@wrongstack/tools 0.1.10 → 0.3.1

package/dist/pack.js

@@ -0,0 +1,4216 @@
+import { spawn } from 'child_process';
+import { buildChildEnv, stripAnsi, detectNewlineStyle, normalizeToLf, toStyle, atomicWrite, unifiedDiff, compileGlob, loadPlan, emptyPlan, clearPlan, savePlan, removePlanItem, setPlanItemStatus, addPlanItem, formatPlan } from '@wrongstack/core';
+import * as path from 'path';
+import { dirname } from 'path';
+import * as os from 'os';
+import { statSync } from 'fs';
+import * as fs9 from 'fs/promises';
+import * as dns from 'dns/promises';
+import * as net from 'net';
+
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+async function* spawnStream(opts) {
+  const max = opts.maxBytes ?? 2e5;
+  const flushAt = opts.flushBytes ?? 4 * 1024;
+  let stdout = "";
+  let stderr = "";
+  let pending = "";
+  let error;
+  const child = spawn(opts.cmd, opts.args, {
+    cwd: opts.cwd,
+    signal: opts.signal,
+    env: buildChildEnv(),
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const queue = [];
+  let waiter;
+  const wake = () => {
+    if (waiter) {
+      const w = waiter;
+      waiter = void 0;
+      w();
+    }
+  };
+  child.stdout?.on("data", (c) => {
+    const s = c.toString();
+    if (stdout.length < max) stdout += s;
+    queue.push({ kind: "out", data: s });
+    wake();
+  });
+  child.stderr?.on("data", (c) => {
+    const s = c.toString();
+    if (stderr.length < max) stderr += s;
+    queue.push({ kind: "err", data: s });
+    wake();
+  });
+  child.on("error", (e) => {
+    error = e.message;
+    queue.push({ kind: "error", data: e.message });
+    wake();
+  });
+  child.on("close", (code) => {
+    queue.push({ kind: "close", data: "", code: code ?? 0 });
+    wake();
+  });
+  let exitCode = 0;
+  let spawnFailed = false;
+  for (; ; ) {
+    while (queue.length === 0) {
+      await new Promise((resolve4) => {
+        waiter = resolve4;
+      });
+    }
+    const chunk = queue.shift();
+    if (chunk.kind === "close") {
+      if (!spawnFailed) exitCode = chunk.code ?? 0;
+      break;
+    }
+    if (chunk.kind === "error") {
+      spawnFailed = true;
+      exitCode = 1;
+      continue;
+    }
+    pending += chunk.data;
+    if (pending.length >= flushAt) {
+      yield { type: "partial_output", text: pending };
+      pending = "";
+    }
+  }
+  if (pending.length > 0) {
+    yield { type: "partial_output", text: pending };
+  }
+  return {
+    stdout,
+    stderr,
+    exitCode,
+    truncated: stdout.length >= max || stderr.length >= max,
+    error
+  };
+}
+function resolvePath(input, ctx) {
+  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);
+}
+function ensureInsideRoot(absPath, ctx) {
+  const root = path.resolve(ctx.projectRoot);
+  const target = path.resolve(absPath);
+  const rel = path.relative(root, target);
+  if (rel.startsWith("..") || path.isAbsolute(rel)) {
+    throw new Error(`Path "${absPath}" is outside project root "${root}"`);
+  }
+  return target;
+}
+function safeResolve(input, ctx) {
+  return ensureInsideRoot(resolvePath(input, ctx), ctx);
+}
+function truncateMiddle(s, max) {
+  if (Buffer.byteLength(s, "utf8") <= max) return s;
+  const half = Math.floor(max / 2);
+  return s.slice(0, half) + `
+\u2026[truncated ${Buffer.byteLength(s, "utf8") - max} bytes from middle]\u2026
+` + s.slice(-half);
+}
+function isBinaryBuffer(buf) {
+  const len = Math.min(buf.length, 8192);
+  for (let i = 0; i < len; i++) {
+    if (buf[i] === 0) return true;
+  }
+  return false;
+}
+
+// src/audit.ts
+var auditTool = {
+  name: "audit",
+  category: "Package Management",
+  description: "Run npm/pnpm security audit. Returns vulnerabilities sorted by severity.",
+  usageHint: "Set `level` to filter minimum severity. `fix` attempts auto-fix. `packages` checks specific packages.",
+  permission: "confirm",
+  mutating: false,
+  timeoutMs: 6e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      cwd: { type: "string", description: "Working directory (default: cwd)" },
+      level: {
+        type: "string",
+        enum: ["low", "moderate", "high", "critical"],
+        description: "Minimum severity level to report"
+      },
+      fix: { type: "boolean", description: "Attempt to fix vulnerabilities (default: false)" },
+      packages: { type: "string", description: "Specific package(s) to audit (comma-separated)" }
+    }
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    for await (const ev of auditTool.executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("audit: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const manager = await detectManager(cwd);
+    yield { type: "log", text: `Auditing with ${manager}\u2026`, data: { manager } };
+    const args = ["audit", "--json"];
+    if (input.fix) args.push("--fix");
+    if (input.packages) {
+      const pkgs = Array.isArray(input.packages) ? input.packages : input.packages.split(",");
+      args.push(...pkgs.map((p) => p.trim()));
+    }
+    const result = yield* spawnStream({
+      cmd: manager,
+      args,
+      cwd,
+      signal: opts.signal,
+      maxBytes: 1e5
+    });
+    yield { type: "final", output: parseAuditOutput(result.stdout, result.exitCode) };
+  }
+};
+async function detectManager(cwd) {
+  const { stat: stat9 } = await import('fs/promises');
+  try {
+    await stat9(`${cwd}/pnpm-lock.yaml`);
+    return "pnpm";
+  } catch {
+  }
+  try {
+    await stat9(`${cwd}/yarn.lock`);
+    return "yarn";
+  } catch {
+  }
+  return "npm";
+}
+function parseAuditOutput(json, exitCode) {
+  if (!json) {
+    return {
+      exit_code: exitCode,
+      vulnerabilities: [],
+      total: 0,
+      summary: exitCode === 0 ? "No vulnerabilities found" : "Audit failed",
+      output: "",
+      truncated: false
+    };
+  }
+  try {
+    const data = JSON.parse(json);
+    const advisories = [];
+    const ads = data.advisories ?? {};
+    for (const id of Object.keys(ads)) {
+      const adv = ads[id];
+      advisories.push({
+        severity: adv.severity ?? "unknown",
+        package: adv.module_name ?? id,
+        title: adv.title ?? "Unknown vulnerability",
+        url: adv.url ?? ""
+      });
+    }
+    const total = advisories.length;
+    const summary = total === 0 ? "No vulnerabilities found" : `Found ${total} vulnerabilities: ${advisories.filter((a) => a.severity === "critical").length} critical, ${advisories.filter((a) => a.severity === "high").length} high`;
+    return {
+      exit_code: exitCode,
+      vulnerabilities: advisories,
+      total,
+      summary,
+      output: json,
+      truncated: json.length >= 1e5
+    };
+  } catch {
+    return {
+      exit_code: exitCode,
+      vulnerabilities: [],
+      total: 0,
+      summary: "Could not parse audit output",
+      output: json,
+      truncated: false
+    };
+  }
+}
+
+// src/bash.ts
+var MAX_OUTPUT = 32768;
+var DEFAULT_TIMEOUT = 3e4;
+var STREAM_FLUSH_INTERVAL_MS = 200;
+var STREAM_FLUSH_BYTES = 4 * 1024;
+var bashTool = {
+  name: "bash",
+  category: "Shell",
+  description: "Run a shell command. stdout and stderr are merged.",
+  usageHint: "Runs via `bash -c` (or `cmd /c` on Windows). Cwd is the project root. Default timeout 30s. Output truncated from the middle if oversized. Use for git, npm, builds, tests.",
+  permission: "confirm",
+  mutating: true,
+  // Trust rules match on the literal `command` string. Without subjectKey
+  // the policy heuristic would have done the same here, but declaring it
+  // explicitly removes the implicit cross-tool aliasing.
+  subjectKey: "command",
+  timeoutMs: 3e4,
+  maxOutputBytes: MAX_OUTPUT,
+  estimatedDurationMs: 3e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      command: { type: "string" },
+      timeout_ms: { type: "integer" },
+      background: { type: "boolean" }
+    },
+    required: ["command"]
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    for await (const ev of bashTool.executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("bash: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    if (!input?.command) throw new Error("bash: command is required");
+    const timeoutMs = Math.max(1, Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT, 6e5));
+    const isWin = os.platform() === "win32";
+    const shell = isWin ? process.env["COMSPEC"] ?? "cmd.exe" : process.env["SHELL"] ?? "/bin/bash";
+    const args = isWin ? ["/c", input.command] : ["-c", input.command];
+    const env = buildChildEnv(ctx.session?.id);
+    const detached = isWin ? !!input.background : true;
+    const child = spawn(shell, args, {
+      cwd: ctx.projectRoot,
+      env,
+      stdio: input.background ? "ignore" : ["ignore", "pipe", "pipe"],
+      detached,
+      signal: opts.signal
+    });
+    if (input.background) {
+      const pid = child.pid;
+      if (typeof pid === "number") child.unref();
+      yield {
+        type: "final",
+        output: {
+          output: `[background] pid=${pid ?? "unknown"}`,
+          exit_code: null,
+          timed_out: false,
+          pid
+        }
+      };
+      return;
+    }
+    let buf = "";
+    let pending = "";
+    let timedOut = false;
+    const timers = [];
+    const timer = setTimeout(() => {
+      timedOut = true;
+      if (isWin) {
+        try {
+          child.kill();
+        } catch {
+        }
+      } else {
+        try {
+          if (typeof child.pid === "number") {
+            try {
+              process.kill(-child.pid, "SIGTERM");
+            } catch {
+              child.kill("SIGTERM");
+            }
+          } else {
+            child.kill("SIGTERM");
+          }
+          const killTimer = setTimeout(() => {
+            try {
+              if (typeof child.pid === "number") {
+                try {
+                  process.kill(-child.pid, "SIGKILL");
+                } catch {
+                  child.kill("SIGKILL");
+                }
+              } else {
+                child.kill("SIGKILL");
+              }
+            } catch {
+            }
+          }, 2e3);
+          timers.push(killTimer);
+        } catch {
+        }
+      }
+    }, timeoutMs);
+    timers.push(timer);
+    timer.unref?.();
+    const queue = [];
+    let resolveNext = null;
+    const push = (c) => {
+      if (resolveNext) {
+        const r = resolveNext;
+        resolveNext = null;
+        r(c);
+      } else {
+        queue.push(c);
+      }
+    };
+    const next = () => new Promise((resolve4) => {
+      const c = queue.shift();
+      if (c) resolve4(c);
+      else resolveNext = resolve4;
+    });
+    let lastFlush = Date.now();
+    const flush = () => {
+      if (pending.length === 0) return null;
+      const text = pending;
+      pending = "";
+      lastFlush = Date.now();
+      return text;
+    };
+    child.stdout?.on("data", (chunk) => {
+      const text = chunk.toString();
+      buf += text;
+      pending += text;
+      push({ kind: "data", text });
+    });
+    child.stderr?.on("data", (chunk) => {
+      const text = chunk.toString();
+      buf += text;
+      pending += text;
+      push({ kind: "data", text });
+    });
+    child.on("error", (err) => {
+      for (const t of timers) clearTimeout(t);
+      push({ kind: "error", err });
+    });
+    child.on("close", (code) => {
+      for (const t of timers) clearTimeout(t);
+      push({ kind: "end", code });
+    });
+    try {
+      while (true) {
+        const c = await next();
+        if (c.kind === "error") throw c.err;
+        if (c.kind === "end") {
+          const remainder = flush();
+          if (remainder !== null) {
+            yield { type: "partial_output", text: remainder };
+          }
+          const cleaned = stripAnsi(buf).replace(/\r\n?/g, "\n");
+          yield {
+            type: "final",
+            output: {
+              output: truncateMiddle(cleaned, MAX_OUTPUT),
+              exit_code: c.code,
+              timed_out: timedOut
+            }
+          };
+          return;
+        }
+        const now = Date.now();
+        if (pending.length >= STREAM_FLUSH_BYTES || now - lastFlush >= STREAM_FLUSH_INTERVAL_MS) {
+          const text = flush();
+          if (text) yield { type: "partial_output", text };
+        }
+      }
+    } finally {
+      for (const t of timers) clearTimeout(t);
+    }
+  }
+};
+
+// src/batch-tool-use.ts
+var batchToolUseTool = {
+  name: "batch_tool_use",
+  category: "Meta",
+  description: "Execute multiple tool calls in sequence or parallel. Returns all results.",
+  usageHint: "Set `calls` array with tool names and inputs. `stop_on_error` halts on first failure. `parallel` runs concurrently (default: true).",
+  permission: "confirm",
+  mutating: true,
+  timeoutMs: 12e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      calls: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: {
+            tool: { type: "string" },
+            input: { type: "object" }
+          },
+          required: ["tool"]
+        },
+        description: "Array of tool calls to execute"
+      },
+      stop_on_error: {
+        type: "boolean",
+        description: "Stop execution on first error (default: false)"
+      },
+      parallel: {
+        type: "boolean",
+        description: "Execute calls in parallel (default: true)"
+      }
+    },
+    required: ["calls"]
+  },
+  async execute(input, ctx, opts) {
+    if (!input?.calls || input.calls.length === 0) {
+      return {
+        results: [],
+        total: 0,
+        succeeded: 0,
+        failed: 0,
+        stop_on_error: false
+      };
+    }
+    const results = [];
+    let succeeded = 0;
+    let failed = 0;
+    if (input.parallel !== false) {
+      const promises = input.calls.map(async (call) => executeSingle(call, ctx, opts));
+      const allResults = await Promise.all(promises);
+      results.push(...allResults);
+      succeeded = allResults.filter((r) => r.success).length;
+      failed = allResults.filter((r) => !r.success).length;
+    } else {
+      for (const call of input.calls) {
+        const result = await executeSingle(call, ctx, opts);
+        results.push(result);
+        if (result.success) {
+          succeeded++;
+        } else {
+          failed++;
+          if (input.stop_on_error) break;
+        }
+      }
+    }
+    return {
+      results,
+      total: input.calls.length,
+      succeeded,
+      failed,
+      stop_on_error: input.stop_on_error ?? false
+    };
+  }
+};
+async function executeSingle(call, ctx, opts) {
+  const start = Date.now();
+  const tool = ctx.tools.find((t) => t.name === call.tool);
+  if (!tool) {
+    return {
+      tool: call.tool,
+      success: false,
+      error: `tool "${call.tool}" not found`,
+      executionMs: Date.now() - start
+    };
+  }
+  try {
+    const result = await tool.execute(call.input, ctx, opts);
+    return {
+      tool: call.tool,
+      success: true,
+      result,
+      executionMs: Date.now() - start
+    };
+  } catch (e) {
+    return {
+      tool: call.tool,
+      success: false,
+      error: e instanceof Error ? e.message : String(e),
+      executionMs: Date.now() - start
+    };
+  }
+}
+var diffTool = {
+  name: "diff",
+  category: "Filesystem",
+  description: "Show differences between files, commits, or branches. Supports staged vs working tree.",
+  usageHint: "Use `files` for file paths, `a`/`b` for commit refs, `staged` for git index. `mode`: unified (default), stat, side-by-side.",
+  permission: "auto",
+  mutating: false,
+  timeoutMs: 1e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      path: { type: "string", description: "Working directory for diff" },
+      files: {
+        type: "string",
+        description: 'File(s) to diff: single path, comma-separated, or "**/*.ts" glob'
+      },
+      a: { type: "string", description: "First commit/branch/ref (for git diff)" },
+      b: { type: "string", description: "Second commit/branch/ref (for git diff)" },
+      staged: { type: "boolean", description: "Diff staged changes only" },
+      mode: {
+        type: "string",
+        enum: ["unified", "side-by-side", "stat"],
+        description: "Output mode (default: unified)"
+      },
+      context: { type: "integer", description: "Context lines for unified diff (default: 3)" }
+    }
+  },
+  async execute(input, ctx, opts) {
+    if (input.a !== void 0 || input.b !== void 0) {
+      return await gitDiff(input, ctx, opts.signal);
+    }
+    return await fileDiff(input, ctx, opts.signal);
+  }
+};
+async function gitDiff(input, ctx, signal) {
+  const gitDir = findGitDir(ctx.cwd);
+  if (!gitDir) {
+    return { diff: "", files: [], truncated: false, mode: "unified" };
+  }
+  const args = ["diff", "--no-color"];
+  if (input.staged) args.push("--staged");
+  if (input.a) args.push(input.a);
+  if (input.b) args.push(input.b);
+  if (input.files) {
+    const files = Array.isArray(input.files) ? input.files : input.files.split(",");
+    args.push("--", ...files.map((f) => f.trim()));
+  }
+  const result = await runGit(args, gitDir, signal);
+  return {
+    diff: result.stdout,
+    files: [],
+    truncated: result.stdout.length > 1e5,
+    mode: "unified"
+  };
+}
+function findGitDir(cwd) {
+  let dir = cwd;
+  for (let i = 0; i < 20; i++) {
+    try {
+      const stat9 = statSync(path.join(dir, ".git"));
+      if (stat9.isDirectory()) return dir;
+    } catch {
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function runGit(args, cwd, signal) {
+  return new Promise((resolve4) => {
+    let stdout = "";
+    let stderr = "";
+    const child = spawn("git", args, { cwd, signal, stdio: ["ignore", "pipe", "pipe"] });
+    child.stdout?.on("data", (c) => {
+      stdout += c.toString();
+    });
+    child.stderr?.on("data", (c) => {
+      stderr += c.toString();
+    });
+    child.on("close", (code) => resolve4({ stdout, stderr, exitCode: code ?? 0 }));
+    child.on("error", (e) => resolve4({ stdout: "", stderr: e.message, exitCode: 1 }));
+  });
+}
+async function fileDiff(input, ctx, signal) {
+  input.path ? safeResolve(input.path, ctx) : ctx.cwd;
+  input.context ?? 3;
+  const files = input.files ? (Array.isArray(input.files) ? input.files : input.files.split(",")).map((f) => f.trim()).filter(Boolean) : [];
+  if (files.length === 0) {
+    return {
+      diff: "No files specified",
+      files: [],
+      truncated: false,
+      mode: input.mode ?? "unified"
+    };
+  }
+  const results = [];
+  for (const file of files) {
+    const absPath = safeResolve(file, ctx);
+    const stat9 = await fs9.stat(absPath).catch(() => null);
+    if (!stat9?.isFile()) continue;
+    const content = await fs9.readFile(absPath, "utf8");
+    const lines = content.split(/\r?\n/);
+    results.push(`--- ${file}
++++ ${file}
+${formatUnified(lines)}`);
+  }
+  return {
+    diff: results.join("\n"),
+    files,
+    truncated: false,
+    mode: input.mode ?? "unified"
+  };
+}
+function formatUnified(lines, context) {
+  return lines.map((line, i) => ` ${line}`).join("\n");
+}
+var documentTool = {
+  name: "document",
+  category: "Project",
+  description: "Generate or update documentation comments for functions, classes, and types. Supports JSDoc, TSDoc, and block comments.",
+  usageHint: "Set `target` for what to document. `files` for paths. `style` for comment format. `overwrite` replaces existing docs.",
+  permission: "confirm",
+  mutating: true,
+  timeoutMs: 3e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      target: {
+        type: "string",
+        enum: ["file", "function", "class", "type", "all"],
+        description: "What to document"
+      },
+      path: {
+        type: "string",
+        description: "Specific file path to document"
+      },
+      files: {
+        type: "string",
+        description: "File(s) to process: single path, comma-separated list, or glob"
+      },
+      style: {
+        type: "string",
+        enum: ["jsdoc", "tsdoc", "block"],
+        description: "Documentation style (default: jsdoc)"
+      },
+      overwrite: {
+        type: "boolean",
+        description: "Overwrite existing docstrings (default: false)"
+      },
+      cwd: { type: "string", description: "Working directory (default: cwd)" }
+    }
+  },
+  async execute(input, ctx) {
+    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const style = input.style ?? "jsdoc";
+    const results = [];
+    let filesProcessed = 0;
+    let itemsDocumented = 0;
+    const fileList = input.files ? await resolveFiles(Array.isArray(input.files) ? input.files.join(",") : input.files, cwd) : input.path ? [safeResolve(input.path, ctx)] : [];
+    for (const absPath of fileList) {
+      try {
+        const content = await fs9.readFile(absPath, "utf8");
+        filesProcessed++;
+        const processed = processFile(
+          content,
+          absPath,
+          style,
+          input.overwrite ?? false,
+          input.target ?? "all"
+        );
+        results.push(...processed);
+        itemsDocumented += processed.filter((r) => r.status === "documented").length;
+      } catch (e) {
+        results.push({
+          path: absPath,
+          name: absPath.split("/").pop() ?? absPath,
+          signature: "",
+          docstring: "",
+          status: "error",
+          error: e instanceof Error ? e.message : String(e)
+        });
+      }
+    }
+    return {
+      files_processed: filesProcessed,
+      items_documented: itemsDocumented,
+      results,
+      style
+    };
+  }
+};
+async function resolveFiles(filesInput, cwd) {
+  const files = Array.isArray(filesInput) ? filesInput : filesInput.split(",");
+  const resolved = [];
+  for (const f of files) {
+    const absPath = f.trim().startsWith("/") ? f.trim() : `${cwd}/${f.trim()}`;
+    try {
+      const stat9 = await fs9.stat(absPath);
+      if (stat9.isFile()) resolved.push(absPath);
+    } catch {
+    }
+  }
+  return resolved;
+}
+function processFile(content, absPath, style, overwrite, target) {
+  const results = [];
+  content.split("\n");
+  const functionRegex = /(?:async\s+)?function\s+(\w+)\s*\(([^)]*)\)/g;
+  const arrowRegex = /(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s+)?\(([^)]*)\)\s*=>/g;
+  const classRegex = /class\s+(\w+)/g;
+  const typeRegex = /(?:type|interface)\s+(\w+)\s*[=<]/g;
+  const allMatches = [];
+  if (target === "all" || target === "function") {
+    for (const m of content.matchAll(functionRegex)) {
+      if (!m[1]) continue;
+      allMatches.push({
+        name: m[1],
+        sig: m[2] ?? "",
+        type: "function",
+        line: content.slice(0, m.index).split("\n").length
+      });
+    }
+    for (const m of content.matchAll(arrowRegex)) {
+      if (!m[1]) continue;
+      allMatches.push({
+        name: m[1],
+        sig: m[2] ?? "",
+        type: "arrow",
+        line: content.slice(0, m.index).split("\n").length
+      });
+    }
+  }
+  if (target === "all" || target === "class") {
+    for (const m of content.matchAll(classRegex)) {
+      if (!m[1]) continue;
+      allMatches.push({
+        name: m[1],
+        sig: "",
+        type: "class",
+        line: content.slice(0, m.index).split("\n").length
+      });
+    }
+  }
+  if (target === "all" || target === "type") {
+    for (const m of content.matchAll(typeRegex)) {
+      if (!m[1]) continue;
+      allMatches.push({
+        name: m[1],
+        sig: m[0] ?? "",
+        type: "type",
+        line: content.slice(0, m.index).split("\n").length
+      });
+    }
+  }
+  for (const m of allMatches) {
+    results.push({
+      path: absPath,
+      name: m.name,
+      signature: m.sig,
+      docstring: `/** ${m.name} - documented at line ${m.line} */`,
+      status: "skipped"
+    });
+  }
+  return results;
+}
+var editTool = {
+  name: "edit",
+  category: "Filesystem",
+  description: "Make a surgical edit by replacing exact text. Fails if `old_string` is not unique unless `replace_all` is true.",
+  usageHint: "Always `read` the file first. `old_string` must be an EXACT match (whitespace included). If multiple matches exist, either narrow `old_string` with more context or set `replace_all: true`.",
+  permission: "confirm",
+  mutating: true,
+  timeoutMs: 5e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      path: { type: "string" },
+      old_string: { type: "string" },
+      new_string: { type: "string" },
+      replace_all: { type: "boolean" }
+    },
+    required: ["path", "old_string", "new_string"]
+  },
+  async execute(input, ctx) {
+    if (!input?.path) throw new Error("edit: path is required");
+    if (input.old_string === void 0) throw new Error("edit: old_string is required");
+    if (input.new_string === void 0) throw new Error("edit: new_string is required");
+    if (input.old_string === "") throw new Error("edit: old_string cannot be empty");
+    const absPath = safeResolve(input.path, ctx);
+    const stat9 = await fs9.stat(absPath).catch((err) => {
+      if (err.code === "ENOENT") {
+        throw new Error(`edit: file "${input.path}" does not exist. Use \`write\` instead.`);
+      }
+      throw err;
+    });
+    if (!stat9.isFile()) throw new Error(`edit: "${input.path}" is not a regular file`);
+    if (!ctx.hasRead(absPath)) {
+      throw new Error(`edit: file "${input.path}" was not read in this session. Read it first.`);
+    }
+    const lastReadMtime = ctx.lastReadMtime(absPath);
+    const mtimeTolerance = process.platform === "win32" ? 2e3 : 1;
+    if (lastReadMtime !== void 0 && stat9.mtimeMs > lastReadMtime + mtimeTolerance) {
+      throw new Error(`edit: file "${input.path}" was modified externally. Re-read it first.`);
+    }
+    const original = await fs9.readFile(absPath, "utf8");
+    const style = detectNewlineStyle(original);
+    const fileLf = normalizeToLf(original);
+    const oldLf = normalizeToLf(input.old_string);
+    const newLf = normalizeToLf(input.new_string);
+    if (oldLf === newLf) {
+      return {
+        path: absPath,
+        replacements: 0,
+        diff: "(no-op: old and new are identical)"
+      };
+    }
+    let count = 0;
+    let idx = fileLf.indexOf(oldLf);
+    const matches = [];
+    while (idx !== -1) {
+      matches.push(idx);
+      count++;
+      idx = fileLf.indexOf(oldLf, idx + 1);
+    }
+    if (count === 0) {
+      const hint = findSimilarity(fileLf, oldLf);
+      throw new Error(
+        `edit: no match for old_string in "${input.path}".${hint ? ` Nearest match near line ${hint}.` : ""}`
+      );
+    }
+    if (count > 1 && !input.replace_all) {
+      const lines = lineNumbersFor(fileLf, matches);
+      throw new Error(
+        `edit: old_string matched ${count} times in "${input.path}" (lines: ${lines.join(", ")}). Add more context to make it unique, or set replace_all: true.`
+      );
+    }
+    const newFileLf = input.replace_all ? fileLf.split(oldLf).join(newLf) : fileLf.replace(oldLf, newLf);
+    const newFile = toStyle(newFileLf, style);
+    await atomicWrite(absPath, newFile, { mode: stat9.mode & 511 });
+    const updated = await fs9.stat(absPath);
+    ctx.recordRead(absPath, updated.mtimeMs);
+    const diff = unifiedDiff(original, newFile, {
+      fromFile: input.path,
+      toFile: input.path
+    });
+    return {
+      path: absPath,
+      replacements: input.replace_all ? count : 1,
+      diff
+    };
+  }
+};
+function lineNumbersFor(text, indices) {
+  const out = [];
+  let pos = 0;
+  let line = 1;
+  for (const target of indices) {
+    while (pos < target) {
+      if (text.charCodeAt(pos) === 10) line++;
+      pos++;
+    }
+    out.push(line);
+  }
+  return out;
+}
+function findSimilarity(haystack, needle) {
+  if (needle.length < 20) return void 0;
+  const probe = needle.slice(0, Math.min(40, needle.length));
+  const idx = haystack.indexOf(probe);
+  if (idx === -1) return void 0;
+  let line = 1;
+  for (let i = 0; i < idx; i++) {
+    if (haystack.charCodeAt(i) === 10) line++;
+  }
+  return line;
+}
+var ALLOWED_COMMANDS = {
+  node: ["--version", "-e", "-p", "-r", "--input-type=module"],
+  npm: ["--version", "init", "install", "test", "run", "list", "pkg", "doctor"],
+  pnpm: ["--version", "init", "install", "add", "remove", "exec", "list", "run", "dlx"],
+  npx: ["--version"],
+  git: [
+    "--version",
+    "status",
+    "log",
+    "diff",
+    "branch",
+    "checkout",
+    "stash",
+    "add",
+    "commit",
+    "push",
+    "pull"
+  ],
+  ls: ["-la", "-l", "-a"],
+  cat: [],
+  head: ["-n"],
+  tail: ["-n"],
+  wc: ["-l", "-w", "-c"],
+  grep: [],
+  find: [],
+  echo: [],
+  mkdir: ["-p"],
+  cp: ["-r"],
+  mv: [],
+  rm: ["-rf"],
+  touch: [],
+  bun: ["--version", "run", "add", "init"],
+  tsc: ["--version", "--noEmit", "--project"],
+  vitest: ["--version", "run", "--coverage"],
+  biome: ["--version", "lint", "format", "check"],
+  cargo: ["--version", "build", "test", "check"],
+  rustc: ["--version"],
+  go: ["version", "run", "build", "test"],
+  python: ["--version", "-c"],
+  pip: ["--version", "install", "list"],
+  docker: ["--version", "ps", "images", "build"],
+  kubectl: ["version", "get", "describe", "logs"]
+};
+var MAX_ARGS = 20;
+var MAX_OUTPUT2 = 2e5;
+var TIMEOUT_MS = 3e4;
+var execTool = {
+  name: "exec",
+  category: "Shell",
+  description: "Restricted shell that only runs pre-approved commands with constrained arguments. Safer alternative to `bash`.",
+  usageHint: "Set `command` (must be in allowlist). `args` passed through. For arbitrary shell access use the `bash` tool instead.",
+  permission: "confirm",
+  mutating: true,
+  timeoutMs: TIMEOUT_MS,
+  inputSchema: {
+    type: "object",
+    properties: {
+      command: { type: "string", description: "Command to run (must be in allowlist)" },
+      args: { type: "array", items: { type: "string" }, description: "Arguments" },
+      cwd: { type: "string", description: "Working directory (must resolve inside project root)" },
+      timeout: { type: "integer", description: "Timeout in ms (default: 30000)" }
+    },
+    required: ["command"]
+  },
+  async execute(input, ctx, opts) {
+    const cmd = input.command.trim();
+    if (!cmd)
+      return {
+        command: cmd,
+        args: [],
+        stdout: "",
+        stderr: "Empty command",
+        exitCode: 1,
+        truncated: false,
+        allowed: false
+      };
+    if (!(cmd in ALLOWED_COMMANDS)) {
+      return {
+        command: cmd,
+        args: input.args ?? [],
+        stdout: "",
+        stderr: `Command "${cmd}" not in allowlist. Use the bash tool for arbitrary commands.`,
+        exitCode: 1,
+        truncated: false,
+        allowed: false
+      };
+    }
+    const args = (input.args ?? []).slice(0, MAX_ARGS);
+    const timeout = Math.max(1, Math.min(input.timeout ?? TIMEOUT_MS, TIMEOUT_MS));
+    const requestedCwd = input.cwd ? path.resolve(ctx.projectRoot, input.cwd) : ctx.cwd;
+    const rel = path.relative(ctx.projectRoot, requestedCwd);
+    if (rel.startsWith("..") || path.isAbsolute(rel)) {
+      return {
+        command: cmd,
+        args,
+        stdout: "",
+        stderr: `cwd "${input.cwd}" resolves outside project root`,
+        exitCode: 1,
+        truncated: false,
+        allowed: false
+      };
+    }
+    const cwd = requestedCwd;
+    const signal = opts.signal;
+    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id);
+  }
+};
+function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
+  return new Promise((resolve4) => {
+    let stdout = "";
+    let stderr = "";
+    let killed = false;
+    const child = spawn(cmd, args, {
+      cwd,
+      signal,
+      env: buildChildEnv(sessionId),
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const timer = setTimeout(() => {
+      killed = true;
+      child.kill("SIGTERM");
+    }, timeout);
+    child.stdout?.on("data", (chunk) => {
+      if (stdout.length < MAX_OUTPUT2) stdout += chunk.toString();
+    });
+    child.stderr?.on("data", (chunk) => {
+      if (stderr.length < MAX_OUTPUT2) stderr += chunk.toString();
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve4({
+        command: cmd,
+        args,
+        stdout: stdout.slice(0, MAX_OUTPUT2),
+        stderr: stderr.slice(0, MAX_OUTPUT2),
+        exitCode: killed ? 124 : code ?? 1,
+        truncated: stdout.length >= MAX_OUTPUT2 || stderr.length >= MAX_OUTPUT2,
+        allowed: true
+      });
+    });
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      resolve4({
+        command: cmd,
+        args,
+        stdout: stdout.slice(0, MAX_OUTPUT2),
+        stderr: err.message,
+        exitCode: 1,
+        truncated: false,
+        allowed: true
+      });
+    });
+  });
+}
+var MAX_BYTES = 131072;
+var TIMEOUT_MS2 = 2e4;
+var ALLOW_PRIVATE = process.env["WRONGSTACK_FETCH_ALLOW_PRIVATE"] === "1";
+async function fetchWithRedirectLimit(url, maxRedirects, signal) {
+  const headers = {
+    "user-agent": "WrongStack/1.0 (+https://wrongstack.com)",
+    accept: "text/html,application/json;q=0.9,text/plain;q=0.8,*/*;q=0.1"
+  };
+  let redirectCount = 0;
+  let currentUrl = url;
+  for (; ; ) {
+    const parsed = new URL(currentUrl);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+      throw new Error(`fetch: redirect to unsupported protocol "${parsed.protocol}"`);
+    }
+    if (parsed.protocol === "http:" && !ALLOW_PRIVATE) {
+      throw new Error("fetch: redirect to http:// blocked (HTTPS required by default)");
+    }
+    await assertNotPrivate(parsed.hostname);
+    const res = await fetch(currentUrl, {
+      redirect: "manual",
+      signal,
+      headers
+    });
+    if (res.status < 300 || res.status > 399) {
+      return res;
+    }
+    redirectCount++;
+    if (redirectCount > maxRedirects) {
+      throw new Error(`fetch: exceeded ${maxRedirects} redirects`);
+    }
+    const location = res.headers.get("location");
+    if (!location) {
+      throw new Error("fetch: redirect status with no location header");
+    }
+    currentUrl = new URL(location, currentUrl).toString();
+  }
+}
+var fetchTool = {
+  name: "fetch",
+  category: "Network",
+  description: "Fetch the contents of a URL. HTML is converted to markdown by default.",
+  usageHint: "HTTPS only by default. Localhost and RFC1918 ranges blocked unless WRONGSTACK_FETCH_ALLOW_PRIVATE=1. Max 5 redirects, 20s timeout, 128KB cap.",
+  permission: "confirm",
+  mutating: false,
+  // Trust rules for fetch match on the literal URL — declare it explicitly
+  // so a user can trust `https://api.example.com/*` without accidentally
+  // matching that pattern on any other tool that happens to have a `url`
+  // input field.
+  subjectKey: "url",
+  timeoutMs: TIMEOUT_MS2,
+  maxOutputBytes: MAX_BYTES,
+  inputSchema: {
+    type: "object",
+    properties: {
+      url: { type: "string" },
+      format: { type: "string", enum: ["markdown", "text", "raw"] }
+    },
+    required: ["url"]
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    for await (const ev of fetchTool.executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("fetch: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, _ctx, opts) {
+    if (!input?.url) throw new Error("fetch: url is required");
+    const u = new URL(input.url);
+    if (u.protocol !== "https:" && u.protocol !== "http:") {
+      throw new Error(`fetch: unsupported protocol "${u.protocol}"`);
+    }
+    if (u.protocol === "http:" && !ALLOW_PRIVATE) {
+      throw new Error("fetch: http:// blocked (HTTPS required by default)");
+    }
+    await assertNotPrivate(u.hostname);
+    yield { type: "log", text: `GET ${input.url}` };
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(new Error("fetch timeout")), TIMEOUT_MS2);
+    const combined = combineSignals(opts.signal, ctrl.signal);
+    try {
+      const res = await fetchWithRedirectLimit(input.url, 5, combined);
+      const ct = res.headers.get("content-type") ?? "application/octet-stream";
+      if (/^image\/|^audio\/|^video\/|application\/octet-stream/.test(ct)) {
+        throw new Error(`fetch: refusing to read binary content-type "${ct}"`);
+      }
+      yield {
+        type: "log",
+        text: `HTTP ${res.status} ${ct}`,
+        data: { status: res.status, contentType: ct }
+      };
+      const reader = res.body?.getReader();
+      let received = 0;
+      const chunks = [];
+      let pendingBytes = 0;
+      const FLUSH_AT = 4 * 1024;
+      if (reader) {
+        for (; ; ) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          if (!value) continue;
+          received += value.byteLength;
+          pendingBytes += value.byteLength;
+          chunks.push(value);
+          if (pendingBytes >= FLUSH_AT) {
+            const recent = Buffer.from(value).toString("utf8");
+            yield {
+              type: "partial_output",
+              text: recent,
+              data: { received }
+            };
+            pendingBytes = 0;
+          }
+          if (received > MAX_BYTES) break;
+        }
+      }
+      const text = Buffer.concat(chunks.map((c) => Buffer.from(c))).toString("utf8");
+      const format = input.format ?? (ct.includes("text/html") ? "markdown" : "text");
+      let content;
+      if (format === "raw") content = text;
+      else if (format === "markdown" && ct.includes("text/html")) content = htmlToMarkdown(text);
+      else if (ct.includes("application/json")) content = prettyJson(text);
+      else content = text;
+      yield {
+        type: "final",
+        output: {
+          content: truncateMiddle(content, MAX_BYTES),
+          status: res.status,
+          content_type: ct,
+          url: res.url
+        }
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+async function assertNotPrivate(hostname) {
+  if (ALLOW_PRIVATE) return;
+  const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  if (host === "localhost" || host.endsWith(".localhost")) {
+    throw new Error("fetch: blocked localhost target");
+  }
+  const ipVersion = net.isIP(host);
+  if (ipVersion === 4) {
+    if (isPrivateIPv4(host)) {
+      throw new Error(`fetch: blocked private/loopback address "${host}"`);
+    }
+  } else if (ipVersion === 6) {
+    if (isPrivateIPv6(host)) {
+      throw new Error(`fetch: blocked private/loopback address "${host}"`);
+    }
+  } else {
+    try {
+      const records = await dns.lookup(host, { all: true });
+      for (const r of records) {
+        const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);
+        if (bad) {
+          throw new Error(`fetch: resolved to private address ${r.address}`);
+        }
+      }
+    } catch (err) {
+      if (err instanceof Error && err.message.startsWith("fetch:")) throw err;
+    }
+  }
+}
+function isPrivateIPv4(addr) {
+  const parts = addr.split(".").map((p) => Number.parseInt(p, 10));
+  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) {
+    return true;
+  }
+  const [a, b, c] = parts;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 192 && b === 0 && c === 0) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function isPrivateIPv6(addr) {
+  const lower = addr.toLowerCase();
+  if (lower === "::" || lower === "::1") return true;
+  const groups = expandIPv6(lower);
+  if (!groups) return true;
+  if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) {
+    const a = (groups[6] ?? 0) >> 8;
+    const b = (groups[6] ?? 0) & 255;
+    const c = (groups[7] ?? 0) >> 8;
+    const d = (groups[7] ?? 0) & 255;
+    return isPrivateIPv4(`${a}.${b}.${c}.${d}`);
+  }
+  const high = groups[0] ?? 0;
+  if ((high & 65024) === 64512) return true;
+  if ((high & 65472) === 65152) return true;
+  if ((high & 65280) === 65280) return true;
+  return false;
+}
+function expandIPv6(addr) {
+  const parts = addr.split("::");
+  if (parts.length > 2) return null;
+  const parseGroups = (s) => {
+    if (s === "") return [];
+    const out = [];
+    for (const g of s.split(":")) {
+      if (g.length === 0 || g.length > 4) return null;
+      const n = Number.parseInt(g, 16);
+      if (Number.isNaN(n) || n < 0 || n > 65535) return null;
+      out.push(n);
+    }
+    return out;
+  };
+  if (parts.length === 1) {
+    const groups = parseGroups(parts[0] ?? "");
+    if (!groups || groups.length !== 8) return null;
+    return groups;
+  }
+  const head = parseGroups(parts[0] ?? "");
+  const tail = parseGroups(parts[1] ?? "");
+  if (!head || !tail) return null;
+  const fill = 8 - head.length - tail.length;
+  if (fill < 0) return null;
+  return [...head, ...new Array(fill).fill(0), ...tail];
+}
+function combineSignals(...sigs) {
+  if (typeof AbortSignal.any === "function") {
+    return AbortSignal.any(sigs);
+  }
+  const ctrl = new AbortController();
+  const cleanups = [];
+  const detach = () => {
+    for (const fn of cleanups) fn();
+    cleanups.length = 0;
+  };
+  for (const s of sigs) {
+    if (s.aborted) {
+      detach();
+      ctrl.abort(s.reason);
+      return ctrl.signal;
+    }
+    const onAbort = () => {
+      detach();
+      ctrl.abort(s.reason);
+    };
+    s.addEventListener("abort", onAbort, { once: true });
+    cleanups.push(() => s.removeEventListener("abort", onAbort));
+  }
+  ctrl.signal.addEventListener("abort", detach, { once: true });
+  return ctrl.signal;
+}
+function prettyJson(s) {
+  try {
+    return JSON.stringify(JSON.parse(s), null, 2);
+  } catch {
+    return s;
+  }
+}
+function htmlToMarkdown(html) {
+  let s = html;
+  s = s.replace(/<script[\s\S]*?<\/script>/gi, "");
+  s = s.replace(/<style[\s\S]*?<\/style>/gi, "");
+  s = s.replace(/<noscript[\s\S]*?<\/noscript>/gi, "");
+  s = s.replace(/<h([1-6])[^>]*>([\s\S]*?)<\/h\1>/gi, (_m, n, c) => {
+    return "\n" + "#".repeat(Number(n)) + " " + stripTags(c).trim() + "\n";
+  });
+  s = s.replace(/<(strong|b)[^>]*>([\s\S]*?)<\/\1>/gi, "**$2**");
+  s = s.replace(/<(em|i)[^>]*>([\s\S]*?)<\/\1>/gi, "*$2*");
+  s = s.replace(/<a [^>]*href="([^"]+)"[^>]*>([\s\S]*?)<\/a>/gi, "[$2]($1)");
+  s = s.replace(/<pre[^>]*>([\s\S]*?)<\/pre>/gi, (_m, c) => "\n```\n" + stripTags(c) + "\n```\n");
+  s = s.replace(/<code[^>]*>([\s\S]*?)<\/code>/gi, "`$1`");
+  s = s.replace(/<li[^>]*>([\s\S]*?)<\/li>/gi, "- $1\n");
+  s = s.replace(/<br\s*\/?>/gi, "\n");
+  s = s.replace(/<\/p>/gi, "\n\n");
+  s = stripTags(s);
+  s = s.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&nbsp;/g, " ");
+  return s.replace(/\n{3,}/g, "\n\n").trim();
+}
+function stripTags(s) {
+  return s.replace(/<[^>]+>/g, "");
+}
+
+// src/format.ts
+var formatTool = {
+  name: "format",
+  category: "Code Quality",
+  description: "Format files with biome or prettier. Use `check` to verify without modifying.",
+  usageHint: "Set `files` (glob or comma-separated). `check` only validates. `fixer` forces tool.",
+  permission: "confirm",
+  mutating: true,
+  timeoutMs: 6e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      files: {
+        type: "string",
+        description: "Files/patterns: single path, comma-separated list, or glob"
+      },
+      fixer: {
+        type: "string",
+        enum: ["biome", "prettier", "auto"],
+        description: "Formatter to use (default: auto-detect)"
+      },
+      check: {
+        type: "boolean",
+        description: "Verify only, do not modify files (default: false)"
+      },
+      cwd: { type: "string", description: "Working directory (default: cwd)" }
+    }
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    for await (const ev of formatTool.executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("format: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const fixer = input.fixer ?? "auto";
+    const detected = fixer === "auto" ? await detectFixer(cwd) : fixer;
+    if (!detected) {
+      yield {
+        type: "final",
+        output: {
+          fixer: "none",
+          files_checked: 0,
+          files_changed: 0,
+          output: "No formatter found (biome.json, .prettierrc)",
+          truncated: false
+        }
+      };
+      return;
+    }
+    yield {
+      type: "log",
+      text: `Running ${detected}\u2026`,
+      data: { fixer: detected, check: !!input.check }
+    };
+    const args = ["format", "--write"];
+    if (input.check) args[args.length - 1] = "--check";
+    if (input.files) {
+      const files = Array.isArray(input.files) ? input.files : input.files.split(",");
+      args.push("--", ...files.map((f) => f.trim()));
+    }
+    const result = yield* spawnStream({
+      cmd: detected,
+      args,
+      cwd,
+      signal: opts.signal,
+      maxBytes: 1e5
+    });
+    const changed = (result.stdout.match(/changed/g) || []).length;
+    yield {
+      type: "final",
+      output: {
+        fixer: detected,
+        files_checked: 0,
+        files_changed: changed,
+        output: result.stdout || result.stderr || result.error || "",
+        truncated: result.truncated
+      }
+    };
+  }
+};
+async function detectFixer(cwd) {
+  const { stat: stat9 } = await import('fs/promises');
+  try {
+    await stat9(`${cwd}/biome.json`);
+    return "biome";
+  } catch {
+    try {
+      await stat9(`${cwd}/.prettierrc`);
+      return "prettier";
+    } catch {
+      return "biome";
+    }
+  }
+}
+var TIMEOUT_MS3 = 3e4;
+var MAX_OUTPUT3 = 1e5;
+var gitTool = {
+  name: "git",
+  category: "Git",
+  description: "Run git commands. Wraps common operations: status, log, diff, commit, branch, checkout, stash, push, pull, fetch, reset.",
+  usageHint: "Prefer built-in subcommands over raw args. `command` is required. `message` for commits. `branch` for checkout/branch. `files` for status/diff. `format` for log.",
+  permission: "confirm",
+  // Conservative: any of these may mutate. The non-mutating commands
+  // (status/log/diff/branch/fetch) are still gated on `permission: 'confirm'`
+  // and `MUTATING_SUBCOMMANDS` is consulted at runtime for per-call checks.
+  mutating: true,
+  timeoutMs: TIMEOUT_MS3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      command: {
+        type: "string",
+        enum: [
+          "status",
+          "log",
+          "diff",
+          "commit",
+          "branch",
+          "checkout",
+          "stash",
+          "push",
+          "pull",
+          "fetch",
+          "reset"
+        ],
+        description: "Git subcommand"
+      },
+      files: {
+        type: "string",
+        description: 'File(s) for status/diff: single path, comma-separated list, or "**/*.ts" glob'
+      },
+      message: { type: "string", description: "Commit message (required for commit)" },
+      branch: { type: "string", description: "Branch name for checkout/branch" },
+      format: {
+        type: "string",
+        enum: ["short", "oneline", "stat", "graph"],
+        description: "Log format (default: short)"
+      },
+      limit: { type: "integer", description: "Limit for log (default: 20)" },
+      dry_run: { type: "boolean", description: "For commit: show what would be committed" }
+    },
+    required: ["command"]
+  },
+  async execute(input, ctx, opts) {
+    if (!input?.command) throw new Error("git: command is required");
+    const gitDir = findGitDir2(ctx.cwd, ctx.projectRoot);
+    if (!gitDir) {
+      return {
+        command: input.command,
+        stdout: "",
+        stderr: "Not in a git repository (within project root)",
+        exitCode: 128,
+        truncated: false
+      };
+    }
+    const args = buildArgs(input);
+    return await runGit2(args, gitDir, opts.signal);
+  }
+};
+function findGitDir2(cwd, projectRoot) {
+  const root = projectRoot;
+  let dir = cwd;
+  for (let i = 0; i < 20; i++) {
+    try {
+      const stat9 = statSync(`${dir}/.git`);
+      if (stat9.isDirectory()) return dir;
+    } catch {
+    }
+    if (dir === root) break;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function buildArgs(input) {
+  const limit = input.limit ?? 20;
+  const files = input.files ? (Array.isArray(input.files) ? input.files : input.files.split(",")).map((s) => s.trim()).filter(Boolean) : [];
+  switch (input.command) {
+    case "status":
+      return ["status", ...files.length ? ["--", ...files] : []];
+    case "log":
+      return [
+        "log",
+        `--max-count=${limit}`,
+        ...input.format === "oneline" ? ["--oneline"] : [],
+        ...input.format === "stat" ? ["--stat"] : [],
+        ...input.format === "graph" ? ["--oneline", "--graph", "--decorate"] : [],
+        ...input.format === "short" || !input.format ? [] : []
+      ];
+    case "diff":
+      return ["diff", "--no-color", ...files.length ? ["--", ...files] : []];
+    case "commit":
+      return [
+        "commit",
+        ...input.dry_run ? ["--dry-run", "--porcelain"] : [],
+        ...input.message ? ["-m", input.message] : [],
+        ...files.length ? ["--", ...files] : []
+      ];
+    case "branch":
+      return input.branch ? ["branch", input.branch] : ["branch"];
+    case "checkout":
+      return [
+        "checkout",
+        ...input.branch ? [input.branch] : [],
+        ...files.length ? ["--", ...files] : []
+      ];
+    case "stash":
+      return input.message ? ["stash", "push", "-m", input.message] : ["stash", "push"];
+    case "push":
+      return ["push"];
+    case "pull":
+      return ["pull"];
+    case "fetch":
+      return ["fetch", ...input.branch ? [input.branch] : ["--all"]];
+    case "reset":
+      return ["reset"];
+    default:
+      return [input.command];
+  }
+}
+function runGit2(args, cwd, signal) {
+  return new Promise((resolve4) => {
+    let stdout = "";
+    let stderr = "";
+    const child = spawn("git", args, {
+      cwd,
+      signal,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    child.stdout?.on("data", (chunk) => {
+      if (stdout.length < MAX_OUTPUT3) {
+        stdout += chunk.toString();
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      if (stderr.length < MAX_OUTPUT3) {
+        stderr += chunk.toString();
+      }
+    });
+    child.on("error", (err) => {
+      resolve4({
+        command: args[0],
+        stdout,
+        stderr: err.message,
+        exitCode: 1,
+        truncated: stdout.length >= MAX_OUTPUT3
+      });
+    });
+    child.on("close", (code) => {
+      resolve4({
+        command: args[0],
+        stdout: stdout.slice(0, MAX_OUTPUT3),
+        stderr: stderr.slice(0, MAX_OUTPUT3),
+        exitCode: code ?? 1,
+        truncated: stdout.length >= MAX_OUTPUT3 || stderr.length >= MAX_OUTPUT3
+      });
+    });
+  });
+}
+var DEFAULT_IGNORE = ["node_modules", ".git", "dist", "build", ".next", "coverage", ".turbo"];
+var globTool = {
+  name: "glob",
+  category: "Filesystem",
+  description: "Find files matching a glob pattern. Returns paths sorted by mtime (newest first).",
+  usageHint: "Examples: `**/*.ts`, `src/**/*.test.ts`, `*.json`. Common dirs (node_modules, .git, dist) are ignored by default. Returns up to 1000 paths.",
+  permission: "auto",
+  mutating: false,
+  maxOutputBytes: 65536,
+  timeoutMs: 5e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      pattern: { type: "string" },
+      path: { type: "string", description: "Base directory (defaults to cwd)" },
+      limit: { type: "integer" }
+    },
+    required: ["pattern"]
+  },
+  async execute(input, ctx) {
+    if (!input?.pattern) throw new Error("glob: pattern is required");
+    const base = input.path ? safeResolve(input.path, ctx) : ctx.cwd;
+    const limit = Math.max(1, Math.min(input.limit ?? 1e3, 5e3));
+    const ignored = await readGitignore(base);
+    const re = compileGlob(input.pattern);
+    const results = [];
+    let truncated = false;
+    const walk = async (dir, relPrefix) => {
+      if (results.length >= limit) {
+        truncated = true;
+        return;
+      }
+      let entries;
+      try {
+        entries = await fs9.readdir(dir, { withFileTypes: true });
+      } catch {
+        return;
+      }
+      for (const e of entries) {
+        const name = e.name;
+        if (DEFAULT_IGNORE.includes(name)) continue;
+        if (ignored.includes(name)) continue;
+        const rel = relPrefix ? `${relPrefix}/${name}` : name;
+        const full = path.join(dir, name);
+        if (e.isDirectory()) {
+          await walk(full, rel);
+          if (truncated) return;
+        } else if (e.isFile()) {
+          if (re.test(rel) || re.test(name)) {
+            try {
+              const st = await fs9.stat(full);
+              results.push({ rel: full, mtime: st.mtimeMs });
+              if (results.length >= limit) {
+                truncated = true;
+                return;
+              }
+            } catch {
+            }
+          }
+        }
+      }
+    };
+    await walk(base, "");
+    results.sort((a, b) => b.mtime - a.mtime);
+    return { files: results.map((r) => r.rel), truncated };
+  }
+};
+async function readGitignore(dir) {
+  try {
+    const raw = await fs9.readFile(path.join(dir, ".gitignore"), "utf8");
+    return raw.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+  } catch {
+    return [];
+  }
+}
+
+// src/_regex.ts
+var MAX_PATTERN_LEN = 512;
+var DANGEROUS_PATTERNS = [
+  /(\([^)]*[+*][^)]*\))[+*]/,
+  // (a+)+, (.*)+, etc — nested quantifier on a group with internal quantifier
+  /(\(\?:[^)]*[+*][^)]*\))[+*]/
+  // same, with non-capturing group
+];
+function compileUserRegex(pattern, flags) {
+  if (typeof pattern !== "string") {
+    return { ok: false, reason: "pattern must be a string" };
+  }
+  if (pattern.length === 0) {
+    return { ok: false, reason: "pattern is empty" };
+  }
+  if (pattern.length > MAX_PATTERN_LEN) {
+    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
+  }
+  for (const rx of DANGEROUS_PATTERNS) {
+    if (rx.test(pattern)) {
+      return {
+        ok: false,
+        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
+      };
+    }
+  }
+  try {
+    return { ok: true, regex: new RegExp(pattern, flags) };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: err instanceof Error ? err.message : "invalid regex"
+    };
+  }
+}
+var MAX_SUBJECT_LEN = 64 * 1024;
+function capSubject(line) {
+  return line.length > MAX_SUBJECT_LEN ? line.slice(0, MAX_SUBJECT_LEN) : line;
+}
+
+// src/grep.ts
+var DEFAULT_IGNORE2 = ["node_modules", ".git", "dist", "build", ".next", "coverage"];
+var grepTool = {
+  name: "grep",
+  category: "Search",
+  description: "Search file contents with a regex. Uses ripgrep when available.",
+  usageHint: 'Pattern is regex. Use `output_mode: "content"` for matched lines, `"files_with_matches"` for paths, `"count"` for tallies. `glob` filters files (e.g. `*.ts`).',
+  permission: "auto",
+  mutating: false,
+  maxOutputBytes: 131072,
+  timeoutMs: 1e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      pattern: { type: "string" },
+      path: { type: "string" },
+      glob: { type: "string" },
+      output_mode: { type: "string", enum: ["content", "files_with_matches", "count"] },
+      context_lines: { type: "integer" },
+      case_insensitive: { type: "boolean" },
+      limit: { type: "integer" }
+    },
+    required: ["pattern"]
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    for await (const ev of grepTool.executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("grep: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    if (!input?.pattern) throw new Error("grep: pattern is required");
+    const base = input.path ? safeResolve(input.path, ctx) : ctx.cwd;
+    const mode = input.output_mode ?? "content";
+    const limit = Math.max(1, Math.min(input.limit ?? 200, 2e3));
+    const validation = compileUserRegex(input.pattern, input.case_insensitive ? "i" : "");
+    if (!validation.ok) {
+      throw new Error(`grep: ${validation.reason}`);
+    }
+    const rgAvailable = await detectRg(opts.signal);
+    if (rgAvailable) {
+      try {
+        yield* runRgStream(input, base, mode, limit, opts.signal);
+        return;
+      } catch {
+      }
+    }
+    yield { type: "log", text: "Falling back to native grep\u2026" };
+    const out = await runNative(input, base, mode, limit, opts.signal);
+    yield { type: "final", output: out };
+  }
+};
+async function detectRg(signal) {
+  return new Promise((resolve4) => {
+    try {
+      const p = spawn("rg", ["--version"], { stdio: "ignore", signal });
+      p.on("error", () => resolve4(false));
+      p.on("close", (code) => resolve4(code === 0));
+    } catch {
+      resolve4(false);
+    }
+  });
+}
+async function* runRgStream(input, base, mode, limit, signal) {
+  const args = ["--no-heading"];
+  if (input.case_insensitive) args.push("-i");
+  if (mode === "files_with_matches") args.push("-l");
+  if (mode === "count") args.push("-c");
+  if (mode === "content") {
+    args.push("-n");
+    if (input.context_lines) args.push("-C", String(input.context_lines));
+  }
+  for (const ignored of DEFAULT_IGNORE2) {
+    args.push("--glob", `!${ignored}/**`, "--glob", `!**/${ignored}/**`);
+  }
+  if (input.glob) args.push("--glob", input.glob);
+  args.push("--", input.pattern, base);
+  const matches = [];
+  let buf = "";
+  let totalLines = 0;
+  let totalCount = 0;
+  let batchSinceFlush = 0;
+  const FLUSH_AT = 16;
+  const MAX_BUF_BYTES = 1e6;
+  let bufOverflow = false;
+  const child = spawn("rg", args, { signal, stdio: ["ignore", "pipe", "pipe"] });
+  const queue = [];
+  let waiter;
+  const wake = () => {
+    if (waiter) {
+      const w = waiter;
+      waiter = void 0;
+      w();
+    }
+  };
+  child.stdout?.on("data", (c) => {
+    queue.push({ kind: "out", data: c.toString() });
+    wake();
+  });
+  child.on("error", (e) => {
+    queue.push({ kind: "error", data: e.message });
+    wake();
+  });
+  child.on("close", () => {
+    queue.push({ kind: "close", data: "" });
+    wake();
+  });
+  let pendingBatch = [];
+  let errored = false;
+  for (; ; ) {
+    while (queue.length === 0) {
+      await new Promise((r) => {
+        waiter = r;
+      });
+    }
+    const c = queue.shift();
+    if (c.kind === "error") {
+      errored = true;
+      continue;
+    }
+    if (c.kind === "close") break;
+    buf += c.data;
+    if (buf.length > MAX_BUF_BYTES && !bufOverflow) {
+      bufOverflow = true;
+      buf = buf.slice(-MAX_BUF_BYTES);
+      try {
+        child.kill("SIGTERM");
+      } catch {
+      }
+    }
+    const idx = buf.lastIndexOf("\n");
+    if (idx === -1) continue;
+    const ready = buf.slice(0, idx);
+    buf = buf.slice(idx + 1);
+    for (const line of ready.split("\n")) {
+      if (!line) continue;
+      totalLines++;
+      if (mode === "count") totalCount += parseRgCountLine(line);
+      if (matches.length < limit) {
+        matches.push(line);
+        pendingBatch.push(line);
+        batchSinceFlush++;
+      }
+    }
+    if (batchSinceFlush >= FLUSH_AT) {
+      yield {
+        type: "partial_output",
+        text: pendingBatch.join("\n"),
+        data: { matches_so_far: matches.length }
+      };
+      pendingBatch = [];
+      batchSinceFlush = 0;
+    }
+  }
+  if (buf.trim()) {
+    for (const line of buf.split("\n")) {
+      if (!line) continue;
+      totalLines++;
+      if (mode === "count") totalCount += parseRgCountLine(line);
+      if (matches.length < limit) {
+        matches.push(line);
+        pendingBatch.push(line);
+      }
+    }
+  }
+  if (pendingBatch.length > 0) {
+    yield {
+      type: "partial_output",
+      text: pendingBatch.join("\n"),
+      data: { matches_so_far: matches.length }
+    };
+  }
+  if (errored) throw new Error("rg: spawn error");
+  yield {
+    type: "final",
+    output: {
+      matches,
+      count: mode === "count" ? totalCount : totalLines,
+      truncated: totalLines > limit || bufOverflow,
+      used: "rg"
+    }
+  };
+}
+function parseRgCountLine(line) {
+  const idx = line.lastIndexOf(":");
+  if (idx === -1) return 0;
+  const n = Number.parseInt(line.slice(idx + 1), 10);
+  return Number.isFinite(n) ? n : 0;
+}
+async function runNative(input, base, mode, limit, signal) {
+  const flags = input.case_insensitive ? "i" : "";
+  const compiled = compileUserRegex(input.pattern, flags);
+  if (!compiled.ok) {
+    throw new Error(`grep: ${compiled.reason}`);
+  }
+  const re = compiled.regex;
+  const globRe = input.glob ? compileGlob(input.glob) : null;
+  const matches = [];
+  const fileMatches = /* @__PURE__ */ new Map();
+  let total = 0;
+  let stopped = false;
+  const walk = async (dir) => {
+    if (stopped || signal.aborted) return;
+    let entries;
+    try {
+      entries = await fs9.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (stopped) return;
+      if (DEFAULT_IGNORE2.includes(e.name)) continue;
+      if (e.isSymbolicLink()) continue;
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) {
+        await walk(full);
+      } else if (e.isFile()) {
+        if (globRe && !globRe.test(e.name) && !globRe.test(full)) continue;
+        if (globRe) globRe.lastIndex = 0;
+        try {
+          const stat9 = await fs9.stat(full);
+          if (stat9.size > 1e6) continue;
+          const head = await fs9.readFile(full);
+          if (isBinaryBuffer(head)) continue;
+          const text = head.toString("utf8");
+          const lines = text.split(/\r?\n/);
+          let fileHits = 0;
+          for (let i = 0; i < lines.length; i++) {
+            const ln = capSubject(lines[i] ?? "");
+            re.lastIndex = 0;
+            if (re.test(ln)) {
+              fileHits++;
+              total++;
+              if (mode === "content" && matches.length < limit) {
+                matches.push(`${full}:${i + 1}:${ln}`);
+              }
+            }
+          }
+          if (fileHits > 0) {
+            fileMatches.set(full, fileHits);
+            if (mode === "files_with_matches" && matches.length < limit) {
+              matches.push(full);
+            }
+            if (mode === "count" && matches.length < limit) {
+              matches.push(`${full}:${fileHits}`);
+            }
+          }
+          if (matches.length >= limit) stopped = true;
+        } catch {
+        }
+      }
+    }
+  };
+  await walk(base);
+  return {
+    matches,
+    count: total,
+    truncated: stopped,
+    used: "native"
+  };
+}
+
+// src/install.ts
+var installTool = {
+  name: "install",
+  category: "Package Management",
+  description: "Install npm packages. Detects pnpm/npm/yarn and uses the right package manager.",
+  usageHint: "Set `packages` to install. `save` as dependency type. `global` for global install. `dry_run` to preview.",
+  permission: "confirm",
+  mutating: true,
+  timeoutMs: 12e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      packages: {
+        type: "string",
+        description: "Package(s) to install: single name, comma-separated list, or empty for all deps"
+      },
+      save: {
+        type: "string",
+        enum: ["dependency", "dev", "optional"],
+        description: "Save as regular, dev, or optional dependency"
+      },
+      cwd: { type: "string", description: "Working directory (default: cwd)" },
+      dry_run: {
+        type: "boolean",
+        description: "Preview install without modifying (default: false)"
+      },
+      global: { type: "boolean", description: "Install globally (default: false)" }
+    }
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    for await (const ev of installTool.executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("install: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const pkgManager = await detectPackageManager(cwd);
+    yield { type: "log", text: `Resolving with ${pkgManager}\u2026`, data: { phase: "resolve" } };
+    const save = input.save === "dev" ? "-D" : input.save === "optional" ? "-O" : "";
+    const globalFlag = input.global ? ["-g"] : [];
+    const args = [];
+    if (input.dry_run) args.push("--dry-run");
+    if (pkgManager === "pnpm") {
+      if (save) args.push(save);
+      args.push("add", ...globalFlag);
+    } else if (pkgManager === "yarn") {
+      args.push("add", ...globalFlag);
+    } else {
+      args.push("install", ...globalFlag);
+    }
+    const pkgList = input.packages ? (Array.isArray(input.packages) ? input.packages : input.packages.split(",")).map(
+      (p) => p.trim()
+    ) : [];
+    if (pkgList.length > 0) args.push(...pkgList);
+    yield {
+      type: "log",
+      text: `Fetching ${pkgList.length || "all"} packages\u2026`,
+      data: { phase: "fetch" }
+    };
+    const result = yield* spawnStream({
+      cmd: pkgManager,
+      args,
+      cwd,
+      signal: opts.signal,
+      maxBytes: 1e5
+    });
+    yield {
+      type: "final",
+      output: {
+        packages: pkgList,
+        exit_code: result.exitCode,
+        output: result.stdout || result.stderr || result.error || "",
+        dry_run: args.includes("--dry-run"),
+        truncated: result.truncated
+      }
+    };
+  }
+};
+async function detectPackageManager(cwd) {
+  const { stat: stat9 } = await import('fs/promises');
+  try {
+    await stat9(`${cwd}/pnpm-lock.yaml`);
+    return "pnpm";
+  } catch {
+    try {
+      await stat9(`${cwd}/yarn.lock`);
+      return "yarn";
+    } catch {
+      return "npm";
+    }
+  }
+}
+var jsonTool = {
+  name: "json",
+  category: "Data",
+  description: "Parse, query, and validate JSON/JSON5/YAML. Use `query` with JMESPath-like paths to extract values.",
+  usageHint: 'Provide `file` path or `data` string. `query` supports dot notation (e.g. "results[0].name"). `format` outputs in specified format.',
+  permission: "auto",
+  mutating: false,
+  timeoutMs: 5e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      file: { type: "string", description: "Path to JSON/JSON5/YAML file" },
+      data: { type: "string", description: "JSON/JSON5/YAML string (alternative to file)" },
+      query: {
+        type: "string",
+        description: 'JMESPath-like query (e.g. "a.b[0].c" or "a[*].name")'
+      },
+      format: {
+        type: "string",
+        enum: ["json", "json5", "yaml"],
+        description: "Output format (default: json)"
+      },
+      validate: {
+        type: "boolean",
+        description: "Validate syntax only, no output (default: false)"
+      }
+    }
+  },
+  async execute(input) {
+    const format = input.format ?? "json";
+    let parsed;
+    let raw;
+    if (input.file) {
+      try {
+        raw = await fs9.readFile(input.file, "utf8");
+      } catch {
+        return { data: null, formatted: "", type: "unknown", error: `Could not read file` };
+      }
+    } else if (input.data) {
+      raw = input.data;
+    } else {
+      return { data: null, formatted: "", type: "unknown", error: "Provide file or data" };
+    }
+    try {
+      parsed = JSON.parse(raw);
+    } catch (e) {
+      return {
+        data: null,
+        formatted: "",
+        type: "unknown",
+        error: `Parse failed: ${e instanceof Error ? e.message : String(e)}`
+      };
+    }
+    if (input.validate) {
+      return {
+        data: parsed,
+        formatted: "valid",
+        type: Array.isArray(parsed) ? "array" : typeof parsed,
+        keys: typeof parsed === "object" && parsed !== null ? Object.keys(parsed) : void 0
+      };
+    }
+    const queryResult = input.query ? query(parsed, input.query) : void 0;
+    const formatted = formatOutput(queryResult ?? parsed, format);
+    return {
+      data: parsed,
+      formatted,
+      type: Array.isArray(parsed) ? "array" : typeof parsed,
+      keys: typeof parsed === "object" && parsed !== null ? Object.keys(parsed) : void 0,
+      query_result: queryResult
+    };
+  }
+};
+function query(data, path12) {
+  const parts = path12.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean);
+  let current = data;
+  for (const part of parts) {
+    if (current === null || current === void 0) return void 0;
+    const idx = Number(part);
+    if (!Number.isNaN(idx) && Array.isArray(current)) {
+      current = current[idx];
+    } else if (typeof current === "object" && current !== null) {
+      current = current[part];
+    } else {
+      return void 0;
+    }
+  }
+  return current;
+}
+function formatOutput(data, format) {
+  if (format === "json5") {
+    return JSON.stringify(data, null, 2).replace(/,\s*}/g, "}").replace(/,\s*\]/g, "]");
+  }
+  if (format === "yaml") {
+    return toYaml(data);
+  }
+  return JSON.stringify(data, null, 2);
+}
+function toYaml(data, indent = 0) {
+  if (data === null) return "null\n";
+  if (data === void 0) return "";
+  if (typeof data === "boolean") return String(data) + "\n";
+  if (typeof data === "number") return String(data) + "\n";
+  if (typeof data === "string") {
+    if (data.includes("\n") || data.includes(":") || data.includes("#")) {
+      return `"${data.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"
+`;
+    }
+    return data + "\n";
+  }
+  if (Array.isArray(data)) {
+    if (data.length === 0) return "[]\n";
+    const prefix = "  ".repeat(indent);
+    return data.map((item) => `${prefix}- ${toYaml(item, indent + 1).trimStart()}`).join("");
+  }
+  if (typeof data === "object") {
+    const prefix = "  ".repeat(indent);
+    const entries = Object.entries(data);
+    return entries.map(([k, v]) => `${prefix}${k}: ${toYaml(v, indent + 1)}`).join("");
+  }
+  return String(data) + "\n";
+}
+
+// src/lint.ts
+var lintTool = {
+  name: "lint",
+  category: "Code Quality",
+  description: "Run a linter on files. Auto-detects biome, eslint, or tslint. Use `fix` to auto-fix issues.",
+  usageHint: "Set `files` (glob or comma-separated). `fix` applies corrections. `linter` forces specific tool.",
+  permission: "confirm",
+  mutating: false,
+  timeoutMs: 6e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      files: {
+        type: "string",
+        description: 'Files/patterns: single path, comma-separated list, or glob (e.g. "src/**/*.ts")'
+      },
+      fix: { type: "boolean", description: "Auto-fix fixable issues (default: false)" },
+      linter: {
+        type: "string",
+        enum: ["biome", "eslint", "tslint", "auto"],
+        description: "Linter to use (default: auto-detect)"
+      },
+      cwd: { type: "string", description: "Working directory (default: cwd)" }
+    }
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    for await (const ev of lintTool.executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("lint: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const linter = input.linter ?? "auto";
+    const detected = linter === "auto" ? await detectLinter(cwd) : linter;
+    if (!detected) {
+      yield {
+        type: "final",
+        output: {
+          linter: "none",
+          files_checked: 0,
+          errors: 0,
+          warnings: 0,
+          output: "No linter found (biome.json, .eslintrc, tslint.json)",
+          fix_applied: false,
+          truncated: false
+        }
+      };
+      return;
+    }
+    yield { type: "log", text: `Running ${detected}\u2026`, data: { linter: detected } };
+    const args = ["lint"];
+    if (input.fix) args.push("--write");
+    if (input.files) {
+      const files = Array.isArray(input.files) ? input.files : input.files.split(",");
+      args.push("--", ...files.map((f) => f.trim()));
+    }
+    const cmd = detected === "biome" ? "biome" : detected;
+    const result = yield* spawnStream({ cmd, args, cwd, signal: opts.signal, maxBytes: 1e5 });
+    const errors = (result.stdout.match(/error/g) || []).length;
+    const warnings = (result.stdout.match(/warning/g) || []).length;
+    yield {
+      type: "final",
+      output: {
+        linter: detected,
+        files_checked: input.files ? Array.isArray(input.files) ? input.files.length : input.files.split(",").length : 0,
+        errors,
+        warnings,
+        output: result.stdout,
+        fix_applied: input.fix ?? false,
+        truncated: result.truncated
+      }
+    };
+  }
+};
+async function detectLinter(cwd) {
+  const { stat: stat9 } = await import('fs/promises');
+  const checks = ["biome.json", ".eslintrc.json", "tslint.json", ".eslintrc.js", "tsconfig.json"];
+  for (const f of checks) {
+    try {
+      await stat9(`${cwd}/${f}`);
+      if (f.includes("biome")) return "biome";
+      if (f.includes("eslint")) return "eslint";
+      if (f.includes("tslint")) return "tslint";
+    } catch {
+    }
+  }
+  return "biome";
+}
+var logsTool = {
+  name: "logs",
+  category: "Logs",
+  description: "Stream or fetch logs from a service or file. Supports Docker, systemd, or plain log files.",
+  usageHint: "Set `service` for Docker/systemd, `path` for file. `lines` limits output. `stream` for tail -f behavior. `filter` regex filters lines.",
+  permission: "confirm",
+  mutating: false,
+  timeoutMs: 3e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      service: {
+        type: "string",
+        description: "Service name for Docker or systemd journal"
+      },
+      path: {
+        type: "string",
+        description: "Path to log file (alternative to service)"
+      },
+      lines: {
+        type: "integer",
+        description: "Number of log lines to fetch (default: 100, 0 for all)",
+        minimum: 0,
+        maximum: 1e4
+      },
+      stream: {
+        type: "boolean",
+        description: "Stream logs continuously (like tail -f) (default: false)"
+      },
+      filter: {
+        type: "string",
+        description: "Regex pattern to filter log lines"
+      },
+      since: {
+        type: "string",
+        enum: ["1h", "6h", "24h", "all"],
+        description: "Only show logs since duration"
+      },
+      cwd: { type: "string", description: "Working directory (default: cwd)" }
+    }
+  },
+  async execute(input, ctx, opts) {
+    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const lines = input.lines ?? 100;
+    let filterRe = null;
+    if (input.filter) {
+      const compiled = compileUserRegex(input.filter, "i");
+      if (!compiled.ok) {
+        throw new Error(`logs: ${compiled.reason}`);
+      }
+      filterRe = compiled.regex;
+    }
+    if (input.service) {
+      return await dockerLogs(input.service, lines, filterRe, cwd, opts.signal);
+    }
+    if (input.path) {
+      return await fileLogs(safeResolve(input.path, ctx), lines, filterRe, input.stream ?? false);
+    }
+    return {
+      source: "none",
+      entries: [],
+      total: 0,
+      truncated: false,
+      stream_mode: false
+    };
+  }
+};
+async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
+  const args = ["logs"];
+  if (lines > 0) args.push("--tail", String(lines));
+  args.push("--timestamps", service);
+  return new Promise((resolve4) => {
+    let stdout = "";
+    let stderr = "";
+    const MAX = 2e5;
+    const child = spawn("docker", args, { cwd, signal, stdio: ["ignore", "pipe", "pipe"] });
+    child.stdout?.on("data", (c) => {
+      if (stdout.length < MAX) stdout += c.toString();
+    });
+    child.stderr?.on("data", (c) => {
+      if (stderr.length < MAX) stderr += c.toString();
+    });
+    child.on("close", (code) => {
+      const output = stdout + stderr;
+      const entries = parseLogLines(output, filterRe);
+      resolve4({
+        source: `docker:${service}`,
+        entries,
+        total: entries.length,
+        truncated: output.length >= MAX,
+        stream_mode: false
+      });
+    });
+    child.on(
+      "error",
+      (e) => resolve4({
+        source: `docker:${service}`,
+        entries: [],
+        total: 0,
+        truncated: false,
+        stream_mode: false
+      })
+    );
+  });
+}
+var MAX_TAIL_LINES = 1e5;
+async function fileLogs(path12, lines, filterRe, stream) {
+  const { createInterface } = await import('readline');
+  const { createReadStream } = await import('fs');
+  const entries = [];
+  const effLines = lines > 0 ? Math.min(lines, MAX_TAIL_LINES) : MAX_TAIL_LINES;
+  const window = new Array(effLines);
+  let writeIdx = 0;
+  let totalLines = 0;
+  const rl = createInterface({
+    input: createReadStream(path12),
+    crlfDelay: Number.POSITIVE_INFINITY
+  });
+  for await (const line of rl) {
+    if (filterRe && !filterRe.test(line)) continue;
+    window[writeIdx] = line;
+    writeIdx = (writeIdx + 1) % effLines;
+    totalLines++;
+  }
+  const ordered = [];
+  const start = totalLines >= effLines ? writeIdx : 0;
+  const count = Math.min(totalLines, effLines);
+  for (let i = 0; i < count; i++) {
+    const v = window[(start + i) % effLines];
+    if (v !== void 0) ordered.push(v);
+  }
+  for (const line of ordered) {
+    const parsed = parseLine(line);
+    if (parsed) entries.push(parsed);
+  }
+  return {
+    source: path12,
+    entries,
+    total: entries.length,
+    truncated: totalLines > effLines,
+    stream_mode: stream
+  };
+}
+function parseLogLines(output, filterRe) {
+  const lines = output.split("\n").filter(Boolean);
+  const entries = [];
+  for (const line of lines) {
+    if (filterRe && !filterRe.test(line)) continue;
+    const parsed = parseLine(line);
+    if (parsed) entries.push(parsed);
+  }
+  return entries;
+}
+function parseLine(line) {
+  const tsRe = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z?)\s+(?:\[?(\w+)\]?)\s*(.*)/;
+  const match = tsRe.exec(line);
+  if (match) {
+    return {
+      timestamp: match[1] ?? "",
+      level: match[2]?.toLowerCase() ?? "info",
+      message: match[3] ?? ""
+    };
+  }
+  const levelRe = /(?:ERROR|WARN|INFO|DEBUG|TRACE)\s+(.*)/i;
+  const levelMatch = levelRe.exec(line);
+  if (levelMatch) {
+    return {
+      timestamp: "",
+      level: levelMatch[1]?.toLowerCase() ?? "info",
+      message: levelMatch[2] ?? line
+    };
+  }
+  return {
+    timestamp: "",
+    level: "info",
+    message: line
+  };
+}
+var outdatedTool = {
+  name: "outdated",
+  category: "Package Management",
+  description: "Check for outdated npm packages. Shows current, wanted, and latest versions.",
+  usageHint: "Set `check` to filter specific packages. `format` as list or table. `include_deprecated` shows deprecated packages.",
+  permission: "auto",
+  mutating: false,
+  timeoutMs: 6e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      cwd: { type: "string", description: "Working directory (default: cwd)" },
+      format: {
+        type: "string",
+        enum: ["list", "table"],
+        description: "Output format (default: list)"
+      },
+      include_deprecated: {
+        type: "boolean",
+        description: "Include deprecated packages (default: false)"
+      },
+      check: {
+        type: "string",
+        description: "Specific package(s) to check (comma-separated)"
+      }
+    }
+  },
+  async execute(input, ctx, opts) {
+    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const manager = await detectManager2(cwd);
+    const args = ["outdated", "--json"];
+    if (input.format === "table") args.push("--table");
+    if (input.include_deprecated) args.push("--include", "deprecated");
+    return runOutdated(manager, args, cwd, opts.signal);
+  }
+};
+async function detectManager2(cwd) {
+  const { stat: stat9 } = __require("fs/promises");
+  try {
+    await stat9(`${cwd}/pnpm-lock.yaml`);
+    return "pnpm";
+  } catch {
+  }
+  try {
+    await stat9(`${cwd}/yarn.lock`);
+    return "yarn";
+  } catch {
+  }
+  return "npm";
+}
+function runOutdated(manager, args, cwd, signal) {
+  return new Promise((resolve4) => {
+    let stdout = "";
+    let stderr = "";
+    const MAX = 1e5;
+    const child = spawn(manager, args, { cwd, signal, stdio: ["ignore", "pipe", "pipe"] });
+    child.stdout?.on("data", (c) => {
+      if (stdout.length < MAX) stdout += c.toString();
+    });
+    child.stderr?.on("data", (c) => {
+      if (stderr.length < MAX) stderr += c.toString();
+    });
+    child.on("close", (code) => {
+      const result = parseOutdatedOutput(stdout, code ?? 0);
+      resolve4(result);
+    });
+    child.on(
+      "error",
+      (e) => resolve4({
+        exit_code: 1,
+        packages: [],
+        total: 0,
+        output: e.message,
+        truncated: false
+      })
+    );
+  });
+}
+function parseOutdatedOutput(json, exitCode) {
+  const packages = [];
+  if (!json) {
+    return {
+      exit_code: exitCode,
+      packages: [],
+      total: 0,
+      output: exitCode === 0 ? "All packages up to date" : "Could not check outdated packages",
+      truncated: false
+    };
+  }
+  try {
+    const data = JSON.parse(json);
+    for (const name of Object.keys(data)) {
+      const info = data[name];
+      packages.push({
+        name,
+        current: info.current ?? "unknown",
+        latest: info.latest ?? "unknown",
+        wanted: info.wanted ?? "unknown",
+        type: info.type ?? "unknown",
+        location: info.location ?? name
+      });
+    }
+  } catch {
+  }
+  return {
+    exit_code: exitCode,
+    packages,
+    total: packages.length,
+    output: json,
+    truncated: json.length >= 1e5
+  };
+}
+var patchTool = {
+  name: "patch",
+  category: "Filesystem",
+  description: "Apply a unified diff patch to files. Writes .orig and .rej files on failure.",
+  usageHint: "Set `patch` (the diff text). `directory` defaults to cwd. `strip` removes leading path components. `dry_run` previews.",
+  permission: "confirm",
+  mutating: true,
+  timeoutMs: 3e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      patch: { type: "string", description: "Unified diff patch content" },
+      directory: { type: "string", description: "Root directory for patch (default: cwd)" },
+      strip: { type: "integer", description: "Strip leading path components (default: 1)" },
+      dry_run: { type: "boolean", description: "Preview without applying" }
+    },
+    required: ["patch"]
+  },
+  async execute(input, ctx, opts) {
+    if (!input?.patch) throw new Error("patch: patch content is required");
+    const dir = input.directory ? safeResolve(input.directory, ctx) : ctx.cwd;
+    const strip = Math.max(1, input.strip ?? 1);
+    const dryRun = input.dry_run ?? false;
+    const targets = extractDiffTargets(input.patch);
+    for (const t of targets) {
+      const stripped = stripPathComponents(t, strip);
+      if (!stripped) continue;
+      const candidate = path.resolve(dir, stripped);
+      const rel = path.relative(ctx.projectRoot, candidate);
+      if (rel.startsWith("..") || path.isAbsolute(rel)) {
+        return {
+          applied: 0,
+          rejected: 1,
+          files: [],
+          dry_run: dryRun,
+          message: `patch refused: target "${t}" resolves outside project root`
+        };
+      }
+    }
+    const tmpDir = await fs9.mkdtemp(path.join(dir, ".wstack_patch_"));
+    try {
+      await fs9.chmod(tmpDir, 448).catch(() => {
+      });
+      const patchFile = path.join(tmpDir, "in.diff");
+      await fs9.writeFile(patchFile, input.patch, { mode: 384 });
+      const args = [`-p${strip}`, "--merge", ...dryRun ? ["--dry-run"] : [], "-i", patchFile];
+      const result = await runPatch(args, dir, opts.signal);
+      if (result.exitCode !== 0 && !dryRun) {
+        return {
+          applied: 0,
+          rejected: 1,
+          files: [],
+          dry_run: dryRun,
+          message: `patch failed: ${result.stderr || result.stdout}`
+        };
+      }
+      const patched = extractPatchedFiles(result.stdout);
+      return {
+        applied: patched.length,
+        rejected: 0,
+        files: patched,
+        dry_run: dryRun,
+        message: result.stdout || "patch applied"
+      };
+    } finally {
+      await fs9.rm(tmpDir, { recursive: true, force: true }).catch(() => {
+      });
+    }
+  }
+};
+function extractDiffTargets(patch) {
+  const out = [];
+  const re = /^\+\+\+\s+([^\t\r\n]+)/gm;
+  for (const m of patch.matchAll(re)) {
+    const target = m[1]?.trim();
+    if (!target || target === "/dev/null") continue;
+    out.push(target);
+  }
+  return out;
+}
+function stripPathComponents(p, strip) {
+  const parts = p.replace(/\\/g, "/").split("/");
+  if (parts.length <= strip) return void 0;
+  return parts.slice(strip).join("/");
+}
+function runPatch(args, cwd, signal) {
+  return new Promise((resolve4) => {
+    let stdout = "";
+    let stderr = "";
+    const env = { ...buildChildEnv(), LANG: "C", LC_ALL: "C" };
+    const child = spawn("patch", args, { cwd, signal, env, stdio: ["pipe", "pipe", "pipe"] });
+    child.stdout?.on("data", (c) => {
+      stdout += c.toString();
+    });
+    child.stderr?.on("data", (c) => {
+      stderr += c.toString();
+    });
+    child.on("close", (code) => resolve4({ exitCode: code ?? 1, stdout, stderr }));
+    child.on("error", (e) => resolve4({ exitCode: 1, stdout: "", stderr: e.message }));
+  });
+}
+function extractPatchedFiles(output) {
+  const files = [];
+  const re = /patching file (.+)/gi;
+  for (const m of output.matchAll(re)) {
+    if (m[1]) files.push(m[1]);
+  }
+  return files;
+}
+var planTool = {
+  name: "plan",
+  category: "Session",
+  description: "Inspect or edit the strategic plan board for this session. Plans persist across resume (unlike todos). Use this to lay out the multi-step approach before diving in, then mark steps in_progress/done as the work proceeds.",
+  usageHint: "Set action to one of: show | add | start | done | remove | clear. Pass `title` for add. Pass `target` (item id, 1-based index, or title substring) for start/done/remove. Always returns the formatted plan plus open/total counts.",
+  permission: "auto",
+  mutating: false,
+  timeoutMs: 2e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      action: {
+        type: "string",
+        enum: ["show", "add", "start", "done", "remove", "clear"]
+      },
+      title: { type: "string", description: "Required when action = add." },
+      details: { type: "string", description: "Optional extra context for add." },
+      target: {
+        type: "string",
+        description: "Plan item id, 1-based index, or title substring. Required for start/done/remove."
+      }
+    },
+    required: ["action"]
+  },
+  async execute(input, ctx) {
+    const planPath = ctx.meta["plan.path"];
+    if (typeof planPath !== "string" || !planPath) {
+      return {
+        ok: false,
+        message: "Plan storage path is not configured for this session.",
+        plan: "",
+        count: 0,
+        open: 0
+      };
+    }
+    const sessionId = ctx.session?.id ?? "unknown";
+    let plan = await loadPlan(planPath) ?? emptyPlan(sessionId);
+    switch (input.action) {
+      case "show":
+        break;
+      case "add": {
+        const title = input.title?.trim();
+        if (!title) {
+          return mkResult(plan, false, "add requires `title`.");
+        }
+        ({ plan } = addPlanItem(plan, title, input.details?.trim() || void 0));
+        await savePlan(planPath, plan);
+        break;
+      }
+      case "start":
+      case "done": {
+        if (!input.target) {
+          return mkResult(plan, false, `${input.action} requires \`target\` (id|index|substring).`);
+        }
+        const next = setPlanItemStatus(
+          plan,
+          input.target,
+          input.action === "start" ? "in_progress" : "done"
+        );
+        if (next === plan) {
+          return mkResult(plan, false, `No plan item matched "${input.target}".`);
+        }
+        plan = next;
+        await savePlan(planPath, plan);
+        break;
+      }
+      case "remove": {
+        if (!input.target) {
+          return mkResult(plan, false, "remove requires `target` (id|index|substring).");
+        }
+        const next = removePlanItem(plan, input.target);
+        if (next === plan) {
+          return mkResult(plan, false, `No plan item matched "${input.target}".`);
+        }
+        plan = next;
+        await savePlan(planPath, plan);
+        break;
+      }
+      case "clear":
+        plan = clearPlan(plan);
+        await savePlan(planPath, plan);
+        break;
+      default:
+        return mkResult(plan, false, `Unknown action "${input.action}".`);
+    }
+    return mkResult(plan, true, `Plan ${input.action} ok.`);
+  }
+};
+function mkResult(plan, ok, message) {
+  const open = plan.items.filter((i) => i.status !== "done").length;
+  return {
+    ok,
+    message,
+    plan: formatPlan(plan),
+    count: plan.items.length,
+    open
+  };
+}
+var MAX_BYTES2 = 5 * 1024 * 1024;
+var readTool = {
+  name: "read",
+  category: "Filesystem",
+  description: "Read the contents of a file. Lines are 1-indexed and prefixed with line numbers.",
+  usageHint: "Read a file before editing it. Returns lines numbered like `   1\u2192content`. Use `offset` and `limit` for large files (default reads up to 2000 lines).",
+  permission: "auto",
+  mutating: false,
+  maxOutputBytes: 262144,
+  timeoutMs: 5e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      path: { type: "string", description: "File path (absolute or relative to cwd)" },
+      offset: { type: "integer", description: "1-based line number to start from" },
+      limit: { type: "integer", description: "Max lines to read (default 2000)" }
+    },
+    required: ["path"]
+  },
+  async execute(input, ctx) {
+    if (!input?.path) throw new Error("read: path is required");
+    const absPath = safeResolve(input.path, ctx);
+    const stat9 = await fs9.stat(absPath);
+    if (!stat9.isFile()) throw new Error(`read: "${input.path}" is not a regular file`);
+    if (stat9.size > MAX_BYTES2) {
+      throw new Error(`read: file too large (${stat9.size} bytes, limit ${MAX_BYTES2})`);
+    }
+    const buf = await fs9.readFile(absPath);
+    if (isBinaryBuffer(buf)) {
+      throw new Error(`read: "${input.path}" appears to be binary`);
+    }
+    const text = buf.toString("utf8");
+    const allLines = text.split(/\r\n|\r|\n/);
+    const total = allLines.length;
+    const offset = Math.max(1, input.offset ?? 1);
+    const limit = Math.max(0, Math.min(input.limit ?? 2e3, 5e3));
+    if (limit === 0) {
+      ctx.recordRead(absPath, stat9.mtimeMs);
+      return { text: "", total_lines: total, encoding: "utf8", truncated: total > 0 };
+    }
+    const slice = allLines.slice(offset - 1, offset - 1 + limit);
+    const truncated = offset - 1 + slice.length < total;
+    const width = String(offset + slice.length - 1).length;
+    const numbered = slice.map((line, i) => `${String(offset + i).padStart(width, " ")}\u2192${line}`).join("\n");
+    ctx.recordRead(absPath, stat9.mtimeMs);
+    return {
+      text: numbered,
+      total_lines: total,
+      encoding: "utf8",
+      truncated
+    };
+  }
+};
+var DEFAULT_IGNORE3 = ["node_modules", ".git", "dist", "build", ".next", "coverage"];
+var replaceTool = {
+  name: "replace",
+  category: "Transform",
+  description: "Batch replace a pattern across multiple files matched by glob. Returns diff for each modified file.",
+  usageHint: 'Use `glob` for broad patterns (e.g. "**/*.ts"). Set `dry_run: true` to preview without modifying. `files` can be a single path, comma-separated list, or glob pattern.',
+  permission: "confirm",
+  mutating: true,
+  timeoutMs: 3e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      pattern: { type: "string", description: "Regex pattern to match" },
+      replacement: { type: "string", description: "Replacement string" },
+      files: {
+        type: "string",
+        description: "File(s) to target: single path, comma-separated list, or glob pattern"
+      },
+      glob: { type: "string", description: 'Additional glob filter (e.g. "*.ts")' },
+      replace_all: {
+        type: "boolean",
+        description: "Replace all occurrences in each file (default: true)"
+      },
+      dry_run: { type: "boolean", description: "Preview changes without writing" }
+    },
+    required: ["pattern", "replacement", "files"]
+  },
+  async execute(input, ctx) {
+    if (!input?.pattern) throw new Error("replace: pattern is required");
+    if (input.replacement === void 0) throw new Error("replace: replacement is required");
+    if (!input?.files) throw new Error("replace: files is required");
+    const replaceAll = input.replace_all ?? true;
+    const compiled = compileUserRegex(input.pattern, "g");
+    if (!compiled.ok) {
+      throw new Error(`replace: ${compiled.reason}`);
+    }
+    const re = compiled.regex;
+    const globRe = input.glob ? compileGlob(input.glob) : null;
+    const dryRun = input.dry_run ?? false;
+    const filesInput = Array.isArray(input.files) ? input.files.join(",") : input.files;
+    const fileList = await resolveFiles2(filesInput, ctx, globRe);
+    const results = [];
+    let totalReplacements = 0;
+    for (const absPath of fileList) {
+      const lstat2 = await fs9.lstat(absPath).catch((err) => {
+        if (err.code === "ENOENT") return null;
+        throw err;
+      });
+      if (!lstat2 || !lstat2.isFile()) continue;
+      if (lstat2.isSymbolicLink()) continue;
+      let realPath;
+      try {
+        realPath = await fs9.realpath(absPath);
+      } catch {
+        continue;
+      }
+      const rel = path.relative(ctx.projectRoot, realPath);
+      if (rel.startsWith("..") || path.isAbsolute(rel)) continue;
+      const stat9 = await fs9.stat(realPath).catch(() => null);
+      if (!stat9 || !stat9.isFile()) continue;
+      let content;
+      try {
+        const buf = await fs9.readFile(realPath);
+        if (isBinaryBuffer(buf)) continue;
+        content = buf.toString("utf8");
+      } catch {
+        continue;
+      }
+      const style = detectNewlineStyle(content);
+      const contentLf = normalizeToLf(content);
+      re.lastIndex = 0;
+      const allMatches = [...contentLf.matchAll(re)];
+      if (allMatches.length === 0) continue;
+      const matches = replaceAll ? allMatches : allMatches.slice(0, 1);
+      const count = matches.length;
+      let newContentLf = contentLf;
+      for (let i = matches.length - 1; i >= 0; i--) {
+        const m = matches[i];
+        newContentLf = newContentLf.slice(0, m.index) + input.replacement + newContentLf.slice(m.index + m[0].length);
+      }
+      re.lastIndex = 0;
+      totalReplacements += count;
+      if (!dryRun) {
+        const newContent = toStyle(newContentLf, style);
+        await atomicWrite(realPath, newContent, { mode: stat9.mode & 511 });
+      }
+      const diff = dryRun || matches.length > 0 ? unifiedDiff(content, toStyle(newContentLf, style), {
+        fromFile: absPath,
+        toFile: absPath
+      }) : void 0;
+      results.push({
+        path: absPath,
+        replacements: matches.length,
+        diff
+      });
+    }
+    return {
+      files_modified: results.length,
+      total_replacements: totalReplacements,
+      results,
+      dry_run: dryRun
+    };
+  }
+};
+async function resolveFiles2(filesInput, ctx, extraGlob) {
+  const base = ctx.cwd;
+  const normalized = filesInput.trim();
+  if (normalized.startsWith("**/") || normalized.startsWith("*") || normalized.includes("**")) {
+    return await globFiles(normalized, base, extraGlob);
+  }
+  const parts = normalized.split(",").map((s) => s.trim()).filter(Boolean);
+  const resolved = [];
+  for (const p of parts) {
+    const absPath = safeResolve(p, ctx);
+    const stat9 = await fs9.stat(absPath).catch(() => null);
+    if (stat9?.isFile()) {
+      resolved.push(absPath);
+    }
+  }
+  return resolved;
+}
+async function globFiles(pattern, base, extraGlob) {
+  const { spawn: spawn11 } = await import('child_process');
+  const rgAvailable = await checkRg();
+  if (rgAvailable) {
+    try {
+      const { promise } = spawnRgFind(pattern, base);
+      return await promise;
+    } catch {
+    }
+  }
+  return await globNative(pattern, base, extraGlob);
+}
+function checkRg() {
+  return new Promise((resolve4) => {
+    try {
+      const p = spawn("rg", ["--version"], { stdio: "ignore" });
+      p.on("error", () => resolve4(false));
+      p.on("close", (code) => resolve4(code === 0));
+    } catch {
+      resolve4(false);
+    }
+  });
+}
+function spawnRgFind(pattern, base) {
+  const args = ["--files", "--glob", pattern, base];
+  const child = spawn("rg", args, { stdio: ["ignore", "pipe", "pipe"] });
+  let buf = "";
+  child.stdout?.on("data", (chunk) => {
+    buf += chunk.toString();
+  });
+  return {
+    promise: new Promise((resolve4, reject) => {
+      child.on("error", reject);
+      child.on("close", () => {
+        resolve4(buf.split("\n").filter(Boolean));
+      });
+    })
+  };
+}
+async function globNative(pattern, base, extraGlob) {
+  const results = [];
+  const globRe = compileGlob(pattern);
+  const walk = async (dir) => {
+    let entries;
+    try {
+      entries = await fs9.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (DEFAULT_IGNORE3.includes(e.name)) continue;
+      const full = path.join(dir, e.name);
+      if (e.isSymbolicLink()) continue;
+      if (e.isDirectory()) {
+        await walk(full);
+      } else if (e.isFile()) {
+        const name = e.name;
+        if (globRe.test(name) || globRe.test(full)) {
+          if (extraGlob && !extraGlob.test(name) && !extraGlob.test(full)) continue;
+          results.push(full);
+        }
+        globRe.lastIndex = 0;
+        if (extraGlob) extraGlob.lastIndex = 0;
+      }
+    }
+  };
+  await walk(base);
+  return results;
+}
+var BUILT_IN_TEMPLATES = {
+  "npm-package": {
+    description: "Basic npm package with ESM",
+    files: {
+      "package.json": JSON.stringify(
+        {
+          name: "{{name}}",
+          version: "0.1.1",
+          type: "module",
+          main: "./dist/index.js",
+          scripts: { build: "tsc", test: "vitest run" },
+          devDependencies: { typescript: "^5.0.0" }
+        },
+        null,
+        2
+      ),
+      "tsconfig.json": JSON.stringify(
+        {
+          compilerOptions: { target: "ES2022", module: "ESNext", strict: true },
+          include: ["src"]
+        },
+        null,
+        2
+      ),
+      "src/index.ts": `export function hello() {
+  return 'Hello from {{name}}';
+}
+`,
+      "src/index.test.ts": `import { hello } from './index';
+import { describe, it, expect } from 'vitest';
+
+describe('hello', () => {
+  it('returns greeting', () => {
+    expect(hello()).toBe('Hello from {{name}}');
+  });
+});
+`
+    }
+  },
+  "cli-tool": {
+    description: "CLI tool with argparse",
+    files: {
+      "package.json": JSON.stringify(
+        {
+          name: "{{name}}",
+          version: "0.1.1",
+          type: "module",
+          bin: { "{{name}}": "./src/index.js" },
+          scripts: { build: "tsc", start: "node dist/index.js" }
+        },
+        null,
+        2
+      ),
+      "src/index.ts": `#!/usr/bin/env node
+
+async function main() {
+  console.log('Hello from {{name}}');
+}
+
+main();
+`
+    }
+  },
+  "react-component": {
+    description: "React component with TypeScript",
+    files: {
+      "{{name}}.tsx": `interface {{Name}}Props {
+  className?: string;
+}
+
+export function {{Name}}({ className }: {{Name}}Props) {
+  return (
+    <div className={className}>
+      {{Name}} Component
+    </div>
+  );
+}
+`,
+      "{{name}}.test.tsx": `import { render, screen } from '@testing-library/react';
+import { {{Name}} } from './{{Name}}';
+
+describe('{{Name}}', () => {
+  it('renders', () => {
+    render(<{{Name}} />);
+    expect(screen.getByText('{{Name}} Component')).toBeInTheDocument();
+  });
+});
+`
+    }
+  }
+};
+var scaffoldTool = {
+  name: "scaffold",
+  category: "Project",
+  description: "Generate boilerplate code from built-in templates or paths. Creates package.json, source files, tests.",
+  usageHint: "Set `template` (npm-package, cli-tool, react-component) and `name`. `vars` for template variables. `dry_run` preview.",
+  permission: "confirm",
+  mutating: true,
+  timeoutMs: 3e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      template: {
+        type: "string",
+        description: "Template name (npm-package, cli-tool, react-component) or path to template directory"
+      },
+      name: {
+        type: "string",
+        description: "Project/component name (used in generated files)"
+      },
+      cwd: { type: "string", description: "Working directory (default: cwd)" },
+      vars: {
+        type: "object",
+        additionalProperties: { type: "string" },
+        description: "Template variables for custom templates"
+      },
+      dry_run: {
+        type: "boolean",
+        description: "Preview generated files without creating (default: false)"
+      }
+    },
+    required: ["template", "name"]
+  },
+  async execute(input, ctx) {
+    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const name = input.name;
+    const vars = { name, ...input.vars };
+    const builtIn = BUILT_IN_TEMPLATES[input.template];
+    if (builtIn) {
+      return await handleBuiltIn(name, builtIn.files, cwd, input.dry_run ?? false, vars);
+    }
+    return {
+      template: input.template,
+      name,
+      files_created: 0,
+      files: [],
+      dry_run: input.dry_run ?? false,
+      output: `Template "${input.template}" not found. Available: ${Object.keys(BUILT_IN_TEMPLATES).join(", ")}`
+    };
+  }
+};
+async function handleBuiltIn(name, templateFiles, cwd, dryRun, vars) {
+  const files = [];
+  let filesCreated = 0;
+  for (const [filePath, content] of Object.entries(templateFiles)) {
+    const resolvedPath = substituteVars(filePath, name, vars);
+    const fullPath = path.join(cwd, resolvedPath);
+    if (!dryRun) {
+      await fs9.mkdir(path.dirname(fullPath), { recursive: true });
+      await fs9.writeFile(fullPath, substituteVars(content, name, vars), "utf8");
+    }
+    files.push(resolvedPath);
+    filesCreated++;
+  }
+  return {
+    template: "built-in",
+    name,
+    files_created: filesCreated,
+    files,
+    dry_run: dryRun,
+    output: dryRun ? `Would create ${filesCreated} files: ${files.join(", ")}` : `Created ${filesCreated} files: ${files.join(", ")}`
+  };
+}
+function substituteVars(content, name, vars) {
+  let result = content;
+  result = result.replace(/\{\{name\}\}/g, name.toLowerCase().replace(/\s+/g, "-"));
+  result = result.replace(
+    /\{\{Name\}\}/g,
+    name.replace(/(?:^|[-_\s]+)([a-z])/g, (_, c) => c.toUpperCase())
+  );
+  for (const [k, v] of Object.entries(vars)) {
+    result = result.replace(new RegExp(`\\{\\{${k}\\}\\}`, "g"), v);
+  }
+  return result;
+}
+
+// src/search.ts
+var DEFAULT_NUM = 10;
+var MAX_RESULTS = 50;
+var TIMEOUT_MS4 = 15e3;
+var searchTool = {
+  name: "search",
+  category: "Search",
+  description: "Search the web for information. Returns title, URL, and snippet for each result.",
+  usageHint: "Set `num_results` (1-50, default 10). Use `source` to pick engine: duckduckgo (default), google, bing.",
+  permission: "confirm",
+  mutating: false,
+  timeoutMs: TIMEOUT_MS4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      query: { type: "string", description: "Search query" },
+      num_results: {
+        type: "integer",
+        description: "Number of results (1-50, default 10)",
+        minimum: 1,
+        maximum: MAX_RESULTS
+      },
+      source: {
+        type: "string",
+        enum: ["duckduckgo", "google", "bing"],
+        description: "Search engine to use (default: duckduckgo)"
+      }
+    },
+    required: ["query"]
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    for await (const ev of searchTool.executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("search: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, _ctx, opts) {
+    if (!input?.query) throw new Error("search: query is required");
+    const num = Math.max(1, Math.min(input.num_results ?? DEFAULT_NUM, MAX_RESULTS));
+    const source = input.source ?? "duckduckgo";
+    yield {
+      type: "log",
+      text: `Querying ${source} for "${input.query}"\u2026`,
+      data: { source, query: input.query }
+    };
+    let output;
+    switch (source) {
+      case "duckduckgo":
+        output = await duckduckgoSearch(input.query, num, opts.signal);
+        break;
+      case "google":
+        output = await googleSearch(input.query, num, opts.signal);
+        break;
+      case "bing":
+        output = await bingSearch(input.query, num, opts.signal);
+        break;
+      default:
+        throw new Error(`search: unknown source "${source}"`);
+    }
+    yield {
+      type: "partial_output",
+      text: `${output.results.length} results from ${output.source}`,
+      data: { count: output.results.length }
+    };
+    yield { type: "final", output };
+  }
+};
+async function duckduckgoSearch(query2, num, signal) {
+  const encoded = encodeURIComponent(query2);
+  const url = `https://lite.duckduckgo.com/lite/?q=${encoded}&kd=-1&kl=wt-wt`;
+  const results = await fetchWithTimeout(url, signal, TIMEOUT_MS4).then((r) => r.text()).then((html) => parseDuckDuckGo(html, num)).catch(() => [{ title: "Search unavailable", url: "", snippet: "Could not reach DuckDuckGo" }]);
+  return {
+    query: query2,
+    results,
+    source: "duckduckgo",
+    truncated: results.length >= num
+  };
+}
+function takeFrom(iter, max) {
+  const out = [];
+  for (const item of iter) {
+    if (out.length >= max) break;
+    out.push(item);
+  }
+  return out;
+}
+function parseDuckDuckGo(html, num) {
+  const results = [];
+  const snippetRegex = /<a class="result-link"[^>]+href="([^"]+)"[^>]*>([^<]+)<\/a>/gi;
+  const snippet2Regex = /<a class="result-snippet"[^>]*>([^<]+)<\/a>/gi;
+  const linkMatches = takeFrom(
+    [...html.matchAll(snippetRegex)].filter((m) => m[1] && m[2]).map((m) => ({ url: m[1], title: stripTags2(m[2]) })),
+    num
+  );
+  const snippetMatches = takeFrom(
+    [...html.matchAll(snippet2Regex)].filter((m) => m[1]).map((m) => stripTags2(m[1])),
+    num
+  );
+  for (let i = 0; i < linkMatches.length && i < num; i++) {
+    const entry = linkMatches[i];
+    results.push({
+      title: entry?.title ?? "",
+      url: entry?.url ?? "",
+      snippet: snippetMatches[i] ?? ""
+    });
+  }
+  return results;
+}
+async function googleSearch(query2, num, signal) {
+  const encoded = encodeURIComponent(query2);
+  const url = `https://www.google.com/search?q=${encoded}&hl=en`;
+  const html = await fetchWithTimeout(url, signal, TIMEOUT_MS4).then((r) => r.text()).catch(() => "");
+  const results = parseGoogleResults(html, num);
+  return {
+    query: query2,
+    results,
+    source: "google",
+    truncated: results.length >= num
+  };
+}
+function parseGoogleResults(html, num) {
+  const results = [];
+  const titleRegex = /<h3[^>]*class="[^"]*DKV84"[^>]*>([^<]+)<\/h3>/gi;
+  const urlRegex = /<cite[^>]*>([^<]+)<\/cite>/gi;
+  const snippetRegex = /<span[^>]*class="[^"]*aXCZ0b[^>]*>([^<]+)<\/span>/gi;
+  const titles = takeFrom(
+    [...html.matchAll(titleRegex)].filter((m) => m[1]).map((m) => stripTags2(m[1])),
+    num
+  );
+  const urls = takeFrom(
+    [...html.matchAll(urlRegex)].filter((m) => m[1]).map((m) => stripTags2(m[1]).replace(/^\*(https?:\/\/[^\s]+).*$/, "$1")).filter((u) => u.startsWith("http")),
+    num
+  );
+  const snippets = takeFrom(
+    [...html.matchAll(snippetRegex)].filter((m) => m[1]).map((m) => stripTags2(m[1])),
+    num
+  );
+  for (let i = 0; i < Math.min(titles.length, num); i++) {
+    results.push({
+      title: titles[i] ?? "",
+      url: urls[i] ?? "",
+      snippet: snippets[i] ?? ""
+    });
+  }
+  return results;
+}
+async function bingSearch(query2, num, signal) {
+  const encoded = encodeURIComponent(query2);
+  const url = `https://www.bing.com/search?q=${encoded}`;
+  const html = await fetchWithTimeout(url, signal, TIMEOUT_MS4).then((r) => r.text()).catch(() => "");
+  const results = parseBingResults(html, num);
+  return {
+    query: query2,
+    results,
+    source: "bing",
+    truncated: results.length >= num
+  };
+}
+function parseBingResults(html, num) {
+  const results = [];
+  const titleRegex = /<h2[^>]*>\s*<a[^>]+href="([^"]+)"[^>]*>([^<]+)<\/a>\s*<\/h2>/gi;
+  const snippetRegex = /<p[^>]*class="[^"]*b_paractl[^"]*"[^>]*>([^<]+)<\/p>/gi;
+  const entries = takeFrom(
+    [...html.matchAll(titleRegex)].filter((m) => m[1] && m[2]).map((m) => ({ url: m[1], title: stripTags2(m[2]) })),
+    num
+  );
+  const snippets = takeFrom(
+    [...html.matchAll(snippetRegex)].filter((m) => m[1]).map((m) => stripTags2(m[1])),
+    num
+  );
+  for (let i = 0; i < entries.length; i++) {
+    results.push({
+      title: entries[i]?.title ?? "",
+      url: entries[i]?.url ?? "",
+      snippet: snippets[i] ?? ""
+    });
+  }
+  return results;
+}
+async function fetchWithTimeout(url, signal, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const fetchSignal = anySignal(signal, controller.signal);
+  try {
+    const res = await fetch(url, {
+      headers: {
+        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
+      },
+      signal: fetchSignal
+    });
+    clearTimeout(timer);
+    return res;
+  } catch (e) {
+    clearTimeout(timer);
+    throw e;
+  }
+}
+function anySignal(...signals) {
+  const controller = new AbortController();
+  for (const s of signals) {
+    if (s.aborted) {
+      controller.abort();
+      break;
+    }
+    s.addEventListener("abort", () => controller.abort());
+  }
+  return controller.signal;
+}
+function stripTags2(html) {
+  return html.replace(/<[^>]+>/g, "").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").trim();
+}
+var testTool = {
+  name: "test",
+  category: "Code Quality",
+  description: "Run tests with vitest, jest, or mocha. Returns pass/fail counts and output.",
+  usageHint: "Set `files` for specific tests. `watch` enables watch mode. `coverage` generates coverage report. `grep` filters by name.",
+  permission: "confirm",
+  mutating: false,
+  timeoutMs: 12e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      files: {
+        type: "string",
+        description: 'Test files: single path, comma-separated list, or glob (e.g. "**/*.test.ts")'
+      },
+      runner: {
+        type: "string",
+        enum: ["vitest", "jest", "mocha", "auto"],
+        description: "Test runner (default: auto-detect)"
+      },
+      watch: { type: "boolean", description: "Run in watch mode (default: false)" },
+      coverage: { type: "boolean", description: "Generate coverage report (default: false)" },
+      cwd: { type: "string", description: "Working directory (default: cwd)" },
+      grep: { type: "string", description: "Filter tests by name pattern (default: none)" },
+      timeout: { type: "integer", description: "Test timeout in ms (default: 30000)" }
+    }
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    for await (const ev of testTool.executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("test: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const runner = input.runner ?? "auto";
+    const detected = runner === "auto" ? await detectRunner(cwd) : runner;
+    if (!detected) {
+      yield {
+        type: "final",
+        output: {
+          runner: "none",
+          exit_code: 1,
+          tests_run: 0,
+          passed: 0,
+          failed: 0,
+          duration_ms: 0,
+          output: "No test runner found (vitest.config.ts, jest.config.js, .mocharc.json)",
+          truncated: false
+        }
+      };
+      return;
+    }
+    yield { type: "log", text: `Running ${detected}\u2026`, data: { runner: detected } };
+    const start = Date.now();
+    const args = buildArgs2(detected, input);
+    const result = yield* spawnStream({
+      cmd: detected,
+      args,
+      cwd,
+      signal: opts.signal,
+      maxBytes: 2e5
+    });
+    const duration = Date.now() - start;
+    yield { type: "final", output: parseResult(detected, result, duration) };
+  }
+};
+async function detectRunner(cwd) {
+  const { stat: stat9 } = await import('fs/promises');
+  const candidates = ["vitest.config.ts", "jest.config.js", ".mocharc.json"];
+  for (const f of candidates) {
+    try {
+      await stat9(path.join(cwd, f));
+      if (f.includes("vitest")) return "vitest";
+      if (f.includes("jest")) return "jest";
+      if (f.includes("mocha")) return "mocha";
+    } catch {
+    }
+  }
+  return "vitest";
+}
+function buildArgs2(runner, input) {
+  const args = [];
+  const timeout = input.timeout ?? 3e4;
+  switch (runner) {
+    case "vitest":
+      args.push("run", "--reporter=verbose");
+      if (input.watch) {
+        args[1] = "";
+        args.push("watch");
+      }
+      if (input.coverage) args.push("--coverage");
+      if (input.grep) args.push("--testNamePattern", input.grep);
+      args.push("--testTimeout", String(timeout));
+      break;
+    case "jest":
+      args.push("--verbose");
+      if (input.watch) args.push("--watch");
+      if (input.coverage) args.push("--coverage");
+      if (input.grep) args.push("--testPathPattern", input.grep);
+      args.push("--testTimeout", String(timeout));
+      break;
+    case "mocha":
+      args.push("--reporter", "spec");
+      if (input.grep) args.push("--grep", input.grep);
+      args.push("--timeout", String(timeout));
+      break;
+  }
+  if (input.files) {
+    const files = Array.isArray(input.files) ? input.files : input.files.split(",");
+    args.push("--", ...files.map((f) => f.trim()));
+  }
+  return args;
+}
+function parseResult(runner, result, duration) {
+  const out = result.stdout + result.stderr;
+  let tests_run = 0;
+  let passed = 0;
+  let failed = 0;
+  if (runner === "vitest") {
+    const passedMatch = out.match(/(\d+) passed/);
+    const failedMatch = out.match(/(\d+) failed/);
+    if (passedMatch?.[1]) passed = Number.parseInt(passedMatch[1], 10);
+    if (failedMatch?.[1]) failed = Number.parseInt(failedMatch[1], 10);
+    tests_run = passed + failed;
+  } else if (runner === "jest") {
+    const suitesMatch = out.match(/Test Suites:\s+(\d+)\s+total/);
+    const passedMatch = out.match(/Tests:\s+(\d+)\s+passed/);
+    const failedMatch = out.match(/Tests:\s+(\d+)\s+failed/);
+    tests_run = Number.parseInt(suitesMatch?.[1] ?? "0", 10);
+    passed = Number.parseInt(passedMatch?.[1] ?? "0", 10);
+    failed = Number.parseInt(failedMatch?.[1] ?? "0", 10);
+  }
+  return {
+    runner,
+    exit_code: result.exitCode,
+    tests_run,
+    passed,
+    failed,
+    duration_ms: duration,
+    output: result.stdout || result.error || "",
+    truncated: result.truncated
+  };
+}
+
+// src/todo.ts
+var todoTool = {
+  name: "todo",
+  category: "Session",
+  description: "Replace the current todo list with a new set of items.",
+  usageHint: "Use for multi-step tasks. Replace the full list on each call. At most ONE task may be in_progress at a time. Items have id, content, status (pending|in_progress|completed), and optional activeForm.",
+  permission: "auto",
+  mutating: false,
+  timeoutMs: 1e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      todos: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+            content: { type: "string" },
+            status: { type: "string", enum: ["pending", "in_progress", "completed"] },
+            activeForm: { type: "string" }
+          },
+          required: ["id", "content", "status"]
+        }
+      }
+    },
+    required: ["todos"]
+  },
+  async execute(input, ctx) {
+    if (!Array.isArray(input?.todos)) {
+      throw new Error("todo: todos must be an array");
+    }
+    const items = input.todos.filter((t) => Boolean(t?.id && t.content));
+    const inProgress = items.filter((t) => t.status === "in_progress");
+    if (inProgress.length > 1) {
+      let seenInProgress = false;
+      for (const item of items) {
+        if (item.status === "in_progress") {
+          if (seenInProgress) item.status = "pending";
+          seenInProgress = true;
+        }
+      }
+    }
+    ctx.state.replaceTodos(items);
+    return {
+      count: items.length,
+      in_progress: items.filter((t) => t.status === "in_progress").length
+    };
+  }
+};
+
+// src/tool-help.ts
+var toolHelpTool = {
+  name: "tool_help",
+  category: "Meta",
+  description: "Get help and usage information for a specific tool or list all available tools.",
+  usageHint: "Set `tool` for specific help. Omit to list all tools. `format`: short (one-liner), full (schema), markdown (formatted).",
+  permission: "auto",
+  mutating: false,
+  timeoutMs: 5e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      tool: {
+        type: "string",
+        description: "Tool name to get help for (omit for all tools)"
+      },
+      format: {
+        type: "string",
+        enum: ["short", "full", "markdown"],
+        description: "Output format (default: short)"
+      },
+      include_examples: {
+        type: "boolean",
+        description: "Include usage examples in output (default: false)"
+      }
+    }
+  },
+  async execute(input, ctx) {
+    const format = input.format ?? "short";
+    const includeExamples = input.include_examples ?? false;
+    if (input.tool) {
+      const tool = ctx.tools.find((t) => t.name === input.tool);
+      if (!tool) {
+        return {
+          tool: input.tool,
+          help: `No tool found with name "${input.tool}"`,
+          tools: [],
+          total: 0
+        };
+      }
+      return {
+        tool: tool.name,
+        help: formatToolHelp(tool, format, includeExamples),
+        tools: [
+          {
+            name: tool.name,
+            description: tool.description,
+            usageHint: tool.usageHint ?? "",
+            inputSchema: tool.inputSchema,
+            permission: tool.permission,
+            mutating: tool.mutating
+          }
+        ],
+        total: 1
+      };
+    }
+    const allTools = ctx.tools.map((t) => ({
+      name: t.name,
+      description: t.description,
+      usageHint: t.usageHint ?? "",
+      inputSchema: format === "full" ? t.inputSchema : void 0,
+      permission: t.permission,
+      mutating: t.mutating
+    }));
+    return {
+      help: format === "markdown" ? formatAllToolsMarkdown(allTools) : formatAllToolsShort(allTools),
+      tools: allTools,
+      total: allTools.length
+    };
+  }
+};
+function formatToolHelp(tool, format, includeExamples) {
+  const lines = [];
+  if (format === "short") {
+    lines.push(`${tool.name}: ${tool.description}`);
+    if (tool.usageHint) lines.push(`Hint: ${tool.usageHint}`);
+    return lines.join("\n");
+  }
+  if (format === "markdown") {
+    lines.push(`## ${tool.name}`);
+    lines.push("");
+    lines.push(tool.description);
+    lines.push("");
+    lines.push("**Permission:** " + tool.permission);
+    lines.push("**Mutating:** " + (tool.mutating ? "yes" : "no"));
+    if (tool.usageHint) {
+      lines.push("");
+      lines.push("### Usage Hint");
+      lines.push(tool.usageHint);
+    }
+    if (includeExamples && tool.inputSchema) {
+      lines.push("");
+      lines.push("### Input Schema");
+      lines.push("```json");
+      lines.push(JSON.stringify(tool.inputSchema, null, 2));
+      lines.push("```");
+    }
+    return lines.join("\n");
+  }
+  lines.push(`Tool: ${tool.name}`);
+  lines.push(`Description: ${tool.description}`);
+  lines.push(`Permission: ${tool.permission}`);
+  lines.push(`Mutating: ${tool.mutating}`);
+  if (tool.usageHint) lines.push(`Usage: ${tool.usageHint}`);
+  if (format === "full" && tool.inputSchema) {
+    lines.push("Schema: " + JSON.stringify(tool.inputSchema, null, 2));
+  }
+  return lines.join("\n");
+}
+function formatAllToolsShort(tools) {
+  return tools.map((t) => `  ${t.name.padEnd(16)} ${t.description}`).join("\n");
+}
+function formatAllToolsMarkdown(tools) {
+  const lines = ["## Available Tools", ""];
+  lines.push("| Tool | Description |");
+  lines.push("|------|-------------|");
+  for (const t of tools) {
+    lines.push(`| \`${t.name}\` | ${t.description} |`);
+  }
+  return lines.join("\n");
+}
+
+// src/tool-search.ts
+var toolSearchTool = {
+  name: "tool_search",
+  category: "Meta",
+  description: "Search available tools by name, description, tags, permission level, or mutating flag.",
+  usageHint: "Set `query` for keyword search. `tags` to filter by category. `permission` to filter by required permission. `mutating` to filter by mutating flag.",
+  permission: "auto",
+  mutating: false,
+  timeoutMs: 1e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      query: {
+        type: "string",
+        description: "Search query for tool name or description"
+      },
+      tags: {
+        type: "array",
+        items: { type: "string" },
+        description: 'Filter by tags (e.g. "filesystem", "network", "dev")'
+      },
+      permission: {
+        type: "string",
+        enum: ["auto", "confirm", "deny"],
+        description: "Filter by required permission level"
+      },
+      mutating: {
+        type: "boolean",
+        description: "Filter by mutating flag (true=filters that modify, false=read-only)"
+      },
+      limit: {
+        type: "integer",
+        description: "Maximum results to return (default: 20)",
+        minimum: 1,
+        maximum: 100
+      }
+    }
+  },
+  async execute(input, ctx) {
+    const limit = Math.min(input.limit ?? 20, 100);
+    const tools = ctx.tools;
+    const query2 = input.query?.toLowerCase() ?? "";
+    const filtered = tools.filter((t) => {
+      if (query2 && !t.name.toLowerCase().includes(query2) && !t.description.toLowerCase().includes(query2)) {
+        return false;
+      }
+      if (input.permission && t.permission !== input.permission) {
+        return false;
+      }
+      if (typeof input.mutating === "boolean" && t.mutating !== input.mutating) {
+        return false;
+      }
+      return true;
+    });
+    const results = filtered.slice(0, limit).map((t) => ({
+      name: t.name,
+      description: t.description,
+      permission: t.permission,
+      mutating: t.mutating
+    }));
+    return {
+      tools: results,
+      total: filtered.length,
+      truncated: filtered.length > limit
+    };
+  }
+};
+
+// src/tool-use.ts
+var toolUseTool = {
+  name: "tool_use",
+  category: "Meta",
+  description: "Execute a specific tool by name with given input. Useful when the agent knows exactly which tool to call.",
+  usageHint: "Set `tool` with exact tool name and `input` with the tool parameters. Returns result or error.",
+  permission: "confirm",
+  mutating: true,
+  timeoutMs: 6e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      tool: {
+        type: "string",
+        description: "Exact name of the tool to execute"
+      },
+      input: {
+        type: "object",
+        description: "Input parameters for the tool"
+      }
+    },
+    required: ["tool"]
+  },
+  async execute(input, ctx, opts) {
+    const start = Date.now();
+    if (!input?.tool) {
+      return {
+        tool: "unknown",
+        success: false,
+        error: "tool_use: tool name is required",
+        executionMs: 0
+      };
+    }
+    const tool = ctx.tools.find((t) => t.name === input.tool);
+    if (!tool) {
+      return {
+        tool: input.tool,
+        success: false,
+        error: `tool_use: tool "${input.tool}" not found`,
+        executionMs: Date.now() - start
+      };
+    }
+    if (tool.permission === "deny") {
+      return {
+        tool: input.tool,
+        success: false,
+        error: `tool_use: tool "${input.tool}" is denied by policy`,
+        executionMs: Date.now() - start
+      };
+    }
+    try {
+      const result = await tool.execute(input.input, ctx, opts);
+      return {
+        tool: input.tool,
+        success: true,
+        result,
+        executionMs: Date.now() - start
+      };
+    } catch (e) {
+      return {
+        tool: input.tool,
+        success: false,
+        error: e instanceof Error ? e.message : String(e),
+        executionMs: Date.now() - start
+      };
+    }
+  }
+};
+var DEFAULT_IGNORE4 = [
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  ".next",
+  "coverage",
+  "__pycache__"
+];
+var treeTool = {
+  name: "tree",
+  category: "Filesystem",
+  description: "Display directory structure as an ASCII tree. Shows files and folders with indentation.",
+  usageHint: "Set `path` (default: cwd). `depth` limits nesting (default: 3). `glob` filters files. `exclude` ignores dirs. `show_files` toggles file listing (default: true).",
+  permission: "auto",
+  mutating: false,
+  timeoutMs: 15e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      path: { type: "string", description: "Root directory (default: cwd)" },
+      depth: {
+        type: "integer",
+        description: "Max nesting depth (default: 3, 0 for unlimited)",
+        minimum: 0,
+        maximum: 20
+      },
+      glob: { type: "string", description: 'Filter files matching glob (e.g. "*.ts")' },
+      exclude: {
+        type: "array",
+        items: { type: "string" },
+        description: "Directory names to exclude"
+      },
+      show_files: {
+        type: "boolean",
+        description: "Show files (default: true, false shows dirs only)"
+      },
+      show_dirs: {
+        type: "boolean",
+        description: "Show directories (default: true)"
+      },
+      show_hidden: {
+        type: "boolean",
+        description: "Show hidden files starting with . (default: false)"
+      }
+    }
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    for await (const ev of treeTool.executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("tree: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx) {
+    const basePath = input.path ? safeResolve(input.path, ctx) : ctx.cwd;
+    const maxDepth = input.depth ?? 3;
+    const showFiles = input.show_files ?? true;
+    const showDirs = input.show_dirs ?? true;
+    const showHidden = input.show_hidden ?? false;
+    const exclude = /* @__PURE__ */ new Set([...DEFAULT_IGNORE4, ...input.exclude ?? []]);
+    const filterGlob = input.glob;
+    const lines = [basePath];
+    const totals = { totalFiles: { value: 0 }, totalDirs: { value: 0 } };
+    const queue = [];
+    const FLUSH_EVERY = 200;
+    let lastEmittedTotal = 0;
+    const tickProgress = () => {
+      const seen = totals.totalFiles.value + totals.totalDirs.value;
+      if (seen - lastEmittedTotal >= FLUSH_EVERY) {
+        queue.push({
+          type: "metric",
+          text: `${seen} entries`,
+          data: { files: totals.totalFiles.value, dirs: totals.totalDirs.value }
+        });
+        lastEmittedTotal = seen;
+      }
+    };
+    const walkPromise = walkDir(basePath, 0, {
+      maxDepth,
+      exclude,
+      showFiles,
+      showDirs,
+      showHidden,
+      filterGlob,
+      lines,
+      prefix: "",
+      isLast: true,
+      totalFiles: totals.totalFiles,
+      totalDirs: totals.totalDirs,
+      onProgress: tickProgress
+    });
+    let walkDone = false;
+    walkPromise.finally(() => {
+      walkDone = true;
+    });
+    while (!walkDone || queue.length > 0) {
+      if (queue.length > 0) {
+        yield queue.shift();
+      } else {
+        let pollTimer;
+        const poll = new Promise((r) => {
+          pollTimer = setTimeout(r, 50);
+        });
+        try {
+          await Promise.race([walkPromise, poll]).catch(() => void 0);
+        } finally {
+          if (pollTimer) clearTimeout(pollTimer);
+        }
+      }
+    }
+    await walkPromise;
+    yield {
+      type: "final",
+      output: {
+        tree: lines.join("\n"),
+        total_files: totals.totalFiles.value,
+        total_dirs: totals.totalDirs.value,
+        truncated: false,
+        path: basePath
+      }
+    };
+  }
+};
+async function walkDir(dir, depth, opts) {
+  const entries = await fs9.readdir(dir, { withFileTypes: true }).catch(() => []);
+  const filtered = entries.filter((e) => {
+    if (!opts.showHidden && e.name.startsWith(".")) return false;
+    if (opts.exclude.has(e.name)) return false;
+    return true;
+  });
+  if (depth > 0) {
+    const dirCount = filtered.filter((e) => e.isDirectory()).length;
+    const fileCount = filtered.filter((e) => e.isFile()).length;
+    opts.totalDirs.value += dirCount;
+    opts.totalFiles.value += fileCount;
+    opts.onProgress?.();
+  }
+  const items = filtered.sort((a, b) => {
+    if (a.isDirectory() && !b.isDirectory()) return -1;
+    if (!a.isDirectory() && b.isDirectory()) return 1;
+    return a.name.localeCompare(b.name);
+  });
+  for (let i = 0; i < items.length; i++) {
+    const entry = items[i];
+    if (!entry) continue;
+    const isLast = i === items.length - 1;
+    const connector = opts.isLast ? "    " : "\u2502   ";
+    const branch = isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 ";
+    const displayName = entry.name + (entry.isDirectory() ? "/" : "");
+    if (!opts.showDirs && entry.isDirectory()) continue;
+    if (!opts.showFiles && entry.isFile()) continue;
+    opts.lines.push(opts.prefix + branch + displayName);
+    if (entry.isDirectory() && (opts.maxDepth === 0 || depth < opts.maxDepth)) {
+      const childPrefix = opts.prefix + connector;
+      await walkDir(path.join(dir, entry.name), depth + 1, {
+        ...opts,
+        prefix: childPrefix,
+        isLast
+      });
+    }
+  }
+}
+var typecheckTool = {
+  name: "typecheck",
+  category: "Code Quality",
+  description: "Run TypeScript type checking with `tsc --noEmit`. Checks for type errors without compiling.",
+  usageHint: "Set `project` for tsconfig path (default: nearest). `strict` enables strictest flags. `all` checks all projects in workspace.",
+  permission: "confirm",
+  mutating: false,
+  timeoutMs: 12e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      project: { type: "string", description: "Path to tsconfig.json (default: auto-detect)" },
+      cwd: { type: "string", description: "Working directory (default: cwd)" },
+      strict: {
+        type: "boolean",
+        description: "Add --strict flag for maximum type checking (default: false)"
+      },
+      all: {
+        type: "boolean",
+        description: "Type-check all projects (pnpm -r) (default: false)"
+      }
+    }
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    for await (const ev of typecheckTool.executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("typecheck: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    let args;
+    let project;
+    if (input.all) {
+      args = ["--noEmit"];
+      project = "workspace";
+    } else {
+      const tsconfig = input.project ? safeResolve(input.project, ctx) : await findTsConfig(cwd);
+      args = ["--noEmit"];
+      if (input.strict) args.push("--strict");
+      if (tsconfig) args.push("--project", tsconfig);
+      project = tsconfig ?? "default";
+    }
+    yield { type: "log", text: `tsc ${args.join(" ")}`, data: { project } };
+    const result = yield* spawnStream({
+      cmd: "npx",
+      args: ["tsc", ...args],
+      cwd,
+      signal: opts.signal,
+      maxBytes: 2e5
+    });
+    const errors = (result.stdout.match(/error TS/g) || []).length;
+    const warnings = (result.stdout.match(/warning/g) || []).length;
+    yield {
+      type: "final",
+      output: {
+        project,
+        exit_code: result.exitCode,
+        errors,
+        warnings,
+        output: result.stdout || result.stderr || result.error || "",
+        truncated: result.truncated
+      }
+    };
+  }
+};
+async function findTsConfig(cwd) {
+  const { stat: stat9 } = await import('fs/promises');
+  const candidates = ["tsconfig.json", "tsconfig.base.json"];
+  for (const f of candidates) {
+    try {
+      const s = await stat9(path.join(cwd, f));
+      if (s.isFile()) return path.join(cwd, f);
+    } catch {
+    }
+  }
+  return null;
+}
+var writeTool = {
+  name: "write",
+  category: "Filesystem",
+  description: "Write or overwrite a file. For existing files, prefer `edit` over `write`.",
+  usageHint: "Use `write` for new files or full replacements. For partial edits use `edit`. Existing files must have been `read` first in this session.",
+  permission: "confirm",
+  mutating: true,
+  timeoutMs: 5e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      path: { type: "string" },
+      content: { type: "string" }
+    },
+    required: ["path", "content"]
+  },
+  async execute(input, ctx) {
+    if (!input?.path) throw new Error("write: path is required");
+    if (input.content === void 0) throw new Error("write: content is required");
+    const absPath = safeResolve(input.path, ctx);
+    let existed = false;
+    let prev = "";
+    try {
+      const stat10 = await fs9.stat(absPath);
+      existed = stat10.isFile();
+      if (existed) {
+        if (!ctx.hasRead(absPath)) {
+          throw new Error(
+            `write: file "${input.path}" exists but was not read in this session. Read it first.`
+          );
+        }
+        prev = await fs9.readFile(absPath, "utf8");
+      }
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        throw err;
+      }
+    }
+    await atomicWrite(absPath, input.content);
+    const diff = existed ? unifiedDiff(prev, input.content, { fromFile: input.path, toFile: input.path }) : `+++ ${input.path}
++ (new file, ${input.content.split("\n").length} lines)`;
+    const stat9 = await fs9.stat(absPath);
+    ctx.recordRead(absPath, stat9.mtimeMs);
+    return {
+      path: absPath,
+      bytes_written: Buffer.byteLength(input.content, "utf8"),
+      created: !existed,
+      diff
+    };
+  }
+};
+
+// src/builtin.ts
+var builtinTools = [
+  readTool,
+  writeTool,
+  editTool,
+  replaceTool,
+  globTool,
+  grepTool,
+  bashTool,
+  execTool,
+  fetchTool,
+  searchTool,
+  todoTool,
+  planTool,
+  gitTool,
+  patchTool,
+  jsonTool,
+  diffTool,
+  treeTool,
+  lintTool,
+  formatTool,
+  typecheckTool,
+  testTool,
+  installTool,
+  auditTool,
+  outdatedTool,
+  logsTool,
+  documentTool,
+  scaffoldTool,
+  toolSearchTool,
+  toolUseTool,
+  batchToolUseTool,
+  toolHelpTool
+];
+
+// src/pack.ts
+var builtinToolsPack = {
+  name: "builtin-tools",
+  description: "WrongStack built-in filesystem, execution, network, lifecycle, and agent-control tools.",
+  tools: builtinTools
+};
+
+export { builtinToolsPack };
+//# sourceMappingURL=pack.js.map
+//# sourceMappingURL=pack.js.map