@wrongstack/tools 0.317.2 → 0.319.0

package/dist/_util.d.ts

@@ -69,6 +69,19 @@ export declare function resolveRealInsideRoot(absPath: string, ctx: Context): Pr
  * caller then opened.
  */
 export declare function safeResolveReal(input: string, ctx: Context): Promise<string>;
+/**
+ * Project-root-relative variant of {@link safeResolveReal} for the codebase
+ * tools whose documented input contract is "relative to projectRoot or
+ * absolute" (codebase-skeleton, security-ast-scan, codebase-invariant-check,
+ * codebase-ast-replace). The sibling file tools (edit/grep/glob/…) resolve
+ * relative input against the session cwd — that is THEIR contract; these four
+ * always resolved against the project root and their schemas say so. Routing
+ * them through plain safeResolveReal silently changed that: with a nested
+ * workingDir (worktrees, set_working_dir) a relative input resolved to the
+ * wrong file. Containment is still enforced exactly as in safeResolveReal
+ * (realpath + allowOutsideProjectRoot honored).
+ */
+export declare function safeResolveProjectPath(input: string, ctx: Context): Promise<string>;
 /**
  * Truncate a diff (or similar text payload) to `maxBytes`, cutting at a line
  * boundary and appending an explicit marker. Used by the mutating file tools

package/dist/audit.js

@@ -1,14 +1,14 @@
 import {
   auditTool
-} from "./chunk-CVALEVGA.js";
-import "./chunk-4E42D7UF.js";
-import "./chunk-SOG7XIRF.js";
+} from "./chunk-QZDOQRF7.js";
+import "./chunk-ZDUGI5BC.js";
+import "./chunk-UC3RKRIV.js";
 import "./chunk-ZHH3BEWU.js";
 import "./chunk-2VSZC6QM.js";
 import "./chunk-3PVYQFRQ.js";
 import "./chunk-HFXSNKCV.js";
 import "./chunk-V43EQ6VR.js";
-import "./chunk-D33S4RQG.js";
+import "./chunk-QLF74MSV.js";
 export {
   auditTool
 };

package/dist/bash.js

@@ -1,13 +1,13 @@
 import {
   bashTool
-} from "./chunk-HTYEO67J.js";
+} from "./chunk-WNUJR3H4.js";
 import "./chunk-BTSFTGIL.js";
 import "./chunk-NKNOBUBU.js";
 import "./chunk-2VSZC6QM.js";
 import "./chunk-3PVYQFRQ.js";
 import "./chunk-HFXSNKCV.js";
 import "./chunk-V43EQ6VR.js";
-import "./chunk-D33S4RQG.js";
+import "./chunk-QLF74MSV.js";
 export {
   bashTool
 };

package/dist/builtin.js

@@ -5,10 +5,10 @@ import {
   TIER2_TOOLS,
   TIER3_TOOLS,
   builtinTools
-} from "./chunk-XVGB6KYU.js";
-import "./chunk-5WNDJHT6.js";
-import "./chunk-AK2K4KHR.js";
-import "./chunk-EEOFQDT6.js";
+} from "./chunk-VALQFAY2.js";
+import "./chunk-DPKTXJQS.js";
+import "./chunk-RK47IWO3.js";
+import "./chunk-OCUXN6Y3.js";
 import "./chunk-H6AWAZ2Y.js";
 import "./chunk-X5K3U6GI.js";
 import "./chunk-RJZQWEMS.js";
@@ -16,58 +16,58 @@ import "./chunk-FRN7TIAA.js";
 import "./chunk-WXJY3BKV.js";
 import "./chunk-QBV725YG.js";
 import "./chunk-6RNIFLG4.js";
-import "./chunk-CPVLVQYT.js";
-import "./chunk-UE3UBMCP.js";
-import "./chunk-CVALEVGA.js";
-import "./chunk-MRZOVQ5D.js";
-import "./chunk-CPSAF2AU.js";
-import "./chunk-EMRGN4KM.js";
-import "./chunk-TKA4VEX2.js";
-import "./chunk-ZE6KLBUO.js";
-import "./chunk-RUOMW2I6.js";
-import "./chunk-VB3MJGCV.js";
-import "./chunk-P7ZQ2FAJ.js";
-import "./chunk-J5SKD6LN.js";
-import "./chunk-WJYXMB2R.js";
-import "./chunk-3QQSBUXR.js";
-import "./chunk-4AEZIFOW.js";
-import "./chunk-4E42D7UF.js";
-import "./chunk-SOG7XIRF.js";
+import "./chunk-Y7QXSE7N.js";
+import "./chunk-4Q7LFU4T.js";
+import "./chunk-QZDOQRF7.js";
+import "./chunk-Z4VBTVUM.js";
+import "./chunk-YZHK4TLF.js";
+import "./chunk-HBM4QNXU.js";
+import "./chunk-2472NT76.js";
+import "./chunk-UMXVT7ST.js";
+import "./chunk-COUNXG4X.js";
+import "./chunk-D4CXUZIF.js";
+import "./chunk-7WV3D4S3.js";
+import "./chunk-HWDB2G7J.js";
+import "./chunk-ZKSBHXVB.js";
+import "./chunk-ODFVG54U.js";
+import "./chunk-VFF3Q5Z3.js";
+import "./chunk-ZDUGI5BC.js";
+import "./chunk-UC3RKRIV.js";
 import "./chunk-ZHH3BEWU.js";
-import "./chunk-6RR5VX6U.js";
-import "./chunk-ICAXDRP6.js";
-import "./chunk-S2JRYDYG.js";
+import "./chunk-OYVPBPCL.js";
+import "./chunk-OJ4FIBAN.js";
+import "./chunk-N5O3FK5Q.js";
 import "./chunk-Q5JPPCZC.js";
 import "./chunk-NWZ6XGBJ.js";
-import "./chunk-HTYEO67J.js";
-import "./chunk-WI3VDXHD.js";
+import "./chunk-WNUJR3H4.js";
+import "./chunk-PMHVSHMU.js";
 import "./chunk-BTSFTGIL.js";
 import "./chunk-NKNOBUBU.js";
 import "./chunk-2VSZC6QM.js";
 import "./chunk-3PVYQFRQ.js";
 import "./chunk-HFXSNKCV.js";
-import "./chunk-UKGMDCXT.js";
+import "./chunk-KD5EHYA2.js";
 import "./chunk-PQTONQ4P.js";
 import "./chunk-NBDZMMG2.js";
 import "./chunk-5ZYEGP2P.js";
 import "./chunk-FJEQZHZN.js";
 import "./chunk-CWALNI6K.js";
 import "./chunk-45JPRMC2.js";
-import "./chunk-NKX4SJ5R.js";
-import "./chunk-BANPF4LY.js";
-import "./chunk-TDLZIDCY.js";
+import "./chunk-C3W3V54D.js";
+import "./chunk-MYRMD6PZ.js";
+import "./chunk-PRXZOIEW.js";
 import "./chunk-FQZOHLG3.js";
-import "./chunk-A2PX7M7A.js";
-import "./chunk-UOXX4SQZ.js";
-import "./chunk-TFEGJDH5.js";
-import "./chunk-JJQB6R7Y.js";
-import "./chunk-ZLTFLC25.js";
-import "./chunk-A6BRWIXN.js";
+import "./chunk-MRKWZCHZ.js";
+import "./chunk-W4GAAI3M.js";
+import "./chunk-TFMVHYJI.js";
+import "./chunk-TX3R5NVV.js";
+import "./chunk-IIF5HIVF.js";
+import "./chunk-6IEBD27U.js";
 import "./chunk-UCYQTZ7F.js";
 import "./chunk-YOHO4DVT.js";
-import "./chunk-ELFFQ4RU.js";
+import "./chunk-DTQ75VBC.js";
 import "./chunk-V43EQ6VR.js";
-import "./chunk-D33S4RQG.js";
+import "./chunk-QLF74MSV.js";
 export {
   OFF_ONLY_TOOLS,
   OPTIONAL_TOOLS,

package/dist/{chunk-TKA4VEX2.js → chunk-2472NT76.js}

@@ -1,6 +1,6 @@
 import {
   safeResolveReal
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/scaffold.ts
 import * as fs from "node:fs/promises";
@@ -197,4 +197,4 @@ function substituteVars(content, name, vars) {
 export {
   scaffoldTool
 };
-//# sourceMappingURL=chunk-TKA4VEX2.js.map
+//# sourceMappingURL=chunk-2472NT76.js.map

package/dist/{chunk-UE3UBMCP.js → chunk-4Q7LFU4T.js}

@@ -1,6 +1,6 @@
 import {
   tryLegacyPackageOperation
-} from "./chunk-4E42D7UF.js";
+} from "./chunk-ZDUGI5BC.js";
 import {
   spawnStream
 } from "./chunk-ZHH3BEWU.js";
@@ -8,7 +8,7 @@ import {
   detectPackageManager,
   normalizeCommandOutput,
   safeResolveReal
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/install.ts
 import { join } from "node:path";
@@ -221,4 +221,4 @@ function resolveManifestPath(cwd, pkgManager) {
 export {
   installTool
 };
-//# sourceMappingURL=chunk-UE3UBMCP.js.map
+//# sourceMappingURL=chunk-4Q7LFU4T.js.map

package/dist/{chunk-RMB76PDS.js → chunk-65EMYN5G.js}

@@ -1,10 +1,10 @@
 import {
   builtinToolsPack
-} from "./chunk-FYDKHXN7.js";
+} from "./chunk-SYXW3Y5Z.js";
 import {
   TIER1_TOOLS,
   TIER2_TOOLS
-} from "./chunk-XVGB6KYU.js";
+} from "./chunk-VALQFAY2.js";
 
 // src/tool-tier.ts
 function toolNameSet(tools) {
@@ -51,4 +51,4 @@ export {
   selectBuiltinToolsForTier,
   registerBuiltinToolTier
 };
-//# sourceMappingURL=chunk-RMB76PDS.js.map
+//# sourceMappingURL=chunk-65EMYN5G.js.map

package/dist/{chunk-A6BRWIXN.js → chunk-6IEBD27U.js}

@@ -2,7 +2,17 @@
 var C_LIKE = [
   { re: /\b(?:class|struct|enum|interface|union)\s+([A-Za-z_]\w*)/g, kind: "class" },
   {
-    re: /\b(?:public|private|protected|static|final|async|override|virtual|inline|export)?\s*(?:[\w:<>[\]\s*&]+)\s+([A-Za-z_]\w*)\s*\([^;{]*\)\s*(?:const)?\s*[{;]/g,
+    // H-10 (security report VF-11): the old shape
+    // `(?:…modifiers…)?\s*(?:[\w:<>[\]\s*&]+)\s+name\(` had three adjacent
+    // quantifiers that could each consume whitespace (`\s*`, the class with
+    // `\s` inside, `\s+`) — catastrophic backtracking on whitespace runs
+    // (516 bytes = 4.5 s measured). Decomposed so whitespace is owned by
+    // exactly one position: modifiers each consume their own trailing
+    // whitespace, the type is a single no-whitespace class, one `\s+`
+    // separates type from name. Generic types with internal spaces
+    // (`Map<String, Integer> x;`) are no longer matched — tree-sitter is the
+    // primary parser for C/C++ and this is only its WASM-less fallback.
+    re: /\b(?:(?:public|private|protected|static|final|async|override|virtual|inline|export)\s+)?[\w:<>[\]*&]+\s+([A-Za-z_]\w*)\s*\([^;{]*\)\s*(?:const)?\s*[{;]/g,
     kind: "function"
   },
   { re: /\b(?:namespace)\s+([A-Za-z_]\w*)/g, kind: "namespace" }
@@ -33,7 +43,11 @@ var LANG_PATTERNS = {
   java: [
     { re: /\b(?:class|interface|enum|record)\s+([A-Za-z_]\w*)/g, kind: "class" },
     {
-      re: /\b(?:public|private|protected|static|final|abstract|synchronized|native|default|\s)+\s*[\w.<>,[\]\s]+\s+([A-Za-z_]\w*)\s*\(/g,
+      // H-10 (security report VF-11): same rewrite as C_LIKE above — the old
+      // `(?:…|\s)+\s*[\w.<>,[\]\s]+\s+` let three quantifiers compete for the
+      // same whitespace (800 bytes of padding measured at 42 s). Whitespace
+      // now has exactly one owner per position.
+      re: /\b(?:(?:public|private|protected|static|final|abstract|synchronized|native|default)\s+)*[\w.$,<>[\]]+\s+([A-Za-z_]\w*)\s*\(/g,
       kind: "method"
     }
   ],
@@ -41,7 +55,8 @@ var LANG_PATTERNS = {
     { re: /\b(?:class|interface|struct|enum|record)\s+([A-Za-z_]\w*)/g, kind: "class" },
     { re: /\bnamespace\s+([A-Za-z_.\w]+)/g, kind: "namespace" },
     {
-      re: /\b(?:public|private|protected|internal|static|async|override|virtual|\s)+\s*[\w.<>,[\]\s]+\s+([A-Za-z_]\w*)\s*\(/g,
+      // H-10: see java above.
+      re: /\b(?:(?:public|private|protected|internal|static|async|override|virtual)\s+)*[\w.$,<>[\]]+\s+([A-Za-z_]\w*)\s*\(/g,
       kind: "method"
     }
   ],
@@ -250,7 +265,7 @@ function lineColAt(offsets, index) {
   return { line: low + 1, col: index - lastNl };
 }
 var GENERIC_MAX_SYMBOLS_DEFAULT = 500;
-var GENERIC_MAX_FILE_CHARS = 512 * 1024;
+var GENERIC_MAX_FILE_CHARS = 128 * 1024;
 function parseGeneric(opts) {
   const { file, lang } = opts;
   const maxSymbols = opts.maxSymbols ?? GENERIC_MAX_SYMBOLS_DEFAULT;
@@ -314,4 +329,4 @@ export {
   parseGeneric,
   parseSymbols
 };
-//# sourceMappingURL=chunk-A6BRWIXN.js.map
+//# sourceMappingURL=chunk-6IEBD27U.js.map

package/dist/{chunk-P7ZQ2FAJ.js → chunk-7WV3D4S3.js}

@@ -1,6 +1,6 @@
 import {
   safeResolveReal
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/diff.ts
 import { spawn } from "node:child_process";
@@ -210,4 +210,4 @@ ${numbered}`;
 export {
   diffTool
 };
-//# sourceMappingURL=chunk-P7ZQ2FAJ.js.map
+//# sourceMappingURL=chunk-7WV3D4S3.js.map

package/dist/{chunk-NKX4SJ5R.js → chunk-C3W3V54D.js}

@@ -1,15 +1,15 @@
 import {
   getIndexState,
   searchCodebaseIndex
-} from "./chunk-A2PX7M7A.js";
+} from "./chunk-MRKWZCHZ.js";
 import {
   codebaseIndexDirOverride
-} from "./chunk-TFEGJDH5.js";
+} from "./chunk-TFMVHYJI.js";
 import {
   isBinaryBuffer,
   safeResolveReal,
   sha256hex
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/read.ts
 import * as fs from "node:fs/promises";
@@ -295,4 +295,4 @@ ${interesting.join("\n")}` : "symbols/imports: (none detected)"
 export {
   readTool
 };
-//# sourceMappingURL=chunk-NKX4SJ5R.js.map
+//# sourceMappingURL=chunk-C3W3V54D.js.map

package/dist/{chunk-RUOMW2I6.js → chunk-COUNXG4X.js}

@@ -1,11 +1,11 @@
 import {
   enqueueReindex
-} from "./chunk-A2PX7M7A.js";
+} from "./chunk-MRKWZCHZ.js";
 import {
   resolveRealInsideRoot,
   safeResolveReal,
   sha256hex
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/patch.ts
 import { spawn } from "node:child_process";
@@ -313,4 +313,4 @@ function extractPatchedFiles(output) {
 export {
   patchTool
 };
-//# sourceMappingURL=chunk-RUOMW2I6.js.map
+//# sourceMappingURL=chunk-COUNXG4X.js.map

package/dist/{chunk-VB3MJGCV.js → chunk-D4CXUZIF.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-Q5JPPCZC.js";
 import {
   safeResolveReal
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/json.ts
 import * as fs from "node:fs/promises";
@@ -607,4 +607,4 @@ function toYaml(data, indent = 0) {
 export {
   jsonTool
 };
-//# sourceMappingURL=chunk-VB3MJGCV.js.map
+//# sourceMappingURL=chunk-D4CXUZIF.js.map

package/dist/{chunk-5WNDJHT6.js → chunk-DPKTXJQS.js}

@@ -1,6 +1,6 @@
 import {
   safeResolveReal
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/e2e.ts
 import { open, readdir } from "node:fs/promises";
@@ -422,4 +422,4 @@ export {
   discoverE2EProjects,
   e2ePlanTool
 };
-//# sourceMappingURL=chunk-5WNDJHT6.js.map
+//# sourceMappingURL=chunk-DPKTXJQS.js.map

package/dist/{chunk-ELFFQ4RU.js → chunk-DTQ75VBC.js}

@@ -58,6 +58,7 @@ async function loadGitignoreMatcher(projectRoot) {
 }
 
 export {
+  compileGitignore,
   loadGitignoreMatcher
 };
-//# sourceMappingURL=chunk-ELFFQ4RU.js.map
+//# sourceMappingURL=chunk-DTQ75VBC.js.map

package/dist/{chunk-EMRGN4KM.js → chunk-HBM4QNXU.js}

@@ -1,7 +1,7 @@
 import {
   ensureInsideRoot,
   safeResolveReal
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/document.ts
 import * as fs from "node:fs/promises";
@@ -167,4 +167,4 @@ function processFile(content, absPath, _style, _overwrite, target) {
 export {
   documentTool
 };
-//# sourceMappingURL=chunk-EMRGN4KM.js.map
+//# sourceMappingURL=chunk-HBM4QNXU.js.map

package/dist/{chunk-J5SKD6LN.js → chunk-HWDB2G7J.js}

@@ -1,6 +1,6 @@
 import {
   safeResolveReal
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/tree.ts
 import * as fs from "node:fs/promises";
@@ -232,4 +232,4 @@ async function walkDir(dir, depth, opts) {
 export {
   treeTool
 };
-//# sourceMappingURL=chunk-J5SKD6LN.js.map
+//# sourceMappingURL=chunk-HWDB2G7J.js.map

package/dist/{chunk-ZLTFLC25.js → chunk-IIF5HIVF.js}

@@ -1,6 +1,6 @@
 import {
   parseGeneric
-} from "./chunk-A6BRWIXN.js";
+} from "./chunk-6IEBD27U.js";
 import {
   parseParserOutput,
   withSpawnGate
@@ -382,4 +382,4 @@ export {
   parseSymbols,
   resolvePythonBinary
 };
-//# sourceMappingURL=chunk-ZLTFLC25.js.map
+//# sourceMappingURL=chunk-IIF5HIVF.js.map

package/dist/{chunk-UKGMDCXT.js → chunk-KD5EHYA2.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-NBDZMMG2.js";
 import {
   truncateMiddle
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/fetch.ts
 import { FetchError, ToolError, ToolValidationError } from "@wrongstack/core/types";
@@ -236,4 +236,4 @@ function prettyJson(s) {
 export {
   fetchTool
 };
-//# sourceMappingURL=chunk-UKGMDCXT.js.map
+//# sourceMappingURL=chunk-KD5EHYA2.js.map

package/dist/{chunk-A2PX7M7A.js → chunk-MRKWZCHZ.js}

@@ -9,7 +9,7 @@ import {
   projectIndexServerBuildId,
   projectIndexServerEndpoint,
   projectIndexServerMetadataPath
-} from "./chunk-UOXX4SQZ.js";
+} from "./chunk-W4GAAI3M.js";
 import {
   CircuitOpenError,
   IndexTimeoutError,
@@ -24,7 +24,7 @@ import {
   searchService,
   statsService,
   symbolGraphService
-} from "./chunk-TFEGJDH5.js";
+} from "./chunk-TFMVHYJI.js";
 import {
   isIndexablePath
 } from "./chunk-YOHO4DVT.js";
@@ -1269,4 +1269,4 @@ export {
   checkCodebaseIndexServerHealth,
   ensureCodebaseIndexServer
 };
-//# sourceMappingURL=chunk-A2PX7M7A.js.map
+//# sourceMappingURL=chunk-MRKWZCHZ.js.map

package/dist/{chunk-BANPF4LY.js → chunk-MYRMD6PZ.js}

@@ -3,12 +3,12 @@ import {
 } from "./chunk-FQZOHLG3.js";
 import {
   enqueueReindex
-} from "./chunk-A2PX7M7A.js";
+} from "./chunk-MRKWZCHZ.js";
 import {
   safeResolveReal,
   sha256hex,
   truncateDiffPayload
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/write.ts
 import * as fs from "node:fs/promises";
@@ -155,4 +155,4 @@ async function finishWrite(input, ctx, prepared, signal) {
 export {
   writeTool
 };
-//# sourceMappingURL=chunk-BANPF4LY.js.map
+//# sourceMappingURL=chunk-MYRMD6PZ.js.map

package/dist/{chunk-S2JRYDYG.js → chunk-N5O3FK5Q.js}

@@ -7,11 +7,11 @@ import {
 } from "./chunk-NWZ6XGBJ.js";
 import {
   loadGitignoreMatcher
-} from "./chunk-ELFFQ4RU.js";
+} from "./chunk-DTQ75VBC.js";
 import {
   isBinaryBuffer,
   safeResolveReal
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/grep.ts
 import { spawn } from "node:child_process";
@@ -476,4 +476,4 @@ export {
   grepTool,
   __resetRgDetectionForTests
 };
-//# sourceMappingURL=chunk-S2JRYDYG.js.map
+//# sourceMappingURL=chunk-N5O3FK5Q.js.map

package/dist/{chunk-EEOFQDT6.js → chunk-OCUXN6Y3.js}

@@ -1,4 +1,6 @@
 // src/codebase-index/tree-sitter-parser.ts
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -759,6 +761,43 @@ function emitSymbol(node, kind, file, lang, scopeStack, content, nlOffsets, quer
 // src/codebase-index/tree-sitter-parser.ts
 var WASM_DIR = fileURLToPath(new URL("./wasm/", import.meta.url));
 var RUNTIME_WASM = path.join(WASM_DIR, "tree-sitter-runtime.wasm");
+var CHECKSUMS_PATH = path.join(WASM_DIR, "checksums.json");
+var cachedChecksums;
+function expectedChecksums() {
+  if (cachedChecksums !== void 0) return cachedChecksums;
+  try {
+    cachedChecksums = JSON.parse(readFileSync(CHECKSUMS_PATH, "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      cachedChecksums = null;
+    } else {
+      console.error(
+        `[tree-sitter] grammar checksum manifest is unreadable (${CHECKSUMS_PATH}): ${err instanceof Error ? err.message : String(err)}. Treating as an integrity failure \u2014 tree-sitter grammars will not load.`
+      );
+      cachedChecksums = {};
+    }
+  }
+  return cachedChecksums;
+}
+function verifyWasmIntegrity(wasmPath) {
+  const manifest = expectedChecksums();
+  if (manifest === null) return;
+  const rel = path.relative(WASM_DIR, wasmPath).split(path.sep).join("/");
+  const expected = manifest[rel];
+  if (expected === void 0) {
+    console.error(
+      `[tree-sitter] grammar ${rel} is not pinned in checksums.json. Refusing to load; falling back to the regex parser. If this change is intentional, regenerate wasm/checksums.json via scripts/check-tree-sitter-wasm.mjs --write and review the diff.`
+    );
+    throw new Error(`tree-sitter grammar not pinned: ${rel}`);
+  }
+  const actual = createHash("sha256").update(readFileSync(wasmPath)).digest("hex");
+  if (actual !== expected) {
+    console.error(
+      `[tree-sitter] grammar integrity FAILED for ${rel}: expected sha256 ${expected}, found ${actual}. Refusing to load; falling back to the regex parser. If this change is intentional, regenerate wasm/checksums.json via scripts/check-tree-sitter-wasm.mjs --write and review the diff.`
+    );
+    throw new Error(`tree-sitter grammar integrity failure: ${rel}`);
+  }
+}
 var LANG_TO_GRAMMAR = {
   c: "c",
   cpp: "cpp",
@@ -786,7 +825,10 @@ function getRuntime() {
   if (!runtimePromise) {
     runtimePromise = (async () => {
       const mod = await import("web-tree-sitter");
-      const init = () => mod.Parser.init({ locateFile: () => RUNTIME_WASM });
+      const init = () => {
+        verifyWasmIntegrity(RUNTIME_WASM);
+        return mod.Parser.init({ locateFile: () => RUNTIME_WASM });
+      };
       return { Parser: mod.Parser, Language: mod.Language, init };
     })();
   }
@@ -803,6 +845,7 @@ async function loadLanguage(lang) {
     const wasmPath = path.join(WASM_DIR, grammarName, `tree-sitter-${grammarName}.wasm`);
     const { Language, init } = await getRuntime();
     await init();
+    verifyWasmIntegrity(wasmPath);
     const languageObj = await Language.load(wasmPath);
     return { lang, Language: languageObj };
   })();
@@ -874,6 +917,7 @@ async function parseTreeSitterAst(opts) {
     const { Parser, Language, init } = await getRuntime();
     await init();
     const wasmPath = path.join(WASM_DIR, grammar, `tree-sitter-${grammar}.wasm`);
+    verifyWasmIntegrity(wasmPath);
     const languageObj = await Language.load(wasmPath);
     const parser = new Parser();
     parser.setLanguage(languageObj);
@@ -895,4 +939,4 @@ export {
   __smokeRootType,
   parseTreeSitterAst
 };
-//# sourceMappingURL=chunk-EEOFQDT6.js.map
+//# sourceMappingURL=chunk-OCUXN6Y3.js.map

package/dist/{chunk-3QQSBUXR.js → chunk-ODFVG54U.js}

@@ -1,13 +1,13 @@
 import {
   tryLegacyCodeOperation
-} from "./chunk-4E42D7UF.js";
+} from "./chunk-ZDUGI5BC.js";
 import {
   spawnStream
 } from "./chunk-ZHH3BEWU.js";
 import {
   normalizeCommandOutput,
   safeResolveReal
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/format.ts
 var formatTool = {
@@ -176,4 +176,4 @@ async function detectFixer(cwd) {
 export {
   formatTool
 };
-//# sourceMappingURL=chunk-3QQSBUXR.js.map
+//# sourceMappingURL=chunk-ODFVG54U.js.map

package/dist/{chunk-ICAXDRP6.js → chunk-OJ4FIBAN.js}

@@ -3,11 +3,11 @@ import {
 } from "./chunk-NWZ6XGBJ.js";
 import {
   loadGitignoreMatcher
-} from "./chunk-ELFFQ4RU.js";
+} from "./chunk-DTQ75VBC.js";
 import {
   assertRealInsideRoot,
   safeResolveReal
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/glob.ts
 import * as fs from "node:fs/promises";
@@ -151,4 +151,4 @@ var globTool = {
 export {
   globTool
 };
-//# sourceMappingURL=chunk-ICAXDRP6.js.map
+//# sourceMappingURL=chunk-OJ4FIBAN.js.map

package/dist/{chunk-6RR5VX6U.js → chunk-OYVPBPCL.js}

@@ -3,13 +3,13 @@ import {
 } from "./chunk-Q5JPPCZC.js";
 import {
   enqueueReindex
-} from "./chunk-A2PX7M7A.js";
+} from "./chunk-MRKWZCHZ.js";
 import {
   isBinaryBuffer,
   safeResolveReal,
   sha256hex,
   truncateDiffPayload
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-QLF74MSV.js";
 
 // src/replace.ts
 import { spawn } from "node:child_process";
@@ -374,4 +374,4 @@ export {
   replaceTool,
   __resetRgDetectionForTests
 };
-//# sourceMappingURL=chunk-6RR5VX6U.js.map
+//# sourceMappingURL=chunk-OYVPBPCL.js.map