@wrongstack/tools 0.298.3 → 0.300.0

package/dist/builtin.js

@@ -721,7 +721,7 @@ var init_process_registry = __esm({
         const p = this.processes.get(pid);
         if (!p) return false;
         if (p.killed) return true;
-        if (p.protected) return false;
+        if (p.protected && opts.includeProtected !== true) return false;
         if (opts.preserveBackground && p.background) return false;
         const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
         const isWin5 = os.platform() === "win32";
@@ -772,9 +772,13 @@ var init_process_registry = __esm({
       killAll(opts = {}) {
         const pids = Array.from(this.processes.keys());
         const killed = [];
+        const includeProtected = opts.includeProtected === true;
         for (const pid of pids) {
           const p = this.processes.get(pid);
-          if (p && !p.protected && this.kill(pid, opts)) killed.push(pid);
+          if (!p) continue;
+          if (p.protected && !includeProtected) continue;
+          if (opts.preserveBackground && p.background) continue;
+          if (this.kill(pid, opts)) killed.push(pid);
         }
         return killed;
       }
@@ -1138,18 +1142,18 @@ async function resolveRealInsideRoot(absPath, ctx) {
   const realRoots = await Promise.all(
     allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path3.resolve(r)))
   );
-  let probe2 = absPath;
+  let probe = absPath;
   const pendingTail = [];
   for (; ; ) {
     let real;
     try {
-      real = await fsp2.realpath(probe2);
+      real = await fsp2.realpath(probe);
     } catch (err) {
       if (err.code === "ENOENT") {
-        const parent = path3.dirname(probe2);
-        if (parent === probe2) return absPath;
-        pendingTail.unshift(path3.basename(probe2));
-        probe2 = parent;
+        const parent = path3.dirname(probe);
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path3.basename(probe));
+        probe = parent;
         continue;
       }
       throw err;
@@ -4968,20 +4972,23 @@ var init_legacy_bridge = __esm({
 });
 
 // src/codebase-index/languages.ts
-import * as path18 from "node:path";
+import * as path13 from "node:path";
 function detectLang(file) {
-  const base = path18.basename(file);
+  const base = path13.basename(file);
   const lowerBase = base.toLowerCase();
   if (lowerBase.endsWith(".d.ts") || lowerBase.endsWith(".d.mts") || lowerBase.endsWith(".d.cts")) {
     return "ts";
   }
   const special = SPECIAL_FILENAMES[lowerBase];
   if (special) return special;
-  const ext = path18.extname(base).toLowerCase();
+  const ext = path13.extname(base).toLowerCase();
   if (!ext) return null;
   return EXT_TO_LANG[ext] ?? null;
 }
-var EXT_TO_LANG, INDEXABLE_EXTENSIONS, SPECIAL_FILENAMES;
+function languageFamily(lang) {
+  return LANG_FAMILY[lang] ?? "other";
+}
+var EXT_TO_LANG, INDEXABLE_EXTENSIONS, SPECIAL_FILENAMES, LANG_FAMILY, LANG_FAMILY_ENTRIES;
 var init_languages2 = __esm({
   "src/codebase-index/languages.ts"() {
     "use strict";
@@ -5072,6 +5079,52 @@ var init_languages2 = __esm({
       procfile: "other",
       justfile: "other"
     };
+    LANG_FAMILY = {
+      // Single-compilation-unit family: a .vue/.svelte script block is JS/TS and
+      // imports from — and is imported by — plain .ts files.
+      ts: "js",
+      tsx: "js",
+      js: "js",
+      jsx: "js",
+      vue: "js",
+      svelte: "js",
+      go: "go",
+      py: "py",
+      rs: "rs",
+      // The JVM resolves across languages: Kotlin and Scala call Java directly.
+      java: "jvm",
+      kotlin: "jvm",
+      scala: "jvm",
+      csharp: "dotnet",
+      // A .h header is consumed by both C and C++ translation units.
+      c: "c",
+      cpp: "c",
+      ruby: "ruby",
+      php: "php",
+      swift: "swift",
+      dart: "dart",
+      elixir: "elixir",
+      haskell: "haskell",
+      zig: "zig",
+      lua: "lua",
+      r: "r",
+      shell: "shell",
+      sql: "sql",
+      json: "data",
+      yaml: "data",
+      toml: "data",
+      html: "web",
+      css: "web",
+      proto: "proto",
+      graphql: "graphql",
+      md: "other",
+      other: "other"
+    };
+    LANG_FAMILY_ENTRIES = Object.freeze(
+      Object.entries(LANG_FAMILY).map(
+        ([lang, family]) => Object.freeze([lang, family])
+      )
+    );
   }
 });
 
@@ -5236,7 +5289,7 @@ function getTypeName(name) {
 function deduplicateRefs(refs) {
   const seen = /* @__PURE__ */ new Set();
   return refs.filter((r) => {
-    const key = `${r.toName}:${r.callType}:${r.line}`;
+    const key = `${r.toName}:${r.callType}:${r.line}:${r.module ?? ""}`;
     if (seen.has(key)) return false;
     seen.add(key);
     return true;
@@ -5246,10 +5299,16 @@ function getImportSpecifierName(spec) {
   return spec.propertyName?.text ?? spec.name.text;
 }
 function emitImportSpecifierRefs(node, refs, lineNum) {
+  const module = moduleSpecifierOf(node.moduleSpecifier);
   const clause = node.importClause;
-  if (!clause) return;
+  if (!clause) {
+    if (module) {
+      refs.push({ fromId: 0, toName: module, callType: "import", line: lineNum, module });
+    }
+    return;
+  }
   if (clause.name) {
-    refs.push({ fromId: 0, toName: clause.name.text, callType: "import", line: lineNum });
+    refs.push({ fromId: 0, toName: clause.name.text, callType: "import", line: lineNum, module });
   }
   const bindings = clause.namedBindings;
   if (!bindings) return;
@@ -5259,26 +5318,40 @@ function emitImportSpecifierRefs(node, refs, lineNum) {
         fromId: 0,
         toName: getImportSpecifierName(element),
         callType: "import",
-        line: lineNum
+        line: lineNum,
+        module
       });
     }
   } else if (ts.isNamespaceImport(bindings)) {
-    refs.push({ fromId: 0, toName: bindings.name.text, callType: "import", line: lineNum });
+    refs.push({
+      fromId: 0,
+      toName: bindings.name.text,
+      callType: "import",
+      line: lineNum,
+      module
+    });
   }
 }
+function moduleSpecifierOf(node) {
+  return node && ts.isStringLiteral(node) ? node.text : void 0;
+}
 function emitExportSpecifierRefs(node, refs, lineNum) {
+  const module = moduleSpecifierOf(node.moduleSpecifier);
   const clause = node.exportClause;
   if (clause && ts.isNamespaceExport(clause)) {
-    refs.push({ fromId: 0, toName: clause.name.text, callType: "import", line: lineNum });
+    refs.push({ fromId: 0, toName: clause.name.text, callType: "import", line: lineNum, module });
     return;
   }
   if (clause && ts.isNamedExports(clause)) {
     for (const element of clause.elements) {
       const originalName = element.propertyName?.text ?? element.name.text;
-      refs.push({ fromId: 0, toName: originalName, callType: "import", line: lineNum });
+      refs.push({ fromId: 0, toName: originalName, callType: "import", line: lineNum, module });
     }
     return;
   }
+  if (module) {
+    refs.push({ fromId: 0, toName: module, callType: "import", line: lineNum, module });
+  }
 }
 var ts, tsLoad, kindMapCache;
 var init_ts_parser = __esm({
@@ -5290,6 +5363,82 @@ var init_ts_parser = __esm({
   }
 });
 
+// src/codebase-index/parser-output.ts
+function coerceSymbols(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry) => {
+    const candidate = entry;
+    if (typeof candidate.name !== "string" || typeof candidate.kind !== "string") return [];
+    return [
+      {
+        name: candidate.name,
+        kind: candidate.kind,
+        line: typeof candidate.line === "number" ? candidate.line : 1,
+        col: typeof candidate.col === "number" ? candidate.col : 0,
+        signature: typeof candidate.signature === "string" ? candidate.signature : "",
+        scope: typeof candidate.scope === "string" ? candidate.scope : ""
+      }
+    ];
+  });
+}
+function coerceRefs(value, lang) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry) => {
+    const candidate = entry;
+    if (typeof candidate.toName !== "string" || !candidate.toName) return [];
+    if (typeof candidate.callType !== "string" || !CALL_TYPES.has(candidate.callType)) return [];
+    const module = typeof candidate.module === "string" && candidate.module ? candidate.module : void 0;
+    return [
+      {
+        fromId: 0,
+        toName: candidate.toName,
+        callType: candidate.callType,
+        line: typeof candidate.line === "number" ? candidate.line : 1,
+        lang,
+        module
+      }
+    ];
+  });
+}
+function parseParserOutput(stdout, lang) {
+  const trimmed = stdout.trim();
+  if (!trimmed) return { symbols: [], refs: [] };
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return { symbols: [], refs: [] };
+  }
+  if (Array.isArray(parsed)) return { symbols: coerceSymbols(parsed), refs: [] };
+  const record = parsed;
+  return {
+    symbols: coerceSymbols(record.symbols),
+    refs: dedupeRefs(coerceRefs(record.refs, lang))
+  };
+}
+function dedupeRefs(refs) {
+  const seen = /* @__PURE__ */ new Set();
+  return refs.filter((ref) => {
+    const key = `${ref.toName}:${ref.callType}:${ref.line}:${ref.module ?? ""}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+var CALL_TYPES;
+var init_parser_output = __esm({
+  "src/codebase-index/parser-output.ts"() {
+    "use strict";
+    CALL_TYPES = /* @__PURE__ */ new Set([
+      "call",
+      "type_ref",
+      "inherit",
+      "implement",
+      "import"
+    ]);
+  }
+});
+
 // src/codebase-index/spawn-gate.ts
 function withSpawnGate(fn) {
   const run = chain.then(fn, fn);
@@ -5315,8 +5464,8 @@ __export(go_parser_exports, {
 });
 import { spawn as spawn5 } from "node:child_process";
 import * as os6 from "node:os";
-import * as path19 from "node:path";
-import * as fs14 from "node:fs/promises";
+import * as path20 from "node:path";
+import * as fs15 from "node:fs/promises";
 async function parseSymbols2(opts) {
   const { file, content, lang } = opts;
   try {
@@ -5324,7 +5473,8 @@ async function parseSymbols2(opts) {
     if (parsed.symbols.length > 0) {
       return parsed;
     }
-    return fallbackParse(file, content, lang);
+    const fallback = fallbackParse(file, content, lang);
+    return parsed.refs?.length ? { ...fallback, refs: parsed.refs } : fallback;
   } catch {
     return fallbackParse(file, content, lang);
   }
@@ -5388,9 +5538,9 @@ async function syncGoParse(filePath, content, lang) {
   try {
     let scriptPath = _cachedGoScriptPath;
     if (!scriptPath) {
-      const tmpDir = await fs14.mkdtemp(path19.join(os6.tmpdir(), "ws-go-parse-"));
-      scriptPath = path19.join(tmpDir, "parse.go");
-      await fs14.writeFile(scriptPath, GO_PARSE_SCRIPT, "utf8");
+      const tmpDir = await fs15.mkdtemp(path20.join(os6.tmpdir(), "ws-go-parse-"));
+      scriptPath = path20.join(tmpDir, "parse.go");
+      await fs15.writeFile(scriptPath, GO_PARSE_SCRIPT, "utf8");
       _cachedGoScriptPath = scriptPath;
     }
     const goBinary = resolveWin32Command("go");
@@ -5432,8 +5582,8 @@ async function syncGoParse(filePath, content, lang) {
     if (code !== 0 || !stdout.trim()) {
       return { file: filePath, lang, symbols: [], mtimeMs: Date.now() };
     }
-    const raw = JSON.parse(stdout.trim());
-    const symbols = raw.map((s) => ({
+    const { symbols: rawSymbols, refs } = parseParserOutput(stdout, lang);
+    const symbols = rawSymbols.map((s) => ({
       id: 0,
       lang,
       kind: s.kind,
@@ -5446,7 +5596,7 @@ async function syncGoParse(filePath, content, lang) {
       scope: s.scope ?? "",
       text: `${s.name} ${s.signature ?? ""}`.trim()
     }));
-    return { file: filePath, lang, symbols, mtimeMs: Date.now() };
+    return { file: filePath, lang, symbols, refs, mtimeMs: Date.now() };
   } catch {
     return { file: filePath, lang, symbols: [], mtimeMs: Date.now() };
   }
@@ -5456,6 +5606,7 @@ var init_go_parser = __esm({
   "src/codebase-index/go-parser.ts"() {
     "use strict";
     init_win32_resolve();
+    init_parser_output();
     init_spawn_gate();
     init_languages2();
     GO_PARSE_SCRIPT = `
@@ -5469,6 +5620,7 @@ import (
 	"go/token"
 	"io"
 	"os"
+	"strconv"
 	"strings"
 )
 
@@ -5481,16 +5633,34 @@ type Sym struct {
 	Scope     string \`json:"scope"\`
 }
 
+// Ref is a cross-reference emitted alongside the symbols, so one \`go run\`
+// yields both. Module is the import path for CallType "import", else empty.
+type Ref struct {
+	ToName   string \`json:"toName"\`
+	CallType string \`json:"callType"\`
+	Line     int    \`json:"line"\`
+	Module   string \`json:"module"\`
+}
+
+type Result struct {
+	Symbols []Sym \`json:"symbols"\`
+	Refs    []Ref \`json:"refs"\`
+}
+
+func emptyResult() string {
+	return "{\\"symbols\\":[],\\"refs\\":[]}"
+}
+
 func main() {
 	src, err := io.ReadAll(os.Stdin)
 	if err != nil {
-		fmt.Print("[]")
+		fmt.Print(emptyResult())
 		return
 	}
 	fset := token.NewFileSet()
 	node, err := parser.ParseFile(fset, "src.go", src, 0)
 	if err != nil {
-		fmt.Print("[]")
+		fmt.Print(emptyResult())
 		return
 	}
 
@@ -5554,9 +5724,43 @@ func main() {
 		}
 	}
 
-	data, err := json.Marshal(syms)
+	refs := []Ref{}
+	ast.Inspect(node, func(n ast.Node) bool {
+		switch expr := n.(type) {
+		case *ast.CallExpr:
+			line := fset.Position(expr.Pos()).Line
+			switch fun := expr.Fun.(type) {
+			case *ast.Ident:
+				refs = append(refs, Ref{ToName: fun.Name, CallType: "call", Line: line})
+			case *ast.SelectorExpr:
+				// Record the selected name (\`Join\` of \`filepath.Join\`): it is the
+				// declared symbol name, so it resolves the same way the TypeScript
+				// and Python extractors' call refs do.
+				refs = append(refs, Ref{ToName: fun.Sel.Name, CallType: "call", Line: line})
+			}
+		case *ast.ImportSpec:
+			if expr.Path != nil {
+				if importPath, uerr := strconv.Unquote(expr.Path.Value); uerr == nil {
+					line := fset.Position(expr.Pos()).Line
+					// A Go import names a package, not a symbol; the package's
+					// last path segment is the name it is referenced by.
+					name := importPath
+					if idx := strings.LastIndex(importPath, "/"); idx >= 0 {
+						name = importPath[idx+1:]
+					}
+					refs = append(refs, Ref{ToName: name, CallType: "import", Line: line, Module: importPath})
+				}
+			}
+		}
+		return true
+	})
+
+	if syms == nil {
+		syms = []Sym{}
+	}
+	data, err := json.Marshal(Result{Symbols: syms, Refs: refs})
 	if err != nil {
-		fmt.Print("[]")
+		fmt.Print(emptyResult())
 		return
 	}
 	fmt.Print(string(data))
@@ -5908,9 +6112,13 @@ var init_generic_parser = __esm({
       ],
       elixir: [
         { re: /\bdef(?:p|macro|macrop)?\s+([A-Za-z_]\w*[!?]?)/g, kind: "function" },
-        { re: /\bdefmodule\s+([A-Za-z_.]\w*)/g, kind: "namespace" }
+        // Dotted module names must be captured whole: `alias Foo.Bar` resolves
+        // against this symbol, and a `Foo`-only capture never matches it.
+        { re: /\bdefmodule\s+([A-Z][\w.]*)/g, kind: "namespace" }
       ],
       haskell: [
+        // Target of `import Data.List`.
+        { re: /^module\s+([A-Z][\w.]*)/gm, kind: "namespace" },
         { re: /^([A-Za-z_]\w*)\s*::/gm, kind: "function" },
         { re: /\bdata\s+([A-Za-z_]\w*)/g, kind: "type" },
         { re: /\btype\s+(?:family\s+)?([A-Za-z_]\w*)/g, kind: "type" },
@@ -6001,9 +6209,9 @@ __export(py_parser_exports, {
   parseSymbols: () => parseSymbols4
 });
 import { spawn as spawn6 } from "node:child_process";
-import * as fs15 from "node:fs/promises";
+import * as fs16 from "node:fs/promises";
 import * as os7 from "node:os";
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 async function parseSymbols4(opts) {
   const { file, content, lang } = opts;
   try {
@@ -6081,10 +6289,10 @@ function spawnPyParser(pyBinary, scriptPath, filePath, content) {
 async function syncPyParse(filePath, content, lang) {
   try {
     if (!_cachedScriptPath) {
-      const tmpDir = path20.join(os7.tmpdir(), "ws-py-parse");
-      await fs15.mkdir(tmpDir, { recursive: true });
-      _cachedScriptPath = path20.join(tmpDir, "parse.py");
-      await fs15.writeFile(_cachedScriptPath, PY_PARSE_SCRIPT, "utf8");
+      const tmpDir = path21.join(os7.tmpdir(), "ws-py-parse");
+      await fs16.mkdir(tmpDir, { recursive: true });
+      _cachedScriptPath = path21.join(tmpDir, "parse.py");
+      await fs16.writeFile(_cachedScriptPath, PY_PARSE_SCRIPT, "utf8");
     }
     cachedPyBinary ??= resolvePython();
     const pyBinary = await cachedPyBinary;
@@ -6098,7 +6306,7 @@ async function syncPyParse(filePath, content, lang) {
     if (code !== 0 || !stdout.trim()) {
       return { file: filePath, lang, symbols: [], mtimeMs: Date.now() };
     }
-    const raw = JSON.parse(stdout.trim());
+    const { symbols: raw, refs } = parseParserOutput(stdout, lang);
     const symbols = raw.map((s) => ({
       id: 0,
       lang,
@@ -6112,7 +6320,7 @@ async function syncPyParse(filePath, content, lang) {
       scope: s.scope ?? "",
       text: `${s.name} ${s.signature ?? ""}`.trim()
     }));
-    return { file: filePath, lang, symbols, mtimeMs: Date.now() };
+    return { file: filePath, lang, symbols, refs, mtimeMs: Date.now() };
   } catch {
     return null;
   }
@@ -6123,6 +6331,7 @@ var init_py_parser = __esm({
     "use strict";
     init_win32_resolve();
     init_generic_parser();
+    init_parser_output();
     init_spawn_gate();
     init_languages2();
     PY_PARSE_SCRIPT = `import ast, json, sys, os
@@ -6184,7 +6393,18 @@ class Sym:
 def is_private(name):
     return name.startswith("__") and not name.endswith("__")
 
+def leaf_name(node):
+    # Declared name of the callee: \`join\` of \`os.path.join\`. Matches how the
+    # TypeScript and Go extractors record call refs, so resolution behaves the
+    # same across languages.
+    if isinstance(node, ast.Attribute):
+        return node.attr
+    if isinstance(node, ast.Name):
+        return node.id
+    return get_name(node).split(".")[-1]
+
 syms = []
+refs = []
 errors = []
 
 try:
@@ -6192,7 +6412,7 @@ try:
     tree = ast.parse(source, filename=sys.argv[1])
 except Exception as e:
     errors.append(str(e))
-    print("[]")
+    print(json.dumps({"symbols": [], "refs": []}))
     sys.exit(0)
 
 # Module-level scope
@@ -6326,7 +6546,42 @@ class ModuleVisitor(ast.NodeVisitor):
 visitor = ModuleVisitor()
 visitor.visit(tree)
 
-print(json.dumps([s.to_dict() for s in syms]))
+# Refs need a separate full walk: ModuleVisitor deliberately does not descend
+# into function bodies (it would index locals as symbols), but that is exactly
+# where the calls are.
+for node in ast.walk(tree):
+    if isinstance(node, ast.Call):
+        name = leaf_name(node.func)
+        if name:
+            refs.append({"toName": name, "callType": "call", "line": node.lineno})
+    elif isinstance(node, ast.Import):
+        for alias in node.names:
+            refs.append({
+                "toName": alias.name.split(".")[-1],
+                "callType": "import",
+                "line": node.lineno,
+                "module": alias.name,
+            })
+    elif isinstance(node, ast.ImportFrom):
+        # PEP 328: node.level is the number of leading dots. Preserving them is
+        # what lets the resolver walk up from the importing file's package \u2014
+        # dropping them made \`from .foo import X\` indistinguishable from an
+        # absolute \`foo\`.
+        module = ("." * (node.level or 0)) + (node.module or "")
+        for alias in node.names:
+            refs.append({
+                "toName": alias.name,
+                "callType": "import",
+                "line": node.lineno,
+                "module": module,
+            })
+    elif isinstance(node, ast.ClassDef):
+        for base in node.bases:
+            name = leaf_name(base)
+            if name:
+                refs.append({"toName": name, "callType": "inherit", "line": node.lineno})
+
+print(json.dumps({"symbols": [s.to_dict() for s in syms], "refs": refs}))
 `;
     _cachedScriptPath = null;
   }
@@ -6339,107 +6594,10 @@ __export(rs_parser_exports, {
   parseSymbols: () => parseSymbols5
 });
 import { expectDefined as expectDefined3 } from "@wrongstack/core/utils";
-import { execFile, spawn as spawn7 } from "node:child_process";
-import * as fs16 from "node:fs/promises";
-import * as path21 from "node:path";
 async function parseSymbols5(opts) {
   const { file, content, lang } = opts;
-  const nativeAvailable = await checkNativeParser();
-  if (nativeAvailable) {
-    const result = await withSpawnGate(() => tryNativeParse(file, content));
-    if (result) return result;
-  }
   return regexParse({ file, content, lang });
 }
-function probe(command, args) {
-  return new Promise((resolve16, reject) => {
-    execFile(command, args, { timeout: 1e4, windowsHide: true }, (error) => {
-      if (error) reject(error);
-      else resolve16();
-    });
-  });
-}
-function checkNativeParser() {
-  nativeParserAvailability ??= (async () => {
-    try {
-      await probe("rustc", ["--version"]);
-      const toolsDir = path21.join(process.cwd(), "tools");
-      await probe(
-        "cargo",
-        [
-          "metadata",
-          "--no-deps",
-          "--format-version",
-          "1",
-          "--manifest-path",
-          path21.join(toolsDir, "Cargo.toml")
-        ]
-      );
-      return true;
-    } catch {
-      return false;
-    }
-  })();
-  return nativeParserAvailability;
-}
-async function tryNativeParse(file, content) {
-  try {
-    const toolsDir = path21.join(process.cwd(), "tools");
-    const crateDir = path21.join(toolsDir, "syn-parser");
-    const tmpFile = path21.join(crateDir, "src", "input.rs");
-    await fs16.writeFile(tmpFile, content, "utf8");
-    const cargoBinary = resolveWin32Command("cargo");
-    const result = await new Promise(
-      (resolve16, reject) => {
-        let settled = false;
-        const proc = spawn7(
-          cargoBinary,
-          ["run", "--manifest-path", path21.join(toolsDir, "Cargo.toml")],
-          {
-            cwd: process.cwd(),
-            stdio: ["pipe", "pipe", "pipe"],
-            windowsHide: true
-          }
-        );
-        proc.on("error", (err) => {
-          if (settled) return;
-          settled = true;
-          reject(err);
-        });
-        let stdout2 = "";
-        proc.stdout?.on("data", (chunk) => {
-          stdout2 += chunk.toString();
-        });
-        proc.stderr?.resume();
-        const timer = setTimeout(() => {
-          if (settled) return;
-          settled = true;
-          proc.kill("SIGKILL");
-          reject(new Error("timeout"));
-        }, 15e3);
-        timer.unref?.();
-        proc.on("close", (c) => {
-          if (settled) return;
-          settled = true;
-          clearTimeout(timer);
-          resolve16({ code: c, stdout: stdout2 });
-        });
-      }
-    );
-    const { code, stdout } = result;
-    if (code === 0 && stdout.trim()) {
-      const symbols = JSON.parse(stdout.trim());
-      return {
-        file,
-        lang: "rs",
-        symbols: symbols.map((s) => ({ ...s, id: 0, lang: "rs" })),
-        mtimeMs: Date.now()
-      };
-    }
-  } catch {
-  }
-  return null;
-}
 function regexParse(opts) {
   const { file, content, lang } = opts;
   const symbols = [];
@@ -6495,12 +6653,10 @@ function regexParse(opts) {
   });
   return { file, lang, symbols: deduped, mtimeMs: Date.now() };
 }
-var nativeParserAvailability, RS_PATTERNS;
+var RS_PATTERNS;
 var init_rs_parser = __esm({
   "src/codebase-index/rs-parser.ts"() {
     "use strict";
-    init_win32_resolve();
-    init_spawn_gate();
     init_languages2();
     RS_PATTERNS = [
       { regex: /fn\s+(\w+)\s*\([^)]*\)/g, kind: "function" },
@@ -7082,6 +7238,10 @@ async function acquireLock(lockfilePath, timeoutMs = 5e3) {
   const start = Date.now();
   const pidStr = String(process.pid);
   const hostStr = os2.hostname();
+  try {
+    await fs6.mkdir(path9.dirname(lockfilePath), { recursive: true });
+  } catch {
+  }
   while (Date.now() - start < timeoutMs) {
     try {
       await fs6.writeFile(lockfilePath, `${pidStr}:${hostStr}:${Date.now()}`, { flag: "wx" });
@@ -7747,6 +7907,16 @@ function parseKillCommand(command) {
   if (pgrepMatch) {
     return null;
   }
+  const posixScriptMatch = normalized.match(SCRIPT_KILL_RE_POSIX);
+  if (posixScriptMatch) {
+    return {
+      name: "kill-script",
+      signal: "FORCE",
+      isGroupKill: false,
+      isAllKill: false,
+      originalCommand: command
+    };
+  }
   return null;
 }
 async function getProtectedEntries() {
@@ -9940,7 +10110,7 @@ for (const tool of browserTools) tool.timeoutMs ??= 6e4;
 
 // src/codebase-index/project-server-client.ts
 import { spawn as spawn4 } from "node:child_process";
-import * as fs12 from "node:fs";
+import * as fs13 from "node:fs";
 import * as net3 from "node:net";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { checkUnixSocketPath } from "@wrongstack/core/utils";
@@ -10027,16 +10197,16 @@ var indexCircuitBreaker = new IndexCircuitBreaker();
 
 // src/codebase-index/project-server-endpoint.ts
 import { createHash as createHash4 } from "node:crypto";
-import * as fs11 from "node:fs";
+import * as fs12 from "node:fs";
 import * as os5 from "node:os";
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertUnixSocketPathWithinLimit } from "@wrongstack/core/utils";
 
 // src/codebase-index/writer.ts
 import { expectDefined as expectDefined2 } from "@wrongstack/core/utils";
-import * as fs10 from "node:fs";
-import * as path15 from "node:path";
+import * as fs11 from "node:fs";
+import * as path16 from "node:path";
 
 // src/codebase-index/bm25.ts
 var K1 = 1.5;
@@ -10127,6 +10297,9 @@ var Bm25Index = class {
   }
 };
 
+// src/codebase-index/writer.ts
+init_languages2();
+
 // src/codebase-index/lsp-kind.ts
 function lspKindToInternalKind(k) {
   switch (k) {
@@ -10161,7 +10334,7 @@ function lspKindToInternalKind(k) {
 }
 
 // src/codebase-index/schema.ts
-var SCHEMA_VERSION = 3;
+var SCHEMA_VERSION = 4;
 
 // src/codebase-index/sqlite-runtime.ts
 import { createRequire } from "node:module";
@@ -10232,7 +10405,7 @@ function runSqliteWithRetry(fn) {
 
 // src/codebase-index/writer-admin.ts
 import * as fs9 from "node:fs";
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 var DB_FILE = "index.db";
 function getAllIndexableWithStatement(stmt) {
   return stmt("SELECT id, text FROM symbols").all().map(({ id, text }) => ({ id, text }));
@@ -10291,7 +10464,7 @@ function getAllFileMetasWithStatement(stmt) {
 }
 function getIndexDbSizeBytes(indexDir) {
   try {
-    return fs9.statSync(path13.join(indexDir, DB_FILE)).size;
+    return fs9.statSync(path14.join(indexDir, DB_FILE)).size;
   } catch {
     return 0;
   }
@@ -10342,49 +10515,345 @@ function bulkInsertFtsWithStatement(stmt, maxSqlVars, ftsAvailable, rows) {
 }
 function bulkInsertRefsWithStatement(stmt, maxSqlVars, refs) {
   if (refs.length === 0) return;
-  const chunkSize = Math.max(1, Math.floor(maxSqlVars / 5));
+  const chunkSize = Math.max(1, Math.floor(maxSqlVars / 8));
   for (let i = 0; i < refs.length; i += chunkSize) {
     const chunk = refs.slice(i, i + chunkSize);
-    const placeholders = chunk.map(() => "(?, ?, ?, ?, ?)").join(", ");
+    const placeholders = chunk.map(() => "(?, ?, ?, ?, ?, ?, ?, ?)").join(", ");
     const insert = stmt(
-      `INSERT INTO refs(from_id, to_name, to_id, call_type, line) VALUES ${placeholders}`
+      `INSERT INTO refs(from_id, to_name, to_id, call_type, line, lang, module, to_file)
+       VALUES ${placeholders}`
     );
     const binds = [];
     for (const ref of chunk) {
-      binds.push(ref.fromId, ref.toName, ref.toId ?? null, ref.callType, ref.line);
+      binds.push(
+        ref.fromId,
+        ref.toName,
+        ref.toId ?? null,
+        ref.callType,
+        ref.line,
+        ref.lang ?? "",
+        ref.module ?? null,
+        ref.toFile ?? null
+      );
     }
     insert.run(...binds);
   }
 }
 
-// src/codebase-index/writer-graph-helpers.ts
-import * as path14 from "node:path";
-function derivePackage(filePath) {
-  const f = filePath.replace(/\\/g, "/");
-  const pkgsIdx = f.indexOf("/packages/");
-  if (pkgsIdx !== -1) {
-    const rest = f.slice(pkgsIdx + "/packages/".length);
-    const seg = rest.split("/")[0];
-    return seg ? `@wrongstack/${seg}` : void 0;
-  }
-  const appsIdx = f.indexOf("/apps/");
+// src/codebase-index/writer-graph-reader.ts
+init_languages2();
+
+// src/codebase-index/module-roots.ts
+init_languages2();
+import * as fs10 from "node:fs/promises";
+import * as path15 from "node:path";
+function toPortablePath(file) {
+  return file.replace(/\\/g, "/");
+}
+async function readTextIfPresent(file) {
+  try {
+    return await fs10.readFile(file, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function parsePackageJsonName(source) {
+  try {
+    const parsed = JSON.parse(source);
+    return typeof parsed.name === "string" && parsed.name ? parsed.name : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function parseGoModulePath(source) {
+  for (const rawLine of source.split(/\r?\n/)) {
+    const line = rawLine.replace(/\/\/.*$/, "").trim();
+    const match = /^module\s+(\S+)/.exec(line);
+    if (match?.[1]) return match[1].replace(/^["']|["']$/g, "");
+  }
+  return void 0;
+}
+function parseTomlTableName(source, tables) {
+  let current = "";
+  for (const rawLine of source.split(/\r?\n/)) {
+    const line = rawLine.replace(/#.*$/, "").trim();
+    if (line.startsWith("[[")) {
+      current = "\0";
+      continue;
+    }
+    const table = /^\[([^\]]+)\]$/.exec(line);
+    if (table?.[1]) {
+      current = table[1].trim();
+      continue;
+    }
+    if (!tables.includes(current)) continue;
+    const match = /^name\s*=\s*["']([^"']+)["']/.exec(line);
+    if (match?.[1]) return match[1];
+  }
+  return void 0;
+}
+function parsePomArtifactId(source) {
+  const withoutParent = source.replace(/<parent>[\s\S]*?<\/parent>/g, "");
+  return /<artifactId>\s*([^<\s]+)\s*<\/artifactId>/.exec(withoutParent)?.[1];
+}
+var LANGS_BY_KIND = {
+  npm: ["ts", "tsx", "js", "jsx", "vue", "svelte"],
+  cargo: ["rs"],
+  go: ["go"],
+  python: ["py"],
+  maven: ["java", "kotlin", "scala"],
+  gradle: ["java", "kotlin", "scala"],
+  dotnet: ["csharp"]
+};
+function ancestorsOf(dir, stopAt) {
+  const out = [];
+  let current = dir;
+  for (; ; ) {
+    out.push(current);
+    if (current === stopAt || current.length <= stopAt.length) break;
+    const parent = path15.posix.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return out;
+}
+var MARKER_PROBES = [
+  {
+    kind: "npm",
+    file: "package.json",
+    build: (dir, source) => {
+      const name = parsePackageJsonName(source) ?? path15.posix.basename(dir);
+      return { name, importPath: name, sourceRoots: [dir] };
+    }
+  },
+  {
+    kind: "cargo",
+    file: "Cargo.toml",
+    build: (dir, source) => {
+      const name = parseTomlTableName(source, ["package"]);
+      if (!name) return void 0;
+      return {
+        name: `crate:${name}`,
+        // Rust paths use underscores where crate names often use dashes.
+        importPath: name.replace(/-/g, "_"),
+        sourceRoots: [path15.posix.join(dir, "src")]
+      };
+    }
+  },
+  {
+    kind: "go",
+    file: "go.mod",
+    build: (dir, source) => {
+      const modulePath = parseGoModulePath(source);
+      if (!modulePath) return void 0;
+      return { name: `go:${modulePath}`, importPath: modulePath, sourceRoots: [dir] };
+    }
+  },
+  {
+    kind: "python",
+    file: "pyproject.toml",
+    build: (dir, source) => {
+      const name = parseTomlTableName(source, ["project", "tool.poetry"]) ?? path15.posix.basename(dir);
+      return {
+        name: `py:${name}`,
+        importPath: void 0,
+        // `src/` layout is the packaging-guide default; the root itself covers
+        // the flat layout. Both are probed, missing ones simply never match.
+        sourceRoots: [path15.posix.join(dir, "src"), dir]
+      };
+    }
+  },
+  {
+    kind: "python",
+    file: "setup.py",
+    build: (dir) => ({
+      name: `py:${path15.posix.basename(dir)}`,
+      importPath: void 0,
+      sourceRoots: [path15.posix.join(dir, "src"), dir]
+    })
+  },
+  {
+    kind: "maven",
+    file: "pom.xml",
+    build: (dir, source) => {
+      const artifactId = parsePomArtifactId(source) ?? path15.posix.basename(dir);
+      return {
+        name: `mvn:${artifactId}`,
+        importPath: void 0,
+        sourceRoots: [
+          path15.posix.join(dir, "src/main/java"),
+          path15.posix.join(dir, "src/main/kotlin"),
+          path15.posix.join(dir, "src/main/scala"),
+          path15.posix.join(dir, "src/test/java")
+        ]
+      };
+    }
+  },
+  {
+    kind: "gradle",
+    file: "build.gradle",
+    build: (dir) => buildGradleRoot(dir)
+  },
+  {
+    kind: "gradle",
+    file: "build.gradle.kts",
+    build: (dir) => buildGradleRoot(dir)
+  }
+];
+function buildGradleRoot(dir) {
+  return {
+    name: `gradle:${path15.posix.basename(dir)}`,
+    importPath: void 0,
+    sourceRoots: [
+      path15.posix.join(dir, "src/main/java"),
+      path15.posix.join(dir, "src/main/kotlin"),
+      path15.posix.join(dir, "src/main/scala")
+    ]
+  };
+}
+async function probeDotnetRoot(dir) {
+  let entries;
+  try {
+    entries = await fs10.readdir(dir);
+  } catch {
+    return void 0;
+  }
+  const project = entries.find((entry) => entry.toLowerCase().endsWith(".csproj"));
+  if (!project) return void 0;
+  const name = project.slice(0, -".csproj".length);
+  return {
+    dir,
+    kind: "dotnet",
+    name: `csproj:${name}`,
+    importPath: void 0,
+    sourceRoots: [dir]
+  };
+}
+async function detectModuleRoots(projectRoot, files) {
+  const root = toPortablePath(projectRoot).replace(/\/+$/, "");
+  const langsByDir = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const portable = toPortablePath(file);
+    const lang = detectLang(portable);
+    if (!lang) continue;
+    const dir = path15.posix.dirname(portable);
+    let langs = langsByDir.get(dir);
+    if (!langs) {
+      langs = /* @__PURE__ */ new Set();
+      langsByDir.set(dir, langs);
+    }
+    langs.add(lang);
+  }
+  const candidates = /* @__PURE__ */ new Map();
+  for (const [dir, langs] of langsByDir) {
+    for (const ancestor of ancestorsOf(dir, root)) {
+      let merged = candidates.get(ancestor);
+      if (!merged) {
+        merged = /* @__PURE__ */ new Set();
+        candidates.set(ancestor, merged);
+      }
+      for (const lang of langs) merged.add(lang);
+    }
+  }
+  const roots = [];
+  await Promise.all(
+    [...candidates].map(async ([dir, langs]) => {
+      for (const probe of MARKER_PROBES) {
+        if (!LANGS_BY_KIND[probe.kind].some((lang) => langs.has(lang))) continue;
+        const source = await readTextIfPresent(path15.posix.join(dir, probe.file));
+        if (source === void 0) continue;
+        const built = probe.build(dir, source);
+        if (built) roots.push({ dir, kind: probe.kind, ...built });
+      }
+      if (LANGS_BY_KIND.dotnet.some((lang) => langs.has(lang))) {
+        const dotnet = await probeDotnetRoot(dir);
+        if (dotnet) roots.push(dotnet);
+      }
+    })
+  );
+  roots.sort((a, b) => b.dir.length - a.dir.length || a.dir.localeCompare(b.dir));
+  return { projectRoot: root, roots };
+}
+function findOwningRoot(structure, file, kinds) {
+  const portable = toPortablePath(file);
+  for (const root of structure.roots) {
+    if (kinds && !kinds.includes(root.kind)) continue;
+    if (portable === root.dir || portable.startsWith(`${root.dir}/`)) return root;
+  }
+  return void 0;
+}
+function derivePackageFromLayout(filePath) {
+  const portable = toPortablePath(filePath);
+  const packagesIdx = portable.indexOf("/packages/");
+  if (packagesIdx !== -1) {
+    const segment = portable.slice(packagesIdx + "/packages/".length).split("/")[0];
+    if (segment) return `@wrongstack/${segment}`;
+  }
+  const appsIdx = portable.indexOf("/apps/");
   if (appsIdx !== -1) {
-    const rest = f.slice(appsIdx + "/apps/".length);
-    const seg = rest.split("/")[0];
-    return seg ? `app:${seg}` : void 0;
+    const segment = portable.slice(appsIdx + "/apps/".length).split("/")[0];
+    if (segment) return `app:${segment}`;
   }
   return void 0;
 }
-function packageFromImport(moduleName) {
-  if (!moduleName.startsWith("@wrongstack/")) return void 0;
-  const parts = moduleName.split("/");
-  return parts[1] ? `@wrongstack/${parts[1]}` : void 0;
+function pythonPackageLabel(structure, file, initDirs) {
+  const portable = toPortablePath(file);
+  const dir = path15.posix.dirname(portable);
+  if (!initDirs.has(dir)) return void 0;
+  const segments = [];
+  let current = dir;
+  while (initDirs.has(current) && current.length > structure.projectRoot.length) {
+    segments.unshift(path15.posix.basename(current));
+    current = path15.posix.dirname(current);
+  }
+  return segments.length > 0 ? `py:${segments.join(".")}` : void 0;
 }
-function buildPackageGraphNodes(fileCounts, files) {
+function assignPackageLabels(structure, files) {
+  const initDirs = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    const portable = toPortablePath(file);
+    if (path15.posix.basename(portable) === "__init__.py") {
+      initDirs.add(path15.posix.dirname(portable));
+    }
+  }
+  const labels = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const portable = toPortablePath(file);
+    const lang = detectLang(portable);
+    if (lang === "go") {
+      const owner3 = findOwningRoot(structure, portable, ["go"]);
+      const dir = path15.posix.dirname(portable);
+      if (owner3?.importPath) {
+        const relative12 = path15.posix.relative(owner3.dir, dir);
+        labels.set(file, relative12 ? `${owner3.importPath}/${relative12}` : owner3.importPath);
+      } else {
+        labels.set(file, `go:${path15.posix.relative(structure.projectRoot, dir) || "."}`);
+      }
+      continue;
+    }
+    if (lang === "py") {
+      const dotted = pythonPackageLabel(structure, portable, initDirs);
+      if (dotted) {
+        labels.set(file, dotted);
+        continue;
+      }
+    }
+    const owner2 = findOwningRoot(structure, portable);
+    const label = owner2?.name ?? derivePackageFromLayout(portable) ?? "(root)";
+    labels.set(file, label);
+  }
+  return labels;
+}
+
+// src/codebase-index/writer-graph-helpers.ts
+function createPackageLabeller(stored) {
+  return (file) => stored.get(file) ?? derivePackageFromLayout(file) ?? "(root)";
+}
+function buildPackageGraphNodes(fileCounts, files, packageOf) {
   const pkgNodes = /* @__PURE__ */ new Map();
   const fileToPkg = /* @__PURE__ */ new Map();
   for (const { file, n } of fileCounts) {
-    const pkg = derivePackage(file) ?? "(root)";
+    const pkg = packageOf(file);
     fileToPkg.set(file, pkg);
     const node = pkgNodes.get(pkg);
     if (node) {
@@ -10401,7 +10870,7 @@ function buildPackageGraphNodes(fileCounts, files) {
     }
   }
   for (const { file } of files) {
-    const pkg = derivePackage(file) ?? "(root)";
+    const pkg = packageOf(file);
     fileToPkg.set(file, pkg);
     const node = pkgNodes.get(pkg);
     if (node) {
@@ -10419,7 +10888,7 @@ function buildPackageGraphNodes(fileCounts, files) {
   }
   return { pkgNodes, fileToPkg };
 }
-function buildFileGraphNodeState(pkgSyms, localFiles) {
+function buildFileGraphNodeState(pkgSyms, localFiles, packageOf) {
   const fileNodes = /* @__PURE__ */ new Map();
   const symToFile = /* @__PURE__ */ new Map();
   const fileStats = /* @__PURE__ */ new Map();
@@ -10438,7 +10907,7 @@ function buildFileGraphNodeState(pkgSyms, localFiles) {
       id: `file:${file}`,
       label: file.replace(/\\/g, "/").split("/").pop() ?? file,
       kind: "file",
-      package: derivePackage(file) ?? "(root)",
+      package: packageOf(file),
       file,
       symbolCount: stats?.count ?? 0,
       lang: stats?.lang,
@@ -10450,7 +10919,7 @@ function buildFileGraphNodeState(pkgSyms, localFiles) {
   }
   return { fileNodes, symToFile, fileStats, ensureFileNode };
 }
-function buildSymbolGraphNodes(symById, relatedIds, fileFilter) {
+function buildSymbolGraphNodes(symById, relatedIds, fileFilter, packageOf) {
   return [...relatedIds].map((id) => symById.get(id)).filter((symbol) => symbol !== void 0).sort((a, b) => {
     const aExternal = a.file === fileFilter ? 0 : 1;
     const bExternal = b.file === fileFilter ? 0 : 1;
@@ -10462,7 +10931,7 @@ function buildSymbolGraphNodes(symById, relatedIds, fileFilter) {
     symbolId: s.id,
     symbolKind: s.kind,
     file: s.file,
-    package: derivePackage(s.file) ?? "(root)",
+    package: packageOf(s.file),
     lang: s.lang,
     line: s.line,
     signature: s.signature,
@@ -10470,29 +10939,6 @@ function buildSymbolGraphNodes(symById, relatedIds, fileFilter) {
     external: s.file !== fileFilter
   }));
 }
-function resolveRelativeImport(fromFile, moduleName, indexedFiles) {
-  if (!moduleName.startsWith(".")) return void 0;
-  const normalizedFrom = fromFile.replace(/\\/g, "/");
-  const absolute = path14.posix.normalize(
-    path14.posix.join(path14.posix.dirname(normalizedFrom), moduleName)
-  );
-  const extension = path14.posix.extname(absolute);
-  const base = extension ? absolute.slice(0, -extension.length) : absolute;
-  const candidates = [
-    absolute,
-    ...[".ts", ".tsx", ".js", ".jsx", ".mts", ".cts"].map((ext) => `${base}${ext}`),
-    ...[".ts", ".tsx", ".js", ".jsx"].map((ext) => path14.posix.join(absolute, `index${ext}`)),
-    ...[".ts", ".tsx", ".js", ".jsx"].map((ext) => path14.posix.join(base, `index${ext}`))
-  ];
-  const indexedByPortablePath = new Map(
-    [...indexedFiles].map((file) => [file.replace(/\\/g, "/").toLocaleLowerCase(), file])
-  );
-  for (const candidate of candidates) {
-    const indexed = indexedByPortablePath.get(candidate.toLocaleLowerCase());
-    if (indexed) return indexed;
-  }
-  return void 0;
-}
 function addWeightedEdge(edgeMap, source, target, callType, weight) {
   const key = `${source}\0${target}`;
   let edge = edgeMap.get(key);
@@ -10533,11 +10979,146 @@ function mapWriterRefRow(row) {
     toName: row.to_name,
     toId: row.to_id ?? void 0,
     callType: row.call_type,
-    line: row.line
+    line: row.line,
+    // `lang`/`module`/`to_file` are absent from the narrower column lists some
+    // queries select; `undefined` keeps those rows valid Refs.
+    lang: row.lang || void 0,
+    module: row.module ?? void 0,
+    toFile: row.to_file ?? void 0
   };
 }
 
 // src/codebase-index/writer-graph-reader.ts
+var MAX_SQL_VARS = 900;
+function chunkedIdQuery(stmt, ids, buildSql, extraArgs = []) {
+  const results = [];
+  for (let start = 0; start < ids.length; start += MAX_SQL_VARS) {
+    const chunk = ids.slice(start, start + MAX_SQL_VARS);
+    const placeholders = chunk.map(() => "?").join(",");
+    const sql = buildSql(placeholders);
+    results.push(...stmt(sql).all(...chunk, ...extraArgs));
+  }
+  return results;
+}
+function chunkedIdScalar(stmt, ids, buildSql, extraArgs = []) {
+  let total = 0;
+  for (let start = 0; start < ids.length; start += MAX_SQL_VARS) {
+    const chunk = ids.slice(start, start + MAX_SQL_VARS);
+    const placeholders = chunk.map(() => "?").join(",");
+    const sql = buildSql(placeholders);
+    const rows = stmt(sql).all(...chunk, ...extraArgs);
+    total += rows[0]?.n ?? 0;
+  }
+  return total;
+}
+function mapCallSiteRow(row) {
+  return {
+    symbol: {
+      id: row.sym_id,
+      name: row.sym_name,
+      kind: row.sym_kind,
+      lang: row.sym_lang,
+      file: row.sym_file,
+      line: row.sym_line,
+      signature: row.sym_signature
+    },
+    callType: row.call_type,
+    line: row.ref_line
+  };
+}
+function resolveSymbolIds(stmt, symbolName, file) {
+  const baseSql = file ? `SELECT id FROM symbols WHERE name = ? AND file = ? ORDER BY id` : `SELECT id FROM symbols WHERE name = ? ORDER BY id`;
+  const args = file ? [symbolName, file] : [symbolName];
+  const rows = stmt(baseSql).all(...args);
+  return rows.map((r) => r.id);
+}
+function findIncomingCallsByName(stmt, symbolName, file, limit) {
+  const targetIds = resolveSymbolIds(stmt, symbolName, file);
+  if (targetIds.length === 0) return { calls: [], symbolFound: false, ambiguous: false, totalMatches: 0 };
+  let matchIds = targetIds;
+  let ambiguous = false;
+  if (file !== void 0) {
+    const allNamedIds = resolveSymbolIds(stmt, symbolName, void 0);
+    if (allNamedIds.length > targetIds.length) {
+      matchIds = allNamedIds;
+      ambiguous = true;
+    }
+  }
+  const useFallback = !file;
+  const rows = chunkedIdQuery(
+    stmt,
+    matchIds,
+    (ph) => `SELECT
+         s.id   AS sym_id,
+         s.name AS sym_name,
+         s.kind AS sym_kind,
+         s.lang AS sym_lang,
+         s.file AS sym_file,
+         s.line AS sym_line,
+         s.signature AS sym_signature,
+         r.call_type,
+         r.line AS ref_line
+       FROM refs r
+       JOIN symbols s ON s.id = r.from_id
+       WHERE r.to_id IN (${ph})
+       ORDER BY r.line, r.id`,
+    []
+  );
+  if (useFallback) {
+    const fallbackRows = stmt(
+      `SELECT
+         s.id   AS sym_id,
+         s.name AS sym_name,
+         s.kind AS sym_kind,
+         s.lang AS sym_lang,
+         s.file AS sym_file,
+         s.line AS sym_line,
+         s.signature AS sym_signature,
+         r.call_type,
+         r.line AS ref_line
+       FROM refs r
+       JOIN symbols s ON s.id = r.from_id
+       WHERE r.to_id IS NULL AND r.to_name = ?
+       ORDER BY r.line, r.id`
+    ).all(symbolName);
+    rows.push(...fallbackRows);
+  }
+  rows.sort((a, b) => a.ref_line - b.ref_line || a.sym_id - b.sym_id);
+  const allCalls = rows.map(mapCallSiteRow);
+  return { calls: allCalls.slice(0, limit), symbolFound: true, ambiguous, totalMatches: allCalls.length };
+}
+function findOutgoingCallsByName(stmt, symbolName, file, limit) {
+  const sourceIds = resolveSymbolIds(stmt, symbolName, file);
+  if (sourceIds.length === 0) return { calls: [], symbolFound: false, unresolvedCount: 0, totalMatches: 0 };
+  const unresolvedCount = chunkedIdScalar(
+    stmt,
+    sourceIds,
+    (ph) => `SELECT COUNT(*) AS n FROM refs WHERE from_id IN (${ph}) AND to_id IS NULL`
+  );
+  const rows = chunkedIdQuery(
+    stmt,
+    sourceIds,
+    (ph) => `SELECT
+         s.id   AS sym_id,
+         s.name AS sym_name,
+         s.kind AS sym_kind,
+         s.lang AS sym_lang,
+         s.file AS sym_file,
+         s.line AS sym_line,
+         s.signature AS sym_signature,
+         r.call_type,
+         r.line AS ref_line
+       FROM refs r
+       JOIN symbols s ON s.id = r.to_id
+       WHERE r.from_id IN (${ph})
+         AND r.to_id IS NOT NULL  -- INNER JOIN already excludes NULL to_id; this is defensive belt-and-suspenders
+       ORDER BY r.line, r.id`,
+    []
+  );
+  rows.sort((a, b) => a.ref_line - b.ref_line || a.sym_id - b.sym_id);
+  const calls = rows.map(mapCallSiteRow).slice(0, limit);
+  return { calls, symbolFound: true, unresolvedCount, totalMatches: rows.length };
+}
 function findRefsToWithStatement(stmt, symbolId) {
   return stmt(
     "SELECT id, from_id, to_name, to_id, call_type, line FROM refs WHERE to_id = ? OR to_name = (SELECT name FROM symbols WHERE id = ?)"
@@ -10551,7 +11132,8 @@ function findRefsFromWithStatement(stmt, symbolId) {
 function getPackageGraphWithStatement(stmt) {
   const fileCounts = stmt("SELECT file, COUNT(*) AS n FROM symbols GROUP BY file").all();
   const files = stmt("SELECT DISTINCT file FROM files").all();
-  const { pkgNodes, fileToPkg } = buildPackageGraphNodes(fileCounts, files);
+  const packageOf = readPackageLabeller(stmt);
+  const { pkgNodes, fileToPkg } = buildPackageGraphNodes(fileCounts, files, packageOf);
   const refRows = stmt(
     `SELECT r.call_type, sf.file AS from_file, st.file AS to_file, COUNT(*) AS n
        FROM refs r
@@ -10562,32 +11144,42 @@ function getPackageGraphWithStatement(stmt) {
   ).all();
   const edgeMap = /* @__PURE__ */ new Map();
   for (const r of refRows) {
-    const fromPkg = fileToPkg.get(r.from_file) ?? derivePackage(r.from_file) ?? "(root)";
-    const toPkg = fileToPkg.get(r.to_file) ?? derivePackage(r.to_file) ?? "(root)";
+    const fromPkg = fileToPkg.get(r.from_file) ?? packageOf(r.from_file);
+    const toPkg = fileToPkg.get(r.to_file) ?? packageOf(r.to_file);
     if (fromPkg === toPkg) continue;
     const n = Number(r.n) || 0;
     addWeightedEdge(edgeMap, fromPkg, toPkg, r.call_type, n);
   }
   const importRows = stmt(
-    `SELECT r.to_name, s.file AS from_file, COUNT(*) AS n
+    `SELECT s.file AS from_file,
+            COALESCE(r.to_file, st.file) AS to_file,
+            COUNT(*) AS n
        FROM refs r
        JOIN symbols s ON s.id = r.from_id
+       LEFT JOIN symbols st ON st.id = r.to_id
        WHERE r.call_type = 'import'
-       GROUP BY r.to_name, s.file`
+         AND COALESCE(r.to_file, st.file) IS NOT NULL
+       GROUP BY s.file, COALESCE(r.to_file, st.file)`
   ).all();
   for (const r of importRows) {
-    const fromPkg = fileToPkg.get(r.from_file) ?? derivePackage(r.from_file) ?? "(root)";
-    const toPkg = packageFromImport(r.to_name);
-    if (!fromPkg || !toPkg || fromPkg === toPkg || !pkgNodes.has(toPkg)) continue;
+    const fromPkg = fileToPkg.get(r.from_file) ?? packageOf(r.from_file);
+    const toPkg = fileToPkg.get(r.to_file) ?? packageOf(r.to_file);
+    if (fromPkg === toPkg || !pkgNodes.has(toPkg)) continue;
     const n = Number(r.n) || 0;
     addWeightedEdge(edgeMap, fromPkg, toPkg, "import", n);
   }
   const edges = materializeWeightedEdges(edgeMap, "pkg");
   return { nodes: [...pkgNodes.values()], edges };
 }
+function readPackageLabeller(stmt) {
+  const rows = stmt("SELECT file, package FROM files WHERE package != ''").all();
+  return createPackageLabeller(new Map(rows.map((row) => [row.file, row.package])));
+}
 function getFileGraphWithStatement(stmt, packageFilter) {
   const allFiles = stmt("SELECT DISTINCT file FROM symbols").all();
-  const pkgFilePaths = allFiles.filter((f) => (derivePackage(f.file) ?? "(root)") === packageFilter).map((f) => f.file);
+  const packageOf = readPackageLabeller(stmt);
+  const langOf = (file) => detectLang(file) ?? "other";
+  const pkgFilePaths = allFiles.filter((f) => packageOf(f.file) === packageFilter).map((f) => f.file);
   const localFiles = new Set(pkgFilePaths);
   if (localFiles.size === 0) return { nodes: [], edges: [] };
   const filePlaceholders = [...localFiles].map(() => "?").join(",");
@@ -10596,9 +11188,9 @@ function getFileGraphWithStatement(stmt, packageFilter) {
   ).all(...pkgFilePaths);
   const { fileNodes, symToFile, fileStats, ensureFileNode } = buildFileGraphNodeState(
     pkgSyms,
-    localFiles
+    localFiles,
+    packageOf
   );
-  const indexedFiles = new Set(allFiles.map((f) => f.file));
   const refRows = stmt(
     `SELECT r.from_id, r.to_id, r.call_type, COUNT(*) AS n
        FROM refs r
@@ -10621,7 +11213,7 @@ function getFileGraphWithStatement(stmt, packageFilter) {
     for (const x of extras) {
       symToFile.set(x.id, x.file);
       if (!fileStats.has(x.file)) {
-        fileStats.set(x.file, { count: 0, lang: "ts" });
+        fileStats.set(x.file, { count: 0, lang: langOf(x.file) });
       }
     }
   }
@@ -10638,17 +11230,22 @@ function getFileGraphWithStatement(stmt, packageFilter) {
     addWeightedEdge(edgeMap, fromFile, toFile, r.call_type, n);
   }
   const importRows = stmt(
-    `SELECT r.from_id, r.to_name, COUNT(*) AS n
+    `SELECT r.from_id, COALESCE(r.to_file, st.file) AS to_file, COUNT(*) AS n
        FROM refs r
+       LEFT JOIN symbols st ON st.id = r.to_id
        WHERE r.call_type = 'import'
+         AND COALESCE(r.to_file, st.file) IS NOT NULL
          AND r.from_id IN (SELECT id FROM symbols WHERE file IN (${filePlaceholders}))
-       GROUP BY r.from_id, r.to_name`
+       GROUP BY r.from_id, COALESCE(r.to_file, st.file)`
   ).all(...pkgFilePaths);
   for (const r of importRows) {
     const fromFile = symToFile.get(r.from_id);
     if (!fromFile || !localFiles.has(fromFile)) continue;
-    const toFile = resolveRelativeImport(fromFile, r.to_name, indexedFiles);
+    const toFile = r.to_file;
     if (!toFile || fromFile === toFile) continue;
+    if (!fileStats.has(toFile)) {
+      fileStats.set(toFile, { count: 0, lang: langOf(toFile) });
+    }
     ensureFileNode(fromFile);
     ensureFileNode(toFile);
     const n = Number(r.n) || 0;
@@ -10698,7 +11295,7 @@ function getSymbolGraphWithStatement(stmt, fileFilter) {
     ).all(...missingIds);
     for (const s of extras) symById.set(s.id, s);
   }
-  const nodes = buildSymbolGraphNodes(symById, relatedIds, fileFilter);
+  const nodes = buildSymbolGraphNodes(symById, relatedIds, fileFilter, readPackageLabeller(stmt));
   return { nodes, edges };
 }
 
@@ -10720,7 +11317,7 @@ function assignRefsToSymbols(refs, symbols) {
     }
     if (!owner2 && ref.callType === "import") owner2 = ordered[0];
     if (!owner2 || owner2.id <= 0) continue;
-    const key = `${owner2.id}:${ref.toName}:${ref.callType}`;
+    const key = `${owner2.id}:${ref.toName}:${ref.callType}:${ref.module ?? ""}`;
     if (seen.has(key)) continue;
     seen.add(key);
     assigned.push({ ...ref, fromId: owner2.id });
@@ -10766,7 +11363,11 @@ var CORE_TABLES_SQL = `
     lang TEXT NOT NULL,
     mtime_ms INTEGER NOT NULL,
     symbol_count INTEGER NOT NULL DEFAULT 0,
-    last_indexed INTEGER NOT NULL
+    last_indexed INTEGER NOT NULL,
+    -- Code Atlas grouping label, computed at index time from the ecosystem's
+    -- own manifests (package.json, go.mod, Cargo.toml, \u2026). Stored rather than
+    -- re-derived per query because the evidence lives on disk, not in the DB.
+    package TEXT NOT NULL DEFAULT ''
   );
   CREATE TABLE IF NOT EXISTS symbols (
     id INTEGER PRIMARY KEY,
@@ -10783,6 +11384,9 @@ var CORE_TABLES_SQL = `
     file_fk TEXT NOT NULL
   );
 `;
+var FILE_INDEX_SQL = [
+  "CREATE INDEX IF NOT EXISTS idx_f_package ON files(package)"
+];
 var SYMBOL_INDEX_SQL = [
   "CREATE INDEX IF NOT EXISTS idx_s_name ON symbols(name)",
   "CREATE INDEX IF NOT EXISTS idx_s_kind ON symbols(kind)",
@@ -10799,15 +11403,32 @@ var REFS_TABLE_SQL = `
     to_name TEXT NOT NULL,
     to_id INTEGER,
     call_type TEXT NOT NULL,
-    line INTEGER NOT NULL
+    line INTEGER NOT NULL,
+    lang TEXT NOT NULL DEFAULT '',
+    module TEXT,
+    to_file TEXT
   );
 `;
 var REFS_INDEX_SQL = [
   "CREATE INDEX IF NOT EXISTS idx_r_from ON refs(from_id)",
   "CREATE INDEX IF NOT EXISTS idx_r_to_id ON refs(to_id)",
   "CREATE INDEX IF NOT EXISTS idx_r_to_name ON refs(to_name)",
-  "CREATE INDEX IF NOT EXISTS idx_r_call_type ON refs(call_type)"
+  "CREATE INDEX IF NOT EXISTS idx_r_call_type ON refs(call_type)",
+  // Name resolution matches (to_name, lang) pairs; the composite keeps the
+  // language-scoped UPDATE from degrading into a scan of every same-named row.
+  "CREATE INDEX IF NOT EXISTS idx_r_to_name_lang ON refs(to_name, lang)",
+  // The post-index module resolution pass groups unresolved import refs by
+  // (module, lang); graph readers then read to_file back.
+  "CREATE INDEX IF NOT EXISTS idx_r_module ON refs(module)",
+  "CREATE INDEX IF NOT EXISTS idx_r_to_file ON refs(to_file)"
 ];
+var LANG_FAMILY_TABLE_SQL = `
+  CREATE TABLE IF NOT EXISTS lang_family (
+    lang TEXT PRIMARY KEY,
+    family TEXT NOT NULL
+  );
+`;
+var LANG_FAMILY_WILDCARD = "*";
 var SYMBOLS_FTS_SQL = "CREATE VIRTUAL TABLE IF NOT EXISTS symbols_fts USING fts5(text, tokenize = 'unicode61')";
 
 // src/codebase-index/writer-search-helpers.ts
@@ -11019,15 +11640,69 @@ var IndexStore = class _IndexStore {
   }
   constructor(projectRoot, opts = {}) {
     this.indexDir = resolveIndexDir(projectRoot, opts.indexDir);
-    fs10.mkdirSync(this.indexDir, { recursive: true });
+    fs11.mkdirSync(this.indexDir, { recursive: true });
     const Database = loadDatabaseSync();
-    this.db = new Database(path15.join(this.indexDir, DB_FILE2));
+    this.db = new Database(path16.join(this.indexDir, DB_FILE2));
     applyIndexStorePragmas(this.db);
     this.initSchema();
   }
   runWithRetry(fn) {
     return runSqliteWithRetry(fn);
   }
+  /**
+   * Mirror the in-process language→family map into SQLite.
+   *
+   * Rewritten on every open rather than only on schema bumps: the mapping is
+   * static lookup data, so a code-side change (a new language, a language
+   * moving families) must take effect without forcing a full reindex.
+   */
+  seedLangFamilies() {
+    const insert = this.stmt("INSERT OR REPLACE INTO lang_family(lang, family) VALUES (?, ?)");
+    for (const [lang, family] of LANG_FAMILY_ENTRIES) insert.run(lang, family);
+    insert.run("", LANG_FAMILY_WILDCARD);
+  }
+  /**
+   * Add any column the current schema expects but the on-disk table lacks.
+   *
+   * `CREATE TABLE IF NOT EXISTS` silently keeps an existing table's old shape,
+   * and the version check above only rebuilds on a version *mismatch*. That
+   * leaves a real gap: several wstack processes share this database, and while
+   * a version upgrade is rolling out one of them may still be running the
+   * previous build. That older process sees the newer version number, drops the
+   * tables, and recreates them from *its* DDL — without the newer columns —
+   * while the metadata row still reads the new version. Every later query for
+   * one of those columns then fails with `no such column`, and no amount of
+   * reindexing fixes it, because the version numbers already agree.
+   *
+   * Repairing column-by-column makes the schema self-healing from any of those
+   * states. Table and column names are compile-time literals from this module,
+   * never user input.
+   */
+  repairMissingColumns() {
+    const expected = [
+      { table: "files", columns: [["package", "TEXT NOT NULL DEFAULT ''"]] },
+      {
+        table: "refs",
+        columns: [
+          ["lang", "TEXT NOT NULL DEFAULT ''"],
+          ["module", "TEXT"],
+          ["to_file", "TEXT"]
+        ]
+      }
+    ];
+    for (const { table, columns } of expected) {
+      const present = new Set(
+        this.db.prepare(`PRAGMA table_info(${table})`).all().flatMap(
+          (row) => typeof row.name === "string" ? [row.name] : []
+        )
+      );
+      if (present.size === 0) continue;
+      for (const [name, type] of columns) {
+        if (present.has(name)) continue;
+        this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${name} ${type}`);
+      }
+    }
+  }
   initSchema() {
     this.db.exec(METADATA_TABLE_SQL);
     const storedRows = this.stmt("SELECT value FROM metadata WHERE key = ?").all("version");
@@ -11050,9 +11725,13 @@ var IndexStore = class _IndexStore {
       );
     }
     this.db.exec(CORE_TABLES_SQL);
-    for (const sql of SYMBOL_INDEX_SQL) this.db.exec(sql);
     this.db.exec(REFS_TABLE_SQL);
+    this.repairMissingColumns();
+    for (const sql of FILE_INDEX_SQL) this.db.exec(sql);
+    for (const sql of SYMBOL_INDEX_SQL) this.db.exec(sql);
     for (const sql of REFS_INDEX_SQL) this.db.exec(sql);
+    this.db.exec(LANG_FAMILY_TABLE_SQL);
+    this.seedLangFamilies();
     try {
       this.db.exec(SYMBOLS_FTS_SQL);
       this.ftsAvailable = true;
@@ -11087,6 +11766,18 @@ var IndexStore = class _IndexStore {
   static NEXT_SYMBOL_ID_KEY = "next_symbol_id";
   /** Stay under typical SQLite SQLITE_MAX_VARIABLE_NUMBER (often 999). */
   static MAX_SQL_VARS = 900;
+  /**
+   * Correlated predicate: the ref in `refs` and the candidate symbol aliased
+   * `sym` belong to the same language family — or the ref carries no language,
+   * in which case the wildcard bind matches everything.
+   *
+   * Each textual occurrence consumes one `?` bind of {@link LANG_FAMILY_WILDCARD}.
+   */
+  static FAMILY_MATCH_SQL = `(
+    (SELECT family FROM lang_family WHERE lang = refs.lang) = ?
+    OR (SELECT family FROM lang_family WHERE lang = sym.lang)
+       = (SELECT family FROM lang_family WHERE lang = refs.lang)
+  )`;
   /**
    * Ensure `metadata.next_symbol_id` exists. Safe to call outside a write
    * transaction on open; the first concurrent writer under BEGIN IMMEDIATE
@@ -11150,9 +11841,12 @@ var IndexStore = class _IndexStore {
       const placeholders = chunk.map(() => "?").join(",");
       const result = this.stmt(
         `UPDATE refs
-         SET to_id = (SELECT MIN(id) FROM symbols WHERE name = refs.to_name)
+         SET to_id = (
+           SELECT MIN(sym.id) FROM symbols sym
+            WHERE sym.name = refs.to_name AND ${_IndexStore.FAMILY_MATCH_SQL}
+         )
          WHERE to_name IN (${placeholders})`
-      ).run(...chunk);
+      ).run(LANG_FAMILY_WILDCARD, ...chunk);
       changes += result.changes ?? 0;
     }
     return changes;
@@ -11279,6 +11973,115 @@ var IndexStore = class _IndexStore {
   getAllFileMetas() {
     return getAllFileMetasWithStatement((sql) => this.stmt(sql));
   }
+  // ─── Project structure & module resolution ──────────────────────────────────
+  /** Store the Code Atlas grouping label for each indexed file. */
+  setFilePackages(entries) {
+    if (entries.size === 0) return;
+    this.runWithRetry(() => {
+      const update = this.stmt("UPDATE files SET package = ? WHERE file = ?");
+      for (const [file, label] of entries) update.run(label, file);
+    });
+  }
+  /**
+   * Every indexed `namespace`/`module` declaration, for ecosystems whose import
+   * specifiers name a namespace rather than a path (C#, PHP, Elixir, Haskell).
+   * Ordered so the resolver's choice among duplicate declarations is stable.
+   */
+  getNamespaceDeclarations() {
+    return this.stmt(
+      `SELECT name, file FROM symbols WHERE kind = 'namespace' ORDER BY file, id`
+    ).all();
+  }
+  /** `file → package` for every indexed file that has a label. */
+  getFilePackages() {
+    const rows = this.stmt("SELECT file, package FROM files WHERE package != ''").all();
+    return new Map(rows.map((row) => [row.file, row.package]));
+  }
+  /**
+   * Distinct `(fromFile, lang, module)` triples needing module resolution.
+   *
+   * Distinct rather than per-ref because resolution depends only on these three
+   * values: a file importing the same module twenty times resolves it once.
+   */
+  getUnresolvedImports(onlyFiles) {
+    const base = `SELECT DISTINCT s.file AS fromFile, r.lang AS lang, r.module AS module
+                    FROM refs r
+                    JOIN symbols s ON s.id = r.from_id
+                   WHERE r.call_type = 'import' AND r.module IS NOT NULL`;
+    if (!onlyFiles?.length) {
+      return this.stmt(base).all();
+    }
+    const out = [];
+    for (let i = 0; i < onlyFiles.length; i += _IndexStore.MAX_SQL_VARS) {
+      const chunk = onlyFiles.slice(i, i + _IndexStore.MAX_SQL_VARS);
+      const placeholders = chunk.map(() => "?").join(",");
+      out.push(
+        ...this.stmt(`${base} AND s.file IN (${placeholders})`).all(...chunk)
+      );
+    }
+    return out;
+  }
+  /**
+   * Write resolved import targets back onto `refs.to_file`.
+   *
+   * Applied through a temp table and a single UPDATE: one statement per
+   * resolution would mean thousands of round-trips on a first index.
+   */
+  applyImportResolutions(resolutions) {
+    if (resolutions.length === 0) return 0;
+    return this.runWithRetry(() => {
+      this.db.exec("DROP TABLE IF EXISTS temp.import_resolution");
+      this.db.exec(
+        `CREATE TEMP TABLE import_resolution (
+           from_file TEXT NOT NULL,
+           lang TEXT NOT NULL,
+           module TEXT NOT NULL,
+           to_file TEXT NOT NULL
+         )`
+      );
+      const chunkSize = Math.max(1, Math.floor(_IndexStore.MAX_SQL_VARS / 4));
+      for (let i = 0; i < resolutions.length; i += chunkSize) {
+        const chunk = resolutions.slice(i, i + chunkSize);
+        const placeholders = chunk.map(() => "(?, ?, ?, ?)").join(", ");
+        const binds = [];
+        for (const entry of chunk) {
+          binds.push(entry.fromFile, entry.lang, entry.module, entry.toFile);
+        }
+        this.stmt(
+          `INSERT INTO temp.import_resolution(from_file, lang, module, to_file)
+           VALUES ${placeholders}`
+        ).run(...binds);
+      }
+      this.db.exec(
+        `CREATE INDEX IF NOT EXISTS temp.idx_ir
+           ON import_resolution(module, lang, from_file)`
+      );
+      const result = this.stmt(
+        `UPDATE refs
+            SET to_file = (
+              SELECT ir.to_file
+                FROM temp.import_resolution ir
+                JOIN symbols s ON s.id = refs.from_id
+               WHERE ir.module = refs.module
+                 AND ir.lang = refs.lang
+                 AND ir.from_file = s.file
+               LIMIT 1
+            )
+          WHERE refs.call_type = 'import'
+            AND refs.module IS NOT NULL
+            AND EXISTS (
+              SELECT 1
+                FROM temp.import_resolution ir
+                JOIN symbols s ON s.id = refs.from_id
+               WHERE ir.module = refs.module
+                 AND ir.lang = refs.lang
+                 AND ir.from_file = s.file
+            )`
+      ).run();
+      this.db.exec("DROP TABLE IF EXISTS temp.import_resolution");
+      return result.changes ?? 0;
+    });
+  }
   // ─── Search ──────────────────────────────────────────────────────────────────
   search(query, filter, opts) {
     const built = this.buildSearchWhere(query, filter);
@@ -11665,9 +12468,12 @@ var IndexStore = class _IndexStore {
    * Resolve `to_name` → `to_id` for all refs that have a name but no id.
    * Call this after all symbols have been inserted to fill in cross-references.
    *
-   * Single statement: the `to_name IN (SELECT name FROM symbols)` guard restricts
-   * the UPDATE to refs that will actually resolve, so `.changes` counts only refs
-   * that found a target — matching the previous per-row loop's return value.
+   * A match additionally requires the referencing ref and the target symbol to
+   * be in the same {@link LangFamily}. Without that guard a name match is a
+   * cross-language accident waiting to happen — `main`, `New`, `Parse` and
+   * `Config` are declared in most languages at once, and each collision draws a
+   * Code Atlas edge between files that never reference each other. Refs stored
+   * without a language keep the old global behaviour via the `'*'` wildcard row.
    */
   resolveRefs() {
     return this.runWithRetry(() => {
@@ -11676,20 +12482,35 @@ var IndexStore = class _IndexStore {
           `UPDATE refs
            SET to_id = s.id
            FROM (
-             SELECT name, MIN(id) AS id FROM symbols GROUP BY name
-           ) AS s
+                 SELECT sym.name AS name, lf.family AS family, MIN(sym.id) AS id
+                   FROM symbols sym
+                   JOIN lang_family lf ON lf.lang = sym.lang
+                  GROUP BY sym.name, lf.family
+                 UNION ALL
+                 SELECT sym.name AS name, '${LANG_FAMILY_WILDCARD}' AS family, MIN(sym.id) AS id
+                   FROM symbols sym
+                  GROUP BY sym.name
+               ) AS s,
+               lang_family AS rf
            WHERE refs.to_id IS NULL
              AND refs.to_name IS NOT NULL
-             AND refs.to_name = s.name`
+             AND rf.lang = refs.lang
+             AND s.name = refs.to_name
+             AND s.family = rf.family`
         ).run();
         return result.changes ?? 0;
       } catch {
         const result = this.stmt(
           `UPDATE refs SET to_id = (
-             SELECT id FROM symbols WHERE name = refs.to_name LIMIT 1
+             SELECT sym.id FROM symbols sym
+              WHERE sym.name = refs.to_name AND ${_IndexStore.FAMILY_MATCH_SQL}
+              ORDER BY sym.id LIMIT 1
            ) WHERE to_id IS NULL AND to_name IS NOT NULL
-             AND to_name IN (SELECT name FROM symbols)`
-        ).run();
+             AND EXISTS (
+               SELECT 1 FROM symbols sym
+                WHERE sym.name = refs.to_name AND ${_IndexStore.FAMILY_MATCH_SQL}
+             )`
+        ).run(LANG_FAMILY_WILDCARD, LANG_FAMILY_WILDCARD);
         return result.changes ?? 0;
       }
     });
@@ -11773,6 +12594,20 @@ var IndexStore = class _IndexStore {
       return false;
     }
   }
+  /**
+   * Find all symbols that reference the named target symbol (incoming callers).
+   * Accepts a name instead of an id so the agent doesn't need a prior lookup.
+   */
+  findIncomingCallsByName(symbolName, file, limit = 100) {
+    return findIncomingCallsByName((sql) => this.stmt(sql), symbolName, file, limit);
+  }
+  /**
+   * Find all symbols that the named source symbol references (outgoing callees).
+   * Accepts a name instead of an id so the agent doesn't need a prior lookup.
+   */
+  findOutgoingCallsByName(symbolName, file, limit = 100) {
+    return findOutgoingCallsByName((sql) => this.stmt(sql), symbolName, file, limit);
+  }
   /**
    * Find all references TO a given symbol (who calls / uses this symbol?).
    */
@@ -11864,21 +12699,21 @@ var PROJECT_INDEX_SERVER_METADATA_FILE = "server.json";
 var PROJECT_INDEX_SERVER_SOCKET_DIR = `wsci-v${PROJECT_INDEX_SERVER_PROTOCOL_VERSION}`;
 var buildIdCache;
 function projectIndexServerBuildId(entrypoint) {
-  const file = entrypoint instanceof URL || entrypoint.startsWith("file:") ? fileURLToPath(entrypoint) : path16.resolve(entrypoint);
+  const file = entrypoint instanceof URL || entrypoint.startsWith("file:") ? fileURLToPath(entrypoint) : path17.resolve(entrypoint);
   try {
-    const stat18 = fs11.statSync(file);
+    const stat18 = fs12.statSync(file);
     if (buildIdCache?.file === file && buildIdCache.mtimeMs === stat18.mtimeMs && buildIdCache.size === stat18.size) {
       return buildIdCache.buildId;
     }
-    const buildId = createHash4("sha256").update(fs11.readFileSync(file)).digest("hex").slice(0, 24);
+    const buildId = createHash4("sha256").update(fs12.readFileSync(file)).digest("hex").slice(0, 24);
     buildIdCache = { file, mtimeMs: stat18.mtimeMs, size: stat18.size, buildId };
     return buildId;
   } catch {
-    return `unreadable:${path16.basename(file)}`;
+    return `unreadable:${path17.basename(file)}`;
   }
 }
 function normalizeLocalPath(value) {
-  const resolved = path16.resolve(value);
+  const resolved = path17.resolve(value);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 function projectIndexServerKey(projectRoot, indexDir) {
@@ -11890,11 +12725,11 @@ function projectIndexServerEndpoint(projectRoot, indexDir) {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\wrongstack-codebase-index-v${PROJECT_INDEX_SERVER_PROTOCOL_VERSION}-${key}`;
   }
-  return path16.join(os5.tmpdir(), PROJECT_INDEX_SERVER_SOCKET_DIR, `${key}.sock`);
+  return path17.join(os5.tmpdir(), PROJECT_INDEX_SERVER_SOCKET_DIR, `${key}.sock`);
 }
 function projectIndexServerMetadataPath(projectRoot, indexDir) {
-  return path16.join(
-    path16.resolve(resolveIndexDir(projectRoot, indexDir)),
+  return path17.join(
+    path17.resolve(resolveIndexDir(projectRoot, indexDir)),
     PROJECT_INDEX_SERVER_METADATA_FILE
   );
 }
@@ -11934,7 +12769,7 @@ function resolveProjectIndexDaemonAvailability(projectRoot, indexDir) {
   for (const rel of ["./project-server.js", "./codebase-index/project-server.js"]) {
     try {
       const url = new URL(rel, import.meta.url);
-      if (url.protocol === "file:" && fs12.existsSync(fileURLToPath2(url))) {
+      if (url.protocol === "file:" && fs13.existsSync(fileURLToPath2(url))) {
         builtUrl = url;
         break;
       }
@@ -12191,7 +13026,7 @@ var ProjectServerConnection = class {
   currentAuthToken() {
     if (this.authToken === void 0) {
       try {
-        const raw = fs12.readFileSync(
+        const raw = fs13.readFileSync(
           projectIndexServerMetadataPath(this.projectRoot, this.indexDir),
           "utf8"
         );
@@ -12456,7 +13291,7 @@ var ProjectServerConnection = class {
     if (!url) throw new Error("built codebase-index project server is unavailable");
     if (process.platform !== "win32") {
       try {
-        fs12.rmSync(this.endpoint, { force: true });
+        fs13.rmSync(this.endpoint, { force: true });
       } catch {
       }
     }
@@ -12480,8 +13315,8 @@ var ProjectServerConnection = class {
       process.kill(pid);
       const metadataPath = projectIndexServerMetadataPath(this.projectRoot, this.indexDir);
       try {
-        const metadata = JSON.parse(fs12.readFileSync(metadataPath, "utf8"));
-        if (metadata.pid === pid) fs12.rmSync(metadataPath, { force: true });
+        const metadata = JSON.parse(fs13.readFileSync(metadataPath, "utf8"));
+        if (metadata.pid === pid) fs13.rmSync(metadataPath, { force: true });
       } catch {
       }
       return true;
@@ -12551,7 +13386,7 @@ import { Worker } from "node:worker_threads";
 
 // src/codebase-index/indexer.ts
 import { expectDefined as expectDefined6 } from "@wrongstack/core/utils";
-import { execFile as execFile2 } from "node:child_process";
+import { execFile } from "node:child_process";
 import * as fs17 from "node:fs/promises";
 import { availableParallelism } from "node:os";
 import * as path23 from "node:path";
@@ -12562,8 +13397,8 @@ import {
 } from "@wrongstack/core/utils";
 
 // src/codebase-index/gitignore.ts
-import * as fs13 from "node:fs/promises";
-import * as path17 from "node:path";
+import * as fs14 from "node:fs/promises";
+import * as path18 from "node:path";
 import { compileGlob } from "@wrongstack/core/utils";
 function globBody(glob) {
   return compileGlob(glob).source.replace(/^\^/, "").replace(/\$$/, "");
@@ -12579,48 +13414,474 @@ function compileGitignore(lines) {
       negated = true;
       line = line.slice(1);
     }
-    let dirOnly = false;
-    if (line.endsWith("/")) {
-      dirOnly = true;
-      line = line.slice(0, -1);
+    let dirOnly = false;
+    if (line.endsWith("/")) {
+      dirOnly = true;
+      line = line.slice(0, -1);
+    }
+    if (!line) continue;
+    const anchored = line.startsWith("/") || line.includes("/");
+    if (line.startsWith("/")) line = line.slice(1);
+    const body = globBody(line);
+    const prefix = anchored ? "^" : "(?:^|.*/)";
+    rules.push({
+      eqOrUnder: new RegExp(`${prefix}${body}(?:/.*)?$`),
+      under: new RegExp(`${prefix}${body}/.*$`),
+      negated,
+      dirOnly
+    });
+  }
+  return (relPath, isDir) => {
+    const p = relPath.replace(/\\/g, "/").replace(/^\/+/, "");
+    let ignored = false;
+    for (const r of rules) {
+      const re = r.dirOnly && !isDir ? r.under : r.eqOrUnder;
+      if (re.test(p)) ignored = !r.negated;
+    }
+    return ignored;
+  };
+}
+async function loadGitignoreMatcher(projectRoot) {
+  let lines = [];
+  try {
+    const raw = await fs14.readFile(path18.join(projectRoot, ".gitignore"), "utf8");
+    lines = raw.split("\n");
+  } catch {
+  }
+  return compileGitignore(lines);
+}
+
+// src/codebase-index/indexer.ts
+init_languages2();
+
+// src/codebase-index/module-resolver.ts
+init_languages2();
+import * as path19 from "node:path";
+var EXTENSIONS = {
+  js: [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs", ".vue", ".svelte"],
+  py: [".py", ".pyi"],
+  rs: [".rs"],
+  jvm: [".java", ".kt", ".scala"],
+  c: [".h", ".hpp", ".hh", ".hxx", ".c", ".cpp", ".cc", ".cxx"],
+  ruby: [".rb"],
+  go: [".go"]
+};
+var DIRECTORY_ENTRIES = {
+  js: ["index"],
+  py: ["__init__"],
+  rs: ["mod"],
+  ruby: ["index"]
+};
+function normalizeNamespace(value) {
+  return value.replace(/::|[\\/]/g, ".").replace(/^\.+|\.+$/g, "").toLowerCase();
+}
+var ModuleResolver = class {
+  structure;
+  /** Lowercased portable path → the path as indexed (case is preserved). */
+  byPath;
+  /** Lowercased portable directory → files directly inside it, as indexed. */
+  byDir;
+  /** Normalized namespace → the file declaring it (first by path, stable). */
+  byNamespace;
+  constructor(structure, files, namespaces = []) {
+    this.structure = structure;
+    this.byPath = /* @__PURE__ */ new Map();
+    this.byDir = /* @__PURE__ */ new Map();
+    this.byNamespace = /* @__PURE__ */ new Map();
+    const dirsByKey = /* @__PURE__ */ new Map();
+    for (const file of files) {
+      const portable = toPortablePath(file);
+      const pathKey = portable.toLowerCase();
+      const priorPath = this.byPath.get(pathKey);
+      if (priorPath !== void 0 && priorPath !== file) this.byPath.delete(pathKey);
+      else this.byPath.set(pathKey, file);
+      const dir = path19.posix.dirname(portable);
+      const dirKey = dir.toLowerCase();
+      const knownDir = dirsByKey.get(dirKey);
+      if (knownDir === void 0) {
+        dirsByKey.set(dirKey, dir);
+        this.byDir.set(dirKey, [file]);
+      } else if (knownDir === dir) {
+        this.byDir.get(dirKey)?.push(file);
+      } else {
+        dirsByKey.delete(dirKey);
+        this.byDir.delete(dirKey);
+      }
+    }
+    for (const { name, file } of namespaces) {
+      const lang = detectLang(file);
+      if (!lang) continue;
+      const key = `${languageFamily(lang)}:${normalizeNamespace(name)}`;
+      if (normalizeNamespace(name) && !this.byNamespace.has(key)) {
+        this.byNamespace.set(key, file);
+      }
+    }
+  }
+  /**
+   * Resolve `specifier` as written in `fromFile`.
+   * Returns the indexed target path, or `undefined` when it is external or
+   * cannot be located.
+   */
+  resolve(fromFile, lang, specifier) {
+    const spec = specifier.trim().replace(/\\/g, "/");
+    if (!spec) return void 0;
+    const from = toPortablePath(fromFile);
+    switch (languageFamily(lang)) {
+      case "js":
+        return this.resolveJs(from, spec);
+      case "go":
+        return this.resolveGo(spec);
+      case "py":
+        return this.resolvePython(from, spec);
+      case "rs":
+        return this.resolveRust(from, spec);
+      case "jvm":
+        return this.resolveJvm(spec);
+      case "c":
+        return this.resolveInclude(from, spec);
+      case "ruby":
+        return this.resolveRuby(from, spec);
+      case "dotnet":
+      case "php":
+      case "elixir":
+      case "haskell":
+        return this.resolveNamespace(lang, spec);
+      default:
+        return void 0;
+    }
+  }
+  /**
+   * Resolve a namespace specifier to the file declaring it.
+   *
+   * Tried whole first, then with the trailing segment dropped: `using Foo.Bar`
+   * names a namespace outright, while PHP's `use App\Models\User` names a
+   * *class* inside `App\Models`, so the prefix is what was declared.
+   */
+  resolveNamespace(lang, spec) {
+    const family = languageFamily(lang);
+    const normalized = normalizeNamespace(spec);
+    const exact = this.byNamespace.get(`${family}:${normalized}`);
+    if (exact) return exact;
+    const segments = normalized.split(".").filter(Boolean);
+    if (segments.length < 2) return void 0;
+    return this.byNamespace.get(`${family}:${segments.slice(0, -1).join(".")}`);
+  }
+  // ─── Lookup primitives ──────────────────────────────────────────────────────
+  lookup(candidate) {
+    return this.byPath.get(path19.posix.normalize(candidate).toLowerCase());
+  }
+  /**
+   * Try `base` verbatim, then `base` + each extension, then each directory
+   * entry point inside `base`.
+   */
+  lookupWithExtensions(base, family) {
+    const direct = this.lookup(base);
+    if (direct) return direct;
+    const extensions = EXTENSIONS[family] ?? [];
+    const suffix = path19.posix.extname(base);
+    const stem = suffix && extensions.includes(suffix) ? base.slice(0, -suffix.length) : base;
+    for (const ext of extensions) {
+      const hit = this.lookup(`${stem}${ext}`);
+      if (hit) return hit;
+    }
+    for (const entry of DIRECTORY_ENTRIES[family] ?? []) {
+      for (const ext of extensions) {
+        const hit = this.lookup(path19.posix.join(base, `${entry}${ext}`));
+        if (hit) return hit;
+      }
+    }
+    return void 0;
+  }
+  /**
+   * A representative indexed file inside `dir`, for ecosystems whose import
+   * unit is a directory rather than a file (Go packages, JVM wildcard imports).
+   *
+   * The choice is deterministic — a file named after the directory, else the
+   * first by name — so the same import always produces the same edge. Package
+   * grouping is unaffected either way: every file in the directory carries the
+   * same package label, so the package-level edge is exact regardless of which
+   * member represents it.
+   */
+  representativeIn(dir, family) {
+    const members = this.byDir.get(path19.posix.normalize(dir).toLowerCase());
+    if (!members?.length) return void 0;
+    const extensions = EXTENSIONS[family] ?? [];
+    const eligible = members.filter((file) => extensions.includes(path19.posix.extname(toPortablePath(file)).toLowerCase())).sort((a, b) => toPortablePath(a).localeCompare(toPortablePath(b)));
+    if (eligible.length === 0) return void 0;
+    const base = path19.posix.basename(path19.posix.normalize(dir)).toLowerCase();
+    const named = eligible.find(
+      (file) => path19.posix.basename(toPortablePath(file)).split(".")[0]?.toLowerCase() === base
+    );
+    return named ?? eligible[0];
+  }
+  // ─── Per-family resolution ──────────────────────────────────────────────────
+  /** Relative specifiers, then workspace package names and their subpaths. */
+  resolveJs(fromFile, spec) {
+    if (spec.startsWith(".")) {
+      const absolute = path19.posix.join(path19.posix.dirname(fromFile), spec);
+      return this.lookupWithExtensions(absolute, "js");
+    }
+    const owner2 = this.structure.roots.find(
+      (root) => root.kind === "npm" && root.importPath !== void 0 && (spec === root.importPath || spec.startsWith(`${root.importPath}/`))
+    );
+    if (!owner2?.importPath) return void 0;
+    const subpath = spec.slice(owner2.importPath.length).replace(/^\//, "");
+    if (!subpath) {
+      return this.lookupWithExtensions(path19.posix.join(owner2.dir, "src/index"), "js") ?? this.lookupWithExtensions(path19.posix.join(owner2.dir, "index"), "js");
+    }
+    return this.lookupWithExtensions(path19.posix.join(owner2.dir, subpath), "js") ?? this.lookupWithExtensions(path19.posix.join(owner2.dir, "src", subpath), "js");
+  }
+  /** Go import paths are absolute module paths; a package is a directory. */
+  resolveGo(spec) {
+    const owner2 = this.structure.roots.find(
+      (root) => root.kind === "go" && root.importPath !== void 0 && (spec === root.importPath || spec.startsWith(`${root.importPath}/`))
+    );
+    if (!owner2?.importPath) return void 0;
+    const subpath = spec.slice(owner2.importPath.length).replace(/^\//, "");
+    return this.representativeIn(path19.posix.join(owner2.dir, subpath), "go");
+  }
+  /**
+   * `import a.b.c` / `from a.b import c`, plus PEP 328 relative imports whose
+   * leading dots the extractor preserves (`.sibling`, `..parent.mod`).
+   */
+  resolvePython(fromFile, spec) {
+    const leadingDots = /^\.*/.exec(spec)?.[0].length ?? 0;
+    if (leadingDots > 0) {
+      let base = path19.posix.dirname(fromFile);
+      for (let i = 1; i < leadingDots; i++) base = path19.posix.dirname(base);
+      const rest = spec.slice(leadingDots).split(".").filter(Boolean);
+      return this.lookupWithExtensions(path19.posix.join(base, ...rest), "py");
+    }
+    const segments = spec.split(".").filter(Boolean);
+    if (segments.length === 0) return void 0;
+    const sourceRoots = this.structure.roots.filter((root) => root.kind === "python").flatMap((root) => root.sourceRoots);
+    for (const base of [...sourceRoots, this.structure.projectRoot]) {
+      const hit = this.lookupWithExtensions(path19.posix.join(base, ...segments), "py");
+      if (hit) return hit;
+      if (segments.length > 1) {
+        const parent = this.lookupWithExtensions(
+          path19.posix.join(base, ...segments.slice(0, -1)),
+          "py"
+        );
+        if (parent) return parent;
+      }
+    }
+    return void 0;
+  }
+  /** `use crate::a::b`, `use super::x`, `use self::y`, `use other_crate::z`. */
+  resolveRust(fromFile, spec) {
+    const segments = spec.split("::").filter(Boolean);
+    if (segments.length === 0) return void 0;
+    const head = segments[0];
+    if (head === "self" || head === "super") {
+      let base = path19.posix.dirname(fromFile);
+      for (const segment of segments) {
+        if (segment === "super") base = path19.posix.dirname(base);
+        else if (segment !== "self") break;
+      }
+      const rest2 = segments.filter((segment) => segment !== "self" && segment !== "super");
+      return this.lookupWithExtensions(path19.posix.join(base, ...rest2), "rs");
+    }
+    const owningCrate = findOwningRoot(this.structure, fromFile, ["cargo"]);
+    const crate = head === "crate" ? owningCrate : this.structure.roots.find(
+      (root) => root.kind === "cargo" && root.importPath === head?.replace(/-/g, "_")
+    );
+    if (!crate) {
+      return this.lookupWithExtensions(
+        path19.posix.join(path19.posix.dirname(fromFile), ...segments),
+        "rs"
+      );
     }
-    if (!line) continue;
-    const anchored = line.startsWith("/") || line.includes("/");
-    if (line.startsWith("/")) line = line.slice(1);
-    const body = globBody(line);
-    const prefix = anchored ? "^" : "(?:^|.*/)";
-    rules.push({
-      eqOrUnder: new RegExp(`${prefix}${body}(?:/.*)?$`),
-      under: new RegExp(`${prefix}${body}/.*$`),
-      negated,
-      dirOnly
-    });
+    const rest = segments.slice(1);
+    for (const base of crate.sourceRoots) {
+      const parent = rest.length > 1 ? this.lookupWithExtensions(path19.posix.join(base, ...rest.slice(0, -1)), "rs") : void 0;
+      const exact = this.lookupWithExtensions(path19.posix.join(base, ...rest), "rs");
+      const hit = exact ?? parent ?? this.lookupWithExtensions(path19.posix.join(base, "lib"), "rs");
+      if (hit) return hit;
+    }
+    return void 0;
   }
-  return (relPath, isDir) => {
-    const p = relPath.replace(/\\/g, "/").replace(/^\/+/, "");
-    let ignored = false;
-    for (const r of rules) {
-      const re = r.dirOnly && !isDir ? r.under : r.eqOrUnder;
-      if (re.test(p)) ignored = !r.negated;
+  /** `com.example.Thing` and `com.example.*` against JVM source roots. */
+  resolveJvm(spec) {
+    const segments = spec.split(".").filter(Boolean);
+    if (segments.length === 0) return void 0;
+    const sourceRoots = this.structure.roots.filter((root) => root.kind === "maven" || root.kind === "gradle").flatMap((root) => root.sourceRoots);
+    const wildcard = segments[segments.length - 1] === "*";
+    const parts = wildcard ? segments.slice(0, -1) : segments;
+    for (const base of [...sourceRoots, this.structure.projectRoot]) {
+      const target = path19.posix.join(base, ...parts);
+      const hit = wildcard ? this.representativeIn(target, "jvm") : this.lookupWithExtensions(target, "jvm");
+      if (hit) return hit;
     }
-    return ignored;
-  };
+    return void 0;
+  }
+  /** `#include "foo/bar.h"` — quoted form only; `<…>` is a system header. */
+  resolveInclude(fromFile, spec) {
+    const relative12 = this.lookupWithExtensions(
+      path19.posix.join(path19.posix.dirname(fromFile), spec),
+      "c"
+    );
+    if (relative12) return relative12;
+    for (const base of [
+      path19.posix.join(this.structure.projectRoot, "include"),
+      this.structure.projectRoot
+    ]) {
+      const hit = this.lookupWithExtensions(path19.posix.join(base, spec), "c");
+      if (hit) return hit;
+    }
+    return void 0;
+  }
+  /** `require_relative 'x'` is relative; `require 'x'` is looked up under lib/. */
+  resolveRuby(fromFile, spec) {
+    const relative12 = this.lookupWithExtensions(
+      path19.posix.join(path19.posix.dirname(fromFile), spec),
+      "ruby"
+    );
+    if (relative12) return relative12;
+    for (const base of [
+      path19.posix.join(this.structure.projectRoot, "lib"),
+      this.structure.projectRoot
+    ]) {
+      const hit = this.lookupWithExtensions(path19.posix.join(base, spec), "ruby");
+      if (hit) return hit;
+    }
+    return void 0;
+  }
+};
+
+// src/codebase-index/import-extractor.ts
+var IMPORT_MAX_FILE_CHARS = 512 * 1024;
+var IMPORT_MAX_PER_FILE = 400;
+var DOTTED_IMPORT = [
+  { re: /^[ \t]*import\s+(?:static\s+)?([\w.]+(?:\.\*)?)\s*;?\s*$/gm }
+];
+var LANG_IMPORTS = {
+  // Go and Python have real AST extractors; these patterns are the fallback for
+  // machines with no Go toolchain or Python interpreter installed, where the
+  // parser degrades to regex symbols and would otherwise contribute no edges.
+  go: [
+    { re: /^[ \t]*import\s+(?:[\w.]+\s+)?"([^"]+)"/gm },
+    // Grouped form: inside `import ( … )` each line is an optional alias plus a
+    // quoted path. A stray match elsewhere resolves to no file and is dropped.
+    { re: /^[ \t]*(?:[A-Za-z_.]\w*\s+)?"([^"]+)"\s*$/gm }
+  ],
+  py: [
+    { re: /^[ \t]*import\s+([\w.]+)/gm },
+    { re: /^[ \t]*from\s+([.\w]+)\s+import\b/gm }
+  ],
+  rs: [
+    // use a::b::C;  |  use a::b::{C, D};  → the path before any brace
+    { re: /^[ \t]*(?:pub\s+)?use\s+([\w:]+?)(?:::\{|\s*;|\s+as\b)/gm },
+    // mod foo;  (a declaration *and* a dependency on foo.rs / foo/mod.rs)
+    { re: /^[ \t]*(?:pub\s+)?mod\s+(\w+)\s*;/gm }
+  ],
+  java: DOTTED_IMPORT,
+  kotlin: DOTTED_IMPORT,
+  scala: [{ re: /^[ \t]*import\s+([\w.]+(?:\.[_*])?)\s*$/gm }],
+  csharp: [
+    // using Foo.Bar;  |  using static Foo.Bar;  |  using Alias = Foo.Bar;
+    { re: /^[ \t]*global\s+using\s+(?:static\s+)?([\w.]+)\s*;/gm, name: "full" },
+    { re: /^[ \t]*using\s+(?:static\s+)?(?:\w+\s*=\s*)?([\w.]+)\s*;/gm, name: "full" }
+  ],
+  // Quoted includes only: <stdio.h> is a system header with no indexed file.
+  c: [{ re: /^[ \t]*#\s*include\s+"([^"]+)"/gm }],
+  cpp: [{ re: /^[ \t]*#\s*include\s+"([^"]+)"/gm }],
+  ruby: [{ re: /^[ \t]*(?:require|require_relative|load)\s*\(?\s*['"]([^'"]+)['"]/gm }],
+  php: [
+    // `use A\B\C` imports the class C, which is what the index has a symbol
+    // for — the namespace symbol only covers the `A\B` prefix.
+    { re: /^[ \t]*use\s+(?:function\s+|const\s+)?([\w\\]+)/gm },
+    { re: /^[ \t]*(?:require|require_once|include|include_once)\s*\(?\s*['"]([^'"]+)['"]/gm }
+  ],
+  swift: [{ re: /^[ \t]*import\s+(?:struct\s+|class\s+|func\s+)?([\w.]+)\s*$/gm }],
+  dart: [{ re: /^[ \t]*(?:import|export|part)\s+['"]([^'"]+)['"]/gm }],
+  lua: [{ re: /\brequire\s*\(?\s*['"]([^'"]+)['"]/g }],
+  elixir: [{ re: /^[ \t]*(?:alias|import|require|use)\s+([A-Z][\w.]*)/gm, name: "full" }],
+  haskell: [{ re: /^[ \t]*import\s+(?:qualified\s+)?([\w.]+)/gm, name: "full" }],
+  zig: [{ re: /@import\s*\(\s*"([^"]+)"\s*\)/g }],
+  proto: [{ re: /^[ \t]*import\s+(?:public\s+|weak\s+)?"([^"]+)"\s*;/gm }],
+  // `@import "x"`, `@use "x"`, `@forward "x"` — Sass and plain CSS alike.
+  css: [{ re: /^[ \t]*@(?:import|use|forward)\s+(?:url\()?\s*['"]([^'"]+)['"]/gm }],
+  // A .vue/.svelte file's <script> block is JS; the same ESM syntax applies.
+  vue: [{ re: /^[ \t]*import\s[^'"]*from\s*['"]([^'"]+)['"]/gm }],
+  svelte: [{ re: /^[ \t]*import\s[^'"]*from\s*['"]([^'"]+)['"]/gm }],
+  html: [
+    { re: /<script[^>]+src\s*=\s*['"]([^'"]+)['"]/g },
+    { re: /<link[^>]+href\s*=\s*['"]([^'"]+)['"]/g }
+  ],
+  shell: [{ re: /^[ \t]*(?:source|\.)\s+(\S+)/gm }],
+  r: [{ re: /\b(?:source|library|require)\s*\(\s*['"]?([\w./-]+)['"]?\s*\)/g }]
+};
+function lastSegment(specifier) {
+  const pathLike = /[/\\]|::/.test(specifier);
+  const segments = specifier.split(/[/\\]|::/).filter(Boolean);
+  let last = segments[segments.length - 1] ?? specifier;
+  if (last === "*" || last === "_") {
+    last = segments[segments.length - 2] ?? specifier;
+  }
+  if (pathLike) return last.replace(/\.[A-Za-z0-9]{1,8}$/, "") || last;
+  const dotted = last.split(".").filter((part) => part && part !== "*" && part !== "_");
+  return dotted[dotted.length - 1] ?? last;
 }
-async function loadGitignoreMatcher(projectRoot) {
-  let lines = [];
-  try {
-    const raw = await fs13.readFile(path17.join(projectRoot, ".gitignore"), "utf8");
-    lines = raw.split("\n");
-  } catch {
+function newlineOffsets(content) {
+  const offsets = [];
+  for (let i = 0; i < content.length; i++) {
+    if (content.charCodeAt(i) === 10) offsets.push(i);
   }
-  return compileGitignore(lines);
+  return offsets;
+}
+function lineAt(offsets, index) {
+  let low = 0;
+  let high = offsets.length;
+  while (low < high) {
+    const mid = low + high >>> 1;
+    if ((offsets[mid] ?? 0) < index) low = mid + 1;
+    else high = mid;
+  }
+  return low + 1;
+}
+function hasImportPatterns(lang) {
+  return LANG_IMPORTS[lang] !== void 0;
+}
+function extractImports(opts) {
+  const patterns = LANG_IMPORTS[opts.lang];
+  if (!patterns || !opts.content) return [];
+  const limit = opts.maxImports ?? IMPORT_MAX_PER_FILE;
+  const content = opts.content.length > IMPORT_MAX_FILE_CHARS ? opts.content.slice(0, IMPORT_MAX_FILE_CHARS) : opts.content;
+  const refs = [];
+  const seen = /* @__PURE__ */ new Set();
+  const offsets = newlineOffsets(content);
+  for (const pattern of patterns) {
+    const re = new RegExp(pattern.re.source, pattern.re.flags);
+    for (const match of content.matchAll(re)) {
+      if (refs.length >= limit) return refs;
+      const specifier = match[1]?.trim();
+      if (!specifier) continue;
+      const module = specifier;
+      const toName = pattern.name === "full" ? module : lastSegment(module);
+      if (!toName) continue;
+      const key = `${module}\0${toName}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      refs.push({
+        fromId: 0,
+        toName,
+        callType: "import",
+        line: lineAt(offsets, match.index ?? 0),
+        lang: opts.lang,
+        module
+      });
+    }
+  }
+  return refs;
 }
-
-// src/codebase-index/indexer.ts
-init_languages2();
 
 // src/codebase-index/parser-dispatch.ts
 async function parseFileContent(file, content, lang) {
+  const parsed = await dispatch(file, content, lang);
+  return withRelations(parsed, content, lang);
+}
+async function dispatch(file, content, lang) {
   switch (lang) {
     case "ts":
     case "tsx":
@@ -12655,6 +13916,13 @@ async function parseFileContent(file, content, lang) {
     }
   }
 }
+function withRelations(parsed, content, lang) {
+  let refs = parsed.refs ?? [];
+  if (refs.length === 0 && hasImportPatterns(lang)) {
+    refs = extractImports({ content, lang });
+  }
+  return { ...parsed, refs: refs.map((ref) => ref.lang ? ref : { ...ref, lang }) };
+}
 
 // src/codebase-index/indexer.ts
 var YIELD_EVERY_N = 50;
@@ -12691,7 +13959,7 @@ function normalizeComparablePath(value) {
 }
 function gitOutput(projectRoot, args) {
   return new Promise((resolve16, reject) => {
-    execFile2(
+    execFile(
       "git",
       ["-C", projectRoot, ...args],
       {
@@ -12822,13 +14090,40 @@ function assignRefsToSymbols2(refs, symbols) {
     }
     if (!owner2 && ref.callType === "import") owner2 = ordered[0];
     if (!owner2 || owner2.id <= 0) continue;
-    const key = `${owner2.id}:${ref.toName}:${ref.callType}`;
+    const key = `${owner2.id}:${ref.toName}:${ref.callType}:${ref.module ?? ""}`;
     if (seen.has(key)) continue;
     seen.add(key);
     assigned.push({ ...ref, fromId: owner2.id });
   }
   return assigned;
 }
+async function resolveProjectRelations(store, projectRoot, opts) {
+  if (opts.signal?.aborted) return;
+  try {
+    const indexedFiles = store.getAllFileMetas().map((meta) => meta.file);
+    if (indexedFiles.length === 0) return;
+    const structure = await detectModuleRoots(projectRoot, indexedFiles);
+    if (opts.signal?.aborted) return;
+    store.setFilePackages(assignPackageLabels(structure, indexedFiles));
+    const resolver = new ModuleResolver(
+      structure,
+      indexedFiles,
+      store.getNamespaceDeclarations()
+    );
+    const pending2 = store.getUnresolvedImports(opts.onlyFiles);
+    const resolutions = [];
+    for (const entry of pending2) {
+      const toFile = resolver.resolve(entry.fromFile, entry.lang, entry.module);
+      if (toFile && toFile !== entry.fromFile) {
+        resolutions.push({ ...entry, toFile });
+      }
+    }
+    if (opts.signal?.aborted) return;
+    store.applyImportResolutions(resolutions);
+  } catch (err) {
+    opts.errors.push(`relation resolution: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
 async function runIndexerWithStore(store, opts) {
   const { projectRoot, langs, ignore = [], signal } = opts;
   const relationGraphVersion = "2";
@@ -13073,6 +14368,14 @@ async function runIndexerWithStore(store, opts) {
     }
   }
   if (needsFullRefResolution) store.resolveRefs();
+  await resolveProjectRelations(store, projectRoot, {
+    // A watcher run re-resolves only what it touched; a full run (or a contract
+    // bump) re-resolves everything, because a newly indexed file can be the
+    // target of imports written long before it.
+    onlyFiles: needsFullRefResolution ? void 0 : opts.files,
+    errors,
+    signal
+  });
   store.setMetadata("ref_resolution_version", refResolutionVersion);
   store.setMetadata("relation_graph_version", relationGraphVersion);
   if (!opts.files || filesIndexed >= 50) store.optimize();
@@ -13155,6 +14458,22 @@ function symbolGraphService(args) {
     indexStorePool.release(store);
   }
 }
+function incomingCallsService(args) {
+  const store = indexStorePool.acquire(args.projectRoot, { indexDir: args.indexDir });
+  try {
+    return store.findIncomingCallsByName(args.symbol, args.file, args.limit ?? 100);
+  } finally {
+    indexStorePool.release(store);
+  }
+}
+function outgoingCallsService(args) {
+  const store = indexStorePool.acquire(args.projectRoot, { indexDir: args.indexDir });
+  try {
+    return store.findOutgoingCallsByName(args.symbol, args.file, args.limit ?? 100);
+  } finally {
+    indexStorePool.release(store);
+  }
+}
 
 // src/codebase-index/background-indexer.ts
 var DEFAULT_FULL_INDEX_TIMEOUT_MS = 24e4;
@@ -13366,6 +14685,10 @@ async function callInline(op, args, opts) {
         return fileGraphService(args);
       case "symbolGraph":
         return symbolGraphService(args);
+      case "incomingCalls":
+        return incomingCallsService(args);
+      case "outgoingCalls":
+        return outgoingCallsService(args);
       default:
         throw new Error(`unknown index op: ${String(op)}`);
     }
@@ -13461,6 +14784,12 @@ async function codebaseIndexStats(args, opts = {}) {
     signal: opts.signal
   });
 }
+async function incomingCallsService2(args) {
+  return callIndexOp("incomingCalls", args, { timeoutMs: DEFAULT_QUERY_TIMEOUT_MS });
+}
+async function outgoingCallsService2(args) {
+  return callIndexOp("outgoingCalls", args, { timeoutMs: DEFAULT_QUERY_TIMEOUT_MS });
+}
 
 // src/codebase-index/codebase-index-tool.ts
 var codebaseIndexTool = {
@@ -13525,6 +14854,214 @@ var codebaseIndexTool = {
   }
 };
 
+// src/codebase-index/codebase-incoming-calls-tool.ts
+var codebaseIncomingCallsTool = {
+  name: "codebase-incoming-calls",
+  category: "Project",
+  icon: "index",
+  description: "Find all callers of a function, method, or symbol \u2014 who invokes or references it. Uses the codebase index ref graph for instant, exact results. Always use this instead of grep when checking impact of a change.",
+  usageHint: 'CALL THIS BEFORE REFACTORING OR CHANGING ANY FUNCTION:\n\n- NEVER use grep or manual line reading to check where a function is called.\n- ALWAYS call codebase-incoming-calls({ symbol: "funcName" }) first.\n- Returns exact files, line numbers, caller signatures, and call types in milliseconds.\n- Use `file` to disambiguate when multiple symbols share a name.\n- Combine with codebase-outgoing-calls to see what the symbol itself calls.\nIf the index is not built, run codebase-index first.',
+  permission: "auto",
+  mutating: false,
+  capabilities: ["fs.read"],
+  timeoutMs: 35e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      symbol: {
+        type: "string",
+        description: "The function/method/type name to find callers for"
+      },
+      file: {
+        type: "string",
+        description: "Scope to a specific file when multiple symbols share the same name"
+      },
+      limit: {
+        type: "integer",
+        description: "Maximum call sites to return (default 50, max 200)",
+        minimum: 1,
+        maximum: 200
+      }
+    },
+    required: ["symbol"]
+  },
+  async execute(input, ctx) {
+    const state = getIndexState();
+    if (state.indexing && !state.ready) {
+      return {
+        symbol: input.symbol,
+        calls: [],
+        total: 0,
+        indexStatus: `Indexing in progress (${state.currentFile}/${state.totalFiles} files) \u2014 retry in a moment.`
+      };
+    }
+    if (state.lastError) {
+      const circuit = state.circuit;
+      const retryHint = circuit.state === "open" ? `Indexing is paused (circuit open, retry in ${Math.ceil(circuit.cooldownRemainingMs / 1e3)}s).` : "Try /codebase-reindex.";
+      return {
+        symbol: input.symbol,
+        calls: [],
+        total: 0,
+        indexStatus: `Index build failed: ${state.lastError}. ${retryHint}`
+      };
+    }
+    const limit = Math.max(1, Math.min(Math.trunc(input.limit ?? 50), 200));
+    const { calls, symbolFound, ambiguous, totalMatches } = await incomingCallsService2(
+      {
+        projectRoot: ctx.projectRoot,
+        indexDir: codebaseIndexDirOverride(ctx),
+        symbol: input.symbol,
+        file: input.file,
+        limit
+      }
+    );
+    if (!symbolFound) {
+      let hasPersistedIndex = state.ready;
+      if (!hasPersistedIndex) {
+        try {
+          const stats = await codebaseIndexStats({
+            projectRoot: ctx.projectRoot,
+            indexDir: codebaseIndexDirOverride(ctx)
+          });
+          hasPersistedIndex = stats.totalFiles > 0 || stats.lastIndexed !== null;
+        } catch {
+        }
+      }
+      if (!hasPersistedIndex) {
+        return {
+          symbol: input.symbol,
+          calls: [],
+          total: 0,
+          indexStatus: "No persisted index data found. Run codebase-index to build it."
+        };
+      }
+      return {
+        symbol: input.symbol,
+        calls: [],
+        total: 0,
+        note: `Symbol "${input.symbol}" not found in the index. Use codebase-search to verify the name.`
+      };
+    }
+    const notes = [];
+    if (totalMatches > limit) {
+      notes.push(`Results capped at ${limit} of ${totalMatches} call sites. Increase \`limit\` or use \`file\` to narrow.`);
+    }
+    if (ambiguous) {
+      notes.push(`Symbol "${input.symbol}" exists in multiple files. Results include callers of all same-named symbols. Use codebase-search to find the exact file and pass it as \`file\`.`);
+    }
+    return {
+      symbol: input.symbol,
+      calls,
+      total: calls.length,
+      ...notes.length > 0 ? { note: notes.join(" ") } : {}
+    };
+  }
+};
+
+// src/codebase-index/codebase-outgoing-calls-tool.ts
+var codebaseOutgoingCallsTool = {
+  name: "codebase-outgoing-calls",
+  category: "Project",
+  icon: "index",
+  description: "Find all functions/methods/symbols that a given symbol calls or depends on \u2014 its callees. Uses the codebase index ref graph for instant, exact results. Use this to understand a function's dependencies before modifying it.",
+  usageHint: 'USE THIS TO UNDERSTAND A FUNCTION\'S DEPENDENCIES:\n\n- Call codebase-outgoing-calls({ symbol: "funcName" }) to see everything it calls.\n- Returns exact files, line numbers, callee signatures, and call types in milliseconds.\n- Use `file` to disambiguate when multiple symbols share a name.\n- Pair with codebase-incoming-calls for a complete impact picture: incoming = who calls you, outgoing = what you call.\nIf the index is not built, run codebase-index first.',
+  permission: "auto",
+  mutating: false,
+  capabilities: ["fs.read"],
+  timeoutMs: 35e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      symbol: {
+        type: "string",
+        description: "The function/method/type name to find callees for"
+      },
+      file: {
+        type: "string",
+        description: "Scope to a specific file when multiple symbols share the same name"
+      },
+      limit: {
+        type: "integer",
+        description: "Maximum call sites to return (default 50, max 200)",
+        minimum: 1,
+        maximum: 200
+      }
+    },
+    required: ["symbol"]
+  },
+  async execute(input, ctx) {
+    const state = getIndexState();
+    if (state.indexing && !state.ready) {
+      return {
+        symbol: input.symbol,
+        calls: [],
+        total: 0,
+        indexStatus: `Indexing in progress (${state.currentFile}/${state.totalFiles} files) \u2014 retry in a moment.`
+      };
+    }
+    if (state.lastError) {
+      const circuit = state.circuit;
+      const retryHint = circuit.state === "open" ? `Indexing is paused (circuit open, retry in ${Math.ceil(circuit.cooldownRemainingMs / 1e3)}s).` : "Try /codebase-reindex.";
+      return {
+        symbol: input.symbol,
+        calls: [],
+        total: 0,
+        indexStatus: `Index build failed: ${state.lastError}. ${retryHint}`
+      };
+    }
+    const limit = Math.max(1, Math.min(Math.trunc(input.limit ?? 50), 200));
+    const { calls, symbolFound, unresolvedCount, totalMatches } = await outgoingCallsService2(
+      {
+        projectRoot: ctx.projectRoot,
+        indexDir: codebaseIndexDirOverride(ctx),
+        symbol: input.symbol,
+        file: input.file,
+        limit
+      }
+    );
+    if (!symbolFound) {
+      let hasPersistedIndex = state.ready;
+      if (!hasPersistedIndex) {
+        try {
+          const stats = await codebaseIndexStats({
+            projectRoot: ctx.projectRoot,
+            indexDir: codebaseIndexDirOverride(ctx)
+          });
+          hasPersistedIndex = stats.totalFiles > 0 || stats.lastIndexed !== null;
+        } catch {
+        }
+      }
+      if (!hasPersistedIndex) {
+        return {
+          symbol: input.symbol,
+          calls: [],
+          total: 0,
+          indexStatus: "No persisted index data found. Run codebase-index to build it."
+        };
+      }
+      return {
+        symbol: input.symbol,
+        calls: [],
+        total: 0,
+        note: `Symbol "${input.symbol}" not found in the index. Use codebase-search to verify the name.`
+      };
+    }
+    const notes = [];
+    if (totalMatches > limit) {
+      notes.push(`Results capped at ${limit} of ${totalMatches} call sites. Increase \`limit\` or use \`file\` to narrow.`);
+    }
+    if (unresolvedCount > 0) {
+      notes.push(`${unresolvedCount} unresolved reference(s) not shown \u2014 their targets could not be resolved during indexing.`);
+    }
+    return {
+      symbol: input.symbol,
+      calls,
+      total: calls.length,
+      ...notes.length > 0 ? { note: notes.join(" ") } : {}
+    };
+  }
+};
+
 // src/codebase-index/codebase-search-tool.ts
 var codebaseSearchTool = {
   name: "codebase-search",
@@ -14245,17 +15782,17 @@ import {
 } from "@wrongstack/core/design";
 async function resolveReal(p) {
   const resolved = path25.resolve(p);
-  let probe2 = resolved;
+  let probe = resolved;
   const missing = [];
   for (; ; ) {
     try {
-      return path25.resolve(await fs20.realpath(probe2), ...missing);
+      return path25.resolve(await fs20.realpath(probe), ...missing);
     } catch (err) {
       if (err.code === "ENOENT") {
-        const parent = path25.dirname(probe2);
-        if (parent === probe2) return resolved;
-        missing.unshift(path25.basename(probe2));
-        probe2 = parent;
+        const parent = path25.dirname(probe);
+        if (parent === probe) return resolved;
+        missing.unshift(path25.basename(probe));
+        probe = parent;
         continue;
       }
       return resolved;
@@ -14530,7 +16067,7 @@ Replace off-palette colors with kit tokens (or the materialized CSS vars / token
 
 // src/diff.ts
 init_util();
-import { spawn as spawn8 } from "node:child_process";
+import { spawn as spawn7 } from "node:child_process";
 import { statSync as statSync3 } from "node:fs";
 import * as fs21 from "node:fs/promises";
 import * as path26 from "node:path";
@@ -14633,7 +16170,7 @@ function runGit(args, cwd, signal) {
   return new Promise((resolve16) => {
     let stdout = "";
     let stderr = "";
-    const child = spawn8("git", args, {
+    const child = spawn7("git", args, {
       cwd,
       signal,
       env: buildChildEnv3(),
@@ -14844,7 +16381,7 @@ function processFile(content, absPath, _style, _overwrite, target) {
 
 // src/e2e.ts
 init_util();
-import { open, readdir as readdir6 } from "node:fs/promises";
+import { open, readdir as readdir7 } from "node:fs/promises";
 import * as path27 from "node:path";
 async function readBoundedText(filePath, maxBytes) {
   let handle;
@@ -14962,7 +16499,7 @@ async function scanWorkspace(root, maxDepth, signal) {
     }
     let entries;
     try {
-      entries = await readdir6(current.directory, { withFileTypes: true });
+      entries = await readdir7(current.directory, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -15021,7 +16558,7 @@ async function detectPackageManager3(projectRoot, scanRoot, declared) {
   while (true) {
     const names = /* @__PURE__ */ new Set();
     try {
-      for (const entry of await readdir6(directory)) names.add(entry);
+      for (const entry of await readdir7(directory)) names.add(entry);
     } catch {
     }
     if (names.has("pnpm-lock.yaml")) return "pnpm";
@@ -15089,7 +16626,7 @@ async function collectSpecs(root, framework, testDirectory, signal) {
     if (scanned > MAX_SCAN_DIRECTORIES) return { count, samples, truncated: true };
     let entries;
     try {
-      entries = await readdir6(directory, { withFileTypes: true });
+      entries = await readdir7(directory, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -15290,7 +16827,7 @@ function findLadderMatches(fileLf, oldLf) {
   const exact = [];
   let idx = fileLf.indexOf(oldLf);
   while (idx !== -1) {
-    exact.push({ start: idx, end: idx + oldLf.length, startLine: lineAt(fileLf, idx) });
+    exact.push({ start: idx, end: idx + oldLf.length, startLine: lineAt2(fileLf, idx) });
     idx = fileLf.indexOf(oldLf, idx + 1);
   }
   if (exact.length > 0) return { tier: "exact", matches: exact };
@@ -15322,7 +16859,7 @@ function findLadderMatches(fileLf, oldLf) {
   if (normalized.length > 0) return { tier: "whitespace-normalized", matches: normalized };
   return fuzzyScan(fileLines, needleLines, offsets);
 }
-function lineAt(text, pos) {
+function lineAt2(text, pos) {
   if (pos < 512) {
     let line2 = 1;
     for (let i = 0; i < pos; i++) {
@@ -15784,7 +17321,7 @@ Compare this against your old_string and retry with the file's actual text.` : "
 };
 
 // src/exec.ts
-import { spawn as spawn9 } from "node:child_process";
+import { spawn as spawn8 } from "node:child_process";
 import {
   emitProcessCompleted as emitProcessCompleted3,
   emitProcessOutput as emitProcessOutput3,
@@ -17001,6 +18538,26 @@ var BLOCKED_ARG_PATTERNS = {
   pnpm: [],
   npx: []
 };
+var BLOCKED_OPTION_NAMES = {
+  git: /* @__PURE__ */ new Set([
+    "--exec",
+    "--upload-pack",
+    "--receive-pack",
+    "--exec-path",
+    "--git-dir",
+    "--work-tree",
+    "--namespace",
+    "-c",
+    "--config",
+    "--config-env",
+    "-C"
+  ]),
+  find: /* @__PURE__ */ new Set(["-exec", "-ok", "-execdir"])
+};
+function optionName(arg) {
+  const eq = arg.indexOf("=");
+  return eq > 0 ? arg.slice(0, eq) : arg;
+}
 var BLOCKED_SUBCOMMANDS = {
   docker: /* @__PURE__ */ new Set(["push"]),
   podman: /* @__PURE__ */ new Set(["push"]),
@@ -17038,6 +18595,15 @@ function validateArgs(cmd, args) {
     const blocked2 = blockedSequences.find((seq) => seq.every((part, idx) => actual[idx] === part));
     if (blocked2) return `Blocked subcommand "${blocked2.join(" ")}" for command "${cmd}"`;
   }
+  const blockedOptions = BLOCKED_OPTION_NAMES[cmd];
+  if (blockedOptions) {
+    for (const arg of args) {
+      if (arg === "--") break;
+      if (blockedOptions.has(optionName(arg))) {
+        return `Blocked option "${optionName(arg)}" for command "${cmd}"`;
+      }
+    }
+  }
   const blocked = BLOCKED_ARG_PATTERNS[cmd];
   if (!blocked) return null;
   for (const arg of args) {
@@ -17220,7 +18786,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     };
     let child;
     try {
-      child = spawn9(spawnCmd, spawnArgs, {
+      child = spawn8(spawnCmd, spawnArgs, {
         cwd,
         env: buildChildEnv2(sessionId),
         stdio: ["ignore", "pipe", "pipe"],
@@ -17854,7 +19420,7 @@ async function detectFixer(cwd) {
 
 // src/git.ts
 init_util();
-import { spawn as spawn10 } from "node:child_process";
+import { spawn as spawn9 } from "node:child_process";
 import { statSync as statSync4 } from "node:fs";
 import { dirname as dirname14, resolve as resolve13, sep as sep6 } from "node:path";
 import { assessCommitSafety } from "@wrongstack/core/coordination";
@@ -18118,7 +19684,7 @@ function runGit2(args, cwd, signal) {
   return new Promise((resolve16) => {
     let stdout = "";
     let stderr = "";
-    const child = spawn10("git", args, {
+    const child = spawn9("git", args, {
       cwd,
       signal,
       env: buildChildEnv4(),
@@ -18309,7 +19875,7 @@ var globTool = {
 };
 
 // src/grep.ts
-import { spawn as spawn11 } from "node:child_process";
+import { spawn as spawn10 } from "node:child_process";
 import * as fs25 from "node:fs/promises";
 import * as path31 from "node:path";
 import { ToolValidationError as ToolValidationError4 } from "@wrongstack/core/types";
@@ -18466,7 +20032,7 @@ var grepTool = {
 async function detectRg(signal) {
   return new Promise((resolve16) => {
     try {
-      const p = spawn11("rg", ["--version"], { env: buildChildEnv5(), stdio: "ignore", signal, windowsHide: true });
+      const p = spawn10("rg", ["--version"], { env: buildChildEnv5(), stdio: "ignore", signal, windowsHide: true });
       p.on("error", () => resolve16(false));
       p.on("close", (code) => resolve16(code === 0));
     } catch {
@@ -18500,7 +20066,7 @@ async function* runRgStream(input, base, mode, limit, signal) {
   const FLUSH_AT = 16;
   const MAX_BUF_BYTES = 1e6;
   let bufOverflow = false;
-  const child = spawn11("rg", args, {
+  const child = spawn10("rg", args, {
     signal,
     env: buildChildEnv5(),
     // rg diagnostics are not part of the tool result. Ignoring stderr avoids
@@ -18797,7 +20363,7 @@ async function runNative(input, base, mode, limit, signal) {
 init_spawn_stream();
 init_util();
 init_legacy_bridge();
-import { join as join25 } from "node:path";
+import { join as join24 } from "node:path";
 import {
   detectEcosystem as detectPackageEcosystem,
   recordPackageAction
@@ -18981,17 +20547,17 @@ function resolveManifestPath(cwd, pkgManager) {
     case "pnpm":
     case "yarn":
     case "npm":
-      return join25(cwd, "package.json");
+      return join24(cwd, "package.json");
     /* v8 ignore next 2 -- pkgManager is always pnpm/yarn/npm; the default is defensive. */
     default:
-      return join25(cwd, "package.json");
+      return join24(cwd, "package.json");
   }
 }
 
 // src/json.ts
-init_util();
 import * as fs26 from "node:fs/promises";
 import { deepMerge as deepMergeCore } from "@wrongstack/core/utils";
+init_util();
 var MAX_JSON_FILE_BYTES = 16 * 1024 * 1024;
 var MAX_JSON_FILE_BYTES_HUMAN = "16 MiB";
 var JsonFileTooLargeError = class extends Error {
@@ -19430,8 +20996,12 @@ function validateJsonSchema(data, schema) {
       }
     }
     if (typeof value === "string" && s["pattern"]) {
-      const re = new RegExp(s["pattern"]);
-      if (!re.test(value)) errors.push(`${path38}: does not match pattern ${s["pattern"]}`);
+      const compiled = compileUserRegex(s["pattern"], "");
+      if (!compiled.ok) {
+        errors.push(`${path38}: invalid schema pattern \u2014 ${compiled.reason}`);
+      } else if (!compiled.regex.test(capSubject(value))) {
+        errors.push(`${path38}: does not match pattern ${s["pattern"]}`);
+      }
     }
     if (typeof value === "string" && s["minLength"] !== void 0 && value.length < s["minLength"]) {
       errors.push(`${path38}: string too short (min ${s["minLength"]})`);
@@ -21416,7 +22986,7 @@ async function detectLinter(cwd) {
 }
 
 // src/logs.ts
-import { spawn as spawn12 } from "node:child_process";
+import { spawn as spawn11 } from "node:child_process";
 import { buildChildEnv as buildChildEnv6 } from "@wrongstack/core/utils";
 init_util();
 var logsTool = {
@@ -21523,7 +23093,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
       clearTimeout(timer);
       resolve16(result);
     };
-    const child = spawn12("docker", args, { cwd, signal, env: buildChildEnv6(), stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+    const child = spawn11("docker", args, { cwd, signal, env: buildChildEnv6(), stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
     const timer = setTimeout(() => {
       child.kill("SIGTERM");
       finish(empty());
@@ -21632,7 +23202,7 @@ function parseLine(line) {
 // src/outdated.ts
 init_util();
 init_win32_resolve();
-import { spawn as spawn13 } from "node:child_process";
+import { spawn as spawn12 } from "node:child_process";
 import { buildChildEnv as buildChildEnv7 } from "@wrongstack/core/utils";
 var outdatedTool = {
   name: "outdated",
@@ -21752,7 +23322,7 @@ function runOutdated(manager, args, cwd, signal) {
     const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
     const spawnCmd = shim?.command ?? resolved;
     const spawnArgs = shim?.args ?? args;
-    const child = spawn13(spawnCmd, spawnArgs, {
+    const child = spawn12(spawnCmd, spawnArgs, {
       cwd,
       signal,
       env: buildChildEnv7(),
@@ -21818,7 +23388,7 @@ function parseOutdatedOutput(json2, exitCode) {
 
 // src/patch.ts
 init_util();
-import { spawn as spawn14 } from "node:child_process";
+import { spawn as spawn13 } from "node:child_process";
 import * as fs27 from "node:fs/promises";
 import * as os9 from "node:os";
 import * as path32 from "node:path";
@@ -21960,7 +23530,7 @@ function runPatch(args, cwd, signal) {
     let stdout = "";
     let stderr = "";
     const env = { ...buildChildEnv8(), LANG: "C", LC_ALL: "C" };
-    const child = spawn14("patch", args, {
+    const child = spawn13("patch", args, {
       cwd,
       signal,
       env,
@@ -22557,7 +24127,7 @@ ${interesting.join("\n")}` : "symbols/imports: (none detected)"
 }
 
 // src/replace.ts
-import { spawn as spawn15 } from "node:child_process";
+import { spawn as spawn14 } from "node:child_process";
 import * as fs29 from "node:fs/promises";
 import * as path33 from "node:path";
 import { ToolValidationError as ToolValidationError6 } from "@wrongstack/core/types";
@@ -22742,7 +24312,7 @@ async function globFiles(pattern, base, extraGlob) {
 function checkRg() {
   return new Promise((resolve16) => {
     try {
-      const p = spawn15("rg", ["--version"], {
+      const p = spawn14("rg", ["--version"], {
         env: buildChildEnv9(),
         stdio: "ignore",
         windowsHide: true
@@ -22756,7 +24326,7 @@ function checkRg() {
 }
 function spawnRgFind(pattern, base) {
   const args = ["--files", "--glob", pattern, base];
-  const child = spawn15("rg", args, {
+  const child = spawn14("rg", args, {
     signal: AbortSignal.timeout(3e4),
     env: buildChildEnv9(),
     stdio: ["ignore", "pipe", "pipe"],
@@ -24795,7 +26365,7 @@ var writeTool = {
     required: ["path", "content"]
   },
   async execute(input, ctx, opts) {
-    return writeFile7(input, ctx, opts?.signal);
+    return writeFile6(input, ctx, opts?.signal);
   },
   async *executeStream(input, ctx, opts) {
     const prepared = await prepareWrite(input, ctx);
@@ -24808,7 +26378,7 @@ var writeTool = {
     yield { type: "final", output: await finishWrite(input, ctx, prepared, opts?.signal) };
   }
 };
-async function writeFile7(input, ctx, signal) {
+async function writeFile6(input, ctx, signal) {
   return finishWrite(input, ctx, await prepareWrite(input, ctx), signal);
 }
 async function prepareWrite(input, ctx) {
@@ -24896,6 +26466,8 @@ var TIER1_TOOLS = [
   editTool,
   codebaseStatsTool,
   codebaseSearchTool,
+  codebaseIncomingCallsTool,
+  codebaseOutgoingCallsTool,
   codebaseIndexTool,
   bashTool,
   grepTool,
@@ -24946,6 +26518,8 @@ var builtinTools = [
   editTool,
   codebaseStatsTool,
   codebaseSearchTool,
+  codebaseIncomingCallsTool,
+  codebaseOutgoingCallsTool,
   codebaseIndexTool,
   deadCodeScanTool,
   replaceTool,