重构主控编排与运行时预热链路，统一工作区提示词/专家调度协议并补齐 wiki 记忆注入与写回闭环。

同时收敛启动与运维脚本默认行为（含 wiki worker）、更新 Admin 可观测性与相关测试，降低首轮时延并提高运行稳定性。

Made-with: Cursor

openclaw/scripts/pre-commit/filter-staged-files.mjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+import path from "node:path";
+
+/**
+ * Prints selected files as NUL-delimited tokens to stdout.
+ *
+ * Usage:
+ *   node scripts/pre-commit/filter-staged-files.mjs lint -- <files...>
+ *   node scripts/pre-commit/filter-staged-files.mjs format -- <files...>
+ *
+ * Keep this dependency-free: the pre-commit hook runs in many environments.
+ */
+
+const mode = process.argv[2];
+const rawArgs = process.argv.slice(3);
+const files = rawArgs[0] === "--" ? rawArgs.slice(1) : rawArgs;
+
+if (mode !== "lint" && mode !== "format") {
+  process.stderr.write("usage: filter-staged-files.mjs <lint|format> -- <files...>\n");
+  process.exit(2);
+}
+
+const lintExts = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
+const formatExts = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".json", ".md", ".mdx"]);
+const formatIgnoredPaths = new Set(["src/canvas-host/a2ui/a2ui.bundle.js"]);
+
+const shouldSelect = (filePath) => {
+  const ext = path.extname(filePath).toLowerCase();
+  if (mode === "lint") {
+    return lintExts.has(ext);
+  }
+  if (formatIgnoredPaths.has(filePath)) {
+    return false;
+  }
+  return formatExts.has(ext);
+};
+
+for (const file of files) {
+  if (shouldSelect(file)) {
+    process.stdout.write(file);
+    process.stdout.write("\0");
+  }
+}

openclaw/scripts/pre-commit/pnpm-audit-prod.mjs

@@ -0,0 +1,740 @@
+#!/usr/bin/env node
+
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+import { pathToFileURL } from "node:url";
+
+const DEFAULT_REGISTRY = "https://registry.npmjs.org";
+const BULK_ADVISORY_PATH = "/-/npm/v1/security/advisories/bulk";
+const MIN_SEVERITY = "high";
+const SEVERITY_RANK = {
+  info: 0,
+  low: 1,
+  moderate: 2,
+  high: 3,
+  critical: 4,
+};
+const TOP_LEVEL_INDENT = 0;
+const SECTION_ENTRY_INDENT = 2;
+const NESTED_SECTION_INDENT = 4;
+const MAPPING_ENTRY_INDENT = 6;
+const NESTED_MAPPING_ENTRY_INDENT = 8;
+const SNAPSHOT_SECTIONS = ["dependencies", "optionalDependencies"];
+const IMPORTER_SECTIONS = ["dependencies", "optionalDependencies"];
+const LOCAL_REFERENCE_PREFIXES = ["file:", "link:", "portal:", "workspace:"];
+
+export function normalizeAuditLevel(level) {
+  const normalized = String(level ?? "").toLowerCase();
+  if (normalized in SEVERITY_RANK) {
+    return normalized;
+  }
+  throw new Error(
+    `Unsupported audit level "${String(level)}". Expected one of: ${Object.keys(SEVERITY_RANK).join(", ")}`,
+  );
+}
+
+export function stripVersionDecorators(reference) {
+  const openParenIndex = reference.indexOf("(");
+  if (openParenIndex === -1) {
+    return reference;
+  }
+  return reference.slice(0, openParenIndex);
+}
+
+export function parseSnapshotKey(snapshotKey) {
+  let separatorIndex = -1;
+  let parenDepth = 0;
+  for (let index = 1; index < snapshotKey.length; index += 1) {
+    const character = snapshotKey[index];
+    if (character === "(") {
+      parenDepth += 1;
+      continue;
+    }
+    if (character === ")") {
+      parenDepth = Math.max(0, parenDepth - 1);
+      continue;
+    }
+    if (character === "@" && parenDepth === 0) {
+      separatorIndex = index;
+    }
+  }
+  if (separatorIndex <= 0) {
+    throw new Error(`Unable to parse pnpm snapshot key "${snapshotKey}".`);
+  }
+  const packageName = snapshotKey.slice(0, separatorIndex);
+  const reference = snapshotKey.slice(separatorIndex + 1);
+  return {
+    packageName,
+    reference,
+    version: stripVersionDecorators(reference),
+  };
+}
+
+function isLocalReference(reference) {
+  return LOCAL_REFERENCE_PREFIXES.some((prefix) => reference.startsWith(prefix));
+}
+
+function countIndentation(line) {
+  let indentation = 0;
+  while (indentation < line.length && line[indentation] === " ") {
+    indentation += 1;
+  }
+  return indentation;
+}
+
+function isIgnorableYamlLine(trimmed) {
+  return !trimmed || trimmed.startsWith("#");
+}
+
+function unquoteYamlString(value) {
+  if (value.length >= 2 && value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1).replaceAll("''", "'");
+  }
+  if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+    return value.slice(1, -1).replaceAll('\\"', '"');
+  }
+  return value;
+}
+
+function parseYamlScalar(value) {
+  return unquoteYamlString(value.trim());
+}
+
+function splitInlineYamlMapEntries(text) {
+  const entries = [];
+  let current = "";
+  let quote = null;
+  let depth = 0;
+
+  for (const character of text) {
+    if (quote) {
+      current += character;
+      if (character === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (character === "'" || character === '"') {
+      quote = character;
+      current += character;
+      continue;
+    }
+    if (character === "{" || character === "[" || character === "(") {
+      depth += 1;
+      current += character;
+      continue;
+    }
+    if (character === "}" || character === "]" || character === ")") {
+      depth = Math.max(0, depth - 1);
+      current += character;
+      continue;
+    }
+    if (character === "," && depth === 0) {
+      const entry = current.trim();
+      if (entry) {
+        entries.push(entry);
+      }
+      current = "";
+      continue;
+    }
+    current += character;
+  }
+
+  const entry = current.trim();
+  if (entry) {
+    entries.push(entry);
+  }
+  return entries;
+}
+
+function parseInlineYamlMap(rawValue) {
+  const trimmed = rawValue.trim();
+  if (!trimmed.startsWith("{") || !trimmed.endsWith("}")) {
+    return null;
+  }
+
+  const body = trimmed.slice(1, -1).trim();
+  if (!body) {
+    return {};
+  }
+
+  const result = {};
+  for (const entry of splitInlineYamlMapEntries(body)) {
+    const mapping = parseYamlMappingLine(entry);
+    if (!mapping?.value) {
+      continue;
+    }
+    result[mapping.key] = parseYamlScalar(mapping.value);
+  }
+  return result;
+}
+
+function findYamlMappingSeparator(line) {
+  let quote = null;
+  let depth = 0;
+
+  for (let index = 0; index < line.length; index += 1) {
+    const character = line[index];
+    if (quote) {
+      if (character === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (character === "'" || character === '"') {
+      quote = character;
+      continue;
+    }
+    if (character === "{" || character === "[" || character === "(") {
+      depth += 1;
+      continue;
+    }
+    if (character === "}" || character === "]" || character === ")") {
+      depth = Math.max(0, depth - 1);
+      continue;
+    }
+    if (character !== ":" || depth !== 0) {
+      continue;
+    }
+
+    const nextCharacter = line[index + 1];
+    if (nextCharacter === undefined || /\s/u.test(nextCharacter)) {
+      return index;
+    }
+  }
+
+  return -1;
+}
+
+function parseYamlMappingLine(line) {
+  const separatorIndex = findYamlMappingSeparator(line);
+  if (separatorIndex === -1) {
+    return null;
+  }
+  return {
+    key: parseYamlScalar(line.slice(0, separatorIndex)),
+    value: line.slice(separatorIndex + 1).trim(),
+  };
+}
+
+function isNamedYamlSection(trimmed, sectionNames) {
+  return sectionNames.some((sectionName) => trimmed === `${sectionName}:`);
+}
+
+function readNestedVersionValue(lines, startIndex, parentIndent) {
+  let index = startIndex;
+  let version = null;
+
+  while (index < lines.length) {
+    const nestedLine = lines[index];
+    const nestedTrimmed = nestedLine.trim();
+    const nestedIndentation = countIndentation(nestedLine);
+    if (isIgnorableYamlLine(nestedTrimmed)) {
+      index += 1;
+      continue;
+    }
+    if (nestedIndentation <= parentIndent) {
+      break;
+    }
+    if (nestedIndentation === NESTED_MAPPING_ENTRY_INDENT) {
+      const nestedEntry = parseYamlMappingLine(nestedTrimmed);
+      if (nestedEntry?.key === "version") {
+        version = parseYamlScalar(nestedEntry.value);
+      }
+    }
+    index += 1;
+  }
+
+  return { nextIndex: index, version };
+}
+
+function collectIndentedStringMap(lines, startIndex, entryIndent) {
+  const entries = {};
+  let index = startIndex;
+
+  while (index < lines.length) {
+    const line = lines[index];
+    const trimmed = line.trim();
+    const indentation = countIndentation(line);
+
+    if (isIgnorableYamlLine(trimmed)) {
+      index += 1;
+      continue;
+    }
+    if (indentation < entryIndent) {
+      break;
+    }
+    if (indentation !== entryIndent) {
+      index += 1;
+      continue;
+    }
+
+    const entry = parseYamlMappingLine(trimmed);
+    if (entry?.value) {
+      entries[entry.key] = parseYamlScalar(entry.value);
+    }
+    index += 1;
+  }
+
+  return { entries, nextIndex: index };
+}
+
+function collectImporterDependencyReferences(lines, startIndex) {
+  const references = [];
+  let index = startIndex;
+
+  while (index < lines.length) {
+    const line = lines[index];
+    const trimmed = line.trim();
+    const indentation = countIndentation(line);
+
+    if (isIgnorableYamlLine(trimmed)) {
+      index += 1;
+      continue;
+    }
+    if (indentation < MAPPING_ENTRY_INDENT) {
+      break;
+    }
+    if (indentation > MAPPING_ENTRY_INDENT) {
+      index += 1;
+      continue;
+    }
+
+    const entry = parseYamlMappingLine(trimmed);
+    index += 1;
+    if (!entry) {
+      continue;
+    }
+
+    if (entry.value) {
+      const inlineMap = parseInlineYamlMap(entry.value);
+      if (inlineMap && typeof inlineMap.version === "string") {
+        references.push({ dependencyName: entry.key, reference: inlineMap.version });
+        continue;
+      }
+      references.push({ dependencyName: entry.key, reference: parseYamlScalar(entry.value) });
+      continue;
+    }
+
+    const nestedVersion = readNestedVersionValue(lines, index, MAPPING_ENTRY_INDENT);
+    index = nestedVersion.nextIndex;
+    if (nestedVersion.version) {
+      references.push({ dependencyName: entry.key, reference: nestedVersion.version });
+    }
+  }
+
+  return {
+    nextIndex: index,
+    references,
+  };
+}
+
+function collectSnapshotDependencies(lines, startIndex) {
+  const result = collectIndentedStringMap(lines, startIndex, MAPPING_ENTRY_INDENT);
+  return { dependencies: result.entries, nextIndex: result.nextIndex };
+}
+
+function parsePnpmLockfileSections(lockfileText) {
+  // Keep this parser dependency-free: security-fast runs this hook without pnpm install.
+  // It only needs the small pnpm-lock subset used to collect production snapshots.
+  const importers = [];
+  const snapshots = {};
+  const lines = lockfileText.split(/\r?\n/u);
+  let currentTopLevelSection = null;
+  let hasImportersSection = false;
+  let hasSnapshotsSection = false;
+
+  for (let index = 0; index < lines.length; ) {
+    const line = lines[index];
+    const trimmed = line.trim();
+    const indentation = countIndentation(line);
+
+    if (isIgnorableYamlLine(trimmed)) {
+      index += 1;
+      continue;
+    }
+
+    if (indentation === TOP_LEVEL_INDENT && trimmed.endsWith(":")) {
+      currentTopLevelSection = parseYamlScalar(trimmed.slice(0, -1));
+      if (currentTopLevelSection === "importers") {
+        hasImportersSection = true;
+      }
+      if (currentTopLevelSection === "snapshots") {
+        hasSnapshotsSection = true;
+      }
+      index += 1;
+      continue;
+    }
+
+    if (
+      currentTopLevelSection === "importers" &&
+      indentation === SECTION_ENTRY_INDENT &&
+      trimmed.endsWith(":")
+    ) {
+      index += 1;
+      while (index < lines.length) {
+        const nestedLine = lines[index];
+        const nestedTrimmed = nestedLine.trim();
+        const nestedIndentation = countIndentation(nestedLine);
+
+        if (isIgnorableYamlLine(nestedTrimmed)) {
+          index += 1;
+          continue;
+        }
+        if (nestedIndentation <= SECTION_ENTRY_INDENT) {
+          break;
+        }
+        if (
+          nestedIndentation === NESTED_SECTION_INDENT &&
+          isNamedYamlSection(nestedTrimmed, IMPORTER_SECTIONS)
+        ) {
+          const result = collectImporterDependencyReferences(lines, index + 1);
+          importers.push(...result.references);
+          index = result.nextIndex;
+          continue;
+        }
+        index += 1;
+      }
+      continue;
+    }
+
+    if (currentTopLevelSection === "snapshots" && indentation === SECTION_ENTRY_INDENT) {
+      const snapshotEntry = parseYamlMappingLine(trimmed);
+      if (!snapshotEntry) {
+        index += 1;
+        continue;
+      }
+      if (snapshotEntry.value) {
+        snapshots[snapshotEntry.key] = {};
+        index += 1;
+        continue;
+      }
+
+      const snapshotKey = snapshotEntry.key;
+      const snapshot = {};
+      index += 1;
+      while (index < lines.length) {
+        const nestedLine = lines[index];
+        const nestedTrimmed = nestedLine.trim();
+        const nestedIndentation = countIndentation(nestedLine);
+
+        if (isIgnorableYamlLine(nestedTrimmed)) {
+          index += 1;
+          continue;
+        }
+        if (nestedIndentation <= SECTION_ENTRY_INDENT) {
+          break;
+        }
+        if (
+          nestedIndentation === NESTED_SECTION_INDENT &&
+          isNamedYamlSection(nestedTrimmed, SNAPSHOT_SECTIONS)
+        ) {
+          const result = collectSnapshotDependencies(lines, index + 1);
+          snapshot[nestedTrimmed.slice(0, -1)] = result.dependencies;
+          index = result.nextIndex;
+          continue;
+        }
+        index += 1;
+      }
+      snapshots[snapshotKey] = snapshot;
+      continue;
+    }
+
+    index += 1;
+  }
+
+  return { hasImportersSection, hasSnapshotsSection, importers, snapshots };
+}
+
+function resolveSnapshot({ dependencyName, reference, snapshots }) {
+  if (isLocalReference(reference)) {
+    return null;
+  }
+
+  const directKey = `${dependencyName}@${reference}`;
+  if (directKey in snapshots) {
+    return {
+      snapshotKey: directKey,
+      ...parseSnapshotKey(directKey),
+    };
+  }
+
+  if (reference in snapshots) {
+    return {
+      snapshotKey: reference,
+      ...parseSnapshotKey(reference),
+    };
+  }
+
+  if (reference.startsWith("npm:")) {
+    const aliasKey = reference.slice(4);
+    if (aliasKey in snapshots) {
+      return {
+        snapshotKey: aliasKey,
+        ...parseSnapshotKey(aliasKey),
+      };
+    }
+  }
+
+  throw new Error(
+    `Unable to resolve pnpm snapshot for dependency "${dependencyName}" with reference "${reference}".`,
+  );
+}
+
+export function collectProdResolvedPackagesFromLockfile(lockfileText) {
+  const lockfile = parsePnpmLockfileSections(lockfileText);
+  if (!lockfile.hasImportersSection) {
+    throw new Error("pnpm-lock.yaml is missing the importers section.");
+  }
+  if (!lockfile.hasSnapshotsSection) {
+    throw new Error("pnpm-lock.yaml is missing the snapshots section.");
+  }
+
+  const versionsByPackage = new Map();
+  const seenSnapshots = new Set();
+  const queue = [...lockfile.importers];
+
+  while (queue.length > 0) {
+    const next = queue.pop();
+    if (!next) {
+      continue;
+    }
+    const resolved = resolveSnapshot({
+      dependencyName: next.dependencyName,
+      reference: next.reference,
+      snapshots: lockfile.snapshots,
+    });
+    if (!resolved) {
+      continue;
+    }
+
+    let versions = versionsByPackage.get(resolved.packageName);
+    if (!versions) {
+      versions = new Set();
+      versionsByPackage.set(resolved.packageName, versions);
+    }
+    versions.add(resolved.version);
+
+    if (seenSnapshots.has(resolved.snapshotKey)) {
+      continue;
+    }
+    seenSnapshots.add(resolved.snapshotKey);
+
+    const snapshot = lockfile.snapshots[resolved.snapshotKey];
+    if (!snapshot || typeof snapshot !== "object") {
+      continue;
+    }
+    for (const sectionName of SNAPSHOT_SECTIONS) {
+      const dependencies = snapshot[sectionName];
+      if (!dependencies || typeof dependencies !== "object") {
+        continue;
+      }
+      for (const [dependencyName, reference] of Object.entries(dependencies)) {
+        if (typeof reference !== "string") {
+          continue;
+        }
+        queue.push({ dependencyName, reference });
+      }
+    }
+  }
+
+  return versionsByPackage;
+}
+
+export function createBulkAdvisoryPayload(versionsByPackage) {
+  return Object.fromEntries(
+    [...versionsByPackage.entries()]
+      .toSorted(([left], [right]) => left.localeCompare(right))
+      .map(([packageName, versions]) => [
+        packageName,
+        [...versions].toSorted((left, right) => left.localeCompare(right)),
+      ]),
+  );
+}
+
+function normalizeSeverity(severity) {
+  if (typeof severity !== "string") {
+    return "info";
+  }
+  return severity.toLowerCase();
+}
+
+export function filterFindingsBySeverity(advisoriesByPackage, minSeverity) {
+  const threshold = normalizeAuditLevel(minSeverity);
+  const findings = [];
+
+  for (const [packageName, advisories] of Object.entries(advisoriesByPackage ?? {})) {
+    if (!Array.isArray(advisories)) {
+      continue;
+    }
+    for (const advisory of advisories) {
+      if (!advisory || typeof advisory !== "object") {
+        continue;
+      }
+      const severity = normalizeSeverity(advisory.severity);
+      if ((SEVERITY_RANK[severity] ?? -1) < SEVERITY_RANK[threshold]) {
+        continue;
+      }
+      findings.push({
+        packageName,
+        id: advisory.id ?? "unknown",
+        severity,
+        title: advisory.title ?? "Untitled advisory",
+        url: advisory.url ?? null,
+        vulnerableVersions: advisory.vulnerable_versions ?? null,
+      });
+    }
+  }
+
+  findings.sort((left, right) => {
+    const severityDelta =
+      (SEVERITY_RANK[right.severity] ?? -1) - (SEVERITY_RANK[left.severity] ?? -1);
+    if (severityDelta !== 0) {
+      return severityDelta;
+    }
+    return left.packageName.localeCompare(right.packageName);
+  });
+
+  return findings;
+}
+
+function chunkEntries(entries, size) {
+  const chunks = [];
+  for (let index = 0; index < entries.length; index += size) {
+    chunks.push(entries.slice(index, index + size));
+  }
+  return chunks;
+}
+
+function resolveRegistryBaseUrl() {
+  const configured =
+    process.env.npm_config_registry ??
+    process.env.NPM_CONFIG_REGISTRY ??
+    process.env.npm_config_userconfig_registry ??
+    DEFAULT_REGISTRY;
+  return configured.replace(/\/+$/u, "");
+}
+
+export async function fetchBulkAdvisories({
+  payload,
+  fetchImpl = fetch,
+  registryBaseUrl = resolveRegistryBaseUrl(),
+}) {
+  const url = `${registryBaseUrl}${BULK_ADVISORY_PATH}`;
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      "content-type": "application/json",
+    },
+    body: JSON.stringify(payload),
+  });
+
+  if (!response.ok) {
+    const bodyText = await response.text();
+    throw new Error(
+      `Bulk advisory request failed (${response.status} ${response.statusText}): ${bodyText}`,
+    );
+  }
+
+  return response.json();
+}
+
+export async function runPnpmAuditProd({
+  rootDir = process.cwd(),
+  fetchImpl = fetch,
+  stdout = process.stdout,
+  stderr = process.stderr,
+  minSeverity = MIN_SEVERITY,
+} = {}) {
+  const normalizedMinSeverity = normalizeAuditLevel(minSeverity);
+  const lockfilePath = path.join(rootDir, "pnpm-lock.yaml");
+  const lockfileText = await readFile(lockfilePath, "utf8");
+  const payload = createBulkAdvisoryPayload(collectProdResolvedPackagesFromLockfile(lockfileText));
+  const payloadEntries = Object.entries(payload);
+
+  if (payloadEntries.length === 0) {
+    stdout.write("No production dependencies found in pnpm-lock.yaml.\n");
+    return 0;
+  }
+
+  const advisoryResults = {};
+  for (const payloadChunk of chunkEntries(payloadEntries, 400)) {
+    const chunkPayload = Object.fromEntries(payloadChunk);
+    const chunkResults = await fetchBulkAdvisories({
+      payload: chunkPayload,
+      fetchImpl,
+    });
+    Object.assign(advisoryResults, chunkResults);
+  }
+
+  const findings = filterFindingsBySeverity(advisoryResults, normalizedMinSeverity);
+  if (findings.length === 0) {
+    stdout.write(
+      `No ${normalizedMinSeverity} or higher advisories found for production dependencies.\n`,
+    );
+    return 0;
+  }
+
+  stderr.write(
+    `Found ${findings.length} ${normalizedMinSeverity} or higher advisories in production dependencies:\n`,
+  );
+  for (const finding of findings.slice(0, 25)) {
+    const details = [
+      `${finding.severity.toUpperCase()} ${finding.packageName}`,
+      `id=${finding.id}`,
+      `title=${finding.title}`,
+    ];
+    if (finding.vulnerableVersions) {
+      details.push(`range=${finding.vulnerableVersions}`);
+    }
+    if (finding.url) {
+      details.push(`url=${finding.url}`);
+    }
+    stderr.write(`- ${details.join(" · ")}\n`);
+  }
+  if (findings.length > 25) {
+    stderr.write(`...and ${findings.length - 25} more advisories.\n`);
+  }
+  return 1;
+}
+
+function parseArgs(argv) {
+  let minSeverity = MIN_SEVERITY;
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === "--audit-level" || argument === "--min-severity") {
+      minSeverity = argv[index + 1] ?? "";
+      index += 1;
+      continue;
+    }
+    if (argument.startsWith("--audit-level=")) {
+      minSeverity = argument.slice("--audit-level=".length);
+      continue;
+    }
+    if (argument.startsWith("--min-severity=")) {
+      minSeverity = argument.slice("--min-severity=".length);
+      continue;
+    }
+    throw new Error(`Unknown argument "${argument}".`);
+  }
+
+  return { minSeverity };
+}
+
+async function main() {
+  try {
+    const { minSeverity } = parseArgs(process.argv.slice(2));
+    process.exitCode = await runPnpmAuditProd({ minSeverity });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`${message}\n`);
+    process.exitCode = 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  await main();
+}

openclaw/scripts/pre-commit/run-node-tool.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+if [[ $# -lt 1 ]]; then
+  echo "usage: run-node-tool.sh <tool> [args...]" >&2
+  exit 2
+fi
+
+tool="$1"
+shift
+
+if [[ -f "$ROOT_DIR/pnpm-lock.yaml" ]] && command -v pnpm >/dev/null 2>&1; then
+  exec pnpm exec "$tool" "$@"
+fi
+
+if { [[ -f "$ROOT_DIR/bun.lockb" ]] || [[ -f "$ROOT_DIR/bun.lock" ]]; } && command -v bun >/dev/null 2>&1; then
+  exec bunx --bun "$tool" "$@"
+fi
+
+if command -v npm >/dev/null 2>&1; then
+  exec npm exec -- "$tool" "$@"
+fi
+
+if command -v npx >/dev/null 2>&1; then
+  exec npx "$tool" "$@"
+fi
+
+echo "Missing package manager: pnpm, bun, or npm required." >&2
+exit 1