@wrongstack/tools 0.284.0 → 0.285.0

package/dist/languages/index.js

@@ -0,0 +1,4457 @@
+// src/languages/detect.ts
+import { createHash } from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+
+// src/languages/profile-helpers.ts
+var DEFAULT_TIMEOUT_MS = 12e4;
+var DEFAULT_OUTPUT_LIMIT_BYTES = 2e5;
+function processPlan(ctx, operation, command, args, options) {
+  return {
+    profileId: ctx.workspace.language,
+    workspaceId: ctx.workspace.id,
+    operation,
+    kind: "process",
+    command,
+    args: Object.freeze([...args]),
+    cwd: ctx.workspace.root,
+    env: Object.freeze({}),
+    timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+    outputLimitBytes: DEFAULT_OUTPUT_LIMIT_BYTES,
+    mutating: options.mutating ?? false,
+    network: options.network ?? false,
+    executesProjectCode: options.executesProjectCode ?? false,
+    reason: options.reason,
+    evidence: ctx.workspace.evidence,
+    parser: options.parser
+  };
+}
+function internalPlan(ctx, operation, parser, reason) {
+  return {
+    profileId: ctx.workspace.language,
+    workspaceId: ctx.workspace.id,
+    operation,
+    kind: "internal",
+    command: null,
+    args: Object.freeze([]),
+    cwd: ctx.workspace.root,
+    env: Object.freeze({}),
+    timeoutMs: 5e3,
+    outputLimitBytes: 32768,
+    mutating: false,
+    network: false,
+    executesProjectCode: false,
+    reason,
+    evidence: ctx.workspace.evidence,
+    parser
+  };
+}
+function unavailable(ctx, operation, reason) {
+  return {
+    status: "unavailable",
+    profileId: ctx.workspace.language,
+    workspaceId: ctx.workspace.id,
+    operation,
+    reason
+  };
+}
+function packageNames(ctx) {
+  return ctx.options.packages ?? [];
+}
+
+// src/languages/profiles/additional.ts
+var IGNORES = Object.freeze([
+  ".git",
+  ".wrongstack",
+  "node_modules",
+  "vendor",
+  "dist",
+  "build",
+  "coverage"
+]);
+function pythonProfile() {
+  return {
+    id: "python",
+    displayName: "Python",
+    extensions: Object.freeze([".py", ".pyi"]),
+    lspLanguageIds: Object.freeze(["python"]),
+    detectors: Object.freeze([
+      { kind: "config", filename: "pyproject.toml", weight: 90 },
+      { kind: "config", filename: "setup.py", weight: 70 },
+      { kind: "config", filename: "setup.cfg", weight: 60 },
+      { kind: "manifest", filename: "requirements.txt", weight: 55 },
+      { kind: "manifest", filename: "Pipfile", weight: 50 },
+      { kind: "lockfile", filename: "poetry.lock", weight: 30 },
+      { kind: "lockfile", filename: "Pipfile.lock", weight: 30 },
+      { kind: "lockfile", filename: "uv.lock", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["pip", "poetry", "pipenv", "uv"]),
+    executables: Object.freeze(["python", "python3", "ruff", "black", "pytest", "mypy", "pyright"]),
+    operations: Object.freeze({
+      syntax: async (ctx) => {
+        const py = ctx.options.target ? "python3" : "python3";
+        return ctx.options.target ? processPlan(ctx, "syntax", py, ["-m", "py_compile", ctx.options.target], {
+          parser: "python",
+          reason: "Compile the target file to check for syntax errors."
+        }) : unavailable(ctx, "syntax", "Python syntax check requires an explicit target file.");
+      },
+      semantic: async (ctx) => processPlan(ctx, "semantic", "mypy", [".", "--no-error-summary"], {
+        parser: "mypy",
+        reason: "Run mypy type checking on the workspace.",
+        executesProjectCode: true
+      }),
+      lint: async (ctx) => processPlan(ctx, "lint", "ruff", ["check", "."], {
+        parser: "ruff",
+        reason: "Run the Ruff linter on the workspace."
+      }),
+      "format-check": async (ctx) => processPlan(ctx, "format-check", "ruff", ["format", "--check", "."], {
+        parser: "ruff",
+        reason: "Check Python formatting without writing files."
+      }),
+      "format-write": async (ctx) => processPlan(ctx, "format-write", "ruff", ["format", "."], {
+        parser: "ruff",
+        reason: "Format Python source files.",
+        mutating: true
+      }),
+      test: async (ctx) => processPlan(
+        ctx,
+        "test",
+        "pytest",
+        [...ctx.options.filter ? ["-k", ctx.options.filter] : [], "."],
+        {
+          parser: "pytest",
+          reason: ctx.options.filter ? "Run filtered Python tests." : "Run all Python tests.",
+          mutating: true,
+          executesProjectCode: true
+        }
+      ),
+      build: async (ctx) => unavailable(ctx, "build", "Python is interpreted; use semantic or test instead."),
+      "debug-compile": async (ctx) => processPlan(ctx, "debug-compile", "mypy", [".", "--no-error-summary"], {
+        parser: "mypy",
+        reason: "Collect mypy type diagnostics.",
+        executesProjectCode: true
+      }),
+      "package-install": async (ctx) => processPlan(ctx, "package-install", "pip", ["install", "--no-cache-dir"], {
+        parser: "package-text",
+        reason: "Install dependencies from requirements.",
+        mutating: true,
+        network: true
+      }),
+      "package-add": async (ctx) => {
+        const names = packageNames(ctx);
+        return names.length === 0 ? unavailable(ctx, "package-add", "At least one package name is required.") : processPlan(ctx, "package-add", "pip", ["install", ...names], {
+          parser: "package-text",
+          reason: "Install specified Python packages.",
+          mutating: true,
+          network: true
+        });
+      },
+      "package-audit": async (ctx) => processPlan(ctx, "package-audit", "pip", ["audit"], {
+        parser: "pip-audit",
+        reason: "Audit Python dependencies for vulnerabilities.",
+        network: true
+      }),
+      run: async (ctx) => {
+        const entries = ["main.py", "app.py", "__main__.py", "manage.py"];
+        const first = (await Promise.all(
+          entries.map((name) => ctx.pathExists(name).then((ok) => ok ? name : void 0))
+        )).find(Boolean);
+        const args = first ? [first] : [];
+        return processPlan(ctx, "run", "python3", args, {
+          parser: "command-text",
+          reason: first ? `Run the Python entry point ${first}.` : "Run the Python project (no common entry point detected \u2014 add the module path manually).",
+          executesProjectCode: true,
+          mutating: true
+        });
+      }
+    })
+  };
+}
+function hasGradleEvidence(ctx) {
+  return ctx.workspace.evidence.some(
+    (e) => e.kind === "manifest" && (e.value === "build.gradle" || e.value === "build.gradle.kts" || e.value === "settings.gradle") || e.kind === "lockfile" && e.value === "gradle.lockfile"
+  );
+}
+async function gradleRunner(ctx) {
+  if (await ctx.pathExists("gradlew")) return "gradlew";
+  return "gradle";
+}
+function javaProfile() {
+  return {
+    id: "java",
+    displayName: "Java / Kotlin",
+    extensions: Object.freeze([".java", ".kt", ".kts", ".scala"]),
+    lspLanguageIds: Object.freeze(["java", "kotlin"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "pom.xml", weight: 90 },
+      { kind: "manifest", filename: "build.gradle", weight: 85 },
+      { kind: "manifest", filename: "build.gradle.kts", weight: 85 },
+      { kind: "manifest", filename: "settings.gradle", weight: 50 },
+      { kind: "lockfile", filename: "gradle.lockfile", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["maven", "gradle"]),
+    executables: Object.freeze(["mvn", "gradle", "gradlew", "java", "kotlinc"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => {
+        const isGradle = hasGradleEvidence(ctx);
+        const runner = isGradle ? await gradleRunner(ctx) : "mvn";
+        const args = isGradle ? ["compileJava"] : ["compile", "-q"];
+        const reason = isGradle ? "Compile the Gradle project." : "Compile the Maven project.";
+        return processPlan(ctx, "semantic", runner, args, {
+          parser: isGradle ? "gradle" : "maven",
+          reason,
+          mutating: true,
+          executesProjectCode: true
+        });
+      },
+      lint: async (ctx) => unavailable(
+        ctx,
+        "lint",
+        "Java linting requires a configured checkstyle or spotbugs plugin."
+      ),
+      "format-check": async (ctx) => unavailable(
+        ctx,
+        "format-check",
+        "Java formatting check requires a configured spotless or google-java-format plugin."
+      ),
+      test: async (ctx) => {
+        const isGradle = hasGradleEvidence(ctx);
+        const runner = isGradle ? await gradleRunner(ctx) : "mvn";
+        const args = isGradle ? ["test"] : ["test", "-q"];
+        const reason = isGradle ? "Run Gradle tests." : "Run Maven tests.";
+        return processPlan(ctx, "test", runner, args, {
+          parser: isGradle ? "gradle" : "maven",
+          reason,
+          mutating: true,
+          executesProjectCode: true
+        });
+      },
+      build: async (ctx) => {
+        const isGradle = hasGradleEvidence(ctx);
+        const runner = isGradle ? await gradleRunner(ctx) : "mvn";
+        const args = isGradle ? ["build"] : ["package", "-q", "-DskipTests"];
+        const reason = isGradle ? "Build the Gradle project." : "Build the Maven project, skipping tests.";
+        return processPlan(ctx, "build", runner, args, {
+          parser: isGradle ? "gradle" : "maven",
+          reason,
+          mutating: true,
+          executesProjectCode: true
+        });
+      },
+      run: async (ctx) => {
+        if (!hasGradleEvidence(ctx))
+          return unavailable(
+            ctx,
+            "run",
+            "Maven run requires exec-maven-plugin configuration. Use `mvn exec:java -q` manually."
+          );
+        const runner = await gradleRunner(ctx);
+        return processPlan(ctx, "run", runner, ["run"], {
+          parser: "command-text",
+          reason: `Run the Gradle project entry point via ${runner}.`,
+          executesProjectCode: true,
+          mutating: true
+        });
+      },
+      "package-install": async (ctx) => unavailable(
+        ctx,
+        "package-install",
+        "JVM dependency installation happens through build or dependency:get."
+      ),
+      "package-add": async (ctx) => {
+        const names = packageNames(ctx);
+        return names.length === 0 ? unavailable(ctx, "package-add", "At least one dependency coordinate is required.") : processPlan(ctx, "package-add", "mvn", ["dependency:get", `-Dartifact=${names[0]}`], {
+          parser: "maven",
+          reason: "Resolve and fetch a Maven dependency.",
+          mutating: true,
+          network: true
+        });
+      }
+    })
+  };
+}
+function rubyProfile() {
+  return {
+    id: "ruby",
+    displayName: "Ruby",
+    extensions: Object.freeze([".rb"]),
+    lspLanguageIds: Object.freeze(["ruby"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "Gemfile", weight: 90 },
+      { kind: "config", filename: ".ruby-version", weight: 40 },
+      { kind: "lockfile", filename: "Gemfile.lock", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["gem", "bundler"]),
+    executables: Object.freeze(["ruby", "gem", "bundle", "rubocop", "rspec"]),
+    operations: Object.freeze({
+      syntax: async (ctx) => ctx.options.target ? processPlan(ctx, "syntax", "ruby", ["-c", ctx.options.target], {
+        parser: "ruby",
+        reason: "Check the target Ruby file for syntax errors."
+      }) : unavailable(ctx, "syntax", "Ruby syntax check requires an explicit target file."),
+      lint: async (ctx) => processPlan(ctx, "lint", "rubocop", ["--format=json"], {
+        parser: "rubocop",
+        reason: "Run RuboCop linter.",
+        executesProjectCode: true
+      }),
+      "format-write": async (ctx) => processPlan(ctx, "format-write", "rubocop", ["--auto-correct"], {
+        parser: "rubocop",
+        reason: "Auto-correct RuboCop violations.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      test: async (ctx) => processPlan(ctx, "test", "rspec", [], {
+        parser: "rspec",
+        reason: "Run the RSpec test suite.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      "package-install": async (ctx) => processPlan(ctx, "package-install", "bundle", ["install"], {
+        parser: "package-text",
+        reason: "Install Ruby gem dependencies.",
+        mutating: true,
+        network: true,
+        executesProjectCode: true
+      }),
+      "package-add": async (ctx) => {
+        const names = packageNames(ctx);
+        return names.length === 0 ? unavailable(ctx, "package-add", "At least one gem name is required.") : processPlan(ctx, "package-add", "gem", ["install", ...names], {
+          parser: "package-text",
+          reason: "Install specified Ruby gems.",
+          mutating: true,
+          network: true
+        });
+      },
+      "package-audit": async (ctx) => processPlan(ctx, "package-audit", "bundle", ["audit", "--format=json"], {
+        parser: "bundler-audit",
+        reason: "Audit Ruby gems for vulnerabilities.",
+        network: true
+      }),
+      run: async (ctx) => {
+        const entries = ["main.rb", "app.rb", "server.rb", "config.ru"];
+        const first = (await Promise.all(
+          entries.map((name) => ctx.pathExists(name).then((ok) => ok ? name : void 0))
+        )).find(Boolean);
+        const hasGemfile = await ctx.pathExists("Gemfile");
+        const cmd = hasGemfile ? "bundle" : "ruby";
+        const args = hasGemfile ? ["exec", "ruby", first ?? ""] : [first ?? ""];
+        return processPlan(ctx, "run", cmd, args, {
+          parser: "command-text",
+          reason: first ? `Run the Ruby entry point ${first}.` : "Run the Ruby project (no common entry point detected \u2014 add the file path manually).",
+          executesProjectCode: true,
+          mutating: true
+        });
+      }
+    })
+  };
+}
+function cProfile() {
+  return {
+    id: "c",
+    displayName: "C / C++",
+    extensions: Object.freeze([".c", ".h"]),
+    lspLanguageIds: Object.freeze(["c"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "CMakeLists.txt", weight: 85 },
+      { kind: "manifest", filename: "Makefile", weight: 60 },
+      { kind: "config", suffix: ".cmake", weight: 50 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze([]),
+    executables: Object.freeze(["cc", "gcc", "clang", "cmake", "make"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => processPlan(ctx, "semantic", "cmake", ["--build", ".", "--target", "all"], {
+        parser: "cmake",
+        reason: "Build C project to collect compiler diagnostics.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      test: async (ctx) => unavailable(
+        ctx,
+        "test",
+        "C test execution requires a configured test runner (ctest, etc.)."
+      ),
+      build: async (ctx) => processPlan(ctx, "build", "cmake", ["--build", "."], {
+        parser: "cmake",
+        reason: "Build the C project.",
+        mutating: true,
+        executesProjectCode: true
+      })
+    })
+  };
+}
+function cppProfile() {
+  return {
+    ...cProfile(),
+    id: "cpp",
+    displayName: "C++",
+    extensions: Object.freeze([".cpp", ".cc", ".cxx", ".hpp", ".hxx"]),
+    lspLanguageIds: Object.freeze(["cpp"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "CMakeLists.txt", weight: 85 },
+      { kind: "manifest", filename: "Makefile", weight: 50 }
+    ]),
+    executables: Object.freeze(["c++", "g++", "clang++", "cmake", "make"])
+  };
+}
+function swiftProfile() {
+  return {
+    id: "swift",
+    displayName: "Swift",
+    extensions: Object.freeze([".swift"]),
+    lspLanguageIds: Object.freeze(["swift"]),
+    detectors: Object.freeze([{ kind: "manifest", filename: "Package.swift", weight: 90 }]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["swift"]),
+    executables: Object.freeze(["swift", "swiftc"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => processPlan(ctx, "semantic", "swift", ["build"], {
+        parser: "swift",
+        reason: "Build Swift package to collect compiler diagnostics.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      test: async (ctx) => processPlan(ctx, "test", "swift", ["test"], {
+        parser: "swift-test",
+        reason: "Run Swift tests.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      build: async (ctx) => processPlan(ctx, "build", "swift", ["build", "-c", "release"], {
+        parser: "swift",
+        reason: "Build the Swift package in release mode.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      run: async (ctx) => processPlan(ctx, "run", "swift", ["run"], {
+        parser: "command-text",
+        reason: "Run the Swift package entry point.",
+        executesProjectCode: true
+      })
+    })
+  };
+}
+function dartProfile() {
+  return {
+    id: "dart",
+    displayName: "Dart / Flutter",
+    extensions: Object.freeze([".dart"]),
+    lspLanguageIds: Object.freeze(["dart"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "pubspec.yaml", weight: 90 },
+      { kind: "lockfile", filename: "pubspec.lock", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["pub"]),
+    executables: Object.freeze(["dart", "flutter"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => processPlan(ctx, "semantic", "dart", ["analyze"], {
+        parser: "dart-analyze",
+        reason: "Run Dart static analysis."
+      }),
+      "format-check": async (ctx) => processPlan(
+        ctx,
+        "format-check",
+        "dart",
+        ["format", "--output=none", "--set-exit-if-changed", "."],
+        {
+          parser: "dart-format",
+          reason: "Check Dart formatting without writing files."
+        }
+      ),
+      "format-write": async (ctx) => processPlan(ctx, "format-write", "dart", ["format", "."], {
+        parser: "dart-format",
+        reason: "Format Dart source files.",
+        mutating: true
+      }),
+      test: async (ctx) => processPlan(ctx, "test", "dart", ["test"], {
+        parser: "dart-test",
+        reason: "Run Dart tests.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      "package-install": async (ctx) => processPlan(ctx, "package-install", "dart", ["pub", "get"], {
+        parser: "package-text",
+        reason: "Fetch Dart package dependencies.",
+        mutating: true,
+        network: true
+      }),
+      "package-outdated": async (ctx) => processPlan(ctx, "package-outdated", "dart", ["pub", "outdated"], {
+        parser: "dart-outdated",
+        reason: "Check for outdated Dart packages.",
+        network: true
+      }),
+      run: async (ctx) => processPlan(ctx, "run", "dart", ["run"], {
+        parser: "command-text",
+        reason: "Run the Dart / Flutter project entry point.",
+        executesProjectCode: true
+      })
+    })
+  };
+}
+function denoProfile() {
+  return {
+    id: "deno",
+    displayName: "Deno",
+    extensions: Object.freeze([".ts", ".tsx", ".js", ".jsx"]),
+    lspLanguageIds: Object.freeze(["typescript", "javascript"]),
+    detectors: Object.freeze([
+      { kind: "config", filename: "deno.json", weight: 90 },
+      { kind: "config", filename: "deno.jsonc", weight: 90 },
+      { kind: "config", filename: "import_map.json", weight: 60 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze([]),
+    executables: Object.freeze(["deno"]),
+    // .ts/.js extensions are shared with the TypeScript/JavaScript profiles;
+    // only a deno.json(c)/import_map.json detector hit may establish a workspace.
+    sourceFallback: false,
+    operations: Object.freeze({
+      test: async (ctx) => processPlan(ctx, "test", "deno", ["test"], {
+        parser: "deno-test",
+        reason: "Run Deno tests.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      run: async (ctx) => processPlan(ctx, "run", "deno", ["run", "--allow-all", "main.ts"], {
+        parser: "command-text",
+        reason: "Run the Deno project entry point with full permission.",
+        executesProjectCode: true,
+        mutating: true
+      })
+    })
+  };
+}
+function elixirProfile() {
+  return {
+    id: "elixir",
+    displayName: "Elixir",
+    extensions: Object.freeze([".ex", ".exs"]),
+    lspLanguageIds: Object.freeze(["elixir"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "mix.exs", weight: 90 },
+      { kind: "lockfile", filename: "mix.lock", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["mix"]),
+    executables: Object.freeze(["mix", "elixir"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => unavailable(ctx, "semantic", "Elixir compilation is handled by the build operation."),
+      lint: async (ctx) => unavailable(ctx, "lint", "Elixir linting requires the credo package."),
+      test: async (ctx) => processPlan(ctx, "test", "mix", ["test"], {
+        parser: "mix-test",
+        reason: "Run ExUnit tests.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      build: async (ctx) => processPlan(ctx, "build", "mix", ["compile"], {
+        parser: "mix",
+        reason: "Compile the Mix project.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      run: async (ctx) => processPlan(ctx, "run", "mix", ["run"], {
+        parser: "command-text",
+        reason: "Run the Mix project entry point.",
+        executesProjectCode: true
+      }),
+      "package-install": async (ctx) => processPlan(ctx, "package-install", "mix", ["deps.get"], {
+        parser: "package-text",
+        reason: "Fetch Elixir dependencies.",
+        mutating: true,
+        network: true
+      })
+    })
+  };
+}
+function shellProfile() {
+  return {
+    id: "shell",
+    displayName: "Shell",
+    extensions: Object.freeze([".sh", ".bash"]),
+    lspLanguageIds: Object.freeze(["shellscript"]),
+    detectors: Object.freeze([{ kind: "config", filename: "ShellCheckrc", weight: 50 }]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze([]),
+    executables: Object.freeze(["bash", "sh", "shellcheck", "shfmt"]),
+    operations: Object.freeze({
+      syntax: async (ctx) => ctx.options.target ? processPlan(ctx, "syntax", "bash", ["-n", ctx.options.target], {
+        parser: "shell",
+        reason: "Check the shell script for syntax errors."
+      }) : unavailable(ctx, "syntax", "Shell syntax check requires an explicit target file."),
+      lint: async (ctx) => ctx.options.target ? processPlan(ctx, "lint", "shellcheck", ["--format=json", ctx.options.target], {
+        parser: "shellcheck",
+        reason: "Run ShellCheck on the target script."
+      }) : unavailable(ctx, "lint", "Shell linting requires an explicit target file."),
+      "format-check": async (ctx) => ctx.options.target ? processPlan(ctx, "format-check", "shfmt", ["-d", ctx.options.target], {
+        parser: "shell",
+        reason: "Check shell formatting without writing."
+      }) : unavailable(
+        ctx,
+        "format-check",
+        "Shell formatting check requires an explicit target file."
+      ),
+      "format-write": async (ctx) => ctx.options.target ? processPlan(ctx, "format-write", "shfmt", ["-w", ctx.options.target], {
+        parser: "shell",
+        reason: "Format the shell script.",
+        mutating: true
+      }) : unavailable(ctx, "format-write", "Shell formatting requires an explicit target file.")
+    })
+  };
+}
+var ADDITIONAL_LANGUAGE_PROFILES = Object.freeze([
+  pythonProfile(),
+  javaProfile(),
+  rubyProfile(),
+  cProfile(),
+  cppProfile(),
+  swiftProfile(),
+  dartProfile(),
+  denoProfile(),
+  elixirProfile(),
+  shellProfile()
+]);
+
+// src/languages/profiles/primary.ts
+var COMMON_IGNORES = Object.freeze([
+  ".git",
+  ".wrongstack",
+  "node_modules",
+  "vendor",
+  "target",
+  "bin",
+  "obj",
+  "dist",
+  "build",
+  "coverage"
+]);
+function nodeManager(ctx) {
+  const lockfiles = new Set(
+    ctx.workspace.evidence.filter((evidence) => evidence.kind === "lockfile").map((evidence) => evidence.value.toLowerCase())
+  );
+  if (lockfiles.size > 1 && !ctx.workspace.packageManager) return void 0;
+  return ctx.workspace.packageManager ?? "npm";
+}
+function scriptPlan(ctx, operation, script) {
+  const manager = nodeManager(ctx);
+  if (!manager)
+    return unavailable(
+      ctx,
+      operation,
+      "Conflicting Node lockfiles make the package manager ambiguous."
+    );
+  const args = manager === "npm" ? ["run", script] : [script];
+  return processPlan(ctx, operation, manager, args, {
+    parser: "command-text",
+    reason: `Run the detected ${manager} ${script} script for this workspace.`,
+    mutating: true,
+    executesProjectCode: true
+  });
+}
+function nodeExec(ctx, executable, args) {
+  const manager = ctx.workspace.packageManager ?? "npm";
+  if (manager === "pnpm") return { command: "pnpm", args: ["exec", executable, ...args] };
+  if (manager === "yarn") return { command: "yarn", args: ["exec", executable, ...args] };
+  if (manager === "bun") return { command: "bun", args: ["x", executable, ...args] };
+  return { command: "npx", args: ["--no-install", executable, ...args] };
+}
+function typescriptProfile() {
+  return {
+    id: "typescript",
+    displayName: "TypeScript",
+    extensions: Object.freeze([".ts", ".tsx", ".mts", ".cts"]),
+    lspLanguageIds: Object.freeze(["typescript", "typescriptreact"]),
+    detectors: Object.freeze([
+      { kind: "config", filename: "tsconfig.json", weight: 90 },
+      { kind: "manifest", filename: "package.json", weight: 55 },
+      { kind: "lockfile", filename: "pnpm-lock.yaml", weight: 30 },
+      { kind: "lockfile", filename: "yarn.lock", weight: 30 },
+      { kind: "lockfile", filename: "package-lock.json", weight: 30 },
+      { kind: "lockfile", filename: "bun.lock", weight: 30 },
+      { kind: "lockfile", filename: "bun.lockb", weight: 30 }
+    ]),
+    ignoredDirectories: COMMON_IGNORES,
+    packageManagers: Object.freeze(["pnpm", "yarn", "bun", "npm"]),
+    executables: Object.freeze(["pnpm", "yarn", "bun", "npx", "npm"]),
+    operations: Object.freeze({
+      syntax: async (ctx) => internalPlan(
+        ctx,
+        "syntax",
+        "typescript-parser",
+        "Parse the target with the TypeScript compiler API."
+      ),
+      semantic: async (ctx) => {
+        const run = nodeExec(ctx, "tsc", ["--noEmit", "--pretty", "false"]);
+        return processPlan(ctx, "semantic", run.command, run.args, {
+          parser: "typescript",
+          reason: "Run the workspace TypeScript compiler without emitting files.",
+          executesProjectCode: true
+        });
+      },
+      lint: async (ctx) => {
+        const run = nodeExec(ctx, "biome", ["lint", "."]);
+        return processPlan(ctx, "lint", run.command, run.args, {
+          parser: "biome",
+          reason: "Run the project-local Biome linter.",
+          executesProjectCode: true
+        });
+      },
+      "format-check": async (ctx) => {
+        const run = nodeExec(ctx, "biome", ["format", "--check", "."]);
+        return processPlan(ctx, "format-check", run.command, run.args, {
+          parser: "biome",
+          reason: "Check formatting with the project-local Biome formatter.",
+          executesProjectCode: true
+        });
+      },
+      "format-write": async (ctx) => {
+        const run = nodeExec(ctx, "biome", ["format", "--write", "."]);
+        return processPlan(ctx, "format-write", run.command, run.args, {
+          parser: "biome",
+          reason: "Format the workspace with the project-local Biome formatter.",
+          mutating: true,
+          executesProjectCode: true
+        });
+      },
+      test: async (ctx) => ctx.options.filter || ctx.options.coverage ? unavailable(
+        ctx,
+        "test",
+        "The detected package script does not expose deterministic filter or coverage adapters."
+      ) : scriptPlan(ctx, "test", "test"),
+      build: async (ctx) => scriptPlan(ctx, "build", "build"),
+      run: async (ctx) => scriptPlan(ctx, "run", "dev"),
+      "debug-compile": async (ctx) => {
+        const run = nodeExec(ctx, "tsc", ["--noEmit", "--pretty", "false"]);
+        return processPlan(ctx, "debug-compile", run.command, run.args, {
+          parser: "typescript",
+          reason: "Collect deterministic TypeScript compiler diagnostics.",
+          executesProjectCode: true
+        });
+      },
+      "package-install": async (ctx) => {
+        const manager = ctx.workspace.packageManager ?? "npm";
+        const args = manager === "yarn" ? ["install", "--ignore-scripts"] : ["install", "--ignore-scripts"];
+        return processPlan(ctx, "package-install", manager, args, {
+          parser: "package-text",
+          reason: `Restore declared dependencies with ${manager} and lifecycle scripts disabled.`,
+          mutating: true,
+          network: true,
+          executesProjectCode: false
+        });
+      },
+      "package-add": async (ctx) => {
+        const names = packageNames(ctx);
+        if (names.length === 0)
+          return unavailable(ctx, "package-add", "At least one package name is required.");
+        const manager = ctx.workspace.packageManager ?? "npm";
+        const args = manager === "npm" ? ["install", "--ignore-scripts", ...names] : ["add", "--ignore-scripts", ...names];
+        return processPlan(ctx, "package-add", manager, args, {
+          parser: "package-text",
+          reason: `Add validated packages with ${manager} and lifecycle scripts disabled.`,
+          mutating: true,
+          network: true
+        });
+      },
+      "package-audit": async (ctx) => {
+        const manager = ctx.workspace.packageManager ?? "npm";
+        return processPlan(ctx, "package-audit", manager, ["audit", "--json"], {
+          parser: "npm-audit",
+          reason: `Audit dependencies with the detected ${manager} package manager.`,
+          network: true
+        });
+      },
+      "package-outdated": async (ctx) => {
+        const manager = ctx.workspace.packageManager ?? "npm";
+        return processPlan(ctx, "package-outdated", manager, ["outdated", "--json"], {
+          parser: "npm-outdated",
+          reason: `Check outdated dependencies with ${manager}.`,
+          network: true
+        });
+      }
+    })
+  };
+}
+function javascriptProfile() {
+  const ts = typescriptProfile();
+  return {
+    ...ts,
+    id: "javascript",
+    displayName: "JavaScript",
+    extensions: Object.freeze([".js", ".jsx", ".mjs", ".cjs"]),
+    lspLanguageIds: Object.freeze(["javascript", "javascriptreact"]),
+    detectors: Object.freeze([
+      { kind: "config", filename: "jsconfig.json", weight: 90 },
+      { kind: "manifest", filename: "package.json", weight: 70 },
+      { kind: "lockfile", filename: "pnpm-lock.yaml", weight: 30 },
+      { kind: "lockfile", filename: "yarn.lock", weight: 30 },
+      { kind: "lockfile", filename: "package-lock.json", weight: 30 },
+      { kind: "lockfile", filename: "bun.lock", weight: 30 },
+      { kind: "lockfile", filename: "bun.lockb", weight: 30 }
+    ]),
+    operations: Object.freeze({
+      ...ts.operations,
+      syntax: async (ctx) => internalPlan(
+        ctx,
+        "syntax",
+        "typescript-parser",
+        "Parse JavaScript with the TypeScript compiler API."
+      )
+    })
+  };
+}
+var goProfile = {
+  id: "go",
+  displayName: "Go",
+  extensions: Object.freeze([".go"]),
+  lspLanguageIds: Object.freeze(["go"]),
+  detectors: Object.freeze([
+    { kind: "manifest", filename: "go.mod", weight: 90 },
+    { kind: "manifest", filename: "go.work", weight: 95 },
+    { kind: "lockfile", filename: "go.sum", weight: 30 }
+  ]),
+  ignoredDirectories: COMMON_IGNORES,
+  packageManagers: Object.freeze(["go"]),
+  executables: Object.freeze(["go", "gofmt"]),
+  operations: Object.freeze({
+    syntax: async (ctx) => {
+      if (!ctx.target)
+        return unavailable(ctx, "syntax", "Go syntax planning requires a target file.");
+      return processPlan(ctx, "syntax", "gofmt", ["-e", "-d", ctx.target], {
+        parser: "gofmt",
+        reason: "Parse the target and report syntax errors without writing it."
+      });
+    },
+    semantic: async (ctx) => processPlan(ctx, "semantic", "go", ["test", "-run", "^$", "./..."], {
+      parser: "go-test",
+      reason: "Compile all Go packages without selecting tests.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    lint: async (ctx) => processPlan(ctx, "lint", "go", ["vet", "./..."], {
+      parser: "go-compiler",
+      reason: "Run the standard Go vet checks.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    "format-check": async (ctx) => ctx.target ? processPlan(ctx, "format-check", "gofmt", ["-d", ctx.target], {
+      parser: "gofmt",
+      reason: "Report Go formatting differences for the target without writing it."
+    }) : unavailable(ctx, "format-check", "Go formatting requires an explicit target file."),
+    "format-write": async (ctx) => ctx.target ? processPlan(ctx, "format-write", "gofmt", ["-w", ctx.target], {
+      parser: "gofmt",
+      reason: "Format the target Go source file.",
+      mutating: true
+    }) : unavailable(ctx, "format-write", "Go formatting requires an explicit target file."),
+    test: async (ctx) => processPlan(
+      ctx,
+      "test",
+      "go",
+      ["test", ...ctx.options.filter ? ["-run", ctx.options.filter] : [], "./..."],
+      {
+        parser: "go-test",
+        reason: ctx.options.filter ? "Run filtered Go tests." : "Run all Go tests.",
+        mutating: true,
+        executesProjectCode: true
+      }
+    ),
+    build: async (ctx) => processPlan(ctx, "build", "go", ["build", "./..."], {
+      parser: "go-compiler",
+      reason: "Build all Go packages.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    run: async (ctx) => processPlan(ctx, "run", "go", ["run", "."], {
+      parser: "command-text",
+      reason: "Run the Go module entry point.",
+      executesProjectCode: true
+    }),
+    "debug-race": async (ctx) => processPlan(ctx, "debug-race", "go", ["test", "-race", "./..."], {
+      parser: "go-test",
+      reason: "Collect Go race-detector evidence.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    "package-install": async (ctx) => processPlan(ctx, "package-install", "go", ["mod", "download"], {
+      parser: "go-module",
+      reason: "Download the dependencies declared by go.mod.",
+      mutating: true,
+      network: true
+    }),
+    "package-add": async (ctx) => {
+      const names = packageNames(ctx);
+      if (names.length === 0)
+        return unavailable(ctx, "package-add", "At least one Go module is required.");
+      return processPlan(ctx, "package-add", "go", ["get", ...names], {
+        parser: "go-module",
+        reason: "Add validated Go modules.",
+        mutating: true,
+        network: true
+      });
+    },
+    "package-update": async (ctx) => processPlan(ctx, "package-update", "go", ["get", "-u", "./..."], {
+      parser: "go-module",
+      reason: "Update dependencies of all Go packages.",
+      mutating: true,
+      network: true
+    })
+  })
+};
+var rustProfile = {
+  id: "rust",
+  displayName: "Rust",
+  extensions: Object.freeze([".rs"]),
+  lspLanguageIds: Object.freeze(["rust"]),
+  detectors: Object.freeze([
+    { kind: "manifest", filename: "Cargo.toml", weight: 90 },
+    { kind: "lockfile", filename: "Cargo.lock", weight: 30 }
+  ]),
+  ignoredDirectories: COMMON_IGNORES,
+  packageManagers: Object.freeze(["cargo"]),
+  executables: Object.freeze(["cargo"]),
+  operations: Object.freeze({
+    syntax: async (ctx) => processPlan(ctx, "syntax", "cargo", ["check", "--message-format=json"], {
+      parser: "cargo-json",
+      reason: "Check Rust syntax and semantics with Cargo.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    semantic: async (ctx) => processPlan(ctx, "semantic", "cargo", ["check", "--message-format=json"], {
+      parser: "cargo-json",
+      reason: "Collect Rust compiler diagnostics with Cargo check.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    lint: async (ctx) => processPlan(ctx, "lint", "cargo", ["clippy", "--message-format=json"], {
+      parser: "cargo-json",
+      reason: "Run Clippy for this crate.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    "format-check": async (ctx) => processPlan(ctx, "format-check", "cargo", ["fmt", "--check"], {
+      parser: "cargo-fmt",
+      reason: "Check Rust formatting without writing files."
+    }),
+    "format-write": async (ctx) => processPlan(ctx, "format-write", "cargo", ["fmt"], {
+      parser: "cargo-fmt",
+      reason: "Format Rust source files in the workspace.",
+      mutating: true
+    }),
+    "test-compile": async (ctx) => processPlan(ctx, "test-compile", "cargo", ["test", "--no-run", "--message-format=json"], {
+      parser: "cargo-json",
+      reason: "Compile Rust tests without running them.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    test: async (ctx) => processPlan(
+      ctx,
+      "test",
+      "cargo",
+      ["test", ...ctx.options.filter ? [ctx.options.filter] : []],
+      {
+        parser: "cargo-test",
+        reason: ctx.options.filter ? "Run filtered Rust tests." : "Run Rust tests.",
+        mutating: true,
+        executesProjectCode: true
+      }
+    ),
+    build: async (ctx) => processPlan(ctx, "build", "cargo", ["build", "--message-format=json"], {
+      parser: "cargo-json",
+      reason: "Build the Rust workspace.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    run: async (ctx) => processPlan(ctx, "run", "cargo", ["run"], {
+      parser: "command-text",
+      reason: "Run the Rust workspace entry point.",
+      executesProjectCode: true
+    }),
+    "package-install": async (ctx) => processPlan(ctx, "package-install", "cargo", ["fetch", "--locked"], {
+      parser: "cargo-json",
+      reason: "Fetch locked Rust dependencies.",
+      mutating: true,
+      network: true
+    }),
+    "package-add": async (ctx) => {
+      const names = packageNames(ctx);
+      return names.length === 0 ? unavailable(ctx, "package-add", "At least one crate is required.") : processPlan(ctx, "package-add", "cargo", ["add", ...names], {
+        parser: "cargo-text",
+        reason: "Add validated Rust crates.",
+        mutating: true,
+        network: true
+      });
+    },
+    "package-remove": async (ctx) => {
+      const names = packageNames(ctx);
+      return names.length === 0 ? unavailable(ctx, "package-remove", "At least one crate is required.") : processPlan(ctx, "package-remove", "cargo", ["remove", ...names], {
+        parser: "cargo-text",
+        reason: "Remove validated Rust crates.",
+        mutating: true
+      });
+    },
+    "package-update": async (ctx) => processPlan(ctx, "package-update", "cargo", ["update"], {
+      parser: "cargo-text",
+      reason: "Update the Cargo lockfile.",
+      mutating: true,
+      network: true
+    }),
+    "package-audit": async (ctx) => processPlan(ctx, "package-audit", "cargo", ["audit", "--json"], {
+      parser: "cargo-audit",
+      reason: "Audit Rust dependencies when cargo-audit is installed.",
+      network: true
+    })
+  })
+};
+var phpProfile = {
+  id: "php",
+  displayName: "PHP",
+  extensions: Object.freeze([".php"]),
+  lspLanguageIds: Object.freeze(["php"]),
+  detectors: Object.freeze([
+    { kind: "manifest", filename: "composer.json", weight: 90 },
+    { kind: "lockfile", filename: "composer.lock", weight: 30 },
+    { kind: "config", filename: "phpunit.xml", weight: 25 },
+    { kind: "config", filename: "phpunit.xml.dist", weight: 25 }
+  ]),
+  ignoredDirectories: COMMON_IGNORES,
+  packageManagers: Object.freeze(["composer"]),
+  executables: Object.freeze(["php", "composer"]),
+  operations: Object.freeze({
+    syntax: async (ctx) => ctx.target ? processPlan(ctx, "syntax", "php", ["-l", ctx.target], {
+      parser: "php-lint",
+      reason: "Lint the target PHP file without executing it."
+    }) : unavailable(ctx, "syntax", "PHP syntax planning requires a target file."),
+    semantic: async (ctx) => unavailable(
+      ctx,
+      "semantic",
+      "No configured PHPStan or Psalm adapter was detected in Phase 1."
+    ),
+    test: async (ctx) => processPlan(
+      ctx,
+      "test",
+      "php",
+      ["vendor/bin/phpunit", ...ctx.options.filter ? ["--filter", ctx.options.filter] : []],
+      {
+        parser: "phpunit",
+        reason: ctx.options.filter ? "Run filtered tests with the project-local PHPUnit runner." : "Run the project-local PHPUnit test runner.",
+        executesProjectCode: true
+      }
+    ),
+    "package-install": async (ctx) => processPlan(
+      ctx,
+      "package-install",
+      "composer",
+      ["install", "--no-interaction", "--no-scripts"],
+      {
+        parser: "composer",
+        reason: "Restore Composer dependencies without scripts.",
+        mutating: true,
+        network: true
+      }
+    ),
+    "package-add": async (ctx) => {
+      const names = packageNames(ctx);
+      return names.length === 0 ? unavailable(ctx, "package-add", "At least one Composer package is required.") : processPlan(
+        ctx,
+        "package-add",
+        "composer",
+        ["require", "--no-interaction", "--no-scripts", ...names],
+        {
+          parser: "composer",
+          reason: "Add validated Composer packages without scripts.",
+          mutating: true,
+          network: true
+        }
+      );
+    },
+    "package-remove": async (ctx) => {
+      const names = packageNames(ctx);
+      return names.length === 0 ? unavailable(ctx, "package-remove", "At least one Composer package is required.") : processPlan(
+        ctx,
+        "package-remove",
+        "composer",
+        ["remove", "--no-interaction", "--no-scripts", ...names],
+        {
+          parser: "composer",
+          reason: "Remove validated Composer packages without scripts.",
+          mutating: true
+        }
+      );
+    },
+    "package-update": async (ctx) => processPlan(
+      ctx,
+      "package-update",
+      "composer",
+      ["update", "--no-interaction", "--no-scripts"],
+      {
+        parser: "composer",
+        reason: "Update Composer dependencies without scripts.",
+        mutating: true,
+        network: true
+      }
+    ),
+    "package-audit": async (ctx) => processPlan(ctx, "package-audit", "composer", ["audit", "--format=json"], {
+      parser: "composer-audit",
+      reason: "Audit Composer dependencies.",
+      network: true
+    }),
+    "package-outdated": async (ctx) => processPlan(ctx, "package-outdated", "composer", ["outdated", "--format=json"], {
+      parser: "composer-outdated",
+      reason: "Check outdated Composer dependencies.",
+      network: true
+    })
+  })
+};
+var csharpProfile = {
+  id: "csharp",
+  displayName: "C# / .NET",
+  extensions: Object.freeze([".cs"]),
+  lspLanguageIds: Object.freeze(["csharp"]),
+  detectors: Object.freeze([
+    { kind: "config", filename: "global.json", weight: 25 },
+    { kind: "manifest", suffix: ".slnx", weight: 95 },
+    { kind: "manifest", suffix: ".sln", weight: 95 },
+    { kind: "manifest", suffix: ".csproj", weight: 90 },
+    { kind: "manifest", suffix: ".fsproj", weight: 90 },
+    { kind: "lockfile", filename: "packages.lock.json", weight: 30 }
+  ]),
+  ignoredDirectories: COMMON_IGNORES,
+  packageManagers: Object.freeze(["dotnet"]),
+  executables: Object.freeze(["dotnet"]),
+  operations: Object.freeze({
+    syntax: async (ctx) => processPlan(ctx, "syntax", "dotnet", ["build", "--no-restore"], {
+      parser: "dotnet-build",
+      reason: "Use the nearest project or solution to collect C# syntax diagnostics.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    semantic: async (ctx) => processPlan(ctx, "semantic", "dotnet", ["build", "--no-restore"], {
+      parser: "dotnet-build",
+      reason: "Build without restoring to collect .NET compiler diagnostics.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    lint: async (ctx) => processPlan(ctx, "lint", "dotnet", ["format", "--verify-no-changes", "--no-restore"], {
+      parser: "dotnet-format",
+      reason: "Verify .NET formatting and analyzers without writing source files.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    "format-check": async (ctx) => processPlan(
+      ctx,
+      "format-check",
+      "dotnet",
+      ["format", "--verify-no-changes", "--no-restore"],
+      {
+        parser: "dotnet-format",
+        reason: "Verify .NET formatting without source writes.",
+        mutating: true,
+        executesProjectCode: true
+      }
+    ),
+    "format-write": async (ctx) => processPlan(ctx, "format-write", "dotnet", ["format", "--no-restore"], {
+      parser: "dotnet-format",
+      reason: "Format .NET source files without restoring packages.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    test: async (ctx) => processPlan(
+      ctx,
+      "test",
+      "dotnet",
+      ["test", "--no-restore", ...ctx.options.filter ? ["--filter", ctx.options.filter] : []],
+      {
+        parser: "dotnet-test",
+        reason: ctx.options.filter ? "Run filtered .NET tests without restoring packages." : "Run .NET tests without restoring packages.",
+        mutating: true,
+        executesProjectCode: true
+      }
+    ),
+    build: async (ctx) => processPlan(ctx, "build", "dotnet", ["build", "--no-restore"], {
+      parser: "dotnet-build",
+      reason: "Build the nearest .NET project or solution without restoring packages.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    run: async (ctx) => processPlan(ctx, "run", "dotnet", ["run", "--no-restore"], {
+      parser: "command-text",
+      reason: "Run the .NET project entry point.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    "package-install": async (ctx) => processPlan(ctx, "package-install", "dotnet", ["restore", "--locked-mode"], {
+      parser: "dotnet-restore",
+      reason: "Restore locked .NET dependencies.",
+      mutating: true,
+      network: true,
+      executesProjectCode: true
+    }),
+    "package-add": async (ctx) => {
+      const names = packageNames(ctx);
+      return names.length === 0 ? unavailable(ctx, "package-add", "At least one NuGet package is required.") : processPlan(ctx, "package-add", "dotnet", ["add", "package", ...names], {
+        parser: "dotnet-package",
+        reason: "Add validated NuGet packages.",
+        mutating: true,
+        network: true,
+        executesProjectCode: true
+      });
+    },
+    "package-remove": async (ctx) => {
+      const names = packageNames(ctx);
+      return names.length === 0 ? unavailable(ctx, "package-remove", "At least one NuGet package is required.") : processPlan(ctx, "package-remove", "dotnet", ["remove", "package", ...names], {
+        parser: "dotnet-package",
+        reason: "Remove validated NuGet packages.",
+        mutating: true
+      });
+    },
+    "package-audit": async (ctx) => processPlan(
+      ctx,
+      "package-audit",
+      "dotnet",
+      ["list", "package", "--vulnerable", "--format", "json"],
+      { parser: "dotnet-package", reason: "List vulnerable NuGet dependencies.", network: true }
+    ),
+    "package-outdated": async (ctx) => processPlan(
+      ctx,
+      "package-outdated",
+      "dotnet",
+      ["list", "package", "--outdated", "--format", "json"],
+      { parser: "dotnet-package", reason: "List outdated NuGet dependencies.", network: true }
+    )
+  })
+};
+var PRIMARY_LANGUAGE_PROFILES = Object.freeze([
+  Object.freeze(typescriptProfile()),
+  Object.freeze(javascriptProfile()),
+  Object.freeze(goProfile),
+  Object.freeze(rustProfile),
+  Object.freeze(phpProfile),
+  Object.freeze(csharpProfile)
+]);
+
+// src/languages/registry.ts
+var PROFILE_ID_RE = /^[a-z][a-z0-9-]{0,63}$/;
+var EXECUTABLE_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
+var KNOWN_OPERATIONS = /* @__PURE__ */ new Set([
+  "syntax",
+  "semantic",
+  "lint",
+  "format-check",
+  "format-write",
+  "test-compile",
+  "test",
+  "build",
+  "run",
+  "debug-compile",
+  "debug-test",
+  "debug-runtime",
+  "debug-race",
+  "package-install",
+  "package-add",
+  "package-remove",
+  "package-update",
+  "package-audit",
+  "package-outdated"
+]);
+var LanguageProfileRegistry = class {
+  #profiles = /* @__PURE__ */ new Map();
+  constructor(profiles = []) {
+    for (const profile of profiles) this.register(profile);
+  }
+  register(profile) {
+    const errors = validateLanguageProfile(profile);
+    if (errors.length > 0) {
+      throw new Error(`Invalid language profile "${profile.id}": ${errors.join("; ")}`);
+    }
+    if (this.#profiles.has(profile.id)) {
+      throw new Error(`Language profile "${profile.id}" is already registered`);
+    }
+    this.#profiles.set(profile.id, freezeProfile(profile));
+  }
+  get(id) {
+    return this.#profiles.get(id);
+  }
+  list() {
+    return Object.freeze([...this.#profiles.values()]);
+  }
+};
+function validateLanguageProfile(profile) {
+  const errors = [];
+  if (!PROFILE_ID_RE.test(profile.id)) errors.push("id must be a lowercase stable identifier");
+  if (!profile.displayName.trim()) errors.push("displayName is required");
+  if (profile.extensions.length === 0) errors.push("at least one extension is required");
+  for (const ext of profile.extensions) {
+    if (!/^\.[a-z0-9+.-]+$/i.test(ext)) errors.push(`invalid extension "${ext}"`);
+  }
+  if (profile.detectors.length === 0) errors.push("at least one detector is required");
+  for (const detector of profile.detectors) {
+    if ((detector.filename ? 1 : 0) + (detector.suffix ? 1 : 0) !== 1) {
+      errors.push("each detector must declare exactly one of filename or suffix");
+    }
+    if (!Number.isFinite(detector.weight) || detector.weight <= 0 || detector.weight > 100) {
+      errors.push("detector weights must be in the range 1..100");
+    }
+    const marker = detector.filename ?? detector.suffix ?? "";
+    if (marker.includes("/") || marker.includes("\\") || marker.includes("\0")) {
+      errors.push(`detector marker "${marker}" must be a basename or suffix`);
+    }
+  }
+  if (profile.executables.length === 0) errors.push("at least one executable is required");
+  for (const executable of profile.executables) {
+    if (!EXECUTABLE_RE.test(executable)) errors.push(`invalid executable token "${executable}"`);
+  }
+  for (const operation of Object.keys(profile.operations)) {
+    if (!KNOWN_OPERATIONS.has(operation)) {
+      errors.push(`unknown operation "${operation}"`);
+    }
+    if (typeof profile.operations[operation] !== "function") {
+      errors.push(`operation "${operation}" must be a resolver function`);
+    }
+  }
+  return [...new Set(errors)];
+}
+function freezeProfile(profile) {
+  const detectors = Object.freeze(profile.detectors.map((item) => Object.freeze({ ...item })));
+  const operations = Object.freeze({ ...profile.operations });
+  return Object.freeze({
+    ...profile,
+    extensions: Object.freeze([...profile.extensions]),
+    lspLanguageIds: Object.freeze([...profile.lspLanguageIds]),
+    detectors,
+    ignoredDirectories: Object.freeze([...profile.ignoredDirectories]),
+    packageManagers: Object.freeze([...profile.packageManagers]),
+    executables: Object.freeze([...profile.executables]),
+    operations
+  });
+}
+var languageProfileRegistry = new LanguageProfileRegistry([
+  ...PRIMARY_LANGUAGE_PROFILES,
+  ...ADDITIONAL_LANGUAGE_PROFILES
+]);
+
+// src/languages/detect.ts
+var DEFAULT_LIMITS = { maxDepth: 6, maxEntries: 5e3 };
+var SOURCE_WEIGHT = 5;
+var SOURCE_WEIGHT_CAP = 25;
+var TARGET_WEIGHT = 100;
+var GLOBAL_IGNORES = /* @__PURE__ */ new Set([
+  ".git",
+  ".wrongstack",
+  "node_modules",
+  "vendor",
+  "target",
+  "bin",
+  "obj",
+  "dist",
+  "build",
+  "out",
+  "coverage",
+  ".cache",
+  ".idea",
+  ".vscode",
+  ".next",
+  ".nuxt"
+]);
+async function detectLanguageWorkspaces(options) {
+  const projectRoot = await canonicalDirectory(options.projectRoot);
+  const cwdInput = options.cwd ? path.isAbsolute(options.cwd) ? options.cwd : path.resolve(projectRoot, options.cwd) : projectRoot;
+  const cwd = await canonicalInside(cwdInput, projectRoot, "cwd");
+  const target = options.target ? await canonicalInside(resolveFrom(cwd, options.target), projectRoot, "target") : void 0;
+  const profiles = (options.profiles ?? languageProfileRegistry.list()).filter((profile) => !options.language || profile.id === options.language).slice().sort((a, b) => a.id.localeCompare(b.id));
+  const limits = normalizeLimits(options.limits);
+  const state = {
+    entries: 0,
+    truncated: false,
+    sourcePaths: /* @__PURE__ */ new Map(),
+    candidates: /* @__PURE__ */ new Map()
+  };
+  await scanDirectory(projectRoot, 0, profiles, limits, state, options.signal);
+  addSourceFallbacks(projectRoot, profiles, state);
+  if (target) addTargetEvidence(target, projectRoot, profiles, state);
+  const workspaces = await Promise.all(
+    [...state.candidates.values()].map((candidate) => finalizeCandidate(candidate, projectRoot))
+  );
+  workspaces.sort(compareWorkspaces);
+  return {
+    projectRoot,
+    scannedEntries: state.entries,
+    truncated: state.truncated,
+    workspaces
+  };
+}
+async function scanDirectory(directory, depth, profiles, limits, state, signal) {
+  signal?.throwIfAborted();
+  if (depth > limits.maxDepth || state.entries >= limits.maxEntries) {
+    state.truncated = true;
+    return;
+  }
+  let entries;
+  try {
+    entries = await fs.readdir(directory, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  entries.sort((a, b) => a.name.localeCompare(b.name));
+  for (const entry of entries) {
+    signal?.throwIfAborted();
+    if (state.entries >= limits.maxEntries) {
+      state.truncated = true;
+      return;
+    }
+    state.entries++;
+    const fullPath = path.join(directory, entry.name);
+    if (entry.isSymbolicLink()) continue;
+    if (entry.isDirectory()) {
+      if (shouldIgnoreDirectory(entry.name, profiles)) continue;
+      if (depth >= limits.maxDepth) {
+        state.truncated = true;
+        continue;
+      }
+      await scanDirectory(fullPath, depth + 1, profiles, limits, state, signal);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    collectFileEvidence(directory, fullPath, entry.name, profiles, state);
+  }
+}
+function collectFileEvidence(directory, fullPath, basename4, profiles, state) {
+  const lower = basename4.toLowerCase();
+  const extension = path.extname(lower);
+  for (const profile of profiles) {
+    const detector = profile.detectors.find(
+      (rule) => rule.filename ? lower === rule.filename.toLowerCase() : lower.endsWith(rule.suffix.toLowerCase())
+    );
+    if (detector) {
+      const candidate = getCandidate(state, profile, directory);
+      candidate.evidence.push({
+        kind: detector.kind,
+        path: fullPath,
+        value: basename4,
+        weight: detector.weight
+      });
+      if (detector.kind === "manifest" || detector.kind === "config") {
+        candidate.manifests.push(fullPath);
+      }
+    }
+    if (profile.extensions.includes(extension)) {
+      const paths = state.sourcePaths.get(profile.id) ?? [];
+      if (paths.length < SOURCE_WEIGHT_CAP / SOURCE_WEIGHT) paths.push(fullPath);
+      state.sourcePaths.set(profile.id, paths);
+    }
+  }
+}
+function addSourceFallbacks(projectRoot, profiles, state) {
+  for (const profile of profiles) {
+    const sources = state.sourcePaths.get(profile.id) ?? [];
+    if (sources.length === 0) continue;
+    const profileCandidates = [...state.candidates.values()].filter(
+      (item) => item.profile.id === profile.id
+    );
+    for (const source of sources) {
+      const containing = profileCandidates.filter((candidate2) => isInside(source, candidate2.root)).sort(
+        (a, b) => pathDepth(b.root, projectRoot) - pathDepth(a.root, projectRoot) || a.root.localeCompare(b.root)
+      );
+      const candidate = containing[0] ?? (profile.sourceFallback === false ? void 0 : getCandidate(state, profile, projectRoot));
+      if (!candidate) continue;
+      candidate.evidence.push({
+        kind: "source",
+        path: source,
+        value: path.extname(source),
+        weight: SOURCE_WEIGHT
+      });
+    }
+  }
+}
+function addTargetEvidence(target, projectRoot, profiles, state) {
+  const extension = path.extname(target).toLowerCase();
+  for (const profile of profiles) {
+    if (!profile.extensions.includes(extension)) continue;
+    const candidates = [...state.candidates.values()].filter(
+      (candidate2) => candidate2.profile.id === profile.id && isInside(target, candidate2.root)
+    );
+    const candidate = candidates.length > 0 ? candidates.sort(
+      (a, b) => pathDepth(b.root, projectRoot) - pathDepth(a.root, projectRoot) || a.root.localeCompare(b.root)
+    )[0] : profile.sourceFallback === false ? void 0 : getCandidate(state, profile, path.dirname(target));
+    if (!candidate) continue;
+    candidate.evidence.push({
+      kind: "target",
+      path: target,
+      value: extension,
+      weight: TARGET_WEIGHT
+    });
+  }
+}
+async function finalizeCandidate(candidate, projectRoot) {
+  const evidence = dedupeEvidence(candidate.evidence).sort(compareEvidence);
+  const manifests = [...new Set(candidate.manifests)].sort();
+  const confidence = Math.min(1, evidence.reduce((sum, item) => sum + item.weight, 0) / 100);
+  const packageManager = await detectPackageManager(candidate.profile, candidate.root, evidence);
+  const id = createHash("sha256").update(`${candidate.profile.id}\0${path.relative(projectRoot, candidate.root)}`).digest("hex").slice(0, 16);
+  return Object.freeze({
+    id,
+    language: candidate.profile.id,
+    root: candidate.root,
+    confidence,
+    evidence: Object.freeze(evidence.map((item) => Object.freeze(item))),
+    ...packageManager ? { packageManager } : {},
+    manifests: Object.freeze(manifests),
+    capabilities: Object.freeze(
+      Object.keys(candidate.profile.operations).sort()
+    )
+  });
+}
+async function detectPackageManager(profile, root, evidence) {
+  if (profile.packageManagers.length === 1) return profile.packageManagers[0];
+  if (profile.id !== "typescript" && profile.id !== "javascript") return void 0;
+  let declared;
+  try {
+    const pkg = JSON.parse(await fs.readFile(path.join(root, "package.json"), "utf8"));
+    if (typeof pkg.packageManager === "string") {
+      const manager = pkg.packageManager.split("@")[0];
+      if (manager && profile.packageManagers.includes(manager)) declared = manager;
+    }
+  } catch {
+  }
+  const lockManagers = /* @__PURE__ */ new Set();
+  for (const item of evidence) {
+    const name = path.basename(item.path).toLowerCase();
+    if (name === "pnpm-lock.yaml") lockManagers.add("pnpm");
+    else if (name === "yarn.lock") lockManagers.add("yarn");
+    else if (name === "bun.lock" || name === "bun.lockb") lockManagers.add("bun");
+    else if (name === "package-lock.json") lockManagers.add("npm");
+  }
+  if (declared && (lockManagers.size === 0 || lockManagers.size === 1 && lockManagers.has(declared))) {
+    return declared;
+  }
+  if (lockManagers.size === 1) return [...lockManagers][0];
+  if (lockManagers.size > 1) return void 0;
+  return declared ?? "npm";
+}
+function getCandidate(state, profile, root) {
+  const key = `${profile.id}\0${root}`;
+  let candidate = state.candidates.get(key);
+  if (!candidate) {
+    candidate = { profile, root, evidence: [], manifests: [] };
+    state.candidates.set(key, candidate);
+  }
+  return candidate;
+}
+function shouldIgnoreDirectory(name, profiles) {
+  if (GLOBAL_IGNORES.has(name) || name.startsWith(".")) return true;
+  return profiles.some((profile) => profile.ignoredDirectories.includes(name));
+}
+function normalizeLimits(input) {
+  const maxDepth = Math.max(
+    0,
+    Math.min(12, Math.trunc(input?.maxDepth ?? DEFAULT_LIMITS.maxDepth))
+  );
+  const maxEntries = Math.max(
+    1,
+    Math.min(5e4, Math.trunc(input?.maxEntries ?? DEFAULT_LIMITS.maxEntries))
+  );
+  return { maxDepth, maxEntries };
+}
+async function canonicalDirectory(input) {
+  const resolved = path.resolve(input);
+  const real = await fs.realpath(resolved);
+  const stat4 = await fs.stat(real);
+  if (!stat4.isDirectory()) throw new Error(`Project root is not a directory: ${input}`);
+  return real;
+}
+async function canonicalInside(input, root, label) {
+  const resolved = path.resolve(input);
+  let real;
+  try {
+    real = await fs.realpath(resolved);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    const parent = await fs.realpath(path.dirname(resolved));
+    real = path.join(parent, path.basename(resolved));
+  }
+  if (!isInside(real, root)) throw new Error(`${label} is outside project root: ${input}`);
+  return real;
+}
+function resolveFrom(cwd, input) {
+  return path.isAbsolute(input) ? input : path.resolve(cwd, input);
+}
+function isInside(candidate, root) {
+  const relative5 = path.relative(root, candidate);
+  return relative5 === "" || !relative5.startsWith("..") && !path.isAbsolute(relative5);
+}
+function pathDepth(candidate, root) {
+  const relative5 = path.relative(root, candidate);
+  return relative5 === "" ? 0 : relative5.split(path.sep).length;
+}
+function dedupeEvidence(items) {
+  const seen = /* @__PURE__ */ new Set();
+  return items.filter((item) => {
+    const key = `${item.kind}\0${item.path}\0${item.value}\0${item.weight}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function compareEvidence(a, b) {
+  return a.path.localeCompare(b.path) || a.kind.localeCompare(b.kind) || b.weight - a.weight;
+}
+function compareWorkspaces(a, b) {
+  return b.confidence - a.confidence || a.language.localeCompare(b.language) || a.root.localeCompare(b.root) || a.id.localeCompare(b.id);
+}
+
+// src/languages/diagnostics.ts
+import * as path2 from "node:path";
+var MAX_DIAGNOSTICS = 200;
+function parseLanguageDiagnostics(parser, stdout, stderr, workspaceRoot) {
+  const text = `${stdout}${stdout && stderr ? "\n" : ""}${stderr}`;
+  let diagnostics;
+  switch (parser) {
+    case "typescript":
+      diagnostics = parseTypeScript(text, workspaceRoot);
+      break;
+    case "cargo-json":
+      diagnostics = parseCargoJson(text, workspaceRoot);
+      break;
+    case "php-lint":
+      diagnostics = parsePhpLint(text, workspaceRoot);
+      break;
+    case "dotnet-build":
+    case "dotnet-format":
+    case "dotnet-test":
+      diagnostics = parseDotnet(text, workspaceRoot);
+      break;
+    case "go-test":
+    case "go-compiler":
+    case "gofmt":
+      diagnostics = parseGo(text, workspaceRoot);
+      break;
+    case "biome":
+      diagnostics = parseBiome(text, workspaceRoot);
+      break;
+    default:
+      diagnostics = parseGeneric(text, parser, workspaceRoot);
+      break;
+  }
+  const sorted = dedupeDiagnostics(diagnostics).sort(compareDiagnostics);
+  const omitted = Math.max(0, sorted.length - MAX_DIAGNOSTICS);
+  const kept = Object.freeze(sorted.slice(0, MAX_DIAGNOSTICS).map((item) => Object.freeze(item)));
+  return {
+    diagnostics: kept,
+    omitted,
+    summary: summarize(kept)
+  };
+}
+function diagnosticsForInternalSyntax(language, target, sourceText) {
+  if (language !== "typescript" && language !== "javascript") {
+    return Promise.resolve({ diagnostics: [], omitted: 0, summary: emptySummary() });
+  }
+  return import("@typescript/typescript6").then((tsModule) => {
+    const ts = tsModule.default ?? tsModule;
+    const extension = path2.extname(target).toLowerCase();
+    const scriptKind = extension === ".tsx" ? ts.ScriptKind.TSX : extension === ".ts" || extension === ".mts" || extension === ".cts" ? ts.ScriptKind.TS : ts.ScriptKind.JSX;
+    const sourceFile = ts.createSourceFile(
+      path2.basename(target),
+      sourceText,
+      ts.ScriptTarget.Latest,
+      false,
+      scriptKind
+    );
+    const native = sourceFile.parseDiagnostics ?? [];
+    const diagnostics = native.map((diagnostic) => {
+      const start = diagnostic.start ?? 0;
+      const location = sourceFile.getLineAndCharacterOfPosition(start);
+      return {
+        severity: diagnostic.category === ts.DiagnosticCategory.Warning ? "warning" : "error",
+        ...diagnostic.code ? { code: `TS${diagnostic.code}` } : {},
+        message: ts.flattenDiagnosticMessageText(diagnostic.messageText, " "),
+        file: target,
+        range: { start: { line: location.line + 1, column: location.character + 1 } },
+        source: "typescript-parser"
+      };
+    });
+    const sorted = dedupeDiagnostics(diagnostics).sort(compareDiagnostics);
+    const omitted = Math.max(0, sorted.length - MAX_DIAGNOSTICS);
+    const kept = Object.freeze(sorted.slice(0, MAX_DIAGNOSTICS).map((item) => Object.freeze(item)));
+    return { diagnostics: kept, omitted, summary: summarize(kept) };
+  });
+}
+function parseTypeScript(text, root) {
+  const diagnostics = [];
+  const regex = /^(.+?)\((\d+),(\d+)\):\s+(error|warning)\s+(TS\d+):\s*(.+)$/gm;
+  for (const match of text.matchAll(regex)) {
+    diagnostics.push({
+      severity: match[4] === "warning" ? "warning" : "error",
+      code: match[5],
+      message: match[6].trim(),
+      file: normalizeDiagnosticPath(match[1], root),
+      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
+      source: "typescript"
+    });
+  }
+  return diagnostics;
+}
+function parseCargoJson(text, root) {
+  const diagnostics = [];
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.trim().startsWith("{")) continue;
+    try {
+      const value = JSON.parse(line);
+      if (value.reason !== "compiler-message" || !value.message?.message) continue;
+      const primary = value.message.spans?.find((span) => span.is_primary) ?? value.message.spans?.[0];
+      diagnostics.push({
+        severity: normalizeSeverity(value.message.level),
+        ...value.message.code?.code ? { code: value.message.code.code } : {},
+        message: value.message.message,
+        ...primary?.file_name ? { file: normalizeDiagnosticPath(primary.file_name, root) } : {},
+        ...primary?.line_start ? { range: { start: { line: primary.line_start, column: primary.column_start ?? 1 } } } : {},
+        source: "rustc"
+      });
+    } catch {
+    }
+  }
+  return diagnostics;
+}
+function parseGo(text, root) {
+  return parseLinePattern(
+    text,
+    /^(.*?\.go):(\d+):(\d+):\s*(.+)$/gm,
+    root,
+    "go",
+    (_match, message) => ({ message, severity: /warning/i.test(message) ? "warning" : "error" })
+  );
+}
+function parsePhpLint(text, root) {
+  const diagnostics = [];
+  const regex = /(?:PHP\s+)?(?:Parse|Fatal) error:\s*(.+?)\s+in\s+(.+?)\s+on line\s+(\d+)/gi;
+  for (const match of text.matchAll(regex)) {
+    diagnostics.push({
+      severity: "error",
+      message: match[1].trim(),
+      file: normalizeDiagnosticPath(match[2], root),
+      range: { start: { line: toPositiveInt(match[3]), column: 1 } },
+      source: "php"
+    });
+  }
+  return diagnostics;
+}
+function parseDotnet(text, root) {
+  const diagnostics = [];
+  const regex = /^(.+?)\((\d+),(\d+)\):\s*(error|warning)\s+([A-Z]+\d+):\s*(.+?)(?:\s+\[.+\])?$/gm;
+  for (const match of text.matchAll(regex)) {
+    diagnostics.push({
+      severity: match[4] === "warning" ? "warning" : "error",
+      code: match[5],
+      message: match[6].trim(),
+      file: normalizeDiagnosticPath(match[1], root),
+      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
+      source: "dotnet"
+    });
+  }
+  return diagnostics;
+}
+function parseBiome(text, root) {
+  const diagnostics = [];
+  const regex = /^(.+?):(\d+):(\d+)\s+(lint\/[^\s]+|format)\s+(.+)$/gm;
+  for (const match of text.matchAll(regex)) {
+    diagnostics.push({
+      severity: "warning",
+      code: match[4],
+      message: match[5].trim(),
+      file: normalizeDiagnosticPath(match[1], root),
+      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
+      source: "biome"
+    });
+  }
+  return diagnostics;
+}
+function parseGeneric(text, source, root) {
+  return parseLinePattern(
+    text,
+    /^(.+?):(\d+):(\d+):\s*(?:(error|warning|info):\s*)?(.+)$/gm,
+    root,
+    source,
+    (match, fallback) => ({
+      severity: normalizeSeverity(match[4]),
+      message: match[5]?.trim() || fallback
+    })
+  );
+}
+function parsePackageReports(parser, stdout, stderr) {
+  const text = `${stdout}${stdout && stderr ? "\n" : ""}${stderr}`;
+  switch (parser) {
+    case "npm-audit":
+      return parseNpmAudit(text);
+    case "npm-outdated":
+      return parseNpmOutdated(text);
+    case "cargo-audit":
+      return parseCargoAudit(text);
+    case "composer-audit":
+      return parseComposerAudit(text);
+    case "composer-outdated":
+      return parseComposerOutdated(text);
+    case "dotnet-package":
+      return parseDotnetPackage(text);
+    default:
+      return { diagnostics: [], vulnerabilities: [], outdated: [] };
+  }
+}
+function parseNpmAudit(text) {
+  const advisories = [];
+  const diagnostics = [];
+  let root;
+  try {
+    root = JSON.parse(text);
+  } catch {
+    return { diagnostics, vulnerabilities: advisories, outdated: [] };
+  }
+  const vulnerabilities = root?.vulnerabilities ?? {};
+  const advisoriesRecord = root?.advisories ?? vulnerabilities;
+  for (const [id, value] of Object.entries(advisoriesRecord)) {
+    const advisory = value;
+    const name = advisory.module_name ?? advisory.package_name ?? advisory.name ?? id;
+    advisories.push({
+      package: name,
+      ...advisory.title ? { advisory: advisory.title } : { advisory: id },
+      severity: mapSeverity(advisory.severity),
+      ...advisory.patched_versions ? { fixedIn: advisory.patched_versions } : {},
+      ...advisory.url ? { url: advisory.url } : {}
+    });
+    diagnostics.push({
+      severity: mapSeverity(advisory.severity) === "critical" || mapSeverity(advisory.severity) === "high" ? "error" : "warning",
+      code: id,
+      message: advisory.title ?? `Vulnerability reported for ${name}.`,
+      source: "npm-audit"
+    });
+  }
+  return { diagnostics, vulnerabilities: advisories, outdated: [] };
+}
+function parseNpmOutdated(text) {
+  const diagnostics = [];
+  const outdated = [];
+  let payload = {};
+  try {
+    payload = JSON.parse(text);
+  } catch {
+    return { diagnostics, vulnerabilities: [], outdated };
+  }
+  for (const [name, info] of Object.entries(payload)) {
+    const entry = info;
+    if (!entry.latest || entry.latest === entry.current) continue;
+    outdated.push({
+      name,
+      previous: entry.current,
+      resolved: entry.latest,
+      kind: mapOutdatedKind(entry.type)
+    });
+    diagnostics.push({
+      severity: "info",
+      code: "outdated",
+      message: `${name}: ${entry.current ?? "?"} \u2192 ${entry.latest}`,
+      source: "npm-outdated"
+    });
+  }
+  return { diagnostics, vulnerabilities: [], outdated };
+}
+function parseCargoAudit(text) {
+  const diagnostics = [];
+  const vulnerabilities = [];
+  let root;
+  try {
+    root = JSON.parse(text);
+  } catch {
+    return { diagnostics, vulnerabilities, outdated: [] };
+  }
+  const findings = root.vulnerabilities?.found;
+  if (!Array.isArray(findings)) return { diagnostics, vulnerabilities, outdated: [] };
+  for (const finding of findings) {
+    const item = finding;
+    const name = item.package ?? "unknown";
+    const advisory = item.id ?? item.advisory?.id ?? "cargo-audit";
+    vulnerabilities.push({
+      package: name,
+      ...item.title ? { advisory: item.title } : { advisory },
+      severity: mapSeverity(item.severity),
+      ...item.patched_versions && item.patched_versions.length > 0 ? { fixedIn: item.patched_versions[0] } : {},
+      ...item.url?.short ? { url: item.url.short } : {}
+    });
+    diagnostics.push({
+      severity: mapSeverity(item.severity) === "critical" || mapSeverity(item.severity) === "high" ? "error" : "warning",
+      code: advisory,
+      message: item.title ?? `${name} reported by cargo-audit.`,
+      source: "cargo-audit"
+    });
+  }
+  return { diagnostics, vulnerabilities, outdated: [] };
+}
+function parseComposerAudit(text) {
+  const diagnostics = [];
+  const vulnerabilities = [];
+  const lines = text.split(/\r?\n/);
+  for (const line of lines) {
+    if (!line.trim().startsWith("{")) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (!entry.package) continue;
+      vulnerabilities.push({
+        package: entry.package,
+        ...entry.advisory ? { advisory: entry.advisory } : {},
+        ...entry.title ? { advisory: entry.title } : { advisory: entry.advisory ?? "composer-audit" },
+        severity: mapSeverity(entry.severity),
+        ...entry.affectedVersions ? { fixedIn: entry.affectedVersions } : {},
+        ...entry.url ? { url: entry.url } : {}
+      });
+      diagnostics.push({
+        severity: "warning",
+        code: entry.advisory ?? "composer-audit",
+        message: entry.title ?? `${entry.package} reported by composer audit.`,
+        source: "composer-audit"
+      });
+    } catch {
+    }
+  }
+  return { diagnostics, vulnerabilities, outdated: [] };
+}
+function parseComposerOutdated(text) {
+  const diagnostics = [];
+  const outdated = [];
+  const lines = text.split(/\r?\n/);
+  for (const line of lines) {
+    if (!line.trim().startsWith("{")) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (!entry.name || entry.version === entry.latest) continue;
+      outdated.push({
+        name: entry.name,
+        previous: entry.version,
+        resolved: entry.latest ?? entry.version
+      });
+      diagnostics.push({
+        severity: "info",
+        code: "outdated",
+        message: `${entry.name}: ${entry.version ?? "?"} \u2192 ${entry.latest ?? "?"}`,
+        source: "composer-outdated"
+      });
+    } catch {
+    }
+  }
+  return { diagnostics, vulnerabilities: [], outdated };
+}
+function parseDotnetPackage(text) {
+  const diagnostics = [];
+  const vulnerabilities = [];
+  const outdated = [];
+  let root;
+  try {
+    root = JSON.parse(text);
+  } catch {
+    return { diagnostics, vulnerabilities, outdated };
+  }
+  const projects = root.projects;
+  if (!Array.isArray(projects)) return { diagnostics, vulnerabilities, outdated };
+  for (const project of projects) {
+    const packages = Array.isArray(project.packages) ? project.packages : [];
+    for (const pkg of packages) {
+      const name = typeof pkg.name === "string" ? pkg.name : "unknown";
+      const requested = typeof pkg.requestedVersion === "string" ? pkg.requestedVersion : void 0;
+      const resolved = typeof pkg.resolvedVersion === "string" ? pkg.resolvedVersion : void 0;
+      const vulnerabilitiesRaw = Array.isArray(pkg.vulnerabilities) ? pkg.vulnerabilities : [];
+      for (const vuln of vulnerabilitiesRaw) {
+        const advisory = typeof vuln.advisoryUrl === "string" ? vuln.advisoryUrl : "dotnet-vulnerable";
+        vulnerabilities.push({
+          package: name,
+          advisory,
+          severity: mapSeverity(typeof vuln.severity === "string" ? vuln.severity : void 0)
+        });
+      }
+      if (vulnerabilitiesRaw.length > 0) {
+        diagnostics.push({
+          severity: "warning",
+          code: "dotnet-vulnerable",
+          message: `${name} has ${vulnerabilitiesRaw.length} known vulnerability entry/entries.`,
+          source: "dotnet-package"
+        });
+      }
+      if (requested && resolved && requested.startsWith(">") && requested.split(">")[1].split(".").slice(0, 2).join(".") !== resolved.split(".").slice(0, 2).join(".")) {
+        outdated.push({ name, requested, resolved });
+        diagnostics.push({
+          severity: "info",
+          code: "outdated",
+          message: `${name}: ${requested} \u2192 ${resolved}`,
+          source: "dotnet-package"
+        });
+      }
+    }
+  }
+  return { diagnostics, vulnerabilities, outdated };
+}
+function mapSeverity(value) {
+  switch (value?.toLowerCase()) {
+    case "critical":
+    case "high":
+      return "high";
+    case "medium":
+    case "moderate":
+      return "moderate";
+    case "low":
+      return "low";
+    case "unknown":
+      return "unknown";
+    default:
+      return "unknown";
+  }
+}
+function mapOutdatedKind(value) {
+  switch (value?.toLowerCase()) {
+    case "devdependencies":
+    case "development":
+      return "development";
+    case "optionaldependencies":
+    case "optional":
+      return "optional";
+    default:
+      return "runtime";
+  }
+}
+function parseLinePattern(text, regex, root, source, details) {
+  const diagnostics = [];
+  for (const match of text.matchAll(regex)) {
+    const parsed = details(match, match.at(-1)?.trim() ?? "Diagnostic");
+    diagnostics.push({
+      severity: parsed.severity,
+      message: parsed.message,
+      file: normalizeDiagnosticPath(match[1], root),
+      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
+      source
+    });
+  }
+  return diagnostics;
+}
+function normalizeDiagnosticPath(value, root) {
+  const clean = value.trim().replace(/^['"]|['"]$/g, "");
+  return path2.resolve(root, clean);
+}
+function normalizeSeverity(value) {
+  if (value === "warning" || value === "warn") return "warning";
+  if (value === "info" || value === "note" || value === "help") return "info";
+  if (value === "hint") return "hint";
+  return "error";
+}
+function toPositiveInt(value) {
+  return Math.max(1, Number.parseInt(value ?? "1", 10) || 1);
+}
+function summarize(diagnostics) {
+  return {
+    errors: diagnostics.filter((item) => item.severity === "error").length,
+    warnings: diagnostics.filter((item) => item.severity === "warning").length,
+    infos: diagnostics.filter((item) => item.severity === "info" || item.severity === "hint").length
+  };
+}
+function emptySummary() {
+  return { errors: 0, warnings: 0, infos: 0 };
+}
+function dedupeDiagnostics(items) {
+  const seen = /* @__PURE__ */ new Set();
+  return items.filter((item) => {
+    const key = [
+      item.source,
+      item.code ?? "",
+      item.file ?? "",
+      item.range?.start.line ?? 0,
+      item.range?.start.column ?? 0,
+      item.message
+    ].join("\0");
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function compareDiagnostics(a, b) {
+  return (a.file ?? "").localeCompare(b.file ?? "") || (a.range?.start.line ?? 0) - (b.range?.start.line ?? 0) || (a.range?.start.column ?? 0) - (b.range?.start.column ?? 0) || severityRank(a.severity) - severityRank(b.severity) || (a.code ?? "").localeCompare(b.code ?? "") || a.message.localeCompare(b.message);
+}
+function severityRank(value) {
+  return value === "error" ? 0 : value === "warning" ? 1 : value === "info" ? 2 : 3;
+}
+
+// src/languages/execute.ts
+import * as fs4 from "node:fs/promises";
+import * as path7 from "node:path";
+
+// src/_spawn-stream.ts
+import { spawn as spawn2 } from "node:child_process";
+import { buildChildEnv } from "@wrongstack/core";
+
+// src/_output-spool.ts
+import { createWriteStream, mkdirSync } from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as path3 from "node:path";
+import { wstackGlobalRoot } from "@wrongstack/core";
+var SPOOL_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
+var SPOOL_WRITE_HWM_BYTES = 4 * 1024 * 1024;
+var sweepStarted = false;
+function toolOutputDir() {
+  return path3.join(wstackGlobalRoot(), "tool-output");
+}
+function sweepOldSpoolFiles(dir) {
+  if (sweepStarted) return;
+  sweepStarted = true;
+  void (async () => {
+    try {
+      const now = Date.now();
+      for (const name of await fsp.readdir(dir)) {
+        if (!name.endsWith(".log")) continue;
+        const p = path3.join(dir, name);
+        try {
+          const st = await fsp.stat(p);
+          if (now - st.mtimeMs > SPOOL_RETENTION_MS) await fsp.unlink(p);
+        } catch {
+        }
+      }
+    } catch {
+    }
+  })();
+}
+function spoolNote(info) {
+  const dropped = info.droppedBytes > 0 ? `, ~${info.droppedBytes} bytes dropped under backpressure` : "";
+  return `
+[output truncated \u2014 full ${info.bytes} bytes at ${info.path}${dropped}; read/grep that file selectively instead of re-running with more output]`;
+}
+function createOutputSpool(opts) {
+  const threshold = opts.thresholdBytes ?? 32768;
+  const safeTool = opts.tool.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
+  let head = "";
+  let headBytes = 0;
+  let totalBytes = 0;
+  let droppedBytes = 0;
+  let stream = null;
+  let filePath = null;
+  let failed = false;
+  let finalized = false;
+  const open = () => {
+    if (stream || failed) return;
+    try {
+      const dir = toolOutputDir();
+      mkdirSync(dir, { recursive: true });
+      sweepOldSpoolFiles(dir);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const rand = Math.random().toString(36).slice(2, 6);
+      filePath = path3.join(dir, `${stamp}-${safeTool}-${rand}.log`);
+      stream = createWriteStream(filePath, { flags: "w", encoding: "utf8" });
+      stream.on("error", () => {
+        failed = true;
+        stream = null;
+        filePath = null;
+      });
+      stream.write(head);
+    } catch {
+      failed = true;
+      stream = null;
+      filePath = null;
+    }
+  };
+  return {
+    write(text) {
+      if (finalized || !text) return;
+      totalBytes += Buffer.byteLength(text, "utf8");
+      if (!stream && !failed) {
+        if (headBytes + text.length <= threshold) {
+          head += text;
+          headBytes += text.length;
+          return;
+        }
+        head += text;
+        open();
+        head = "";
+        return;
+      }
+      if (stream) {
+        if (stream.writableLength > SPOOL_WRITE_HWM_BYTES) {
+          droppedBytes += Buffer.byteLength(text, "utf8");
+          return;
+        }
+        stream.write(text);
+      }
+    },
+    finalize() {
+      if (finalized) {
+        return filePath ? { path: filePath, bytes: totalBytes, droppedBytes } : null;
+      }
+      finalized = true;
+      head = "";
+      if (!stream || !filePath) return null;
+      try {
+        stream.end();
+      } catch {
+      }
+      return { path: filePath, bytes: totalBytes, droppedBytes };
+    }
+  };
+}
+
+// src/process-registry.ts
+import { spawn } from "node:child_process";
+import * as os from "node:os";
+
+// src/circuit-breaker.ts
+var DEFAULT_MAX_CONSECUTIVE_FAILURES = 5;
+var DEFAULT_SLOW_CALL_THRESHOLD_MS = 18e4;
+var DEFAULT_MAX_SLOW_CALLS = 3;
+var DEFAULT_WINDOW_MS = 6e4;
+var DEFAULT_MAX_CALLS_PER_WINDOW = 30;
+var DEFAULT_COOLDOWN_MS = 3e4;
+var CircuitBreaker = class {
+  maxConsecutiveFailures;
+  slowCallThresholdMs;
+  maxSlowCalls;
+  windowMs;
+  maxCallsPerWindow;
+  cooldownMs;
+  state = "closed";
+  consecutiveFailures = 0;
+  window = [];
+  lastFailureAt = null;
+  lastSlowAt = null;
+  /** Timestamp when the breaker was opened (for cooldown calculation). */
+  openedAt = null;
+  /**
+   * Master enable flag. When false the breaker is bypassed: `beforeCall`
+   * always returns true and `afterCall` records nothing. The class itself
+   * defaults to enabled (so the standalone unit tests exercise tripping); the
+   * ProcessRegistry flips this off until the user opts in via `/settings`.
+   */
+  enabled = true;
+  /**
+   * Fired (best-effort) when the breaker transitions into the `open` state.
+   * The registry uses this to arm its auto kill/reset countdown.
+   */
+  onTrip;
+  /**
+   * Fired (best-effort) when the breaker returns to `closed` after having been
+   * open/half-open. The registry uses this to cancel a pending kill/reset.
+   */
+  onReset;
+  constructor(config = {}) {
+    this.maxConsecutiveFailures = config.maxConsecutiveFailures ?? DEFAULT_MAX_CONSECUTIVE_FAILURES;
+    this.slowCallThresholdMs = config.slowCallThresholdMs ?? DEFAULT_SLOW_CALL_THRESHOLD_MS;
+    this.maxSlowCalls = config.maxSlowCalls ?? DEFAULT_MAX_SLOW_CALLS;
+    this.windowMs = config.windowMs ?? DEFAULT_WINDOW_MS;
+    this.maxCallsPerWindow = config.maxCallsPerWindow ?? DEFAULT_MAX_CALLS_PER_WINDOW;
+    this.cooldownMs = config.cooldownMs ?? DEFAULT_COOLDOWN_MS;
+  }
+  /** Toggle the master enable. Disabling resets to a clean `closed` state. */
+  setEnabled(enabled) {
+    if (this.enabled === enabled) return;
+    this.enabled = enabled;
+    if (!enabled) this._reset();
+  }
+  get isEnabled() {
+    return this.enabled;
+  }
+  /**
+   * Returns true if the circuit allows a new call to proceed.
+   * When false, callers should abort the tool call and return a
+   * circuit-breaker error instead of spawning a process.
+   */
+  get canProceed() {
+    if (!this.enabled) return true;
+    this._checkStateTransition();
+    return this.state !== "open";
+  }
+  /**
+   * Snapshot of the current breaker state for observability (`/kill`).
+   */
+  snapshot() {
+    this._checkStateTransition();
+    const now = Date.now();
+    let cooldownRemaining = null;
+    if (this.openedAt !== null && this.state === "open") {
+      const elapsed = now - this.openedAt;
+      cooldownRemaining = Math.max(0, this.cooldownMs - elapsed);
+    }
+    return {
+      state: this.state,
+      consecutiveFailures: this.consecutiveFailures,
+      slowCallsInWindow: this.window.filter((c) => c.slow).length,
+      callsInWindow: this.window.length,
+      windowMs: this.windowMs,
+      cooldownRemainingMs: cooldownRemaining,
+      lastFailureAt: this.lastFailureAt,
+      lastSlowAt: this.lastSlowAt
+    };
+  }
+  /**
+   * Call this BEFORE spawning a bash/exec process.
+   * Returns true if the call is allowed; false if the breaker is open.
+   * When false, callers MUST NOT spawn a process.
+   *
+   * @param bypass - If true, skip the circuit breaker check entirely.
+   *                  Use for background/fire-and-forget processes that should
+   *                  not affect breaker state.
+   */
+  beforeCall(bypass = false) {
+    if (bypass || !this.enabled) return true;
+    this._checkStateTransition();
+    if (this.state === "open") return false;
+    return true;
+  }
+  /**
+   * Call this AFTER a bash/exec process finishes (success or failure).
+   * `durationMs` is the wall-clock time the process ran.
+   * `failed` is true when the process returned a non-zero exit code or
+   * threw an exception before spawning.
+   *
+   * @param bypass - If true, do not update breaker state.
+   *                  Use for background/fire-and-forget processes.
+   */
+  afterCall(durationMs, failed, bypass = false) {
+    if (bypass || !this.enabled) return;
+    const now = Date.now();
+    if (this.state === "half-open") {
+      if (failed) {
+        this._trip();
+        return;
+      }
+      this._reset();
+      return;
+    }
+    this._pruneWindow(now);
+    const slow = durationMs >= this.slowCallThresholdMs;
+    this.window.push({ at: now, failed, slow });
+    if (failed) {
+      this.consecutiveFailures++;
+      this.lastFailureAt = now;
+      if (this.consecutiveFailures >= this.maxConsecutiveFailures) {
+        this._trip();
+      }
+      return;
+    }
+    this.consecutiveFailures = 0;
+    if (slow) {
+      this.lastSlowAt = now;
+      const slowCount = this.window.filter((c) => c.slow).length;
+      if (slowCount >= this.maxSlowCalls) {
+        this._trip();
+      }
+    }
+    const callCount = this.window.length;
+    if (callCount >= this.maxCallsPerWindow) {
+      this._trip();
+    }
+  }
+  /** Force the breaker open. Used by /kill force and Ctrl+C. */
+  forceOpen() {
+    this._trip();
+  }
+  /** Force a reset to closed. Used by tests and /kill reset. */
+  forceReset() {
+    this._reset();
+  }
+  _trip() {
+    if (this.state === "open") return;
+    this.state = "open";
+    this.openedAt = Date.now();
+    this.window = [];
+    try {
+      this.onTrip?.();
+    } catch {
+    }
+  }
+  _reset() {
+    const wasRecovering = this.state !== "closed";
+    this.state = "closed";
+    this.consecutiveFailures = 0;
+    this.window = [];
+    this.openedAt = null;
+    if (wasRecovering) {
+      try {
+        this.onReset?.();
+      } catch {
+      }
+    }
+  }
+  /** Transition from open → half-open when cooldown elapses. */
+  _checkStateTransition() {
+    if (this.state !== "open" || this.openedAt === null) return;
+    const elapsed = Date.now() - this.openedAt;
+    if (elapsed >= this.cooldownMs) {
+      this.state = "half-open";
+      this.openedAt = null;
+    }
+  }
+  _pruneWindow(now) {
+    const cutoff = now - this.windowMs;
+    this.window = this.window.filter((c) => c.at >= cutoff);
+  }
+};
+
+// src/_redact-command.ts
+import { expectDefined } from "@wrongstack/core";
+var SENSITIVE_FLAG_PATTERNS = [
+  // --flag=value  or  --flag "value"  (value captured up to next space or comma)
+  /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
+  // -f "value" style short flags
+  /(?<!\w)-t(?:\s+|\s*=\s*)[^\s,]+/,
+  /(?<!\w)-(?:p|password)(?:\s+|\s*=\s*)[^\s,]+/gi,
+  // env var–style secrets: TOKEN=x, API_KEY=y, etc.
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
+  // when preceded by a flag name (e.g. --github-token=EyJ...).
+  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/
+];
+function redactCommand(cmd) {
+  let result = cmd;
+  for (const pattern of SENSITIVE_FLAG_PATTERNS) {
+    result = result.replace(pattern, (match) => {
+      const eq = match.indexOf("=");
+      const sp = match.search(/\s/);
+      const delim = eq !== -1 ? "=" : sp !== -1 ? match[sp] : null;
+      if (delim !== null) {
+        const flag = match.slice(0, match.indexOf(expectDefined(delim)) + 1);
+        return `${flag}[REDACTED]`;
+      }
+      const flagEnd = match.match(/^--?[a-zA-Z][a-zA-Z0-9_-]*/)?.[0] ?? match;
+      return `${flagEnd}=**redacted**`;
+    });
+  }
+  return result;
+}
+
+// src/process-registry.ts
+var DEFAULT_GRACE_MS = 2e3;
+var WIN32_TASKKILL_TIMEOUT_MS = 5e3;
+function killWin32Tree(pid, opts = {}) {
+  try {
+    const child = spawn("taskkill", ["/pid", String(pid), "/T", "/F"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
+    let settled = false;
+    let timeout;
+    const settle = () => {
+      if (settled) return;
+      settled = true;
+      if (timeout) clearTimeout(timeout);
+      try {
+        opts.onSettled?.();
+      } catch {
+      }
+    };
+    child.on("error", settle);
+    child.on("close", settle);
+    timeout = setTimeout(() => {
+      try {
+        child.kill();
+      } catch {
+      }
+      settle();
+    }, Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS));
+    timeout.unref?.();
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+var ProcessRegistryImpl = class {
+  processes = /* @__PURE__ */ new Map();
+  breaker;
+  /**
+   * Auto kill/reset config. When the breaker trips and `autoKillResetMs > 0`,
+   * a countdown is armed; on expiry all tracked processes are killed and the
+   * breaker is reset to closed (forced recovery). Zero means manual recovery
+   * only (`/kill reset`).
+   */
+  autoKillResetMs = 0;
+  autoKillTimer = null;
+  autoKillArmedAt = null;
+  breakerCountdownListeners = [];
+  constructor(breakerConfig) {
+    this.breaker = new CircuitBreaker(breakerConfig);
+    this.breaker.onTrip = () => this._armAutoKillReset();
+    this.breaker.onReset = () => this._cancelAutoKillReset();
+    this.breaker.setEnabled(false);
+  }
+  register(info) {
+    this.processes.set(info.pid, { ...info, killed: false, protected: info.protected ?? false });
+  }
+  _isSafeSignalPid(pid) {
+    return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
+  }
+  _canSignalProcessGroup(p) {
+    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && typeof p.child.pid === "number" && p.child.pid === p.pid;
+  }
+  _killChildDirect(p, signal) {
+    try {
+      p.child.kill(signal);
+    } catch {
+    }
+  }
+  _killPosix(p, signal) {
+    if (this._canSignalProcessGroup(p)) {
+      try {
+        process.kill(-p.pid, signal);
+        return;
+      } catch {
+      }
+    }
+    this._killChildDirect(p, signal);
+  }
+  /** Unregister a process by PID. Called on 'close' / 'exit' events. */
+  unregister(pid) {
+    this.processes.delete(pid);
+  }
+  /** Get a single process by PID. */
+  get(pid) {
+    this._pruneStale(pid);
+    return this.processes.get(pid);
+  }
+  /** Get all tracked processes. */
+  list() {
+    return Array.from(this.processes.values());
+  }
+  /** Get processes filtered by name (e.g. 'bash', 'exec'). */
+  byName(name) {
+    return this.list().filter((p) => p.name === name);
+  }
+  /** Get processes filtered by session. */
+  bySession(sessionId) {
+    return this.list().filter((p) => p.sessionId === sessionId);
+  }
+  /** Count of active (non-killed) processes. */
+  get activeCount() {
+    let n = 0;
+    for (const p of this.processes.values()) {
+      if (!p.killed) n++;
+    }
+    return n;
+  }
+  /**
+   * Combined stats for observability — used by /ps and the TUI status bar.
+   */
+  stats() {
+    return {
+      activeCount: this.activeCount,
+      totalCount: this.processes.size,
+      breaker: this.breaker.snapshot()
+    };
+  }
+  /**
+   * Returns true if the circuit allows a new bash/exec call to proceed.
+   * When false, callers MUST NOT spawn a process.
+   */
+  get canProceed() {
+    return this.breaker.canProceed;
+  }
+  /**
+   * Called before spawning a process. Returns true if allowed; false if
+   * the circuit breaker is open.
+   *
+   * @param bypass - If true, skip circuit breaker check (for background processes).
+   */
+  beforeCall(bypass = false) {
+    return this.breaker.beforeCall(bypass);
+  }
+  /**
+   * Called after a process finishes. `durationMs` is wall-clock time;
+   * `failed` is true for non-zero exit codes.
+   *
+   * @param bypass - If true, do not update circuit breaker state (for background processes).
+   */
+  afterCall(durationMs, failed, bypass = false) {
+    this.breaker.afterCall(durationMs, failed, bypass);
+  }
+  /** Force-open the circuit breaker (Ctrl+C, /kill force). */
+  forceBreakerOpen() {
+    this.breaker.forceOpen();
+  }
+  /** Force-reset the circuit breaker to closed (/kill reset). */
+  forceBreakerReset() {
+    this.breaker.forceReset();
+  }
+  /**
+   * Configure circuit-breaker protection at runtime. Called from `/settings`
+   * (instant, all modes) and on TUI mount (applies persisted config).
+   *
+   * - `enabled` toggles whether the breaker gates `bash`/`exec`.
+   * - `autoKillResetMs` arms the auto kill/reset countdown when the breaker
+   *   trips (0 = manual recovery only).
+   *
+   * Re-applies cleanly on every call: cancels a pending countdown when the
+   * timeout is cleared or protection disabled, and re-arms if the breaker is
+   * currently open under the new settings.
+   */
+  setBreakerConfig(cfg) {
+    if (cfg.enabled !== void 0) this.breaker.setEnabled(cfg.enabled);
+    if (cfg.autoKillResetMs !== void 0) this.autoKillResetMs = Math.max(0, cfg.autoKillResetMs);
+    if (this.autoKillResetMs <= 0) {
+      this._cancelAutoKillReset();
+      return;
+    }
+    if (this.breaker.isEnabled && this.breaker.snapshot().state === "open") {
+      this._armAutoKillReset();
+    }
+  }
+  /**
+   * Live countdown to the next auto kill/reset, or null when nothing is armed.
+   * The TUI polls this on a 1s tick while armed so the statusline decrements.
+   */
+  getBreakerCountdown() {
+    if (this.autoKillArmedAt === null || this.autoKillResetMs <= 0) return null;
+    const elapsed = Date.now() - this.autoKillArmedAt;
+    return { remainingMs: Math.max(0, this.autoKillResetMs - elapsed), totalMs: this.autoKillResetMs };
+  }
+  /**
+   * Subscribe to countdown arm/cancel events. Returns an unsubscribe function.
+   * Use {@link getBreakerCountdown} for the live ticking value between events.
+   */
+  onBreakerCountdownChange(listener) {
+    this.breakerCountdownListeners.push(listener);
+    return () => {
+      this.breakerCountdownListeners = this.breakerCountdownListeners.filter((l) => l !== listener);
+    };
+  }
+  _emitBreakerCountdown() {
+    const snap = this.getBreakerCountdown();
+    for (const l of this.breakerCountdownListeners) {
+      try {
+        l(snap);
+      } catch {
+      }
+    }
+  }
+  /**
+   * Arm the auto kill/reset countdown. Idempotent: re-arming resets the window
+   * (a fresh trip after a failed half-open probe restarts the clock). No-op
+   * when protection is off or no timeout is configured.
+   */
+  _armAutoKillReset() {
+    if (this.autoKillResetMs <= 0 || !this.breaker.isEnabled) return;
+    this._clearAutoKillTimer();
+    this.autoKillArmedAt = Date.now();
+    this.autoKillTimer = setTimeout(() => {
+      this.autoKillTimer = null;
+      this.autoKillArmedAt = null;
+      this.killAll({ force: false });
+      this.breaker.forceReset();
+      this._emitBreakerCountdown();
+    }, this.autoKillResetMs);
+    this.autoKillTimer.unref?.();
+    this._emitBreakerCountdown();
+  }
+  _cancelAutoKillReset() {
+    const wasArmed = this.autoKillArmedAt !== null;
+    this._clearAutoKillTimer();
+    if (wasArmed) {
+      this.autoKillArmedAt = null;
+      this._emitBreakerCountdown();
+    }
+  }
+  _clearAutoKillTimer() {
+    if (this.autoKillTimer !== null) {
+      clearTimeout(this.autoKillTimer);
+      this.autoKillTimer = null;
+    }
+  }
+  /** Kill a single process by PID.
+   *
+   *  On POSIX: sends SIGTERM to the *process group* (-pid) so that
+   *  runaway grandchild processes (`sleep 9999 & disown`) are also killed.
+   *  After `graceMs` a SIGKILL is sent if the process hasn't exited.
+   *
+   *  On Windows: `child.kill()` maps to TerminateProcess — process groups
+   *  are not meaningfully supported. A second `force=true` call sends
+   *  SIGKILL (which maps to TerminateProcess again — the distinction is
+   *  in the exit code, not the signal).
+   *
+   *  Returns true if the process was found and kill was attempted.
+   */
+  kill(pid, opts = {}) {
+    this._pruneStale(pid);
+    const p = this.processes.get(pid);
+    if (!p) return false;
+    if (p.killed) return true;
+    if (p.protected) return false;
+    const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
+    const isWin2 = os.platform() === "win32";
+    if (isWin2) {
+      const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
+      const directFallback = () => {
+        if (p.child.exitCode === null) {
+          try {
+            p.child.kill("SIGKILL");
+          } catch {
+          }
+        }
+      };
+      if (liveRealChild && killWin32Tree(pid, {
+        timeoutMs: Math.max(graceMs, WIN32_TASKKILL_TIMEOUT_MS),
+        onSettled: directFallback
+      })) {
+      } else {
+        try {
+          p.child.kill(force ? "SIGKILL" : "SIGTERM");
+        } catch {
+        }
+      }
+      p.killed = true;
+      return true;
+    }
+    try {
+      if (force) {
+        this._killPosix(p, "SIGKILL");
+      } else {
+        this._killPosix(p, "SIGTERM");
+        const timer = setTimeout(() => {
+          if (this.processes.has(pid) && !p.child.killed) {
+            this._killPosix(p, "SIGKILL");
+          }
+        }, graceMs);
+        timer.unref?.();
+      }
+    } catch {
+    }
+    p.killed = true;
+    return true;
+  }
+  /**
+   * Kill all tracked processes.
+   * Returns the PIDs that were kill()ed.
+   */
+  killAll(opts = {}) {
+    const pids = Array.from(this.processes.keys());
+    const killed = [];
+    for (const pid of pids) {
+      const p = this.processes.get(pid);
+      if (p && !p.protected && this.kill(pid, opts)) killed.push(pid);
+    }
+    return killed;
+  }
+  /**
+   * Kill all processes for a specific session.
+   * Returns the PIDs that were kill()ed.
+   */
+  killSession(sessionId, opts = {}) {
+    const pids = this.bySession(sessionId).map((p) => p.pid);
+    const killed = [];
+    for (const pid of pids) {
+      if (this.kill(pid, opts)) killed.push(pid);
+    }
+    return killed;
+  }
+  /**
+   * Check whether a tracked process entry is stale — the child has exited
+   * (exitCode !== null) AND it's been in the registry long enough that the
+   * OS may have reused the PID for a new, unrelated process.
+   *
+   * P3 #24 (before-release.md): on POSIX, PIDs are reused after process
+   * exit. If a tracked process exits but its 'close' event hasn't fired yet
+   * (or was missed), the registry still holds the entry. A new process
+   * gets the same PID, and PID-based lookups (get, kill, shouldBlockKill)
+   * may incorrectly protect or target the wrong process.
+   *
+   * The 60s threshold is conservative — the OS typically waits much longer
+   * before reusing a PID, but we want to clean up before that becomes a risk.
+   */
+  _isStaleEntry(entry) {
+    return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
+  }
+  /**
+   * Remove a stale entry for a specific PID before any PID-based lookup.
+   * This prevents PID reuse from causing the registry to act on a dead
+   * process that has been replaced by a new one with the same PID.
+   */
+  _pruneStale(pid) {
+    const entry = this.processes.get(pid);
+    if (entry && this._isStaleEntry(entry)) {
+      this.processes.delete(pid);
+    }
+  }
+};
+var _registry;
+function getProcessRegistry() {
+  if (!_registry) {
+    _registry = new ProcessRegistryImpl();
+  }
+  return _registry;
+}
+
+// src/_win32-resolve.ts
+import * as fs2 from "node:fs";
+import * as path4 from "node:path";
+function resolveWin32Command(cmd) {
+  if (process.platform !== "win32") return cmd;
+  if (cmd.includes("/") || cmd.includes("\\") || path4.extname(cmd.replace(/\//g, "\\"))) {
+    return cmd;
+  }
+  const pathext = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC").toLowerCase().split(";");
+  const pathDirs = (process.env["PATH"] ?? "").split(path4.delimiter);
+  for (const dir of pathDirs) {
+    const base = path4.join(dir, cmd);
+    for (const ext of pathext) {
+      const full = `${base}${ext}`;
+      try {
+        fs2.accessSync(full, fs2.constants.X_OK);
+        return full;
+      } catch {
+      }
+    }
+  }
+  return cmd;
+}
+var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+function assertSafeWin32ShellArgs(args) {
+  for (const arg of args) {
+    if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
+      throw new Error(
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+      );
+    }
+  }
+}
+function buildWin32CmdShimInvocation(command, args = []) {
+  assertSafeWin32ShellArgs([command, ...args]);
+  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
+  return {
+    command: process.env["COMSPEC"] ?? "cmd.exe",
+    args: ["/d", "/c", line],
+    windowsVerbatimArguments: true
+  };
+}
+function quoteWin32CmdArg(arg) {
+  return `"${arg}"`;
+}
+
+// src/_spawn-stream.ts
+var isWin = process.platform === "win32";
+async function* spawnStream(opts) {
+  const max = opts.maxBytes ?? 2e5;
+  const flushAt = opts.flushBytes ?? 4 * 1024;
+  const maxQueue = opts.maxQueueSize ?? 500;
+  let stdout = "";
+  let stderr = "";
+  let pending = "";
+  let error;
+  const spool = createOutputSpool({ tool: opts.cmd, thresholdBytes: max });
+  const resolved = resolveWin32Command(opts.cmd);
+  const needsShell = isWin && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
+  const shim = needsShell ? buildWin32CmdShimInvocation(resolved, opts.args) : null;
+  const cmd = shim?.command ?? resolved;
+  const args = shim?.args ?? opts.args;
+  const child = spawn2(cmd, args, {
+    cwd: opts.cwd,
+    env: buildChildEnv(),
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true,
+    ...isWin ? {} : { signal: opts.signal },
+    ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
+  });
+  const registry = getProcessRegistry();
+  const pid = child.pid;
+  if (typeof pid === "number") {
+    registry.register({
+      pid,
+      name: opts.cmd,
+      command: redactCommand(`${opts.cmd} ${opts.args.join(" ")}`),
+      startedAt: Date.now(),
+      child
+    });
+  }
+  const queue = [];
+  let waiter;
+  let paused = false;
+  const wake = () => {
+    if (waiter) {
+      const w = waiter;
+      waiter = void 0;
+      w();
+    }
+  };
+  const resume = () => {
+    if (paused && queue.length < maxQueue) {
+      paused = false;
+      child.stdout?.resume();
+      child.stderr?.resume();
+    }
+  };
+  const onOut = (c) => {
+    const s = c.toString();
+    if (stdout.length < max) stdout += s;
+    spool.write(s);
+    queue.push({ kind: "out", data: s });
+    wake();
+    if (!paused && queue.length >= maxQueue) {
+      paused = true;
+      child.stdout?.pause();
+      child.stderr?.pause();
+    }
+  };
+  const onErr = (c) => {
+    const s = c.toString();
+    if (stderr.length < max) stderr += s;
+    spool.write(s);
+    queue.push({ kind: "err", data: s });
+    wake();
+    if (!paused && queue.length >= maxQueue) {
+      paused = true;
+      child.stdout?.pause();
+      child.stderr?.pause();
+    }
+  };
+  child.stdout?.on("data", onOut);
+  child.stderr?.on("data", onErr);
+  child.on("error", (e) => {
+    error = e.message;
+    queue.push({ kind: "error", data: e.message });
+    wake();
+  });
+  child.on("close", (code) => {
+    if (typeof pid === "number") registry.unregister(pid);
+    queue.push({ kind: "close", data: "", code: code ?? 0 });
+    wake();
+  });
+  const onAbort = () => {
+    if (typeof pid === "number") {
+      registry.kill(pid, { force: true });
+    } else {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+    }
+    queue.push({ kind: "close", data: "", code: 124 });
+    wake();
+  };
+  if (isWin) {
+    if (opts.signal.aborted) onAbort();
+    else opts.signal.addEventListener("abort", onAbort, { once: true });
+  }
+  let exitCode = 0;
+  let spawnFailed = false;
+  try {
+    for (; ; ) {
+      while (queue.length === 0) {
+        await new Promise((resolve5) => {
+          waiter = resolve5;
+        });
+      }
+      const chunk = queue.shift();
+      resume();
+      if (chunk.kind === "close") {
+        if (!spawnFailed) exitCode = chunk.code ?? 0;
+        break;
+      }
+      if (chunk.kind === "error") {
+        spawnFailed = true;
+        exitCode = 1;
+        continue;
+      }
+      pending += chunk.data;
+      if (pending.length >= flushAt) {
+        yield { type: "partial_output", text: pending };
+        pending = "";
+      }
+    }
+    if (pending.length > 0) {
+      yield { type: "partial_output", text: pending };
+    }
+    const spooled = spool.finalize();
+    return {
+      // The marker rides on stdout's tail so every consumer's head+tail
+      // normalization keeps it without per-tool changes.
+      stdout: spooled ? stdout + spoolNote(spooled) : stdout,
+      stderr,
+      exitCode,
+      truncated: stdout.length >= max || stderr.length >= max,
+      error,
+      spoolPath: spooled?.path,
+      spoolBytes: spooled?.bytes
+    };
+  } finally {
+    spool.finalize();
+    if (isWin) opts.signal.removeEventListener("abort", onAbort);
+    child.stdout?.off("data", onOut);
+    child.stderr?.off("data", onErr);
+    child.stdout?.destroy();
+    child.stderr?.destroy();
+    if (child.exitCode === null && !child.killed) {
+      if (typeof pid === "number") {
+        registry.kill(pid, { force: true });
+      } else {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+      }
+    }
+  }
+}
+
+// src/_util.ts
+import * as fsp2 from "node:fs/promises";
+import * as path5 from "node:path";
+import * as Core from "@wrongstack/core";
+function resolvePath(input, ctx) {
+  return path5.isAbsolute(input) ? path5.normalize(input) : path5.resolve(ctx.workingDir ?? ctx.cwd, input);
+}
+function allowedRoots(ctx) {
+  return [path5.resolve(ctx.projectRoot), path5.resolve(Core.wstackGlobalRoot())];
+}
+function isInsideAny(target, roots) {
+  return roots.some((root) => {
+    const rel = path5.relative(root, target);
+    return rel === "" || !rel.startsWith("..") && !path5.isAbsolute(rel);
+  });
+}
+function ensureInsideRoot(absPath, ctx) {
+  const target = path5.resolve(absPath);
+  if (ctx.allowOutsideProjectRoot) return target;
+  if (isInsideAny(target, allowedRoots(ctx))) return target;
+  throw new Error(`Path "${absPath}" is outside project root "${path5.resolve(ctx.projectRoot)}"`);
+}
+function safeResolve(input, ctx) {
+  return ensureInsideRoot(resolvePath(input, ctx), ctx);
+}
+async function assertRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return;
+  const realRoots = await Promise.all(
+    allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path5.resolve(r)))
+  );
+  let probe = absPath;
+  for (; ; ) {
+    let real;
+    try {
+      real = await fsp2.realpath(probe);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        const parent = path5.dirname(probe);
+        if (parent === probe) return;
+        probe = parent;
+        continue;
+      }
+      throw err;
+    }
+    if (isInsideAny(real, realRoots)) return;
+    throw new Error(
+      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
+    );
+  }
+}
+async function safeResolveReal(input, ctx) {
+  const abs = safeResolve(input, ctx);
+  await assertRealInsideRoot(abs, ctx);
+  return abs;
+}
+var COMMAND_OUTPUT_MAX_BYTES = 32768;
+var REPEAT_RUN_THRESHOLD = 3;
+function collapseCarriageReturns(text) {
+  const lf = text.replace(/\r\n/g, "\n");
+  if (!lf.includes("\r")) return lf;
+  return lf.split("\n").map((line) => line.includes("\r") ? line.slice(line.lastIndexOf("\r") + 1) : line).join("\n");
+}
+function collapseConsecutiveDuplicates(text, minRun = REPEAT_RUN_THRESHOLD) {
+  const lines = text.split("\n");
+  const out = [];
+  let i = 0;
+  while (i < lines.length) {
+    let j = i + 1;
+    while (j < lines.length && lines[j] === lines[i]) j++;
+    const run = j - i;
+    if (run >= minRun) {
+      out.push(lines[i], `\u2026 \u27E8repeated ${run}\xD7\u27E9`);
+    } else {
+      for (let k = i; k < j; k++) out.push(lines[k]);
+    }
+    i = j;
+  }
+  return out.join("\n");
+}
+function takeHeadBytes(s, maxBytes) {
+  if (maxBytes <= 0) return "";
+  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
+  let lo = 0;
+  let hi = s.length;
+  while (lo < hi) {
+    const mid = Math.ceil((lo + hi) / 2);
+    if (Buffer.byteLength(s.slice(0, mid), "utf8") <= maxBytes) lo = mid;
+    else hi = mid - 1;
+  }
+  return s.slice(0, lo);
+}
+function takeTailBytes(s, maxBytes) {
+  if (maxBytes <= 0) return "";
+  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
+  let lo = 0;
+  let hi = s.length;
+  while (lo < hi) {
+    const mid = Math.ceil((lo + hi) / 2);
+    if (Buffer.byteLength(s.slice(s.length - mid), "utf8") <= maxBytes) lo = mid;
+    else hi = mid - 1;
+  }
+  return s.slice(s.length - lo);
+}
+function truncateHeadTail(s, maxBytes) {
+  const total = Buffer.byteLength(s, "utf8");
+  if (total <= maxBytes) return s;
+  const MARKER_RESERVE = 64;
+  const avail = Math.max(0, maxBytes - MARKER_RESERVE);
+  const headBudget = Math.floor(avail * 0.45);
+  const head = takeHeadBytes(s, headBudget);
+  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, "utf8"));
+  const kept = Buffer.byteLength(head, "utf8") + Buffer.byteLength(tail, "utf8");
+  return `${head}
+\u2026[truncated ${total - kept} bytes]\u2026
+${tail}`;
+}
+function normalizeCommandOutput(raw, opts = {}) {
+  if (!raw) return raw;
+  let text = Core.stripAnsi(raw);
+  text = collapseCarriageReturns(text);
+  text = text.replace(/[ \t]+$/gm, "");
+  text = collapseConsecutiveDuplicates(text);
+  text = text.replace(/\n{3,}/g, "\n\n");
+  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);
+}
+
+// src/languages/plan.ts
+import * as fs3 from "node:fs/promises";
+import * as path6 from "node:path";
+var MAX_ARGUMENTS = 128;
+var MAX_ARGUMENT_LENGTH = 4096;
+var PACKAGE_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+(?:@[a-z0-9*+._~^<>=|-]+)?$/i;
+var COMPOSER_PACKAGE_RE = /^[a-z0-9_.-]+\/[a-z0-9_.-]+(?::[a-z0-9*+._~^<>=|-]+)?$/i;
+var GO_MODULE_RE = /^(?:[a-z0-9.-]+\.)+[a-z0-9.-]+\/[a-z0-9._~+/@-]+$/i;
+async function planLanguageOperation(options) {
+  validateOperationOptions(options.operation, options.operationOptions?.packages);
+  const detection = await detectLanguageWorkspaces(options);
+  const candidates = detection.workspaces.filter(
+    (workspace) => workspace.capabilities.includes(options.operation)
+  );
+  const selected = selectWorkspace(candidates, options);
+  if (selected.status !== "selected") return selected.result;
+  const profile = (options.profiles ?? languageProfileRegistry.list()).find(
+    (item) => item.id === selected.workspace.language
+  );
+  if (!profile) {
+    return {
+      status: "not_found",
+      reason: `Profile ${selected.workspace.language} is unavailable.`,
+      candidates
+    };
+  }
+  if ((profile.id === "typescript" || profile.id === "javascript") && options.operation !== "syntax" && selected.workspace.packageManager === void 0 && new Set(
+    selected.workspace.evidence.filter((evidence) => evidence.kind === "lockfile").map((evidence) => evidence.value.toLowerCase())
+  ).size > 1) {
+    return {
+      status: "unavailable",
+      workspace: selected.workspace,
+      unavailable: {
+        status: "unavailable",
+        profileId: profile.id,
+        workspaceId: selected.workspace.id,
+        operation: options.operation,
+        reason: "Conflicting Node lockfiles make the package manager ambiguous."
+      }
+    };
+  }
+  const resolver = profile.operations[options.operation];
+  if (!resolver) {
+    return {
+      status: "unavailable",
+      workspace: selected.workspace,
+      unavailable: {
+        status: "unavailable",
+        profileId: profile.id,
+        workspaceId: selected.workspace.id,
+        operation: options.operation,
+        reason: `${profile.displayName} does not define ${options.operation}.`
+      }
+    };
+  }
+  const canonicalCwd = options.cwd ? path6.isAbsolute(options.cwd) ? options.cwd : path6.resolve(detection.projectRoot, options.cwd) : detection.projectRoot;
+  const target = options.target ? await canonicalTarget(canonicalCwd, options.target, detection.projectRoot) : void 0;
+  const ctx = {
+    projectRoot: detection.projectRoot,
+    workspace: selected.workspace,
+    ...target ? { target } : {},
+    mode: options.mode ?? "standard",
+    options: options.operationOptions ?? {},
+    platform: process.platform,
+    pathExists: async (candidate) => {
+      try {
+        await fs3.access(path6.resolve(detection.projectRoot, candidate));
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+  const result = await resolver(ctx);
+  if ("status" in result) {
+    return { status: "unavailable", workspace: selected.workspace, unavailable: result };
+  }
+  const errors = validateCommandPlan(result, profile, detection.projectRoot);
+  if (errors.length > 0) {
+    return {
+      status: "unavailable",
+      workspace: selected.workspace,
+      unavailable: {
+        status: "unavailable",
+        profileId: profile.id,
+        workspaceId: selected.workspace.id,
+        operation: options.operation,
+        reason: `Generated plan failed validation: ${errors.join("; ")}`
+      }
+    };
+  }
+  return { status: "planned", workspace: selected.workspace, plan: Object.freeze(result) };
+}
+function validateCommandPlan(plan, profile, projectRoot) {
+  const errors = [];
+  if (plan.profileId !== profile.id) errors.push("profile id does not match");
+  if (!isInside2(plan.cwd, projectRoot)) errors.push("cwd is outside project root");
+  if (plan.args.length > MAX_ARGUMENTS) errors.push(`argument count exceeds ${MAX_ARGUMENTS}`);
+  if (plan.args.some((arg) => arg.length > MAX_ARGUMENT_LENGTH || /[\r\n\0]/.test(arg))) {
+    errors.push("arguments contain an invalid or oversized value");
+  }
+  if (!Number.isFinite(plan.timeoutMs) || plan.timeoutMs < 1 || plan.timeoutMs > 6e5) {
+    errors.push("timeout is outside 1..600000ms");
+  }
+  if (!Number.isFinite(plan.outputLimitBytes) || plan.outputLimitBytes < 1 || plan.outputLimitBytes > 1e6) {
+    errors.push("output limit is outside 1..1000000 bytes");
+  }
+  if (plan.kind === "internal") {
+    if (plan.command !== null || plan.args.length !== 0)
+      errors.push("internal plans cannot declare a command");
+  } else {
+    if (!plan.command || !profile.executables.includes(plan.command)) {
+      errors.push(`executable "${plan.command ?? ""}" is not allowlisted by the profile`);
+    }
+  }
+  if (Object.keys(plan.env).length > 0)
+    errors.push("Phase 1 plans cannot override environment variables");
+  return errors;
+}
+function selectWorkspace(candidates, options) {
+  if (candidates.length === 0) {
+    return {
+      status: "result",
+      result: {
+        status: "not_found",
+        reason: `No workspace supports ${options.operation}.`,
+        candidates: []
+      }
+    };
+  }
+  if (options.workspace) {
+    const requested = path6.isAbsolute(options.workspace) ? path6.resolve(options.workspace) : path6.resolve(options.projectRoot, options.workspace);
+    const matches = candidates.filter(
+      (item) => item.id === options.workspace || path6.resolve(item.root) === requested
+    );
+    if (matches.length === 1) return { status: "selected", workspace: matches[0] };
+    return {
+      status: "result",
+      result: {
+        status: "not_found",
+        reason: `Requested workspace "${options.workspace}" was not detected.`,
+        candidates: [...candidates]
+      }
+    };
+  }
+  if (options.target) {
+    const base = options.cwd ? path6.isAbsolute(options.cwd) ? path6.resolve(options.cwd) : path6.resolve(options.projectRoot, options.cwd) : path6.resolve(options.projectRoot);
+    const target = path6.isAbsolute(options.target) ? path6.resolve(options.target) : path6.resolve(base, options.target);
+    const targeted = candidates.filter((item) => item.evidence.some((evidence) => evidence.kind === "target")).sort(
+      (a, b) => workspaceDepth(b.root, options.projectRoot) - workspaceDepth(a.root, options.projectRoot) || compareCandidates(a, b)
+    );
+    if (targeted[0]) return { status: "selected", workspace: targeted[0] };
+    const containing = candidates.filter((item) => isInside2(target, item.root)).sort(
+      (a, b) => workspaceDepth(b.root, options.projectRoot) - workspaceDepth(a.root, options.projectRoot) || compareCandidates(a, b)
+    );
+    if (containing[0]) return { status: "selected", workspace: containing[0] };
+  }
+  const sorted = [...candidates].sort(compareCandidates);
+  const first = sorted[0];
+  const firstDepth = workspaceDepth(first.root, options.projectRoot);
+  const tied = sorted.filter(
+    (item) => item.confidence === first.confidence && workspaceDepth(item.root, options.projectRoot) === firstDepth
+  );
+  if (tied.length > 1) {
+    return {
+      status: "result",
+      result: {
+        status: "ambiguous",
+        reason: "Multiple workspaces have equal confidence; provide target, language, or workspace.",
+        candidates: tied
+      }
+    };
+  }
+  return { status: "selected", workspace: first };
+}
+function compareCandidates(a, b) {
+  return b.confidence - a.confidence || a.language.localeCompare(b.language) || a.root.localeCompare(b.root);
+}
+function workspaceDepth(workspaceRoot, projectRoot) {
+  const relative5 = path6.relative(path6.resolve(projectRoot), path6.resolve(workspaceRoot));
+  return relative5 === "" ? 0 : relative5.split(path6.sep).length;
+}
+function validateOperationOptions(operation, packages) {
+  if (!operation.startsWith("package-") || !packages) return;
+  for (const value of packages) {
+    if (!value || value.length > 214 || value.startsWith("-") || /[\r\n\0;&|`$<>\\]/.test(value)) {
+      throw new Error(`Invalid package identifier "${value}"`);
+    }
+    if (value.startsWith(".") || value.startsWith("/") || /^[A-Za-z]:/.test(value) || value.includes("://")) {
+      throw new Error(`Package paths and URLs are not supported: "${value}"`);
+    }
+    if (!PACKAGE_NAME_RE.test(value) && !COMPOSER_PACKAGE_RE.test(value) && !GO_MODULE_RE.test(value)) {
+      throw new Error(`Invalid package identifier "${value}"`);
+    }
+  }
+}
+async function canonicalTarget(cwd, target, projectRoot) {
+  const resolved = path6.isAbsolute(target) ? path6.resolve(target) : path6.resolve(cwd, target);
+  let real;
+  try {
+    real = await fs3.realpath(resolved);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    const parent = await fs3.realpath(path6.dirname(resolved));
+    real = path6.join(parent, path6.basename(resolved));
+  }
+  if (!isInside2(real, projectRoot)) throw new Error(`target is outside project root: ${target}`);
+  return real;
+}
+function isInside2(candidate, root) {
+  const relative5 = path6.relative(path6.resolve(root), path6.resolve(candidate));
+  return relative5 === "" || !relative5.startsWith("..") && !path6.isAbsolute(relative5);
+}
+
+// src/languages/execute.ts
+var MAX_INTERNAL_SOURCE_BYTES = 15e5;
+async function* executeLanguagePlan(options) {
+  const { plan, workspace } = options;
+  if (options.signal.aborted) {
+    return terminalResult(options, "cancelled", options.signal.reason);
+  }
+  const profile = languageProfileRegistry.get(plan.profileId);
+  if (!profile) return unavailableResult(options, `Unknown language profile: ${plan.profileId}`);
+  if (workspace.id !== plan.workspaceId || workspace.language !== plan.profileId) {
+    return unavailableResult(options, "Plan and workspace identity do not match.");
+  }
+  const validation = validateCommandPlan(plan, profile, options.projectRoot);
+  if (validation.length > 0) {
+    return unavailableResult(options, `Plan failed execution validation: ${validation.join("; ")}`);
+  }
+  const containmentError = await validatePlanRealpaths(plan, options.projectRoot);
+  if (containmentError) return unavailableResult(options, containmentError);
+  if (plan.operation.startsWith("package-") || plan.network) {
+    return terminalNonPackageResult(
+      options,
+      "Package and network plans require the separate language_package tool (Phase 3)."
+    );
+  }
+  const startedAt = Date.now();
+  yield {
+    type: "log",
+    text: plan.kind === "internal" ? `Running ${plan.parser}\u2026` : `${plan.command} ${plan.args.join(" ")}`,
+    data: { language: plan.profileId, operation: plan.operation, workspace: workspace.root }
+  };
+  if (plan.kind === "internal") {
+    try {
+      return await executeInternal(options, startedAt);
+    } catch (error) {
+      return unavailableResult(options, error instanceof Error ? error.message : String(error));
+    }
+  }
+  const timeoutController = new AbortController();
+  const timer = setTimeout(
+    () => timeoutController.abort(new Error("language plan timed out")),
+    plan.timeoutMs
+  );
+  timer.unref?.();
+  const signal = AbortSignal.any([options.signal, timeoutController.signal]);
+  let spawned;
+  try {
+    const stream = spawnStream({
+      cmd: plan.command,
+      args: [...plan.args],
+      cwd: plan.cwd,
+      signal,
+      maxBytes: plan.outputLimitBytes
+    });
+    for (; ; ) {
+      const next = await stream.next();
+      if (next.done) {
+        spawned = next.value;
+        break;
+      }
+      yield next.value;
+    }
+  } catch (error) {
+    const timedOut2 = timeoutController.signal.aborted && !options.signal.aborted;
+    const cancelled2 = options.signal.aborted;
+    return {
+      status: timedOut2 ? "timed_out" : cancelled2 ? "cancelled" : "failed",
+      language: plan.profileId,
+      workspace,
+      plan,
+      exitCode: null,
+      durationMs: Date.now() - startedAt,
+      diagnostics: Object.freeze([]),
+      omittedDiagnostics: 0,
+      summary: emptySummary2(),
+      output: "",
+      truncated: false,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+  const parsed = parseLanguageDiagnostics(
+    plan.parser,
+    spawned.stdout,
+    spawned.stderr,
+    workspace.root
+  );
+  const timedOut = timeoutController.signal.aborted && !options.signal.aborted;
+  const cancelled = options.signal.aborted;
+  const spawnUnavailable = Boolean(
+    spawned.error && /ENOENT|not found|cannot find/i.test(spawned.error)
+  );
+  const status = timedOut ? "timed_out" : cancelled ? "cancelled" : spawnUnavailable ? "unavailable" : spawned.exitCode === 0 ? "passed" : "failed";
+  const raw = [spawned.stdout, spawned.stderr, spawned.error].filter(Boolean).join("\n");
+  return {
+    status,
+    language: plan.profileId,
+    workspace,
+    plan,
+    exitCode: spawned.exitCode,
+    durationMs: Date.now() - startedAt,
+    diagnostics: parsed.diagnostics,
+    omittedDiagnostics: parsed.omitted,
+    summary: parsed.summary,
+    output: normalizeCommandOutput(raw, { maxBytes: plan.outputLimitBytes }),
+    truncated: spawned.truncated,
+    ...spawned.spoolPath ? { spoolPath: spawned.spoolPath } : {},
+    ...spawned.error ? { error: spawned.error } : {}
+  };
+}
+async function executeInternal(options, startedAt) {
+  const target = options.plan.evidence.find((item) => item.kind === "target")?.path;
+  if (!target) return unavailableResult(options, "Internal syntax plan has no target evidence.");
+  const safeTarget = await assertContainedFile(target, options.projectRoot);
+  const stat4 = await fs4.stat(safeTarget);
+  if (stat4.size > MAX_INTERNAL_SOURCE_BYTES) {
+    return unavailableResult(
+      options,
+      `Internal syntax target exceeds ${MAX_INTERNAL_SOURCE_BYTES} bytes.`
+    );
+  }
+  const source = await fs4.readFile(safeTarget, "utf8");
+  const parsed = await diagnosticsForInternalSyntax(options.plan.profileId, safeTarget, source);
+  return {
+    status: parsed.summary.errors > 0 ? "failed" : "passed",
+    language: options.plan.profileId,
+    workspace: options.workspace,
+    plan: options.plan,
+    exitCode: parsed.summary.errors > 0 ? 1 : 0,
+    durationMs: Date.now() - startedAt,
+    diagnostics: parsed.diagnostics,
+    omittedDiagnostics: parsed.omitted,
+    summary: parsed.summary,
+    output: parsed.summary.errors > 0 ? `${parsed.summary.errors} syntax error(s) found.` : "Syntax check passed.",
+    truncated: false
+  };
+}
+async function validatePlanRealpaths(plan, projectRoot) {
+  const realRoot = await fs4.realpath(projectRoot);
+  let realCwd;
+  try {
+    realCwd = await fs4.realpath(plan.cwd);
+  } catch (error) {
+    return `Plan cwd is unavailable: ${error instanceof Error ? error.message : String(error)}`;
+  }
+  if (!isRealInside(realCwd, realRoot)) return "Plan cwd resolves outside project root.";
+  for (const argument of plan.args) {
+    if (!path7.isAbsolute(argument)) continue;
+    try {
+      const realArgument = await fs4.realpath(argument);
+      if (!isRealInside(realArgument, realRoot)) {
+        return `Plan argument resolves outside project root: ${argument}`;
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        return `Plan argument could not be resolved safely: ${argument}`;
+      }
+    }
+  }
+  return void 0;
+}
+function isRealInside(candidate, root) {
+  const relative5 = path7.relative(root, candidate);
+  return relative5 === "" || !relative5.startsWith("..") && !path7.isAbsolute(relative5);
+}
+async function assertContainedFile(candidate, projectRoot) {
+  const realRoot = await fs4.realpath(projectRoot);
+  const realTarget = await fs4.realpath(candidate);
+  const relative5 = path7.relative(realRoot, realTarget);
+  if (relative5.startsWith("..") || path7.isAbsolute(relative5)) {
+    throw new Error(`Internal syntax target resolves outside project root: ${candidate}`);
+  }
+  return realTarget;
+}
+function terminalResult(options, status, reason) {
+  const message = reason instanceof Error ? reason.message : reason ? String(reason) : status;
+  return {
+    status,
+    language: options.plan.profileId,
+    workspace: options.workspace,
+    plan: options.plan,
+    exitCode: null,
+    durationMs: 0,
+    diagnostics: Object.freeze([]),
+    omittedDiagnostics: 0,
+    summary: emptySummary2(),
+    output: "",
+    truncated: false,
+    error: message
+  };
+}
+function unavailableResult(options, reason) {
+  return {
+    status: "unavailable",
+    language: options.plan.profileId,
+    workspace: options.workspace,
+    plan: options.plan,
+    exitCode: null,
+    durationMs: 0,
+    diagnostics: Object.freeze([]),
+    omittedDiagnostics: 0,
+    summary: emptySummary2(),
+    output: reason,
+    truncated: false,
+    error: reason
+  };
+}
+function emptySummary2() {
+  return { errors: 0, warnings: 0, infos: 0 };
+}
+function terminalNonPackageResult(options, reason) {
+  return {
+    status: "unavailable",
+    language: options.plan.profileId,
+    workspace: options.workspace,
+    plan: options.plan,
+    exitCode: null,
+    durationMs: 0,
+    diagnostics: Object.freeze([]),
+    omittedDiagnostics: 0,
+    summary: emptySummary2(),
+    output: reason,
+    truncated: false,
+    error: reason
+  };
+}
+async function* executePackagePlan(options) {
+  const { plan, workspace } = options;
+  const startedAt = Date.now();
+  if (options.signal.aborted) {
+    yield { type: "log", text: "Run cancelled before execution." };
+    return terminalPackageResult(options, "cancelled", startedAt);
+  }
+  const profile = languageProfileRegistry.get(plan.profileId);
+  if (!profile) {
+    yield { type: "warning", text: `Unknown language profile: ${plan.profileId}` };
+    return terminalPackageResult(options, "unavailable", startedAt, "Unknown language profile.");
+  }
+  if (workspace.id !== plan.workspaceId || workspace.language !== plan.profileId) {
+    return terminalPackageResult(
+      options,
+      "unavailable",
+      startedAt,
+      "Plan and workspace identity do not match."
+    );
+  }
+  const validation = validateCommandPlan(plan, profile, options.projectRoot);
+  if (validation.length > 0) {
+    return terminalPackageResult(
+      options,
+      "unavailable",
+      startedAt,
+      `Plan failed execution validation: ${validation.join("; ")}`
+    );
+  }
+  const containmentError = await validatePlanRealpaths(plan, options.projectRoot);
+  if (containmentError) {
+    return terminalPackageResult(options, "unavailable", startedAt, containmentError);
+  }
+  const manifestsBefore = await snapshotPaths(workspace.manifests);
+  const lockfilePaths = collectLockfilePaths(workspace);
+  const lockfilesBefore = await snapshotPaths(lockfilePaths);
+  const manifestSizesBefore = await snapshotSizes(workspace.manifests);
+  const lockfileSizesBefore = await snapshotSizes(lockfilePaths);
+  yield {
+    type: "log",
+    text: plan.kind === "process" ? `${plan.command} ${plan.args.join(" ")}` : `${plan.parser}: ${plan.operation}`,
+    data: {
+      language: plan.profileId,
+      operation: plan.operation,
+      workspace: workspace.root,
+      packages: [...options.packages]
+    }
+  };
+  const timeoutController = new AbortController();
+  const timer = setTimeout(
+    () => timeoutController.abort(new Error("language package plan timed out")),
+    plan.timeoutMs
+  );
+  timer.unref?.();
+  const signal = AbortSignal.any([options.signal, timeoutController.signal]);
+  let spawned;
+  let run;
+  let status = "unavailable";
+  let error;
+  try {
+    if (plan.kind !== "process") {
+      return terminalPackageResult(
+        options,
+        "unavailable",
+        startedAt,
+        "Package operations require an executable plan; internal plans cannot mutate the manifest."
+      );
+    }
+    const stream = spawnStream({
+      cmd: plan.command,
+      args: [...plan.args],
+      cwd: plan.cwd,
+      signal,
+      maxBytes: plan.outputLimitBytes
+    });
+    for (; ; ) {
+      const next = await stream.next();
+      if (next.done) {
+        spawned = next.value;
+        break;
+      }
+      yield next.value;
+    }
+  } catch (error_) {
+    error = error_ instanceof Error ? error_.message : String(error_);
+  } finally {
+    clearTimeout(timer);
+  }
+  if (spawned) {
+    const parsed = parseLanguageDiagnostics(
+      plan.parser,
+      spawned.stdout,
+      spawned.stderr,
+      workspace.root
+    );
+    const timedOut = timeoutController.signal.aborted && !options.signal.aborted;
+    const cancelled = options.signal.aborted;
+    const spawnUnavailable = Boolean(
+      spawned.error && /ENOENT|not found|cannot find/i.test(spawned.error)
+    );
+    status = timedOut ? "timed_out" : cancelled ? "cancelled" : spawnUnavailable ? "unavailable" : spawned.exitCode === 0 ? "passed" : "failed";
+    error ??= spawned.error;
+    const raw = [spawned.stdout, spawned.stderr, spawned.error].filter(Boolean).join("\n");
+    run = {
+      status,
+      language: plan.profileId,
+      workspace,
+      plan,
+      exitCode: spawned.exitCode,
+      durationMs: Date.now() - startedAt,
+      diagnostics: parsed.diagnostics,
+      omittedDiagnostics: parsed.omitted,
+      summary: parsed.summary,
+      output: normalizeCommandOutput(raw, { maxBytes: plan.outputLimitBytes }),
+      truncated: spawned.truncated,
+      ...spawned.spoolPath ? { spoolPath: spawned.spoolPath } : {},
+      ...spawned.error ? { error: spawned.error } : {}
+    };
+  } else {
+    status = options.signal.aborted ? "cancelled" : timeoutController.signal.aborted ? "timed_out" : "failed";
+  }
+  if (status !== "passed") {
+    return terminalPackageResult(
+      options,
+      status,
+      startedAt,
+      error,
+      run,
+      manifestsBefore,
+      lockfilesBefore
+    );
+  }
+  const manifestsAfter = await snapshotPaths(workspace.manifests);
+  const lockfilesAfter = await snapshotPaths(lockfilePaths);
+  const manifestSizesAfter = await snapshotSizes(workspace.manifests);
+  const lockfileSizesAfter = await snapshotSizes(lockfilePaths);
+  const manifestsChanged = await changedPaths(
+    manifestsBefore,
+    manifestsAfter,
+    manifestSizesBefore,
+    manifestSizesAfter
+  );
+  const lockfilesChanged = await changedPaths(
+    lockfilesBefore,
+    lockfilesAfter,
+    lockfileSizesBefore,
+    lockfileSizesAfter
+  );
+  const reports = parsePackageReports(plan.parser, spawned?.stdout ?? "", spawned?.stderr ?? "");
+  const mutations = packageMutationsFromInputs(options.packages, reports.outdated);
+  return {
+    workspace,
+    language: plan.profileId,
+    operation: plan.operation,
+    status,
+    ...run ? { run } : {},
+    durationMs: Date.now() - startedAt,
+    manifestsBefore,
+    lockfilesBefore,
+    manifestsAfter,
+    lockfilesAfter,
+    mutations,
+    vulnerabilities: reports.vulnerabilities,
+    outdated: reports.outdated,
+    manifestsChanged: Object.freeze(manifestsChanged),
+    lockfilesChanged: Object.freeze(lockfilesChanged)
+  };
+}
+function packageMutationsFromInputs(inputs, outdated) {
+  const outdatedNames = new Set(outdated.map((entry) => entry.name));
+  return inputs.filter((name) => !outdatedNames.has(name)).map((name) => ({ name, requested: name, kind: "runtime" }));
+}
+async function snapshotPaths(paths) {
+  const existing = [];
+  for (const candidate of paths) {
+    try {
+      const stat4 = await fs4.stat(candidate);
+      if (!stat4.isFile()) continue;
+      existing.push(candidate);
+    } catch {
+    }
+  }
+  return Object.freeze(existing);
+}
+async function changedPaths(before, after, beforeSizes, afterSizes) {
+  const beforeSet = new Set(before);
+  const afterSet = new Set(after);
+  const changed = /* @__PURE__ */ new Set();
+  for (const path8 of after) {
+    if (!beforeSet.has(path8)) changed.add(path8);
+  }
+  for (const path8 of before) {
+    if (!afterSet.has(path8)) changed.add(path8);
+  }
+  if (beforeSizes && afterSizes) {
+    for (const path8 of after) {
+      if (beforeSizes.get(path8) !== afterSizes.get(path8)) changed.add(path8);
+    }
+  }
+  return [...changed].sort();
+}
+async function snapshotSizes(paths) {
+  const sizes = /* @__PURE__ */ new Map();
+  for (const candidate of paths) {
+    try {
+      const stat4 = await fs4.stat(candidate);
+      if (stat4.isFile()) sizes.set(candidate, stat4.size);
+    } catch {
+    }
+  }
+  return sizes;
+}
+function collectLockfilePaths(workspace) {
+  const explicit = workspace.evidence.filter((evidence) => evidence.kind === "lockfile").map((evidence) => evidence.path);
+  const detected = LOCKFILE_NAMES_BY_PROFILE.get(workspace.language)?.map(
+    (name) => path7.join(workspace.root, name)
+  ) ?? [];
+  const merged = /* @__PURE__ */ new Set();
+  for (const candidate of [...explicit, ...detected]) merged.add(candidate);
+  return Object.freeze([...merged]);
+}
+var LOCKFILE_NAMES_BY_PROFILE = /* @__PURE__ */ new Map([
+  ["typescript", ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"]],
+  ["javascript", ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"]],
+  ["go", ["go.sum"]],
+  ["rust", ["Cargo.lock"]],
+  ["php", ["composer.lock"]],
+  ["csharp", ["packages.lock.json"]]
+]);
+function terminalPackageResult(options, status, startedAt, error, run, manifestsBefore = [], lockfilesBefore = []) {
+  return {
+    workspace: options.workspace,
+    language: options.plan.profileId,
+    operation: options.plan.operation,
+    status,
+    ...run ? { run } : {},
+    durationMs: Date.now() - startedAt,
+    manifestsBefore,
+    lockfilesBefore,
+    manifestsAfter: manifestsBefore,
+    lockfilesAfter: lockfilesBefore,
+    manifestsChanged: Object.freeze([]),
+    lockfilesChanged: Object.freeze([]),
+    mutations: Object.freeze([]),
+    vulnerabilities: Object.freeze([]),
+    outdated: Object.freeze([]),
+    ...error ? { error } : {}
+  };
+}
+
+// src/languages/execute-tool.ts
+var LANGUAGE_IDS = [
+  "typescript",
+  "javascript",
+  "go",
+  "rust",
+  "php",
+  "csharp",
+  "python",
+  "java",
+  "ruby",
+  "c",
+  "cpp",
+  "swift",
+  "dart",
+  "elixir",
+  "deno",
+  "shell"
+];
+var languageTool = {
+  name: "language",
+  category: "Code Quality",
+  description: "Execute predefined language-specific checks, linters, formatters, tests, builds, and debugging evidence.",
+  usageHint: "Use this instead of constructing compiler or test commands manually. The tool detects the workspace, builds an allowlisted argv plan, revalidates it, executes without a shell, and returns normalized diagnostics. Package and network operations are intentionally excluded.",
+  selection: {
+    doNotUseWhen: "You only need workspace detection/planning, or need to modify dependencies.",
+    useInstead: ["language_info", "install", "audit", "outdated"]
+  },
+  permission: "confirm",
+  mutating: true,
+  riskTier: "standard",
+  capabilities: ["shell.restricted", "fs.write"],
+  icon: "code",
+  timeoutMs: 6e5,
+  inputSchema: {
+    type: "object",
+    properties: {
+      action: {
+        type: "string",
+        enum: ["check", "lint", "format", "test", "build", "debug"],
+        description: "Language operation to execute."
+      },
+      cwd: { type: "string", description: "Directory inside the project." },
+      target: { type: "string", description: "Optional target file for workspace selection." },
+      language: { type: "string", enum: LANGUAGE_IDS, description: "Optional language filter." },
+      workspace: { type: "string", description: "Detected workspace id or root." },
+      mode: { type: "string", enum: ["fast", "standard", "thorough"] },
+      check: { type: "string", enum: ["syntax", "semantic", "all"] },
+      formatCheck: {
+        type: "boolean",
+        description: "Verify formatting without writing (default true)."
+      },
+      filter: {
+        type: "string",
+        description: "Validated test/debug filter passed to profile adapters."
+      },
+      coverage: { type: "boolean" },
+      noRun: { type: "boolean", description: "Compile tests without running when supported." },
+      debug: { type: "string", enum: ["compile", "test", "runtime", "race"] }
+    },
+    required: ["action"],
+    additionalProperties: false
+  },
+  validate(input) {
+    const errors = [];
+    if (input.action !== "check" && input.check)
+      errors.push("check is only valid when action=check");
+    if (input.action !== "format" && input.formatCheck !== void 0)
+      errors.push("formatCheck is only valid when action=format");
+    if (input.action !== "debug" && input.debug)
+      errors.push("debug is only valid when action=debug");
+    if (input.coverage) errors.push("coverage collection is not implemented in Phase 2");
+    if (input.noRun && input.action !== "test") errors.push("noRun is only valid when action=test");
+    if (input.filter && (input.filter.length > 500 || input.filter.startsWith("-") || /[\r\n\0;&|`$<>]/.test(input.filter)))
+      errors.push(
+        'filter must be at most 500 characters, not start with "-", and contain no shell/control characters'
+      );
+    return errors;
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    const stream = languageTool.executeStream;
+    if (!stream) throw new Error("languageTool: stream execution unavailable");
+    for await (const event of stream(input, ctx, opts)) {
+      if (event.type === "final") final = event.output;
+    }
+    if (!final) throw new Error("language: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.workingDir ?? ctx.cwd;
+    const operations = operationsFor(input);
+    const runs = [];
+    const unavailableReasons = [];
+    for (const operation of operations) {
+      opts.signal.throwIfAborted();
+      const planResult = await planLanguageOperation({
+        projectRoot: ctx.projectRoot,
+        cwd,
+        operation,
+        ...input.target ? { target: input.target } : {},
+        ...input.language ? { language: input.language } : {},
+        ...input.workspace ? { workspace: input.workspace } : {},
+        ...input.mode ? { mode: input.mode } : {},
+        operationOptions: operationOptions(input),
+        signal: opts.signal
+      });
+      if (planResult.status !== "planned") {
+        const reason = planResult.status === "unavailable" ? planResult.unavailable.reason : planResult.reason;
+        if (runs.length === 0) {
+          return yield {
+            type: "final",
+            output: unavailableOutput(reason)
+          };
+        }
+        unavailableReasons.push(`${operation}: ${reason}`);
+        yield { type: "warning", text: `${operation}: ${reason}` };
+        continue;
+      }
+      const runner = executeLanguagePlan({
+        projectRoot: ctx.projectRoot,
+        workspace: planResult.workspace,
+        plan: planResult.plan,
+        signal: opts.signal
+      });
+      for (; ; ) {
+        const next = await runner.next();
+        if (next.done) {
+          runs.push(next.value);
+          if (next.value.plan.kind === "process") {
+            ctx.recordSideEffect?.({
+              toolUseId: `language-${Date.now()}-${runs.length}`,
+              toolName: "language",
+              ts: (/* @__PURE__ */ new Date()).toISOString(),
+              input: {
+                language: next.value.language,
+                operation: next.value.plan.operation,
+                command: next.value.plan.command,
+                args: next.value.plan.args,
+                cwd: next.value.plan.cwd
+              },
+              outcome: `${next.value.status}${next.value.exitCode === null ? "" : ` (exit ${next.value.exitCode})`}`,
+              risk: "shell"
+            });
+          }
+          break;
+        }
+        yield next.value;
+      }
+      const last = runs.at(-1);
+      if (last.status === "cancelled" || last.status === "timed_out") break;
+      if (last.status === "failed" && input.mode !== "thorough") break;
+    }
+    yield { type: "final", output: aggregateRuns(runs, unavailableReasons) };
+  },
+  serialize(output) {
+    const lines = [
+      `status=${output.status} runs=${output.summary.runs} passed=${output.summary.passed} failed=${output.summary.failed}`,
+      `diagnostics: ${output.summary.errors} error(s), ${output.summary.warnings} warning(s)`
+    ];
+    for (const diagnostic of output.diagnostics.slice(0, 20)) {
+      const location = diagnostic.file ? `${diagnostic.file}${diagnostic.range ? `:${diagnostic.range.start.line}:${diagnostic.range.start.column}` : ""}` : diagnostic.source;
+      lines.push(
+        `${diagnostic.severity.toUpperCase()} ${location}${diagnostic.code ? ` ${diagnostic.code}` : ""}: ${diagnostic.message}`
+      );
+    }
+    if (output.diagnostics.length > 20)
+      lines.push(`\u2026 ${output.diagnostics.length - 20} more diagnostic(s)`);
+    if (output.output) lines.push(output.output);
+    return lines.join("\n");
+  }
+};
+function operationsFor(input) {
+  switch (input.action) {
+    case "check":
+      return input.check === "syntax" ? ["syntax"] : input.check === "semantic" ? ["semantic"] : ["syntax", "semantic"];
+    case "lint":
+      return ["lint"];
+    case "format":
+      return [input.formatCheck === false ? "format-write" : "format-check"];
+    case "test":
+      return [input.noRun ? "test-compile" : "test"];
+    case "build":
+      return ["build"];
+    case "debug":
+      if (input.debug === "race") return ["debug-race"];
+      if (input.debug === "test") return ["test-compile", "test"];
+      if (input.debug === "runtime") return ["semantic", "build", "test"];
+      return ["semantic"];
+  }
+}
+function operationOptions(input) {
+  return {
+    ...input.target ? { target: input.target } : {},
+    ...input.filter ? { filter: input.filter } : {},
+    ...input.coverage !== void 0 ? { coverage: input.coverage } : {},
+    ...input.noRun !== void 0 ? { noRun: input.noRun } : {}
+  };
+}
+function unavailableOutput(reason) {
+  return {
+    status: "unavailable",
+    runs: [],
+    diagnostics: Object.freeze([]),
+    summary: { runs: 0, passed: 0, failed: 0, errors: 0, warnings: 0 },
+    output: reason
+  };
+}
+function aggregateRuns(runs, unavailableReasons) {
+  if (runs.length === 0)
+    return unavailableOutput(
+      unavailableReasons.join("\n") || "No executable language operations were planned."
+    );
+  const diagnostics = Object.freeze(runs.flatMap((run) => [...run.diagnostics]));
+  const failed = runs.filter((run) => run.status === "failed").length;
+  const terminal = runs.find((run) => run.status === "cancelled" || run.status === "timed_out");
+  const unavailable2 = runs.filter((run) => run.status === "unavailable").length;
+  const status = terminal?.status ?? (failed > 0 ? "failed" : unavailableReasons.length > 0 || unavailable2 === runs.length ? "unavailable" : "passed");
+  return {
+    status,
+    language: runs[0].language,
+    workspace: runs[0].workspace.root,
+    runs,
+    diagnostics,
+    summary: {
+      runs: runs.length,
+      passed: runs.filter((run) => run.status === "passed").length,
+      failed,
+      errors: diagnostics.filter((item) => item.severity === "error").length,
+      warnings: diagnostics.filter((item) => item.severity === "warning").length
+    },
+    output: [
+      ...runs.map(
+        (run) => `${run.plan.operation}: ${run.status}${run.output ? `
+${run.output}` : ""}`
+      ),
+      ...unavailableReasons
+    ].join("\n\n")
+  };
+}
+
+// src/languages/package-tool.ts
+var LANGUAGE_IDS2 = [
+  "typescript",
+  "javascript",
+  "go",
+  "rust",
+  "php",
+  "csharp",
+  "python",
+  "java",
+  "ruby",
+  "c",
+  "cpp",
+  "swift",
+  "dart",
+  "elixir",
+  "deno",
+  "shell"
+];
+var SUPPORTED_OPERATIONS = /* @__PURE__ */ new Set([
+  "install",
+  "add",
+  "remove",
+  "update",
+  "audit",
+  "outdated"
+]);
+var OPERATION_TO_PLAN = {
+  install: "package-install",
+  add: "package-add",
+  remove: "package-remove",
+  update: "package-update",
+  audit: "package-audit",
+  outdated: "package-outdated"
+};
+var languagePackageTool = {
+  name: "language_package",
+  category: "Package Management",
+  description: "Restore, mutate, audit, or report outdated packages via predefined ecosystem-specific plans.",
+  usageHint: "Use this instead of the legacy `install`/`audit`/`outdated` tools. The tool detects the workspace, builds an allowlisted argv plan with lifecycle scripts disabled, runs it, and records manifest/lockfile changes.",
+  selection: {
+    doNotUseWhen: "You only need to inspect or plan, or need to compile/test/lint without touching dependencies.",
+    useInstead: ["language_info", "language", "install", "audit", "outdated"]
+  },
+  permission: "confirm",
+  mutating: true,
+  riskTier: "destructive",
+  capabilities: ["shell.restricted", "fs.write", "net.outbound", "package.install"],
+  icon: "package",
+  timeoutMs: 6e5,
+  inputSchema: {
+    type: "object",
+    properties: {
+      operation: {
+        type: "string",
+        enum: ["install", "add", "remove", "update", "audit", "outdated"],
+        description: "Package management operation to perform."
+      },
+      cwd: { type: "string", description: "Directory inside the project." },
+      language: {
+        type: "string",
+        enum: LANGUAGE_IDS2,
+        description: "Optional language profile filter."
+      },
+      workspace: { type: "string", description: "Detected workspace id or root." },
+      names: {
+        type: "array",
+        items: { type: "string" },
+        description: "Validated package names. Required for add/remove/update; optional for install."
+      },
+      scope: {
+        type: "string",
+        enum: ["runtime", "development", "optional"],
+        description: "Where to record the dependency (add/update)."
+      },
+      dryRun: {
+        type: "boolean",
+        description: "Preview the install without modifying the workspace."
+      },
+      allowScripts: {
+        type: "boolean",
+        description: "Opt in to running package lifecycle scripts (preinstall/install/postinstall). Default false."
+      }
+    },
+    required: ["operation"],
+    additionalProperties: false
+  },
+  validate(input) {
+    const errors = [];
+    if (!SUPPORTED_OPERATIONS.has(input.operation))
+      errors.push(`Unsupported package operation: ${String(input.operation)}`);
+    if ((input.operation === "add" || input.operation === "remove") && (!input.names || input.names.length === 0)) {
+      errors.push(`operation=${input.operation} requires at least one name in names`);
+    }
+    for (const name of input.names ?? []) {
+      if (typeof name !== "string" || !name) {
+        errors.push("names must contain only non-empty strings");
+        break;
+      }
+    }
+    return errors;
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    const stream = languagePackageTool.executeStream;
+    if (!stream) throw new Error("languagePackageTool: stream execution unavailable");
+    for await (const event of stream(input, ctx, opts)) {
+      if (event.type === "final") final = event.output;
+    }
+    if (!final) throw new Error("language_package: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.workingDir ?? ctx.cwd;
+    const planOperation = OPERATION_TO_PLAN[input.operation];
+    const operationOptions2 = {
+      ...input.names ? { packages: input.names } : {},
+      ...input.scope ? { packageScope: input.scope } : {},
+      ...input.dryRun !== void 0 ? { allowScripts: input.dryRun } : { allowScripts: false },
+      ...input.allowScripts !== void 0 ? { allowScripts: input.allowScripts } : {}
+    };
+    const planResult = await planLanguageOperation({
+      projectRoot: ctx.projectRoot,
+      cwd,
+      operation: planOperation,
+      ...input.language ? { language: input.language } : {},
+      ...input.workspace ? { workspace: input.workspace } : {},
+      operationOptions: operationOptions2,
+      signal: opts.signal
+    });
+    if (planResult.status !== "planned") {
+      const reason = planResult.status === "unavailable" ? planResult.unavailable.reason : planResult.reason;
+      yield {
+        type: "final",
+        output: {
+          status: "unavailable",
+          mutations: [],
+          vulnerabilities: [],
+          outdated: [],
+          manifestsChanged: [],
+          lockfilesChanged: [],
+          output: reason,
+          error: reason
+        }
+      };
+      return;
+    }
+    const runner = executePackagePlan({
+      projectRoot: ctx.projectRoot,
+      workspace: planResult.workspace,
+      plan: planResult.plan,
+      packages: input.names ?? [],
+      signal: opts.signal
+    });
+    let outcome;
+    for (; ; ) {
+      const next = await runner.next();
+      if (next.done) {
+        outcome = next.value;
+        break;
+      }
+      yield next.value;
+    }
+    if (!outcome) {
+      yield {
+        type: "final",
+        output: {
+          status: "unavailable",
+          mutations: [],
+          vulnerabilities: [],
+          outdated: [],
+          manifestsChanged: [],
+          lockfilesChanged: [],
+          output: "Language package plan produced no outcome."
+        }
+      };
+      return;
+    }
+    const final = aggregateOutcome(outcome);
+    if (outcome.run?.plan.kind === "process") {
+      ctx.recordSideEffect?.({
+        toolUseId: `language_package-${Date.now()}`,
+        toolName: "language_package",
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        input: {
+          language: outcome.language,
+          operation: outcome.operation,
+          command: outcome.run.plan.command,
+          args: outcome.run.plan.args,
+          cwd: outcome.run.plan.cwd,
+          dryRun: input.dryRun ?? false
+        },
+        outcome: `${final.status}${outcome.run.exitCode === null ? "" : ` (exit ${outcome.run.exitCode})`}`,
+        risk: "package"
+      });
+    }
+    yield { type: "final", output: final };
+  },
+  serialize(output) {
+    const lines = [
+      `status=${output.status} operation=${output.operation ?? "unknown"} mutations=${output.mutations.length} vulnerabilities=${output.vulnerabilities.length} outdated=${output.outdated.length}`,
+      `manifestsChanged: ${output.manifestsChanged.join(", ") || "\u2205"}`,
+      `lockfilesChanged: ${output.lockfilesChanged.join(", ") || "\u2205"}`
+    ];
+    for (const mutation of output.mutations) {
+      lines.push(`+ ${mutation.name}${mutation.resolved ? `@${mutation.resolved}` : ""}`);
+    }
+    for (const outdated of output.outdated) {
+      lines.push(`= ${outdated.name}: ${outdated.previous ?? "?"} \u2192 ${outdated.resolved ?? "?"}`);
+    }
+    for (const vuln of output.vulnerabilities) {
+      lines.push(`! ${vuln.package} (${vuln.severity}) ${vuln.advisory ?? ""}`);
+    }
+    if (output.output) lines.push(output.output);
+    return lines.join("\n");
+  }
+};
+function aggregateOutcome(outcome) {
+  return {
+    status: outcome.status,
+    language: outcome.language,
+    workspace: outcome.workspace.root,
+    operation: outcome.operation,
+    outcome,
+    mutations: Object.freeze([...outcome.mutations]),
+    vulnerabilities: Object.freeze([...outcome.vulnerabilities]),
+    outdated: Object.freeze([...outcome.outdated]),
+    manifestsChanged: [...outcome.manifestsChanged],
+    lockfilesChanged: [...outcome.lockfilesChanged],
+    output: outputSummary(outcome),
+    ...outcome.run?.output ? { error: void 0 } : {}
+  };
+}
+function outputSummary(outcome) {
+  const lines = [
+    `${outcome.operation} on ${outcome.workspace.root}: ${outcome.status}`,
+    `manifestsChanged: ${outcome.manifestsChanged.join(", ") || "\u2205"}`,
+    `lockfilesChanged: ${outcome.lockfilesChanged.join(", ") || "\u2205"}`
+  ];
+  for (const mutation of outcome.mutations) {
+    lines.push(`+ ${mutation.name}${mutation.resolved ? `@${mutation.resolved}` : ""}`);
+  }
+  for (const vuln of outcome.vulnerabilities) {
+    lines.push(`! ${vuln.package} (${vuln.severity})${vuln.advisory ? ` ${vuln.advisory}` : ""}`);
+  }
+  for (const outdated of outcome.outdated) {
+    lines.push(`= ${outdated.name}: ${outdated.previous ?? "?"} \u2192 ${outdated.resolved ?? "?"}`);
+  }
+  if (outcome.run?.output) lines.push(outcome.run.output);
+  return lines.join("\n");
+}
+
+// src/languages/tool.ts
+var LANGUAGE_IDS3 = [
+  "typescript",
+  "javascript",
+  "go",
+  "rust",
+  "php",
+  "csharp",
+  "python",
+  "java",
+  "ruby",
+  "c",
+  "cpp",
+  "swift",
+  "dart",
+  "elixir",
+  "deno",
+  "shell"
+];
+var OPERATIONS = [
+  "syntax",
+  "semantic",
+  "lint",
+  "format-check",
+  "format-write",
+  "test-compile",
+  "test",
+  "build",
+  "run",
+  "debug-compile",
+  "debug-test",
+  "debug-runtime",
+  "debug-race",
+  "package-install",
+  "package-add",
+  "package-remove",
+  "package-update",
+  "package-audit",
+  "package-outdated"
+];
+var languageInfoTool = {
+  name: "language_info",
+  category: "Code Quality",
+  description: "Detect language workspaces and preview predefined language-specific command plans without executing them.",
+  usageHint: "Use `detect` to find TypeScript/JavaScript, Go, Rust, PHP, and C# workspaces. Use `plan` to obtain an exact, validated argv plan before choosing an execution tool. This tool never spawns a process or modifies files.",
+  selection: {
+    doNotUseWhen: "You need to execute a compiler, test runner, formatter, or package manager.",
+    useInstead: ["exec", "typecheck", "lint", "format", "test", "install"]
+  },
+  permission: "auto",
+  mutating: false,
+  riskTier: "safe",
+  capabilities: ["fs.read"],
+  icon: "code",
+  timeoutMs: 3e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      action: {
+        type: "string",
+        enum: ["detect", "plan", "capabilities"],
+        description: "Read-only action to perform."
+      },
+      cwd: { type: "string", description: "Directory inside the project to inspect." },
+      target: { type: "string", description: "Optional target file used for workspace selection." },
+      language: {
+        type: "string",
+        enum: LANGUAGE_IDS3,
+        description: "Optional language profile filter."
+      },
+      workspace: { type: "string", description: "Workspace id or root returned by detect." },
+      operation: {
+        type: "string",
+        enum: OPERATIONS,
+        description: "Operation to preview when action=plan."
+      },
+      mode: {
+        type: "string",
+        enum: ["fast", "standard", "thorough"],
+        description: "Planning mode."
+      },
+      options: {
+        type: "object",
+        properties: {
+          target: { type: "string" },
+          filter: { type: "string" },
+          coverage: { type: "boolean" },
+          noRun: { type: "boolean" },
+          packages: { type: "array", items: { type: "string" } },
+          packageScope: { type: "string", enum: ["runtime", "development", "optional"] },
+          allowScripts: { type: "boolean" }
+        },
+        additionalProperties: false
+      }
+    },
+    required: ["action"],
+    additionalProperties: false
+  },
+  validate(input) {
+    const errors = [];
+    if (input.action === "plan" && !input.operation)
+      errors.push("operation is required when action=plan");
+    if (input.action !== "plan" && input.operation)
+      errors.push("operation is only valid when action=plan");
+    if (input.action !== "plan" && input.options)
+      errors.push("options are only valid when action=plan");
+    return errors;
+  },
+  async execute(input, ctx, opts) {
+    if (input.action === "capabilities") {
+      return {
+        action: "capabilities",
+        profiles: languageProfileRegistry.list().map((profile) => ({
+          id: profile.id,
+          displayName: profile.displayName,
+          extensions: profile.extensions,
+          operations: Object.keys(profile.operations).sort(),
+          packageManagers: profile.packageManagers
+        }))
+      };
+    }
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.workingDir ?? ctx.cwd;
+    const common = {
+      projectRoot: ctx.projectRoot,
+      cwd,
+      ...input.target ? { target: input.target } : {},
+      ...input.language ? { language: input.language } : {},
+      signal: opts.signal
+    };
+    if (input.action === "detect") {
+      return { action: "detect", ...await detectLanguageWorkspaces(common) };
+    }
+    const result = await planLanguageOperation({
+      ...common,
+      operation: input.operation,
+      ...input.workspace ? { workspace: input.workspace } : {},
+      ...input.mode ? { mode: input.mode } : {},
+      ...input.options ? { operationOptions: input.options } : {}
+    });
+    return { action: "plan", ...result };
+  }
+};
+export {
+  ADDITIONAL_LANGUAGE_PROFILES,
+  LanguageProfileRegistry,
+  PRIMARY_LANGUAGE_PROFILES,
+  detectLanguageWorkspaces,
+  diagnosticsForInternalSyntax,
+  executeLanguagePlan,
+  executePackagePlan,
+  languageInfoTool,
+  languagePackageTool,
+  languageProfileRegistry,
+  languageTool,
+  parseLanguageDiagnostics,
+  parsePackageReports,
+  planLanguageOperation,
+  validateCommandPlan,
+  validateLanguageProfile
+};
+//# sourceMappingURL=index.js.map