Skip to main content

hematite/agent/
routing.rs

1use super::conversation::WorkflowMode;
2
3#[derive(Clone, Copy, Debug, Eq, PartialEq)]
4pub enum QueryIntentClass {
5    ProductTruth,
6    RuntimeDiagnosis,
7    RepoArchitecture,
8    Toolchain,
9    Capability,
10    Implementation,
11    Unknown,
12}
13
14#[derive(Clone, Copy, Debug, Eq, PartialEq)]
15pub enum DirectAnswerKind {
16    About,
17    LanguageCapability,
18    UnsafeWorkflowPressure,
19    SessionMemory,
20    RecoveryRecipes,
21    McpLifecycle,
22    AuthorizationPolicy,
23    ToolClasses,
24    ToolRegistryOwnership,
25    SessionResetSemantics,
26    ProductSurface,
27    ReasoningSplit,
28    Identity,
29    WorkflowModes,
30    GemmaNative,
31    GemmaNativeSettings,
32    VerifyProfiles,
33    Toolchain,
34    HostInspection,
35    ArchitectSessionResetPlan,
36}
37
38#[derive(Clone, Copy, Debug)]
39pub struct QueryIntent {
40    pub primary_class: QueryIntentClass,
41    pub direct_answer: Option<DirectAnswerKind>,
42    pub grounded_trace_mode: bool,
43    pub capability_mode: bool,
44    pub capability_needs_repo: bool,
45    pub toolchain_mode: bool,
46    pub host_inspection_mode: bool,
47    pub maintainer_workflow_mode: bool,
48    pub workspace_workflow_mode: bool,
49    pub architecture_overview_mode: bool,
50    pub sovereign_mode: bool,
51    pub surgical_filesystem_mode: bool,
52}
53
54fn contains_any(haystack: &str, needles: &[&str]) -> bool {
55    needles.iter().any(|needle| haystack.contains(needle))
56}
57
58fn contains_all(haystack: &str, needles: &[&str]) -> bool {
59    needles.iter().all(|needle| haystack.contains(needle))
60}
61
62fn mentions_reset_commands(lower: &str) -> bool {
63    contains_all(lower, &["/clear", "/new", "/forget"])
64}
65
66fn mentions_stable_product_surface(lower: &str) -> bool {
67    contains_any(
68        lower,
69        &[
70            "stable product-surface question",
71            "stable product surface question",
72            "stable product-surface questions",
73            "stable product surface questions",
74        ],
75    )
76}
77
78fn mentions_product_truth_routing(lower: &str) -> bool {
79    let asks_decision_policy = contains_any(
80        lower,
81        &[
82            "how hematite decides",
83            "how does hematite decide",
84            "decides whether",
85            "decide whether",
86        ],
87    );
88    let asks_direct_vs_inspect_split = contains_any(
89        lower,
90        &[
91            "answered as stable product truth",
92            "stable product truth",
93            "stable product behavior",
94            "answer directly",
95            "direct answer",
96            "inspect the repository",
97            "inspect repository",
98            "repository implementation",
99            "repo implementation",
100        ],
101    );
102    asks_decision_policy && asks_direct_vs_inspect_split
103}
104
105fn mentions_broad_system_walkthrough(lower: &str) -> bool {
106    let asks_walkthrough = contains_any(
107        lower,
108        &[
109            "walk me through",
110            "walk through",
111            "how hematite is wired",
112            "understand how hematite is wired",
113            "major runtime pieces",
114            "normal message moves",
115            "moves from the tui to the model and back",
116        ],
117    );
118    let asks_multiple_runtime_areas = contains_any(
119        lower,
120        &[
121            "session recovery",
122            "tool policy",
123            "mcp state",
124            "mcp policy",
125            "files own the major runtime pieces",
126            "which files own",
127            "where session recovery",
128            "where tool policy",
129            "where mcp state",
130        ],
131    );
132    asks_walkthrough && asks_multiple_runtime_areas
133}
134
135fn mentions_capability_question(lower: &str) -> bool {
136    contains_any(
137        lower,
138        &[
139            "what can you do",
140            "what are you capable",
141            "can you make projects",
142            "can you build projects",
143            "do you know other coding languages",
144            "other coding languages",
145            "what languages",
146            "can you use the internet",
147            "internet research capabilities",
148            "what tools do you have",
149        ],
150    )
151}
152
153fn mentions_creator_question(lower: &str) -> bool {
154    contains_any(
155        lower,
156        &[
157            "who created you",
158            "who built you",
159            "who made you",
160            "who developed you",
161            "who engineered you",
162            "who engineered your architecture",
163            "who created hematite",
164            "who built hematite",
165            "who developed hematite",
166            "who engineered hematite",
167            "who maintains hematite",
168            "who authored hematite",
169            "who is the author",
170            "who wrote this",
171            "who made this app",
172        ],
173    )
174}
175
176fn capability_question_requires_repo_inspection(lower: &str) -> bool {
177    contains_any(
178        lower,
179        &[
180            "this repo",
181            "this repository",
182            "codebase",
183            "which files",
184            "implementation",
185            "in this project",
186        ],
187    )
188}
189
190fn mentions_host_inspection_question(lower: &str) -> bool {
191    let host_scope = contains_any(
192        lower,
193        &[
194            "path",
195            "package manager",
196            "package managers",
197            "env doctor",
198            "environment doctor",
199            "pip",
200            "winget",
201            "choco",
202            "scoop",
203            "network",
204            "adapter",
205            "dns",
206            "gateway",
207            "ip address",
208            "ipconfig",
209            "wifi",
210            "ethernet",
211            "service",
212            "services",
213            "daemon",
214            "startup type",
215            "process",
216            "processes",
217            "task manager",
218            "ram",
219            "cpu",
220            "gpu",
221            "vram",
222            "nvidia",
223            "memory",
224            "developer tools",
225            "toolchains",
226            "installed",
227            "desktop",
228            "downloads",
229            "folder",
230            "directory",
231            "local development",
232            "machine",
233            "computer",
234            "firewall",
235            "vpn",
236            "proxy",
237            "internet",
238            "online",
239            "connectivity",
240            "ssid",
241            "wireless",
242            "tcp connection",
243            "active connection",
244            "traceroute",
245            "tracert",
246            "dns cache",
247            "arp table",
248            "arp cache",
249            "route table",
250            "routing table",
251            "default gateway",
252            "next hop",
253            "power plan",
254            "power settings",
255            "uptime",
256            "reboot",
257            "silicon",
258            "throttle",
259            "throttled",
260            "clocks",
261            "mhz",
262            "health",
263            "report",
264            "bitlocker",
265            "rdp",
266            "remote desktop",
267            "vss",
268            "shadow copy",
269            "shadow copies",
270            "pagefile",
271            "virtual memory",
272            "swap",
273            "windows feature",
274            "optional feature",
275            "printer",
276            "print queue",
277            "winrm",
278            "psremoting",
279            "network stats",
280            "adapter stats",
281            "udp listening",
282            "udp port",
283            "session",
284            "logon",
285            "login",
286            "slat",
287            "error",
288            "warning",
289            "event",
290            "log",
291            "throughput",
292            "permission",
293            "access control",
294            "login",
295            "logon",
296            "registry",
297            "share",
298            "mbps",
299            "ad",
300            "sid",
301            "vm",
302            "hyper-v",
303            "hyperv",
304            "dhcp",
305            "lease",
306        ],
307    );
308    let host_action = contains_any(
309        lower,
310        &[
311            "inspect",
312            "count",
313            "tell me",
314            "summarize",
315            "how big",
316            "biggest",
317            "versions",
318            "duplicate",
319            "analyze",
320            "missing",
321            "ready",
322            "resolve",
323            "troubleshoot",
324            "show me",
325            "show",
326            "find",
327            "list",
328            "audit",
329            "test",
330            "check",
331            "is",
332            "are",
333            "am",
334            "why",
335            "what",
336            "currently",
337            "status",
338            "stats",
339            "vitals",
340            "telemetry",
341            "how",
342            "looking",
343        ],
344    );
345
346    host_scope && host_action
347}
348
349pub fn preferred_host_inspection_topic(user_input: &str) -> Option<&'static str> {
350    let lower = user_input.to_lowercase();
351    let asks_fix_plan = (lower.contains("fix")
352        || lower.contains("repair")
353        || lower.contains("resolve")
354        || lower.contains("troubleshoot"))
355        && (lower.contains("cargo")
356            || lower.contains("path")
357            || lower.contains("package manager")
358            || lower.contains("toolchain")
359            || lower.contains("port ")
360            || lower.contains("already in use")
361            || lower.contains("lm studio")
362            || lower.contains("localhost:1234")
363            || lower.contains("embedding model")
364            || lower.contains("no coding model loaded"));
365    let asks_path = lower.contains("path entries")
366        || lower.contains("raw path")
367        || (lower.contains("path") && (lower.contains("show") || lower.contains("what is")));
368    let asks_gpo = lower.contains("gpo")
369        || lower.contains("group policy")
370        || lower.contains("gpresult")
371        || lower.contains("applied policy");
372    let asks_certificates = lower.contains("cert")
373        || lower.contains("ssl")
374        || lower.contains("client cert")
375        || lower.contains("expiring cert");
376    let asks_integrity = lower.contains("integrity")
377        || lower.contains("sfc")
378        || lower.contains("dism")
379        || lower.contains("corruption")
380        || lower.contains("os health");
381    let asks_user_accounts = lower.contains("user account")
382        || lower.contains("local user")
383        || lower.contains("local group")
384        || lower.contains("get-localuser")
385        || lower.contains("get-localgroup")
386        || lower.contains("get-localgroupmember")
387        || lower.contains("who is logged in")
388        || lower.contains("who is logged on")
389        || lower.contains("who am i")
390        || lower.contains("logged in as")
391        || lower.contains("logged in user")
392        || lower.contains("logged on user")
393        || lower.contains("admin group")
394        || lower.contains("administrators group")
395        || lower.contains("local admin")
396        || lower.contains("who has admin")
397        || lower.contains("running as admin")
398        || lower.contains("is this elevated")
399        || lower.contains("active sessions")
400        || lower.contains("logon session")
401        || lower.contains("net user")
402        || lower.contains("net localgroup");
403    let asks_ad_user = lower.contains("ad user")
404        || lower.contains("domain user")
405        || (lower.contains("user") && (lower.contains("sid") || lower.contains("membership")));
406    let asks_dns_lookup = (lower.contains("dns") || lower.contains("record"))
407        && (lower.contains("lookup")
408            || lower.contains("srv")
409            || lower.contains("mx")
410            || lower.contains("txt"));
411    let asks_hyperv =
412        lower.contains("hyper-v") || lower.contains("hyperv") || lower.contains("list vm");
413    let asks_ip_config =
414        lower.contains("ipconfig") && (lower.contains("all") || lower.contains("detailed"));
415    let asks_domain = lower.contains("domain")
416        || lower.contains("active directory")
417        || lower.contains("ad join")
418        || lower.contains("workgroup")
419        || lower.contains("netbios");
420    let asks_device_health = lower.contains("device health")
421        || lower.contains("hardware error")
422        || lower.contains("malfunctioning")
423        || lower.contains("yellow bang")
424        || lower.contains("hardware failing");
425    let asks_drivers =
426        lower.contains("driver") || lower.contains("kmod") || lower.contains("kernel module");
427    let asks_peripherals = lower.contains("peripheral")
428        || lower.contains("usb")
429        || lower.contains("keyboard")
430        || lower.contains("mouse")
431        || lower.contains("pointer")
432        || lower.contains("monitor")
433        || lower.contains("input device")
434        || lower.contains("connected hardware");
435    let asks_sessions = lower.contains("session")
436        || lower.contains("login")
437        || lower.contains("who is on")
438        || lower.contains("active user");
439    let asks_virtualization = lower.contains("virtualization")
440        || lower.contains("hypervisor")
441        || lower.contains("vt-x")
442        || lower.contains("slat")
443        || lower.contains("v-p")
444        || lower.contains("nested virt")
445        || lower.contains("cpu model")
446        || lower.contains("ram size")
447        || lower.contains("hardware spec")
448        || lower.contains("hardware dna")
449        || lower.contains("hardware info")
450        || lower.contains("bios version")
451        || lower.contains("motherboard")
452        || lower.contains("how much ram")
453        || lower.contains("what processor")
454        || lower.contains("what cpu")
455        || (lower.contains("what hardware") && lower.contains("have"))
456        || (lower.contains("hardware") && lower.contains("inventory"));
457    let asks_startup = lower.contains("startup")
458        || lower.contains("boot program")
459        || lower.contains("autorun")
460        || lower.contains("run at boot");
461    let asks_env_doctor = lower.contains("env doctor")
462        || lower.contains("environment doctor")
463        || lower.contains("package manager")
464        || lower.contains("package managers")
465        || lower.contains("shims")
466        || lower.contains("path drift")
467        || lower.contains("environment is broken")
468        || lower.contains("env is broken")
469        || (lower.contains("dev machine") && lower.contains("off"))
470        || (lower.contains("environment") && lower.contains("sane"));
471    let asks_network = (((lower.contains("network") && !lower.contains("active directory"))
472        && !lower.contains("stat")
473        && !lower.contains("share")
474        && !lower.contains("throughput"))
475        || lower.contains("adapter")
476        || lower.contains("ip address")
477        || lower.contains("ipconfig")
478        || lower.contains("ipv4")
479        || lower.contains("ipv6")
480        || lower.contains("subnet")
481        || lower.contains("dns server")
482        || lower.contains("nameserver")
483        || lower.contains("wifi")
484        || lower.contains("wireless")
485        || lower.contains("ethernet")
486        || lower.contains("lan"))
487        && !asks_ad_user;
488    let asks_services = lower.contains("service")
489        || lower.contains("services")
490        || lower.contains("daemon")
491        || lower.contains("startup type")
492        || lower.contains("background service")
493        || lower.contains("windows service")
494        || lower.contains("systemctl")
495        || lower.contains("get-service");
496    let asks_processes = lower.contains("process")
497        || lower.contains("processes")
498        || lower.contains("task manager")
499        || lower.contains("what is running")
500        || lower.contains("what's running")
501        || lower.contains("using my ram")
502        || lower.contains("using ram")
503        || lower.contains("using my cpu")
504        || lower.contains("top memory")
505        || lower.contains("top ram")
506        || lower.contains("high memory")
507        || lower.contains("resource-heavy processes")
508        || lower.contains("heavy hitters")
509        || (lower.contains("using the most")
510            && (lower.contains("cpu") || lower.contains("ram") || lower.contains("memory")))
511        || (lower.contains("most cpu")
512            || lower.contains("most ram")
513            || lower.contains("most memory"))
514        || (lower.contains("hitting")
515            && (lower.contains("cpu") || lower.contains("ram") || lower.contains("disk")));
516    let asks_toolchains = lower.contains("developer tools")
517        || lower.contains("toolchains")
518        || (lower.contains("installed") && lower.contains("version"))
519        || (lower.contains("detect") && lower.contains("version"));
520    let _asks_permissions = lower.contains("permission")
521        || lower.contains("access control")
522        || lower.contains("get-acl")
523        || lower.contains("acl ")
524        || lower.contains("icacls")
525        || lower.contains("takeown")
526        || lower.contains("ntfs permission")
527        || (lower.contains("who has") && lower.contains("access"));
528    let _asks_login_history = lower.contains("login history")
529        || lower.contains("logon history")
530        || lower.contains("who logged in")
531        || lower.contains("recent logon")
532        || lower.contains("failed logon")
533        || lower.contains("event id 4624")
534        || lower.contains("eventid 4624");
535    let _asks_registry_audit = lower.contains("registry audit")
536        || lower.contains("persistence")
537        || lower.contains("debugger hijack")
538        || lower.contains("ifeo")
539        || lower.contains("winlogon shell")
540        || lower.contains("bootexecute")
541        || lower.contains("reg query")
542        || lower.contains("regedit")
543        || lower.contains("sticky keys")
544        || lower.contains("sethc.exe");
545    let asks_share_access = lower.contains("share access")
546        || lower.contains("unc path")
547        || lower.contains("smbshare")
548        || lower.contains("net share")
549        || lower.contains("net use")
550        || lower.contains("\\\\")
551        || lower.contains("share is reachable")
552        || lower.contains("reachable share")
553        || (lower.contains("network share")
554            && (lower.contains("reach") || lower.contains("access") || lower.contains("test")));
555    let asks_thermal = lower.contains("thermal")
556        || (lower.contains("throttle") && !lower.contains("gpu"))
557        || lower.contains("overheating")
558        || lower.contains("cpu temp");
559    let asks_overclocker = lower.contains("overclocker")
560        || lower.contains("nvidia stats")
561        || lower.contains("silicon health")
562        || lower.contains("mhz")
563        || (lower.contains("gpu")
564            && (lower.contains("throttle")
565                || lower.contains("bottleneck")
566                || lower.contains("clock")
567                || lower.contains("fan")
568                || lower.contains("power draw")
569                || lower.contains("frequency")));
570    let asks_hardware = lower.contains("cpu model")
571        || lower.contains("ram size")
572        || lower.contains("hardware spec")
573        || (lower.contains("what hardware") && lower.contains("have"))
574        || (lower.contains("gpu") && (lower.contains("what") || lower.contains("show")))
575        || lower.contains("motherboard")
576        || lower.contains("bios version");
577    let asks_activation = lower.contains("activation")
578        || lower.contains("slmgr")
579        || lower.contains("license status")
580        || lower.contains("is windows genuine");
581    let asks_patch_history = lower.contains("patch history")
582        || lower.contains("hotfix")
583        || lower.contains("kb history")
584        || lower.contains("installed updates");
585    let asks_ports = lower.contains("listening on port")
586        || lower.contains("listening port")
587        || lower.contains("open port")
588        || lower.contains("port 3000")
589        || lower.contains("port ")
590        || lower.contains("listening on ")
591        || lower.contains("exposed")
592        || lower.contains("what is listening")
593        || (lower.contains("listening") && lower.contains("port"));
594    let asks_repo_doctor = lower.contains("repo doctor")
595        || lower.contains("repository doctor")
596        || lower.contains("workspace health")
597        || lower.contains("repo health")
598        || lower.contains("workspace sanity")
599        || (lower.contains("git state")
600            && (lower.contains("release artifacts")
601                || lower.contains("build markers")
602                || lower.contains("hematite memory")));
603    let asks_directory = lower.contains("directory")
604        || lower.contains("folder")
605        || lower.contains("how big")
606        || lower.contains("biggest");
607    let asks_mutation_intent = (lower.contains("make")
608        || lower.contains("create")
609        || lower.contains("mkdir")
610        || lower.contains("organize")
611        || lower.contains("edit")
612        || lower.contains("write")
613        || lower.contains("save")
614        || lower.contains("update"))
615        && (lower.contains("folder")
616            || lower.contains("directory")
617            || lower.contains("file")
618            || lower.contains("code")
619            || lower.contains("desktop"));
620    let asks_broad_readiness = lower.contains("local development")
621        || lower.contains("ready for local development")
622        || (lower.contains("machine") && lower.contains("ready"))
623        || (lower.contains("computer") && lower.contains("ready"));
624    let asks_os_config = lower.contains("firewall")
625        || lower.contains("power plan")
626        || lower.contains("power settings")
627        || lower.contains("powercfg")
628        || lower.contains("uptime")
629        || lower.contains("boot time")
630        || lower.contains("last boot");
631    let asks_health_report = lower.contains("health report")
632        || lower.contains("system health")
633        || (lower.contains("how") && lower.contains("machine") && lower.contains("doing"))
634        || (lower.contains("status") && lower.contains("report") && !lower.contains("git"));
635    let asks_updates = lower.contains("up to date")
636        || lower.contains("windows update")
637        || lower.contains("pending update")
638        || lower.contains("update available")
639        || lower.contains("check for update")
640        || lower.contains("latest update")
641        || (lower.contains("update")
642            && (lower.contains("my pc")
643                || lower.contains("my computer")
644                || lower.contains("my machine")));
645    let asks_security = lower.contains("antivirus")
646        || lower.contains("defender")
647        || lower.contains("virus protection")
648        || lower.contains("malware")
649        || lower.contains("windows security")
650        || lower.contains("uac")
651        || lower.contains("windows activated")
652        || lower.contains("activation status")
653        || (lower.contains("protected") && (lower.contains("pc") || lower.contains("computer")))
654        || (lower.contains("security")
655            && !lower.contains("git")
656            && !lower.contains("ssh")
657            && !lower.contains("token"));
658    let asks_pending_reboot = lower.contains("need to restart")
659        || lower.contains("need to reboot")
660        || lower.contains("requires restart")
661        || lower.contains("requires a reboot")
662        || lower.contains("reboot required")
663        || lower.contains("restart required")
664        || lower.contains("pending restart")
665        || lower.contains("pending reboot")
666        || (lower.contains("restart")
667            && (lower.contains("waiting")
668                || lower.contains("queued")
669                || lower.contains("required")))
670        || (lower.contains("reboot") && lower.contains("required"))
671        || (lower.contains("reboot") && lower.contains("pending"))
672        || (lower.contains("restart") && lower.contains("pending"));
673    let asks_disk_health = lower.contains("disk health")
674        || lower.contains("drive health")
675        || lower.contains("hard drive dying")
676        || lower.contains("smart status")
677        || lower.contains("drive failing")
678        || lower.contains("drive fail")
679        || (lower.contains("dying") && (lower.contains("drive") || lower.contains("disk")))
680        || (lower.contains("healthy")
681            && (lower.contains("drive")
682                || lower.contains("disk")
683                || lower.contains("ssd")
684                || lower.contains("hdd")));
685    let asks_battery = lower.contains("battery")
686        || lower.contains("battery life")
687        || lower.contains("battery health")
688        || lower.contains("battery wear")
689        || lower.contains("charge level")
690        || lower.contains("how long until")
691        || (lower.contains("dying") && lower.contains("batter"));
692    let asks_recent_crashes = lower.contains("crash")
693        || lower.contains("bsod")
694        || lower.contains("blue screen")
695        || lower.contains("why did my pc restart")
696        || lower.contains("unexpected restart")
697        || lower.contains("sudden restart")
698        || lower.contains("kernel panic")
699        || lower.contains("app crash")
700        || (lower.contains("restart") && lower.contains("itself"))
701        || (lower.contains("restart") && lower.contains("by itself"));
702    let asks_log_check = lower.contains("event log")
703        || lower.contains("windows log")
704        || lower.contains("system log")
705        || lower.contains("error log")
706        || lower.contains("recent errors")
707        || lower.contains("recent warnings")
708        || lower.contains("recent events")
709        || lower.contains("event viewer")
710        || lower.contains("journald")
711        || lower.contains("journal log")
712        || lower.contains("show me warnings")
713        || (lower.contains("log") && lower.contains("error"))
714        || (lower.contains("log") && lower.contains("warning"))
715        || (lower.contains("show me") && lower.contains("error"))
716        || (lower.contains("show me") && lower.contains("warning"))
717        || (lower.contains("what errors") && lower.contains("log"));
718    let asks_scheduled_tasks = lower.contains("scheduled task")
719        || lower.contains("scheduled tasks")
720        || lower.contains("task scheduler")
721        || lower.contains("what runs on a timer")
722        || lower.contains("what runs at")
723        || lower.contains("cron job")
724        || lower.contains("background task");
725    let asks_dev_conflicts = lower.contains("dev conflict")
726        || lower.contains("environment conflict")
727        || lower.contains("toolchain conflict")
728        || lower.contains("version conflict")
729        || lower.contains("path conflict")
730        || lower.contains("duplicate path")
731        || (lower.contains("python") && lower.contains("wrong version"))
732        || (lower.contains("node") && lower.contains("wrong version"))
733        || lower.contains("conda shadow")
734        || lower.contains("dev environment clean");
735    let asks_disk_benchmark = lower.contains("benchmark")
736        || lower.contains("stress test")
737        || lower.contains("load test")
738        || lower.contains("intensity report")
739        || lower.contains("io intensity")
740        || lower.contains("disk intensity")
741        || lower.contains("thrash")
742        || lower.contains("latency report");
743    let asks_storage = lower.contains("storage")
744        || lower.contains("disk space")
745        || lower.contains("drive capacity")
746        || lower.contains("free space")
747        || lower.contains("how much space")
748        || lower.contains("space left")
749        || lower.contains("running out of space")
750        || lower.contains("i/o pressure")
751        || lower.contains("disk usage")
752        || lower.contains("disk usage")
753        || lower.contains("how much disk")
754        || lower.contains("how full")
755        || lower.contains("cache size")
756        || (lower.contains("drive") && lower.contains("usage"))
757        || (lower.contains("drives") && lower.contains("usage"))
758        || (lower.contains("where") && lower.contains("space") && lower.contains("go"));
759    let asks_resource_load = lower.contains("resource load")
760        || lower.contains("system load")
761        || lower.contains("performance")
762        || lower.contains("utilization")
763        || lower.contains("usage report")
764        || lower.contains("performance report")
765        || lower.contains("what is my load")
766        || lower.contains("current load")
767        || lower.contains("why is it slow")
768        || lower.contains("why is it laggy")
769        || lower.contains("slow")
770        || lower.contains("lag")
771        || lower.contains("sluggish")
772        || lower.contains("hang")
773        || lower.contains("unresponsive")
774        || lower.contains("is it working hard")
775        || lower.contains("high cpu")
776        || lower.contains("high ram")
777        || lower.contains("cpu load")
778        || lower.contains("heavy hitters")
779        || (lower.contains("resource") && lower.contains("usage"));
780
781    let asks_connectivity = lower.contains("internet")
782        || lower.contains("online")
783        || lower.contains("connectivity")
784        || lower.contains("am i connected")
785        || lower.contains("ping google")
786        || lower.contains("reach the internet")
787        || lower.contains("internet access")
788        || lower.contains("no internet")
789        || lower.contains("internet down")
790        || lower.starts_with("ping ")
791        || lower.contains(" ping ")
792        || (lower.contains("check") && lower.contains("connection"))
793        || (lower.contains("dns") && (lower.contains("resolv") || lower.contains("working")));
794    let asks_wifi = lower.contains("wi-fi")
795        || lower.contains("wifi")
796        || lower.contains("wireless")
797        || lower.contains("wlan")
798        || lower.contains("signal strength")
799        || lower.contains("ssid")
800        || lower.contains("access point")
801        || (lower.contains("wireless") && lower.contains("connect"));
802    let asks_connections = lower.contains("tcp connection")
803        || lower.contains("active connection")
804        || lower.contains("established connection")
805        || lower.contains("socket")
806        || lower.contains("netstat")
807        || (lower.contains("connection") && lower.contains("active"))
808        || (lower.contains("connection") && lower.contains("open"));
809    let asks_vpn = lower.contains("vpn")
810        || lower.contains("virtual private network")
811        || (lower.contains("tunnel") && (lower.contains("network") || lower.contains("vpn")));
812    let asks_proxy = lower.contains("proxy")
813        || lower.contains("proxy setting")
814        || lower.contains("winhttp proxy")
815        || lower.contains("system proxy")
816        || (lower.contains("routed") && lower.contains("proxy"));
817    let asks_firewall_rules = (lower.contains("firewall")
818        && (lower.contains("rule")
819            || lower.contains("block")
820            || lower.contains("allow")
821            || lower.contains("inbound")
822            || lower.contains("outbound")))
823        || lower.contains("blocked port")
824        || lower.contains("firewall rule");
825    let asks_traceroute = lower.contains("traceroute")
826        || lower.contains("tracert")
827        || lower.contains("tracepath")
828        || lower.contains("trace route")
829        || lower.contains("trace the route")
830        || lower.contains("trace the path")
831        || lower.contains("network path")
832        || lower.contains("how many hops")
833        || lower.contains("where does traffic go")
834        || (lower.contains("trace") && lower.contains("hop"))
835        || (lower.contains("route") && lower.contains("traffic"))
836        || (lower.contains("trace") && lower.contains("8.8.8.8"))
837        || (lower.contains("path") && lower.contains("8.8.8.8"));
838    let asks_dns_cache = lower.contains("dns cache")
839        || lower.contains("cached dns")
840        || lower.contains("dns lookup cache")
841        || lower.contains("displaydns")
842        || lower.contains("/displaydns")
843        || lower.contains("get-dnsclientcache")
844        || lower.contains("dns entries")
845        || (lower.contains("dns") && lower.contains("cached"));
846    let asks_arp = lower.contains("arp -")
847        || lower.contains("arp table")
848        || lower.contains("arp cache")
849        || lower.contains("mac address")
850        || lower.contains("neighbor table")
851        || lower.contains("ip to mac")
852        || lower.contains("ip neigh")
853        || (lower.contains("arp")
854            && (lower.contains("who") || lower.contains("entry") || lower.contains("entries")));
855    let asks_route_table = lower.contains("route print")
856        || lower.contains("route table")
857        || lower.contains("routing table")
858        || lower.contains("get-netroute")
859        || lower.contains("default gateway")
860        || lower.contains("network routes")
861        || lower.contains("ip route")
862        || lower.contains("next hop")
863        || (lower.contains("route")
864            && (lower.contains("table") || lower.contains("entry") || lower.contains("entries")));
865    let asks_env = (lower.contains("environment variable")
866        || lower.contains("env var")
867        || lower.contains("env vars")
868        || lower.contains("show env")
869        || lower.contains("list env"))
870        && !lower.contains("env doctor");
871    let asks_hosts_file = lower.contains("hosts file")
872        || lower.contains("/etc/hosts")
873        || lower.contains("etc/hosts")
874        || lower.contains("hosts entry")
875        || lower.contains("hosts entries")
876        || (lower.contains("hosts")
877            && (lower.contains("redirect")
878                || lower.contains("block")
879                || lower.contains("loopback")));
880    let asks_docker = lower.contains("docker")
881        || lower.contains("container")
882        || lower.contains("docker compose")
883        || lower.contains("docker ps")
884        || lower.contains("running container");
885    let asks_wsl = lower.contains("wsl")
886        || lower.contains("windows subsystem")
887        || lower.contains("linux distro")
888        || lower.contains("ubuntu on windows")
889        || (lower.contains("subsystem") && lower.contains("linux"));
890    let asks_ssh = (lower.contains("ssh") && !lower.contains("ssh key") && !lower.contains("git"))
891        || lower.contains("sshd")
892        || lower.contains("ssh config")
893        || lower.contains("ssh server")
894        || lower.contains("ssh client")
895        || lower.contains("known_hosts")
896        || lower.contains("authorized_keys")
897        || lower.contains("ssh key")
898        || (lower.contains("ssh")
899            && (lower.contains("running")
900                || lower.contains("service")
901                || lower.contains("port 22")));
902    let asks_installed_software = lower.contains("installed software")
903        || lower.contains("installed program")
904        || lower.contains("installed app")
905        || lower.contains("installed package")
906        || lower.contains("what is installed")
907        || lower.contains("what's installed")
908        || lower.contains("winget list")
909        || lower.contains("list programs")
910        || (lower.contains("installed")
911            && (lower.contains("on this machine")
912                || lower.contains("on my machine")
913                || lower.contains("on my pc")));
914    let asks_databases = lower.contains("postgres")
915        || lower.contains("postgresql")
916        || lower.contains("mysql")
917        || lower.contains("mariadb")
918        || lower.contains("mongodb")
919        || lower.contains("mongo")
920        || lower.contains("redis")
921        || lower.contains("sql server")
922        || lower.contains("mssql")
923        || lower.contains("sqlite")
924        || lower.contains("elasticsearch")
925        || lower.contains("cassandra")
926        || lower.contains("couchdb")
927        || (lower.contains("database")
928            && (lower.contains("running")
929                || lower.contains("service")
930                || lower.contains("installed")
931                || lower.contains("up")
932                || lower.contains("local")))
933        || lower.contains("db service")
934        || lower.contains("database server")
935        || (lower.contains("is")
936            && lower.contains("running")
937            && (lower.contains("db") || lower.contains("database")));
938    let asks_git_config = (lower.contains("git config")
939        || lower.contains("git configuration")
940        || lower.contains("git global")
941        || (lower.contains("git") && lower.contains("user.name"))
942        || (lower.contains("git") && lower.contains("user.email"))
943        || (lower.contains("git") && lower.contains("signing"))
944        || (lower.contains("git") && lower.contains("credential"))
945        || lower.contains("git aliases"))
946        && !lower.contains("github");
947    let asks_audit_policy = lower.contains("audit policy")
948        || lower.contains("auditpol")
949        || lower.contains("audit log")
950        || lower.contains("what is being logged")
951        || lower.contains("security audit")
952        || lower.contains("logon event")
953        || lower.contains("audit category")
954        || lower.contains("event auditing");
955    let asks_shares = lower.contains("smb share")
956        || lower.contains("network share")
957        || lower.contains("shared folder")
958        || lower.contains("mapped drive")
959        || lower.contains("mapped network drive")
960        || lower.contains("get-smbshare")
961        || lower.contains("what is shared")
962        || lower.contains("what am i sharing")
963        || lower.contains("smb session")
964        || lower.contains("lanmanager")
965        || lower.contains("netlanmanager")
966        || lower.contains("smb1")
967        || lower.contains("smb signing")
968        || lower.contains("nfs export");
969    let asks_dns_servers = (lower.contains("dns server")
970        || lower.contains("dns resolver")
971        || lower.contains("nameserver")
972        || lower.contains("which dns")
973        || lower.contains("what dns")
974        || lower.contains("dns over https")
975        || lower.contains("doh")
976        || lower.contains("dns search suffix")
977        || lower.contains("configured dns")
978        || lower.contains("get-dnsclientserveraddress"))
979        && !lower.contains("dns cache");
980    let asks_bitlocker = lower.contains("bitlocker")
981        || (lower.contains("drive") && lower.contains("encrypt"))
982        || (lower.contains("disk") && lower.contains("encrypt"))
983        || lower.contains("encryption status");
984    let asks_rdp = lower.contains("rdp")
985        || lower.contains("remote desktop")
986        || (lower.contains("remote") && lower.contains("access") && !lower.contains("git"));
987    let asks_shadow_copies = lower.contains("shadow copy")
988        || lower.contains("shadow copies")
989        || lower.contains("vss")
990        || lower.contains("snapshot")
991        || lower.contains("restore point");
992    let asks_pagefile = lower.contains("pagefile")
993        || lower.contains("page file")
994        || lower.contains("virtual memory")
995        || lower.contains("swap file")
996        || (lower.contains("paging") && lower.contains("file"));
997    let asks_windows_features = (lower.contains("window") && lower.contains("feature"))
998        || lower.contains("optional feature")
999        || lower.contains("iis")
1000        || lower.contains("hyper-v")
1001        || (lower.contains("feature")
1002            && (lower.contains("install")
1003                || lower.contains("enabled")
1004                || lower.contains("turn on")));
1005    let asks_printers =
1006        lower.contains("printer") || lower.contains("print queue") || lower.contains("get-printer");
1007    let asks_winrm = lower.contains("winrm")
1008        || lower.contains("psremoting")
1009        || (lower.contains("ps") && lower.contains("remoting"))
1010        || (lower.contains("remote") && lower.contains("management") && !lower.contains("rdp"));
1011    let asks_network_stats = (lower.contains("network") && lower.contains("stat"))
1012        || (lower.contains("adapter") && lower.contains("stat"))
1013        || (lower.contains("nic") && lower.contains("stat"))
1014        || lower.contains("throughput")
1015        || lower.contains("packet loss")
1016        || lower.contains("dropped packet");
1017    let asks_udp_ports = lower.contains("udp port")
1018        || lower.contains("udp listener")
1019        || (lower.contains("udp")
1020            && (lower.contains("port") || lower.contains("listen") || lower.contains("open")));
1021
1022    // If the user has a clear mutation intent (create folder, edit file),
1023    // we should NOT route to a read-only host inspection topic, as that would
1024    // trigger a pre-run crash. The main LLM turn will handle the mutation.
1025    if asks_mutation_intent {
1026        return None;
1027    }
1028
1029    // Priority 1: High-Precision Enterprise Triage (IT Pro Plus)
1030    if asks_overclocker {
1031        Some("overclocker")
1032    } else if asks_ad_user {
1033        Some("ad_user")
1034    } else if asks_user_accounts {
1035        Some("user_accounts")
1036    } else if asks_dns_lookup {
1037        Some("dns_lookup")
1038    } else if asks_hyperv {
1039        Some("hyperv")
1040    } else if asks_ip_config {
1041        Some("ip_config")
1042    } else if asks_disk_benchmark {
1043        Some("disk_benchmark")
1044    } else if asks_fix_plan {
1045        Some("fix_plan")
1046    } else if asks_env_doctor {
1047        Some("env_doctor")
1048    } else if asks_overclocker {
1049        Some("overclocker")
1050    } else if asks_network_stats {
1051        Some("network_stats")
1052    } else if asks_share_access {
1053        Some("share_access")
1054    } else if asks_thermal {
1055        Some("thermal")
1056    } else if asks_activation {
1057        Some("activation")
1058    } else if asks_patch_history {
1059        Some("patch_history")
1060    } else if asks_storage {
1061        Some("storage")
1062    } else if asks_gpo {
1063        Some("gpo")
1064    } else if asks_certificates {
1065        Some("certificates")
1066    } else if asks_integrity {
1067        Some("integrity")
1068    } else if asks_domain {
1069        Some("domain")
1070    } else if asks_device_health {
1071        Some("device_health")
1072    } else if asks_drivers {
1073        Some("drivers")
1074    } else if asks_peripherals {
1075        Some("peripherals")
1076    } else if asks_user_accounts {
1077        Some("user_accounts")
1078    } else if asks_sessions {
1079        Some("sessions")
1080    } else if asks_virtualization {
1081        Some("hardware")
1082    } else if asks_services {
1083        Some("services")
1084    } else if asks_startup {
1085        Some("startup_items")
1086    } else if asks_bitlocker {
1087        Some("bitlocker")
1088    } else if asks_rdp {
1089        Some("rdp")
1090    } else if asks_shadow_copies {
1091        Some("shadow_copies")
1092    } else if asks_pagefile {
1093        Some("pagefile")
1094    } else if asks_windows_features {
1095        Some("windows_features")
1096    } else if asks_printers {
1097        Some("printers")
1098    } else if asks_winrm {
1099        Some("winrm")
1100    } else if (asks_path && asks_toolchains)
1101        || (mentions_host_inspection_question(&lower) && asks_broad_readiness)
1102    {
1103        Some("summary")
1104    } else if asks_env_doctor {
1105        Some("env_doctor")
1106    } else if asks_dns_servers {
1107        Some("dns_servers")
1108    } else if asks_connectivity {
1109        Some("connectivity")
1110    } else if asks_wifi {
1111        Some("wifi")
1112    } else if asks_connections {
1113        Some("connections")
1114    } else if asks_vpn {
1115        Some("vpn")
1116    } else if asks_proxy {
1117        Some("proxy")
1118    } else if asks_firewall_rules {
1119        Some("firewall_rules")
1120    } else if asks_traceroute {
1121        Some("traceroute")
1122    } else if asks_dns_cache {
1123        Some("dns_cache")
1124    } else if asks_arp {
1125        Some("arp")
1126    } else if asks_route_table {
1127        Some("route_table")
1128    } else if asks_network_stats {
1129        Some("network_stats")
1130    } else if asks_udp_ports {
1131        Some("udp_ports")
1132    } else if asks_shares {
1133        Some("shares")
1134    } else if asks_health_report {
1135        Some("health_report")
1136    } else if asks_os_config {
1137        Some("os_config")
1138    } else if asks_hardware || asks_virtualization {
1139        Some("hardware")
1140    } else if asks_network {
1141        Some("network")
1142    } else if asks_updates {
1143        Some("updates")
1144    } else if asks_audit_policy {
1145        Some("audit_policy")
1146    } else if asks_security {
1147        Some("security")
1148    } else if asks_pending_reboot {
1149        Some("pending_reboot")
1150    } else if asks_disk_health {
1151        Some("disk_health")
1152    } else if asks_battery {
1153        Some("battery")
1154    } else if asks_recent_crashes {
1155        Some("recent_crashes")
1156    } else if asks_log_check {
1157        Some("log_check")
1158    } else if asks_scheduled_tasks {
1159        Some("scheduled_tasks")
1160    } else if asks_dev_conflicts {
1161        Some("dev_conflicts")
1162    } else if asks_databases {
1163        Some("databases")
1164    } else if asks_docker {
1165        Some("docker")
1166    } else if asks_wsl {
1167        Some("wsl")
1168    } else if asks_ssh {
1169        Some("ssh")
1170    } else if asks_git_config {
1171        Some("git_config")
1172    } else if asks_installed_software {
1173        Some("installed_software")
1174    } else if asks_env {
1175        Some("env")
1176    } else if asks_hosts_file {
1177        Some("hosts_file")
1178    } else if asks_ports {
1179        Some("ports")
1180    } else if asks_processes {
1181        Some("processes")
1182    } else if asks_repo_doctor {
1183        Some("repo_doctor")
1184    } else if lower.contains("desktop") {
1185        Some("desktop")
1186    } else if lower.contains("downloads") {
1187        Some("downloads")
1188    } else if asks_path {
1189        Some("path")
1190    } else if asks_toolchains {
1191        Some("toolchains")
1192    } else if asks_resource_load {
1193        Some("resource_load")
1194    } else if asks_directory {
1195        Some("directory")
1196    } else if mentions_host_inspection_question(&lower) {
1197        Some("summary")
1198    } else {
1199        None
1200    }
1201}
1202
1203pub fn all_host_inspection_topics(user_input: &str) -> Vec<&'static str> {
1204    // All topic detectors in priority order — ordered so more specific topics come
1205    // before generic fallbacks (e.g. traceroute before network).
1206    let lower = user_input.to_lowercase();
1207    let mut topics: Vec<&'static str> = Vec::new();
1208
1209    let detectors: &[(&str, fn(&str) -> bool)] = &[
1210        ("overclocker", |l| {
1211            l.contains("overclocker")
1212                || l.contains("gpu clock")
1213                || l.contains("gpu throttle")
1214                || l.contains("throttle reason")
1215                || l.contains("root cause")
1216                || l.contains("nvidia stats")
1217                || l.contains("silicon health")
1218                || (l.contains("gpu")
1219                    && (l.contains("throttle")
1220                        || l.contains("bottleneck")
1221                        || l.contains("performance")))
1222        }),
1223        ("directory", |l| {
1224            (l.contains("make")
1225                || l.contains("create")
1226                || l.contains("mkdir")
1227                || l.contains("organize"))
1228                && (l.contains("folder")
1229                    || l.contains("directory")
1230                    || l.contains("project area")
1231                    || l.contains("desktop"))
1232        }),
1233        ("ad_user", |l| {
1234            l.contains("ad user")
1235                || l.contains("domain user")
1236                || (l.contains("user") && (l.contains("sid") || l.contains("membership")))
1237        }),
1238        ("dns_lookup", |l| {
1239            l.contains("dns lookup")
1240                || l.contains("dns record")
1241                || l.contains("dns query")
1242                || l.contains("nslookup")
1243                || l.contains(" dig ")
1244                || l.contains("srv record")
1245                || l.contains("mx record")
1246        }),
1247        ("hyperv", |l| {
1248            l.contains("hyper-v")
1249                || l.contains("hyperv")
1250                || (l.contains("virtual machine") && l.contains("load"))
1251                || l.contains("vmmem")
1252        }),
1253        ("ip_config", |l| {
1254            l.contains("ipconfig")
1255                || l.contains("ip config")
1256                || l.contains("adapter detail")
1257                || l.contains("dhcp lease")
1258        }),
1259        ("fix_plan", |l| {
1260            l.contains("fix")
1261                && (l.contains("cargo")
1262                    || l.contains("port ")
1263                    || l.contains("lm studio")
1264                    || l.contains("toolchain"))
1265        }),
1266        ("updates", |l| {
1267            l.contains("up to date")
1268                || l.contains("windows update")
1269                || l.contains("pending update")
1270                || l.contains("update available")
1271        }),
1272        ("security", |l| {
1273            l.contains("antivirus")
1274                || l.contains("defender")
1275                || l.contains("uac")
1276                || (l.contains("security") && !l.contains("git") && !l.contains("ssh"))
1277        }),
1278        ("permissions", |l| {
1279            l.contains("permission") || l.contains("access control") || l.contains("get-acl")
1280        }),
1281        ("login_history", |l| {
1282            l.contains("login history")
1283                || l.contains("logon history")
1284                || l.contains("event id 4624")
1285        }),
1286        ("registry_audit", |l| {
1287            l.contains("registry audit")
1288                || l.contains("persistence")
1289                || l.contains("ifeo")
1290                || l.contains("reg query")
1291        }),
1292        ("share_access", |l| {
1293            l.contains("share access")
1294                || l.contains("unc path")
1295                || l.contains("smbshare")
1296                || l.contains("net share")
1297        }),
1298        ("thermal", |l| {
1299            l.contains("thermal") || l.contains("throttling") || l.contains("overheating")
1300        }),
1301        ("overclocker", |l| {
1302            l.contains("overclocker")
1303                || l.contains("gpu clock")
1304                || l.contains("nvidia stats")
1305                || l.contains("silicon health")
1306                || l.contains("mhz")
1307        }),
1308        ("activation", |l| {
1309            l.contains("activation") || l.contains("slmgr") || l.contains("license status")
1310        }),
1311        ("patch_history", |l| {
1312            l.contains("patch history") || l.contains("hotfix") || l.contains("kb history")
1313        }),
1314        ("pending_reboot", |l| {
1315            l.contains("pending reboot")
1316                || l.contains("pending restart")
1317                || l.contains("need to restart")
1318                || l.contains("reboot required")
1319                || (l.contains("reboot") && l.contains("pending"))
1320                || (l.contains("restart") && l.contains("pending"))
1321        }),
1322        ("disk_health", |l| {
1323            l.contains("disk health")
1324                || l.contains("drive health")
1325                || l.contains("smart status")
1326                || (l.contains("healthy")
1327                    && (l.contains("drive") || l.contains("disk") || l.contains("ssd")))
1328        }),
1329        ("battery", |l| l.contains("battery")),
1330        ("recent_crashes", |l| {
1331            l.contains("crash") || l.contains("bsod") || l.contains("blue screen")
1332        }),
1333        ("scheduled_tasks", |l| {
1334            l.contains("scheduled task") || l.contains("task scheduler")
1335        }),
1336        ("ad_user", |l| {
1337            l.contains("ad user")
1338                || l.contains("domain user")
1339                || (l.contains("user") && l.contains("sid"))
1340        }),
1341        ("dns_lookup", |l| {
1342            l.contains("dns") && (l.contains("lookup") || l.contains("srv") || l.contains("mx"))
1343        }),
1344        ("hyperv", |l| {
1345            l.contains("hyper-v")
1346                || l.contains("hyperv")
1347                || (l.contains("list") && l.contains("vm"))
1348        }),
1349        ("ip_config", |l| {
1350            l.contains("ipconfig") && (l.contains("all") || l.contains("detail"))
1351        }),
1352        ("dev_conflicts", |l| {
1353            l.contains("dev conflict")
1354                || l.contains("toolchain conflict")
1355                || l.contains("duplicate path")
1356        }),
1357        ("storage", |l| {
1358            l.contains("disk space")
1359                || l.contains("storage")
1360                || l.contains("drive capacity")
1361                || l.contains("cache size")
1362                || l.contains("i/o pressure")
1363                || l.contains("disk usage")
1364        }),
1365        ("hardware", |l| {
1366            l.contains("cpu model")
1367                || l.contains("ram size")
1368                || l.contains("hardware spec")
1369                || (l.contains("what hardware") && l.contains("have"))
1370        }),
1371        ("health_report", |l| {
1372            l.contains("health report") || l.contains("system health")
1373        }),
1374        ("resource_load", |l| {
1375            l.contains("resource load")
1376                || l.contains("cpu load")
1377                || l.contains("ram %")
1378                || l.contains("cpu %")
1379                || l.contains("performance")
1380                || l.contains("slow")
1381                || l.contains("lag")
1382                || l.contains("sluggish")
1383                || l.contains("hang")
1384                || l.contains("unresponsive")
1385        }),
1386        ("processes", |l| {
1387            l.contains("process")
1388                || l.contains("task manager")
1389                || l.contains("what is running")
1390                || l.contains("using my ram")
1391                || l.contains("hitting the disk")
1392                || l.contains("disk thrasher")
1393        }),
1394        ("services", |l| {
1395            l.contains("service") || l.contains("daemon") || l.contains("windows service")
1396        }),
1397        ("ports", |l| {
1398            l.contains("listening port")
1399                || l.contains("open port")
1400                || l.contains("what is on port")
1401                || l.contains("port 3000")
1402                || (l.contains("listening") && l.contains("port"))
1403        }),
1404        ("traceroute", |l| {
1405            l.contains("traceroute")
1406                || l.contains("tracert")
1407                || l.contains("trace route")
1408                || l.contains("trace the path")
1409                || l.contains("network path")
1410                || l.contains("how many hops")
1411                || (l.contains("trace") && l.contains("hop"))
1412        }),
1413        ("dns_cache", |l| {
1414            l.contains("dns cache")
1415                || l.contains("cached dns")
1416                || l.contains("displaydns")
1417                || (l.contains("dns") && l.contains("cached"))
1418        }),
1419        ("arp", |l| {
1420            l.contains("arp table")
1421                || l.contains("arp cache")
1422                || l.contains("mac address")
1423                || l.contains("ip to mac")
1424                || l.contains("arp -")
1425        }),
1426        ("route_table", |l| {
1427            l.contains("route table")
1428                || l.contains("routing table")
1429                || l.contains("route print")
1430                || l.contains("network route")
1431                || l.contains("next hop")
1432        }),
1433        ("connectivity", |l| {
1434            l.contains("internet")
1435                || l.contains("am i connected")
1436                || l.contains("ping google")
1437                || l.contains("internet access")
1438                || l.contains("no internet")
1439        }),
1440        ("wifi", |l| {
1441            l.contains("wi-fi")
1442                || l.contains("wifi")
1443                || l.contains("wireless")
1444                || l.contains("ssid")
1445                || l.contains("signal strength")
1446        }),
1447        ("connections", |l| {
1448            l.contains("tcp connection")
1449                || l.contains("active connection")
1450                || l.contains("netstat")
1451                || l.contains("open socket")
1452                || (l.contains("established") && l.contains("connection"))
1453        }),
1454        ("vpn", |l| {
1455            l.contains("vpn") || l.contains("virtual private network")
1456        }),
1457        ("proxy", |l| {
1458            l.contains("proxy setting") || l.contains("system proxy") || l.contains("winhttp proxy")
1459        }),
1460        ("firewall_rules", |l| {
1461            (l.contains("firewall")
1462                && (l.contains("rule") || l.contains("inbound") || l.contains("outbound")))
1463                || l.contains("firewall rule")
1464        }),
1465        ("network", |l| {
1466            l.contains("network adapter")
1467                || l.contains("ip address")
1468                || l.contains("ipconfig")
1469                || l.contains("gateway")
1470                || l.contains("subnet")
1471        }),
1472        ("env_doctor", |l| {
1473            l.contains("env doctor")
1474                || l.contains("environment doctor")
1475                || l.contains("package manager")
1476                || l.contains("path drift")
1477        }),
1478        ("os_config", |l| {
1479            l.contains("power plan")
1480                || l.contains("uptime")
1481                || l.contains("boot time")
1482                || l.contains("last boot")
1483        }),
1484        ("overclocker", |l| {
1485            l.contains("overclocker")
1486                || l.contains("gpu clock")
1487                || l.contains("gpu throttle")
1488                || l.contains("nvidia stats")
1489                || l.contains("silicon health")
1490                || l.contains("mhz")
1491                || (l.contains("gpu") && (l.contains("throttle") || l.contains("bottleneck")))
1492        }),
1493        ("path", |l| {
1494            l.contains("path entries") || l.contains("raw path")
1495        }),
1496        ("toolchains", |l| {
1497            l.contains("developer tools")
1498                || l.contains("toolchains")
1499                || (l.contains("installed") && l.contains("version"))
1500        }),
1501        ("docker", |l| {
1502            l.contains("docker") || l.contains("container") || l.contains("running container")
1503        }),
1504        ("wsl", |l| {
1505            l.contains("wsl")
1506                || l.contains("windows subsystem")
1507                || (l.contains("subsystem") && l.contains("linux"))
1508        }),
1509        ("ssh", |l| {
1510            l.contains("ssh")
1511                || l.contains("sshd")
1512                || l.contains("known_hosts")
1513                || l.contains("authorized_keys")
1514        }),
1515        ("git_config", |l| {
1516            (l.contains("git config") || l.contains("git global") || l.contains("git aliases"))
1517                && !l.contains("github")
1518        }),
1519        ("installed_software", |l| {
1520            l.contains("installed software")
1521                || l.contains("installed program")
1522                || l.contains("what is installed")
1523                || l.contains("what's installed")
1524                || l.contains("winget list")
1525        }),
1526        ("env", |l| {
1527            (l.contains("environment variable") || l.contains("env var") || l.contains("env vars"))
1528                && !l.contains("env doctor")
1529        }),
1530        ("hosts_file", |l| {
1531            l.contains("hosts file") || l.contains("/etc/hosts") || l.contains("hosts entry")
1532        }),
1533        ("databases", |l| {
1534            l.contains("postgres")
1535                || l.contains("mysql")
1536                || l.contains("mariadb")
1537                || l.contains("mongodb")
1538                || l.contains("redis")
1539                || l.contains("sqlite")
1540                || l.contains("sql server")
1541                || l.contains("elasticsearch")
1542                || (l.contains("database") && (l.contains("running") || l.contains("service")))
1543        }),
1544        ("user_accounts", |l| {
1545            l.contains("local user")
1546                || l.contains("user account")
1547                || l.contains("who is logged")
1548                || l.contains("who am i")
1549                || l.contains("logged in as")
1550                || l.contains("admin group")
1551                || l.contains("local admin")
1552                || l.contains("active sessions")
1553                || l.contains("running as admin")
1554        }),
1555        ("audit_policy", |l| {
1556            l.contains("audit policy")
1557                || l.contains("auditpol")
1558                || l.contains("what is being logged")
1559                || l.contains("security audit")
1560                || l.contains("event auditing")
1561        }),
1562        ("shares", |l| {
1563            l.contains("smb share")
1564                || l.contains("network share")
1565                || l.contains("shared folder")
1566                || l.contains("mapped drive")
1567                || l.contains("smb1")
1568                || l.contains("nfs export")
1569        }),
1570        ("dns_servers", |l| {
1571            (l.contains("dns server")
1572                || l.contains("dns resolver")
1573                || l.contains("nameserver")
1574                || l.contains("which dns")
1575                || l.contains("dns over https")
1576                || l.contains("configured dns"))
1577                && !l.contains("dns cache")
1578        }),
1579        ("bitlocker", |l| {
1580            l.contains("bitlocker")
1581                || (l.contains("drive") && l.contains("encrypt"))
1582                || (l.contains("disk") && l.contains("encrypt"))
1583                || l.contains("encryption status")
1584        }),
1585        ("rdp", |l| {
1586            l.contains("rdp")
1587                || l.contains("remote desktop")
1588                || (l.contains("remote") && l.contains("access") && !l.contains("git"))
1589        }),
1590        ("shadow_copies", |l| {
1591            l.contains("shadow copy")
1592                || l.contains("shadow copies")
1593                || l.contains("vss")
1594                || l.contains("snapshot")
1595                || l.contains("restore point")
1596        }),
1597        ("pagefile", |l| {
1598            l.contains("pagefile")
1599                || l.contains("page file")
1600                || l.contains("virtual memory")
1601                || l.contains("swap file")
1602        }),
1603        ("windows_features", |l| {
1604            (l.contains("window") && l.contains("feature"))
1605                || l.contains("optional feature")
1606                || l.contains("iis")
1607                || l.contains("hyper-v")
1608                || (l.contains("feature") && (l.contains("install") || l.contains("enabled")))
1609        }),
1610        ("printers", |l| {
1611            l.contains("printer") || l.contains("print queue") || l.contains("get-printer")
1612        }),
1613        ("winrm", |l| {
1614            l.contains("winrm")
1615                || l.contains("psremoting")
1616                || (l.contains("remote") && l.contains("management") && !l.contains("rdp"))
1617        }),
1618        ("network_stats", |l| {
1619            (l.contains("network") && l.contains("stat"))
1620                || (l.contains("adapter") && l.contains("stat"))
1621                || l.contains("throughput")
1622                || l.contains("packet loss")
1623                || l.contains("dropped packet")
1624        }),
1625        ("startup_items", |l| {
1626            l.contains("startup") || l.contains("boot program") || l.contains("autorun")
1627        }),
1628        ("udp_ports", |l| {
1629            l.contains("udp port")
1630                || l.contains("udp listener")
1631                || (l.contains("udp") && l.contains("listening"))
1632        }),
1633        ("gpo", |l| {
1634            l.contains("gpo") || l.contains("group policy") || l.contains("gpresult")
1635        }),
1636        ("certificates", |l| {
1637            l.contains("cert") || l.contains("ssl") || l.contains("thumbprint")
1638        }),
1639        ("integrity", |l| {
1640            l.contains("integrity") || l.contains("sfc") || l.contains("dism")
1641        }),
1642        ("domain", |l| {
1643            l.contains("domain")
1644                || l.contains("workgroup")
1645                || l.contains("netbios")
1646                || l.contains("active directory")
1647        }),
1648        ("device_health", |l| {
1649            l.contains("device health")
1650                || l.contains("hardware error")
1651                || l.contains("yellow bang")
1652                || l.contains("malfunctioning")
1653        }),
1654        ("drivers", |l| {
1655            l.contains("driver") || l.contains("system driver")
1656        }),
1657        ("peripherals", |l| {
1658            l.contains("peripheral")
1659                || l.contains("usb")
1660                || l.contains("keyboard")
1661                || l.contains("mouse")
1662                || l.contains("monitor")
1663        }),
1664        ("sessions", |l| {
1665            l.contains("session") || l.contains("who is logged") || l.contains("active login")
1666        }),
1667        ("hardware", |l| {
1668            l.contains("virtualization")
1669                || l.contains("hypervisor")
1670                || l.contains("vt-x")
1671                || l.contains("slat")
1672        }),
1673    ];
1674
1675    for (topic, check) in detectors {
1676        if check(&lower) && !topics.contains(topic) {
1677            topics.push(topic);
1678        }
1679    }
1680    topics
1681}
1682
1683pub(crate) fn preferred_maintainer_workflow(user_input: &str) -> Option<&'static str> {
1684    let lower = user_input.to_ascii_lowercase();
1685    let asks_cleanup = contains_any(
1686        &lower,
1687        &[
1688            "run my cleanup",
1689            "run the cleanup",
1690            "run cleanup",
1691            "deep clean",
1692            "prune dist",
1693            "clean.ps1",
1694            "cleanup script",
1695            "cleanup workflow",
1696            "clean up scripts",
1697        ],
1698    );
1699    let asks_package = contains_any(
1700        &lower,
1701        &[
1702            "rebuild local portable",
1703            "rebuild the portable",
1704            "run the local build",
1705            "run the portable",
1706            "package-windows.ps1",
1707            "package windows",
1708            "build installer",
1709            "overwrite the portable",
1710            "refresh the portable",
1711            "update path",
1712            "update path with the portable",
1713        ],
1714    );
1715    let asks_release = contains_any(
1716        &lower,
1717        &[
1718            "run the release flow",
1719            "regular workflow",
1720            "cut the release",
1721            "ship it",
1722            "release.ps1",
1723            "bump to ",
1724            "tag it",
1725            "full tag and everything",
1726            "publish crates",
1727        ],
1728    );
1729
1730    if asks_cleanup {
1731        Some("clean")
1732    } else if asks_package {
1733        Some("package_windows")
1734    } else if asks_release {
1735        Some("release")
1736    } else {
1737        None
1738    }
1739}
1740
1741pub fn mentions_symbol_search(user_input: &str) -> bool {
1742    let lower = user_input.to_lowercase();
1743    contains_any(
1744        &lower,
1745        &[
1746            "find where",
1747            "who calls",
1748            "who uses",
1749            "where is",
1750            "is defined",
1751            "is used",
1752            "find definition",
1753            "find references",
1754            "go to definition",
1755        ],
1756    ) && contains_any(
1757        &lower,
1758        &[
1759            "function", "struct", "variable", "symbol", "method", "type", "trait", "module",
1760        ],
1761    )
1762}
1763
1764pub fn mentions_commit_intent(user_input: &str) -> bool {
1765    let lower = user_input.to_lowercase();
1766    contains_any(
1767        &lower,
1768        &[
1769            "git commit",
1770            "commit my",
1771            "commit the",
1772            "commit changes",
1773            "save my progress to git",
1774        ],
1775    )
1776}
1777
1778pub fn preferred_workspace_workflow(user_input: &str) -> Option<&'static str> {
1779    let lower = user_input.to_ascii_lowercase();
1780    let asks_project_scope = contains_any(
1781        &lower,
1782        &[
1783            "this repo",
1784            "this repository",
1785            "this project",
1786            "current project",
1787            "current repo",
1788            "workspace",
1789            "in this folder",
1790            "here",
1791        ],
1792    );
1793    let asks_build = contains_any(
1794        &lower,
1795        &[
1796            "run the build",
1797            "build this project",
1798            "build this repo",
1799            "run build",
1800            "compile this project",
1801            "cargo build",
1802            "npm run build",
1803            "pnpm run build",
1804            "yarn build",
1805            "go build",
1806            "gradlew build",
1807        ],
1808    );
1809    let asks_test = contains_any(
1810        &lower,
1811        &[
1812            "run the tests",
1813            "run tests",
1814            "test this project",
1815            "test this repo",
1816            "run the test suite",
1817            "cargo test",
1818            "npm test",
1819            "pnpm test",
1820            "yarn test",
1821            "pytest",
1822            "go test",
1823            "gradlew test",
1824        ],
1825    );
1826    let asks_lint = contains_any(
1827        &lower,
1828        &[
1829            "run lint",
1830            "lint this project",
1831            "lint this repo",
1832            "cargo clippy",
1833            "npm run lint",
1834            "pnpm run lint",
1835            "yarn lint",
1836        ],
1837    );
1838    let asks_fix = contains_any(
1839        &lower,
1840        &[
1841            "run fix",
1842            "fix formatting",
1843            "run formatter",
1844            "cargo fmt",
1845            "npm run fix",
1846            "pnpm run fix",
1847            "yarn fix",
1848        ],
1849    );
1850    let asks_script = {
1851        let is_make_file_op = lower.contains("make a folder")
1852            || lower.contains("make a directory")
1853            || lower.contains("make a file")
1854            || lower.contains("make a hello.txt")
1855            || lower.contains("make x");
1856
1857        let has_script_keyword = contains_any(
1858            &lower,
1859            &[
1860                "npm run ",
1861                "pnpm run ",
1862                "yarn ",
1863                "bun run ",
1864                "make ",
1865                "just ",
1866                "task ",
1867                "scripts/",
1868                ".\\scripts\\",
1869                "./scripts/",
1870                ".ps1",
1871                ".sh",
1872                ".py",
1873                ".cmd",
1874                ".bat",
1875            ],
1876        );
1877
1878        has_script_keyword && !is_make_file_op
1879    };
1880
1881    if mentions_symbol_search(user_input) {
1882        Some("lsp_search")
1883    } else if mentions_commit_intent(user_input) {
1884        Some("commit_workflow")
1885    } else if asks_build
1886        && (asks_project_scope
1887            || !contains_any(&lower, &["release.ps1", "package-windows.ps1", "clean.ps1"]))
1888    {
1889        Some("build")
1890    } else if asks_test && asks_project_scope {
1891        Some("test")
1892    } else if asks_lint && asks_project_scope {
1893        Some("lint")
1894    } else if asks_fix && asks_project_scope {
1895        Some("fix")
1896    } else if asks_script && !preferred_maintainer_workflow(user_input).is_some() {
1897        Some("script")
1898    } else if (asks_test || asks_lint || asks_fix)
1899        && !preferred_maintainer_workflow(user_input).is_some()
1900    {
1901        Some(if asks_test {
1902            "test"
1903        } else if asks_lint {
1904            "lint"
1905        } else {
1906            "fix"
1907        })
1908    } else {
1909        None
1910    }
1911}
1912
1913pub(crate) fn looks_like_mutation_request(user_input: &str) -> bool {
1914    let lower = user_input.to_lowercase();
1915    [
1916        "fix ",
1917        "change ",
1918        "edit ",
1919        "modify ",
1920        "update ",
1921        "rename ",
1922        "refactor ",
1923        "patch ",
1924        "rewrite ",
1925        "implement ",
1926        "create a file",
1927        "create file",
1928        "add a file",
1929        "delete ",
1930        "remove ",
1931        "make the change",
1932        "mkdir ",
1933        "touch ",
1934        "create a folder",
1935        "create folder",
1936        "new folder",
1937        "new file",
1938        "write to",
1939        "save this",
1940        "commit ",
1941        "move-item",
1942        "remove-item",
1943        "copy-item",
1944        "rmdir",
1945        "mv ",
1946        "rm ",
1947        "cp ",
1948        "set-content",
1949        "add-content",
1950    ]
1951    .iter()
1952    .any(|needle| lower.contains(needle))
1953}
1954
1955pub(crate) fn is_sovereign_mutation(user_input: &str) -> bool {
1956    let lower = user_input.to_lowercase();
1957    let mentions_location = contains_any(
1958        &lower,
1959        &[
1960            "desktop",
1961            "documents",
1962            "downloads",
1963            "pictures",
1964            "images",
1965            "videos",
1966            "movies",
1967            "music",
1968            "audio",
1969            "temp",
1970            "cache",
1971            "config",
1972            "appdata",
1973        ],
1974    );
1975    let mentions_simple_creation = (lower.contains("make")
1976        || lower.contains("create")
1977        || lower.contains("add")
1978        || lower.contains("new")
1979        || lower.contains("mkdir")
1980        || lower.contains("generate"))
1981        && (lower.contains("folder")
1982            || lower.contains("directory")
1983            || lower.contains("project area")
1984            || lower.contains("file"));
1985
1986    mentions_location && mentions_simple_creation
1987}
1988
1989pub fn classify_query_intent(workflow_mode: WorkflowMode, user_input: &str) -> QueryIntent {
1990    let lower = user_input.to_lowercase();
1991    let trimmed = user_input.trim().to_ascii_lowercase();
1992
1993    let mentions_runtime_trace = contains_any(
1994        &lower,
1995        &[
1996            "trace",
1997            "how does",
1998            "what are the main runtime subsystems",
1999            "how does a user message move",
2000            "separate normal assistant output",
2001            "session reset behavior",
2002            "file references",
2003            "event types",
2004            "channels",
2005        ],
2006    );
2007    let anti_guess = contains_any(&lower, &["do not guess", "if you are unsure"]);
2008    let capability_mode = mentions_capability_question(&lower);
2009    let capability_needs_repo =
2010        capability_mode && capability_question_requires_repo_inspection(&lower);
2011    let host_inspection_mode = preferred_host_inspection_topic(&lower).is_some();
2012    let maintainer_workflow_mode = preferred_maintainer_workflow(&lower).is_some();
2013    let workspace_workflow_mode =
2014        preferred_workspace_workflow(&lower).is_some() && !maintainer_workflow_mode;
2015    let toolchain_mode = contains_any(
2016        &lower,
2017        &[
2018            "tooling discipline",
2019            "best read-only toolchain",
2020            "identify the best tools you actually have",
2021            "concrete read-only investigation plan",
2022            "do not execute the plan",
2023            "available repo-inspection tools",
2024            "tool choice discipline",
2025            "what tools would you choose first",
2026        ],
2027    ) || (lower.contains("which tools") && lower.contains("why"))
2028        || (lower.contains("when would you choose") && lower.contains("tool"));
2029    let architecture_overview_mode = {
2030        let architecture_signals = contains_any(
2031            &lower,
2032            &[
2033                "architecture overview",
2034                "architecture walkthrough",
2035                "full architecture",
2036                "runtime walkthrough",
2037                "control flow",
2038                "tool routing",
2039                "workflow modes",
2040                "repo map behavior",
2041                "mcp policy",
2042                "prompt budgeting",
2043                "compaction",
2044                "file ownership",
2045                "owner file",
2046                "project structure",
2047                "repository structure",
2048            ],
2049        );
2050        let broad = contains_any(
2051            &lower,
2052            &[
2053                "full detailed",
2054                "all in one answer",
2055                "concrete file ownership",
2056                "walk me through",
2057                "major runtime pieces",
2058                "which files own",
2059                "how",
2060                "explain",
2061                "overview",
2062            ],
2063        );
2064        (architecture_signals && broad)
2065            || (lower.contains("runtime")
2066                && lower.contains("workflow")
2067                && (lower.contains("architecture") || lower.contains("tool routing")))
2068            || mentions_broad_system_walkthrough(&lower)
2069    };
2070
2071    let direct_answer = if trimmed == "/about" || mentions_creator_question(&lower) {
2072        Some(DirectAnswerKind::About)
2073    } else if matches!(
2074        trimmed.as_str(),
2075        "who are you" | "who are you?" | "what are you" | "what are you?"
2076    ) || (lower.contains("what is hematite") && !lower.contains("lm studio"))
2077    {
2078        Some(DirectAnswerKind::Identity)
2079    } else if (mentions_stable_product_surface(&lower) || mentions_product_truth_routing(&lower))
2080        && contains_any(
2081            &lower,
2082            &[
2083                "how hematite answers",
2084                "how does hematite answer",
2085                "how hematite handles",
2086                "how does hematite handle",
2087                "how hematite decides",
2088                "how does hematite decide",
2089                "decides whether",
2090                "decide whether",
2091            ],
2092        )
2093    {
2094        Some(DirectAnswerKind::ProductSurface)
2095    } else if mentions_reset_commands(&lower)
2096        && contains_any(
2097            &lower,
2098            &[
2099                "exact difference",
2100                "difference between",
2101                "explain the exact difference",
2102                "what is the difference",
2103            ],
2104        )
2105    {
2106        Some(DirectAnswerKind::SessionResetSemantics)
2107    } else if (lower.contains("reasoning output") || lower.contains("reasoning"))
2108        && contains_any(
2109            &lower,
2110            &["visible chat output", "visible chat", "chat output"],
2111        )
2112    {
2113        Some(DirectAnswerKind::ReasoningSplit)
2114    } else if lower.contains("/ask")
2115        && lower.contains("/code")
2116        && lower.contains("/architect")
2117        && lower.contains("/read-only")
2118        && lower.contains("/auto")
2119        && contains_any(&lower, &["difference", "differences", "what are"])
2120    {
2121        Some(DirectAnswerKind::WorkflowModes)
2122    } else if lower.contains(".hematite/settings.json")
2123        && lower.contains("gemma_native_auto")
2124        && lower.contains("gemma_native_formatting")
2125    {
2126        Some(DirectAnswerKind::GemmaNativeSettings)
2127    } else if contains_any(
2128        &lower,
2129        &[
2130            "skip verification",
2131            "skip build verification",
2132            "commit it immediately",
2133            "commit immediately",
2134        ],
2135    ) && contains_any(
2136        &lower,
2137        &[
2138            "make a code change",
2139            "make the change",
2140            "change the code",
2141            "edit the code",
2142            "edit a file",
2143            "implement",
2144        ],
2145    ) {
2146        Some(DirectAnswerKind::UnsafeWorkflowPressure)
2147    } else if contains_any(&lower, &["/gemma-native", "gemma native"])
2148        && contains_any(&lower, &["what does", "what is", "how does", "what do"])
2149    {
2150        Some(DirectAnswerKind::GemmaNative)
2151    } else if lower.contains("verify_build")
2152        && lower.contains(".hematite/settings.json")
2153        && contains_any(
2154            &lower,
2155            &["build", "test", "lint", "fix", "verification commands"],
2156        )
2157    {
2158        Some(DirectAnswerKind::VerifyProfiles)
2159    } else if (lower.contains("carry forward by default")
2160        || lower.contains("session memory should you carry forward")
2161        || (lower.contains("carry forward")
2162            && contains_any(
2163                &lower,
2164                &[
2165                    "besides the active task",
2166                    "blocker",
2167                    "compacts",
2168                    "recovers from a blocker",
2169                    "session state",
2170                ],
2171            )))
2172        && contains_any(
2173            &lower,
2174            &[
2175                "restarted hematite",
2176                "restarted",
2177                "avoid carrying forward",
2178                "session state",
2179                "active task",
2180                "blocker",
2181                "compacts",
2182                "recovers from a blocker",
2183            ],
2184        )
2185    {
2186        Some(DirectAnswerKind::SessionMemory)
2187    } else if contains_any(
2188        &lower,
2189        &[
2190            "recovery recipe",
2191            "recovery recipes",
2192            "recovery step",
2193            "recovery steps",
2194        ],
2195    ) && contains_any(
2196        &lower,
2197        &[
2198            "blocker",
2199            "runtime failure",
2200            "degrades",
2201            "context window",
2202            "context-window",
2203            "operator",
2204        ],
2205    ) {
2206        Some(DirectAnswerKind::RecoveryRecipes)
2207    } else if !architecture_overview_mode
2208        && contains_any(
2209            &lower,
2210            &[
2211                "mcp server health",
2212                "mcp runtime state",
2213                "mcp lifecycle",
2214                "mcp state",
2215                "mcp healthy",
2216                "mcp degraded",
2217                "mcp failed",
2218            ],
2219        )
2220    {
2221        Some(DirectAnswerKind::McpLifecycle)
2222    } else if contains_any(
2223        &lower,
2224        &[
2225            "allowed, denied, or require approval",
2226            "allowed denied or require approval",
2227            "allow, ask, or deny",
2228            "tool call should be allowed",
2229            "authorization logic",
2230            "workspace trust",
2231            "trust-allowlisted",
2232        ],
2233    ) {
2234        Some(DirectAnswerKind::AuthorizationPolicy)
2235    } else if contains_any(
2236        &lower,
2237        &[
2238            "tool classes",
2239            "tool class",
2240            "flat tool list",
2241            "runtime tool classes",
2242            "different runtime tool classes",
2243        ],
2244    ) || (lower.contains("repo reads")
2245        && lower.contains("repo writes")
2246        && contains_any(
2247            &lower,
2248            &[
2249                "verification tools",
2250                "git tools",
2251                "external mcp tools",
2252                "different runtime",
2253            ],
2254        ))
2255    {
2256        Some(DirectAnswerKind::ToolClasses)
2257    } else if contains_any(
2258        &lower,
2259        &[
2260            "built-in tool catalog",
2261            "builtin tool catalog",
2262            "builtin-tool dispatch",
2263            "built-in tool dispatch",
2264            "tool registry ownership",
2265            "which file now owns",
2266        ],
2267    ) && contains_any(
2268        &lower,
2269        &[
2270            "tool catalog",
2271            "dispatch path",
2272            "dispatch",
2273            "tool registry",
2274            "owns",
2275        ],
2276    ) {
2277        Some(DirectAnswerKind::ToolRegistryOwnership)
2278    } else if (lower.contains("other coding languages")
2279        || lower.contains("what languages")
2280        || lower.contains("know other languages"))
2281        && contains_any(
2282            &lower,
2283            &[
2284                "capable of making projects",
2285                "can you make projects",
2286                "can you build projects",
2287            ],
2288        )
2289    {
2290        Some(DirectAnswerKind::LanguageCapability)
2291    } else if workflow_mode == WorkflowMode::Architect
2292        && (lower.contains("session reset")
2293            || (lower.contains("/clear") && lower.contains("/new") && lower.contains("/forget")))
2294        && contains_any(&lower, &["redesign", "clearer", "easier", "understand"])
2295    {
2296        Some(DirectAnswerKind::ArchitectSessionResetPlan)
2297    } else if toolchain_mode
2298        && lower.contains("read-only")
2299        && contains_any(
2300            &lower,
2301            &[
2302                "tooling discipline",
2303                "investigation plan",
2304                "best read-only toolchain",
2305                "tool choice discipline",
2306                "what tools would you choose first",
2307            ],
2308        )
2309    {
2310        Some(DirectAnswerKind::Toolchain)
2311    } else if host_inspection_mode && mentions_host_inspection_question(&lower) {
2312        Some(DirectAnswerKind::HostInspection)
2313    } else {
2314        None
2315    };
2316
2317    let sovereign_mode = is_sovereign_mutation(user_input);
2318
2319    let primary_class = if direct_answer.is_some()
2320        || mentions_stable_product_surface(&lower)
2321        || mentions_product_truth_routing(&lower)
2322    {
2323        QueryIntentClass::ProductTruth
2324    } else if architecture_overview_mode {
2325        QueryIntentClass::RepoArchitecture
2326    } else if toolchain_mode {
2327        QueryIntentClass::Toolchain
2328    } else if capability_mode {
2329        QueryIntentClass::Capability
2330    } else if mentions_runtime_trace || anti_guess || lower.contains("read-only") {
2331        QueryIntentClass::RuntimeDiagnosis
2332    } else if looks_like_mutation_request(user_input) {
2333        QueryIntentClass::Implementation
2334    } else {
2335        QueryIntentClass::Unknown
2336    };
2337
2338    QueryIntent {
2339        primary_class,
2340        direct_answer,
2341        grounded_trace_mode: mentions_runtime_trace || lower.contains("read-only") || anti_guess,
2342        capability_mode,
2343        capability_needs_repo,
2344        toolchain_mode,
2345        host_inspection_mode,
2346        maintainer_workflow_mode: maintainer_workflow_mode && !sovereign_mode,
2347        workspace_workflow_mode: workspace_workflow_mode && !sovereign_mode,
2348        architecture_overview_mode,
2349        sovereign_mode,
2350        surgical_filesystem_mode: is_simple_surgical_filesystem_request(user_input),
2351    }
2352}
2353
2354fn is_simple_surgical_filesystem_request(user_input: &str) -> bool {
2355    let lower = user_input.to_lowercase();
2356    let mentions_creation = contains_any(
2357        &lower,
2358        &[
2359            "make a folder",
2360            "make a directory",
2361            "make a file",
2362            "create a folder",
2363            "create a directory",
2364            "create a file",
2365            "new folder",
2366            "new directory",
2367        ],
2368    );
2369    let mentions_sovereign = contains_any(
2370        &lower,
2371        &[
2372            "@desktop",
2373            "@documents",
2374            "@downloads",
2375            "@home",
2376            "~/",
2377            "@temp",
2378        ],
2379    );
2380
2381    mentions_creation || mentions_sovereign
2382}
2383
2384pub(crate) fn is_capability_probe_tool(name: &str) -> bool {
2385    matches!(
2386        name,
2387        "read_file"
2388            | "inspect_lines"
2389            | "list_files"
2390            | "grep_files"
2391            | "lsp_definitions"
2392            | "lsp_references"
2393            | "lsp_hover"
2394            | "lsp_search_symbol"
2395            | "lsp_get_diagnostics"
2396            | "trace_runtime_flow"
2397            | "auto_pin_context"
2398            | "list_pinned"
2399    )
2400}
2401
2402/// Returns true when the user's query involves computation that must be exact —
2403/// checksums, financial math, statistics, date arithmetic, algorithmic verification, etc.
2404/// Used by the harness to inject a pre-turn nudge toward run_code instead of model memory.
2405pub fn needs_computation_sandbox(user_input: &str) -> bool {
2406    let lower = user_input.to_lowercase();
2407    let hash_or_checksum = lower.contains("sha")
2408        || lower.contains("md5")
2409        || lower.contains("checksum")
2410        || lower.contains("crc")
2411        || lower.contains("hash")
2412        || lower.contains("fingerprint");
2413    let financial =
2414        (lower.contains("calculat") || lower.contains("compute") || lower.contains("what is"))
2415            && (lower.contains("percent")
2416                || lower.contains("%")
2417                || lower.contains("interest")
2418                || lower.contains("compound")
2419                || lower.contains("roi")
2420                || lower.contains("tax")
2421                || lower.contains("discount")
2422                || lower.contains("profit")
2423                || lower.contains("loss"));
2424    let statistics = lower.contains("standard deviation")
2425        || lower.contains("std dev")
2426        || lower.contains("mean of")
2427        || lower.contains("median of")
2428        || lower.contains("average of")
2429        || lower.contains("variance")
2430        || lower.contains("regression")
2431        || lower.contains("correlation");
2432    let date_math = (lower.contains("how many days")
2433        || lower.contains("days between")
2434        || lower.contains("days until")
2435        || lower.contains("days since")
2436        || lower.contains("unix timestamp")
2437        || lower.contains("epoch")
2438        || lower.contains("time zone")
2439        || lower.contains("timezone"))
2440        && (lower.contains("date")
2441            || lower.contains("day")
2442            || lower.contains("timestamp")
2443            || lower.contains("time"));
2444    let algorithmic = lower.contains("is prime")
2445        || lower.contains("prime number")
2446        || lower.contains("factori")
2447        || lower.contains("fibonacci")
2448        || lower.contains("factorial")
2449        || lower.contains("sort this")
2450        || lower.contains("verify this algorithm")
2451        || lower.contains("run this code")
2452        || lower.contains("execute this");
2453    let unit_conversion = (lower.contains("convert") || lower.contains("how many"))
2454        && (lower.contains(" bytes")
2455            || lower.contains(" kb")
2456            || lower.contains(" mb")
2457            || lower.contains(" gb")
2458            || lower.contains(" tb")
2459            || lower.contains("gigabyte")
2460            || lower.contains("megabyte")
2461            || lower.contains("celsius")
2462            || lower.contains("fahrenheit")
2463            || lower.contains("kelvin")
2464            || lower.contains("kilometers")
2465            || lower.contains("miles")
2466            || lower.contains("pounds")
2467            || lower.contains("kilograms"));
2468    hash_or_checksum || financial || statistics || date_math || algorithmic || unit_conversion
2469}
2470
2471#[cfg(test)]
2472mod tests {
2473    use super::*;
2474
2475    #[test]
2476    fn classify_query_intent_routes_creator_questions_to_about() {
2477        let intent = classify_query_intent(WorkflowMode::Auto, "Who created Hematite?");
2478        assert_eq!(intent.direct_answer, Some(DirectAnswerKind::About));
2479
2480        let intent = classify_query_intent(WorkflowMode::Auto, "/about");
2481        assert_eq!(intent.direct_answer, Some(DirectAnswerKind::About));
2482    }
2483
2484    #[test]
2485    fn classify_query_intent_marks_maintainer_workflow_requests() {
2486        let intent = classify_query_intent(
2487            WorkflowMode::Auto,
2488            "Run my cleanup scripts and prune old artifacts.",
2489        );
2490        assert!(intent.maintainer_workflow_mode);
2491        assert_eq!(
2492            preferred_maintainer_workflow("Rebuild the local portable and update PATH."),
2493            Some("package_windows")
2494        );
2495        assert_eq!(
2496            preferred_maintainer_workflow("Run the release flow and publish crates."),
2497            Some("release")
2498        );
2499    }
2500
2501    #[test]
2502    fn classify_query_intent_marks_workspace_workflow_requests() {
2503        let intent = classify_query_intent(WorkflowMode::Auto, "Run the tests in this project.");
2504        assert!(intent.workspace_workflow_mode);
2505        assert_eq!(
2506            preferred_workspace_workflow("Run the tests in this project."),
2507            Some("test")
2508        );
2509        assert_eq!(
2510            preferred_workspace_workflow("Run npm run dev in this repo."),
2511            Some("script")
2512        );
2513    }
2514
2515    #[test]
2516    fn test_overclocker_routing() {
2517        assert_eq!(
2518            preferred_host_inspection_topic("How's my silicon health looking?"),
2519            Some("overclocker")
2520        );
2521        assert_eq!(
2522            preferred_host_inspection_topic("Show me GPU clocks"),
2523            Some("overclocker")
2524        );
2525        assert_eq!(
2526            preferred_host_inspection_topic("nvidia stats"),
2527            Some("overclocker")
2528        );
2529    }
2530
2531    #[test]
2532    fn test_gpu_throttle_routing() {
2533        assert_eq!(
2534            preferred_host_inspection_topic("Is my GPU currently throttled and why?"),
2535            Some("overclocker")
2536        );
2537        assert_eq!(
2538            preferred_host_inspection_topic("Tell me if my GPU is throttled"),
2539            Some("overclocker")
2540        );
2541        assert_eq!(
2542            preferred_host_inspection_topic("Is the GPU overheating?"),
2543            Some("overclocker")
2544        );
2545    }
2546
2547    #[test]
2548    fn test_host_inspection_gateway() {
2549        assert!(mentions_host_inspection_question("is my gpu throttled?"));
2550        assert!(mentions_host_inspection_question(
2551            "check vram and silicon health"
2552        ));
2553        assert!(mentions_host_inspection_question("nvidia stats"));
2554
2555        // Negative tests: General coding/repo questions should NOT trigger the gate
2556        assert!(!mentions_host_inspection_question("What is a Rust macro?"));
2557        assert!(!mentions_host_inspection_question(
2558            "Explain the repository structure."
2559        ));
2560        assert!(!mentions_host_inspection_question("how do I build this?"));
2561        assert!(!mentions_host_inspection_question(
2562            "is this code efficient?"
2563        ));
2564    }
2565}