hematite/agent/

routing.rs

use super::conversation::WorkflowMode;

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum QueryIntentClass {
    ProductTruth,
    RuntimeDiagnosis,
    RepoArchitecture,
    Toolchain,
    Capability,
    Implementation,
    Research,
    Unknown,
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum DirectAnswerKind {
    About,
    LanguageCapability,
    UnsafeWorkflowPressure,
    SessionMemory,
    RecoveryRecipes,
    McpLifecycle,
    AuthorizationPolicy,
    ToolClasses,
    ToolRegistryOwnership,
    SessionResetSemantics,
    ProductSurface,
    ReasoningSplit,
    Identity,
    WorkflowModes,
    GemmaNative,
    GemmaNativeSettings,
    VerifyProfiles,
    Toolchain,
    HostInspection,
    ArchitectSessionResetPlan,
    Help,
}

#[derive(Clone, Copy, Debug)]
pub struct QueryIntent {
    pub primary_class: QueryIntentClass,
    pub direct_answer: Option<DirectAnswerKind>,
    pub grounded_trace_mode: bool,
    pub capability_mode: bool,
    pub capability_needs_repo: bool,
    pub toolchain_mode: bool,
    pub host_inspection_mode: bool,
    pub maintainer_workflow_mode: bool,
    pub workspace_workflow_mode: bool,
    pub architecture_overview_mode: bool,
    pub sovereign_mode: bool,
    pub surgical_filesystem_mode: bool,
    pub scaffold_mode: bool,
}

fn contains_any(haystack: &str, needles: &[&str]) -> bool {
    needles.iter().any(|needle| haystack.contains(needle))
}

fn contains_all(haystack: &str, needles: &[&str]) -> bool {
    needles.iter().all(|needle| haystack.contains(needle))
}

const CODE_KEYWORDS: &[&str] = &[
    ".rs",
    ".js",
    ".ts",
    ".py",
    ".go",
    ".c",
    ".cpp",
    ".h",
    ".hpp",
    ".css",
    ".html",
    ".json",
    ".toml",
    ".yaml",
    ".yml",
    ".md",
    ".sh",
    ".ps1",
    ".sql",
    "rust",
    "python",
    "javascript",
    "typescript",
    "golang",
    "react",
    "svelte",
    "vue",
    "nextjs",
    "node",
    "npm",
    "cargo",
    "pip",
    "logic",
    "refactor",
    "implementation",
    "styles",
    "script",
];

static CODE_KW_AC: std::sync::OnceLock<aho_corasick::AhoCorasick> = std::sync::OnceLock::new();

fn code_kw_ac() -> &'static aho_corasick::AhoCorasick {
    CODE_KW_AC
        .get_or_init(|| aho_corasick::AhoCorasick::new(CODE_KEYWORDS).expect("valid patterns"))
}

fn mentions_reset_commands(lower: &str) -> bool {
    contains_all(lower, &["/clear", "/new", "/forget"])
}

fn mentions_stable_product_surface(lower: &str) -> bool {
    contains_any(
        lower,
        &[
            "stable product-surface question",
            "stable product surface question",
            "stable product-surface questions",
            "stable product surface questions",
        ],
    )
}

fn mentions_product_truth_routing(lower: &str) -> bool {
    let asks_decision_policy = contains_any(
        lower,
        &[
            "how hematite decides",
            "how does hematite decide",
            "decides whether",
            "decide whether",
        ],
    );
    let asks_direct_vs_inspect_split = contains_any(
        lower,
        &[
            "answered as stable product truth",
            "stable product truth",
            "stable product behavior",
            "answer directly",
            "direct answer",
            "inspect the repository",
            "inspect repository",
            "repository implementation",
            "repo implementation",
        ],
    );
    asks_decision_policy && asks_direct_vs_inspect_split
}

fn mentions_broad_system_walkthrough(lower: &str) -> bool {
    let asks_walkthrough = contains_any(
        lower,
        &[
            "walk me through",
            "walk through",
            "how hematite is wired",
            "understand how hematite is wired",
            "major runtime pieces",
            "normal message moves",
            "moves from the tui to the model and back",
        ],
    );
    let asks_multiple_runtime_areas = contains_any(
        lower,
        &[
            "session recovery",
            "tool policy",
            "mcp state",
            "mcp policy",
            "files own the major runtime pieces",
            "which files own",
            "where session recovery",
            "where tool policy",
            "where mcp state",
        ],
    );
    asks_walkthrough && asks_multiple_runtime_areas
}

fn mentions_research_query(lower: &str) -> bool {
    contains_any(
        lower,
        &[
            "search for",
            "lookup",
            "look up",
            "google",
            "find info",
            "find information",
            "what are the latest",
            "who is",
            "who are",
            "who was",
            "what is",
            "what was",
            "who's",
            "current version of",
            "history of",
            "what happened with",
            "tell me about",
            "tell me about the new",
        ],
    )
}

fn mentions_codebase_keywords(lower: &str) -> bool {
    contains_any(
        lower,
        &[
            "this repo",
            "the repo",
            "this project",
            "the project",
            "in the code",
            "in my code",
            "this codebase",
            "the codebase",
            "function",
            "module",
            "file",
            "struct",
            "enum",
            "impl",
            "trait",
            "crate",
            "logic",
            "implementation",
            "wiring",
            "handles ",
            "defined",
            "located",
        ],
    )
}

fn mentions_capability_question(lower: &str) -> bool {
    contains_any(
        lower,
        &[
            "what is your purpose",
            "what's your purpose",
            "what are you for",
            "what is your job",
            "what's your job",
            "what can you do",
            "what are you capable",
            "can you make projects",
            "can you build projects",
            "do you know other coding languages",
            "other coding languages",
            "what languages",
            "can you use the internet",
            "internet research capabilities",
            "what tools do you have",
        ],
    )
}

fn mentions_creator_question(lower: &str) -> bool {
    contains_any(
        lower,
        &[
            "who is ocean bennett",
            "who's ocean bennett",
            "tell me about ocean bennett",
            "who created you",
            "who built you",
            "who made you",
            "who developed you",
            "who engineered you",
            "who engineered your architecture",
            "who created hematite",
            "who built hematite",
            "who developed hematite",
            "who engineered hematite",
            "who maintains hematite",
            "who authored hematite",
            "who is the author",
            "who wrote this",
            "who made this app",
        ],
    )
}

fn capability_question_requires_repo_inspection(lower: &str) -> bool {
    contains_any(
        lower,
        &[
            "this repo",
            "this repository",
            "codebase",
            "which files",
            "implementation",
            "in this project",
        ],
    )
}

/// Returns true for conversational, advisory, or declarative turns that should not
/// trigger a blanket inspect_host(summary) call. Covers:
///   - Advisory/opinion questions: "would more ram be nice?", "should I upgrade?"
///   - Opinion assertions: "i think the gpu is fine"
///   - Hypotheticals: "what if I had more ram", "if i upgraded the gpu"
///   - Conversational acknowledgments: "makes sense", "so the cpu is fine", "ok so"
///   - Positive/negative statements that aren't asking for new data
///
/// Does NOT block specific diagnostic routes — those fire before this catch-all guard.
fn is_conversational_advisory(lower: &str) -> bool {
    // ── Advisory openers — seeking opinion or recommendation, not data ──────────
    let starts_advisory = lower.starts_with("would ")
        || lower.starts_with("could ")
        || lower.starts_with("should ")
        || lower.starts_with("is that ")
        || lower.starts_with("was that ")
        || lower.starts_with("do you think")
        || lower.starts_with("what do you think")
        || lower.starts_with("does that ")
        || lower.starts_with("is it worth")
        || lower.starts_with("would it ");

    // ── Opinion / belief assertions — not requesting fresh data ─────────────────
    let opinion_opener = (lower.starts_with("i think ")
        || lower.starts_with("i believe ")
        || lower.starts_with("i know ")
        || lower.starts_with("i guess ")
        || lower.starts_with("i see,")
        || lower.starts_with("i see ")
        || lower.starts_with("i feel like"))
        && !lower.trim_end().ends_with('?');

    // ── Hypotheticals — not asking about current machine state ──────────────────
    let hypothetical = lower.starts_with("what if ")
        || lower.starts_with("if i ")
        || lower.starts_with("if i'd ")
        || lower.starts_with("say i ")
        || lower.starts_with("suppose ");

    // ── Conversational acknowledgments / pivots without a follow-up question ────
    let no_question = !lower.trim_end().ends_with('?');
    let no_imperative = !lower.contains("what is ")
        && !lower.contains("what are ")
        && !lower.contains("how do ")
        && !lower.contains("how much ")
        && !lower.contains("how many ")
        && !lower.contains("show me")
        && !lower.contains("tell me")
        && !lower.contains("check ");
    let acknowledgment = (lower.starts_with("makes sense")
        || lower.starts_with("that makes sense")
        || lower.starts_with("ok so ")
        || lower.starts_with("right so ")
        || lower.starts_with("so the ")
        || lower.starts_with("so it ")
        || lower.starts_with("so my ")
        || lower.starts_with("ah ")
        || lower.starts_with("got it")
        || lower.starts_with("ok, ")
        || lower.starts_with("everything "))
        && no_question
        && no_imperative;

    // ── Confirmation-seeking tail — "right?", "correct?" ────────────────────────
    let ends_confirmation = lower.trim_end_matches(['?', ' ']).ends_with("right")
        || lower.trim_end_matches(['?', ' ']).ends_with("correct")
        || lower.ends_with("right?")
        || lower.ends_with("yeah?");

    // ── Advisory tail vocabulary ─────────────────────────────────────────────────
    let advisory_tail = lower.contains(" be nice")
        || lower.contains(" be worth")
        || lower.contains(" be helpful")
        || lower.contains(" be useful")
        || lower.contains(" be better")
        || lower.contains(" be good")
        || lower.contains(" help with")
        || lower.contains("offload")
        || lower.contains("upgrade");

    starts_advisory
        || opinion_opener
        || hypothetical
        || acknowledgment
        || ends_confirmation && advisory_tail
}

fn mentions_host_inspection_question(lower: &str) -> bool {
    let host_scope = lower.split_whitespace().any(|w| {
        let w = w.trim_matches(|c: char| !c.is_alphanumeric());
        matches!(
            w,
            "path"
                | "pip"
                | "winget"
                | "choco"
                | "scoop"
                | "network"
                | "adapter"
                | "dns"
                | "gateway"
                | "wifi"
                | "ethernet"
                | "service"
                | "services"
                | "daemon"
                | "process"
                | "processes"
                | "ram"
                | "cpu"
                | "gpu"
                | "vram"
                | "nvidia"
                | "memory"
                | "machine"
                | "computer"
                | "firewall"
                | "vpn"
                | "proxy"
                | "internet"
                | "online"
                | "connectivity"
                | "uptime"
                | "reboot"
                | "silicon"
                | "throttle"
                | "throttled"
                | "throttling"
                | "clocks"
                | "mhz"
                | "health"
                | "report"
                | "bitlocker"
                | "rdp"
                | "vss"
                | "pagefile"
                | "swap"
                | "printer"
                | "audio"
                | "sound"
                | "speaker"
                | "speakers"
                | "microphone"
                | "mic"
                | "bluetooth"
                | "pairing"
                | "headset"
                | "headphones"
                | "camera"
                | "webcam"
                | "msi"
                | "msiexec"
                | "onedrive"
                | "indexer"
                | "ntp"
                | "w32tm"
                | "winrm"
                | "psremoting"
                | "slat"
                | "error"
                | "warning"
                | "event"
                | "log"
                | "throughput"
                | "registry"
                | "share"
                | "mbps"
                | "ad"
                | "sid"
                | "vm"
                | "hyper-v"
                | "hyperv"
                | "dhcp"
                | "lease"
                | "login"
                | "disk"
                | "drive"
                | "backup"
                | "ssd"
                | "hdd"
                | "nvme"
                | "encryption"
        )
    }) || contains_any(
        lower,
        &[
            "package manager",
            "environment doctor",
            "ip address",
            "ipconfig",
            "task manager",
            "developer tools",
            "toolchains",
            "local development",
            "tcp connection",
            "active connection",
            "traceroute",
            "tracert",
            "dns cache",
            "arp table",
            "route table",
            "routing table",
            "default gateway",
            "power plan",
            "windows feature",
            "optional feature",
            "microsoft store",
            "app installer",
            "search index",
            "windows search",
            "monitor resolution",
            "display config",
            "refresh rate",
            "sign in",
            "hard drive",
            "task scheduler",
        ],
    );

    let host_action = lower.split_whitespace().any(|w| {
        let w = w.trim_matches(|c: char| !c.is_alphanumeric());
        matches!(
            w,
            "inspect"
                | "count"
                | "summarize"
                | "analyze"
                | "missing"
                | "ready"
                | "resolve"
                | "troubleshoot"
                | "show"
                | "find"
                | "list"
                | "audit"
                | "test"
                | "check"
                | "currently"
                | "status"
                | "stats"
                | "vitals"
                | "telemetry"
                | "looking"
        )
    }) || contains_any(lower, &["tell me", "how big", "show me"]);

    // Some words are self-sufficient diagnostic state indicators: asking "is my GPU
    // throttled?" implicitly asks to inspect whether throttling is happening.
    let self_sufficient_state =
        lower.contains("throttl") || lower.contains("overheat") || lower.contains("bottleneck");

    host_scope && (host_action || self_sufficient_state)
}

pub fn preferred_host_inspection_topic(user_input: &str) -> Option<&'static str> {
    let lower = user_input.to_lowercase();
    let asks_fix_plan = (lower.contains("fix")
        || lower.contains("repair")
        || lower.contains("resolve")
        || lower.contains("troubleshoot"))
        && (lower.contains("cargo")
            || lower.contains("path")
            || lower.contains("package manager")
            || lower.contains("toolchain")
            || lower.contains("port ")
            || lower.contains("already in use")
            || lower.contains("lm studio")
            || lower.contains("localhost:1234")
            || lower.contains("embedding model")
            || lower.contains("no coding model loaded"));
    let asks_path = lower.contains("path entries")
        || lower.contains("raw path")
        || lower.contains("path issue")
        || lower.contains("missing from path")
        || lower.contains("not in path")
        || lower.contains("path variable")
        || (lower.contains("path") && (lower.contains("show") || lower.contains("what is")));
    let asks_gpo = lower.contains("gpo")
        || lower.contains("group polic")
        || lower.contains("gpresult")
        || lower.contains("applied policy")
        || lower.contains("active policies")
        || lower.contains("what policies")
        || lower.contains("policy objects")
        || lower.contains("policy applied")
        || (lower.contains("policies") && lower.contains("applied"))
        || (lower.contains("policies") && lower.contains("effect"))
        || (lower.contains("policy") && lower.contains("in effect"));
    let asks_certificates = lower.contains("cert")
        || lower.contains("ssl")
        || lower.contains("client cert")
        || lower.contains("expiring cert")
        || lower.contains("tls certificate")
        || lower.contains("x509")
        || lower.contains("x.509")
        || lower.contains(".pfx")
        || lower.contains(".p12")
        || lower.contains(".pem")
        || lower.contains("pkcs")
        || lower.contains("trust store")
        || lower.contains("certificate store")
        || lower.contains("certificate expir")
        || lower.contains("untrusted cert")
        || (lower.contains("tls")
            && (lower.contains("check")
                || lower.contains("inspect")
                || lower.contains("status")
                || lower.contains("valid")));
    let asks_integrity = lower.contains("integrity")
        || lower.contains("sfc")
        || lower.contains("dism")
        || lower.contains("corrupt")
        || lower.contains("os health")
        || lower.contains("system file")
        || (lower.contains("windows") && lower.contains("damaged"))
        || (lower.contains("check") && lower.contains("system") && lower.contains("file"));
    let asks_user_accounts = (lower.contains("user account")
        && !lower.contains("user account control"))
        || lower.contains("local user")
        || lower.contains("local group")
        || lower.contains("get-localuser")
        || lower.contains("get-localgroup")
        || lower.contains("get-localgroupmember")
        || lower.contains("who am i")
        || lower.contains("logged in as")
        || lower.contains("logged in user")
        || lower.contains("logged on user")
        || lower.contains("admin group")
        || lower.contains("administrators group")
        || lower.contains("local admin")
        || lower.contains("who has admin")
        || lower.contains("running as admin")
        || lower.contains("is this elevated")
        || lower.contains("net user")
        || lower.contains("net localgroup")
        || lower.contains("who has admin rights")
        || lower.contains("list all users")
        || lower.contains("list users")
        || lower.contains("what accounts")
        || (lower.contains("accounts") && lower.contains("admin"));
    let asks_ad_user = lower.contains("ad user")
        || lower.contains("domain user")
        || (lower.contains("user") && (lower.contains("sid") || lower.contains("membership")));
    let asks_mdm = lower.contains("mdm")
        || lower.contains("intune")
        || lower.contains("autopilot")
        || lower.contains("device enrollment")
        || lower.contains("enrolled in")
        || lower.contains("mdm enrollment")
        || lower.contains("device management")
        || lower.contains("managed device")
        || lower.contains("azure ad join")
        || lower.contains("aad join")
        || (lower.contains("enrolled") && lower.contains("device"))
        || (lower.contains("enroll") && lower.contains("device"))
        || (lower.contains("microsoft") && lower.contains("endpoint"));
    let asks_hyperv = lower.contains("hyper-v")
        || lower.contains("hyperv")
        || lower.contains("hyper v")
        || lower.contains("list vm")
        || lower.contains("list vms")
        || lower.contains("running vms")
        || lower.contains("virtual machines")
        || lower.contains("virtual machine")
        || (lower.contains("vm")
            && !lower.contains("nvme")
            && (lower.contains("running")
                || lower.contains("status")
                || lower.contains("health")
                || lower.contains("checkpoint")
                || lower.contains("snapshot")
                || lower.contains("switch")
                || lower.contains("memory")
                || lower.contains("ram")))
        || lower.contains("vmms")
        || lower.contains("vmmem");
    let asks_storage_spaces = lower.contains("storage space")
        || lower.contains("storage pool")
        || lower.contains("storage pools")
        || lower.contains("virtual disk")
        || lower.contains("virtual disks")
        || lower.contains("windows raid")
        || lower.contains("disk pool")
        || lower.contains("resiliency")
        || (lower.contains("storage") && lower.contains("pool"))
        || (lower.contains("mdadm")
            || lower.contains("software raid")
            || lower.contains("md array"));
    let asks_defender_quarantine = lower.contains("quarantine")
        || lower.contains("threat history")
        || lower.contains("malware history")
        || lower.contains("defender history")
        || lower.contains("detected threat")
        || lower.contains("detected virus")
        || lower.contains("defender found")
        || lower.contains("defender detected")
        || lower.contains("defender find")
        || lower.contains("virus found")
        || lower.contains("threats found")
        || lower.contains("threat detected")
        || (lower.contains("defender")
            && (lower.contains("malware") || lower.contains("virus") || lower.contains("threat")))
        || (lower.contains("defender")
            && lower.contains("scan")
            && (lower.contains("result") || lower.contains("history") || lower.contains("found")));
    let asks_event_query = lower.contains("event id")
        || lower.contains("event log query")
        || lower.contains("event_id")
        || lower.contains("eventid")
        || lower.contains("search event")
        || lower.contains("query event")
        || lower.contains("find event")
        || lower.contains("filter event")
        || (lower.contains("event") && lower.contains("4625"))
        || (lower.contains("event") && lower.contains("7034"))
        || (lower.contains("event") && lower.contains("7031"))
        || (lower.contains("event") && lower.contains("4648"))
        || (lower.contains("event") && lower.contains("41"))
        || (lower.contains("event")
            && (lower.contains("last hour")
                || lower.contains("last 24")
                || lower.contains("past hour")
                || lower.contains("today")))
        || ((lower.contains("event log")
            || lower.contains("system log")
            || lower.contains("application log")
            || lower.contains("security log"))
            && (lower.contains("last ")
                || lower.contains("past ")
                || lower.contains("today")
                || lower.contains("hour")
                || lower.contains("hours"))
            && (lower.contains("error")
                || lower.contains("errors")
                || lower.contains("warning")
                || lower.contains("warnings")
                || lower.contains("critical")))
        || lower.contains("failed logon event")
        || lower.contains("failed login event")
        || lower.contains("application error event")
        || lower.contains("crash event")
        || lower.contains("service crash event");
    let asks_ip_config =
        lower.contains("ipconfig") && (lower.contains("all") || lower.contains("detailed"));
    let asks_domain = lower.contains("domain")
        || lower.contains("active directory")
        || lower.contains("ad join")
        || lower.contains("workgroup");
    let asks_device_health = lower.contains("device health")
        || lower.contains("hardware error")
        || lower.contains("malfunctioning")
        || lower.contains("yellow bang")
        || lower.contains("hardware failing")
        || lower.contains("device manager")
        || lower.contains("unknown device")
        || lower.contains("code 43")
        || lower.contains("code 10")
        || lower.contains("code 28")
        || lower.contains("pnp device")
        || lower.contains("exclamation mark in device")
        || (lower.contains("device") && lower.contains("error code"))
        || (lower.contains("device") && lower.contains("not recognized"))
        || (lower.contains("device") && lower.contains("broken"))
        || (lower.contains("device") && lower.contains("not working"))
        || (lower.contains("device") && lower.contains("stopped working"))
        || (lower.contains("hardware") && lower.contains("broken"));
    let asks_drivers =
        lower.contains("driver") || lower.contains("kmod") || lower.contains("kernel module");
    let asks_audio = lower.contains("no sound")
        || lower.contains("audio service")
        || lower.contains("windows audio")
        || lower.contains("speaker")
        || lower.contains("speakers")
        || lower.contains("microphone")
        || lower.contains(" mic ")
        || lower.starts_with("mic ")
        || lower.contains("mic not")
        || lower.contains("headset")
        || lower.contains("headphones")
        || lower.contains("playback device")
        || lower.contains("recording device")
        || lower.contains("audio endpoint")
        || lower.contains("audioendpointbuilder")
        || lower.contains("can't hear")
        || lower.contains("cannot hear")
        || lower.contains("cant hear")
        || lower.contains("no audio")
        || ((lower.contains("audio") || lower.contains("sound"))
            && (lower.contains("device")
                || lower.contains("driver")
                || lower.contains("service")
                || lower.contains("working")
                || lower.contains("broken")
                || lower.contains("input")
                || lower.contains("output")
                || lower.contains("crackling")
                || lower.contains("mute")
                || lower.contains("muted")
                || lower.contains("volume")
                || lower.contains("speaker")
                || lower.contains("microphone")))
            && !lower.contains("audio file")
            && !lower.contains("voice engine");
    let asks_bluetooth = lower.contains("bluetooth")
        || lower.contains("pairing")
        || lower.contains("paired device")
        || lower.contains("paired devices")
        || lower.contains("bthserv")
        || lower.contains("bthavctpsvc")
        || lower.contains("btagservice")
        || lower.contains("bluetoothuserservice")
        || lower.contains("wireless headset")
        || lower.contains("wireless earbuds")
        || ((lower.contains("headset") || lower.contains("headphones"))
            && (lower.contains("disconnect")
                || lower.contains("pair")
                || lower.contains("reconnect")
                || lower.contains("bluetooth")))
        || ((lower.contains("won't") || lower.contains("cannot") || lower.contains("can't"))
            && (lower.contains("pair") || lower.contains("connect"))
            && lower.contains("bluetooth"));
    let asks_camera = lower.contains("camera")
        || lower.contains("webcam")
        || lower.contains("web cam")
        || (lower.contains("app") && lower.contains("can't see") && lower.contains("camera"))
        || (lower.contains("camera") && lower.contains("permission"))
        || (lower.contains("camera") && lower.contains("privacy"))
        || (lower.contains("camera") && lower.contains("not working"))
        || (lower.contains("camera") && lower.contains("missing"))
        || lower.contains("camera_privacy");
    let asks_sign_in = lower.contains("windows hello")
        || (lower.contains("hello") && lower.contains("not working"))
        || (lower.contains("pin")
            && (lower.contains("broken")
                || lower.contains("not working")
                || lower.contains("forgot")))
        || (lower.contains("can't sign in")
            || lower.contains("cannot sign in")
            || lower.contains("cant sign in"))
        || (lower.contains("sign") && lower.contains("in") && lower.contains("issue"))
        || lower.contains("logon failure")
        || lower.contains("credential provider")
        || lower.contains("biometric service")
        || (lower.contains("profile") && lower.contains("corrupt"))
        || lower.contains("wbiosrvc")
        || lower.contains("login screen stuck")
        || lower.contains("stuck on login")
        || lower.contains("stuck at login")
        || lower.contains("login loop")
        || lower.contains("sign-in loop")
        || lower.contains("sign in loop")
        || lower.contains("reboot loop on login")
        || (lower.contains("can't log in") && !lower.contains("vpn") && !lower.contains("ssh"))
        || (lower.contains("cannot log in") && !lower.contains("vpn") && !lower.contains("ssh"))
        || lower.contains("can't login")
        || lower.contains("cannot login")
        || lower.contains("cant login")
        || lower.contains("login failed")
        || lower.contains("login failure")
        || (lower.contains("login") && lower.contains("not working"))
        || (lower.contains("login") && lower.contains("problem"))
        || (lower.contains("login") && lower.contains("status"))
        || lower.contains("sign-in status")
        || lower.contains("sign in status");
    let asks_identity_auth = lower.contains("web account manager")
        || lower.contains("token broker")
        || lower.contains("tokenbroker")
        || lower.contains("aad broker")
        || lower.contains("broker plugin")
        || lower.contains("identity broker")
        || lower.contains("microsoft 365 sign-in")
        || lower.contains("microsoft 365 signin")
        || lower.contains("office sign-in")
        || lower.contains("office signin")
        || lower.contains("workplace join")
        || lower.contains("device registration")
        || lower.contains("device registered")
        || lower.contains("entra")
        || lower.contains("azure ad")
        || lower.contains("azuread")
        || lower.contains("azure ad prt")
        || lower.contains("azureadprt")
        || lower.contains("wamdefaultset")
        || lower.contains("single sign-on")
        || lower.contains("organizational account")
        || lower.contains("corporate account")
        || (lower.contains("azure") && lower.contains("registered"))
        || ((lower.contains("outlook")
            || lower.contains("teams")
            || lower.contains("onedrive")
            || lower.contains("office")
            || lower.contains("microsoft 365"))
            && (lower.contains("sign in")
                || lower.contains("signin")
                || lower.contains("signed in")
                || lower.contains("signed out")
                || lower.contains("keeps asking")
                || lower.contains("keep asking")
                || lower.contains("authentication")
                || lower.contains("auth")
                || lower.contains("token")
                || lower.contains("work account")
                || lower.contains("school account")
                || lower.contains("account mismatch")));
    let asks_installer_health = lower.contains("installer health")
        || lower.contains("installer broken")
        || lower.contains("msiexec")
        || lower.contains("msi installer")
        || lower.contains("windows installer")
        || lower.contains("app installer")
        || lower.contains("desktopappinstaller")
        || lower.contains("microsoft store")
        || lower.contains("winget broken")
        || (lower.contains("can't install")
            && (lower.contains("app") || lower.contains("apps") || lower.contains("program")))
        || (lower.contains("cannot install")
            && (lower.contains("app") || lower.contains("apps") || lower.contains("program")))
        || (lower.contains("cant install")
            && (lower.contains("app") || lower.contains("apps") || lower.contains("program")))
        || (lower.contains("unable to install")
            && (lower.contains("app") || lower.contains("program") || lower.contains("software")))
        || ((lower.contains("install") || lower.contains("installer"))
            && (lower.contains("fail")
                || lower.contains("failing")
                || lower.contains("broken")
                || lower.contains("stuck")
                || lower.contains("hanging")
                || lower.contains("error"))
            && !lower.contains("windows update"));
    let asks_onedrive = lower.contains("onedrive")
        || lower.contains("one drive")
        || lower.contains("files on-demand")
        || lower.contains("known folder backup")
        || lower.contains("known folder move")
        || lower.contains("kfm")
        || lower.contains("sharepoint sync")
        || lower.contains("sync root")
        || ((lower.contains("desktop")
            || lower.contains("documents")
            || lower.contains("pictures"))
            && lower.contains("backup")
            && (lower.contains("onedrive") || lower.contains("cloud") || lower.contains("sync")))
        || ((lower.contains("desktop")
            || lower.contains("documents")
            || lower.contains("pictures"))
            && lower.contains("sync")
            && (lower.contains("onedrive")
                || lower.contains("sharepoint")
                || lower.contains("cloud")));
    let asks_browser_health = lower.contains("browser health")
        || lower.contains("webview2")
        || lower.contains("default browser")
        || ((lower.contains("browser")
            || lower.contains("chrome")
            || lower.contains("edge")
            || lower.contains("firefox"))
            && (lower.contains("slow")
                || lower.contains("sluggish")
                || lower.contains("lag")
                || lower.contains("crash")
                || lower.contains("crashing")
                || lower.contains("hang")
                || lower.contains("frozen")
                || lower.contains("freeze")
                || lower.contains("broken")
                || lower.contains("not opening")
                || lower.contains("won't open")
                || lower.contains("cannot open")
                || lower.contains("unresponsive")
                || lower.contains("not starting")
                || lower.contains("not loading")
                || lower.contains("extension")
                || lower.contains("extensions")
                || lower.contains("proxy")
                || lower.contains("policy")))
        || ((lower.contains("links") || lower.contains("link"))
            && (lower.contains("open wrong")
                || lower.contains("opens wrong")
                || lower.contains("wrong browser")
                || lower.contains("wrong app")
                || lower.contains("default browser")))
        || ((lower.contains("website") || lower.contains("websites") || lower.contains("web app"))
            && (lower.contains("browser")
                || lower.contains("chrome")
                || lower.contains("edge")
                || lower.contains("firefox"))
            && (lower.contains("load")
                || lower.contains("broken")
                || lower.contains("slow")
                || lower.contains("proxy")
                || lower.contains("policy")));
    let asks_outlook = lower.contains("outlook")
        || lower.contains("ms outlook")
        || lower.contains("microsoft outlook")
        || (lower.contains("ost") && lower.contains("mail"))
        || (lower.contains("pst") && lower.contains("mail"))
        || (lower.contains("add-in") && lower.contains("mail"))
        || (lower.contains("addin") && lower.contains("outlook"))
        || (lower.contains("email client")
            && (lower.contains("slow")
                || lower.contains("crash")
                || lower.contains("broken")
                || lower.contains("hanging")))
        || (lower.contains("mail profile") && lower.contains("corrupt"));
    let not_nic_teaming = !lower.contains("nic teaming")
        && !lower.contains("nic-teaming")
        && !lower.contains("link aggregation")
        && !lower.contains("lbfo");
    let asks_teams = (lower.contains("teams") && not_nic_teaming)
        || lower.contains("ms teams")
        || lower.contains("microsoft teams")
        || (lower.contains("teams cache") && lower.contains("clear"))
        || (lower.contains("teams")
            && not_nic_teaming
            && lower.contains("sign-in")
            && lower.contains("broken"))
        || (lower.contains("teams")
            && not_nic_teaming
            && lower.contains("device")
            && (lower.contains("audio")
                || lower.contains("video")
                || lower.contains("camera")
                || lower.contains("microphone")));
    let asks_windows_backup = lower.contains("file history")
        || lower.contains("windows backup")
        || lower.contains("wbadmin")
        || lower.contains("system restore")
        || lower.contains("restore point")
        || lower.contains("restore points")
        || lower.contains("backed up")
        || lower.contains("being backed")
        || (lower.contains("backup")
            && !lower.contains("onedrive")
            && !lower.contains("one drive")
            && (lower.contains("backup drive")
                || lower.contains("backup disk")
                || lower.contains("configured")
                || lower.contains("schedule")
                || lower.contains("last backup")
                || lower.contains("backup health")
                || lower.contains("backup status")
                || lower.contains("backup running")
                || lower.contains("broken")
                || lower.contains("failed")
                || lower.contains("running")
                || lower.contains("enabled")
                || lower.contains("working")
                || lower.contains("set up")))
        || (lower.contains("recovery")
            && (lower.contains("backup")
                || lower.contains("restore")
                || lower.contains("posture")))
        || lower.contains("known folder move")
        || lower.contains("known folder backup");
    let asks_search_index = (lower.contains("search")
        && (lower.contains("broken")
            || lower.contains("not working")
            || lower.contains("slow")
            || lower.contains("indexing")
            || lower.contains("index")))
        || lower.contains("wsearch")
        || lower.contains("windows search")
        || lower.contains("search index")
        || lower.contains("indexer")
        || (lower.contains("search") && lower.contains("stuck"))
        || (lower.contains("search") && lower.contains("results") && lower.contains("show"));
    let asks_display_config = lower.contains("monitor")
        || lower.contains("display")
        || lower.contains("resolution")
        || lower.contains("refresh rate")
        || lower.contains("refresh hz")
        || lower.contains("screen config")
        || lower.contains("dpi")
        || lower.contains("scaling")
        || lower.contains("hdmi")
        || lower.contains("displayport")
        || lower.contains("how many screens")
        || lower.contains("multi-monitor")
        || lower.contains("second screen")
        || lower.contains("external display");
    let asks_data_audit = lower.contains("data audit")
        || lower.contains("audit data")
        || lower.contains("csv schema")
        || lower.contains("data schema")
        || lower.contains("inspect file")
        || lower.contains("profile data")
        || lower.contains("data distribution")
        || (lower.contains("audit")
            && (lower.contains("csv")
                || lower.contains("json")
                || lower.contains("file")
                || lower.contains("data")))
        || (lower.contains("schema")
            && (lower.contains("csv") || lower.contains("json") || lower.contains("data")));
    let asks_ntp = lower.contains("ntp")
        || lower.contains("time sync")
        || lower.contains("clock sync")
        || lower.contains("w32tm")
        || lower.contains("clock drift")
        || lower.contains("system clock")
        || lower.contains("time server")
        || lower.contains("time zone")
        || lower.contains("timezone")
        || lower.contains("wrong timezone")
        || (lower.contains("time") && lower.contains("drift"))
        || (lower.contains("clock") && lower.contains("wrong"))
        || (lower.contains("time") && lower.contains("wrong"))
        || (lower.contains("clock") && lower.contains("off"))
        || (lower.contains("time") && lower.contains("off") && lower.contains("sync"))
        || lower.contains("system time")
        || (lower.contains("time") && lower.contains("accurate"))
        || (lower.contains("time") && lower.contains("correct"));
    let asks_cpu_power = lower.contains("turbo boost")
        || lower.contains("cpu frequency")
        || lower.contains("cpu freq")
        || lower.contains("processor frequency")
        || lower.contains("cpu clock")
        || lower.contains("cpu speed")
        || lower.contains("processor speed")
        || lower.contains("cpu stuck")
        || lower.contains("cpu slow")
        || lower.contains("power plan")
        || lower.contains("cpu power")
        || lower.contains("processor state")
        || (lower.contains("cpu") && lower.contains("slow"))
        || (lower.contains("cpu") && lower.contains("underclocking"))
        || (lower.contains("boost") && lower.contains("disabled"))
        || (lower.contains("processor") && lower.contains("slow"))
        || (lower.contains("processor") && lower.contains("running slow"))
        || lower.contains("processor running at");
    let asks_credentials = lower.contains("credential manager")
        || lower.contains("credential store")
        || lower.contains("saved password")
        || lower.contains("stored credential")
        || lower.contains("saved credential")
        || lower.contains("credential vault")
        || lower.contains("cmdkey")
        || (lower.contains("credential") && lower.contains("list"))
        || (lower.contains("password") && lower.contains("vault"))
        || (lower.contains("windows") && lower.contains("credential"))
        || (lower.contains("credential")
            && (lower.contains("clear")
                || lower.contains("cached")
                || lower.contains("view")
                || lower.contains("delete")
                || lower.contains("remove")));
    let asks_tpm = lower.contains("tpm")
        || lower.contains("secure boot")
        || lower.contains("secureboot")
        || lower.contains("trusted platform module")
        || lower.contains("firmware security")
        || lower.contains("uefi security")
        || lower.contains("uefi mode")
        || lower.contains("uefi enabled")
        || lower.contains("uefi settings")
        || lower.contains("legacy bios")
        || lower.contains("uefi bios")
        || (lower.contains("uefi")
            && (lower.contains("boot")
                || lower.contains("secure")
                || lower.contains("status")
                || lower.contains("check")))
        || (lower.contains("bitlocker") && lower.contains("chip"))
        || (lower.contains("windows 11") && lower.contains("tpm"));
    let asks_dhcp = lower.contains("dhcp lease")
        || lower.contains("lease expires")
        || lower.contains("lease obtained")
        || lower.contains("dhcp server")
        || lower.contains("ip lease")
        || lower.contains("lease time")
        || lower.contains("lease renew")
        || lower.contains("renew lease")
        || (lower.contains("dhcp")
            && (lower.contains("detail")
                || lower.contains("info")
                || lower.contains("check")
                || lower.contains("show")))
        || (lower.contains("ip") && lower.contains("lease"));
    let asks_mtu = lower.contains("mtu")
        || lower.contains("path mtu")
        || lower.contains("pmtu")
        || lower.contains("jumbo frame") && lower.contains("test")
        || lower.contains("frame size")
        || lower.contains("mtu discovery")
        || lower.contains("fragmentation")
        || (lower.contains("packet") && lower.contains("size") && lower.contains("max"))
        || (lower.contains("vpn") && lower.contains("mtu"))
        || (lower.contains("mtu") && lower.contains("check"));
    let asks_latency = (lower
        .split_whitespace()
        .any(|w| w.trim_matches(|c: char| !c.is_alphanumeric()) == "ping"))
        || lower.contains("latency")
        || lower.contains("packet loss")
        || lower.contains("rtt")
        || lower.contains("round trip")
        || lower.contains("reachability")
        || lower.contains("ping test")
        || (lower.contains("network") && lower.contains("slow"))
        || (lower.contains("internet") && lower.contains("slow"))
        || (lower.contains("connection") && lower.contains("slow"))
        || (lower.contains("high") && lower.contains("latency"))
        || lower.contains("network lag")
        || lower.contains("jitter");
    let asks_network_adapter = lower.contains("nic settings")
        || lower.contains("nic offload")
        || lower.contains("adapter settings")
        || lower.contains("adapter offload")
        || lower.contains("jumbo frame")
        || lower.contains("rss setting")
        || lower.contains("tcp offload")
        || lower.contains("lso")
        || lower.contains("checksum offload")
        || lower.contains("wake on lan")
        || lower.contains("wake-on-lan")
        || lower.contains("wol")
        || lower.contains("nic advanced")
        || lower.contains("adapter error")
        || lower.contains("duplex mismatch")
        || lower.contains("ethernet not")
        || lower.contains("ethernet port")
        || lower.contains("ethernet cable")
        || lower.contains("wired connection not")
        || lower.contains("wired network not")
        || lower.contains("nic not working")
        || lower.contains("network adapter not")
        || lower.contains("network card")
        || lower.contains("link speed")
        || lower.contains("network adapter settings")
        || (lower.contains("nic")
            && (lower.contains("driver")
                || lower.contains("setting")
                || lower.contains("error")
                || lower.contains("config")));
    let asks_ipv6 = lower.contains("ipv6")
        || lower.contains("slaac")
        || lower.contains("dhcpv6")
        || lower.contains("ipv6 address")
        || lower.contains("ipv6 prefix")
        || lower.contains("ipv6 gateway")
        || lower.contains("ipv6 config")
        || lower.contains("privacy extension")
        || lower.contains("global unicast")
        || lower.contains("link-local address")
        || (lower.contains("ipv6")
            && (lower.contains("check") || lower.contains("show") || lower.contains("status")));
    let asks_tcp_params = lower.contains("tcp autotuning")
        || lower.contains("tcp auto-tuning")
        || lower.contains("tcp window scaling")
        || lower.contains("tcp congestion")
        || lower.contains("congestion algorithm")
        || lower.contains("congestion provider")
        || lower.contains("tcp settings")
        || lower.contains("tcp parameters")
        || lower.contains("tcp tuning")
        || lower.contains("tcp chimney")
        || lower.contains("tcp offload")
        || lower.contains("ecn")
        || lower.contains("rwin")
        || lower.contains("receive window")
        || lower.contains("dynamic port range")
        || lower.contains("tcp window")
        || (lower.contains("tcp")
            && (lower.contains("slow")
                || lower.contains("throughput")
                || lower.contains("performance")
                || lower.contains("config")
                || lower.contains("speed")
                || lower.contains("window size")));
    let asks_wlan_profiles = lower.contains("saved wifi")
        || lower.contains("saved wireless")
        || lower.contains("wifi profile")
        || lower.contains("wlan profile")
        || lower.contains("wireless profile")
        || lower.contains("saved network")
        || lower.contains("known network")
        || lower.contains("netsh wlan")
        || (lower.contains("wifi")
            && (lower.contains("security")
                || lower.contains("audit")
                || lower.contains("wep")
                || lower.contains("saved")
                || lower.contains("remember")
                || lower.contains("password")))
        || (lower.contains("wireless")
            && (lower.contains("profile")
                || lower.contains("saved")
                || lower.contains("audit")
                || lower.contains("remember")));
    let asks_ipsec = lower.contains("ipsec")
        || lower.contains("ip sec")
        || lower.contains("ipsec sa")
        || lower.contains("security association")
        || lower.contains("ike ")
        || lower.contains("ikev2")
        || lower.contains("ike tunnel")
        || lower.contains("ipsec tunnel")
        || lower.contains("ipsec policy")
        || lower.contains("ipsec rule")
        || lower.contains("policy agent")
        || lower.contains("xfrm")
        || (lower.contains("ipsec")
            && (lower.contains("check") || lower.contains("active") || lower.contains("status")));
    let asks_netbios = lower.contains("netbios")
        || lower.contains("nbtstat")
        || lower.contains("wins server")
        || lower.contains("wins address")
        || lower.contains("netbios name")
        || lower.contains("netbios over tcp")
        || lower.contains("nbns")
        || (lower.contains("wins")
            && (lower.contains("server") || lower.contains("config") || lower.contains("check")));
    let asks_nic_teaming = lower.contains("nic team")
        || lower.contains("nic teaming")
        || lower.contains("network team")
        || lower.contains("lacp")
        || lower.contains("link aggregation")
        || lower.contains("bonding")
        || lower.contains("bond interface")
        || lower.contains("lbfo")
        || (lower.contains("team")
            && (lower.contains("nic") || lower.contains("adapter") || lower.contains("network")))
        || (lower.contains("bond")
            && (lower.contains("adapter") || lower.contains("interface") || lower.contains("nic")));
    let asks_snmp = lower.contains("snmp")
        || lower.contains("snmp agent")
        || lower.contains("snmp trap")
        || lower.contains("community string")
        || lower.contains("community name")
        || lower.contains("snmp service")
        || lower.contains("snmpd");
    let asks_port_test = lower.contains("port test")
        || lower.contains("test port")
        || lower.contains("port check")
        || lower.contains("check port")
        || lower.contains("port reachab")
        || lower.contains("can i reach")
        || lower.contains("is port")
        || lower.contains("tcp test")
        || lower.contains("test-netconnection")
        || lower.contains("test connection")
        || (lower.contains("port")
            && (lower.contains("open")
                || lower.contains("closed")
                || lower.contains("blocked")
                || lower.contains("reachable")))
        || (lower.contains("reach") && lower.contains("port"));
    let asks_network_profile = lower.contains("network profile")
        || lower.contains("network location")
        || lower.contains("network category")
        || lower.contains("public network")
        || lower.contains("private network")
        || lower.contains("domain network")
        || lower.contains("net profile")
        || (lower.contains("network") && lower.contains("location"))
        || (lower.contains("firewall") && lower.contains("profile") && lower.contains("network"));
    let asks_dns_lookup = lower.contains("dns lookup")
        || lower.contains("dns record")
        || lower.contains("nslookup")
        || lower.contains("resolve-dnsname")
        || lower.contains("gethostaddresses")
        || lower.contains("gethostentry")
        || lower.contains("[system.net.dns]")
        || lower.contains("net.dns]")
        || lower.contains("look up ")
        || lower.contains("look up the")
        || lower.contains("resolve ")
        || lower.contains("mx record")
        || lower.contains("srv record")
        || lower.contains("txt record")
        || lower.contains("a record")
        || lower.contains("aaaa record")
        || lower.contains("cname record")
        || lower.contains(" dig ")
        || lower.starts_with("host ")
        || (lower.contains("what") && lower.contains("ip") && lower.contains("for"))
        || (lower.contains("ip address") && lower.contains(" of "))
        || (lower.contains("resolve")
            && (lower.contains("hostname") || lower.contains("domain") || lower.contains("name")))
        || (lower.contains("lookup")
            && (lower.contains("domain") || lower.contains("host") || lower.contains("name")));
    let asks_peripherals = lower.contains("peripheral")
        || lower.contains("usb")
        || lower.contains("keyboard")
        || lower.contains("mouse")
        || lower.contains("pointer")
        || lower.contains("monitor")
        || lower.contains("input device")
        || lower.contains("connected hardware");
    let asks_sessions = lower.contains("session")
        || lower.contains("login")
        || lower.contains("who is on")
        || lower.contains("active user")
        || lower.contains("who is logged on")
        || lower.contains("who is logged in")
        || lower.contains("logged on users")
        || lower.contains("logged in users")
        || lower.contains("current users")
        || lower.contains("query session")
        || lower.contains("qwinsta")
        || lower.contains("connected users")
        || lower.contains("user sessions")
        || lower.contains("terminal session")
        || (lower.contains("who") && lower.contains("logged"))
        || (lower.contains("who")
            && lower.contains("using")
            && (lower.contains("computer") || lower.contains("machine")));
    let asks_virtualization = lower.contains("virtualization")
        || lower.contains("hypervisor")
        || lower.contains("vt-x")
        || lower.contains("slat")
        || lower.contains("v-p")
        || lower.contains("nested virt")
        || lower.contains("cpu model")
        || lower.contains("ram size")
        || lower.contains("hardware spec")
        || lower.contains("hardware dna")
        || lower.contains("hardware info")
        || lower.contains("bios version")
        || lower.contains("motherboard")
        || lower.contains("how much ram")
        || lower.contains("what processor")
        || lower.contains("what cpu")
        || (lower.contains("what hardware") && lower.contains("have"))
        || (lower.contains("hardware") && lower.contains("inventory"));
    let asks_startup = lower.contains("startup")
        || lower.contains("boot program")
        || lower.contains("autorun")
        || lower.contains("run at boot")
        || lower.contains("startup program")
        || lower.contains("startup app")
        || lower.contains("startup list")
        || lower.contains("startup item")
        || lower.contains("starts with windows")
        || lower.contains("start with windows")
        || lower.contains("launch at startup")
        || lower.contains("launch on startup")
        || lower.contains("open at startup")
        || lower.contains("open on boot")
        || lower.contains("runs on boot")
        || lower.contains("run at login")
        || lower.contains("msconfig")
        || lower.contains("login item")
        || lower.contains("autostart")
        || (lower.contains("disable") && lower.contains("startup"))
        || (lower.contains("what") && lower.contains("start") && lower.contains("boot"))
        || (lower.contains("load") && lower.contains("boot"))
        || (lower.contains("load") && lower.contains("startup") && !lower.contains("reload"));
    let asks_env_doctor = lower.contains("env doctor")
        || lower.contains("environment doctor")
        || lower.contains("package manager")
        || lower.contains("package managers")
        || lower.contains("shims")
        || lower.contains("path drift")
        || lower.contains("environment is broken")
        || lower.contains("env is broken")
        || (lower.contains("dev machine") && lower.contains("off"))
        || (lower.contains("environment") && lower.contains("sane"));
    let asks_lan_discovery = lower.contains("upnp")
        || lower.contains("ssdp")
        || lower.contains("mdns")
        || lower.contains("bonjour")
        || lower.contains("llmnr")
        || lower.contains("network neighborhood")
        || lower.contains("device discovery")
        || lower.contains("local discovery")
        || lower.contains("discover local devices")
        || lower.contains("discover devices")
        || lower.contains("browse computers")
        || (lower.contains("local network")
            && (lower.contains("discover")
                || lower.contains("discovery")
                || lower.contains("neighborhood")
                || lower.contains("device")
                || lower.contains("devices")
                || lower.contains("aware of")))
        || ((lower.contains("netbios") || lower.contains("smb visibility"))
            && !lower.contains("active directory"))
        || ((lower.contains("nas")
            || lower.contains("printer")
            || lower.contains("device")
            || lower.contains("computer")
            || lower.contains("pc"))
            && ((lower.contains("can't") && lower.contains("see"))
                || (lower.contains("cannot") && lower.contains("see"))
                || (lower.contains("cant") && lower.contains("see"))
                || lower.contains("can't see")
                || lower.contains("cannot see")
                || lower.contains("cant see")
                || lower.contains("not visible")
                || lower.contains("not showing up")
                || lower.contains("not show up")
                || lower.contains("discover"))
            && (lower.contains("network")
                || lower.contains("lan")
                || lower.contains("local")
                || lower.contains("neighborhood")));
    let asks_network = (((lower.contains("network") && !lower.contains("active directory"))
        && !lower.contains("stat")
        && !lower.contains("share")
        && !lower.contains("throughput"))
        || lower.contains("adapter")
        || lower.contains("ip address")
        || lower.contains("ipconfig")
        || lower.contains("ipv4")
        || lower.contains("ipv6")
        || lower.contains("subnet")
        || lower.contains("dns server")
        || lower.contains("nameserver")
        || lower.contains("wifi")
        || lower.contains("wireless")
        || lower.contains("ethernet")
        || lower.contains("lan"))
        && !asks_ad_user;
    let asks_services = lower.contains("service")
        || lower.contains("services")
        || lower.contains("daemon")
        || lower.contains("startup type")
        || lower.contains("background service")
        || lower.contains("windows service")
        || lower.contains("systemctl")
        || lower.contains("get-service");
    let asks_processes = lower.contains("process")
        || lower.contains("processes")
        || lower.contains("task manager")
        || lower.contains("what is running")
        || lower.contains("what's running")
        || lower.contains("using my ram")
        || lower.contains("using ram")
        || lower.contains("using my cpu")
        || lower.contains("using the cpu")
        || lower.contains("top memory")
        || lower.contains("top ram")
        || lower.contains("high memory")
        || lower.contains("resource-heavy processes")
        || lower.contains("heavy hitters")
        || lower.contains("cpu hog")
        || lower.contains("memory hog")
        || lower.contains("ram hog")
        || lower.contains("hogging cpu")
        || lower.contains("hogging ram")
        || lower.contains("hogging memory")
        || lower.contains("eating up cpu")
        || lower.contains("eating up ram")
        || lower.contains("eating up memory")
        || lower.contains("eating my cpu")
        || lower.contains("eating my ram")
        || lower.contains("eating my memory")
        || (lower.contains("hogging")
            && (lower.contains("cpu") || lower.contains("ram") || lower.contains("memory")))
        || (lower.contains("eating up")
            && (lower.contains("cpu") || lower.contains("ram") || lower.contains("memory")))
        || (lower.contains("using the most")
            && (lower.contains("cpu") || lower.contains("ram") || lower.contains("memory")))
        || (lower.contains("most cpu")
            || lower.contains("most ram")
            || lower.contains("most memory"))
        || (lower.contains("hitting")
            && (lower.contains("cpu") || lower.contains("ram") || lower.contains("disk")));
    let asks_toolchains = lower.contains("developer tools")
        || lower.contains("toolchains")
        || lower.contains("toolchain not found")
        || lower.contains("toolchain missing")
        || (lower.contains("installed") && lower.contains("version"))
        || (lower.contains("detect") && lower.contains("version"));
    let asks_permissions = lower.contains("permission")
        || lower.contains("access control")
        || lower.contains("get-acl")
        || lower.contains("acl ")
        || lower.contains("icacls")
        || lower.contains("takeown")
        || lower.contains("ntfs permission")
        || (lower.contains("who has") && lower.contains("access"));
    let asks_login_history = lower.contains("login history")
        || lower.contains("logon history")
        || lower.contains("who logged in")
        || lower.contains("recent logon")
        || lower.contains("failed logon")
        || lower.contains("event id 4624")
        || lower.contains("eventid 4624");
    let asks_registry_audit = lower.contains("registry audit")
        || lower.contains("persistence")
        || lower.contains("debugger hijack")
        || lower.contains("ifeo")
        || lower.contains("winlogon shell")
        || lower.contains("bootexecute")
        || lower.contains("reg query")
        || lower.contains("regedit")
        || lower.contains("sticky keys")
        || lower.contains("sethc.exe");
    let asks_share_access = lower.contains("share access")
        || lower.contains("unc path")
        || lower.contains("smbshare")
        || lower.contains("net share")
        || lower.contains("net use")
        || lower.contains("\\\\")
        || lower.contains("share is reachable")
        || lower.contains("reachable share")
        || (lower.contains("network share")
            && (lower.contains("reach") || lower.contains("access") || lower.contains("test")))
        || (lower.contains("network drive") && !lower.contains("network drives"))
        || lower.contains("mapped drive")
        || lower.contains("shared folder");
    let asks_thermal = lower.contains("thermal")
        || (lower.contains("throttl") && !lower.contains("gpu"))
        || lower.contains("overheat")
        || lower.contains("too hot")
        || lower.contains("running hot")
        || lower.contains("laptop hot")
        || lower.contains("pc getting hot")
        || lower.contains("getting hot")
        || lower.contains("temperature high")
        || lower.contains("cpu temp")
        || lower.contains("cpu temperature")
        || lower.contains("temp sensor")
        || lower.contains("check temps")
        || lower.contains("fan loud")
        || lower.contains("fan noise")
        || lower.contains("fan running")
        || lower.contains("fans running")
        || lower.contains("fan spinning")
        || lower.contains("fans spinning")
        || lower.contains("loud fan")
        || lower.contains("fan always on")
        || (lower.contains("fan") && lower.contains("always on"))
        || lower.contains("fan constantly")
        || lower.contains("fan at max")
        || lower.contains("fan at 100")
        || (lower.contains("temperature")
            && (lower.contains("cpu")
                || lower.contains("gpu")
                || lower.contains("system")
                || lower.contains("sensor")
                || lower.contains("check")
                || lower.contains("monitor")));
    let asks_overclocker = lower.contains("overclocker")
        || lower.contains("nvidia stats")
        || lower.contains("silicon health")
        || lower.contains("mhz")
        || ((lower.contains("voltage") || lower.contains("volts"))
            && (lower.contains("gpu")
                || lower.contains("cpu")
                || lower.contains("nvidia")
                || lower.contains("silicon")))
        || (lower.contains("gpu")
            && (lower.contains("throttl")
                || lower.contains("bottleneck")
                || lower.contains("clock")
                || lower.contains("fan")
                || lower.contains("power draw")
                || lower.contains("frequency")
                || lower.contains("overheating")
                || lower.contains("usage")
                || lower.contains("utilization")
                || lower.contains("performance")));
    let asks_hardware = lower.contains("cpu model")
        || lower.contains("ram size")
        || lower.contains("hardware spec")
        || (lower.contains("what hardware") && lower.contains("have"))
        || (lower.contains("gpu") && (lower.contains("what") || lower.contains("show")))
        || lower.contains("motherboard")
        || lower.contains("bios version")
        || lower.contains("graphics card")
        || lower.contains("video card")
        || lower.contains("system information")
        || lower.contains("system info")
        || lower.contains("system specs")
        || lower.contains("computer spec")
        || lower.contains("display adapter")
        || (lower.contains("how much") && lower.contains("ram"))
        || (lower.contains("what") && lower.contains("processor"))
        || (lower.contains("what") && lower.contains("cpu") && !lower.contains("using"));
    let asks_activation = lower.contains("activation")
        || lower.contains("activated")
        || lower.contains("not activated")
        || lower.contains("product key")
        || lower.contains("license expired")
        || lower.contains("slmgr")
        || lower.contains("license status")
        || lower.contains("is windows genuine")
        || lower.contains("licensed")
        || lower.contains("unlicensed")
        || (lower.contains("activate") && lower.contains("window"));
    let asks_patch_history = lower.contains("patch history")
        || lower.contains("hotfix")
        || lower.contains("kb history")
        || lower.contains("installed updates")
        || lower.contains("security patch")
        || (lower.contains("update") && lower.contains("applied"));
    let asks_ports = lower.contains("listening on port")
        || lower.contains("listening port")
        || lower.contains("open port")
        || lower.contains("port 3000")
        || lower.contains("listening on ")
        || lower.contains("what ports are")
        || lower.contains("what port is")
        || lower.contains("exposed")
        || lower.contains("what is listening")
        || (lower.contains("listening") && lower.contains("port"));
    let asks_repo_doctor = lower.contains("repo doctor")
        || lower.contains("repository doctor")
        || lower.contains("workspace health")
        || lower.contains("repo health")
        || lower.contains("workspace sanity")
        || (lower.contains("git state")
            && (lower.contains("release artifacts")
                || lower.contains("build markers")
                || lower.contains("hematite memory")));
    let asks_directory = lower.contains("directory")
        || lower.contains("folder")
        || lower.contains("how big")
        || lower.contains("biggest");

    let asks_mutation_intent = (lower.contains("make")
        || lower.contains("create")
        || lower.contains("mkdir")
        || lower.contains("organize")
        || lower.contains("edit")
        || lower.contains("write")
        || lower.contains("save")
        || lower.contains("update")
        || lower.contains("change")
        || lower.contains("fix")
        || lower.contains("implement")
        || lower.contains("refactor"))
        && (lower.contains("folder")
            || lower.contains("directory")
            || lower.split_whitespace().any(|w| {
                let w = w.trim_matches(|c: char| !c.is_alphanumeric());
                w == "file"
                    || w == "files"
                    || w == "code"
                    || w == "script"
                    || w == "css"
                    || w == "js"
                    || w == "html"
                    || w == "ts"
                    || w == "rust"
                    || w == "json"
                    || w == "logic"
            })
            || lower.contains("code")
            || lower.contains("desktop")
            || lower.contains("logic")
            || lower.contains("css")
            || lower.contains("styles")
            || lower.contains("script")
            || code_kw_ac().find(&lower).is_some());
    let asks_broad_readiness = lower.contains("local development")
        || lower.contains("ready for local development")
        || (lower.contains("machine") && lower.contains("ready"))
        || (lower.contains("computer") && lower.contains("ready"));
    let asks_os_config = lower.contains("firewall")
        || lower.contains("power plan")
        || lower.contains("power settings")
        || lower.contains("powercfg")
        || lower.contains("uptime")
        || lower.contains("boot time")
        || lower.contains("last boot")
        || lower.contains("windows version")
        || lower.contains("what version of windows")
        || lower.contains("os version")
        || lower.contains("build number")
        || lower.contains("windows build")
        || lower.contains("edition of windows")
        || lower.contains("which windows")
        || (lower.contains("windows")
            && (lower.contains("10 or 11") || lower.contains("11 or 10")));
    let asks_health_report = lower.contains("health report")
        || lower.contains("system health")
        || (lower.contains("how") && lower.contains("machine") && lower.contains("doing"))
        || (lower.contains("status") && lower.contains("report") && !lower.contains("git"));
    let asks_updates = lower.contains("up to date")
        || lower.contains("windows update")
        || lower.contains("pending update")
        || lower.contains("update available")
        || lower.contains("check for update")
        || lower.contains("latest update")
        || (lower.contains("update")
            && (lower.contains("my pc")
                || lower.contains("my computer")
                || lower.contains("my machine")))
        || lower.contains("check updates")
        || lower.contains("update windows")
        || lower.contains("windows needs update")
        || (lower.contains("windows") && lower.contains("out of date"));
    let asks_security = lower.contains("antivirus")
        || lower.contains("defender")
        || lower.contains("virus protection")
        || lower.contains("malware")
        || lower.contains("windows security")
        || lower.contains("windows activated")
        || lower.contains("activation status")
        || (lower.contains("protected") && (lower.contains("pc") || lower.contains("computer")))
        || (lower.contains("security")
            && !lower.contains("git")
            && !lower.contains("ssh")
            && !lower.contains("token"));
    let asks_pending_reboot = lower.contains("need to restart")
        || lower.contains("need to reboot")
        || lower.contains("requires restart")
        || lower.contains("requires a reboot")
        || lower.contains("reboot required")
        || lower.contains("restart required")
        || lower.contains("pending restart")
        || lower.contains("pending reboot")
        || (lower.contains("restart")
            && (lower.contains("waiting")
                || lower.contains("queued")
                || lower.contains("required")))
        || (lower.contains("reboot") && lower.contains("required"))
        || (lower.contains("reboot") && lower.contains("pending"))
        || (lower.contains("restart") && lower.contains("pending"))
        || (lower.contains("have to") && (lower.contains("restart") || lower.contains("reboot")))
        || (lower.contains("do i need to")
            && (lower.contains("restart") || lower.contains("reboot")));
    let asks_disk_health = lower.contains("disk health")
        || lower.contains("drive health")
        || lower.contains("hard drive dying")
        || lower.contains("smart status")
        || lower.contains("drive failing")
        || lower.contains("drive fail")
        || lower.contains("ssd health")
        || lower.contains("nvme health")
        || lower.contains("hard drive status")
        || (lower.contains("drive") && lower.contains("status") && !lower.contains("backup"))
        || (lower.contains("dying") && (lower.contains("drive") || lower.contains("disk")))
        || (lower.contains("healthy")
            && (lower.contains("drive")
                || lower.contains("disk")
                || lower.contains("ssd")
                || lower.contains("hdd")))
        || lower.contains("bad sector")
        || lower.contains("smart data")
        || (lower.contains("disk") && lower.contains("fail"));
    let asks_battery = lower.contains("battery")
        || lower.contains("battery life")
        || lower.contains("battery health")
        || lower.contains("battery wear")
        || lower.contains("charge level")
        || lower.contains("charge percentage")
        || lower.contains("current charge")
        || lower.contains("charge status")
        || lower.contains("how long until")
        || (lower.contains("dying") && lower.contains("batter"));
    let asks_app_crashes = lower.contains("application crash")
        || lower.contains("application error")
        || lower.contains("application hang")
        || lower.contains("app hang")
        || lower.contains("faulting application")
        || lower.contains("faulting module")
        || lower.contains("exception code")
        || lower.contains("windows error reporting")
        || lower.contains("wer report")
        || lower.contains("which app crashed")
        || lower.contains("what app crashed")
        || lower.contains("what crashed")
        || lower.contains("app crash history")
        || lower.contains("application crash log")
        || lower.contains("apps crashing")
        || lower.contains("apps have been crashing")
        || lower.contains("applications crashing")
        || lower.contains("applications have been crashing")
        || lower.contains("what applications crashed")
        || lower.contains("which applications crashed")
        || lower.contains("what applications have been crashing")
        || lower.contains("which applications have been crashing")
        || (lower.contains("applications") && lower.contains("crashing"))
        || (lower.contains("apps") && lower.contains("crashing"))
        || (lower.contains("crash") && lower.contains("program"))
        || (lower.contains("crash")
            && (lower.contains("chrome")
                || lower.contains("edge")
                || lower.contains("firefox")
                || lower.contains("discord")
                || lower.contains("steam")
                || lower.contains("office")
                || lower.contains("word")
                || lower.contains("excel")
                || lower.contains("photoshop")));
    let asks_recent_crashes = lower.contains("crash")
        || lower.contains("bsod")
        || lower.contains("blue screen")
        || lower.contains("why did my pc restart")
        || lower.contains("unexpected restart")
        || lower.contains("sudden restart")
        || lower.contains("keep restarting")
        || lower.contains("keeps restarting")
        || lower.contains("restarts randomly")
        || lower.contains("random restart")
        || lower.contains("random reboot")
        || lower.contains("kernel panic")
        || (lower.contains("restart") && lower.contains("itself"))
        || (lower.contains("restart") && lower.contains("by itself"));
    let asks_log_check = lower.contains("event log")
        || lower.contains("windows log")
        || lower.contains("system log")
        || lower.contains("error log")
        || lower.contains("recent errors")
        || lower.contains("recent warnings")
        || lower.contains("recent events")
        || lower.contains("event viewer")
        || lower.contains("journald")
        || lower.contains("journal log")
        || lower.contains("show me warnings")
        || (lower.contains("log") && lower.contains("error"))
        || (lower.contains("log") && lower.contains("warning"))
        || (lower.contains("show me") && lower.contains("error"))
        || (lower.contains("show me") && lower.contains("warning"))
        || (lower.contains("what errors") && lower.contains("log"));
    let asks_scheduled_tasks = lower.contains("scheduled task")
        || lower.contains("scheduled tasks")
        || lower.contains("task scheduler")
        || lower.contains("what runs on a timer")
        || lower.contains("what runs at")
        || lower.contains("cron job")
        || lower.contains("background task")
        || lower.contains("scheduled job")
        || lower.contains("runs automatically")
        || lower.contains("running automatically")
        || lower.contains("auto-run task")
        || (lower.contains("background") && lower.contains("run"))
        || (lower.contains("periodic") && lower.contains("run"))
        || (lower.contains("what") && lower.contains("schedule"));
    let asks_dev_conflicts = lower.contains("dev conflict")
        || lower.contains("environment conflict")
        || lower.contains("toolchain conflict")
        || lower.contains("version conflict")
        || lower.contains("path conflict")
        || lower.contains("duplicate path")
        || lower.contains("package manager conflict")
        || lower.contains("nvm conflict")
        || lower.contains("pyenv conflict")
        || (lower.contains("python") && lower.contains("wrong version"))
        || (lower.contains("node") && lower.contains("wrong version"))
        || lower.contains("conda shadow")
        || lower.contains("dev environment clean");
    let asks_disk_benchmark = lower.contains("benchmark")
        || lower.contains("stress test")
        || lower.contains("load test")
        || lower.contains("intensity report")
        || lower.contains("io intensity")
        || lower.contains("disk intensity")
        || lower.contains("thrash")
        || lower.contains("latency report");
    let asks_storage_deep = lower.contains("where did my")
        && (lower.contains("space") || lower.contains("disk") || lower.contains("storage"))
        || lower.contains("what is taking up")
        || lower.contains("what is using my disk")
        || lower.contains("what is eating my disk")
        || lower.contains("biggest folders")
        || lower.contains("largest folders")
        || lower.contains("largest directories")
        || lower.contains("what is filling")
        || lower.contains("storage breakdown")
        || lower.contains("disk breakdown")
        || lower.contains("find large files")
        || lower.contains("find big files")
        || lower.contains("storage deep")
        || lower.contains("deep storage")
        || lower.contains("storage analysis")
        || lower.contains("disk analysis")
        || (lower.contains("clean up")
            && (lower.contains("disk")
                || lower.contains("drive")
                || lower.contains("space")
                || lower.contains("storage")))
        || (lower.contains("clean") && lower.contains("c drive"))
        || (lower.contains("analyze") && (lower.contains("storage") || lower.contains("disk")));
    let asks_storage = lower.contains("storage")
        || lower.contains("disk space")
        || lower.contains("drive capacity")
        || lower.contains("free space")
        || lower.contains("how much space")
        || lower.contains("space left")
        || lower.contains("running out of space")
        || lower.contains("i/o pressure")
        || lower.contains("disk usage")
        || lower.contains("disk usage")
        || lower.contains("how much disk")
        || lower.contains("how full")
        || lower.contains("cache size")
        || (lower.contains("drive") && lower.contains("usage"))
        || (lower.contains("drives") && lower.contains("usage"))
        || (lower.contains("where") && lower.contains("space") && lower.contains("go"))
        || ((lower.contains("disk") || lower.contains("drive")) && lower.contains("full"))
        || lower.contains("out of space");
    let asks_resource_load = lower.contains("resource load")
        || lower.contains("system load")
        || lower.contains("performance")
        || lower.contains("utilization")
        || lower.contains("usage report")
        || lower.contains("performance report")
        || lower.contains("what is my load")
        || lower.contains("current load")
        || lower.contains("why is it slow")
        || lower.contains("why is it laggy")
        || lower.contains("memory pressure")
        || lower.contains("memory load")
        || lower.contains("process overhead")
        || lower.contains("slow")
        || lower.contains("lag")
        || lower.contains("sluggish")
        || lower.contains("hang")
        || lower.contains("unresponsive")
        || lower.contains("frozen")
        || lower.contains("freezing up")
        || lower.contains("computer freeze")
        || lower.contains("is it working hard")
        || lower.contains("high cpu")
        || lower.contains("high ram")
        || lower.contains("cpu load")
        || lower.contains("heavy hitters")
        || (lower.contains("resource") && lower.contains("usage"));

    let asks_connectivity = lower.contains("internet")
        || lower.contains("online")
        || lower.contains("connectivity")
        || lower.contains("am i connected")
        || lower.contains("ping google")
        || lower.contains("reach the internet")
        || lower.contains("internet access")
        || lower.contains("no internet")
        || lower.contains("internet down")
        || lower.starts_with("ping ")
        || lower.contains(" ping ")
        || (lower.contains("check") && lower.contains("connection"))
        || (lower.contains("dns") && (lower.contains("resolv") || lower.contains("working")))
        || lower.contains("can't browse")
        || lower.contains("cannot browse")
        || lower.contains("web browsing")
        || lower.contains("browser not loading")
        || lower.contains("pages not loading")
        || lower.contains("websites not loading")
        || lower.contains("no network")
        || (lower.contains("network") && lower.contains("down"))
        || (lower.contains("can't") && lower.contains("connect to internet"))
        || (lower.contains("cannot") && lower.contains("connect to internet"))
        || (lower.contains("network") && lower.contains("not working"))
        || (lower.contains("internet") && lower.contains("not working"));
    let asks_wifi = lower.contains("wi-fi")
        || lower.contains("wifi")
        || lower.contains("wireless")
        || lower.contains("wlan")
        || lower.contains("signal strength")
        || lower.contains("ssid")
        || lower.contains("access point")
        || (lower.contains("wireless") && lower.contains("connect"));
    let asks_connections = lower.contains("tcp connection")
        || lower.contains("active connection")
        || lower.contains("established connection")
        || lower.contains("socket")
        || lower.contains("netstat")
        || lower.contains("outbound connection")
        || lower.contains("inbound connection")
        || lower.contains("remote connection")
        || lower.contains("connection list")
        || (lower.contains("connection") && lower.contains("active"))
        || (lower.contains("connection") && lower.contains("open"))
        || (lower.contains("what") && lower.contains("connecting"))
        || (lower.contains("which") && lower.contains("connecting"))
        || (lower.contains("process") && lower.contains("network") && lower.contains("connect"));
    let asks_vpn = lower.contains("vpn")
        || lower.contains("virtual private network")
        || lower.contains("wireguard")
        || lower.contains("anyconnect")
        || lower.contains("globalprotect")
        || lower.contains("pulse secure")
        || lower.contains("openvpn")
        || lower.contains("split tunnel")
        || lower.contains("vpn adapter")
        || (lower.contains("tunnel") && (lower.contains("network") || lower.contains("vpn")));
    let asks_proxy = lower.contains("proxy")
        || lower.contains("proxy setting")
        || lower.contains("winhttp proxy")
        || lower.contains("system proxy")
        || (lower.contains("routed") && lower.contains("proxy"));
    let asks_firewall_rules = (lower.contains("firewall")
        && (lower.contains("rule")
            || lower.contains("block")
            || lower.contains("allow")
            || lower.contains("inbound")
            || lower.contains("outbound")))
        || lower.contains("blocked port")
        || lower.contains("firewall rule");
    let asks_traceroute = lower.contains("traceroute")
        || lower.contains("tracert")
        || lower.contains("tracepath")
        || lower.contains("trace route")
        || lower.contains("trace the route")
        || lower.contains("trace the path")
        || lower.contains("network path")
        || lower.contains("how many hops")
        || lower.contains("where does traffic go")
        || (lower.contains("trace") && lower.contains("hop"))
        || (lower.contains("route") && lower.contains("traffic"))
        || (lower.contains("trace") && lower.contains("8.8.8.8"))
        || (lower.contains("path") && lower.contains("8.8.8.8"));
    let asks_dns_cache = lower.contains("dns cache")
        || lower.contains("cached dns")
        || lower.contains("dns lookup cache")
        || lower.contains("displaydns")
        || lower.contains("/displaydns")
        || lower.contains("get-dnsclientcache")
        || lower.contains("dns entries")
        || (lower.contains("dns") && lower.contains("cached"));
    let asks_arp = lower.contains("arp -")
        || lower.contains("arp table")
        || lower.contains("arp cache")
        || lower.contains("mac address")
        || lower.contains("neighbor table")
        || lower.contains("ip to mac")
        || lower.contains("ip neigh")
        || (lower.contains("arp")
            && (lower.contains("who") || lower.contains("entry") || lower.contains("entries")));
    let asks_route_table = lower.contains("route print")
        || lower.contains("route table")
        || lower.contains("routing table")
        || lower.contains("get-netroute")
        || lower.contains("default gateway")
        || lower.contains("network routes")
        || lower.contains("ip route")
        || lower.contains("next hop")
        || (lower.contains("route")
            && (lower.contains("table") || lower.contains("entry") || lower.contains("entries")));
    let asks_env = (lower.contains("environment variable")
        || lower.contains("env var")
        || lower.contains("env vars")
        || lower.contains("show env")
        || lower.contains("list env"))
        && !lower.contains("env doctor");
    let asks_hosts_file = lower.contains("hosts file")
        || lower.contains("/etc/hosts")
        || lower.contains("etc/hosts")
        || lower.contains("hosts entry")
        || lower.contains("hosts entries")
        || (lower.contains("hosts")
            && (lower.contains("redirect")
                || lower.contains("block")
                || lower.contains("loopback")));
    let asks_docker = lower.contains("docker")
        || lower.contains("container")
        || lower.contains("docker compose")
        || lower.contains("docker ps")
        || lower.contains("running container");
    let asks_docker_filesystems = (lower.contains("docker")
        || lower.contains("container")
        || lower.contains("compose")
        || lower.contains("volume")
        || lower.contains("bind mount"))
        && (lower.contains("mount")
            || lower.contains("volume")
            || lower.contains("bind")
            || lower.contains("filesystem")
            || lower.contains("storage")
            || lower.contains("path")
            || lower.contains("missing"));
    let asks_wsl = lower.contains("wsl")
        || lower.contains("windows subsystem")
        || lower.contains("linux distro")
        || lower.contains("ubuntu on windows")
        || (lower.contains("subsystem") && lower.contains("linux"));
    let asks_wsl_filesystems = (lower.contains("wsl")
        || lower.contains("windows subsystem")
        || lower.contains("linux distro")
        || lower.contains("ubuntu on windows")
        || (lower.contains("subsystem") && lower.contains("linux")))
        && (lower.contains("mount")
            || lower.contains("filesystem")
            || lower.contains("storage")
            || lower.contains("disk")
            || lower.contains("vhdx")
            || lower.contains("path bridge")
            || lower.contains("/mnt/c")
            || lower.contains("wsl df")
            || lower.contains("wsl du")
            || lower.contains("du -sh /mnt/c"));
    let asks_ssh = (lower.contains("ssh") && !lower.contains("ssh key") && !lower.contains("git"))
        || lower.contains("sshd")
        || lower.contains("ssh config")
        || lower.contains("ssh server")
        || lower.contains("ssh client")
        || lower.contains("known_hosts")
        || lower.contains("authorized_keys")
        || lower.contains("ssh key")
        || (lower.contains("ssh")
            && (lower.contains("running")
                || lower.contains("service")
                || lower.contains("port 22")));
    let asks_installed_software = lower.contains("installed software")
        || lower.contains("installed program")
        || lower.contains("installed app")
        || lower.contains("installed package")
        || lower.contains("what is installed")
        || lower.contains("what's installed")
        || lower.contains("winget list")
        || lower.contains("list programs")
        || lower.contains("list applications")
        || lower.contains("list all apps")
        || lower.contains("list apps")
        || lower.contains("show applications")
        || lower.contains("show programs")
        || (lower.contains("list") && lower.contains("application"))
        || (lower.contains("show") && lower.contains("application"))
        || (lower.contains("installed")
            && (lower.contains("on this machine")
                || lower.contains("on my machine")
                || lower.contains("on my pc")));
    let asks_databases = lower.contains("postgres")
        || lower.contains("postgresql")
        || lower.contains("mysql")
        || lower.contains("mariadb")
        || lower.contains("mongodb")
        || lower.contains("mongo")
        || lower.contains("redis")
        || lower.contains("sql server")
        || lower.contains("mssql")
        || lower.contains("sqlite")
        || lower.contains("elasticsearch")
        || lower.contains("cassandra")
        || lower.contains("couchdb")
        || (lower.contains("database")
            && (lower.contains("running")
                || lower.contains("service")
                || lower.contains("installed")
                || lower.contains("up")
                || lower.contains("local")))
        || lower.contains("db service")
        || lower.contains("database server")
        || (lower.contains("is")
            && lower.contains("running")
            && (lower.contains("db") || lower.contains("database")));
    let asks_git_config = (lower.contains("git config")
        || lower.contains("git configuration")
        || lower.contains("git global")
        || (lower.contains("git") && lower.contains("user.name"))
        || (lower.contains("git") && lower.contains("user.email"))
        || (lower.contains("git") && lower.contains("signing"))
        || (lower.contains("git") && lower.contains("credential"))
        || (lower.contains("git") && lower.contains("auth"))
        || lower.contains("git push denied")
        || lower.contains("git clone failed")
        || lower.contains("git identity")
        || lower.contains("git aliases"))
        && !lower.contains("github");
    let asks_audit_policy = lower.contains("audit policy")
        || lower.contains("auditpol")
        || lower.contains("audit log")
        || lower.contains("what is being logged")
        || lower.contains("security audit")
        || lower.contains("logon event")
        || lower.contains("login event")
        || lower.contains("audit category")
        || lower.contains("event auditing")
        || (lower.contains("audit") && lower.contains("event"))
        || (lower.contains("what") && lower.contains("being audited"))
        || (lower.contains("audit") && lower.contains("enable"));
    let asks_shares = lower.contains("smb share")
        || lower.contains("network share")
        || lower.contains("shared folder")
        || lower.contains("mapped drive")
        || lower.contains("mapped network drive")
        || lower.contains("get-smbshare")
        || lower.contains("what is shared")
        || lower.contains("what am i sharing")
        || lower.contains("file sharing")
        || lower.contains("smb session")
        || lower.contains("lanmanager")
        || lower.contains("netlanmanager")
        || lower.contains("smb1")
        || lower.contains("smb signing")
        || lower.contains("nfs export")
        || (lower.contains("folder") && lower.contains("shared"))
        || (lower.contains("sharing") && lower.contains("network"))
        || lower.contains("what am i sharing");
    let asks_dns_servers = (lower.contains("dns server")
        || lower.contains("dns resolver")
        || lower.contains("nameserver")
        || lower.contains("which dns")
        || lower.contains("what dns")
        || lower.contains("dns over https")
        || lower.contains("doh")
        || lower.contains("dns search suffix")
        || lower.contains("configured dns")
        || lower.contains("get-dnsclientserveraddress"))
        && !lower.contains("dns cache")
        && (!lower.contains("adapter")
            || contains_any(
                &lower,
                &[
                    "dns server",
                    "dns resolver",
                    "nameserver",
                    "configured dns",
                    "per adapter",
                    "which dns",
                    "what dns",
                    "get-dnsclientserveraddress",
                ],
            ))
        && !lower.contains("ip address")
        && !lower.contains("gateway");
    let asks_bitlocker = lower.contains("bitlocker")
        || (lower.contains("drive") && lower.contains("encrypt"))
        || (lower.contains("disk") && lower.contains("encrypt"))
        || (lower.contains("ssd") && lower.contains("encrypt"))
        || (lower.contains("volume") && lower.contains("encrypt"))
        || (lower.contains("machine") && lower.contains("encrypt"))
        || lower.contains("encryption status")
        || lower.contains("full disk encryption")
        || lower.contains("drive encryption");
    let asks_rdp = lower.contains("rdp")
        || lower.contains("remote desktop")
        || (lower.contains("remote") && lower.contains("access") && !lower.contains("git"));
    let asks_shadow_copies = lower.contains("shadow copy")
        || lower.contains("shadow copies")
        || lower.contains("vss")
        || lower.contains("snapshot")
        || lower.contains("restore point");
    let asks_pagefile = lower.contains("pagefile")
        || lower.contains("page file")
        || lower.contains("virtual memory")
        || lower.contains("swap file")
        || lower.contains("swap space")
        || lower.contains("memory swapping")
        || lower.contains("paging file")
        || (lower.contains("paging") && lower.contains("file"))
        || (lower.contains("paging") && lower.contains("active"));
    let asks_windows_features = (lower.contains("window") && lower.contains("feature"))
        || lower.contains("optional feature")
        || lower.contains("iis")
        || lower.contains("hyper-v")
        || (lower.contains("feature")
            && (lower.contains("install")
                || lower.contains("enabled")
                || lower.contains("turn on")));
    let asks_printers = lower.contains("printer")
        || lower.contains("print queue")
        || lower.contains("get-printer")
        || lower.contains("printing")
        || lower.contains("can't print")
        || lower.contains("cannot print")
        || lower.contains("print job")
        || lower.contains("print driver")
        || lower.contains("default printer")
        || lower.contains("add printer")
        || lower.contains("print to pdf")
        || (lower.contains("print") && lower.contains("not working"))
        || (lower.contains("print") && lower.contains("stuck"))
        || (lower.contains("print") && lower.contains("pending"))
        || (lower.contains("print") && lower.contains("offline"));
    let asks_winrm = lower.contains("winrm")
        || lower.contains("psremoting")
        || (lower.contains("ps") && lower.contains("remoting"))
        || (lower.contains("remote") && lower.contains("management") && !lower.contains("rdp"));
    let asks_network_stats = (lower.contains("network") && lower.contains("stat"))
        || (lower.contains("adapter")
            && lower.contains("stat")
            && !lower.contains("wlan")
            && !lower.contains("wireless"))
        || (lower.contains("nic") && lower.contains("stat"))
        || lower.contains("throughput")
        || lower.contains("dropped packet")
        || (lower.contains("network") && lower.contains("usage"))
        || (lower.contains("data") && lower.contains("transferred"))
        || (lower.contains("bytes") && lower.contains("transferred"))
        || lower.contains("network traffic")
        || (lower.contains("packet") && lower.contains("error"));
    let asks_udp_ports = lower.contains("udp port")
        || lower.contains("udp listener")
        || (lower.contains("udp")
            && (lower.contains("port")
                || lower.contains("listen")
                || lower.contains("open")
                || lower.contains("service")
                || lower.contains("connection")));

    let asks_domain_health = lower.contains("domain health")
        || lower.contains("dc connectivity")
        || lower.contains("dc reachab")
        || lower.contains("can reach dc")
        || lower.contains("ldap port")
        || lower.contains("kerberos health")
        || lower.contains("kerberos connectivity")
        || lower.contains("ad connectivity")
        || lower.contains("active directory health")
        || lower.contains("domain controller connectivity")
        || lower.contains("domain controller reachab")
        || lower.contains("nltest")
        || lower.contains("dsgetdc")
        || lower.contains("gpo refresh")
        || (lower.contains("domain controller")
            && (lower.contains("reach")
                || lower.contains("connect")
                || lower.contains("test")
                || lower.contains("check")
                || lower.contains("online")
                || lower.contains("up")))
        || (lower.contains("active directory")
            && (lower.contains("connect")
                || lower.contains("reach")
                || lower.contains("health")
                || lower.contains("working")
                || lower.contains("accessible")))
        || (lower.contains("can reach") && lower.contains("domain"))
        || (lower.contains("kerberos") && lower.contains("issue"))
        || (lower.contains("kerberos") && lower.contains("fail"));
    let asks_service_dependencies = lower.contains("service depend")
        || lower.contains("services depend")
        || lower.contains("depends on")
        || lower.contains("service graph")
        || lower.contains("which services depend")
        || lower.contains("what depends on")
        || lower.contains("restart cascade")
        || lower.contains("svc dep")
        || lower.contains("service prerequisite")
        || (lower.contains("service")
            && (lower.contains("dependency")
                || lower.contains("dependencies")
                || lower.contains("required by")
                || lower.contains("needed by")
                || lower.contains("requirement")
                || lower.contains("relationship")));
    let asks_wmi_health = lower.contains("wmi health")
        || lower.contains("wmi corrupt")
        || lower.contains("wmi repository")
        || lower.contains("wmi broken")
        || lower.contains("winmgmt")
        || lower.contains("wmi query fail")
        || lower.contains("wmi not working")
        || (lower.contains("wmi")
            && (lower.contains("health")
                || lower.contains("status")
                || lower.contains("repair")
                || lower.contains("reset")
                || lower.contains("broken")));
    let asks_local_security_policy = lower.contains("password policy")
        || lower.contains("account lockout")
        || lower.contains("lockout policy")
        || lower.contains("lockout threshold")
        || lower.contains("lm compatibility")
        || lower.contains("ntlm level")
        || lower.contains("ntlm policy")
        || lower.contains("local security policy")
        || lower.contains("account policy")
        || lower.contains("uac level")
        || lower.contains("uac policy")
        || lower.contains("uac disabled")
        || lower.contains("uac prompt")
        || lower.contains("uac not")
        || lower.contains("user account control")
        || lower.contains("needs elevation")
        || lower.contains("needs admin")
        || lower.contains("run as administrator")
        || lower.contains("administrator permission")
        || lower.contains("lmcompatibilitylevel")
        || lower.contains("net accounts")
        || lower.contains("lockout")
        || (lower.contains("uac")
            && (lower.contains("off")
                || lower.contains("status")
                || lower.contains("check")
                || lower.contains("on")))
        || (lower.contains("password")
            && (lower.contains("minimum")
                || lower.contains("maximum age")
                || lower.contains("complexity")
                || lower.contains("history")
                || lower.contains("policy")));
    let asks_usb_history = lower.contains("usb history")
        || lower.contains("usb devices connected")
        || lower.contains("usb forensic")
        || lower.contains("usbstor")
        || lower.contains("usb registry")
        || lower.contains("what usb")
        || lower.contains("ever connected usb")
        || lower.contains("usb devices ever")
        || lower.contains("usb drives ever")
        || (lower.contains("usb")
            && (lower.contains("history")
                || lower.contains("forensic")
                || lower.contains("audit")
                || lower.contains("ever connected")
                || lower.contains("registry")
                || lower.contains("plugged")
                || lower.contains("were connected")
                || lower.contains("have been connected")
                || lower.contains("has been connected")));
    let asks_print_spooler = lower.contains("print spooler")
        || lower.contains("spooler service")
        || lower.contains("printnightmare")
        || lower.contains("print nightmar")
        || lower.contains("cve-2021-34527")
        || lower.contains("cve-2021-1675")
        || lower.contains("print security")
        || lower.contains("printer security")
        || lower.contains("printer service")
        || lower.contains("point and print")
        || lower.contains("rpcauthnlevel")
        || (lower.contains("print") && lower.contains("vulnerab"))
        || lower.contains("print service")
        || (lower.contains("printer") && lower.contains("spooler"))
        || (lower.contains("spooler")
            && (lower.contains("status")
                || lower.contains("running")
                || lower.contains("security")
                || lower.contains("hardening")));

    // Host-remediation queries (e.g., "fix cargo not found on this machine") contain
    // code keywords like "cargo" that also trip the mutation guard. Check fix_plan
    // first so these read-only host inspection requests are never silently dropped.
    if asks_fix_plan && asks_mutation_intent {
        return Some("fix_plan");
    }

    // If the user has a clear mutation intent (create folder, edit file),
    // we should NOT route to a read-only host inspection topic, as that would
    // trigger a pre-run crash. The main LLM turn will handle the mutation.
    if asks_mutation_intent {
        return None;
    }

    // Priority 1: High-Precision Enterprise Triage (IT Pro Plus)
    if asks_overclocker {
        Some("overclocker")
    } else if asks_ad_user {
        Some("ad_user")
    } else if asks_user_accounts {
        Some("user_accounts")
    } else if asks_dns_lookup {
        Some("dns_lookup")
    } else if asks_event_query {
        Some("event_query")
    } else if asks_mdm {
        Some("mdm_enrollment")
    } else if asks_hyperv {
        Some("hyperv")
    } else if asks_ip_config {
        Some("ip_config")
    } else if asks_disk_benchmark {
        Some("disk_benchmark")
    } else if asks_fix_plan {
        Some("fix_plan")
    } else if asks_env_doctor {
        Some("env_doctor")
    } else if asks_traceroute {
        Some("traceroute")
    } else if asks_dhcp {
        Some("dhcp")
    } else if asks_mtu {
        Some("mtu")
    } else if asks_ipv6 {
        Some("ipv6")
    } else if asks_domain_health {
        Some("domain_health")
    } else if asks_service_dependencies {
        Some("service_dependencies")
    } else if asks_wmi_health {
        Some("wmi_health")
    } else if asks_local_security_policy {
        Some("local_security_policy")
    } else if asks_usb_history {
        Some("usb_history")
    } else if asks_print_spooler {
        Some("print_spooler")
    } else if asks_latency {
        Some("latency")
    } else if asks_nic_teaming {
        Some("nic_teaming")
    } else if asks_network_stats {
        Some("network_stats")
    } else if asks_share_access {
        Some("share_access")
    } else if asks_thermal {
        Some("thermal")
    } else if asks_activation {
        Some("activation")
    } else if asks_patch_history {
        Some("patch_history")
    } else if asks_bluetooth {
        Some("bluetooth")
    } else if asks_audio {
        Some("audio")
    } else if asks_camera {
        Some("camera")
    } else if asks_identity_auth {
        Some("identity_auth")
    } else if asks_sign_in {
        Some("sign_in")
    } else if asks_installer_health {
        Some("installer_health")
    } else if asks_teams {
        Some("teams")
    } else if asks_windows_backup {
        Some("windows_backup")
    } else if asks_onedrive {
        Some("onedrive")
    } else if asks_browser_health {
        Some("browser_health")
    } else if asks_outlook {
        Some("outlook")
    } else if asks_search_index {
        Some("search_index")
    } else if asks_display_config {
        Some("display_config")
    } else if asks_ntp {
        Some("ntp")
    } else if asks_cpu_power {
        Some("cpu_power")
    } else if asks_credentials {
        Some("credentials")
    } else if asks_tpm {
        Some("tpm")
    } else if asks_network_adapter {
        Some("network_adapter")
    } else if asks_tcp_params {
        Some("tcp_params")
    } else if asks_wlan_profiles {
        Some("wlan_profiles")
    } else if asks_ipsec {
        Some("ipsec")
    } else if asks_udp_ports {
        Some("udp_ports")
    } else if asks_port_test {
        Some("port_test")
    } else if asks_netbios {
        Some("netbios")
    } else if asks_snmp {
        Some("snmp")
    } else if asks_network_profile {
        Some("network_profile")
    } else if asks_permissions {
        Some("permissions")
    } else if asks_login_history {
        Some("login_history")
    } else if asks_registry_audit {
        Some("registry_audit")
    } else if asks_docker_filesystems {
        Some("docker_filesystems")
    } else if asks_wsl_filesystems {
        Some("wsl_filesystems")
    } else if asks_lan_discovery {
        Some("lan_discovery")
    } else if asks_storage_spaces {
        Some("storage_spaces")
    } else if asks_defender_quarantine {
        Some("defender_quarantine")
    } else if asks_storage_deep {
        Some("storage_deep")
    } else if asks_storage {
        Some("storage")
    } else if asks_gpo {
        Some("gpo")
    } else if asks_data_audit {
        Some("data_audit")
    } else if asks_certificates {
        Some("certificates")
    } else if asks_integrity {
        Some("integrity")
    } else if asks_domain {
        Some("domain")
    } else if asks_device_health {
        Some("device_health")
    } else if asks_drivers {
        Some("drivers")
    } else if asks_peripherals {
        Some("peripherals")
    } else if asks_sessions {
        Some("sessions")
    } else if asks_virtualization {
        Some("hardware")
    } else if asks_services {
        Some("services")
    } else if asks_startup {
        Some("startup_items")
    } else if asks_bitlocker {
        Some("bitlocker")
    } else if asks_rdp {
        Some("rdp")
    } else if asks_shadow_copies {
        Some("shadow_copies")
    } else if asks_pagefile {
        Some("pagefile")
    } else if asks_windows_features {
        Some("windows_features")
    } else if asks_printers {
        Some("printers")
    } else if asks_winrm {
        Some("winrm")
    } else if (asks_path && asks_toolchains)
        || (mentions_host_inspection_question(&lower) && asks_broad_readiness)
    {
        Some("summary")
    } else if asks_dns_servers {
        Some("dns_servers")
    } else if asks_connectivity {
        Some("connectivity")
    } else if asks_wifi {
        Some("wifi")
    } else if asks_connections {
        Some("connections")
    } else if asks_vpn {
        Some("vpn")
    } else if asks_proxy {
        Some("proxy")
    } else if asks_firewall_rules {
        Some("firewall_rules")
    } else if asks_dns_cache {
        Some("dns_cache")
    } else if asks_arp {
        Some("arp")
    } else if asks_route_table {
        Some("route_table")
    } else if asks_shares {
        Some("shares")
    } else if asks_network {
        Some("network")
    } else if asks_health_report {
        Some("health_report")
    } else if asks_os_config {
        Some("os_config")
    } else if asks_hardware || asks_virtualization {
        Some("hardware")
    } else if asks_updates {
        Some("updates")
    } else if asks_audit_policy {
        Some("audit_policy")
    } else if asks_security {
        Some("security")
    } else if asks_pending_reboot {
        Some("pending_reboot")
    } else if asks_disk_health {
        Some("disk_health")
    } else if asks_battery {
        Some("battery")
    } else if asks_app_crashes {
        Some("app_crashes")
    } else if asks_recent_crashes {
        Some("recent_crashes")
    } else if asks_log_check {
        Some("log_check")
    } else if asks_scheduled_tasks {
        Some("scheduled_tasks")
    } else if asks_dev_conflicts {
        Some("dev_conflicts")
    } else if asks_databases {
        Some("databases")
    } else if asks_docker {
        Some("docker")
    } else if asks_wsl {
        Some("wsl")
    } else if asks_ssh {
        Some("ssh")
    } else if asks_git_config {
        Some("git_config")
    } else if asks_installed_software {
        Some("installed_software")
    } else if asks_env {
        Some("env")
    } else if asks_hosts_file {
        Some("hosts_file")
    } else if asks_ports {
        Some("ports")
    } else if asks_processes {
        Some("processes")
    } else if asks_repo_doctor {
        Some("repo_doctor")
    } else if lower.contains("desktop")
        && (lower.contains("show")
            || lower.contains("list")
            || lower.contains("what is in")
            || lower.contains("what's in")
            || lower.contains("folder"))
    {
        Some("desktop")
    } else if lower.contains("downloads")
        && (lower.contains("show")
            || lower.contains("list")
            || lower.contains("what is in")
            || lower.contains("what's in")
            || lower.contains("folder"))
    {
        Some("downloads")
    } else if asks_path {
        Some("path")
    } else if asks_toolchains {
        Some("toolchains")
    } else if asks_resource_load {
        Some("resource_load")
    } else if asks_directory {
        Some("directory")
    } else if mentions_host_inspection_question(&lower) && !is_conversational_advisory(&lower) {
        Some("summary")
    } else {
        None
    }
}

type TopicDetector = (&'static str, fn(&str) -> bool);

pub fn all_host_inspection_topics(user_input: &str) -> Vec<&'static str> {
    // All topic detectors in priority order — ordered so more specific topics come
    // before generic fallbacks (e.g. traceroute before network).
    let lower = user_input.to_lowercase();
    let mut topics: Vec<&'static str> = Vec::with_capacity(4);

    let detectors: &[TopicDetector] = &[
        ("overclocker", |l| {
            l.contains("overclocker")
                || l.contains("gpu clock")
                || l.contains("gpu throttle")
                || l.contains("throttle reason")
                || l.contains("root cause")
                || l.contains("nvidia stats")
                || l.contains("silicon health")
                || ((l.contains("voltage") || l.contains("volts"))
                    && (l.contains("gpu")
                        || l.contains("cpu")
                        || l.contains("nvidia")
                        || l.contains("silicon")))
                || (l.contains("gpu")
                    && (l.contains("throttle")
                        || l.contains("bottleneck")
                        || l.contains("performance")
                        || l.contains("overheating")
                        || l.contains("usage")
                        || l.contains("utilization")))
        }),
        ("data_audit", |l| {
            l.contains("data audit")
                || l.contains("audit data")
                || l.contains("csv schema")
                || l.contains("data schema")
                || l.contains("inspect file")
                || l.contains("profile data")
                || l.contains("data distribution")
                || (l.contains("schema") && (l.contains("csv") || l.contains("json")))
        }),
        ("directory", |l| {
            (l.contains("make")
                || l.contains("create")
                || l.contains("mkdir")
                || l.contains("organize"))
                && (l.contains("folder")
                    || l.contains("directory")
                    || l.contains("project area")
                    || l.contains("desktop"))
        }),
        ("ad_user", |l| {
            l.contains("ad user")
                || l.contains("domain user")
                || (l.contains("user") && (l.contains("sid") || l.contains("membership")))
        }),
        ("dns_lookup", |l| {
            l.contains("dns lookup")
                || l.contains("dns record")
                || l.contains("dns query")
                || l.contains("nslookup")
                || l.contains("resolve-dnsname")
                || l.contains("gethostaddresses")
                || l.contains("gethostentry")
                || l.contains("[system.net.dns]")
                || l.contains(" dig ")
                || l.starts_with("host ")
                || (l.contains("ip address") && l.contains(" of "))
                || l.contains("srv record")
                || l.contains("mx record")
        }),
        ("mdm_enrollment", |l| {
            l.contains("mdm")
                || l.contains("intune")
                || l.contains("autopilot")
                || l.contains("device enrollment")
                || l.contains("enrolled in")
                || l.contains("mdm enrollment")
                || l.contains("device management")
                || l.contains("managed device")
                || l.contains("azure ad join")
                || l.contains("aad join")
                || (l.contains("enrolled") && l.contains("device"))
                || (l.contains("enroll") && l.contains("device"))
                || (l.contains("microsoft") && l.contains("endpoint"))
        }),
        ("hyperv", |l| {
            l.contains("hyper-v")
                || l.contains("hyperv")
                || l.contains("hyper v")
                || l.contains("virtual machine")
                || l.contains("running vms")
                || l.contains("list vms")
                || l.contains("list vm")
                || l.contains("vmmem")
                || l.contains("vmms")
                || (l.contains("vm")
                    && !l.contains("nvme")
                    && (l.contains("checkpoint")
                        || l.contains("snapshot")
                        || l.contains("switch")
                        || l.contains("running")))
        }),
        ("ip_config", |l| {
            l.contains("ipconfig")
                || l.contains("ip config")
                || l.contains("adapter detail")
                || l.contains("dhcp lease")
        }),
        ("event_query", |l| {
            l.contains("event id")
                || l.contains("event_id")
                || l.contains("eventid")
                || l.contains("event log query")
                || l.contains("search event")
                || l.contains("query event")
                || l.contains("failed logon event")
                || l.contains("failed login event")
                || l.contains("application error event")
                || ((l.contains("event log")
                    || l.contains("system log")
                    || l.contains("application log")
                    || l.contains("security log"))
                    && (l.contains("last ")
                        || l.contains("past ")
                        || l.contains("today")
                        || l.contains("hour")
                        || l.contains("hours"))
                    && (l.contains("error")
                        || l.contains("errors")
                        || l.contains("warning")
                        || l.contains("warnings")
                        || l.contains("critical")))
                || (l.contains("event")
                    && (l.contains("4625")
                        || l.contains("7034")
                        || l.contains("7031")
                        || l.contains("4648")))
        }),
        ("fix_plan", |l| {
            l.contains("fix")
                && (l.contains("cargo")
                    || l.contains("port ")
                    || l.contains("lm studio")
                    || l.contains("toolchain"))
        }),
        ("updates", |l| {
            l.contains("up to date")
                || l.contains("windows update")
                || l.contains("pending update")
                || l.contains("update available")
                || l.contains("check updates")
                || l.contains("update windows")
                || (l.contains("windows") && l.contains("out of date"))
        }),
        ("security", |l| {
            l.contains("antivirus")
                || l.contains("defender")
                || l.contains("uac")
                || (l.contains("security") && !l.contains("git") && !l.contains("ssh"))
        }),
        ("defender_quarantine", |l| {
            l.contains("defender quarantine")
                || l.contains("quarantine threat")
                || l.contains("quarantine")
                || l.contains("threat history")
                || l.contains("malware history")
                || l.contains("defender history")
                || l.contains("detected threat")
                || l.contains("detected virus")
                || l.contains("malware detected")
                || l.contains("defender found")
                || l.contains("defender detected")
                || l.contains("defender find")
                || l.contains("virus found")
                || l.contains("threats found")
                || l.contains("threat detected")
                || l.contains("threat detection")
                || (l.contains("defender")
                    && (l.contains("malware") || l.contains("virus") || l.contains("threat")))
                || (l.contains("defender")
                    && l.contains("scan")
                    && (l.contains("result") || l.contains("history") || l.contains("found")))
        }),
        ("permissions", |l| {
            l.contains("permission") || l.contains("access control") || l.contains("get-acl")
        }),
        ("login_history", |l| {
            l.contains("login history")
                || l.contains("logon history")
                || l.contains("event id 4624")
        }),
        ("registry_audit", |l| {
            l.contains("registry audit")
                || l.contains("persistence")
                || l.contains("ifeo")
                || l.contains("reg query")
        }),
        ("share_access", |l| {
            l.contains("share access")
                || l.contains("unc path")
                || l.contains("smbshare")
                || l.contains("net share")
                || (l.contains("network drive") && !l.contains("network drives"))
                || l.contains("mapped drive")
                || l.contains("shared folder")
        }),
        ("thermal", |l| {
            l.contains("thermal")
                || l.contains("throttling")
                || l.contains("overheat")
                || l.contains("too hot")
                || l.contains("running hot")
                || l.contains("cpu temp")
                || l.contains("cpu temperature")
                || l.contains("temp sensor")
                || l.contains("fan loud")
                || l.contains("fan noise")
                || l.contains("fan spinning")
                || l.contains("fan running")
                || l.contains("fans running")
                || l.contains("fans spinning")
                || l.contains("loud fan")
                || l.contains("fan always on")
                || (l.contains("fan") && l.contains("always on"))
                || l.contains("fan at 100")
                || l.contains("fan constantly")
                || l.contains("laptop hot")
                || l.contains("pc getting hot")
                || l.contains("getting hot")
                || l.contains("check temps")
                || (l.contains("temperature")
                    && (l.contains("cpu")
                        || l.contains("gpu")
                        || l.contains("system")
                        || l.contains("sensor")
                        || l.contains("check")))
        }),
        ("overclocker", |l| {
            l.contains("overclocker")
                || l.contains("gpu clock")
                || l.contains("nvidia stats")
                || l.contains("silicon health")
                || l.contains("mhz")
                || (l.contains("gpu")
                    && (l.contains("usage")
                        || l.contains("utilization")
                        || l.contains("performance")))
        }),
        ("activation", |l| {
            l.contains("activation")
                || l.contains("slmgr")
                || l.contains("license status")
                || l.contains("licensed")
                || l.contains("unlicensed")
                || (l.contains("activate") && l.contains("window"))
                || l.contains("not activated")
                || l.contains("product key")
                || l.contains("license expired")
                || l.contains("is windows genuine")
                || (l.contains("windows") && l.contains("activated"))
        }),
        ("patch_history", |l| {
            l.contains("patch history")
                || l.contains("hotfix")
                || l.contains("kb history")
                || l.contains("security patch")
                || (l.contains("update") && l.contains("applied"))
        }),
        ("bluetooth", |l| {
            l.contains("bluetooth")
                || l.contains("pairing")
                || l.contains("paired device")
                || l.contains("paired devices")
                || l.contains("bthserv")
                || l.contains("bthavctpsvc")
                || l.contains("btagservice")
                || l.contains("bluetoothuserservice")
                || ((l.contains("headset") || l.contains("headphones"))
                    && (l.contains("disconnect")
                        || l.contains("pair")
                        || l.contains("reconnect")
                        || l.contains("bluetooth")))
        }),
        ("audio", |l| {
            l.contains("no sound")
                || l.contains("audio service")
                || l.contains("windows audio")
                || l.contains("speaker")
                || l.contains("speakers")
                || l.contains("microphone")
                || l.contains(" mic ")
                || l.starts_with("mic ")
                || l.contains("mic not")
                || l.contains("headset")
                || l.contains("headphones")
                || l.contains("playback device")
                || l.contains("recording device")
                || l.contains("audio endpoint")
                || l.contains("audioendpointbuilder")
                || l.contains("can't hear")
                || l.contains("cannot hear")
                || l.contains("cant hear")
                || l.contains("no audio")
                || (((l.contains("audio") || l.contains("sound"))
                    && (l.contains("device")
                        || l.contains("driver")
                        || l.contains("service")
                        || l.contains("working")
                        || l.contains("broken")
                        || l.contains("input")
                        || l.contains("output")
                        || l.contains("crackling")
                        || l.contains("mute")
                        || l.contains("muted")
                        || l.contains("volume")
                        || l.contains("speaker")
                        || l.contains("microphone")))
                    && !l.contains("audio file")
                    && !l.contains("voice engine"))
        }),
        ("camera", |l| {
            l.contains("camera")
                || l.contains("webcam")
                || l.contains("web cam")
                || (l.contains("camera") && l.contains("permission"))
                || (l.contains("camera") && l.contains("privacy"))
        }),
        ("sign_in", |l| {
            l.contains("windows hello")
                || l.contains("sign in")
                || l.contains("cant sign in")
                || l.contains("can't sign in")
                || l.contains("logon failure")
                || l.contains("login screen stuck")
                || l.contains("stuck on login")
                || l.contains("login loop")
                || l.contains("can't login")
                || l.contains("cannot login")
                || l.contains("cant login")
                || l.contains("login failed")
                || l.contains("login failure")
                || (l.contains("login") && l.contains("not working"))
                || (l.contains("login") && l.contains("problem"))
                || (l.contains("login") && l.contains("status"))
                || l.contains("sign-in status")
                || l.contains("sign in status")
                || (l.contains("can't log in") && !l.contains("vpn") && !l.contains("ssh"))
                || (l.contains("pin") && (l.contains("broken") || l.contains("not working")))
                || l.contains("credential provider")
                || l.contains("biometric service")
                || l.contains("wbiosrvc")
        }),
        ("identity_auth", |l| {
            l.contains("web account manager")
                || l.contains("token broker")
                || l.contains("tokenbroker")
                || l.contains("aad broker")
                || l.contains("broker plugin")
                || l.contains("identity broker")
                || l.contains("microsoft 365 sign-in")
                || l.contains("microsoft 365 signin")
                || l.contains("office sign-in")
                || l.contains("office signin")
                || l.contains("workplace join")
                || l.contains("device registration")
                || l.contains("device registered")
                || l.contains("entra")
                || l.contains("azure ad")
                || l.contains("azuread")
                || l.contains("azure ad prt")
                || l.contains("azureadprt")
                || l.contains("wamdefaultset")
                || l.contains("single sign-on")
                || l.contains("organizational account")
                || l.contains("corporate account")
                || (l.contains("azure") && l.contains("registered"))
                || ((l.contains("outlook")
                    || l.contains("teams")
                    || l.contains("onedrive")
                    || l.contains("office")
                    || l.contains("microsoft 365"))
                    && (l.contains("sign in")
                        || l.contains("signin")
                        || l.contains("signed in")
                        || l.contains("signed out")
                        || l.contains("keeps asking")
                        || l.contains("keep asking")
                        || l.contains("authentication")
                        || l.contains("auth")
                        || l.contains("token")
                        || l.contains("work account")
                        || l.contains("school account")
                        || l.contains("account mismatch")))
        }),
        ("installer_health", |l| {
            l.contains("installer health")
                || l.contains("installer broken")
                || l.contains("msiexec")
                || l.contains("msi installer")
                || l.contains("windows installer")
                || l.contains("app installer")
                || l.contains("desktopappinstaller")
                || l.contains("microsoft store")
                || l.contains("winget broken")
                || (l.contains("unable to install")
                    && (l.contains("app") || l.contains("program") || l.contains("software")))
                || ((l.contains("install") || l.contains("installer"))
                    && (l.contains("fail")
                        || l.contains("failing")
                        || l.contains("broken")
                        || l.contains("stuck")
                        || l.contains("hanging")
                        || l.contains("error"))
                    && !l.contains("windows update"))
        }),
        ("onedrive", |l| {
            l.contains("onedrive")
                || l.contains("one drive")
                || l.contains("files on-demand")
                || l.contains("known folder backup")
                || l.contains("known folder move")
                || l.contains("kfm")
                || l.contains("sharepoint sync")
                || l.contains("sync root")
                || ((l.contains("desktop") || l.contains("documents") || l.contains("pictures"))
                    && l.contains("backup")
                    && (l.contains("onedrive") || l.contains("cloud") || l.contains("sync")))
                || ((l.contains("desktop") || l.contains("documents") || l.contains("pictures"))
                    && l.contains("sync")
                    && (l.contains("onedrive") || l.contains("sharepoint") || l.contains("cloud")))
        }),
        ("browser_health", |l| {
            l.contains("browser health")
                || l.contains("webview2")
                || l.contains("default browser")
                || ((l.contains("browser")
                    || l.contains("chrome")
                    || l.contains("edge")
                    || l.contains("firefox"))
                    && (l.contains("slow")
                        || l.contains("sluggish")
                        || l.contains("lag")
                        || l.contains("crash")
                        || l.contains("crashing")
                        || l.contains("hang")
                        || l.contains("freeze")
                        || l.contains("frozen")
                        || l.contains("broken")
                        || l.contains("unresponsive")
                        || l.contains("not starting")
                        || l.contains("not loading")
                        || l.contains("extension")
                        || l.contains("extensions")
                        || l.contains("proxy")
                        || l.contains("policy")))
                || ((l.contains("links") || l.contains("link"))
                    && (l.contains("open wrong")
                        || l.contains("opens wrong")
                        || l.contains("wrong browser")
                        || l.contains("wrong app")))
        }),
        ("outlook", |l| {
            l.contains("outlook")
                || l.contains("ms outlook")
                || l.contains("microsoft outlook")
                || (l.contains("ost") && l.contains("mail"))
                || (l.contains("pst") && l.contains("mail"))
                || (l.contains("add-in") && l.contains("mail"))
        }),
        ("teams", |l| {
            (l.contains("teams")
                && !l.contains("nic team")
                && !l.contains("nic teaming")
                && !l.contains("link aggregation")
                && !l.contains("lbfo"))
                || l.contains("ms teams")
                || l.contains("microsoft teams")
        }),
        ("windows_backup", |l| {
            l.contains("file history")
                || l.contains("windows backup")
                || l.contains("wbadmin")
                || l.contains("system restore")
                || l.contains("restore point")
                || l.contains("known folder move")
                || l.contains("backed up")
                || (l.contains("backup")
                    && (l.contains("drive")
                        || l.contains("running")
                        || l.contains("health")
                        || l.contains("status")
                        || l.contains("failed")
                        || l.contains("enabled")
                        || l.contains("working")
                        || l.contains("set up")
                        || l.contains("configured")
                        || l.contains("schedule")))
        }),
        ("search_index", |l| {
            l.contains("search index")
                || l.contains("windows search")
                || l.contains("wsearch")
                || l.contains("indexer")
                || (l.contains("search") && l.contains("broken"))
                || (l.contains("search") && l.contains("not working"))
        }),
        ("display_config", |l| {
            l.contains("monitor")
                || l.contains("display")
                || l.contains("resolution")
                || l.contains("refresh rate")
                || l.contains("refresh hz")
                || l.contains("dpi")
                || l.contains("scaling")
                || l.contains("screen config")
                || l.contains("hdmi")
                || l.contains("displayport")
                || l.contains("how many screens")
                || l.contains("multi-monitor")
                || l.contains("second screen")
                || l.contains("external display")
        }),
        ("ntp", |l| {
            l.contains("ntp")
                || l.contains("time sync")
                || l.contains("clock sync")
                || l.contains("w32tm")
                || l.contains("clock drift")
                || l.contains("time server")
                || l.contains("time zone")
                || l.contains("timezone")
                || l.contains("wrong timezone")
                || l.contains("clock wrong")
                || l.contains("time wrong")
                || l.contains("system clock")
                || l.contains("system time")
                || (l.contains("time") && l.contains("drift"))
                || (l.contains("clock") && l.contains("off"))
                || (l.contains("time") && l.contains("accurate"))
                || (l.contains("time") && l.contains("correct"))
        }),
        ("cpu_power", |l| {
            l.contains("turbo boost")
                || l.contains("cpu frequency")
                || l.contains("cpu freq")
                || l.contains("cpu clock")
                || l.contains("cpu power")
                || l.contains("cpu speed")
                || l.contains("processor speed")
                || l.contains("processor frequency")
                || l.contains("power plan")
                || l.contains("cpu stuck")
                || l.contains("boost disabled")
                || (l.contains("boost") && l.contains("disabled"))
                || (l.contains("cpu") && l.contains("slow"))
                || (l.contains("processor") && l.contains("slow"))
                || (l.contains("cpu") && l.contains("underclocking"))
                || (l.contains("processor") && l.contains("running slow"))
                || l.contains("processor running at")
        }),
        ("credentials", |l| {
            l.contains("credential manager")
                || l.contains("credential store")
                || l.contains("saved password")
                || l.contains("stored credential")
                || l.contains("credential vault")
                || l.contains("cmdkey")
                || (l.contains("credential") && l.contains("list"))
                || (l.contains("windows") && l.contains("credential"))
                || (l.contains("credential")
                    && (l.contains("clear")
                        || l.contains("cached")
                        || l.contains("view")
                        || l.contains("delete")
                        || l.contains("remove")))
        }),
        ("tpm", |l| {
            l.contains("tpm")
                || l.contains("secure boot")
                || l.contains("trusted platform module")
                || l.contains("firmware security")
                || l.contains("uefi security")
                || l.contains("uefi mode")
                || l.contains("uefi enabled")
                || l.contains("legacy bios")
                || l.contains("uefi bios")
                || (l.contains("uefi")
                    && (l.contains("boot")
                        || l.contains("secure")
                        || l.contains("status")
                        || l.contains("check")))
        }),
        ("dhcp", |l| {
            l.contains("dhcp lease")
                || l.contains("lease expires")
                || l.contains("dhcp server")
                || l.contains("ip lease")
                || l.contains("lease renew")
                || (l.contains("dhcp")
                    && (l.contains("detail") || l.contains("info") || l.contains("check")))
        }),
        ("mtu", |l| {
            l.contains("mtu")
                || l.contains("path mtu")
                || l.contains("pmtu")
                || l.contains("frame size")
                || l.contains("fragmentation")
                || (l.contains("vpn") && l.contains("mtu"))
                || (l.contains("packet") && l.contains("size") && l.contains("max"))
        }),
        ("latency", |l| {
            l.contains("ping")
                || l.contains("latency")
                || l.contains("packet loss")
                || l.contains("rtt")
                || l.contains("round trip")
                || l.contains("network lag")
                || l.contains("jitter")
                || (l.contains("network") && l.contains("slow"))
                || (l.contains("internet") && l.contains("slow"))
        }),
        ("network_adapter", |l| {
            l.contains("nic settings")
                || l.contains("nic offload")
                || l.contains("adapter settings")
                || l.contains("jumbo frame")
                || l.contains("tcp offload")
                || l.contains("wake on lan")
                || l.contains("wake-on-lan")
                || l.contains("link speed")
                || l.contains("duplex mismatch")
                || l.contains("adapter error")
                || (l.contains("nic") && (l.contains("driver") || l.contains("error")))
        }),
        ("ipv6", |l| {
            l.contains("ipv6")
                || l.contains("slaac")
                || l.contains("dhcpv6")
                || l.contains("privacy extension")
                || l.contains("global unicast")
        }),
        ("tcp_params", |l| {
            l.contains("tcp autotuning")
                || l.contains("tcp congestion")
                || l.contains("congestion algorithm")
                || l.contains("tcp settings")
                || l.contains("tcp tuning")
                || l.contains("tcp chimney")
                || l.contains("ecn")
                || l.contains("receive window")
                || l.contains("tcp window")
                || (l.contains("tcp")
                    && (l.contains("slow")
                        || l.contains("throughput")
                        || l.contains("speed")
                        || l.contains("window size")))
        }),
        ("wlan_profiles", |l| {
            l.contains("saved wifi")
                || l.contains("wifi profile")
                || l.contains("wlan profile")
                || l.contains("wireless profile")
                || l.contains("saved network")
                || l.contains("netsh wlan")
                || (l.contains("wifi")
                    && (l.contains("security")
                        || l.contains("audit")
                        || l.contains("remember")
                        || l.contains("password")))
                || (l.contains("wireless") && l.contains("remember"))
        }),
        ("ipsec", |l| {
            l.contains("ipsec")
                || l.contains("security association")
                || l.contains("ike tunnel")
                || l.contains("ipsec tunnel")
                || l.contains("policy agent")
                || l.contains("xfrm")
        }),
        ("netbios", |l| {
            l.contains("netbios")
                || l.contains("nbtstat")
                || l.contains("wins server")
                || l.contains("nbns")
        }),
        ("nic_teaming", |l| {
            l.contains("nic team")
                || l.contains("lacp")
                || l.contains("link aggregation")
                || l.contains("lbfo")
                || l.contains("bonding")
                || (l.contains("bond")
                    && (l.contains("adapter") || l.contains("interface") || l.contains("nic")))
        }),
        ("snmp", |l| {
            l.contains("snmp")
                || l.contains("community string")
                || l.contains("community name")
                || l.contains("snmpd")
        }),
        ("port_test", |l| {
            l.contains("port test")
                || l.contains("test port")
                || l.contains("port check")
                || l.contains("can i reach")
                || l.contains("is port")
                || l.contains("port reachab")
                || (l.contains("port")
                    && (l.contains("open") || l.contains("blocked") || l.contains("reachable")))
        }),
        ("network_profile", |l| {
            l.contains("network profile")
                || l.contains("network location")
                || l.contains("network category")
                || l.contains("public network")
                || l.contains("private network")
        }),
        ("dns_lookup", |l| {
            l.contains("dns lookup")
                || l.contains("dns record")
                || l.contains("nslookup")
                || l.contains("resolve-dnsname")
                || l.contains("gethostaddresses")
                || l.contains("gethostentry")
                || l.contains("mx record")
                || l.contains("srv record")
                || l.contains("look up ")
                || l.contains(" dig ")
                || l.starts_with("host ")
                || (l.contains("ip address") && l.contains(" of "))
                || (l.contains("resolve") && (l.contains("hostname") || l.contains("domain")))
        }),
        ("pending_reboot", |l| {
            l.contains("pending reboot")
                || l.contains("pending restart")
                || l.contains("need to restart")
                || l.contains("reboot required")
                || (l.contains("reboot") && l.contains("pending"))
                || (l.contains("restart") && l.contains("pending"))
                || (l.contains("have to") && (l.contains("restart") || l.contains("reboot")))
                || (l.contains("do i need to") && (l.contains("restart") || l.contains("reboot")))
        }),
        ("disk_health", |l| {
            l.contains("disk health")
                || l.contains("drive health")
                || l.contains("smart status")
                || l.contains("smart data")
                || l.contains("bad sector")
                || l.contains("ssd health")
                || l.contains("nvme health")
                || l.contains("hard drive status")
                || (l.contains("drive") && l.contains("status") && !l.contains("backup"))
                || (l.contains("healthy")
                    && (l.contains("drive") || l.contains("disk") || l.contains("ssd")))
                || (l.contains("disk") && l.contains("fail"))
        }),
        ("battery", |l| {
            l.contains("battery")
                || l.contains("charge percentage")
                || l.contains("current charge")
                || l.contains("charge status")
        }),
        ("app_crashes", |l| {
            l.contains("application crash")
                || l.contains("application error")
                || l.contains("app hang")
                || l.contains("application hang")
                || l.contains("faulting application")
                || l.contains("faulting module")
                || l.contains("wer report")
                || l.contains("apps crashing")
                || l.contains("what crashed")
                || l.contains("which app crashed")
                || l.contains("what app crashed")
                || l.contains("app crash history")
                || l.contains("application crash log")
                || (l.contains("crash") && l.contains("program"))
                || (l.contains("applications") && l.contains("crashing"))
                || (l.contains("apps") && l.contains("crashing"))
                || (l.contains("crash")
                    && (l.contains("chrome")
                        || l.contains("edge")
                        || l.contains("firefox")
                        || l.contains("discord")
                        || l.contains("office")))
        }),
        ("recent_crashes", |l| {
            l.contains("crash")
                || l.contains("bsod")
                || l.contains("blue screen")
                || l.contains("unexpected restart")
                || l.contains("sudden restart")
                || l.contains("keep restarting")
                || l.contains("keeps restarting")
                || l.contains("restarts randomly")
                || l.contains("random restart")
                || l.contains("random reboot")
                || l.contains("kernel panic")
                || (l.contains("restart") && l.contains("itself"))
                || (l.contains("restart") && l.contains("by itself"))
                || (l.contains("why") && l.contains("restart"))
        }),
        ("scheduled_tasks", |l| {
            l.contains("scheduled task")
                || l.contains("task scheduler")
                || l.contains("scheduled job")
                || l.contains("runs automatically")
                || l.contains("running automatically")
                || l.contains("auto-run task")
                || l.contains("what runs on a timer")
                || l.contains("cron job")
                || l.contains("background task")
                || (l.contains("background") && l.contains("run"))
                || (l.contains("periodic") && l.contains("run"))
                || (l.contains("what") && l.contains("schedule"))
        }),
        ("ad_user", |l| {
            l.contains("ad user")
                || l.contains("domain user")
                || (l.contains("user") && l.contains("sid"))
        }),
        ("dns_lookup", |l| {
            (l.contains("dns") && (l.contains("lookup") || l.contains("srv") || l.contains("mx")))
                || l.contains("resolve-dnsname")
                || l.contains("gethostaddresses")
                || l.contains("gethostentry")
                || l.starts_with("host ")
                || (l.contains("ip address") && l.contains(" of "))
        }),
        ("hyperv", |l| {
            l.contains("hyper-v")
                || l.contains("hyperv")
                || l.contains("hyper v")
                || l.contains("virtual machine")
                || l.contains("running vms")
                || (l.contains("vm")
                    && !l.contains("nvme")
                    && (l.contains("running")
                        || l.contains("checkpoint")
                        || l.contains("snapshot")
                        || l.contains("switch")
                        || l.contains("ram")
                        || l.contains("memory")))
                || (l.contains("list") && l.contains("vm") && !l.contains("nvme"))
        }),
        ("ip_config", |l| {
            l.contains("ipconfig") && (l.contains("all") || l.contains("detail"))
        }),
        ("dev_conflicts", |l| {
            l.contains("dev conflict")
                || l.contains("toolchain conflict")
                || l.contains("duplicate path")
        }),
        ("storage_deep", |l| {
            (l.contains("where did my")
                && (l.contains("space") || l.contains("disk") || l.contains("storage")))
                || l.contains("what is taking up")
                || l.contains("what is using my disk")
                || l.contains("what is eating my disk")
                || l.contains("biggest folders")
                || l.contains("largest folders")
                || l.contains("largest directories")
                || l.contains("what is filling")
                || l.contains("storage breakdown")
                || l.contains("disk breakdown")
                || l.contains("find large files")
                || l.contains("find big files")
                || l.contains("storage analysis")
                || l.contains("disk analysis")
                || (l.contains("clean up")
                    && (l.contains("disk")
                        || l.contains("drive")
                        || l.contains("space")
                        || l.contains("storage")))
                || (l.contains("clean") && l.contains("c drive"))
                || (l.contains("analyze") && (l.contains("storage") || l.contains("disk")))
        }),
        ("storage", |l| {
            l.contains("disk space")
                || l.contains("storage")
                || l.contains("drive capacity")
                || l.contains("cache size")
                || l.contains("i/o pressure")
                || l.contains("disk usage")
                || ((l.contains("disk") || l.contains("drive")) && l.contains("full"))
                || l.contains("out of space")
                || l.contains("free space")
                || l.contains("how much space")
                || l.contains("space left")
                || l.contains("running out of space")
                || l.contains("how much disk")
                || l.contains("how full")
                || (l.contains("drive") && l.contains("usage"))
                || (l.contains("where") && l.contains("space"))
        }),
        ("storage_spaces", |l| {
            l.contains("storage spaces")
                || l.contains("storage space")
                || l.contains("storage pool")
                || l.contains("storage pools")
                || l.contains("virtual disk")
                || l.contains("virtual disks")
                || l.contains("windows raid")
                || l.contains("storage pool degraded")
                || l.contains("parity volume")
                || l.contains("disk pool")
                || l.contains("resiliency")
                || l.contains("mdadm")
                || l.contains("software raid")
                || l.contains("md array")
                || (l.contains("mirror") && l.contains("drive"))
                || (l.contains("storage") && l.contains("pool"))
        }),
        ("disk_benchmark", |l| {
            l.contains("benchmark")
                || l.contains("stress test")
                || l.contains("load test")
                || l.contains("intensity report")
                || l.contains("io intensity")
                || l.contains("disk intensity")
                || l.contains("thrash")
                || l.contains("latency report")
        }),
        ("log_check", |l| {
            l.contains("event log")
                || l.contains("recent errors")
                || l.contains("recent warnings")
                || l.contains("error log")
                || l.contains("event viewer")
                || l.contains("system log")
                || l.contains("windows log")
                || l.contains("application log")
                || l.contains("recent events")
                || l.contains("journal log")
                || l.contains("show me warnings")
                || (l.contains("log") && l.contains("recent") && l.contains("error"))
                || (l.contains("log") && l.contains("warning"))
                || (l.contains("what errors") && l.contains("log"))
        }),
        ("hardware", |l| {
            l.contains("cpu model")
                || l.contains("ram size")
                || l.contains("hardware spec")
                || (l.contains("what hardware") && l.contains("have"))
                || l.contains("hardware info")
                || l.contains("hardware inventory")
                || l.contains("system information")
                || l.contains("system info")
                || l.contains("system specs")
                || l.contains("computer spec")
                || l.contains("graphics card")
                || l.contains("video card")
                || l.contains("display adapter")
                || l.contains("bios version")
                || l.contains("motherboard")
                || l.contains("what gpu")
                || l.contains("what cpu")
                || (l.contains("hardware") && (l.contains("dna") || l.contains("inventory")))
        }),
        ("health_report", |l| {
            l.contains("health report") || l.contains("system health")
        }),
        ("resource_load", |l| {
            l.contains("resource load")
                || l.contains("cpu load")
                || l.contains("ram %")
                || l.contains("cpu %")
                || l.contains("performance")
                || l.contains("memory pressure")
                || l.contains("memory load")
                || l.contains("slow")
                || l.contains("lag")
                || l.contains("sluggish")
                || l.contains("hang")
                || l.contains("unresponsive")
                || l.contains("frozen")
                || l.contains("freezing up")
                || l.contains("computer freeze")
                || l.contains("utilization")
                || l.contains("high cpu")
                || l.contains("high ram")
                || l.contains("current load")
                || (l.contains("resource") && l.contains("usage"))
                || (l.contains("why") && l.contains("slow"))
                || (l.contains("why") && l.contains("laggy"))
        }),
        ("processes", |l| {
            l.contains("process")
                || l.contains("task manager")
                || l.contains("what is running")
                || l.contains("using my ram")
                || l.contains("using my cpu")
                || l.contains("using the cpu")
                || l.contains("hitting the disk")
                || l.contains("disk thrasher")
                || l.contains("cpu hog")
                || l.contains("memory hog")
                || l.contains("ram hog")
                || l.contains("hogging cpu")
                || l.contains("hogging ram")
                || l.contains("hogging memory")
                || l.contains("eating up cpu")
                || l.contains("eating up memory")
                || l.contains("eating my cpu")
                || l.contains("eating my memory")
                || (l.contains("hogging")
                    && (l.contains("cpu") || l.contains("ram") || l.contains("memory")))
                || (l.contains("eating up")
                    && (l.contains("cpu") || l.contains("ram") || l.contains("memory")))
        }),
        ("services", |l| {
            l.contains("service") || l.contains("daemon") || l.contains("windows service")
        }),
        ("ports", |l| {
            l.contains("listening port")
                || l.contains("open port")
                || l.contains("what is on port")
                || l.contains("port 3000")
                || l.contains("what is listening")
                || l.contains("what's listening")
                || l.contains("exposed port")
                || l.contains("listening on port")
                || (l.contains("listening") && l.contains("port"))
        }),
        ("traceroute", |l| {
            l.contains("traceroute")
                || l.contains("tracert")
                || l.contains("trace route")
                || l.contains("trace the path")
                || l.contains("network path")
                || l.contains("how many hops")
                || (l.contains("trace") && l.contains("hop"))
        }),
        ("dns_cache", |l| {
            l.contains("dns cache")
                || l.contains("cached dns")
                || l.contains("displaydns")
                || (l.contains("dns") && l.contains("cached"))
        }),
        ("arp", |l| {
            l.contains("arp table")
                || l.contains("arp cache")
                || l.contains("mac address")
                || l.contains("ip to mac")
                || l.contains("arp -")
        }),
        ("route_table", |l| {
            l.contains("route table")
                || l.contains("routing table")
                || l.contains("route print")
                || l.contains("network route")
                || l.contains("next hop")
        }),
        ("connectivity", |l| {
            l.contains("internet")
                || l.contains("am i connected")
                || l.contains("ping google")
                || l.contains("internet access")
                || l.contains("no internet")
                || l.contains("network connectivity")
                || l.contains("connectivity check")
                || l.contains("check connectivity")
                || l.contains("can't browse")
                || l.contains("cannot browse")
                || l.contains("web browsing")
                || l.contains("browser not loading")
                || l.contains("pages not loading")
                || l.contains("websites not loading")
                || l.contains("no network")
                || (l.contains("network") && l.contains("down"))
                || (l.contains("can't") && l.contains("connect to internet"))
                || (l.contains("cannot") && l.contains("connect to internet"))
                || (l.contains("network") && l.contains("not working"))
                || (l.contains("internet") && l.contains("not working"))
        }),
        ("wifi", |l| {
            l.contains("wi-fi")
                || l.contains("wifi")
                || l.contains("wireless")
                || l.contains("ssid")
                || l.contains("signal strength")
        }),
        ("connections", |l| {
            l.contains("tcp connection")
                || l.contains("active connection")
                || l.contains("established connection")
                || l.contains("socket")
                || l.contains("netstat")
                || l.contains("outbound connection")
                || l.contains("inbound connection")
                || l.contains("remote connection")
                || l.contains("connection list")
                || (l.contains("connection") && l.contains("active"))
                || (l.contains("connection") && l.contains("open"))
                || (l.contains("what") && l.contains("connecting"))
                || (l.contains("which") && l.contains("connecting"))
        }),
        ("vpn", |l| {
            l.contains("vpn")
                || l.contains("virtual private network")
                || l.contains("wireguard")
                || l.contains("anyconnect")
                || l.contains("globalprotect")
                || l.contains("pulse secure")
                || l.contains("split tunnel")
                || l.contains("vpn adapter")
        }),
        ("proxy", |l| {
            l.contains("proxy setting") || l.contains("system proxy") || l.contains("winhttp proxy")
        }),
        ("firewall_rules", |l| {
            (l.contains("firewall")
                && (l.contains("rule") || l.contains("inbound") || l.contains("outbound")))
                || l.contains("firewall rule")
        }),
        ("lan_discovery", |l| {
            l.contains("upnp")
                || l.contains("ssdp")
                || l.contains("mdns")
                || l.contains("bonjour")
                || l.contains("llmnr")
                || l.contains("network neighborhood")
                || l.contains("device discovery")
                || l.contains("local discovery")
                || l.contains("discover local devices")
                || l.contains("discover devices")
                || l.contains("browse computers")
                || (l.contains("local network")
                    && (l.contains("discover")
                        || l.contains("discovery")
                        || l.contains("neighborhood")
                        || l.contains("device")
                        || l.contains("devices")
                        || l.contains("aware of")))
                || ((l.contains("netbios") || l.contains("smb visibility"))
                    && !l.contains("active directory"))
                || ((l.contains("nas")
                    || l.contains("printer")
                    || l.contains("device")
                    || l.contains("computer")
                    || l.contains("pc"))
                    && ((l.contains("can't") && l.contains("see"))
                        || (l.contains("cannot") && l.contains("see"))
                        || (l.contains("cant") && l.contains("see"))
                        || l.contains("can't see")
                        || l.contains("cannot see")
                        || l.contains("cant see")
                        || l.contains("not visible")
                        || l.contains("not showing up")
                        || l.contains("not show up")
                        || l.contains("discover"))
                    && (l.contains("network")
                        || l.contains("lan")
                        || l.contains("local")
                        || l.contains("neighborhood")))
        }),
        ("network", |l| {
            l.contains("network adapter")
                || l.contains("ip address")
                || l.contains("ipconfig")
                || l.contains("gateway")
                || l.contains("subnet")
        }),
        ("env_doctor", |l| {
            l.contains("env doctor")
                || l.contains("environment doctor")
                || l.contains("package manager")
                || l.contains("path drift")
        }),
        ("os_config", |l| {
            l.contains("power plan")
                || l.contains("uptime")
                || l.contains("boot time")
                || l.contains("last boot")
        }),
        ("overclocker", |l| {
            l.contains("overclocker")
                || l.contains("gpu clock")
                || l.contains("gpu throttle")
                || l.contains("nvidia stats")
                || l.contains("silicon health")
                || l.contains("mhz")
                || ((l.contains("voltage") || l.contains("volts"))
                    && (l.contains("gpu")
                        || l.contains("cpu")
                        || l.contains("nvidia")
                        || l.contains("silicon")))
                || (l.contains("gpu")
                    && (l.contains("throttle")
                        || l.contains("bottleneck")
                        || l.contains("overheating")
                        || l.contains("usage")
                        || l.contains("utilization")
                        || l.contains("performance")))
        }),
        ("path", |l| {
            l.contains("path entries") || l.contains("raw path")
        }),
        ("toolchains", |l| {
            l.contains("developer tools")
                || l.contains("toolchains")
                || (l.contains("installed") && l.contains("version"))
        }),
        ("docker", |l| {
            l.contains("docker") || l.contains("container") || l.contains("running container")
        }),
        ("docker_filesystems", |l| {
            (l.contains("docker")
                || l.contains("container")
                || l.contains("compose")
                || l.contains("volume")
                || l.contains("bind mount"))
                && (l.contains("mount")
                    || l.contains("volume")
                    || l.contains("bind")
                    || l.contains("filesystem")
                    || l.contains("storage")
                    || l.contains("path")
                    || l.contains("missing"))
        }),
        ("wsl", |l| {
            l.contains("wsl")
                || l.contains("windows subsystem")
                || (l.contains("subsystem") && l.contains("linux"))
        }),
        ("wsl_filesystems", |l| {
            (l.contains("wsl")
                || l.contains("windows subsystem")
                || l.contains("linux distro")
                || (l.contains("subsystem") && l.contains("linux")))
                && (l.contains("mount")
                    || l.contains("filesystem")
                    || l.contains("storage")
                    || l.contains("disk")
                    || l.contains("vhdx")
                    || l.contains("path bridge")
                    || l.contains("/mnt/c")
                    || l.contains("wsl df")
                    || l.contains("wsl du")
                    || l.contains("du -sh /mnt/c"))
        }),
        ("ssh", |l| {
            l.contains("ssh")
                || l.contains("sshd")
                || l.contains("known_hosts")
                || l.contains("authorized_keys")
        }),
        ("git_config", |l| {
            (l.contains("git config") || l.contains("git global") || l.contains("git aliases"))
                && !l.contains("github")
        }),
        ("installed_software", |l| {
            l.contains("installed software")
                || l.contains("installed program")
                || l.contains("installed app")
                || l.contains("what is installed")
                || l.contains("what's installed")
                || l.contains("winget list")
                || l.contains("list programs")
                || l.contains("list applications")
                || l.contains("list apps")
                || l.contains("show applications")
                || l.contains("show programs")
                || (l.contains("list") && l.contains("application"))
                || (l.contains("show") && l.contains("application"))
        }),
        ("env", |l| {
            (l.contains("environment variable") || l.contains("env var") || l.contains("env vars"))
                && !l.contains("env doctor")
        }),
        ("hosts_file", |l| {
            l.contains("hosts file") || l.contains("/etc/hosts") || l.contains("hosts entry")
        }),
        ("databases", |l| {
            l.contains("postgres")
                || l.contains("mysql")
                || l.contains("mariadb")
                || l.contains("mongodb")
                || l.contains("redis")
                || l.contains("sqlite")
                || l.contains("sql server")
                || l.contains("elasticsearch")
                || (l.contains("database") && (l.contains("running") || l.contains("service")))
        }),
        ("user_accounts", |l| {
            l.contains("local user")
                || l.contains("user account")
                || l.contains("who is logged")
                || l.contains("who am i")
                || l.contains("logged in as")
                || l.contains("admin group")
                || l.contains("local admin")
                || l.contains("active sessions")
                || l.contains("running as admin")
                || l.contains("who has admin rights")
                || l.contains("list all users")
                || l.contains("list users")
                || l.contains("what accounts")
                || (l.contains("accounts") && l.contains("admin"))
        }),
        ("audit_policy", |l| {
            l.contains("audit policy")
                || l.contains("auditpol")
                || l.contains("what is being logged")
                || l.contains("security audit")
                || l.contains("event auditing")
                || l.contains("login event")
                || l.contains("logon event")
                || (l.contains("audit") && l.contains("event"))
                || (l.contains("what") && l.contains("being audited"))
                || (l.contains("audit") && l.contains("enable"))
        }),
        ("shares", |l| {
            l.contains("smb share")
                || l.contains("network share")
                || l.contains("shared folder")
                || l.contains("mapped drive")
                || l.contains("file sharing")
                || l.contains("what is shared")
                || l.contains("what am i sharing")
                || l.contains("smb1")
                || l.contains("nfs export")
                || (l.contains("folder") && l.contains("shared"))
                || (l.contains("sharing") && l.contains("network"))
        }),
        ("dns_servers", |l| {
            (l.contains("dns server")
                || l.contains("dns resolver")
                || l.contains("nameserver")
                || l.contains("which dns")
                || l.contains("dns over https")
                || l.contains("configured dns"))
                && !l.contains("dns cache")
        }),
        ("bitlocker", |l| {
            l.contains("bitlocker")
                || (l.contains("drive") && l.contains("encrypt"))
                || (l.contains("disk") && l.contains("encrypt"))
                || (l.contains("ssd") && l.contains("encrypt"))
                || (l.contains("volume") && l.contains("encrypt"))
                || (l.contains("machine") && l.contains("encrypt"))
                || l.contains("encryption status")
                || l.contains("full disk encryption")
                || l.contains("drive encryption")
        }),
        ("rdp", |l| {
            l.contains("rdp")
                || l.contains("remote desktop")
                || (l.contains("remote") && l.contains("access") && !l.contains("git"))
        }),
        ("shadow_copies", |l| {
            l.contains("shadow copy")
                || l.contains("shadow copies")
                || l.contains("vss")
                || l.contains("snapshot")
                || l.contains("restore point")
        }),
        ("pagefile", |l| {
            l.contains("pagefile")
                || l.contains("page file")
                || l.contains("virtual memory")
                || l.contains("swap file")
                || l.contains("swap space")
                || l.contains("memory swapping")
                || l.contains("paging file")
        }),
        ("windows_features", |l| {
            (l.contains("window") && l.contains("feature"))
                || l.contains("optional feature")
                || l.contains("iis")
                || l.contains("hyper-v")
                || (l.contains("feature") && (l.contains("install") || l.contains("enabled")))
        }),
        ("printers", |l| {
            l.contains("printer")
                || l.contains("print queue")
                || l.contains("get-printer")
                || l.contains("printing")
                || l.contains("can't print")
                || l.contains("cannot print")
                || l.contains("print job")
                || l.contains("print driver")
                || l.contains("default printer")
                || (l.contains("print") && l.contains("not working"))
                || (l.contains("print") && l.contains("stuck"))
                || (l.contains("print") && l.contains("offline"))
        }),
        ("winrm", |l| {
            l.contains("winrm")
                || l.contains("psremoting")
                || (l.contains("remote") && l.contains("management") && !l.contains("rdp"))
        }),
        ("network_stats", |l| {
            (l.contains("network") && l.contains("stat"))
                || (l.contains("adapter")
                    && l.contains("stat")
                    && !l.contains("wlan")
                    && !l.contains("wireless"))
                || l.contains("throughput")
                || l.contains("packet loss")
                || l.contains("dropped packet")
                || (l.contains("network") && l.contains("usage"))
                || (l.contains("data") && l.contains("transferred"))
                || (l.contains("bytes") && l.contains("transferred"))
                || l.contains("network traffic")
                || (l.contains("packet") && l.contains("error"))
        }),
        ("startup_items", |l| {
            l.contains("startup")
                || l.contains("boot program")
                || l.contains("autorun")
                || l.contains("run at boot")
                || l.contains("startup program")
                || l.contains("startup app")
                || l.contains("startup list")
                || l.contains("startup item")
                || l.contains("starts with windows")
                || l.contains("start with windows")
                || l.contains("launch at startup")
                || l.contains("launch on startup")
                || l.contains("open at startup")
                || l.contains("open on boot")
                || l.contains("runs on boot")
                || l.contains("run at login")
                || l.contains("msconfig")
                || l.contains("login item")
                || (l.contains("disable") && l.contains("startup"))
                || (l.contains("what") && l.contains("start") && l.contains("boot"))
                || l.contains("autostart")
                || (l.contains("load") && l.contains("boot"))
                || (l.contains("load") && l.contains("startup") && !l.contains("reload"))
        }),
        ("udp_ports", |l| {
            l.contains("udp port")
                || l.contains("udp listener")
                || (l.contains("udp")
                    && (l.contains("listening")
                        || l.contains("service")
                        || l.contains("connection")
                        || l.contains("open")))
        }),
        ("gpo", |l| {
            l.contains("gpo")
                || l.contains("group polic")
                || l.contains("gpresult")
                || l.contains("applied policy")
                || l.contains("active policies")
                || l.contains("what policies")
                || l.contains("policy objects")
                || l.contains("policy applied")
                || (l.contains("policies") && l.contains("applied"))
                || (l.contains("policies") && l.contains("effect"))
        }),
        ("certificates", |l| {
            l.contains("cert")
                || l.contains("ssl")
                || l.contains("client cert")
                || l.contains("expiring cert")
                || l.contains("tls certificate")
                || l.contains("thumbprint")
                || l.contains("x509")
                || l.contains("x.509")
                || l.contains(".pfx")
                || l.contains(".p12")
                || l.contains(".pem")
                || l.contains("pkcs")
                || l.contains("trust store")
                || l.contains("certificate store")
                || l.contains("certificate expir")
                || l.contains("untrusted cert")
                || (l.contains("tls")
                    && (l.contains("check") || l.contains("status") || l.contains("valid")))
        }),
        ("integrity", |l| {
            l.contains("integrity")
                || l.contains("sfc")
                || l.contains("dism")
                || l.contains("corrupt")
                || l.contains("system file")
                || (l.contains("windows") && l.contains("damaged"))
                || (l.contains("check") && l.contains("system") && l.contains("file"))
        }),
        ("domain", |l| {
            l.contains("domain") || l.contains("workgroup") || l.contains("active directory")
        }),
        ("device_health", |l| {
            l.contains("device health")
                || l.contains("hardware error")
                || l.contains("yellow bang")
                || l.contains("malfunctioning")
                || l.contains("device manager")
                || l.contains("unknown device")
                || l.contains("code 43")
                || l.contains("code 10")
                || l.contains("code 28")
                || l.contains("hardware failing")
                || (l.contains("device") && l.contains("error code"))
                || (l.contains("device") && l.contains("not recognized"))
                || (l.contains("device") && l.contains("broken"))
                || (l.contains("device") && l.contains("not working"))
                || (l.contains("device") && l.contains("stopped working"))
                || (l.contains("hardware") && l.contains("broken"))
        }),
        ("drivers", |l| {
            l.contains("driver") || l.contains("system driver")
        }),
        ("peripherals", |l| {
            l.contains("peripheral")
                || l.contains("usb")
                || l.contains("keyboard")
                || l.contains("mouse")
                || l.contains("monitor")
        }),
        ("sessions", |l| {
            l.contains("session")
                || l.contains("who is logged")
                || l.contains("active login")
                || l.contains("who is on")
                || l.contains("connected users")
                || l.contains("logged on users")
                || l.contains("logged in users")
                || l.contains("query session")
                || l.contains("qwinsta")
                || (l.contains("who") && l.contains("logged"))
                || (l.contains("who")
                    && l.contains("using")
                    && (l.contains("computer") || l.contains("machine")))
        }),
        ("hardware", |l| {
            l.contains("virtualization")
                || l.contains("hypervisor")
                || l.contains("vt-x")
                || l.contains("slat")
                || l.contains("cpu model")
                || l.contains("ram size")
                || l.contains("hardware spec")
                || l.contains("motherboard")
                || l.contains("bios version")
                || l.contains("graphics card")
                || l.contains("video card")
                || l.contains("system information")
                || l.contains("system info")
                || l.contains("system specs")
                || l.contains("computer spec")
                || l.contains("display adapter")
                || (l.contains("what") && l.contains("processor"))
                || (l.contains("what") && l.contains("cpu") && !l.contains("using"))
                || (l.contains("how much") && l.contains("ram"))
                || (l.contains("gpu") && (l.contains("what") || l.contains("show")))
        }),
        ("ipv6", |l| {
            l.contains("ipv6")
                || l.contains("slaac")
                || l.contains("dhcpv6")
                || l.contains("ipv6 address")
                || l.contains("privacy extension")
                || l.contains("link-local address")
        }),
        ("domain_health", |l| {
            l.contains("domain health")
                || l.contains("dc connectivity")
                || l.contains("dc reachab")
                || l.contains("reach dc")
                || l.contains("domain controller")
                || l.contains("kerberos health")
                || l.contains("kerberos connectivity")
                || l.contains("nltest")
                || l.contains("dsgetdc")
                || l.contains("ldap port")
                || l.contains("ldap error")
                || l.contains("ad connectivity")
                || l.contains("gpo refresh")
                || (l.contains("active directory") && l.contains("connect"))
                || (l.contains("active directory") && l.contains("reach"))
                || (l.contains("active directory") && l.contains("health"))
                || (l.contains("active directory") && l.contains("working"))
                || (l.contains("active directory") && l.contains("accessible"))
                || (l.contains("domain controller") && l.contains("online"))
                || (l.contains("can reach") && l.contains("domain"))
                || (l.contains("kerberos") && l.contains("issue"))
                || (l.contains("kerberos") && l.contains("fail"))
        }),
        ("service_dependencies", |l| {
            l.contains("service depend")
                || l.contains("services depend")
                || l.contains("depends on")
                || l.contains("what depends on")
                || l.contains("which services depend")
                || l.contains("restart cascade")
                || l.contains("service graph")
                || l.contains("svc dep")
                || (l.contains("service") && l.contains("dependenc"))
                || (l.contains("service") && l.contains("required by"))
                || (l.contains("service") && l.contains("needed by"))
                || l.contains("service prerequisite")
                || (l.contains("service") && l.contains("requirement"))
                || (l.contains("service") && l.contains("relationship"))
        }),
        ("wmi_health", |l| {
            l.contains("wmi health")
                || l.contains("wmi corrupt")
                || l.contains("wmi repository")
                || l.contains("wmi broken")
                || l.contains("wmi not working")
                || l.contains("wmi query fail")
                || l.contains("wmi error")
                || l.contains("winmgmt")
                || (l.contains("wmi")
                    && (l.contains("health")
                        || l.contains("corrupt")
                        || l.contains("reposit")
                        || l.contains("broken")
                        || l.contains("repair")
                        || l.contains("status")
                        || l.contains("reset")))
        }),
        ("local_security_policy", |l| {
            l.contains("password policy")
                || l.contains("account lockout")
                || l.contains("lockout policy")
                || l.contains("lockout threshold")
                || l.contains("lm compatibility")
                || l.contains("lmcompatibilitylevel")
                || l.contains("ntlm policy")
                || l.contains("ntlm level")
                || l.contains("ntlm authentication level")
                || l.contains("local security policy")
                || l.contains("uac policy")
                || l.contains("uac disabled")
                || l.contains("uac level")
                || l.contains("uac prompt")
                || l.contains("user account control")
                || l.contains("needs elevation")
                || l.contains("run as administrator")
                || l.contains("administrator permission")
                || l.contains("account policy")
                || l.contains("net accounts")
                || l.contains("lockout")
                || (l.contains("uac")
                    && (l.contains("off")
                        || l.contains("status")
                        || l.contains("check")
                        || l.contains("on")))
        }),
        ("usb_history", |l| {
            l.contains("usb history")
                || l.contains("usb forensic")
                || l.contains("usb devices connected")
                || l.contains("usb devices ever")
                || l.contains("usb drives ever")
                || l.contains("what usb")
                || l.contains("usbstor")
                || l.contains("usb registry")
                || (l.contains("usb") && l.contains("ever connected"))
                || (l.contains("usb") && l.contains("audit"))
                || (l.contains("usb") && l.contains("forensic"))
                || (l.contains("usb") && l.contains("history"))
                || (l.contains("usb") && l.contains("registry"))
                || (l.contains("usb") && l.contains("plugged"))
                || (l.contains("usb") && l.contains("were connected"))
                || (l.contains("usb") && l.contains("have been connected"))
                || (l.contains("usb") && l.contains("has been connected"))
        }),
        ("print_spooler", |l| {
            l.contains("print spooler")
                || l.contains("printnightmare")
                || l.contains("print nightmar")
                || l.contains("spooler service")
                || l.contains("print security")
                || l.contains("cve-2021-34527")
                || l.contains("cve-2021-1675")
                || l.contains("printer security")
                || l.contains("printer service")
                || l.contains("point and print")
                || l.contains("rpcauthnlevel")
                || l.contains("print service")
                || (l.contains("printer") && l.contains("spooler"))
                || (l.contains("print") && l.contains("vulnerab"))
                || (l.contains("spooler") && l.contains("status"))
                || (l.contains("spooler") && l.contains("running"))
                || (l.contains("spooler") && l.contains("hardening"))
        }),
        ("repo_doctor", |l| {
            l.contains("repo doctor")
                || l.contains("repository doctor")
                || l.contains("workspace health")
                || l.contains("repo health")
                || l.contains("git status")
                || l.contains("uncommitted changes")
        }),
        ("desktop", |l| {
            l.contains("desktop")
                && (l.contains("show")
                    || l.contains("list")
                    || l.contains("what is in")
                    || l.contains("what's in")
                    || l.contains("folder")
                    || l.contains("contents"))
        }),
        ("downloads", |l| {
            l.contains("downloads")
                && (l.contains("show")
                    || l.contains("list")
                    || l.contains("what is in")
                    || l.contains("what's in")
                    || l.contains("folder")
                    || l.contains("contents"))
        }),
    ];

    for (topic, check) in detectors {
        if check(&lower) && !topics.contains(topic) {
            topics.push(topic);
        }
    }

    if topics.contains(&"docker_filesystems") {
        topics.retain(|topic| *topic != "docker");
        topics.retain(|topic| *topic != "storage");
    }
    if topics.contains(&"wsl_filesystems") {
        topics.retain(|topic| *topic != "wsl");
        topics.retain(|topic| *topic != "storage");
    }
    if topics.contains(&"lan_discovery") {
        topics.retain(|topic| *topic != "network");
    }
    if topics.contains(&"dns_lookup") {
        topics.retain(|topic| *topic != "network");
    }
    if topics.contains(&"identity_auth") {
        topics.retain(|topic| *topic != "sign_in");
        topics.retain(|topic| *topic != "onedrive");
        topics.retain(|topic| *topic != "outlook");
        topics.retain(|topic| *topic != "teams");
        topics.retain(|topic| *topic != "browser_health");
    }
    if topics.contains(&"event_query") {
        topics.retain(|topic| *topic != "log_check");
    }
    if topics.contains(&"browser_health") {
        topics.retain(|topic| *topic != "proxy");
    }
    if topics.contains(&"audio") {
        topics.retain(|topic| *topic != "peripherals");
    }
    if topics.contains(&"bluetooth") {
        topics.retain(|topic| *topic != "peripherals");
    }

    topics
}

pub(crate) fn preferred_maintainer_workflow(user_input: &str) -> Option<&'static str> {
    let lower = user_input.to_ascii_lowercase();
    let asks_cleanup = contains_any(
        &lower,
        &[
            "run my cleanup",
            "run the cleanup",
            "run cleanup",
            "deep clean",
            "prune dist",
            "clean.ps1",
            "cleanup script",
            "cleanup workflow",
            "clean up scripts",
        ],
    );
    let asks_package = contains_any(
        &lower,
        &[
            "rebuild local portable",
            "rebuild the portable",
            "run the local build",
            "run the portable",
            "package-windows.ps1",
            "package windows",
            "build installer",
            "overwrite the portable",
            "refresh the portable",
            "update path",
            "update path with the portable",
        ],
    );
    let asks_release = contains_any(
        &lower,
        &[
            "run the release flow",
            "regular workflow",
            "cut the release",
            "ship it",
            "release.ps1",
            "bump to ",
            "tag it",
            "full tag and everything",
            "publish crates",
        ],
    );

    if asks_cleanup {
        Some("clean")
    } else if asks_package {
        Some("package_windows")
    } else if asks_release {
        Some("release")
    } else {
        None
    }
}

pub fn mentions_symbol_search(user_input: &str) -> bool {
    let lower = user_input.to_lowercase();
    contains_any(
        &lower,
        &[
            "find where",
            "who calls",
            "who uses",
            "where is",
            "is defined",
            "is used",
            "find definition",
            "find references",
            "go to definition",
        ],
    ) && contains_any(
        &lower,
        &[
            "function", "struct", "variable", "symbol", "method", "type", "trait", "module",
        ],
    )
}

pub fn mentions_commit_intent(user_input: &str) -> bool {
    let lower = user_input.to_lowercase();
    contains_any(
        &lower,
        &[
            "git commit",
            "commit my",
            "commit the",
            "commit changes",
            "save my progress to git",
        ],
    )
}

pub fn preferred_workspace_workflow(user_input: &str) -> Option<&'static str> {
    let lower = user_input.to_ascii_lowercase();
    let asks_project_scope = contains_any(
        &lower,
        &[
            "this repo",
            "this repository",
            "this project",
            "current project",
            "current repo",
            "workspace",
            "in this folder",
            "here",
        ],
    );
    let asks_build = contains_any(
        &lower,
        &[
            "run the build",
            "build this project",
            "build this repo",
            "run build",
            "compile this project",
            "cargo build",
            "npm run build",
            "pnpm run build",
            "yarn build",
            "go build",
            "gradlew build",
        ],
    );
    let asks_test = contains_any(
        &lower,
        &[
            "run the tests",
            "run tests",
            "test this project",
            "test this repo",
            "run the test suite",
            "cargo test",
            "npm test",
            "pnpm test",
            "yarn test",
            "pytest",
            "go test",
            "gradlew test",
        ],
    );
    let asks_lint = contains_any(
        &lower,
        &[
            "run lint",
            "lint this project",
            "lint this repo",
            "cargo clippy",
            "npm run lint",
            "pnpm run lint",
            "yarn lint",
        ],
    );
    let asks_fix = contains_any(
        &lower,
        &[
            "run fix",
            "fix formatting",
            "run formatter",
            "cargo fmt",
            "npm run fix",
            "pnpm run fix",
            "yarn fix",
        ],
    );
    let asks_script = {
        let is_make_file_op = lower.contains("make a folder")
            || lower.contains("make a directory")
            || lower.contains("make a file")
            || lower.contains("make a hello.txt")
            || lower.contains("make it")
            || lower.contains("make x");

        let has_script_keyword = contains_any(
            &lower,
            &[
                "npm run ",
                "pnpm run ",
                "yarn ",
                "bun run ",
                "make ",
                "just ",
                "task ",
                "scripts/",
                ".\\scripts\\",
                "./scripts/",
                ".ps1",
                ".sh",
                ".py",
                ".cmd",
                ".bat",
            ],
        );

        has_script_keyword && !is_make_file_op
    };

    if mentions_symbol_search(user_input) {
        Some("lsp_search")
    } else if mentions_commit_intent(user_input) {
        Some("commit_workflow")
    } else if asks_build
        && (asks_project_scope
            || !contains_any(&lower, &["release.ps1", "package-windows.ps1", "clean.ps1"]))
    {
        Some("build")
    } else if asks_test && asks_project_scope {
        Some("test")
    } else if asks_lint && asks_project_scope {
        Some("lint")
    } else if asks_fix && asks_project_scope {
        Some("fix")
    } else if asks_script && preferred_maintainer_workflow(user_input).is_none() {
        Some("script")
    } else if (asks_test || asks_lint || asks_fix)
        && preferred_maintainer_workflow(user_input).is_none()
    {
        Some(if asks_test {
            "test"
        } else if asks_lint {
            "lint"
        } else {
            "fix"
        })
    } else {
        None
    }
}

pub(crate) fn looks_like_mutation_request(user_input: &str) -> bool {
    let lower = user_input.to_lowercase();
    [
        "fix ",
        "change ",
        "edit ",
        "modify ",
        "update ",
        "rename ",
        "refactor ",
        "patch ",
        "rewrite ",
        "implement ",
        "create a file",
        "create file",
        "add a file",
        "delete ",
        "remove ",
        "make the change",
        "mkdir ",
        "touch ",
        "create a folder",
        "create folder",
        "new folder",
        "new file",
        "write to",
        "save this",
        "commit ",
        "move-item",
        "remove-item",
        "copy-item",
        "rmdir",
        "mv ",
        "rm ",
        "cp ",
        "set-content",
        "add-content",
    ]
    .iter()
    .any(|needle| lower.contains(needle))
}

pub(crate) fn is_sovereign_mutation(user_input: &str) -> bool {
    let lower = user_input.to_lowercase();
    let mentions_location = contains_any(
        &lower,
        &[
            "desktop",
            "documents",
            "downloads",
            "pictures",
            "images",
            "videos",
            "movies",
            "music",
            "audio",
            "temp",
            "cache",
            "config",
            "appdata",
        ],
    );
    let mentions_simple_creation = (lower.contains("make")
        || lower.contains("create")
        || lower.contains("add")
        || lower.contains("new")
        || lower.contains("mkdir")
        || lower.contains("generate"))
        && (lower.contains("folder")
            || lower.contains("directory")
            || lower.contains("project area")
            || lower.contains("file"));

    mentions_location && mentions_simple_creation
}

pub fn classify_query_intent(workflow_mode: WorkflowMode, user_input: &str) -> QueryIntent {
    let lower = user_input.to_lowercase();

    let mentions_runtime_trace = contains_any(
        &lower,
        &[
            "trace",
            "how does",
            "what are the main runtime subsystems",
            "how does a user message move",
            "separate normal assistant output",
            "session reset behavior",
            "file references",
            "event types",
            "channels",
        ],
    );
    let anti_guess = contains_any(&lower, &["do not guess", "if you are unsure"]);
    let capability_mode = mentions_capability_question(&lower);
    let capability_needs_repo =
        capability_mode && capability_question_requires_repo_inspection(&lower);
    let is_coding_workflow =
        workflow_mode == WorkflowMode::Auto || workflow_mode == WorkflowMode::Code;

    let has_authoritative_hardware_noun = lower.split_whitespace().any(|w| {
        let w = w.trim_matches(|c: char| !c.is_alphanumeric());
        matches!(
            w,
            "gpu"
                | "ram"
                | "cpu"
                | "vram"
                | "nvidia"
                | "silicon"
                | "vitals"
                | "throttle"
                | "overclocker"
                | "thermal"
        )
    });

    let host_inspection_allowed = if is_coding_workflow && code_kw_ac().find(&lower).is_some() {
        // High-barrier: if we are clearly in a code task, only allow diagnostic
        // if they use an authoritative hardware noun.
        has_authoritative_hardware_noun
    } else {
        true
    };

    let host_inspection_mode =
        host_inspection_allowed && preferred_host_inspection_topic(&lower).is_some();
    let maintainer_workflow_mode = preferred_maintainer_workflow(&lower).is_some();
    let workspace_workflow_mode =
        preferred_workspace_workflow(&lower).is_some() && !maintainer_workflow_mode;
    let toolchain_mode = contains_any(
        &lower,
        &[
            "tooling discipline",
            "best read-only toolchain",
            "identify the best tools you actually have",
            "concrete read-only investigation plan",
            "do not execute the plan",
            "available repo-inspection tools",
            "tool choice discipline",
            "what tools would you choose first",
        ],
    ) || (lower.contains("which tools") && lower.contains("why"))
        || (lower.contains("when would you choose") && lower.contains("tool"));
    let architecture_overview_mode = {
        let architecture_signals = contains_any(
            &lower,
            &[
                "architecture overview",
                "architecture walkthrough",
                "full architecture",
                "runtime walkthrough",
                "control flow",
                "tool routing",
                "workflow modes",
                "repo map behavior",
                "mcp policy",
                "prompt budgeting",
                "compaction",
                "file ownership",
                "owner file",
                "project structure",
                "repository structure",
            ],
        );
        let broad = contains_any(
            &lower,
            &[
                "full detailed",
                "all in one answer",
                "concrete file ownership",
                "walk me through",
                "major runtime pieces",
                "which files own",
                "how",
                "explain",
                "overview",
            ],
        );
        (architecture_signals && broad)
            || (lower.contains("runtime")
                && lower.contains("workflow")
                && (lower.contains("architecture") || lower.contains("tool routing")))
            || mentions_broad_system_walkthrough(&lower)
    };

    let direct_answer = if lower == "/help"
        || lower == "help"
        || lower == "/inventory"
        || lower == "/commands"
    {
        Some(DirectAnswerKind::Help)
    } else if lower == "/about"
        || lower == "/version"
        || lower == "about"
        || lower == "version"
        || mentions_creator_question(&lower)
    {
        Some(DirectAnswerKind::About)
    } else if matches!(
        lower.trim(),
        "who are you"
            | "who are you?"
            | "what are you"
            | "what are you?"
            | "what is your purpose"
            | "what is your purpose?"
            | "what's your purpose"
            | "what's your purpose?"
            | "what are you for"
            | "what are you for?"
            | "what is your job"
            | "what is your job?"
            | "what's your job"
            | "what's your job?"
    ) || (lower.contains("what is hematite") && !lower.contains("lm studio"))
    {
        Some(DirectAnswerKind::Identity)
    } else if (mentions_stable_product_surface(&lower) || mentions_product_truth_routing(&lower))
        && contains_any(
            &lower,
            &[
                "how hematite answers",
                "how does hematite answer",
                "how hematite handles",
                "how does hematite handle",
                "how hematite decides",
                "how does hematite decide",
                "decides whether",
                "decide whether",
            ],
        )
    {
        Some(DirectAnswerKind::ProductSurface)
    } else if mentions_reset_commands(&lower)
        && contains_any(
            &lower,
            &[
                "exact difference",
                "difference between",
                "explain the exact difference",
                "what is the difference",
            ],
        )
    {
        Some(DirectAnswerKind::SessionResetSemantics)
    } else if (lower.contains("reasoning output") || lower.contains("reasoning"))
        && contains_any(
            &lower,
            &["visible chat output", "visible chat", "chat output"],
        )
    {
        Some(DirectAnswerKind::ReasoningSplit)
    } else if lower.contains("/ask")
        && lower.contains("/code")
        && lower.contains("/architect")
        && lower.contains("/read-only")
        && lower.contains("/auto")
        && contains_any(&lower, &["difference", "differences", "what are"])
    {
        Some(DirectAnswerKind::WorkflowModes)
    } else if lower.contains(".hematite/settings.json")
        && lower.contains("gemma_native_auto")
        && lower.contains("gemma_native_formatting")
    {
        Some(DirectAnswerKind::GemmaNativeSettings)
    } else if contains_any(
        &lower,
        &[
            "skip verification",
            "skip build verification",
            "commit it immediately",
            "commit immediately",
        ],
    ) && contains_any(
        &lower,
        &[
            "make a code change",
            "make the change",
            "change the code",
            "edit the code",
            "edit a file",
            "implement",
        ],
    ) {
        Some(DirectAnswerKind::UnsafeWorkflowPressure)
    } else if contains_any(&lower, &["/gemma-native", "gemma native"])
        && contains_any(&lower, &["what does", "what is", "how does", "what do"])
    {
        Some(DirectAnswerKind::GemmaNative)
    } else if lower.contains("verify_build")
        && lower.contains(".hematite/settings.json")
        && contains_any(
            &lower,
            &["build", "test", "lint", "fix", "verification commands"],
        )
    {
        Some(DirectAnswerKind::VerifyProfiles)
    } else if (lower.contains("carry forward by default")
        || lower.contains("session memory should you carry forward")
        || (lower.contains("carry forward")
            && contains_any(
                &lower,
                &[
                    "besides the active task",
                    "blocker",
                    "compacts",
                    "recovers from a blocker",
                    "session state",
                ],
            )))
        && contains_any(
            &lower,
            &[
                "restarted hematite",
                "restarted",
                "avoid carrying forward",
                "session state",
                "active task",
                "blocker",
                "compacts",
                "recovers from a blocker",
            ],
        )
    {
        Some(DirectAnswerKind::SessionMemory)
    } else if contains_any(
        &lower,
        &[
            "recovery recipe",
            "recovery recipes",
            "recovery step",
            "recovery steps",
        ],
    ) && contains_any(
        &lower,
        &[
            "blocker",
            "runtime failure",
            "degrades",
            "context window",
            "context-window",
            "operator",
        ],
    ) {
        Some(DirectAnswerKind::RecoveryRecipes)
    } else if !architecture_overview_mode
        && contains_any(
            &lower,
            &[
                "mcp server health",
                "mcp runtime state",
                "mcp lifecycle",
                "mcp state",
                "mcp healthy",
                "mcp degraded",
                "mcp failed",
            ],
        )
    {
        Some(DirectAnswerKind::McpLifecycle)
    } else if contains_any(
        &lower,
        &[
            "allowed, denied, or require approval",
            "allowed denied or require approval",
            "allow, ask, or deny",
            "tool call should be allowed",
            "authorization logic",
            "workspace trust",
            "trust-allowlisted",
        ],
    ) {
        Some(DirectAnswerKind::AuthorizationPolicy)
    } else if contains_any(
        &lower,
        &[
            "tool classes",
            "tool class",
            "flat tool list",
            "runtime tool classes",
            "different runtime tool classes",
        ],
    ) || (lower.contains("repo reads")
        && lower.contains("repo writes")
        && contains_any(
            &lower,
            &[
                "verification tools",
                "git tools",
                "external mcp tools",
                "different runtime",
            ],
        ))
    {
        Some(DirectAnswerKind::ToolClasses)
    } else if contains_any(
        &lower,
        &[
            "built-in tool catalog",
            "builtin tool catalog",
            "builtin-tool dispatch",
            "built-in tool dispatch",
            "tool registry ownership",
            "which file now owns",
        ],
    ) && contains_any(
        &lower,
        &[
            "tool catalog",
            "dispatch path",
            "dispatch",
            "tool registry",
            "owns",
        ],
    ) {
        Some(DirectAnswerKind::ToolRegistryOwnership)
    } else if (lower.contains("other coding languages")
        || lower.contains("what languages")
        || lower.contains("know other languages"))
        && contains_any(
            &lower,
            &[
                "capable of making projects",
                "can you make projects",
                "can you build projects",
            ],
        )
    {
        Some(DirectAnswerKind::LanguageCapability)
    } else if workflow_mode == WorkflowMode::Architect
        && (lower.contains("session reset")
            || (lower.contains("/clear") && lower.contains("/new") && lower.contains("/forget")))
        && contains_any(&lower, &["redesign", "clearer", "easier", "understand"])
    {
        Some(DirectAnswerKind::ArchitectSessionResetPlan)
    } else if toolchain_mode
        && lower.contains("read-only")
        && contains_any(
            &lower,
            &[
                "tooling discipline",
                "investigation plan",
                "best read-only toolchain",
                "tool choice discipline",
                "what tools would you choose first",
            ],
        )
    {
        Some(DirectAnswerKind::Toolchain)
    } else if !architecture_overview_mode
        && host_inspection_mode
        && mentions_host_inspection_question(&lower)
    {
        Some(DirectAnswerKind::HostInspection)
    } else {
        None
    };

    let sovereign_mode = is_sovereign_mutation(user_input);

    let primary_class = if architecture_overview_mode {
        QueryIntentClass::RepoArchitecture
    } else if direct_answer.is_some()
        || mentions_stable_product_surface(&lower)
        || mentions_product_truth_routing(&lower)
    {
        QueryIntentClass::ProductTruth
    } else if mentions_research_query(&lower) {
        // Disambiguation: if also mentions codebase keywords, it's likely a local search.
        if mentions_codebase_keywords(&lower) {
            if lower.contains("logic") || lower.contains("wiring") || lower.contains("architecture")
            {
                QueryIntentClass::RepoArchitecture
            } else {
                QueryIntentClass::RuntimeDiagnosis
            }
        } else {
            QueryIntentClass::Research
        }
    } else if toolchain_mode {
        QueryIntentClass::Toolchain
    } else if capability_mode {
        QueryIntentClass::Capability
    } else if mentions_runtime_trace || anti_guess || lower.contains("read-only") {
        QueryIntentClass::RuntimeDiagnosis
    } else if looks_like_mutation_request(user_input) {
        QueryIntentClass::Implementation
    } else {
        QueryIntentClass::Unknown
    };

    QueryIntent {
        primary_class,
        direct_answer,
        grounded_trace_mode: mentions_runtime_trace || lower.contains("read-only") || anti_guess,
        capability_mode,
        capability_needs_repo,
        toolchain_mode,
        host_inspection_mode,
        maintainer_workflow_mode: maintainer_workflow_mode && !sovereign_mode,
        workspace_workflow_mode: workspace_workflow_mode && !sovereign_mode,
        architecture_overview_mode,
        sovereign_mode,
        surgical_filesystem_mode: is_simple_surgical_filesystem_request(user_input),
        scaffold_mode: is_scaffold_request(user_input),
    }
}

pub fn is_scaffold_request(user_input: &str) -> bool {
    let lower = user_input.to_lowercase();

    // Creation/generation verbs (combined with stack keywords for specificity)
    let creation_verbs = contains_any(
        &lower,
        &[
            "scaffold",
            "bootstrap",
            "create a",
            "create an",
            "create me a",
            "create me an",
            "make a",
            "make an",
            "make me a",
            "make me an",
            "build a",
            "build an",
            "build me a",
            "build me an",
            "generate a",
            "generate an",
            "set up a",
            "set up an",
            "set me up a",
            "set me up an",
            "spin up a",
            "spin up an",
            "start a",
            "start an",
            "init a",
            "init an",
            "initialize a",
            "initialize an",
            "write a",
            "write me a",
            "write me an",
            "build website",
            "make website",
            "create website",
            "scaffold website",
        ],
    );

    // Stack/project keywords — broad enough to catch short requests like "make me a rust app"
    let stack_keywords = contains_any(
        &lower,
        &[
            // Web frameworks
            "react app",
            "react project",
            "react site",
            "react component",
            "next.js",
            "nextjs",
            "next app",
            "next project",
            "nuxt",
            "vue app",
            "vue project",
            "vue site",
            "vue component",
            "svelte app",
            "svelte project",
            "sveltekit",
            "astro project",
            "astro site",
            "remix app",
            "solid.js",
            // Backend
            "express app",
            "express server",
            "express api",
            "express project",
            "fastapi",
            "flask app",
            "flask project",
            "flask api",
            "django project",
            "django app",
            "node project",
            "node app",
            "node server",
            "node api",
            "typescript project",
            "ts project",
            "ts app",
            // Rust
            "rust cli",
            "rust project",
            "rust app",
            "rust tool",
            "rust binary",
            "rust library",
            "rust crate",
            "rust api",
            // Go
            "go project",
            "go app",
            "go cli",
            "go api",
            "go server",
            "go tool",
            "golang project",
            "golang app",
            // Python
            "python project",
            "python app",
            "python cli",
            "python script",
            "python package",
            "python tool",
            "python api",
            "python service",
            "python library",
            // C / C++
            "c++ project",
            "c++ app",
            "cpp project",
            "cpp app",
            "c project",
            "c app",
            "cmake project",
            // Generic project types
            "landing page",
            "html website",
            "html site",
            "html page",
            "html file",
            "single file html",
            "single-file html",
            "single html file",
            "single index.html",
            "index.html",
            "portfolio site",
            "portfolio page",
            "personal site",
            "todo app",
            "rest api",
            "graphql api",
            "crud app",
            "web app",
            "web project",
            "web site",
            "website",
            "cli app",
            "cli tool",
            "command line tool",
            "command-line tool",
            "desktop app",
            "mobile app",
            "microservice",
            "api server",
            "backend api",
            "new project",
            "new app",
            "new site",
        ],
    );

    // Explicit scaffold tool invocations (always scaffold regardless of verb)
    let scaffold_commands = contains_any(
        &lower,
        &[
            "npm init",
            "npm create",
            "cargo new",
            "cargo init",
            "go mod init",
            "npx create-react-app",
            "npx create-next-app",
            "npx create-vue",
            "npx create-svelte",
            "npx astro",
            "pnpm create",
            "yarn create",
            "django-admin startproject",
            "python -m django startproject",
        ],
    );

    (creation_verbs && stack_keywords) || scaffold_commands
}

fn is_simple_surgical_filesystem_request(user_input: &str) -> bool {
    let lower = user_input.to_lowercase();
    let mentions_creation = contains_any(
        &lower,
        &[
            "make a folder",
            "make a directory",
            "make a file",
            "create a folder",
            "create a directory",
            "create a file",
            "new folder",
            "new directory",
        ],
    );
    let mentions_sovereign = contains_any(
        &lower,
        &[
            "@desktop",
            "@documents",
            "@downloads",
            "@home",
            "~/",
            "@temp",
        ],
    );

    mentions_creation || mentions_sovereign
}

pub(crate) fn is_capability_probe_tool(name: &str) -> bool {
    matches!(
        name,
        "read_file"
            | "inspect_lines"
            | "list_files"
            | "grep_files"
            | "lsp_definitions"
            | "lsp_references"
            | "lsp_hover"
            | "lsp_search_symbol"
            | "lsp_get_diagnostics"
            | "trace_runtime_flow"
            | "auto_pin_context"
            | "list_pinned"
    )
}

/// Returns true when the user's query is GitHub-related and should use `github_ops`.
/// The model should never shell out to `gh` — use the dedicated tool instead.
pub fn needs_github_ops(user_input: &str) -> bool {
    let lower = user_input.to_lowercase();
    lower.contains("pull request")
        || lower.contains("open pr")
        || lower.contains("create pr")
        || lower.contains("merge pr")
        || lower.contains("list prs")
        || lower.contains("list issues")
        || lower.contains("open issue")
        || lower.contains("create issue")
        || lower.contains("github issue")
        || lower.contains("ci status")
        || lower.contains("ci run")
        || lower.contains("github actions")
        || lower.contains("workflow run")
        || lower.contains("gh pr")
        || lower.contains("gh issue")
        || lower.contains("gh run")
        || (lower.contains("check") && lower.contains("pr"))
        || (lower.contains("status") && lower.contains("ci"))
}

/// Returns true when the user's query involves computation that must be exact —
/// checksums, financial math, statistics, date arithmetic, algorithmic verification, etc.
/// Used by the harness to inject a pre-turn nudge toward run_code instead of model memory.
pub fn needs_computation_sandbox(user_input: &str) -> bool {
    let lower = user_input.to_lowercase();

    // ── Computation verb set (reused by multiple categories) ─────────────────
    let has_compute_verb = lower.contains("calculat")
        || lower.contains("compute")
        || lower.contains("what is")
        || lower.contains("what's")
        || lower.contains("how much is")
        || lower.contains("how much does")
        || lower.contains("solve")
        || lower.contains("evaluate")
        || lower.contains("find the")
        || lower.contains("work out");

    // ── Hash / checksum ───────────────────────────────────────────────────────
    let hash_or_checksum = lower.contains("sha")
        || lower.contains("md5")
        || lower.contains("checksum")
        || lower.contains("crc")
        || lower.contains("hash")
        || lower.contains("fingerprint");

    // ── Simple arithmetic (any inline operator with digits) ───────────────────
    let simple_arithmetic = {
        let has_operator = lower.contains(" + ")
            || lower.contains(" - ")
            || lower.contains(" * ")
            || lower.contains(" / ")
            || lower.contains(" × ")
            || lower.contains(" ÷ ")
            || lower.contains(" ^ ")
            || lower.contains("squared")
            || lower.contains("cubed")
            || lower.contains("times ")
            || lower.contains("divided by")
            || lower.contains("multiplied by")
            || lower.contains("plus ")
            || lower.contains("minus ");
        let has_digit = lower.chars().any(|c| c.is_ascii_digit());
        has_operator && has_digit && has_compute_verb
    };

    // ── Financial / percentage ────────────────────────────────────────────────
    let financial = has_compute_verb
        && (lower.contains("percent")
            || lower.contains("%")
            || lower.contains("interest")
            || lower.contains("compound")
            || lower.contains("roi")
            || lower.contains("tax")
            || lower.contains("discount")
            || lower.contains("profit")
            || lower.contains("loss")
            || lower.contains("salary")
            || lower.contains("annuali")
            || lower.contains("amortiz")
            || lower.contains("mortgage")
            || lower.contains("exchange rate")
            || lower.contains("currency"));

    // ── Statistics / data analysis ────────────────────────────────────────────
    let statistics = lower.contains("standard deviation")
        || lower.contains("std dev")
        || lower.contains("mean of")
        || lower.contains("median of")
        || lower.contains("average of")
        || lower.contains("variance of")
        || lower.contains("regression")
        || lower.contains("correlation")
        || lower.contains("percentile")
        || lower.contains("quartile")
        || lower.contains("sum of")
        || lower.contains("total of")
        || lower.contains("count of")
        || lower.contains("these numbers")
        || lower.contains("the following numbers")
        || lower.contains("the following data")
        || lower.contains("from the data")
        || lower.contains("in this dataset")
        || lower.contains("from this csv")
        || lower.contains("from this table")
        || lower.contains("analyze the data")
        || lower.contains("analyze this data")
        || lower.contains("analyze these numbers");

    // ── Geometry / trigonometry ───────────────────────────────────────────────
    let geometry = lower.contains("area of")
        || lower.contains("volume of")
        || lower.contains("circumference")
        || lower.contains("perimeter of")
        || lower.contains("hypotenuse")
        || lower.contains("pythagorean")
        || lower.contains("square root")
        || lower.contains("sqrt")
        || lower.contains("cube root")
        || (has_compute_verb
            && (lower.contains(" sine ")
                || lower.contains(" sin ")
                || lower.contains(" cosine ")
                || lower.contains(" cos ")
                || lower.contains(" tangent ")
                || lower.contains(" tan ")))
        || lower.contains("logarithm")
        || lower.contains("log base")
        || lower.contains("natural log")
        || lower.contains(" ln ")
        || (has_compute_verb
            && (lower.contains("exponent")
                || lower.contains("power of")
                || lower.contains("to the power")
                || lower.contains("raised to")))
        || (has_compute_verb && lower.contains("derivative"))
        || (has_compute_verb && lower.contains("integral"));

    // ── Date / time arithmetic ────────────────────────────────────────────────
    let date_math = (lower.contains("how many days")
        || lower.contains("how many hours")
        || lower.contains("how many weeks")
        || lower.contains("how many months")
        || lower.contains("days between")
        || lower.contains("hours between")
        || lower.contains("weeks between")
        || lower.contains("days until")
        || lower.contains("days since")
        || lower.contains("unix timestamp")
        || lower.contains("epoch")
        || lower.contains("time zone")
        || lower.contains("timezone"))
        && (lower.contains("date")
            || lower.contains("day")
            || lower.contains("hour")
            || lower.contains("week")
            || lower.contains("month")
            || lower.contains("timestamp")
            || lower.contains("time"));

    // ── Algorithms / code execution ───────────────────────────────────────────
    let algorithmic = lower.contains("is prime")
        || lower.contains("prime number")
        || lower.contains("factori")
        || lower.contains("fibonacci")
        || lower.contains("factorial")
        || lower.contains("sort this")
        || lower.contains("verify this algorithm")
        || lower.contains("run this code")
        || lower.contains("execute this")
        || lower.contains("big-o")
        || lower.contains("time complexity")
        || lower.contains("space complexity");

    // ── Unit conversion ───────────────────────────────────────────────────────
    let unit_conversion = (lower.contains("convert") || lower.contains("how many"))
        && (lower.contains(" bytes")
            || lower.contains(" kb")
            || lower.contains(" mb")
            || lower.contains(" gb")
            || lower.contains(" tb")
            || lower.contains("gigabyte")
            || lower.contains("megabyte")
            || lower.contains("celsius")
            || lower.contains("fahrenheit")
            || lower.contains("kelvin")
            || lower.contains("kilometers")
            || lower.contains("kilometres")
            || lower.contains("miles")
            || lower.contains("meters")
            || lower.contains("metres")
            || lower.contains("feet")
            || lower.contains("inches")
            || lower.contains("centimeter")
            || lower.contains("centimetre")
            || lower.contains("pounds")
            || lower.contains("kilograms")
            || lower.contains("ounces")
            || lower.contains("liters")
            || lower.contains("litres")
            || lower.contains("gallons")
            || lower.contains("watts")
            || lower.contains("kilowatts")
            || lower.contains("volts")
            || lower.contains("ampere")
            || lower.contains("horsepower"));

    hash_or_checksum
        || simple_arithmetic
        || financial
        || statistics
        || date_math
        || algorithmic
        || unit_conversion
        || geometry
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn classify_query_intent_routes_creator_questions_to_about() {
        let intent = classify_query_intent(WorkflowMode::Auto, "Who created Hematite?");
        assert_eq!(intent.direct_answer, Some(DirectAnswerKind::About));

        let intent = classify_query_intent(WorkflowMode::Auto, "/about");
        assert_eq!(intent.direct_answer, Some(DirectAnswerKind::About));
    }

    #[test]
    fn classify_query_intent_routes_known_author_question_to_about() {
        let intent = classify_query_intent(WorkflowMode::Auto, "who is ocean bennett");
        assert_eq!(intent.direct_answer, Some(DirectAnswerKind::About));
    }

    #[test]
    fn classify_query_intent_marks_maintainer_workflow_requests() {
        let intent = classify_query_intent(
            WorkflowMode::Auto,
            "Run my cleanup scripts and prune old artifacts.",
        );
        assert!(intent.maintainer_workflow_mode);
        assert_eq!(
            preferred_maintainer_workflow("Rebuild the local portable and update PATH."),
            Some("package_windows")
        );
        assert_eq!(
            preferred_maintainer_workflow("Run the release flow and publish crates."),
            Some("release")
        );
    }

    #[test]
    fn classify_query_intent_marks_workspace_workflow_requests() {
        let intent = classify_query_intent(WorkflowMode::Auto, "Run the tests in this project.");
        assert!(intent.workspace_workflow_mode);
        assert_eq!(
            preferred_workspace_workflow("Run the tests in this project."),
            Some("test")
        );
        assert_eq!(
            preferred_workspace_workflow("Run npm run dev in this repo."),
            Some("script")
        );
    }

    #[test]
    fn test_overclocker_routing() {
        assert_eq!(
            preferred_host_inspection_topic("How's my silicon health looking?"),
            Some("overclocker")
        );
        assert_eq!(
            preferred_host_inspection_topic("Show me GPU clocks"),
            Some("overclocker")
        );
        assert_eq!(
            preferred_host_inspection_topic("nvidia stats"),
            Some("overclocker")
        );
        assert_eq!(
            preferred_host_inspection_topic("Show me GPU voltage telemetry"),
            Some("overclocker")
        );
        assert_eq!(
            preferred_host_inspection_topic("What are my CPU and GPU volts right now?"),
            Some("overclocker")
        );
    }

    #[test]
    fn test_gpu_throttle_routing() {
        assert_eq!(
            preferred_host_inspection_topic("Is my GPU currently throttled and why?"),
            Some("overclocker")
        );
        assert_eq!(
            preferred_host_inspection_topic("Tell me if my GPU is throttled"),
            Some("overclocker")
        );
        assert_eq!(
            preferred_host_inspection_topic("Is the GPU overheating?"),
            Some("overclocker")
        );
    }

    #[test]
    fn test_host_inspection_gateway() {
        assert!(mentions_host_inspection_question("is my gpu throttled?"));
        assert!(mentions_host_inspection_question(
            "check vram and silicon health"
        ));
        assert!(mentions_host_inspection_question("nvidia stats"));

        // Negative tests: General coding/repo questions should NOT trigger the gate
        assert!(!mentions_host_inspection_question("What is a Rust macro?"));
        assert!(!mentions_host_inspection_question(
            "Explain the repository structure."
        ));
        assert!(!mentions_host_inspection_question(
            "is this code efficient?"
        ));
    }

    #[test]
    fn test_web_mutation_routing() {
        // This is the prompt that previously failed by routing to HostInspection
        let input = "I want to change the primary brand color from whatever it is now to a vibrant 'Neon Hematite' (HSL 180, 100%, 50%). Update all CSS variables, update the JS theme toggle logic to support this as the new default highlight, and ensure the HTML icons match. Run verify_build when you are done.";

        // Test in Auto mode (where it should stay in code)
        let intent = classify_query_intent(WorkflowMode::Auto, input);
        assert_eq!(intent.primary_class, QueryIntentClass::Implementation);
        assert_eq!(intent.direct_answer, None);

        // Test in Code mode (where it should stay in code)
        let intent = classify_query_intent(WorkflowMode::Code, input);
        assert_eq!(intent.primary_class, QueryIntentClass::Implementation);
        assert_eq!(intent.direct_answer, None);
    }

    #[test]
    fn test_explicit_diagnostic_during_code() {
        // Even if we are in Code mode, an authoritative hardware noun should trigger the diagnostic
        let input = "Check my GPU stats and tell me if it's throttled.";
        let intent = classify_query_intent(WorkflowMode::Code, input);

        assert_eq!(intent.direct_answer, Some(DirectAnswerKind::HostInspection));
    }

    #[test]
    fn test_coding_shield_logic_collision() {
        // "logic" should not collide with "log" when in code mode
        let input = "Fix the login logic in my typescript code.";
        let intent = classify_query_intent(WorkflowMode::Auto, input);

        assert_eq!(intent.primary_class, QueryIntentClass::Implementation);
        assert_ne!(intent.direct_answer, Some(DirectAnswerKind::HostInspection));
    }

    #[test]
    fn single_file_html_sovereign_prompt_counts_as_scaffold() {
        let input = "google uefn toolbelt then make a folder on my desktop called yourtask and inside it create a single index.html that explains what you found";
        let intent = classify_query_intent(WorkflowMode::Auto, input);

        assert!(intent.sovereign_mode);
        assert!(intent.scaffold_mode);
    }
}