@wrongstack/plugins 1.0.8 → 1.0.11

package/dist/index.js

@@ -13,8 +13,9 @@ var __copyProps = (to, from, except, desc) => {
 var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 
 // src/accessibility-auditor/index.ts
-import { readFile } from "node:fs/promises";
+import { readFile, stat } from "node:fs/promises";
 import { isAbsolute, relative, resolve } from "node:path";
+import { ToolValidationError } from "@wrongstack/core/types";
 
 // src/runtime/index.ts
 var runtime_exports = {};
@@ -53,6 +54,13 @@ function readConfig(raw) {
     onWriteEdit: (r["onWriteEdit"] ?? r["on_write_edit"] ?? r["onSave"]) !== false
   };
 }
+async function assertPathExists(rawPath) {
+  try {
+    await stat(resolve(process.cwd(), rawPath));
+  } catch (err) {
+    throw new Error(`path not found: ${rawPath}`, { cause: err });
+  }
+}
 function normalizeExtensions(exts) {
   return exts.map((e) => e.startsWith(".") ? e.toLowerCase() : `.${e.toLowerCase()}`);
 }
@@ -381,12 +389,16 @@ var plugin = {
       category: "Diagnostics",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "accessibility-auditor is disabled" };
+        if (!cfg.enabled) throw new Error("accessibility-auditor is disabled");
         const raw = input;
         const rawPath = (typeof input.path === "string" && input.path.trim().length > 0 ? input.path.trim() : void 0) ?? (typeof raw["directory"] === "string" ? raw["directory"] : void 0) ?? (typeof raw["dir"] === "string" ? raw["dir"] : void 0) ?? (typeof raw["SearchDirectory"] === "string" ? raw["SearchDirectory"] : void 0) ?? (typeof raw["TargetFile"] === "string" ? raw["TargetFile"] : void 0) ?? (typeof raw["filePath"] === "string" ? raw["filePath"] : void 0) ?? (typeof raw["file_path"] === "string" ? raw["file_path"] : void 0) ?? (typeof raw["targetFile"] === "string" ? raw["targetFile"] : void 0) ?? (typeof raw["file"] === "string" ? raw["file"] : void 0) ?? ".";
         if (!(0, runtime_exports.withinProject)(rawPath)) {
-          return { ok: false, error: "path must be inside the project" };
+          throw new ToolValidationError({
+            message: "path must be inside the project",
+            field: "path"
+          });
         }
+        await assertPathExists(rawPath);
         state.auditCount += 1;
         const result = await auditPath(rawPath, cfg);
         state.fileCount += result.fileCount;
@@ -701,8 +713,8 @@ var plugin2 = {
       category: "Coordination",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "agent-handoff is disabled" };
-        if (!mailbox) return { ok: false, error: "mailbox not available" };
+        if (!cfg.enabled) throw new Error("agent-handoff is disabled");
+        if (!mailbox) throw new Error("mailbox not available");
         const raw = input;
         const summary = (typeof raw["summary"] === "string" ? raw["summary"] : void 0) ?? (typeof raw["note"] === "string" ? raw["note"] : void 0) ?? (typeof raw["message"] === "string" ? raw["message"] : void 0) ?? (typeof raw["content"] === "string" ? raw["content"] : void 0) ?? (typeof raw["text"] === "string" ? raw["text"] : void 0) ?? (typeof raw["body"] === "string" ? raw["body"] : void 0);
         const task = (typeof raw["task"] === "string" ? raw["task"] : void 0) ?? (typeof raw["title"] === "string" ? raw["title"] : void 0) ?? (typeof raw["subject"] === "string" ? raw["subject"] : void 0);
@@ -729,10 +741,10 @@ var plugin2 = {
           return { ok: true, messageId: result.id, to: recipient };
         } catch (err) {
           state2.errorCount += 1;
-          return {
-            ok: false,
-            error: err instanceof Error ? err.message : String(err)
-          };
+          throw new Error(
+            `handoff_note: mailbox send to "${recipient}" failed: ${err instanceof Error ? err.message : String(err)}`,
+            { cause: err }
+          );
         }
       }
     });
@@ -1171,6 +1183,7 @@ var api_compatibility_gate_default = plugin3;
 
 // src/auto-doc/index.ts
 import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3 } from "node:path";
+import { ToolValidationError as ToolValidationError2 } from "@wrongstack/core/types";
 var AUTO_DOC_API_VERSION = "^0.1.10";
 function resolveProjectPath(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
@@ -1334,41 +1347,37 @@ function injectDocComment(content, entity, doc) {
 async function runAutoDoc(input, api) {
   const rawInput = input;
   if (rawInput["files"] !== void 0 && !Array.isArray(rawInput["files"])) {
-    return {
-      ok: false,
-      error: "input.files must be an array of file paths",
-      filesProcessed: 0,
-      changes: []
-    };
+    throw new ToolValidationError2({
+      message: "input.files must be an array of file paths",
+      field: "files"
+    });
   }
   const rawFiles = rawInput["files"] ?? rawInput["file"] ?? rawInput["path"] ?? rawInput["filePath"] ?? rawInput["TargetFile"] ?? rawInput["targetFile"];
   const files = Array.isArray(rawFiles) ? rawFiles.filter((f) => typeof f === "string" && f.trim().length > 0).map((f) => f.trim()) : typeof rawFiles === "string" && rawFiles.trim().length > 0 ? [rawFiles.trim()] : void 0;
   if (!files || !Array.isArray(files)) {
-    return {
-      ok: false,
-      error: "input.files must be an array of file paths",
-      filesProcessed: 0,
-      changes: []
-    };
+    throw new ToolValidationError2({
+      message: "input.files must be an array of file paths",
+      field: "files"
+    });
   }
   if (files.length === 0) {
-    return {
-      ok: false,
-      error: "input.files is empty \u2014 provide at least one file path",
-      filesProcessed: 0,
-      changes: []
-    };
+    throw new ToolValidationError2({
+      message: "input.files is empty \u2014 provide at least one file path",
+      field: "files"
+    });
   }
   const extConfig = api.config.extensions?.["auto-doc"] ?? {};
   const includeTypes = extConfig["includeTypes"] ?? false;
   const useLlm = (input.use_llm ?? rawInput["useLlm"] ?? extConfig["useLlm"] ?? false) === true && Boolean(api.llm);
   const maxLlmEntities = typeof extConfig["maxLlmEntities"] === "number" && extConfig["maxLlmEntities"] >= 0 ? extConfig["maxLlmEntities"] : 25;
   const results = [];
+  const skipped = [];
   let llmBudget = maxLlmEntities;
   for (const rawFile of files) {
     const safeFile = resolveProjectPath(rawFile);
     if (!safeFile) {
       api.log.warn(`auto-doc: skipped file outside project directory: ${rawFile}`);
+      skipped.push({ file: rawFile, reason: "outside project directory" });
       continue;
     }
     try {
@@ -1376,8 +1385,12 @@ async function runAutoDoc(input, api) {
       let content;
       try {
         content = readFileSync17(safeFile, "utf-8");
-      } catch {
+      } catch (err) {
         api.log.warn(`auto-doc: could not read file ${safeFile}`);
+        skipped.push({
+          file: safeFile,
+          reason: `could not read: ${err instanceof Error ? err.message : String(err)}`
+        });
         continue;
       }
       const entities = parseSource(content);
@@ -1417,11 +1430,21 @@ async function runAutoDoc(input, api) {
       }
     } catch (err) {
       api.log.error(`auto-doc: error processing ${safeFile}: ${err}`);
+      skipped.push({
+        file: safeFile,
+        reason: err instanceof Error ? err.message : String(err)
+      });
     }
   }
+  if (skipped.length === files.length) {
+    throw new Error(
+      `auto_doc processed no files: ${skipped.map((s) => `${s.file} (${s.reason})`).join("; ")}`
+    );
+  }
   return {
     ok: true,
-    filesProcessed: files.length,
+    filesProcessed: files.length - skipped.length,
+    ...skipped.length > 0 ? { skipped } : {},
     changes: results,
     llm: useLlm ? { docs: state4.llmDocs, fallbacks: state4.llmFallbacks } : void 0
   };
@@ -1738,6 +1761,7 @@ var auto_escalate_default = plugin5;
 
 // src/auto-i18n-extractor/index.ts
 import { readFileSync as readFileSync2 } from "node:fs";
+import { ToolValidationError as ToolValidationError3 } from "@wrongstack/core/types";
 var API_VERSION4 = "^0.1.10";
 var state6 = {
   filesScanned: 0,
@@ -1961,28 +1985,31 @@ ${lines.join("\n")}${more}`;
       category: "Diagnostics",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "auto-i18n-extractor is disabled" };
+        if (!cfg.enabled) throw new Error("auto-i18n-extractor is disabled");
         const raw = input;
         const rawPath = (typeof input.path === "string" && input.path.trim().length > 0 ? input.path.trim() : void 0) ?? (typeof raw["TargetFile"] === "string" && raw["TargetFile"].trim().length > 0 ? raw["TargetFile"].trim() : void 0) ?? (typeof raw["targetFile"] === "string" && raw["targetFile"].trim().length > 0 ? raw["targetFile"].trim() : void 0) ?? (typeof raw["filePath"] === "string" && raw["filePath"].trim().length > 0 ? raw["filePath"].trim() : void 0) ?? (typeof raw["file_path"] === "string" && raw["file_path"].trim().length > 0 ? raw["file_path"].trim() : void 0) ?? (typeof raw["file"] === "string" && raw["file"].trim().length > 0 ? raw["file"].trim() : void 0);
         const filePath = typeof rawPath === "string" ? rawPath.trim() : "";
         if (!filePath) {
-          return { ok: false, error: "path is required" };
+          throw new ToolValidationError3({ message: "path is required", field: "path" });
         }
         if (!(0, runtime_exports.withinProject)(filePath)) {
-          return { ok: false, error: "path must be inside the project" };
+          throw new ToolValidationError3({
+            message: "path must be inside the project",
+            field: "path"
+          });
         }
         const ext = fileExtension(filePath);
         if (!cfg.fileExtensions.includes(ext)) {
-          return {
-            ok: false,
-            error: `unsupported extension "${ext}"; allowed: ${cfg.fileExtensions.join(", ")}`
-          };
+          throw new ToolValidationError3({
+            message: `unsupported extension "${ext}"; allowed: ${cfg.fileExtensions.join(", ")}`,
+            field: "path"
+          });
         }
         state6.filesScanned += 1;
         const content = readSourceFile(filePath);
         if (content === null) {
           state6.readErrors += 1;
-          return { ok: false, error: `could not read ${filePath}` };
+          throw new Error(`could not read ${filePath}`);
         }
         const extracted = extractStrings(content, cfg);
         state6.stringsFound += extracted.length;
@@ -2169,13 +2196,13 @@ async function detectUncommittedChanges(cwd, signal) {
 }
 function detectGitCommand(command) {
   const cmd = command.trim();
-  if (/\bgit\s+commit\b/.test(cmd)) {
+  if (/\bgit\s+commit(?![a-zA-Z0-9_-])/.test(cmd)) {
     return { type: "commit", snippet: cmd.slice(0, 120) };
   }
-  if (/\bgit\s+push\b/.test(cmd)) {
+  if (/\bgit\s+push(?![a-zA-Z0-9_-])/.test(cmd)) {
     return { type: "push", snippet: cmd.slice(0, 120) };
   }
-  if (/\bgit\s+merge\s/.test(cmd)) {
+  if (/\bgit\s+merge(?![a-zA-Z0-9_-])/.test(cmd)) {
     return { type: "merge", snippet: cmd.slice(0, 120) };
   }
   return null;
@@ -2389,6 +2416,7 @@ var branch_guard_default = plugin7;
 // src/changelog-writer/index.ts
 import { readFileSync as readFileSync3, writeFileSync } from "node:fs";
 import { isAbsolute as isAbsolute4, relative as relative4, resolve as resolve4 } from "node:path";
+import { ToolValidationError as ToolValidationError4 } from "@wrongstack/core/types";
 var state8 = {
   entries: [],
   filesTouched: new runtime_exports.BoundedSet({ max: 2e3 }),
@@ -2685,11 +2713,13 @@ var plugin8 = {
       category: "Docs",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "changelog-writer is disabled" };
+        if (!cfg.enabled) throw new Error("changelog-writer is disabled");
         const raw = input ?? {};
         const rawText = input.text ?? raw["message"] ?? raw["entry"] ?? raw["content"] ?? raw["description"] ?? raw["desc"] ?? raw["summary"] ?? raw["body"] ?? raw["note"] ?? raw["item"];
         const text = String(rawText ?? "").trim();
-        if (!text) return { ok: false, error: "entry text must not be empty" };
+        if (!text) {
+          throw new ToolValidationError4({ message: "entry text must not be empty", field: "text" });
+        }
         const section = SECTION_ORDER.includes(input.section) ? input.section : "Changed";
         addEntry({ section, text, origin: "manual", when: (/* @__PURE__ */ new Date()).toISOString() });
         return { ok: true, pendingEntries: state8.entries.length };
@@ -2744,12 +2774,12 @@ var plugin8 = {
       category: "Docs",
       mutating: true,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "changelog-writer is disabled" };
+        if (!cfg.enabled) throw new Error("changelog-writer is disabled");
         if (!cfg.filePath) {
-          return { ok: false, error: "filePath must stay within the current project directory" };
+          throw new Error("filePath must stay within the current project directory");
         }
         if (state8.entries.length === 0) {
-          return { ok: false, error: "no pending entries \u2014 add some with changelog_add first" };
+          throw new Error("no pending entries \u2014 add some with changelog_add first");
         }
         const rawInput = input ?? {};
         const shouldPolish = input.polish === true || rawInput["use_llm"] === true || rawInput["useLlm"] === true || rawInput["ai"] === true || rawInput["use_ai"] === true;
@@ -2757,16 +2787,22 @@ var plugin8 = {
         let existing = null;
         try {
           existing = readFileSync3(cfg.filePath, "utf-8");
-        } catch {
+        } catch (err) {
+          if (err.code !== "ENOENT") {
+            throw new Error(
+              `failed to read ${cfg.filePath}: ${err instanceof Error ? err.message : String(err)}`,
+              { cause: err }
+            );
+          }
           existing = null;
         }
         try {
           writeFileSync(cfg.filePath, mergeIntoChangelog(existing, block));
         } catch (err) {
-          return {
-            ok: false,
-            error: `failed to write ${cfg.filePath}: ${err instanceof Error ? err.message : String(err)}`
-          };
+          throw new Error(
+            `failed to write ${cfg.filePath}: ${err instanceof Error ? err.message : String(err)}`,
+            { cause: err }
+          );
         }
         const written = state8.entries.length;
         state8.entries = [];
@@ -2823,8 +2859,9 @@ var plugin8 = {
 var changelog_writer_default = plugin8;
 
 // src/checkpoint/index.ts
-import { mkdir, readFile as readFile3, realpath, stat, writeFile } from "node:fs/promises";
+import { mkdir, readFile as readFile3, realpath, stat as stat2, writeFile } from "node:fs/promises";
 import { dirname as dirname2, isAbsolute as isAbsolute5, relative as relative5, resolve as resolve5 } from "node:path";
+import { ToolValidationError as ToolValidationError5 } from "@wrongstack/core/types";
 var state9 = {
   snapshots: [],
   nextId: 1,
@@ -2887,7 +2924,7 @@ async function realResolutionEscapes(absPath, root) {
 }
 async function pathExists(p) {
   try {
-    await stat(p);
+    await stat2(p);
     return true;
   } catch {
     return false;
@@ -2903,18 +2940,24 @@ function hashContent(s) {
 }
 async function captureFile(path, maxBytes) {
   try {
-    const st = await stat(path);
+    const st = await stat2(path);
     if (st.size > maxBytes) return "too-large";
     const content = await readFile3(path, "utf-8");
     return { path, content, bytes: st.size };
-  } catch {
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      throw new Error(
+        `could not snapshot ${path}: ${err instanceof Error ? err.message : String(err)}`,
+        { cause: err }
+      );
+    }
     return { path, content: null, bytes: 0 };
   }
 }
 async function captureFileForHook(path, maxBytes, signal) {
   try {
     signal.throwIfAborted();
-    const st = await stat(path);
+    const st = await stat2(path);
     if (st.size > maxBytes) return "too-large";
     const content = await readFile3(path, "utf-8");
     signal.throwIfAborted();
@@ -3049,7 +3092,7 @@ var plugin9 = {
       category: "Safety",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "checkpoint is disabled" };
+        if (!cfg.enabled) throw new Error("checkpoint is disabled");
         let paths = [];
         const rawInput = input;
         const raw = rawInput["paths"] ?? rawInput["path"] ?? rawInput["files"] ?? rawInput["file"] ?? rawInput["filePath"] ?? rawInput["file_path"] ?? rawInput["TargetFile"] ?? rawInput["targetFile"];
@@ -3058,16 +3101,25 @@ var plugin9 = {
         } else if (Array.isArray(raw)) {
           paths = raw.filter((p) => typeof p === "string" && p.trim().length > 0);
         }
-        if (paths.length === 0) return { ok: false, error: "paths must not be empty" };
-        const files = [];
+        if (paths.length === 0) {
+          throw new ToolValidationError5({ message: "paths must not be empty", field: "paths" });
+        }
         const rejectedOutsideProject = [];
-        let skipped = 0;
+        const safePaths = [];
         for (const p of paths) {
           const safePath = await resolveProjectPath3(p);
-          if (!safePath) {
-            rejectedOutsideProject.push(p);
-            continue;
-          }
+          if (safePath) safePaths.push(safePath);
+          else rejectedOutsideProject.push(p);
+        }
+        if (rejectedOutsideProject.length > 0) {
+          throw new ToolValidationError5({
+            message: `paths must stay within the current project directory: ${rejectedOutsideProject.join(", ")}`,
+            field: "paths"
+          });
+        }
+        const files = [];
+        let skipped = 0;
+        for (const safePath of safePaths) {
           const captured = await captureFile(safePath, cfg.maxFileBytes);
           if (captured === "too-large") {
             skipped += 1;
@@ -3076,15 +3128,10 @@ var plugin9 = {
           }
           files.push(captured);
         }
-        if (rejectedOutsideProject.length > 0) {
-          return {
-            ok: false,
-            error: "paths must stay within the current project directory",
-            rejectedOutsideProject
-          };
-        }
         if (files.length === 0) {
-          return { ok: false, error: "all files were skipped (too large)" };
+          throw new Error(
+            `all files were skipped (larger than maxFileBytes=${cfg.maxFileBytes}); nothing was snapshotted`
+          );
         }
         const snapshot = {
           id: `cp-${state9.nextId++}`,
@@ -3159,21 +3206,18 @@ var plugin9 = {
       category: "Safety",
       mutating: true,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "checkpoint is disabled" };
+        if (!cfg.enabled) throw new Error("checkpoint is disabled");
         const raw = input ?? {};
         const rawId = (typeof input.id === "string" && input.id.trim().length > 0 ? input.id.trim() : void 0) ?? (typeof raw["snapshotId"] === "string" ? raw["snapshotId"] : void 0) ?? (typeof raw["snapshot_id"] === "string" ? raw["snapshot_id"] : void 0);
         const rawPath = (typeof input.path === "string" && input.path.trim().length > 0 ? input.path.trim() : void 0) ?? (typeof raw["filePath"] === "string" ? raw["filePath"] : void 0) ?? (typeof raw["file_path"] === "string" ? raw["file_path"] : void 0) ?? (typeof raw["TargetFile"] === "string" ? raw["TargetFile"] : void 0) ?? (typeof raw["targetFile"] === "string" ? raw["targetFile"] : void 0) ?? (typeof raw["file"] === "string" ? raw["file"] : void 0);
         const snapshot = rawId ? state9.snapshots.find((s) => s.id === rawId) : state9.snapshots[state9.snapshots.length - 1];
         if (!snapshot) {
-          return {
-            ok: false,
-            error: rawId ? `no snapshot with id "${rawId}"` : "no snapshots captured yet"
-          };
+          throw new Error(rawId ? `no snapshot with id "${rawId}"` : "no snapshots captured yet");
         }
         const targetPath = rawPath ? await resolveProjectPath3(rawPath) ?? rawPath : null;
         const targets = targetPath ? snapshot.files.filter((f) => f.path === targetPath || f.path === rawPath) : snapshot.files;
         if (targets.length === 0) {
-          return { ok: false, error: `snapshot ${snapshot.id} has no entry for "${rawPath}"` };
+          throw new Error(`snapshot ${snapshot.id} has no entry for "${rawPath}"`);
         }
         const restored = [];
         const createdByTool = [];
@@ -3195,8 +3239,14 @@ var plugin9 = {
           state9.restores += 1;
           api.metrics.counter("restores");
         }
+        if (errors.length > 0) {
+          const failed = errors.map((e) => `${e.path} (${e.error})`).join("; ");
+          throw new Error(
+            `checkpoint_restore ${snapshot.id}: ${errors.length} file(s) failed to restore: ${failed}` + (restored.length > 0 ? `. Restored: ${restored.join(", ")}` : "")
+          );
+        }
         return {
-          ok: errors.length === 0,
+          ok: true,
           snapshotId: snapshot.id,
           restored,
           notRestoredFileDidNotExist: createdByTool,
@@ -3255,8 +3305,9 @@ var plugin9 = {
 var checkpoint_default = plugin9;
 
 // src/code-metrics/index.ts
-import { readFile as readFile4 } from "node:fs/promises";
+import { readFile as readFile4, stat as stat3 } from "node:fs/promises";
 import { isAbsolute as isAbsolute6, relative as relative6, resolve as resolve6 } from "node:path";
+import { ToolValidationError as ToolValidationError6 } from "@wrongstack/core/types";
 var API_VERSION6 = "^0.1.10";
 var state10 = {
   measureCount: 0,
@@ -3492,19 +3543,26 @@ var plugin10 = {
       category: "Diagnostics",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "code-metrics is disabled" };
+        if (!cfg.enabled) throw new Error("code-metrics is disabled");
         const raw = input ?? {};
         const rawPath = (typeof input.path === "string" && input.path.trim().length > 0 ? input.path.trim() : void 0) ?? (typeof raw["directory"] === "string" ? raw["directory"] : void 0) ?? (typeof raw["dir"] === "string" ? raw["dir"] : void 0) ?? (typeof raw["SearchDirectory"] === "string" ? raw["SearchDirectory"] : void 0) ?? (typeof raw["filePath"] === "string" ? raw["filePath"] : void 0) ?? (typeof raw["TargetFile"] === "string" ? raw["TargetFile"] : void 0) ?? (typeof raw["targetFile"] === "string" ? raw["targetFile"] : void 0) ?? (typeof raw["file_path"] === "string" ? raw["file_path"] : void 0) ?? (typeof raw["file"] === "string" ? raw["file"] : void 0) ?? ".";
         if (!(0, runtime_exports.withinProject)(rawPath)) {
-          return { ok: false, error: "path is outside the project root" };
+          throw new ToolValidationError6({
+            message: "path is outside the project root",
+            field: "path"
+          });
         }
         state10.measureCount += 1;
         let result;
         try {
+          await stat3(resolve6(process.cwd(), rawPath));
           result = await measurePath(rawPath, cfg);
         } catch (err) {
           state10.errorCount += 1;
-          return { ok: false, error: String(err) };
+          throw new Error(
+            `measure_code_metrics failed for ${rawPath}: ${err instanceof Error ? err.message : String(err)}`,
+            { cause: err }
+          );
         }
         state10.fileCount += result.files.length;
         return {
@@ -3707,11 +3765,11 @@ function parseCommitMessage(message, cfg) {
 }
 var GIT_MESSAGE_FLAG_RE = new RegExp(
   [
-    // -m "…" | -m '…' | -m=… ; --message "…" | --message='…' | --message=…
-    String.raw`(?:^|\s)(?:-m|--message)(?:\s+|=)"([^"]*)"`,
-    String.raw`(?:^|\s)(?:-m|--message)(?:\s+|=)'([^']*)'`,
+    // -m "…" | -am "…" | -m '…' | -m=… ; --message "…" | --message='…' | --message=…
+    String.raw`(?:^|\s)(?:-[a-zA-Z]*m|--message)(?:\s+|=)"([^"]*)"`,
+    String.raw`(?:^|\s)(?:-[a-zA-Z]*m|--message)(?:\s+|=)'([^']*)'`,
     // Bare value: stops at whitespace or a shell separator.
-    String.raw`(?:^|\s)(?:-m|--message)(?:\s+|=)([^\s;&|"']+)`
+    String.raw`(?:^|\s)(?:-[a-zA-Z]*m|--message)(?:\s+|=)([^\s;&|"']+)`
   ].join("|"),
   "g"
 );
@@ -3821,7 +3879,7 @@ var plugin11 = {
       } else if (toolName === "bash") {
         const command = inp["command"] ?? inp["CommandLine"] ?? inp["cmd"] ?? inp["script"] ?? inp["input"];
         if (typeof command !== "string") return;
-        if (!/\bgit\s+commit\b/.test(command)) return;
+        if (!/\bgit\s+commit(?![a-zA-Z0-9_-])/.test(command)) return;
         message = extractMessageFromBash(command);
         if (!message) return;
       } else {
@@ -4357,6 +4415,7 @@ var config_validator_default = plugin12;
 // src/context-pins/index.ts
 import * as fs from "node:fs";
 import { dirname as dirname3, isAbsolute as isAbsolute7, relative as relative7, resolve as resolve7 } from "node:path";
+import { ToolValidationError as ToolValidationError7 } from "@wrongstack/core/types";
 import { atomicWrite, ensureDir } from "@wrongstack/core/utils";
 var state13 = {
   pins: [],
@@ -4497,16 +4556,17 @@ var plugin13 = {
       category: "Memory",
       mutating: true,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "context-pins is disabled" };
+        if (!cfg.enabled) throw new Error("context-pins is disabled");
         const raw = input ?? {};
         const rawText = input.text ?? raw["pin"] ?? raw["content"] ?? raw["message"] ?? raw["note"] ?? raw["fact"] ?? raw["data"];
         const text = String(rawText ?? "").trim();
-        if (!text) return { ok: false, error: "pin text must not be empty" };
+        if (!text) {
+          throw new ToolValidationError7({ message: "pin text must not be empty", field: "text" });
+        }
         if (state13.pins.length >= cfg.maxPins) {
-          return {
-            ok: false,
-            error: `pin limit reached (${cfg.maxPins}). Remove a pin first with pin_remove.`
-          };
+          throw new Error(
+            `pin limit reached (${cfg.maxPins}). Remove a pin first with pin_remove.`
+          );
         }
         const pin = {
           id: `pin-${state13.nextId++}`,
@@ -4535,16 +4595,17 @@ var plugin13 = {
       category: "Memory",
       mutating: true,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "context-pins is disabled" };
+        if (!cfg.enabled) throw new Error("context-pins is disabled");
         const raw = input ?? {};
         const key = String(
           input.id ?? input.label ?? raw["pinId"] ?? raw["pin_id"] ?? raw["name"] ?? raw["key"] ?? ""
         ).trim();
-        if (!key) return { ok: false, error: "id or label is required" };
+        if (!key)
+          throw new ToolValidationError7({ message: "id or label is required", field: "id" });
         const before = state13.pins.length;
         state13.pins = state13.pins.filter((p) => p.id !== key && p.label !== key);
         const removed = before - state13.pins.length;
-        if (removed === 0) return { ok: false, error: `no pin matches "${key}"` };
+        if (removed === 0) throw new Error(`no pin matches "${key}"`);
         state13.removals += removed;
         api.metrics.counter("removals", removed);
         const persisted = await persistPins(cfg.filePath);
@@ -4662,6 +4723,9 @@ function estimateCost(model, freshTokens, completionTokens, cachedTokens = 0) {
   const outputCost = completionTokens / 1e6 * pricing.output;
   return inputCost + outputCost;
 }
+function toFiniteNumber(value) {
+  return Number.isFinite(value) ? value : 0;
+}
 var plugin14 = {
   name: "cost-tracker",
   version: "0.1.0",
@@ -4735,11 +4799,12 @@ var plugin14 = {
         const input = v["input"];
         const output = v["output"];
         if (typeof input !== "number" || typeof output !== "number") continue;
+        if (!Number.isFinite(input) || !Number.isFinite(output)) continue;
         const cacheRead = v["cacheRead"];
         pricingOverrides[model.toLowerCase()] = {
           input,
           output,
-          ...typeof cacheRead === "number" ? { cacheRead } : {}
+          ...typeof cacheRead === "number" && Number.isFinite(cacheRead) ? { cacheRead } : {}
         };
       }
     }
@@ -4752,11 +4817,11 @@ var plugin14 = {
           if (!providerModels) continue;
           for (const [modelId, model] of Object.entries(providerModels)) {
             const cost = model?.cost;
-            if (cost && typeof cost.input === "number" && typeof cost.output === "number") {
+            if (cost && typeof cost.input === "number" && typeof cost.output === "number" && Number.isFinite(cost.input) && Number.isFinite(cost.output)) {
               bundledFromRegistry[modelId.toLowerCase()] = {
                 input: cost.input,
                 output: cost.output,
-                ...typeof cost.cache_read === "number" ? { cacheRead: cost.cache_read } : {}
+                ...typeof cost.cache_read === "number" && Number.isFinite(cost.cache_read) ? { cacheRead: cost.cache_read } : {}
               };
               hydrated += 1;
             }
@@ -4784,14 +4849,22 @@ var plugin14 = {
       const usage = payload.usage;
       const model = payload.ctx?.model ?? "unknown";
       const u = usage ?? {};
-      const cachedTokens = Number(u["cacheRead"] ?? u["cache_read_input_tokens"] ?? u["cached_prompt_tokens"] ?? 0) || 0;
-      const rawInput = Number(u["input"] ?? u["prompt_tokens"] ?? u["inputTokens"] ?? u["promptTokens"] ?? 0) || 0;
-      const rawCacheWrite = Number(u["cacheWrite"] ?? u["cache_creation_input_tokens"] ?? 0) || 0;
+      const cachedTokens = toFiniteNumber(
+        Number(u["cacheRead"] ?? u["cache_read_input_tokens"] ?? u["cached_prompt_tokens"] ?? 0)
+      );
+      const rawInput = toFiniteNumber(
+        Number(u["input"] ?? u["prompt_tokens"] ?? u["inputTokens"] ?? u["promptTokens"] ?? 0)
+      );
+      const rawCacheWrite = toFiniteNumber(
+        Number(u["cacheWrite"] ?? u["cache_creation_input_tokens"] ?? 0)
+      );
       const freshTokens = rawInput + rawCacheWrite;
       const promptTokens = freshTokens + cachedTokens;
-      const completionTokens = Number(
-        u["output"] ?? u["completion_tokens"] ?? u["outputTokens"] ?? u["completionTokens"] ?? 0
-      ) || 0;
+      const completionTokens = toFiniteNumber(
+        Number(
+          u["output"] ?? u["completion_tokens"] ?? u["outputTokens"] ?? u["completionTokens"] ?? 0
+        )
+      );
       const totalTokens = promptTokens + completionTokens;
       const costUsd = estimateCost(model, freshTokens, completionTokens, cachedTokens);
       const record = {
@@ -5012,6 +5085,7 @@ by model: ${top || "(none)"}`
 var cost_tracker_default = plugin14;
 
 // src/cron/index.ts
+import { ToolValidationError as ToolValidationError8 } from "@wrongstack/core/types";
 var COORDINATION_CRON_CAPABILITY = "coordination.cron";
 var API_VERSION9 = "^0.1.10";
 var state14 = {
@@ -5180,16 +5254,28 @@ var plugin15 = {
         const action = input["action"] ?? input["task"] ?? input["command"] ?? input["run"];
         const enabled = input["enabled"] ?? true;
         if (!name || typeof name !== "string" || name.trim() === "") {
-          return { ok: false, error: "name is required and must be a non-empty string" };
+          throw new ToolValidationError8({
+            message: "name is required and must be a non-empty string",
+            field: "name"
+          });
         }
         if (Number.isNaN(intervalMs) || rawInterval === void 0 || rawInterval === null) {
-          return { ok: false, error: "intervalMs must be a number >= 1000" };
+          throw new ToolValidationError8({
+            message: "intervalMs must be a number >= 1000",
+            field: "intervalMs"
+          });
+        }
+        if (typeof action !== "string" || action.trim() === "") {
+          throw new ToolValidationError8({
+            message: "action is required and must be a non-empty string",
+            field: "action"
+          });
         }
         if (state14.jobs.has(name)) {
-          return { ok: false, error: `Cron job '${name}' already exists. Use cron_cancel first.` };
+          throw new Error(`Cron job '${name}' already exists. Use cron_cancel first.`);
         }
         if (state14.jobs.size >= maxConcurrent) {
-          return { ok: false, error: `Maximum concurrent jobs (${maxConcurrent}) reached.` };
+          throw new Error(`Maximum concurrent jobs (${maxConcurrent}) reached.`);
         }
         const job = {
           name,
@@ -5255,7 +5341,7 @@ var plugin15 = {
       async execute(input) {
         const name = input["name"] ?? input["jobName"] ?? input["job_name"] ?? input["job"] ?? input["id"];
         if (!name || typeof name !== "string" || !state14.jobs.has(name)) {
-          return { ok: false, error: `No cron job named '${name}'` };
+          throw new Error(`No cron job named '${name}'`);
         }
         cancelJob(name);
         api.metrics.gauge("cron_active_jobs", state14.jobs.size);
@@ -5290,8 +5376,9 @@ var plugin15 = {
 var cron_default = plugin15;
 
 // src/dead-code-detector/index.ts
-import { readdir, readFile as readFile5, stat as stat2 } from "node:fs/promises";
+import { readdir, readFile as readFile5, stat as stat4 } from "node:fs/promises";
 import { extname as extname2, join, relative as relative8, resolve as resolve8 } from "node:path";
+import { ToolValidationError as ToolValidationError9 } from "@wrongstack/core/types";
 var API_VERSION10 = "^0.1.10";
 var state15 = {
   scanCount: 0,
@@ -5438,14 +5525,8 @@ async function scan(root, depth, cfg) {
 }
 async function resolveScanRoot(rawPath) {
   const resolved = resolve8(process.cwd(), rawPath);
-  try {
-    const stats = await stat2(resolved);
-    if (!stats.isDirectory()) {
-      return resolve8(resolved, "..");
-    }
-  } catch {
-  }
-  return resolved;
+  const stats = await stat4(resolved);
+  return stats.isDirectory() ? resolved : resolve8(resolved, "..");
 }
 function toPosix2(p) {
   return p.replace(/\\/g, "/");
@@ -5564,22 +5645,29 @@ Consider removing the export if it is not part of the public API.`;
       category: "Diagnostics",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "dead-code-detector is disabled" };
+        if (!cfg.enabled) throw new Error("dead-code-detector is disabled");
         const raw = input ?? {};
         const rawPath = (typeof input.path === "string" && input.path.trim().length > 0 ? input.path.trim() : void 0) ?? (typeof raw["directory"] === "string" ? raw["directory"] : void 0) ?? (typeof raw["dir"] === "string" ? raw["dir"] : void 0) ?? (typeof raw["SearchDirectory"] === "string" ? raw["SearchDirectory"] : void 0) ?? (typeof raw["filePath"] === "string" ? raw["filePath"] : void 0) ?? (typeof raw["TargetFile"] === "string" ? raw["TargetFile"] : void 0) ?? (typeof raw["targetFile"] === "string" ? raw["targetFile"] : void 0) ?? (typeof raw["file_path"] === "string" ? raw["file_path"] : void 0) ?? (typeof raw["file"] === "string" ? raw["file"] : void 0) ?? ".";
         const rawDepth = typeof input.depth === "number" ? input.depth : cfg.defaultDepth;
         const depth = Math.max(0, Math.min(Math.floor(rawDepth), cfg.maxDepth));
         if (!(0, runtime_exports.withinProject)(rawPath)) {
-          return { ok: false, error: "scan path is outside the project root" };
+          throw new ToolValidationError9({
+            message: "scan path is outside the project root",
+            field: "path"
+          });
         }
         state15.scanCount += 1;
-        const scanRoot = await resolveScanRoot(rawPath);
         let result;
+        let scanRoot;
         try {
+          scanRoot = await resolveScanRoot(rawPath);
           result = await scan(scanRoot, depth, cfg);
         } catch (err) {
           state15.errorCount += 1;
-          return { ok: false, error: String(err) };
+          throw new Error(
+            `dead_code_scan failed for ${rawPath}: ${err instanceof Error ? err.message : String(err)}`,
+            { cause: err }
+          );
         }
         return {
           ok: true,
@@ -6982,8 +7070,9 @@ Consider mentioning these changes in the documentation.`;
 var doc_sync_guard_default = plugin20;
 
 // src/duplicate-code-detector/index.ts
-import { readFile as readFile6, realpath as realpath2, stat as stat3 } from "node:fs/promises";
+import { readFile as readFile6, realpath as realpath2, stat as stat5 } from "node:fs/promises";
 import { extname as extname4, isAbsolute as isAbsolute8, relative as relative9, resolve as resolve9, sep } from "node:path";
+import { ToolValidationError as ToolValidationError10 } from "@wrongstack/core/types";
 var API_VERSION14 = "^0.1.10";
 var HOOK_WARNING_COOLDOWN_MS = 6e4;
 var state20 = {
@@ -7289,7 +7378,7 @@ var plugin21 = {
     async function readCachedFingerprints(filePath, minLines) {
       let st;
       try {
-        st = await stat3(filePath);
+        st = await stat5(filePath);
       } catch {
         return null;
       }
@@ -7404,19 +7493,26 @@ var plugin21 = {
       category: "Diagnostics",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "duplicate-code-detector is disabled" };
+        if (!cfg.enabled) throw new Error("duplicate-code-detector is disabled");
         const raw = input;
         const rawPath = (typeof raw["path"] === "string" ? raw["path"] : void 0) ?? (typeof raw["directory"] === "string" ? raw["directory"] : void 0) ?? (typeof raw["dir"] === "string" ? raw["dir"] : void 0) ?? (typeof raw["SearchDirectory"] === "string" ? raw["SearchDirectory"] : void 0) ?? (typeof raw["filePath"] === "string" ? raw["filePath"] : void 0) ?? (typeof raw["file_path"] === "string" ? raw["file_path"] : void 0) ?? (typeof raw["TargetFile"] === "string" ? raw["TargetFile"] : void 0) ?? (typeof raw["targetFile"] === "string" ? raw["targetFile"] : void 0) ?? (typeof raw["file"] === "string" ? raw["file"] : void 0) ?? ".";
         if (!(0, runtime_exports.withinProject)(rawPath)) {
-          return { ok: false, error: "scan path is outside the project root" };
+          throw new ToolValidationError10({
+            message: "scan path is outside the project root",
+            field: "path"
+          });
         }
         state20.scanCount += 1;
         let result;
         try {
+          await stat5(resolve9(process.cwd(), rawPath));
           result = await scanPath(rawPath, cfg);
         } catch (err) {
           state20.errorCount += 1;
-          return { ok: false, error: String(err) };
+          throw new Error(
+            `detect_duplicate_code failed for ${rawPath}: ${err instanceof Error ? err.message : String(err)}`,
+            { cause: err }
+          );
         }
         state20.findingCount += result.findings.length;
         return {
@@ -7800,8 +7896,9 @@ ${errorLine ?? "(no error line)"}
 var error_lens_default = plugin22;
 
 // src/feature-flag-tracker/index.ts
-import { readFile as readFile7 } from "node:fs/promises";
+import { readFile as readFile7, stat as stat6 } from "node:fs/promises";
 import { isAbsolute as isAbsolute9, relative as relative10, resolve as resolve10 } from "node:path";
+import { ToolValidationError as ToolValidationError11 } from "@wrongstack/core/types";
 var API_VERSION15 = "^0.1.10";
 var state22 = {
   scanCount: 0,
@@ -8026,19 +8123,26 @@ Make sure flag behavior is intentional and consider updating flag inventory/docs
       category: "Diagnostics",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "feature-flag-tracker is disabled" };
+        if (!cfg.enabled) throw new Error("feature-flag-tracker is disabled");
         const raw = input ?? {};
         const rawPath = (typeof input.path === "string" && input.path.trim().length > 0 ? input.path.trim() : void 0) ?? (typeof raw["directory"] === "string" ? raw["directory"] : void 0) ?? (typeof raw["SearchDirectory"] === "string" ? raw["SearchDirectory"] : void 0) ?? (typeof raw["dir"] === "string" ? raw["dir"] : void 0) ?? (typeof raw["TargetFile"] === "string" ? raw["TargetFile"] : void 0) ?? (typeof raw["targetFile"] === "string" ? raw["targetFile"] : void 0) ?? (typeof raw["filePath"] === "string" ? raw["filePath"] : void 0) ?? (typeof raw["file_path"] === "string" ? raw["file_path"] : void 0) ?? (typeof raw["file"] === "string" ? raw["file"] : void 0) ?? ".";
         if (!(0, runtime_exports.withinProject)(rawPath)) {
-          return { ok: false, error: "path is outside the project root" };
+          throw new ToolValidationError11({
+            message: "path is outside the project root",
+            field: "path"
+          });
         }
         state22.scanCount += 1;
         let result;
         try {
+          await stat6(resolve10(process.cwd(), rawPath));
           result = await scanPath2(rawPath, cfg);
         } catch (err) {
           state22.errorCount += 1;
-          return { ok: false, error: String(err) };
+          throw new Error(
+            `scan_feature_flags failed for ${rawPath}: ${err instanceof Error ? err.message : String(err)}`,
+            { cause: err }
+          );
         }
         state22.flagCount += result.usages.length;
         return {
@@ -8124,6 +8228,7 @@ var feature_flag_tracker_default = plugin23;
 // src/file-watcher/index.ts
 import { watch as fsWatch } from "node:fs";
 import { join as join2 } from "node:path";
+import { ToolValidationError as ToolValidationError12 } from "@wrongstack/core/types";
 var API_VERSION16 = "^0.1.10";
 var watch_idCounter = 0;
 function nextId() {
@@ -8311,11 +8416,10 @@ var plugin24 = {
         let rawPaths;
         if (explicitPaths !== void 0) {
           if (!Array.isArray(explicitPaths)) {
-            return {
-              ok: false,
-              error: "paths must be an array of file/directory paths",
-              watch_id: null
-            };
+            throw new ToolValidationError12({
+              message: "paths must be an array of file/directory paths",
+              field: "paths"
+            });
           }
           rawPaths = explicitPaths;
         } else {
@@ -8323,55 +8427,46 @@ var plugin24 = {
           rawPaths = Array.isArray(fallback) ? fallback : typeof fallback === "string" && fallback.trim().length > 0 ? [fallback.trim()] : void 0;
         }
         if (!rawPaths || !Array.isArray(rawPaths)) {
-          return {
-            ok: false,
-            error: "paths must be an array of file/directory paths",
-            watch_id: null
-          };
+          throw new ToolValidationError12({
+            message: "paths must be an array of file/directory paths",
+            field: "paths"
+          });
         }
         const paths = [...new Set(rawPaths)];
         if (paths.length === 0) {
-          return {
-            ok: false,
-            error: "paths array is empty \u2014 provide at least one path",
-            watch_id: null
-          };
+          throw new ToolValidationError12({
+            message: "paths array is empty \u2014 provide at least one path",
+            field: "paths"
+          });
         }
         if (paths.length > MAX_PATHS_PER_WATCH) {
-          return {
-            ok: false,
-            error: `a watch may contain at most ${MAX_PATHS_PER_WATCH} unique paths`,
-            watch_id: null
-          };
+          throw new ToolValidationError12({
+            message: `a watch may contain at most ${MAX_PATHS_PER_WATCH} unique paths`,
+            field: "paths"
+          });
         }
         if (watches.size >= MAX_WATCH_GROUPS) {
-          return {
-            ok: false,
-            error: `active watch group limit reached (${MAX_WATCH_GROUPS})`,
-            watch_id: null
-          };
+          throw new Error(
+            `active watch group limit reached (${MAX_WATCH_GROUPS}); stop a watch with watch_stop first`
+          );
         }
         const activeFilesystemWatchers = [...watches.values()].reduce(
           (total, handle2) => total + handle2.watchers.length,
           0
         );
         if (activeFilesystemWatchers + paths.length > MAX_FILESYSTEM_WATCHERS) {
-          return {
-            ok: false,
-            error: `filesystem watcher limit reached (${MAX_FILESYSTEM_WATCHERS})`,
-            watch_id: null
-          };
+          throw new Error(
+            `filesystem watcher limit reached (${MAX_FILESYSTEM_WATCHERS}); stop a watch with watch_stop first`
+          );
         }
         const events = input["events"] ?? ["change", "add", "delete"];
         const recursive = input["recursive"] ?? true;
         const bad = paths.find((p) => !(0, runtime_exports.withinProject)(p));
         if (bad !== void 0) {
-          return {
-            ok: false,
-            error: `path is outside the project root: ${bad}`,
-            watch_id: null,
-            rejectedOutsideProject: true
-          };
+          throw new ToolValidationError12({
+            message: `path is outside the project root: ${bad}`,
+            field: "paths"
+          });
         }
         const id = nextId();
         const handle = {
@@ -8383,8 +8478,15 @@ var plugin24 = {
           createdAt: (/* @__PURE__ */ new Date()).toISOString()
         };
         const watchedPaths = [];
+        const failedPaths = [];
         for (const p of paths) {
           if (safeWatchDir(p, recursive, handle)) watchedPaths.push(p);
+          else failedPaths.push(p);
+        }
+        if (watchedPaths.length === 0) {
+          throw new Error(
+            `could not watch any of the requested paths: ${failedPaths.join(", ")} (missing path or OS watcher limit)`
+          );
         }
         handle.paths = watchedPaths;
         watches.set(id, handle);
@@ -8393,9 +8495,10 @@ var plugin24 = {
           ok: true,
           watch_id: id,
           paths: watchedPaths,
+          ...failedPaths.length > 0 ? { failedPaths } : {},
           events,
           recursive,
-          message: `Started watching ${watchedPaths.length} path(s). Use watch_stop to cancel.`
+          message: `Started watching ${watchedPaths.length} path(s). Use watch_stop to cancel.` + (failedPaths.length > 0 ? ` Could not watch: ${failedPaths.join(", ")}.` : "")
         };
       }
     });
@@ -8417,7 +8520,7 @@ var plugin24 = {
         const watch_id = typeof rawId === "string" ? rawId.trim() : "";
         const handle = watches.get(watch_id);
         if (!handle) {
-          return { ok: false, error: `No active watch with ID: ${watch_id}` };
+          throw new Error(`No active watch with ID: ${watch_id}`);
         }
         for (const w of handle.watchers) {
           try {
@@ -8501,7 +8604,7 @@ var file_watcher_default = plugin24;
 // src/format-on-save/index.ts
 import { execFile as execFile5 } from "node:child_process";
 import { createHash } from "node:crypto";
-import { access as access2, readFile as readFile8, stat as stat4 } from "node:fs/promises";
+import { access as access2, readFile as readFile8, stat as stat7 } from "node:fs/promises";
 var API_VERSION17 = "^0.1.10";
 var state23 = {
   invocationCount: 0,
@@ -8624,7 +8727,7 @@ async function formatFile(filePath, timeoutMs) {
   const started = Date.now();
   let bytesBefore;
   try {
-    bytesBefore = (await stat4(filePath)).size;
+    bytesBefore = (await stat7(filePath)).size;
   } catch {
     return null;
   }
@@ -8662,7 +8765,7 @@ async function formatFile(filePath, timeoutMs) {
   }
   let bytesAfter;
   try {
-    bytesAfter = (await stat4(filePath)).size;
+    bytesAfter = (await stat7(filePath)).size;
   } catch {
     return null;
   }
@@ -8877,6 +8980,7 @@ var format_on_save_default = plugin25;
 import { execFile as execFile6 } from "node:child_process";
 import { existsSync as existsSync3 } from "node:fs";
 import { resolve as resolve11 } from "node:path";
+import { ToolValidationError as ToolValidationError13 } from "@wrongstack/core/types";
 var API_VERSION18 = "^0.1.10";
 var commitCount = { value: 0 };
 var lastCommit = { hash: null, at: null };
@@ -9053,22 +9157,22 @@ async function simultaneousEditWarning(cwd) {
 }
 async function getStagedDiff(cwd) {
   try {
-    const stat8 = await runGit3(["diff", "--cached", "--stat"], cwd);
+    const stat13 = await runGit3(["diff", "--cached", "--stat"], cwd);
     const diff = await runGit3(["diff", "--cached"], cwd);
     const MAX_DIFF = 2e4;
     const truncated = diff.length > MAX_DIFF ? diff.slice(0, MAX_DIFF) + "\n\n... (diff truncated)" : diff;
-    return { stat: stat8 || "(no stat)", diff: truncated || "(clean)" };
+    return { stat: stat13 || "(no stat)", diff: truncated || "(clean)" };
   } catch {
     return { stat: "(unavailable)", diff: "(unavailable)" };
   }
 }
 async function getScopedStagedDiff(paths, cwd) {
   try {
-    const stat8 = await runGit3(["diff", "--cached", "--stat", "--", ...paths], cwd);
+    const stat13 = await runGit3(["diff", "--cached", "--stat", "--", ...paths], cwd);
     const diff = await runGit3(["diff", "--cached", "--", ...paths], cwd);
     const MAX_DIFF = 2e4;
     const truncated = diff.length > MAX_DIFF ? diff.slice(0, MAX_DIFF) + "\n\n... (diff truncated)" : diff;
-    return { stat: stat8 || "(no stat)", diff: truncated || "(clean)" };
+    return { stat: stat13 || "(no stat)", diff: truncated || "(clean)" };
   } catch {
     return { stat: "(unavailable)", diff: "(unavailable)" };
   }
@@ -9109,14 +9213,14 @@ var VALID_TYPES = [
   "build",
   "revert"
 ];
-async function generateCommitFromDiff(api, stat8, diff) {
+async function generateCommitFromDiff(api, stat13, diff) {
   if (!api.llm) return null;
   try {
     const result = await api.llm.complete(
       `Write a Conventional Commits message for this staged git diff. Respond with ONLY a JSON object of the form {"type": string, "scope": string, "summary": string, "body": string}. type is one of: ${VALID_TYPES.join(", ")}. scope is a short area (empty string if unclear). summary is an imperative, lower-case, <=72-char subject with no trailing period. body is an optional short explanation (empty string if not needed). No prose outside the JSON.
 
 Stat:
-${stat8}
+${stat13}
 
 Diff:
 ${diff}`,
@@ -9257,7 +9361,10 @@ var plugin26 = {
           const rawFiles = input["files"] ?? input["fileList"] ?? input["file_list"];
           if (rawFiles !== void 0) {
             if (!Array.isArray(rawFiles)) {
-              return { ok: false, error: "files must be an array of file paths" };
+              throw new ToolValidationError13({
+                message: "files must be an array of file paths",
+                field: "files"
+              });
             }
             files = rawFiles;
           } else if (typeof (input["file"] ?? input["file_path"]) === "string" && String(input["file"] ?? input["file_path"]).trim().length > 0) {
@@ -9271,20 +9378,26 @@ var plugin26 = {
           const rawPaths = input["paths"] ?? input["pathList"] ?? input["path_list"];
           if (rawPaths !== void 0) {
             if (!Array.isArray(rawPaths)) {
-              return { ok: false, error: "paths must be an array of pathspec patterns" };
+              throw new ToolValidationError13({
+                message: "paths must be an array of pathspec patterns",
+                field: "paths"
+              });
             }
             pathspecs = rawPaths.filter((p) => typeof p === "string" && p.length > 0);
             if (pathspecs.length === 0) {
-              return { ok: false, error: "paths must contain at least one non-empty pattern" };
+              throw new ToolValidationError13({
+                message: "paths must contain at least one non-empty pattern",
+                field: "paths"
+              });
             }
           } else if (typeof input["path"] === "string" && input["path"].trim().length > 0) {
             pathspecs = [input["path"].trim()];
           }
           if (rawPaths !== void 0 && files && files.length > 0) {
-            return {
-              ok: false,
-              error: "Pass either files (exact paths) or paths (pathspec globs), not both \u2014 the other would be silently ignored."
-            };
+            throw new ToolValidationError13({
+              message: "Pass either files (exact paths) or paths (pathspec globs), not both \u2014 the other would be silently ignored.",
+              field: "paths"
+            });
           }
           let commitScope;
           let staged = [];
@@ -9292,10 +9405,10 @@ var plugin26 = {
             try {
               await stageFiles(pathspecs);
             } catch (err) {
-              return {
-                ok: false,
-                error: `Failed to stage files matching paths: ${err instanceof Error ? err.message : String(err)}`
-              };
+              throw new Error(
+                `Failed to stage files matching paths: ${err instanceof Error ? err.message : String(err)}`,
+                { cause: err }
+              );
             }
             try {
               staged = await getScopedStagedFiles(pathspecs);
@@ -9303,10 +9416,9 @@ var plugin26 = {
               staged = [];
             }
             if (staged.length === 0) {
-              return {
-                ok: false,
-                error: "No changed files match the given paths \u2014 refusing to commit anything else."
-              };
+              throw new Error(
+                "No changed files match the given paths \u2014 refusing to commit anything else."
+              );
             }
             commitScope = staged;
             try {
@@ -9318,10 +9430,10 @@ var plugin26 = {
             try {
               commitScope = await stageFiles(files);
             } catch (err) {
-              return {
-                ok: false,
-                error: `Failed to stage files: ${err instanceof Error ? err.message : String(err)}`
-              };
+              throw new Error(
+                `Failed to stage files: ${err instanceof Error ? err.message : String(err)}`,
+                { cause: err }
+              );
             }
             try {
               staged = await getStagedFiles();
@@ -9352,10 +9464,10 @@ var plugin26 = {
               }
             }
           }
-          const { stat: stat8, diff: stagedDiff } = commitScope ? await getScopedStagedDiff(commitScope) : await getStagedDiff();
+          const { stat: stat13, diff: stagedDiff } = commitScope ? await getScopedStagedDiff(commitScope) : await getStagedDiff();
           let generatedByLlm = false;
           if (wantGenerate && staged.length > 0) {
-            const g = await generateCommitFromDiff(api, stat8, stagedDiff);
+            const g = await generateCommitFromDiff(api, stat13, stagedDiff);
             if (g) {
               type = g.type;
               if (g.scope) scope = g.scope;
@@ -9386,17 +9498,16 @@ var plugin26 = {
                 message: `Would create: ${summary || "update code"}`
               };
             }
-            return {
-              ok: false,
-              error: "type is required and must be a valid conventional commit type"
-            };
+            throw new ToolValidationError13({
+              message: "type is required and must be a valid conventional commit type",
+              field: "type"
+            });
           }
           const msg = generateCommitMessage(type, scope, summary || "update code", body);
           if (staged.length === 0) {
-            return {
-              ok: false,
-              error: 'Nothing staged. Pass files (exact paths) or paths (pathspec globs) to scope this commit, stage with git add beforehand, or set extensions["git-autocommit"].autoStage=true to allow staging every changed file (legacy whole-tree behavior).'
-            };
+            throw new Error(
+              'Nothing staged. Pass files (exact paths) or paths (pathspec globs) to scope this commit, stage with git add beforehand, or set extensions["git-autocommit"].autoStage=true to allow staging every changed file (legacy whole-tree behavior).'
+            );
           }
           let scopeWarning = null;
           if (commitScope) {
@@ -9426,7 +9537,7 @@ var plugin26 = {
               stagedDiff: `
 ## Staged changes (dry run)
 
-${stat8}
+${stat13}
 
 \`\`\`diff
 ${stagedDiff}
@@ -9438,20 +9549,19 @@ ${stagedDiff}
             if (drifted.length > 0) {
               const preview = drifted.slice(0, 10).join(", ");
               const suffix = drifted.length > 10 ? ` and ${drifted.length - 10} more` : "";
-              return {
-                ok: false,
-                error: `Working tree changed after staging for: ${preview}${suffix}. A scoped commit takes working-tree content, so committing now could include changes that were never staged or previewed. Re-run the tool to re-stage the current content.`
-              };
+              throw new Error(
+                `Working tree changed after staging for: ${preview}${suffix}. A scoped commit takes working-tree content, so committing now could include changes that were never staged or previewed. Re-run the tool to re-stage the current content.`
+              );
             }
           }
           let hash = "";
           try {
             hash = await commitWithMessage(msg, void 0, commitScope);
           } catch (err) {
-            return {
-              ok: false,
-              error: `Failed to commit: ${err instanceof Error ? err.message : String(err)}`
-            };
+            throw new Error(
+              `Failed to commit: ${err instanceof Error ? err.message : String(err)}`,
+              { cause: err }
+            );
           }
           api.log.info("git-autocommit: created commit", { hash, type, scope });
           commitCount.value += 1;
@@ -9483,17 +9593,15 @@ ${stagedDiff}
             diff: `
 ## Staged diff
 
-${stat8}
+${stat13}
 
 \`\`\`diff
 ${stagedDiff}
 \`\`\``
           };
         } catch (err) {
-          return {
-            ok: false,
-            error: `Uncaught error in git_autocommit: ${err instanceof Error ? err.message : String(err)}`
-          };
+          if (err instanceof Error) throw err;
+          throw new Error(`Uncaught error in git_autocommit: ${String(err)}`, { cause: err });
         }
       }
     });
@@ -9532,6 +9640,7 @@ var git_autocommit_default = plugin26;
 // src/gitignore-guard/index.ts
 import { access as access3, readFile as readFile9, writeFile as writeFile2 } from "node:fs/promises";
 import { basename as basename3, isAbsolute as isAbsolute10, join as join3, relative as relative11, resolve as resolve12, sep as sep2 } from "node:path";
+import { ToolValidationError as ToolValidationError14 } from "@wrongstack/core/types";
 var API_VERSION19 = "^0.1.10";
 var DEFAULT_ARTIFACT_PATTERNS = Object.freeze([
   "dist/",
@@ -9900,19 +10009,24 @@ var plugin27 = {
         const rawInp = input ?? {};
         const raw = rawInp["path"] ?? rawInp["filePath"] ?? rawInp["file_path"] ?? rawInp["TargetFile"] ?? rawInp["targetFile"] ?? rawInp["file"];
         const rawPath = typeof raw === "string" ? raw.trim() : "";
-        if (rawPath.length === 0) return { ok: false, reason: "path is required" };
+        if (rawPath.length === 0) {
+          throw new ToolValidationError14({ message: "path is required", field: "path" });
+        }
         const resolved = projectRelativePath(rawPath, process.cwd());
         if (!resolved) {
-          return { ok: false, reason: `path outside project root: ${rawPath}` };
+          throw new ToolValidationError14({
+            message: `path outside project root: ${rawPath}`,
+            field: "path"
+          });
         }
         const cfg = readConfig22(api.config.extensions?.["gitignore-guard"]);
         const explicit = typeof input?.pattern === "string" && input.pattern.trim().length > 0 ? input.pattern.trim() : null;
         const pattern = explicit ?? classifyArtifact(resolved.rel, cfg.artifactPatterns);
         if (!pattern) {
-          return {
-            ok: false,
-            reason: `'${resolved.rel}' does not match any configured artifact pattern; pass an explicit pattern`
-          };
+          throw new ToolValidationError14({
+            message: `'${resolved.rel}' does not match any configured artifact pattern; pass an explicit pattern`,
+            field: "pattern"
+          });
         }
         const candidates = gitignoreCandidates(relDirOf(resolved.rel), resolved.root);
         const nearest = await firstExistingGitignore(candidates);
@@ -10620,8 +10734,9 @@ var plugin29 = {
 var injection_shield_default = plugin29;
 
 // src/interface-contract-guard/index.ts
-import { readFile as readFile10 } from "node:fs/promises";
+import { readFile as readFile10, stat as stat8 } from "node:fs/promises";
 import { isAbsolute as isAbsolute12, relative as relative12, resolve as resolve13 } from "node:path";
+import { ToolValidationError as ToolValidationError15 } from "@wrongstack/core/types";
 var API_VERSION21 = "^0.1.10";
 var state27 = {
   scanCount: 0,
@@ -10816,19 +10931,26 @@ If you changed member shapes, search the project for implementers/\`satisfies\`/
       category: "Diagnostics",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "interface-contract-guard is disabled" };
+        if (!cfg.enabled) throw new Error("interface-contract-guard is disabled");
         const raw = input ?? {};
         const rawPath = (typeof input.path === "string" && input.path.trim().length > 0 ? input.path.trim() : void 0) ?? (typeof raw["directory"] === "string" ? raw["directory"] : void 0) ?? (typeof raw["dir"] === "string" ? raw["dir"] : void 0) ?? (typeof raw["SearchDirectory"] === "string" ? raw["SearchDirectory"] : void 0) ?? (typeof raw["TargetFile"] === "string" ? raw["TargetFile"] : void 0) ?? (typeof raw["filePath"] === "string" ? raw["filePath"] : void 0) ?? (typeof raw["targetFile"] === "string" ? raw["targetFile"] : void 0) ?? (typeof raw["file"] === "string" ? raw["file"] : void 0) ?? ".";
         if (!(0, runtime_exports.withinProject)(rawPath)) {
-          return { ok: false, error: "path is outside the project root" };
+          throw new ToolValidationError15({
+            message: "path is outside the project root",
+            field: "path"
+          });
         }
         state27.scanCount += 1;
         let result;
         try {
+          await stat8(resolve13(process.cwd(), rawPath));
           result = await scanPath3(rawPath, cfg);
         } catch (err) {
           state27.errorCount += 1;
-          return { ok: false, error: String(err) };
+          throw new Error(
+            `check_interface_contracts failed for ${rawPath}: ${err instanceof Error ? err.message : String(err)}`,
+            { cause: err }
+          );
         }
         state27.findingCount += result.findings.length;
         return {
@@ -10915,6 +11037,7 @@ var interface_contract_guard_default = plugin30;
 // src/knowledge-graph/index.ts
 import { readFileSync as readFileSync7 } from "node:fs";
 import { dirname as dirname4, isAbsolute as isAbsolute13, relative as relative13, resolve as resolve14 } from "node:path";
+import { ToolValidationError as ToolValidationError16 } from "@wrongstack/core/types";
 import { atomicWrite as atomicWrite2, ensureDir as ensureDir2 } from "@wrongstack/core/utils";
 var API_VERSION22 = "^0.1.10";
 var state28 = {
@@ -11085,12 +11208,9 @@ var plugin31 = {
       category: "Memory",
       mutating: true,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "knowledge-graph is disabled" };
+        if (!cfg.enabled) throw new Error("knowledge-graph is disabled");
         if (state28.facts.length >= cfg.maxFacts) {
-          return {
-            ok: false,
-            error: `fact limit reached (${cfg.maxFacts}). Remove old facts first.`
-          };
+          throw new Error(`fact limit reached (${cfg.maxFacts}). Remove old facts first.`);
         }
         const trim = (s) => String(s ?? "").trim().slice(0, cfg.maxFactChars);
         const raw = input;
@@ -11104,7 +11224,10 @@ var plugin31 = {
           input.object ?? raw["target"] ?? raw["val"] ?? raw["value"] ?? raw["obj"] ?? raw["targetEntity"]
         );
         if (!subject || !relation || !object) {
-          return { ok: false, error: "subject, relation, and object are required" };
+          throw new ToolValidationError16({
+            message: "subject, relation, and object are required",
+            field: !subject ? "subject" : !relation ? "relation" : "object"
+          });
         }
         const rawConf = typeof input.confidence === "string" ? input.confidence.trim().toLowerCase() : "";
         const confidence = rawConf === "low" || rawConf === "high" || rawConf === "medium" ? rawConf : "medium";
@@ -11141,7 +11264,7 @@ var plugin31 = {
       category: "Memory",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "knowledge-graph is disabled" };
+        if (!cfg.enabled) throw new Error("knowledge-graph is disabled");
         state28.queries += 1;
         const raw = input;
         const rawQ = (typeof raw["query"] === "string" ? raw["query"] : void 0) ?? (typeof raw["q"] === "string" ? raw["q"] : void 0);
@@ -11186,16 +11309,17 @@ var plugin31 = {
       category: "Memory",
       mutating: true,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "knowledge-graph is disabled" };
+        if (!cfg.enabled) throw new Error("knowledge-graph is disabled");
         const before = state28.facts.length;
         const raw = input ?? {};
         const rawId = String(input.id ?? raw["factId"] ?? raw["fact_id"] ?? "").trim();
+        if (!rawId) throw new ToolValidationError16({ message: "id is required", field: "id" });
         const normalized = rawId.toLowerCase().startsWith("kg-") ? rawId.toLowerCase() : `kg-${rawId.toLowerCase()}`;
         state28.facts = state28.facts.filter(
           (f) => f.id.toLowerCase() !== normalized && f.id !== rawId
         );
         const removed = before - state28.facts.length;
-        if (removed === 0) return { ok: false, error: `no fact matches "${input.id ?? rawId}"` };
+        if (removed === 0) throw new Error(`no fact matches "${input.id ?? rawId}"`);
         state28.removals += removed;
         api.metrics.counter("removals", removed);
         const persisted = await persistFacts(resolved);
@@ -12364,7 +12488,10 @@ var state32 = {
 };
 var DEFAULTS30 = {
   enabled: true,
-  mode: "warn",
+  // Documented contract (feature matrix, plugin description): warn, then
+  // block. A warn-only default meant an agent stuck re-issuing the same call
+  // was never actually stopped unless the user happened to set any option.
+  mode: "block",
   warnAfter: 3,
   blockAfter: 5,
   oscillationWindow: 8,
@@ -12390,7 +12517,7 @@ function readConfig30(raw) {
   const ignoreTools = Array.isArray(rawIgnore) ? rawIgnore.filter((t) => typeof t === "string") : [];
   ignoreToolsSet = new Set(ignoreTools);
   const rawMode = typeof (r["mode"] ?? r["action"] ?? r["behavior"]) === "string" ? String(r["mode"] ?? r["action"] ?? r["behavior"]).trim().toLowerCase() : void 0;
-  const mode = rawMode === "warn" ? "warn" : "block";
+  const mode = rawMode === "warn" || rawMode === "block" ? rawMode : DEFAULTS30.mode;
   const rawOsc = r["oscillationWindow"] ?? r["oscillation_window"] ?? r["window"];
   const rawMaxSteps = r["maxSteps"] ?? r["max_steps"] ?? r["stepLimit"] ?? r["step_limit"];
   return {
@@ -12419,7 +12546,11 @@ function sortKeys(value, depth = 0, seen = /* @__PURE__ */ new Set()) {
   if (value === null || typeof value !== "object") return value;
   if (seen.has(value)) return "[circular]";
   if (depth >= CANONICALIZE_MAX_DEPTH) {
-    return Array.isArray(value) ? `[array:${value.length}]` : "[deep-object]";
+    try {
+      return `[deep:${JSON.stringify(value)}]`;
+    } catch {
+      return Array.isArray(value) ? `[array:${value.length}]` : "[deep-object]";
+    }
   }
   seen.add(value);
   try {
@@ -12507,7 +12638,7 @@ var plugin35 = {
       mode: {
         type: "string",
         enum: ["warn", "block"],
-        default: "warn",
+        default: "block",
         description: "block = refuse the repeated call; warn = only inject context."
       },
       warnAfter: {
@@ -12839,6 +12970,7 @@ var loop_breaker_default = plugin35;
 
 // src/migration-planner/index.ts
 import { existsSync as existsSync5, readFileSync as readFileSync10 } from "node:fs";
+import { ToolValidationError as ToolValidationError17 } from "@wrongstack/core/types";
 
 // src/runtime/llm.ts
 import {
@@ -13107,14 +13239,14 @@ var plugin36 = {
       const rawPath = inp["path"] ?? inp["TargetFile"] ?? inp["filePath"] ?? inp["targetFile"] ?? inp["file_path"] ?? inp["file"];
       const path = typeof rawPath === "string" ? rawPath : void 0;
       if (!path) return;
-      const basename7 = path.split(/[/\\]/).pop() ?? "";
+      const basename8 = path.split(/[/\\]/).pop() ?? "";
       if (!/^(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?)$/i.test(
-        basename7
+        basename8
       )) {
         return;
       }
       return {
-        additionalContext: `Manifest file ${basename7} changed. Consider running migration_plan if a dependency version was updated.`
+        additionalContext: `Manifest file ${basename8} changed. Consider running migration_plan if a dependency version was updated.`
       };
     };
     state33.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
@@ -13212,7 +13344,7 @@ var plugin36 = {
       category: "Planning",
       mutating: false,
       async execute(input, _ctx, execOpts) {
-        if (!cfg.enabled) return { ok: false, error: "migration-planner is disabled" };
+        if (!cfg.enabled) throw new Error("migration-planner is disabled");
         execOpts?.signal?.throwIfAborted();
         const raw = input ?? {};
         const rawPackage = input.packageName || raw["package"] || raw["pkg"] || raw["name"] || raw["package_name"] || raw["packageName"] || raw["dependency"] || raw["dep"] || raw["module"];
@@ -13223,7 +13355,10 @@ var plugin36 = {
         const fromVersion = String(rawFrom ?? "").trim();
         const toVersion = String(rawTo ?? "").trim();
         if (!packageName || !fromVersion || !toVersion) {
-          return { ok: false, error: "packageName, fromVersion, and toVersion are required" };
+          throw new ToolValidationError17({
+            message: "packageName, fromVersion, and toVersion are required",
+            field: !packageName ? "packageName" : !fromVersion ? "fromVersion" : "toVersion"
+          });
         }
         const changelog = readChangelog(packageName, cfg);
         let breakingChanges;
@@ -13593,6 +13728,7 @@ var model_router_default = plugin37;
 
 // src/notify-hub/index.ts
 import { lookup } from "node:dns/promises";
+import { ToolValidationError as ToolValidationError18 } from "@wrongstack/core/types";
 
 // src/notify-hub/webhook-channel.ts
 function freshCircuit() {
@@ -13755,7 +13891,13 @@ var DEFAULTS33 = {
   maxConsecutiveFailures: 5
 };
 function isPrivateIPv4(hostname) {
-  const normalised = hostname.replace(/^::ffff:/i, "");
+  const hexMapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(hostname);
+  const normalised = hexMapped ? [
+    Number.parseInt(hexMapped[1], 16) >> 8,
+    Number.parseInt(hexMapped[1], 16) & 255,
+    Number.parseInt(hexMapped[2], 16) >> 8,
+    Number.parseInt(hexMapped[2], 16) & 255
+  ].join(".") : hostname.replace(/^::ffff:/i, "");
   const parts = normalised.split(".").map((p) => Number(p));
   if (parts.length !== 4 || parts.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) {
     return false;
@@ -13995,18 +14137,19 @@ var plugin38 = {
       category: "Notifications",
       mutating: true,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "notify-hub is disabled" };
+        if (!cfg.enabled) throw new Error("notify-hub is disabled");
         const ch = state35.channel;
         if (!ch) {
-          return {
-            ok: false,
-            error: 'no webhookUrl configured \u2014 set config.extensions["notify-hub"].webhookUrl to enable deliveries'
-          };
+          throw new Error(
+            'no webhookUrl configured \u2014 set config.extensions["notify-hub"].webhookUrl to enable deliveries'
+          );
         }
         const inp = input ?? {};
         const rawMsg = inp["message"] ?? inp["body"] ?? inp["text"] ?? inp["content"] ?? inp["msg"];
         const message = typeof rawMsg === "string" && rawMsg.trim().length > 0 ? rawMsg.trim() : "";
-        if (!message) return { ok: false, error: "message is required" };
+        if (!message) {
+          throw new ToolValidationError18({ message: "message is required", field: "message" });
+        }
         const rawTitle = inp["title"] ?? inp["subject"] ?? inp["header"];
         const title = typeof rawTitle === "string" && rawTitle.trim() ? rawTitle.trim() : "WrongStack notification";
         const result = await deliverViaChannel(ch, "manual", {
@@ -14015,11 +14158,10 @@ var plugin38 = {
           level: input.level === "warning" || input.level === "critical" ? input.level : "info",
           source: "manual"
         });
-        return {
-          ok: result.ok,
-          circuitOpen: ch.circuitStatus().open,
-          ...result.ok ? {} : { error: result.error ?? "delivery failed" }
-        };
+        if (!result.ok) {
+          throw new Error(`notification delivery failed: ${result.error ?? "unknown error"}`);
+        }
+        return { ok: true, circuitOpen: ch.circuitStatus().open };
       }
     });
     api.tools.register({
@@ -14238,8 +14380,8 @@ function isRootPathScope(path) {
 function isDirectoryAmbiguousPath(path) {
   const normalized = normalizePath2(path).replace(/\/$/, "");
   if (isRootPathScope(normalized)) return true;
-  const basename7 = normalized.slice(normalized.lastIndexOf("/") + 1);
-  return path.endsWith("/") || basename7.length > 0 && !basename7.includes(".");
+  const basename8 = normalized.slice(normalized.lastIndexOf("/") + 1);
+  return path.endsWith("/") || basename8.length > 0 && !basename8.includes(".");
 }
 function hasConfiguredProtectedDescendant(path, patterns) {
   const normalized = normalizePath2(path).replace(/\/$/, "").toLowerCase();
@@ -15516,9 +15658,9 @@ var plugin39 = {
       } catch {
       }
     }
-    const state60 = createState();
-    states.set(api, state60);
-    latestState = state60;
+    const state59 = createState();
+    states.set(api, state59);
+    latestState = state59;
     const cfg = readConfig34(api.config.extensions?.["path-guard"]);
     const protectRes = cfg.protect.map(compilePathGlob);
     const allowRes = cfg.allow.map(compilePathGlob);
@@ -15526,15 +15668,15 @@ var plugin39 = {
       const subject = isScope ? `write scope "${path}" may include a protected path \u2014 narrow it or add an \`allow\` glob` : `"${path}" is a protected path`;
       const matchContext = isScope ? 'its unresolved scope overlaps config.extensions["path-guard"].protect' : 'matched by config.extensions["path-guard"].protect';
       if (cfg.mode === "block") {
-        state60.blocks += 1;
-        state60.lastBlock = { path, tool, when: (/* @__PURE__ */ new Date()).toISOString() };
+        state59.blocks += 1;
+        state59.lastBlock = { path, tool, when: (/* @__PURE__ */ new Date()).toISOString() };
         api.metrics.counter("blocks");
         return {
           decision: "block",
           reason: `path-guard: ${subject} (${matchContext}) \u2014 ${operation} refused. If this change is intentional, ask the user to do it, add an \`allow\` glob, or set mode: "warn".`
         };
       }
-      state60.warns += 1;
+      state59.warns += 1;
       api.metrics.counter("warns");
       return {
         decision: "allow",
@@ -15542,12 +15684,12 @@ var plugin39 = {
       };
     };
     const bumpRedos = () => {
-      state60.redosTimeouts += 1;
+      state59.redosTimeouts += 1;
       api.metrics.counter("redos_timeouts");
     };
     const hook = async (input) => {
       if (!cfg.enabled) return;
-      state60.invocations += 1;
+      state59.invocations += 1;
       const toolName = input.toolName ?? "";
       const ti = input.toolInput ?? {};
       const command = typeof ti["command"] === "string" ? ti["command"] : "";
@@ -15633,7 +15775,7 @@ var plugin39 = {
       }
       return;
     };
-    state60.hookUnregister = api.registerHook("PreToolUse", "*", hook, {
+    state59.hookUnregister = api.registerHook("PreToolUse", "*", hook, {
       name: "path-guard",
       stage: "validate",
       failurePolicy: "closed",
@@ -15654,12 +15796,12 @@ var plugin39 = {
           protect: cfg.protect,
           allow: cfg.allow,
           counters: {
-            invocations: state60.invocations,
-            blocks: state60.blocks,
-            warns: state60.warns,
-            redosTimeouts: state60.redosTimeouts
+            invocations: state59.invocations,
+            blocks: state59.blocks,
+            warns: state59.warns,
+            redosTimeouts: state59.redosTimeouts
           },
-          lastBlock: state60.lastBlock
+          lastBlock: state59.lastBlock
         };
       }
     });
@@ -15671,39 +15813,39 @@ var plugin39 = {
     });
   },
   teardown(api) {
-    const state60 = states.get(api);
-    if (!state60) return;
-    if (state60.hookUnregister) {
+    const state59 = states.get(api);
+    if (!state59) return;
+    if (state59.hookUnregister) {
       try {
-        state60.hookUnregister();
+        state59.hookUnregister();
       } catch {
       }
-      state60.hookUnregister = null;
+      state59.hookUnregister = null;
     }
     const final = {
-      invocations: state60.invocations,
-      blocks: state60.blocks,
-      warns: state60.warns,
-      redosTimeouts: state60.redosTimeouts
+      invocations: state59.invocations,
+      blocks: state59.blocks,
+      warns: state59.warns,
+      redosTimeouts: state59.redosTimeouts
     };
-    state60.invocations = 0;
-    state60.blocks = 0;
-    state60.warns = 0;
-    state60.redosTimeouts = 0;
-    state60.lastBlock = null;
+    state59.invocations = 0;
+    state59.blocks = 0;
+    state59.warns = 0;
+    state59.redosTimeouts = 0;
+    state59.lastBlock = null;
     states.delete(api);
     api.log.info("path-guard: teardown complete", { final });
   },
   async health() {
-    const state60 = latestState;
+    const state59 = latestState;
     return {
       ok: true,
-      message: state60.lastBlock === null ? `path-guard: ${state60.invocations} invocation(s), ${state60.blocks} block(s), ${state60.warns} warn(s)` : `path-guard: last block on "${state60.lastBlock.path}" (${state60.lastBlock.tool}) at ${state60.lastBlock.when}`,
+      message: state59.lastBlock === null ? `path-guard: ${state59.invocations} invocation(s), ${state59.blocks} block(s), ${state59.warns} warn(s)` : `path-guard: last block on "${state59.lastBlock.path}" (${state59.lastBlock.tool}) at ${state59.lastBlock.when}`,
       counters: {
-        invocations: state60.invocations,
-        blocks: state60.blocks,
-        warns: state60.warns,
-        redosTimeouts: state60.redosTimeouts
+        invocations: state59.invocations,
+        blocks: state59.blocks,
+        warns: state59.warns,
+        redosTimeouts: state59.redosTimeouts
       }
     };
   }
@@ -15713,6 +15855,7 @@ var path_guard_default = plugin39;
 // src/performance-regression-gate/index.ts
 import { existsSync as existsSync7, readFileSync as readFileSync11 } from "node:fs";
 import { isAbsolute as isAbsolute16, relative as relative16, resolve as resolve18 } from "node:path";
+import { ToolValidationError as ToolValidationError19 } from "@wrongstack/core/types";
 var API_VERSION26 = "^0.1.10";
 var state36 = {
   invocationCount: 0,
@@ -15779,10 +15922,11 @@ function flattenResults(results) {
 function loadResults(path) {
   if (!path || !existsSync7(path)) return null;
   try {
-    const raw = JSON.parse(readFileSync11(path, "utf-8"));
-    return raw;
-  } catch {
-    return null;
+    return JSON.parse(readFileSync11(path, "utf-8"));
+  } catch (err) {
+    throw new Error(`Could not read benchmark results at ${path}: ${String(err)}`, {
+      cause: err
+    });
   }
 }
 function stripVariantSuffix(name) {
@@ -15909,7 +16053,7 @@ var plugin40 = {
       mutating: false,
       async execute(input) {
         if (!cfg.enabled) {
-          return { ok: false, error: "performance-regression-gate is disabled" };
+          throw new Error("performance-regression-gate is disabled");
         }
         state36.invocationCount += 1;
         const raw = input ?? {};
@@ -15920,11 +16064,23 @@ var plugin40 = {
         const resultsPath = resolveProjectPath6(resultsPathStr) ?? "";
         if (!resultsPath) {
           state36.errorCount += 1;
-          return { ok: false, error: "invalid results path (must be inside project)" };
+          throw new ToolValidationError19({
+            message: "invalid results path (must be inside project)",
+            field: "resultsPath"
+          });
+        }
+        let results;
+        try {
+          results = loadResults(resultsPath);
+        } catch (err) {
+          state36.errorCount += 1;
+          throw err;
         }
-        const results = loadResults(resultsPath);
         if (!results) {
           state36.missingResultsCount += 1;
+          if (resultsPathStr !== "bench-results.json" || rawResultsPath !== "bench-results.json") {
+            throw new Error(`No benchmark results found at ${resultsPathStr}.`);
+          }
           return {
             ok: true,
             hasResults: false,
@@ -15953,15 +16109,21 @@ var plugin40 = {
           const baselineResolved = resolveProjectPath6(baselinePathStr) ?? "";
           if (!baselineResolved) {
             state36.errorCount += 1;
-            return { ok: false, error: "invalid baseline path (must be inside project)" };
+            throw new ToolValidationError19({
+              message: "invalid baseline path (must be inside project)",
+              field: "baselinePath"
+            });
+          }
+          let baselineResults;
+          try {
+            baselineResults = loadResults(baselineResolved);
+          } catch (err) {
+            state36.errorCount += 1;
+            throw err;
           }
-          const baselineResults = loadResults(baselineResolved);
           if (!baselineResults) {
             state36.errorCount += 1;
-            return {
-              ok: false,
-              error: `Could not read baseline results at ${baselinePathStr}.`
-            };
+            throw new Error(`Could not read baseline results at ${baselinePathStr}.`);
           }
           const baseline = flattenResults(baselineResults);
           pairs = pairCrossFile(baseline, current);
@@ -16176,6 +16338,7 @@ var plugin_stack_observer_default = PLUGIN;
 import { execFile as execFile9 } from "node:child_process";
 import { mkdir as mkdir2, writeFile as writeFile4 } from "node:fs/promises";
 import { dirname as dirname7, isAbsolute as isAbsolute17, relative as relative17, resolve as resolve19 } from "node:path";
+import { ToolValidationError as ToolValidationError20 } from "@wrongstack/core/types";
 var API_VERSION27 = "^0.1.10";
 var state38 = {
   commits: [],
@@ -16188,8 +16351,23 @@ var state38 = {
   draftErrors: 0,
   stopInvocations: 0,
   stopHookUnregister: null,
+  postHookUnregister: null,
   eventUnsubscribers: []
 };
+var TRACKED_FILE_TOOLS = /* @__PURE__ */ new Set(["write", "edit", "write_to_file", "replace_file_content"]);
+function parseAutocommitResult(content) {
+  const hash = /"hash":\s*"([0-9a-f]{7,64})"/.exec(content)?.[1];
+  if (!hash) return null;
+  const rawMessage = /"message":\s*("(?:[^"\\]|\\.)*")/.exec(content)?.[1];
+  let message = "commit";
+  if (rawMessage) {
+    try {
+      message = JSON.parse(rawMessage);
+    } catch {
+    }
+  }
+  return { hash, message };
+}
 var DEFAULTS36 = {
   enabled: true,
   outputPath: ".wrongstack/PR_DRAFT.md",
@@ -16372,6 +16550,7 @@ var plugin41 = {
     state38.draftErrors = 0;
     state38.stopInvocations = 0;
     state38.stopHookUnregister = (0, runtime_exports.releaseHandle)(state38.stopHookUnregister);
+    state38.postHookUnregister = (0, runtime_exports.releaseHandle)(state38.postHookUnregister);
     for (const off of state38.eventUnsubscribers) {
       try {
         off();
@@ -16381,22 +16560,24 @@ var plugin41 = {
     state38.eventUnsubscribers = [];
     const cfg = readConfig37(api.config.extensions?.["pr-drafter"]);
     if (api.onPattern) {
-      const offTool = api.onPattern("tool.completed", (_event, payload) => {
-        const p = payload;
-        const toolName = p?.tool;
+      const offTool = api.onPattern("tool.completed", () => {
         state38.toolCalls += 1;
-        if (toolName === "git_autocommit" && p?.result?.committed) {
-          const msg = p.result.commitMessage ?? p.input?.message ?? "commit";
-          state38.commits.push(msg);
-        }
-        const rawInput = p?.input ?? {};
-        const filePath = typeof rawInput["path"] === "string" && rawInput["path"] || typeof rawInput["filePath"] === "string" && rawInput["filePath"] || typeof rawInput["file_path"] === "string" && rawInput["file_path"] || typeof rawInput["TargetFile"] === "string" && rawInput["TargetFile"] || typeof rawInput["targetFile"] === "string" && rawInput["targetFile"] || typeof rawInput["file"] === "string" && rawInput["file"];
-        if ((toolName === "write" || toolName === "edit" || toolName === "write_to_file" || toolName === "replace_file_content") && filePath) {
-          state38.files.add(filePath);
-        }
       });
       state38.eventUnsubscribers.push(offTool);
     }
+    const postHook = (input) => {
+      if (!input.toolResult || input.toolResult.isError) return;
+      const toolName = input.toolName;
+      if (toolName === "git_autocommit") {
+        const commit = parseAutocommitResult(String(input.toolResult.content ?? ""));
+        if (commit) state38.commits.push(commit.message);
+        return;
+      }
+      if (!toolName || !TRACKED_FILE_TOOLS.has(toolName)) return;
+      const rawInput = input.toolInput ?? {};
+      const filePath = ["path", "filePath", "file_path", "TargetFile", "targetFile", "file"].map((key) => rawInput[key]).find((value) => typeof value === "string" && value.length > 0);
+      if (filePath) state38.files.add(filePath);
+    };
     if (api.onEvent) {
       const offUsage = api.onEvent("provider.response", (payload) => {
         const p = payload;
@@ -16415,6 +16596,11 @@ var plugin41 = {
       await writeDraft(cfg, api.llm);
     };
     state38.stopHookUnregister = api.registerHook("Stop", void 0, stopHook);
+    state38.postHookUnregister = api.registerHook(
+      "PostToolUse",
+      "git_autocommit|write|edit|write_to_file|replace_file_content",
+      postHook
+    );
     api.tools.register({
       name: "pr_draft",
       description: "Generate or refresh the pull-request draft for the current session. Writes the markdown file and returns its path + title.",
@@ -16437,7 +16623,7 @@ var plugin41 = {
       mutating: true,
       capabilities: ["fs.write"],
       async execute(input = {}) {
-        if (!cfg.enabled) return { ok: false, error: "pr-drafter is disabled" };
+        if (!cfg.enabled) throw new Error("pr-drafter is disabled");
         const raw = input ?? {};
         const preview = Boolean(
           input?.preview ?? raw["dryRun"] ?? raw["dry_run"] ?? raw["dry"] ?? raw["previewOnly"]
@@ -16449,24 +16635,29 @@ var plugin41 = {
           return { ok: true, preview: true, title: draft.title, body: draft.body };
         }
         const resolved = resolveProjectPath7(outputPathStr);
-        if (!resolved) return { ok: false, error: "outputPath resolves outside project" };
+        if (!resolved) {
+          throw new ToolValidationError20({
+            message: "outputPath resolves outside project",
+            field: "outputPath"
+          });
+        }
         try {
           await mkdir2(dirname7(resolved), { recursive: true });
           await writeFile4(resolved, draft.body);
-          state38.draftsWritten += 1;
-          return {
-            ok: true,
-            path: outputPathStr,
-            resolvedPath: resolved,
-            title: draft.title
-          };
         } catch (err) {
           state38.draftErrors += 1;
-          return {
-            ok: false,
-            error: err instanceof Error ? err.message : String(err)
-          };
+          throw new Error(
+            `Could not write PR draft to ${outputPathStr}: ${err instanceof Error ? err.message : String(err)}`,
+            { cause: err }
+          );
         }
+        state38.draftsWritten += 1;
+        return {
+          ok: true,
+          path: outputPathStr,
+          resolvedPath: resolved,
+          title: draft.title
+        };
       }
     });
     api.log.info("pr-drafter plugin loaded", {
@@ -16483,6 +16674,7 @@ var plugin41 = {
       }
       state38.stopHookUnregister = null;
     }
+    state38.postHookUnregister = (0, runtime_exports.releaseHandle)(state38.postHookUnregister);
     for (const off of state38.eventUnsubscribers) {
       try {
         off();
@@ -17194,8 +17386,9 @@ var plugin43 = {
 var prompt_firewall_default = plugin43;
 
 // src/refactor-suggester/index.ts
-import { readFile as readFile12 } from "node:fs/promises";
+import { readFile as readFile12, stat as stat9 } from "node:fs/promises";
 import { isAbsolute as isAbsolute18, relative as relative18, resolve as resolve20 } from "node:path";
+import { ToolValidationError as ToolValidationError21 } from "@wrongstack/core/types";
 var API_VERSION28 = "^0.1.10";
 var HOOK_WARNING_COOLDOWN_MS2 = 6e4;
 var state41 = {
@@ -17485,11 +17678,23 @@ var plugin44 = {
       category: "Diagnostics",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "refactor-suggester is disabled" };
+        if (!cfg.enabled) throw new Error("refactor-suggester is disabled");
         const raw = input ?? {};
         const rawPath = (typeof input.path === "string" && input.path.trim().length > 0 ? input.path.trim() : void 0) ?? (typeof raw["directory"] === "string" ? raw["directory"] : void 0) ?? (typeof raw["dir"] === "string" ? raw["dir"] : void 0) ?? (typeof raw["SearchDirectory"] === "string" ? raw["SearchDirectory"] : void 0) ?? (typeof raw["TargetFile"] === "string" ? raw["TargetFile"] : void 0) ?? (typeof raw["filePath"] === "string" ? raw["filePath"] : void 0) ?? (typeof raw["targetFile"] === "string" ? raw["targetFile"] : void 0) ?? ".";
         if (!(0, runtime_exports.withinProject)(rawPath)) {
-          return { ok: false, error: "path is outside the project root" };
+          throw new ToolValidationError21({
+            message: "path is outside the project root",
+            field: "path"
+          });
+        }
+        try {
+          await stat9(resolve20(process.cwd(), rawPath));
+        } catch (err) {
+          throw new ToolValidationError21({
+            message: `path does not exist or cannot be read: ${rawPath}`,
+            field: "path",
+            cause: err
+          });
         }
         state41.scanCount += 1;
         let result;
@@ -17497,7 +17702,7 @@ var plugin44 = {
           result = await scanPath4(rawPath, cfg);
         } catch (err) {
           state41.errorCount += 1;
-          return { ok: false, error: String(err) };
+          throw new Error(`refactor scan failed: ${String(err)}`, { cause: err });
         }
         state41.suggestionCount += result.suggestions.length;
         return {
@@ -17858,7 +18063,7 @@ var plugin45 = {
       category: "Development",
       mutating: false,
       async execute(input, _ctx, execOpts) {
-        if (!cfg.enabled) return { ok: false, error: "release-notes-generator is disabled" };
+        if (!cfg.enabled) throw new Error("release-notes-generator is disabled");
         execOpts?.signal?.throwIfAborted();
         const raw = input ?? {};
         const rawTo = input.to ?? raw["to_ref"] ?? raw["toRef"] ?? raw["until"] ?? raw["end"];
@@ -17873,7 +18078,7 @@ var plugin45 = {
           commits = await getCommits(fromRef, toRef, execOpts?.signal);
         } catch (err) {
           state42.errorCount += 1;
-          return { ok: false, error: String(err) };
+          throw new Error(`Could not read git history: ${String(err)}`, { cause: err });
         }
         state42.commitCount += commits.length;
         execOpts?.signal?.throwIfAborted();
@@ -18288,6 +18493,7 @@ ${body}${suffix}`;
 var schema_evolution_guard_default = plugin46;
 
 // src/secret-scanner/index.ts
+import { ToolValidationError as ToolValidationError22 } from "@wrongstack/core/types";
 var BASE_PATTERNS = cloneCredentialPatterns();
 var PATTERNS3 = [...BASE_PATTERNS];
 var GROUP_INDEX_OF_PATTERN = [];
@@ -18496,7 +18702,7 @@ function readConfig43(raw) {
 function buildHook(cfg, log, runtime) {
   return (input) => {
     activateRuntime(runtime);
-    const { state: state60 } = runtime;
+    const { state: state59 } = runtime;
     if (!cfg.enabled) return;
     const toolName = input.toolName ?? "unknown";
     let matched;
@@ -18504,7 +18710,7 @@ function buildHook(cfg, log, runtime) {
       matched = scanInput(input.toolInput);
     } catch (err) {
       if (String(err).includes("ReDoS")) {
-        state60.timeoutCount += 1;
+        state59.timeoutCount += 1;
         return {
           decision: "block",
           reason: "secret-scanner: ReDoS timeout \u2014 regex scan exceeded the wall-clock budget. Fail-closed: treated as a block."
@@ -18516,8 +18722,8 @@ function buildHook(cfg, log, runtime) {
     const summary = matched.join(", ");
     const when = (/* @__PURE__ */ new Date()).toISOString();
     if (cfg.mode === "block") {
-      state60.blockCount += 1;
-      state60.lastBlock = { toolName, matchedTypes: matched, when };
+      state59.blockCount += 1;
+      state59.lastBlock = { toolName, matchedTypes: matched, when };
       log.warn(`[secret-scanner] blocked ${toolName} \u2014 matched: ${summary}`);
       return {
         decision: "block",
@@ -18527,7 +18733,7 @@ function buildHook(cfg, log, runtime) {
     if (cfg.mode === "redact") {
       const redacted = redactInput(input.toolInput);
       if (redacted.ok && redacted.value !== null && typeof redacted.value === "object" && !Array.isArray(redacted.value)) {
-        state60.redactCount += 1;
+        state59.redactCount += 1;
         log.info(`[secret-scanner] redacted ${toolName} \u2014 matched: ${summary}`);
         return {
           decision: "allow",
@@ -18535,15 +18741,15 @@ function buildHook(cfg, log, runtime) {
           additionalContext: `secret-scanner: redacted ${matched.length} credential pattern(s) from the ${toolName} arguments before execution.`
         };
       }
-      state60.blockCount += 1;
-      state60.lastBlock = { toolName, matchedTypes: matched, when };
+      state59.blockCount += 1;
+      state59.lastBlock = { toolName, matchedTypes: matched, when };
       const detail = !redacted.ok ? redacted.reason === "oversized_input" ? "an input field exceeds the safe scan limit" : "the input exceeds the safe nesting depth" : "the input has a non-object shape";
       return {
         decision: "block",
         reason: `secret-scanner: cannot safely redact '${toolName}' because ${detail}; refusing to run.`
       };
     }
-    state60.allowCount += 1;
+    state59.allowCount += 1;
     log.warn(
       `[secret-scanner] allow-mode: ${toolName} matched ${summary} but mode='allow' lets it through.`
     );
@@ -18553,7 +18759,7 @@ function buildHook(cfg, log, runtime) {
 function buildPostHook(cfg, log, runtime) {
   return (input) => {
     activateRuntime(runtime);
-    const { state: state60 } = runtime;
+    const { state: state59 } = runtime;
     if (!cfg.enabled) return;
     const result = input.toolResult;
     if (!result || typeof result.content !== "string") return;
@@ -18573,8 +18779,8 @@ function buildPostHook(cfg, log, runtime) {
     }
     const summary = credentialMatches.join(", ");
     const when = (/* @__PURE__ */ new Date()).toISOString();
-    state60.leakCount += 1;
-    state60.lastLeak = { toolName, matchedTypes: credentialMatches, when };
+    state59.leakCount += 1;
+    state59.lastLeak = { toolName, matchedTypes: credentialMatches, when };
     log.warn(`[secret-scanner] POST-TOOL LEAK: ${toolName} output matched ${summary}`);
     return {
       additionalContext: `
@@ -18652,13 +18858,13 @@ var plugin47 = {
     };
     runtimes.set(api, runtime);
     latestRuntime = runtime;
-    const { state: state60 } = runtime;
+    const { state: state59 } = runtime;
     const log = {
       warn: (msg, ...rest) => api.log.warn(msg, ...rest),
       info: (msg, ...rest) => api.log.info(msg, ...rest)
     };
     const hook = buildHook(cfg, log, runtime);
-    state60.hookUnregister = api.registerHook("PreToolUse", cfg.matcher, hook, {
+    state59.hookUnregister = api.registerHook("PreToolUse", cfg.matcher, hook, {
       name: "secret-scanner",
       // Redaction rewrites arguments; block/allow modes must inspect the final
       // result after every mutator has run so a later rewrite cannot smuggle a
@@ -18668,7 +18874,7 @@ var plugin47 = {
       policy: true
     });
     const postHook = buildPostHook(cfg, log, runtime);
-    state60.postHookUnregister = api.registerHook("PostToolUse", cfg.postToolUseMatcher, postHook);
+    state59.postHookUnregister = api.registerHook("PostToolUse", cfg.postToolUseMatcher, postHook);
     api.tools.register({
       name: "secret_scanner_status",
       description: "Reports the current secret-scanner state: pattern count, last block (if any), and per-mode invocation counters.",
@@ -18686,14 +18892,14 @@ var plugin47 = {
           patternCount: PATTERNS3.length,
           patternTypes: PATTERNS3.map((p) => p.type),
           counters: {
-            block: state60.blockCount,
-            redact: state60.redactCount,
-            allow: state60.allowCount,
-            leak: state60.leakCount,
-            timeoutCount: state60.timeoutCount
+            block: state59.blockCount,
+            redact: state59.redactCount,
+            allow: state59.allowCount,
+            leak: state59.leakCount,
+            timeoutCount: state59.timeoutCount
           },
-          lastBlock: state60.lastBlock,
-          lastLeak: state60.lastLeak
+          lastBlock: state59.lastBlock,
+          lastLeak: state59.lastLeak
         };
       }
     });
@@ -18711,9 +18917,14 @@ var plugin47 = {
       mutating: false,
       async execute(input) {
         activateRuntime(runtime);
-        const rawText = input["text"] ?? input["content"] ?? input["string"] ?? input["input"] ?? input["code"] ?? input["value"] ?? "";
-        const text = typeof rawText === "string" ? rawText : "";
-        const matched = findMatches(text);
+        const rawText = input["text"] ?? input["content"] ?? input["string"] ?? input["input"] ?? input["code"] ?? input["value"];
+        if (typeof rawText !== "string") {
+          throw new ToolValidationError22({
+            message: "text is required and must be a string",
+            field: "text"
+          });
+        }
+        const matched = findMatches(rawText);
         return {
           ok: true,
           matched,
@@ -18731,57 +18942,58 @@ var plugin47 = {
   teardown(api) {
     const runtime = runtimes.get(api);
     if (!runtime) return;
-    const { state: state60 } = runtime;
-    if (state60.hookUnregister) {
+    const { state: state59 } = runtime;
+    if (state59.hookUnregister) {
       try {
-        state60.hookUnregister();
+        state59.hookUnregister();
       } catch {
       }
-      state60.hookUnregister = null;
+      state59.hookUnregister = null;
     }
-    if (state60.postHookUnregister) {
+    if (state59.postHookUnregister) {
       try {
-        state60.postHookUnregister();
+        state59.postHookUnregister();
       } catch {
       }
-      state60.postHookUnregister = null;
+      state59.postHookUnregister = null;
     }
     const finalCounters = {
-      block: state60.blockCount,
-      redact: state60.redactCount,
-      allow: state60.allowCount,
-      leak: state60.leakCount
+      block: state59.blockCount,
+      redact: state59.redactCount,
+      allow: state59.allowCount,
+      leak: state59.leakCount
     };
-    state60.blockCount = 0;
-    state60.redactCount = 0;
-    state60.allowCount = 0;
-    state60.leakCount = 0;
-    state60.lastBlock = null;
-    state60.lastLeak = null;
+    state59.blockCount = 0;
+    state59.redactCount = 0;
+    state59.allowCount = 0;
+    state59.leakCount = 0;
+    state59.lastBlock = null;
+    state59.lastLeak = null;
     runtimes.delete(api);
     api.log.info("secret-scanner: teardown complete", { counters: finalCounters });
   },
   async health() {
-    const state60 = latestRuntime?.state ?? createState2();
+    const state59 = latestRuntime?.state ?? createState2();
     return {
       ok: true,
-      message: state60.lastLeak !== null ? `secret-scanner: last leak at ${state60.lastLeak.when} on ${state60.lastLeak.toolName} (${state60.lastLeak.matchedTypes.join(", ")})` : state60.lastBlock !== null ? `secret-scanner: last block at ${state60.lastBlock.when} on ${state60.lastBlock.toolName} (${state60.lastBlock.matchedTypes.join(", ")})` : `secret-scanner: ${state60.blockCount + state60.redactCount + state60.allowCount + state60.leakCount} invocations, no blocks or leaks`,
+      message: state59.lastLeak !== null ? `secret-scanner: last leak at ${state59.lastLeak.when} on ${state59.lastLeak.toolName} (${state59.lastLeak.matchedTypes.join(", ")})` : state59.lastBlock !== null ? `secret-scanner: last block at ${state59.lastBlock.when} on ${state59.lastBlock.toolName} (${state59.lastBlock.matchedTypes.join(", ")})` : `secret-scanner: ${state59.blockCount + state59.redactCount + state59.allowCount + state59.leakCount} invocations, no blocks or leaks`,
       counters: {
-        block: state60.blockCount,
-        redact: state60.redactCount,
-        allow: state60.allowCount,
-        leak: state60.leakCount
+        block: state59.blockCount,
+        redact: state59.redactCount,
+        allow: state59.allowCount,
+        leak: state59.leakCount
       },
-      lastBlock: state60.lastBlock,
-      lastLeak: state60.lastLeak
+      lastBlock: state59.lastBlock,
+      lastLeak: state59.lastLeak
     };
   }
 };
 var secret_scanner_default = plugin47;
 
 // src/security-hotspot-scanner/index.ts
-import { readdir as readdir2, readFile as readFile13, stat as stat5 } from "node:fs/promises";
+import { readdir as readdir2, readFile as readFile13, stat as stat10 } from "node:fs/promises";
 import { extname as extname5, isAbsolute as isAbsolute19, relative as relative19, resolve as resolve21 } from "node:path";
+import { ToolValidationError as ToolValidationError23 } from "@wrongstack/core/types";
 var API_VERSION31 = "^0.1.10";
 var state44 = {
   scanCount: 0,
@@ -18929,7 +19141,7 @@ async function scanPath5(inputPath, cfg) {
       if (allFindings.length >= cfg.maxFindings) return;
       const full = resolve21(dir, entry);
       try {
-        const st = await stat5(full);
+        const st = await stat10(full);
         if (st.isDirectory()) {
           if (entry.startsWith(".") || entry === "node_modules" || entry === "dist" || entry === "coverage") {
             continue;
@@ -18943,7 +19155,7 @@ async function scanPath5(inputPath, cfg) {
     }
   };
   try {
-    const st = await stat5(resolved);
+    const st = await stat10(resolved);
     if (st.isDirectory()) {
       await walk(resolved);
     } else if (st.isFile()) {
@@ -19095,7 +19307,7 @@ Review or remove the risky pattern(s).`;
       category: "Security",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "security-hotspot-scanner is disabled" };
+        if (!cfg.enabled) throw new Error("security-hotspot-scanner is disabled");
         const raw = input;
         const targetPath = (typeof input.path === "string" ? input.path : void 0) ?? (typeof raw["directory"] === "string" ? raw["directory"] : void 0) ?? (typeof raw["dir"] === "string" ? raw["dir"] : void 0) ?? (typeof raw["SearchDirectory"] === "string" ? raw["SearchDirectory"] : void 0) ?? (typeof raw["TargetFile"] === "string" ? raw["TargetFile"] : void 0) ?? (typeof raw["filePath"] === "string" ? raw["filePath"] : void 0) ?? (typeof raw["targetFile"] === "string" ? raw["targetFile"] : void 0) ?? ".";
         const result = await scanPath5(targetPath, cfg);
@@ -19103,7 +19315,10 @@ Review or remove the risky pattern(s).`;
         state44.fileScanCount += result.filesScanned;
         state44.findingCount += result.findings.length;
         if (!result.scanned) {
-          return { ok: false, error: result.error, path: targetPath };
+          throw new ToolValidationError23({
+            message: `cannot scan ${targetPath}: ${result.error ?? "unknown error"}`,
+            field: "path"
+          });
         }
         state44.lastResult = {
           path: result.path,
@@ -19201,6 +19416,7 @@ var security_hotspot_scanner_default = plugin48;
 // src/semantic-search-indexer/index.ts
 import * as fs2 from "node:fs/promises";
 import { isAbsolute as isAbsolute20, relative as relative20, resolve as resolve22 } from "node:path";
+import { ToolValidationError as ToolValidationError24 } from "@wrongstack/core/types";
 import { DEFAULT_WALK_IGNORE_DIRS } from "@wrongstack/core/utils";
 var API_VERSION32 = "^0.1.10";
 var escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -19710,16 +19926,31 @@ var plugin49 = {
       icon: "search",
       async execute(input) {
         if (!cfg.enabled) {
-          return { ok: false, error: "semantic-search-indexer is disabled" };
+          throw new Error("semantic-search-indexer is disabled");
         }
         const rawPath = input.path ?? input["directory"] ?? input["dir"] ?? input["SearchDirectory"] ?? input["SearchPath"] ?? input["TargetFile"] ?? input["targetFile"] ?? input["filePath"] ?? input["file"];
         const resolved = resolveProjectPath8(typeof rawPath === "string" ? rawPath : void 0);
         if (!resolved) {
-          return { ok: false, error: "path outside project root" };
+          throw new ToolValidationError24({ message: "path outside project root", field: "path" });
         }
-        await ensureIndex(resolved, cfg);
         const rawQuery = input.query ?? input["q"] ?? input["text"] ?? input["keyword"] ?? input["keywords"] ?? input["search"] ?? "";
         const query = String(rawQuery);
+        if (tokenize(query, cfg.minTokenLength).length === 0) {
+          throw new ToolValidationError24({
+            message: `query must contain at least one keyword of ${cfg.minTokenLength}+ characters`,
+            field: "query"
+          });
+        }
+        try {
+          await fs2.stat(resolved);
+        } catch (err) {
+          throw new ToolValidationError24({
+            message: `path does not exist or cannot be read: ${typeof rawPath === "string" ? rawPath : resolved}`,
+            field: "path",
+            cause: err
+          });
+        }
+        await ensureIndex(resolved, cfg);
         const limit = typeof input.limit === "number" && input.limit >= 1 ? Math.floor(input.limit) : cfg.defaultLimit;
         const results = runQuery(query, limit, cfg);
         const queryTokens = [...new Set(tokenize(query, cfg.minTokenLength))];
@@ -19843,10 +20074,26 @@ var semantic_search_indexer_default = plugin49;
 // src/semver-bump/index.ts
 import { expectDefined as expectDefined2 } from "@wrongstack/core/utils";
 import { toErrorMessage } from "@wrongstack/core/utils";
+import { ToolValidationError as ToolValidationError25 } from "@wrongstack/core/types";
 import { execFile as execFile11 } from "node:child_process";
 import { access as access4, readFile as readFile15, readdir as readdir4, writeFile as writeFile5 } from "node:fs/promises";
 import { isAbsolute as isAbsolute21, join as join5, relative as relative21, resolve as resolve23 } from "node:path";
 var API_VERSION33 = "^0.1.10";
+function requireProjectRoot(rawCwd) {
+  const safeCwd = resolveProjectRoot(rawCwd);
+  if (!safeCwd) {
+    throw new ToolValidationError25({
+      message: "cwd must stay within the current project directory",
+      field: "cwd"
+    });
+  }
+  return safeCwd;
+}
+function requireGitRef(field, ref) {
+  if (ref !== void 0 && (typeof ref !== "string" || ref.startsWith("-"))) {
+    throw new ToolValidationError25({ message: `${field} is not a valid git ref`, field });
+  }
+}
 function resolveProjectRoot(rawCwd, root = process.cwd()) {
   if (typeof rawCwd !== "string" || rawCwd.length === 0) return root;
   const base = resolve23(root);
@@ -20092,14 +20339,10 @@ var plugin50 = {
       defaultPart = readDefaultPart(next);
     });
     async function performBump(part, dryRun, cwd) {
-      const safeCwd = resolveProjectRoot(cwd);
-      if (!safeCwd) {
-        return { ok: false, error: "cwd must stay within the current project directory" };
-      }
-      cwd = safeCwd;
+      cwd = requireProjectRoot(cwd);
       const pkg = await getPackageJson(cwd);
       if (!pkg) {
-        return { ok: false, error: "No package.json found" };
+        throw new Error("No package.json found");
       }
       const currentVersion = pkg.version;
       let bumpPart = part;
@@ -20114,8 +20357,7 @@ var plugin50 = {
         try {
           commits = await getRecentCommits(lastTag, cwd);
         } catch (err) {
-          const msg = toErrorMessage(err);
-          return { ok: false, error: `Git error: ${msg}`, bumpPart: "patch" };
+          throw new Error(`Git error: ${toErrorMessage(err)}`, { cause: err });
         }
         bumpPart = determineBump(commits);
       } else {
@@ -20147,8 +20389,7 @@ var plugin50 = {
         try {
           await runCommand3(process.execPath, [bumpScript, "set", newVersion], root);
         } catch (err) {
-          const msg = toErrorMessage(err);
-          return { ok: false, error: `bump script failed: ${msg}` };
+          throw new Error(`bump script failed: ${toErrorMessage(err)}`, { cause: err });
         }
         for (const rel of ["package.json", "package-lock.json", "src/lib/utils.ts", "index.html"]) {
           const p = join5(root, "website", rel);
@@ -20165,16 +20406,15 @@ var plugin50 = {
           try {
             pkgData = JSON.parse(await readFile15(manifest, "utf-8"));
           } catch (err) {
-            return {
-              ok: false,
-              error: `cannot bump: ${manifest} is not readable as JSON (${toErrorMessage(err)}). No manifests were modified.`
-            };
+            throw new Error(
+              `cannot bump: ${manifest} is not readable as JSON (${toErrorMessage(err)}). No manifests were modified.`,
+              { cause: err }
+            );
           }
           if (!pkgData || typeof pkgData !== "object") {
-            return {
-              ok: false,
-              error: `cannot bump: ${manifest} does not contain a JSON object. No manifests were modified.`
-            };
+            throw new Error(
+              `cannot bump: ${manifest} does not contain a JSON object. No manifests were modified.`
+            );
           }
           pkgData.version = newVersion;
           pending.push({ path: manifest, contents: `${JSON.stringify(pkgData, null, 2)}
@@ -20184,16 +20424,20 @@ var plugin50 = {
           await writeFile5(path, contents, "utf-8");
         }
       }
+      let commitError;
       try {
         await runGit6(["add", "--", ...changed], cwd);
         await runGit6(["commit", "-m", `chore: bump version to ${newVersion}`], cwd);
-      } catch {
+      } catch (err) {
+        commitError = toErrorMessage(err);
       }
+      let tagError;
       if (autoTag) {
         try {
           const msg = tagMessage.replace("{{version}}", newVersion);
           await runGit6(["tag", "-a", `${tagPrefix}${newVersion}`, "-m", msg], cwd);
-        } catch {
+        } catch (err) {
+          tagError = toErrorMessage(err);
         }
       }
       api.log.info("semver-bump: bumped", { from: currentVersion, to: newVersion, bump: bumpPart });
@@ -20213,13 +20457,22 @@ var plugin50 = {
         commitCount: commits.length,
         breakingCount: commits.filter((c) => c.breaking).length
       };
+      const tagged = autoTag && tagError === void 0;
+      const warnings = [
+        ...commitError ? [`commit failed: ${commitError}`] : [],
+        ...tagError ? [`tag failed: ${tagError}`] : []
+      ];
       return {
         ok: true,
         currentVersion,
         newVersion,
         bump: bumpPart,
-        tag: `${tagPrefix}${newVersion}`,
-        message: `Bumped ${currentVersion} \u2192 ${newVersion} (${bumpPart})`
+        // Only name the tag when it was actually created.
+        tag: tagged ? `${tagPrefix}${newVersion}` : null,
+        committed: commitError === void 0,
+        tagged,
+        ...warnings.length > 0 ? { warnings } : {},
+        message: `Bumped ${currentVersion} \u2192 ${newVersion} (${bumpPart})` + (warnings.length > 0 ? ` \u2014 ${warnings.join("; ")}` : "")
       };
     }
     api.tools.register({
@@ -20305,9 +20558,13 @@ var plugin50 = {
         if (!safeCwd) {
           return { message: "cwd must stay within the current project directory" };
         }
-        const result = await performBump(mode, dry, safeCwd);
-        return { message: String(result["message"] ?? result["error"] ?? JSON.stringify(result)) };
-      }
+        try {
+          const result = await performBump(mode, dry, safeCwd);
+          return { message: String(result["message"] ?? JSON.stringify(result)) };
+        } catch (err) {
+          return { message: toErrorMessage(err) };
+        }
+      }
     });
     api.tools.register({
       name: "semver_current",
@@ -20323,11 +20580,7 @@ var plugin50 = {
       async execute(input) {
         state46.invocationCount += 1;
         state46.perTool["semver_current"] = (state46.perTool["semver_current"] ?? 0) + 1;
-        const cwdInput = input["cwd"];
-        const safeCwd = resolveProjectRoot(cwdInput);
-        if (!safeCwd) {
-          return { ok: false, error: "cwd must stay within the current project directory" };
-        }
+        const safeCwd = requireProjectRoot(input["cwd"]);
         const pkg = await getPackageJson(safeCwd);
         const currentVersion = pkg?.version ?? "unknown";
         let latestTag = null;
@@ -20373,22 +20626,20 @@ var plugin50 = {
         state46.perTool["semver_changelog"] = (state46.perTool["semver_changelog"] ?? 0) + 1;
         const from = input["from"];
         const to = input["to"] ?? "HEAD";
-        const cwd = input["cwd"];
-        const safeCwd = resolveProjectRoot(cwd);
-        if (!safeCwd) {
-          return { ok: false, error: "cwd must stay within the current project directory" };
-        }
+        requireGitRef("from", from);
+        requireGitRef("to", to);
+        const safeCwd = requireProjectRoot(input["cwd"]);
         const format = input["format"] ?? "markdown";
-        const range = from ? `${from}..${to}` : to;
+        const rangeArgs = from ? [`${from}..${to}`] : ["-30", to];
         let commits;
         try {
           const output = await runGit6(
-            ["log", range === to ? "-30" : range, "--format=%H%x1f%s%x1f%b%x1e"],
+            ["log", ...rangeArgs, "--format=%H%x1f%s%x1f%b%x1e"],
             safeCwd
           );
           commits = parseGitLogOutput(output);
         } catch (err) {
-          return { ok: false, error: `Failed to get git log: ${err}` };
+          throw new Error(`Failed to get git log: ${toErrorMessage(err)}`, { cause: err });
         }
         if (format === "json") {
           return {
@@ -20656,8 +20907,10 @@ var plugin51 = {
       const offTool = api.onPattern("tool.*", (eventName, payload) => {
         touchActivity();
         const p = payload;
-        const toolName = p?.tool ?? p?.name ?? eventName;
-        if (typeof toolName === "string") bumpToolCount(toolName);
+        const rawTool = p?.tool;
+        const nameOf = (v) => typeof v === "string" ? v : v && typeof v === "object" && typeof v.name === "string" ? v.name : void 0;
+        const toolName = nameOf(rawTool) ?? nameOf(p?.name) ?? eventName;
+        bumpToolCount(toolName);
         if (toolName === "git_autocommit" || toolName.startsWith("git ")) {
         }
       });
@@ -20903,6 +21156,7 @@ Tokens: ${recap.tokens.total.input} in / ${recap.tokens.total.output} out
 var session_recap_default = plugin51;
 
 // src/shell-check/index.ts
+import { ToolValidationError as ToolValidationError26 } from "@wrongstack/core/types";
 import { execFile as execFile12 } from "node:child_process";
 import { readdir as readdir5 } from "node:fs/promises";
 import { isAbsolute as isAbsolute22, join as join6, relative as relative22, resolve as resolve24 } from "node:path";
@@ -20976,8 +21230,11 @@ async function runShellCheck(files, severity, cwd) {
         }
       );
     });
-  } catch {
-    return [];
+  } catch (err) {
+    throw new Error(
+      `shellcheck failed without output: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
   }
   if (!raw.trim()) return [];
   try {
@@ -20990,22 +21247,31 @@ async function runShellCheck(files, severity, cwd) {
       code: item.code,
       message: item.message
     }));
-  } catch {
-    return [];
+  } catch (err) {
+    throw new Error(`shellcheck returned unparseable output: ${raw.trim().slice(0, 500)}`, {
+      cause: err
+    });
   }
 }
-async function findShellFiles(dir, pattern) {
+async function findShellFiles(dir, pattern, isRoot = true) {
   const results = [];
   let entries;
   try {
     entries = await readdir5(dir, { withFileTypes: true });
-  } catch {
+  } catch (err) {
+    if (isRoot) {
+      throw new ToolValidationError26({
+        message: `directory does not exist or cannot be read: ${dir}`,
+        field: "directory",
+        cause: err
+      });
+    }
     return results;
   }
   for (const entry of entries) {
     const full = join6(dir, entry.name);
     if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== ".git") {
-      results.push(...await findShellFiles(full, pattern));
+      results.push(...await findShellFiles(full, pattern, false));
     } else if (entry.isFile() && (entry.name.endsWith(".sh") || entry.name.endsWith(".bash") || entry.name.endsWith(".zsh") || entry.name === "Dockerfile" || entry.name === ".bashrc" || entry.name === ".zshrc")) {
       if (!pattern || entry.name.includes(pattern)) {
         results.push(full);
@@ -21075,12 +21341,8 @@ var plugin52 = {
             enum: ["error", "warning", "info", "style"],
             default: "warning",
             description: "Minimum severity level to report"
-          },
-          fix: {
-            type: "boolean",
-            default: false,
-            description: "Apply safe automatic fixes where possible"
           }
+          // `fix` was declared ("apply safe automatic fixes") but never implemented.
         }
       },
       permission: "auto",
@@ -21106,22 +21368,16 @@ var plugin52 = {
         state48.invocationCount += 1;
         const pathIsSafe = (p) => typeof p === "string" && p.length > 0 && p.length <= MAX_PATH_LEN && withinProject22(p);
         if (!pathIsSafe(directory)) {
-          return {
-            ok: false,
-            error: `directory path is outside the project root: ${directory}`,
-            issues: [],
-            filesScanned: 0,
-            rejectedOutsideProject: true
-          };
+          throw new ToolValidationError26({
+            message: `directory path is outside the project root: ${directory}`,
+            field: "directory"
+          });
         }
         if (files?.some((f) => !pathIsSafe(f))) {
-          return {
-            ok: false,
-            error: "one or more file paths are outside the project root",
-            issues: [],
-            filesScanned: 0,
-            rejectedOutsideProject: true
-          };
+          throw new ToolValidationError26({
+            message: "one or more file paths are outside the project root",
+            field: "files"
+          });
         }
         let checkFiles;
         let scannedDirectories = false;
@@ -21147,19 +21403,7 @@ var plugin52 = {
             mode: scannedDirectories ? "directory" : "files"
           };
         }
-        let issues;
-        try {
-          issues = await runShellCheck(checkFiles, severity);
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          return {
-            ok: false,
-            error: msg,
-            issues: [],
-            filesScanned: 0,
-            mode: scannedDirectories ? "directory" : "files"
-          };
-        }
+        const issues = await runShellCheck(checkFiles, severity);
         const byFile = {};
         for (const issue of issues) {
           if (byFile[issue.file] === void 0) {
@@ -21227,6 +21471,7 @@ var shell_check_default = plugin52;
 // src/smart-rename/index.ts
 import { readFileSync as readFileSync13, writeFileSync as writeFileSync2 } from "node:fs";
 import { extname as extname6, isAbsolute as isAbsolute23, relative as relative23, resolve as resolve25 } from "node:path";
+import { ToolValidationError as ToolValidationError27 } from "@wrongstack/core/types";
 var NEW_API_VERSION = "^0.1.10";
 var state49 = {
   renameCount: 0,
@@ -21332,32 +21577,44 @@ var plugin53 = {
       mutating: true,
       capabilities: ["fs.write"],
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "smart-rename is disabled" };
+        if (!cfg.enabled) throw new Error("smart-rename is disabled");
         const inp = input ?? {};
         const rawPath = inp["path"] ?? inp["filePath"] ?? inp["file_path"] ?? inp["TargetFile"] ?? inp["targetFile"] ?? inp["file"];
         const oldName = inp["oldName"] ?? inp["old_name"] ?? inp["from"];
         const newName = inp["newName"] ?? inp["new_name"] ?? inp["to"];
         if (!rawPath || typeof rawPath !== "string") {
-          return { ok: false, error: "path is required" };
+          throw new ToolValidationError27({ message: "path is required", field: "path" });
         }
         if (!oldName || typeof oldName !== "string" || oldName.length === 0) {
-          return { ok: false, error: "oldName is required" };
+          throw new ToolValidationError27({ message: "oldName is required", field: "oldName" });
         }
         if (!newName || typeof newName !== "string" || newName.length === 0) {
-          return { ok: false, error: "newName is required" };
+          throw new ToolValidationError27({ message: "newName is required", field: "newName" });
         }
         if (!isIdentifier(oldName)) {
-          return { ok: false, error: `oldName "${oldName}" is not a valid identifier` };
+          throw new ToolValidationError27({
+            message: `oldName "${oldName}" is not a valid identifier`,
+            field: "oldName"
+          });
         }
         if (!isIdentifier(newName)) {
-          return { ok: false, error: `newName "${newName}" is not a valid identifier` };
+          throw new ToolValidationError27({
+            message: `newName "${newName}" is not a valid identifier`,
+            field: "newName"
+          });
         }
         if (!withinProject23(rawPath)) {
-          return { ok: false, error: "path is outside the project root" };
+          throw new ToolValidationError27({
+            message: "path is outside the project root",
+            field: "path"
+          });
         }
         const ext = extname6(rawPath).toLowerCase();
         if (!cfg.extensions.includes(ext)) {
-          return { ok: false, error: `extension ${ext} is not allowed for rename` };
+          throw new ToolValidationError27({
+            message: `extension ${ext} is not allowed for rename`,
+            field: "path"
+          });
         }
         const resolved = resolve25(process.cwd(), rawPath);
         let content;
@@ -21365,7 +21622,7 @@ var plugin53 = {
           content = readFileSync13(resolved, "utf-8");
         } catch (err) {
           state49.errorCount += 1;
-          return { ok: false, error: String(err) };
+          throw new Error(`Could not read ${rawPath}: ${String(err)}`, { cause: err });
         }
         const { preview, replacements } = renameInContent(content, oldName, newName);
         state49.renameCount += 1;
@@ -21378,7 +21635,7 @@ var plugin53 = {
             writeFileSync2(resolved, preview, "utf-8");
           } catch (err) {
             state49.errorCount += 1;
-            return { ok: false, error: String(err) };
+            throw new Error(`Could not write ${rawPath}: ${String(err)}`, { cause: err });
           }
         }
         return {
@@ -21811,8 +22068,8 @@ var plugin54 = {
       state50.postInvocations += 1;
       let content;
       try {
-        const stat8 = await fs3.stat(filePath);
-        if (!stat8.isFile()) return;
+        const stat13 = await fs3.stat(filePath);
+        if (!stat13.isFile()) return;
         content = await fs3.readFile(filePath, "utf-8");
       } catch {
         state50.readErrorCount += 1;
@@ -21962,6 +22219,7 @@ var spec_linker_default = plugin54;
 // src/template-engine/index.ts
 import { readFile as readFile17, writeFile as writeFile6 } from "node:fs/promises";
 import { isAbsolute as isAbsolute24 } from "node:path";
+import { ToolValidationError as ToolValidationError28 } from "@wrongstack/core/types";
 var API_VERSION35 = "^0.1.10";
 var templates = /* @__PURE__ */ new Map();
 var MAX_TEMPLATES = 256;
@@ -22123,24 +22381,26 @@ var plugin55 = {
         const output_path = typeof rawOutputPath === "string" && rawOutputPath.trim().length > 0 ? rawOutputPath.trim() : void 0;
         const raw = input["raw"] ?? false;
         if (!template || typeof template !== "string") {
-          return { ok: false, error: "template is required and must be a string" };
+          throw new ToolValidationError28({
+            message: "template is required and must be a string",
+            field: "template"
+          });
         }
         if (!variables || typeof variables !== "object") {
-          return { ok: false, error: "variables is required and must be an object" };
-        }
-        let result;
-        try {
-          result = raw ? renderTemplateRaw(template, variables) : renderTemplate(template, variables, autoEscapeHtml);
-        } catch (err) {
-          return { ok: false, error: String(err) };
+          throw new ToolValidationError28({
+            message: "variables is required and must be an object",
+            field: "variables"
+          });
         }
+        const result = raw ? renderTemplateRaw(template, variables) : renderTemplate(template, variables, autoEscapeHtml);
         if (output_path) {
           const pathError = validateWritableTemplateTarget("output_path", output_path);
-          if (pathError) return { ok: false, error: pathError };
+          if (pathError)
+            throw new ToolValidationError28({ message: pathError, field: "output_path" });
           try {
             await writeFile6(output_path, result, "utf-8");
           } catch (err) {
-            return { ok: false, error: `Could not write ${output_path}: ${String(err)}` };
+            throw new Error(`Could not write ${output_path}: ${String(err)}`, { cause: err });
           }
           return {
             ok: true,
@@ -22191,32 +22451,36 @@ var plugin55 = {
         const output_path = typeof rawOutputPath === "string" && rawOutputPath.trim().length > 0 ? rawOutputPath.trim() : void 0;
         const raw = input["raw"] ?? false;
         if (!template_path || typeof template_path !== "string") {
-          return { ok: false, error: "template_path is required and must be a string" };
+          throw new ToolValidationError28({
+            message: "template_path is required and must be a string",
+            field: "template_path"
+          });
         }
         const templatePathError = validateRelativeTemplatePath("template_path", template_path);
-        if (templatePathError) return { ok: false, error: templatePathError };
+        if (templatePathError) {
+          throw new ToolValidationError28({ message: templatePathError, field: "template_path" });
+        }
         if (!variables || typeof variables !== "object") {
-          return { ok: false, error: "variables is required and must be an object" };
+          throw new ToolValidationError28({
+            message: "variables is required and must be an object",
+            field: "variables"
+          });
         }
         let content;
         try {
           content = await readFile17(template_path, "utf-8");
         } catch (err) {
-          return { ok: false, error: `Could not read template file: ${err}` };
-        }
-        let result;
-        try {
-          result = raw ? renderTemplateRaw(content, variables) : renderTemplate(content, variables, autoEscapeHtml);
-        } catch (err) {
-          return { ok: false, error: `Template rendering failed: ${err}` };
+          throw new Error(`Could not read template file: ${String(err)}`, { cause: err });
         }
+        const result = raw ? renderTemplateRaw(content, variables) : renderTemplate(content, variables, autoEscapeHtml);
         if (output_path) {
           const pathError = validateWritableTemplateTarget("output_path", output_path);
-          if (pathError) return { ok: false, error: pathError };
+          if (pathError)
+            throw new ToolValidationError28({ message: pathError, field: "output_path" });
           try {
             await writeFile6(output_path, result, "utf-8");
           } catch (err) {
-            return { ok: false, error: `Could not write ${output_path}: ${String(err)}` };
+            throw new Error(`Could not write ${output_path}: ${String(err)}`, { cause: err });
           }
           return {
             ok: true,
@@ -22267,30 +22531,39 @@ var plugin55 = {
         const rawDesc = input["description"] ?? input["desc"] ?? input["summary"];
         const description = typeof rawDesc === "string" ? rawDesc : void 0;
         if (!name || typeof name !== "string" || name.trim() === "") {
-          return { ok: false, error: "name is required and must be a non-empty string" };
+          throw new ToolValidationError28({
+            message: "name is required and must be a non-empty string",
+            field: "name"
+          });
         }
         if (!content || typeof content !== "string") {
-          return { ok: false, error: "content is required and must be a string" };
+          throw new ToolValidationError28({
+            message: "content is required and must be a string",
+            field: "content"
+          });
         }
         if (name.length > MAX_TEMPLATE_NAME_CHARS) {
-          return { ok: false, error: `name exceeds ${MAX_TEMPLATE_NAME_CHARS} characters` };
+          throw new ToolValidationError28({
+            message: `name exceeds ${MAX_TEMPLATE_NAME_CHARS} characters`,
+            field: "name"
+          });
         }
         if (content.length > MAX_TEMPLATE_CONTENT_CHARS) {
-          return {
-            ok: false,
-            error: `content exceeds ${MAX_TEMPLATE_CONTENT_CHARS} characters`
-          };
+          throw new ToolValidationError28({
+            message: `content exceeds ${MAX_TEMPLATE_CONTENT_CHARS} characters`,
+            field: "content"
+          });
         }
         if (description && description.length > MAX_TEMPLATE_DESCRIPTION_CHARS) {
-          return {
-            ok: false,
-            error: `description exceeds ${MAX_TEMPLATE_DESCRIPTION_CHARS} characters`
-          };
+          throw new ToolValidationError28({
+            message: `description exceeds ${MAX_TEMPLATE_DESCRIPTION_CHARS} characters`,
+            field: "description"
+          });
         }
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const existing = templates.get(name);
         if (!existing && templates.size >= MAX_TEMPLATES) {
-          return { ok: false, error: `template limit reached (${MAX_TEMPLATES})` };
+          throw new Error(`template limit reached (${MAX_TEMPLATES})`);
         }
         const tmpl = {
           name,
@@ -22303,10 +22576,7 @@ var plugin55 = {
         for (const stored of templates.values()) retainedChars += templateChars(stored);
         const nextChars = retainedChars - (existing ? templateChars(existing) : 0) + templateChars(tmpl);
         if (nextChars > MAX_TOTAL_TEMPLATE_CHARS) {
-          return {
-            ok: false,
-            error: `template store exceeds ${MAX_TOTAL_TEMPLATE_CHARS} retained characters`
-          };
+          throw new Error(`template store exceeds ${MAX_TOTAL_TEMPLATE_CHARS} retained characters`);
         }
         templates.set(name, tmpl);
         api.metrics.gauge("template_count", templates.size);
@@ -22635,6 +22905,7 @@ import { execFile as execFile13 } from "node:child_process";
 import { readFileSync as readFileSync15 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { dirname as dirname8, isAbsolute as isAbsolute25, relative as relative24, resolve as resolve26 } from "node:path";
+import { ToolValidationError as ToolValidationError29 } from "@wrongstack/core/types";
 var API_VERSION37 = "^0.1.10";
 var state52 = {
   invocationCount: 0,
@@ -22885,7 +23156,7 @@ var plugin57 = {
       mutating: false,
       async execute(input) {
         if (!cfg.enabled) {
-          return { ok: false, error: "test-flake-detector is disabled" };
+          throw new Error("test-flake-detector is disabled");
         }
         const raw = input;
         const rawPattern = input.testPattern ?? raw["pattern"] ?? raw["path"] ?? raw["file"] ?? raw["filePath"] ?? raw["TargetFile"] ?? raw["targetFile"];
@@ -22896,10 +23167,10 @@ var plugin57 = {
         const requestedRuns = typeof rawRuns === "number" && rawRuns >= 1 ? Math.min(Math.floor(rawRuns), cfg.maxRuns) : 5;
         const command = resolveTestCommand(commandString, testPattern);
         if (!command) {
-          return {
-            ok: false,
-            error: "Unsupported test command or unsafe testPattern. Use vitest, jest, or mocha through a supported package runner, and keep patterns inside the project."
-          };
+          throw new ToolValidationError29({
+            message: "Unsupported test command or unsafe testPattern. Use vitest, jest, or mocha through a supported package runner, and keep patterns inside the project.",
+            field: "command"
+          });
         }
         state52.invocationCount += 1;
         const start = Date.now();
@@ -22927,6 +23198,11 @@ var plugin57 = {
           }
         }
         const all = Array.from(records.values());
+        if (all.length === 0 && runErrors.length === requestedRuns) {
+          throw new Error(
+            `test command produced no test results in ${requestedRuns} run(s): ${runErrors.slice(0, 3).join("; ")}`
+          );
+        }
         const flakyTests = all.filter((r) => r.passCount > 0 && r.failCount > 0);
         const alwaysFailing = all.filter((r) => r.passCount === 0 && r.failCount > 0);
         const alwaysPassing = all.filter((r) => r.passCount > 0 && r.failCount === 0);
@@ -23014,6 +23290,7 @@ var test_flake_detector_default = plugin57;
 // src/test-generator/index.ts
 import { readFileSync as readFileSync16 } from "node:fs";
 import { isAbsolute as isAbsolute26, relative as relative25, resolve as resolve27 } from "node:path";
+import { ToolValidationError as ToolValidationError30 } from "@wrongstack/core/types";
 var API_VERSION38 = "^0.1.10";
 var state53 = {
   generateCount: 0,
@@ -23302,7 +23579,7 @@ var plugin58 = {
       category: "Development",
       mutating: false,
       async execute(input, _ctx, execOpts) {
-        if (!cfg.enabled) return { ok: false, error: "test-generator is disabled" };
+        if (!cfg.enabled) throw new Error("test-generator is disabled");
         execOpts?.signal?.throwIfAborted();
         const inp = input ?? {};
         const rawFramework = inp["framework"];
@@ -23313,16 +23590,19 @@ var plugin58 = {
         };
         const rawPath = inp["path"] ?? inp["filePath"] ?? inp["file_path"] ?? inp["TargetFile"] ?? inp["targetFile"] ?? inp["file"];
         if (!rawPath || typeof rawPath !== "string") {
-          return { ok: false, error: "path is required" };
+          throw new ToolValidationError30({ message: "path is required", field: "path" });
         }
         if (!withinProject27(rawPath)) {
-          return { ok: false, error: "path is outside the project root" };
+          throw new ToolValidationError30({
+            message: "path is outside the project root",
+            field: "path"
+          });
         }
         if (!SOURCE_EXTENSIONS.some((ext) => rawPath.toLowerCase().endsWith(ext))) {
-          return {
-            ok: false,
-            error: `test generation only reads source files (${SOURCE_EXTENSIONS.join(", ")}); refusing "${rawPath}"`
-          };
+          throw new ToolValidationError30({
+            message: `test generation only reads source files (${SOURCE_EXTENSIONS.join(", ")}); refusing "${rawPath}"`,
+            field: "path"
+          });
         }
         const resolved = resolve27(process.cwd(), rawPath);
         state53.generateCount += 1;
@@ -23331,7 +23611,7 @@ var plugin58 = {
           result = generateForFile(resolved, effectiveCfg);
         } catch (err) {
           state53.errorCount += 1;
-          return { ok: false, error: String(err) };
+          throw new Error(`Could not read ${rawPath}: ${String(err)}`, { cause: err });
         }
         state53.exportCount += result.exports.length;
         const raw = input ?? {};
@@ -24152,451 +24432,632 @@ var todo_listener_default = plugin60;
 // src/todo-tracker/index.ts
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
-import { dirname as dirname10 } from "node:path";
-import { atomicWrite as atomicWrite3, ensureDir as ensureDir3 } from "@wrongstack/core/utils";
+import { basename as basename7, dirname as dirname10, extname as extname8 } from "node:path";
+import { ToolValidationError as ToolValidationError31 } from "@wrongstack/core/types";
+import { atomicWrite as atomicWrite3, ensureDir as ensureDir3, withFileLock } from "@wrongstack/core/utils";
 import { nowIso } from "@wrongstack/primitives";
+var STATUSES = ["pending", "in_progress", "completed", "dropped"];
+var PRIORITIES = ["low", "normal", "high"];
+var defaultDeps = {
+  readFile: (p) => fsp.readFile(p, "utf8"),
+  rename: (from, to) => fsp.rename(from, to),
+  atomicWrite: (p, content, opts) => atomicWrite3(p, content, opts),
+  withFileLock: (p, fn) => withFileLock(p, fn),
+  ensureDir: (dir) => ensureDir3(dir)
+};
+function deriveProjectSlug(filePath) {
+  const base = basename7(filePath.replace(/[\\/]+$/, "").replace(/\\/g, "/"));
+  const ext = extname8(base);
+  const stem = ext && ext !== base ? base.slice(0, -ext.length) : base;
+  return stem || "tracker";
+}
 function deriveFilePath(api) {
   const raw = api.config.extensions?.["todo-tracker"];
   const rawPath = raw?.["filePath"] ?? raw?.["file_path"] ?? raw?.["path"] ?? raw?.["file"] ?? raw?.["targetFile"];
   const explicit = typeof rawPath === "string" && rawPath.trim().length > 0 ? rawPath.trim() : null;
   if (explicit) {
-    const base = explicit.replace(/[\\/]+$/, "").split(/[\\/]/).pop() ?? "tracker";
-    return { filePath: explicit, projectSlug: base };
+    return { filePath: explicit, projectSlug: deriveProjectSlug(explicit) };
   }
   return { filePath: null, projectSlug: null };
 }
 var FILE_VERSION = 1;
-async function loadFile(filePath) {
-  let raw;
+var isStr = (v) => typeof v === "string";
+var isOptStr = (v) => v === void 0 || v === null || typeof v === "string";
+function validateItem(raw, index) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return `items[${index}] is not an object`;
+  }
+  const it = raw;
+  if (!isStr(it["id"]) || it["id"].length === 0) return `items[${index}].id is not a string`;
+  if (!isStr(it["content"])) return `items[${index}].content is not a string`;
+  if (!STATUSES.includes(it["status"])) {
+    return `items[${index}].status is not one of ${STATUSES.join("|")}`;
+  }
+  if (!PRIORITIES.includes(it["priority"])) {
+    return `items[${index}].priority is not one of ${PRIORITIES.join("|")}`;
+  }
+  if (!Array.isArray(it["tags"]) || !it["tags"].every(isStr)) {
+    return `items[${index}].tags is not a string[]`;
+  }
+  if (!isStr(it["createdAt"]) || !isStr(it["updatedAt"])) {
+    return `items[${index}] timestamps are not strings`;
+  }
+  if (!isOptStr(it["completedAt"]) || !isOptStr(it["sourceSessionId"]) || !isOptStr(it["notes"])) {
+    return `items[${index}] optional fields are not string|null`;
+  }
+  return {
+    id: it["id"],
+    content: it["content"],
+    status: it["status"],
+    priority: it["priority"],
+    tags: [...it["tags"]],
+    createdAt: it["createdAt"],
+    updatedAt: it["updatedAt"],
+    completedAt: it["completedAt"] ?? null,
+    sourceSessionId: it["sourceSessionId"] ?? null,
+    notes: it["notes"] ?? null
+  };
+}
+function parseTrackerFile(rawText) {
+  const text = rawText.charCodeAt(0) === 65279 ? rawText.slice(1) : rawText;
+  let parsed;
   try {
-    raw = await fsp.readFile(filePath, "utf8");
+    parsed = JSON.parse(text);
   } catch (err) {
-    if (err.code === "ENOENT") return null;
-    throw err;
+    return { kind: "corrupt", reason: `invalid JSON: ${err.message}` };
   }
-  try {
-    const parsed = JSON.parse(raw);
-    if (parsed.version !== FILE_VERSION || !Array.isArray(parsed.items)) {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { kind: "corrupt", reason: "top-level value is not an object" };
   }
-}
-async function saveFile(filePath, file) {
-  await ensureDir3(dirname10(filePath));
-  await atomicWrite3(filePath, JSON.stringify(file, null, 2), { mode: 384 });
-}
-var state56 = {
-  filePath: null,
-  projectSlug: null,
-  file: null,
-  addCount: 0,
-  completeCount: 0,
-  dropCount: 0,
-  removeCount: 0,
-  pullCount: 0,
-  /** Most recent mutation for /diag plugins visibility. */
-  lastMutation: null
-};
-function ensureFile() {
-  if (!state56.file) {
-    state56.file = {
+  const obj = parsed;
+  if (typeof obj["version"] !== "number") {
+    return { kind: "corrupt", reason: "missing or non-numeric version" };
+  }
+  if (obj["version"] !== FILE_VERSION) {
+    return { kind: "unsupportedVersion", version: obj["version"] };
+  }
+  if (!Array.isArray(obj["items"])) {
+    return { kind: "invalidItems", reason: "items is not an array" };
+  }
+  const items = [];
+  for (const [i, rawItem] of obj["items"].entries()) {
+    const v = validateItem(rawItem, i);
+    if (typeof v === "string") return { kind: "invalidItems", reason: v };
+    items.push(v);
+  }
+  return {
+    kind: "ok",
+    file: {
       version: FILE_VERSION,
-      projectSlug: state56.projectSlug ?? "unconfigured",
-      updatedAt: nowIso(),
-      items: []
-    };
+      // Any stored slug is accepted (older versions stored the basename
+      // including the extension); the current slug is written on next save.
+      projectSlug: isStr(obj["projectSlug"]) ? obj["projectSlug"] : "",
+      updatedAt: isStr(obj["updatedAt"]) ? obj["updatedAt"] : "",
+      items
+    }
+  };
+}
+async function loadFile(deps, filePath) {
+  let raw;
+  try {
+    raw = await deps.readFile(filePath);
+  } catch (err) {
+    if (err.code === "ENOENT") return { kind: "missing" };
+    throw err;
   }
-  return state56.file;
+  return parseTrackerFile(raw);
 }
-function recordMutation(op, itemId) {
-  state56.lastMutation = { op, itemId, when: nowIso() };
-  if (op === "add") state56.addCount += 1;
-  else if (op === "complete") state56.completeCount += 1;
-  else if (op === "drop") state56.dropCount += 1;
-  else if (op === "remove") state56.removeCount += 1;
-  else if (op === "pull") state56.pullCount += 1;
+function quarantineSuffix() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace(/:/g, "-");
 }
-function findItemIndex(id) {
-  return ensureFile().items.findIndex((it) => it.id === id);
+function emptyFile(slug) {
+  return { version: FILE_VERSION, projectSlug: slug, updatedAt: nowIso(), items: [] };
 }
-function notConfiguredError() {
-  return {
-    ok: false,
-    error: 'todo-tracker: no file path configured. Set `filePath` under `config.extensions["todo-tracker"]` or run inside a session where `paths.projectDir` is provided by the host (e.g. `wstack` CLI).'
-  };
+function requireItemId(input) {
+  const rawId = input["id"] ?? input["itemId"] ?? input["taskId"] ?? input["todoId"];
+  const id = typeof rawId === "string" ? rawId.trim() : "";
+  if (!id) throw new ToolValidationError31({ message: "id is required", field: "id" });
+  return id;
 }
-var plugin61 = {
-  name: "todo-tracker",
-  version: "0.1.0",
-  description: "Persistent, project-scoped todo backlog that survives across sessions",
-  apiVersion: "^0.1.10",
-  capabilities: { tools: true },
-  defaultConfig: {
-    filePath: ""
-  },
-  configSchema: {
-    type: "object",
-    properties: {
-      filePath: {
-        type: "string",
-        description: "Override the auto-derived per-project path. Defaults to <projectDir>/todo-tracker.json when `paths.projectDir` is provided by the host."
+function commonPrefixLength(a, b) {
+  const n = Math.min(a.length, b.length);
+  let i = 0;
+  while (i < n && a[i] === b[i]) i++;
+  return i;
+}
+function requireItemIndex(file, id) {
+  const idx = file.items.findIndex((it) => it.id === id);
+  if (idx !== -1) return idx;
+  const open = file.items.filter((it) => it.status === "pending" || it.status === "in_progress");
+  const pool = open.length > 0 ? open : file.items;
+  const candidates = [...pool].sort((a, b) => commonPrefixLength(b.id, id) - commonPrefixLength(a.id, id)).slice(0, 5).map((it) => `${it.id} ("${it.content.slice(0, 40)}")`);
+  const hint = candidates.length > 0 ? ` Known ${open.length > 0 ? "open " : ""}ids: ${candidates.join(", ")}` : " The tracker is empty.";
+  throw new ToolValidationError31({ message: `no item with id ${id}.${hint}`, field: "id" });
+}
+function createTodoTrackerPlugin(overrides = {}) {
+  const deps = { ...defaultDeps, ...overrides };
+  const instances = /* @__PURE__ */ new WeakMap();
+  let latest = null;
+  function unregisterTools(inst) {
+    const unregister = inst.api.tools.unregister;
+    for (const name of inst.registeredTools.splice(0)) {
+      if (typeof unregister !== "function") continue;
+      try {
+        unregister.call(inst.api.tools, name);
+      } catch (err) {
+        inst.api.log.warn("todo-tracker: failed to unregister tool", { name, err });
       }
     }
-  },
-  async setup(api) {
-    state56.addCount = 0;
-    state56.completeCount = 0;
-    state56.dropCount = 0;
-    state56.removeCount = 0;
-    state56.pullCount = 0;
-    state56.lastMutation = null;
-    state56.file = null;
-    const derived = deriveFilePath(api);
-    if (derived.filePath === null) {
-      api.log.warn(
-        'todo-tracker: no file path configured (set `config.extensions["todo-tracker"].filePath` or wire `paths.projectDir` through PluginAPI) \u2014 tools will report a clear error'
+  }
+  function assertWritable(inst) {
+    if (inst.readOnlyReason !== null) {
+      throw new Error(`todo-tracker: store is read-only \u2014 ${inst.readOnlyReason}`);
+    }
+  }
+  function serialize(inst, fn) {
+    const run = inst.queue.then(fn, fn);
+    inst.queue = run.catch(() => void 0);
+    return run;
+  }
+  async function quarantineLocked(inst, reason) {
+    const target = `${inst.filePath}.corrupt-${quarantineSuffix()}`;
+    try {
+      await deps.rename(inst.filePath, target);
+    } catch (err) {
+      inst.readOnlyReason = `${inst.filePath} is unreadable (${reason}) and could not be moved aside (${err.message}); fix or remove the file, then reload the plugin`;
+      inst.api.log.error(
+        "todo-tracker: corrupt file could not be quarantined; store is read-only",
+        {
+          filePath: inst.filePath,
+          reason,
+          err
+        }
       );
-      return;
+      return false;
     }
-    state56.filePath = derived.filePath;
-    state56.projectSlug = derived.projectSlug;
-    state56.file = await loadFile(state56.filePath);
-    if (state56.file === null) {
-      state56.file = {
-        version: FILE_VERSION,
-        projectSlug: state56.projectSlug ?? "tracker",
-        updatedAt: nowIso(),
-        items: []
-      };
+    inst.degradedReason = `${inst.filePath} was unreadable (${reason}); original moved to ${target}`;
+    inst.api.log.error(`todo-tracker: corrupt file quarantined to ${target}`, {
+      filePath: inst.filePath,
+      quarantinedTo: target,
+      reason
+    });
+    return true;
+  }
+  async function resolveLoad(inst, res, opts) {
+    switch (res.kind) {
+      case "ok":
+        return res.file;
+      case "missing":
+        return emptyFile(inst.projectSlug);
+      case "unsupportedVersion": {
+        inst.readOnlyReason = `${inst.filePath} has format version ${JSON.stringify(res.version)}, this plugin only writes version ${FILE_VERSION}; refusing to modify it`;
+        inst.api.log.error("todo-tracker: unsupported file version; store is read-only", {
+          filePath: inst.filePath,
+          version: res.version
+        });
+        if (opts.strict) assertWritable(inst);
+        return emptyFile(inst.projectSlug);
+      }
+      case "corrupt":
+      case "invalidItems": {
+        const quarantine = async () => {
+          const again = opts.locked ? res : await loadFile(deps, inst.filePath);
+          if (again.kind === "ok") return again.file;
+          if (again.kind === "missing") return emptyFile(inst.projectSlug);
+          if (again.kind === "unsupportedVersion") {
+            return resolveLoad(inst, again, { locked: true, strict: opts.strict });
+          }
+          const moved = await quarantineLocked(inst, again.reason);
+          if (!moved && opts.strict) assertWritable(inst);
+          return emptyFile(inst.projectSlug);
+        };
+        return opts.locked ? quarantine() : deps.withFileLock(inst.filePath, quarantine);
+      }
     }
-    api.tools.register({
-      name: "todo_tracker_list",
-      description: "List persistent todo-tracker items. Filterable by status, priority, and tag. By default only pending + in_progress items are shown.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          status: {
-            type: "string",
-            enum: ["pending", "in_progress", "completed", "dropped", "all"],
-            description: "Filter by status. 'all' returns every item; default is pending+in_progress."
-          },
-          priority: { type: "string", enum: ["low", "normal", "high"] },
-          tag: { type: "string", description: "Filter by exact tag match" },
-          limit: { type: "number", description: "Max items to return (default 50, max 200)" }
+  }
+  async function refresh(inst) {
+    if (inst.readOnlyReason !== null) return inst.file;
+    const res = await loadFile(deps, inst.filePath);
+    const file = await resolveLoad(inst, res, { locked: false, strict: false });
+    inst.file = file;
+    return file;
+  }
+  function mutate(inst, apply) {
+    return serialize(
+      inst,
+      () => deps.withFileLock(inst.filePath, async () => {
+        assertWritable(inst);
+        const res = await loadFile(deps, inst.filePath);
+        const current = await resolveLoad(inst, res, { locked: true, strict: true });
+        const draft = structuredClone(current);
+        const now = nowIso();
+        const { changed, result } = apply(draft, now);
+        if (changed) {
+          draft.version = FILE_VERSION;
+          draft.projectSlug = inst.projectSlug;
+          draft.updatedAt = now;
+          await deps.ensureDir(dirname10(inst.filePath));
+          await deps.atomicWrite(inst.filePath, JSON.stringify(draft, null, 2), { mode: 384 });
+          inst.file = draft;
+        } else {
+          inst.file = current;
         }
-      },
-      permission: "auto",
-      mutating: false,
-      async execute(input) {
-        if (state56.filePath === null) return notConfiguredError();
-        const rawStatus = typeof input["status"] === "string" ? input["status"].trim().toLowerCase() : void 0;
-        const status = rawStatus ?? "active";
-        const rawPriority = typeof input["priority"] === "string" ? input["priority"].trim().toLowerCase() : void 0;
-        const priority = rawPriority;
-        const tag = input["tag"];
-        const limit = Math.min(Math.max(Number(input["limit"] ?? 50) || 50, 1), 200);
-        const file = ensureFile();
-        let items = file.items;
-        if (status !== "all") {
-          if (status === "active") {
-            items = items.filter((it) => it.status === "pending" || it.status === "in_progress");
-          } else {
-            items = items.filter((it) => it.status.toLowerCase() === status);
+        return result;
+      })
+    );
+  }
+  function recordMutation(inst, op, itemId) {
+    inst.lastMutation = { op, itemId, when: nowIso() };
+    if (op === "add") inst.addCount += 1;
+    else if (op === "complete") inst.completeCount += 1;
+    else if (op === "drop") inst.dropCount += 1;
+    else if (op === "remove") inst.removeCount += 1;
+  }
+  function sessionCounts(inst) {
+    return {
+      add: inst.addCount,
+      complete: inst.completeCount,
+      drop: inst.dropCount,
+      remove: inst.removeCount,
+      pull: inst.pullCount
+    };
+  }
+  function disposeInstance(api) {
+    const inst = instances.get(api);
+    if (!inst) return void 0;
+    unregisterTools(inst);
+    instances.delete(api);
+    if (latest === inst) latest = null;
+    return inst;
+  }
+  const plugin65 = {
+    name: "todo-tracker",
+    version: "0.1.0",
+    description: "Persistent, project-scoped todo backlog that survives across sessions",
+    apiVersion: "^0.1.10",
+    capabilities: { tools: true },
+    defaultConfig: {
+      filePath: ""
+    },
+    configSchema: {
+      type: "object",
+      properties: {
+        filePath: {
+          type: "string",
+          description: "Override the auto-derived per-project path. Defaults to <projectDir>/todo-tracker.json when `paths.projectDir` is provided by the host."
+        }
+      }
+    },
+    async setup(api) {
+      disposeInstance(api);
+      const derived = deriveFilePath(api);
+      if (derived.filePath === null) {
+        latest = null;
+        api.log.warn(
+          'todo-tracker: no file path configured (set `config.extensions["todo-tracker"].filePath` or wire `paths.projectDir` through PluginAPI) \u2014 tools will report a clear error'
+        );
+        return;
+      }
+      const inst = {
+        api,
+        filePath: derived.filePath,
+        projectSlug: derived.projectSlug ?? "tracker",
+        file: emptyFile(derived.projectSlug ?? "tracker"),
+        readOnlyReason: null,
+        degradedReason: null,
+        queue: Promise.resolve(),
+        registeredTools: [],
+        addCount: 0,
+        completeCount: 0,
+        dropCount: 0,
+        removeCount: 0,
+        pullCount: 0,
+        lastMutation: null
+      };
+      instances.set(api, inst);
+      latest = inst;
+      await refresh(inst);
+      const register = (tool) => {
+        api.tools.register(tool);
+        inst.registeredTools.push(tool.name);
+      };
+      register({
+        name: "todo_tracker_list",
+        description: "List persistent todo-tracker items. Filterable by status, priority, and tag. By default only pending + in_progress items are shown.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            status: {
+              type: "string",
+              enum: ["pending", "in_progress", "completed", "dropped", "all"],
+              description: "Filter by status. 'all' returns every item; default is pending+in_progress."
+            },
+            priority: { type: "string", enum: ["low", "normal", "high"] },
+            tag: { type: "string", description: "Filter by exact tag match" },
+            limit: { type: "number", description: "Max items to return (default 50, max 200)" }
+          }
+        },
+        permission: "auto",
+        mutating: false,
+        async execute(input) {
+          const rawStatus = typeof input["status"] === "string" ? input["status"].trim().toLowerCase() : void 0;
+          const status = rawStatus ?? "active";
+          const priority = typeof input["priority"] === "string" ? input["priority"].trim().toLowerCase() : void 0;
+          const tag = typeof input["tag"] === "string" ? input["tag"] : void 0;
+          const limit = Math.min(Math.max(Number(input["limit"] ?? 50) || 50, 1), 200);
+          const file = await refresh(inst);
+          let items = file.items;
+          if (status !== "all") {
+            if (status === "active") {
+              items = items.filter((it) => it.status === "pending" || it.status === "in_progress");
+            } else {
+              items = items.filter((it) => it.status === status);
+            }
           }
+          if (priority) items = items.filter((it) => it.priority === priority);
+          if (tag) items = items.filter((it) => it.tags.includes(tag));
+          const total = items.length;
+          const truncated = items.slice(0, limit);
+          return {
+            ok: true,
+            total,
+            returned: truncated.length,
+            truncated: total > truncated.length,
+            items: truncated,
+            ...inst.readOnlyReason ? { readOnly: inst.readOnlyReason } : {}
+          };
         }
-        if (priority) items = items.filter((it) => it.priority.toLowerCase() === priority);
-        if (tag) items = items.filter((it) => it.tags.includes(tag));
-        const total = items.length;
-        const truncated = items.slice(0, limit);
-        return {
-          ok: true,
-          total,
-          returned: truncated.length,
-          truncated: total > truncated.length,
-          items: truncated
-        };
-      }
-    });
-    api.tools.register({
-      name: "todo_tracker_add",
-      description: "Append a new item to the persistent todo-tracker backlog.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          content: { type: "string", description: "What needs doing (required)" },
-          priority: { type: "string", enum: ["low", "normal", "high"], default: "normal" },
-          tags: {
-            type: "array",
-            items: { type: "string" },
-            description: "Optional tags for filtering"
+      });
+      register({
+        name: "todo_tracker_add",
+        description: "Append a new item to the persistent todo-tracker backlog.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            content: { type: "string", description: "What needs doing (required)" },
+            priority: { type: "string", enum: ["low", "normal", "high"], default: "normal" },
+            tags: {
+              type: "array",
+              items: { type: "string" },
+              description: "Optional tags for filtering"
+            },
+            sourceSessionId: { type: "string", description: "Session that created this item" },
+            notes: { type: "string", description: "Optional free-form notes" }
           },
-          sourceSessionId: { type: "string", description: "Session that created this item" },
-          notes: { type: "string", description: "Optional free-form notes" }
+          required: ["content"]
         },
-        required: ["content"]
-      },
-      permission: "auto",
-      mutating: true,
-      async execute(input) {
-        if (state56.filePath === null) return notConfiguredError();
-        const rawContent = input["content"] ?? input["text"] ?? input["task"] ?? input["title"] ?? input["todo"] ?? input["message"] ?? input["item"];
-        const content = typeof rawContent === "string" ? rawContent.trim() : "";
-        if (!content) {
-          return { ok: false, error: "content is required and must be a non-empty string" };
-        }
-        const rawPri = typeof input["priority"] === "string" ? input["priority"].trim().toLowerCase() : "";
-        const priority = rawPri === "low" || rawPri === "high" ? rawPri : "normal";
-        const tags = Array.isArray(input["tags"]) ? input["tags"].filter((t) => typeof t === "string") : [];
-        const sourceSessionId = typeof input["sourceSessionId"] === "string" ? input["sourceSessionId"] : null;
-        const notes = typeof input["notes"] === "string" ? input["notes"] : null;
-        const now = nowIso();
-        const item = {
-          id: randomUUID(),
-          content,
-          status: "pending",
-          priority,
-          tags,
-          createdAt: now,
-          updatedAt: now,
-          completedAt: null,
-          sourceSessionId,
-          notes
-        };
-        const file = ensureFile();
-        file.items.push(item);
-        file.updatedAt = now;
-        await saveFile(state56.filePath, file);
-        recordMutation("add", item.id);
-        api.log.info("todo-tracker: added item", { id: item.id, content });
-        try {
-          await api.session?.append?.({
-            type: "todo-tracker:add",
-            ts: now,
-            id: item.id,
-            content,
-            priority,
-            tags
+        permission: "auto",
+        mutating: true,
+        async execute(input) {
+          const rawContent = input["content"] ?? input["text"] ?? input["task"] ?? input["title"] ?? input["todo"] ?? input["message"] ?? input["item"];
+          const content = typeof rawContent === "string" ? rawContent.trim() : "";
+          if (!content) {
+            throw new ToolValidationError31({
+              message: "content is required and must be a non-empty string",
+              field: "content"
+            });
+          }
+          const rawPri = typeof input["priority"] === "string" ? input["priority"].trim().toLowerCase() : "";
+          const priority = rawPri === "low" || rawPri === "high" ? rawPri : "normal";
+          const tags = Array.isArray(input["tags"]) ? input["tags"].filter((t) => typeof t === "string") : [];
+          const sourceSessionId = typeof input["sourceSessionId"] === "string" ? input["sourceSessionId"] : null;
+          const notes = typeof input["notes"] === "string" ? input["notes"] : null;
+          const item = await mutate(inst, (draft, now) => {
+            const created = {
+              id: randomUUID(),
+              content,
+              status: "pending",
+              priority,
+              tags,
+              createdAt: now,
+              updatedAt: now,
+              completedAt: null,
+              sourceSessionId,
+              notes
+            };
+            draft.items.push(created);
+            return { changed: true, result: created };
           });
-        } catch {
+          recordMutation(inst, "add", item.id);
+          api.log.info("todo-tracker: added item", { id: item.id, content });
+          try {
+            await api.session?.append?.({
+              type: "todo-tracker:add",
+              ts: item.createdAt,
+              id: item.id,
+              content,
+              priority,
+              tags
+            });
+          } catch (err) {
+            api.log.warn("todo-tracker: session.append failed (item was saved)", {
+              id: item.id,
+              err
+            });
+          }
+          return { ok: true, item };
         }
-        return { ok: true, item };
-      }
-    });
-    api.tools.register({
-      name: "todo_tracker_complete",
-      description: "Mark a tracked item as completed. Idempotent.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          id: { type: "string", description: "Item id" }
+      });
+      const setTerminalStatus = async (input, target) => {
+        const id = requireItemId(input);
+        return mutate(inst, (draft, now) => {
+          const item = draft.items[requireItemIndex(draft, id)];
+          if (item.status === target) {
+            return {
+              changed: false,
+              result: { ok: true, item, message: `already ${target} (idempotent)` }
+            };
+          }
+          item.status = target;
+          item.updatedAt = now;
+          item.completedAt = now;
+          return { changed: true, result: { ok: true, item } };
+        });
+      };
+      register({
+        name: "todo_tracker_complete",
+        description: "Mark a tracked item as completed. Idempotent.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            id: { type: "string", description: "Item id" }
+          },
+          required: ["id"]
         },
-        required: ["id"]
-      },
-      permission: "auto",
-      mutating: true,
-      async execute(input) {
-        if (state56.filePath === null) return notConfiguredError();
-        const rawId = input["id"] ?? input["itemId"] ?? input["taskId"] ?? input["todoId"];
-        const id = typeof rawId === "string" ? rawId.trim() : "";
-        if (!id) return { ok: false, error: "id is required" };
-        const idx = findItemIndex(id);
-        if (idx === -1) return { ok: false, error: `no item with id ${id}` };
-        const file = ensureFile();
-        const item = file.items[idx];
-        if (item.status === "completed") {
-          return { ok: true, item, message: "already completed (idempotent)" };
+        permission: "auto",
+        mutating: true,
+        async execute(input) {
+          const result = await setTerminalStatus(input, "completed");
+          if (!result.message) {
+            recordMutation(inst, "complete", result.item.id);
+            api.log.info("todo-tracker: completed item", { id: result.item.id });
+          }
+          return result;
         }
-        const now = nowIso();
-        item.status = "completed";
-        item.updatedAt = now;
-        item.completedAt = now;
-        file.updatedAt = now;
-        await saveFile(state56.filePath, file);
-        recordMutation("complete", id);
-        api.log.info("todo-tracker: completed item", { id });
-        return { ok: true, item };
-      }
-    });
-    api.tools.register({
-      name: "todo_tracker_drop",
-      description: "Mark a tracked item as dropped (skipped/obsolete). The row is kept for audit. Idempotent.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          id: { type: "string", description: "Item id" }
+      });
+      register({
+        name: "todo_tracker_drop",
+        description: "Mark a tracked item as dropped (skipped/obsolete). The row is kept for audit. Idempotent.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            id: { type: "string", description: "Item id" }
+          },
+          required: ["id"]
         },
-        required: ["id"]
-      },
-      permission: "auto",
-      mutating: true,
-      async execute(input) {
-        if (state56.filePath === null) return notConfiguredError();
-        const rawId = input["id"] ?? input["itemId"] ?? input["taskId"] ?? input["todoId"];
-        const id = typeof rawId === "string" ? rawId.trim() : "";
-        if (!id) return { ok: false, error: "id is required" };
-        const idx = findItemIndex(id);
-        if (idx === -1) return { ok: false, error: `no item with id ${id}` };
-        const file = ensureFile();
-        const item = file.items[idx];
-        if (item.status === "dropped") {
-          return { ok: true, item, message: "already dropped (idempotent)" };
+        permission: "auto",
+        mutating: true,
+        async execute(input) {
+          const result = await setTerminalStatus(input, "dropped");
+          if (!result.message) recordMutation(inst, "drop", result.item.id);
+          return result;
         }
-        const now = nowIso();
-        item.status = "dropped";
-        item.updatedAt = now;
-        item.completedAt = now;
-        file.updatedAt = now;
-        await saveFile(state56.filePath, file);
-        recordMutation("drop", id);
-        return { ok: true, item };
-      }
-    });
-    api.tools.register({
-      name: "todo_tracker_remove",
-      description: "Permanently delete a tracked item by id. Use todo_tracker_drop instead if you want to keep the audit row.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          id: { type: "string", description: "Item id" }
+      });
+      register({
+        name: "todo_tracker_remove",
+        description: "Permanently delete a tracked item by id. Use todo_tracker_drop instead if you want to keep the audit row.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            id: { type: "string", description: "Item id" }
+          },
+          required: ["id"]
         },
-        required: ["id"]
-      },
-      permission: "confirm",
-      mutating: true,
-      async execute(input) {
-        if (state56.filePath === null) return notConfiguredError();
-        const rawId = input["id"] ?? input["itemId"] ?? input["taskId"] ?? input["todoId"];
-        const id = typeof rawId === "string" ? rawId.trim() : "";
-        if (!id) return { ok: false, error: "id is required" };
-        const idx = findItemIndex(id);
-        if (idx === -1) return { ok: false, error: `no item with id ${id}` };
-        const file = ensureFile();
-        const [removed] = file.items.splice(idx, 1);
-        file.updatedAt = nowIso();
-        await saveFile(state56.filePath, file);
-        recordMutation("remove", id);
-        return { ok: true, removed };
-      }
-    });
-    api.tools.register({
-      name: "todo_tracker_pull",
-      description: "Return all pending + in_progress items. The LLM is expected to take this list and re-register each entry with the session-local `todo` tool (which mutates ctx.todos). After pull, the LLM may also choose to call todo_tracker_complete on items it finishes mid-session.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          limit: { type: "number", description: "Max items to return (default 50, max 200)" }
+        permission: "confirm",
+        mutating: true,
+        async execute(input) {
+          const id = requireItemId(input);
+          const removed = await mutate(inst, (draft) => {
+            const [gone] = draft.items.splice(requireItemIndex(draft, id), 1);
+            return { changed: true, result: gone };
+          });
+          recordMutation(inst, "remove", id);
+          return { ok: true, removed };
         }
-      },
-      permission: "auto",
-      mutating: false,
-      async execute(input) {
-        if (state56.filePath === null) return notConfiguredError();
-        const limit = Math.min(Math.max(Number(input["limit"] ?? 50) || 50, 1), 200);
-        const file = ensureFile();
-        const items = file.items.filter((it) => it.status === "pending" || it.status === "in_progress").slice(0, limit);
-        if (items.length > 0) {
-          recordMutation("pull", items[0].id);
+      });
+      register({
+        name: "todo_tracker_pull",
+        description: "Return all pending + in_progress items. The LLM is expected to take this list and re-register each entry with the session-local `todo` tool (which mutates ctx.todos). After pull, the LLM may also choose to call todo_tracker_complete on items it finishes mid-session.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            limit: { type: "number", description: "Max items to return (default 50, max 200)" }
+          }
+        },
+        permission: "auto",
+        mutating: false,
+        async execute(input) {
+          const limit = Math.min(Math.max(Number(input["limit"] ?? 50) || 50, 1), 200);
+          const file = await refresh(inst);
+          const open = file.items.filter(
+            (it) => it.status === "pending" || it.status === "in_progress"
+          );
+          const items = open.slice(0, limit);
+          if (items.length > 0) inst.pullCount += 1;
+          return {
+            ok: true,
+            total: open.length,
+            returned: items.length,
+            truncated: open.length > items.length,
+            items,
+            hint: "These are persistent items. To work on them this session, register each one with the built-in `todo` tool. Mark them `completed` via todo_tracker_complete when done."
+          };
         }
+      });
+      register({
+        name: "todo_tracker_status",
+        description: "Report todo-tracker counters (per-status totals) + the file path + last update timestamp.",
+        inputSchema: { type: "object", properties: {} },
+        permission: "auto",
+        mutating: false,
+        async execute() {
+          const file = await refresh(inst);
+          const byStatus = {
+            pending: 0,
+            in_progress: 0,
+            completed: 0,
+            dropped: 0
+          };
+          for (const it of file.items) {
+            if (STATUSES.includes(it.status)) byStatus[it.status] += 1;
+          }
+          return {
+            ok: true,
+            filePath: inst.filePath,
+            projectSlug: inst.projectSlug,
+            updatedAt: file.updatedAt,
+            counters: byStatus,
+            total: file.items.length,
+            session: sessionCounts(inst),
+            lastMutation: inst.lastMutation,
+            readOnly: inst.readOnlyReason,
+            degraded: inst.degradedReason
+          };
+        }
+      });
+      api.log.info("todo-tracker plugin loaded", {
+        filePath: inst.filePath,
+        projectSlug: inst.projectSlug,
+        initialItemCount: inst.file.items.length,
+        readOnly: inst.readOnlyReason,
+        degraded: inst.degradedReason
+      });
+    },
+    teardown(api) {
+      const inst = disposeInstance(api);
+      if (!inst) return;
+      api.log.info("todo-tracker: teardown complete", { sessionCounts: sessionCounts(inst) });
+    },
+    async health() {
+      const inst = latest;
+      if (inst === null) {
         return {
-          ok: true,
-          total: items.length,
-          items,
-          hint: "These are persistent items. To work on them this session, register each one with the built-in `todo` tool. Mark them `completed` via todo_tracker_complete when done."
-        };
-      }
-    });
-    api.tools.register({
-      name: "todo_tracker_status",
-      description: "Report todo-tracker counters (per-status totals) + the file path + last update timestamp.",
-      inputSchema: { type: "object", properties: {} },
-      permission: "auto",
-      mutating: false,
-      async execute() {
-        if (state56.filePath === null) return notConfiguredError();
-        const file = ensureFile();
-        const byStatus = {
-          pending: 0,
-          in_progress: 0,
-          completed: 0,
-          dropped: 0
-        };
-        for (const it of file.items) byStatus[it.status] += 1;
-        return {
-          ok: true,
-          filePath: state56.filePath,
-          projectSlug: state56.projectSlug,
-          updatedAt: file.updatedAt,
-          counters: byStatus,
-          total: file.items.length,
-          session: {
-            add: state56.addCount,
-            complete: state56.completeCount,
-            drop: state56.dropCount,
-            remove: state56.removeCount,
-            pull: state56.pullCount
-          },
-          lastMutation: state56.lastMutation
+          ok: false,
+          message: "todo-tracker: no file path configured \u2014 tools will error"
         };
       }
-    });
-    api.log.info("todo-tracker plugin loaded", {
-      filePath: state56.filePath,
-      projectSlug: state56.projectSlug,
-      initialItemCount: state56.file.items.length
-    });
-  },
-  teardown(api) {
-    const finalCounts = {
-      add: state56.addCount,
-      complete: state56.completeCount,
-      drop: state56.dropCount,
-      remove: state56.removeCount,
-      pull: state56.pullCount
-    };
-    state56.addCount = 0;
-    state56.completeCount = 0;
-    state56.dropCount = 0;
-    state56.removeCount = 0;
-    state56.pullCount = 0;
-    state56.lastMutation = null;
-    state56.file = null;
-    state56.filePath = null;
-    state56.projectSlug = null;
-    api.log.info("todo-tracker: teardown complete", { sessionCounts: finalCounts });
-  },
-  async health() {
-    if (state56.filePath === null) {
+      const reason = inst.readOnlyReason ?? inst.degradedReason;
       return {
-        ok: false,
-        message: "todo-tracker: no file path configured \u2014 tools will error"
+        ok: reason === null,
+        message: reason === null ? `todo-tracker: ${inst.file.items.length} item(s) at ${inst.filePath}` : `todo-tracker: ${inst.readOnlyReason ? "read-only" : "degraded"} \u2014 ${reason}`,
+        filePath: inst.filePath,
+        projectSlug: inst.projectSlug,
+        total: inst.file.items.length,
+        readOnly: inst.readOnlyReason,
+        degraded: inst.degradedReason,
+        sessionCounts: sessionCounts(inst),
+        lastMutation: inst.lastMutation
       };
     }
-    const file = ensureFile();
-    return {
-      ok: true,
-      message: `todo-tracker: ${file.items.length} item(s) at ${state56.filePath}`,
-      filePath: state56.filePath,
-      projectSlug: state56.projectSlug,
-      total: file.items.length,
-      sessionCounts: {
-        add: state56.addCount,
-        complete: state56.completeCount,
-        drop: state56.dropCount,
-        remove: state56.removeCount,
-        pull: state56.pullCount
-      },
-      lastMutation: state56.lastMutation
-    };
-  }
-};
+  };
+  return plugin65;
+}
+var plugin61 = createTodoTrackerPlugin();
 var todo_tracker_default = plugin61;
 
 // src/token-budget/index.ts
 var API_VERSION40 = "^0.1.10";
-var state57 = {
+var state56 = {
   totalTokens: 0,
   totalPromptTokens: 0,
   totalCompletionTokens: 0,
@@ -24654,13 +25115,13 @@ function readConfig54(raw) {
 }
 function clearRegistrations3() {
   for (const key of ["hookUnregister", "postHookUnregister"]) {
-    const off = state57[key];
+    const off = state56[key];
     if (!off) continue;
     try {
       off();
     } catch {
     }
-    state57[key] = null;
+    state56[key] = null;
   }
 }
 var plugin62 = {
@@ -24701,15 +25162,15 @@ var plugin62 = {
     }
   },
   setup(api) {
-    state57.totalTokens = 0;
-    state57.totalPromptTokens = 0;
-    state57.totalCompletionTokens = 0;
-    state57.requestCount = 0;
-    state57.warningFired = false;
-    state57.stopFired = false;
-    state57.warnContextInjected = false;
-    state57.stopContextInjected = false;
-    state57.lastRequest = null;
+    state56.totalTokens = 0;
+    state56.totalPromptTokens = 0;
+    state56.totalCompletionTokens = 0;
+    state56.requestCount = 0;
+    state56.warningFired = false;
+    state56.stopFired = false;
+    state56.warnContextInjected = false;
+    state56.stopContextInjected = false;
+    state56.lastRequest = null;
     clearRegistrations3();
     const cfg = readConfig54(api.config.extensions?.["token-budget"]);
     api.onEvent("provider.response", (payload) => {
@@ -24722,24 +25183,26 @@ var plugin62 = {
         if (!modelMatches(cfg.model, modelName)) return;
       }
       const rawUsage = usage;
-      const promptTokens = (typeof rawUsage["input"] === "number" ? rawUsage["input"] : void 0) ?? (typeof rawUsage["prompt_tokens"] === "number" ? rawUsage["prompt_tokens"] : void 0) ?? (typeof rawUsage["input_tokens"] === "number" ? rawUsage["input_tokens"] : void 0) ?? (typeof rawUsage["promptTokens"] === "number" ? rawUsage["promptTokens"] : 0);
-      const completionTokens = (typeof rawUsage["output"] === "number" ? rawUsage["output"] : void 0) ?? (typeof rawUsage["completion_tokens"] === "number" ? rawUsage["completion_tokens"] : void 0) ?? (typeof rawUsage["output_tokens"] === "number" ? rawUsage["output_tokens"] : void 0) ?? (typeof rawUsage["completionTokens"] === "number" ? rawUsage["completionTokens"] : 0);
+      const promptTokensRaw = (typeof rawUsage["input"] === "number" ? rawUsage["input"] : void 0) ?? (typeof rawUsage["prompt_tokens"] === "number" ? rawUsage["prompt_tokens"] : void 0) ?? (typeof rawUsage["input_tokens"] === "number" ? rawUsage["input_tokens"] : void 0) ?? (typeof rawUsage["promptTokens"] === "number" ? rawUsage["promptTokens"] : 0);
+      const promptTokens = Number.isFinite(promptTokensRaw) ? promptTokensRaw : 0;
+      const completionTokensRaw = (typeof rawUsage["output"] === "number" ? rawUsage["output"] : void 0) ?? (typeof rawUsage["completion_tokens"] === "number" ? rawUsage["completion_tokens"] : void 0) ?? (typeof rawUsage["output_tokens"] === "number" ? rawUsage["output_tokens"] : void 0) ?? (typeof rawUsage["completionTokens"] === "number" ? rawUsage["completionTokens"] : 0);
+      const completionTokens = Number.isFinite(completionTokensRaw) ? completionTokensRaw : 0;
       const total = promptTokens + completionTokens;
-      state57.totalPromptTokens += promptTokens;
-      state57.totalCompletionTokens += completionTokens;
-      state57.totalTokens += total;
-      state57.requestCount += 1;
-      state57.lastRequest = {
+      state56.totalPromptTokens += promptTokens;
+      state56.totalCompletionTokens += completionTokens;
+      state56.totalTokens += total;
+      state56.requestCount += 1;
+      state56.lastRequest = {
         model: modelName,
         prompt: promptTokens,
         completion: completionTokens,
         when: (/* @__PURE__ */ new Date()).toISOString()
       };
       if (cfg.limit <= 0) return;
-      const percent = state57.totalTokens / cfg.limit * 100;
-      if (!state57.warningFired && percent >= cfg.warnPercent && percent < cfg.stopPercent) {
-        state57.warningFired = true;
-        const remaining = cfg.limit - state57.totalTokens;
+      const percent = state56.totalTokens / cfg.limit * 100;
+      if (!state56.warningFired && percent >= cfg.warnPercent) {
+        state56.warningFired = true;
+        const remaining = Math.max(cfg.limit - state56.totalTokens, 0);
         api.log.info("token-budget: warning threshold reached", {
           percent: Math.round(percent),
           remaining
@@ -24747,45 +25210,46 @@ var plugin62 = {
         api.emitCustom("token-budget:warning", {
           percent: Math.round(percent),
           remaining,
-          total: state57.totalTokens,
+          total: state56.totalTokens,
           limit: cfg.limit
         });
       }
-      if (!state57.stopFired && percent >= cfg.stopPercent) {
-        state57.stopFired = true;
+      if (!state56.stopFired && percent >= cfg.stopPercent) {
+        state56.stopFired = true;
         api.log.warn("token-budget: hard limit reached \u2014 agent loop will be stopped", {
-          total: state57.totalTokens,
+          total: state56.totalTokens,
           limit: cfg.limit
         });
         api.emitCustom("token-budget:limit_reached", {
-          total: state57.totalTokens,
+          total: state56.totalTokens,
           limit: cfg.limit
         });
       }
     });
-    state57.hookUnregister = api.registerHook("Stop", void 0, () => {
-      if (cfg.limit <= 0 || !state57.stopFired) return;
+    state56.hookUnregister = api.registerHook("Stop", void 0, () => {
+      if (cfg.limit <= 0 || !state56.stopFired) return;
       return {
         decision: "block",
-        reason: `token-budget: session token limit reached (${state57.totalTokens.toLocaleString()} / ${cfg.limit.toLocaleString()} tokens). The budget is exhausted \u2014 wrap up the current task and summarize what was accomplished.`
+        reason: `token-budget: session token limit reached (${state56.totalTokens.toLocaleString()} / ${cfg.limit.toLocaleString()} tokens). The budget is exhausted \u2014 wrap up the current task and summarize what was accomplished.`
       };
     });
-    state57.postHookUnregister = api.registerHook("PostToolUse", "*", () => {
+    state56.postHookUnregister = api.registerHook("PostToolUse", "*", () => {
       if (cfg.limit <= 0) return;
-      const percent = Math.round(state57.totalTokens / cfg.limit * 100);
-      const remaining = Math.max(cfg.limit - state57.totalTokens, 0);
-      if (state57.stopFired && !state57.stopContextInjected) {
-        state57.stopContextInjected = true;
+      const percent = Math.round(state56.totalTokens / cfg.limit * 100);
+      const remaining = Math.max(cfg.limit - state56.totalTokens, 0);
+      if (state56.stopFired && !state56.stopContextInjected) {
+        state56.stopContextInjected = true;
+        state56.warnContextInjected = true;
         return {
           additionalContext: `
-\u{1F6D1} token-budget: HARD LIMIT REACHED \u2014 ${state57.totalTokens.toLocaleString()} / ${cfg.limit.toLocaleString()} tokens (${percent}%). You must stop here. Do NOT start any new task. Summarize what was accomplished and list any remaining work.`
+\u{1F6D1} token-budget: HARD LIMIT REACHED \u2014 ${state56.totalTokens.toLocaleString()} / ${cfg.limit.toLocaleString()} tokens (${percent}%). You must stop here. Do NOT start any new task. Summarize what was accomplished and list any remaining work.`
         };
       }
-      if (state57.warningFired && !state57.warnContextInjected) {
-        state57.warnContextInjected = true;
+      if (state56.warningFired && !state56.warnContextInjected) {
+        state56.warnContextInjected = true;
         return {
           additionalContext: `
-\u26A0\uFE0F token-budget: ${percent}% of budget used (${state57.totalTokens.toLocaleString()} / ${cfg.limit.toLocaleString()} tokens, ${remaining.toLocaleString()} remaining). Start wrapping up \u2014 prioritize finishing the current task over starting new ones.`
+\u26A0\uFE0F token-budget: ${percent}% of budget used (${state56.totalTokens.toLocaleString()} / ${cfg.limit.toLocaleString()} tokens, ${remaining.toLocaleString()} remaining). Start wrapping up \u2014 prioritize finishing the current task over starting new ones.`
         };
       }
       return;
@@ -24798,7 +25262,7 @@ var plugin62 = {
       category: "Meta",
       mutating: false,
       async execute() {
-        const consumed = state57.totalTokens;
+        const consumed = state56.totalTokens;
         const limit = cfg.limit;
         const percent = limit > 0 ? Math.round(consumed / limit * 100) : 0;
         const remaining = limit > 0 ? Math.max(limit - consumed, 0) : Infinity;
@@ -24808,7 +25272,7 @@ var plugin62 = {
           consumed,
           remaining,
           percent,
-          requestCount: state57.requestCount,
+          requestCount: state56.requestCount,
           // The EFFECTIVE thresholds, after out-of-range values fall back to
           // the defaults and warn/stop are ordered. Without these the user
           // cannot tell that a rejected or clamped setting is not in force.
@@ -24816,12 +25280,12 @@ var plugin62 = {
           stopPercent: cfg.stopPercent,
           model: cfg.model === "" ? null : cfg.model,
           breakdown: {
-            prompt: state57.totalPromptTokens,
-            completion: state57.totalCompletionTokens
+            prompt: state56.totalPromptTokens,
+            completion: state56.totalCompletionTokens
           },
-          warningFired: state57.warningFired,
-          stopFired: state57.stopFired,
-          lastRequest: state57.lastRequest
+          warningFired: state56.warningFired,
+          stopFired: state56.stopFired,
+          lastRequest: state56.lastRequest
         };
       }
     });
@@ -24835,30 +25299,30 @@ var plugin62 = {
   teardown(api) {
     clearRegistrations3();
     const final = {
-      totalTokens: state57.totalTokens,
-      requestCount: state57.requestCount,
-      warningFired: state57.warningFired,
-      stopFired: state57.stopFired
+      totalTokens: state56.totalTokens,
+      requestCount: state56.requestCount,
+      warningFired: state56.warningFired,
+      stopFired: state56.stopFired
     };
-    state57.totalTokens = 0;
-    state57.totalPromptTokens = 0;
-    state57.totalCompletionTokens = 0;
-    state57.requestCount = 0;
-    state57.warningFired = false;
-    state57.stopFired = false;
-    state57.warnContextInjected = false;
-    state57.stopContextInjected = false;
-    state57.lastRequest = null;
+    state56.totalTokens = 0;
+    state56.totalPromptTokens = 0;
+    state56.totalCompletionTokens = 0;
+    state56.requestCount = 0;
+    state56.warningFired = false;
+    state56.stopFired = false;
+    state56.warnContextInjected = false;
+    state56.stopContextInjected = false;
+    state56.lastRequest = null;
     api.log.info("token-budget: teardown complete", { final });
   },
   async health() {
     return {
       ok: true,
-      message: state57.lastRequest === null ? `token-budget: ${state57.totalTokens.toLocaleString()} tokens across ${state57.requestCount} request(s)` : `token-budget: ${state57.totalTokens.toLocaleString()} tokens, last ${state57.lastRequest.model} at ${state57.lastRequest.when}`,
-      totalTokens: state57.totalTokens,
-      requestCount: state57.requestCount,
-      warningFired: state57.warningFired,
-      stopFired: state57.stopFired
+      message: state56.lastRequest === null ? `token-budget: ${state56.totalTokens.toLocaleString()} tokens across ${state56.requestCount} request(s)` : `token-budget: ${state56.totalTokens.toLocaleString()} tokens, last ${state56.lastRequest.model} at ${state56.lastRequest.when}`,
+      totalTokens: state56.totalTokens,
+      requestCount: state56.requestCount,
+      warningFired: state56.warningFired,
+      stopFired: state56.stopFired
     };
   }
 };
@@ -24905,7 +25369,7 @@ function computeThrottleDelay(entries, now, limit, projected) {
   const newest = sorted[sorted.length - 1];
   return newest ? Math.max(0, newest.at + WINDOW_MS - now) : 0;
 }
-var state58 = {
+var state57 = {
   window: [],
   invocations: 0,
   throttled: 0,
@@ -24978,16 +25442,16 @@ var plugin63 = {
     }
   },
   setup(api) {
-    state58.window = [];
-    state58.invocations = 0;
-    state58.throttled = 0;
-    state58.totalDelayMs = 0;
-    if (state58.extensionUnregister) {
+    state57.window = [];
+    state57.invocations = 0;
+    state57.throttled = 0;
+    state57.totalDelayMs = 0;
+    if (state57.extensionUnregister) {
       try {
-        state58.extensionUnregister();
+        state57.extensionUnregister();
       } catch {
       }
-      state58.extensionUnregister = null;
+      state57.extensionUnregister = null;
     }
     const cfg = readConfig55(api.config.extensions?.["token-throttle"]);
     if (cfg.enabled) {
@@ -24996,21 +25460,21 @@ var plugin63 = {
         kind: "throttle",
         wraps: ["request"]
       });
-      state58.extensionUnregister = api.extensions.register({
+      state57.extensionUnregister = api.extensions.register({
         name: "token-throttle",
         owner: "token-throttle",
         async wrapProviderRunner(_ctx, request, inner) {
           const signal = _ctx?.signal;
           const req = request ?? {};
-          state58.invocations += 1;
+          state57.invocations += 1;
           const now = Date.now();
-          state58.window = pruneWindow(state58.window, now);
+          state57.window = pruneWindow(state57.window, now);
           const projected = estimateRequestTokens(req, cfg.charsPerToken);
-          const rawDelay = computeThrottleDelay(state58.window, now, cfg.tokensPerMinute, projected);
+          const rawDelay = computeThrottleDelay(state57.window, now, cfg.tokensPerMinute, projected);
           const delay = Math.min(rawDelay, cfg.maxDelayMs);
           if (delay > 0) {
-            state58.throttled += 1;
-            state58.totalDelayMs += delay;
+            state57.throttled += 1;
+            state57.totalDelayMs += delay;
             api.metrics.counter("throttled");
             api.metrics.histogram("delay_ms", delay);
             api.log.info("token-throttle: delaying provider call", { delayMs: delay, projected });
@@ -25018,11 +25482,14 @@ var plugin63 = {
           }
           const response = await inner(_ctx, request);
           const rawUsage = response?.usage;
-          const inputTokens = (typeof rawUsage?.["input"] === "number" ? rawUsage["input"] : void 0) ?? (typeof rawUsage?.["prompt_tokens"] === "number" ? rawUsage["prompt_tokens"] : void 0) ?? (typeof rawUsage?.["input_tokens"] === "number" ? rawUsage["input_tokens"] : void 0) ?? (typeof rawUsage?.["promptTokens"] === "number" ? rawUsage["promptTokens"] : void 0) ?? (typeof rawUsage?.["inputTokens"] === "number" ? rawUsage["inputTokens"] : 0);
-          const outputTokens = (typeof rawUsage?.["output"] === "number" ? rawUsage["output"] : void 0) ?? (typeof rawUsage?.["completion_tokens"] === "number" ? rawUsage["completion_tokens"] : void 0) ?? (typeof rawUsage?.["output_tokens"] === "number" ? rawUsage["output_tokens"] : void 0) ?? (typeof rawUsage?.["completionTokens"] === "number" ? rawUsage["completionTokens"] : void 0) ?? (typeof rawUsage?.["outputTokens"] === "number" ? rawUsage["outputTokens"] : 0);
-          const totalTokens = (typeof rawUsage?.["total_tokens"] === "number" ? rawUsage["total_tokens"] : void 0) ?? (typeof rawUsage?.["totalTokens"] === "number" ? rawUsage["totalTokens"] : void 0) ?? (typeof rawUsage?.["total"] === "number" ? rawUsage["total"] : void 0) ?? inputTokens + outputTokens;
+          const inputTokensRaw = (typeof rawUsage?.["input"] === "number" ? rawUsage["input"] : void 0) ?? (typeof rawUsage?.["prompt_tokens"] === "number" ? rawUsage["prompt_tokens"] : void 0) ?? (typeof rawUsage?.["input_tokens"] === "number" ? rawUsage["input_tokens"] : void 0) ?? (typeof rawUsage?.["promptTokens"] === "number" ? rawUsage["promptTokens"] : void 0) ?? (typeof rawUsage?.["inputTokens"] === "number" ? rawUsage["inputTokens"] : 0);
+          const inputTokens = Number.isFinite(inputTokensRaw) ? inputTokensRaw : 0;
+          const outputTokensRaw = (typeof rawUsage?.["output"] === "number" ? rawUsage["output"] : void 0) ?? (typeof rawUsage?.["completion_tokens"] === "number" ? rawUsage["completion_tokens"] : void 0) ?? (typeof rawUsage?.["output_tokens"] === "number" ? rawUsage["output_tokens"] : void 0) ?? (typeof rawUsage?.["completionTokens"] === "number" ? rawUsage["completionTokens"] : void 0) ?? (typeof rawUsage?.["outputTokens"] === "number" ? rawUsage["outputTokens"] : 0);
+          const outputTokens = Number.isFinite(outputTokensRaw) ? outputTokensRaw : 0;
+          const totalTokensRaw = (typeof rawUsage?.["total_tokens"] === "number" ? rawUsage["total_tokens"] : void 0) ?? (typeof rawUsage?.["totalTokens"] === "number" ? rawUsage["totalTokens"] : void 0) ?? (typeof rawUsage?.["total"] === "number" ? rawUsage["total"] : void 0) ?? inputTokens + outputTokens;
+          const totalTokens = Number.isFinite(totalTokensRaw) ? totalTokensRaw : 0;
           const used = totalTokens > 0 ? totalTokens : projected;
-          state58.window.push({ at: Date.now(), tokens: used });
+          state57.window.push({ at: Date.now(), tokens: used });
           return response;
         }
       });
@@ -25036,7 +25503,7 @@ var plugin63 = {
       mutating: false,
       async execute() {
         const now = Date.now();
-        const live = pruneWindow(state58.window, now);
+        const live = pruneWindow(state57.window, now);
         return {
           ok: true,
           enabled: cfg.enabled,
@@ -25045,9 +25512,9 @@ var plugin63 = {
           windowSpend: windowSpend(live),
           windowEntries: live.length,
           counters: {
-            invocations: state58.invocations,
-            throttled: state58.throttled,
-            totalDelayMs: state58.totalDelayMs
+            invocations: state57.invocations,
+            throttled: state57.throttled,
+            totalDelayMs: state57.totalDelayMs
           }
         };
       }
@@ -25059,32 +25526,32 @@ var plugin63 = {
     });
   },
   teardown(api) {
-    if (state58.extensionUnregister) {
+    if (state57.extensionUnregister) {
       try {
-        state58.extensionUnregister();
+        state57.extensionUnregister();
       } catch {
       }
-      state58.extensionUnregister = null;
+      state57.extensionUnregister = null;
     }
     const final = {
-      invocations: state58.invocations,
-      throttled: state58.throttled,
-      totalDelayMs: state58.totalDelayMs
+      invocations: state57.invocations,
+      throttled: state57.throttled,
+      totalDelayMs: state57.totalDelayMs
     };
-    state58.window = [];
-    state58.invocations = 0;
-    state58.throttled = 0;
-    state58.totalDelayMs = 0;
+    state57.window = [];
+    state57.invocations = 0;
+    state57.throttled = 0;
+    state57.totalDelayMs = 0;
     api.log.info("token-throttle: teardown complete", { final });
   },
   async health() {
     return {
       ok: true,
-      message: `token-throttle: ${state58.throttled} throttle(s) of ${state58.invocations} call(s), ${state58.totalDelayMs}ms total delay`,
+      message: `token-throttle: ${state57.throttled} throttle(s) of ${state57.invocations} call(s), ${state57.totalDelayMs}ms total delay`,
       counters: {
-        invocations: state58.invocations,
-        throttled: state58.throttled,
-        totalDelayMs: state58.totalDelayMs
+        invocations: state57.invocations,
+        throttled: state57.throttled,
+        totalDelayMs: state57.totalDelayMs
       }
     };
   }
@@ -25094,7 +25561,7 @@ var token_throttle_default = plugin63;
 // src/type-gate/index.ts
 import { existsSync as existsSync8 } from "node:fs";
 var API_VERSION41 = "^0.1.10";
-var state59 = {
+var state58 = {
   invocationCount: 0,
   runCount: 0,
   passCount: 0,
@@ -25260,14 +25727,14 @@ var plugin64 = {
     }
   },
   setup(api) {
-    state59.invocationCount = 0;
-    state59.runCount = 0;
-    state59.passCount = 0;
-    state59.failCount = 0;
-    state59.errorCount = 0;
-    state59.skippedCount = 0;
-    state59.lastResult = null;
-    state59.hookUnregister = (0, runtime_exports.releaseHandle)(state59.hookUnregister);
+    state58.invocationCount = 0;
+    state58.runCount = 0;
+    state58.passCount = 0;
+    state58.failCount = 0;
+    state58.errorCount = 0;
+    state58.skippedCount = 0;
+    state58.lastResult = null;
+    state58.hookUnregister = (0, runtime_exports.releaseHandle)(state58.hookUnregister);
     const cfg = readConfig56(api.config.extensions?.["type-gate"]);
     const hook = async (input) => {
       if (!cfg.enabled) return;
@@ -25279,27 +25746,27 @@ var plugin64 = {
       if (!(0, runtime_exports.withinProject)(sourcePath)) return;
       const ext = sourcePath.includes(".") ? sourcePath.slice(sourcePath.lastIndexOf(".")).toLowerCase() : "";
       if (!runOnChangeSet2.has(ext)) {
-        state59.skippedCount += 1;
+        state58.skippedCount += 1;
         return;
       }
-      state59.invocationCount += 1;
+      state58.invocationCount += 1;
       const result = await runTypeCheck(cfg);
       if (!result) {
-        state59.errorCount += 1;
+        state58.errorCount += 1;
         return;
       }
-      state59.runCount += 1;
-      state59.lastResult = {
+      state58.runCount += 1;
+      state58.lastResult = {
         passed: result.passed,
         errorCount: result.errorCount,
         durationMs: result.durationMs,
         when: (/* @__PURE__ */ new Date()).toISOString()
       };
       if (result.passed) {
-        state59.passCount += 1;
+        state58.passCount += 1;
         return;
       }
-      state59.failCount += 1;
+      state58.failCount += 1;
       const errorList = result.errors.map((e) => `  \u274C ${e}`).join("\n");
       const message = `
 \u274C type-gate: Type check failed after editing ${sourcePath} (${result.durationMs}ms).
@@ -25314,7 +25781,7 @@ Fix the type error(s) or adjust the change.`;
       }
       return { additionalContext: message };
     };
-    state59.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+    state58.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
       background: true
     });
     api.tools.register({
@@ -25334,14 +25801,14 @@ Fix the type error(s) or adjust the change.`;
           maxErrors: cfg.maxErrors,
           runOnChange: cfg.runOnChange,
           counters: {
-            invocations: state59.invocationCount,
-            runs: state59.runCount,
-            passed: state59.passCount,
-            failed: state59.failCount,
-            errors: state59.errorCount,
-            skipped: state59.skippedCount
+            invocations: state58.invocationCount,
+            runs: state58.runCount,
+            passed: state58.passCount,
+            failed: state58.failCount,
+            errors: state58.errorCount,
+            skipped: state58.skippedCount
           },
-          lastResult: state59.lastResult
+          lastResult: state58.lastResult
         };
       }
     });
@@ -25353,43 +25820,43 @@ Fix the type error(s) or adjust the change.`;
     });
   },
   teardown(api) {
-    if (state59.hookUnregister) {
+    if (state58.hookUnregister) {
       try {
-        state59.hookUnregister();
+        state58.hookUnregister();
       } catch {
       }
-      state59.hookUnregister = null;
+      state58.hookUnregister = null;
     }
     const final = {
-      invocations: state59.invocationCount,
-      runs: state59.runCount,
-      passed: state59.passCount,
-      failed: state59.failCount,
-      errors: state59.errorCount,
-      skipped: state59.skippedCount
+      invocations: state58.invocationCount,
+      runs: state58.runCount,
+      passed: state58.passCount,
+      failed: state58.failCount,
+      errors: state58.errorCount,
+      skipped: state58.skippedCount
     };
-    state59.invocationCount = 0;
-    state59.runCount = 0;
-    state59.passCount = 0;
-    state59.failCount = 0;
-    state59.errorCount = 0;
-    state59.skippedCount = 0;
-    state59.lastResult = null;
+    state58.invocationCount = 0;
+    state58.runCount = 0;
+    state58.passCount = 0;
+    state58.failCount = 0;
+    state58.errorCount = 0;
+    state58.skippedCount = 0;
+    state58.lastResult = null;
     api.log.info("type-gate: teardown complete", { final });
   },
   async health() {
     return {
       ok: true,
-      message: state59.lastResult ? `type-gate: ${state59.runCount} run(s), last ${state59.lastResult.passed ? "PASSED" : "FAILED"} (${state59.lastResult.errorCount} errors)` : `type-gate: ${state59.invocationCount} invocation(s), ${state59.runCount} run(s)`,
+      message: state58.lastResult ? `type-gate: ${state58.runCount} run(s), last ${state58.lastResult.passed ? "PASSED" : "FAILED"} (${state58.lastResult.errorCount} errors)` : `type-gate: ${state58.invocationCount} invocation(s), ${state58.runCount} run(s)`,
       counters: {
-        invocations: state59.invocationCount,
-        runs: state59.runCount,
-        passed: state59.passCount,
-        failed: state59.failCount,
-        errors: state59.errorCount,
-        skipped: state59.skippedCount
-      },
-      lastResult: state59.lastResult
+        invocations: state58.invocationCount,
+        runs: state58.runCount,
+        passed: state58.passCount,
+        failed: state58.failCount,
+        errors: state58.errorCount,
+        skipped: state58.skippedCount
+      },
+      lastResult: state58.lastResult
     };
   }
 };