@wrongstack/tools 0.32.0 → 0.51.3

package/dist/outdated.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/_util.ts","../src/outdated.ts"],"names":["resolve"],"mappings":";;;;;;AAIO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAY,IAAA,CAAA,UAAA,CAAW,KAAK,CAAA,GAAS,IAAA,CAAA,SAAA,CAAU,KAAK,CAAA,GAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AACrF;AAEO,SAAS,gBAAA,CAAiB,SAAiB,GAAA,EAAsB;AACtE,EAAA,MAAM,IAAA,GAAY,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AACzC,EAAA,MAAM,MAAA,GAAc,aAAQ,OAAO,CAAA;AACnC,EAAA,MAAM,GAAA,GAAW,IAAA,CAAA,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AACtC,EAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,IAAU,IAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AAChD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,OAAO,CAAA,2BAAA,EAA8B,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,EACvE;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAO,gBAAA,CAAiB,WAAA,CAAY,KAAA,EAAO,GAAG,GAAG,GAAG,CAAA;AACtD;;;ACUO,IAAM,YAAA,GAAoD;AAAA,EAC/D,IAAA,EAAM,UAAA;AAAA,EACN,QAAA,EAAU,oBAAA;AAAA,EACV,WAAA,EACE,wHAAA;AAAA,EACF,SAAA,EACE,qSAAA;AAAA,EAKF,UAAA,EAAY,MAAA;AAAA,EACZ,QAAA,EAAU,IAAA;AAAA,EACV,SAAA,EAAW,GAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,kCAAA,EAAmC;AAAA,MACvE,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,QACtB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,kBAAA,EAAoB;AAAA,QAClB,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf;AACF,GACF;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,MAAM,GAAA,GAAM,MAAM,GAAA,GAAM,WAAA,CAAY,MAAM,GAAA,EAAK,GAAG,IAAI,GAAA,CAAI,GAAA;AAC1D,IAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,GAAG,CAAA;AAEvC,IAAA,MAAM,IAAA,GAAiB,CAAC,UAAA,EAAY,QAAQ,CAAA;AAC5C,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,OAAA,EAAS,IAAA,CAAK,KAAK,SAAS,CAAA;AACjD,IAAA,IAAI,KAAA,CAAM,kBAAA,EAAoB,IAAA,CAAK,IAAA,CAAK,aAAa,YAAY,CAAA;AAEjE,IAAA,OAAO,WAAA,CAAY,OAAA,EAAS,IAAA,EAAM,GAAA,EAAK,KAAK,MAAM,CAAA;AAAA,EACpD;AACF;AAEA,eAAe,cAAc,GAAA,EAA8B;AACzD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,eAAA,CAAiB,CAAA;AAClC,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,UAAA,CAAY,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CACP,OAAA,EACA,IAAA,EACA,GAAA,EACA,MAAA,EACyB;AACzB,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACA,QAAAA,KAAY;AAC9B,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,MAAM,GAAA,GAAM,GAAA;AAEZ,IAAA,MAAM,QAAQ,KAAA,CAAM,OAAA,EAAS,IAAA,EAAM,EAAE,KAAK,MAAA,EAAQ,GAAA,EAAK,aAAA,EAAc,EAAG,OAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM,GAAG,CAAA;AAC3G,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,GAAA,EAAK,MAAA,IAAU,EAAE,QAAA,EAAS;AAAA,IAChD,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,GAAA,EAAK,MAAA,IAAU,EAAE,QAAA,EAAS;AAAA,IAChD,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,MAAA,EAAQ,IAAA,IAAQ,CAAC,CAAA;AACpD,MAAAA,SAAQ,MAAM,CAAA;AAAA,IAChB,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,CAAA,KAAM;AACvB,MAAAA,QAAAA,CAAQ;AAAA,QACN,SAAA,EAAW,CAAA;AAAA,QACX,UAAU,EAAC;AAAA,QACX,KAAA,EAAO,CAAA;AAAA,QACP,QAAQ,CAAA,CAAE,OAAA;AAAA,QACV,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAEA,SAAS,mBAAA,CAAoB,MAAc,QAAA,EAAkC;AAC3E,EAAA,MAAM,WAA8B,EAAC;AAErC,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,UAAU,EAAC;AAAA,MACX,KAAA,EAAO,CAAA;AAAA,MACP,MAAA,EAAQ,QAAA,KAAa,CAAA,GAAI,yBAAA,GAA4B,mCAAA;AAAA,MACrD,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC5B,IAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG;AACpC,MAAA,MAAM,IAAA,GAAO,KAAK,IAAI,CAAA;AACtB,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA,QACZ,IAAA;AAAA,QACA,OAAA,EAAS,KAAK,OAAA,IAAW,SAAA;AAAA,QACzB,MAAA,EAAQ,KAAK,MAAA,IAAU,SAAA;AAAA,QACvB,MAAA,EAAQ,KAAK,MAAA,IAAU,SAAA;AAAA,QACvB,IAAA,EAAM,KAAK,IAAA,IAAQ,SAAA;AAAA,QACnB,QAAA,EAAU,KAAK,QAAA,IAAY;AAAA,OAC5B,CAAA;AAAA,IACH;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,QAAA;AAAA,IACX,QAAA;AAAA,IACA,OAAO,QAAA,CAAS,MAAA;AAAA,IAChB,MAAA,EAAQ,IAAA;AAAA,IACR,SAAA,EAAW,KAAK,MAAA,IAAU;AAAA,GAC5B;AACF","file":"outdated.js","sourcesContent":["import * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport { type Context, stripAnsi } from '@wrongstack/core';\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const root = path.resolve(ctx.projectRoot);\n  const target = path.resolve(absPath);\n  const rel = path.relative(root, target);\n  if (rel.startsWith('..') || path.isAbsolute(rel)) {\n    throw new Error(`Path \"${absPath}\" is outside project root \"${root}\"`);\n  }\n  return target;\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root→out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink — macOS `/var`→`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  const realRoot = await fsp.realpath(ctx.projectRoot).catch(() => path.resolve(ctx.projectRoot));\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    const rel = path.relative(realRoot, real);\n    if (rel.startsWith('..') || path.isAbsolute(rel)) {\n      throw new Error(\n        `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoot}\"`,\n      );\n    }\n    return;\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// ─── Command-output normalization (token-saving) ────────────────────────────\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) — never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only — it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `… ⟨repeated ${run}×⟩`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends — the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n…[truncated ${total - kept} bytes]…\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI → collapse\n * carriage-return progress → trim trailing whitespace → collapse identical\n * consecutive lines → squeeze blank-line runs → head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number } = {},\n): string {\n  if (!raw) return raw;\n  let text = stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines → 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n","import { spawn } from 'node:child_process';\nimport { stat } from 'node:fs/promises';\nimport { buildChildEnv } from '@wrongstack/core';\nimport type { Tool } from '@wrongstack/core';\nimport { safeResolve } from './_util.js';\n\ninterface OutdatedInput {\n  cwd?: string;\n  format?: 'list' | 'table';\n  include_deprecated?: boolean;\n  check?: string | string[];\n}\n\ninterface OutdatedPackage {\n  name: string;\n  current: string;\n  latest: string;\n  wanted: string;\n  type: string;\n  location: string;\n}\n\ninterface OutdatedOutput {\n  exit_code: number;\n  packages: OutdatedPackage[];\n  total: number;\n  output: string;\n  truncated: boolean;\n}\n\nexport const outdatedTool: Tool<OutdatedInput, OutdatedOutput> = {\n  name: 'outdated',\n  category: 'Package Management',\n  description:\n    'Check for outdated dependencies in the project. Reports current, wanted (semver range), and latest versions available.',\n  usageHint:\n    'MAINTENANCE & SECURITY TOOL:\\n\\n' +\n    '- Run periodically or before dependency-related work.\\n' +\n    '- Helps surface packages that may need updates for security or features.\\n' +\n    '- Safe, read-only operation.\\n' +\n    'Use the output to decide on upgrades. Prefer this over manual shell commands for dependency hygiene.',\n  permission: 'auto',\n  mutating: true,\n  timeoutMs: 60_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      cwd: { type: 'string', description: 'Working directory (default: cwd)' },\n      format: {\n        type: 'string',\n        enum: ['list', 'table'],\n        description: 'Output format (default: list)',\n      },\n      include_deprecated: {\n        type: 'boolean',\n        description: 'Include deprecated packages (default: false)',\n      },\n      check: {\n        type: 'string',\n        description: 'Specific package(s) to check (comma-separated)',\n      },\n    },\n  },\n  async execute(input, ctx, opts) {\n    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;\n    const manager = await detectManager(cwd);\n\n    const args: string[] = ['outdated', '--json'];\n    if (input.format === 'table') args.push('--table');\n    if (input.include_deprecated) args.push('--include', 'deprecated');\n\n    return runOutdated(manager, args, cwd, opts.signal);\n  },\n};\n\nasync function detectManager(cwd: string): Promise<string> {\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* */\n  }\n  return 'npm';\n}\n\nfunction runOutdated(\n  manager: string,\n  args: string[],\n  cwd: string,\n  signal: AbortSignal,\n): Promise<OutdatedOutput> {\n  return new Promise((resolve) => {\n    let stdout = '';\n    let stderr = '';\n    const MAX = 100_000;\n\n    const child = spawn(manager, args, { cwd, signal, env: buildChildEnv(), stdio: ['ignore', 'pipe', 'pipe'] });\n    child.stdout?.on('data', (c) => {\n      if (stdout.length < MAX) stdout += c.toString();\n    });\n    child.stderr?.on('data', (c) => {\n      if (stderr.length < MAX) stderr += c.toString();\n    });\n    child.on('close', (code) => {\n      const result = parseOutdatedOutput(stdout, code ?? 0);\n      resolve(result);\n    });\n    child.on('error', (e) => {\n      resolve({\n        exit_code: 1,\n        packages: [],\n        total: 0,\n        output: e.message,\n        truncated: false,\n      });\n    });\n  });\n}\n\nfunction parseOutdatedOutput(json: string, exitCode: number): OutdatedOutput {\n  const packages: OutdatedPackage[] = [];\n\n  if (!json) {\n    return {\n      exit_code: exitCode,\n      packages: [],\n      total: 0,\n      output: exitCode === 0 ? 'All packages up to date' : 'Could not check outdated packages',\n      truncated: false,\n    };\n  }\n\n  try {\n    const data = JSON.parse(json);\n    for (const name of Object.keys(data)) {\n      const info = data[name];\n      packages.push({\n        name,\n        current: info.current ?? 'unknown',\n        latest: info.latest ?? 'unknown',\n        wanted: info.wanted ?? 'unknown',\n        type: info.type ?? 'unknown',\n        location: info.location ?? name,\n      });\n    }\n  } catch {\n    // JSON parse failed, return raw output\n  }\n\n  return {\n    exit_code: exitCode,\n    packages,\n    total: packages.length,\n    output: json,\n    truncated: json.length >= 100_000,\n  };\n}\n"]}
+{"version":3,"sources":["../src/_util.ts","../src/outdated.ts"],"names":["resolve"],"mappings":";;;;;AAcA,eAAsB,qBAAqB,GAAA,EAAsC;AAC/E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,OAAO,kBAAkB,CAAA;AAChD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,eAAA,CAAiB,CAAA;AAClC,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,UAAA,CAAY,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAY,IAAA,CAAA,UAAA,CAAW,KAAK,CAAA,GAAS,IAAA,CAAA,SAAA,CAAU,KAAK,CAAA,GAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AACrF;AAEO,SAAS,gBAAA,CAAiB,SAAiB,GAAA,EAAsB;AACtE,EAAA,MAAM,IAAA,GAAY,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AACzC,EAAA,MAAM,MAAA,GAAc,aAAQ,OAAO,CAAA;AACnC,EAAA,MAAM,GAAA,GAAW,IAAA,CAAA,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AACtC,EAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,IAAU,IAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AAChD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,OAAO,CAAA,2BAAA,EAA8B,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,EACvE;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAO,gBAAA,CAAiB,WAAA,CAAY,KAAA,EAAO,GAAG,GAAG,GAAG,CAAA;AACtD;;;AClBO,IAAM,YAAA,GAAoD;AAAA,EAC/D,IAAA,EAAM,UAAA;AAAA,EACN,QAAA,EAAU,oBAAA;AAAA,EACV,WAAA,EACE,wHAAA;AAAA,EACF,SAAA,EACE,qSAAA;AAAA,EAKF,UAAA,EAAY,MAAA;AAAA,EACZ,QAAA,EAAU,KAAA;AAAA,EACV,SAAA,EAAW,GAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,kCAAA,EAAmC;AAAA,MACvE,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,QACtB,WAAA,EAAa;AAAA,OACf;AAAA,MACA,kBAAA,EAAoB;AAAA,QAClB,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf;AACF,GACF;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,MAAM,GAAA,GAAM,MAAM,GAAA,GAAM,WAAA,CAAY,MAAM,GAAA,EAAK,GAAG,IAAI,GAAA,CAAI,GAAA;AAC1D,IAAA,MAAM,OAAA,GAAU,MAAM,oBAAA,CAAqB,GAAG,CAAA;AAE9C,IAAA,MAAM,IAAA,GAAiB,CAAC,UAAA,EAAY,QAAQ,CAAA;AAC5C,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,OAAA,EAAS,IAAA,CAAK,KAAK,SAAS,CAAA;AACjD,IAAA,IAAI,KAAA,CAAM,kBAAA,EAAoB,IAAA,CAAK,IAAA,CAAK,aAAa,YAAY,CAAA;AAEjE,IAAA,OAAO,WAAA,CAAY,OAAA,EAAS,IAAA,EAAM,GAAA,EAAK,KAAK,MAAM,CAAA;AAAA,EACpD;AACF;AAEA,SAAS,WAAA,CACP,OAAA,EACA,IAAA,EACA,GAAA,EACA,MAAA,EACyB;AACzB,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACA,QAAAA,KAAY;AAC9B,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,MAAM,GAAA,GAAM,GAAA;AAEZ,IAAA,MAAM,QAAQ,KAAA,CAAM,OAAA,EAAS,IAAA,EAAM,EAAE,KAAK,MAAA,EAAQ,GAAA,EAAK,aAAA,EAAc,EAAG,OAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM,GAAG,CAAA;AAC3G,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,GAAA,EAAK,MAAA,IAAU,EAAE,QAAA,EAAS;AAAA,IAChD,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,GAAA,EAAK,MAAA,IAAU,EAAE,QAAA,EAAS;AAAA,IAChD,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,MAAA,EAAQ,IAAA,IAAQ,CAAC,CAAA;AACpD,MAAAA,SAAQ,MAAM,CAAA;AAAA,IAChB,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,CAAA,KAAM;AACvB,MAAAA,QAAAA,CAAQ;AAAA,QACN,SAAA,EAAW,CAAA;AAAA,QACX,UAAU,EAAC;AAAA,QACX,KAAA,EAAO,CAAA;AAAA,QACP,QAAQ,CAAA,CAAE,OAAA;AAAA,QACV,SAAA,EAAW;AAAA,OACZ,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAEA,SAAS,mBAAA,CAAoB,MAAc,QAAA,EAAkC;AAC3E,EAAA,MAAM,WAA8B,EAAC;AAErC,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,UAAU,EAAC;AAAA,MACX,KAAA,EAAO,CAAA;AAAA,MACP,MAAA,EAAQ,QAAA,KAAa,CAAA,GAAI,yBAAA,GAA4B,mCAAA;AAAA,MACrD,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC5B,IAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG;AACpC,MAAA,MAAM,IAAA,GAAO,KAAK,IAAI,CAAA;AACtB,MAAA,QAAA,CAAS,IAAA,CAAK;AAAA,QACZ,IAAA;AAAA,QACA,OAAA,EAAS,KAAK,OAAA,IAAW,SAAA;AAAA,QACzB,MAAA,EAAQ,KAAK,MAAA,IAAU,SAAA;AAAA,QACvB,MAAA,EAAQ,KAAK,MAAA,IAAU,SAAA;AAAA,QACvB,IAAA,EAAM,KAAK,IAAA,IAAQ,SAAA;AAAA,QACnB,QAAA,EAAU,KAAK,QAAA,IAAY;AAAA,OAC5B,CAAA;AAAA,IACH;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,QAAA;AAAA,IACX,QAAA;AAAA,IACA,OAAO,QAAA,CAAS,MAAA;AAAA,IAChB,MAAA,EAAQ,IAAA;AAAA,IACR,SAAA,EAAW,KAAK,MAAA,IAAU;AAAA,GAC5B;AACF","file":"outdated.js","sourcesContent":["import * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core';\nimport type { Context } from '@wrongstack/core';\n\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm → yarn → npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const root = path.resolve(ctx.projectRoot);\n  const target = path.resolve(absPath);\n  const rel = path.relative(root, target);\n  if (rel.startsWith('..') || path.isAbsolute(rel)) {\n    throw new Error(`Path \"${absPath}\" is outside project root \"${root}\"`);\n  }\n  return target;\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root→out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink — macOS `/var`→`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  const realRoot = await fsp.realpath(ctx.projectRoot).catch(() => path.resolve(ctx.projectRoot));\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    const rel = path.relative(realRoot, real);\n    if (rel.startsWith('..') || path.isAbsolute(rel)) {\n      throw new Error(\n        `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoot}\"`,\n      );\n    }\n    return;\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// ─── Command-output normalization (token-saving) ────────────────────────────\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) — never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only — it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `… ⟨repeated ${run}×⟩`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends — the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n…[truncated ${total - kept} bytes]…\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI → collapse\n * carriage-return progress → trim trailing whitespace → collapse identical\n * consecutive lines → squeeze blank-line runs → head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines → 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n","import { spawn } from 'node:child_process';\nimport { buildChildEnv } from '@wrongstack/core';\nimport type { Tool } from '@wrongstack/core';\nimport { detectPackageManager, safeResolve } from './_util.js';\n\ninterface OutdatedInput {\n  cwd?: string;\n  format?: 'list' | 'table';\n  include_deprecated?: boolean;\n  check?: string | string[];\n}\n\ninterface OutdatedPackage {\n  name: string;\n  current: string;\n  latest: string;\n  wanted: string;\n  type: string;\n  location: string;\n}\n\ninterface OutdatedOutput {\n  exit_code: number;\n  packages: OutdatedPackage[];\n  total: number;\n  output: string;\n  truncated: boolean;\n}\n\nexport const outdatedTool: Tool<OutdatedInput, OutdatedOutput> = {\n  name: 'outdated',\n  category: 'Package Management',\n  description:\n    'Check for outdated dependencies in the project. Reports current, wanted (semver range), and latest versions available.',\n  usageHint:\n    'MAINTENANCE & SECURITY TOOL:\\n\\n' +\n    '- Run periodically or before dependency-related work.\\n' +\n    '- Helps surface packages that may need updates for security or features.\\n' +\n    '- Safe, read-only operation.\\n' +\n    'Use the output to decide on upgrades. Prefer this over manual shell commands for dependency hygiene.',\n  permission: 'auto',\n  mutating: false,\n  timeoutMs: 60_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      cwd: { type: 'string', description: 'Working directory (default: cwd)' },\n      format: {\n        type: 'string',\n        enum: ['list', 'table'],\n        description: 'Output format (default: list)',\n      },\n      include_deprecated: {\n        type: 'boolean',\n        description: 'Include deprecated packages (default: false)',\n      },\n      check: {\n        type: 'string',\n        description: 'Specific package(s) to check (comma-separated)',\n      },\n    },\n  },\n  async execute(input, ctx, opts) {\n    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;\n    const manager = await detectPackageManager(cwd);\n\n    const args: string[] = ['outdated', '--json'];\n    if (input.format === 'table') args.push('--table');\n    if (input.include_deprecated) args.push('--include', 'deprecated');\n\n    return runOutdated(manager, args, cwd, opts.signal);\n  },\n};\n\nfunction runOutdated(\n  manager: string,\n  args: string[],\n  cwd: string,\n  signal: AbortSignal,\n): Promise<OutdatedOutput> {\n  return new Promise((resolve) => {\n    let stdout = '';\n    let stderr = '';\n    const MAX = 100_000;\n\n    const child = spawn(manager, args, { cwd, signal, env: buildChildEnv(), stdio: ['ignore', 'pipe', 'pipe'] });\n    child.stdout?.on('data', (c) => {\n      if (stdout.length < MAX) stdout += c.toString();\n    });\n    child.stderr?.on('data', (c) => {\n      if (stderr.length < MAX) stderr += c.toString();\n    });\n    child.on('close', (code) => {\n      const result = parseOutdatedOutput(stdout, code ?? 0);\n      resolve(result);\n    });\n    child.on('error', (e) => {\n      resolve({\n        exit_code: 1,\n        packages: [],\n        total: 0,\n        output: e.message,\n        truncated: false,\n      });\n    });\n  });\n}\n\nfunction parseOutdatedOutput(json: string, exitCode: number): OutdatedOutput {\n  const packages: OutdatedPackage[] = [];\n\n  if (!json) {\n    return {\n      exit_code: exitCode,\n      packages: [],\n      total: 0,\n      output: exitCode === 0 ? 'All packages up to date' : 'Could not check outdated packages',\n      truncated: false,\n    };\n  }\n\n  try {\n    const data = JSON.parse(json);\n    for (const name of Object.keys(data)) {\n      const info = data[name];\n      packages.push({\n        name,\n        current: info.current ?? 'unknown',\n        latest: info.latest ?? 'unknown',\n        wanted: info.wanted ?? 'unknown',\n        type: info.type ?? 'unknown',\n        location: info.location ?? name,\n      });\n    }\n  } catch {\n    // JSON parse failed, return raw output\n  }\n\n  return {\n    exit_code: exitCode,\n    packages,\n    total: packages.length,\n    output: json,\n    truncated: json.length >= 100_000,\n  };\n}\n"]}

package/dist/pack.js

@@ -1,7 +1,7 @@
 import { spawn, execFileSync, spawnSync } from 'node:child_process';
-import { buildChildEnv, detectNewlineStyle, normalizeToLf, toStyle, atomicWrite, unifiedDiff, compileGlob, loadPlan, emptyPlan, clearPlan, savePlan, getPlanTemplate, addPlanItem, deriveTodosFromPlanItem, removePlanItem, setPlanItemStatus, formatPlan, stripAnsi, resolveWstackPaths } from '@wrongstack/core';
+import * as Core from '@wrongstack/core';
+import { buildChildEnv, detectNewlineStyle, normalizeToLf, toStyle, atomicWrite, unifiedDiff, compileGlob, loadPlan, emptyPlan, clearPlan, savePlan, getPlanTemplate, addPlanItem, deriveTodosFromPlanItem, removePlanItem, setPlanItemStatus, formatPlan, resolveWstackPaths } from '@wrongstack/core';
 import * as fs11 from 'node:fs/promises';
-import { stat } from 'node:fs/promises';
 import * as path from 'node:path';
 import { resolve, sep, dirname } from 'node:path';
 import * as os from 'node:os';
@@ -97,6 +97,20 @@ async function* spawnStream(opts) {
     error
   };
 }
+async function detectPackageManager(cwd) {
+  const { stat: stat10 } = await import('node:fs/promises');
+  try {
+    await stat10(`${cwd}/pnpm-lock.yaml`);
+    return "pnpm";
+  } catch {
+  }
+  try {
+    await stat10(`${cwd}/yarn.lock`);
+    return "yarn";
+  } catch {
+  }
+  return "npm";
+}
 function resolvePath(input, ctx) {
   return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);
 }
@@ -219,7 +233,7 @@ ${tail}`;
 }
 function normalizeCommandOutput(raw, opts = {}) {
   if (!raw) return raw;
-  let text = stripAnsi(raw);
+  let text = Core.stripAnsi(raw);
   text = collapseCarriageReturns(text);
   text = text.replace(/[ \t]+$/gm, "");
   text = collapseConsecutiveDuplicates(text);
@@ -259,7 +273,7 @@ var auditTool = {
   },
   async *executeStream(input, ctx, opts) {
     const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
-    const manager = await detectManager(cwd);
+    const manager = await detectPackageManager(cwd);
     yield { type: "log", text: `Auditing with ${manager}\u2026`, data: { manager } };
     const args = ["audit", "--json"];
     if (input.fix) args.push("--fix");
@@ -277,20 +291,6 @@ var auditTool = {
     yield { type: "final", output: parseAuditOutput(result.stdout, result.exitCode) };
   }
 };
-async function detectManager(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
-  try {
-    await stat11(`${cwd}/pnpm-lock.yaml`);
-    return "pnpm";
-  } catch {
-  }
-  try {
-    await stat11(`${cwd}/yarn.lock`);
-    return "yarn";
-  } catch {
-  }
-  return "npm";
-}
 function parseAuditOutput(json, exitCode) {
   if (!json) {
     return {
@@ -2716,18 +2716,18 @@ async function runIndexer(_ctx, opts) {
     for (const meta of store.getAllFileMetas()) existingMeta.set(meta.file, meta);
   }
   for (const file of files) {
-    let stat11;
+    let stat10;
     try {
-      stat11 = await fs11.stat(file);
+      stat10 = await fs11.stat(file);
     } catch {
       store.deleteFile(file);
       continue;
     }
-    if (!stat11.isFile()) continue;
+    if (!stat10.isFile()) continue;
     const lang = detectLang(file);
     if (!lang) continue;
     const meta = existingMeta.get(file);
-    if (!force && meta && meta.mtimeMs === Math.floor(stat11.mtimeMs)) {
+    if (!force && meta && meta.mtimeMs === Math.floor(stat10.mtimeMs)) {
       langStats[lang] = (langStats[lang] ?? 0) + meta.symbolCount;
       symbolsIndexed += meta.symbolCount;
       filesIndexed++;
@@ -2753,7 +2753,7 @@ async function runIndexer(_ctx, opts) {
       store.upsertFile({
         file,
         lang,
-        mtimeMs: Math.floor(stat11.mtimeMs),
+        mtimeMs: Math.floor(stat10.mtimeMs),
         symbolCount: 0,
         lastIndexed: Date.now()
       });
@@ -2779,7 +2779,7 @@ async function runIndexer(_ctx, opts) {
     store.upsertFile({
       file,
       lang,
-      mtimeMs: Math.floor(stat11.mtimeMs),
+      mtimeMs: Math.floor(stat10.mtimeMs),
       symbolCount: count,
       lastIndexed: Date.now()
     });
@@ -2810,8 +2810,9 @@ var codebaseIndexTool = {
   category: "Project",
   description: "Build or incrementally update the project-wide symbol index. This powers fast codebase search and understanding. By default it only processes files that have changed since the last indexing run.",
   usageHint: "IMPORTANT FOR LARGE CODEBASES:\n\n- First run (or after major changes): consider `force: true` for a clean rebuild.\n- Normal usage: call without arguments for fast incremental updates.\n- Use `langs` to restrict to specific languages if you only care about certain parts of the project.\nThis tool is relatively expensive \u2014 do not call it on every turn. Use it when the index is stale or before heavy codebase-search sessions.",
-  permission: "auto",
+  permission: "confirm",
   mutating: true,
+  capabilities: ["fs.write.outside-project"],
   timeoutMs: 12e4,
   inputSchema: {
     type: "object",
@@ -3047,8 +3048,8 @@ var codebaseStatsTool = {
 var diffTool = {
   name: "diff",
   category: "Filesystem",
-  description: "Show code differences between files, commits, branches, or staged changes. A safer and more structured alternative to raw `git diff` via shell.",
-  usageHint: 'USE FOR CODE REVIEW AND CHANGE INSPECTION:\n\n- `files` + no `a`/`b` \u2192 diff working tree vs HEAD for those files.\n- `a` and/or `b` \u2192 git-style commit/branch diff.\n- `staged: true` \u2192 only show staged changes.\n- `mode` can be "unified", "stat", or "side-by-side".\nThis tool has important safety guards against flag injection (see previous security findings).',
+  description: "Show file content with line numbers, staged/working-tree diffs via git, or commit/branch diffs. A safer and more structured alternative to raw `git diff` via shell.",
+  usageHint: 'USE FOR CODE REVIEW AND CHANGE INSPECTION:\n\n- `files` + no `a`/`b` \u2192 show file content with line numbers (NOT a unified diff; no +/- prefixes).\n- `a` and/or `b` \u2192 git-style commit/branch diff (unified format, real +/- prefixes).\n- `staged: true` \u2192 only show staged changes.\n- `mode` can be "unified", "stat", or "side-by-side" (only affects the git-diff path).\n\nNOTE: For a true file-vs-file unified diff, supply `a` and `b` so the tool delegates to `git diff`. The `files`-only path is a line-numbered dump, not a diff.\n\nThis tool has important safety guards against flag injection (see previous security findings).',
   permission: "auto",
   mutating: false,
   capabilities: ["fs.read"],
@@ -3125,8 +3126,8 @@ function findGitDir(cwd) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat11 = statSync(path.join(dir, ".git"));
-      if (stat11.isDirectory()) return dir;
+      const stat10 = statSync(path.join(dir, ".git"));
+      if (stat10.isDirectory()) return dir;
     } catch {
     }
     const parent = path.dirname(dir);
@@ -3156,7 +3157,7 @@ function runGit(args, cwd, signal) {
   });
 }
 async function fileDiff(input, ctx, _signal) {
-  input.context ?? 3;
+  void input.context;
   const files = input.files ? (Array.isArray(input.files) ? input.files : input.files.split(",")).map((f) => f.trim()).filter(Boolean) : [];
   if (files.length === 0) {
     return {
@@ -3169,31 +3170,32 @@ async function fileDiff(input, ctx, _signal) {
   const results = [];
   for (const file of files) {
     const absPath = safeResolve(file, ctx);
-    const stat11 = await fs11.stat(absPath).catch(() => null);
-    if (!stat11?.isFile()) continue;
+    const stat10 = await fs11.stat(absPath).catch(() => null);
+    if (!stat10?.isFile()) continue;
     const content = await fs11.readFile(absPath, "utf8");
     const lines = content.split(/\r?\n/);
-    results.push(`--- ${file}
-+++ ${file}
-${formatUnified(lines)}`);
+    results.push(formatWithLineNumbers(file, lines));
   }
   return {
-    diff: results.join("\n"),
+    diff: results.join("\n\n"),
     files,
     truncated: false,
     mode: input.mode ?? "unified"
   };
 }
-function formatUnified(lines, _context) {
-  return lines.map((line, _i) => ` ${line}`).join("\n");
+function formatWithLineNumbers(file, lines) {
+  const width = String(lines.length).length;
+  const numbered = lines.map((line, i) => `${String(i + 1).padStart(width)} | ${line}`).join("\n");
+  return `--- ${file} (line-numbered dump, not a unified diff) ---
+${numbered}`;
 }
 var documentTool = {
   name: "document",
   category: "Project",
-  description: "Automatically generate or update documentation comments (JSDoc/TSDoc style) for code. Can target specific symbols or entire files/directories.",
-  usageHint: "USE FOR IMPROVING CODE DOCUMENTATION:\n\n- Good for adding missing docs to public APIs or complex functions.\n- `overwrite: true` will replace existing documentation (use carefully).\n- You can target specific symbols via `target` or whole files/directories via `files`.\nAlways review the generated documentation before committing \u2014 the model can hallucinate details.",
-  permission: "confirm",
-  mutating: true,
+  description: "Preview documentation comments (JSDoc/TSDoc style) that would be generated for code symbols. Returns a list of candidates with status `skipped` \u2014 the tool is currently a read-only preview and does NOT write to files.",
+  usageHint: "USE FOR IMPROVING CODE DOCUMENTATION:\n\n- Good for adding missing docs to public APIs or complex functions.\n- Currently this is a PREVIEW-ONLY tool: it does not modify files.\n- Use the output to decide which symbols to document manually, or pass the candidates to `edit` / `patch`.\n- `overwrite`, `style`, and `target` parameters are accepted for future expansion but are ignored today.\nAlways review the proposed documentation before applying it \u2014 the model can hallucinate details.",
+  permission: "auto",
+  mutating: false,
   timeoutMs: 3e4,
   inputSchema: {
     type: "object",
@@ -3268,8 +3270,8 @@ async function resolveFiles(filesInput, cwd) {
   for (const f of files) {
     const absPath = f.trim().startsWith("/") ? f.trim() : `${cwd}/${f.trim()}`;
     try {
-      const stat11 = await fs11.stat(absPath);
-      if (stat11.isFile()) resolved.push(absPath);
+      const stat10 = await fs11.stat(absPath);
+      if (stat10.isFile()) resolved.push(absPath);
     } catch {
     }
   }
@@ -3360,13 +3362,13 @@ var editTool = {
     if (input.new_string === void 0) throw new Error("edit: new_string is required");
     if (input.old_string === "") throw new Error("edit: old_string cannot be empty");
     const absPath = await safeResolveReal(input.path, ctx);
-    const stat11 = await fs11.stat(absPath).catch((err) => {
+    const stat10 = await fs11.stat(absPath).catch((err) => {
       if (err.code === "ENOENT") {
         throw new Error(`edit: file "${input.path}" does not exist. Use \`write\` instead.`);
       }
       throw err;
     });
-    if (!stat11.isFile()) throw new Error(`edit: "${input.path}" is not a regular file`);
+    if (!stat10.isFile()) throw new Error(`edit: "${input.path}" is not a regular file`);
     if (!ctx.hasRead(absPath)) {
       throw new Error(`edit: file "${input.path}" was not read in this session. Read it first.`);
     }
@@ -4062,6 +4064,7 @@ var formatTool = {
   usageHint: "RUN REGULARLY:\n\n- Use on changed files before committing.\n- `check: true` verifies formatting without making changes (useful in CI-like flows).\nThis project has very consistent formatting expectations. Always ensure your changes are formatted.",
   permission: "confirm",
   mutating: true,
+  capabilities: ["fs.write", "shell.exec"],
   timeoutMs: 6e4,
   inputSchema: {
     type: "object",
@@ -4139,13 +4142,13 @@ var formatTool = {
   }
 };
 async function detectFixer(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
+  const { stat: stat10 } = await import('node:fs/promises');
   try {
-    await stat11(`${cwd}/biome.json`);
+    await stat10(`${cwd}/biome.json`);
     return "biome";
   } catch {
     try {
-      await stat11(`${cwd}/.prettierrc`);
+      await stat10(`${cwd}/.prettierrc`);
       return "prettier";
     } catch {
       return "biome";
@@ -4275,8 +4278,8 @@ function findGitDir2(cwd, projectRoot) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat11 = statSync(`${dir}/.git`);
-      if (stat11.isDirectory() || stat11.isFile()) return dir;
+      const stat10 = statSync(`${dir}/.git`);
+      if (stat10.isDirectory() || stat10.isFile()) return dir;
     } catch {
     }
     if (dir === root) break;
@@ -4772,8 +4775,8 @@ async function runNative(input, base, mode, limit, signal) {
         if (globRe && !globRe.test(e.name) && !globRe.test(full)) continue;
         if (globRe) globRe.lastIndex = 0;
         try {
-          const stat11 = await fs11.stat(full);
-          if (stat11.size > 1e6) continue;
+          const stat10 = await fs11.stat(full);
+          if (stat10.size > 1e6) continue;
           const head = await fs11.readFile(full);
           if (isBinaryBuffer(head)) continue;
           const text = head.toString("utf8");
@@ -4918,20 +4921,6 @@ var installTool = {
     };
   }
 };
-async function detectPackageManager(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
-  try {
-    await stat11(`${cwd}/pnpm-lock.yaml`);
-    return "pnpm";
-  } catch {
-    try {
-      await stat11(`${cwd}/yarn.lock`);
-      return "yarn";
-    } catch {
-      return "npm";
-    }
-  }
-}
 var jsonTool = {
   name: "json",
   category: "Data",
@@ -5132,11 +5121,11 @@ var lintTool = {
   }
 };
 async function detectLinter(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
+  const { stat: stat10 } = await import('node:fs/promises');
   const checks = ["biome.json", ".eslintrc.json", "tslint.json", ".eslintrc.js", "tsconfig.json"];
   for (const f of checks) {
     try {
-      await stat11(`${cwd}/${f}`);
+      await stat10(`${cwd}/${f}`);
       if (f.includes("biome")) return "biome";
       if (f.includes("eslint")) return "eslint";
       if (f.includes("tslint")) return "tslint";
@@ -5352,7 +5341,7 @@ var outdatedTool = {
   description: "Check for outdated dependencies in the project. Reports current, wanted (semver range), and latest versions available.",
   usageHint: "MAINTENANCE & SECURITY TOOL:\n\n- Run periodically or before dependency-related work.\n- Helps surface packages that may need updates for security or features.\n- Safe, read-only operation.\nUse the output to decide on upgrades. Prefer this over manual shell commands for dependency hygiene.",
   permission: "auto",
-  mutating: true,
+  mutating: false,
   timeoutMs: 6e4,
   inputSchema: {
     type: "object",
@@ -5375,26 +5364,13 @@ var outdatedTool = {
   },
   async execute(input, ctx, opts) {
     const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
-    const manager = await detectManager2(cwd);
+    const manager = await detectPackageManager(cwd);
     const args = ["outdated", "--json"];
     if (input.format === "table") args.push("--table");
     if (input.include_deprecated) args.push("--include", "deprecated");
     return runOutdated(manager, args, cwd, opts.signal);
   }
 };
-async function detectManager2(cwd) {
-  try {
-    await stat(`${cwd}/pnpm-lock.yaml`);
-    return "pnpm";
-  } catch {
-  }
-  try {
-    await stat(`${cwd}/yarn.lock`);
-    return "yarn";
-  } catch {
-  }
-  return "npm";
-}
 function runOutdated(manager, args, cwd, signal) {
   return new Promise((resolve7) => {
     let stdout = "";
@@ -5571,15 +5547,26 @@ var planTool = {
   category: "Session",
   description: "Manage a persistent strategic plan for the current session. Unlike todos, plans are meant for higher-level, multi-phase approaches and survive across conversation resumptions. Use this to outline big-picture work, then promote concrete items into the todo list when ready to execute.",
   usageHint: 'RECOMMENDED FOR COMPLEX, MULTI-PHASE WORK:\n\n- Start by creating a high-level plan with `action: "add"` or using templates (`template_use`).\n- Use `promote` to turn a plan item into actionable todos.\n- Keep plans at the "why and what" level, and todos at the "how and next step" level.\n- Common templates: "new-feature", "bug-fix", "refactor", "release", "security-audit".\n\nThis tool is excellent for maintaining long-term direction across many turns or even multiple sessions.',
-  permission: "auto",
-  mutating: false,
+  permission: "confirm",
+  mutating: true,
+  capabilities: ["fs.write"],
   timeoutMs: 2e3,
   inputSchema: {
     type: "object",
     properties: {
       action: {
         type: "string",
-        enum: ["show", "add", "start", "done", "remove", "promote", "derive", "template_use", "clear"],
+        enum: [
+          "show",
+          "add",
+          "start",
+          "done",
+          "remove",
+          "promote",
+          "derive",
+          "template_use",
+          "clear"
+        ],
         description: "The operation to perform on the plan board."
       },
       title: {
@@ -5672,7 +5659,12 @@ var planTool = {
         plan = derived.plan;
         await savePlan(planPath, plan);
         ctx.state.replaceTodos(derived.todos);
-        return mkResult(plan, true, `${input.action} ok \u2014 ${derived.todos.length} todo(s) created.`, derived.todos);
+        return mkResult(
+          plan,
+          true,
+          `${input.action} ok \u2014 ${derived.todos.length} todo(s) created.`,
+          derived.todos
+        );
       }
       case "template_use": {
         const templateName = input.template?.trim();
@@ -5687,7 +5679,11 @@ var planTool = {
           ({ plan } = addPlanItem(plan, item.title, item.details));
         }
         await savePlan(planPath, plan);
-        return mkResult(plan, true, `Applied template "${template.name}" \u2014 ${template.items.length} items added.`);
+        return mkResult(
+          plan,
+          true,
+          `Applied template "${template.name}" \u2014 ${template.items.length} items added.`
+        );
       }
       case "clear":
         plan = clearPlan(plan);
@@ -5742,9 +5738,9 @@ var readTool = {
   async execute(input, ctx) {
     if (!input?.path) throw new Error("read: path is required");
     const absPath = await safeResolveReal(input.path, ctx);
-    let stat11;
+    let stat10;
     try {
-      stat11 = await fs11.stat(absPath);
+      stat10 = await fs11.stat(absPath);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") throw new Error(`read: file not found "${input.path}"`);
@@ -5752,9 +5748,9 @@ var readTool = {
         `read: failed to stat "${input.path}": ${err instanceof Error ? err.message : String(err)}`
       );
     }
-    if (!stat11.isFile()) throw new Error(`read: "${input.path}" is not a regular file`);
-    if (stat11.size > MAX_BYTES2) {
-      throw new Error(`read: file too large (${stat11.size} bytes, limit ${MAX_BYTES2})`);
+    if (!stat10.isFile()) throw new Error(`read: "${input.path}" is not a regular file`);
+    if (stat10.size > MAX_BYTES2) {
+      throw new Error(`read: file too large (${stat10.size} bytes, limit ${MAX_BYTES2})`);
     }
     const buf = await fs11.readFile(absPath);
     if (isBinaryBuffer(buf)) {
@@ -5766,14 +5762,14 @@ var readTool = {
     const offset = Math.max(1, input.offset ?? 1);
     const limit = Math.max(0, Math.min(input.limit ?? 2e3, 5e3));
     if (limit === 0) {
-      ctx.recordRead(absPath, stat11.mtimeMs);
+      ctx.recordRead(absPath, stat10.mtimeMs);
       return { text: "", total_lines: total, encoding: "utf8", truncated: total > 0 };
     }
     const slice = allLines.slice(offset - 1, offset - 1 + limit);
     const truncated = offset - 1 + slice.length < total;
     const width = String(offset + slice.length - 1).length;
     const numbered = slice.map((line, i) => `${String(offset + i).padStart(width, " ")}\u2192${line}`).join("\n");
-    ctx.recordRead(absPath, stat11.mtimeMs);
+    ctx.recordRead(absPath, stat10.mtimeMs);
     return {
       text: numbered,
       total_lines: total,
@@ -5842,8 +5838,8 @@ var replaceTool = {
       }
       const rel = path.relative(realRoot, realPath);
       if (rel.startsWith("..") || path.isAbsolute(rel)) continue;
-      const stat11 = await fs11.stat(realPath).catch(() => null);
-      if (!stat11 || !stat11.isFile()) continue;
+      const stat10 = await fs11.stat(realPath).catch(() => null);
+      if (!stat10 || !stat10.isFile()) continue;
       let content;
       try {
         const buf = await fs11.readFile(realPath);
@@ -5868,7 +5864,7 @@ var replaceTool = {
       totalReplacements += count;
       if (!dryRun) {
         const newContent = toStyle(newContentLf, style);
-        await atomicWrite(realPath, newContent, { mode: stat11.mode & 511 });
+        await atomicWrite(realPath, newContent, { mode: stat10.mode & 511 });
       }
       const diff = dryRun || matches.length > 0 ? unifiedDiff(content, toStyle(newContentLf, style), {
         fromFile: absPath,
@@ -5898,8 +5894,8 @@ async function resolveFiles2(filesInput, ctx, extraGlob) {
   const resolved = [];
   for (const p of parts) {
     const absPath = safeResolve(p, ctx);
-    const stat11 = await fs11.stat(absPath).catch(() => null);
-    if (stat11?.isFile()) {
+    const stat10 = await fs11.stat(absPath).catch(() => null);
+    if (stat10?.isFile()) {
       resolved.push(absPath);
     }
   }
@@ -5957,8 +5953,8 @@ async function globNative(pattern, base, extraGlob) {
       if (DEFAULT_IGNORE4.includes(e.name)) continue;
       const full = path.join(dir, e.name);
       try {
-        const stat11 = await fs11.lstat(full);
-        if (stat11.isSymbolicLink()) continue;
+        const stat10 = await fs11.lstat(full);
+        if (stat10.isSymbolicLink()) continue;
       } catch {
         continue;
       }
@@ -6443,11 +6439,11 @@ var testTool = {
   }
 };
 async function detectRunner(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
+  const { stat: stat10 } = await import('node:fs/promises');
   const candidates = ["vitest.config.ts", "jest.config.js", ".mocharc.json"];
   for (const f of candidates) {
     try {
-      await stat11(path.join(cwd, f));
+      await stat10(path.join(cwd, f));
       if (f.includes("vitest")) return "vitest";
       if (f.includes("jest")) return "jest";
       if (f.includes("mocha")) return "mocha";
@@ -7093,11 +7089,11 @@ var typecheckTool = {
   }
 };
 async function findTsConfig(cwd) {
-  const { stat: stat11 } = await import('node:fs/promises');
+  const { stat: stat10 } = await import('node:fs/promises');
   const candidates = ["tsconfig.json", "tsconfig.base.json"];
   for (const f of candidates) {
     try {
-      const s = await stat11(path.join(cwd, f));
+      const s = await stat10(path.join(cwd, f));
       if (s.isFile()) return path.join(cwd, f);
     } catch {
     }
@@ -7134,12 +7130,12 @@ var writeTool = {
     let existed = false;
     let prev = "";
     try {
-      const stat12 = await fs11.stat(absPath);
-      existed = stat12.isFile();
+      const stat11 = await fs11.stat(absPath);
+      existed = stat11.isFile();
       if (existed) {
         if (!ctx.hasRead(absPath)) {
           prev = await fs11.readFile(absPath, "utf8");
-          ctx.recordRead(absPath, stat12.mtimeMs);
+          ctx.recordRead(absPath, stat11.mtimeMs);
         } else {
           prev = await fs11.readFile(absPath, "utf8");
         }
@@ -7152,8 +7148,8 @@ var writeTool = {
     await atomicWrite(absPath, input.content);
     const diff = existed ? unifiedDiff(prev, input.content, { fromFile: input.path, toFile: input.path }) : `+++ ${input.path}
 + (new file, ${input.content.split("\n").length} lines)`;
-    const stat11 = await fs11.stat(absPath);
-    ctx.recordRead(absPath, stat11.mtimeMs);
+    const stat10 = await fs11.stat(absPath);
+    ctx.recordRead(absPath, stat10.mtimeMs);
     ctx.session.recordFileChange({
       path: absPath,
       action: existed ? "modified" : "created",