@wrongstack/plugins 0.284.1 → 0.286.0

package/dist/index.js

@@ -1,14 +1,3 @@
-import { dirname, resolve, extname, isAbsolute, relative, join, basename } from 'path';
-import { execSync, execFileSync, execFile, spawn } from 'child_process';
-import * as fs from 'fs';
-import { readFileSync, writeFileSync, mkdirSync, statSync, watch, existsSync, readdirSync } from 'fs';
-import * as fsp from 'fs/promises';
-import { readFile, stat, mkdtemp, writeFile, rm } from 'fs/promises';
-import { expectDefined } from '@wrongstack/core';
-import { tmpdir } from 'os';
-import { randomUUID, createHash } from 'crypto';
-import { toErrorMessage } from '@wrongstack/core/utils';
-
 // src/agent-handoff/index.ts
 var API_VERSION = "^0.1.10";
 var state = {
@@ -305,6 +294,9 @@ var plugin = {
   }
 };
 var agent_handoff_default = plugin;
+
+// src/auto-doc/index.ts
+import { isAbsolute, relative, resolve } from "node:path";
 var AUTO_DOC_API_VERSION = "^0.1.10";
 function resolveProjectPath(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
@@ -491,10 +483,10 @@ async function runAutoDoc(input, api) {
       continue;
     }
     try {
-      const { readFileSync: readFileSync24, writeFileSync: writeFileSync8 } = await import('fs');
+      const { readFileSync: readFileSync25, writeFileSync: writeFileSync8 } = await import("node:fs");
       let content;
       try {
-        content = readFileSync24(safeFile, "utf-8");
+        content = readFileSync25(safeFile, "utf-8");
       } catch {
         api.log.warn(`auto-doc: could not read file ${safeFile}`);
         continue;
@@ -840,6 +832,9 @@ var plugin3 = {
   }
 };
 var auto_escalate_default = plugin3;
+
+// src/branch-guard/index.ts
+import { execFile } from "node:child_process";
 var API_VERSION2 = "^0.1.10";
 var state4 = {
   invocationCount: 0,
@@ -892,14 +887,14 @@ function hasDisabledPluginEntry(raw) {
   });
 }
 function runGit(args, cwd, signal) {
-  return new Promise((resolve34, reject) => {
+  return new Promise((resolve36, reject) => {
     execFile(
       "git",
       args,
       { encoding: "utf-8", timeout: 3e3, cwd, windowsHide: true, signal },
       (error, stdout) => {
         if (error) reject(error);
-        else resolve34(stdout);
+        else resolve36(stdout);
       }
     );
   });
@@ -1138,6 +1133,10 @@ var plugin4 = {
   }
 };
 var branch_guard_default = plugin4;
+
+// src/changelog-writer/index.ts
+import { readFileSync, writeFileSync } from "node:fs";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
 var state5 = {
   entries: [],
   filesTouched: /* @__PURE__ */ new Set(),
@@ -1154,10 +1153,10 @@ var DEFAULTS3 = {
   maxEntries: 200
 };
 function resolveProjectPath2(rawPath, cwd = process.cwd()) {
-  const root = resolve(cwd);
-  const resolved = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
-  const rel = relative(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel)) return resolved;
+  const root = resolve2(cwd);
+  const resolved = isAbsolute2(rawPath) ? resolve2(rawPath) : resolve2(root, rawPath);
+  const rel = relative2(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute2(rel)) return resolved;
   return null;
 }
 function readConfig4(raw) {
@@ -1512,6 +1511,11 @@ var plugin5 = {
   }
 };
 var changelog_writer_default = plugin5;
+
+// src/checkpoint/index.ts
+import { mkdirSync, readFileSync as readFileSync2, statSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { readFile, stat } from "node:fs/promises";
+import { dirname, isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3 } from "node:path";
 var state6 = {
   snapshots: [],
   nextId: 1,
@@ -1537,10 +1541,10 @@ function readConfig5(raw) {
   };
 }
 function resolveProjectPath3(rawPath, cwd = process.cwd()) {
-  const root = resolve(cwd);
-  const resolved = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
-  const rel = relative(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel)) return resolved;
+  const root = resolve3(cwd);
+  const resolved = isAbsolute3(rawPath) ? resolve3(rawPath) : resolve3(root, rawPath);
+  const rel = relative3(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute3(rel)) return resolved;
   return null;
 }
 function hashContent(s) {
@@ -1555,7 +1559,7 @@ function captureFile(path, maxBytes) {
   try {
     const st = statSync(path);
     if (st.size > maxBytes) return "too-large";
-    const content = readFileSync(path, "utf-8");
+    const content = readFileSync2(path, "utf-8");
     return { path, content, bytes: st.size };
   } catch {
     return { path, content: null, bytes: 0 };
@@ -1809,7 +1813,7 @@ var plugin6 = {
           }
           try {
             mkdirSync(dirname(f.path), { recursive: true });
-            writeFileSync(f.path, f.content);
+            writeFileSync2(f.path, f.content);
             restored.push(f.path);
           } catch (err) {
             errors.push({ path: f.path, error: err instanceof Error ? err.message : String(err) });
@@ -1950,7 +1954,8 @@ function parseCommitMessage(message, cfg) {
     errors.push(
       `Type "${type}" is not in allowedTypes: ${cfg.allowedTypes.join(", ")}. Standard types: ${STANDARD_TYPES.join(", ")}.`
     );
-  } else if (cfg.allowedTypes.length === 0 && !STANDARD_TYPES.includes(type)) ;
+  } else if (cfg.allowedTypes.length === 0 && !STANDARD_TYPES.includes(type)) {
+  }
   if (cfg.requireScope && !scope) {
     errors.push("A scope is required (e.g. feat(auth): ...).");
   }
@@ -2244,6 +2249,9 @@ Suggested rewrite (${suggest.model}):
   }
 };
 var commit_validator_default = plugin7;
+
+// src/config-validator/index.ts
+import { readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
 var state8 = {
   invocations: 0,
   filesChecked: 0,
@@ -2504,8 +2512,8 @@ var plugin8 = {
       if (!cfg.extensions.some((ext) => lower.endsWith(ext))) return;
       let text;
       try {
-        if (statSync(raw).size > cfg.maxFileBytes) return;
-        text = readFileSync(raw, "utf-8");
+        if (statSync2(raw).size > cfg.maxFileBytes) return;
+        text = readFileSync3(raw, "utf-8");
       } catch {
         return;
       }
@@ -2586,6 +2594,10 @@ var plugin8 = {
   }
 };
 var config_validator_default = plugin8;
+
+// src/context-pins/index.ts
+import * as fs from "node:fs";
+import { dirname as dirname2, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve4 } from "node:path";
 var state9 = {
   pins: [],
   nextId: 1,
@@ -2602,10 +2614,10 @@ var DEFAULTS7 = {
 };
 function resolveProjectPath4(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return "";
-  const root = resolve(cwd);
-  const resolved = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
-  const rel = relative(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel)) return resolved;
+  const root = resolve4(cwd);
+  const resolved = isAbsolute4(rawPath) ? resolve4(rawPath) : resolve4(root, rawPath);
+  const rel = relative4(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute4(rel)) return resolved;
   return null;
 }
 function readConfig8(raw) {
@@ -2635,7 +2647,7 @@ function loadPins(filePath) {
 function persistPins(filePath) {
   if (!filePath) return true;
   try {
-    fs.mkdirSync(dirname(filePath), { recursive: true });
+    fs.mkdirSync(dirname2(filePath), { recursive: true });
     fs.writeFileSync(filePath, JSON.stringify({ pins: state9.pins, nextId: state9.nextId }, null, 2));
     return true;
   } catch {
@@ -2829,6 +2841,9 @@ var plugin9 = {
   }
 };
 var context_pins_default = plugin9;
+
+// src/cost-tracker/index.ts
+import { expectDefined } from "@wrongstack/core";
 var API_VERSION4 = "^0.1.10";
 var PRICING = {
   "gpt-4o": { input: 5, output: 15 },
@@ -3786,15 +3801,19 @@ ${notes.map((n) => `  - ${n}`).join("\n")}`
   }
 };
 var dep_guard_default = plugin12;
+
+// src/diff-summary/index.ts
+import { execFileSync } from "node:child_process";
+import { isAbsolute as isAbsolute5, relative as relative5, resolve as resolve5 } from "node:path";
 var API_VERSION6 = "^0.1.10";
 function withinProject(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute5(p) ? resolve5(p) : resolve5(root, p);
+  const rel = relative5(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute5(rel)) return false;
   return true;
 }
 var state12 = {
@@ -4381,15 +4400,19 @@ ${errorLine ?? "(no error line)"}
   }
 };
 var error_lens_default = plugin14;
+
+// src/file-watcher/index.ts
+import { watch as fsWatch } from "node:fs";
+import { isAbsolute as isAbsolute6, relative as relative6, resolve as resolve6 } from "node:path";
 var API_VERSION7 = "^0.1.10";
 function withinProject2(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute6(p) ? resolve6(p) : resolve6(root, p);
+  const rel = relative6(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute6(rel)) return false;
   return true;
 }
 var watch_idCounter = 0;
@@ -4487,7 +4510,7 @@ var plugin15 = {
     }
     function safeWatchDir(dirPath, recursive, handle) {
       try {
-        const watcher = watch(dirPath, { recursive }, (eventType, filename) => {
+        const watcher = fsWatch(dirPath, { recursive }, (eventType, filename) => {
           if (!filename) return;
           const fullPath = `${dirPath}/${filename}`;
           const key = `${handle.id}:${fullPath}:${eventType}`;
@@ -4508,7 +4531,7 @@ var plugin15 = {
                   `index:${fullPath}`,
                   async () => {
                     try {
-                      const { enqueueReindex } = await import('@wrongstack/tools/codebase-index');
+                      const { enqueueReindex } = await import("@wrongstack/tools/codebase-index");
                       const root = safeIndexRoot || dirPath;
                       enqueueReindex({
                         projectRoot: root,
@@ -4692,15 +4715,20 @@ var plugin15 = {
   }
 };
 var file_watcher_default = plugin15;
+
+// src/format-on-save/index.ts
+import { execFileSync as execFileSync2, execSync } from "node:child_process";
+import { existsSync, statSync as statSync3 } from "node:fs";
+import { isAbsolute as isAbsolute7, relative as relative7, resolve as resolve7 } from "node:path";
 var API_VERSION8 = "^0.1.10";
 function withinProject3(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute7(p) ? resolve7(p) : resolve7(root, p);
+  const rel = relative7(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute7(rel)) return false;
   return true;
 }
 var state14 = {
@@ -4765,12 +4793,12 @@ function formatFile(filePath, timeoutMs) {
   if (!existsSync(filePath)) return null;
   let bytesBefore;
   try {
-    bytesBefore = statSync(filePath).size;
+    bytesBefore = statSync3(filePath).size;
   } catch {
     return null;
   }
   try {
-    execFileSync("npx", ["biome", "format", "--write", filePath], {
+    execFileSync2("npx", ["biome", "format", "--write", filePath], {
       encoding: "utf-8",
       timeout: timeoutMs,
       cwd: process.cwd(),
@@ -4782,7 +4810,7 @@ function formatFile(filePath, timeoutMs) {
   }
   let bytesAfter;
   try {
-    bytesAfter = statSync(filePath).size;
+    bytesAfter = statSync3(filePath).size;
   } catch {
     return null;
   }
@@ -4790,7 +4818,7 @@ function formatFile(filePath, timeoutMs) {
     return { changed: true, bytesBefore, bytesAfter };
   }
   try {
-    execFileSync("npx", ["biome", "format", filePath], {
+    execFileSync2("npx", ["biome", "format", filePath], {
       encoding: "utf-8",
       timeout: timeoutMs,
       cwd: process.cwd(),
@@ -4985,6 +5013,10 @@ var plugin16 = {
   }
 };
 var format_on_save_default = plugin16;
+
+// src/git-autocommit/index.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { existsSync as existsSync2 } from "node:fs";
 var API_VERSION9 = "^0.1.10";
 var commitCount = { value: 0 };
 var lastCommit = { hash: null, at: null };
@@ -4993,7 +5025,7 @@ var DEFAULT_GIT_TIMEOUT_MS = 3e4;
 var GIT_COMMIT_TIMEOUT_MS = 5 * 6e4;
 function runGit2(args, cwd, timeoutMs = DEFAULT_GIT_TIMEOUT_MS) {
   try {
-    return execFileSync("git", args, {
+    return execFileSync3("git", args, {
       encoding: "utf-8",
       cwd,
       stdio: ["pipe", "pipe", "pipe"],
@@ -5019,7 +5051,7 @@ function stageFiles(files, cwd) {
   if (!files || !Array.isArray(files)) return;
   const existing = files.filter((f) => {
     try {
-      return existsSync(f);
+      return existsSync2(f);
     } catch {
       return false;
     }
@@ -5441,14 +5473,19 @@ ${preCommitDiff}
   }
 };
 var git_autocommit_default = plugin17;
+
+// src/import-organizer/index.ts
+import { spawn } from "node:child_process";
+import { existsSync as existsSync3, statSync as statSync4 } from "node:fs";
+import { basename, isAbsolute as isAbsolute8, relative as relative8, resolve as resolve8 } from "node:path";
 function withinProject4(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute8(p) ? resolve8(p) : resolve8(root, p);
+  const rel = relative8(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute8(rel)) return false;
   return true;
 }
 var ALLOWED_FIRST_TOKENS = /* @__PURE__ */ new Set([
@@ -5470,12 +5507,12 @@ function resolveAllowedCommand(command) {
   if (ALLOWED_FIRST_TOKENS.has(head)) {
     return { cmd: head, args: tokens.slice(1) };
   }
-  if (isAbsolute(head)) {
+  if (isAbsolute8(head)) {
     if (!withinProject4(head)) return null;
     const base = basename(head);
     if (ALLOWED_FIRST_TOKENS.has(base)) return { cmd: head, args: tokens.slice(1) };
   }
-  if (!isAbsolute(head) && withinProject4(head)) {
+  if (!isAbsolute8(head) && withinProject4(head)) {
     const base = basename(head);
     if (ALLOWED_FIRST_TOKENS.has(base)) return { cmd: head, args: tokens.slice(1) };
   }
@@ -5511,7 +5548,7 @@ function readConfig13(raw) {
   };
 }
 function runCommand(command, args, timeoutMs, cwd) {
-  return new Promise((resolve34) => {
+  return new Promise((resolve36) => {
     let timedOut = false;
     const stdoutChunks = [];
     const stderrChunks = [];
@@ -5523,17 +5560,17 @@ function runCommand(command, args, timeoutMs, cwd) {
         signal: AbortSignal.timeout(timeoutMs)
       });
     } catch {
-      resolve34({ code: 127, stdout: "", stderr: "", timedOut: false });
+      resolve36({ code: 127, stdout: "", stderr: "", timedOut: false });
       return;
     }
     child.stdout?.on("data", (c) => stdoutChunks.push(c));
     child.stderr?.on("data", (c) => stderrChunks.push(c));
     child.on("error", () => {
-      resolve34({ code: 127, stdout: "", stderr: "", timedOut: false });
+      resolve36({ code: 127, stdout: "", stderr: "", timedOut: false });
     });
     child.on("close", (code) => {
       if (timedOut) return;
-      resolve34({
+      resolve36({
         code,
         stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
         stderr: Buffer.concat(stderrChunks).toString("utf-8"),
@@ -5542,16 +5579,16 @@ function runCommand(command, args, timeoutMs, cwd) {
     });
     child.on("abort", () => {
       timedOut = true;
-      resolve34({ code: null, stdout: "", stderr: "", timedOut: true });
+      resolve36({ code: null, stdout: "", stderr: "", timedOut: true });
     });
   });
 }
 async function organizeImports(filePath, cfg, cwd) {
   if (!withinProject4(filePath)) return null;
-  if (!existsSync(filePath)) return null;
+  if (!existsSync3(filePath)) return null;
   let bytesBefore;
   try {
-    bytesBefore = statSync(filePath).size;
+    bytesBefore = statSync4(filePath).size;
   } catch {
     return null;
   }
@@ -5572,7 +5609,7 @@ async function organizeImports(filePath, cfg, cwd) {
   if (result.code === 127) return null;
   let bytesAfter;
   try {
-    bytesAfter = statSync(filePath).size;
+    bytesAfter = statSync4(filePath).size;
   } catch {
     return null;
   }
@@ -5972,6 +6009,10 @@ var plugin19 = {
   }
 };
 var injection_shield_default = plugin19;
+
+// src/knowledge-graph/index.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname3, isAbsolute as isAbsolute9, relative as relative9, resolve as resolve9 } from "node:path";
 var API_VERSION11 = "^0.1.10";
 var state17 = {
   facts: [],
@@ -5992,10 +6033,10 @@ var DEFAULTS14 = {
 };
 function resolveProjectPath5(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
-  const root = resolve(cwd);
-  const resolved = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
-  const rel = relative(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel)) return resolved;
+  const root = resolve9(cwd);
+  const resolved = isAbsolute9(rawPath) ? resolve9(rawPath) : resolve9(root, rawPath);
+  const rel = relative9(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute9(rel)) return resolved;
   return null;
 }
 function readConfig15(raw) {
@@ -6013,7 +6054,7 @@ function readConfig15(raw) {
 function loadFacts(filePath) {
   if (!filePath) return { facts: [], nextId: 1 };
   try {
-    const raw = JSON.parse(readFileSync(filePath, "utf-8"));
+    const raw = JSON.parse(readFileSync5(filePath, "utf-8"));
     const facts = Array.isArray(raw.facts) ? raw.facts.filter(
       (f) => !!f && typeof f === "object" && typeof f.id === "string" && typeof f.subject === "string" && typeof f.relation === "string" && typeof f.object === "string"
     ) : [];
@@ -6026,8 +6067,8 @@ function loadFacts(filePath) {
 function persistFacts(filePath) {
   if (!filePath) return true;
   try {
-    mkdirSync(dirname(filePath), { recursive: true });
-    writeFileSync(
+    mkdirSync3(dirname3(filePath), { recursive: true });
+    writeFileSync4(
       filePath,
       JSON.stringify({ facts: state17.facts, nextId: state17.nextId }, null, 2)
     );
@@ -6291,6 +6332,12 @@ var plugin20 = {
   }
 };
 var knowledge_graph_default = plugin20;
+
+// src/lint-gate/index.ts
+import { execFile as execFile2 } from "node:child_process";
+import { mkdtemp, readFile as readFile2, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 var API_VERSION12 = "^0.1.10";
 var state18 = {
   /** Total PreToolUse invocations. */
@@ -6328,9 +6375,9 @@ function executable(command) {
   return process.platform === "win32" && command === "npx" ? "npx.cmd" : command;
 }
 function runCommand2(command, args, timeoutMs, signal) {
-  return new Promise((resolve34) => {
+  return new Promise((resolve36) => {
     try {
-      execFile(
+      execFile2(
         executable(command),
         args,
         {
@@ -6341,10 +6388,10 @@ function runCommand2(command, args, timeoutMs, signal) {
           maxBuffer: 2 * 1024 * 1024,
           ...signal ? { signal } : {}
         },
-        (error, stdout) => resolve34({ stdout, error })
+        (error, stdout) => resolve36({ stdout, error })
       );
     } catch (err) {
-      resolve34({ stdout: "", error: err instanceof Error ? err : new Error(String(err)) });
+      resolve36({ stdout: "", error: err instanceof Error ? err : new Error(String(err)) });
     }
   });
 }
@@ -6392,7 +6439,7 @@ async function lintAndFix(content, filePath, linter, timeoutMs, signal) {
     const fixArgs = linter.name === "biome" ? ["biome", "check", "--write", tmpFile] : ["eslint", "--fix", tmpFile];
     await runCommand2(linter.cmd, fixArgs, timeoutMs, signal);
     if (signal.aborted) throw signal.reason;
-    return await readFile(tmpFile, "utf-8");
+    return await readFile2(tmpFile, "utf-8");
   } catch {
     if (signal.aborted) throw signal.reason;
     return content;
@@ -6519,7 +6566,7 @@ var plugin21 = {
         const newStr = inp["new_string"];
         if (typeof oldStr !== "string" || typeof newStr !== "string") return;
         try {
-          const current = await readFile(filePath, "utf-8");
+          const current = await readFile2(filePath, "utf-8");
           content = applyEdit(current, oldStr, newStr);
         } catch {
           return;
@@ -6713,6 +6760,9 @@ ${summary}${truncated}`
   }
 };
 var lint_gate_default = plugin21;
+
+// src/llm-cache/index.ts
+import { createHash } from "node:crypto";
 var state19 = {
   cache: /* @__PURE__ */ new Map(),
   hits: 0,
@@ -6964,6 +7014,9 @@ var plugin22 = {
   }
 };
 var llm_cache_default = plugin22;
+
+// src/loop-breaker/index.ts
+import { execFile as execFile3 } from "node:child_process";
 var state20 = {
   lastFingerprint: null,
   streak: 0,
@@ -7059,8 +7112,8 @@ function hashString2(value) {
 }
 async function gitDiffFingerprint(cwd, signal) {
   try {
-    const diff = await new Promise((resolve34, reject) => {
-      execFile(
+    const diff = await new Promise((resolve36, reject) => {
+      execFile3(
         "git",
         ["diff", "--no-ext-diff", "--"],
         {
@@ -7076,7 +7129,7 @@ async function gitDiffFingerprint(cwd, signal) {
         },
         (error, stdout) => {
           if (error) reject(error);
-          else resolve34(stdout);
+          else resolve36(stdout);
         }
       );
     });
@@ -8330,6 +8383,11 @@ function readConfig22(raw) {
   };
 }
 var plugin_stack_observer_default = PLUGIN;
+
+// src/pr-drafter/index.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname4, isAbsolute as isAbsolute10, relative as relative10, resolve as resolve10 } from "node:path";
 var API_VERSION13 = "^0.1.10";
 var state25 = {
   commits: [],
@@ -8368,15 +8426,15 @@ function readConfig23(raw) {
 }
 function resolveProjectPath6(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
-  const root = resolve(cwd);
-  const resolved = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
-  const rel = relative(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel)) return resolved;
+  const root = resolve10(cwd);
+  const resolved = isAbsolute10(rawPath) ? resolve10(rawPath) : resolve10(root, rawPath);
+  const rel = relative10(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute10(rel)) return resolved;
   return null;
 }
 function gitBranch() {
   try {
-    const out = execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    const out = execFileSync4("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
       encoding: "utf-8",
       cwd: process.cwd(),
       stdio: ["pipe", "pipe", "ignore"],
@@ -8389,7 +8447,7 @@ function gitBranch() {
 }
 function gitDiff() {
   try {
-    return execFileSync("git", ["diff", "--stat"], {
+    return execFileSync4("git", ["diff", "--stat"], {
       encoding: "utf-8",
       cwd: process.cwd(),
       stdio: ["pipe", "pipe", "ignore"],
@@ -8458,8 +8516,8 @@ async function writeDraft(cfg, llm) {
   }
   const draft = await buildDraft(cfg, llm);
   try {
-    mkdirSync(dirname(resolved), { recursive: true });
-    writeFileSync(resolved, draft.body);
+    mkdirSync4(dirname4(resolved), { recursive: true });
+    writeFileSync5(resolved, draft.body);
     state25.draftsWritten += 1;
   } catch {
     state25.draftErrors += 1;
@@ -8585,8 +8643,8 @@ var plugin27 = {
         const resolved = resolveProjectPath6(cfg.outputPath);
         if (!resolved) return { ok: false, error: "outputPath resolves outside project" };
         try {
-          mkdirSync(dirname(resolved), { recursive: true });
-          writeFileSync(resolved, draft.body);
+          mkdirSync4(dirname4(resolved), { recursive: true });
+          writeFileSync5(resolved, draft.body);
           state25.draftsWritten += 1;
           return {
             ok: true,
@@ -9374,13 +9432,20 @@ var plugin29 = {
   }
 };
 var secret_scanner_default = plugin29;
+
+// src/semver-bump/index.ts
+import { expectDefined as expectDefined2 } from "@wrongstack/core";
+import { toErrorMessage } from "@wrongstack/core/utils";
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync6, readdirSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { isAbsolute as isAbsolute11, join as join2, relative as relative11, resolve as resolve11 } from "node:path";
 var API_VERSION14 = "^0.1.10";
 function resolveProjectRoot(rawCwd, root = process.cwd()) {
   if (typeof rawCwd !== "string" || rawCwd.length === 0) return root;
-  const base = resolve(root);
-  const resolved = isAbsolute(rawCwd) ? resolve(rawCwd) : resolve(base, rawCwd);
-  const rel = relative(base, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel)) return resolved;
+  const base = resolve11(root);
+  const resolved = isAbsolute11(rawCwd) ? resolve11(rawCwd) : resolve11(base, rawCwd);
+  const rel = relative11(base, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute11(rel)) return resolved;
   return null;
 }
 var state28 = {
@@ -9393,7 +9458,7 @@ var state28 = {
 };
 function runGit3(args, cwd) {
   try {
-    return execFileSync("git", args, {
+    return execFileSync5("git", args, {
       encoding: "utf-8",
       cwd,
       stdio: ["pipe", "pipe", "pipe"],
@@ -9408,24 +9473,24 @@ function runGit3(args, cwd) {
 }
 function getPackageJson(cwd) {
   const path = cwd ? `${cwd}/package.json` : "package.json";
-  if (!existsSync(path)) return null;
+  if (!existsSync4(path)) return null;
   try {
-    return JSON.parse(readFileSync(path, "utf-8"));
+    return JSON.parse(readFileSync6(path, "utf-8"));
   } catch {
     return null;
   }
 }
 function collectManifests(root) {
   const paths = [];
-  const rootPkg = join(root, "package.json");
-  if (existsSync(rootPkg)) paths.push(rootPkg);
+  const rootPkg = join2(root, "package.json");
+  if (existsSync4(rootPkg)) paths.push(rootPkg);
   for (const group of ["packages", "apps"]) {
-    const groupDir = join(root, group);
-    if (!existsSync(groupDir)) continue;
+    const groupDir = join2(root, group);
+    if (!existsSync4(groupDir)) continue;
     for (const entry of readdirSync(groupDir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
-      const candidate = join(groupDir, entry.name, "package.json");
-      if (existsSync(candidate)) paths.push(candidate);
+      const candidate = join2(groupDir, entry.name, "package.json");
+      if (existsSync4(candidate)) paths.push(candidate);
     }
   }
   return paths;
@@ -9434,9 +9499,9 @@ function parseVersion(v) {
   const m = v.match(/^v?(\d+)\.(\d+)\.(\d+)/);
   if (!m) return [0, 0, 0];
   return [
-    Number.parseInt(expectDefined(m[1]), 10),
-    Number.parseInt(expectDefined(m[2]), 10),
-    Number.parseInt(expectDefined(m[3]), 10)
+    Number.parseInt(expectDefined2(m[1]), 10),
+    Number.parseInt(expectDefined2(m[2]), 10),
+    Number.parseInt(expectDefined2(m[3]), 10)
   ];
 }
 function bumpVersion(version, part) {
@@ -9615,11 +9680,11 @@ var plugin30 = {
         };
       }
       const root = cwd ?? process.cwd();
-      const bumpScript = join(root, "scripts", "bump-version.mjs");
+      const bumpScript = join2(root, "scripts", "bump-version.mjs");
       const changed = collectManifests(root);
-      if (existsSync(bumpScript)) {
+      if (existsSync4(bumpScript)) {
         try {
-          execFileSync(process.execPath, [bumpScript, "set", newVersion], {
+          execFileSync5(process.execPath, [bumpScript, "set", newVersion], {
             cwd: root,
             stdio: ["pipe", "pipe", "pipe"],
             timeout: 3e4,
@@ -9630,14 +9695,14 @@ var plugin30 = {
           return { ok: false, error: `bump script failed: ${msg}` };
         }
         for (const rel of ["package.json", "package-lock.json", "src/lib/utils.ts", "index.html"]) {
-          const p = join(root, "website", rel);
-          if (existsSync(p)) changed.push(p);
+          const p = join2(root, "website", rel);
+          if (existsSync4(p)) changed.push(p);
         }
       } else {
         for (const manifest of changed) {
-          const pkgData = JSON.parse(readFileSync(manifest, "utf-8"));
+          const pkgData = JSON.parse(readFileSync6(manifest, "utf-8"));
           pkgData.version = newVersion;
-          writeFileSync(manifest, JSON.stringify(pkgData, null, 2) + "\n", "utf-8");
+          writeFileSync6(manifest, JSON.stringify(pkgData, null, 2) + "\n", "utf-8");
         }
       }
       try {
@@ -9969,7 +10034,7 @@ async function readTranscriptTail(transcriptPath, n) {
   if (!transcriptPath || n <= 0) return [];
   let raw;
   try {
-    const { readFile: readFile6 } = await import('fs/promises');
+    const { readFile: readFile6 } = await import("node:fs/promises");
     raw = await readFile6(transcriptPath, "utf-8");
   } catch {
     return [];
@@ -10071,7 +10136,8 @@ var plugin31 = {
         const p = payload;
         const toolName = p?.tool ?? p?.name ?? eventName;
         if (typeof toolName === "string") bumpToolCount(toolName);
-        if (toolName === "git_autocommit" || toolName.startsWith("git ")) ;
+        if (toolName === "git_autocommit" || toolName.startsWith("git ")) {
+        }
       });
       state29.eventUnsubscribers.push(offTool);
       const offResult = api.onPattern("tool.result", (_event, payload) => {
@@ -10306,14 +10372,19 @@ Tokens: ${recap.tokens.total.input} in / ${recap.tokens.total.output} out
   }
 };
 var session_recap_default = plugin31;
+
+// src/shell-check/index.ts
+import { execFileSync as execFileSync6, execSync as execSync2 } from "node:child_process";
+import { existsSync as existsSync5, readdirSync as readdirSync2 } from "node:fs";
+import { isAbsolute as isAbsolute12, join as join3, relative as relative12, resolve as resolve12 } from "node:path";
 var API_VERSION15 = "^0.1.10";
 function withinProject5(p) {
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute12(p) ? resolve12(p) : resolve12(root, p);
+  const rel = relative12(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute12(rel)) return false;
   return true;
 }
 var MAX_PATH_LEN = 4096;
@@ -10326,9 +10397,9 @@ var state30 = {
   lastRun: null
 };
 function runShellCheck(files, severity, cwd) {
-  if (!existsSync("shellcheck")) {
+  if (!existsSync5("shellcheck")) {
     try {
-      execSync("shellcheck --version", { encoding: "utf-8", stdio: "ignore", windowsHide: true });
+      execSync2("shellcheck --version", { encoding: "utf-8", stdio: "ignore", windowsHide: true });
     } catch {
       throw new Error(
         "shellcheck is not installed. Install via: apt install shellcheck / brew install shellcheck"
@@ -10345,7 +10416,7 @@ function runShellCheck(files, severity, cwd) {
   const args = ["-f", "json", "-S", severityFlag, ...files];
   let raw;
   try {
-    raw = execFileSync("shellcheck", args, {
+    raw = execFileSync6("shellcheck", args, {
       encoding: "utf-8",
       cwd,
       stdio: ["pipe", "pipe", "pipe"],
@@ -10378,9 +10449,9 @@ function runShellCheck(files, severity, cwd) {
 function findShellFiles(dir, pattern) {
   const results = [];
   try {
-    const entries = readdirSync(dir, { withFileTypes: true });
+    const entries = readdirSync2(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = join(dir, entry.name);
+      const full = join3(dir, entry.name);
       if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== ".git") {
         results.push(...findShellFiles(full, pattern));
       } else if (entry.isFile() && (entry.name.endsWith(".sh") || entry.name === "Dockerfile")) {
@@ -10579,6 +10650,12 @@ var plugin32 = {
   }
 };
 var shell_check_default = plugin32;
+
+// src/spec-linker/index.ts
+import * as fs3 from "node:fs/promises";
+
+// src/template-engine/index.ts
+import { isAbsolute as isAbsolute13 } from "node:path";
 var API_VERSION16 = "^0.1.10";
 var templates = /* @__PURE__ */ new Map();
 function expandTemplate(template, variables) {
@@ -10625,7 +10702,7 @@ function renderTemplateRaw(template, variables) {
   return result;
 }
 function validateRelativeTemplatePath(field, value) {
-  if (isAbsolute(value) || value.split(/[\\/]+/).includes("..")) {
+  if (isAbsolute13(value) || value.split(/[\\/]+/).includes("..")) {
     return `${field} must be a relative path without ".." components`;
   }
   return null;
@@ -10698,7 +10775,7 @@ var plugin33 = {
         if (output_path) {
           const pathError = validateRelativeTemplatePath("output_path", output_path);
           if (pathError) return { ok: false, error: pathError };
-          const { writeFileSync: writeFileSync8 } = await import('fs');
+          const { writeFileSync: writeFileSync8 } = await import("node:fs");
           writeFileSync8(output_path, result, "utf-8");
           return {
             ok: true,
@@ -10752,8 +10829,8 @@ var plugin33 = {
         }
         let content;
         try {
-          const { readFileSync: readFileSync24 } = await import('fs');
-          content = readFileSync24(template_path, "utf-8");
+          const { readFileSync: readFileSync25 } = await import("node:fs");
+          content = readFileSync25(template_path, "utf-8");
         } catch (err) {
           return { ok: false, error: `Could not read template file: ${err}` };
         }
@@ -10766,7 +10843,7 @@ var plugin33 = {
         if (output_path) {
           const pathError = validateRelativeTemplatePath("output_path", output_path);
           if (pathError) return { ok: false, error: pathError };
-          const { writeFileSync: writeFileSync8 } = await import('fs');
+          const { writeFileSync: writeFileSync8 } = await import("node:fs");
           writeFileSync8(output_path, result, "utf-8");
           return {
             ok: true,
@@ -10884,6 +10961,10 @@ var plugin33 = {
   }
 };
 var template_engine_default = plugin33;
+
+// src/test-coverage-gate/index.ts
+import { readFileSync as readFileSync7 } from "node:fs";
+import { isAbsolute as isAbsolute14, relative as relative13, resolve as resolve13 } from "node:path";
 var API_VERSION17 = "^0.1.10";
 var state31 = {
   invocationCount: 0,
@@ -10919,16 +11000,16 @@ function readConfig27(raw) {
 function withinProject6(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute14(p) ? resolve13(p) : resolve13(root, p);
+  const rel = relative13(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute14(rel)) return false;
   return true;
 }
 function readCoverageSummary(coveragePath) {
   try {
-    const raw = readFileSync(coveragePath, "utf-8");
+    const raw = readFileSync7(coveragePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -11141,6 +11222,11 @@ var plugin34 = {
   }
 };
 var test_coverage_gate_default = plugin34;
+
+// src/test-runner-gate/index.ts
+import { execFileSync as execFileSync7, execSync as execSync3 } from "node:child_process";
+import { existsSync as existsSync6 } from "node:fs";
+import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute15, join as join4, relative as relative14, resolve as resolve14 } from "node:path";
 var API_VERSION18 = "^0.1.10";
 var state32 = {
   invocationCount: 0,
@@ -11209,11 +11295,11 @@ var lastPassedHash = /* @__PURE__ */ new Map();
 function withinProject7(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute15(p) ? resolve14(p) : resolve14(root, p);
+  const rel = relative14(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute15(rel)) return false;
   return true;
 }
 var ALLOWED_COMMAND_TOKENS = /* @__PURE__ */ new Set([
@@ -11231,9 +11317,9 @@ var ALLOWED_COMMAND_TOKENS = /* @__PURE__ */ new Set([
   // by basename in resolveAllowedCommand().
 ]);
 function resolveTestFiles(sourcePath, patterns) {
-  const name = basename(sourcePath).replace(/\.[^.]+$/, "");
+  const name = basename2(sourcePath).replace(/\.[^.]+$/, "");
   const pathNoExt = sourcePath.replace(/\.[^.]+$/, "");
-  const dir = dirname(sourcePath);
+  const dir = dirname5(sourcePath);
   const candidates = [];
   for (const pattern of patterns) {
     const candidate = pattern.replace(/\{name\}/g, name).replace(/\{path\}/g, pathNoExt).replace(/\{dir\}/g, dir);
@@ -11242,7 +11328,7 @@ function resolveTestFiles(sourcePath, patterns) {
         candidates.push(candidate);
       } else {
         candidates.push(candidate);
-        candidates.push(join(dir, candidate));
+        candidates.push(join4(dir, candidate));
       }
     }
   }
@@ -11251,7 +11337,7 @@ function resolveTestFiles(sourcePath, patterns) {
 function findTestFile(sourcePath, patterns) {
   const candidates = resolveTestFiles(sourcePath, patterns);
   for (const candidate of candidates) {
-    if (existsSync(candidate)) return candidate;
+    if (existsSync6(candidate)) return candidate;
   }
   return null;
 }
@@ -11265,7 +11351,7 @@ function detectRunner(requested) {
     const match = candidates.find((c) => c.name === requested);
     if (!match) return null;
     try {
-      execSync(`npx ${match.name} --version`, {
+      execSync3(`npx ${match.name} --version`, {
         encoding: "utf-8",
         timeout: 5e3,
         cwd: process.cwd(),
@@ -11278,7 +11364,7 @@ function detectRunner(requested) {
   }
   for (const candidate of candidates) {
     try {
-      execSync(`npx ${candidate.name} --version`, {
+      execSync3(`npx ${candidate.name} --version`, {
         encoding: "utf-8",
         timeout: 5e3,
         cwd: process.cwd(),
@@ -11297,9 +11383,9 @@ function resolveAllowedCommand2(customCommand) {
   if (ALLOWED_COMMAND_TOKENS.has(head)) {
     return { cmd: head, args: tokens.slice(1) };
   }
-  if (isAbsolute(head)) {
+  if (isAbsolute15(head)) {
     if (!withinProject7(head)) return null;
-    const base = basename(head);
+    const base = basename2(head);
     if (ALLOWED_COMMAND_TOKENS.has(base)) {
       return { cmd: head, args: tokens.slice(1) };
     }
@@ -11327,7 +11413,7 @@ function runTests(testFile, runner, customCommand, timeoutMs) {
   const fullArgs = [...cmdArgs, ...trailing];
   let stdout = "";
   try {
-    stdout = execFileSync(cmd, fullArgs, {
+    stdout = execFileSync7(cmd, fullArgs, {
       encoding: "utf-8",
       timeout: timeoutMs,
       cwd: process.cwd(),
@@ -11622,6 +11708,201 @@ Fix the failing tests or revert the change if it broke something.`
   }
 };
 var test_runner_gate_default = plugin35;
+
+// src/type-gate/index.ts
+import { execFileSync as execFileSync8 } from "node:child_process";
+import { existsSync as existsSync7 } from "node:fs";
+import { isAbsolute as isAbsolute17, relative as relative16, resolve as resolve16 } from "node:path";
+
+// src/runtime/index.ts
+import { execFile as execFile4 } from "node:child_process";
+import { basename as basename3, isAbsolute as isAbsolute16, relative as relative15, resolve as resolve15 } from "node:path";
+var META_CHARS = /["'`;&|<>\r\n]/;
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+function hasLeadingDash(arg) {
+  return arg.length > 0 && arg.startsWith("-");
+}
+function safeSplit(command) {
+  const trimmed = command.trim();
+  if (!trimmed || META_CHARS.test(trimmed)) return null;
+  return trimmed.split(/\s+/).filter(Boolean);
+}
+function withinProjectPath(projectRoot, candidate) {
+  if (candidate.length === 0 || candidate.length > 4096) return false;
+  if (hasLeadingDash(candidate)) return false;
+  const resolved = isAbsolute16(candidate) ? resolve15(candidate) : resolve15(projectRoot, candidate);
+  const rel = relative15(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute16(rel);
+}
+function everyFlagAllowed(allowed, args) {
+  for (const arg of args) {
+    if (!hasLeadingDash(arg)) continue;
+    if (allowed === null) return false;
+    if (!allowed.has(arg)) return false;
+  }
+  return true;
+}
+function sanitizeRunnerPath(value, options = {}) {
+  if (!value || hasLeadingDash(value)) return null;
+  const projectRoot = resolve15(options.projectRoot ?? process.cwd());
+  if (!withinProjectPath(projectRoot, value)) return null;
+  return isAbsolute16(value) ? resolve15(value) : resolve15(projectRoot, value);
+}
+function resolveRunnerCommand(runtime, command, options = {}) {
+  const tokens = safeSplit(command);
+  if (!tokens || tokens.length === 0) return null;
+  const projectRoot = resolve15(options.projectRoot ?? process.cwd());
+  const launcher = runtime.packageManager;
+  const [head, second, ...rest] = tokens;
+  if (!head) return null;
+  const display = tokens.join(" ");
+  if (launcher !== "none" && tokens.length === 1 && head === launcher) {
+    return null;
+  }
+  if (head === runtime.executable) {
+    if (!everyFlagAllowed(runtime.allowedFlags, [second, ...rest].filter((v) => Boolean(v)))) {
+      return null;
+    }
+    return {
+      cmd: head,
+      args: [second, ...rest].filter((v) => Boolean(v)),
+      display
+    };
+  }
+  if (launcher !== "none" && head === launcher && runtime.subcommands.length === 0 && second === runtime.executable) {
+    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
+    return { cmd: head, args: [second, ...rest], display };
+  }
+  if (launcher !== "none" && head === launcher && runtime.subcommands.length > 0) {
+    const subcommand = runtime.subcommands[0];
+    const exe = rest[0];
+    if (second === subcommand && exe === runtime.executable) {
+      const tail = rest.slice(1);
+      if (!everyFlagAllowed(runtime.allowedFlags, tail)) return null;
+      return { cmd: head, args: [second, exe, ...tail], display };
+    }
+  }
+  if (isAbsolute16(head)) {
+    if (!withinProjectPath(projectRoot, head)) return null;
+    const base = basename3(head);
+    if (base !== runtime.executable && base !== launcher) return null;
+    if (second !== runtime.executable) return null;
+    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
+    return { cmd: head, args: [second, ...rest], display };
+  }
+  return null;
+}
+function runRunnerCommand(argv, options) {
+  if (argv.length === 0) {
+    return Promise.resolve({
+      code: null,
+      stdout: "",
+      stderr: "runtime helper: empty argv",
+      timedOut: false,
+      spawnError: true
+    });
+  }
+  return new Promise((resolvePromise) => {
+    const projectRoot = resolve15(options.projectRoot ?? process.cwd());
+    const trimmedCwd = options.cwd.trim();
+    if (!withinProjectPath(projectRoot, trimmedCwd)) {
+      resolvePromise({
+        code: null,
+        stdout: "",
+        stderr: "runtime helper: cwd outside project",
+        timedOut: false,
+        spawnError: true
+      });
+      return;
+    }
+    const timedOut = false;
+    let spawnErrored = false;
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    const child = execFile4(
+      argv[0],
+      argv.slice(1),
+      {
+        cwd: trimmedCwd,
+        timeout: options.timeoutMs,
+        signal: options.signal,
+        maxBuffer: MAX_BUFFER_BYTES,
+        windowsHide: true,
+        shell: false
+      },
+      (err, stdout, stderr) => {
+        if (timedOut) {
+          resolvePromise({
+            code: null,
+            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
+            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            timedOut: true,
+            spawnError: false
+          });
+          return;
+        }
+        if (spawnErrored) {
+          resolvePromise({
+            code: 127,
+            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
+            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            timedOut: false,
+            spawnError: true
+          });
+          return;
+        }
+        if (err) {
+          const anyErr = err;
+          const code = typeof anyErr.code === "number" ? anyErr.code : 1;
+          resolvePromise({
+            code,
+            stdout: Buffer.concat([
+              ...stdoutChunks,
+              ...anyErr.stdout ? [Buffer.isBuffer(anyErr.stdout) ? anyErr.stdout : Buffer.from(anyErr.stdout)] : []
+            ]).toString("utf8"),
+            stderr: Buffer.concat([
+              ...stderrChunks,
+              ...anyErr.stderr ? [Buffer.isBuffer(anyErr.stderr) ? anyErr.stderr : Buffer.from(anyErr.stderr)] : []
+            ]).toString("utf8"),
+            timedOut: false,
+            spawnError: false
+          });
+          return;
+        }
+        resolvePromise({
+          code: 0,
+          stdout: Buffer.concat([
+            ...stdoutChunks,
+            ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]
+          ]).toString("utf8"),
+          stderr: Buffer.concat([
+            ...stderrChunks,
+            ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]
+          ]).toString("utf8"),
+          timedOut: false,
+          spawnError: false
+        });
+      }
+    );
+    child.stdout?.on("data", (chunk) => {
+      stdoutBytes += chunk.length;
+      if (stdoutBytes <= MAX_BUFFER_BYTES) stdoutChunks.push(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderrBytes += chunk.length;
+      if (stderrBytes <= MAX_BUFFER_BYTES) stderrChunks.push(chunk);
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT" || err.code === "EPERM" || err.code === "EACCES") {
+        spawnErrored = true;
+      }
+    });
+  });
+}
+
+// src/type-gate/index.ts
 var API_VERSION19 = "^0.1.10";
 var state33 = {
   invocationCount: 0,
@@ -11658,63 +11939,59 @@ function readConfig29(raw) {
 function withinProject8(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute17(p) ? resolve16(p) : resolve16(root, p);
+  const rel = relative16(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute17(rel)) return false;
   return true;
 }
-var ALLOWED_COMMAND_TOKENS2 = /* @__PURE__ */ new Set([
-  "npx",
-  "pnpm",
-  "npm",
-  "yarn",
-  "bun",
-  "tsc",
-  "node",
-  "tsx"
-]);
-function resolveAllowedCommand3(customCommand) {
-  const tokens = customCommand.split(/\s+/).filter(Boolean);
-  if (tokens.length === 0) return null;
-  const head = tokens[0];
-  if (ALLOWED_COMMAND_TOKENS2.has(head)) {
-    return { cmd: head, args: tokens.slice(1) };
-  }
-  if (isAbsolute(head)) {
-    if (!withinProject8(head)) return null;
-    const base = head.split(/[/\\]/).pop() ?? "";
-    if (ALLOWED_COMMAND_TOKENS2.has(base)) {
-      return { cmd: head, args: tokens.slice(1) };
-    }
-  }
-  return null;
+var TSC_RUNTIME = {
+  id: "typescript",
+  packageManager: "pnpm",
+  executable: "tsc",
+  allowedFlags: /* @__PURE__ */ new Set([
+    "--noEmit",
+    "--pretty",
+    "--pretty=false",
+    "--incremental",
+    "--watch",
+    "--build",
+    "--filter"
+  ]),
+  subcommands: ["exec"],
+  defaultCommand: "pnpm exec tsc --noEmit"
+};
+function validateTsConfigPath(p) {
+  const sanitized = sanitizeRunnerPath(p);
+  return sanitized;
 }
 function runTypeCheck(cfg) {
   const start = Date.now();
-  const tsConfig = cfg.tsConfigPath;
-  let cmd;
-  let args;
+  const rawTsConfig = cfg.tsConfigPath;
+  const validTsConfig = rawTsConfig && rawTsConfig !== "tsconfig.json" ? validateTsConfigPath(rawTsConfig) : null;
+  if (rawTsConfig && rawTsConfig !== "tsconfig.json" && !validTsConfig) {
+    return null;
+  }
+  const tsConfig = validTsConfig ?? (rawTsConfig || "tsconfig.json");
+  let argv;
   if (cfg.command) {
-    const resolved = resolveAllowedCommand3(cfg.command);
+    const resolved = resolveRunnerCommand(TSC_RUNTIME, cfg.command);
     if (!resolved) return null;
-    cmd = resolved.cmd;
-    args = resolved.args;
+    argv = [resolved.cmd, ...resolved.args];
   } else {
-    cmd = "npx";
-    args = ["tsc", "--noEmit"];
+    argv = ["npx", "tsc", "--noEmit"];
     if (tsConfig && tsConfig !== "tsconfig.json") {
-      args.push("-p", tsConfig);
+      argv = [...argv, "-p", tsConfig];
     }
   }
-  if (!cfg.command && tsConfig && !existsSync(tsConfig)) {
+  if (!cfg.command && tsConfig && !existsSync7(tsConfig)) {
     return null;
   }
   let stdout = "";
   let stderr = "";
   try {
-    const out = execFileSync(cmd, args, {
+    const out = execFileSync8(argv[0], argv.slice(1), {
       encoding: "utf-8",
       timeout: cfg.timeoutMs,
       cwd: process.cwd(),
@@ -11728,6 +12005,7 @@ function runTypeCheck(cfg) {
     stdout = e.stdout ?? "";
     stderr = e.stderr ?? "";
   }
+  void runRunnerCommand;
   const combined = `${stdout}
 ${stderr}`.trim();
   const durationMs = Date.now() - start;
@@ -11745,6 +12023,12 @@ ${stderr}`.trim();
 var plugin36 = {
   name: "type-gate",
   version: "0.1.0",
+  runtime: {
+    language: "typescript",
+    packageManager: "pnpm",
+    executable: "tsc",
+    defaultCommand: "pnpm exec tsc --noEmit"
+  },
   description: "PostToolUse hook that runs TypeScript type-checking after every write or edit to a source file",
   apiVersion: API_VERSION19,
   capabilities: { tools: true, hooks: true },
@@ -12141,6 +12425,10 @@ var plugin37 = {
   }
 };
 var todo_listener_default = plugin37;
+
+// src/todo-tracker/index.ts
+import * as fsp from "node:fs/promises";
+import { randomUUID } from "node:crypto";
 function deriveFilePath(api) {
   const raw = api.config.extensions?.["todo-tracker"];
   const explicit = typeof raw?.["filePath"] === "string" ? raw["filePath"] : null;
@@ -12892,7 +13180,7 @@ function estimateRequestTokens(request, charsPerToken) {
   walk(request["messages"]);
   return Math.ceil(chars / charsPerToken);
 }
-var sleep = (ms) => new Promise((resolve34) => setTimeout(resolve34, ms));
+var sleep = (ms) => new Promise((resolve36) => setTimeout(resolve36, ms));
 var plugin40 = {
   name: "token-throttle",
   version: "0.1.0",
@@ -13036,6 +13324,10 @@ var plugin40 = {
   }
 };
 var token_throttle_default = plugin40;
+
+// src/accessibility-auditor/index.ts
+import { existsSync as existsSync8, readFileSync as readFileSync8, readdirSync as readdirSync3, statSync as statSync5 } from "node:fs";
+import { isAbsolute as isAbsolute18, relative as relative17, resolve as resolve17 } from "node:path";
 var API_VERSION21 = "^0.1.10";
 var state38 = {
   auditCount: 0,
@@ -13066,11 +13358,11 @@ function readConfig33(raw) {
 function withinProject9(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute18(p) ? resolve17(p) : resolve17(root, p);
+  const rel = relative17(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute18(rel)) return false;
   return true;
 }
 function normalizeExtensions(exts) {
@@ -13083,8 +13375,8 @@ function matchesExtension(p, exts) {
 }
 function collectUiFiles(root, exts) {
   const files = [];
-  if (!existsSync(root)) return files;
-  const s = statSync(root);
+  if (!existsSync8(root)) return files;
+  const s = statSync5(root);
   if (s.isFile()) {
     if (matchesExtension(root, exts)) files.push(root);
     return files;
@@ -13093,15 +13385,15 @@ function collectUiFiles(root, exts) {
   function walk(dir) {
     let entries;
     try {
-      entries = readdirSync(dir);
+      entries = readdirSync3(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const full = resolve(dir, entry);
+      const full = resolve17(dir, entry);
       let st;
       try {
-        st = statSync(full);
+        st = statSync5(full);
       } catch {
         continue;
       }
@@ -13135,7 +13427,7 @@ function hasMeaningfulAlt(tag) {
 function auditFile(filePath, projectRoot) {
   let content;
   try {
-    content = readFileSync(filePath, "utf-8");
+    content = readFileSync8(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -13144,7 +13436,7 @@ function auditFile(filePath, projectRoot) {
   const idsByValue = /* @__PURE__ */ new Map();
   function add(line, rule, severity, message) {
     findings.push({
-      file: relative(projectRoot, filePath),
+      file: relative17(projectRoot, filePath),
       line,
       rule,
       severity,
@@ -13154,24 +13446,21 @@ function auditFile(filePath, projectRoot) {
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
     const lineNo = i + 1;
-    let idMatch;
-    while ((idMatch = ATTR_ID.exec(line)) !== null) {
+    for (const idMatch of line.matchAll(ATTR_ID)) {
       const id = idMatch[1];
       const list = idsByValue.get(id) ?? [];
       list.push(lineNo);
       idsByValue.set(id, list);
     }
     ATTR_ID.lastIndex = 0;
-    let imgMatch;
-    while ((imgMatch = TAG_IMG.exec(line)) !== null) {
+    for (const imgMatch of line.matchAll(TAG_IMG)) {
       const tag = imgMatch[0];
       if (!hasMeaningfulAlt(tag)) {
         add(lineNo, "missing-alt", "error", "<img> is missing meaningful alt text");
       }
     }
     TAG_IMG.lastIndex = 0;
-    let inputMatch;
-    while ((inputMatch = TAG_INPUT.exec(line)) !== null) {
+    for (const inputMatch of line.matchAll(TAG_INPUT)) {
       const tag = inputMatch[0];
       const typeMatch = tag.match(/\btype\s*=\s*["']?([^"'\s>]*)["']?/i);
       const type = typeMatch ? typeMatch[1].toLowerCase() : "text";
@@ -13196,8 +13485,7 @@ function auditFile(filePath, projectRoot) {
       }
     }
     TAG_INPUT.lastIndex = 0;
-    let buttonMatch;
-    while ((buttonMatch = TAG_BUTTON.exec(line)) !== null) {
+    for (const buttonMatch of line.matchAll(TAG_BUTTON)) {
       const tag = buttonMatch[0];
       const inner = buttonMatch[1] ?? "";
       const hasText = inner.replace(/\s+/g, "").length > 0;
@@ -13208,8 +13496,7 @@ function auditFile(filePath, projectRoot) {
       }
     }
     TAG_BUTTON.lastIndex = 0;
-    let inputButtonMatch;
-    while ((inputButtonMatch = INPUT_BUTTON.exec(line)) !== null) {
+    for (const inputButtonMatch of line.matchAll(INPUT_BUTTON)) {
       const tag = inputButtonMatch[0];
       if (!ATTR_VALUE.test(tag) && !ATTR_ARIA_LABEL.test(tag) && !ATTR_TITLE.test(tag)) {
         add(lineNo, "missing-button-text", "error", `<input type="${inputButtonMatch[1]}"> is missing value/aria-label/title`);
@@ -13228,7 +13515,7 @@ function auditFile(filePath, projectRoot) {
 }
 function auditPath(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
+  const resolved = isAbsolute18(rawPath) ? resolve17(rawPath) : resolve17(root, rawPath);
   const exts = normalizeExtensions(cfg.includeExtensions);
   const files = collectUiFiles(resolved, exts);
   const findings = [];
@@ -13238,7 +13525,7 @@ function auditPath(rawPath, cfg) {
     if (findings.length >= cfg.maxFindings) break;
   }
   return {
-    path: relative(root, resolved),
+    path: relative17(root, resolved),
     findings: findings.slice(0, cfg.maxFindings),
     fileCount: files.length
   };
@@ -13441,6 +13728,11 @@ var plugin41 = {
   }
 };
 var accessibility_auditor_default = plugin41;
+
+// src/api-compatibility-gate/index.ts
+import { execFileSync as execFileSync9 } from "node:child_process";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "node:fs";
+import { basename as basename4, dirname as dirname6, extname, isAbsolute as isAbsolute19, relative as relative18, resolve as resolve18 } from "node:path";
 var API_VERSION22 = "^0.1.10";
 var state39 = {
   invocationCount: 0,
@@ -13504,25 +13796,25 @@ function matchesAnyPattern(filePath, patterns) {
   return patterns.some((p) => patternToRegex(p).test(normalized));
 }
 function resolveToProjectRoot(filePath) {
-  if (isAbsolute(filePath)) return resolve(filePath);
-  return resolve(process.cwd(), filePath);
+  if (isAbsolute19(filePath)) return resolve18(filePath);
+  return resolve18(process.cwd(), filePath);
 }
 function withinProject10(filePath) {
   if (typeof filePath !== "string" || filePath.length === 0 || filePath.length > 4096) return false;
   const resolved = resolveToProjectRoot(filePath);
-  const rel = relative(process.cwd(), resolved);
+  const rel = relative18(process.cwd(), resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute19(rel)) return false;
   return true;
 }
 function isPackageEntryPoint(filePath) {
   const resolved = resolveToProjectRoot(filePath);
-  const dir = dirname(resolved);
-  const pkgPath = resolve(dir, "package.json");
-  if (!existsSync(pkgPath)) return false;
+  const dir = dirname6(resolved);
+  const pkgPath = resolve18(dir, "package.json");
+  if (!existsSync9(pkgPath)) return false;
   try {
-    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
     const entries = [];
     if (pkg.main) entries.push(pkg.main);
     if (pkg.module) entries.push(pkg.module);
@@ -13540,9 +13832,9 @@ function isPackageEntryPoint(filePath) {
       }
     }
     for (const entry of entries) {
-      const entryResolved = resolve(dir, entry);
+      const entryResolved = resolve18(dir, entry);
       if (entryResolved === resolved) return true;
-      if (basename(dirname(entryResolved)) === basename(dirname(resolved)) && basename(entryResolved, extname(entryResolved)) === basename(resolved, extname(resolved))) {
+      if (basename4(dirname6(entryResolved)) === basename4(dirname6(resolved)) && basename4(entryResolved, extname(entryResolved)) === basename4(resolved, extname(resolved))) {
         return true;
       }
     }
@@ -13593,9 +13885,9 @@ function extractExports(source) {
 }
 function readGitVersion(filePath) {
   const resolved = resolveToProjectRoot(filePath);
-  const relPath = normalizePath2(relative(process.cwd(), resolved));
+  const relPath = normalizePath2(relative18(process.cwd(), resolved));
   try {
-    const out = execFileSync("git", ["show", `HEAD:${relPath}`], {
+    const out = execFileSync9("git", ["show", `HEAD:${relPath}`], {
       encoding: "utf-8",
       cwd: process.cwd(),
       stdio: ["pipe", "pipe", "pipe"]
@@ -13608,7 +13900,7 @@ function readGitVersion(filePath) {
 function readCurrentFile(filePath) {
   try {
     const resolved = resolveToProjectRoot(filePath);
-    return readFileSync(resolved, "utf-8");
+    return readFileSync9(resolved, "utf-8");
   } catch {
     return null;
   }
@@ -13791,6 +14083,10 @@ var plugin42 = {
   }
 };
 var api_compatibility_gate_default = plugin42;
+
+// src/auto-i18n-extractor/index.ts
+import { readFileSync as readFileSync10 } from "node:fs";
+import { isAbsolute as isAbsolute20, relative as relative19, resolve as resolve19 } from "node:path";
 var API_VERSION23 = "^0.1.10";
 var state40 = {
   filesScanned: 0,
@@ -13834,11 +14130,11 @@ function readConfig35(raw) {
 function withinProject11(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute20(p) ? resolve19(p) : resolve19(root, p);
+  const rel = relative19(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute20(rel)) return false;
   return true;
 }
 function fileExtension(p) {
@@ -13873,8 +14169,7 @@ function extractStrings(content, cfg) {
   for (let i = 0; i < lines.length; i += 1) {
     const line = lines[i];
     stringRegex.lastIndex = 0;
-    let match;
-    while ((match = stringRegex.exec(line)) !== null) {
+    for (const match of line.matchAll(stringRegex)) {
       const value = match[2] ?? "";
       const quoteIndex = match.index + (match[1]?.length ?? 1);
       if (!looksLikeUserText(value, cfg.minLength)) continue;
@@ -13886,7 +14181,7 @@ function extractStrings(content, cfg) {
 }
 function readSourceFile(filePath) {
   try {
-    return readFileSync(filePath, "utf-8");
+    return readFileSync10(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -14120,6 +14415,10 @@ ${lines.join("\n")}${more}`;
   }
 };
 var auto_i18n_extractor_default = plugin43;
+
+// src/code-metrics/index.ts
+import { existsSync as existsSync10, readFileSync as readFileSync11, readdirSync as readdirSync4, statSync as statSync6 } from "node:fs";
+import { extname as extname2, isAbsolute as isAbsolute21, relative as relative20, resolve as resolve20 } from "node:path";
 var API_VERSION24 = "^0.1.10";
 var state41 = {
   measureCount: 0,
@@ -14145,23 +14444,23 @@ function readConfig36(raw) {
 function withinProject12(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute21(p) ? resolve20(p) : resolve20(root, p);
+  const rel = relative20(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute21(rel)) return false;
   return true;
 }
 function normalizeExtensions2(exts) {
   return exts.map((e) => e.startsWith(".") ? e.toLowerCase() : `.${e.toLowerCase()}`);
 }
 function matchesExtension2(p, exts) {
-  return exts.includes(extname(p).toLowerCase());
+  return exts.includes(extname2(p).toLowerCase());
 }
 function collectSourceFiles(root, exts) {
   const files = [];
-  if (!existsSync(root)) return files;
-  const s = statSync(root);
+  if (!existsSync10(root)) return files;
+  const s = statSync6(root);
   if (s.isFile()) {
     if (matchesExtension2(root, exts)) files.push(root);
     return files;
@@ -14170,16 +14469,16 @@ function collectSourceFiles(root, exts) {
   function walk(dir) {
     let entries;
     try {
-      entries = readdirSync(dir);
+      entries = readdirSync4(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === "dist" || entry === ".git" || entry === "coverage") continue;
-      const full = resolve(dir, entry);
+      const full = resolve20(dir, entry);
       let st;
       try {
-        st = statSync(full);
+        st = statSync6(full);
       } catch {
         continue;
       }
@@ -14197,40 +14496,38 @@ function toPosix(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath(p) {
-  return toPosix(relative(process.cwd(), p));
+  return toPosix(relative20(process.cwd(), p));
 }
 function countFunctions(content) {
   let count = 0;
   const declRe = /\bfunction\s+[A-Za-z_$][A-Za-z0-9_$]*\s*\(/g;
   const methodRe = /\b[A-Za-z_$][A-Za-z0-9_$]*\s*\([^)]*\)\s*\{/g;
   const arrowRe = /=>\s*(?:\{|\(|[^\s;{}])/g;
-  let m;
   declRe.lastIndex = 0;
-  while ((m = declRe.exec(content)) !== null) count++;
+  for (const _match of content.matchAll(declRe)) count++;
   methodRe.lastIndex = 0;
-  while ((m = methodRe.exec(content)) !== null) {
-    const prefix = content.slice(0, m.index).trimEnd();
+  for (const match of content.matchAll(methodRe)) {
+    const prefix = content.slice(0, match.index).trimEnd();
     if (/\bfunction\s*$/.test(prefix)) continue;
     count++;
   }
   arrowRe.lastIndex = 0;
-  while ((m = arrowRe.exec(content)) !== null) count++;
+  for (const _match of content.matchAll(arrowRe)) count++;
   return count;
 }
 function countComplexity(content) {
   const controlRe = /\b(if|else\s+if|for|while|switch|catch)\b/g;
   const operatorRe = /[?&|]/g;
   let complexity = 0;
-  let m;
   controlRe.lastIndex = 0;
-  while ((m = controlRe.exec(content)) !== null) complexity++;
+  for (const _match of content.matchAll(controlRe)) complexity++;
   operatorRe.lastIndex = 0;
-  while ((m = operatorRe.exec(content)) !== null) {
-    const ch = m[0];
+  for (const match of content.matchAll(operatorRe)) {
+    const ch = match[0];
     if (ch === "?") {
       complexity++;
     } else {
-      const next = content[m.index + 1];
+      const next = content[match.index + 1];
       if (next === ch) complexity++;
     }
   }
@@ -14276,14 +14573,14 @@ function analyzeFile(filePath, content) {
 }
 function measurePath(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
+  const resolved = isAbsolute21(rawPath) ? resolve20(rawPath) : resolve20(root, rawPath);
   const exts = normalizeExtensions2(cfg.extensions);
   const allFiles = collectSourceFiles(resolved, exts);
   const files = allFiles.slice(0, cfg.maxFiles);
   const metrics = [];
   for (const p of files) {
     try {
-      const content = readFileSync(p, "utf-8");
+      const content = readFileSync11(p, "utf-8");
       metrics.push(analyzeFile(p, content));
     } catch {
     }
@@ -14339,10 +14636,10 @@ var plugin44 = {
       const exts = normalizeExtensions2(cfg.extensions);
       if (!matchesExtension2(sourcePath, exts)) return;
       state41.hookInvocationCount += 1;
-      const resolved = resolve(process.cwd(), sourcePath);
+      const resolved = resolve20(process.cwd(), sourcePath);
       let content;
       try {
-        content = readFileSync(resolved, "utf-8");
+        content = readFileSync11(resolved, "utf-8");
       } catch {
         state41.errorCount += 1;
         return;
@@ -14383,7 +14680,7 @@ var plugin44 = {
         state41.fileCount += result.files.length;
         return {
           ok: true,
-          path: relativePath(resolve(process.cwd(), rawPath)),
+          path: relativePath(resolve20(process.cwd(), rawPath)),
           files: result.files,
           totalFiles: result.totalFiles,
           capped: result.totalFiles > cfg.maxFiles
@@ -14452,6 +14749,10 @@ var plugin44 = {
   }
 };
 var code_metrics_default = plugin44;
+
+// src/dead-code-detector/index.ts
+import { readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync7 } from "node:fs";
+import { extname as extname3, isAbsolute as isAbsolute22, join as join5, relative as relative21, resolve as resolve21 } from "node:path";
 var API_VERSION25 = "^0.1.10";
 var state42 = {
   scanCount: 0,
@@ -14485,24 +14786,24 @@ function gatherFiles(root, depth, cfg) {
   function walk(dir, remaining) {
     let entries;
     try {
-      entries = readdirSync(dir, { withFileTypes: true });
+      entries = readdirSync5(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (remaining > 0 && !cfg.excludeDirs.includes(entry.name)) {
-          walk(join(dir, entry.name), remaining - 1);
+          walk(join5(dir, entry.name), remaining - 1);
         }
       } else if (entry.isFile()) {
-        const ext = extname(entry.name).toLowerCase();
+        const ext = extname3(entry.name).toLowerCase();
         if (cfg.extensions.includes(ext)) {
-          files.push(join(dir, entry.name));
+          files.push(join5(dir, entry.name));
         }
       }
     }
   }
-  walk(resolve(root), depth);
+  walk(resolve21(root), depth);
   return files;
 }
 function stripNoise(content) {
@@ -14524,9 +14825,8 @@ var DECLARATION_EXPORT_RE = /export\s+(?:async\s+|abstract\s+)?(?:const|let|var|
 var NAMED_EXPORT_RE = /export\s*\{([^}]+)\}/g;
 function extractExports2(content, filePath) {
   const exports = [];
-  let match;
   DECLARATION_EXPORT_RE.lastIndex = 0;
-  while ((match = DECLARATION_EXPORT_RE.exec(content)) !== null) {
+  for (const match of content.matchAll(DECLARATION_EXPORT_RE)) {
     exports.push({
       identifier: match[1],
       file: filePath,
@@ -14535,7 +14835,7 @@ function extractExports2(content, filePath) {
     });
   }
   NAMED_EXPORT_RE.lastIndex = 0;
-  while ((match = NAMED_EXPORT_RE.exec(content)) !== null) {
+  for (const match of content.matchAll(NAMED_EXPORT_RE)) {
     const line = lineNumber(content, match.index);
     const names = match[1].split(",").map((s) => s.trim()).filter(Boolean);
     for (const name of names) {
@@ -14579,7 +14879,7 @@ function scan(root, depth, cfg) {
   const files = [];
   for (const p of filePaths) {
     try {
-      const content = readFileSync(p, "utf-8");
+      const content = readFileSync12(p, "utf-8");
       files.push({ path: p, content, stripped: stripNoise(content) });
     } catch {
     }
@@ -14589,19 +14889,19 @@ function scan(root, depth, cfg) {
 function withinProject13(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute22(p) ? resolve21(p) : resolve21(root, p);
+  const rel = relative21(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute22(rel)) return false;
   return true;
 }
 function resolveScanRoot(rawPath) {
-  const resolved = resolve(process.cwd(), rawPath);
+  const resolved = resolve21(process.cwd(), rawPath);
   try {
-    const stats = statSync(resolved);
+    const stats = statSync7(resolved);
     if (!stats.isDirectory()) {
-      return resolve(resolved, "..");
+      return resolve21(resolved, "..");
     }
   } catch {
   }
@@ -14611,7 +14911,7 @@ function toPosix2(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath2(p) {
-  return toPosix2(relative(process.cwd(), p));
+  return toPosix2(relative21(process.cwd(), p));
 }
 var plugin45 = {
   name: "dead-code-detector",
@@ -14678,12 +14978,12 @@ var plugin45 = {
       let result;
       try {
         result = scan(scanRoot, 1, cfg);
-      } catch (err) {
+      } catch {
         state42.errorCount += 1;
         return;
       }
-      const changedFile = resolve(process.cwd(), sourcePath);
-      const relevant = result.findings.filter((f) => resolve(f.file) === changedFile);
+      const changedFile = resolve21(process.cwd(), sourcePath);
+      const relevant = result.findings.filter((f) => resolve21(f.file) === changedFile);
       if (relevant.length === 0) {
         state42.missCount += 1;
         return;
@@ -14800,6 +15100,10 @@ Consider removing the export if it is not part of the public API.`;
   }
 };
 var dead_code_detector_default = plugin45;
+
+// src/dependency-vulnerability-gate/index.ts
+import { execFileSync as execFileSync10 } from "node:child_process";
+import { existsSync as existsSync11 } from "node:fs";
 var API_VERSION26 = "^0.1.10";
 var state43 = {
   invocations: 0,
@@ -14912,14 +15216,14 @@ function isInstallCommand(input) {
   return INSTALL_RE2.test(command);
 }
 function detectManager() {
-  return existsSync("pnpm-lock.yaml") ? "pnpm" : "npm";
+  return existsSync11("pnpm-lock.yaml") ? "pnpm" : "npm";
 }
 function runAudit(cfg) {
   const manager = detectManager();
   const start = Date.now();
   let stdout = "";
   try {
-    stdout = execFileSync(manager, ["audit", "--json"], {
+    stdout = execFileSync10(manager, ["audit", "--json"], {
       encoding: "utf-8",
       timeout: cfg.timeoutMs,
       cwd: process.cwd(),
@@ -15102,6 +15406,9 @@ Review the audit output or adjust the dependency choice.`;
   }
 };
 var dependency_vulnerability_gate_default = plugin46;
+
+// src/doc-sync-guard/index.ts
+import { isAbsolute as isAbsolute23, relative as relative22, resolve as resolve22, basename as basename5, extname as extname4 } from "node:path";
 var API_VERSION27 = "^0.1.10";
 var state44 = {
   changedFiles: [],
@@ -15129,32 +15436,32 @@ function readConfig39(raw) {
 function withinProject14(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute23(p) ? resolve22(p) : resolve22(root, p);
+  const rel = relative22(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute23(rel)) return false;
   return true;
 }
 function normalizeSlashes(p) {
   return p.replace(/\\/g, "/");
 }
 function isSourceFile(p, extensions) {
-  const ext = extname(p).toLowerCase();
+  const ext = extname4(p).toLowerCase();
   return extensions.includes(ext);
 }
 function isPublicSource(p, extensions) {
   if (!isSourceFile(p, extensions)) return false;
   const norm = normalizeSlashes(p);
   if (norm.includes("/node_modules/") || norm.startsWith("node_modules/")) return false;
-  const base = basename(norm).toLowerCase();
+  const base = basename5(norm).toLowerCase();
   if (/\.(test|spec)\./.test(base)) return false;
   if (base.startsWith("_")) return false;
   return true;
 }
 function isDocFile(p, docNames) {
   const norm = normalizeSlashes(p);
-  const base = basename(norm);
+  const base = basename5(norm);
   const lowerBase = base.toLowerCase();
   if (docNames.some((name) => lowerBase === name.toLowerCase())) return true;
   if (norm.includes("/docs/") || norm.startsWith("docs/")) return true;
@@ -15172,7 +15479,7 @@ function extractDocContent(toolInput) {
   return void 0;
 }
 function referenceTokens(p) {
-  const base = basename(p);
+  const base = basename5(p);
   const withoutExt = base.replace(/\.[^.]+$/, "");
   const tokens = [base];
   if (withoutExt && withoutExt !== base) tokens.push(withoutExt);
@@ -15320,6 +15627,10 @@ Consider mentioning these changes in the documentation.`;
   }
 };
 var doc_sync_guard_default = plugin47;
+
+// src/duplicate-code-detector/index.ts
+import { existsSync as existsSync12, readFileSync as readFileSync13, readdirSync as readdirSync6, statSync as statSync8 } from "node:fs";
+import { extname as extname5, isAbsolute as isAbsolute24, relative as relative23, resolve as resolve23 } from "node:path";
 var API_VERSION28 = "^0.1.10";
 var state45 = {
   scanCount: 0,
@@ -15353,21 +15664,21 @@ function readConfig40(raw) {
 function withinProject15(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute24(p) ? resolve23(p) : resolve23(root, p);
+  const rel = relative23(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute24(rel)) return false;
   return true;
 }
 function matchesExtension3(p, exts) {
-  const ext = extname(p).toLowerCase();
+  const ext = extname5(p).toLowerCase();
   return exts.includes(ext);
 }
 function collectSourceFiles2(root, cfg) {
   const files = [];
-  if (!existsSync(root)) return files;
-  const s = statSync(root);
+  if (!existsSync12(root)) return files;
+  const s = statSync8(root);
   if (s.isFile()) {
     if (matchesExtension3(root, cfg.extensions)) files.push(root);
     return files;
@@ -15376,15 +15687,15 @@ function collectSourceFiles2(root, cfg) {
   function walk(dir) {
     let entries;
     try {
-      entries = readdirSync(dir);
+      entries = readdirSync6(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const full = resolve(dir, entry);
+      const full = resolve23(dir, entry);
       let st;
       try {
-        st = statSync(full);
+        st = statSync8(full);
       } catch {
         continue;
       }
@@ -15402,7 +15713,7 @@ function toPosix3(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath3(p) {
-  return toPosix3(relative(process.cwd(), p));
+  return toPosix3(relative23(process.cwd(), p));
 }
 function removeInlineComments(line) {
   return line.replace(/\/\/.*$/, "").replace(/\/\*[\s\S]*?\*\//, "");
@@ -15460,12 +15771,12 @@ function findDuplicates(files, minLines, maxFindings) {
 }
 function scanPath(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
+  const resolved = isAbsolute24(rawPath) ? resolve23(rawPath) : resolve23(root, rawPath);
   const filePaths = collectSourceFiles2(resolved, cfg);
   const files = /* @__PURE__ */ new Map();
   for (const p of filePaths) {
     try {
-      files.set(p, readFileSync(p, "utf-8"));
+      files.set(p, readFileSync13(p, "utf-8"));
     } catch {
     }
   }
@@ -15545,24 +15856,24 @@ var plugin48 = {
       const now = Date.now();
       const lastWarning = state45.lastHookWarning.get(sourcePath);
       if (lastWarning !== void 0 && now - lastWarning < 6e4) return;
-      const changedFile = resolve(process.cwd(), sourcePath);
+      const changedFile = resolve23(process.cwd(), sourcePath);
       let content;
       try {
-        content = readFileSync(changedFile, "utf-8");
+        content = readFileSync13(changedFile, "utf-8");
       } catch {
         state45.errorCount += 1;
         return;
       }
       const changedWindows = extractWindows(changedFile, content, cfg.minLines);
       if (changedWindows.length === 0) return;
-      const projectRoot = resolve(process.cwd());
+      const projectRoot = resolve23(process.cwd());
       let otherFiles;
       try {
         const filePaths = collectSourceFiles2(projectRoot, cfg).filter((p) => p !== changedFile);
         otherFiles = /* @__PURE__ */ new Map();
         for (const p of filePaths) {
           try {
-            otherFiles.set(p, readFileSync(p, "utf-8"));
+            otherFiles.set(p, readFileSync13(p, "utf-8"));
           } catch {
           }
         }
@@ -15621,7 +15932,7 @@ var plugin48 = {
         state45.findingCount += result.findings.length;
         return {
           ok: true,
-          path: relativePath3(resolve(process.cwd(), rawPath)),
+          path: relativePath3(resolve23(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
           minLines: cfg.minLines,
           findings: result.findings
@@ -15698,6 +16009,10 @@ var plugin48 = {
   }
 };
 var duplicate_code_detector_default = plugin48;
+
+// src/feature-flag-tracker/index.ts
+import { existsSync as existsSync13, readFileSync as readFileSync14, readdirSync as readdirSync7, statSync as statSync9 } from "node:fs";
+import { extname as extname6, isAbsolute as isAbsolute25, relative as relative24, resolve as resolve24 } from "node:path";
 var API_VERSION29 = "^0.1.10";
 var state46 = {
   scanCount: 0,
@@ -15732,23 +16047,23 @@ function readConfig41(raw) {
 function withinProject16(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute25(p) ? resolve24(p) : resolve24(root, p);
+  const rel = relative24(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute25(rel)) return false;
   return true;
 }
 function normalizeExtensions3(exts) {
   return exts.map((e) => e.startsWith(".") ? e.toLowerCase() : `.${e.toLowerCase()}`);
 }
 function matchesExtension4(p, exts) {
-  return exts.includes(extname(p).toLowerCase());
+  return exts.includes(extname6(p).toLowerCase());
 }
 function collectSourceFiles3(root, exts) {
   const files = [];
-  if (!existsSync(root)) return files;
-  const s = statSync(root);
+  if (!existsSync13(root)) return files;
+  const s = statSync9(root);
   if (s.isFile()) {
     if (matchesExtension4(root, exts)) files.push(root);
     return files;
@@ -15757,16 +16072,16 @@ function collectSourceFiles3(root, exts) {
   function walk(dir) {
     let entries;
     try {
-      entries = readdirSync(dir);
+      entries = readdirSync7(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === "dist" || entry === ".git" || entry === "coverage") continue;
-      const full = resolve(dir, entry);
+      const full = resolve24(dir, entry);
       let st;
       try {
-        st = statSync(full);
+        st = statSync9(full);
       } catch {
         continue;
       }
@@ -15784,7 +16099,7 @@ function toPosix4(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath4(p) {
-  return toPosix4(relative(process.cwd(), p));
+  return toPosix4(relative24(process.cwd(), p));
 }
 function compilePatterns(patterns) {
   const sources = [...DEFAULT_PATTERNS2, ...patterns];
@@ -15795,8 +16110,7 @@ function scanFile(filePath, content, patterns, maxFindings) {
   const lines = content.split(/\r?\n/);
   for (const re of patterns) {
     re.lastIndex = 0;
-    let m;
-    while ((m = re.exec(content)) !== null) {
+    for (const m of content.matchAll(re)) {
       const flag = m[1] ?? m[0];
       const lineNo = content.slice(0, m.index).split(/\r?\n/).length;
       const context = (lines[lineNo - 1] ?? "").trim();
@@ -15815,14 +16129,14 @@ function scanFile(filePath, content, patterns, maxFindings) {
 }
 function scanPath2(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
+  const resolved = isAbsolute25(rawPath) ? resolve24(rawPath) : resolve24(root, rawPath);
   const exts = normalizeExtensions3(cfg.extensions);
   const files = collectSourceFiles3(resolved, exts);
   const patterns = compilePatterns(cfg.patterns);
   const usages = [];
   for (const p of files) {
     try {
-      const content = readFileSync(p, "utf-8");
+      const content = readFileSync14(p, "utf-8");
       usages.push(...scanFile(p, content, patterns, cfg.maxFindings));
       if (usages.length >= cfg.maxFindings) break;
     } catch {
@@ -15886,10 +16200,10 @@ var plugin49 = {
       const exts = normalizeExtensions3(cfg.extensions);
       if (!matchesExtension4(sourcePath, exts)) return;
       state46.hookInvocationCount += 1;
-      const resolved = resolve(process.cwd(), sourcePath);
+      const resolved = resolve24(process.cwd(), sourcePath);
       let content;
       try {
-        content = readFileSync(resolved, "utf-8");
+        content = readFileSync14(resolved, "utf-8");
       } catch {
         state46.errorCount += 1;
         return;
@@ -15935,7 +16249,7 @@ Make sure flag behavior is intentional and consider updating flag inventory/docs
         state46.flagCount += result.usages.length;
         return {
           ok: true,
-          path: relativePath4(resolve(process.cwd(), rawPath)),
+          path: relativePath4(resolve24(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
           usages: result.usages
         };
@@ -16008,6 +16322,10 @@ Make sure flag behavior is intentional and consider updating flag inventory/docs
   }
 };
 var feature_flag_tracker_default = plugin49;
+
+// src/interface-contract-guard/index.ts
+import { existsSync as existsSync14, readFileSync as readFileSync15, readdirSync as readdirSync8, statSync as statSync10 } from "node:fs";
+import { extname as extname7, isAbsolute as isAbsolute26, relative as relative25, resolve as resolve25 } from "node:path";
 var API_VERSION30 = "^0.1.10";
 var state47 = {
   scanCount: 0,
@@ -16034,23 +16352,23 @@ function readConfig42(raw) {
 function withinProject17(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute26(p) ? resolve25(p) : resolve25(root, p);
+  const rel = relative25(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute26(rel)) return false;
   return true;
 }
 function normalizeExtensions4(exts) {
   return exts.map((e) => e.startsWith(".") ? e.toLowerCase() : `.${e.toLowerCase()}`);
 }
 function matchesExtension5(p, exts) {
-  return exts.includes(extname(p).toLowerCase());
+  return exts.includes(extname7(p).toLowerCase());
 }
 function collectSourceFiles4(root, exts) {
   const files = [];
-  if (!existsSync(root)) return files;
-  const s = statSync(root);
+  if (!existsSync14(root)) return files;
+  const s = statSync10(root);
   if (s.isFile()) {
     if (matchesExtension5(root, exts)) files.push(root);
     return files;
@@ -16059,16 +16377,16 @@ function collectSourceFiles4(root, exts) {
   function walk(dir) {
     let entries;
     try {
-      entries = readdirSync(dir);
+      entries = readdirSync8(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === "dist" || entry === ".git" || entry === "coverage") continue;
-      const full = resolve(dir, entry);
+      const full = resolve25(dir, entry);
       let st;
       try {
-        st = statSync(full);
+        st = statSync10(full);
       } catch {
         continue;
       }
@@ -16086,14 +16404,13 @@ function toPosix5(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath5(p) {
-  return toPosix5(relative(process.cwd(), p));
+  return toPosix5(relative25(process.cwd(), p));
 }
 var INTERFACE_RE = /(?:export\s+)?interface\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
 function extractInterfaceNames(content) {
   const names = [];
-  let m;
   INTERFACE_RE.lastIndex = 0;
-  while ((m = INTERFACE_RE.exec(content)) !== null) {
+  for (const m of content.matchAll(INTERFACE_RE)) {
     names.push({ name: m[1], line: content.slice(0, m.index).split(/\r?\n/).length });
   }
   return names;
@@ -16107,13 +16424,13 @@ function hasImplementer(name, contents) {
 }
 function scanPath3(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
+  const resolved = isAbsolute26(rawPath) ? resolve25(rawPath) : resolve25(root, rawPath);
   const exts = normalizeExtensions4(cfg.extensions);
   const files = collectSourceFiles4(resolved, exts);
   const contents = [];
   for (const p of files) {
     try {
-      contents.push({ path: p, content: readFileSync(p, "utf-8") });
+      contents.push({ path: p, content: readFileSync15(p, "utf-8") });
     } catch {
     }
   }
@@ -16185,10 +16502,10 @@ var plugin50 = {
       const exts = normalizeExtensions4(cfg.extensions);
       if (!matchesExtension5(sourcePath, exts)) return;
       state47.hookInvocationCount += 1;
-      const resolved = resolve(process.cwd(), sourcePath);
+      const resolved = resolve25(process.cwd(), sourcePath);
       let content;
       try {
-        content = readFileSync(resolved, "utf-8");
+        content = readFileSync15(resolved, "utf-8");
       } catch {
         state47.errorCount += 1;
         return;
@@ -16233,7 +16550,7 @@ If you changed member shapes, search the project for implementers/\`satisfies\`/
         state47.findingCount += result.findings.length;
         return {
           ok: true,
-          path: relativePath5(resolve(process.cwd(), rawPath)),
+          path: relativePath5(resolve25(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
           findings: result.findings
         };
@@ -16304,6 +16621,10 @@ If you changed member shapes, search the project for implementers/\`satisfies\`/
   }
 };
 var interface_contract_guard_default = plugin50;
+
+// src/license-audit-gate/index.ts
+import { readFileSync as readFileSync16 } from "node:fs";
+import { resolve as resolve26 } from "node:path";
 var API_VERSION31 = "^0.1.10";
 var state48 = {
   invocations: 0,
@@ -16357,8 +16678,7 @@ var INSTALL_RE3 = /(?:^|[;&|]\s*)(npm|pnpm|yarn|bun)\s+(?:install|i|add)\s+([^;&
 function parsePackageNames(command) {
   const names = [];
   INSTALL_RE3.lastIndex = 0;
-  let m;
-  while ((m = INSTALL_RE3.exec(command)) !== null) {
+  for (const m of command.matchAll(INSTALL_RE3)) {
     const argString = m[2] ?? "";
     for (const token of argString.split(/\s+/)) {
       if (!token || token.startsWith("-")) continue;
@@ -16380,8 +16700,8 @@ function auditPackages(names, allowedLicenses) {
   for (const name of names) {
     let licenses = [];
     try {
-      const pkgPath = resolve("node_modules", name, "package.json");
-      const raw = JSON.parse(readFileSync(pkgPath, "utf-8"));
+      const pkgPath = resolve26("node_modules", name, "package.json");
+      const raw = JSON.parse(readFileSync16(pkgPath, "utf-8"));
       licenses = extractLicenseStrings(raw);
     } catch {
       errors.push(name);
@@ -16558,6 +16878,10 @@ Allowed licenses: ${cfg.allowedLicenses.join(", ")}
   }
 };
 var license_audit_gate_default = plugin51;
+
+// src/migration-planner/index.ts
+import { existsSync as existsSync15, readFileSync as readFileSync17 } from "node:fs";
+import { isAbsolute as isAbsolute27, relative as relative26, resolve as resolve27 } from "node:path";
 var API_VERSION32 = "^0.1.10";
 var state49 = {
   plansGenerated: 0,
@@ -16583,11 +16907,11 @@ function readConfig44(raw) {
 function withinProject18(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute27(p) ? resolve27(p) : resolve27(root, p);
+  const rel = relative26(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute27(rel)) return false;
   return true;
 }
 function normalizeVersion(v) {
@@ -16599,9 +16923,9 @@ function readChangelog(packageName, cfg) {
   candidates.push(`node_modules/${packageName}/changelog.md`);
   for (const candidate of candidates) {
     if (!withinProject18(candidate)) continue;
-    if (existsSync(candidate)) {
+    if (existsSync15(candidate)) {
       try {
-        const content = readFileSync(candidate, "utf-8");
+        const content = readFileSync17(candidate, "utf-8");
         return { source: candidate, content: content.slice(0, cfg.maxChars) };
       } catch {
       }
@@ -16753,14 +17077,14 @@ var plugin52 = {
       const inp = input.toolInput ?? {};
       const path = inp["path"];
       if (!path) return;
-      const basename6 = path.split(/[/\\]/).pop() ?? "";
+      const basename7 = path.split(/[/\\]/).pop() ?? "";
       if (!/^(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?)$/i.test(
-        basename6
+        basename7
       )) {
         return;
       }
       return {
-        additionalContext: `Manifest file ${basename6} changed. Consider running migration_plan if a dependency version was updated.`
+        additionalContext: `Manifest file ${basename7} changed. Consider running migration_plan if a dependency version was updated.`
       };
     };
     state49.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook);
@@ -16901,6 +17225,10 @@ var plugin52 = {
   }
 };
 var migration_planner_default = plugin52;
+
+// src/performance-regression-gate/index.ts
+import { existsSync as existsSync16, readFileSync as readFileSync18 } from "node:fs";
+import { isAbsolute as isAbsolute28, relative as relative27, resolve as resolve28 } from "node:path";
 var API_VERSION33 = "^0.1.10";
 var state50 = {
   invocationCount: 0,
@@ -16925,18 +17253,18 @@ function readConfig45(raw) {
 }
 function withinProject19(p, cwd = process.cwd()) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
-  const root = resolve(cwd);
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const root = resolve28(cwd);
+  const resolved = isAbsolute28(p) ? resolve28(p) : resolve28(root, p);
+  const rel = relative27(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute28(rel)) return false;
   return true;
 }
 function resolveProjectPath7(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
-  const root = resolve(cwd);
-  const resolved = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
+  const root = resolve28(cwd);
+  const resolved = isAbsolute28(rawPath) ? resolve28(rawPath) : resolve28(root, rawPath);
   if (!withinProject19(resolved, cwd)) return null;
   return resolved;
 }
@@ -16965,9 +17293,9 @@ function flattenResults(results) {
   return flat;
 }
 function loadResults(path) {
-  if (!path || !existsSync(path)) return null;
+  if (!path || !existsSync16(path)) return null;
   try {
-    const raw = JSON.parse(readFileSync(path, "utf-8"));
+    const raw = JSON.parse(readFileSync18(path, "utf-8"));
     return raw;
   } catch {
     return null;
@@ -17210,6 +17538,10 @@ var plugin53 = {
   }
 };
 var performance_regression_gate_default = plugin53;
+
+// src/refactor-suggester/index.ts
+import { existsSync as existsSync17, readFileSync as readFileSync19, readdirSync as readdirSync9, statSync as statSync11 } from "node:fs";
+import { extname as extname8, isAbsolute as isAbsolute29, relative as relative28, resolve as resolve29 } from "node:path";
 var API_VERSION34 = "^0.1.10";
 var state51 = {
   scanCount: 0,
@@ -17248,23 +17580,23 @@ function readConfig46(raw) {
 function withinProject20(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute29(p) ? resolve29(p) : resolve29(root, p);
+  const rel = relative28(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute29(rel)) return false;
   return true;
 }
 function normalizeExtensions5(exts) {
   return exts.map((e) => e.startsWith(".") ? e.toLowerCase() : `.${e.toLowerCase()}`);
 }
 function matchesExtension6(p, exts) {
-  return exts.includes(extname(p).toLowerCase());
+  return exts.includes(extname8(p).toLowerCase());
 }
 function collectSourceFiles5(root, exts) {
   const files = [];
-  if (!existsSync(root)) return files;
-  const s = statSync(root);
+  if (!existsSync17(root)) return files;
+  const s = statSync11(root);
   if (s.isFile()) {
     if (matchesExtension6(root, exts)) files.push(root);
     return files;
@@ -17273,16 +17605,16 @@ function collectSourceFiles5(root, exts) {
   function walk(dir) {
     let entries;
     try {
-      entries = readdirSync(dir);
+      entries = readdirSync9(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === "dist" || entry === ".git" || entry === "coverage") continue;
-      const full = resolve(dir, entry);
+      const full = resolve29(dir, entry);
       let st;
       try {
-        st = statSync(full);
+        st = statSync11(full);
       } catch {
         continue;
       }
@@ -17300,7 +17632,7 @@ function toPosix6(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath6(p) {
-  return toPosix6(relative(process.cwd(), p));
+  return toPosix6(relative28(process.cwd(), p));
 }
 function leadingIndentLevel(line) {
   const leading = line.match(/^(\s*)/)?.[1] ?? "";
@@ -17313,21 +17645,20 @@ function detectSmells(filePath, content, rules) {
   const lines = content.split(/\r?\n/);
   const stripped = content.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, " ");
   const functionLikeRe = /(?:export\s+)?(?:async\s+)?(?:function\s+)?([A-Za-z_$][A-Za-z0-9_$]*)\s*\(([^)]*)\)\s*\{/g;
-  let m;
   functionLikeRe.lastIndex = 0;
-  while ((m = functionLikeRe.exec(stripped)) !== null) {
-    const name = m[1];
-    const paramsRaw = m[2];
+  for (const match of stripped.matchAll(functionLikeRe)) {
+    const name = match[1];
+    const paramsRaw = match[2];
     const params = paramsRaw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
     if (params.length > rules.maxParams) {
       suggestions.push({
         file: relativePath6(filePath),
-        line: content.slice(0, m.index).split(/\r?\n/).length,
+        line: content.slice(0, match.index).split(/\r?\n/).length,
         type: "many-parameters",
         message: `${name} has ${params.length} parameters (limit ${rules.maxParams})`
       });
     }
-    const bodyStart = m.index + m[0].length;
+    const bodyStart = match.index + match[0].length;
     let depth = 1;
     let lineEnd = bodyStart;
     for (let i = bodyStart; i < stripped.length && depth > 0; i++) {
@@ -17340,7 +17671,7 @@ function detectSmells(filePath, content, rules) {
     if (bodyLines > rules.longFunctionLines) {
       suggestions.push({
         file: relativePath6(filePath),
-        line: content.slice(0, m.index).split(/\r?\n/).length,
+        line: content.slice(0, match.index).split(/\r?\n/).length,
         type: "long-function",
         message: `${name} spans ~${bodyLines} lines (limit ${rules.longFunctionLines})`
       });
@@ -17371,15 +17702,15 @@ function detectSmells(filePath, content, rules) {
   const magicRe = /\b-?\d+(?:\.\d+)?\b/g;
   const allowed = /* @__PURE__ */ new Set(["0", "1", "-1", "2"]);
   magicRe.lastIndex = 0;
-  while ((m = magicRe.exec(content)) !== null) {
-    const match = m[0];
+  for (const magicNumberMatch of content.matchAll(magicRe)) {
+    const match = magicNumberMatch[0];
     if (allowed.has(match)) continue;
-    const before = content[m.index - 1];
-    const after = content[m.index + match.length];
+    const before = content[magicNumberMatch.index - 1];
+    const after = content[magicNumberMatch.index + match.length];
     if (before === "[" && after === "]") continue;
     suggestions.push({
       file: relativePath6(filePath),
-      line: content.slice(0, m.index).split(/\r?\n/).length,
+      line: content.slice(0, magicNumberMatch.index).split(/\r?\n/).length,
       type: "magic-number",
       message: `magic number ${match} should be a named constant`
     });
@@ -17388,13 +17719,13 @@ function detectSmells(filePath, content, rules) {
 }
 function scanPath4(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
+  const resolved = isAbsolute29(rawPath) ? resolve29(rawPath) : resolve29(root, rawPath);
   const exts = normalizeExtensions5(cfg.extensions);
   const files = collectSourceFiles5(resolved, exts);
   const suggestions = [];
   for (const p of files) {
     try {
-      const content = readFileSync(p, "utf-8");
+      const content = readFileSync19(p, "utf-8");
       suggestions.push(...detectSmells(p, content, cfg.rules));
       if (suggestions.length >= cfg.maxSuggestions) break;
     } catch {
@@ -17464,10 +17795,10 @@ var plugin54 = {
       const now = Date.now();
       const lastWarning = state51.lastHookWarning.get(sourcePath);
       if (lastWarning !== void 0 && now - lastWarning < 6e4) return;
-      const resolved = resolve(process.cwd(), sourcePath);
+      const resolved = resolve29(process.cwd(), sourcePath);
       let content;
       try {
-        content = readFileSync(resolved, "utf-8");
+        content = readFileSync19(resolved, "utf-8");
       } catch {
         state51.errorCount += 1;
         return;
@@ -17511,7 +17842,7 @@ var plugin54 = {
         state51.suggestionCount += result.suggestions.length;
         return {
           ok: true,
-          path: relativePath6(resolve(process.cwd(), rawPath)),
+          path: relativePath6(resolve29(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
           suggestions: result.suggestions,
           rules: cfg.rules
@@ -17586,6 +17917,9 @@ var plugin54 = {
   }
 };
 var refactor_suggester_default = plugin54;
+
+// src/release-notes-generator/index.ts
+import { execFileSync as execFileSync11 } from "node:child_process";
 var API_VERSION35 = "^0.1.10";
 var state52 = {
   generateCount: 0,
@@ -17626,23 +17960,41 @@ function formatCommit(c, includeScope) {
   line += ` ${c.description}`;
   return line;
 }
+var GIT_OPTIONS = {
+  encoding: "utf-8",
+  stdio: ["pipe", "pipe", "ignore"],
+  shell: false
+};
 function resolveFromRef(defaultFrom, inputFrom) {
   if (inputFrom) return inputFrom;
   if (defaultFrom === "latest-tag") {
     try {
-      return execSync("git describe --tags --abbrev=0", { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }).trim();
+      return execFileSync11("git", ["describe", "--tags", "--abbrev=0"], GIT_OPTIONS).trim();
     } catch {
       return "";
     }
   }
   return defaultFrom;
 }
+function resolveCommit(ref) {
+  const resolved = execFileSync11(
+    "git",
+    ["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`],
+    GIT_OPTIONS
+  ).trim();
+  if (!/^[0-9a-f]{40,64}$/i.test(resolved)) {
+    throw new Error(`git returned an invalid commit id for ref ${JSON.stringify(ref)}`);
+  }
+  return resolved;
+}
 function getCommits(from, to) {
-  const range = from ? `${from}..${to}` : to;
-  const output = execSync(`git log --pretty=format:'%H%x09%s' ${range}`, {
-    encoding: "utf-8",
-    stdio: ["pipe", "pipe", "ignore"]
-  });
+  const toCommit = resolveCommit(to);
+  const range = from ? `${resolveCommit(from)}..${toCommit}` : toCommit;
+  const output = execFileSync11(
+    "git",
+    ["log", "--pretty=format:%H%x09%s", "--end-of-options", range],
+    GIT_OPTIONS
+  );
   if (!output.trim()) return [];
   const commits = [];
   for (const line of output.split(/\r?\n/)) {
@@ -17790,6 +18142,10 @@ var plugin55 = {
   }
 };
 var release_notes_generator_default = plugin55;
+
+// src/schema-evolution-guard/index.ts
+import { readFileSync as readFileSync20 } from "node:fs";
+import { basename as basename6, isAbsolute as isAbsolute30, relative as relative29, resolve as resolve30 } from "node:path";
 var API_VERSION36 = "^0.1.10";
 var state53 = {
   invocationCount: 0,
@@ -17842,11 +18198,11 @@ function fileKind(fileName) {
 function withinProject21(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute30(p) ? resolve30(p) : resolve30(root, p);
+  const rel = relative29(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute30(rel)) return false;
   return true;
 }
 function findIssues(content, kind, maxFindings) {
@@ -17986,7 +18342,7 @@ var plugin56 = {
       const filePath = typeof toolInput["path"] === "string" ? toolInput["path"] : void 0;
       if (!filePath) return;
       state53.invocationCount += 1;
-      const fileName = basename(filePath);
+      const fileName = basename6(filePath);
       if (!matchesAnyPattern2(fileName, cfg.filePatterns)) {
         state53.skippedCount += 1;
         return;
@@ -18001,7 +18357,7 @@ var plugin56 = {
         content = toolInput["content"];
       } else if (withinProject21(filePath)) {
         try {
-          content = readFileSync(filePath, "utf-8");
+          content = readFileSync20(filePath, "utf-8");
         } catch {
           content = void 0;
         }
@@ -18103,6 +18459,10 @@ ${body}${suffix}`;
   }
 };
 var schema_evolution_guard_default = plugin56;
+
+// src/security-hotspot-scanner/index.ts
+import { readdirSync as readdirSync10, readFileSync as readFileSync21, statSync as statSync12 } from "node:fs";
+import { isAbsolute as isAbsolute31, relative as relative30, resolve as resolve31 } from "node:path";
 var API_VERSION37 = "^0.1.10";
 var state54 = {
   scanCount: 0,
@@ -18147,7 +18507,7 @@ var PATTERNS4 = [
   {
     type: "hardcoded_http",
     severity: "medium",
-    regex: /http:\/\/[a-zA-Z0-9][^\s'"\)\\]*/i
+    regex: /http:\/\/[a-zA-Z0-9][^\s'")\\]*/i
   },
   {
     type: "console_log_credentials",
@@ -18187,17 +18547,17 @@ function isSourceFile2(filePath, extensions) {
 function withinProject22(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute31(p) ? resolve31(p) : resolve31(root, p);
+  const rel = relative30(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute31(rel)) return false;
   return true;
 }
 function scanPath5(inputPath, cfg) {
   const start = Date.now();
   const root = process.cwd();
-  const resolved = isAbsolute(inputPath) ? resolve(inputPath) : resolve(root, inputPath);
+  const resolved = isAbsolute31(inputPath) ? resolve31(inputPath) : resolve31(root, inputPath);
   if (!withinProject22(inputPath)) {
     return {
       path: inputPath,
@@ -18214,11 +18574,11 @@ function scanPath5(inputPath, cfg) {
   const scanFile2 = (filePath) => {
     if (!isSourceFile2(filePath, cfg.scanOnChange)) return;
     try {
-      const content = readFileSync(filePath, "utf-8");
+      const content = readFileSync21(filePath, "utf-8");
       filesScanned += 1;
       const findings = scanSource(content, maxPerFile);
       for (const f of findings) {
-        allFindings.push({ ...f, snippet: `${relative(root, filePath)}:${f.line}: ${f.snippet}` });
+        allFindings.push({ ...f, snippet: `${relative30(root, filePath)}:${f.line}: ${f.snippet}` });
         if (allFindings.length >= cfg.maxFindings) return;
       }
     } catch {
@@ -18227,15 +18587,15 @@ function scanPath5(inputPath, cfg) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = readdirSync(dir);
+      entries = readdirSync10(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (allFindings.length >= cfg.maxFindings) return;
-      const full = resolve(dir, entry);
+      const full = resolve31(dir, entry);
       try {
-        const st = statSync(full);
+        const st = statSync12(full);
         if (st.isDirectory()) {
           if (entry.startsWith(".") || entry === "node_modules" || entry === "dist" || entry === "coverage") {
             continue;
@@ -18249,7 +18609,7 @@ function scanPath5(inputPath, cfg) {
     }
   };
   try {
-    const st = statSync(resolved);
+    const st = statSync12(resolved);
     if (st.isDirectory()) {
       walk(resolved);
     } else if (st.isFile()) {
@@ -18499,6 +18859,10 @@ Review or remove the risky pattern(s).`;
   }
 };
 var security_hotspot_scanner_default = plugin57;
+
+// src/semantic-search-indexer/index.ts
+import * as fs2 from "node:fs/promises";
+import { isAbsolute as isAbsolute32, relative as relative31, resolve as resolve32 } from "node:path";
 var API_VERSION38 = "^0.1.10";
 var state55 = {
   index: null,
@@ -18509,7 +18873,9 @@ var state55 = {
   truncated: false,
   queryCount: 0,
   reindexCount: 0,
-  buildPromise: null};
+  buildPromise: null,
+  hookUnregister: null
+};
 var DEFAULTS47 = {
   enabled: true,
   includeExtensions: [
@@ -18571,18 +18937,18 @@ function normalizeSlashes2(p) {
 function withinProject23(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = normalizeSlashes2(process.cwd());
-  const resolved = normalizeSlashes2(isAbsolute(p) ? resolve(p) : resolve(root, p));
-  const rel = normalizeSlashes2(relative(root, resolved));
+  const resolved = normalizeSlashes2(isAbsolute32(p) ? resolve32(p) : resolve32(root, p));
+  const rel = normalizeSlashes2(relative31(root, resolved));
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute32(rel)) return false;
   return true;
 }
 function resolveProjectPath8(p) {
   const raw = typeof p === "string" && p.length > 0 ? p : ".";
   if (!withinProject23(raw)) return null;
   const root = normalizeSlashes2(process.cwd());
-  return normalizeSlashes2(isAbsolute(raw) ? resolve(raw) : resolve(root, raw));
+  return normalizeSlashes2(isAbsolute32(raw) ? resolve32(raw) : resolve32(root, raw));
 }
 function tokenize(text, minLength) {
   const tokens = [];
@@ -18612,7 +18978,7 @@ function shouldIndexFile(filePath, cfg) {
 var INDEX_BATCH_SIZE = 32;
 var YIELD_EVERY_FILES = 64;
 function yieldEventLoop() {
-  return new Promise((resolve34) => setImmediate(resolve34));
+  return new Promise((resolve36) => setImmediate(resolve36));
 }
 function addFileToIndex(relPath, content, size, cfg) {
   if (!state55.index || content.includes("\0")) return;
@@ -18640,7 +19006,7 @@ async function indexFileFromStats(absPath, relPath, stats, cfg) {
   if (!shouldIndexFile(relPath, cfg) || !stats.isFile() || stats.size > cfg.maxFileBytes) return;
   let content;
   try {
-    content = await fsp.readFile(absPath, "utf-8");
+    content = await fs2.readFile(absPath, "utf-8");
   } catch {
     return;
   }
@@ -18656,7 +19022,7 @@ async function flushFileBatch(batch, cfg) {
 async function walkDirectory(absPath, cfg, excludes, fileBatch) {
   let entries;
   try {
-    entries = await fsp.readdir(absPath, { withFileTypes: true });
+    entries = await fs2.readdir(absPath, { withFileTypes: true });
   } catch {
     return;
   }
@@ -18666,8 +19032,8 @@ async function walkDirectory(absPath, cfg, excludes, fileBatch) {
       state55.truncated = true;
       return;
     }
-    const absChild = normalizeSlashes2(resolve(absPath, ent.name));
-    const relChild = normalizeSlashes2(relative(root, absChild));
+    const absChild = normalizeSlashes2(resolve32(absPath, ent.name));
+    const relChild = normalizeSlashes2(relative31(root, absChild));
     if (relChild === "" || relChild === ".") continue;
     if (excludes.some((re) => re.test(relChild))) continue;
     if (ent.isDirectory()) {
@@ -18678,7 +19044,7 @@ async function walkDirectory(absPath, cfg, excludes, fileBatch) {
       if (!shouldIndexFile(relChild, cfg)) continue;
       let stats;
       try {
-        stats = await fsp.stat(absChild);
+        stats = await fs2.stat(absChild);
       } catch {
         continue;
       }
@@ -18703,13 +19069,13 @@ async function buildIndex(rootPath, cfg) {
   const excludes = compileExcludes(cfg.excludePatterns);
   let rootStats;
   try {
-    rootStats = await fsp.stat(rootPath);
+    rootStats = await fs2.stat(rootPath);
   } catch {
     state55.termCount = 0;
     return;
   }
   if (rootStats.isFile()) {
-    const relPath = normalizeSlashes2(relative(normalizeSlashes2(process.cwd()), rootPath));
+    const relPath = normalizeSlashes2(relative31(normalizeSlashes2(process.cwd()), rootPath));
     await indexFileFromStats(rootPath, relPath === "" ? "." : relPath, rootStats, cfg);
     state55.fileCount = state55.index.files.size;
   } else if (rootStats.isDirectory()) {
@@ -18869,6 +19235,13 @@ var plugin58 = {
     state55.queryCount = 0;
     state55.reindexCount = 0;
     state55.buildPromise = null;
+    if (state55.hookUnregister) {
+      try {
+        state55.hookUnregister();
+      } catch {
+      }
+      state55.hookUnregister = null;
+    }
     const cfg = readConfig50(api.config.extensions?.["semantic-search-indexer"]);
     api.tools.register({
       name: "semantic_search",
@@ -18954,6 +19327,13 @@ var plugin58 = {
     });
   },
   teardown(api) {
+    if (state55.hookUnregister) {
+      try {
+        state55.hookUnregister();
+      } catch {
+      }
+      state55.hookUnregister = null;
+    }
     const final = {
       fileCount: state55.fileCount,
       termCount: state55.termCount,
@@ -18986,6 +19366,10 @@ var plugin58 = {
   }
 };
 var semantic_search_indexer_default = plugin58;
+
+// src/smart-rename/index.ts
+import { readFileSync as readFileSync22, writeFileSync as writeFileSync7 } from "node:fs";
+import { extname as extname9, isAbsolute as isAbsolute33, relative as relative32, resolve as resolve33 } from "node:path";
 var API_VERSION39 = "^0.1.10";
 var state56 = {
   renameCount: 0,
@@ -19007,18 +19391,18 @@ function readConfig51(raw) {
 function withinProject24(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute33(p) ? resolve33(p) : resolve33(root, p);
+  const rel = relative32(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute33(rel)) return false;
   return true;
 }
 function toPosix7(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath7(p) {
-  return toPosix7(relative(process.cwd(), p));
+  return toPosix7(relative32(process.cwd(), p));
 }
 function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -19089,14 +19473,14 @@ var plugin59 = {
         if (!withinProject24(rawPath)) {
           return { ok: false, error: "path is outside the project root" };
         }
-        const ext = extname(rawPath).toLowerCase();
+        const ext = extname9(rawPath).toLowerCase();
         if (!cfg.extensions.includes(ext)) {
           return { ok: false, error: `extension ${ext} is not allowed for rename` };
         }
-        const resolved = resolve(process.cwd(), rawPath);
+        const resolved = resolve33(process.cwd(), rawPath);
         let content;
         try {
-          content = readFileSync(resolved, "utf-8");
+          content = readFileSync22(resolved, "utf-8");
         } catch (err) {
           state56.errorCount += 1;
           return { ok: false, error: String(err) };
@@ -19106,7 +19490,7 @@ var plugin59 = {
         state56.replacementCount += replacements;
         if (input.apply) {
           try {
-            writeFileSync(resolved, preview, "utf-8");
+            writeFileSync7(resolved, preview, "utf-8");
           } catch (err) {
             state56.errorCount += 1;
             return { ok: false, error: String(err) };
@@ -19150,6 +19534,12 @@ var plugin59 = {
   }
 };
 var smart_rename_default = plugin59;
+
+// src/test-flake-detector/index.ts
+import { execFileSync as execFileSync12 } from "node:child_process";
+import { readFileSync as readFileSync23 } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname as dirname7, isAbsolute as isAbsolute34, relative as relative33, resolve as resolve34 } from "node:path";
 var API_VERSION40 = "^0.1.10";
 var state57 = {
   invocationCount: 0,
@@ -19209,19 +19599,95 @@ function parseTestOutput(output) {
   }
   return { passed, failed };
 }
-function buildCommand(baseCommand, testPattern) {
-  const trimmedBase = baseCommand.trim();
-  if (!testPattern) return trimmedBase;
-  if (trimmedBase.includes(testPattern)) return trimmedBase;
-  return `${trimmedBase} ${testPattern}`;
+var TEST_RUNNERS = /* @__PURE__ */ new Set(["vitest", "jest", "mocha"]);
+var ALLOWED_RUNNER_FLAGS = /* @__PURE__ */ new Set([
+  "run",
+  "--run",
+  "--runInBand",
+  "--passWithNoTests",
+  "--reporter=verbose",
+  "--reporter=default"
+]);
+function withinProject25(p) {
+  if (p.length === 0 || p.length > 4096 || p.startsWith("-")) return false;
+  const root = resolve34(process.cwd());
+  const resolved = isAbsolute34(p) ? resolve34(p) : resolve34(root, p);
+  const rel = relative33(root, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute34(rel);
+}
+function isInside(parent, child) {
+  if (parent === child) return true;
+  const rel = relative33(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute34(rel);
+}
+function tokenizeCommand(command) {
+  const trimmed = command.trim();
+  if (!trimmed || /["'`;&|<>\r\n]/.test(trimmed)) return null;
+  return trimmed.split(/\s+/).filter(Boolean);
+}
+function resolveTestCommand(baseCommand, testPattern) {
+  const tokens = tokenizeCommand(baseCommand);
+  if (!tokens) return null;
+  let runner;
+  let runnerArgs;
+  const [head, second, third, ...rest] = tokens;
+  if (TEST_RUNNERS.has(head ?? "")) {
+    runner = head;
+    runnerArgs = tokens.slice(1);
+  } else if (head === "npx" && TEST_RUNNERS.has(second ?? "")) {
+    runner = second;
+    runnerArgs = tokens.slice(2);
+  } else if (head === "pnpm" && (second === "exec" || second === "dlx") && TEST_RUNNERS.has(third ?? "")) {
+    runner = third;
+    runnerArgs = rest;
+  } else if (head === "pnpm" && TEST_RUNNERS.has(second ?? "")) {
+    runner = second;
+    runnerArgs = tokens.slice(2);
+  } else if (head === "npm" && second === "exec" && TEST_RUNNERS.has(third ?? "")) {
+    runner = third;
+    runnerArgs = rest;
+  } else if (head === "yarn" && TEST_RUNNERS.has(second ?? "")) {
+    runner = second;
+    runnerArgs = tokens.slice(2);
+  } else {
+    return null;
+  }
+  if (runnerArgs.some((arg) => !ALLOWED_RUNNER_FLAGS.has(arg))) return null;
+  let resolvedEntry;
+  try {
+    const requireFromProject = createRequire(resolve34(process.cwd(), "package.json"));
+    const packagePath = requireFromProject.resolve(`${runner}/package.json`);
+    const packageJson = JSON.parse(readFileSync23(packagePath, "utf8"));
+    const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[runner] ?? Object.values(packageJson.bin ?? {})[0];
+    if (!relativeBin) return null;
+    const packageDir = dirname7(packagePath);
+    const candidate = resolve34(packageDir, relativeBin);
+    if (isAbsolute34(relativeBin) || !isInside(packageDir, candidate)) {
+      return null;
+    }
+    resolvedEntry = candidate;
+  } catch {
+    return null;
+  }
+  const args = [resolvedEntry, ...runnerArgs];
+  if (testPattern) {
+    if (!withinProject25(testPattern)) return null;
+    args.push(testPattern);
+  }
+  return {
+    cmd: process.execPath,
+    args,
+    display: [...tokens, ...testPattern ? [testPattern] : []].join(" ")
+  };
 }
 function runOnce(command, timeoutMs) {
   try {
-    const output = execSync(command, {
+    const output = execFileSync12(command.cmd, command.args, {
       encoding: "utf-8",
       timeout: timeoutMs,
       cwd: process.cwd(),
-      stdio: ["pipe", "pipe", "pipe"]
+      stdio: ["pipe", "pipe", "pipe"],
+      shell: false
     });
     return { output };
   } catch (err) {
@@ -19306,10 +19772,16 @@ var plugin60 = {
           return { ok: false, error: "test-flake-detector is disabled" };
         }
         const requestedRuns = typeof input.runs === "number" && input.runs >= 1 ? Math.min(Math.floor(input.runs), cfg.maxRuns) : 5;
-        const command = buildCommand(
+        const command = resolveTestCommand(
           typeof input.command === "string" && input.command.trim().length > 0 ? input.command : cfg.defaultCommand,
           input.testPattern
         );
+        if (!command) {
+          return {
+            ok: false,
+            error: "Unsupported test command or unsafe testPattern. Use vitest, jest, or mocha through a supported package runner, and keep patterns inside the project."
+          };
+        }
         state57.invocationCount += 1;
         const start = Date.now();
         const records = /* @__PURE__ */ new Map();
@@ -19351,7 +19823,7 @@ var plugin60 = {
         };
         return {
           ok: true,
-          command,
+          command: command.display,
           runsRequested: requestedRuns,
           runsCompleted,
           durationMs,
@@ -19419,6 +19891,10 @@ var plugin60 = {
   }
 };
 var test_flake_detector_default = plugin60;
+
+// src/test-generator/index.ts
+import { readFileSync as readFileSync24 } from "node:fs";
+import { isAbsolute as isAbsolute35, relative as relative34, resolve as resolve35 } from "node:path";
 var API_VERSION41 = "^0.1.10";
 var state58 = {
   generateCount: 0,
@@ -19441,21 +19917,21 @@ function readConfig53(raw) {
     includeImports: r["includeImports"] !== false
   };
 }
-function withinProject25(p) {
+function withinProject26(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute35(p) ? resolve35(p) : resolve35(root, p);
+  const rel = relative34(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute35(rel)) return false;
   return true;
 }
 function toPosix8(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath8(p) {
-  return toPosix8(relative(process.cwd(), p));
+  return toPosix8(relative34(process.cwd(), p));
 }
 function detectExports(content) {
   const exports = [];
@@ -19464,31 +19940,30 @@ function detectExports(content) {
   const arrowRe = /export\s+(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>/g;
   const classRe = /export\s+(?:abstract\s+)?class\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
   const namedRe = /export\s*\{([^}]+)\}/g;
-  let m;
   functionRe.lastIndex = 0;
-  while ((m = functionRe.exec(content)) !== null) {
-    if (!seen.has(m[1])) {
-      seen.add(m[1]);
-      exports.push({ name: m[1], kind: "function" });
+  for (const match of content.matchAll(functionRe)) {
+    if (!seen.has(match[1])) {
+      seen.add(match[1]);
+      exports.push({ name: match[1], kind: "function" });
     }
   }
   arrowRe.lastIndex = 0;
-  while ((m = arrowRe.exec(content)) !== null) {
-    if (!seen.has(m[1])) {
-      seen.add(m[1]);
-      exports.push({ name: m[1], kind: "arrow" });
+  for (const match of content.matchAll(arrowRe)) {
+    if (!seen.has(match[1])) {
+      seen.add(match[1]);
+      exports.push({ name: match[1], kind: "arrow" });
     }
   }
   classRe.lastIndex = 0;
-  while ((m = classRe.exec(content)) !== null) {
-    if (!seen.has(m[1])) {
-      seen.add(m[1]);
-      exports.push({ name: m[1], kind: "class" });
+  for (const match of content.matchAll(classRe)) {
+    if (!seen.has(match[1])) {
+      seen.add(match[1]);
+      exports.push({ name: match[1], kind: "class" });
     }
   }
   namedRe.lastIndex = 0;
-  while ((m = namedRe.exec(content)) !== null) {
-    const names = m[1].split(",").map((s) => s.trim()).filter(Boolean);
+  for (const match of content.matchAll(namedRe)) {
+    const names = match[1].split(",").map((s) => s.trim()).filter(Boolean);
     for (const raw of names) {
       const parts = raw.split(/\s+as\s+/);
       const name = (parts.length > 1 ? parts[parts.length - 1] : raw).trim();
@@ -19536,7 +20011,7 @@ function generateTestContent(filePath, detected, cfg) {
   return lines.join("\n");
 }
 function generateForFile(filePath, cfg) {
-  const content = readFileSync(filePath, "utf-8");
+  const content = readFileSync24(filePath, "utf-8");
   const detected = detectExports(content);
   const sourceName = relativePath8(filePath).split("/").pop();
   const baseName = sourceName.replace(/\.[^.]+$/, "");
@@ -19603,10 +20078,10 @@ var plugin61 = {
         if (!rawPath || typeof rawPath !== "string") {
           return { ok: false, error: "path is required" };
         }
-        if (!withinProject25(rawPath)) {
+        if (!withinProject26(rawPath)) {
           return { ok: false, error: "path is outside the project root" };
         }
-        const resolved = resolve(process.cwd(), rawPath);
+        const resolved = resolve35(process.cwd(), rawPath);
         state58.generateCount += 1;
         let result;
         try {
@@ -19936,9 +20411,9 @@ var plugin62 = {
       state59.postInvocations += 1;
       let content;
       try {
-        const stat4 = await fsp.stat(filePath);
+        const stat4 = await fs3.stat(filePath);
         if (!stat4.isFile()) return;
-        content = await fsp.readFile(filePath, "utf-8");
+        content = await fs3.readFile(filePath, "utf-8");
       } catch {
         state59.readErrorCount += 1;
         return;
@@ -20070,5 +20545,68 @@ ${lines}${overflowNote}`
   }
 };
 var spec_linker_default = plugin62;
-
-export { accessibility_auditor_default as accessibilityAuditorPlugin, agent_handoff_default as agentHandoffPlugin, api_compatibility_gate_default as apiCompatibilityGatePlugin, auto_doc_default as autoDocPlugin, auto_escalate_default as autoEscalatePlugin, auto_i18n_extractor_default as autoI18nExtractorPlugin, branch_guard_default as branchGuardPlugin, changelog_writer_default as changelogWriterPlugin, checkpoint_default as checkpointPlugin, code_metrics_default as codeMetricsPlugin, commit_validator_default as commitValidatorPlugin, config_validator_default as configValidatorPlugin, context_pins_default as contextPinsPlugin, cost_tracker_default as costTrackerPlugin, cron_default as cronPlugin, dead_code_detector_default as deadCodeDetectorPlugin, dep_guard_default as depGuardPlugin, dependency_vulnerability_gate_default as dependencyVulnerabilityGatePlugin, diff_summary_default as diffSummaryPlugin, doc_sync_guard_default as docSyncGuardPlugin, duplicate_code_detector_default as duplicateCodeDetectorPlugin, error_lens_default as errorLensPlugin, feature_flag_tracker_default as featureFlagTrackerPlugin, file_watcher_default as fileWatcherPlugin, format_on_save_default as formatOnSavePlugin, git_autocommit_default as gitAutocommitPlugin, import_organizer_default as importOrganizerPlugin, injection_shield_default as injectionShieldPlugin, interface_contract_guard_default as interfaceContractGuardPlugin, knowledge_graph_default as knowledgeGraphPlugin, license_audit_gate_default as licenseAuditGatePlugin, lint_gate_default as lintGatePlugin, llm_cache_default as llmCachePlugin, loop_breaker_default as loopBreakerPlugin, migration_planner_default as migrationPlannerPlugin, model_router_default as modelRouterPlugin, notify_hub_default as notifyHubPlugin, path_guard_default as pathGuardPlugin, performance_regression_gate_default as performanceRegressionGatePlugin, plugin_stack_observer_default as pluginStackObserverPlugin, pr_drafter_default as prDrafterPlugin, prompt_firewall_default as promptFirewallPlugin, refactor_suggester_default as refactorSuggesterPlugin, release_notes_generator_default as releaseNotesGeneratorPlugin, schema_evolution_guard_default as schemaEvolutionGuardPlugin, secret_scanner_default as secretScannerPlugin, security_hotspot_scanner_default as securityHotspotScannerPlugin, semantic_search_indexer_default as semanticSearchIndexerPlugin, semver_bump_default as semverBumpPlugin, session_recap_default as sessionRecapPlugin, shell_check_default as shellCheckPlugin, smart_rename_default as smartRenamePlugin, spec_linker_default as specLinkerPlugin, template_engine_default as templateEnginePlugin, test_coverage_gate_default as testCoverageGatePlugin, test_flake_detector_default as testFlakeDetectorPlugin, test_generator_default as testGeneratorPlugin, test_runner_gate_default as testRunnerGatePlugin, todo_listener_default as todoListenerPlugin, todo_tracker_default as todoTrackerPlugin, token_budget_default as tokenBudgetPlugin, token_throttle_default as tokenThrottlePlugin, type_gate_default as typeGatePlugin };
+export {
+  accessibility_auditor_default as accessibilityAuditorPlugin,
+  agent_handoff_default as agentHandoffPlugin,
+  api_compatibility_gate_default as apiCompatibilityGatePlugin,
+  auto_doc_default as autoDocPlugin,
+  auto_escalate_default as autoEscalatePlugin,
+  auto_i18n_extractor_default as autoI18nExtractorPlugin,
+  branch_guard_default as branchGuardPlugin,
+  changelog_writer_default as changelogWriterPlugin,
+  checkpoint_default as checkpointPlugin,
+  code_metrics_default as codeMetricsPlugin,
+  commit_validator_default as commitValidatorPlugin,
+  config_validator_default as configValidatorPlugin,
+  context_pins_default as contextPinsPlugin,
+  cost_tracker_default as costTrackerPlugin,
+  cron_default as cronPlugin,
+  dead_code_detector_default as deadCodeDetectorPlugin,
+  dep_guard_default as depGuardPlugin,
+  dependency_vulnerability_gate_default as dependencyVulnerabilityGatePlugin,
+  diff_summary_default as diffSummaryPlugin,
+  doc_sync_guard_default as docSyncGuardPlugin,
+  duplicate_code_detector_default as duplicateCodeDetectorPlugin,
+  error_lens_default as errorLensPlugin,
+  feature_flag_tracker_default as featureFlagTrackerPlugin,
+  file_watcher_default as fileWatcherPlugin,
+  format_on_save_default as formatOnSavePlugin,
+  git_autocommit_default as gitAutocommitPlugin,
+  import_organizer_default as importOrganizerPlugin,
+  injection_shield_default as injectionShieldPlugin,
+  interface_contract_guard_default as interfaceContractGuardPlugin,
+  knowledge_graph_default as knowledgeGraphPlugin,
+  license_audit_gate_default as licenseAuditGatePlugin,
+  lint_gate_default as lintGatePlugin,
+  llm_cache_default as llmCachePlugin,
+  loop_breaker_default as loopBreakerPlugin,
+  migration_planner_default as migrationPlannerPlugin,
+  model_router_default as modelRouterPlugin,
+  notify_hub_default as notifyHubPlugin,
+  path_guard_default as pathGuardPlugin,
+  performance_regression_gate_default as performanceRegressionGatePlugin,
+  plugin_stack_observer_default as pluginStackObserverPlugin,
+  pr_drafter_default as prDrafterPlugin,
+  prompt_firewall_default as promptFirewallPlugin,
+  refactor_suggester_default as refactorSuggesterPlugin,
+  release_notes_generator_default as releaseNotesGeneratorPlugin,
+  schema_evolution_guard_default as schemaEvolutionGuardPlugin,
+  secret_scanner_default as secretScannerPlugin,
+  security_hotspot_scanner_default as securityHotspotScannerPlugin,
+  semantic_search_indexer_default as semanticSearchIndexerPlugin,
+  semver_bump_default as semverBumpPlugin,
+  session_recap_default as sessionRecapPlugin,
+  shell_check_default as shellCheckPlugin,
+  smart_rename_default as smartRenamePlugin,
+  spec_linker_default as specLinkerPlugin,
+  template_engine_default as templateEnginePlugin,
+  test_coverage_gate_default as testCoverageGatePlugin,
+  test_flake_detector_default as testFlakeDetectorPlugin,
+  test_generator_default as testGeneratorPlugin,
+  test_runner_gate_default as testRunnerGatePlugin,
+  todo_listener_default as todoListenerPlugin,
+  todo_tracker_default as todoTrackerPlugin,
+  token_budget_default as tokenBudgetPlugin,
+  token_throttle_default as tokenThrottlePlugin,
+  type_gate_default as typeGatePlugin
+};