@wrongstack/tools 0.299.0 → 0.301.0

package/dist/index.js

@@ -724,7 +724,7 @@ var init_process_registry = __esm({
         const p = this.processes.get(pid);
         if (!p) return false;
         if (p.killed) return true;
-        if (p.protected) return false;
+        if (p.protected && opts.includeProtected !== true) return false;
         if (opts.preserveBackground && p.background) return false;
         const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
         const isWin5 = os.platform() === "win32";
@@ -775,9 +775,13 @@ var init_process_registry = __esm({
       killAll(opts = {}) {
         const pids = Array.from(this.processes.keys());
         const killed = [];
+        const includeProtected = opts.includeProtected === true;
         for (const pid of pids) {
           const p = this.processes.get(pid);
-          if (p && !p.protected && this.kill(pid, opts)) killed.push(pid);
+          if (!p) continue;
+          if (p.protected && !includeProtected) continue;
+          if (opts.preserveBackground && p.background) continue;
+          if (this.kill(pid, opts)) killed.push(pid);
         }
         return killed;
       }
@@ -1141,18 +1145,18 @@ async function resolveRealInsideRoot(absPath, ctx) {
   const realRoots = await Promise.all(
     allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path3.resolve(r)))
   );
-  let probe2 = absPath;
+  let probe = absPath;
   const pendingTail = [];
   for (; ; ) {
     let real;
     try {
-      real = await fsp2.realpath(probe2);
+      real = await fsp2.realpath(probe);
     } catch (err) {
       if (err.code === "ENOENT") {
-        const parent = path3.dirname(probe2);
-        if (parent === probe2) return absPath;
-        pendingTail.unshift(path3.basename(probe2));
-        probe2 = parent;
+        const parent = path3.dirname(probe);
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path3.basename(probe));
+        probe = parent;
         continue;
       }
       throw err;
@@ -4971,23 +4975,26 @@ var init_legacy_bridge = __esm({
 });
 
 // src/codebase-index/languages.ts
-import * as path18 from "node:path";
+import * as path13 from "node:path";
 function detectLang(file) {
-  const base = path18.basename(file);
+  const base = path13.basename(file);
   const lowerBase = base.toLowerCase();
   if (lowerBase.endsWith(".d.ts") || lowerBase.endsWith(".d.mts") || lowerBase.endsWith(".d.cts")) {
     return "ts";
   }
   const special = SPECIAL_FILENAMES[lowerBase];
   if (special) return special;
-  const ext = path18.extname(base).toLowerCase();
+  const ext = path13.extname(base).toLowerCase();
   if (!ext) return null;
   return EXT_TO_LANG[ext] ?? null;
 }
 function isIndexablePath(file) {
   return detectLang(file) !== null;
 }
-var EXT_TO_LANG, INDEXABLE_EXTENSIONS, SPECIAL_FILENAMES;
+function languageFamily(lang) {
+  return LANG_FAMILY[lang] ?? "other";
+}
+var EXT_TO_LANG, INDEXABLE_EXTENSIONS, SPECIAL_FILENAMES, LANG_FAMILY, LANG_FAMILY_ENTRIES;
 var init_languages2 = __esm({
   "src/codebase-index/languages.ts"() {
     "use strict";
@@ -5078,6 +5085,52 @@ var init_languages2 = __esm({
       procfile: "other",
       justfile: "other"
     };
+    LANG_FAMILY = {
+      // Single-compilation-unit family: a .vue/.svelte script block is JS/TS and
+      // imports from — and is imported by — plain .ts files.
+      ts: "js",
+      tsx: "js",
+      js: "js",
+      jsx: "js",
+      vue: "js",
+      svelte: "js",
+      go: "go",
+      py: "py",
+      rs: "rs",
+      // The JVM resolves across languages: Kotlin and Scala call Java directly.
+      java: "jvm",
+      kotlin: "jvm",
+      scala: "jvm",
+      csharp: "dotnet",
+      // A .h header is consumed by both C and C++ translation units.
+      c: "c",
+      cpp: "c",
+      ruby: "ruby",
+      php: "php",
+      swift: "swift",
+      dart: "dart",
+      elixir: "elixir",
+      haskell: "haskell",
+      zig: "zig",
+      lua: "lua",
+      r: "r",
+      shell: "shell",
+      sql: "sql",
+      json: "data",
+      yaml: "data",
+      toml: "data",
+      html: "web",
+      css: "web",
+      proto: "proto",
+      graphql: "graphql",
+      md: "other",
+      other: "other"
+    };
+    LANG_FAMILY_ENTRIES = Object.freeze(
+      Object.entries(LANG_FAMILY).map(
+        ([lang, family]) => Object.freeze([lang, family])
+      )
+    );
   }
 });
 
@@ -5242,7 +5295,7 @@ function getTypeName(name) {
 function deduplicateRefs(refs) {
   const seen = /* @__PURE__ */ new Set();
   return refs.filter((r) => {
-    const key = `${r.toName}:${r.callType}:${r.line}`;
+    const key = `${r.toName}:${r.callType}:${r.line}:${r.module ?? ""}`;
     if (seen.has(key)) return false;
     seen.add(key);
     return true;
@@ -5252,10 +5305,16 @@ function getImportSpecifierName(spec) {
   return spec.propertyName?.text ?? spec.name.text;
 }
 function emitImportSpecifierRefs(node, refs, lineNum) {
+  const module = moduleSpecifierOf(node.moduleSpecifier);
   const clause = node.importClause;
-  if (!clause) return;
+  if (!clause) {
+    if (module) {
+      refs.push({ fromId: 0, toName: module, callType: "import", line: lineNum, module });
+    }
+    return;
+  }
   if (clause.name) {
-    refs.push({ fromId: 0, toName: clause.name.text, callType: "import", line: lineNum });
+    refs.push({ fromId: 0, toName: clause.name.text, callType: "import", line: lineNum, module });
   }
   const bindings2 = clause.namedBindings;
   if (!bindings2) return;
@@ -5265,26 +5324,40 @@ function emitImportSpecifierRefs(node, refs, lineNum) {
         fromId: 0,
         toName: getImportSpecifierName(element),
         callType: "import",
-        line: lineNum
+        line: lineNum,
+        module
       });
     }
   } else if (ts.isNamespaceImport(bindings2)) {
-    refs.push({ fromId: 0, toName: bindings2.name.text, callType: "import", line: lineNum });
+    refs.push({
+      fromId: 0,
+      toName: bindings2.name.text,
+      callType: "import",
+      line: lineNum,
+      module
+    });
   }
 }
+function moduleSpecifierOf(node) {
+  return node && ts.isStringLiteral(node) ? node.text : void 0;
+}
 function emitExportSpecifierRefs(node, refs, lineNum) {
+  const module = moduleSpecifierOf(node.moduleSpecifier);
   const clause = node.exportClause;
   if (clause && ts.isNamespaceExport(clause)) {
-    refs.push({ fromId: 0, toName: clause.name.text, callType: "import", line: lineNum });
+    refs.push({ fromId: 0, toName: clause.name.text, callType: "import", line: lineNum, module });
     return;
   }
   if (clause && ts.isNamedExports(clause)) {
     for (const element of clause.elements) {
       const originalName = element.propertyName?.text ?? element.name.text;
-      refs.push({ fromId: 0, toName: originalName, callType: "import", line: lineNum });
+      refs.push({ fromId: 0, toName: originalName, callType: "import", line: lineNum, module });
     }
     return;
   }
+  if (module) {
+    refs.push({ fromId: 0, toName: module, callType: "import", line: lineNum, module });
+  }
 }
 var ts, tsLoad, kindMapCache;
 var init_ts_parser = __esm({
@@ -5296,6 +5369,82 @@ var init_ts_parser = __esm({
   }
 });
 
+// src/codebase-index/parser-output.ts
+function coerceSymbols(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry) => {
+    const candidate = entry;
+    if (typeof candidate.name !== "string" || typeof candidate.kind !== "string") return [];
+    return [
+      {
+        name: candidate.name,
+        kind: candidate.kind,
+        line: typeof candidate.line === "number" ? candidate.line : 1,
+        col: typeof candidate.col === "number" ? candidate.col : 0,
+        signature: typeof candidate.signature === "string" ? candidate.signature : "",
+        scope: typeof candidate.scope === "string" ? candidate.scope : ""
+      }
+    ];
+  });
+}
+function coerceRefs(value, lang) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry) => {
+    const candidate = entry;
+    if (typeof candidate.toName !== "string" || !candidate.toName) return [];
+    if (typeof candidate.callType !== "string" || !CALL_TYPES.has(candidate.callType)) return [];
+    const module = typeof candidate.module === "string" && candidate.module ? candidate.module : void 0;
+    return [
+      {
+        fromId: 0,
+        toName: candidate.toName,
+        callType: candidate.callType,
+        line: typeof candidate.line === "number" ? candidate.line : 1,
+        lang,
+        module
+      }
+    ];
+  });
+}
+function parseParserOutput(stdout, lang) {
+  const trimmed = stdout.trim();
+  if (!trimmed) return { symbols: [], refs: [] };
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return { symbols: [], refs: [] };
+  }
+  if (Array.isArray(parsed)) return { symbols: coerceSymbols(parsed), refs: [] };
+  const record = parsed;
+  return {
+    symbols: coerceSymbols(record.symbols),
+    refs: dedupeRefs(coerceRefs(record.refs, lang))
+  };
+}
+function dedupeRefs(refs) {
+  const seen = /* @__PURE__ */ new Set();
+  return refs.filter((ref) => {
+    const key = `${ref.toName}:${ref.callType}:${ref.line}:${ref.module ?? ""}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+var CALL_TYPES;
+var init_parser_output = __esm({
+  "src/codebase-index/parser-output.ts"() {
+    "use strict";
+    CALL_TYPES = /* @__PURE__ */ new Set([
+      "call",
+      "type_ref",
+      "inherit",
+      "implement",
+      "import"
+    ]);
+  }
+});
+
 // src/codebase-index/spawn-gate.ts
 function withSpawnGate(fn) {
   const run = chain.then(fn, fn);
@@ -5321,8 +5470,8 @@ __export(go_parser_exports, {
 });
 import { spawn as spawn5 } from "node:child_process";
 import * as os6 from "node:os";
-import * as path19 from "node:path";
-import * as fs14 from "node:fs/promises";
+import * as path20 from "node:path";
+import * as fs15 from "node:fs/promises";
 async function parseSymbols2(opts) {
   const { file, content, lang } = opts;
   try {
@@ -5330,7 +5479,8 @@ async function parseSymbols2(opts) {
     if (parsed.symbols.length > 0) {
       return parsed;
     }
-    return fallbackParse(file, content, lang);
+    const fallback = fallbackParse(file, content, lang);
+    return parsed.refs?.length ? { ...fallback, refs: parsed.refs } : fallback;
   } catch {
     return fallbackParse(file, content, lang);
   }
@@ -5394,9 +5544,9 @@ async function syncGoParse(filePath, content, lang) {
   try {
     let scriptPath = _cachedGoScriptPath;
     if (!scriptPath) {
-      const tmpDir = await fs14.mkdtemp(path19.join(os6.tmpdir(), "ws-go-parse-"));
-      scriptPath = path19.join(tmpDir, "parse.go");
-      await fs14.writeFile(scriptPath, GO_PARSE_SCRIPT, "utf8");
+      const tmpDir = await fs15.mkdtemp(path20.join(os6.tmpdir(), "ws-go-parse-"));
+      scriptPath = path20.join(tmpDir, "parse.go");
+      await fs15.writeFile(scriptPath, GO_PARSE_SCRIPT, "utf8");
       _cachedGoScriptPath = scriptPath;
     }
     const goBinary = resolveWin32Command("go");
@@ -5438,8 +5588,8 @@ async function syncGoParse(filePath, content, lang) {
     if (code !== 0 || !stdout.trim()) {
       return { file: filePath, lang, symbols: [], mtimeMs: Date.now() };
     }
-    const raw = JSON.parse(stdout.trim());
-    const symbols = raw.map((s) => ({
+    const { symbols: rawSymbols, refs } = parseParserOutput(stdout, lang);
+    const symbols = rawSymbols.map((s) => ({
       id: 0,
       lang,
       kind: s.kind,
@@ -5452,7 +5602,7 @@ async function syncGoParse(filePath, content, lang) {
       scope: s.scope ?? "",
       text: `${s.name} ${s.signature ?? ""}`.trim()
     }));
-    return { file: filePath, lang, symbols, mtimeMs: Date.now() };
+    return { file: filePath, lang, symbols, refs, mtimeMs: Date.now() };
   } catch {
     return { file: filePath, lang, symbols: [], mtimeMs: Date.now() };
   }
@@ -5462,6 +5612,7 @@ var init_go_parser = __esm({
   "src/codebase-index/go-parser.ts"() {
     "use strict";
     init_win32_resolve();
+    init_parser_output();
     init_spawn_gate();
     init_languages2();
     GO_PARSE_SCRIPT = `
@@ -5475,6 +5626,7 @@ import (
 	"go/token"
 	"io"
 	"os"
+	"strconv"
 	"strings"
 )
 
@@ -5487,16 +5639,34 @@ type Sym struct {
 	Scope     string \`json:"scope"\`
 }
 
+// Ref is a cross-reference emitted alongside the symbols, so one \`go run\`
+// yields both. Module is the import path for CallType "import", else empty.
+type Ref struct {
+	ToName   string \`json:"toName"\`
+	CallType string \`json:"callType"\`
+	Line     int    \`json:"line"\`
+	Module   string \`json:"module"\`
+}
+
+type Result struct {
+	Symbols []Sym \`json:"symbols"\`
+	Refs    []Ref \`json:"refs"\`
+}
+
+func emptyResult() string {
+	return "{\\"symbols\\":[],\\"refs\\":[]}"
+}
+
 func main() {
 	src, err := io.ReadAll(os.Stdin)
 	if err != nil {
-		fmt.Print("[]")
+		fmt.Print(emptyResult())
 		return
 	}
 	fset := token.NewFileSet()
 	node, err := parser.ParseFile(fset, "src.go", src, 0)
 	if err != nil {
-		fmt.Print("[]")
+		fmt.Print(emptyResult())
 		return
 	}
 
@@ -5560,9 +5730,43 @@ func main() {
 		}
 	}
 
-	data, err := json.Marshal(syms)
+	refs := []Ref{}
+	ast.Inspect(node, func(n ast.Node) bool {
+		switch expr := n.(type) {
+		case *ast.CallExpr:
+			line := fset.Position(expr.Pos()).Line
+			switch fun := expr.Fun.(type) {
+			case *ast.Ident:
+				refs = append(refs, Ref{ToName: fun.Name, CallType: "call", Line: line})
+			case *ast.SelectorExpr:
+				// Record the selected name (\`Join\` of \`filepath.Join\`): it is the
+				// declared symbol name, so it resolves the same way the TypeScript
+				// and Python extractors' call refs do.
+				refs = append(refs, Ref{ToName: fun.Sel.Name, CallType: "call", Line: line})
+			}
+		case *ast.ImportSpec:
+			if expr.Path != nil {
+				if importPath, uerr := strconv.Unquote(expr.Path.Value); uerr == nil {
+					line := fset.Position(expr.Pos()).Line
+					// A Go import names a package, not a symbol; the package's
+					// last path segment is the name it is referenced by.
+					name := importPath
+					if idx := strings.LastIndex(importPath, "/"); idx >= 0 {
+						name = importPath[idx+1:]
+					}
+					refs = append(refs, Ref{ToName: name, CallType: "import", Line: line, Module: importPath})
+				}
+			}
+		}
+		return true
+	})
+
+	if syms == nil {
+		syms = []Sym{}
+	}
+	data, err := json.Marshal(Result{Symbols: syms, Refs: refs})
 	if err != nil {
-		fmt.Print("[]")
+		fmt.Print(emptyResult())
 		return
 	}
 	fmt.Print(string(data))
@@ -5723,16 +5927,23 @@ function looksBinary(content) {
   }
   return bad / sample.length > 0.1;
 }
-function lineColAt(content, index) {
-  let line = 1;
-  let lastNl = -1;
-  for (let i = 0; i < index && i < content.length; i++) {
-    if (content.charCodeAt(i) === 10) {
-      line++;
-      lastNl = i;
-    }
+function newlineOffsets2(content) {
+  const offsets = [];
+  for (let i = 0; i < content.length; i++) {
+    if (content.charCodeAt(i) === 10) offsets.push(i);
   }
-  return { line, col: index - lastNl };
+  return offsets;
+}
+function lineColAt(offsets, index) {
+  let low = 0;
+  let high = offsets.length;
+  while (low < high) {
+    const mid = low + high >>> 1;
+    if ((offsets[mid] ?? 0) < index) low = mid + 1;
+    else high = mid;
+  }
+  const lastNl = low > 0 ? offsets[low - 1] : -1;
+  return { line: low + 1, col: index - lastNl };
 }
 function parseGeneric2(opts) {
   const { file, lang } = opts;
@@ -5745,6 +5956,7 @@ function parseGeneric2(opts) {
   const patterns = patternsFor(lang);
   const symbols = [];
   const seen = /* @__PURE__ */ new Set();
+  const nlOffsets = newlineOffsets2(content);
   for (const pattern of patterns) {
     const re = new RegExp(pattern.re.source, pattern.re.flags.includes("g") ? pattern.re.flags : `${pattern.re.flags}g`);
     re.lastIndex = 0;
@@ -5758,7 +5970,7 @@ function parseGeneric2(opts) {
       if (!/^[A-Za-z_#.@/\w][\w.\-:/#!?]*$/.test(name) && lang !== "md" && lang !== "toml") {
         continue;
       }
-      const { line, col } = lineColAt(content, match.index);
+      const { line, col } = lineColAt(nlOffsets, match.index ?? 0);
       const key = `${name}\0${line}\0${pattern.kind}`;
       if (seen.has(key)) continue;
       seen.add(key);
@@ -5914,9 +6126,13 @@ var init_generic_parser = __esm({
       ],
       elixir: [
         { re: /\bdef(?:p|macro|macrop)?\s+([A-Za-z_]\w*[!?]?)/g, kind: "function" },
-        { re: /\bdefmodule\s+([A-Za-z_.]\w*)/g, kind: "namespace" }
+        // Dotted module names must be captured whole: `alias Foo.Bar` resolves
+        // against this symbol, and a `Foo`-only capture never matches it.
+        { re: /\bdefmodule\s+([A-Z][\w.]*)/g, kind: "namespace" }
       ],
       haskell: [
+        // Target of `import Data.List`.
+        { re: /^module\s+([A-Z][\w.]*)/gm, kind: "namespace" },
         { re: /^([A-Za-z_]\w*)\s*::/gm, kind: "function" },
         { re: /\bdata\s+([A-Za-z_]\w*)/g, kind: "type" },
         { re: /\btype\s+(?:family\s+)?([A-Za-z_]\w*)/g, kind: "type" },
@@ -6007,9 +6223,9 @@ __export(py_parser_exports, {
   parseSymbols: () => parseSymbols4
 });
 import { spawn as spawn6 } from "node:child_process";
-import * as fs15 from "node:fs/promises";
+import * as fs16 from "node:fs/promises";
 import * as os7 from "node:os";
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 async function parseSymbols4(opts) {
   const { file, content, lang } = opts;
   try {
@@ -6087,10 +6303,10 @@ function spawnPyParser(pyBinary, scriptPath, filePath, content) {
 async function syncPyParse(filePath, content, lang) {
   try {
     if (!_cachedScriptPath) {
-      const tmpDir = path20.join(os7.tmpdir(), "ws-py-parse");
-      await fs15.mkdir(tmpDir, { recursive: true });
-      _cachedScriptPath = path20.join(tmpDir, "parse.py");
-      await fs15.writeFile(_cachedScriptPath, PY_PARSE_SCRIPT, "utf8");
+      const tmpDir = path21.join(os7.tmpdir(), "ws-py-parse");
+      await fs16.mkdir(tmpDir, { recursive: true });
+      _cachedScriptPath = path21.join(tmpDir, "parse.py");
+      await fs16.writeFile(_cachedScriptPath, PY_PARSE_SCRIPT, "utf8");
     }
     cachedPyBinary ??= resolvePython();
     const pyBinary = await cachedPyBinary;
@@ -6104,7 +6320,7 @@ async function syncPyParse(filePath, content, lang) {
     if (code !== 0 || !stdout.trim()) {
       return { file: filePath, lang, symbols: [], mtimeMs: Date.now() };
     }
-    const raw = JSON.parse(stdout.trim());
+    const { symbols: raw, refs } = parseParserOutput(stdout, lang);
     const symbols = raw.map((s) => ({
       id: 0,
       lang,
@@ -6118,7 +6334,7 @@ async function syncPyParse(filePath, content, lang) {
       scope: s.scope ?? "",
       text: `${s.name} ${s.signature ?? ""}`.trim()
     }));
-    return { file: filePath, lang, symbols, mtimeMs: Date.now() };
+    return { file: filePath, lang, symbols, refs, mtimeMs: Date.now() };
   } catch {
     return null;
   }
@@ -6129,6 +6345,7 @@ var init_py_parser = __esm({
     "use strict";
     init_win32_resolve();
     init_generic_parser();
+    init_parser_output();
     init_spawn_gate();
     init_languages2();
     PY_PARSE_SCRIPT = `import ast, json, sys, os
@@ -6190,7 +6407,18 @@ class Sym:
 def is_private(name):
     return name.startswith("__") and not name.endswith("__")
 
+def leaf_name(node):
+    # Declared name of the callee: \`join\` of \`os.path.join\`. Matches how the
+    # TypeScript and Go extractors record call refs, so resolution behaves the
+    # same across languages.
+    if isinstance(node, ast.Attribute):
+        return node.attr
+    if isinstance(node, ast.Name):
+        return node.id
+    return get_name(node).split(".")[-1]
+
 syms = []
+refs = []
 errors = []
 
 try:
@@ -6198,7 +6426,7 @@ try:
     tree = ast.parse(source, filename=sys.argv[1])
 except Exception as e:
     errors.append(str(e))
-    print("[]")
+    print(json.dumps({"symbols": [], "refs": []}))
     sys.exit(0)
 
 # Module-level scope
@@ -6332,7 +6560,42 @@ class ModuleVisitor(ast.NodeVisitor):
 visitor = ModuleVisitor()
 visitor.visit(tree)
 
-print(json.dumps([s.to_dict() for s in syms]))
+# Refs need a separate full walk: ModuleVisitor deliberately does not descend
+# into function bodies (it would index locals as symbols), but that is exactly
+# where the calls are.
+for node in ast.walk(tree):
+    if isinstance(node, ast.Call):
+        name = leaf_name(node.func)
+        if name:
+            refs.append({"toName": name, "callType": "call", "line": node.lineno})
+    elif isinstance(node, ast.Import):
+        for alias in node.names:
+            refs.append({
+                "toName": alias.name.split(".")[-1],
+                "callType": "import",
+                "line": node.lineno,
+                "module": alias.name,
+            })
+    elif isinstance(node, ast.ImportFrom):
+        # PEP 328: node.level is the number of leading dots. Preserving them is
+        # what lets the resolver walk up from the importing file's package \u2014
+        # dropping them made \`from .foo import X\` indistinguishable from an
+        # absolute \`foo\`.
+        module = ("." * (node.level or 0)) + (node.module or "")
+        for alias in node.names:
+            refs.append({
+                "toName": alias.name,
+                "callType": "import",
+                "line": node.lineno,
+                "module": module,
+            })
+    elif isinstance(node, ast.ClassDef):
+        for base in node.bases:
+            name = leaf_name(base)
+            if name:
+                refs.append({"toName": name, "callType": "inherit", "line": node.lineno})
+
+print(json.dumps({"symbols": [s.to_dict() for s in syms], "refs": refs}))
 `;
     _cachedScriptPath = null;
   }
@@ -6345,107 +6608,10 @@ __export(rs_parser_exports, {
   parseSymbols: () => parseSymbols5
 });
 import { expectDefined as expectDefined3 } from "@wrongstack/core/utils";
-import { execFile, spawn as spawn7 } from "node:child_process";
-import * as fs16 from "node:fs/promises";
-import * as path21 from "node:path";
 async function parseSymbols5(opts) {
   const { file, content, lang } = opts;
-  const nativeAvailable = await checkNativeParser();
-  if (nativeAvailable) {
-    const result = await withSpawnGate(() => tryNativeParse(file, content));
-    if (result) return result;
-  }
   return regexParse({ file, content, lang });
 }
-function probe(command, args) {
-  return new Promise((resolve17, reject) => {
-    execFile(command, args, { timeout: 1e4, windowsHide: true }, (error) => {
-      if (error) reject(error);
-      else resolve17();
-    });
-  });
-}
-function checkNativeParser() {
-  nativeParserAvailability ??= (async () => {
-    try {
-      await probe("rustc", ["--version"]);
-      const toolsDir = path21.join(process.cwd(), "tools");
-      await probe(
-        "cargo",
-        [
-          "metadata",
-          "--no-deps",
-          "--format-version",
-          "1",
-          "--manifest-path",
-          path21.join(toolsDir, "Cargo.toml")
-        ]
-      );
-      return true;
-    } catch {
-      return false;
-    }
-  })();
-  return nativeParserAvailability;
-}
-async function tryNativeParse(file, content) {
-  try {
-    const toolsDir = path21.join(process.cwd(), "tools");
-    const crateDir = path21.join(toolsDir, "syn-parser");
-    const tmpFile = path21.join(crateDir, "src", "input.rs");
-    await fs16.writeFile(tmpFile, content, "utf8");
-    const cargoBinary = resolveWin32Command("cargo");
-    const result = await new Promise(
-      (resolve17, reject) => {
-        let settled = false;
-        const proc = spawn7(
-          cargoBinary,
-          ["run", "--manifest-path", path21.join(toolsDir, "Cargo.toml")],
-          {
-            cwd: process.cwd(),
-            stdio: ["pipe", "pipe", "pipe"],
-            windowsHide: true
-          }
-        );
-        proc.on("error", (err) => {
-          if (settled) return;
-          settled = true;
-          reject(err);
-        });
-        let stdout2 = "";
-        proc.stdout?.on("data", (chunk) => {
-          stdout2 += chunk.toString();
-        });
-        proc.stderr?.resume();
-        const timer = setTimeout(() => {
-          if (settled) return;
-          settled = true;
-          proc.kill("SIGKILL");
-          reject(new Error("timeout"));
-        }, 15e3);
-        timer.unref?.();
-        proc.on("close", (c) => {
-          if (settled) return;
-          settled = true;
-          clearTimeout(timer);
-          resolve17({ code: c, stdout: stdout2 });
-        });
-      }
-    );
-    const { code, stdout } = result;
-    if (code === 0 && stdout.trim()) {
-      const symbols = JSON.parse(stdout.trim());
-      return {
-        file,
-        lang: "rs",
-        symbols: symbols.map((s) => ({ ...s, id: 0, lang: "rs" })),
-        mtimeMs: Date.now()
-      };
-    }
-  } catch {
-  }
-  return null;
-}
 function regexParse(opts) {
   const { file, content, lang } = opts;
   const symbols = [];
@@ -6501,12 +6667,10 @@ function regexParse(opts) {
   });
   return { file, lang, symbols: deduped, mtimeMs: Date.now() };
 }
-var nativeParserAvailability, RS_PATTERNS;
+var RS_PATTERNS;
 var init_rs_parser = __esm({
   "src/codebase-index/rs-parser.ts"() {
     "use strict";
-    init_win32_resolve();
-    init_spawn_gate();
     init_languages2();
     RS_PATTERNS = [
       { regex: /fn\s+(\w+)\s*\([^)]*\)/g, kind: "function" },
@@ -8959,7 +9123,9 @@ async function executeSingle(call, ctx, governedExecute) {
       executionMs: Date.now() - start
     };
   }
-  const tool = ctx.tools.find((candidate) => candidate.name === call.tool);
+  const tool = (ctx.catalogTools ?? ctx.tools).find(
+    (candidate) => candidate.name === call.tool
+  );
   if (!tool) {
     return {
       tool: call.tool,
@@ -9181,7 +9347,7 @@ function parsePrivateOriginAllowlist(raw) {
   if (!raw?.trim()) return [];
   const origins = /* @__PURE__ */ new Set();
   for (const entry of raw.split(",")) {
-    const candidate = entry.trim();
+    const candidate = entry.trim().replace(/^["']+|["']+$/gu, "");
     if (!candidate) continue;
     const url = parseBrowserUrl(candidate, true);
     if (url.pathname !== "/" || url.search || url.hash) {
@@ -10321,7 +10487,7 @@ async function shutdownBrowserTools() {
 
 // src/codebase-index/project-server-client.ts
 import { spawn as spawn4 } from "node:child_process";
-import * as fs12 from "node:fs";
+import * as fs13 from "node:fs";
 import * as net3 from "node:net";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { checkUnixSocketPath } from "@wrongstack/core/utils";
@@ -10411,23 +10577,23 @@ function resetIndexCircuitBreaker() {
 
 // src/codebase-index/project-server-endpoint.ts
 import { createHash as createHash4 } from "node:crypto";
-import * as fs11 from "node:fs";
+import * as fs12 from "node:fs";
 import * as os5 from "node:os";
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertUnixSocketPathWithinLimit } from "@wrongstack/core/utils";
 
 // src/codebase-index/writer.ts
 import { expectDefined as expectDefined2 } from "@wrongstack/core/utils";
-import * as fs10 from "node:fs";
-import * as path15 from "node:path";
+import * as fs11 from "node:fs";
+import * as path16 from "node:path";
 
 // src/codebase-index/bm25.ts
 var K1 = 1.5;
 var B = 0.75;
+var TOKENISE_RE = new RegExp("[^\\p{L}\\p{N}$']", "gu");
 function tokenise(text) {
-  const sanitised = text.replace(/[^\p{L}\p{N}$'_]/gu, " ").replace(/_/g, " ");
-  return sanitised.toLowerCase().split(" ").filter(Boolean);
+  return text.replace(TOKENISE_RE, " ").toLowerCase().trim().split(/\s+/).filter(Boolean);
 }
 function splitName(name) {
   return name.replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").replace(/([a-z\d])([A-Z])/g, "$1 $2").replace(/([\p{L}])(\d)/gu, "$1 $2").replace(/(\d)([\p{L}])/gu, "$1 $2").replace(/[_-]+/g, " ").trim();
@@ -10511,6 +10677,9 @@ var Bm25Index = class {
   }
 };
 
+// src/codebase-index/writer.ts
+init_languages2();
+
 // src/codebase-index/lsp-kind.ts
 function lspKindToInternalKind(k) {
   switch (k) {
@@ -10545,7 +10714,7 @@ function lspKindToInternalKind(k) {
 }
 
 // src/codebase-index/schema.ts
-var SCHEMA_VERSION = 3;
+var SCHEMA_VERSION = 4;
 
 // src/codebase-index/sqlite-runtime.ts
 import { createRequire } from "node:module";
@@ -10616,7 +10785,7 @@ function runSqliteWithRetry(fn) {
 
 // src/codebase-index/writer-admin.ts
 import * as fs9 from "node:fs";
-import * as path13 from "node:path";
+import * as path14 from "node:path";
 var DB_FILE = "index.db";
 function getAllIndexableWithStatement(stmt) {
   return stmt("SELECT id, text FROM symbols").all().map(({ id, text }) => ({ id, text }));
@@ -10675,7 +10844,7 @@ function getAllFileMetasWithStatement(stmt) {
 }
 function getIndexDbSizeBytes(indexDir) {
   try {
-    return fs9.statSync(path13.join(indexDir, DB_FILE)).size;
+    return fs9.statSync(path14.join(indexDir, DB_FILE)).size;
   } catch {
     return 0;
   }
@@ -10726,49 +10895,345 @@ function bulkInsertFtsWithStatement(stmt, maxSqlVars, ftsAvailable, rows) {
 }
 function bulkInsertRefsWithStatement(stmt, maxSqlVars, refs) {
   if (refs.length === 0) return;
-  const chunkSize = Math.max(1, Math.floor(maxSqlVars / 5));
+  const chunkSize = Math.max(1, Math.floor(maxSqlVars / 8));
   for (let i = 0; i < refs.length; i += chunkSize) {
     const chunk = refs.slice(i, i + chunkSize);
-    const placeholders = chunk.map(() => "(?, ?, ?, ?, ?)").join(", ");
+    const placeholders = chunk.map(() => "(?, ?, ?, ?, ?, ?, ?, ?)").join(", ");
     const insert = stmt(
-      `INSERT INTO refs(from_id, to_name, to_id, call_type, line) VALUES ${placeholders}`
+      `INSERT INTO refs(from_id, to_name, to_id, call_type, line, lang, module, to_file)
+       VALUES ${placeholders}`
     );
     const binds = [];
     for (const ref of chunk) {
-      binds.push(ref.fromId, ref.toName, ref.toId ?? null, ref.callType, ref.line);
+      binds.push(
+        ref.fromId,
+        ref.toName,
+        ref.toId ?? null,
+        ref.callType,
+        ref.line,
+        ref.lang ?? "",
+        ref.module ?? null,
+        ref.toFile ?? null
+      );
     }
     insert.run(...binds);
   }
 }
 
-// src/codebase-index/writer-graph-helpers.ts
-import * as path14 from "node:path";
-function derivePackage(filePath) {
-  const f = filePath.replace(/\\/g, "/");
-  const pkgsIdx = f.indexOf("/packages/");
-  if (pkgsIdx !== -1) {
-    const rest = f.slice(pkgsIdx + "/packages/".length);
-    const seg = rest.split("/")[0];
-    return seg ? `@wrongstack/${seg}` : void 0;
-  }
-  const appsIdx = f.indexOf("/apps/");
+// src/codebase-index/writer-graph-reader.ts
+init_languages2();
+
+// src/codebase-index/module-roots.ts
+init_languages2();
+import * as fs10 from "node:fs/promises";
+import * as path15 from "node:path";
+function toPortablePath(file) {
+  return file.replace(/\\/g, "/");
+}
+async function readTextIfPresent(file) {
+  try {
+    return await fs10.readFile(file, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function parsePackageJsonName(source) {
+  try {
+    const parsed = JSON.parse(source);
+    return typeof parsed.name === "string" && parsed.name ? parsed.name : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function parseGoModulePath(source) {
+  for (const rawLine of source.split(/\r?\n/)) {
+    const line = rawLine.replace(/\/\/.*$/, "").trim();
+    const match = /^module\s+(\S+)/.exec(line);
+    if (match?.[1]) return match[1].replace(/^["']|["']$/g, "");
+  }
+  return void 0;
+}
+function parseTomlTableName(source, tables) {
+  let current = "";
+  for (const rawLine of source.split(/\r?\n/)) {
+    const line = rawLine.replace(/#.*$/, "").trim();
+    if (line.startsWith("[[")) {
+      current = "\0";
+      continue;
+    }
+    const table = /^\[([^\]]+)\]$/.exec(line);
+    if (table?.[1]) {
+      current = table[1].trim();
+      continue;
+    }
+    if (!tables.includes(current)) continue;
+    const match = /^name\s*=\s*["']([^"']+)["']/.exec(line);
+    if (match?.[1]) return match[1];
+  }
+  return void 0;
+}
+function parsePomArtifactId(source) {
+  const withoutParent = source.replace(/<parent>[\s\S]*?<\/parent>/g, "");
+  return /<artifactId>\s*([^<\s]+)\s*<\/artifactId>/.exec(withoutParent)?.[1];
+}
+var LANGS_BY_KIND = {
+  npm: ["ts", "tsx", "js", "jsx", "vue", "svelte"],
+  cargo: ["rs"],
+  go: ["go"],
+  python: ["py"],
+  maven: ["java", "kotlin", "scala"],
+  gradle: ["java", "kotlin", "scala"],
+  dotnet: ["csharp"]
+};
+function ancestorsOf(dir, stopAt) {
+  const out = [];
+  let current = dir;
+  for (; ; ) {
+    out.push(current);
+    if (current === stopAt || current.length <= stopAt.length) break;
+    const parent = path15.posix.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return out;
+}
+var MARKER_PROBES = [
+  {
+    kind: "npm",
+    file: "package.json",
+    build: (dir, source) => {
+      const name = parsePackageJsonName(source) ?? path15.posix.basename(dir);
+      return { name, importPath: name, sourceRoots: [dir] };
+    }
+  },
+  {
+    kind: "cargo",
+    file: "Cargo.toml",
+    build: (dir, source) => {
+      const name = parseTomlTableName(source, ["package"]);
+      if (!name) return void 0;
+      return {
+        name: `crate:${name}`,
+        // Rust paths use underscores where crate names often use dashes.
+        importPath: name.replace(/-/g, "_"),
+        sourceRoots: [path15.posix.join(dir, "src")]
+      };
+    }
+  },
+  {
+    kind: "go",
+    file: "go.mod",
+    build: (dir, source) => {
+      const modulePath = parseGoModulePath(source);
+      if (!modulePath) return void 0;
+      return { name: `go:${modulePath}`, importPath: modulePath, sourceRoots: [dir] };
+    }
+  },
+  {
+    kind: "python",
+    file: "pyproject.toml",
+    build: (dir, source) => {
+      const name = parseTomlTableName(source, ["project", "tool.poetry"]) ?? path15.posix.basename(dir);
+      return {
+        name: `py:${name}`,
+        importPath: void 0,
+        // `src/` layout is the packaging-guide default; the root itself covers
+        // the flat layout. Both are probed, missing ones simply never match.
+        sourceRoots: [path15.posix.join(dir, "src"), dir]
+      };
+    }
+  },
+  {
+    kind: "python",
+    file: "setup.py",
+    build: (dir) => ({
+      name: `py:${path15.posix.basename(dir)}`,
+      importPath: void 0,
+      sourceRoots: [path15.posix.join(dir, "src"), dir]
+    })
+  },
+  {
+    kind: "maven",
+    file: "pom.xml",
+    build: (dir, source) => {
+      const artifactId = parsePomArtifactId(source) ?? path15.posix.basename(dir);
+      return {
+        name: `mvn:${artifactId}`,
+        importPath: void 0,
+        sourceRoots: [
+          path15.posix.join(dir, "src/main/java"),
+          path15.posix.join(dir, "src/main/kotlin"),
+          path15.posix.join(dir, "src/main/scala"),
+          path15.posix.join(dir, "src/test/java")
+        ]
+      };
+    }
+  },
+  {
+    kind: "gradle",
+    file: "build.gradle",
+    build: (dir) => buildGradleRoot(dir)
+  },
+  {
+    kind: "gradle",
+    file: "build.gradle.kts",
+    build: (dir) => buildGradleRoot(dir)
+  }
+];
+function buildGradleRoot(dir) {
+  return {
+    name: `gradle:${path15.posix.basename(dir)}`,
+    importPath: void 0,
+    sourceRoots: [
+      path15.posix.join(dir, "src/main/java"),
+      path15.posix.join(dir, "src/main/kotlin"),
+      path15.posix.join(dir, "src/main/scala")
+    ]
+  };
+}
+async function probeDotnetRoot(dir) {
+  let entries;
+  try {
+    entries = await fs10.readdir(dir);
+  } catch {
+    return void 0;
+  }
+  const project = entries.find((entry) => entry.toLowerCase().endsWith(".csproj"));
+  if (!project) return void 0;
+  const name = project.slice(0, -".csproj".length);
+  return {
+    dir,
+    kind: "dotnet",
+    name: `csproj:${name}`,
+    importPath: void 0,
+    sourceRoots: [dir]
+  };
+}
+async function detectModuleRoots(projectRoot, files) {
+  const root = toPortablePath(projectRoot).replace(/\/+$/, "");
+  const langsByDir = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const portable = toPortablePath(file);
+    const lang = detectLang(portable);
+    if (!lang) continue;
+    const dir = path15.posix.dirname(portable);
+    let langs = langsByDir.get(dir);
+    if (!langs) {
+      langs = /* @__PURE__ */ new Set();
+      langsByDir.set(dir, langs);
+    }
+    langs.add(lang);
+  }
+  const candidates = /* @__PURE__ */ new Map();
+  for (const [dir, langs] of langsByDir) {
+    for (const ancestor of ancestorsOf(dir, root)) {
+      let merged = candidates.get(ancestor);
+      if (!merged) {
+        merged = /* @__PURE__ */ new Set();
+        candidates.set(ancestor, merged);
+      }
+      for (const lang of langs) merged.add(lang);
+    }
+  }
+  const roots = [];
+  await Promise.all(
+    [...candidates].map(async ([dir, langs]) => {
+      for (const probe of MARKER_PROBES) {
+        if (!LANGS_BY_KIND[probe.kind].some((lang) => langs.has(lang))) continue;
+        const source = await readTextIfPresent(path15.posix.join(dir, probe.file));
+        if (source === void 0) continue;
+        const built = probe.build(dir, source);
+        if (built) roots.push({ dir, kind: probe.kind, ...built });
+      }
+      if (LANGS_BY_KIND.dotnet.some((lang) => langs.has(lang))) {
+        const dotnet = await probeDotnetRoot(dir);
+        if (dotnet) roots.push(dotnet);
+      }
+    })
+  );
+  roots.sort((a, b) => b.dir.length - a.dir.length || a.dir.localeCompare(b.dir));
+  return { projectRoot: root, roots };
+}
+function findOwningRoot(structure, file, kinds) {
+  const portable = toPortablePath(file);
+  for (const root of structure.roots) {
+    if (kinds && !kinds.includes(root.kind)) continue;
+    if (portable === root.dir || portable.startsWith(`${root.dir}/`)) return root;
+  }
+  return void 0;
+}
+function derivePackageFromLayout(filePath) {
+  const portable = toPortablePath(filePath);
+  const packagesIdx = portable.indexOf("/packages/");
+  if (packagesIdx !== -1) {
+    const segment = portable.slice(packagesIdx + "/packages/".length).split("/")[0];
+    if (segment) return `@wrongstack/${segment}`;
+  }
+  const appsIdx = portable.indexOf("/apps/");
   if (appsIdx !== -1) {
-    const rest = f.slice(appsIdx + "/apps/".length);
-    const seg = rest.split("/")[0];
-    return seg ? `app:${seg}` : void 0;
+    const segment = portable.slice(appsIdx + "/apps/".length).split("/")[0];
+    if (segment) return `app:${segment}`;
   }
   return void 0;
 }
-function packageFromImport(moduleName) {
-  if (!moduleName.startsWith("@wrongstack/")) return void 0;
-  const parts = moduleName.split("/");
-  return parts[1] ? `@wrongstack/${parts[1]}` : void 0;
+function pythonPackageLabel(structure, file, initDirs) {
+  const portable = toPortablePath(file);
+  const dir = path15.posix.dirname(portable);
+  if (!initDirs.has(dir)) return void 0;
+  const segments = [];
+  let current = dir;
+  while (initDirs.has(current) && current.length > structure.projectRoot.length) {
+    segments.unshift(path15.posix.basename(current));
+    current = path15.posix.dirname(current);
+  }
+  return segments.length > 0 ? `py:${segments.join(".")}` : void 0;
 }
-function buildPackageGraphNodes(fileCounts, files) {
+function assignPackageLabels(structure, files) {
+  const initDirs = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    const portable = toPortablePath(file);
+    if (path15.posix.basename(portable) === "__init__.py") {
+      initDirs.add(path15.posix.dirname(portable));
+    }
+  }
+  const labels = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const portable = toPortablePath(file);
+    const lang = detectLang(portable);
+    if (lang === "go") {
+      const owner3 = findOwningRoot(structure, portable, ["go"]);
+      const dir = path15.posix.dirname(portable);
+      if (owner3?.importPath) {
+        const relative13 = path15.posix.relative(owner3.dir, dir);
+        labels.set(file, relative13 ? `${owner3.importPath}/${relative13}` : owner3.importPath);
+      } else {
+        labels.set(file, `go:${path15.posix.relative(structure.projectRoot, dir) || "."}`);
+      }
+      continue;
+    }
+    if (lang === "py") {
+      const dotted = pythonPackageLabel(structure, portable, initDirs);
+      if (dotted) {
+        labels.set(file, dotted);
+        continue;
+      }
+    }
+    const owner2 = findOwningRoot(structure, portable);
+    const label = owner2?.name ?? derivePackageFromLayout(portable) ?? "(root)";
+    labels.set(file, label);
+  }
+  return labels;
+}
+
+// src/codebase-index/writer-graph-helpers.ts
+function createPackageLabeller(stored) {
+  return (file) => stored.get(file) ?? derivePackageFromLayout(file) ?? "(root)";
+}
+function buildPackageGraphNodes(fileCounts, files, packageOf) {
   const pkgNodes = /* @__PURE__ */ new Map();
   const fileToPkg = /* @__PURE__ */ new Map();
   for (const { file, n } of fileCounts) {
-    const pkg = derivePackage(file) ?? "(root)";
+    const pkg = packageOf(file);
     fileToPkg.set(file, pkg);
     const node = pkgNodes.get(pkg);
     if (node) {
@@ -10785,7 +11250,7 @@ function buildPackageGraphNodes(fileCounts, files) {
     }
   }
   for (const { file } of files) {
-    const pkg = derivePackage(file) ?? "(root)";
+    const pkg = packageOf(file);
     fileToPkg.set(file, pkg);
     const node = pkgNodes.get(pkg);
     if (node) {
@@ -10803,7 +11268,7 @@ function buildPackageGraphNodes(fileCounts, files) {
   }
   return { pkgNodes, fileToPkg };
 }
-function buildFileGraphNodeState(pkgSyms, localFiles) {
+function buildFileGraphNodeState(pkgSyms, localFiles, packageOf) {
   const fileNodes = /* @__PURE__ */ new Map();
   const symToFile = /* @__PURE__ */ new Map();
   const fileStats = /* @__PURE__ */ new Map();
@@ -10822,7 +11287,7 @@ function buildFileGraphNodeState(pkgSyms, localFiles) {
       id: `file:${file}`,
       label: file.replace(/\\/g, "/").split("/").pop() ?? file,
       kind: "file",
-      package: derivePackage(file) ?? "(root)",
+      package: packageOf(file),
       file,
       symbolCount: stats?.count ?? 0,
       lang: stats?.lang,
@@ -10834,7 +11299,7 @@ function buildFileGraphNodeState(pkgSyms, localFiles) {
   }
   return { fileNodes, symToFile, fileStats, ensureFileNode };
 }
-function buildSymbolGraphNodes(symById, relatedIds, fileFilter) {
+function buildSymbolGraphNodes(symById, relatedIds, fileFilter, packageOf) {
   return [...relatedIds].map((id) => symById.get(id)).filter((symbol) => symbol !== void 0).sort((a, b) => {
     const aExternal = a.file === fileFilter ? 0 : 1;
     const bExternal = b.file === fileFilter ? 0 : 1;
@@ -10846,7 +11311,7 @@ function buildSymbolGraphNodes(symById, relatedIds, fileFilter) {
     symbolId: s.id,
     symbolKind: s.kind,
     file: s.file,
-    package: derivePackage(s.file) ?? "(root)",
+    package: packageOf(s.file),
     lang: s.lang,
     line: s.line,
     signature: s.signature,
@@ -10854,29 +11319,6 @@ function buildSymbolGraphNodes(symById, relatedIds, fileFilter) {
     external: s.file !== fileFilter
   }));
 }
-function resolveRelativeImport(fromFile, moduleName, indexedFiles) {
-  if (!moduleName.startsWith(".")) return void 0;
-  const normalizedFrom = fromFile.replace(/\\/g, "/");
-  const absolute = path14.posix.normalize(
-    path14.posix.join(path14.posix.dirname(normalizedFrom), moduleName)
-  );
-  const extension = path14.posix.extname(absolute);
-  const base = extension ? absolute.slice(0, -extension.length) : absolute;
-  const candidates = [
-    absolute,
-    ...[".ts", ".tsx", ".js", ".jsx", ".mts", ".cts"].map((ext) => `${base}${ext}`),
-    ...[".ts", ".tsx", ".js", ".jsx"].map((ext) => path14.posix.join(absolute, `index${ext}`)),
-    ...[".ts", ".tsx", ".js", ".jsx"].map((ext) => path14.posix.join(base, `index${ext}`))
-  ];
-  const indexedByPortablePath = new Map(
-    [...indexedFiles].map((file) => [file.replace(/\\/g, "/").toLocaleLowerCase(), file])
-  );
-  for (const candidate of candidates) {
-    const indexed = indexedByPortablePath.get(candidate.toLocaleLowerCase());
-    if (indexed) return indexed;
-  }
-  return void 0;
-}
 function addWeightedEdge(edgeMap, source, target, callType, weight) {
   const key = `${source}\0${target}`;
   let edge = edgeMap.get(key);
@@ -10917,7 +11359,12 @@ function mapWriterRefRow(row) {
     toName: row.to_name,
     toId: row.to_id ?? void 0,
     callType: row.call_type,
-    line: row.line
+    line: row.line,
+    // `lang`/`module`/`to_file` are absent from the narrower column lists some
+    // queries select; `undefined` keeps those rows valid Refs.
+    lang: row.lang || void 0,
+    module: row.module ?? void 0,
+    toFile: row.to_file ?? void 0
   };
 }
 
@@ -11065,7 +11512,8 @@ function findRefsFromWithStatement(stmt, symbolId) {
 function getPackageGraphWithStatement(stmt) {
   const fileCounts = stmt("SELECT file, COUNT(*) AS n FROM symbols GROUP BY file").all();
   const files = stmt("SELECT DISTINCT file FROM files").all();
-  const { pkgNodes, fileToPkg } = buildPackageGraphNodes(fileCounts, files);
+  const packageOf = readPackageLabeller(stmt);
+  const { pkgNodes, fileToPkg } = buildPackageGraphNodes(fileCounts, files, packageOf);
   const refRows = stmt(
     `SELECT r.call_type, sf.file AS from_file, st.file AS to_file, COUNT(*) AS n
        FROM refs r
@@ -11076,32 +11524,42 @@ function getPackageGraphWithStatement(stmt) {
   ).all();
   const edgeMap = /* @__PURE__ */ new Map();
   for (const r of refRows) {
-    const fromPkg = fileToPkg.get(r.from_file) ?? derivePackage(r.from_file) ?? "(root)";
-    const toPkg = fileToPkg.get(r.to_file) ?? derivePackage(r.to_file) ?? "(root)";
+    const fromPkg = fileToPkg.get(r.from_file) ?? packageOf(r.from_file);
+    const toPkg = fileToPkg.get(r.to_file) ?? packageOf(r.to_file);
     if (fromPkg === toPkg) continue;
     const n = Number(r.n) || 0;
     addWeightedEdge(edgeMap, fromPkg, toPkg, r.call_type, n);
   }
   const importRows = stmt(
-    `SELECT r.to_name, s.file AS from_file, COUNT(*) AS n
+    `SELECT s.file AS from_file,
+            COALESCE(r.to_file, st.file) AS to_file,
+            COUNT(*) AS n
        FROM refs r
        JOIN symbols s ON s.id = r.from_id
+       LEFT JOIN symbols st ON st.id = r.to_id
        WHERE r.call_type = 'import'
-       GROUP BY r.to_name, s.file`
+         AND COALESCE(r.to_file, st.file) IS NOT NULL
+       GROUP BY s.file, COALESCE(r.to_file, st.file)`
   ).all();
   for (const r of importRows) {
-    const fromPkg = fileToPkg.get(r.from_file) ?? derivePackage(r.from_file) ?? "(root)";
-    const toPkg = packageFromImport(r.to_name);
-    if (!fromPkg || !toPkg || fromPkg === toPkg || !pkgNodes.has(toPkg)) continue;
+    const fromPkg = fileToPkg.get(r.from_file) ?? packageOf(r.from_file);
+    const toPkg = fileToPkg.get(r.to_file) ?? packageOf(r.to_file);
+    if (fromPkg === toPkg || !pkgNodes.has(toPkg)) continue;
     const n = Number(r.n) || 0;
     addWeightedEdge(edgeMap, fromPkg, toPkg, "import", n);
   }
   const edges = materializeWeightedEdges(edgeMap, "pkg");
   return { nodes: [...pkgNodes.values()], edges };
 }
+function readPackageLabeller(stmt) {
+  const rows = stmt("SELECT file, package FROM files WHERE package != ''").all();
+  return createPackageLabeller(new Map(rows.map((row) => [row.file, row.package])));
+}
 function getFileGraphWithStatement(stmt, packageFilter) {
   const allFiles = stmt("SELECT DISTINCT file FROM symbols").all();
-  const pkgFilePaths = allFiles.filter((f) => (derivePackage(f.file) ?? "(root)") === packageFilter).map((f) => f.file);
+  const packageOf = readPackageLabeller(stmt);
+  const langOf = (file) => detectLang(file) ?? "other";
+  const pkgFilePaths = allFiles.filter((f) => packageOf(f.file) === packageFilter).map((f) => f.file);
   const localFiles = new Set(pkgFilePaths);
   if (localFiles.size === 0) return { nodes: [], edges: [] };
   const filePlaceholders = [...localFiles].map(() => "?").join(",");
@@ -11110,9 +11568,9 @@ function getFileGraphWithStatement(stmt, packageFilter) {
   ).all(...pkgFilePaths);
   const { fileNodes, symToFile, fileStats, ensureFileNode } = buildFileGraphNodeState(
     pkgSyms,
-    localFiles
+    localFiles,
+    packageOf
   );
-  const indexedFiles = new Set(allFiles.map((f) => f.file));
   const refRows = stmt(
     `SELECT r.from_id, r.to_id, r.call_type, COUNT(*) AS n
        FROM refs r
@@ -11135,7 +11593,7 @@ function getFileGraphWithStatement(stmt, packageFilter) {
     for (const x of extras) {
       symToFile.set(x.id, x.file);
       if (!fileStats.has(x.file)) {
-        fileStats.set(x.file, { count: 0, lang: "ts" });
+        fileStats.set(x.file, { count: 0, lang: langOf(x.file) });
       }
     }
   }
@@ -11152,17 +11610,22 @@ function getFileGraphWithStatement(stmt, packageFilter) {
     addWeightedEdge(edgeMap, fromFile, toFile, r.call_type, n);
   }
   const importRows = stmt(
-    `SELECT r.from_id, r.to_name, COUNT(*) AS n
+    `SELECT r.from_id, COALESCE(r.to_file, st.file) AS to_file, COUNT(*) AS n
        FROM refs r
+       LEFT JOIN symbols st ON st.id = r.to_id
        WHERE r.call_type = 'import'
+         AND COALESCE(r.to_file, st.file) IS NOT NULL
          AND r.from_id IN (SELECT id FROM symbols WHERE file IN (${filePlaceholders}))
-       GROUP BY r.from_id, r.to_name`
+       GROUP BY r.from_id, COALESCE(r.to_file, st.file)`
   ).all(...pkgFilePaths);
   for (const r of importRows) {
     const fromFile = symToFile.get(r.from_id);
     if (!fromFile || !localFiles.has(fromFile)) continue;
-    const toFile = resolveRelativeImport(fromFile, r.to_name, indexedFiles);
+    const toFile = r.to_file;
     if (!toFile || fromFile === toFile) continue;
+    if (!fileStats.has(toFile)) {
+      fileStats.set(toFile, { count: 0, lang: langOf(toFile) });
+    }
     ensureFileNode(fromFile);
     ensureFileNode(toFile);
     const n = Number(r.n) || 0;
@@ -11212,7 +11675,7 @@ function getSymbolGraphWithStatement(stmt, fileFilter) {
     ).all(...missingIds);
     for (const s of extras) symById.set(s.id, s);
   }
-  const nodes = buildSymbolGraphNodes(symById, relatedIds, fileFilter);
+  const nodes = buildSymbolGraphNodes(symById, relatedIds, fileFilter, readPackageLabeller(stmt));
   return { nodes, edges };
 }
 
@@ -11234,7 +11697,7 @@ function assignRefsToSymbols(refs, symbols) {
     }
     if (!owner2 && ref.callType === "import") owner2 = ordered[0];
     if (!owner2 || owner2.id <= 0) continue;
-    const key = `${owner2.id}:${ref.toName}:${ref.callType}`;
+    const key = `${owner2.id}:${ref.toName}:${ref.callType}:${ref.module ?? ""}`;
     if (seen.has(key)) continue;
     seen.add(key);
     assigned.push({ ...ref, fromId: owner2.id });
@@ -11280,7 +11743,11 @@ var CORE_TABLES_SQL = `
     lang TEXT NOT NULL,
     mtime_ms INTEGER NOT NULL,
     symbol_count INTEGER NOT NULL DEFAULT 0,
-    last_indexed INTEGER NOT NULL
+    last_indexed INTEGER NOT NULL,
+    -- Code Atlas grouping label, computed at index time from the ecosystem's
+    -- own manifests (package.json, go.mod, Cargo.toml, \u2026). Stored rather than
+    -- re-derived per query because the evidence lives on disk, not in the DB.
+    package TEXT NOT NULL DEFAULT ''
   );
   CREATE TABLE IF NOT EXISTS symbols (
     id INTEGER PRIMARY KEY,
@@ -11297,6 +11764,9 @@ var CORE_TABLES_SQL = `
     file_fk TEXT NOT NULL
   );
 `;
+var FILE_INDEX_SQL = [
+  "CREATE INDEX IF NOT EXISTS idx_f_package ON files(package)"
+];
 var SYMBOL_INDEX_SQL = [
   "CREATE INDEX IF NOT EXISTS idx_s_name ON symbols(name)",
   "CREATE INDEX IF NOT EXISTS idx_s_kind ON symbols(kind)",
@@ -11313,15 +11783,32 @@ var REFS_TABLE_SQL = `
     to_name TEXT NOT NULL,
     to_id INTEGER,
     call_type TEXT NOT NULL,
-    line INTEGER NOT NULL
+    line INTEGER NOT NULL,
+    lang TEXT NOT NULL DEFAULT '',
+    module TEXT,
+    to_file TEXT
   );
 `;
 var REFS_INDEX_SQL = [
   "CREATE INDEX IF NOT EXISTS idx_r_from ON refs(from_id)",
   "CREATE INDEX IF NOT EXISTS idx_r_to_id ON refs(to_id)",
   "CREATE INDEX IF NOT EXISTS idx_r_to_name ON refs(to_name)",
-  "CREATE INDEX IF NOT EXISTS idx_r_call_type ON refs(call_type)"
+  "CREATE INDEX IF NOT EXISTS idx_r_call_type ON refs(call_type)",
+  // Name resolution matches (to_name, lang) pairs; the composite keeps the
+  // language-scoped UPDATE from degrading into a scan of every same-named row.
+  "CREATE INDEX IF NOT EXISTS idx_r_to_name_lang ON refs(to_name, lang)",
+  // The post-index module resolution pass groups unresolved import refs by
+  // (module, lang); graph readers then read to_file back.
+  "CREATE INDEX IF NOT EXISTS idx_r_module ON refs(module)",
+  "CREATE INDEX IF NOT EXISTS idx_r_to_file ON refs(to_file)"
 ];
+var LANG_FAMILY_TABLE_SQL = `
+  CREATE TABLE IF NOT EXISTS lang_family (
+    lang TEXT PRIMARY KEY,
+    family TEXT NOT NULL
+  );
+`;
+var LANG_FAMILY_WILDCARD = "*";
 var SYMBOLS_FTS_SQL = "CREATE VIRTUAL TABLE IF NOT EXISTS symbols_fts USING fts5(text, tokenize = 'unicode61')";
 
 // src/codebase-index/writer-search-helpers.ts
@@ -11533,15 +12020,69 @@ var IndexStore = class _IndexStore {
   }
   constructor(projectRoot, opts = {}) {
     this.indexDir = resolveIndexDir(projectRoot, opts.indexDir);
-    fs10.mkdirSync(this.indexDir, { recursive: true });
+    fs11.mkdirSync(this.indexDir, { recursive: true });
     const Database = loadDatabaseSync();
-    this.db = new Database(path15.join(this.indexDir, DB_FILE2));
+    this.db = new Database(path16.join(this.indexDir, DB_FILE2));
     applyIndexStorePragmas(this.db);
     this.initSchema();
   }
   runWithRetry(fn) {
     return runSqliteWithRetry(fn);
   }
+  /**
+   * Mirror the in-process language→family map into SQLite.
+   *
+   * Rewritten on every open rather than only on schema bumps: the mapping is
+   * static lookup data, so a code-side change (a new language, a language
+   * moving families) must take effect without forcing a full reindex.
+   */
+  seedLangFamilies() {
+    const insert = this.stmt("INSERT OR REPLACE INTO lang_family(lang, family) VALUES (?, ?)");
+    for (const [lang, family] of LANG_FAMILY_ENTRIES) insert.run(lang, family);
+    insert.run("", LANG_FAMILY_WILDCARD);
+  }
+  /**
+   * Add any column the current schema expects but the on-disk table lacks.
+   *
+   * `CREATE TABLE IF NOT EXISTS` silently keeps an existing table's old shape,
+   * and the version check above only rebuilds on a version *mismatch*. That
+   * leaves a real gap: several wstack processes share this database, and while
+   * a version upgrade is rolling out one of them may still be running the
+   * previous build. That older process sees the newer version number, drops the
+   * tables, and recreates them from *its* DDL — without the newer columns —
+   * while the metadata row still reads the new version. Every later query for
+   * one of those columns then fails with `no such column`, and no amount of
+   * reindexing fixes it, because the version numbers already agree.
+   *
+   * Repairing column-by-column makes the schema self-healing from any of those
+   * states. Table and column names are compile-time literals from this module,
+   * never user input.
+   */
+  repairMissingColumns() {
+    const expected = [
+      { table: "files", columns: [["package", "TEXT NOT NULL DEFAULT ''"]] },
+      {
+        table: "refs",
+        columns: [
+          ["lang", "TEXT NOT NULL DEFAULT ''"],
+          ["module", "TEXT"],
+          ["to_file", "TEXT"]
+        ]
+      }
+    ];
+    for (const { table, columns } of expected) {
+      const present = new Set(
+        this.db.prepare(`PRAGMA table_info(${table})`).all().flatMap(
+          (row) => typeof row.name === "string" ? [row.name] : []
+        )
+      );
+      if (present.size === 0) continue;
+      for (const [name, type] of columns) {
+        if (present.has(name)) continue;
+        this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${name} ${type}`);
+      }
+    }
+  }
   initSchema() {
     this.db.exec(METADATA_TABLE_SQL);
     const storedRows = this.stmt("SELECT value FROM metadata WHERE key = ?").all("version");
@@ -11564,9 +12105,13 @@ var IndexStore = class _IndexStore {
       );
     }
     this.db.exec(CORE_TABLES_SQL);
-    for (const sql of SYMBOL_INDEX_SQL) this.db.exec(sql);
     this.db.exec(REFS_TABLE_SQL);
+    this.repairMissingColumns();
+    for (const sql of FILE_INDEX_SQL) this.db.exec(sql);
+    for (const sql of SYMBOL_INDEX_SQL) this.db.exec(sql);
     for (const sql of REFS_INDEX_SQL) this.db.exec(sql);
+    this.db.exec(LANG_FAMILY_TABLE_SQL);
+    this.seedLangFamilies();
     try {
       this.db.exec(SYMBOLS_FTS_SQL);
       this.ftsAvailable = true;
@@ -11601,6 +12146,18 @@ var IndexStore = class _IndexStore {
   static NEXT_SYMBOL_ID_KEY = "next_symbol_id";
   /** Stay under typical SQLite SQLITE_MAX_VARIABLE_NUMBER (often 999). */
   static MAX_SQL_VARS = 900;
+  /**
+   * Correlated predicate: the ref in `refs` and the candidate symbol aliased
+   * `sym` belong to the same language family — or the ref carries no language,
+   * in which case the wildcard bind matches everything.
+   *
+   * Each textual occurrence consumes one `?` bind of {@link LANG_FAMILY_WILDCARD}.
+   */
+  static FAMILY_MATCH_SQL = `(
+    (SELECT family FROM lang_family WHERE lang = refs.lang) = ?
+    OR (SELECT family FROM lang_family WHERE lang = sym.lang)
+       = (SELECT family FROM lang_family WHERE lang = refs.lang)
+  )`;
   /**
    * Ensure `metadata.next_symbol_id` exists. Safe to call outside a write
    * transaction on open; the first concurrent writer under BEGIN IMMEDIATE
@@ -11664,9 +12221,12 @@ var IndexStore = class _IndexStore {
       const placeholders = chunk.map(() => "?").join(",");
       const result = this.stmt(
         `UPDATE refs
-         SET to_id = (SELECT MIN(id) FROM symbols WHERE name = refs.to_name)
+         SET to_id = (
+           SELECT MIN(sym.id) FROM symbols sym
+            WHERE sym.name = refs.to_name AND ${_IndexStore.FAMILY_MATCH_SQL}
+         )
          WHERE to_name IN (${placeholders})`
-      ).run(...chunk);
+      ).run(LANG_FAMILY_WILDCARD, ...chunk);
       changes += result.changes ?? 0;
     }
     return changes;
@@ -11793,6 +12353,115 @@ var IndexStore = class _IndexStore {
   getAllFileMetas() {
     return getAllFileMetasWithStatement((sql) => this.stmt(sql));
   }
+  // ─── Project structure & module resolution ──────────────────────────────────
+  /** Store the Code Atlas grouping label for each indexed file. */
+  setFilePackages(entries) {
+    if (entries.size === 0) return;
+    this.runWithRetry(() => {
+      const update = this.stmt("UPDATE files SET package = ? WHERE file = ?");
+      for (const [file, label] of entries) update.run(label, file);
+    });
+  }
+  /**
+   * Every indexed `namespace`/`module` declaration, for ecosystems whose import
+   * specifiers name a namespace rather than a path (C#, PHP, Elixir, Haskell).
+   * Ordered so the resolver's choice among duplicate declarations is stable.
+   */
+  getNamespaceDeclarations() {
+    return this.stmt(
+      `SELECT name, file FROM symbols WHERE kind = 'namespace' ORDER BY file, id`
+    ).all();
+  }
+  /** `file → package` for every indexed file that has a label. */
+  getFilePackages() {
+    const rows = this.stmt("SELECT file, package FROM files WHERE package != ''").all();
+    return new Map(rows.map((row) => [row.file, row.package]));
+  }
+  /**
+   * Distinct `(fromFile, lang, module)` triples needing module resolution.
+   *
+   * Distinct rather than per-ref because resolution depends only on these three
+   * values: a file importing the same module twenty times resolves it once.
+   */
+  getUnresolvedImports(onlyFiles) {
+    const base = `SELECT DISTINCT s.file AS fromFile, r.lang AS lang, r.module AS module
+                    FROM refs r
+                    JOIN symbols s ON s.id = r.from_id
+                   WHERE r.call_type = 'import' AND r.module IS NOT NULL`;
+    if (!onlyFiles?.length) {
+      return this.stmt(base).all();
+    }
+    const out = [];
+    for (let i = 0; i < onlyFiles.length; i += _IndexStore.MAX_SQL_VARS) {
+      const chunk = onlyFiles.slice(i, i + _IndexStore.MAX_SQL_VARS);
+      const placeholders = chunk.map(() => "?").join(",");
+      out.push(
+        ...this.stmt(`${base} AND s.file IN (${placeholders})`).all(...chunk)
+      );
+    }
+    return out;
+  }
+  /**
+   * Write resolved import targets back onto `refs.to_file`.
+   *
+   * Applied through a temp table and a single UPDATE: one statement per
+   * resolution would mean thousands of round-trips on a first index.
+   */
+  applyImportResolutions(resolutions) {
+    if (resolutions.length === 0) return 0;
+    return this.runWithRetry(() => {
+      this.db.exec("DROP TABLE IF EXISTS temp.import_resolution");
+      this.db.exec(
+        `CREATE TEMP TABLE import_resolution (
+           from_file TEXT NOT NULL,
+           lang TEXT NOT NULL,
+           module TEXT NOT NULL,
+           to_file TEXT NOT NULL
+         )`
+      );
+      const chunkSize = Math.max(1, Math.floor(_IndexStore.MAX_SQL_VARS / 4));
+      for (let i = 0; i < resolutions.length; i += chunkSize) {
+        const chunk = resolutions.slice(i, i + chunkSize);
+        const placeholders = chunk.map(() => "(?, ?, ?, ?)").join(", ");
+        const binds = [];
+        for (const entry of chunk) {
+          binds.push(entry.fromFile, entry.lang, entry.module, entry.toFile);
+        }
+        this.stmt(
+          `INSERT INTO temp.import_resolution(from_file, lang, module, to_file)
+           VALUES ${placeholders}`
+        ).run(...binds);
+      }
+      this.db.exec(
+        `CREATE INDEX IF NOT EXISTS temp.idx_ir
+           ON import_resolution(module, lang, from_file)`
+      );
+      const result = this.stmt(
+        `UPDATE refs
+            SET to_file = (
+              SELECT ir.to_file
+                FROM temp.import_resolution ir
+                JOIN symbols s ON s.id = refs.from_id
+               WHERE ir.module = refs.module
+                 AND ir.lang = refs.lang
+                 AND ir.from_file = s.file
+               LIMIT 1
+            )
+          WHERE refs.call_type = 'import'
+            AND refs.module IS NOT NULL
+            AND EXISTS (
+              SELECT 1
+                FROM temp.import_resolution ir
+                JOIN symbols s ON s.id = refs.from_id
+               WHERE ir.module = refs.module
+                 AND ir.lang = refs.lang
+                 AND ir.from_file = s.file
+            )`
+      ).run();
+      this.db.exec("DROP TABLE IF EXISTS temp.import_resolution");
+      return result.changes ?? 0;
+    });
+  }
   // ─── Search ──────────────────────────────────────────────────────────────────
   search(query, filter, opts) {
     const built = this.buildSearchWhere(query, filter);
@@ -12179,9 +12848,12 @@ var IndexStore = class _IndexStore {
    * Resolve `to_name` → `to_id` for all refs that have a name but no id.
    * Call this after all symbols have been inserted to fill in cross-references.
    *
-   * Single statement: the `to_name IN (SELECT name FROM symbols)` guard restricts
-   * the UPDATE to refs that will actually resolve, so `.changes` counts only refs
-   * that found a target — matching the previous per-row loop's return value.
+   * A match additionally requires the referencing ref and the target symbol to
+   * be in the same {@link LangFamily}. Without that guard a name match is a
+   * cross-language accident waiting to happen — `main`, `New`, `Parse` and
+   * `Config` are declared in most languages at once, and each collision draws a
+   * Code Atlas edge between files that never reference each other. Refs stored
+   * without a language keep the old global behaviour via the `'*'` wildcard row.
    */
   resolveRefs() {
     return this.runWithRetry(() => {
@@ -12190,20 +12862,35 @@ var IndexStore = class _IndexStore {
           `UPDATE refs
            SET to_id = s.id
            FROM (
-             SELECT name, MIN(id) AS id FROM symbols GROUP BY name
-           ) AS s
+                 SELECT sym.name AS name, lf.family AS family, MIN(sym.id) AS id
+                   FROM symbols sym
+                   JOIN lang_family lf ON lf.lang = sym.lang
+                  GROUP BY sym.name, lf.family
+                 UNION ALL
+                 SELECT sym.name AS name, '${LANG_FAMILY_WILDCARD}' AS family, MIN(sym.id) AS id
+                   FROM symbols sym
+                  GROUP BY sym.name
+               ) AS s,
+               lang_family AS rf
            WHERE refs.to_id IS NULL
              AND refs.to_name IS NOT NULL
-             AND refs.to_name = s.name`
+             AND rf.lang = refs.lang
+             AND s.name = refs.to_name
+             AND s.family = rf.family`
         ).run();
         return result.changes ?? 0;
       } catch {
         const result = this.stmt(
           `UPDATE refs SET to_id = (
-             SELECT id FROM symbols WHERE name = refs.to_name LIMIT 1
+             SELECT sym.id FROM symbols sym
+              WHERE sym.name = refs.to_name AND ${_IndexStore.FAMILY_MATCH_SQL}
+              ORDER BY sym.id LIMIT 1
            ) WHERE to_id IS NULL AND to_name IS NOT NULL
-             AND to_name IN (SELECT name FROM symbols)`
-        ).run();
+             AND EXISTS (
+               SELECT 1 FROM symbols sym
+                WHERE sym.name = refs.to_name AND ${_IndexStore.FAMILY_MATCH_SQL}
+             )`
+        ).run(LANG_FAMILY_WILDCARD, LANG_FAMILY_WILDCARD);
         return result.changes ?? 0;
       }
     });
@@ -12392,21 +13079,23 @@ var PROJECT_INDEX_SERVER_METADATA_FILE = "server.json";
 var PROJECT_INDEX_SERVER_SOCKET_DIR = `wsci-v${PROJECT_INDEX_SERVER_PROTOCOL_VERSION}`;
 var buildIdCache;
 function projectIndexServerBuildId(entrypoint) {
-  const file = entrypoint instanceof URL || entrypoint.startsWith("file:") ? fileURLToPath(entrypoint) : path16.resolve(entrypoint);
+  const href = entrypoint instanceof URL ? entrypoint.href : entrypoint;
+  const cleanHref = href.split(/[?#]/, 1)[0] ?? href;
+  const file = cleanHref.startsWith("file:") ? fileURLToPath(cleanHref) : path17.resolve(cleanHref);
   try {
-    const stat19 = fs11.statSync(file);
+    const stat19 = fs12.statSync(file);
     if (buildIdCache?.file === file && buildIdCache.mtimeMs === stat19.mtimeMs && buildIdCache.size === stat19.size) {
       return buildIdCache.buildId;
     }
-    const buildId = createHash4("sha256").update(fs11.readFileSync(file)).digest("hex").slice(0, 24);
+    const buildId = createHash4("sha256").update(fs12.readFileSync(file)).digest("hex").slice(0, 24);
     buildIdCache = { file, mtimeMs: stat19.mtimeMs, size: stat19.size, buildId };
     return buildId;
   } catch {
-    return `unreadable:${path16.basename(file)}`;
+    return `unreadable:${path17.basename(file)}`;
   }
 }
 function normalizeLocalPath(value) {
-  const resolved = path16.resolve(value);
+  const resolved = path17.resolve(value);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 function projectIndexServerKey(projectRoot, indexDir) {
@@ -12418,11 +13107,11 @@ function projectIndexServerEndpoint(projectRoot, indexDir) {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\wrongstack-codebase-index-v${PROJECT_INDEX_SERVER_PROTOCOL_VERSION}-${key}`;
   }
-  return path16.join(os5.tmpdir(), PROJECT_INDEX_SERVER_SOCKET_DIR, `${key}.sock`);
+  return path17.join(os5.tmpdir(), PROJECT_INDEX_SERVER_SOCKET_DIR, `${key}.sock`);
 }
 function projectIndexServerMetadataPath(projectRoot, indexDir) {
-  return path16.join(
-    path16.resolve(resolveIndexDir(projectRoot, indexDir)),
+  return path17.join(
+    path17.resolve(resolveIndexDir(projectRoot, indexDir)),
     PROJECT_INDEX_SERVER_METADATA_FILE
   );
 }
@@ -12462,7 +13151,7 @@ function resolveProjectIndexDaemonAvailability(projectRoot, indexDir) {
   for (const rel of ["./project-server.js", "./codebase-index/project-server.js"]) {
     try {
       const url = new URL(rel, import.meta.url);
-      if (url.protocol === "file:" && fs12.existsSync(fileURLToPath2(url))) {
+      if (url.protocol === "file:" && fs13.existsSync(fileURLToPath2(url))) {
         builtUrl = url;
         break;
       }
@@ -12719,7 +13408,7 @@ var ProjectServerConnection = class {
   currentAuthToken() {
     if (this.authToken === void 0) {
       try {
-        const raw = fs12.readFileSync(
+        const raw = fs13.readFileSync(
           projectIndexServerMetadataPath(this.projectRoot, this.indexDir),
           "utf8"
         );
@@ -12984,7 +13673,7 @@ var ProjectServerConnection = class {
     if (!url) throw new Error("built codebase-index project server is unavailable");
     if (process.platform !== "win32") {
       try {
-        fs12.rmSync(this.endpoint, { force: true });
+        fs13.rmSync(this.endpoint, { force: true });
       } catch {
       }
     }
@@ -13008,8 +13697,8 @@ var ProjectServerConnection = class {
       process.kill(pid);
       const metadataPath = projectIndexServerMetadataPath(this.projectRoot, this.indexDir);
       try {
-        const metadata = JSON.parse(fs12.readFileSync(metadataPath, "utf8"));
-        if (metadata.pid === pid) fs12.rmSync(metadataPath, { force: true });
+        const metadata = JSON.parse(fs13.readFileSync(metadataPath, "utf8"));
+        if (metadata.pid === pid) fs13.rmSync(metadataPath, { force: true });
       } catch {
       }
       return true;
@@ -13113,7 +13802,7 @@ import { Worker } from "node:worker_threads";
 
 // src/codebase-index/indexer.ts
 import { expectDefined as expectDefined6 } from "@wrongstack/core/utils";
-import { execFile as execFile2 } from "node:child_process";
+import { execFile } from "node:child_process";
 import * as fs17 from "node:fs/promises";
 import { availableParallelism } from "node:os";
 import * as path23 from "node:path";
@@ -13124,8 +13813,8 @@ import {
 } from "@wrongstack/core/utils";
 
 // src/codebase-index/gitignore.ts
-import * as fs13 from "node:fs/promises";
-import * as path17 from "node:path";
+import * as fs14 from "node:fs/promises";
+import * as path18 from "node:path";
 import { compileGlob } from "@wrongstack/core/utils";
 function globBody(glob) {
   return compileGlob(glob).source.replace(/^\^/, "").replace(/\$$/, "");
@@ -13141,48 +13830,474 @@ function compileGitignore(lines) {
       negated = true;
       line = line.slice(1);
     }
-    let dirOnly = false;
-    if (line.endsWith("/")) {
-      dirOnly = true;
-      line = line.slice(0, -1);
+    let dirOnly = false;
+    if (line.endsWith("/")) {
+      dirOnly = true;
+      line = line.slice(0, -1);
+    }
+    if (!line) continue;
+    const anchored = line.startsWith("/") || line.includes("/");
+    if (line.startsWith("/")) line = line.slice(1);
+    const body = globBody(line);
+    const prefix = anchored ? "^" : "(?:^|.*/)";
+    rules.push({
+      eqOrUnder: new RegExp(`${prefix}${body}(?:/.*)?$`),
+      under: new RegExp(`${prefix}${body}/.*$`),
+      negated,
+      dirOnly
+    });
+  }
+  return (relPath, isDir) => {
+    const p = relPath.replace(/\\/g, "/").replace(/^\/+/, "");
+    let ignored = false;
+    for (const r of rules) {
+      const re = r.dirOnly && !isDir ? r.under : r.eqOrUnder;
+      if (re.test(p)) ignored = !r.negated;
+    }
+    return ignored;
+  };
+}
+async function loadGitignoreMatcher(projectRoot) {
+  let lines = [];
+  try {
+    const raw = await fs14.readFile(path18.join(projectRoot, ".gitignore"), "utf8");
+    lines = raw.split("\n");
+  } catch {
+  }
+  return compileGitignore(lines);
+}
+
+// src/codebase-index/indexer.ts
+init_languages2();
+
+// src/codebase-index/module-resolver.ts
+init_languages2();
+import * as path19 from "node:path";
+var EXTENSIONS = {
+  js: [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs", ".vue", ".svelte"],
+  py: [".py", ".pyi"],
+  rs: [".rs"],
+  jvm: [".java", ".kt", ".scala"],
+  c: [".h", ".hpp", ".hh", ".hxx", ".c", ".cpp", ".cc", ".cxx"],
+  ruby: [".rb"],
+  go: [".go"]
+};
+var DIRECTORY_ENTRIES = {
+  js: ["index"],
+  py: ["__init__"],
+  rs: ["mod"],
+  ruby: ["index"]
+};
+function normalizeNamespace(value) {
+  return value.replace(/::|[\\/]/g, ".").replace(/^\.+|\.+$/g, "").toLowerCase();
+}
+var ModuleResolver = class {
+  structure;
+  /** Lowercased portable path → the path as indexed (case is preserved). */
+  byPath;
+  /** Lowercased portable directory → files directly inside it, as indexed. */
+  byDir;
+  /** Normalized namespace → the file declaring it (first by path, stable). */
+  byNamespace;
+  constructor(structure, files, namespaces = []) {
+    this.structure = structure;
+    this.byPath = /* @__PURE__ */ new Map();
+    this.byDir = /* @__PURE__ */ new Map();
+    this.byNamespace = /* @__PURE__ */ new Map();
+    const dirsByKey = /* @__PURE__ */ new Map();
+    for (const file of files) {
+      const portable = toPortablePath(file);
+      const pathKey = portable.toLowerCase();
+      const priorPath = this.byPath.get(pathKey);
+      if (priorPath !== void 0 && priorPath !== file) this.byPath.delete(pathKey);
+      else this.byPath.set(pathKey, file);
+      const dir = path19.posix.dirname(portable);
+      const dirKey = dir.toLowerCase();
+      const knownDir = dirsByKey.get(dirKey);
+      if (knownDir === void 0) {
+        dirsByKey.set(dirKey, dir);
+        this.byDir.set(dirKey, [file]);
+      } else if (knownDir === dir) {
+        this.byDir.get(dirKey)?.push(file);
+      } else {
+        dirsByKey.delete(dirKey);
+        this.byDir.delete(dirKey);
+      }
+    }
+    for (const { name, file } of namespaces) {
+      const lang = detectLang(file);
+      if (!lang) continue;
+      const key = `${languageFamily(lang)}:${normalizeNamespace(name)}`;
+      if (normalizeNamespace(name) && !this.byNamespace.has(key)) {
+        this.byNamespace.set(key, file);
+      }
+    }
+  }
+  /**
+   * Resolve `specifier` as written in `fromFile`.
+   * Returns the indexed target path, or `undefined` when it is external or
+   * cannot be located.
+   */
+  resolve(fromFile, lang, specifier) {
+    const spec = specifier.trim().replace(/\\/g, "/");
+    if (!spec) return void 0;
+    const from = toPortablePath(fromFile);
+    switch (languageFamily(lang)) {
+      case "js":
+        return this.resolveJs(from, spec);
+      case "go":
+        return this.resolveGo(spec);
+      case "py":
+        return this.resolvePython(from, spec);
+      case "rs":
+        return this.resolveRust(from, spec);
+      case "jvm":
+        return this.resolveJvm(spec);
+      case "c":
+        return this.resolveInclude(from, spec);
+      case "ruby":
+        return this.resolveRuby(from, spec);
+      case "dotnet":
+      case "php":
+      case "elixir":
+      case "haskell":
+        return this.resolveNamespace(lang, spec);
+      default:
+        return void 0;
+    }
+  }
+  /**
+   * Resolve a namespace specifier to the file declaring it.
+   *
+   * Tried whole first, then with the trailing segment dropped: `using Foo.Bar`
+   * names a namespace outright, while PHP's `use App\Models\User` names a
+   * *class* inside `App\Models`, so the prefix is what was declared.
+   */
+  resolveNamespace(lang, spec) {
+    const family = languageFamily(lang);
+    const normalized = normalizeNamespace(spec);
+    const exact = this.byNamespace.get(`${family}:${normalized}`);
+    if (exact) return exact;
+    const segments = normalized.split(".").filter(Boolean);
+    if (segments.length < 2) return void 0;
+    return this.byNamespace.get(`${family}:${segments.slice(0, -1).join(".")}`);
+  }
+  // ─── Lookup primitives ──────────────────────────────────────────────────────
+  lookup(candidate) {
+    return this.byPath.get(path19.posix.normalize(candidate).toLowerCase());
+  }
+  /**
+   * Try `base` verbatim, then `base` + each extension, then each directory
+   * entry point inside `base`.
+   */
+  lookupWithExtensions(base, family) {
+    const direct = this.lookup(base);
+    if (direct) return direct;
+    const extensions = EXTENSIONS[family] ?? [];
+    const suffix = path19.posix.extname(base);
+    const stem = suffix && extensions.includes(suffix) ? base.slice(0, -suffix.length) : base;
+    for (const ext of extensions) {
+      const hit = this.lookup(`${stem}${ext}`);
+      if (hit) return hit;
+    }
+    for (const entry of DIRECTORY_ENTRIES[family] ?? []) {
+      for (const ext of extensions) {
+        const hit = this.lookup(path19.posix.join(base, `${entry}${ext}`));
+        if (hit) return hit;
+      }
+    }
+    return void 0;
+  }
+  /**
+   * A representative indexed file inside `dir`, for ecosystems whose import
+   * unit is a directory rather than a file (Go packages, JVM wildcard imports).
+   *
+   * The choice is deterministic — a file named after the directory, else the
+   * first by name — so the same import always produces the same edge. Package
+   * grouping is unaffected either way: every file in the directory carries the
+   * same package label, so the package-level edge is exact regardless of which
+   * member represents it.
+   */
+  representativeIn(dir, family) {
+    const members = this.byDir.get(path19.posix.normalize(dir).toLowerCase());
+    if (!members?.length) return void 0;
+    const extensions = EXTENSIONS[family] ?? [];
+    const eligible = members.filter((file) => extensions.includes(path19.posix.extname(toPortablePath(file)).toLowerCase())).sort((a, b) => toPortablePath(a).localeCompare(toPortablePath(b)));
+    if (eligible.length === 0) return void 0;
+    const base = path19.posix.basename(path19.posix.normalize(dir)).toLowerCase();
+    const named = eligible.find(
+      (file) => path19.posix.basename(toPortablePath(file)).split(".")[0]?.toLowerCase() === base
+    );
+    return named ?? eligible[0];
+  }
+  // ─── Per-family resolution ──────────────────────────────────────────────────
+  /** Relative specifiers, then workspace package names and their subpaths. */
+  resolveJs(fromFile, spec) {
+    if (spec.startsWith(".")) {
+      const absolute = path19.posix.join(path19.posix.dirname(fromFile), spec);
+      return this.lookupWithExtensions(absolute, "js");
+    }
+    const owner2 = this.structure.roots.find(
+      (root) => root.kind === "npm" && root.importPath !== void 0 && (spec === root.importPath || spec.startsWith(`${root.importPath}/`))
+    );
+    if (!owner2?.importPath) return void 0;
+    const subpath = spec.slice(owner2.importPath.length).replace(/^\//, "");
+    if (!subpath) {
+      return this.lookupWithExtensions(path19.posix.join(owner2.dir, "src/index"), "js") ?? this.lookupWithExtensions(path19.posix.join(owner2.dir, "index"), "js");
+    }
+    return this.lookupWithExtensions(path19.posix.join(owner2.dir, subpath), "js") ?? this.lookupWithExtensions(path19.posix.join(owner2.dir, "src", subpath), "js");
+  }
+  /** Go import paths are absolute module paths; a package is a directory. */
+  resolveGo(spec) {
+    const owner2 = this.structure.roots.find(
+      (root) => root.kind === "go" && root.importPath !== void 0 && (spec === root.importPath || spec.startsWith(`${root.importPath}/`))
+    );
+    if (!owner2?.importPath) return void 0;
+    const subpath = spec.slice(owner2.importPath.length).replace(/^\//, "");
+    return this.representativeIn(path19.posix.join(owner2.dir, subpath), "go");
+  }
+  /**
+   * `import a.b.c` / `from a.b import c`, plus PEP 328 relative imports whose
+   * leading dots the extractor preserves (`.sibling`, `..parent.mod`).
+   */
+  resolvePython(fromFile, spec) {
+    const leadingDots = /^\.*/.exec(spec)?.[0].length ?? 0;
+    if (leadingDots > 0) {
+      let base = path19.posix.dirname(fromFile);
+      for (let i = 1; i < leadingDots; i++) base = path19.posix.dirname(base);
+      const rest = spec.slice(leadingDots).split(".").filter(Boolean);
+      return this.lookupWithExtensions(path19.posix.join(base, ...rest), "py");
+    }
+    const segments = spec.split(".").filter(Boolean);
+    if (segments.length === 0) return void 0;
+    const sourceRoots = this.structure.roots.filter((root) => root.kind === "python").flatMap((root) => root.sourceRoots);
+    for (const base of [...sourceRoots, this.structure.projectRoot]) {
+      const hit = this.lookupWithExtensions(path19.posix.join(base, ...segments), "py");
+      if (hit) return hit;
+      if (segments.length > 1) {
+        const parent = this.lookupWithExtensions(
+          path19.posix.join(base, ...segments.slice(0, -1)),
+          "py"
+        );
+        if (parent) return parent;
+      }
     }
-    if (!line) continue;
-    const anchored = line.startsWith("/") || line.includes("/");
-    if (line.startsWith("/")) line = line.slice(1);
-    const body = globBody(line);
-    const prefix = anchored ? "^" : "(?:^|.*/)";
-    rules.push({
-      eqOrUnder: new RegExp(`${prefix}${body}(?:/.*)?$`),
-      under: new RegExp(`${prefix}${body}/.*$`),
-      negated,
-      dirOnly
-    });
+    return void 0;
   }
-  return (relPath, isDir) => {
-    const p = relPath.replace(/\\/g, "/").replace(/^\/+/, "");
-    let ignored = false;
-    for (const r of rules) {
-      const re = r.dirOnly && !isDir ? r.under : r.eqOrUnder;
-      if (re.test(p)) ignored = !r.negated;
+  /** `use crate::a::b`, `use super::x`, `use self::y`, `use other_crate::z`. */
+  resolveRust(fromFile, spec) {
+    const segments = spec.split("::").filter(Boolean);
+    if (segments.length === 0) return void 0;
+    const head = segments[0];
+    if (head === "self" || head === "super") {
+      let base = path19.posix.dirname(fromFile);
+      for (const segment of segments) {
+        if (segment === "super") base = path19.posix.dirname(base);
+        else if (segment !== "self") break;
+      }
+      const rest2 = segments.filter((segment) => segment !== "self" && segment !== "super");
+      return this.lookupWithExtensions(path19.posix.join(base, ...rest2), "rs");
+    }
+    const owningCrate = findOwningRoot(this.structure, fromFile, ["cargo"]);
+    const crate = head === "crate" ? owningCrate : this.structure.roots.find(
+      (root) => root.kind === "cargo" && root.importPath === head?.replace(/-/g, "_")
+    );
+    if (!crate) {
+      return this.lookupWithExtensions(
+        path19.posix.join(path19.posix.dirname(fromFile), ...segments),
+        "rs"
+      );
     }
-    return ignored;
-  };
+    const rest = segments.slice(1);
+    for (const base of crate.sourceRoots) {
+      const parent = rest.length > 1 ? this.lookupWithExtensions(path19.posix.join(base, ...rest.slice(0, -1)), "rs") : void 0;
+      const exact = this.lookupWithExtensions(path19.posix.join(base, ...rest), "rs");
+      const hit = exact ?? parent ?? this.lookupWithExtensions(path19.posix.join(base, "lib"), "rs");
+      if (hit) return hit;
+    }
+    return void 0;
+  }
+  /** `com.example.Thing` and `com.example.*` against JVM source roots. */
+  resolveJvm(spec) {
+    const segments = spec.split(".").filter(Boolean);
+    if (segments.length === 0) return void 0;
+    const sourceRoots = this.structure.roots.filter((root) => root.kind === "maven" || root.kind === "gradle").flatMap((root) => root.sourceRoots);
+    const wildcard = segments[segments.length - 1] === "*";
+    const parts = wildcard ? segments.slice(0, -1) : segments;
+    for (const base of [...sourceRoots, this.structure.projectRoot]) {
+      const target = path19.posix.join(base, ...parts);
+      const hit = wildcard ? this.representativeIn(target, "jvm") : this.lookupWithExtensions(target, "jvm");
+      if (hit) return hit;
+    }
+    return void 0;
+  }
+  /** `#include "foo/bar.h"` — quoted form only; `<…>` is a system header. */
+  resolveInclude(fromFile, spec) {
+    const relative13 = this.lookupWithExtensions(
+      path19.posix.join(path19.posix.dirname(fromFile), spec),
+      "c"
+    );
+    if (relative13) return relative13;
+    for (const base of [
+      path19.posix.join(this.structure.projectRoot, "include"),
+      this.structure.projectRoot
+    ]) {
+      const hit = this.lookupWithExtensions(path19.posix.join(base, spec), "c");
+      if (hit) return hit;
+    }
+    return void 0;
+  }
+  /** `require_relative 'x'` is relative; `require 'x'` is looked up under lib/. */
+  resolveRuby(fromFile, spec) {
+    const relative13 = this.lookupWithExtensions(
+      path19.posix.join(path19.posix.dirname(fromFile), spec),
+      "ruby"
+    );
+    if (relative13) return relative13;
+    for (const base of [
+      path19.posix.join(this.structure.projectRoot, "lib"),
+      this.structure.projectRoot
+    ]) {
+      const hit = this.lookupWithExtensions(path19.posix.join(base, spec), "ruby");
+      if (hit) return hit;
+    }
+    return void 0;
+  }
+};
+
+// src/codebase-index/import-extractor.ts
+var IMPORT_MAX_FILE_CHARS = 512 * 1024;
+var IMPORT_MAX_PER_FILE = 400;
+var DOTTED_IMPORT = [
+  { re: /^[ \t]*import\s+(?:static\s+)?([\w.]+(?:\.\*)?)\s*;?\s*$/gm }
+];
+var LANG_IMPORTS = {
+  // Go and Python have real AST extractors; these patterns are the fallback for
+  // machines with no Go toolchain or Python interpreter installed, where the
+  // parser degrades to regex symbols and would otherwise contribute no edges.
+  go: [
+    { re: /^[ \t]*import\s+(?:[\w.]+\s+)?"([^"]+)"/gm },
+    // Grouped form: inside `import ( … )` each line is an optional alias plus a
+    // quoted path. A stray match elsewhere resolves to no file and is dropped.
+    { re: /^[ \t]*(?:[A-Za-z_.]\w*\s+)?"([^"]+)"\s*$/gm }
+  ],
+  py: [
+    { re: /^[ \t]*import\s+([\w.]+)/gm },
+    { re: /^[ \t]*from\s+([.\w]+)\s+import\b/gm }
+  ],
+  rs: [
+    // use a::b::C;  |  use a::b::{C, D};  → the path before any brace
+    { re: /^[ \t]*(?:pub\s+)?use\s+([\w:]+?)(?:::\{|\s*;|\s+as\b)/gm },
+    // mod foo;  (a declaration *and* a dependency on foo.rs / foo/mod.rs)
+    { re: /^[ \t]*(?:pub\s+)?mod\s+(\w+)\s*;/gm }
+  ],
+  java: DOTTED_IMPORT,
+  kotlin: DOTTED_IMPORT,
+  scala: [{ re: /^[ \t]*import\s+([\w.]+(?:\.[_*])?)\s*$/gm }],
+  csharp: [
+    // using Foo.Bar;  |  using static Foo.Bar;  |  using Alias = Foo.Bar;
+    { re: /^[ \t]*global\s+using\s+(?:static\s+)?([\w.]+)\s*;/gm, name: "full" },
+    { re: /^[ \t]*using\s+(?:static\s+)?(?:\w+\s*=\s*)?([\w.]+)\s*;/gm, name: "full" }
+  ],
+  // Quoted includes only: <stdio.h> is a system header with no indexed file.
+  c: [{ re: /^[ \t]*#\s*include\s+"([^"]+)"/gm }],
+  cpp: [{ re: /^[ \t]*#\s*include\s+"([^"]+)"/gm }],
+  ruby: [{ re: /^[ \t]*(?:require|require_relative|load)\s*\(?\s*['"]([^'"]+)['"]/gm }],
+  php: [
+    // `use A\B\C` imports the class C, which is what the index has a symbol
+    // for — the namespace symbol only covers the `A\B` prefix.
+    { re: /^[ \t]*use\s+(?:function\s+|const\s+)?([\w\\]+)/gm },
+    { re: /^[ \t]*(?:require|require_once|include|include_once)\s*\(?\s*['"]([^'"]+)['"]/gm }
+  ],
+  swift: [{ re: /^[ \t]*import\s+(?:struct\s+|class\s+|func\s+)?([\w.]+)\s*$/gm }],
+  dart: [{ re: /^[ \t]*(?:import|export|part)\s+['"]([^'"]+)['"]/gm }],
+  lua: [{ re: /\brequire\s*\(?\s*['"]([^'"]+)['"]/g }],
+  elixir: [{ re: /^[ \t]*(?:alias|import|require|use)\s+([A-Z][\w.]*)/gm, name: "full" }],
+  haskell: [{ re: /^[ \t]*import\s+(?:qualified\s+)?([\w.]+)/gm, name: "full" }],
+  zig: [{ re: /@import\s*\(\s*"([^"]+)"\s*\)/g }],
+  proto: [{ re: /^[ \t]*import\s+(?:public\s+|weak\s+)?"([^"]+)"\s*;/gm }],
+  // `@import "x"`, `@use "x"`, `@forward "x"` — Sass and plain CSS alike.
+  css: [{ re: /^[ \t]*@(?:import|use|forward)\s+(?:url\()?\s*['"]([^'"]+)['"]/gm }],
+  // A .vue/.svelte file's <script> block is JS; the same ESM syntax applies.
+  vue: [{ re: /^[ \t]*import\s[^'"]*from\s*['"]([^'"]+)['"]/gm }],
+  svelte: [{ re: /^[ \t]*import\s[^'"]*from\s*['"]([^'"]+)['"]/gm }],
+  html: [
+    { re: /<script[^>]+src\s*=\s*['"]([^'"]+)['"]/g },
+    { re: /<link[^>]+href\s*=\s*['"]([^'"]+)['"]/g }
+  ],
+  shell: [{ re: /^[ \t]*(?:source|\.)\s+(\S+)/gm }],
+  r: [{ re: /\b(?:source|library|require)\s*\(\s*['"]?([\w./-]+)['"]?\s*\)/g }]
+};
+function lastSegment(specifier) {
+  const pathLike = /[/\\]|::/.test(specifier);
+  const segments = specifier.split(/[/\\]|::/).filter(Boolean);
+  let last = segments[segments.length - 1] ?? specifier;
+  if (last === "*" || last === "_") {
+    last = segments[segments.length - 2] ?? specifier;
+  }
+  if (pathLike) return last.replace(/\.[A-Za-z0-9]{1,8}$/, "") || last;
+  const dotted = last.split(".").filter((part) => part && part !== "*" && part !== "_");
+  return dotted[dotted.length - 1] ?? last;
 }
-async function loadGitignoreMatcher(projectRoot) {
-  let lines = [];
-  try {
-    const raw = await fs13.readFile(path17.join(projectRoot, ".gitignore"), "utf8");
-    lines = raw.split("\n");
-  } catch {
+function newlineOffsets(content) {
+  const offsets = [];
+  for (let i = 0; i < content.length; i++) {
+    if (content.charCodeAt(i) === 10) offsets.push(i);
   }
-  return compileGitignore(lines);
+  return offsets;
+}
+function lineAt(offsets, index) {
+  let low = 0;
+  let high = offsets.length;
+  while (low < high) {
+    const mid = low + high >>> 1;
+    if ((offsets[mid] ?? 0) < index) low = mid + 1;
+    else high = mid;
+  }
+  return low + 1;
+}
+function hasImportPatterns(lang) {
+  return LANG_IMPORTS[lang] !== void 0;
+}
+function extractImports(opts) {
+  const patterns = LANG_IMPORTS[opts.lang];
+  if (!patterns || !opts.content) return [];
+  const limit = opts.maxImports ?? IMPORT_MAX_PER_FILE;
+  const content = opts.content.length > IMPORT_MAX_FILE_CHARS ? opts.content.slice(0, IMPORT_MAX_FILE_CHARS) : opts.content;
+  const refs = [];
+  const seen = /* @__PURE__ */ new Set();
+  const offsets = newlineOffsets(content);
+  for (const pattern of patterns) {
+    const re = new RegExp(pattern.re.source, pattern.re.flags);
+    for (const match of content.matchAll(re)) {
+      if (refs.length >= limit) return refs;
+      const specifier = match[1]?.trim();
+      if (!specifier) continue;
+      const module = specifier;
+      const toName = pattern.name === "full" ? module : lastSegment(module);
+      if (!toName) continue;
+      const key = `${module}\0${toName}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      refs.push({
+        fromId: 0,
+        toName,
+        callType: "import",
+        line: lineAt(offsets, match.index ?? 0),
+        lang: opts.lang,
+        module
+      });
+    }
+  }
+  return refs;
 }
-
-// src/codebase-index/indexer.ts
-init_languages2();
 
 // src/codebase-index/parser-dispatch.ts
 async function parseFileContent(file, content, lang) {
+  const parsed = await dispatch(file, content, lang);
+  return withRelations(parsed, content, lang);
+}
+async function dispatch(file, content, lang) {
   switch (lang) {
     case "ts":
     case "tsx":
@@ -13217,6 +14332,13 @@ async function parseFileContent(file, content, lang) {
     }
   }
 }
+function withRelations(parsed, content, lang) {
+  let refs = parsed.refs ?? [];
+  if (refs.length === 0 && hasImportPatterns(lang)) {
+    refs = extractImports({ content, lang });
+  }
+  return { ...parsed, refs: refs.map((ref) => ref.lang ? ref : { ...ref, lang }) };
+}
 
 // src/codebase-index/indexer.ts
 var YIELD_EVERY_N = 50;
@@ -13253,7 +14375,7 @@ function normalizeComparablePath(value) {
 }
 function gitOutput(projectRoot, args) {
   return new Promise((resolve17, reject) => {
-    execFile2(
+    execFile(
       "git",
       ["-C", projectRoot, ...args],
       {
@@ -13384,13 +14506,40 @@ function assignRefsToSymbols2(refs, symbols) {
     }
     if (!owner2 && ref.callType === "import") owner2 = ordered[0];
     if (!owner2 || owner2.id <= 0) continue;
-    const key = `${owner2.id}:${ref.toName}:${ref.callType}`;
+    const key = `${owner2.id}:${ref.toName}:${ref.callType}:${ref.module ?? ""}`;
     if (seen.has(key)) continue;
     seen.add(key);
     assigned.push({ ...ref, fromId: owner2.id });
   }
   return assigned;
 }
+async function resolveProjectRelations(store, projectRoot, opts) {
+  if (opts.signal?.aborted) return;
+  try {
+    const indexedFiles = store.getAllFileMetas().map((meta) => meta.file);
+    if (indexedFiles.length === 0) return;
+    const structure = await detectModuleRoots(projectRoot, indexedFiles);
+    if (opts.signal?.aborted) return;
+    store.setFilePackages(assignPackageLabels(structure, indexedFiles));
+    const resolver = new ModuleResolver(
+      structure,
+      indexedFiles,
+      store.getNamespaceDeclarations()
+    );
+    const pending2 = store.getUnresolvedImports(opts.onlyFiles);
+    const resolutions = [];
+    for (const entry of pending2) {
+      const toFile = resolver.resolve(entry.fromFile, entry.lang, entry.module);
+      if (toFile && toFile !== entry.fromFile) {
+        resolutions.push({ ...entry, toFile });
+      }
+    }
+    if (opts.signal?.aborted) return;
+    store.applyImportResolutions(resolutions);
+  } catch (err) {
+    opts.errors.push(`relation resolution: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
 async function runIndexerWithStore(store, opts) {
   const { projectRoot, langs, ignore = [], signal } = opts;
   const relationGraphVersion = "2";
@@ -13635,6 +14784,14 @@ async function runIndexerWithStore(store, opts) {
     }
   }
   if (needsFullRefResolution) store.resolveRefs();
+  await resolveProjectRelations(store, projectRoot, {
+    // A watcher run re-resolves only what it touched; a full run (or a contract
+    // bump) re-resolves everything, because a newly indexed file can be the
+    // target of imports written long before it.
+    onlyFiles: needsFullRefResolution ? void 0 : opts.files,
+    errors,
+    signal
+  });
   store.setMetadata("ref_resolution_version", refResolutionVersion);
   store.setMetadata("relation_graph_version", relationGraphVersion);
   if (!opts.files || filesIndexed >= 50) store.optimize();
@@ -15184,17 +16341,17 @@ import {
 } from "@wrongstack/core/design";
 async function resolveReal(p) {
   const resolved = path25.resolve(p);
-  let probe2 = resolved;
+  let probe = resolved;
   const missing = [];
   for (; ; ) {
     try {
-      return path25.resolve(await fs20.realpath(probe2), ...missing);
+      return path25.resolve(await fs20.realpath(probe), ...missing);
     } catch (err) {
       if (err.code === "ENOENT") {
-        const parent = path25.dirname(probe2);
-        if (parent === probe2) return resolved;
-        missing.unshift(path25.basename(probe2));
-        probe2 = parent;
+        const parent = path25.dirname(probe);
+        if (parent === probe) return resolved;
+        missing.unshift(path25.basename(probe));
+        probe = parent;
         continue;
       }
       return resolved;
@@ -15469,7 +16626,7 @@ Replace off-palette colors with kit tokens (or the materialized CSS vars / token
 
 // src/diff.ts
 init_util();
-import { spawn as spawn8 } from "node:child_process";
+import { spawn as spawn7 } from "node:child_process";
 import { statSync as statSync3 } from "node:fs";
 import * as fs21 from "node:fs/promises";
 import * as path26 from "node:path";
@@ -15572,7 +16729,7 @@ function runGit(args, cwd, signal) {
   return new Promise((resolve17) => {
     let stdout = "";
     let stderr = "";
-    const child = spawn8("git", args, {
+    const child = spawn7("git", args, {
       cwd,
       signal,
       env: buildChildEnv3(),
@@ -15783,7 +16940,7 @@ function processFile(content, absPath, _style, _overwrite, target) {
 
 // src/e2e.ts
 init_util();
-import { open, readdir as readdir6 } from "node:fs/promises";
+import { open, readdir as readdir7 } from "node:fs/promises";
 import * as path27 from "node:path";
 async function readBoundedText(filePath, maxBytes) {
   let handle;
@@ -15901,7 +17058,7 @@ async function scanWorkspace(root, maxDepth, signal) {
     }
     let entries;
     try {
-      entries = await readdir6(current.directory, { withFileTypes: true });
+      entries = await readdir7(current.directory, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -15960,7 +17117,7 @@ async function detectPackageManager3(projectRoot, scanRoot, declared) {
   while (true) {
     const names = /* @__PURE__ */ new Set();
     try {
-      for (const entry of await readdir6(directory)) names.add(entry);
+      for (const entry of await readdir7(directory)) names.add(entry);
     } catch {
     }
     if (names.has("pnpm-lock.yaml")) return "pnpm";
@@ -16028,7 +17185,7 @@ async function collectSpecs(root, framework, testDirectory, signal) {
     if (scanned > MAX_SCAN_DIRECTORIES) return { count, samples, truncated: true };
     let entries;
     try {
-      entries = await readdir6(directory, { withFileTypes: true });
+      entries = await readdir7(directory, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -16229,7 +17386,7 @@ function findLadderMatches(fileLf, oldLf) {
   const exact = [];
   let idx = fileLf.indexOf(oldLf);
   while (idx !== -1) {
-    exact.push({ start: idx, end: idx + oldLf.length, startLine: lineAt(fileLf, idx) });
+    exact.push({ start: idx, end: idx + oldLf.length, startLine: lineAt2(fileLf, idx) });
     idx = fileLf.indexOf(oldLf, idx + 1);
   }
   if (exact.length > 0) return { tier: "exact", matches: exact };
@@ -16261,7 +17418,7 @@ function findLadderMatches(fileLf, oldLf) {
   if (normalized.length > 0) return { tier: "whitespace-normalized", matches: normalized };
   return fuzzyScan(fileLines, needleLines, offsets);
 }
-function lineAt(text, pos) {
+function lineAt2(text, pos) {
   if (pos < 512) {
     let line2 = 1;
     for (let i = 0; i < pos; i++) {
@@ -16723,7 +17880,7 @@ Compare this against your old_string and retry with the file's actual text.` : "
 };
 
 // src/exec.ts
-import { spawn as spawn9 } from "node:child_process";
+import { spawn as spawn8 } from "node:child_process";
 import {
   emitProcessCompleted as emitProcessCompleted3,
   emitProcessOutput as emitProcessOutput3,
@@ -17644,6 +18801,26 @@ var BLOCKED_ARG_PATTERNS = {
   pnpm: [],
   npx: []
 };
+var BLOCKED_OPTION_NAMES = {
+  git: /* @__PURE__ */ new Set([
+    "--exec",
+    "--upload-pack",
+    "--receive-pack",
+    "--exec-path",
+    "--git-dir",
+    "--work-tree",
+    "--namespace",
+    "-c",
+    "--config",
+    "--config-env",
+    "-C"
+  ]),
+  find: /* @__PURE__ */ new Set(["-exec", "-ok", "-execdir"])
+};
+function optionName(arg) {
+  const eq = arg.indexOf("=");
+  return eq > 0 ? arg.slice(0, eq) : arg;
+}
 var BLOCKED_SUBCOMMANDS = {
   docker: /* @__PURE__ */ new Set(["push"]),
   podman: /* @__PURE__ */ new Set(["push"]),
@@ -17681,6 +18858,15 @@ function validateArgs(cmd, args) {
     const blocked2 = blockedSequences.find((seq) => seq.every((part, idx) => actual[idx] === part));
     if (blocked2) return `Blocked subcommand "${blocked2.join(" ")}" for command "${cmd}"`;
   }
+  const blockedOptions = BLOCKED_OPTION_NAMES[cmd];
+  if (blockedOptions) {
+    for (const arg of args) {
+      if (arg === "--") break;
+      if (blockedOptions.has(optionName(arg))) {
+        return `Blocked option "${optionName(arg)}" for command "${cmd}"`;
+      }
+    }
+  }
   const blocked = BLOCKED_ARG_PATTERNS[cmd];
   if (!blocked) return null;
   for (const arg of args) {
@@ -17863,7 +19049,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     };
     let child;
     try {
-      child = spawn9(spawnCmd, spawnArgs, {
+      child = spawn8(spawnCmd, spawnArgs, {
         cwd,
         env: buildChildEnv2(sessionId),
         stdio: ["ignore", "pipe", "pipe"],
@@ -18497,7 +19683,7 @@ async function detectFixer(cwd) {
 
 // src/git.ts
 init_util();
-import { spawn as spawn10 } from "node:child_process";
+import { spawn as spawn9 } from "node:child_process";
 import { statSync as statSync4 } from "node:fs";
 import { dirname as dirname14, resolve as resolve13, sep as sep6 } from "node:path";
 import { assessCommitSafety } from "@wrongstack/core/coordination";
@@ -18714,11 +19900,8 @@ function buildArgs(input) {
         ...input.branch.startsWith("-") || input.branch.includes(" --") ? [] : [input.branch]
       ] : ["branch"];
     case "checkout":
-      return [
-        "checkout",
-        ...input.branch ? ["--", input.branch] : [],
-        ...files.length ? ["--", ...files] : []
-      ];
+      if (files.length) return ["checkout", "--", ...files];
+      return input.branch ? ["checkout", input.branch, "--"] : ["checkout"];
     case "stash":
       return input.message ? ["stash", "push", "-m", input.message] : ["stash", "push"];
     case "push":
@@ -18761,7 +19944,7 @@ function runGit2(args, cwd, signal) {
   return new Promise((resolve17) => {
     let stdout = "";
     let stderr = "";
-    const child = spawn10("git", args, {
+    const child = spawn9("git", args, {
       cwd,
       signal,
       env: buildChildEnv4(),
@@ -18823,7 +20006,7 @@ async function mapWithConcurrency2(items, limit, fn) {
 
 // src/glob.ts
 init_util();
-var DEFAULT_IGNORE2 = DEFAULT_WALK_IGNORE_DIRS2;
+var DEFAULT_IGNORE2 = new Set(DEFAULT_WALK_IGNORE_DIRS2);
 var WALK_CONCURRENCY = 16;
 var globTool = {
   name: "glob",
@@ -18902,7 +20085,7 @@ var globTool = {
       const matchedFiles = [];
       for (const e of entries) {
         const name = e.name;
-        if (DEFAULT_IGNORE2.includes(name)) continue;
+        if (DEFAULT_IGNORE2.has(name)) continue;
         const rel = relPrefix ? `${relPrefix}/${name}` : name;
         const full = path30.join(dir, name);
         if (e.isDirectory()) {
@@ -18952,7 +20135,7 @@ var globTool = {
 };
 
 // src/grep.ts
-import { spawn as spawn11 } from "node:child_process";
+import { spawn as spawn10 } from "node:child_process";
 import * as fs25 from "node:fs/promises";
 import * as path31 from "node:path";
 import { ToolValidationError as ToolValidationError4 } from "@wrongstack/core/types";
@@ -18976,6 +20159,81 @@ var DANGEROUS_PATTERNS = [
   // Greedy quantifier inside lookahead/lookbehind — (?!.*a+)
   /[([][^)\]]*[+*][^)\]]*[)\]][^)]*\?\??/
 ];
+function hasAmbiguousQuantifiedAlternation(pattern) {
+  for (let i = 0; i < pattern.length; i++) {
+    if (pattern[i] !== "(") continue;
+    if (i > 0 && pattern[i - 1] === "\\") continue;
+    let depth = 0;
+    let inClass = false;
+    let j = i;
+    for (; j < pattern.length; j++) {
+      const ch = pattern[j];
+      if (ch === "\\") {
+        j++;
+        continue;
+      }
+      if (inClass) {
+        if (ch === "]") inClass = false;
+        continue;
+      }
+      if (ch === "[") {
+        inClass = true;
+        continue;
+      }
+      if (ch === "(") depth++;
+      else if (ch === ")") {
+        depth--;
+        if (depth === 0) break;
+      }
+    }
+    if (j >= pattern.length) return false;
+    const next = pattern[j + 1];
+    if (next !== "+" && next !== "*" && next !== "{") continue;
+    let inner = pattern.slice(i + 1, j);
+    inner = inner.replace(/^\?(?::|<?[=!])/u, "");
+    const branches = [];
+    let current = "";
+    let d = 0;
+    let cls = false;
+    for (let k = 0; k < inner.length; k++) {
+      const ch = inner[k];
+      if (ch === "\\") {
+        current += ch + (inner[k + 1] ?? "");
+        k++;
+        continue;
+      }
+      if (cls) {
+        if (ch === "]") cls = false;
+        current += ch;
+        continue;
+      }
+      if (ch === "[") {
+        cls = true;
+        current += ch;
+        continue;
+      }
+      if (ch === "(") d++;
+      if (ch === ")") d--;
+      if (ch === "|" && d === 0) {
+        branches.push(current);
+        current = "";
+        continue;
+      }
+      current += ch;
+    }
+    branches.push(current);
+    if (branches.length < 2) continue;
+    for (let a = 0; a < branches.length; a++) {
+      for (let b = a + 1; b < branches.length; b++) {
+        const x = branches[a];
+        const y = branches[b];
+        if (x === "" || y === "") return true;
+        if (x === y || x.startsWith(y) || y.startsWith(x)) return true;
+      }
+    }
+  }
+  return false;
+}
 function compileUserRegex(pattern, flags) {
   if (typeof pattern !== "string") {
     return { ok: false, reason: "pattern must be a string" };
@@ -18994,6 +20252,12 @@ function compileUserRegex(pattern, flags) {
       };
     }
   }
+  if (hasAmbiguousQuantifiedAlternation(pattern)) {
+    return {
+      ok: false,
+      reason: "pattern quantifies an alternation with overlapping branches \u2014 rewrite so no two branches can match the same text"
+    };
+  }
   try {
     return { ok: true, regex: new RegExp(pattern, flags) };
   } catch (err) {
@@ -19010,7 +20274,7 @@ function capSubject(line) {
 
 // src/grep.ts
 init_util();
-var DEFAULT_IGNORE3 = DEFAULT_WALK_IGNORE_DIRS3;
+var DEFAULT_IGNORE3 = new Set(DEFAULT_WALK_IGNORE_DIRS3);
 var NATIVE_SCAN_CONCURRENCY = 32;
 var NATIVE_READ_CHUNK_BYTES = 64 * 1024;
 var NATIVE_MAX_FILE_BYTES = 1e6;
@@ -19083,7 +20347,7 @@ var grepTool = {
         field: "pattern"
       });
     }
-    const base = input.path ? safeResolve(input.path, ctx) : ctx.cwd;
+    const base = input.path ? await safeResolveReal(input.path, ctx) : ctx.cwd;
     const mode = input.output_mode ?? "content";
     const limit = Math.max(1, Math.min(input.limit ?? 200, 2e3));
     const validation = compileUserRegex(input.pattern, input.case_insensitive ? "i" : "");
@@ -19109,7 +20373,7 @@ var grepTool = {
 async function detectRg(signal) {
   return new Promise((resolve17) => {
     try {
-      const p = spawn11("rg", ["--version"], { env: buildChildEnv5(), stdio: "ignore", signal, windowsHide: true });
+      const p = spawn10("rg", ["--version"], { env: buildChildEnv5(), stdio: "ignore", signal, windowsHide: true });
       p.on("error", () => resolve17(false));
       p.on("close", (code) => resolve17(code === 0));
     } catch {
@@ -19143,7 +20407,7 @@ async function* runRgStream(input, base, mode, limit, signal) {
   const FLUSH_AT = 16;
   const MAX_BUF_BYTES = 1e6;
   let bufOverflow = false;
-  const child = spawn11("rg", args, {
+  const child = spawn10("rg", args, {
     signal,
     env: buildChildEnv5(),
     // rg diagnostics are not part of the tool result. Ignoring stderr avoids
@@ -19408,7 +20672,7 @@ async function runNative(input, base, mode, limit, signal) {
     const subdirs = [];
     for (const e of entries) {
       if (stopped) return;
-      if (DEFAULT_IGNORE3.includes(e.name)) continue;
+      if (DEFAULT_IGNORE3.has(e.name)) continue;
       if (e.isSymbolicLink()) continue;
       const rel = relPrefix ? `${relPrefix}/${e.name}` : e.name;
       const full = path31.join(dir, e.name);
@@ -19440,7 +20704,7 @@ async function runNative(input, base, mode, limit, signal) {
 init_spawn_stream();
 init_util();
 init_legacy_bridge();
-import { join as join25 } from "node:path";
+import { join as join24 } from "node:path";
 import {
   detectEcosystem as detectPackageEcosystem,
   recordPackageAction
@@ -19624,17 +20888,17 @@ function resolveManifestPath(cwd, pkgManager) {
     case "pnpm":
     case "yarn":
     case "npm":
-      return join25(cwd, "package.json");
+      return join24(cwd, "package.json");
     /* v8 ignore next 2 -- pkgManager is always pnpm/yarn/npm; the default is defensive. */
     default:
-      return join25(cwd, "package.json");
+      return join24(cwd, "package.json");
   }
 }
 
 // src/json.ts
-init_util();
 import * as fs26 from "node:fs/promises";
 import { deepMerge as deepMergeCore } from "@wrongstack/core/utils";
+init_util();
 var MAX_JSON_FILE_BYTES = 16 * 1024 * 1024;
 var MAX_JSON_FILE_BYTES_HUMAN = "16 MiB";
 var JsonFileTooLargeError = class extends Error {
@@ -20073,8 +21337,12 @@ function validateJsonSchema(data, schema) {
       }
     }
     if (typeof value === "string" && s["pattern"]) {
-      const re = new RegExp(s["pattern"]);
-      if (!re.test(value)) errors.push(`${path39}: does not match pattern ${s["pattern"]}`);
+      const compiled = compileUserRegex(s["pattern"], "");
+      if (!compiled.ok) {
+        errors.push(`${path39}: invalid schema pattern \u2014 ${compiled.reason}`);
+      } else if (!compiled.regex.test(capSubject(value))) {
+        errors.push(`${path39}: does not match pattern ${s["pattern"]}`);
+      }
     }
     if (typeof value === "string" && s["minLength"] !== void 0 && value.length < s["minLength"]) {
       errors.push(`${path39}: string too short (min ${s["minLength"]})`);
@@ -22473,7 +23741,7 @@ async function detectLinter(cwd) {
 }
 
 // src/logs.ts
-import { spawn as spawn12 } from "node:child_process";
+import { spawn as spawn11 } from "node:child_process";
 import { buildChildEnv as buildChildEnv6 } from "@wrongstack/core/utils";
 init_util();
 var logsTool = {
@@ -22580,7 +23848,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
       clearTimeout(timer);
       resolve17(result);
     };
-    const child = spawn12("docker", args, { cwd, signal, env: buildChildEnv6(), stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+    const child = spawn11("docker", args, { cwd, signal, env: buildChildEnv6(), stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
     const timer = setTimeout(() => {
       child.kill("SIGTERM");
       finish(empty());
@@ -22689,7 +23957,7 @@ function parseLine(line) {
 // src/outdated.ts
 init_util();
 init_win32_resolve();
-import { spawn as spawn13 } from "node:child_process";
+import { spawn as spawn12 } from "node:child_process";
 import { buildChildEnv as buildChildEnv7 } from "@wrongstack/core/utils";
 var outdatedTool = {
   name: "outdated",
@@ -22809,7 +24077,7 @@ function runOutdated(manager, args, cwd, signal) {
     const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
     const spawnCmd = shim?.command ?? resolved;
     const spawnArgs = shim?.args ?? args;
-    const child = spawn13(spawnCmd, spawnArgs, {
+    const child = spawn12(spawnCmd, spawnArgs, {
       cwd,
       signal,
       env: buildChildEnv7(),
@@ -22875,16 +24143,16 @@ function parseOutdatedOutput(json2, exitCode) {
 
 // src/patch.ts
 init_util();
-import { spawn as spawn14 } from "node:child_process";
+import { spawn as spawn13 } from "node:child_process";
 import * as fs27 from "node:fs/promises";
 import * as os9 from "node:os";
 import * as path32 from "node:path";
-import { buildChildEnv as buildChildEnv8 } from "@wrongstack/core/utils";
+import { buildChildEnv as buildChildEnv8, toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
 var patchTool = {
   name: "patch",
   category: "Filesystem",
   description: "Apply a unified diff (patch) to the project. This is the correct tool when you have a diff that needs to be applied precisely, including handling of rejects.",
-  usageHint: "Best used when you already have a diff (from generation, external source, or previous step).\n- Use `dry_run: true` to see what would happen without modifying files.\n- On failure it creates .rej and .orig files for manual review.\nOften cleaner than many small `edit` operations for larger changes.",
+  usageHint: "Best used when you already have a diff (from generation, external source, or previous step).\n- Use `dry_run: true` to see what would happen without modifying files.\n- Applied with `--merge`: a conflicting hunk writes git-style conflict\n  markers (<<<<<<< / ======= / >>>>>>>) INTO the file and reports failure.\n  It does NOT create .rej/.orig files. `files` lists what changed on disk\n  even when the patch failed, so read those back before retrying.\nOften cleaner than many small `edit` operations for larger changes.",
   selection: {
     doNotUseWhen: "you do not already have a unified diff or only need one precise replacement.",
     useInstead: ["edit"]
@@ -22910,31 +24178,50 @@ var patchTool = {
   },
   async execute(input, ctx, opts) {
     if (!input?.patch) throw new Error("patch: patch content is required");
-    const dir = input.directory ? safeResolve(input.directory, ctx) : ctx.cwd;
     const strip = Math.max(1, input.strip ?? 1);
     const dryRun = input.dry_run ?? false;
+    const refuse = (message) => ({
+      applied: 0,
+      rejected: 1,
+      files: [],
+      dry_run: dryRun,
+      message
+    });
+    let dir;
+    try {
+      dir = input.directory ? await safeResolveReal(input.directory, ctx) : ctx.cwd;
+    } catch (err) {
+      return refuse(`patch refused: ${toErrorMessage4(err)}`);
+    }
+    const realRoot = await fs27.realpath(ctx.projectRoot).catch(() => path32.resolve(ctx.projectRoot));
     const targets = extractDiffTargets(input.patch);
     const resolvedTargets = [];
     for (const t of targets) {
-      const stripped = stripPathComponents(t, strip);
+      const stripped = stripPathComponents(t.raw, strip);
       if (!stripped) continue;
+      if (path32.isAbsolute(stripped)) {
+        return refuse(`patch refused: target "${t.raw}" strips to absolute path`);
+      }
       const candidate = path32.resolve(dir, stripped);
-      const rel = path32.relative(ctx.projectRoot, candidate);
+      let real;
+      try {
+        real = await resolveRealInsideRoot(candidate, ctx);
+      } catch (err) {
+        return refuse(`patch refused: target "${t.raw}" ${toErrorMessage4(err)}`);
+      }
+      const rel = path32.relative(realRoot, real);
       if (rel.startsWith("..") || path32.isAbsolute(rel)) {
-        return {
-          applied: 0,
-          rejected: 1,
-          files: [],
-          dry_run: dryRun,
-          message: `patch refused: target "${t}" resolves outside project root`
-        };
+        return refuse(`patch refused: target "${t.raw}" resolves outside project root`);
       }
-      resolvedTargets.push(candidate);
+      resolvedTargets.push({ raw: t.raw, deleted: t.deleted, abs: real });
     }
     const beforeContents = /* @__PURE__ */ new Map();
+    const beforeExisted = /* @__PURE__ */ new Set();
     if (!dryRun) {
       for (const target of resolvedTargets) {
-        beforeContents.set(target, await readTextForTracking(target));
+        const existed = (await fs27.stat(target.abs).catch(() => null))?.isFile() ?? false;
+        if (existed) beforeExisted.add(target.abs);
+        beforeContents.set(target.abs, await readTextForTracking(target.abs));
       }
     }
     const tmpDir = await fs27.mkdtemp(path32.join(os9.tmpdir(), ".wstack_patch_"));
@@ -22944,32 +24231,70 @@ var patchTool = {
       const patchFile = path32.join(tmpDir, "in.diff");
       await fs27.writeFile(patchFile, input.patch, { mode: 384 });
       const args = [`-p${strip}`, "--merge", ...dryRun ? ["--dry-run"] : [], "-i", patchFile];
-      const result = await runPatch(args, dir, opts.signal);
-      if (result.exitCode !== 0 && !dryRun) {
-        return {
-          applied: 0,
-          rejected: 1,
-          files: [],
-          dry_run: dryRun,
-          message: `patch failed: ${result.stderr || result.stdout}`
-        };
-      }
-      const patched = extractPatchedFiles(result.stdout);
+      const result = await runPatch(args, dir, opts.signal, {
+        patchFile,
+        strip,
+        dryRun
+      });
+      const touched = [];
       if (!dryRun) {
         for (const target of resolvedTargets) {
-          const before = beforeContents.get(target) ?? null;
-          const after = await readTextForTracking(target);
+          const abs = target.abs;
+          const before = beforeContents.get(abs) ?? null;
+          const stat19 = await fs27.stat(abs).catch(() => null);
+          if (!stat19?.isFile()) {
+            if (beforeExisted.has(abs)) {
+              touched.push(abs);
+              ctx.session?.recordFileChange?.({
+                path: abs,
+                action: "deleted",
+                before,
+                after: null
+              });
+            }
+            continue;
+          }
+          const after = await readTextForTracking(abs);
           if (after === null || after === before) continue;
-          const stat19 = await fs27.stat(target).catch(() => null);
-          if (stat19) ctx.recordRead?.(target, stat19.mtimeMs, "write", sha256hex(after));
+          touched.push(abs);
+          ctx.recordRead?.(abs, stat19.mtimeMs, "write", sha256hex(after));
           ctx.session?.recordFileChange?.({
-            path: target,
+            path: abs,
             action: before === null ? "created" : "modified",
             before,
             after
           });
         }
       }
+      if (result.exitCode !== 0) {
+        if (!dryRun) {
+          const partial = touched.length > 0 ? ` ${touched.length} file(s) were still modified on disk and have been recorded for rewind: ${touched.map((p) => path32.relative(realRoot, p) || p).join(", ")}.` : "";
+          return {
+            applied: touched.length,
+            rejected: 1,
+            // Normalize to relative-to-realRoot for API consistency with the
+            // success path (which returns GNU patch's dir-relative names).
+            // `touched` entries are realpaths from resolveRealInsideRoot, and
+            // realRoot is also a realpath, so path.relative is like-for-like.
+            files: touched.map((p) => path32.relative(realRoot, p) || p),
+            dry_run: dryRun,
+            message: `patch failed: ${result.stderr || result.stdout}${partial}`
+          };
+        }
+        const wouldPatch = extractPatchedFiles(result.stdout);
+        return {
+          applied: wouldPatch.length,
+          rejected: 1,
+          files: wouldPatch,
+          dry_run: dryRun,
+          message: `patch preview: would conflict \u2014 ${result.stderr || result.stdout}`
+        };
+      }
+      const patched = result.engine === "git" ? [
+        ...new Set(
+          resolvedTargets.map((target) => path32.relative(dir, target.abs) || target.abs)
+        )
+      ] : extractPatchedFiles(result.stdout);
       return {
         applied: patched.length,
         rejected: 0,
@@ -22997,27 +24322,86 @@ async function readTextForTracking(absPath) {
 }
 function extractDiffTargets(patch) {
   const out = [];
-  const re = /^\+\+\+\s+([^\t\r\n]+)/gm;
-  for (const m of patch.matchAll(re)) {
-    const raw = m[1];
-    if (!raw) continue;
-    const target = raw.length > 4096 ? raw.slice(0, 4096).trim() : raw.trim();
-    if (!target || target === "/dev/null") continue;
-    out.push(target);
+  const clean = (raw) => {
+    if (!raw) return "";
+    return (raw.length > 4096 ? raw.slice(0, 4096) : raw).trim();
+  };
+  let lastOld;
+  let inHunk = false;
+  let oldLinesLeft = 0;
+  let newLinesLeft = 0;
+  for (const line of patch.split(/\r?\n/)) {
+    const hunkMatch = /^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(line);
+    if (hunkMatch) {
+      inHunk = true;
+      oldLinesLeft = hunkMatch[1] ? Number(hunkMatch[1]) : 1;
+      newLinesLeft = hunkMatch[2] ? Number(hunkMatch[2]) : 1;
+      lastOld = void 0;
+      continue;
+    }
+    if (inHunk) {
+      const ch = line[0];
+      if (ch === "-") oldLinesLeft--;
+      else if (ch === "+") newLinesLeft--;
+      else if (ch === " " || ch === void 0) {
+        oldLinesLeft--;
+        newLinesLeft--;
+      }
+      if (oldLinesLeft <= 0 && newLinesLeft <= 0) inHunk = false;
+      continue;
+    }
+    const oldMatch = /^---\s+([^\t\r\n]+)/.exec(line);
+    if (oldMatch) {
+      lastOld = clean(oldMatch[1]);
+      continue;
+    }
+    const newMatch = /^\+\+\+\s+([^\t\r\n]+)/.exec(line);
+    if (!newMatch) continue;
+    const newTarget = clean(newMatch[1]);
+    if (newTarget && newTarget !== "/dev/null") {
+      out.push({ raw: newTarget, deleted: false });
+    } else if (lastOld && lastOld !== "/dev/null") {
+      out.push({ raw: lastOld, deleted: true });
+    }
+    lastOld = void 0;
   }
   return out;
 }
 function stripPathComponents(p, strip) {
-  const parts = p.replace(/\\/g, "/").split("/").filter((s) => s !== "" && s !== ".");
-  if (parts.length <= strip) return void 0;
-  return parts.slice(strip).join("/");
+  const s = p.replace(/\\/g, "/");
+  let idx = 0;
+  for (let i = 0; i < strip; i++) {
+    while (idx < s.length && s[idx] !== "/") idx++;
+    let hadSlash = false;
+    while (idx < s.length && s[idx] === "/") {
+      idx++;
+      hadSlash = true;
+    }
+    if (!hadSlash) return void 0;
+  }
+  return s.slice(idx) || void 0;
+}
+function runPatch(args, cwd, signal, fallback) {
+  return runPatchProcess("patch", args, cwd, signal).then(async (result) => {
+    if (!result.unavailable) return { ...result, engine: "patch" };
+    const gitArgs = [
+      "apply",
+      "--unsafe-paths",
+      `-p${fallback.strip}`,
+      "--verbose",
+      ...fallback.dryRun ? ["--check"] : [],
+      fallback.patchFile
+    ];
+    const gitResult = await runPatchProcess("git", gitArgs, cwd, signal);
+    return { ...gitResult, engine: "git" };
+  });
 }
-function runPatch(args, cwd, signal) {
+function runPatchProcess(command, args, cwd, signal) {
   return new Promise((resolve17) => {
     let stdout = "";
     let stderr = "";
     const env = { ...buildChildEnv8(), LANG: "C", LC_ALL: "C" };
-    const child = spawn14("patch", args, {
+    const child = spawn13(command, args, {
       cwd,
       signal,
       env,
@@ -23030,13 +24414,24 @@ function runPatch(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve17({ exitCode: code ?? 1, stdout, stderr }));
-    child.on("error", (e) => resolve17({ exitCode: 1, stdout: "", stderr: e.message }));
+    child.on(
+      "close",
+      (code) => resolve17({ exitCode: code ?? 1, stdout, stderr, unavailable: false })
+    );
+    child.on(
+      "error",
+      (e) => resolve17({
+        exitCode: 1,
+        stdout: "",
+        stderr: e.message,
+        unavailable: e.code === "ENOENT"
+      })
+    );
   });
 }
 function extractPatchedFiles(output) {
   const files = [];
-  const re = /patching file (.+)/gi;
+  const re = /(?:patching|checking) file (.+)/gi;
   for (const m of output.matchAll(re)) {
     if (m[1]) files.push(m[1]);
   }
@@ -23345,7 +24740,7 @@ function mkResult(plan, ok, message, todos) {
 init_util();
 import * as fs28 from "node:fs/promises";
 import { FsError, ToolValidationError as ToolValidationError5 } from "@wrongstack/core/types";
-import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
 var ADVANCED_MODE_META_KEY = "tools.read.advancedMode";
 var MAX_BYTES2 = 5 * 1024 * 1024;
 var readTool = {
@@ -23413,7 +24808,7 @@ var readTool = {
         });
       }
       throw new FsError({
-        message: `read: failed to stat "${input.path}": ${toErrorMessage4(err)}`,
+        message: `read: failed to stat "${input.path}": ${toErrorMessage5(err)}`,
         code: "FS_READ_FAILED",
         path: absPath,
         context: { errno: code },
@@ -23614,7 +25009,7 @@ ${interesting.join("\n")}` : "symbols/imports: (none detected)"
 }
 
 // src/replace.ts
-import { spawn as spawn15 } from "node:child_process";
+import { spawn as spawn14 } from "node:child_process";
 import * as fs29 from "node:fs/promises";
 import * as path33 from "node:path";
 import { ToolValidationError as ToolValidationError6 } from "@wrongstack/core/types";
@@ -23799,7 +25194,7 @@ async function globFiles(pattern, base, extraGlob) {
 function checkRg() {
   return new Promise((resolve17) => {
     try {
-      const p = spawn15("rg", ["--version"], {
+      const p = spawn14("rg", ["--version"], {
         env: buildChildEnv9(),
         stdio: "ignore",
         windowsHide: true
@@ -23813,7 +25208,7 @@ function checkRg() {
 }
 function spawnRgFind(pattern, base) {
   const args = ["--files", "--glob", pattern, base];
-  const child = spawn15("rg", args, {
+  const child = spawn14("rg", args, {
     signal: AbortSignal.timeout(3e4),
     env: buildChildEnv9(),
     stdio: ["ignore", "pipe", "pipe"],
@@ -24072,7 +25467,7 @@ function substituteVars(content, name, vars) {
 // src/search.ts
 import { FetchError as FetchError3, ToolValidationError as ToolValidationError7 } from "@wrongstack/core/types";
 import { expectDefined as expectDefined9 } from "@wrongstack/core/utils";
-import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
 var DEFAULT_NUM = 10;
 var MAX_RESULTS = 50;
 var TIMEOUT_MS3 = 15e3;
@@ -24276,7 +25671,7 @@ async function duckduckgoSearch(query, num, signal) {
     return parseDuckDuckGo(html, num);
   } catch (err) {
     console.log(
-      JSON.stringify({ level: "debug", event: "search_failed", query, error: toErrorMessage5(err) })
+      JSON.stringify({ level: "debug", event: "search_failed", query, error: toErrorMessage6(err) })
     );
     return [{ title: "Search unavailable", url: "https://duckduckgo.com/unavailable", snippet: "Could not reach DuckDuckGo", score: 0 }];
   }
@@ -24460,7 +25855,7 @@ function decodeHtmlEntities(text) {
 
 // src/set-working-dir.ts
 import * as fs31 from "node:fs/promises";
-import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage7 } from "@wrongstack/core/utils";
 var setWorkingDirTool = {
   name: "set_working_dir",
   category: "Context",
@@ -24494,7 +25889,7 @@ var setWorkingDirTool = {
     } catch (err) {
       return {
         current: ctx.workingDir,
-        error: toErrorMessage6(err)
+        error: toErrorMessage7(err)
       };
     }
     try {
@@ -25229,7 +26624,7 @@ var toolHelpTool = {
     const format = input.format ?? "short";
     const includeExamples = input.include_examples ?? false;
     if (input.tool) {
-      const tool = ctx.tools.find((t) => t.name === input.tool);
+      const tool = (ctx.catalogTools ?? ctx.tools).find((t) => t.name === input.tool);
       if (!tool) {
         return {
           tool: input.tool,
@@ -25254,7 +26649,7 @@ var toolHelpTool = {
         total: 1
       };
     }
-    const allTools = ctx.tools.map((t) => ({
+    const allTools = (ctx.catalogTools ?? ctx.tools).map((t) => ({
       name: t.name,
       description: t.description,
       usageHint: t.usageHint ?? "",
@@ -25362,7 +26757,7 @@ var toolSearchTool = {
   },
   async execute(input, ctx) {
     const limit = Math.min(input.limit ?? 20, 100);
-    const tools = ctx.tools;
+    const tools = ctx.catalogTools ?? ctx.tools;
     const query = input.query?.toLowerCase() ?? "";
     const filtered = tools.filter((t) => {
       if (query && !t.name.toLowerCase().includes(query) && !t.description.toLowerCase().includes(query)) {
@@ -25442,7 +26837,7 @@ var toolUseTool = {
         executionMs: 0
       };
     }
-    const tool = ctx.tools.find((t) => t.name === input.tool);
+    const tool = (ctx.catalogTools ?? ctx.tools).find((t) => t.name === input.tool);
     if (!tool) {
       return {
         tool: input.tool,
@@ -25500,7 +26895,13 @@ init_util();
 import * as fs32 from "node:fs/promises";
 import * as path36 from "node:path";
 import { DEFAULT_WALK_IGNORE_DIRS as DEFAULT_WALK_IGNORE_DIRS4, expectDefined as expectDefined10 } from "@wrongstack/core/utils";
-var DEFAULT_IGNORE5 = [...DEFAULT_WALK_IGNORE_DIRS4, ".wrongstack", ".ssh", ".gnupg", ".aws"];
+var DEFAULT_IGNORE5 = /* @__PURE__ */ new Set([
+  ...DEFAULT_WALK_IGNORE_DIRS4,
+  ".wrongstack",
+  ".ssh",
+  ".gnupg",
+  ".aws"
+]);
 var DEFAULT_MAX_ENTRIES2 = 5e3;
 var MAX_TREE_OUTPUT_BYTES = 256 * 1024;
 var treeTool = {
@@ -25661,8 +27062,12 @@ async function walkDir(dir, depth, opts) {
     return true;
   });
   if (depth > 0) {
-    const dirCount = filtered.filter((e) => e.isDirectory()).length;
-    const fileCount = filtered.filter((e) => e.isFile()).length;
+    let dirCount = 0;
+    let fileCount = 0;
+    for (const e of filtered) {
+      if (e.isDirectory()) dirCount++;
+      else if (e.isFile()) fileCount++;
+    }
     opts.totalDirs.value += dirCount;
     opts.totalFiles.value += fileCount;
     opts.onProgress?.();
@@ -25852,7 +27257,7 @@ var writeTool = {
     required: ["path", "content"]
   },
   async execute(input, ctx, opts) {
-    return writeFile7(input, ctx, opts?.signal);
+    return writeFile6(input, ctx, opts?.signal);
   },
   async *executeStream(input, ctx, opts) {
     const prepared = await prepareWrite(input, ctx);
@@ -25865,7 +27270,7 @@ var writeTool = {
     yield { type: "final", output: await finishWrite(input, ctx, prepared, opts?.signal) };
   }
 };
-async function writeFile7(input, ctx, signal) {
+async function writeFile6(input, ctx, signal) {
   return finishWrite(input, ctx, await prepareWrite(input, ctx), signal);
 }
 async function prepareWrite(input, ctx) {
@@ -26343,6 +27748,62 @@ ${mode.description}`
   };
 }
 
+// src/next-steps-tool.ts
+import {
+  MAX_PENDING_NEXT_STEPS,
+  writePendingNextSteps
+} from "@wrongstack/core/agent";
+var nextStepsTool = {
+  name: "nextsteps",
+  category: "Session",
+  description: "Record the after-task follow-on suggestions for this turn. Equivalent to ending your final message with a <nextsteps> block \u2014 use whichever you prefer. The list is fully replaced on every call (not appended).",
+  usageHint: 'Call this at most once, on the turn you are finishing the work \u2014 not mid-task.\n- Each `text` is the **exact prompt message** that gets submitted back to you when the user picks it. Write agent-directed work ("Run the parser tests and fix any failures"), never a chore for the user to do by hand.\n- Order by priority; 1-4 items. Do not pad with filler or invent work to fill the list.\n- `auto: true` is honored on the first item only. Set it when that prompt is safe to run unattended \u2014 YOLO+auto executes it verbatim, so it must be complete and self-contained.\n- Omit the call entirely while any todo is still `pending` or `in_progress`; suggestions recorded in that state are discarded.\n- If you also write a <nextsteps> block in your message, that block wins.',
+  permission: "auto",
+  mutating: false,
+  // mutates only turn-scoped conversation state — no confirmation needed
+  timeoutMs: 5e3,
+  capabilities: ["session.nextsteps"],
+  icon: "todo",
+  inputSchema: {
+    type: "object",
+    properties: {
+      steps: {
+        type: "array",
+        minItems: 1,
+        maxItems: MAX_PENDING_NEXT_STEPS,
+        items: {
+          type: "object",
+          properties: {
+            text: {
+              type: "string",
+              description: "The exact natural-language prompt message to submit back to the agent when the user selects this item."
+            },
+            auto: {
+              type: "boolean",
+              description: "Safe to run unattended. Honored on the first item only; ignored elsewhere."
+            }
+          },
+          required: ["text"]
+        },
+        description: `The complete suggestion list (1-${MAX_PENDING_NEXT_STEPS} items), highest priority first. Replaces any previous list for this turn.`
+      }
+    },
+    required: ["steps"]
+  },
+  async execute(input, ctx) {
+    if (!Array.isArray(input?.steps)) {
+      throw new Error("nextsteps: steps must be an array");
+    }
+    const steps = input.steps.filter((s) => typeof s?.text === "string").map((s) => s.auto === true ? { text: s.text, auto: true } : { text: s.text });
+    if (steps.length === 0) {
+      throw new Error("nextsteps: steps must contain at least one item with a non-empty text");
+    }
+    writePendingNextSteps(ctx, steps);
+    const accepted = Math.min(steps.length, MAX_PENDING_NEXT_STEPS);
+    return { accepted, auto: steps[0]?.auto === true };
+  }
+};
+
 // src/pack.ts
 var builtinToolsPack = {
   name: "builtin-tools",
@@ -26943,6 +28404,11 @@ function createGlobalPsSlashCommand() {
 // src/skill.ts
 import * as fs34 from "node:fs/promises";
 import * as path38 from "node:path";
+import {
+  missingRequiredRuntimeTools,
+  missingRuntimeCapabilities,
+  runtimeToolReferencesFromText
+} from "@wrongstack/core/agent-catalog";
 import { SKILL_LIMITS, stripFrontmatter } from "@wrongstack/core/skills";
 import { ToolValidationError as ToolValidationError10 } from "@wrongstack/core/types";
 var MAX_BODY_CHARS = SKILL_LIMITS.MAX_SKILL_BODY_CHARS;
@@ -26986,12 +28452,37 @@ function makeSkillTool(skillLoader) {
           field: "name"
         });
       }
+      const availableToolNames = (ctx?.catalogTools ?? ctx?.tools ?? []).map((tool) => tool.name);
+      const missingCapabilities = missingRuntimeCapabilities(
+        manifest.requiredCapabilities,
+        availableToolNames
+      );
+      const missingTools = missingRequiredRuntimeTools(manifest.requiredTools, availableToolNames);
+      if (missingCapabilities.length > 0 || missingTools.length > 0) {
+        throw new ToolValidationError10({
+          message: `skill "${name}" is unavailable in this runtime; ` + [
+            missingCapabilities.length > 0 ? `missing capabilities: ${missingCapabilities.join(", ")}` : "",
+            missingTools.length > 0 ? `missing tools: ${missingTools.join(", ")}` : ""
+          ].filter(Boolean).join("; "),
+          field: "name"
+        });
+      }
       const dir = path38.dirname(manifest.path);
       let loadedResource;
       if (input.resource?.trim()) {
         loadedResource = await loadResource(dir, input.resource.trim());
       }
       const raw = await skillLoader.readBody(name);
+      const missingBodyTools = missingRequiredRuntimeTools(
+        runtimeToolReferencesFromText(raw),
+        availableToolNames
+      );
+      if (missingBodyTools.length > 0) {
+        throw new ToolValidationError10({
+          message: `skill "${name}" references unregistered tools: ${missingBodyTools.join(", ")}`,
+          field: "name"
+        });
+      }
       const body = stripFrontmatter(raw).trim().slice(0, MAX_BODY_CHARS);
       const resources = loadedResource ? [] : await listResources(dir);
       try {
@@ -27050,9 +28541,26 @@ async function loadResource(skillDir, rel) {
       field: "resource"
     });
   }
+  let realPath;
+  let realRoot;
+  try {
+    realRoot = await fs34.realpath(root);
+    realPath = await fs34.realpath(absPath);
+  } catch {
+    throw new ToolValidationError10({
+      message: `skill: resource "${rel}" not readable`,
+      field: "resource"
+    });
+  }
+  if (realPath !== realRoot && !realPath.startsWith(realRoot + path38.sep)) {
+    throw new ToolValidationError10({
+      message: `skill: resource "${rel}" resolves outside the skill directory`,
+      field: "resource"
+    });
+  }
   let buf;
   try {
-    buf = await fs34.readFile(absPath);
+    buf = await fs34.readFile(realPath);
   } catch {
     throw new ToolValidationError10({
       message: `skill: resource "${rel}" not readable`,
@@ -27063,7 +28571,9 @@ async function loadResource(skillDir, rel) {
   const truncated = raw.length > MAX_RESOURCE_CHARS;
   return {
     rel: norm,
-    absPath,
+    // The canonical path — the one actually opened, and the one a follow-up
+    // `bash` invocation should use.
+    absPath: realPath,
     content: truncated ? raw.slice(0, MAX_RESOURCE_CHARS) : raw,
     bytes: buf.length,
     truncated
@@ -27171,6 +28681,9 @@ var TOOL_ICON_MAP = {
   // Task management
   todo: "todo",
   todos: "todo",
+  // After-task suggestions — same family as the todo board, so it reuses the
+  // icon rather than widening ToolIconId (every UI maps that union by hand).
+  nextsteps: "todo",
   // Planning
   plan: "plan",
   planning: "plan",
@@ -27297,11 +28810,7 @@ function selectBuiltinToolsForTier(tier, allTools) {
     }
     case "aggressive": {
       const tier1Names = toolNameSet(TIER1_TOOLS);
-      const tier2Names = toolNameSet(TIER2_TOOLS);
-      const tier3Names = toolNameSet(TIER3_TOOLS);
-      return allTools.filter(
-        (tool) => tier1Names.has(tool.name) || tier2Names.has(tool.name) && tool.name !== "task" || tier3Names.has(tool.name) && tool.name !== "set_working_dir"
-      );
+      return allTools.filter((tool) => tier1Names.has(tool.name));
     }
   }
 }
@@ -27428,6 +28937,7 @@ export {
   mirrorSessionPlanToKanban,
   mirrorSessionTasksToKanban,
   mirrorSessionTodosToKanban,
+  nextStepsTool,
   normalizeShell,
   onIndexStateChange,
   outdatedTool,