@wrongstack/tools 0.320.1 → 1.0.1

package/dist/{chunk-KWXIKGE3.js → chunk-3D5DJWOE.js}

@@ -1,9 +1,9 @@
 import {
   tryLegacyCodeOperation
-} from "./chunk-I7FBZOEP.js";
+} from "./chunk-T3SMFF5Q.js";
 import {
   spawnStream
-} from "./chunk-OYP27E3I.js";
+} from "./chunk-DRRY6SCM.js";
 import {
   normalizeCommandOutput,
   safeResolveReal
@@ -181,4 +181,4 @@ async function detectLinter(cwd) {
 export {
   lintTool
 };
-//# sourceMappingURL=chunk-KWXIKGE3.js.map
+//# sourceMappingURL=chunk-3D5DJWOE.js.map

package/dist/{chunk-XSSFBS5I.js → chunk-4ERMPDHV.js}

@@ -1,13 +1,13 @@
 import {
   capSubject,
   compileUserRegex
-} from "./chunk-Q5JPPCZC.js";
+} from "./chunk-YJTXRH5Y.js";
 import {
   mapWithConcurrency
 } from "./chunk-ZBMANLYH.js";
 import {
   loadGitignoreMatcher
-} from "./chunk-DTQ75VBC.js";
+} from "./chunk-2CTZW6JQ.js";
 import {
   isBinaryBuffer,
   safeResolveReal
@@ -374,6 +374,7 @@ async function runNative(input, base, mode, limit, signal) {
   const maxBytes = NATIVE_MAX_FILE_BYTES;
   let total = 0;
   let stopped = false;
+  let countTruncated = false;
   const scanFile = async (full, name, rel) => {
     if (stopped || signal.aborted) return;
     if (globRe) {
@@ -449,8 +450,12 @@ async function runNative(input, base, mode, limit, signal) {
           }
         }
         if (fileHits > 0) {
-          if (mode === "count" && matches.length < limit) {
-            matches.push(`${full}:${fileHits}`);
+          if (mode === "count") {
+            if (matches.length < limit) {
+              matches.push(`${full}:${fileHits}`);
+            } else {
+              countTruncated = true;
+            }
           }
           if (mode === "files_with_matches" && matches.length >= limit) stopped = true;
         }
@@ -507,7 +512,7 @@ async function runNative(input, base, mode, limit, signal) {
   return {
     matches,
     count: total,
-    truncated: stopped,
+    truncated: stopped || countTruncated,
     used: "native"
   };
 }
@@ -517,4 +522,4 @@ export {
   __resetRgDetectionForTests,
   __setRgAvailableForTests
 };
-//# sourceMappingURL=chunk-XSSFBS5I.js.map
+//# sourceMappingURL=chunk-4ERMPDHV.js.map

package/dist/{chunk-QSNVDHOZ.js → chunk-4WPBS45A.js}

@@ -1,9 +1,9 @@
 import {
   tryLegacyCodeOperation
-} from "./chunk-I7FBZOEP.js";
+} from "./chunk-T3SMFF5Q.js";
 import {
   spawnStream
-} from "./chunk-OYP27E3I.js";
+} from "./chunk-DRRY6SCM.js";
 import {
   detectPackageManager,
   normalizeCommandOutput,
@@ -118,8 +118,7 @@ var typecheckTool = {
       signal,
       maxBytes: 2e5
     });
-    const combined = `${result.stdout}
-${result.stderr}`;
+    const combined = [result.stdout, result.stderr, result.error].filter(Boolean).join("\n");
     let errors = [...combined.matchAll(/^.*\berror TS\d+:/gmi)].length;
     const warnings = [...combined.matchAll(/^.*\bwarning TS\d+:/gmi)].length;
     if (errors === 0 && result.exitCode !== 0) {
@@ -163,4 +162,4 @@ async function findTsConfig(cwd) {
 export {
   typecheckTool
 };
-//# sourceMappingURL=chunk-QSNVDHOZ.js.map
+//# sourceMappingURL=chunk-4WPBS45A.js.map

package/dist/{chunk-4CQWNZ62.js → chunk-5ITQPCLC.js}

@@ -1,6 +1,6 @@
 import {
   getPersistentProcessRegistry
-} from "./chunk-QGF2C7TF.js";
+} from "./chunk-PVCB7RUZ.js";
 
 // src/ps-slash.ts
 import * as os from "node:os";
@@ -334,4 +334,4 @@ export {
   formatInstanceSummary,
   createGlobalPsSlashCommand
 };
-//# sourceMappingURL=chunk-4CQWNZ62.js.map
+//# sourceMappingURL=chunk-5ITQPCLC.js.map

package/dist/{chunk-B4HTSV6Z.js → chunk-5KS24LTS.js}

@@ -1,6 +1,6 @@
 import {
   todoTool
-} from "./chunk-BK732J7I.js";
+} from "./chunk-FBUP524S.js";
 import {
   projectSessionPlanToKanban
 } from "./chunk-X6KXNHUO.js";
@@ -308,17 +308,17 @@ var planTool = {
               );
               return p;
             }
-            let itemIdx = -1;
-            const asNum = Number.parseInt(input.target, 10);
-            if (!Number.isNaN(asNum) && asNum >= 1 && asNum <= p.items.length) {
-              itemIdx = asNum - 1;
-            } else {
-              itemIdx = p.items.findIndex((it) => it.id === input.target);
-              if (itemIdx === -1) {
-                const lower = input.target.toLowerCase();
-                itemIdx = p.items.findIndex((it) => it.title.toLowerCase().includes(lower));
+            let itemIdx = p.items.findIndex((it) => it.id === input.target);
+            if (itemIdx === -1 && /^[1-9]\d*$/.test(input.target)) {
+              const asNum = Number.parseInt(input.target, 10) - 1;
+              if (asNum >= 0 && asNum < p.items.length) {
+                itemIdx = asNum;
               }
             }
+            if (itemIdx === -1) {
+              const lower = input.target.toLowerCase();
+              itemIdx = p.items.findIndex((it) => it.title.toLowerCase().includes(lower));
+            }
             if (itemIdx === -1 || !p.items[itemIdx]) {
               early = mkResult(p, false, `No plan item matched "${input.target}".`);
               return p;
@@ -414,4 +414,4 @@ function mkResult(plan, ok, message, todos) {
 export {
   planTool
 };
-//# sourceMappingURL=chunk-B4HTSV6Z.js.map
+//# sourceMappingURL=chunk-5KS24LTS.js.map

package/dist/{chunk-QPNYDH5B.js → chunk-62OAECEQ.js}

@@ -63,8 +63,21 @@ var searchTool = {
       });
     }
     const signal = opts?.signal ?? ctx?.signal ?? new AbortController().signal;
+    if (input.num_results !== void 0 && (typeof input.num_results !== "number" || !Number.isFinite(input.num_results) || input.num_results <= 0)) {
+      throw new ToolValidationError({
+        message: "search: num_results must be a positive integer",
+        field: "num_results"
+      });
+    }
     const rawNum = typeof input.num_results === "number" && !Number.isNaN(input.num_results) ? input.num_results : DEFAULT_NUM;
     const num = Math.max(1, Math.min(Math.floor(rawNum), MAX_RESULTS));
+    const VALID_SOURCES = /* @__PURE__ */ new Set(["duckduckgo", "google", "bing"]);
+    if (input.source !== void 0 && !VALID_SOURCES.has(input.source)) {
+      throw new ToolValidationError({
+        message: `search: unknown source "${input.source}"`,
+        field: "source"
+      });
+    }
     const source = input.source ?? "duckduckgo";
     const skipCache = input.skip_cache ?? false;
     const normalizedQuery = input.query.trim().toLowerCase().replace(/\s+/g, " ");
@@ -77,21 +90,22 @@ var searchTool = {
           url: r.url,
           snippet: r.snippet
         }));
+        const finalResults2 = results.slice(0, num);
         yield {
           type: "log",
-          text: `Cache hit for "${input.query}" (${source})`,
-          data: { source, query: input.query, cached: true }
+          text: `Cache hit for "${input.query}" (${entry.source})`,
+          data: { source: entry.source, query: input.query, cached: true }
         };
         yield {
           type: "partial_output",
-          text: `${results.length} cached results from ${entry.source}`,
-          data: { count: results.length, cached: true, source: entry.source }
+          text: `${finalResults2.length} cached results from ${entry.source}`,
+          data: { count: finalResults2.length, cached: true, source: entry.source }
         };
         yield {
           type: "final",
           output: {
             query: input.query,
-            results: results.slice(0, num),
+            results: finalResults2,
             source: entry.source,
             truncated: results.length > num,
             cached: true
@@ -181,6 +195,12 @@ function pruneCacheEntries() {
 function __clearSearchCache() {
   cache.clear();
 }
+function __setSearchCacheForTest(key, entry) {
+  cache.set(key, entry);
+}
+function __getSearchCacheSizeForTest() {
+  return cache.size;
+}
 function rankSearchResults(results, query) {
   const seenUrls = /* @__PURE__ */ new Set();
   const deduped = [];
@@ -445,6 +465,8 @@ function decodeHtmlEntities(text) {
 
 export {
   searchTool,
-  __clearSearchCache
+  __clearSearchCache,
+  __setSearchCacheForTest,
+  __getSearchCacheSizeForTest
 };
-//# sourceMappingURL=chunk-QPNYDH5B.js.map
+//# sourceMappingURL=chunk-62OAECEQ.js.map

package/dist/{chunk-DFQDJT22.js → chunk-6GOZTS6F.js}

@@ -1,7 +1,7 @@
 import {
   getProcessRegistry,
   redactCommand
-} from "./chunk-ESLPBT5A.js";
+} from "./chunk-HDYUBRMF.js";
 import {
   buildWin32CmdShimInvocation,
   resolveWin32Command
@@ -66,7 +66,7 @@ var outdatedTool = {
     const manager = await detectPackageManager(cwd, ctx.projectRoot);
     if (manager === "npm") {
       try {
-        const { detectNonJsEcosystem } = await import("./legacy-bridge-FOV5ODDI.js");
+        const { detectNonJsEcosystem } = await import("./legacy-bridge-YXANP5QB.js");
         const nonJs = await detectNonJsEcosystem(cwd, ctx.projectRoot);
         if (nonJs) {
           const { planLanguageOperation, executePackagePlan } = await import("./languages/index.js");
@@ -282,4 +282,4 @@ Note: exit code 1 from \`outdated\` means outdated packages were found (expected
 export {
   outdatedTool
 };
-//# sourceMappingURL=chunk-DFQDJT22.js.map
+//# sourceMappingURL=chunk-6GOZTS6F.js.map

package/dist/{chunk-5UFVCIUB.js → chunk-6H4ERJP7.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-BTSFTGIL.js";
 import {
   getPersistentProcessRegistry
-} from "./chunk-QGF2C7TF.js";
+} from "./chunk-PVCB7RUZ.js";
 import {
   createOutputSpool,
   spoolNote
@@ -11,7 +11,7 @@ import {
 import {
   getProcessRegistry,
   redactCommand
-} from "./chunk-ESLPBT5A.js";
+} from "./chunk-HDYUBRMF.js";
 import {
   resolvePowerShell
 } from "./chunk-KE7A76VC.js";
@@ -627,17 +627,51 @@ var bashTool = {
     const detached = !isWin2;
     const startedAt = Date.now();
     if (input.background) {
-      const child2 = spawn(shell, args, {
-        cwd: spawnCwd,
-        env,
-        stdio: ["ignore", "ignore", "ignore"],
-        detached: !isWin2,
-        windowsHide: true
-      });
+      let child2;
+      try {
+        child2 = spawn(shell, args, {
+          cwd: spawnCwd,
+          env,
+          stdio: ["ignore", "ignore", "ignore"],
+          detached: !isWin2,
+          windowsHide: true
+        });
+      } catch (err) {
+        registry.afterCall(Date.now() - startedAt, true, bypassBreaker);
+        emitProcessStarted({
+          parentPid: process.pid,
+          command: redactCommand(`${shell} ${args.join(" ")}`),
+          args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
+          cwd: spawnCwd,
+          background: true,
+          startedAt: new Date(startedAt).toISOString()
+        });
+        emitProcessCompleted({
+          exitCode: 1,
+          durationMs: Date.now() - startedAt,
+          stdoutBytes: 0,
+          stderrBytes: 0,
+          timedOut: false,
+          endedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        yield {
+          type: "final",
+          output: {
+            output: "",
+            exit_code: 1,
+            timed_out: false,
+            pid: null,
+            error: `spawn failed: ${err instanceof Error ? err.message : String(err)}`
+          }
+        };
+        return;
+      }
       const pid2 = child2.pid;
       const stdoutBytes2 = 0;
       const stderrBytes2 = 0;
       let telemetryCompleted2 = false;
+      let bgErrorOccurred = false;
+      let bgSettled = false;
       emitProcessStarted({
         ...pid2 !== void 0 ? { pid: pid2 } : {},
         parentPid: process.pid,
@@ -675,15 +709,33 @@ var bashTool = {
         child2.on("close", () => registry.unregister(pid2));
       }
       child2.on("error", () => {
-        if (typeof pid2 === "number") registry.unregister(pid2);
+        if (bgSettled) return;
+        bgErrorOccurred = true;
         registry.afterCall(Date.now() - startedAt, true, bypassBreaker);
         completeBackground(1);
       });
       child2.on("close", (code, signal) => {
-        registry.afterCall(Date.now() - startedAt, false, bypassBreaker);
+        bgSettled = true;
+        if (bgErrorOccurred) return;
+        const failed = code !== 0 && code !== null || !!signal;
+        registry.afterCall(Date.now() - startedAt, failed, bypassBreaker);
         completeBackground(code ?? (signal ? 1 : 0), signal ?? void 0);
       });
-      if (typeof pid2 === "number") child2.unref();
+      if (typeof pid2 !== "number") {
+        completeBackground(1);
+        yield {
+          type: "final",
+          output: {
+            output: "",
+            exit_code: 1,
+            timed_out: false,
+            pid: null,
+            error: "Failed to launch background process: invalid PID"
+          }
+        };
+        return;
+      }
+      child2.unref();
       yield {
         type: "final",
         output: {
@@ -705,14 +757,46 @@ var bashTool = {
       });
       return;
     }
-    const child = spawn(shell, args, {
-      cwd: spawnCwd,
-      env,
-      stdio: ["ignore", "pipe", "pipe"],
-      detached,
-      windowsHide: true,
-      ...isWin2 ? {} : { signal: callerSignal }
-    });
+    let child;
+    try {
+      child = spawn(shell, args, {
+        cwd: spawnCwd,
+        env,
+        stdio: ["ignore", "pipe", "pipe"],
+        detached,
+        windowsHide: true,
+        ...isWin2 ? {} : { signal: callerSignal }
+      });
+    } catch (err) {
+      registry.afterCall(Date.now() - startedAt, true, bypassBreaker);
+      emitProcessStarted({
+        parentPid: process.pid,
+        command: redactCommand(`${shell} ${args.join(" ")}`),
+        args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
+        cwd: spawnCwd,
+        background: false,
+        startedAt: new Date(startedAt).toISOString()
+      });
+      emitProcessCompleted({
+        exitCode: 1,
+        durationMs: Date.now() - startedAt,
+        stdoutBytes: 0,
+        stderrBytes: 0,
+        timedOut: false,
+        endedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      yield {
+        type: "final",
+        output: {
+          output: "",
+          exit_code: 1,
+          timed_out: false,
+          pid: null,
+          error: `spawn failed: ${err instanceof Error ? err.message : String(err)}`
+        }
+      };
+      return;
+    }
     const pid = child.pid;
     let stdoutBytes = 0;
     let stderrBytes = 0;
@@ -862,15 +946,21 @@ var bashTool = {
     const onStderrData = (chunk) => onData(chunk, "stderr");
     child.stdout?.on("data", onStdoutData);
     child.stderr?.on("data", onStderrData);
+    let fgErrorOccurred = false;
+    let sawClose = false;
     child.on("error", (err) => {
+      if (sawClose) return;
+      fgErrorOccurred = true;
       for (const t of timers) clearTimeout(t);
       registry.afterCall(Date.now() - startedAt, true);
       completeForeground(1);
       push({ kind: "error", err });
     });
     child.on("close", (code, signal) => {
+      sawClose = true;
       for (const t of timers) clearTimeout(t);
       if (typeof pid === "number") registry.unregister(pid);
+      if (fgErrorOccurred) return;
       registry.afterCall(Date.now() - startedAt, code !== 0 && code !== null);
       completeForeground(timedOut ? 124 : code ?? (signal ? 1 : 0), signal ?? void 0);
       const tail = stdoutDecoder.end() + stderrDecoder.end();
@@ -885,7 +975,33 @@ var bashTool = {
       while (true) {
         const c = await next();
         resumeIfDrained();
-        if (c.kind === "error") throw c.err;
+        if (c.kind === "error") {
+          const isAbort = c.err?.code === "ABORT_ERR" || callerSignal.aborted;
+          const remainder = flush();
+          if (remainder !== null) {
+            yield { type: "partial_output", text: remainder };
+          }
+          const spooled = spool.finalize();
+          yield {
+            type: "final",
+            output: {
+              output: normalizeCommandOutput(buf) + (spooled ? spoolNote(spooled) : "") + pipeToShellNote,
+              exit_code: isAbort ? 124 : 1,
+              timed_out: isAbort,
+              pid: pid ?? null,
+              error: isAbort ? "Command aborted by user or signal" : c.err.message
+            }
+          };
+          ctx.recordSideEffect?.({
+            toolUseId: `bash-${Date.now()}`,
+            toolName: "bash",
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            input: { command: redactCommand(input.command) },
+            outcome: isAbort ? "aborted" : `error (${c.err.message})`,
+            risk: "shell"
+          });
+          return;
+        }
         if (c.kind === "end") {
           const remainder = flush();
           if (remainder !== null) {
@@ -903,7 +1019,7 @@ ${hint}` : "") + pipeToShellNote,
               exit_code: timedOut || isAborted ? 124 : c.code,
               timed_out: timedOut || isAborted,
               pid: pid ?? null,
-              error: isAborted ? "Command aborted by user or signal" : void 0
+              error: timedOut ? "Command timed out" : isAborted ? "Command aborted by user or signal" : void 0
             }
           };
           ctx.recordSideEffect?.({
@@ -930,7 +1046,7 @@ ${hint}` : "") + pipeToShellNote,
       child.stderr?.off("data", onStderrData);
       child.stdout?.destroy();
       child.stderr?.destroy();
-      if (child.exitCode === null && !child.killed) {
+      if (!sawClose && child.exitCode === null && !child.killed) {
         if (typeof pid === "number") registry.kill(pid, { force: true });
         else killWithTimeout(child, 2e3);
       }
@@ -977,4 +1093,4 @@ export {
   checkAndBlockKillCommand,
   bashTool
 };
-//# sourceMappingURL=chunk-5UFVCIUB.js.map
+//# sourceMappingURL=chunk-6H4ERJP7.js.map

package/dist/{chunk-34VLZ35Z.js → chunk-7HL23T3T.js}

@@ -18,7 +18,7 @@ var diffTool = {
   name: "diff",
   category: "Filesystem",
   description: "Show file content with line numbers, staged/working-tree diffs via git, or commit/branch diffs. A safer and more structured alternative to raw `git diff` via shell.",
-  usageHint: 'USE FOR CODE REVIEW AND CHANGE INSPECTION:\n\n- `files` + no `a`/`b` \u2192 show file content with line numbers (NOT a unified diff; no +/- prefixes). Result `mode` is "dump".\n- `a` and/or `b` \u2192 git-style commit/branch diff (unified format, real +/- prefixes).\n- `staged: true` \u2192 only show staged changes.\n- `mode` only affects the git-diff path: "stat" runs `git diff --stat`; "side-by-side" is not supported and falls back to unified (result `mode` reports what was produced).\n- `context` sets the unified-diff context line count on the git path (`-U<n>`); the dump path has no context notion.\n\nNOTE: For a true file-vs-file unified diff, supply `a` and `b` so the tool delegates to `git diff`. The `files`-only path is a line-numbered dump, not a diff.\n\nThis tool has important safety guards against flag injection (see previous security findings).',
+  usageHint: 'USE FOR CODE REVIEW AND CHANGE INSPECTION:\n\n- `files` + no `a`/`b` \u2192 show file content with line numbers (NOT a unified diff; no +/- prefixes). Result `mode` is "dump".\n- `a` and/or `b` \u2192 git-style commit/branch diff (unified format, real +/- prefixes).\n- `staged: true` \u2192 only show staged changes.\n- `mode` only affects the git-diff path: "stat" runs `git diff --stat`; "side-by-side" is unimplemented and falls back to unified (result `mode` reports what was produced).\n- `context` sets the unified-diff context line count on the git path (`-U<n>`); the dump path has no context notion.\n\nNOTE: For a true file-vs-file unified diff, supply `a` and `b` so the tool delegates to `git diff`. The `files`-only path is a line-numbered dump, not a diff.\n\nThis tool has important safety guards against flag injection (see previous security findings).',
   permission: "auto",
   mutating: false,
   maxOutputBytes: 262144,
@@ -63,7 +63,29 @@ var diffTool = {
   async execute(input, ctx, opts) {
     const signal = opts?.signal ?? ctx.signal ?? new AbortController().signal;
     signal.throwIfAborted();
-    if (input.a !== void 0 || input.b !== void 0) {
+    if (input.path !== void 0) {
+      if (typeof input.path !== "string" || !input.path.trim()) {
+        throw new ToolValidationError({
+          message: "diff: 'path' must be a non-empty string when provided",
+          field: "path"
+        });
+      }
+      try {
+        await safeResolveReal(input.path, ctx);
+      } catch (err) {
+        throw new ToolValidationError({
+          message: `diff: ${err.message}`,
+          field: "path"
+        });
+      }
+    }
+    if (input.context !== void 0 && (typeof input.context !== "number" || !Number.isInteger(input.context) || input.context < 0 || input.context > 100)) {
+      throw new ToolValidationError({
+        message: "diff: context must be an integer between 0 and 100",
+        field: "context"
+      });
+    }
+    if (input.staged || input.a !== void 0 || input.b !== void 0) {
       return await gitDiff(input, ctx, signal);
     }
     return await fileDiff(input, ctx, signal);
@@ -98,7 +120,15 @@ async function gitDiff(input, ctx, signal) {
   const statMode = requestedMode === "stat";
   const effectiveMode = statMode ? "stat" : "unified";
   const sideBySideNote = requestedMode === "side-by-side" ? "side-by-side output is not supported; a unified diff was produced instead." : void 0;
-  const basePath = input.path ? await safeResolveReal(input.path, ctx) : ctx.cwd;
+  let basePath;
+  try {
+    basePath = input.path ? await safeResolveReal(input.path, ctx) : ctx.cwd;
+  } catch (err) {
+    throw new ToolValidationError({
+      message: `diff: ${err.message}`,
+      field: "path"
+    });
+  }
   const gitDir = findGitDir(basePath);
   if (!gitDir) {
     return {
@@ -118,10 +148,16 @@ async function gitDiff(input, ctx, signal) {
   if (input.staged) args.push("--staged");
   if (input.a) args.push(input.a.trim());
   if (input.b) args.push(input.b.trim());
+  let effectiveFiles = [];
   if (input.files) {
     const rawFiles = Array.isArray(input.files) ? input.files : typeof input.files === "string" ? input.files.split(",") : [];
-    const files = rawFiles.filter((f) => typeof f === "string").map((f) => f.trim().replace(/\\/g, "/")).filter(Boolean);
+    const files = [
+      ...new Set(
+        rawFiles.filter((f) => typeof f === "string").map((f) => f.trim().replace(/\\/g, "/")).filter(Boolean)
+      )
+    ];
     if (files.length > 0) {
+      effectiveFiles = files;
       args.push("--", ...files);
     }
   }
@@ -140,7 +176,7 @@ async function gitDiff(input, ctx, signal) {
   const combinedNote = [sideBySideNote, exitNote].filter(Boolean).join("\n") || void 0;
   return {
     diff,
-    files: [],
+    files: effectiveFiles,
     truncated,
     mode: effectiveMode,
     note: combinedNote
@@ -151,7 +187,7 @@ function findGitDir(cwd) {
   for (let i = 0; i < 20; i++) {
     try {
       const stat2 = statSync(path.join(dir, ".git"));
-      if (stat2.isDirectory()) return dir;
+      if (stat2.isDirectory() || stat2.isFile()) return dir;
     } catch {
     }
     const parent = path.dirname(dir);
@@ -188,7 +224,11 @@ async function fileDiff(input, ctx, signal) {
   signal.throwIfAborted();
   void input.context;
   const rawFiles = Array.isArray(input.files) ? input.files : typeof input.files === "string" ? input.files.split(",") : [];
-  const files = rawFiles.filter((f) => typeof f === "string").map((f) => f.trim()).filter(Boolean);
+  const files = [
+    ...new Set(
+      rawFiles.filter((f) => typeof f === "string").map((f) => f.trim()).filter(Boolean)
+    )
+  ];
   if (files.length === 0) {
     return {
       diff: "No files specified",
@@ -197,11 +237,24 @@ async function fileDiff(input, ctx, signal) {
       mode: "dump"
     };
   }
-  const basePath = input.path ? await safeResolveReal(input.path, ctx) : ctx.cwd;
+  let basePath;
+  try {
+    basePath = input.path ? await safeResolveReal(input.path, ctx) : ctx.cwd;
+  } catch (err) {
+    throw new ToolValidationError({
+      message: `diff: ${err.message}`,
+      field: "path"
+    });
+  }
   const fileEntries = await mapWithConcurrency(files, 16, async (file) => {
     signal.throwIfAborted();
     const fileToResolve = path.isAbsolute(file) ? file : path.resolve(basePath, file);
-    const absPath = await safeResolveReal(fileToResolve, ctx);
+    let absPath;
+    try {
+      absPath = await safeResolveReal(fileToResolve, ctx);
+    } catch {
+      return null;
+    }
     const stat2 = await fs.stat(absPath).catch(() => null);
     if (!stat2?.isFile()) return null;
     if (stat2.size > MAX_FILE_DUMP_BYTES) {
@@ -249,4 +302,4 @@ ${parts.join("\n")}`;
 export {
   diffTool
 };
-//# sourceMappingURL=chunk-34VLZ35Z.js.map
+//# sourceMappingURL=chunk-7HL23T3T.js.map

package/dist/{chunk-HFXSNKCV.js → chunk-7JJFC6CT.js}

@@ -193,4 +193,4 @@ var CircuitBreaker = class {
 export {
   CircuitBreaker
 };
-//# sourceMappingURL=chunk-HFXSNKCV.js.map
+//# sourceMappingURL=chunk-7JJFC6CT.js.map

package/dist/{chunk-23EX5WDO.js → chunk-7LQCT3LT.js}

@@ -1,10 +1,10 @@
 import {
   builtinToolsPack
-} from "./chunk-JVRLTEO7.js";
+} from "./chunk-E7JE3UEX.js";
 import {
   TIER1_TOOLS,
   TIER2_TOOLS
-} from "./chunk-4BABEJC2.js";
+} from "./chunk-IAYMTTR2.js";
 
 // src/tool-tier.ts
 function toolNameSet(tools) {
@@ -54,4 +54,4 @@ export {
   selectBuiltinToolsForTier,
   registerBuiltinToolTier
 };
-//# sourceMappingURL=chunk-23EX5WDO.js.map
+//# sourceMappingURL=chunk-7LQCT3LT.js.map

package/dist/{chunk-NDIT3SBZ.js → chunk-7N5U2RAU.js}

@@ -1,6 +1,6 @@
 import {
   spawnStream
-} from "./chunk-OYP27E3I.js";
+} from "./chunk-DRRY6SCM.js";
 import {
   normalizeCommandOutput,
   safeResolveReal
@@ -3515,4 +3515,4 @@ export {
   languagePackageTool,
   languageInfoTool
 };
-//# sourceMappingURL=chunk-NDIT3SBZ.js.map
+//# sourceMappingURL=chunk-7N5U2RAU.js.map