@wrongstack/tools 0.284.1 → 0.285.0

package/dist/outdated.js

@@ -1,89 +1,4740 @@
-import { spawn } from 'node:child_process';
-import * as Core from '@wrongstack/core';
-import { buildChildEnv } from '@wrongstack/core';
-import * as path from 'node:path';
-import * as fs from 'node:fs';
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/_util.ts
+import * as fsp from "node:fs/promises";
+import * as path from "node:path";
+import * as Core from "@wrongstack/core";
+async function detectPackageManager(cwd) {
+  const { stat: stat5 } = await import("node:fs/promises");
+  try {
+    await stat5(`${cwd}/pnpm-lock.yaml`);
+    return "pnpm";
+  } catch {
+  }
+  try {
+    await stat5(`${cwd}/yarn.lock`);
+    return "yarn";
+  } catch {
+  }
+  return "npm";
+}
+function resolvePath(input, ctx) {
+  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);
+}
+function allowedRoots(ctx) {
+  return [path.resolve(ctx.projectRoot), path.resolve(Core.wstackGlobalRoot())];
+}
+function isInsideAny(target, roots) {
+  return roots.some((root) => {
+    const rel = path.relative(root, target);
+    return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
+  });
+}
+function ensureInsideRoot(absPath, ctx) {
+  const target = path.resolve(absPath);
+  if (ctx.allowOutsideProjectRoot) return target;
+  if (isInsideAny(target, allowedRoots(ctx))) return target;
+  throw new Error(`Path "${absPath}" is outside project root "${path.resolve(ctx.projectRoot)}"`);
+}
+function safeResolve(input, ctx) {
+  return ensureInsideRoot(resolvePath(input, ctx), ctx);
+}
+async function assertRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return;
+  const realRoots = await Promise.all(
+    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r)))
+  );
+  let probe = absPath;
+  for (; ; ) {
+    let real;
+    try {
+      real = await fsp.realpath(probe);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        const parent = path.dirname(probe);
+        if (parent === probe) return;
+        probe = parent;
+        continue;
+      }
+      throw err;
+    }
+    if (isInsideAny(real, realRoots)) return;
+    throw new Error(
+      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
+    );
+  }
+}
+async function safeResolveReal(input, ctx) {
+  const abs = safeResolve(input, ctx);
+  await assertRealInsideRoot(abs, ctx);
+  return abs;
+}
+function collapseCarriageReturns(text) {
+  const lf = text.replace(/\r\n/g, "\n");
+  if (!lf.includes("\r")) return lf;
+  return lf.split("\n").map((line) => line.includes("\r") ? line.slice(line.lastIndexOf("\r") + 1) : line).join("\n");
+}
+function collapseConsecutiveDuplicates(text, minRun = REPEAT_RUN_THRESHOLD) {
+  const lines = text.split("\n");
+  const out = [];
+  let i = 0;
+  while (i < lines.length) {
+    let j = i + 1;
+    while (j < lines.length && lines[j] === lines[i]) j++;
+    const run = j - i;
+    if (run >= minRun) {
+      out.push(lines[i], `\u2026 \u27E8repeated ${run}\xD7\u27E9`);
+    } else {
+      for (let k = i; k < j; k++) out.push(lines[k]);
+    }
+    i = j;
+  }
+  return out.join("\n");
+}
+function takeHeadBytes(s, maxBytes) {
+  if (maxBytes <= 0) return "";
+  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
+  let lo = 0;
+  let hi = s.length;
+  while (lo < hi) {
+    const mid = Math.ceil((lo + hi) / 2);
+    if (Buffer.byteLength(s.slice(0, mid), "utf8") <= maxBytes) lo = mid;
+    else hi = mid - 1;
+  }
+  return s.slice(0, lo);
+}
+function takeTailBytes(s, maxBytes) {
+  if (maxBytes <= 0) return "";
+  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
+  let lo = 0;
+  let hi = s.length;
+  while (lo < hi) {
+    const mid = Math.ceil((lo + hi) / 2);
+    if (Buffer.byteLength(s.slice(s.length - mid), "utf8") <= maxBytes) lo = mid;
+    else hi = mid - 1;
+  }
+  return s.slice(s.length - lo);
+}
+function truncateHeadTail(s, maxBytes) {
+  const total = Buffer.byteLength(s, "utf8");
+  if (total <= maxBytes) return s;
+  const MARKER_RESERVE = 64;
+  const avail = Math.max(0, maxBytes - MARKER_RESERVE);
+  const headBudget = Math.floor(avail * 0.45);
+  const head = takeHeadBytes(s, headBudget);
+  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, "utf8"));
+  const kept = Buffer.byteLength(head, "utf8") + Buffer.byteLength(tail, "utf8");
+  return `${head}
+\u2026[truncated ${total - kept} bytes]\u2026
+${tail}`;
+}
+function normalizeCommandOutput(raw, opts = {}) {
+  if (!raw) return raw;
+  let text = Core.stripAnsi(raw);
+  text = collapseCarriageReturns(text);
+  text = text.replace(/[ \t]+$/gm, "");
+  text = collapseConsecutiveDuplicates(text);
+  text = text.replace(/\n{3,}/g, "\n\n");
+  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);
+}
+var COMMAND_OUTPUT_MAX_BYTES, REPEAT_RUN_THRESHOLD;
+var init_util = __esm({
+  "src/_util.ts"() {
+    "use strict";
+    COMMAND_OUTPUT_MAX_BYTES = 32768;
+    REPEAT_RUN_THRESHOLD = 3;
+  }
+});
+
+// src/_win32-resolve.ts
+import * as fs from "node:fs";
+import * as path2 from "node:path";
+function resolveWin32Command(cmd) {
+  if (process.platform !== "win32") return cmd;
+  if (cmd.includes("/") || cmd.includes("\\") || path2.extname(cmd.replace(/\//g, "\\"))) {
+    return cmd;
+  }
+  const pathext = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC").toLowerCase().split(";");
+  const pathDirs = (process.env["PATH"] ?? "").split(path2.delimiter);
+  for (const dir of pathDirs) {
+    const base = path2.join(dir, cmd);
+    for (const ext of pathext) {
+      const full = `${base}${ext}`;
+      try {
+        fs.accessSync(full, fs.constants.X_OK);
+        return full;
+      } catch {
+      }
+    }
+  }
+  return cmd;
+}
+function assertSafeWin32ShellArgs(args) {
+  for (const arg of args) {
+    if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
+      throw new Error(
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+      );
+    }
+  }
+}
+function buildWin32CmdShimInvocation(command, args = []) {
+  assertSafeWin32ShellArgs([command, ...args]);
+  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
+  return {
+    command: process.env["COMSPEC"] ?? "cmd.exe",
+    args: ["/d", "/c", line],
+    windowsVerbatimArguments: true
+  };
+}
+function quoteWin32CmdArg(arg) {
+  return `"${arg}"`;
+}
+var WIN32_SHELL_META;
+var init_win32_resolve = __esm({
+  "src/_win32-resolve.ts"() {
+    "use strict";
+    WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+  }
+});
+
+// src/languages/profile-helpers.ts
+function processPlan(ctx, operation, command, args, options) {
+  return {
+    profileId: ctx.workspace.language,
+    workspaceId: ctx.workspace.id,
+    operation,
+    kind: "process",
+    command,
+    args: Object.freeze([...args]),
+    cwd: ctx.workspace.root,
+    env: Object.freeze({}),
+    timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+    outputLimitBytes: DEFAULT_OUTPUT_LIMIT_BYTES,
+    mutating: options.mutating ?? false,
+    network: options.network ?? false,
+    executesProjectCode: options.executesProjectCode ?? false,
+    reason: options.reason,
+    evidence: ctx.workspace.evidence,
+    parser: options.parser
+  };
+}
+function internalPlan(ctx, operation, parser, reason) {
+  return {
+    profileId: ctx.workspace.language,
+    workspaceId: ctx.workspace.id,
+    operation,
+    kind: "internal",
+    command: null,
+    args: Object.freeze([]),
+    cwd: ctx.workspace.root,
+    env: Object.freeze({}),
+    timeoutMs: 5e3,
+    outputLimitBytes: 32768,
+    mutating: false,
+    network: false,
+    executesProjectCode: false,
+    reason,
+    evidence: ctx.workspace.evidence,
+    parser
+  };
+}
+function unavailable(ctx, operation, reason) {
+  return {
+    status: "unavailable",
+    profileId: ctx.workspace.language,
+    workspaceId: ctx.workspace.id,
+    operation,
+    reason
+  };
+}
+function packageNames(ctx) {
+  return ctx.options.packages ?? [];
+}
+var DEFAULT_TIMEOUT_MS, DEFAULT_OUTPUT_LIMIT_BYTES;
+var init_profile_helpers = __esm({
+  "src/languages/profile-helpers.ts"() {
+    "use strict";
+    DEFAULT_TIMEOUT_MS = 12e4;
+    DEFAULT_OUTPUT_LIMIT_BYTES = 2e5;
+  }
+});
+
+// src/languages/profiles/additional.ts
+function pythonProfile() {
+  return {
+    id: "python",
+    displayName: "Python",
+    extensions: Object.freeze([".py", ".pyi"]),
+    lspLanguageIds: Object.freeze(["python"]),
+    detectors: Object.freeze([
+      { kind: "config", filename: "pyproject.toml", weight: 90 },
+      { kind: "config", filename: "setup.py", weight: 70 },
+      { kind: "config", filename: "setup.cfg", weight: 60 },
+      { kind: "manifest", filename: "requirements.txt", weight: 55 },
+      { kind: "manifest", filename: "Pipfile", weight: 50 },
+      { kind: "lockfile", filename: "poetry.lock", weight: 30 },
+      { kind: "lockfile", filename: "Pipfile.lock", weight: 30 },
+      { kind: "lockfile", filename: "uv.lock", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["pip", "poetry", "pipenv", "uv"]),
+    executables: Object.freeze(["python", "python3", "ruff", "black", "pytest", "mypy", "pyright"]),
+    operations: Object.freeze({
+      syntax: async (ctx) => {
+        const py = ctx.options.target ? "python3" : "python3";
+        return ctx.options.target ? processPlan(ctx, "syntax", py, ["-m", "py_compile", ctx.options.target], {
+          parser: "python",
+          reason: "Compile the target file to check for syntax errors."
+        }) : unavailable(ctx, "syntax", "Python syntax check requires an explicit target file.");
+      },
+      semantic: async (ctx) => processPlan(ctx, "semantic", "mypy", [".", "--no-error-summary"], {
+        parser: "mypy",
+        reason: "Run mypy type checking on the workspace.",
+        executesProjectCode: true
+      }),
+      lint: async (ctx) => processPlan(ctx, "lint", "ruff", ["check", "."], {
+        parser: "ruff",
+        reason: "Run the Ruff linter on the workspace."
+      }),
+      "format-check": async (ctx) => processPlan(ctx, "format-check", "ruff", ["format", "--check", "."], {
+        parser: "ruff",
+        reason: "Check Python formatting without writing files."
+      }),
+      "format-write": async (ctx) => processPlan(ctx, "format-write", "ruff", ["format", "."], {
+        parser: "ruff",
+        reason: "Format Python source files.",
+        mutating: true
+      }),
+      test: async (ctx) => processPlan(
+        ctx,
+        "test",
+        "pytest",
+        [...ctx.options.filter ? ["-k", ctx.options.filter] : [], "."],
+        {
+          parser: "pytest",
+          reason: ctx.options.filter ? "Run filtered Python tests." : "Run all Python tests.",
+          mutating: true,
+          executesProjectCode: true
+        }
+      ),
+      build: async (ctx) => unavailable(ctx, "build", "Python is interpreted; use semantic or test instead."),
+      "debug-compile": async (ctx) => processPlan(ctx, "debug-compile", "mypy", [".", "--no-error-summary"], {
+        parser: "mypy",
+        reason: "Collect mypy type diagnostics.",
+        executesProjectCode: true
+      }),
+      "package-install": async (ctx) => processPlan(ctx, "package-install", "pip", ["install", "--no-cache-dir"], {
+        parser: "package-text",
+        reason: "Install dependencies from requirements.",
+        mutating: true,
+        network: true
+      }),
+      "package-add": async (ctx) => {
+        const names = packageNames(ctx);
+        return names.length === 0 ? unavailable(ctx, "package-add", "At least one package name is required.") : processPlan(ctx, "package-add", "pip", ["install", ...names], {
+          parser: "package-text",
+          reason: "Install specified Python packages.",
+          mutating: true,
+          network: true
+        });
+      },
+      "package-audit": async (ctx) => processPlan(ctx, "package-audit", "pip", ["audit"], {
+        parser: "pip-audit",
+        reason: "Audit Python dependencies for vulnerabilities.",
+        network: true
+      }),
+      run: async (ctx) => {
+        const entries = ["main.py", "app.py", "__main__.py", "manage.py"];
+        const first = (await Promise.all(
+          entries.map((name) => ctx.pathExists(name).then((ok) => ok ? name : void 0))
+        )).find(Boolean);
+        const args = first ? [first] : [];
+        return processPlan(ctx, "run", "python3", args, {
+          parser: "command-text",
+          reason: first ? `Run the Python entry point ${first}.` : "Run the Python project (no common entry point detected \u2014 add the module path manually).",
+          executesProjectCode: true,
+          mutating: true
+        });
+      }
+    })
+  };
+}
+function hasGradleEvidence(ctx) {
+  return ctx.workspace.evidence.some(
+    (e) => e.kind === "manifest" && (e.value === "build.gradle" || e.value === "build.gradle.kts" || e.value === "settings.gradle") || e.kind === "lockfile" && e.value === "gradle.lockfile"
+  );
+}
+async function gradleRunner(ctx) {
+  if (await ctx.pathExists("gradlew")) return "gradlew";
+  return "gradle";
+}
+function javaProfile() {
+  return {
+    id: "java",
+    displayName: "Java / Kotlin",
+    extensions: Object.freeze([".java", ".kt", ".kts", ".scala"]),
+    lspLanguageIds: Object.freeze(["java", "kotlin"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "pom.xml", weight: 90 },
+      { kind: "manifest", filename: "build.gradle", weight: 85 },
+      { kind: "manifest", filename: "build.gradle.kts", weight: 85 },
+      { kind: "manifest", filename: "settings.gradle", weight: 50 },
+      { kind: "lockfile", filename: "gradle.lockfile", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["maven", "gradle"]),
+    executables: Object.freeze(["mvn", "gradle", "gradlew", "java", "kotlinc"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => {
+        const isGradle = hasGradleEvidence(ctx);
+        const runner = isGradle ? await gradleRunner(ctx) : "mvn";
+        const args = isGradle ? ["compileJava"] : ["compile", "-q"];
+        const reason = isGradle ? "Compile the Gradle project." : "Compile the Maven project.";
+        return processPlan(ctx, "semantic", runner, args, {
+          parser: isGradle ? "gradle" : "maven",
+          reason,
+          mutating: true,
+          executesProjectCode: true
+        });
+      },
+      lint: async (ctx) => unavailable(
+        ctx,
+        "lint",
+        "Java linting requires a configured checkstyle or spotbugs plugin."
+      ),
+      "format-check": async (ctx) => unavailable(
+        ctx,
+        "format-check",
+        "Java formatting check requires a configured spotless or google-java-format plugin."
+      ),
+      test: async (ctx) => {
+        const isGradle = hasGradleEvidence(ctx);
+        const runner = isGradle ? await gradleRunner(ctx) : "mvn";
+        const args = isGradle ? ["test"] : ["test", "-q"];
+        const reason = isGradle ? "Run Gradle tests." : "Run Maven tests.";
+        return processPlan(ctx, "test", runner, args, {
+          parser: isGradle ? "gradle" : "maven",
+          reason,
+          mutating: true,
+          executesProjectCode: true
+        });
+      },
+      build: async (ctx) => {
+        const isGradle = hasGradleEvidence(ctx);
+        const runner = isGradle ? await gradleRunner(ctx) : "mvn";
+        const args = isGradle ? ["build"] : ["package", "-q", "-DskipTests"];
+        const reason = isGradle ? "Build the Gradle project." : "Build the Maven project, skipping tests.";
+        return processPlan(ctx, "build", runner, args, {
+          parser: isGradle ? "gradle" : "maven",
+          reason,
+          mutating: true,
+          executesProjectCode: true
+        });
+      },
+      run: async (ctx) => {
+        if (!hasGradleEvidence(ctx))
+          return unavailable(
+            ctx,
+            "run",
+            "Maven run requires exec-maven-plugin configuration. Use `mvn exec:java -q` manually."
+          );
+        const runner = await gradleRunner(ctx);
+        return processPlan(ctx, "run", runner, ["run"], {
+          parser: "command-text",
+          reason: `Run the Gradle project entry point via ${runner}.`,
+          executesProjectCode: true,
+          mutating: true
+        });
+      },
+      "package-install": async (ctx) => unavailable(
+        ctx,
+        "package-install",
+        "JVM dependency installation happens through build or dependency:get."
+      ),
+      "package-add": async (ctx) => {
+        const names = packageNames(ctx);
+        return names.length === 0 ? unavailable(ctx, "package-add", "At least one dependency coordinate is required.") : processPlan(ctx, "package-add", "mvn", ["dependency:get", `-Dartifact=${names[0]}`], {
+          parser: "maven",
+          reason: "Resolve and fetch a Maven dependency.",
+          mutating: true,
+          network: true
+        });
+      }
+    })
+  };
+}
+function rubyProfile() {
+  return {
+    id: "ruby",
+    displayName: "Ruby",
+    extensions: Object.freeze([".rb"]),
+    lspLanguageIds: Object.freeze(["ruby"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "Gemfile", weight: 90 },
+      { kind: "config", filename: ".ruby-version", weight: 40 },
+      { kind: "lockfile", filename: "Gemfile.lock", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["gem", "bundler"]),
+    executables: Object.freeze(["ruby", "gem", "bundle", "rubocop", "rspec"]),
+    operations: Object.freeze({
+      syntax: async (ctx) => ctx.options.target ? processPlan(ctx, "syntax", "ruby", ["-c", ctx.options.target], {
+        parser: "ruby",
+        reason: "Check the target Ruby file for syntax errors."
+      }) : unavailable(ctx, "syntax", "Ruby syntax check requires an explicit target file."),
+      lint: async (ctx) => processPlan(ctx, "lint", "rubocop", ["--format=json"], {
+        parser: "rubocop",
+        reason: "Run RuboCop linter.",
+        executesProjectCode: true
+      }),
+      "format-write": async (ctx) => processPlan(ctx, "format-write", "rubocop", ["--auto-correct"], {
+        parser: "rubocop",
+        reason: "Auto-correct RuboCop violations.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      test: async (ctx) => processPlan(ctx, "test", "rspec", [], {
+        parser: "rspec",
+        reason: "Run the RSpec test suite.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      "package-install": async (ctx) => processPlan(ctx, "package-install", "bundle", ["install"], {
+        parser: "package-text",
+        reason: "Install Ruby gem dependencies.",
+        mutating: true,
+        network: true,
+        executesProjectCode: true
+      }),
+      "package-add": async (ctx) => {
+        const names = packageNames(ctx);
+        return names.length === 0 ? unavailable(ctx, "package-add", "At least one gem name is required.") : processPlan(ctx, "package-add", "gem", ["install", ...names], {
+          parser: "package-text",
+          reason: "Install specified Ruby gems.",
+          mutating: true,
+          network: true
+        });
+      },
+      "package-audit": async (ctx) => processPlan(ctx, "package-audit", "bundle", ["audit", "--format=json"], {
+        parser: "bundler-audit",
+        reason: "Audit Ruby gems for vulnerabilities.",
+        network: true
+      }),
+      run: async (ctx) => {
+        const entries = ["main.rb", "app.rb", "server.rb", "config.ru"];
+        const first = (await Promise.all(
+          entries.map((name) => ctx.pathExists(name).then((ok) => ok ? name : void 0))
+        )).find(Boolean);
+        const hasGemfile = await ctx.pathExists("Gemfile");
+        const cmd = hasGemfile ? "bundle" : "ruby";
+        const args = hasGemfile ? ["exec", "ruby", first ?? ""] : [first ?? ""];
+        return processPlan(ctx, "run", cmd, args, {
+          parser: "command-text",
+          reason: first ? `Run the Ruby entry point ${first}.` : "Run the Ruby project (no common entry point detected \u2014 add the file path manually).",
+          executesProjectCode: true,
+          mutating: true
+        });
+      }
+    })
+  };
+}
+function cProfile() {
+  return {
+    id: "c",
+    displayName: "C / C++",
+    extensions: Object.freeze([".c", ".h"]),
+    lspLanguageIds: Object.freeze(["c"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "CMakeLists.txt", weight: 85 },
+      { kind: "manifest", filename: "Makefile", weight: 60 },
+      { kind: "config", suffix: ".cmake", weight: 50 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze([]),
+    executables: Object.freeze(["cc", "gcc", "clang", "cmake", "make"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => processPlan(ctx, "semantic", "cmake", ["--build", ".", "--target", "all"], {
+        parser: "cmake",
+        reason: "Build C project to collect compiler diagnostics.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      test: async (ctx) => unavailable(
+        ctx,
+        "test",
+        "C test execution requires a configured test runner (ctest, etc.)."
+      ),
+      build: async (ctx) => processPlan(ctx, "build", "cmake", ["--build", "."], {
+        parser: "cmake",
+        reason: "Build the C project.",
+        mutating: true,
+        executesProjectCode: true
+      })
+    })
+  };
+}
+function cppProfile() {
+  return {
+    ...cProfile(),
+    id: "cpp",
+    displayName: "C++",
+    extensions: Object.freeze([".cpp", ".cc", ".cxx", ".hpp", ".hxx"]),
+    lspLanguageIds: Object.freeze(["cpp"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "CMakeLists.txt", weight: 85 },
+      { kind: "manifest", filename: "Makefile", weight: 50 }
+    ]),
+    executables: Object.freeze(["c++", "g++", "clang++", "cmake", "make"])
+  };
+}
+function swiftProfile() {
+  return {
+    id: "swift",
+    displayName: "Swift",
+    extensions: Object.freeze([".swift"]),
+    lspLanguageIds: Object.freeze(["swift"]),
+    detectors: Object.freeze([{ kind: "manifest", filename: "Package.swift", weight: 90 }]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["swift"]),
+    executables: Object.freeze(["swift", "swiftc"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => processPlan(ctx, "semantic", "swift", ["build"], {
+        parser: "swift",
+        reason: "Build Swift package to collect compiler diagnostics.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      test: async (ctx) => processPlan(ctx, "test", "swift", ["test"], {
+        parser: "swift-test",
+        reason: "Run Swift tests.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      build: async (ctx) => processPlan(ctx, "build", "swift", ["build", "-c", "release"], {
+        parser: "swift",
+        reason: "Build the Swift package in release mode.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      run: async (ctx) => processPlan(ctx, "run", "swift", ["run"], {
+        parser: "command-text",
+        reason: "Run the Swift package entry point.",
+        executesProjectCode: true
+      })
+    })
+  };
+}
+function dartProfile() {
+  return {
+    id: "dart",
+    displayName: "Dart / Flutter",
+    extensions: Object.freeze([".dart"]),
+    lspLanguageIds: Object.freeze(["dart"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "pubspec.yaml", weight: 90 },
+      { kind: "lockfile", filename: "pubspec.lock", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["pub"]),
+    executables: Object.freeze(["dart", "flutter"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => processPlan(ctx, "semantic", "dart", ["analyze"], {
+        parser: "dart-analyze",
+        reason: "Run Dart static analysis."
+      }),
+      "format-check": async (ctx) => processPlan(
+        ctx,
+        "format-check",
+        "dart",
+        ["format", "--output=none", "--set-exit-if-changed", "."],
+        {
+          parser: "dart-format",
+          reason: "Check Dart formatting without writing files."
+        }
+      ),
+      "format-write": async (ctx) => processPlan(ctx, "format-write", "dart", ["format", "."], {
+        parser: "dart-format",
+        reason: "Format Dart source files.",
+        mutating: true
+      }),
+      test: async (ctx) => processPlan(ctx, "test", "dart", ["test"], {
+        parser: "dart-test",
+        reason: "Run Dart tests.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      "package-install": async (ctx) => processPlan(ctx, "package-install", "dart", ["pub", "get"], {
+        parser: "package-text",
+        reason: "Fetch Dart package dependencies.",
+        mutating: true,
+        network: true
+      }),
+      "package-outdated": async (ctx) => processPlan(ctx, "package-outdated", "dart", ["pub", "outdated"], {
+        parser: "dart-outdated",
+        reason: "Check for outdated Dart packages.",
+        network: true
+      }),
+      run: async (ctx) => processPlan(ctx, "run", "dart", ["run"], {
+        parser: "command-text",
+        reason: "Run the Dart / Flutter project entry point.",
+        executesProjectCode: true
+      })
+    })
+  };
+}
+function denoProfile() {
+  return {
+    id: "deno",
+    displayName: "Deno",
+    extensions: Object.freeze([".ts", ".tsx", ".js", ".jsx"]),
+    lspLanguageIds: Object.freeze(["typescript", "javascript"]),
+    detectors: Object.freeze([
+      { kind: "config", filename: "deno.json", weight: 90 },
+      { kind: "config", filename: "deno.jsonc", weight: 90 },
+      { kind: "config", filename: "import_map.json", weight: 60 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze([]),
+    executables: Object.freeze(["deno"]),
+    // .ts/.js extensions are shared with the TypeScript/JavaScript profiles;
+    // only a deno.json(c)/import_map.json detector hit may establish a workspace.
+    sourceFallback: false,
+    operations: Object.freeze({
+      test: async (ctx) => processPlan(ctx, "test", "deno", ["test"], {
+        parser: "deno-test",
+        reason: "Run Deno tests.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      run: async (ctx) => processPlan(ctx, "run", "deno", ["run", "--allow-all", "main.ts"], {
+        parser: "command-text",
+        reason: "Run the Deno project entry point with full permission.",
+        executesProjectCode: true,
+        mutating: true
+      })
+    })
+  };
+}
+function elixirProfile() {
+  return {
+    id: "elixir",
+    displayName: "Elixir",
+    extensions: Object.freeze([".ex", ".exs"]),
+    lspLanguageIds: Object.freeze(["elixir"]),
+    detectors: Object.freeze([
+      { kind: "manifest", filename: "mix.exs", weight: 90 },
+      { kind: "lockfile", filename: "mix.lock", weight: 30 }
+    ]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze(["mix"]),
+    executables: Object.freeze(["mix", "elixir"]),
+    operations: Object.freeze({
+      semantic: async (ctx) => unavailable(ctx, "semantic", "Elixir compilation is handled by the build operation."),
+      lint: async (ctx) => unavailable(ctx, "lint", "Elixir linting requires the credo package."),
+      test: async (ctx) => processPlan(ctx, "test", "mix", ["test"], {
+        parser: "mix-test",
+        reason: "Run ExUnit tests.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      build: async (ctx) => processPlan(ctx, "build", "mix", ["compile"], {
+        parser: "mix",
+        reason: "Compile the Mix project.",
+        mutating: true,
+        executesProjectCode: true
+      }),
+      run: async (ctx) => processPlan(ctx, "run", "mix", ["run"], {
+        parser: "command-text",
+        reason: "Run the Mix project entry point.",
+        executesProjectCode: true
+      }),
+      "package-install": async (ctx) => processPlan(ctx, "package-install", "mix", ["deps.get"], {
+        parser: "package-text",
+        reason: "Fetch Elixir dependencies.",
+        mutating: true,
+        network: true
+      })
+    })
+  };
+}
+function shellProfile() {
+  return {
+    id: "shell",
+    displayName: "Shell",
+    extensions: Object.freeze([".sh", ".bash"]),
+    lspLanguageIds: Object.freeze(["shellscript"]),
+    detectors: Object.freeze([{ kind: "config", filename: "ShellCheckrc", weight: 50 }]),
+    ignoredDirectories: IGNORES,
+    packageManagers: Object.freeze([]),
+    executables: Object.freeze(["bash", "sh", "shellcheck", "shfmt"]),
+    operations: Object.freeze({
+      syntax: async (ctx) => ctx.options.target ? processPlan(ctx, "syntax", "bash", ["-n", ctx.options.target], {
+        parser: "shell",
+        reason: "Check the shell script for syntax errors."
+      }) : unavailable(ctx, "syntax", "Shell syntax check requires an explicit target file."),
+      lint: async (ctx) => ctx.options.target ? processPlan(ctx, "lint", "shellcheck", ["--format=json", ctx.options.target], {
+        parser: "shellcheck",
+        reason: "Run ShellCheck on the target script."
+      }) : unavailable(ctx, "lint", "Shell linting requires an explicit target file."),
+      "format-check": async (ctx) => ctx.options.target ? processPlan(ctx, "format-check", "shfmt", ["-d", ctx.options.target], {
+        parser: "shell",
+        reason: "Check shell formatting without writing."
+      }) : unavailable(
+        ctx,
+        "format-check",
+        "Shell formatting check requires an explicit target file."
+      ),
+      "format-write": async (ctx) => ctx.options.target ? processPlan(ctx, "format-write", "shfmt", ["-w", ctx.options.target], {
+        parser: "shell",
+        reason: "Format the shell script.",
+        mutating: true
+      }) : unavailable(ctx, "format-write", "Shell formatting requires an explicit target file.")
+    })
+  };
+}
+var IGNORES, ADDITIONAL_LANGUAGE_PROFILES;
+var init_additional = __esm({
+  "src/languages/profiles/additional.ts"() {
+    "use strict";
+    init_profile_helpers();
+    IGNORES = Object.freeze([
+      ".git",
+      ".wrongstack",
+      "node_modules",
+      "vendor",
+      "dist",
+      "build",
+      "coverage"
+    ]);
+    ADDITIONAL_LANGUAGE_PROFILES = Object.freeze([
+      pythonProfile(),
+      javaProfile(),
+      rubyProfile(),
+      cProfile(),
+      cppProfile(),
+      swiftProfile(),
+      dartProfile(),
+      denoProfile(),
+      elixirProfile(),
+      shellProfile()
+    ]);
+  }
+});
+
+// src/languages/profiles/primary.ts
+function nodeManager(ctx) {
+  const lockfiles = new Set(
+    ctx.workspace.evidence.filter((evidence) => evidence.kind === "lockfile").map((evidence) => evidence.value.toLowerCase())
+  );
+  if (lockfiles.size > 1 && !ctx.workspace.packageManager) return void 0;
+  return ctx.workspace.packageManager ?? "npm";
+}
+function scriptPlan(ctx, operation, script) {
+  const manager = nodeManager(ctx);
+  if (!manager)
+    return unavailable(
+      ctx,
+      operation,
+      "Conflicting Node lockfiles make the package manager ambiguous."
+    );
+  const args = manager === "npm" ? ["run", script] : [script];
+  return processPlan(ctx, operation, manager, args, {
+    parser: "command-text",
+    reason: `Run the detected ${manager} ${script} script for this workspace.`,
+    mutating: true,
+    executesProjectCode: true
+  });
+}
+function nodeExec(ctx, executable, args) {
+  const manager = ctx.workspace.packageManager ?? "npm";
+  if (manager === "pnpm") return { command: "pnpm", args: ["exec", executable, ...args] };
+  if (manager === "yarn") return { command: "yarn", args: ["exec", executable, ...args] };
+  if (manager === "bun") return { command: "bun", args: ["x", executable, ...args] };
+  return { command: "npx", args: ["--no-install", executable, ...args] };
+}
+function typescriptProfile() {
+  return {
+    id: "typescript",
+    displayName: "TypeScript",
+    extensions: Object.freeze([".ts", ".tsx", ".mts", ".cts"]),
+    lspLanguageIds: Object.freeze(["typescript", "typescriptreact"]),
+    detectors: Object.freeze([
+      { kind: "config", filename: "tsconfig.json", weight: 90 },
+      { kind: "manifest", filename: "package.json", weight: 55 },
+      { kind: "lockfile", filename: "pnpm-lock.yaml", weight: 30 },
+      { kind: "lockfile", filename: "yarn.lock", weight: 30 },
+      { kind: "lockfile", filename: "package-lock.json", weight: 30 },
+      { kind: "lockfile", filename: "bun.lock", weight: 30 },
+      { kind: "lockfile", filename: "bun.lockb", weight: 30 }
+    ]),
+    ignoredDirectories: COMMON_IGNORES,
+    packageManagers: Object.freeze(["pnpm", "yarn", "bun", "npm"]),
+    executables: Object.freeze(["pnpm", "yarn", "bun", "npx", "npm"]),
+    operations: Object.freeze({
+      syntax: async (ctx) => internalPlan(
+        ctx,
+        "syntax",
+        "typescript-parser",
+        "Parse the target with the TypeScript compiler API."
+      ),
+      semantic: async (ctx) => {
+        const run = nodeExec(ctx, "tsc", ["--noEmit", "--pretty", "false"]);
+        return processPlan(ctx, "semantic", run.command, run.args, {
+          parser: "typescript",
+          reason: "Run the workspace TypeScript compiler without emitting files.",
+          executesProjectCode: true
+        });
+      },
+      lint: async (ctx) => {
+        const run = nodeExec(ctx, "biome", ["lint", "."]);
+        return processPlan(ctx, "lint", run.command, run.args, {
+          parser: "biome",
+          reason: "Run the project-local Biome linter.",
+          executesProjectCode: true
+        });
+      },
+      "format-check": async (ctx) => {
+        const run = nodeExec(ctx, "biome", ["format", "--check", "."]);
+        return processPlan(ctx, "format-check", run.command, run.args, {
+          parser: "biome",
+          reason: "Check formatting with the project-local Biome formatter.",
+          executesProjectCode: true
+        });
+      },
+      "format-write": async (ctx) => {
+        const run = nodeExec(ctx, "biome", ["format", "--write", "."]);
+        return processPlan(ctx, "format-write", run.command, run.args, {
+          parser: "biome",
+          reason: "Format the workspace with the project-local Biome formatter.",
+          mutating: true,
+          executesProjectCode: true
+        });
+      },
+      test: async (ctx) => ctx.options.filter || ctx.options.coverage ? unavailable(
+        ctx,
+        "test",
+        "The detected package script does not expose deterministic filter or coverage adapters."
+      ) : scriptPlan(ctx, "test", "test"),
+      build: async (ctx) => scriptPlan(ctx, "build", "build"),
+      run: async (ctx) => scriptPlan(ctx, "run", "dev"),
+      "debug-compile": async (ctx) => {
+        const run = nodeExec(ctx, "tsc", ["--noEmit", "--pretty", "false"]);
+        return processPlan(ctx, "debug-compile", run.command, run.args, {
+          parser: "typescript",
+          reason: "Collect deterministic TypeScript compiler diagnostics.",
+          executesProjectCode: true
+        });
+      },
+      "package-install": async (ctx) => {
+        const manager = ctx.workspace.packageManager ?? "npm";
+        const args = manager === "yarn" ? ["install", "--ignore-scripts"] : ["install", "--ignore-scripts"];
+        return processPlan(ctx, "package-install", manager, args, {
+          parser: "package-text",
+          reason: `Restore declared dependencies with ${manager} and lifecycle scripts disabled.`,
+          mutating: true,
+          network: true,
+          executesProjectCode: false
+        });
+      },
+      "package-add": async (ctx) => {
+        const names = packageNames(ctx);
+        if (names.length === 0)
+          return unavailable(ctx, "package-add", "At least one package name is required.");
+        const manager = ctx.workspace.packageManager ?? "npm";
+        const args = manager === "npm" ? ["install", "--ignore-scripts", ...names] : ["add", "--ignore-scripts", ...names];
+        return processPlan(ctx, "package-add", manager, args, {
+          parser: "package-text",
+          reason: `Add validated packages with ${manager} and lifecycle scripts disabled.`,
+          mutating: true,
+          network: true
+        });
+      },
+      "package-audit": async (ctx) => {
+        const manager = ctx.workspace.packageManager ?? "npm";
+        return processPlan(ctx, "package-audit", manager, ["audit", "--json"], {
+          parser: "npm-audit",
+          reason: `Audit dependencies with the detected ${manager} package manager.`,
+          network: true
+        });
+      },
+      "package-outdated": async (ctx) => {
+        const manager = ctx.workspace.packageManager ?? "npm";
+        return processPlan(ctx, "package-outdated", manager, ["outdated", "--json"], {
+          parser: "npm-outdated",
+          reason: `Check outdated dependencies with ${manager}.`,
+          network: true
+        });
+      }
+    })
+  };
+}
+function javascriptProfile() {
+  const ts = typescriptProfile();
+  return {
+    ...ts,
+    id: "javascript",
+    displayName: "JavaScript",
+    extensions: Object.freeze([".js", ".jsx", ".mjs", ".cjs"]),
+    lspLanguageIds: Object.freeze(["javascript", "javascriptreact"]),
+    detectors: Object.freeze([
+      { kind: "config", filename: "jsconfig.json", weight: 90 },
+      { kind: "manifest", filename: "package.json", weight: 70 },
+      { kind: "lockfile", filename: "pnpm-lock.yaml", weight: 30 },
+      { kind: "lockfile", filename: "yarn.lock", weight: 30 },
+      { kind: "lockfile", filename: "package-lock.json", weight: 30 },
+      { kind: "lockfile", filename: "bun.lock", weight: 30 },
+      { kind: "lockfile", filename: "bun.lockb", weight: 30 }
+    ]),
+    operations: Object.freeze({
+      ...ts.operations,
+      syntax: async (ctx) => internalPlan(
+        ctx,
+        "syntax",
+        "typescript-parser",
+        "Parse JavaScript with the TypeScript compiler API."
+      )
+    })
+  };
+}
+var COMMON_IGNORES, goProfile, rustProfile, phpProfile, csharpProfile, PRIMARY_LANGUAGE_PROFILES;
+var init_primary = __esm({
+  "src/languages/profiles/primary.ts"() {
+    "use strict";
+    init_profile_helpers();
+    COMMON_IGNORES = Object.freeze([
+      ".git",
+      ".wrongstack",
+      "node_modules",
+      "vendor",
+      "target",
+      "bin",
+      "obj",
+      "dist",
+      "build",
+      "coverage"
+    ]);
+    goProfile = {
+      id: "go",
+      displayName: "Go",
+      extensions: Object.freeze([".go"]),
+      lspLanguageIds: Object.freeze(["go"]),
+      detectors: Object.freeze([
+        { kind: "manifest", filename: "go.mod", weight: 90 },
+        { kind: "manifest", filename: "go.work", weight: 95 },
+        { kind: "lockfile", filename: "go.sum", weight: 30 }
+      ]),
+      ignoredDirectories: COMMON_IGNORES,
+      packageManagers: Object.freeze(["go"]),
+      executables: Object.freeze(["go", "gofmt"]),
+      operations: Object.freeze({
+        syntax: async (ctx) => {
+          if (!ctx.target)
+            return unavailable(ctx, "syntax", "Go syntax planning requires a target file.");
+          return processPlan(ctx, "syntax", "gofmt", ["-e", "-d", ctx.target], {
+            parser: "gofmt",
+            reason: "Parse the target and report syntax errors without writing it."
+          });
+        },
+        semantic: async (ctx) => processPlan(ctx, "semantic", "go", ["test", "-run", "^$", "./..."], {
+          parser: "go-test",
+          reason: "Compile all Go packages without selecting tests.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        lint: async (ctx) => processPlan(ctx, "lint", "go", ["vet", "./..."], {
+          parser: "go-compiler",
+          reason: "Run the standard Go vet checks.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        "format-check": async (ctx) => ctx.target ? processPlan(ctx, "format-check", "gofmt", ["-d", ctx.target], {
+          parser: "gofmt",
+          reason: "Report Go formatting differences for the target without writing it."
+        }) : unavailable(ctx, "format-check", "Go formatting requires an explicit target file."),
+        "format-write": async (ctx) => ctx.target ? processPlan(ctx, "format-write", "gofmt", ["-w", ctx.target], {
+          parser: "gofmt",
+          reason: "Format the target Go source file.",
+          mutating: true
+        }) : unavailable(ctx, "format-write", "Go formatting requires an explicit target file."),
+        test: async (ctx) => processPlan(
+          ctx,
+          "test",
+          "go",
+          ["test", ...ctx.options.filter ? ["-run", ctx.options.filter] : [], "./..."],
+          {
+            parser: "go-test",
+            reason: ctx.options.filter ? "Run filtered Go tests." : "Run all Go tests.",
+            mutating: true,
+            executesProjectCode: true
+          }
+        ),
+        build: async (ctx) => processPlan(ctx, "build", "go", ["build", "./..."], {
+          parser: "go-compiler",
+          reason: "Build all Go packages.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        run: async (ctx) => processPlan(ctx, "run", "go", ["run", "."], {
+          parser: "command-text",
+          reason: "Run the Go module entry point.",
+          executesProjectCode: true
+        }),
+        "debug-race": async (ctx) => processPlan(ctx, "debug-race", "go", ["test", "-race", "./..."], {
+          parser: "go-test",
+          reason: "Collect Go race-detector evidence.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        "package-install": async (ctx) => processPlan(ctx, "package-install", "go", ["mod", "download"], {
+          parser: "go-module",
+          reason: "Download the dependencies declared by go.mod.",
+          mutating: true,
+          network: true
+        }),
+        "package-add": async (ctx) => {
+          const names = packageNames(ctx);
+          if (names.length === 0)
+            return unavailable(ctx, "package-add", "At least one Go module is required.");
+          return processPlan(ctx, "package-add", "go", ["get", ...names], {
+            parser: "go-module",
+            reason: "Add validated Go modules.",
+            mutating: true,
+            network: true
+          });
+        },
+        "package-update": async (ctx) => processPlan(ctx, "package-update", "go", ["get", "-u", "./..."], {
+          parser: "go-module",
+          reason: "Update dependencies of all Go packages.",
+          mutating: true,
+          network: true
+        })
+      })
+    };
+    rustProfile = {
+      id: "rust",
+      displayName: "Rust",
+      extensions: Object.freeze([".rs"]),
+      lspLanguageIds: Object.freeze(["rust"]),
+      detectors: Object.freeze([
+        { kind: "manifest", filename: "Cargo.toml", weight: 90 },
+        { kind: "lockfile", filename: "Cargo.lock", weight: 30 }
+      ]),
+      ignoredDirectories: COMMON_IGNORES,
+      packageManagers: Object.freeze(["cargo"]),
+      executables: Object.freeze(["cargo"]),
+      operations: Object.freeze({
+        syntax: async (ctx) => processPlan(ctx, "syntax", "cargo", ["check", "--message-format=json"], {
+          parser: "cargo-json",
+          reason: "Check Rust syntax and semantics with Cargo.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        semantic: async (ctx) => processPlan(ctx, "semantic", "cargo", ["check", "--message-format=json"], {
+          parser: "cargo-json",
+          reason: "Collect Rust compiler diagnostics with Cargo check.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        lint: async (ctx) => processPlan(ctx, "lint", "cargo", ["clippy", "--message-format=json"], {
+          parser: "cargo-json",
+          reason: "Run Clippy for this crate.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        "format-check": async (ctx) => processPlan(ctx, "format-check", "cargo", ["fmt", "--check"], {
+          parser: "cargo-fmt",
+          reason: "Check Rust formatting without writing files."
+        }),
+        "format-write": async (ctx) => processPlan(ctx, "format-write", "cargo", ["fmt"], {
+          parser: "cargo-fmt",
+          reason: "Format Rust source files in the workspace.",
+          mutating: true
+        }),
+        "test-compile": async (ctx) => processPlan(ctx, "test-compile", "cargo", ["test", "--no-run", "--message-format=json"], {
+          parser: "cargo-json",
+          reason: "Compile Rust tests without running them.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        test: async (ctx) => processPlan(
+          ctx,
+          "test",
+          "cargo",
+          ["test", ...ctx.options.filter ? [ctx.options.filter] : []],
+          {
+            parser: "cargo-test",
+            reason: ctx.options.filter ? "Run filtered Rust tests." : "Run Rust tests.",
+            mutating: true,
+            executesProjectCode: true
+          }
+        ),
+        build: async (ctx) => processPlan(ctx, "build", "cargo", ["build", "--message-format=json"], {
+          parser: "cargo-json",
+          reason: "Build the Rust workspace.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        run: async (ctx) => processPlan(ctx, "run", "cargo", ["run"], {
+          parser: "command-text",
+          reason: "Run the Rust workspace entry point.",
+          executesProjectCode: true
+        }),
+        "package-install": async (ctx) => processPlan(ctx, "package-install", "cargo", ["fetch", "--locked"], {
+          parser: "cargo-json",
+          reason: "Fetch locked Rust dependencies.",
+          mutating: true,
+          network: true
+        }),
+        "package-add": async (ctx) => {
+          const names = packageNames(ctx);
+          return names.length === 0 ? unavailable(ctx, "package-add", "At least one crate is required.") : processPlan(ctx, "package-add", "cargo", ["add", ...names], {
+            parser: "cargo-text",
+            reason: "Add validated Rust crates.",
+            mutating: true,
+            network: true
+          });
+        },
+        "package-remove": async (ctx) => {
+          const names = packageNames(ctx);
+          return names.length === 0 ? unavailable(ctx, "package-remove", "At least one crate is required.") : processPlan(ctx, "package-remove", "cargo", ["remove", ...names], {
+            parser: "cargo-text",
+            reason: "Remove validated Rust crates.",
+            mutating: true
+          });
+        },
+        "package-update": async (ctx) => processPlan(ctx, "package-update", "cargo", ["update"], {
+          parser: "cargo-text",
+          reason: "Update the Cargo lockfile.",
+          mutating: true,
+          network: true
+        }),
+        "package-audit": async (ctx) => processPlan(ctx, "package-audit", "cargo", ["audit", "--json"], {
+          parser: "cargo-audit",
+          reason: "Audit Rust dependencies when cargo-audit is installed.",
+          network: true
+        })
+      })
+    };
+    phpProfile = {
+      id: "php",
+      displayName: "PHP",
+      extensions: Object.freeze([".php"]),
+      lspLanguageIds: Object.freeze(["php"]),
+      detectors: Object.freeze([
+        { kind: "manifest", filename: "composer.json", weight: 90 },
+        { kind: "lockfile", filename: "composer.lock", weight: 30 },
+        { kind: "config", filename: "phpunit.xml", weight: 25 },
+        { kind: "config", filename: "phpunit.xml.dist", weight: 25 }
+      ]),
+      ignoredDirectories: COMMON_IGNORES,
+      packageManagers: Object.freeze(["composer"]),
+      executables: Object.freeze(["php", "composer"]),
+      operations: Object.freeze({
+        syntax: async (ctx) => ctx.target ? processPlan(ctx, "syntax", "php", ["-l", ctx.target], {
+          parser: "php-lint",
+          reason: "Lint the target PHP file without executing it."
+        }) : unavailable(ctx, "syntax", "PHP syntax planning requires a target file."),
+        semantic: async (ctx) => unavailable(
+          ctx,
+          "semantic",
+          "No configured PHPStan or Psalm adapter was detected in Phase 1."
+        ),
+        test: async (ctx) => processPlan(
+          ctx,
+          "test",
+          "php",
+          ["vendor/bin/phpunit", ...ctx.options.filter ? ["--filter", ctx.options.filter] : []],
+          {
+            parser: "phpunit",
+            reason: ctx.options.filter ? "Run filtered tests with the project-local PHPUnit runner." : "Run the project-local PHPUnit test runner.",
+            executesProjectCode: true
+          }
+        ),
+        "package-install": async (ctx) => processPlan(
+          ctx,
+          "package-install",
+          "composer",
+          ["install", "--no-interaction", "--no-scripts"],
+          {
+            parser: "composer",
+            reason: "Restore Composer dependencies without scripts.",
+            mutating: true,
+            network: true
+          }
+        ),
+        "package-add": async (ctx) => {
+          const names = packageNames(ctx);
+          return names.length === 0 ? unavailable(ctx, "package-add", "At least one Composer package is required.") : processPlan(
+            ctx,
+            "package-add",
+            "composer",
+            ["require", "--no-interaction", "--no-scripts", ...names],
+            {
+              parser: "composer",
+              reason: "Add validated Composer packages without scripts.",
+              mutating: true,
+              network: true
+            }
+          );
+        },
+        "package-remove": async (ctx) => {
+          const names = packageNames(ctx);
+          return names.length === 0 ? unavailable(ctx, "package-remove", "At least one Composer package is required.") : processPlan(
+            ctx,
+            "package-remove",
+            "composer",
+            ["remove", "--no-interaction", "--no-scripts", ...names],
+            {
+              parser: "composer",
+              reason: "Remove validated Composer packages without scripts.",
+              mutating: true
+            }
+          );
+        },
+        "package-update": async (ctx) => processPlan(
+          ctx,
+          "package-update",
+          "composer",
+          ["update", "--no-interaction", "--no-scripts"],
+          {
+            parser: "composer",
+            reason: "Update Composer dependencies without scripts.",
+            mutating: true,
+            network: true
+          }
+        ),
+        "package-audit": async (ctx) => processPlan(ctx, "package-audit", "composer", ["audit", "--format=json"], {
+          parser: "composer-audit",
+          reason: "Audit Composer dependencies.",
+          network: true
+        }),
+        "package-outdated": async (ctx) => processPlan(ctx, "package-outdated", "composer", ["outdated", "--format=json"], {
+          parser: "composer-outdated",
+          reason: "Check outdated Composer dependencies.",
+          network: true
+        })
+      })
+    };
+    csharpProfile = {
+      id: "csharp",
+      displayName: "C# / .NET",
+      extensions: Object.freeze([".cs"]),
+      lspLanguageIds: Object.freeze(["csharp"]),
+      detectors: Object.freeze([
+        { kind: "config", filename: "global.json", weight: 25 },
+        { kind: "manifest", suffix: ".slnx", weight: 95 },
+        { kind: "manifest", suffix: ".sln", weight: 95 },
+        { kind: "manifest", suffix: ".csproj", weight: 90 },
+        { kind: "manifest", suffix: ".fsproj", weight: 90 },
+        { kind: "lockfile", filename: "packages.lock.json", weight: 30 }
+      ]),
+      ignoredDirectories: COMMON_IGNORES,
+      packageManagers: Object.freeze(["dotnet"]),
+      executables: Object.freeze(["dotnet"]),
+      operations: Object.freeze({
+        syntax: async (ctx) => processPlan(ctx, "syntax", "dotnet", ["build", "--no-restore"], {
+          parser: "dotnet-build",
+          reason: "Use the nearest project or solution to collect C# syntax diagnostics.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        semantic: async (ctx) => processPlan(ctx, "semantic", "dotnet", ["build", "--no-restore"], {
+          parser: "dotnet-build",
+          reason: "Build without restoring to collect .NET compiler diagnostics.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        lint: async (ctx) => processPlan(ctx, "lint", "dotnet", ["format", "--verify-no-changes", "--no-restore"], {
+          parser: "dotnet-format",
+          reason: "Verify .NET formatting and analyzers without writing source files.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        "format-check": async (ctx) => processPlan(
+          ctx,
+          "format-check",
+          "dotnet",
+          ["format", "--verify-no-changes", "--no-restore"],
+          {
+            parser: "dotnet-format",
+            reason: "Verify .NET formatting without source writes.",
+            mutating: true,
+            executesProjectCode: true
+          }
+        ),
+        "format-write": async (ctx) => processPlan(ctx, "format-write", "dotnet", ["format", "--no-restore"], {
+          parser: "dotnet-format",
+          reason: "Format .NET source files without restoring packages.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        test: async (ctx) => processPlan(
+          ctx,
+          "test",
+          "dotnet",
+          ["test", "--no-restore", ...ctx.options.filter ? ["--filter", ctx.options.filter] : []],
+          {
+            parser: "dotnet-test",
+            reason: ctx.options.filter ? "Run filtered .NET tests without restoring packages." : "Run .NET tests without restoring packages.",
+            mutating: true,
+            executesProjectCode: true
+          }
+        ),
+        build: async (ctx) => processPlan(ctx, "build", "dotnet", ["build", "--no-restore"], {
+          parser: "dotnet-build",
+          reason: "Build the nearest .NET project or solution without restoring packages.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        run: async (ctx) => processPlan(ctx, "run", "dotnet", ["run", "--no-restore"], {
+          parser: "command-text",
+          reason: "Run the .NET project entry point.",
+          mutating: true,
+          executesProjectCode: true
+        }),
+        "package-install": async (ctx) => processPlan(ctx, "package-install", "dotnet", ["restore", "--locked-mode"], {
+          parser: "dotnet-restore",
+          reason: "Restore locked .NET dependencies.",
+          mutating: true,
+          network: true,
+          executesProjectCode: true
+        }),
+        "package-add": async (ctx) => {
+          const names = packageNames(ctx);
+          return names.length === 0 ? unavailable(ctx, "package-add", "At least one NuGet package is required.") : processPlan(ctx, "package-add", "dotnet", ["add", "package", ...names], {
+            parser: "dotnet-package",
+            reason: "Add validated NuGet packages.",
+            mutating: true,
+            network: true,
+            executesProjectCode: true
+          });
+        },
+        "package-remove": async (ctx) => {
+          const names = packageNames(ctx);
+          return names.length === 0 ? unavailable(ctx, "package-remove", "At least one NuGet package is required.") : processPlan(ctx, "package-remove", "dotnet", ["remove", "package", ...names], {
+            parser: "dotnet-package",
+            reason: "Remove validated NuGet packages.",
+            mutating: true
+          });
+        },
+        "package-audit": async (ctx) => processPlan(
+          ctx,
+          "package-audit",
+          "dotnet",
+          ["list", "package", "--vulnerable", "--format", "json"],
+          { parser: "dotnet-package", reason: "List vulnerable NuGet dependencies.", network: true }
+        ),
+        "package-outdated": async (ctx) => processPlan(
+          ctx,
+          "package-outdated",
+          "dotnet",
+          ["list", "package", "--outdated", "--format", "json"],
+          { parser: "dotnet-package", reason: "List outdated NuGet dependencies.", network: true }
+        )
+      })
+    };
+    PRIMARY_LANGUAGE_PROFILES = Object.freeze([
+      Object.freeze(typescriptProfile()),
+      Object.freeze(javascriptProfile()),
+      Object.freeze(goProfile),
+      Object.freeze(rustProfile),
+      Object.freeze(phpProfile),
+      Object.freeze(csharpProfile)
+    ]);
+  }
+});
+
+// src/languages/registry.ts
+function validateLanguageProfile(profile) {
+  const errors = [];
+  if (!PROFILE_ID_RE.test(profile.id)) errors.push("id must be a lowercase stable identifier");
+  if (!profile.displayName.trim()) errors.push("displayName is required");
+  if (profile.extensions.length === 0) errors.push("at least one extension is required");
+  for (const ext of profile.extensions) {
+    if (!/^\.[a-z0-9+.-]+$/i.test(ext)) errors.push(`invalid extension "${ext}"`);
+  }
+  if (profile.detectors.length === 0) errors.push("at least one detector is required");
+  for (const detector of profile.detectors) {
+    if ((detector.filename ? 1 : 0) + (detector.suffix ? 1 : 0) !== 1) {
+      errors.push("each detector must declare exactly one of filename or suffix");
+    }
+    if (!Number.isFinite(detector.weight) || detector.weight <= 0 || detector.weight > 100) {
+      errors.push("detector weights must be in the range 1..100");
+    }
+    const marker = detector.filename ?? detector.suffix ?? "";
+    if (marker.includes("/") || marker.includes("\\") || marker.includes("\0")) {
+      errors.push(`detector marker "${marker}" must be a basename or suffix`);
+    }
+  }
+  if (profile.executables.length === 0) errors.push("at least one executable is required");
+  for (const executable of profile.executables) {
+    if (!EXECUTABLE_RE.test(executable)) errors.push(`invalid executable token "${executable}"`);
+  }
+  for (const operation of Object.keys(profile.operations)) {
+    if (!KNOWN_OPERATIONS.has(operation)) {
+      errors.push(`unknown operation "${operation}"`);
+    }
+    if (typeof profile.operations[operation] !== "function") {
+      errors.push(`operation "${operation}" must be a resolver function`);
+    }
+  }
+  return [...new Set(errors)];
+}
+function freezeProfile(profile) {
+  const detectors = Object.freeze(profile.detectors.map((item) => Object.freeze({ ...item })));
+  const operations = Object.freeze({ ...profile.operations });
+  return Object.freeze({
+    ...profile,
+    extensions: Object.freeze([...profile.extensions]),
+    lspLanguageIds: Object.freeze([...profile.lspLanguageIds]),
+    detectors,
+    ignoredDirectories: Object.freeze([...profile.ignoredDirectories]),
+    packageManagers: Object.freeze([...profile.packageManagers]),
+    executables: Object.freeze([...profile.executables]),
+    operations
+  });
+}
+var PROFILE_ID_RE, EXECUTABLE_RE, KNOWN_OPERATIONS, LanguageProfileRegistry, languageProfileRegistry;
+var init_registry = __esm({
+  "src/languages/registry.ts"() {
+    "use strict";
+    init_additional();
+    init_primary();
+    PROFILE_ID_RE = /^[a-z][a-z0-9-]{0,63}$/;
+    EXECUTABLE_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
+    KNOWN_OPERATIONS = /* @__PURE__ */ new Set([
+      "syntax",
+      "semantic",
+      "lint",
+      "format-check",
+      "format-write",
+      "test-compile",
+      "test",
+      "build",
+      "run",
+      "debug-compile",
+      "debug-test",
+      "debug-runtime",
+      "debug-race",
+      "package-install",
+      "package-add",
+      "package-remove",
+      "package-update",
+      "package-audit",
+      "package-outdated"
+    ]);
+    LanguageProfileRegistry = class {
+      #profiles = /* @__PURE__ */ new Map();
+      constructor(profiles = []) {
+        for (const profile of profiles) this.register(profile);
+      }
+      register(profile) {
+        const errors = validateLanguageProfile(profile);
+        if (errors.length > 0) {
+          throw new Error(`Invalid language profile "${profile.id}": ${errors.join("; ")}`);
+        }
+        if (this.#profiles.has(profile.id)) {
+          throw new Error(`Language profile "${profile.id}" is already registered`);
+        }
+        this.#profiles.set(profile.id, freezeProfile(profile));
+      }
+      get(id) {
+        return this.#profiles.get(id);
+      }
+      list() {
+        return Object.freeze([...this.#profiles.values()]);
+      }
+    };
+    languageProfileRegistry = new LanguageProfileRegistry([
+      ...PRIMARY_LANGUAGE_PROFILES,
+      ...ADDITIONAL_LANGUAGE_PROFILES
+    ]);
+  }
+});
+
+// src/languages/detect.ts
+import { createHash } from "node:crypto";
+import * as fs2 from "node:fs/promises";
+import * as path3 from "node:path";
+async function detectLanguageWorkspaces(options) {
+  const projectRoot = await canonicalDirectory(options.projectRoot);
+  const cwdInput = options.cwd ? path3.isAbsolute(options.cwd) ? options.cwd : path3.resolve(projectRoot, options.cwd) : projectRoot;
+  const cwd = await canonicalInside(cwdInput, projectRoot, "cwd");
+  const target = options.target ? await canonicalInside(resolveFrom(cwd, options.target), projectRoot, "target") : void 0;
+  const profiles = (options.profiles ?? languageProfileRegistry.list()).filter((profile) => !options.language || profile.id === options.language).slice().sort((a, b) => a.id.localeCompare(b.id));
+  const limits = normalizeLimits(options.limits);
+  const state = {
+    entries: 0,
+    truncated: false,
+    sourcePaths: /* @__PURE__ */ new Map(),
+    candidates: /* @__PURE__ */ new Map()
+  };
+  await scanDirectory(projectRoot, 0, profiles, limits, state, options.signal);
+  addSourceFallbacks(projectRoot, profiles, state);
+  if (target) addTargetEvidence(target, projectRoot, profiles, state);
+  const workspaces = await Promise.all(
+    [...state.candidates.values()].map((candidate) => finalizeCandidate(candidate, projectRoot))
+  );
+  workspaces.sort(compareWorkspaces);
+  return {
+    projectRoot,
+    scannedEntries: state.entries,
+    truncated: state.truncated,
+    workspaces
+  };
+}
+async function scanDirectory(directory, depth, profiles, limits, state, signal) {
+  signal?.throwIfAborted();
+  if (depth > limits.maxDepth || state.entries >= limits.maxEntries) {
+    state.truncated = true;
+    return;
+  }
+  let entries;
+  try {
+    entries = await fs2.readdir(directory, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  entries.sort((a, b) => a.name.localeCompare(b.name));
+  for (const entry of entries) {
+    signal?.throwIfAborted();
+    if (state.entries >= limits.maxEntries) {
+      state.truncated = true;
+      return;
+    }
+    state.entries++;
+    const fullPath = path3.join(directory, entry.name);
+    if (entry.isSymbolicLink()) continue;
+    if (entry.isDirectory()) {
+      if (shouldIgnoreDirectory(entry.name, profiles)) continue;
+      if (depth >= limits.maxDepth) {
+        state.truncated = true;
+        continue;
+      }
+      await scanDirectory(fullPath, depth + 1, profiles, limits, state, signal);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    collectFileEvidence(directory, fullPath, entry.name, profiles, state);
+  }
+}
+function collectFileEvidence(directory, fullPath, basename4, profiles, state) {
+  const lower = basename4.toLowerCase();
+  const extension = path3.extname(lower);
+  for (const profile of profiles) {
+    const detector = profile.detectors.find(
+      (rule) => rule.filename ? lower === rule.filename.toLowerCase() : lower.endsWith(rule.suffix.toLowerCase())
+    );
+    if (detector) {
+      const candidate = getCandidate(state, profile, directory);
+      candidate.evidence.push({
+        kind: detector.kind,
+        path: fullPath,
+        value: basename4,
+        weight: detector.weight
+      });
+      if (detector.kind === "manifest" || detector.kind === "config") {
+        candidate.manifests.push(fullPath);
+      }
+    }
+    if (profile.extensions.includes(extension)) {
+      const paths = state.sourcePaths.get(profile.id) ?? [];
+      if (paths.length < SOURCE_WEIGHT_CAP / SOURCE_WEIGHT) paths.push(fullPath);
+      state.sourcePaths.set(profile.id, paths);
+    }
+  }
+}
+function addSourceFallbacks(projectRoot, profiles, state) {
+  for (const profile of profiles) {
+    const sources = state.sourcePaths.get(profile.id) ?? [];
+    if (sources.length === 0) continue;
+    const profileCandidates = [...state.candidates.values()].filter(
+      (item) => item.profile.id === profile.id
+    );
+    for (const source of sources) {
+      const containing = profileCandidates.filter((candidate2) => isInside(source, candidate2.root)).sort(
+        (a, b) => pathDepth(b.root, projectRoot) - pathDepth(a.root, projectRoot) || a.root.localeCompare(b.root)
+      );
+      const candidate = containing[0] ?? (profile.sourceFallback === false ? void 0 : getCandidate(state, profile, projectRoot));
+      if (!candidate) continue;
+      candidate.evidence.push({
+        kind: "source",
+        path: source,
+        value: path3.extname(source),
+        weight: SOURCE_WEIGHT
+      });
+    }
+  }
+}
+function addTargetEvidence(target, projectRoot, profiles, state) {
+  const extension = path3.extname(target).toLowerCase();
+  for (const profile of profiles) {
+    if (!profile.extensions.includes(extension)) continue;
+    const candidates = [...state.candidates.values()].filter(
+      (candidate2) => candidate2.profile.id === profile.id && isInside(target, candidate2.root)
+    );
+    const candidate = candidates.length > 0 ? candidates.sort(
+      (a, b) => pathDepth(b.root, projectRoot) - pathDepth(a.root, projectRoot) || a.root.localeCompare(b.root)
+    )[0] : profile.sourceFallback === false ? void 0 : getCandidate(state, profile, path3.dirname(target));
+    if (!candidate) continue;
+    candidate.evidence.push({
+      kind: "target",
+      path: target,
+      value: extension,
+      weight: TARGET_WEIGHT
+    });
+  }
+}
+async function finalizeCandidate(candidate, projectRoot) {
+  const evidence = dedupeEvidence(candidate.evidence).sort(compareEvidence);
+  const manifests = [...new Set(candidate.manifests)].sort();
+  const confidence = Math.min(1, evidence.reduce((sum, item) => sum + item.weight, 0) / 100);
+  const packageManager = await detectPackageManager2(candidate.profile, candidate.root, evidence);
+  const id = createHash("sha256").update(`${candidate.profile.id}\0${path3.relative(projectRoot, candidate.root)}`).digest("hex").slice(0, 16);
+  return Object.freeze({
+    id,
+    language: candidate.profile.id,
+    root: candidate.root,
+    confidence,
+    evidence: Object.freeze(evidence.map((item) => Object.freeze(item))),
+    ...packageManager ? { packageManager } : {},
+    manifests: Object.freeze(manifests),
+    capabilities: Object.freeze(
+      Object.keys(candidate.profile.operations).sort()
+    )
+  });
+}
+async function detectPackageManager2(profile, root, evidence) {
+  if (profile.packageManagers.length === 1) return profile.packageManagers[0];
+  if (profile.id !== "typescript" && profile.id !== "javascript") return void 0;
+  let declared;
+  try {
+    const pkg = JSON.parse(await fs2.readFile(path3.join(root, "package.json"), "utf8"));
+    if (typeof pkg.packageManager === "string") {
+      const manager = pkg.packageManager.split("@")[0];
+      if (manager && profile.packageManagers.includes(manager)) declared = manager;
+    }
+  } catch {
+  }
+  const lockManagers = /* @__PURE__ */ new Set();
+  for (const item of evidence) {
+    const name = path3.basename(item.path).toLowerCase();
+    if (name === "pnpm-lock.yaml") lockManagers.add("pnpm");
+    else if (name === "yarn.lock") lockManagers.add("yarn");
+    else if (name === "bun.lock" || name === "bun.lockb") lockManagers.add("bun");
+    else if (name === "package-lock.json") lockManagers.add("npm");
+  }
+  if (declared && (lockManagers.size === 0 || lockManagers.size === 1 && lockManagers.has(declared))) {
+    return declared;
+  }
+  if (lockManagers.size === 1) return [...lockManagers][0];
+  if (lockManagers.size > 1) return void 0;
+  return declared ?? "npm";
+}
+function getCandidate(state, profile, root) {
+  const key = `${profile.id}\0${root}`;
+  let candidate = state.candidates.get(key);
+  if (!candidate) {
+    candidate = { profile, root, evidence: [], manifests: [] };
+    state.candidates.set(key, candidate);
+  }
+  return candidate;
+}
+function shouldIgnoreDirectory(name, profiles) {
+  if (GLOBAL_IGNORES.has(name) || name.startsWith(".")) return true;
+  return profiles.some((profile) => profile.ignoredDirectories.includes(name));
+}
+function normalizeLimits(input) {
+  const maxDepth = Math.max(
+    0,
+    Math.min(12, Math.trunc(input?.maxDepth ?? DEFAULT_LIMITS.maxDepth))
+  );
+  const maxEntries = Math.max(
+    1,
+    Math.min(5e4, Math.trunc(input?.maxEntries ?? DEFAULT_LIMITS.maxEntries))
+  );
+  return { maxDepth, maxEntries };
+}
+async function canonicalDirectory(input) {
+  const resolved = path3.resolve(input);
+  const real = await fs2.realpath(resolved);
+  const stat5 = await fs2.stat(real);
+  if (!stat5.isDirectory()) throw new Error(`Project root is not a directory: ${input}`);
+  return real;
+}
+async function canonicalInside(input, root, label) {
+  const resolved = path3.resolve(input);
+  let real;
+  try {
+    real = await fs2.realpath(resolved);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    const parent = await fs2.realpath(path3.dirname(resolved));
+    real = path3.join(parent, path3.basename(resolved));
+  }
+  if (!isInside(real, root)) throw new Error(`${label} is outside project root: ${input}`);
+  return real;
+}
+function resolveFrom(cwd, input) {
+  return path3.isAbsolute(input) ? input : path3.resolve(cwd, input);
+}
+function isInside(candidate, root) {
+  const relative5 = path3.relative(root, candidate);
+  return relative5 === "" || !relative5.startsWith("..") && !path3.isAbsolute(relative5);
+}
+function pathDepth(candidate, root) {
+  const relative5 = path3.relative(root, candidate);
+  return relative5 === "" ? 0 : relative5.split(path3.sep).length;
+}
+function dedupeEvidence(items) {
+  const seen = /* @__PURE__ */ new Set();
+  return items.filter((item) => {
+    const key = `${item.kind}\0${item.path}\0${item.value}\0${item.weight}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function compareEvidence(a, b) {
+  return a.path.localeCompare(b.path) || a.kind.localeCompare(b.kind) || b.weight - a.weight;
+}
+function compareWorkspaces(a, b) {
+  return b.confidence - a.confidence || a.language.localeCompare(b.language) || a.root.localeCompare(b.root) || a.id.localeCompare(b.id);
+}
+var DEFAULT_LIMITS, SOURCE_WEIGHT, SOURCE_WEIGHT_CAP, TARGET_WEIGHT, GLOBAL_IGNORES;
+var init_detect = __esm({
+  "src/languages/detect.ts"() {
+    "use strict";
+    init_registry();
+    DEFAULT_LIMITS = { maxDepth: 6, maxEntries: 5e3 };
+    SOURCE_WEIGHT = 5;
+    SOURCE_WEIGHT_CAP = 25;
+    TARGET_WEIGHT = 100;
+    GLOBAL_IGNORES = /* @__PURE__ */ new Set([
+      ".git",
+      ".wrongstack",
+      "node_modules",
+      "vendor",
+      "target",
+      "bin",
+      "obj",
+      "dist",
+      "build",
+      "out",
+      "coverage",
+      ".cache",
+      ".idea",
+      ".vscode",
+      ".next",
+      ".nuxt"
+    ]);
+  }
+});
+
+// src/languages/diagnostics.ts
+import * as path4 from "node:path";
+function parseLanguageDiagnostics(parser, stdout, stderr, workspaceRoot) {
+  const text = `${stdout}${stdout && stderr ? "\n" : ""}${stderr}`;
+  let diagnostics;
+  switch (parser) {
+    case "typescript":
+      diagnostics = parseTypeScript(text, workspaceRoot);
+      break;
+    case "cargo-json":
+      diagnostics = parseCargoJson(text, workspaceRoot);
+      break;
+    case "php-lint":
+      diagnostics = parsePhpLint(text, workspaceRoot);
+      break;
+    case "dotnet-build":
+    case "dotnet-format":
+    case "dotnet-test":
+      diagnostics = parseDotnet(text, workspaceRoot);
+      break;
+    case "go-test":
+    case "go-compiler":
+    case "gofmt":
+      diagnostics = parseGo(text, workspaceRoot);
+      break;
+    case "biome":
+      diagnostics = parseBiome(text, workspaceRoot);
+      break;
+    default:
+      diagnostics = parseGeneric(text, parser, workspaceRoot);
+      break;
+  }
+  const sorted = dedupeDiagnostics(diagnostics).sort(compareDiagnostics);
+  const omitted = Math.max(0, sorted.length - MAX_DIAGNOSTICS);
+  const kept = Object.freeze(sorted.slice(0, MAX_DIAGNOSTICS).map((item) => Object.freeze(item)));
+  return {
+    diagnostics: kept,
+    omitted,
+    summary: summarize(kept)
+  };
+}
+function diagnosticsForInternalSyntax(language, target, sourceText) {
+  if (language !== "typescript" && language !== "javascript") {
+    return Promise.resolve({ diagnostics: [], omitted: 0, summary: emptySummary() });
+  }
+  return import("@typescript/typescript6").then((tsModule) => {
+    const ts = tsModule.default ?? tsModule;
+    const extension = path4.extname(target).toLowerCase();
+    const scriptKind = extension === ".tsx" ? ts.ScriptKind.TSX : extension === ".ts" || extension === ".mts" || extension === ".cts" ? ts.ScriptKind.TS : ts.ScriptKind.JSX;
+    const sourceFile = ts.createSourceFile(
+      path4.basename(target),
+      sourceText,
+      ts.ScriptTarget.Latest,
+      false,
+      scriptKind
+    );
+    const native = sourceFile.parseDiagnostics ?? [];
+    const diagnostics = native.map((diagnostic) => {
+      const start = diagnostic.start ?? 0;
+      const location = sourceFile.getLineAndCharacterOfPosition(start);
+      return {
+        severity: diagnostic.category === ts.DiagnosticCategory.Warning ? "warning" : "error",
+        ...diagnostic.code ? { code: `TS${diagnostic.code}` } : {},
+        message: ts.flattenDiagnosticMessageText(diagnostic.messageText, " "),
+        file: target,
+        range: { start: { line: location.line + 1, column: location.character + 1 } },
+        source: "typescript-parser"
+      };
+    });
+    const sorted = dedupeDiagnostics(diagnostics).sort(compareDiagnostics);
+    const omitted = Math.max(0, sorted.length - MAX_DIAGNOSTICS);
+    const kept = Object.freeze(sorted.slice(0, MAX_DIAGNOSTICS).map((item) => Object.freeze(item)));
+    return { diagnostics: kept, omitted, summary: summarize(kept) };
+  });
+}
+function parseTypeScript(text, root) {
+  const diagnostics = [];
+  const regex = /^(.+?)\((\d+),(\d+)\):\s+(error|warning)\s+(TS\d+):\s*(.+)$/gm;
+  for (const match of text.matchAll(regex)) {
+    diagnostics.push({
+      severity: match[4] === "warning" ? "warning" : "error",
+      code: match[5],
+      message: match[6].trim(),
+      file: normalizeDiagnosticPath(match[1], root),
+      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
+      source: "typescript"
+    });
+  }
+  return diagnostics;
+}
+function parseCargoJson(text, root) {
+  const diagnostics = [];
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.trim().startsWith("{")) continue;
+    try {
+      const value = JSON.parse(line);
+      if (value.reason !== "compiler-message" || !value.message?.message) continue;
+      const primary = value.message.spans?.find((span) => span.is_primary) ?? value.message.spans?.[0];
+      diagnostics.push({
+        severity: normalizeSeverity(value.message.level),
+        ...value.message.code?.code ? { code: value.message.code.code } : {},
+        message: value.message.message,
+        ...primary?.file_name ? { file: normalizeDiagnosticPath(primary.file_name, root) } : {},
+        ...primary?.line_start ? { range: { start: { line: primary.line_start, column: primary.column_start ?? 1 } } } : {},
+        source: "rustc"
+      });
+    } catch {
+    }
+  }
+  return diagnostics;
+}
+function parseGo(text, root) {
+  return parseLinePattern(
+    text,
+    /^(.*?\.go):(\d+):(\d+):\s*(.+)$/gm,
+    root,
+    "go",
+    (_match, message) => ({ message, severity: /warning/i.test(message) ? "warning" : "error" })
+  );
+}
+function parsePhpLint(text, root) {
+  const diagnostics = [];
+  const regex = /(?:PHP\s+)?(?:Parse|Fatal) error:\s*(.+?)\s+in\s+(.+?)\s+on line\s+(\d+)/gi;
+  for (const match of text.matchAll(regex)) {
+    diagnostics.push({
+      severity: "error",
+      message: match[1].trim(),
+      file: normalizeDiagnosticPath(match[2], root),
+      range: { start: { line: toPositiveInt(match[3]), column: 1 } },
+      source: "php"
+    });
+  }
+  return diagnostics;
+}
+function parseDotnet(text, root) {
+  const diagnostics = [];
+  const regex = /^(.+?)\((\d+),(\d+)\):\s*(error|warning)\s+([A-Z]+\d+):\s*(.+?)(?:\s+\[.+\])?$/gm;
+  for (const match of text.matchAll(regex)) {
+    diagnostics.push({
+      severity: match[4] === "warning" ? "warning" : "error",
+      code: match[5],
+      message: match[6].trim(),
+      file: normalizeDiagnosticPath(match[1], root),
+      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
+      source: "dotnet"
+    });
+  }
+  return diagnostics;
+}
+function parseBiome(text, root) {
+  const diagnostics = [];
+  const regex = /^(.+?):(\d+):(\d+)\s+(lint\/[^\s]+|format)\s+(.+)$/gm;
+  for (const match of text.matchAll(regex)) {
+    diagnostics.push({
+      severity: "warning",
+      code: match[4],
+      message: match[5].trim(),
+      file: normalizeDiagnosticPath(match[1], root),
+      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
+      source: "biome"
+    });
+  }
+  return diagnostics;
+}
+function parseGeneric(text, source, root) {
+  return parseLinePattern(
+    text,
+    /^(.+?):(\d+):(\d+):\s*(?:(error|warning|info):\s*)?(.+)$/gm,
+    root,
+    source,
+    (match, fallback) => ({
+      severity: normalizeSeverity(match[4]),
+      message: match[5]?.trim() || fallback
+    })
+  );
+}
+function parsePackageReports(parser, stdout, stderr) {
+  const text = `${stdout}${stdout && stderr ? "\n" : ""}${stderr}`;
+  switch (parser) {
+    case "npm-audit":
+      return parseNpmAudit(text);
+    case "npm-outdated":
+      return parseNpmOutdated(text);
+    case "cargo-audit":
+      return parseCargoAudit(text);
+    case "composer-audit":
+      return parseComposerAudit(text);
+    case "composer-outdated":
+      return parseComposerOutdated(text);
+    case "dotnet-package":
+      return parseDotnetPackage(text);
+    default:
+      return { diagnostics: [], vulnerabilities: [], outdated: [] };
+  }
+}
+function parseNpmAudit(text) {
+  const advisories = [];
+  const diagnostics = [];
+  let root;
+  try {
+    root = JSON.parse(text);
+  } catch {
+    return { diagnostics, vulnerabilities: advisories, outdated: [] };
+  }
+  const vulnerabilities = root?.vulnerabilities ?? {};
+  const advisoriesRecord = root?.advisories ?? vulnerabilities;
+  for (const [id, value] of Object.entries(advisoriesRecord)) {
+    const advisory = value;
+    const name = advisory.module_name ?? advisory.package_name ?? advisory.name ?? id;
+    advisories.push({
+      package: name,
+      ...advisory.title ? { advisory: advisory.title } : { advisory: id },
+      severity: mapSeverity(advisory.severity),
+      ...advisory.patched_versions ? { fixedIn: advisory.patched_versions } : {},
+      ...advisory.url ? { url: advisory.url } : {}
+    });
+    diagnostics.push({
+      severity: mapSeverity(advisory.severity) === "critical" || mapSeverity(advisory.severity) === "high" ? "error" : "warning",
+      code: id,
+      message: advisory.title ?? `Vulnerability reported for ${name}.`,
+      source: "npm-audit"
+    });
+  }
+  return { diagnostics, vulnerabilities: advisories, outdated: [] };
+}
+function parseNpmOutdated(text) {
+  const diagnostics = [];
+  const outdated = [];
+  let payload = {};
+  try {
+    payload = JSON.parse(text);
+  } catch {
+    return { diagnostics, vulnerabilities: [], outdated };
+  }
+  for (const [name, info] of Object.entries(payload)) {
+    const entry = info;
+    if (!entry.latest || entry.latest === entry.current) continue;
+    outdated.push({
+      name,
+      previous: entry.current,
+      resolved: entry.latest,
+      kind: mapOutdatedKind(entry.type)
+    });
+    diagnostics.push({
+      severity: "info",
+      code: "outdated",
+      message: `${name}: ${entry.current ?? "?"} \u2192 ${entry.latest}`,
+      source: "npm-outdated"
+    });
+  }
+  return { diagnostics, vulnerabilities: [], outdated };
+}
+function parseCargoAudit(text) {
+  const diagnostics = [];
+  const vulnerabilities = [];
+  let root;
+  try {
+    root = JSON.parse(text);
+  } catch {
+    return { diagnostics, vulnerabilities, outdated: [] };
+  }
+  const findings = root.vulnerabilities?.found;
+  if (!Array.isArray(findings)) return { diagnostics, vulnerabilities, outdated: [] };
+  for (const finding of findings) {
+    const item = finding;
+    const name = item.package ?? "unknown";
+    const advisory = item.id ?? item.advisory?.id ?? "cargo-audit";
+    vulnerabilities.push({
+      package: name,
+      ...item.title ? { advisory: item.title } : { advisory },
+      severity: mapSeverity(item.severity),
+      ...item.patched_versions && item.patched_versions.length > 0 ? { fixedIn: item.patched_versions[0] } : {},
+      ...item.url?.short ? { url: item.url.short } : {}
+    });
+    diagnostics.push({
+      severity: mapSeverity(item.severity) === "critical" || mapSeverity(item.severity) === "high" ? "error" : "warning",
+      code: advisory,
+      message: item.title ?? `${name} reported by cargo-audit.`,
+      source: "cargo-audit"
+    });
+  }
+  return { diagnostics, vulnerabilities, outdated: [] };
+}
+function parseComposerAudit(text) {
+  const diagnostics = [];
+  const vulnerabilities = [];
+  const lines = text.split(/\r?\n/);
+  for (const line of lines) {
+    if (!line.trim().startsWith("{")) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (!entry.package) continue;
+      vulnerabilities.push({
+        package: entry.package,
+        ...entry.advisory ? { advisory: entry.advisory } : {},
+        ...entry.title ? { advisory: entry.title } : { advisory: entry.advisory ?? "composer-audit" },
+        severity: mapSeverity(entry.severity),
+        ...entry.affectedVersions ? { fixedIn: entry.affectedVersions } : {},
+        ...entry.url ? { url: entry.url } : {}
+      });
+      diagnostics.push({
+        severity: "warning",
+        code: entry.advisory ?? "composer-audit",
+        message: entry.title ?? `${entry.package} reported by composer audit.`,
+        source: "composer-audit"
+      });
+    } catch {
+    }
+  }
+  return { diagnostics, vulnerabilities, outdated: [] };
+}
+function parseComposerOutdated(text) {
+  const diagnostics = [];
+  const outdated = [];
+  const lines = text.split(/\r?\n/);
+  for (const line of lines) {
+    if (!line.trim().startsWith("{")) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (!entry.name || entry.version === entry.latest) continue;
+      outdated.push({
+        name: entry.name,
+        previous: entry.version,
+        resolved: entry.latest ?? entry.version
+      });
+      diagnostics.push({
+        severity: "info",
+        code: "outdated",
+        message: `${entry.name}: ${entry.version ?? "?"} \u2192 ${entry.latest ?? "?"}`,
+        source: "composer-outdated"
+      });
+    } catch {
+    }
+  }
+  return { diagnostics, vulnerabilities: [], outdated };
+}
+function parseDotnetPackage(text) {
+  const diagnostics = [];
+  const vulnerabilities = [];
+  const outdated = [];
+  let root;
+  try {
+    root = JSON.parse(text);
+  } catch {
+    return { diagnostics, vulnerabilities, outdated };
+  }
+  const projects = root.projects;
+  if (!Array.isArray(projects)) return { diagnostics, vulnerabilities, outdated };
+  for (const project of projects) {
+    const packages = Array.isArray(project.packages) ? project.packages : [];
+    for (const pkg of packages) {
+      const name = typeof pkg.name === "string" ? pkg.name : "unknown";
+      const requested = typeof pkg.requestedVersion === "string" ? pkg.requestedVersion : void 0;
+      const resolved = typeof pkg.resolvedVersion === "string" ? pkg.resolvedVersion : void 0;
+      const vulnerabilitiesRaw = Array.isArray(pkg.vulnerabilities) ? pkg.vulnerabilities : [];
+      for (const vuln of vulnerabilitiesRaw) {
+        const advisory = typeof vuln.advisoryUrl === "string" ? vuln.advisoryUrl : "dotnet-vulnerable";
+        vulnerabilities.push({
+          package: name,
+          advisory,
+          severity: mapSeverity(typeof vuln.severity === "string" ? vuln.severity : void 0)
+        });
+      }
+      if (vulnerabilitiesRaw.length > 0) {
+        diagnostics.push({
+          severity: "warning",
+          code: "dotnet-vulnerable",
+          message: `${name} has ${vulnerabilitiesRaw.length} known vulnerability entry/entries.`,
+          source: "dotnet-package"
+        });
+      }
+      if (requested && resolved && requested.startsWith(">") && requested.split(">")[1].split(".").slice(0, 2).join(".") !== resolved.split(".").slice(0, 2).join(".")) {
+        outdated.push({ name, requested, resolved });
+        diagnostics.push({
+          severity: "info",
+          code: "outdated",
+          message: `${name}: ${requested} \u2192 ${resolved}`,
+          source: "dotnet-package"
+        });
+      }
+    }
+  }
+  return { diagnostics, vulnerabilities, outdated };
+}
+function mapSeverity(value) {
+  switch (value?.toLowerCase()) {
+    case "critical":
+    case "high":
+      return "high";
+    case "medium":
+    case "moderate":
+      return "moderate";
+    case "low":
+      return "low";
+    case "unknown":
+      return "unknown";
+    default:
+      return "unknown";
+  }
+}
+function mapOutdatedKind(value) {
+  switch (value?.toLowerCase()) {
+    case "devdependencies":
+    case "development":
+      return "development";
+    case "optionaldependencies":
+    case "optional":
+      return "optional";
+    default:
+      return "runtime";
+  }
+}
+function parseLinePattern(text, regex, root, source, details) {
+  const diagnostics = [];
+  for (const match of text.matchAll(regex)) {
+    const parsed = details(match, match.at(-1)?.trim() ?? "Diagnostic");
+    diagnostics.push({
+      severity: parsed.severity,
+      message: parsed.message,
+      file: normalizeDiagnosticPath(match[1], root),
+      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
+      source
+    });
+  }
+  return diagnostics;
+}
+function normalizeDiagnosticPath(value, root) {
+  const clean = value.trim().replace(/^['"]|['"]$/g, "");
+  return path4.resolve(root, clean);
+}
+function normalizeSeverity(value) {
+  if (value === "warning" || value === "warn") return "warning";
+  if (value === "info" || value === "note" || value === "help") return "info";
+  if (value === "hint") return "hint";
+  return "error";
+}
+function toPositiveInt(value) {
+  return Math.max(1, Number.parseInt(value ?? "1", 10) || 1);
+}
+function summarize(diagnostics) {
+  return {
+    errors: diagnostics.filter((item) => item.severity === "error").length,
+    warnings: diagnostics.filter((item) => item.severity === "warning").length,
+    infos: diagnostics.filter((item) => item.severity === "info" || item.severity === "hint").length
+  };
+}
+function emptySummary() {
+  return { errors: 0, warnings: 0, infos: 0 };
+}
+function dedupeDiagnostics(items) {
+  const seen = /* @__PURE__ */ new Set();
+  return items.filter((item) => {
+    const key = [
+      item.source,
+      item.code ?? "",
+      item.file ?? "",
+      item.range?.start.line ?? 0,
+      item.range?.start.column ?? 0,
+      item.message
+    ].join("\0");
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function compareDiagnostics(a, b) {
+  return (a.file ?? "").localeCompare(b.file ?? "") || (a.range?.start.line ?? 0) - (b.range?.start.line ?? 0) || (a.range?.start.column ?? 0) - (b.range?.start.column ?? 0) || severityRank(a.severity) - severityRank(b.severity) || (a.code ?? "").localeCompare(b.code ?? "") || a.message.localeCompare(b.message);
+}
+function severityRank(value) {
+  return value === "error" ? 0 : value === "warning" ? 1 : value === "info" ? 2 : 3;
+}
+var MAX_DIAGNOSTICS;
+var init_diagnostics = __esm({
+  "src/languages/diagnostics.ts"() {
+    "use strict";
+    MAX_DIAGNOSTICS = 200;
+  }
+});
+
+// src/_output-spool.ts
+import { createWriteStream, mkdirSync } from "node:fs";
+import * as fsp2 from "node:fs/promises";
+import * as path5 from "node:path";
+import { wstackGlobalRoot as wstackGlobalRoot2 } from "@wrongstack/core";
+function toolOutputDir() {
+  return path5.join(wstackGlobalRoot2(), "tool-output");
+}
+function sweepOldSpoolFiles(dir) {
+  if (sweepStarted) return;
+  sweepStarted = true;
+  void (async () => {
+    try {
+      const now = Date.now();
+      for (const name of await fsp2.readdir(dir)) {
+        if (!name.endsWith(".log")) continue;
+        const p = path5.join(dir, name);
+        try {
+          const st = await fsp2.stat(p);
+          if (now - st.mtimeMs > SPOOL_RETENTION_MS) await fsp2.unlink(p);
+        } catch {
+        }
+      }
+    } catch {
+    }
+  })();
+}
+function spoolNote(info) {
+  const dropped = info.droppedBytes > 0 ? `, ~${info.droppedBytes} bytes dropped under backpressure` : "";
+  return `
+[output truncated \u2014 full ${info.bytes} bytes at ${info.path}${dropped}; read/grep that file selectively instead of re-running with more output]`;
+}
+function createOutputSpool(opts) {
+  const threshold = opts.thresholdBytes ?? 32768;
+  const safeTool = opts.tool.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
+  let head = "";
+  let headBytes = 0;
+  let totalBytes = 0;
+  let droppedBytes = 0;
+  let stream = null;
+  let filePath = null;
+  let failed = false;
+  let finalized = false;
+  const open = () => {
+    if (stream || failed) return;
+    try {
+      const dir = toolOutputDir();
+      mkdirSync(dir, { recursive: true });
+      sweepOldSpoolFiles(dir);
+      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const rand = Math.random().toString(36).slice(2, 6);
+      filePath = path5.join(dir, `${stamp}-${safeTool}-${rand}.log`);
+      stream = createWriteStream(filePath, { flags: "w", encoding: "utf8" });
+      stream.on("error", () => {
+        failed = true;
+        stream = null;
+        filePath = null;
+      });
+      stream.write(head);
+    } catch {
+      failed = true;
+      stream = null;
+      filePath = null;
+    }
+  };
+  return {
+    write(text) {
+      if (finalized || !text) return;
+      totalBytes += Buffer.byteLength(text, "utf8");
+      if (!stream && !failed) {
+        if (headBytes + text.length <= threshold) {
+          head += text;
+          headBytes += text.length;
+          return;
+        }
+        head += text;
+        open();
+        head = "";
+        return;
+      }
+      if (stream) {
+        if (stream.writableLength > SPOOL_WRITE_HWM_BYTES) {
+          droppedBytes += Buffer.byteLength(text, "utf8");
+          return;
+        }
+        stream.write(text);
+      }
+    },
+    finalize() {
+      if (finalized) {
+        return filePath ? { path: filePath, bytes: totalBytes, droppedBytes } : null;
+      }
+      finalized = true;
+      head = "";
+      if (!stream || !filePath) return null;
+      try {
+        stream.end();
+      } catch {
+      }
+      return { path: filePath, bytes: totalBytes, droppedBytes };
+    }
+  };
+}
+var SPOOL_RETENTION_MS, SPOOL_WRITE_HWM_BYTES, sweepStarted;
+var init_output_spool = __esm({
+  "src/_output-spool.ts"() {
+    "use strict";
+    SPOOL_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
+    SPOOL_WRITE_HWM_BYTES = 4 * 1024 * 1024;
+    sweepStarted = false;
+  }
+});
+
+// src/circuit-breaker.ts
+var DEFAULT_MAX_CONSECUTIVE_FAILURES, DEFAULT_SLOW_CALL_THRESHOLD_MS, DEFAULT_MAX_SLOW_CALLS, DEFAULT_WINDOW_MS, DEFAULT_MAX_CALLS_PER_WINDOW, DEFAULT_COOLDOWN_MS, CircuitBreaker;
+var init_circuit_breaker = __esm({
+  "src/circuit-breaker.ts"() {
+    "use strict";
+    DEFAULT_MAX_CONSECUTIVE_FAILURES = 5;
+    DEFAULT_SLOW_CALL_THRESHOLD_MS = 18e4;
+    DEFAULT_MAX_SLOW_CALLS = 3;
+    DEFAULT_WINDOW_MS = 6e4;
+    DEFAULT_MAX_CALLS_PER_WINDOW = 30;
+    DEFAULT_COOLDOWN_MS = 3e4;
+    CircuitBreaker = class {
+      maxConsecutiveFailures;
+      slowCallThresholdMs;
+      maxSlowCalls;
+      windowMs;
+      maxCallsPerWindow;
+      cooldownMs;
+      state = "closed";
+      consecutiveFailures = 0;
+      window = [];
+      lastFailureAt = null;
+      lastSlowAt = null;
+      /** Timestamp when the breaker was opened (for cooldown calculation). */
+      openedAt = null;
+      /**
+       * Master enable flag. When false the breaker is bypassed: `beforeCall`
+       * always returns true and `afterCall` records nothing. The class itself
+       * defaults to enabled (so the standalone unit tests exercise tripping); the
+       * ProcessRegistry flips this off until the user opts in via `/settings`.
+       */
+      enabled = true;
+      /**
+       * Fired (best-effort) when the breaker transitions into the `open` state.
+       * The registry uses this to arm its auto kill/reset countdown.
+       */
+      onTrip;
+      /**
+       * Fired (best-effort) when the breaker returns to `closed` after having been
+       * open/half-open. The registry uses this to cancel a pending kill/reset.
+       */
+      onReset;
+      constructor(config = {}) {
+        this.maxConsecutiveFailures = config.maxConsecutiveFailures ?? DEFAULT_MAX_CONSECUTIVE_FAILURES;
+        this.slowCallThresholdMs = config.slowCallThresholdMs ?? DEFAULT_SLOW_CALL_THRESHOLD_MS;
+        this.maxSlowCalls = config.maxSlowCalls ?? DEFAULT_MAX_SLOW_CALLS;
+        this.windowMs = config.windowMs ?? DEFAULT_WINDOW_MS;
+        this.maxCallsPerWindow = config.maxCallsPerWindow ?? DEFAULT_MAX_CALLS_PER_WINDOW;
+        this.cooldownMs = config.cooldownMs ?? DEFAULT_COOLDOWN_MS;
+      }
+      /** Toggle the master enable. Disabling resets to a clean `closed` state. */
+      setEnabled(enabled) {
+        if (this.enabled === enabled) return;
+        this.enabled = enabled;
+        if (!enabled) this._reset();
+      }
+      get isEnabled() {
+        return this.enabled;
+      }
+      /**
+       * Returns true if the circuit allows a new call to proceed.
+       * When false, callers should abort the tool call and return a
+       * circuit-breaker error instead of spawning a process.
+       */
+      get canProceed() {
+        if (!this.enabled) return true;
+        this._checkStateTransition();
+        return this.state !== "open";
+      }
+      /**
+       * Snapshot of the current breaker state for observability (`/kill`).
+       */
+      snapshot() {
+        this._checkStateTransition();
+        const now = Date.now();
+        let cooldownRemaining = null;
+        if (this.openedAt !== null && this.state === "open") {
+          const elapsed = now - this.openedAt;
+          cooldownRemaining = Math.max(0, this.cooldownMs - elapsed);
+        }
+        return {
+          state: this.state,
+          consecutiveFailures: this.consecutiveFailures,
+          slowCallsInWindow: this.window.filter((c) => c.slow).length,
+          callsInWindow: this.window.length,
+          windowMs: this.windowMs,
+          cooldownRemainingMs: cooldownRemaining,
+          lastFailureAt: this.lastFailureAt,
+          lastSlowAt: this.lastSlowAt
+        };
+      }
+      /**
+       * Call this BEFORE spawning a bash/exec process.
+       * Returns true if the call is allowed; false if the breaker is open.
+       * When false, callers MUST NOT spawn a process.
+       *
+       * @param bypass - If true, skip the circuit breaker check entirely.
+       *                  Use for background/fire-and-forget processes that should
+       *                  not affect breaker state.
+       */
+      beforeCall(bypass = false) {
+        if (bypass || !this.enabled) return true;
+        this._checkStateTransition();
+        if (this.state === "open") return false;
+        return true;
+      }
+      /**
+       * Call this AFTER a bash/exec process finishes (success or failure).
+       * `durationMs` is the wall-clock time the process ran.
+       * `failed` is true when the process returned a non-zero exit code or
+       * threw an exception before spawning.
+       *
+       * @param bypass - If true, do not update breaker state.
+       *                  Use for background/fire-and-forget processes.
+       */
+      afterCall(durationMs, failed, bypass = false) {
+        if (bypass || !this.enabled) return;
+        const now = Date.now();
+        if (this.state === "half-open") {
+          if (failed) {
+            this._trip();
+            return;
+          }
+          this._reset();
+          return;
+        }
+        this._pruneWindow(now);
+        const slow = durationMs >= this.slowCallThresholdMs;
+        this.window.push({ at: now, failed, slow });
+        if (failed) {
+          this.consecutiveFailures++;
+          this.lastFailureAt = now;
+          if (this.consecutiveFailures >= this.maxConsecutiveFailures) {
+            this._trip();
+          }
+          return;
+        }
+        this.consecutiveFailures = 0;
+        if (slow) {
+          this.lastSlowAt = now;
+          const slowCount = this.window.filter((c) => c.slow).length;
+          if (slowCount >= this.maxSlowCalls) {
+            this._trip();
+          }
+        }
+        const callCount = this.window.length;
+        if (callCount >= this.maxCallsPerWindow) {
+          this._trip();
+        }
+      }
+      /** Force the breaker open. Used by /kill force and Ctrl+C. */
+      forceOpen() {
+        this._trip();
+      }
+      /** Force a reset to closed. Used by tests and /kill reset. */
+      forceReset() {
+        this._reset();
+      }
+      _trip() {
+        if (this.state === "open") return;
+        this.state = "open";
+        this.openedAt = Date.now();
+        this.window = [];
+        try {
+          this.onTrip?.();
+        } catch {
+        }
+      }
+      _reset() {
+        const wasRecovering = this.state !== "closed";
+        this.state = "closed";
+        this.consecutiveFailures = 0;
+        this.window = [];
+        this.openedAt = null;
+        if (wasRecovering) {
+          try {
+            this.onReset?.();
+          } catch {
+          }
+        }
+      }
+      /** Transition from open → half-open when cooldown elapses. */
+      _checkStateTransition() {
+        if (this.state !== "open" || this.openedAt === null) return;
+        const elapsed = Date.now() - this.openedAt;
+        if (elapsed >= this.cooldownMs) {
+          this.state = "half-open";
+          this.openedAt = null;
+        }
+      }
+      _pruneWindow(now) {
+        const cutoff = now - this.windowMs;
+        this.window = this.window.filter((c) => c.at >= cutoff);
+      }
+    };
+  }
+});
+
+// src/_redact-command.ts
+import { expectDefined } from "@wrongstack/core";
+function redactCommand(cmd) {
+  let result = cmd;
+  for (const pattern of SENSITIVE_FLAG_PATTERNS) {
+    result = result.replace(pattern, (match) => {
+      const eq = match.indexOf("=");
+      const sp = match.search(/\s/);
+      const delim = eq !== -1 ? "=" : sp !== -1 ? match[sp] : null;
+      if (delim !== null) {
+        const flag = match.slice(0, match.indexOf(expectDefined(delim)) + 1);
+        return `${flag}[REDACTED]`;
+      }
+      const flagEnd = match.match(/^--?[a-zA-Z][a-zA-Z0-9_-]*/)?.[0] ?? match;
+      return `${flagEnd}=**redacted**`;
+    });
+  }
+  return result;
+}
+var SENSITIVE_FLAG_PATTERNS;
+var init_redact_command = __esm({
+  "src/_redact-command.ts"() {
+    "use strict";
+    SENSITIVE_FLAG_PATTERNS = [
+      // --flag=value  or  --flag "value"  (value captured up to next space or comma)
+      /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
+      // -f "value" style short flags
+      /(?<!\w)-t(?:\s+|\s*=\s*)[^\s,]+/,
+      /(?<!\w)-(?:p|password)(?:\s+|\s*=\s*)[^\s,]+/gi,
+      // env var–style secrets: TOKEN=x, API_KEY=y, etc.
+      /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+      // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
+      // when preceded by a flag name (e.g. --github-token=EyJ...).
+      /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/
+    ];
+  }
+});
+
+// src/process-registry.ts
+import { spawn } from "node:child_process";
+import * as os from "node:os";
+function killWin32Tree(pid, opts = {}) {
+  try {
+    const child = spawn("taskkill", ["/pid", String(pid), "/T", "/F"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
+    let settled = false;
+    let timeout;
+    const settle = () => {
+      if (settled) return;
+      settled = true;
+      if (timeout) clearTimeout(timeout);
+      try {
+        opts.onSettled?.();
+      } catch {
+      }
+    };
+    child.on("error", settle);
+    child.on("close", settle);
+    timeout = setTimeout(() => {
+      try {
+        child.kill();
+      } catch {
+      }
+      settle();
+    }, Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS));
+    timeout.unref?.();
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getProcessRegistry() {
+  if (!_registry) {
+    _registry = new ProcessRegistryImpl();
+  }
+  return _registry;
+}
+var DEFAULT_GRACE_MS, WIN32_TASKKILL_TIMEOUT_MS, ProcessRegistryImpl, _registry;
+var init_process_registry = __esm({
+  "src/process-registry.ts"() {
+    "use strict";
+    init_circuit_breaker();
+    init_redact_command();
+    DEFAULT_GRACE_MS = 2e3;
+    WIN32_TASKKILL_TIMEOUT_MS = 5e3;
+    ProcessRegistryImpl = class {
+      processes = /* @__PURE__ */ new Map();
+      breaker;
+      /**
+       * Auto kill/reset config. When the breaker trips and `autoKillResetMs > 0`,
+       * a countdown is armed; on expiry all tracked processes are killed and the
+       * breaker is reset to closed (forced recovery). Zero means manual recovery
+       * only (`/kill reset`).
+       */
+      autoKillResetMs = 0;
+      autoKillTimer = null;
+      autoKillArmedAt = null;
+      breakerCountdownListeners = [];
+      constructor(breakerConfig) {
+        this.breaker = new CircuitBreaker(breakerConfig);
+        this.breaker.onTrip = () => this._armAutoKillReset();
+        this.breaker.onReset = () => this._cancelAutoKillReset();
+        this.breaker.setEnabled(false);
+      }
+      register(info) {
+        this.processes.set(info.pid, { ...info, killed: false, protected: info.protected ?? false });
+      }
+      _isSafeSignalPid(pid) {
+        return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
+      }
+      _canSignalProcessGroup(p) {
+        return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && typeof p.child.pid === "number" && p.child.pid === p.pid;
+      }
+      _killChildDirect(p, signal) {
+        try {
+          p.child.kill(signal);
+        } catch {
+        }
+      }
+      _killPosix(p, signal) {
+        if (this._canSignalProcessGroup(p)) {
+          try {
+            process.kill(-p.pid, signal);
+            return;
+          } catch {
+          }
+        }
+        this._killChildDirect(p, signal);
+      }
+      /** Unregister a process by PID. Called on 'close' / 'exit' events. */
+      unregister(pid) {
+        this.processes.delete(pid);
+      }
+      /** Get a single process by PID. */
+      get(pid) {
+        this._pruneStale(pid);
+        return this.processes.get(pid);
+      }
+      /** Get all tracked processes. */
+      list() {
+        return Array.from(this.processes.values());
+      }
+      /** Get processes filtered by name (e.g. 'bash', 'exec'). */
+      byName(name) {
+        return this.list().filter((p) => p.name === name);
+      }
+      /** Get processes filtered by session. */
+      bySession(sessionId) {
+        return this.list().filter((p) => p.sessionId === sessionId);
+      }
+      /** Count of active (non-killed) processes. */
+      get activeCount() {
+        let n = 0;
+        for (const p of this.processes.values()) {
+          if (!p.killed) n++;
+        }
+        return n;
+      }
+      /**
+       * Combined stats for observability — used by /ps and the TUI status bar.
+       */
+      stats() {
+        return {
+          activeCount: this.activeCount,
+          totalCount: this.processes.size,
+          breaker: this.breaker.snapshot()
+        };
+      }
+      /**
+       * Returns true if the circuit allows a new bash/exec call to proceed.
+       * When false, callers MUST NOT spawn a process.
+       */
+      get canProceed() {
+        return this.breaker.canProceed;
+      }
+      /**
+       * Called before spawning a process. Returns true if allowed; false if
+       * the circuit breaker is open.
+       *
+       * @param bypass - If true, skip circuit breaker check (for background processes).
+       */
+      beforeCall(bypass = false) {
+        return this.breaker.beforeCall(bypass);
+      }
+      /**
+       * Called after a process finishes. `durationMs` is wall-clock time;
+       * `failed` is true for non-zero exit codes.
+       *
+       * @param bypass - If true, do not update circuit breaker state (for background processes).
+       */
+      afterCall(durationMs, failed, bypass = false) {
+        this.breaker.afterCall(durationMs, failed, bypass);
+      }
+      /** Force-open the circuit breaker (Ctrl+C, /kill force). */
+      forceBreakerOpen() {
+        this.breaker.forceOpen();
+      }
+      /** Force-reset the circuit breaker to closed (/kill reset). */
+      forceBreakerReset() {
+        this.breaker.forceReset();
+      }
+      /**
+       * Configure circuit-breaker protection at runtime. Called from `/settings`
+       * (instant, all modes) and on TUI mount (applies persisted config).
+       *
+       * - `enabled` toggles whether the breaker gates `bash`/`exec`.
+       * - `autoKillResetMs` arms the auto kill/reset countdown when the breaker
+       *   trips (0 = manual recovery only).
+       *
+       * Re-applies cleanly on every call: cancels a pending countdown when the
+       * timeout is cleared or protection disabled, and re-arms if the breaker is
+       * currently open under the new settings.
+       */
+      setBreakerConfig(cfg) {
+        if (cfg.enabled !== void 0) this.breaker.setEnabled(cfg.enabled);
+        if (cfg.autoKillResetMs !== void 0) this.autoKillResetMs = Math.max(0, cfg.autoKillResetMs);
+        if (this.autoKillResetMs <= 0) {
+          this._cancelAutoKillReset();
+          return;
+        }
+        if (this.breaker.isEnabled && this.breaker.snapshot().state === "open") {
+          this._armAutoKillReset();
+        }
+      }
+      /**
+       * Live countdown to the next auto kill/reset, or null when nothing is armed.
+       * The TUI polls this on a 1s tick while armed so the statusline decrements.
+       */
+      getBreakerCountdown() {
+        if (this.autoKillArmedAt === null || this.autoKillResetMs <= 0) return null;
+        const elapsed = Date.now() - this.autoKillArmedAt;
+        return { remainingMs: Math.max(0, this.autoKillResetMs - elapsed), totalMs: this.autoKillResetMs };
+      }
+      /**
+       * Subscribe to countdown arm/cancel events. Returns an unsubscribe function.
+       * Use {@link getBreakerCountdown} for the live ticking value between events.
+       */
+      onBreakerCountdownChange(listener) {
+        this.breakerCountdownListeners.push(listener);
+        return () => {
+          this.breakerCountdownListeners = this.breakerCountdownListeners.filter((l) => l !== listener);
+        };
+      }
+      _emitBreakerCountdown() {
+        const snap = this.getBreakerCountdown();
+        for (const l of this.breakerCountdownListeners) {
+          try {
+            l(snap);
+          } catch {
+          }
+        }
+      }
+      /**
+       * Arm the auto kill/reset countdown. Idempotent: re-arming resets the window
+       * (a fresh trip after a failed half-open probe restarts the clock). No-op
+       * when protection is off or no timeout is configured.
+       */
+      _armAutoKillReset() {
+        if (this.autoKillResetMs <= 0 || !this.breaker.isEnabled) return;
+        this._clearAutoKillTimer();
+        this.autoKillArmedAt = Date.now();
+        this.autoKillTimer = setTimeout(() => {
+          this.autoKillTimer = null;
+          this.autoKillArmedAt = null;
+          this.killAll({ force: false });
+          this.breaker.forceReset();
+          this._emitBreakerCountdown();
+        }, this.autoKillResetMs);
+        this.autoKillTimer.unref?.();
+        this._emitBreakerCountdown();
+      }
+      _cancelAutoKillReset() {
+        const wasArmed = this.autoKillArmedAt !== null;
+        this._clearAutoKillTimer();
+        if (wasArmed) {
+          this.autoKillArmedAt = null;
+          this._emitBreakerCountdown();
+        }
+      }
+      _clearAutoKillTimer() {
+        if (this.autoKillTimer !== null) {
+          clearTimeout(this.autoKillTimer);
+          this.autoKillTimer = null;
+        }
+      }
+      /** Kill a single process by PID.
+       *
+       *  On POSIX: sends SIGTERM to the *process group* (-pid) so that
+       *  runaway grandchild processes (`sleep 9999 & disown`) are also killed.
+       *  After `graceMs` a SIGKILL is sent if the process hasn't exited.
+       *
+       *  On Windows: `child.kill()` maps to TerminateProcess — process groups
+       *  are not meaningfully supported. A second `force=true` call sends
+       *  SIGKILL (which maps to TerminateProcess again — the distinction is
+       *  in the exit code, not the signal).
+       *
+       *  Returns true if the process was found and kill was attempted.
+       */
+      kill(pid, opts = {}) {
+        this._pruneStale(pid);
+        const p = this.processes.get(pid);
+        if (!p) return false;
+        if (p.killed) return true;
+        if (p.protected) return false;
+        const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
+        const isWin2 = os.platform() === "win32";
+        if (isWin2) {
+          const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
+          const directFallback = () => {
+            if (p.child.exitCode === null) {
+              try {
+                p.child.kill("SIGKILL");
+              } catch {
+              }
+            }
+          };
+          if (liveRealChild && killWin32Tree(pid, {
+            timeoutMs: Math.max(graceMs, WIN32_TASKKILL_TIMEOUT_MS),
+            onSettled: directFallback
+          })) {
+          } else {
+            try {
+              p.child.kill(force ? "SIGKILL" : "SIGTERM");
+            } catch {
+            }
+          }
+          p.killed = true;
+          return true;
+        }
+        try {
+          if (force) {
+            this._killPosix(p, "SIGKILL");
+          } else {
+            this._killPosix(p, "SIGTERM");
+            const timer = setTimeout(() => {
+              if (this.processes.has(pid) && !p.child.killed) {
+                this._killPosix(p, "SIGKILL");
+              }
+            }, graceMs);
+            timer.unref?.();
+          }
+        } catch {
+        }
+        p.killed = true;
+        return true;
+      }
+      /**
+       * Kill all tracked processes.
+       * Returns the PIDs that were kill()ed.
+       */
+      killAll(opts = {}) {
+        const pids = Array.from(this.processes.keys());
+        const killed = [];
+        for (const pid of pids) {
+          const p = this.processes.get(pid);
+          if (p && !p.protected && this.kill(pid, opts)) killed.push(pid);
+        }
+        return killed;
+      }
+      /**
+       * Kill all processes for a specific session.
+       * Returns the PIDs that were kill()ed.
+       */
+      killSession(sessionId, opts = {}) {
+        const pids = this.bySession(sessionId).map((p) => p.pid);
+        const killed = [];
+        for (const pid of pids) {
+          if (this.kill(pid, opts)) killed.push(pid);
+        }
+        return killed;
+      }
+      /**
+       * Check whether a tracked process entry is stale — the child has exited
+       * (exitCode !== null) AND it's been in the registry long enough that the
+       * OS may have reused the PID for a new, unrelated process.
+       *
+       * P3 #24 (before-release.md): on POSIX, PIDs are reused after process
+       * exit. If a tracked process exits but its 'close' event hasn't fired yet
+       * (or was missed), the registry still holds the entry. A new process
+       * gets the same PID, and PID-based lookups (get, kill, shouldBlockKill)
+       * may incorrectly protect or target the wrong process.
+       *
+       * The 60s threshold is conservative — the OS typically waits much longer
+       * before reusing a PID, but we want to clean up before that becomes a risk.
+       */
+      _isStaleEntry(entry) {
+        return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
+      }
+      /**
+       * Remove a stale entry for a specific PID before any PID-based lookup.
+       * This prevents PID reuse from causing the registry to act on a dead
+       * process that has been replaced by a new one with the same PID.
+       */
+      _pruneStale(pid) {
+        const entry = this.processes.get(pid);
+        if (entry && this._isStaleEntry(entry)) {
+          this.processes.delete(pid);
+        }
+      }
+    };
+  }
+});
+
+// src/_spawn-stream.ts
+import { spawn as spawn2 } from "node:child_process";
+import { buildChildEnv } from "@wrongstack/core";
+async function* spawnStream(opts) {
+  const max = opts.maxBytes ?? 2e5;
+  const flushAt = opts.flushBytes ?? 4 * 1024;
+  const maxQueue = opts.maxQueueSize ?? 500;
+  let stdout = "";
+  let stderr = "";
+  let pending = "";
+  let error;
+  const spool = createOutputSpool({ tool: opts.cmd, thresholdBytes: max });
+  const resolved = resolveWin32Command(opts.cmd);
+  const needsShell = isWin && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
+  const shim = needsShell ? buildWin32CmdShimInvocation(resolved, opts.args) : null;
+  const cmd = shim?.command ?? resolved;
+  const args = shim?.args ?? opts.args;
+  const child = spawn2(cmd, args, {
+    cwd: opts.cwd,
+    env: buildChildEnv(),
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true,
+    ...isWin ? {} : { signal: opts.signal },
+    ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
+  });
+  const registry = getProcessRegistry();
+  const pid = child.pid;
+  if (typeof pid === "number") {
+    registry.register({
+      pid,
+      name: opts.cmd,
+      command: redactCommand(`${opts.cmd} ${opts.args.join(" ")}`),
+      startedAt: Date.now(),
+      child
+    });
+  }
+  const queue = [];
+  let waiter;
+  let paused = false;
+  const wake = () => {
+    if (waiter) {
+      const w = waiter;
+      waiter = void 0;
+      w();
+    }
+  };
+  const resume = () => {
+    if (paused && queue.length < maxQueue) {
+      paused = false;
+      child.stdout?.resume();
+      child.stderr?.resume();
+    }
+  };
+  const onOut = (c) => {
+    const s = c.toString();
+    if (stdout.length < max) stdout += s;
+    spool.write(s);
+    queue.push({ kind: "out", data: s });
+    wake();
+    if (!paused && queue.length >= maxQueue) {
+      paused = true;
+      child.stdout?.pause();
+      child.stderr?.pause();
+    }
+  };
+  const onErr = (c) => {
+    const s = c.toString();
+    if (stderr.length < max) stderr += s;
+    spool.write(s);
+    queue.push({ kind: "err", data: s });
+    wake();
+    if (!paused && queue.length >= maxQueue) {
+      paused = true;
+      child.stdout?.pause();
+      child.stderr?.pause();
+    }
+  };
+  child.stdout?.on("data", onOut);
+  child.stderr?.on("data", onErr);
+  child.on("error", (e) => {
+    error = e.message;
+    queue.push({ kind: "error", data: e.message });
+    wake();
+  });
+  child.on("close", (code) => {
+    if (typeof pid === "number") registry.unregister(pid);
+    queue.push({ kind: "close", data: "", code: code ?? 0 });
+    wake();
+  });
+  const onAbort = () => {
+    if (typeof pid === "number") {
+      registry.kill(pid, { force: true });
+    } else {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+    }
+    queue.push({ kind: "close", data: "", code: 124 });
+    wake();
+  };
+  if (isWin) {
+    if (opts.signal.aborted) onAbort();
+    else opts.signal.addEventListener("abort", onAbort, { once: true });
+  }
+  let exitCode = 0;
+  let spawnFailed = false;
+  try {
+    for (; ; ) {
+      while (queue.length === 0) {
+        await new Promise((resolve6) => {
+          waiter = resolve6;
+        });
+      }
+      const chunk = queue.shift();
+      resume();
+      if (chunk.kind === "close") {
+        if (!spawnFailed) exitCode = chunk.code ?? 0;
+        break;
+      }
+      if (chunk.kind === "error") {
+        spawnFailed = true;
+        exitCode = 1;
+        continue;
+      }
+      pending += chunk.data;
+      if (pending.length >= flushAt) {
+        yield { type: "partial_output", text: pending };
+        pending = "";
+      }
+    }
+    if (pending.length > 0) {
+      yield { type: "partial_output", text: pending };
+    }
+    const spooled = spool.finalize();
+    return {
+      // The marker rides on stdout's tail so every consumer's head+tail
+      // normalization keeps it without per-tool changes.
+      stdout: spooled ? stdout + spoolNote(spooled) : stdout,
+      stderr,
+      exitCode,
+      truncated: stdout.length >= max || stderr.length >= max,
+      error,
+      spoolPath: spooled?.path,
+      spoolBytes: spooled?.bytes
+    };
+  } finally {
+    spool.finalize();
+    if (isWin) opts.signal.removeEventListener("abort", onAbort);
+    child.stdout?.off("data", onOut);
+    child.stderr?.off("data", onErr);
+    child.stdout?.destroy();
+    child.stderr?.destroy();
+    if (child.exitCode === null && !child.killed) {
+      if (typeof pid === "number") {
+        registry.kill(pid, { force: true });
+      } else {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+      }
+    }
+  }
+}
+var isWin;
+var init_spawn_stream = __esm({
+  "src/_spawn-stream.ts"() {
+    "use strict";
+    init_output_spool();
+    init_process_registry();
+    init_win32_resolve();
+    isWin = process.platform === "win32";
+  }
+});
 
-// src/outdated.ts
-async function detectPackageManager(cwd) {
-  const { stat } = await import('node:fs/promises');
+// src/languages/plan.ts
+import * as fs3 from "node:fs/promises";
+import * as path6 from "node:path";
+async function planLanguageOperation(options) {
+  validateOperationOptions(options.operation, options.operationOptions?.packages);
+  const detection = await detectLanguageWorkspaces(options);
+  const candidates = detection.workspaces.filter(
+    (workspace) => workspace.capabilities.includes(options.operation)
+  );
+  const selected = selectWorkspace(candidates, options);
+  if (selected.status !== "selected") return selected.result;
+  const profile = (options.profiles ?? languageProfileRegistry.list()).find(
+    (item) => item.id === selected.workspace.language
+  );
+  if (!profile) {
+    return {
+      status: "not_found",
+      reason: `Profile ${selected.workspace.language} is unavailable.`,
+      candidates
+    };
+  }
+  if ((profile.id === "typescript" || profile.id === "javascript") && options.operation !== "syntax" && selected.workspace.packageManager === void 0 && new Set(
+    selected.workspace.evidence.filter((evidence) => evidence.kind === "lockfile").map((evidence) => evidence.value.toLowerCase())
+  ).size > 1) {
+    return {
+      status: "unavailable",
+      workspace: selected.workspace,
+      unavailable: {
+        status: "unavailable",
+        profileId: profile.id,
+        workspaceId: selected.workspace.id,
+        operation: options.operation,
+        reason: "Conflicting Node lockfiles make the package manager ambiguous."
+      }
+    };
+  }
+  const resolver = profile.operations[options.operation];
+  if (!resolver) {
+    return {
+      status: "unavailable",
+      workspace: selected.workspace,
+      unavailable: {
+        status: "unavailable",
+        profileId: profile.id,
+        workspaceId: selected.workspace.id,
+        operation: options.operation,
+        reason: `${profile.displayName} does not define ${options.operation}.`
+      }
+    };
+  }
+  const canonicalCwd = options.cwd ? path6.isAbsolute(options.cwd) ? options.cwd : path6.resolve(detection.projectRoot, options.cwd) : detection.projectRoot;
+  const target = options.target ? await canonicalTarget(canonicalCwd, options.target, detection.projectRoot) : void 0;
+  const ctx = {
+    projectRoot: detection.projectRoot,
+    workspace: selected.workspace,
+    ...target ? { target } : {},
+    mode: options.mode ?? "standard",
+    options: options.operationOptions ?? {},
+    platform: process.platform,
+    pathExists: async (candidate) => {
+      try {
+        await fs3.access(path6.resolve(detection.projectRoot, candidate));
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+  const result = await resolver(ctx);
+  if ("status" in result) {
+    return { status: "unavailable", workspace: selected.workspace, unavailable: result };
+  }
+  const errors = validateCommandPlan(result, profile, detection.projectRoot);
+  if (errors.length > 0) {
+    return {
+      status: "unavailable",
+      workspace: selected.workspace,
+      unavailable: {
+        status: "unavailable",
+        profileId: profile.id,
+        workspaceId: selected.workspace.id,
+        operation: options.operation,
+        reason: `Generated plan failed validation: ${errors.join("; ")}`
+      }
+    };
+  }
+  return { status: "planned", workspace: selected.workspace, plan: Object.freeze(result) };
+}
+function validateCommandPlan(plan, profile, projectRoot) {
+  const errors = [];
+  if (plan.profileId !== profile.id) errors.push("profile id does not match");
+  if (!isInside2(plan.cwd, projectRoot)) errors.push("cwd is outside project root");
+  if (plan.args.length > MAX_ARGUMENTS) errors.push(`argument count exceeds ${MAX_ARGUMENTS}`);
+  if (plan.args.some((arg) => arg.length > MAX_ARGUMENT_LENGTH || /[\r\n\0]/.test(arg))) {
+    errors.push("arguments contain an invalid or oversized value");
+  }
+  if (!Number.isFinite(plan.timeoutMs) || plan.timeoutMs < 1 || plan.timeoutMs > 6e5) {
+    errors.push("timeout is outside 1..600000ms");
+  }
+  if (!Number.isFinite(plan.outputLimitBytes) || plan.outputLimitBytes < 1 || plan.outputLimitBytes > 1e6) {
+    errors.push("output limit is outside 1..1000000 bytes");
+  }
+  if (plan.kind === "internal") {
+    if (plan.command !== null || plan.args.length !== 0)
+      errors.push("internal plans cannot declare a command");
+  } else {
+    if (!plan.command || !profile.executables.includes(plan.command)) {
+      errors.push(`executable "${plan.command ?? ""}" is not allowlisted by the profile`);
+    }
+  }
+  if (Object.keys(plan.env).length > 0)
+    errors.push("Phase 1 plans cannot override environment variables");
+  return errors;
+}
+function selectWorkspace(candidates, options) {
+  if (candidates.length === 0) {
+    return {
+      status: "result",
+      result: {
+        status: "not_found",
+        reason: `No workspace supports ${options.operation}.`,
+        candidates: []
+      }
+    };
+  }
+  if (options.workspace) {
+    const requested = path6.isAbsolute(options.workspace) ? path6.resolve(options.workspace) : path6.resolve(options.projectRoot, options.workspace);
+    const matches = candidates.filter(
+      (item) => item.id === options.workspace || path6.resolve(item.root) === requested
+    );
+    if (matches.length === 1) return { status: "selected", workspace: matches[0] };
+    return {
+      status: "result",
+      result: {
+        status: "not_found",
+        reason: `Requested workspace "${options.workspace}" was not detected.`,
+        candidates: [...candidates]
+      }
+    };
+  }
+  if (options.target) {
+    const base = options.cwd ? path6.isAbsolute(options.cwd) ? path6.resolve(options.cwd) : path6.resolve(options.projectRoot, options.cwd) : path6.resolve(options.projectRoot);
+    const target = path6.isAbsolute(options.target) ? path6.resolve(options.target) : path6.resolve(base, options.target);
+    const targeted = candidates.filter((item) => item.evidence.some((evidence) => evidence.kind === "target")).sort(
+      (a, b) => workspaceDepth(b.root, options.projectRoot) - workspaceDepth(a.root, options.projectRoot) || compareCandidates(a, b)
+    );
+    if (targeted[0]) return { status: "selected", workspace: targeted[0] };
+    const containing = candidates.filter((item) => isInside2(target, item.root)).sort(
+      (a, b) => workspaceDepth(b.root, options.projectRoot) - workspaceDepth(a.root, options.projectRoot) || compareCandidates(a, b)
+    );
+    if (containing[0]) return { status: "selected", workspace: containing[0] };
+  }
+  const sorted = [...candidates].sort(compareCandidates);
+  const first = sorted[0];
+  const firstDepth = workspaceDepth(first.root, options.projectRoot);
+  const tied = sorted.filter(
+    (item) => item.confidence === first.confidence && workspaceDepth(item.root, options.projectRoot) === firstDepth
+  );
+  if (tied.length > 1) {
+    return {
+      status: "result",
+      result: {
+        status: "ambiguous",
+        reason: "Multiple workspaces have equal confidence; provide target, language, or workspace.",
+        candidates: tied
+      }
+    };
+  }
+  return { status: "selected", workspace: first };
+}
+function compareCandidates(a, b) {
+  return b.confidence - a.confidence || a.language.localeCompare(b.language) || a.root.localeCompare(b.root);
+}
+function workspaceDepth(workspaceRoot, projectRoot) {
+  const relative5 = path6.relative(path6.resolve(projectRoot), path6.resolve(workspaceRoot));
+  return relative5 === "" ? 0 : relative5.split(path6.sep).length;
+}
+function validateOperationOptions(operation, packages) {
+  if (!operation.startsWith("package-") || !packages) return;
+  for (const value of packages) {
+    if (!value || value.length > 214 || value.startsWith("-") || /[\r\n\0;&|`$<>\\]/.test(value)) {
+      throw new Error(`Invalid package identifier "${value}"`);
+    }
+    if (value.startsWith(".") || value.startsWith("/") || /^[A-Za-z]:/.test(value) || value.includes("://")) {
+      throw new Error(`Package paths and URLs are not supported: "${value}"`);
+    }
+    if (!PACKAGE_NAME_RE.test(value) && !COMPOSER_PACKAGE_RE.test(value) && !GO_MODULE_RE.test(value)) {
+      throw new Error(`Invalid package identifier "${value}"`);
+    }
+  }
+}
+async function canonicalTarget(cwd, target, projectRoot) {
+  const resolved = path6.isAbsolute(target) ? path6.resolve(target) : path6.resolve(cwd, target);
+  let real;
   try {
-    await stat(`${cwd}/pnpm-lock.yaml`);
-    return "pnpm";
-  } catch {
+    real = await fs3.realpath(resolved);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    const parent = await fs3.realpath(path6.dirname(resolved));
+    real = path6.join(parent, path6.basename(resolved));
+  }
+  if (!isInside2(real, projectRoot)) throw new Error(`target is outside project root: ${target}`);
+  return real;
+}
+function isInside2(candidate, root) {
+  const relative5 = path6.relative(path6.resolve(root), path6.resolve(candidate));
+  return relative5 === "" || !relative5.startsWith("..") && !path6.isAbsolute(relative5);
+}
+var MAX_ARGUMENTS, MAX_ARGUMENT_LENGTH, PACKAGE_NAME_RE, COMPOSER_PACKAGE_RE, GO_MODULE_RE;
+var init_plan = __esm({
+  "src/languages/plan.ts"() {
+    "use strict";
+    init_detect();
+    init_registry();
+    MAX_ARGUMENTS = 128;
+    MAX_ARGUMENT_LENGTH = 4096;
+    PACKAGE_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+(?:@[a-z0-9*+._~^<>=|-]+)?$/i;
+    COMPOSER_PACKAGE_RE = /^[a-z0-9_.-]+\/[a-z0-9_.-]+(?::[a-z0-9*+._~^<>=|-]+)?$/i;
+    GO_MODULE_RE = /^(?:[a-z0-9.-]+\.)+[a-z0-9.-]+\/[a-z0-9._~+/@-]+$/i;
+  }
+});
+
+// src/languages/execute.ts
+import * as fs4 from "node:fs/promises";
+import * as path7 from "node:path";
+async function* executeLanguagePlan(options) {
+  const { plan, workspace } = options;
+  if (options.signal.aborted) {
+    return terminalResult(options, "cancelled", options.signal.reason);
+  }
+  const profile = languageProfileRegistry.get(plan.profileId);
+  if (!profile) return unavailableResult(options, `Unknown language profile: ${plan.profileId}`);
+  if (workspace.id !== plan.workspaceId || workspace.language !== plan.profileId) {
+    return unavailableResult(options, "Plan and workspace identity do not match.");
+  }
+  const validation = validateCommandPlan(plan, profile, options.projectRoot);
+  if (validation.length > 0) {
+    return unavailableResult(options, `Plan failed execution validation: ${validation.join("; ")}`);
+  }
+  const containmentError = await validatePlanRealpaths(plan, options.projectRoot);
+  if (containmentError) return unavailableResult(options, containmentError);
+  if (plan.operation.startsWith("package-") || plan.network) {
+    return terminalNonPackageResult(
+      options,
+      "Package and network plans require the separate language_package tool (Phase 3)."
+    );
   }
+  const startedAt = Date.now();
+  yield {
+    type: "log",
+    text: plan.kind === "internal" ? `Running ${plan.parser}\u2026` : `${plan.command} ${plan.args.join(" ")}`,
+    data: { language: plan.profileId, operation: plan.operation, workspace: workspace.root }
+  };
+  if (plan.kind === "internal") {
+    try {
+      return await executeInternal(options, startedAt);
+    } catch (error) {
+      return unavailableResult(options, error instanceof Error ? error.message : String(error));
+    }
+  }
+  const timeoutController = new AbortController();
+  const timer = setTimeout(
+    () => timeoutController.abort(new Error("language plan timed out")),
+    plan.timeoutMs
+  );
+  timer.unref?.();
+  const signal = AbortSignal.any([options.signal, timeoutController.signal]);
+  let spawned;
   try {
-    await stat(`${cwd}/yarn.lock`);
-    return "yarn";
-  } catch {
+    const stream = spawnStream({
+      cmd: plan.command,
+      args: [...plan.args],
+      cwd: plan.cwd,
+      signal,
+      maxBytes: plan.outputLimitBytes
+    });
+    for (; ; ) {
+      const next = await stream.next();
+      if (next.done) {
+        spawned = next.value;
+        break;
+      }
+      yield next.value;
+    }
+  } catch (error) {
+    const timedOut2 = timeoutController.signal.aborted && !options.signal.aborted;
+    const cancelled2 = options.signal.aborted;
+    return {
+      status: timedOut2 ? "timed_out" : cancelled2 ? "cancelled" : "failed",
+      language: plan.profileId,
+      workspace,
+      plan,
+      exitCode: null,
+      durationMs: Date.now() - startedAt,
+      diagnostics: Object.freeze([]),
+      omittedDiagnostics: 0,
+      summary: emptySummary2(),
+      output: "",
+      truncated: false,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    clearTimeout(timer);
   }
-  return "npm";
+  const parsed = parseLanguageDiagnostics(
+    plan.parser,
+    spawned.stdout,
+    spawned.stderr,
+    workspace.root
+  );
+  const timedOut = timeoutController.signal.aborted && !options.signal.aborted;
+  const cancelled = options.signal.aborted;
+  const spawnUnavailable = Boolean(
+    spawned.error && /ENOENT|not found|cannot find/i.test(spawned.error)
+  );
+  const status = timedOut ? "timed_out" : cancelled ? "cancelled" : spawnUnavailable ? "unavailable" : spawned.exitCode === 0 ? "passed" : "failed";
+  const raw = [spawned.stdout, spawned.stderr, spawned.error].filter(Boolean).join("\n");
+  return {
+    status,
+    language: plan.profileId,
+    workspace,
+    plan,
+    exitCode: spawned.exitCode,
+    durationMs: Date.now() - startedAt,
+    diagnostics: parsed.diagnostics,
+    omittedDiagnostics: parsed.omitted,
+    summary: parsed.summary,
+    output: normalizeCommandOutput(raw, { maxBytes: plan.outputLimitBytes }),
+    truncated: spawned.truncated,
+    ...spawned.spoolPath ? { spoolPath: spawned.spoolPath } : {},
+    ...spawned.error ? { error: spawned.error } : {}
+  };
 }
-function resolvePath(input, ctx) {
-  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);
+async function executeInternal(options, startedAt) {
+  const target = options.plan.evidence.find((item) => item.kind === "target")?.path;
+  if (!target) return unavailableResult(options, "Internal syntax plan has no target evidence.");
+  const safeTarget = await assertContainedFile(target, options.projectRoot);
+  const stat5 = await fs4.stat(safeTarget);
+  if (stat5.size > MAX_INTERNAL_SOURCE_BYTES) {
+    return unavailableResult(
+      options,
+      `Internal syntax target exceeds ${MAX_INTERNAL_SOURCE_BYTES} bytes.`
+    );
+  }
+  const source = await fs4.readFile(safeTarget, "utf8");
+  const parsed = await diagnosticsForInternalSyntax(options.plan.profileId, safeTarget, source);
+  return {
+    status: parsed.summary.errors > 0 ? "failed" : "passed",
+    language: options.plan.profileId,
+    workspace: options.workspace,
+    plan: options.plan,
+    exitCode: parsed.summary.errors > 0 ? 1 : 0,
+    durationMs: Date.now() - startedAt,
+    diagnostics: parsed.diagnostics,
+    omittedDiagnostics: parsed.omitted,
+    summary: parsed.summary,
+    output: parsed.summary.errors > 0 ? `${parsed.summary.errors} syntax error(s) found.` : "Syntax check passed.",
+    truncated: false
+  };
 }
-function allowedRoots(ctx) {
-  return [path.resolve(ctx.projectRoot), path.resolve(Core.wstackGlobalRoot())];
+async function validatePlanRealpaths(plan, projectRoot) {
+  const realRoot = await fs4.realpath(projectRoot);
+  let realCwd;
+  try {
+    realCwd = await fs4.realpath(plan.cwd);
+  } catch (error) {
+    return `Plan cwd is unavailable: ${error instanceof Error ? error.message : String(error)}`;
+  }
+  if (!isRealInside(realCwd, realRoot)) return "Plan cwd resolves outside project root.";
+  for (const argument of plan.args) {
+    if (!path7.isAbsolute(argument)) continue;
+    try {
+      const realArgument = await fs4.realpath(argument);
+      if (!isRealInside(realArgument, realRoot)) {
+        return `Plan argument resolves outside project root: ${argument}`;
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        return `Plan argument could not be resolved safely: ${argument}`;
+      }
+    }
+  }
+  return void 0;
 }
-function isInsideAny(target, roots) {
-  return roots.some((root) => {
-    const rel = path.relative(root, target);
-    return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
-  });
+function isRealInside(candidate, root) {
+  const relative5 = path7.relative(root, candidate);
+  return relative5 === "" || !relative5.startsWith("..") && !path7.isAbsolute(relative5);
 }
-function ensureInsideRoot(absPath, ctx) {
-  const target = path.resolve(absPath);
-  if (ctx.allowOutsideProjectRoot) return target;
-  if (isInsideAny(target, allowedRoots(ctx))) return target;
-  throw new Error(`Path "${absPath}" is outside project root "${path.resolve(ctx.projectRoot)}"`);
+async function assertContainedFile(candidate, projectRoot) {
+  const realRoot = await fs4.realpath(projectRoot);
+  const realTarget = await fs4.realpath(candidate);
+  const relative5 = path7.relative(realRoot, realTarget);
+  if (relative5.startsWith("..") || path7.isAbsolute(relative5)) {
+    throw new Error(`Internal syntax target resolves outside project root: ${candidate}`);
+  }
+  return realTarget;
 }
-function safeResolve(input, ctx) {
-  return ensureInsideRoot(resolvePath(input, ctx), ctx);
+function terminalResult(options, status, reason) {
+  const message = reason instanceof Error ? reason.message : reason ? String(reason) : status;
+  return {
+    status,
+    language: options.plan.profileId,
+    workspace: options.workspace,
+    plan: options.plan,
+    exitCode: null,
+    durationMs: 0,
+    diagnostics: Object.freeze([]),
+    omittedDiagnostics: 0,
+    summary: emptySummary2(),
+    output: "",
+    truncated: false,
+    error: message
+  };
 }
-function resolveWin32Command(cmd) {
-  if (process.platform !== "win32") return cmd;
-  if (cmd.includes("/") || cmd.includes("\\") || path.extname(cmd.replace(/\//g, "\\"))) {
-    return cmd;
+function unavailableResult(options, reason) {
+  return {
+    status: "unavailable",
+    language: options.plan.profileId,
+    workspace: options.workspace,
+    plan: options.plan,
+    exitCode: null,
+    durationMs: 0,
+    diagnostics: Object.freeze([]),
+    omittedDiagnostics: 0,
+    summary: emptySummary2(),
+    output: reason,
+    truncated: false,
+    error: reason
+  };
+}
+function emptySummary2() {
+  return { errors: 0, warnings: 0, infos: 0 };
+}
+function terminalNonPackageResult(options, reason) {
+  return {
+    status: "unavailable",
+    language: options.plan.profileId,
+    workspace: options.workspace,
+    plan: options.plan,
+    exitCode: null,
+    durationMs: 0,
+    diagnostics: Object.freeze([]),
+    omittedDiagnostics: 0,
+    summary: emptySummary2(),
+    output: reason,
+    truncated: false,
+    error: reason
+  };
+}
+async function* executePackagePlan(options) {
+  const { plan, workspace } = options;
+  const startedAt = Date.now();
+  if (options.signal.aborted) {
+    yield { type: "log", text: "Run cancelled before execution." };
+    return terminalPackageResult(options, "cancelled", startedAt);
   }
-  const pathext = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC").toLowerCase().split(";");
-  const pathDirs = (process.env["PATH"] ?? "").split(path.delimiter);
-  for (const dir of pathDirs) {
-    const base = path.join(dir, cmd);
-    for (const ext of pathext) {
-      const full = `${base}${ext}`;
-      try {
-        fs.accessSync(full, fs.constants.X_OK);
-        return full;
-      } catch {
+  const profile = languageProfileRegistry.get(plan.profileId);
+  if (!profile) {
+    yield { type: "warning", text: `Unknown language profile: ${plan.profileId}` };
+    return terminalPackageResult(options, "unavailable", startedAt, "Unknown language profile.");
+  }
+  if (workspace.id !== plan.workspaceId || workspace.language !== plan.profileId) {
+    return terminalPackageResult(
+      options,
+      "unavailable",
+      startedAt,
+      "Plan and workspace identity do not match."
+    );
+  }
+  const validation = validateCommandPlan(plan, profile, options.projectRoot);
+  if (validation.length > 0) {
+    return terminalPackageResult(
+      options,
+      "unavailable",
+      startedAt,
+      `Plan failed execution validation: ${validation.join("; ")}`
+    );
+  }
+  const containmentError = await validatePlanRealpaths(plan, options.projectRoot);
+  if (containmentError) {
+    return terminalPackageResult(options, "unavailable", startedAt, containmentError);
+  }
+  const manifestsBefore = await snapshotPaths(workspace.manifests);
+  const lockfilePaths = collectLockfilePaths(workspace);
+  const lockfilesBefore = await snapshotPaths(lockfilePaths);
+  const manifestSizesBefore = await snapshotSizes(workspace.manifests);
+  const lockfileSizesBefore = await snapshotSizes(lockfilePaths);
+  yield {
+    type: "log",
+    text: plan.kind === "process" ? `${plan.command} ${plan.args.join(" ")}` : `${plan.parser}: ${plan.operation}`,
+    data: {
+      language: plan.profileId,
+      operation: plan.operation,
+      workspace: workspace.root,
+      packages: [...options.packages]
+    }
+  };
+  const timeoutController = new AbortController();
+  const timer = setTimeout(
+    () => timeoutController.abort(new Error("language package plan timed out")),
+    plan.timeoutMs
+  );
+  timer.unref?.();
+  const signal = AbortSignal.any([options.signal, timeoutController.signal]);
+  let spawned;
+  let run;
+  let status = "unavailable";
+  let error;
+  try {
+    if (plan.kind !== "process") {
+      return terminalPackageResult(
+        options,
+        "unavailable",
+        startedAt,
+        "Package operations require an executable plan; internal plans cannot mutate the manifest."
+      );
+    }
+    const stream = spawnStream({
+      cmd: plan.command,
+      args: [...plan.args],
+      cwd: plan.cwd,
+      signal,
+      maxBytes: plan.outputLimitBytes
+    });
+    for (; ; ) {
+      const next = await stream.next();
+      if (next.done) {
+        spawned = next.value;
+        break;
       }
+      yield next.value;
     }
+  } catch (error_) {
+    error = error_ instanceof Error ? error_.message : String(error_);
+  } finally {
+    clearTimeout(timer);
   }
-  return cmd;
+  if (spawned) {
+    const parsed = parseLanguageDiagnostics(
+      plan.parser,
+      spawned.stdout,
+      spawned.stderr,
+      workspace.root
+    );
+    const timedOut = timeoutController.signal.aborted && !options.signal.aborted;
+    const cancelled = options.signal.aborted;
+    const spawnUnavailable = Boolean(
+      spawned.error && /ENOENT|not found|cannot find/i.test(spawned.error)
+    );
+    status = timedOut ? "timed_out" : cancelled ? "cancelled" : spawnUnavailable ? "unavailable" : spawned.exitCode === 0 ? "passed" : "failed";
+    error ??= spawned.error;
+    const raw = [spawned.stdout, spawned.stderr, spawned.error].filter(Boolean).join("\n");
+    run = {
+      status,
+      language: plan.profileId,
+      workspace,
+      plan,
+      exitCode: spawned.exitCode,
+      durationMs: Date.now() - startedAt,
+      diagnostics: parsed.diagnostics,
+      omittedDiagnostics: parsed.omitted,
+      summary: parsed.summary,
+      output: normalizeCommandOutput(raw, { maxBytes: plan.outputLimitBytes }),
+      truncated: spawned.truncated,
+      ...spawned.spoolPath ? { spoolPath: spawned.spoolPath } : {},
+      ...spawned.error ? { error: spawned.error } : {}
+    };
+  } else {
+    status = options.signal.aborted ? "cancelled" : timeoutController.signal.aborted ? "timed_out" : "failed";
+  }
+  if (status !== "passed") {
+    return terminalPackageResult(
+      options,
+      status,
+      startedAt,
+      error,
+      run,
+      manifestsBefore,
+      lockfilesBefore
+    );
+  }
+  const manifestsAfter = await snapshotPaths(workspace.manifests);
+  const lockfilesAfter = await snapshotPaths(lockfilePaths);
+  const manifestSizesAfter = await snapshotSizes(workspace.manifests);
+  const lockfileSizesAfter = await snapshotSizes(lockfilePaths);
+  const manifestsChanged = await changedPaths(
+    manifestsBefore,
+    manifestsAfter,
+    manifestSizesBefore,
+    manifestSizesAfter
+  );
+  const lockfilesChanged = await changedPaths(
+    lockfilesBefore,
+    lockfilesAfter,
+    lockfileSizesBefore,
+    lockfileSizesAfter
+  );
+  const reports = parsePackageReports(plan.parser, spawned?.stdout ?? "", spawned?.stderr ?? "");
+  const mutations = packageMutationsFromInputs(options.packages, reports.outdated);
+  return {
+    workspace,
+    language: plan.profileId,
+    operation: plan.operation,
+    status,
+    ...run ? { run } : {},
+    durationMs: Date.now() - startedAt,
+    manifestsBefore,
+    lockfilesBefore,
+    manifestsAfter,
+    lockfilesAfter,
+    mutations,
+    vulnerabilities: reports.vulnerabilities,
+    outdated: reports.outdated,
+    manifestsChanged: Object.freeze(manifestsChanged),
+    lockfilesChanged: Object.freeze(lockfilesChanged)
+  };
 }
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
-function assertSafeWin32ShellArgs(args) {
-  for (const arg of args) {
-    if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
-      throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
-      );
+function packageMutationsFromInputs(inputs, outdated) {
+  const outdatedNames = new Set(outdated.map((entry) => entry.name));
+  return inputs.filter((name) => !outdatedNames.has(name)).map((name) => ({ name, requested: name, kind: "runtime" }));
+}
+async function snapshotPaths(paths) {
+  const existing = [];
+  for (const candidate of paths) {
+    try {
+      const stat5 = await fs4.stat(candidate);
+      if (!stat5.isFile()) continue;
+      existing.push(candidate);
+    } catch {
     }
   }
+  return Object.freeze(existing);
 }
-function buildWin32CmdShimInvocation(command, args = []) {
-  assertSafeWin32ShellArgs([command, ...args]);
-  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
+async function changedPaths(before, after, beforeSizes, afterSizes) {
+  const beforeSet = new Set(before);
+  const afterSet = new Set(after);
+  const changed = /* @__PURE__ */ new Set();
+  for (const path9 of after) {
+    if (!beforeSet.has(path9)) changed.add(path9);
+  }
+  for (const path9 of before) {
+    if (!afterSet.has(path9)) changed.add(path9);
+  }
+  if (beforeSizes && afterSizes) {
+    for (const path9 of after) {
+      if (beforeSizes.get(path9) !== afterSizes.get(path9)) changed.add(path9);
+    }
+  }
+  return [...changed].sort();
+}
+async function snapshotSizes(paths) {
+  const sizes = /* @__PURE__ */ new Map();
+  for (const candidate of paths) {
+    try {
+      const stat5 = await fs4.stat(candidate);
+      if (stat5.isFile()) sizes.set(candidate, stat5.size);
+    } catch {
+    }
+  }
+  return sizes;
+}
+function collectLockfilePaths(workspace) {
+  const explicit = workspace.evidence.filter((evidence) => evidence.kind === "lockfile").map((evidence) => evidence.path);
+  const detected = LOCKFILE_NAMES_BY_PROFILE.get(workspace.language)?.map(
+    (name) => path7.join(workspace.root, name)
+  ) ?? [];
+  const merged = /* @__PURE__ */ new Set();
+  for (const candidate of [...explicit, ...detected]) merged.add(candidate);
+  return Object.freeze([...merged]);
+}
+function terminalPackageResult(options, status, startedAt, error, run, manifestsBefore = [], lockfilesBefore = []) {
   return {
-    command: process.env["COMSPEC"] ?? "cmd.exe",
-    args: ["/d", "/c", line],
-    windowsVerbatimArguments: true
+    workspace: options.workspace,
+    language: options.plan.profileId,
+    operation: options.plan.operation,
+    status,
+    ...run ? { run } : {},
+    durationMs: Date.now() - startedAt,
+    manifestsBefore,
+    lockfilesBefore,
+    manifestsAfter: manifestsBefore,
+    lockfilesAfter: lockfilesBefore,
+    manifestsChanged: Object.freeze([]),
+    lockfilesChanged: Object.freeze([]),
+    mutations: Object.freeze([]),
+    vulnerabilities: Object.freeze([]),
+    outdated: Object.freeze([]),
+    ...error ? { error } : {}
   };
 }
-function quoteWin32CmdArg(arg) {
-  return `"${arg}"`;
+var MAX_INTERNAL_SOURCE_BYTES, LOCKFILE_NAMES_BY_PROFILE;
+var init_execute = __esm({
+  "src/languages/execute.ts"() {
+    "use strict";
+    init_spawn_stream();
+    init_util();
+    init_diagnostics();
+    init_plan();
+    init_registry();
+    MAX_INTERNAL_SOURCE_BYTES = 15e5;
+    LOCKFILE_NAMES_BY_PROFILE = /* @__PURE__ */ new Map([
+      ["typescript", ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"]],
+      ["javascript", ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"]],
+      ["go", ["go.sum"]],
+      ["rust", ["Cargo.lock"]],
+      ["php", ["composer.lock"]],
+      ["csharp", ["packages.lock.json"]]
+    ]);
+  }
+});
+
+// src/languages/execute-tool.ts
+function operationsFor(input) {
+  switch (input.action) {
+    case "check":
+      return input.check === "syntax" ? ["syntax"] : input.check === "semantic" ? ["semantic"] : ["syntax", "semantic"];
+    case "lint":
+      return ["lint"];
+    case "format":
+      return [input.formatCheck === false ? "format-write" : "format-check"];
+    case "test":
+      return [input.noRun ? "test-compile" : "test"];
+    case "build":
+      return ["build"];
+    case "debug":
+      if (input.debug === "race") return ["debug-race"];
+      if (input.debug === "test") return ["test-compile", "test"];
+      if (input.debug === "runtime") return ["semantic", "build", "test"];
+      return ["semantic"];
+  }
+}
+function operationOptions(input) {
+  return {
+    ...input.target ? { target: input.target } : {},
+    ...input.filter ? { filter: input.filter } : {},
+    ...input.coverage !== void 0 ? { coverage: input.coverage } : {},
+    ...input.noRun !== void 0 ? { noRun: input.noRun } : {}
+  };
+}
+function unavailableOutput(reason) {
+  return {
+    status: "unavailable",
+    runs: [],
+    diagnostics: Object.freeze([]),
+    summary: { runs: 0, passed: 0, failed: 0, errors: 0, warnings: 0 },
+    output: reason
+  };
 }
+function aggregateRuns(runs, unavailableReasons) {
+  if (runs.length === 0)
+    return unavailableOutput(
+      unavailableReasons.join("\n") || "No executable language operations were planned."
+    );
+  const diagnostics = Object.freeze(runs.flatMap((run) => [...run.diagnostics]));
+  const failed = runs.filter((run) => run.status === "failed").length;
+  const terminal = runs.find((run) => run.status === "cancelled" || run.status === "timed_out");
+  const unavailable2 = runs.filter((run) => run.status === "unavailable").length;
+  const status = terminal?.status ?? (failed > 0 ? "failed" : unavailableReasons.length > 0 || unavailable2 === runs.length ? "unavailable" : "passed");
+  return {
+    status,
+    language: runs[0].language,
+    workspace: runs[0].workspace.root,
+    runs,
+    diagnostics,
+    summary: {
+      runs: runs.length,
+      passed: runs.filter((run) => run.status === "passed").length,
+      failed,
+      errors: diagnostics.filter((item) => item.severity === "error").length,
+      warnings: diagnostics.filter((item) => item.severity === "warning").length
+    },
+    output: [
+      ...runs.map(
+        (run) => `${run.plan.operation}: ${run.status}${run.output ? `
+${run.output}` : ""}`
+      ),
+      ...unavailableReasons
+    ].join("\n\n")
+  };
+}
+var LANGUAGE_IDS, languageTool;
+var init_execute_tool = __esm({
+  "src/languages/execute-tool.ts"() {
+    "use strict";
+    init_util();
+    init_execute();
+    init_plan();
+    LANGUAGE_IDS = [
+      "typescript",
+      "javascript",
+      "go",
+      "rust",
+      "php",
+      "csharp",
+      "python",
+      "java",
+      "ruby",
+      "c",
+      "cpp",
+      "swift",
+      "dart",
+      "elixir",
+      "deno",
+      "shell"
+    ];
+    languageTool = {
+      name: "language",
+      category: "Code Quality",
+      description: "Execute predefined language-specific checks, linters, formatters, tests, builds, and debugging evidence.",
+      usageHint: "Use this instead of constructing compiler or test commands manually. The tool detects the workspace, builds an allowlisted argv plan, revalidates it, executes without a shell, and returns normalized diagnostics. Package and network operations are intentionally excluded.",
+      selection: {
+        doNotUseWhen: "You only need workspace detection/planning, or need to modify dependencies.",
+        useInstead: ["language_info", "install", "audit", "outdated"]
+      },
+      permission: "confirm",
+      mutating: true,
+      riskTier: "standard",
+      capabilities: ["shell.restricted", "fs.write"],
+      icon: "code",
+      timeoutMs: 6e5,
+      inputSchema: {
+        type: "object",
+        properties: {
+          action: {
+            type: "string",
+            enum: ["check", "lint", "format", "test", "build", "debug"],
+            description: "Language operation to execute."
+          },
+          cwd: { type: "string", description: "Directory inside the project." },
+          target: { type: "string", description: "Optional target file for workspace selection." },
+          language: { type: "string", enum: LANGUAGE_IDS, description: "Optional language filter." },
+          workspace: { type: "string", description: "Detected workspace id or root." },
+          mode: { type: "string", enum: ["fast", "standard", "thorough"] },
+          check: { type: "string", enum: ["syntax", "semantic", "all"] },
+          formatCheck: {
+            type: "boolean",
+            description: "Verify formatting without writing (default true)."
+          },
+          filter: {
+            type: "string",
+            description: "Validated test/debug filter passed to profile adapters."
+          },
+          coverage: { type: "boolean" },
+          noRun: { type: "boolean", description: "Compile tests without running when supported." },
+          debug: { type: "string", enum: ["compile", "test", "runtime", "race"] }
+        },
+        required: ["action"],
+        additionalProperties: false
+      },
+      validate(input) {
+        const errors = [];
+        if (input.action !== "check" && input.check)
+          errors.push("check is only valid when action=check");
+        if (input.action !== "format" && input.formatCheck !== void 0)
+          errors.push("formatCheck is only valid when action=format");
+        if (input.action !== "debug" && input.debug)
+          errors.push("debug is only valid when action=debug");
+        if (input.coverage) errors.push("coverage collection is not implemented in Phase 2");
+        if (input.noRun && input.action !== "test") errors.push("noRun is only valid when action=test");
+        if (input.filter && (input.filter.length > 500 || input.filter.startsWith("-") || /[\r\n\0;&|`$<>]/.test(input.filter)))
+          errors.push(
+            'filter must be at most 500 characters, not start with "-", and contain no shell/control characters'
+          );
+        return errors;
+      },
+      async execute(input, ctx, opts) {
+        let final;
+        const stream = languageTool.executeStream;
+        if (!stream) throw new Error("languageTool: stream execution unavailable");
+        for await (const event of stream(input, ctx, opts)) {
+          if (event.type === "final") final = event.output;
+        }
+        if (!final) throw new Error("language: stream ended without final event");
+        return final;
+      },
+      async *executeStream(input, ctx, opts) {
+        const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.workingDir ?? ctx.cwd;
+        const operations = operationsFor(input);
+        const runs = [];
+        const unavailableReasons = [];
+        for (const operation of operations) {
+          opts.signal.throwIfAborted();
+          const planResult = await planLanguageOperation({
+            projectRoot: ctx.projectRoot,
+            cwd,
+            operation,
+            ...input.target ? { target: input.target } : {},
+            ...input.language ? { language: input.language } : {},
+            ...input.workspace ? { workspace: input.workspace } : {},
+            ...input.mode ? { mode: input.mode } : {},
+            operationOptions: operationOptions(input),
+            signal: opts.signal
+          });
+          if (planResult.status !== "planned") {
+            const reason = planResult.status === "unavailable" ? planResult.unavailable.reason : planResult.reason;
+            if (runs.length === 0) {
+              return yield {
+                type: "final",
+                output: unavailableOutput(reason)
+              };
+            }
+            unavailableReasons.push(`${operation}: ${reason}`);
+            yield { type: "warning", text: `${operation}: ${reason}` };
+            continue;
+          }
+          const runner = executeLanguagePlan({
+            projectRoot: ctx.projectRoot,
+            workspace: planResult.workspace,
+            plan: planResult.plan,
+            signal: opts.signal
+          });
+          for (; ; ) {
+            const next = await runner.next();
+            if (next.done) {
+              runs.push(next.value);
+              if (next.value.plan.kind === "process") {
+                ctx.recordSideEffect?.({
+                  toolUseId: `language-${Date.now()}-${runs.length}`,
+                  toolName: "language",
+                  ts: (/* @__PURE__ */ new Date()).toISOString(),
+                  input: {
+                    language: next.value.language,
+                    operation: next.value.plan.operation,
+                    command: next.value.plan.command,
+                    args: next.value.plan.args,
+                    cwd: next.value.plan.cwd
+                  },
+                  outcome: `${next.value.status}${next.value.exitCode === null ? "" : ` (exit ${next.value.exitCode})`}`,
+                  risk: "shell"
+                });
+              }
+              break;
+            }
+            yield next.value;
+          }
+          const last = runs.at(-1);
+          if (last.status === "cancelled" || last.status === "timed_out") break;
+          if (last.status === "failed" && input.mode !== "thorough") break;
+        }
+        yield { type: "final", output: aggregateRuns(runs, unavailableReasons) };
+      },
+      serialize(output) {
+        const lines = [
+          `status=${output.status} runs=${output.summary.runs} passed=${output.summary.passed} failed=${output.summary.failed}`,
+          `diagnostics: ${output.summary.errors} error(s), ${output.summary.warnings} warning(s)`
+        ];
+        for (const diagnostic of output.diagnostics.slice(0, 20)) {
+          const location = diagnostic.file ? `${diagnostic.file}${diagnostic.range ? `:${diagnostic.range.start.line}:${diagnostic.range.start.column}` : ""}` : diagnostic.source;
+          lines.push(
+            `${diagnostic.severity.toUpperCase()} ${location}${diagnostic.code ? ` ${diagnostic.code}` : ""}: ${diagnostic.message}`
+          );
+        }
+        if (output.diagnostics.length > 20)
+          lines.push(`\u2026 ${output.diagnostics.length - 20} more diagnostic(s)`);
+        if (output.output) lines.push(output.output);
+        return lines.join("\n");
+      }
+    };
+  }
+});
+
+// src/languages/package-tool.ts
+function aggregateOutcome(outcome) {
+  return {
+    status: outcome.status,
+    language: outcome.language,
+    workspace: outcome.workspace.root,
+    operation: outcome.operation,
+    outcome,
+    mutations: Object.freeze([...outcome.mutations]),
+    vulnerabilities: Object.freeze([...outcome.vulnerabilities]),
+    outdated: Object.freeze([...outcome.outdated]),
+    manifestsChanged: [...outcome.manifestsChanged],
+    lockfilesChanged: [...outcome.lockfilesChanged],
+    output: outputSummary(outcome),
+    ...outcome.run?.output ? { error: void 0 } : {}
+  };
+}
+function outputSummary(outcome) {
+  const lines = [
+    `${outcome.operation} on ${outcome.workspace.root}: ${outcome.status}`,
+    `manifestsChanged: ${outcome.manifestsChanged.join(", ") || "\u2205"}`,
+    `lockfilesChanged: ${outcome.lockfilesChanged.join(", ") || "\u2205"}`
+  ];
+  for (const mutation of outcome.mutations) {
+    lines.push(`+ ${mutation.name}${mutation.resolved ? `@${mutation.resolved}` : ""}`);
+  }
+  for (const vuln of outcome.vulnerabilities) {
+    lines.push(`! ${vuln.package} (${vuln.severity})${vuln.advisory ? ` ${vuln.advisory}` : ""}`);
+  }
+  for (const outdated of outcome.outdated) {
+    lines.push(`= ${outdated.name}: ${outdated.previous ?? "?"} \u2192 ${outdated.resolved ?? "?"}`);
+  }
+  if (outcome.run?.output) lines.push(outcome.run.output);
+  return lines.join("\n");
+}
+var LANGUAGE_IDS2, SUPPORTED_OPERATIONS, OPERATION_TO_PLAN, languagePackageTool;
+var init_package_tool = __esm({
+  "src/languages/package-tool.ts"() {
+    "use strict";
+    init_util();
+    init_execute();
+    init_plan();
+    LANGUAGE_IDS2 = [
+      "typescript",
+      "javascript",
+      "go",
+      "rust",
+      "php",
+      "csharp",
+      "python",
+      "java",
+      "ruby",
+      "c",
+      "cpp",
+      "swift",
+      "dart",
+      "elixir",
+      "deno",
+      "shell"
+    ];
+    SUPPORTED_OPERATIONS = /* @__PURE__ */ new Set([
+      "install",
+      "add",
+      "remove",
+      "update",
+      "audit",
+      "outdated"
+    ]);
+    OPERATION_TO_PLAN = {
+      install: "package-install",
+      add: "package-add",
+      remove: "package-remove",
+      update: "package-update",
+      audit: "package-audit",
+      outdated: "package-outdated"
+    };
+    languagePackageTool = {
+      name: "language_package",
+      category: "Package Management",
+      description: "Restore, mutate, audit, or report outdated packages via predefined ecosystem-specific plans.",
+      usageHint: "Use this instead of the legacy `install`/`audit`/`outdated` tools. The tool detects the workspace, builds an allowlisted argv plan with lifecycle scripts disabled, runs it, and records manifest/lockfile changes.",
+      selection: {
+        doNotUseWhen: "You only need to inspect or plan, or need to compile/test/lint without touching dependencies.",
+        useInstead: ["language_info", "language", "install", "audit", "outdated"]
+      },
+      permission: "confirm",
+      mutating: true,
+      riskTier: "destructive",
+      capabilities: ["shell.restricted", "fs.write", "net.outbound", "package.install"],
+      icon: "package",
+      timeoutMs: 6e5,
+      inputSchema: {
+        type: "object",
+        properties: {
+          operation: {
+            type: "string",
+            enum: ["install", "add", "remove", "update", "audit", "outdated"],
+            description: "Package management operation to perform."
+          },
+          cwd: { type: "string", description: "Directory inside the project." },
+          language: {
+            type: "string",
+            enum: LANGUAGE_IDS2,
+            description: "Optional language profile filter."
+          },
+          workspace: { type: "string", description: "Detected workspace id or root." },
+          names: {
+            type: "array",
+            items: { type: "string" },
+            description: "Validated package names. Required for add/remove/update; optional for install."
+          },
+          scope: {
+            type: "string",
+            enum: ["runtime", "development", "optional"],
+            description: "Where to record the dependency (add/update)."
+          },
+          dryRun: {
+            type: "boolean",
+            description: "Preview the install without modifying the workspace."
+          },
+          allowScripts: {
+            type: "boolean",
+            description: "Opt in to running package lifecycle scripts (preinstall/install/postinstall). Default false."
+          }
+        },
+        required: ["operation"],
+        additionalProperties: false
+      },
+      validate(input) {
+        const errors = [];
+        if (!SUPPORTED_OPERATIONS.has(input.operation))
+          errors.push(`Unsupported package operation: ${String(input.operation)}`);
+        if ((input.operation === "add" || input.operation === "remove") && (!input.names || input.names.length === 0)) {
+          errors.push(`operation=${input.operation} requires at least one name in names`);
+        }
+        for (const name of input.names ?? []) {
+          if (typeof name !== "string" || !name) {
+            errors.push("names must contain only non-empty strings");
+            break;
+          }
+        }
+        return errors;
+      },
+      async execute(input, ctx, opts) {
+        let final;
+        const stream = languagePackageTool.executeStream;
+        if (!stream) throw new Error("languagePackageTool: stream execution unavailable");
+        for await (const event of stream(input, ctx, opts)) {
+          if (event.type === "final") final = event.output;
+        }
+        if (!final) throw new Error("language_package: stream ended without final event");
+        return final;
+      },
+      async *executeStream(input, ctx, opts) {
+        const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.workingDir ?? ctx.cwd;
+        const planOperation = OPERATION_TO_PLAN[input.operation];
+        const operationOptions2 = {
+          ...input.names ? { packages: input.names } : {},
+          ...input.scope ? { packageScope: input.scope } : {},
+          ...input.dryRun !== void 0 ? { allowScripts: input.dryRun } : { allowScripts: false },
+          ...input.allowScripts !== void 0 ? { allowScripts: input.allowScripts } : {}
+        };
+        const planResult = await planLanguageOperation({
+          projectRoot: ctx.projectRoot,
+          cwd,
+          operation: planOperation,
+          ...input.language ? { language: input.language } : {},
+          ...input.workspace ? { workspace: input.workspace } : {},
+          operationOptions: operationOptions2,
+          signal: opts.signal
+        });
+        if (planResult.status !== "planned") {
+          const reason = planResult.status === "unavailable" ? planResult.unavailable.reason : planResult.reason;
+          yield {
+            type: "final",
+            output: {
+              status: "unavailable",
+              mutations: [],
+              vulnerabilities: [],
+              outdated: [],
+              manifestsChanged: [],
+              lockfilesChanged: [],
+              output: reason,
+              error: reason
+            }
+          };
+          return;
+        }
+        const runner = executePackagePlan({
+          projectRoot: ctx.projectRoot,
+          workspace: planResult.workspace,
+          plan: planResult.plan,
+          packages: input.names ?? [],
+          signal: opts.signal
+        });
+        let outcome;
+        for (; ; ) {
+          const next = await runner.next();
+          if (next.done) {
+            outcome = next.value;
+            break;
+          }
+          yield next.value;
+        }
+        if (!outcome) {
+          yield {
+            type: "final",
+            output: {
+              status: "unavailable",
+              mutations: [],
+              vulnerabilities: [],
+              outdated: [],
+              manifestsChanged: [],
+              lockfilesChanged: [],
+              output: "Language package plan produced no outcome."
+            }
+          };
+          return;
+        }
+        const final = aggregateOutcome(outcome);
+        if (outcome.run?.plan.kind === "process") {
+          ctx.recordSideEffect?.({
+            toolUseId: `language_package-${Date.now()}`,
+            toolName: "language_package",
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            input: {
+              language: outcome.language,
+              operation: outcome.operation,
+              command: outcome.run.plan.command,
+              args: outcome.run.plan.args,
+              cwd: outcome.run.plan.cwd,
+              dryRun: input.dryRun ?? false
+            },
+            outcome: `${final.status}${outcome.run.exitCode === null ? "" : ` (exit ${outcome.run.exitCode})`}`,
+            risk: "package"
+          });
+        }
+        yield { type: "final", output: final };
+      },
+      serialize(output) {
+        const lines = [
+          `status=${output.status} operation=${output.operation ?? "unknown"} mutations=${output.mutations.length} vulnerabilities=${output.vulnerabilities.length} outdated=${output.outdated.length}`,
+          `manifestsChanged: ${output.manifestsChanged.join(", ") || "\u2205"}`,
+          `lockfilesChanged: ${output.lockfilesChanged.join(", ") || "\u2205"}`
+        ];
+        for (const mutation of output.mutations) {
+          lines.push(`+ ${mutation.name}${mutation.resolved ? `@${mutation.resolved}` : ""}`);
+        }
+        for (const outdated of output.outdated) {
+          lines.push(`= ${outdated.name}: ${outdated.previous ?? "?"} \u2192 ${outdated.resolved ?? "?"}`);
+        }
+        for (const vuln of output.vulnerabilities) {
+          lines.push(`! ${vuln.package} (${vuln.severity}) ${vuln.advisory ?? ""}`);
+        }
+        if (output.output) lines.push(output.output);
+        return lines.join("\n");
+      }
+    };
+  }
+});
+
+// src/languages/tool.ts
+var LANGUAGE_IDS3, OPERATIONS, languageInfoTool;
+var init_tool = __esm({
+  "src/languages/tool.ts"() {
+    "use strict";
+    init_util();
+    init_detect();
+    init_plan();
+    init_registry();
+    LANGUAGE_IDS3 = [
+      "typescript",
+      "javascript",
+      "go",
+      "rust",
+      "php",
+      "csharp",
+      "python",
+      "java",
+      "ruby",
+      "c",
+      "cpp",
+      "swift",
+      "dart",
+      "elixir",
+      "deno",
+      "shell"
+    ];
+    OPERATIONS = [
+      "syntax",
+      "semantic",
+      "lint",
+      "format-check",
+      "format-write",
+      "test-compile",
+      "test",
+      "build",
+      "run",
+      "debug-compile",
+      "debug-test",
+      "debug-runtime",
+      "debug-race",
+      "package-install",
+      "package-add",
+      "package-remove",
+      "package-update",
+      "package-audit",
+      "package-outdated"
+    ];
+    languageInfoTool = {
+      name: "language_info",
+      category: "Code Quality",
+      description: "Detect language workspaces and preview predefined language-specific command plans without executing them.",
+      usageHint: "Use `detect` to find TypeScript/JavaScript, Go, Rust, PHP, and C# workspaces. Use `plan` to obtain an exact, validated argv plan before choosing an execution tool. This tool never spawns a process or modifies files.",
+      selection: {
+        doNotUseWhen: "You need to execute a compiler, test runner, formatter, or package manager.",
+        useInstead: ["exec", "typecheck", "lint", "format", "test", "install"]
+      },
+      permission: "auto",
+      mutating: false,
+      riskTier: "safe",
+      capabilities: ["fs.read"],
+      icon: "code",
+      timeoutMs: 3e4,
+      inputSchema: {
+        type: "object",
+        properties: {
+          action: {
+            type: "string",
+            enum: ["detect", "plan", "capabilities"],
+            description: "Read-only action to perform."
+          },
+          cwd: { type: "string", description: "Directory inside the project to inspect." },
+          target: { type: "string", description: "Optional target file used for workspace selection." },
+          language: {
+            type: "string",
+            enum: LANGUAGE_IDS3,
+            description: "Optional language profile filter."
+          },
+          workspace: { type: "string", description: "Workspace id or root returned by detect." },
+          operation: {
+            type: "string",
+            enum: OPERATIONS,
+            description: "Operation to preview when action=plan."
+          },
+          mode: {
+            type: "string",
+            enum: ["fast", "standard", "thorough"],
+            description: "Planning mode."
+          },
+          options: {
+            type: "object",
+            properties: {
+              target: { type: "string" },
+              filter: { type: "string" },
+              coverage: { type: "boolean" },
+              noRun: { type: "boolean" },
+              packages: { type: "array", items: { type: "string" } },
+              packageScope: { type: "string", enum: ["runtime", "development", "optional"] },
+              allowScripts: { type: "boolean" }
+            },
+            additionalProperties: false
+          }
+        },
+        required: ["action"],
+        additionalProperties: false
+      },
+      validate(input) {
+        const errors = [];
+        if (input.action === "plan" && !input.operation)
+          errors.push("operation is required when action=plan");
+        if (input.action !== "plan" && input.operation)
+          errors.push("operation is only valid when action=plan");
+        if (input.action !== "plan" && input.options)
+          errors.push("options are only valid when action=plan");
+        return errors;
+      },
+      async execute(input, ctx, opts) {
+        if (input.action === "capabilities") {
+          return {
+            action: "capabilities",
+            profiles: languageProfileRegistry.list().map((profile) => ({
+              id: profile.id,
+              displayName: profile.displayName,
+              extensions: profile.extensions,
+              operations: Object.keys(profile.operations).sort(),
+              packageManagers: profile.packageManagers
+            }))
+          };
+        }
+        const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.workingDir ?? ctx.cwd;
+        const common = {
+          projectRoot: ctx.projectRoot,
+          cwd,
+          ...input.target ? { target: input.target } : {},
+          ...input.language ? { language: input.language } : {},
+          signal: opts.signal
+        };
+        if (input.action === "detect") {
+          return { action: "detect", ...await detectLanguageWorkspaces(common) };
+        }
+        const result = await planLanguageOperation({
+          ...common,
+          operation: input.operation,
+          ...input.workspace ? { workspace: input.workspace } : {},
+          ...input.mode ? { mode: input.mode } : {},
+          ...input.options ? { operationOptions: input.options } : {}
+        });
+        return { action: "plan", ...result };
+      }
+    };
+  }
+});
+
+// src/languages/index.ts
+var languages_exports = {};
+__export(languages_exports, {
+  ADDITIONAL_LANGUAGE_PROFILES: () => ADDITIONAL_LANGUAGE_PROFILES,
+  LanguageProfileRegistry: () => LanguageProfileRegistry,
+  PRIMARY_LANGUAGE_PROFILES: () => PRIMARY_LANGUAGE_PROFILES,
+  detectLanguageWorkspaces: () => detectLanguageWorkspaces,
+  diagnosticsForInternalSyntax: () => diagnosticsForInternalSyntax,
+  executeLanguagePlan: () => executeLanguagePlan,
+  executePackagePlan: () => executePackagePlan,
+  languageInfoTool: () => languageInfoTool,
+  languagePackageTool: () => languagePackageTool,
+  languageProfileRegistry: () => languageProfileRegistry,
+  languageTool: () => languageTool,
+  parseLanguageDiagnostics: () => parseLanguageDiagnostics,
+  parsePackageReports: () => parsePackageReports,
+  planLanguageOperation: () => planLanguageOperation,
+  validateCommandPlan: () => validateCommandPlan,
+  validateLanguageProfile: () => validateLanguageProfile
+});
+var init_languages = __esm({
+  "src/languages/index.ts"() {
+    "use strict";
+    init_detect();
+    init_diagnostics();
+    init_execute();
+    init_execute_tool();
+    init_package_tool();
+    init_plan();
+    init_additional();
+    init_primary();
+    init_registry();
+    init_tool();
+  }
+});
+
+// src/languages/legacy-bridge.ts
+var legacy_bridge_exports = {};
+__export(legacy_bridge_exports, {
+  detectNonJsEcosystem: () => detectNonJsEcosystem,
+  tryLegacyCodeOperation: () => tryLegacyCodeOperation,
+  tryLegacyPackageOperation: () => tryLegacyPackageOperation
+});
+import * as fs5 from "node:fs/promises";
+import * as path8 from "node:path";
+async function detectNonJsEcosystem(cwd, projectRoot) {
+  try {
+    let dir = path8.resolve(cwd);
+    const root = path8.resolve(projectRoot);
+    for (let depth = 0; depth <= 4 && dir.startsWith(root); depth++) {
+      for (const marker of NON_JS_MARKERS) {
+        try {
+          const s = await fs5.stat(path8.join(dir, marker.filename));
+          if (s.isFile()) return marker.language;
+        } catch {
+        }
+      }
+      try {
+        const entries = await fs5.readdir(dir);
+        for (const entry of entries) {
+          for (const suffix of NON_JS_SUFFIXES) {
+            if (entry.toLowerCase().endsWith(suffix.suffix)) return suffix.language;
+          }
+        }
+      } catch {
+      }
+      if (dir === root) break;
+      dir = path8.dirname(dir);
+    }
+  } catch {
+  }
+  return null;
+}
+async function tryLegacyCodeOperation(operation, ctx) {
+  const language = await detectNonJsEcosystem(ctx.cwd, ctx.projectRoot);
+  if (!language) return null;
+  const planResult = await planLanguageOperation({
+    projectRoot: ctx.projectRoot,
+    cwd: ctx.cwd,
+    operation,
+    language,
+    ...ctx.target ? { target: ctx.target } : {},
+    signal: ctx.signal
+  });
+  if (planResult.status !== "planned") return null;
+  const runner = executeLanguagePlan({
+    projectRoot: ctx.projectRoot,
+    workspace: planResult.workspace,
+    plan: planResult.plan,
+    signal: ctx.signal
+  });
+  for (; ; ) {
+    const next = await runner.next();
+    if (next.done) return { language, run: next.value };
+  }
+}
+async function tryLegacyPackageOperation(operation, ctx, packages = []) {
+  const language = await detectNonJsEcosystem(ctx.cwd, ctx.projectRoot);
+  if (!language) return null;
+  const planResult = await planLanguageOperation({
+    projectRoot: ctx.projectRoot,
+    cwd: ctx.cwd,
+    operation,
+    language,
+    signal: ctx.signal,
+    ...packages.length > 0 ? { operationOptions: { packages: [...packages] } } : {}
+  });
+  if (planResult.status !== "planned") return null;
+  const runner = executePackagePlan({
+    projectRoot: ctx.projectRoot,
+    workspace: planResult.workspace,
+    plan: planResult.plan,
+    packages,
+    signal: ctx.signal
+  });
+  for (; ; ) {
+    const next = await runner.next();
+    if (next.done) return { language, outcome: next.value };
+  }
+}
+var NON_JS_MARKERS, NON_JS_SUFFIXES;
+var init_legacy_bridge = __esm({
+  "src/languages/legacy-bridge.ts"() {
+    "use strict";
+    init_languages();
+    NON_JS_MARKERS = [
+      { filename: "go.mod", language: "go" },
+      { filename: "go.work", language: "go" },
+      { filename: "Cargo.toml", language: "rust" },
+      { filename: "composer.json", language: "php" }
+    ];
+    NON_JS_SUFFIXES = [
+      { suffix: ".csproj", language: "csharp" },
+      { suffix: ".fsproj", language: "csharp" }
+    ];
+  }
+});
 
 // src/outdated.ts
+init_util();
+init_win32_resolve();
+import { spawn as spawn3 } from "node:child_process";
+import { buildChildEnv as buildChildEnv2 } from "@wrongstack/core";
 var outdatedTool = {
   name: "outdated",
   category: "Package Management",
@@ -132,6 +4783,57 @@ var outdatedTool = {
   async execute(input, ctx, opts) {
     const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
     const manager = await detectPackageManager(cwd);
+    if (manager === "npm") {
+      try {
+        const { detectNonJsEcosystem: detectNonJsEcosystem2 } = await Promise.resolve().then(() => (init_legacy_bridge(), legacy_bridge_exports));
+        const nonJs = await detectNonJsEcosystem2(cwd, ctx.projectRoot);
+        if (nonJs) {
+          const { planLanguageOperation: planLanguageOperation2, executePackagePlan: executePackagePlan2 } = await Promise.resolve().then(() => (init_languages(), languages_exports));
+          const planResult = await planLanguageOperation2({
+            projectRoot: ctx.projectRoot,
+            cwd,
+            operation: "package-outdated",
+            language: nonJs,
+            signal: opts.signal
+          });
+          if (planResult.status === "planned") {
+            const runner = executePackagePlan2({
+              projectRoot: ctx.projectRoot,
+              workspace: planResult.workspace,
+              plan: planResult.plan,
+              packages: [],
+              signal: opts.signal
+            });
+            let outcome = null;
+            for (; ; ) {
+              const next = await runner.next();
+              if (next.done) {
+                outcome = next.value;
+                break;
+              }
+            }
+            if (outcome) {
+              const packages = outcome.outdated.map((o) => ({
+                name: o.name,
+                current: o.previous ?? "unknown",
+                latest: o.resolved ?? "unknown",
+                wanted: o.requested ?? o.resolved ?? "unknown",
+                type: "unknown",
+                location: o.name
+              }));
+              return {
+                exit_code: outcome.run?.exitCode ?? 0,
+                packages,
+                total: packages.length,
+                output: outcome.run?.output ?? (packages.length === 0 ? "All packages up to date" : ""),
+                truncated: outcome.run?.truncated ?? false
+              };
+            }
+          }
+        }
+      } catch {
+      }
+    }
     const args = ["outdated", "--json"];
     if (input.format === "table") args.push("--table");
     if (input.include_deprecated) args.push("--include", "deprecated");
@@ -139,7 +4841,7 @@ var outdatedTool = {
   }
 };
 function runOutdated(manager, args, cwd, signal) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve6) => {
     let stdout = "";
     let stderr = "";
     const MAX = 1e5;
@@ -148,7 +4850,14 @@ function runOutdated(manager, args, cwd, signal) {
     const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
     const spawnCmd = shim?.command ?? resolved;
     const spawnArgs = shim?.args ?? args;
-    const child = spawn(spawnCmd, spawnArgs, { cwd, signal, env: buildChildEnv(), stdio: ["ignore", "pipe", "pipe"], windowsHide: true, ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {} });
+    const child = spawn3(spawnCmd, spawnArgs, {
+      cwd,
+      signal,
+      env: buildChildEnv2(),
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+      ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
+    });
     child.stdout?.on("data", (c) => {
       if (stdout.length < MAX) stdout += c.toString();
     });
@@ -157,10 +4866,10 @@ function runOutdated(manager, args, cwd, signal) {
     });
     child.on("close", (code) => {
       const result = parseOutdatedOutput(stdout, code ?? 0);
-      resolve2(result);
+      resolve6(result);
     });
     child.on("error", (e) => {
-      resolve2({
+      resolve6({
         exit_code: 1,
         packages: [],
         total: 0,
@@ -204,7 +4913,7 @@ function parseOutdatedOutput(json, exitCode) {
     truncated: json.length >= 1e5
   };
 }
-
-export { outdatedTool };
+export {
+  outdatedTool
+};
 //# sourceMappingURL=outdated.js.map
-//# sourceMappingURL=outdated.js.map