P0-P8: Full V1.0.0 Alpha implementation + audit reports

Implements 123 tasks across 9 phases (T-001..T-809) totaling 146 source files.

Monorepo (P0):
- 7-package Bun + Turborepo + TypeScript monorepo
- dependency-cruiser enforcing 7 forbidden edges + 5 deep-import rules

Contracts (P0):
- 16 type files (ids/error/event/runtime/ipc/task/worker-result/tool/artifact/evidence/project/provider/permission/ui/capability/platform)

Storage & Events (P1):
- DatabaseManager + MigrationRunner (19 tables, 22 indexes, 5 schema_meta seeds)
- 16 repositories (Repository<T,I,U> pattern, INV-1 status columns via EventStore.project only)
- EventSchemaRegistry (54 durable + 7 ephemeral), EventStore, EventBus, EventIngestor
- Project/Session/Artifact/Evidence stores + 8-step Recovery

Tools & Permission (P2):
- PathClassifier (8 categories), CommandRiskAnalyzer (10 categories), SecretRedactor
- PermissionEngine 6-layer evaluation (capability→profile→task_scope→risk→credential→user_prompt)
- ToolRegistry with 20+ tools across fs/shell/git/project/artifact/context/permission/doctor
- CapabilityManifestValidator + CapabilityRegistry

LLM & Context (P3):
- ModelConfigLoader, CapabilityMatrix, AnthropicCanonicalConverter
- AnthropicAdapter + OpenAICompatibleAdapter
- ProviderManager facade
- PromptLayerLoader (L0/L1/L3/L5), CompactionPolicy, ContextAssembler

Worker IPC & Scheduler (P4):
- WorkerProtocol (NDJSON), WorkerProcess (exit codes 0-5), WorkerManager (spawn/handshake)
- WorkerRuntime (INV-3: IPC only, no direct fs/shell/SQLite)
- 5 worker roles (Executor/Reviewer/Debugger/Compactor/ExperienceMiner)
- TaskGraph, WavePlanner, RetryPlanner, AgentMonitor, WorkspaceManager
- Scheduler (state machine), 8-step Recovery

C++ Toolchain (P5):
- DiagnosticParser, CppProjectDetector, CMakeConfigurator, CppBuilder
- CppTestRunner, CppcheckRunner, ClangdClient
- CppToolRegistrar + capability manifest

Projection & TUI (P6):
- ProjectionStore (hydrate/apply/snapshot/subscribe)
- TuiApp + 8 components (Session/Task/Agent/Tool/Diff/Evidence/Permission/Blocker/Hud)
- ProjectionClient in-process ref

Agents & Knowledge (P7):
- MainAgent, ArchitectureDesigner
- DebugKnowledgeStore + LearnedMemoryStore (single-writer, outbox model)
- Role integration wiring

CLI & Doctor & Release (P8):
- Logger + DeveloperLogEncryptor (AES-256-GCM)
- DoctorService (self_bootstrap first)
- RuntimeApp + ServiceRegistry
- 11 CLI commands: run/init/doctor/provider/resume/compact/history/session/restore/e2e/release
- CliEntrypoint + air<TODO>

Audit (in AirPlan/docs/):
- Deepseek开发阶段审计.md (97 findings)
- Opus开发阶段审计.md (140+ findings, 18 P0 blockers)
- MiniMaxM3开发阶段审计.md (18 P0 blockers, focuses on executability)
- AirPlan/TODO.md (technical debt + 42 TODOs by phase)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/toolchain-cpp/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@aircoding/toolchain-cpp",
+  "version": "1.0.0-alpha.0",
+  "private": true,
+  "type": "module",
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "build": "tsc --build",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo"
+  },
+  "dependencies": {
+    "@aircoding/contracts": "workspace:*"
+  },
+  "devDependencies": {
+    "typescript": "^5.8.0"
+  }
+}

packages/toolchain-cpp/src/CppToolRegistrar.ts

@@ -0,0 +1,97 @@
+/**
+ * CppToolRegistrar - Registers cpp.* tools through CapabilityRegistry
+ * DD §15. INV-4: registered via capability boundary, not direct runtime import.
+ *
+ * @module packages/toolchain-cpp/src/CppToolRegistrar
+ */
+
+import { CPP_TOOLCHAIN_CAPABILITY } from './capability.js'
+import { CppProjectDetector } from './detect/CppProjectDetector.js'
+import { CMakeConfigurator } from './build/CMakeConfigurator.js'
+import { CppBuilder } from './build/CppBuilder.js'
+import { CppTestRunner } from './test/CppTestRunner.js'
+import { CppcheckRunner } from './analysis/CppcheckRunner.js'
+import { ClangdClient } from './analysis/ClangdClient.js'
+
+export class CppToolRegistrar {
+  manifest = CPP_TOOLCHAIN_CAPABILITY
+
+  /**
+   * Register all cpp.* tools with the provided registry.
+   * INV-4: This is called through CapabilityRegistry boundary, never via direct runtime import.
+   */
+  register(registry: { register(name: string, definition: any, executor: (call: any) => Promise<any>): void }, project_root: string): void {
+    const detector = new CppProjectDetector(project_root)
+    const configurator = new CMakeConfigurator()
+    const builder = new CppBuilder()
+    const tester = new CppTestRunner()
+    const cppcheck = new CppcheckRunner()
+    const clangd = new ClangdClient()
+
+    // cpp.detect
+    registry.register('cpp.detect', {
+      name: 'cpp.detect', category: 'toolchain',
+      description: 'Detect C++ project structure and toolchain',
+      input_schema: CPP_TOOLCHAIN_CAPABILITY.tools[0].input_schema,
+      permissions: { read: true, write: false, network: false }, streaming: false
+    }, async (call) => {
+      const result = detector.detect()
+      return { call_id: call.id, tool_name: 'cpp.detect', type: 'text', content: result, metadata: { timestamp: new Date().toISOString() } }
+    })
+
+    // cpp.configure
+    registry.register('cpp.configure', {
+      name: 'cpp.configure', category: 'toolchain',
+      description: 'Configure C++ build with CMake',
+      input_schema: CPP_TOOLCHAIN_CAPABILITY.tools[1].input_schema,
+      permissions: { read: true, write: true, network: false }, streaming: false
+    }, async (call) => {
+      const result = configurator.configure({ project_root, generator: call.arguments?.generator as any, build_type: call.arguments?.build_type as any })
+      return { call_id: call.id, tool_name: 'cpp.configure', type: result.ok ? 'text' : 'error', content: result, metadata: { timestamp: new Date().toISOString() } }
+    })
+
+    // cpp.build
+    registry.register('cpp.build', {
+      name: 'cpp.build', category: 'toolchain',
+      description: 'Build C++ project',
+      input_schema: CPP_TOOLCHAIN_CAPABILITY.tools[2].input_schema,
+      permissions: { read: true, write: true, network: false }, streaming: false
+    }, async (call) => {
+      const result = builder.build(project_root + '/build', call.arguments?.target as string)
+      return { call_id: call.id, tool_name: 'cpp.build', type: result.ok ? 'text' : 'error', content: result, metadata: { timestamp: new Date().toISOString() } }
+    })
+
+    // cpp.test
+    registry.register('cpp.test', {
+      name: 'cpp.test', category: 'toolchain',
+      description: 'Run C++ tests',
+      input_schema: CPP_TOOLCHAIN_CAPABILITY.tools[3].input_schema,
+      permissions: { read: true, write: false, network: false }, streaming: false
+    }, async (call) => {
+      const result = tester.run_tests(project_root + '/build')
+      return { call_id: call.id, tool_name: 'cpp.test', type: result.ok ? 'text' : 'error', content: result, metadata: { timestamp: new Date().toISOString() } }
+    })
+
+    // cpp.cppcheck
+    registry.register('cpp.cppcheck', {
+      name: 'cpp.cppcheck', category: 'toolchain',
+      description: 'Run cppcheck static analysis',
+      input_schema: CPP_TOOLCHAIN_CAPABILITY.tools[4].input_schema,
+      permissions: { read: true, write: false, network: false }, streaming: false
+    }, async (call) => {
+      const result = cppcheck.run(project_root, { enable_all: call.arguments?.enable_all as boolean, check_config: call.arguments?.check_config as boolean })
+      return { call_id: call.id, tool_name: 'cpp.cppcheck', type: result.ok ? 'text' : 'error', content: result, metadata: { timestamp: new Date().toISOString() } }
+    })
+
+    // cpp.clangd
+    registry.register('cpp.clangd', {
+      name: 'cpp.clangd', category: 'toolchain',
+      description: 'Query clangd for symbol info',
+      input_schema: CPP_TOOLCHAIN_CAPABILITY.tools[5].input_schema,
+      permissions: { read: true, write: false, network: false }, streaming: false
+    }, async (call) => {
+      const result = await clangd.query_symbol(call.arguments?.file as string, call.arguments?.line as number, call.arguments?.column as number)
+      return { call_id: call.id, tool_name: 'cpp.clangd', type: 'text', content: result, metadata: { timestamp: new Date().toISOString() } }
+    })
+  }
+}

packages/toolchain-cpp/src/analysis/ClangdClient.ts

@@ -0,0 +1,38 @@
+/**
+ * ClangdClient - LSP query interface via clangd
+ * DD §15. Uses compile_commands.json for context-aware queries.
+ *
+ * @module packages/toolchain-cpp/src/analysis/ClangdClient
+ */
+
+export interface ClangdQueryOutput {
+  ok: boolean
+  symbols?: Array<{ name: string; kind: string; file: string; line: number }>
+  diagnostics?: Array<{ file: string; line: number; message: string; severity: string }>
+  error?: string
+}
+
+export class ClangdClient {
+  private compile_commands_path: string | null
+
+  constructor(compile_commands_path?: string) {
+    this.compile_commands_path = compile_commands_path || null
+  }
+
+  /**
+   * Query a symbol definition using clangd.
+   * TODO(P5): Implement LSP protocol communication with clangd.
+   */
+  async query_symbol(file: string, line: number, column: number): Promise<ClangdQueryOutput> {
+    // STUB: Would start clangd, send textDocument/definition request
+    return { ok: false, error: 'Clangd LSP client not yet implemented' }
+  }
+
+  /**
+   * Query diagnostics for a file.
+   * TODO(P5): Implement textDocument/diagnostic LSP request.
+   */
+  async query_diagnostics(file: string): Promise<ClangdQueryOutput> {
+    return { ok: false, error: 'Diagnostics query not yet implemented' }
+  }
+}

packages/toolchain-cpp/src/analysis/CppcheckRunner.ts

@@ -0,0 +1,58 @@
+/**
+ * CppcheckRunner - Static analysis via cppcheck
+ * DD §15. Exhaustive branch checking.
+ *
+ * @module packages/toolchain-cpp/src/analysis/CppcheckRunner
+ */
+
+import { execSync } from 'child_process'
+import { DiagnosticParser, type ParsedDiagnostic } from './DiagnosticParser.js'
+
+export interface CppcheckOutput {
+  ok: boolean
+  diagnostics: ParsedDiagnostic[]
+  output: string
+  elapsed_ms: number
+}
+
+export class CppcheckRunner {
+  private parser: DiagnosticParser
+
+  constructor() {
+    this.parser = new DiagnosticParser()
+  }
+
+  run(project_root: string, options?: { enable_all?: boolean; check_config?: boolean }): CppcheckOutput {
+    // TODO(P5): Pass args as array to execFileSync for command injection safety.
+    // Currently uses execSync with string interpolation — UNSAFE for untrusted input.
+    const start = Date.now()
+    const args: string[] = ['--enable=all', '--inconclusive', '--error-exitcode=0']
+
+    if (options?.check_config) {
+      args.push('--check-config')
+    }
+
+    try {
+      const output = execSync(`cppcheck ${args.join(' ')} ${project_root}`, {
+        encoding: 'utf-8',
+        stdio: 'pipe'
+      })
+
+      return {
+        ok: true,
+        diagnostics: this.parser.parse_compiler_output(output),
+        output,
+        elapsed_ms: Date.now() - start
+      }
+    } catch (error) {
+      const err = error as { stdout?: string; message?: string }
+      const output = err.stdout || err.message || ''
+      return {
+        ok: false,
+        diagnostics: [],
+        output,
+        elapsed_ms: Date.now() - start
+      }
+    }
+  }
+}

packages/toolchain-cpp/src/analysis/DiagnosticParser.ts

@@ -0,0 +1,83 @@
+/**
+ * DiagnosticParser - Parses compiler output to structured diagnostics
+ * DD §15. Deterministic semantic_signature generation (NO LLM here).
+ *
+ * @module packages/toolchain-cpp/src/analysis/DiagnosticParser
+ */
+
+import type { DiagnosticSeverity } from '@aircoding/contracts'
+
+export interface ParsedDiagnostic {
+  file?: string
+  line?: number
+  column?: number
+  severity: DiagnosticSeverity
+  message: string
+  code?: string
+  context?: string
+  semantic_signature: string
+}
+
+export class DiagnosticParser {
+  /**
+   * Parse compiler output (gcc/clang) to structured Diagnostics.
+   */
+  parse_compiler_output(output: string): ParsedDiagnostic[] {
+    const lines = output.split('\n')
+    const diagnostics: ParsedDiagnostic[] = []
+
+    // GCC/Clang diagnostic pattern: file:line:col: severity: message
+    const GCC_PATTERN = /^([^:]+):(\d+):(\d+):\s*(error|warning|note|fatal error):\s*(.+)/
+
+    for (const line of lines) {
+      const match = line.match(GCC_PATTERN)
+      if (match) {
+        const [, file, line_str, col_str, severity_str, message] = match
+        const severity = this.map_severity(severity_str)
+        const sig = this.generate_signature(file, severity, message)
+
+        diagnostics.push({
+          file,
+          line: parseInt(line_str),
+          column: parseInt(col_str),
+          severity,
+          message: message.trim(),
+          semantic_signature: sig
+        })
+      }
+    }
+
+    return diagnostics
+  }
+
+  /**
+   * Generate deterministic semantic_signature for deduplication.
+   */
+  generate_signature(file: string, severity: DiagnosticSeverity, message: string): string {
+    // Deterministic hash from error location + type + normalized message
+    const normalized = message.toLowerCase().replace(/\d+/g, 'N').replace(/'[^']*'/g, "'X'").replace(/"[^"]*"/g, '"X"')
+    const source = `${file}:${severity}:${normalized}`
+    // Simple deterministic hash
+    let hash = 0
+    for (let i = 0; i < source.length; i++) {
+      const char = source.charCodeAt(i)
+      hash = ((hash << 5) - hash) + char
+      hash |= 0
+    }
+    return `diag_${Math.abs(hash).toString(16).padStart(8, '0')}`
+  }
+
+  private map_severity(s: string): DiagnosticSeverity {
+    switch (s.toLowerCase()) {
+      case 'error':
+      case 'fatal error':
+        return 'error'
+      case 'warning':
+        return 'warning'
+      case 'note':
+        return 'info'
+      default:
+        return 'info'
+    }
+  }
+}

packages/toolchain-cpp/src/build/CMakeConfigurator.ts

@@ -0,0 +1,68 @@
+/**
+ * CMakeConfigurator - CMake build configuration
+ * DD §15. CMake+Ninja preferred, Make fallback. Generates compile_commands.json.
+ *
+ * @module packages/toolchain-cpp/src/build/CMakeConfigurator
+ */
+
+import { execSync } from 'child_process'
+import { existsSync, mkdirSync } from 'fs'
+import { join } from 'path'
+
+export interface CMakeConfig {
+  project_root: string
+  build_dir?: string
+  generator?: 'Ninja' | 'Unix Makefiles'
+  cmake_args?: string[]
+  build_type?: 'Debug' | 'Release' | 'RelWithDebInfo'
+}
+
+export interface CMakeConfigureOutput {
+  ok: boolean
+  build_dir: string
+  compile_commands_path?: string
+  error?: string
+}
+
+export class CMakeConfigurator {
+  configure(config: CMakeConfig): CMakeConfigureOutput {
+    const build_dir = config.build_dir || join(config.project_root, 'build')
+    const generator = config.generator || 'Ninja'
+    const build_type = config.build_type || 'Debug'
+    const args: string[] = config.cmake_args || []
+
+    // Create build directory
+    if (!existsSync(build_dir)) {
+      mkdirSync(build_dir, { recursive: true })
+    }
+
+    // TODO(P5): Use execFileSync with array args for command injection safety
+    const cmake_args = [
+      `-G`, generator,
+      `-DCMAKE_BUILD_TYPE=${build_type}`,
+      `-DCMAKE_EXPORT_COMPILE_COMMANDS=ON`,
+      ...args
+    ].join(' ')
+
+    try {
+      execSync(`cmake ${cmake_args} ${config.project_root}`, {
+        cwd: build_dir,
+        encoding: 'utf-8',
+        stdio: 'pipe'
+      })
+
+      const cc_path = join(build_dir, 'compile_commands.json')
+      return {
+        ok: true,
+        build_dir,
+        compile_commands_path: existsSync(cc_path) ? cc_path : undefined
+      }
+    } catch (error) {
+      return {
+        ok: false,
+        build_dir,
+        error: error instanceof Error ? error.message : String(error)
+      }
+    }
+  }
+}

packages/toolchain-cpp/src/build/CppBuilder.ts

@@ -0,0 +1,54 @@
+/**
+ * CppBuilder - Build C++ project
+ * DD §15. build→CppBuildOutput; diagnostics via DiagnosticParser.
+ *
+ * @module packages/toolchain-cpp/src/build/CppBuilder
+ */
+
+import { execSync } from 'child_process'
+import { DiagnosticParser, type ParsedDiagnostic } from '../analysis/DiagnosticParser.js'
+
+export interface BuildOutput {
+  ok: boolean
+  output: string
+  diagnostics: ParsedDiagnostic[]
+  elapsed_ms: number
+}
+
+export class CppBuilder {
+  private parser: DiagnosticParser
+
+  constructor() {
+    this.parser = new DiagnosticParser()
+  }
+
+  build(build_dir: string, target?: string): BuildOutput {
+    const start = Date.now()
+    const target_arg = target ? ` ${target}` : ''
+
+    try {
+      const output = execSync(`cmake --build .${target_arg}`, {
+        cwd: build_dir,
+        encoding: 'utf-8',
+        stdio: 'pipe'
+      })
+
+      return {
+        ok: true,
+        output,
+        diagnostics: this.parser.parse_compiler_output(output),
+        elapsed_ms: Date.now() - start
+      }
+    } catch (error) {
+      const err = error as { stdout?: string; stderr?: string; message?: string }
+      const output = [err.stdout, err.stderr].filter(Boolean).join('\n')
+
+      return {
+        ok: false,
+        output,
+        diagnostics: this.parser.parse_compiler_output(output),
+        elapsed_ms: Date.now() - start
+      }
+    }
+  }
+}

packages/toolchain-cpp/src/capability.ts

@@ -0,0 +1,67 @@
+/**
+ * C++ Toolchain capability manifest
+ * Registered via CapabilityRegistry per DD §15.
+ * INV-4: registered via capability boundary, not direct runtime import.
+ *
+ * @module packages/toolchain-cpp/src/capability
+ */
+
+import type { CapabilityManifestV1 } from '@aircoding/contracts'
+
+export const CPP_TOOLCHAIN_CAPABILITY: CapabilityManifestV1 = {
+  schema_version: 1,
+  name: 'aircoding-cpp-toolchain',
+  version: '1.0.0-alpha',
+  description: 'C++ build and analysis toolchain for AirCoding',
+  trust_level: 'local',
+  tools: [
+    {
+      name: 'cpp.detect', version: 1,
+      description: 'Detect C++ project structure and toolchain',
+      category: 'debug' as const,
+      permissions: { read_paths: { allow: ['*'] }, execute: false, network: false },
+      input_schema: { type: 'object', properties: { project_root: { type: 'string' } } },
+      output_schema: { type: 'object', properties: {} }
+    },
+    {
+      name: 'cpp.configure', version: 1,
+      description: 'Configure C++ build with CMake',
+      category: 'build' as const,
+      permissions: { read_paths: { allow: ['*'] }, write_paths: { allow: ['build/**'] }, execute: true, network: false },
+      input_schema: { type: 'object', properties: { generator: { type: 'string' }, build_type: { type: 'string' } } },
+      output_schema: { type: 'object', properties: {} }
+    },
+    {
+      name: 'cpp.build', version: 1,
+      description: 'Build C++ project with CMake',
+      category: 'build' as const,
+      permissions: { read_paths: { allow: ['*'] }, write_paths: { allow: ['build/**'] }, execute: true, network: false },
+      input_schema: { type: 'object', properties: { target: { type: 'string' } } },
+      output_schema: { type: 'object', properties: {} }
+    },
+    {
+      name: 'cpp.test', version: 1,
+      description: 'Run C++ tests via ctest',
+      category: 'test' as const,
+      permissions: { read_paths: { allow: ['*'] }, execute: true, network: false },
+      input_schema: { type: 'object', properties: {} },
+      output_schema: { type: 'object', properties: {} }
+    },
+    {
+      name: 'cpp.cppcheck', version: 1,
+      description: 'Run cppcheck static analysis with exhaustive branch checking',
+      category: 'static_analysis' as const,
+      permissions: { read_paths: { allow: ['*'] }, execute: true, network: false },
+      input_schema: { type: 'object', properties: { enable_all: { type: 'boolean' }, check_config: { type: 'boolean' } } },
+      output_schema: { type: 'object', properties: {} }
+    },
+    {
+      name: 'cpp.clangd', version: 1,
+      description: 'Query clangd LSP for symbol/diagnostic info',
+      category: 'static_analysis' as const,
+      permissions: { read_paths: { allow: ['*'] }, execute: true, network: false },
+      input_schema: { type: 'object', properties: { file: { type: 'string' }, line: { type: 'number' }, column: { type: 'number' } } },
+      output_schema: { type: 'object', properties: {} }
+    }
+  ]
+}

packages/toolchain-cpp/src/detect/CppProjectDetector.ts

@@ -0,0 +1,74 @@
+/**
+ * CppProjectDetector - Detects C++ project structure and toolchain
+ * DD §15. detect→CppDetectOutput.
+ *
+ * @module packages/toolchain-cpp/src/detect/CppProjectDetector
+ */
+
+import { existsSync, readFileSync } from 'fs'
+import { join } from 'path'
+
+export interface CppDetectOutput {
+  project_type: 'cmake' | 'make' | 'unknown'
+  has_cmake: boolean
+  has_make: boolean
+  has_ninja: boolean
+  has_compiler: boolean
+  compiler_version?: string
+  build_dir?: string
+  source_files: string[]
+  compile_commands?: string
+}
+
+export class CppProjectDetector {
+  private project_root: string
+
+  constructor(project_root: string) {
+    this.project_root = project_root
+  }
+
+  detect(): CppDetectOutput {
+    const result: CppDetectOutput = {
+      project_type: 'unknown',
+      has_cmake: false,
+      has_make: false,
+      has_ninja: false,
+      has_compiler: false,
+      source_files: []
+    }
+
+    // Detect project type
+    if (existsSync(join(this.project_root, 'CMakeLists.txt'))) {
+      result.project_type = 'cmake'
+      result.has_cmake = true
+    } else if (existsSync(join(this.project_root, 'Makefile'))) {
+      result.project_type = 'make'
+      result.has_make = true
+    }
+
+    // Check for compile_commands.json
+    const cc_path = join(this.project_root, 'build', 'compile_commands.json')
+    if (existsSync(cc_path)) {
+      result.compile_commands = cc_path
+    }
+
+    // Check toolchain
+    result.has_ninja = this.command_exists('ninja')
+    result.has_compiler = this.command_exists('g++') || this.command_exists('clang++')
+
+    // Find source files
+    result.source_files = this.find_cpp_sources()
+
+    return result
+  }
+
+  private command_exists(cmd: string): boolean {
+    // Simplified check
+    return existsSync(`/usr/bin/${cmd}`) || existsSync(`/usr/local/bin/${cmd}`)
+  }
+
+  private find_cpp_sources(): string[] {
+    // Would recursively find .cpp/.cc/.cxx/.h/.hpp files
+    return []
+  }
+}

packages/toolchain-cpp/src/index.ts

@@ -0,0 +1,16 @@
+export { DiagnosticParser } from './analysis/DiagnosticParser.js'
+export type { ParsedDiagnostic } from './analysis/DiagnosticParser.js'
+export { CppcheckRunner } from './analysis/CppcheckRunner.js'
+export type { CppcheckOutput } from './analysis/CppcheckRunner.js'
+export { ClangdClient } from './analysis/ClangdClient.js'
+export type { ClangdQueryOutput } from './analysis/ClangdClient.js'
+export { CppProjectDetector } from './detect/CppProjectDetector.js'
+export type { CppDetectOutput } from './detect/CppProjectDetector.js'
+export { CMakeConfigurator } from './build/CMakeConfigurator.js'
+export type { CMakeConfig, CMakeConfigureOutput } from './build/CMakeConfigurator.js'
+export { CppBuilder } from './build/CppBuilder.js'
+export type { BuildOutput } from './build/CppBuilder.js'
+export { CppTestRunner } from './test/CppTestRunner.js'
+export type { CppTestOutput } from './test/CppTestRunner.js'
+export { CppToolRegistrar } from './CppToolRegistrar.js'
+export { CPP_TOOLCHAIN_CAPABILITY } from './capability.js'

packages/toolchain-cpp/src/test/CppTestRunner.ts

@@ -0,0 +1,61 @@
+/**
+ * CppTestRunner - Run C++ tests
+ * DD §15. run_tests→CppTestOutput.
+ *
+ * @module packages/toolchain-cpp/src/test/CppTestRunner
+ */
+
+import { execSync } from 'child_process'
+import { DiagnosticParser } from '../analysis/DiagnosticParser.js'
+
+export interface CppTestOutput {
+  ok: boolean
+  total: number
+  passed: number
+  failed: number
+  output: string
+  elapsed_ms: number
+}
+
+export class CppTestRunner {
+  run_tests(build_dir: string): CppTestOutput {
+    const start = Date.now()
+
+    try {
+      const output = execSync('ctest --output-on-failure', {
+        cwd: build_dir,
+        encoding: 'utf-8',
+        stdio: 'pipe'
+      })
+
+      const { total, passed, failed } = this.parse_ctest_output(output)
+
+      return {
+        ok: failed === 0,
+        total,
+        passed,
+        failed,
+        output,
+        elapsed_ms: Date.now() - start
+      }
+    } catch (error) {
+      const err = error as { stdout?: string; message?: string }
+      return {
+        ok: false,
+        total: 0,
+        passed: 0,
+        failed: 1,
+        output: err.stdout || err.message || '',
+        elapsed_ms: Date.now() - start
+      }
+    }
+  }
+
+  private parse_ctest_output(output: string): { total: number; passed: number; failed: number } {
+    const match = output.match(/(\d+)\/?(?:\d+)?\s*Test.*#\d+:|Tests\s+passed.*(\d+)\s+total/i)
+    if (match) {
+      return { total: parseInt(match[1]) || 0, passed: parseInt(match[1]) || 0, failed: 0 }
+    }
+    return { total: 0, passed: 0, failed: 0 }
+  }
+}

packages/toolchain-cpp/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src"
+  },
+  "include": ["src"],
+  "references": [
+    { "path": "../contracts" }
+  ]
+}