@wrongstack/tools 0.289.0 → 0.291.1

package/dist/builtin.js

@@ -639,8 +639,8 @@ var init_process_registry = __esm({
         if (p.killed) return true;
         if (p.protected) return false;
         const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
-        const isWin4 = os.platform() === "win32";
-        if (isWin4) {
+        const isWin5 = os.platform() === "win32";
+        if (isWin5) {
           const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
           const directFallback = () => {
             if (p.child.exitCode === null) {
@@ -2605,8 +2605,8 @@ async function scanDirectory(directory, depth, profiles, limits, state, extraIgn
     collectFileEvidence(directory, fullPath, entry.name, profiles, state);
   }
 }
-function collectFileEvidence(directory, fullPath, basename9, profiles, state) {
-  const lower = basename9.toLowerCase();
+function collectFileEvidence(directory, fullPath, basename10, profiles, state) {
+  const lower = basename10.toLowerCase();
   const extension = path4.extname(lower);
   for (const profile of profiles) {
     const detector = profile.detectors.find(
@@ -2617,7 +2617,7 @@ function collectFileEvidence(directory, fullPath, basename9, profiles, state) {
       candidate.evidence.push({
         kind: detector.kind,
         path: fullPath,
-        value: basename9,
+        value: basename10,
         weight: detector.weight
       });
       if (detector.kind === "manifest" || detector.kind === "config") {
@@ -3934,15 +3934,15 @@ async function changedPaths(before, after, beforeSizes, afterSizes) {
   const beforeSet = new Set(before);
   const afterSet = new Set(after);
   const changed = /* @__PURE__ */ new Set();
-  for (const path32 of after) {
-    if (!beforeSet.has(path32)) changed.add(path32);
+  for (const path33 of after) {
+    if (!beforeSet.has(path33)) changed.add(path33);
   }
-  for (const path32 of before) {
-    if (!afterSet.has(path32)) changed.add(path32);
+  for (const path33 of before) {
+    if (!afterSet.has(path33)) changed.add(path33);
   }
   if (beforeSizes && afterSizes) {
-    for (const path32 of after) {
-      if (beforeSizes.get(path32) !== afterSizes.get(path32)) changed.add(path32);
+    for (const path33 of after) {
+      if (beforeSizes.get(path33) !== afterSizes.get(path33)) changed.add(path33);
     }
   }
   return [...changed].sort();
@@ -5374,17 +5374,18 @@ function getPersistentProcessRegistry() {
 
 // src/bash-kill-guard.ts
 var isWin2 = os3.platform() === "win32";
+var SCRIPT_KILL_RE = /^(?:\.\\|\.\/)?(?:kill|terminate|stop)\S*\.(?:ps1|bat|cmd|sh)(?:\s|$)/i;
+var SCRIPT_KILL_RE_POSIX = /^(?:\.\/)?(?:kill|terminate|stop)\S*\.sh(?:\s|$)/i;
+var SCRIPT_KILL_FALLBACK_RE = /^\S*(?:kill|terminate|stop)\S*\.(?:ps1|bat|cmd|sh)\b/i;
 function extractKillCommand(command) {
   const normalized = command.replace(/\s+/g, " ").trim();
-  const shellCMatch = normalized.match(
-    /^(?:\S+(?:\s+\S+)?)?\s+-c\s+['"](.+?)['"]$/
-  );
-  if (shellCMatch?.[1]) {
-    const inner = shellCMatch[1].trim();
+  const shellCMatch = normalized.match(/^.+?\s+-c\s+(['"])([\s\S]+)\1$/);
+  if (shellCMatch?.[2]) {
+    const inner = shellCMatch[2].trim();
     return isKillRelatedCommand(inner) ? inner : null;
   }
   const shellCUnquoted = normalized.match(
-    /^(?:\S+(?:\s+\S+)?)?\s+-c\s+(kill(?:\s+-[a-zA-Z]+)?(?:\s+\d+)+)$/
+    /^.+?\s+-c\s+(kill(?:\s+-s\s+[a-zA-Z0-9]+|\s+-[a-zA-Z0-9]+)?\s+\d+)$/
   );
   if (shellCUnquoted?.[1]) {
     return shellCUnquoted[1];
@@ -5396,22 +5397,47 @@ function isKillRelatedCommand(cmd) {
   if (isWin2) {
     if (/^taskkill\s/i.test(normalized)) return true;
     if (/^tskill\s/i.test(normalized)) return true;
+    if (/^(stop-process|kill|stop)\s/i.test(normalized)) return true;
+    if (/^wmic\s+process\s/i.test(normalized) && /\bdelete\b/i.test(normalized)) return true;
+    if (SCRIPT_KILL_RE.test(normalized)) return true;
     return false;
   }
   if (/^kill(\s|$)/.test(normalized)) return true;
   if (/^(pkill|killall|pgrep|skill)\s/.test(normalized)) return true;
   if (/^\/proc\/\d+\/(?:kill|fd)/.test(normalized)) return true;
+  if (SCRIPT_KILL_RE_POSIX.test(normalized)) return true;
   return false;
 }
 function parseKillCommand(command) {
   const normalized = command.replace(/\s+/g, " ").trim();
   if (isWin2) {
-    const taskkillMatch = normalized.match(/^taskkill\s+(?:\/[a-zA-Z]+\s+)*\/PID\s+(\d+)/i);
-    if (taskkillMatch?.[1]) {
-      const pidStr = taskkillMatch[1];
+    const hasTaskkillForce = /(?:^|\s)\/F(?=\s|$)/i.test(normalized);
+    const isSimpleTaskkill = /^taskkill\s+/i.test(normalized) && !/[|&<>]/.test(normalized);
+    const taskkillPidMatch = isSimpleTaskkill ? normalized.match(/(?:^|\s)\/PID\s+(\d+)(?=\s|$)/i) : null;
+    if (taskkillPidMatch?.[1]) {
+      return {
+        pid: parseInt(taskkillPidMatch[1], 10),
+        signal: hasTaskkillForce ? "FORCE" : "TERM",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const taskkillImMatch = isSimpleTaskkill ? normalized.match(/(?:^|\s)\/IM\s+([^\s/]+)(?=\s|$)/i) : null;
+    if (taskkillImMatch?.[1]) {
+      return {
+        name: taskkillImMatch[1],
+        signal: hasTaskkillForce ? "FORCE" : "TERM",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const taskkillFiMatch = isSimpleTaskkill ? normalized.match(/(?:^|\s)\/FI\s+"IMAGENAME\s+eq\s+([^"]+)"(?=\s|$)/i) : null;
+    if (taskkillFiMatch?.[1]) {
       return {
-        pid: parseInt(pidStr, 10),
-        signal: normalized.includes("/F") ? "FORCE" : "TERM",
+        name: taskkillFiMatch[1],
+        signal: hasTaskkillForce ? "FORCE" : "TERM",
         isGroupKill: false,
         isAllKill: false,
         originalCommand: command
@@ -5419,18 +5445,109 @@ function parseKillCommand(command) {
     }
     const tskillMatch = normalized.match(/^tskill\s+(\d+)/i);
     if (tskillMatch?.[1]) {
-      const pidStr = tskillMatch[1];
       return {
-        pid: parseInt(pidStr, 10),
+        pid: parseInt(tskillMatch[1], 10),
         signal: "TERM",
         isGroupKill: false,
         isAllKill: false,
         originalCommand: command
       };
     }
+    const isStopProcIdCommand = /^(?:stop-process|kill)(?:\s+-(?:id|pid)\s+\d+|\s+-[a-zA-Z]+)+$/i.test(normalized);
+    const stopProcIdMatch = normalized.match(/(?:^|\s)-(?:id|pid)\s+(\d+)(?=\s|$)/i);
+    if (isStopProcIdCommand && stopProcIdMatch?.[1]) {
+      return {
+        pid: parseInt(stopProcIdMatch[1], 10),
+        signal: "FORCE",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const killSignalOptionMatch = normalized.match(/^kill\s+-s\s+([a-zA-Z0-9]+)\s+(\d+)$/i);
+    if (killSignalOptionMatch?.[1] && killSignalOptionMatch[2]) {
+      return {
+        pid: parseInt(killSignalOptionMatch[2], 10),
+        signal: killSignalOptionMatch[1].toUpperCase(),
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const killPosixMatch = normalized.match(/^kill\s+(?:(-[a-zA-Z0-9]+)\s+)?(\d+)$/);
+    if (killPosixMatch?.[2]) {
+      const sig = killPosixMatch[1] ? killPosixMatch[1].slice(1).toUpperCase() : "TERM";
+      return {
+        pid: parseInt(killPosixMatch[2], 10),
+        signal: sig,
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const stopProcNameMatch = normalized.match(
+      /^(?:stop-process|kill)\s+-(?:name|n)\s+(?:['"]([a-zA-Z0-9_.-]+)['"]|([a-zA-Z0-9_.-]+))(?:\s|$)/i
+    );
+    const stopProcName = stopProcNameMatch?.[1] ?? stopProcNameMatch?.[2];
+    if (stopProcName) {
+      return {
+        name: stopProcName,
+        signal: "FORCE",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const stopProcStandalone = normalized.match(
+      /^(?:stop-process|kill)\s+['"]?([a-zA-Z][a-zA-Z0-9_.-]+)['"]?$/i
+    );
+    if (stopProcStandalone?.[1]) {
+      return {
+        name: stopProcStandalone[1],
+        signal: "FORCE",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const wmicMatch = normalized.match(
+      /^wmic\s+process\s+where\s+['"]?(?:name\s*=\s*['"]?)([a-zA-Z0-9_.-]+)/i
+    );
+    if (wmicMatch?.[1]) {
+      return {
+        name: wmicMatch[1],
+        signal: "FORCE",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const killScriptMatch = normalized.match(SCRIPT_KILL_RE);
+    if (killScriptMatch) {
+      return {
+        name: "kill-script",
+        // sentinel — isKillProtected always blocks "kill-script"
+        signal: "FORCE",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
     return null;
   }
-  const simpleMatch = normalized.match(/^kill\s+(?:(-[a-zA-Z]+)\s+)?(\d+|-?\d+)$/);
+  const signalOptionMatch = normalized.match(/^kill\s+-s\s+([a-zA-Z0-9]+)\s+(\d+|-?\d+)$/i);
+  if (signalOptionMatch?.[1] && signalOptionMatch[2]) {
+    const pidOrGroup = signalOptionMatch[2];
+    const isGroupKill = pidOrGroup.startsWith("-");
+    return {
+      pid: parseInt(isGroupKill ? pidOrGroup.slice(1) : pidOrGroup, 10),
+      signal: signalOptionMatch[1].toUpperCase(),
+      isGroupKill,
+      isAllKill: false,
+      originalCommand: command
+    };
+  }
+  const simpleMatch = normalized.match(/^kill\s+(?:(-[a-zA-Z0-9]+)\s+)?(\d+|-?\d+)$/);
   if (simpleMatch) {
     const signal = simpleMatch[1] ?? "-TERM";
     const pidOrGroup = simpleMatch[2];
@@ -5490,6 +5607,9 @@ async function getProtectedEntries() {
 }
 async function isKillProtected(kill) {
   const registry = getPersistentProcessRegistry();
+  if (kill.name === "kill-script") {
+    return true;
+  }
   if (kill.name) {
     const entries = await getProtectedEntries();
     const killNameLower = kill.name.toLowerCase();
@@ -5529,6 +5649,12 @@ async function checkAndBlockKillCommand(command) {
         reason: `Blocked: complex kill pipeline detected \u2014 "${killCmd.slice(0, 50)}..."`
       };
     }
+    if (SCRIPT_KILL_FALLBACK_RE.test(killCmd)) {
+      return {
+        blocked: true,
+        reason: `Blocked: script-based kill detected \u2014 "${killCmd.slice(0, 80)}" may target protected WrongStack processes (cannot inspect script body).`
+      };
+    }
     return { blocked: false };
   }
   if (await isKillProtected(parsed)) {
@@ -5552,8 +5678,8 @@ async function checkAndBlockKillCommand(command) {
 
 // src/_shell-pick.ts
 var POSIX_DEFAULT = "cmd";
-function pickShell(platform4, command, env) {
-  if (platform4 !== "win32") return POSIX_DEFAULT;
+function pickShell(platform5, command, env) {
+  if (platform5 !== "win32") return POSIX_DEFAULT;
   const override = env.get("WRONGSTACK_SHELL")?.trim().toLowerCase();
   if (override === "cmd" || override === "cmd.exe") return "cmd";
   if (override === "powershell" || override === "powershell.exe") return "powershell";
@@ -5757,10 +5883,10 @@ var bashTool = {
       }));
     }
     const timeoutMs = Math.max(1, Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT_MS2, 6e5));
-    const isWin4 = os4.platform() === "win32";
+    const isWin5 = os4.platform() === "win32";
     let plan;
     let winShellKind;
-    if (isWin4) {
+    if (isWin5) {
       const shell2 = pickShell("win32", input.command, {
         get: (k) => process.env[k]
       });
@@ -5789,7 +5915,7 @@ var bashTool = {
     const shell = plan.bin;
     const args = plan.useStdin ? [...plan.argv] : [...plan.argv, input.command];
     const env = buildChildEnv2(ctx.session?.id);
-    const detached = !isWin4;
+    const detached = !isWin5;
     const startedAt = Date.now();
     if (input.background) {
       let buf2 = "";
@@ -5807,7 +5933,7 @@ var bashTool = {
         // apply: the child gets a hidden console that grandchildren inherit.
         // Windows children survive parent exit either way. POSIX keeps
         // detached for the process-group kill semantics.
-        detached: !isWin4,
+        detached: !isWin5,
         windowsHide: true
       });
       if (plan.useStdin) {
@@ -5918,7 +6044,7 @@ var bashTool = {
       stdio: [plan.useStdin ? "pipe" : "ignore", "pipe", "pipe"],
       detached,
       windowsHide: true,
-      ...isWin4 ? {} : { signal: opts.signal }
+      ...isWin5 ? {} : { signal: opts.signal }
     });
     if (plan.useStdin) {
       try {
@@ -5971,7 +6097,7 @@ var bashTool = {
     const timers = [];
     const spool = createOutputSpool({ tool: "bash", thresholdBytes: MAX_OUTPUT });
     function killWithTimeout(child2, timeoutMs2) {
-      if (isWin4) {
+      if (isWin5) {
         if (typeof child2.pid === "number" && child2.exitCode === null) {
           const attempted = registry.kill(child2.pid, { force: true, graceMs: timeoutMs2 });
           if (!attempted) {
@@ -6012,7 +6138,7 @@ var bashTool = {
     timers.push(timer);
     timer.unref?.();
     const onAbort = () => killWithTimeout(child, 2e3);
-    if (isWin4) {
+    if (isWin5) {
       if (opts.signal.aborted) onAbort();
       else opts.signal.addEventListener("abort", onAbort, { once: true });
     }
@@ -6126,7 +6252,7 @@ ${hint}` : ""),
     } finally {
       for (const t of timers) clearTimeout(t);
       spool.finalize();
-      if (isWin4) opts.signal.removeEventListener("abort", onAbort);
+      if (isWin5) opts.signal.removeEventListener("abort", onAbort);
       child.stdout?.off("data", onStdoutData);
       child.stderr?.off("data", onStderrData);
       child.stdout?.destroy();
@@ -7774,6 +7900,53 @@ function codebaseIndexDirOverride(ctx) {
   const v = ctx.meta?.["codebaseIndexDir"];
   return typeof v === "string" ? v : void 0;
 }
+var StorePool = class {
+  stores = /* @__PURE__ */ new Map();
+  key(projectRoot, indexDir) {
+    return `${projectRoot}\0${indexDir ?? ""}`;
+  }
+  /** Borrow a store. Creates it on first access for this key. */
+  acquire(projectRoot, opts) {
+    const k = this.key(projectRoot, opts?.indexDir);
+    let store = this.stores.get(k);
+    if (!store) {
+      store = new IndexStore(projectRoot, { indexDir: opts?.indexDir });
+      this.stores.set(k, store);
+    }
+    return store;
+  }
+  /** Return the store to the pool. The connection stays warm for subsequent
+   * operations on the same (projectRoot, indexDir). */
+  release(_store) {
+  }
+  /** Close every pooled connection and drain the pool. Call on shutdown. */
+  closeAll() {
+    for (const store of this.stores.values()) {
+      try {
+        store.close();
+      } catch {
+      }
+    }
+    this.stores.clear();
+  }
+  /** Remove one store from the pool. Used by tests that need isolation. */
+  evict(projectRoot, indexDir) {
+    const k = this.key(projectRoot, indexDir);
+    const store = this.stores.get(k);
+    if (store) {
+      try {
+        store.close();
+      } catch {
+      }
+      this.stores.delete(k);
+    }
+  }
+  /** True when the pool holds a connection for the given key. */
+  has(projectRoot, indexDir) {
+    return this.stores.has(this.key(projectRoot, indexDir));
+  }
+};
+var indexStorePool = new StorePool();
 var warningSilenced = false;
 function silenceSqliteExperimentalWarning() {
   if (warningSilenced) return;
@@ -7991,7 +8164,7 @@ var IndexStore = class _IndexStore {
     return this.runWithRetry(() => {
       this.db.exec("BEGIN IMMEDIATE");
       try {
-        const maxRows = this.db.prepare("SELECT MAX(id) AS m FROM symbols").all();
+        const maxRows = this.stmt("SELECT MAX(id) AS m FROM symbols").all();
         let nextId = (maxRows[0]?.m ?? 0) + 1;
         const stmt = this.db.prepare(
           `INSERT INTO symbols(id, lang, kind, name, file, line, col, signature, doc_comment, scope, text, file_fk)
@@ -8263,7 +8436,7 @@ var IndexStore = class _IndexStore {
     return { results, total: candidates.length };
   }
   getAllIndexable() {
-    return this.db.prepare("SELECT id, text FROM symbols").all().map(({ id, text }) => ({ id, text }));
+    return this.stmt("SELECT id, text FROM symbols").all().map(({ id, text }) => ({ id, text }));
   }
   /**
    * Largest symbol id currently in the table (0 when empty). New ids must be
@@ -8273,7 +8446,7 @@ var IndexStore = class _IndexStore {
    * `symbols.id`). Ids may have gaps — that is fine.
    */
   getMaxSymbolId() {
-    const rows = this.db.prepare("SELECT MAX(id) AS m FROM symbols").all();
+    const rows = this.stmt("SELECT MAX(id) AS m FROM symbols").all();
     return rows[0]?.m ?? 0;
   }
   // ─── Stats ───────────────────────────────────────────────────────────────────
@@ -8281,14 +8454,14 @@ var IndexStore = class _IndexStore {
     const sizeBytes = this.sizeBytes();
     const lastRows = this.db.prepare("SELECT value FROM metadata WHERE key = 'last_indexed'").all();
     const lastIndexed = lastRows.length ? Number(lastRows[0]?.value) : null;
-    const totalRows = this.db.prepare("SELECT COUNT(*) FROM symbols").all();
+    const totalRows = this.stmt("SELECT COUNT(*) FROM symbols").all();
     const totalSymbols = totalRows[0] ? Number(totalRows[0]["COUNT(*)"]) : 0;
-    const fileRows = this.db.prepare("SELECT COUNT(*) FROM files").all();
+    const fileRows = this.stmt("SELECT COUNT(*) FROM files").all();
     const totalFiles = fileRows[0] ? Number(fileRows[0]["COUNT(*)"]) : 0;
-    const langRows = this.db.prepare("SELECT lang, COUNT(*) FROM symbols GROUP BY lang").all();
+    const langRows = this.stmt("SELECT lang, COUNT(*) FROM symbols GROUP BY lang").all();
     const byLang = {};
     for (const row of langRows) byLang[row.lang] = Number(row["COUNT(*)"]);
-    const kindRows = this.db.prepare("SELECT kind, COUNT(*) FROM symbols GROUP BY kind").all();
+    const kindRows = this.stmt("SELECT kind, COUNT(*) FROM symbols GROUP BY kind").all();
     const byKind = {};
     for (const row of kindRows) byKind[row.kind] = Number(row["COUNT(*)"]);
     return {
@@ -8320,11 +8493,14 @@ var IndexStore = class _IndexStore {
     this.runWithRetry(() => {
       this.db.exec("BEGIN IMMEDIATE");
       try {
-        this.db.exec("DELETE FROM refs");
-        this.db.exec("DELETE FROM symbols");
-        this.db.exec("DELETE FROM files");
-        if (this.ftsAvailable) this.db.exec("DELETE FROM symbols_fts");
+        this.db.exec("DROP TABLE IF EXISTS refs");
+        this.db.exec("DROP TABLE IF EXISTS symbols");
+        this.db.exec("DROP TABLE IF EXISTS files");
+        this.db.exec("DROP TABLE IF EXISTS metadata");
+        if (this.ftsAvailable) this.db.exec("DROP TABLE IF EXISTS symbols_fts");
         this.db.exec("COMMIT");
+        this.stmtCache.clear();
+        this.initSchema();
       } catch (err) {
         this.db.exec("ROLLBACK");
         throw err;
@@ -8409,7 +8585,7 @@ var IndexStore = class _IndexStore {
           ).run(...options.deleteForFiles);
           this.db.prepare(`DELETE FROM symbols WHERE file IN (${placeholders})`).run(...options.deleteForFiles);
         }
-        const maxRows = this.db.prepare("SELECT MAX(id) AS m FROM symbols").all();
+        const maxRows = this.stmt("SELECT MAX(id) AS m FROM symbols").all();
         let nextId = (maxRows[0]?.m ?? 0) + 1;
         const symStmt = this.db.prepare(
           `INSERT INTO symbols(id, lang, kind, name, file, line, col, signature, doc_comment, scope, text, file_fk)
@@ -8593,7 +8769,7 @@ var IndexStore = class _IndexStore {
    * symbol resolved in package B). Node metadata includes symbol/file counts.
    */
   getPackageGraph() {
-    const symbols = this.db.prepare("SELECT file, id, name, kind, lang, line FROM symbols ORDER BY id").all();
+    const symbols = this.db.prepare("SELECT file, id FROM symbols ORDER BY id").all();
     const pkgNodes = /* @__PURE__ */ new Map();
     const fileToPkg = /* @__PURE__ */ new Map();
     const symbolToPkg = /* @__PURE__ */ new Map();
@@ -8684,15 +8860,18 @@ var IndexStore = class _IndexStore {
    * derived from cross-file symbol references within the package.
    */
   getFileGraph(packageFilter) {
-    const allSymbols = this.db.prepare("SELECT file, id, name, kind, lang, line FROM symbols ORDER BY id").all();
-    const pkgSyms = allSymbols.filter(
-      (s) => (_IndexStore.derivePackage(s.file) ?? "(root)") === packageFilter
-    );
-    if (pkgSyms.length === 0) return { nodes: [], edges: [] };
+    const allFiles = this.db.prepare("SELECT DISTINCT file FROM symbols").all();
+    const pkgFilePaths = allFiles.filter((f) => (_IndexStore.derivePackage(f.file) ?? "(root)") === packageFilter).map((f) => f.file);
+    const localFiles = new Set(pkgFilePaths);
+    if (localFiles.size === 0) return { nodes: [], edges: [] };
+    const filePlaceholders = [...localFiles].map(() => "?").join(",");
+    const pkgSyms = this.db.prepare(
+      `SELECT file, id, name, kind, lang, line FROM symbols WHERE file IN (${filePlaceholders}) ORDER BY id`
+    ).all(...pkgFilePaths);
     const fileNodes = /* @__PURE__ */ new Map();
     const symToFile = /* @__PURE__ */ new Map();
     const fileStats = /* @__PURE__ */ new Map();
-    for (const s of allSymbols) {
+    for (const s of pkgSyms) {
       symToFile.set(s.id, s.file);
       const current = fileStats.get(s.file);
       fileStats.set(s.file, {
@@ -8700,8 +8879,6 @@ var IndexStore = class _IndexStore {
         lang: current?.lang ?? s.lang
       });
     }
-    const localFiles = new Set(pkgSyms.map((s) => s.file));
-    const indexedFiles = new Set(allSymbols.map((s) => s.file));
     const ensureFileNode = (file) => {
       if (fileNodes.has(file)) return;
       const stats = fileStats.get(file);
@@ -8719,11 +8896,32 @@ var IndexStore = class _IndexStore {
     for (const file of localFiles) {
       ensureFileNode(file);
     }
+    const indexedFiles = new Set(allFiles.map((f) => f.file));
     const refRows = this.db.prepare(
       `SELECT r.from_id, r.to_id, r.call_type
        FROM refs r
-       WHERE r.to_id IS NOT NULL`
-    ).all();
+       WHERE (r.from_id IN (SELECT id FROM symbols WHERE file IN (${filePlaceholders}))
+           OR r.to_id IN (SELECT id FROM symbols WHERE file IN (${filePlaceholders})))
+         AND r.to_id IS NOT NULL`
+    ).all(...pkgFilePaths, ...pkgFilePaths);
+    const knownSymIds = new Set(pkgSyms.map((s) => s.id));
+    const crossRefIds = /* @__PURE__ */ new Set();
+    for (const r of refRows) {
+      if (!knownSymIds.has(r.from_id)) crossRefIds.add(r.from_id);
+      if (!knownSymIds.has(r.to_id)) crossRefIds.add(r.to_id);
+    }
+    if (crossRefIds.size > 0) {
+      const crossPlaceholders = [...crossRefIds].map(() => "?").join(",");
+      const extras = this.db.prepare(
+        `SELECT id, file FROM symbols WHERE id IN (${crossPlaceholders})`
+      ).all(...crossRefIds);
+      for (const x of extras) {
+        symToFile.set(x.id, x.file);
+        if (!fileStats.has(x.file)) {
+          fileStats.set(x.file, { count: 0, lang: "ts" });
+        }
+      }
+    }
     const edgeMap = /* @__PURE__ */ new Map();
     for (const r of refRows) {
       if (r.call_type === "import") continue;
@@ -8745,8 +8943,9 @@ var IndexStore = class _IndexStore {
     const importRows = this.db.prepare(
       `SELECT r.from_id, r.to_name
        FROM refs r
-       WHERE r.call_type = 'import'`
-    ).all();
+       WHERE r.call_type = 'import'
+         AND r.from_id IN (SELECT id FROM symbols WHERE file IN (${filePlaceholders}))`
+    ).all(...pkgFilePaths);
     for (const r of importRows) {
       const fromFile = symToFile.get(r.from_id);
       if (!fromFile || !localFiles.has(fromFile)) continue;
@@ -8788,12 +8987,11 @@ var IndexStore = class _IndexStore {
    * derived from intra-file and cross-file symbol references (who calls whom).
    */
   getSymbolGraph(fileFilter) {
-    const allSymbols = this.db.prepare(
-      "SELECT id, name, kind, lang, file, line, signature, scope FROM symbols ORDER BY file, line, id"
-    ).all();
-    const syms = allSymbols.filter((symbol) => symbol.file === fileFilter);
+    const syms = this.db.prepare(
+      "SELECT id, name, kind, lang, file, line, signature, scope FROM symbols WHERE file = ? ORDER BY line, id"
+    ).all(fileFilter);
     if (syms.length === 0) return { nodes: [], edges: [] };
-    const symById = new Map(allSymbols.map((symbol) => [symbol.id, symbol]));
+    const symById = new Map(syms.map((symbol) => [symbol.id, symbol]));
     const relatedIds = new Set(syms.map((symbol) => symbol.id));
     const toGraphNode = (s) => ({
       id: `sym:${s.id}`,
@@ -8849,6 +9047,15 @@ var IndexStore = class _IndexStore {
         refType: bestType
       });
     }
+    const loadedIds = new Set(syms.map((s) => s.id));
+    const missingIds = [...relatedIds].filter((id) => !loadedIds.has(id));
+    if (missingIds.length > 0) {
+      const placeholders = missingIds.map(() => "?").join(",");
+      const extras = this.db.prepare(
+        `SELECT id, name, kind, lang, file, line, signature, scope FROM symbols WHERE id IN (${placeholders})`
+      ).all(...missingIds);
+      for (const s of extras) symById.set(s.id, s);
+    }
     const nodes = [...relatedIds].map((id) => symById.get(id)).filter((symbol) => symbol !== void 0).sort((a, b) => {
       const aExternal = a.file === fileFilter ? 0 : 1;
       const bExternal = b.file === fileFilter ? 0 : 1;
@@ -8874,6 +9081,7 @@ import { Worker } from "node:worker_threads";
 import { expectDefined as expectDefined6 } from "@wrongstack/core";
 import * as fs14 from "node:fs/promises";
 import * as path19 from "node:path";
+import { availableParallelism } from "node:os";
 import { compileGlob as compileGlob2 } from "@wrongstack/core";
 
 // src/codebase-index/ts-parser.ts
@@ -8930,8 +9138,7 @@ function extToLang(ext) {
       return null;
   }
 }
-function getSignature(node, sourceFile) {
-  const printer = ts.createPrinter({});
+function getSignature(printer, node, sourceFile) {
   const raw = printer.printNode(ts.EmitHint.Unspecified, node, sourceFile);
   return raw.replace(/\s+/g, " ").slice(0, 500);
 }
@@ -8950,28 +9157,14 @@ function getJsDoc(node, sourceFile) {
   }
   return "";
 }
-function hasFunctionLikeAncestor(node) {
-  let current = node.parent;
-  while (current) {
-    if (ts.isFunctionLike(current)) return true;
-    current = current.parent;
-  }
-  return false;
-}
-function buildScope(node) {
-  const parts = [];
-  let current = node.parent;
-  while (current) {
-    if (ts.isClassDeclaration(current) || ts.isInterfaceDeclaration(current) || ts.isEnumDeclaration(current) || ts.isTypeAliasDeclaration(current)) {
-      parts.unshift(current.name?.text ?? "Anon");
-    } else if (ts.isMethodDeclaration(current) || ts.isGetAccessor(current) || ts.isSetAccessor(current) || ts.isPropertyDeclaration(current) || ts.isFunctionDeclaration(current)) {
-      if (current.name && ts.isIdentifier(current.name)) {
-        parts.unshift(current.name.text);
-      }
+function pushScopeName(node, parts) {
+  if (ts.isClassDeclaration(node) || ts.isInterfaceDeclaration(node) || ts.isEnumDeclaration(node) || ts.isTypeAliasDeclaration(node)) {
+    parts.push(node.name?.text ?? "Anon");
+  } else if (ts.isMethodDeclaration(node) || ts.isGetAccessor(node) || ts.isSetAccessor(node) || ts.isPropertyDeclaration(node) || ts.isFunctionDeclaration(node)) {
+    if (node.name && ts.isIdentifier(node.name)) {
+      parts.push(node.name.text);
     }
-    current = current.parent;
   }
-  return parts.join(".");
 }
 function parseSymbols(opts) {
   const { file, content, lang } = opts;
@@ -8982,45 +9175,39 @@ function parseSymbols(opts) {
     return { file, lang, symbols: [], mtimeMs: Date.now() };
   }
   const symbols = [];
-  function visit(node) {
+  const refs = [];
+  const printer = ts.createPrinter({});
+  function visit(node, funcDepth, scopeParts) {
     const kind = kindOf(node);
     if (kind) {
-      if ((kind === "const" || kind === "let" || kind === "var" || kind === "parameter") && hasFunctionLikeAncestor(node)) {
-        ts.forEachChild(node, visit);
-        return;
+      if ((kind === "const" || kind === "let" || kind === "var" || kind === "parameter") && funcDepth > 0) {
+      } else {
+        const nameNode = node.name;
+        if (!nameNode || !ts.isIdentifier(nameNode)) {
+          return;
+        }
+        const name = nameNode.text;
+        const pos2 = nameNode.getStart(sourceFile);
+        const { line: line2, character } = sourceFile.getLineAndCharacterOfPosition(pos2);
+        const scope = scopeParts.join(".");
+        const signature = getSignature(printer, node, sourceFile);
+        const docComment = getJsDoc(node, sourceFile);
+        const text = [name, signature, docComment].filter(Boolean).join(" | ");
+        symbols.push({
+          id: 0,
+          lang,
+          kind,
+          name,
+          file,
+          line: line2 + 1,
+          col: character,
+          signature,
+          docComment,
+          scope,
+          text
+        });
       }
-      const nameNode = node.name;
-      if (!nameNode || !ts.isIdentifier(nameNode)) return;
-      const name = nameNode.text;
-      const pos = nameNode.getStart(sourceFile);
-      const { line, character } = sourceFile.getLineAndCharacterOfPosition(pos);
-      const scope = buildScope(node);
-      const signature = getSignature(node, sourceFile);
-      const docComment = getJsDoc(node, sourceFile);
-      const text = [name, signature, docComment].filter(Boolean).join(" | ");
-      symbols.push({
-        id: 0,
-        lang,
-        kind,
-        name,
-        file,
-        line: line + 1,
-        col: character,
-        signature,
-        docComment,
-        scope,
-        text
-      });
     }
-    ts.forEachChild(node, visit);
-  }
-  visit(sourceFile);
-  const refs = extractRefs(sourceFile);
-  return { file, lang, symbols, refs, mtimeMs: Date.now() };
-}
-function extractRefs(sourceFile) {
-  const refs = [];
-  function visit(node) {
     const pos = node.getStart(sourceFile);
     const { line } = sourceFile.getLineAndCharacterOfPosition(pos);
     const lineNum = line + 1;
@@ -9045,10 +9232,14 @@ function extractRefs(sourceFile) {
       const moduleName = getModuleName(node);
       if (moduleName) refs.push({ fromId: 0, toName: moduleName, callType: "import", line: lineNum });
     }
-    ts.forEachChild(node, visit);
+    const scopeIdx = scopeParts.length;
+    pushScopeName(node, scopeParts);
+    const childFuncDepth = ts.isFunctionLike(node) ? funcDepth + 1 : funcDepth;
+    ts.forEachChild(node, (child) => visit(child, childFuncDepth, scopeParts));
+    scopeParts.length = scopeIdx;
   }
-  visit(sourceFile);
-  return deduplicateRefs(refs);
+  visit(sourceFile, 0, []);
+  return { file, lang, symbols, refs: deduplicateRefs(refs), mtimeMs: Date.now() };
 }
 function getTypeName(name) {
   if (ts.isIdentifier(name)) return name.text;
@@ -9933,9 +10124,9 @@ function parseSymbols5(opts) {
 function regexParse2(opts) {
   const { file, content, lang } = opts;
   const symbols = [];
-  const basename9 = path17.basename(file).toLowerCase();
-  const isPackageJson = basename9 === "package.json";
-  const isTsconfig = basename9 === "tsconfig.json" || basename9 === "tsconfig.build.json";
+  const basename10 = path17.basename(file).toLowerCase();
+  const isPackageJson = basename10 === "package.json";
+  const isTsconfig = basename10 === "tsconfig.json" || basename10 === "tsconfig.build.json";
   const isJsonSchema = content.includes("$schema") || content.includes("$id") || content.includes("$ref");
   const isOpenApi = content.includes("openapi") || content.includes("swagger");
   const lines = content.split("\n");
@@ -10330,7 +10521,7 @@ async function loadGitignoreMatcher(projectRoot) {
 
 // src/codebase-index/indexer.ts
 var YIELD_EVERY_N = 50;
-var PARALLEL_BATCH = 20;
+var PARALLEL_BATCH = Math.min(availableParallelism() * 4, 40);
 function yieldEventLoop() {
   return new Promise((resolve14) => setImmediate(resolve14));
 }
@@ -10508,11 +10699,14 @@ async function runIndexerWithStore(store, opts) {
   if (!force) {
     for (const meta of store.getAllFileMetas()) existingMeta.set(meta.file, meta);
   }
+  let filesSinceLastYield = 0;
   for (let batchStart = 0; batchStart < files.length; batchStart += PARALLEL_BATCH) {
     const batchEnd = Math.min(batchStart + PARALLEL_BATCH, files.length);
     const batchFiles = files.slice(batchStart, batchEnd);
     opts.onProgress?.(batchEnd, files.length);
-    if (batchStart > 0 && batchStart % YIELD_EVERY_N === 0) {
+    filesSinceLastYield += batchFiles.length;
+    if (filesSinceLastYield >= YIELD_EVERY_N) {
+      filesSinceLastYield = 0;
       await yieldEventLoop();
       throwIfAborted(signal);
     }
@@ -10723,7 +10917,7 @@ async function indexService(args, hooks = {}) {
   });
 }
 function searchService(args) {
-  const store = new IndexStore(args.projectRoot, { indexDir: args.indexDir });
+  const store = indexStorePool.acquire(args.projectRoot, { indexDir: args.indexDir });
   try {
     return store.searchRanked(
       args.query,
@@ -10736,15 +10930,15 @@ function searchService(args) {
       args.limit
     );
   } finally {
-    store.close();
+    indexStorePool.release(store);
   }
 }
 function statsService(args) {
-  const store = new IndexStore(args.projectRoot, { indexDir: args.indexDir });
+  const store = indexStorePool.acquire(args.projectRoot, { indexDir: args.indexDir });
   try {
     return store.getStats();
   } finally {
-    store.close();
+    indexStorePool.release(store);
   }
 }
 
@@ -13086,8 +13280,243 @@ function levelRank(level) {
   }
 }
 
+// src/exec-kill-guard.ts
+import * as os7 from "node:os";
+import * as path24 from "node:path";
+var isWin3 = os7.platform() === "win32";
+async function checkExecKillCommand(cmd, args) {
+  if (!cmd) return { blocked: false };
+  const cmdLower = cmd.toLowerCase().trim();
+  const fullCommand = [cmdLower, ...args].join(" ").replace(/\s+/g, " ").trim();
+  if (isWin3) {
+    if (cmdLower === "taskkill" || cmdLower === "taskkill.exe") {
+      const hasForce = args.some((a) => a.toUpperCase() === "/F" || a.toUpperCase() === "-F");
+      const signal = hasForce ? "FORCE" : "TERM";
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.toUpperCase() === "/IM" || a.toUpperCase() === "-IM") {
+          const nameArg = args[i + 1];
+          if (nameArg) {
+            const result = await checkKillTarget({ name: nameArg, signal, cmd: fullCommand });
+            if (result.blocked) return result;
+          }
+        }
+      }
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.toUpperCase() === "/PID" || a.toUpperCase() === "-PID") {
+          const pidArg = args[i + 1];
+          if (pidArg && /^\d+$/.test(pidArg)) {
+            const result = await checkKillTarget({
+              pid: parseInt(pidArg, 10),
+              signal,
+              cmd: fullCommand
+            });
+            if (result.blocked) return result;
+          }
+        }
+      }
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.toUpperCase() === "/FI" || a.toUpperCase() === "-FI") {
+          const filterArg = args[i + 1];
+          if (filterArg) {
+            const nameMatch = filterArg.match(/IMAGENAME\s+eq\s+"?([^"\s]+)/i);
+            if (nameMatch?.[1]) {
+              const result = await checkKillTarget({ name: nameMatch[1], signal, cmd: fullCommand });
+              if (result.blocked) return result;
+            }
+          }
+        }
+      }
+      return { blocked: false };
+    }
+    if (cmdLower === "powershell" || cmdLower === "powershell.exe" || cmdLower === "pwsh" || cmdLower === "pwsh.exe" || cmdLower === "cmd" || cmdLower === "cmd.exe") {
+      const shellFlagIndex = args.findIndex((arg) => {
+        const lower = arg.toLowerCase();
+        return lower === "-c" || lower === "-command" || lower === "/c";
+      });
+      if (shellFlagIndex >= 0) {
+        const innerTokens = tokenizeShellCommand(args.slice(shellFlagIndex + 1).join(" "));
+        const innerCommand = innerTokens[0];
+        if (innerCommand) {
+          const result = await checkExecKillCommand(innerCommand, innerTokens.slice(1));
+          if (result.blocked) return result;
+        }
+      }
+    }
+    if (cmdLower === "stop-process" || cmdLower === "kill") {
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "-Name" || a === "-n") {
+          const nameArg = args[i + 1]?.replace(/^['"]|['"]$/g, "");
+          if (nameArg) {
+            const result = await checkKillTarget({
+              name: nameArg,
+              signal: "FORCE",
+              cmd: fullCommand
+            });
+            if (result.blocked) return result;
+          }
+        }
+        if (a === "-Id" || a === "-PID" || a === "-pid") {
+          const pidArg = args[i + 1];
+          if (pidArg && /^\d+$/.test(pidArg)) {
+            const result = await checkKillTarget({
+              pid: parseInt(pidArg, 10),
+              signal: "FORCE",
+              cmd: fullCommand
+            });
+            if (result.blocked) return result;
+          }
+        }
+      }
+      const firstNonFlag = args.find((a) => !a.startsWith("-"));
+      if (firstNonFlag) {
+        const name = firstNonFlag.replace(/^['"]|['"]$/g, "");
+        const result = await checkKillTarget({ name, signal: "TERM", cmd: fullCommand });
+        if (result.blocked) return result;
+      }
+    }
+    if (cmdLower === "wmic" || cmdLower === "wmic.exe") {
+      const joined = args.join(" ").toLowerCase();
+      if (/\bprocess\b/.test(joined) && /\bdelete\b/.test(joined)) {
+        const nameMatch = joined.match(/name\s*=\s*['"]?([^'"]+)/);
+        if (nameMatch?.[1]) {
+          const result = await checkKillTarget({
+            name: nameMatch[1].trim(),
+            signal: "FORCE",
+            cmd: fullCommand
+          });
+          if (result.blocked) return result;
+        }
+        return {
+          blocked: true,
+          reason: "Blocked: wmic process delete targets all matched processes \u2014 would include protected WrongStack processes."
+        };
+      }
+    }
+    if (cmdLower === "node" || cmdLower === "node.exe") {
+      if (args.includes("-e") || args.includes("--eval")) {
+        const evalIdx = args.indexOf("-e") !== -1 ? args.indexOf("-e") : args.indexOf("--eval");
+        const evalCode = args[evalIdx + 1] ?? "";
+        if (/\bprocess\.kill\s*\(/.test(evalCode)) {
+          const pidMatch = evalCode.match(/process\.kill\s*\(\s*(\d+)/);
+          if (pidMatch?.[1]) {
+            const pid = parseInt(pidMatch[1], 10);
+            const result = await checkKillTarget({ pid, signal: "SIGTERM", cmd: fullCommand });
+            if (result.blocked) return result;
+          }
+          return {
+            blocked: true,
+            reason: "Blocked: node -e with process.kill() \u2014 would target protected WrongStack process(es)."
+          };
+        }
+      }
+    }
+  } else {
+    if (cmdLower === "kill") {
+      for (const a of args) {
+        const num = a.replace(/^-/, "");
+        if (/^\d+$/.test(num)) {
+          const pid = parseInt(num, 10);
+          const result = await checkKillTarget({ pid, signal: "SIGTERM", cmd: fullCommand });
+          if (result.blocked) return result;
+        }
+      }
+    }
+    if (cmdLower === "pkill" || cmdLower === "killall") {
+      const firstNonFlag = args.find((a) => !a.startsWith("-"));
+      if (firstNonFlag) {
+        const result = await checkKillTarget({
+          name: firstNonFlag,
+          signal: "SIGTERM",
+          cmd: fullCommand
+        });
+        if (result.blocked) return result;
+      }
+    }
+  }
+  return { blocked: false };
+}
+function tokenizeShellCommand(command) {
+  const tokens = [];
+  let current = "";
+  let quote = null;
+  for (const char of command.trim()) {
+    if (quote) {
+      if (char === quote) quote = null;
+      else current += char;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+    } else if (/\s/.test(char)) {
+      if (current) {
+        tokens.push(current);
+        current = "";
+      }
+    } else {
+      current += char;
+    }
+  }
+  if (current) tokens.push(current);
+  return tokens;
+}
+async function checkKillTarget(target) {
+  const registry = getPersistentProcessRegistry();
+  if (target.pid !== void 0) {
+    const blocked = await registry.shouldBlockKill(target.pid);
+    if (blocked) {
+      return {
+        blocked: true,
+        reason: `Blocked: kill ${target.signal} PID ${target.pid} targets a protected WrongStack process (${target.cmd.slice(0, 80)}).`
+      };
+    }
+    if (target.pid === process.pid) {
+      return {
+        blocked: true,
+        reason: "Blocked: cannot kill the current WrongStack process."
+      };
+    }
+    if (target.pid === process.ppid) {
+      return {
+        blocked: true,
+        reason: "Blocked: cannot kill the parent terminal hosting WrongStack."
+      };
+    }
+    return { blocked: false };
+  }
+  if (target.name) {
+    const nameLower = target.name.toLowerCase().replace(/\.exe$/, "");
+    if (nameLower.includes("wrongstack")) {
+      return {
+        blocked: true,
+        reason: `Blocked: kill ${target.signal} '${target.name}' targets a WrongStack process name.`
+      };
+    }
+    const currentImage = path24.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
+    const targetsNodeRuntime = nameLower === "node" || nameLower.startsWith("node");
+    if (targetsNodeRuntime && currentImage === "node") {
+      return {
+        blocked: true,
+        reason: `Blocked: kill ${target.signal} '${target.name}' would kill the active WrongStack node.exe runtime.`
+      };
+    }
+    const protectedPids = await registry.getAllProtectedPids();
+    if (protectedPids.length > 0 && targetsNodeRuntime) {
+      return {
+        blocked: true,
+        reason: `Blocked: kill ${target.signal} '${target.name}' would kill all node.exe processes including active WrongStack instance(s).`
+      };
+    }
+    return { blocked: false };
+  }
+  return { blocked: false };
+}
+
 // src/exec.ts
-var isWin3 = process.platform === "win32";
+var isWin4 = process.platform === "win32";
 var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   // JS / TS toolchain
   "node",
@@ -13863,6 +14292,19 @@ var execTool = {
     const args = (input.args ?? []).slice(0, MAX_ARGS);
     const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS3, DEFAULT_TIMEOUT_MS3));
     const danger = detectDanger(cmd, args, dangerBypass);
+    const killCheck = await checkExecKillCommand(cmd, args);
+    if (killCheck.blocked) {
+      return {
+        command: cmd,
+        args,
+        stdout: "",
+        stderr: killCheck.reason ?? "Kill command blocked: targets a protected WrongStack process.",
+        exitCode: 1,
+        truncated: false,
+        allowed: false,
+        danger
+      };
+    }
     const argError = validateArgs(cmd, args);
     if (argError) {
       return {
@@ -13913,7 +14355,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     let timedOut = false;
     const spool = createOutputSpool({ tool: `exec-${cmd}`, thresholdBytes: MAX_OUTPUT2 });
     const resolved = resolveWin32Command(cmd);
-    const needsShell = isWin3 && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
+    const needsShell = isWin4 && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
     const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
     const spawnCmd = shim?.command ?? resolved;
     const spawnArgs = shim?.args ?? args;
@@ -13938,7 +14380,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
         env: buildChildEnv2(sessionId),
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true,
-        ...isWin3 ? {} : { signal },
+        ...isWin4 ? {} : { signal },
         ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
       });
     } catch (err) {
@@ -13977,7 +14419,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
       const isAbort = err && err.code === "ABORT_ERR";
       const stderrText = isAbort ? `Aborted: ${err.message}` : err.message;
       clearTimeout(timer);
-      if (isWin3) signal.removeEventListener("abort", onAbort);
+      if (isWin4) signal.removeEventListener("abort", onAbort);
       if (typeof pid === "number") registry.unregister(pid);
       registry.afterCall(Date.now() - startedAt, true);
       spool.finalize();
@@ -14010,7 +14452,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
       if (typeof pid === "number") registry.kill(pid, { force: true });
       else child.kill("SIGTERM");
     };
-    if (isWin3) {
+    if (isWin4) {
       if (signal.aborted) onAbort();
       else signal.addEventListener("abort", onAbort, { once: true });
     }
@@ -14030,7 +14472,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      if (isWin3) signal.removeEventListener("abort", onAbort);
+      if (isWin4) signal.removeEventListener("abort", onAbort);
       if (typeof pid === "number") registry.unregister(pid);
       const durationMs = Date.now() - startedAt;
       const exitCode = killed ? 124 : code ?? 1;
@@ -14841,7 +15283,7 @@ function runGit2(args, cwd, signal) {
 
 // src/glob.ts
 import * as fs20 from "node:fs/promises";
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 import { compileGlob as compileGlob3 } from "@wrongstack/core";
 
 // src/_concurrency.ts
@@ -14945,7 +15387,7 @@ var globTool = {
         if (DEFAULT_IGNORE2.includes(name)) continue;
         if (ignored.includes(name)) continue;
         const rel = relPrefix ? `${relPrefix}/${name}` : name;
-        const full = path24.join(dir, name);
+        const full = path25.join(dir, name);
         if (e.isDirectory()) {
           subdirs.push({ full, rel });
         } else if (e.isFile()) {
@@ -14989,7 +15431,7 @@ var globTool = {
 };
 async function readGitignore(dir) {
   try {
-    const raw = await fs20.readFile(path24.join(dir, ".gitignore"), "utf8");
+    const raw = await fs20.readFile(path25.join(dir, ".gitignore"), "utf8");
     return raw.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
   } catch {
     return [];
@@ -15000,7 +15442,7 @@ async function readGitignore(dir) {
 import { expectDefined as expectDefined7 } from "@wrongstack/core";
 import { spawn as spawn10 } from "node:child_process";
 import * as fs21 from "node:fs/promises";
-import * as path25 from "node:path";
+import * as path26 from "node:path";
 import { buildChildEnv as buildChildEnv5, compileGlob as compileGlob4, ToolValidationError as ToolValidationError4 } from "@wrongstack/core";
 
 // src/_regex.ts
@@ -15393,7 +15835,7 @@ async function runNative(input, base, mode, limit, signal) {
       if (stopped) return;
       if (DEFAULT_IGNORE3.includes(e.name)) continue;
       if (e.isSymbolicLink()) continue;
-      const full = path25.join(dir, e.name);
+      const full = path26.join(dir, e.name);
       if (e.isDirectory()) {
         subdirs.push(full);
       } else if (e.isFile()) {
@@ -15981,56 +16423,56 @@ function jmespathSearch(data, query) {
 }
 function validateJsonSchema(data, schema) {
   const errors = [];
-  function check(value, s, path32) {
+  function check(value, s, path33) {
     if (s["type"]) {
       const expectedType = s["type"];
       const actualType = Array.isArray(value) ? "array" : value === null ? "null" : typeof value;
       if (expectedType === "integer") {
-        if (!Number.isInteger(value)) errors.push(`${path32}: expected integer, got ${actualType}`);
+        if (!Number.isInteger(value)) errors.push(`${path33}: expected integer, got ${actualType}`);
       } else if (expectedType !== actualType) {
-        errors.push(`${path32}: expected ${expectedType}, got ${actualType}`);
+        errors.push(`${path33}: expected ${expectedType}, got ${actualType}`);
       }
     }
     if (typeof value === "string" && s["format"] === "uri" && value) {
       try {
         new URL(value);
       } catch {
-        errors.push(`${path32}: not a valid URI`);
+        errors.push(`${path33}: not a valid URI`);
       }
     }
     if (typeof value === "string" && s["pattern"]) {
       const re = new RegExp(s["pattern"]);
-      if (!re.test(value)) errors.push(`${path32}: does not match pattern ${s["pattern"]}`);
+      if (!re.test(value)) errors.push(`${path33}: does not match pattern ${s["pattern"]}`);
     }
     if (typeof value === "string" && s["minLength"] !== void 0 && value.length < s["minLength"]) {
-      errors.push(`${path32}: string too short (min ${s["minLength"]})`);
+      errors.push(`${path33}: string too short (min ${s["minLength"]})`);
     }
     if (typeof value === "string" && s["maxLength"] !== void 0 && value.length > s["maxLength"]) {
-      errors.push(`${path32}: string too long (max ${s["maxLength"]})`);
+      errors.push(`${path33}: string too long (max ${s["maxLength"]})`);
     }
     if (typeof value === "number" && s["minimum"] !== void 0 && value < s["minimum"]) {
-      errors.push(`${path32}: below minimum ${s["minimum"]}`);
+      errors.push(`${path33}: below minimum ${s["minimum"]}`);
     }
     if (typeof value === "number" && s["maximum"] !== void 0 && value > s["maximum"]) {
-      errors.push(`${path32}: above maximum ${s["maximum"]}`);
+      errors.push(`${path33}: above maximum ${s["maximum"]}`);
     }
     if (Array.isArray(value) && s["items"] && Array.isArray(s["items"])) {
       for (let i = 0; i < value.length; i++) {
-        check(value[i], s["items"], `${path32}[${i}]`);
+        check(value[i], s["items"], `${path33}[${i}]`);
       }
     }
     if (typeof value === "object" && value !== null && !Array.isArray(value) && s["properties"]) {
       const props = s["properties"];
       for (const [k, propSchema] of Object.entries(props)) {
-        check(value[k], propSchema, `${path32}.${k}`);
+        check(value[k], propSchema, `${path33}.${k}`);
       }
     }
   }
   check(data, schema, "$");
   return { valid: errors.length === 0, errors };
 }
-function simpleQuery(data, path32) {
-  const parts = path32.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean);
+function simpleQuery(data, path33) {
+  const parts = path33.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean);
   let current = data;
   for (const part of parts) {
     if (current === null || current === void 0) return void 0;
@@ -16098,7 +16540,7 @@ import {
   duplicateBoard,
   exportBoardAsMarkdown,
   exportBoardToTaskGraph,
-  generateBoardFromDescription,
+  createBoardFromText,
   getBoard as getBoard2,
   getKanbanOrchestrationSnapshot,
   getKanbanQueueHealth,
@@ -16622,7 +17064,7 @@ var kanbanTool = {
           }
           case "generate_board": {
             if (!input.description) return fail("generate_board requires description.");
-            const boardInput = generateBoardFromDescription({
+            const boardInput = createBoardFromText({
               description: input.description,
               ...input.title !== void 0 ? { title: input.title } : {},
               ...input.context !== void 0 ? { context: input.context } : {},
@@ -17007,20 +17449,31 @@ var kanbanTool = {
             if (!input.boardId || !input.taskId)
               return fail("mark_assignment requires boardId and taskId.");
             const assignmentStatus = input.assignmentStatus ?? (input.status === "completed" ? "completed" : input.error ? "failed" : void 0);
-            const board = await updateTaskAssignment(projectRoot, input.boardId, input.taskId, {
-              ...assignmentStatus !== void 0 ? { status: assignmentStatus } : {},
-              ...input.subagentId !== void 0 ? { subagentId: input.subagentId } : {},
-              ...input.runTaskId !== void 0 ? { runTaskId: input.runTaskId } : {},
-              ...input.lastResult !== void 0 ? { lastResult: input.lastResult } : {},
-              ...input.error !== void 0 ? { error: input.error } : {},
-              ...input.agentId !== void 0 ? { agentId: input.agentId } : {},
-              ...input.leaseId !== void 0 ? { leaseId: input.leaseId } : {},
-              ...input.claimedAt !== void 0 ? { claimedAt: input.claimedAt } : {},
-              ...input.heartbeatAt !== void 0 ? { heartbeatAt: input.heartbeatAt } : {},
-              ...input.leaseExpiresAt !== void 0 ? { leaseExpiresAt: input.leaseExpiresAt } : {},
-              ...input.attempt !== void 0 ? { attempt: input.attempt } : {},
-              ...input.maxAttempts !== void 0 ? { maxAttempts: input.maxAttempts } : {}
-            });
+            const board = await updateTaskAssignment(
+              projectRoot,
+              input.boardId,
+              input.taskId,
+              {
+                ...assignmentStatus !== void 0 ? { status: assignmentStatus } : {},
+                ...input.subagentId !== void 0 ? { subagentId: input.subagentId } : {},
+                ...input.runTaskId !== void 0 ? { runTaskId: input.runTaskId } : {},
+                ...input.lastResult !== void 0 ? { lastResult: input.lastResult } : {},
+                ...input.error !== void 0 ? { error: input.error } : {},
+                ...input.agentId !== void 0 ? { agentId: input.agentId } : {},
+                ...input.leaseId !== void 0 ? { leaseId: input.leaseId } : {},
+                ...input.claimedAt !== void 0 ? { claimedAt: input.claimedAt } : {},
+                ...input.heartbeatAt !== void 0 ? { heartbeatAt: input.heartbeatAt } : {},
+                ...input.leaseExpiresAt !== void 0 ? { leaseExpiresAt: input.leaseExpiresAt } : {},
+                ...input.attempt !== void 0 ? { attempt: input.attempt } : {},
+                ...input.maxAttempts !== void 0 ? { maxAttempts: input.maxAttempts } : {}
+              },
+              // Ownership fence: when expectedLeaseId is supplied, the write is
+              // applied only if the current assignment still holds this lease.
+              // This prevents a recovered+reassigned stale worker's terminal
+              // mark_assignment from overwriting the successor's state. The check
+              // is atomic inside updateTaskAssignment's mutateBoard lock.
+              input.expectedLeaseId !== void 0 ? { expectedLeaseId: input.expectedLeaseId } : {}
+            );
             return board ? okBoard(board, "Assignment updated.") : fail("Task not found.");
           }
           case "heartbeat_assignment": {
@@ -17029,7 +17482,13 @@ var kanbanTool = {
             }
             const board = await heartbeatTaskAssignment(projectRoot, input.boardId, input.taskId, {
               ...input.heartbeatAt !== void 0 ? { heartbeatAt: input.heartbeatAt } : {},
-              ...input.leaseExpiresAt !== void 0 ? { leaseExpiresAt: input.leaseExpiresAt } : {}
+              ...input.leaseExpiresAt !== void 0 ? { leaseExpiresAt: input.leaseExpiresAt } : {},
+              // Ownership fence: when expectedLeaseId is supplied, the renewal
+              // is applied only if the current assignment still holds this lease.
+              // This prevents a recovered+reassigned stale worker's heartbeat
+              // from renewing the successor's lease. The check is atomic inside
+              // heartbeatTaskAssignment's mutateBoard lock.
+              ...input.expectedLeaseId !== void 0 ? { expectedLeaseId: input.expectedLeaseId } : {}
             });
             return board ? okBoard(board, "Assignment heartbeat updated.") : fail("Task assignment not found.");
           }
@@ -17620,7 +18079,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
 }
 var DOCKER_LOGS_TIMEOUT_MS = 3e3;
 var MAX_TAIL_LINES = 1e5;
-async function fileLogs(path32, lines, filterRe, stream) {
+async function fileLogs(path33, lines, filterRe, stream) {
   const { createInterface } = await import("node:readline");
   const { createReadStream: createReadStream2 } = await import("node:fs");
   const entries = [];
@@ -17629,7 +18088,7 @@ async function fileLogs(path32, lines, filterRe, stream) {
   let writeIdx = 0;
   let totalLines = 0;
   const rl = createInterface({
-    input: createReadStream2(path32),
+    input: createReadStream2(path33),
     crlfDelay: Number.POSITIVE_INFINITY
   });
   for await (const line of rl) {
@@ -17650,7 +18109,7 @@ async function fileLogs(path32, lines, filterRe, stream) {
     if (parsed) entries.push(parsed);
   }
   return {
-    source: path32,
+    source: path33,
     entries,
     total: entries.length,
     truncated: totalLines > effLines,
@@ -17881,8 +18340,8 @@ function parseOutdatedOutput(json2, exitCode) {
 init_util();
 import { spawn as spawn13 } from "node:child_process";
 import * as fs23 from "node:fs/promises";
-import * as os7 from "node:os";
-import * as path26 from "node:path";
+import * as os8 from "node:os";
+import * as path27 from "node:path";
 import { buildChildEnv as buildChildEnv8 } from "@wrongstack/core";
 var patchTool = {
   name: "patch",
@@ -17918,9 +18377,9 @@ var patchTool = {
     for (const t of targets) {
       const stripped = stripPathComponents(t, strip);
       if (!stripped) continue;
-      const candidate = path26.resolve(dir, stripped);
-      const rel = path26.relative(ctx.projectRoot, candidate);
-      if (rel.startsWith("..") || path26.isAbsolute(rel)) {
+      const candidate = path27.resolve(dir, stripped);
+      const rel = path27.relative(ctx.projectRoot, candidate);
+      if (rel.startsWith("..") || path27.isAbsolute(rel)) {
         return {
           applied: 0,
           rejected: 1,
@@ -17937,11 +18396,11 @@ var patchTool = {
         beforeContents.set(target, await readTextForTracking(target));
       }
     }
-    const tmpDir = await fs23.mkdtemp(path26.join(os7.tmpdir(), ".wstack_patch_"));
+    const tmpDir = await fs23.mkdtemp(path27.join(os8.tmpdir(), ".wstack_patch_"));
     try {
       await fs23.chmod(tmpDir, 448).catch(() => {
       });
-      const patchFile = path26.join(tmpDir, "in.diff");
+      const patchFile = path27.join(tmpDir, "in.diff");
       await fs23.writeFile(patchFile, input.patch, { mode: 384 });
       const args = [`-p${strip}`, "--merge", ...dryRun ? ["--dry-run"] : [], "-i", patchFile];
       const result = await runPatch(args, dir, opts.signal);
@@ -18527,7 +18986,7 @@ ${interesting.join("\n")}` : "symbols/imports: (none detected)"
 import { expectDefined as expectDefined8 } from "@wrongstack/core";
 import { spawn as spawn14 } from "node:child_process";
 import * as fs25 from "node:fs/promises";
-import * as path27 from "node:path";
+import * as path28 from "node:path";
 import {
   atomicWrite as atomicWrite3,
   buildChildEnv as buildChildEnv9,
@@ -18616,8 +19075,8 @@ var replaceTool = {
       } catch {
         continue;
       }
-      const rel = path27.relative(realRoot, realPath);
-      if (rel.startsWith("..") || path27.isAbsolute(rel)) continue;
+      const rel = path28.relative(realRoot, realPath);
+      if (rel.startsWith("..") || path28.isAbsolute(rel)) continue;
       const stat17 = await fs25.stat(realPath).catch(() => null);
       if (!stat17?.isFile()) continue;
       let content;
@@ -18746,7 +19205,7 @@ async function globNative(pattern, base, extraGlob) {
     }
     for (const e of entries) {
       if (DEFAULT_IGNORE4.includes(e.name)) continue;
-      const full = path27.join(dir, e.name);
+      const full = path28.join(dir, e.name);
       try {
         const stat17 = await fs25.lstat(full);
         if (stat17.isSymbolicLink()) continue;
@@ -18773,7 +19232,7 @@ async function globNative(pattern, base, extraGlob) {
 // src/scaffold.ts
 init_util();
 import * as fs26 from "node:fs/promises";
-import * as path28 from "node:path";
+import * as path29 from "node:path";
 import { atomicWrite as atomicWrite4 } from "@wrongstack/core";
 var BUILT_IN_TEMPLATES = {
   "npm-package": {
@@ -18923,16 +19382,16 @@ async function handleBuiltIn(name, templateFiles, cwd, ctx, dryRun, vars) {
   let filesCreated = 0;
   for (const [filePath, content] of Object.entries(templateFiles)) {
     const resolvedPath = substituteVars(filePath, name, vars);
-    const joinedPath = path28.join(cwd, resolvedPath);
-    const root = path28.resolve(ctx.projectRoot);
-    const target = path28.resolve(joinedPath);
-    const rel = path28.relative(root, target);
-    if (rel.startsWith("..") || path28.isAbsolute(rel)) {
+    const joinedPath = path29.join(cwd, resolvedPath);
+    const root = path29.resolve(ctx.projectRoot);
+    const target = path29.resolve(joinedPath);
+    const rel = path29.relative(root, target);
+    if (rel.startsWith("..") || path29.isAbsolute(rel)) {
       throw new Error(`scaffold: generated path "${resolvedPath}" would escape project root`);
     }
     const fullPath = target;
     if (!dryRun) {
-      await fs26.mkdir(path28.dirname(fullPath), { recursive: true });
+      await fs26.mkdir(path29.dirname(fullPath), { recursive: true });
       await atomicWrite4(fullPath, substituteVars(content, name, vars));
     }
     files.push(resolvedPath);
@@ -19789,7 +20248,7 @@ ${formatTaskList2(file.tasks)}` : file.tasks.length > 0 ? formatTaskList2(file.t
 init_spawn_stream();
 init_util();
 init_legacy_bridge();
-import * as path29 from "node:path";
+import * as path30 from "node:path";
 var testTool = {
   name: "test",
   category: "Code Quality",
@@ -19896,7 +20355,7 @@ async function detectRunner(cwd) {
   const candidates = ["vitest.config.ts", "jest.config.js", ".mocharc.json"];
   for (const f of candidates) {
     try {
-      await stat17(path29.join(cwd, f));
+      await stat17(path30.join(cwd, f));
       if (f.includes("vitest")) return "vitest";
       if (f.includes("jest")) return "jest";
       if (f.includes("mocha")) return "mocha";
@@ -20367,7 +20826,7 @@ var toolUseTool = {
 init_util();
 import { expectDefined as expectDefined10 } from "@wrongstack/core";
 import * as fs28 from "node:fs/promises";
-import * as path30 from "node:path";
+import * as path31 from "node:path";
 var DEFAULT_IGNORE5 = [
   "node_modules",
   ".git",
@@ -20538,7 +20997,7 @@ async function walkDir(dir, depth, opts) {
     opts.lines.push(opts.prefix + branch + displayName);
     if (entry.isDirectory() && (opts.maxDepth === 0 || depth < opts.maxDepth)) {
       const childPrefix = opts.prefix + connector;
-      await walkDir(path30.join(dir, entry.name), depth + 1, {
+      await walkDir(path31.join(dir, entry.name), depth + 1, {
         ...opts,
         prefix: childPrefix,
         isLast
@@ -20551,7 +21010,7 @@ async function walkDir(dir, depth, opts) {
 init_spawn_stream();
 init_util();
 init_legacy_bridge();
-import * as path31 from "node:path";
+import * as path32 from "node:path";
 var typecheckTool = {
   name: "typecheck",
   category: "Code Quality",
@@ -20654,8 +21113,8 @@ async function findTsConfig(cwd) {
   const candidates = ["tsconfig.json", "tsconfig.base.json"];
   for (const f of candidates) {
     try {
-      const s = await stat17(path31.join(cwd, f));
-      if (s.isFile()) return path31.join(cwd, f);
+      const s = await stat17(path32.join(cwd, f));
+      if (s.isFile()) return path32.join(cwd, f);
     } catch {
     }
   }