@wrongstack/tools 0.284.1 → 0.285.0

package/dist/audit.js

@@ -1,18 +1,17 @@
-import { spawn } from 'node:child_process';
-import * as Core from '@wrongstack/core';
-import { buildChildEnv, expectDefined, wstackGlobalRoot } from '@wrongstack/core';
-import * as fs from 'node:fs';
-import { mkdirSync, createWriteStream } from 'node:fs';
-import * as fsp from 'node:fs/promises';
-import * as path3 from 'node:path';
-import * as os from 'node:os';
-
 // src/_spawn-stream.ts
+import { spawn as spawn2 } from "node:child_process";
+import { buildChildEnv } from "@wrongstack/core";
+
+// src/_output-spool.ts
+import { createWriteStream, mkdirSync } from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as path from "node:path";
+import { wstackGlobalRoot } from "@wrongstack/core";
 var SPOOL_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
 var SPOOL_WRITE_HWM_BYTES = 4 * 1024 * 1024;
 var sweepStarted = false;
 function toolOutputDir() {
-  return path3.join(wstackGlobalRoot(), "tool-output");
+  return path.join(wstackGlobalRoot(), "tool-output");
 }
 function sweepOldSpoolFiles(dir) {
   if (sweepStarted) return;
@@ -22,7 +21,7 @@ function sweepOldSpoolFiles(dir) {
       const now = Date.now();
       for (const name of await fsp.readdir(dir)) {
         if (!name.endsWith(".log")) continue;
-        const p = path3.join(dir, name);
+        const p = path.join(dir, name);
         try {
           const st = await fsp.stat(p);
           if (now - st.mtimeMs > SPOOL_RETENTION_MS) await fsp.unlink(p);
@@ -39,7 +38,7 @@ function spoolNote(info) {
 [output truncated \u2014 full ${info.bytes} bytes at ${info.path}${dropped}; read/grep that file selectively instead of re-running with more output]`;
 }
 function createOutputSpool(opts) {
-  const threshold = opts.thresholdBytes;
+  const threshold = opts.thresholdBytes ?? 32768;
   const safeTool = opts.tool.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
   let head = "";
   let headBytes = 0;
@@ -57,7 +56,7 @@ function createOutputSpool(opts) {
       sweepOldSpoolFiles(dir);
       const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
       const rand = Math.random().toString(36).slice(2, 6);
-      filePath = path3.join(dir, `${stamp}-${safeTool}-${rand}.log`);
+      filePath = path.join(dir, `${stamp}-${safeTool}-${rand}.log`);
       stream = createWriteStream(filePath, { flags: "w", encoding: "utf8" });
       stream.on("error", () => {
         failed = true;
@@ -110,6 +109,10 @@ function createOutputSpool(opts) {
   };
 }
 
+// src/process-registry.ts
+import { spawn } from "node:child_process";
+import * as os from "node:os";
+
 // src/circuit-breaker.ts
 var DEFAULT_MAX_CONSECUTIVE_FAILURES = 5;
 var DEFAULT_SLOW_CALL_THRESHOLD_MS = 18e4;
@@ -302,7 +305,8 @@ var CircuitBreaker = class {
   }
 };
 
-// src/process-registry.ts
+// src/_redact-command.ts
+import { expectDefined } from "@wrongstack/core";
 var SENSITIVE_FLAG_PATTERNS = [
   // --flag=value  or  --flag "value"  (value captured up to next space or comma)
   /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
@@ -332,6 +336,8 @@ function redactCommand(cmd) {
   }
   return result;
 }
+
+// src/process-registry.ts
 var DEFAULT_GRACE_MS = 2e3;
 var WIN32_TASKKILL_TIMEOUT_MS = 5e3;
 function killWin32Tree(pid, opts = {}) {
@@ -601,7 +607,8 @@ var ProcessRegistryImpl = class {
       if (liveRealChild && killWin32Tree(pid, {
         timeoutMs: Math.max(graceMs, WIN32_TASKKILL_TIMEOUT_MS),
         onSettled: directFallback
-      })) ; else {
+      })) {
+      } else {
         try {
           p.child.kill(force ? "SIGKILL" : "SIGTERM");
         } catch {
@@ -688,15 +695,19 @@ function getProcessRegistry() {
   }
   return _registry;
 }
+
+// src/_win32-resolve.ts
+import * as fs from "node:fs";
+import * as path2 from "node:path";
 function resolveWin32Command(cmd) {
   if (process.platform !== "win32") return cmd;
-  if (cmd.includes("/") || cmd.includes("\\") || path3.extname(cmd.replace(/\//g, "\\"))) {
+  if (cmd.includes("/") || cmd.includes("\\") || path2.extname(cmd.replace(/\//g, "\\"))) {
     return cmd;
   }
   const pathext = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC").toLowerCase().split(";");
-  const pathDirs = (process.env["PATH"] ?? "").split(path3.delimiter);
+  const pathDirs = (process.env["PATH"] ?? "").split(path2.delimiter);
   for (const dir of pathDirs) {
-    const base = path3.join(dir, cmd);
+    const base = path2.join(dir, cmd);
     for (const ext of pathext) {
       const full = `${base}${ext}`;
       try {
@@ -734,7 +745,7 @@ function quoteWin32CmdArg(arg) {
 // src/_spawn-stream.ts
 var isWin = process.platform === "win32";
 async function* spawnStream(opts) {
-  const max = opts.maxBytes;
+  const max = opts.maxBytes ?? 2e5;
   const flushAt = opts.flushBytes ?? 4 * 1024;
   const maxQueue = opts.maxQueueSize ?? 500;
   let stdout = "";
@@ -747,7 +758,7 @@ async function* spawnStream(opts) {
   const shim = needsShell ? buildWin32CmdShimInvocation(resolved, opts.args) : null;
   const cmd = shim?.command ?? resolved;
   const args = shim?.args ?? opts.args;
-  const child = spawn(cmd, args, {
+  const child = spawn2(cmd, args, {
     cwd: opts.cwd,
     env: buildChildEnv(),
     stdio: ["ignore", "pipe", "pipe"],
@@ -840,8 +851,8 @@ async function* spawnStream(opts) {
   try {
     for (; ; ) {
       while (queue.length === 0) {
-        await new Promise((resolve2) => {
-          waiter = resolve2;
+        await new Promise((resolve6) => {
+          waiter = resolve6;
         });
       }
       const chunk = queue.shift();
@@ -895,15 +906,19 @@ async function* spawnStream(opts) {
     }
   }
 }
+
+// src/_util.ts
+import * as path3 from "node:path";
+import * as Core from "@wrongstack/core";
 async function detectPackageManager(cwd) {
-  const { stat: stat2 } = await import('node:fs/promises');
+  const { stat: stat5 } = await import("node:fs/promises");
   try {
-    await stat2(`${cwd}/pnpm-lock.yaml`);
+    await stat5(`${cwd}/pnpm-lock.yaml`);
     return "pnpm";
   } catch {
   }
   try {
-    await stat2(`${cwd}/yarn.lock`);
+    await stat5(`${cwd}/yarn.lock`);
     return "yarn";
   } catch {
   }
@@ -930,6 +945,2678 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
+var COMMAND_OUTPUT_MAX_BYTES = 32768;
+var REPEAT_RUN_THRESHOLD = 3;
+function collapseCarriageReturns(text) {
+  const lf = text.replace(/\r\n/g, "\n");
+  if (!lf.includes("\r")) return lf;
+  return lf.split("\n").map((line) => line.includes("\r") ? line.slice(line.lastIndexOf("\r") + 1) : line).join("\n");
+}
+function collapseConsecutiveDuplicates(text, minRun = REPEAT_RUN_THRESHOLD) {
+  const lines = text.split("\n");
+  const out = [];
+  let i = 0;
+  while (i < lines.length) {
+    let j = i + 1;
+    while (j < lines.length && lines[j] === lines[i]) j++;
+    const run = j - i;
+    if (run >= minRun) {
+      out.push(lines[i], `\u2026 \u27E8repeated ${run}\xD7\u27E9`);
+    } else {
+      for (let k = i; k < j; k++) out.push(lines[k]);
+    }
+    i = j;
+  }
+  return out.join("\n");
+}
+function takeHeadBytes(s, maxBytes) {
+  if (maxBytes <= 0) return "";
+  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
+  let lo = 0;
+  let hi = s.length;
+  while (lo < hi) {
+    const mid = Math.ceil((lo + hi) / 2);
+    if (Buffer.byteLength(s.slice(0, mid), "utf8") <= maxBytes) lo = mid;
+    else hi = mid - 1;
+  }
+  return s.slice(0, lo);
+}
+function takeTailBytes(s, maxBytes) {
+  if (maxBytes <= 0) return "";
+  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
+  let lo = 0;
+  let hi = s.length;
+  while (lo < hi) {
+    const mid = Math.ceil((lo + hi) / 2);
+    if (Buffer.byteLength(s.slice(s.length - mid), "utf8") <= maxBytes) lo = mid;
+    else hi = mid - 1;
+  }
+  return s.slice(s.length - lo);
+}
+function truncateHeadTail(s, maxBytes) {
+  const total = Buffer.byteLength(s, "utf8");
+  if (total <= maxBytes) return s;
+  const MARKER_RESERVE = 64;
+  const avail = Math.max(0, maxBytes - MARKER_RESERVE);
+  const headBudget = Math.floor(avail * 0.45);
+  const head = takeHeadBytes(s, headBudget);
+  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, "utf8"));
+  const kept = Buffer.byteLength(head, "utf8") + Buffer.byteLength(tail, "utf8");
+  return `${head}
+\u2026[truncated ${total - kept} bytes]\u2026
+${tail}`;
+}
+function normalizeCommandOutput(raw, opts = {}) {
+  if (!raw) return raw;
+  let text = Core.stripAnsi(raw);
+  text = collapseCarriageReturns(text);
+  text = text.replace(/[ \t]+$/gm, "");
+  text = collapseConsecutiveDuplicates(text);
+  text = text.replace(/\n{3,}/g, "\n\n");
+  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);
+}
+
+// src/languages/legacy-bridge.ts
+import * as fs5 from "node:fs/promises";
+import * as path8 from "node:path";
+
+// src/languages/detect.ts
+import { createHash } from "node:crypto";
+import * as fs2 from "node:fs/promises";
+import * as path4 from "node:path";
+
+// src/languages/profile-helpers.ts
+var DEFAULT_TIMEOUT_MS = 12e4;
+var DEFAULT_OUTPUT_LIMIT_BYTES = 2e5;
+function processPlan(ctx, operation, command, args, options) {
+  return {
+    profileId: ctx.workspace.language,
+    workspaceId: ctx.workspace.id,
+    operation,
+    kind: "process",
+    command,
+    args: Object.freeze([...args]),
+    cwd: ctx.workspace.root,
+    env: Object.freeze({}),
+    timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+    outputLimitBytes: DEFAULT_OUTPUT_LIMIT_BYTES,
+    mutating: options.mutating ?? false,
+    network: options.network ?? false,
+    executesProjectCode: options.executesProjectCode ?? false,
+    reason: options.reason,
+    evidence: ctx.workspace.evidence,
+    parser: options.parser
+  };
+}
+function internalPlan(ctx, operation, parser, reason) {
+  return {
+    profileId: ctx.workspace.language,
+    workspaceId: ctx.workspace.id,
+    operation,
+    kind: "internal",
+    command: null,
+    args: Object.freeze([]),
+    cwd: ctx.workspace.root,
+    env: Object.freeze({}),
+    timeoutMs: 5e3,
+    outputLimitBytes: 32768,
+    mutating: false,
+    network: false,
+    executesProjectCode: false,
+    reason,
+    evidence: ctx.workspace.evidence,
+    parser
+  };
+}
+function unavailable(ctx, operation, reason) {
+  return {
+    status: "unavailable",
+    profileId: ctx.workspace.language,
+    workspaceId: ctx.workspace.id,
+    operation,
+    reason
+  };
+}
+function packageNames(ctx) {
+  return ctx.options.packages ?? [];
+}
+
+// src/languages/profiles/additional.ts
+var IGNORES = Object.freeze([
+  ".git",
+  ".wrongstack",
+  "node_modules",
+  "vendor",
+  "dist",
+  "build",
+  "coverage"
+]);
+function pythonProfile() {
+  return {
+    id: "python",
+    displayName: "Python",
+    extensions: Object.freeze([".py", ".pyi"]),
+    lspLanguageIds: Object.freeze(["python"]),
+    detectors: Object.freeze([
+      { kind: "config", filename: "pyproject.toml", weight: 90 },
+      { kind: "config", filename: "setup.py", weight: 70 },
+      { kind: "config", filename: "setup.cfg", weight: 60 },
+      { kind: "manifest", filename: "requirements.txt", weight: 55 },
+      { kind: "manifest", filename: "Pipfile", weight: 50 },
+      { kind: "lockfile", filename: "poetry.lock", weight: 30 },
+      { kind: "lockfile", filename: "Pipfile.lock", weight: 30 },
+      { kind: "lockfile", filename: "uv.lock", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["pip", "poetry", "pipenv", "uv"]),
+    executables: Object.freeze(["python", "python3", "ruff", "black", "pytest", "mypy", "pyright"]),
+    operations: Object.freeze({
+      syntax: async (ctx) => {
+        const py = ctx.options.target ? "python3" : "python3";
+        return ctx.options.target ? processPlan(ctx, "syntax", py, ["-m", "py_compile", ctx.options.target], {
+          parser: "python",
+          reason: "Compile the target file to check for syntax errors."
+        }) : unavailable(ctx, "syntax", "Python syntax check requires an explicit target file.");
+      },
+      semantic: async (ctx) => processPlan(ctx, "semantic", "mypy", [".", "--no-error-summary"], {
+        parser: "mypy",
+        reason: "Run mypy type checking on the workspace.",
+        executesProjectCode: true
+      }),
+      lint: async (ctx) => processPlan(ctx, "lint", "ruff", ["check", "."], {
+        parser: "ruff",
+        reason: "Run the Ruff linter on the workspace."
+      }),
+      "format-check": async (ctx) => processPlan(ctx, "format-check", "ruff", ["format", "--check", "."], {
+        parser: "ruff",
+        reason: "Check Python formatting without writing files."
+      }),
+      "format-write": async (ctx) => processPlan(ctx, "format-write", "ruff", ["format", "."], {
+        parser: "ruff",
+        reason: "Format Python source files.",
+        mutating: true
+      }),
+      test: async (ctx) => processPlan(
+        ctx,
+        "test",
+        "pytest",
+        [...ctx.options.filter ? ["-k", ctx.options.filter] : [], "."],
+        {
+          parser: "pytest",
+          reason: ctx.options.filter ? "Run filtered Python tests." : "Run all Python tests.",
+          mutating: true,
+          executesProjectCode: true
+        }
+      ),
+      build: async (ctx) => unavailable(ctx, "build", "Python is interpreted; use semantic or test instead."),
+      "debug-compile": async (ctx) => processPlan(ctx, "debug-compile", "mypy", [".", "--no-error-summary"], {
+        parser: "mypy",
+        reason: "Collect mypy type diagnostics.",
+        executesProjectCode: true
+      }),
+      "package-install": async (ctx) => processPlan(ctx, "package-install", "pip", ["install", "--no-cache-dir"], {
+        parser: "package-text",
+        reason: "Install dependencies from requirements.",
+        mutating: true,
+        network: true
+      }),
+      "package-add": async (ctx) => {
+        const names = packageNames(ctx);
+        return names.length === 0 ? unavailable(ctx, "package-add", "At least one package name is required.") : processPlan(ctx, "package-add", "pip", ["install", ...names], {
+          parser: "package-text",
+          reason: "Install specified Python packages.",
+          mutating: true,
+          network: true
+        });
+      },
+      "package-audit": async (ctx) => processPlan(ctx, "package-audit", "pip", ["audit"], {
+        parser: "pip-audit",
+        reason: "Audit Python dependencies for vulnerabilities.",
+        network: true
+      }),
+      run: async (ctx) => {
+        const entries = ["main.py", "app.py", "__main__.py", "manage.py"];
+        const first = (await Promise.all(
+          entries.map((name) => ctx.pathExists(name).then((ok) => ok ? name : void 0))
+        )).find(Boolean);
+        const args = first ? [first] : [];
+        return processPlan(ctx, "run", "python3", args, {
+          parser: "command-text",
+          reason: first ? `Run the Python entry point ${first}.` : "Run the Python project (no common entry point detected \u2014 add the module path manually).",
+          executesProjectCode: true,
+          mutating: true
+        });
+      }
+    })
+  };
+}
+function hasGradleEvidence(ctx) {
+  return ctx.workspace.evidence.some(
+    (e) => e.kind === "manifest" && (e.value === "build.gradle" || e.value === "build.gradle.kts" || e.value === "settings.gradle") || e.kind === "lockfile" && e.value === "gradle.lockfile"
+  );
+}
+async function gradleRunner(ctx) {
+  if (await ctx.pathExists("gradlew")) return "gradlew";
+  return "gradle";
+}
+function javaProfile() {
+  return {
+    id: "java",
+    displayName: "Java / Kotlin",
+    extensions: Object.freeze([".java", ".kt", ".kts", ".scala"]),
+    lspLanguageIds: Object.freeze(["java", "kotlin"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "pom.xml", weight: 90 },
+      { kind: "manifest", filename: "build.gradle", weight: 85 },
+      { kind: "manifest", filename: "build.gradle.kts", weight: 85 },
+      { kind: "manifest", filename: "settings.gradle", weight: 50 },
+      { kind: "lockfile", filename: "gradle.lockfile", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["maven", "gradle"]),
+    executables: Object.freeze(["mvn", "gradle", "gradlew", "java", "kotlinc"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => {
+        const isGradle = hasGradleEvidence(ctx);
+        const runner = isGradle ? await gradleRunner(ctx) : "mvn";
+        const args = isGradle ? ["compileJava"] : ["compile", "-q"];
+        const reason = isGradle ? "Compile the Gradle project." : "Compile the Maven project.";
+        return processPlan(ctx, "semantic", runner, args, {
+          parser: isGradle ? "gradle" : "maven",
+          reason,
+          mutating: true,
+          executesProjectCode: true
+        });
+      },
+      lint: async (ctx) => unavailable(
+        ctx,
+        "lint",
+        "Java linting requires a configured checkstyle or spotbugs plugin."
+      ),
+      "format-check": async (ctx) => unavailable(
+        ctx,
+        "format-check",
+        "Java formatting check requires a configured spotless or google-java-format plugin."
+      ),
+      test: async (ctx) => {
+        const isGradle = hasGradleEvidence(ctx);
+        const runner = isGradle ? await gradleRunner(ctx) : "mvn";
+        const args = isGradle ? ["test"] : ["test", "-q"];
+        const reason = isGradle ? "Run Gradle tests." : "Run Maven tests.";
+        return processPlan(ctx, "test", runner, args, {
+          parser: isGradle ? "gradle" : "maven",
+          reason,
+          mutating: true,
+          executesProjectCode: true
+        });
+      },
+      build: async (ctx) => {
+        const isGradle = hasGradleEvidence(ctx);
+        const runner = isGradle ? await gradleRunner(ctx) : "mvn";
+        const args = isGradle ? ["build"] : ["package", "-q", "-DskipTests"];
+        const reason = isGradle ? "Build the Gradle project." : "Build the Maven project, skipping tests.";
+        return processPlan(ctx, "build", runner, args, {
+          parser: isGradle ? "gradle" : "maven",
+          reason,
+          mutating: true,
+          executesProjectCode: true
+        });
+      },
+      run: async (ctx) => {
+        if (!hasGradleEvidence(ctx))
+          return unavailable(
+            ctx,
+            "run",
+            "Maven run requires exec-maven-plugin configuration. Use `mvn exec:java -q` manually."
+          );
+        const runner = await gradleRunner(ctx);
+        return processPlan(ctx, "run", runner, ["run"], {
+          parser: "command-text",
+          reason: `Run the Gradle project entry point via ${runner}.`,
+          executesProjectCode: true,
+          mutating: true
+        });
+      },
+      "package-install": async (ctx) => unavailable(
+        ctx,
+        "package-install",
+        "JVM dependency installation happens through build or dependency:get."
+      ),
+      "package-add": async (ctx) => {
+        const names = packageNames(ctx);
+        return names.length === 0 ? unavailable(ctx, "package-add", "At least one dependency coordinate is required.") : processPlan(ctx, "package-add", "mvn", ["dependency:get", `-Dartifact=${names[0]}`], {
+          parser: "maven",
+          reason: "Resolve and fetch a Maven dependency.",
+          mutating: true,
+          network: true
+        });
+      }
+    })
+  };
+}
+function rubyProfile() {
+  return {
+    id: "ruby",
+    displayName: "Ruby",
+    extensions: Object.freeze([".rb"]),
+    lspLanguageIds: Object.freeze(["ruby"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "Gemfile", weight: 90 },
+      { kind: "config", filename: ".ruby-version", weight: 40 },
+      { kind: "lockfile", filename: "Gemfile.lock", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["gem", "bundler"]),
+    executables: Object.freeze(["ruby", "gem", "bundle", "rubocop", "rspec"]),
+    operations: Object.freeze({
+      syntax: async (ctx) => ctx.options.target ? processPlan(ctx, "syntax", "ruby", ["-c", ctx.options.target], {
+        parser: "ruby",
+        reason: "Check the target Ruby file for syntax errors."
+      }) : unavailable(ctx, "syntax", "Ruby syntax check requires an explicit target file."),
+      lint: async (ctx) => processPlan(ctx, "lint", "rubocop", ["--format=json"], {
+        parser: "rubocop",
+        reason: "Run RuboCop linter.",
+        executesProjectCode: true
+      }),
+      "format-write": async (ctx) => processPlan(ctx, "format-write", "rubocop", ["--auto-correct"], {
+        parser: "rubocop",
+        reason: "Auto-correct RuboCop violations.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      test: async (ctx) => processPlan(ctx, "test", "rspec", [], {
+        parser: "rspec",
+        reason: "Run the RSpec test suite.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      "package-install": async (ctx) => processPlan(ctx, "package-install", "bundle", ["install"], {
+        parser: "package-text",
+        reason: "Install Ruby gem dependencies.",
+        mutating: true,
+        network: true,
+        executesProjectCode: true
+      }),
+      "package-add": async (ctx) => {
+        const names = packageNames(ctx);
+        return names.length === 0 ? unavailable(ctx, "package-add", "At least one gem name is required.") : processPlan(ctx, "package-add", "gem", ["install", ...names], {
+          parser: "package-text",
+          reason: "Install specified Ruby gems.",
+          mutating: true,
+          network: true
+        });
+      },
+      "package-audit": async (ctx) => processPlan(ctx, "package-audit", "bundle", ["audit", "--format=json"], {
+        parser: "bundler-audit",
+        reason: "Audit Ruby gems for vulnerabilities.",
+        network: true
+      }),
+      run: async (ctx) => {
+        const entries = ["main.rb", "app.rb", "server.rb", "config.ru"];
+        const first = (await Promise.all(
+          entries.map((name) => ctx.pathExists(name).then((ok) => ok ? name : void 0))
+        )).find(Boolean);
+        const hasGemfile = await ctx.pathExists("Gemfile");
+        const cmd = hasGemfile ? "bundle" : "ruby";
+        const args = hasGemfile ? ["exec", "ruby", first ?? ""] : [first ?? ""];
+        return processPlan(ctx, "run", cmd, args, {
+          parser: "command-text",
+          reason: first ? `Run the Ruby entry point ${first}.` : "Run the Ruby project (no common entry point detected \u2014 add the file path manually).",
+          executesProjectCode: true,
+          mutating: true
+        });
+      }
+    })
+  };
+}
+function cProfile() {
+  return {
+    id: "c",
+    displayName: "C / C++",
+    extensions: Object.freeze([".c", ".h"]),
+    lspLanguageIds: Object.freeze(["c"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "CMakeLists.txt", weight: 85 },
+      { kind: "manifest", filename: "Makefile", weight: 60 },
+      { kind: "config", suffix: ".cmake", weight: 50 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze([]),
+    executables: Object.freeze(["cc", "gcc", "clang", "cmake", "make"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => processPlan(ctx, "semantic", "cmake", ["--build", ".", "--target", "all"], {
+        parser: "cmake",
+        reason: "Build C project to collect compiler diagnostics.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      test: async (ctx) => unavailable(
+        ctx,
+        "test",
+        "C test execution requires a configured test runner (ctest, etc.)."
+      ),
+      build: async (ctx) => processPlan(ctx, "build", "cmake", ["--build", "."], {
+        parser: "cmake",
+        reason: "Build the C project.",
+        mutating: true,
+        executesProjectCode: true
+      })
+    })
+  };
+}
+function cppProfile() {
+  return {
+    ...cProfile(),
+    id: "cpp",
+    displayName: "C++",
+    extensions: Object.freeze([".cpp", ".cc", ".cxx", ".hpp", ".hxx"]),
+    lspLanguageIds: Object.freeze(["cpp"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "CMakeLists.txt", weight: 85 },
+      { kind: "manifest", filename: "Makefile", weight: 50 }
+    ]),
+    executables: Object.freeze(["c++", "g++", "clang++", "cmake", "make"])
+  };
+}
+function swiftProfile() {
+  return {
+    id: "swift",
+    displayName: "Swift",
+    extensions: Object.freeze([".swift"]),
+    lspLanguageIds: Object.freeze(["swift"]),
+    detectors: Object.freeze([{ kind: "manifest", filename: "Package.swift", weight: 90 }]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["swift"]),
+    executables: Object.freeze(["swift", "swiftc"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => processPlan(ctx, "semantic", "swift", ["build"], {
+        parser: "swift",
+        reason: "Build Swift package to collect compiler diagnostics.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      test: async (ctx) => processPlan(ctx, "test", "swift", ["test"], {
+        parser: "swift-test",
+        reason: "Run Swift tests.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      build: async (ctx) => processPlan(ctx, "build", "swift", ["build", "-c", "release"], {
+        parser: "swift",
+        reason: "Build the Swift package in release mode.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      run: async (ctx) => processPlan(ctx, "run", "swift", ["run"], {
+        parser: "command-text",
+        reason: "Run the Swift package entry point.",
+        executesProjectCode: true
+      })
+    })
+  };
+}
+function dartProfile() {
+  return {
+    id: "dart",
+    displayName: "Dart / Flutter",
+    extensions: Object.freeze([".dart"]),
+    lspLanguageIds: Object.freeze(["dart"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "pubspec.yaml", weight: 90 },
+      { kind: "lockfile", filename: "pubspec.lock", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["pub"]),
+    executables: Object.freeze(["dart", "flutter"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => processPlan(ctx, "semantic", "dart", ["analyze"], {
+        parser: "dart-analyze",
+        reason: "Run Dart static analysis."
+      }),
+      "format-check": async (ctx) => processPlan(
+        ctx,
+        "format-check",
+        "dart",
+        ["format", "--output=none", "--set-exit-if-changed", "."],
+        {
+          parser: "dart-format",
+          reason: "Check Dart formatting without writing files."
+        }
+      ),
+      "format-write": async (ctx) => processPlan(ctx, "format-write", "dart", ["format", "."], {
+        parser: "dart-format",
+        reason: "Format Dart source files.",
+        mutating: true
+      }),
+      test: async (ctx) => processPlan(ctx, "test", "dart", ["test"], {
+        parser: "dart-test",
+        reason: "Run Dart tests.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      "package-install": async (ctx) => processPlan(ctx, "package-install", "dart", ["pub", "get"], {
+        parser: "package-text",
+        reason: "Fetch Dart package dependencies.",
+        mutating: true,
+        network: true
+      }),
+      "package-outdated": async (ctx) => processPlan(ctx, "package-outdated", "dart", ["pub", "outdated"], {
+        parser: "dart-outdated",
+        reason: "Check for outdated Dart packages.",
+        network: true
+      }),
+      run: async (ctx) => processPlan(ctx, "run", "dart", ["run"], {
+        parser: "command-text",
+        reason: "Run the Dart / Flutter project entry point.",
+        executesProjectCode: true
+      })
+    })
+  };
+}
+function denoProfile() {
+  return {
+    id: "deno",
+    displayName: "Deno",
+    extensions: Object.freeze([".ts", ".tsx", ".js", ".jsx"]),
+    lspLanguageIds: Object.freeze(["typescript", "javascript"]),
+    detectors: Object.freeze([
+      { kind: "config", filename: "deno.json", weight: 90 },
+      { kind: "config", filename: "deno.jsonc", weight: 90 },
+      { kind: "config", filename: "import_map.json", weight: 60 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze([]),
+    executables: Object.freeze(["deno"]),
+    // .ts/.js extensions are shared with the TypeScript/JavaScript profiles;
+    // only a deno.json(c)/import_map.json detector hit may establish a workspace.
+    sourceFallback: false,
+    operations: Object.freeze({
+      test: async (ctx) => processPlan(ctx, "test", "deno", ["test"], {
+        parser: "deno-test",
+        reason: "Run Deno tests.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      run: async (ctx) => processPlan(ctx, "run", "deno", ["run", "--allow-all", "main.ts"], {
+        parser: "command-text",
+        reason: "Run the Deno project entry point with full permission.",
+        executesProjectCode: true,
+        mutating: true
+      })
+    })
+  };
+}
+function elixirProfile() {
+  return {
+    id: "elixir",
+    displayName: "Elixir",
+    extensions: Object.freeze([".ex", ".exs"]),
+    lspLanguageIds: Object.freeze(["elixir"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "mix.exs", weight: 90 },
+      { kind: "lockfile", filename: "mix.lock", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["mix"]),
+    executables: Object.freeze(["mix", "elixir"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => unavailable(ctx, "semantic", "Elixir compilation is handled by the build operation."),
+      lint: async (ctx) => unavailable(ctx, "lint", "Elixir linting requires the credo package."),
+      test: async (ctx) => processPlan(ctx, "test", "mix", ["test"], {
+        parser: "mix-test",
+        reason: "Run ExUnit tests.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      build: async (ctx) => processPlan(ctx, "build", "mix", ["compile"], {
+        parser: "mix",
+        reason: "Compile the Mix project.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      run: async (ctx) => processPlan(ctx, "run", "mix", ["run"], {
+        parser: "command-text",
+        reason: "Run the Mix project entry point.",
+        executesProjectCode: true
+      }),
+      "package-install": async (ctx) => processPlan(ctx, "package-install", "mix", ["deps.get"], {
+        parser: "package-text",
+        reason: "Fetch Elixir dependencies.",
+        mutating: true,
+        network: true
+      })
+    })
+  };
+}
+function shellProfile() {
+  return {
+    id: "shell",
+    displayName: "Shell",
+    extensions: Object.freeze([".sh", ".bash"]),
+    lspLanguageIds: Object.freeze(["shellscript"]),
+    detectors: Object.freeze([{ kind: "config", filename: "ShellCheckrc", weight: 50 }]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze([]),
+    executables: Object.freeze(["bash", "sh", "shellcheck", "shfmt"]),
+    operations: Object.freeze({
+      syntax: async (ctx) => ctx.options.target ? processPlan(ctx, "syntax", "bash", ["-n", ctx.options.target], {
+        parser: "shell",
+        reason: "Check the shell script for syntax errors."
+      }) : unavailable(ctx, "syntax", "Shell syntax check requires an explicit target file."),
+      lint: async (ctx) => ctx.options.target ? processPlan(ctx, "lint", "shellcheck", ["--format=json", ctx.options.target], {
+        parser: "shellcheck",
+        reason: "Run ShellCheck on the target script."
+      }) : unavailable(ctx, "lint", "Shell linting requires an explicit target file."),
+      "format-check": async (ctx) => ctx.options.target ? processPlan(ctx, "format-check", "shfmt", ["-d", ctx.options.target], {
+        parser: "shell",
+        reason: "Check shell formatting without writing."
+      }) : unavailable(
+        ctx,
+        "format-check",
+        "Shell formatting check requires an explicit target file."
+      ),
+      "format-write": async (ctx) => ctx.options.target ? processPlan(ctx, "format-write", "shfmt", ["-w", ctx.options.target], {
+        parser: "shell",
+        reason: "Format the shell script.",
+        mutating: true
+      }) : unavailable(ctx, "format-write", "Shell formatting requires an explicit target file.")
+    })
+  };
+}
+var ADDITIONAL_LANGUAGE_PROFILES = Object.freeze([
+  pythonProfile(),
+  javaProfile(),
+  rubyProfile(),
+  cProfile(),
+  cppProfile(),
+  swiftProfile(),
+  dartProfile(),
+  denoProfile(),
+  elixirProfile(),
+  shellProfile()
+]);
+
+// src/languages/profiles/primary.ts
+var COMMON_IGNORES = Object.freeze([
+  ".git",
+  ".wrongstack",
+  "node_modules",
+  "vendor",
+  "target",
+  "bin",
+  "obj",
+  "dist",
+  "build",
+  "coverage"
+]);
+function nodeManager(ctx) {
+  const lockfiles = new Set(
+    ctx.workspace.evidence.filter((evidence) => evidence.kind === "lockfile").map((evidence) => evidence.value.toLowerCase())
+  );
+  if (lockfiles.size > 1 && !ctx.workspace.packageManager) return void 0;
+  return ctx.workspace.packageManager ?? "npm";
+}
+function scriptPlan(ctx, operation, script) {
+  const manager = nodeManager(ctx);
+  if (!manager)
+    return unavailable(
+      ctx,
+      operation,
+      "Conflicting Node lockfiles make the package manager ambiguous."
+    );
+  const args = manager === "npm" ? ["run", script] : [script];
+  return processPlan(ctx, operation, manager, args, {
+    parser: "command-text",
+    reason: `Run the detected ${manager} ${script} script for this workspace.`,
+    mutating: true,
+    executesProjectCode: true
+  });
+}
+function nodeExec(ctx, executable, args) {
+  const manager = ctx.workspace.packageManager ?? "npm";
+  if (manager === "pnpm") return { command: "pnpm", args: ["exec", executable, ...args] };
+  if (manager === "yarn") return { command: "yarn", args: ["exec", executable, ...args] };
+  if (manager === "bun") return { command: "bun", args: ["x", executable, ...args] };
+  return { command: "npx", args: ["--no-install", executable, ...args] };
+}
+function typescriptProfile() {
+  return {
+    id: "typescript",
+    displayName: "TypeScript",
+    extensions: Object.freeze([".ts", ".tsx", ".mts", ".cts"]),
+    lspLanguageIds: Object.freeze(["typescript", "typescriptreact"]),
+    detectors: Object.freeze([
+      { kind: "config", filename: "tsconfig.json", weight: 90 },
+      { kind: "manifest", filename: "package.json", weight: 55 },
+      { kind: "lockfile", filename: "pnpm-lock.yaml", weight: 30 },
+      { kind: "lockfile", filename: "yarn.lock", weight: 30 },
+      { kind: "lockfile", filename: "package-lock.json", weight: 30 },
+      { kind: "lockfile", filename: "bun.lock", weight: 30 },
+      { kind: "lockfile", filename: "bun.lockb", weight: 30 }
+    ]),
+    ignoredDirectories: COMMON_IGNORES,
+    packageManagers: Object.freeze(["pnpm", "yarn", "bun", "npm"]),
+    executables: Object.freeze(["pnpm", "yarn", "bun", "npx", "npm"]),
+    operations: Object.freeze({
+      syntax: async (ctx) => internalPlan(
+        ctx,
+        "syntax",
+        "typescript-parser",
+        "Parse the target with the TypeScript compiler API."
+      ),
+      semantic: async (ctx) => {
+        const run = nodeExec(ctx, "tsc", ["--noEmit", "--pretty", "false"]);
+        return processPlan(ctx, "semantic", run.command, run.args, {
+          parser: "typescript",
+          reason: "Run the workspace TypeScript compiler without emitting files.",
+          executesProjectCode: true
+        });
+      },
+      lint: async (ctx) => {
+        const run = nodeExec(ctx, "biome", ["lint", "."]);
+        return processPlan(ctx, "lint", run.command, run.args, {
+          parser: "biome",
+          reason: "Run the project-local Biome linter.",
+          executesProjectCode: true
+        });
+      },
+      "format-check": async (ctx) => {
+        const run = nodeExec(ctx, "biome", ["format", "--check", "."]);
+        return processPlan(ctx, "format-check", run.command, run.args, {
+          parser: "biome",
+          reason: "Check formatting with the project-local Biome formatter.",
+          executesProjectCode: true
+        });
+      },
+      "format-write": async (ctx) => {
+        const run = nodeExec(ctx, "biome", ["format", "--write", "."]);
+        return processPlan(ctx, "format-write", run.command, run.args, {
+          parser: "biome",
+          reason: "Format the workspace with the project-local Biome formatter.",
+          mutating: true,
+          executesProjectCode: true
+        });
+      },
+      test: async (ctx) => ctx.options.filter || ctx.options.coverage ? unavailable(
+        ctx,
+        "test",
+        "The detected package script does not expose deterministic filter or coverage adapters."
+      ) : scriptPlan(ctx, "test", "test"),
+      build: async (ctx) => scriptPlan(ctx, "build", "build"),
+      run: async (ctx) => scriptPlan(ctx, "run", "dev"),
+      "debug-compile": async (ctx) => {
+        const run = nodeExec(ctx, "tsc", ["--noEmit", "--pretty", "false"]);
+        return processPlan(ctx, "debug-compile", run.command, run.args, {
+          parser: "typescript",
+          reason: "Collect deterministic TypeScript compiler diagnostics.",
+          executesProjectCode: true
+        });
+      },
+      "package-install": async (ctx) => {
+        const manager = ctx.workspace.packageManager ?? "npm";
+        const args = manager === "yarn" ? ["install", "--ignore-scripts"] : ["install", "--ignore-scripts"];
+        return processPlan(ctx, "package-install", manager, args, {
+          parser: "package-text",
+          reason: `Restore declared dependencies with ${manager} and lifecycle scripts disabled.`,
+          mutating: true,
+          network: true,
+          executesProjectCode: false
+        });
+      },
+      "package-add": async (ctx) => {
+        const names = packageNames(ctx);
+        if (names.length === 0)
+          return unavailable(ctx, "package-add", "At least one package name is required.");
+        const manager = ctx.workspace.packageManager ?? "npm";
+        const args = manager === "npm" ? ["install", "--ignore-scripts", ...names] : ["add", "--ignore-scripts", ...names];
+        return processPlan(ctx, "package-add", manager, args, {
+          parser: "package-text",
+          reason: `Add validated packages with ${manager} and lifecycle scripts disabled.`,
+          mutating: true,
+          network: true
+        });
+      },
+      "package-audit": async (ctx) => {
+        const manager = ctx.workspace.packageManager ?? "npm";
+        return processPlan(ctx, "package-audit", manager, ["audit", "--json"], {
+          parser: "npm-audit",
+          reason: `Audit dependencies with the detected ${manager} package manager.`,
+          network: true
+        });
+      },
+      "package-outdated": async (ctx) => {
+        const manager = ctx.workspace.packageManager ?? "npm";
+        return processPlan(ctx, "package-outdated", manager, ["outdated", "--json"], {
+          parser: "npm-outdated",
+          reason: `Check outdated dependencies with ${manager}.`,
+          network: true
+        });
+      }
+    })
+  };
+}
+function javascriptProfile() {
+  const ts = typescriptProfile();
+  return {
+    ...ts,
+    id: "javascript",
+    displayName: "JavaScript",
+    extensions: Object.freeze([".js", ".jsx", ".mjs", ".cjs"]),
+    lspLanguageIds: Object.freeze(["javascript", "javascriptreact"]),
+    detectors: Object.freeze([
+      { kind: "config", filename: "jsconfig.json", weight: 90 },
+      { kind: "manifest", filename: "package.json", weight: 70 },
+      { kind: "lockfile", filename: "pnpm-lock.yaml", weight: 30 },
+      { kind: "lockfile", filename: "yarn.lock", weight: 30 },
+      { kind: "lockfile", filename: "package-lock.json", weight: 30 },
+      { kind: "lockfile", filename: "bun.lock", weight: 30 },
+      { kind: "lockfile", filename: "bun.lockb", weight: 30 }
+    ]),
+    operations: Object.freeze({
+      ...ts.operations,
+      syntax: async (ctx) => internalPlan(
+        ctx,
+        "syntax",
+        "typescript-parser",
+        "Parse JavaScript with the TypeScript compiler API."
+      )
+    })
+  };
+}
+var goProfile = {
+  id: "go",
+  displayName: "Go",
+  extensions: Object.freeze([".go"]),
+  lspLanguageIds: Object.freeze(["go"]),
+  detectors: Object.freeze([
+    { kind: "manifest", filename: "go.mod", weight: 90 },
+    { kind: "manifest", filename: "go.work", weight: 95 },
+    { kind: "lockfile", filename: "go.sum", weight: 30 }
+  ]),
+  ignoredDirectories: COMMON_IGNORES,
+  packageManagers: Object.freeze(["go"]),
+  executables: Object.freeze(["go", "gofmt"]),
+  operations: Object.freeze({
+    syntax: async (ctx) => {
+      if (!ctx.target)
+        return unavailable(ctx, "syntax", "Go syntax planning requires a target file.");
+      return processPlan(ctx, "syntax", "gofmt", ["-e", "-d", ctx.target], {
+        parser: "gofmt",
+        reason: "Parse the target and report syntax errors without writing it."
+      });
+    },
+    semantic: async (ctx) => processPlan(ctx, "semantic", "go", ["test", "-run", "^$", "./..."], {
+      parser: "go-test",
+      reason: "Compile all Go packages without selecting tests.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    lint: async (ctx) => processPlan(ctx, "lint", "go", ["vet", "./..."], {
+      parser: "go-compiler",
+      reason: "Run the standard Go vet checks.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    "format-check": async (ctx) => ctx.target ? processPlan(ctx, "format-check", "gofmt", ["-d", ctx.target], {
+      parser: "gofmt",
+      reason: "Report Go formatting differences for the target without writing it."
+    }) : unavailable(ctx, "format-check", "Go formatting requires an explicit target file."),
+    "format-write": async (ctx) => ctx.target ? processPlan(ctx, "format-write", "gofmt", ["-w", ctx.target], {
+      parser: "gofmt",
+      reason: "Format the target Go source file.",
+      mutating: true
+    }) : unavailable(ctx, "format-write", "Go formatting requires an explicit target file."),
+    test: async (ctx) => processPlan(
+      ctx,
+      "test",
+      "go",
+      ["test", ...ctx.options.filter ? ["-run", ctx.options.filter] : [], "./..."],
+      {
+        parser: "go-test",
+        reason: ctx.options.filter ? "Run filtered Go tests." : "Run all Go tests.",
+        mutating: true,
+        executesProjectCode: true
+      }
+    ),
+    build: async (ctx) => processPlan(ctx, "build", "go", ["build", "./..."], {
+      parser: "go-compiler",
+      reason: "Build all Go packages.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    run: async (ctx) => processPlan(ctx, "run", "go", ["run", "."], {
+      parser: "command-text",
+      reason: "Run the Go module entry point.",
+      executesProjectCode: true
+    }),
+    "debug-race": async (ctx) => processPlan(ctx, "debug-race", "go", ["test", "-race", "./..."], {
+      parser: "go-test",
+      reason: "Collect Go race-detector evidence.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    "package-install": async (ctx) => processPlan(ctx, "package-install", "go", ["mod", "download"], {
+      parser: "go-module",
+      reason: "Download the dependencies declared by go.mod.",
+      mutating: true,
+      network: true
+    }),
+    "package-add": async (ctx) => {
+      const names = packageNames(ctx);
+      if (names.length === 0)
+        return unavailable(ctx, "package-add", "At least one Go module is required.");
+      return processPlan(ctx, "package-add", "go", ["get", ...names], {
+        parser: "go-module",
+        reason: "Add validated Go modules.",
+        mutating: true,
+        network: true
+      });
+    },
+    "package-update": async (ctx) => processPlan(ctx, "package-update", "go", ["get", "-u", "./..."], {
+      parser: "go-module",
+      reason: "Update dependencies of all Go packages.",
+      mutating: true,
+      network: true
+    })
+  })
+};
+var rustProfile = {
+  id: "rust",
+  displayName: "Rust",
+  extensions: Object.freeze([".rs"]),
+  lspLanguageIds: Object.freeze(["rust"]),
+  detectors: Object.freeze([
+    { kind: "manifest", filename: "Cargo.toml", weight: 90 },
+    { kind: "lockfile", filename: "Cargo.lock", weight: 30 }
+  ]),
+  ignoredDirectories: COMMON_IGNORES,
+  packageManagers: Object.freeze(["cargo"]),
+  executables: Object.freeze(["cargo"]),
+  operations: Object.freeze({
+    syntax: async (ctx) => processPlan(ctx, "syntax", "cargo", ["check", "--message-format=json"], {
+      parser: "cargo-json",
+      reason: "Check Rust syntax and semantics with Cargo.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    semantic: async (ctx) => processPlan(ctx, "semantic", "cargo", ["check", "--message-format=json"], {
+      parser: "cargo-json",
+      reason: "Collect Rust compiler diagnostics with Cargo check.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    lint: async (ctx) => processPlan(ctx, "lint", "cargo", ["clippy", "--message-format=json"], {
+      parser: "cargo-json",
+      reason: "Run Clippy for this crate.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    "format-check": async (ctx) => processPlan(ctx, "format-check", "cargo", ["fmt", "--check"], {
+      parser: "cargo-fmt",
+      reason: "Check Rust formatting without writing files."
+    }),
+    "format-write": async (ctx) => processPlan(ctx, "format-write", "cargo", ["fmt"], {
+      parser: "cargo-fmt",
+      reason: "Format Rust source files in the workspace.",
+      mutating: true
+    }),
+    "test-compile": async (ctx) => processPlan(ctx, "test-compile", "cargo", ["test", "--no-run", "--message-format=json"], {
+      parser: "cargo-json",
+      reason: "Compile Rust tests without running them.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    test: async (ctx) => processPlan(
+      ctx,
+      "test",
+      "cargo",
+      ["test", ...ctx.options.filter ? [ctx.options.filter] : []],
+      {
+        parser: "cargo-test",
+        reason: ctx.options.filter ? "Run filtered Rust tests." : "Run Rust tests.",
+        mutating: true,
+        executesProjectCode: true
+      }
+    ),
+    build: async (ctx) => processPlan(ctx, "build", "cargo", ["build", "--message-format=json"], {
+      parser: "cargo-json",
+      reason: "Build the Rust workspace.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    run: async (ctx) => processPlan(ctx, "run", "cargo", ["run"], {
+      parser: "command-text",
+      reason: "Run the Rust workspace entry point.",
+      executesProjectCode: true
+    }),
+    "package-install": async (ctx) => processPlan(ctx, "package-install", "cargo", ["fetch", "--locked"], {
+      parser: "cargo-json",
+      reason: "Fetch locked Rust dependencies.",
+      mutating: true,
+      network: true
+    }),
+    "package-add": async (ctx) => {
+      const names = packageNames(ctx);
+      return names.length === 0 ? unavailable(ctx, "package-add", "At least one crate is required.") : processPlan(ctx, "package-add", "cargo", ["add", ...names], {
+        parser: "cargo-text",
+        reason: "Add validated Rust crates.",
+        mutating: true,
+        network: true
+      });
+    },
+    "package-remove": async (ctx) => {
+      const names = packageNames(ctx);
+      return names.length === 0 ? unavailable(ctx, "package-remove", "At least one crate is required.") : processPlan(ctx, "package-remove", "cargo", ["remove", ...names], {
+        parser: "cargo-text",
+        reason: "Remove validated Rust crates.",
+        mutating: true
+      });
+    },
+    "package-update": async (ctx) => processPlan(ctx, "package-update", "cargo", ["update"], {
+      parser: "cargo-text",
+      reason: "Update the Cargo lockfile.",
+      mutating: true,
+      network: true
+    }),
+    "package-audit": async (ctx) => processPlan(ctx, "package-audit", "cargo", ["audit", "--json"], {
+      parser: "cargo-audit",
+      reason: "Audit Rust dependencies when cargo-audit is installed.",
+      network: true
+    })
+  })
+};
+var phpProfile = {
+  id: "php",
+  displayName: "PHP",
+  extensions: Object.freeze([".php"]),
+  lspLanguageIds: Object.freeze(["php"]),
+  detectors: Object.freeze([
+    { kind: "manifest", filename: "composer.json", weight: 90 },
+    { kind: "lockfile", filename: "composer.lock", weight: 30 },
+    { kind: "config", filename: "phpunit.xml", weight: 25 },
+    { kind: "config", filename: "phpunit.xml.dist", weight: 25 }
+  ]),
+  ignoredDirectories: COMMON_IGNORES,
+  packageManagers: Object.freeze(["composer"]),
+  executables: Object.freeze(["php", "composer"]),
+  operations: Object.freeze({
+    syntax: async (ctx) => ctx.target ? processPlan(ctx, "syntax", "php", ["-l", ctx.target], {
+      parser: "php-lint",
+      reason: "Lint the target PHP file without executing it."
+    }) : unavailable(ctx, "syntax", "PHP syntax planning requires a target file."),
+    semantic: async (ctx) => unavailable(
+      ctx,
+      "semantic",
+      "No configured PHPStan or Psalm adapter was detected in Phase 1."
+    ),
+    test: async (ctx) => processPlan(
+      ctx,
+      "test",
+      "php",
+      ["vendor/bin/phpunit", ...ctx.options.filter ? ["--filter", ctx.options.filter] : []],
+      {
+        parser: "phpunit",
+        reason: ctx.options.filter ? "Run filtered tests with the project-local PHPUnit runner." : "Run the project-local PHPUnit test runner.",
+        executesProjectCode: true
+      }
+    ),
+    "package-install": async (ctx) => processPlan(
+      ctx,
+      "package-install",
+      "composer",
+      ["install", "--no-interaction", "--no-scripts"],
+      {
+        parser: "composer",
+        reason: "Restore Composer dependencies without scripts.",
+        mutating: true,
+        network: true
+      }
+    ),
+    "package-add": async (ctx) => {
+      const names = packageNames(ctx);
+      return names.length === 0 ? unavailable(ctx, "package-add", "At least one Composer package is required.") : processPlan(
+        ctx,
+        "package-add",
+        "composer",
+        ["require", "--no-interaction", "--no-scripts", ...names],
+        {
+          parser: "composer",
+          reason: "Add validated Composer packages without scripts.",
+          mutating: true,
+          network: true
+        }
+      );
+    },
+    "package-remove": async (ctx) => {
+      const names = packageNames(ctx);
+      return names.length === 0 ? unavailable(ctx, "package-remove", "At least one Composer package is required.") : processPlan(
+        ctx,
+        "package-remove",
+        "composer",
+        ["remove", "--no-interaction", "--no-scripts", ...names],
+        {
+          parser: "composer",
+          reason: "Remove validated Composer packages without scripts.",
+          mutating: true
+        }
+      );
+    },
+    "package-update": async (ctx) => processPlan(
+      ctx,
+      "package-update",
+      "composer",
+      ["update", "--no-interaction", "--no-scripts"],
+      {
+        parser: "composer",
+        reason: "Update Composer dependencies without scripts.",
+        mutating: true,
+        network: true
+      }
+    ),
+    "package-audit": async (ctx) => processPlan(ctx, "package-audit", "composer", ["audit", "--format=json"], {
+      parser: "composer-audit",
+      reason: "Audit Composer dependencies.",
+      network: true
+    }),
+    "package-outdated": async (ctx) => processPlan(ctx, "package-outdated", "composer", ["outdated", "--format=json"], {
+      parser: "composer-outdated",
+      reason: "Check outdated Composer dependencies.",
+      network: true
+    })
+  })
+};
+var csharpProfile = {
+  id: "csharp",
+  displayName: "C# / .NET",
+  extensions: Object.freeze([".cs"]),
+  lspLanguageIds: Object.freeze(["csharp"]),
+  detectors: Object.freeze([
+    { kind: "config", filename: "global.json", weight: 25 },
+    { kind: "manifest", suffix: ".slnx", weight: 95 },
+    { kind: "manifest", suffix: ".sln", weight: 95 },
+    { kind: "manifest", suffix: ".csproj", weight: 90 },
+    { kind: "manifest", suffix: ".fsproj", weight: 90 },
+    { kind: "lockfile", filename: "packages.lock.json", weight: 30 }
+  ]),
+  ignoredDirectories: COMMON_IGNORES,
+  packageManagers: Object.freeze(["dotnet"]),
+  executables: Object.freeze(["dotnet"]),
+  operations: Object.freeze({
+    syntax: async (ctx) => processPlan(ctx, "syntax", "dotnet", ["build", "--no-restore"], {
+      parser: "dotnet-build",
+      reason: "Use the nearest project or solution to collect C# syntax diagnostics.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    semantic: async (ctx) => processPlan(ctx, "semantic", "dotnet", ["build", "--no-restore"], {
+      parser: "dotnet-build",
+      reason: "Build without restoring to collect .NET compiler diagnostics.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    lint: async (ctx) => processPlan(ctx, "lint", "dotnet", ["format", "--verify-no-changes", "--no-restore"], {
+      parser: "dotnet-format",
+      reason: "Verify .NET formatting and analyzers without writing source files.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    "format-check": async (ctx) => processPlan(
+      ctx,
+      "format-check",
+      "dotnet",
+      ["format", "--verify-no-changes", "--no-restore"],
+      {
+        parser: "dotnet-format",
+        reason: "Verify .NET formatting without source writes.",
+        mutating: true,
+        executesProjectCode: true
+      }
+    ),
+    "format-write": async (ctx) => processPlan(ctx, "format-write", "dotnet", ["format", "--no-restore"], {
+      parser: "dotnet-format",
+      reason: "Format .NET source files without restoring packages.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    test: async (ctx) => processPlan(
+      ctx,
+      "test",
+      "dotnet",
+      ["test", "--no-restore", ...ctx.options.filter ? ["--filter", ctx.options.filter] : []],
+      {
+        parser: "dotnet-test",
+        reason: ctx.options.filter ? "Run filtered .NET tests without restoring packages." : "Run .NET tests without restoring packages.",
+        mutating: true,
+        executesProjectCode: true
+      }
+    ),
+    build: async (ctx) => processPlan(ctx, "build", "dotnet", ["build", "--no-restore"], {
+      parser: "dotnet-build",
+      reason: "Build the nearest .NET project or solution without restoring packages.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    run: async (ctx) => processPlan(ctx, "run", "dotnet", ["run", "--no-restore"], {
+      parser: "command-text",
+      reason: "Run the .NET project entry point.",
+      mutating: true,
+      executesProjectCode: true
+    }),
+    "package-install": async (ctx) => processPlan(ctx, "package-install", "dotnet", ["restore", "--locked-mode"], {
+      parser: "dotnet-restore",
+      reason: "Restore locked .NET dependencies.",
+      mutating: true,
+      network: true,
+      executesProjectCode: true
+    }),
+    "package-add": async (ctx) => {
+      const names = packageNames(ctx);
+      return names.length === 0 ? unavailable(ctx, "package-add", "At least one NuGet package is required.") : processPlan(ctx, "package-add", "dotnet", ["add", "package", ...names], {
+        parser: "dotnet-package",
+        reason: "Add validated NuGet packages.",
+        mutating: true,
+        network: true,
+        executesProjectCode: true
+      });
+    },
+    "package-remove": async (ctx) => {
+      const names = packageNames(ctx);
+      return names.length === 0 ? unavailable(ctx, "package-remove", "At least one NuGet package is required.") : processPlan(ctx, "package-remove", "dotnet", ["remove", "package", ...names], {
+        parser: "dotnet-package",
+        reason: "Remove validated NuGet packages.",
+        mutating: true
+      });
+    },
+    "package-audit": async (ctx) => processPlan(
+      ctx,
+      "package-audit",
+      "dotnet",
+      ["list", "package", "--vulnerable", "--format", "json"],
+      { parser: "dotnet-package", reason: "List vulnerable NuGet dependencies.", network: true }
+    ),
+    "package-outdated": async (ctx) => processPlan(
+      ctx,
+      "package-outdated",
+      "dotnet",
+      ["list", "package", "--outdated", "--format", "json"],
+      { parser: "dotnet-package", reason: "List outdated NuGet dependencies.", network: true }
+    )
+  })
+};
+var PRIMARY_LANGUAGE_PROFILES = Object.freeze([
+  Object.freeze(typescriptProfile()),
+  Object.freeze(javascriptProfile()),
+  Object.freeze(goProfile),
+  Object.freeze(rustProfile),
+  Object.freeze(phpProfile),
+  Object.freeze(csharpProfile)
+]);
+
+// src/languages/registry.ts
+var PROFILE_ID_RE = /^[a-z][a-z0-9-]{0,63}$/;
+var EXECUTABLE_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
+var KNOWN_OPERATIONS = /* @__PURE__ */ new Set([
+  "syntax",
+  "semantic",
+  "lint",
+  "format-check",
+  "format-write",
+  "test-compile",
+  "test",
+  "build",
+  "run",
+  "debug-compile",
+  "debug-test",
+  "debug-runtime",
+  "debug-race",
+  "package-install",
+  "package-add",
+  "package-remove",
+  "package-update",
+  "package-audit",
+  "package-outdated"
+]);
+var LanguageProfileRegistry = class {
+  #profiles = /* @__PURE__ */ new Map();
+  constructor(profiles = []) {
+    for (const profile of profiles) this.register(profile);
+  }
+  register(profile) {
+    const errors = validateLanguageProfile(profile);
+    if (errors.length > 0) {
+      throw new Error(`Invalid language profile "${profile.id}": ${errors.join("; ")}`);
+    }
+    if (this.#profiles.has(profile.id)) {
+      throw new Error(`Language profile "${profile.id}" is already registered`);
+    }
+    this.#profiles.set(profile.id, freezeProfile(profile));
+  }
+  get(id) {
+    return this.#profiles.get(id);
+  }
+  list() {
+    return Object.freeze([...this.#profiles.values()]);
+  }
+};
+function validateLanguageProfile(profile) {
+  const errors = [];
+  if (!PROFILE_ID_RE.test(profile.id)) errors.push("id must be a lowercase stable identifier");
+  if (!profile.displayName.trim()) errors.push("displayName is required");
+  if (profile.extensions.length === 0) errors.push("at least one extension is required");
+  for (const ext of profile.extensions) {
+    if (!/^\.[a-z0-9+.-]+$/i.test(ext)) errors.push(`invalid extension "${ext}"`);
+  }
+  if (profile.detectors.length === 0) errors.push("at least one detector is required");
+  for (const detector of profile.detectors) {
+    if ((detector.filename ? 1 : 0) + (detector.suffix ? 1 : 0) !== 1) {
+      errors.push("each detector must declare exactly one of filename or suffix");
+    }
+    if (!Number.isFinite(detector.weight) || detector.weight <= 0 || detector.weight > 100) {
+      errors.push("detector weights must be in the range 1..100");
+    }
+    const marker = detector.filename ?? detector.suffix ?? "";
+    if (marker.includes("/") || marker.includes("\\") || marker.includes("\0")) {
+      errors.push(`detector marker "${marker}" must be a basename or suffix`);
+    }
+  }
+  if (profile.executables.length === 0) errors.push("at least one executable is required");
+  for (const executable of profile.executables) {
+    if (!EXECUTABLE_RE.test(executable)) errors.push(`invalid executable token "${executable}"`);
+  }
+  for (const operation of Object.keys(profile.operations)) {
+    if (!KNOWN_OPERATIONS.has(operation)) {
+      errors.push(`unknown operation "${operation}"`);
+    }
+    if (typeof profile.operations[operation] !== "function") {
+      errors.push(`operation "${operation}" must be a resolver function`);
+    }
+  }
+  return [...new Set(errors)];
+}
+function freezeProfile(profile) {
+  const detectors = Object.freeze(profile.detectors.map((item) => Object.freeze({ ...item })));
+  const operations = Object.freeze({ ...profile.operations });
+  return Object.freeze({
+    ...profile,
+    extensions: Object.freeze([...profile.extensions]),
+    lspLanguageIds: Object.freeze([...profile.lspLanguageIds]),
+    detectors,
+    ignoredDirectories: Object.freeze([...profile.ignoredDirectories]),
+    packageManagers: Object.freeze([...profile.packageManagers]),
+    executables: Object.freeze([...profile.executables]),
+    operations
+  });
+}
+var languageProfileRegistry = new LanguageProfileRegistry([
+  ...PRIMARY_LANGUAGE_PROFILES,
+  ...ADDITIONAL_LANGUAGE_PROFILES
+]);
+
+// src/languages/detect.ts
+var DEFAULT_LIMITS = { maxDepth: 6, maxEntries: 5e3 };
+var SOURCE_WEIGHT = 5;
+var SOURCE_WEIGHT_CAP = 25;
+var TARGET_WEIGHT = 100;
+var GLOBAL_IGNORES = /* @__PURE__ */ new Set([
+  ".git",
+  ".wrongstack",
+  "node_modules",
+  "vendor",
+  "target",
+  "bin",
+  "obj",
+  "dist",
+  "build",
+  "out",
+  "coverage",
+  ".cache",
+  ".idea",
+  ".vscode",
+  ".next",
+  ".nuxt"
+]);
+async function detectLanguageWorkspaces(options) {
+  const projectRoot = await canonicalDirectory(options.projectRoot);
+  const cwdInput = options.cwd ? path4.isAbsolute(options.cwd) ? options.cwd : path4.resolve(projectRoot, options.cwd) : projectRoot;
+  const cwd = await canonicalInside(cwdInput, projectRoot, "cwd");
+  const target = options.target ? await canonicalInside(resolveFrom(cwd, options.target), projectRoot, "target") : void 0;
+  const profiles = (options.profiles ?? languageProfileRegistry.list()).filter((profile) => !options.language || profile.id === options.language).slice().sort((a, b) => a.id.localeCompare(b.id));
+  const limits = normalizeLimits(options.limits);
+  const state = {
+    entries: 0,
+    truncated: false,
+    sourcePaths: /* @__PURE__ */ new Map(),
+    candidates: /* @__PURE__ */ new Map()
+  };
+  await scanDirectory(projectRoot, 0, profiles, limits, state, options.signal);
+  addSourceFallbacks(projectRoot, profiles, state);
+  if (target) addTargetEvidence(target, projectRoot, profiles, state);
+  const workspaces = await Promise.all(
+    [...state.candidates.values()].map((candidate) => finalizeCandidate(candidate, projectRoot))
+  );
+  workspaces.sort(compareWorkspaces);
+  return {
+    projectRoot,
+    scannedEntries: state.entries,
+    truncated: state.truncated,
+    workspaces
+  };
+}
+async function scanDirectory(directory, depth, profiles, limits, state, signal) {
+  signal?.throwIfAborted();
+  if (depth > limits.maxDepth || state.entries >= limits.maxEntries) {
+    state.truncated = true;
+    return;
+  }
+  let entries;
+  try {
+    entries = await fs2.readdir(directory, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  entries.sort((a, b) => a.name.localeCompare(b.name));
+  for (const entry of entries) {
+    signal?.throwIfAborted();
+    if (state.entries >= limits.maxEntries) {
+      state.truncated = true;
+      return;
+    }
+    state.entries++;
+    const fullPath = path4.join(directory, entry.name);
+    if (entry.isSymbolicLink()) continue;
+    if (entry.isDirectory()) {
+      if (shouldIgnoreDirectory(entry.name, profiles)) continue;
+      if (depth >= limits.maxDepth) {
+        state.truncated = true;
+        continue;
+      }
+      await scanDirectory(fullPath, depth + 1, profiles, limits, state, signal);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    collectFileEvidence(directory, fullPath, entry.name, profiles, state);
+  }
+}
+function collectFileEvidence(directory, fullPath, basename4, profiles, state) {
+  const lower = basename4.toLowerCase();
+  const extension = path4.extname(lower);
+  for (const profile of profiles) {
+    const detector = profile.detectors.find(
+      (rule) => rule.filename ? lower === rule.filename.toLowerCase() : lower.endsWith(rule.suffix.toLowerCase())
+    );
+    if (detector) {
+      const candidate = getCandidate(state, profile, directory);
+      candidate.evidence.push({
+        kind: detector.kind,
+        path: fullPath,
+        value: basename4,
+        weight: detector.weight
+      });
+      if (detector.kind === "manifest" || detector.kind === "config") {
+        candidate.manifests.push(fullPath);
+      }
+    }
+    if (profile.extensions.includes(extension)) {
+      const paths = state.sourcePaths.get(profile.id) ?? [];
+      if (paths.length < SOURCE_WEIGHT_CAP / SOURCE_WEIGHT) paths.push(fullPath);
+      state.sourcePaths.set(profile.id, paths);
+    }
+  }
+}
+function addSourceFallbacks(projectRoot, profiles, state) {
+  for (const profile of profiles) {
+    const sources = state.sourcePaths.get(profile.id) ?? [];
+    if (sources.length === 0) continue;
+    const profileCandidates = [...state.candidates.values()].filter(
+      (item) => item.profile.id === profile.id
+    );
+    for (const source of sources) {
+      const containing = profileCandidates.filter((candidate2) => isInside(source, candidate2.root)).sort(
+        (a, b) => pathDepth(b.root, projectRoot) - pathDepth(a.root, projectRoot) || a.root.localeCompare(b.root)
+      );
+      const candidate = containing[0] ?? (profile.sourceFallback === false ? void 0 : getCandidate(state, profile, projectRoot));
+      if (!candidate) continue;
+      candidate.evidence.push({
+        kind: "source",
+        path: source,
+        value: path4.extname(source),
+        weight: SOURCE_WEIGHT
+      });
+    }
+  }
+}
+function addTargetEvidence(target, projectRoot, profiles, state) {
+  const extension = path4.extname(target).toLowerCase();
+  for (const profile of profiles) {
+    if (!profile.extensions.includes(extension)) continue;
+    const candidates = [...state.candidates.values()].filter(
+      (candidate2) => candidate2.profile.id === profile.id && isInside(target, candidate2.root)
+    );
+    const candidate = candidates.length > 0 ? candidates.sort(
+      (a, b) => pathDepth(b.root, projectRoot) - pathDepth(a.root, projectRoot) || a.root.localeCompare(b.root)
+    )[0] : profile.sourceFallback === false ? void 0 : getCandidate(state, profile, path4.dirname(target));
+    if (!candidate) continue;
+    candidate.evidence.push({
+      kind: "target",
+      path: target,
+      value: extension,
+      weight: TARGET_WEIGHT
+    });
+  }
+}
+async function finalizeCandidate(candidate, projectRoot) {
+  const evidence = dedupeEvidence(candidate.evidence).sort(compareEvidence);
+  const manifests = [...new Set(candidate.manifests)].sort();
+  const confidence = Math.min(1, evidence.reduce((sum, item) => sum + item.weight, 0) / 100);
+  const packageManager = await detectPackageManager2(candidate.profile, candidate.root, evidence);
+  const id = createHash("sha256").update(`${candidate.profile.id}\0${path4.relative(projectRoot, candidate.root)}`).digest("hex").slice(0, 16);
+  return Object.freeze({
+    id,
+    language: candidate.profile.id,
+    root: candidate.root,
+    confidence,
+    evidence: Object.freeze(evidence.map((item) => Object.freeze(item))),
+    ...packageManager ? { packageManager } : {},
+    manifests: Object.freeze(manifests),
+    capabilities: Object.freeze(
+      Object.keys(candidate.profile.operations).sort()
+    )
+  });
+}
+async function detectPackageManager2(profile, root, evidence) {
+  if (profile.packageManagers.length === 1) return profile.packageManagers[0];
+  if (profile.id !== "typescript" && profile.id !== "javascript") return void 0;
+  let declared;
+  try {
+    const pkg = JSON.parse(await fs2.readFile(path4.join(root, "package.json"), "utf8"));
+    if (typeof pkg.packageManager === "string") {
+      const manager = pkg.packageManager.split("@")[0];
+      if (manager && profile.packageManagers.includes(manager)) declared = manager;
+    }
+  } catch {
+  }
+  const lockManagers = /* @__PURE__ */ new Set();
+  for (const item of evidence) {
+    const name = path4.basename(item.path).toLowerCase();
+    if (name === "pnpm-lock.yaml") lockManagers.add("pnpm");
+    else if (name === "yarn.lock") lockManagers.add("yarn");
+    else if (name === "bun.lock" || name === "bun.lockb") lockManagers.add("bun");
+    else if (name === "package-lock.json") lockManagers.add("npm");
+  }
+  if (declared && (lockManagers.size === 0 || lockManagers.size === 1 && lockManagers.has(declared))) {
+    return declared;
+  }
+  if (lockManagers.size === 1) return [...lockManagers][0];
+  if (lockManagers.size > 1) return void 0;
+  return declared ?? "npm";
+}
+function getCandidate(state, profile, root) {
+  const key = `${profile.id}\0${root}`;
+  let candidate = state.candidates.get(key);
+  if (!candidate) {
+    candidate = { profile, root, evidence: [], manifests: [] };
+    state.candidates.set(key, candidate);
+  }
+  return candidate;
+}
+function shouldIgnoreDirectory(name, profiles) {
+  if (GLOBAL_IGNORES.has(name) || name.startsWith(".")) return true;
+  return profiles.some((profile) => profile.ignoredDirectories.includes(name));
+}
+function normalizeLimits(input) {
+  const maxDepth = Math.max(
+    0,
+    Math.min(12, Math.trunc(input?.maxDepth ?? DEFAULT_LIMITS.maxDepth))
+  );
+  const maxEntries = Math.max(
+    1,
+    Math.min(5e4, Math.trunc(input?.maxEntries ?? DEFAULT_LIMITS.maxEntries))
+  );
+  return { maxDepth, maxEntries };
+}
+async function canonicalDirectory(input) {
+  const resolved = path4.resolve(input);
+  const real = await fs2.realpath(resolved);
+  const stat5 = await fs2.stat(real);
+  if (!stat5.isDirectory()) throw new Error(`Project root is not a directory: ${input}`);
+  return real;
+}
+async function canonicalInside(input, root, label) {
+  const resolved = path4.resolve(input);
+  let real;
+  try {
+    real = await fs2.realpath(resolved);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    const parent = await fs2.realpath(path4.dirname(resolved));
+    real = path4.join(parent, path4.basename(resolved));
+  }
+  if (!isInside(real, root)) throw new Error(`${label} is outside project root: ${input}`);
+  return real;
+}
+function resolveFrom(cwd, input) {
+  return path4.isAbsolute(input) ? input : path4.resolve(cwd, input);
+}
+function isInside(candidate, root) {
+  const relative5 = path4.relative(root, candidate);
+  return relative5 === "" || !relative5.startsWith("..") && !path4.isAbsolute(relative5);
+}
+function pathDepth(candidate, root) {
+  const relative5 = path4.relative(root, candidate);
+  return relative5 === "" ? 0 : relative5.split(path4.sep).length;
+}
+function dedupeEvidence(items) {
+  const seen = /* @__PURE__ */ new Set();
+  return items.filter((item) => {
+    const key = `${item.kind}\0${item.path}\0${item.value}\0${item.weight}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function compareEvidence(a, b) {
+  return a.path.localeCompare(b.path) || a.kind.localeCompare(b.kind) || b.weight - a.weight;
+}
+function compareWorkspaces(a, b) {
+  return b.confidence - a.confidence || a.language.localeCompare(b.language) || a.root.localeCompare(b.root) || a.id.localeCompare(b.id);
+}
+
+// src/languages/diagnostics.ts
+import * as path5 from "node:path";
+var MAX_DIAGNOSTICS = 200;
+function parseLanguageDiagnostics(parser, stdout, stderr, workspaceRoot) {
+  const text = `${stdout}${stdout && stderr ? "\n" : ""}${stderr}`;
+  let diagnostics;
+  switch (parser) {
+    case "typescript":
+      diagnostics = parseTypeScript(text, workspaceRoot);
+      break;
+    case "cargo-json":
+      diagnostics = parseCargoJson(text, workspaceRoot);
+      break;
+    case "php-lint":
+      diagnostics = parsePhpLint(text, workspaceRoot);
+      break;
+    case "dotnet-build":
+    case "dotnet-format":
+    case "dotnet-test":
+      diagnostics = parseDotnet(text, workspaceRoot);
+      break;
+    case "go-test":
+    case "go-compiler":
+    case "gofmt":
+      diagnostics = parseGo(text, workspaceRoot);
+      break;
+    case "biome":
+      diagnostics = parseBiome(text, workspaceRoot);
+      break;
+    default:
+      diagnostics = parseGeneric(text, parser, workspaceRoot);
+      break;
+  }
+  const sorted = dedupeDiagnostics(diagnostics).sort(compareDiagnostics);
+  const omitted = Math.max(0, sorted.length - MAX_DIAGNOSTICS);
+  const kept = Object.freeze(sorted.slice(0, MAX_DIAGNOSTICS).map((item) => Object.freeze(item)));
+  return {
+    diagnostics: kept,
+    omitted,
+    summary: summarize(kept)
+  };
+}
+function parseTypeScript(text, root) {
+  const diagnostics = [];
+  const regex = /^(.+?)\((\d+),(\d+)\):\s+(error|warning)\s+(TS\d+):\s*(.+)$/gm;
+  for (const match of text.matchAll(regex)) {
+    diagnostics.push({
+      severity: match[4] === "warning" ? "warning" : "error",
+      code: match[5],
+      message: match[6].trim(),
+      file: normalizeDiagnosticPath(match[1], root),
+      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
+      source: "typescript"
+    });
+  }
+  return diagnostics;
+}
+function parseCargoJson(text, root) {
+  const diagnostics = [];
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.trim().startsWith("{")) continue;
+    try {
+      const value = JSON.parse(line);
+      if (value.reason !== "compiler-message" || !value.message?.message) continue;
+      const primary = value.message.spans?.find((span) => span.is_primary) ?? value.message.spans?.[0];
+      diagnostics.push({
+        severity: normalizeSeverity(value.message.level),
+        ...value.message.code?.code ? { code: value.message.code.code } : {},
+        message: value.message.message,
+        ...primary?.file_name ? { file: normalizeDiagnosticPath(primary.file_name, root) } : {},
+        ...primary?.line_start ? { range: { start: { line: primary.line_start, column: primary.column_start ?? 1 } } } : {},
+        source: "rustc"
+      });
+    } catch {
+    }
+  }
+  return diagnostics;
+}
+function parseGo(text, root) {
+  return parseLinePattern(
+    text,
+    /^(.*?\.go):(\d+):(\d+):\s*(.+)$/gm,
+    root,
+    "go",
+    (_match, message) => ({ message, severity: /warning/i.test(message) ? "warning" : "error" })
+  );
+}
+function parsePhpLint(text, root) {
+  const diagnostics = [];
+  const regex = /(?:PHP\s+)?(?:Parse|Fatal) error:\s*(.+?)\s+in\s+(.+?)\s+on line\s+(\d+)/gi;
+  for (const match of text.matchAll(regex)) {
+    diagnostics.push({
+      severity: "error",
+      message: match[1].trim(),
+      file: normalizeDiagnosticPath(match[2], root),
+      range: { start: { line: toPositiveInt(match[3]), column: 1 } },
+      source: "php"
+    });
+  }
+  return diagnostics;
+}
+function parseDotnet(text, root) {
+  const diagnostics = [];
+  const regex = /^(.+?)\((\d+),(\d+)\):\s*(error|warning)\s+([A-Z]+\d+):\s*(.+?)(?:\s+\[.+\])?$/gm;
+  for (const match of text.matchAll(regex)) {
+    diagnostics.push({
+      severity: match[4] === "warning" ? "warning" : "error",
+      code: match[5],
+      message: match[6].trim(),
+      file: normalizeDiagnosticPath(match[1], root),
+      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
+      source: "dotnet"
+    });
+  }
+  return diagnostics;
+}
+function parseBiome(text, root) {
+  const diagnostics = [];
+  const regex = /^(.+?):(\d+):(\d+)\s+(lint\/[^\s]+|format)\s+(.+)$/gm;
+  for (const match of text.matchAll(regex)) {
+    diagnostics.push({
+      severity: "warning",
+      code: match[4],
+      message: match[5].trim(),
+      file: normalizeDiagnosticPath(match[1], root),
+      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
+      source: "biome"
+    });
+  }
+  return diagnostics;
+}
+function parseGeneric(text, source, root) {
+  return parseLinePattern(
+    text,
+    /^(.+?):(\d+):(\d+):\s*(?:(error|warning|info):\s*)?(.+)$/gm,
+    root,
+    source,
+    (match, fallback) => ({
+      severity: normalizeSeverity(match[4]),
+      message: match[5]?.trim() || fallback
+    })
+  );
+}
+function parsePackageReports(parser, stdout, stderr) {
+  const text = `${stdout}${stdout && stderr ? "\n" : ""}${stderr}`;
+  switch (parser) {
+    case "npm-audit":
+      return parseNpmAudit(text);
+    case "npm-outdated":
+      return parseNpmOutdated(text);
+    case "cargo-audit":
+      return parseCargoAudit(text);
+    case "composer-audit":
+      return parseComposerAudit(text);
+    case "composer-outdated":
+      return parseComposerOutdated(text);
+    case "dotnet-package":
+      return parseDotnetPackage(text);
+    default:
+      return { diagnostics: [], vulnerabilities: [], outdated: [] };
+  }
+}
+function parseNpmAudit(text) {
+  const advisories = [];
+  const diagnostics = [];
+  let root;
+  try {
+    root = JSON.parse(text);
+  } catch {
+    return { diagnostics, vulnerabilities: advisories, outdated: [] };
+  }
+  const vulnerabilities = root?.vulnerabilities ?? {};
+  const advisoriesRecord = root?.advisories ?? vulnerabilities;
+  for (const [id, value] of Object.entries(advisoriesRecord)) {
+    const advisory = value;
+    const name = advisory.module_name ?? advisory.package_name ?? advisory.name ?? id;
+    advisories.push({
+      package: name,
+      ...advisory.title ? { advisory: advisory.title } : { advisory: id },
+      severity: mapSeverity(advisory.severity),
+      ...advisory.patched_versions ? { fixedIn: advisory.patched_versions } : {},
+      ...advisory.url ? { url: advisory.url } : {}
+    });
+    diagnostics.push({
+      severity: mapSeverity(advisory.severity) === "critical" || mapSeverity(advisory.severity) === "high" ? "error" : "warning",
+      code: id,
+      message: advisory.title ?? `Vulnerability reported for ${name}.`,
+      source: "npm-audit"
+    });
+  }
+  return { diagnostics, vulnerabilities: advisories, outdated: [] };
+}
+function parseNpmOutdated(text) {
+  const diagnostics = [];
+  const outdated = [];
+  let payload = {};
+  try {
+    payload = JSON.parse(text);
+  } catch {
+    return { diagnostics, vulnerabilities: [], outdated };
+  }
+  for (const [name, info] of Object.entries(payload)) {
+    const entry = info;
+    if (!entry.latest || entry.latest === entry.current) continue;
+    outdated.push({
+      name,
+      previous: entry.current,
+      resolved: entry.latest,
+      kind: mapOutdatedKind(entry.type)
+    });
+    diagnostics.push({
+      severity: "info",
+      code: "outdated",
+      message: `${name}: ${entry.current ?? "?"} \u2192 ${entry.latest}`,
+      source: "npm-outdated"
+    });
+  }
+  return { diagnostics, vulnerabilities: [], outdated };
+}
+function parseCargoAudit(text) {
+  const diagnostics = [];
+  const vulnerabilities = [];
+  let root;
+  try {
+    root = JSON.parse(text);
+  } catch {
+    return { diagnostics, vulnerabilities, outdated: [] };
+  }
+  const findings = root.vulnerabilities?.found;
+  if (!Array.isArray(findings)) return { diagnostics, vulnerabilities, outdated: [] };
+  for (const finding of findings) {
+    const item = finding;
+    const name = item.package ?? "unknown";
+    const advisory = item.id ?? item.advisory?.id ?? "cargo-audit";
+    vulnerabilities.push({
+      package: name,
+      ...item.title ? { advisory: item.title } : { advisory },
+      severity: mapSeverity(item.severity),
+      ...item.patched_versions && item.patched_versions.length > 0 ? { fixedIn: item.patched_versions[0] } : {},
+      ...item.url?.short ? { url: item.url.short } : {}
+    });
+    diagnostics.push({
+      severity: mapSeverity(item.severity) === "critical" || mapSeverity(item.severity) === "high" ? "error" : "warning",
+      code: advisory,
+      message: item.title ?? `${name} reported by cargo-audit.`,
+      source: "cargo-audit"
+    });
+  }
+  return { diagnostics, vulnerabilities, outdated: [] };
+}
+function parseComposerAudit(text) {
+  const diagnostics = [];
+  const vulnerabilities = [];
+  const lines = text.split(/\r?\n/);
+  for (const line of lines) {
+    if (!line.trim().startsWith("{")) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (!entry.package) continue;
+      vulnerabilities.push({
+        package: entry.package,
+        ...entry.advisory ? { advisory: entry.advisory } : {},
+        ...entry.title ? { advisory: entry.title } : { advisory: entry.advisory ?? "composer-audit" },
+        severity: mapSeverity(entry.severity),
+        ...entry.affectedVersions ? { fixedIn: entry.affectedVersions } : {},
+        ...entry.url ? { url: entry.url } : {}
+      });
+      diagnostics.push({
+        severity: "warning",
+        code: entry.advisory ?? "composer-audit",
+        message: entry.title ?? `${entry.package} reported by composer audit.`,
+        source: "composer-audit"
+      });
+    } catch {
+    }
+  }
+  return { diagnostics, vulnerabilities, outdated: [] };
+}
+function parseComposerOutdated(text) {
+  const diagnostics = [];
+  const outdated = [];
+  const lines = text.split(/\r?\n/);
+  for (const line of lines) {
+    if (!line.trim().startsWith("{")) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (!entry.name || entry.version === entry.latest) continue;
+      outdated.push({
+        name: entry.name,
+        previous: entry.version,
+        resolved: entry.latest ?? entry.version
+      });
+      diagnostics.push({
+        severity: "info",
+        code: "outdated",
+        message: `${entry.name}: ${entry.version ?? "?"} \u2192 ${entry.latest ?? "?"}`,
+        source: "composer-outdated"
+      });
+    } catch {
+    }
+  }
+  return { diagnostics, vulnerabilities: [], outdated };
+}
+function parseDotnetPackage(text) {
+  const diagnostics = [];
+  const vulnerabilities = [];
+  const outdated = [];
+  let root;
+  try {
+    root = JSON.parse(text);
+  } catch {
+    return { diagnostics, vulnerabilities, outdated };
+  }
+  const projects = root.projects;
+  if (!Array.isArray(projects)) return { diagnostics, vulnerabilities, outdated };
+  for (const project of projects) {
+    const packages = Array.isArray(project.packages) ? project.packages : [];
+    for (const pkg of packages) {
+      const name = typeof pkg.name === "string" ? pkg.name : "unknown";
+      const requested = typeof pkg.requestedVersion === "string" ? pkg.requestedVersion : void 0;
+      const resolved = typeof pkg.resolvedVersion === "string" ? pkg.resolvedVersion : void 0;
+      const vulnerabilitiesRaw = Array.isArray(pkg.vulnerabilities) ? pkg.vulnerabilities : [];
+      for (const vuln of vulnerabilitiesRaw) {
+        const advisory = typeof vuln.advisoryUrl === "string" ? vuln.advisoryUrl : "dotnet-vulnerable";
+        vulnerabilities.push({
+          package: name,
+          advisory,
+          severity: mapSeverity(typeof vuln.severity === "string" ? vuln.severity : void 0)
+        });
+      }
+      if (vulnerabilitiesRaw.length > 0) {
+        diagnostics.push({
+          severity: "warning",
+          code: "dotnet-vulnerable",
+          message: `${name} has ${vulnerabilitiesRaw.length} known vulnerability entry/entries.`,
+          source: "dotnet-package"
+        });
+      }
+      if (requested && resolved && requested.startsWith(">") && requested.split(">")[1].split(".").slice(0, 2).join(".") !== resolved.split(".").slice(0, 2).join(".")) {
+        outdated.push({ name, requested, resolved });
+        diagnostics.push({
+          severity: "info",
+          code: "outdated",
+          message: `${name}: ${requested} \u2192 ${resolved}`,
+          source: "dotnet-package"
+        });
+      }
+    }
+  }
+  return { diagnostics, vulnerabilities, outdated };
+}
+function mapSeverity(value) {
+  switch (value?.toLowerCase()) {
+    case "critical":
+    case "high":
+      return "high";
+    case "medium":
+    case "moderate":
+      return "moderate";
+    case "low":
+      return "low";
+    case "unknown":
+      return "unknown";
+    default:
+      return "unknown";
+  }
+}
+function mapOutdatedKind(value) {
+  switch (value?.toLowerCase()) {
+    case "devdependencies":
+    case "development":
+      return "development";
+    case "optionaldependencies":
+    case "optional":
+      return "optional";
+    default:
+      return "runtime";
+  }
+}
+function parseLinePattern(text, regex, root, source, details) {
+  const diagnostics = [];
+  for (const match of text.matchAll(regex)) {
+    const parsed = details(match, match.at(-1)?.trim() ?? "Diagnostic");
+    diagnostics.push({
+      severity: parsed.severity,
+      message: parsed.message,
+      file: normalizeDiagnosticPath(match[1], root),
+      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
+      source
+    });
+  }
+  return diagnostics;
+}
+function normalizeDiagnosticPath(value, root) {
+  const clean = value.trim().replace(/^['"]|['"]$/g, "");
+  return path5.resolve(root, clean);
+}
+function normalizeSeverity(value) {
+  if (value === "warning" || value === "warn") return "warning";
+  if (value === "info" || value === "note" || value === "help") return "info";
+  if (value === "hint") return "hint";
+  return "error";
+}
+function toPositiveInt(value) {
+  return Math.max(1, Number.parseInt(value ?? "1", 10) || 1);
+}
+function summarize(diagnostics) {
+  return {
+    errors: diagnostics.filter((item) => item.severity === "error").length,
+    warnings: diagnostics.filter((item) => item.severity === "warning").length,
+    infos: diagnostics.filter((item) => item.severity === "info" || item.severity === "hint").length
+  };
+}
+function dedupeDiagnostics(items) {
+  const seen = /* @__PURE__ */ new Set();
+  return items.filter((item) => {
+    const key = [
+      item.source,
+      item.code ?? "",
+      item.file ?? "",
+      item.range?.start.line ?? 0,
+      item.range?.start.column ?? 0,
+      item.message
+    ].join("\0");
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function compareDiagnostics(a, b) {
+  return (a.file ?? "").localeCompare(b.file ?? "") || (a.range?.start.line ?? 0) - (b.range?.start.line ?? 0) || (a.range?.start.column ?? 0) - (b.range?.start.column ?? 0) || severityRank(a.severity) - severityRank(b.severity) || (a.code ?? "").localeCompare(b.code ?? "") || a.message.localeCompare(b.message);
+}
+function severityRank(value) {
+  return value === "error" ? 0 : value === "warning" ? 1 : value === "info" ? 2 : 3;
+}
+
+// src/languages/execute.ts
+import * as fs4 from "node:fs/promises";
+import * as path7 from "node:path";
+
+// src/languages/plan.ts
+import * as fs3 from "node:fs/promises";
+import * as path6 from "node:path";
+var MAX_ARGUMENTS = 128;
+var MAX_ARGUMENT_LENGTH = 4096;
+var PACKAGE_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+(?:@[a-z0-9*+._~^<>=|-]+)?$/i;
+var COMPOSER_PACKAGE_RE = /^[a-z0-9_.-]+\/[a-z0-9_.-]+(?::[a-z0-9*+._~^<>=|-]+)?$/i;
+var GO_MODULE_RE = /^(?:[a-z0-9.-]+\.)+[a-z0-9.-]+\/[a-z0-9._~+/@-]+$/i;
+async function planLanguageOperation(options) {
+  validateOperationOptions(options.operation, options.operationOptions?.packages);
+  const detection = await detectLanguageWorkspaces(options);
+  const candidates = detection.workspaces.filter(
+    (workspace) => workspace.capabilities.includes(options.operation)
+  );
+  const selected = selectWorkspace(candidates, options);
+  if (selected.status !== "selected") return selected.result;
+  const profile = (options.profiles ?? languageProfileRegistry.list()).find(
+    (item) => item.id === selected.workspace.language
+  );
+  if (!profile) {
+    return {
+      status: "not_found",
+      reason: `Profile ${selected.workspace.language} is unavailable.`,
+      candidates
+    };
+  }
+  if ((profile.id === "typescript" || profile.id === "javascript") && options.operation !== "syntax" && selected.workspace.packageManager === void 0 && new Set(
+    selected.workspace.evidence.filter((evidence) => evidence.kind === "lockfile").map((evidence) => evidence.value.toLowerCase())
+  ).size > 1) {
+    return {
+      status: "unavailable",
+      workspace: selected.workspace,
+      unavailable: {
+        status: "unavailable",
+        profileId: profile.id,
+        workspaceId: selected.workspace.id,
+        operation: options.operation,
+        reason: "Conflicting Node lockfiles make the package manager ambiguous."
+      }
+    };
+  }
+  const resolver = profile.operations[options.operation];
+  if (!resolver) {
+    return {
+      status: "unavailable",
+      workspace: selected.workspace,
+      unavailable: {
+        status: "unavailable",
+        profileId: profile.id,
+        workspaceId: selected.workspace.id,
+        operation: options.operation,
+        reason: `${profile.displayName} does not define ${options.operation}.`
+      }
+    };
+  }
+  const canonicalCwd = options.cwd ? path6.isAbsolute(options.cwd) ? options.cwd : path6.resolve(detection.projectRoot, options.cwd) : detection.projectRoot;
+  const target = options.target ? await canonicalTarget(canonicalCwd, options.target, detection.projectRoot) : void 0;
+  const ctx = {
+    projectRoot: detection.projectRoot,
+    workspace: selected.workspace,
+    ...target ? { target } : {},
+    mode: options.mode ?? "standard",
+    options: options.operationOptions ?? {},
+    platform: process.platform,
+    pathExists: async (candidate) => {
+      try {
+        await fs3.access(path6.resolve(detection.projectRoot, candidate));
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+  const result = await resolver(ctx);
+  if ("status" in result) {
+    return { status: "unavailable", workspace: selected.workspace, unavailable: result };
+  }
+  const errors = validateCommandPlan(result, profile, detection.projectRoot);
+  if (errors.length > 0) {
+    return {
+      status: "unavailable",
+      workspace: selected.workspace,
+      unavailable: {
+        status: "unavailable",
+        profileId: profile.id,
+        workspaceId: selected.workspace.id,
+        operation: options.operation,
+        reason: `Generated plan failed validation: ${errors.join("; ")}`
+      }
+    };
+  }
+  return { status: "planned", workspace: selected.workspace, plan: Object.freeze(result) };
+}
+function validateCommandPlan(plan, profile, projectRoot) {
+  const errors = [];
+  if (plan.profileId !== profile.id) errors.push("profile id does not match");
+  if (!isInside2(plan.cwd, projectRoot)) errors.push("cwd is outside project root");
+  if (plan.args.length > MAX_ARGUMENTS) errors.push(`argument count exceeds ${MAX_ARGUMENTS}`);
+  if (plan.args.some((arg) => arg.length > MAX_ARGUMENT_LENGTH || /[\r\n\0]/.test(arg))) {
+    errors.push("arguments contain an invalid or oversized value");
+  }
+  if (!Number.isFinite(plan.timeoutMs) || plan.timeoutMs < 1 || plan.timeoutMs > 6e5) {
+    errors.push("timeout is outside 1..600000ms");
+  }
+  if (!Number.isFinite(plan.outputLimitBytes) || plan.outputLimitBytes < 1 || plan.outputLimitBytes > 1e6) {
+    errors.push("output limit is outside 1..1000000 bytes");
+  }
+  if (plan.kind === "internal") {
+    if (plan.command !== null || plan.args.length !== 0)
+      errors.push("internal plans cannot declare a command");
+  } else {
+    if (!plan.command || !profile.executables.includes(plan.command)) {
+      errors.push(`executable "${plan.command ?? ""}" is not allowlisted by the profile`);
+    }
+  }
+  if (Object.keys(plan.env).length > 0)
+    errors.push("Phase 1 plans cannot override environment variables");
+  return errors;
+}
+function selectWorkspace(candidates, options) {
+  if (candidates.length === 0) {
+    return {
+      status: "result",
+      result: {
+        status: "not_found",
+        reason: `No workspace supports ${options.operation}.`,
+        candidates: []
+      }
+    };
+  }
+  if (options.workspace) {
+    const requested = path6.isAbsolute(options.workspace) ? path6.resolve(options.workspace) : path6.resolve(options.projectRoot, options.workspace);
+    const matches = candidates.filter(
+      (item) => item.id === options.workspace || path6.resolve(item.root) === requested
+    );
+    if (matches.length === 1) return { status: "selected", workspace: matches[0] };
+    return {
+      status: "result",
+      result: {
+        status: "not_found",
+        reason: `Requested workspace "${options.workspace}" was not detected.`,
+        candidates: [...candidates]
+      }
+    };
+  }
+  if (options.target) {
+    const base = options.cwd ? path6.isAbsolute(options.cwd) ? path6.resolve(options.cwd) : path6.resolve(options.projectRoot, options.cwd) : path6.resolve(options.projectRoot);
+    const target = path6.isAbsolute(options.target) ? path6.resolve(options.target) : path6.resolve(base, options.target);
+    const targeted = candidates.filter((item) => item.evidence.some((evidence) => evidence.kind === "target")).sort(
+      (a, b) => workspaceDepth(b.root, options.projectRoot) - workspaceDepth(a.root, options.projectRoot) || compareCandidates(a, b)
+    );
+    if (targeted[0]) return { status: "selected", workspace: targeted[0] };
+    const containing = candidates.filter((item) => isInside2(target, item.root)).sort(
+      (a, b) => workspaceDepth(b.root, options.projectRoot) - workspaceDepth(a.root, options.projectRoot) || compareCandidates(a, b)
+    );
+    if (containing[0]) return { status: "selected", workspace: containing[0] };
+  }
+  const sorted = [...candidates].sort(compareCandidates);
+  const first = sorted[0];
+  const firstDepth = workspaceDepth(first.root, options.projectRoot);
+  const tied = sorted.filter(
+    (item) => item.confidence === first.confidence && workspaceDepth(item.root, options.projectRoot) === firstDepth
+  );
+  if (tied.length > 1) {
+    return {
+      status: "result",
+      result: {
+        status: "ambiguous",
+        reason: "Multiple workspaces have equal confidence; provide target, language, or workspace.",
+        candidates: tied
+      }
+    };
+  }
+  return { status: "selected", workspace: first };
+}
+function compareCandidates(a, b) {
+  return b.confidence - a.confidence || a.language.localeCompare(b.language) || a.root.localeCompare(b.root);
+}
+function workspaceDepth(workspaceRoot, projectRoot) {
+  const relative5 = path6.relative(path6.resolve(projectRoot), path6.resolve(workspaceRoot));
+  return relative5 === "" ? 0 : relative5.split(path6.sep).length;
+}
+function validateOperationOptions(operation, packages) {
+  if (!operation.startsWith("package-") || !packages) return;
+  for (const value of packages) {
+    if (!value || value.length > 214 || value.startsWith("-") || /[\r\n\0;&|`$<>\\]/.test(value)) {
+      throw new Error(`Invalid package identifier "${value}"`);
+    }
+    if (value.startsWith(".") || value.startsWith("/") || /^[A-Za-z]:/.test(value) || value.includes("://")) {
+      throw new Error(`Package paths and URLs are not supported: "${value}"`);
+    }
+    if (!PACKAGE_NAME_RE.test(value) && !COMPOSER_PACKAGE_RE.test(value) && !GO_MODULE_RE.test(value)) {
+      throw new Error(`Invalid package identifier "${value}"`);
+    }
+  }
+}
+async function canonicalTarget(cwd, target, projectRoot) {
+  const resolved = path6.isAbsolute(target) ? path6.resolve(target) : path6.resolve(cwd, target);
+  let real;
+  try {
+    real = await fs3.realpath(resolved);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    const parent = await fs3.realpath(path6.dirname(resolved));
+    real = path6.join(parent, path6.basename(resolved));
+  }
+  if (!isInside2(real, projectRoot)) throw new Error(`target is outside project root: ${target}`);
+  return real;
+}
+function isInside2(candidate, root) {
+  const relative5 = path6.relative(path6.resolve(root), path6.resolve(candidate));
+  return relative5 === "" || !relative5.startsWith("..") && !path6.isAbsolute(relative5);
+}
+
+// src/languages/execute.ts
+async function validatePlanRealpaths(plan, projectRoot) {
+  const realRoot = await fs4.realpath(projectRoot);
+  let realCwd;
+  try {
+    realCwd = await fs4.realpath(plan.cwd);
+  } catch (error) {
+    return `Plan cwd is unavailable: ${error instanceof Error ? error.message : String(error)}`;
+  }
+  if (!isRealInside(realCwd, realRoot)) return "Plan cwd resolves outside project root.";
+  for (const argument of plan.args) {
+    if (!path7.isAbsolute(argument)) continue;
+    try {
+      const realArgument = await fs4.realpath(argument);
+      if (!isRealInside(realArgument, realRoot)) {
+        return `Plan argument resolves outside project root: ${argument}`;
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        return `Plan argument could not be resolved safely: ${argument}`;
+      }
+    }
+  }
+  return void 0;
+}
+function isRealInside(candidate, root) {
+  const relative5 = path7.relative(root, candidate);
+  return relative5 === "" || !relative5.startsWith("..") && !path7.isAbsolute(relative5);
+}
+async function* executePackagePlan(options) {
+  const { plan, workspace } = options;
+  const startedAt = Date.now();
+  if (options.signal.aborted) {
+    yield { type: "log", text: "Run cancelled before execution." };
+    return terminalPackageResult(options, "cancelled", startedAt);
+  }
+  const profile = languageProfileRegistry.get(plan.profileId);
+  if (!profile) {
+    yield { type: "warning", text: `Unknown language profile: ${plan.profileId}` };
+    return terminalPackageResult(options, "unavailable", startedAt, "Unknown language profile.");
+  }
+  if (workspace.id !== plan.workspaceId || workspace.language !== plan.profileId) {
+    return terminalPackageResult(
+      options,
+      "unavailable",
+      startedAt,
+      "Plan and workspace identity do not match."
+    );
+  }
+  const validation = validateCommandPlan(plan, profile, options.projectRoot);
+  if (validation.length > 0) {
+    return terminalPackageResult(
+      options,
+      "unavailable",
+      startedAt,
+      `Plan failed execution validation: ${validation.join("; ")}`
+    );
+  }
+  const containmentError = await validatePlanRealpaths(plan, options.projectRoot);
+  if (containmentError) {
+    return terminalPackageResult(options, "unavailable", startedAt, containmentError);
+  }
+  const manifestsBefore = await snapshotPaths(workspace.manifests);
+  const lockfilePaths = collectLockfilePaths(workspace);
+  const lockfilesBefore = await snapshotPaths(lockfilePaths);
+  const manifestSizesBefore = await snapshotSizes(workspace.manifests);
+  const lockfileSizesBefore = await snapshotSizes(lockfilePaths);
+  yield {
+    type: "log",
+    text: plan.kind === "process" ? `${plan.command} ${plan.args.join(" ")}` : `${plan.parser}: ${plan.operation}`,
+    data: {
+      language: plan.profileId,
+      operation: plan.operation,
+      workspace: workspace.root,
+      packages: [...options.packages]
+    }
+  };
+  const timeoutController = new AbortController();
+  const timer = setTimeout(
+    () => timeoutController.abort(new Error("language package plan timed out")),
+    plan.timeoutMs
+  );
+  timer.unref?.();
+  const signal = AbortSignal.any([options.signal, timeoutController.signal]);
+  let spawned;
+  let run;
+  let status = "unavailable";
+  let error;
+  try {
+    if (plan.kind !== "process") {
+      return terminalPackageResult(
+        options,
+        "unavailable",
+        startedAt,
+        "Package operations require an executable plan; internal plans cannot mutate the manifest."
+      );
+    }
+    const stream = spawnStream({
+      cmd: plan.command,
+      args: [...plan.args],
+      cwd: plan.cwd,
+      signal,
+      maxBytes: plan.outputLimitBytes
+    });
+    for (; ; ) {
+      const next = await stream.next();
+      if (next.done) {
+        spawned = next.value;
+        break;
+      }
+      yield next.value;
+    }
+  } catch (error_) {
+    error = error_ instanceof Error ? error_.message : String(error_);
+  } finally {
+    clearTimeout(timer);
+  }
+  if (spawned) {
+    const parsed = parseLanguageDiagnostics(
+      plan.parser,
+      spawned.stdout,
+      spawned.stderr,
+      workspace.root
+    );
+    const timedOut = timeoutController.signal.aborted && !options.signal.aborted;
+    const cancelled = options.signal.aborted;
+    const spawnUnavailable = Boolean(
+      spawned.error && /ENOENT|not found|cannot find/i.test(spawned.error)
+    );
+    status = timedOut ? "timed_out" : cancelled ? "cancelled" : spawnUnavailable ? "unavailable" : spawned.exitCode === 0 ? "passed" : "failed";
+    error ??= spawned.error;
+    const raw = [spawned.stdout, spawned.stderr, spawned.error].filter(Boolean).join("\n");
+    run = {
+      status,
+      language: plan.profileId,
+      workspace,
+      plan,
+      exitCode: spawned.exitCode,
+      durationMs: Date.now() - startedAt,
+      diagnostics: parsed.diagnostics,
+      omittedDiagnostics: parsed.omitted,
+      summary: parsed.summary,
+      output: normalizeCommandOutput(raw, { maxBytes: plan.outputLimitBytes }),
+      truncated: spawned.truncated,
+      ...spawned.spoolPath ? { spoolPath: spawned.spoolPath } : {},
+      ...spawned.error ? { error: spawned.error } : {}
+    };
+  } else {
+    status = options.signal.aborted ? "cancelled" : timeoutController.signal.aborted ? "timed_out" : "failed";
+  }
+  if (status !== "passed") {
+    return terminalPackageResult(
+      options,
+      status,
+      startedAt,
+      error,
+      run,
+      manifestsBefore,
+      lockfilesBefore
+    );
+  }
+  const manifestsAfter = await snapshotPaths(workspace.manifests);
+  const lockfilesAfter = await snapshotPaths(lockfilePaths);
+  const manifestSizesAfter = await snapshotSizes(workspace.manifests);
+  const lockfileSizesAfter = await snapshotSizes(lockfilePaths);
+  const manifestsChanged = await changedPaths(
+    manifestsBefore,
+    manifestsAfter,
+    manifestSizesBefore,
+    manifestSizesAfter
+  );
+  const lockfilesChanged = await changedPaths(
+    lockfilesBefore,
+    lockfilesAfter,
+    lockfileSizesBefore,
+    lockfileSizesAfter
+  );
+  const reports = parsePackageReports(plan.parser, spawned?.stdout ?? "", spawned?.stderr ?? "");
+  const mutations = packageMutationsFromInputs(options.packages, reports.outdated);
+  return {
+    workspace,
+    language: plan.profileId,
+    operation: plan.operation,
+    status,
+    ...run ? { run } : {},
+    durationMs: Date.now() - startedAt,
+    manifestsBefore,
+    lockfilesBefore,
+    manifestsAfter,
+    lockfilesAfter,
+    mutations,
+    vulnerabilities: reports.vulnerabilities,
+    outdated: reports.outdated,
+    manifestsChanged: Object.freeze(manifestsChanged),
+    lockfilesChanged: Object.freeze(lockfilesChanged)
+  };
+}
+function packageMutationsFromInputs(inputs, outdated) {
+  const outdatedNames = new Set(outdated.map((entry) => entry.name));
+  return inputs.filter((name) => !outdatedNames.has(name)).map((name) => ({ name, requested: name, kind: "runtime" }));
+}
+async function snapshotPaths(paths) {
+  const existing = [];
+  for (const candidate of paths) {
+    try {
+      const stat5 = await fs4.stat(candidate);
+      if (!stat5.isFile()) continue;
+      existing.push(candidate);
+    } catch {
+    }
+  }
+  return Object.freeze(existing);
+}
+async function changedPaths(before, after, beforeSizes, afterSizes) {
+  const beforeSet = new Set(before);
+  const afterSet = new Set(after);
+  const changed = /* @__PURE__ */ new Set();
+  for (const path9 of after) {
+    if (!beforeSet.has(path9)) changed.add(path9);
+  }
+  for (const path9 of before) {
+    if (!afterSet.has(path9)) changed.add(path9);
+  }
+  if (beforeSizes && afterSizes) {
+    for (const path9 of after) {
+      if (beforeSizes.get(path9) !== afterSizes.get(path9)) changed.add(path9);
+    }
+  }
+  return [...changed].sort();
+}
+async function snapshotSizes(paths) {
+  const sizes = /* @__PURE__ */ new Map();
+  for (const candidate of paths) {
+    try {
+      const stat5 = await fs4.stat(candidate);
+      if (stat5.isFile()) sizes.set(candidate, stat5.size);
+    } catch {
+    }
+  }
+  return sizes;
+}
+function collectLockfilePaths(workspace) {
+  const explicit = workspace.evidence.filter((evidence) => evidence.kind === "lockfile").map((evidence) => evidence.path);
+  const detected = LOCKFILE_NAMES_BY_PROFILE.get(workspace.language)?.map(
+    (name) => path7.join(workspace.root, name)
+  ) ?? [];
+  const merged = /* @__PURE__ */ new Set();
+  for (const candidate of [...explicit, ...detected]) merged.add(candidate);
+  return Object.freeze([...merged]);
+}
+var LOCKFILE_NAMES_BY_PROFILE = /* @__PURE__ */ new Map([
+  ["typescript", ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"]],
+  ["javascript", ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"]],
+  ["go", ["go.sum"]],
+  ["rust", ["Cargo.lock"]],
+  ["php", ["composer.lock"]],
+  ["csharp", ["packages.lock.json"]]
+]);
+function terminalPackageResult(options, status, startedAt, error, run, manifestsBefore = [], lockfilesBefore = []) {
+  return {
+    workspace: options.workspace,
+    language: options.plan.profileId,
+    operation: options.plan.operation,
+    status,
+    ...run ? { run } : {},
+    durationMs: Date.now() - startedAt,
+    manifestsBefore,
+    lockfilesBefore,
+    manifestsAfter: manifestsBefore,
+    lockfilesAfter: lockfilesBefore,
+    manifestsChanged: Object.freeze([]),
+    lockfilesChanged: Object.freeze([]),
+    mutations: Object.freeze([]),
+    vulnerabilities: Object.freeze([]),
+    outdated: Object.freeze([]),
+    ...error ? { error } : {}
+  };
+}
+
+// src/languages/legacy-bridge.ts
+var NON_JS_MARKERS = [
+  { filename: "go.mod", language: "go" },
+  { filename: "go.work", language: "go" },
+  { filename: "Cargo.toml", language: "rust" },
+  { filename: "composer.json", language: "php" }
+];
+var NON_JS_SUFFIXES = [
+  { suffix: ".csproj", language: "csharp" },
+  { suffix: ".fsproj", language: "csharp" }
+];
+async function detectNonJsEcosystem(cwd, projectRoot) {
+  try {
+    let dir = path8.resolve(cwd);
+    const root = path8.resolve(projectRoot);
+    for (let depth = 0; depth <= 4 && dir.startsWith(root); depth++) {
+      for (const marker of NON_JS_MARKERS) {
+        try {
+          const s = await fs5.stat(path8.join(dir, marker.filename));
+          if (s.isFile()) return marker.language;
+        } catch {
+        }
+      }
+      try {
+        const entries = await fs5.readdir(dir);
+        for (const entry of entries) {
+          for (const suffix of NON_JS_SUFFIXES) {
+            if (entry.toLowerCase().endsWith(suffix.suffix)) return suffix.language;
+          }
+        }
+      } catch {
+      }
+      if (dir === root) break;
+      dir = path8.dirname(dir);
+    }
+  } catch {
+  }
+  return null;
+}
+async function tryLegacyPackageOperation(operation, ctx, packages = []) {
+  const language = await detectNonJsEcosystem(ctx.cwd, ctx.projectRoot);
+  if (!language) return null;
+  const planResult = await planLanguageOperation({
+    projectRoot: ctx.projectRoot,
+    cwd: ctx.cwd,
+    operation,
+    language,
+    signal: ctx.signal,
+    ...packages.length > 0 ? { operationOptions: { packages: [...packages] } } : {}
+  });
+  if (planResult.status !== "planned") return null;
+  const runner = executePackagePlan({
+    projectRoot: ctx.projectRoot,
+    workspace: planResult.workspace,
+    plan: planResult.plan,
+    packages,
+    signal: ctx.signal
+  });
+  for (; ; ) {
+    const next = await runner.next();
+    if (next.done) return { language, outcome: next.value };
+  }
+}
 
 // src/audit.ts
 var auditTool = {
@@ -967,6 +3654,34 @@ var auditTool = {
   },
   async *executeStream(input, ctx, opts) {
     const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const bridge = await tryLegacyPackageOperation("package-audit", {
+      cwd,
+      projectRoot: ctx.projectRoot,
+      signal: opts.signal
+    });
+    if (bridge?.outcome) {
+      const outcome = bridge.outcome;
+      const vulns = outcome.vulnerabilities.map((v) => ({
+        severity: v.severity,
+        package: v.package,
+        title: v.advisory ?? "Unknown vulnerability",
+        url: v.url ?? ""
+      }));
+      const total = vulns.length;
+      const summary = total === 0 ? "No vulnerabilities found" : `Found ${total} vulnerabilities: ${vulns.filter((a) => a.severity === "critical").length} critical, ${vulns.filter((a) => a.severity === "high").length} high`;
+      yield {
+        type: "final",
+        output: {
+          exit_code: outcome.run?.exitCode ?? 0,
+          vulnerabilities: vulns,
+          total,
+          summary,
+          output: outcome.run?.output ?? "",
+          truncated: outcome.run?.truncated ?? false
+        }
+      };
+      return;
+    }
     const manager = await detectPackageManager(cwd);
     yield { type: "log", text: `Auditing with ${manager}\u2026`, data: { manager } };
     const args = ["audit", "--json"];
@@ -1030,7 +3745,7 @@ function parseAuditOutput(json, exitCode) {
     };
   }
 }
-
-export { auditTool };
+export {
+  auditTool
+};
 //# sourceMappingURL=audit.js.map
-//# sourceMappingURL=audit.js.map