codelocal 1.5.0-beta.1

package/dist/security-policy.js

@@ -0,0 +1,293 @@
+import { createHash } from "node:crypto";
+import os from "node:os";
+import path from "node:path";
+const rank = { SAFE: 0, REVIEW: 1, HIGH: 2, CRITICAL: 3, BLOCKED: 4 };
+const SECRET_ENV_NAME = /(?:^|_)(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|PRIVATE_?KEY|ACCESS_?KEY|SESSION_?TOKEN|COOKIE)(?:$|_)/i;
+function hashKey(value) {
+    return createHash("sha256").update(value).digest("hex").slice(0, 24);
+}
+export function redactCommand(command) {
+    let value = command;
+    value = value.replace(/(authorization\s*:\s*bearer\s+)[^\s"']+/gi, "$1[REDACTED]");
+    value = value.replace(/((?:api[_-]?key|access[_-]?token|auth[_-]?token|password|secret|cookie)\s*[=:]\s*)[^\s"']+/gi, "$1[REDACTED]");
+    value = value.replace(/(--(?:token|password|secret|api-key|apikey)\s+)([^\s]+)/gi, "$1[REDACTED]");
+    value = value.replace(/((?:OPENAI_API_KEY|CODEX_API_KEY|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN|GITHUB_TOKEN|GH_TOKEN|NPM_TOKEN)=)([^\s]+)/gi, "$1[REDACTED]");
+    value = value.replace(/(https?:\/\/[^\s:@]+:)[^@\s]+@/gi, "$1[REDACTED]@");
+    return value;
+}
+export function isSensitivePath(relativePath) {
+    const p = relativePath.replace(/\\/g, "/").replace(/^\.\//, "");
+    const base = p.split("/").pop()?.toLowerCase() ?? "";
+    if ([".env.example", ".env.sample", ".env.template"].includes(base))
+        return false;
+    if (/(^|\/)\.(git|ssh|aws|gnupg|gcloud|azure)(\/|$)/i.test(p))
+        return true;
+    if (/(^|\/)\.env($|\.)/i.test(p))
+        return true;
+    if (/\.(pem|p12|pfx|key|kdbx)$/i.test(base))
+        return true;
+    if (/(credentials?|service[-_]?account|private[-_]?key|secrets?)\.(json|ya?ml|toml|ini)$/i.test(base))
+        return true;
+    return false;
+}
+export function hasShellComposition(command) {
+    return /[;&|<>`\r\n]/.test(command) || /\$\s*\(/.test(command);
+}
+function shellWords(command) {
+    const words = [];
+    let current = "";
+    let quote = null;
+    let escaped = false;
+    for (const char of command) {
+        if (escaped) {
+            current += char;
+            escaped = false;
+            continue;
+        }
+        if (char === "\\" && quote !== "'") {
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (char === quote)
+                quote = null;
+            else
+                current += char;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char;
+            continue;
+        }
+        if (/\s/.test(char)) {
+            if (current) {
+                words.push(current);
+                current = "";
+            }
+            continue;
+        }
+        current += char;
+    }
+    if (escaped || quote)
+        return null;
+    if (current)
+        words.push(current);
+    return words;
+}
+function commandWords(command) {
+    const words = shellWords(command);
+    if (!words)
+        return null;
+    let index = 0;
+    while (index < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[index]))
+        index++;
+    if (path.basename(words[index] ?? "").toLowerCase() === "env") {
+        index++;
+        while (index < words.length && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[index]) || words[index].startsWith("-")))
+            index++;
+    }
+    return { words, commandIndex: index, executable: path.basename(words[index] ?? "").toLowerCase(), args: words.slice(index + 1) };
+}
+function isInside(workspaceRoot, candidate) {
+    const root = path.resolve(workspaceRoot);
+    const value = path.resolve(candidate);
+    return value === root || value.startsWith(root + path.sep);
+}
+function pathCandidate(token) {
+    const equals = token.indexOf("=");
+    const raw = equals > 0 && token.startsWith("-") ? token.slice(equals + 1) : token;
+    if (/^(?:https?|wss?|ssh):\/\//i.test(raw))
+        return null;
+    if (raw === "/dev/null")
+        return null;
+    if (raw === "~" || raw.startsWith("~/") || path.isAbsolute(raw) || raw === ".." || raw.startsWith("../") || raw.includes("/../"))
+        return raw;
+    return null;
+}
+function explicitPathEscape(command, context) {
+    if (!context.workspaceRoot)
+        return null;
+    const parsed = commandWords(command);
+    if (!parsed)
+        return null;
+    const cwd = path.resolve(context.cwd ?? context.workspaceRoot);
+    const rawExecutable = parsed.words[parsed.commandIndex] ?? "";
+    const tokens = [rawExecutable, ...parsed.args];
+    for (const token of tokens) {
+        const candidate = pathCandidate(token);
+        if (!candidate)
+            continue;
+        const expanded = candidate === "~" ? os.homedir() : candidate.startsWith("~/") ? path.join(os.homedir(), candidate.slice(2)) : path.isAbsolute(candidate) ? candidate : path.resolve(cwd, candidate);
+        if (!isInside(context.workspaceRoot, expanded))
+            return candidate;
+    }
+    return null;
+}
+function structuredApproval(command) {
+    if (hasShellComposition(command))
+        return null;
+    const parsed = commandWords(command);
+    if (!parsed?.executable)
+        return null;
+    const normalized = command.replace(/\s+/g, " ").trim();
+    const redacted = redactCommand(normalized);
+    if (parsed.executable === "git") {
+        const sub = parsed.args[0]?.toLowerCase();
+        const rest = parsed.args.slice(1);
+        if (sub === "commit")
+            return { key: "git.commit", label: "Git commit in this workspace" };
+        if (sub === "push" && !rest.some((arg) => /^(?:-f|--force(?:-with-lease)?(?:=.*)?|--delete|--mirror|--all|--tags|--prune)$/.test(arg))) {
+            const positional = rest.filter((arg) => !arg.startsWith("-"));
+            if (positional.some((arg) => arg.startsWith(":")))
+                return null;
+            if (positional[0] && positional[1])
+                return { key: `git.push:${positional[0]}:${positional[1]}`, label: `Git push ${positional[0]} ${positional[1]}` };
+            return null;
+        }
+        if (["tag", "merge", "rebase", "pull", "fetch"].includes(sub ?? ""))
+            return { key: `git.${sub}:${hashKey(redacted)}`, label: redacted };
+    }
+    if (/^(?:npm|pnpm|yarn|bun|pip|pipx|poetry|uv|cargo|go)$/i.test(parsed.executable) && /^(?:install|add|remove|uninstall|update|upgrade|get)$/i.test(parsed.args[0] ?? "")) {
+        return { key: `dependency:${parsed.executable}:${hashKey(redacted)}`, label: redacted };
+    }
+    const rawExecutable = parsed.words[parsed.commandIndex] ?? "";
+    if (rawExecutable.includes("/") || /^(?:node|python|python3|ruby|perl|php|deno|tsx|ts-node|jest|vitest|pytest|mocha|ava|bash|sh|zsh|fish|pwsh|powershell|java|swift|swiftc|dotnet|xcodebuild)$/i.test(parsed.executable)) {
+        return { key: `workspace-exec:${hashKey(redacted)}`, label: redacted };
+    }
+    if (/^(?:npm|pnpm|yarn|bun)$/i.test(parsed.executable) && /^(?:run|test|start|exec|x)$/i.test(parsed.args[0] ?? "")) {
+        return { key: `workspace-exec:${hashKey(redacted)}`, label: redacted };
+    }
+    if (/^(?:npx|make|just|task|gradle|gradlew|mvn|mvnw)$/i.test(parsed.executable)) {
+        return { key: `workspace-exec:${hashKey(redacted)}`, label: redacted };
+    }
+    if (/^(?:cargo)$/i.test(parsed.executable) && /^(?:run|test|build|bench)$/i.test(parsed.args[0] ?? "")) {
+        return { key: `workspace-exec:${hashKey(redacted)}`, label: redacted };
+    }
+    if (/^(?:go)$/i.test(parsed.executable) && /^(?:run|test|build|generate)$/i.test(parsed.args[0] ?? "")) {
+        return { key: `workspace-exec:${hashKey(redacted)}`, label: redacted };
+    }
+    if (/^(?:flutter|dart)$/i.test(parsed.executable) && /^(?:run|test|build|compile)$/i.test(parsed.args[0] ?? "")) {
+        return { key: `workspace-exec:${hashKey(redacted)}`, label: redacted };
+    }
+    if (parsed.executable === "dotnet" && /^(?:run|test|build|publish)$/i.test(parsed.args[0] ?? "")) {
+        return { key: `workspace-exec:${hashKey(redacted)}`, label: redacted };
+    }
+    if (/^(?:flutter|dart)$/i.test(parsed.executable) && parsed.args[0] === "pub" && /^(?:add|remove|upgrade|downgrade|get)$/i.test(parsed.args[1] ?? "")) {
+        return { key: `dependency:${parsed.executable}-pub:${hashKey(redacted)}`, label: redacted };
+    }
+    if (parsed.executable === "pod" && /^(?:install|update)$/i.test(parsed.args[0] ?? "")) {
+        return { key: `dependency:pod:${hashKey(redacted)}`, label: redacted };
+    }
+    return null;
+}
+function isRoutineDeveloperCommand(normalized) {
+    if (hasShellComposition(normalized))
+        return false;
+    return /^(?:(?:[A-Za-z_][A-Za-z0-9_]*=[^\s]+)\s+)*(?:(?:fvm\s+)?flutter\s+(?:analyze|test|run|doctor|devices|emulators|clean|build)\b|dart\s+(?:analyze|test|format|fix|compile)\b|xcodebuild\b|xcrun\s+(?:simctl|xctrace)\b|pod\s+(?:repo\s+list|env)\b)/i.test(normalized);
+}
+export function classifyCommand(command, networkPolicy = "approval", context = {}) {
+    const normalized = command.replace(/\s+/g, " ").trim();
+    const rules = [];
+    let risk = "SAFE";
+    let blocked = false;
+    let approval = false;
+    const hit = (pattern, reason, level, options = {}) => {
+        if (!pattern.test(normalized))
+            return;
+        rules.push(reason);
+        if (rank[level] > rank[risk])
+            risk = level;
+        blocked ||= !!options.block;
+        approval ||= !!options.approve;
+    };
+    hit(/(^|[;&|]\s*)sudo\b/i, "privilege escalation", "BLOCKED", { block: true });
+    hit(/(^|[;&|]\s*)(shutdown|reboot|halt|diskutil|mkfs|fdisk|gpt|mount|umount)\b/i, "system or disk administration", "BLOCKED", { block: true });
+    hit(/\bdd\s+[^\n]*\bof=\/dev\//i, "raw device write", "BLOCKED", { block: true });
+    hit(/(^|\s)(~\/)?\.(ssh|aws|gnupg|gcloud|azure)(\/|\s|$)/i, "credential directory access", "BLOCKED", { block: true });
+    hit(/(^|\s)\/dev\/(?!null\b|zero\b|random\b|urandom\b)/i, "device file access", "BLOCKED", { block: true });
+    hit(/\b(?:security\s+(?:find|dump|unlock|set)|gh\s+auth\s+token|git\s+credential(?:-\w+)?\b)/i, "credential retrieval", "BLOCKED", { block: true });
+    hit(/\$(?:\{)?(?:HOME|USERPROFILE|OLDPWD|TMPDIR|XDG_CONFIG_HOME|XDG_DATA_HOME)(?:\})?(?:[\\/]|$)/i, "environment-based path can escape authorized workspace", "BLOCKED", { block: true });
+    hit(/^(?:env|printenv|set|export\s+-p)\s*$/i, "environment secret enumeration", "BLOCKED", { block: true });
+    if (/\bprintenv\s+([A-Za-z_][A-Za-z0-9_]*)/i.test(normalized)) {
+        const name = normalized.match(/\bprintenv\s+([A-Za-z_][A-Za-z0-9_]*)/i)?.[1] ?? "";
+        if (SECRET_ENV_NAME.test(name))
+            hit(/\bprintenv\b/i, "sensitive environment variable access", "BLOCKED", { block: true });
+    }
+    if (/\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/.test(normalized)) {
+        const vars = [...normalized.matchAll(/\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/g)].map((m) => m[1]);
+        if (vars.some((name) => SECRET_ENV_NAME.test(name)))
+            hit(/\$/i, "sensitive environment variable expansion", "BLOCKED", { block: true });
+    }
+    const escaped = explicitPathEscape(command, context);
+    if (escaped) {
+        rules.push(`explicit path escapes authorized workspace: ${redactCommand(escaped)}`);
+        risk = "BLOCKED";
+        blocked = true;
+    }
+    else if (!context.workspaceRoot) {
+        hit(/(^|\s)\.\.\/(?:\.\.\/)?/, "parent-directory traversal", "BLOCKED", { block: true });
+    }
+    hit(/\bgit\s+(?:commit\b[^\n]*--amend\b|reset\s+--hard|clean\s+-[a-z]*f|push\s+[^\n]*(?:-f\b|--force(?:-with-lease)?(?:=\S+)?|--delete\b|--mirror\b|--all\b|--tags\b|--prune\b)|push\s+\S+\s+:\S+|restore\s+(?!--staged))\b/i, "destructive Git action", "CRITICAL", { approve: true });
+    hit(/\bgit\s+remote\s+(?:add|remove|rename|set-url)\b/i, "Git remote configuration change", "CRITICAL", { approve: true });
+    hit(/\bgit\s+config\b(?![^\n]*\s(?:--get|--get-all|--list|-l)\b)/i, "Git configuration change", "CRITICAL", { approve: true });
+    hit(/\brm\s+-[^\s]*r/i, "recursive delete", "CRITICAL", { approve: true });
+    hit(/\b(prisma|typeorm|sequelize|knex|alembic|rails)\b[^\n]*(migrate|migration|db:)/i, "database migration", "CRITICAL", { approve: true });
+    hit(/\b(?:npm|pnpm|yarn|bun)\s+(?:publish|login|logout)\b/i, "package registry or account action", "CRITICAL", { approve: true });
+    hit(/\bdart\s+pub\s+publish\b/i, "package publish action", "CRITICAL", { approve: true });
+    hit(/\bpod\s+trunk\s+push\b/i, "package publish action", "CRITICAL", { approve: true });
+    hit(/\b(chmod|chown|launchctl|systemctl|service)\b/i, "permission or service modification", "CRITICAL", { approve: true });
+    hit(/\b(?:node\s+-e|python(?:3)?\s+-c|ruby\s+-e|perl\s+-e|bash\s+-c|sh\s+-c|zsh\s+-c|fish\s+-c|pwsh\s+-Command|powershell\s+-Command|cmd(?:\.exe)?\s+\/c|osascript\s+-e)\b/i, "inline interpreter can bypass workspace path analysis", "CRITICAL", { approve: true });
+    hit(/\bgit\s+(commit|push|tag|merge|rebase|pull|fetch)\b/i, "Git write action", "REVIEW", { approve: true });
+    hit(/^(?:(?:[A-Za-z_][A-Za-z0-9_]*=[^\s]+)\s+)*(?:(?:\.\/?|[^\s]+\/)[^\s]+|(?:node|python|python3|ruby|perl|php|deno|tsx|ts-node|jest|vitest|pytest|mocha|ava|bash|sh|zsh|fish|pwsh|powershell|java|swift|swiftc|xcodebuild)\b|(?:npm|pnpm|yarn|bun)\s+(?:run|test|start|exec|x)\b|npx\b|(?:make|just|task|gradle|gradlew|mvn|mvnw)\b|cargo\s+(?:run|test|build|bench)\b|go\s+(?:run|test|build|generate)\b|(?:flutter|dart)\s+(?:run|test|build|compile)\b|dotnet\s+(?:run|test|build|publish)\b)/i, "workspace code execution", "REVIEW", { approve: true });
+    hit(/\b(npm|pnpm|yarn|bun|pip|pipx|poetry|uv|cargo|go)\s+(install|add|remove|uninstall|update|upgrade|get)\b/i, "dependency or toolchain change", "REVIEW", { approve: true });
+    hit(/\b(?:flutter|dart)\s+pub\s+(?:add|remove|upgrade|downgrade|get)\b/i, "Flutter/Dart dependency change", "REVIEW", { approve: true });
+    hit(/\bpod\s+(?:install|update|repo\s+update)\b/i, "CocoaPods dependency change", "REVIEW", { approve: true });
+    const networkPattern = /\b(curl|wget|ssh|scp|sftp|ftp|nc|ncat|telnet)\b/i;
+    if (networkPattern.test(normalized)) {
+        if (networkPolicy === "deny")
+            hit(networkPattern, "network access denied by policy", "BLOCKED", { block: true });
+        else if (networkPolicy === "approval")
+            hit(networkPattern, "network or remote command", "CRITICAL", { approve: true });
+    }
+    if (!blocked && hasShellComposition(command)) {
+        rules.push("composed shell command requires one-time review");
+        if (rank.CRITICAL > rank[risk])
+            risk = "CRITICAL";
+        approval = true;
+    }
+    if (!blocked && !approval && isRoutineDeveloperCommand(normalized))
+        rules.push("routine developer command");
+    if (blocked)
+        risk = "BLOCKED";
+    const uniqueRules = [...new Set(rules)];
+    const structured = !blocked && approval && rank[risk] === rank.REVIEW ? structuredApproval(command) : null;
+    const approvalPolicy = blocked ? "blocked" : !approval ? "none" : structured ? "rememberable" : "always";
+    const reason = uniqueRules.length ? uniqueRules.join("; ") : "no risky policy rule matched";
+    return {
+        riskLevel: risk,
+        matchedRules: uniqueRules,
+        requiresApproval: !blocked && approval,
+        blocked,
+        redactedCommand: redactCommand(normalized),
+        reason,
+        approvalPolicy,
+        approvalKey: structured?.key,
+        approvalLabel: structured?.label,
+    };
+}
+export function classifyGitWrite(operation, detail = "") {
+    return classifyCommand(`git ${operation} ${detail}`.trim(), "approval");
+}
+export function decisionSummary(decision) {
+    return {
+        riskLevel: decision.riskLevel,
+        matchedRules: decision.matchedRules,
+        requiresApproval: decision.requiresApproval,
+        blocked: decision.blocked,
+        redactedCommand: decision.redactedCommand,
+        reason: decision.reason,
+        approvalPolicy: decision.approvalPolicy,
+        approvalKey: decision.approvalKey,
+        approvalLabel: decision.approvalLabel,
+    };
+}

package/dist/semantic-router.js

@@ -0,0 +1,378 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { promises as fs } from "node:fs";
+import { spawn } from "node:child_process";
+import { TypeScriptSemanticIndex } from "./semantic.js";
+import { LspClient, commandExists, resolveLspRoot } from "./lsp.js";
+import { isSensitivePath } from "./security-policy.js";
+const SPECS = [
+    { id: "pyright", command: "pyright-langserver", args: ["--stdio"], languages: ["python"], extensions: [".py"], rootMarkers: ["pyproject.toml", "setup.cfg", "setup.py", "requirements.txt"] },
+    { id: "rust-analyzer", command: "rust-analyzer", args: [], languages: ["rust"], extensions: [".rs"], rootMarkers: ["Cargo.toml"] },
+    { id: "gopls", command: "gopls", args: [], languages: ["go"], extensions: [".go"], rootMarkers: ["go.mod", "go.work"] },
+    { id: "clangd", command: "clangd", args: ["--background-index"], languages: ["c", "cpp"], extensions: [".c", ".h", ".cc", ".cpp", ".cxx", ".hpp", ".hh"], rootMarkers: ["compile_commands.json", "CMakeLists.txt"] },
+    { id: "jdtls", command: "jdtls", args: [], languages: ["java"], extensions: [".java"], rootMarkers: ["pom.xml", "build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts"] },
+    { id: "kotlin-language-server", command: "kotlin-language-server", args: [], languages: ["kotlin"], extensions: [".kt", ".kts"], rootMarkers: ["build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts", "pom.xml"] },
+    { id: "lua-language-server", command: "lua-language-server", args: [], languages: ["lua"], extensions: [".lua"], rootMarkers: [".luarc.json", ".luarc.jsonc"] },
+    { id: "sourcekit-lsp", command: "sourcekit-lsp", args: [], languages: ["swift"], extensions: [".swift"], rootMarkers: ["Package.swift"] },
+    { id: "dart-analyzer", command: "dart", args: ["language-server", "--protocol=lsp"], languages: ["dart"], extensions: [".dart"], rootMarkers: ["pubspec.yaml"] },
+    { id: "zls", command: "zls", args: [], languages: ["zig"], extensions: [".zig"], rootMarkers: ["build.zig"] },
+];
+function rel(root, file) {
+    return path.relative(root, file).split(path.sep).join("/") || ".";
+}
+function lspUriToPath(uri) {
+    try {
+        return fileURLToPath(uri);
+    }
+    catch {
+        return uri;
+    }
+}
+function locationFromLsp(root, value, provider) {
+    const target = value?.targetUri
+        ? { uri: value.targetUri, range: value.targetSelectionRange ?? value.targetRange }
+        : value?.location
+            ? value.location
+            : value;
+    const uri = target?.uri;
+    const range = target?.range ?? target?.selectionRange;
+    if (!uri || !range?.start)
+        return null;
+    const absolute = lspUriToPath(String(uri));
+    const relative = rel(root, absolute);
+    if (relative.startsWith("../") || isSensitivePath(relative))
+        return null;
+    return {
+        path: relative,
+        line: Number(range.start.line ?? 0) + 1,
+        column: Number(range.start.character ?? 0) + 1,
+        endLine: Number(range.end?.line ?? range.start.line ?? 0) + 1,
+        endColumn: Number(range.end?.character ?? range.start.character ?? 0) + 1,
+        provider,
+    };
+}
+function flattenLocations(root, value, provider) {
+    const values = Array.isArray(value) ? value : value ? [value] : [];
+    return values.map((item) => locationFromLsp(root, item, provider)).filter((item) => !!item);
+}
+function symbolLocations(root, value, provider) {
+    const out = [];
+    const visit = (item, fallbackUri) => {
+        if (!item)
+            return;
+        const uri = item.location?.uri ?? fallbackUri;
+        const range = item.location?.range ?? item.selectionRange ?? item.range;
+        if (uri && range?.start) {
+            const loc = locationFromLsp(root, { uri, range }, provider);
+            if (loc)
+                out.push({ ...loc, name: String(item.name ?? ""), kind: String(item.kind ?? "") });
+        }
+        for (const child of Array.isArray(item.children) ? item.children : [])
+            visit(child, uri);
+    };
+    for (const item of Array.isArray(value) ? value : value ? [value] : [])
+        visit(item);
+    return out;
+}
+function callHierarchyLocations(root, value, provider, direction) {
+    const values = Array.isArray(value) ? value : value ? [value] : [];
+    const out = [];
+    for (const entry of values) {
+        const item = direction === "incoming" ? entry?.from : entry?.to;
+        const loc = locationFromLsp(root, item, provider);
+        if (loc)
+            out.push({ ...loc, name: item?.name ? String(item.name) : undefined, kind: "call-hierarchy" });
+    }
+    return out;
+}
+async function runCapture(command, args, cwd, timeoutMs = 20_000) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { cwd, env: { ...process.env, PAGER: "cat", GIT_PAGER: "cat" }, stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "", stderr = "", done = false;
+        const timer = setTimeout(() => { if (!done)
+            child.kill("SIGTERM"); }, timeoutMs);
+        child.stdout.on("data", (d) => { stdout = (stdout + d.toString()).slice(-2_000_000); });
+        child.stderr.on("data", (d) => { stderr = (stderr + d.toString()).slice(-2_000_000); });
+        child.on("error", reject);
+        child.on("close", (code) => { done = true; clearTimeout(timer); resolve({ stdout, stderr, code }); });
+    });
+}
+export class SemanticRouter {
+    root;
+    ts;
+    clients = new Map();
+    brokenUntil = new Map();
+    availability = new Map();
+    rootCache = new Map();
+    constructor(root) {
+        this.root = root;
+        this.ts = new TypeScriptSemanticIndex(root);
+    }
+    invalidate() {
+        this.ts.invalidate();
+    }
+    specForFile(file) {
+        const ext = path.extname(file).toLowerCase();
+        return SPECS.find((spec) => spec.extensions.includes(ext)) ?? null;
+    }
+    isTypeScriptLike(file) {
+        return !file || [".ts", ".tsx", ".js", ".jsx", ".mts", ".cts", ".mjs", ".cjs"].includes(path.extname(file).toLowerCase());
+    }
+    async installed(spec) {
+        const cached = this.availability.get(spec.id);
+        if (cached && Date.now() - cached.at < 30_000)
+            return cached.installed;
+        const installed = await commandExists(spec.command);
+        this.availability.set(spec.id, { at: Date.now(), installed });
+        return installed;
+    }
+    async rootForFile(relativePath, spec) {
+        const absolute = path.resolve(this.root, relativePath);
+        const cacheKey = `${spec.id}:${path.dirname(absolute)}`;
+        const cached = this.rootCache.get(cacheKey);
+        if (cached)
+            return cached;
+        const resolved = await resolveLspRoot(this.root, absolute, spec);
+        this.rootCache.set(cacheKey, resolved);
+        return resolved;
+    }
+    async clientFor(relativePath) {
+        const spec = this.specForFile(relativePath);
+        if (!spec || !(await this.installed(spec)))
+            return null;
+        const projectRoot = await this.rootForFile(relativePath, spec);
+        const key = `${spec.id}:${projectRoot}`;
+        if ((this.brokenUntil.get(key) ?? 0) > Date.now())
+            return null;
+        let client = this.clients.get(key);
+        if (!client) {
+            client = new LspClient(projectRoot, spec);
+            this.clients.set(key, client);
+        }
+        return { key, spec, client };
+    }
+    async withClient(relativePath, fn) {
+        const resolved = await this.clientFor(relativePath);
+        if (!resolved)
+            return null;
+        try {
+            return await fn(resolved.client, resolved.spec);
+        }
+        catch {
+            this.brokenUntil.set(resolved.key, Date.now() + 30_000);
+            this.clients.delete(resolved.key);
+            await resolved.client.stop().catch(() => undefined);
+            return null;
+        }
+    }
+    async info() {
+        const providers = await Promise.all(SPECS.map(async (spec) => ({
+            id: spec.id,
+            languages: spec.languages,
+            installed: await this.installed(spec),
+            activeRoots: [...this.clients.values()].filter((client) => client.spec.id === spec.id).map((client) => rel(this.root, client.root)),
+        })));
+        return {
+            typescript: this.ts.info(),
+            providers,
+            activeClients: [...this.clients.values()].map((client) => ({ ...client.status(), root: rel(this.root, client.root) })),
+            fallback: (await commandExists("rg")) ? "ripgrep" : "grep",
+            routing: "nearest-project-root/polyglot",
+        };
+    }
+    async identifierAt(relativePath, line, column) {
+        const absolute = path.resolve(this.root, relativePath);
+        const text = await fs.readFile(absolute, "utf8");
+        const lines = text.split(/\r?\n/);
+        const row = lines[Math.max(0, line - 1)] ?? "";
+        const index = Math.max(0, Math.min(row.length, column - 1));
+        const left = row.slice(0, index + 1).match(/[A-Za-z_$][\w$]*$/)?.[0] ?? "";
+        const right = row.slice(index + 1).match(/^[\w$]*/)?.[0] ?? "";
+        return `${left}${right}` || row.slice(index).match(/^[A-Za-z_$][\w$]*/)?.[0] || "";
+    }
+    async workspaceSymbols(query, limit = 200) {
+        const out = this.ts.workspaceSymbols(query, limit).map((item) => ({ ...item, provider: "typescript" }));
+        if (out.length >= limit)
+            return out.slice(0, limit);
+        for (const client of this.clients.values()) {
+            if (out.length >= limit)
+                break;
+            const result = await client.workspaceSymbols(query).catch(() => []);
+            for (const item of symbolLocations(this.root, result, client.spec.id)) {
+                if (!out.some((existing) => existing.path === item.path && existing.line === item.line && existing.name === item.name))
+                    out.push(item);
+                if (out.length >= limit)
+                    break;
+            }
+        }
+        if (query && out.length < limit) {
+            const fallback = await this.textSearch(query, limit - out.length, true);
+            for (const item of fallback)
+                if (!out.some((existing) => existing.path === item.path && existing.line === item.line))
+                    out.push(item);
+        }
+        return out.slice(0, limit);
+    }
+    async documentSymbols(relativePath, limit = 500) {
+        if (this.isTypeScriptLike(relativePath)) {
+            const ts = this.ts.workspaceSymbols("", 10_000).filter((item) => item.path === relativePath).slice(0, limit).map((item) => ({ ...item, provider: "typescript" }));
+            if (ts.length)
+                return ts;
+        }
+        const absolute = path.resolve(this.root, relativePath);
+        const result = await this.withClient(relativePath, (client) => client.documentSymbols(absolute));
+        if (result)
+            return symbolLocations(this.root, result, this.specForFile(relativePath)?.id ?? "lsp").slice(0, limit);
+        return this.textSearchInFile(relativePath, /\b(class|struct|interface|enum|trait|mixin|extension|def|fn|func|function|type|module)\s+([A-Za-z_$][\w$]*)/g, limit);
+    }
+    async definition(input) {
+        const limit = input.limit ?? 100;
+        if (input.path && input.line && input.column && !this.isTypeScriptLike(input.path)) {
+            const provider = this.specForFile(input.path)?.id ?? "lsp";
+            const value = await this.withClient(input.path, (client) => client.positionRequest("textDocument/definition", path.resolve(this.root, input.path), input.line, input.column));
+            const locations = value ? flattenLocations(this.root, value, provider) : [];
+            if (locations.length)
+                return locations.slice(0, limit);
+        }
+        const name = input.name || (input.path && input.line && input.column ? await this.identifierAt(input.path, input.line, input.column) : "");
+        if (!name)
+            return [];
+        if (!input.path || this.isTypeScriptLike(input.path)) {
+            const ts = this.ts.definitions(name, limit).map((item) => ({ ...item, provider: "typescript" }));
+            if (ts.length)
+                return ts;
+        }
+        return this.textSearch(name, limit, true);
+    }
+    async references(input) {
+        const limit = input.limit ?? 500;
+        if (input.path && input.line && input.column && !this.isTypeScriptLike(input.path)) {
+            const provider = this.specForFile(input.path)?.id ?? "lsp";
+            const value = await this.withClient(input.path, (client) => client.positionRequest("textDocument/references", path.resolve(this.root, input.path), input.line, input.column, { context: { includeDeclaration: true } }));
+            const locations = value ? flattenLocations(this.root, value, provider) : [];
+            if (locations.length)
+                return locations.slice(0, limit);
+        }
+        const name = input.name || (input.path && input.line && input.column ? await this.identifierAt(input.path, input.line, input.column) : "");
+        if (!name)
+            return [];
+        if (!input.path || this.isTypeScriptLike(input.path)) {
+            const ts = this.ts.references(name, limit).map((item) => ({ ...item, provider: "typescript" }));
+            if (ts.length)
+                return ts;
+        }
+        return this.textSearch(name, limit, false);
+    }
+    async implementations(input) {
+        const provider = this.specForFile(input.path)?.id ?? "lsp";
+        const value = await this.withClient(input.path, (client) => client.positionRequest("textDocument/implementation", path.resolve(this.root, input.path), input.line, input.column));
+        const locations = value ? flattenLocations(this.root, value, provider) : [];
+        if (locations.length)
+            return locations.slice(0, input.limit ?? 200);
+        return this.definition({ ...input, limit: input.limit });
+    }
+    async hover(input) {
+        const provider = this.specForFile(input.path)?.id;
+        if (provider) {
+            const value = await this.withClient(input.path, (client) => client.positionRequest("textDocument/hover", path.resolve(this.root, input.path), input.line, input.column));
+            if (value)
+                return { provider, result: value };
+        }
+        const name = await this.identifierAt(input.path, input.line, input.column);
+        return { provider: this.isTypeScriptLike(input.path) ? "typescript" : "text", name, definitions: await this.definition({ ...input, name, limit: 10 }) };
+    }
+    async diagnostics(relativePath, limit = 500) {
+        if (!relativePath)
+            return this.ts.diagnostics(limit).map((item) => ({ ...item, provider: "typescript" }));
+        if (this.isTypeScriptLike(relativePath)) {
+            const ts = this.ts.diagnostics(limit).filter((item) => !item.path || item.path === relativePath).map((item) => ({ ...item, provider: "typescript" }));
+            if (ts.length)
+                return ts;
+        }
+        const provider = this.specForFile(relativePath)?.id;
+        if (!provider)
+            return [];
+        const values = await this.withClient(relativePath, (client) => client.diagnostics(path.resolve(this.root, relativePath)));
+        if (!values)
+            return [];
+        return values.slice(0, limit).map((diagnostic) => ({
+            path: relativePath,
+            line: Number(diagnostic.range?.start?.line ?? 0) + 1,
+            column: Number(diagnostic.range?.start?.character ?? 0) + 1,
+            severity: diagnostic.severity,
+            code: diagnostic.code,
+            message: diagnostic.message,
+            provider,
+        }));
+    }
+    async incomingCalls(input) {
+        const provider = this.specForFile(input.path)?.id;
+        if (!provider)
+            return [];
+        const value = await this.withClient(input.path, (client) => client.callHierarchy(path.resolve(this.root, input.path), input.line, input.column, "incoming"));
+        return callHierarchyLocations(this.root, value ?? [], provider, "incoming").slice(0, input.limit ?? 200);
+    }
+    async outgoingCalls(input) {
+        const provider = this.specForFile(input.path)?.id;
+        if (!provider)
+            return [];
+        const value = await this.withClient(input.path, (client) => client.callHierarchy(path.resolve(this.root, input.path), input.line, input.column, "outgoing"));
+        return callHierarchyLocations(this.root, value ?? [], provider, "outgoing").slice(0, input.limit ?? 200);
+    }
+    callers(name, limit = 300) {
+        return this.ts.callers(name, limit).map((item) => ({ ...item, provider: "typescript" }));
+    }
+    callees(name, limit = 300) {
+        return this.ts.callees(name, limit).map((item) => ({ ...item, provider: "typescript" }));
+    }
+    importGraph(limit = 2000) {
+        return this.ts.importGraph(limit).map((item) => ({ ...item, provider: "typescript" }));
+    }
+    async textSearch(query, limit, definitionLike) {
+        if (!query)
+            return [];
+        const rg = await commandExists("rg");
+        const escaped = query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const pattern = definitionLike
+            ? `\\b(class|struct|interface|enum|trait|mixin|extension|def|fn|func|function|type|const|let|var|final)\\s+${escaped}\\b|\\b${escaped}\\s*[:=]`
+            : `\\b${escaped}\\b`;
+        const result = rg
+            ? await runCapture("rg", ["--line-number", "--column", "--no-heading", "--color", "never", "--hidden", "--glob", "!.git/**", "--glob", "!node_modules/**", pattern, "."], this.root).catch(() => null)
+            : null;
+        if (!result)
+            return [];
+        const out = [];
+        for (const line of result.stdout.split("\n")) {
+            const match = /^(.*?):(\d+):(\d+):/.exec(line);
+            if (!match)
+                continue;
+            const relative = match[1].replace(/^\.\//, "");
+            if (isSensitivePath(relative))
+                continue;
+            out.push({ path: relative, line: Number(match[2]), column: Number(match[3]), name: query, provider: "ripgrep" });
+            if (out.length >= limit)
+                break;
+        }
+        return out;
+    }
+    async textSearchInFile(relativePath, pattern, limit) {
+        const text = await fs.readFile(path.resolve(this.root, relativePath), "utf8");
+        const out = [];
+        for (const [index, line] of text.split(/\r?\n/).entries()) {
+            pattern.lastIndex = 0;
+            let match;
+            while ((match = pattern.exec(line))) {
+                out.push({ path: relativePath, line: index + 1, column: match.index + 1, name: match[2], provider: "text-structure" });
+                if (out.length >= limit)
+                    return out;
+                if (!pattern.global)
+                    break;
+            }
+        }
+        return out;
+    }
+    async shutdown() {
+        await Promise.all([...this.clients.values()].map((client) => client.stop().catch(() => undefined)));
+        this.clients.clear();
+    }
+}