@wrongstack/tools 0.307.0 → 0.308.0

package/dist/builtin.js

@@ -1031,8 +1031,8 @@ async function* spawnStream(opts) {
   try {
     for (; ; ) {
       while (queue.length === 0) {
-        await new Promise((resolve22) => {
-          waiter = resolve22;
+        await new Promise((resolve23) => {
+          waiter = resolve23;
         });
       }
       const chunk = queue.shift();
@@ -1135,9 +1135,9 @@ async function detectPackageManager(cwd, stopAt) {
   return "npm";
 }
 async function detectPackageManagerInDir(dir) {
-  const fs42 = await import("node:fs/promises");
+  const fs43 = await import("node:fs/promises");
   try {
-    const raw = await fs42.readFile(path3.join(dir, "package.json"), "utf8");
+    const raw = await fs43.readFile(path3.join(dir, "package.json"), "utf8");
     const declared = JSON.parse(raw).packageManager;
     if (typeof declared === "string") {
       const name = declared.split("@")[0] ?? "";
@@ -1156,7 +1156,7 @@ async function detectPackageManagerInDir(dir) {
   ];
   for (const [file, manager] of lockfiles) {
     try {
-      await fs42.stat(`${dir}/${file}`);
+      await fs43.stat(`${dir}/${file}`);
       return manager;
     } catch {
     }
@@ -4137,15 +4137,15 @@ async function changedPaths(before, after, beforeSizes, afterSizes) {
   const beforeSet = new Set(before);
   const afterSet = new Set(after);
   const changed = /* @__PURE__ */ new Set();
-  for (const path48 of after) {
-    if (!beforeSet.has(path48)) changed.add(path48);
+  for (const path49 of after) {
+    if (!beforeSet.has(path49)) changed.add(path49);
   }
-  for (const path48 of before) {
-    if (!afterSet.has(path48)) changed.add(path48);
+  for (const path49 of before) {
+    if (!afterSet.has(path49)) changed.add(path49);
   }
   if (beforeSizes && afterSizes) {
-    for (const path48 of after) {
-      if (beforeSizes.get(path48) !== afterSizes.get(path48)) changed.add(path48);
+    for (const path49 of after) {
+      if (beforeSizes.get(path49) !== afterSizes.get(path49)) changed.add(path49);
     }
   }
   return [...changed].sort();
@@ -5640,7 +5640,7 @@ async function syncGoParse(filePath, content, lang) {
     }
     const goBinary = resolveWin32Command("go");
     const goResult = await new Promise(
-      (resolve22, reject) => {
+      (resolve23, reject) => {
         let settled = false;
         const proc = spawn5(goBinary, ["run", scriptPath], {
           stdio: ["pipe", "pipe", "pipe"],
@@ -5669,7 +5669,7 @@ async function syncGoParse(filePath, content, lang) {
           if (settled) return;
           settled = true;
           clearTimeout(timer);
-          resolve22({ code: code2, stdout: stdout2 });
+          resolve23({ code: code2, stdout: stdout2 });
         });
       }
     );
@@ -6345,7 +6345,7 @@ async function resolvePython() {
   return null;
 }
 function commandIsAvailable(command) {
-  return new Promise((resolve22) => {
+  return new Promise((resolve23) => {
     let settled = false;
     const proc = spawn6(command, ["--version"], {
       stdio: "ignore",
@@ -6355,7 +6355,7 @@ function commandIsAvailable(command) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve22(available);
+      resolve23(available);
     };
     const timer = setTimeout(() => {
       proc.kill("SIGKILL");
@@ -6367,7 +6367,7 @@ function commandIsAvailable(command) {
   });
 }
 function spawnPyParser(pyBinary, scriptPath, filePath, content) {
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve23, reject) => {
     let settled = false;
     const proc = spawn6(pyBinary, [scriptPath, filePath], {
       stdio: ["pipe", "pipe", "pipe"],
@@ -6396,7 +6396,7 @@ function spawnPyParser(pyBinary, scriptPath, filePath, content) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve22({ code, stdout });
+      resolve23({ code, stdout });
     });
   });
 }
@@ -9230,10 +9230,10 @@ var bashTool = {
         queue.push(c);
       }
     };
-    const next = () => new Promise((resolve22) => {
+    const next = () => new Promise((resolve23) => {
       const c = queue.shift();
-      if (c) resolve22(c);
-      else resolveNext = resolve22;
+      if (c) resolve23(c);
+      else resolveNext = resolve23;
     });
     let lastFlush = Date.now();
     const flush = () => {
@@ -9696,11 +9696,11 @@ var BrowserArtifactStore = class {
 };
 async function hashFile(target) {
   const hash = createHash3("sha256");
-  await new Promise((resolve22, reject) => {
+  await new Promise((resolve23, reject) => {
     const stream = createReadStream(target);
     stream.on("data", (chunk) => hash.update(chunk));
     stream.once("error", reject);
-    stream.once("end", resolve22);
+    stream.once("end", resolve23);
   });
   return hash.digest("hex");
 }
@@ -9850,7 +9850,7 @@ var BrowserNetworkGuardProxy = class {
   async start() {
     if (this.url) return this.url;
     if (this.startPromise) return this.startPromise;
-    this.startPromise = new Promise((resolve22, reject) => {
+    this.startPromise = new Promise((resolve23, reject) => {
       const onError = (error) => {
         this.server.off("listening", onListening);
         reject(error);
@@ -9863,7 +9863,7 @@ var BrowserNetworkGuardProxy = class {
           return;
         }
         this.url = `http://127.0.0.1:${address.port}`;
-        resolve22(this.url);
+        resolve23(this.url);
       };
       this.server.once("error", onError);
       this.server.once("listening", onListening);
@@ -9878,7 +9878,7 @@ var BrowserNetworkGuardProxy = class {
     for (const socket of this.sockets) socket.destroy();
     this.sockets.clear();
     if (!this.server.listening) return;
-    await new Promise((resolve22) => this.server.close(() => resolve22()));
+    await new Promise((resolve23) => this.server.close(() => resolve23()));
   }
   async forwardHttp(request2, response) {
     try {
@@ -10451,7 +10451,7 @@ function pushBounded(target, value, limit) {
 }
 async function abortable(signal, operation, onAbort) {
   signal.throwIfAborted();
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve23, reject) => {
     let settled = false;
     let aborting = false;
     const finish = (fn) => {
@@ -10469,7 +10469,7 @@ async function abortable(signal, operation, onAbort) {
     signal.addEventListener("abort", abort, { once: true });
     operation().then(
       (value) => {
-        if (!aborting) finish(() => resolve22(value));
+        if (!aborting) finish(() => resolve23(value));
       },
       (err) => {
         if (!aborting) finish(() => reject(err));
@@ -11725,10 +11725,16 @@ function buildFileGraphNodeState(pkgSyms, localFiles, packageOf) {
   }
   return { fileNodes, symToFile, fileStats, ensureFileNode };
 }
-function buildSymbolGraphNodes(symById, relatedIds, fileFilter, packageOf) {
+function buildSymbolGraphNodes(symById, relatedIds, localFiles, packageOf) {
+  const local = new Set(
+    [...typeof localFiles === "string" ? [localFiles] : localFiles].map(
+      (file) => file.replace(/\\/g, "/")
+    )
+  );
+  const isLocal = (file) => local.has(file.replace(/\\/g, "/"));
   return [...relatedIds].map((id) => symById.get(id)).filter((symbol) => symbol !== void 0).sort((a, b) => {
-    const aExternal = a.file === fileFilter ? 0 : 1;
-    const bExternal = b.file === fileFilter ? 0 : 1;
+    const aExternal = isLocal(a.file) ? 0 : 1;
+    const bExternal = isLocal(b.file) ? 0 : 1;
     return aExternal - bExternal || a.file.localeCompare(b.file) || a.line - b.line || a.id - b.id;
   }).map((s) => ({
     id: `sym:${s.id}`,
@@ -11742,7 +11748,7 @@ function buildSymbolGraphNodes(symById, relatedIds, fileFilter, packageOf) {
     line: s.line,
     signature: s.signature,
     scope: s.scope,
-    external: s.file !== fileFilter
+    external: !isLocal(s.file)
   }));
 }
 function addWeightedEdge(edgeMap, source, target, callType, weight) {
@@ -11777,6 +11783,56 @@ function materializeWeightedEdges(edgeMap, idPrefix) {
   return edges;
 }
 
+// src/codebase-index/writer-helpers.ts
+import { resolveWstackPaths as resolveWstackPaths2 } from "@wrongstack/core/utils";
+function escapeLike(value) {
+  return value.replace(/[\\%_]/g, (char) => `\\${char}`);
+}
+function posixIndexPath(file) {
+  return file.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function indexedFileMatchSql(column = "file") {
+  return `(${column} = ? OR replace(${column}, '\\', '/') = ? OR replace(${column}, '\\', '/') LIKE ? ESCAPE '\\')`;
+}
+function indexedFileMatchArgs(file) {
+  const posix4 = posixIndexPath(file.trim());
+  return [file, posix4, `%/${escapeLike(posix4)}`];
+}
+function matchesIndexedPackageFilter(storedFile, packageLabel, filter) {
+  if (packageLabel === filter) return true;
+  const posixFile = posixIndexPath(storedFile);
+  const posixFilter = posixIndexPath(filter.trim());
+  if (!posixFilter) return false;
+  return posixFile === posixFilter || posixFile.endsWith(`/${posixFilter}`) || posixFile.includes(`/${posixFilter}/`);
+}
+function assignRefsToSymbols(refs, symbols) {
+  if (refs.length === 0 || symbols.length === 0) return [];
+  const ordered = [...symbols].sort((a, b) => a.line - b.line || a.col - b.col || a.id - b.id);
+  const seen = /* @__PURE__ */ new Set();
+  const assigned = [];
+  for (const ref of refs) {
+    let owner2;
+    for (const symbol of ordered) {
+      if (symbol.line > ref.line) break;
+      owner2 = symbol;
+    }
+    if (!owner2 && ref.callType === "import") owner2 = ordered[0];
+    if (!owner2 || owner2.id <= 0) continue;
+    const key = `${owner2.id}:${ref.toName}:${ref.callType}:${ref.module ?? ""}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    assigned.push({ ...ref, fromId: owner2.id });
+  }
+  return assigned;
+}
+function resolveIndexDir(projectRoot, override) {
+  return override ?? resolveWstackPaths2({ projectRoot }).projectCodebaseIndex;
+}
+function codebaseIndexDirOverride(ctx) {
+  const v = ctx.meta?.["codebaseIndexDir"];
+  return typeof v === "string" ? v : void 0;
+}
+
 // src/codebase-index/writer-ref-mapper.ts
 function mapWriterRefRow(row) {
   return {
@@ -11832,10 +11888,23 @@ function mapCallSiteRow(row) {
     line: row.ref_line
   };
 }
+function resolveIndexedFiles(stmt, file) {
+  const rows = stmt(
+    `SELECT DISTINCT file FROM symbols WHERE ${indexedFileMatchSql("file")} ORDER BY length(file), file`
+  ).all(...indexedFileMatchArgs(file));
+  return rows.map((row) => row.file);
+}
 function resolveSymbolIds(stmt, symbolName, file) {
-  const baseSql = file ? `SELECT id FROM symbols WHERE name = ? AND file = ? ORDER BY id` : `SELECT id FROM symbols WHERE name = ? ORDER BY id`;
-  const args = file ? [symbolName, file] : [symbolName];
-  const rows = stmt(baseSql).all(...args);
+  if (!file) {
+    const rows2 = stmt("SELECT id FROM symbols WHERE name = ? ORDER BY id").all(symbolName);
+    return rows2.map((r) => r.id);
+  }
+  const indexedFiles = resolveIndexedFiles(stmt, file);
+  if (indexedFiles.length === 0) return [];
+  const placeholders = indexedFiles.map(() => "?").join(",");
+  const rows = stmt(
+    `SELECT id FROM symbols WHERE name = ? AND file IN (${placeholders}) ORDER BY id`
+  ).all(symbolName, ...indexedFiles);
   return rows.map((r) => r.id);
 }
 function findIncomingCallsByName(stmt, symbolName, file, limit) {
@@ -12157,7 +12226,7 @@ function getFileGraphWithStatement(stmt, packageFilter) {
   const allFiles = stmt("SELECT DISTINCT file FROM symbols").all();
   const packageOf = readPackageLabeller(stmt);
   const langOf = (file) => detectLang(file) ?? "other";
-  const pkgFilePaths = allFiles.filter((f) => packageOf(f.file) === packageFilter).map((f) => f.file);
+  const pkgFilePaths = allFiles.filter((f) => matchesIndexedPackageFilter(f.file, packageOf(f.file), packageFilter)).map((f) => f.file);
   const localFiles = new Set(pkgFilePaths);
   if (localFiles.size === 0) return { nodes: [], edges: [] };
   const filePlaceholders = [...localFiles].map(() => "?").join(",");
@@ -12233,9 +12302,12 @@ function getFileGraphWithStatement(stmt, packageFilter) {
   return { nodes: [...fileNodes.values()], edges };
 }
 function getSymbolGraphWithStatement(stmt, fileFilter) {
+  const indexedFiles = resolveIndexedFiles(stmt, fileFilter);
+  if (indexedFiles.length === 0) return { nodes: [], edges: [] };
+  const filePlaceholders = indexedFiles.map(() => "?").join(",");
   const syms = stmt(
-    "SELECT id, name, kind, lang, file, line, signature, scope FROM symbols WHERE file = ? ORDER BY line, id"
-  ).all(fileFilter);
+    `SELECT id, name, kind, lang, file, line, signature, scope FROM symbols WHERE file IN (${filePlaceholders}) ORDER BY line, id`
+  ).all(...indexedFiles);
   if (syms.length === 0) return { nodes: [], edges: [] };
   const symById = new Map(syms.map((symbol) => [symbol.id, symbol]));
   const relatedIds = new Set(syms.map((symbol) => symbol.id));
@@ -12245,16 +12317,16 @@ function getSymbolGraphWithStatement(stmt, fileFilter) {
          SELECT r.from_id, r.to_id, r.to_name, r.call_type, r.line
          FROM refs r
          JOIN symbols s ON s.id = r.from_id
-         WHERE s.file = ?
+         WHERE s.file IN (${filePlaceholders})
          UNION
          SELECT r.from_id, r.to_id, r.to_name, r.call_type, r.line
          FROM refs r
          JOIN symbols s ON s.id = r.to_id
-         WHERE s.file = ?
+         WHERE s.file IN (${filePlaceholders})
        )
        WHERE to_id IS NOT NULL
        GROUP BY from_id, to_id, call_type`
-  ).all(fileFilter, fileFilter);
+  ).all(...indexedFiles, ...indexedFiles);
   const edgeMap = /* @__PURE__ */ new Map();
   for (const r of refRows) {
     if (r.to_id == null) continue;
@@ -12273,43 +12345,15 @@ function getSymbolGraphWithStatement(stmt, fileFilter) {
     ).all(...missingIds);
     for (const s of extras) symById.set(s.id, s);
   }
-  const nodes = buildSymbolGraphNodes(symById, relatedIds, fileFilter, readPackageLabeller(stmt));
+  const nodes = buildSymbolGraphNodes(
+    symById,
+    relatedIds,
+    new Set(syms.map((symbol) => symbol.file)),
+    readPackageLabeller(stmt)
+  );
   return { nodes, edges };
 }
 
-// src/codebase-index/writer-helpers.ts
-import { resolveWstackPaths as resolveWstackPaths2 } from "@wrongstack/core/utils";
-function escapeLike(value) {
-  return value.replace(/[\\%_]/g, (char) => `\\${char}`);
-}
-function assignRefsToSymbols(refs, symbols) {
-  if (refs.length === 0 || symbols.length === 0) return [];
-  const ordered = [...symbols].sort((a, b) => a.line - b.line || a.col - b.col || a.id - b.id);
-  const seen = /* @__PURE__ */ new Set();
-  const assigned = [];
-  for (const ref of refs) {
-    let owner2;
-    for (const symbol of ordered) {
-      if (symbol.line > ref.line) break;
-      owner2 = symbol;
-    }
-    if (!owner2 && ref.callType === "import") owner2 = ordered[0];
-    if (!owner2 || owner2.id <= 0) continue;
-    const key = `${owner2.id}:${ref.toName}:${ref.callType}:${ref.module ?? ""}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    assigned.push({ ...ref, fromId: owner2.id });
-  }
-  return assigned;
-}
-function resolveIndexDir(projectRoot, override) {
-  return override ?? resolveWstackPaths2({ projectRoot }).projectCodebaseIndex;
-}
-function codebaseIndexDirOverride(ctx) {
-  const v = ctx.meta?.["codebaseIndexDir"];
-  return typeof v === "string" ? v : void 0;
-}
-
 // src/codebase-index/vector-search.ts
 var RRF_K = 60;
 var VECTOR_DIMENSIONS = 384;
@@ -13952,8 +13996,8 @@ function isProjectIndexServerHealth(value) {
   return typeof health.checkedAt === "number" && typeof health.uptimeMs === "number" && typeof memory?.rss === "number" && typeof memory.heapUsed === "number" && typeof memory.heapTotal === "number" && typeof memory.external === "number" && typeof health.clients === "number" && typeof health.activeRequests === "number" && typeof health.activeWrites === "number" && typeof health.queuedWrites === "number" && typeof health.pendingExternalFiles === "number" && typeof health.watchingExternal === "boolean" && typeof activity?.indexing === "boolean" && typeof activity.currentFile === "number" && typeof activity.totalFiles === "number" && typeof activity.generation === "number";
 }
 function delay(ms) {
-  return new Promise((resolve22) => {
-    const timer = setTimeout(resolve22, ms);
+  return new Promise((resolve23) => {
+    const timer = setTimeout(resolve23, ms);
     timer.unref?.();
   });
 }
@@ -14159,7 +14203,7 @@ var ProjectServerConnection = class {
       return Promise.reject(new Error("codebase-index server connection is not available"));
     }
     const id = this.nextId++;
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve23, reject) => {
       const timer = setTimeout(() => {
         const entry = this.pending.get(id);
         if (!entry) return;
@@ -14182,7 +14226,7 @@ var ProjectServerConnection = class {
         entry.reject(cancellationError(signal));
       } : void 0;
       this.pending.set(id, {
-        resolve: resolve22,
+        resolve: resolve23,
         reject,
         timer,
         signal,
@@ -14251,7 +14295,7 @@ var ProjectServerConnection = class {
     this.binaryBuffer = [];
     this.useBinary = false;
     this.textDecoder = null;
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve23, reject) => {
       const socket = net3.createConnection(this.endpoint);
       this.socket = socket;
       const timer = setTimeout(() => {
@@ -14263,7 +14307,7 @@ var ProjectServerConnection = class {
         clearTimeout(timer);
         this.connectResolve = null;
         this.connectReject = null;
-        resolve22();
+        resolve23();
       };
       const finishReject = (error) => {
         clearTimeout(timer);
@@ -15277,9 +15321,9 @@ var ParserWorkerPool = class {
     for (let i = 0; i < files.length; i++) {
       chunks[i % workerCount].push(files[i]);
     }
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve23, reject) => {
       this.pending.set(batchId, {
-        resolve: resolve22,
+        resolve: resolve23,
         reject,
         accumulated: [],
         expectedWorkers: workerCount,
@@ -15310,10 +15354,10 @@ var ParserWorkerPool = class {
     await Promise.allSettled(
       workers.map(
         (w) => Promise.race([
-          new Promise((resolve22) => {
-            w.once("exit", () => resolve22());
+          new Promise((resolve23) => {
+            w.once("exit", () => resolve23());
           }),
-          new Promise((resolve22) => setTimeout(() => resolve22(), 2e3))
+          new Promise((resolve23) => setTimeout(() => resolve23(), 2e3))
         ]).then(() => {
           if (!w.threadId) return;
           return w.terminate().catch(() => {
@@ -15374,7 +15418,7 @@ function shouldUseParserWorkerPool(candidateFileCount, parseBatchCount) {
   return !isFrugalPerf() && candidateFileCount >= WORKER_POOL_THRESHOLD && parseBatchCount > 1;
 }
 function yieldEventLoop() {
-  return new Promise((resolve22) => setImmediate(resolve22));
+  return new Promise((resolve23) => setImmediate(resolve23));
 }
 function throwIfAborted(signal) {
   if (!signal?.aborted) return;
@@ -15406,7 +15450,7 @@ function normalizeComparablePath(value) {
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 function gitOutput(projectRoot, args) {
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve23, reject) => {
     execFile(
       "git",
       ["-C", projectRoot, ...args],
@@ -15417,7 +15461,7 @@ function gitOutput(projectRoot, args) {
       },
       (error, stdout) => {
         if (error) reject(error);
-        else resolve22(Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout));
+        else resolve23(Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout));
       }
     );
   });
@@ -16193,7 +16237,7 @@ function callIndexOp(op, args, opts) {
       opts.signal.reason instanceof Error ? opts.signal.reason : new Error("Indexing cancelled")
     );
   }
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve23, reject) => {
     const id = nextRpcId++;
     const timer = setTimeout(() => {
       pending.delete(id);
@@ -16215,7 +16259,7 @@ function callIndexOp(op, args, opts) {
     pending.set(id, {
       resolve: (v) => {
         cleanup();
-        resolve22(v);
+        resolve23(v);
       },
       reject: (e) => {
         cleanup();
@@ -17142,9 +17186,90 @@ var codebaseAstReplaceTool = {
   }
 };
 
-// src/codebase-index/codebase-impact-analysis-tool.ts
+// src/codebase-index/codebase-invariant-check-tool.ts
+import * as fs22 from "node:fs/promises";
 import * as path27 from "node:path";
 import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
+init_languages2();
+var codebaseInvariantCheckTool = {
+  name: "codebase-invariant-check",
+  category: "Inspect",
+  icon: "index",
+  permission: "auto",
+  subjectKey: "file",
+  mutating: false,
+  capabilities: ["fs.read"],
+  description: "Mathematically verify AST backward-compatibility invariants between original code and candidate mutations across TypeScript, Python, Go, Rust, Java, etc. Detects missing exports (INV-001), mandatory parameter additions (INV-002), interface breaking expansions (INV-003), and return type changes (INV-004) with zero hallucinations.",
+  usageHint: "PRE-FLIGHT AST INVARIANT AUDIT:\n\n- Provide `file` and `modifiedCode` (or both `originalCode` and `modifiedCode`).\n- Returns `valid: true` if changes are strictly backward compatible.\n- Returns structured `violations[]` with exact rule IDs, offending symbol names, and fix instructions.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      file: {
+        type: "string",
+        description: "Path to existing source file to compare against candidate modifications."
+      },
+      originalCode: {
+        type: "string",
+        description: "Original source code string (if not reading from an existing file)."
+      },
+      modifiedCode: {
+        type: "string",
+        description: "The candidate modified code string to validate."
+      },
+      lang: {
+        type: "string",
+        description: "Language hint (ts, py, go, rs, etc.). Inferred from file path if omitted."
+      }
+    },
+    required: ["modifiedCode"],
+    additionalProperties: false
+  },
+  async execute(input, ctx) {
+    try {
+      let originalCode = input.originalCode;
+      let lang = input.lang;
+      if (!originalCode && input.file) {
+        const resolved = path27.isAbsolute(input.file) ? input.file : path27.resolve(ctx.projectRoot, input.file);
+        originalCode = await fs22.readFile(resolved, "utf8");
+        if (!lang) {
+          lang = detectLang(resolved) ?? "ts";
+        }
+      }
+      if (originalCode === void 0) {
+        return {
+          valid: false,
+          violations: [],
+          summary: "Neither originalCode nor file was provided for invariant comparison.",
+          error: "Missing originalCode or file path."
+        };
+      }
+      const res = await polyglotInvariantEngine.evaluate({
+        originalCode,
+        modifiedCode: input.modifiedCode,
+        lang,
+        filePath: input.file
+      });
+      const summary = res.valid ? "AST Invariants PASSED. Mutation is 100% backward compatible." : `AST Invariants FAILED with ${res.violations.length} violation(s):
+` + res.violations.map((v) => ` - [${v.ruleId}] ${v.symbolName}: ${v.message}`).join("\n");
+      return {
+        valid: res.valid,
+        violations: res.violations,
+        summary
+      };
+    } catch (err) {
+      return {
+        valid: false,
+        violations: [],
+        summary: `Error during invariant evaluation: ${toErrorMessage4(err)}`,
+        error: toErrorMessage4(err)
+      };
+    }
+  }
+};
+
+// src/codebase-index/codebase-impact-analysis-tool.ts
+import * as path28 from "node:path";
+import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
 var TEST_FILE_REGEX = /(?:test|spec|mock|fixture|bench)[s]?[/\\._]/i;
 var codebaseImpactAnalysisTool = {
   name: "codebase-impact-analysis",
@@ -17181,6 +17306,9 @@ var codebaseImpactAnalysisTool = {
       const limit = 200;
       const transitive = input.transitive ?? true;
       let rawSites = [];
+      let symbolFound = true;
+      let indexUnavailable = false;
+      let indexError;
       try {
         const serviced = await incomingCallsService2({
           projectRoot,
@@ -17191,13 +17319,49 @@ var codebaseImpactAnalysisTool = {
           transitive
         });
         rawSites = serviced.calls;
-      } catch {
+        symbolFound = serviced.symbolFound;
+      } catch (err) {
+        symbolFound = false;
+        indexUnavailable = true;
+        indexError = toErrorMessage5(err);
+      }
+      if (indexUnavailable) {
+        const detail = indexError ? ` (${indexError})` : "";
+        const reason = `Index query failed for '${input.symbol}'. Run codebase-index, then retry.${detail}`;
+        return {
+          status: "error",
+          symbol: input.symbol,
+          riskLevel: "low",
+          summary: reason,
+          totalCallSites: 0,
+          affectedProductionFiles: [],
+          affectedTestFiles: [],
+          callSites: [],
+          recommendedActionPlan: [reason],
+          symbolFound: false,
+          error: reason
+        };
+      }
+      if (!symbolFound) {
+        const reason = `Symbol '${input.symbol}' was not found in the index` + (input.file ? ` for file filter '${input.file}'` : "") + ". Use codebase-search to verify the name.";
+        return {
+          status: "ok",
+          symbol: input.symbol,
+          riskLevel: "low",
+          summary: reason,
+          totalCallSites: 0,
+          affectedProductionFiles: [],
+          affectedTestFiles: [],
+          callSites: [],
+          recommendedActionPlan: [reason],
+          symbolFound: false
+        };
       }
       const prodFilesSet = /* @__PURE__ */ new Set();
       const testFilesSet = /* @__PURE__ */ new Set();
       const callSites = [];
       for (const site of rawSites) {
-        const relPath = path27.relative(projectRoot, site.symbol.file).replace(/\\/g, "/");
+        const relPath = path28.relative(projectRoot, site.symbol.file).replace(/\\/g, "/");
         const isTest = TEST_FILE_REGEX.test(relPath);
         if (isTest) {
           testFilesSet.add(relPath);
@@ -17247,7 +17411,8 @@ var codebaseImpactAnalysisTool = {
         affectedProductionFiles: prodFiles,
         affectedTestFiles: testFiles,
         callSites,
-        recommendedActionPlan
+        recommendedActionPlan,
+        symbolFound: true
       };
     } catch (err) {
       return {
@@ -17260,14 +17425,15 @@ var codebaseImpactAnalysisTool = {
         affectedTestFiles: [],
         callSites: [],
         recommendedActionPlan: [],
-        error: toErrorMessage4(err)
+        symbolFound: false,
+        error: toErrorMessage5(err)
       };
     }
   }
 };
 
 // src/codebase-index/codebase-incoming-calls-tool.ts
-import { toErrorMessage as toErrorMessage5 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
 var codebaseIncomingCallsTool = {
   name: "codebase-incoming-calls",
   category: "Project",
@@ -17340,7 +17506,7 @@ var codebaseIncomingCallsTool = {
         symbol: input.symbol,
         calls: [],
         total: 0,
-        indexStatus: `Index query failed: ${toErrorMessage5(err)}. Fall back to grep for this lookup.`
+        indexStatus: `Index query failed: ${toErrorMessage6(err)}. Fall back to grep for this lookup.`
       };
     }
     const { calls, symbolFound, ambiguous, totalMatches } = serviced;
@@ -17395,7 +17561,7 @@ var codebaseIncomingCallsTool = {
 import { ToolValidationError } from "@wrongstack/core/types";
 
 // src/codebase-index/codebase-search-tool.ts
-import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage7 } from "@wrongstack/core/utils";
 var INDEXABLE_LANG_IDS = [
   "ts",
   "tsx",
@@ -17520,7 +17686,7 @@ var codebaseSearchTool = {
         results: [],
         total: 0,
         query: input.query,
-        indexStatus: `Index query failed: ${toErrorMessage6(err)}. Fall back to grep/glob for this lookup.`
+        indexStatus: `Index query failed: ${toErrorMessage7(err)}. Fall back to grep/glob for this lookup.`
       };
     }
     const { results, total } = searched;
@@ -17628,7 +17794,7 @@ var codebaseIndexTool = {
 };
 
 // src/codebase-index/codebase-outgoing-calls-tool.ts
-import { toErrorMessage as toErrorMessage7 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage8 } from "@wrongstack/core/utils";
 var codebaseOutgoingCallsTool = {
   name: "codebase-outgoing-calls",
   category: "Project",
@@ -17701,7 +17867,7 @@ var codebaseOutgoingCallsTool = {
         symbol: input.symbol,
         calls: [],
         total: 0,
-        indexStatus: `Index query failed: ${toErrorMessage7(err)}. Fall back to grep for this lookup.`
+        indexStatus: `Index query failed: ${toErrorMessage8(err)}. Fall back to grep for this lookup.`
       };
     }
     const { calls, symbolFound, unresolvedCount, totalMatches } = serviced;
@@ -17753,18 +17919,18 @@ var codebaseOutgoingCallsTool = {
 };
 
 // src/codebase-index/codebase-repo-map-tool.ts
-import { toErrorMessage as toErrorMessage8 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
 
 // src/codebase-index/repo-map.ts
 init_languages2();
-import * as fs23 from "node:fs/promises";
-import * as path29 from "node:path";
+import * as fs24 from "node:fs/promises";
+import * as path30 from "node:path";
 
 // src/codebase-index/skeleton-extractor.ts
 init_languages2();
 init_tree_sitter_parser();
-import * as fs22 from "node:fs/promises";
-import * as path28 from "node:path";
+import * as fs23 from "node:fs/promises";
+import * as path29 from "node:path";
 var tsModule3 = null;
 async function loadTs3() {
   if (!tsModule3) {
@@ -18092,7 +18258,7 @@ async function extractDirectorySkeleton(opts) {
     if (filePaths.length >= maxFiles) return;
     let entries;
     try {
-      entries = await fs22.readdir(dir, { withFileTypes: true });
+      entries = await fs23.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -18101,7 +18267,7 @@ async function extractDirectorySkeleton(opts) {
       if (entry.name.startsWith(".") || entry.name === "node_modules" || entry.name === "dist" || entry.name === "build") {
         continue;
       }
-      const fullPath = path28.join(dir, entry.name);
+      const fullPath = path29.join(dir, entry.name);
       if (entry.isDirectory()) {
         await scan(fullPath);
       } else if (entry.isFile() && isIndexablePath(fullPath)) {
@@ -18118,7 +18284,7 @@ async function extractDirectorySkeleton(opts) {
   const combinedParts = [];
   for (const fp of filePaths) {
     try {
-      const content = await fs22.readFile(fp, "utf8");
+      const content = await fs23.readFile(fp, "utf8");
       const res = await extractFileSkeleton({
         file: fp,
         content,
@@ -18129,7 +18295,7 @@ async function extractDirectorySkeleton(opts) {
       totalSkelChars += res.skeleton.length;
       totalOrigLines += res.stats.originalLines;
       totalSkelLines += res.stats.skeletonLines;
-      const rel = path28.relative(opts.dirPath, fp).replace(/\\/g, "/");
+      const rel = path29.relative(opts.dirPath, fp).replace(/\\/g, "/");
       combinedParts.push(
         `// \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 ${rel} (${res.lang}) \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
 ${res.skeleton}`
@@ -18166,13 +18332,13 @@ async function generateRepoMap(opts) {
   const projectRoot = opts.projectRoot;
   const maxTokens = opts.maxTokens ?? 1200;
   const charBudget = maxTokens * 4;
-  const focusSet = new Set((opts.focusFiles ?? []).map((f) => path29.resolve(projectRoot, f)));
+  const focusSet = new Set((opts.focusFiles ?? []).map((f) => path30.resolve(projectRoot, f)));
   const allFiles = [];
   async function scan(dir) {
     if (allFiles.length > 500) return;
     let entries;
     try {
-      entries = await fs23.readdir(dir, { withFileTypes: true });
+      entries = await fs24.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -18180,7 +18346,7 @@ async function generateRepoMap(opts) {
       if (entry.name.startsWith(".") || entry.name === "node_modules" || entry.name === "dist" || entry.name === "build" || entry.name === "coverage") {
         continue;
       }
-      const fullPath = path29.join(dir, entry.name);
+      const fullPath = path30.join(dir, entry.name);
       if (entry.isDirectory()) {
         await scan(fullPath);
       } else if (entry.isFile() && isIndexablePath(fullPath)) {
@@ -18200,7 +18366,7 @@ async function generateRepoMap(opts) {
   }
   const scoredFiles = [];
   for (const file of allFiles) {
-    const relPath = path29.relative(projectRoot, file).replace(/\\/g, "/");
+    const relPath = path30.relative(projectRoot, file).replace(/\\/g, "/");
     let score = 10;
     if (focusSet.has(file)) {
       score += 100;
@@ -18215,7 +18381,7 @@ async function generateRepoMap(opts) {
   for (const candidate of scoredFiles) {
     if (currentChars >= charBudget) break;
     try {
-      const content = await fs23.readFile(candidate.file, "utf8");
+      const content = await fs24.readFile(candidate.file, "utf8");
       if (content.length === 0) continue;
       const skeletonResult = await extractFileSkeleton({
         file: candidate.file,
@@ -18298,16 +18464,16 @@ var codebaseRepoMapTool = {
         totalFilesScanned: 0,
         estimatedTokens: 0,
         rankedFiles: [],
-        error: toErrorMessage8(err)
+        error: toErrorMessage9(err)
       };
     }
   }
 };
 
 // src/codebase-index/codebase-skeleton-tool.ts
-import * as fs24 from "node:fs/promises";
-import * as path30 from "node:path";
-import { toErrorMessage as toErrorMessage9 } from "@wrongstack/core/utils";
+import * as fs25 from "node:fs/promises";
+import * as path31 from "node:path";
+import { toErrorMessage as toErrorMessage10 } from "@wrongstack/core/utils";
 var codebaseSkeletonTool = {
   name: "codebase-skeleton",
   category: "Project",
@@ -18346,13 +18512,13 @@ var codebaseSkeletonTool = {
     additionalProperties: false
   },
   async execute(input, ctx) {
-    const targetPath = path30.isAbsolute(input.path) ? input.path : path30.resolve(ctx.projectRoot ?? process.cwd(), input.path);
+    const targetPath = path31.isAbsolute(input.path) ? input.path : path31.resolve(ctx.projectRoot ?? process.cwd(), input.path);
     let stat21;
     try {
-      stat21 = await fs24.stat(targetPath);
+      stat21 = await fs25.stat(targetPath);
     } catch (err) {
       throw new Error(
-        `codebase-skeleton: file or directory not found at "${input.path}": ${toErrorMessage9(err)}`
+        `codebase-skeleton: file or directory not found at "${input.path}": ${toErrorMessage10(err)}`
       );
     }
     const options = {
@@ -18385,7 +18551,7 @@ var codebaseSkeletonTool = {
         files: dirResult.files
       };
     }
-    const content = await fs24.readFile(targetPath, "utf8");
+    const content = await fs25.readFile(targetPath, "utf8");
     const fileResult = await extractFileSkeleton({
       file: targetPath,
       content,
@@ -18489,28 +18655,28 @@ var codebaseStatsTool = {
 // src/codebase-index/codebase-targeted-test-tool.ts
 init_spawn_stream();
 init_util();
-import * as fs25 from "node:fs/promises";
-import * as path31 from "node:path";
-import { toErrorMessage as toErrorMessage10 } from "@wrongstack/core/utils";
+import * as fs26 from "node:fs/promises";
+import * as path32 from "node:path";
+import { toErrorMessage as toErrorMessage11 } from "@wrongstack/core/utils";
 var TEST_FILE_REGEX2 = /(?:test|spec|mock|fixture|bench)[s]?[/\\._]/i;
 async function findConventionTestFiles(projectRoot, sourceRelPath) {
-  const parsed = path31.parse(sourceRelPath);
+  const parsed = path32.parse(sourceRelPath);
   const candidates = [
-    path31.join(parsed.dir, `${parsed.name}.test${parsed.ext}`),
-    path31.join(parsed.dir, `${parsed.name}.spec${parsed.ext}`),
-    path31.join(parsed.dir, `${parsed.name}_test${parsed.ext}`),
-    path31.join(parsed.dir, `test_${parsed.name}${parsed.ext}`),
-    path31.join("tests", `${parsed.name}.test${parsed.ext}`),
-    path31.join("tests", `${parsed.name}.spec${parsed.ext}`),
-    path31.join("test", `${parsed.name}.test${parsed.ext}`),
-    path31.join(parsed.dir, "__tests__", `${parsed.name}.test${parsed.ext}`),
-    path31.join(parsed.dir, "__tests__", `${parsed.name}${parsed.ext}`)
+    path32.join(parsed.dir, `${parsed.name}.test${parsed.ext}`),
+    path32.join(parsed.dir, `${parsed.name}.spec${parsed.ext}`),
+    path32.join(parsed.dir, `${parsed.name}_test${parsed.ext}`),
+    path32.join(parsed.dir, `test_${parsed.name}${parsed.ext}`),
+    path32.join("tests", `${parsed.name}.test${parsed.ext}`),
+    path32.join("tests", `${parsed.name}.spec${parsed.ext}`),
+    path32.join("test", `${parsed.name}.test${parsed.ext}`),
+    path32.join(parsed.dir, "__tests__", `${parsed.name}.test${parsed.ext}`),
+    path32.join(parsed.dir, "__tests__", `${parsed.name}${parsed.ext}`)
   ];
   const found = [];
   for (const cand of candidates) {
-    const absPath = path31.resolve(projectRoot, cand);
+    const absPath = path32.resolve(projectRoot, cand);
     try {
-      const st = await fs25.stat(absPath);
+      const st = await fs26.stat(absPath);
       if (st.isFile()) {
         found.push(cand.replace(/\\/g, "/"));
       }
@@ -18567,7 +18733,7 @@ var codebaseTargetedTestTool = {
             transitive: true
           });
           for (const site of serviced.calls) {
-            const relPath = path31.relative(projectRoot, site.symbol.file).replace(/\\/g, "/");
+            const relPath = path32.relative(projectRoot, site.symbol.file).replace(/\\/g, "/");
             if (TEST_FILE_REGEX2.test(relPath)) {
               suitesSet.add(relPath);
             }
@@ -18644,7 +18810,7 @@ ${streamRes.stderr}`.trim(),
         failed: 0,
         durationMs: 0,
         output: "",
-        error: toErrorMessage10(err)
+        error: toErrorMessage11(err)
       };
     }
   }
@@ -18652,8 +18818,8 @@ ${streamRes.stderr}`.trim(),
 
 // src/codebase-index/dead-code-scan.ts
 init_languages2();
-import * as fs26 from "node:fs";
-import * as path32 from "node:path";
+import * as fs27 from "node:fs";
+import * as path33 from "node:path";
 var deadCodeScanTool = {
   name: "dead-code-scan",
   category: "Project",
@@ -18698,25 +18864,25 @@ var deadCodeScanTool = {
 };
 function tryReadJson(filePath) {
   try {
-    const raw = fs26.readFileSync(filePath, "utf8");
+    const raw = fs27.readFileSync(filePath, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
   }
 }
 function resolveAgainst(base, relative19) {
-  if (path32.isAbsolute(relative19)) return relative19;
-  return path32.resolve(base, relative19);
+  if (path33.isAbsolute(relative19)) return relative19;
+  return path33.resolve(base, relative19);
 }
 function discoverEntryPoints(projectRoot, userEntryPoints) {
   const entries = /* @__PURE__ */ new Set();
   if (userEntryPoints) {
     for (const ep of userEntryPoints) {
       const resolved = resolveAgainst(projectRoot, ep);
-      if (fs26.existsSync(resolved)) entries.add(resolved);
+      if (fs27.existsSync(resolved)) entries.add(resolved);
     }
   }
-  const rootPkg = tryReadJson(path32.join(projectRoot, "package.json"));
+  const rootPkg = tryReadJson(path33.join(projectRoot, "package.json"));
   if (rootPkg) {
     addPkgJsonEntryPoints(projectRoot, rootPkg, entries);
   }
@@ -18730,45 +18896,45 @@ function discoverEntryPoints(projectRoot, userEntryPoints) {
     workspaces = [];
   }
   for (const wsDir of workspaces) {
-    const pkgJsonPath = path32.join(wsDir, "package.json");
+    const pkgJsonPath = path33.join(wsDir, "package.json");
     const pkg = tryReadJson(pkgJsonPath);
     if (pkg) {
       addPkgJsonEntryPoints(wsDir, pkg, entries);
-      const convention1 = path32.join(wsDir, "src", "index.ts");
-      if (fs26.existsSync(convention1)) entries.add(convention1);
-      const convention2 = path32.join(wsDir, "src", "main.ts");
-      if (fs26.existsSync(convention2)) entries.add(convention2);
-      const convention3 = path32.join(wsDir, "index.ts");
-      if (fs26.existsSync(convention3)) entries.add(convention3);
+      const convention1 = path33.join(wsDir, "src", "index.ts");
+      if (fs27.existsSync(convention1)) entries.add(convention1);
+      const convention2 = path33.join(wsDir, "src", "main.ts");
+      if (fs27.existsSync(convention2)) entries.add(convention2);
+      const convention3 = path33.join(wsDir, "index.ts");
+      if (fs27.existsSync(convention3)) entries.add(convention3);
     }
   }
   if (!rootPkg || !workspaces.length) {
     for (const name of ["src/index.ts", "src/main.ts", "index.ts"]) {
-      const convention = path32.join(projectRoot, name);
-      if (fs26.existsSync(convention)) entries.add(convention);
+      const convention = path33.join(projectRoot, name);
+      if (fs27.existsSync(convention)) entries.add(convention);
     }
   }
   return [...entries];
 }
 var BUILD_OUTPUT_DIRS = ["dist", "out", "build", "release"];
-var BUILD_OUTPUT_DIR_NAMES = BUILD_OUTPUT_DIRS.map((d) => `${path32.sep}${d}${path32.sep}`);
+var BUILD_OUTPUT_DIR_NAMES = BUILD_OUTPUT_DIRS.map((d) => `${path33.sep}${d}${path33.sep}`);
 function trySourceEquivalent(resolved) {
-  resolved = resolved.replace(/[/\\]/g, path32.sep);
+  resolved = resolved.replace(/[/\\]/g, path33.sep);
   for (const marker of BUILD_OUTPUT_DIR_NAMES) {
     const idx = resolved.indexOf(marker);
     if (idx === -1) continue;
-    const base = resolved.replace(marker, `${path32.sep}src${path32.sep}`);
+    const base = resolved.replace(marker, `${path33.sep}src${path33.sep}`);
     const candidate = base.replace(/\.(js|mjs|cjs)$/, ".ts");
-    if (candidate !== base && fs26.existsSync(candidate)) {
+    if (candidate !== base && fs27.existsSync(candidate)) {
       return candidate;
     }
     const dtsStripped = base.replace(/\.d\.ts$/, "");
     const candidateDts = dtsStripped + ".ts";
-    if (candidateDts !== base && candidateDts !== candidate && fs26.existsSync(candidateDts)) {
+    if (candidateDts !== base && candidateDts !== candidate && fs27.existsSync(candidateDts)) {
       return candidateDts;
     }
     const candidateNoExt = base + ".ts";
-    if (candidate !== candidateNoExt && candidateNoExt !== candidateDts && fs26.existsSync(candidateNoExt)) {
+    if (candidate !== candidateNoExt && candidateNoExt !== candidateDts && fs27.existsSync(candidateNoExt)) {
       return candidateNoExt;
     }
   }
@@ -18776,9 +18942,9 @@ function trySourceEquivalent(resolved) {
 }
 function tryAddEntryPath(pkgDir, rawPath, entries) {
   const resolved = resolveAgainst(pkgDir, rawPath);
-  if (fs26.existsSync(resolved)) entries.add(resolved);
+  if (fs27.existsSync(resolved)) entries.add(resolved);
   const tsResolved = resolved.replace(/\.(js|mjs|cjs)$/, ".ts");
-  if (tsResolved !== resolved && fs26.existsSync(tsResolved)) {
+  if (tsResolved !== resolved && fs27.existsSync(tsResolved)) {
     entries.add(tsResolved);
   }
   const srcAlt = trySourceEquivalent(resolved);
@@ -18822,18 +18988,18 @@ function expandGlobPattern(entry, projectRoot) {
   const dirs = [];
   if (entry.includes("*")) {
     const base = entry.replace(/\/\*+$/, "");
-    const baseDir = path32.resolve(projectRoot, base);
+    const baseDir = path33.resolve(projectRoot, base);
     try {
-      const children = fs26.readdirSync(baseDir, { withFileTypes: true });
+      const children = fs27.readdirSync(baseDir, { withFileTypes: true });
       for (const child of children) {
         if (child.isDirectory()) {
-          dirs.push(path32.join(baseDir, child.name));
+          dirs.push(path33.join(baseDir, child.name));
         }
       }
     } catch {
     }
   } else {
-    dirs.push(path32.resolve(projectRoot, entry));
+    dirs.push(path33.resolve(projectRoot, entry));
   }
   return dirs;
 }
@@ -18850,10 +19016,10 @@ function extractWorkspaceGlobs(pkg, projectRoot) {
   return dirs;
 }
 function extractPnpmWorkspaceDirs(projectRoot) {
-  const yamlPath = path32.join(projectRoot, "pnpm-workspace.yaml");
-  if (!fs26.existsSync(yamlPath)) return [];
+  const yamlPath = path33.join(projectRoot, "pnpm-workspace.yaml");
+  if (!fs27.existsSync(yamlPath)) return [];
   try {
-    const content = fs26.readFileSync(yamlPath, "utf8");
+    const content = fs27.readFileSync(yamlPath, "utf8");
     const dirs = [];
     let inPackages = false;
     const lines = content.split("\n");
@@ -18887,8 +19053,8 @@ function extractPnpmWorkspaceDirs(projectRoot) {
 }
 function resolveModulePath(importerPath, moduleSpecifier, indexedFiles) {
   if (!moduleSpecifier.startsWith(".")) return [];
-  const dir = path32.dirname(importerPath);
-  const base = path32.resolve(dir, moduleSpecifier);
+  const dir = path33.dirname(importerPath);
+  const base = path33.resolve(dir, moduleSpecifier);
   const results = [];
   const stripped = base.replace(/\.(ts|tsx|js|jsx|mjs|cjs)$/, "");
   const skipBase = stripped !== base && /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(base);
@@ -18900,18 +19066,18 @@ function resolveModulePath(importerPath, moduleSpecifier, indexedFiles) {
     if (indexedFiles.has(candidate + ".jsx")) results.push(candidate + ".jsx");
     if (indexedFiles.has(candidate + ".mjs")) results.push(candidate + ".mjs");
     if (indexedFiles.has(candidate + ".cjs")) results.push(candidate + ".cjs");
-    if (indexedFiles.has(path32.join(candidate, "index.ts")))
-      results.push(path32.join(candidate, "index.ts"));
-    if (indexedFiles.has(path32.join(candidate, "index.tsx")))
-      results.push(path32.join(candidate, "index.tsx"));
-    if (indexedFiles.has(path32.join(candidate, "index.js")))
-      results.push(path32.join(candidate, "index.js"));
-    if (indexedFiles.has(path32.join(candidate, "index.jsx")))
-      results.push(path32.join(candidate, "index.jsx"));
-    if (indexedFiles.has(path32.join(candidate, "index.mjs")))
-      results.push(path32.join(candidate, "index.mjs"));
-    if (indexedFiles.has(path32.join(candidate, "index.cjs")))
-      results.push(path32.join(candidate, "index.cjs"));
+    if (indexedFiles.has(path33.join(candidate, "index.ts")))
+      results.push(path33.join(candidate, "index.ts"));
+    if (indexedFiles.has(path33.join(candidate, "index.tsx")))
+      results.push(path33.join(candidate, "index.tsx"));
+    if (indexedFiles.has(path33.join(candidate, "index.js")))
+      results.push(path33.join(candidate, "index.js"));
+    if (indexedFiles.has(path33.join(candidate, "index.jsx")))
+      results.push(path33.join(candidate, "index.jsx"));
+    if (indexedFiles.has(path33.join(candidate, "index.mjs")))
+      results.push(path33.join(candidate, "index.mjs"));
+    if (indexedFiles.has(path33.join(candidate, "index.cjs")))
+      results.push(path33.join(candidate, "index.cjs"));
   }
   return [...new Set(results)];
 }
@@ -18943,7 +19109,7 @@ function runDeadCodeScan(projectRoot, opts = {}) {
       symbolById.set(s.id, s);
     }
     const discoveredFiles = discoverEntryPoints(projectRoot, opts.userEntryPoints);
-    const entryFileSet = new Set(discoveredFiles.map((f) => path32.resolve(f)));
+    const entryFileSet = new Set(discoveredFiles.map((f) => path33.resolve(f)));
     const indexedFiles = /* @__PURE__ */ new Set();
     for (const s of allSymbols) indexedFiles.add(s.file);
     for (const fm of store.getAllFileMetas()) indexedFiles.add(fm.file);
@@ -18969,7 +19135,7 @@ function runDeadCodeScan(projectRoot, opts = {}) {
       if (scannedBarrels.has(epFile)) continue;
       scannedBarrels.add(epFile);
       try {
-        const content = fs26.readFileSync(epFile, "utf8");
+        const content = fs27.readFileSync(epFile, "utf8");
         const strippedContent = content.replace(/\/\*[\s\S]*?\*\//g, (m) => " ".repeat(m.length)).replace(/\/\/[^\n]*/g, (m) => " ".repeat(m.length));
         const reExportRe = /export\s+(?:(?:type\s+)?\{[\s\S]*?\}\s+from|\*\s+as\s+\w+\s+from|\*\s+from)\s+['"]([^'"]+)['"]/g;
         for (; ; ) {
@@ -19059,7 +19225,7 @@ function runDeadCodeScan(projectRoot, opts = {}) {
     const deadPackages = [];
     const pkgEntries = findPackageEntries(projectRoot);
     for (const [pkgName, pkgDir] of pkgEntries) {
-      const pkgFiles = allSymbols.filter((s) => s.file.startsWith(pkgDir + path32.sep));
+      const pkgFiles = allSymbols.filter((s) => s.file.startsWith(pkgDir + path33.sep));
       if (pkgFiles.length === 0) continue;
       const pkgUsed = pkgFiles.filter((s) => alive.has(s.id));
       if (pkgUsed.length === 0) {
@@ -19095,7 +19261,7 @@ function runDeadCodeScan(projectRoot, opts = {}) {
 }
 function findPackageEntries(projectRoot) {
   const pkgMap = /* @__PURE__ */ new Map();
-  const rootPkg = tryReadJson(path32.join(projectRoot, "package.json"));
+  const rootPkg = tryReadJson(path33.join(projectRoot, "package.json"));
   if (rootPkg && typeof rootPkg.name === "string") {
     pkgMap.set(rootPkg.name, projectRoot);
   }
@@ -19105,7 +19271,7 @@ function findPackageEntries(projectRoot) {
       wsDirs = extractPnpmWorkspaceDirs(projectRoot);
     }
     for (const wsDir of wsDirs) {
-      const wsPkg = tryReadJson(path32.join(wsDir, "package.json"));
+      const wsPkg = tryReadJson(path33.join(wsDir, "package.json"));
       if (wsPkg && typeof wsPkg.name === "string") {
         pkgMap.set(wsPkg.name, wsDir);
       }
@@ -19115,7 +19281,7 @@ function findPackageEntries(projectRoot) {
 }
 
 // src/clarify.ts
-import { toErrorMessage as toErrorMessage11 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage12 } from "@wrongstack/core/utils";
 var clarifyTool = {
   name: "clarify",
   category: "Meta",
@@ -19188,15 +19354,15 @@ var clarifyTool = {
         question: input.question ?? "",
         selectedOptions: [],
         decisionSummary: "",
-        error: toErrorMessage11(err)
+        error: toErrorMessage12(err)
       };
     }
   }
 };
 
 // src/design.ts
-import * as fs27 from "node:fs/promises";
-import * as path33 from "node:path";
+import * as fs28 from "node:fs/promises";
+import * as path34 from "node:path";
 import {
   applyTokenOverrides,
   getDesignKitLoader,
@@ -19211,17 +19377,17 @@ import {
   setDesignOverrides
 } from "@wrongstack/core/design";
 async function resolveReal(p) {
-  const resolved = path33.resolve(p);
+  const resolved = path34.resolve(p);
   let probe = resolved;
   const missing = [];
   for (; ; ) {
     try {
-      return path33.resolve(await fs27.realpath(probe), ...missing);
+      return path34.resolve(await fs28.realpath(probe), ...missing);
     } catch (err) {
       if (err.code === "ENOENT") {
-        const parent = path33.dirname(probe);
+        const parent = path34.dirname(probe);
         if (parent === probe) return resolved;
-        missing.unshift(path33.basename(probe));
+        missing.unshift(path34.basename(probe));
         probe = parent;
         continue;
       }
@@ -19422,16 +19588,16 @@ Run \`design {action:"materialize"}\` to write the tuned tokens to your theme fi
         outPath: input.out
       });
       const root = await resolveReal(ctx.projectRoot);
-      const absResolved = path33.isAbsolute(result.path) ? path33.resolve(result.path) : path33.resolve(path33.join(ctx.projectRoot, result.path));
-      const absParent = await resolveReal(path33.dirname(absResolved));
-      const abs = path33.join(absParent, path33.basename(absResolved));
-      const rel = path33.relative(root, abs);
-      if (rel.startsWith("..") || path33.isAbsolute(rel)) {
+      const absResolved = path34.isAbsolute(result.path) ? path34.resolve(result.path) : path34.resolve(path34.join(ctx.projectRoot, result.path));
+      const absParent = await resolveReal(path34.dirname(absResolved));
+      const abs = path34.join(absParent, path34.basename(absResolved));
+      const rel = path34.relative(root, abs);
+      if (rel.startsWith("..") || path34.isAbsolute(rel)) {
         throw new Error(`design: materialize path "${result.path}" would escape the project root`);
       }
       let exists = false;
       try {
-        await fs27.access(abs);
+        await fs28.access(abs);
         exists = true;
       } catch {
       }
@@ -19448,8 +19614,8 @@ ${result.content}
 \`\`\``
         };
       }
-      await fs27.mkdir(path33.dirname(abs), { recursive: true });
-      await fs27.writeFile(abs, result.content);
+      await fs28.mkdir(path34.dirname(abs), { recursive: true });
+      await fs28.writeFile(abs, result.content);
       return {
         action,
         kit: active.kit,
@@ -19499,8 +19665,8 @@ Replace off-palette colors with kit tokens (or the materialized CSS vars / token
 init_util();
 import { spawn as spawn7 } from "node:child_process";
 import { statSync as statSync3 } from "node:fs";
-import * as fs28 from "node:fs/promises";
-import * as path34 from "node:path";
+import * as fs29 from "node:fs/promises";
+import * as path35 from "node:path";
 import { buildChildEnv as buildChildEnv3 } from "@wrongstack/core/utils";
 import { ToolValidationError as ToolValidationError2 } from "@wrongstack/core/types";
 var MAX_FILE_DUMP_BYTES = 5 * 1024 * 1024;
@@ -19615,18 +19781,18 @@ function findGitDir(cwd) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat21 = statSync3(path34.join(dir, ".git"));
+      const stat21 = statSync3(path35.join(dir, ".git"));
       if (stat21.isDirectory()) return dir;
     } catch {
     }
-    const parent = path34.dirname(dir);
+    const parent = path35.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return null;
 }
 function runGit(args, cwd, signal) {
-  return new Promise((resolve22) => {
+  return new Promise((resolve23) => {
     let stdout = "";
     let stderr = "";
     const child = spawn7("git", args, {
@@ -19642,8 +19808,8 @@ function runGit(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve22({ stdout, stderr, exitCode: code ?? 0 }));
-    child.on("error", (e) => resolve22({ stdout: "", stderr: e.message, exitCode: 1 }));
+    child.on("close", (code) => resolve23({ stdout, stderr, exitCode: code ?? 0 }));
+    child.on("error", (e) => resolve23({ stdout: "", stderr: e.message, exitCode: 1 }));
   });
 }
 async function fileDiff(input, ctx, _signal) {
@@ -19661,7 +19827,7 @@ async function fileDiff(input, ctx, _signal) {
   let truncated = false;
   for (const file of files) {
     const absPath = await safeResolveReal(file, ctx);
-    const stat21 = await fs28.stat(absPath).catch(() => null);
+    const stat21 = await fs29.stat(absPath).catch(() => null);
     if (!stat21?.isFile()) continue;
     if (stat21.size > MAX_FILE_DUMP_BYTES) {
       truncated = true;
@@ -19670,7 +19836,7 @@ async function fileDiff(input, ctx, _signal) {
       );
       continue;
     }
-    const content = await fs28.readFile(absPath, "utf8");
+    const content = await fs29.readFile(absPath, "utf8");
     const lines = content.split(/\r?\n/);
     results.push(formatWithLineNumbers(file, lines));
   }
@@ -19693,8 +19859,8 @@ ${numbered}`;
 
 // src/document.ts
 init_util();
-import * as fs29 from "node:fs/promises";
-import * as path35 from "node:path";
+import * as fs30 from "node:fs/promises";
+import * as path36 from "node:path";
 var documentTool = {
   name: "document",
   category: "Project",
@@ -19742,7 +19908,7 @@ var documentTool = {
     ) : input.path ? [await safeResolveReal(input.path, ctx)] : [];
     for (const absPath of fileList) {
       try {
-        const content = await fs29.readFile(absPath, "utf8");
+        const content = await fs30.readFile(absPath, "utf8");
         filesProcessed++;
         const processed = processFile(
           content,
@@ -19780,12 +19946,12 @@ async function resolveFiles(filesInput, cwd, ctx) {
     if (!entry) continue;
     let absPath;
     try {
-      absPath = ensureInsideRoot(path35.resolve(cwd, entry), ctx);
+      absPath = ensureInsideRoot(path36.resolve(cwd, entry), ctx);
     } catch {
       continue;
     }
     try {
-      const stat21 = await fs29.stat(absPath);
+      const stat21 = await fs30.stat(absPath);
       if (stat21.isFile()) resolved.push(absPath);
     } catch {
     }
@@ -19856,7 +20022,7 @@ function processFile(content, absPath, _style, _overwrite, target) {
 // src/e2e.ts
 init_util();
 import { open, readdir as readdir9 } from "node:fs/promises";
-import * as path36 from "node:path";
+import * as path37 from "node:path";
 async function readBoundedText(filePath, maxBytes) {
   let handle;
   try {
@@ -19906,8 +20072,8 @@ var MAX_PACKAGE_BYTES = 512 * 1024;
 var MAX_CONFIG_BYTES = 512 * 1024;
 var MAX_SPEC_SAMPLES = 20;
 function relativePath(root, target) {
-  const value = path36.relative(root, target) || ".";
-  return value.split(path36.sep).join("/");
+  const value = path37.relative(root, target) || ".";
+  return value.split(path37.sep).join("/");
 }
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -19979,7 +20145,7 @@ async function scanWorkspace(root, maxDepth, signal) {
     }
     for (const entry of entries) {
       signal.throwIfAborted();
-      const absolutePath = path36.join(current.directory, entry.name);
+      const absolutePath = path37.join(current.directory, entry.name);
       if (entry.isFile()) {
         if (entry.name === "package.json") result.packageFiles.push(absolutePath);
         const framework = CONFIG_NAMES.get(entry.name);
@@ -20040,9 +20206,9 @@ async function detectPackageManager3(projectRoot, scanRoot, declared) {
     if (names.has("bun.lock") || names.has("bun.lockb")) return "bun";
     if (names.has("package-lock.json") || names.has("npm-shrinkwrap.json")) return "npm";
     if (directory === scanRoot) break;
-    const parent = path36.dirname(directory);
-    const relativeParent = path36.relative(scanRoot, parent);
-    if (parent === directory || relativeParent.startsWith("..") || path36.isAbsolute(relativeParent)) {
+    const parent = path37.dirname(directory);
+    const relativeParent = path37.relative(scanRoot, parent);
+    if (parent === directory || relativeParent.startsWith("..") || path37.isAbsolute(relativeParent)) {
       break;
     }
     directory = parent;
@@ -20087,7 +20253,7 @@ function isSpec(framework, filename) {
   return /\.(?:spec|test)\.(?:[cm]?[jt]sx?)$/i.test(filename);
 }
 async function collectSpecs(root, framework, testDirectory, signal) {
-  const roots = testDirectory ? [path36.resolve(root, testDirectory)] : framework === "cypress" ? [path36.join(root, "cypress", "e2e"), path36.join(root, "cypress", "integration")] : [path36.join(root, "tests")];
+  const roots = testDirectory ? [path37.resolve(root, testDirectory)] : framework === "cypress" ? [path37.join(root, "cypress", "e2e"), path37.join(root, "cypress", "integration")] : [path37.join(root, "tests")];
   const samples = [];
   let count = 0;
   let scanned = 0;
@@ -20106,7 +20272,7 @@ async function collectSpecs(root, framework, testDirectory, signal) {
     }
     for (const entry of entries) {
       signal.throwIfAborted();
-      const target = path36.join(directory, entry.name);
+      const target = path37.join(directory, entry.name);
       if (entry.isDirectory() && !SKIP_DIRECTORIES.has(entry.name)) queue.push(target);
       else if (entry.isFile() && isSpec(framework, entry.name)) {
         count += 1;
@@ -20126,7 +20292,7 @@ function nearestPackage(projectRoot, packagesByDirectory, scanRoot) {
     const found = packagesByDirectory.get(directory);
     if (found) return found;
     if (directory === scanRoot) return void 0;
-    const parent = path36.dirname(directory);
+    const parent = path37.dirname(directory);
     if (parent === directory || relativePath(scanRoot, parent).startsWith("..")) return void 0;
     directory = parent;
   }
@@ -20137,13 +20303,13 @@ async function discoverE2EProjects(root, options) {
   const packages = (await Promise.all(scan.packageFiles.map(readPackageInfo))).filter(
     (info) => Boolean(info)
   );
-  const packagesByDirectory = new Map(packages.map((info) => [path36.dirname(info.path), info]));
+  const packagesByDirectory = new Map(packages.map((info) => [path37.dirname(info.path), info]));
   const candidates = /* @__PURE__ */ new Map();
   for (const config of scan.configs) {
     if (options.framework && options.framework !== "all" && config.framework !== options.framework) {
       continue;
     }
-    const projectRoot = path36.dirname(config.absolutePath);
+    const projectRoot = path37.dirname(config.absolutePath);
     candidates.set(`${config.framework}:${projectRoot}`, {
       framework: config.framework,
       root: projectRoot,
@@ -20151,7 +20317,7 @@ async function discoverE2EProjects(root, options) {
     });
   }
   for (const info of packages) {
-    const projectRoot = path36.dirname(info.path);
+    const projectRoot = path37.dirname(info.path);
     for (const framework of frameworkFromPackage(info)) {
       if (options.framework && options.framework !== "all" && framework !== options.framework)
         continue;
@@ -20167,10 +20333,10 @@ async function discoverE2EProjects(root, options) {
     const scripts = matchingScripts(info, candidate.framework);
     const manager = await detectPackageManager3(candidate.root, root, info?.packageManager);
     const testDirectory = candidate.framework === "playwright" ? staticString(source, "testDir") : void 0;
-    const resolvedTestDirectory = testDirectory ? path36.resolve(candidate.root, testDirectory) : void 0;
-    const relativeTestDirectory = resolvedTestDirectory ? path36.relative(root, resolvedTestDirectory) : void 0;
+    const resolvedTestDirectory = testDirectory ? path37.resolve(candidate.root, testDirectory) : void 0;
+    const relativeTestDirectory = resolvedTestDirectory ? path37.relative(root, resolvedTestDirectory) : void 0;
     const unsafeTestDirectory = Boolean(
-      relativeTestDirectory && (relativeTestDirectory.startsWith("..") || path36.isAbsolute(relativeTestDirectory))
+      relativeTestDirectory && (relativeTestDirectory.startsWith("..") || path37.isAbsolute(relativeTestDirectory))
     );
     const specs = options.includeSpecs === false || unsafeTestDirectory ? { count: 0, samples: [], truncated: false } : await collectSpecs(candidate.root, candidate.framework, testDirectory, options.signal);
     const warnings = [];
@@ -20270,7 +20436,7 @@ var e2ePlanTool = {
 };
 
 // src/edit.ts
-import * as fs30 from "node:fs/promises";
+import * as fs31 from "node:fs/promises";
 import {
   atomicWrite as atomicWrite3,
   detectNewlineStyle,
@@ -20494,7 +20660,7 @@ function prefixSimilarity(a, b) {
 }
 
 // src/_syntax-check.ts
-import * as path37 from "node:path";
+import * as path38 from "node:path";
 var TS_LIKE = /* @__PURE__ */ new Set([".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"]);
 var MAX_CHECK_CHARS = 15e5;
 var MAX_ERRORS = 5;
@@ -20518,15 +20684,15 @@ async function checkSyntax(filePath, content, previousContent) {
   return { errors, preExisting };
 }
 function isJsoncFile(filePath) {
-  const base = path37.basename(filePath).toLowerCase();
+  const base = path38.basename(filePath).toLowerCase();
   if (base.endsWith(".jsonc")) return true;
   if (/^(tsconfig|jsconfig)([.-].*)?\.json$/.test(base)) return true;
-  const dir = path37.basename(path37.dirname(filePath)).toLowerCase();
+  const dir = path38.basename(path38.dirname(filePath)).toLowerCase();
   return dir === ".vscode";
 }
 async function parseErrors(filePath, content) {
   if (content.length > MAX_CHECK_CHARS) return void 0;
-  const ext = path37.extname(filePath).toLowerCase();
+  const ext = path38.extname(filePath).toLowerCase();
   if (ext === ".json" || ext === ".jsonc") {
     try {
       JSON.parse(content);
@@ -20553,7 +20719,7 @@ async function parseErrors(filePath, content) {
     ts2.ScriptKind.JSX
   );
   const sourceFile = ts2.createSourceFile(
-    path37.basename(filePath),
+    path38.basename(filePath),
     content,
     ts2.ScriptTarget.Latest,
     /* setParentNodes */
@@ -20644,7 +20810,7 @@ var editTool = {
       });
     }
     const absPath = await safeResolveReal(input.path, ctx);
-    const stat21 = await fs30.stat(absPath).catch((err) => {
+    const stat21 = await fs31.stat(absPath).catch((err) => {
       if (err.code === "ENOENT") {
         throw new ToolValidationError3({
           message: `edit: file "${input.path}" does not exist. Use \`write\` instead.`,
@@ -20661,8 +20827,8 @@ var editTool = {
       });
     }
     const autoRead = !ctx.hasRead(absPath);
-    const original = await fs30.readFile(absPath, "utf8");
-    const updated = await fs30.stat(absPath);
+    const original = await fs31.readFile(absPath, "utf8");
+    const updated = await fs31.stat(absPath);
     const mtimeTolerance = process.platform === "win32" ? 2e3 : 1;
     const originalHash = sha256hex(original);
     const lastReadHash = ctx.lastReadHash?.(absPath);
@@ -20770,7 +20936,7 @@ var editTool = {
       enqueueReindex({ projectRoot: ctx.projectRoot, files: [absPath] });
     } catch {
     }
-    const written = await fs30.stat(absPath);
+    const written = await fs31.stat(absPath);
     ctx.recordRead(absPath, written.mtimeMs, "write", sha256hex(newFile));
     ctx.session.recordFileChange({
       path: absPath,
@@ -20820,7 +20986,7 @@ import {
   emitProcessOutput as emitProcessOutput3,
   emitProcessStarted as emitProcessStarted3
 } from "@wrongstack/core/observability";
-import { toErrorMessage as toErrorMessage12 } from "@wrongstack/core/utils/error";
+import { toErrorMessage as toErrorMessage13 } from "@wrongstack/core/utils/error";
 
 // src/_danger-detect.ts
 var argHas = (args, value) => args.includes(value);
@@ -21176,7 +21342,7 @@ init_win32_resolve();
 
 // src/exec-kill-guard.ts
 import * as os8 from "node:os";
-import * as path38 from "node:path";
+import * as path39 from "node:path";
 var isWin3 = os8.platform() === "win32";
 async function checkExecKillCommand(cmd, args) {
   if (!cmd) return { blocked: false };
@@ -21393,7 +21559,7 @@ async function checkKillTarget(target) {
         reason: `Blocked: kill ${target.signal} '${target.name}' targets a WrongStack process name.`
       };
     }
-    const currentImage = path38.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
+    const currentImage = path39.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
     const targetsNodeRuntime = nameLower === "node" || nameLower.startsWith("node");
     if (targetsNodeRuntime && currentImage === "node") {
       return {
@@ -22278,7 +22444,7 @@ var execTool = {
   }
 };
 function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
-  return new Promise((resolve22) => {
+  return new Promise((resolve23) => {
     let stdout = "";
     let stderr = "";
     let killed = false;
@@ -22286,7 +22452,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     const finish = (result) => {
       if (resolvedOnce.value) return;
       resolvedOnce.value = true;
-      resolve22(result);
+      resolve23(result);
     };
     const startedAt = Date.now();
     let stdoutBytes = 0;
@@ -22338,7 +22504,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
         command: cmd,
         args,
         stdout: "",
-        stderr: `spawn failed: ${toErrorMessage12(err)}`,
+        stderr: `spawn failed: ${toErrorMessage13(err)}`,
         exitCode: 1,
         truncated: false,
         allowed: true,
@@ -22962,10 +23128,10 @@ function parseFormatterCounts(fixer, output) {
   };
 }
 async function detectFixer(cwd) {
-  const fs42 = await import("node:fs/promises");
+  const fs43 = await import("node:fs/promises");
   const exists = async (file) => {
     try {
-      await fs42.stat(`${cwd}/${file}`);
+      await fs43.stat(`${cwd}/${file}`);
       return true;
     } catch {
       return false;
@@ -22988,7 +23154,7 @@ async function detectFixer(cwd) {
     if (await exists(cfg)) return "prettier";
   }
   try {
-    const raw = await fs42.readFile(`${cwd}/package.json`, "utf8");
+    const raw = await fs43.readFile(`${cwd}/package.json`, "utf8");
     const pkg = JSON.parse(raw);
     if (pkg["prettier"] !== void 0) return "prettier";
   } catch {
@@ -23000,7 +23166,7 @@ async function detectFixer(cwd) {
 init_util();
 import { spawn as spawn9 } from "node:child_process";
 import { statSync as statSync4 } from "node:fs";
-import { dirname as dirname13, resolve as resolve18, sep as sep6 } from "node:path";
+import { dirname as dirname13, resolve as resolve19, sep as sep6 } from "node:path";
 import { assessCommitSafety } from "@wrongstack/core/coordination";
 import { buildChildEnv as buildChildEnv4 } from "@wrongstack/core/utils";
 var TIMEOUT_MS2 = 3e4;
@@ -23161,8 +23327,8 @@ function validateWorktreeInput(input, projectRoot) {
     return reject(`unsafe worktree path: ${input.worktreePath}`);
   }
   if ((input.worktreeAction === "add" || input.worktreeAction === "remove") && input.worktreePath) {
-    const root = resolve18(projectRoot);
-    const abs = resolve18(root, input.worktreePath);
+    const root = resolve19(projectRoot);
+    const abs = resolve19(root, input.worktreePath);
     if (abs !== root && !abs.startsWith(root + sep6)) {
       return reject(`unsafe worktree path (escapes project root): ${input.worktreePath}`);
     }
@@ -23256,7 +23422,7 @@ function buildArgs(input) {
   }
 }
 function runGit2(args, cwd, signal) {
-  return new Promise((resolve22) => {
+  return new Promise((resolve23) => {
     let stdout = "";
     let stderr = "";
     const child = spawn9("git", args, {
@@ -23277,7 +23443,7 @@ function runGit2(args, cwd, signal) {
       }
     });
     child.on("error", (err) => {
-      resolve22({
+      resolve23({
         command: args[0],
         stdout: normalizeCommandOutput(stdout),
         stderr: err.message,
@@ -23286,7 +23452,7 @@ function runGit2(args, cwd, signal) {
       });
     });
     child.on("close", (code) => {
-      resolve22({
+      resolve23({
         command: args[0],
         stdout: normalizeCommandOutput(stdout),
         stderr: normalizeCommandOutput(stderr),
@@ -23298,8 +23464,8 @@ function runGit2(args, cwd, signal) {
 }
 
 // src/glob.ts
-import * as fs31 from "node:fs/promises";
-import * as path39 from "node:path";
+import * as fs32 from "node:fs/promises";
+import * as path40 from "node:path";
 import { compileGlob as compileGlob2, DEFAULT_WALK_IGNORE_DIRS as DEFAULT_WALK_IGNORE_DIRS2 } from "@wrongstack/core/utils";
 import { ToolValidationError as ToolValidationError6 } from "@wrongstack/core/types";
 
@@ -23379,7 +23545,7 @@ var globTool = {
         return;
       }
       try {
-        const st = await fs31.stat(full);
+        const st = await fs32.stat(full);
         if (truncated || results.length >= limit) {
           truncated = true;
           return;
@@ -23400,7 +23566,7 @@ var globTool = {
       }
       let entries;
       try {
-        entries = await fs31.readdir(dir, { withFileTypes: true });
+        entries = await fs32.readdir(dir, { withFileTypes: true });
       } catch {
         return;
       }
@@ -23410,7 +23576,7 @@ var globTool = {
         const name = e.name;
         if (DEFAULT_IGNORE2.has(name)) continue;
         const rel = relPrefix ? `${relPrefix}/${name}` : name;
-        const full = path39.join(dir, name);
+        const full = path40.join(dir, name);
         if (e.isDirectory()) {
           if (isGitIgnored(rel, true)) continue;
           subdirs.push({ full, rel });
@@ -23425,15 +23591,15 @@ var globTool = {
           }
         } else if (e.isSymbolicLink()) {
           try {
-            const st = await fs31.stat(full);
+            const st = await fs32.stat(full);
             if (st.isDirectory()) {
               if (isGitIgnored(rel, true)) continue;
-              const real = await fs31.realpath(full);
+              const real = await fs32.realpath(full);
               await assertRealInsideRoot(real, ctx);
               subdirs.push({ full, rel });
             } else if (st.isFile()) {
               if (isGitIgnored(rel, false)) continue;
-              const real = await fs31.realpath(full);
+              const real = await fs32.realpath(full);
               await assertRealInsideRoot(real, ctx);
               re.lastIndex = 0;
               const relMatch = re.test(rel);
@@ -23463,8 +23629,8 @@ var globTool = {
 
 // src/grep.ts
 import { spawn as spawn10 } from "node:child_process";
-import * as fs32 from "node:fs/promises";
-import * as path40 from "node:path";
+import * as fs33 from "node:fs/promises";
+import * as path41 from "node:path";
 import { ToolValidationError as ToolValidationError7 } from "@wrongstack/core/types";
 import {
   buildChildEnv as buildChildEnv5,
@@ -23699,7 +23865,7 @@ var grepTool = {
 };
 var rgAvailabilityCache;
 function detectRg() {
-  rgAvailabilityCache ??= new Promise((resolve22) => {
+  rgAvailabilityCache ??= new Promise((resolve23) => {
     try {
       const p = spawn10("rg", ["--version"], {
         env: buildChildEnv5(),
@@ -23707,10 +23873,10 @@ function detectRg() {
         signal: AbortSignal.timeout(1e4),
         windowsHide: true
       });
-      p.on("error", () => resolve22(false));
-      p.on("close", (code) => resolve22(code === 0));
+      p.on("error", () => resolve23(false));
+      p.on("close", (code) => resolve23(code === 0));
     } catch {
-      resolve22(false);
+      resolve23(false);
     }
   });
   return rgAvailabilityCache;
@@ -23727,8 +23893,8 @@ async function* runRgStream(input, base, mode, limit, signal) {
   for (const ignored of DEFAULT_IGNORE3) {
     args.push("--glob", `!${ignored}/**`, "--glob", `!**/${ignored}/**`);
   }
-  const gitignorePath = path40.join(base, ".gitignore");
-  if (await fs32.access(gitignorePath).then(
+  const gitignorePath = path41.join(base, ".gitignore");
+  if (await fs33.access(gitignorePath).then(
     () => true,
     () => false
   )) {
@@ -23918,9 +24084,9 @@ async function runNative(input, base, mode, limit, signal) {
     if (globRe && !globRe.test(name) && !globRe.test(full)) return;
     if (globRe) globRe.lastIndex = 0;
     try {
-      const stat21 = await fs32.stat(full);
+      const stat21 = await fs33.stat(full);
       if (!stat21.isFile() || stat21.size > maxBytes || stopped || signal.aborted) return;
-      const file = await fs32.open(full, "r");
+      const file = await fs33.open(full, "r");
       try {
         let bytesReadTotal = 0;
         let lineNumber = 0;
@@ -24005,7 +24171,7 @@ async function runNative(input, base, mode, limit, signal) {
     if (stopped || signal.aborted) return;
     let entries;
     try {
-      entries = await fs32.readdir(dir, { withFileTypes: true });
+      entries = await fs33.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -24016,7 +24182,7 @@ async function runNative(input, base, mode, limit, signal) {
       if (DEFAULT_IGNORE3.has(e.name)) continue;
       if (e.isSymbolicLink()) continue;
       const rel = relPrefix ? `${relPrefix}/${e.name}` : e.name;
-      const full = path40.join(dir, e.name);
+      const full = path41.join(dir, e.name);
       if (e.isDirectory()) {
         if (isGitIgnored(rel, true)) continue;
         subdirs.push({ full, rel });
@@ -24256,7 +24422,7 @@ function resolveManifestPath(cwd, pkgManager) {
 }
 
 // src/json.ts
-import * as fs33 from "node:fs/promises";
+import * as fs34 from "node:fs/promises";
 import { deepMerge as deepMergeCore } from "@wrongstack/core/utils";
 init_util();
 var MAX_JSON_FILE_BYTES = 16 * 1024 * 1024;
@@ -24271,11 +24437,11 @@ var JsonFileTooLargeError = class extends Error {
 };
 async function readJsonFileBounded(filePath, ctx) {
   const resolved = await safeResolveReal(filePath, ctx);
-  const stat21 = await fs33.stat(resolved);
+  const stat21 = await fs34.stat(resolved);
   if (stat21.size > MAX_JSON_FILE_BYTES) {
     throw new JsonFileTooLargeError(filePath, stat21.size);
   }
-  return fs33.readFile(resolved, "utf8");
+  return fs34.readFile(resolved, "utf8");
 }
 var jsonTool = {
   name: "json",
@@ -24752,60 +24918,60 @@ function jmespathSearch(data, query) {
 }
 function validateJsonSchema(data, schema) {
   const errors = [];
-  function check(value, s, path48) {
+  function check(value, s, path49) {
     if (s["type"]) {
       const expectedType = s["type"];
       const actualType = Array.isArray(value) ? "array" : value === null ? "null" : typeof value;
       if (expectedType === "integer") {
-        if (!Number.isInteger(value)) errors.push(`${path48}: expected integer, got ${actualType}`);
+        if (!Number.isInteger(value)) errors.push(`${path49}: expected integer, got ${actualType}`);
       } else if (expectedType !== actualType) {
-        errors.push(`${path48}: expected ${expectedType}, got ${actualType}`);
+        errors.push(`${path49}: expected ${expectedType}, got ${actualType}`);
       }
     }
     if (typeof value === "string" && s["format"] === "uri" && value) {
       try {
         new URL(value);
       } catch {
-        errors.push(`${path48}: not a valid URI`);
+        errors.push(`${path49}: not a valid URI`);
       }
     }
     if (typeof value === "string" && s["pattern"]) {
       const compiled = compileUserRegex(s["pattern"], "");
       if (!compiled.ok) {
-        errors.push(`${path48}: invalid schema pattern \u2014 ${compiled.reason}`);
+        errors.push(`${path49}: invalid schema pattern \u2014 ${compiled.reason}`);
       } else if (!compiled.regex.test(capSubject(value))) {
-        errors.push(`${path48}: does not match pattern ${s["pattern"]}`);
+        errors.push(`${path49}: does not match pattern ${s["pattern"]}`);
       }
     }
     if (typeof value === "string" && s["minLength"] !== void 0 && value.length < s["minLength"]) {
-      errors.push(`${path48}: string too short (min ${s["minLength"]})`);
+      errors.push(`${path49}: string too short (min ${s["minLength"]})`);
     }
     if (typeof value === "string" && s["maxLength"] !== void 0 && value.length > s["maxLength"]) {
-      errors.push(`${path48}: string too long (max ${s["maxLength"]})`);
+      errors.push(`${path49}: string too long (max ${s["maxLength"]})`);
     }
     if (typeof value === "number" && s["minimum"] !== void 0 && value < s["minimum"]) {
-      errors.push(`${path48}: below minimum ${s["minimum"]}`);
+      errors.push(`${path49}: below minimum ${s["minimum"]}`);
     }
     if (typeof value === "number" && s["maximum"] !== void 0 && value > s["maximum"]) {
-      errors.push(`${path48}: above maximum ${s["maximum"]}`);
+      errors.push(`${path49}: above maximum ${s["maximum"]}`);
     }
     if (Array.isArray(value) && s["items"] && Array.isArray(s["items"])) {
       for (let i = 0; i < value.length; i++) {
-        check(value[i], s["items"], `${path48}[${i}]`);
+        check(value[i], s["items"], `${path49}[${i}]`);
       }
     }
     if (typeof value === "object" && value !== null && !Array.isArray(value) && s["properties"]) {
       const props = s["properties"];
       for (const [k, propSchema] of Object.entries(props)) {
-        check(value[k], propSchema, `${path48}.${k}`);
+        check(value[k], propSchema, `${path49}.${k}`);
       }
     }
   }
   check(data, schema, "$");
   return { valid: errors.length === 0, errors };
 }
-function simpleQuery(data, path48) {
-  const parts = path48.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean);
+function simpleQuery(data, path49) {
+  const parts = path49.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean);
   let current = data;
   for (const part of parts) {
     if (current === null || current === void 0) return void 0;
@@ -27477,7 +27643,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
     };
   }
   args.push("--timestamps", service);
-  return new Promise((resolve22) => {
+  return new Promise((resolve23) => {
     let stdout = "";
     let stderr = "";
     const MAX = 2e5;
@@ -27493,7 +27659,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve22(result);
+      resolve23(result);
     };
     const child = spawn11("docker", args, {
       cwd,
@@ -27538,7 +27704,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
 }
 var DOCKER_LOGS_TIMEOUT_MS = 3e3;
 var MAX_TAIL_LINES = 1e5;
-async function fileLogs(path48, lines, filterRe) {
+async function fileLogs(path49, lines, filterRe) {
   const { createInterface } = await import("node:readline");
   const { createReadStream: createReadStream2 } = await import("node:fs");
   const entries = [];
@@ -27547,7 +27713,7 @@ async function fileLogs(path48, lines, filterRe) {
   let writeIdx = 0;
   let totalLines = 0;
   const rl = createInterface({
-    input: createReadStream2(path48),
+    input: createReadStream2(path49),
     crlfDelay: Number.POSITIVE_INFINITY
   });
   for await (const line of rl) {
@@ -27568,7 +27734,7 @@ async function fileLogs(path48, lines, filterRe) {
     if (parsed) entries.push(parsed);
   }
   return {
-    source: path48,
+    source: path49,
     entries,
     total: entries.length,
     truncated: totalLines > effLines,
@@ -27710,7 +27876,7 @@ var outdatedTool = {
   }
 };
 function runOutdated(manager, args, cwd, signal) {
-  return new Promise((resolve22) => {
+  return new Promise((resolve23) => {
     let stdout = "";
     let stderr = "";
     const MAX = 1e5;
@@ -27735,10 +27901,10 @@ function runOutdated(manager, args, cwd, signal) {
     });
     child.on("close", (code) => {
       const result = parseOutdatedOutput(stdout, code ?? 0);
-      resolve22(result);
+      resolve23(result);
     });
     child.on("error", (e) => {
-      resolve22({
+      resolve23({
         exit_code: 1,
         packages: [],
         total: 0,
@@ -27798,10 +27964,10 @@ Note: exit code 1 from \`outdated\` means outdated packages were found (expected
 // src/patch.ts
 init_util();
 import { spawn as spawn13 } from "node:child_process";
-import * as fs34 from "node:fs/promises";
+import * as fs35 from "node:fs/promises";
 import * as os9 from "node:os";
-import * as path41 from "node:path";
-import { buildChildEnv as buildChildEnv8, toErrorMessage as toErrorMessage13 } from "@wrongstack/core/utils";
+import * as path42 from "node:path";
+import { buildChildEnv as buildChildEnv8, toErrorMessage as toErrorMessage14 } from "@wrongstack/core/utils";
 var patchTool = {
   name: "patch",
   category: "Filesystem",
@@ -27845,26 +28011,26 @@ var patchTool = {
     try {
       dir = input.directory ? await safeResolveReal(input.directory, ctx) : ctx.cwd;
     } catch (err) {
-      return refuse(`patch refused: ${toErrorMessage13(err)}`);
+      return refuse(`patch refused: ${toErrorMessage14(err)}`);
     }
-    const realRoot = await fs34.realpath(ctx.projectRoot).catch(() => path41.resolve(ctx.projectRoot));
+    const realRoot = await fs35.realpath(ctx.projectRoot).catch(() => path42.resolve(ctx.projectRoot));
     const targets = extractDiffTargets(input.patch);
     const resolvedTargets = [];
     for (const t of targets) {
       const stripped = stripPathComponents(t.raw, strip);
       if (!stripped) continue;
-      if (path41.isAbsolute(stripped)) {
+      if (path42.isAbsolute(stripped)) {
         return refuse(`patch refused: target "${t.raw}" strips to absolute path`);
       }
-      const candidate = path41.resolve(dir, stripped);
+      const candidate = path42.resolve(dir, stripped);
       let real;
       try {
         real = await resolveRealInsideRoot(candidate, ctx);
       } catch (err) {
-        return refuse(`patch refused: target "${t.raw}" ${toErrorMessage13(err)}`);
+        return refuse(`patch refused: target "${t.raw}" ${toErrorMessage14(err)}`);
       }
-      const rel = path41.relative(realRoot, real);
-      if (rel.startsWith("..") || path41.isAbsolute(rel)) {
+      const rel = path42.relative(realRoot, real);
+      if (rel.startsWith("..") || path42.isAbsolute(rel)) {
         return refuse(`patch refused: target "${t.raw}" resolves outside project root`);
       }
       resolvedTargets.push({ raw: t.raw, deleted: t.deleted, abs: real });
@@ -27873,17 +28039,17 @@ var patchTool = {
     const beforeExisted = /* @__PURE__ */ new Set();
     if (!dryRun) {
       for (const target of resolvedTargets) {
-        const existed = (await fs34.stat(target.abs).catch(() => null))?.isFile() ?? false;
+        const existed = (await fs35.stat(target.abs).catch(() => null))?.isFile() ?? false;
         if (existed) beforeExisted.add(target.abs);
         beforeContents.set(target.abs, await readTextForTracking(target.abs));
       }
     }
-    const tmpDir = await fs34.mkdtemp(path41.join(os9.tmpdir(), ".wstack_patch_"));
+    const tmpDir = await fs35.mkdtemp(path42.join(os9.tmpdir(), ".wstack_patch_"));
     try {
-      await fs34.chmod(tmpDir, 448).catch(() => {
+      await fs35.chmod(tmpDir, 448).catch(() => {
       });
-      const patchFile = path41.join(tmpDir, "in.diff");
-      await fs34.writeFile(patchFile, input.patch, { mode: 384 });
+      const patchFile = path42.join(tmpDir, "in.diff");
+      await fs35.writeFile(patchFile, input.patch, { mode: 384 });
       const args = [`-p${strip}`, "--merge", ...dryRun ? ["--dry-run"] : [], "-i", patchFile];
       const result = await runPatch(args, dir, opts.signal, {
         patchFile,
@@ -27895,7 +28061,7 @@ var patchTool = {
         for (const target of resolvedTargets) {
           const abs = target.abs;
           const before = beforeContents.get(abs) ?? null;
-          const stat21 = await fs34.stat(abs).catch(() => null);
+          const stat21 = await fs35.stat(abs).catch(() => null);
           if (!stat21?.isFile()) {
             if (beforeExisted.has(abs)) {
               touched.push(abs);
@@ -27928,7 +28094,7 @@ var patchTool = {
       }
       if (result.exitCode !== 0) {
         if (!dryRun) {
-          const partial = touched.length > 0 ? ` ${touched.length} file(s) were still modified on disk and have been recorded for rewind: ${touched.map((p) => path41.relative(realRoot, p) || p).join(", ")}.` : "";
+          const partial = touched.length > 0 ? ` ${touched.length} file(s) were still modified on disk and have been recorded for rewind: ${touched.map((p) => path42.relative(realRoot, p) || p).join(", ")}.` : "";
           return {
             applied: touched.length,
             rejected: 1,
@@ -27936,7 +28102,7 @@ var patchTool = {
             // success path (which returns GNU patch's dir-relative names).
             // `touched` entries are realpaths from resolveRealInsideRoot, and
             // realRoot is also a realpath, so path.relative is like-for-like.
-            files: touched.map((p) => path41.relative(realRoot, p) || p),
+            files: touched.map((p) => path42.relative(realRoot, p) || p),
             dry_run: dryRun,
             message: `patch failed: ${result.stderr || result.stdout}${partial}`
           };
@@ -27952,7 +28118,7 @@ var patchTool = {
       }
       const patched = result.engine === "git" ? [
         ...new Set(
-          resolvedTargets.map((target) => path41.relative(dir, target.abs) || target.abs)
+          resolvedTargets.map((target) => path42.relative(dir, target.abs) || target.abs)
         )
       ] : extractPatchedFiles(result.stdout);
       return {
@@ -27963,7 +28129,7 @@ var patchTool = {
         message: result.stdout || "patch applied"
       };
     } finally {
-      await fs34.rm(tmpDir, { recursive: true, force: true }).catch(() => {
+      await fs35.rm(tmpDir, { recursive: true, force: true }).catch(() => {
       });
     }
   }
@@ -27971,9 +28137,9 @@ var patchTool = {
 var MAX_TRACKING_BYTES = 5 * 1024 * 1024;
 async function readTextForTracking(absPath) {
   try {
-    const stat21 = await fs34.stat(absPath);
+    const stat21 = await fs35.stat(absPath);
     if (!stat21.isFile() || stat21.size > MAX_TRACKING_BYTES) return null;
-    const buf = await fs34.readFile(absPath);
+    const buf = await fs35.readFile(absPath);
     if (buf.includes(0)) return null;
     return buf.toString("utf8");
   } catch {
@@ -28057,7 +28223,7 @@ function runPatch(args, cwd, signal, fallback) {
   });
 }
 function runPatchProcess(command, args, cwd, signal) {
-  return new Promise((resolve22) => {
+  return new Promise((resolve23) => {
     let stdout = "";
     let stderr = "";
     const env = { ...buildChildEnv8(), LANG: "C", LC_ALL: "C" };
@@ -28076,11 +28242,11 @@ function runPatchProcess(command, args, cwd, signal) {
     });
     child.on(
       "close",
-      (code) => resolve22({ exitCode: code ?? 1, stdout, stderr, unavailable: false })
+      (code) => resolve23({ exitCode: code ?? 1, stdout, stderr, unavailable: false })
     );
     child.on(
       "error",
-      (e) => resolve22({
+      (e) => resolve23({
         exitCode: 1,
         stdout: "",
         stderr: e.message,
@@ -28871,9 +29037,9 @@ function mkResult(plan, ok, message, todos) {
 
 // src/read.ts
 init_util();
-import * as fs35 from "node:fs/promises";
+import * as fs36 from "node:fs/promises";
 import { FsError, ToolValidationError as ToolValidationError8 } from "@wrongstack/core/types";
-import { toErrorMessage as toErrorMessage14 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage15 } from "@wrongstack/core/utils";
 var ADVANCED_MODE_META_KEY = "tools.read.advancedMode";
 var MAX_BYTES2 = 5 * 1024 * 1024;
 var readTool = {
@@ -28931,7 +29097,7 @@ var readTool = {
     const shouldIncludeSymbols = input.includeSymbols === true || input.includeSymbols !== false && ctx.meta[ADVANCED_MODE_META_KEY] === true;
     let stat21;
     try {
-      stat21 = await fs35.stat(absPath);
+      stat21 = await fs36.stat(absPath);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
@@ -28943,7 +29109,7 @@ var readTool = {
         });
       }
       throw new FsError({
-        message: `read: failed to stat "${input.path}": ${toErrorMessage14(err)}`,
+        message: `read: failed to stat "${input.path}": ${toErrorMessage15(err)}`,
         code: "FS_READ_FAILED",
         path: absPath,
         context: { errno: code },
@@ -28983,7 +29149,7 @@ var readTool = {
         ...symResult2?.symbols ? { symbols: symResult2.symbols } : {}
       };
     }
-    const buf = await fs35.readFile(absPath);
+    const buf = await fs36.readFile(absPath);
     if (isBinaryBuffer(buf)) {
       throw new FsError({
         message: `read: "${input.path}" appears to be binary`,
@@ -29150,8 +29316,8 @@ ${interesting.join("\n")}` : "symbols/imports: (none detected)"
 
 // src/replace.ts
 import { spawn as spawn14 } from "node:child_process";
-import * as fs36 from "node:fs/promises";
-import * as path42 from "node:path";
+import * as fs37 from "node:fs/promises";
+import * as path43 from "node:path";
 import { ToolValidationError as ToolValidationError9 } from "@wrongstack/core/types";
 import {
   atomicWrite as atomicWrite4,
@@ -29234,14 +29400,14 @@ var replaceTool = {
     const dryRun = input.dry_run ?? true;
     const filesInput = Array.isArray(input.files) ? input.files.join(",") : input.files;
     const fileList = await resolveFiles2(filesInput, ctx, globRe);
-    const realRoot = await fs36.realpath(ctx.projectRoot).catch(() => ctx.projectRoot);
+    const realRoot = await fs37.realpath(ctx.projectRoot).catch(() => ctx.projectRoot);
     const results = [];
     let totalReplacements = 0;
     let diffBytesUsed = 0;
     let diffsOmitted = 0;
     let diffsTruncated = 0;
     for (const absPath of fileList) {
-      const lstat2 = await fs36.lstat(absPath).catch((err) => {
+      const lstat2 = await fs37.lstat(absPath).catch((err) => {
         if (err.code === "ENOENT") return null;
         throw err;
       });
@@ -29249,17 +29415,17 @@ var replaceTool = {
       if (lstat2.isSymbolicLink()) continue;
       let realPath;
       try {
-        realPath = await fs36.realpath(absPath);
+        realPath = await fs37.realpath(absPath);
       } catch {
         continue;
       }
-      const rel = path42.relative(realRoot, realPath);
-      if (rel.startsWith("..") || path42.isAbsolute(rel)) continue;
-      const stat21 = await fs36.stat(realPath).catch(() => null);
+      const rel = path43.relative(realRoot, realPath);
+      if (rel.startsWith("..") || path43.isAbsolute(rel)) continue;
+      const stat21 = await fs37.stat(realPath).catch(() => null);
       if (!stat21?.isFile()) continue;
       let content;
       try {
-        const buf = await fs36.readFile(realPath);
+        const buf = await fs37.readFile(realPath);
         if (isBinaryBuffer(buf)) continue;
         content = buf.toString("utf8");
       } catch {
@@ -29282,7 +29448,7 @@ var replaceTool = {
       if (!dryRun) {
         const newContent = toStyle2(newContentLf, style);
         await atomicWrite4(realPath, newContent, { mode: stat21.mode & 511 });
-        const written = await fs36.stat(realPath).catch(() => null);
+        const written = await fs37.stat(realPath).catch(() => null);
         if (written) {
           ctx.recordRead?.(realPath, written.mtimeMs, "write", sha256hex(newContent));
         }
@@ -29382,8 +29548,8 @@ async function resolveFiles2(filesInput, ctx, extraGlob) {
   const resolved = [];
   for (const p of parts) {
     const absPath = await safeResolveReal(p, ctx);
-    if (extraGlob && !passesExtraGlob(extraGlob, path42.basename(absPath), absPath)) continue;
-    const stat21 = await fs36.stat(absPath).catch(() => null);
+    if (extraGlob && !passesExtraGlob(extraGlob, path43.basename(absPath), absPath)) continue;
+    const stat21 = await fs37.stat(absPath).catch(() => null);
     if (stat21?.isFile()) {
       resolved.push(absPath);
     }
@@ -29397,7 +29563,7 @@ async function globFiles(pattern, base, extraGlob) {
       const { promise } = spawnRgFind(pattern, base);
       const files = await promise;
       if (extraGlob) {
-        return files.filter((f) => passesExtraGlob(extraGlob, path42.basename(f), f));
+        return files.filter((f) => passesExtraGlob(extraGlob, path43.basename(f), f));
       }
       return files;
     } catch {
@@ -29407,17 +29573,17 @@ async function globFiles(pattern, base, extraGlob) {
 }
 var rgAvailabilityCache2;
 function checkRg() {
-  rgAvailabilityCache2 ??= new Promise((resolve22) => {
+  rgAvailabilityCache2 ??= new Promise((resolve23) => {
     try {
       const p = spawn14("rg", ["--version"], {
         env: buildChildEnv9(),
         stdio: "ignore",
         windowsHide: true
       });
-      p.on("error", () => resolve22(false));
-      p.on("close", (code) => resolve22(code === 0));
+      p.on("error", () => resolve23(false));
+      p.on("close", (code) => resolve23(code === 0));
     } catch {
-      resolve22(false);
+      resolve23(false);
     }
   });
   return rgAvailabilityCache2;
@@ -29443,10 +29609,10 @@ function spawnRgFind(pattern, base) {
     }
   });
   return {
-    promise: new Promise((resolve22, reject) => {
+    promise: new Promise((resolve23, reject) => {
       child.on("error", reject);
       child.on("close", () => {
-        resolve22(buf.split("\n").filter(Boolean));
+        resolve23(buf.split("\n").filter(Boolean));
       });
     })
   };
@@ -29457,15 +29623,15 @@ async function globNative(pattern, base, extraGlob) {
   const walk = async (dir) => {
     let entries;
     try {
-      entries = await fs36.readdir(dir, { withFileTypes: true });
+      entries = await fs37.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries) {
       if (DEFAULT_IGNORE4.includes(e.name)) continue;
-      const full = path42.join(dir, e.name);
+      const full = path43.join(dir, e.name);
       try {
-        const stat21 = await fs36.lstat(full);
+        const stat21 = await fs37.lstat(full);
         if (stat21.isSymbolicLink()) continue;
       } catch {
         continue;
@@ -29489,8 +29655,8 @@ async function globNative(pattern, base, extraGlob) {
 
 // src/scaffold.ts
 init_util();
-import * as fs37 from "node:fs/promises";
-import * as path43 from "node:path";
+import * as fs38 from "node:fs/promises";
+import * as path44 from "node:path";
 import { atomicWrite as atomicWrite5 } from "@wrongstack/core/utils";
 var BUILT_IN_TEMPLATES = {
   "npm-package": {
@@ -29641,16 +29807,16 @@ async function handleBuiltIn(name, templateFiles, cwd, ctx, dryRun, vars) {
   let filesCreated = 0;
   for (const [filePath, content] of Object.entries(templateFiles)) {
     const resolvedPath = substituteVars(filePath, name, vars);
-    const joinedPath = path43.join(cwd, resolvedPath);
-    const root = path43.resolve(ctx.projectRoot);
-    const target = path43.resolve(joinedPath);
-    const rel = path43.relative(root, target);
-    if (rel.startsWith("..") || path43.isAbsolute(rel)) {
+    const joinedPath = path44.join(cwd, resolvedPath);
+    const root = path44.resolve(ctx.projectRoot);
+    const target = path44.resolve(joinedPath);
+    const rel = path44.relative(root, target);
+    if (rel.startsWith("..") || path44.isAbsolute(rel)) {
       throw new Error(`scaffold: generated path "${resolvedPath}" would escape project root`);
     }
     const fullPath = target;
     if (!dryRun) {
-      await fs37.mkdir(path43.dirname(fullPath), { recursive: true });
+      await fs38.mkdir(path44.dirname(fullPath), { recursive: true });
       await atomicWrite5(fullPath, substituteVars(content, name, vars));
     }
     files.push(resolvedPath);
@@ -29683,7 +29849,7 @@ function substituteVars(content, name, vars) {
 // src/search.ts
 import { FetchError as FetchError3, ToolValidationError as ToolValidationError10 } from "@wrongstack/core/types";
 import { expectDefined as expectDefined9 } from "@wrongstack/core/utils";
-import { toErrorMessage as toErrorMessage15 } from "@wrongstack/core/utils";
+import { toErrorMessage as toErrorMessage16 } from "@wrongstack/core/utils";
 var DEFAULT_NUM = 10;
 var MAX_RESULTS = 50;
 var MAX_SNIPPET_CHARS = 300;
@@ -29893,9 +30059,9 @@ async function duckduckgoSearch(query, signal) {
     return { results: parseDuckDuckGo(html, MAX_RESULTS) };
   } catch (err) {
     console.log(
-      JSON.stringify({ level: "debug", event: "search_failed", query, error: toErrorMessage15(err) })
+      JSON.stringify({ level: "debug", event: "search_failed", query, error: toErrorMessage16(err) })
     );
-    return { results: [], error: `duckduckgo unreachable: ${toErrorMessage15(err)}` };
+    return { results: [], error: `duckduckgo unreachable: ${toErrorMessage16(err)}` };
   }
 }
 function takeFrom(iter, max) {
@@ -29961,7 +30127,7 @@ async function googleSearch(query, signal) {
     const html = await fetchWithTimeout(url, signal, TIMEOUT_MS3).then((r) => r.text());
     return { results: parseGoogleResults(html, MAX_RESULTS) };
   } catch (err) {
-    return { results: [], error: `google unreachable: ${toErrorMessage15(err)}` };
+    return { results: [], error: `google unreachable: ${toErrorMessage16(err)}` };
   }
 }
 function parseGoogleResults(html, num) {
@@ -29998,7 +30164,7 @@ async function bingSearch(query, signal) {
     const html = await fetchWithTimeout(url, signal, TIMEOUT_MS3).then((r) => r.text());
     return { results: parseBingResults(html, MAX_RESULTS) };
   } catch (err) {
-    return { results: [], error: `bing unreachable: ${toErrorMessage15(err)}` };
+    return { results: [], error: `bing unreachable: ${toErrorMessage16(err)}` };
   }
 }
 function parseBingResults(html, num) {
@@ -30096,9 +30262,9 @@ function decodeHtmlEntities(text) {
 }
 
 // src/security-ast-scan-tool.ts
-import * as fs38 from "node:fs/promises";
-import * as path44 from "node:path";
-import { toErrorMessage as toErrorMessage16 } from "@wrongstack/core/utils";
+import * as fs39 from "node:fs/promises";
+import * as path45 from "node:path";
+import { toErrorMessage as toErrorMessage17 } from "@wrongstack/core/utils";
 var SECRET_PATTERNS = [
   { name: "AWS Access Key", regex: /\b(AKIA[0-9A-Z]{16})\b/ },
   { name: "GitHub Token", regex: /\b(gh[pousr]_[A-Za-z0-9_]{36,255})\b/ },
@@ -30264,9 +30430,9 @@ var securityAstScanTool = {
       let targetFile = input.file ?? "inline-code.ts";
       let content = input.content;
       if (!content && input.file) {
-        const absPath = path44.isAbsolute(input.file) ? input.file : path44.resolve(projectRoot, input.file);
-        targetFile = path44.relative(projectRoot, absPath).replace(/\\/g, "/");
-        content = await fs38.readFile(absPath, "utf8");
+        const absPath = path45.isAbsolute(input.file) ? input.file : path45.resolve(projectRoot, input.file);
+        targetFile = path45.relative(projectRoot, absPath).replace(/\\/g, "/");
+        content = await fs39.readFile(absPath, "utf8");
       }
       if (!content) {
         return {
@@ -30307,15 +30473,15 @@ var securityAstScanTool = {
         warningCount: 0,
         findings: [],
         summary: "",
-        error: toErrorMessage16(err)
+        error: toErrorMessage17(err)
       };
     }
   }
 };
 
 // src/set-working-dir.ts
-import * as fs39 from "node:fs/promises";
-import { toErrorMessage as toErrorMessage17 } from "@wrongstack/core/utils";
+import * as fs40 from "node:fs/promises";
+import { toErrorMessage as toErrorMessage18 } from "@wrongstack/core/utils";
 var setWorkingDirTool = {
   name: "set_working_dir",
   category: "Context",
@@ -30349,12 +30515,12 @@ var setWorkingDirTool = {
     } catch (err) {
       return {
         current: ctx.workingDir,
-        error: toErrorMessage17(err)
+        error: toErrorMessage18(err)
       };
     }
     let isDirectory = false;
     try {
-      isDirectory = (await fs39.stat(resolved)).isDirectory();
+      isDirectory = (await fs40.stat(resolved)).isDirectory();
     } catch {
       isDirectory = false;
     }
@@ -30889,7 +31055,7 @@ ${formatTaskList2(file.tasks)}` : file.tasks.length > 0 ? formatTaskList2(file.t
 init_spawn_stream();
 init_util();
 init_legacy_bridge();
-import * as path45 from "node:path";
+import * as path46 from "node:path";
 var testTool = {
   name: "test",
   category: "Code Quality",
@@ -30996,7 +31162,7 @@ async function detectRunner(cwd) {
   const candidates = ["vitest.config.ts", "jest.config.js", ".mocharc.json"];
   for (const f of candidates) {
     try {
-      await stat21(path45.join(cwd, f));
+      await stat21(path46.join(cwd, f));
       if (f.includes("vitest")) return "vitest";
       if (f.includes("jest")) return "jest";
       if (f.includes("mocha")) return "mocha";
@@ -31373,8 +31539,8 @@ var toolUseTool = {
 
 // src/tree.ts
 init_util();
-import * as fs40 from "node:fs/promises";
-import * as path46 from "node:path";
+import * as fs41 from "node:fs/promises";
+import * as path47 from "node:path";
 import { DEFAULT_WALK_IGNORE_DIRS as DEFAULT_WALK_IGNORE_DIRS4, expectDefined as expectDefined10 } from "@wrongstack/core/utils";
 var DEFAULT_IGNORE5 = /* @__PURE__ */ new Set([
   ...DEFAULT_WALK_IGNORE_DIRS4,
@@ -31537,7 +31703,7 @@ var treeTool = {
 async function walkDir(dir, depth, opts) {
   opts.signal.throwIfAborted();
   if (opts.retention.truncated) return;
-  const entries = await fs40.readdir(dir, { withFileTypes: true }).catch(() => []);
+  const entries = await fs41.readdir(dir, { withFileTypes: true }).catch(() => []);
   const filtered = entries.filter((e) => {
     if (!opts.showHidden && e.name.startsWith(".")) return false;
     if (opts.exclude.has(e.name)) return false;
@@ -31579,7 +31745,7 @@ async function walkDir(dir, depth, opts) {
     opts.retention.outputBytes += lineBytes;
     if (entry.isDirectory() && (opts.maxDepth === 0 || depth < opts.maxDepth)) {
       const childPrefix = opts.prefix + connector;
-      await walkDir(path46.join(dir, entry.name), depth + 1, {
+      await walkDir(path47.join(dir, entry.name), depth + 1, {
         ...opts,
         prefix: childPrefix,
         isLast
@@ -31592,7 +31758,7 @@ async function walkDir(dir, depth, opts) {
 init_spawn_stream();
 init_util();
 init_legacy_bridge();
-import * as path47 from "node:path";
+import * as path48 from "node:path";
 var typecheckTool = {
   name: "typecheck",
   category: "Code Quality",
@@ -31704,8 +31870,8 @@ async function findTsConfig(cwd) {
   const candidates = ["tsconfig.json", "tsconfig.base.json"];
   for (const f of candidates) {
     try {
-      const s = await stat21(path47.join(cwd, f));
-      if (s.isFile()) return path47.join(cwd, f);
+      const s = await stat21(path48.join(cwd, f));
+      if (s.isFile()) return path48.join(cwd, f);
     } catch {
     }
   }
@@ -31713,7 +31879,7 @@ async function findTsConfig(cwd) {
 }
 
 // src/write.ts
-import * as fs41 from "node:fs/promises";
+import * as fs42 from "node:fs/promises";
 import { ToolValidationError as ToolValidationError11 } from "@wrongstack/core/types";
 import {
   atomicWrite as atomicWrite6,
@@ -31790,14 +31956,14 @@ async function prepareWrite(input, ctx) {
   let existed = false;
   let prev = "";
   try {
-    const stat21 = await fs41.stat(absPath);
+    const stat21 = await fs42.stat(absPath);
     existed = stat21.isFile();
     if (existed) {
       if (!ctx.hasRead(absPath)) {
-        prev = await fs41.readFile(absPath, "utf8");
+        prev = await fs42.readFile(absPath, "utf8");
         ctx.recordRead(absPath, stat21.mtimeMs, "write", sha256hex(prev));
       } else {
-        prev = await fs41.readFile(absPath, "utf8");
+        prev = await fs42.readFile(absPath, "utf8");
       }
     }
   } catch (err) {
@@ -31818,7 +31984,7 @@ async function finishWrite(input, ctx, prepared, signal) {
   const rawDiff = prepared.existed ? unifiedDiff3(prepared.prev, content, { fromFile: input.path, toFile: input.path }) : `+++ ${input.path}
 + (new file, ${content.split("\n").length} lines)`;
   const { text: diff, truncated: diffTruncated } = truncateDiffPayload(rawDiff, MAX_DIFF_BYTES3);
-  const stat21 = await fs41.stat(prepared.absPath);
+  const stat21 = await fs42.stat(prepared.absPath);
   ctx.recordRead(prepared.absPath, stat21.mtimeMs, "write", sha256hex(content));
   ctx.session.recordFileChange({
     path: prepared.absPath,
@@ -31874,6 +32040,7 @@ var TIER1_TOOLS = [
   editTool,
   clarifyTool,
   codebaseAstReplaceTool,
+  codebaseInvariantCheckTool,
   codebaseStatsTool,
   codebaseSearchTool,
   codebaseSkeletonTool,
@@ -31933,6 +32100,7 @@ var builtinTools = [
   editTool,
   clarifyTool,
   codebaseAstReplaceTool,
+  codebaseInvariantCheckTool,
   codebaseStatsTool,
   codebaseSearchTool,
   codebaseSkeletonTool,