen, so
+    // running the full ^-+|-+$ pass last is equivalent for leading hyphens and
+    // fixes the trailing-hyphen-after-truncation case.
+    return transliterateForSlug(text).replace(/[^a-z0-9]+/g, '-').substring(0, 60).replace(/^-+|-+$/g, '');
 }
-/** Filter a file list to just SUMMARY.md / *-SUMMARY.md entries. */
-function filterSummaryFiles(files) {
-    return files.filter(f => f.endsWith('-SUMMARY.md') || f === 'SUMMARY.md');
+// ─── Transliteration (#2848) ─────────────────────────────────────────────────
+//
+// Non-Latin titles used to reduce to an empty slug: the `[^a-z0-9]+` strip
+// removed every character of an all-Cyrillic title and the hyphen cleanup left
+// "". Callers then created unnamed phase directories (`01-`) and empty
+// `milestone_slug` init JSON. The fix transliterates Cyrillic to ASCII BEFORE
+// the existing ASCII filter, so a non-Latin title yields a usable ASCII slug
+// while Latin-script text (which hits zero map entries) is byte-for-byte
+// unchanged — the negative control is satisfied by construction.
+//
+// Multi-letter mappings (ж→zh, ч→ch, ш→sh, щ→sch, ю→yu, я→ya) are applied as a
+// single pass; soft/hard signs (ъ, ь) drop to nothing rather than a hyphen.
+// Scope is Cyrillic (Russian + the reported Ukrainian/Belarusian extras
+// і ї є ґ ў) per the issue's confirmed-working patch. CJK and other
+// non-transliterated scripts keep the existing strip-to-ASCII behavior.
+const CYRILLIC_TRANSLITERATION = {
+    // multi-letter first (longest-match-safe within a single pass via ordered keys)
+    а: 'a', б: 'b', в: 'v', г: 'g', д: 'd', е: 'e', ё: 'e', ж: 'zh',
+    з: 'z', и: 'i', й: 'y', к: 'k', л: 'l', м: 'm', н: 'n', о: 'o',
+    п: 'p', р: 'r', с: 's', т: 't', у: 'u', ф: 'f', х: 'h', ц: 'ts',
+    ч: 'ch', ш: 'sh', щ: 'sch', ъ: '', ы: 'y', ь: '', э: 'e', ю: 'yu',
+    я: 'ya',
+    // Ukrainian / Belarusian extras reported in #2848
+    є: 'ye', і: 'i', ї: 'yi', ґ: 'g', ў: 'u',
+};
+const CYRILLIC_TRANSLITERATION_KEYS = Object.keys(CYRILLIC_TRANSLITERATION);
+/**
+ * Lowercase + transliterate Cyrillic characters to ASCII. The output still
+ * contains non-ASCII for scripts outside the map (CJK, etc.) — the caller's
+ * existing `[^a-z0-9]+` filter handles those. Latin-script input is returned
+ * lowercased with no other change.
+ *
+ * Shared by `generateSlugInternal` (core-utils) and `slugify` (gsd2-import) so
+ * the transliteration step is not duplicated across the two slug helpers (#2848
+ * explicitly requires both be fixed).
+ */
+function transliterateForSlug(text) {
+    const lowered = text.toLowerCase();
+    let out = '';
+    for (const ch of lowered) {
+        out += CYRILLIC_TRANSLITERATION_KEYS.includes(ch)
+            ? CYRILLIC_TRANSLITERATION[ch]
+            : ch;
+    }
+    return out;
 }
 /**
  * Read a phase directory and return counts/flags for common file types.
+ *
+ * #3183 (ADR-3180 Decision 2): `plans`/`summaries` are derived from the
+ * canonical `scanPhasePlans` rather than a local re-derivation, so this
+ * primitive can no longer diverge from the single owner of live-plan
+ * counting. `scanPhasePlans`
+ * lives in plan-scan.cjs, which itself imports `countMatchedSummaries` from
+ * THIS module — a top-level import here would be circular, so the require
+ * is deferred (lazy, inside the function body) to break the cycle at load
+ * time. This mirrors the lazy-require seam already used elsewhere in this
+ * repo (see src/audit-command-router.cts) for the same "module A needs
+ * module B which needs module A" shape.
+ *
+ * `hasResearch`/`hasContext`/`hasVerification`/`hasReviews` stay on the raw
+ * `readdirSync` listing — they are not plan-scan concerns.
+ *
+ * #3511 BLOCKER-2: the raw listing is scoped through `scopeToPhase` (keyed on
+ * `path.basename(phaseDir)`) before any of the four artifact predicates run,
+ * so a stray cross-phase file (e.g. `04-VERIFICATION.md` sitting inside phase
+ * 03's directory) cannot flip `hasResearch`/`hasContext`/`hasVerification`/
+ * `hasReviews` true for a phase it does not belong to — the same membership
+ * rule every other aggregate phase-directory scan (`uat.cts`, `audit.cts`,
+ * `phase.cts`, `state.cts`) already routes through. `hasContext` is scoped by
+ * passing the already-scoped array into `findContextMdIn` at this call site
+ * only — `findContextMdIn` itself is unchanged and its other 4 call sites
+ * (roadmap.cts, gap-checker.cts, init.cts) are unaffected.
+ *
+ * Degrades on an unreadable directory instead of throwing: empty arrays,
+ * every flag false, scope UNREADABLE (mirroring scanPhasePlans's own
+ * degrade path).
  */
 function getPhaseFileStats(phaseDir) {
-    const files = node_fs_1.default.readdirSync(phaseDir);
+    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+    const scanPhasePlans = require('./plan-scan.cjs');
+    const scan = scanPhasePlans(phaseDir);
+    let files;
+    try {
+        files = node_fs_1.default.readdirSync(phaseDir);
+    }
+    catch {
+        return {
+            plans: scan.planFiles,
+            summaries: scan.summaryFiles,
+            hasResearch: false,
+            hasContext: false,
+            hasVerification: false,
+            hasReviews: false,
+            scope: scan.scope,
+        };
+    }
+    const scopedFiles = scopeToPhase(files, node_path_1.default.basename(phaseDir));
     return {
-        plans: filterPlanFiles(files),
-        summaries: filterSummaryFiles(files),
-        hasResearch: files.some(f => f.endsWith('-RESEARCH.md') || f === 'RESEARCH.md'),
-        hasContext: findContextMdIn(files) !== null,
-        hasVerification: files.some(f => f.endsWith('-VERIFICATION.md') || f === 'VERIFICATION.md'),
-        hasReviews: files.some(f => f.endsWith('-REVIEWS.md') || f === 'REVIEWS.md'),
+        plans: scan.planFiles,
+        summaries: scan.summaryFiles,
+        hasResearch: scopedFiles.some(f => f.endsWith('-RESEARCH.md') || f === 'RESEARCH.md'),
+        hasContext: findContextMdIn(scopedFiles) !== null,
+        hasVerification: scopedFiles.some(f => f.endsWith('-VERIFICATION.md') || f === 'VERIFICATION.md'),
+        hasReviews: scopedFiles.some(f => f.endsWith('-REVIEWS.md') || f === 'REVIEWS.md'),
+        scope: scan.scope,
     };
 }
 /**
@@ -222,32 +325,106 @@ function countMatchedSummaries(planFiles, summaryFiles) {
     const summarySet = new Set(summaryFiles);
     let matched = 0;
     for (const plan of planFiles) {
-        const slashIdx = plan.lastIndexOf('/');
-        const dir = slashIdx >= 0 ? plan.slice(0, slashIdx + 1) : '';
-        const base = (dir ? plan.slice(dir.length) : plan).replace(/\.md$/i, '');
-        const candidates = [
-            dir + base.replace(/PLAN/i, 'SUMMARY') + '.md',
-            dir + base + '-SUMMARY.md',
-        ];
-        const extended = base.match(/^(\d+)-PLAN-(\d+)/i);
-        if (extended)
-            candidates.push(dir + extended[1] + '-' + extended[2] + '-SUMMARY.md');
-        if (candidates.some((c) => summarySet.has(c)))
+        if (summaryCandidates(plan).some((c) => summarySet.has(c)))
             matched++;
     }
     return matched;
 }
+/**
+ * The candidate `*-SUMMARY.md` filenames a single plan's completion record
+ * could take, per the three naming conventions documented above
+ * `countMatchedSummaries`. Extracted so `findUnsummarizedPlans` can reuse the
+ * exact same matching rule without duplicating it (a divergence between the
+ * count and the list would let a plan be counted as matched while still
+ * appearing in the unsummarized set, or vice versa).
+ */
+function summaryCandidates(plan) {
+    const slashIdx = plan.lastIndexOf('/');
+    const dir = slashIdx >= 0 ? plan.slice(0, slashIdx + 1) : '';
+    const base = (dir ? plan.slice(dir.length) : plan).replace(/\.md$/i, '');
+    const candidates = [
+        dir + base.replace(/PLAN/i, 'SUMMARY') + '.md',
+        dir + base + '-SUMMARY.md',
+    ];
+    const extended = base.match(/^(\d+)-PLAN-(\d+)/i);
+    if (extended)
+        candidates.push(dir + extended[1] + '-' + extended[2] + '-SUMMARY.md');
+    // #3183: canonical-id form. Restores the coverage of the pre-migration
+    // bespoke I001 rule (verify.cts, pre-#3183, via validate.cjs's now-unused
+    // `canonicalPlanStem` — behaviourally identical to `extractCanonicalPlanId`,
+    // confirmed empirically), which matched a plan carrying a descriptive slug
+    // after its <phase>-<plan> id — e.g. `68-01-scaffolding-PLAN.md` — against
+    // a summary named only by the bare id — `68-01-SUMMARY.md`. None of the
+    // three candidates above produce that filename.
+    //
+    // Narrowed to the case `extractCanonicalPlanId` actually extracted an
+    // <id>-<id> pair (its result differs from the plan's own PLAN-stripped
+    // base). When no pair is found it falls back to returning that same base
+    // unchanged, which would otherwise push a redundant candidate identical to
+    // the `<stem>-SUMMARY.md` form above (e.g. `setup-PLAN.md` -> canonical
+    // 'setup' -> 'setup-SUMMARY.md', already candidate #2) rather than the
+    // original rule's actual behavior of matching only real id pairs.
+    //
+    // Collision, matching the original rule byte-for-behaviour: two plans that
+    // share the same <phase>-<plan> id but differ only in their descriptive
+    // slug (`68-01-alpha-PLAN.md` + `68-01-beta-PLAN.md`) both generate the
+    // SAME candidate `68-01-SUMMARY.md` and therefore BOTH read as summarized
+    // off one shared summary file. This is not a new regression: the
+    // pre-migration bespoke rule collapsed the same way (it populated one
+    // `summaryBases` Set keyed by canonical stem, so any plan whose canonical
+    // stem hit the set counted as matched, with no cardinality check against
+    // how many plans shared that stem).
+    const planStem = base.replace(/-PLAN$/i, '');
+    const canonicalId = extractCanonicalPlanId(base + '.md');
+    if (canonicalId !== planStem)
+        candidates.push(dir + canonicalId + '-SUMMARY.md');
+    return candidates;
+}
+/**
+ * #2648: the plan files in `planFiles` that have NO matching completion record
+ * in `summaryFiles`, using the identical matching rule as `countMatchedSummaries`
+ * (so the count and the named list can never disagree). Callers that must NAME
+ * the missing plans — e.g. phase.complete's fail-closed coverage gate, which
+ * refuses completion when any non-retired plan lacks a SUMMARY — need the list,
+ * not just the count. `planFiles` is expected to be already superseded-filtered
+ * (the caller passes `scanPhasePlans(...).planFiles`, which drops
+ * `status: superseded` plans), so a deliberately-retired plan never appears
+ * here and never blocks completion.
+ */
+function findUnsummarizedPlans(planFiles, summaryFiles) {
+    const summarySet = new Set(summaryFiles);
+    return planFiles.filter((plan) => !summaryCandidates(plan).some((c) => summarySet.has(c)));
+}
+/**
+ * #3183: the mirror image of `findUnsummarizedPlans` — the summary files in
+ * `summaryFiles` that do NOT pair with ANY plan in `planFiles`, using the
+ * identical `summaryCandidates` matching rule as `countMatchedSummaries` /
+ * `findUnsummarizedPlans`. Callers that must name orphaned summaries (a
+ * stray non-plan summary, or a summary whose plan was renamed/removed) need
+ * this instead of a bespoke exact-suffix Set-diff, which cannot recognize
+ * the nested or extended naming forms `summaryCandidates` already handles —
+ * a divergence that produced false "orphan summary" warnings.
+ */
+function findOrphanSummaries(planFiles, summaryFiles) {
+    const claimed = new Set();
+    for (const plan of planFiles) {
+        for (const candidate of summaryCandidates(plan))
+            claimed.add(candidate);
+    }
+    return summaryFiles.filter((s) => !claimed.has(s));
+}
 module.exports = {
     toPosixPath,
     detectSubRepos,
     extractOneLinerFromBody,
     pathExistsInternal,
     generateSlugInternal,
-    filterPlanFiles,
-    filterSummaryFiles,
+    transliterateForSlug,
     getPhaseFileStats,
     readSubdirectories,
     timeAgo,
     extractCanonicalPlanId,
     countMatchedSummaries,
+    findUnsummarizedPlans,
+    findOrphanSummaries,
 };

package/gsd-core/bin/lib/decisions.cjs

@@ -21,6 +21,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractDecisions = extractDecisions;
 exports.parseDecisions = parseDecisions;
 const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
+const token_scanner_cjs_1 = require("./token-scanner.cjs");
 const DISCRETION_HEADINGS = new Set([
     "claude's discretion",
     'claudes discretion',
@@ -89,12 +90,14 @@ function parseDecisionLines(block) {
     let category = '';
     let inDiscretion = false;
     let current = null;
+    let openIndent = null;
     let parseMisses = 0;
     const flush = () => {
         if (current) {
             current.text = current.text.trim();
             out.push(current);
             current = null;
+            openIndent = null;
         }
     };
     for (const line of lines) {
@@ -115,6 +118,23 @@ function parseDecisionLines(block) {
             inDiscretion = DISCRETION_HEADINGS.has(normalized);
             continue;
         }
+        // Nested bullet under an open decision (#3212 Phase 3, #3169): a bullet
+        // indented deeper than the currently-open decision's own bullet is that
+        // decision's elaboration (e.g. a cross-reference to a sibling decision),
+        // not a fresh declaration attempt — fold it into current.text exactly
+        // like a continuation line, before it ever reaches the declaration/
+        // parse-miss regexes below. A bullet at the SAME or a SHALLOWER indent
+        // is unaffected — tested exactly as before this fix. See design doc
+        // .gsd/phase/chore-3414-tokenizer-first-seam/40-design.md §1.3 for why
+        // nesting depth, not bullet content, is the signal that distinguishes
+        // this from a genuinely malformed top-level declaration.
+        if (current &&
+            openIndent !== null &&
+            trimmed.startsWith('-') &&
+            (0, token_scanner_cjs_1.indentWidth)(line) > openIndent) {
+            current.text += ' ' + trimmed;
+            continue;
+        }
         // Colon form: `- **D-NN[ [tags]]:** text`
         const colonMatch = line.match(bulletColonRe);
         if (colonMatch) {
@@ -125,6 +145,7 @@ function parseDecisionLines(block) {
                 : [];
             const trackable = !inDiscretion && !tags.some((t) => NON_TRACKABLE_TAGS.has(t));
             current = { id, text: colonMatch[3], category, tags, trackable };
+            openIndent = (0, token_scanner_cjs_1.indentWidth)(line);
             continue;
         }
         // Em-dash form: `- **D-NN[ [tags]] — title** body`
@@ -140,6 +161,7 @@ function parseDecisionLines(block) {
             // title itself is embedded in the bold run but we report the body as text
             // (consistent with how the gate cares only about coverage, not title/body split).
             current = { id, text: emDashMatch[3] || '', category, tags, trackable };
+            openIndent = (0, token_scanner_cjs_1.indentWidth)(line);
             continue;
         }
         // Titled-colon form: `- **D-NN[ [tags]]: Title.** body` (#1639). Checked LAST — it is
@@ -155,6 +177,7 @@ function parseDecisionLines(block) {
                 : [];
             const trackable = !inDiscretion && !tags.some((t) => NON_TRACKABLE_TAGS.has(t));
             current = { id, text: titledColonMatch[3] || '', category, tags, trackable };
+            openIndent = (0, token_scanner_cjs_1.indentWidth)(line);
             continue;
         }
         // Parse-miss guard (FIX B + #1343): a line that looks like a `D-NN` decision

package/gsd-core/bin/lib/docs.cjs

@@ -30,6 +30,7 @@ const { pathExistsInternal, toPosixPath } = coreUtils;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const agentInstallCheck = require("./agent-install-check.cjs");
 const { checkAgentsInstalled } = agentInstallCheck;
+const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 // ─── Constants ────────────────────────────────────────────────────────────────
 const GSD_MARKER = '<!-- generated-by: gsd-doc-writer -->';
@@ -256,7 +257,7 @@ function cmdDocsInit(cwd, raw) {
     };
     // Inject project_root and agent installation status (mirrors withProjectRoot in init.cjs)
     result['project_root'] = cwd;
-    const agentStatus = checkAgentsInstalled();
+    const agentStatus = checkAgentsInstalled((0, runtime_slash_cjs_1.resolveRuntime)(cwd), cwd);
     result['agents_installed'] = agentStatus.agents_installed;
     result['missing_agents'] = agentStatus.missing_agents;
     // #2402: withProjectRoot injects response_language when set; cmdDocsInit predates
@@ -267,4 +268,4 @@ function cmdDocsInit(cwd, raw) {
     }
     output(result, raw, undefined);
 }
-module.exports = { cmdDocsInit };
+module.exports = { cmdDocsInit, detectMonorepoWorkspaces };

package/gsd-core/bin/lib/external-job.cjs

@@ -219,6 +219,11 @@ function _isNonTerminal(status) {
  *  - Same `job_id` for the same `plan_id` -> allowed (status progression).
  *  - A prior job for the same `plan_id` that is already terminal -> allowed
  *    (the duplicate guard only protects against re-dispatching live work).
+ *  - If a SIBLING manifest (not the target) cannot be read or parsed, the
+ *    duplicate scan cannot be completed and may be hiding a live duplicate
+ *    -> refuse (`scan_incomplete`), naming the offending file's path so an
+ *    operator can quarantine or repair it. Never silently skip a sibling the
+ *    scan could not inspect.
  */
 function writeManifest(manifest, planningDir, opts = {}) {
     const fs = opts.fs ?? node_fs_1.default;
@@ -240,18 +245,28 @@ function writeManifest(manifest, planningDir, opts = {}) {
         try {
             raw = String(fs.readFileSync(p));
         }
-        catch {
-            continue;
+        catch (e) {
+            return {
+                ok: false,
+                kind: 'scan_incomplete',
+                message: `duplicate scan incomplete: failed to READ sibling manifest ${p} (${e.message}); quarantine or repair this file before retrying`,
+                offendingPath: p,
+            };
         }
         let existing;
         try {
             existing = JSON.parse(raw);
         }
-        catch {
+        catch (e) {
             if (p === target) {
                 return { ok: false, kind: 'malformed_existing', message: `target manifest ${p} is not valid JSON` };
             }
-            continue;
+            return {
+                ok: false,
+                kind: 'scan_incomplete',
+                message: `duplicate scan incomplete: failed to PARSE sibling manifest ${p} (${e.message}); quarantine or repair this file before retrying`,
+                offendingPath: p,
+            };
         }
         const samePlan = existing.plan_id === manifest.plan_id;
         const sameJob = existing.job_id === manifest.job_id;

package/gsd-core/bin/lib/fallow-runner.cjs

@@ -8,6 +8,13 @@
  *
  * Parses the real fallow `audit --format json` schema (schema_version 3
  * envelope, nested dead_code/duplication sections). See fallow 2.70.0+.
+ *
+ * #3411 Phase 2 (#3618): binary resolution no longer lives here — it delegates
+ * to the platform seam's `resolveExecutableBinary` (shell-command-projection.cts).
+ * This file's prior private resolver deliberately included an extensionless
+ * `fallow` as a win32 candidate; the seam does not, and that is a fix, not a
+ * regression — an extensionless file sitting beside `fallow.cmd` is npm's POSIX
+ * `sh` shim, which `CreateProcess` cannot run (#3275).
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -19,51 +26,20 @@ exports.normalizeFallowReport = normalizeFallowReport;
 exports.normalizeFallowReportFile = normalizeFallowReportFile;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-function candidateNames() {
-    return process.platform === 'win32'
-        ? ['fallow.exe', 'fallow.cmd', 'fallow.bat', 'fallow']
-        : ['fallow'];
-}
-function isExecutableFile(filePath) {
-    try {
-        const stat = node_fs_1.default.statSync(filePath);
-        if (!stat.isFile())
-            return false;
-        if (process.platform === 'win32')
-            return true;
-        node_fs_1.default.accessSync(filePath, node_fs_1.default.constants.X_OK);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function findInPath(envPath) {
-    if (!envPath)
-        return null;
-    const names = candidateNames();
-    const segments = envPath.split(node_path_1.default.delimiter).filter(Boolean);
-    for (const segment of segments) {
-        for (const name of names) {
-            const candidate = node_path_1.default.join(segment, name);
-            if (isExecutableFile(candidate))
-                return candidate;
-        }
-    }
-    return null;
-}
-function findInNodeModules(cwd) {
-    const names = candidateNames();
-    const binDir = node_path_1.default.join(cwd, 'node_modules', '.bin');
-    for (const name of names) {
-        const candidate = node_path_1.default.join(binDir, name);
-        if (isExecutableFile(candidate))
-            return candidate;
-    }
-    return null;
-}
+const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 function resolveFallowBinary({ cwd, envPath = process.env['PATH'] ?? '' }) {
-    return findInNodeModules(cwd) || findInPath(envPath) || null;
+    return (0, shell_command_projection_cjs_1.resolveExecutableBinary)('fallow', {
+        prependPaths: [node_path_1.default.join(cwd, 'node_modules', '.bin')],
+        // #3619 (epic #3411 Phase 3): pathOverride carries envPath as the search
+        // path while leaving `env` unset, so the seam falls back to its default
+        // `env` (process.env) for everything else — PATHEXT included. Ambient
+        // PATHEXT therefore still governs win32 resolution exactly as before, but
+        // this file never reads it itself: that's what keeps this module clean
+        // under local/no-private-binary-resolution, which forbids a PATHEXT read
+        // outside the seam.
+        pathOverride: envPath,
+        requireExecutable: true,
+    });
 }
 function requireFallowBinary({ cwd, envPath = process.env['PATH'] ?? '' }) {
     const binary = resolveFallowBinary({ cwd, envPath });