@wrongstack/plugins 0.308.6 → 0.309.0

package/dist/index.js

@@ -1,699 +1,25 @@
-// src/accessibility-auditor/index.ts
-import { readFile } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3 } from "node:path";
-
-// src/runtime/index.ts
-import { execFile } from "node:child_process";
-import { basename, extname as extname2, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
-
-// src/runtime/llm.ts
-function stripOuterMarkdownFence(text) {
-  const trimmed = text.trim();
-  const match = trimmed.match(/^```(?:[a-z0-9_-]+)?\s*\r?\n([\s\S]*?)\r?\n```$/i);
-  return (match?.[1] ?? trimmed).trim();
-}
-function parseLlmJsonObject(text) {
-  const candidate = stripOuterMarkdownFence(text);
-  try {
-    const parsed = JSON.parse(candidate);
-    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-async function runOptionalPluginLlm(request) {
-  if (!request.requested) {
-    return { used: false, value: null, fallbackReason: "not-requested" };
-  }
-  if (!request.api.llm) {
-    return { used: false, value: null, fallbackReason: "unavailable" };
-  }
-  if (request.options?.signal?.aborted) {
-    return { used: false, value: null, fallbackReason: "cancelled" };
-  }
-  try {
-    const response = await request.api.llm.complete(request.prompt, request.options);
-    const parsed = request.parse(response.text);
-    if (parsed === null) {
-      request.api.log.warn(`${request.label}: ignored invalid LLM response`);
-      return { used: false, value: null, fallbackReason: "invalid-response" };
-    }
-    return { used: true, value: parsed, fallbackReason: null };
-  } catch (error) {
-    const cancelled = request.options?.signal?.aborted === true;
-    request.api.log.warn(`${request.label}: LLM enrichment failed; using deterministic fallback`, {
-      error: error instanceof Error ? error.message : String(error)
-    });
-    return {
-      used: false,
-      value: null,
-      fallbackReason: cancelled ? "cancelled" : "provider-error"
-    };
-  }
-}
-async function runOptionalPluginCouncil(request) {
-  if (!request.requested) {
-    return { used: false, value: null, fallbackReason: "not-requested" };
-  }
-  if (request.options?.signal?.aborted) {
-    return { used: false, value: null, fallbackReason: "cancelled" };
-  }
-  const council = request.api.llm?.council;
-  if (council) {
-    try {
-      const result = await council(request.prompt, {
-        ...request.context ? { context: request.context } : {},
-        ...request.profile ? { profile: request.profile } : {},
-        ...request.councilOptions ? { options: request.councilOptions } : {},
-        ...request.options?.signal ? { signal: request.options.signal } : {}
-      });
-      if (result.status === "cancelled") {
-        return { used: false, value: null, fallbackReason: "cancelled" };
-      }
-      const parsed = result.status === "decided" ? request.parse(result.answer ?? "") : null;
-      if (parsed !== null) return { used: true, value: parsed, fallbackReason: null };
-      request.api.log.warn(
-        `${request.label}: Council did not return a valid answer; trying One Shot`,
-        {
-          status: result.status,
-          resolution: result.resolution
-        }
-      );
-    } catch (error) {
-      if (request.options?.signal?.aborted) {
-        return { used: false, value: null, fallbackReason: "cancelled" };
-      }
-      request.api.log.warn(`${request.label}: Council failed; trying One Shot`, {
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
-  }
-  return runOptionalPluginLlm(request);
-}
-
-// src/runtime/local-bin.ts
-import { createRequire } from "node:module";
-import { delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { accessSync, constants, readFileSync } from "node:fs";
-import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
-function resolveExecInvocation(command, args = []) {
-  const resolved = resolveWin32Command(command);
-  const normalizedResolved = resolved.toLowerCase();
-  const needsShell = process.platform === "win32" && (normalizedResolved.endsWith(".cmd") || normalizedResolved.endsWith(".bat"));
-  if (needsShell) {
-    const shim = buildWin32CmdShimInvocation(resolved, args);
-    return { cmd: shim.command, args: shim.args, windowsVerbatimArguments: true };
-  }
-  return { cmd: resolved, args: [...args], windowsVerbatimArguments: false };
-}
-function findOnPath(cmd) {
-  if (!cmd) return null;
-  const exists = (p) => {
-    try {
-      accessSync(p, constants.X_OK);
-      return true;
-    } catch {
-      return false;
-    }
-  };
-  if (cmd.includes("/") || cmd.includes("\\")) {
-    return exists(cmd) ? resolve(cmd) : null;
-  }
-  const suffixes = process.platform === "win32" && extname(cmd) === "" ? (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
-  for (const dir of (process.env["PATH"] ?? "").split(delimiter)) {
-    if (!dir) continue;
-    const base = join(dir, cmd);
-    for (const suffix of suffixes) {
-      const candidate = `${base}${suffix}`;
-      if (exists(candidate)) return candidate;
-    }
-  }
-  return null;
-}
-function isInside(parent, candidate) {
-  const rel = relative(parent, candidate);
-  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel);
-}
-var binCache = /* @__PURE__ */ new Map();
-var BIN_CACHE_MAX = 64;
-var NEGATIVE_BIN_CACHE_TTL_MS = 5e3;
-function cachePut(key, value) {
-  while (binCache.size >= BIN_CACHE_MAX) {
-    const oldest = binCache.keys().next().value;
-    if (oldest === void 0) break;
-    binCache.delete(oldest);
-  }
-  binCache.set(key, { value, cachedAt: Date.now() });
-  return value;
-}
-function clearLocalBinCache() {
-  binCache.clear();
-}
-function resolveNodeBin(packageName, binName, cwd, extraArgs = []) {
-  const key = `${packageName}|${binName}|${cwd}`;
-  const cached = binCache.get(key);
-  if (cached !== void 0) {
-    if (cached.value !== null || Date.now() - cached.cachedAt < NEGATIVE_BIN_CACHE_TTL_MS) {
-      return cached.value === null ? null : { ...cached.value, args: [cached.value.entry, ...extraArgs] };
-    }
-    binCache.delete(key);
-  }
-  let resolved = null;
-  try {
-    const requireFromProject = createRequire(resolve(cwd, "package.json"));
-    const packagePath = requireFromProject.resolve(`${packageName}/package.json`);
-    const packageJson = JSON.parse(readFileSync(packagePath, "utf-8"));
-    const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[binName] ?? Object.values(packageJson.bin ?? {})[0];
-    if (relativeBin && !isAbsolute(relativeBin)) {
-      const packageDir = dirname(packagePath);
-      const entry = resolve(packageDir, relativeBin);
-      if (isInside(packageDir, entry)) {
-        resolved = { cmd: process.execPath, args: [entry], entry };
-      }
-    }
-  } catch {
-    resolved = null;
-  }
-  cachePut(key, resolved);
-  return resolved === null ? null : { ...resolved, args: [resolved.entry, ...extraArgs] };
-}
-function resolveFirstNodeBin(candidates, cwd) {
-  for (const c of candidates) {
-    const hit = resolveNodeBin(c.packageName, c.binName, cwd, c.args ?? []);
-    if (hit) return { ...hit, packageName: c.packageName, binName: c.binName };
-  }
-  return null;
-}
-
-// src/runtime/bounded-map.ts
-var BoundedMap = class {
-  map = /* @__PURE__ */ new Map();
-  max;
-  ttlMs;
-  now;
-  /** Entries dropped to stay under `max`. Surfaced by plugin health(). */
-  evictions = 0;
-  constructor(options) {
-    const normalizedMax = Math.floor(options.max);
-    this.max = Number.isSafeInteger(normalizedMax) ? Math.max(1, normalizedMax) : 1;
-    this.ttlMs = options.ttlMs;
-    this.now = options.now ?? Date.now;
-  }
-  expired(entry) {
-    return this.ttlMs !== void 0 && this.now() - entry.storedAt > this.ttlMs;
-  }
-  get(key) {
-    const entry = this.map.get(key);
-    if (entry === void 0) return void 0;
-    if (this.expired(entry)) {
-      this.map.delete(key);
-      return void 0;
-    }
-    this.map.delete(key);
-    this.map.set(key, entry);
-    return entry.value;
-  }
-  /**
-   * Read without promoting the key to most-recently-used. Use for
-   * diagnostics that must not perturb the eviction order.
-   */
-  peek(key) {
-    const entry = this.map.get(key);
-    if (entry === void 0 || this.expired(entry)) return void 0;
-    return entry.value;
-  }
-  has(key) {
-    const entry = this.map.get(key);
-    if (entry === void 0) return false;
-    if (this.expired(entry)) {
-      this.map.delete(key);
-      return false;
-    }
-    return true;
-  }
-  set(key, value) {
-    this.map.delete(key);
-    this.map.set(key, { value, storedAt: this.now() });
-    while (this.map.size > this.max) {
-      const coldest = this.map.keys().next().value;
-      if (coldest === void 0) break;
-      this.map.delete(coldest);
-      this.evictions += 1;
-    }
-    return this;
-  }
-  delete(key) {
-    return this.map.delete(key);
-  }
-  clear() {
-    this.map.clear();
-    this.evictions = 0;
-  }
-  get size() {
-    return this.map.size;
-  }
-  /** How many entries have been dropped to respect `max`, since the last clear. */
-  get evictionCount() {
-    return this.evictions;
-  }
-  /** Drop every expired entry. Cheap enough to call from a status tool. */
-  prune() {
-    if (this.ttlMs === void 0) return 0;
-    let removed = 0;
-    for (const [key, entry] of this.map) {
-      if (this.expired(entry)) {
-        this.map.delete(key);
-        removed += 1;
-      }
-    }
-    return removed;
-  }
-  /** Live (non-expired) entries, coldest first. */
-  *entries() {
-    for (const [key, entry] of this.map) {
-      if (!this.expired(entry)) yield [key, entry.value];
-    }
-  }
-  [Symbol.iterator]() {
-    return this.entries();
-  }
-};
-var BoundedSet = class {
-  inner;
-  constructor(options) {
-    this.inner = new BoundedMap(options);
-  }
-  has(value) {
-    return this.inner.has(value);
-  }
-  add(value) {
-    this.inner.set(value, true);
-    return this;
-  }
-  delete(value) {
-    return this.inner.delete(value);
-  }
-  clear() {
-    this.inner.clear();
-  }
-  get size() {
-    return this.inner.size;
-  }
-  /** How many entries have been dropped to respect `max`, since the last clear. */
-  get evictionCount() {
-    return this.inner.evictionCount;
-  }
-  *values() {
-    for (const [key] of this.inner) yield key;
-  }
-  [Symbol.iterator]() {
-    return this.values();
-  }
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
 };
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 
-// src/runtime/safe-json.ts
-var UNSERIALIZABLE = "[unserializable]";
-function safeJsonStringify(value, indent) {
-  try {
-    const stack = [];
-    const out = JSON.stringify(
-      value,
-      function replacer(_key, val) {
-        if (typeof val === "bigint") return `${val.toString()}n`;
-        if (val === null || typeof val !== "object") return val;
-        while (stack.length > 0 && stack[stack.length - 1] !== this) stack.pop();
-        if (stack.includes(val)) return "[circular]";
-        stack.push(val);
-        return val;
-      },
-      indent
-    );
-    return out ?? String(value);
-  } catch {
-    return UNSERIALIZABLE;
-  }
-}
-
-// src/runtime/handles.ts
-function releaseHandle(off) {
-  if (off) {
-    try {
-      off();
-    } catch {
-    }
-  }
-  return null;
-}
-
-// src/runtime/redos-guard.ts
-import { Worker } from "node:worker_threads";
-function withReDoSGuard(re, input, budgetMs = 50, options = {}) {
-  const opts = { budgetMs, ...options };
-  const start = Date.now();
-  const workerSource = buildWorkerSource(re.source, input, re.flags);
-  const worker = new Worker(workerSource, {
-    eval: true,
-    name: `redos-guard:${re.source.slice(0, 32)}`
-  });
-  return new Promise((resolve29) => {
-    let settled = false;
-    const onMessage = (msg) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      worker.terminate().catch(() => {
-      });
-      if (!msg.ok) {
-        resolve29({ timedOut: true, match: null });
-        return;
-      }
-      resolve29({ timedOut: false, match: msg.match });
-    };
-    const onError = () => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      worker.terminate().catch(() => {
-      });
-      resolve29({ timedOut: true, match: null });
-    };
-    const timer = setTimeout(() => {
-      if (settled) return;
-      settled = true;
-      const elapsedMs = Date.now() - start;
-      worker.terminate().catch(() => {
-      });
-      try {
-        opts.onTimeout?.({
-          regex: re,
-          input,
-          budgetMs: opts.budgetMs,
-          elapsedMs
-        });
-      } catch {
-      }
-      resolve29({ timedOut: true, match: null });
-    }, opts.budgetMs);
-    timer.unref?.();
-    worker.on("message", onMessage);
-    worker.on("error", onError);
-  });
-}
-function buildWorkerSource(source, input, flags) {
-  const S = JSON.stringify(source);
-  const I = JSON.stringify(input);
-  const F = JSON.stringify(flags);
-  return `
-const { parentPort } = require('node:worker_threads');
-const source = ${S};
-const input = ${I};
-const flags = ${F};
-try {
-  const re = new RegExp(source, flags);
-  const match = re.exec(input);
-  // parentPort.postMessage, NOT bare postMessage: with eval:true
-  // workers this Node version does not expose the bare postMessage
-  // global \u2014 the worker throws ReferenceError at startup and the
-  // host misreads it as a timeout (positive-path regression).
-  parentPort.postMessage({ ok: true, match });
-} catch (err) {
-  parentPort.postMessage({ ok: false, error: err && err.message ? err.message : String(err) });
-}
-`;
-}
+// src/accessibility-auditor/index.ts
+import { readFile } from "node:fs/promises";
+import { isAbsolute, relative, resolve } from "node:path";
 
 // src/runtime/index.ts
-var META_CHARS = /["'`;&|<>\r\n]/;
-var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
-function hasLeadingDash(arg) {
-  return arg.length > 0 && arg.startsWith("-");
-}
-function safeSplit(command) {
-  const trimmed = command.trim();
-  if (!trimmed || META_CHARS.test(trimmed)) return null;
-  return trimmed.split(/\s+/).filter(Boolean);
-}
-function withinProjectPath(projectRoot, candidate) {
-  if (candidate.length === 0 || candidate.length > 4096) return false;
-  if (hasLeadingDash(candidate)) return false;
-  const resolved = isAbsolute2(candidate) ? resolve2(candidate) : resolve2(projectRoot, candidate);
-  const rel = relative2(projectRoot, resolved);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
-}
-function everyFlagAllowed(allowed, args) {
-  for (const arg of args) {
-    if (!hasLeadingDash(arg)) continue;
-    if (allowed === null) return false;
-    if (!allowed.has(arg)) return false;
-  }
-  return true;
-}
-function sanitizeRunnerPath(value, options = {}) {
-  if (!value || hasLeadingDash(value)) return null;
-  const projectRoot = resolve2(options.projectRoot ?? process.cwd());
-  if (!withinProjectPath(projectRoot, value)) return null;
-  return isAbsolute2(value) ? resolve2(value) : resolve2(projectRoot, value);
-}
-function resolveRunnerCommand(runtime, command, options = {}) {
-  const tokens = safeSplit(command);
-  if (!tokens || tokens.length === 0) return null;
-  const projectRoot = resolve2(options.projectRoot ?? process.cwd());
-  const launcher = runtime.packageManager;
-  const [head, second, ...rest] = tokens;
-  if (!head) return null;
-  const display = tokens.join(" ");
-  if (launcher !== "none" && tokens.length === 1 && head === launcher) {
-    return null;
-  }
-  if (head === runtime.executable) {
-    if (!everyFlagAllowed(runtime.allowedFlags, [second, ...rest].filter((v) => Boolean(v)))) {
-      return null;
-    }
-    return {
-      cmd: head,
-      args: [second, ...rest].filter((v) => Boolean(v)),
-      display
-    };
-  }
-  if (launcher !== "none" && head === launcher && runtime.subcommands.length === 0 && second === runtime.executable) {
-    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
-    return { cmd: head, args: [second, ...rest], display };
-  }
-  if (launcher !== "none" && head === launcher && runtime.subcommands.length > 0) {
-    const subcommand = runtime.subcommands[0];
-    const exe = rest[0];
-    if (second === subcommand && exe === runtime.executable) {
-      const tail = rest.slice(1);
-      if (!everyFlagAllowed(runtime.allowedFlags, tail)) return null;
-      return { cmd: head, args: [second, exe, ...tail], display };
-    }
-  }
-  if (isAbsolute2(head)) {
-    if (!withinProjectPath(projectRoot, head)) return null;
-    const base = basename(head);
-    if (base !== runtime.executable && base !== launcher) return null;
-    if (second !== runtime.executable) return null;
-    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
-    return { cmd: head, args: [second, ...rest], display };
-  }
-  return null;
-}
-function runRunnerCommand(argv, options) {
-  if (argv.length === 0) {
-    return Promise.resolve({
-      code: null,
-      stdout: "",
-      stderr: "runtime helper: empty argv",
-      timedOut: false,
-      spawnError: true
-    });
-  }
-  return new Promise((resolvePromise) => {
-    const projectRoot = resolve2(options.projectRoot ?? process.cwd());
-    const trimmedCwd = options.cwd.trim();
-    if (!withinProjectPath(projectRoot, trimmedCwd)) {
-      resolvePromise({
-        code: null,
-        stdout: "",
-        stderr: "runtime helper: cwd outside project",
-        timedOut: false,
-        spawnError: true
-      });
-      return;
-    }
-    let timedOut = false;
-    let spawnErrored = false;
-    const start = Date.now();
-    const stdoutChunks = [];
-    const stderrChunks = [];
-    let stdoutBytes = 0;
-    let stderrBytes = 0;
-    const onAbort = () => {
-      timedOut = true;
-    };
-    let invocation;
-    try {
-      invocation = resolveExecInvocation(argv[0], argv.slice(1));
-    } catch (err) {
-      resolvePromise({
-        code: null,
-        stdout: "",
-        stderr: `runtime helper: ${err instanceof Error ? err.message : String(err)}`,
-        timedOut: false,
-        spawnError: true
-      });
-      return;
-    }
-    options.signal?.addEventListener("abort", onAbort, { once: true });
-    const child = execFile(
-      invocation.cmd,
-      invocation.args,
-      {
-        cwd: trimmedCwd,
-        timeout: options.timeoutMs,
-        signal: options.signal,
-        maxBuffer: MAX_BUFFER_BYTES,
-        // execFile defaults `encoding` to 'utf8', which makes the
-        // stdout/stderr `data` events emit *strings*. The chunk arrays
-        // below are typed Buffer[] and every consumer runs them through
-        // Buffer.concat(...).toString('utf8'), which throws
-        // ERR_INVALID_ARG_TYPE on any non-empty string output. Pin the
-        // streams to buffers so the declared contract holds (regression:
-        // runRunnerCommand crashed on any child that actually wrote
-        // output; only the maxBuffer fixture exercised this path).
-        encoding: "buffer",
-        windowsHide: true,
-        shell: false,
-        ...invocation.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
-      },
-      (err) => {
-        options.signal?.removeEventListener("abort", onAbort);
-        if (timedOut) {
-          resolvePromise({
-            code: null,
-            stdout: Buffer.concat(stdoutChunks).toString("utf8"),
-            stderr: Buffer.concat(stderrChunks).toString("utf8"),
-            timedOut: true,
-            spawnError: false
-          });
-          return;
-        }
-        if (spawnErrored) {
-          resolvePromise({
-            code: 127,
-            stdout: Buffer.concat(stdoutChunks).toString("utf8"),
-            stderr: Buffer.concat(stderrChunks).toString("utf8"),
-            timedOut: false,
-            spawnError: true
-          });
-          return;
-        }
-        if (err) {
-          const anyErr = err;
-          if ((anyErr.killed === true || anyErr.signal === "SIGTERM") && // maxBuffer overflow must NOT be misreported as a timeout
-          // — it's a real failure (the child wrote too much) and
-          // downstream callers (type-gate/index.ts:227) return
-          // null on timedOut=true, which would silently swallow
-          // maxBuffer overflow into a confusing empty-output
-          // result. Skip the timeout resolve when the err shape
-          // names maxBuffer explicitly.
-          !/maxBuffer length exceeded/i.test(anyErr.message ?? "") && // And only count it as a timeout if the wall clock has
-          // actually elapsed past the budget. External SIGTERMs and
-          // races against the exit handler don't satisfy this.
-          Date.now() - start >= options.timeoutMs) {
-            resolvePromise({
-              code: null,
-              stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
-              stderr: Buffer.concat(stderrChunks).toString("utf-8"),
-              timedOut: true,
-              spawnError: false
-            });
-            return;
-          }
-          const code = typeof anyErr.code === "number" ? anyErr.code : 1;
-          resolvePromise({
-            code,
-            stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
-            stderr: Buffer.concat(stderrChunks).toString("utf-8"),
-            timedOut: false,
-            spawnError: false
-          });
-          return;
-        }
-        resolvePromise({
-          code: 0,
-          stdout: Buffer.concat(stdoutChunks).toString("utf8"),
-          stderr: Buffer.concat(stderrChunks).toString("utf8"),
-          timedOut: false,
-          spawnError: false
-        });
-      }
-    );
-    child.on("exit", (_code, signal) => {
-      if (signal !== null && Date.now() - start >= options.timeoutMs) {
-        timedOut = true;
-      }
-    });
-    child.stdout?.on("data", (chunk) => {
-      stdoutBytes += chunk.length;
-      if (stdoutBytes <= MAX_BUFFER_BYTES) stdoutChunks.push(chunk);
-    });
-    child.stderr?.on("data", (chunk) => {
-      stderrBytes += chunk.length;
-      if (stderrBytes <= MAX_BUFFER_BYTES) stderrChunks.push(chunk);
-    });
-    child.on("error", (err) => {
-      if (err.code === "ENOENT" || err.code === "EPERM" || err.code === "EACCES") {
-        spawnErrored = true;
-      }
-    });
-  });
-}
-function withinProject(p) {
-  const cwd = process.cwd();
-  return withinProjectPath(cwd, p) || relative2(cwd, p) === ".";
-}
-var DEFAULT_EXCLUDE_DIRS = ["node_modules", "dist", ".git", "coverage"];
-async function collectSourceFilesAsync(root, opts) {
-  const { readdir: readdir6, stat: stat8 } = await import("node:fs/promises");
-  const files = [];
-  try {
-    const s = await stat8(root);
-    if (s.isFile()) {
-      if (matchesExtension(root, opts.extensions)) files.push(root);
-      return files;
-    }
-    if (!s.isDirectory()) return files;
-  } catch {
-    return files;
-  }
-  const exclude = opts.excludeDirs ?? DEFAULT_EXCLUDE_DIRS;
-  const excludeSet = new Set(exclude);
-  async function walk(dir, depth) {
-    if (opts.maxDepth !== void 0 && depth > opts.maxDepth) return;
-    let entries;
-    try {
-      entries = await readdir6(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    entries.sort((a, b) => a.name.localeCompare(b.name));
-    for (const entry of entries) {
-      if (excludeSet.has(entry.name)) continue;
-      const full = resolve2(dir, entry.name);
-      if (entry.isDirectory()) {
-        await walk(full, depth + 1);
-      } else if (entry.isFile() && matchesExtension(full, opts.extensions)) {
-        files.push(full);
-      }
-    }
-  }
-  await walk(root, 0);
-  return files;
-}
-function matchesExtension(p, exts) {
-  return exts.includes(extname2(p).toLowerCase());
-}
+var runtime_exports = {};
+__reExport(runtime_exports, runtime_star);
+import * as runtime_star from "@wrongstack/plugin-sdk/runtime";
 
 // src/accessibility-auditor/index.ts
 var API_VERSION = "^0.1.10";
@@ -780,7 +106,7 @@ async function auditFile(filePath, projectRoot) {
   const idsByValue = /* @__PURE__ */ new Map();
   function add(line, rule, severity, message, note) {
     findings.push({
-      file: relative3(projectRoot, filePath),
+      file: relative(projectRoot, filePath),
       line,
       rule,
       severity,
@@ -879,9 +205,9 @@ async function auditFile(filePath, projectRoot) {
 }
 async function auditPath(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute3(rawPath) ? resolve3(rawPath) : resolve3(root, rawPath);
+  const resolved = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
   const exts = normalizeExtensions(cfg.includeExtensions);
-  const files = await collectSourceFilesAsync(resolved, { extensions: exts });
+  const files = await (0, runtime_exports.collectSourceFilesAsync)(resolved, { extensions: exts });
   const findings = [];
   let scannedFiles = 0;
   let truncated = false;
@@ -895,7 +221,7 @@ async function auditPath(rawPath, cfg) {
     }
   }
   return {
-    path: relative3(root, resolved),
+    path: relative(root, resolved),
     findings: findings.slice(0, cfg.maxFindings),
     fileCount: files.length,
     scannedFiles,
@@ -968,7 +294,7 @@ var plugin = {
     state.findingCount = 0;
     state.hookInvocationCount = 0;
     state.lastResult = null;
-    state.hookUnregister = releaseHandle(state.hookUnregister);
+    state.hookUnregister = (0, runtime_exports.releaseHandle)(state.hookUnregister);
     const cfg = readConfig(api.config.extensions?.["accessibility-auditor"]);
     const hook = async (input) => {
       if (!cfg.enabled || !cfg.onWriteEdit) return;
@@ -976,9 +302,9 @@ var plugin = {
       const inp = input.toolInput ?? {};
       const sourcePath = inp["path"];
       if (!sourcePath || typeof sourcePath !== "string") return;
-      if (!withinProject(sourcePath)) return;
+      if (!(0, runtime_exports.withinProject)(sourcePath)) return;
       const exts = normalizeExtensions(cfg.includeExtensions);
-      if (!matchesExtension(sourcePath, exts)) return;
+      if (!(0, runtime_exports.matchesExtension)(sourcePath, exts)) return;
       state.hookInvocationCount += 1;
       const result = await auditPath(sourcePath, cfg);
       state.auditCount += 1;
@@ -1020,7 +346,7 @@ var plugin = {
         if (!rawPath || typeof rawPath !== "string") {
           return { ok: false, error: "path is required" };
         }
-        if (!withinProject(rawPath)) {
+        if (!(0, runtime_exports.withinProject)(rawPath)) {
           return { ok: false, error: "path must be inside the project" };
         }
         state.auditCount += 1;
@@ -1173,7 +499,7 @@ function buildBody(payload, cfg) {
   if (cfg.includeResult && payload.result !== void 0) {
     lines.push("## Result");
     lines.push("```json");
-    lines.push(safeJsonStringify(payload.result, 2));
+    lines.push((0, runtime_exports.safeJsonStringify)(payload.result, 2));
     lines.push("```");
     lines.push("");
   }
@@ -1414,10 +740,10 @@ var plugin2 = {
 var agent_handoff_default = plugin2;
 
 // src/api-compatibility-gate/index.ts
-import { execFile as execFile2 } from "node:child_process";
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { execFile } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
 import { readFile as readFile2 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname2, extname as extname3, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve4 } from "node:path";
+import { basename, dirname, extname, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
 var API_VERSION3 = "^0.1.10";
 var state3 = {
   invocationCount: 0,
@@ -1481,25 +807,25 @@ function matchesAnyPattern(filePath, patterns) {
   return patterns.some((p) => patternToRegex(p).test(normalized));
 }
 function resolveToProjectRoot(filePath) {
-  if (isAbsolute4(filePath)) return resolve4(filePath);
-  return resolve4(process.cwd(), filePath);
+  if (isAbsolute2(filePath)) return resolve2(filePath);
+  return resolve2(process.cwd(), filePath);
 }
 function withinProject2(filePath) {
   if (typeof filePath !== "string" || filePath.length === 0 || filePath.length > 4096) return false;
   const resolved = resolveToProjectRoot(filePath);
-  const rel = relative4(process.cwd(), resolved);
+  const rel = relative2(process.cwd(), resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute4(rel)) return false;
+  if (isAbsolute2(rel)) return false;
   return true;
 }
 function isPackageEntryPoint(filePath) {
   const resolved = resolveToProjectRoot(filePath);
-  const dir = dirname2(resolved);
-  const pkgPath = resolve4(dir, "package.json");
+  const dir = dirname(resolved);
+  const pkgPath = resolve2(dir, "package.json");
   if (!existsSync(pkgPath)) return false;
   try {
-    const pkg = JSON.parse(readFileSync2(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
     const entries = [];
     if (pkg.main) entries.push(pkg.main);
     if (pkg.module) entries.push(pkg.module);
@@ -1517,9 +843,9 @@ function isPackageEntryPoint(filePath) {
       }
     }
     for (const entry of entries) {
-      const entryResolved = resolve4(dir, entry);
+      const entryResolved = resolve2(dir, entry);
       if (entryResolved === resolved) return true;
-      if (basename2(dirname2(entryResolved)) === basename2(dirname2(resolved)) && basename2(entryResolved, extname3(entryResolved)) === basename2(resolved, extname3(resolved))) {
+      if (basename(dirname(entryResolved)) === basename(dirname(resolved)) && basename(entryResolved, extname(entryResolved)) === basename(resolved, extname(resolved))) {
         return true;
       }
     }
@@ -1570,9 +896,9 @@ function extractExports(source) {
 }
 function readGitVersion(filePath) {
   const resolved = resolveToProjectRoot(filePath);
-  const relPath = normalizePath(relative4(process.cwd(), resolved));
+  const relPath = normalizePath(relative2(process.cwd(), resolved));
   return new Promise((resolveVersion) => {
-    execFile2(
+    execFile(
       "git",
       ["show", `HEAD:${relPath}`],
       {
@@ -1774,14 +1100,14 @@ var plugin3 = {
 var api_compatibility_gate_default = plugin3;
 
 // src/auto-doc/index.ts
-import { isAbsolute as isAbsolute5, relative as relative5, resolve as resolve5 } from "node:path";
+import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3 } from "node:path";
 var AUTO_DOC_API_VERSION = "^0.1.10";
 function resolveProjectPath(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
-  const root = resolve5(cwd);
-  const resolved = isAbsolute5(rawPath) ? resolve5(rawPath) : resolve5(root, rawPath);
-  const rel = relative5(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute5(rel)) return resolved;
+  const root = resolve3(cwd);
+  const resolved = isAbsolute3(rawPath) ? resolve3(rawPath) : resolve3(root, rawPath);
+  const rel = relative3(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute3(rel)) return resolved;
   return null;
 }
 var state4 = {
@@ -1962,10 +1288,10 @@ async function runAutoDoc(input, api) {
       continue;
     }
     try {
-      const { readFileSync: readFileSync17, writeFileSync: writeFileSync3 } = await import("node:fs");
+      const { readFileSync: readFileSync16, writeFileSync: writeFileSync3 } = await import("node:fs");
       let content;
       try {
-        content = readFileSync17(safeFile, "utf-8");
+        content = readFileSync16(safeFile, "utf-8");
       } catch {
         api.log.warn(`auto-doc: could not read file ${safeFile}`);
         continue;
@@ -2315,7 +1641,7 @@ var plugin5 = {
 var auto_escalate_default = plugin5;
 
 // src/auto-i18n-extractor/index.ts
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 var API_VERSION4 = "^0.1.10";
 var state6 = {
   filesScanned: 0,
@@ -2400,7 +1726,7 @@ function extractStrings(content, cfg) {
 }
 function readSourceFile(filePath) {
   try {
-    return readFileSync3(filePath, "utf-8");
+    return readFileSync2(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -2476,7 +1802,7 @@ var plugin6 = {
       const inp = input.toolInput ?? {};
       const sourcePath = inp["path"];
       if (!sourcePath || typeof sourcePath !== "string") return;
-      if (!withinProject(sourcePath)) return;
+      if (!(0, runtime_exports.withinProject)(sourcePath)) return;
       const ext = fileExtension(sourcePath);
       if (!cfg.fileExtensions.includes(ext)) {
         state6.skipped += 1;
@@ -2529,7 +1855,7 @@ ${lines.join("\n")}${more}`;
         if (typeof filePath !== "string" || !filePath) {
           return { ok: false, error: "path is required" };
         }
-        if (!withinProject(filePath)) {
+        if (!(0, runtime_exports.withinProject)(filePath)) {
           return { ok: false, error: "path must be inside the project" };
         }
         const ext = fileExtension(filePath);
@@ -2636,7 +1962,7 @@ ${lines.join("\n")}${more}`;
 var auto_i18n_extractor_default = plugin6;
 
 // src/branch-guard/index.ts
-import { execFile as execFile3 } from "node:child_process";
+import { execFile as execFile2 } from "node:child_process";
 var API_VERSION5 = "^0.1.10";
 var state7 = {
   invocationCount: 0,
@@ -2688,16 +2014,16 @@ function hasDisabledPluginEntry(raw) {
     return name === "branch-guard" || name === "@wrongstack/plugins/branch-guard";
   });
 }
-var branchCache = new BoundedMap({ max: 64, ttlMs: 3e4 });
+var branchCache = new runtime_exports.BoundedMap({ max: 64, ttlMs: 3e4 });
 function runGit(args, cwd, signal) {
-  return new Promise((resolve29, reject) => {
-    execFile3(
+  return new Promise((resolve27, reject) => {
+    execFile2(
       "git",
       args,
       { encoding: "utf-8", timeout: 3e3, cwd, windowsHide: true, signal },
       (error, stdout) => {
         if (error) reject(error);
-        else resolve29(stdout);
+        else resolve27(stdout);
       }
     );
   });
@@ -2798,8 +2124,8 @@ var plugin7 = {
     state7.invocationCount = 0;
     state7.blockCount = 0;
     state7.warnCount = 0;
-    state7.hookUnregister = releaseHandle(state7.hookUnregister);
-    state7.configUnregister = releaseHandle(state7.configUnregister);
+    state7.hookUnregister = (0, runtime_exports.releaseHandle)(state7.hookUnregister);
+    state7.configUnregister = (0, runtime_exports.releaseHandle)(state7.configUnregister);
     state7.lastBlock = null;
     branchCache.clear();
     let cfg = readHostConfig(api.config);
@@ -2945,11 +2271,11 @@ var plugin7 = {
 var branch_guard_default = plugin7;
 
 // src/changelog-writer/index.ts
-import { readFileSync as readFileSync4, writeFileSync } from "node:fs";
-import { isAbsolute as isAbsolute6, relative as relative6, resolve as resolve6 } from "node:path";
+import { readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { isAbsolute as isAbsolute4, relative as relative4, resolve as resolve4 } from "node:path";
 var state8 = {
   entries: [],
-  filesTouched: new BoundedSet({ max: 2e3 }),
+  filesTouched: new runtime_exports.BoundedSet({ max: 2e3 }),
   commitsSeen: 0,
   writes: 0,
   polishes: 0,
@@ -2963,10 +2289,10 @@ var DEFAULTS6 = {
   maxEntries: 200
 };
 function resolveProjectPath2(rawPath, cwd = process.cwd()) {
-  const root = resolve6(cwd);
-  const resolved = isAbsolute6(rawPath) ? resolve6(rawPath) : resolve6(root, rawPath);
-  const rel = relative6(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute6(rel)) return resolved;
+  const root = resolve4(cwd);
+  const resolved = isAbsolute4(rawPath) ? resolve4(rawPath) : resolve4(root, rawPath);
+  const rel = relative4(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute4(rel)) return resolved;
   return null;
 }
 function readConfig7(raw) {
@@ -3110,7 +2436,7 @@ var plugin8 = {
   },
   setup(api) {
     state8.entries = [];
-    state8.filesTouched = new BoundedSet({ max: 2e3 });
+    state8.filesTouched = new runtime_exports.BoundedSet({ max: 2e3 });
     state8.commitsSeen = 0;
     state8.writes = 0;
     for (const off of state8.eventUnsubscribers) {
@@ -3260,7 +2586,7 @@ var plugin8 = {
         );
         let existing = null;
         try {
-          existing = readFileSync4(cfg.filePath, "utf-8");
+          existing = readFileSync3(cfg.filePath, "utf-8");
         } catch {
           existing = null;
         }
@@ -3306,7 +2632,7 @@ var plugin8 = {
       filesTouched: state8.filesTouched.size
     };
     state8.entries = [];
-    state8.filesTouched = new BoundedSet({ max: 2e3 });
+    state8.filesTouched = new runtime_exports.BoundedSet({ max: 2e3 });
     state8.commitsSeen = 0;
     state8.writes = 0;
     api.log.info("changelog-writer: teardown complete", { final });
@@ -3328,7 +2654,7 @@ var changelog_writer_default = plugin8;
 
 // src/checkpoint/index.ts
 import { mkdir, readFile as readFile3, stat, writeFile } from "node:fs/promises";
-import { dirname as dirname3, isAbsolute as isAbsolute7, relative as relative7, resolve as resolve7 } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute5, relative as relative5, resolve as resolve5 } from "node:path";
 var state9 = {
   snapshots: [],
   nextId: 1,
@@ -3357,10 +2683,10 @@ function readConfig8(raw) {
   };
 }
 function resolveProjectPath3(rawPath, cwd = process.cwd()) {
-  const root = resolve7(cwd);
-  const resolved = isAbsolute7(rawPath) ? resolve7(rawPath) : resolve7(root, rawPath);
-  const rel = relative7(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute7(rel)) return resolved;
+  const root = resolve5(cwd);
+  const resolved = isAbsolute5(rawPath) ? resolve5(rawPath) : resolve5(root, rawPath);
+  const rel = relative5(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute5(rel)) return resolved;
   return null;
 }
 function hashContent(s) {
@@ -3462,9 +2788,9 @@ var plugin9 = {
         const ti = input.toolInput ?? {};
         const raw = ti["path"] ?? ti["file_path"] ?? ti["filePath"];
         if (typeof raw !== "string" || raw.length === 0) return;
-        const safePath2 = resolveProjectPath3(raw);
-        if (!safePath2) return;
-        const captured = await captureFileForHook(safePath2, cfg.maxFileBytes, runtime.signal);
+        const safePath = resolveProjectPath3(raw);
+        if (!safePath) return;
+        const captured = await captureFileForHook(safePath, cfg.maxFileBytes, runtime.signal);
         if (captured === "too-large") {
           state9.skippedLarge += 1;
           return;
@@ -3482,7 +2808,7 @@ var plugin9 = {
         state9.captures += 1;
         api.metrics.counter("captures");
         api.emitCustom?.("checkpoint:captured", {
-          path: safePath2,
+          path: safePath,
           bytes: captured.bytes,
           hadContent: captured.content !== null,
           // 32-bit unsigned hash of the captured bytes. Collisions
@@ -3526,12 +2852,12 @@ var plugin9 = {
         const rejectedOutsideProject = [];
         let skipped = 0;
         for (const p of paths) {
-          const safePath2 = resolveProjectPath3(p);
-          if (!safePath2) {
+          const safePath = resolveProjectPath3(p);
+          if (!safePath) {
             rejectedOutsideProject.push(p);
             continue;
           }
-          const captured = await captureFile(safePath2, cfg.maxFileBytes);
+          const captured = await captureFile(safePath, cfg.maxFileBytes);
           if (captured === "too-large") {
             skipped += 1;
             state9.skippedLarge += 1;
@@ -3643,7 +2969,7 @@ var plugin9 = {
             continue;
           }
           try {
-            await mkdir(dirname3(f.path), { recursive: true });
+            await mkdir(dirname2(f.path), { recursive: true });
             await writeFile(f.path, f.content);
             restored.push(f.path);
           } catch (err) {
@@ -3715,7 +3041,7 @@ var checkpoint_default = plugin9;
 
 // src/code-metrics/index.ts
 import { readFile as readFile4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute8, relative as relative8, resolve as resolve8 } from "node:path";
+import { isAbsolute as isAbsolute6, relative as relative6, resolve as resolve6 } from "node:path";
 var API_VERSION6 = "^0.1.10";
 var state10 = {
   measureCount: 0,
@@ -3745,7 +3071,7 @@ function toPosix(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath(p) {
-  return toPosix(relative8(process.cwd(), p));
+  return toPosix(relative6(process.cwd(), p));
 }
 function countFunctions(content) {
   let count = 0;
@@ -3851,9 +3177,9 @@ function analyzeFile(filePath, content) {
 }
 async function measurePath(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute8(rawPath) ? resolve8(rawPath) : resolve8(root, rawPath);
+  const resolved = isAbsolute6(rawPath) ? resolve6(rawPath) : resolve6(root, rawPath);
   const exts = normalizeExtensions2(cfg.extensions);
-  const allFiles = await collectSourceFilesAsync(resolved, { extensions: exts });
+  const allFiles = await (0, runtime_exports.collectSourceFilesAsync)(resolved, { extensions: exts });
   const files = allFiles.slice(0, cfg.maxFiles);
   const metrics = [];
   for (const p of files) {
@@ -3910,11 +3236,11 @@ var plugin10 = {
       const inp = input.toolInput ?? {};
       const sourcePath = inp["path"];
       if (!sourcePath || typeof sourcePath !== "string") return;
-      if (!withinProject(sourcePath)) return;
+      if (!(0, runtime_exports.withinProject)(sourcePath)) return;
       const exts = normalizeExtensions2(cfg.extensions);
-      if (!matchesExtension(sourcePath, exts)) return;
+      if (!(0, runtime_exports.matchesExtension)(sourcePath, exts)) return;
       state10.hookInvocationCount += 1;
-      const resolved = resolve8(process.cwd(), sourcePath);
+      const resolved = resolve6(process.cwd(), sourcePath);
       let content;
       try {
         content = await readFile4(resolved, "utf-8");
@@ -3944,7 +3270,7 @@ var plugin10 = {
       async execute(input) {
         if (!cfg.enabled) return { ok: false, error: "code-metrics is disabled" };
         const rawPath = typeof input.path === "string" ? input.path : ".";
-        if (!withinProject(rawPath)) {
+        if (!(0, runtime_exports.withinProject)(rawPath)) {
           return { ok: false, error: "path is outside the project root" };
         }
         state10.measureCount += 1;
@@ -3958,7 +3284,7 @@ var plugin10 = {
         state10.fileCount += result.files.length;
         return {
           ok: true,
-          path: relativePath(resolve8(process.cwd(), rawPath)),
+          path: relativePath(resolve6(process.cwd(), rawPath)),
           files: result.files,
           totalFiles: result.totalFiles,
           capped: result.totalFiles > cfg.maxFiles
@@ -4223,7 +3549,7 @@ var plugin11 = {
     state11.invalidCount = 0;
     state11.suggestFixCount = 0;
     state11.suggestFixErrors = 0;
-    state11.hookUnregister = releaseHandle(state11.hookUnregister);
+    state11.hookUnregister = (0, runtime_exports.releaseHandle)(state11.hookUnregister);
     state11.lastValidation = null;
     const cfg = readConfig10(api.config.extensions?.["commit-validator"]);
     const hook = async (input) => {
@@ -4416,7 +3742,7 @@ Suggested rewrite (${suggest.model}):
 var commit_validator_default = plugin11;
 
 // src/config-validator/index.ts
-import { readFileSync as readFileSync5, statSync } from "node:fs";
+import { readFileSync as readFileSync4, statSync } from "node:fs";
 var state12 = {
   invocations: 0,
   filesChecked: 0,
@@ -4677,13 +4003,13 @@ var plugin12 = {
       const ti = input.toolInput ?? {};
       const raw = ti["path"] ?? ti["file_path"] ?? ti["filePath"];
       if (typeof raw !== "string" || raw.length === 0) return;
-      if (!withinProject(raw)) return;
+      if (!(0, runtime_exports.withinProject)(raw)) return;
       const lower = raw.toLowerCase();
       if (!cfg.extensions.some((ext) => lower.endsWith(ext))) return;
       let text;
       try {
         if (statSync(raw).size > cfg.maxFileBytes) return;
-        text = readFileSync5(raw, "utf-8");
+        text = readFileSync4(raw, "utf-8");
       } catch {
         return;
       }
@@ -4767,7 +4093,7 @@ var config_validator_default = plugin12;
 
 // src/context-pins/index.ts
 import * as fs from "node:fs";
-import { dirname as dirname4, isAbsolute as isAbsolute9, relative as relative9, resolve as resolve9 } from "node:path";
+import { dirname as dirname3, isAbsolute as isAbsolute7, relative as relative7, resolve as resolve7 } from "node:path";
 import { atomicWrite, ensureDir } from "@wrongstack/core/utils";
 var state13 = {
   pins: [],
@@ -4785,10 +4111,10 @@ var DEFAULTS11 = {
 };
 function resolveProjectPath4(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return "";
-  const root = resolve9(cwd);
-  const resolved = isAbsolute9(rawPath) ? resolve9(rawPath) : resolve9(root, rawPath);
-  const rel = relative9(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute9(rel)) return resolved;
+  const root = resolve7(cwd);
+  const resolved = isAbsolute7(rawPath) ? resolve7(rawPath) : resolve7(root, rawPath);
+  const rel = relative7(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute7(rel)) return resolved;
   return null;
 }
 function readConfig12(raw) {
@@ -4818,7 +4144,7 @@ function loadPins(filePath) {
 async function persistPins(filePath) {
   if (!filePath) return true;
   try {
-    await ensureDir(dirname4(filePath));
+    await ensureDir(dirname3(filePath));
     await atomicWrite(filePath, JSON.stringify({ pins: state13.pins, nextId: state13.nextId }, null, 2));
     return true;
   } catch {
@@ -5043,7 +4369,7 @@ function readCostTrackerConfig(raw) {
     mailboxDigestTo: typeof digestTo === "string" && digestTo.length > 0 ? digestTo : "cost-tracker"
   };
 }
-var modelKeyCache = new BoundedMap({ max: 256 });
+var modelKeyCache = new runtime_exports.BoundedMap({ max: 256 });
 function estimateCost(model, promptTokens, completionTokens) {
   let key = modelKeyCache.get(model);
   if (!key) {
@@ -5653,7 +4979,7 @@ var cron_default = plugin15;
 
 // src/dead-code-detector/index.ts
 import { readdir, readFile as readFile5, stat as stat2 } from "node:fs/promises";
-import { extname as extname4, join as join2, relative as relative10, resolve as resolve10 } from "node:path";
+import { extname as extname2, join, relative as relative8, resolve as resolve8 } from "node:path";
 var API_VERSION10 = "^0.1.10";
 var state15 = {
   scanCount: 0,
@@ -5696,17 +5022,17 @@ async function gatherFiles(root, depth, cfg) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (remaining > 0 && !excludeSet.has(entry.name)) {
-          await walk(join2(dir, entry.name), remaining - 1);
+          await walk(join(dir, entry.name), remaining - 1);
         }
       } else if (entry.isFile()) {
-        const ext = extname4(entry.name).toLowerCase();
+        const ext = extname2(entry.name).toLowerCase();
         if (cfg.extensions.includes(ext)) {
-          files.push(join2(dir, entry.name));
+          files.push(join(dir, entry.name));
         }
       }
     }
   }
-  await walk(resolve10(root), depth);
+  await walk(resolve8(root), depth);
   return files;
 }
 function stripNoise(content) {
@@ -5799,11 +5125,11 @@ async function scan(root, depth, cfg) {
   return { findings: await findUnusedSymbols(files), scannedFiles: files.length };
 }
 async function resolveScanRoot(rawPath) {
-  const resolved = resolve10(process.cwd(), rawPath);
+  const resolved = resolve8(process.cwd(), rawPath);
   try {
     const stats = await stat2(resolved);
     if (!stats.isDirectory()) {
-      return resolve10(resolved, "..");
+      return resolve8(resolved, "..");
     }
   } catch {
   }
@@ -5813,7 +5139,7 @@ function toPosix2(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath2(p) {
-  return toPosix2(relative10(process.cwd(), p));
+  return toPosix2(relative8(process.cwd(), p));
 }
 var plugin16 = {
   name: "dead-code-detector",
@@ -5872,7 +5198,7 @@ var plugin16 = {
       const inp = input.toolInput ?? {};
       const sourcePath = inp["path"];
       if (!sourcePath || typeof sourcePath !== "string") return;
-      if (!withinProject(sourcePath)) return;
+      if (!(0, runtime_exports.withinProject)(sourcePath)) return;
       const ext = sourcePath.includes(".") ? sourcePath.slice(sourcePath.lastIndexOf(".")).toLowerCase() : "";
       if (!cfg.extensions.includes(ext)) return;
       state15.hookInvocationCount += 1;
@@ -5884,8 +5210,8 @@ var plugin16 = {
         state15.errorCount += 1;
         return;
       }
-      const changedFile = resolve10(process.cwd(), sourcePath);
-      const relevant = result.findings.filter((f) => resolve10(f.file) === changedFile);
+      const changedFile = resolve8(process.cwd(), sourcePath);
+      const relevant = result.findings.filter((f) => resolve8(f.file) === changedFile);
       if (relevant.length === 0) {
         state15.missCount += 1;
         return;
@@ -5930,7 +5256,7 @@ Consider removing the export if it is not part of the public API.`;
         const rawPath = typeof input.path === "string" ? input.path : ".";
         const rawDepth = typeof input.depth === "number" ? input.depth : cfg.defaultDepth;
         const depth = Math.max(0, Math.min(Math.floor(rawDepth), cfg.maxDepth));
-        if (!withinProject(rawPath)) {
+        if (!(0, runtime_exports.withinProject)(rawPath)) {
           return { ok: false, error: "scan path is outside the project root" };
         }
         state15.scanCount += 1;
@@ -6378,7 +5704,7 @@ ${notes.map((n) => `  - ${n}`).join("\n")}`
 var dep_guard_default = plugin17;
 
 // src/dependency-vulnerability-gate/index.ts
-import { execFile as execFile4 } from "node:child_process";
+import { execFile as execFile3 } from "node:child_process";
 import { access } from "node:fs/promises";
 var API_VERSION11 = "^0.1.10";
 var state17 = {
@@ -6512,12 +5838,12 @@ async function runAudit(cfg) {
   const start = Date.now();
   let invocation;
   try {
-    invocation = resolveExecInvocation(manager, ["audit", "--json"]);
+    invocation = (0, runtime_exports.resolveExecInvocation)(manager, ["audit", "--json"]);
   } catch {
     return null;
   }
-  const stdout = await new Promise((resolve29) => {
-    execFile4(
+  const stdout = await new Promise((resolve27) => {
+    execFile3(
       invocation.cmd,
       invocation.args,
       {
@@ -6531,10 +5857,10 @@ async function runAudit(cfg) {
       },
       (error, output) => {
         if (error && error.killed) {
-          resolve29(null);
+          resolve27(null);
           return;
         }
-        resolve29(output);
+        resolve27(output);
       }
     );
   });
@@ -6712,7 +6038,7 @@ Review the audit output or adjust the dependency choice.`;
 var dependency_vulnerability_gate_default = plugin18;
 
 // src/diff-summary/index.ts
-import { execFile as execFile5 } from "node:child_process";
+import { execFile as execFile4 } from "node:child_process";
 var API_VERSION12 = "^0.1.10";
 var state18 = {
   invocationCount: 0,
@@ -6757,10 +6083,10 @@ function contentHash(s) {
   }
   return h >>> 0;
 }
-var pathMemo = new BoundedMap({ max: 512 });
+var pathMemo = new runtime_exports.BoundedMap({ max: 512 });
 function runGit2(args, cwd) {
   return new Promise((resolveCommand) => {
-    execFile5(
+    execFile4(
       "git",
       args,
       {
@@ -6872,7 +6198,7 @@ var plugin19 = {
     state18.fallbackCount = 0;
     state18.throttledCount = 0;
     state18.duplicateContentCount = 0;
-    state18.hookUnregister = releaseHandle(state18.hookUnregister);
+    state18.hookUnregister = (0, runtime_exports.releaseHandle)(state18.hookUnregister);
     state18.lastSummary = null;
     pathMemo.clear();
     const cfg = readConfig16(api.config.extensions?.["diff-summary"]);
@@ -6885,7 +6211,7 @@ var plugin19 = {
       const filePath = inp["path"];
       if (!filePath || typeof filePath !== "string") return;
       state18.invocationCount += 1;
-      if (!withinProject(filePath)) {
+      if (!(0, runtime_exports.withinProject)(filePath)) {
         state18.fallbackCount += 1;
         return;
       }
@@ -7019,7 +6345,7 @@ var plugin19 = {
 var diff_summary_default = plugin19;
 
 // src/doc-sync-guard/index.ts
-import { basename as basename3, extname as extname5 } from "node:path";
+import { basename as basename2, extname as extname3 } from "node:path";
 var API_VERSION13 = "^0.1.10";
 var state19 = {
   changedFiles: [],
@@ -7048,21 +6374,21 @@ function normalizeSlashes(p) {
   return p.replace(/\\/g, "/");
 }
 function isSourceFile(p, extensions) {
-  const ext = extname5(p).toLowerCase();
+  const ext = extname3(p).toLowerCase();
   return extensions.includes(ext);
 }
 function isPublicSource(p, extensions) {
   if (!isSourceFile(p, extensions)) return false;
   const norm = normalizeSlashes(p);
   if (norm.includes("/node_modules/") || norm.startsWith("node_modules/")) return false;
-  const base = basename3(norm).toLowerCase();
+  const base = basename2(norm).toLowerCase();
   if (/\.(test|spec)\./.test(base)) return false;
   if (base.startsWith("_")) return false;
   return true;
 }
 function isDocFile(p, docNames) {
   const norm = normalizeSlashes(p);
-  const base = basename3(norm);
+  const base = basename2(norm);
   const lowerBase = base.toLowerCase();
   if (docNames.some((name) => lowerBase === name.toLowerCase())) return true;
   if (norm.includes("/docs/") || norm.startsWith("docs/")) return true;
@@ -7080,7 +6406,7 @@ function extractDocContent(toolInput) {
   return void 0;
 }
 function referenceTokens(p) {
-  const base = basename3(p);
+  const base = basename2(p);
   const withoutExt = base.replace(/\.[^.]+$/, "");
   const tokens = [base];
   if (withoutExt && withoutExt !== base) tokens.push(withoutExt);
@@ -7138,13 +6464,13 @@ var plugin20 = {
     state19.sourceWrites = 0;
     state19.docWrites = 0;
     state19.warningsIssued = 0;
-    state19.hookUnregister = releaseHandle(state19.hookUnregister);
+    state19.hookUnregister = (0, runtime_exports.releaseHandle)(state19.hookUnregister);
     const cfg = readConfig17(api.config.extensions?.["doc-sync-guard"]);
     const hook = (input) => {
       if (!cfg.enabled) return;
       if (input.toolResult?.isError) return;
       const path = extractPath(input.toolInput);
-      if (!path || !withinProject(path)) return;
+      if (!path || !(0, runtime_exports.withinProject)(path)) return;
       if (isPublicSource(path, cfg.sourceExtensions)) {
         trackChangedFile(path, cfg.maxTrackedFiles);
         state19.sourceWrites += 1;
@@ -7231,7 +6557,7 @@ var doc_sync_guard_default = plugin20;
 
 // src/duplicate-code-detector/index.ts
 import { readFile as readFile6, realpath, stat as stat3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute10, relative as relative11, resolve as resolve11, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute8, relative as relative9, resolve as resolve9, sep } from "node:path";
 var API_VERSION14 = "^0.1.10";
 var HOOK_WARNING_COOLDOWN_MS = 6e4;
 var state20 = {
@@ -7241,7 +6567,7 @@ var state20 = {
   warningCount: 0,
   errorCount: 0,
   hookUnregister: null,
-  lastHookWarning: new BoundedMap({ max: 512, ttlMs: HOOK_WARNING_COOLDOWN_MS }),
+  lastHookWarning: new runtime_exports.BoundedMap({ max: 512, ttlMs: HOOK_WARNING_COOLDOWN_MS }),
   fileIndex: /* @__PURE__ */ new Map(),
   inFlightFingerprintReads: /* @__PURE__ */ new Map(),
   indexFingerprintCount: 0,
@@ -7288,14 +6614,14 @@ function readConfig18(raw) {
   };
 }
 function isWithinRoot(projectRoot, candidate) {
-  const rel = relative11(projectRoot, candidate);
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute10(rel);
+  const rel = relative9(projectRoot, candidate);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute8(rel);
 }
 function toPosix3(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath3(p) {
-  return toPosix3(relative11(process.cwd(), p));
+  return toPosix3(relative9(process.cwd(), p));
 }
 function removeInlineComments(line) {
   return line.replace(/\/\/.*$/, "").replace(/\/\*[\s\S]*?\*\//, "");
@@ -7387,8 +6713,8 @@ function findDuplicates(files, minLines, maxFindings) {
 }
 async function scanPath(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute10(rawPath) ? resolve11(rawPath) : resolve11(root, rawPath);
-  const filePaths = await collectSourceFilesAsync(resolved, {
+  const resolved = isAbsolute8(rawPath) ? resolve9(rawPath) : resolve9(root, rawPath);
+  const filePaths = await (0, runtime_exports.collectSourceFilesAsync)(resolved, {
     extensions: cfg.extensions,
     excludeDirs: cfg.excludeDirs
   });
@@ -7515,8 +6841,8 @@ var plugin21 = {
       const inp = input.toolInput ?? {};
       const sourcePath = inp["path"];
       if (!sourcePath || typeof sourcePath !== "string") return;
-      const projectRoot = resolve11(process.cwd());
-      const resolvedFile = isAbsolute10(sourcePath) ? resolve11(sourcePath) : resolve11(projectRoot, sourcePath);
+      const projectRoot = resolve9(process.cwd());
+      const resolvedFile = isAbsolute8(sourcePath) ? resolve9(sourcePath) : resolve9(projectRoot, sourcePath);
       if (!isWithinRoot(projectRoot, resolvedFile)) return;
       let changedFile;
       try {
@@ -7540,7 +6866,7 @@ var plugin21 = {
       if (changedFps.size === 0) return;
       let otherFilePaths;
       try {
-        otherFilePaths = await collectSourceFilesAsync(projectRoot, {
+        otherFilePaths = await (0, runtime_exports.collectSourceFilesAsync)(projectRoot, {
           extensions: cfg.extensions,
           excludeDirs: cfg.excludeDirs
         });
@@ -7550,7 +6876,7 @@ var plugin21 = {
       }
       const matched = /* @__PURE__ */ new Set();
       for (const p of otherFilePaths) {
-        if (resolve11(p) === resolve11(changedFile)) continue;
+        if (resolve9(p) === resolve9(changedFile)) continue;
         const otherFps = await readCachedFingerprints(p, cfg.minLines);
         if (otherFps === null || otherFps.size === 0) continue;
         for (const fp of changedFps) {
@@ -7582,7 +6908,7 @@ var plugin21 = {
       async execute(input) {
         if (!cfg.enabled) return { ok: false, error: "duplicate-code-detector is disabled" };
         const rawPath = typeof input.path === "string" ? input.path : ".";
-        if (!withinProject(rawPath)) {
+        if (!(0, runtime_exports.withinProject)(rawPath)) {
           return { ok: false, error: "scan path is outside the project root" };
         }
         state20.scanCount += 1;
@@ -7596,7 +6922,7 @@ var plugin21 = {
         state20.findingCount += result.findings.length;
         return {
           ok: true,
-          path: relativePath3(resolve11(process.cwd(), rawPath)),
+          path: relativePath3(resolve9(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
           minLines: cfg.minLines,
           findings: result.findings
@@ -7975,7 +7301,7 @@ var error_lens_default = plugin22;
 
 // src/feature-flag-tracker/index.ts
 import { readFile as readFile7 } from "node:fs/promises";
-import { isAbsolute as isAbsolute11, relative as relative12, resolve as resolve12 } from "node:path";
+import { isAbsolute as isAbsolute9, relative as relative10, resolve as resolve10 } from "node:path";
 var API_VERSION15 = "^0.1.10";
 var state22 = {
   scanCount: 0,
@@ -8014,7 +7340,7 @@ function toPosix4(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath4(p) {
-  return toPosix4(relative12(process.cwd(), p));
+  return toPosix4(relative10(process.cwd(), p));
 }
 function compilePatterns(patterns) {
   const out = [];
@@ -8050,9 +7376,9 @@ function scanFile(filePath, content, patterns, maxFindings) {
 }
 async function scanPath2(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute11(rawPath) ? resolve12(rawPath) : resolve12(root, rawPath);
+  const resolved = isAbsolute9(rawPath) ? resolve10(rawPath) : resolve10(root, rawPath);
   const exts = normalizeExtensions3(cfg.extensions);
-  const files = await collectSourceFilesAsync(resolved, { extensions: exts });
+  const files = await (0, runtime_exports.collectSourceFilesAsync)(resolved, { extensions: exts });
   const patterns = compilePatterns(cfg.patterns);
   const usages = [];
   let scannedFiles = 0;
@@ -8128,11 +7454,11 @@ var plugin23 = {
       const inp = input.toolInput ?? {};
       const sourcePath = inp["path"];
       if (!sourcePath || typeof sourcePath !== "string") return;
-      if (!withinProject(sourcePath)) return;
+      if (!(0, runtime_exports.withinProject)(sourcePath)) return;
       const exts = normalizeExtensions3(cfg.extensions);
-      if (!matchesExtension(sourcePath, exts)) return;
+      if (!(0, runtime_exports.matchesExtension)(sourcePath, exts)) return;
       state22.hookInvocationCount += 1;
-      const resolved = resolve12(process.cwd(), sourcePath);
+      const resolved = resolve10(process.cwd(), sourcePath);
       let content;
       try {
         content = await readFile7(resolved, "utf-8");
@@ -8167,7 +7493,7 @@ Make sure flag behavior is intentional and consider updating flag inventory/docs
       async execute(input) {
         if (!cfg.enabled) return { ok: false, error: "feature-flag-tracker is disabled" };
         const rawPath = typeof input.path === "string" ? input.path : ".";
-        if (!withinProject(rawPath)) {
+        if (!(0, runtime_exports.withinProject)(rawPath)) {
           return { ok: false, error: "path is outside the project root" };
         }
         state22.scanCount += 1;
@@ -8181,7 +7507,7 @@ Make sure flag behavior is intentional and consider updating flag inventory/docs
         state22.flagCount += result.usages.length;
         return {
           ok: true,
-          path: relativePath4(resolve12(process.cwd(), rawPath)),
+          path: relativePath4(resolve10(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
           discoveredFiles: result.discoveredFiles,
           // Say so when the cap stopped the walk early: a partial scan
@@ -8261,7 +7587,7 @@ var feature_flag_tracker_default = plugin23;
 
 // src/file-watcher/index.ts
 import { watch as fsWatch } from "node:fs";
-import { join as join3 } from "node:path";
+import { join as join2 } from "node:path";
 var API_VERSION16 = "^0.1.10";
 var watch_idCounter = 0;
 function nextId() {
@@ -8343,7 +7669,7 @@ var plugin24 = {
     }
     const autoIndex = api.config.extensions?.["file-watcher"]?.["autoIndex"] ?? false;
     const indexProjectRoot = api.config.extensions?.["file-watcher"]?.["indexProjectRoot"] ?? "";
-    const safeIndexRoot = indexProjectRoot !== "" && withinProject(indexProjectRoot) ? indexProjectRoot : "";
+    const safeIndexRoot = indexProjectRoot !== "" && (0, runtime_exports.withinProject)(indexProjectRoot) ? indexProjectRoot : "";
     if (indexProjectRoot !== "" && safeIndexRoot === "") {
       api.log.warn(
         "file-watcher: indexProjectRoot is outside the project root \u2014 using watched dirPath instead",
@@ -8365,7 +7691,7 @@ var plugin24 = {
           if (handle.events.length > 0 && !(eventType === "change" ? handle.events.includes("change") : handle.events.includes("add") || handle.events.includes("delete"))) {
             return;
           }
-          const rawPath = filename.startsWith(dirPath) ? filename : join3(dirPath, filename);
+          const rawPath = filename.startsWith(dirPath) ? filename : join2(dirPath, filename);
           const fullPath = rawPath.replace(/\\/g, "/");
           const key = `${handle.id}:${fullPath}:${eventType}`;
           debounceEvent(
@@ -8488,7 +7814,7 @@ var plugin24 = {
         }
         const events = input["events"] ?? ["change", "add", "delete"];
         const recursive = input["recursive"] ?? true;
-        const bad = paths.find((p) => !withinProject(p));
+        const bad = paths.find((p) => !(0, runtime_exports.withinProject)(p));
         if (bad !== void 0) {
           return {
             ok: false,
@@ -8614,7 +7940,7 @@ var plugin24 = {
 var file_watcher_default = plugin24;
 
 // src/format-on-save/index.ts
-import { execFile as execFile6 } from "node:child_process";
+import { execFile as execFile5 } from "node:child_process";
 import { createHash } from "node:crypto";
 import { access as access2, readFile as readFile8, stat as stat4 } from "node:fs/promises";
 var API_VERSION17 = "^0.1.10";
@@ -8652,7 +7978,7 @@ function readConfig21(raw) {
     skipTtlMs: typeof r["skipTtlMs"] === "number" && r["skipTtlMs"] >= 0 ? r["skipTtlMs"] : DEFAULTS20.skipTtlMs
   };
 }
-var recentlyCovered = new BoundedMap({ max: 256 });
+var recentlyCovered = new runtime_exports.BoundedMap({ max: 256 });
 function clearRegistrations() {
   if (state23.hookUnregister) {
     try {
@@ -8688,7 +8014,7 @@ var FORMATTERS = [
 var activeFormatter;
 function resetFormatter() {
   activeFormatter = void 0;
-  clearLocalBinCache();
+  (0, runtime_exports.clearLocalBinCache)();
 }
 function resolveFormatter() {
   if (activeFormatter !== void 0) return activeFormatter;
@@ -8701,7 +8027,7 @@ function resolveFormatter() {
     }
   }
   for (const f of FORMATTERS) {
-    const onPath = findOnPath(f.binName);
+    const onPath = (0, runtime_exports.findOnPath)(f.binName);
     if (!onPath) continue;
     activeFormatter = { cmd: onPath, args: [...f.writeArgs], label: f.label };
     return activeFormatter;
@@ -8710,7 +8036,7 @@ function resolveFormatter() {
   return null;
 }
 function resolveNodeBinFor(f, cwd) {
-  const hit = resolveFirstNodeBin([{ packageName: f.packageName, binName: f.binName }], cwd);
+  const hit = (0, runtime_exports.resolveFirstNodeBin)([{ packageName: f.packageName, binName: f.binName }], cwd);
   if (!hit) return null;
   return { cmd: hit.cmd, args: [...hit.args, ...f.writeArgs], label: f.label };
 }
@@ -8725,7 +8051,7 @@ async function sha256File(filePath) {
   }
 }
 async function formatFile(filePath, timeoutMs) {
-  if (!withinProject(filePath)) return null;
+  if (!(0, runtime_exports.withinProject)(filePath)) return null;
   try {
     await access2(filePath);
   } catch {
@@ -8743,13 +8069,13 @@ async function formatFile(filePath, timeoutMs) {
   const hashBefore = await sha256File(filePath);
   let invocation;
   try {
-    invocation = resolveExecInvocation(formatter.cmd, [...formatter.args, filePath]);
+    invocation = (0, runtime_exports.resolveExecInvocation)(formatter.cmd, [...formatter.args, filePath]);
   } catch {
     return null;
   }
   try {
-    await new Promise((resolve29, reject) => {
-      execFile6(
+    await new Promise((resolve27, reject) => {
+      execFile5(
         invocation.cmd,
         invocation.args,
         {
@@ -8765,7 +8091,7 @@ async function formatFile(filePath, timeoutMs) {
             const e = err;
             if (e.killed) return reject(err);
           }
-          resolve29();
+          resolve27();
         }
       );
     });
@@ -8983,7 +8309,7 @@ var plugin25 = {
 var format_on_save_default = plugin25;
 
 // src/git-autocommit/index.ts
-import { execFile as execFile7 } from "node:child_process";
+import { execFile as execFile6 } from "node:child_process";
 import { existsSync as existsSync2 } from "node:fs";
 var API_VERSION18 = "^0.1.10";
 var commitCount = { value: 0 };
@@ -8993,7 +8319,7 @@ var DEFAULT_GIT_TIMEOUT_MS = 3e4;
 var GIT_COMMIT_TIMEOUT_MS = 5 * 6e4;
 async function runGit3(args, cwd, timeoutMs = DEFAULT_GIT_TIMEOUT_MS) {
   return await new Promise((resolvePromise, rejectPromise) => {
-    execFile7(
+    execFile6(
       "git",
       args,
       {
@@ -9506,7 +8832,7 @@ var git_autocommit_default = plugin26;
 
 // src/gitignore-guard/index.ts
 import { access as access3, readFile as readFile9, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename4, isAbsolute as isAbsolute12, join as join4, relative as relative13, resolve as resolve13, sep as sep3 } from "node:path";
+import { basename as basename3, isAbsolute as isAbsolute10, join as join3, relative as relative11, resolve as resolve11, sep as sep2 } from "node:path";
 var API_VERSION19 = "^0.1.10";
 var DEFAULT_ARTIFACT_PATTERNS = Object.freeze([
   "dist/",
@@ -9533,7 +8859,7 @@ var DEFAULT_ARTIFACT_PATTERNS = Object.freeze([
   "*.env.*"
 ]);
 function toForwardSlashes(p) {
-  return p.split(sep3).join("/").replaceAll("\\", "/");
+  return p.split(sep2).join("/").replaceAll("\\", "/");
 }
 function globToSource(glob) {
   return glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]");
@@ -9593,11 +8919,11 @@ function isCoveredByLines(lines, relPath) {
 }
 function gitignoreCandidates(relDir, root) {
   const parts = relDir === "" ? [] : toForwardSlashes(relDir).split("/");
-  const out = [join4(root, ".gitignore")];
+  const out = [join3(root, ".gitignore")];
   let cur = root;
   for (const part of parts) {
-    cur = join4(cur, part);
-    out.push(join4(cur, ".gitignore"));
+    cur = join3(cur, part);
+    out.push(join3(cur, ".gitignore"));
   }
   return out;
 }
@@ -9628,9 +8954,9 @@ async function appendPatterns(target, patterns, limit) {
 }
 function projectRelativePath(rawPath, cwd) {
   const root = cwd ?? process.cwd();
-  const abs = isAbsolute12(rawPath) ? rawPath : resolve13(root, rawPath);
-  const rel = toForwardSlashes(relative13(root, abs));
-  if (rel.startsWith("..") || isAbsolute12(rel) || rel === "") return null;
+  const abs = isAbsolute10(rawPath) ? rawPath : resolve11(root, rawPath);
+  const rel = toForwardSlashes(relative11(root, abs));
+  if (rel.startsWith("..") || isAbsolute10(rel) || rel === "") return null;
   return { abs, rel, root };
 }
 var DEFAULTS21 = {
@@ -9762,7 +9088,7 @@ var plugin27 = {
       const inp = input.toolInput ?? {};
       const rawPath = inp["path"];
       if (typeof rawPath !== "string" || rawPath.trim().length === 0) return;
-      if (basename4(rawPath) === ".gitignore") return;
+      if (basename3(rawPath) === ".gitignore") return;
       const resolved = projectRelativePath(rawPath, input.cwd);
       if (!resolved) return;
       state24.invocationCount += 1;
@@ -9787,7 +9113,7 @@ var plugin27 = {
       };
       if (cfg.mode === "append") {
         const nearest = await firstExistingGitignore(candidates);
-        const target = nearest ?? join4(resolved.root, ".gitignore");
+        const target = nearest ?? join3(resolved.root, ".gitignore");
         const { appended } = await appendPatterns(target, [matched], cfg.maxAppendPerCall);
         if (appended.length === 0) {
           state24.coveredSkipCount += 1;
@@ -9884,7 +9210,7 @@ var plugin27 = {
         }
         const candidates = gitignoreCandidates(relDirOf(resolved.rel), resolved.root);
         const nearest = await firstExistingGitignore(candidates);
-        const target = nearest ?? join4(resolved.root, ".gitignore");
+        const target = nearest ?? join3(resolved.root, ".gitignore");
         const { appended } = await appendPatterns(target, [pattern], cfg.maxAppendPerCall);
         if (appended.length === 0) {
           state24.coveredSkipCount += 1;
@@ -9942,7 +9268,7 @@ var gitignore_guard_default = plugin27;
 // src/import-organizer/index.ts
 import { spawn } from "node:child_process";
 import { existsSync as existsSync3, statSync as statSync2 } from "node:fs";
-import { basename as basename5, isAbsolute as isAbsolute13 } from "node:path";
+import { basename as basename4, isAbsolute as isAbsolute11 } from "node:path";
 var ALLOWED_FIRST_TOKENS = /* @__PURE__ */ new Set([
   "npx",
   "pnpm",
@@ -9977,7 +9303,7 @@ function resolveLocalToolCommand(tokens) {
   const rest = tokens.slice(i + 1);
   const pkg = LOCAL_BIN_PACKAGES[toolToken];
   if (!pkg) return null;
-  const local = resolveNodeBin(pkg.packageName, pkg.binName, process.cwd(), rest);
+  const local = (0, runtime_exports.resolveNodeBin)(pkg.packageName, pkg.binName, process.cwd(), rest);
   if (!local) return null;
   return { cmd: local.cmd, args: local.args };
 }
@@ -9996,7 +9322,7 @@ function resolveAllowedCommand(command) {
   if (head === "node") {
     const target = tokens[1];
     if (!target) return null;
-    const base = basename5(target);
+    const base = basename4(target);
     if (!(base in LOCAL_BIN_PACKAGES) && !ALLOWED_FIRST_TOKENS.has(base)) return null;
   }
   const local = ALLOWED_FIRST_TOKENS.has(head) ? resolveLocalToolCommand(tokens) : null;
@@ -10004,13 +9330,13 @@ function resolveAllowedCommand(command) {
   if (ALLOWED_FIRST_TOKENS.has(head)) {
     return { cmd: head, args: tokens.slice(1) };
   }
-  if (isAbsolute13(head)) {
-    if (!withinProject(head)) return null;
-    const base = basename5(head);
+  if (isAbsolute11(head)) {
+    if (!(0, runtime_exports.withinProject)(head)) return null;
+    const base = basename4(head);
     if (ALLOWED_FIRST_TOKENS.has(base)) return { cmd: head, args: tokens.slice(1) };
   }
-  if (!isAbsolute13(head) && withinProject(head)) {
-    const base = basename5(head);
+  if (!isAbsolute11(head) && (0, runtime_exports.withinProject)(head)) {
+    const base = basename4(head);
     if (ALLOWED_FIRST_TOKENS.has(base)) return { cmd: head, args: tokens.slice(1) };
   }
   return null;
@@ -10046,13 +9372,13 @@ function readConfig23(raw) {
 }
 var MAX_CAPTURE_BYTES = 4 * 1024 * 1024;
 function runCommand(command, args, timeoutMs, cwd) {
-  return new Promise((resolve29) => {
+  return new Promise((resolve27) => {
     let timedOut = false;
     let settled = false;
     const settle = (r) => {
       if (settled) return;
       settled = true;
-      resolve29(r);
+      resolve27(r);
     };
     const stdoutChunks = [];
     const stderrChunks = [];
@@ -10067,7 +9393,7 @@ function runCommand(command, args, timeoutMs, cwd) {
     let child;
     let invocation;
     try {
-      invocation = resolveExecInvocation(command, args);
+      invocation = (0, runtime_exports.resolveExecInvocation)(command, args);
     } catch {
       signal.removeEventListener("abort", onAbort);
       settle({ code: 127, stdout: "", stderr: "", timedOut: false });
@@ -10111,7 +9437,7 @@ function runCommand(command, args, timeoutMs, cwd) {
   });
 }
 async function organizeImports(filePath, cfg, cwd) {
-  if (!withinProject(filePath)) return null;
+  if (!(0, runtime_exports.withinProject)(filePath)) return null;
   if (!existsSync3(filePath)) return null;
   let bytesBefore;
   try {
@@ -10191,7 +9517,7 @@ var plugin28 = {
     state25.organizedCount = 0;
     state25.cleanCount = 0;
     state25.errorCount = 0;
-    state25.hookUnregister = releaseHandle(state25.hookUnregister);
+    state25.hookUnregister = (0, runtime_exports.releaseHandle)(state25.hookUnregister);
     state25.lastResult = null;
     state25.probeComplete = false;
     state25.linterAvailable = false;
@@ -10298,7 +9624,7 @@ ${result.stderr.trim()}`
     });
   },
   teardown(api) {
-    clearLocalBinCache();
+    (0, runtime_exports.clearLocalBinCache)();
     if (state25.hookUnregister) {
       try {
         state25.hookUnregister();
@@ -10553,7 +9879,7 @@ var injection_shield_default = plugin29;
 
 // src/interface-contract-guard/index.ts
 import { readFile as readFile10 } from "node:fs/promises";
-import { isAbsolute as isAbsolute14, relative as relative14, resolve as resolve14 } from "node:path";
+import { isAbsolute as isAbsolute12, relative as relative12, resolve as resolve12 } from "node:path";
 var API_VERSION21 = "^0.1.10";
 var state27 = {
   scanCount: 0,
@@ -10586,7 +9912,7 @@ function toPosix5(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath5(p) {
-  return toPosix5(relative14(process.cwd(), p));
+  return toPosix5(relative12(process.cwd(), p));
 }
 var INTERFACE_RE = /(?:export\s+)?interface\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
 function extractInterfaceNames(content) {
@@ -10614,9 +9940,9 @@ function collectImplementedNames(content, into) {
 }
 async function scanPath3(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute14(rawPath) ? resolve14(rawPath) : resolve14(root, rawPath);
+  const resolved = isAbsolute12(rawPath) ? resolve12(rawPath) : resolve12(root, rawPath);
   const exts = normalizeExtensions4(cfg.extensions);
-  const allFiles = await collectSourceFilesAsync(resolved, { extensions: exts });
+  const allFiles = await (0, runtime_exports.collectSourceFilesAsync)(resolved, { extensions: exts });
   const files = allFiles.slice(0, cfg.maxFiles);
   const implemented = /* @__PURE__ */ new Set();
   const declarations = [];
@@ -10700,11 +10026,11 @@ var plugin30 = {
       const inp = input.toolInput ?? {};
       const sourcePath = inp["path"];
       if (!sourcePath || typeof sourcePath !== "string") return;
-      if (!withinProject(sourcePath)) return;
+      if (!(0, runtime_exports.withinProject)(sourcePath)) return;
       const exts = normalizeExtensions4(cfg.extensions);
-      if (!matchesExtension(sourcePath, exts)) return;
+      if (!(0, runtime_exports.matchesExtension)(sourcePath, exts)) return;
       state27.hookInvocationCount += 1;
-      const resolved = resolve14(process.cwd(), sourcePath);
+      const resolved = resolve12(process.cwd(), sourcePath);
       let content;
       try {
         content = await readFile10(resolved, "utf-8");
@@ -10738,7 +10064,7 @@ If you changed member shapes, search the project for implementers/\`satisfies\`/
       async execute(input) {
         if (!cfg.enabled) return { ok: false, error: "interface-contract-guard is disabled" };
         const rawPath = typeof input.path === "string" ? input.path : ".";
-        if (!withinProject(rawPath)) {
+        if (!(0, runtime_exports.withinProject)(rawPath)) {
           return { ok: false, error: "path is outside the project root" };
         }
         state27.scanCount += 1;
@@ -10752,7 +10078,7 @@ If you changed member shapes, search the project for implementers/\`satisfies\`/
         state27.findingCount += result.findings.length;
         return {
           ok: true,
-          path: relativePath5(resolve14(process.cwd(), rawPath)),
+          path: relativePath5(resolve12(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
           findings: result.findings,
           // Say so when the corpus was cut short. A partial scan that
@@ -10832,8 +10158,8 @@ If you changed member shapes, search the project for implementers/\`satisfies\`/
 var interface_contract_guard_default = plugin30;
 
 // src/knowledge-graph/index.ts
-import { readFileSync as readFileSync7 } from "node:fs";
-import { dirname as dirname5, isAbsolute as isAbsolute15, relative as relative15, resolve as resolve15 } from "node:path";
+import { readFileSync as readFileSync6 } from "node:fs";
+import { dirname as dirname4, isAbsolute as isAbsolute13, relative as relative13, resolve as resolve13 } from "node:path";
 import { atomicWrite as atomicWrite2, ensureDir as ensureDir2 } from "@wrongstack/core/utils";
 var API_VERSION22 = "^0.1.10";
 var state28 = {
@@ -10855,10 +10181,10 @@ var DEFAULTS25 = {
 };
 function resolveProjectPath5(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
-  const root = resolve15(cwd);
-  const resolved = isAbsolute15(rawPath) ? resolve15(rawPath) : resolve15(root, rawPath);
-  const rel = relative15(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute15(rel)) return resolved;
+  const root = resolve13(cwd);
+  const resolved = isAbsolute13(rawPath) ? resolve13(rawPath) : resolve13(root, rawPath);
+  const rel = relative13(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute13(rel)) return resolved;
   return null;
 }
 function readConfig26(raw) {
@@ -10876,7 +10202,7 @@ function readConfig26(raw) {
 function loadFacts(filePath) {
   if (!filePath) return { facts: [], nextId: 1 };
   try {
-    const raw = JSON.parse(readFileSync7(filePath, "utf-8"));
+    const raw = JSON.parse(readFileSync6(filePath, "utf-8"));
     const facts = Array.isArray(raw.facts) ? raw.facts.filter(
       (f) => !!f && typeof f === "object" && typeof f.id === "string" && typeof f.subject === "string" && typeof f.relation === "string" && typeof f.object === "string"
     ) : [];
@@ -10889,7 +10215,7 @@ function loadFacts(filePath) {
 async function persistFacts(filePath) {
   if (!filePath) return true;
   try {
-    await ensureDir2(dirname5(filePath));
+    await ensureDir2(dirname4(filePath));
     await atomicWrite2(
       filePath,
       JSON.stringify({ facts: state28.facts, nextId: state28.nextId }, null, 2)
@@ -11156,8 +10482,8 @@ var plugin31 = {
 var knowledge_graph_default = plugin31;
 
 // src/license-audit-gate/index.ts
-import { readFileSync as readFileSync8 } from "node:fs";
-import { resolve as resolve16 } from "node:path";
+import { readFileSync as readFileSync7 } from "node:fs";
+import { resolve as resolve14 } from "node:path";
 var API_VERSION23 = "^0.1.10";
 var state29 = {
   invocations: 0,
@@ -11219,8 +10545,8 @@ function auditPackages(names, allowedLicenses) {
   for (const name of names) {
     let licenses = [];
     try {
-      const pkgPath = resolve16("node_modules", name, "package.json");
-      const raw = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+      const pkgPath = resolve14("node_modules", name, "package.json");
+      const raw = JSON.parse(readFileSync7(pkgPath, "utf-8"));
       licenses = extractLicenseStrings(raw);
     } catch {
       errors.push(name);
@@ -11399,12 +10725,12 @@ Allowed licenses: ${cfg.allowedLicenses.join(", ")}
 var license_audit_gate_default = plugin32;
 
 // src/lint-gate/index.ts
-import { execFile as execFile8 } from "node:child_process";
-import { readFileSync as readFileSync9 } from "node:fs";
+import { execFile as execFile7 } from "node:child_process";
+import { readFileSync as readFileSync8 } from "node:fs";
 import { mkdtemp, readFile as readFile11, rm, writeFile as writeFile3 } from "node:fs/promises";
-import { createRequire as createRequire2 } from "node:module";
+import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
-import { dirname as dirname6, isAbsolute as isAbsolute16, join as join5, relative as relative16, resolve as resolve17, sep as sep4 } from "node:path";
+import { dirname as dirname5, isAbsolute as isAbsolute14, join as join4, relative as relative14, resolve as resolve15, sep as sep3 } from "node:path";
 var API_VERSION24 = "^0.1.10";
 var state30 = {
   /** Total PreToolUse invocations. */
@@ -11442,22 +10768,22 @@ var LINTER_PACKAGES = {
   biome: "@biomejs/biome",
   eslint: "eslint"
 };
-var linterCache = new BoundedMap({ max: 32, ttlMs: 3e5 });
-function isInside2(parent, candidate) {
-  const rel = relative16(parent, candidate);
-  return rel === "" || !rel.startsWith(`..${sep4}`) && rel !== ".." && !isAbsolute16(rel);
+var linterCache = new runtime_exports.BoundedMap({ max: 32, ttlMs: 3e5 });
+function isInside(parent, candidate) {
+  const rel = relative14(parent, candidate);
+  return rel === "" || !rel.startsWith(`..${sep3}`) && rel !== ".." && !isAbsolute14(rel);
 }
 function resolveLocalLinter(name, cwd) {
   try {
     const packageName = LINTER_PACKAGES[name];
-    const requireFromProject = createRequire2(resolve17(cwd, "package.json"));
+    const requireFromProject = createRequire(resolve15(cwd, "package.json"));
     const packagePath = requireFromProject.resolve(`${packageName}/package.json`);
-    const packageJson = JSON.parse(readFileSync9(packagePath, "utf-8"));
+    const packageJson = JSON.parse(readFileSync8(packagePath, "utf-8"));
     const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[name] ?? Object.values(packageJson.bin ?? {})[0];
-    if (!relativeBin || isAbsolute16(relativeBin)) return null;
-    const packageDir = dirname6(packagePath);
-    const entry = resolve17(packageDir, relativeBin);
-    if (!isInside2(packageDir, entry)) return null;
+    if (!relativeBin || isAbsolute14(relativeBin)) return null;
+    const packageDir = dirname5(packagePath);
+    const entry = resolve15(packageDir, relativeBin);
+    if (!isInside(packageDir, entry)) return null;
     return {
       cmd: process.execPath,
       args: name === "biome" ? [entry, "check", "--reporter=json"] : [entry, "--format=json"],
@@ -11470,7 +10796,7 @@ function resolveLocalLinter(name, cwd) {
 function runCommand2(command, args, timeoutMs, cwd, signal) {
   return new Promise((resolveResult) => {
     try {
-      execFile8(
+      execFile7(
         command,
         args,
         {
@@ -11510,8 +10836,8 @@ async function lintContent(content, filePath, linter, timeoutMs, cwd, signal) {
   const ext = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")) : ".ts";
   let tmpDir;
   try {
-    tmpDir = await mkdtemp(join5(tmpdir(), "lint-gate-"));
-    const tmpFile = join5(tmpDir, `input${ext}`);
+    tmpDir = await mkdtemp(join4(tmpdir(), "lint-gate-"));
+    const tmpFile = join4(tmpDir, `input${ext}`);
     await writeFile3(tmpFile, content, "utf-8");
     const fullArgs = [...linter.args, tmpFile];
     const result = await runCommand2(linter.cmd, fullArgs, timeoutMs, cwd, signal);
@@ -11529,8 +10855,8 @@ async function lintAndFix(content, filePath, linter, timeoutMs, cwd, signal) {
   const ext = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")) : ".ts";
   let tmpDir;
   try {
-    tmpDir = await mkdtemp(join5(tmpdir(), "lint-gate-fix-"));
-    const tmpFile = join5(tmpDir, `input${ext}`);
+    tmpDir = await mkdtemp(join4(tmpdir(), "lint-gate-fix-"));
+    const tmpFile = join4(tmpDir, `input${ext}`);
     await writeFile3(tmpFile, content, "utf-8");
     const fixArgs = linter.name === "biome" ? [linter.args[0], "check", "--write", tmpFile] : [linter.args[0], "--fix", tmpFile];
     await runCommand2(linter.cmd, fixArgs, timeoutMs, cwd, signal);
@@ -11631,11 +10957,11 @@ var plugin33 = {
     state30.hitCount = 0;
     state30.fixCount = 0;
     state30.linterErrorCount = 0;
-    state30.hookUnregister = releaseHandle(state30.hookUnregister);
+    state30.hookUnregister = (0, runtime_exports.releaseHandle)(state30.hookUnregister);
     state30.lastResult = null;
     linterCache.clear();
     const cfg = readConfig28(api.config.extensions?.["lint-gate"]);
-    const cwd = resolve17(api.config.cwd ?? process.cwd());
+    const cwd = resolve15(api.config.cwd ?? process.cwd());
     const linterReady = detectLinter(cfg.linter, cwd).then((linter) => {
       if (!linter) {
         api.log.warn("lint-gate: no linter found (biome or eslint) \u2014 hook will be a no-op", {
@@ -12137,8 +11463,8 @@ var plugin34 = {
 var llm_cache_default = plugin34;
 
 // src/loop-breaker/index.ts
-import { execFile as execFile9 } from "node:child_process";
-import { isAbsolute as isAbsolute17, relative as relative17 } from "node:path";
+import { execFile as execFile8 } from "node:child_process";
+import { isAbsolute as isAbsolute15, relative as relative15 } from "node:path";
 var state32 = {
   lastFingerprint: null,
   streak: 0,
@@ -12249,13 +11575,13 @@ function hashString2(value) {
   return String(h >>> 0);
 }
 async function gitDiffFingerprint(cwd, targetPath, signal) {
-  const pathspec = isAbsolute17(targetPath) ? relative17(cwd, targetPath) : targetPath;
+  const pathspec = isAbsolute15(targetPath) ? relative15(cwd, targetPath) : targetPath;
   if (!pathspec || pathspec === ".." || pathspec.startsWith("../") || pathspec.startsWith("..\\")) {
     return null;
   }
   try {
-    const diff = await new Promise((resolve29, reject) => {
-      execFile9(
+    const diff = await new Promise((resolve27, reject) => {
+      execFile8(
         "git",
         ["diff", "--no-ext-diff", "--", pathspec],
         {
@@ -12271,7 +11597,7 @@ async function gitDiffFingerprint(cwd, targetPath, signal) {
         },
         (error, stdout) => {
           if (error) reject(error);
-          else resolve29(stdout);
+          else resolve27(stdout);
         }
       );
     });
@@ -12628,7 +11954,17 @@ var plugin35 = {
 var loop_breaker_default = plugin35;
 
 // src/migration-planner/index.ts
-import { existsSync as existsSync4, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync4, readFileSync as readFileSync9 } from "node:fs";
+
+// src/runtime/llm.ts
+import {
+  parseLlmJsonObject,
+  runOptionalPluginCouncil,
+  runOptionalPluginLlm,
+  stripOuterMarkdownFence
+} from "@wrongstack/plugin-sdk/runtime";
+
+// src/migration-planner/index.ts
 var API_VERSION25 = "^0.1.10";
 var state33 = {
   plansGenerated: 0,
@@ -12665,10 +12001,10 @@ function readChangelog(packageName, cfg) {
   candidates.push(`node_modules/${packageName}/CHANGELOG.md`);
   candidates.push(`node_modules/${packageName}/changelog.md`);
   for (const candidate of candidates) {
-    if (!withinProject(candidate)) continue;
+    if (!(0, runtime_exports.withinProject)(candidate)) continue;
     if (existsSync4(candidate)) {
       try {
-        const content = readFileSync10(candidate, "utf-8");
+        const content = readFileSync9(candidate, "utf-8");
         return { source: candidate, content: content.slice(0, cfg.maxChars) };
       } catch {
       }
@@ -12876,7 +12212,7 @@ var plugin36 = {
     state33.llmAnalysisCount = 0;
     state33.llmFallbackCount = 0;
     state33.lastPlan = null;
-    state33.hookUnregister = releaseHandle(state33.hookUnregister);
+    state33.hookUnregister = (0, runtime_exports.releaseHandle)(state33.hookUnregister);
     const cfg = readConfig31(api.config.extensions?.["migration-planner"]);
     const hook = (input) => {
       if (!cfg.enabled) return;
@@ -12884,14 +12220,14 @@ var plugin36 = {
       const inp = input.toolInput ?? {};
       const path = inp["path"];
       if (!path) return;
-      const basename8 = path.split(/[/\\]/).pop() ?? "";
+      const basename7 = path.split(/[/\\]/).pop() ?? "";
       if (!/^(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?)$/i.test(
-        basename8
+        basename7
       )) {
         return;
       }
       return {
-        additionalContext: `Manifest file ${basename8} changed. Consider running migration_plan if a dependency version was updated.`
+        additionalContext: `Manifest file ${basename7} changed. Consider running migration_plan if a dependency version was updated.`
       };
     };
     state33.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
@@ -13499,7 +12835,7 @@ async function deliver(event, payload) {
   }
   const result = await deliverViaChannel(ch, event, {
     title: typeof payload.title === "string" ? payload.title : event,
-    body: typeof payload.message === "string" ? payload.message : typeof payload.error === "string" ? payload.error : safeJsonStringify(payload),
+    body: typeof payload.message === "string" ? payload.message : typeof payload.error === "string" ? payload.error : (0, runtime_exports.safeJsonStringify)(payload),
     level: event === "tool.error" || event === "budget.threshold" ? "warning" : "info",
     source: event,
     metadata: payload
@@ -13783,6 +13119,12 @@ var plugin38 = {
 };
 var notify_hub_default = plugin38;
 
+// src/runtime/redos-guard.ts
+import {
+  withReDoSGuard,
+  guardedMatcher
+} from "@wrongstack/plugin-sdk/runtime";
+
 // src/path-guard/glob.ts
 var GLOB_REDOS_BUDGET_MS = 250;
 function mergeGuardedRegex(patterns) {
@@ -13897,8 +13239,8 @@ function isRootPathScope(path) {
 function isDirectoryAmbiguousPath(path) {
   const normalized = normalizePath2(path).replace(/\/$/, "");
   if (isRootPathScope(normalized)) return true;
-  const basename8 = normalized.slice(normalized.lastIndexOf("/") + 1);
-  return path.endsWith("/") || basename8.length > 0 && !basename8.includes(".");
+  const basename7 = normalized.slice(normalized.lastIndexOf("/") + 1);
+  return path.endsWith("/") || basename7.length > 0 && !basename7.includes(".");
 }
 function hasConfiguredProtectedDescendant(path, patterns) {
   const normalized = normalizePath2(path).replace(/\/$/, "").toLowerCase();
@@ -14386,7 +13728,7 @@ function heredocDelimiterOnLine(line) {
     const stripTabs = line[cursor] === "-";
     if (stripTabs) cursor += 1;
     while (line[cursor] === " " || line[cursor] === "	") cursor += 1;
-    let delimiter2 = "";
+    let delimiter = "";
     let delimiterQuote = null;
     let quoted = false;
     for (; cursor < line.length; cursor += 1) {
@@ -14398,9 +13740,9 @@ function heredocDelimiterOnLine(line) {
         } else if (delimiterChar === "\\" && delimiterQuote === '"' && cursor + 1 < line.length) {
           quoted = true;
           cursor += 1;
-          delimiter2 += line[cursor] ?? "";
+          delimiter += line[cursor] ?? "";
         } else {
-          delimiter2 += delimiterChar;
+          delimiter += delimiterChar;
         }
         continue;
       }
@@ -14412,13 +13754,13 @@ function heredocDelimiterOnLine(line) {
       if (delimiterChar === "\\" && cursor + 1 < line.length) {
         quoted = true;
         cursor += 1;
-        delimiter2 += line[cursor] ?? "";
+        delimiter += line[cursor] ?? "";
         continue;
       }
       if (/\s|[;&|<>]/.test(delimiterChar)) break;
-      delimiter2 += delimiterChar;
+      delimiter += delimiterChar;
     }
-    return delimiter2.length > 0 ? { delimiter: delimiter2, start: index, end: cursor, quoted, stripTabs } : null;
+    return delimiter.length > 0 ? { delimiter, start: index, end: cursor, quoted, stripTabs } : null;
   }
   return null;
 }
@@ -15073,13 +14415,13 @@ function operationLabel(toolName) {
 
 // src/path-guard/index.ts
 import { realpathSync } from "node:fs";
-import { resolve as resolve18 } from "node:path";
+import { resolve as resolve16 } from "node:path";
 function isSymlinkEscape(path, cwd) {
-  if (!withinProject(path)) return false;
+  if (!(0, runtime_exports.withinProject)(path)) return false;
   try {
-    const abs = resolve18(cwd ?? process.cwd(), path);
+    const abs = resolve16(cwd ?? process.cwd(), path);
     const real = realpathSync(abs);
-    return !withinProject(real);
+    return !(0, runtime_exports.withinProject)(real);
   } catch {
     return false;
   }
@@ -15348,8 +14690,8 @@ var plugin39 = {
 var path_guard_default = plugin39;
 
 // src/performance-regression-gate/index.ts
-import { existsSync as existsSync5, readFileSync as readFileSync11 } from "node:fs";
-import { isAbsolute as isAbsolute18, relative as relative18, resolve as resolve19 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync10 } from "node:fs";
+import { isAbsolute as isAbsolute16, relative as relative16, resolve as resolve17 } from "node:path";
 var API_VERSION26 = "^0.1.10";
 var state36 = {
   invocationCount: 0,
@@ -15372,21 +14714,21 @@ function readConfig35(raw) {
     thresholdPercent: threshold
   };
 }
-function withinProject3(p, cwd = process.cwd()) {
+function withinProject17(p, cwd = process.cwd()) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
-  const root = resolve19(cwd);
-  const resolved = isAbsolute18(p) ? resolve19(p) : resolve19(root, p);
-  const rel = relative18(root, resolved);
+  const root = resolve17(cwd);
+  const resolved = isAbsolute16(p) ? resolve17(p) : resolve17(root, p);
+  const rel = relative16(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute18(rel)) return false;
+  if (isAbsolute16(rel)) return false;
   return true;
 }
 function resolveProjectPath6(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
-  const root = resolve19(cwd);
-  const resolved = isAbsolute18(rawPath) ? resolve19(rawPath) : resolve19(root, rawPath);
-  if (!withinProject3(resolved, cwd)) return null;
+  const root = resolve17(cwd);
+  const resolved = isAbsolute16(rawPath) ? resolve17(rawPath) : resolve17(root, rawPath);
+  if (!withinProject17(resolved, cwd)) return null;
   return resolved;
 }
 function isValidNumber(n) {
@@ -15416,7 +14758,7 @@ function flattenResults(results) {
 function loadResults(path) {
   if (!path || !existsSync5(path)) return null;
   try {
-    const raw = JSON.parse(readFileSync11(path, "utf-8"));
+    const raw = JSON.parse(readFileSync10(path, "utf-8"));
     return raw;
   } catch {
     return null;
@@ -15798,9 +15140,9 @@ function readConfig36(raw) {
 var plugin_stack_observer_default = PLUGIN;
 
 // src/pr-drafter/index.ts
-import { execFile as execFile10 } from "node:child_process";
+import { execFile as execFile9 } from "node:child_process";
 import { mkdir as mkdir2, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname7, isAbsolute as isAbsolute19, relative as relative19, resolve as resolve20 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute17, relative as relative17, resolve as resolve18 } from "node:path";
 var API_VERSION27 = "^0.1.10";
 var state38 = {
   commits: [],
@@ -15839,15 +15181,15 @@ function readConfig37(raw) {
 }
 function resolveProjectPath7(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
-  const root = resolve20(cwd);
-  const resolved = isAbsolute19(rawPath) ? resolve20(rawPath) : resolve20(root, rawPath);
-  const rel = relative19(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute19(rel)) return resolved;
+  const root = resolve18(cwd);
+  const resolved = isAbsolute17(rawPath) ? resolve18(rawPath) : resolve18(root, rawPath);
+  const rel = relative17(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute17(rel)) return resolved;
   return null;
 }
 function runGit4(args, timeout) {
   return new Promise((resolveOutput) => {
-    execFile10(
+    execFile9(
       "git",
       args,
       {
@@ -15932,7 +15274,7 @@ async function writeDraft(cfg, llm) {
   }
   const draft = await buildDraft(cfg, llm);
   try {
-    await mkdir2(dirname7(resolved), { recursive: true });
+    await mkdir2(dirname6(resolved), { recursive: true });
     await writeFile4(resolved, draft.body);
     state38.draftsWritten += 1;
   } catch {
@@ -15996,7 +15338,7 @@ var plugin41 = {
     state38.draftsWritten = 0;
     state38.draftErrors = 0;
     state38.stopInvocations = 0;
-    state38.stopHookUnregister = releaseHandle(state38.stopHookUnregister);
+    state38.stopHookUnregister = (0, runtime_exports.releaseHandle)(state38.stopHookUnregister);
     for (const off of state38.eventUnsubscribers) {
       try {
         off();
@@ -16065,7 +15407,7 @@ var plugin41 = {
         const resolved = resolveProjectPath7(cfg.outputPath);
         if (!resolved) return { ok: false, error: "outputPath resolves outside project" };
         try {
-          await mkdir2(dirname7(resolved), { recursive: true });
+          await mkdir2(dirname6(resolved), { recursive: true });
           await writeFile4(resolved, draft.body);
           state38.draftsWritten += 1;
           return {
@@ -16290,136 +15632,10 @@ var process_guard_default = plugin42;
 import { performance as performance2 } from "node:perf_hooks";
 
 // src/runtime/credential-patterns.ts
-var CREDENTIAL_PATTERNS = [
-  // LLM provider keys
-  {
-    type: "anthropic_key",
-    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g
-  },
-  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?!ant)(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g },
-  // GitHub. `ghp_` is only the personal-access-token prefix — the OAuth
-  // (`gho_`), user-to-server (`ghu_`), server-to-server (`ghs_`) and
-  // refresh (`ghr_`) tokens grant the same or broader access and were
-  // previously not detected at all.
-  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g },
-  {
-    type: "github_oauth_token",
-    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g
-  },
-  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g },
-  // GitLab
-  { type: "gitlab_pat", regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
-  {
-    type: "gitlab_runner_token",
-    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
-  },
-  // npm — a leaked publish token is a supply-chain compromise.
-  { type: "npm_token", regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g },
-  // AWS
-  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g },
-  // GCP
-  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g },
-  // Slack. `xoxe` (token-rotation) and `xapp` (app-level) were missing;
-  // both are as sensitive as the bot/user tokens already covered.
-  {
-    type: "slack_token",
-    regex: /(?<![A-Za-z0-9-])xox[abposer]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g
-  },
-  { type: "slack_app_token", regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g },
-  {
-    type: "slack_webhook",
-    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g
-  },
-  // Stripe
-  {
-    type: "stripe_key",
-    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g
-  },
-  // Twilio
-  { type: "twilio_sid", regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g },
-  // Telegram
-  {
-    type: "telegram_bot_token",
-    regex: /(?:(?<![A-Za-z0-9_])|(?<=(?:^|[^A-Za-z0-9_])bot))\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
-  },
-  // JWT
-  {
-    type: "jwt",
-    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g
-  },
-  // Private keys
-  {
-    type: "private_key",
-    regex: /(?:^|\n)(?:-----BEGIN (?:RSA|EC|OPENSSH|DSA)? ?PRIVATE KEY-----[\s\S]*?-----END (?:RSA|EC|OPENSSH|DSA)? ?PRIVATE KEY-----|-----BEGIN PGP PRIVATE KEY BLOCK-----[\s\S]*?-----END PGP PRIVATE KEY BLOCK-----)(?!\S)/g
-  },
-  // AI/ML provider tokens
-  { type: "huggingface_token", regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g },
-  { type: "replicate_token", regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
-  { type: "perplexity_key", regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
-  { type: "groq_key", regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
-  // SaaS / infrastructure tokens — each grants API access on the user's
-  // account, and each was previously invisible to this gate.
-  { type: "sendgrid_key", regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
-  { type: "digitalocean_token", regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g },
-  { type: "doppler_token", regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
-  { type: "shopify_token", regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g },
-  { type: "docker_pat", regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
-  { type: "linear_key", regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
-  { type: "atlassian_token", regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g },
-  { type: "square_token", regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
-  {
-    type: "azure_storage_key",
-    regex: /AccountKey=[A-Za-z0-9+/]{80,}={0,2}/g
-  },
-  {
-    type: "google_oauth_client_secret",
-    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
-  },
-  // Bearer tokens
-  {
-    type: "bearer_token",
-    regex: /(?<![A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?![A-Za-z0-9._~+/-])/g
-  },
-  // Database URIs. Require password-bearing user-info; credential-free values stay scannable.
-  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
-  {
-    type: "postgres_uri",
-    // Query parsers decode percent-encoded parameter names. Recognize each
-    // encoded character in `password` so mixed forms such as `pass%77ord`
-    // cannot bypass detection while keeping the scan strictly bounded.
-    regex: /postgres(?:ql)?:\/\/(?:[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+|[^&\s?"'`#]{1,2048}\?(?:(?!(?:p|%70)(?:a|%61)(?:s|%73)(?:s|%73)(?:w|%77)(?:o|%6[fF])(?:r|%72)(?:d|%64)=)[^&\s#"'`]{1,256}&){0,32}(?:p|%70)(?:a|%61)(?:s|%73)(?:s|%73)(?:w|%77)(?:o|%6[fF])(?:r|%72)(?:d|%64)=[^&\s#"'`]{1,4096})/g
-  },
-  { type: "mysql_uri", regex: /mysql:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
-  { type: "redis_uri", regex: /redis:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
-  {
-    // Credentials serialised as JSON, keyed rather than prefixed. Every other
-    // entry in this table recognises a credential by its SHAPE (`ghp_`, `sk-`,
-    // `eyJ`), which means a key with no distinctive prefix — Azure, a
-    // self-hosted gateway, an Anthropic/Codex OAuth token — was invisible to
-    // both surfaces. `prompt-firewall` guards the outgoing provider request, so
-    // this is what stops a JSON-shaped tool result carrying such a value to a
-    // third party.
-    //
-    // The key is matched in a LOOKBEHIND, so the reported match is the secret
-    // itself and the pattern keeps zero capturing groups — `secret-scanner`
-    // maps a combined-regex group index back to the pattern that fired, and an
-    // inner group would shift that mapping (see the style note above, enforced
-    // by credential-pattern-parity.test.ts).
-    //
-    // Mirrors `json_credential_key` in
-    // `@wrongstack/core` → `src/security/secret-scrubber.ts`. Keep the two key
-    // lists in step; the core side additionally preserves the key name when it
-    // rewrites, which is why it is written with capture groups instead.
-    type: "json_credential_key",
-    regex: /(?<="[A-Za-z0-9_]{0,64}(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s{0,8}:\s{0,8}")[^"\\]{8,512}(?=")/gi
-  }
-];
-function cloneCredentialPatterns() {
-  return CREDENTIAL_PATTERNS.map((p) => ({
-    type: p.type,
-    regex: new RegExp(p.regex.source, p.regex.flags)
-  }));
-}
+import {
+  cloneCredentialPatterns,
+  CREDENTIAL_PATTERNS
+} from "@wrongstack/plugin-sdk/runtime";
 
 // src/prompt-firewall/index.ts
 var KIND_ALIASES = {
@@ -16920,7 +16136,7 @@ var prompt_firewall_default = plugin43;
 
 // src/refactor-suggester/index.ts
 import { readFile as readFile12 } from "node:fs/promises";
-import { isAbsolute as isAbsolute20, relative as relative20, resolve as resolve21 } from "node:path";
+import { isAbsolute as isAbsolute18, relative as relative18, resolve as resolve19 } from "node:path";
 var API_VERSION28 = "^0.1.10";
 var HOOK_WARNING_COOLDOWN_MS2 = 6e4;
 var state41 = {
@@ -16930,7 +16146,7 @@ var state41 = {
   warningCount: 0,
   errorCount: 0,
   hookUnregister: null,
-  lastHookWarning: new BoundedMap({ max: 512, ttlMs: HOOK_WARNING_COOLDOWN_MS2 })
+  lastHookWarning: new runtime_exports.BoundedMap({ max: 512, ttlMs: HOOK_WARNING_COOLDOWN_MS2 })
 };
 var DEFAULTS37 = {
   enabled: false,
@@ -16964,7 +16180,7 @@ function toPosix6(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath6(p) {
-  return toPosix6(relative20(process.cwd(), p));
+  return toPosix6(relative18(process.cwd(), p));
 }
 function leadingIndentLevel(line) {
   const leading = line.match(/^(\s*)/)?.[1] ?? "";
@@ -17051,9 +16267,9 @@ function detectSmells(filePath, content, rules) {
 }
 async function scanPath4(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute20(rawPath) ? resolve21(rawPath) : resolve21(root, rawPath);
+  const resolved = isAbsolute18(rawPath) ? resolve19(rawPath) : resolve19(root, rawPath);
   const exts = normalizeExtensions5(cfg.extensions);
-  const files = await collectSourceFilesAsync(resolved, { extensions: exts });
+  const files = await (0, runtime_exports.collectSourceFilesAsync)(resolved, { extensions: exts });
   const suggestions = [];
   let scannedFiles = 0;
   let truncated = false;
@@ -17131,14 +16347,14 @@ var plugin44 = {
       const inp = input.toolInput ?? {};
       const sourcePath = inp["path"];
       if (!sourcePath || typeof sourcePath !== "string") return;
-      if (!withinProject(sourcePath)) return;
+      if (!(0, runtime_exports.withinProject)(sourcePath)) return;
       const exts = normalizeExtensions5(cfg.extensions);
-      if (!matchesExtension(sourcePath, exts)) return;
+      if (!(0, runtime_exports.matchesExtension)(sourcePath, exts)) return;
       state41.hookInvocationCount += 1;
       const now = Date.now();
       const lastWarning = state41.lastHookWarning.get(sourcePath);
       if (lastWarning !== void 0 && now - lastWarning < HOOK_WARNING_COOLDOWN_MS2) return;
-      const resolved = resolve21(process.cwd(), sourcePath);
+      const resolved = resolve19(process.cwd(), sourcePath);
       let content;
       try {
         content = await readFile12(resolved, "utf-8");
@@ -17171,7 +16387,7 @@ var plugin44 = {
       async execute(input) {
         if (!cfg.enabled) return { ok: false, error: "refactor-suggester is disabled" };
         const rawPath = typeof input.path === "string" ? input.path : ".";
-        if (!withinProject(rawPath)) {
+        if (!(0, runtime_exports.withinProject)(rawPath)) {
           return { ok: false, error: "path is outside the project root" };
         }
         state41.scanCount += 1;
@@ -17185,7 +16401,7 @@ var plugin44 = {
         state41.suggestionCount += result.suggestions.length;
         return {
           ok: true,
-          path: relativePath6(resolve21(process.cwd(), rawPath)),
+          path: relativePath6(resolve19(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
           discoveredFiles: result.discoveredFiles,
           // Say so when the cap stopped the walk early: a partial scan
@@ -17266,7 +16482,7 @@ var plugin44 = {
 var refactor_suggester_default = plugin44;
 
 // src/release-notes-generator/index.ts
-import { execFile as execFile11 } from "node:child_process";
+import { execFile as execFile10 } from "node:child_process";
 var API_VERSION29 = "^0.1.10";
 var state42 = {
   generateCount: 0,
@@ -17318,7 +16534,7 @@ function formatCommit(c, includeScope) {
 }
 function runGit5(args, signal) {
   return new Promise((resolveOutput, reject) => {
-    execFile11(
+    execFile10(
       "git",
       args,
       {
@@ -17600,8 +16816,8 @@ var plugin45 = {
 var release_notes_generator_default = plugin45;
 
 // src/schema-evolution-guard/index.ts
-import { readFileSync as readFileSync12 } from "node:fs";
-import { basename as basename6 } from "node:path";
+import { readFileSync as readFileSync11 } from "node:fs";
+import { basename as basename5 } from "node:path";
 var API_VERSION30 = "^0.1.10";
 var state43 = {
   invocationCount: 0,
@@ -17788,7 +17004,7 @@ var plugin46 = {
       const filePath = typeof toolInput["path"] === "string" ? toolInput["path"] : void 0;
       if (!filePath) return;
       state43.invocationCount += 1;
-      const fileName = basename6(filePath);
+      const fileName = basename5(filePath);
       if (!matchesAnyPattern2(fileName, cfg.filePatterns)) {
         state43.skippedCount += 1;
         return;
@@ -17801,9 +17017,9 @@ var plugin46 = {
       let content;
       if (typeof toolInput["content"] === "string") {
         content = toolInput["content"];
-      } else if (withinProject(filePath)) {
+      } else if ((0, runtime_exports.withinProject)(filePath)) {
         try {
-          content = readFileSync12(filePath, "utf-8");
+          content = readFileSync11(filePath, "utf-8");
         } catch {
           content = void 0;
         }
@@ -18249,8 +17465,8 @@ var plugin47 = {
   setup(api) {
     const previous = runtimes.get(api);
     if (previous) {
-      previous.state.hookUnregister = releaseHandle(previous.state.hookUnregister);
-      previous.state.postHookUnregister = releaseHandle(previous.state.postHookUnregister);
+      previous.state.hookUnregister = (0, runtime_exports.releaseHandle)(previous.state.hookUnregister);
+      previous.state.postHookUnregister = (0, runtime_exports.releaseHandle)(previous.state.postHookUnregister);
     }
     const cfg = readConfig43(api.config.extensions?.["secret-scanner"]);
     PATTERNS3 = [...BASE_PATTERNS];
@@ -18397,7 +17613,7 @@ var secret_scanner_default = plugin47;
 
 // src/security-hotspot-scanner/index.ts
 import { readdir as readdir2, readFile as readFile13, stat as stat5 } from "node:fs/promises";
-import { isAbsolute as isAbsolute21, relative as relative21, resolve as resolve22 } from "node:path";
+import { isAbsolute as isAbsolute19, relative as relative19, resolve as resolve20 } from "node:path";
 var API_VERSION31 = "^0.1.10";
 var state44 = {
   scanCount: 0,
@@ -18407,7 +17623,7 @@ var state44 = {
   skippedCount: 0,
   blockedCount: 0,
   lastResult: null,
-  knownHotspots: new BoundedSet({ max: 5e3 }),
+  knownHotspots: new runtime_exports.BoundedSet({ max: 5e3 }),
   hookUnregister: null
 };
 var DEFAULTS41 = {
@@ -18488,8 +17704,8 @@ function isSourceFile2(filePath, extensions) {
 async function scanPath5(inputPath, cfg) {
   const start = Date.now();
   const root = process.cwd();
-  const resolved = isAbsolute21(inputPath) ? resolve22(inputPath) : resolve22(root, inputPath);
-  if (!withinProject(inputPath)) {
+  const resolved = isAbsolute19(inputPath) ? resolve20(inputPath) : resolve20(root, inputPath);
+  if (!(0, runtime_exports.withinProject)(inputPath)) {
     return {
       path: inputPath,
       scanned: false,
@@ -18509,7 +17725,7 @@ async function scanPath5(inputPath, cfg) {
       filesScanned += 1;
       const findings = scanSource(content, maxPerFile);
       for (const f of findings) {
-        allFindings.push({ ...f, snippet: `${relative21(root, filePath)}:${f.line}: ${f.snippet}` });
+        allFindings.push({ ...f, snippet: `${relative19(root, filePath)}:${f.line}: ${f.snippet}` });
         if (allFindings.length >= cfg.maxFindings) return;
       }
     } catch {
@@ -18524,7 +17740,7 @@ async function scanPath5(inputPath, cfg) {
     }
     for (const entry of entries) {
       if (allFindings.length >= cfg.maxFindings) return;
-      const full = resolve22(dir, entry);
+      const full = resolve20(dir, entry);
       try {
         const st = await stat5(full);
         if (st.isDirectory()) {
@@ -18628,7 +17844,7 @@ var plugin48 = {
       const inp = input.toolInput ?? {};
       const sourcePath = inp["path"];
       if (!sourcePath || typeof sourcePath !== "string") return;
-      if (!withinProject(sourcePath)) return;
+      if (!(0, runtime_exports.withinProject)(sourcePath)) return;
       const ext = sourcePath.includes(".") ? sourcePath.slice(sourcePath.lastIndexOf(".")).toLowerCase() : "";
       if (!scanOnChangeSet.has(ext)) {
         state44.skippedCount += 1;
@@ -18793,7 +18009,7 @@ var security_hotspot_scanner_default = plugin48;
 
 // src/semantic-search-indexer/index.ts
 import * as fs2 from "node:fs/promises";
-import { isAbsolute as isAbsolute22, relative as relative22, resolve as resolve23 } from "node:path";
+import { isAbsolute as isAbsolute20, relative as relative20, resolve as resolve21 } from "node:path";
 import { DEFAULT_WALK_IGNORE_DIRS } from "@wrongstack/core/utils";
 var API_VERSION32 = "^0.1.10";
 var escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -18871,21 +18087,21 @@ function readConfig45(raw) {
 function normalizeSlashes2(p) {
   return p.replace(/\\/g, "/");
 }
-function withinProject4(p) {
+function withinProject21(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = normalizeSlashes2(process.cwd());
-  const resolved = normalizeSlashes2(isAbsolute22(p) ? resolve23(p) : resolve23(root, p));
-  const rel = normalizeSlashes2(relative22(root, resolved));
+  const resolved = normalizeSlashes2(isAbsolute20(p) ? resolve21(p) : resolve21(root, p));
+  const rel = normalizeSlashes2(relative20(root, resolved));
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute22(rel)) return false;
+  if (isAbsolute20(rel)) return false;
   return true;
 }
 function resolveProjectPath8(p) {
   const raw = typeof p === "string" && p.length > 0 ? p : ".";
-  if (!withinProject4(raw)) return null;
+  if (!withinProject21(raw)) return null;
   const root = normalizeSlashes2(process.cwd());
-  return normalizeSlashes2(isAbsolute22(raw) ? resolve23(raw) : resolve23(root, raw));
+  return normalizeSlashes2(isAbsolute20(raw) ? resolve21(raw) : resolve21(root, raw));
 }
 function tokenize(text, minLength) {
   const tokens = [];
@@ -18915,7 +18131,7 @@ function shouldIndexFile(filePath, cfg) {
 var INDEX_BATCH_SIZE = 32;
 var YIELD_EVERY_FILES = 64;
 function yieldEventLoop() {
-  return new Promise((resolve29) => setImmediate(resolve29));
+  return new Promise((resolve27) => setImmediate(resolve27));
 }
 function addFileToIndex(relPath, content, size, cfg) {
   if (!state45.index || content.includes("\0")) return;
@@ -18969,8 +18185,8 @@ async function walkDirectory(absPath, cfg, excludes, fileBatch) {
       state45.truncated = true;
       return;
     }
-    const absChild = normalizeSlashes2(resolve23(absPath, ent.name));
-    const relChild = normalizeSlashes2(relative22(root, absChild));
+    const absChild = normalizeSlashes2(resolve21(absPath, ent.name));
+    const relChild = normalizeSlashes2(relative20(root, absChild));
     if (relChild === "" || relChild === ".") continue;
     if (excludes.some((re) => re.test(relChild))) continue;
     if (ent.isDirectory()) {
@@ -19012,7 +18228,7 @@ async function buildIndex(rootPath, cfg) {
     return;
   }
   if (rootStats.isFile()) {
-    const relPath = normalizeSlashes2(relative22(normalizeSlashes2(process.cwd()), rootPath));
+    const relPath = normalizeSlashes2(relative20(normalizeSlashes2(process.cwd()), rootPath));
     await indexFileFromStats(rootPath, relPath === "" ? "." : relPath, rootStats, cfg);
     state45.fileCount = state45.index.files.size;
   } else if (rootStats.isDirectory()) {
@@ -19307,16 +18523,16 @@ var semantic_search_indexer_default = plugin49;
 // src/semver-bump/index.ts
 import { expectDefined as expectDefined2 } from "@wrongstack/core/utils";
 import { toErrorMessage } from "@wrongstack/core/utils";
-import { execFile as execFile12 } from "node:child_process";
+import { execFile as execFile11 } from "node:child_process";
 import { access as access4, readFile as readFile15, readdir as readdir4, writeFile as writeFile5 } from "node:fs/promises";
-import { isAbsolute as isAbsolute23, join as join6, relative as relative23, resolve as resolve24 } from "node:path";
+import { isAbsolute as isAbsolute21, join as join5, relative as relative21, resolve as resolve22 } from "node:path";
 var API_VERSION33 = "^0.1.10";
 function resolveProjectRoot(rawCwd, root = process.cwd()) {
   if (typeof rawCwd !== "string" || rawCwd.length === 0) return root;
-  const base = resolve24(root);
-  const resolved = isAbsolute23(rawCwd) ? resolve24(rawCwd) : resolve24(base, rawCwd);
-  const rel = relative23(base, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute23(rel)) return resolved;
+  const base = resolve22(root);
+  const resolved = isAbsolute21(rawCwd) ? resolve22(rawCwd) : resolve22(base, rawCwd);
+  const rel = relative21(base, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute21(rel)) return resolved;
   return null;
 }
 var state46 = {
@@ -19328,15 +18544,15 @@ var state46 = {
   lastBump: null
 };
 function runCommand3(command, args, cwd) {
-  return new Promise((resolve29, reject) => {
-    execFile12(command, args, {
+  return new Promise((resolve27, reject) => {
+    execFile11(command, args, {
       encoding: "utf-8",
       cwd,
       timeout: 3e4,
       windowsHide: true
     }, (err, stdout, stderr) => {
       if (!err) {
-        resolve29(stdout.trim());
+        resolve27(stdout.trim());
         return;
       }
       const failure = err;
@@ -19364,14 +18580,14 @@ async function getPackageJson(cwd) {
 }
 async function collectManifests(root) {
   const paths = [];
-  const rootPkg = join6(root, "package.json");
+  const rootPkg = join5(root, "package.json");
   try {
     await access4(rootPkg);
     paths.push(rootPkg);
   } catch {
   }
   for (const group of ["packages", "apps"]) {
-    const groupDir = join6(root, group);
+    const groupDir = join5(root, group);
     let entries;
     try {
       entries = await readdir4(groupDir, { withFileTypes: true });
@@ -19380,7 +18596,7 @@ async function collectManifests(root) {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const candidate = join6(groupDir, entry.name, "package.json");
+      const candidate = join5(groupDir, entry.name, "package.json");
       try {
         await access4(candidate);
         paths.push(candidate);
@@ -19575,7 +18791,7 @@ var plugin50 = {
         };
       }
       const root = cwd ?? process.cwd();
-      const bumpScript = join6(root, "scripts", "bump-version.mjs");
+      const bumpScript = join5(root, "scripts", "bump-version.mjs");
       const changed = await collectManifests(root);
       let hasBumpScript = true;
       try {
@@ -19591,7 +18807,7 @@ var plugin50 = {
           return { ok: false, error: `bump script failed: ${msg}` };
         }
         for (const rel of ["package.json", "package-lock.json", "src/lib/utils.ts", "index.html"]) {
-          const p = join6(root, "website", rel);
+          const p = join5(root, "website", rel);
           try {
             await access4(p);
             changed.push(p);
@@ -20068,7 +19284,7 @@ var plugin51 = {
     state47.commitCount = 0;
     state47.startedAt = null;
     state47.lastActivityAt = null;
-    state47.stopHookUnregister = releaseHandle(state47.stopHookUnregister);
+    state47.stopHookUnregister = (0, runtime_exports.releaseHandle)(state47.stopHookUnregister);
     for (const off of state47.eventUnsubscribers) {
       try {
         off();
@@ -20337,18 +19553,18 @@ Tokens: ${recap.tokens.total.input} in / ${recap.tokens.total.output} out
 var session_recap_default = plugin51;
 
 // src/shell-check/index.ts
-import { execFile as execFile13 } from "node:child_process";
+import { execFile as execFile12 } from "node:child_process";
 import { readdir as readdir5 } from "node:fs/promises";
-import { isAbsolute as isAbsolute24, join as join7, relative as relative24, resolve as resolve25 } from "node:path";
+import { isAbsolute as isAbsolute22, join as join6, relative as relative22, resolve as resolve23 } from "node:path";
 var API_VERSION34 = "^0.1.10";
-function withinProject5(p) {
+function withinProject22(p) {
   if (p.startsWith("-")) return false;
   const root = process.cwd();
-  const resolved = isAbsolute24(p) ? resolve25(p) : resolve25(root, p);
-  const rel = relative24(root, resolved);
+  const resolved = isAbsolute22(p) ? resolve23(p) : resolve23(root, p);
+  const rel = relative22(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute24(rel)) return false;
+  if (isAbsolute22(rel)) return false;
   return true;
 }
 var MAX_PATH_LEN = 4096;
@@ -20363,7 +19579,7 @@ var state48 = {
 async function runShellCheck(files, severity, cwd) {
   try {
     await new Promise((resolvePromise, rejectPromise) => {
-      execFile13(
+      execFile12(
         "shellcheck",
         ["--version"],
         { encoding: "utf-8", windowsHide: true },
@@ -20389,7 +19605,7 @@ async function runShellCheck(files, severity, cwd) {
   let raw;
   try {
     raw = await new Promise((resolvePromise, rejectPromise) => {
-      execFile13(
+      execFile12(
         "shellcheck",
         args,
         {
@@ -20441,7 +19657,7 @@ async function findShellFiles(dir, pattern) {
     return results;
   }
   for (const entry of entries) {
-    const full = join7(dir, entry.name);
+    const full = join6(dir, entry.name);
     if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== ".git") {
       results.push(...await findShellFiles(full, pattern));
     } else if (entry.isFile() && (entry.name.endsWith(".sh") || entry.name === "Dockerfile")) {
@@ -20525,7 +19741,7 @@ var plugin52 = {
         const pattern = inp.pattern ?? "";
         const severity = inp.severity ?? "warning";
         state48.invocationCount += 1;
-        const pathIsSafe = (p) => typeof p === "string" && p.length > 0 && p.length <= MAX_PATH_LEN && withinProject5(p);
+        const pathIsSafe = (p) => typeof p === "string" && p.length > 0 && p.length <= MAX_PATH_LEN && withinProject22(p);
         if (!pathIsSafe(directory)) {
           return {
             ok: false,
@@ -20640,8 +19856,8 @@ var plugin52 = {
 var shell_check_default = plugin52;
 
 // src/smart-rename/index.ts
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync2 } from "node:fs";
-import { extname as extname6, isAbsolute as isAbsolute25, relative as relative25, resolve as resolve26 } from "node:path";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync2 } from "node:fs";
+import { extname as extname4, isAbsolute as isAbsolute23, relative as relative23, resolve as resolve24 } from "node:path";
 var API_VERSION35 = "^0.1.10";
 var state49 = {
   renameCount: 0,
@@ -20660,21 +19876,21 @@ function readConfig47(raw) {
     extensions: Array.isArray(r["extensions"]) ? r["extensions"].filter((x) => typeof x === "string") : DEFAULTS44.extensions
   };
 }
-function withinProject6(p) {
+function withinProject23(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute25(p) ? resolve26(p) : resolve26(root, p);
-  const rel = relative25(root, resolved);
+  const resolved = isAbsolute23(p) ? resolve24(p) : resolve24(root, p);
+  const rel = relative23(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute25(rel)) return false;
+  if (isAbsolute23(rel)) return false;
   return true;
 }
 function toPosix7(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath7(p) {
-  return toPosix7(relative25(process.cwd(), p));
+  return toPosix7(relative23(process.cwd(), p));
 }
 function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -20759,17 +19975,17 @@ var plugin53 = {
         if (!isIdentifier(newName)) {
           return { ok: false, error: `newName "${newName}" is not a valid identifier` };
         }
-        if (!withinProject6(rawPath)) {
+        if (!withinProject23(rawPath)) {
           return { ok: false, error: "path is outside the project root" };
         }
-        const ext = extname6(rawPath).toLowerCase();
+        const ext = extname4(rawPath).toLowerCase();
         if (!cfg.extensions.includes(ext)) {
           return { ok: false, error: `extension ${ext} is not allowed for rename` };
         }
-        const resolved = resolve26(process.cwd(), rawPath);
+        const resolved = resolve24(process.cwd(), rawPath);
         let content;
         try {
-          content = readFileSync13(resolved, "utf-8");
+          content = readFileSync12(resolved, "utf-8");
         } catch (err) {
           state49.errorCount += 1;
           return { ok: false, error: String(err) };
@@ -21157,8 +20373,8 @@ var plugin54 = {
     state50.skippedNonMd = 0;
     state50.readErrorCount = 0;
     state50.autoFixApplied = 0;
-    state50.postHookUnregister = releaseHandle(state50.postHookUnregister);
-    state50.preHookUnregister = releaseHandle(state50.preHookUnregister);
+    state50.postHookUnregister = (0, runtime_exports.releaseHandle)(state50.postHookUnregister);
+    state50.preHookUnregister = (0, runtime_exports.releaseHandle)(state50.preHookUnregister);
     const cfg = readConfig48(api.config.extensions?.["spec-linker"]);
     const postHook = async (input) => {
       if (!cfg.enabled) return;
@@ -21312,7 +20528,7 @@ var spec_linker_default = plugin54;
 
 // src/template-engine/index.ts
 import { readFile as readFile17, writeFile as writeFile6 } from "node:fs/promises";
-import { isAbsolute as isAbsolute26 } from "node:path";
+import { isAbsolute as isAbsolute24 } from "node:path";
 var API_VERSION36 = "^0.1.10";
 var templates = /* @__PURE__ */ new Map();
 var MAX_TEMPLATES = 256;
@@ -21368,10 +20584,10 @@ function renderTemplateRaw(template, variables) {
   return result;
 }
 function validateRelativeTemplatePath(field, value) {
-  if (isAbsolute26(value) || value.split(/[\\/]+/).includes("..")) {
+  if (isAbsolute24(value) || value.split(/[\\/]+/).includes("..")) {
     return `${field} must be a relative path without ".." components`;
   }
-  if (!withinProject(value)) {
+  if (!(0, runtime_exports.withinProject)(value)) {
     return `${field} must resolve inside the project directory`;
   }
   return null;
@@ -21674,7 +20890,7 @@ var plugin55 = {
         };
       }
     });
-    contributorUnregister = releaseHandle(contributorUnregister);
+    contributorUnregister = (0, runtime_exports.releaseHandle)(contributorUnregister);
     contributorUnregister = api.registerSystemPromptContributor(async () => [
       {
         type: "text",
@@ -21690,7 +20906,7 @@ var plugin55 = {
   teardown(api) {
     const count = templates.size;
     templates.clear();
-    contributorUnregister = releaseHandle(contributorUnregister);
+    contributorUnregister = (0, runtime_exports.releaseHandle)(contributorUnregister);
     api.log.info("template-engine: teardown complete", { cleared: count });
   },
   async health() {
@@ -21709,7 +20925,7 @@ var plugin55 = {
 var template_engine_default = plugin55;
 
 // src/test-coverage-gate/index.ts
-import { readFileSync as readFileSync14 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 var API_VERSION37 = "^0.1.10";
 var state51 = {
   invocationCount: 0,
@@ -21750,7 +20966,7 @@ function readConfig49(raw) {
 }
 function readCoverageSummary(coveragePath) {
   try {
-    const raw = readFileSync14(coveragePath, "utf-8");
+    const raw = readFileSync13(coveragePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -21820,7 +21036,7 @@ var plugin56 = {
     state51.skippedCount = 0;
     state51.lastOverallPct = null;
     state51.lastResult = null;
-    state51.hookUnregister = releaseHandle(state51.hookUnregister);
+    state51.hookUnregister = (0, runtime_exports.releaseHandle)(state51.hookUnregister);
     const cfg = readConfig49(api.config.extensions?.["test-coverage-gate"]);
     const hook = (input) => {
       if (!cfg.enabled) return;
@@ -21828,7 +21044,7 @@ var plugin56 = {
       const inp = input.toolInput ?? {};
       const sourcePath = inp["path"];
       if (!sourcePath || typeof sourcePath !== "string") return;
-      if (!withinProject(sourcePath)) return;
+      if (!(0, runtime_exports.withinProject)(sourcePath)) return;
       const ext = sourcePath.includes(".") ? sourcePath.slice(sourcePath.lastIndexOf(".")).toLowerCase() : "";
       if (!runOnChangeSet.has(ext)) {
         state51.skippedCount += 1;
@@ -21965,10 +21181,10 @@ var plugin56 = {
 var test_coverage_gate_default = plugin56;
 
 // src/test-flake-detector/index.ts
-import { execFile as execFile14 } from "node:child_process";
-import { readFileSync as readFileSync15 } from "node:fs";
-import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname8, isAbsolute as isAbsolute27, relative as relative26, resolve as resolve27 } from "node:path";
+import { execFile as execFile13 } from "node:child_process";
+import { readFileSync as readFileSync14 } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
+import { dirname as dirname7, isAbsolute as isAbsolute25, relative as relative24, resolve as resolve25 } from "node:path";
 var API_VERSION38 = "^0.1.10";
 var state52 = {
   invocationCount: 0,
@@ -22037,17 +21253,17 @@ var ALLOWED_RUNNER_FLAGS = /* @__PURE__ */ new Set([
   "--reporter=verbose",
   "--reporter=default"
 ]);
-function withinProject7(p) {
+function withinProject26(p) {
   if (p.length === 0 || p.length > 4096 || p.startsWith("-")) return false;
-  const root = resolve27(process.cwd());
-  const resolved = isAbsolute27(p) ? resolve27(p) : resolve27(root, p);
-  const rel = relative26(root, resolved);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute27(rel);
+  const root = resolve25(process.cwd());
+  const resolved = isAbsolute25(p) ? resolve25(p) : resolve25(root, p);
+  const rel = relative24(root, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute25(rel);
 }
-function isInside3(parent, child) {
+function isInside2(parent, child) {
   if (parent === child) return true;
-  const rel = relative26(parent, child);
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute27(rel);
+  const rel = relative24(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute25(rel);
 }
 function tokenizeCommand(command) {
   const trimmed = command.trim();
@@ -22084,14 +21300,14 @@ function resolveTestCommand(baseCommand, testPattern) {
   if (runnerArgs.some((arg) => !ALLOWED_RUNNER_FLAGS.has(arg))) return null;
   let resolvedEntry;
   try {
-    const requireFromProject = createRequire3(resolve27(process.cwd(), "package.json"));
+    const requireFromProject = createRequire2(resolve25(process.cwd(), "package.json"));
     const packagePath = requireFromProject.resolve(`${runner}/package.json`);
-    const packageJson = JSON.parse(readFileSync15(packagePath, "utf8"));
+    const packageJson = JSON.parse(readFileSync14(packagePath, "utf8"));
     const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[runner] ?? Object.values(packageJson.bin ?? {})[0];
     if (!relativeBin) return null;
-    const packageDir = dirname8(packagePath);
-    const candidate = resolve27(packageDir, relativeBin);
-    if (isAbsolute27(relativeBin) || !isInside3(packageDir, candidate)) {
+    const packageDir = dirname7(packagePath);
+    const candidate = resolve25(packageDir, relativeBin);
+    if (isAbsolute25(relativeBin) || !isInside2(packageDir, candidate)) {
       return null;
     }
     resolvedEntry = candidate;
@@ -22100,7 +21316,7 @@ function resolveTestCommand(baseCommand, testPattern) {
   }
   const args = [resolvedEntry, ...runnerArgs];
   if (testPattern) {
-    if (!withinProject7(testPattern)) return null;
+    if (!withinProject26(testPattern)) return null;
     args.push(testPattern);
   }
   return {
@@ -22111,7 +21327,7 @@ function resolveTestCommand(baseCommand, testPattern) {
 }
 function runOnce(command, timeoutMs) {
   return new Promise((resolveRun) => {
-    execFile14(
+    execFile13(
       command.cmd,
       command.args,
       {
@@ -22333,8 +21549,8 @@ var plugin57 = {
 var test_flake_detector_default = plugin57;
 
 // src/test-generator/index.ts
-import { readFileSync as readFileSync16 } from "node:fs";
-import { isAbsolute as isAbsolute28, relative as relative27, resolve as resolve28 } from "node:path";
+import { readFileSync as readFileSync15 } from "node:fs";
+import { isAbsolute as isAbsolute26, relative as relative25, resolve as resolve26 } from "node:path";
 var API_VERSION39 = "^0.1.10";
 var state53 = {
   generateCount: 0,
@@ -22390,21 +21606,21 @@ var SOURCE_EXTENSIONS = [
   ".cpp",
   ".hpp"
 ];
-function withinProject8(p) {
+function withinProject27(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute28(p) ? resolve28(p) : resolve28(root, p);
-  const rel = relative27(root, resolved);
+  const resolved = isAbsolute26(p) ? resolve26(p) : resolve26(root, p);
+  const rel = relative25(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute28(rel)) return false;
+  if (isAbsolute26(rel)) return false;
   return true;
 }
 function toPosix8(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath8(p) {
-  return toPosix8(relative27(process.cwd(), p));
+  return toPosix8(relative25(process.cwd(), p));
 }
 function detectExports(content) {
   const exports = [];
@@ -22498,7 +21714,7 @@ function generateTestContent(sourcePath, sourceModule, detected, cfg) {
   return lines.join("\n");
 }
 function generateForFile(filePath, cfg) {
-  const sourceContent = readFileSync16(filePath, "utf-8");
+  const sourceContent = readFileSync15(filePath, "utf-8");
   const detected = detectExports(sourceContent);
   const sourceFile = relativePath8(filePath);
   const sourceParts = sourceFile.split("/");
@@ -22614,7 +21830,7 @@ var plugin58 = {
         if (!rawPath || typeof rawPath !== "string") {
           return { ok: false, error: "path is required" };
         }
-        if (!withinProject8(rawPath)) {
+        if (!withinProject27(rawPath)) {
           return { ok: false, error: "path is outside the project root" };
         }
         if (!SOURCE_EXTENSIONS.some((ext) => rawPath.toLowerCase().endsWith(ext))) {
@@ -22623,7 +21839,7 @@ var plugin58 = {
             error: `test generation only reads source files (${SOURCE_EXTENSIONS.join(", ")}); refusing "${rawPath}"`
           };
         }
-        const resolved = resolve28(process.cwd(), rawPath);
+        const resolved = resolve26(process.cwd(), rawPath);
         state53.generateCount += 1;
         let result;
         try {
@@ -22708,15 +21924,15 @@ var plugin58 = {
 var test_generator_default = plugin58;
 
 // src/test-runner-gate/index.ts
-import { execFile as execFile15 } from "node:child_process";
+import { execFile as execFile14 } from "node:child_process";
 import { access as access5 } from "node:fs/promises";
-import { basename as basename7, dirname as dirname9, isAbsolute as isAbsolute29, join as join8 } from "node:path";
-import { buildWin32CmdShimInvocation as buildWin32CmdShimInvocation2, resolveWin32Command as resolveWin32Command2 } from "@wrongstack/tools/win32";
+import { basename as basename6, dirname as dirname8, isAbsolute as isAbsolute27, join as join7 } from "node:path";
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
 function resolveExec(command, args) {
-  const resolved = resolveWin32Command2(command);
+  const resolved = resolveWin32Command(command);
   const needsShell = process.platform === "win32" && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
   if (needsShell) {
-    const shim = buildWin32CmdShimInvocation2(resolved, args);
+    const shim = buildWin32CmdShimInvocation(resolved, args);
     return { cmd: shim.command, args: shim.args, windowsVerbatimArguments: true };
   }
   return { cmd: resolved, args: [...args], windowsVerbatimArguments: false };
@@ -22785,7 +22001,7 @@ function pathContentHash(content) {
   }
   return h >>> 0;
 }
-var lastPassedHash = new BoundedMap({ max: 1024 });
+var lastPassedHash = new runtime_exports.BoundedMap({ max: 1024 });
 var ALLOWED_COMMAND_TOKENS = /* @__PURE__ */ new Set([
   "npx",
   "pnpm",
@@ -22801,9 +22017,9 @@ var ALLOWED_COMMAND_TOKENS = /* @__PURE__ */ new Set([
   // by basename in resolveAllowedCommand().
 ]);
 function resolveTestFiles(sourcePath, patterns) {
-  const name = basename7(sourcePath).replace(/\.[^.]+$/, "");
+  const name = basename6(sourcePath).replace(/\.[^.]+$/, "");
   const pathNoExt = sourcePath.replace(/\.[^.]+$/, "");
-  const dir = dirname9(sourcePath);
+  const dir = dirname8(sourcePath);
   const candidates = [];
   for (const pattern of patterns) {
     const candidate = pattern.replace(/\{name\}/g, name).replace(/\{path\}/g, pathNoExt).replace(/\{dir\}/g, dir);
@@ -22812,7 +22028,7 @@ function resolveTestFiles(sourcePath, patterns) {
         candidates.push(candidate);
       } else {
         candidates.push(candidate);
-        candidates.push(join8(dir, candidate));
+        candidates.push(join7(dir, candidate));
       }
     }
   }
@@ -22839,15 +22055,15 @@ async function detectRunner(requested) {
     const match = candidates.find((c) => c.name === requested);
     if (!match) return null;
     try {
-      await new Promise((resolve29, reject) => {
+      await new Promise((resolve27, reject) => {
         const ex = resolveExec("npx", [`${match.name}`, "--version"]);
-        execFile15(ex.cmd, ex.args, {
+        execFile14(ex.cmd, ex.args, {
           encoding: "utf-8",
           timeout: 5e3,
           cwd: process.cwd(),
           windowsHide: true,
           ...ex.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
-        }, (err) => err ? reject(err) : resolve29());
+        }, (err) => err ? reject(err) : resolve27());
       });
       return match;
     } catch {
@@ -22856,15 +22072,15 @@ async function detectRunner(requested) {
   }
   for (const candidate of candidates) {
     try {
-      await new Promise((resolve29, reject) => {
+      await new Promise((resolve27, reject) => {
         const ex = resolveExec("npx", [`${candidate.name}`, "--version"]);
-        execFile15(ex.cmd, ex.args, {
+        execFile14(ex.cmd, ex.args, {
           encoding: "utf-8",
           timeout: 5e3,
           cwd: process.cwd(),
           windowsHide: true,
           ...ex.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
-        }, (err) => err ? reject(err) : resolve29());
+        }, (err) => err ? reject(err) : resolve27());
       });
       return candidate;
     } catch {
@@ -22879,9 +22095,9 @@ function resolveAllowedCommand2(customCommand) {
   if (ALLOWED_COMMAND_TOKENS.has(head)) {
     return { cmd: head, args: tokens.slice(1) };
   }
-  if (isAbsolute29(head)) {
-    if (!withinProject(head)) return null;
-    const base = basename7(head);
+  if (isAbsolute27(head)) {
+    if (!(0, runtime_exports.withinProject)(head)) return null;
+    const base = basename6(head);
     if (ALLOWED_COMMAND_TOKENS.has(base)) {
       return { cmd: head, args: tokens.slice(1) };
     }
@@ -22889,7 +22105,7 @@ function resolveAllowedCommand2(customCommand) {
   return null;
 }
 async function runTests(testFile, runner, customCommand, timeoutMs) {
-  if (!withinProject(testFile)) return null;
+  if (!(0, runtime_exports.withinProject)(testFile)) return null;
   let cmd;
   let cmdArgs;
   let trailingFlag;
@@ -22910,9 +22126,9 @@ async function runTests(testFile, runner, customCommand, timeoutMs) {
   let stdout = "";
   try {
     const { stdout: out } = await new Promise(
-      (resolve29, reject) => {
+      (resolve27, reject) => {
         const ex = resolveExec(cmd, fullArgs);
-        execFile15(
+        execFile14(
           ex.cmd,
           ex.args,
           {
@@ -22924,7 +22140,7 @@ async function runTests(testFile, runner, customCommand, timeoutMs) {
           },
           (err, out2, stderr) => {
             if (err) reject(Object.assign(err, { stdout: out2, stderr }));
-            else resolve29({ stdout: out2, stderr });
+            else resolve27({ stdout: out2, stderr });
           }
         );
       }
@@ -23041,7 +22257,7 @@ var plugin59 = {
     state54.errorCount = 0;
     state54.extensionSkippedCount = 0;
     state54.cachedSkipCount = 0;
-    state54.hookUnregister = releaseHandle(state54.hookUnregister);
+    state54.hookUnregister = (0, runtime_exports.releaseHandle)(state54.hookUnregister);
     state54.lastResult = null;
     lastPassedHash.clear();
     const cfg = readConfig52(api.config.extensions?.["test-runner-gate"]);
@@ -23062,7 +22278,7 @@ var plugin59 = {
       const inp = input.toolInput ?? {};
       const sourcePath = inp["path"];
       if (!sourcePath || typeof sourcePath !== "string") return;
-      if (!withinProject(sourcePath)) return;
+      if (!(0, runtime_exports.withinProject)(sourcePath)) return;
       if (sourcePath.includes(".test.") || sourcePath.includes(".spec.")) return;
       if (cfg.enableExtensionFilter) {
         const ext = sourcePath.includes(".") ? sourcePath.slice(sourcePath.lastIndexOf(".")).toLowerCase() : "";
@@ -23292,7 +22508,7 @@ var plugin60 = {
     state55.lastMessageId = null;
     state55.lastPayloadHash = "";
     state55.lastBroadcastAt = 0;
-    state55.hookUnregister = releaseHandle(state55.hookUnregister);
+    state55.hookUnregister = (0, runtime_exports.releaseHandle)(state55.hookUnregister);
     const cfg = readConfig53(api.config.extensions?.["todo-listener"]);
     const mailbox = api.mailbox;
     const hook = async (input) => {
@@ -23333,7 +22549,7 @@ var plugin60 = {
         0,
         200
       );
-      const body = safeJsonStringify(payload, 2);
+      const body = (0, runtime_exports.safeJsonStringify)(payload, 2);
       const sendInput = {
         from: `plugin:todo-listener`,
         to: "*",
@@ -24201,15 +23417,15 @@ function estimateRequestTokens(request, charsPerToken) {
 }
 function sleep(ms, signal) {
   if (signal?.aborted) return Promise.resolve();
-  return new Promise((resolve29) => {
+  return new Promise((resolve27) => {
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve29();
+      resolve27();
     }, ms);
     timer.unref?.();
     function onAbort() {
       clearTimeout(timer);
-      resolve29();
+      resolve27();
     }
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -24417,7 +23633,7 @@ var TSC_RUNTIME = {
   defaultCommand: "pnpm exec tsc --noEmit"
 };
 function validateTsConfigPath(p) {
-  const sanitized = sanitizeRunnerPath(p);
+  const sanitized = (0, runtime_exports.sanitizeRunnerPath)(p);
   return sanitized;
 }
 async function runTypeCheck(cfg) {
@@ -24430,12 +23646,12 @@ async function runTypeCheck(cfg) {
   const tsConfig = validTsConfig ?? (rawTsConfig || "tsconfig.json");
   let argv;
   if (cfg.command) {
-    const resolved = resolveRunnerCommand(TSC_RUNTIME, cfg.command);
+    const resolved = (0, runtime_exports.resolveRunnerCommand)(TSC_RUNTIME, cfg.command);
     if (!resolved) return null;
     argv = [resolved.cmd, ...resolved.args];
   } else {
     const tscFlags = ["--noEmit", "--incremental"];
-    const localTsc = resolveNodeBin("typescript", "tsc", process.cwd(), tscFlags);
+    const localTsc = (0, runtime_exports.resolveNodeBin)("typescript", "tsc", process.cwd(), tscFlags);
     argv = localTsc ? [localTsc.cmd, ...localTsc.args] : ["npx", "tsc", ...tscFlags];
     if (tsConfig && tsConfig !== "tsconfig.json") {
       argv = [...argv, "-p", tsConfig];
@@ -24444,7 +23660,7 @@ async function runTypeCheck(cfg) {
   if (!cfg.command && tsConfig && !existsSync6(tsConfig)) {
     return null;
   }
-  const result = await runRunnerCommand([argv[0], ...argv.slice(1)], {
+  const result = await (0, runtime_exports.runRunnerCommand)([argv[0], ...argv.slice(1)], {
     cwd: process.cwd(),
     timeoutMs: cfg.timeoutMs
   });
@@ -24532,7 +23748,7 @@ var plugin64 = {
     state59.errorCount = 0;
     state59.skippedCount = 0;
     state59.lastResult = null;
-    state59.hookUnregister = releaseHandle(state59.hookUnregister);
+    state59.hookUnregister = (0, runtime_exports.releaseHandle)(state59.hookUnregister);
     const cfg = readConfig56(api.config.extensions?.["type-gate"]);
     const hook = async (input) => {
       if (!cfg.enabled) return;
@@ -24540,7 +23756,7 @@ var plugin64 = {
       const inp = input.toolInput ?? {};
       const sourcePath = inp["path"];
       if (!sourcePath || typeof sourcePath !== "string") return;
-      if (!withinProject(sourcePath)) return;
+      if (!(0, runtime_exports.withinProject)(sourcePath)) return;
       const ext = sourcePath.includes(".") ? sourcePath.slice(sourcePath.lastIndexOf(".")).toLowerCase() : "";
       if (!runOnChangeSet2.has(ext)) {
         state59.skippedCount += 1;