@plannotator/pi-extension 0.28.38 → 0.28.40

package/generated/ai/providers/ask-ai-env.ts

@@ -0,0 +1,217 @@
+// @generated — DO NOT EDIT. Source: packages/ai/providers/ask-ai-env.ts
+/**
+ * The environment of every agent process Ask AI starts (Claude, Codex,
+ * OpenCode, Pi, Qwen Code): the live env with Plannotator's own integration
+ * switched off inside it.
+ *
+ * Ask AI drives an agent headlessly, and that agent loads the person's
+ * configuration, Plannotator's integration included: the Inbox MCP server
+ * (`plannotator inbox mcp`), the agent tool, and the plan hooks (Claude Code's
+ * ExitPlanMode PermissionRequest, the Codex Stop hook, Qwen Code's
+ * exit_plan_mode). Left on, a question could post to the person's Inbox or
+ * block on a plan review nobody is waiting for. So the child gets:
+ *
+ *  - `PLANNOTATOR_INBOX_TOOL=0` and `PLANNOTATOR_AGENT_TOOL=0`: the switches
+ *    the Claude Code mod, the OpenCode plugin and the Pi extension already
+ *    read, and which win over config.json (`resolveInboxTool` /
+ *    `resolveAgentTool` in packages/shared/config.ts).
+ *  - `PLANNOTATOR_ASK_AI_CHILD=1`: the marker the rest honours
+ *    (`isAskAiChild` in packages/shared/child-env.ts): the Inbox MCP shim
+ *    lists no tools, the plan-review hook (`plannotator` with no arguments)
+ *    exits 0 at once, and the OpenCode plugin stands down.
+ *
+ * Codex does not pass the env to a stdio MCP server, so codex-app-server.ts
+ * also turns the Inbox server off by config (`codexAskAiConfigArgs`, below).
+ * Claude sessions disallow it by name (claude-agent-sdk.ts).
+ *
+ * The review server's agent jobs (code review, Code Tour, Guided Review,
+ * `agent-jobs.ts` in both runtimes) get the same env and, for `codex exec`,
+ * the same `-c` override: none of them uses Plannotator's integration (each
+ * returns its result on stdout or in its `-o` file).
+ *
+ * Bun-free and Node-safe: vendored into the Pi extension.
+ */
+
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+
+/** The marker's name. Only the exact value "1" counts. */
+export const ASK_AI_CHILD_ENV = "PLANNOTATOR_ASK_AI_CHILD";
+
+/** What `askAiChildEnv` lays over the env it copies. */
+export const ASK_AI_CHILD_SWITCHES: Readonly<Record<string, string>> = {
+	PLANNOTATOR_INBOX_TOOL: "0",
+	PLANNOTATOR_AGENT_TOOL: "0",
+	[ASK_AI_CHILD_ENV]: "1",
+};
+
+/** A copy of `env` (default: the LIVE process.env) with Plannotator's integration off. */
+export function askAiChildEnv(
+	env: Readonly<Record<string, string | undefined>> = process.env,
+): Record<string, string | undefined> {
+	return { ...env, ...ASK_AI_CHILD_SWITCHES };
+}
+
+/**
+ * Run `start` with `ASK_AI_CHILD_SWITCHES` set on process.env, and put
+ * process.env back before returning. Only for a spawn API that takes no env
+ * and copies process.env synchronously inside the call: the OpenCode SDK's
+ * `createOpencodeServer` (its `cross-spawn` call with `{ ...process.env }`
+ * comes before its first await). JavaScript runs one call at a time, so no
+ * other code, a concurrent Ask AI start included, sees the change.
+ * `ask-ai-env.test.ts` runs the installed SDK against a fake `opencode` to
+ * keep that true.
+ */
+export function withAskAiChildEnv<T>(start: () => T): T {
+	const saved = Object.keys(ASK_AI_CHILD_SWITCHES).map((key) => [key, process.env[key]] as const);
+	Object.assign(process.env, ASK_AI_CHILD_SWITCHES);
+	try {
+		return start();
+	} finally {
+		for (const [key, value] of saved) {
+			if (value === undefined) delete process.env[key];
+			else process.env[key] = value;
+		}
+	}
+}
+
+/** The Inbox MCP server Plannotator connects to Codex (`INBOX_MCP_SERVER_NAME` in packages/server/inbox-agents.ts). */
+const CODEX_INBOX_SERVER = "plannotator-inbox";
+
+/**
+ * The global `-c` override every `codex app-server` that Ask AI starts gets,
+ * and every `codex exec` agent job of the review server (code review, Code
+ * Tour, Guided Review). It turns off the Inbox MCP server. The marker in the
+ * agent's env (`askAiChildEnv`) cannot do this, because Codex starts a stdio MCP server with
+ * a cleared environment that holds only HOME, PATH and a few others
+ * (codex-rs/rmcp-client `create_env_for_mcp_server`). Codex hooks get the
+ * whole env, so the Stop hook does see the marker.
+ *
+ * Codex deep-merges `-c` tables over config.toml and then rejects an entry
+ * that has both `command` and `url`, or neither. So:
+ *  - the person's entry has a `url` (the HTTP transport): only
+ *    `enabled=false`, because the entry already has its transport;
+ *  - otherwise: a whole disabled stdio server. It is merged over a stdio entry,
+ *    or added when there is none. Its own `env` carries the marker, so a Codex
+ *    that ignored `enabled` would still start a shim that lists no tools.
+ * `configTexts` is every config.toml Codex merges for the run
+ * (`readCodexConfigTexts`): a `url` in any of them, the person's or the
+ * project's, picks the first form. Gap, not handled (rare): Codex ignores the
+ * config of a project it does not trust, so a `url` entry only there, with no
+ * entry in `$CODEX_HOME`, leaves `enabled=false` with no transport, and Codex
+ * (without `--strict-config`) warns "Invalid configuration; using defaults."
+ * and runs that session or job on its default config. Literal strings and no
+ * spaces: the argument stays unquoted on the cmd.exe line of a Windows `.cmd`
+ * shim.
+ */
+export function codexAskAiConfigArgs(configTexts: string | null | readonly string[]): string[] {
+  const texts = configTexts === null ? [] : typeof configTexts === "string" ? [configTexts] : configTexts;
+  if (texts.some((text) => codexInboxEntryHasUrl(text))) {
+    return ["-c", `mcp_servers.${CODEX_INBOX_SERVER}.enabled=false`];
+  }
+  return [
+    "-c",
+    `mcp_servers.${CODEX_INBOX_SERVER}={command='plannotator',args=['inbox','mcp'],env={PLANNOTATOR_ASK_AI_CHILD='1'},enabled=false}`,
+  ];
+}
+
+/**
+ * The config.toml files Codex reads for a run in `cwd`, read only, the
+ * unreadable ones left out: `$CODEX_HOME/config.toml` (a relative CODEX_HOME
+ * resolved against `cwd`, as Codex does; else `~/.codex`), then the
+ * `.codex/config.toml` of each folder from `cwd` up to the project root, the
+ * nearest folder with a `.git` (a folder holding `HEAD`, or a worktree's
+ * file). With no root, only `cwd`'s. The `.codex` that is CODEX_HOME is not
+ * read twice. This is Codex's own walk (codex-rs/config `discover_project_root`
+ * and `discover_project_layers`), with its default `project_root_markers`.
+ */
+export function readCodexConfigTexts(cwd: string, env: Readonly<Record<string, string | undefined>> = process.env): string[] {
+  const start = resolve(cwd);
+  const home = env.CODEX_HOME?.trim();
+  const codexHome = home ? resolve(start, home) : join(homedir(), ".codex");
+  const dirs: string[] = [];
+  for (let dir = start; ; dir = dirname(dir)) {
+    dirs.push(dir);
+    if (isGitRoot(dir)) break;
+    if (dirname(dir) === dir) {
+      dirs.length = 1;
+      break;
+    }
+  }
+  const folders = [codexHome, ...dirs.map((dir) => join(dir, ".codex")).filter((dot) => dot !== codexHome)];
+  return folders.flatMap((folder) => {
+    try {
+      return [readFileSync(join(folder, "config.toml"), "utf8")];
+    } catch {
+      return [];
+    }
+  });
+}
+
+/** Whether `dir` holds a `.git` that Codex takes as the project root marker. */
+function isGitRoot(dir: string): boolean {
+  try {
+    const git = statSync(join(dir, ".git"));
+    return git.isFile() || (git.isDirectory() && existsSync(join(dir, ".git", "HEAD")));
+  } catch {
+    return false;
+  }
+}
+
+/** A TOML key (`a."b-c".d`) as its parts; null when the text is not a plain key. */
+function tomlKeyPath(text: string): string[] | null {
+  const part = /\s*(?:"((?:[^"\\]|\\.)*)"|'([^']*)'|([A-Za-z0-9_-]+))\s*(\.|$)/y;
+  const parts: string[] = [];
+  let at = 0;
+  while (at < text.length) {
+    part.lastIndex = at;
+    const match = part.exec(text);
+    if (!match) return null;
+    parts.push(match[1] ?? match[2] ?? match[3]!);
+    at = part.lastIndex;
+    if (match[4] !== ".") break;
+  }
+  return parts.length > 0 && at >= text.length ? parts : null;
+}
+
+/** The first key of each top-level member of an inline table (`{ url = "…", env = { … } }`). */
+function inlineTableKeys(value: string): string[] {
+  let inner = value.replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, '""').trim();
+  if (!inner.startsWith("{")) return [];
+  const close = inner.lastIndexOf("}");
+  inner = inner.slice(1, close < 0 ? undefined : close);
+  // Drop nested tables and arrays, innermost first, so only top-level members remain.
+  const nested = /[{[][^{}[\]]*[}\]]/;
+  while (nested.test(inner)) inner = inner.replace(new RegExp(nested.source, "g"), "");
+  return inner
+    .split(",")
+    .map((member) => tomlKeyPath(member.slice(0, Math.max(0, member.indexOf("="))))?.[0])
+    .filter((key): key is string => key !== undefined);
+}
+
+/**
+ * Whether config.toml's `mcp_servers.plannotator-inbox` has a `url`, in any
+ * form: its `[mcp_servers.plannotator-inbox]` table, an inline table, or
+ * dotted keys. A line scan, not a full TOML parser: something it cannot read
+ * counts as no `url`.
+ */
+export function codexInboxEntryHasUrl(configText: string): boolean {
+  let table: string[] = [];
+  for (const raw of configText.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const header = /^\[\[?([^\]]*)\]\]?\s*(?:#.*)?$/.exec(line);
+    if (header) {
+      table = tomlKeyPath(header[1]!) ?? [""];
+      continue;
+    }
+    const eq = line.indexOf("=");
+    const key = eq > 0 ? tomlKeyPath(line.slice(0, eq)) : null;
+    if (!key) continue;
+    const path = [...table, ...key];
+    if (path[0] !== "mcp_servers" || path[1] !== CODEX_INBOX_SERVER) continue;
+    if (path.length > 2 ? path[2] === "url" : inlineTableKeys(line.slice(eq + 1)).includes("url")) return true;
+  }
+  return false;
+}

package/generated/ai/providers/claude-agent-sdk.ts

@@ -30,6 +30,7 @@ import {
   type CatalogModel,
   type ClaudeSdkModelInfo,
 } from '../model-catalog.ts';
+import { askAiChildEnv } from "./ask-ai-env.ts";
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -162,8 +163,20 @@ interface ClaudeSDKQueryOptions {
   settingSources?: string[];
   effort?: string;
   strictMcpConfig?: boolean;
+  /** The whole env of the `claude` process (the SDK does not merge it with process.env). */
+  env: Record<string, string | undefined>;
+  disallowedTools: string[];
 }
 
+/**
+ * Removed from every Ask AI session whatever the person's settings allow: the
+ * Plannotator Inbox MCP server, by its whole-server name (`mcp__<server>`, a
+ * server-level spec the SDK's `disallowedTools` takes). This covers an
+ * HTTP-transport `plannotator-inbox` entry too, which the env marker
+ * (ask-ai-env.ts) cannot reach.
+ */
+const ASK_AI_DISALLOWED_TOOLS = ["mcp__plannotator-inbox"];
+
 // ---------------------------------------------------------------------------
 // Provider
 // ---------------------------------------------------------------------------
@@ -281,6 +294,7 @@ export class ClaudeAgentSDKProvider implements AIProvider {
           // option out, so the SDK loads every source, like the CLI.
           settingSources: [],
           strictMcpConfig: true,
+          env: askAiChildEnv(),
           ...(this.config.claudeExecutablePath && {
             pathToClaudeCodeExecutable: this.config.claudeExecutablePath,
           }),
@@ -462,10 +476,15 @@ class ClaudeAgentSDKSession extends BaseSession {
       ...(this.config.effort && { effort: this.config.effort }),
       maxTurns: this.config.maxTurns,
       allowedTools: this.config.allowedTools,
+      disallowedTools: ASK_AI_DISALLOWED_TOOLS,
       cwd: this.config.cwd,
       abortController: this._currentAbort!,
       includePartialMessages: true,
       persistSession: true,
+      // Plannotator's integration off in this `claude` (ask-ai-env.ts): the
+      // plugin's ExitPlanMode hook exits at once instead of opening a review.
+      // The SDK replaces the child's env with this, so it is the full live env.
+      env: askAiChildEnv(),
       ...(this.config.claudeExecutablePath && {
         pathToClaudeCodeExecutable: this.config.claudeExecutablePath,
       }),

package/generated/ai/providers/codex-app-server.ts

@@ -45,6 +45,7 @@ import {
   resolveWindowsCommandShim,
 } from "./command-path.ts";
 import { guardChildStreams, writeChildLine } from "./child-io.ts";
+import { askAiChildEnv, codexAskAiConfigArgs, readCodexConfigTexts } from "./ask-ai-env.ts";
 import { CODEX_FALLBACK_MODELS, cliVersionFrom, effortList, type CatalogModel } from '../model-catalog.ts';
 
 const PROVIDER_NAME = "codex-sdk";
@@ -68,6 +69,10 @@ const FILE_APPROVAL_METHOD = "item/fileChange/requestApproval";
 // response shape from the two above ({permissions} grant, not {decision}).
 const PERMISSIONS_APPROVAL_METHOD = "item/permissions/requestApproval";
 
+// The `-c` override that turns the Inbox MCP server off lives in
+// ask-ai-env.ts, so the review server's `codex exec` jobs use it too.
+export { codexAskAiConfigArgs, codexInboxEntryHasUrl, readCodexConfigTexts } from "./ask-ai-env.ts";
+
 // ---------------------------------------------------------------------------
 // Pure helpers (exported for testing)
 // ---------------------------------------------------------------------------
@@ -292,7 +297,7 @@ export function mapApprovalRequest(
 // JSON-RPC over stdio (bidirectional: responses, notifications, server requests)
 // ---------------------------------------------------------------------------
 
-type NotificationListener = (notification: { method: string; params: RpcMessage }) => void;
+type NotificationListener =(notification: { method: string; params: RpcMessage }) => void;
 type RequestHandler = (method: string, id: string | number, params: RpcMessage) => void;
 
 class CodexAppServerProcess {
@@ -327,18 +332,21 @@ class CodexAppServerProcess {
 
   private async doStart(codexPath: string, cwd: string, initTimeoutMs?: number): Promise<void> {
     const commandPath = resolveWindowsCommandShim(codexPath);
+    const appServerArgs = [...codexAskAiConfigArgs(readCodexConfigTexts(cwd)), "app-server"];
     const command =
-      buildWindowsCommandScriptSpawnCommand(commandPath, ["app-server"]) ?? [
+      buildWindowsCommandScriptSpawnCommand(commandPath, appServerArgs) ?? [
         commandPath,
-        "app-server",
+        ...appServerArgs,
       ];
 
     let proc: ChildProcess;
     try {
       const [file, ...args] = command;
       // stderr is "ignore", not "pipe": we never read it, and an un-drained
-      // stderr pipe deadlocks the child once its buffer fills.
-      proc = spawn(file, args, { cwd, stdio: ["pipe", "pipe", "ignore"] });
+      // stderr pipe deadlocks the child once its buffer fills. The env turns
+      // Plannotator's integration off in this Codex (ask-ai-env.ts): its hooks
+      // read the marker; the Inbox MCP server is off by the `-c` overrides.
+      proc = spawn(file, args, { cwd, env: askAiChildEnv(), stdio: ["pipe", "pipe", "ignore"] });
     } catch (err) {
       const error = err instanceof Error ? err : new Error(String(err));
       this.handleProcessEnd(error);

package/generated/ai/providers/opencode-sdk.ts

@@ -14,6 +14,7 @@
 import type { OpencodeClient } from "@opencode-ai/sdk";
 import { BaseSession } from "../base-session.ts";
 import { buildSystemPrompt } from "../context.ts";
+import { withAskAiChildEnv } from "./ask-ai-env.ts";
 import type {
 	AIMessage,
 	AIProvider,
@@ -93,11 +94,18 @@ export class OpenCodeProvider implements AIProvider {
 		// port. An explicitly configured port is still honored verbatim.
 		let server: { url: string; close: () => void };
 		try {
-			server = await createOpencodeServer({
-				hostname: this.config.hostname ?? "127.0.0.1",
-				port: this.config.port ?? 0,
-				timeout: 15_000,
-			});
+			// Plannotator's integration off in this `opencode serve`
+			// (ask-ai-env.ts): the Plannotator OpenCode plugin it loads reads
+			// process.env and stands down. The SDK takes no env, so the switches
+			// are set on process.env only for the synchronous part of the call,
+			// where the SDK copies it into the spawn.
+			server = await withAskAiChildEnv(() =>
+				createOpencodeServer({
+					hostname: this.config.hostname ?? "127.0.0.1",
+					port: this.config.port ?? 0,
+					timeout: 15_000,
+				}),
+			);
 		} catch (err: unknown) {
 			// A missing CLI is a spawn error with code ENOENT in every runtime
 			// (Node: "spawn opencode ENOENT"; Bun: "Executable not found in

package/generated/ai/providers/pi-events.ts

@@ -2,7 +2,7 @@
 /**
  * Pi event mapping — shared between Bun and Node.js Pi providers.
  *
- * Pure function, no runtime-specific dependencies.
+ * Pure functions, no runtime-specific dependencies.
  */
 
 import type { AIMessage } from "../types.ts";

package/generated/ai/providers/pi-sdk-node.ts

@@ -33,6 +33,7 @@ import {
 } from "./command-path.ts";
 import { createPiVersionProbe } from "./pi-version.ts";
 import { guardChildStreams, writeChildLine } from "./child-io.ts";
+import { askAiChildEnv } from "./ask-ai-env.ts";
 
 // Re-export mapPiEvent from shared (runtime-agnostic)
 export { mapPiEvent } from "./pi-events.ts";
@@ -77,6 +78,10 @@ export class PiProcessNode {
 			// (same reasoning as codex-app-server.ts).
 			proc = spawn(file, args, {
 				cwd,
+				// Plannotator's integration off in this throwaway Pi: Pi's RPC
+				// mode reports `ctx.hasUI`, so the Plannotator Pi extension would
+				// otherwise take it for a person's session (ask-ai-env.ts).
+				env: askAiChildEnv(),
 				stdio: ["pipe", "pipe", "ignore"],
 			});
 		} catch (err) {

package/generated/ai/providers/pi-sdk.ts

@@ -29,6 +29,7 @@ import {
 	resolveWindowsCommandShim,
 } from "./command-path.ts";
 import { createPiVersionProbe } from "./pi-version.ts";
+import { askAiChildEnv } from "./ask-ai-env.ts";
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -72,8 +73,11 @@ class PiProcess {
 				cwd,
 				// The LIVE env, never Bun's startup env (which still holds the
 				// variables the CLI scrubbed, like the bridge token): see
-				// packages/shared/child-env.ts.
-				env: { ...process.env },
+				// packages/shared/child-env.ts. Plannotator's integration off
+				// (ask-ai-env.ts): Pi's RPC mode reports `ctx.hasUI`, so the
+				// Plannotator Pi extension would otherwise take this throwaway
+				// process for a person's session and connect it to the Inbox.
+				env: askAiChildEnv(),
 				stdin: "pipe",
 				stdout: "pipe",
 				stderr: "ignore",

package/generated/ai/providers/qwen-sdk.ts

@@ -51,6 +51,7 @@ import {
 	resolveWindowsCommandShim,
 } from "./command-path.ts";
 import { guardChildStreams, toChildError, writeChildLine } from "./child-io.ts";
+import { askAiChildEnv } from "./ask-ai-env.ts";
 import { mapQwenLine, newQwenAskAISessionId } from "./qwen-events.ts";
 
 export { mapQwenLine, QWEN_ASK_AI_SESSION_PREFIX } from "./qwen-events.ts";
@@ -213,7 +214,10 @@ export class QwenProcess {
 		try {
 			proc = spawn(file!, rest, {
 				cwd,
-				env: { ...process.env },
+				// Plannotator's integration off in this Qwen (ask-ai-env.ts):
+				// the Inbox MCP server Plannotator adds to Qwen's settings.json
+				// inherits the env, and so lists no tools.
+				env: askAiChildEnv(),
 				stdio: ["pipe", "pipe", "pipe"],
 				windowsHide: true,
 			});

package/generated/call-flow-languages.ts

@@ -41,7 +41,9 @@ export interface CallFlowLanguageDefinition {
 const MB = 1024 * 1024;
 
 /**
- * CallDiff 0.4.1's supported extensions and pinned grammar packages.
+ * CallDiff 0.6.0's supported extensions and pinned grammar packages. Perl,
+ * new upstream in 0.6.0, is left out: tree-sitter-perl ships no prebuilt
+ * binaries, so a pack would need a C compiler on every machine.
  *
  * Size estimates describe Plannotator's pruned managed artifacts, not the
  * much larger npm tarball expansion. They are deliberately rounded up and
@@ -55,7 +57,7 @@ export const CALL_FLOW_LANGUAGES = [
   { id: "java", label: "Java", extensions: [".java"], kind: "pack", packageName: "tree-sitter-java", packageVersion: "0.23.5", installSizeBytes: 1 * MB },
   { id: "ruby", label: "Ruby", extensions: [".rb"], kind: "pack", packageName: "tree-sitter-ruby", packageVersion: "0.23.1", installSizeBytes: 3 * MB },
   { id: "c", label: "C", extensions: [".c", ".h"], kind: "pack", packageName: "tree-sitter-c", packageVersion: "0.24.1", installSizeBytes: 1 * MB },
-  { id: "cpp", label: "C++", extensions: [".cc", ".cpp", ".cxx", ".hpp", ".hh"], kind: "pack", packageName: "tree-sitter-cpp", packageVersion: "0.23.4", installSizeBytes: 4 * MB },
+  { id: "cpp", label: "C++", extensions: [".cc", ".cpp", ".cu", ".cuh", ".cxx", ".hpp", ".hh"], kind: "pack", packageName: "tree-sitter-cpp", packageVersion: "0.23.4", installSizeBytes: 4 * MB },
   { id: "csharp", label: "C#", extensions: [".cs"], kind: "pack", packageName: "tree-sitter-c-sharp", packageVersion: "0.23.1", installSizeBytes: 6 * MB },
   { id: "php", label: "PHP", extensions: [".php"], kind: "pack", packageName: "tree-sitter-php", packageVersion: "0.24.2", installSizeBytes: 17 * MB },
   { id: "kotlin", label: "Kotlin", extensions: [".kt", ".kts"], kind: "pack", packageName: "tree-sitter-kotlin", packageVersion: "0.3.8", installSizeBytes: 4 * MB },

package/generated/call-flow-runtime/package-lock.json

@@ -1,15 +1,15 @@
 {
   "name": "plannotator-call-flow-runtime",
-  "version": "0.4.1-plannotator.2",
+  "version": "0.6.0-plannotator.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "plannotator-call-flow-runtime",
-      "version": "0.4.1-plannotator.2",
+      "version": "0.6.0-plannotator.1",
       "dependencies": {
         "@types/node": "24.2.0",
-        "calldiff": "file:calldiff-a3194d20ca91ef6a314273d634e9b9c0db1c2707.tar.gz",
+        "calldiff": "file:calldiff-2086f6e4e9ed3c410bba7c94ca3dde77791b1956.tar.gz",
         "tree-sitter": "0.25.1",
         "tree-sitter-javascript": "0.25.0",
         "tree-sitter-typescript": "0.23.2",
@@ -64,9 +64,9 @@
       }
     },
     "node_modules/calldiff": {
-      "version": "0.4.1",
-      "resolved": "file:calldiff-a3194d20ca91ef6a314273d634e9b9c0db1c2707.tar.gz",
-      "integrity": "sha512-5y6tjre5UE00qPrVFPurnk9RBdk8WlRok+0w41lxLt1MyPLOlNUEaAT2/j/nz2xWlhDm3DfDYvW/5KBD2b9TLg==",
+      "version": "0.6.0",
+      "resolved": "file:calldiff-2086f6e4e9ed3c410bba7c94ca3dde77791b1956.tar.gz",
+      "integrity": "sha512-t+YCPz0WkETiwSOznwx3mLxVkEUe7DVACV+it2HJER7q/ha+K0IavN9IfBvP+7/ijzPXoUHgJIkAM/kg1O5S6A==",
       "license": "MIT",
       "dependencies": {
         "incur": "^0.4.26",
@@ -78,7 +78,7 @@
         "calldiff": "dist/cli.js"
       },
       "engines": {
-        "node": ">=22"
+        "node": ">=22.18.0"
       }
     },
     "node_modules/incur": {

package/generated/call-flow-runtime/package.json

@@ -1,11 +1,11 @@
 {
   "name": "plannotator-call-flow-runtime",
-  "version": "0.4.1-plannotator.2",
+  "version": "0.6.0-plannotator.1",
   "private": true,
   "description": "Managed offline runtime for Plannotator call-flow analysis",
   "dependencies": {
     "@types/node": "24.2.0",
-    "calldiff": "file:calldiff-a3194d20ca91ef6a314273d634e9b9c0db1c2707.tar.gz",
+    "calldiff": "file:calldiff-2086f6e4e9ed3c410bba7c94ca3dde77791b1956.tar.gz",
     "tree-sitter": "0.25.1",
     "tree-sitter-javascript": "0.25.0",
     "tree-sitter-typescript": "0.23.2",