@paretools/shared 0.12.0 → 0.13.1

package/dist/ansi.js

@@ -2,7 +2,7 @@
  * Strips ANSI escape codes from a string.
  * Handles SGR (colors/styles), cursor movement, and other terminal sequences.
  */
-const ANSI_REGEX = /\x1B(?:\][^\x07]*\x07|\[[0-?]*[ -/]*[@-~]|[@-Z\\-_])/g;
+const ANSI_REGEX = /\x1B(?:\][^\x07]{0,256}\x07|\[[\d;?]{0,64}[A-Za-z]|[@-Z\\-_])/g;
 export function stripAnsi(str) {
     return str.replace(ANSI_REGEX, "");
 }

package/dist/ansi.js.map

@@ -1 +1 @@
-{"version":3,"file":"ansi.js","sourceRoot":"","sources":["../src/ansi.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,GAAG,uDAAuD,CAAC;AAE3E,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"ansi.js","sourceRoot":"","sources":["../src/ansi.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,GAAG,gEAAgE,CAAC;AAEpF,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC"}

package/dist/discover-tool.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The `discover-tools` meta-tool — allows LLM clients to discover and load
+ * tools that were deferred at startup for token efficiency.
+ *
+ * Each server registers this tool when lazy mode is active and at least one
+ * tool was deferred. Calling it with no arguments lists available tools;
+ * passing tool names in `load` immediately registers them.
+ */
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { LazyToolManager } from "./lazy-tools.js";
+/**
+ * Registers the `discover-tools` meta-tool on the given server.
+ *
+ * @param server - The MCP server to register on.
+ * @param manager - The lazy tool manager tracking deferred tools.
+ * @param serverName - Human-readable server name for the tool description.
+ */
+export declare function registerDiscoverTool(server: McpServer, manager: LazyToolManager, serverName: string): void;
+//# sourceMappingURL=discover-tool.d.ts.map

package/dist/discover-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover-tool.d.ts","sourceRoot":"","sources":["../src/discover-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAsCvD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,GACjB,IAAI,CA+BN"}

package/dist/discover-tool.js

@@ -0,0 +1,70 @@
+/**
+ * The `discover-tools` meta-tool — allows LLM clients to discover and load
+ * tools that were deferred at startup for token efficiency.
+ *
+ * Each server registers this tool when lazy mode is active and at least one
+ * tool was deferred. Calling it with no arguments lists available tools;
+ * passing tool names in `load` immediately registers them.
+ */
+import { z } from "zod";
+import { dualOutput } from "./output.js";
+/** Zod schema for the discover-tools output. */
+const DiscoverToolsOutputSchema = {
+    available: z.array(z.object({
+        name: z.string(),
+        description: z.string(),
+    })),
+    loaded: z.array(z.string()),
+    totalAvailable: z.number(),
+};
+function formatDiscoverTools(data) {
+    const lines = [];
+    if (data.loaded.length > 0) {
+        lines.push(`Loaded ${data.loaded.length} tool(s): ${data.loaded.join(", ")}`);
+        lines.push("");
+    }
+    if (data.available.length > 0) {
+        lines.push(`${data.totalAvailable} additional tool(s) available:`);
+        for (const tool of data.available) {
+            lines.push(`  - ${tool.name}: ${tool.description}`);
+        }
+    }
+    else {
+        lines.push("All tools are loaded.");
+    }
+    return lines.join("\n");
+}
+/**
+ * Registers the `discover-tools` meta-tool on the given server.
+ *
+ * @param server - The MCP server to register on.
+ * @param manager - The lazy tool manager tracking deferred tools.
+ * @param serverName - Human-readable server name for the tool description.
+ */
+export function registerDiscoverTool(server, manager, serverName) {
+    server.registerTool("discover-tools", {
+        title: "Discover Available Tools",
+        description: `List and load additional ${serverName} tools that aren't loaded by default. Use this to find tools for less common operations.`,
+        inputSchema: {
+            load: z.array(z.string()).optional().describe("Tool names to load immediately"),
+        },
+        outputSchema: DiscoverToolsOutputSchema,
+    }, async (args) => {
+        const loaded = [];
+        if (args.load) {
+            for (const name of args.load) {
+                if (manager.loadTool(name)) {
+                    loaded.push(name);
+                }
+            }
+        }
+        const available = manager.listLazy();
+        const result = {
+            available,
+            loaded,
+            totalAvailable: available.length,
+        };
+        return dualOutput(result, formatDiscoverTools);
+    });
+}
+//# sourceMappingURL=discover-tool.js.map

package/dist/discover-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover-tool.js","sourceRoot":"","sources":["../src/discover-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,gDAAgD;AAChD,MAAM,yBAAyB,GAAG;IAChC,SAAS,EAAE,CAAC,CAAC,KAAK,CAChB,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;KACxB,CAAC,CACH;IACD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC;AAEF,SAAS,mBAAmB,CAAC,IAI5B;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,gCAAgC,CAAC,CAAC;QACnE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAiB,EACjB,OAAwB,EACxB,UAAkB;IAElB,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,4BAA4B,UAAU,0FAA0F;QAC7I,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;SAChF;QACD,YAAY,EAAE,yBAAyB;KACxC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG;YACb,SAAS;YACT,MAAM;YACN,cAAc,EAAE,SAAS,CAAC,MAAM;SACjC,CAAC;QAEF,OAAO,UAAU,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACjD,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,17 +1,20 @@
-export { dualOutput, estimateTokens, compactDualOutput } from "./output.js";
-export { run, escapeCmdArg, type RunResult, type RunOptions } from "./runner.js";
+export { dualOutput, estimateTokens, compactDualOutput, strippedDualOutput, strippedCompactDualOutput, } from "./output.js";
+export { run, escapeCmdArg, _buildSpawnConfig, type RunResult, type RunOptions, type SpawnConfig, } from "./runner.js";
 export { stripAnsi } from "./ansi.js";
-export { assertNoFlagInjection, assertValidSortKey, assertValidLogOpts, assertAllowedCommand, } from "./validation.js";
+export { coerceJsonArray, assertNoFlagInjection, assertValidSortKey, assertValidLogOpts, assertAllowedCommand, } from "./validation.js";
 export { INPUT_LIMITS } from "./limits.js";
 export { compactInput, projectPathInput, repoPathInput, cwdPathInput, fixInput, pathInput, configInput, filePatternsInput, } from "./input-schemas.js";
 export { sanitizeErrorOutput } from "./sanitize.js";
-export { shouldRegisterTool, _resetProfileCache } from "./tool-filter.js";
-export { PROFILES, resolveProfile } from "./profiles.js";
+export { shouldRegisterTool, isLazyEnabled, _resetProfileCache } from "./tool-filter.js";
+export { PROFILES, CORE_TOOLS, resolveProfile, isCoreToolForServer } from "./profiles.js";
 export type { ProfileName } from "./profiles.js";
+export { createLazyToolManager, type LazyToolDefinition, type LazyToolManager, } from "./lazy-tools.js";
+export { registerDiscoverTool } from "./discover-tool.js";
 export { assertAllowedByPolicy, assertAllowedRoot, assertNoPathQualifiedCommand, } from "./policy.js";
 export type { ToolOutput } from "./types.js";
 export { PareErrorCategory, PareErrorSchema, classifyError, errorOutput, invalidInputError, isCommandNotFound, isPermissionDenied, isTimeout, isNetworkError, isAuthError, isConflict, isNotFound, isAlreadyExists, isConfigurationError, } from "./errors.js";
 export type { PareErrorCategoryType, PareError } from "./errors.js";
 export { createServer } from "./server.js";
 export type { CreateServerOptions } from "./server.js";
+export { readPackageVersion } from "./version.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACzD,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,WAAW,EACX,UAAU,EACV,UAAU,EACV,eAAe,EACf,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,GAAG,EACH,YAAY,EACZ,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC1F,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,WAAW,EACX,UAAU,EACV,UAAU,EACV,eAAe,EACf,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,13 +1,16 @@
-export { dualOutput, estimateTokens, compactDualOutput } from "./output.js";
-export { run, escapeCmdArg } from "./runner.js";
+export { dualOutput, estimateTokens, compactDualOutput, strippedDualOutput, strippedCompactDualOutput, } from "./output.js";
+export { run, escapeCmdArg, _buildSpawnConfig, } from "./runner.js";
 export { stripAnsi } from "./ansi.js";
-export { assertNoFlagInjection, assertValidSortKey, assertValidLogOpts, assertAllowedCommand, } from "./validation.js";
+export { coerceJsonArray, assertNoFlagInjection, assertValidSortKey, assertValidLogOpts, assertAllowedCommand, } from "./validation.js";
 export { INPUT_LIMITS } from "./limits.js";
 export { compactInput, projectPathInput, repoPathInput, cwdPathInput, fixInput, pathInput, configInput, filePatternsInput, } from "./input-schemas.js";
 export { sanitizeErrorOutput } from "./sanitize.js";
-export { shouldRegisterTool, _resetProfileCache } from "./tool-filter.js";
-export { PROFILES, resolveProfile } from "./profiles.js";
+export { shouldRegisterTool, isLazyEnabled, _resetProfileCache } from "./tool-filter.js";
+export { PROFILES, CORE_TOOLS, resolveProfile, isCoreToolForServer } from "./profiles.js";
+export { createLazyToolManager, } from "./lazy-tools.js";
+export { registerDiscoverTool } from "./discover-tool.js";
 export { assertAllowedByPolicy, assertAllowedRoot, assertNoPathQualifiedCommand, } from "./policy.js";
 export { PareErrorCategory, PareErrorSchema, classifyError, errorOutput, invalidInputError, isCommandNotFound, isPermissionDenied, isTimeout, isNetworkError, isAuthError, isConflict, isNotFound, isAlreadyExists, isConfigurationError, } from "./errors.js";
 export { createServer } from "./server.js";
+export { readPackageVersion } from "./version.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,GAAG,EAAE,YAAY,EAAmC,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,WAAW,EACX,UAAU,EACV,UAAU,EACV,eAAe,EACf,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,GAAG,EACH,YAAY,EACZ,iBAAiB,GAIlB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAE1F,OAAO,EACL,qBAAqB,GAGtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,WAAW,EACX,UAAU,EACV,UAAU,EACV,eAAe,EACf,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}

package/dist/lazy-tools.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Lazy tool registration — allows servers to defer loading of non-core tools
+ * until they are explicitly requested via the `discover-tools` meta-tool.
+ *
+ * When `PARE_LAZY=true`, only core tools are registered at startup.
+ * Extended tools are stored as lazy definitions and can be loaded on demand,
+ * reducing the token cost of tool schemas in LLM prompts.
+ */
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/** Definition of a tool that can be lazily loaded on demand. */
+export interface LazyToolDefinition {
+    /** Tool name as registered with the MCP server. */
+    name: string;
+    /** Short description shown in discover-tools output. */
+    description: string;
+    /** Callback that registers the full tool on the server when invoked. */
+    register: (server: McpServer) => void;
+}
+/** Manager for lazy/deferred tool registration. */
+export interface LazyToolManager {
+    /** Register a tool as lazy (deferred — not yet loaded). */
+    registerLazy(def: LazyToolDefinition): void;
+    /** Get list of all lazy (not yet loaded) tools. */
+    listLazy(): Array<{
+        name: string;
+        description: string;
+    }>;
+    /** Load a specific lazy tool by name. Returns true if the tool was found and loaded. */
+    loadTool(name: string): boolean;
+    /** Load all remaining lazy tools. Returns the count of tools loaded. */
+    loadAll(): number;
+    /** Check if any tools were deferred. */
+    hasDeferredTools(): boolean;
+}
+/**
+ * Creates a lazy tool manager bound to the given MCP server.
+ *
+ * The manager stores deferred tool definitions and registers them on the
+ * server when explicitly loaded. After loading, it sends the
+ * `notifications/tools/list_changed` notification so clients re-fetch the
+ * tool list.
+ */
+export declare function createLazyToolManager(server: McpServer): LazyToolManager;
+//# sourceMappingURL=lazy-tools.d.ts.map

package/dist/lazy-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lazy-tools.d.ts","sourceRoot":"","sources":["../src/lazy-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC;CACvC;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC5C,mDAAmD;IACnD,QAAQ,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzD,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,wEAAwE;IACxE,OAAO,IAAI,MAAM,CAAC;IAClB,wCAAwC;IACxC,gBAAgB,IAAI,OAAO,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,eAAe,CAyCxE"}

package/dist/lazy-tools.js

@@ -0,0 +1,54 @@
+/**
+ * Lazy tool registration — allows servers to defer loading of non-core tools
+ * until they are explicitly requested via the `discover-tools` meta-tool.
+ *
+ * When `PARE_LAZY=true`, only core tools are registered at startup.
+ * Extended tools are stored as lazy definitions and can be loaded on demand,
+ * reducing the token cost of tool schemas in LLM prompts.
+ */
+/**
+ * Creates a lazy tool manager bound to the given MCP server.
+ *
+ * The manager stores deferred tool definitions and registers them on the
+ * server when explicitly loaded. After loading, it sends the
+ * `notifications/tools/list_changed` notification so clients re-fetch the
+ * tool list.
+ */
+export function createLazyToolManager(server) {
+    const pending = new Map();
+    return {
+        registerLazy(def) {
+            pending.set(def.name, def);
+        },
+        listLazy() {
+            return Array.from(pending.values()).map((d) => ({
+                name: d.name,
+                description: d.description,
+            }));
+        },
+        loadTool(name) {
+            const def = pending.get(name);
+            if (!def)
+                return false;
+            def.register(server);
+            pending.delete(name);
+            server.sendToolListChanged();
+            return true;
+        },
+        loadAll() {
+            const count = pending.size;
+            if (count === 0)
+                return 0;
+            for (const def of Array.from(pending.values())) {
+                def.register(server);
+            }
+            pending.clear();
+            server.sendToolListChanged();
+            return count;
+        },
+        hasDeferredTools() {
+            return pending.size > 0;
+        },
+    };
+}
+//# sourceMappingURL=lazy-tools.js.map

package/dist/lazy-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lazy-tools.js","sourceRoot":"","sources":["../src/lazy-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA4BH;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAiB;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEtD,OAAO;QACL,YAAY,CAAC,GAAuB;YAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,QAAQ;YACN,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9C,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC,CAAC,CAAC;QACN,CAAC;QAED,QAAQ,CAAC,IAAY;YACnB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YAEvB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;YAC3B,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YAE1B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,gBAAgB;YACd,OAAO,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/output.d.ts

@@ -29,4 +29,31 @@ export declare function estimateTokens(text: string): number;
  * @param forceFullSchema - When true, skip auto-detection and return full data.
  */
 export declare function compactDualOutput<T, C>(data: T, rawStdout: string, humanFormat: (d: T) => string, compactMap: (d: T) => C, compactFormat: (d: C) => string, forceFullSchema: boolean): ToolOutput<T | C>;
+/**
+ * Creates a dual-output response where the formatter receives the full internal
+ * data (with extra fields for human-readable output) while structuredContent
+ * receives a clean projection that matches the output schema.
+ *
+ * Use this instead of `dualOutput` when your parsed data has Internal-only fields
+ * that should appear in human text but NOT in structuredContent.
+ *
+ * @param data - The full internal data (may contain extra fields for formatters).
+ * @param humanFormat - Formatter that receives the full internal data.
+ * @param schemaMap - Projects internal data into the clean schema shape for structuredContent.
+ */
+export declare function strippedDualOutput<T, S>(data: T, humanFormat: (d: T) => string, schemaMap: (d: T) => S): ToolOutput<S>;
+/**
+ * Like `compactDualOutput` but strips Internal-only fields from the full data path
+ * using a schema projection function. This ensures structuredContent only contains
+ * fields defined in the output schema, while formatters still receive all fields.
+ *
+ * @param data - The full internal data parsed from CLI output.
+ * @param rawStdout - The ANSI-stripped stdout from the CLI command.
+ * @param humanFormat - Formatter for full data (used when not compacting).
+ * @param schemaMap - Projects internal data into clean schema shape (for non-compact mode).
+ * @param compactMap - Projects full data into a compact shape (for compact mode).
+ * @param compactFormat - Formatter for compact data.
+ * @param forceFullSchema - When true, skip auto-detection and return full data.
+ */
+export declare function strippedCompactDualOutput<T, S, C>(data: T, rawStdout: string, humanFormat: (d: T) => string, schemaMap: (d: T) => S, compactMap: (d: T) => C, compactFormat: (d: C) => string, forceFullSchema: boolean): ToolOutput<S | C>;
 //# sourceMappingURL=output.d.ts.map

package/dist/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAKnF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,CAAC,EACpC,IAAI,EAAE,CAAC,EACP,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC7B,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EACvB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC/B,eAAe,EAAE,OAAO,GACvB,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAcnB"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAKnF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,CAAC,EACpC,IAAI,EAAE,CAAC,EACP,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC7B,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EACvB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC/B,eAAe,EAAE,OAAO,GACvB,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAcnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EACrC,IAAI,EAAE,CAAC,EACP,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC7B,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GACrB,UAAU,CAAC,CAAC,CAAC,CAKf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC/C,IAAI,EAAE,CAAC,EACP,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC7B,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EACtB,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EACvB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,EAC/B,eAAe,EAAE,OAAO,GACvB,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAcnB"}

package/dist/output.js

@@ -46,4 +46,47 @@ export function compactDualOutput(data, rawStdout, humanFormat, compactMap, comp
     }
     return dualOutput(data, humanFormat);
 }
+/**
+ * Creates a dual-output response where the formatter receives the full internal
+ * data (with extra fields for human-readable output) while structuredContent
+ * receives a clean projection that matches the output schema.
+ *
+ * Use this instead of `dualOutput` when your parsed data has Internal-only fields
+ * that should appear in human text but NOT in structuredContent.
+ *
+ * @param data - The full internal data (may contain extra fields for formatters).
+ * @param humanFormat - Formatter that receives the full internal data.
+ * @param schemaMap - Projects internal data into the clean schema shape for structuredContent.
+ */
+export function strippedDualOutput(data, humanFormat, schemaMap) {
+    return {
+        content: [{ type: "text", text: humanFormat(data) }],
+        structuredContent: schemaMap(data),
+    };
+}
+/**
+ * Like `compactDualOutput` but strips Internal-only fields from the full data path
+ * using a schema projection function. This ensures structuredContent only contains
+ * fields defined in the output schema, while formatters still receive all fields.
+ *
+ * @param data - The full internal data parsed from CLI output.
+ * @param rawStdout - The ANSI-stripped stdout from the CLI command.
+ * @param humanFormat - Formatter for full data (used when not compacting).
+ * @param schemaMap - Projects internal data into clean schema shape (for non-compact mode).
+ * @param compactMap - Projects full data into a compact shape (for compact mode).
+ * @param compactFormat - Formatter for compact data.
+ * @param forceFullSchema - When true, skip auto-detection and return full data.
+ */
+export function strippedCompactDualOutput(data, rawStdout, humanFormat, schemaMap, compactMap, compactFormat, forceFullSchema) {
+    if (forceFullSchema) {
+        return strippedDualOutput(data, humanFormat, schemaMap);
+    }
+    const structuredTokens = estimateTokens(JSON.stringify(data));
+    const rawTokens = estimateTokens(rawStdout);
+    if (structuredTokens >= rawTokens) {
+        const compact = compactMap(data);
+        return dualOutput(compact, compactFormat);
+    }
+    return strippedDualOutput(data, humanFormat, schemaMap);
+}
 //# sourceMappingURL=output.js.map

package/dist/output.js.map

@@ -1 +1 @@
-{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAI,IAAO,EAAE,WAA6B;IAClE,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,iBAAiB,EAAE,IAAI;KACxB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAO,EACP,SAAiB,EACjB,WAA6B,EAC7B,UAAuB,EACvB,aAA+B,EAC/B,eAAwB;IAExB,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,CAAsB,CAAC;IAC5D,CAAC;IAED,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAE5C,IAAI,gBAAgB,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC,OAAO,EAAE,aAAa,CAAsB,CAAC;IACjE,CAAC;IAED,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,CAAsB,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAI,IAAO,EAAE,WAA6B;IAClE,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,iBAAiB,EAAE,IAAI;KACxB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAO,EACP,SAAiB,EACjB,WAA6B,EAC7B,UAAuB,EACvB,aAA+B,EAC/B,eAAwB;IAExB,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,CAAsB,CAAC;IAC5D,CAAC;IAED,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAE5C,IAAI,gBAAgB,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC,OAAO,EAAE,aAAa,CAAsB,CAAC;IACjE,CAAC;IAED,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,CAAsB,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAO,EACP,WAA6B,EAC7B,SAAsB;IAEtB,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,iBAAiB,EAAE,SAAS,CAAC,IAAI,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAO,EACP,SAAiB,EACjB,WAA6B,EAC7B,SAAsB,EACtB,UAAuB,EACvB,aAA+B,EAC/B,eAAwB;IAExB,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAsB,CAAC;IAC/E,CAAC;IAED,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAE5C,IAAI,gBAAgB,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC,OAAO,EAAE,aAAa,CAAsB,CAAC;IACjE,CAAC;IAED,OAAO,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAsB,CAAC;AAC/E,CAAC"}

package/dist/profiles.d.ts

@@ -14,6 +14,22 @@ export type ProfileName = "minimal" | "web" | "python" | "devops" | "rust" | "go
  * for the "full" profile (no filtering).
  */
 export declare const PROFILES: Record<ProfileName, readonly string[] | null>;
+/**
+ * Core tools per server — the most commonly used tools that should always
+ * load immediately, even when lazy mode (`PARE_LAZY=true`) is active.
+ *
+ * Tools not listed here will be deferred and discoverable via the
+ * `discover-tools` meta-tool.
+ */
+export declare const CORE_TOOLS: Record<string, readonly string[]>;
+/**
+ * Checks whether a tool is in the core set for a given server.
+ *
+ * @param serverName - The server identifier (e.g., "git", "npm").
+ * @param toolName - The tool name (e.g., "status", "install").
+ * @returns `true` if the tool is a core tool, `false` otherwise.
+ */
+export declare function isCoreToolForServer(serverName: string, toolName: string): boolean;
 /**
  * Reads `PARE_PROFILE` and returns a `Set<string>` of allowed `server:tool`
  * entries, or `null` if all tools should be enabled.

package/dist/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,2BAA2B;AAC3B,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;AAE3F;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAgTlE,CAAC;AAKF;;;;;;GAMG;AACH,wBAAgB,cAAc,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CA6BnD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,2BAA2B;AAC3B,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC;AAE3F;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAgTlE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAqCxD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIjF;AAKD;;;;;;GAMG;AACH,wBAAgB,cAAc,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CA6BnD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/profiles.js

@@ -310,6 +310,64 @@ export const PROFILES = {
     ],
     full: null,
 };
+/**
+ * Core tools per server — the most commonly used tools that should always
+ * load immediately, even when lazy mode (`PARE_LAZY=true`) is active.
+ *
+ * Tools not listed here will be deferred and discoverable via the
+ * `discover-tools` meta-tool.
+ */
+export const CORE_TOOLS = {
+    git: ["status", "log", "diff", "commit", "push", "pull", "checkout", "branch", "add"],
+    github: [
+        "pr-view",
+        "pr-list",
+        "pr-create",
+        "pr-checks",
+        "issue-view",
+        "issue-list",
+        "issue-create",
+    ],
+    npm: ["install", "run", "test", "audit", "list"],
+    docker: ["ps", "build", "logs", "images", "compose-up", "compose-down"],
+    build: ["tsc", "build"],
+    test: ["run", "coverage"],
+    lint: ["lint", "format-check", "prettier-format"],
+    search: ["search", "find", "count"],
+    cargo: ["build", "test", "clippy", "run", "check"],
+    go: ["build", "test", "vet", "run", "mod-tidy", "fmt"],
+    python: ["pip-install", "pip-list", "pytest", "ruff-check", "uv-run"],
+    k8s: ["get", "describe", "logs"],
+    http: ["get", "post", "request"],
+    security: ["trivy", "semgrep"],
+    make: ["run", "list"],
+    process: ["run"],
+    bun: ["run", "test", "build", "install"],
+    deno: ["run", "test", "fmt", "lint"],
+    dotnet: ["build", "test", "run"],
+    infra: ["plan", "validate", "init"],
+    jvm: ["gradle-build", "gradle-test", "maven-build", "maven-test"],
+    nix: ["build", "run", "develop"],
+    remote: ["ssh-run", "ssh-test"],
+    ruby: ["run", "check", "bundle-install", "bundle-exec"],
+    swift: ["build", "test", "run"],
+    db: ["psql-query", "psql-list-databases", "mysql-query", "mysql-list-databases"],
+    bazel: ["bazel"],
+    cmake: ["cmake"],
+};
+/**
+ * Checks whether a tool is in the core set for a given server.
+ *
+ * @param serverName - The server identifier (e.g., "git", "npm").
+ * @param toolName - The tool name (e.g., "status", "install").
+ * @returns `true` if the tool is a core tool, `false` otherwise.
+ */
+export function isCoreToolForServer(serverName, toolName) {
+    const core = CORE_TOOLS[serverName];
+    if (!core)
+        return true; // Unknown server — treat all as core.
+    return core.includes(toolName);
+}
 /** Module-level cache for the resolved profile Set. */
 let profileCache;
 /**

package/dist/profiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAkD;IACrE,OAAO,EAAE;QACP,YAAY;QACZ,SAAS;QACT,UAAU;QACV,SAAS;QACT,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,YAAY;QACZ,UAAU;QACV,aAAa;QACb,WAAW;QACX,eAAe;QACf,aAAa;QACb,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,aAAa;KACd;IAED,GAAG,EAAE;QACH,YAAY;QACZ,SAAS;QACT,eAAe;QACf,UAAU;QACV,YAAY;QACZ,UAAU;QACV,SAAS;QACT,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,WAAW;QACX,YAAY;QACZ,WAAW;QACX,gBAAgB;QAChB,WAAW;QACX,aAAa;QACb,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,iBAAiB;QACjB,mBAAmB;QACnB,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB;QAClB,gBAAgB;QAChB,mBAAmB;QACnB,mBAAmB;QACnB,qBAAqB;QACrB,oBAAoB;QACpB,sBAAsB;QACtB,iBAAiB;QACjB,iBAAiB;QACjB,aAAa;QACb,WAAW;QACX,cAAc;QACd,UAAU;QACV,SAAS;QACT,UAAU;QACV,UAAU;QACV,YAAY;QACZ,SAAS;QACT,WAAW;QACX,aAAa;QACb,eAAe;QACf,kBAAkB;QAClB,eAAe;QACf,aAAa;QACb,UAAU;QACV,UAAU;QACV,eAAe;QACf,iBAAiB;QACjB,WAAW;QACX,mBAAmB;QACnB,sBAAsB;QACtB,kBAAkB;QAClB,mBAAmB;QACnB,aAAa;QACb,gBAAgB;QAChB,eAAe;QACf,aAAa;QACb,cAAc;QACd,WAAW;QACX,UAAU;QACV,WAAW;QACX,cAAc;QACd,WAAW;QACX,aAAa;KACd;IAED,MAAM,EAAE;QACN,YAAY;QACZ,SAAS;QACT,eAAe;QACf,UAAU;QACV,YAAY;QACZ,UAAU;QACV,SAAS;QACT,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,WAAW;QACX,YAAY;QACZ,WAAW;QACX,gBAAgB;QAChB,WAAW;QACX,aAAa;QACb,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,iBAAiB;QACjB,kBAAkB;QAClB,mBAAmB;QACnB,mBAAmB;QACnB,qBAAqB;QACrB,iBAAiB;QACjB,iBAAiB;QACjB,oBAAoB;QACpB,iBAAiB;QACjB,iBAAiB;QACjB,aAAa;QACb,mBAAmB;QACnB,oBAAoB;QACpB,kBAAkB;QAClB,eAAe;QACf,mBAAmB;QACnB,eAAe;QACf,cAAc;QACd,eAAe;QACf,cAAc;QACd,cAAc;QACd,UAAU;QACV,eAAe;QACf,eAAe;QACf,aAAa;QACb,cAAc;QACd,UAAU;QACV,WAAW;QACX,aAAa;KACd;IAED,MAAM,EAAE;QACN,YAAY;QACZ,SAAS;QACT,UAAU;QACV,YAAY;QACZ,UAAU;QACV,SAAS;QACT,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,SAAS;QACT,YAAY;QACZ,WAAW;QACX,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,iBAAiB;QACjB,kBAAkB;QAClB,mBAAmB;QACnB,mBAAmB;QACnB,iBAAiB;QACjB,iBAAiB;QACjB,kBAAkB;QAClB,uBAAuB;QACvB,qBAAqB;QACrB,WAAW;QACX,cAAc;QACd,aAAa;QACb,eAAe;QACf,YAAY;QACZ,aAAa;QACb,mBAAmB;QACnB,qBAAqB;QACrB,aAAa;QACb,gBAAgB;QAChB,mBAAmB;QACnB,kBAAkB;QAClB,mBAAmB;QACnB,qBAAqB;QACrB,sBAAsB;QACtB,cAAc;QACd,SAAS;QACT,cAAc;QACd,UAAU;QACV,WAAW;QACX,UAAU;QACV,gBAAgB;QAChB,kBAAkB;QAClB,mBAAmB;QACnB,UAAU;QACV,WAAW;QACX,iBAAiB;QACjB,eAAe;QACf,UAAU;QACV,WAAW;QACX,cAAc;QACd,WAAW;QACX,eAAe;QACf,aAAa;QACb,aAAa;KACd;IAED,IAAI,EAAE;QACJ,YAAY;QACZ,SAAS;QACT,eAAe;QACf,UAAU;QACV,YAAY;QACZ,UAAU;QACV,SAAS;QACT,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,WAAW;QACX,YAAY;QACZ,WAAW;QACX,gBAAgB;QAChB,WAAW;QACX,aAAa;QACb,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,iBAAiB;QACjB,kBAAkB;QAClB,mBAAmB;QACnB,mBAAmB;QACnB,qBAAqB;QACrB,iBAAiB;QACjB,iBAAiB;QACjB,aAAa;QACb,YAAY;QACZ,cAAc;QACd,WAAW;QACX,WAAW;QACX,cAAc;QACd,WAAW;QACX,WAAW;QACX,aAAa;QACb,cAAc;QACd,YAAY;QACZ,aAAa;QACb,UAAU;QACV,eAAe;QACf,eAAe;QACf,aAAa;QACb,cAAc;QACd,aAAa;KACd;IAED,EAAE,EAAE;QACF,YAAY;QACZ,SAAS;QACT,eAAe;QACf,UAAU;QACV,YAAY;QACZ,UAAU;QACV,SAAS;QACT,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,WAAW;QACX,YAAY;QACZ,WAAW;QACX,gBAAgB;QAChB,WAAW;QACX,aAAa;QACb,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,iBAAiB;QACjB,kBAAkB;QAClB,mBAAmB;QACnB,mBAAmB;QACnB,qBAAqB;QACrB,iBAAiB;QACjB,iBAAiB;QACjB,UAAU;QACV,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,aAAa;QACb,QAAQ;QACR,aAAa;QACb,QAAQ;QACR,SAAS;QACT,QAAQ;QACR,kBAAkB;QAClB,UAAU;QACV,eAAe;QACf,eAAe;QACf,aAAa;QACb,cAAc;QACd,aAAa;KACd;IAED,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,uDAAuD;AACvD,IAAI,YAA4C,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAEpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACrC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,YAAY,GAAG,IAAI,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAiB,CAAC;IACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,wDAAwD;QACxD,OAAO,CAAC,IAAI,CACV,2BAA2B,GAAG,CAAC,IAAI,EAAE,sBAAsB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CACzG,CAAC;QACF,YAAY,GAAG,IAAI,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,iCAAiC;QACjC,YAAY,GAAG,IAAI,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,YAAY,GAAG,SAAS,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAkD;IACrE,OAAO,EAAE;QACP,YAAY;QACZ,SAAS;QACT,UAAU;QACV,SAAS;QACT,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,YAAY;QACZ,UAAU;QACV,aAAa;QACb,WAAW;QACX,eAAe;QACf,aAAa;QACb,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,aAAa;KACd;IAED,GAAG,EAAE;QACH,YAAY;QACZ,SAAS;QACT,eAAe;QACf,UAAU;QACV,YAAY;QACZ,UAAU;QACV,SAAS;QACT,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,WAAW;QACX,YAAY;QACZ,WAAW;QACX,gBAAgB;QAChB,WAAW;QACX,aAAa;QACb,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,iBAAiB;QACjB,mBAAmB;QACnB,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB;QAClB,gBAAgB;QAChB,mBAAmB;QACnB,mBAAmB;QACnB,qBAAqB;QACrB,oBAAoB;QACpB,sBAAsB;QACtB,iBAAiB;QACjB,iBAAiB;QACjB,aAAa;QACb,WAAW;QACX,cAAc;QACd,UAAU;QACV,SAAS;QACT,UAAU;QACV,UAAU;QACV,YAAY;QACZ,SAAS;QACT,WAAW;QACX,aAAa;QACb,eAAe;QACf,kBAAkB;QAClB,eAAe;QACf,aAAa;QACb,UAAU;QACV,UAAU;QACV,eAAe;QACf,iBAAiB;QACjB,WAAW;QACX,mBAAmB;QACnB,sBAAsB;QACtB,kBAAkB;QAClB,mBAAmB;QACnB,aAAa;QACb,gBAAgB;QAChB,eAAe;QACf,aAAa;QACb,cAAc;QACd,WAAW;QACX,UAAU;QACV,WAAW;QACX,cAAc;QACd,WAAW;QACX,aAAa;KACd;IAED,MAAM,EAAE;QACN,YAAY;QACZ,SAAS;QACT,eAAe;QACf,UAAU;QACV,YAAY;QACZ,UAAU;QACV,SAAS;QACT,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,WAAW;QACX,YAAY;QACZ,WAAW;QACX,gBAAgB;QAChB,WAAW;QACX,aAAa;QACb,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,iBAAiB;QACjB,kBAAkB;QAClB,mBAAmB;QACnB,mBAAmB;QACnB,qBAAqB;QACrB,iBAAiB;QACjB,iBAAiB;QACjB,oBAAoB;QACpB,iBAAiB;QACjB,iBAAiB;QACjB,aAAa;QACb,mBAAmB;QACnB,oBAAoB;QACpB,kBAAkB;QAClB,eAAe;QACf,mBAAmB;QACnB,eAAe;QACf,cAAc;QACd,eAAe;QACf,cAAc;QACd,cAAc;QACd,UAAU;QACV,eAAe;QACf,eAAe;QACf,aAAa;QACb,cAAc;QACd,UAAU;QACV,WAAW;QACX,aAAa;KACd;IAED,MAAM,EAAE;QACN,YAAY;QACZ,SAAS;QACT,UAAU;QACV,YAAY;QACZ,UAAU;QACV,SAAS;QACT,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,SAAS;QACT,YAAY;QACZ,WAAW;QACX,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,iBAAiB;QACjB,kBAAkB;QAClB,mBAAmB;QACnB,mBAAmB;QACnB,iBAAiB;QACjB,iBAAiB;QACjB,kBAAkB;QAClB,uBAAuB;QACvB,qBAAqB;QACrB,WAAW;QACX,cAAc;QACd,aAAa;QACb,eAAe;QACf,YAAY;QACZ,aAAa;QACb,mBAAmB;QACnB,qBAAqB;QACrB,aAAa;QACb,gBAAgB;QAChB,mBAAmB;QACnB,kBAAkB;QAClB,mBAAmB;QACnB,qBAAqB;QACrB,sBAAsB;QACtB,cAAc;QACd,SAAS;QACT,cAAc;QACd,UAAU;QACV,WAAW;QACX,UAAU;QACV,gBAAgB;QAChB,kBAAkB;QAClB,mBAAmB;QACnB,UAAU;QACV,WAAW;QACX,iBAAiB;QACjB,eAAe;QACf,UAAU;QACV,WAAW;QACX,cAAc;QACd,WAAW;QACX,eAAe;QACf,aAAa;QACb,aAAa;KACd;IAED,IAAI,EAAE;QACJ,YAAY;QACZ,SAAS;QACT,eAAe;QACf,UAAU;QACV,YAAY;QACZ,UAAU;QACV,SAAS;QACT,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,WAAW;QACX,YAAY;QACZ,WAAW;QACX,gBAAgB;QAChB,WAAW;QACX,aAAa;QACb,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,iBAAiB;QACjB,kBAAkB;QAClB,mBAAmB;QACnB,mBAAmB;QACnB,qBAAqB;QACrB,iBAAiB;QACjB,iBAAiB;QACjB,aAAa;QACb,YAAY;QACZ,cAAc;QACd,WAAW;QACX,WAAW;QACX,cAAc;QACd,WAAW;QACX,WAAW;QACX,aAAa;QACb,cAAc;QACd,YAAY;QACZ,aAAa;QACb,UAAU;QACV,eAAe;QACf,eAAe;QACf,aAAa;QACb,cAAc;QACd,aAAa;KACd;IAED,EAAE,EAAE;QACF,YAAY;QACZ,SAAS;QACT,eAAe;QACf,UAAU;QACV,YAAY;QACZ,UAAU;QACV,SAAS;QACT,YAAY;QACZ,UAAU;QACV,UAAU;QACV,cAAc;QACd,WAAW;QACX,YAAY;QACZ,WAAW;QACX,gBAAgB;QAChB,WAAW;QACX,aAAa;QACb,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,iBAAiB;QACjB,kBAAkB;QAClB,mBAAmB;QACnB,mBAAmB;QACnB,qBAAqB;QACrB,iBAAiB;QACjB,iBAAiB;QACjB,UAAU;QACV,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,aAAa;QACb,QAAQ;QACR,aAAa;QACb,QAAQ;QACR,SAAS;QACT,QAAQ;QACR,kBAAkB;QAClB,UAAU;QACV,eAAe;QACf,eAAe;QACf,aAAa;QACb,cAAc;QACd,aAAa;KACd;IAED,IAAI,EAAE,IAAI;CACX,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAsC;IAC3D,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC;IACrF,MAAM,EAAE;QACN,SAAS;QACT,SAAS;QACT,WAAW;QACX,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,cAAc;KACf;IACD,GAAG,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC;IAChD,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,CAAC;IACvE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;IACzB,IAAI,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,iBAAiB,CAAC;IACjD,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;IACnC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC;IAClD,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;IACtD,MAAM,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC;IACrE,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;IAChC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;IAC9B,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,CAAC,KAAK,CAAC;IAChB,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;IACxC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;IAChC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,CAAC;IACjE,GAAG,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC;IAChC,MAAM,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,CAAC;IACvD,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;IAC/B,EAAE,EAAE,CAAC,YAAY,EAAE,qBAAqB,EAAE,aAAa,EAAE,sBAAsB,CAAC;IAChF,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,KAAK,EAAE,CAAC,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,QAAgB;IACtE,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,sCAAsC;IAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,uDAAuD;AACvD,IAAI,YAA4C,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAEpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACrC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,YAAY,GAAG,IAAI,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAiB,CAAC;IACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,wDAAwD;QACxD,OAAO,CAAC,IAAI,CACV,2BAA2B,GAAG,CAAC,IAAI,EAAE,sBAAsB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CACzG,CAAC;QACF,YAAY,GAAG,IAAI,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,iCAAiC;QACjC,YAAY,GAAG,IAAI,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,YAAY,GAAG,SAAS,CAAC;AAC3B,CAAC"}

package/dist/runner.d.ts

@@ -7,9 +7,9 @@ export interface RunOptions {
      *  (e.g., `git commit --file -`) instead of passing it as a command arg,
      *  which avoids cmd.exe argument-length and newline limitations on Windows. */
     stdin?: string;
-    /** Override shell mode. Defaults to `true` on Windows (for .cmd/.bat wrappers)
-     *  and `false` elsewhere. Set to `false` for native executables (e.g., git)
-     *  whose args contain characters that cmd.exe would misinterpret (like `<>`). */
+    /** Override shell mode. Defaults to `false` on all platforms. On Windows,
+     *  .cmd/.bat wrappers are automatically handled via cmd.exe invocation without
+     *  shell mode. Set to `true` only when you need shell features (pipes, globs). */
     shell?: boolean;
     /** Maximum combined stdout+stderr buffer size in bytes. Defaults to 10 MB. */
     maxBuffer?: number;
@@ -45,14 +45,40 @@ export interface RunResult {
  * they are literal, and outside quotes they rarely appear in tool args.
  */
 export declare function escapeCmdArg(arg: string): string;
+/** Configuration for how to invoke `spawn()`. @internal — exported for testing only. */
+export interface SpawnConfig {
+    command: string;
+    args: string[];
+    shell: boolean;
+    windowsVerbatimArguments: boolean;
+}
+/**
+ * Determines how to spawn a command, handling Windows .cmd/.bat wrappers
+ * without using `shell: true` (which triggers CodeQL alert #16).
+ *
+ * @internal — Exported for unit testing only. Use `run()` instead.
+ *
+ * Branches:
+ *   1. Explicit `shell: true` — pass cmd directly, don't resolve (caller wants shell features)
+ *   2. Windows native .exe/.com — spawn resolved path directly
+ *   3. Windows non-exe (cmd/bat/extensionless/bare) — cmd.exe /d /s /c with windowsVerbatimArguments
+ *   4. Unix — spawn cmd directly, execvp handles PATH
+ */
+export declare function _buildSpawnConfig(cmd: string, args: string[], opts?: {
+    shell?: boolean;
+}, platform?: string, resolver?: (cmd: string) => string): SpawnConfig;
 /**
  * Executes a command and returns cleaned output with ANSI codes stripped.
  * Uses spawn (not exec) to avoid shell injection. The child is spawned in its
  * own process group (`detached: true` on Unix) so that on timeout we can kill
  * the entire group — preventing orphaned grandchild processes.
  *
- * On Windows, shell is enabled so that .cmd/.bat wrappers (like npx) can be
- * executed — args are still passed as an array so they remain properly escaped.
+ * Shell mode defaults to `false` on all platforms. On Windows, .cmd/.bat
+ * wrappers (like npm, npx) are automatically handled via cmd.exe invocation
+ * with windowsVerbatimArguments (cross-spawn pattern), avoiding shell injection.
+ *
+ * Callers can opt in to `shell: true` for shell features (pipes, globs),
+ * but this bypasses security protections — use only with trusted input.
  *
  * Throws on system-level errors (command not found, permission denied, timeout).
  * Normal non-zero exit codes are returned in the result, not thrown.

package/dist/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAIA,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;mFAE+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;qFAEiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;0FACsF;IACtF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAgCD,+FAA+F;AAC/F,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAqChD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA4JtF"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAiDA,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;mFAE+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;sFAEkF;IAClF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;0FACsF;IACtF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAgCD,+FAA+F;AAC/F,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAqChD;AAgDD,wFAAwF;AACxF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC1B,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAuB,GACjD,WAAW,CA2Cb;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAqJtF"}