@wrongstack/tools 0.310.1 → 0.313.1

package/dist/audit.js

@@ -1,4059 +1,14 @@
-// src/_spawn-stream.ts
-import { spawn as spawn2 } from "node:child_process";
 import {
-  emitProcessCompleted,
-  emitProcessOutput,
-  emitProcessStarted
-} from "@wrongstack/core/observability";
-import { buildChildEnv } from "@wrongstack/core/utils";
-
-// src/_output-spool.ts
-import { createWriteStream, mkdirSync } from "node:fs";
-import * as fsp from "node:fs/promises";
-import * as path from "node:path";
-import { wstackGlobalRoot } from "@wrongstack/core/utils";
-var SPOOL_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
-var SPOOL_WRITE_HWM_BYTES = 4 * 1024 * 1024;
-var sweepStarted = false;
-function toolOutputDir() {
-  return path.join(wstackGlobalRoot(), "tool-output");
-}
-function sweepOldSpoolFiles(dir) {
-  if (sweepStarted) return;
-  sweepStarted = true;
-  void (async () => {
-    try {
-      const now = Date.now();
-      for (const name of await fsp.readdir(dir)) {
-        if (!name.endsWith(".log")) continue;
-        const p = path.join(dir, name);
-        try {
-          const st = await fsp.stat(p);
-          if (now - st.mtimeMs > SPOOL_RETENTION_MS) await fsp.unlink(p);
-        } catch {
-        }
-      }
-    } catch {
-    }
-  })();
-}
-function spoolNote(info) {
-  const dropped = info.droppedBytes > 0 ? `, ~${info.droppedBytes} bytes dropped under backpressure` : "";
-  return `
-[output truncated \u2014 full ${info.bytes} bytes at ${info.path}${dropped}; read/grep that file selectively instead of re-running with more output]`;
-}
-function createOutputSpool(opts) {
-  const threshold = opts.thresholdBytes ?? 32768;
-  const safeTool = opts.tool.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
-  let head = "";
-  let headBytes = 0;
-  let totalBytes = 0;
-  let droppedBytes = 0;
-  let stream = null;
-  let filePath = null;
-  let failed = false;
-  let finalized = false;
-  const open = () => {
-    if (stream || failed) return;
-    try {
-      const dir = toolOutputDir();
-      mkdirSync(dir, { recursive: true });
-      sweepOldSpoolFiles(dir);
-      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-      const rand = Math.random().toString(36).slice(2, 6);
-      filePath = path.join(dir, `${stamp}-${safeTool}-${rand}.log`);
-      stream = createWriteStream(filePath, { flags: "w", encoding: "utf8" });
-      stream.on("error", () => {
-        failed = true;
-        stream = null;
-        filePath = null;
-      });
-      stream.write(head);
-    } catch {
-      failed = true;
-      stream = null;
-      filePath = null;
-    }
-  };
-  return {
-    write(text) {
-      if (finalized || !text) return;
-      const textBytes = Buffer.byteLength(text, "utf8");
-      totalBytes += textBytes;
-      if (!stream && !failed) {
-        if (headBytes + textBytes <= threshold) {
-          head += text;
-          headBytes += textBytes;
-          return;
-        }
-        head += text;
-        open();
-        head = "";
-        return;
-      }
-      if (stream) {
-        if (stream.writableLength > SPOOL_WRITE_HWM_BYTES) {
-          droppedBytes += textBytes;
-          return;
-        }
-        stream.write(text);
-      }
-    },
-    finalize() {
-      if (finalized) {
-        return filePath ? { path: filePath, bytes: totalBytes, droppedBytes } : null;
-      }
-      finalized = true;
-      head = "";
-      if (!stream || !filePath) return null;
-      try {
-        stream.end();
-      } catch {
-      }
-      return { path: filePath, bytes: totalBytes, droppedBytes };
-    }
-  };
-}
-
-// src/_win32-resolve.ts
-import * as fs from "node:fs";
-import * as path2 from "node:path";
-function resolveWin32Command(cmd) {
-  if (process.platform !== "win32") return cmd;
-  if (cmd.includes("/") || cmd.includes("\\") || path2.extname(cmd.replace(/\//g, "\\"))) {
-    return cmd;
-  }
-  const pathext = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC").toLowerCase().split(";");
-  const pathDirs = (process.env["PATH"] ?? "").split(path2.delimiter);
-  for (const dir of pathDirs) {
-    const base = path2.join(dir, cmd);
-    for (const ext of pathext) {
-      const full = `${base}${ext}`;
-      try {
-        fs.accessSync(full, fs.constants.X_OK);
-        return full;
-      } catch {
-      }
-    }
-  }
-  return cmd;
-}
-var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
-function assertSafeWin32ShellArgs(args) {
-  for (const arg of args) {
-    if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
-      throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
-      );
-    }
-  }
-}
-function buildWin32CmdShimInvocation(command, args = []) {
-  assertSafeWin32ShellArgs([command, ...args]);
-  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
-  return {
-    command: process.env["COMSPEC"] ?? "cmd.exe",
-    args: ["/d", "/c", line],
-    windowsVerbatimArguments: true
-  };
-}
-function quoteWin32CmdArg(arg) {
-  return `"${arg}"`;
-}
-
-// src/process-registry.ts
-import { spawn } from "node:child_process";
-import * as os from "node:os";
-
-// src/circuit-breaker.ts
-var DEFAULT_MAX_CONSECUTIVE_FAILURES = 5;
-var DEFAULT_SLOW_CALL_THRESHOLD_MS = 18e4;
-var DEFAULT_MAX_SLOW_CALLS = 3;
-var DEFAULT_WINDOW_MS = 6e4;
-var DEFAULT_MAX_CALLS_PER_WINDOW = 30;
-var DEFAULT_COOLDOWN_MS = 3e4;
-var CircuitBreaker = class {
-  maxConsecutiveFailures;
-  slowCallThresholdMs;
-  maxSlowCalls;
-  windowMs;
-  maxCallsPerWindow;
-  cooldownMs;
-  state = "closed";
-  consecutiveFailures = 0;
-  window = [];
-  lastFailureAt = null;
-  lastSlowAt = null;
-  /** Timestamp when the breaker was opened (for cooldown calculation). */
-  openedAt = null;
-  /**
-   * Master enable flag. When false the breaker is bypassed: `beforeCall`
-   * always returns true and `afterCall` records nothing. The class itself
-   * defaults to enabled (so the standalone unit tests exercise tripping); the
-   * ProcessRegistry flips this off until the user opts in via `/settings`.
-   */
-  enabled = true;
-  /**
-   * Fired (best-effort) when the breaker transitions into the `open` state.
-   * The registry uses this to arm its auto kill/reset countdown.
-   */
-  onTrip;
-  /**
-   * Fired (best-effort) when the breaker returns to `closed` after having been
-   * open/half-open. The registry uses this to cancel a pending kill/reset.
-   */
-  onReset;
-  constructor(config = {}) {
-    this.maxConsecutiveFailures = config.maxConsecutiveFailures ?? DEFAULT_MAX_CONSECUTIVE_FAILURES;
-    this.slowCallThresholdMs = config.slowCallThresholdMs ?? DEFAULT_SLOW_CALL_THRESHOLD_MS;
-    this.maxSlowCalls = config.maxSlowCalls ?? DEFAULT_MAX_SLOW_CALLS;
-    this.windowMs = config.windowMs ?? DEFAULT_WINDOW_MS;
-    this.maxCallsPerWindow = config.maxCallsPerWindow ?? DEFAULT_MAX_CALLS_PER_WINDOW;
-    this.cooldownMs = config.cooldownMs ?? DEFAULT_COOLDOWN_MS;
-  }
-  /** Toggle the master enable. Disabling resets to a clean `closed` state. */
-  setEnabled(enabled) {
-    if (this.enabled === enabled) return;
-    this.enabled = enabled;
-    if (!enabled) this._reset();
-  }
-  get isEnabled() {
-    return this.enabled;
-  }
-  /**
-   * Returns true if the circuit allows a new call to proceed.
-   * When false, callers should abort the tool call and return a
-   * circuit-breaker error instead of spawning a process.
-   */
-  get canProceed() {
-    if (!this.enabled) return true;
-    this._checkStateTransition();
-    return this.state !== "open";
-  }
-  /**
-   * Snapshot of the current breaker state for observability (`/kill`).
-   */
-  snapshot() {
-    this._checkStateTransition();
-    const now = Date.now();
-    let cooldownRemaining = null;
-    if (this.openedAt !== null && this.state === "open") {
-      const elapsed = now - this.openedAt;
-      cooldownRemaining = Math.max(0, this.cooldownMs - elapsed);
-    }
-    return {
-      state: this.state,
-      consecutiveFailures: this.consecutiveFailures,
-      slowCallsInWindow: this.window.filter((c) => c.slow).length,
-      callsInWindow: this.window.length,
-      windowMs: this.windowMs,
-      cooldownRemainingMs: cooldownRemaining,
-      lastFailureAt: this.lastFailureAt,
-      lastSlowAt: this.lastSlowAt
-    };
-  }
-  /**
-   * Call this BEFORE spawning a bash/exec process.
-   * Returns true if the call is allowed; false if the breaker is open.
-   * When false, callers MUST NOT spawn a process.
-   *
-   * @param bypass - If true, skip the circuit breaker check entirely.
-   *                  Use for background/fire-and-forget processes that should
-   *                  not affect breaker state.
-   */
-  beforeCall(bypass = false) {
-    if (bypass || !this.enabled) return true;
-    this._checkStateTransition();
-    if (this.state === "open") return false;
-    return true;
-  }
-  /**
-   * Call this AFTER a bash/exec process finishes (success or failure).
-   * `durationMs` is the wall-clock time the process ran.
-   * `failed` is true when the process returned a non-zero exit code or
-   * threw an exception before spawning.
-   *
-   * @param bypass - If true, do not update breaker state.
-   *                  Use for background/fire-and-forget processes.
-   */
-  afterCall(durationMs, failed, bypass = false) {
-    if (bypass || !this.enabled) return;
-    const now = Date.now();
-    if (this.state === "half-open") {
-      if (failed) {
-        this._trip();
-        return;
-      }
-      this._reset();
-      return;
-    }
-    this._pruneWindow(now);
-    const slow = durationMs >= this.slowCallThresholdMs;
-    this.window.push({ at: now, failed, slow });
-    if (failed) {
-      this.consecutiveFailures++;
-      this.lastFailureAt = now;
-      if (this.consecutiveFailures >= this.maxConsecutiveFailures) {
-        this._trip();
-      }
-      return;
-    }
-    this.consecutiveFailures = 0;
-    if (slow) {
-      this.lastSlowAt = now;
-      const slowCount = this.window.filter((c) => c.slow).length;
-      if (slowCount >= this.maxSlowCalls) {
-        this._trip();
-      }
-    }
-    const callCount = this.window.length;
-    if (callCount >= this.maxCallsPerWindow) {
-      this._trip();
-    }
-  }
-  /** Force the breaker open. Used by /kill force and Ctrl+C. */
-  forceOpen() {
-    this._trip();
-  }
-  /** Force a reset to closed. Used by tests and /kill reset. */
-  forceReset() {
-    this._reset();
-  }
-  _trip() {
-    if (this.state === "open") return;
-    this.state = "open";
-    this.openedAt = Date.now();
-    this.window = [];
-    try {
-      this.onTrip?.();
-    } catch {
-    }
-  }
-  _reset() {
-    const wasRecovering = this.state !== "closed";
-    this.state = "closed";
-    this.consecutiveFailures = 0;
-    this.window = [];
-    this.openedAt = null;
-    if (wasRecovering) {
-      try {
-        this.onReset?.();
-      } catch {
-      }
-    }
-  }
-  /** Transition from open → half-open when cooldown elapses. */
-  _checkStateTransition() {
-    if (this.state !== "open" || this.openedAt === null) return;
-    const elapsed = Date.now() - this.openedAt;
-    if (elapsed >= this.cooldownMs) {
-      this.state = "half-open";
-      this.openedAt = null;
-    }
-  }
-  _pruneWindow(now) {
-    const cutoff = now - this.windowMs;
-    this.window = this.window.filter((c) => c.at >= cutoff);
-  }
-};
-
-// src/_redact-command.ts
-import { expectDefined } from "@wrongstack/core/utils";
-var SENSITIVE_FLAG_PATTERNS = [
-  // --flag=value  or  --flag "value"  (value captured up to next space or comma)
-  /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
-  // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
-  // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
-  // The value must be token-like (>= 8 chars) so ordinary combined flags such
-  // as `tar -tf` / `ssh -tt` are not eaten. Global flag: EVERY occurrence is
-  // redacted, not just the first.
-  // NOTE: synced with @wrongstack/core observability/redact-command.ts.
-  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]{8,}/g,
-  // -p|-password|-a (redis auth) short flags: attached + separated + =value.
-  // Same token-start anchor; over-redaction is an accepted tradeoff for a
-  // redaction function. Synced with core copy.
-  /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
-  // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
-  // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
-  // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
-  // every such flag in the command line is redacted, not just the first.
-  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/g
-];
-function redactCommand(cmd) {
-  let result = cmd;
-  for (const pattern of SENSITIVE_FLAG_PATTERNS) {
-    result = result.replace(pattern, (match) => {
-      const eq = match.indexOf("=");
-      const sp = match.search(/\s/);
-      const delim = eq !== -1 ? "=" : sp !== -1 ? match[sp] : null;
-      if (delim !== null) {
-        const flag = match.slice(0, match.indexOf(expectDefined(delim)) + 1);
-        return `${flag}[REDACTED]`;
-      }
-      if (match.startsWith("--")) {
-        return match;
-      }
-      return `${match.slice(0, 2)}[REDACTED]`;
-    });
-  }
-  return result;
-}
-
-// src/process-registry.ts
-var DEFAULT_GRACE_MS = 2e3;
-var WIN32_TASKKILL_TIMEOUT_MS = 5e3;
-function killWin32Tree(pid, opts = {}) {
-  try {
-    const child = spawn("taskkill", ["/pid", String(pid), "/T", "/F"], {
-      stdio: "ignore",
-      windowsHide: true
-    });
-    let settled = false;
-    let timeout;
-    const settle = () => {
-      if (settled) return;
-      settled = true;
-      if (timeout) clearTimeout(timeout);
-      try {
-        opts.onSettled?.();
-      } catch {
-      }
-    };
-    child.on("error", settle);
-    child.on("close", settle);
-    timeout = setTimeout(
-      () => {
-        try {
-          child.kill();
-        } catch {
-        }
-        settle();
-      },
-      Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS)
-    );
-    timeout.unref?.();
-    child.unref();
-    return true;
-  } catch {
-    return false;
-  }
-}
-var ProcessRegistryImpl = class {
-  processes = /* @__PURE__ */ new Map();
-  breaker;
-  /**
-   * Auto kill/reset config. When the breaker trips and `autoKillResetMs > 0`,
-   * a countdown is armed; on expiry all tracked processes are killed and the
-   * breaker is reset to closed (forced recovery). Zero means manual recovery
-   * only (`/kill reset`).
-   */
-  autoKillResetMs = 0;
-  autoKillTimer = null;
-  autoKillArmedAt = null;
-  breakerCountdownListeners = [];
-  constructor(breakerConfig) {
-    this.breaker = new CircuitBreaker(breakerConfig);
-    this.breaker.onTrip = () => this._armAutoKillReset();
-    this.breaker.onReset = () => this._cancelAutoKillReset();
-    this.breaker.setEnabled(false);
-  }
-  register(info) {
-    this.processes.set(info.pid, {
-      ...info,
-      killed: false,
-      protected: info.protected ?? false,
-      background: info.background ?? false
-    });
-  }
-  _isSafeSignalPid(pid) {
-    return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
-  }
-  _canSignalProcessGroup(p) {
-    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && p.child !== null && typeof p.child.pid === "number" && p.child.pid === p.pid;
-  }
-  _killChildDirect(p, signal) {
-    try {
-      if (p.child) {
-        p.child.kill(signal);
-        return;
-      }
-      if (this._isSafeSignalPid(p.pid)) process.kill(p.pid, signal);
-    } catch {
-    }
-  }
-  _killPosix(p, signal) {
-    if (this._canSignalProcessGroup(p)) {
-      try {
-        process.kill(-p.pid, signal);
-        return;
-      } catch {
-      }
-    }
-    this._killChildDirect(p, signal);
-  }
-  /** Unregister a process by PID. Called on 'close' / 'exit' events. */
-  unregister(pid) {
-    this.processes.delete(pid);
-  }
-  /** Get a single process by PID. */
-  get(pid) {
-    this._pruneStale(pid);
-    return this.processes.get(pid);
-  }
-  /** Get all tracked processes. */
-  list() {
-    this._pruneAllStale();
-    return Array.from(this.processes.values());
-  }
-  /** Get processes filtered by name (e.g. 'bash', 'exec'). */
-  byName(name) {
-    return this.list().filter((p) => p.name === name);
-  }
-  /** Get processes filtered by session. */
-  bySession(sessionId) {
-    return this.list().filter((p) => p.sessionId === sessionId);
-  }
-  /** Count of active (non-killed) processes. */
-  get activeCount() {
-    let n = 0;
-    for (const p of this.processes.values()) {
-      if (!p.killed) n++;
-    }
-    return n;
-  }
-  /** Count of active jobs explicitly launched in background mode. */
-  get activeBackgroundCount() {
-    let n = 0;
-    for (const p of this.processes.values()) {
-      if (p.background && !p.killed) n++;
-    }
-    return n;
-  }
-  /**
-   * Combined stats for observability — used by /ps and the TUI status bar.
-   */
-  stats() {
-    this._pruneAllStale();
-    return {
-      activeCount: this.activeCount,
-      backgroundCount: this.activeBackgroundCount,
-      totalCount: this.processes.size,
-      breaker: this.breaker.snapshot()
-    };
-  }
-  /**
-   * Returns true if the circuit allows a new bash/exec call to proceed.
-   * When false, callers MUST NOT spawn a process.
-   */
-  get canProceed() {
-    return this.breaker.canProceed;
-  }
-  /**
-   * Called before spawning a process. Returns true if allowed; false if
-   * the circuit breaker is open.
-   *
-   * @param bypass - If true, skip circuit breaker check (for background processes).
-   */
-  beforeCall(bypass = false) {
-    return this.breaker.beforeCall(bypass);
-  }
-  /**
-   * Called after a process finishes. `durationMs` is wall-clock time;
-   * `failed` is true for non-zero exit codes.
-   *
-   * @param bypass - If true, do not update circuit breaker state (for background processes).
-   */
-  afterCall(durationMs, failed, bypass = false) {
-    this.breaker.afterCall(durationMs, failed, bypass);
-  }
-  /** Force-open the circuit breaker (Ctrl+C, /kill force). */
-  forceBreakerOpen() {
-    this.breaker.forceOpen();
-  }
-  /** Force-reset the circuit breaker to closed (/kill reset). */
-  forceBreakerReset() {
-    this.breaker.forceReset();
-  }
-  /**
-   * Configure circuit-breaker protection at runtime. Called from `/settings`
-   * (instant, all modes) and on TUI mount (applies persisted config).
-   *
-   * - `enabled` toggles whether the breaker gates `bash`/`exec`.
-   * - `autoKillResetMs` arms the auto kill/reset countdown when the breaker
-   *   trips (0 = manual recovery only).
-   *
-   * Re-applies cleanly on every call: cancels a pending countdown when the
-   * timeout is cleared or protection disabled, and re-arms if the breaker is
-   * currently open under the new settings.
-   */
-  setBreakerConfig(cfg) {
-    if (cfg.enabled !== void 0) this.breaker.setEnabled(cfg.enabled);
-    if (cfg.autoKillResetMs !== void 0) this.autoKillResetMs = Math.max(0, cfg.autoKillResetMs);
-    if (this.autoKillResetMs <= 0) {
-      this._cancelAutoKillReset();
-      return;
-    }
-    if (this.breaker.isEnabled && this.breaker.snapshot().state === "open") {
-      this._armAutoKillReset();
-    }
-  }
-  /**
-   * Live countdown to the next auto kill/reset, or null when nothing is armed.
-   * The TUI polls this on a 1s tick while armed so the statusline decrements.
-   */
-  getBreakerCountdown() {
-    if (this.autoKillArmedAt === null || this.autoKillResetMs <= 0) return null;
-    const elapsed = Date.now() - this.autoKillArmedAt;
-    return {
-      remainingMs: Math.max(0, this.autoKillResetMs - elapsed),
-      totalMs: this.autoKillResetMs
-    };
-  }
-  /**
-   * Subscribe to countdown arm/cancel events. Returns an unsubscribe function.
-   * Use {@link getBreakerCountdown} for the live ticking value between events.
-   */
-  onBreakerCountdownChange(listener) {
-    this.breakerCountdownListeners.push(listener);
-    return () => {
-      this.breakerCountdownListeners = this.breakerCountdownListeners.filter((l) => l !== listener);
-    };
-  }
-  _emitBreakerCountdown() {
-    const snap = this.getBreakerCountdown();
-    for (const l of this.breakerCountdownListeners) {
-      try {
-        l(snap);
-      } catch {
-      }
-    }
-  }
-  /**
-   * Arm the auto kill/reset countdown. Idempotent: re-arming resets the window
-   * (a fresh trip after a failed half-open probe restarts the clock). No-op
-   * when protection is off or no timeout is configured.
-   */
-  _armAutoKillReset() {
-    if (this.autoKillResetMs <= 0 || !this.breaker.isEnabled) return;
-    this._clearAutoKillTimer();
-    this.autoKillArmedAt = Date.now();
-    this.autoKillTimer = setTimeout(() => {
-      this.autoKillTimer = null;
-      this.autoKillArmedAt = null;
-      this.killAll({ force: false, preserveBackground: true });
-      this.breaker.forceReset();
-      this._emitBreakerCountdown();
-    }, this.autoKillResetMs);
-    this.autoKillTimer.unref?.();
-    this._emitBreakerCountdown();
-  }
-  _cancelAutoKillReset() {
-    const wasArmed = this.autoKillArmedAt !== null;
-    this._clearAutoKillTimer();
-    if (wasArmed) {
-      this.autoKillArmedAt = null;
-      this._emitBreakerCountdown();
-    }
-  }
-  _clearAutoKillTimer() {
-    if (this.autoKillTimer !== null) {
-      clearTimeout(this.autoKillTimer);
-      this.autoKillTimer = null;
-    }
-  }
-  /** Kill a single process by PID.
-   *
-   *  On POSIX: sends SIGTERM to the *process group* (-pid) so that
-   *  runaway grandchild processes (`sleep 9999 & disown`) are also killed.
-   *  After `graceMs` a SIGKILL is sent if the process hasn't exited.
-   *
-   *  On Windows: `child.kill()` maps to TerminateProcess — process groups
-   *  are not meaningfully supported. A second `force=true` call sends
-   *  SIGKILL (which maps to TerminateProcess again — the distinction is
-   *  in the exit code, not the signal).
-   *
-   *  Returns true if the process was found and kill was attempted.
-   */
-  kill(pid, opts = {}) {
-    this._pruneStale(pid);
-    const p = this.processes.get(pid);
-    if (!p) return false;
-    if (p.killed && opts.force !== true) return true;
-    if (p.protected && opts.includeProtected !== true) return false;
-    if (opts.preserveBackground && p.background) return false;
-    const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
-    const isWin2 = os.platform() === "win32";
-    if (isWin2) {
-      const liveRealChild = p.child === null || p.child.exitCode === null && typeof p.child.pid === "number";
-      const directFallback = () => {
-        if (p.child && p.child.exitCode === null) {
-          try {
-            p.child.kill("SIGKILL");
-          } catch {
-          }
-        }
-      };
-      if (liveRealChild && killWin32Tree(pid, {
-        timeoutMs: Math.max(graceMs, WIN32_TASKKILL_TIMEOUT_MS),
-        onSettled: directFallback
-      })) {
-      } else {
-        this._killChildDirect(p, force ? "SIGKILL" : "SIGTERM");
-      }
-      p.killed = true;
-      return true;
-    }
-    try {
-      if (force) {
-        this._killPosix(p, "SIGKILL");
-      } else {
-        this._killPosix(p, "SIGTERM");
-        const timer = setTimeout(() => {
-          if (this.processes.has(pid) && !p.child?.killed) {
-            this._killPosix(p, "SIGKILL");
-          }
-        }, graceMs);
-        timer.unref?.();
-      }
-    } catch {
-    }
-    p.killed = true;
-    return true;
-  }
-  /**
-   * Kill all tracked processes.
-   * Returns the PIDs that were kill()ed.
-   */
-  killAll(opts = {}) {
-    const pids = Array.from(this.processes.keys());
-    const killed = [];
-    const includeProtected = opts.includeProtected === true;
-    for (const pid of pids) {
-      const p = this.processes.get(pid);
-      if (!p) continue;
-      if (p.protected && !includeProtected) continue;
-      if (opts.preserveBackground && p.background) continue;
-      if (this.kill(pid, opts)) killed.push(pid);
-    }
-    return killed;
-  }
-  /**
-   * Kill all processes for a specific session.
-   * Returns the PIDs that were kill()ed.
-   */
-  killSession(sessionId, opts = {}) {
-    const pids = this.bySession(sessionId).map((p) => p.pid);
-    const killed = [];
-    for (const pid of pids) {
-      if (this.kill(pid, opts)) killed.push(pid);
-    }
-    return killed;
-  }
-  /**
-   * Check whether a tracked process entry is stale — the child has exited
-   * (exitCode !== null) AND it's been in the registry long enough that the
-   * OS may have reused the PID for a new, unrelated process.
-   *
-   * P3 #24 (before-release.md): on POSIX, PIDs are reused after process
-   * exit. If a tracked process exits but its 'close' event hasn't fired yet
-   * (or was missed), the registry still holds the entry. A new process
-   * gets the same PID, and PID-based lookups (get, kill, shouldBlockKill)
-   * may incorrectly protect or target the wrong process.
-   *
-   * The 60s threshold is conservative — the OS typically waits much longer
-   * before reusing a PID, but we want to clean up before that becomes a risk.
-   */
-  _isStaleEntry(entry) {
-    if (entry.child === null) {
-      if (Date.now() - entry.startedAt <= 6e4) return false;
-      if (os.platform() === "win32") return false;
-      try {
-        process.kill(entry.pid, 0);
-        return false;
-      } catch (err) {
-        return err.code !== "EPERM";
-      }
-    }
-    return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
-  }
-  /**
-   * Remove a stale entry for a specific PID before any PID-based lookup.
-   * This prevents PID reuse from causing the registry to act on a dead
-   * process that has been replaced by a new one with the same PID.
-   */
-  _pruneStale(pid) {
-    const entry = this.processes.get(pid);
-    if (entry && this._isStaleEntry(entry)) {
-      this.processes.delete(pid);
-    }
-  }
-  /**
-   * Remove every stale entry, not just one PID. `list()`/`stats()` — the
-   * surfaces the TUI status bar and `/ps` poll — must prune too: a child
-   * whose 'close' event never fires (e.g. Windows grandchildren holding stdio
-   * open) would otherwise linger in the registry until someone looks up its
-   * exact PID, and PID reuse meanwhile makes `get()`/`kill()` target the
-   * wrong process. RAM-leak audit 2026-07-31, MEDIUM.
-   */
-  _pruneAllStale() {
-    for (const [pid, entry] of this.processes) {
-      if (this._isStaleEntry(entry)) this.processes.delete(pid);
-    }
-  }
-};
-var _registry;
-function getProcessRegistry() {
-  if (!_registry) {
-    _registry = new ProcessRegistryImpl();
-  }
-  return _registry;
-}
-
-// src/_spawn-stream.ts
-var isWin = process.platform === "win32";
-async function* spawnStream(opts) {
-  const max = opts.maxBytes ?? 999999999;
-  const flushAt = opts.flushBytes ?? 4 * 1024;
-  const maxQueue = opts.maxQueueSize ?? 500;
-  const maxQueueBytes = opts.maxQueueBytes ?? 1024 * 1024;
-  let stdout = "";
-  let stderr = "";
-  let stdoutRetainedBytes = 0;
-  let stderrRetainedBytes = 0;
-  let pending = "";
-  let error;
-  const spool = createOutputSpool({ tool: opts.cmd, thresholdBytes: max });
-  const resolved = resolveWin32Command(opts.cmd);
-  const needsShell = isWin && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
-  const shim = needsShell ? buildWin32CmdShimInvocation(resolved, opts.args) : null;
-  const cmd = shim?.command ?? resolved;
-  const args = shim?.args ?? opts.args;
-  const child = spawn2(cmd, args, {
-    cwd: opts.cwd,
-    env: buildChildEnv(),
-    stdio: ["ignore", "pipe", "pipe"],
-    windowsHide: true,
-    ...isWin ? {} : { signal: opts.signal },
-    ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
-  });
-  const registry = getProcessRegistry();
-  const pid = child.pid;
-  const processStartedAt = Date.now();
-  let stdoutBytes = 0;
-  let stderrBytes = 0;
-  let telemetryCompleted = false;
-  emitProcessStarted({
-    ...pid !== void 0 ? { pid } : {},
-    parentPid: process.pid,
-    command: redactCommand(`${opts.cmd} ${opts.args.join(" ")}`),
-    args: redactCommand(opts.args.join(" ")).split(" ").filter(Boolean),
-    cwd: opts.cwd,
-    background: false,
-    startedAt: new Date(processStartedAt).toISOString()
-  });
-  if (typeof pid === "number") {
-    registry.register({
-      pid,
-      name: opts.cmd,
-      command: redactCommand(`${opts.cmd} ${opts.args.join(" ")}`),
-      startedAt: Date.now(),
-      child
-    });
-  }
-  const queue = [];
-  let queuedBytes = 0;
-  let waiter;
-  let paused = false;
-  const wake = () => {
-    if (waiter) {
-      const w = waiter;
-      waiter = void 0;
-      w();
-    }
-  };
-  const resume = () => {
-    if (paused && queue.length <= Math.floor(maxQueue / 2) && queuedBytes <= Math.floor(maxQueueBytes / 2)) {
-      paused = false;
-      child.stdout?.resume();
-      child.stderr?.resume();
-    }
-  };
-  const onOut = (c) => {
-    const s = c.toString();
-    stdoutBytes += c.byteLength;
-    emitProcessOutput({ pid, stream: "stdout", chunk: c });
-    if (stdoutRetainedBytes < max) {
-      const retained = utf8Prefix(s, max - stdoutRetainedBytes);
-      stdout += retained;
-      stdoutRetainedBytes += Buffer.byteLength(retained, "utf8");
-    }
-    spool.write(s);
-    queue.push({ kind: "out", data: s, bytes: c.byteLength });
-    queuedBytes += c.byteLength;
-    wake();
-    if (!paused && (queue.length >= maxQueue || queuedBytes >= maxQueueBytes)) {
-      paused = true;
-      child.stdout?.pause();
-      child.stderr?.pause();
-    }
-  };
-  const onErr = (c) => {
-    const s = c.toString();
-    stderrBytes += c.byteLength;
-    emitProcessOutput({ pid, stream: "stderr", chunk: c });
-    if (stderrRetainedBytes < max) {
-      const retained = utf8Prefix(s, max - stderrRetainedBytes);
-      stderr += retained;
-      stderrRetainedBytes += Buffer.byteLength(retained, "utf8");
-    }
-    spool.write(s);
-    queue.push({ kind: "err", data: s, bytes: c.byteLength });
-    queuedBytes += c.byteLength;
-    wake();
-    if (!paused && (queue.length >= maxQueue || queuedBytes >= maxQueueBytes)) {
-      paused = true;
-      child.stdout?.pause();
-      child.stderr?.pause();
-    }
-  };
-  child.stdout?.on("data", onOut);
-  child.stderr?.on("data", onErr);
-  child.on("error", (e) => {
-    error = e.message;
-    const bytes = Buffer.byteLength(e.message, "utf8");
-    queue.push({ kind: "error", data: e.message, bytes });
-    queuedBytes += bytes;
-    wake();
-  });
-  const completeTelemetry = (code, signal, timedOut = false) => {
-    if (telemetryCompleted) return;
-    telemetryCompleted = true;
-    emitProcessCompleted({
-      ...pid !== void 0 ? { pid } : {},
-      exitCode: code,
-      ...signal ? { signal } : {},
-      durationMs: Date.now() - processStartedAt,
-      stdoutBytes,
-      stderrBytes,
-      timedOut,
-      endedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-  };
-  child.on("close", (code, signal) => {
-    if (typeof pid === "number") registry.unregister(pid);
-    const exitCode2 = code ?? (signal ? 1 : 0);
-    completeTelemetry(exitCode2, signal ?? void 0);
-    queue.push({
-      kind: "close",
-      data: "",
-      bytes: 0,
-      code: exitCode2,
-      ...signal ? { signal } : {}
-    });
-    wake();
-  });
-  const onAbort = () => {
-    if (typeof pid === "number") {
-      registry.kill(pid, { force: true });
-    } else {
-      try {
-        child.kill("SIGKILL");
-      } catch {
-      }
-    }
-    queue.push({ kind: "close", data: "", bytes: 0, code: 124 });
-    completeTelemetry(124, "SIGKILL", true);
-    wake();
-  };
-  if (isWin) {
-    if (opts.signal.aborted) onAbort();
-    else opts.signal.addEventListener("abort", onAbort, { once: true });
-  }
-  let exitCode = 0;
-  let spawnFailed = false;
-  try {
-    for (; ; ) {
-      while (queue.length === 0) {
-        await new Promise((resolve6) => {
-          waiter = resolve6;
-        });
-      }
-      const chunk = queue.shift();
-      queuedBytes -= chunk.bytes;
-      resume();
-      if (chunk.kind === "close") {
-        if (!spawnFailed) exitCode = chunk.code ?? 0;
-        break;
-      }
-      if (chunk.kind === "error") {
-        spawnFailed = true;
-        exitCode = 1;
-        continue;
-      }
-      pending += chunk.data;
-      if (pending.length >= flushAt) {
-        yield { type: "partial_output", text: pending };
-        pending = "";
-      }
-    }
-    if (pending.length > 0) {
-      yield { type: "partial_output", text: pending };
-    }
-    const spooled = spool.finalize();
-    return {
-      // The marker rides on stdout's tail so every consumer's head+tail
-      // normalization keeps it without per-tool changes.
-      stdout: spooled ? stdout + spoolNote(spooled) : stdout,
-      stderr,
-      exitCode,
-      truncated: stdoutBytes > stdoutRetainedBytes || stderrBytes > stderrRetainedBytes,
-      error,
-      spoolPath: spooled?.path,
-      spoolBytes: spooled?.bytes
-    };
-  } finally {
-    spool.finalize();
-    if (isWin) opts.signal.removeEventListener("abort", onAbort);
-    child.stdout?.off("data", onOut);
-    child.stderr?.off("data", onErr);
-    child.stdout?.destroy();
-    child.stderr?.destroy();
-    if (child.exitCode === null && !child.killed) {
-      if (typeof pid === "number") {
-        registry.kill(pid, { force: true });
-      } else {
-        try {
-          child.kill("SIGKILL");
-        } catch {
-        }
-      }
-    }
-  }
-}
-function utf8Prefix(text, maxBytes) {
-  if (maxBytes <= 0) return "";
-  if (Buffer.byteLength(text, "utf8") <= maxBytes) return text;
-  let low = 0;
-  let high = text.length;
-  while (low < high) {
-    const mid = Math.ceil((low + high) / 2);
-    if (Buffer.byteLength(text.slice(0, mid), "utf8") <= maxBytes) low = mid;
-    else high = mid - 1;
-  }
-  let end = low;
-  if (end > 0 && /[\uD800-\uDBFF]/.test(text[end - 1])) end--;
-  return text.slice(0, end);
-}
-
-// src/_util.ts
-import * as fsp2 from "node:fs/promises";
-import * as path3 from "node:path";
-import * as Core from "@wrongstack/core/utils";
-async function detectPackageManager(cwd, stopAt) {
-  let dir = path3.resolve(cwd);
-  const stop = stopAt ? path3.resolve(stopAt) : dir;
-  for (; ; ) {
-    const found = await detectPackageManagerInDir(dir);
-    if (found) return found;
-    if (dir === stop) break;
-    const parent = path3.dirname(dir);
-    const relParent = path3.relative(stop, parent);
-    if (parent === dir || relParent.startsWith("..") || path3.isAbsolute(relParent)) break;
-    dir = parent;
-  }
-  return "npm";
-}
-async function detectPackageManagerInDir(dir) {
-  const fs6 = await import("node:fs/promises");
-  try {
-    const raw = await fs6.readFile(path3.join(dir, "package.json"), "utf8");
-    const declared = JSON.parse(raw).packageManager;
-    if (typeof declared === "string") {
-      const name = declared.split("@")[0] ?? "";
-      if (name === "pnpm" || name === "yarn") return name;
-      if (name === "npm" || name === "bun") return "npm";
-    }
-  } catch {
-  }
-  const lockfiles = [
-    ["pnpm-lock.yaml", "pnpm"],
-    ["yarn.lock", "yarn"],
-    ["bun.lockb", "npm"],
-    ["bun.lock", "npm"],
-    ["package-lock.json", "npm"],
-    ["npm-shrinkwrap.json", "npm"]
-  ];
-  for (const [file, manager] of lockfiles) {
-    try {
-      await fs6.stat(`${dir}/${file}`);
-      return manager;
-    } catch {
-    }
-  }
-  return null;
-}
-function resolvePath(input, ctx) {
-  return path3.isAbsolute(input) ? path3.normalize(input) : path3.resolve(ctx.workingDir ?? ctx.cwd, input);
-}
-function allowedRoots(ctx) {
-  return [path3.resolve(ctx.projectRoot), path3.resolve(Core.wstackGlobalRoot())];
-}
-function isInsideAny(target, roots) {
-  return roots.some((root) => {
-    const rel = path3.relative(root, target);
-    return rel === "" || !rel.startsWith("..") && !path3.isAbsolute(rel);
-  });
-}
-function ensureInsideRoot(absPath, ctx) {
-  const target = path3.resolve(absPath);
-  if (ctx.allowOutsideProjectRoot) return target;
-  if (isInsideAny(target, allowedRoots(ctx))) return target;
-  throw new Error(`Path "${absPath}" is outside project root "${path3.resolve(ctx.projectRoot)}"`);
-}
-function safeResolve(input, ctx) {
-  return ensureInsideRoot(resolvePath(input, ctx), ctx);
-}
-async function resolveRealInsideRoot(absPath, ctx) {
-  if (ctx.allowOutsideProjectRoot) return absPath;
-  const realRoots = await Promise.all(
-    allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path3.resolve(r)))
-  );
-  let probe = absPath;
-  const pendingTail = [];
-  for (; ; ) {
-    let real;
-    try {
-      real = await fsp2.realpath(probe);
-    } catch (err) {
-      if (err.code === "ENOENT") {
-        const parent = path3.dirname(probe);
-        if (parent === probe) return absPath;
-        pendingTail.unshift(path3.basename(probe));
-        probe = parent;
-        continue;
-      }
-      throw err;
-    }
-    const candidate = pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
-    if (isInsideAny(candidate, realRoots)) {
-      return candidate;
-    }
-    throw new Error(
-      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
-    );
-  }
-}
-async function safeResolveReal(input, ctx) {
-  const abs = safeResolve(input, ctx);
-  return await resolveRealInsideRoot(abs, ctx);
-}
-var COMMAND_OUTPUT_MAX_BYTES = 32768;
-var REPEAT_RUN_THRESHOLD = 3;
-function collapseCarriageReturns(text) {
-  const lf = text.replace(/\r\n/g, "\n");
-  if (!lf.includes("\r")) return lf;
-  return lf.split("\n").map((line) => line.includes("\r") ? line.slice(line.lastIndexOf("\r") + 1) : line).join("\n");
-}
-function collapseConsecutiveDuplicates(text, minRun = REPEAT_RUN_THRESHOLD) {
-  const lines = text.split("\n");
-  const out = [];
-  let i = 0;
-  while (i < lines.length) {
-    let j = i + 1;
-    while (j < lines.length && lines[j] === lines[i]) j++;
-    const run = j - i;
-    if (run >= minRun) {
-      out.push(lines[i], `\u2026 \u27E8repeated ${run}\xD7\u27E9`);
-    } else {
-      for (let k = i; k < j; k++) out.push(lines[k]);
-    }
-    i = j;
-  }
-  return out.join("\n");
-}
-function takeHeadBytes(s, maxBytes) {
-  if (maxBytes <= 0) return "";
-  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
-  let lo = 0;
-  let hi = s.length;
-  while (lo < hi) {
-    const mid = Math.ceil((lo + hi) / 2);
-    if (Buffer.byteLength(s.slice(0, mid), "utf8") <= maxBytes) lo = mid;
-    else hi = mid - 1;
-  }
-  return s.slice(0, lo);
-}
-function takeTailBytes(s, maxBytes) {
-  if (maxBytes <= 0) return "";
-  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
-  let lo = 0;
-  let hi = s.length;
-  while (lo < hi) {
-    const mid = Math.ceil((lo + hi) / 2);
-    if (Buffer.byteLength(s.slice(s.length - mid), "utf8") <= maxBytes) lo = mid;
-    else hi = mid - 1;
-  }
-  return s.slice(s.length - lo);
-}
-function truncateHeadTail(s, maxBytes) {
-  const total = Buffer.byteLength(s, "utf8");
-  if (total <= maxBytes) return s;
-  const MARKER_RESERVE = 64;
-  const avail = Math.max(0, maxBytes - MARKER_RESERVE);
-  const headBudget = Math.floor(avail * 0.45);
-  const head = takeHeadBytes(s, headBudget);
-  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, "utf8"));
-  const kept = Buffer.byteLength(head, "utf8") + Buffer.byteLength(tail, "utf8");
-  return `${head}
-\u2026[truncated ${total - kept} bytes]\u2026
-${tail}`;
-}
-function normalizeCommandOutput(raw, opts = {}) {
-  if (!raw) return raw;
-  let text = Core.stripAnsi(raw);
-  text = collapseCarriageReturns(text);
-  text = text.replace(/[ \t]+$/gm, "");
-  text = collapseConsecutiveDuplicates(text);
-  text = text.replace(/\n{3,}/g, "\n\n");
-  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);
-}
-
-// src/languages/legacy-bridge.ts
-import * as fs5 from "node:fs/promises";
-import * as path8 from "node:path";
-
-// src/languages/detect.ts
-import { createHash } from "node:crypto";
-import * as fs2 from "node:fs/promises";
-import * as path4 from "node:path";
-
-// src/languages/profile-helpers.ts
-var DEFAULT_TIMEOUT_MS = 12e4;
-var DEFAULT_OUTPUT_LIMIT_BYTES = 2e5;
-function processPlan(ctx, operation, command, args, options) {
-  return {
-    profileId: ctx.workspace.language,
-    workspaceId: ctx.workspace.id,
-    operation,
-    kind: "process",
-    command,
-    args: Object.freeze([...args]),
-    cwd: ctx.workspace.root,
-    env: Object.freeze({}),
-    timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
-    outputLimitBytes: DEFAULT_OUTPUT_LIMIT_BYTES,
-    mutating: options.mutating ?? false,
-    network: options.network ?? false,
-    executesProjectCode: options.executesProjectCode ?? false,
-    reason: options.reason,
-    evidence: ctx.workspace.evidence,
-    parser: options.parser
-  };
-}
-function internalPlan(ctx, operation, parser, reason) {
-  return {
-    profileId: ctx.workspace.language,
-    workspaceId: ctx.workspace.id,
-    operation,
-    kind: "internal",
-    command: null,
-    args: Object.freeze([]),
-    cwd: ctx.workspace.root,
-    env: Object.freeze({}),
-    timeoutMs: 5e3,
-    outputLimitBytes: 32768,
-    mutating: false,
-    network: false,
-    executesProjectCode: false,
-    reason,
-    evidence: ctx.workspace.evidence,
-    parser
-  };
-}
-function unavailable(ctx, operation, reason) {
-  return {
-    status: "unavailable",
-    profileId: ctx.workspace.language,
-    workspaceId: ctx.workspace.id,
-    operation,
-    reason
-  };
-}
-function packageNames(ctx) {
-  return ctx.options.packages ?? [];
-}
-
-// src/languages/profiles/additional.ts
-var IGNORES = Object.freeze([
-  ".git",
-  ".wrongstack",
-  "node_modules",
-  "vendor",
-  "dist",
-  "build",
-  "coverage"
-]);
-function pythonProfile() {
-  return {
-    id: "python",
-    displayName: "Python",
-    extensions: Object.freeze([".py", ".pyi"]),
-    lspLanguageIds: Object.freeze(["python"]),
-    detectors: Object.freeze([
-      { kind: "config", filename: "pyproject.toml", weight: 90 },
-      { kind: "config", filename: "setup.py", weight: 70 },
-      { kind: "config", filename: "setup.cfg", weight: 60 },
-      { kind: "manifest", filename: "requirements.txt", weight: 55 },
-      { kind: "manifest", filename: "Pipfile", weight: 50 },
-      { kind: "lockfile", filename: "poetry.lock", weight: 30 },
-      { kind: "lockfile", filename: "Pipfile.lock", weight: 30 },
-      { kind: "lockfile", filename: "uv.lock", weight: 30 }
-    ]),
-    ignoredDirectories: IGNORES,
-    packageManagers: Object.freeze(["pip", "poetry", "pipenv", "uv"]),
-    executables: Object.freeze([
-      "python",
-      "python3",
-      "pip",
-      "pip3",
-      "poetry",
-      "pipenv",
-      "uv",
-      "ruff",
-      "black",
-      "pytest",
-      "mypy",
-      "pyright"
-    ]),
-    operations: Object.freeze({
-      syntax: async (ctx) => {
-        const py = ctx.options.target ? "python3" : "python3";
-        return ctx.options.target ? processPlan(ctx, "syntax", py, ["-m", "py_compile", ctx.options.target], {
-          parser: "python",
-          reason: "Compile the target file to check for syntax errors."
-        }) : unavailable(ctx, "syntax", "Python syntax check requires an explicit target file.");
-      },
-      semantic: async (ctx) => processPlan(ctx, "semantic", "mypy", [".", "--no-error-summary"], {
-        parser: "mypy",
-        reason: "Run mypy type checking on the workspace.",
-        executesProjectCode: true
-      }),
-      lint: async (ctx) => processPlan(ctx, "lint", "ruff", ["check", "."], {
-        parser: "ruff",
-        reason: "Run the Ruff linter on the workspace."
-      }),
-      "format-check": async (ctx) => processPlan(ctx, "format-check", "ruff", ["format", "--check", "."], {
-        parser: "ruff",
-        reason: "Check Python formatting without writing files."
-      }),
-      "format-write": async (ctx) => processPlan(ctx, "format-write", "ruff", ["format", "."], {
-        parser: "ruff",
-        reason: "Format Python source files.",
-        mutating: true
-      }),
-      test: async (ctx) => processPlan(
-        ctx,
-        "test",
-        "pytest",
-        [...ctx.options.filter ? ["-k", ctx.options.filter] : [], "."],
-        {
-          parser: "pytest",
-          reason: ctx.options.filter ? "Run filtered Python tests." : "Run all Python tests.",
-          mutating: true,
-          executesProjectCode: true
-        }
-      ),
-      build: async (ctx) => unavailable(ctx, "build", "Python is interpreted; use semantic or test instead."),
-      "debug-compile": async (ctx) => processPlan(ctx, "debug-compile", "mypy", [".", "--no-error-summary"], {
-        parser: "mypy",
-        reason: "Collect mypy type diagnostics.",
-        executesProjectCode: true
-      }),
-      "package-install": async (ctx) => processPlan(ctx, "package-install", "pip", ["install", "--no-cache-dir"], {
-        parser: "package-text",
-        reason: "Install dependencies from requirements.",
-        mutating: true,
-        network: true
-      }),
-      "package-add": async (ctx) => {
-        const names = packageNames(ctx);
-        return names.length === 0 ? unavailable(ctx, "package-add", "At least one package name is required.") : processPlan(ctx, "package-add", "pip", ["install", ...names], {
-          parser: "package-text",
-          reason: "Install specified Python packages.",
-          mutating: true,
-          network: true
-        });
-      },
-      "package-remove": async (ctx) => {
-        const names = packageNames(ctx);
-        return names.length === 0 ? unavailable(ctx, "package-remove", "At least one package name is required.") : processPlan(ctx, "package-remove", "pip", ["uninstall", "--yes", ...names], {
-          parser: "package-text",
-          reason: "Remove validated Python packages.",
-          mutating: true
-        });
-      },
-      "package-audit": async (ctx) => processPlan(ctx, "package-audit", "pip", ["audit"], {
-        parser: "pip-audit",
-        reason: "Audit Python dependencies for vulnerabilities.",
-        network: true
-      }),
-      run: async (ctx) => {
-        const entries = ["main.py", "app.py", "__main__.py", "manage.py"];
-        const first = (await Promise.all(
-          entries.map((name) => ctx.pathExists(name).then((ok) => ok ? name : void 0))
-        )).find(Boolean);
-        const args = first ? [first] : [];
-        return processPlan(ctx, "run", "python3", args, {
-          parser: "command-text",
-          reason: first ? `Run the Python entry point ${first}.` : "Run the Python project (no common entry point detected \u2014 add the module path manually).",
-          executesProjectCode: true,
-          mutating: true
-        });
-      }
-    })
-  };
-}
-function hasGradleEvidence(ctx) {
-  return ctx.workspace.evidence.some(
-    (e) => e.kind === "manifest" && (e.value === "build.gradle" || e.value === "build.gradle.kts" || e.value === "settings.gradle") || e.kind === "lockfile" && e.value === "gradle.lockfile"
-  );
-}
-async function gradleRunner(ctx) {
-  if (await ctx.pathExists("gradlew")) return "gradlew";
-  return "gradle";
-}
-function javaProfile() {
-  return {
-    id: "java",
-    displayName: "Java / Kotlin",
-    extensions: Object.freeze([".java", ".kt", ".kts", ".scala"]),
-    lspLanguageIds: Object.freeze(["java", "kotlin"]),
-    detectors: Object.freeze([
-      { kind: "manifest", filename: "pom.xml", weight: 90 },
-      { kind: "manifest", filename: "build.gradle", weight: 85 },
-      { kind: "manifest", filename: "build.gradle.kts", weight: 85 },
-      { kind: "manifest", filename: "settings.gradle", weight: 50 },
-      { kind: "lockfile", filename: "gradle.lockfile", weight: 30 }
-    ]),
-    ignoredDirectories: IGNORES,
-    packageManagers: Object.freeze(["maven", "gradle"]),
-    executables: Object.freeze(["mvn", "gradle", "gradlew", "java", "kotlinc"]),
-    operations: Object.freeze({
-      semantic: async (ctx) => {
-        const isGradle = hasGradleEvidence(ctx);
-        const runner = isGradle ? await gradleRunner(ctx) : "mvn";
-        const args = isGradle ? ["compileJava"] : ["compile", "-q"];
-        const reason = isGradle ? "Compile the Gradle project." : "Compile the Maven project.";
-        return processPlan(ctx, "semantic", runner, args, {
-          parser: isGradle ? "gradle" : "maven",
-          reason,
-          mutating: true,
-          executesProjectCode: true
-        });
-      },
-      lint: async (ctx) => unavailable(
-        ctx,
-        "lint",
-        "Java linting requires a configured checkstyle or spotbugs plugin."
-      ),
-      "format-check": async (ctx) => unavailable(
-        ctx,
-        "format-check",
-        "Java formatting check requires a configured spotless or google-java-format plugin."
-      ),
-      test: async (ctx) => {
-        const isGradle = hasGradleEvidence(ctx);
-        const runner = isGradle ? await gradleRunner(ctx) : "mvn";
-        const args = isGradle ? ["test"] : ["test", "-q"];
-        const reason = isGradle ? "Run Gradle tests." : "Run Maven tests.";
-        return processPlan(ctx, "test", runner, args, {
-          parser: isGradle ? "gradle" : "maven",
-          reason,
-          mutating: true,
-          executesProjectCode: true
-        });
-      },
-      build: async (ctx) => {
-        const isGradle = hasGradleEvidence(ctx);
-        const runner = isGradle ? await gradleRunner(ctx) : "mvn";
-        const args = isGradle ? ["build"] : ["package", "-q", "-DskipTests"];
-        const reason = isGradle ? "Build the Gradle project." : "Build the Maven project, skipping tests.";
-        return processPlan(ctx, "build", runner, args, {
-          parser: isGradle ? "gradle" : "maven",
-          reason,
-          mutating: true,
-          executesProjectCode: true
-        });
-      },
-      run: async (ctx) => {
-        if (!hasGradleEvidence(ctx))
-          return unavailable(
-            ctx,
-            "run",
-            "Maven run requires exec-maven-plugin configuration. Use `mvn exec:java -q` manually."
-          );
-        const runner = await gradleRunner(ctx);
-        return processPlan(ctx, "run", runner, ["run"], {
-          parser: "command-text",
-          reason: `Run the Gradle project entry point via ${runner}.`,
-          executesProjectCode: true,
-          mutating: true
-        });
-      },
-      "package-install": async (ctx) => unavailable(
-        ctx,
-        "package-install",
-        "JVM dependency installation happens through build or dependency:get."
-      ),
-      "package-add": async (ctx) => {
-        const names = packageNames(ctx);
-        return names.length === 0 ? unavailable(ctx, "package-add", "At least one dependency coordinate is required.") : processPlan(ctx, "package-add", "mvn", ["dependency:get", `-Dartifact=${names[0]}`], {
-          parser: "maven",
-          reason: "Resolve and fetch a Maven dependency.",
-          mutating: true,
-          network: true
-        });
-      }
-    })
-  };
-}
-function rubyProfile() {
-  return {
-    id: "ruby",
-    displayName: "Ruby",
-    extensions: Object.freeze([".rb"]),
-    lspLanguageIds: Object.freeze(["ruby"]),
-    detectors: Object.freeze([
-      { kind: "manifest", filename: "Gemfile", weight: 90 },
-      { kind: "config", filename: ".ruby-version", weight: 40 },
-      { kind: "lockfile", filename: "Gemfile.lock", weight: 30 }
-    ]),
-    ignoredDirectories: IGNORES,
-    packageManagers: Object.freeze(["gem", "bundler"]),
-    executables: Object.freeze(["ruby", "gem", "bundle", "rubocop", "rspec"]),
-    operations: Object.freeze({
-      syntax: async (ctx) => ctx.options.target ? processPlan(ctx, "syntax", "ruby", ["-c", ctx.options.target], {
-        parser: "ruby",
-        reason: "Check the target Ruby file for syntax errors."
-      }) : unavailable(ctx, "syntax", "Ruby syntax check requires an explicit target file."),
-      lint: async (ctx) => processPlan(ctx, "lint", "rubocop", ["--format=json"], {
-        parser: "rubocop",
-        reason: "Run RuboCop linter.",
-        executesProjectCode: true
-      }),
-      "format-write": async (ctx) => processPlan(ctx, "format-write", "rubocop", ["--auto-correct"], {
-        parser: "rubocop",
-        reason: "Auto-correct RuboCop violations.",
-        mutating: true,
-        executesProjectCode: true
-      }),
-      test: async (ctx) => processPlan(ctx, "test", "rspec", [], {
-        parser: "rspec",
-        reason: "Run the RSpec test suite.",
-        mutating: true,
-        executesProjectCode: true
-      }),
-      "package-install": async (ctx) => processPlan(ctx, "package-install", "bundle", ["install"], {
-        parser: "package-text",
-        reason: "Install Ruby gem dependencies.",
-        mutating: true,
-        network: true,
-        executesProjectCode: true
-      }),
-      "package-add": async (ctx) => {
-        const names = packageNames(ctx);
-        return names.length === 0 ? unavailable(ctx, "package-add", "At least one gem name is required.") : processPlan(ctx, "package-add", "gem", ["install", ...names], {
-          parser: "package-text",
-          reason: "Install specified Ruby gems.",
-          mutating: true,
-          network: true
-        });
-      },
-      "package-audit": async (ctx) => processPlan(ctx, "package-audit", "bundle", ["audit", "--format=json"], {
-        parser: "bundler-audit",
-        reason: "Audit Ruby gems for vulnerabilities.",
-        network: true
-      }),
-      run: async (ctx) => {
-        const entries = ["main.rb", "app.rb", "server.rb", "config.ru"];
-        const first = (await Promise.all(
-          entries.map((name) => ctx.pathExists(name).then((ok) => ok ? name : void 0))
-        )).find(Boolean);
-        const hasGemfile = await ctx.pathExists("Gemfile");
-        const cmd = hasGemfile ? "bundle" : "ruby";
-        const args = hasGemfile ? ["exec", "ruby", first ?? ""] : [first ?? ""];
-        return processPlan(ctx, "run", cmd, args, {
-          parser: "command-text",
-          reason: first ? `Run the Ruby entry point ${first}.` : "Run the Ruby project (no common entry point detected \u2014 add the file path manually).",
-          executesProjectCode: true,
-          mutating: true
-        });
-      }
-    })
-  };
-}
-function cProfile() {
-  return {
-    id: "c",
-    displayName: "C / C++",
-    extensions: Object.freeze([".c", ".h"]),
-    lspLanguageIds: Object.freeze(["c"]),
-    detectors: Object.freeze([
-      { kind: "manifest", filename: "CMakeLists.txt", weight: 85 },
-      { kind: "manifest", filename: "Makefile", weight: 60 },
-      { kind: "config", suffix: ".cmake", weight: 50 }
-    ]),
-    ignoredDirectories: IGNORES,
-    packageManagers: Object.freeze([]),
-    executables: Object.freeze(["cc", "gcc", "clang", "cmake", "make"]),
-    operations: Object.freeze({
-      semantic: async (ctx) => processPlan(ctx, "semantic", "cmake", ["--build", ".", "--target", "all"], {
-        parser: "cmake",
-        reason: "Build C project to collect compiler diagnostics.",
-        mutating: true,
-        executesProjectCode: true
-      }),
-      test: async (ctx) => unavailable(
-        ctx,
-        "test",
-        "C test execution requires a configured test runner (ctest, etc.)."
-      ),
-      build: async (ctx) => processPlan(ctx, "build", "cmake", ["--build", "."], {
-        parser: "cmake",
-        reason: "Build the C project.",
-        mutating: true,
-        executesProjectCode: true
-      })
-    })
-  };
-}
-function cppProfile() {
-  return {
-    ...cProfile(),
-    id: "cpp",
-    displayName: "C++",
-    extensions: Object.freeze([".cpp", ".cc", ".cxx", ".hpp", ".hxx"]),
-    lspLanguageIds: Object.freeze(["cpp"]),
-    detectors: Object.freeze([
-      { kind: "manifest", filename: "CMakeLists.txt", weight: 85 },
-      { kind: "manifest", filename: "Makefile", weight: 50 }
-    ]),
-    executables: Object.freeze(["c++", "g++", "clang++", "cmake", "make"])
-  };
-}
-function swiftProfile() {
-  return {
-    id: "swift",
-    displayName: "Swift",
-    extensions: Object.freeze([".swift"]),
-    lspLanguageIds: Object.freeze(["swift"]),
-    detectors: Object.freeze([{ kind: "manifest", filename: "Package.swift", weight: 90 }]),
-    ignoredDirectories: IGNORES,
-    packageManagers: Object.freeze(["swift"]),
-    executables: Object.freeze(["swift", "swiftc"]),
-    operations: Object.freeze({
-      semantic: async (ctx) => processPlan(ctx, "semantic", "swift", ["build"], {
-        parser: "swift",
-        reason: "Build Swift package to collect compiler diagnostics.",
-        mutating: true,
-        executesProjectCode: true
-      }),
-      test: async (ctx) => processPlan(ctx, "test", "swift", ["test"], {
-        parser: "swift-test",
-        reason: "Run Swift tests.",
-        mutating: true,
-        executesProjectCode: true
-      }),
-      build: async (ctx) => processPlan(ctx, "build", "swift", ["build", "-c", "release"], {
-        parser: "swift",
-        reason: "Build the Swift package in release mode.",
-        mutating: true,
-        executesProjectCode: true
-      }),
-      run: async (ctx) => processPlan(ctx, "run", "swift", ["run"], {
-        parser: "command-text",
-        reason: "Run the Swift package entry point.",
-        executesProjectCode: true
-      })
-    })
-  };
-}
-function dartProfile() {
-  return {
-    id: "dart",
-    displayName: "Dart / Flutter",
-    extensions: Object.freeze([".dart"]),
-    lspLanguageIds: Object.freeze(["dart"]),
-    detectors: Object.freeze([
-      { kind: "manifest", filename: "pubspec.yaml", weight: 90 },
-      { kind: "lockfile", filename: "pubspec.lock", weight: 30 }
-    ]),
-    ignoredDirectories: IGNORES,
-    packageManagers: Object.freeze(["pub"]),
-    executables: Object.freeze(["dart", "flutter"]),
-    operations: Object.freeze({
-      semantic: async (ctx) => processPlan(ctx, "semantic", "dart", ["analyze"], {
-        parser: "dart-analyze",
-        reason: "Run Dart static analysis."
-      }),
-      "format-check": async (ctx) => processPlan(
-        ctx,
-        "format-check",
-        "dart",
-        ["format", "--output=none", "--set-exit-if-changed", "."],
-        {
-          parser: "dart-format",
-          reason: "Check Dart formatting without writing files."
-        }
-      ),
-      "format-write": async (ctx) => processPlan(ctx, "format-write", "dart", ["format", "."], {
-        parser: "dart-format",
-        reason: "Format Dart source files.",
-        mutating: true
-      }),
-      test: async (ctx) => processPlan(ctx, "test", "dart", ["test"], {
-        parser: "dart-test",
-        reason: "Run Dart tests.",
-        mutating: true,
-        executesProjectCode: true
-      }),
-      "package-install": async (ctx) => processPlan(ctx, "package-install", "dart", ["pub", "get"], {
-        parser: "package-text",
-        reason: "Fetch Dart package dependencies.",
-        mutating: true,
-        network: true
-      }),
-      "package-outdated": async (ctx) => processPlan(ctx, "package-outdated", "dart", ["pub", "outdated"], {
-        parser: "dart-outdated",
-        reason: "Check for outdated Dart packages.",
-        network: true
-      }),
-      run: async (ctx) => processPlan(ctx, "run", "dart", ["run"], {
-        parser: "command-text",
-        reason: "Run the Dart / Flutter project entry point.",
-        executesProjectCode: true
-      })
-    })
-  };
-}
-function denoProfile() {
-  return {
-    id: "deno",
-    displayName: "Deno",
-    extensions: Object.freeze([".ts", ".tsx", ".js", ".jsx"]),
-    lspLanguageIds: Object.freeze(["typescript", "javascript"]),
-    detectors: Object.freeze([
-      { kind: "config", filename: "deno.json", weight: 90 },
-      { kind: "config", filename: "deno.jsonc", weight: 90 },
-      { kind: "config", filename: "import_map.json", weight: 60 }
-    ]),
-    ignoredDirectories: IGNORES,
-    packageManagers: Object.freeze([]),
-    executables: Object.freeze(["deno"]),
-    // .ts/.js extensions are shared with the TypeScript/JavaScript profiles;
-    // only a deno.json(c)/import_map.json detector hit may establish a workspace.
-    sourceFallback: false,
-    operations: Object.freeze({
-      test: async (ctx) => processPlan(ctx, "test", "deno", ["test"], {
-        parser: "deno-test",
-        reason: "Run Deno tests.",
-        mutating: true,
-        executesProjectCode: true
-      }),
-      run: async (ctx) => processPlan(ctx, "run", "deno", ["run", "--allow-all", "main.ts"], {
-        parser: "command-text",
-        reason: "Run the Deno project entry point with full permission.",
-        executesProjectCode: true,
-        mutating: true
-      })
-    })
-  };
-}
-function elixirProfile() {
-  return {
-    id: "elixir",
-    displayName: "Elixir",
-    extensions: Object.freeze([".ex", ".exs"]),
-    lspLanguageIds: Object.freeze(["elixir"]),
-    detectors: Object.freeze([
-      { kind: "manifest", filename: "mix.exs", weight: 90 },
-      { kind: "lockfile", filename: "mix.lock", weight: 30 }
-    ]),
-    ignoredDirectories: IGNORES,
-    packageManagers: Object.freeze(["mix"]),
-    executables: Object.freeze(["mix", "elixir"]),
-    operations: Object.freeze({
-      semantic: async (ctx) => unavailable(ctx, "semantic", "Elixir compilation is handled by the build operation."),
-      lint: async (ctx) => unavailable(ctx, "lint", "Elixir linting requires the credo package."),
-      test: async (ctx) => processPlan(ctx, "test", "mix", ["test"], {
-        parser: "mix-test",
-        reason: "Run ExUnit tests.",
-        mutating: true,
-        executesProjectCode: true
-      }),
-      build: async (ctx) => processPlan(ctx, "build", "mix", ["compile"], {
-        parser: "mix",
-        reason: "Compile the Mix project.",
-        mutating: true,
-        executesProjectCode: true
-      }),
-      run: async (ctx) => processPlan(ctx, "run", "mix", ["run"], {
-        parser: "command-text",
-        reason: "Run the Mix project entry point.",
-        executesProjectCode: true
-      }),
-      "package-install": async (ctx) => processPlan(ctx, "package-install", "mix", ["deps.get"], {
-        parser: "package-text",
-        reason: "Fetch Elixir dependencies.",
-        mutating: true,
-        network: true
-      })
-    })
-  };
-}
-function shellProfile() {
-  return {
-    id: "shell",
-    displayName: "Shell",
-    extensions: Object.freeze([".sh", ".bash"]),
-    lspLanguageIds: Object.freeze(["shellscript"]),
-    detectors: Object.freeze([{ kind: "config", filename: "ShellCheckrc", weight: 50 }]),
-    ignoredDirectories: IGNORES,
-    packageManagers: Object.freeze([]),
-    executables: Object.freeze(["bash", "sh", "shellcheck", "shfmt"]),
-    operations: Object.freeze({
-      syntax: async (ctx) => ctx.options.target ? processPlan(ctx, "syntax", "bash", ["-n", ctx.options.target], {
-        parser: "shell",
-        reason: "Check the shell script for syntax errors."
-      }) : unavailable(ctx, "syntax", "Shell syntax check requires an explicit target file."),
-      lint: async (ctx) => ctx.options.target ? processPlan(ctx, "lint", "shellcheck", ["--format=json", ctx.options.target], {
-        parser: "shellcheck",
-        reason: "Run ShellCheck on the target script."
-      }) : unavailable(ctx, "lint", "Shell linting requires an explicit target file."),
-      "format-check": async (ctx) => ctx.options.target ? processPlan(ctx, "format-check", "shfmt", ["-d", ctx.options.target], {
-        parser: "shell",
-        reason: "Check shell formatting without writing."
-      }) : unavailable(
-        ctx,
-        "format-check",
-        "Shell formatting check requires an explicit target file."
-      ),
-      "format-write": async (ctx) => ctx.options.target ? processPlan(ctx, "format-write", "shfmt", ["-w", ctx.options.target], {
-        parser: "shell",
-        reason: "Format the shell script.",
-        mutating: true
-      }) : unavailable(ctx, "format-write", "Shell formatting requires an explicit target file.")
-    })
-  };
-}
-var ADDITIONAL_LANGUAGE_PROFILES = Object.freeze([
-  pythonProfile(),
-  javaProfile(),
-  rubyProfile(),
-  cProfile(),
-  cppProfile(),
-  swiftProfile(),
-  dartProfile(),
-  denoProfile(),
-  elixirProfile(),
-  shellProfile()
-]);
-
-// src/languages/profiles/primary.ts
-var COMMON_IGNORES = Object.freeze([
-  ".git",
-  ".wrongstack",
-  "node_modules",
-  "vendor",
-  "target",
-  "bin",
-  "obj",
-  "dist",
-  "build",
-  "coverage"
-]);
-function nodeManager(ctx) {
-  const lockfiles = new Set(
-    ctx.workspace.evidence.filter((evidence) => evidence.kind === "lockfile").map((evidence) => evidence.value.toLowerCase())
-  );
-  if (lockfiles.size > 1 && !ctx.workspace.packageManager) return void 0;
-  return ctx.workspace.packageManager ?? "npm";
-}
-function scriptPlan(ctx, operation, script) {
-  const manager = nodeManager(ctx);
-  if (!manager)
-    return unavailable(
-      ctx,
-      operation,
-      "Conflicting Node lockfiles make the package manager ambiguous."
-    );
-  const args = manager === "npm" ? ["run", script] : [script];
-  return processPlan(ctx, operation, manager, args, {
-    parser: "command-text",
-    reason: `Run the detected ${manager} ${script} script for this workspace.`,
-    mutating: true,
-    executesProjectCode: true
-  });
-}
-function nodeExec(ctx, executable, args) {
-  const manager = ctx.workspace.packageManager ?? "npm";
-  if (manager === "pnpm") return { command: "pnpm", args: ["exec", executable, ...args] };
-  if (manager === "yarn") return { command: "yarn", args: ["exec", executable, ...args] };
-  if (manager === "bun") return { command: "bun", args: ["x", executable, ...args] };
-  return { command: "npx", args: ["--no-install", executable, ...args] };
-}
-function typescriptProfile() {
-  return {
-    id: "typescript",
-    displayName: "TypeScript",
-    extensions: Object.freeze([".ts", ".tsx", ".mts", ".cts"]),
-    lspLanguageIds: Object.freeze(["typescript", "typescriptreact"]),
-    detectors: Object.freeze([
-      { kind: "config", filename: "tsconfig.json", weight: 90 },
-      { kind: "manifest", filename: "package.json", weight: 55 },
-      { kind: "lockfile", filename: "pnpm-lock.yaml", weight: 30 },
-      { kind: "lockfile", filename: "yarn.lock", weight: 30 },
-      { kind: "lockfile", filename: "package-lock.json", weight: 30 },
-      { kind: "lockfile", filename: "bun.lock", weight: 30 },
-      { kind: "lockfile", filename: "bun.lockb", weight: 30 }
-    ]),
-    ignoredDirectories: COMMON_IGNORES,
-    packageManagers: Object.freeze(["pnpm", "yarn", "bun", "npm"]),
-    executables: Object.freeze(["pnpm", "yarn", "bun", "npx", "npm"]),
-    operations: Object.freeze({
-      syntax: async (ctx) => internalPlan(
-        ctx,
-        "syntax",
-        "typescript-parser",
-        "Parse the target with the TypeScript compiler API."
-      ),
-      semantic: async (ctx) => {
-        const run = nodeExec(ctx, "tsc", ["--noEmit", "--pretty", "false"]);
-        return processPlan(ctx, "semantic", run.command, run.args, {
-          parser: "typescript",
-          reason: "Run the workspace TypeScript compiler without emitting files.",
-          executesProjectCode: true
-        });
-      },
-      lint: async (ctx) => {
-        const run = nodeExec(ctx, "biome", ["lint", "."]);
-        return processPlan(ctx, "lint", run.command, run.args, {
-          parser: "biome",
-          reason: "Run the project-local Biome linter.",
-          executesProjectCode: true
-        });
-      },
-      "format-check": async (ctx) => {
-        const run = nodeExec(ctx, "biome", ["format", "--check", "."]);
-        return processPlan(ctx, "format-check", run.command, run.args, {
-          parser: "biome",
-          reason: "Check formatting with the project-local Biome formatter.",
-          executesProjectCode: true
-        });
-      },
-      "format-write": async (ctx) => {
-        const run = nodeExec(ctx, "biome", ["format", "--write", "."]);
-        return processPlan(ctx, "format-write", run.command, run.args, {
-          parser: "biome",
-          reason: "Format the workspace with the project-local Biome formatter.",
-          mutating: true,
-          executesProjectCode: true
-        });
-      },
-      test: async (ctx) => ctx.options.filter || ctx.options.coverage ? unavailable(
-        ctx,
-        "test",
-        "The detected package script does not expose deterministic filter or coverage adapters."
-      ) : scriptPlan(ctx, "test", "test"),
-      build: async (ctx) => scriptPlan(ctx, "build", "build"),
-      run: async (ctx) => scriptPlan(ctx, "run", "dev"),
-      "debug-compile": async (ctx) => {
-        const run = nodeExec(ctx, "tsc", ["--noEmit", "--pretty", "false"]);
-        return processPlan(ctx, "debug-compile", run.command, run.args, {
-          parser: "typescript",
-          reason: "Collect deterministic TypeScript compiler diagnostics.",
-          executesProjectCode: true
-        });
-      },
-      "package-install": async (ctx) => {
-        const manager = ctx.workspace.packageManager ?? "npm";
-        const args = manager === "yarn" ? ["install", "--ignore-scripts"] : ["install", "--ignore-scripts"];
-        return processPlan(ctx, "package-install", manager, args, {
-          parser: "package-text",
-          reason: `Restore declared dependencies with ${manager} and lifecycle scripts disabled.`,
-          mutating: true,
-          network: true,
-          executesProjectCode: false
-        });
-      },
-      "package-add": async (ctx) => {
-        const names = packageNames(ctx);
-        if (names.length === 0)
-          return unavailable(ctx, "package-add", "At least one package name is required.");
-        const manager = ctx.workspace.packageManager ?? "npm";
-        const args = manager === "npm" ? ["install", "--ignore-scripts", ...names] : ["add", "--ignore-scripts", ...names];
-        return processPlan(ctx, "package-add", manager, args, {
-          parser: "package-text",
-          reason: `Add validated packages with ${manager} and lifecycle scripts disabled.`,
-          mutating: true,
-          network: true
-        });
-      },
-      "package-remove": async (ctx) => {
-        const names = packageNames(ctx);
-        if (names.length === 0)
-          return unavailable(ctx, "package-remove", "At least one package name is required.");
-        const manager = ctx.workspace.packageManager ?? "npm";
-        const args = manager === "npm" ? ["uninstall", "--ignore-scripts", ...names] : ["remove", "--ignore-scripts", ...names];
-        return processPlan(ctx, "package-remove", manager, args, {
-          parser: "package-text",
-          reason: `Remove validated packages with ${manager} and lifecycle scripts disabled.`,
-          mutating: true,
-          network: true
-        });
-      },
-      "package-audit": async (ctx) => {
-        const manager = ctx.workspace.packageManager ?? "npm";
-        return processPlan(ctx, "package-audit", manager, ["audit", "--json"], {
-          parser: "npm-audit",
-          reason: `Audit dependencies with the detected ${manager} package manager.`,
-          network: true
-        });
-      },
-      "package-outdated": async (ctx) => {
-        const manager = ctx.workspace.packageManager ?? "npm";
-        return processPlan(ctx, "package-outdated", manager, ["outdated", "--json"], {
-          parser: "npm-outdated",
-          reason: `Check outdated dependencies with ${manager}.`,
-          network: true
-        });
-      }
-    })
-  };
-}
-function javascriptProfile() {
-  const ts = typescriptProfile();
-  return {
-    ...ts,
-    id: "javascript",
-    displayName: "JavaScript",
-    extensions: Object.freeze([".js", ".jsx", ".mjs", ".cjs"]),
-    lspLanguageIds: Object.freeze(["javascript", "javascriptreact"]),
-    detectors: Object.freeze([
-      { kind: "config", filename: "jsconfig.json", weight: 90 },
-      { kind: "manifest", filename: "package.json", weight: 70 },
-      { kind: "lockfile", filename: "pnpm-lock.yaml", weight: 30 },
-      { kind: "lockfile", filename: "yarn.lock", weight: 30 },
-      { kind: "lockfile", filename: "package-lock.json", weight: 30 },
-      { kind: "lockfile", filename: "bun.lock", weight: 30 },
-      { kind: "lockfile", filename: "bun.lockb", weight: 30 }
-    ]),
-    operations: Object.freeze({
-      ...ts.operations,
-      syntax: async (ctx) => internalPlan(
-        ctx,
-        "syntax",
-        "typescript-parser",
-        "Parse JavaScript with the TypeScript compiler API."
-      )
-    })
-  };
-}
-var goProfile = {
-  id: "go",
-  displayName: "Go",
-  extensions: Object.freeze([".go"]),
-  lspLanguageIds: Object.freeze(["go"]),
-  detectors: Object.freeze([
-    { kind: "manifest", filename: "go.mod", weight: 90 },
-    { kind: "manifest", filename: "go.work", weight: 95 },
-    { kind: "lockfile", filename: "go.sum", weight: 30 }
-  ]),
-  ignoredDirectories: COMMON_IGNORES,
-  packageManagers: Object.freeze(["go"]),
-  executables: Object.freeze(["go", "gofmt"]),
-  operations: Object.freeze({
-    syntax: async (ctx) => {
-      if (!ctx.target)
-        return unavailable(ctx, "syntax", "Go syntax planning requires a target file.");
-      return processPlan(ctx, "syntax", "gofmt", ["-e", "-d", ctx.target], {
-        parser: "gofmt",
-        reason: "Parse the target and report syntax errors without writing it."
-      });
-    },
-    semantic: async (ctx) => processPlan(ctx, "semantic", "go", ["test", "-run", "^$", "./..."], {
-      parser: "go-test",
-      reason: "Compile all Go packages without selecting tests.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    lint: async (ctx) => processPlan(ctx, "lint", "go", ["vet", "./..."], {
-      parser: "go-compiler",
-      reason: "Run the standard Go vet checks.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    "format-check": async (ctx) => ctx.target ? processPlan(ctx, "format-check", "gofmt", ["-d", ctx.target], {
-      parser: "gofmt",
-      reason: "Report Go formatting differences for the target without writing it."
-    }) : unavailable(ctx, "format-check", "Go formatting requires an explicit target file."),
-    "format-write": async (ctx) => ctx.target ? processPlan(ctx, "format-write", "gofmt", ["-w", ctx.target], {
-      parser: "gofmt",
-      reason: "Format the target Go source file.",
-      mutating: true
-    }) : unavailable(ctx, "format-write", "Go formatting requires an explicit target file."),
-    test: async (ctx) => processPlan(
-      ctx,
-      "test",
-      "go",
-      ["test", ...ctx.options.filter ? ["-run", ctx.options.filter] : [], "./..."],
-      {
-        parser: "go-test",
-        reason: ctx.options.filter ? "Run filtered Go tests." : "Run all Go tests.",
-        mutating: true,
-        executesProjectCode: true
-      }
-    ),
-    build: async (ctx) => processPlan(ctx, "build", "go", ["build", "./..."], {
-      parser: "go-compiler",
-      reason: "Build all Go packages.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    run: async (ctx) => processPlan(ctx, "run", "go", ["run", "."], {
-      parser: "command-text",
-      reason: "Run the Go module entry point.",
-      executesProjectCode: true
-    }),
-    "debug-race": async (ctx) => processPlan(ctx, "debug-race", "go", ["test", "-race", "./..."], {
-      parser: "go-test",
-      reason: "Collect Go race-detector evidence.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    "package-install": async (ctx) => processPlan(ctx, "package-install", "go", ["mod", "download"], {
-      parser: "go-module",
-      reason: "Download the dependencies declared by go.mod.",
-      mutating: true,
-      network: true
-    }),
-    "package-add": async (ctx) => {
-      const names = packageNames(ctx);
-      if (names.length === 0)
-        return unavailable(ctx, "package-add", "At least one Go module is required.");
-      return processPlan(ctx, "package-add", "go", ["get", ...names], {
-        parser: "go-module",
-        reason: "Add validated Go modules.",
-        mutating: true,
-        network: true
-      });
-    },
-    "package-update": async (ctx) => processPlan(ctx, "package-update", "go", ["get", "-u", "./..."], {
-      parser: "go-module",
-      reason: "Update dependencies of all Go packages.",
-      mutating: true,
-      network: true
-    })
-  })
-};
-var rustProfile = {
-  id: "rust",
-  displayName: "Rust",
-  extensions: Object.freeze([".rs"]),
-  lspLanguageIds: Object.freeze(["rust"]),
-  detectors: Object.freeze([
-    { kind: "manifest", filename: "Cargo.toml", weight: 90 },
-    { kind: "lockfile", filename: "Cargo.lock", weight: 30 }
-  ]),
-  ignoredDirectories: COMMON_IGNORES,
-  packageManagers: Object.freeze(["cargo"]),
-  executables: Object.freeze(["cargo"]),
-  operations: Object.freeze({
-    syntax: async (ctx) => processPlan(ctx, "syntax", "cargo", ["check", "--message-format=json"], {
-      parser: "cargo-json",
-      reason: "Check Rust syntax and semantics with Cargo.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    semantic: async (ctx) => processPlan(ctx, "semantic", "cargo", ["check", "--message-format=json"], {
-      parser: "cargo-json",
-      reason: "Collect Rust compiler diagnostics with Cargo check.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    lint: async (ctx) => processPlan(ctx, "lint", "cargo", ["clippy", "--message-format=json"], {
-      parser: "cargo-json",
-      reason: "Run Clippy for this crate.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    "format-check": async (ctx) => processPlan(ctx, "format-check", "cargo", ["fmt", "--check"], {
-      parser: "cargo-fmt",
-      reason: "Check Rust formatting without writing files."
-    }),
-    "format-write": async (ctx) => processPlan(ctx, "format-write", "cargo", ["fmt"], {
-      parser: "cargo-fmt",
-      reason: "Format Rust source files in the workspace.",
-      mutating: true
-    }),
-    "test-compile": async (ctx) => processPlan(ctx, "test-compile", "cargo", ["test", "--no-run", "--message-format=json"], {
-      parser: "cargo-json",
-      reason: "Compile Rust tests without running them.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    test: async (ctx) => processPlan(
-      ctx,
-      "test",
-      "cargo",
-      ["test", ...ctx.options.filter ? [ctx.options.filter] : []],
-      {
-        parser: "cargo-test",
-        reason: ctx.options.filter ? "Run filtered Rust tests." : "Run Rust tests.",
-        mutating: true,
-        executesProjectCode: true
-      }
-    ),
-    build: async (ctx) => processPlan(ctx, "build", "cargo", ["build", "--message-format=json"], {
-      parser: "cargo-json",
-      reason: "Build the Rust workspace.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    run: async (ctx) => processPlan(ctx, "run", "cargo", ["run"], {
-      parser: "command-text",
-      reason: "Run the Rust workspace entry point.",
-      executesProjectCode: true
-    }),
-    "package-install": async (ctx) => processPlan(ctx, "package-install", "cargo", ["fetch", "--locked"], {
-      parser: "cargo-json",
-      reason: "Fetch locked Rust dependencies.",
-      mutating: true,
-      network: true
-    }),
-    "package-add": async (ctx) => {
-      const names = packageNames(ctx);
-      return names.length === 0 ? unavailable(ctx, "package-add", "At least one crate is required.") : processPlan(ctx, "package-add", "cargo", ["add", ...names], {
-        parser: "cargo-text",
-        reason: "Add validated Rust crates.",
-        mutating: true,
-        network: true
-      });
-    },
-    "package-remove": async (ctx) => {
-      const names = packageNames(ctx);
-      return names.length === 0 ? unavailable(ctx, "package-remove", "At least one crate is required.") : processPlan(ctx, "package-remove", "cargo", ["remove", ...names], {
-        parser: "cargo-text",
-        reason: "Remove validated Rust crates.",
-        mutating: true
-      });
-    },
-    "package-update": async (ctx) => processPlan(ctx, "package-update", "cargo", ["update"], {
-      parser: "cargo-text",
-      reason: "Update the Cargo lockfile.",
-      mutating: true,
-      network: true
-    }),
-    "package-audit": async (ctx) => processPlan(ctx, "package-audit", "cargo", ["audit", "--json"], {
-      parser: "cargo-audit",
-      reason: "Audit Rust dependencies when cargo-audit is installed.",
-      network: true
-    })
-  })
-};
-var phpProfile = {
-  id: "php",
-  displayName: "PHP",
-  extensions: Object.freeze([".php"]),
-  lspLanguageIds: Object.freeze(["php"]),
-  detectors: Object.freeze([
-    { kind: "manifest", filename: "composer.json", weight: 90 },
-    { kind: "lockfile", filename: "composer.lock", weight: 30 },
-    { kind: "config", filename: "phpunit.xml", weight: 25 },
-    { kind: "config", filename: "phpunit.xml.dist", weight: 25 }
-  ]),
-  ignoredDirectories: COMMON_IGNORES,
-  packageManagers: Object.freeze(["composer"]),
-  executables: Object.freeze(["php", "composer"]),
-  operations: Object.freeze({
-    syntax: async (ctx) => ctx.target ? processPlan(ctx, "syntax", "php", ["-l", ctx.target], {
-      parser: "php-lint",
-      reason: "Lint the target PHP file without executing it."
-    }) : unavailable(ctx, "syntax", "PHP syntax planning requires a target file."),
-    semantic: async (ctx) => unavailable(
-      ctx,
-      "semantic",
-      "No configured PHPStan or Psalm adapter was detected in Phase 1."
-    ),
-    test: async (ctx) => processPlan(
-      ctx,
-      "test",
-      "php",
-      ["vendor/bin/phpunit", ...ctx.options.filter ? ["--filter", ctx.options.filter] : []],
-      {
-        parser: "phpunit",
-        reason: ctx.options.filter ? "Run filtered tests with the project-local PHPUnit runner." : "Run the project-local PHPUnit test runner.",
-        executesProjectCode: true
-      }
-    ),
-    "package-install": async (ctx) => processPlan(
-      ctx,
-      "package-install",
-      "composer",
-      ["install", "--no-interaction", "--no-scripts"],
-      {
-        parser: "composer",
-        reason: "Restore Composer dependencies without scripts.",
-        mutating: true,
-        network: true
-      }
-    ),
-    "package-add": async (ctx) => {
-      const names = packageNames(ctx);
-      return names.length === 0 ? unavailable(ctx, "package-add", "At least one Composer package is required.") : processPlan(
-        ctx,
-        "package-add",
-        "composer",
-        ["require", "--no-interaction", "--no-scripts", ...names],
-        {
-          parser: "composer",
-          reason: "Add validated Composer packages without scripts.",
-          mutating: true,
-          network: true
-        }
-      );
-    },
-    "package-remove": async (ctx) => {
-      const names = packageNames(ctx);
-      return names.length === 0 ? unavailable(ctx, "package-remove", "At least one Composer package is required.") : processPlan(
-        ctx,
-        "package-remove",
-        "composer",
-        ["remove", "--no-interaction", "--no-scripts", ...names],
-        {
-          parser: "composer",
-          reason: "Remove validated Composer packages without scripts.",
-          mutating: true
-        }
-      );
-    },
-    "package-update": async (ctx) => processPlan(
-      ctx,
-      "package-update",
-      "composer",
-      ["update", "--no-interaction", "--no-scripts"],
-      {
-        parser: "composer",
-        reason: "Update Composer dependencies without scripts.",
-        mutating: true,
-        network: true
-      }
-    ),
-    "package-audit": async (ctx) => processPlan(ctx, "package-audit", "composer", ["audit", "--format=json"], {
-      parser: "composer-audit",
-      reason: "Audit Composer dependencies.",
-      network: true
-    }),
-    "package-outdated": async (ctx) => processPlan(ctx, "package-outdated", "composer", ["outdated", "--format=json"], {
-      parser: "composer-outdated",
-      reason: "Check outdated Composer dependencies.",
-      network: true
-    })
-  })
-};
-var csharpProfile = {
-  id: "csharp",
-  displayName: "C# / .NET",
-  extensions: Object.freeze([".cs"]),
-  lspLanguageIds: Object.freeze(["csharp"]),
-  detectors: Object.freeze([
-    { kind: "config", filename: "global.json", weight: 25 },
-    { kind: "manifest", suffix: ".slnx", weight: 95 },
-    { kind: "manifest", suffix: ".sln", weight: 95 },
-    { kind: "manifest", suffix: ".csproj", weight: 90 },
-    { kind: "manifest", suffix: ".fsproj", weight: 90 },
-    { kind: "lockfile", filename: "packages.lock.json", weight: 30 }
-  ]),
-  ignoredDirectories: COMMON_IGNORES,
-  packageManagers: Object.freeze(["dotnet"]),
-  executables: Object.freeze(["dotnet"]),
-  operations: Object.freeze({
-    syntax: async (ctx) => processPlan(ctx, "syntax", "dotnet", ["build", "--no-restore"], {
-      parser: "dotnet-build",
-      reason: "Use the nearest project or solution to collect C# syntax diagnostics.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    semantic: async (ctx) => processPlan(ctx, "semantic", "dotnet", ["build", "--no-restore"], {
-      parser: "dotnet-build",
-      reason: "Build without restoring to collect .NET compiler diagnostics.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    lint: async (ctx) => processPlan(ctx, "lint", "dotnet", ["format", "--verify-no-changes", "--no-restore"], {
-      parser: "dotnet-format",
-      reason: "Verify .NET formatting and analyzers without writing source files.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    "format-check": async (ctx) => processPlan(
-      ctx,
-      "format-check",
-      "dotnet",
-      ["format", "--verify-no-changes", "--no-restore"],
-      {
-        parser: "dotnet-format",
-        reason: "Verify .NET formatting without source writes.",
-        mutating: true,
-        executesProjectCode: true
-      }
-    ),
-    "format-write": async (ctx) => processPlan(ctx, "format-write", "dotnet", ["format", "--no-restore"], {
-      parser: "dotnet-format",
-      reason: "Format .NET source files without restoring packages.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    test: async (ctx) => processPlan(
-      ctx,
-      "test",
-      "dotnet",
-      ["test", "--no-restore", ...ctx.options.filter ? ["--filter", ctx.options.filter] : []],
-      {
-        parser: "dotnet-test",
-        reason: ctx.options.filter ? "Run filtered .NET tests without restoring packages." : "Run .NET tests without restoring packages.",
-        mutating: true,
-        executesProjectCode: true
-      }
-    ),
-    build: async (ctx) => processPlan(ctx, "build", "dotnet", ["build", "--no-restore"], {
-      parser: "dotnet-build",
-      reason: "Build the nearest .NET project or solution without restoring packages.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    run: async (ctx) => processPlan(ctx, "run", "dotnet", ["run", "--no-restore"], {
-      parser: "command-text",
-      reason: "Run the .NET project entry point.",
-      mutating: true,
-      executesProjectCode: true
-    }),
-    "package-install": async (ctx) => processPlan(ctx, "package-install", "dotnet", ["restore", "--locked-mode"], {
-      parser: "dotnet-restore",
-      reason: "Restore locked .NET dependencies.",
-      mutating: true,
-      network: true,
-      executesProjectCode: true
-    }),
-    "package-add": async (ctx) => {
-      const names = packageNames(ctx);
-      const [spec] = names;
-      const versionAt = spec?.lastIndexOf("@") ?? -1;
-      const packageName = versionAt > 0 ? spec?.slice(0, versionAt) : spec;
-      const packageVersion = versionAt > 0 ? spec?.slice(versionAt + 1) : void 0;
-      return names.length === 0 ? unavailable(ctx, "package-add", "At least one NuGet package is required.") : names.length > 1 ? unavailable(ctx, "package-add", "NuGet package changes run one package at a time.") : processPlan(
-        ctx,
-        "package-add",
-        "dotnet",
-        [
-          "add",
-          "package",
-          packageName ?? "",
-          ...packageVersion ? ["--version", packageVersion] : []
-        ],
-        {
-          parser: "dotnet-package",
-          reason: "Add validated NuGet packages.",
-          mutating: true,
-          network: true,
-          executesProjectCode: true
-        }
-      );
-    },
-    "package-remove": async (ctx) => {
-      const names = packageNames(ctx);
-      return names.length === 0 ? unavailable(ctx, "package-remove", "At least one NuGet package is required.") : processPlan(ctx, "package-remove", "dotnet", ["remove", "package", ...names], {
-        parser: "dotnet-package",
-        reason: "Remove validated NuGet packages.",
-        mutating: true
-      });
-    },
-    "package-audit": async (ctx) => processPlan(
-      ctx,
-      "package-audit",
-      "dotnet",
-      ["list", "package", "--vulnerable", "--format", "json"],
-      { parser: "dotnet-package", reason: "List vulnerable NuGet dependencies.", network: true }
-    ),
-    "package-outdated": async (ctx) => processPlan(
-      ctx,
-      "package-outdated",
-      "dotnet",
-      ["list", "package", "--outdated", "--format", "json"],
-      { parser: "dotnet-package", reason: "List outdated NuGet dependencies.", network: true }
-    )
-  })
-};
-var PRIMARY_LANGUAGE_PROFILES = Object.freeze([
-  Object.freeze(typescriptProfile()),
-  Object.freeze(javascriptProfile()),
-  Object.freeze(goProfile),
-  Object.freeze(rustProfile),
-  Object.freeze(phpProfile),
-  Object.freeze(csharpProfile)
-]);
-
-// src/languages/registry.ts
-var PROFILE_ID_RE = /^[a-z][a-z0-9-]{0,63}$/;
-var EXECUTABLE_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
-var KNOWN_OPERATIONS = /* @__PURE__ */ new Set([
-  "syntax",
-  "semantic",
-  "lint",
-  "format-check",
-  "format-write",
-  "test-compile",
-  "test",
-  "build",
-  "run",
-  "debug-compile",
-  "debug-test",
-  "debug-runtime",
-  "debug-race",
-  "package-install",
-  "package-add",
-  "package-remove",
-  "package-update",
-  "package-audit",
-  "package-outdated"
-]);
-var LanguageProfileRegistry = class {
-  #profiles = /* @__PURE__ */ new Map();
-  constructor(profiles = []) {
-    for (const profile of profiles) this.register(profile);
-  }
-  register(profile) {
-    const errors = validateLanguageProfile(profile);
-    if (errors.length > 0) {
-      throw new Error(`Invalid language profile "${profile.id}": ${errors.join("; ")}`);
-    }
-    if (this.#profiles.has(profile.id)) {
-      throw new Error(`Language profile "${profile.id}" is already registered`);
-    }
-    this.#profiles.set(profile.id, freezeProfile(profile));
-  }
-  get(id) {
-    return this.#profiles.get(id);
-  }
-  list() {
-    return Object.freeze([...this.#profiles.values()]);
-  }
-};
-function validateLanguageProfile(profile) {
-  const errors = [];
-  if (!PROFILE_ID_RE.test(profile.id)) errors.push("id must be a lowercase stable identifier");
-  if (!profile.displayName.trim()) errors.push("displayName is required");
-  if (profile.extensions.length === 0) errors.push("at least one extension is required");
-  for (const ext of profile.extensions) {
-    if (!/^\.[a-z0-9+.-]+$/i.test(ext)) errors.push(`invalid extension "${ext}"`);
-  }
-  if (profile.detectors.length === 0) errors.push("at least one detector is required");
-  for (const detector of profile.detectors) {
-    if ((detector.filename ? 1 : 0) + (detector.suffix ? 1 : 0) !== 1) {
-      errors.push("each detector must declare exactly one of filename or suffix");
-    }
-    if (!Number.isFinite(detector.weight) || detector.weight <= 0 || detector.weight > 100) {
-      errors.push("detector weights must be in the range 1..100");
-    }
-    const marker = detector.filename ?? detector.suffix ?? "";
-    if (marker.includes("/") || marker.includes("\\") || marker.includes("\0")) {
-      errors.push(`detector marker "${marker}" must be a basename or suffix`);
-    }
-  }
-  if (profile.executables.length === 0) errors.push("at least one executable is required");
-  for (const executable of profile.executables) {
-    if (!EXECUTABLE_RE.test(executable)) errors.push(`invalid executable token "${executable}"`);
-  }
-  for (const operation of Object.keys(profile.operations)) {
-    if (!KNOWN_OPERATIONS.has(operation)) {
-      errors.push(`unknown operation "${operation}"`);
-    }
-    if (typeof profile.operations[operation] !== "function") {
-      errors.push(`operation "${operation}" must be a resolver function`);
-    }
-  }
-  return [...new Set(errors)];
-}
-function freezeProfile(profile) {
-  const detectors = Object.freeze(profile.detectors.map((item) => Object.freeze({ ...item })));
-  const operations = Object.freeze({ ...profile.operations });
-  return Object.freeze({
-    ...profile,
-    extensions: Object.freeze([...profile.extensions]),
-    lspLanguageIds: Object.freeze([...profile.lspLanguageIds]),
-    detectors,
-    ignoredDirectories: Object.freeze([...profile.ignoredDirectories]),
-    packageManagers: Object.freeze([...profile.packageManagers]),
-    executables: Object.freeze([...profile.executables]),
-    operations
-  });
-}
-var languageProfileRegistry = new LanguageProfileRegistry([
-  ...PRIMARY_LANGUAGE_PROFILES,
-  ...ADDITIONAL_LANGUAGE_PROFILES
-]);
-
-// src/languages/detect.ts
-var DEFAULT_LIMITS = { maxDepth: 6, maxEntries: 5e3 };
-var SOURCE_WEIGHT = 5;
-var SOURCE_WEIGHT_CAP = 25;
-var TARGET_WEIGHT = 100;
-var GLOBAL_IGNORES = /* @__PURE__ */ new Set([
-  ".git",
-  ".wrongstack",
-  "node_modules",
-  "vendor",
-  "target",
-  "bin",
-  "obj",
-  "dist",
-  "build",
-  "out",
-  "coverage",
-  ".cache",
-  ".idea",
-  ".vscode",
-  ".next",
-  ".nuxt"
-]);
-async function detectLanguageWorkspaces(options) {
-  const projectRoot = await canonicalDirectory(options.projectRoot);
-  const cwdInput = options.cwd ? path4.isAbsolute(options.cwd) ? options.cwd : path4.resolve(projectRoot, options.cwd) : projectRoot;
-  const cwd = await canonicalInside(cwdInput, projectRoot, "cwd");
-  const target = options.target ? await canonicalInside(resolveFrom(cwd, options.target), projectRoot, "target") : void 0;
-  const profiles = (options.profiles ?? languageProfileRegistry.list()).filter((profile) => !options.language || profile.id === options.language).slice().sort((a, b) => a.id.localeCompare(b.id));
-  const limits = normalizeLimits(options.limits);
-  const extraIgnores = new Set(options.ignoredDirectories ?? []);
-  const state = {
-    entries: 0,
-    truncated: false,
-    sourcePaths: /* @__PURE__ */ new Map(),
-    candidates: /* @__PURE__ */ new Map()
-  };
-  await scanDirectory(projectRoot, 0, profiles, limits, state, extraIgnores, options.signal);
-  addSourceFallbacks(projectRoot, profiles, state);
-  if (target) addTargetEvidence(target, projectRoot, profiles, state);
-  const workspaces = await Promise.all(
-    [...state.candidates.values()].map((candidate) => finalizeCandidate(candidate, projectRoot))
-  );
-  workspaces.sort(compareWorkspaces);
-  return {
-    projectRoot,
-    scannedEntries: state.entries,
-    truncated: state.truncated,
-    workspaces
-  };
-}
-async function scanDirectory(directory, depth, profiles, limits, state, extraIgnores, signal) {
-  signal?.throwIfAborted();
-  if (depth > limits.maxDepth || state.entries >= limits.maxEntries) {
-    state.truncated = true;
-    return;
-  }
-  let entries;
-  try {
-    entries = await fs2.readdir(directory, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  entries.sort((a, b) => a.name.localeCompare(b.name));
-  for (const entry of entries) {
-    signal?.throwIfAborted();
-    if (state.entries >= limits.maxEntries) {
-      state.truncated = true;
-      return;
-    }
-    state.entries++;
-    const fullPath = path4.join(directory, entry.name);
-    if (entry.isSymbolicLink()) continue;
-    if (entry.isDirectory()) {
-      if (shouldIgnoreDirectory(entry.name, profiles, extraIgnores)) continue;
-      if (depth >= limits.maxDepth) {
-        state.truncated = true;
-        continue;
-      }
-      await scanDirectory(fullPath, depth + 1, profiles, limits, state, extraIgnores, signal);
-      continue;
-    }
-    if (!entry.isFile()) continue;
-    collectFileEvidence(directory, fullPath, entry.name, profiles, state);
-  }
-}
-function collectFileEvidence(directory, fullPath, basename5, profiles, state) {
-  const lower = basename5.toLowerCase();
-  const extension = path4.extname(lower);
-  for (const profile of profiles) {
-    const detector = profile.detectors.find(
-      (rule) => rule.filename ? lower === rule.filename.toLowerCase() : lower.endsWith(rule.suffix.toLowerCase())
-    );
-    if (detector) {
-      const candidate = getCandidate(state, profile, directory);
-      candidate.evidence.push({
-        kind: detector.kind,
-        path: fullPath,
-        value: basename5,
-        weight: detector.weight
-      });
-      if (detector.kind === "manifest" || detector.kind === "config") {
-        candidate.manifests.push(fullPath);
-      }
-    }
-    if (profile.extensions.includes(extension)) {
-      const paths = state.sourcePaths.get(profile.id) ?? [];
-      if (paths.length < SOURCE_WEIGHT_CAP / SOURCE_WEIGHT) paths.push(fullPath);
-      state.sourcePaths.set(profile.id, paths);
-    }
-  }
-}
-function addSourceFallbacks(projectRoot, profiles, state) {
-  for (const profile of profiles) {
-    const sources = state.sourcePaths.get(profile.id) ?? [];
-    if (sources.length === 0) continue;
-    const profileCandidates = [...state.candidates.values()].filter(
-      (item) => item.profile.id === profile.id
-    );
-    for (const source of sources) {
-      const containing = profileCandidates.filter((candidate2) => isInside(source, candidate2.root)).sort(
-        (a, b) => pathDepth(b.root, projectRoot) - pathDepth(a.root, projectRoot) || a.root.localeCompare(b.root)
-      );
-      const candidate = containing[0] ?? (profile.sourceFallback === false ? void 0 : getCandidate(state, profile, projectRoot));
-      if (!candidate) continue;
-      candidate.evidence.push({
-        kind: "source",
-        path: source,
-        value: path4.extname(source),
-        weight: SOURCE_WEIGHT
-      });
-    }
-  }
-}
-function addTargetEvidence(target, projectRoot, profiles, state) {
-  const extension = path4.extname(target).toLowerCase();
-  for (const profile of profiles) {
-    if (!profile.extensions.includes(extension)) continue;
-    const candidates = [...state.candidates.values()].filter(
-      (candidate2) => candidate2.profile.id === profile.id && isInside(target, candidate2.root)
-    );
-    const candidate = candidates.length > 0 ? candidates.sort(
-      (a, b) => pathDepth(b.root, projectRoot) - pathDepth(a.root, projectRoot) || a.root.localeCompare(b.root)
-    )[0] : profile.sourceFallback === false ? void 0 : getCandidate(state, profile, path4.dirname(target));
-    if (!candidate) continue;
-    candidate.evidence.push({
-      kind: "target",
-      path: target,
-      value: extension,
-      weight: TARGET_WEIGHT
-    });
-  }
-}
-async function finalizeCandidate(candidate, projectRoot) {
-  const evidence = dedupeEvidence(candidate.evidence).sort(compareEvidence);
-  const manifests = [...new Set(candidate.manifests)].sort();
-  const confidence = Math.min(1, evidence.reduce((sum, item) => sum + item.weight, 0) / 100);
-  const packageManager = await detectPackageManager2(candidate.profile, candidate.root, evidence);
-  const id = createHash("sha256").update(`${candidate.profile.id}\0${path4.relative(projectRoot, candidate.root)}`).digest("hex").slice(0, 16);
-  return Object.freeze({
-    id,
-    language: candidate.profile.id,
-    root: candidate.root,
-    confidence,
-    evidence: Object.freeze(evidence.map((item) => Object.freeze(item))),
-    ...packageManager ? { packageManager } : {},
-    manifests: Object.freeze(manifests),
-    capabilities: Object.freeze(
-      Object.keys(candidate.profile.operations).sort()
-    )
-  });
-}
-async function detectPackageManager2(profile, root, evidence) {
-  if (profile.packageManagers.length === 1) return profile.packageManagers[0];
-  if (profile.id !== "typescript" && profile.id !== "javascript") return void 0;
-  let declared;
-  try {
-    const pkg = JSON.parse(await fs2.readFile(path4.join(root, "package.json"), "utf8"));
-    if (typeof pkg.packageManager === "string") {
-      const manager = pkg.packageManager.split("@")[0];
-      if (manager && profile.packageManagers.includes(manager)) declared = manager;
-    }
-  } catch {
-  }
-  const lockManagers = /* @__PURE__ */ new Set();
-  for (const item of evidence) {
-    const name = path4.basename(item.path).toLowerCase();
-    if (name === "pnpm-lock.yaml") lockManagers.add("pnpm");
-    else if (name === "yarn.lock") lockManagers.add("yarn");
-    else if (name === "bun.lock" || name === "bun.lockb") lockManagers.add("bun");
-    else if (name === "package-lock.json") lockManagers.add("npm");
-  }
-  if (declared && (lockManagers.size === 0 || lockManagers.size === 1 && lockManagers.has(declared))) {
-    return declared;
-  }
-  if (lockManagers.size === 1) return [...lockManagers][0];
-  if (lockManagers.size > 1) return void 0;
-  return declared ?? "npm";
-}
-function getCandidate(state, profile, root) {
-  const key = `${profile.id}\0${root}`;
-  let candidate = state.candidates.get(key);
-  if (!candidate) {
-    candidate = { profile, root, evidence: [], manifests: [] };
-    state.candidates.set(key, candidate);
-  }
-  return candidate;
-}
-function shouldIgnoreDirectory(name, profiles, extraIgnores) {
-  if (GLOBAL_IGNORES.has(name) || extraIgnores.has(name) || name.startsWith(".")) return true;
-  return profiles.some((profile) => profile.ignoredDirectories.includes(name));
-}
-function normalizeLimits(input) {
-  const maxDepth = Math.max(
-    0,
-    Math.min(12, Math.trunc(input?.maxDepth ?? DEFAULT_LIMITS.maxDepth))
-  );
-  const maxEntries = Math.max(
-    1,
-    Math.min(5e4, Math.trunc(input?.maxEntries ?? DEFAULT_LIMITS.maxEntries))
-  );
-  return { maxDepth, maxEntries };
-}
-async function canonicalDirectory(input) {
-  const resolved = path4.resolve(input);
-  const real = await fs2.realpath(resolved);
-  const stat5 = await fs2.stat(real);
-  if (!stat5.isDirectory()) throw new Error(`Project root is not a directory: ${input}`);
-  return real;
-}
-async function canonicalInside(input, root, label) {
-  const resolved = path4.resolve(input);
-  let real;
-  try {
-    real = await fs2.realpath(resolved);
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-    const parent = await fs2.realpath(path4.dirname(resolved));
-    real = path4.join(parent, path4.basename(resolved));
-  }
-  if (!isInside(real, root)) throw new Error(`${label} is outside project root: ${input}`);
-  return real;
-}
-function resolveFrom(cwd, input) {
-  return path4.isAbsolute(input) ? input : path4.resolve(cwd, input);
-}
-function isInside(candidate, root) {
-  const relative5 = path4.relative(root, candidate);
-  return relative5 === "" || !relative5.startsWith("..") && !path4.isAbsolute(relative5);
-}
-function pathDepth(candidate, root) {
-  const relative5 = path4.relative(root, candidate);
-  return relative5 === "" ? 0 : relative5.split(path4.sep).length;
-}
-function dedupeEvidence(items) {
-  const seen = /* @__PURE__ */ new Set();
-  return items.filter((item) => {
-    const key = `${item.kind}\0${item.path}\0${item.value}\0${item.weight}`;
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
-}
-function compareEvidence(a, b) {
-  return a.path.localeCompare(b.path) || a.kind.localeCompare(b.kind) || b.weight - a.weight;
-}
-function compareWorkspaces(a, b) {
-  return b.confidence - a.confidence || a.language.localeCompare(b.language) || a.root.localeCompare(b.root) || a.id.localeCompare(b.id);
-}
-
-// src/languages/diagnostics.ts
-import * as path5 from "node:path";
-var MAX_DIAGNOSTICS = 200;
-function parseLanguageDiagnostics(parser, stdout, stderr, workspaceRoot) {
-  const text = `${stdout}${stdout && stderr ? "\n" : ""}${stderr}`;
-  let diagnostics;
-  switch (parser) {
-    case "typescript":
-      diagnostics = parseTypeScript(text, workspaceRoot);
-      break;
-    case "cargo-json":
-      diagnostics = parseCargoJson(text, workspaceRoot);
-      break;
-    case "php-lint":
-      diagnostics = parsePhpLint(text, workspaceRoot);
-      break;
-    case "dotnet-build":
-    case "dotnet-format":
-    case "dotnet-test":
-      diagnostics = parseDotnet(text, workspaceRoot);
-      break;
-    case "go-test":
-    case "go-compiler":
-    case "gofmt":
-      diagnostics = parseGo(text, workspaceRoot);
-      break;
-    case "biome":
-      diagnostics = parseBiome(text, workspaceRoot);
-      break;
-    default:
-      diagnostics = parseGeneric(text, parser, workspaceRoot);
-      break;
-  }
-  const sorted = dedupeDiagnostics(diagnostics).sort(compareDiagnostics);
-  const omitted = Math.max(0, sorted.length - MAX_DIAGNOSTICS);
-  const kept = Object.freeze(sorted.slice(0, MAX_DIAGNOSTICS).map((item) => Object.freeze(item)));
-  return {
-    diagnostics: kept,
-    omitted,
-    summary: summarize(kept)
-  };
-}
-function parseTypeScript(text, root) {
-  const diagnostics = [];
-  const regex = /^(.+?)\((\d+),(\d+)\):\s+(error|warning)\s+(TS\d+):\s*(.+)$/gm;
-  for (const match of text.matchAll(regex)) {
-    diagnostics.push({
-      severity: match[4] === "warning" ? "warning" : "error",
-      code: match[5],
-      message: match[6].trim(),
-      file: normalizeDiagnosticPath(match[1], root),
-      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
-      source: "typescript"
-    });
-  }
-  return diagnostics;
-}
-function parseCargoJson(text, root) {
-  const diagnostics = [];
-  for (const line of text.split(/\r?\n/)) {
-    if (!line.trim().startsWith("{")) continue;
-    try {
-      const value = JSON.parse(line);
-      if (value.reason !== "compiler-message" || !value.message?.message) continue;
-      const primary = value.message.spans?.find((span) => span.is_primary) ?? value.message.spans?.[0];
-      diagnostics.push({
-        severity: normalizeSeverity(value.message.level),
-        ...value.message.code?.code ? { code: value.message.code.code } : {},
-        message: value.message.message,
-        ...primary?.file_name ? { file: normalizeDiagnosticPath(primary.file_name, root) } : {},
-        ...primary?.line_start ? { range: { start: { line: primary.line_start, column: primary.column_start ?? 1 } } } : {},
-        source: "rustc"
-      });
-    } catch {
-    }
-  }
-  return diagnostics;
-}
-function parseGo(text, root) {
-  return parseLinePattern(
-    text,
-    /^(.*?\.go):(\d+):(\d+):\s*(.+)$/gm,
-    root,
-    "go",
-    (_match, message) => ({ message, severity: /warning/i.test(message) ? "warning" : "error" })
-  );
-}
-function parsePhpLint(text, root) {
-  const diagnostics = [];
-  const regex = /(?:PHP\s+)?(?:Parse|Fatal) error:\s*(.+?)\s+in\s+(.+?)\s+on line\s+(\d+)/gi;
-  for (const match of text.matchAll(regex)) {
-    diagnostics.push({
-      severity: "error",
-      message: match[1].trim(),
-      file: normalizeDiagnosticPath(match[2], root),
-      range: { start: { line: toPositiveInt(match[3]), column: 1 } },
-      source: "php"
-    });
-  }
-  return diagnostics;
-}
-function parseDotnet(text, root) {
-  const diagnostics = [];
-  const regex = /^(.+?)\((\d+),(\d+)\):\s*(error|warning)\s+([A-Z]+\d+):\s*(.+?)(?:\s+\[.+\])?$/gm;
-  for (const match of text.matchAll(regex)) {
-    diagnostics.push({
-      severity: match[4] === "warning" ? "warning" : "error",
-      code: match[5],
-      message: match[6].trim(),
-      file: normalizeDiagnosticPath(match[1], root),
-      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
-      source: "dotnet"
-    });
-  }
-  return diagnostics;
-}
-function parseBiome(text, root) {
-  const diagnostics = [];
-  const regex = /^(.+?):(\d+):(\d+)\s+(lint\/[^\s]+|format)\s+(.+)$/gm;
-  for (const match of text.matchAll(regex)) {
-    diagnostics.push({
-      severity: "warning",
-      code: match[4],
-      message: match[5].trim(),
-      file: normalizeDiagnosticPath(match[1], root),
-      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
-      source: "biome"
-    });
-  }
-  return diagnostics;
-}
-function parseGeneric(text, source, root) {
-  return parseLinePattern(
-    text,
-    /^(.+?):(\d+):(\d+):\s*(?:(error|warning|info):\s*)?(.+)$/gm,
-    root,
-    source,
-    (match, fallback) => ({
-      severity: normalizeSeverity(match[4]),
-      message: match[5]?.trim() || fallback
-    })
-  );
-}
-function parsePackageReports(parser, stdout, stderr) {
-  const text = `${stdout}${stdout && stderr ? "\n" : ""}${stderr}`;
-  switch (parser) {
-    case "npm-audit":
-      return parseNpmAudit(text);
-    case "npm-outdated":
-      return parseNpmOutdated(text);
-    case "cargo-audit":
-      return parseCargoAudit(text);
-    case "composer-audit":
-      return parseComposerAudit(text);
-    case "composer-outdated":
-      return parseComposerOutdated(text);
-    case "dotnet-package":
-      return parseDotnetPackage(text);
-    default:
-      return { diagnostics: [], vulnerabilities: [], outdated: [] };
-  }
-}
-function parseNpmAudit(text) {
-  const advisories = [];
-  const diagnostics = [];
-  let root;
-  try {
-    root = JSON.parse(text);
-  } catch {
-    return { diagnostics, vulnerabilities: advisories, outdated: [] };
-  }
-  const vulnerabilities = root?.vulnerabilities ?? {};
-  const advisoriesRecord = root?.advisories ?? vulnerabilities;
-  for (const [id, value] of Object.entries(advisoriesRecord)) {
-    const advisory = value;
-    const name = advisory.module_name ?? advisory.package_name ?? advisory.name ?? id;
-    advisories.push({
-      package: name,
-      ...advisory.title ? { advisory: advisory.title } : { advisory: id },
-      severity: mapSeverity(advisory.severity),
-      ...advisory.patched_versions ? { fixedIn: advisory.patched_versions } : {},
-      ...advisory.url ? { url: advisory.url } : {}
-    });
-    diagnostics.push({
-      severity: mapSeverity(advisory.severity) === "critical" || mapSeverity(advisory.severity) === "high" ? "error" : "warning",
-      code: id,
-      message: advisory.title ?? `Vulnerability reported for ${name}.`,
-      source: "npm-audit"
-    });
-  }
-  return { diagnostics, vulnerabilities: advisories, outdated: [] };
-}
-function parseNpmOutdated(text) {
-  const diagnostics = [];
-  const outdated = [];
-  let payload = {};
-  try {
-    payload = JSON.parse(text);
-  } catch {
-    return { diagnostics, vulnerabilities: [], outdated };
-  }
-  for (const [name, info] of Object.entries(payload)) {
-    const entry = info;
-    if (!entry.latest || entry.latest === entry.current) continue;
-    outdated.push({
-      name,
-      previous: entry.current,
-      resolved: entry.latest,
-      kind: mapOutdatedKind(entry.type)
-    });
-    diagnostics.push({
-      severity: "info",
-      code: "outdated",
-      message: `${name}: ${entry.current ?? "?"} \u2192 ${entry.latest}`,
-      source: "npm-outdated"
-    });
-  }
-  return { diagnostics, vulnerabilities: [], outdated };
-}
-function parseCargoAudit(text) {
-  const diagnostics = [];
-  const vulnerabilities = [];
-  let root;
-  try {
-    root = JSON.parse(text);
-  } catch {
-    return { diagnostics, vulnerabilities, outdated: [] };
-  }
-  const findings = root.vulnerabilities?.found;
-  if (!Array.isArray(findings)) return { diagnostics, vulnerabilities, outdated: [] };
-  for (const finding of findings) {
-    const item = finding;
-    const name = item.package ?? "unknown";
-    const advisory = item.id ?? item.advisory?.id ?? "cargo-audit";
-    vulnerabilities.push({
-      package: name,
-      ...item.title ? { advisory: item.title } : { advisory },
-      severity: mapSeverity(item.severity),
-      ...item.patched_versions && item.patched_versions.length > 0 ? { fixedIn: item.patched_versions[0] } : {},
-      ...item.url?.short ? { url: item.url.short } : {}
-    });
-    diagnostics.push({
-      severity: mapSeverity(item.severity) === "critical" || mapSeverity(item.severity) === "high" ? "error" : "warning",
-      code: advisory,
-      message: item.title ?? `${name} reported by cargo-audit.`,
-      source: "cargo-audit"
-    });
-  }
-  return { diagnostics, vulnerabilities, outdated: [] };
-}
-function parseComposerAudit(text) {
-  const diagnostics = [];
-  const vulnerabilities = [];
-  const lines = text.split(/\r?\n/);
-  for (const line of lines) {
-    if (!line.trim().startsWith("{")) continue;
-    try {
-      const entry = JSON.parse(line);
-      if (!entry.package) continue;
-      vulnerabilities.push({
-        package: entry.package,
-        ...entry.advisory ? { advisory: entry.advisory } : {},
-        ...entry.title ? { advisory: entry.title } : { advisory: entry.advisory ?? "composer-audit" },
-        severity: mapSeverity(entry.severity),
-        ...entry.affectedVersions ? { fixedIn: entry.affectedVersions } : {},
-        ...entry.url ? { url: entry.url } : {}
-      });
-      diagnostics.push({
-        severity: "warning",
-        code: entry.advisory ?? "composer-audit",
-        message: entry.title ?? `${entry.package} reported by composer audit.`,
-        source: "composer-audit"
-      });
-    } catch {
-    }
-  }
-  return { diagnostics, vulnerabilities, outdated: [] };
-}
-function parseComposerOutdated(text) {
-  const diagnostics = [];
-  const outdated = [];
-  const lines = text.split(/\r?\n/);
-  for (const line of lines) {
-    if (!line.trim().startsWith("{")) continue;
-    try {
-      const entry = JSON.parse(line);
-      if (!entry.name || entry.version === entry.latest) continue;
-      outdated.push({
-        name: entry.name,
-        previous: entry.version,
-        resolved: entry.latest ?? entry.version
-      });
-      diagnostics.push({
-        severity: "info",
-        code: "outdated",
-        message: `${entry.name}: ${entry.version ?? "?"} \u2192 ${entry.latest ?? "?"}`,
-        source: "composer-outdated"
-      });
-    } catch {
-    }
-  }
-  return { diagnostics, vulnerabilities: [], outdated };
-}
-function parseDotnetPackage(text) {
-  const diagnostics = [];
-  const vulnerabilities = [];
-  const outdated = [];
-  let root;
-  try {
-    root = JSON.parse(text);
-  } catch {
-    return { diagnostics, vulnerabilities, outdated };
-  }
-  const projects = root.projects;
-  if (!Array.isArray(projects)) return { diagnostics, vulnerabilities, outdated };
-  for (const project of projects) {
-    const packages = Array.isArray(project.packages) ? project.packages : [];
-    for (const pkg of packages) {
-      const name = typeof pkg.name === "string" ? pkg.name : "unknown";
-      const requested = typeof pkg.requestedVersion === "string" ? pkg.requestedVersion : void 0;
-      const resolved = typeof pkg.resolvedVersion === "string" ? pkg.resolvedVersion : void 0;
-      const vulnerabilitiesRaw = Array.isArray(pkg.vulnerabilities) ? pkg.vulnerabilities : [];
-      for (const vuln of vulnerabilitiesRaw) {
-        const advisory = typeof vuln.advisoryUrl === "string" ? vuln.advisoryUrl : "dotnet-vulnerable";
-        vulnerabilities.push({
-          package: name,
-          advisory,
-          severity: mapSeverity(typeof vuln.severity === "string" ? vuln.severity : void 0)
-        });
-      }
-      if (vulnerabilitiesRaw.length > 0) {
-        diagnostics.push({
-          severity: "warning",
-          code: "dotnet-vulnerable",
-          message: `${name} has ${vulnerabilitiesRaw.length} known vulnerability entry/entries.`,
-          source: "dotnet-package"
-        });
-      }
-      if (requested && resolved && requested.startsWith(">") && requested.split(">")[1].split(".").slice(0, 2).join(".") !== resolved.split(".").slice(0, 2).join(".")) {
-        outdated.push({ name, requested, resolved });
-        diagnostics.push({
-          severity: "info",
-          code: "outdated",
-          message: `${name}: ${requested} \u2192 ${resolved}`,
-          source: "dotnet-package"
-        });
-      }
-    }
-  }
-  return { diagnostics, vulnerabilities, outdated };
-}
-function mapSeverity(value) {
-  switch (value?.toLowerCase()) {
-    case "critical":
-    case "high":
-      return "high";
-    case "medium":
-    case "moderate":
-      return "moderate";
-    case "low":
-      return "low";
-    case "unknown":
-      return "unknown";
-    default:
-      return "unknown";
-  }
-}
-function mapOutdatedKind(value) {
-  switch (value?.toLowerCase()) {
-    case "devdependencies":
-    case "development":
-      return "development";
-    case "optionaldependencies":
-    case "optional":
-      return "optional";
-    default:
-      return "runtime";
-  }
-}
-function parseLinePattern(text, regex, root, source, details) {
-  const diagnostics = [];
-  for (const match of text.matchAll(regex)) {
-    const parsed = details(match, match.at(-1)?.trim() ?? "Diagnostic");
-    diagnostics.push({
-      severity: parsed.severity,
-      message: parsed.message,
-      file: normalizeDiagnosticPath(match[1], root),
-      range: { start: { line: toPositiveInt(match[2]), column: toPositiveInt(match[3]) } },
-      source
-    });
-  }
-  return diagnostics;
-}
-function normalizeDiagnosticPath(value, root) {
-  const clean = value.trim().replace(/^['"]|['"]$/g, "");
-  return path5.resolve(root, clean);
-}
-function normalizeSeverity(value) {
-  if (value === "warning" || value === "warn") return "warning";
-  if (value === "info" || value === "note" || value === "help") return "info";
-  if (value === "hint") return "hint";
-  return "error";
-}
-function toPositiveInt(value) {
-  return Math.max(1, Number.parseInt(value ?? "1", 10) || 1);
-}
-function summarize(diagnostics) {
-  return {
-    errors: diagnostics.filter((item) => item.severity === "error").length,
-    warnings: diagnostics.filter((item) => item.severity === "warning").length,
-    infos: diagnostics.filter((item) => item.severity === "info" || item.severity === "hint").length
-  };
-}
-function dedupeDiagnostics(items) {
-  const seen = /* @__PURE__ */ new Set();
-  return items.filter((item) => {
-    const key = [
-      item.source,
-      item.code ?? "",
-      item.file ?? "",
-      item.range?.start.line ?? 0,
-      item.range?.start.column ?? 0,
-      item.message
-    ].join("\0");
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
-}
-function compareDiagnostics(a, b) {
-  return (a.file ?? "").localeCompare(b.file ?? "") || (a.range?.start.line ?? 0) - (b.range?.start.line ?? 0) || (a.range?.start.column ?? 0) - (b.range?.start.column ?? 0) || severityRank(a.severity) - severityRank(b.severity) || (a.code ?? "").localeCompare(b.code ?? "") || a.message.localeCompare(b.message);
-}
-function severityRank(value) {
-  return value === "error" ? 0 : value === "warning" ? 1 : value === "info" ? 2 : 3;
-}
-
-// src/languages/execute.ts
-import * as fs4 from "node:fs/promises";
-import * as path7 from "node:path";
-
-// src/languages/plan.ts
-import * as fs3 from "node:fs/promises";
-import * as path6 from "node:path";
-var MAX_ARGUMENTS = 128;
-var MAX_ARGUMENT_LENGTH = 4096;
-var PACKAGE_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+(?:@[a-z0-9*+._~^<>=|-]+)?$/i;
-var COMPOSER_PACKAGE_RE = /^[a-z0-9_.-]+\/[a-z0-9_.-]+(?::[a-z0-9*+._~^<>=|-]+)?$/i;
-var GO_MODULE_RE = /^(?:[a-z0-9-]+\.)+[a-z0-9-]+\/[a-z0-9._~+/@-]+$/i;
-var PYTHON_PACKAGE_RE = /^[a-z0-9._-]+(?:\[[a-z0-9._,-]+\])?==[a-z0-9*+._!~-]+$/i;
-async function planLanguageOperation(options) {
-  validateOperationOptions(options.operation, options.operationOptions?.packages);
-  validateFilterOption(options.operationOptions?.filter);
-  const detection = await detectLanguageWorkspaces(options);
-  const candidates = detection.workspaces.filter(
-    (workspace) => workspace.capabilities.includes(options.operation)
-  );
-  const selected = selectWorkspace(candidates, options);
-  if (selected.status !== "selected") return selected.result;
-  const profile = (options.profiles ?? languageProfileRegistry.list()).find(
-    (item) => item.id === selected.workspace.language
-  );
-  if (!profile) {
-    return {
-      status: "not_found",
-      reason: `Profile ${selected.workspace.language} is unavailable.`,
-      candidates
-    };
-  }
-  if ((profile.id === "typescript" || profile.id === "javascript") && options.operation !== "syntax" && selected.workspace.packageManager === void 0 && new Set(
-    selected.workspace.evidence.filter((evidence) => evidence.kind === "lockfile").map((evidence) => evidence.value.toLowerCase())
-  ).size > 1) {
-    return {
-      status: "unavailable",
-      workspace: selected.workspace,
-      unavailable: {
-        status: "unavailable",
-        profileId: profile.id,
-        workspaceId: selected.workspace.id,
-        operation: options.operation,
-        reason: "Conflicting Node lockfiles make the package manager ambiguous."
-      }
-    };
-  }
-  const resolver = profile.operations[options.operation];
-  if (!resolver) {
-    return {
-      status: "unavailable",
-      workspace: selected.workspace,
-      unavailable: {
-        status: "unavailable",
-        profileId: profile.id,
-        workspaceId: selected.workspace.id,
-        operation: options.operation,
-        reason: `${profile.displayName} does not define ${options.operation}.`
-      }
-    };
-  }
-  const canonicalCwd = options.cwd ? path6.isAbsolute(options.cwd) ? options.cwd : path6.resolve(detection.projectRoot, options.cwd) : detection.projectRoot;
-  const target = options.target ? await canonicalTarget(canonicalCwd, options.target, detection.projectRoot) : void 0;
-  const ctx = {
-    projectRoot: detection.projectRoot,
-    workspace: selected.workspace,
-    ...target ? { target } : {},
-    mode: options.mode ?? "standard",
-    options: options.operationOptions ?? {},
-    platform: process.platform,
-    pathExists: async (candidate) => {
-      try {
-        await fs3.access(path6.resolve(detection.projectRoot, candidate));
-        return true;
-      } catch {
-        return false;
-      }
-    }
-  };
-  const result = await resolver(ctx);
-  if ("status" in result) {
-    return { status: "unavailable", workspace: selected.workspace, unavailable: result };
-  }
-  const errors = validateCommandPlan(result, profile, detection.projectRoot);
-  if (errors.length > 0) {
-    return {
-      status: "unavailable",
-      workspace: selected.workspace,
-      unavailable: {
-        status: "unavailable",
-        profileId: profile.id,
-        workspaceId: selected.workspace.id,
-        operation: options.operation,
-        reason: `Generated plan failed validation: ${errors.join("; ")}`
-      }
-    };
-  }
-  return { status: "planned", workspace: selected.workspace, plan: Object.freeze(result) };
-}
-function validateCommandPlan(plan, profile, projectRoot) {
-  const errors = [];
-  if (plan.profileId !== profile.id) errors.push("profile id does not match");
-  if (!isInside2(plan.cwd, projectRoot)) errors.push("cwd is outside project root");
-  if (plan.args.length > MAX_ARGUMENTS) errors.push(`argument count exceeds ${MAX_ARGUMENTS}`);
-  if (plan.args.some((arg) => arg.length > MAX_ARGUMENT_LENGTH || /[\r\n\0]/.test(arg))) {
-    errors.push("arguments contain an invalid or oversized value");
-  }
-  if (!Number.isFinite(plan.timeoutMs) || plan.timeoutMs < 1 || plan.timeoutMs > 6e5) {
-    errors.push("timeout is outside 1..600000ms");
-  }
-  if (!Number.isFinite(plan.outputLimitBytes) || plan.outputLimitBytes < 1 || plan.outputLimitBytes > 1e6) {
-    errors.push("output limit is outside 1..1000000 bytes");
-  }
-  if (plan.kind === "internal") {
-    if (plan.command !== null || plan.args.length !== 0)
-      errors.push("internal plans cannot declare a command");
-  } else {
-    if (!plan.command || !profile.executables.includes(plan.command)) {
-      errors.push(`executable "${plan.command ?? ""}" is not allowlisted by the profile`);
-    }
-  }
-  if (Object.keys(plan.env).length > 0)
-    errors.push("Phase 1 plans cannot override environment variables");
-  return errors;
-}
-function selectWorkspace(candidates, options) {
-  if (candidates.length === 0) {
-    return {
-      status: "result",
-      result: {
-        status: "not_found",
-        reason: `No workspace supports ${options.operation}.`,
-        candidates: []
-      }
-    };
-  }
-  if (options.workspace) {
-    const requested = path6.isAbsolute(options.workspace) ? path6.resolve(options.workspace) : path6.resolve(options.projectRoot, options.workspace);
-    const matches = candidates.filter(
-      (item) => item.id === options.workspace || path6.resolve(item.root) === requested
-    );
-    if (matches.length === 1) return { status: "selected", workspace: matches[0] };
-    return {
-      status: "result",
-      result: {
-        status: "not_found",
-        reason: `Requested workspace "${options.workspace}" was not detected.`,
-        candidates: [...candidates]
-      }
-    };
-  }
-  if (options.target) {
-    const base = options.cwd ? path6.isAbsolute(options.cwd) ? path6.resolve(options.cwd) : path6.resolve(options.projectRoot, options.cwd) : path6.resolve(options.projectRoot);
-    const target = path6.isAbsolute(options.target) ? path6.resolve(options.target) : path6.resolve(base, options.target);
-    const targeted = candidates.filter((item) => item.evidence.some((evidence) => evidence.kind === "target")).sort(
-      (a, b) => workspaceDepth(b.root, options.projectRoot) - workspaceDepth(a.root, options.projectRoot) || compareCandidates(a, b)
-    );
-    if (targeted[0]) return { status: "selected", workspace: targeted[0] };
-    const containing = candidates.filter((item) => isInside2(target, item.root)).sort(
-      (a, b) => workspaceDepth(b.root, options.projectRoot) - workspaceDepth(a.root, options.projectRoot) || compareCandidates(a, b)
-    );
-    if (containing[0]) return { status: "selected", workspace: containing[0] };
-  }
-  const sorted = [...candidates].sort(compareCandidates);
-  const first = sorted[0];
-  const firstDepth = workspaceDepth(first.root, options.projectRoot);
-  const tied = sorted.filter(
-    (item) => item.confidence === first.confidence && workspaceDepth(item.root, options.projectRoot) === firstDepth
-  );
-  if (tied.length > 1) {
-    return {
-      status: "result",
-      result: {
-        status: "ambiguous",
-        reason: "Multiple workspaces have equal confidence; provide target, language, or workspace.",
-        candidates: tied
-      }
-    };
-  }
-  return { status: "selected", workspace: first };
-}
-function compareCandidates(a, b) {
-  return b.confidence - a.confidence || a.language.localeCompare(b.language) || a.root.localeCompare(b.root);
-}
-function workspaceDepth(workspaceRoot, projectRoot) {
-  const relative5 = path6.relative(path6.resolve(projectRoot), path6.resolve(workspaceRoot));
-  return relative5 === "" ? 0 : relative5.split(path6.sep).length;
-}
-function validateFilterOption(filter) {
-  if (filter === void 0) return;
-  if (filter.startsWith("-") || filter.includes(" --")) {
-    throw new Error(`Invalid test filter (parsed as a runner option): "${filter}"`);
-  }
-  if (filter.length > MAX_ARGUMENT_LENGTH || /[\r\n\0]/.test(filter)) {
-    throw new Error("Invalid test filter (oversized or contains a control character)");
-  }
-}
-function validateOperationOptions(operation, packages) {
-  if (!operation.startsWith("package-") || !packages) return;
-  for (const value of packages) {
-    if (!value || value.length > 214 || value.startsWith("-") || /[\r\n\0;&|`$<>\\]/.test(value)) {
-      throw new Error(`Invalid package identifier "${value}"`);
-    }
-    if (value.startsWith(".") || value.startsWith("/") || /^[A-Za-z]:/.test(value) || value.includes("://")) {
-      throw new Error(`Package paths and URLs are not supported: "${value}"`);
-    }
-    if (!PACKAGE_NAME_RE.test(value) && !COMPOSER_PACKAGE_RE.test(value) && !GO_MODULE_RE.test(value) && !PYTHON_PACKAGE_RE.test(value)) {
-      throw new Error(`Invalid package identifier "${value}"`);
-    }
-  }
-}
-async function canonicalTarget(cwd, target, projectRoot) {
-  const resolved = path6.isAbsolute(target) ? path6.resolve(target) : path6.resolve(cwd, target);
-  let real;
-  try {
-    real = await fs3.realpath(resolved);
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-    const parent = await fs3.realpath(path6.dirname(resolved));
-    real = path6.join(parent, path6.basename(resolved));
-  }
-  if (!isInside2(real, projectRoot)) throw new Error(`target is outside project root: ${target}`);
-  return real;
-}
-function isInside2(candidate, root) {
-  const relative5 = path6.relative(path6.resolve(root), path6.resolve(candidate));
-  return relative5 === "" || !relative5.startsWith("..") && !path6.isAbsolute(relative5);
-}
-
-// src/languages/execute.ts
-async function validatePlanRealpaths(plan, projectRoot) {
-  const realRoot = await fs4.realpath(projectRoot);
-  let realCwd;
-  try {
-    realCwd = await fs4.realpath(plan.cwd);
-  } catch (error) {
-    return `Plan cwd is unavailable: ${error instanceof Error ? error.message : String(error)}`;
-  }
-  if (!isRealInside(realCwd, realRoot)) return "Plan cwd resolves outside project root.";
-  for (const argument of plan.args) {
-    if (!path7.isAbsolute(argument)) continue;
-    try {
-      const realArgument = await fs4.realpath(argument);
-      if (!isRealInside(realArgument, realRoot)) {
-        return `Plan argument resolves outside project root: ${argument}`;
-      }
-    } catch (error) {
-      if (error.code !== "ENOENT") {
-        return `Plan argument could not be resolved safely: ${argument}`;
-      }
-    }
-  }
-  return void 0;
-}
-function isRealInside(candidate, root) {
-  const relative5 = path7.relative(root, candidate);
-  return relative5 === "" || !relative5.startsWith("..") && !path7.isAbsolute(relative5);
-}
-async function* executePackagePlan(options) {
-  const { plan, workspace } = options;
-  const startedAt = Date.now();
-  if (options.signal.aborted) {
-    yield { type: "log", text: "Run cancelled before execution." };
-    return terminalPackageResult(options, "cancelled", startedAt);
-  }
-  const profile = languageProfileRegistry.get(plan.profileId);
-  if (!profile) {
-    yield { type: "warning", text: `Unknown language profile: ${plan.profileId}` };
-    return terminalPackageResult(options, "unavailable", startedAt, "Unknown language profile.");
-  }
-  if (workspace.id !== plan.workspaceId || workspace.language !== plan.profileId) {
-    return terminalPackageResult(
-      options,
-      "unavailable",
-      startedAt,
-      "Plan and workspace identity do not match."
-    );
-  }
-  const validation = validateCommandPlan(plan, profile, options.projectRoot);
-  if (validation.length > 0) {
-    return terminalPackageResult(
-      options,
-      "unavailable",
-      startedAt,
-      `Plan failed execution validation: ${validation.join("; ")}`
-    );
-  }
-  const containmentError = await validatePlanRealpaths(plan, options.projectRoot);
-  if (containmentError) {
-    return terminalPackageResult(options, "unavailable", startedAt, containmentError);
-  }
-  const manifestsBefore = await snapshotPaths(workspace.manifests);
-  const lockfilePaths = collectLockfilePaths(workspace);
-  const lockfilesBefore = await snapshotPaths(lockfilePaths);
-  const manifestSizesBefore = await snapshotSizes(workspace.manifests);
-  const lockfileSizesBefore = await snapshotSizes(lockfilePaths);
-  yield {
-    type: "log",
-    text: plan.kind === "process" ? `${plan.command} ${plan.args.join(" ")}` : `${plan.parser}: ${plan.operation}`,
-    data: {
-      language: plan.profileId,
-      operation: plan.operation,
-      workspace: workspace.root,
-      packages: [...options.packages]
-    }
-  };
-  const timeoutController = new AbortController();
-  const timer = setTimeout(
-    () => timeoutController.abort(new Error("language package plan timed out")),
-    plan.timeoutMs
-  );
-  timer.unref?.();
-  const signal = AbortSignal.any([options.signal, timeoutController.signal]);
-  let spawned;
-  let run;
-  let status = "unavailable";
-  let error;
-  try {
-    if (plan.kind !== "process") {
-      return terminalPackageResult(
-        options,
-        "unavailable",
-        startedAt,
-        "Package operations require an executable plan; internal plans cannot mutate the manifest."
-      );
-    }
-    const stream = spawnStream({
-      cmd: plan.command,
-      args: [...plan.args],
-      cwd: plan.cwd,
-      signal,
-      maxBytes: plan.outputLimitBytes
-    });
-    for (; ; ) {
-      const next = await stream.next();
-      if (next.done) {
-        spawned = next.value;
-        break;
-      }
-      yield next.value;
-    }
-  } catch (error_) {
-    error = error_ instanceof Error ? error_.message : String(error_);
-  } finally {
-    clearTimeout(timer);
-  }
-  if (spawned) {
-    const parsed = parseLanguageDiagnostics(
-      plan.parser,
-      spawned.stdout,
-      spawned.stderr,
-      workspace.root
-    );
-    const timedOut = timeoutController.signal.aborted && !options.signal.aborted;
-    const cancelled = options.signal.aborted;
-    const spawnUnavailable = Boolean(
-      spawned.error && /ENOENT|not found|cannot find/i.test(spawned.error)
-    );
-    status = timedOut ? "timed_out" : cancelled ? "cancelled" : spawnUnavailable ? "unavailable" : spawned.exitCode === 0 ? "passed" : "failed";
-    error ??= spawned.error;
-    const raw = [spawned.stdout, spawned.stderr, spawned.error].filter(Boolean).join("\n");
-    run = {
-      status,
-      language: plan.profileId,
-      workspace,
-      plan,
-      exitCode: spawned.exitCode,
-      durationMs: Date.now() - startedAt,
-      diagnostics: parsed.diagnostics,
-      omittedDiagnostics: parsed.omitted,
-      summary: parsed.summary,
-      output: normalizeCommandOutput(raw, { maxBytes: plan.outputLimitBytes }),
-      truncated: spawned.truncated,
-      ...spawned.spoolPath ? { spoolPath: spawned.spoolPath } : {},
-      ...spawned.error ? { error: spawned.error } : {}
-    };
-  } else {
-    status = options.signal.aborted ? "cancelled" : timeoutController.signal.aborted ? "timed_out" : "failed";
-  }
-  if (status !== "passed") {
-    return terminalPackageResult(
-      options,
-      status,
-      startedAt,
-      error,
-      run,
-      manifestsBefore,
-      lockfilesBefore
-    );
-  }
-  const manifestsAfter = await snapshotPaths(workspace.manifests);
-  const lockfilesAfter = await snapshotPaths(lockfilePaths);
-  const manifestSizesAfter = await snapshotSizes(workspace.manifests);
-  const lockfileSizesAfter = await snapshotSizes(lockfilePaths);
-  const manifestsChanged = await changedPaths(
-    manifestsBefore,
-    manifestsAfter,
-    manifestSizesBefore,
-    manifestSizesAfter
-  );
-  const lockfilesChanged = await changedPaths(
-    lockfilesBefore,
-    lockfilesAfter,
-    lockfileSizesBefore,
-    lockfileSizesAfter
-  );
-  const reports = parsePackageReports(plan.parser, spawned?.stdout ?? "", spawned?.stderr ?? "");
-  const mutations = packageMutationsFromInputs(options.packages, reports.outdated);
-  return {
-    workspace,
-    language: plan.profileId,
-    operation: plan.operation,
-    status,
-    ...run ? { run } : {},
-    durationMs: Date.now() - startedAt,
-    manifestsBefore,
-    lockfilesBefore,
-    manifestsAfter,
-    lockfilesAfter,
-    mutations,
-    vulnerabilities: reports.vulnerabilities,
-    outdated: reports.outdated,
-    manifestsChanged: Object.freeze(manifestsChanged),
-    lockfilesChanged: Object.freeze(lockfilesChanged)
-  };
-}
-function packageMutationsFromInputs(inputs, outdated) {
-  const outdatedNames = new Set(outdated.map((entry) => entry.name));
-  return inputs.filter((name) => !outdatedNames.has(name)).map((name) => ({ name, requested: name, kind: "runtime" }));
-}
-async function snapshotPaths(paths) {
-  const existing = [];
-  for (const candidate of paths) {
-    try {
-      const stat5 = await fs4.stat(candidate);
-      if (!stat5.isFile()) continue;
-      existing.push(candidate);
-    } catch {
-    }
-  }
-  return Object.freeze(existing);
-}
-async function changedPaths(before, after, beforeSizes, afterSizes) {
-  const beforeSet = new Set(before);
-  const afterSet = new Set(after);
-  const changed = /* @__PURE__ */ new Set();
-  for (const path9 of after) {
-    if (!beforeSet.has(path9)) changed.add(path9);
-  }
-  for (const path9 of before) {
-    if (!afterSet.has(path9)) changed.add(path9);
-  }
-  if (beforeSizes && afterSizes) {
-    for (const path9 of after) {
-      if (beforeSizes.get(path9) !== afterSizes.get(path9)) changed.add(path9);
-    }
-  }
-  return [...changed].sort();
-}
-async function snapshotSizes(paths) {
-  const sizes = /* @__PURE__ */ new Map();
-  for (const candidate of paths) {
-    try {
-      const stat5 = await fs4.stat(candidate);
-      if (stat5.isFile()) sizes.set(candidate, stat5.size);
-    } catch {
-    }
-  }
-  return sizes;
-}
-function collectLockfilePaths(workspace) {
-  const explicit = workspace.evidence.filter((evidence) => evidence.kind === "lockfile").map((evidence) => evidence.path);
-  const detected = LOCKFILE_NAMES_BY_PROFILE.get(workspace.language)?.map(
-    (name) => path7.join(workspace.root, name)
-  ) ?? [];
-  const merged = /* @__PURE__ */ new Set();
-  for (const candidate of [...explicit, ...detected]) merged.add(candidate);
-  return Object.freeze([...merged]);
-}
-var LOCKFILE_NAMES_BY_PROFILE = /* @__PURE__ */ new Map([
-  ["typescript", ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"]],
-  ["javascript", ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"]],
-  ["go", ["go.sum"]],
-  ["rust", ["Cargo.lock"]],
-  ["php", ["composer.lock"]],
-  ["csharp", ["packages.lock.json"]]
-]);
-function terminalPackageResult(options, status, startedAt, error, run, manifestsBefore = [], lockfilesBefore = []) {
-  return {
-    workspace: options.workspace,
-    language: options.plan.profileId,
-    operation: options.plan.operation,
-    status,
-    ...run ? { run } : {},
-    durationMs: Date.now() - startedAt,
-    manifestsBefore,
-    lockfilesBefore,
-    manifestsAfter: manifestsBefore,
-    lockfilesAfter: lockfilesBefore,
-    manifestsChanged: Object.freeze([]),
-    lockfilesChanged: Object.freeze([]),
-    mutations: Object.freeze([]),
-    vulnerabilities: Object.freeze([]),
-    outdated: Object.freeze([]),
-    ...error ? { error } : {}
-  };
-}
-
-// src/languages/legacy-bridge.ts
-var NON_JS_MARKERS = [
-  { filename: "go.mod", language: "go" },
-  { filename: "go.work", language: "go" },
-  { filename: "Cargo.toml", language: "rust" },
-  { filename: "composer.json", language: "php" }
-];
-var NON_JS_SUFFIXES = [
-  { suffix: ".csproj", language: "csharp" },
-  { suffix: ".fsproj", language: "csharp" }
-];
-async function detectNonJsEcosystem(cwd, projectRoot) {
-  try {
-    let dir = path8.resolve(cwd);
-    const root = path8.resolve(projectRoot);
-    for (let depth = 0; depth <= 4 && dir.startsWith(root); depth++) {
-      for (const marker of NON_JS_MARKERS) {
-        try {
-          const s = await fs5.stat(path8.join(dir, marker.filename));
-          if (s.isFile()) return marker.language;
-        } catch {
-        }
-      }
-      try {
-        const entries = await fs5.readdir(dir);
-        for (const entry of entries) {
-          for (const suffix of NON_JS_SUFFIXES) {
-            if (entry.toLowerCase().endsWith(suffix.suffix)) return suffix.language;
-          }
-        }
-      } catch {
-      }
-      if (dir === root) break;
-      dir = path8.dirname(dir);
-    }
-  } catch {
-  }
-  return null;
-}
-async function tryLegacyPackageOperation(operation, ctx, packages = []) {
-  const language = await detectNonJsEcosystem(ctx.cwd, ctx.projectRoot);
-  if (!language) return null;
-  const planResult = await planLanguageOperation({
-    projectRoot: ctx.projectRoot,
-    cwd: ctx.cwd,
-    operation,
-    language,
-    signal: ctx.signal,
-    ...packages.length > 0 ? { operationOptions: { packages: [...packages] } } : {}
-  });
-  if (planResult.status !== "planned") return null;
-  const runner = executePackagePlan({
-    projectRoot: ctx.projectRoot,
-    workspace: planResult.workspace,
-    plan: planResult.plan,
-    packages,
-    signal: ctx.signal
-  });
-  for (; ; ) {
-    const next = await runner.next();
-    if (next.done) return { language, outcome: next.value };
-  }
-}
-
-// src/audit.ts
-var SEVERITY_RANK = {
-  info: 0,
-  low: 1,
-  moderate: 2,
-  high: 3,
-  critical: 4
-};
-var auditTool = {
-  name: "audit",
-  category: "Package Management",
-  description: "Run a security audit against project dependencies (using pnpm/npm audit). Reports known vulnerabilities with severity.",
-  usageHint: "CRITICAL SECURITY TOOL:\n\n- Run regularly and especially before any release.\n- Use `level` to focus on high/critical issues.\n- This tool is read-only: to remediate, use `install` (or `language_package`) to upgrade the affected packages.\nThis is one of the most important tools for supply chain security.",
-  permission: "confirm",
-  mutating: false,
-  capabilities: ["shell.restricted"],
-  icon: "package",
-  timeoutMs: 6e4,
-  inputSchema: {
-    type: "object",
-    properties: {
-      cwd: { type: "string", description: "Working directory (default: cwd)" },
-      level: {
-        type: "string",
-        enum: ["low", "moderate", "high", "critical"],
-        description: "Minimum severity level to report"
-      },
-      fix: {
-        type: "boolean",
-        description: "Deprecated and rejected \u2014 this tool is read-only and never modifies dependencies. Use `install` (or `language_package`) to remediate vulnerabilities."
-      }
-    }
-  },
-  async execute(input, ctx, opts) {
-    let final;
-    const executeStream = auditTool.executeStream;
-    if (!executeStream) throw new Error("auditTool: stream execution unavailable");
-    for await (const ev of executeStream(input, ctx, opts)) {
-      if (ev.type === "final") final = ev.output;
-    }
-    if (!final) throw new Error("audit: stream ended without final event");
-    return final;
-  },
-  async *executeStream(input, ctx, opts) {
-    if (input.fix === true) {
-      throw new Error(
-        "audit: `fix: true` is not supported \u2014 this tool is read-only (mutating: false). To remediate vulnerabilities, upgrade the affected packages with the `install` tool (or `language_package` for non-JS ecosystems)."
-      );
-    }
-    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
-    const bridge = await tryLegacyPackageOperation("package-audit", {
-      cwd,
-      projectRoot: ctx.projectRoot,
-      signal: opts.signal
-    });
-    if (bridge?.outcome) {
-      const outcome = bridge.outcome;
-      const vulns = outcome.vulnerabilities.map((v) => ({
-        severity: v.severity,
-        package: v.package,
-        title: v.advisory ?? "Unknown vulnerability",
-        url: v.url ?? ""
-      }));
-      const total = vulns.length;
-      const summary = total === 0 ? "No vulnerabilities found" : `Found ${total} vulnerabilities: ${vulns.filter((a) => a.severity === "critical").length} critical, ${vulns.filter((a) => a.severity === "high").length} high`;
-      yield {
-        type: "final",
-        output: {
-          exit_code: outcome.run?.exitCode ?? 0,
-          vulnerabilities: vulns,
-          total,
-          summary,
-          output: outcome.run?.output ?? "",
-          truncated: outcome.run?.truncated ?? false
-        }
-      };
-      return;
-    }
-    const manager = await detectPackageManager(cwd, ctx.projectRoot);
-    yield { type: "log", text: `Auditing with ${manager}\u2026`, data: { manager } };
-    const args = ["audit", "--json"];
-    if (input.level && (manager === "npm" || manager === "pnpm")) {
-      args.push(`--audit-level=${input.level}`);
-    }
-    const result = yield* spawnStream({
-      cmd: manager,
-      args,
-      cwd,
-      signal: opts.signal,
-      maxBytes: 1e5
-    });
-    yield {
-      type: "final",
-      output: parseAuditOutput(result.stdout, result.exitCode, {
-        level: input.level,
-        spawnTruncated: result.truncated
-      })
-    };
-  }
-};
-function parseAuditOutput(json, exitCode, opts = {}) {
-  if (!json) {
-    return {
-      exit_code: exitCode,
-      vulnerabilities: [],
-      total: 0,
-      summary: exitCode === 0 ? "No vulnerabilities found" : "Audit failed",
-      output: "",
-      truncated: false
-    };
-  }
-  const cappedOutput = normalizeCommandOutput(json);
-  const truncated = opts.spawnTruncated === true || Buffer.byteLength(json, "utf8") > COMMAND_OUTPUT_MAX_BYTES;
-  try {
-    const data = JSON.parse(json);
-    let advisories = extractAdvisories(data);
-    const minRank = opts.level ? SEVERITY_RANK[opts.level] ?? 0 : 0;
-    if (minRank > 0) {
-      advisories = advisories.filter((a) => (SEVERITY_RANK[a.severity] ?? 0) >= minRank);
-    }
-    const total = advisories.length;
-    const summary = total === 0 ? "No vulnerabilities found" : `Found ${total} vulnerabilities: ${advisories.filter((a) => a.severity === "critical").length} critical, ${advisories.filter((a) => a.severity === "high").length} high`;
-    return {
-      exit_code: exitCode,
-      vulnerabilities: advisories,
-      total,
-      summary,
-      output: cappedOutput,
-      truncated
-    };
-  } catch {
-    return {
-      exit_code: exitCode,
-      vulnerabilities: [],
-      total: 0,
-      summary: "Could not parse audit output",
-      output: cappedOutput,
-      truncated
-    };
-  }
-}
-function extractAdvisories(data) {
-  const advisories = [];
-  const ads = data["advisories"];
-  if (ads && typeof ads === "object") {
-    for (const [id, value] of Object.entries(ads)) {
-      const adv = value ?? {};
-      advisories.push({
-        severity: typeof adv["severity"] === "string" ? adv["severity"] : "unknown",
-        package: typeof adv["module_name"] === "string" ? adv["module_name"] : id,
-        title: typeof adv["title"] === "string" ? adv["title"] : "Unknown vulnerability",
-        url: typeof adv["url"] === "string" ? adv["url"] : ""
-      });
-    }
-    return advisories;
-  }
-  const vulns = data["vulnerabilities"];
-  if (vulns && typeof vulns === "object") {
-    for (const [pkg, value] of Object.entries(vulns)) {
-      const vuln = value ?? {};
-      const via = Array.isArray(vuln["via"]) ? vuln["via"] : [];
-      const detail = via.find((v) => !!v && typeof v === "object");
-      advisories.push({
-        severity: typeof vuln["severity"] === "string" ? vuln["severity"] : "unknown",
-        package: pkg,
-        title: detail && typeof detail["title"] === "string" ? detail["title"] : "Unknown vulnerability",
-        url: detail && typeof detail["url"] === "string" ? detail["url"] : ""
-      });
-    }
-  }
-  return advisories;
-}
+  auditTool
+} from "./chunk-HEQFMLZ7.js";
+import "./chunk-NHA6BEIH.js";
+import "./chunk-DPL47QGS.js";
+import "./chunk-MAN26PZ5.js";
+import "./chunk-2TFQDEPU.js";
+import "./chunk-3PVYQFRQ.js";
+import "./chunk-HFXSNKCV.js";
+import "./chunk-V43EQ6VR.js";
+import "./chunk-D33S4RQG.js";
 export {
   auditTool
 };