create-walle 0.9.13 → 0.9.15

package/template/wall-e/skills/skill-planner.js

@@ -6,6 +6,11 @@ const { validateSkillRequirements } = require('./skill-validator');
 const { decideSkillDispatch } = require('./skill-dispatch-decision');
 const { getCurrentSkillSnapshot } = require('./skill-snapshot');
 const { resolveInternalSkill } = require('./internal-skill-registry');
+const {
+  OWNER_ENV_KEY: SLACK_OWNER_ENV_KEY,
+  getSlackOwnerRepairState,
+  repairSlackOwnerIdentity,
+} = require('../tools/slack-owner');
 let telemetry;
 try { telemetry = require('../telemetry'); } catch { telemetry = { trackError() {}, track() {} }; }
 
@@ -59,7 +64,11 @@ function getServiceAlerts({ includeVersionUpdate = false } = {}) {
           if (update.latest && update.current && update.latest !== update.current) {
             alerts.push({
               id: 'version_update', service: 'system', type: 'update_available',
-              message: `Wall-E ${update.latest} is available (you have ${update.current}). Run: npx create-walle@latest`,
+              message: `CTM / Wall-E ${update.latest} is available (you have ${update.current}).`,
+              action: 'show_update_wizard',
+              action_label: 'Upgrade',
+              current: update.current,
+              latest: update.latest,
               created_at: update.checked_at,
             });
           }
@@ -95,10 +104,63 @@ function dismissServiceAlert(alertId) {
 }
 
 function clearServiceAlerts(service) {
-  const alerts = getServiceAlerts().filter(a => a.service !== service);
+  const alerts = getServiceAlerts().filter((a) => {
+    if (service === 'slack') return !(a.service === 'slack' || (typeof a.service === 'string' && a.service.startsWith('slack-')));
+    return a.service !== service;
+  });
   brain.setKv('service_alerts', JSON.stringify(alerts));
 }
 
+function clearResolvedSlackHealthAlerts({ authenticated = false, ownerConfigured = false } = {}) {
+  if (!authenticated) return { cleared: 0 };
+  const before = getServiceAlerts();
+  const after = before.filter((a) => {
+    const service = String(a.service || '');
+    const type = String(a.type || '');
+    const message = String(a.message || '');
+    const slackFamily = service === 'slack' || service.startsWith('slack-');
+    if (!slackFamily) return true;
+    if (type === 'auth_expired') return false;
+    if (ownerConfigured && type === 'owner_identity_missing') return false;
+    // `slack-sync` was an older Slack path. A disabled legacy alert should not
+    // keep current Slack MCP/OAuth status red once slack-mentions is healthy.
+    if (type === 'skill_disabled' && /\bslack-sync\b/.test(message + ' ' + service)) return false;
+    return true;
+  });
+  if (after.length !== before.length) {
+    brain.setKv('service_alerts', JSON.stringify(after));
+  }
+  return { cleared: before.length - after.length };
+}
+
+function _hasMissingSlackOwner(validation) {
+  return !!(validation && Array.isArray(validation.missing)
+    && validation.missing.some(m => m.type === 'env' && m.name === SLACK_OWNER_ENV_KEY));
+}
+
+function _addSlackOwnerIdentityAlert() {
+  const state = getSlackOwnerRepairState();
+  if (state.canRepair) {
+    addServiceAlert({
+      service: 'slack',
+      type: 'owner_identity_missing',
+      message: 'Slack sync needs to know which Slack user is you. Wall-E can fix this from your existing Slack connection.',
+      action_label: 'Fix automatically',
+      action: 'repair_slack_owner',
+      action_endpoint: '/api/wall-e/slack/repair-owner',
+    });
+    return;
+  }
+
+  addServiceAlert({
+    service: 'slack',
+    type: 'owner_identity_missing',
+    message: 'Slack sync needs to know which Slack user is you. Connect Slack so Wall-E can configure this automatically.',
+    action_label: 'Connect Slack',
+    action_url: '/setup.html#slack',
+  });
+}
+
 /**
  * One-time migration: alerts fired before the attemptAuthRecovery fix used
  * the skill name as the service (e.g. service='slack-mentions') which meant
@@ -307,8 +369,21 @@ async function runDueSkills(opts = {}) {
         const hasRequires = loaderSkill && loaderSkill.requires &&
           (loaderSkill.requires.bins || loaderSkill.requires.env || loaderSkill.requires.mcp);
         if (hasRequires) {
-          const validation = validateSkillRequirements(loaderSkill);
+          let validation = validateSkillRequirements(loaderSkill);
+          if (!validation.valid && _hasMissingSlackOwner(validation)) {
+            const repaired = repairSlackOwnerIdentity({ persist: true });
+            if (repaired.ok) {
+              console.log(`[skill-planner] Repaired ${SLACK_OWNER_ENV_KEY} from Slack OAuth token for "${skill.name}"`);
+              clearServiceAlerts('slack');
+              validation = validateSkillRequirements(loaderSkill);
+            }
+          }
           if (!validation.valid) {
+            if (_hasMissingSlackOwner(validation)) {
+              console.log(`[skill-planner] Preflight failed for "${skill.name}": Slack owner identity missing`);
+              _addSlackOwnerIdentityAlert();
+              continue;
+            }
             const items = validation.missing
               .map(m => `${m.type}=${m.name}`)
               .join(', ');
@@ -506,4 +581,11 @@ async function runDueSkills(opts = {}) {
 
 // `isSkillDue` was inlined into `decideSkillDispatch` (Item C).
 
-module.exports = { runDueSkills, getServiceAlerts, addServiceAlert, dismissServiceAlert, clearServiceAlerts };
+module.exports = {
+  runDueSkills,
+  getServiceAlerts,
+  addServiceAlert,
+  dismissServiceAlert,
+  clearServiceAlerts,
+  clearResolvedSlackHealthAlerts,
+};

package/template/wall-e/slack/socket-mode-listener.js

@@ -0,0 +1,276 @@
+'use strict';
+
+const DEFAULT_RECONNECT_MS = 5000;
+const MAX_RECONNECT_MS = 60000;
+
+function getAppToken(env = process.env) {
+  return env.WALLE_SLACK_APP_TOKEN || env.SLACK_APP_TOKEN || env.SLACK_SOCKET_MODE_APP_TOKEN || '';
+}
+
+function socketModeDisabled(env = process.env) {
+  const value = String(env.WALLE_SLACK_SOCKET_MODE || env.SLACK_SOCKET_MODE || '').toLowerCase();
+  return value === '0' || value === 'false' || value === 'off';
+}
+
+function isConfigured(env = process.env) {
+  const token = getAppToken(env);
+  return !socketModeDisabled(env) && /^xapp-/.test(token);
+}
+
+function resolveWebSocketCtor() {
+  if (typeof WebSocket === 'function') return WebSocket;
+  try { return require('ws'); } catch {}
+  return null;
+}
+
+function extractSlackEvent(envelope) {
+  if (!envelope || envelope.type !== 'events_api') return null;
+  const payload = envelope.payload || {};
+  if (payload.type !== 'event_callback') return null;
+  return payload.event || null;
+}
+
+function isRealtimeMessageEvent(event) {
+  if (!event || !event.type) return false;
+  if (event.bot_id || event.subtype) return false;
+  if (event.type === 'app_mention') return true;
+  if (event.type !== 'message') return false;
+  return event.channel_type === 'im' || event.channel_type === 'mpim';
+}
+
+class SlackSocketModeListener {
+  constructor(opts = {}) {
+    this.env = opts.env || process.env;
+    this.fetchImpl = opts.fetch || global.fetch;
+    this.WebSocketCtor = opts.WebSocketCtor || resolveWebSocketCtor();
+    this.handleEvent = opts.handleEvent || defaultHandleEvent;
+    this.logger = opts.logger || console;
+    this.reconnectBaseMs = opts.reconnectBaseMs || DEFAULT_RECONNECT_MS;
+    this.maxReconnectMs = opts.maxReconnectMs || MAX_RECONNECT_MS;
+    this.started = false;
+    this.running = false;
+    this.ws = null;
+    this.reconnectTimer = null;
+    this.reconnectAttempts = 0;
+    this.lastConnectedAt = null;
+    this.lastEventAt = null;
+    this.lastError = null;
+    this._seenEventIds = new Map();
+  }
+
+  get configured() {
+    return isConfigured(this.env);
+  }
+
+  getStatus() {
+    return {
+      configured: this.configured,
+      enabled: !socketModeDisabled(this.env),
+      running: this.running,
+      started: this.started,
+      last_connected_at: this.lastConnectedAt,
+      last_event_at: this.lastEventAt,
+      last_error: this.lastError,
+      reconnect_attempts: this.reconnectAttempts,
+    };
+  }
+
+  start() {
+    if (this.started) return this.getStatus();
+    this.started = true;
+    if (!this.configured) {
+      this.logger.log?.('[slack-socket] Not configured; set WALLE_SLACK_APP_TOKEN or SLACK_APP_TOKEN to enable Socket Mode');
+      return this.getStatus();
+    }
+    if (!this.WebSocketCtor) {
+      this.lastError = 'No WebSocket implementation available';
+      this.logger.warn?.('[slack-socket] No WebSocket implementation available');
+      return this.getStatus();
+    }
+    this._connect().catch((err) => {
+      this._recordError(err);
+      this._scheduleReconnect();
+    });
+    return this.getStatus();
+  }
+
+  stop() {
+    this.started = false;
+    this.running = false;
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    if (this.ws) {
+      try { this.ws.close(); } catch {}
+      this.ws = null;
+    }
+  }
+
+  async _connect() {
+    if (!this.started || !this.configured) return;
+    const appToken = getAppToken(this.env);
+    if (!this.fetchImpl) throw new Error('fetch is not available');
+
+    const resp = await this.fetchImpl('https://slack.com/api/apps.connections.open', {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${appToken}`,
+        'Content-Type': 'application/x-www-form-urlencoded',
+      },
+    });
+    const data = await resp.json();
+    if (!data.ok || !data.url) {
+      throw new Error(`apps.connections.open failed: ${data.error || resp.status}`);
+    }
+
+    const ws = new this.WebSocketCtor(data.url);
+    this.ws = ws;
+    this._bindSocket(ws);
+  }
+
+  _bindSocket(ws) {
+    const onOpen = () => {
+      this.running = true;
+      this.reconnectAttempts = 0;
+      this.lastConnectedAt = new Date().toISOString();
+      this.lastError = null;
+      this.logger.log?.('[slack-socket] Connected');
+    };
+    const onMessage = (eventOrData) => {
+      const data = eventOrData && Object.prototype.hasOwnProperty.call(eventOrData, 'data')
+        ? eventOrData.data
+        : eventOrData;
+      this._handleMessage(data).catch((err) => this._recordError(err));
+    };
+    const onError = (err) => this._recordError(err);
+    const onClose = () => {
+      this.running = false;
+      if (this.ws === ws) this.ws = null;
+      if (this.started) this._scheduleReconnect();
+    };
+
+    if (typeof ws.on === 'function') {
+      ws.on('open', onOpen);
+      ws.on('message', onMessage);
+      ws.on('error', onError);
+      ws.on('close', onClose);
+    } else {
+      ws.onopen = onOpen;
+      ws.onmessage = onMessage;
+      ws.onerror = onError;
+      ws.onclose = onClose;
+    }
+  }
+
+  async _handleMessage(data) {
+    const text = Buffer.isBuffer(data)
+      ? data.toString('utf8')
+      : (data instanceof ArrayBuffer)
+        ? Buffer.from(data).toString('utf8')
+        : ArrayBuffer.isView(data)
+          ? Buffer.from(data.buffer, data.byteOffset, data.byteLength).toString('utf8')
+          : String(data || '');
+    if (!text) return;
+    let envelope;
+    try {
+      envelope = JSON.parse(text);
+    } catch {
+      return;
+    }
+
+    if (envelope.envelope_id) this._ack(envelope.envelope_id);
+    if (envelope.type === 'hello') return;
+    if (envelope.type === 'disconnect') {
+      this.lastError = envelope.reason || 'Slack requested disconnect';
+      this._scheduleReconnect();
+      return;
+    }
+
+    const event = extractSlackEvent(envelope);
+    if (!isRealtimeMessageEvent(event)) return;
+    if (this._seenRecently(envelope.payload?.event_id || event.event_ts || event.ts)) return;
+
+    this.lastEventAt = new Date().toISOString();
+    await this.handleEvent(event, { envelope });
+  }
+
+  _ack(envelopeId) {
+    if (!this.ws || typeof this.ws.send !== 'function') return;
+    try {
+      this.ws.send(JSON.stringify({ envelope_id: envelopeId }));
+    } catch (err) {
+      this._recordError(err);
+    }
+  }
+
+  _seenRecently(id) {
+    if (!id) return false;
+    const now = Date.now();
+    for (const [key, ts] of this._seenEventIds) {
+      if (now - ts > 10 * 60_000) this._seenEventIds.delete(key);
+    }
+    if (this._seenEventIds.has(id)) return true;
+    this._seenEventIds.set(id, now);
+    return false;
+  }
+
+  _recordError(err) {
+    const msg = err && err.message ? err.message : String(err || 'unknown error');
+    this.lastError = msg.slice(0, 300);
+    this.logger.warn?.(`[slack-socket] ${this.lastError}`);
+  }
+
+  _scheduleReconnect() {
+    if (!this.started || this.reconnectTimer) return;
+    this.running = false;
+    this.reconnectAttempts += 1;
+    const delay = Math.min(this.reconnectBaseMs * Math.pow(2, Math.max(0, this.reconnectAttempts - 1)), this.maxReconnectMs);
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = null;
+      this._connect().catch((err) => {
+        this._recordError(err);
+        this._scheduleReconnect();
+      });
+    }, delay);
+    if (typeof this.reconnectTimer.unref === 'function') this.reconnectTimer.unref();
+  }
+}
+
+async function defaultHandleEvent(event) {
+  const slackMentions = require('../skills/_bundled/slack-mentions/run');
+  return slackMentions.processIncomingSlackEvent(event);
+}
+
+let singleton = null;
+
+function startSlackSocketModeListener(opts = {}) {
+  if (singleton) return singleton;
+  singleton = new SlackSocketModeListener(opts);
+  singleton.start();
+  return singleton;
+}
+
+function getSlackSocketModeStatus() {
+  if (singleton) return singleton.getStatus();
+  return {
+    configured: isConfigured(process.env),
+    enabled: !socketModeDisabled(process.env),
+    running: false,
+    started: false,
+    last_connected_at: null,
+    last_event_at: null,
+    last_error: null,
+    reconnect_attempts: 0,
+  };
+}
+
+module.exports = {
+  SlackSocketModeListener,
+  startSlackSocketModeListener,
+  getSlackSocketModeStatus,
+  getAppToken,
+  isConfigured,
+  extractSlackEvent,
+  isRealtimeMessageEvent,
+};

package/template/wall-e/telemetry.js

@@ -9,6 +9,8 @@ const FLUSH_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
 const MAX_BATCH_SIZE = 100;
 const DATA_DIR = process.env.WALL_E_DATA_DIR || path.join(process.env.HOME || '/tmp', '.walle', 'data');
 const INSTALL_ID_PATH = path.join(DATA_DIR, '.install-id');
+const CLI_LIFECYCLE_PATH = path.join(DATA_DIR, '.cli-lifecycle.jsonl');
+const MACHINE_ID_PATH = process.env.WALL_E_MACHINE_ID_PATH || path.join(path.dirname(DATA_DIR), '.machine-id');
 
 // --- Opt-out ---
 function isDisabled() {
@@ -33,6 +35,27 @@ function getInstallId() {
   return _installId;
 }
 
+// --- Machine bucket (anonymous, stable across reinstall churn) ---
+let _machineBucket = null;
+function getMachineBucket() {
+  if (_machineBucket) return _machineBucket;
+  let machineId = '';
+  try {
+    if (fs.existsSync(MACHINE_ID_PATH)) {
+      machineId = fs.readFileSync(MACHINE_ID_PATH, 'utf8').trim();
+    }
+    if (!machineId) {
+      machineId = crypto.randomUUID();
+      fs.mkdirSync(path.dirname(MACHINE_ID_PATH), { recursive: true });
+      fs.writeFileSync(MACHINE_ID_PATH, machineId, { encoding: 'utf8', mode: 0o600 });
+    }
+  } catch {
+    machineId = getInstallId();
+  }
+  _machineBucket = crypto.createHash('sha256').update(machineId).digest('hex').slice(0, 16);
+  return _machineBucket;
+}
+
 // --- Local JSONL log (survives crashes, unlike the in-memory buffer) ---
 const LOCAL_LOG_DIR = path.join(process.env.HOME || '/tmp', '.walle', 'logs');
 const LOCAL_LOG_PATH = path.join(LOCAL_LOG_DIR, 'telemetry.jsonl');
@@ -74,6 +97,7 @@ async function flush() {
   const version = getVersion();
   const payload = {
     id: getInstallId(),
+    machine: getMachineBucket(),
     v: version,
     os: process.platform,
     node: process.version,
@@ -102,7 +126,18 @@ async function flush() {
 
 // --- First-run funnel tracking ---
 const FUNNEL_PATH = path.join(DATA_DIR, '.telemetry-funnel.json');
-const FUNNEL_STEPS = ['install', 'boot', 'first_ingest', 'first_chat', 'first_skill'];
+const FUNNEL_STEPS = [
+  'install',
+  'boot',
+  'first_ingest',
+  'first_chat',
+  'first_skill',
+  'upgrade_available',
+  'upgrade_prompt_shown',
+  'upgrade_prompt_dismissed',
+  'upgrade_prompt_command_copied',
+  'upgrade_completed',
+];
 
 function trackFunnelStep(step) {
   if (isDisabled()) return;
@@ -133,10 +168,43 @@ function getVersion() {
   return _version;
 }
 
+function drainCliLifecycleEvents() {
+  if (isDisabled()) return;
+  let lines = [];
+  try {
+    if (!fs.existsSync(CLI_LIFECYCLE_PATH)) return;
+    lines = fs.readFileSync(CLI_LIFECYCLE_PATH, 'utf8')
+      .split(/\r?\n/)
+      .filter(Boolean)
+      .slice(-100);
+    fs.unlinkSync(CLI_LIFECYCLE_PATH);
+  } catch {
+    return;
+  }
+  const allowed = new Set([
+    'cli_install_started',
+    'cli_install_completed',
+    'cli_update_started',
+    'cli_update_completed',
+  ]);
+  for (const line of lines) {
+    try {
+      const entry = JSON.parse(line);
+      if (!entry || !allowed.has(entry.event)) continue;
+      const meta = entry.meta && typeof entry.meta === 'object' ? entry.meta : {};
+      track(entry.event, {
+        ...meta,
+        age_seconds: entry.t ? Math.max(0, Math.round((Date.now() - entry.t) / 1000)) : undefined,
+      });
+    } catch {}
+  }
+}
+
 // --- Lifecycle ---
 function start() {
   if (isDisabled()) return;
   if (flushTimer) return;
+  drainCliLifecycleEvents();
   track('startup', {
     uptime: process.uptime(),
   });
@@ -207,4 +275,4 @@ function trackCompatUsage(features) {
   track('compat_usage', features);
 }
 
-module.exports = { track, trackError, flush, start, stop, isDisabled, getInstallId, getVersion, printNoticeIfFirstRun, trackFunnelStep, trackCompatUsage };
+module.exports = { track, trackError, flush, start, stop, isDisabled, getInstallId, getMachineBucket, getVersion, printNoticeIfFirstRun, trackFunnelStep, trackCompatUsage, drainCliLifecycleEvents };

package/template/wall-e/tools/builtin-middleware.js

@@ -32,8 +32,32 @@ function registerBuiltinMiddleware(mw, opts = {}) {
     if (!ctx.params) ctx.params = {};
     // Deterministic output for coding
     ctx.params.temperature = 0;
-    // Cap tokens for small models
-    if (ctx.provider === 'ollama' || opts.provider === 'ollama') {
+    const provider = ctx.provider || opts.provider;
+    const model = String(ctx.model || opts.model || '');
+    const isOllama = provider === 'ollama';
+    const isGemma4 = isOllama && /^gemma4:/i.test(model);
+    if (isGemma4) {
+      const benchmarkMode = Boolean(opts.benchmark || ctx.benchmark);
+      const noToolsTurn = ctx.toolsAvailable === false;
+      // Gemma4's Ollama thinking trace shares the output budget with final
+      // content. Small coding budgets can be consumed entirely by reasoning.
+      const floor = /26b/i.test(model) ? 6144 : 8192;
+      if (benchmarkMode && noToolsTurn) {
+        ctx.params.maxTokens = Math.min(ctx.params.maxTokens || 1024, 1024);
+      } else {
+        ctx.params.maxTokens = Math.max(ctx.params.maxTokens || 4096, floor);
+      }
+      // Keep structured tool-call turns direct. Thinking traces improve
+      // no-tool planning/wrap-up turns but can crowd out or destabilize JSON
+      // function-call arguments during active edit/test loops.
+      if (ctx.params.thinking == null) ctx.params.thinking = noToolsTurn && !benchmarkMode;
+      ctx.params.options = {
+        ...(ctx.params.options || {}),
+        num_ctx: Math.max(ctx.params.options?.num_ctx || 0, 16384),
+      };
+    } else if (isOllama) {
+      // Cap generic local models; many smaller tags degrade if asked for huge
+      // coding turns. Gemma4 is handled separately above.
       ctx.params.maxTokens = Math.min(ctx.params.maxTokens || 4096, 2048);
     }
   });
@@ -72,6 +96,18 @@ Do not make any edits. Review the diff and assess quality.`);
 - minimize output tokens. Use tools, not words.
 - Never introduce code that exposes, logs, or commits secrets.`);
 
+    const provider = ctx.provider || opts.provider;
+    const model = String(ctx.model || opts.model || '');
+    if (provider === 'ollama' && /^gemma4:/i.test(model)) {
+      sections.push(`## Gemma4 Coding Guardrails
+- Before each edit, silently identify the smallest complete syntactic unit you are changing.
+- Insert new sibling code between complete blocks. Do not replace a function, route, class, or object entry header with unrelated code.
+- If the task says add, preserve existing behavior. For route/handler additions, keep every existing route/handler block and insert the new one as a sibling.
+- For edit_file, use an old_string that includes enough surrounding context to be unique and preserves neighboring declarations.
+- Do not run long-lived servers in the foreground with run_shell. Prefer the project test command; if a server must be started, use a bounded/background command.
+- After one failed or timed-out verification command, read the error/output and inspect the edited code before running the same command again.`);
+    }
+
     // Tool workflow patterns (loaded once at startup)
     if (workflowDocs) sections.push(workflowDocs);
 
@@ -137,7 +173,18 @@ Do not make any edits. Review the diff and assess quality.`);
   let portsBefore = null;
   mw.use('tool.before', async (ctx, toolName, input) => {
     if (toolName !== 'run_shell') return input;
+    const provider = ctx.provider || opts.provider;
+    const model = String(ctx.model || opts.model || '');
     const { isLikelyServerCommand, getListeningPorts } = require('./port-detector');
+    if (opts.benchmark && provider === 'ollama' && /^gemma4:/i.test(model) &&
+        isLikelyServerCommand(input.command) && !isBoundedServerCommand(input.command)) {
+      portsBefore = null;
+      return {
+        ...input,
+        command: 'node -e "console.error(\'Blocked foreground server command in benchmark; run npm test or use a bounded/background server command instead.\'); process.exit(1)"',
+        timeout_ms: Math.min(input.timeout_ms || 5000, 5000),
+      };
+    }
     if (isLikelyServerCommand(input.command)) {
       portsBefore = getListeningPorts();
     } else {
@@ -164,4 +211,10 @@ Do not make any edits. Review the diff and assess quality.`);
   });
 }
 
+function isBoundedServerCommand(command = '') {
+  const text = String(command || '');
+  return /(?:^|[;&|]\s*)(?:timeout|gtimeout)\s+\d+/i.test(text) ||
+    /(?:&\s*$|\bnohup\b|\bsetsid\b)/i.test(text);
+}
+
 module.exports = { registerBuiltinMiddleware };

package/template/wall-e/tools/shell-policy.js

@@ -17,7 +17,7 @@ const SHELL_ALLOWLIST = new Set([
   // Network
   'curl', 'wget', 'ping', 'dig', 'host', 'nslookup',
   // Dev tools
-  'git', 'node', 'npm', 'npx', 'python3', 'pip3', 'bun', 'deno',
+  'git', 'node', 'npm', 'npx', 'python', 'python3', 'pip', 'pip3', 'pytest', 'bun', 'deno',
   'make', 'cargo', 'go', 'ruby', 'perl', 'tsc',
   // Cloud / infra
   'fly', 'docker', 'kubectl',