@wrongstack/tools 0.284.1 → 0.286.0

package/dist/diff.js.map

@@ -1 +1,7 @@
-{"version":3,"sources":["../src/_util.ts","../src/diff.ts"],"names":["stat","path2","resolve"],"mappings":";;;;;;;;AAwCO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAY,IAAA,CAAA,UAAA,CAAW,KAAK,CAAA,GAAS,IAAA,CAAA,SAAA,CAAU,KAAK,CAAA,GAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,UAAA,IAAc,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AACvG;AAOA,SAAS,aAAa,GAAA,EAAwB;AAC5C,EAAA,OAAO,CAAM,aAAQ,GAAA,CAAI,WAAW,GAAQ,IAAA,CAAA,OAAA,CAAa,IAAA,CAAA,gBAAA,EAAkB,CAAC,CAAA;AAC9E;AAGA,SAAS,WAAA,CAAY,QAAgB,KAAA,EAA0B;AAC7D,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,IAAA,KAAS;AAC1B,IAAA,MAAM,GAAA,GAAW,IAAA,CAAA,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AACtC,IAAA,OAAO,GAAA,KAAQ,MAAO,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAAM,IAAA,CAAA,UAAA,CAAW,GAAG,CAAA;AAAA,EACrE,CAAC,CAAA;AACH;AAEO,SAAS,gBAAA,CAAiB,SAAiB,GAAA,EAAsB;AACtE,EAAA,MAAM,MAAA,GAAc,aAAQ,OAAO,CAAA;AAEnC,EAAA,IAAI,GAAA,CAAI,yBAAyB,OAAO,MAAA;AACxC,EAAA,IAAI,YAAY,MAAA,EAAQ,YAAA,CAAa,GAAG,CAAC,GAAG,OAAO,MAAA;AACnD,EAAA,MAAM,IAAI,MAAM,CAAA,MAAA,EAAS,OAAO,8BAAmC,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAC,CAAA,CAAA,CAAG,CAAA;AAChG;AAEO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAO,gBAAA,CAAiB,WAAA,CAAY,KAAA,EAAO,GAAG,GAAG,GAAG,CAAA;AACtD;;;AC9CO,IAAM,QAAA,GAAwC;AAAA,EACnD,IAAA,EAAM,MAAA;AAAA,EACN,QAAA,EAAU,YAAA;AAAA,EACV,WAAA,EACE,sKAAA;AAAA,EACF,SAAA,EACE,koBAAA;AAAA,EAUF,UAAA,EAAY,MAAA;AAAA,EACZ,QAAA,EAAU,KAAA;AAAA,EACV,YAAA,EAAc,CAAC,SAAS,CAAA;AAAA,EACxB,IAAA,EAAM,MAAA;AAAA,EACN,SAAA,EAAW,GAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,IAAA,EAAM;AAAA,QACJ,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,CAAA,EAAG;AAAA,QACD,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,CAAA,EAAG;AAAA,QACD,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,IAAA,EAAM;AAAA,QACJ,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,SAAA,EAAW,cAAA,EAAgB,MAAM,CAAA;AAAA,QACxC,WAAA,EAAa;AAAA,OACf;AAAA,MACA,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf;AACF,GACF;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,KAAA,CAAM,CAAA,KAAM,MAAA,IAAa,KAAA,CAAM,MAAM,MAAA,EAAW;AAClD,MAAA,OAAO,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,KAAK,MAAM,CAAA;AAAA,IAC9C;AAEA,IAAA,OAAO,MAAM,QAAA,CAAS,KAAA,EAAO,GAAA,EAAK,KAAK,MAAM,CAAA;AAAA,EAC/C;AACF;AAEA,eAAe,OAAA,CACb,KAAA,EACA,GAAA,EACA,MAAA,EACqB;AAOrB,EAAA,IAAI,KAAA,CAAM,CAAA,EAAG,UAAA,CAAW,GAAG,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,KAAA,CAAM,CAAC,CAAA,qDAAA,CAAkD,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,KAAA,CAAM,CAAA,EAAG,UAAA,CAAW,GAAG,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,KAAA,CAAM,CAAC,CAAA,qDAAA,CAAkD,CAAA;AAAA,EAChG;AAEA,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA;AACjC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,EAAE,MAAM,EAAA,EAAI,KAAA,EAAO,EAAC,EAAG,SAAA,EAAW,KAAA,EAAO,IAAA,EAAM,SAAA,EAAU;AAAA,EAClE;AAEA,EAAA,MAAM,IAAA,GAAiB,CAAC,MAAA,EAAQ,YAAY,CAAA;AAC5C,EAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,IAAA,CAAK,IAAA,CAAK,UAAU,CAAA;AACtC,EAAA,IAAI,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,MAAM,CAAC,CAAA;AAC9B,EAAA,IAAI,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,MAAM,CAAC,CAAA;AAC9B,EAAA,IAAI,MAAM,KAAA,EAAO;AACf,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,GAAI,KAAA,CAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC9E,IAAA,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,GAAG,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAAA,EAC/C;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAM,QAAQ,MAAM,CAAA;AAChD,EAAA,OAAO;AAAA,IACL,MAAM,MAAA,CAAO,MAAA;AAAA,IACb,OAAO,EAAC;AAAA,IACR,SAAA,EAAW,MAAA,CAAO,MAAA,CAAO,MAAA,GAAS,GAAA;AAAA,IAClC,IAAA,EAAM;AAAA,GACR;AACF;AAEA,SAAS,WAAW,GAAA,EAA4B;AAC9C,EAAA,IAAI,GAAA,GAAM,GAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,IAAI;AACF,MAAA,MAAMA,KAAAA,GAAO,QAAA,CAAcC,IAAA,CAAA,IAAA,CAAK,GAAA,EAAK,MAAM,CAAC,CAAA;AAC5C,MAAA,IAAID,KAAAA,CAAK,WAAA,EAAY,EAAG,OAAO,GAAA;AAAA,IACjC,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,MAAA,GAAcC,aAAQ,GAAG,CAAA;AAC/B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,MAAA,CACP,IAAA,EACA,GAAA,EACA,MAAA,EAC+D;AAC/D,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACC,QAAAA,KAAY;AAC9B,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AAEb,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,EAAO,IAAA,EAAM;AAAA,MAC/B,GAAA;AAAA,MACA,MAAA;AAAA,MACA,KAAK,aAAA,EAAc;AAAA,MACnB,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAAA,MAChC,WAAA,EAAa;AAAA,KACd,CAAA;AACD,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,MAAA,MAAA,IAAU,EAAE,QAAA,EAAS;AAAA,IACvB,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,MAAA,MAAA,IAAU,EAAE,QAAA,EAAS;AAAA,IACvB,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAASA,QAAAA,CAAQ,EAAE,MAAA,EAAQ,MAAA,EAAQ,QAAA,EAAU,IAAA,IAAQ,CAAA,EAAG,CAAC,CAAA;AAE5E,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,CAAA,KAAMA,SAAQ,EAAE,MAAA,EAAQ,EAAA,EAAI,MAAA,EAAQ,CAAA,CAAE,OAAA,EAAS,QAAA,EAAU,CAAA,EAAG,CAAC,CAAA;AAAA,EAClF,CAAC,CAAA;AACH;AAEA,eAAe,QAAA,CACb,KAAA,EACA,GAAA,EACA,OAAA,EACqB;AAIrB,EAAA,KAAK,KAAA,CAAM,OAAA;AAEX,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,GAAA,CACf,KAAA,CAAM,OAAA,CAAQ,MAAM,KAAK,CAAA,GAAI,KAAA,CAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,MAAM,GAAG,CAAA,EAC9D,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CACnB,MAAA,CAAO,OAAO,CAAA,GACjB,EAAC;AAEL,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,oBAAA;AAAA,MACN,OAAO,EAAC;AAAA,MACR,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM,MAAM,IAAA,IAAQ;AAAA,KACtB;AAAA,EACF;AAEA,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,IAAA,EAAM,GAAG,CAAA;AACrC,IAAA,MAAMF,QAAO,MAAS,EAAA,CAAA,IAAA,CAAK,OAAO,CAAA,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AACpD,IAAA,IAAI,CAACA,KAAAA,EAAM,MAAA,EAAO,EAAG;AAErB,IAAA,MAAM,OAAA,GAAU,MAAS,EAAA,CAAA,QAAA,CAAS,OAAA,EAAS,MAAM,CAAA;AACjD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA;AACnC,IAAA,OAAA,CAAQ,IAAA,CAAK,qBAAA,CAAsB,IAAA,EAAM,KAAK,CAAC,CAAA;AAAA,EACjD;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA;AAAA,IACzB,KAAA;AAAA,IACA,SAAA,EAAW,KAAA;AAAA,IACX,IAAA,EAAM,MAAM,IAAA,IAAQ;AAAA,GACtB;AACF;AAWA,SAAS,qBAAA,CAAsB,MAAc,KAAA,EAAyB;AACpE,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,MAAM,CAAA,CAAE,MAAA;AACnC,EAAA,MAAM,WAAW,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,EAAM,CAAA,KAAM,GAAG,MAAA,CAAO,CAAA,GAAI,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAC/F,EAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EAAkD,QAAQ,CAAA,CAAA;AAC9E","file":"diff.js","sourcesContent":["import { createHash } from 'node:crypto';\nimport * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core';\nimport type { Context } from '@wrongstack/core';\n\n/**\n * sha-256 hex of a UTF-8 string. Used by the file tools to record a content\n * hash alongside the mtime in `ctx.recordRead` — the hash is the authoritative\n * staleness arbiter for `edit` (mtime has a 2 s tolerance window on Windows).\n */\nexport function sha256hex(content: string): string {\n  return createHash('sha256').update(content, 'utf8').digest('hex');\n}\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm → yarn → npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);\n}\n\n/**\n * Roots every file tool may always reach, even in restricted mode: the\n * project root and the user-global `~/.wrongstack` directory (config, memory,\n * sessions, skills). `~/.wrongstack` honors the `WRONGSTACK_HOME` override.\n */\nfunction allowedRoots(ctx: Context): string[] {\n  return [path.resolve(ctx.projectRoot), path.resolve(Core.wstackGlobalRoot())];\n}\n\n/** True if `target` is `root` itself or nested inside any of `roots`. */\nfunction isInsideAny(target: string, roots: string[]): boolean {\n  return roots.some((root) => {\n    const rel = path.relative(root, target);\n    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));\n  });\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const target = path.resolve(absPath);\n  // Unrestricted filesystem access: skip the project-root containment check.\n  if (ctx.allowOutsideProjectRoot) return target;\n  if (isInsideAny(target, allowedRoots(ctx))) return target;\n  throw new Error(`Path \"${absPath}\" is outside project root \"${path.resolve(ctx.projectRoot)}\"`);\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root→out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink — macOS `/var`→`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  // Unrestricted filesystem access: no symlink-escape check to perform.\n  if (ctx.allowOutsideProjectRoot) return;\n  // Compare like-for-like against the realpath of each always-allowed root\n  // (project root + ~/.wrongstack), since a root may itself be a symlink.\n  const realRoots = await Promise.all(\n    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r))),\n  );\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    if (isInsideAny(real, realRoots)) return;\n    throw new Error(\n      `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoots[0]}\"`,\n    );\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// ─── Command-output normalization (token-saving) ────────────────────────────\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) — never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only — it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `… ⟨repeated ${run}×⟩`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends — the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n…[truncated ${total - kept} bytes]…\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI → collapse\n * carriage-return progress → trim trailing whitespace → collapse identical\n * consecutive lines → squeeze blank-line runs → head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number | undefined } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines → 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n","import { spawn } from 'node:child_process';\nimport { statSync } from 'node:fs';\nimport * as fs from 'node:fs/promises';\nimport * as path from 'node:path';\nimport { buildChildEnv } from '@wrongstack/core';\nimport type { Tool } from '@wrongstack/core';\nimport { safeResolve } from './_util.js';\n\ninterface DiffInput {\n  path?: string | undefined;\n  files?: string | string[] | undefined;\n  a?: string | undefined;\n  b?: string | undefined;\n  staged?: boolean | undefined;\n  mode?: 'unified' | 'side-by-side' | 'stat' | undefined;\n  context?: number | undefined;\n}\n\ninterface DiffOutput {\n  diff: string;\n  files: string[];\n  truncated: boolean;\n  mode: string;\n}\n\nexport const diffTool: Tool<DiffInput, DiffOutput> = {\n  name: 'diff',\n  category: 'Filesystem',\n  description:\n    'Show file content with line numbers, staged/working-tree diffs via git, or commit/branch diffs. A safer and more structured alternative to raw `git diff` via shell.',\n  usageHint:\n    'USE FOR CODE REVIEW AND CHANGE INSPECTION:\\n\\n' +\n    '- `files` + no `a`/`b` → show file content with line numbers (NOT a unified diff; no +/- prefixes).\\n' +\n    '- `a` and/or `b` → git-style commit/branch diff (unified format, real +/- prefixes).\\n' +\n    '- `staged: true` → only show staged changes.\\n' +\n    '- `mode` can be \"unified\", \"stat\", or \"side-by-side\" (only affects the git-diff path).\\n' +\n    '\\n' +\n    'NOTE: For a true file-vs-file unified diff, supply `a` and `b` so the tool ' +\n    'delegates to `git diff`. The `files`-only path is a line-numbered dump, not a diff.\\n' +\n    '\\n' +\n    'This tool has important safety guards against flag injection (see previous security findings).',\n  permission: 'auto',\n  mutating: false,\n  capabilities: ['fs.read'],\n  icon: 'diff',\n  timeoutMs: 10_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      path: {\n        type: 'string',\n        description: 'Working directory for the diff operation (defaults to project root).',\n      },\n      files: {\n        type: 'string',\n        description: 'Files or globs to diff (e.g. \"src/**/*.ts\" or comma-separated list).',\n      },\n      a: {\n        type: 'string',\n        description: 'First ref/commit/branch for git diff (e.g. HEAD, main, a commit hash).',\n      },\n      b: {\n        type: 'string',\n        description: 'Second ref/commit/branch for git diff.',\n      },\n      staged: {\n        type: 'boolean',\n        description: 'If true, only show changes that are staged in git.',\n      },\n      mode: {\n        type: 'string',\n        enum: ['unified', 'side-by-side', 'stat'],\n        description: 'Output format. \"unified\" is default, \"stat\" shows summary only.',\n      },\n      context: {\n        type: 'integer',\n        description: 'Number of context lines for unified diffs (default: 3).',\n      },\n    },\n  },\n  async execute(input, ctx, opts) {\n    if (input.a !== undefined || input.b !== undefined) {\n      return await gitDiff(input, ctx, opts.signal);\n    }\n\n    return await fileDiff(input, ctx, opts.signal);\n  },\n};\n\nasync function gitDiff(\n  input: DiffInput,\n  ctx: import('@wrongstack/core').Context,\n  signal: AbortSignal,\n): Promise<DiffOutput> {\n  // Flag injection: a/b are passed as positional args BEFORE the `--`\n  // separator, so a leading '-' would be parsed as a git option. The most\n  // dangerous is `--output=<path>`, which makes `git diff` write to an\n  // arbitrary path (outside the project root, with no confirmation since this\n  // tool is permission:'auto'). Reject leading-dash refs unconditionally —\n  // mirrors the guard in git.ts (validateWorktreeInput) and install.ts.\n  if (input.a?.startsWith('-')) {\n    throw new Error(`diff: unsafe ref \"${input.a}\" — refs may not begin with '-' (flag injection)`);\n  }\n  if (input.b?.startsWith('-')) {\n    throw new Error(`diff: unsafe ref \"${input.b}\" — refs may not begin with '-' (flag injection)`);\n  }\n\n  const gitDir = findGitDir(ctx.cwd);\n  if (!gitDir) {\n    return { diff: '', files: [], truncated: false, mode: 'unified' };\n  }\n\n  const args: string[] = ['diff', '--no-color'];\n  if (input.staged) args.push('--staged');\n  if (input.a) args.push(input.a);\n  if (input.b) args.push(input.b);\n  if (input.files) {\n    const files = Array.isArray(input.files) ? input.files : input.files.split(',');\n    args.push('--', ...files.map((f) => f.trim()));\n  }\n\n  const result = await runGit(args, gitDir, signal);\n  return {\n    diff: result.stdout,\n    files: [],\n    truncated: result.stdout.length > 100_000,\n    mode: 'unified',\n  };\n}\n\nfunction findGitDir(cwd: string): string | null {\n  let dir = cwd;\n  for (let i = 0; i < 20; i++) {\n    try {\n      const stat = statSync(path.join(dir, '.git'));\n      if (stat.isDirectory()) return dir;\n    } catch {\n      // continue\n    }\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\nfunction runGit(\n  args: string[],\n  cwd: string,\n  signal: AbortSignal,\n): Promise<{ stdout: string; stderr: string; exitCode: number }> {\n  return new Promise((resolve) => {\n    let stdout = '';\n    let stderr = '';\n\n    const child = spawn('git', args, {\n      cwd,\n      signal,\n      env: buildChildEnv(),\n      stdio: ['ignore', 'pipe', 'pipe'],\n      windowsHide: true,\n    });\n    child.stdout?.on('data', (c) => {\n      stdout += c.toString();\n    });\n    child.stderr?.on('data', (c) => {\n      stderr += c.toString();\n    });\n    child.on('close', (code) => resolve({ stdout, stderr, exitCode: code ?? 0 }));\n    /* v8 ignore next -- spawn 'error' only fires when the git binary is missing; defensive. */\n    child.on('error', (e) => resolve({ stdout: '', stderr: e.message, exitCode: 1 }));\n  });\n}\n\nasync function fileDiff(\n  input: DiffInput,\n  ctx: import('@wrongstack/core').Context,\n  _signal: AbortSignal,\n): Promise<DiffOutput> {\n  // `context` is accepted on the input schema for API stability but is\n  // unused in the line-dump path — there is no notion of \"context lines\"\n  // when there is no real diff. The git-diff path (`a`/`b`) ignores it too.\n  void input.context;\n\n  const files = input.files\n    ? (Array.isArray(input.files) ? input.files : input.files.split(','))\n        .map((f) => f.trim())\n        .filter(Boolean)\n    : [];\n\n  if (files.length === 0) {\n    return {\n      diff: 'No files specified',\n      files: [],\n      truncated: false,\n      mode: input.mode ?? 'unified',\n    };\n  }\n\n  const results: string[] = [];\n\n  for (const file of files) {\n    const absPath = safeResolve(file, ctx);\n    const stat = await fs.stat(absPath).catch(() => null);\n    if (!stat?.isFile()) continue;\n\n    const content = await fs.readFile(absPath, 'utf8');\n    const lines = content.split(/\\r?\\n/);\n    results.push(formatWithLineNumbers(file, lines));\n  }\n\n  return {\n    diff: results.join('\\n\\n'),\n    files,\n    truncated: false,\n    mode: input.mode ?? 'unified',\n  };\n}\n\n/**\n * Render a file's content as a line-numbered dump. This is intentionally\n * NOT a unified diff — it has no `-`/`+` prefixes. For a real diff\n * between two revisions, use the `a`/`b` params (delegates to `git diff`).\n *\n * Format: `   N | content` with the line number right-aligned. The\n * `context` parameter is accepted for API compatibility but unused —\n * a line dump has no notion of \"context lines\".\n */\nfunction formatWithLineNumbers(file: string, lines: string[]): string {\n  const width = String(lines.length).length;\n  const numbered = lines.map((line, i) => `${String(i + 1).padStart(width)} | ${line}`).join('\\n');\n  return `--- ${file} (line-numbered dump, not a unified diff) ---\\n${numbered}`;\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../src/diff.ts", "../src/_util.ts"],
+  "sourcesContent": ["import { spawn } from 'node:child_process';\nimport { statSync } from 'node:fs';\nimport * as fs from 'node:fs/promises';\nimport * as path from 'node:path';\nimport { buildChildEnv } from '@wrongstack/core';\nimport type { Tool } from '@wrongstack/core';\nimport { safeResolve } from './_util.js';\n\ninterface DiffInput {\n  path?: string | undefined;\n  files?: string | string[] | undefined;\n  a?: string | undefined;\n  b?: string | undefined;\n  staged?: boolean | undefined;\n  mode?: 'unified' | 'side-by-side' | 'stat' | undefined;\n  context?: number | undefined;\n}\n\ninterface DiffOutput {\n  diff: string;\n  files: string[];\n  truncated: boolean;\n  mode: string;\n}\n\nexport const diffTool: Tool<DiffInput, DiffOutput> = {\n  name: 'diff',\n  category: 'Filesystem',\n  description:\n    'Show file content with line numbers, staged/working-tree diffs via git, or commit/branch diffs. A safer and more structured alternative to raw `git diff` via shell.',\n  usageHint:\n    'USE FOR CODE REVIEW AND CHANGE INSPECTION:\\n\\n' +\n    '- `files` + no `a`/`b` \u2192 show file content with line numbers (NOT a unified diff; no +/- prefixes).\\n' +\n    '- `a` and/or `b` \u2192 git-style commit/branch diff (unified format, real +/- prefixes).\\n' +\n    '- `staged: true` \u2192 only show staged changes.\\n' +\n    '- `mode` can be \"unified\", \"stat\", or \"side-by-side\" (only affects the git-diff path).\\n' +\n    '\\n' +\n    'NOTE: For a true file-vs-file unified diff, supply `a` and `b` so the tool ' +\n    'delegates to `git diff`. The `files`-only path is a line-numbered dump, not a diff.\\n' +\n    '\\n' +\n    'This tool has important safety guards against flag injection (see previous security findings).',\n  permission: 'auto',\n  mutating: false,\n  capabilities: ['fs.read'],\n  icon: 'diff',\n  timeoutMs: 10_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      path: {\n        type: 'string',\n        description: 'Working directory for the diff operation (defaults to project root).',\n      },\n      files: {\n        type: 'string',\n        description: 'Files or globs to diff (e.g. \"src/**/*.ts\" or comma-separated list).',\n      },\n      a: {\n        type: 'string',\n        description: 'First ref/commit/branch for git diff (e.g. HEAD, main, a commit hash).',\n      },\n      b: {\n        type: 'string',\n        description: 'Second ref/commit/branch for git diff.',\n      },\n      staged: {\n        type: 'boolean',\n        description: 'If true, only show changes that are staged in git.',\n      },\n      mode: {\n        type: 'string',\n        enum: ['unified', 'side-by-side', 'stat'],\n        description: 'Output format. \"unified\" is default, \"stat\" shows summary only.',\n      },\n      context: {\n        type: 'integer',\n        description: 'Number of context lines for unified diffs (default: 3).',\n      },\n    },\n  },\n  async execute(input, ctx, opts) {\n    if (input.a !== undefined || input.b !== undefined) {\n      return await gitDiff(input, ctx, opts.signal);\n    }\n\n    return await fileDiff(input, ctx, opts.signal);\n  },\n};\n\nasync function gitDiff(\n  input: DiffInput,\n  ctx: import('@wrongstack/core').Context,\n  signal: AbortSignal,\n): Promise<DiffOutput> {\n  // Flag injection: a/b are passed as positional args BEFORE the `--`\n  // separator, so a leading '-' would be parsed as a git option. The most\n  // dangerous is `--output=<path>`, which makes `git diff` write to an\n  // arbitrary path (outside the project root, with no confirmation since this\n  // tool is permission:'auto'). Reject leading-dash refs unconditionally \u2014\n  // mirrors the guard in git.ts (validateWorktreeInput) and install.ts.\n  if (input.a?.startsWith('-')) {\n    throw new Error(`diff: unsafe ref \"${input.a}\" \u2014 refs may not begin with '-' (flag injection)`);\n  }\n  if (input.b?.startsWith('-')) {\n    throw new Error(`diff: unsafe ref \"${input.b}\" \u2014 refs may not begin with '-' (flag injection)`);\n  }\n\n  const gitDir = findGitDir(ctx.cwd);\n  if (!gitDir) {\n    return { diff: '', files: [], truncated: false, mode: 'unified' };\n  }\n\n  const args: string[] = ['diff', '--no-color'];\n  if (input.staged) args.push('--staged');\n  if (input.a) args.push(input.a);\n  if (input.b) args.push(input.b);\n  if (input.files) {\n    const files = Array.isArray(input.files) ? input.files : input.files.split(',');\n    args.push('--', ...files.map((f) => f.trim()));\n  }\n\n  const result = await runGit(args, gitDir, signal);\n  return {\n    diff: result.stdout,\n    files: [],\n    truncated: result.stdout.length > 100_000,\n    mode: 'unified',\n  };\n}\n\nfunction findGitDir(cwd: string): string | null {\n  let dir = cwd;\n  for (let i = 0; i < 20; i++) {\n    try {\n      const stat = statSync(path.join(dir, '.git'));\n      if (stat.isDirectory()) return dir;\n    } catch {\n      // continue\n    }\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\nfunction runGit(\n  args: string[],\n  cwd: string,\n  signal: AbortSignal,\n): Promise<{ stdout: string; stderr: string; exitCode: number }> {\n  return new Promise((resolve) => {\n    let stdout = '';\n    let stderr = '';\n\n    const child = spawn('git', args, {\n      cwd,\n      signal,\n      env: buildChildEnv(),\n      stdio: ['ignore', 'pipe', 'pipe'],\n      windowsHide: true,\n    });\n    child.stdout?.on('data', (c) => {\n      stdout += c.toString();\n    });\n    child.stderr?.on('data', (c) => {\n      stderr += c.toString();\n    });\n    child.on('close', (code) => resolve({ stdout, stderr, exitCode: code ?? 0 }));\n    /* v8 ignore next -- spawn 'error' only fires when the git binary is missing; defensive. */\n    child.on('error', (e) => resolve({ stdout: '', stderr: e.message, exitCode: 1 }));\n  });\n}\n\nasync function fileDiff(\n  input: DiffInput,\n  ctx: import('@wrongstack/core').Context,\n  _signal: AbortSignal,\n): Promise<DiffOutput> {\n  // `context` is accepted on the input schema for API stability but is\n  // unused in the line-dump path \u2014 there is no notion of \"context lines\"\n  // when there is no real diff. The git-diff path (`a`/`b`) ignores it too.\n  void input.context;\n\n  const files = input.files\n    ? (Array.isArray(input.files) ? input.files : input.files.split(','))\n        .map((f) => f.trim())\n        .filter(Boolean)\n    : [];\n\n  if (files.length === 0) {\n    return {\n      diff: 'No files specified',\n      files: [],\n      truncated: false,\n      mode: input.mode ?? 'unified',\n    };\n  }\n\n  const results: string[] = [];\n\n  for (const file of files) {\n    const absPath = safeResolve(file, ctx);\n    const stat = await fs.stat(absPath).catch(() => null);\n    if (!stat?.isFile()) continue;\n\n    const content = await fs.readFile(absPath, 'utf8');\n    const lines = content.split(/\\r?\\n/);\n    results.push(formatWithLineNumbers(file, lines));\n  }\n\n  return {\n    diff: results.join('\\n\\n'),\n    files,\n    truncated: false,\n    mode: input.mode ?? 'unified',\n  };\n}\n\n/**\n * Render a file's content as a line-numbered dump. This is intentionally\n * NOT a unified diff \u2014 it has no `-`/`+` prefixes. For a real diff\n * between two revisions, use the `a`/`b` params (delegates to `git diff`).\n *\n * Format: `   N | content` with the line number right-aligned. The\n * `context` parameter is accepted for API compatibility but unused \u2014\n * a line dump has no notion of \"context lines\".\n */\nfunction formatWithLineNumbers(file: string, lines: string[]): string {\n  const width = String(lines.length).length;\n  const numbered = lines.map((line, i) => `${String(i + 1).padStart(width)} | ${line}`).join('\\n');\n  return `--- ${file} (line-numbered dump, not a unified diff) ---\\n${numbered}`;\n}\n", "import { createHash } from 'node:crypto';\nimport * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core';\nimport type { Context } from '@wrongstack/core';\n\n/**\n * sha-256 hex of a UTF-8 string. Used by the file tools to record a content\n * hash alongside the mtime in `ctx.recordRead` \u2014 the hash is the authoritative\n * staleness arbiter for `edit` (mtime has a 2 s tolerance window on Windows).\n */\nexport function sha256hex(content: string): string {\n  return createHash('sha256').update(content, 'utf8').digest('hex');\n}\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm \u2192 yarn \u2192 npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);\n}\n\n/**\n * Roots every file tool may always reach, even in restricted mode: the\n * project root and the user-global `~/.wrongstack` directory (config, memory,\n * sessions, skills). `~/.wrongstack` honors the `WRONGSTACK_HOME` override.\n */\nfunction allowedRoots(ctx: Context): string[] {\n  return [path.resolve(ctx.projectRoot), path.resolve(Core.wstackGlobalRoot())];\n}\n\n/** True if `target` is `root` itself or nested inside any of `roots`. */\nfunction isInsideAny(target: string, roots: string[]): boolean {\n  return roots.some((root) => {\n    const rel = path.relative(root, target);\n    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));\n  });\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const target = path.resolve(absPath);\n  // Unrestricted filesystem access: skip the project-root containment check.\n  if (ctx.allowOutsideProjectRoot) return target;\n  if (isInsideAny(target, allowedRoots(ctx))) return target;\n  throw new Error(`Path \"${absPath}\" is outside project root \"${path.resolve(ctx.projectRoot)}\"`);\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root\u2192out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink \u2014 macOS `/var`\u2192`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  // Unrestricted filesystem access: no symlink-escape check to perform.\n  if (ctx.allowOutsideProjectRoot) return;\n  // Compare like-for-like against the realpath of each always-allowed root\n  // (project root + ~/.wrongstack), since a root may itself be a symlink.\n  const realRoots = await Promise.all(\n    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r))),\n  );\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    if (isInsideAny(real, realRoots)) return;\n    throw new Error(\n      `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoots[0]}\"`,\n    );\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n\u2026[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]\u2026\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// \u2500\u2500\u2500 Command-output normalization (token-saving) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) \u2014 never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only \u2014 it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `\u2026 \u27E8repeated ${run}\u00D7\u27E9`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends \u2014 the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n\u2026[truncated ${total - kept} bytes]\u2026\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI \u2192 collapse\n * carriage-return progress \u2192 trim trailing whitespace \u2192 collapse identical\n * consecutive lines \u2192 squeeze blank-line runs \u2192 head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number | undefined } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines \u2192 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n"],
+  "mappings": ";AAAA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AACzB,YAAY,QAAQ;AACpB,YAAYA,WAAU;AACtB,SAAS,qBAAqB;;;ACF9B,YAAY,UAAU;AACtB,YAAY,UAAU;AAqCf,SAAS,YAAY,OAAe,KAAsB;AAC/D,SAAY,gBAAW,KAAK,IAAS,eAAU,KAAK,IAAS,aAAQ,IAAI,cAAc,IAAI,KAAK,KAAK;AACvG;AAOA,SAAS,aAAa,KAAwB;AAC5C,SAAO,CAAM,aAAQ,IAAI,WAAW,GAAQ,aAAa,sBAAiB,CAAC,CAAC;AAC9E;AAGA,SAAS,YAAY,QAAgB,OAA0B;AAC7D,SAAO,MAAM,KAAK,CAAC,SAAS;AAC1B,UAAM,MAAW,cAAS,MAAM,MAAM;AACtC,WAAO,QAAQ,MAAO,CAAC,IAAI,WAAW,IAAI,KAAK,CAAM,gBAAW,GAAG;AAAA,EACrE,CAAC;AACH;AAEO,SAAS,iBAAiB,SAAiB,KAAsB;AACtE,QAAM,SAAc,aAAQ,OAAO;AAEnC,MAAI,IAAI,wBAAyB,QAAO;AACxC,MAAI,YAAY,QAAQ,aAAa,GAAG,CAAC,EAAG,QAAO;AACnD,QAAM,IAAI,MAAM,SAAS,OAAO,8BAAmC,aAAQ,IAAI,WAAW,CAAC,GAAG;AAChG;AAEO,SAAS,YAAY,OAAe,KAAsB;AAC/D,SAAO,iBAAiB,YAAY,OAAO,GAAG,GAAG,GAAG;AACtD;;;AD9CO,IAAM,WAAwC;AAAA,EACnD,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aACE;AAAA,EACF,WACE;AAAA,EAUF,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,cAAc,CAAC,SAAS;AAAA,EACxB,MAAM;AAAA,EACN,WAAW;AAAA,EACX,aAAa;AAAA,IACX,MAAM;AAAA,IACN,YAAY;AAAA,MACV,MAAM;AAAA,QACJ,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,OAAO;AAAA,QACL,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,GAAG;AAAA,QACD,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,GAAG;AAAA,QACD,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,MAAM;AAAA,QACJ,MAAM;AAAA,QACN,MAAM,CAAC,WAAW,gBAAgB,MAAM;AAAA,QACxC,aAAa;AAAA,MACf;AAAA,MACA,SAAS;AAAA,QACP,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK,MAAM;AAC9B,QAAI,MAAM,MAAM,UAAa,MAAM,MAAM,QAAW;AAClD,aAAO,MAAM,QAAQ,OAAO,KAAK,KAAK,MAAM;AAAA,IAC9C;AAEA,WAAO,MAAM,SAAS,OAAO,KAAK,KAAK,MAAM;AAAA,EAC/C;AACF;AAEA,eAAe,QACb,OACA,KACA,QACqB;AAOrB,MAAI,MAAM,GAAG,WAAW,GAAG,GAAG;AAC5B,UAAM,IAAI,MAAM,qBAAqB,MAAM,CAAC,uDAAkD;AAAA,EAChG;AACA,MAAI,MAAM,GAAG,WAAW,GAAG,GAAG;AAC5B,UAAM,IAAI,MAAM,qBAAqB,MAAM,CAAC,uDAAkD;AAAA,EAChG;AAEA,QAAM,SAAS,WAAW,IAAI,GAAG;AACjC,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,WAAW,OAAO,MAAM,UAAU;AAAA,EAClE;AAEA,QAAM,OAAiB,CAAC,QAAQ,YAAY;AAC5C,MAAI,MAAM,OAAQ,MAAK,KAAK,UAAU;AACtC,MAAI,MAAM,EAAG,MAAK,KAAK,MAAM,CAAC;AAC9B,MAAI,MAAM,EAAG,MAAK,KAAK,MAAM,CAAC;AAC9B,MAAI,MAAM,OAAO;AACf,UAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,MAAM,GAAG;AAC9E,SAAK,KAAK,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAAA,EAC/C;AAEA,QAAM,SAAS,MAAM,OAAO,MAAM,QAAQ,MAAM;AAChD,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,OAAO,CAAC;AAAA,IACR,WAAW,OAAO,OAAO,SAAS;AAAA,IAClC,MAAM;AAAA,EACR;AACF;AAEA,SAAS,WAAW,KAA4B;AAC9C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,QAAI;AACF,YAAMC,QAAO,SAAc,WAAK,KAAK,MAAM,CAAC;AAC5C,UAAIA,MAAK,YAAY,EAAG,QAAO;AAAA,IACjC,QAAQ;AAAA,IAER;AACA,UAAM,SAAc,cAAQ,GAAG;AAC/B,QAAI,WAAW,IAAK;AACpB,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAEA,SAAS,OACP,MACA,KACA,QAC+D;AAC/D,SAAO,IAAI,QAAQ,CAACC,aAAY;AAC9B,QAAI,SAAS;AACb,QAAI,SAAS;AAEb,UAAM,QAAQ,MAAM,OAAO,MAAM;AAAA,MAC/B;AAAA,MACA;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,MAChC,aAAa;AAAA,IACf,CAAC;AACD,UAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM;AAC9B,gBAAU,EAAE,SAAS;AAAA,IACvB,CAAC;AACD,UAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM;AAC9B,gBAAU,EAAE,SAAS;AAAA,IACvB,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,SAASA,SAAQ,EAAE,QAAQ,QAAQ,UAAU,QAAQ,EAAE,CAAC,CAAC;AAE5E,UAAM,GAAG,SAAS,CAAC,MAAMA,SAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC,CAAC;AAAA,EAClF,CAAC;AACH;AAEA,eAAe,SACb,OACA,KACA,SACqB;AAIrB,OAAK,MAAM;AAEX,QAAM,QAAQ,MAAM,SACf,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,MAAM,GAAG,GAC9D,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO,IACjB,CAAC;AAEL,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO,CAAC;AAAA,MACR,WAAW;AAAA,MACX,MAAM,MAAM,QAAQ;AAAA,IACtB;AAAA,EACF;AAEA,QAAM,UAAoB,CAAC;AAE3B,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,YAAY,MAAM,GAAG;AACrC,UAAMD,QAAO,MAAS,QAAK,OAAO,EAAE,MAAM,MAAM,IAAI;AACpD,QAAI,CAACA,OAAM,OAAO,EAAG;AAErB,UAAM,UAAU,MAAS,YAAS,SAAS,MAAM;AACjD,UAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAQ,KAAK,sBAAsB,MAAM,KAAK,CAAC;AAAA,EACjD;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,KAAK,MAAM;AAAA,IACzB;AAAA,IACA,WAAW;AAAA,IACX,MAAM,MAAM,QAAQ;AAAA,EACtB;AACF;AAWA,SAAS,sBAAsB,MAAc,OAAyB;AACpE,QAAM,QAAQ,OAAO,MAAM,MAAM,EAAE;AACnC,QAAM,WAAW,MAAM,IAAI,CAAC,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,EAAE,SAAS,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,IAAI;AAC/F,SAAO,OAAO,IAAI;AAAA,EAAkD,QAAQ;AAC9E;",
+  "names": ["path", "stat", "resolve"]
+}

package/dist/document.d.ts

@@ -1,5 +1,4 @@
-import { Tool } from '@wrongstack/core';
-
+import type { Tool } from '@wrongstack/core';
 interface DocumentInput {
     target: 'file' | 'function' | 'class' | 'type' | 'all';
     path?: string | undefined;
@@ -22,6 +21,6 @@ interface DocumentOutput {
     results: DocumentedItem[];
     style: string;
 }
-declare const documentTool: Tool<DocumentInput, DocumentOutput>;
-
-export { documentTool };
+export declare const documentTool: Tool<DocumentInput, DocumentOutput>;
+export {};
+//# sourceMappingURL=document.d.ts.map

package/dist/document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../src/document.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG7C,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IACvD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IAChD,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAAC;IAC3C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,UAAU,cAAc;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,cAAc,CAoF5D,CAAC"}

package/dist/document.js

@@ -1,8 +1,9 @@
-import * as fs from 'node:fs/promises';
-import * as path from 'node:path';
-import * as Core from '@wrongstack/core';
-
 // src/document.ts
+import * as fs from "node:fs/promises";
+
+// src/_util.ts
+import * as path from "node:path";
+import * as Core from "@wrongstack/core";
 function resolvePath(input, ctx) {
   return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);
 }
@@ -172,7 +173,7 @@ function processFile(content, absPath, _style, _overwrite, target) {
   }
   return results;
 }
-
-export { documentTool };
+export {
+  documentTool
+};
 //# sourceMappingURL=document.js.map
-//# sourceMappingURL=document.js.map

package/dist/document.js.map

@@ -1 +1,7 @@
-{"version":3,"sources":["../src/_util.ts","../src/document.ts"],"names":["stat"],"mappings":";;;;;AAwCO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAY,IAAA,CAAA,UAAA,CAAW,KAAK,CAAA,GAAS,IAAA,CAAA,SAAA,CAAU,KAAK,CAAA,GAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,UAAA,IAAc,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AACvG;AAOA,SAAS,aAAa,GAAA,EAAwB;AAC5C,EAAA,OAAO,CAAM,aAAQ,GAAA,CAAI,WAAW,GAAQ,IAAA,CAAA,OAAA,CAAa,IAAA,CAAA,gBAAA,EAAkB,CAAC,CAAA;AAC9E;AAGA,SAAS,WAAA,CAAY,QAAgB,KAAA,EAA0B;AAC7D,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,IAAA,KAAS;AAC1B,IAAA,MAAM,GAAA,GAAW,IAAA,CAAA,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AACtC,IAAA,OAAO,GAAA,KAAQ,MAAO,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAAM,IAAA,CAAA,UAAA,CAAW,GAAG,CAAA;AAAA,EACrE,CAAC,CAAA;AACH;AAEO,SAAS,gBAAA,CAAiB,SAAiB,GAAA,EAAsB;AACtE,EAAA,MAAM,MAAA,GAAc,aAAQ,OAAO,CAAA;AAEnC,EAAA,IAAI,GAAA,CAAI,yBAAyB,OAAO,MAAA;AACxC,EAAA,IAAI,YAAY,MAAA,EAAQ,YAAA,CAAa,GAAG,CAAC,GAAG,OAAO,MAAA;AACnD,EAAA,MAAM,IAAI,MAAM,CAAA,MAAA,EAAS,OAAO,8BAAmC,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAC,CAAA,CAAA,CAAG,CAAA;AAChG;AAEO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAO,gBAAA,CAAiB,WAAA,CAAY,KAAA,EAAO,GAAG,GAAG,GAAG,CAAA;AACtD;;;AC1CO,IAAM,YAAA,GAAoD;AAAA,EAC/D,IAAA,EAAM,UAAA;AAAA,EACN,QAAA,EAAU,SAAA;AAAA,EACV,WAAA,EACE,oLAAA;AAAA,EAEF,SAAA,EACE,+NAAA;AAAA,EAEF,UAAA,EAAY,MAAA;AAAA,EACZ,QAAA,EAAU,KAAA;AAAA,EACV,SAAA,EAAW,GAAA;AAAA,EACX,YAAA,EAAc,CAAC,SAAS,CAAA;AAAA,EACxB,IAAA,EAAM,UAAA;AAAA,EACN,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,MAAM,CAAC,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAS,QAAQ,KAAK,CAAA;AAAA,QACjD,WAAA,EAAa;AAAA,OACf;AAAA,MACA,IAAA,EAAM;AAAA,QACJ,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,OAAA,EAAS,OAAA,EAAS,OAAO,CAAA;AAAA,QAChC,WAAA,EAAa;AAAA,OACf;AAAA,MAEA,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,kCAAA;AAAmC;AACzE,GACF;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK;AACxB,IAAA,MAAM,GAAA,GAAM,MAAM,GAAA,GAAM,WAAA,CAAY,MAAM,GAAA,EAAK,GAAG,IAAI,GAAA,CAAI,GAAA;AAC1D,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,OAAA;AAC7B,IAAA,MAAM,UAA4B,EAAC;AACnC,IAAA,IAAI,cAAA,GAAiB,CAAA;AACrB,IAAA,IAAI,eAAA,GAAkB,CAAA;AAEtB,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,GACnB,MAAM,YAAA,CAAa,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,GAAI,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,GAAI,KAAA,CAAM,KAAA,EAAO,GAAG,CAAA,GACxF,KAAA,CAAM,IAAA,GACJ,CAAC,WAAA,CAAY,KAAA,CAAM,IAAA,EAAM,GAAG,CAAC,CAAA,GAC7B,EAAC;AAEP,IAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,MAAS,EAAA,CAAA,QAAA,CAAS,OAAA,EAAS,MAAM,CAAA;AACjD,QAAA,cAAA,EAAA;AACA,QAAA,MAAM,SAAA,GAAY,WAAA;AAAA,UAChB,OAAA;AAAA,UACA,OAAA;AAAA,UACA,KAAA;AAAA,UACA,MAAM,SAAA,IAAa,KAAA;AAAA,UACnB,MAAM,MAAA,IAAU;AAAA,SAClB;AACA,QAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,SAAS,CAAA;AACzB,QAAA,eAAA,IAAmB,UAAU,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,MAAA,KAAW,YAAY,CAAA,CAAE,MAAA;AAAA,MACxE,SAAS,CAAA,EAAG;AACV,QAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,UACX,IAAA,EAAM,OAAA;AAAA,UACN,MAAM,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,CAAE,KAAI,IAAK,OAAA;AAAA,UAClC,SAAA,EAAW,EAAA;AAAA,UACX,SAAA,EAAW,EAAA;AAAA,UACX,MAAA,EAAQ,OAAA;AAAA,UACR,OAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,OAAO,CAAC;AAAA,SACjD,CAAA;AAAA,MACH;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,eAAA,EAAiB,cAAA;AAAA,MACjB,gBAAA,EAAkB,eAAA;AAAA,MAClB,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACF;AAEA,eAAe,YAAA,CAAa,YAAoB,GAAA,EAAgC;AAC9E,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,UAAU,IAAI,UAAA,GAAa,UAAA,CAAW,MAAM,GAAG,CAAA;AAC3E,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,MAAM,OAAA,GAAU,CAAA,CAAE,IAAA,EAAK,CAAE,WAAW,GAAG,CAAA,GAAI,CAAA,CAAE,IAAA,KAAS,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,CAAA,CAAE,MAAM,CAAA,CAAA;AACxE,IAAA,IAAI;AACF,MAAA,MAAMA,KAAAA,GAAO,MAAS,EAAA,CAAA,IAAA,CAAK,OAAO,CAAA;AAClC,MAAA,IAAIA,KAAAA,CAAK,MAAA,EAAO,EAAG,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,IAC1C,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,WAAA,CACP,OAAA,EACA,OAAA,EACA,MAAA,EACA,YACA,MAAA,EACkB;AAClB,EAAA,MAAM,UAA4B,EAAC;AAInC,EAAA,MAAM,aAAA,GAAgB,8CAAA;AACtB,EAAA,MAAM,UAAA,GAAa,gEAAA;AACnB,EAAA,MAAM,UAAA,GAAa,gBAAA;AACnB,EAAA,MAAM,SAAA,GAAY,oCAAA;AAElB,EAAA,MAAM,aAA0E,EAAC;AAEjF,EAAA,IAAI,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,UAAA,EAAY;AAC7C,IAAA,KAAA,MAAW,CAAA,IAAK,OAAA,CAAQ,QAAA,CAAS,aAAa,CAAA,EAAG;AAE/C,MAAA,IAAI,CAAC,CAAA,CAAE,CAAC,CAAA,EAAG;AACX,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,IAAA,EAAM,EAAE,CAAC,CAAA;AAAA,QACT,GAAA,EAAK,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AAAA,QACb,IAAA,EAAM,UAAA;AAAA,QACN,IAAA,EAAM,QAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,CAAE;AAAA,OAC7C,CAAA;AAAA,IACH;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,OAAA,CAAQ,QAAA,CAAS,UAAU,CAAA,EAAG;AAE5C,MAAA,IAAI,CAAC,CAAA,CAAE,CAAC,CAAA,EAAG;AACX,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,IAAA,EAAM,EAAE,CAAC,CAAA;AAAA,QACT,GAAA,EAAK,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AAAA,QACb,IAAA,EAAM,OAAA;AAAA,QACN,IAAA,EAAM,QAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,CAAE;AAAA,OAC7C,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,IAAI,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,OAAA,EAAS;AAC1C,IAAA,KAAA,MAAW,CAAA,IAAK,OAAA,CAAQ,QAAA,CAAS,UAAU,CAAA,EAAG;AAE5C,MAAA,IAAI,CAAC,CAAA,CAAE,CAAC,CAAA,EAAG;AACX,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,IAAA,EAAM,EAAE,CAAC,CAAA;AAAA,QACT,GAAA,EAAK,EAAA;AAAA,QACL,IAAA,EAAM,OAAA;AAAA,QACN,IAAA,EAAM,QAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,CAAE;AAAA,OAC7C,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,IAAI,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,MAAA,EAAQ;AACzC,IAAA,KAAA,MAAW,CAAA,IAAK,OAAA,CAAQ,QAAA,CAAS,SAAS,CAAA,EAAG;AAE3C,MAAA,IAAI,CAAC,CAAA,CAAE,CAAC,CAAA,EAAG;AACX,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,IAAA,EAAM,EAAE,CAAC,CAAA;AAAA,QACT,GAAA,EAAK,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AAAA,QACb,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,QAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,CAAE;AAAA,OAC7C,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,KAAK,UAAA,EAAY;AAC1B,IAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,MACX,IAAA,EAAM,OAAA;AAAA,MACN,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,WAAW,CAAA,CAAE,GAAA;AAAA,MACb,WAAW,CAAA,IAAA,EAAO,CAAA,CAAE,IAAI,CAAA,sBAAA,EAAyB,EAAE,IAAI,CAAA,GAAA,CAAA;AAAA,MACvD,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,OAAA;AACT","file":"document.js","sourcesContent":["import { createHash } from 'node:crypto';\nimport * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core';\nimport type { Context } from '@wrongstack/core';\n\n/**\n * sha-256 hex of a UTF-8 string. Used by the file tools to record a content\n * hash alongside the mtime in `ctx.recordRead` — the hash is the authoritative\n * staleness arbiter for `edit` (mtime has a 2 s tolerance window on Windows).\n */\nexport function sha256hex(content: string): string {\n  return createHash('sha256').update(content, 'utf8').digest('hex');\n}\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm → yarn → npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);\n}\n\n/**\n * Roots every file tool may always reach, even in restricted mode: the\n * project root and the user-global `~/.wrongstack` directory (config, memory,\n * sessions, skills). `~/.wrongstack` honors the `WRONGSTACK_HOME` override.\n */\nfunction allowedRoots(ctx: Context): string[] {\n  return [path.resolve(ctx.projectRoot), path.resolve(Core.wstackGlobalRoot())];\n}\n\n/** True if `target` is `root` itself or nested inside any of `roots`. */\nfunction isInsideAny(target: string, roots: string[]): boolean {\n  return roots.some((root) => {\n    const rel = path.relative(root, target);\n    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));\n  });\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const target = path.resolve(absPath);\n  // Unrestricted filesystem access: skip the project-root containment check.\n  if (ctx.allowOutsideProjectRoot) return target;\n  if (isInsideAny(target, allowedRoots(ctx))) return target;\n  throw new Error(`Path \"${absPath}\" is outside project root \"${path.resolve(ctx.projectRoot)}\"`);\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root→out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink — macOS `/var`→`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  // Unrestricted filesystem access: no symlink-escape check to perform.\n  if (ctx.allowOutsideProjectRoot) return;\n  // Compare like-for-like against the realpath of each always-allowed root\n  // (project root + ~/.wrongstack), since a root may itself be a symlink.\n  const realRoots = await Promise.all(\n    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r))),\n  );\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    if (isInsideAny(real, realRoots)) return;\n    throw new Error(\n      `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoots[0]}\"`,\n    );\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// ─── Command-output normalization (token-saving) ────────────────────────────\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) — never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only — it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `… ⟨repeated ${run}×⟩`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends — the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n…[truncated ${total - kept} bytes]…\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI → collapse\n * carriage-return progress → trim trailing whitespace → collapse identical\n * consecutive lines → squeeze blank-line runs → head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number | undefined } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines → 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n","import * as fs from 'node:fs/promises';\nimport type { Tool } from '@wrongstack/core';\nimport { safeResolve } from './_util.js';\n\ninterface DocumentInput {\n  target: 'file' | 'function' | 'class' | 'type' | 'all';\n  path?: string | undefined;\n  files?: string | string[] | undefined;\n  style?: 'jsdoc' | 'tsdoc' | 'block' | undefined;\n  overwrite?: boolean | undefined;\n  cwd?: string | undefined;\n}\n\ninterface DocumentedItem {\n  path: string;\n  name: string;\n  signature: string;\n  docstring: string;\n  status: 'documented' | 'skipped' | 'error';\n  error?: string | undefined;\n}\n\ninterface DocumentOutput {\n  files_processed: number;\n  items_documented: number;\n  results: DocumentedItem[];\n  style: string;\n}\n\nexport const documentTool: Tool<DocumentInput, DocumentOutput> = {\n  name: 'document',\n  category: 'Project',\n  description:\n    'DEPRECATED — use the `auto_doc` tool with `dryRun: true` instead. ' +\n    'This tool is a read-only preview stub that returns `skipped` candidates without generating real docstrings.',\n  usageHint:\n    'Deprecated: prefer `auto_doc` with `dryRun: true` for previewing, or `auto_doc` without dryRun for writing. ' +\n    'This tool only lists undocumented symbols with placeholder comments — it does not generate real JSDoc/TSDoc.',\n  permission: 'auto',\n  mutating: false,\n  timeoutMs: 30_000,\n  capabilities: ['fs.read'],\n  icon: 'document',\n  inputSchema: {\n    type: 'object',\n    properties: {\n      target: {\n        type: 'string',\n        enum: ['file', 'function', 'class', 'type', 'all'],\n        description: 'What to document',\n      },\n      path: {\n        type: 'string',\n        description: 'Specific file path to document',\n      },\n      files: {\n        type: 'string',\n        description: 'File(s) to process: single path, comma-separated list, or glob',\n      },\n      style: {\n        type: 'string',\n        enum: ['jsdoc', 'tsdoc', 'block'],\n        description: 'Documentation style (default: jsdoc)',\n      },\n\n      cwd: { type: 'string', description: 'Working directory (default: cwd)' },\n    },\n  },\n  async execute(input, ctx) {\n    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;\n    const style = input.style ?? 'jsdoc';\n    const results: DocumentedItem[] = [];\n    let filesProcessed = 0;\n    let itemsDocumented = 0;\n\n    const fileList = input.files\n      ? await resolveFiles(Array.isArray(input.files) ? input.files.join(',') : input.files, cwd)\n      : input.path\n        ? [safeResolve(input.path, ctx)]\n        : [];\n\n    for (const absPath of fileList) {\n      try {\n        const content = await fs.readFile(absPath, 'utf8');\n        filesProcessed++;\n        const processed = processFile(\n          content,\n          absPath,\n          style,\n          input.overwrite ?? false,\n          input.target ?? 'all',\n        );\n        results.push(...processed);\n        itemsDocumented += processed.filter((r) => r.status === 'documented').length;\n      } catch (e) {\n        results.push({\n          path: absPath,\n          name: absPath.split('/').pop() ?? absPath,\n          signature: '',\n          docstring: '',\n          status: 'error',\n          error: e instanceof Error ? e.message : String(e),\n        });\n      }\n    }\n\n    return {\n      files_processed: filesProcessed,\n      items_documented: itemsDocumented,\n      results,\n      style,\n    };\n  },\n};\n\nasync function resolveFiles(filesInput: string, cwd: string): Promise<string[]> {\n  const files = Array.isArray(filesInput) ? filesInput : filesInput.split(',');\n  const resolved: string[] = [];\n\n  for (const f of files) {\n    const absPath = f.trim().startsWith('/') ? f.trim() : `${cwd}/${f.trim()}`;\n    try {\n      const stat = await fs.stat(absPath);\n      if (stat.isFile()) resolved.push(absPath);\n    } catch {\n      // skip\n    }\n  }\n\n  return resolved;\n}\n\nfunction processFile(\n  content: string,\n  absPath: string,\n  _style: string,\n  _overwrite: boolean,\n  target: string,\n): DocumentedItem[] {\n  const results: DocumentedItem[] = [];\n  // These must be global — `String.prototype.matchAll` throws on a non-global\n  // RegExp, which previously made processFile throw and report every file as an\n  // error instead of returning documentation candidates.\n  const functionRegex = /(?:async\\s+)?function\\s+(\\w+)\\s*\\(([^)]*)\\)/g;\n  const arrowRegex = /(?:const|let|var)\\s+(\\w+)\\s*=\\s*(?:async\\s+)?\\(([^)]*)\\)\\s*=>/g;\n  const classRegex = /class\\s+(\\w+)/g;\n  const typeRegex = /(?:type|interface)\\s+(\\w+)\\s*[=<]/g;\n\n  const allMatches: { name: string; sig: string; type: string; line: number }[] = [];\n\n  if (target === 'all' || target === 'function') {\n    for (const m of content.matchAll(functionRegex)) {\n      /* v8 ignore next -- capture group (\\w+) is mandatory, so m[1] is always defined; defensive. */\n      if (!m[1]) continue;\n      allMatches.push({\n        name: m[1],\n        sig: m[2] ?? '',\n        type: 'function',\n        line: content.slice(0, m.index).split('\\n').length,\n      });\n    }\n    for (const m of content.matchAll(arrowRegex)) {\n      /* v8 ignore next -- capture group (\\w+) is mandatory, so m[1] is always defined; defensive. */\n      if (!m[1]) continue;\n      allMatches.push({\n        name: m[1],\n        sig: m[2] ?? '',\n        type: 'arrow',\n        line: content.slice(0, m.index).split('\\n').length,\n      });\n    }\n  }\n\n  if (target === 'all' || target === 'class') {\n    for (const m of content.matchAll(classRegex)) {\n      /* v8 ignore next -- capture group (\\w+) is mandatory, so m[1] is always defined; defensive. */\n      if (!m[1]) continue;\n      allMatches.push({\n        name: m[1],\n        sig: '',\n        type: 'class',\n        line: content.slice(0, m.index).split('\\n').length,\n      });\n    }\n  }\n\n  if (target === 'all' || target === 'type') {\n    for (const m of content.matchAll(typeRegex)) {\n      /* v8 ignore next -- capture group (\\w+) is mandatory, so m[1] is always defined; defensive. */\n      if (!m[1]) continue;\n      allMatches.push({\n        name: m[1],\n        sig: m[0] ?? '',\n        type: 'type',\n        line: content.slice(0, m.index).split('\\n').length,\n      });\n    }\n  }\n\n  for (const m of allMatches) {\n    results.push({\n      path: absPath,\n      name: m.name,\n      signature: m.sig,\n      docstring: `/** ${m.name} - documented at line ${m.line} */`,\n      status: 'skipped',\n    });\n  }\n\n  return results;\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../src/document.ts", "../src/_util.ts"],
+  "sourcesContent": ["import * as fs from 'node:fs/promises';\nimport type { Tool } from '@wrongstack/core';\nimport { safeResolve } from './_util.js';\n\ninterface DocumentInput {\n  target: 'file' | 'function' | 'class' | 'type' | 'all';\n  path?: string | undefined;\n  files?: string | string[] | undefined;\n  style?: 'jsdoc' | 'tsdoc' | 'block' | undefined;\n  overwrite?: boolean | undefined;\n  cwd?: string | undefined;\n}\n\ninterface DocumentedItem {\n  path: string;\n  name: string;\n  signature: string;\n  docstring: string;\n  status: 'documented' | 'skipped' | 'error';\n  error?: string | undefined;\n}\n\ninterface DocumentOutput {\n  files_processed: number;\n  items_documented: number;\n  results: DocumentedItem[];\n  style: string;\n}\n\nexport const documentTool: Tool<DocumentInput, DocumentOutput> = {\n  name: 'document',\n  category: 'Project',\n  description:\n    'DEPRECATED \u2014 use the `auto_doc` tool with `dryRun: true` instead. ' +\n    'This tool is a read-only preview stub that returns `skipped` candidates without generating real docstrings.',\n  usageHint:\n    'Deprecated: prefer `auto_doc` with `dryRun: true` for previewing, or `auto_doc` without dryRun for writing. ' +\n    'This tool only lists undocumented symbols with placeholder comments \u2014 it does not generate real JSDoc/TSDoc.',\n  permission: 'auto',\n  mutating: false,\n  timeoutMs: 30_000,\n  capabilities: ['fs.read'],\n  icon: 'document',\n  inputSchema: {\n    type: 'object',\n    properties: {\n      target: {\n        type: 'string',\n        enum: ['file', 'function', 'class', 'type', 'all'],\n        description: 'What to document',\n      },\n      path: {\n        type: 'string',\n        description: 'Specific file path to document',\n      },\n      files: {\n        type: 'string',\n        description: 'File(s) to process: single path, comma-separated list, or glob',\n      },\n      style: {\n        type: 'string',\n        enum: ['jsdoc', 'tsdoc', 'block'],\n        description: 'Documentation style (default: jsdoc)',\n      },\n\n      cwd: { type: 'string', description: 'Working directory (default: cwd)' },\n    },\n  },\n  async execute(input, ctx) {\n    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;\n    const style = input.style ?? 'jsdoc';\n    const results: DocumentedItem[] = [];\n    let filesProcessed = 0;\n    let itemsDocumented = 0;\n\n    const fileList = input.files\n      ? await resolveFiles(Array.isArray(input.files) ? input.files.join(',') : input.files, cwd)\n      : input.path\n        ? [safeResolve(input.path, ctx)]\n        : [];\n\n    for (const absPath of fileList) {\n      try {\n        const content = await fs.readFile(absPath, 'utf8');\n        filesProcessed++;\n        const processed = processFile(\n          content,\n          absPath,\n          style,\n          input.overwrite ?? false,\n          input.target ?? 'all',\n        );\n        results.push(...processed);\n        itemsDocumented += processed.filter((r) => r.status === 'documented').length;\n      } catch (e) {\n        results.push({\n          path: absPath,\n          name: absPath.split('/').pop() ?? absPath,\n          signature: '',\n          docstring: '',\n          status: 'error',\n          error: e instanceof Error ? e.message : String(e),\n        });\n      }\n    }\n\n    return {\n      files_processed: filesProcessed,\n      items_documented: itemsDocumented,\n      results,\n      style,\n    };\n  },\n};\n\nasync function resolveFiles(filesInput: string, cwd: string): Promise<string[]> {\n  const files = Array.isArray(filesInput) ? filesInput : filesInput.split(',');\n  const resolved: string[] = [];\n\n  for (const f of files) {\n    const absPath = f.trim().startsWith('/') ? f.trim() : `${cwd}/${f.trim()}`;\n    try {\n      const stat = await fs.stat(absPath);\n      if (stat.isFile()) resolved.push(absPath);\n    } catch {\n      // skip\n    }\n  }\n\n  return resolved;\n}\n\nfunction processFile(\n  content: string,\n  absPath: string,\n  _style: string,\n  _overwrite: boolean,\n  target: string,\n): DocumentedItem[] {\n  const results: DocumentedItem[] = [];\n  // These must be global \u2014 `String.prototype.matchAll` throws on a non-global\n  // RegExp, which previously made processFile throw and report every file as an\n  // error instead of returning documentation candidates.\n  const functionRegex = /(?:async\\s+)?function\\s+(\\w+)\\s*\\(([^)]*)\\)/g;\n  const arrowRegex = /(?:const|let|var)\\s+(\\w+)\\s*=\\s*(?:async\\s+)?\\(([^)]*)\\)\\s*=>/g;\n  const classRegex = /class\\s+(\\w+)/g;\n  const typeRegex = /(?:type|interface)\\s+(\\w+)\\s*[=<]/g;\n\n  const allMatches: { name: string; sig: string; type: string; line: number }[] = [];\n\n  if (target === 'all' || target === 'function') {\n    for (const m of content.matchAll(functionRegex)) {\n      /* v8 ignore next -- capture group (\\w+) is mandatory, so m[1] is always defined; defensive. */\n      if (!m[1]) continue;\n      allMatches.push({\n        name: m[1],\n        sig: m[2] ?? '',\n        type: 'function',\n        line: content.slice(0, m.index).split('\\n').length,\n      });\n    }\n    for (const m of content.matchAll(arrowRegex)) {\n      /* v8 ignore next -- capture group (\\w+) is mandatory, so m[1] is always defined; defensive. */\n      if (!m[1]) continue;\n      allMatches.push({\n        name: m[1],\n        sig: m[2] ?? '',\n        type: 'arrow',\n        line: content.slice(0, m.index).split('\\n').length,\n      });\n    }\n  }\n\n  if (target === 'all' || target === 'class') {\n    for (const m of content.matchAll(classRegex)) {\n      /* v8 ignore next -- capture group (\\w+) is mandatory, so m[1] is always defined; defensive. */\n      if (!m[1]) continue;\n      allMatches.push({\n        name: m[1],\n        sig: '',\n        type: 'class',\n        line: content.slice(0, m.index).split('\\n').length,\n      });\n    }\n  }\n\n  if (target === 'all' || target === 'type') {\n    for (const m of content.matchAll(typeRegex)) {\n      /* v8 ignore next -- capture group (\\w+) is mandatory, so m[1] is always defined; defensive. */\n      if (!m[1]) continue;\n      allMatches.push({\n        name: m[1],\n        sig: m[0] ?? '',\n        type: 'type',\n        line: content.slice(0, m.index).split('\\n').length,\n      });\n    }\n  }\n\n  for (const m of allMatches) {\n    results.push({\n      path: absPath,\n      name: m.name,\n      signature: m.sig,\n      docstring: `/** ${m.name} - documented at line ${m.line} */`,\n      status: 'skipped',\n    });\n  }\n\n  return results;\n}\n", "import { createHash } from 'node:crypto';\nimport * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core';\nimport type { Context } from '@wrongstack/core';\n\n/**\n * sha-256 hex of a UTF-8 string. Used by the file tools to record a content\n * hash alongside the mtime in `ctx.recordRead` \u2014 the hash is the authoritative\n * staleness arbiter for `edit` (mtime has a 2 s tolerance window on Windows).\n */\nexport function sha256hex(content: string): string {\n  return createHash('sha256').update(content, 'utf8').digest('hex');\n}\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm \u2192 yarn \u2192 npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);\n}\n\n/**\n * Roots every file tool may always reach, even in restricted mode: the\n * project root and the user-global `~/.wrongstack` directory (config, memory,\n * sessions, skills). `~/.wrongstack` honors the `WRONGSTACK_HOME` override.\n */\nfunction allowedRoots(ctx: Context): string[] {\n  return [path.resolve(ctx.projectRoot), path.resolve(Core.wstackGlobalRoot())];\n}\n\n/** True if `target` is `root` itself or nested inside any of `roots`. */\nfunction isInsideAny(target: string, roots: string[]): boolean {\n  return roots.some((root) => {\n    const rel = path.relative(root, target);\n    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));\n  });\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const target = path.resolve(absPath);\n  // Unrestricted filesystem access: skip the project-root containment check.\n  if (ctx.allowOutsideProjectRoot) return target;\n  if (isInsideAny(target, allowedRoots(ctx))) return target;\n  throw new Error(`Path \"${absPath}\" is outside project root \"${path.resolve(ctx.projectRoot)}\"`);\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root\u2192out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink \u2014 macOS `/var`\u2192`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  // Unrestricted filesystem access: no symlink-escape check to perform.\n  if (ctx.allowOutsideProjectRoot) return;\n  // Compare like-for-like against the realpath of each always-allowed root\n  // (project root + ~/.wrongstack), since a root may itself be a symlink.\n  const realRoots = await Promise.all(\n    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r))),\n  );\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    if (isInsideAny(real, realRoots)) return;\n    throw new Error(\n      `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoots[0]}\"`,\n    );\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n\u2026[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]\u2026\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// \u2500\u2500\u2500 Command-output normalization (token-saving) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) \u2014 never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only \u2014 it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `\u2026 \u27E8repeated ${run}\u00D7\u27E9`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends \u2014 the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n\u2026[truncated ${total - kept} bytes]\u2026\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI \u2192 collapse\n * carriage-return progress \u2192 trim trailing whitespace \u2192 collapse identical\n * consecutive lines \u2192 squeeze blank-line runs \u2192 head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number | undefined } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines \u2192 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n"],
+  "mappings": ";AAAA,YAAY,QAAQ;;;ACEpB,YAAY,UAAU;AACtB,YAAY,UAAU;AAqCf,SAAS,YAAY,OAAe,KAAsB;AAC/D,SAAY,gBAAW,KAAK,IAAS,eAAU,KAAK,IAAS,aAAQ,IAAI,cAAc,IAAI,KAAK,KAAK;AACvG;AAOA,SAAS,aAAa,KAAwB;AAC5C,SAAO,CAAM,aAAQ,IAAI,WAAW,GAAQ,aAAa,sBAAiB,CAAC,CAAC;AAC9E;AAGA,SAAS,YAAY,QAAgB,OAA0B;AAC7D,SAAO,MAAM,KAAK,CAAC,SAAS;AAC1B,UAAM,MAAW,cAAS,MAAM,MAAM;AACtC,WAAO,QAAQ,MAAO,CAAC,IAAI,WAAW,IAAI,KAAK,CAAM,gBAAW,GAAG;AAAA,EACrE,CAAC;AACH;AAEO,SAAS,iBAAiB,SAAiB,KAAsB;AACtE,QAAM,SAAc,aAAQ,OAAO;AAEnC,MAAI,IAAI,wBAAyB,QAAO;AACxC,MAAI,YAAY,QAAQ,aAAa,GAAG,CAAC,EAAG,QAAO;AACnD,QAAM,IAAI,MAAM,SAAS,OAAO,8BAAmC,aAAQ,IAAI,WAAW,CAAC,GAAG;AAChG;AAEO,SAAS,YAAY,OAAe,KAAsB;AAC/D,SAAO,iBAAiB,YAAY,OAAO,GAAG,GAAG,GAAG;AACtD;;;AD1CO,IAAM,eAAoD;AAAA,EAC/D,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aACE;AAAA,EAEF,WACE;AAAA,EAEF,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,WAAW;AAAA,EACX,cAAc,CAAC,SAAS;AAAA,EACxB,MAAM;AAAA,EACN,aAAa;AAAA,IACX,MAAM;AAAA,IACN,YAAY;AAAA,MACV,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM,CAAC,QAAQ,YAAY,SAAS,QAAQ,KAAK;AAAA,QACjD,aAAa;AAAA,MACf;AAAA,MACA,MAAM;AAAA,QACJ,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,OAAO;AAAA,QACL,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,OAAO;AAAA,QACL,MAAM;AAAA,QACN,MAAM,CAAC,SAAS,SAAS,OAAO;AAAA,QAChC,aAAa;AAAA,MACf;AAAA,MAEA,KAAK,EAAE,MAAM,UAAU,aAAa,mCAAmC;AAAA,IACzE;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,MAAM,MAAM,MAAM,YAAY,MAAM,KAAK,GAAG,IAAI,IAAI;AAC1D,UAAM,QAAQ,MAAM,SAAS;AAC7B,UAAM,UAA4B,CAAC;AACnC,QAAI,iBAAiB;AACrB,QAAI,kBAAkB;AAEtB,UAAM,WAAW,MAAM,QACnB,MAAM,aAAa,MAAM,QAAQ,MAAM,KAAK,IAAI,MAAM,MAAM,KAAK,GAAG,IAAI,MAAM,OAAO,GAAG,IACxF,MAAM,OACJ,CAAC,YAAY,MAAM,MAAM,GAAG,CAAC,IAC7B,CAAC;AAEP,eAAW,WAAW,UAAU;AAC9B,UAAI;AACF,cAAM,UAAU,MAAS,YAAS,SAAS,MAAM;AACjD;AACA,cAAM,YAAY;AAAA,UAChB;AAAA,UACA;AAAA,UACA;AAAA,UACA,MAAM,aAAa;AAAA,UACnB,MAAM,UAAU;AAAA,QAClB;AACA,gBAAQ,KAAK,GAAG,SAAS;AACzB,2BAAmB,UAAU,OAAO,CAAC,MAAM,EAAE,WAAW,YAAY,EAAE;AAAA,MACxE,SAAS,GAAG;AACV,gBAAQ,KAAK;AAAA,UACX,MAAM;AAAA,UACN,MAAM,QAAQ,MAAM,GAAG,EAAE,IAAI,KAAK;AAAA,UAClC,WAAW;AAAA,UACX,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AAAA,QAClD,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO;AAAA,MACL,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,MAClB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,aAAa,YAAoB,KAAgC;AAC9E,QAAM,QAAQ,MAAM,QAAQ,UAAU,IAAI,aAAa,WAAW,MAAM,GAAG;AAC3E,QAAM,WAAqB,CAAC;AAE5B,aAAW,KAAK,OAAO;AACrB,UAAM,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,EAAE,KAAK,IAAI,GAAG,GAAG,IAAI,EAAE,KAAK,CAAC;AACxE,QAAI;AACF,YAAMA,QAAO,MAAS,QAAK,OAAO;AAClC,UAAIA,MAAK,OAAO,EAAG,UAAS,KAAK,OAAO;AAAA,IAC1C,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,YACP,SACA,SACA,QACA,YACA,QACkB;AAClB,QAAM,UAA4B,CAAC;AAInC,QAAM,gBAAgB;AACtB,QAAM,aAAa;AACnB,QAAM,aAAa;AACnB,QAAM,YAAY;AAElB,QAAM,aAA0E,CAAC;AAEjF,MAAI,WAAW,SAAS,WAAW,YAAY;AAC7C,eAAW,KAAK,QAAQ,SAAS,aAAa,GAAG;AAE/C,UAAI,CAAC,EAAE,CAAC,EAAG;AACX,iBAAW,KAAK;AAAA,QACd,MAAM,EAAE,CAAC;AAAA,QACT,KAAK,EAAE,CAAC,KAAK;AAAA,QACb,MAAM;AAAA,QACN,MAAM,QAAQ,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE;AAAA,MAC9C,CAAC;AAAA,IACH;AACA,eAAW,KAAK,QAAQ,SAAS,UAAU,GAAG;AAE5C,UAAI,CAAC,EAAE,CAAC,EAAG;AACX,iBAAW,KAAK;AAAA,QACd,MAAM,EAAE,CAAC;AAAA,QACT,KAAK,EAAE,CAAC,KAAK;AAAA,QACb,MAAM;AAAA,QACN,MAAM,QAAQ,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,WAAW,SAAS;AAC1C,eAAW,KAAK,QAAQ,SAAS,UAAU,GAAG;AAE5C,UAAI,CAAC,EAAE,CAAC,EAAG;AACX,iBAAW,KAAK;AAAA,QACd,MAAM,EAAE,CAAC;AAAA,QACT,KAAK;AAAA,QACL,MAAM;AAAA,QACN,MAAM,QAAQ,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,eAAW,KAAK,QAAQ,SAAS,SAAS,GAAG;AAE3C,UAAI,CAAC,EAAE,CAAC,EAAG;AACX,iBAAW,KAAK;AAAA,QACd,MAAM,EAAE,CAAC;AAAA,QACT,KAAK,EAAE,CAAC,KAAK;AAAA,QACb,MAAM;AAAA,QACN,MAAM,QAAQ,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,EACF;AAEA,aAAW,KAAK,YAAY;AAC1B,YAAQ,KAAK;AAAA,MACX,MAAM;AAAA,MACN,MAAM,EAAE;AAAA,MACR,WAAW,EAAE;AAAA,MACb,WAAW,OAAO,EAAE,IAAI,yBAAyB,EAAE,IAAI;AAAA,MACvD,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAEA,SAAO;AACT;",
+  "names": ["stat"]
+}

package/dist/e2e.d.ts

@@ -0,0 +1,56 @@
+import type { Tool } from '@wrongstack/core';
+export type E2EFramework = 'playwright' | 'cypress';
+export type E2EPackageManager = 'pnpm' | 'npm' | 'yarn' | 'bun';
+interface E2EPlanInput {
+    cwd?: string | undefined;
+    framework?: E2EFramework | 'all' | undefined;
+    maxDepth?: number | undefined;
+    includeSpecs?: boolean | undefined;
+}
+export interface E2EServerHint {
+    kind: 'managed' | 'attach';
+    command?: string | undefined;
+    url?: string | undefined;
+    port?: number | undefined;
+    source: 'static-config';
+    incomplete: boolean;
+}
+export interface E2EExecutionPlan {
+    command: string;
+    args: string[];
+    cwd: string;
+    source: 'package-script' | 'framework-default';
+    script?: string | undefined;
+}
+export interface E2EProjectPlan {
+    framework: E2EFramework;
+    root: string;
+    configPath?: string | undefined;
+    packagePath?: string | undefined;
+    packageManager: E2EPackageManager;
+    evidence: string[];
+    scripts: string[];
+    serverHints: E2EServerHint[];
+    specPattern: string;
+    specCount: number;
+    specSamples: string[];
+    specsTruncated: boolean;
+    execution: E2EExecutionPlan;
+    warnings: string[];
+}
+export interface E2EPlanOutput {
+    root: string;
+    projects: E2EProjectPlan[];
+    scannedDirectories: number;
+    scanTruncated: boolean;
+    warnings: string[];
+}
+export declare function discoverE2EProjects(root: string, options: {
+    framework?: E2EFramework | 'all' | undefined;
+    maxDepth?: number | undefined;
+    includeSpecs?: boolean | undefined;
+    signal: AbortSignal;
+}): Promise<E2EPlanOutput>;
+export declare const e2ePlanTool: Tool<E2EPlanInput, E2EPlanOutput>;
+export {};
+//# sourceMappingURL=e2e.d.ts.map

package/dist/e2e.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e.d.ts","sourceRoot":"","sources":["../src/e2e.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG7C,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,SAAS,CAAC;AACpD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;AAEhE,UAAU,YAAY;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,SAAS,CAAC,EAAE,YAAY,GAAG,KAAK,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,EAAE,eAAe,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IAC/C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,YAAY,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,cAAc,EAAE,iBAAiB,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA0XD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,SAAS,CAAC,EAAE,YAAY,GAAG,KAAK,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,MAAM,EAAE,WAAW,CAAC;CACrB,GACA,OAAO,CAAC,aAAa,CAAC,CAuHxB;AAED,eAAO,MAAM,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CA4CzD,CAAC"}

package/dist/edit.d.ts

@@ -1,36 +1,5 @@
-import { Tool } from '@wrongstack/core';
-
-/**
- * Matching ladder for the `edit` tool.
- *
- * Models routinely hallucinate whitespace when reproducing code they read
- * many turns ago: trailing spaces appear, indentation shifts by a level,
- * tabs become spaces. A strict exact-match `old_string` fails on all of
- * these even though the intended target is unambiguous. This module
- * implements a graded fallback chain — each tier is strictly more permissive
- * and strictly lower-confidence than the previous one:
- *
- *   1. `exact`                  — substring match (the classic behavior).
- *   2. `trailing-whitespace`    — whole-line window match ignoring trailing
- *                                 whitespace per line. Zero ambiguity risk
- *                                 beyond exact (trailing blanks never carry
- *                                 meaning in the languages we edit).
- *   3. `whitespace-normalized`  — whole-line window match ignoring leading
- *                                 AND trailing whitespace per line. The
- *                                 replacement is re-indented to the file's
- *                                 actual indentation.
- *   4. `fuzzy`                  — block-anchor match: first and last lines
- *                                 must match (trimmed), interior lines are
- *                                 compared by Levenshtein similarity. Only a
- *                                 single candidate with a clear margin over
- *                                 the runner-up is accepted.
- *
- * The caller (edit.ts) enforces per-tier uniqueness, restricts `replace_all`
- * to tiers 1–2, and surfaces the tier + confidence in the tool output so the
- * model and the session log both see when a fallback fired.
- */
-type MatchTier = 'exact' | 'trailing-whitespace' | 'whitespace-normalized' | 'fuzzy';
-
+import type { Tool } from '@wrongstack/core';
+import { type MatchTier } from './_edit-match.js';
 interface EditInput {
     path: string;
     old_string: string;
@@ -61,6 +30,6 @@ interface EditOutput {
     syntax_errors?: string[] | undefined;
     note?: string | undefined;
 }
-declare const editTool: Tool<EditInput, EditOutput>;
-
-export { editTool };
+export declare const editTool: Tool<EditInput, EditOutput>;
+export {};
+//# sourceMappingURL=edit.d.ts.map

package/dist/edit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edit.d.ts","sourceRoot":"","sources":["../src/edit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAS7C,OAAO,EAIL,KAAK,SAAS,EAIf,MAAM,kBAAkB,CAAC;AAI1B,UAAU,SAAS;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACnC;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,eAAO,MAAM,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAiRhD,CAAC"}

package/dist/edit.js

@@ -1,10 +1,13 @@
-import * as fs from 'node:fs/promises';
-import * as Core from '@wrongstack/core';
-import { ToolValidationError, detectNewlineStyle, normalizeToLf, toStyle, atomicWrite, unifiedDiff } from '@wrongstack/core';
-import * as path2 from 'node:path';
-import { createHash } from 'node:crypto';
-
 // src/edit.ts
+import * as fs from "node:fs/promises";
+import {
+  atomicWrite,
+  detectNewlineStyle,
+  normalizeToLf,
+  ToolValidationError,
+  toStyle,
+  unifiedDiff
+} from "@wrongstack/core";
 
 // src/_edit-match.ts
 var TIER_LABEL = {
@@ -209,12 +212,15 @@ function prefixSimilarity(a, b) {
   while (p < lim && a.charCodeAt(p) === b.charCodeAt(p)) p++;
   return p / max;
 }
+
+// src/_syntax-check.ts
+import * as path from "node:path";
 var TS_LIKE = /* @__PURE__ */ new Set([".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"]);
 var MAX_CHECK_CHARS = 15e5;
 var MAX_ERRORS = 5;
 var tsLoad = null;
 function loadTypescript() {
-  tsLoad ??= import('typescript').then(
+  tsLoad ??= import("@typescript/typescript6").then(
     (m) => m.default ?? m,
     () => null
   );
@@ -232,15 +238,15 @@ async function checkSyntax(filePath, content, previousContent) {
   return { errors, preExisting };
 }
 function isJsoncFile(filePath) {
-  const base = path2.basename(filePath).toLowerCase();
+  const base = path.basename(filePath).toLowerCase();
   if (base.endsWith(".jsonc")) return true;
   if (/^(tsconfig|jsconfig)([.-].*)?\.json$/.test(base)) return true;
-  const dir = path2.basename(path2.dirname(filePath)).toLowerCase();
+  const dir = path.basename(path.dirname(filePath)).toLowerCase();
   return dir === ".vscode";
 }
 async function parseErrors(filePath, content) {
   if (content.length > MAX_CHECK_CHARS) return void 0;
-  const ext = path2.extname(filePath).toLowerCase();
+  const ext = path.extname(filePath).toLowerCase();
   if (ext === ".json" || ext === ".jsonc") {
     try {
       JSON.parse(content);
@@ -267,7 +273,7 @@ async function parseErrors(filePath, content) {
     ts.ScriptKind.JSX
   );
   const sourceFile = ts.createSourceFile(
-    path2.basename(filePath),
+    path.basename(filePath),
     content,
     ts.ScriptTarget.Latest,
     /* setParentNodes */
@@ -291,6 +297,12 @@ function formatDiag(ts, diag, content, sourceFile) {
   }
   return `line ${line}: ${message}`;
 }
+
+// src/_util.ts
+import { createHash } from "node:crypto";
+import * as fsp from "node:fs/promises";
+import * as path2 from "node:path";
+import * as Core from "@wrongstack/core";
 function sha256hex(content) {
   return createHash("sha256").update(content, "utf8").digest("hex");
 }
@@ -318,13 +330,13 @@ function safeResolve(input, ctx) {
 async function assertRealInsideRoot(absPath, ctx) {
   if (ctx.allowOutsideProjectRoot) return;
   const realRoots = await Promise.all(
-    allowedRoots(ctx).map((r) => fs.realpath(r).catch(() => path2.resolve(r)))
+    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path2.resolve(r)))
   );
   let probe = absPath;
   for (; ; ) {
     let real;
     try {
-      real = await fs.realpath(probe);
+      real = await fsp.realpath(probe);
     } catch (err) {
       if (err.code === "ENOENT") {
         const parent = path2.dirname(probe);
@@ -545,7 +557,7 @@ Compare this against your old_string and retry with the file's actual text.` : "
     };
   }
 };
-
-export { editTool };
+export {
+  editTool
+};
 //# sourceMappingURL=edit.js.map
-//# sourceMappingURL=edit.js.map