@wrongstack/tools 0.155.0 → 0.250.0

package/dist/audit.js

@@ -29,6 +29,7 @@ function resolveWin32Command(cmd) {
 async function* spawnStream(opts) {
   const max = opts.maxBytes;
   const flushAt = opts.flushBytes ?? 4 * 1024;
+  const maxQueue = opts.maxQueueSize ?? 500;
   let stdout = "";
   let stderr = "";
   let pending = "";
@@ -40,10 +41,12 @@ async function* spawnStream(opts) {
     signal: opts.signal,
     env: buildChildEnv(),
     stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true,
     ...needsShell ? { shell: true, windowsVerbatimArguments: true } : {}
   });
   const queue = [];
   let waiter;
+  let paused = false;
   const wake = () => {
     if (waiter) {
       const w = waiter;
@@ -51,17 +54,34 @@ async function* spawnStream(opts) {
       w();
     }
   };
+  const resume = () => {
+    if (paused && queue.length < maxQueue) {
+      paused = false;
+      child.stdout?.resume();
+      child.stderr?.resume();
+    }
+  };
   child.stdout?.on("data", (c) => {
     const s = c.toString();
     if (stdout.length < max) stdout += s;
     queue.push({ kind: "out", data: s });
     wake();
+    if (!paused && queue.length >= maxQueue) {
+      paused = true;
+      child.stdout?.pause();
+      child.stderr?.pause();
+    }
   });
   child.stderr?.on("data", (c) => {
     const s = c.toString();
     if (stderr.length < max) stderr += s;
     queue.push({ kind: "err", data: s });
     wake();
+    if (!paused && queue.length >= maxQueue) {
+      paused = true;
+      child.stdout?.pause();
+      child.stderr?.pause();
+    }
   });
   child.on("error", (e) => {
     error = e.message;
@@ -81,6 +101,7 @@ async function* spawnStream(opts) {
       });
     }
     const chunk = queue.shift();
+    resume();
     if (chunk.kind === "close") {
       if (!spawnFailed) exitCode = chunk.code ?? 0;
       break;
@@ -122,7 +143,7 @@ async function detectPackageManager(cwd) {
   return "npm";
 }
 function resolvePath(input, ctx) {
-  return path2.isAbsolute(input) ? path2.normalize(input) : path2.resolve(ctx.cwd, input);
+  return path2.isAbsolute(input) ? path2.normalize(input) : path2.resolve(ctx.workingDir ?? ctx.cwd, input);
 }
 function ensureInsideRoot(absPath, ctx) {
   const root = path2.resolve(ctx.projectRoot);

package/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/_win32-resolve.ts","../src/_spawn-stream.ts","../src/_util.ts","../src/audit.ts"],"names":["path","resolve"],"mappings":";;;;;;AAYO,SAAS,oBAAoB,GAAA,EAAqB;AACvD,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,OAAA,EAAS,OAAO,GAAA;AAGzC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,CAAI,SAAS,IAAI,CAAA,IAAUA,KAAA,CAAA,OAAA,CAAQ,GAAG,CAAA,EAAG;AAChE,IAAA,OAAO,GAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAA,CAAW,QAAQ,GAAA,CAAI,SAAS,KAAK,uCAAA,EACxC,WAAA,EAAY,CACZ,KAAA,CAAM,GAAG,CAAA;AAEZ,EAAA,MAAM,YAAY,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,IAAK,EAAA,EAAI,MAAWA,KAAA,CAAA,SAAS,CAAA;AAEjE,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,MAAM,IAAA,GAAYA,KAAA,CAAA,IAAA,CAAK,GAAA,EAAK,GAAG,CAAA;AAG/B,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,MAAA,MAAM,IAAA,GAAO,CAAA,EAAG,IAAI,CAAA,EAAG,GAAG,CAAA,CAAA;AAC1B,MAAA,IAAI;AACF,QAAG,EAAA,CAAA,UAAA,CAAW,IAAA,EAAS,EAAA,CAAA,SAAA,CAAU,IAAI,CAAA;AACrC,QAAA,OAAO,IAAA;AAAA,MACT,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAIA,EAAA,OAAO,GAAA;AACT;;;ACfA,gBAAuB,YACrB,IAAA,EACsD;AACtD,EAAA,MAAM,GAAA,GAAM,KAAK,QAAY;AAC7B,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,IAAc,CAAA,GAAI,IAAA;AACvC,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,IAAI,KAAA;AAEJ,EAAA,MAAM,GAAA,GAAM,mBAAA,CAAoB,IAAA,CAAK,GAAG,CAAA;AACxC,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,QAAA,KAAa,OAAA,KAAY,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,CAAA;AAE/F,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,EAAK,IAAA,CAAK,IAAA,EAAM;AAAA,IAClC,KAAK,IAAA,CAAK,GAAA;AAAA,IACV,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,KAAK,aAAA,EAAc;AAAA,IACnB,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAAA,IAChC,GAAI,aAAa,EAAE,KAAA,EAAO,MAAM,wBAAA,EAA0B,IAAA,KAAS;AAAC,GACrE,CAAA;AAGD,EAAA,MAAM,QAAiB,EAAC;AACxB,EAAA,IAAI,MAAA;AACJ,EAAA,MAAM,OAAO,MAAM;AACjB,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAM,CAAA,GAAI,MAAA;AACV,MAAA,MAAA,GAAS,MAAA;AACT,MAAA,CAAA,EAAE;AAAA,IACJ;AAAA,EACF,CAAA;AAEA,EAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,IAAA,MAAM,CAAA,GAAI,EAAE,QAAA,EAAS;AACrB,IAAA,IAAI,MAAA,CAAO,MAAA,GAAS,GAAA,EAAK,MAAA,IAAU,CAAA;AACnC,IAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,GAAG,CAAA;AACnC,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AACD,EAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,IAAA,MAAM,CAAA,GAAI,EAAE,QAAA,EAAS;AACrB,IAAA,IAAI,MAAA,CAAO,MAAA,GAAS,GAAA,EAAK,MAAA,IAAU,CAAA;AACnC,IAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,GAAG,CAAA;AACnC,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AACD,EAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,CAAA,KAAM;AACvB,IAAA,KAAA,GAAQ,CAAA,CAAE,OAAA;AACV,IAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,SAAS,IAAA,EAAM,CAAA,CAAE,SAAS,CAAA;AAC7C,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AACD,EAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,IAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,EAAA,EAAI,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,CAAA;AACvD,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AAED,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,IAAI,WAAA,GAAc,KAAA;AAClB,EAAA,WAAS;AACP,IAAA,OAAO,KAAA,CAAM,WAAW,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,OAAA,CAAc,CAACC,QAAAA,KAAY;AACnC,QAAA,MAAA,GAASA,QAAAA;AAAA,MACX,CAAC,CAAA;AAAA,IACH;AACA,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,EAAM;AAC1B,IAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAG1B,MAAA,IAAI,CAAC,WAAA,EAAa,QAAA,GAAW,KAAA,CAAM,IAAA,IAAQ,CAAA;AAC3C,MAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,MAAA,WAAA,GAAc,IAAA;AACd,MAAA,QAAA,GAAW,CAAA;AAEX,MAAA;AAAA,IACF;AACA,IAAA,OAAA,IAAW,KAAA,CAAM,IAAA;AACjB,IAAA,IAAI,OAAA,CAAQ,UAAU,OAAA,EAAS;AAC7B,MAAA,MAAM,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,OAAA,EAAQ;AAC9C,MAAA,OAAA,GAAU,EAAA;AAAA,IACZ;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,MAAM,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,OAAA,EAAQ;AAAA,EAChD;AAEA,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,SAAA,EAAW,MAAA,CAAO,MAAA,IAAU,GAAA,IAAO,OAAO,MAAA,IAAU,GAAA;AAAA,IACpD;AAAA,GACF;AACF;AC5GA,eAAsB,qBAAqB,GAAA,EAAsC;AAC/E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,OAAO,kBAAkB,CAAA;AAChD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,eAAA,CAAiB,CAAA;AAClC,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,UAAA,CAAY,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAY,KAAA,CAAA,UAAA,CAAW,KAAK,CAAA,GAAS,KAAA,CAAA,SAAA,CAAU,KAAK,CAAA,GAAS,KAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AACrF;AAEO,SAAS,gBAAA,CAAiB,SAAiB,GAAA,EAAsB;AACtE,EAAA,MAAM,IAAA,GAAY,KAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AACzC,EAAA,MAAM,MAAA,GAAc,cAAQ,OAAO,CAAA;AACnC,EAAA,MAAM,GAAA,GAAW,KAAA,CAAA,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AACtC,EAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,IAAU,KAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AAChD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,OAAO,CAAA,2BAAA,EAA8B,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,EACvE;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAO,gBAAA,CAAiB,WAAA,CAAY,KAAA,EAAO,GAAG,GAAG,GAAG,CAAA;AACtD;;;ACnBO,IAAM,SAAA,GAA2C;AAAA,EACtD,IAAA,EAAM,OAAA;AAAA,EACN,QAAA,EAAU,oBAAA;AAAA,EACV,WAAA,EACE,wHAAA;AAAA,EACF,SAAA,EACE,yQAAA;AAAA,EAKF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,KAAA;AAAA,EACV,SAAA,EAAW,GAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,kCAAA,EAAmC;AAAA,MACvE,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,KAAA,EAAO,UAAA,EAAY,QAAQ,UAAU,CAAA;AAAA,QAC5C,WAAA,EAAa;AAAA,OACf;AAAA,MACA,GAAA,EAAK,EAAE,IAAA,EAAM,SAAA,EAAW,aAAa,iDAAA,EAAkD;AAAA,MACvF,QAAA,EAAU,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,gDAAA;AAAiD;AAC5F,GACF;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,KAAA;AACJ,IAAA,MAAM,gBAAgB,SAAA,CAAU,aAAA;AAChC,IAAA,IAAI,CAAC,aAAA,EAAe,MAAM,IAAI,MAAM,yCAAyC,CAAA;AAC7E,IAAA,WAAA,MAAiB,EAAA,IAAM,aAAA,CAAc,KAAA,EAAO,GAAA,EAAK,IAAI,CAAA,EAAG;AACtD,MAAA,IAAI,EAAA,CAAG,IAAA,KAAS,OAAA,EAAS,KAAA,GAAQ,EAAA,CAAG,MAAA;AAAA,IACtC;AACA,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,yCAAyC,CAAA;AACrE,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAAA,EACA,OAAO,aAAA,CAAc,KAAA,EAAO,GAAA,EAAK,IAAA,EAAoD;AACnF,IAAA,MAAM,GAAA,GAAM,MAAM,GAAA,GAAM,WAAA,CAAY,MAAM,GAAA,EAAK,GAAG,IAAI,GAAA,CAAI,GAAA;AAC1D,IAAA,MAAM,OAAA,GAAU,MAAM,oBAAA,CAAqB,GAAG,CAAA;AAC9C,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA,cAAA,EAAiB,OAAO,CAAA,MAAA,CAAA,EAAK,IAAA,EAAM,EAAE,OAAA,EAAQ,EAAE;AAE1E,IAAA,MAAM,IAAA,GAAO,CAAC,OAAA,EAAS,QAAQ,CAAA;AAC/B,IAAA,IAAI,KAAA,CAAM,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA;AAChC,IAAA,IAAI,MAAM,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,GAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA,GAAI,KAAA,CAAM,QAAA,GAAW,KAAA,CAAM,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AACtF,MAAA,IAAA,CAAK,IAAA,CAAK,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAc,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAAA,IAChD;AAEA,IAAA,MAAM,MAAA,GAAS,OAAO,WAAA,CAAY;AAAA,MAChC,GAAA,EAAK,OAAA;AAAA,MACL,IAAA;AAAA,MACA,GAAA;AAAA,MACA,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACX,CAAA;AAED,IAAA,MAAM,EAAE,MAAM,OAAA,EAAS,MAAA,EAAQ,iBAAiB,MAAA,CAAO,MAAA,EAAQ,MAAA,CAAO,QAAQ,CAAA,EAAE;AAAA,EAClF;AACF;AAEA,SAAS,gBAAA,CAAiB,MAAc,QAAA,EAA+B;AACrE,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,iBAAiB,EAAC;AAAA,MAClB,KAAA,EAAO,CAAA;AAAA,MACP,OAAA,EAAS,QAAA,KAAa,CAAA,GAAI,0BAAA,GAA6B,cAAA;AAAA,MACvD,MAAA,EAAQ,EAAA;AAAA,MACR,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC5B,IAAA,MAAM,aAAmC,EAAC;AAC1C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,UAAA,IAAc,EAAC;AAChC,IAAA,KAAA,MAAW,EAAA,IAAM,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AACjC,MAAA,MAAM,GAAA,GAAM,IAAI,EAAE,CAAA;AAClB,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,QAAA,EAAU,IAAI,QAAA,IAAY,SAAA;AAAA,QAC1B,OAAA,EAAS,IAAI,WAAA,IAAe,EAAA;AAAA,QAC5B,KAAA,EAAO,IAAI,KAAA,IAAS,uBAAA;AAAA,QACpB,GAAA,EAAK,IAAI,GAAA,IAAO;AAAA,OACjB,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAA;AACzB,IAAA,MAAM,OAAA,GACJ,KAAA,KAAU,CAAA,GACN,0BAAA,GACA,CAAA,MAAA,EAAS,KAAK,CAAA,kBAAA,EAAqB,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,UAAU,CAAA,CAAE,MAAM,CAAA,WAAA,EAAc,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,KAAa,MAAM,CAAA,CAAE,MAAM,CAAA,KAAA,CAAA;AAEvK,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,eAAA,EAAiB,UAAA;AAAA,MACjB,KAAA;AAAA,MACA,OAAA;AAAA,MACA,MAAA,EAAQ,IAAA;AAAA,MACR,SAAA,EAAW,KAAK,MAAA,IAAU;AAAA,KAC5B;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,iBAAiB,EAAC;AAAA,MAClB,KAAA,EAAO,CAAA;AAAA,MACP,OAAA,EAAS,8BAAA;AAAA,MACT,MAAA,EAAQ,IAAA;AAAA,MACR,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AACF","file":"audit.js","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\n/**\n * On Windows, Node.js `spawn()` without a shell does NOT resolve .cmd/.bat\n * extensions through PATHEXT — it only auto-resolves .exe. Most Node.js CLI\n * tools (npx, pnpm, biome, tsc, vitest, etc.) ship as .cmd wrappers on\n * Windows. This function resolves the command name to its full path so spawn\n * can find it without relying on shell-mode argument concatenation.\n *\n * On non-Windows, returns the command unchanged.\n */\nexport function resolveWin32Command(cmd: string): string {\n  if (process.platform !== 'win32') return cmd;\n\n  // Already has a path or extension — use as-is\n  if (cmd.includes('/') || cmd.includes('\\\\') || path.extname(cmd)) {\n    return cmd;\n  }\n\n  const pathext = (process.env['PATHEXT'] ?? '.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC')\n    .toLowerCase()\n    .split(';');\n\n  const pathDirs = (process.env['PATH'] ?? '').split(path.delimiter);\n\n  for (const dir of pathDirs) {\n    const base = path.join(dir, cmd);\n    // Check extensions in PATHEXT order. .EXE should win first because\n    // it's typically listed first, and .exe doesn't need shell: true.\n    for (const ext of pathext) {\n      const full = `${base}${ext}`;\n      try {\n        fs.accessSync(full, fs.constants.X_OK);\n        return full;\n      } catch {\n        // Not found with this extension — try next\n      }\n    }\n  }\n\n  // Not found — return original; let spawn report ENOENT with the\n  // expected error message so tools can surface it properly.\n  return cmd;\n}\n","import { spawn } from 'node:child_process';\nimport { buildChildEnv } from '@wrongstack/core';\nimport type { ToolProgressEvent } from '@wrongstack/core';\nimport { resolveWin32Command } from './_win32-resolve.js';\nexport interface SpawnStreamResult {\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  truncated: boolean;\n  error?: string | undefined;\n}\n\nexport interface SpawnStreamOptions {\n  cmd: string;\n  args: string[];\n  cwd: string;\n  signal: AbortSignal;\n  maxBytes?: number | undefined;\n  /** Bytes of new stdout/stderr to accumulate before yielding a `partial_output` event. */\n  flushBytes?: number | undefined;\n}\n\n/**\n * Spawn a child process and yield `partial_output` progress events as\n * stdout/stderr arrive (batched by byte threshold), then return the full\n * buffered result. Shared between install/lint/format/typecheck/test/audit\n * so the TUI live tail sees consistent progress regardless of which tool\n * is running.\n */\nexport async function* spawnStream(\n  opts: SpawnStreamOptions,\n): AsyncGenerator<ToolProgressEvent, SpawnStreamResult> {\n  const max = opts.maxBytes ?? 200_000;\n  const flushAt = opts.flushBytes ?? 4 * 1024;\n  let stdout = '';\n  let stderr = '';\n  let pending = '';\n  let error: string | undefined;\n\n  const cmd = resolveWin32Command(opts.cmd);\n  const needsShell = process.platform === 'win32' && (cmd.endsWith('.cmd') || cmd.endsWith('.bat'));\n\n  const child = spawn(cmd, opts.args, {\n    cwd: opts.cwd,\n    signal: opts.signal,\n    env: buildChildEnv(),\n    stdio: ['ignore', 'pipe', 'pipe'],\n    ...(needsShell ? { shell: true, windowsVerbatimArguments: true } : {}),\n  });\n\n  type Chunk = { kind: 'out' | 'err' | 'close' | 'error'; data: string; code?: number | undefined };\n  const queue: Chunk[] = [];\n  let waiter: (() => void) | undefined;\n  const wake = () => {\n    if (waiter) {\n      const w = waiter;\n      waiter = undefined;\n      w();\n    }\n  };\n\n  child.stdout?.on('data', (c) => {\n    const s = c.toString();\n    if (stdout.length < max) stdout += s;\n    queue.push({ kind: 'out', data: s });\n    wake();\n  });\n  child.stderr?.on('data', (c) => {\n    const s = c.toString();\n    if (stderr.length < max) stderr += s;\n    queue.push({ kind: 'err', data: s });\n    wake();\n  });\n  child.on('error', (e) => {\n    error = e.message;\n    queue.push({ kind: 'error', data: e.message });\n    wake();\n  });\n  child.on('close', (code) => {\n    queue.push({ kind: 'close', data: '', code: code ?? 0 });\n    wake();\n  });\n\n  let exitCode = 0;\n  let spawnFailed = false;\n  for (;;) {\n    while (queue.length === 0) {\n      await new Promise<void>((resolve) => {\n        waiter = resolve;\n      });\n    }\n    const chunk = queue.shift()!;\n    if (chunk.kind === 'close') {\n      // If we already saw a spawn error (ENOENT etc.), keep exitCode=1\n      // rather than the negative platform code Node fabricates.\n      if (!spawnFailed) exitCode = chunk.code ?? 0;\n      break;\n    }\n    if (chunk.kind === 'error') {\n      spawnFailed = true;\n      exitCode = 1;\n      // close usually follows\n      continue;\n    }\n    pending += chunk.data;\n    if (pending.length >= flushAt) {\n      yield { type: 'partial_output', text: pending };\n      pending = '';\n    }\n  }\n  if (pending.length > 0) {\n    yield { type: 'partial_output', text: pending };\n  }\n\n  return {\n    stdout,\n    stderr,\n    exitCode,\n    truncated: stdout.length >= max || stderr.length >= max,\n    error,\n  };\n}\n","import * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core';\nimport type { Context } from '@wrongstack/core';\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm → yarn → npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const root = path.resolve(ctx.projectRoot);\n  const target = path.resolve(absPath);\n  const rel = path.relative(root, target);\n  if (rel.startsWith('..') || path.isAbsolute(rel)) {\n    throw new Error(`Path \"${absPath}\" is outside project root \"${root}\"`);\n  }\n  return target;\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root→out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink — macOS `/var`→`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  const realRoot = await fsp.realpath(ctx.projectRoot).catch(() => path.resolve(ctx.projectRoot));\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    const rel = path.relative(realRoot, real);\n    if (rel.startsWith('..') || path.isAbsolute(rel)) {\n      throw new Error(\n        `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoot}\"`,\n      );\n    }\n    return;\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// ─── Command-output normalization (token-saving) ────────────────────────────\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) — never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only — it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `… ⟨repeated ${run}×⟩`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends — the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n…[truncated ${total - kept} bytes]…\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI → collapse\n * carriage-return progress → trim trailing whitespace → collapse identical\n * consecutive lines → squeeze blank-line runs → head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number | undefined } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines → 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n","import type { Tool, ToolStreamEvent } from '@wrongstack/core';\nimport { spawnStream } from './_spawn-stream.js';\nimport { detectPackageManager, safeResolve } from './_util.js';\n\ninterface AuditInput {\n  cwd?: string | undefined;\n  level?: 'low' | 'moderate' | 'high' | 'critical' | undefined;\n  fix?: boolean | undefined;\n  packages?: string | string[] | undefined;\n}\n\ninterface AuditVulnerability {\n  severity: string;\n  package: string;\n  title: string;\n  url: string;\n}\n\ninterface AuditOutput {\n  exit_code: number;\n  vulnerabilities: AuditVulnerability[];\n  total: number;\n  summary: string;\n  output: string;\n  truncated: boolean;\n}\n\nexport const auditTool: Tool<AuditInput, AuditOutput> = {\n  name: 'audit',\n  category: 'Package Management',\n  description:\n    'Run a security audit against project dependencies (using pnpm/npm audit). Reports known vulnerabilities with severity.',\n  usageHint:\n    'CRITICAL SECURITY TOOL:\\n\\n' +\n    '- Run regularly and especially before any release.\\n' +\n    '- Use `level` to focus on high/critical issues.\\n' +\n    '- `fix` can attempt automatic remediation for some vulnerabilities.\\n' +\n    'This is one of the most important tools for supply chain security.',\n  permission: 'confirm',\n  mutating: false,\n  timeoutMs: 60_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      cwd: { type: 'string', description: 'Working directory (default: cwd)' },\n      level: {\n        type: 'string',\n        enum: ['low', 'moderate', 'high', 'critical'],\n        description: 'Minimum severity level to report',\n      },\n      fix: { type: 'boolean', description: 'Attempt to fix vulnerabilities (default: false)' },\n      packages: { type: 'string', description: 'Specific package(s) to audit (comma-separated)' },\n    },\n  },\n  async execute(input, ctx, opts) {\n    let final: AuditOutput | undefined;\n    const executeStream = auditTool.executeStream;\n    if (!executeStream) throw new Error('auditTool: stream execution unavailable');\n    for await (const ev of executeStream(input, ctx, opts)) {\n      if (ev.type === 'final') final = ev.output;\n    }\n    if (!final) throw new Error('audit: stream ended without final event');\n    return final;\n  },\n  async *executeStream(input, ctx, opts): AsyncGenerator<ToolStreamEvent<AuditOutput>> {\n    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;\n    const manager = await detectPackageManager(cwd);\n    yield { type: 'log', text: `Auditing with ${manager}…`, data: { manager } };\n\n    const args = ['audit', '--json'];\n    if (input.fix) args.push('--fix');\n    if (input.packages) {\n      const pkgs = Array.isArray(input.packages) ? input.packages : input.packages.split(',');\n      args.push(...pkgs.map((p: string) => p.trim()));\n    }\n\n    const result = yield* spawnStream({\n      cmd: manager,\n      args,\n      cwd,\n      signal: opts.signal,\n      maxBytes: 100_000,\n    });\n\n    yield { type: 'final', output: parseAuditOutput(result.stdout, result.exitCode) };\n  },\n};\n\nfunction parseAuditOutput(json: string, exitCode: number): AuditOutput {\n  if (!json) {\n    return {\n      exit_code: exitCode,\n      vulnerabilities: [],\n      total: 0,\n      summary: exitCode === 0 ? 'No vulnerabilities found' : 'Audit failed',\n      output: '',\n      truncated: false,\n    };\n  }\n\n  try {\n    const data = JSON.parse(json);\n    const advisories: AuditVulnerability[] = [];\n    const ads = data.advisories ?? {};\n    for (const id of Object.keys(ads)) {\n      const adv = ads[id];\n      advisories.push({\n        severity: adv.severity ?? 'unknown',\n        package: adv.module_name ?? id,\n        title: adv.title ?? 'Unknown vulnerability',\n        url: adv.url ?? '',\n      });\n    }\n\n    const total = advisories.length;\n    const summary =\n      total === 0\n        ? 'No vulnerabilities found'\n        : `Found ${total} vulnerabilities: ${advisories.filter((a) => a.severity === 'critical').length} critical, ${advisories.filter((a) => a.severity === 'high').length} high`;\n\n    return {\n      exit_code: exitCode,\n      vulnerabilities: advisories,\n      total,\n      summary,\n      output: json,\n      truncated: json.length >= 100_000,\n    };\n  } catch {\n    return {\n      exit_code: exitCode,\n      vulnerabilities: [],\n      total: 0,\n      summary: 'Could not parse audit output',\n      output: json,\n      truncated: false,\n    };\n  }\n}\n"]}
+{"version":3,"sources":["../src/_win32-resolve.ts","../src/_spawn-stream.ts","../src/_util.ts","../src/audit.ts"],"names":["path","resolve"],"mappings":";;;;;;AAYO,SAAS,oBAAoB,GAAA,EAAqB;AACvD,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,OAAA,EAAS,OAAO,GAAA;AAGzC,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,CAAI,SAAS,IAAI,CAAA,IAAUA,KAAA,CAAA,OAAA,CAAQ,GAAG,CAAA,EAAG;AAChE,IAAA,OAAO,GAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAA,CAAW,QAAQ,GAAA,CAAI,SAAS,KAAK,uCAAA,EACxC,WAAA,EAAY,CACZ,KAAA,CAAM,GAAG,CAAA;AAEZ,EAAA,MAAM,YAAY,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,IAAK,EAAA,EAAI,MAAWA,KAAA,CAAA,SAAS,CAAA;AAEjE,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,MAAM,IAAA,GAAYA,KAAA,CAAA,IAAA,CAAK,GAAA,EAAK,GAAG,CAAA;AAG/B,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,MAAA,MAAM,IAAA,GAAO,CAAA,EAAG,IAAI,CAAA,EAAG,GAAG,CAAA,CAAA;AAC1B,MAAA,IAAI;AACF,QAAG,EAAA,CAAA,UAAA,CAAW,IAAA,EAAS,EAAA,CAAA,SAAA,CAAU,IAAI,CAAA;AACrC,QAAA,OAAO,IAAA;AAAA,MACT,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAIA,EAAA,OAAO,GAAA;AACT;;;ACbA,gBAAuB,YACrB,IAAA,EACsD;AACtD,EAAA,MAAM,GAAA,GAAM,KAAK,QAAY;AAC7B,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,IAAc,CAAA,GAAI,IAAA;AACvC,EAAA,MAAM,QAAA,GAAW,KAAK,YAAA,IAAgB,GAAA;AACtC,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,IAAI,KAAA;AAEJ,EAAA,MAAM,GAAA,GAAM,mBAAA,CAAoB,IAAA,CAAK,GAAG,CAAA;AACxC,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,QAAA,KAAa,OAAA,KAAY,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,CAAA;AAE/F,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,EAAK,IAAA,CAAK,IAAA,EAAM;AAAA,IAClC,KAAK,IAAA,CAAK,GAAA;AAAA,IACV,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,KAAK,aAAA,EAAc;AAAA,IACnB,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAAA,IAChC,WAAA,EAAa,IAAA;AAAA,IACb,GAAI,aAAa,EAAE,KAAA,EAAO,MAAM,wBAAA,EAA0B,IAAA,KAAS;AAAC,GACrE,CAAA;AAGD,EAAA,MAAM,QAAiB,EAAC;AACxB,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,MAAM,OAAO,MAAM;AACjB,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAM,CAAA,GAAI,MAAA;AACV,MAAA,MAAA,GAAS,MAAA;AACT,MAAA,CAAA,EAAE;AAAA,IACJ;AAAA,EACF,CAAA;AAGA,EAAA,MAAM,SAAS,MAAM;AACnB,IAAA,IAAI,MAAA,IAAU,KAAA,CAAM,MAAA,GAAS,QAAA,EAAU;AACrC,MAAA,MAAA,GAAS,KAAA;AACT,MAAA,KAAA,CAAM,QAAQ,MAAA,EAAO;AACrB,MAAA,KAAA,CAAM,QAAQ,MAAA,EAAO;AAAA,IACvB;AAAA,EACF,CAAA;AAKA,EAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,IAAA,MAAM,CAAA,GAAI,EAAE,QAAA,EAAS;AACrB,IAAA,IAAI,MAAA,CAAO,MAAA,GAAS,GAAA,EAAK,MAAA,IAAU,CAAA;AACnC,IAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,GAAG,CAAA;AACnC,IAAA,IAAA,EAAK;AAEL,IAAA,IAAI,CAAC,MAAA,IAAU,KAAA,CAAM,MAAA,IAAU,QAAA,EAAU;AACvC,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,KAAA,CAAM,QAAQ,KAAA,EAAM;AACpB,MAAA,KAAA,CAAM,QAAQ,KAAA,EAAM;AAAA,IACtB;AAAA,EACF,CAAC,CAAA;AACD,EAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,IAAA,MAAM,CAAA,GAAI,EAAE,QAAA,EAAS;AACrB,IAAA,IAAI,MAAA,CAAO,MAAA,GAAS,GAAA,EAAK,MAAA,IAAU,CAAA;AACnC,IAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,GAAG,CAAA;AACnC,IAAA,IAAA,EAAK;AACL,IAAA,IAAI,CAAC,MAAA,IAAU,KAAA,CAAM,MAAA,IAAU,QAAA,EAAU;AACvC,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,KAAA,CAAM,QAAQ,KAAA,EAAM;AACpB,MAAA,KAAA,CAAM,QAAQ,KAAA,EAAM;AAAA,IACtB;AAAA,EACF,CAAC,CAAA;AACD,EAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,CAAA,KAAM;AACvB,IAAA,KAAA,GAAQ,CAAA,CAAE,OAAA;AACV,IAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,SAAS,IAAA,EAAM,CAAA,CAAE,SAAS,CAAA;AAC7C,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AACD,EAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,IAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,EAAA,EAAI,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,CAAA;AACvD,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AAED,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,IAAI,WAAA,GAAc,KAAA;AAClB,EAAA,WAAS;AACP,IAAA,OAAO,KAAA,CAAM,WAAW,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,OAAA,CAAc,CAACC,QAAAA,KAAY;AACnC,QAAA,MAAA,GAASA,QAAAA;AAAA,MACX,CAAC,CAAA;AAAA,IACH;AACA,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,EAAM;AAE1B,IAAA,MAAA,EAAO;AACP,IAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAG1B,MAAA,IAAI,CAAC,WAAA,EAAa,QAAA,GAAW,KAAA,CAAM,IAAA,IAAQ,CAAA;AAC3C,MAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,MAAA,WAAA,GAAc,IAAA;AACd,MAAA,QAAA,GAAW,CAAA;AAEX,MAAA;AAAA,IACF;AACA,IAAA,OAAA,IAAW,KAAA,CAAM,IAAA;AACjB,IAAA,IAAI,OAAA,CAAQ,UAAU,OAAA,EAAS;AAC7B,MAAA,MAAM,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,OAAA,EAAQ;AAC9C,MAAA,OAAA,GAAU,EAAA;AAAA,IACZ;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,MAAM,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,OAAA,EAAQ;AAAA,EAChD;AAEA,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,SAAA,EAAW,MAAA,CAAO,MAAA,IAAU,GAAA,IAAO,OAAO,MAAA,IAAU,GAAA;AAAA,IACpD;AAAA,GACF;AACF;AC1IA,eAAsB,qBAAqB,GAAA,EAAsC;AAC/E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,OAAO,kBAAkB,CAAA;AAChD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,eAAA,CAAiB,CAAA;AAClC,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,UAAA,CAAY,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAY,KAAA,CAAA,UAAA,CAAW,KAAK,CAAA,GAAS,KAAA,CAAA,SAAA,CAAU,KAAK,CAAA,GAAS,KAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,UAAA,IAAc,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AACvG;AAEO,SAAS,gBAAA,CAAiB,SAAiB,GAAA,EAAsB;AACtE,EAAA,MAAM,IAAA,GAAY,KAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AACzC,EAAA,MAAM,MAAA,GAAc,cAAQ,OAAO,CAAA;AACnC,EAAA,MAAM,GAAA,GAAW,KAAA,CAAA,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AACtC,EAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,IAAU,KAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AAChD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,OAAO,CAAA,2BAAA,EAA8B,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,EACvE;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAO,gBAAA,CAAiB,WAAA,CAAY,KAAA,EAAO,GAAG,GAAG,GAAG,CAAA;AACtD;;;ACnBO,IAAM,SAAA,GAA2C;AAAA,EACtD,IAAA,EAAM,OAAA;AAAA,EACN,QAAA,EAAU,oBAAA;AAAA,EACV,WAAA,EACE,wHAAA;AAAA,EACF,SAAA,EACE,yQAAA;AAAA,EAKF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,KAAA;AAAA,EACV,SAAA,EAAW,GAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,kCAAA,EAAmC;AAAA,MACvE,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,KAAA,EAAO,UAAA,EAAY,QAAQ,UAAU,CAAA;AAAA,QAC5C,WAAA,EAAa;AAAA,OACf;AAAA,MACA,GAAA,EAAK,EAAE,IAAA,EAAM,SAAA,EAAW,aAAa,iDAAA,EAAkD;AAAA,MACvF,QAAA,EAAU,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,gDAAA;AAAiD;AAC5F,GACF;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,KAAA;AACJ,IAAA,MAAM,gBAAgB,SAAA,CAAU,aAAA;AAChC,IAAA,IAAI,CAAC,aAAA,EAAe,MAAM,IAAI,MAAM,yCAAyC,CAAA;AAC7E,IAAA,WAAA,MAAiB,EAAA,IAAM,aAAA,CAAc,KAAA,EAAO,GAAA,EAAK,IAAI,CAAA,EAAG;AACtD,MAAA,IAAI,EAAA,CAAG,IAAA,KAAS,OAAA,EAAS,KAAA,GAAQ,EAAA,CAAG,MAAA;AAAA,IACtC;AACA,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,yCAAyC,CAAA;AACrE,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAAA,EACA,OAAO,aAAA,CAAc,KAAA,EAAO,GAAA,EAAK,IAAA,EAAoD;AACnF,IAAA,MAAM,GAAA,GAAM,MAAM,GAAA,GAAM,WAAA,CAAY,MAAM,GAAA,EAAK,GAAG,IAAI,GAAA,CAAI,GAAA;AAC1D,IAAA,MAAM,OAAA,GAAU,MAAM,oBAAA,CAAqB,GAAG,CAAA;AAC9C,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA,cAAA,EAAiB,OAAO,CAAA,MAAA,CAAA,EAAK,IAAA,EAAM,EAAE,OAAA,EAAQ,EAAE;AAE1E,IAAA,MAAM,IAAA,GAAO,CAAC,OAAA,EAAS,QAAQ,CAAA;AAC/B,IAAA,IAAI,KAAA,CAAM,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA;AAChC,IAAA,IAAI,MAAM,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,GAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA,GAAI,KAAA,CAAM,QAAA,GAAW,KAAA,CAAM,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AACtF,MAAA,IAAA,CAAK,IAAA,CAAK,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAc,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAAA,IAChD;AAEA,IAAA,MAAM,MAAA,GAAS,OAAO,WAAA,CAAY;AAAA,MAChC,GAAA,EAAK,OAAA;AAAA,MACL,IAAA;AAAA,MACA,GAAA;AAAA,MACA,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACX,CAAA;AAED,IAAA,MAAM,EAAE,MAAM,OAAA,EAAS,MAAA,EAAQ,iBAAiB,MAAA,CAAO,MAAA,EAAQ,MAAA,CAAO,QAAQ,CAAA,EAAE;AAAA,EAClF;AACF;AAEA,SAAS,gBAAA,CAAiB,MAAc,QAAA,EAA+B;AACrE,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,iBAAiB,EAAC;AAAA,MAClB,KAAA,EAAO,CAAA;AAAA,MACP,OAAA,EAAS,QAAA,KAAa,CAAA,GAAI,0BAAA,GAA6B,cAAA;AAAA,MACvD,MAAA,EAAQ,EAAA;AAAA,MACR,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC5B,IAAA,MAAM,aAAmC,EAAC;AAC1C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,UAAA,IAAc,EAAC;AAChC,IAAA,KAAA,MAAW,EAAA,IAAM,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AACjC,MAAA,MAAM,GAAA,GAAM,IAAI,EAAE,CAAA;AAClB,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,QAAA,EAAU,IAAI,QAAA,IAAY,SAAA;AAAA,QAC1B,OAAA,EAAS,IAAI,WAAA,IAAe,EAAA;AAAA,QAC5B,KAAA,EAAO,IAAI,KAAA,IAAS,uBAAA;AAAA,QACpB,GAAA,EAAK,IAAI,GAAA,IAAO;AAAA,OACjB,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAA;AACzB,IAAA,MAAM,OAAA,GACJ,KAAA,KAAU,CAAA,GACN,0BAAA,GACA,CAAA,MAAA,EAAS,KAAK,CAAA,kBAAA,EAAqB,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,UAAU,CAAA,CAAE,MAAM,CAAA,WAAA,EAAc,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,KAAa,MAAM,CAAA,CAAE,MAAM,CAAA,KAAA,CAAA;AAEvK,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,eAAA,EAAiB,UAAA;AAAA,MACjB,KAAA;AAAA,MACA,OAAA;AAAA,MACA,MAAA,EAAQ,IAAA;AAAA,MACR,SAAA,EAAW,KAAK,MAAA,IAAU;AAAA,KAC5B;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,iBAAiB,EAAC;AAAA,MAClB,KAAA,EAAO,CAAA;AAAA,MACP,OAAA,EAAS,8BAAA;AAAA,MACT,MAAA,EAAQ,IAAA;AAAA,MACR,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AACF","file":"audit.js","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\n/**\n * On Windows, Node.js `spawn()` without a shell does NOT resolve .cmd/.bat\n * extensions through PATHEXT — it only auto-resolves .exe. Most Node.js CLI\n * tools (npx, pnpm, biome, tsc, vitest, etc.) ship as .cmd wrappers on\n * Windows. This function resolves the command name to its full path so spawn\n * can find it without relying on shell-mode argument concatenation.\n *\n * On non-Windows, returns the command unchanged.\n */\nexport function resolveWin32Command(cmd: string): string {\n  if (process.platform !== 'win32') return cmd;\n\n  // Already has a path or extension — use as-is\n  if (cmd.includes('/') || cmd.includes('\\\\') || path.extname(cmd)) {\n    return cmd;\n  }\n\n  const pathext = (process.env['PATHEXT'] ?? '.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC')\n    .toLowerCase()\n    .split(';');\n\n  const pathDirs = (process.env['PATH'] ?? '').split(path.delimiter);\n\n  for (const dir of pathDirs) {\n    const base = path.join(dir, cmd);\n    // Check extensions in PATHEXT order. .EXE should win first because\n    // it's typically listed first, and .exe doesn't need shell: true.\n    for (const ext of pathext) {\n      const full = `${base}${ext}`;\n      try {\n        fs.accessSync(full, fs.constants.X_OK);\n        return full;\n      } catch {\n        // Not found with this extension — try next\n      }\n    }\n  }\n\n  // Not found — return original; let spawn report ENOENT with the\n  // expected error message so tools can surface it properly.\n  return cmd;\n}\n","import { spawn } from 'node:child_process';\nimport { buildChildEnv } from '@wrongstack/core';\nimport type { ToolProgressEvent } from '@wrongstack/core';\nimport { resolveWin32Command } from './_win32-resolve.js';\nexport interface SpawnStreamResult {\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  truncated: boolean;\n  error?: string | undefined;\n}\n\nexport interface SpawnStreamOptions {\n  cmd: string;\n  args: string[];\n  cwd: string;\n  signal: AbortSignal;\n  maxBytes?: number | undefined;\n  /** Bytes of new stdout/stderr to accumulate before yielding a `partial_output` event. */\n  flushBytes?: number | undefined;\n  /** Maximum chunks to buffer before applying backpressure to the child. Default 500. */\n  maxQueueSize?: number | undefined;\n}\n\n/**\n * Spawn a child process and yield `partial_output` progress events as\n * stdout/stderr arrive (batched by byte threshold), then return the full\n * buffered result. Shared between install/lint/format/typecheck/test/audit\n * so the TUI live tail sees consistent progress regardless of which tool\n * is running.\n */\nexport async function* spawnStream(\n  opts: SpawnStreamOptions,\n): AsyncGenerator<ToolProgressEvent, SpawnStreamResult> {\n  const max = opts.maxBytes ?? 200_000;\n  const flushAt = opts.flushBytes ?? 4 * 1024;\n  const maxQueue = opts.maxQueueSize ?? 500;\n  let stdout = '';\n  let stderr = '';\n  let pending = '';\n  let error: string | undefined;\n\n  const cmd = resolveWin32Command(opts.cmd);\n  const needsShell = process.platform === 'win32' && (cmd.endsWith('.cmd') || cmd.endsWith('.bat'));\n\n  const child = spawn(cmd, opts.args, {\n    cwd: opts.cwd,\n    signal: opts.signal,\n    env: buildChildEnv(),\n    stdio: ['ignore', 'pipe', 'pipe'],\n    windowsHide: true,\n    ...(needsShell ? { shell: true, windowsVerbatimArguments: true } : {}),\n  });\n\n  type Chunk = { kind: 'out' | 'err' | 'close' | 'error'; data: string; code?: number | undefined };\n  const queue: Chunk[] = [];\n  let waiter: (() => void) | undefined;\n  let paused = false;\n  const wake = () => {\n    if (waiter) {\n      const w = waiter;\n      waiter = undefined;\n      w();\n    }\n  };\n\n  // Resume the stream when there's room in the queue\n  const resume = () => {\n    if (paused && queue.length < maxQueue) {\n      paused = false;\n      child.stdout?.resume();\n      child.stderr?.resume();\n    }\n  };\n\n  // Note: chunks may still arrive briefly after pause() (already in flight) —\n  // they are accumulated and queued rather than dropped, so the queue can\n  // overshoot maxQueue by a few entries but no output is silently lost.\n  child.stdout?.on('data', (c) => {\n    const s = c.toString();\n    if (stdout.length < max) stdout += s;\n    queue.push({ kind: 'out', data: s });\n    wake();\n    // Apply backpressure if queue is growing faster than we consume\n    if (!paused && queue.length >= maxQueue) {\n      paused = true;\n      child.stdout?.pause();\n      child.stderr?.pause();\n    }\n  });\n  child.stderr?.on('data', (c) => {\n    const s = c.toString();\n    if (stderr.length < max) stderr += s;\n    queue.push({ kind: 'err', data: s });\n    wake();\n    if (!paused && queue.length >= maxQueue) {\n      paused = true;\n      child.stdout?.pause();\n      child.stderr?.pause();\n    }\n  });\n  child.on('error', (e) => {\n    error = e.message;\n    queue.push({ kind: 'error', data: e.message });\n    wake();\n  });\n  child.on('close', (code) => {\n    queue.push({ kind: 'close', data: '', code: code ?? 0 });\n    wake();\n  });\n\n  let exitCode = 0;\n  let spawnFailed = false;\n  for (;;) {\n    while (queue.length === 0) {\n      await new Promise<void>((resolve) => {\n        waiter = resolve;\n      });\n    }\n    const chunk = queue.shift()!;\n    // Resume reading after consuming a chunk\n    resume();\n    if (chunk.kind === 'close') {\n      // If we already saw a spawn error (ENOENT etc.), keep exitCode=1\n      // rather than the negative platform code Node fabricates.\n      if (!spawnFailed) exitCode = chunk.code ?? 0;\n      break;\n    }\n    if (chunk.kind === 'error') {\n      spawnFailed = true;\n      exitCode = 1;\n      // close usually follows\n      continue;\n    }\n    pending += chunk.data;\n    if (pending.length >= flushAt) {\n      yield { type: 'partial_output', text: pending };\n      pending = '';\n    }\n  }\n  if (pending.length > 0) {\n    yield { type: 'partial_output', text: pending };\n  }\n\n  return {\n    stdout,\n    stderr,\n    exitCode,\n    truncated: stdout.length >= max || stderr.length >= max,\n    error,\n  };\n}\n","import * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core';\nimport type { Context } from '@wrongstack/core';\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm → yarn → npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const root = path.resolve(ctx.projectRoot);\n  const target = path.resolve(absPath);\n  const rel = path.relative(root, target);\n  if (rel.startsWith('..') || path.isAbsolute(rel)) {\n    throw new Error(`Path \"${absPath}\" is outside project root \"${root}\"`);\n  }\n  return target;\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root→out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink — macOS `/var`→`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  const realRoot = await fsp.realpath(ctx.projectRoot).catch(() => path.resolve(ctx.projectRoot));\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    const rel = path.relative(realRoot, real);\n    if (rel.startsWith('..') || path.isAbsolute(rel)) {\n      throw new Error(\n        `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoot}\"`,\n      );\n    }\n    return;\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// ─── Command-output normalization (token-saving) ────────────────────────────\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) — never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only — it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `… ⟨repeated ${run}×⟩`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends — the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n…[truncated ${total - kept} bytes]…\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI → collapse\n * carriage-return progress → trim trailing whitespace → collapse identical\n * consecutive lines → squeeze blank-line runs → head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number | undefined } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines → 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n","import type { Tool, ToolStreamEvent } from '@wrongstack/core';\nimport { spawnStream } from './_spawn-stream.js';\nimport { detectPackageManager, safeResolve } from './_util.js';\n\ninterface AuditInput {\n  cwd?: string | undefined;\n  level?: 'low' | 'moderate' | 'high' | 'critical' | undefined;\n  fix?: boolean | undefined;\n  packages?: string | string[] | undefined;\n}\n\ninterface AuditVulnerability {\n  severity: string;\n  package: string;\n  title: string;\n  url: string;\n}\n\ninterface AuditOutput {\n  exit_code: number;\n  vulnerabilities: AuditVulnerability[];\n  total: number;\n  summary: string;\n  output: string;\n  truncated: boolean;\n}\n\nexport const auditTool: Tool<AuditInput, AuditOutput> = {\n  name: 'audit',\n  category: 'Package Management',\n  description:\n    'Run a security audit against project dependencies (using pnpm/npm audit). Reports known vulnerabilities with severity.',\n  usageHint:\n    'CRITICAL SECURITY TOOL:\\n\\n' +\n    '- Run regularly and especially before any release.\\n' +\n    '- Use `level` to focus on high/critical issues.\\n' +\n    '- `fix` can attempt automatic remediation for some vulnerabilities.\\n' +\n    'This is one of the most important tools for supply chain security.',\n  permission: 'confirm',\n  mutating: false,\n  timeoutMs: 60_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      cwd: { type: 'string', description: 'Working directory (default: cwd)' },\n      level: {\n        type: 'string',\n        enum: ['low', 'moderate', 'high', 'critical'],\n        description: 'Minimum severity level to report',\n      },\n      fix: { type: 'boolean', description: 'Attempt to fix vulnerabilities (default: false)' },\n      packages: { type: 'string', description: 'Specific package(s) to audit (comma-separated)' },\n    },\n  },\n  async execute(input, ctx, opts) {\n    let final: AuditOutput | undefined;\n    const executeStream = auditTool.executeStream;\n    if (!executeStream) throw new Error('auditTool: stream execution unavailable');\n    for await (const ev of executeStream(input, ctx, opts)) {\n      if (ev.type === 'final') final = ev.output;\n    }\n    if (!final) throw new Error('audit: stream ended without final event');\n    return final;\n  },\n  async *executeStream(input, ctx, opts): AsyncGenerator<ToolStreamEvent<AuditOutput>> {\n    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;\n    const manager = await detectPackageManager(cwd);\n    yield { type: 'log', text: `Auditing with ${manager}…`, data: { manager } };\n\n    const args = ['audit', '--json'];\n    if (input.fix) args.push('--fix');\n    if (input.packages) {\n      const pkgs = Array.isArray(input.packages) ? input.packages : input.packages.split(',');\n      args.push(...pkgs.map((p: string) => p.trim()));\n    }\n\n    const result = yield* spawnStream({\n      cmd: manager,\n      args,\n      cwd,\n      signal: opts.signal,\n      maxBytes: 100_000,\n    });\n\n    yield { type: 'final', output: parseAuditOutput(result.stdout, result.exitCode) };\n  },\n};\n\nfunction parseAuditOutput(json: string, exitCode: number): AuditOutput {\n  if (!json) {\n    return {\n      exit_code: exitCode,\n      vulnerabilities: [],\n      total: 0,\n      summary: exitCode === 0 ? 'No vulnerabilities found' : 'Audit failed',\n      output: '',\n      truncated: false,\n    };\n  }\n\n  try {\n    const data = JSON.parse(json);\n    const advisories: AuditVulnerability[] = [];\n    const ads = data.advisories ?? {};\n    for (const id of Object.keys(ads)) {\n      const adv = ads[id];\n      advisories.push({\n        severity: adv.severity ?? 'unknown',\n        package: adv.module_name ?? id,\n        title: adv.title ?? 'Unknown vulnerability',\n        url: adv.url ?? '',\n      });\n    }\n\n    const total = advisories.length;\n    const summary =\n      total === 0\n        ? 'No vulnerabilities found'\n        : `Found ${total} vulnerabilities: ${advisories.filter((a) => a.severity === 'critical').length} critical, ${advisories.filter((a) => a.severity === 'high').length} high`;\n\n    return {\n      exit_code: exitCode,\n      vulnerabilities: advisories,\n      total,\n      summary,\n      output: json,\n      truncated: json.length >= 100_000,\n    };\n  } catch {\n    return {\n      exit_code: exitCode,\n      vulnerabilities: [],\n      total: 0,\n      summary: 'Could not parse audit output',\n      output: json,\n      truncated: false,\n    };\n  }\n}\n"]}

package/dist/background-indexer-DwJsyAB0.d.ts

@@ -0,0 +1,373 @@
+import { Tool } from '@wrongstack/core';
+
+declare const codebaseIndexTool: Tool<CodebaseIndexInput, CodebaseIndexOutput>;
+interface CodebaseIndexInput {
+    force?: boolean | undefined;
+    langs?: string[] | undefined;
+}
+interface CodebaseIndexOutput {
+    filesIndexed: number;
+    symbolsIndexed: number;
+    langStats: Record<string, number>;
+    durationMs: number;
+    errors: string[];
+    /** Advisory note when the indexer was skipped (e.g. another index in progress). */
+    note?: string | undefined;
+}
+
+/** Language a symbol belongs to. */
+type SymbolLang = 'ts' | 'js' | 'tsx' | 'jsx' | 'go' | 'py' | 'rs' | 'json' | 'yaml';
+/** What kind of symbol this is. */
+type SymbolKind = 'class' | 'interface' | 'enum' | 'type' | 'function' | 'method' | 'var' | 'const' | 'let' | 'property' | 'parameter' | 'namespace' | 'object' | 'literal' | 'schema' | 'struct' | 'trait' | 'impl' | 'static' | 'mod';
+/** A single indexed code symbol. */
+interface Symbol {
+    id: number;
+    lang: SymbolLang;
+    kind: SymbolKind;
+    name: string;
+    file: string;
+    line: number;
+    col: number;
+    signature: string;
+    docComment: string;
+    scope: string;
+    text: string;
+}
+/** Extracted symbols and cross-references for one file. */
+interface FileSymbols {
+    file: string;
+    lang: SymbolLang;
+    symbols: Symbol[];
+    refs?: Ref[] | undefined;
+    mtimeMs: number;
+}
+/** Source file metadata tracked for incremental indexing. */
+interface FileMeta {
+    file: string;
+    lang: SymbolLang;
+    mtimeMs: number;
+    symbolCount: number;
+    lastIndexed: number;
+}
+/** Statistics about the index. */
+interface IndexStats {
+    totalSymbols: number;
+    totalFiles: number;
+    byLang: Record<SymbolLang, number>;
+    byKind: Record<SymbolKind, number>;
+    indexPath: string;
+    lastIndexed: number | null;
+    sizeBytes: number;
+    version: number;
+}
+/** Result of a search query. */
+interface SearchResult {
+    id: number;
+    name: string;
+    kind: SymbolKind;
+    lang: SymbolLang;
+    file: string;
+    line: number;
+    col: number;
+    signature: string;
+    docComment: string;
+    score: number;
+    snippet: string;
+    /** Original LSP SymbolKind number if the result was filtered by an LSP kind. */
+    lspKind?: number | undefined;
+}
+/** Result of a full reindex. */
+interface IndexResult {
+    filesIndexed: number;
+    symbolsIndexed: number;
+    langStats: Record<SymbolLang, number>;
+    durationMs: number;
+    errors: string[];
+}
+/** What kind of reference this is. */
+type CallType = 'call' | 'type_ref' | 'inherit' | 'implement' | 'import';
+/** A cross-reference between two symbols (who references whom). */
+interface Ref {
+    id?: number | undefined;
+    fromId: number;
+    toName: string;
+    toId?: number | undefined;
+    callType: CallType;
+    line: number;
+}
+declare const SCHEMA_VERSION = 2;
+
+/**
+ * `codebase-search` tool — search the symbol index with BM25 ranking.
+ *
+ * Usage: codebase-search({
+ *   query: string,        // search terms
+ *   kind?: string,       // class|function|interface|method|const|...
+ *   lang?: string,       // ts|tsx|js|jsx|go|py|rs
+ *   file?: string,       // filter to a specific file path (substring match)
+ *   limit?: number,      // max results (default 20, max 100)
+ * })
+ *
+ * Returns: [{ name, kind, lang, file, line, signature, snippet, score }, ...]
+ *
+ * The query executes in the index worker via FTS5 (`MATCH` + native `bm25()`)
+ * — the main thread never opens SQLite, so a contended or wedged index can
+ * slow this tool down but can never freeze the terminal.
+ */
+
+declare const codebaseSearchTool: Tool<CodebaseSearchInput, CodebaseSearchOutput>;
+interface CodebaseSearchInput {
+    query: string;
+    kind?: string | undefined;
+    lang?: string | undefined;
+    file?: string | undefined;
+    limit?: number | undefined;
+    lspKind?: number | undefined;
+}
+interface CodebaseSearchOutput {
+    results: SearchResult[];
+    total: number;
+    query: string;
+    /** Non-empty when the index blocked the search (not ready, indexing, failed). */
+    indexStatus?: string | undefined;
+}
+
+/**
+ * `codebase-stats` tool — report index health and statistics.
+ *
+ * Usage: codebase-stats({})
+ *
+ * Returns: { totalSymbols, totalFiles, byLang, byKind, lastIndexed, sizeBytes, version }
+ */
+
+declare const codebaseStatsTool: Tool<Record<string, never>, CodebaseStatsOutput>;
+interface CodebaseStatsOutput {
+    totalSymbols: number;
+    totalFiles: number;
+    byLang: Record<string, number>;
+    byKind: Record<string, number>;
+    lastIndexed: number | null;
+    sizeBytes: number;
+    indexPath: string;
+    version: number;
+    /** Non-empty when the index is not ready or is still building. */
+    indexStatus?: string | undefined;
+}
+
+/**
+ * Circuit breaker for the codebase indexer.
+ *
+ * The indexer can wedge: a hung filesystem, a parser pathology, or another
+ * wstack process holding the SQLite write lock (several surfaces — TUI, WebUI,
+ * parallel terminals — share one per-project `index.db`). Without protection,
+ * every queued reindex piles up behind the process-wide mutex, `isIndexing()`
+ * stays true forever, and anything that awaits an index run (the startup scan,
+ * `/codebase-reindex`) locks its terminal.
+ *
+ * Standard three-state breaker:
+ *
+ *   closed    — normal operation; consecutive failures are counted.
+ *   open      — after `failureThreshold` consecutive failures, every request
+ *               is rejected fast ({@link CircuitOpenError}) for `cooldownMs`.
+ *   half-open — after the cooldown exactly one probe run is admitted;
+ *               success closes the circuit, failure re-opens it.
+ *
+ * Watchdog timeouts ({@link IndexTimeoutError}) count as failures;
+ * caller-initiated aborts (session teardown) do not — the background indexer
+ * makes that distinction before recording.
+ *
+ * Lock conflicts ({@link LockError}) do NOT count as failures — they are expected
+ * transient conditions when multiple wstack surfaces share the same `index.db`.
+ * The index store retries automatically; a LockError only reaches the circuit
+ * breaker when all retries are exhausted.
+ */
+type CircuitState = 'closed' | 'open' | 'half-open';
+interface CircuitSnapshot {
+    state: CircuitState;
+    consecutiveFailures: number;
+    lastFailure: string | null;
+    /** ms until an open circuit admits a half-open probe (0 unless open). */
+    cooldownRemainingMs: number;
+}
+/** Thrown when a run is rejected because the circuit is open. */
+declare class CircuitOpenError extends Error {
+    readonly name = "CircuitOpenError";
+}
+/** Thrown by the background indexer's watchdog when a run exceeds its timeout. */
+declare class IndexTimeoutError extends Error {
+    readonly name = "IndexTimeoutError";
+}
+interface CircuitBreakerOptions {
+    /** Consecutive failures before the circuit opens. Default: 3. */
+    failureThreshold?: number | undefined;
+    /** How long an open circuit rejects requests before allowing a probe. Default: 60s. */
+    cooldownMs?: number | undefined;
+    /** Injectable clock for tests. Default: Date.now. */
+    now?: (() => number) | undefined;
+}
+declare class IndexCircuitBreaker {
+    private readonly failureThreshold;
+    private readonly cooldownMs;
+    private readonly now;
+    private state;
+    private consecutiveFailures;
+    private openedAt;
+    private lastFailure;
+    private probeInFlight;
+    constructor(opts?: CircuitBreakerOptions);
+    /**
+     * True when a run may proceed. An open circuit transitions to half-open once
+     * the cooldown has elapsed, admitting exactly one probe; further requests
+     * are rejected until that probe settles via recordSuccess/recordFailure.
+     */
+    allowRequest(): boolean;
+    recordSuccess(): void;
+    recordFailure(err: unknown): void;
+    /** Force-close the circuit (manual recovery: `/codebase-reindex`). */
+    reset(): void;
+    snapshot(): CircuitSnapshot;
+}
+/**
+ * Process-wide breaker shared by every index path (startup scan, per-edit
+ * incremental, external watcher, the `codebase-index` tool). Module-level for
+ * the same reason the mutex is: there is one `index.db` per project and one
+ * indexing pipeline per process.
+ */
+declare const indexCircuitBreaker: IndexCircuitBreaker;
+/** Reset the shared breaker — used by `/codebase-reindex` and tests. */
+declare function resetIndexCircuitBreaker(): void;
+
+/**
+ * Message protocol between the index host (main thread) and the index worker.
+ *
+ * Plain structured-cloneable shapes only — no class instances, no functions.
+ * Errors cross the boundary as strings and are re-wrapped by the host.
+ */
+
+interface SearchOpArgs {
+    projectRoot: string;
+    indexDir?: string | undefined;
+    query: string;
+    kind?: string | undefined;
+    lang?: string | undefined;
+    file?: string | undefined;
+    lspKind?: number | undefined;
+    limit: number;
+}
+interface StatsOpArgs {
+    projectRoot: string;
+    indexDir?: string | undefined;
+}
+interface SearchOpResult {
+    results: SearchResult[];
+    total: number;
+}
+
+/**
+ * Index host — the main-thread coordinator for all codebase-index operations.
+ *
+ * Production mode runs every operation (full scans, per-file reindexes,
+ * searches, stats) in a dedicated worker thread (`worker.ts`), so the
+ * synchronous `node:sqlite` calls and the TypeScript parser can never block
+ * the main event loop — the failure mode that used to freeze terminals is
+ * structurally impossible. When the built worker file is not present (tests
+ * run from source, exotic runtimes) or `WRONGSTACK_INDEX_INLINE=1` is set,
+ * operations fall back to running inline through the same service layer.
+ *
+ * Concerns owned here, in front of either execution mode:
+ *
+ * 1. **Serialization** — every write run (startup scan, per-edit incremental,
+ *    external file-watch, manual reindex) goes through one process-wide
+ *    promise-chain mutex so two runs never race the same `index.db` writer.
+ * 2. **Debounce** — rapid successive edits to the same file coalesce into a
+ *    single reindex, keyed per `(indexDir, file)`.
+ * 3. **Watchdog** — every operation is raced against a timeout. In worker
+ *    mode a timeout hard-terminates the worker (it respawns lazily on the
+ *    next request); inline it aborts the run's signal. Either way the mutex
+ *    chain always advances and the promise always settles.
+ * 4. **Circuit breaker** — repeated failures/timeouts pause indexing instead
+ *    of queuing more work behind a wedged pipeline. See circuit-breaker.ts.
+ * 5. **State tracking** — ready/indexing/progress flags + change listeners
+ *    for the TUI status chip and the search/stats tools' gating.
+ */
+
+/** True once the first full-project index has completed (success or failure). */
+declare function isIndexReady(): boolean;
+/** True while an index build is actively running. */
+declare function isIndexing(): boolean;
+/** Current indexing progress: { currentFile, totalFiles, ready, indexing, circuit }. */
+declare function getIndexState(): {
+    ready: boolean;
+    indexing: boolean;
+    currentFile: number;
+    totalFiles: number;
+    lastError: string | null;
+    /** Circuit-breaker state — `open` means indexing is paused after repeated failures. */
+    circuit: CircuitSnapshot;
+};
+/**
+ * Optional callback fired on every lifecycle transition (started, progress,
+ * completed, failed). Plug into the event bus or a TUI dispatcher to surface
+ * the indexing state in real time.
+ */
+type IndexStateListener = (state: ReturnType<typeof getIndexState>) => void;
+declare function onIndexStateChange(listener: IndexStateListener): () => void;
+/**
+ * Tear down the index host (worker + pending debounces). Call on process
+ * shutdown; safe to call when nothing is running.
+ */
+declare function shutdownCodebaseIndexHost(): void;
+/** True when the file's extension maps to a language the indexer can parse. */
+declare function isIndexableFile(filePath: string): boolean;
+/**
+ * Run a full-project scan and await it. Used at session start and by the manual
+ * `/codebase-reindex` command. Incremental by default (unchanged files skipped
+ * via mtime, so repeat runs are cheap); pass `force` to clear and rebuild.
+ *
+ * Sets the global `_ready` flag on completion so downstream tools know the
+ * index is usable.
+ */
+declare function runStartupIndex(opts: {
+    projectRoot: string;
+    indexDir?: string | undefined;
+    force?: boolean | undefined;
+    langs?: string[] | undefined;
+    signal?: AbortSignal | undefined;
+    /** Watchdog timeout for the whole run. Default: 120s. */
+    timeoutMs?: number | undefined;
+}): Promise<IndexResult>;
+/**
+ * Debounced, fire-and-forget incremental reindex of specific files. Used by the
+ * per-edit toolCall middleware and the external file watcher. Non-indexable
+ * paths are dropped. Errors are reported via the optional `onError` callback and
+ * never thrown to the caller (background work must not crash a turn).
+ */
+declare function enqueueReindex(opts: {
+    projectRoot: string;
+    files: string[];
+    indexDir?: string | undefined;
+    debounceMs?: number | undefined;
+    /** Watchdog timeout per file. Default: 30s. */
+    timeoutMs?: number | undefined;
+    onError?: ((err: unknown) => void) | undefined;
+}): void;
+/** Cancel all pending debounced reindexes. For teardown / tests. */
+declare function cancelPendingReindexes(): void;
+/**
+ * Ranked symbol search against the index. The query runs in the index worker
+ * (or inline in fallback mode) — the main thread never opens SQLite. Reads
+ * don't take the write mutex (WAL readers don't block the writer) and don't
+ * feed the circuit breaker; a wedged read still trips the watchdog, which
+ * recycles the worker.
+ */
+declare function searchCodebaseIndex(args: SearchOpArgs, opts?: {
+    timeoutMs?: number | undefined;
+    signal?: AbortSignal | undefined;
+}): Promise<SearchOpResult>;
+/** Index health/statistics, fetched off the main thread like searches. */
+declare function codebaseIndexStats(args: StatsOpArgs, opts?: {
+    timeoutMs?: number | undefined;
+    signal?: AbortSignal | undefined;
+}): Promise<IndexStats>;
+
+export { CircuitOpenError as C, type FileMeta as F, IndexCircuitBreaker as I, type Ref as R, type Symbol as S, type CircuitSnapshot as a, type CircuitState as b, IndexTimeoutError as c, cancelPendingReindexes as d, codebaseIndexStats as e, codebaseIndexTool as f, codebaseSearchTool as g, codebaseStatsTool as h, enqueueReindex as i, getIndexState as j, indexCircuitBreaker as k, isIndexReady as l, isIndexableFile as m, isIndexing as n, onIndexStateChange as o, runStartupIndex as p, shutdownCodebaseIndexHost as q, resetIndexCircuitBreaker as r, searchCodebaseIndex as s, type IndexResult as t, type SymbolKind as u, type SymbolLang as v, type SearchResult as w, type IndexStats as x, type FileSymbols as y, SCHEMA_VERSION as z };