@wrongstack/tools 0.292.1 → 0.295.0

package/dist/tool-use.d.ts

@@ -1,4 +1,4 @@
-import type { Tool } from '@wrongstack/core';
+import type { Tool } from '@wrongstack/core/types';
 interface ToolUseInput {
     tool: string;
     input: Record<string, unknown>;

package/dist/tool-use.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-use.d.ts","sourceRoot":"","sources":["../src/tool-use.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CA2FzD,CAAC"}
+{"version":3,"file":"tool-use.d.ts","sourceRoot":"","sources":["../src/tool-use.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CA2FzD,CAAC"}

package/dist/tool-use.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/tool-use.ts"],
-  "sourcesContent": ["import type { Tool } from '@wrongstack/core';\n\ninterface ToolUseInput {\n  tool: string;\n  input: Record<string, unknown>;\n}\n\ninterface ToolUseOutput {\n  tool: string;\n  success: boolean;\n  result?: unknown | undefined;\n  error?: string | undefined;\n  executionMs: number;\n}\n\nexport const toolUseTool: Tool<ToolUseInput, ToolUseOutput> = {\n  name: 'tool_use',\n  category: 'Meta',\n  description:\n    'Directly execute any registered tool by its exact name, bypassing normal discovery. ' +\n    'This is a powerful meta-tool intended for cases where the agent has a clear plan and knows precisely which tool to invoke.',\n  usageHint:\n    'ADVANCED META TOOL \u2014 USE WITH CARE:\\n\\n' +\n    '- Only use when you are certain of the exact tool name and its expected input shape.\\n' +\n    '- Prefer using the normal tool calling mechanism when possible.\\n' +\n    '- Very useful in batch-tool-use or when orchestrating complex workflows programmatically.\\n' +\n    '- The call still goes through full permission checks and capability validation.',\n  permission: 'confirm',\n  mutating: true,\n  timeoutMs: 60_000,\n  capabilities: ['tool.mutate.any'],\n  icon: 'meta',\n  inputSchema: {\n    type: 'object',\n    properties: {\n      tool: {\n        type: 'string',\n        description: 'The exact registered name of the tool to invoke (e.g. \"bash\", \"read\", \"codebase-search\").',\n      },\n      input: {\n        type: 'object',\n        description: 'The input object matching the target tool\\'s inputSchema.',\n      },\n    },\n    required: ['tool'],\n  },\n  async execute(input, ctx, opts) {\n    const start = Date.now();\n\n    if (!input?.tool) {\n      return {\n        tool: 'unknown',\n        success: false,\n        error: 'tool_use: tool name is required',\n        executionMs: 0,\n      };\n    }\n\n    const tool = ctx.tools.find((t: Tool) => t.name === input.tool);\n    if (!tool) {\n      return {\n        tool: input.tool,\n        success: false,\n        error: `tool_use: tool \"${input.tool}\" not found`,\n        executionMs: Date.now() - start,\n      };\n    }\n\n    // `deny` is a hard policy gate \u2014 bypassing it through a meta-tool\n    // would defeat the whole point of the permission system. Keep this\n    // check even though the outer `tool_use` already requires `confirm`.\n    if (tool.permission === 'deny') {\n      return {\n        tool: input.tool,\n        success: false,\n        error: `tool_use: tool \"${input.tool}\" is denied by policy`,\n        executionMs: Date.now() - start,\n      };\n    }\n\n    // Note: inner `permission === 'confirm'` is intentionally NOT short-\n    // circuited here. The outer `tool_use` itself has `permission: 'confirm'`,\n    // so the user already saw the full args (including which inner tool will\n    // run, and with what input) before approving the meta-call. Duplicating\n    // the check inside execute() turned every confirm-tool dispatch through\n    // `tool_use` into a hard failure \u2014 the model would see \"requires\n    // confirmation\" with no way to proceed, even after the user said yes.\n    // `batch_tool_use` already follows this same model.\n\n    try {\n      const result = await tool.execute(input.input, ctx, opts);\n      return {\n        tool: input.tool,\n        success: true,\n        result,\n        executionMs: Date.now() - start,\n      };\n    } catch (e) {\n      return {\n        tool: input.tool,\n        success: false,\n        error: e instanceof Error ? e.message : String(e),\n        executionMs: Date.now() - start,\n      };\n    }\n  },\n};\n"],
+  "sourcesContent": ["import type { Tool } from '@wrongstack/core/types';\n\ninterface ToolUseInput {\n  tool: string;\n  input: Record<string, unknown>;\n}\n\ninterface ToolUseOutput {\n  tool: string;\n  success: boolean;\n  result?: unknown | undefined;\n  error?: string | undefined;\n  executionMs: number;\n}\n\nexport const toolUseTool: Tool<ToolUseInput, ToolUseOutput> = {\n  name: 'tool_use',\n  category: 'Meta',\n  description:\n    'Directly execute any registered tool by its exact name, bypassing normal discovery. ' +\n    'This is a powerful meta-tool intended for cases where the agent has a clear plan and knows precisely which tool to invoke.',\n  usageHint:\n    'ADVANCED META TOOL \u2014 USE WITH CARE:\\n\\n' +\n    '- Only use when you are certain of the exact tool name and its expected input shape.\\n' +\n    '- Prefer using the normal tool calling mechanism when possible.\\n' +\n    '- Very useful in batch-tool-use or when orchestrating complex workflows programmatically.\\n' +\n    '- The call still goes through full permission checks and capability validation.',\n  permission: 'confirm',\n  mutating: true,\n  timeoutMs: 60_000,\n  capabilities: ['tool.mutate.any'],\n  icon: 'meta',\n  inputSchema: {\n    type: 'object',\n    properties: {\n      tool: {\n        type: 'string',\n        description: 'The exact registered name of the tool to invoke (e.g. \"bash\", \"read\", \"codebase-search\").',\n      },\n      input: {\n        type: 'object',\n        description: 'The input object matching the target tool\\'s inputSchema.',\n      },\n    },\n    required: ['tool'],\n  },\n  async execute(input, ctx, opts) {\n    const start = Date.now();\n\n    if (!input?.tool) {\n      return {\n        tool: 'unknown',\n        success: false,\n        error: 'tool_use: tool name is required',\n        executionMs: 0,\n      };\n    }\n\n    const tool = ctx.tools.find((t: Tool) => t.name === input.tool);\n    if (!tool) {\n      return {\n        tool: input.tool,\n        success: false,\n        error: `tool_use: tool \"${input.tool}\" not found`,\n        executionMs: Date.now() - start,\n      };\n    }\n\n    // `deny` is a hard policy gate \u2014 bypassing it through a meta-tool\n    // would defeat the whole point of the permission system. Keep this\n    // check even though the outer `tool_use` already requires `confirm`.\n    if (tool.permission === 'deny') {\n      return {\n        tool: input.tool,\n        success: false,\n        error: `tool_use: tool \"${input.tool}\" is denied by policy`,\n        executionMs: Date.now() - start,\n      };\n    }\n\n    // Note: inner `permission === 'confirm'` is intentionally NOT short-\n    // circuited here. The outer `tool_use` itself has `permission: 'confirm'`,\n    // so the user already saw the full args (including which inner tool will\n    // run, and with what input) before approving the meta-call. Duplicating\n    // the check inside execute() turned every confirm-tool dispatch through\n    // `tool_use` into a hard failure \u2014 the model would see \"requires\n    // confirmation\" with no way to proceed, even after the user said yes.\n    // `batch_tool_use` already follows this same model.\n\n    try {\n      const result = await tool.execute(input.input, ctx, opts);\n      return {\n        tool: input.tool,\n        success: true,\n        result,\n        executionMs: Date.now() - start,\n      };\n    } catch (e) {\n      return {\n        tool: input.tool,\n        success: false,\n        error: e instanceof Error ? e.message : String(e),\n        executionMs: Date.now() - start,\n      };\n    }\n  },\n};\n"],
   "mappings": ";AAeO,IAAM,cAAiD;AAAA,EAC5D,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aACE;AAAA,EAEF,WACE;AAAA,EAKF,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,WAAW;AAAA,EACX,cAAc,CAAC,iBAAiB;AAAA,EAChC,MAAM;AAAA,EACN,aAAa;AAAA,IACX,MAAM;AAAA,IACN,YAAY;AAAA,MACV,MAAM;AAAA,QACJ,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,OAAO;AAAA,QACL,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,UAAU,CAAC,MAAM;AAAA,EACnB;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK,MAAM;AAC9B,UAAM,QAAQ,KAAK,IAAI;AAEvB,QAAI,CAAC,OAAO,MAAM;AAChB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS;AAAA,QACT,OAAO;AAAA,QACP,aAAa;AAAA,MACf;AAAA,IACF;AAEA,UAAM,OAAO,IAAI,MAAM,KAAK,CAAC,MAAY,EAAE,SAAS,MAAM,IAAI;AAC9D,QAAI,CAAC,MAAM;AACT,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,SAAS;AAAA,QACT,OAAO,mBAAmB,MAAM,IAAI;AAAA,QACpC,aAAa,KAAK,IAAI,IAAI;AAAA,MAC5B;AAAA,IACF;AAKA,QAAI,KAAK,eAAe,QAAQ;AAC9B,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,SAAS;AAAA,QACT,OAAO,mBAAmB,MAAM,IAAI;AAAA,QACpC,aAAa,KAAK,IAAI,IAAI;AAAA,MAC5B;AAAA,IACF;AAWA,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,IAAI;AACxD,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,SAAS;AAAA,QACT;AAAA,QACA,aAAa,KAAK,IAAI,IAAI;AAAA,MAC5B;AAAA,IACF,SAAS,GAAG;AACV,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,SAAS;AAAA,QACT,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AAAA,QAChD,aAAa,KAAK,IAAI,IAAI;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/tree.d.ts

@@ -1,4 +1,4 @@
-import type { Tool } from '@wrongstack/core';
+import type { Tool } from '@wrongstack/core/types';
 interface TreeInput {
     path?: string | undefined;
     depth?: number | undefined;

package/dist/tree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tree.d.ts","sourceRoot":"","sources":["../src/tree.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAsC,MAAM,kBAAkB,CAAC;AAgBjF,UAAU,SAAS;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/B,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACnC;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAgJhD,CAAC"}
+{"version":3,"file":"tree.d.ts","sourceRoot":"","sources":["../src/tree.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAsC,MAAM,wBAAwB,CAAC;AAgBvF,UAAU,SAAS;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/B,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACnC;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAgJhD,CAAC"}

package/dist/tree.js

@@ -1,11 +1,11 @@
 // src/tree.ts
-import { expectDefined } from "@wrongstack/core";
+import { expectDefined } from "@wrongstack/core/utils";
 import * as fs from "node:fs/promises";
 import * as path2 from "node:path";
 
 // src/_util.ts
 import * as path from "node:path";
-import * as Core from "@wrongstack/core";
+import * as Core from "@wrongstack/core/utils";
 function resolvePath(input, ctx) {
   return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);
 }

package/dist/tree.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/tree.ts", "../src/_util.ts"],
-  "sourcesContent": ["import { expectDefined } from '@wrongstack/core';\nimport * as fs from 'node:fs/promises';\nimport * as path from 'node:path';\nimport type { Tool, ToolProgressEvent, ToolStreamEvent } from '@wrongstack/core';\nimport { safeResolve } from './_util.js';\nconst DEFAULT_IGNORE = [\n  'node_modules',\n  '.git',\n  'dist',\n  'build',\n  '.next',\n  'coverage',\n  '__pycache__',\n  '.wrongstack',\n  '.ssh',\n  '.gnupg',\n  '.aws',\n];\n\ninterface TreeInput {\n  path?: string | undefined;\n  depth?: number | undefined;\n  glob?: string | undefined;\n  exclude?: string[] | undefined;\n  show_files?: boolean | undefined;\n  show_dirs?: boolean | undefined;\n  show_hidden?: boolean | undefined;\n}\n\ninterface TreeOutput {\n  tree: string;\n  total_files: number;\n  total_dirs: number;\n  truncated: boolean;\n  path: string;\n}\n\nexport const treeTool: Tool<TreeInput, TreeOutput> = {\n  name: 'tree',\n  category: 'Filesystem',\n  description:\n    'Display a project or subpath directory tree. Use it for structural layout; use index-backed `codebase-search` first for code understanding when it is live.',\n  usageHint:\n    'DIRECTORY-LAYOUT EXPLORATION:\\n\\n' +\n    '- When `codebase-search` is live, use it first for symbols and concepts; use `tree` when the directory hierarchy itself matters.\\n' +\n    '- Tune `depth` (default 3) and use `glob`/`exclude` to focus the view.\\n' +\n    '- Prefer this over raw `bash find` or `glob` + manual reading when you need a quick structural overview.\\n' +\n    'Output is truncated for very large trees.',\n  permission: 'auto',\n  mutating: false,\n  capabilities: ['fs.read'],\n  icon: 'tree',\n  timeoutMs: 15_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      path: {\n        type: 'string',\n        description: 'Root directory to display the tree from (defaults to project root).',\n      },\n      depth: {\n        type: 'integer',\n        description: 'Maximum directory depth to traverse (default 3, use 0 for unlimited).',\n        minimum: 0,\n        maximum: 20,\n      },\n      glob: {\n        type: 'string',\n        description: 'Only include files matching this glob pattern.',\n      },\n      exclude: {\n        type: 'array',\n        items: { type: 'string' },\n        description: 'List of directory names to completely ignore.',\n      },\n      show_files: {\n        type: 'boolean',\n        description: 'Whether to show individual files (default true).',\n      },\n      show_dirs: {\n        type: 'boolean',\n        description: 'Whether to show directories (default true).',\n      },\n      show_hidden: {\n        type: 'boolean',\n        description: 'Show hidden files starting with . (default: false)',\n      },\n    },\n  },\n  async execute(input, ctx, opts) {\n    let final: TreeOutput | undefined;\n    const executeStream = treeTool.executeStream;\n    if (!executeStream) throw new Error('treeTool: stream execution unavailable');\n    for await (const ev of executeStream(input, ctx, opts)) {\n      if (ev.type === 'final') final = ev.output;\n    }\n    if (!final) throw new Error('tree: stream ended without final event');\n    return final;\n  },\n  async *executeStream(input, ctx): AsyncGenerator<ToolStreamEvent<TreeOutput>> {\n    const basePath = input.path ? safeResolve(input.path, ctx) : ctx.cwd;\n    const maxDepth = input.depth ?? 3;\n    const showFiles = input.show_files ?? true;\n    const showDirs = input.show_dirs ?? true;\n    const showHidden = input.show_hidden ?? false;\n    const exclude = new Set([...DEFAULT_IGNORE, ...(input.exclude ?? [])]);\n    const filterGlob = input.glob;\n\n    const lines: string[] = [basePath];\n    const totals = { totalFiles: { value: 0 }, totalDirs: { value: 0 } };\n\n    // Walker pushes progress into an async queue; the generator drains it.\n    const queue: ToolProgressEvent[] = [];\n    const FLUSH_EVERY = 200; // emit metric every 200 entries seen\n    let lastEmittedTotal = 0;\n\n    const tickProgress = () => {\n      const seen = totals.totalFiles.value + totals.totalDirs.value;\n      if (seen - lastEmittedTotal >= FLUSH_EVERY) {\n        queue.push({\n          type: 'metric',\n          text: `${seen} entries`,\n          data: { files: totals.totalFiles.value, dirs: totals.totalDirs.value },\n        });\n        lastEmittedTotal = seen;\n      }\n    };\n\n    const walkPromise = walkDir(basePath, 0, {\n      maxDepth,\n      exclude,\n      showFiles,\n      showDirs,\n      showHidden,\n      filterGlob,\n      lines,\n      prefix: '',\n      isLast: true,\n      totalFiles: totals.totalFiles,\n      totalDirs: totals.totalDirs,\n      onProgress: tickProgress,\n    });\n\n    // Race the walk against periodic flushes \u2014 yield metrics while it runs.\n    let walkDone = false;\n    walkPromise.finally(() => {\n      walkDone = true;\n    });\n\n    while (!walkDone || queue.length > 0) {\n      if (queue.length > 0) {\n        yield expectDefined(queue.shift());\n      } else {\n        // Race the walk completion against a short tick so we don't busy-\n        // spin while the producer fills the queue. Previously the\n        // setTimeout was never cleared when walkPromise won \u2014 one stray\n        // timer per drain iteration accumulated on the event loop.\n        let pollTimer: ReturnType<typeof setTimeout> | undefined;\n        const poll = new Promise<void>((r) => {\n          pollTimer = setTimeout(r, 50);\n        });\n        try {\n          await Promise.race([walkPromise, poll]).catch(() => undefined);\n        } finally {\n          if (pollTimer) clearTimeout(pollTimer);\n        }\n      }\n    }\n    await walkPromise; // surface any error\n\n    yield {\n      type: 'final',\n      output: {\n        tree: lines.join('\\n'),\n        total_files: totals.totalFiles.value,\n        total_dirs: totals.totalDirs.value,\n        truncated: false,\n        path: basePath,\n      },\n    };\n  },\n};\n\ninterface WalkOptions {\n  maxDepth: number;\n  exclude: Set<string>;\n  showFiles: boolean;\n  showDirs: boolean;\n  showHidden: boolean;\n  filterGlob?: string | undefined;\n  lines: string[];\n  prefix: string;\n  isLast: boolean;\n  totalFiles: { value: number };\n  totalDirs: { value: number };\n  onProgress?: (() => void) | undefined;\n}\n\nasync function walkDir(dir: string, depth: number, opts: WalkOptions): Promise<void> {\n  const entries = await fs\n    .readdir(dir, { withFileTypes: true })\n    .catch(() => [] as import('node:fs').Dirent[]);\n\n  const filtered = entries.filter((e) => {\n    if (!opts.showHidden && e.name.startsWith('.')) return false;\n    if (opts.exclude.has(e.name)) return false;\n    return true;\n  });\n\n  if (depth > 0) {\n    const dirCount = filtered.filter((e) => e.isDirectory()).length;\n    const fileCount = filtered.filter((e) => e.isFile()).length;\n    opts.totalDirs.value += dirCount;\n    opts.totalFiles.value += fileCount;\n    opts.onProgress?.();\n  }\n\n  const items = filtered.sort((a, b) => {\n    if (a.isDirectory() && !b.isDirectory()) return -1;\n    if (!a.isDirectory() && b.isDirectory()) return 1;\n    return a.name.localeCompare(b.name);\n  });\n\n  for (let i = 0; i < items.length; i++) {\n    const entry = items[i];\n    /* v8 ignore next -- i is bounded by items.length, so entry is always defined; defensive. */\n    if (!entry) continue;\n    const isLast = i === items.length - 1;\n    const connector = opts.isLast ? '    ' : '\u2502   ';\n    const branch = isLast ? '\u2514\u2500\u2500 ' : '\u251C\u2500\u2500 ';\n    const displayName = entry.name + (entry.isDirectory() ? '/' : '');\n\n    if (!opts.showDirs && entry.isDirectory()) continue;\n    if (!opts.showFiles && entry.isFile()) continue;\n\n    opts.lines.push(opts.prefix + branch + displayName);\n\n    if (entry.isDirectory() && (opts.maxDepth === 0 || depth < opts.maxDepth)) {\n      const childPrefix = opts.prefix + connector;\n      await walkDir(path.join(dir, entry.name), depth + 1, {\n        ...opts,\n        prefix: childPrefix,\n        isLast,\n      });\n    }\n  }\n}\n", "import { createHash } from 'node:crypto';\nimport * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core';\nimport type { Context } from '@wrongstack/core';\n\n/**\n * sha-256 hex of a UTF-8 string. Used by the file tools to record a content\n * hash alongside the mtime in `ctx.recordRead` \u2014 the hash is the authoritative\n * staleness arbiter for `edit` (mtime has a 2 s tolerance window on Windows).\n */\nexport function sha256hex(content: string): string {\n  return createHash('sha256').update(content, 'utf8').digest('hex');\n}\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm \u2192 yarn \u2192 npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);\n}\n\n/**\n * Roots every file tool may always reach, even in restricted mode: the\n * project root and the user-global `~/.wrongstack` directory (config, memory,\n * sessions, skills). `~/.wrongstack` honors the `WRONGSTACK_HOME` override.\n */\nfunction allowedRoots(ctx: Context): string[] {\n  return [path.resolve(ctx.projectRoot), path.resolve(Core.wstackGlobalRoot())];\n}\n\n/** True if `target` is `root` itself or nested inside any of `roots`. */\nfunction isInsideAny(target: string, roots: string[]): boolean {\n  return roots.some((root) => {\n    const rel = path.relative(root, target);\n    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));\n  });\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const target = path.resolve(absPath);\n  // Unrestricted filesystem access: skip the project-root containment check.\n  if (ctx.allowOutsideProjectRoot) return target;\n  if (isInsideAny(target, allowedRoots(ctx))) return target;\n  throw new Error(`Path \"${absPath}\" is outside project root \"${path.resolve(ctx.projectRoot)}\"`);\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root\u2192out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink \u2014 macOS `/var`\u2192`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  // Unrestricted filesystem access: no symlink-escape check to perform.\n  if (ctx.allowOutsideProjectRoot) return;\n  // Compare like-for-like against the realpath of each always-allowed root\n  // (project root + ~/.wrongstack), since a root may itself be a symlink.\n  const realRoots = await Promise.all(\n    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r))),\n  );\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    if (isInsideAny(real, realRoots)) return;\n    throw new Error(\n      `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoots[0]}\"`,\n    );\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n\u2026[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]\u2026\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// \u2500\u2500\u2500 Command-output normalization (token-saving) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) \u2014 never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only \u2014 it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `\u2026 \u27E8repeated ${run}\u00D7\u27E9`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends \u2014 the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n\u2026[truncated ${total - kept} bytes]\u2026\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI \u2192 collapse\n * carriage-return progress \u2192 trim trailing whitespace \u2192 collapse identical\n * consecutive lines \u2192 squeeze blank-line runs \u2192 head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number | undefined } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines \u2192 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n"],
+  "sourcesContent": ["import { expectDefined } from '@wrongstack/core/utils';\nimport * as fs from 'node:fs/promises';\nimport * as path from 'node:path';\nimport type { Tool, ToolProgressEvent, ToolStreamEvent } from '@wrongstack/core/types';\nimport { safeResolve } from './_util.js';\nconst DEFAULT_IGNORE = [\n  'node_modules',\n  '.git',\n  'dist',\n  'build',\n  '.next',\n  'coverage',\n  '__pycache__',\n  '.wrongstack',\n  '.ssh',\n  '.gnupg',\n  '.aws',\n];\n\ninterface TreeInput {\n  path?: string | undefined;\n  depth?: number | undefined;\n  glob?: string | undefined;\n  exclude?: string[] | undefined;\n  show_files?: boolean | undefined;\n  show_dirs?: boolean | undefined;\n  show_hidden?: boolean | undefined;\n}\n\ninterface TreeOutput {\n  tree: string;\n  total_files: number;\n  total_dirs: number;\n  truncated: boolean;\n  path: string;\n}\n\nexport const treeTool: Tool<TreeInput, TreeOutput> = {\n  name: 'tree',\n  category: 'Filesystem',\n  description:\n    'Display a project or subpath directory tree. Use it for structural layout; use index-backed `codebase-search` first for code understanding when it is live.',\n  usageHint:\n    'DIRECTORY-LAYOUT EXPLORATION:\\n\\n' +\n    '- When `codebase-search` is live, use it first for symbols and concepts; use `tree` when the directory hierarchy itself matters.\\n' +\n    '- Tune `depth` (default 3) and use `glob`/`exclude` to focus the view.\\n' +\n    '- Prefer this over raw `bash find` or `glob` + manual reading when you need a quick structural overview.\\n' +\n    'Output is truncated for very large trees.',\n  permission: 'auto',\n  mutating: false,\n  capabilities: ['fs.read'],\n  icon: 'tree',\n  timeoutMs: 15_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      path: {\n        type: 'string',\n        description: 'Root directory to display the tree from (defaults to project root).',\n      },\n      depth: {\n        type: 'integer',\n        description: 'Maximum directory depth to traverse (default 3, use 0 for unlimited).',\n        minimum: 0,\n        maximum: 20,\n      },\n      glob: {\n        type: 'string',\n        description: 'Only include files matching this glob pattern.',\n      },\n      exclude: {\n        type: 'array',\n        items: { type: 'string' },\n        description: 'List of directory names to completely ignore.',\n      },\n      show_files: {\n        type: 'boolean',\n        description: 'Whether to show individual files (default true).',\n      },\n      show_dirs: {\n        type: 'boolean',\n        description: 'Whether to show directories (default true).',\n      },\n      show_hidden: {\n        type: 'boolean',\n        description: 'Show hidden files starting with . (default: false)',\n      },\n    },\n  },\n  async execute(input, ctx, opts) {\n    let final: TreeOutput | undefined;\n    const executeStream = treeTool.executeStream;\n    if (!executeStream) throw new Error('treeTool: stream execution unavailable');\n    for await (const ev of executeStream(input, ctx, opts)) {\n      if (ev.type === 'final') final = ev.output;\n    }\n    if (!final) throw new Error('tree: stream ended without final event');\n    return final;\n  },\n  async *executeStream(input, ctx): AsyncGenerator<ToolStreamEvent<TreeOutput>> {\n    const basePath = input.path ? safeResolve(input.path, ctx) : ctx.cwd;\n    const maxDepth = input.depth ?? 3;\n    const showFiles = input.show_files ?? true;\n    const showDirs = input.show_dirs ?? true;\n    const showHidden = input.show_hidden ?? false;\n    const exclude = new Set([...DEFAULT_IGNORE, ...(input.exclude ?? [])]);\n    const filterGlob = input.glob;\n\n    const lines: string[] = [basePath];\n    const totals = { totalFiles: { value: 0 }, totalDirs: { value: 0 } };\n\n    // Walker pushes progress into an async queue; the generator drains it.\n    const queue: ToolProgressEvent[] = [];\n    const FLUSH_EVERY = 200; // emit metric every 200 entries seen\n    let lastEmittedTotal = 0;\n\n    const tickProgress = () => {\n      const seen = totals.totalFiles.value + totals.totalDirs.value;\n      if (seen - lastEmittedTotal >= FLUSH_EVERY) {\n        queue.push({\n          type: 'metric',\n          text: `${seen} entries`,\n          data: { files: totals.totalFiles.value, dirs: totals.totalDirs.value },\n        });\n        lastEmittedTotal = seen;\n      }\n    };\n\n    const walkPromise = walkDir(basePath, 0, {\n      maxDepth,\n      exclude,\n      showFiles,\n      showDirs,\n      showHidden,\n      filterGlob,\n      lines,\n      prefix: '',\n      isLast: true,\n      totalFiles: totals.totalFiles,\n      totalDirs: totals.totalDirs,\n      onProgress: tickProgress,\n    });\n\n    // Race the walk against periodic flushes \u2014 yield metrics while it runs.\n    let walkDone = false;\n    walkPromise.finally(() => {\n      walkDone = true;\n    });\n\n    while (!walkDone || queue.length > 0) {\n      if (queue.length > 0) {\n        yield expectDefined(queue.shift());\n      } else {\n        // Race the walk completion against a short tick so we don't busy-\n        // spin while the producer fills the queue. Previously the\n        // setTimeout was never cleared when walkPromise won \u2014 one stray\n        // timer per drain iteration accumulated on the event loop.\n        let pollTimer: ReturnType<typeof setTimeout> | undefined;\n        const poll = new Promise<void>((r) => {\n          pollTimer = setTimeout(r, 50);\n        });\n        try {\n          await Promise.race([walkPromise, poll]).catch(() => undefined);\n        } finally {\n          if (pollTimer) clearTimeout(pollTimer);\n        }\n      }\n    }\n    await walkPromise; // surface any error\n\n    yield {\n      type: 'final',\n      output: {\n        tree: lines.join('\\n'),\n        total_files: totals.totalFiles.value,\n        total_dirs: totals.totalDirs.value,\n        truncated: false,\n        path: basePath,\n      },\n    };\n  },\n};\n\ninterface WalkOptions {\n  maxDepth: number;\n  exclude: Set<string>;\n  showFiles: boolean;\n  showDirs: boolean;\n  showHidden: boolean;\n  filterGlob?: string | undefined;\n  lines: string[];\n  prefix: string;\n  isLast: boolean;\n  totalFiles: { value: number };\n  totalDirs: { value: number };\n  onProgress?: (() => void) | undefined;\n}\n\nasync function walkDir(dir: string, depth: number, opts: WalkOptions): Promise<void> {\n  const entries = await fs\n    .readdir(dir, { withFileTypes: true })\n    .catch(() => [] as import('node:fs').Dirent[]);\n\n  const filtered = entries.filter((e) => {\n    if (!opts.showHidden && e.name.startsWith('.')) return false;\n    if (opts.exclude.has(e.name)) return false;\n    return true;\n  });\n\n  if (depth > 0) {\n    const dirCount = filtered.filter((e) => e.isDirectory()).length;\n    const fileCount = filtered.filter((e) => e.isFile()).length;\n    opts.totalDirs.value += dirCount;\n    opts.totalFiles.value += fileCount;\n    opts.onProgress?.();\n  }\n\n  const items = filtered.sort((a, b) => {\n    if (a.isDirectory() && !b.isDirectory()) return -1;\n    if (!a.isDirectory() && b.isDirectory()) return 1;\n    return a.name.localeCompare(b.name);\n  });\n\n  for (let i = 0; i < items.length; i++) {\n    const entry = items[i];\n    /* v8 ignore next -- i is bounded by items.length, so entry is always defined; defensive. */\n    if (!entry) continue;\n    const isLast = i === items.length - 1;\n    const connector = opts.isLast ? '    ' : '\u2502   ';\n    const branch = isLast ? '\u2514\u2500\u2500 ' : '\u251C\u2500\u2500 ';\n    const displayName = entry.name + (entry.isDirectory() ? '/' : '');\n\n    if (!opts.showDirs && entry.isDirectory()) continue;\n    if (!opts.showFiles && entry.isFile()) continue;\n\n    opts.lines.push(opts.prefix + branch + displayName);\n\n    if (entry.isDirectory() && (opts.maxDepth === 0 || depth < opts.maxDepth)) {\n      const childPrefix = opts.prefix + connector;\n      await walkDir(path.join(dir, entry.name), depth + 1, {\n        ...opts,\n        prefix: childPrefix,\n        isLast,\n      });\n    }\n  }\n}\n", "import { createHash } from 'node:crypto';\nimport * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core/utils';\nimport type { Context } from '@wrongstack/core/agent';\n\n/**\n * sha-256 hex of a UTF-8 string. Used by the file tools to record a content\n * hash alongside the mtime in `ctx.recordRead` \u2014 the hash is the authoritative\n * staleness arbiter for `edit` (mtime has a 2 s tolerance window on Windows).\n */\nexport function sha256hex(content: string): string {\n  return createHash('sha256').update(content, 'utf8').digest('hex');\n}\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm \u2192 yarn \u2192 npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);\n}\n\n/**\n * Roots every file tool may always reach, even in restricted mode: the\n * project root and the user-global `~/.wrongstack` directory (config, memory,\n * sessions, skills). `~/.wrongstack` honors the `WRONGSTACK_HOME` override.\n */\nfunction allowedRoots(ctx: Context): string[] {\n  return [path.resolve(ctx.projectRoot), path.resolve(Core.wstackGlobalRoot())];\n}\n\n/** True if `target` is `root` itself or nested inside any of `roots`. */\nfunction isInsideAny(target: string, roots: string[]): boolean {\n  return roots.some((root) => {\n    const rel = path.relative(root, target);\n    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));\n  });\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const target = path.resolve(absPath);\n  // Unrestricted filesystem access: skip the project-root containment check.\n  if (ctx.allowOutsideProjectRoot) return target;\n  if (isInsideAny(target, allowedRoots(ctx))) return target;\n  throw new Error(`Path \"${absPath}\" is outside project root \"${path.resolve(ctx.projectRoot)}\"`);\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root\u2192out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink \u2014 macOS `/var`\u2192`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  // Unrestricted filesystem access: no symlink-escape check to perform.\n  if (ctx.allowOutsideProjectRoot) return;\n  // Compare like-for-like against the realpath of each always-allowed root\n  // (project root + ~/.wrongstack), since a root may itself be a symlink.\n  const realRoots = await Promise.all(\n    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r))),\n  );\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    if (isInsideAny(real, realRoots)) return;\n    throw new Error(\n      `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoots[0]}\"`,\n    );\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n\u2026[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]\u2026\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// \u2500\u2500\u2500 Command-output normalization (token-saving) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) \u2014 never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only \u2014 it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `\u2026 \u27E8repeated ${run}\u00D7\u27E9`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends \u2014 the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n\u2026[truncated ${total - kept} bytes]\u2026\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI \u2192 collapse\n * carriage-return progress \u2192 trim trailing whitespace \u2192 collapse identical\n * consecutive lines \u2192 squeeze blank-line runs \u2192 head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number | undefined } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines \u2192 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n"],
   "mappings": ";AAAA,SAAS,qBAAqB;AAC9B,YAAY,QAAQ;AACpB,YAAYA,WAAU;;;ACAtB,YAAY,UAAU;AACtB,YAAY,UAAU;AAqCf,SAAS,YAAY,OAAe,KAAsB;AAC/D,SAAY,gBAAW,KAAK,IAAS,eAAU,KAAK,IAAS,aAAQ,IAAI,cAAc,IAAI,KAAK,KAAK;AACvG;AAOA,SAAS,aAAa,KAAwB;AAC5C,SAAO,CAAM,aAAQ,IAAI,WAAW,GAAQ,aAAa,sBAAiB,CAAC,CAAC;AAC9E;AAGA,SAAS,YAAY,QAAgB,OAA0B;AAC7D,SAAO,MAAM,KAAK,CAAC,SAAS;AAC1B,UAAM,MAAW,cAAS,MAAM,MAAM;AACtC,WAAO,QAAQ,MAAO,CAAC,IAAI,WAAW,IAAI,KAAK,CAAM,gBAAW,GAAG;AAAA,EACrE,CAAC;AACH;AAEO,SAAS,iBAAiB,SAAiB,KAAsB;AACtE,QAAM,SAAc,aAAQ,OAAO;AAEnC,MAAI,IAAI,wBAAyB,QAAO;AACxC,MAAI,YAAY,QAAQ,aAAa,GAAG,CAAC,EAAG,QAAO;AACnD,QAAM,IAAI,MAAM,SAAS,OAAO,8BAAmC,aAAQ,IAAI,WAAW,CAAC,GAAG;AAChG;AAEO,SAAS,YAAY,OAAe,KAAsB;AAC/D,SAAO,iBAAiB,YAAY,OAAO,GAAG,GAAG,GAAG;AACtD;;;ADlEA,IAAM,iBAAiB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAoBO,IAAM,WAAwC;AAAA,EACnD,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aACE;AAAA,EACF,WACE;AAAA,EAKF,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,cAAc,CAAC,SAAS;AAAA,EACxB,MAAM;AAAA,EACN,WAAW;AAAA,EACX,aAAa;AAAA,IACX,MAAM;AAAA,IACN,YAAY;AAAA,MACV,MAAM;AAAA,QACJ,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,OAAO;AAAA,QACL,MAAM;AAAA,QACN,aAAa;AAAA,QACb,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,MACA,MAAM;AAAA,QACJ,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,SAAS;AAAA,QACP,MAAM;AAAA,QACN,OAAO,EAAE,MAAM,SAAS;AAAA,QACxB,aAAa;AAAA,MACf;AAAA,MACA,YAAY;AAAA,QACV,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,aAAa;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK,MAAM;AAC9B,QAAI;AACJ,UAAM,gBAAgB,SAAS;AAC/B,QAAI,CAAC,cAAe,OAAM,IAAI,MAAM,wCAAwC;AAC5E,qBAAiB,MAAM,cAAc,OAAO,KAAK,IAAI,GAAG;AACtD,UAAI,GAAG,SAAS,QAAS,SAAQ,GAAG;AAAA,IACtC;AACA,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,wCAAwC;AACpE,WAAO;AAAA,EACT;AAAA,EACA,OAAO,cAAc,OAAO,KAAkD;AAC5E,UAAM,WAAW,MAAM,OAAO,YAAY,MAAM,MAAM,GAAG,IAAI,IAAI;AACjE,UAAM,WAAW,MAAM,SAAS;AAChC,UAAM,YAAY,MAAM,cAAc;AACtC,UAAM,WAAW,MAAM,aAAa;AACpC,UAAM,aAAa,MAAM,eAAe;AACxC,UAAM,UAAU,oBAAI,IAAI,CAAC,GAAG,gBAAgB,GAAI,MAAM,WAAW,CAAC,CAAE,CAAC;AACrE,UAAM,aAAa,MAAM;AAEzB,UAAM,QAAkB,CAAC,QAAQ;AACjC,UAAM,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE;AAGnE,UAAM,QAA6B,CAAC;AACpC,UAAM,cAAc;AACpB,QAAI,mBAAmB;AAEvB,UAAM,eAAe,MAAM;AACzB,YAAM,OAAO,OAAO,WAAW,QAAQ,OAAO,UAAU;AACxD,UAAI,OAAO,oBAAoB,aAAa;AAC1C,cAAM,KAAK;AAAA,UACT,MAAM;AAAA,UACN,MAAM,GAAG,IAAI;AAAA,UACb,MAAM,EAAE,OAAO,OAAO,WAAW,OAAO,MAAM,OAAO,UAAU,MAAM;AAAA,QACvE,CAAC;AACD,2BAAmB;AAAA,MACrB;AAAA,IACF;AAEA,UAAM,cAAc,QAAQ,UAAU,GAAG;AAAA,MACvC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,YAAY,OAAO;AAAA,MACnB,WAAW,OAAO;AAAA,MAClB,YAAY;AAAA,IACd,CAAC;AAGD,QAAI,WAAW;AACf,gBAAY,QAAQ,MAAM;AACxB,iBAAW;AAAA,IACb,CAAC;AAED,WAAO,CAAC,YAAY,MAAM,SAAS,GAAG;AACpC,UAAI,MAAM,SAAS,GAAG;AACpB,cAAM,cAAc,MAAM,MAAM,CAAC;AAAA,MACnC,OAAO;AAKL,YAAI;AACJ,cAAM,OAAO,IAAI,QAAc,CAAC,MAAM;AACpC,sBAAY,WAAW,GAAG,EAAE;AAAA,QAC9B,CAAC;AACD,YAAI;AACF,gBAAM,QAAQ,KAAK,CAAC,aAAa,IAAI,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,QAC/D,UAAE;AACA,cAAI,UAAW,cAAa,SAAS;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AACA,UAAM;AAEN,UAAM;AAAA,MACJ,MAAM;AAAA,MACN,QAAQ;AAAA,QACN,MAAM,MAAM,KAAK,IAAI;AAAA,QACrB,aAAa,OAAO,WAAW;AAAA,QAC/B,YAAY,OAAO,UAAU;AAAA,QAC7B,WAAW;AAAA,QACX,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAiBA,eAAe,QAAQ,KAAa,OAAe,MAAkC;AACnF,QAAM,UAAU,MACb,WAAQ,KAAK,EAAE,eAAe,KAAK,CAAC,EACpC,MAAM,MAAM,CAAC,CAA+B;AAE/C,QAAM,WAAW,QAAQ,OAAO,CAAC,MAAM;AACrC,QAAI,CAAC,KAAK,cAAc,EAAE,KAAK,WAAW,GAAG,EAAG,QAAO;AACvD,QAAI,KAAK,QAAQ,IAAI,EAAE,IAAI,EAAG,QAAO;AACrC,WAAO;AAAA,EACT,CAAC;AAED,MAAI,QAAQ,GAAG;AACb,UAAM,WAAW,SAAS,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE;AACzD,UAAM,YAAY,SAAS,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;AACrD,SAAK,UAAU,SAAS;AACxB,SAAK,WAAW,SAAS;AACzB,SAAK,aAAa;AAAA,EACpB;AAEA,QAAM,QAAQ,SAAS,KAAK,CAAC,GAAG,MAAM;AACpC,QAAI,EAAE,YAAY,KAAK,CAAC,EAAE,YAAY,EAAG,QAAO;AAChD,QAAI,CAAC,EAAE,YAAY,KAAK,EAAE,YAAY,EAAG,QAAO;AAChD,WAAO,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EACpC,CAAC;AAED,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,QAAQ,MAAM,CAAC;AAErB,QAAI,CAAC,MAAO;AACZ,UAAM,SAAS,MAAM,MAAM,SAAS;AACpC,UAAM,YAAY,KAAK,SAAS,SAAS;AACzC,UAAM,SAAS,SAAS,wBAAS;AACjC,UAAM,cAAc,MAAM,QAAQ,MAAM,YAAY,IAAI,MAAM;AAE9D,QAAI,CAAC,KAAK,YAAY,MAAM,YAAY,EAAG;AAC3C,QAAI,CAAC,KAAK,aAAa,MAAM,OAAO,EAAG;AAEvC,SAAK,MAAM,KAAK,KAAK,SAAS,SAAS,WAAW;AAElD,QAAI,MAAM,YAAY,MAAM,KAAK,aAAa,KAAK,QAAQ,KAAK,WAAW;AACzE,YAAM,cAAc,KAAK,SAAS;AAClC,YAAM,QAAa,WAAK,KAAK,MAAM,IAAI,GAAG,QAAQ,GAAG;AAAA,QACnD,GAAG;AAAA,QACH,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;",
   "names": ["path"]
 }

package/dist/typecheck.d.ts

@@ -1,4 +1,4 @@
-import type { Tool } from '@wrongstack/core';
+import type { Tool } from '@wrongstack/core/types';
 interface TypecheckInput {
     project?: string | undefined;
     cwd?: string | undefined;

package/dist/typecheck.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"typecheck.d.ts","sourceRoot":"","sources":["../src/typecheck.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAmB,MAAM,kBAAkB,CAAC;AAK9D,UAAU,cAAc;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,8DAA8D;IAC9D,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5B;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,aAAa,EAAE,IAAI,CAAC,cAAc,EAAE,eAAe,CA6G/D,CAAC"}
+{"version":3,"file":"typecheck.d.ts","sourceRoot":"","sources":["../src/typecheck.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAmB,MAAM,wBAAwB,CAAC;AAKpE,UAAU,cAAc;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,8DAA8D;IAC9D,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5B;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,aAAa,EAAE,IAAI,CAAC,cAAc,EAAE,eAAe,CA6G/D,CAAC"}

package/dist/typecheck.js

@@ -4,17 +4,17 @@ import * as path9 from "node:path";
 // src/_spawn-stream.ts
 import { spawn as spawn2 } from "node:child_process";
 import {
-  buildChildEnv,
   emitProcessCompleted,
   emitProcessOutput,
   emitProcessStarted
-} from "@wrongstack/core";
+} from "@wrongstack/core/observability";
+import { buildChildEnv } from "@wrongstack/core/utils";
 
 // src/_output-spool.ts
 import { createWriteStream, mkdirSync } from "node:fs";
 import * as fsp from "node:fs/promises";
 import * as path from "node:path";
-import { wstackGlobalRoot } from "@wrongstack/core";
+import { wstackGlobalRoot } from "@wrongstack/core/utils";
 var SPOOL_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
 var SPOOL_WRITE_HWM_BYTES = 4 * 1024 * 1024;
 var sweepStarted = false;
@@ -314,7 +314,7 @@ var CircuitBreaker = class {
 };
 
 // src/_redact-command.ts
-import { expectDefined } from "@wrongstack/core";
+import { expectDefined } from "@wrongstack/core/utils";
 var SENSITIVE_FLAG_PATTERNS = [
   // --flag=value  or  --flag "value"  (value captured up to next space or comma)
   /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
@@ -408,7 +408,12 @@ var ProcessRegistryImpl = class {
     this.breaker.setEnabled(false);
   }
   register(info) {
-    this.processes.set(info.pid, { ...info, killed: false, protected: info.protected ?? false });
+    this.processes.set(info.pid, {
+      ...info,
+      killed: false,
+      protected: info.protected ?? false,
+      background: info.background ?? false
+    });
   }
   _isSafeSignalPid(pid) {
     return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
@@ -461,12 +466,21 @@ var ProcessRegistryImpl = class {
     }
     return n;
   }
+  /** Count of active jobs explicitly launched in background mode. */
+  get activeBackgroundCount() {
+    let n = 0;
+    for (const p of this.processes.values()) {
+      if (p.background && !p.killed) n++;
+    }
+    return n;
+  }
   /**
    * Combined stats for observability — used by /ps and the TUI status bar.
    */
   stats() {
     return {
       activeCount: this.activeCount,
+      backgroundCount: this.activeBackgroundCount,
       totalCount: this.processes.size,
       breaker: this.breaker.snapshot()
     };
@@ -567,7 +581,7 @@ var ProcessRegistryImpl = class {
     this.autoKillTimer = setTimeout(() => {
       this.autoKillTimer = null;
       this.autoKillArmedAt = null;
-      this.killAll({ force: false });
+      this.killAll({ force: false, preserveBackground: true });
       this.breaker.forceReset();
       this._emitBreakerCountdown();
     }, this.autoKillResetMs);
@@ -607,6 +621,7 @@ var ProcessRegistryImpl = class {
     if (!p) return false;
     if (p.killed) return true;
     if (p.protected) return false;
+    if (opts.preserveBackground && p.background) return false;
     const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
     const isWin2 = os.platform() === "win32";
     if (isWin2) {
@@ -958,7 +973,7 @@ async function* spawnStream(opts) {
 
 // src/_util.ts
 import * as path3 from "node:path";
-import * as Core from "@wrongstack/core";
+import * as Core from "@wrongstack/core/utils";
 function resolvePath(input, ctx) {
   return path3.isAbsolute(input) ? path3.normalize(input) : path3.resolve(ctx.workingDir ?? ctx.cwd, input);
 }
@@ -1144,7 +1159,20 @@ function pythonProfile() {
     ]),
     ignoredDirectories: IGNORES,
     packageManagers: Object.freeze(["pip", "poetry", "pipenv", "uv"]),
-    executables: Object.freeze(["python", "python3", "ruff", "black", "pytest", "mypy", "pyright"]),
+    executables: Object.freeze([
+      "python",
+      "python3",
+      "pip",
+      "pip3",
+      "poetry",
+      "pipenv",
+      "uv",
+      "ruff",
+      "black",
+      "pytest",
+      "mypy",
+      "pyright"
+    ]),
     operations: Object.freeze({
       syntax: async (ctx) => {
         const py = ctx.options.target ? "python3" : "python3";
@@ -1204,6 +1232,14 @@ function pythonProfile() {
           network: true
         });
       },
+      "package-remove": async (ctx) => {
+        const names = packageNames(ctx);
+        return names.length === 0 ? unavailable(ctx, "package-remove", "At least one package name is required.") : processPlan(ctx, "package-remove", "pip", ["uninstall", "--yes", ...names], {
+          parser: "package-text",
+          reason: "Remove validated Python packages.",
+          mutating: true
+        });
+      },
       "package-audit": async (ctx) => processPlan(ctx, "package-audit", "pip", ["audit"], {
         parser: "pip-audit",
         reason: "Audit Python dependencies for vulnerabilities.",
@@ -1811,6 +1847,19 @@ function typescriptProfile() {
           network: true
         });
       },
+      "package-remove": async (ctx) => {
+        const names = packageNames(ctx);
+        if (names.length === 0)
+          return unavailable(ctx, "package-remove", "At least one package name is required.");
+        const manager = ctx.workspace.packageManager ?? "npm";
+        const args = manager === "npm" ? ["uninstall", "--ignore-scripts", ...names] : ["remove", "--ignore-scripts", ...names];
+        return processPlan(ctx, "package-remove", manager, args, {
+          parser: "package-text",
+          reason: `Remove validated packages with ${manager} and lifecycle scripts disabled.`,
+          mutating: true,
+          network: true
+        });
+      },
       "package-audit": async (ctx) => {
         const manager = ctx.workspace.packageManager ?? "npm";
         return processPlan(ctx, "package-audit", manager, ["audit", "--json"], {
@@ -2246,13 +2295,28 @@ var csharpProfile = {
     }),
     "package-add": async (ctx) => {
       const names = packageNames(ctx);
-      return names.length === 0 ? unavailable(ctx, "package-add", "At least one NuGet package is required.") : processPlan(ctx, "package-add", "dotnet", ["add", "package", ...names], {
-        parser: "dotnet-package",
-        reason: "Add validated NuGet packages.",
-        mutating: true,
-        network: true,
-        executesProjectCode: true
-      });
+      const [spec] = names;
+      const versionAt = spec?.lastIndexOf("@") ?? -1;
+      const packageName = versionAt > 0 ? spec?.slice(0, versionAt) : spec;
+      const packageVersion = versionAt > 0 ? spec?.slice(versionAt + 1) : void 0;
+      return names.length === 0 ? unavailable(ctx, "package-add", "At least one NuGet package is required.") : names.length > 1 ? unavailable(ctx, "package-add", "NuGet package changes run one package at a time.") : processPlan(
+        ctx,
+        "package-add",
+        "dotnet",
+        [
+          "add",
+          "package",
+          packageName ?? "",
+          ...packageVersion ? ["--version", packageVersion] : []
+        ],
+        {
+          parser: "dotnet-package",
+          reason: "Add validated NuGet packages.",
+          mutating: true,
+          network: true,
+          executesProjectCode: true
+        }
+      );
     },
     "package-remove": async (ctx) => {
       const names = packageNames(ctx);
@@ -2906,6 +2970,7 @@ var MAX_ARGUMENT_LENGTH = 4096;
 var PACKAGE_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+(?:@[a-z0-9*+._~^<>=|-]+)?$/i;
 var COMPOSER_PACKAGE_RE = /^[a-z0-9_.-]+\/[a-z0-9_.-]+(?::[a-z0-9*+._~^<>=|-]+)?$/i;
 var GO_MODULE_RE = /^(?:[a-z0-9.-]+\.)+[a-z0-9.-]+\/[a-z0-9._~+/@-]+$/i;
+var PYTHON_PACKAGE_RE = /^[a-z0-9._-]+(?:\[[a-z0-9._,-]+\])?==[a-z0-9*+._!~-]+$/i;
 async function planLanguageOperation(options) {
   validateOperationOptions(options.operation, options.operationOptions?.packages);
   const detection = await detectLanguageWorkspaces(options);
@@ -3089,7 +3154,7 @@ function validateOperationOptions(operation, packages) {
     if (value.startsWith(".") || value.startsWith("/") || /^[A-Za-z]:/.test(value) || value.includes("://")) {
       throw new Error(`Package paths and URLs are not supported: "${value}"`);
     }
-    if (!PACKAGE_NAME_RE.test(value) && !COMPOSER_PACKAGE_RE.test(value) && !GO_MODULE_RE.test(value)) {
+    if (!PACKAGE_NAME_RE.test(value) && !COMPOSER_PACKAGE_RE.test(value) && !GO_MODULE_RE.test(value) && !PYTHON_PACKAGE_RE.test(value)) {
       throw new Error(`Invalid package identifier "${value}"`);
     }
   }