robot-resources 1.15.0 → 1.15.2

package/lib/detect.js

@@ -137,7 +137,10 @@ export function isCursorInstalled() {
 // means a generic project (e.g. just package.json, no LLM SDK deps yet) —
 // still picks the language but with low confidence.
 
-const NODE_AGENT_DEPS = [
+// Exported (Phase 11.1) so the SDK-import scanner in source-edit-attach.js
+// can reuse the same canonical list — single source of truth for "which npm
+// packages count as an AI SDK signal."
+export const NODE_AGENT_DEPS = [
   '@anthropic-ai/sdk',
   'openai',
   '@google/generative-ai',

package/lib/non-oc-wizard.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { select } from '@inquirer/prompts';
+import { extname, isAbsolute, join, resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { select, input } from '@inquirer/prompts';
 import { isClaudeCodeInstalled, isCursorInstalled, detectAgentRuntime } from './detect.js';
 import { configureClaudeCode, configureCursor } from './tool-config.js';
 import { header, info, success, warn, blank, confirm } from './ui.js';
@@ -8,7 +9,7 @@ import { readConfig } from './config.mjs';
 import { installNodeShim } from './install-node-shim.js';
 import { installPythonShim } from './install-python-shim.js';
 import {
-  detectEntryFile,
+  findAgentSourceFile,
   hasSourceMarker,
   writeSourceMarker,
   previewInjection,
@@ -118,75 +119,188 @@ async function emitNodeEntryPatched(payload) {
   }
 }
 
+const VALID_SOURCE_EXTS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx']);
+
+/**
+ * Expand `~` to $HOME. Same trick shells use. Anything else (env vars,
+ * `..` segments) we leave to `path.resolve` to handle.
+ */
+function expandPath(raw, cwd) {
+  let p = raw.trim();
+  if (p === '~') p = homedir();
+  else if (p.startsWith('~/') || p.startsWith('~\\')) p = join(homedir(), p.slice(2));
+  if (!isAbsolute(p)) p = resolve(cwd, p);
+  return p;
+}
+
 /**
- * Phase 11 — offer to inject `require('@robot-resources/router/auto')`
- * (or ESM equivalent) at the top of the user's entry file.
+ * Phase 11 + 11.1 — offer to inject `require('@robot-resources/router/auto')`
+ * (or ESM equivalent) at the top of the user's entry file. Phase 11 wrote
+ * the plumbing; Phase 11.1 swaps the package.json-gated detector for an
+ * SDK-import scanner that finds files actually talking to AI models.
  *
- * Why this is here: NODE_OPTIONS in shell config never reaches cron /
- * Docker / systemd / Lambda agents because those launchers don't read
- * shell rc files. A line in the source survives any launcher.
+ * Why source-edit at all: NODE_OPTIONS in shell config never reaches cron /
+ * Docker / systemd / Lambda agents because those launchers don't read shell
+ * rc files. A line in the source survives any launcher.
  *
- * Gates:
- *   - No package.json or no detectable entry → skip with a hint
+ * Decision matrix (now driven by findAgentSourceFile):
+ *   - 0 SDK files found → free-text path prompt (interactive) or skip (CI)
+ *   - 1 candidate            → preview + Y/N (skip the chooser)
+ *   - 2+, clear winner      → preview winner + Y/N (skip the chooser)
+ *   - 2+, ambiguous          → select() chooser, then Y/N
  *   - Marker already present → skip silently
- *   - Non-interactive without `autoAttachSource` → skip with a hint;
- *     auto-rewriting source files in CI without consent is too aggressive
- *   - Y/N declined → skip silently, user can always re-run
+ *   - Non-interactive without `autoAttachSource` → skip with a hint
+ *
+ * Source files are sacred — every accept path goes through Y/N (or the
+ * explicit `--auto-attach-source` opt-in for CI).
  */
 async function maybeInjectSourceEdit({ nonInteractive, autoAttachSource, cwd = process.cwd() } = {}) {
-  const detection = detectEntryFile(cwd);
-  if (!detection.path) {
-    info('No agent entry file detected — skipping source-attach step.');
-    info('Re-run from your project root, or add this line yourself at the top of your entry file:');
-    info("  require('@robot-resources/router/auto');   // CJS");
-    info("  // or:  import '@robot-resources/router/auto';   // ESM/TS");
-    await emitNodeEntryPatched({ outcome: 'no_entry_detected' });
-    return;
+  const scan = findAgentSourceFile(cwd);
+  const baseTelemetry = {
+    candidates_scanned: scan.scanned,
+    total_files_walked: scan.walked,
+    winner_score: scan.candidates[0]?.score ?? null,
+    runner_up_score: scan.candidates[1]?.score ?? null,
+  };
+
+  // ── 0 candidates ───────────────────────────────────────────────────────
+  if (!scan.winner) {
+    if (nonInteractive) {
+      blank();
+      info(`We scanned ${scan.walked} source files and found no AI SDK imports.`);
+      info('Add this line manually at the top of your agent entry file:');
+      info("  require('@robot-resources/router/auto');   // CJS, or import '...' for ESM/TS");
+      await emitNodeEntryPatched({ ...baseTelemetry, outcome: 'no_sdk_imports_found' });
+      return;
+    }
+
+    // Interactive 0-candidate: ask the user to point us at the file.
+    blank();
+    info(`We scanned ${scan.walked} source files in this directory and found no AI SDK imports.`);
+    blank();
+    let raw;
+    try {
+      raw = await input({
+        message: 'Path to your agent file (or press Enter to skip):',
+        default: '',
+      });
+    } catch {
+      // Ctrl-C or terminal closed.
+      await emitNodeEntryPatched({ ...baseTelemetry, outcome: 'declined_path_prompt' });
+      return;
+    }
+    if (!raw || !raw.trim()) {
+      await emitNodeEntryPatched({ ...baseTelemetry, outcome: 'declined_path_prompt' });
+      return;
+    }
+
+    const target = expandPath(raw, cwd);
+    if (!existsSync(target)) {
+      warn(`File does not exist: ${target}`);
+      await emitNodeEntryPatched({ ...baseTelemetry, outcome: 'failed', error: 'path_missing' });
+      return;
+    }
+    if (!VALID_SOURCE_EXTS.has(extname(target).toLowerCase())) {
+      warn(`Refusing to edit ${extname(target)} — only .js/.mjs/.cjs/.ts/.tsx/.jsx are supported.`);
+      await emitNodeEntryPatched({ ...baseTelemetry, outcome: 'failed', error: 'invalid_extension' });
+      return;
+    }
+    if (hasSourceMarker(target)) {
+      info(`${pathForTelemetry(target, cwd)} already has the auto-attach line — leaving it as-is.`);
+      await emitNodeEntryPatched({ ...baseTelemetry, outcome: 'already_present', entry_path: pathForTelemetry(target, cwd) });
+      return;
+    }
+
+    // Outside-cwd: extra confirmation. The user meant a path relative to
+    // their project; if they typed something far away, double-check.
+    const isOutsideCwd = !target.startsWith(cwd + '/') && target !== cwd;
+    if (isOutsideCwd) {
+      const ok = await confirm(`${target} is outside your current directory. Edit it anyway?`, { defaultYes: false });
+      if (!ok) {
+        await emitNodeEntryPatched({ ...baseTelemetry, outcome: 'declined_path_prompt' });
+        return;
+      }
+    }
+
+    return await applyInjection({
+      target,
+      cwd,
+      nonInteractive,
+      autoAttachSource,
+      baseTelemetry,
+      viaPrompt: true,
+    });
   }
 
-  if (hasSourceMarker(detection.path)) {
-    info(`${pathForTelemetry(detection.path, cwd)} already has the auto-attach line — leaving it as-is.`);
+  // ── 1+ candidates ──────────────────────────────────────────────────────
+  const winnerPath = scan.winner;
+
+  if (hasSourceMarker(winnerPath)) {
+    info(`${pathForTelemetry(winnerPath, cwd)} already has the auto-attach line — leaving it as-is.`);
     await emitNodeEntryPatched({
+      ...baseTelemetry,
       outcome: 'already_present',
-      entry_path: pathForTelemetry(detection.path, cwd),
+      entry_path: pathForTelemetry(winnerPath, cwd),
     });
     return;
   }
 
-  // Non-interactive: skip unless explicit opt-in. Source files are sacred.
   if (nonInteractive && !autoAttachSource) {
     blank();
     info('Skipping source-attach in non-interactive mode (auto-rewriting source needs consent).');
     info(`To enable it in CI, re-run with:  npx robot-resources --for=langchain --auto-attach-source`);
-    info(`Or add this line manually at the top of ${pathForTelemetry(detection.path, cwd)}:`);
+    info(`Or add this line manually at the top of ${pathForTelemetry(winnerPath, cwd)}:`);
     info("  require('@robot-resources/router/auto');   // CJS, or import '...' for ESM/TS");
     await emitNodeEntryPatched({
+      ...baseTelemetry,
       outcome: 'skipped_non_interactive',
-      entry_path: pathForTelemetry(detection.path, cwd),
+      entry_path: pathForTelemetry(winnerPath, cwd),
     });
     return;
   }
 
-  // Multi-candidate ambiguity → ask which entry the user actually runs.
-  let target = detection.path;
-  if (!nonInteractive && detection.candidates.length > 1) {
-    const choices = detection.candidates.map((c) => ({
-      name: pathForTelemetry(c, cwd),
-      value: c,
+  // Resolve the actual target. Skip the chooser when winner is unambiguous —
+  // most users see exactly one Y/N.
+  let target = winnerPath;
+  if (!nonInteractive && scan.ambiguous && scan.candidates.length > 1) {
+    const choices = scan.candidates.slice(0, 6).map((c) => ({
+      name: `${pathForTelemetry(c.path, cwd)}  (score ${c.score})`,
+      value: c.path,
     }));
     choices.push({ name: 'Skip — I\'ll add the line manually', value: '__skip__' });
-    target = await select({
-      message: 'Multiple entry candidates found. Which file runs your agent?',
-      default: detection.path,
-      choices,
-    });
+    try {
+      target = await select({
+        message: 'Multiple files import an AI SDK. Which one is your agent?',
+        default: winnerPath,
+        choices,
+      });
+    } catch {
+      await emitNodeEntryPatched({ ...baseTelemetry, outcome: 'declined' });
+      return;
+    }
     if (target === '__skip__') {
-      await emitNodeEntryPatched({ outcome: 'declined_ambiguous_pick' });
+      await emitNodeEntryPatched({ ...baseTelemetry, outcome: 'declined' });
       return;
     }
   }
 
-  // Show the diff and ask Y/N (unless auto-attach is explicitly opt-in).
+  return await applyInjection({
+    target,
+    cwd,
+    nonInteractive,
+    autoAttachSource,
+    baseTelemetry,
+    viaPrompt: false,
+  });
+}
+
+/**
+ * Common write path used by both the "winner detected" and "user typed a
+ * path" branches. Shows the diff, asks Y/N (unless --auto-attach-source),
+ * writes the marker, emits telemetry. Single source of truth so the two
+ * branches can't drift.
+ */
+async function applyInjection({ target, cwd, nonInteractive, autoAttachSource, baseTelemetry, viaPrompt }) {
   const preview = previewInjection(target);
   blank();
   success('Add the auto-attach line so routing also works under cron / Docker / systemd / Lambda?');
@@ -204,6 +318,7 @@ async function maybeInjectSourceEdit({ nonInteractive, autoAttachSource, cwd = p
   if (!proceed) {
     info('Skipped — you can re-run anytime.');
     await emitNodeEntryPatched({
+      ...baseTelemetry,
       outcome: 'declined',
       entry_path: pathForTelemetry(target, cwd),
     });
@@ -216,7 +331,8 @@ async function maybeInjectSourceEdit({ nonInteractive, autoAttachSource, cwd = p
     if (result.backupWritten) info(`  Backup written to ${pathForTelemetry(`${target}.rr-backup`, cwd)}`);
     info('Now your agent loads the router on every startup — no env vars, no terminal restart.');
     await emitNodeEntryPatched({
-      outcome: 'patched',
+      ...baseTelemetry,
+      outcome: viaPrompt ? 'patched_via_prompt' : 'patched',
       entry_path: pathForTelemetry(target, cwd),
       import_syntax: result.syntax,
       backup_written: !!result.backupWritten,
@@ -225,6 +341,7 @@ async function maybeInjectSourceEdit({ nonInteractive, autoAttachSource, cwd = p
     warn(`Could not patch ${pathForTelemetry(target, cwd)}: ${result.error}`);
     info('You can add the line yourself — see the snippet above.');
     await emitNodeEntryPatched({
+      ...baseTelemetry,
       outcome: 'failed',
       entry_path: pathForTelemetry(target, cwd),
       error: result.error,

package/lib/source-edit-attach.js

@@ -1,5 +1,6 @@
-import { existsSync, readFileSync, writeFileSync, statSync, unlinkSync } from 'node:fs';
-import { dirname, extname, join, relative, resolve, sep } from 'node:path';
+import { existsSync, readFileSync, writeFileSync, statSync, unlinkSync, readdirSync, openSync, readSync, closeSync } from 'node:fs';
+import { basename, dirname, extname, join, relative, resolve, sep } from 'node:path';
+import { NODE_AGENT_DEPS } from './detect.js';
 
 /**
  * Source-edit injection for non-OC Node agents (Phase 11).
@@ -36,11 +37,6 @@ export const MARK_END = '// <<< robot-resources <<<';
 const REQUIRE_LINE = "require('@robot-resources/router/auto');";
 const IMPORT_LINE = "import '@robot-resources/router/auto';";
 
-// File extensions we'll treat as Node source — anything else, refuse to
-// edit. Keeps us out of build artifacts (.min.js), declaration files (.d.ts),
-// JSON, etc.
-const VALID_EXTS = new Set(['.js', '.cjs', '.mjs', '.ts', '.tsx', '.jsx']);
-
 /**
  * Decide which import syntax to inject for a given source file.
  * Implements Node's resolution rules verbatim:
@@ -75,90 +71,228 @@ export function detectImportSyntax(entryPath) {
   }
 }
 
+// Phase 11.1 — directories pruned during the recursive walk. Skipping these
+// is the difference between a 50ms walk and a 30s one. Hardcoded — chasing
+// `.gitignore` would add a transitive dep risk for marginal coverage gain
+// (real false-positive rate from these dirs is already ~0).
+const SKIP_DIRS = new Set([
+  'node_modules', 'dist', 'build', '.next', 'out', 'coverage',
+  '.git', 'venv', '.venv', '__pycache__', '.svelte-kit', 'target',
+]);
+
+// Walker bounds. 4KB read because imports are always hoisted to the top of
+// the file — anything below isn't an import, and reading more is waste on
+// network filesystems / WSL. Depth 2 catches `src/agent.ts`,
+// `apps/api/src/index.ts`. File cap 500 stops huge monorepos from blowing
+// the wizard's budget.
+const WALK_DEPTH_MAX = 2;
+const WALK_FILE_CAP = 500;
+const READ_BYTES = 4096;
+
+const SCAN_EXTS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx']);
+
+// Deliberately omits `index` — too generic to reliably signal "this is the
+// agent." A CLI tool's `cli.js` (matched via package.json `bin`) will lose
+// to a generic `index.js` if `index` is in this set, even though `bin` is
+// what the user actually runs. Names here are strong agent signals on
+// their own; `index` requires a complementary signal (`main`/`bin` match)
+// to be picked up.
+const ENTRY_NAME_PATTERN = /^(agent|bot|app|main|server|worker|handler)\./i;
+const TEST_FILENAME_PATTERN = /\.(test|spec)\./i;
+const TEST_PATH_FRAGMENT = /[\\/](?:test|tests|__tests__|spec|examples|scripts)[\\/]/i;
+
 /**
- * Locate the user's agent entry file under cwd. Staged fallback through
- * standard package.json fields, then a convention scan.
+ * Locate the user's agent source file under cwd by scanning for AI-SDK
+ * imports. Returns { winner, candidates, scanned, walked, ambiguous }.
  *
- * Returns { path, candidates }:
- *   - path: absolute path to the chosen entry, or null if nothing matched
- *   - candidates: every viable candidate found (used by the wizard to
- *     show a select() prompt when ambiguous)
+ * `winner` — absolute path of the highest-scoring file, or null if no file
+ *            in cwd imports any SDK from `NODE_AGENT_DEPS`.
+ * `candidates` — every file that scored > 0, sorted by score descending.
+ *            Each entry: { path, score, syntax, reasons: string[] }.
+ * `scanned` — count of files that imported any SDK (subset of `walked`).
+ * `walked` — total source files inspected (capped at WALK_FILE_CAP).
+ * `ambiguous` — true when winner's lead over runner-up is too narrow to
+ *            silently pick (`winner.score < runner_up.score + 2 &&
+ *            winner.score < runner_up.score * 1.5`). The wizard surfaces
+ *            a chooser only when this is true.
  *
- * Priority (first match wins for `path`, all viable hits go in `candidates`):
- *   1. package.json `bin` — single-string or single-key object → entry
- *   2. package.json `main`
- *   3. package.json `exports["."]` (or `exports["."].default`)
- *   4. parsed package.json `scripts.start` — regex against
- *      `(node|tsx|ts-node|bun) <file>`
- *   5. convention scan: src/index.{ts,js,mjs,cjs}, index.{ts,js,mjs,cjs},
- *      src/agent.{ts,js}, agent.{ts,js}, src/main.{ts,js}, main.{ts,js},
- *      src/app.{ts,js}, app.{ts,js}, src/bot.{ts,js}, bot.{ts,js}
+ * Why this replaces the package.json-gated detector: production data after
+ * the Phase 11 release showed 5 of 5 fresh real users (JP/US/RU) failing
+ * with `outcome: 'no_entry_detected'` because they ran the wizard from
+ * a server's home dir, with no `package.json` at cwd. Real Node agents
+ * commonly look like a single `agent.js` next to a `node_modules/` —
+ * `package.json` is a project-shape signal, not an agent signal. The
+ * actual ground truth for "this is an agent" is "this file imports an
+ * AI SDK." `package.json` here downgrades to a *ranking hint*, used to
+ * boost candidates whose path matches `bin` or `main`, but never to
+ * gate detection.
  */
-export function detectEntryFile(cwd = process.cwd()) {
-  const candidates = [];
-  const pkgPath = join(cwd, 'package.json');
-  let pkg = null;
-  if (existsSync(pkgPath)) {
-    try { pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')); } catch { /* malformed */ }
-  }
-
-  if (pkg) {
-    // Tier 1: bin
-    if (typeof pkg.bin === 'string') {
-      addCandidate(candidates, cwd, pkg.bin);
-    } else if (pkg.bin && typeof pkg.bin === 'object') {
-      for (const v of Object.values(pkg.bin)) {
-        if (typeof v === 'string') addCandidate(candidates, cwd, v);
+export function findAgentSourceFile(cwd = process.cwd()) {
+  let walked = 0;
+  const sdkFiles = [];
+
+  // Recursive walker with hard caps. Each recursion increments depth;
+  // depth 0 is cwd itself, depth 1 is direct children, etc.
+  const walk = (dir, depth) => {
+    if (walked >= WALK_FILE_CAP) return;
+    if (depth > WALK_DEPTH_MAX) return;
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      // Permission or read error — skip this directory silently.
+      return;
+    }
+    for (const entry of entries) {
+      if (walked >= WALK_FILE_CAP) return;
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS.has(entry.name) || entry.name.startsWith('.')) continue;
+        walk(join(dir, entry.name), depth + 1);
+      } else if (entry.isFile()) {
+        const ext = extname(entry.name).toLowerCase();
+        if (!SCAN_EXTS.has(ext)) continue;
+        walked++;
+        const abs = join(dir, entry.name);
+        const head = readHead(abs);
+        if (!head) continue;
+        const sdks = sdksFoundIn(head);
+        if (sdks.size > 0) {
+          sdkFiles.push({ path: abs, head, sdks, depth });
+        }
       }
     }
+  };
+
+  walk(cwd, 0);
+
+  // Score each candidate. The scoring system — finalised after a design
+  // review — is:
+  //   +5  imports any NODE_AGENT_DEPS SDK (boolean per file; multiple
+  //       imports from the same file don't pile points, so a wrapper file
+  //       with 6 re-exports doesn't outrank an actual agent file)
+  //   +1  also has a constructor call (`new Anthropic(...)`, etc.)
+  //   +4  filename matches /^(agent|bot|index|app|main|server|worker|handler)\./
+  //   +1  file lives at cwd root (depth 0)
+  //   -3  file is under /test/, /tests/, /__tests__/, /spec/, /examples/, /scripts/
+  //   -3  filename matches *.test.* or *.spec.*
+  //   +5  file matches package.json `bin` (when present — `bin` strictly dominates `main`)
+  //   +3  file matches package.json `main` (when present and ≠ `bin`)
+  const pkg = readPkg(cwd);
+  const binPath = pkg ? resolveBinPath(pkg, cwd) : null;
+  const mainPath = pkg ? resolveMainPath(pkg, cwd) : null;
+
+  const candidates = sdkFiles.map(({ path, head, sdks, depth }) => {
+    const reasons = [];
+    let score = 0;
+
+    score += 5; reasons.push(`+5 imports SDK (${[...sdks].join(',')})`);
+
+    if (hasConstructor(head)) { score += 1; reasons.push('+1 constructor call'); }
+
+    if (ENTRY_NAME_PATTERN.test(basename(path))) { score += 4; reasons.push('+4 entry-name match'); }
+
+    if (depth === 0) { score += 1; reasons.push('+1 cwd root'); }
+
+    if (TEST_PATH_FRAGMENT.test(path)) { score -= 3; reasons.push('-3 test/spec/examples path'); }
+    if (TEST_FILENAME_PATTERN.test(basename(path))) { score -= 3; reasons.push('-3 test/spec filename'); }
+
+    if (binPath && path === binPath) { score += 5; reasons.push('+5 package.json bin'); }
+    else if (mainPath && path === mainPath) { score += 3; reasons.push('+3 package.json main'); }
+
+    return {
+      path,
+      score,
+      syntax: detectImportSyntax(path),
+      reasons,
+    };
+  }).sort((a, b) => b.score - a.score);
+
+  const winner = candidates[0] ?? null;
+  const runnerUp = candidates[1] ?? null;
+
+  // "Clear winner" threshold: lead ≥ 2 absolute OR ≥ 1.5x runner-up.
+  // Either condition means we silently pick `winner`. Both close → ambiguous.
+  let ambiguous = false;
+  if (runnerUp) {
+    const leadOk = winner.score >= runnerUp.score + 2;
+    const ratioOk = winner.score >= runnerUp.score * 1.5;
+    ambiguous = !(leadOk || ratioOk);
+  }
 
-    // Tier 2: main
-    if (typeof pkg.main === 'string') addCandidate(candidates, cwd, pkg.main);
-
-    // Tier 3: exports["."]
-    const root = pkg.exports?.['.'] ?? pkg.exports;
-    if (typeof root === 'string') addCandidate(candidates, cwd, root);
-    else if (root && typeof root === 'object') {
-      const dflt = root.default ?? root.import ?? root.require;
-      if (typeof dflt === 'string') addCandidate(candidates, cwd, dflt);
-    }
+  return {
+    winner: winner?.path ?? null,
+    candidates,
+    scanned: sdkFiles.length,
+    walked,
+    ambiguous,
+  };
+}
 
-    // Tier 4: scripts.start parse
-    if (typeof pkg.scripts?.start === 'string') {
-      // Match `node ./foo.js`, `tsx src/agent.ts`, `bun run agent.ts` etc.
-      const m = pkg.scripts.start.match(/(?:node|tsx|ts-node|bun(?:\s+run)?)\s+(\S+)/);
-      if (m) addCandidate(candidates, cwd, m[1]);
-    }
+/**
+ * Read the head of a file (first READ_BYTES bytes). Imports are always
+ * hoisted to the top of a Node module — TypeScript and ESM both enforce
+ * import hoisting, and CJS users put requires at the top by convention.
+ * Reading more is waste on slow filesystems.
+ */
+function readHead(filePath) {
+  let fd;
+  try {
+    fd = openSync(filePath, 'r');
+    const buf = Buffer.alloc(READ_BYTES);
+    const bytes = readSync(fd, buf, 0, READ_BYTES, 0);
+    return buf.slice(0, bytes).toString('utf-8');
+  } catch {
+    return null;
+  } finally {
+    if (fd != null) { try { closeSync(fd); } catch { /* ignore */ } }
   }
+}
 
-  // Tier 5: convention scan — only adds if the candidate file actually exists.
-  const conventions = [
-    'src/index.ts', 'src/index.js', 'src/index.mjs', 'src/index.cjs',
-    'index.ts', 'index.js', 'index.mjs', 'index.cjs',
-    'src/agent.ts', 'src/agent.js', 'agent.ts', 'agent.js',
-    'src/main.ts', 'src/main.js', 'main.ts', 'main.js',
-    'src/app.ts', 'src/app.js', 'app.ts', 'app.js',
-    'src/bot.ts', 'src/bot.js', 'bot.ts', 'bot.js',
-  ];
-  for (const rel of conventions) {
-    const abs = join(cwd, rel);
-    if (existsSync(abs) && !candidates.includes(abs)) candidates.push(abs);
+/**
+ * Return the set of SDK package names found in `text`. Boolean per SDK —
+ * multiple `require('@anthropic-ai/sdk')` lines in the same file count
+ * once. Both CJS (`require('foo')`) and ESM (`from 'foo'`) shapes are
+ * checked; we don't care about quote style.
+ */
+function sdksFoundIn(text) {
+  const found = new Set();
+  for (const sdk of NODE_AGENT_DEPS) {
+    const escaped = sdk.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const requireRe = new RegExp(`require\\(\\s*['"]${escaped}['"]\\s*\\)`);
+    const importRe = new RegExp(`from\\s+['"]${escaped}['"]`);
+    if (requireRe.test(text) || importRe.test(text)) found.add(sdk);
   }
+  return found;
+}
 
-  // Filter to files that exist and have a valid extension. The package.json
-  // tiers might point at files that don't exist yet (e.g. a `main` of
-  // `dist/index.js` before the user has built). Don't try to inject into
-  // missing files.
-  const viable = candidates.filter((c) => existsSync(c) && VALID_EXTS.has(extname(c).toLowerCase()));
+function hasConstructor(text) {
+  // Cheap regex; over-matches `if (new Anthropic())` etc. — that's fine,
+  // they still count as evidence that this file talks to a model.
+  return /new\s+(Anthropic|OpenAI|GoogleGenerativeAI)\s*\(/.test(text);
+}
 
-  return { path: viable[0] ?? null, candidates: viable };
+function readPkg(cwd) {
+  const p = join(cwd, 'package.json');
+  if (!existsSync(p)) return null;
+  try { return JSON.parse(readFileSync(p, 'utf-8')); } catch { return null; }
+}
+
+function resolveBinPath(pkg, cwd) {
+  let raw = null;
+  if (typeof pkg.bin === 'string') raw = pkg.bin;
+  else if (pkg.bin && typeof pkg.bin === 'object') {
+    const vals = Object.values(pkg.bin).filter((v) => typeof v === 'string');
+    if (vals.length === 1) raw = vals[0];
+  }
+  if (!raw) return null;
+  const abs = join(cwd, raw.replace(/^\.\//, ''));
+  return existsSync(abs) ? abs : null;
 }
 
-function addCandidate(arr, cwd, rel) {
-  // Strip leading ./, normalize, resolve relative to cwd.
-  const cleaned = rel.replace(/^\.\//, '');
-  const abs = join(cwd, cleaned);
-  if (!arr.includes(abs)) arr.push(abs);
+function resolveMainPath(pkg, cwd) {
+  if (typeof pkg.main !== 'string') return null;
+  const abs = join(cwd, pkg.main.replace(/^\.\//, ''));
+  return existsSync(abs) ? abs : null;
 }
 
 /**

package/lib/uninstall.js

@@ -6,7 +6,7 @@ import { removeShellLine } from './shell-config.js';
 import { detectVenv } from './venv-detect.js';
 import { spawnSync } from 'node:child_process';
 import { removePersistedNodeOptions } from './windows-env.js';
-import { detectEntryFile, hasSourceMarker, removeSourceMarker } from './source-edit-attach.js';
+import { findAgentSourceFile, hasSourceMarker, removeSourceMarker } from './source-edit-attach.js';
 
 /**
  * Single source of truth for `npx robot-resources --uninstall`.
@@ -123,7 +123,11 @@ export function runUninstall({ purge = false } = {}) {
   //     not present. Runs against cwd, so users who --uninstall from a
   //     different repo won't accidentally wipe the wrong file.
   try {
-    const detection = detectEntryFile();
+    // Phase 11.1: detector renamed to findAgentSourceFile, returns
+    // { winner, candidates, ... }. Adapt to the same `path` field name
+    // so the rest of the block reads naturally.
+    const scan = findAgentSourceFile();
+    const detection = { path: scan.winner };
     if (detection.path && hasSourceMarker(detection.path)) {
       const r = removeSourceMarker(detection.path, { restoreFromBackup: !!purge });
       if (r.ok && (r.removed || r.restored)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "robot-resources",
-  "version": "1.15.0",
+  "version": "1.15.2",
   "description": "Robot Resources — AI agent tools. One command to install everything.",
   "type": "module",
   "bin": {