@wrongstack/tools 0.277.2 → 0.280.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import * as fs7 from 'node:fs/promises';
 import * as Core from '@wrongstack/core';
-import { ToolValidationError, FsError, toErrorMessage, atomicWrite, unifiedDiff, detectNewlineStyle, normalizeToLf, toStyle, compileGlob, expectDefined, buildChildEnv, ToolError, FetchError, isPrivateIPv4, isPrivateIPv6, loadPlan, setPlanItemStatus, savePlan, loadTasks, saveTasks, mutatePlan, clearPlan, getPlanTemplate, addPlanItem, deriveTodosFromPlanItem, removePlanItem, mutateTasks, formatTaskList, formatPlan, assessCommitSafety, deepMerge, recordPackageAction, detectPackageEcosystem, getDesignKitLoader, isDesignStack, loadActiveKit, applyTokenOverrides, setActiveKit, recordKitChoice, recordOverrides, setDesignOverrides, materializeTokens, runDesignVerify, computeTaskItemProgress, wstackGlobalRoot, resolveWstackPaths, truncate } from '@wrongstack/core';
+import { SKILL_LIMITS, ToolValidationError, FsError, toErrorMessage, atomicWrite, unifiedDiff, detectNewlineStyle, normalizeToLf, toStyle, compileGlob, expectDefined, buildChildEnv, ToolError, FetchError, isPrivateIPv4, isPrivateIPv6, loadPlan, setPlanItemStatus, savePlan, loadTasks, saveTasks, mutatePlan, clearPlan, getPlanTemplate, addPlanItem, deriveTodosFromPlanItem, removePlanItem, mutateTasks, formatTaskList, formatPlan, assessCommitSafety, deepMerge, recordPackageAction, detectPackageEcosystem, getDesignKitLoader, isDesignStack, loadActiveKit, applyTokenOverrides, setActiveKit, recordKitChoice, recordOverrides, setDesignOverrides, materializeTokens, runDesignVerify, stripFrontmatter, computeTaskItemProgress, wstackGlobalRoot, resolveWstackPaths, truncate } from '@wrongstack/core';
 import * as path from 'node:path';
 import { resolve, sep, dirname, join } from 'node:path';
 import { spawn, execFileSync } from 'node:child_process';
@@ -21,14 +21,14 @@ import * as ts from 'typescript';
 
 // src/read.ts
 async function detectPackageManager(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
+  const { stat: stat12 } = await import('node:fs/promises');
   try {
-    await stat11(`${cwd}/pnpm-lock.yaml`);
+    await stat12(`${cwd}/pnpm-lock.yaml`);
     return "pnpm";
   } catch {
   }
   try {
-    await stat11(`${cwd}/yarn.lock`);
+    await stat12(`${cwd}/yarn.lock`);
     return "yarn";
   } catch {
   }
@@ -214,9 +214,9 @@ var readTool = {
       });
     }
     const absPath = await safeResolveReal(input.path, ctx);
-    let stat11;
+    let stat12;
     try {
-      stat11 = await fs7.stat(absPath);
+      stat12 = await fs7.stat(absPath);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
@@ -235,7 +235,7 @@ var readTool = {
         cause: err
       });
     }
-    if (!stat11.isFile()) {
+    if (!stat12.isFile()) {
       throw new FsError({
         message: `read: "${input.path}" is not a regular file`,
         code: "FS_READ_FAILED",
@@ -243,22 +243,22 @@ var readTool = {
         context: { reason: "not-a-regular-file" }
       });
     }
-    if (stat11.size > MAX_BYTES) {
+    if (stat12.size > MAX_BYTES) {
       throw new FsError({
-        message: `read: file too large (${stat11.size} bytes, limit ${MAX_BYTES})`,
+        message: `read: file too large (${stat12.size} bytes, limit ${MAX_BYTES})`,
         code: "FS_READ_FAILED",
         path: absPath,
-        context: { size: stat11.size, limit: MAX_BYTES, reason: "too-large" }
+        context: { size: stat12.size, limit: MAX_BYTES, reason: "too-large" }
       });
     }
     const offset = Math.max(1, input.offset ?? 1);
     const limit = Math.max(0, Math.min(input.limit ?? 2e3, 5e3));
     const prior = getReadRangeRecord(ctx, absPath);
     const requestedEnd = prior ? Math.min(offset + limit - 1, prior.totalLines) : offset + limit - 1;
-    if (input.mode !== "summary" && limit > 0 && prior && coversRange(prior, stat11.mtimeMs, offset, requestedEnd)) {
-      ctx.recordRead(absPath, stat11.mtimeMs);
+    if (input.mode !== "summary" && limit > 0 && prior && coversRange(prior, stat12.mtimeMs, offset, requestedEnd)) {
+      ctx.recordRead(absPath, stat12.mtimeMs);
       return {
-        text: `[unchanged since previous read: "${input.path}" mtime=${Math.round(stat11.mtimeMs)}; requested lines ${offset}-${requestedEnd} were already shown. Use offset/limit for a new range if needed.]`,
+        text: `[unchanged since previous read: "${input.path}" mtime=${Math.round(stat12.mtimeMs)}; requested lines ${offset}-${requestedEnd} were already shown. Use offset/limit for a new range if needed.]`,
         total_lines: prior.totalLines,
         encoding: "utf8",
         truncated: requestedEnd < prior.totalLines,
@@ -274,10 +274,10 @@ var readTool = {
     const allLines = text.split(/\r\n|\r|\n/);
     const total = allLines.length;
     if (input.mode === "summary") {
-      ctx.recordRead(absPath, stat11.mtimeMs);
-      rememberReadRange(ctx, absPath, stat11.mtimeMs, total, 1, Math.min(total, 200));
+      ctx.recordRead(absPath, stat12.mtimeMs);
+      rememberReadRange(ctx, absPath, stat12.mtimeMs, total, 1, Math.min(total, 200));
       return {
-        text: summarizeFile(input.path, stat11.size, allLines),
+        text: summarizeFile(input.path, stat12.size, allLines),
         total_lines: total,
         encoding: "utf8",
         truncated: total > 200,
@@ -285,13 +285,13 @@ var readTool = {
       };
     }
     if (limit === 0) {
-      ctx.recordRead(absPath, stat11.mtimeMs);
-      rememberReadRange(ctx, absPath, stat11.mtimeMs, total, 1, 0);
+      ctx.recordRead(absPath, stat12.mtimeMs);
+      rememberReadRange(ctx, absPath, stat12.mtimeMs, total, 1, 0);
       return { text: "", total_lines: total, encoding: "utf8", truncated: total > 0 };
     }
     if (offset > total) {
-      ctx.recordRead(absPath, stat11.mtimeMs);
-      rememberReadRange(ctx, absPath, stat11.mtimeMs, total, total + 1, total + 1);
+      ctx.recordRead(absPath, stat12.mtimeMs);
+      rememberReadRange(ctx, absPath, stat12.mtimeMs, total, total + 1, total + 1);
       return {
         text: `[offset ${offset} is past end of file "${input.path}" \u2014 file has ${total} line(s). Do not retry this offset.]`,
         total_lines: total,
@@ -303,8 +303,8 @@ var readTool = {
     const truncated = offset - 1 + slice.length < total;
     const width = String(offset + slice.length - 1).length;
     const numbered = slice.map((line, i) => `${String(offset + i).padStart(width, " ")}\u2192${line}`).join("\n");
-    ctx.recordRead(absPath, stat11.mtimeMs);
-    rememberReadRange(ctx, absPath, stat11.mtimeMs, total, offset, offset + slice.length - 1);
+    ctx.recordRead(absPath, stat12.mtimeMs);
+    rememberReadRange(ctx, absPath, stat12.mtimeMs, total, offset, offset + slice.length - 1);
     return {
       text: numbered,
       total_lines: total,
@@ -410,12 +410,12 @@ var writeTool = {
     let existed = false;
     let prev = "";
     try {
-      const stat12 = await fs7.stat(absPath);
-      existed = stat12.isFile();
+      const stat13 = await fs7.stat(absPath);
+      existed = stat13.isFile();
       if (existed) {
         if (!ctx.hasRead(absPath)) {
           prev = await fs7.readFile(absPath, "utf8");
-          ctx.recordRead(absPath, stat12.mtimeMs, "write");
+          ctx.recordRead(absPath, stat13.mtimeMs, "write");
         } else {
           prev = await fs7.readFile(absPath, "utf8");
         }
@@ -428,8 +428,8 @@ var writeTool = {
     await atomicWrite(absPath, input.content);
     const diff = existed ? unifiedDiff(prev, input.content, { fromFile: input.path, toFile: input.path }) : `+++ ${input.path}
 + (new file, ${input.content.split("\n").length} lines)`;
-    const stat11 = await fs7.stat(absPath);
-    ctx.recordRead(absPath, stat11.mtimeMs, "write");
+    const stat12 = await fs7.stat(absPath);
+    ctx.recordRead(absPath, stat12.mtimeMs, "write");
     ctx.session.recordFileChange({
       path: absPath,
       action: existed ? "modified" : "created",
@@ -487,7 +487,7 @@ var editTool = {
       });
     }
     const absPath = await safeResolveReal(input.path, ctx);
-    const stat11 = await fs7.stat(absPath).catch((err) => {
+    const stat12 = await fs7.stat(absPath).catch((err) => {
       if (err.code === "ENOENT") {
         throw new ToolValidationError({
           message: `edit: file "${input.path}" does not exist. Use \`write\` instead.`,
@@ -497,7 +497,7 @@ var editTool = {
       }
       throw err;
     });
-    if (!stat11.isFile()) {
+    if (!stat12.isFile()) {
       throw new ToolValidationError({
         message: `edit: "${input.path}" is not a regular file`,
         field: "path"
@@ -515,7 +515,7 @@ var editTool = {
         context: { reason: "external_modification" }
       });
     }
-    if (autoRead && updated.mtimeMs > stat11.mtimeMs + mtimeTolerance) {
+    if (autoRead && updated.mtimeMs > stat12.mtimeMs + mtimeTolerance) {
       throw new ToolValidationError({
         message: `edit: file "${input.path}" changed while being auto-read. Retry the edit.`,
         field: "path",
@@ -732,8 +732,8 @@ var replaceTool = {
       }
       const rel = path.relative(realRoot, realPath);
       if (rel.startsWith("..") || path.isAbsolute(rel)) continue;
-      const stat11 = await fs7.stat(realPath).catch(() => null);
-      if (!stat11?.isFile()) continue;
+      const stat12 = await fs7.stat(realPath).catch(() => null);
+      if (!stat12?.isFile()) continue;
       let content;
       try {
         const buf = await fs7.readFile(realPath);
@@ -758,7 +758,7 @@ var replaceTool = {
       totalReplacements += count;
       if (!dryRun) {
         const newContent = toStyle(newContentLf, style);
-        await atomicWrite(realPath, newContent, { mode: stat11.mode & 511 });
+        await atomicWrite(realPath, newContent, { mode: stat12.mode & 511 });
       }
       const diff = dryRun || matches.length > 0 ? unifiedDiff(content, toStyle(newContentLf, style), {
         fromFile: absPath,
@@ -788,8 +788,8 @@ async function resolveFiles(filesInput, ctx, extraGlob) {
   const resolved = [];
   for (const p of parts) {
     const absPath = safeResolve(p, ctx);
-    const stat11 = await fs7.stat(absPath).catch(() => null);
-    if (stat11?.isFile()) {
+    const stat12 = await fs7.stat(absPath).catch(() => null);
+    if (stat12?.isFile()) {
       resolved.push(absPath);
     }
   }
@@ -807,13 +807,13 @@ async function globFiles(pattern, base, extraGlob) {
   return await globNative(pattern, base, extraGlob);
 }
 function checkRg() {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     try {
       const p = spawn("rg", ["--version"], { env: buildChildEnv(), stdio: "ignore", windowsHide: true });
-      p.on("error", () => resolve7(false));
-      p.on("close", (code) => resolve7(code === 0));
+      p.on("error", () => resolve8(false));
+      p.on("close", (code) => resolve8(code === 0));
     } catch {
-      resolve7(false);
+      resolve8(false);
     }
   });
 }
@@ -830,10 +830,10 @@ function spawnRgFind(pattern, base) {
     buf += chunk.toString();
   });
   return {
-    promise: new Promise((resolve7, reject) => {
+    promise: new Promise((resolve8, reject) => {
       child.on("error", reject);
       child.on("close", () => {
-        resolve7(buf.split("\n").filter(Boolean));
+        resolve8(buf.split("\n").filter(Boolean));
       });
     })
   };
@@ -841,7 +841,7 @@ function spawnRgFind(pattern, base) {
 async function globNative(pattern, base, extraGlob) {
   const results = [];
   const globRe = compileGlob(pattern);
-  const walk = async (dir) => {
+  const walk2 = async (dir) => {
     let entries;
     try {
       entries = await fs7.readdir(dir, { withFileTypes: true });
@@ -852,13 +852,13 @@ async function globNative(pattern, base, extraGlob) {
       if (DEFAULT_IGNORE.includes(e.name)) continue;
       const full = path.join(dir, e.name);
       try {
-        const stat11 = await fs7.lstat(full);
-        if (stat11.isSymbolicLink()) continue;
+        const stat12 = await fs7.lstat(full);
+        if (stat12.isSymbolicLink()) continue;
       } catch {
         continue;
       }
       if (e.isDirectory()) {
-        await walk(full);
+        await walk2(full);
       } else if (e.isFile()) {
         const name = e.name;
         if (globRe.test(name) || globRe.test(full)) {
@@ -870,7 +870,7 @@ async function globNative(pattern, base, extraGlob) {
       }
     }
   };
-  await walk(base);
+  await walk2(base);
   return results;
 }
 
@@ -947,7 +947,7 @@ var globTool = {
       } catch {
       }
     };
-    const walk = async (dir, relPrefix) => {
+    const walk2 = async (dir, relPrefix) => {
       if (results.length >= limit) {
         truncated = true;
         return;
@@ -1000,9 +1000,9 @@ var globTool = {
       await mapWithConcurrency(matchedFiles, WALK_CONCURRENCY, pushResult);
       if (truncated) return;
       const remainingSubdirs = truncated ? [] : subdirs;
-      await mapWithConcurrency(remainingSubdirs, WALK_CONCURRENCY, ({ full, rel }) => walk(full, rel));
+      await mapWithConcurrency(remainingSubdirs, WALK_CONCURRENCY, ({ full, rel }) => walk2(full, rel));
     };
-    await walk(base, "");
+    await walk2(base, "");
     results.sort((a, b) => b.mtime - a.mtime);
     return { files: results.map((r) => r.rel), truncated };
   }
@@ -1106,13 +1106,13 @@ var grepTool = {
   }
 };
 async function detectRg(signal) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     try {
       const p = spawn("rg", ["--version"], { env: buildChildEnv(), stdio: "ignore", signal, windowsHide: true });
-      p.on("error", () => resolve7(false));
-      p.on("close", (code) => resolve7(code === 0));
+      p.on("error", () => resolve8(false));
+      p.on("close", (code) => resolve8(code === 0));
     } catch {
-      resolve7(false);
+      resolve8(false);
     }
   });
 }
@@ -1263,8 +1263,8 @@ async function runNative(input, base, mode, limit, signal) {
     if (globRe && !globRe.test(name) && !globRe.test(full)) return;
     if (globRe) globRe.lastIndex = 0;
     try {
-      const stat11 = await fs7.stat(full);
-      if (!stat11.isFile() || stat11.size > maxBytes || stopped || signal.aborted) return;
+      const stat12 = await fs7.stat(full);
+      if (!stat12.isFile() || stat12.size > maxBytes || stopped || signal.aborted) return;
       const file = await fs7.open(full, "r");
       try {
         let bytesReadTotal = 0;
@@ -1340,7 +1340,7 @@ async function runNative(input, base, mode, limit, signal) {
     } catch {
     }
   };
-  const walk = async (dir) => {
+  const walk2 = async (dir) => {
     if (stopped || signal.aborted) return;
     let entries;
     try {
@@ -1362,9 +1362,9 @@ async function runNative(input, base, mode, limit, signal) {
       }
     }
     await mapWithConcurrency(files, NATIVE_SCAN_CONCURRENCY, ({ full, name }) => scanFile(full, name));
-    await mapWithConcurrency(subdirs, Math.min(16, NATIVE_SCAN_CONCURRENCY), walk);
+    await mapWithConcurrency(subdirs, Math.min(16, NATIVE_SCAN_CONCURRENCY), walk2);
   };
-  await walk(base);
+  await walk2(base);
   return {
     matches,
     count: total,
@@ -2643,7 +2643,7 @@ function looksLikePowerShell(command) {
   if (/&\s+\$/.test(trimmed)) return true;
   if (/(^|\s)@\s*\(/.test(trimmed)) return true;
   if (/(^|\s)@\{/.test(trimmed)) return true;
-  if (/(?:^|[\s\[\(\{,;])(?:-eq|-ne|-lt|-gt|-le|-ge|-like|-notlike|-match|-notmatch|-contains|-notcontains|-in|-notin|-and|-or|-not|-band|-bor|-bxor|-replace|-isplit|-csplit|-osplit|-join|-is|-as|-f)(?:$|[\s\]\)\},;])/i.test(trimmed)) {
+  if (/(?:^|[\s[({,;])(?:-eq|-ne|-lt|-gt|-le|-ge|-like|-notlike|-match|-notmatch|-contains|-notcontains|-in|-notin|-and|-or|-not|-band|-bor|-bxor|-replace|-isplit|-csplit|-osplit|-join|-is|-as|-f)(?:$|[\s\])},;])/i.test(trimmed)) {
     return true;
   }
   if (PS_VERB_RE.test(trimmed)) return true;
@@ -2670,7 +2670,7 @@ function looksLikePowerShellExtended(command) {
     return true;
   }
   if (/^\s*<#|#>\s*$/m.test(trimmed)) return true;
-  if (/(?:^|\s)[-/\/](?:AsPlainText|PipelineVariable|pv|FilterHashtable|OutVariable|ov)(?:\s|=|$)/i.test(trimmed)) {
+  if (/(?:^|\s)[-//](?:AsPlainText|PipelineVariable|pv|FilterHashtable|OutVariable|ov)(?:\s|=|$)/i.test(trimmed)) {
     return true;
   }
   return false;
@@ -3093,10 +3093,10 @@ var bashTool = {
         queue.push(c);
       }
     };
-    const next = () => new Promise((resolve7) => {
+    const next = () => new Promise((resolve8) => {
       const c = queue.shift();
-      if (c) resolve7(c);
-      else resolveNext = resolve7;
+      if (c) resolve8(c);
+      else resolveNext = resolve8;
     });
     let lastFlush = Date.now();
     const flush = () => {
@@ -3257,6 +3257,294 @@ function ensureSessionShell(opts = {}) {
   env["WRONGSTACK_SHELL"] = chosen;
   return chosen;
 }
+
+// src/_danger-detect.ts
+var argHas = (args, value) => args.includes(value);
+var argMatches = (args, re) => args.some((a) => re.test(a));
+var hasShortFlags = (args, letters) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const a of args) {
+    if (!a.startsWith("-") || a.startsWith("--")) continue;
+    for (const ch of a.replace(/^-+/, "")) seen.add(ch);
+  }
+  return letters.split("").every((l) => seen.has(l));
+};
+var RULES = [
+  // ----- rm / rmdir: recursive force delete (any path) -----
+  // Note: BLOCKED_ARG_PATTERNS already hard-denies root/home/glob paths,
+  // but `rm -rf ./build` is a normal dev workflow that the user might
+  // want to do intentionally. We downgrade it to 'destructive' so the
+  // confirm prompt can approve.
+  {
+    id: "rm-recursive",
+    level: "destructive",
+    test: (cmd, args) => (cmd === "rm" || cmd === "rmdir") && hasShortFlags(args, "rf"),
+    reason: "recursive force-delete"
+  },
+  // ----- Windows PowerShell Remove-Item: -Recurse -Force -----
+  {
+    id: "powershell-remove-item-recursive-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "powershell" && cmd !== "pwsh") return false;
+      const hasRecurse = argMatches(args, /^-(?:R|Recurse|Recurse\s)/);
+      const hasForce = argHas(args, "-Force") || argHas(args, "-F");
+      if (argHas(args, "-WhatIf")) return false;
+      return hasRecurse && hasForce;
+    },
+    reason: "Remove-Item with -Recurse -Force"
+  },
+  // ----- find -exec / -ok / -execdir -----
+  {
+    id: "find-exec",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "find") return false;
+      return args.some(
+        (a) => a === "-exec" || a === "-exec;" || a === "-ok" || a === "-ok;" || a === "-execdir" || a === "-execdir;" || a.startsWith("-exec=") || a.startsWith("-ok=") || a.startsWith("-execdir=")
+      );
+    },
+    reason: "find with -exec/-ok (executes arbitrary command on matches)"
+  },
+  // ----- git --exec= / --upload-pack= / --receive-pack= -----
+  // These run arbitrary commands via the git transport layer.
+  {
+    id: "git-exec",
+    level: "destructive",
+    test: (cmd, args) => cmd === "git" && args.some(
+      (a) => a.startsWith("--exec=") || a.startsWith("--upload-pack=") || a.startsWith("--receive-pack=") || a === "--exec" || a === "--upload-pack" || a === "--receive-pack"
+    ),
+    reason: "git with --exec/--upload-pack/--receive-pack (runs arbitrary code)"
+  },
+  // ----- Windows: format / diskpart / bcdedit -----
+  {
+    id: "win32-format",
+    level: "destructive",
+    test: (cmd) => cmd === "format" || cmd === "format.exe",
+    reason: "format (Windows disk format)"
+  },
+  {
+    id: "win32-diskpart",
+    level: "destructive",
+    test: (cmd) => cmd === "diskpart" || cmd === "diskpart.exe",
+    reason: "diskpart (Windows partition editor)"
+  },
+  {
+    id: "win32-bcdedit",
+    level: "destructive",
+    test: (cmd) => cmd === "bcdedit" || cmd === "bcdedit.exe",
+    reason: "bcdedit (Windows boot config editor)"
+  },
+  // ----- mkfs family -----
+  {
+    id: "mkfs",
+    level: "destructive",
+    test: (cmd) => /^mkfs(\.[a-z0-9]+)?$/.test(cmd) || cmd === "mkswap",
+    reason: "mkfs (filesystem creation \u2014 destroys existing data)"
+  },
+  // ----- dd writing to a block device -----
+  {
+    id: "dd-to-block-device",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "dd") return false;
+      return args.some((a) => /of=\/dev\/(sd|hd|nvme|vd|mmcblk|xvd|loop|disk)/.test(a));
+    },
+    reason: "dd writing to a block device"
+  },
+  // ----- Secure-erase tools -----
+  {
+    id: "shred",
+    level: "destructive",
+    test: (cmd) => cmd === "shred" || cmd === "shred.exe",
+    reason: "shred (secure file delete)"
+  },
+  {
+    id: "wipefs",
+    level: "destructive",
+    test: (cmd) => cmd === "wipefs" || cmd === "wipefs.exe",
+    reason: "wipefs (signature wipe \u2014 destroys filesystem headers)"
+  },
+  {
+    id: "sdelete",
+    level: "destructive",
+    test: (cmd) => cmd === "sdelete" || cmd === "sdelete.exe",
+    reason: "sdelete (Sysinternals secure delete)"
+  },
+  // ----- VCS history rewrite (destructive) -----
+  // `git push --force` / `-f` rewrites remote history. `--force-with-lease`
+  // is the safer variant (checks remote hasn't moved) but still rewrites.
+  {
+    id: "git-push-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "git") return false;
+      const pushIdx = args.indexOf("push");
+      if (pushIdx < 0) return false;
+      for (let i = pushIdx + 1; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--force" || a === "-f" || a === "--force-with-lease") return true;
+        if (!a.startsWith("-") && !a.includes("=")) continue;
+        if (a.startsWith("--force")) return true;
+      }
+      return false;
+    },
+    reason: "git push with --force / -f (rewrites remote history)"
+  },
+  // ----- git reset --hard (destructive) -----
+  {
+    id: "git-reset-hard",
+    level: "destructive",
+    test: (cmd, args) => cmd === "git" && args.some((a) => a === "--hard" || a.startsWith("--hard=")),
+    reason: "git reset --hard (discards working tree + index)"
+  },
+  // ----- git clean -f / -fd (destructive) -----
+  {
+    id: "git-clean-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "git") return false;
+      const cleanIdx = args.indexOf("clean");
+      if (cleanIdx < 0) return false;
+      return args.slice(cleanIdx + 1).some(
+        (a) => a === "-f" || a === "--force" || a.startsWith("-f") || a.startsWith("--force=")
+      );
+    },
+    reason: "git clean -f (deletes untracked files)"
+  },
+  // ----- package publish (destructive — public, irreversible) -----
+  {
+    id: "npm-publish",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (!["npm", "pnpm", "yarn", "bun", "cargo"].includes(cmd)) return false;
+      return args.includes("publish") || cmd === "cargo" && args.includes("yank");
+    },
+    reason: "publishing to a public package registry (hard to reverse)"
+  },
+  // ----- k8s cluster-wide destructive ops (destructive) -----
+  {
+    id: "kubectl-delete-namespace",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "kubectl") return false;
+      const delIdx = args.indexOf("delete");
+      if (delIdx < 0) return false;
+      const after = args.slice(delIdx + 1);
+      return after[0] === "namespace" || after[0] === "ns";
+    },
+    reason: "kubectl delete namespace (deletes all resources in the namespace)"
+  },
+  {
+    id: "kubectl-drain",
+    level: "destructive",
+    test: (cmd, args) => cmd === "kubectl" && args.includes("drain"),
+    reason: "kubectl drain (evicts pods, marks node unschedulable)"
+  },
+  // ----- inline code evaluation (caution — high false-positive) -----
+  // Common in scripts: `python -c "..."`, `node -e "..."`, `bash -c "..."`.
+  // We tag 'caution' rather than 'destructive' because these are used in
+  // many legitimate one-liners (e.g. `python -c "print(1)"`).
+  {
+    id: "inline-eval",
+    level: "caution",
+    test: (cmd, args) => {
+      if (![
+        "python",
+        "python3",
+        "python2",
+        "node",
+        "bash",
+        "sh",
+        "zsh",
+        "ruby",
+        "perl",
+        "lua"
+      ].includes(cmd)) {
+        return false;
+      }
+      return args.some(
+        (a) => a === "-c" || a === "-e" || a === "--eval" || a === "-eval" || a === "-E"
+      );
+    },
+    reason: "inline script evaluation (-c / -e / --eval)"
+  },
+  // ----- pipe-to-shell (caution — well-known exfil pattern) -----
+  // The classic `curl https://... | sh` download-and-run vector. Detected by
+  // looking for a known fetcher followed by a shell sink. We use a simple
+  // substring scan; false positives are limited because both tokens must
+  // appear in the same argv.
+  {
+    id: "pipe-to-shell",
+    level: "caution",
+    test: (_cmd, args) => {
+      const hasFetcher = args.some(
+        (a) => /^(curl|wget|fetch|httpie|http)$/i.test(a) || a.startsWith("curl") || a.startsWith("wget")
+      );
+      const hasShellSink = args.some(
+        (a) => a === "sh" || a === "bash" || a === "zsh" || a === "fish" || a === "pwsh" || a === "powershell" || a.endsWith("/sh") || a.endsWith("/bash") || a.endsWith("/zsh") || a.endsWith("/pwsh")
+      );
+      return hasFetcher && hasShellSink;
+    },
+    reason: "network fetch piped to a shell (download-and-run pattern)"
+  },
+  // ----- privilege escalation (caution) -----
+  {
+    id: "sudo",
+    level: "caution",
+    test: (cmd) => cmd === "sudo" || cmd === "doas",
+    reason: "privilege escalation (sudo / doas)"
+  },
+  {
+    id: "runas",
+    level: "caution",
+    test: (cmd) => cmd === "runas" || cmd === "runas.exe",
+    reason: "Windows runas (run as different user)"
+  },
+  // ----- world-writable permissions (caution) -----
+  // `chmod 777` is rarely correct. `chmod -R 777` is almost always wrong.
+  // We only flag octal modes; symbolic modes like `chmod o+w` are
+  // left to the operator's discretion.
+  {
+    id: "chmod-world-writable",
+    level: "caution",
+    test: (cmd, args) => {
+      if (cmd !== "chmod") return false;
+      return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));
+    },
+    reason: "chmod with world-writable octal mode (e.g. 777)"
+  }
+];
+function detectDanger(cmd, args, bypass) {
+  const reasons = [];
+  let level = "safe";
+  let matchedRule;
+  for (const rule of RULES) {
+    if (bypass?.has(rule.id)) continue;
+    if (!rule.test(cmd, args)) continue;
+    reasons.push(rule.reason);
+    matchedRule = rule.id;
+    if (levelRank(rule.level) > levelRank(level)) {
+      level = rule.level;
+    }
+  }
+  if (level === "safe") return { level: "safe", reasons: [] };
+  const result = { level, reasons };
+  if (matchedRule !== void 0) result.matchedRule = matchedRule;
+  return result;
+}
+function levelRank(level) {
+  switch (level) {
+    case "safe":
+      return 0;
+    case "caution":
+      return 1;
+    case "destructive":
+      return 2;
+  }
+}
+
+// src/exec.ts
 var isWin2 = process.platform === "win32";
 var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   // JS / TS toolchain
@@ -3876,6 +4164,21 @@ function configureExecPolicy(opts = {}) {
 function resetExecPolicy() {
   allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
 }
+var dangerBypass = /* @__PURE__ */ new Set();
+function configureDangerBypass(opts = {}) {
+  const next = /* @__PURE__ */ new Set();
+  for (const id of opts.bypass ?? []) {
+    const trimmed = id.trim();
+    if (trimmed) next.add(trimmed);
+  }
+  dangerBypass = next;
+}
+function resetDangerBypass() {
+  dangerBypass = /* @__PURE__ */ new Set();
+}
+function getDangerBypass() {
+  return dangerBypass;
+}
 function isExecCommandAllowed(cmd) {
   return allowedCommands.has(normalizeCmd(cmd));
 }
@@ -3967,6 +4270,7 @@ function validateArgs(cmd, args) {
   }
   return null;
 }
+var SAFE_DANGER = { level: "safe", reasons: [] };
 var execTool = {
   name: "exec",
   category: "Shell",
@@ -4011,7 +4315,8 @@ var execTool = {
         stderr: "Circuit breaker is open \u2014 too many consecutive failures. Use /kill reset to recover.",
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger: SAFE_DANGER
       };
     }
     const cmd = input.command.trim();
@@ -4023,7 +4328,8 @@ var execTool = {
         stderr: "Empty command",
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger: SAFE_DANGER
       };
     if (!isExecCommandAllowed(cmd)) {
       return {
@@ -4033,11 +4339,13 @@ var execTool = {
         stderr: `Command "${cmd}" not in allowlist. Add it to your ~/.wrongstack/config.json under "tools": { "exec": { "allow": ["${cmd}"] } }, or use the bash tool for one-off arbitrary commands.`,
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger: SAFE_DANGER
       };
     }
     const args = (input.args ?? []).slice(0, MAX_ARGS);
     const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS2, DEFAULT_TIMEOUT_MS2));
+    const danger = detectDanger(cmd, args, dangerBypass);
     const argError = validateArgs(cmd, args);
     if (argError) {
       return {
@@ -4047,7 +4355,8 @@ var execTool = {
         stderr: argError,
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger
       };
     }
     let cwd;
@@ -4061,15 +4370,16 @@ var execTool = {
         stderr: `cwd "${input.cwd ?? ctx.cwd}" resolves outside project root`,
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger
       };
     }
     const signal = opts.signal;
-    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id);
+    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id, danger);
   }
 };
-function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
-  return new Promise((resolve7) => {
+function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
+  return new Promise((resolve8) => {
     let stdout = "";
     let stderr = "";
     let killed = false;
@@ -4077,7 +4387,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
     const finish = (result) => {
       if (resolvedOnce.value) return;
       resolvedOnce.value = true;
-      resolve7(result);
+      resolve8(result);
     };
     const startedAt = Date.now();
     const spool = createOutputSpool({ tool: `exec-${cmd}`, thresholdBytes: MAX_OUTPUT2 });
@@ -4105,7 +4415,8 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
         stderr: `spawn failed: ${toErrorMessage$1(err)}`,
         exitCode: 1,
         truncated: false,
-        allowed: true
+        allowed: true,
+        danger
       });
       return;
     }
@@ -4124,7 +4435,8 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
         stderr: stderrText,
         exitCode: isAbort ? 124 : 1,
         truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
-        allowed: true
+        allowed: true,
+        danger
       });
     });
     const registry = getProcessRegistry();
@@ -4172,7 +4484,8 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
         stderr: normalizeCommandOutput(stderr),
         exitCode,
         truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES || Buffer.byteLength(stderr, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
-        allowed: true
+        allowed: true,
+        danger
       });
     });
   });
@@ -5436,8 +5749,8 @@ function findGitDir(cwd, projectRoot) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat11 = statSync(`${dir}/.git`);
-      if (stat11.isDirectory() || stat11.isFile()) return dir;
+      const stat12 = statSync(`${dir}/.git`);
+      if (stat12.isDirectory() || stat12.isFile()) return dir;
     } catch {
     }
     if (dir === root) break;
@@ -5518,7 +5831,7 @@ function buildArgs(input) {
   }
 }
 function runGit(args, cwd, signal) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let stdout = "";
     let stderr = "";
     const child = spawn("git", args, {
@@ -5539,7 +5852,7 @@ function runGit(args, cwd, signal) {
       }
     });
     child.on("error", (err) => {
-      resolve7({
+      resolve8({
         command: args[0],
         stdout: normalizeCommandOutput(stdout),
         stderr: err.message,
@@ -5548,7 +5861,7 @@ function runGit(args, cwd, signal) {
       });
     });
     child.on("close", (code) => {
-      resolve7({
+      resolve8({
         command: args[0],
         stdout: normalizeCommandOutput(stdout),
         stderr: normalizeCommandOutput(stderr),
@@ -5648,7 +5961,7 @@ function stripPathComponents(p, strip) {
   return parts.slice(strip).join("/");
 }
 function runPatch(args, cwd, signal) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let stdout = "";
     let stderr = "";
     const env = { ...buildChildEnv(), LANG: "C", LC_ALL: "C" };
@@ -5659,8 +5972,8 @@ function runPatch(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve7({ exitCode: code ?? 1, stdout, stderr }));
-    child.on("error", (e) => resolve7({ exitCode: 1, stdout: "", stderr: e.message }));
+    child.on("close", (code) => resolve8({ exitCode: code ?? 1, stdout, stderr }));
+    child.on("error", (e) => resolve8({ exitCode: 1, stdout: "", stderr: e.message }));
   });
 }
 function extractPatchedFiles(output) {
@@ -5733,7 +6046,6 @@ var jsonTool = {
         return executeTransform(input, ctx);
       case "merge":
         return executeMerge(input);
-      case "parse":
       default:
         return executeParse(input, ctx);
     }
@@ -6049,56 +6361,56 @@ function jmespathSearch(data, query) {
 }
 function validateJsonSchema(data, schema) {
   const errors = [];
-  function check(value, s, path22) {
+  function check(value, s, path23) {
     if (s["type"]) {
       const expectedType = s["type"];
       const actualType = Array.isArray(value) ? "array" : value === null ? "null" : typeof value;
       if (expectedType === "integer") {
-        if (!Number.isInteger(value)) errors.push(`${path22}: expected integer, got ${actualType}`);
+        if (!Number.isInteger(value)) errors.push(`${path23}: expected integer, got ${actualType}`);
       } else if (expectedType !== actualType) {
-        errors.push(`${path22}: expected ${expectedType}, got ${actualType}`);
+        errors.push(`${path23}: expected ${expectedType}, got ${actualType}`);
       }
     }
     if (typeof value === "string" && s["format"] === "uri" && value) {
       try {
         new URL(value);
       } catch {
-        errors.push(`${path22}: not a valid URI`);
+        errors.push(`${path23}: not a valid URI`);
       }
     }
     if (typeof value === "string" && s["pattern"]) {
       const re = new RegExp(s["pattern"]);
-      if (!re.test(value)) errors.push(`${path22}: does not match pattern ${s["pattern"]}`);
+      if (!re.test(value)) errors.push(`${path23}: does not match pattern ${s["pattern"]}`);
     }
     if (typeof value === "string" && s["minLength"] !== void 0 && value.length < s["minLength"]) {
-      errors.push(`${path22}: string too short (min ${s["minLength"]})`);
+      errors.push(`${path23}: string too short (min ${s["minLength"]})`);
     }
     if (typeof value === "string" && s["maxLength"] !== void 0 && value.length > s["maxLength"]) {
-      errors.push(`${path22}: string too long (max ${s["maxLength"]})`);
+      errors.push(`${path23}: string too long (max ${s["maxLength"]})`);
     }
     if (typeof value === "number" && s["minimum"] !== void 0 && value < s["minimum"]) {
-      errors.push(`${path22}: below minimum ${s["minimum"]}`);
+      errors.push(`${path23}: below minimum ${s["minimum"]}`);
     }
     if (typeof value === "number" && s["maximum"] !== void 0 && value > s["maximum"]) {
-      errors.push(`${path22}: above maximum ${s["maximum"]}`);
+      errors.push(`${path23}: above maximum ${s["maximum"]}`);
     }
     if (Array.isArray(value) && s["items"] && Array.isArray(s["items"])) {
       for (let i = 0; i < value.length; i++) {
-        check(value[i], s["items"], `${path22}[${i}]`);
+        check(value[i], s["items"], `${path23}[${i}]`);
       }
     }
     if (typeof value === "object" && value !== null && !Array.isArray(value) && s["properties"]) {
       const props = s["properties"];
       for (const [k, propSchema] of Object.entries(props)) {
-        check(value[k], propSchema, `${path22}.${k}`);
+        check(value[k], propSchema, `${path23}.${k}`);
       }
     }
   }
   check(data, schema, "$");
   return { valid: errors.length === 0, errors };
 }
-function simpleQuery(data, path22) {
-  const parts = path22.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean);
+function simpleQuery(data, path23) {
+  const parts = path23.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean);
   let current = data;
   for (const part of parts) {
     if (current === null || current === void 0) return void 0;
@@ -6228,8 +6540,8 @@ function findGitDir2(cwd) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat11 = statSync(path.join(dir, ".git"));
-      if (stat11.isDirectory()) return dir;
+      const stat12 = statSync(path.join(dir, ".git"));
+      if (stat12.isDirectory()) return dir;
     } catch {
     }
     const parent = path.dirname(dir);
@@ -6239,7 +6551,7 @@ function findGitDir2(cwd) {
   return null;
 }
 function runGit2(args, cwd, signal) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let stdout = "";
     let stderr = "";
     const child = spawn("git", args, {
@@ -6255,8 +6567,8 @@ function runGit2(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve7({ stdout, stderr, exitCode: code ?? 0 }));
-    child.on("error", (e) => resolve7({ stdout: "", stderr: e.message, exitCode: 1 }));
+    child.on("close", (code) => resolve8({ stdout, stderr, exitCode: code ?? 0 }));
+    child.on("error", (e) => resolve8({ stdout: "", stderr: e.message, exitCode: 1 }));
   });
 }
 async function fileDiff(input, ctx, _signal) {
@@ -6273,8 +6585,8 @@ async function fileDiff(input, ctx, _signal) {
   const results = [];
   for (const file of files) {
     const absPath = safeResolve(file, ctx);
-    const stat11 = await fs7.stat(absPath).catch(() => null);
-    if (!stat11?.isFile()) continue;
+    const stat12 = await fs7.stat(absPath).catch(() => null);
+    if (!stat12?.isFile()) continue;
     const content = await fs7.readFile(absPath, "utf8");
     const lines = content.split(/\r?\n/);
     results.push(formatWithLineNumbers(file, lines));
@@ -6578,8 +6890,8 @@ async function* spawnStream(opts) {
   try {
     for (; ; ) {
       while (queue.length === 0) {
-        await new Promise((resolve7) => {
-          waiter = resolve7;
+        await new Promise((resolve8) => {
+          waiter = resolve8;
         });
       }
       const chunk = queue.shift();
@@ -6716,11 +7028,11 @@ var lintTool = {
   }
 };
 async function detectLinter(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
+  const { stat: stat12 } = await import('node:fs/promises');
   const checks = ["biome.json", ".eslintrc.json", "tslint.json", ".eslintrc.js", "tsconfig.json"];
   for (const f of checks) {
     try {
-      await stat11(`${cwd}/${f}`);
+      await stat12(`${cwd}/${f}`);
       if (f.includes("biome")) return "biome";
       if (f.includes("eslint")) return "eslint";
       if (f.includes("tslint")) return "tslint";
@@ -6819,13 +7131,13 @@ var formatTool = {
   }
 };
 async function detectFixer(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
+  const { stat: stat12 } = await import('node:fs/promises');
   try {
-    await stat11(`${cwd}/biome.json`);
+    await stat12(`${cwd}/biome.json`);
     return "biome";
   } catch {
     try {
-      await stat11(`${cwd}/.prettierrc`);
+      await stat12(`${cwd}/.prettierrc`);
       return "prettier";
     } catch {
       return "biome";
@@ -6910,11 +7222,11 @@ var typecheckTool = {
   }
 };
 async function findTsConfig(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
+  const { stat: stat12 } = await import('node:fs/promises');
   const candidates = ["tsconfig.json", "tsconfig.base.json"];
   for (const f of candidates) {
     try {
-      const s = await stat11(path.join(cwd, f));
+      const s = await stat12(path.join(cwd, f));
       if (s.isFile()) return path.join(cwd, f);
     } catch {
     }
@@ -6999,11 +7311,11 @@ var testTool = {
   }
 };
 async function detectRunner(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
+  const { stat: stat12 } = await import('node:fs/promises');
   const candidates = ["vitest.config.ts", "jest.config.js", ".mocharc.json"];
   for (const f of candidates) {
     try {
-      await stat11(path.join(cwd, f));
+      await stat12(path.join(cwd, f));
       if (f.includes("vitest")) return "vitest";
       if (f.includes("jest")) return "jest";
       if (f.includes("mocha")) return "mocha";
@@ -7385,7 +7697,7 @@ var outdatedTool = {
   }
 };
 function runOutdated(manager, args, cwd, signal) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let stdout = "";
     let stderr = "";
     const MAX = 1e5;
@@ -7403,10 +7715,10 @@ function runOutdated(manager, args, cwd, signal) {
     });
     child.on("close", (code) => {
       const result = parseOutdatedOutput(stdout, code ?? 0);
-      resolve7(result);
+      resolve8(result);
     });
     child.on("error", (e) => {
-      resolve7({
+      resolve8({
         exit_code: 1,
         packages: [],
         total: 0,
@@ -7532,7 +7844,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
     };
   }
   args.push("--timestamps", service);
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let stdout = "";
     let stderr = "";
     const MAX = 2e5;
@@ -7548,7 +7860,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve7(result);
+      resolve8(result);
     };
     const child = spawn("docker", args, { cwd, signal, env: buildChildEnv(), stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
     const timer = setTimeout(() => {
@@ -7583,7 +7895,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
 }
 var DOCKER_LOGS_TIMEOUT_MS = 3e3;
 var MAX_TAIL_LINES = 1e5;
-async function fileLogs(path22, lines, filterRe, stream) {
+async function fileLogs(path23, lines, filterRe, stream) {
   const { createInterface } = await import('node:readline');
   const { createReadStream } = await import('node:fs');
   const entries = [];
@@ -7592,7 +7904,7 @@ async function fileLogs(path22, lines, filterRe, stream) {
   let writeIdx = 0;
   let totalLines = 0;
   const rl = createInterface({
-    input: createReadStream(path22),
+    input: createReadStream(path23),
     crlfDelay: Number.POSITIVE_INFINITY
   });
   for await (const line of rl) {
@@ -7613,7 +7925,7 @@ async function fileLogs(path22, lines, filterRe, stream) {
     if (parsed) entries.push(parsed);
   }
   return {
-    source: path22,
+    source: path23,
     entries,
     total: entries.length,
     truncated: totalLines > effLines,
@@ -7734,8 +8046,8 @@ async function resolveFiles2(filesInput, cwd) {
   for (const f of files) {
     const absPath = f.trim().startsWith("/") ? f.trim() : `${cwd}/${f.trim()}`;
     try {
-      const stat11 = await fs7.stat(absPath);
-      if (stat11.isFile()) resolved.push(absPath);
+      const stat12 = await fs7.stat(absPath);
+      if (stat12.isFile()) resolved.push(absPath);
     } catch {
     }
   }
@@ -8789,6 +9101,169 @@ function relatedMemoryTool(memory) {
     }
   };
 }
+var MAX_BODY_CHARS = SKILL_LIMITS.MAX_SKILL_BODY_CHARS;
+var MAX_RESOURCE_CHARS = SKILL_LIMITS.MAX_RESOURCE_CHARS;
+var MAX_LISTED_RESOURCES = SKILL_LIMITS.MAX_LISTED_RESOURCES;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build"]);
+function makeSkillTool(skillLoader) {
+  return {
+    name: "skill",
+    category: "Skills",
+    description: "Load a skill's instructions or a bundled resource on demand (agentskills.io progressive disclosure). With only `name`: returns the SKILL.md body + a list of bundled resource files. With `name` + `resource` (a relative path like `references/REF.md` or `scripts/extract.py`): returns that file content. Prefer this over the read tool for skill files \u2014 it reaches foreign skills outside the project root.",
+    usageHint: 'Load a skill body or one of its bundled resources (progressive disclosure).\n\nWHEN TO USE:\n- A task matches a skill trigger \u2192 load the body: skill({ name })\n- You need a reference/template/script bundled with the skill \u2192 skill({ name, resource: "references/REF.md" })\n\nThe body call lists every bundled resource; load the ones you need. Run scripts via bash using the returned abs path.',
+    permission: "auto",
+    mutating: false,
+    capabilities: ["fs.read"],
+    icon: "document",
+    timeoutMs: 5e3,
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: {
+          type: "string",
+          description: "Exact skill name (as shown in the available-skills list)."
+        },
+        resource: {
+          type: "string",
+          description: "Optional relative path of a bundled resource to load (e.g. references/REF.md, scripts/extract.py, assets/template.html). Omit to list resources."
+        }
+      },
+      required: ["name"]
+    },
+    async execute(input, ctx) {
+      const name = input?.name?.trim();
+      if (!name) {
+        throw new ToolValidationError({ message: "skill: name is required", field: "name" });
+      }
+      const manifest = await skillLoader.find(name);
+      if (!manifest) {
+        throw new ToolValidationError({
+          message: `skill "${name}" not found \u2014 use /skill to list available skills`,
+          field: "name"
+        });
+      }
+      const dir = path.dirname(manifest.path);
+      let loadedResource;
+      if (input.resource?.trim()) {
+        loadedResource = await loadResource(dir, input.resource.trim());
+      }
+      const raw = await skillLoader.readBody(name);
+      const body = stripFrontmatter(raw).trim().slice(0, MAX_BODY_CHARS);
+      const resources = loadedResource ? [] : await listResources(dir);
+      try {
+        await ctx?.session?.append({
+          type: "skill_activated",
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          skillName: manifest.name
+        });
+      } catch {
+      }
+      return {
+        name: manifest.name,
+        description: manifest.description,
+        body,
+        resources,
+        dir,
+        loadedResource
+      };
+    },
+    serialize(output) {
+      if (output.loadedResource) {
+        const lr = output.loadedResource;
+        const note = lr.truncated ? ` (truncated to ${lr.content.length} chars of ${lr.bytes} B)` : "";
+        return `# Resource: ${output.name}/${lr.rel}
+(abs path: ${lr.absPath})${note}
+
+${lr.content}`;
+      }
+      const head = `# Skill: ${output.name}
+${output.description}
+
+${output.body}`;
+      if (output.resources.length === 0) return head;
+      const listing = output.resources.map((r) => `- ${r.path} (${r.bytes} B)`).join("\n");
+      return `${head}
+
+## Bundled resources (load on demand)
+Load any with: \`skill({ name: "${output.name}", resource: "<path>" })\`. Run scripts via bash using their abs path under ${output.dir}.
+${listing}`;
+    }
+  };
+}
+async function loadResource(skillDir, rel) {
+  const norm = rel.replace(/\\/g, "/");
+  if (path.isAbsolute(rel) || norm.split("/").some((seg) => seg === "..")) {
+    throw new ToolValidationError({
+      message: `skill: invalid resource path "${rel}"`,
+      field: "resource"
+    });
+  }
+  const absPath = path.resolve(skillDir, rel);
+  const root = path.resolve(skillDir);
+  if (absPath !== root && !absPath.startsWith(root + path.sep)) {
+    throw new ToolValidationError({
+      message: `skill: resource "${rel}" escapes the skill directory`,
+      field: "resource"
+    });
+  }
+  let buf;
+  try {
+    buf = await fs7.readFile(absPath);
+  } catch {
+    throw new ToolValidationError({
+      message: `skill: resource "${rel}" not readable`,
+      field: "resource"
+    });
+  }
+  const raw = buf.toString("utf8");
+  const truncated = raw.length > MAX_RESOURCE_CHARS;
+  return {
+    rel: norm,
+    absPath,
+    content: truncated ? raw.slice(0, MAX_RESOURCE_CHARS) : raw,
+    bytes: buf.length,
+    truncated
+  };
+}
+async function listResources(skillDir) {
+  const out = [];
+  await walk(skillDir, skillDir, out);
+  out.sort((a, b) => a.path.localeCompare(b.path));
+  return out.slice(0, MAX_LISTED_RESOURCES);
+}
+async function walk(root, dir, out) {
+  if (out.length >= MAX_LISTED_RESOURCES) return;
+  let entries;
+  try {
+    entries = await fs7.readdir(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    if (out.length >= MAX_LISTED_RESOURCES) return;
+    const fullPath = path.join(dir, e.name);
+    let isDir = e.isDirectory();
+    if (e.isSymbolicLink()) {
+      try {
+        isDir = (await fs7.stat(fullPath)).isDirectory();
+      } catch {
+        continue;
+      }
+    }
+    if (isDir) {
+      if (SKIP_DIRS.has(e.name) || e.name.startsWith(".")) continue;
+      await walk(root, fullPath, out);
+    } else if (e.isFile()) {
+      if (e.name === "SKILL.md" || e.name === "SKILL.save.md") continue;
+      try {
+        const stat12 = await fs7.stat(fullPath);
+        const rel = path.relative(root, fullPath).split(path.sep).join("/");
+        out.push({ path: rel, bytes: stat12.size });
+      } catch {
+      }
+    }
+  }
+}
 
 // src/mode.ts
 function createModeTool(modeStore) {
@@ -10734,9 +11209,8 @@ func formatType(t ast.Expr) string {
 }
 `;
 async function syncGoParse(filePath, content, lang) {
-  const tmpDir = path.join(os2.tmpdir(), "ws-go-parse");
+  const tmpDir = await fs7.mkdtemp(path.join(os2.tmpdir(), "ws-go-parse-"));
   try {
-    await fs7.mkdir(tmpDir, { recursive: true });
     const scriptPath = path.join(tmpDir, "parse.go");
     await fs7.writeFile(scriptPath, GO_PARSE_SCRIPT, "utf8");
     const proc = spawn("go", ["run", scriptPath], {
@@ -10750,8 +11224,8 @@ async function syncGoParse(filePath, content, lang) {
     proc.stdin?.write(content);
     proc.stdin?.end();
     const { code } = await Promise.race([
-      new Promise((resolve7) => {
-        proc.on("close", (c) => resolve7({ code: c }));
+      new Promise((resolve8) => {
+        proc.on("close", (c) => resolve8({ code: c }));
       }),
       new Promise(
         (_, reject) => setTimeout(() => {
@@ -10780,6 +11254,8 @@ async function syncGoParse(filePath, content, lang) {
     return { file: filePath, lang, symbols, mtimeMs: Date.now() };
   } catch {
     return { file: filePath, lang, symbols: [], mtimeMs: Date.now() };
+  } finally {
+    await fs7.rm(tmpDir, { recursive: true, force: true });
   }
 }
 async function parseSymbols3(opts) {
@@ -11013,8 +11489,8 @@ async function syncPyParse(filePath, content, lang) {
       stdout += chunk.toString();
     });
     const { code } = await Promise.race([
-      new Promise((resolve7) => {
-        proc.on("close", (c) => resolve7({ code: c }));
+      new Promise((resolve8) => {
+        proc.on("close", (c) => resolve8({ code: c }));
       }),
       new Promise(
         (_, reject) => setTimeout(() => {
@@ -11099,8 +11575,8 @@ async function tryNativeParse(file, content) {
       stdout += chunk.toString();
     });
     const { code } = await Promise.race([
-      new Promise((resolve7) => {
-        proc.on("close", (c) => resolve7({ code: c }));
+      new Promise((resolve8) => {
+        proc.on("close", (c) => resolve8({ code: c }));
       }),
       new Promise(
         (_, reject) => setTimeout(() => {
@@ -11590,7 +12066,7 @@ async function loadGitignoreMatcher(projectRoot) {
 var YIELD_EVERY_N = 50;
 var PARALLEL_BATCH = 20;
 function yieldEventLoop() {
-  return new Promise((resolve7) => setImmediate(resolve7));
+  return new Promise((resolve8) => setImmediate(resolve8));
 }
 function throwIfAborted(signal) {
   if (!signal?.aborted) return;
@@ -11629,7 +12105,7 @@ async function findSourceFiles(projectRoot, ignore, isGitIgnored, signal) {
     { ext: ".yml", pat: compileGlob("**/*.yml") }
   ];
   let dirCount = 0;
-  const walk = async (dir) => {
+  const walk2 = async (dir) => {
     throwIfAborted(signal);
     if (dirCount > 0 && dirCount % YIELD_EVERY_N === 0) {
       await yieldEventLoop();
@@ -11648,7 +12124,7 @@ async function findSourceFiles(projectRoot, ignore, isGitIgnored, signal) {
       const rel = path.relative(projectRoot, full).replace(/\\/g, "/");
       if (e.isDirectory()) {
         if (isGitIgnored(rel, true)) continue;
-        await walk(full);
+        await walk2(full);
       } else if (e.isFile()) {
         if (isGitIgnored(rel, false)) continue;
         const ext = path.extname(e.name);
@@ -11661,7 +12137,7 @@ async function findSourceFiles(projectRoot, ignore, isGitIgnored, signal) {
       }
     }
   };
-  await walk(projectRoot);
+  await walk2(projectRoot);
   return results;
 }
 async function parseFile(file, content, lang) {
@@ -11735,34 +12211,34 @@ async function runIndexerWithStore(store, opts) {
     const statOpts = signal ? { signal } : {};
     const statReadParse = await Promise.allSettled(
       batchFiles.map(async (file) => {
-        let stat11;
+        let stat12;
         try {
-          stat11 = await fs7.stat(file, statOpts);
+          stat12 = await fs7.stat(file, statOpts);
         } catch (e) {
           if (isAbortError(e)) throw e;
           return { file, stat: null, lang: "", parsed: null, error: `stat error: ${e instanceof Error ? e.message : String(e)}` };
         }
-        if (!stat11.isFile()) return { file, stat: stat11, lang: "", parsed: null };
+        if (!stat12.isFile()) return { file, stat: stat12, lang: "", parsed: null };
         const lang = detectLang(file);
-        if (!lang) return { file, stat: stat11, lang: "", parsed: null };
+        if (!lang) return { file, stat: stat12, lang: "", parsed: null };
         const meta = existingMeta.get(file);
-        if (!force && meta && meta.mtimeMs === Math.floor(stat11.mtimeMs)) {
-          return { file, stat: stat11, lang, parsed: null, skippedMeta: meta };
+        if (!force && meta && meta.mtimeMs === Math.floor(stat12.mtimeMs)) {
+          return { file, stat: stat12, lang, parsed: null, skippedMeta: meta };
         }
         let content;
         try {
           content = await fs7.readFile(file, { encoding: "utf8", signal });
         } catch (e) {
           if (isAbortError(e)) throw e;
-          return { file, stat: stat11, lang, parsed: null, error: `read error: ${e instanceof Error ? e.message : String(e)}` };
+          return { file, stat: stat12, lang, parsed: null, error: `read error: ${e instanceof Error ? e.message : String(e)}` };
         }
         let parsed;
         try {
           parsed = await parseFile(file, content, lang);
         } catch (e) {
-          return { file, stat: stat11, lang, parsed: null, error: `parse error: ${e instanceof Error ? e.message : String(e)}` };
+          return { file, stat: stat12, lang, parsed: null, error: `parse error: ${e instanceof Error ? e.message : String(e)}` };
         }
-        return { file, stat: stat11, lang, parsed, content };
+        return { file, stat: stat12, lang, parsed, content };
       })
     );
     const batchEntries = [];
@@ -11782,7 +12258,7 @@ async function runIndexerWithStore(store, opts) {
         if (result.error.includes("error:")) errors.push(result.error);
         continue;
       }
-      const { stat: stat11, lang, parsed } = result;
+      const { stat: stat12, lang, parsed } = result;
       if (result.skippedMeta) {
         langStats[lang] = (langStats[lang] ?? 0) + result.skippedMeta.symbolCount;
         symbolsIndexed += result.skippedMeta.symbolCount;
@@ -11794,7 +12270,7 @@ async function runIndexerWithStore(store, opts) {
           store.upsertFile({
             file,
             lang,
-            mtimeMs: Math.floor(stat11.mtimeMs),
+            mtimeMs: Math.floor(stat12.mtimeMs),
             symbolCount: 0,
             lastIndexed: Date.now()
           });
@@ -11806,7 +12282,7 @@ async function runIndexerWithStore(store, opts) {
         store.upsertFile({
           file,
           lang,
-          mtimeMs: Math.floor(stat11.mtimeMs),
+          mtimeMs: Math.floor(stat12.mtimeMs),
           symbolCount: 0,
           lastIndexed: Date.now()
         });
@@ -11822,7 +12298,7 @@ async function runIndexerWithStore(store, opts) {
         lang,
         symbols: parsed.symbols,
         refs,
-        mtimeMs: Math.floor(stat11.mtimeMs),
+        mtimeMs: Math.floor(stat12.mtimeMs),
         symbolCount: parsed.symbols.length
       });
       deleteForFiles.push(file);
@@ -12083,7 +12559,7 @@ function shutdownCodebaseIndexHost() {
 function callIndexOp(op, args, opts) {
   const w = ensureWorker();
   if (!w) return callInline(op, args, opts);
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const id = nextRpcId++;
     const timer = setTimeout(() => {
       pending.delete(id);
@@ -12106,7 +12582,7 @@ function callIndexOp(op, args, opts) {
     pending.set(id, {
       resolve: (v) => {
         cleanup();
-        resolve7(v);
+        resolve8(v);
       },
       reject: (e) => {
         cleanup();
@@ -13168,6 +13644,6 @@ var TOOL_ICON_CONFIG = {
 };
 var FALLBACK_ICON = "fallback";
 
-export { CircuitBreaker, CircuitOpenError, FALLBACK_ICON, IndexCircuitBreaker, IndexTimeoutError, OPTIONAL_TOOLS, TIER1_TOOLS, TIER2_TOOLS, TIER3_TOOLS, TOOL_ICON_CONFIG, TOOL_ICON_MAP, _resetProcessRegistry, auditTool, bashTool, batchToolUseTool, builtinTools, builtinToolsPack, cancelPendingReindexes, codebaseIndexStats, codebaseIndexTool, codebaseSearchTool, codebaseStatsTool, configureExecPolicy, createGlobalPsSlashCommand, createModeTool, designTool, diffTool, documentTool, editTool, enqueueReindex, ensureSessionShell, execTool, fetchTool, forgetTool, formatGlobalStatus, formatInstanceList, formatInstanceSummary, formatTool, getExecAllowlist, getIndexState, getInstanceCount, getPersistentProcessRegistry, getProcessGuardian, getProcessRegistry, getToolIcon, gitTool, globTool, grepTool, indexCircuitBreaker, installTool, isExecCommandAllowed, isIndexReady, isIndexableFile, isIndexing, jsonTool, lintTool, listInstances, logsTool, normalizeShell, onIndexStateChange, outdatedTool, patchTool, planTool, readTool, relatedMemoryTool, rememberTool, replaceTool, resetExecPolicy, resetIndexCircuitBreaker, resetPersistentProcessRegistry, resolveSessionShell, runStartupIndex, scaffoldTool, searchCodebaseIndex, searchMemoryTool, searchTool, shutdownCodebaseIndexHost, startProcessGuardian, stopProcessGuardian, testTool, todoTool, toolHelpTool, toolSearchTool, toolUseTool, treeTool, typecheckTool, writeTool };
+export { CircuitBreaker, CircuitOpenError, FALLBACK_ICON, IndexCircuitBreaker, IndexTimeoutError, OPTIONAL_TOOLS, TIER1_TOOLS, TIER2_TOOLS, TIER3_TOOLS, TOOL_ICON_CONFIG, TOOL_ICON_MAP, _resetProcessRegistry, auditTool, bashTool, batchToolUseTool, builtinTools, builtinToolsPack, cancelPendingReindexes, codebaseIndexStats, codebaseIndexTool, codebaseSearchTool, codebaseStatsTool, configureDangerBypass, configureExecPolicy, createGlobalPsSlashCommand, createModeTool, designTool, detectDanger, diffTool, documentTool, editTool, enqueueReindex, ensureSessionShell, execTool, fetchTool, forgetTool, formatGlobalStatus, formatInstanceList, formatInstanceSummary, formatTool, getDangerBypass, getExecAllowlist, getIndexState, getInstanceCount, getPersistentProcessRegistry, getProcessGuardian, getProcessRegistry, getToolIcon, gitTool, globTool, grepTool, indexCircuitBreaker, installTool, isExecCommandAllowed, isIndexReady, isIndexableFile, isIndexing, jsonTool, lintTool, listInstances, logsTool, makeSkillTool, normalizeShell, onIndexStateChange, outdatedTool, patchTool, planTool, readTool, relatedMemoryTool, rememberTool, replaceTool, resetDangerBypass, resetExecPolicy, resetIndexCircuitBreaker, resetPersistentProcessRegistry, resolveSessionShell, runStartupIndex, scaffoldTool, searchCodebaseIndex, searchMemoryTool, searchTool, shutdownCodebaseIndexHost, startProcessGuardian, stopProcessGuardian, testTool, todoTool, toolHelpTool, toolSearchTool, toolUseTool, treeTool, typecheckTool, writeTool };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map