@wrongstack/tools 0.305.1 → 0.306.2

package/dist/index.js

@@ -422,8 +422,11 @@ var init_redact_command = __esm({
       /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
       // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
       // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
+      // The value must be token-like (>= 8 chars) so ordinary combined flags such
+      // as `tar -tf` / `ssh -tt` are not eaten. Global flag: EVERY occurrence is
+      // redacted, not just the first.
       // NOTE: synced with @wrongstack/core observability/redact-command.ts.
-      /(?<![-\w])-t(?:[=\s]+)?[^\s,-]+/,
+      /(?<![-\w])-t(?:[=\s]+)?[^\s,-]{8,}/g,
       // -p|-password|-a (redis auth) short flags: attached + separated + =value.
       // Same token-start anchor; over-redaction is an accepted tradeoff for a
       // redaction function. Synced with core copy.
@@ -431,8 +434,9 @@ var init_redact_command = __esm({
       // env var–style secrets: TOKEN=x, API_KEY=y, etc.
       /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
       // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
-      // when preceded by a flag name (e.g. --github-token=EyJ...).
-      /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/
+      // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
+      // every such flag in the command line is redacted, not just the first.
+      /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/g
     ];
   }
 });
@@ -521,11 +525,15 @@ var init_process_registry = __esm({
         return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
       }
       _canSignalProcessGroup(p) {
-        return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && typeof p.child.pid === "number" && p.child.pid === p.pid;
+        return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && p.child !== null && typeof p.child.pid === "number" && p.child.pid === p.pid;
       }
       _killChildDirect(p, signal) {
         try {
-          p.child.kill(signal);
+          if (p.child) {
+            p.child.kill(signal);
+            return;
+          }
+          if (this._isSafeSignalPid(p.pid)) process.kill(p.pid, signal);
         } catch {
         }
       }
@@ -723,15 +731,15 @@ var init_process_registry = __esm({
         this._pruneStale(pid);
         const p = this.processes.get(pid);
         if (!p) return false;
-        if (p.killed) return true;
+        if (p.killed && opts.force !== true) return true;
         if (p.protected && opts.includeProtected !== true) return false;
         if (opts.preserveBackground && p.background) return false;
         const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
         const isWin5 = os.platform() === "win32";
         if (isWin5) {
-          const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
+          const liveRealChild = p.child === null || p.child.exitCode === null && typeof p.child.pid === "number";
           const directFallback = () => {
-            if (p.child.exitCode === null) {
+            if (p.child && p.child.exitCode === null) {
               try {
                 p.child.kill("SIGKILL");
               } catch {
@@ -743,10 +751,7 @@ var init_process_registry = __esm({
             onSettled: directFallback
           })) {
           } else {
-            try {
-              p.child.kill(force ? "SIGKILL" : "SIGTERM");
-            } catch {
-            }
+            this._killChildDirect(p, force ? "SIGKILL" : "SIGTERM");
           }
           p.killed = true;
           return true;
@@ -757,7 +762,7 @@ var init_process_registry = __esm({
           } else {
             this._killPosix(p, "SIGTERM");
             const timer = setTimeout(() => {
-              if (this.processes.has(pid) && !p.child.killed) {
+              if (this.processes.has(pid) && !p.child?.killed) {
                 this._killPosix(p, "SIGKILL");
               }
             }, graceMs);
@@ -812,6 +817,16 @@ var init_process_registry = __esm({
        * before reusing a PID, but we want to clean up before that becomes a risk.
        */
       _isStaleEntry(entry) {
+        if (entry.child === null) {
+          if (Date.now() - entry.startedAt <= 6e4) return false;
+          if (os.platform() === "win32") return false;
+          try {
+            process.kill(entry.pid, 0);
+            return false;
+          } catch (err) {
+            return err.code !== "EPERM";
+          }
+        }
         return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
       }
       /**
@@ -1013,8 +1028,8 @@ async function* spawnStream(opts) {
   try {
     for (; ; ) {
       while (queue.length === 0) {
-        await new Promise((resolve17) => {
-          waiter = resolve17;
+        await new Promise((resolve18) => {
+          waiter = resolve18;
         });
       }
       const chunk = queue.shift();
@@ -1102,19 +1117,48 @@ import * as Core from "@wrongstack/core/utils";
 function sha256hex(content) {
   return createHash("sha256").update(content, "utf8").digest("hex");
 }
-async function detectPackageManager(cwd) {
-  const { stat: stat19 } = await import("node:fs/promises");
-  try {
-    await stat19(`${cwd}/pnpm-lock.yaml`);
-    return "pnpm";
-  } catch {
+async function detectPackageManager(cwd, stopAt) {
+  let dir = path3.resolve(cwd);
+  const stop = stopAt ? path3.resolve(stopAt) : dir;
+  for (; ; ) {
+    const found = await detectPackageManagerInDir(dir);
+    if (found) return found;
+    if (dir === stop) break;
+    const parent = path3.dirname(dir);
+    const relParent = path3.relative(stop, parent);
+    if (parent === dir || relParent.startsWith("..") || path3.isAbsolute(relParent)) break;
+    dir = parent;
   }
+  return "npm";
+}
+async function detectPackageManagerInDir(dir) {
+  const fs36 = await import("node:fs/promises");
   try {
-    await stat19(`${cwd}/yarn.lock`);
-    return "yarn";
+    const raw = await fs36.readFile(path3.join(dir, "package.json"), "utf8");
+    const declared = JSON.parse(raw).packageManager;
+    if (typeof declared === "string") {
+      const name = declared.split("@")[0] ?? "";
+      if (name === "pnpm" || name === "yarn") return name;
+      if (name === "npm" || name === "bun") return "npm";
+    }
   } catch {
   }
-  return "npm";
+  const lockfiles = [
+    ["pnpm-lock.yaml", "pnpm"],
+    ["yarn.lock", "yarn"],
+    ["bun.lockb", "npm"],
+    ["bun.lock", "npm"],
+    ["package-lock.json", "npm"],
+    ["npm-shrinkwrap.json", "npm"]
+  ];
+  for (const [file, manager] of lockfiles) {
+    try {
+      await fs36.stat(`${dir}/${file}`);
+      return manager;
+    } catch {
+    }
+  }
+  return null;
 }
 function resolvePath(input, ctx) {
   return path3.isAbsolute(input) ? path3.normalize(input) : path3.resolve(ctx.workingDir ?? ctx.cwd, input);
@@ -1173,6 +1217,20 @@ async function safeResolveReal(input, ctx) {
   const abs = safeResolve(input, ctx);
   return await resolveRealInsideRoot(abs, ctx);
 }
+function truncateDiffPayload(diff, maxBytes) {
+  const total = Buffer.byteLength(diff, "utf8");
+  if (total <= maxBytes) return { text: diff, truncated: false };
+  const MARKER_RESERVE = 96;
+  let head = takeHeadBytes(diff, Math.max(0, maxBytes - MARKER_RESERVE));
+  const nl = head.lastIndexOf("\n");
+  if (nl > 0) head = head.slice(0, nl);
+  const kept = Buffer.byteLength(head, "utf8");
+  return {
+    text: `${head}
+\u2026[diff truncated: ${total - kept} of ${total} bytes omitted]`,
+    truncated: true
+  };
+}
 function truncateMiddle(s, max) {
   if (Buffer.byteLength(s, "utf8") <= max) return s;
   const half = Math.floor(max / 2);
@@ -2735,8 +2793,8 @@ async function scanDirectory(directory, depth, profiles, limits, state, extraIgn
     collectFileEvidence(directory, fullPath, entry.name, profiles, state);
   }
 }
-function collectFileEvidence(directory, fullPath, basename14, profiles, state) {
-  const lower = basename14.toLowerCase();
+function collectFileEvidence(directory, fullPath, basename15, profiles, state) {
+  const lower = basename15.toLowerCase();
   const extension = path4.extname(lower);
   for (const profile of profiles) {
     const detector = profile.detectors.find(
@@ -2747,7 +2805,7 @@ function collectFileEvidence(directory, fullPath, basename14, profiles, state) {
       candidate.evidence.push({
         kind: detector.kind,
         path: fullPath,
-        value: basename14,
+        value: basename15,
         weight: detector.weight
       });
       if (detector.kind === "manifest" || detector.kind === "config") {
@@ -2875,8 +2933,8 @@ function normalizeLimits(input) {
 async function canonicalDirectory(input) {
   const resolved = path4.resolve(input);
   const real = await fs2.realpath(resolved);
-  const stat19 = await fs2.stat(real);
-  if (!stat19.isDirectory()) throw new Error(`Project root is not a directory: ${input}`);
+  const stat20 = await fs2.stat(real);
+  if (!stat20.isDirectory()) throw new Error(`Project root is not a directory: ${input}`);
   return real;
 }
 async function canonicalInside(input, root, label) {
@@ -3775,8 +3833,8 @@ async function executeInternal(options, startedAt) {
   const target = options.plan.evidence.find((item) => item.kind === "target")?.path;
   if (!target) return unavailableResult(options, "Internal syntax plan has no target evidence.");
   const safeTarget = await assertContainedFile(target, options.projectRoot);
-  const stat19 = await fs4.stat(safeTarget);
-  if (stat19.size > MAX_INTERNAL_SOURCE_BYTES) {
+  const stat20 = await fs4.stat(safeTarget);
+  if (stat20.size > MAX_INTERNAL_SOURCE_BYTES) {
     return unavailableResult(
       options,
       `Internal syntax target exceeds ${MAX_INTERNAL_SOURCE_BYTES} bytes.`
@@ -4063,8 +4121,8 @@ async function snapshotPaths(paths) {
   const existing = [];
   for (const candidate of paths) {
     try {
-      const stat19 = await fs4.stat(candidate);
-      if (!stat19.isFile()) continue;
+      const stat20 = await fs4.stat(candidate);
+      if (!stat20.isFile()) continue;
       existing.push(candidate);
     } catch {
     }
@@ -4075,15 +4133,15 @@ async function changedPaths(before, after, beforeSizes, afterSizes) {
   const beforeSet = new Set(before);
   const afterSet = new Set(after);
   const changed = /* @__PURE__ */ new Set();
-  for (const path40 of after) {
-    if (!beforeSet.has(path40)) changed.add(path40);
+  for (const path41 of after) {
+    if (!beforeSet.has(path41)) changed.add(path41);
   }
-  for (const path40 of before) {
-    if (!afterSet.has(path40)) changed.add(path40);
+  for (const path41 of before) {
+    if (!afterSet.has(path41)) changed.add(path41);
   }
   if (beforeSizes && afterSizes) {
-    for (const path40 of after) {
-      if (beforeSizes.get(path40) !== afterSizes.get(path40)) changed.add(path40);
+    for (const path41 of after) {
+      if (beforeSizes.get(path41) !== afterSizes.get(path41)) changed.add(path41);
     }
   }
   return [...changed].sort();
@@ -4092,8 +4150,8 @@ async function snapshotSizes(paths) {
   const sizes = /* @__PURE__ */ new Map();
   for (const candidate of paths) {
     try {
-      const stat19 = await fs4.stat(candidate);
-      if (stat19.isFile()) sizes.set(candidate, stat19.size);
+      const stat20 = await fs4.stat(candidate);
+      if (stat20.isFile()) sizes.set(candidate, stat20.size);
     } catch {
     }
   }
@@ -5551,7 +5609,7 @@ async function syncGoParse(filePath, content, lang) {
     }
     const goBinary = resolveWin32Command("go");
     const goResult = await new Promise(
-      (resolve17, reject) => {
+      (resolve18, reject) => {
         let settled = false;
         const proc = spawn5(goBinary, ["run", scriptPath], {
           stdio: ["pipe", "pipe", "pipe"],
@@ -5580,7 +5638,7 @@ async function syncGoParse(filePath, content, lang) {
           if (settled) return;
           settled = true;
           clearTimeout(timer);
-          resolve17({ code: code2, stdout: stdout2 });
+          resolve18({ code: code2, stdout: stdout2 });
         });
       }
     );
@@ -6245,7 +6303,7 @@ async function resolvePython() {
   return null;
 }
 function commandIsAvailable(command) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     let settled = false;
     const proc = spawn6(command, ["--version"], {
       stdio: "ignore",
@@ -6255,7 +6313,7 @@ function commandIsAvailable(command) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve17(available);
+      resolve18(available);
     };
     const timer = setTimeout(() => {
       proc.kill("SIGKILL");
@@ -6267,7 +6325,7 @@ function commandIsAvailable(command) {
   });
 }
 function spawnPyParser(pyBinary, scriptPath, filePath, content) {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     let settled = false;
     const proc = spawn6(pyBinary, [scriptPath, filePath], {
       stdio: ["pipe", "pipe", "pipe"],
@@ -6296,7 +6354,7 @@ function spawnPyParser(pyBinary, scriptPath, filePath, content) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve17({ code, stdout });
+      resolve18({ code, stdout });
     });
   });
 }
@@ -6705,9 +6763,9 @@ function parseSymbols6(opts) {
 function regexParse2(opts) {
   const { file, content, lang } = opts;
   const symbols = [];
-  const basename14 = path22.basename(file).toLowerCase();
-  const isPackageJson = basename14 === "package.json";
-  const isTsconfig = basename14 === "tsconfig.json" || basename14 === "tsconfig.build.json";
+  const basename15 = path22.basename(file).toLowerCase();
+  const isPackageJson = basename15 === "package.json";
+  const isTsconfig = basename15 === "tsconfig.json" || basename15 === "tsconfig.build.json";
   const isJsonSchema = content.includes("$schema") || content.includes("$id") || content.includes("$ref");
   const isOpenApi = content.includes("openapi") || content.includes("swagger");
   const lines = content.split("\n");
@@ -7989,11 +8047,18 @@ function ensureSessionShell(opts = {}) {
 init_spawn_stream();
 init_util();
 init_legacy_bridge();
+var SEVERITY_RANK = {
+  info: 0,
+  low: 1,
+  moderate: 2,
+  high: 3,
+  critical: 4
+};
 var auditTool = {
   name: "audit",
   category: "Package Management",
   description: "Run a security audit against project dependencies (using pnpm/npm audit). Reports known vulnerabilities with severity.",
-  usageHint: "CRITICAL SECURITY TOOL:\n\n- Run regularly and especially before any release.\n- Use `level` to focus on high/critical issues.\n- `fix` can attempt automatic remediation for some vulnerabilities.\nThis is one of the most important tools for supply chain security.",
+  usageHint: "CRITICAL SECURITY TOOL:\n\n- Run regularly and especially before any release.\n- Use `level` to focus on high/critical issues.\n- This tool is read-only: to remediate, use `install` (or `language_package`) to upgrade the affected packages.\nThis is one of the most important tools for supply chain security.",
   permission: "confirm",
   mutating: false,
   capabilities: ["shell.restricted"],
@@ -8008,8 +8073,10 @@ var auditTool = {
         enum: ["low", "moderate", "high", "critical"],
         description: "Minimum severity level to report"
       },
-      fix: { type: "boolean", description: "Attempt to fix vulnerabilities (default: false)" },
-      packages: { type: "string", description: "Specific package(s) to audit (comma-separated)" }
+      fix: {
+        type: "boolean",
+        description: "Deprecated and rejected \u2014 this tool is read-only and never modifies dependencies. Use `install` (or `language_package`) to remediate vulnerabilities."
+      }
     }
   },
   async execute(input, ctx, opts) {
@@ -8023,6 +8090,11 @@ var auditTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
+    if (input.fix === true) {
+      throw new Error(
+        "audit: `fix: true` is not supported \u2014 this tool is read-only (mutating: false). To remediate vulnerabilities, upgrade the affected packages with the `install` tool (or `language_package` for non-JS ecosystems)."
+      );
+    }
     const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
     const bridge = await tryLegacyPackageOperation("package-audit", {
       cwd,
@@ -8052,13 +8124,11 @@ var auditTool = {
       };
       return;
     }
-    const manager = await detectPackageManager(cwd);
+    const manager = await detectPackageManager(cwd, ctx.projectRoot);
     yield { type: "log", text: `Auditing with ${manager}\u2026`, data: { manager } };
     const args = ["audit", "--json"];
-    if (input.fix) args.push("--fix");
-    if (input.packages) {
-      const pkgs = Array.isArray(input.packages) ? input.packages : input.packages.split(",");
-      args.push(...pkgs.map((p) => p.trim()));
+    if (input.level && (manager === "npm" || manager === "pnpm")) {
+      args.push(`--audit-level=${input.level}`);
     }
     const result = yield* spawnStream({
       cmd: manager,
@@ -8067,10 +8137,16 @@ var auditTool = {
       signal: opts.signal,
       maxBytes: 1e5
     });
-    yield { type: "final", output: parseAuditOutput(result.stdout, result.exitCode) };
+    yield {
+      type: "final",
+      output: parseAuditOutput(result.stdout, result.exitCode, {
+        level: input.level,
+        spawnTruncated: result.truncated
+      })
+    };
   }
 };
-function parseAuditOutput(json2, exitCode) {
+function parseAuditOutput(json2, exitCode, opts = {}) {
   if (!json2) {
     return {
       exit_code: exitCode,
@@ -8081,18 +8157,14 @@ function parseAuditOutput(json2, exitCode) {
       truncated: false
     };
   }
+  const cappedOutput = normalizeCommandOutput(json2);
+  const truncated = opts.spawnTruncated === true || Buffer.byteLength(json2, "utf8") > COMMAND_OUTPUT_MAX_BYTES;
   try {
     const data = JSON.parse(json2);
-    const advisories = [];
-    const ads = data.advisories ?? {};
-    for (const id of Object.keys(ads)) {
-      const adv = ads[id];
-      advisories.push({
-        severity: adv.severity ?? "unknown",
-        package: adv.module_name ?? id,
-        title: adv.title ?? "Unknown vulnerability",
-        url: adv.url ?? ""
-      });
+    let advisories = extractAdvisories(data);
+    const minRank = opts.level ? SEVERITY_RANK[opts.level] ?? 0 : 0;
+    if (minRank > 0) {
+      advisories = advisories.filter((a) => (SEVERITY_RANK[a.severity] ?? 0) >= minRank);
     }
     const total = advisories.length;
     const summary = total === 0 ? "No vulnerabilities found" : `Found ${total} vulnerabilities: ${advisories.filter((a) => a.severity === "critical").length} critical, ${advisories.filter((a) => a.severity === "high").length} high`;
@@ -8101,8 +8173,8 @@ function parseAuditOutput(json2, exitCode) {
       vulnerabilities: advisories,
       total,
       summary,
-      output: json2,
-      truncated: json2.length > 1e5
+      output: cappedOutput,
+      truncated
     };
   } catch {
     return {
@@ -8110,15 +8182,47 @@ function parseAuditOutput(json2, exitCode) {
       vulnerabilities: [],
       total: 0,
       summary: "Could not parse audit output",
-      output: json2,
-      truncated: false
+      output: cappedOutput,
+      truncated
     };
   }
 }
+function extractAdvisories(data) {
+  const advisories = [];
+  const ads = data["advisories"];
+  if (ads && typeof ads === "object") {
+    for (const [id, value] of Object.entries(ads)) {
+      const adv = value ?? {};
+      advisories.push({
+        severity: typeof adv["severity"] === "string" ? adv["severity"] : "unknown",
+        package: typeof adv["module_name"] === "string" ? adv["module_name"] : id,
+        title: typeof adv["title"] === "string" ? adv["title"] : "Unknown vulnerability",
+        url: typeof adv["url"] === "string" ? adv["url"] : ""
+      });
+    }
+    return advisories;
+  }
+  const vulns = data["vulnerabilities"];
+  if (vulns && typeof vulns === "object") {
+    for (const [pkg, value] of Object.entries(vulns)) {
+      const vuln = value ?? {};
+      const via = Array.isArray(vuln["via"]) ? vuln["via"] : [];
+      const detail = via.find((v) => !!v && typeof v === "object");
+      advisories.push({
+        severity: typeof vuln["severity"] === "string" ? vuln["severity"] : "unknown",
+        package: pkg,
+        title: detail && typeof detail["title"] === "string" ? detail["title"] : "Unknown vulnerability",
+        url: detail && typeof detail["url"] === "string" ? detail["url"] : ""
+      });
+    }
+  }
+  return advisories;
+}
 
 // src/bash.ts
 import { spawn as spawn3 } from "node:child_process";
 import * as os4 from "node:os";
+import { StringDecoder } from "node:string_decoder";
 import {
   emitProcessCompleted as emitProcessCompleted2,
   emitProcessOutput as emitProcessOutput2,
@@ -8399,7 +8503,6 @@ var PersistentProcessRegistry = class {
     try {
       const data = await readRegistryFile(this.registryPath);
       data.instances.set(String(entry.pid), entry);
-      const child = null;
       this.baseRegistry.register({
         pid: entry.pid,
         name: entry.name,
@@ -8407,7 +8510,7 @@ var PersistentProcessRegistry = class {
         startedAt: entry.startedAt,
         sessionId: entry.sessionId,
         protected: entry.protected,
-        child
+        child: null
       });
       await writeRegistryFile(this.registryPath, data);
     } finally {
@@ -8973,7 +9076,7 @@ function looksLikePowerShell(command) {
     return true;
   }
   if (PS_VERB_RE.test(trimmed)) return true;
-  if (/(?:^|[\s;&|])(gci|gi|gp|gcm|gps|sl|rm|cat|cp|mv)\b/i.test(trimmed)) {
+  if (/(?:^|[\s;&|])(gci|gi|gp|gcm|gps)\b/i.test(trimmed)) {
     return true;
   }
   if (looksLikePowerShellExtended(command)) return true;
@@ -9065,7 +9168,7 @@ var bashTool = {
   name: "bash",
   category: "Shell",
   description: "Execute an arbitrary command in the user's default shell (bash/zsh/pwsh/cmd). stdout and stderr are merged into one stream. This is the most powerful and dangerous tool \u2014 it gives the model full access to the developer's machine. Prefer specialized tools whenever possible.",
-  usageHint: "SECURITY WARNING: This tool runs with the full privileges of the current user.\n\nBest practices for the model:\n- Strongly prefer `exec` for known safe commands (node, npm, pnpm, tsc, git, etc.).\n- Use bash only when you genuinely need shell features (pipes, redirection, complex one-liners).\n- Prefer single focused commands over huge `&&` chains.\n- Use `background: true` only for long-running processes (dev servers, watchers).\n- The working directory is the project root.\n- Output may be truncated in the middle for very large results.",
+  usageHint: "SECURITY WARNING: This tool runs with the full privileges of the current user.\n\nBest practices for the model:\n- Strongly prefer `exec` for known safe commands (node, npm, pnpm, tsc, git, etc.).\n- Use bash only when you genuinely need shell features (pipes, redirection, complex one-liners).\n- Prefer single focused commands over huge `&&` chains.\n- Use `background: true` only for long-running processes (dev servers, watchers).\n- The working directory is the session working dir (changed via `set_working_dir`), defaulting to the project root.\n- Output may be truncated in the middle for very large results.",
   selection: {
     doNotUseWhen: "the command is allowlisted and does not require pipes, redirection, or shell expansion.",
     useInstead: ["exec"]
@@ -9079,7 +9182,14 @@ var bashTool = {
   // explicitly removes the implicit cross-tool aliasing.
   subjectKey: "command",
   capabilities: ["shell.arbitrary"],
-  timeoutMs: 3e5,
+  // Executor-level abort ceiling. Must sit ABOVE the per-call `timeout_ms`
+  // ceiling (600_000): the tool's own timer tree-kills and returns a
+  // structured `timed_out: true` result, while the executor's
+  // AbortSignal.timeout is a blunt abort. The old value (300_000) meant any
+  // timeout_ms > 5min was silently cut short by the executor. The 10s margin
+  // covers the kill/teardown window. (The executor additionally clamps to
+  // config `tools.maxToolTimeoutMs`.)
+  timeoutMs: 61e4,
   maxOutputBytes: MAX_OUTPUT,
   estimatedDurationMs: 3e4,
   inputSchema: {
@@ -9091,7 +9201,7 @@ var bashTool = {
       },
       timeout_ms: {
         type: "integer",
-        description: "Optional timeout for this specific command in milliseconds."
+        description: "Optional timeout for this specific command in milliseconds (default 300000, max 600000)."
       },
       background: {
         type: "boolean",
@@ -9142,16 +9252,7 @@ var bashTool = {
       return;
     }
     const PIPE_TO_SHELL_PATTERN = /\|\s*(sh|bash|ksh|zsh|fish|cmd|powershell|pwsh)/i;
-    if (PIPE_TO_SHELL_PATTERN.test(input.command)) {
-      console.warn(JSON.stringify({
-        level: "warn",
-        event: "bash.pipe_to_shell_detected",
-        message: "Detected pipe-to-shell pattern. Consider reviewing the full command before confirming.",
-        command_prefix: input.command.slice(0, 100),
-        // Log first 100 chars for review
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }));
-    }
+    const pipeToShellNote = PIPE_TO_SHELL_PATTERN.test(input.command) ? "\n\n[wrongstack] Caution: this command pipes output into a shell interpreter (pipe-to-shell). Piped content executes as arbitrary code \u2014 review the source before trusting the result, and prefer downloading to a file and inspecting it first." : "";
     const timeoutMs = Math.max(1, Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT_MS2, 6e5));
     const isWin5 = os4.platform() === "win32";
     let plan;
@@ -9185,11 +9286,12 @@ var bashTool = {
     const shell = plan.bin;
     const args = plan.useStdin ? [...plan.argv] : [...plan.argv, input.command];
     const env = buildChildEnv2(ctx.session?.id);
+    const spawnCwd = ctx.workingDir ?? ctx.projectRoot;
     const detached = !isWin5;
     const startedAt = Date.now();
     if (input.background) {
       const child2 = spawn3(shell, args, {
-        cwd: ctx.projectRoot,
+        cwd: spawnCwd,
         env,
         // PowerShell takes the script on stdin (no argv quoting); cmd.exe
         // and POSIX shells ignore stdin when given the command inline.
@@ -9220,7 +9322,7 @@ var bashTool = {
         parentPid: process.pid,
         command: redactCommand(`${shell} ${args.join(" ")}`),
         args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
-        cwd: ctx.projectRoot,
+        cwd: spawnCwd,
         background: true,
         startedAt: new Date(startedAt).toISOString()
       });
@@ -9264,7 +9366,9 @@ var bashTool = {
       yield {
         type: "final",
         output: {
-          output: "",
+          // Background runs have no captured output; the pipe-to-shell caution
+          // (when present) is the only thing worth surfacing.
+          output: pipeToShellNote.trim(),
           exit_code: null,
           timed_out: false,
           pid: pid2
@@ -9281,7 +9385,7 @@ var bashTool = {
       return;
     }
     const child = spawn3(shell, args, {
-      cwd: ctx.projectRoot,
+      cwd: spawnCwd,
       env,
       // PowerShell takes the script on stdin (no argv quoting); cmd.exe
       // and POSIX shells ignore stdin when given the command inline.
@@ -9306,7 +9410,7 @@ var bashTool = {
       parentPid: process.pid,
       command: redactCommand(`${shell} ${args.join(" ")}`),
       args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
-      cwd: ctx.projectRoot,
+      cwd: spawnCwd,
       background: false,
       startedAt: new Date(startedAt).toISOString()
     });
@@ -9397,10 +9501,10 @@ var bashTool = {
         queue.push(c);
       }
     };
-    const next = () => new Promise((resolve17) => {
+    const next = () => new Promise((resolve18) => {
       const c = queue.shift();
-      if (c) resolve17(c);
-      else resolveNext = resolve17;
+      if (c) resolve18(c);
+      else resolveNext = resolve18;
     });
     let lastFlush = Date.now();
     const flush = () => {
@@ -9425,8 +9529,10 @@ var bashTool = {
         child.stderr?.resume();
       }
     };
+    const stdoutDecoder = new StringDecoder("utf8");
+    const stderrDecoder = new StringDecoder("utf8");
     const onData = (chunk, stream) => {
-      const text = chunk.toString();
+      const text = (stream === "stdout" ? stdoutDecoder : stderrDecoder).write(chunk);
       if (stream === "stdout") stdoutBytes += chunk.byteLength;
       else stderrBytes += chunk.byteLength;
       emitProcessOutput2({ pid, stream, chunk });
@@ -9453,6 +9559,12 @@ var bashTool = {
       if (typeof pid === "number") registry.unregister(pid);
       registry.afterCall(Date.now() - startedAt, code !== 0 && code !== null);
       completeForeground(timedOut ? 124 : code ?? (signal ? 1 : 0), signal ?? void 0);
+      const tail = stdoutDecoder.end() + stderrDecoder.end();
+      if (tail) {
+        if (buf.length < MAX_OUTPUT) buf += tail.slice(0, MAX_OUTPUT - buf.length);
+        spool.write(tail);
+        pending2 += tail;
+      }
       push({ kind: "end", code });
     });
     try {
@@ -9472,7 +9584,7 @@ var bashTool = {
             output: {
               output: normalizeCommandOutput(buf) + (spooled ? spoolNote(spooled) : "") + (hint ? `
 
-${hint}` : ""),
+${hint}` : "") + pipeToShellNote,
               exit_code: c.code,
               timed_out: timedOut
             }
@@ -9534,7 +9646,7 @@ ${hint}` : ""),
     if (!sessionId) return;
     for (const entry of registry.bySession(sessionId)) {
       if (entry.name !== "bash") continue;
-      if (entry.child.exitCode !== null) continue;
+      if (entry.child && entry.child.exitCode !== null) continue;
       if (entry.background) continue;
       if (entry.protected) continue;
       registry.kill(entry.pid, { force: true });
@@ -9769,8 +9881,8 @@ function sweepOldArtifacts(root) {
       for (const name of names) {
         const target = path10.join(dir, name);
         try {
-          const stat19 = await fs7.stat(target);
-          if (stat19.isFile() && stat19.mtimeMs < cutoff) {
+          const stat20 = await fs7.stat(target);
+          if (stat20.isFile() && stat20.mtimeMs < cutoff) {
             await fs7.rm(target, { force: true });
             removed++;
           }
@@ -9798,14 +9910,14 @@ var BrowserArtifactStore = class {
   }
   async record(id, sessionId, kind, target, mimeType) {
     await fs7.chmod(target, 384).catch(() => void 0);
-    const [stat19, sha256] = await Promise.all([fs7.stat(target), hashFile(target)]);
+    const [stat20, sha256] = await Promise.all([fs7.stat(target), hashFile(target)]);
     const artifact = {
       id,
       kind,
       sensitivity: "sensitive",
       path: target,
       mimeType,
-      sizeBytes: stat19.size,
+      sizeBytes: stat20.size,
       sha256,
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     };
@@ -9845,11 +9957,11 @@ var BrowserArtifactStore = class {
 };
 async function hashFile(target) {
   const hash = createHash3("sha256");
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     const stream = createReadStream(target);
     stream.on("data", (chunk) => hash.update(chunk));
     stream.once("error", reject);
-    stream.once("end", resolve17);
+    stream.once("end", resolve18);
   });
   return hash.digest("hex");
 }
@@ -10004,7 +10116,7 @@ var BrowserNetworkGuardProxy = class {
   async start() {
     if (this.url) return this.url;
     if (this.startPromise) return this.startPromise;
-    this.startPromise = new Promise((resolve17, reject) => {
+    this.startPromise = new Promise((resolve18, reject) => {
       const onError = (error) => {
         this.server.off("listening", onListening);
         reject(error);
@@ -10017,7 +10129,7 @@ var BrowserNetworkGuardProxy = class {
           return;
         }
         this.url = `http://127.0.0.1:${address.port}`;
-        resolve17(this.url);
+        resolve18(this.url);
       };
       this.server.once("error", onError);
       this.server.once("listening", onListening);
@@ -10032,7 +10144,7 @@ var BrowserNetworkGuardProxy = class {
     for (const socket of this.sockets) socket.destroy();
     this.sockets.clear();
     if (!this.server.listening) return;
-    await new Promise((resolve17) => this.server.close(() => resolve17()));
+    await new Promise((resolve18) => this.server.close(() => resolve18()));
   }
   async forwardHttp(request2, response) {
     try {
@@ -10062,8 +10174,8 @@ var BrowserNetworkGuardProxy = class {
       upstream.on("error", () => writeProxyError(response, 502, "Bad Gateway"));
       request2.on("aborted", () => upstream.destroy());
       request2.pipe(upstream);
-    } catch {
-      writeProxyError(response, 403, "Blocked by browser network policy");
+    } catch (error) {
+      writeProxyError(response, 403, policyBlockMessage(error));
     }
   }
   async forwardConnect(request2, client, head) {
@@ -10087,8 +10199,8 @@ var BrowserNetworkGuardProxy = class {
         pipeDuplexPair(upstream, client);
       });
       client.once("close", () => upstream.destroy());
-    } catch {
-      client.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+    } catch (error) {
+      client.end(rawForbiddenResponse(policyBlockMessage(error)));
     }
   }
   async forwardUpgrade(request2, client, head) {
@@ -10129,9 +10241,9 @@ var BrowserNetworkGuardProxy = class {
       });
       client.once("close", () => upstream?.destroy());
       upstream.end();
-    } catch {
+    } catch (error) {
       upstream?.destroy();
-      client.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+      client.end(rawForbiddenResponse(policyBlockMessage(error)));
     }
   }
   resolve(rawUrl) {
@@ -10171,6 +10283,18 @@ function writeProxyError(response, status, message) {
   response.writeHead(status, { "content-type": "text/plain", connection: "close" });
   response.end(message);
 }
+function policyBlockMessage(error) {
+  const reason = error instanceof Error ? error.message : String(error);
+  return reason ? `Blocked by browser network policy: ${reason}` : "Blocked by browser network policy";
+}
+function rawForbiddenResponse(message) {
+  return `HTTP/1.1 403 Forbidden\r
+Content-Type: text/plain\r
+Content-Length: ${Buffer.byteLength(message)}\r
+Connection: close\r
+\r
+` + message;
+}
 
 // src/browser/manager.ts
 var DEFAULT_OPERATION_TIMEOUT_MS = 3e4;
@@ -10398,13 +10522,21 @@ var BrowserSessionManager = class {
       if (relative13.startsWith("..") || path11.isAbsolute(relative13)) {
         throw new Error("browser: upload files must stay inside the project root");
       }
-      const realFile = await fs8.realpath(absolute);
+      let realFile;
+      try {
+        realFile = await fs8.realpath(absolute);
+      } catch (error) {
+        if (error?.code === "ENOENT") {
+          throw new Error(`browser: upload file not found: ${file}`);
+        }
+        throw error;
+      }
       const realRelative = path11.relative(realRoot, realFile);
       if (realRelative.startsWith("..") || path11.isAbsolute(realRelative)) {
         throw new Error("browser: upload files must not escape the project root through a symlink");
       }
-      const stat19 = await fs8.stat(realFile);
-      if (!stat19.isFile()) throw new Error(`browser: upload target is not a file: ${file}`);
+      const stat20 = await fs8.stat(realFile);
+      if (!stat20.isFile()) throw new Error(`browser: upload target is not a file: ${file}`);
       resolved.push(realFile);
     }
     await this.runPageOperation(
@@ -10585,7 +10717,7 @@ function pushBounded(target, value, limit) {
 }
 async function abortable(signal, operation, onAbort) {
   signal.throwIfAborted();
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     let settled = false;
     let aborting = false;
     const finish = (fn) => {
@@ -10603,7 +10735,7 @@ async function abortable(signal, operation, onAbort) {
     signal.addEventListener("abort", abort, { once: true });
     operation().then(
       (value) => {
-        if (!aborting) finish(() => resolve17(value));
+        if (!aborting) finish(() => resolve18(value));
       },
       (err) => {
         if (!aborting) finish(() => reject(err));
@@ -10663,7 +10795,7 @@ var sessionIdSchema = {
 };
 var browserOpenTool = {
   name: "browser_open",
-  description: "Open an isolated first-party Playwright browser session, optionally navigating to a URL.",
+  description: "Open an isolated first-party Playwright browser session, optionally navigating to a URL. Private/localhost origins are blocked by default; enable specific origins via the WRONGSTACK_BROWSER_PRIVATE_ORIGINS env allowlist.",
   usageHint: "browser_open({ url?, width?, height?, trace? })",
   permission: "confirm",
   mutating: true,
@@ -10716,7 +10848,7 @@ var browserStatusTool = {
 };
 var browserNavigateTool = {
   name: "browser_navigate",
-  description: "Navigate an owned browser session to an approved http(s) URL.",
+  description: "Navigate an owned browser session to an approved http(s) URL. Private/localhost origins are blocked by default; enable specific origins via the WRONGSTACK_BROWSER_PRIVATE_ORIGINS env allowlist.",
   usageHint: "browser_navigate({ sessionId, url })",
   permission: "confirm",
   mutating: true,
@@ -11060,7 +11192,7 @@ async function shutdownBrowserTools() {
 import { spawn as spawn4 } from "node:child_process";
 import * as fs13 from "node:fs";
 import * as net3 from "node:net";
-import { StringDecoder } from "node:string_decoder";
+import { StringDecoder as StringDecoder2 } from "node:string_decoder";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { checkUnixSocketPath } from "@wrongstack/core/utils";
 
@@ -14104,12 +14236,12 @@ function projectIndexServerBuildId(entrypoint) {
   const cleanHref = href.split(/[?#]/, 1)[0] ?? href;
   const file = cleanHref.startsWith("file:") ? fileURLToPath(cleanHref) : path17.resolve(cleanHref);
   try {
-    const stat19 = fs12.statSync(file);
-    if (buildIdCache?.file === file && buildIdCache.mtimeMs === stat19.mtimeMs && buildIdCache.size === stat19.size) {
+    const stat20 = fs12.statSync(file);
+    if (buildIdCache?.file === file && buildIdCache.mtimeMs === stat20.mtimeMs && buildIdCache.size === stat20.size) {
       return buildIdCache.buildId;
     }
     const buildId = createHash4("sha256").update(fs12.readFileSync(file)).digest("hex").slice(0, 24);
-    buildIdCache = { file, mtimeMs: stat19.mtimeMs, size: stat19.size, buildId };
+    buildIdCache = { file, mtimeMs: stat20.mtimeMs, size: stat20.size, buildId };
     return buildId;
   } catch {
     return `unreadable:${path17.basename(file)}`;
@@ -14251,8 +14383,8 @@ function isProjectIndexServerHealth(value) {
   return typeof health.checkedAt === "number" && typeof health.uptimeMs === "number" && typeof memory?.rss === "number" && typeof memory.heapUsed === "number" && typeof memory.heapTotal === "number" && typeof memory.external === "number" && typeof health.clients === "number" && typeof health.activeRequests === "number" && typeof health.activeWrites === "number" && typeof health.queuedWrites === "number" && typeof health.pendingExternalFiles === "number" && typeof health.watchingExternal === "boolean" && typeof activity?.indexing === "boolean" && typeof activity.currentFile === "number" && typeof activity.totalFiles === "number" && typeof activity.generation === "number";
 }
 function delay(ms) {
-  return new Promise((resolve17) => {
-    const timer = setTimeout(resolve17, ms);
+  return new Promise((resolve18) => {
+    const timer = setTimeout(resolve18, ms);
     timer.unref?.();
   });
 }
@@ -14456,7 +14588,7 @@ var ProjectServerConnection = class {
       return Promise.reject(new Error("codebase-index server connection is not available"));
     }
     const id = this.nextId++;
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const timer = setTimeout(() => {
         const entry = this.pending.get(id);
         if (!entry) return;
@@ -14479,7 +14611,7 @@ var ProjectServerConnection = class {
         entry.reject(cancellationError(signal));
       } : void 0;
       this.pending.set(id, {
-        resolve: resolve17,
+        resolve: resolve18,
         reject,
         timer,
         signal,
@@ -14548,7 +14680,7 @@ var ProjectServerConnection = class {
     this.binaryBuffer = [];
     this.useBinary = false;
     this.textDecoder = null;
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       const socket = net3.createConnection(this.endpoint);
       this.socket = socket;
       const timer = setTimeout(() => {
@@ -14560,7 +14692,7 @@ var ProjectServerConnection = class {
         clearTimeout(timer);
         this.connectResolve = null;
         this.connectReject = null;
-        resolve17();
+        resolve18();
       };
       const finishReject = (error) => {
         clearTimeout(timer);
@@ -14583,7 +14715,7 @@ var ProjectServerConnection = class {
       this.onBinaryData(socket, chunk);
       return;
     }
-    if (!this.textDecoder) this.textDecoder = new StringDecoder("utf8");
+    if (!this.textDecoder) this.textDecoder = new StringDecoder2("utf8");
     this.buffer += this.textDecoder.write(chunk);
     while (true) {
       const newline = this.buffer.indexOf("\n");
@@ -15608,9 +15740,9 @@ var ParserWorkerPool = class {
     for (let i = 0; i < files.length; i++) {
       chunks[i % workerCount].push(files[i]);
     }
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve18, reject) => {
       this.pending.set(batchId, {
-        resolve: resolve17,
+        resolve: resolve18,
         reject,
         accumulated: [],
         expectedWorkers: workerCount,
@@ -15641,10 +15773,10 @@ var ParserWorkerPool = class {
     await Promise.allSettled(
       workers.map(
         (w) => Promise.race([
-          new Promise((resolve17) => {
-            w.once("exit", () => resolve17());
+          new Promise((resolve18) => {
+            w.once("exit", () => resolve18());
           }),
-          new Promise((resolve17) => setTimeout(() => resolve17(), 2e3))
+          new Promise((resolve18) => setTimeout(() => resolve18(), 2e3))
         ]).then(() => {
           if (!w.threadId) return;
           return w.terminate().catch(() => {
@@ -15708,7 +15840,7 @@ function shouldUseParserWorkerPool(candidateFileCount, parseBatchCount) {
   return !isFrugalPerf() && candidateFileCount >= WORKER_POOL_THRESHOLD && parseBatchCount > 1;
 }
 function yieldEventLoop() {
-  return new Promise((resolve17) => setImmediate(resolve17));
+  return new Promise((resolve18) => setImmediate(resolve18));
 }
 function throwIfAborted(signal) {
   if (!signal?.aborted) return;
@@ -15736,7 +15868,7 @@ function normalizeComparablePath(value) {
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 function gitOutput(projectRoot, args) {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     execFile(
       "git",
       ["-C", projectRoot, ...args],
@@ -15747,7 +15879,7 @@ function gitOutput(projectRoot, args) {
       },
       (error, stdout) => {
         if (error) reject(error);
-        else resolve17(Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout));
+        else resolve18(Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout));
       }
     );
   });
@@ -15979,9 +16111,9 @@ async function runIndexerWithStore(store, opts) {
     const statReadParse = await Promise.allSettled(
       batchFiles.map(
         async (file) => {
-          let stat19;
+          let stat20;
           try {
-            stat19 = await fs18.stat(file, statOpts);
+            stat20 = await fs18.stat(file, statOpts);
           } catch (e) {
             if (isAbortError(e)) throw e;
             return {
@@ -15993,21 +16125,21 @@ async function runIndexerWithStore(store, opts) {
               missing: isMissingPathError(e)
             };
           }
-          if (!stat19.isFile()) return { file, stat: stat19, lang: "", parsed: null };
+          if (!stat20.isFile()) return { file, stat: stat20, lang: "", parsed: null };
           const lang = detectLang(file);
-          if (!lang) return { file, stat: stat19, lang: "", parsed: null };
-          if (stat19.size > MAX_INDEX_FILE_BYTES) {
+          if (!lang) return { file, stat: stat20, lang: "", parsed: null };
+          if (stat20.size > MAX_INDEX_FILE_BYTES) {
             return {
               file,
-              stat: stat19,
+              stat: stat20,
               lang,
               parsed: null,
-              error: `file too large (${stat19.size} bytes; max ${MAX_INDEX_FILE_BYTES})`
+              error: `file too large (${stat20.size} bytes; max ${MAX_INDEX_FILE_BYTES})`
             };
           }
           const meta = existingMeta.get(file);
-          if (!force && meta && meta.mtimeMs === Math.floor(stat19.mtimeMs)) {
-            return { file, stat: stat19, lang, parsed: null, skippedMeta: meta };
+          if (!force && meta && meta.mtimeMs === Math.floor(stat20.mtimeMs)) {
+            return { file, stat: stat20, lang, parsed: null, skippedMeta: meta };
           }
           let content;
           try {
@@ -16016,7 +16148,7 @@ async function runIndexerWithStore(store, opts) {
             if (isAbortError(e)) throw e;
             return {
               file,
-              stat: stat19,
+              stat: stat20,
               lang,
               parsed: null,
               error: `read error: ${e instanceof Error ? e.message : String(e)}`
@@ -16026,15 +16158,15 @@ async function runIndexerWithStore(store, opts) {
           if (!force && meta && meta.contentHash && contentHash === meta.contentHash) {
             return {
               file,
-              stat: stat19,
+              stat: stat20,
               lang,
               parsed: null,
               content,
               contentHash,
-              skippedMeta: { ...meta, mtimeMs: Math.floor(stat19.mtimeMs) }
+              skippedMeta: { ...meta, mtimeMs: Math.floor(stat20.mtimeMs) }
             };
           }
-          return { file, stat: stat19, lang, parsed: null, content, contentHash };
+          return { file, stat: stat20, lang, parsed: null, content, contentHash };
         }
       )
     );
@@ -16113,7 +16245,7 @@ async function runIndexerWithStore(store, opts) {
         filesFailed++;
         continue;
       }
-      const { stat: stat19, lang, parsed } = result;
+      const { stat: stat20, lang, parsed } = result;
       if (result.skippedMeta) {
         langStats[lang] = (langStats[lang] ?? 0) + result.skippedMeta.symbolCount;
         symbolsIndexed += result.skippedMeta.symbolCount;
@@ -16137,7 +16269,7 @@ async function runIndexerWithStore(store, opts) {
           store.upsertFile({
             file,
             lang,
-            mtimeMs: Math.floor(stat19.mtimeMs),
+            mtimeMs: Math.floor(stat20.mtimeMs),
             symbolCount: 0,
             lastIndexed: Date.now(),
             contentHash: result.contentHash ?? ""
@@ -16151,7 +16283,7 @@ async function runIndexerWithStore(store, opts) {
         store.replaceEmptyFile({
           file,
           lang,
-          mtimeMs: Math.floor(stat19.mtimeMs),
+          mtimeMs: Math.floor(stat20.mtimeMs),
           symbolCount: 0,
           lastIndexed: Date.now(),
           contentHash: result.contentHash ?? ""
@@ -16165,7 +16297,7 @@ async function runIndexerWithStore(store, opts) {
         lang,
         symbols: parsed.symbols,
         refs: parsed.refs ?? [],
-        mtimeMs: Math.floor(stat19.mtimeMs),
+        mtimeMs: Math.floor(stat20.mtimeMs),
         symbolCount: parsed.symbols.length,
         contentHash: result.contentHash ?? ""
       });
@@ -16516,7 +16648,7 @@ function callIndexOp(op, args, opts) {
       opts.signal.reason instanceof Error ? opts.signal.reason : new Error("Indexing cancelled")
     );
   }
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve18, reject) => {
     const id = nextRpcId++;
     const timer = setTimeout(() => {
       pending.delete(id);
@@ -16538,7 +16670,7 @@ function callIndexOp(op, args, opts) {
     pending.set(id, {
       resolve: (v) => {
         cleanup();
-        resolve17(v);
+        resolve18(v);
       },
       reject: (e) => {
         cleanup();
@@ -16806,6 +16938,160 @@ function ensureCodebaseIndexServer(options) {
 }
 
 // src/codebase-index/codebase-index-tool.ts
+import { ToolValidationError } from "@wrongstack/core/types";
+
+// src/codebase-index/codebase-search-tool.ts
+import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
+var INDEXABLE_LANG_IDS = [
+  "ts",
+  "tsx",
+  "js",
+  "jsx",
+  "go",
+  "py",
+  "rs",
+  "json",
+  "yaml"
+];
+var codebaseSearchTool = {
+  name: "codebase-search",
+  category: "Project",
+  icon: "index",
+  description: "Search code symbols using a fast SQLite+BM25 index, with optional LSP fallback. Prefer this before broad `tree`, `glob`, or `grep` exploration when finding code by name or concept. Use `grep` instead for exact text, regexes, unsupported content, or concrete usage sites. Set `preferLsp: true` for live precision when the LSP plugin is active (supersedes codebase-lsp-search).",
+  usageHint: "FIRST CHOICE FOR INDEXABLE CODE UNDERSTANDING:\n\n- Call before broad `tree`, `glob`, or `grep` exploration when locating symbols, concepts, definitions, or candidate modules.\n- `kind` filter is very useful (e.g. only functions or only interfaces).\n- Combine with `file` filter to scope to a specific directory or module.\n- If `indexStatus` reports no persisted data, run `codebase-index` and retry.",
+  permission: "auto",
+  mutating: false,
+  capabilities: ["fs.read"],
+  // The index host has its own 30s read watchdog. Leave enough headroom for
+  // worker teardown and structured timeout reporting.
+  timeoutMs: 35e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      query: {
+        type: "string",
+        description: "Search query \u2014 searches symbol names, signatures, and doc comments"
+      },
+      kind: {
+        type: "string",
+        enum: [
+          "class",
+          "interface",
+          "enum",
+          "type",
+          "function",
+          "method",
+          "var",
+          "const",
+          "let",
+          "property",
+          "parameter",
+          "namespace",
+          "object",
+          "literal",
+          "schema",
+          "struct",
+          "trait",
+          "impl",
+          "static",
+          "mod"
+        ],
+        description: "Filter by indexed symbol kind"
+      },
+      lang: {
+        type: "string",
+        enum: [...INDEXABLE_LANG_IDS],
+        description: "Filter by indexed language"
+      },
+      lspKind: {
+        type: "integer",
+        description: "Filter by LSP SymbolKind number (e.g. 5=Class, 12=Function, 11=Interface, 10=Enum)"
+      },
+      file: {
+        type: "string",
+        description: "Filter to files matching this path substring"
+      },
+      limit: {
+        type: "integer",
+        description: "Maximum results to return (default 20, max 100)",
+        minimum: 1,
+        maximum: 100
+      },
+      preferLsp: {
+        type: "boolean",
+        description: "Prefer live LSP results over the index. Ignored unless the LSP plugin is active; when it is active and this is true, results come from live workspaceSymbol queries."
+      }
+    },
+    required: ["query"]
+  },
+  async execute(input, ctx, execOpts) {
+    const state = getIndexState();
+    if (state.indexing && !state.ready) {
+      return {
+        results: [],
+        total: 0,
+        query: input.query,
+        indexStatus: `Indexing in progress (${state.currentFile}/${state.totalFiles} files) \u2014 retry in a moment.`
+      };
+    }
+    if (state.lastError) {
+      const circuit = state.circuit;
+      const retryHint = circuit.state === "open" ? `Indexing is paused (circuit open, retry in ${Math.ceil(circuit.cooldownRemainingMs / 1e3)}s); the user can run /codebase-reindex to retry now.` : "Try /codebase-reindex.";
+      return {
+        results: [],
+        total: 0,
+        query: input.query,
+        indexStatus: `Index build failed: ${state.lastError}. ${retryHint}`
+      };
+    }
+    const limit = Math.max(1, Math.min(Math.trunc(input.limit ?? 20), 100));
+    let searched;
+    try {
+      searched = await searchCodebaseIndex(
+        {
+          projectRoot: ctx.projectRoot,
+          indexDir: codebaseIndexDirOverride(ctx),
+          query: input.query,
+          kind: input.kind?.toLowerCase(),
+          lang: input.lang?.toLowerCase(),
+          file: input.file,
+          lspKind: input.lspKind,
+          limit
+        },
+        { signal: execOpts?.signal }
+      );
+    } catch (err) {
+      if (execOpts?.signal?.aborted) throw err;
+      return {
+        results: [],
+        total: 0,
+        query: input.query,
+        indexStatus: `Index query failed: ${toErrorMessage3(err)}. Fall back to grep/glob for this lookup.`
+      };
+    }
+    const { results, total } = searched;
+    let hasPersistedIndex = state.ready || total > 0;
+    if (!hasPersistedIndex) {
+      try {
+        const stats = await codebaseIndexStats(
+          { projectRoot: ctx.projectRoot, indexDir: codebaseIndexDirOverride(ctx) },
+          { signal: execOpts?.signal }
+        );
+        hasPersistedIndex = stats.totalFiles > 0 || stats.lastIndexed !== null;
+      } catch {
+      }
+    }
+    return {
+      results,
+      total,
+      query: input.query,
+      ...hasPersistedIndex ? {} : { indexStatus: "No persisted index data found. Run codebase-index to build it." }
+    };
+  }
+};
+
+// src/codebase-index/codebase-index-tool.ts
+var MAX_REPORTED_ERRORS = 20;
 var codebaseIndexTool = {
   name: "codebase-index",
   category: "Project",
@@ -16831,12 +17117,23 @@ var codebaseIndexTool = {
       },
       langs: {
         type: "array",
-        items: { type: "string" },
-        description: "Limit reindex to specific languages: ts, tsx, js, jsx, go, py, rs"
+        items: { type: "string", enum: [...INDEXABLE_LANG_IDS] },
+        description: `Limit reindex to specific languages: ${INDEXABLE_LANG_IDS.join(", ")}`
       }
     }
   },
   async execute(input, ctx, execOpts) {
+    if (input.langs) {
+      const unknown = input.langs.filter(
+        (lang) => !INDEXABLE_LANG_IDS.includes(lang)
+      );
+      if (unknown.length > 0) {
+        throw new ToolValidationError({
+          message: `codebase-index: unknown lang(s) ${unknown.map((l) => `"${l}"`).join(", ")}. Valid ids: ${INDEXABLE_LANG_IDS.join(", ")}.`,
+          field: "langs"
+        });
+      }
+    }
     if (isIndexing()) {
       return {
         filesIndexed: 0,
@@ -16858,23 +17155,32 @@ var codebaseIndexTool = {
         note: `Codebase indexing is paused after repeated failures (last: ${circuit.lastFailure ?? "unknown"}). Auto-retry possible in ${Math.ceil(circuit.cooldownRemainingMs / 1e3)}s; the user can run /codebase-reindex to retry immediately.`
       };
     }
-    return await runStartupIndex({
+    const result = await runStartupIndex({
       projectRoot: ctx.projectRoot,
       force: input.force ?? false,
       langs: input.langs,
       indexDir: codebaseIndexDirOverride(ctx),
       signal: execOpts?.signal
     });
+    if (result.errors.length > MAX_REPORTED_ERRORS) {
+      const hidden = result.errors.length - MAX_REPORTED_ERRORS;
+      return {
+        ...result,
+        errors: [...result.errors.slice(0, MAX_REPORTED_ERRORS), `+${hidden} more`]
+      };
+    }
+    return result;
   }
 };
 
 // src/codebase-index/codebase-incoming-calls-tool.ts
+import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
 var codebaseIncomingCallsTool = {
   name: "codebase-incoming-calls",
   category: "Project",
   icon: "index",
-  description: "Find all callers of a function, method, or symbol \u2014 who invokes or references it. Uses the codebase index ref graph for instant, exact results. Always use this instead of grep when checking impact of a change.",
-  usageHint: 'CALL THIS BEFORE REFACTORING OR CHANGING ANY FUNCTION:\n\n- NEVER use grep or manual line reading to check where a function is called.\n- ALWAYS call codebase-incoming-calls({ symbol: "funcName" }) first.\n- Returns exact files, line numbers, caller signatures, and call types in milliseconds.\n- Use `file` to disambiguate when multiple symbols share a name.\n- Combine with codebase-outgoing-calls to see what the symbol itself calls.\nIf the index is not built, run codebase-index first.',
+  description: "Find all callers of a function, method, or symbol \u2014 who invokes or references it. Uses the codebase index ref graph for instant, exact results. Prefer this over grep for change-impact checks when the index is available.",
+  usageHint: 'CALL THIS BEFORE REFACTORING OR CHANGING ANY FUNCTION:\n\n- Prefer this over grep when the index is available; fall back to grep when the index is cold/unavailable or for dynamic dispatch the ref graph cannot see.\n- Call codebase-incoming-calls({ symbol: "funcName" }) before editing the symbol.\n- Returns exact files, line numbers, caller signatures, and call types in milliseconds.\n- Use `file` to disambiguate when multiple symbols share a name.\n- Combine with codebase-outgoing-calls to see what the symbol itself calls.\nIf the index is not built, run codebase-index first.',
   permission: "auto",
   mutating: false,
   capabilities: ["fs.read"],
@@ -16926,16 +17232,27 @@ var codebaseIncomingCallsTool = {
     }
     const limit = Math.max(1, Math.min(Math.trunc(input.limit ?? 50), 200));
     const transitive = input.transitive === true;
-    const { calls, symbolFound, ambiguous, totalMatches } = await incomingCallsService2(
-      {
-        projectRoot: ctx.projectRoot,
-        indexDir: codebaseIndexDirOverride(ctx),
+    let serviced;
+    try {
+      serviced = await incomingCallsService2(
+        {
+          projectRoot: ctx.projectRoot,
+          indexDir: codebaseIndexDirOverride(ctx),
+          symbol: input.symbol,
+          file: input.file,
+          limit,
+          transitive
+        }
+      );
+    } catch (err) {
+      return {
         symbol: input.symbol,
-        file: input.file,
-        limit,
-        transitive
-      }
-    );
+        calls: [],
+        total: 0,
+        indexStatus: `Index query failed: ${toErrorMessage4(err)}. Fall back to grep for this lookup.`
+      };
+    }
+    const { calls, symbolFound, ambiguous, totalMatches } = serviced;
     if (!symbolFound) {
       let hasPersistedIndex = state.ready;
       if (!hasPersistedIndex) {
@@ -16980,12 +17297,13 @@ var codebaseIncomingCallsTool = {
 };
 
 // src/codebase-index/codebase-outgoing-calls-tool.ts
+import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
 var codebaseOutgoingCallsTool = {
   name: "codebase-outgoing-calls",
   category: "Project",
   icon: "index",
   description: "Find all functions/methods/symbols that a given symbol calls or depends on \u2014 its callees. Uses the codebase index ref graph for instant, exact results. Use this to understand a function's dependencies before modifying it.",
-  usageHint: 'USE THIS TO UNDERSTAND A FUNCTION\'S DEPENDENCIES:\n\n- Call codebase-outgoing-calls({ symbol: "funcName" }) to see everything it calls.\n- Returns exact files, line numbers, callee signatures, and call types in milliseconds.\n- Use `file` to disambiguate when multiple symbols share a name.\n- Pair with codebase-incoming-calls for a complete impact picture: incoming = who calls you, outgoing = what you call.\nIf the index is not built, run codebase-index first.',
+  usageHint: 'USE THIS TO UNDERSTAND A FUNCTION\'S DEPENDENCIES:\n\n- Prefer this over grep when the index is available; fall back to grep when the index is cold/unavailable or for dynamic dispatch the ref graph cannot see.\n- Call codebase-outgoing-calls({ symbol: "funcName" }) to see everything it calls.\n- Returns exact files, line numbers, callee signatures, and call types in milliseconds.\n- Use `file` to disambiguate when multiple symbols share a name.\n- Pair with codebase-incoming-calls for a complete impact picture: incoming = who calls you, outgoing = what you call.\nIf the index is not built, run codebase-index first.',
   permission: "auto",
   mutating: false,
   capabilities: ["fs.read"],
@@ -17037,16 +17355,27 @@ var codebaseOutgoingCallsTool = {
     }
     const limit = Math.max(1, Math.min(Math.trunc(input.limit ?? 50), 200));
     const transitive = input.transitive === true;
-    const { calls, symbolFound, unresolvedCount, totalMatches } = await outgoingCallsService2(
-      {
-        projectRoot: ctx.projectRoot,
-        indexDir: codebaseIndexDirOverride(ctx),
+    let serviced;
+    try {
+      serviced = await outgoingCallsService2(
+        {
+          projectRoot: ctx.projectRoot,
+          indexDir: codebaseIndexDirOverride(ctx),
+          symbol: input.symbol,
+          file: input.file,
+          limit,
+          transitive
+        }
+      );
+    } catch (err) {
+      return {
         symbol: input.symbol,
-        file: input.file,
-        limit,
-        transitive
-      }
-    );
+        calls: [],
+        total: 0,
+        indexStatus: `Index query failed: ${toErrorMessage5(err)}. Fall back to grep for this lookup.`
+      };
+    }
+    const { calls, symbolFound, unresolvedCount, totalMatches } = serviced;
     if (!symbolFound) {
       let hasPersistedIndex = state.ready;
       if (!hasPersistedIndex) {
@@ -17090,132 +17419,6 @@ var codebaseOutgoingCallsTool = {
   }
 };
 
-// src/codebase-index/codebase-search-tool.ts
-var codebaseSearchTool = {
-  name: "codebase-search",
-  category: "Project",
-  icon: "index",
-  description: "Search code symbols using a fast SQLite+BM25 index, with optional LSP fallback. Prefer this before broad `tree`, `glob`, or `grep` exploration when finding code by name or concept. Set `preferLsp: true` for live precision when the LSP plugin is active (supersedes codebase-lsp-search).",
-  usageHint: "FIRST CHOICE FOR INDEXABLE CODE UNDERSTANDING:\n\n- Call before broad `tree`, `glob`, or `grep` exploration when locating symbols, concepts, definitions, or candidate modules.\n- `kind` filter is very useful (e.g. only functions or only interfaces).\n- Combine with `file` filter to scope to a specific directory or module.\n- If `indexStatus` reports no persisted data, run `codebase-index` and retry.\nUse `grep` afterwards for exact text, regexes, unsupported content, or concrete usage sites.",
-  permission: "auto",
-  mutating: false,
-  capabilities: ["fs.read"],
-  // The index host has its own 30s read watchdog. Leave enough headroom for
-  // worker teardown and structured timeout reporting.
-  timeoutMs: 35e3,
-  inputSchema: {
-    type: "object",
-    properties: {
-      query: {
-        type: "string",
-        description: "Search query \u2014 searches symbol names, signatures, and doc comments"
-      },
-      kind: {
-        type: "string",
-        enum: [
-          "class",
-          "interface",
-          "enum",
-          "type",
-          "function",
-          "method",
-          "var",
-          "const",
-          "let",
-          "property",
-          "parameter",
-          "namespace",
-          "object",
-          "literal",
-          "schema",
-          "struct",
-          "trait",
-          "impl",
-          "static",
-          "mod"
-        ],
-        description: "Filter by indexed symbol kind"
-      },
-      lang: {
-        type: "string",
-        enum: ["ts", "tsx", "js", "jsx", "go", "py", "rs", "json", "yaml"],
-        description: "Filter by indexed language"
-      },
-      lspKind: {
-        type: "integer",
-        description: "Filter by LSP SymbolKind number (e.g. 5=Class, 12=Function, 11=Interface, 10=Enum)"
-      },
-      file: {
-        type: "string",
-        description: "Filter to files matching this path substring"
-      },
-      limit: {
-        type: "integer",
-        description: "Maximum results to return (default 20, max 100)",
-        minimum: 1,
-        maximum: 100
-      },
-      preferLsp: {
-        type: "boolean",
-        description: "Prefer live LSP results over the index. Index-only when the LSP plugin is not active. When the LSP plugin is active and this is true, results come from live workspaceSymbol queries."
-      }
-    },
-    required: ["query"]
-  },
-  async execute(input, ctx, execOpts) {
-    const state = getIndexState();
-    if (state.indexing && !state.ready) {
-      return {
-        results: [],
-        total: 0,
-        query: input.query,
-        indexStatus: `Indexing in progress (${state.currentFile}/${state.totalFiles} files) \u2014 retry in a moment.`
-      };
-    }
-    if (state.lastError) {
-      const circuit = state.circuit;
-      const retryHint = circuit.state === "open" ? `Indexing is paused (circuit open, retry in ${Math.ceil(circuit.cooldownRemainingMs / 1e3)}s); the user can run /codebase-reindex to retry now.` : "Try /codebase-reindex.";
-      return {
-        results: [],
-        total: 0,
-        query: input.query,
-        indexStatus: `Index build failed: ${state.lastError}. ${retryHint}`
-      };
-    }
-    const limit = Math.max(1, Math.min(Math.trunc(input.limit ?? 20), 100));
-    const { results, total } = await searchCodebaseIndex(
-      {
-        projectRoot: ctx.projectRoot,
-        indexDir: codebaseIndexDirOverride(ctx),
-        query: input.query,
-        kind: input.kind?.toLowerCase(),
-        lang: input.lang?.toLowerCase(),
-        file: input.file,
-        lspKind: input.lspKind,
-        limit
-      },
-      { signal: execOpts?.signal }
-    );
-    let hasPersistedIndex = state.ready || total > 0;
-    if (!hasPersistedIndex) {
-      try {
-        const stats = await codebaseIndexStats(
-          { projectRoot: ctx.projectRoot, indexDir: codebaseIndexDirOverride(ctx) },
-          { signal: execOpts?.signal }
-        );
-        hasPersistedIndex = stats.totalFiles > 0 || stats.lastIndexed !== null;
-      } catch {
-      }
-    }
-    return {
-      results,
-      total,
-      query: input.query,
-      ...hasPersistedIndex ? {} : { indexStatus: "No persisted index data found. Run codebase-index to build it." }
-    };
-  }
-};
-
 // src/codebase-index/codebase-stats-tool.ts
 var codebaseStatsTool = {
   name: "codebase-stats",
@@ -17309,9 +17512,9 @@ import * as path25 from "node:path";
 var deadCodeScanTool = {
   name: "dead-code-scan",
   category: "Project",
-  icon: "search",
+  icon: "index",
   description: "Scan TypeScript/JavaScript source files for exported symbols that appear unused anywhere in the project. Uses the codebase-index reference graph (import/call/type-ref edges) to compute transitive reachability from package.json entry points. Requires a built codebase-index (run `codebase-index` first if you get no results).",
-  usageHint: 'PASS `path` TO SCOPE THE SCAN:\n\n- Defaults to the project root (all indexed files).\n- `path` can be a directory to scope the scan (e.g. "src/util/").\n- `entryPoints` overrides auto-detected entry points (comma-separated file paths).\n\nThe scan runs against the existing index; results are best-effort.',
+  usageHint: "SCANS ALL INDEXED FILES UNDER THE PROJECT ROOT:\n\n- `projectRoot` defaults to the current project root; `indexDir` overrides the resolved index location.\n- `entryPoints` is an array of file paths that AUGMENTS the auto-discovered entry points (package.json bin/main/exports/types plus conventional src/index.ts-style files) \u2014 it does not replace them.\n\nThe scan runs against the existing index; results are best-effort (dynamic imports, external consumers, and config-driven registration are invisible).",
   permission: "auto",
   mutating: false,
   capabilities: ["fs.read"],
@@ -18074,12 +18277,14 @@ import { statSync as statSync3 } from "node:fs";
 import * as fs22 from "node:fs/promises";
 import * as path27 from "node:path";
 import { buildChildEnv as buildChildEnv3 } from "@wrongstack/core/utils";
+import { ToolValidationError as ToolValidationError2 } from "@wrongstack/core/types";
 var MAX_FILE_DUMP_BYTES = 5 * 1024 * 1024;
+var MAX_GIT_DIFF_CHARS = 1e5;
 var diffTool = {
   name: "diff",
   category: "Filesystem",
   description: "Show file content with line numbers, staged/working-tree diffs via git, or commit/branch diffs. A safer and more structured alternative to raw `git diff` via shell.",
-  usageHint: 'USE FOR CODE REVIEW AND CHANGE INSPECTION:\n\n- `files` + no `a`/`b` \u2192 show file content with line numbers (NOT a unified diff; no +/- prefixes).\n- `a` and/or `b` \u2192 git-style commit/branch diff (unified format, real +/- prefixes).\n- `staged: true` \u2192 only show staged changes.\n- `mode` can be "unified", "stat", or "side-by-side" (only affects the git-diff path).\n\nNOTE: For a true file-vs-file unified diff, supply `a` and `b` so the tool delegates to `git diff`. The `files`-only path is a line-numbered dump, not a diff.\n\nThis tool has important safety guards against flag injection (see previous security findings).',
+  usageHint: 'USE FOR CODE REVIEW AND CHANGE INSPECTION:\n\n- `files` + no `a`/`b` \u2192 show file content with line numbers (NOT a unified diff; no +/- prefixes). Result `mode` is "dump".\n- `a` and/or `b` \u2192 git-style commit/branch diff (unified format, real +/- prefixes).\n- `staged: true` \u2192 only show staged changes.\n- `mode` only affects the git-diff path: "stat" runs `git diff --stat`; "side-by-side" is not supported and falls back to unified (result `mode` reports what was produced).\n- `context` sets the unified-diff context line count on the git path (`-U<n>`); the dump path has no context notion.\n\nNOTE: For a true file-vs-file unified diff, supply `a` and `b` so the tool delegates to `git diff`. The `files`-only path is a line-numbered dump, not a diff.\n\nThis tool has important safety guards against flag injection (see previous security findings).',
   permission: "auto",
   mutating: false,
   maxOutputBytes: 262144,
@@ -18112,11 +18317,12 @@ var diffTool = {
       mode: {
         type: "string",
         enum: ["unified", "side-by-side", "stat"],
-        description: 'Output format. "unified" is default, "stat" shows summary only.'
+        description: 'Output format for the git-diff path. "unified" is default; "stat" shows a summary only; "side-by-side" is not supported and falls back to unified. The `files`-only dump path ignores this.'
       },
       context: {
         type: "integer",
-        description: "Number of context lines for unified diffs (default: 3)."
+        minimum: 0,
+        description: "Number of context lines for git unified diffs (default: 3, passed as -U<n>). Ignored by the `files`-only dump path."
       }
     }
   },
@@ -18129,16 +18335,31 @@ var diffTool = {
 };
 async function gitDiff(input, ctx, signal) {
   if (input.a?.startsWith("-")) {
-    throw new Error(`diff: unsafe ref "${input.a}" \u2014 refs may not begin with '-' (flag injection)`);
+    throw new ToolValidationError2({
+      message: `diff: unsafe ref "${input.a}" \u2014 refs may not begin with '-' (flag injection)`,
+      field: "a"
+    });
   }
   if (input.b?.startsWith("-")) {
-    throw new Error(`diff: unsafe ref "${input.b}" \u2014 refs may not begin with '-' (flag injection)`);
+    throw new ToolValidationError2({
+      message: `diff: unsafe ref "${input.b}" \u2014 refs may not begin with '-' (flag injection)`,
+      field: "b"
+    });
   }
+  const requestedMode = input.mode ?? "unified";
+  const statMode = requestedMode === "stat";
+  const effectiveMode = statMode ? "stat" : "unified";
+  const sideBySideNote = requestedMode === "side-by-side" ? "side-by-side output is not supported; a unified diff was produced instead." : void 0;
   const gitDir = findGitDir(ctx.cwd);
   if (!gitDir) {
-    return { diff: "", files: [], truncated: false, mode: "unified" };
+    return { diff: "", files: [], truncated: false, mode: effectiveMode };
   }
   const args = ["diff", "--no-color"];
+  if (statMode) args.push("--stat");
+  if (!statMode && input.context !== void 0) {
+    const contextLines = Math.max(0, Math.floor(input.context));
+    if (Number.isFinite(contextLines)) args.push(`-U${contextLines}`);
+  }
   if (input.staged) args.push("--staged");
   if (input.a) args.push(input.a);
   if (input.b) args.push(input.b);
@@ -18147,19 +18368,30 @@ async function gitDiff(input, ctx, signal) {
     args.push("--", ...files.map((f) => f.trim()));
   }
   const result = await runGit(args, gitDir, signal);
+  let diff = result.stdout;
+  let truncated = false;
+  if (diff.length > MAX_GIT_DIFF_CHARS) {
+    let clipped = diff.slice(0, MAX_GIT_DIFF_CHARS);
+    const nl = clipped.lastIndexOf("\n");
+    if (nl > 0) clipped = clipped.slice(0, nl);
+    diff = `${clipped}
+\u2026[git diff truncated: ${result.stdout.length - clipped.length} of ${result.stdout.length} characters omitted]`;
+    truncated = true;
+  }
   return {
-    diff: result.stdout,
+    diff,
     files: [],
-    truncated: result.stdout.length > 1e5,
-    mode: "unified"
+    truncated,
+    mode: effectiveMode,
+    note: sideBySideNote
   };
 }
 function findGitDir(cwd) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat19 = statSync3(path27.join(dir, ".git"));
-      if (stat19.isDirectory()) return dir;
+      const stat20 = statSync3(path27.join(dir, ".git"));
+      if (stat20.isDirectory()) return dir;
     } catch {
     }
     const parent = path27.dirname(dir);
@@ -18169,7 +18401,7 @@ function findGitDir(cwd) {
   return null;
 }
 function runGit(args, cwd, signal) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     let stdout = "";
     let stderr = "";
     const child = spawn7("git", args, {
@@ -18185,8 +18417,8 @@ function runGit(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve17({ stdout, stderr, exitCode: code ?? 0 }));
-    child.on("error", (e) => resolve17({ stdout: "", stderr: e.message, exitCode: 1 }));
+    child.on("close", (code) => resolve18({ stdout, stderr, exitCode: code ?? 0 }));
+    child.on("error", (e) => resolve18({ stdout: "", stderr: e.message, exitCode: 1 }));
   });
 }
 async function fileDiff(input, ctx, _signal) {
@@ -18197,19 +18429,19 @@ async function fileDiff(input, ctx, _signal) {
       diff: "No files specified",
       files: [],
       truncated: false,
-      mode: input.mode ?? "unified"
+      mode: "dump"
     };
   }
   const results = [];
   let truncated = false;
   for (const file of files) {
-    const absPath = safeResolve(file, ctx);
-    const stat19 = await fs22.stat(absPath).catch(() => null);
-    if (!stat19?.isFile()) continue;
-    if (stat19.size > MAX_FILE_DUMP_BYTES) {
+    const absPath = await safeResolveReal(file, ctx);
+    const stat20 = await fs22.stat(absPath).catch(() => null);
+    if (!stat20?.isFile()) continue;
+    if (stat20.size > MAX_FILE_DUMP_BYTES) {
       truncated = true;
       results.push(
-        `--- ${file} (skipped: ${stat19.size} bytes exceeds the ${MAX_FILE_DUMP_BYTES} limit; use the read tool with offset/limit) ---`
+        `--- ${file} (skipped: ${stat20.size} bytes exceeds the ${MAX_FILE_DUMP_BYTES} limit; use the read tool with offset/limit) ---`
       );
       continue;
     }
@@ -18221,7 +18453,10 @@ async function fileDiff(input, ctx, _signal) {
     diff: results.join("\n\n"),
     files,
     truncated,
-    mode: input.mode ?? "unified"
+    // Honest mode: this path always produces a line-numbered dump — it never
+    // honors `mode`, so it must not echo the requested value back.
+    mode: "dump",
+    note: input.mode !== void 0 ? "The `files`-only path is a line-numbered dump; `mode` only affects the git-diff path (`a`/`b`)." : void 0
   };
 }
 function formatWithLineNumbers(file, lines) {
@@ -18234,11 +18469,12 @@ ${numbered}`;
 // src/document.ts
 init_util();
 import * as fs23 from "node:fs/promises";
+import * as path28 from "node:path";
 var documentTool = {
   name: "document",
   category: "Project",
-  description: "DEPRECATED \u2014 use the `auto_doc` tool with `dryRun: true` instead. This tool is a read-only preview stub that returns `skipped` candidates without generating real docstrings.",
-  usageHint: "Deprecated: prefer `auto_doc` with `dryRun: true` for previewing, or `auto_doc` without dryRun for writing. This tool only lists undocumented symbols with placeholder comments \u2014 it does not generate real JSDoc/TSDoc.",
+  description: "DEPRECATED \u2014 read-only preview stub that lists undocumented symbols as `skipped` candidates. It never writes files and does not generate real docstrings. If the auto-doc plugin is enabled, use its `auto_doc` tool (with `dry_run: true` to preview) instead.",
+  usageHint: "Deprecated: this tool only lists undocumented symbols with placeholder comments \u2014 it does not generate real JSDoc/TSDoc and writes nothing. When the auto-doc plugin is enabled, prefer its `auto_doc` tool (`dry_run: true` for previewing, without it for writing).",
   permission: "auto",
   mutating: false,
   timeoutMs: 3e4,
@@ -18274,7 +18510,11 @@ var documentTool = {
     const results = [];
     let filesProcessed = 0;
     let itemsDocumented = 0;
-    const fileList = input.files ? await resolveFiles(Array.isArray(input.files) ? input.files.join(",") : input.files, cwd) : input.path ? [safeResolve(input.path, ctx)] : [];
+    const fileList = input.files ? await resolveFiles(
+      Array.isArray(input.files) ? input.files.join(",") : input.files,
+      cwd,
+      ctx
+    ) : input.path ? [safeResolve(input.path, ctx)] : [];
     for (const absPath of fileList) {
       try {
         const content = await fs23.readFile(absPath, "utf8");
@@ -18307,14 +18547,21 @@ var documentTool = {
     };
   }
 };
-async function resolveFiles(filesInput, cwd) {
-  const files = Array.isArray(filesInput) ? filesInput : filesInput.split(",");
+async function resolveFiles(filesInput, cwd, ctx) {
+  const files = filesInput.split(",");
   const resolved = [];
   for (const f of files) {
-    const absPath = f.trim().startsWith("/") ? f.trim() : `${cwd}/${f.trim()}`;
+    const entry = f.trim();
+    if (!entry) continue;
+    let absPath;
+    try {
+      absPath = ensureInsideRoot(path28.resolve(cwd, entry), ctx);
+    } catch {
+      continue;
+    }
     try {
-      const stat19 = await fs23.stat(absPath);
-      if (stat19.isFile()) resolved.push(absPath);
+      const stat20 = await fs23.stat(absPath);
+      if (stat20.isFile()) resolved.push(absPath);
     } catch {
     }
   }
@@ -18384,7 +18631,7 @@ function processFile(content, absPath, _style, _overwrite, target) {
 // src/e2e.ts
 init_util();
 import { open, readdir as readdir7 } from "node:fs/promises";
-import * as path28 from "node:path";
+import * as path29 from "node:path";
 async function readBoundedText(filePath, maxBytes) {
   let handle;
   try {
@@ -18434,8 +18681,8 @@ var MAX_PACKAGE_BYTES = 512 * 1024;
 var MAX_CONFIG_BYTES = 512 * 1024;
 var MAX_SPEC_SAMPLES = 20;
 function relativePath(root, target) {
-  const value = path28.relative(root, target) || ".";
-  return value.split(path28.sep).join("/");
+  const value = path29.relative(root, target) || ".";
+  return value.split(path29.sep).join("/");
 }
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -18507,7 +18754,7 @@ async function scanWorkspace(root, maxDepth, signal) {
     }
     for (const entry of entries) {
       signal.throwIfAborted();
-      const absolutePath = path28.join(current.directory, entry.name);
+      const absolutePath = path29.join(current.directory, entry.name);
       if (entry.isFile()) {
         if (entry.name === "package.json") result.packageFiles.push(absolutePath);
         const framework = CONFIG_NAMES.get(entry.name);
@@ -18568,9 +18815,9 @@ async function detectPackageManager3(projectRoot, scanRoot, declared) {
     if (names.has("bun.lock") || names.has("bun.lockb")) return "bun";
     if (names.has("package-lock.json") || names.has("npm-shrinkwrap.json")) return "npm";
     if (directory === scanRoot) break;
-    const parent = path28.dirname(directory);
-    const relativeParent = path28.relative(scanRoot, parent);
-    if (parent === directory || relativeParent.startsWith("..") || path28.isAbsolute(relativeParent)) {
+    const parent = path29.dirname(directory);
+    const relativeParent = path29.relative(scanRoot, parent);
+    if (parent === directory || relativeParent.startsWith("..") || path29.isAbsolute(relativeParent)) {
       break;
     }
     directory = parent;
@@ -18615,7 +18862,7 @@ function isSpec(framework, filename) {
   return /\.(?:spec|test)\.(?:[cm]?[jt]sx?)$/i.test(filename);
 }
 async function collectSpecs(root, framework, testDirectory, signal) {
-  const roots = testDirectory ? [path28.resolve(root, testDirectory)] : framework === "cypress" ? [path28.join(root, "cypress", "e2e"), path28.join(root, "cypress", "integration")] : [path28.join(root, "tests")];
+  const roots = testDirectory ? [path29.resolve(root, testDirectory)] : framework === "cypress" ? [path29.join(root, "cypress", "e2e"), path29.join(root, "cypress", "integration")] : [path29.join(root, "tests")];
   const samples = [];
   let count = 0;
   let scanned = 0;
@@ -18634,7 +18881,7 @@ async function collectSpecs(root, framework, testDirectory, signal) {
     }
     for (const entry of entries) {
       signal.throwIfAborted();
-      const target = path28.join(directory, entry.name);
+      const target = path29.join(directory, entry.name);
       if (entry.isDirectory() && !SKIP_DIRECTORIES.has(entry.name)) queue.push(target);
       else if (entry.isFile() && isSpec(framework, entry.name)) {
         count += 1;
@@ -18654,7 +18901,7 @@ function nearestPackage(projectRoot, packagesByDirectory, scanRoot) {
     const found = packagesByDirectory.get(directory);
     if (found) return found;
     if (directory === scanRoot) return void 0;
-    const parent = path28.dirname(directory);
+    const parent = path29.dirname(directory);
     if (parent === directory || relativePath(scanRoot, parent).startsWith("..")) return void 0;
     directory = parent;
   }
@@ -18665,13 +18912,13 @@ async function discoverE2EProjects(root, options) {
   const packages = (await Promise.all(scan.packageFiles.map(readPackageInfo))).filter(
     (info) => Boolean(info)
   );
-  const packagesByDirectory = new Map(packages.map((info) => [path28.dirname(info.path), info]));
+  const packagesByDirectory = new Map(packages.map((info) => [path29.dirname(info.path), info]));
   const candidates = /* @__PURE__ */ new Map();
   for (const config of scan.configs) {
     if (options.framework && options.framework !== "all" && config.framework !== options.framework) {
       continue;
     }
-    const projectRoot = path28.dirname(config.absolutePath);
+    const projectRoot = path29.dirname(config.absolutePath);
     candidates.set(`${config.framework}:${projectRoot}`, {
       framework: config.framework,
       root: projectRoot,
@@ -18679,7 +18926,7 @@ async function discoverE2EProjects(root, options) {
     });
   }
   for (const info of packages) {
-    const projectRoot = path28.dirname(info.path);
+    const projectRoot = path29.dirname(info.path);
     for (const framework of frameworkFromPackage(info)) {
       if (options.framework && options.framework !== "all" && framework !== options.framework)
         continue;
@@ -18695,10 +18942,10 @@ async function discoverE2EProjects(root, options) {
     const scripts = matchingScripts(info, candidate.framework);
     const manager = await detectPackageManager3(candidate.root, root, info?.packageManager);
     const testDirectory = candidate.framework === "playwright" ? staticString(source, "testDir") : void 0;
-    const resolvedTestDirectory = testDirectory ? path28.resolve(candidate.root, testDirectory) : void 0;
-    const relativeTestDirectory = resolvedTestDirectory ? path28.relative(root, resolvedTestDirectory) : void 0;
+    const resolvedTestDirectory = testDirectory ? path29.resolve(candidate.root, testDirectory) : void 0;
+    const relativeTestDirectory = resolvedTestDirectory ? path29.relative(root, resolvedTestDirectory) : void 0;
     const unsafeTestDirectory = Boolean(
-      relativeTestDirectory && (relativeTestDirectory.startsWith("..") || path28.isAbsolute(relativeTestDirectory))
+      relativeTestDirectory && (relativeTestDirectory.startsWith("..") || path29.isAbsolute(relativeTestDirectory))
     );
     const specs = options.includeSpecs === false || unsafeTestDirectory ? { count: 0, samples: [], truncated: false } : await collectSpecs(candidate.root, candidate.framework, testDirectory, options.signal);
     const warnings = [];
@@ -18806,7 +19053,7 @@ import {
   toStyle,
   unifiedDiff
 } from "@wrongstack/core/utils";
-import { ToolValidationError } from "@wrongstack/core/types";
+import { ToolValidationError as ToolValidationError3 } from "@wrongstack/core/types";
 
 // src/_edit-match.ts
 var TIER_LABEL = {
@@ -19034,7 +19281,7 @@ function prefixSimilarity(a, b) {
 }
 
 // src/_syntax-check.ts
-import * as path29 from "node:path";
+import * as path30 from "node:path";
 var TS_LIKE = /* @__PURE__ */ new Set([".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"]);
 var MAX_CHECK_CHARS = 15e5;
 var MAX_ERRORS = 5;
@@ -19058,15 +19305,15 @@ async function checkSyntax(filePath, content, previousContent) {
   return { errors, preExisting };
 }
 function isJsoncFile(filePath) {
-  const base = path29.basename(filePath).toLowerCase();
+  const base = path30.basename(filePath).toLowerCase();
   if (base.endsWith(".jsonc")) return true;
   if (/^(tsconfig|jsconfig)([.-].*)?\.json$/.test(base)) return true;
-  const dir = path29.basename(path29.dirname(filePath)).toLowerCase();
+  const dir = path30.basename(path30.dirname(filePath)).toLowerCase();
   return dir === ".vscode";
 }
 async function parseErrors(filePath, content) {
   if (content.length > MAX_CHECK_CHARS) return void 0;
-  const ext = path29.extname(filePath).toLowerCase();
+  const ext = path30.extname(filePath).toLowerCase();
   if (ext === ".json" || ext === ".jsonc") {
     try {
       JSON.parse(content);
@@ -19093,7 +19340,7 @@ async function parseErrors(filePath, content) {
     ts2.ScriptKind.JSX
   );
   const sourceFile = ts2.createSourceFile(
-    path29.basename(filePath),
+    path30.basename(filePath),
     content,
     ts2.ScriptTarget.Latest,
     /* setParentNodes */
@@ -19120,6 +19367,7 @@ function formatDiag(ts2, diag, content, sourceFile) {
 
 // src/edit.ts
 init_util();
+var MAX_DIFF_BYTES = 262144;
 var editTool = {
   name: "edit",
   category: "Filesystem",
@@ -19130,46 +19378,62 @@ var editTool = {
     useInstead: ["write", "patch"]
   },
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on — the file being
+  // edited, so trust rules can scope by path.
+  subjectKey: "path",
   mutating: true,
   capabilities: ["fs.write"],
   icon: "edit",
   timeoutMs: 5e3,
+  maxOutputBytes: 262144,
   inputSchema: {
     type: "object",
     properties: {
-      path: { type: "string" },
-      old_string: { type: "string" },
-      new_string: { type: "string" },
-      replace_all: { type: "boolean" }
+      path: {
+        type: "string",
+        description: "Path to the file to edit \u2014 relative to the project root, or absolute inside it."
+      },
+      old_string: {
+        type: "string",
+        description: "The exact text to replace, including whitespace and indentation. Must be unique in the file unless `replace_all` is set \u2014 add surrounding lines to disambiguate."
+      },
+      new_string: {
+        type: "string",
+        description: "The exact replacement text (may be empty to delete `old_string`)."
+      },
+      replace_all: {
+        type: "boolean",
+        description: "Replace every occurrence instead of requiring a unique match. Only allowed when `old_string` matches exactly (or up to trailing whitespace) \u2014 fuzzy matches stay single-target."
+      }
     },
     required: ["path", "old_string", "new_string"]
   },
   async execute(input, ctx, opts) {
     if (!input?.path) {
-      throw new ToolValidationError({ message: "edit: path is required", field: "path" });
+      throw new ToolValidationError3({ message: "edit: path is required", field: "path" });
     }
     if (input.old_string === void 0) {
-      throw new ToolValidationError({
+      throw new ToolValidationError3({
         message: "edit: old_string is required",
         field: "old_string"
       });
     }
     if (input.new_string === void 0) {
-      throw new ToolValidationError({
+      throw new ToolValidationError3({
         message: "edit: new_string is required",
         field: "new_string"
       });
     }
     if (input.old_string === "") {
-      throw new ToolValidationError({
+      throw new ToolValidationError3({
         message: "edit: old_string cannot be empty",
         field: "old_string"
       });
     }
     const absPath = await safeResolveReal(input.path, ctx);
-    const stat19 = await fs24.stat(absPath).catch((err) => {
+    const stat20 = await fs24.stat(absPath).catch((err) => {
       if (err.code === "ENOENT") {
-        throw new ToolValidationError({
+        throw new ToolValidationError3({
           message: `edit: file "${input.path}" does not exist. Use \`write\` instead.`,
           field: "path",
           context: { exists: false }
@@ -19177,8 +19441,8 @@ var editTool = {
       }
       throw err;
     });
-    if (!stat19.isFile()) {
-      throw new ToolValidationError({
+    if (!stat20.isFile()) {
+      throw new ToolValidationError3({
         message: `edit: "${input.path}" is not a regular file`,
         field: "path"
       });
@@ -19191,7 +19455,7 @@ var editTool = {
     const lastReadHash = ctx.lastReadHash?.(absPath);
     if (lastReadHash !== void 0) {
       if (lastReadHash !== originalHash) {
-        throw new ToolValidationError({
+        throw new ToolValidationError3({
           message: `edit: file "${input.path}" was modified externally. Re-read it first.`,
           field: "path",
           context: { reason: "external_modification" }
@@ -19200,15 +19464,15 @@ var editTool = {
     } else {
       const lastReadMtime = ctx.lastReadMtime(absPath);
       if (lastReadMtime !== void 0 && updated.mtimeMs > lastReadMtime + mtimeTolerance) {
-        throw new ToolValidationError({
+        throw new ToolValidationError3({
           message: `edit: file "${input.path}" was modified externally. Re-read it first.`,
           field: "path",
           context: { reason: "external_modification" }
         });
       }
     }
-    if (autoRead && updated.mtimeMs > stat19.mtimeMs + mtimeTolerance) {
-      throw new ToolValidationError({
+    if (autoRead && updated.mtimeMs > stat20.mtimeMs + mtimeTolerance) {
+      throw new ToolValidationError3({
         message: `edit: file "${input.path}" changed while being auto-read. Retry the edit.`,
         field: "path",
         context: { reason: "auto_read_race" }
@@ -19220,6 +19484,9 @@ var editTool = {
     const oldLf = normalizeToLf(input.old_string);
     const newLf = normalizeToLf(input.new_string);
     if (oldLf === newLf) {
+      if (!fileLf.includes(oldLf)) {
+        throw noMatchError(input.path, fileLf, oldLf);
+      }
       if (autoRead) ctx.recordRead(absPath, updated.mtimeMs, "user", originalHash);
       return {
         path: absPath,
@@ -19233,26 +19500,20 @@ var editTool = {
     const ladder = findLadderMatches(fileLf, oldLf);
     if (!ladder) {
       opts?.signal?.throwIfAborted();
-      const hint = nearestMatchHint(fileLf, oldLf);
-      throw new ToolValidationError({
-        message: `edit: no match for old_string in "${input.path}".${hint ? ` Nearest match near line ${hint.line}:
-${hint.snippet}
-Compare this against your old_string and retry with the file's actual text.` : ""}`,
-        field: "old_string"
-      });
+      throw noMatchError(input.path, fileLf, oldLf);
     }
     const { tier, matches } = ladder;
     const count = matches.length;
     if (ladder.ambiguous) {
       const lines = matches.map((m) => m.startLine);
-      throw new ToolValidationError({
+      throw new ToolValidationError3({
         message: `edit: old_string only matched fuzzily and ${count} candidate blocks scored too close to distinguish (lines: ${lines.join(", ")}) in "${input.path}". Re-read the file and use the exact text of the intended block.`,
         field: "old_string",
         context: { occurrences: count, matchTier: tier }
       });
     }
     if (input.replace_all && tier !== "exact" && tier !== "trailing-whitespace") {
-      throw new ToolValidationError({
+      throw new ToolValidationError3({
         message: `edit: old_string only matched via ${TIER_LABEL[tier]} in "${input.path}", but replace_all requires an exact (or trailing-whitespace) match. Re-read the file and use its exact text.`,
         field: "old_string",
         context: { matchTier: tier }
@@ -19260,7 +19521,7 @@ Compare this against your old_string and retry with the file's actual text.` : "
     }
     if (count > 1 && !input.replace_all) {
       const lines = matches.map((m) => m.startLine);
-      throw new ToolValidationError({
+      throw new ToolValidationError3({
         message: `edit: old_string matched ${count} times in "${input.path}" (lines: ${lines.join(", ")})${tier === "exact" ? "" : ` via ${TIER_LABEL[tier]}`}. Add more context to make it unique, or set replace_all: true.`,
         field: "old_string",
         context: { occurrences: count, matchTier: tier }
@@ -19301,16 +19562,20 @@ Compare this against your old_string and retry with the file's actual text.` : "
       after: newFile
     });
     opts?.signal?.throwIfAborted();
-    const diff = unifiedDiff(original, newFile, {
-      fromFile: input.path,
-      toFile: input.path
-    });
+    const { text: diff, truncated: diffTruncated } = truncateDiffPayload(
+      unifiedDiff(original, newFile, {
+        fromFile: input.path,
+        toFile: input.path
+      }),
+      MAX_DIFF_BYTES
+    );
+    const diffNote = diffTruncated ? "Diff truncated to the 256 KiB output budget \u2014 the full edit is on disk." : void 0;
     const syntax = await checkSyntax(absPath, newFile, original).catch(() => void 0);
     let syntaxNote;
     if (syntax && syntax.errors.length > 0) {
       syntaxNote = syntax.preExisting ? `Syntax check: the file still has parse errors (they pre-date this edit) \u2014 see syntax_errors.` : `Syntax check: this edit introduced ${syntax.errors.length} parse error(s) \u2014 fix them now, see syntax_errors.`;
     }
-    const notes = [autoReadNote, tierNote, syntaxNote].filter(Boolean);
+    const notes = [autoReadNote, tierNote, diffNote, syntaxNote].filter(Boolean);
     return {
       path: absPath,
       replacements: input.replace_all ? count : 1,
@@ -19321,6 +19586,15 @@ Compare this against your old_string and retry with the file's actual text.` : "
     };
   }
 };
+function noMatchError(inputPath, fileLf, oldLf) {
+  const hint = nearestMatchHint(fileLf, oldLf);
+  return new ToolValidationError3({
+    message: `edit: no match for old_string in "${inputPath}".${hint ? ` Nearest match near line ${hint.line}:
+${hint.snippet}
+Compare this against your old_string and retry with the file's actual text.` : ""}`,
+    field: "old_string"
+  });
+}
 
 // src/exec.ts
 import { spawn as spawn8 } from "node:child_process";
@@ -19329,14 +19603,14 @@ import {
   emitProcessOutput as emitProcessOutput3,
   emitProcessStarted as emitProcessStarted3
 } from "@wrongstack/core/observability";
-import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils/error";
+import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils/error";
 init_output_spool();
 init_util();
 init_win32_resolve();
 
 // src/exec-kill-guard.ts
 import * as os8 from "node:os";
-import * as path30 from "node:path";
+import * as path31 from "node:path";
 var isWin3 = os8.platform() === "win32";
 async function checkExecKillCommand(cmd, args) {
   if (!cmd) return { blocked: false };
@@ -19549,7 +19823,7 @@ async function checkKillTarget(target) {
         reason: `Blocked: kill ${target.signal} '${target.name}' targets a WrongStack process name.`
       };
     }
-    const currentImage = path30.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
+    const currentImage = path31.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
     const targetsNodeRuntime = nameLower === "node" || nameLower.startsWith("node");
     if (targetsNodeRuntime && currentImage === "node") {
       return {
@@ -20200,6 +20474,7 @@ function getExecAllowlist() {
 var MAX_ARGS = 20;
 var MAX_OUTPUT2 = 2e5;
 var DEFAULT_TIMEOUT_MS3 = 3e4;
+var MAX_TIMEOUT_MS = 6e5;
 var BLOCKED_ARG_PATTERNS = {
   python: [],
   // git --exec=<cmd> runs arbitrary commands via upload-pack/receive-pack;
@@ -20325,8 +20600,8 @@ var SAFE_DANGER = { level: "safe", reasons: [] };
 var execTool = {
   name: "exec",
   category: "Shell",
-  description: "Execute a **whitelisted, restricted set of commands** with strict argument validation. This is the **preferred and safer** alternative to the `bash` tool for running development tools (node, npm, pnpm, tsc, git, tests, linters, etc.). It prevents arbitrary command injection and limits what the model can do.",
-  usageHint: "PREFERRED SHELL TOOL for most cases.\n\nUse this instead of `bash` whenever possible.\n- `command` must be in the allowlist. Defaults cover JS (node/npm/pnpm/yarn/bun/deno/tsc/vitest/eslint/biome), Go (`go build`/`go test`), Rust (cargo), Python (python/pip), Ruby (gem/bundle), JVM (java/mvn/gradle), .NET (dotnet), native (make/cmake), and git. Users can extend it via `tools.exec.allow` in config.\n- Arguments are passed as a clean array (no shell interpretation).\n- `cwd` is validated to stay inside the project.\n- If a command is not allowlisted, the error explains how to add it; for one-off arbitrary commands, fall back to `bash` (with strong justification).\nThis tool significantly reduces the risk compared to full shell access.",
+  description: "Execute a command from a **curated command roster** with argument validation and confirm gating. This is the **preferred** alternative to the `bash` tool for running development tools (node, npm, pnpm, tsc, git, tests, linters, etc.). It is NOT a sandbox \u2014 several rostered commands (node, python, powershell, \u2026) can run arbitrary code \u2014 so prefer least-privilege commands.",
+  usageHint: "PREFERRED SHELL TOOL for most cases.\n\nUse this instead of `bash` whenever possible.\n- `command` must be in the allowlist. Defaults cover JS (node/npm/pnpm/yarn/bun/deno/tsc/vitest/eslint/biome), Go (`go build`/`go test`), Rust (cargo), Python (python/pip), Ruby (gem/bundle), JVM (java/mvn/gradle), .NET (dotnet), native (make/cmake), and git. Users can extend it via `tools.exec.allow` in config.\n- Arguments are passed as a clean array (no shell interpretation).\n- `cwd` is validated to stay inside the project.\n- If a command is not allowlisted, the error explains how to add it; for one-off arbitrary commands, fall back to `bash` (with strong justification).\nThe curated roster + confirm gating narrows the surface compared to full shell access, but this is not a sandbox \u2014 prefer least-privilege commands.",
   selection: {
     doNotUseWhen: "the operation requires pipes, redirection, shell expansion, or a non-allowlisted command.",
     useInstead: ["bash"]
@@ -20342,7 +20617,13 @@ var execTool = {
   subjectKey: "command",
   mutating: true,
   riskTier: "standard",
-  timeoutMs: DEFAULT_TIMEOUT_MS3,
+  // Executor-level abort ceiling. Must sit ABOVE the per-call timeout ceiling
+  // (MAX_TIMEOUT_MS): the tool's own timer resolves with exit 124 + registry
+  // tree-kill; the executor's AbortSignal.timeout is a blunt abort that would
+  // otherwise fire first and discard the structured timeout result. The 10s
+  // margin covers the kill/teardown window. (The executor additionally clamps
+  // to config `tools.maxToolTimeoutMs`.)
+  timeoutMs: MAX_TIMEOUT_MS + 1e4,
   capabilities: ["shell.restricted"],
   icon: "terminal",
   inputSchema: {
@@ -20363,7 +20644,7 @@ var execTool = {
       },
       timeout: {
         type: "integer",
-        description: "Per-command timeout in milliseconds."
+        description: "Per-command timeout in milliseconds (default 30000, max 600000)."
       }
     },
     required: ["command"]
@@ -20407,7 +20688,7 @@ var execTool = {
       };
     }
     const args = (input.args ?? []).slice(0, MAX_ARGS);
-    const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS3, DEFAULT_TIMEOUT_MS3));
+    const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS3, MAX_TIMEOUT_MS));
     const danger = detectDanger(cmd, args, dangerBypass);
     const killCheck = await checkExecKillCommand(cmd, args);
     if (killCheck.blocked) {
@@ -20435,15 +20716,16 @@ var execTool = {
         danger
       };
     }
+    const defaultCwd = ctx.workingDir ?? ctx.cwd;
     let cwd;
     try {
-      cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : await safeResolveReal(ctx.cwd, ctx);
+      cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : await safeResolveReal(defaultCwd, ctx);
     } catch {
       return {
         command: cmd,
         args,
         stdout: "",
-        stderr: `cwd "${input.cwd ?? ctx.cwd}" resolves outside project root`,
+        stderr: `cwd "${input.cwd ?? defaultCwd}" resolves outside project root`,
         exitCode: 1,
         truncated: false,
         allowed: false,
@@ -20455,7 +20737,7 @@ var execTool = {
   }
 };
 function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     let stdout = "";
     let stderr = "";
     let killed = false;
@@ -20463,7 +20745,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     const finish = (result) => {
       if (resolvedOnce.value) return;
       resolvedOnce.value = true;
-      resolve17(result);
+      resolve18(result);
     };
     const startedAt = Date.now();
     let stdoutBytes = 0;
@@ -20515,7 +20797,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
         command: cmd,
         args,
         stdout: "",
-        stderr: `spawn failed: ${toErrorMessage3(err)}`,
+        stderr: `spawn failed: ${toErrorMessage6(err)}`,
         exitCode: 1,
         truncated: false,
         allowed: true,
@@ -20618,7 +20900,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
 }
 
 // src/fetch.ts
-import { FetchError as FetchError2, ToolError, ToolValidationError as ToolValidationError3 } from "@wrongstack/core/types";
+import { FetchError as FetchError2, ToolError, ToolValidationError as ToolValidationError5 } from "@wrongstack/core/types";
 import TurndownService from "turndown";
 
 // src/_fetch-guard.ts
@@ -20628,7 +20910,7 @@ import {
   isPrivateIPv4 as isPrivateIPv42,
   isPrivateIPv6 as isPrivateIPv62
 } from "@wrongstack/core/utils";
-import { FetchError, ToolValidationError as ToolValidationError2 } from "@wrongstack/core/types";
+import { FetchError, ToolValidationError as ToolValidationError4 } from "@wrongstack/core/types";
 import { Agent, fetch as undiciFetch } from "undici";
 var nativeGlobalFetch = globalThis.fetch;
 var ALLOW_PRIVATE = process.env["WRONGSTACK_FETCH_ALLOW_PRIVATE"] === "1";
@@ -20699,13 +20981,13 @@ async function guardedFetch(url, maxRedirects, signal, headers = {
   for (; ; ) {
     const parsed = new URL(currentUrl);
     if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-      throw new ToolValidationError2({
+      throw new ToolValidationError4({
         message: `fetch: redirect to unsupported protocol "${parsed.protocol}"`,
         field: "url"
       });
     }
     if (parsed.protocol === "http:" && !ALLOW_PRIVATE) {
-      throw new ToolValidationError2({
+      throw new ToolValidationError4({
         message: "fetch: redirect to http:// blocked (HTTPS required by default)",
         field: "url"
       });
@@ -20721,6 +21003,10 @@ async function guardedFetch(url, maxRedirects, signal, headers = {
     if (res.status < 300 || res.status > 399) {
       return res;
     }
+    try {
+      await res.body?.cancel();
+    } catch {
+    }
     redirectCount++;
     if (redirectCount > maxRedirects) {
       throw new FetchError({
@@ -20744,7 +21030,7 @@ async function assertNotPrivate(hostname4) {
   if (ALLOW_PRIVATE) return;
   const host = hostname4.startsWith("[") && hostname4.endsWith("]") ? hostname4.slice(1, -1) : hostname4;
   if (host === "localhost" || host.endsWith(".localhost")) {
-    throw new ToolValidationError2({
+    throw new ToolValidationError4({
       message: "fetch: blocked localhost target",
       field: "url"
     });
@@ -20752,14 +21038,14 @@ async function assertNotPrivate(hostname4) {
   const ipVersion = net4.isIP(host);
   if (ipVersion === 4) {
     if (isPrivateIPv42(host)) {
-      throw new ToolValidationError2({
+      throw new ToolValidationError4({
         message: `fetch: blocked private/loopback address "${host}"`,
         field: "url"
       });
     }
   } else if (ipVersion === 6) {
     if (isPrivateIPv62(host)) {
-      throw new ToolValidationError2({
+      throw new ToolValidationError4({
         message: `fetch: blocked private/loopback address "${host}"`,
         field: "url"
       });
@@ -20770,14 +21056,14 @@ async function assertNotPrivate(hostname4) {
       for (const r of records) {
         const bad = r.family === 4 ? isPrivateIPv42(r.address) : isPrivateIPv62(r.address);
         if (bad) {
-          throw new ToolValidationError2({
+          throw new ToolValidationError4({
             message: `fetch: resolved to private address ${r.address}`,
             field: "url"
           });
         }
       }
     } catch (err) {
-      if (err instanceof ToolValidationError2) throw err;
+      if (err instanceof ToolValidationError4) throw err;
     }
   }
 }
@@ -20794,6 +21080,8 @@ TD.addRule("stripDangerousElements", {
   filter: ["script", "style", "noscript"],
   replacement: () => ""
 });
+var PRUNED_BOILERPLATE_TAGS = /* @__PURE__ */ new Set(["nav", "header", "footer", "aside", "svg", "iframe"]);
+TD.remove((node) => PRUNED_BOILERPLATE_TAGS.has(node.nodeName.toLowerCase()));
 var MAX_BYTES = 131072;
 var TIMEOUT_MS = 2e4;
 var combineSignals = (signals) => AbortSignal.any(signals);
@@ -20823,7 +21111,7 @@ var fetchTool = {
       format: {
         type: "string",
         enum: ["markdown", "text", "raw"],
-        description: 'Output format. "markdown" is recommended for HTML pages.'
+        description: 'Output format. "markdown" is recommended for HTML pages; for non-HTML content types it falls back to plain text (JSON is pretty-printed).'
       }
     },
     required: ["url"]
@@ -20852,20 +21140,26 @@ var fetchTool = {
   },
   async *executeStream(input, ctx, opts) {
     if (!input?.url) {
-      throw new ToolValidationError3({
+      throw new ToolValidationError5({
         message: "fetch: url is required",
         field: "url"
       });
     }
     const u = new URL(input.url);
+    if (u.username || u.password) {
+      throw new ToolValidationError5({
+        message: "fetch: URLs with embedded credentials (user:pass@host) are not allowed",
+        field: "url"
+      });
+    }
     if (u.protocol !== "https:" && u.protocol !== "http:") {
-      throw new ToolValidationError3({
+      throw new ToolValidationError5({
         message: `fetch: unsupported protocol "${u.protocol}"`,
         field: "url"
       });
     }
     if (u.protocol === "http:" && !ALLOW_PRIVATE) {
-      throw new ToolValidationError3({
+      throw new ToolValidationError5({
         message: "fetch: http:// blocked (HTTPS required by default)",
         field: "url"
       });
@@ -21055,8 +21349,9 @@ var formatTool = {
           type: "final",
           output: {
             fixer: bridge.language,
-            files_checked: 0,
-            files_changed: run.summary.errors > 0 ? 0 : 1,
+            // Language-bridge runs don't report per-file counts.
+            files_checked: void 0,
+            files_changed: void 0,
             output: normalizeCommandOutput(run.output || run.error || ""),
             truncated: run.truncated
           }
@@ -21083,11 +21378,14 @@ var formatTool = {
       text: `Running ${detected}\u2026`,
       data: { fixer: detected, check: !!input.check }
     };
-    const args = ["format", "--write"];
-    if (input.check) args[args.length - 1] = "--check";
-    if (input.files) {
-      const files = Array.isArray(input.files) ? input.files : input.files.split(",");
-      args.push("--", ...files.map((f) => f.trim()));
+    const fileList = input.files ? (Array.isArray(input.files) ? input.files : input.files.split(",")).map((f) => f.trim()) : [];
+    let args;
+    if (detected === "prettier") {
+      args = [input.check ? "--check" : "--write"];
+      args.push(...fileList.length > 0 ? fileList : ["."]);
+    } else {
+      args = ["format", input.check ? "--check" : "--write"];
+      if (fileList.length > 0) args.push("--", ...fileList);
     }
     const result = yield* spawnStream({
       cmd: detected,
@@ -21096,39 +21394,70 @@ var formatTool = {
       signal: opts.signal,
       maxBytes: 1e5
     });
-    const changed = [...result.stdout.matchAll(/\bchanged\b/gi)].length;
+    const combinedOut = `${result.stdout}
+${result.stderr}`;
+    const counts = parseFormatterCounts(detected, combinedOut);
     yield {
       type: "final",
       output: {
         fixer: detected,
-        files_checked: 0,
-        files_changed: changed,
+        files_checked: counts.checked,
+        files_changed: counts.changed,
         output: normalizeCommandOutput(result.stdout || result.stderr || result.error || ""),
         truncated: result.truncated
       }
     };
   }
 };
+function parseFormatterCounts(fixer, output) {
+  if (fixer !== "biome") return { checked: void 0, changed: void 0 };
+  const checkedMatch = /\b(?:Checked|Formatted)\s+(\d+)\s+files?\b/i.exec(output);
+  const changedMatch = /\bFixed\s+(\d+)\s+files?\b/i.exec(output);
+  return {
+    checked: checkedMatch?.[1] !== void 0 ? Number(checkedMatch[1]) : void 0,
+    changed: changedMatch?.[1] !== void 0 ? Number(changedMatch[1]) : void 0
+  };
+}
 async function detectFixer(cwd) {
-  const { stat: stat19 } = await import("node:fs/promises");
-  try {
-    await stat19(`${cwd}/biome.json`);
-    return "biome";
-  } catch {
+  const fs36 = await import("node:fs/promises");
+  const exists = async (file) => {
     try {
-      await stat19(`${cwd}/.prettierrc`);
-      return "prettier";
+      await fs36.stat(`${cwd}/${file}`);
+      return true;
     } catch {
-      return "biome";
+      return false;
     }
+  };
+  if (await exists("biome.json") || await exists("biome.jsonc")) return "biome";
+  const PRETTIER_CONFIGS = [
+    ".prettierrc",
+    ".prettierrc.json",
+    ".prettierrc.yml",
+    ".prettierrc.yaml",
+    ".prettierrc.js",
+    ".prettierrc.cjs",
+    ".prettierrc.mjs",
+    "prettier.config.js",
+    "prettier.config.cjs",
+    "prettier.config.mjs"
+  ];
+  for (const cfg of PRETTIER_CONFIGS) {
+    if (await exists(cfg)) return "prettier";
   }
+  try {
+    const raw = await fs36.readFile(`${cwd}/package.json`, "utf8");
+    const pkg = JSON.parse(raw);
+    if (pkg["prettier"] !== void 0) return "prettier";
+  } catch {
+  }
+  return "biome";
 }
 
 // src/git.ts
 init_util();
 import { spawn as spawn9 } from "node:child_process";
 import { statSync as statSync4 } from "node:fs";
-import { dirname as dirname13, resolve as resolve13, sep as sep6 } from "node:path";
+import { dirname as dirname13, resolve as resolve14, sep as sep6 } from "node:path";
 import { assessCommitSafety } from "@wrongstack/core/coordination";
 import { buildChildEnv as buildChildEnv4 } from "@wrongstack/core/utils";
 var TIMEOUT_MS2 = 3e4;
@@ -21289,8 +21618,8 @@ function validateWorktreeInput(input, projectRoot) {
     return reject(`unsafe worktree path: ${input.worktreePath}`);
   }
   if ((input.worktreeAction === "add" || input.worktreeAction === "remove") && input.worktreePath) {
-    const root = resolve13(projectRoot);
-    const abs = resolve13(root, input.worktreePath);
+    const root = resolve14(projectRoot);
+    const abs = resolve14(root, input.worktreePath);
     if (abs !== root && !abs.startsWith(root + sep6)) {
       return reject(`unsafe worktree path (escapes project root): ${input.worktreePath}`);
     }
@@ -21302,8 +21631,8 @@ function findGitDir2(cwd, projectRoot) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat19 = statSync4(`${dir}/.git`);
-      if (stat19.isDirectory() || stat19.isFile()) return dir;
+      const stat20 = statSync4(`${dir}/.git`);
+      if (stat20.isDirectory() || stat20.isFile()) return dir;
     } catch {
     }
     if (dir === root) break;
@@ -21384,7 +21713,7 @@ function buildArgs(input) {
   }
 }
 function runGit2(args, cwd, signal) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     let stdout = "";
     let stderr = "";
     const child = spawn9("git", args, {
@@ -21405,7 +21734,7 @@ function runGit2(args, cwd, signal) {
       }
     });
     child.on("error", (err) => {
-      resolve17({
+      resolve18({
         command: args[0],
         stdout: normalizeCommandOutput(stdout),
         stderr: err.message,
@@ -21414,7 +21743,7 @@ function runGit2(args, cwd, signal) {
       });
     });
     child.on("close", (code) => {
-      resolve17({
+      resolve18({
         command: args[0],
         stdout: normalizeCommandOutput(stdout),
         stderr: normalizeCommandOutput(stderr),
@@ -21427,8 +21756,9 @@ function runGit2(args, cwd, signal) {
 
 // src/glob.ts
 import * as fs25 from "node:fs/promises";
-import * as path31 from "node:path";
+import * as path32 from "node:path";
 import { compileGlob as compileGlob2, DEFAULT_WALK_IGNORE_DIRS as DEFAULT_WALK_IGNORE_DIRS2 } from "@wrongstack/core/utils";
+import { ToolValidationError as ToolValidationError6 } from "@wrongstack/core/types";
 
 // src/_concurrency.ts
 async function mapWithConcurrency2(items, limit, fn) {
@@ -21454,7 +21784,7 @@ var WALK_CONCURRENCY = 16;
 var globTool = {
   name: "glob",
   category: "Filesystem",
-  description: "Find files by path pattern. Use index-backed `codebase-search` first for code symbols or concepts when it is live.",
+  description: "Find files by path pattern. Results are sorted by modification time, newest first, so when the list is truncated at `limit` it is the oldest files that are dropped (recency-biased). Use index-backed `codebase-search` first for code symbols or concepts when it is live.",
   usageHint: "PATH DISCOVERY AND SEARCH SCOPING:\n\n- When `codebase-search` is live, use it first for code concepts; use `glob` for filenames, path patterns, and non-indexed files.\n- Combine with `path` and `limit`.\n- Default ignores common build/dependency directories.\nMuch more efficient than shell `find` for most use cases inside the agent.",
   selection: {
     doNotUseWhen: "you need to search inside file contents.",
@@ -21465,7 +21795,7 @@ var globTool = {
   capabilities: ["fs.read"],
   icon: "folder",
   maxOutputBytes: 65536,
-  timeoutMs: 5e3,
+  timeoutMs: 15e3,
   inputSchema: {
     type: "object",
     properties: {
@@ -21479,13 +21809,20 @@ var globTool = {
       },
       limit: {
         type: "integer",
-        description: "Maximum number of results to return (default 1000, max 5000)."
+        minimum: 1,
+        maximum: 5e3,
+        description: "Maximum number of results to return (default 1000, max 5000). Results are sorted by mtime descending, so truncation keeps the most recently modified files."
       }
     },
     required: ["pattern"]
   },
   async execute(input, ctx, opts) {
-    if (!input?.pattern) throw new Error("glob: pattern is required");
+    if (!input?.pattern) {
+      throw new ToolValidationError6({
+        message: "glob: pattern is required",
+        field: "pattern"
+      });
+    }
     const signal = opts?.signal;
     const base = input.path ? await safeResolveReal(input.path, ctx) : ctx.cwd;
     const limit = Math.max(1, Math.min(input.limit ?? 1e3, 5e3));
@@ -21530,7 +21867,7 @@ var globTool = {
         const name = e.name;
         if (DEFAULT_IGNORE2.has(name)) continue;
         const rel = relPrefix ? `${relPrefix}/${name}` : name;
-        const full = path31.join(dir, name);
+        const full = path32.join(dir, name);
         if (e.isDirectory()) {
           if (isGitIgnored(rel, true)) continue;
           subdirs.push({ full, rel });
@@ -21580,8 +21917,8 @@ var globTool = {
 // src/grep.ts
 import { spawn as spawn10 } from "node:child_process";
 import * as fs26 from "node:fs/promises";
-import * as path32 from "node:path";
-import { ToolValidationError as ToolValidationError4 } from "@wrongstack/core/types";
+import * as path33 from "node:path";
+import { ToolValidationError as ToolValidationError7 } from "@wrongstack/core/types";
 import {
   buildChildEnv as buildChildEnv5,
   compileGlob as compileGlob3,
@@ -21785,7 +22122,7 @@ var grepTool = {
   },
   async *executeStream(input, ctx, opts) {
     if (!input?.pattern) {
-      throw new ToolValidationError4({
+      throw new ToolValidationError7({
         message: "grep: pattern is required",
         field: "pattern"
       });
@@ -21795,12 +22132,12 @@ var grepTool = {
     const limit = Math.max(1, Math.min(input.limit ?? 200, 2e3));
     const validation = compileUserRegex(input.pattern, input.case_insensitive ? "i" : "");
     if (!validation.ok) {
-      throw new ToolValidationError4({
+      throw new ToolValidationError7({
         message: `grep: ${validation.reason}`,
         field: "pattern"
       });
     }
-    const rgAvailable = await detectRg(opts.signal);
+    const rgAvailable = await detectRg();
     if (rgAvailable) {
       try {
         yield* runRgStream(input, base, mode, limit, opts.signal);
@@ -21813,16 +22150,23 @@ var grepTool = {
     yield { type: "final", output: out };
   }
 };
-async function detectRg(signal) {
-  return new Promise((resolve17) => {
+var rgAvailabilityCache;
+function detectRg() {
+  rgAvailabilityCache ??= new Promise((resolve18) => {
     try {
-      const p = spawn10("rg", ["--version"], { env: buildChildEnv5(), stdio: "ignore", signal, windowsHide: true });
-      p.on("error", () => resolve17(false));
-      p.on("close", (code) => resolve17(code === 0));
+      const p = spawn10("rg", ["--version"], {
+        env: buildChildEnv5(),
+        stdio: "ignore",
+        signal: AbortSignal.timeout(1e4),
+        windowsHide: true
+      });
+      p.on("error", () => resolve18(false));
+      p.on("close", (code) => resolve18(code === 0));
     } catch {
-      resolve17(false);
+      resolve18(false);
     }
   });
+  return rgAvailabilityCache;
 }
 async function* runRgStream(input, base, mode, limit, signal) {
   const args = ["--no-heading"];
@@ -21836,7 +22180,7 @@ async function* runRgStream(input, base, mode, limit, signal) {
   for (const ignored of DEFAULT_IGNORE3) {
     args.push("--glob", `!${ignored}/**`, "--glob", `!**/${ignored}/**`);
   }
-  const gitignorePath = path32.join(base, ".gitignore");
+  const gitignorePath = path33.join(base, ".gitignore");
   if (await fs26.access(gitignorePath).then(() => true, () => false)) {
     args.push("--ignore-file", gitignorePath);
   }
@@ -22008,7 +22352,7 @@ async function runNative(input, base, mode, limit, signal) {
   const flags = input.case_insensitive ? "i" : "";
   const compiled = compileUserRegex(input.pattern, flags);
   if (!compiled.ok) {
-    throw new ToolValidationError4({
+    throw new ToolValidationError7({
       message: `grep: ${compiled.reason}`,
       field: "pattern"
     });
@@ -22026,8 +22370,8 @@ async function runNative(input, base, mode, limit, signal) {
     if (globRe && !globRe.test(name) && !globRe.test(full)) return;
     if (globRe) globRe.lastIndex = 0;
     try {
-      const stat19 = await fs26.stat(full);
-      if (!stat19.isFile() || stat19.size > maxBytes || stopped || signal.aborted) return;
+      const stat20 = await fs26.stat(full);
+      if (!stat20.isFile() || stat20.size > maxBytes || stopped || signal.aborted) return;
       const file = await fs26.open(full, "r");
       try {
         let bytesReadTotal = 0;
@@ -22118,7 +22462,7 @@ async function runNative(input, base, mode, limit, signal) {
       if (DEFAULT_IGNORE3.has(e.name)) continue;
       if (e.isSymbolicLink()) continue;
       const rel = relPrefix ? `${relPrefix}/${e.name}` : e.name;
-      const full = path32.join(dir, e.name);
+      const full = path33.join(dir, e.name);
       if (e.isDirectory()) {
         if (isGitIgnored(rel, true)) continue;
         subdirs.push({ full, rel });
@@ -22238,26 +22582,14 @@ var installTool = {
         return;
       }
     }
-    const pkgManager = await detectPackageManager(cwd);
+    const pkgManager = await detectPackageManager(cwd, ctx.projectRoot);
     yield { type: "log", text: `Resolving with ${pkgManager}\u2026`, data: { phase: "resolve" } };
-    const save = input.save === "dev" ? "-D" : input.save === "optional" ? "-O" : "";
     const globalFlag = input.global ? ["-g"] : [];
     const ignoreScripts = input.lifecycleScripts !== true;
-    const args = [];
-    if (input.dry_run) args.push("--dry-run");
-    if (ignoreScripts) args.push("--ignore-scripts");
-    if (pkgManager === "pnpm") {
-      if (save) args.push(save);
-      args.push("add", ...globalFlag);
-    } else if (pkgManager === "yarn") {
-      args.push("add", ...globalFlag);
-    } else {
-      args.push("install", ...globalFlag);
-    }
     const pkgList = input.packages ? (Array.isArray(input.packages) ? input.packages : input.packages.split(",")).map(
       (p) => p.trim()
     ) : [];
-    const PKG_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/i;
+    const PKG_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+(?:@[a-z0-9^~><=*.+-]+)?$/i;
     for (const pkg of pkgList) {
       if (!PKG_NAME_RE.test(pkg) || pkg.startsWith("-") || pkg.length > 200) {
         yield {
@@ -22273,7 +22605,34 @@ var installTool = {
         return;
       }
     }
-    if (pkgList.length > 0) args.push(...pkgList);
+    const hasPkgs = pkgList.length > 0;
+    const args = [];
+    if (input.dry_run) args.push("--dry-run");
+    if (ignoreScripts) args.push("--ignore-scripts");
+    if (pkgManager === "pnpm") {
+      if (hasPkgs) {
+        if (input.save === "dev") args.push("-D");
+        else if (input.save === "optional") args.push("-O");
+        args.push("add", ...globalFlag);
+      } else {
+        args.push("install", ...globalFlag);
+      }
+    } else if (pkgManager === "yarn") {
+      if (hasPkgs) {
+        args.push("add", ...globalFlag);
+        if (input.save === "dev") args.push("--dev");
+        else if (input.save === "optional") args.push("--optional");
+      } else {
+        args.push("install", ...globalFlag);
+      }
+    } else {
+      args.push("install", ...globalFlag);
+      if (hasPkgs) {
+        if (input.save === "dev") args.push("--save-dev");
+        else if (input.save === "optional") args.push("--save-optional");
+      }
+    }
+    if (hasPkgs) args.push(...pkgList);
     yield {
       type: "log",
       text: `Fetching ${pkgList.length || "all"} packages\u2026`,
@@ -22354,9 +22713,9 @@ var JsonFileTooLargeError = class extends Error {
 };
 async function readJsonFileBounded(filePath, ctx) {
   const resolved = await safeResolveReal(filePath, ctx);
-  const stat19 = await fs27.stat(resolved);
-  if (stat19.size > MAX_JSON_FILE_BYTES) {
-    throw new JsonFileTooLargeError(filePath, stat19.size);
+  const stat20 = await fs27.stat(resolved);
+  if (stat20.size > MAX_JSON_FILE_BYTES) {
+    throw new JsonFileTooLargeError(filePath, stat20.size);
   }
   return fs27.readFile(resolved, "utf8");
 }
@@ -22762,60 +23121,60 @@ function jmespathSearch(data, query) {
 }
 function validateJsonSchema(data, schema) {
   const errors = [];
-  function check(value, s, path40) {
+  function check(value, s, path41) {
     if (s["type"]) {
       const expectedType = s["type"];
       const actualType = Array.isArray(value) ? "array" : value === null ? "null" : typeof value;
       if (expectedType === "integer") {
-        if (!Number.isInteger(value)) errors.push(`${path40}: expected integer, got ${actualType}`);
+        if (!Number.isInteger(value)) errors.push(`${path41}: expected integer, got ${actualType}`);
       } else if (expectedType !== actualType) {
-        errors.push(`${path40}: expected ${expectedType}, got ${actualType}`);
+        errors.push(`${path41}: expected ${expectedType}, got ${actualType}`);
       }
     }
     if (typeof value === "string" && s["format"] === "uri" && value) {
       try {
         new URL(value);
       } catch {
-        errors.push(`${path40}: not a valid URI`);
+        errors.push(`${path41}: not a valid URI`);
       }
     }
     if (typeof value === "string" && s["pattern"]) {
       const compiled = compileUserRegex(s["pattern"], "");
       if (!compiled.ok) {
-        errors.push(`${path40}: invalid schema pattern \u2014 ${compiled.reason}`);
+        errors.push(`${path41}: invalid schema pattern \u2014 ${compiled.reason}`);
       } else if (!compiled.regex.test(capSubject(value))) {
-        errors.push(`${path40}: does not match pattern ${s["pattern"]}`);
+        errors.push(`${path41}: does not match pattern ${s["pattern"]}`);
       }
     }
     if (typeof value === "string" && s["minLength"] !== void 0 && value.length < s["minLength"]) {
-      errors.push(`${path40}: string too short (min ${s["minLength"]})`);
+      errors.push(`${path41}: string too short (min ${s["minLength"]})`);
     }
     if (typeof value === "string" && s["maxLength"] !== void 0 && value.length > s["maxLength"]) {
-      errors.push(`${path40}: string too long (max ${s["maxLength"]})`);
+      errors.push(`${path41}: string too long (max ${s["maxLength"]})`);
     }
     if (typeof value === "number" && s["minimum"] !== void 0 && value < s["minimum"]) {
-      errors.push(`${path40}: below minimum ${s["minimum"]}`);
+      errors.push(`${path41}: below minimum ${s["minimum"]}`);
     }
     if (typeof value === "number" && s["maximum"] !== void 0 && value > s["maximum"]) {
-      errors.push(`${path40}: above maximum ${s["maximum"]}`);
+      errors.push(`${path41}: above maximum ${s["maximum"]}`);
     }
     if (Array.isArray(value) && s["items"] && Array.isArray(s["items"])) {
       for (let i = 0; i < value.length; i++) {
-        check(value[i], s["items"], `${path40}[${i}]`);
+        check(value[i], s["items"], `${path41}[${i}]`);
       }
     }
     if (typeof value === "object" && value !== null && !Array.isArray(value) && s["properties"]) {
       const props = s["properties"];
       for (const [k, propSchema] of Object.entries(props)) {
-        check(value[k], propSchema, `${path40}.${k}`);
+        check(value[k], propSchema, `${path41}.${k}`);
       }
     }
   }
   check(data, schema, "$");
   return { valid: errors.length === 0, errors };
 }
-function simpleQuery(data, path40) {
-  const parts = path40.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean);
+function simpleQuery(data, path41) {
+  const parts = path41.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean);
   let current = data;
   for (const part of parts) {
     if (current === null || current === void 0) return void 0;
@@ -23726,6 +24085,18 @@ var KANBAN_INPUT_SCHEMA = {
     },
     transitionAction: { type: "string" },
     transitionComment: { type: "string" },
+    tickChecks: {
+      type: "array",
+      items: {
+        type: "object",
+        properties: {
+          checkId: { type: "string" },
+          checkStatus: { type: "string", enum: ["passed", "failed", "skipped"] }
+        },
+        required: ["checkId", "checkStatus"]
+      },
+      description: "`transition_task` (to=done only): flip one or more manual criteria to `passed` before the gate fires. Read ids from kanban get_task. Non-manual criteria are refused."
+    },
     attachmentUrl: { type: "string" },
     attachmentTitle: { type: "string" },
     attachmentType: {
@@ -24664,6 +25035,7 @@ function sourceStatus(task) {
 function todoStatus(task) {
   const status = sourceStatus(task);
   if (status === "completed") return "completed";
+  if (status === "review" && task.assignment?.status === "completed") return "completed";
   if (status === "in_progress" || status === "review") return "in_progress";
   return "pending";
 }
@@ -24785,11 +25157,12 @@ async function applySessionKanbanTaskToSource(context, task, options = {}) {
   const graphId = task.origin?.graphId ?? "";
   if (!originId) return { source: null };
   if (task.origin?.system === "session-todo" || graphId.startsWith("todo:")) {
+    const mappedStatus = todoStatus(task);
     const next = options.remove ? context.todos.filter((todo) => todo.id !== originId) : context.todos.map(
       (todo) => todo.id === originId ? {
         ...todo,
         content: task.title,
-        status: sourceStatus(task) === "completed" ? "completed" : sourceStatus(task) === "in_progress" || sourceStatus(task) === "review" ? "in_progress" : "pending"
+        status: mappedStatus
       } : todo
     );
     suppressedTodoMirrors.add(context);
@@ -24854,6 +25227,9 @@ var kanbanTool = {
   description: KANBAN_TOOL_DESCRIPTION,
   usageHint: KANBAN_TOOL_USAGE_HINT,
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // The action performed; kanban has no single file or path subject.
+  subjectKey: "action",
   mutating: true,
   capabilities: ["fs.write"],
   icon: "task",
@@ -25295,6 +25671,7 @@ var kanbanTool = {
               actor: input.author,
               comment: input.transitionComment,
               ...input.transitionAction !== void 0 ? { action: input.transitionAction } : {},
+              ...input.tickChecks !== void 0 ? { tickChecks: input.tickChecks } : {},
               ...input.attachmentUrl !== void 0 ? {
                 attachment: {
                   url: input.attachmentUrl,
@@ -25687,8 +26064,52 @@ var kanbanTool = {
     } catch (err) {
       return fail(stripLifecycleIssues(err instanceof Error ? err.message : String(err)));
     }
+  },
+  serialize(output, input) {
+    return serializeKanbanOutput(output, input);
   }
 };
+var KANBAN_BOARD_TRANSCRIPT_BYTE_CAP = 16384;
+var KANBAN_FULL_BOARD_ACTIONS = /* @__PURE__ */ new Set([
+  "get_board",
+  "export_markdown",
+  "export_task_graph"
+]);
+function serializeKanbanOutput(output, input) {
+  const action = input && typeof input === "object" ? input.action : void 0;
+  const board = output.board;
+  if (board) {
+    const keepFull = typeof action === "string" && KANBAN_FULL_BOARD_ACTIONS.has(action);
+    let boardBytes = 0;
+    if (!keepFull) {
+      try {
+        boardBytes = Buffer.byteLength(JSON.stringify(board), "utf8");
+      } catch {
+        boardBytes = 0;
+      }
+    }
+    if (!keepFull && boardBytes > KANBAN_BOARD_TRANSCRIPT_BYTE_CAP) {
+      const columns = {};
+      for (const column of board.columns) {
+        columns[column.title || column.id] = board.tasks.filter(
+          (task) => task.columnId === column.id
+        ).length;
+      }
+      const compact = {
+        ...output,
+        board: {
+          id: board.id,
+          title: board.title,
+          columns,
+          totalTasks: board.tasks.length,
+          note: `Full board (${boardBytes} bytes) omitted from the transcript; use get_board to load it.`
+        }
+      };
+      return JSON.stringify(compact, null, 2);
+    }
+  }
+  return JSON.stringify(output, null, 2);
+}
 
 // src/builtin.ts
 init_execute_tool();
@@ -25803,11 +26224,11 @@ var lintTool = {
   }
 };
 async function detectLinter(cwd) {
-  const { stat: stat19 } = await import("node:fs/promises");
+  const { stat: stat20 } = await import("node:fs/promises");
   const checks = ["biome.json", ".eslintrc.json", "tslint.json", ".eslintrc.js", "tsconfig.json"];
   for (const f of checks) {
     try {
-      await stat19(`${cwd}/${f}`);
+      await stat20(`${cwd}/${f}`);
       if (f.includes("biome")) return "biome";
       if (f.includes("eslint")) return "eslint";
       if (f.includes("tslint")) return "tslint";
@@ -25824,11 +26245,12 @@ init_util();
 var logsTool = {
   name: "logs",
   category: "Logs",
-  description: "Read or stream logs from files, Docker containers, or systemd services. Useful for debugging running applications.",
-  usageHint: "DEBUGGING TOOL \u2014 USE CAREFULLY IN AUTONOMOUS MODE:\n\n- Prefer `path` for local files or `service` for containers/systemd.\n- `stream: true` = live tail (can be expensive).\n- Always use `filter` (regex) when possible to reduce noise and token usage.\n- Long-running streams should be avoided unless the user explicitly wants live logs.",
+  description: "Read logs from files or Docker containers. Useful for debugging running applications.",
+  usageHint: "DEBUGGING TOOL \u2014 USE CAREFULLY IN AUTONOMOUS MODE:\n\n- Prefer `path` for local files or `service` for Docker containers.\n- Always use `filter` (regex) when possible to reduce noise and token usage.\n- `since` narrows Docker logs to a recent window.",
   permission: "confirm",
   mutating: false,
   timeoutMs: 3e4,
+  maxOutputBytes: 262144,
   capabilities: ["shell.restricted"],
   icon: "logs",
   inputSchema: {
@@ -25836,7 +26258,7 @@ var logsTool = {
     properties: {
       service: {
         type: "string",
-        description: "Service name for Docker or systemd journal"
+        description: "Docker container name (passed to `docker logs`)"
       },
       path: {
         type: "string",
@@ -25848,10 +26270,6 @@ var logsTool = {
         minimum: 0,
         maximum: 1e4
       },
-      stream: {
-        type: "boolean",
-        description: "Stream logs continuously (like tail -f) (default: false)"
-      },
       filter: {
         type: "string",
         description: "Regex pattern to filter log lines"
@@ -25859,7 +26277,7 @@ var logsTool = {
       since: {
         type: "string",
         enum: ["1h", "6h", "24h", "all"],
-        description: "Only show logs since duration"
+        description: 'Only show Docker logs since duration (ignored for files; "all" = no limit)'
       },
       cwd: { type: "string", description: "Working directory (default: cwd)" }
     }
@@ -25876,10 +26294,10 @@ var logsTool = {
       filterRe = compiled.regex;
     }
     if (input.service) {
-      return await dockerLogs(input.service, lines, filterRe, cwd, opts.signal);
+      return await dockerLogs(input.service, lines, filterRe, cwd, opts.signal, input.since);
     }
     if (input.path) {
-      return await fileLogs(safeResolve(input.path, ctx), lines, filterRe, input.stream ?? false);
+      return await fileLogs(await safeResolveReal(input.path, ctx), lines, filterRe);
     }
     return {
       source: "none",
@@ -25893,7 +26311,7 @@ var logsTool = {
 async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
   const args = ["logs"];
   if (lines > 0) args.push("--tail", String(lines));
-  if (since) {
+  if (since && since !== "all") {
     const sinceMap = { "1h": "1h", "6h": "6h", "24h": "24h" };
     args.push("--since", sinceMap[since] ?? "1h");
   }
@@ -25907,7 +26325,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
     };
   }
   args.push("--timestamps", service);
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     let stdout = "";
     let stderr = "";
     const MAX = 2e5;
@@ -25923,7 +26341,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve17(result);
+      resolve18(result);
     };
     const child = spawn11("docker", args, { cwd, signal, env: buildChildEnv6(), stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
     const timer = setTimeout(() => {
@@ -25958,7 +26376,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
 }
 var DOCKER_LOGS_TIMEOUT_MS = 3e3;
 var MAX_TAIL_LINES = 1e5;
-async function fileLogs(path40, lines, filterRe, stream) {
+async function fileLogs(path41, lines, filterRe) {
   const { createInterface } = await import("node:readline");
   const { createReadStream: createReadStream2 } = await import("node:fs");
   const entries = [];
@@ -25967,7 +26385,7 @@ async function fileLogs(path40, lines, filterRe, stream) {
   let writeIdx = 0;
   let totalLines = 0;
   const rl = createInterface({
-    input: createReadStream2(path40),
+    input: createReadStream2(path41),
     crlfDelay: Number.POSITIVE_INFINITY
   });
   for await (const line of rl) {
@@ -25988,11 +26406,11 @@ async function fileLogs(path40, lines, filterRe, stream) {
     if (parsed) entries.push(parsed);
   }
   return {
-    source: path40,
+    source: path41,
     entries,
     total: entries.length,
     truncated: totalLines > effLines,
-    stream_mode: stream
+    stream_mode: false
   };
 }
 function parseLogLines(output, filterRe) {
@@ -26068,25 +26486,12 @@ var outdatedTool = {
   inputSchema: {
     type: "object",
     properties: {
-      cwd: { type: "string", description: "Working directory (default: cwd)" },
-      format: {
-        type: "string",
-        enum: ["list", "table"],
-        description: "Output format (default: list)"
-      },
-      include_deprecated: {
-        type: "boolean",
-        description: "Include deprecated packages (default: false)"
-      },
-      check: {
-        type: "string",
-        description: "Specific package(s) to check (comma-separated)"
-      }
+      cwd: { type: "string", description: "Working directory (default: cwd)" }
     }
   },
   async execute(input, ctx, opts) {
     const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
-    const manager = await detectPackageManager(cwd);
+    const manager = await detectPackageManager(cwd, ctx.projectRoot);
     if (manager === "npm") {
       try {
         const { detectNonJsEcosystem: detectNonJsEcosystem2 } = await Promise.resolve().then(() => (init_legacy_bridge(), legacy_bridge_exports));
@@ -26139,13 +26544,11 @@ var outdatedTool = {
       }
     }
     const args = ["outdated", "--json"];
-    if (input.format === "table") args.push("--table");
-    if (input.include_deprecated) args.push("--include", "deprecated");
     return runOutdated(manager, args, cwd, opts.signal);
   }
 };
 function runOutdated(manager, args, cwd, signal) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     let stdout = "";
     let stderr = "";
     const MAX = 1e5;
@@ -26170,10 +26573,10 @@ function runOutdated(manager, args, cwd, signal) {
     });
     child.on("close", (code) => {
       const result = parseOutdatedOutput(stdout, code ?? 0);
-      resolve17(result);
+      resolve18(result);
     });
     child.on("error", (e) => {
-      resolve17({
+      resolve18({
         exit_code: 1,
         packages: [],
         total: 0,
@@ -26194,27 +26597,39 @@ function parseOutdatedOutput(json2, exitCode) {
       truncated: false
     };
   }
+  const truncated = json2.length >= 1e5 || Buffer.byteLength(json2, "utf8") > COMMAND_OUTPUT_MAX_BYTES;
+  let parsedOk = false;
   try {
     const data = JSON.parse(json2);
+    parsedOk = true;
     for (const name of Object.keys(data)) {
-      const info = data[name];
+      const info = data[name] ?? {};
+      const str = (v) => typeof v === "string" ? v : void 0;
       packages.push({
         name,
-        current: info.current ?? "unknown",
-        latest: info.latest ?? "unknown",
-        wanted: info.wanted ?? "unknown",
-        type: info.type ?? "unknown",
-        location: info.location ?? name
+        current: str(info["current"]) ?? "unknown",
+        latest: str(info["latest"]) ?? "unknown",
+        wanted: str(info["wanted"]) ?? "unknown",
+        // npm calls it `type`; pnpm calls it `dependencyType`.
+        type: str(info["type"]) ?? str(info["dependencyType"]) ?? "unknown",
+        location: str(info["location"]) ?? name
       });
     }
   } catch {
+  }
+  const outdatedFound = parsedOk && exitCode === 1;
+  let output = normalizeCommandOutput(json2);
+  if (outdatedFound) {
+    output = `${output}
+
+Note: exit code 1 from \`outdated\` means outdated packages were found (expected); treated as success.`;
   }
   return {
-    exit_code: exitCode,
+    exit_code: outdatedFound ? 0 : exitCode,
     packages,
     total: packages.length,
-    output: json2,
-    truncated: json2.length >= 1e5
+    output,
+    truncated
   };
 }
 
@@ -26223,8 +26638,8 @@ init_util();
 import { spawn as spawn13 } from "node:child_process";
 import * as fs28 from "node:fs/promises";
 import * as os9 from "node:os";
-import * as path33 from "node:path";
-import { buildChildEnv as buildChildEnv8, toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
+import * as path34 from "node:path";
+import { buildChildEnv as buildChildEnv8, toErrorMessage as toErrorMessage7 } from "@wrongstack/core/utils";
 var patchTool = {
   name: "patch",
   category: "Filesystem",
@@ -26268,26 +26683,26 @@ var patchTool = {
     try {
       dir = input.directory ? await safeResolveReal(input.directory, ctx) : ctx.cwd;
     } catch (err) {
-      return refuse(`patch refused: ${toErrorMessage4(err)}`);
+      return refuse(`patch refused: ${toErrorMessage7(err)}`);
     }
-    const realRoot = await fs28.realpath(ctx.projectRoot).catch(() => path33.resolve(ctx.projectRoot));
+    const realRoot = await fs28.realpath(ctx.projectRoot).catch(() => path34.resolve(ctx.projectRoot));
     const targets = extractDiffTargets(input.patch);
     const resolvedTargets = [];
     for (const t of targets) {
       const stripped = stripPathComponents(t.raw, strip);
       if (!stripped) continue;
-      if (path33.isAbsolute(stripped)) {
+      if (path34.isAbsolute(stripped)) {
         return refuse(`patch refused: target "${t.raw}" strips to absolute path`);
       }
-      const candidate = path33.resolve(dir, stripped);
+      const candidate = path34.resolve(dir, stripped);
       let real;
       try {
         real = await resolveRealInsideRoot(candidate, ctx);
       } catch (err) {
-        return refuse(`patch refused: target "${t.raw}" ${toErrorMessage4(err)}`);
+        return refuse(`patch refused: target "${t.raw}" ${toErrorMessage7(err)}`);
       }
-      const rel = path33.relative(realRoot, real);
-      if (rel.startsWith("..") || path33.isAbsolute(rel)) {
+      const rel = path34.relative(realRoot, real);
+      if (rel.startsWith("..") || path34.isAbsolute(rel)) {
         return refuse(`patch refused: target "${t.raw}" resolves outside project root`);
       }
       resolvedTargets.push({ raw: t.raw, deleted: t.deleted, abs: real });
@@ -26301,11 +26716,11 @@ var patchTool = {
         beforeContents.set(target.abs, await readTextForTracking(target.abs));
       }
     }
-    const tmpDir = await fs28.mkdtemp(path33.join(os9.tmpdir(), ".wstack_patch_"));
+    const tmpDir = await fs28.mkdtemp(path34.join(os9.tmpdir(), ".wstack_patch_"));
     try {
       await fs28.chmod(tmpDir, 448).catch(() => {
       });
-      const patchFile = path33.join(tmpDir, "in.diff");
+      const patchFile = path34.join(tmpDir, "in.diff");
       await fs28.writeFile(patchFile, input.patch, { mode: 384 });
       const args = [`-p${strip}`, "--merge", ...dryRun ? ["--dry-run"] : [], "-i", patchFile];
       const result = await runPatch(args, dir, opts.signal, {
@@ -26318,8 +26733,8 @@ var patchTool = {
         for (const target of resolvedTargets) {
           const abs = target.abs;
           const before = beforeContents.get(abs) ?? null;
-          const stat19 = await fs28.stat(abs).catch(() => null);
-          if (!stat19?.isFile()) {
+          const stat20 = await fs28.stat(abs).catch(() => null);
+          if (!stat20?.isFile()) {
             if (beforeExisted.has(abs)) {
               touched.push(abs);
               ctx.session?.recordFileChange?.({
@@ -26334,7 +26749,7 @@ var patchTool = {
           const after = await readTextForTracking(abs);
           if (after === null || after === before) continue;
           touched.push(abs);
-          ctx.recordRead?.(abs, stat19.mtimeMs, "write", sha256hex(after));
+          ctx.recordRead?.(abs, stat20.mtimeMs, "write", sha256hex(after));
           ctx.session?.recordFileChange?.({
             path: abs,
             action: before === null ? "created" : "modified",
@@ -26345,7 +26760,7 @@ var patchTool = {
       }
       if (result.exitCode !== 0) {
         if (!dryRun) {
-          const partial = touched.length > 0 ? ` ${touched.length} file(s) were still modified on disk and have been recorded for rewind: ${touched.map((p) => path33.relative(realRoot, p) || p).join(", ")}.` : "";
+          const partial = touched.length > 0 ? ` ${touched.length} file(s) were still modified on disk and have been recorded for rewind: ${touched.map((p) => path34.relative(realRoot, p) || p).join(", ")}.` : "";
           return {
             applied: touched.length,
             rejected: 1,
@@ -26353,7 +26768,7 @@ var patchTool = {
             // success path (which returns GNU patch's dir-relative names).
             // `touched` entries are realpaths from resolveRealInsideRoot, and
             // realRoot is also a realpath, so path.relative is like-for-like.
-            files: touched.map((p) => path33.relative(realRoot, p) || p),
+            files: touched.map((p) => path34.relative(realRoot, p) || p),
             dry_run: dryRun,
             message: `patch failed: ${result.stderr || result.stdout}${partial}`
           };
@@ -26369,7 +26784,7 @@ var patchTool = {
       }
       const patched = result.engine === "git" ? [
         ...new Set(
-          resolvedTargets.map((target) => path33.relative(dir, target.abs) || target.abs)
+          resolvedTargets.map((target) => path34.relative(dir, target.abs) || target.abs)
         )
       ] : extractPatchedFiles(result.stdout);
       return {
@@ -26388,8 +26803,8 @@ var patchTool = {
 var MAX_TRACKING_BYTES = 5 * 1024 * 1024;
 async function readTextForTracking(absPath) {
   try {
-    const stat19 = await fs28.stat(absPath);
-    if (!stat19.isFile() || stat19.size > MAX_TRACKING_BYTES) return null;
+    const stat20 = await fs28.stat(absPath);
+    if (!stat20.isFile() || stat20.size > MAX_TRACKING_BYTES) return null;
     const buf = await fs28.readFile(absPath);
     if (buf.includes(0)) return null;
     return buf.toString("utf8");
@@ -26474,7 +26889,7 @@ function runPatch(args, cwd, signal, fallback) {
   });
 }
 function runPatchProcess(command, args, cwd, signal) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve18) => {
     let stdout = "";
     let stderr = "";
     const env = { ...buildChildEnv8(), LANG: "C", LC_ALL: "C" };
@@ -26493,11 +26908,11 @@ function runPatchProcess(command, args, cwd, signal) {
     });
     child.on(
       "close",
-      (code) => resolve17({ exitCode: code ?? 1, stdout, stderr, unavailable: false })
+      (code) => resolve18({ exitCode: code ?? 1, stdout, stderr, unavailable: false })
     );
     child.on(
       "error",
-      (e) => resolve17({
+      (e) => resolve18({
         exitCode: 1,
         stdout: "",
         stderr: e.message,
@@ -26664,6 +27079,20 @@ async function synchronizeManagedKanban(items, board, ctx, signal) {
     }
     const task = board.tasks.find((candidate) => candidate.id === item.kanbanTaskId);
     if (!task || task.status === "completed") continue;
+    const stage = task.lifecycle?.currentStage;
+    if (stage === "backlog" || stage === "todo") {
+      const started = await execute({
+        action: "start_task",
+        boardId: board.id,
+        taskId: task.id,
+        author: actor,
+        agentId: actor,
+        transitionComment: `Auto-started for completion: ${item.content}`
+      });
+      if (!started.ok) {
+        continue;
+      }
+    }
     await execute({
       action: "mark_assignment",
       boardId: board.id,
@@ -26875,7 +27304,8 @@ var todoTool = {
     }
     for (const planId of completedPlanIds) {
       if (pendingPlanIds.has(planId)) continue;
-      const planPath = ctx.meta["plan.path"];
+      const meta = ctx.meta;
+      const planPath = meta["plan.path.resolved"] ?? meta["plan.path"];
       if (typeof planPath !== "string" || !planPath) continue;
       try {
         const plan = await loadPlan2(planPath);
@@ -26888,7 +27318,8 @@ var todoTool = {
     }
     for (const taskId of completedTaskIds) {
       if (pendingTaskIds.has(taskId)) continue;
-      const taskPath = ctx.meta["task.path"];
+      const meta = ctx.meta;
+      const taskPath = meta["task.path.resolved"] ?? meta["task.path"];
       if (typeof taskPath !== "string" || !taskPath) continue;
       try {
         const file = await loadTasks3(taskPath);
@@ -27004,7 +27435,16 @@ var planTool = {
           sessionPlanPath.lastIndexOf("/"),
           sessionPlanPath.lastIndexOf("\\")
         );
-        planPath = lastSep >= 0 ? sessionPlanPath.slice(0, lastSep + 1) + "backlog.plan.json" : "backlog.plan.json";
+        if (lastSep < 0) {
+          return {
+            ok: false,
+            message: `Cannot derive the project-scoped plan path: session plan path "${sessionPlanPath}" has no directory component.`,
+            plan: "",
+            count: 0,
+            open: 0
+          };
+        }
+        planPath = sessionPlanPath.slice(0, lastSep + 1) + "backlog.plan.json";
       }
     } else {
       planPath = sessionPlanPath;
@@ -27197,6 +27637,7 @@ var planTool = {
         open: 0
       };
     }
+    ctx.meta["plan.path.resolved"] = planPath;
     await projectSessionPlanToKanban(ctx.projectRoot, plan.items, sessionId);
     if (todosToReplace) {
       await todoTool.execute({ todos: todosToReplace }, ctx, {
@@ -27229,6 +27670,7 @@ var planTool = {
           });
           return f;
         });
+        ctx.meta["task.path.resolved"] = taskPath;
         return mkResult(
           plan,
           true,
@@ -27262,14 +27704,14 @@ function mkResult(plan, ok, message, todos) {
 // src/read.ts
 init_util();
 import * as fs29 from "node:fs/promises";
-import { FsError, ToolValidationError as ToolValidationError5 } from "@wrongstack/core/types";
-import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
+import { FsError, ToolValidationError as ToolValidationError8 } from "@wrongstack/core/types";
+import { toErrorMessage as toErrorMessage8 } from "@wrongstack/core/utils";
 var ADVANCED_MODE_META_KEY = "tools.read.advancedMode";
 var MAX_BYTES2 = 5 * 1024 * 1024;
 var readTool = {
   name: "read",
   category: "Filesystem",
-  description: "Read the contents of a file with line numbers. This is the primary way to inspect source code, configuration, or any text file before making changes. Lines are returned 1-indexed with a `   N| ` prefix for easy reference in edits. When advanced mode is on or `includeSymbols` is set, the result also includes a `symbols` field listing codebase-index symbol names, kinds, and line numbers for the file (not file content).",
+  description: "Read the contents of a file with line numbers. This is the primary way to inspect source code, configuration, or any text file before making changes. Lines are returned 1-indexed in the form `N\u2192content` (line number, then a `\u2192` separator, then the raw line). The `N\u2192` prefix is display-only \u2014 always strip it before reusing the text, e.g. never include it in `edit.old_string`. When advanced mode is on or `includeSymbols` is set, the result also includes a `symbols` field listing codebase-index symbol names, kinds, and line numbers for the file (not file content).",
   usageHint: "FOUNDATIONAL TOOL \u2014 call this before almost any edit operation.\n\nBest practices:\n- Always read a file before using `edit`, `replace`, or `write` on it (the system often requires it for safety).\n- Use `offset` + `limit` for very large files instead of reading everything at once.\n- Default limit is generous (2000 lines) but can be increased.\n- The output format is designed to be directly usable as context for `edit` operations.\n- Set `includeSymbols: true` to also receive the codebase-index symbol listing for the file.\n- Enable advanced mode (`ctx.meta['tools.read.advancedMode'] = true`) to auto-inject symbols on every read.",
   selection: {
     doNotUseWhen: "you need to search many files for matching content.",
@@ -27290,11 +27732,13 @@ var readTool = {
       },
       offset: {
         type: "integer",
+        minimum: 1,
         description: "1-based starting line number. Use together with `limit` for large files."
       },
       limit: {
         type: "integer",
-        description: "Maximum number of lines to return (default is 2000)."
+        minimum: 0,
+        description: "Maximum number of lines to return (default 2000). Values above 5000 are clamped to 5000 \u2014 page with `offset` for more."
       },
       mode: {
         type: "string",
@@ -27310,16 +27754,16 @@ var readTool = {
   },
   async execute(input, ctx, execOpts) {
     if (!input?.path) {
-      throw new ToolValidationError5({
+      throw new ToolValidationError8({
         message: "read: path is required",
         field: "path"
       });
     }
     const absPath = await safeResolveReal(input.path, ctx);
     const shouldIncludeSymbols = input.includeSymbols === true || input.includeSymbols !== false && ctx.meta[ADVANCED_MODE_META_KEY] === true;
-    let stat19;
+    let stat20;
     try {
-      stat19 = await fs29.stat(absPath);
+      stat20 = await fs29.stat(absPath);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
@@ -27331,14 +27775,14 @@ var readTool = {
         });
       }
       throw new FsError({
-        message: `read: failed to stat "${input.path}": ${toErrorMessage5(err)}`,
+        message: `read: failed to stat "${input.path}": ${toErrorMessage8(err)}`,
         code: "FS_READ_FAILED",
         path: absPath,
         context: { errno: code },
         cause: err
       });
     }
-    if (!stat19.isFile()) {
+    if (!stat20.isFile()) {
       throw new FsError({
         message: `read: "${input.path}" is not a regular file`,
         code: "FS_READ_FAILED",
@@ -27346,23 +27790,23 @@ var readTool = {
         context: { reason: "not-a-regular-file" }
       });
     }
-    if (stat19.size > MAX_BYTES2) {
+    if (stat20.size > MAX_BYTES2) {
       throw new FsError({
-        message: `read: file too large (${stat19.size} bytes, limit ${MAX_BYTES2})`,
+        message: `read: file too large (${stat20.size} bytes, limit ${MAX_BYTES2})`,
         code: "FS_READ_FAILED",
         path: absPath,
-        context: { size: stat19.size, limit: MAX_BYTES2, reason: "too-large" }
+        context: { size: stat20.size, limit: MAX_BYTES2, reason: "too-large" }
       });
     }
     const offset = Math.max(1, input.offset ?? 1);
     const limit = Math.max(0, Math.min(input.limit ?? 2e3, 5e3));
     const prior = getReadRangeRecord(ctx, absPath);
     const requestedEnd = prior ? Math.min(offset + limit - 1, prior.totalLines) : offset + limit - 1;
-    if (input.mode !== "summary" && limit > 0 && prior && coversRange(prior, stat19.mtimeMs, offset, requestedEnd)) {
-      ctx.recordRead(absPath, stat19.mtimeMs);
+    if (input.mode !== "summary" && limit > 0 && prior && coversRange(prior, stat20.mtimeMs, offset, requestedEnd)) {
+      ctx.recordRead(absPath, stat20.mtimeMs);
       const symResult2 = shouldIncludeSymbols ? await fetchSymbolsForFile(absPath, ctx, execOpts?.signal) : void 0;
       return {
-        text: `[unchanged since previous read: "${input.path}" mtime=${Math.round(stat19.mtimeMs)}; requested lines ${offset}-${requestedEnd} were already shown. Use offset/limit for a new range if needed.]`,
+        text: `[unchanged since previous read: "${input.path}" mtime=${Math.round(stat20.mtimeMs)}; requested lines ${offset}-${requestedEnd} were already shown. Use offset/limit for a new range if needed.]`,
         total_lines: prior.totalLines,
         encoding: "utf8",
         truncated: requestedEnd < prior.totalLines,
@@ -27373,18 +27817,23 @@ var readTool = {
     }
     const buf = await fs29.readFile(absPath);
     if (isBinaryBuffer(buf)) {
-      throw new Error(`read: "${input.path}" appears to be binary`);
+      throw new FsError({
+        message: `read: "${input.path}" appears to be binary`,
+        code: "FS_READ_FAILED",
+        path: absPath,
+        context: { reason: "binary" }
+      });
     }
     const text = buf.toString("utf8");
     const contentHash = sha256hex(text);
     const allLines = text.split(/\r\n|\r|\n/);
     const total = allLines.length;
     if (input.mode === "summary") {
-      ctx.recordRead(absPath, stat19.mtimeMs, "user", contentHash);
-      rememberReadRange(ctx, absPath, stat19.mtimeMs, total, 1, Math.min(total, 200));
+      ctx.recordRead(absPath, stat20.mtimeMs, "user", contentHash);
+      rememberReadRange(ctx, absPath, stat20.mtimeMs, total, 1, Math.min(total, 200));
       const symResult2 = shouldIncludeSymbols ? await fetchSymbolsForFile(absPath, ctx, execOpts?.signal) : void 0;
       return {
-        text: summarizeFile(input.path, stat19.size, allLines),
+        text: summarizeFile(input.path, stat20.size, allLines),
         total_lines: total,
         encoding: "utf8",
         truncated: total > 200,
@@ -27396,8 +27845,8 @@ var readTool = {
       };
     }
     if (limit === 0) {
-      ctx.recordRead(absPath, stat19.mtimeMs, "user", contentHash);
-      rememberReadRange(ctx, absPath, stat19.mtimeMs, total, 1, 0);
+      ctx.recordRead(absPath, stat20.mtimeMs, "user", contentHash);
+      rememberReadRange(ctx, absPath, stat20.mtimeMs, total, 1, 0);
       const symResult2 = shouldIncludeSymbols ? await fetchSymbolsForFile(absPath, ctx, execOpts?.signal) : void 0;
       return {
         text: "",
@@ -27409,8 +27858,8 @@ var readTool = {
       };
     }
     if (offset > total) {
-      ctx.recordRead(absPath, stat19.mtimeMs, "user", contentHash);
-      rememberReadRange(ctx, absPath, stat19.mtimeMs, total, total + 1, total + 1);
+      ctx.recordRead(absPath, stat20.mtimeMs, "user", contentHash);
+      rememberReadRange(ctx, absPath, stat20.mtimeMs, total, total + 1, total + 1);
       const symResult2 = shouldIncludeSymbols ? await fetchSymbolsForFile(absPath, ctx, execOpts?.signal) : void 0;
       return {
         text: `[offset ${offset} is past end of file "${input.path}" \u2014 file has ${total} line(s). Do not retry this offset.]`,
@@ -27425,8 +27874,8 @@ var readTool = {
     const truncated = offset - 1 + slice.length < total;
     const width = String(offset + slice.length - 1).length;
     const numbered = slice.map((line, i) => `${String(offset + i).padStart(width, " ")}\u2192${line}`).join("\n");
-    ctx.recordRead(absPath, stat19.mtimeMs, "user", contentHash);
-    rememberReadRange(ctx, absPath, stat19.mtimeMs, total, offset, offset + slice.length - 1);
+    ctx.recordRead(absPath, stat20.mtimeMs, "user", contentHash);
+    rememberReadRange(ctx, absPath, stat20.mtimeMs, total, offset, offset + slice.length - 1);
     const symResult = shouldIncludeSymbols ? await fetchSymbolsForFile(absPath, ctx, execOpts?.signal) : void 0;
     return {
       text: numbered,
@@ -27534,8 +27983,8 @@ ${interesting.join("\n")}` : "symbols/imports: (none detected)"
 // src/replace.ts
 import { spawn as spawn14 } from "node:child_process";
 import * as fs30 from "node:fs/promises";
-import * as path34 from "node:path";
-import { ToolValidationError as ToolValidationError6 } from "@wrongstack/core/types";
+import * as path35 from "node:path";
+import { ToolValidationError as ToolValidationError9 } from "@wrongstack/core/types";
 import {
   atomicWrite as atomicWrite3,
   buildChildEnv as buildChildEnv9,
@@ -27547,12 +27996,13 @@ import {
   unifiedDiff as unifiedDiff2
 } from "@wrongstack/core/utils";
 init_util();
+var MAX_DIFF_BYTES2 = 262144;
 var DEFAULT_IGNORE4 = ["node_modules", ".git", "dist", "build", ".next", "coverage"];
 var replaceTool = {
   name: "replace",
   category: "Transform",
   description: "Perform a search-and-replace across multiple files using a regex pattern. This is a powerful bulk transformation tool. Dry-run is ON by default \u2014 set `dry_run: false` to apply changes.",
-  usageHint: "DANGEROUS IF USED CARELESSLY \u2014 review the diff output carefully.\n\nRecommended workflow:\n1. Run without `dry_run: false` first to see exactly what would change (dry-run is the default).\n2. Review the diff output, then re-run with `dry_run: false` to apply.\n3. Use a specific enough `pattern` (and `glob` / `files`) to avoid accidental broad changes.\n4. `replace_all` controls whether only the first match per file or all matches are replaced.\nThis tool is excellent for large-scale refactors (renaming, import updates, etc.) but must be used with caution.",
+  usageHint: "DANGEROUS IF USED CARELESSLY \u2014 review the diff output carefully.\n\nRecommended workflow:\n1. Run without `dry_run: false` first to see exactly what would change (dry-run is the default).\n2. Review the diff output, then re-run with `dry_run: false` to apply.\n3. Use a specific enough `pattern` (and `glob` / `files`) to avoid accidental broad changes.\n4. `replace_all` controls whether only the first match per file or all matches are replaced.\n5. `replacement` supports regex substitutions: `$1`\u2013`$9` insert capture groups, `$&` inserts the whole match, and `$$` inserts a literal dollar sign.\nThis tool is excellent for large-scale refactors (renaming, import updates, etc.) but must be used with caution.",
   permission: "confirm",
   // WS-046: gives permission decisions something to key on.
   // The file scope being rewritten, not the pattern: a trust rule should say
@@ -27562,11 +28012,15 @@ var replaceTool = {
   capabilities: ["fs.write"],
   icon: "edit",
   timeoutMs: 3e4,
+  maxOutputBytes: 262144,
   inputSchema: {
     type: "object",
     properties: {
       pattern: { type: "string", description: "Regex pattern to match" },
-      replacement: { type: "string", description: "Replacement string" },
+      replacement: {
+        type: "string",
+        description: "Replacement string. Supports `$1`\u2013`$9` (capture groups), `$&` (whole match), and `$$` (literal dollar sign) \u2014 same semantics as JavaScript String.replace."
+      },
       files: {
         type: "string",
         description: "File(s) to target: single path, comma-separated list, or glob pattern"
@@ -27582,19 +28036,19 @@ var replaceTool = {
   },
   async execute(input, ctx) {
     if (!input?.pattern) {
-      throw new ToolValidationError6({
+      throw new ToolValidationError9({
         message: "replace: pattern is required",
         field: "pattern"
       });
     }
     if (input.replacement === void 0) {
-      throw new ToolValidationError6({
+      throw new ToolValidationError9({
         message: "replace: replacement is required",
         field: "replacement"
       });
     }
     if (!input?.files) {
-      throw new ToolValidationError6({
+      throw new ToolValidationError9({
         message: "replace: files is required",
         field: "files"
       });
@@ -27602,7 +28056,7 @@ var replaceTool = {
     const replaceAll = input.replace_all ?? true;
     const compiled = compileUserRegex(input.pattern, "g");
     if (!compiled.ok) {
-      throw new ToolValidationError6({
+      throw new ToolValidationError9({
         message: `replace: ${compiled.reason}`,
         field: "pattern"
       });
@@ -27615,6 +28069,9 @@ var replaceTool = {
     const realRoot = await fs30.realpath(ctx.projectRoot).catch(() => ctx.projectRoot);
     const results = [];
     let totalReplacements = 0;
+    let diffBytesUsed = 0;
+    let diffsOmitted = 0;
+    let diffsTruncated = 0;
     for (const absPath of fileList) {
       const lstat2 = await fs30.lstat(absPath).catch((err) => {
         if (err.code === "ENOENT") return null;
@@ -27628,10 +28085,10 @@ var replaceTool = {
       } catch {
         continue;
       }
-      const rel = path34.relative(realRoot, realPath);
-      if (rel.startsWith("..") || path34.isAbsolute(rel)) continue;
-      const stat19 = await fs30.stat(realPath).catch(() => null);
-      if (!stat19?.isFile()) continue;
+      const rel = path35.relative(realRoot, realPath);
+      if (rel.startsWith("..") || path35.isAbsolute(rel)) continue;
+      const stat20 = await fs30.stat(realPath).catch(() => null);
+      if (!stat20?.isFile()) continue;
       let content;
       try {
         const buf = await fs30.readFile(realPath);
@@ -27650,13 +28107,13 @@ var replaceTool = {
       let newContentLf = contentLf;
       for (let i = matches.length - 1; i >= 0; i--) {
         const m = expectDefined8(matches[i]);
-        newContentLf = newContentLf.slice(0, m.index) + input.replacement + newContentLf.slice(expectDefined8(m.index) + m[0].length);
+        newContentLf = newContentLf.slice(0, m.index) + expandReplacement(input.replacement, m) + newContentLf.slice(expectDefined8(m.index) + m[0].length);
       }
       re.lastIndex = 0;
       totalReplacements += count;
       if (!dryRun) {
         const newContent = toStyle2(newContentLf, style);
-        await atomicWrite3(realPath, newContent, { mode: stat19.mode & 511 });
+        await atomicWrite3(realPath, newContent, { mode: stat20.mode & 511 });
         const written = await fs30.stat(realPath).catch(() => null);
         if (written) {
           ctx.recordRead?.(realPath, written.mtimeMs, "write", sha256hex(newContent));
@@ -27668,24 +28125,76 @@ var replaceTool = {
           after: newContent
         });
       }
-      const diff = dryRun || matches.length > 0 ? unifiedDiff2(content, toStyle2(newContentLf, style), {
+      let diff = dryRun || matches.length > 0 ? unifiedDiff2(content, toStyle2(newContentLf, style), {
         fromFile: absPath,
         toFile: absPath
       }) : void 0;
+      if (diff !== void 0) {
+        const remaining = MAX_DIFF_BYTES2 - diffBytesUsed;
+        if (remaining <= 0) {
+          diff = void 0;
+          diffsOmitted++;
+        } else {
+          const capped = truncateDiffPayload(diff, remaining);
+          if (capped.truncated) diffsTruncated++;
+          diff = capped.text;
+          diffBytesUsed += Buffer.byteLength(diff, "utf8");
+        }
+      }
       results.push({
         path: absPath,
         replacements: matches.length,
         diff
       });
     }
+    const overBudget = diffsOmitted > 0 || diffsTruncated > 0;
     return {
       files_modified: results.length,
       total_replacements: totalReplacements,
       results,
-      dry_run: dryRun
+      dry_run: dryRun,
+      note: overBudget ? `Diff payload exceeded the 256 KiB output budget: ${diffsTruncated} diff(s) truncated, ${diffsOmitted} diff(s) omitted. Replacement counts are complete; use the read tool to inspect individual files.` : void 0
     };
   }
 };
+function expandReplacement(template, match) {
+  if (!template.includes("$")) return template;
+  let out = "";
+  for (let i = 0; i < template.length; i++) {
+    const ch = template[i];
+    if (ch !== "$") {
+      out += ch;
+      continue;
+    }
+    const next = template[i + 1];
+    if (next === "$") {
+      out += "$";
+      i++;
+    } else if (next === "&") {
+      out += match[0];
+      i++;
+    } else if (next !== void 0 && next >= "1" && next <= "9") {
+      const idx = next.charCodeAt(0) - 48;
+      if (idx < match.length) {
+        out += match[idx] ?? "";
+        i++;
+      } else {
+        out += "$";
+      }
+    } else {
+      out += "$";
+    }
+  }
+  return out;
+}
+function passesExtraGlob(extraGlob, name, full) {
+  extraGlob.lastIndex = 0;
+  const nameMatch = extraGlob.test(name);
+  extraGlob.lastIndex = 0;
+  const fullMatch = extraGlob.test(full);
+  extraGlob.lastIndex = 0;
+  return nameMatch || fullMatch;
+}
 async function resolveFiles2(filesInput, ctx, extraGlob) {
   const base = ctx.cwd;
   const normalized = filesInput.trim();
@@ -27696,8 +28205,9 @@ async function resolveFiles2(filesInput, ctx, extraGlob) {
   const resolved = [];
   for (const p of parts) {
     const absPath = safeResolve(p, ctx);
-    const stat19 = await fs30.stat(absPath).catch(() => null);
-    if (stat19?.isFile()) {
+    if (extraGlob && !passesExtraGlob(extraGlob, path35.basename(absPath), absPath)) continue;
+    const stat20 = await fs30.stat(absPath).catch(() => null);
+    if (stat20?.isFile()) {
       resolved.push(absPath);
     }
   }
@@ -27708,26 +28218,32 @@ async function globFiles(pattern, base, extraGlob) {
   if (rgAvailable) {
     try {
       const { promise } = spawnRgFind(pattern, base);
-      return await promise;
+      const files = await promise;
+      if (extraGlob) {
+        return files.filter((f) => passesExtraGlob(extraGlob, path35.basename(f), f));
+      }
+      return files;
     } catch {
     }
   }
   return await globNative(pattern, base, extraGlob);
 }
+var rgAvailabilityCache2;
 function checkRg() {
-  return new Promise((resolve17) => {
+  rgAvailabilityCache2 ??= new Promise((resolve18) => {
     try {
       const p = spawn14("rg", ["--version"], {
         env: buildChildEnv9(),
         stdio: "ignore",
         windowsHide: true
       });
-      p.on("error", () => resolve17(false));
-      p.on("close", (code) => resolve17(code === 0));
+      p.on("error", () => resolve18(false));
+      p.on("close", (code) => resolve18(code === 0));
     } catch {
-      resolve17(false);
+      resolve18(false);
     }
   });
+  return rgAvailabilityCache2;
 }
 function spawnRgFind(pattern, base) {
   const args = ["--files", "--glob", pattern, base];
@@ -27750,10 +28266,10 @@ function spawnRgFind(pattern, base) {
     }
   });
   return {
-    promise: new Promise((resolve17, reject) => {
+    promise: new Promise((resolve18, reject) => {
       child.on("error", reject);
       child.on("close", () => {
-        resolve17(buf.split("\n").filter(Boolean));
+        resolve18(buf.split("\n").filter(Boolean));
       });
     })
   };
@@ -27770,10 +28286,10 @@ async function globNative(pattern, base, extraGlob) {
     }
     for (const e of entries) {
       if (DEFAULT_IGNORE4.includes(e.name)) continue;
-      const full = path34.join(dir, e.name);
+      const full = path35.join(dir, e.name);
       try {
-        const stat19 = await fs30.lstat(full);
-        if (stat19.isSymbolicLink()) continue;
+        const stat20 = await fs30.lstat(full);
+        if (stat20.isSymbolicLink()) continue;
       } catch {
         continue;
       }
@@ -27797,7 +28313,7 @@ async function globNative(pattern, base, extraGlob) {
 // src/scaffold.ts
 init_util();
 import * as fs31 from "node:fs/promises";
-import * as path35 from "node:path";
+import * as path36 from "node:path";
 import { atomicWrite as atomicWrite4 } from "@wrongstack/core/utils";
 var BUILT_IN_TEMPLATES = {
   "npm-package": {
@@ -27948,16 +28464,16 @@ async function handleBuiltIn(name, templateFiles, cwd, ctx, dryRun, vars) {
   let filesCreated = 0;
   for (const [filePath, content] of Object.entries(templateFiles)) {
     const resolvedPath = substituteVars(filePath, name, vars);
-    const joinedPath = path35.join(cwd, resolvedPath);
-    const root = path35.resolve(ctx.projectRoot);
-    const target = path35.resolve(joinedPath);
-    const rel = path35.relative(root, target);
-    if (rel.startsWith("..") || path35.isAbsolute(rel)) {
+    const joinedPath = path36.join(cwd, resolvedPath);
+    const root = path36.resolve(ctx.projectRoot);
+    const target = path36.resolve(joinedPath);
+    const rel = path36.relative(root, target);
+    if (rel.startsWith("..") || path36.isAbsolute(rel)) {
       throw new Error(`scaffold: generated path "${resolvedPath}" would escape project root`);
     }
     const fullPath = target;
     if (!dryRun) {
-      await fs31.mkdir(path35.dirname(fullPath), { recursive: true });
+      await fs31.mkdir(path36.dirname(fullPath), { recursive: true });
       await atomicWrite4(fullPath, substituteVars(content, name, vars));
     }
     files.push(resolvedPath);
@@ -27988,11 +28504,12 @@ function substituteVars(content, name, vars) {
 }
 
 // src/search.ts
-import { FetchError as FetchError3, ToolValidationError as ToolValidationError7 } from "@wrongstack/core/types";
+import { FetchError as FetchError3, ToolValidationError as ToolValidationError10 } from "@wrongstack/core/types";
 import { expectDefined as expectDefined9 } from "@wrongstack/core/utils";
-import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
 var DEFAULT_NUM = 10;
 var MAX_RESULTS = 50;
+var MAX_SNIPPET_CHARS = 300;
 var TIMEOUT_MS3 = 15e3;
 var CACHE_TTL_MS = 3e5;
 var CACHE_MAX_ENTRIES = 200;
@@ -28000,7 +28517,7 @@ var cache = /* @__PURE__ */ new Map();
 var searchTool = {
   name: "search",
   category: "Search",
-  description: "Perform a web search and return results with title, URL, and snippet. Use this when you need up-to-date external information that is not in the local codebase. Results are cached (5 min TTL) and deduplicated by URL.",
+  description: "Perform a web search and return results with title, URL, and snippet. Use this when you need up-to-date external information that is not in the local codebase. Results are cached (5 min TTL) and deduplicated by URL. google and bing are best-effort HTML scrapes that fall back to duckduckgo when they return nothing usable.",
   usageHint: "Good for: API documentation, error messages, library usage examples, current best practices.\n\n- Prefer specific queries over very broad ones.\n- Results go through the guarded fetch system (same protections as the `fetch` tool).\n- Supports duckduckgo (default), google, and bing sources.\n- Set `skip_cache: true` to force a fresh search.\n- This is often better than the model trying to recall outdated knowledge.",
   permission: "auto",
   mutating: false,
@@ -28041,7 +28558,7 @@ var searchTool = {
   },
   async *executeStream(input, _ctx, opts) {
     if (!input?.query || input.query.trim() === "") {
-      throw new ToolValidationError7({
+      throw new ToolValidationError10({
         message: "search: query is required and must be a non-empty string",
         field: "query"
       });
@@ -28074,7 +28591,7 @@ var searchTool = {
             query: input.query,
             results: results.slice(0, num),
             source: entry.source,
-            truncated: results.length >= num,
+            truncated: results.length > num,
             cached: true
           }
         };
@@ -28086,41 +28603,45 @@ var searchTool = {
       text: `Querying ${source} for "${input.query}"\u2026`,
       data: { source, query: input.query, cached: false }
     };
-    let rawResults;
+    let engine;
     let effectiveSource = source;
     switch (source) {
       case "duckduckgo":
-        rawResults = await duckduckgoSearch(input.query, num, opts.signal);
+        engine = await duckduckgoSearch(input.query, opts.signal);
         break;
       case "google":
-        rawResults = await googleSearch(input.query, num, opts.signal);
+        engine = await googleSearch(input.query, opts.signal);
         break;
       case "bing":
-        rawResults = await bingSearch(input.query, num, opts.signal);
+        engine = await bingSearch(input.query, opts.signal);
         break;
       default:
-        throw new ToolValidationError7({
+        throw new ToolValidationError10({
           message: `search: unknown source "${source}"`,
           field: "source"
         });
     }
-    let ranked = rankSearchResults(rawResults, input.query);
+    let ranked = rankSearchResults(engine.results, input.query);
+    let engineError = engine.error;
     if (source !== "duckduckgo" && shouldFallbackToDuckDuckGo(ranked, input.query)) {
       yield {
         type: "log",
         text: `${source} returned no relevant static results; falling back to duckduckgo`,
         data: { source, fallback: "duckduckgo", query: input.query }
       };
-      rawResults = await duckduckgoSearch(input.query, num, opts.signal);
-      ranked = rankSearchResults(rawResults, input.query);
+      const fallback = await duckduckgoSearch(input.query, opts.signal);
+      ranked = rankSearchResults(fallback.results, input.query);
+      engineError = fallback.error;
       effectiveSource = "duckduckgo";
     }
     const finalResults = ranked.slice(0, num);
-    cache.set(cacheKey, { results: ranked, source: effectiveSource, timestamp: Date.now() });
-    pruneCacheEntries();
+    if (!engineError) {
+      cache.set(cacheKey, { results: ranked, source: effectiveSource, timestamp: Date.now() });
+      pruneCacheEntries();
+    }
     yield {
       type: "partial_output",
-      text: `${finalResults.length} results from ${effectiveSource}`,
+      text: engineError ? `search failed: ${engineError}` : `${finalResults.length} results from ${effectiveSource}`,
       data: { count: finalResults.length, cached: false, source: effectiveSource }
     };
     yield {
@@ -28133,8 +28654,9 @@ var searchTool = {
           snippet: r.snippet
         })),
         source: effectiveSource,
-        truncated: finalResults.length >= num,
-        cached: false
+        truncated: ranked.length > num,
+        cached: false,
+        ...engineError ? { error: engineError } : {}
       }
     };
   }
@@ -28185,18 +28707,18 @@ function shouldFallbackToDuckDuckGo(results, query) {
     return terms.some((term) => haystack.includes(term));
   });
 }
-async function duckduckgoSearch(query, num, signal) {
+async function duckduckgoSearch(query, signal) {
   const encoded = encodeURIComponent(query);
   const url = `https://lite.duckduckgo.com/lite/?q=${encoded}&kd=-1&kl=wt-wt`;
   try {
     const response = await fetchWithTimeout(url, signal, TIMEOUT_MS3);
     const html = await response.text();
-    return parseDuckDuckGo(html, num);
+    return { results: parseDuckDuckGo(html, MAX_RESULTS) };
   } catch (err) {
     console.log(
-      JSON.stringify({ level: "debug", event: "search_failed", query, error: toErrorMessage6(err) })
+      JSON.stringify({ level: "debug", event: "search_failed", query, error: toErrorMessage9(err) })
     );
-    return [{ title: "Search unavailable", url: "https://duckduckgo.com/unavailable", snippet: "Could not reach DuckDuckGo", score: 0 }];
+    return { results: [], error: `duckduckgo unreachable: ${toErrorMessage9(err)}` };
   }
 }
 function takeFrom(iter, max) {
@@ -28230,7 +28752,7 @@ function parseDuckDuckGo(html, num) {
       results.push({
         title: entry.title ?? "",
         url: entry.url ?? "",
-        snippet: snippetMatches[i] ?? "",
+        snippet: capSnippet(snippetMatches[i] ?? ""),
         score: 1
       });
     }
@@ -28255,11 +28777,15 @@ function normalizeDuckDuckGoUrl(raw) {
     return raw;
   }
 }
-async function googleSearch(query, num, signal) {
+async function googleSearch(query, signal) {
   const encoded = encodeURIComponent(query);
   const url = `https://www.google.com/search?q=${encoded}&hl=en`;
-  const html = await fetchWithTimeout(url, signal, TIMEOUT_MS3).then((r) => r.text()).catch(() => "");
-  return parseGoogleResults(html, num);
+  try {
+    const html = await fetchWithTimeout(url, signal, TIMEOUT_MS3).then((r) => r.text());
+    return { results: parseGoogleResults(html, MAX_RESULTS) };
+  } catch (err) {
+    return { results: [], error: `google unreachable: ${toErrorMessage9(err)}` };
+  }
 }
 function parseGoogleResults(html, num) {
   const results = [];
@@ -28282,17 +28808,21 @@ function parseGoogleResults(html, num) {
     results.push({
       title: titles[i] ?? "",
       url: urls[i] ?? "",
-      snippet: snippets[i] ?? "",
+      snippet: capSnippet(snippets[i] ?? ""),
       score: 1
     });
   }
   return results;
 }
-async function bingSearch(query, num, signal) {
+async function bingSearch(query, signal) {
   const encoded = encodeURIComponent(query);
   const url = `https://www.bing.com/search?q=${encoded}`;
-  const html = await fetchWithTimeout(url, signal, TIMEOUT_MS3).then((r) => r.text()).catch(() => "");
-  return parseBingResults(html, num);
+  try {
+    const html = await fetchWithTimeout(url, signal, TIMEOUT_MS3).then((r) => r.text());
+    return { results: parseBingResults(html, MAX_RESULTS) };
+  } catch (err) {
+    return { results: [], error: `bing unreachable: ${toErrorMessage9(err)}` };
+  }
 }
 function parseBingResults(html, num) {
   const results = [];
@@ -28305,7 +28835,7 @@ function parseBingResults(html, num) {
     const title = stripTags(expectDefined9(titleMatch[2]));
     if (!href || !title) return [];
     const snippetMatch = /<p\b[^>]*class=(["'])[^"']*\b(?:b_paractl|b_lineclamp\d*)\b[^"']*\1[^>]*>([\s\S]*?)<\/p>/i.exec(block) ?? /<p\b[^>]*>([\s\S]*?)<\/p>/i.exec(block);
-    const snippet = snippetMatch ? stripTags(expectDefined9(snippetMatch.at(-1))) : "";
+    const snippet = snippetMatch ? capSnippet(stripTags(expectDefined9(snippetMatch.at(-1)))) : "";
     return [{ url: normalizeBingUrl(href), title, snippet, score: 1 }];
   }), num);
   for (let i = 0; i < entries.length; i++) {
@@ -28372,17 +28902,20 @@ function anySignal(...signals) {
 function stripTags(html) {
   return decodeHtmlEntities(html.replace(/<[^>]+>/g, "")).trim();
 }
+function capSnippet(snippet) {
+  return snippet.length > MAX_SNIPPET_CHARS ? `${snippet.slice(0, MAX_SNIPPET_CHARS - 1)}\u2026` : snippet;
+}
 function decodeHtmlEntities(text) {
   return text.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
 }
 
 // src/set-working-dir.ts
 import * as fs32 from "node:fs/promises";
-import { toErrorMessage as toErrorMessage7 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage10 } from "@wrongstack/core/utils";
 var setWorkingDirTool = {
   name: "set_working_dir",
   category: "Context",
-  description: "Change the current working directory for all subsequent file operations. The new directory must be inside the project root. Use this to navigate between subdirectories when working on files in different parts of the project.",
+  description: "Change the current working directory for subsequent file operations and shell tools (`bash`/`exec` spawn in this directory unless given an explicit cwd). The new directory must be inside the project root. Use this to navigate between subdirectories when working on files in different parts of the project.",
   usageHint: "Change the working directory so relative paths in subsequent tool calls resolve from a different directory. Pass `path` to set a new directory, or omit to query the current one. The directory must exist and be inside the project root.",
   permission: "confirm",
   mutating: true,
@@ -28412,19 +28945,23 @@ var setWorkingDirTool = {
     } catch (err) {
       return {
         current: ctx.workingDir,
-        error: toErrorMessage7(err)
+        error: toErrorMessage10(err)
       };
     }
+    let isDirectory = false;
     try {
-      await fs32.access(resolved);
+      isDirectory = (await fs32.stat(resolved)).isDirectory();
     } catch {
+      isDirectory = false;
+    }
+    if (!isDirectory) {
       try {
         ctx.setWorkingDir(previous);
       } catch {
       }
       return {
         current: ctx.workingDir,
-        error: `Directory does not exist: ${resolved}`
+        error: `Directory does not exist (or is not a directory): ${resolved}`
       };
     }
     return {
@@ -28879,6 +29416,7 @@ var taskTool = {
         inProgress: 0
       };
     }
+    ctx.meta["task.path.resolved"] = taskPath;
     if (todosToReplace) {
       await todoTool.execute({ todos: todosToReplace }, ctx, {
         signal: AbortSignal.timeout(3e4)
@@ -28903,6 +29441,7 @@ var taskTool = {
             formatted = formatPlan2(updated);
             return updated;
           });
+          ctx.meta["plan.path.resolved"] = planPath;
         } catch (err) {
           return {
             ok: false,
@@ -28946,7 +29485,7 @@ ${formatTaskList2(file.tasks)}` : file.tasks.length > 0 ? formatTaskList2(file.t
 init_spawn_stream();
 init_util();
 init_legacy_bridge();
-import * as path36 from "node:path";
+import * as path37 from "node:path";
 var testTool = {
   name: "test",
   category: "Code Quality",
@@ -29049,11 +29588,11 @@ var testTool = {
   }
 };
 async function detectRunner(cwd) {
-  const { stat: stat19 } = await import("node:fs/promises");
+  const { stat: stat20 } = await import("node:fs/promises");
   const candidates = ["vitest.config.ts", "jest.config.js", ".mocharc.json"];
   for (const f of candidates) {
     try {
-      await stat19(path36.join(cwd, f));
+      await stat20(path37.join(cwd, f));
       if (f.includes("vitest")) return "vitest";
       if (f.includes("jest")) return "jest";
       if (f.includes("mocha")) return "mocha";
@@ -29431,7 +29970,7 @@ var toolUseTool = {
 // src/tree.ts
 init_util();
 import * as fs33 from "node:fs/promises";
-import * as path37 from "node:path";
+import * as path38 from "node:path";
 import { DEFAULT_WALK_IGNORE_DIRS as DEFAULT_WALK_IGNORE_DIRS4, expectDefined as expectDefined10 } from "@wrongstack/core/utils";
 var DEFAULT_IGNORE5 = /* @__PURE__ */ new Set([
   ...DEFAULT_WALK_IGNORE_DIRS4,
@@ -29451,6 +29990,7 @@ var treeTool = {
   mutating: false,
   capabilities: ["fs.read"],
   icon: "tree",
+  maxOutputBytes: 262144,
   timeoutMs: 15e3,
   inputSchema: {
     type: "object",
@@ -29599,17 +30139,15 @@ async function walkDir(dir, depth, opts) {
     if (opts.exclude.has(e.name)) return false;
     return true;
   });
-  if (depth > 0) {
-    let dirCount = 0;
-    let fileCount = 0;
-    for (const e of filtered) {
-      if (e.isDirectory()) dirCount++;
-      else if (e.isFile()) fileCount++;
-    }
-    opts.totalDirs.value += dirCount;
-    opts.totalFiles.value += fileCount;
-    opts.onProgress?.();
-  }
+  let dirCount = 0;
+  let fileCount = 0;
+  for (const e of filtered) {
+    if (e.isDirectory()) dirCount++;
+    else if (e.isFile()) fileCount++;
+  }
+  opts.totalDirs.value += dirCount;
+  opts.totalFiles.value += fileCount;
+  opts.onProgress?.();
   const items = filtered.sort((a, b) => {
     if (a.isDirectory() && !b.isDirectory()) return -1;
     if (!a.isDirectory() && b.isDirectory()) return 1;
@@ -29637,7 +30175,7 @@ async function walkDir(dir, depth, opts) {
     opts.retention.outputBytes += lineBytes;
     if (entry.isDirectory() && (opts.maxDepth === 0 || depth < opts.maxDepth)) {
       const childPrefix = opts.prefix + connector;
-      await walkDir(path37.join(dir, entry.name), depth + 1, {
+      await walkDir(path38.join(dir, entry.name), depth + 1, {
         ...opts,
         prefix: childPrefix,
         isLast
@@ -29650,7 +30188,7 @@ async function walkDir(dir, depth, opts) {
 init_spawn_stream();
 init_util();
 init_legacy_bridge();
-import * as path38 from "node:path";
+import * as path39 from "node:path";
 var typecheckTool = {
   name: "typecheck",
   category: "Code Quality",
@@ -29672,11 +30210,7 @@ var typecheckTool = {
       },
       all: {
         type: "boolean",
-        description: "Type-check all projects (pnpm -r) (default: false)"
-      },
-      json: {
-        type: "boolean",
-        description: "Emit JSON output from tsc (default: false)"
+        description: "Type-check all workspace packages (pnpm workspaces run `pnpm -r exec tsc --noEmit`; other setups run a single `tsc --noEmit` at cwd) (default: false)"
       }
     }
   },
@@ -29712,29 +30246,42 @@ var typecheckTool = {
       };
       return;
     }
-    let args;
+    let cmd;
+    let cmdArgs;
     let project;
     if (input.all) {
-      args = ["--noEmit"];
       project = "workspace";
+      const tscArgs = ["--noEmit"];
+      if (input.strict) tscArgs.push("--strict");
+      const manager = await detectPackageManager(cwd, ctx.projectRoot);
+      if (manager === "pnpm") {
+        cmd = "pnpm";
+        cmdArgs = ["-r", "--no-bail", "exec", "tsc", ...tscArgs];
+      } else {
+        cmd = "npx";
+        cmdArgs = ["tsc", ...tscArgs];
+      }
     } else {
       const tsconfig = input.project ? safeResolve(input.project, ctx) : await findTsConfig(cwd);
-      args = ["--noEmit"];
-      if (input.strict) args.push("--strict");
-      if (tsconfig) args.push("--project", tsconfig);
+      const tscArgs = ["--noEmit"];
+      if (input.strict) tscArgs.push("--strict");
+      if (tsconfig) tscArgs.push("--project", tsconfig);
       project = tsconfig ?? "default";
+      cmd = "npx";
+      cmdArgs = ["tsc", ...tscArgs];
     }
-    if (input.json) args.push("--json");
-    yield { type: "log", text: `tsc ${args.join(" ")}`, data: { project } };
+    yield { type: "log", text: `${cmd} ${cmdArgs.join(" ")}`, data: { project } };
     const result = yield* spawnStream({
-      cmd: "npx",
-      args: ["tsc", ...args],
+      cmd,
+      args: cmdArgs,
       cwd,
       signal: opts.signal,
       maxBytes: 2e5
     });
-    const errors = [...result.stdout.matchAll(/\berror\b/gi)].length;
-    const warnings = [...result.stdout.matchAll(/\bwarning\b/gi)].length;
+    const combined = `${result.stdout}
+${result.stderr}`;
+    const errors = [...combined.matchAll(/^.*\berror TS\d+:/gm)].length;
+    const warnings = [...combined.matchAll(/^.*\bwarning TS\d+:/gm)].length;
     yield {
       type: "final",
       output: {
@@ -29749,12 +30296,12 @@ var typecheckTool = {
   }
 };
 async function findTsConfig(cwd) {
-  const { stat: stat19 } = await import("node:fs/promises");
+  const { stat: stat20 } = await import("node:fs/promises");
   const candidates = ["tsconfig.json", "tsconfig.base.json"];
   for (const f of candidates) {
     try {
-      const s = await stat19(path38.join(cwd, f));
-      if (s.isFile()) return path38.join(cwd, f);
+      const s = await stat20(path39.join(cwd, f));
+      if (s.isFile()) return path39.join(cwd, f);
     } catch {
     }
   }
@@ -29763,21 +30310,32 @@ async function findTsConfig(cwd) {
 
 // src/write.ts
 import * as fs34 from "node:fs/promises";
-import { ToolValidationError as ToolValidationError8 } from "@wrongstack/core/types";
-import { atomicWrite as atomicWrite5, unifiedDiff as unifiedDiff3 } from "@wrongstack/core/utils";
+import { ToolValidationError as ToolValidationError11 } from "@wrongstack/core/types";
+import {
+  atomicWrite as atomicWrite5,
+  detectNewlineStyle as detectNewlineStyle3,
+  normalizeToLf as normalizeToLf3,
+  toStyle as toStyle3,
+  unifiedDiff as unifiedDiff3
+} from "@wrongstack/core/utils";
 init_util();
+var MAX_DIFF_BYTES3 = 262144;
 var writeTool = {
   name: "write",
   category: "Filesystem",
   description: "Write or completely overwrite a file on disk. This is a high-privilege operation. For modifying existing files, you should almost always prefer the `edit` tool instead, because `edit` is safer and works on the last-read version of the file.",
-  usageHint: "RULES FOR CORRECT USAGE:\n- Use `write` primarily for **new files** or when you want to replace the entire content.\n- For any existing file, strongly prefer `edit` (it requires a prior `read` in the same session and is more precise).\n- You MUST have called `read` on the file earlier in the conversation before using `write` on an existing path (the system enforces this for safety).\n- The path is resolved relative to the project root and protected against escaping the workspace.",
+  usageHint: "RULES FOR CORRECT USAGE:\n- Use `write` primarily for **new files** or when you want to replace the entire content.\n- For any existing file, strongly prefer `edit` (it requires a prior `read` in the same session and is more precise).\n- When overwriting an existing file, the tool reads the current content itself to compute the diff \u2014 but still `read` the file first before large rewrites so you know what you are replacing.\n- When overwriting an existing file, the content is normalized to the dominant line-ending style (CRLF/LF) of the existing file; new files are written verbatim.\n- The path is resolved relative to the project root and protected against escaping the workspace.",
   selection: {
     doNotUseWhen: "making a precise change to part of an existing file.",
     useInstead: ["edit"]
   },
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on — the file being
+  // written, so trust rules can scope by path.
+  subjectKey: "path",
   mutating: true,
   timeoutMs: 5e3,
+  maxOutputBytes: 262144,
   capabilities: ["fs.write"],
   icon: "file",
   inputSchema: {
@@ -29813,13 +30371,13 @@ async function writeFile6(input, ctx, signal) {
 }
 async function prepareWrite(input, ctx) {
   if (!input?.path) {
-    throw new ToolValidationError8({
+    throw new ToolValidationError11({
       message: "write: path is required",
       field: "path"
     });
   }
   if (input.content === void 0) {
-    throw new ToolValidationError8({
+    throw new ToolValidationError11({
       message: "write: content is required",
       field: "content"
     });
@@ -29828,12 +30386,12 @@ async function prepareWrite(input, ctx) {
   let existed = false;
   let prev = "";
   try {
-    const stat19 = await fs34.stat(absPath);
-    existed = stat19.isFile();
+    const stat20 = await fs34.stat(absPath);
+    existed = stat20.isFile();
     if (existed) {
       if (!ctx.hasRead(absPath)) {
         prev = await fs34.readFile(absPath, "utf8");
-        ctx.recordRead(absPath, stat19.mtimeMs, "write", sha256hex(prev));
+        ctx.recordRead(absPath, stat20.mtimeMs, "write", sha256hex(prev));
       } else {
         prev = await fs34.readFile(absPath, "utf8");
       }
@@ -29846,31 +30404,42 @@ async function prepareWrite(input, ctx) {
   return { absPath, existed, prev };
 }
 async function finishWrite(input, ctx, prepared, signal) {
+  const content = prepared.existed ? toStyle3(normalizeToLf3(input.content), detectNewlineStyle3(prepared.prev)) : input.content;
   signal?.throwIfAborted();
-  await atomicWrite5(prepared.absPath, input.content);
-  const diff = prepared.existed ? unifiedDiff3(prepared.prev, input.content, { fromFile: input.path, toFile: input.path }) : `+++ ${input.path}
-+ (new file, ${input.content.split("\n").length} lines)`;
-  const stat19 = await fs34.stat(prepared.absPath);
-  ctx.recordRead(prepared.absPath, stat19.mtimeMs, "write", sha256hex(input.content));
+  await atomicWrite5(prepared.absPath, content);
+  const rawDiff = prepared.existed ? unifiedDiff3(prepared.prev, content, { fromFile: input.path, toFile: input.path }) : `+++ ${input.path}
++ (new file, ${content.split("\n").length} lines)`;
+  const { text: diff, truncated: diffTruncated } = truncateDiffPayload(rawDiff, MAX_DIFF_BYTES3);
+  const stat20 = await fs34.stat(prepared.absPath);
+  ctx.recordRead(prepared.absPath, stat20.mtimeMs, "write", sha256hex(content));
   ctx.session.recordFileChange({
     path: prepared.absPath,
     action: prepared.existed ? "modified" : "created",
     before: prepared.existed ? prepared.prev : null,
-    after: input.content
+    after: content
   });
   const syntax = await checkSyntax(
     prepared.absPath,
-    input.content,
+    content,
     prepared.existed ? prepared.prev : void 0
   ).catch(() => void 0);
   const hasSyntaxErrors = syntax !== void 0 && syntax.errors.length > 0;
+  const notes = [];
+  if (diffTruncated) {
+    notes.push("Diff truncated to the 256 KiB output budget \u2014 the full write is on disk.");
+  }
+  if (hasSyntaxErrors) {
+    notes.push(
+      syntax.preExisting ? "Syntax check: the file still has parse errors (they pre-date this write) \u2014 see syntax_errors." : `Syntax check: the written content has ${syntax.errors.length} parse error(s) \u2014 fix them now, see syntax_errors.`
+    );
+  }
   return {
     path: prepared.absPath,
-    bytes_written: Buffer.byteLength(input.content, "utf8"),
+    bytes_written: Buffer.byteLength(content, "utf8"),
     created: !prepared.existed,
     diff,
     syntax_errors: hasSyntaxErrors ? syntax.errors : void 0,
-    note: hasSyntaxErrors ? syntax.preExisting ? "Syntax check: the file still has parse errors (they pre-date this write) \u2014 see syntax_errors." : `Syntax check: the written content has ${syntax.errors.length} parse error(s) \u2014 fix them now, see syntax_errors.` : void 0
+    note: notes.length > 0 ? notes.join("\n") : void 0
   };
 }
 
@@ -29995,7 +30564,7 @@ init_circuit_breaker();
 init_languages();
 
 // src/memory.ts
-import { ToolValidationError as ToolValidationError9 } from "@wrongstack/core/types";
+import { ToolValidationError as ToolValidationError12 } from "@wrongstack/core/types";
 function rememberTool(memory) {
   return {
     name: "remember",
@@ -30039,7 +30608,7 @@ function rememberTool(memory) {
     },
     async execute(input) {
       if (!input?.text) {
-        throw new ToolValidationError9({
+        throw new ToolValidationError12({
           message: "remember: text is required",
           field: "text"
         });
@@ -30058,28 +30627,48 @@ function forgetTool(memory) {
   return {
     name: "forget",
     category: "Session",
-    description: "Remove memory entries that contain the given substring (case-insensitive). Use with caution.",
-    usageHint: "This permanently deletes matching memories in the chosen scope.\n- Provide a reasonably specific `query` to avoid deleting unrelated memories.\n- Always double-check before calling with broad queries.\n- Use `remember` + `forget` together to maintain clean long-term memory.",
+    description: "Remove memory entries that contain the given substring (case-insensitive). Use with caution. Pass `dry_run: true` to preview the matching entries (capped at 20) without deleting anything.",
+    usageHint: "This permanently deletes matching memories in the chosen scope.\n- Provide a reasonably specific `query` to avoid deleting unrelated memories.\n- Always double-check before calling with broad queries \u2014 `dry_run: true` previews the matches without deleting.\n- Use `remember` + `forget` together to maintain clean long-term memory.",
     permission: "confirm",
+    // WS-046: gives permission decisions something to key on — the substring
+    // being forgotten.
+    subjectKey: "query",
     mutating: true,
     timeoutMs: 2e3,
     capabilities: ["memory.delete"],
+    icon: "settings",
     inputSchema: {
       type: "object",
       properties: {
         query: { type: "string" },
-        scope: { type: "string", enum: ["project-agents", "project-memory", "user-memory"] }
+        scope: { type: "string", enum: ["project-agents", "project-memory", "user-memory"] },
+        dry_run: {
+          type: "boolean",
+          description: "When true, return the matched entries (capped at 20) WITHOUT deleting them. Default false."
+        }
       },
       required: ["query"]
     },
     async execute(input) {
       if (!input?.query) {
-        throw new ToolValidationError9({
+        throw new ToolValidationError12({
           message: "forget: query is required",
           field: "query"
         });
       }
       const scope = input.scope ?? "project-memory";
+      if (input.dry_run) {
+        const entries = await memory.list(scope);
+        const needle = input.query.toLowerCase();
+        const matching = entries.filter((entry) => entry.text.toLowerCase().includes(needle));
+        return {
+          removed: 0,
+          scope,
+          dryRun: true,
+          matched: matching.length,
+          matches: matching.slice(0, 20).map((entry) => entry.text)
+        };
+      }
       const removed = await memory.forget(input.query, scope);
       return { removed, scope };
     }
@@ -30116,7 +30705,7 @@ function searchMemoryTool(memory) {
     },
     async execute(input) {
       if (!input?.query) {
-        throw new ToolValidationError9({
+        throw new ToolValidationError12({
           message: "search_memory: query is required",
           field: "query"
         });
@@ -30168,7 +30757,7 @@ function relatedMemoryTool(memory) {
     },
     async execute(input) {
       if (!input?.text) {
-        throw new ToolValidationError9({
+        throw new ToolValidationError12({
           message: "find_related_memories: text is required",
           field: "text"
         });
@@ -30204,6 +30793,9 @@ function createModeTool(modeStore) {
     description: "Manage agent operating modes. Modes change the agent's behavior, personality, and system prompt for different workflows (e.g. coding, security review, planning).",
     usageHint: "POWERFUL BEHAVIOR CONTROL TOOL:\n\n- Use `list` to see available modes.\n- Use `set <modeId>` to switch the agent into a specific role/mode.\n- Use `get` to check current mode.\n- Use `clear` to return to default behavior.\nSwitching modes is very effective for specialized tasks. The mode change affects how the agent reasons and which guidelines it follows.",
     permission: "confirm",
+    // WS-046: gives permission decisions something to key on — the mode being
+    // activated. Permission semantics are unchanged.
+    subjectKey: "mode",
     mutating: true,
     timeoutMs: 5e3,
     capabilities: ["session.mode"],
@@ -30942,14 +31534,14 @@ function createGlobalPsSlashCommand() {
 
 // src/skill.ts
 import * as fs35 from "node:fs/promises";
-import * as path39 from "node:path";
+import * as path40 from "node:path";
 import {
   missingRequiredRuntimeTools,
   missingRuntimeCapabilities,
   runtimeToolReferencesFromText
 } from "@wrongstack/core/agent-catalog";
 import { SKILL_LIMITS, stripFrontmatter } from "@wrongstack/core/skills";
-import { ToolValidationError as ToolValidationError10 } from "@wrongstack/core/types";
+import { ToolValidationError as ToolValidationError13 } from "@wrongstack/core/types";
 var MAX_BODY_CHARS = SKILL_LIMITS.MAX_SKILL_BODY_CHARS;
 var MAX_RESOURCE_CHARS = SKILL_LIMITS.MAX_RESOURCE_CHARS;
 var MAX_LISTED_RESOURCES = SKILL_LIMITS.MAX_LISTED_RESOURCES;
@@ -30982,11 +31574,11 @@ function makeSkillTool(skillLoader) {
     async execute(input, ctx) {
       const name = input?.name?.trim();
       if (!name) {
-        throw new ToolValidationError10({ message: "skill: name is required", field: "name" });
+        throw new ToolValidationError13({ message: "skill: name is required", field: "name" });
       }
       const manifest = await skillLoader.find(name);
       if (!manifest) {
-        throw new ToolValidationError10({
+        throw new ToolValidationError13({
           message: `skill "${name}" not found \u2014 use /skill to list available skills`,
           field: "name"
         });
@@ -30998,7 +31590,7 @@ function makeSkillTool(skillLoader) {
       );
       const missingTools = missingRequiredRuntimeTools(manifest.requiredTools, availableToolNames);
       if (missingCapabilities.length > 0 || missingTools.length > 0) {
-        throw new ToolValidationError10({
+        throw new ToolValidationError13({
           message: `skill "${name}" is unavailable in this runtime; ` + [
             missingCapabilities.length > 0 ? `missing capabilities: ${missingCapabilities.join(", ")}` : "",
             missingTools.length > 0 ? `missing tools: ${missingTools.join(", ")}` : ""
@@ -31006,7 +31598,7 @@ function makeSkillTool(skillLoader) {
           field: "name"
         });
       }
-      const dir = path39.dirname(manifest.path);
+      const dir = path40.dirname(manifest.path);
       let loadedResource;
       if (input.resource?.trim()) {
         loadedResource = await loadResource(dir, input.resource.trim());
@@ -31016,12 +31608,7 @@ function makeSkillTool(skillLoader) {
         runtimeToolReferencesFromText(raw),
         availableToolNames
       );
-      if (missingBodyTools.length > 0) {
-        throw new ToolValidationError10({
-          message: `skill "${name}" references unregistered tools: ${missingBodyTools.join(", ")}`,
-          field: "name"
-        });
-      }
+      const warning = missingBodyTools.length > 0 ? `Warning: skill "${name}" references tools not registered in this runtime: ${missingBodyTools.join(", ")}. Steps that call them may be unavailable.` : void 0;
       const body = stripFrontmatter(raw).trim().slice(0, MAX_BODY_CHARS);
       const resources = loadedResource ? [] : await listResources(dir);
       try {
@@ -31038,44 +31625,48 @@ function makeSkillTool(skillLoader) {
         body,
         resources,
         dir,
-        loadedResource
+        loadedResource,
+        warning
       };
     },
     serialize(output) {
+      const warningLine = output.warning ? `
+
+${output.warning}` : "";
       if (output.loadedResource) {
         const lr = output.loadedResource;
         const note = lr.truncated ? ` (truncated to ${lr.content.length} chars of ${lr.bytes} B)` : "";
         return `# Resource: ${output.name}/${lr.rel}
 (abs path: ${lr.absPath})${note}
 
-${lr.content}`;
+${lr.content}${warningLine}`;
       }
       const head = `# Skill: ${output.name}
 ${output.description}
 
 ${output.body}`;
-      if (output.resources.length === 0) return head;
+      if (output.resources.length === 0) return `${head}${warningLine}`;
       const listing = output.resources.map((r) => `- ${r.path} (${r.bytes} B)`).join("\n");
       return `${head}
 
 ## Bundled resources (load on demand)
 Load any with: \`skill({ name: "${output.name}", resource: "<path>" })\`. Run scripts via bash using their abs path under ${output.dir}.
-${listing}`;
+${listing}${warningLine}`;
     }
   };
 }
 async function loadResource(skillDir, rel) {
   const norm = rel.replace(/\\/g, "/");
-  if (path39.isAbsolute(rel) || norm.split("/").some((seg) => seg === "..")) {
-    throw new ToolValidationError10({
+  if (path40.isAbsolute(rel) || norm.split("/").some((seg) => seg === "..")) {
+    throw new ToolValidationError13({
       message: `skill: invalid resource path "${rel}"`,
       field: "resource"
     });
   }
-  const absPath = path39.resolve(skillDir, rel);
-  const root = path39.resolve(skillDir);
-  if (absPath !== root && !absPath.startsWith(root + path39.sep)) {
-    throw new ToolValidationError10({
+  const absPath = path40.resolve(skillDir, rel);
+  const root = path40.resolve(skillDir);
+  if (absPath !== root && !absPath.startsWith(root + path40.sep)) {
+    throw new ToolValidationError13({
       message: `skill: resource "${rel}" escapes the skill directory`,
       field: "resource"
     });
@@ -31086,13 +31677,13 @@ async function loadResource(skillDir, rel) {
     realRoot = await fs35.realpath(root);
     realPath = await fs35.realpath(absPath);
   } catch {
-    throw new ToolValidationError10({
+    throw new ToolValidationError13({
       message: `skill: resource "${rel}" not readable`,
       field: "resource"
     });
   }
-  if (realPath !== realRoot && !realPath.startsWith(realRoot + path39.sep)) {
-    throw new ToolValidationError10({
+  if (realPath !== realRoot && !realPath.startsWith(realRoot + path40.sep)) {
+    throw new ToolValidationError13({
       message: `skill: resource "${rel}" resolves outside the skill directory`,
       field: "resource"
     });
@@ -31101,7 +31692,7 @@ async function loadResource(skillDir, rel) {
   try {
     buf = await fs35.readFile(realPath);
   } catch {
-    throw new ToolValidationError10({
+    throw new ToolValidationError13({
       message: `skill: resource "${rel}" not readable`,
       field: "resource"
     });
@@ -31134,7 +31725,7 @@ async function walk(root, dir, out) {
   }
   for (const e of entries) {
     if (out.length >= MAX_LISTED_RESOURCES) return;
-    const fullPath = path39.join(dir, e.name);
+    const fullPath = path40.join(dir, e.name);
     let isDir = e.isDirectory();
     if (e.isSymbolicLink()) {
       try {
@@ -31149,9 +31740,9 @@ async function walk(root, dir, out) {
     } else if (e.isFile()) {
       if (e.name === "SKILL.md" || e.name === "SKILL.save.md") continue;
       try {
-        const stat19 = await fs35.stat(fullPath);
-        const rel = path39.relative(root, fullPath).split(path39.sep).join("/");
-        out.push({ path: rel, bytes: stat19.size });
+        const stat20 = await fs35.stat(fullPath);
+        const rel = path40.relative(root, fullPath).split(path40.sep).join("/");
+        out.push({ path: rel, bytes: stat20.size });
       } catch {
       }
     }
@@ -31244,9 +31835,15 @@ var TOOL_ICON_MAP = {
   "codebase-index": "index",
   "codebase-search": "index",
   "codebase-stats": "index",
+  "codebase-incoming-calls": "index",
+  "codebase-outgoing-calls": "index",
+  "dead-code-scan": "index",
   codebase_index: "index",
   codebase_search: "index",
   codebase_stats: "index",
+  codebase_incoming_calls: "index",
+  codebase_outgoing_calls: "index",
+  dead_code_scan: "index",
   // Data
   json: "json",
   parse: "json",