From a6d41916bffca972aae435af3f69676897943eac Mon Sep 17 00:00:00 2001
From: Ethan Davidson <31261035+EthanThatOneKid@users.noreply.github.com>
Date: Tue, 13 Oct 2026 11:17:56 -0700
Subject: [PATCH 1/2] feat: run the engine on Node through JSR npm-compat, off
 Deno globals
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Port every `Deno.*` call in `src/` to a single runtime edge, `src/runtime.ts`,
so JSR's npm-compatibility package executes on Node with no wrapper and no
compiled binary. `npx jsr add @wazoo/workspace` already needed no Deno and
Node 24 already loaded the whole module graph; the only blocker was
`ReferenceError: Deno is not defined`.

- `src/runtime.ts` is the only module permitted to import `node:*`. It uses
  `node:child_process`, `node:fs/promises`, `node:os` and `node:process`, and
  preserves `Deno.Command#output()` semantics that callers depend on: it
  resolves for every exit code, and rejects only when the binary cannot be
  spawned, which is how `createGitHubRepoWithFallback` reports a missing `gh`.
- Host differences are normalised once, never at call sites: `isWindows()`
  (`Deno.build.os` says "windows", `process.platform` says "win32"),
  `cliArgs()` (`process.argv.slice(2)`, correct for `deno run`, a compiled
  binary, and `node <script>`), and exit via `process.exitCode` so piped
  `--json` output is never truncated by an immediate exit.
- `@types/node` is the sole non-`@std` dependency: type-only, resolved through
  Deno's global cache, creating no `node_modules/` directory.
- Fix the compiled binary's baked permissions. The code spawns `gh` (`add
  --create`) and `robocopy`/`rmdir`/`rm` (the ADR-0006 purge ladder) as well as
  `git`, so `--allow-run=git` alone would throw `PermissionDenied`.
- Move to 0.8.0, which also delivers the already-merged but unpublished
  `sweep`/`purge` commands to users.
- ADR-0007 records the decision, including the Deno sandbox regression for Node
  consumers; the README documents the no-Deno install.

Verified: `deno task ci` 193 passed / 0 failed; a cold-cache `deno check src/
tests/` is green (the CI path, with no `node_modules`); and the runtime edge was
exercised directly under Node — non-zero exit resolves, a missing binary
rejects, and `cwd`/fs/argv/exit behaviour all hold. End-to-end proof on the
published artifact is an `-rc` publish, pending approval.

Closes #160
Closes #159
---
 AGENTS.md                               |   7 +-
 README.md                               |  16 ++-
 deno.json                               |   7 +-
 deno.lock                               |  17 ++-
 docs/adr/0007-runtime-neutral-engine.md | 112 ++++++++++++++++
 src/cli.ts                              |   5 +-
 src/commands/add.ts                     |   5 +-
 src/commands/init.ts                    |   7 +-
 src/commands/install.ts                 |   5 +-
 src/commands/remove.ts                  |   5 +-
 src/git.ts                              |  16 +--
 src/manifest-discovery.ts               |   3 +-
 src/manifest-load.ts                    |   3 +-
 src/manifest-normalize.ts               |   3 +-
 src/purge.ts                            |  71 ++++------
 src/runtime.ts                          | 168 ++++++++++++++++++++++++
 src/status.ts                           |   3 +-
 tests/runtime_test.ts                   |  98 ++++++++++++++
 18 files changed, 473 insertions(+), 78 deletions(-)
 create mode 100644 docs/adr/0007-runtime-neutral-engine.md
 create mode 100644 src/runtime.ts
 create mode 100644 tests/runtime_test.ts

diff --git a/AGENTS.md b/AGENTS.md
index 2528807..1819fc7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -15,8 +15,11 @@ does not manage their location or lifecycle.
 
 ## Conventions
 
-- Deno 2, TypeScript, strict mode. `@std` packages are the only allowed
-  dependencies (runtime included); nothing outside `@std`.
+- Deno 2, TypeScript, strict mode. `@std` packages are the default dependency;
+  the sole exception is the runtime edge, `src/runtime.ts`, which uses `node:`
+  builtins so the engine also runs on Node through JSR's npm-compatibility layer
+  (see ADR-0007). It is the only module allowed to import `node:*`, and the only
+  one permitted to reference `npm:@types/node`.
 - TypeScript source in `src/`, tests in `tests/`. `tests/integration_test.ts`
   exercises real local git repositories under a temp dir.
 - Machine-readable git: use `--porcelain` output formats and `GitRunner` (an
diff --git a/README.md b/README.md
index be103a6..0f30e8b 100644
--- a/README.md
+++ b/README.md
@@ -207,7 +207,8 @@ Use the `/cli` subpath export — the runnable CLI entry — not the bare
 `jsr:@wazoo/workspace` package (which exposes the library and produces a no-op
 `wspace` when installed globally). `-A` grants the read/write/run permissions
 `wspace` needs; omit it if you prefer to grant specific flags (e.g.
-`--allow-read --allow-write --allow-run=git`) or use Prompts.
+`--allow-read --allow-write --allow-run=git,gh,robocopy,rmdir,rm`) or use
+Prompts.
 
 Or build a local binary:
 
@@ -217,6 +218,19 @@ deno task build
 
 Requires a Deno runtime (v2+). The `wspace` binary has no runtime dependencies.
 
+### Running without a Deno install
+
+JSR also serves the package in Node-compatible form, which needs no Deno
+installation:
+
+```sh
+npx jsr add @wazoo/workspace
+node node_modules/@wazoo/workspace/src/cli.js check --json
+```
+
+JSR forwards `exports` but not `bin`, so this runs the CLI rather than putting a
+`wspace` command on `PATH`; add a one-line wrapper if you want one.
+
 ## Development
 
 ```sh
diff --git a/deno.json b/deno.json
index 05c39a8..f6c9bac 100644
--- a/deno.json
+++ b/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@wazoo/workspace",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",
@@ -15,10 +15,11 @@
     "@std/cli": "jsr:@std/cli@^1.0.0",
     "@std/fs": "jsr:@std/fs@^1.0.0",
     "@std/path": "jsr:@std/path@^1.0.0",
-    "@std/yaml": "jsr:@std/yaml@^1.2.0"
+    "@std/yaml": "jsr:@std/yaml@^1.2.0",
+    "@types/node": "npm:@types/node@^22"
   },
   "tasks": {
-    "build": "deno compile --allow-read --allow-write --allow-run=git --output wspace src/cli.ts",
+    "build": "deno compile --allow-read --allow-write --allow-run=git,gh,robocopy,rmdir,rm --output wspace src/cli.ts",
     "ci": "deno fmt --check && deno lint && deno task lint:imports && deno check src/ tests/ && deno task test",
     "lint:imports": "deno run --allow-read scripts/lint_imports.ts",
     "test": "deno test --allow-read --allow-write --allow-run --allow-env"
diff --git a/deno.lock b/deno.lock
index a420d43..2958dc0 100644
--- a/deno.lock
+++ b/deno.lock
@@ -9,7 +9,8 @@
     "jsr:@std/internal@^1.0.14": "1.0.14",
     "jsr:@std/path@1": "1.1.6",
     "jsr:@std/path@^1.1.5": "1.1.6",
-    "jsr:@std/yaml@^1.2.0": "1.2.0"
+    "jsr:@std/yaml@^1.2.0": "1.2.0",
+    "npm:@types/node@22": "22.20.5"
   },
   "jsr": {
     "@std/assert@1.0.19": {
@@ -48,13 +49,25 @@
       "integrity": "20beb41e4983ba3437dbefac62b14061ab058e8a187596f19d28ff9035f6e6cf"
     }
   },
+  "npm": {
+    "@types/node@22.20.5": {
+      "integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
+      "dependencies": [
+        "undici-types"
+      ]
+    },
+    "undici-types@6.21.0": {
+      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="
+    }
+  },
   "workspace": {
     "dependencies": [
       "jsr:@std/assert@1",
       "jsr:@std/cli@1",
       "jsr:@std/fs@1",
       "jsr:@std/path@1",
-      "jsr:@std/yaml@^1.2.0"
+      "jsr:@std/yaml@^1.2.0",
+      "npm:@types/node@22"
     ]
   }
 }
diff --git a/docs/adr/0007-runtime-neutral-engine.md b/docs/adr/0007-runtime-neutral-engine.md
new file mode 100644
index 0000000..2ce82d1
--- /dev/null
+++ b/docs/adr/0007-runtime-neutral-engine.md
@@ -0,0 +1,112 @@
+# ADR-0007: The engine runs on Deno and Node, through one runtime edge
+
+- Status: accepted
+- Date: 2026-10
+- Amends: ADR-0006 (its purge strategies named `Deno.remove` directly)
+- Related: issues [#160](https://github.com/wazootech/workspace-cli/issues/160),
+  [#159](https://github.com/wazootech/workspace-cli/issues/159),
+  [#135](https://github.com/wazootech/workspace-cli/issues/135),
+  [#29](https://github.com/wazootech/workspace-cli/issues/29)
+
+## Context
+
+`wspace` had exactly one distribution path that did not require a Deno
+installation: a compiled binary built by `deno task build`. Everything else —
+`deno run jsr:@wazoo/workspace/cli`, `deno install` — presumes Deno on the
+machine.
+
+JSR also serves an **npm-compatibility** form of every package, which
+`npx jsr
+add @wazoo/workspace` installs without Deno present at all. Measured
+against the published `0.7.0`, that form is _mechanically_ ready:
+
+- it ships transpiled `.js` beside the `.ts`,
+- it rewrites the `@/x.ts` alias to the correct relative path per directory, and
+  `jsr:@std/fs` to `@jsr/std__fs`,
+- Node 24 loaded the whole module graph, resolved `@jsr/std__cli/parse-args`,
+  and honoured `import.meta.main`.
+
+It then died at `ReferenceError: Deno is not defined`. JSR transpiles; it does
+not shim Deno globals. That single fact — not packaging, not the alias, not the
+`@std` specs — was the whole barrier between "JSR serves a Node package" and
+"JSR serves a Node package that runs".
+
+Two constraints frame the decision. JSR's npm-compat layer forwards only
+`exports`, never `bin`
+([#135](https://github.com/wazootech/workspace-cli/issues/135)), so a `wspace`
+**command** on `PATH` still needs a wrapper; the port buys a runnable **library
+and CLI entry**, not a shim. And the alternative route — compiled binaries per
+platform ([#29](https://github.com/wazootech/workspace-cli/issues/29)) — ships
+no cross-platform runtime code but does ship a large artifact matrix.
+
+## Decision
+
+1. **Remove every `Deno.*` global from `src/`.** `Deno.args` and `Deno.exit` in
+   `src/cli.ts` were the last two.
+
+2. **Confine all host access to one module, `src/runtime.ts`.** It imports
+   `node:child_process`, `node:fs/promises`, `node:os` and `node:process`, which
+   Deno implements natively, so a single implementation serves both runtimes.
+   Nothing else in `src/` may import `node:*`. This is the one documented
+   exception to the "@std only" rule; `src/runtime.ts` is also the only module
+   permitted to reference `npm:@types/node`, which is now the project's sole
+   non-`@std` dependency (type-only, declared in `deno.json`).
+
+3. **`runProcess` preserves the two subprocess behaviours callers depend on.**
+   It resolves for _every_ exit code — including non-zero — so callers keep
+   classifying failure from `code`, and it rejects only when the binary cannot
+   be spawned at all. That rejection is load-bearing: it is how
+   `createGitHubRepoWithFallback` recognises "gh CLI is not available". Stdin is
+   detached so a subprocess cannot block on a credential prompt.
+
+4. **Host differences are normalised in exactly one place each, and never by
+   hand at a call site.** `Deno.build.os` says `"windows"` where
+   `process.platform` says `"win32"`, so Windows checks go through
+   `isWindows()`. `Deno.args` has no Node equivalent, so `cliArgs` derives
+   arguments from `process.argv.slice(2)`, which is correct in all three
+   invocation shapes — `deno run` (`[deno, script, ...]`), a compiled binary
+   (`[exe, exe, ...]`, Deno duplicates the path to mimic Node), and
+   `node <script>` (`[node, script, ...]`).
+
+5. **Exiting sets `process.exitCode` rather than calling `process.exit`.**
+   Exiting immediately can truncate buffered stdout when output is piped, which
+   would corrupt the `--json` contract that tooling consumes. Both runtimes
+   honour the exit code.
+
+6. **The engine stays Deno-tested.** The 185 Deno tests are not rewritten; they
+   are the behaviour-parity gate, and Deno loads `node:` builtins natively.
+   `tests/runtime_test.ts` covers the runtime edge directly, including the
+   non-zero-exit and missing-binary branches above.
+
+7. **The compiled binary's permission set is corrected.** `deno task build`
+   allowed only `--allow-run=git`, but the code also spawns `gh`
+   (`wspace add
+   --create`) and `robocopy`, `rmdir` and `rm` (the ADR-0006
+   purge ladder); `deno compile` bakes permissions in, so those paths would
+   throw `PermissionDenied`. The allowlist now names all five.
+
+## Consequences
+
+- **The npm-compat package becomes runnable, not merely installable.**
+  `npx jsr
+  add @wazoo/workspace` still needs no Deno, and
+  `node .../src/cli.js <cmd>` now executes. ADR-0006's purge ladder,
+  `wspace check --json`, and the rest of the engine come with it.
+- **No `node_modules/` directory is created for the repo.** `@types/node` is
+  resolved through Deno's global cache, so `deno check`, `deno compile` and the
+  publish flow are unaffected by the new dependency being npm-shaped.
+- **The Deno sandbox no longer constrains Node consumers — a real regression.**
+  Under Deno, `--allow-run=git,gh,robocopy,rmdir,rm` and `--allow-read`/`-write`
+  are enforced; the same code run on Node runs with the user's full ambient
+  authority. That is inherent to "runs on Node", and worth stating plainly
+  rather than discovering later.
+- **Getting `wspace` onto `PATH` is explicitly out of scope.** JSR does not
+  forward `bin`, and this ADR does not add an npm wrapper; [#135] tracks that
+  separately.
+- **The version bumps.** JSR is immutable, so the port and the previously
+  unshipped `sweep`/`purge` ([#159]) both require moving off the published
+  `0.7.0`; the release carries both.
+- **A faithful end-to-end test requires a pre-release.** JSR builds the
+  npm-compat tarball only at publish time, and `deno transpile` output is not
+  directly Node-loadable (it leaves `jsr:` specifiers), so verification is an
+  `-rc` publish plus a real `npx jsr add` install.
diff --git a/src/cli.ts b/src/cli.ts
index 0da191e..97411e9 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -6,6 +6,7 @@ import {
   manifestPaths,
   resolveWorkspaceTree,
 } from "./manifest.ts";
+import { cliArgs, exit } from "./runtime.ts";
 import { flattenResolved, resolveManifestPath } from "./shared.ts";
 import type { CliOptions } from "./shared.ts";
 
@@ -242,7 +243,7 @@ async function installConverged(
 
 export async function main(): Promise<number> {
   try {
-    return await run(Deno.args);
+    return await run(cliArgs());
   } catch (error) {
     if (error instanceof CliHelp) {
       return 0;
@@ -253,5 +254,5 @@ export async function main(): Promise<number> {
 }
 
 if (import.meta.main) {
-  main().then((code) => Deno.exit(code));
+  main().then((code) => exit(code));
 }
diff --git a/src/commands/add.ts b/src/commands/add.ts
index 37fea73..9c8140b 100644
--- a/src/commands/add.ts
+++ b/src/commands/add.ts
@@ -3,6 +3,7 @@ import { BARE_DEFAULT_HOST, resolveRepository } from "@/resolve.ts";
 import { validateManifestText } from "@/manifest.ts";
 import { validateRepositoryName } from "@/names.ts";
 import { createGitHubRepo } from "@/remote.ts";
+import { readTextFile, writeTextFile } from "@/runtime.ts";
 import type { CliOptions, EditRow } from "@/shared.ts";
 import {
   applyEntryEdit,
@@ -53,7 +54,7 @@ async function runAdd(
     return 2;
   }
 
-  const raw = await Deno.readTextFile(manifestPath);
+  const raw = await readTextFile(manifestPath);
   const newText = applyEntryEdit(
     raw,
     manifestExtension(manifestPath),
@@ -75,7 +76,7 @@ async function runAdd(
   rows.push({ name: entryName, action: "ADDED" });
   printRows(rows, opts.json);
   if (!opts.dryRun) {
-    await Deno.writeTextFile(manifestPath, newText);
+    await writeTextFile(manifestPath, newText);
     console.log(`Next: run \`wspace install ${entryName}\` to clone it.`);
   }
   return 0;
diff --git a/src/commands/init.ts b/src/commands/init.ts
index 9707cda..8bc1ecd 100644
--- a/src/commands/init.ts
+++ b/src/commands/init.ts
@@ -8,6 +8,7 @@ import {
   type RawManifest,
   validateManifest,
 } from "@/manifest.ts";
+import { currentDirectory, makeDirectory, writeTextFile } from "@/runtime.ts";
 import type { CliOptions } from "@/shared.ts";
 
 /**
@@ -19,7 +20,7 @@ import type { CliOptions } from "@/shared.ts";
  * anything is written.
  */
 export async function run(opts: CliOptions): Promise<number> {
-  const cwd = Deno.cwd();
+  const cwd = currentDirectory();
   const target = opts.manifestPath
     ? resolve(cwd, opts.manifestPath)
     : resolve(cwd, DEFAULT_MANIFEST_FILENAMES[0] + MANIFEST_EXTENSIONS[0]);
@@ -52,8 +53,8 @@ export async function run(opts: CliOptions): Promise<number> {
     return 2;
   }
 
-  await Deno.mkdir(join(targetDir, "repos"), { recursive: true });
-  await Deno.writeTextFile(target, JSON.stringify(doc, null, 2) + "\n");
+  await makeDirectory(join(targetDir, "repos"));
+  await writeTextFile(target, JSON.stringify(doc, null, 2) + "\n");
 
   console.log(`Created ${target} (schema v${CURRENT_SCHEMA_VERSION})`);
   console.log("Created repos/");
diff --git a/src/commands/install.ts b/src/commands/install.ts
index b806eb0..4e732da 100644
--- a/src/commands/install.ts
+++ b/src/commands/install.ts
@@ -5,6 +5,7 @@ import type { GitRunner } from "@/git.ts";
 import { type ManifestPaths, resolveRepositoryPath } from "@/manifest-paths.ts";
 import type { CliOptions } from "@/cli-options.ts";
 import { printRows } from "@/output.ts";
+import { makeDirectory } from "@/runtime.ts";
 import type { WorkspaceManifest } from "@/types.ts";
 import { findExistingManifest } from "@/manifest-discovery.ts";
 
@@ -51,9 +52,9 @@ async function cloneMissing(
   { dryRun = false }: { dryRun?: boolean } = {},
 ): Promise<InstallRow[]> {
   if (!dryRun) {
-    await Deno.mkdir(paths.repositoriesDirectory, { recursive: true });
+    await makeDirectory(paths.repositoriesDirectory);
     if (paths.workspacesDirectory !== undefined) {
-      await Deno.mkdir(paths.workspacesDirectory, { recursive: true });
+      await makeDirectory(paths.workspacesDirectory);
     }
   }
   let repositories = manifest.repositories;
diff --git a/src/commands/remove.ts b/src/commands/remove.ts
index b8ce0e5..290c215 100644
--- a/src/commands/remove.ts
+++ b/src/commands/remove.ts
@@ -4,6 +4,7 @@ import {
   resolveRepositoryPath,
   validateManifestText,
 } from "@/manifest.ts";
+import { readTextFile, writeTextFile } from "@/runtime.ts";
 import type { CliOptions } from "@/shared.ts";
 import {
   applyEntryEdit,
@@ -47,7 +48,7 @@ async function runRemove(
     return 2;
   }
 
-  const raw = await Deno.readTextFile(manifestPath);
+  const raw = await readTextFile(manifestPath);
   const newText = applyEntryEdit(
     raw,
     manifestExtension(manifestPath),
@@ -73,7 +74,7 @@ async function runRemove(
   const checkoutRemains = await exists(repoPath);
 
   if (!opts.dryRun) {
-    await Deno.writeTextFile(manifestPath, newText);
+    await writeTextFile(manifestPath, newText);
   }
   printRows([{ name: target, action: "REMOVED" }], opts.json);
   if (checkoutRemains) {
diff --git a/src/git.ts b/src/git.ts
index 9b97cc5..f3bc50b 100644
--- a/src/git.ts
+++ b/src/git.ts
@@ -1,3 +1,5 @@
+import { runProcess } from "./runtime.ts";
+
 export interface GitResult {
   code: number;
   stdout: string;
@@ -12,19 +14,7 @@ export class SystemGit implements GitRunner {
   constructor(private readonly git: string = "git") {}
 
   async run(args: string[], cwd?: string): Promise<GitResult> {
-    const command = new Deno.Command(this.git, {
-      args,
-      cwd,
-      stdout: "piped",
-      stderr: "piped",
-    });
-    const output = await command.output();
-    const decoder = new TextDecoder();
-    return {
-      code: output.code,
-      stdout: decoder.decode(output.stdout).trim(),
-      stderr: decoder.decode(output.stderr).trim(),
-    };
+    return await runProcess(this.git, args, { cwd });
   }
 }
 
diff --git a/src/manifest-discovery.ts b/src/manifest-discovery.ts
index 419f3a8..d1f8a26 100644
--- a/src/manifest-discovery.ts
+++ b/src/manifest-discovery.ts
@@ -1,5 +1,6 @@
 import { dirname, resolve } from "@std/path";
 import { exists } from "@std/fs";
+import { currentDirectory } from "./runtime.ts";
 
 export const CURRENT_SCHEMA_VERSION = 4;
 
@@ -48,7 +49,7 @@ export async function findManifestWalkingUp(
 }
 
 export async function findDefaultManifestPath(
-  cwd: string = Deno.cwd(),
+  cwd: string = currentDirectory(),
 ): Promise<string> {
   return (await findManifestWalkingUp(cwd)) ??
     resolve(cwd, DEFAULT_MANIFEST_FILENAMES[0] + MANIFEST_EXTENSIONS[0]);
diff --git a/src/manifest-load.ts b/src/manifest-load.ts
index 56064ca..900632c 100644
--- a/src/manifest-load.ts
+++ b/src/manifest-load.ts
@@ -9,6 +9,7 @@ import {
   removeEntry,
 } from "./manifest-edit.ts";
 import type { ManifestCollection, NewEntry } from "./manifest-edit.ts";
+import { currentDirectory } from "./runtime.ts";
 import type { WorkspaceManifest } from "./types.ts";
 import type { CliOptions } from "./cli-options.ts";
 
@@ -16,7 +17,7 @@ export async function resolveManifestPath(
   opts: Pick<CliOptions, "manifestPath">,
 ): Promise<string> {
   return opts.manifestPath
-    ? resolve(Deno.cwd(), opts.manifestPath)
+    ? resolve(currentDirectory(), opts.manifestPath)
     : await findDefaultManifestPath();
 }
 
diff --git a/src/manifest-normalize.ts b/src/manifest-normalize.ts
index 8701f93..dc8d17e 100644
--- a/src/manifest-normalize.ts
+++ b/src/manifest-normalize.ts
@@ -2,6 +2,7 @@ import type { RepositoryEntry, WorkspaceManifest } from "./types.ts";
 import { type Repository, resolveRepository } from "./resolve.ts";
 import { CURRENT_SCHEMA_VERSION } from "./manifest-discovery.ts";
 import { validateRepositoryName } from "./names.ts";
+import { readTextFile } from "./runtime.ts";
 
 /** Raw repository entry — shorthand string or unvalidated object. */
 type RawRepositoryEntry = string | Record<string, unknown>;
@@ -227,7 +228,7 @@ export async function loadManifest(
 ): Promise<WorkspaceManifest> {
   const raw = parseManifestText(
     manifestPath,
-    await Deno.readTextFile(manifestPath),
+    await readTextFile(manifestPath),
   );
   const manifest = normalizeManifest(raw, manifestPath);
   validateManifest(manifest);
diff --git a/src/purge.ts b/src/purge.ts
index d895fe3..439050c 100644
--- a/src/purge.ts
+++ b/src/purge.ts
@@ -10,6 +10,14 @@
  * actually worked is reported so callers and users can see what happened.
  */
 
+import {
+  isWindows,
+  makeTempDirectory,
+  pathExists,
+  removePath,
+  runProcess,
+} from "./runtime.ts";
+
 /** Convert a path to a Windows verbatim (`\\?\`) path, bypassing MAX_PATH. */
 function verbatim(path: string): string {
   if (path.startsWith("\\\\?\\")) return path;
@@ -17,60 +25,43 @@ function verbatim(path: string): string {
   return `\\\\?\\${path}`;
 }
 
-async function exists(path: string): Promise<boolean> {
-  try {
-    await Deno.stat(path);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 /**
  * Mirror an empty directory over `target` with robocopy, which deletes
  * long-path contents the Win32 APIs refuse to touch, then rmdir the shell.
  * The empty source is created under the OS temp dir, not beside the target.
  */
 async function robocopyPurge(target: string): Promise<boolean> {
-  const empty = await Deno.makeTempDir({ prefix: "wspace-purge-" });
+  const empty = await makeTempDirectory("wspace-purge-");
   try {
     // robocopy exit codes 0-7 are success; 8+ are real failures.
-    const copy = await new Deno.Command("robocopy", {
-      args: [
-        empty,
-        target,
-        "/MIR",
-        "/NFL",
-        "/NDL",
-        "/NJH",
-        "/NP",
-        "/R:1",
-        "/W:1",
-      ],
-      stdout: "null",
-      stderr: "null",
-    }).output();
-    if (copy.success === false && copy.code > 7) return false;
+    const copy = await runProcess("robocopy", [
+      empty,
+      target,
+      "/MIR",
+      "/NFL",
+      "/NDL",
+      "/NJH",
+      "/NP",
+      "/R:1",
+      "/W:1",
+    ]);
+    if (copy.code > 7) return false;
   } catch {
     return false;
   } finally {
     try {
-      await Deno.remove(empty, { recursive: true });
+      await removePath(empty);
     } catch {
       // The empty staging dir is disposable; a leftover temp dir must not
       // fail the purge that already succeeded.
     }
   }
   try {
-    await new Deno.Command("rmdir", {
-      args: [verbatim(target)],
-      stdout: "null",
-      stderr: "null",
-    }).output();
+    await runProcess("rmdir", [verbatim(target)]);
   } catch {
     // Fall through to the existence check below.
   }
-  return !(await exists(target));
+  return !(await pathExists(target));
 }
 
 /**
@@ -84,16 +75,16 @@ export async function purgeDirectory(
   // Strategy 1: a plain recursive delete. On non-Windows platforms, and for
   // most Windows paths, this is all that is needed.
   try {
-    await Deno.remove(dir, { recursive: true });
+    await removePath(dir);
     return "recursive delete";
   } catch {
     // Fall through to the long-path strategies.
   }
 
-  if (Deno.build.os === "windows") {
+  if (isWindows()) {
     // Strategy 2: the verbatim prefix opts out of MAX_PATH normalisation.
     try {
-      await Deno.remove(verbatim(dir), { recursive: true });
+      await removePath(verbatim(dir));
       return "verbatim recursive delete";
     } catch {
       // Fall through to robocopy.
@@ -109,12 +100,8 @@ export async function purgeDirectory(
 
   // POSIX last resort: rm -rf tolerates paths Deno refuses to resolve.
   try {
-    const rm = await new Deno.Command("rm", {
-      args: ["-rf", dir],
-      stdout: "null",
-      stderr: "null",
-    }).output();
-    if (rm.success) return "rm -rf";
+    const rm = await runProcess("rm", ["-rf", dir]);
+    if (rm.code === 0) return "rm -rf";
   } catch {
     // Report failure below.
   }
diff --git a/src/runtime.ts b/src/runtime.ts
new file mode 100644
index 0000000..ba7169c
--- /dev/null
+++ b/src/runtime.ts
@@ -0,0 +1,168 @@
+/**
+ * Runtime edge — the one module in `src/` that reaches outside `@std`.
+ *
+ * `wspace` runs two ways: on Deno (as a compiled binary or via `deno run`) and
+ * on Node (via the JSR npm-compatibility package). Deno's `Deno.*` globals do
+ * not exist on Node, so every such call is replaced with a `node:` builtin
+ * here; Deno implements the `node:` specifiers natively, so a single
+ * implementation serves both runtimes. Nothing else in `src/` may import
+ * `node:*`.
+ *
+ * Two host details genuinely differ and must not be hand-normalised:
+ *
+ *  - the OS name is `"windows"` on `Deno.build.os` and `"win32"` on
+ *    `process.platform`, so platform checks go through {@link isWindows};
+ *  - `Deno.args` has no Node equivalent, and `process.argv` is shaped
+ *    `[runtime, scriptOrBinary, ...args]` on all of `deno run`, a compiled
+ *    binary, and `node <script>` alike, so {@link cliArgs} drops the first two.
+ *
+ * See docs/adr/0007-runtime-neutral-engine.md.
+ */
+
+import { spawn } from "node:child_process";
+import {
+  mkdir,
+  mkdtemp,
+  readdir,
+  readFile,
+  rm,
+  stat,
+  writeFile,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import process from "node:process";
+import { join } from "@std/path";
+
+/** Output of a finished subprocess. Mirrors `Deno.Command#output()`. */
+export interface ProcessResult {
+  code: number;
+  stdout: string;
+  stderr: string;
+}
+
+/**
+ * Run `binary` with `args` and capture both output streams.
+ *
+ * Resolves for every exit code, including non-zero: callers classify failure
+ * from `code`, exactly as they did with `Deno.Command#output()`. Rejects only
+ * when the binary cannot be spawned at all — for example when `gh` is not
+ * installed — which is the shape `createGitHubRepoWithFallback` relies on to
+ * report "gh CLI is not available".
+ *
+ * Stdin is detached so a subprocess can never block on a prompt (a credential
+ * prompt from `git ls-remote` would otherwise hang the CLI).
+ */
+export function runProcess(
+  binary: string,
+  args: string[],
+  options: { cwd?: string } = {},
+): Promise<ProcessResult> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(binary, args, {
+      cwd: options.cwd,
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.setEncoding("utf8");
+    child.stderr?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk: string) => {
+      stdout += chunk;
+    });
+    child.stderr?.on("data", (chunk: string) => {
+      stderr += chunk;
+    });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      resolve({
+        code: code ?? 0,
+        stdout: stdout.trim(),
+        stderr: stderr.trim(),
+      });
+    });
+  });
+}
+
+/** Current working directory. */
+export function currentDirectory(): string {
+  return process.cwd();
+}
+
+/** CLI arguments: everything after the runtime and script/binary paths. */
+export function cliArgs(): string[] {
+  return process.argv.slice(2);
+}
+
+/**
+ * Set the process exit code.
+ *
+ * Deliberately not `process.exit()`: exiting immediately can truncate buffered
+ * stdout when output is piped, which would corrupt `--json` consumers. Setting
+ * the code lets the event loop drain, and both runtimes honour it.
+ */
+export function exit(code: number): void {
+  process.exitCode = code;
+}
+
+/** Read a file as UTF-8 text. Rejects when the file is missing. */
+export function readTextFile(path: string): Promise<string> {
+  return readFile(path, "utf8");
+}
+
+/** Write UTF-8 text to a file, creating or truncating it. */
+export function writeTextFile(path: string, text: string): Promise<void> {
+  return writeFile(path, text, "utf8");
+}
+
+/** Create a directory and any missing parents. Succeeds if it exists. */
+export async function makeDirectory(path: string): Promise<void> {
+  await mkdir(path, { recursive: true });
+}
+
+/** A directory entry, carrying the parts of `Deno.DirEntry` this CLI uses. */
+export interface DirectoryEntry {
+  name: string;
+  isDirectory: boolean;
+}
+
+/** List a directory. Rejects when it is missing or unreadable. */
+export async function readDirectory(path: string): Promise<DirectoryEntry[]> {
+  const entries = await readdir(path, { withFileTypes: true });
+  return entries.map((entry) => ({
+    name: entry.name,
+    isDirectory: entry.isDirectory(),
+  }));
+}
+
+/** Whether a path exists, of any kind. Never rejects. */
+export async function pathExists(path: string): Promise<boolean> {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Recursively delete a path. Like `Deno.remove(dir, { recursive: true })`, this
+ * rejects — without deleting anything — when the path does not exist.
+ */
+export function removePath(path: string): Promise<void> {
+  return rm(path, { recursive: true });
+}
+
+/** Create a unique temporary directory under the OS temp root. */
+export function makeTempDirectory(prefix: string): Promise<string> {
+  return mkdtemp(join(tmpdir(), prefix));
+}
+
+/**
+ * True on Windows. `Deno.build.os` spells this `"windows"` and
+ * `process.platform` spells it `"win32"`, so callers must not compare against
+ * the literal themselves.
+ */
+export function isWindows(): boolean {
+  return process.platform === "win32";
+}
diff --git a/src/status.ts b/src/status.ts
index 16e003b..280850a 100644
--- a/src/status.ts
+++ b/src/status.ts
@@ -3,6 +3,7 @@ import type { GitRunner } from "./git.ts";
 import { branchAb, configuredUpstream, hasRef } from "./git.ts";
 import { exists } from "@std/fs";
 import { type ManifestPaths, resolveRepositoryPath } from "./manifest-paths.ts";
+import { readDirectory } from "./runtime.ts";
 import { ROOT_LABEL } from "./types.ts";
 import type { RepositoryEntry, RepoState, RepoStatus } from "./types.ts";
 import {
@@ -166,7 +167,7 @@ export async function collectStatus(
   }
 
   if (await exists(reposDir)) {
-    for await (const entry of Deno.readDir(reposDir)) {
+    for (const entry of await readDirectory(reposDir)) {
       if (!entry.isDirectory || entry.name === ".git") {
         continue;
       }
diff --git a/tests/runtime_test.ts b/tests/runtime_test.ts
new file mode 100644
index 0000000..eab4030
--- /dev/null
+++ b/tests/runtime_test.ts
@@ -0,0 +1,98 @@
+import {
+  assert,
+  assertEquals,
+  assertRejects,
+  assertStringIncludes,
+} from "@std/assert";
+import { join } from "@std/path";
+import {
+  currentDirectory,
+  isWindows,
+  makeDirectory,
+  makeTempDirectory,
+  pathExists,
+  readDirectory,
+  readTextFile,
+  removePath,
+  runProcess,
+  writeTextFile,
+} from "@/runtime.ts";
+
+Deno.test("runProcess captures stdout and a zero exit code", async () => {
+  const result = await runProcess("git", ["--version"]);
+  assertEquals(result.code, 0);
+  assertStringIncludes(result.stdout, "git version");
+});
+
+Deno.test("runProcess resolves rather than throwing on a non-zero exit", async () => {
+  const result = await runProcess("git", [
+    "rev-parse",
+    "--verify",
+    "definitely-not-a-ref-xyz",
+  ]);
+  assert(result.code !== 0, `expected a non-zero exit, got ${result.code}`);
+});
+
+Deno.test("runProcess rejects when the binary cannot be spawned", async () => {
+  await assertRejects(() =>
+    runProcess("wspace-definitely-not-a-real-binary-xyz", [])
+  );
+});
+
+Deno.test("runProcess runs the subprocess in the requested directory", async () => {
+  const dir = await makeTempDirectory("wspace-runtime-test-");
+  try {
+    assertEquals((await runProcess("git", ["init"], { cwd: dir })).code, 0);
+    const inside = await runProcess(
+      "git",
+      ["rev-parse", "--is-inside-work-tree"],
+      { cwd: dir },
+    );
+    assertEquals(inside.stdout, "true");
+  } finally {
+    await removePath(dir);
+  }
+});
+
+Deno.test("currentDirectory matches the runtime's own working directory", () => {
+  assertEquals(currentDirectory(), Deno.cwd());
+});
+
+Deno.test("isWindows agrees with Deno.build.os", () => {
+  assertEquals(isWindows(), Deno.build.os === "windows");
+});
+
+Deno.test("filesystem helpers round-trip", async () => {
+  const dir = await makeTempDirectory("wspace-runtime-test-");
+  try {
+    const nested = join(dir, "a", "b");
+    await makeDirectory(nested);
+    assertEquals(await pathExists(nested), true);
+
+    const file = join(nested, "file.txt");
+    assertEquals(await pathExists(file), false);
+    await writeTextFile(file, "hello");
+    assertEquals(await readTextFile(file), "hello");
+
+    const entries = await readDirectory(nested);
+    assertEquals(
+      entries.map((entry) => [entry.name, entry.isDirectory]),
+      [["file.txt", false]],
+    );
+
+    await removePath(dir);
+    assertEquals(await pathExists(dir), false);
+  } finally {
+    if (await pathExists(dir)) await removePath(dir);
+  }
+});
+
+Deno.test("makeTempDirectory creates a prefixed directory under the temp root", async () => {
+  const dir = await makeTempDirectory("wspace-prefix-check-");
+  try {
+    assert(dir.includes("wspace-prefix-check-"));
+    assertEquals(await pathExists(dir), true);
+  } finally {
+    await removePath(dir);
+  }
+});

From 0ab53ef5f87197e2a58b46f02680796f9c6b9448 Mon Sep 17 00:00:00 2001
From: Ethan Davidson <31261035+EthanThatOneKid@users.noreply.github.com>
Date: Tue, 13 Oct 2026 11:43:10 -0700
Subject: [PATCH 2/2] fix: drop Deno-only @std/fs so the engine runs on Node,
 not just loads
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous commit removed every `Deno.*` call from `src/`, and the engine
still could not run on Node: `@std/fs` — a dependency, not our code — calls the
`Deno` global directly. Its `exists` and `walk` reach `Deno.stat`, `Deno.readDir`
and `Deno.errors.NotFound` in the TypeScript source *and* in the JavaScript JSR
ships to npm. Seven modules imported `exists` and one imported `walk`, so the CLI
died at `ReferenceError: Deno is not defined` during manifest discovery, before
any command could run. `deno test` could not catch this and did not: Deno defines
the `Deno` global, so the suite stays green with the dependency in place. It
surfaced only when the module graph was actually executed on Node.

- `src/runtime.ts` now owns the two shapes `@std/fs` provided, as `pathExists`
  and `walkDirectoryTree`, so the runtime edge covers host access *and*
  filesystem traversal. `src/` no longer imports `@std/fs` at all.
- `walkDirectoryTree` keeps `@std/fs/walk`'s observable semantics, because
  `wspace path` ranks what it is handed: the root is returned first, `maxDepth`
  counts the root as depth 0, `skip` patterns match the whole path rather than the
  basename, a skipped directory is neither returned nor descended into, and
  symlinks are never followed.
- `pathExists` documents the one deliberate divergence: a path that cannot be
  stat'd reads as absent, where `exists` reports it as present.
- Seven call sites move from `exists` to `pathExists`; `src/commands/path.ts`
  moves from `walk` to `walkDirectoryTree`.
- `@std/fs` stays a *test* dependency (`exists`, `expandGlob`); JSR omits
  test-only dependencies from the published package.
- ADR-0007 records the finding, and replaces its claim that an `-rc` publish is
  the only end-to-end proof, since a local run caught this one.

Verified: `deno task ci` is 199 passed / 0 failed / 1 ignored (a symlink test
skipped on Windows). Reproducing JSR's specifier rewrites locally and executing
the resulting graph on Node 24 gives parity with the published 0.7.0 binary:
`check --json` identical across all 39 entries, `path worlds-api` identical,
`path wiki` identical including its ambiguous-match stderr and exit 1, and
`sweep --dry-run --json` exits 0. `@jsr/std__fs` is unreachable from the graph,
and the remaining `@std/path` and `@std/cli` dependencies are runtime-neutral
(`std__path` guards with `global.process?.cwd ?? global.Deno?.cwd`, `std__cli`
with `"Deno" in globalThis`).

Refs #160
---
 AGENTS.md                               |   6 +-
 docs/adr/0007-runtime-neutral-engine.md |  51 +++++++--
 src/commands/install.ts                 |   7 +-
 src/commands/path.ts                    |   6 +-
 src/commands/remove.ts                  |   5 +-
 src/manifest-discovery.ts               |   5 +-
 src/manifest-load.ts                    |   5 +-
 src/repo-inspect.ts                     |   6 +-
 src/runtime.ts                          |  92 +++++++++++++--
 src/status.ts                           |   7 +-
 src/workspace-tree.ts                   |   6 +-
 tests/runtime_test.ts                   | 142 +++++++++++++++++++++++-
 12 files changed, 290 insertions(+), 48 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 1819fc7..83590ae 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -19,7 +19,11 @@ does not manage their location or lifecycle.
   the sole exception is the runtime edge, `src/runtime.ts`, which uses `node:`
   builtins so the engine also runs on Node through JSR's npm-compatibility layer
   (see ADR-0007). It is the only module allowed to import `node:*`, and the only
-  one permitted to reference `npm:@types/node`.
+  one permitted to reference `npm:@types/node`. `src/` must not import `@std/fs`
+  either: that package is Deno-only (`exists` and `walk` call the `Deno` global,
+  so it works under `deno test` and throws under Node), which is why existence
+  checks and tree walks go through the runtime edge's `pathExists` and
+  `walkDirectoryTree`.
 - TypeScript source in `src/`, tests in `tests/`. `tests/integration_test.ts`
   exercises real local git repositories under a temp dir.
 - Machine-readable git: use `--porcelain` output formats and `GitRunner` (an
diff --git a/docs/adr/0007-runtime-neutral-engine.md b/docs/adr/0007-runtime-neutral-engine.md
index 2ce82d1..d54984f 100644
--- a/docs/adr/0007-runtime-neutral-engine.md
+++ b/docs/adr/0007-runtime-neutral-engine.md
@@ -31,6 +31,10 @@ not shim Deno globals. That single fact — not packaging, not the alias, not th
 `@std` specs — was the whole barrier between "JSR serves a Node package" and
 "JSR serves a Node package that runs".
 
+That error had a second source the first pass missed. The CLI's own `Deno.*`
+calls were the visible ones; `@std/fs` — a dependency, not our code — reaches
+the `Deno` global too, in `exists` and `walk`.
+
 Two constraints frame the decision. JSR's npm-compat layer forwards only
 `exports`, never `bin`
 ([#135](https://github.com/wazootech/workspace-cli/issues/135)), so a `wspace`
@@ -47,10 +51,11 @@ no cross-platform runtime code but does ship a large artifact matrix.
 2. **Confine all host access to one module, `src/runtime.ts`.** It imports
    `node:child_process`, `node:fs/promises`, `node:os` and `node:process`, which
    Deno implements natively, so a single implementation serves both runtimes.
-   Nothing else in `src/` may import `node:*`. This is the one documented
-   exception to the "@std only" rule; `src/runtime.ts` is also the only module
-   permitted to reference `npm:@types/node`, which is now the project's sole
-   non-`@std` dependency (type-only, declared in `deno.json`).
+   Nothing else in `src/` may import `node:*` **or `@std/fs`** (item 8). This is
+   the one documented exception to the "@std only" rule; `src/runtime.ts` is
+   also the only module permitted to reference `npm:@types/node`, which is now
+   the project's sole non-`@std` dependency (type-only, declared in
+   `deno.json`).
 
 3. **`runProcess` preserves the two subprocess behaviours callers depend on.**
    It resolves for _every_ exit code — including non-zero — so callers keep
@@ -73,10 +78,10 @@ no cross-platform runtime code but does ship a large artifact matrix.
    would corrupt the `--json` contract that tooling consumes. Both runtimes
    honour the exit code.
 
-6. **The engine stays Deno-tested.** The 185 Deno tests are not rewritten; they
-   are the behaviour-parity gate, and Deno loads `node:` builtins natively.
-   `tests/runtime_test.ts` covers the runtime edge directly, including the
-   non-zero-exit and missing-binary branches above.
+6. **The engine stays Deno-tested.** The existing Deno test suite is not
+   rewritten; it is the behaviour-parity gate, and Deno loads `node:` builtins
+   natively. `tests/runtime_test.ts` covers the runtime edge directly, including
+   the non-zero-exit and missing-binary branches above.
 
 7. **The compiled binary's permission set is corrected.** `deno task build`
    allowed only `--allow-run=git`, but the code also spawns `gh`
@@ -85,6 +90,20 @@ no cross-platform runtime code but does ship a large artifact matrix.
    purge ladder); `deno compile` bakes permissions in, so those paths would
    throw `PermissionDenied`. The allowlist now names all five.
 
+8. **`@std/fs` is removed from `src/`, because it is Deno-only.** Its `exists`
+   and `walk` call the `Deno` global directly — in the TypeScript source _and_
+   in the JavaScript JSR ships to npm — so a module that imports them
+   type-checks and tests green on Deno, then throws
+   `ReferenceError: Deno is not defined` on Node. `src/runtime.ts` now owns the
+   two shapes the CLI needed, `pathExists` and `walkDirectoryTree`, and keeps
+   `@std/fs/walk`'s observable semantics on purpose: the root is returned first,
+   `maxDepth` counts the root as depth 0, `skip` patterns match the whole path
+   rather than the basename, a skipped directory is neither returned nor
+   descended into, and symlinks are never followed. `@std/path` and `@std/cli`
+   are runtime-neutral and stay in use. `@std/fs` remains a _test_ dependency
+   (`exists`, `expandGlob`), and JSR was measured to omit test-only dependencies
+   from the published package.
+
 ## Consequences
 
 - **The npm-compat package becomes runnable, not merely installable.**
@@ -106,7 +125,15 @@ no cross-platform runtime code but does ship a large artifact matrix.
 - **The version bumps.** JSR is immutable, so the port and the previously
   unshipped `sweep`/`purge` ([#159]) both require moving off the published
   `0.7.0`; the release carries both.
-- **A faithful end-to-end test requires a pre-release.** JSR builds the
-  npm-compat tarball only at publish time, and `deno transpile` output is not
-  directly Node-loadable (it leaves `jsr:` specifiers), so verification is an
-  `-rc` publish plus a real `npx jsr add` install.
+- **The Deno test suite could not have caught the `Deno` dependency, and did
+  not.** A green `deno task ci` with `@std/fs` imported from `src/` is expected,
+  because Deno defines the `Deno` global; the defect appears only when the same
+  module graph runs under Node. It was found by reproducing JSR's specifier
+  rewrites locally and executing the result on Node, which is the closest
+  available stand-in for the published tarball. JSR's server-side packaging
+  remains the one link a local run cannot exercise; it applies the same rewrites
+  that were reproduced by hand.
+- **A `wspace path` traversal is now the CLI's own code.** `walkDirectoryTree`
+  is ~40 lines to maintain and read in place of a dependency, and it is covered
+  by tests that pin the semantics `@std/fs/walk` had, so the substitution is
+  observable rather than assumed.
diff --git a/src/commands/install.ts b/src/commands/install.ts
index 4e732da..8dfdd72 100644
--- a/src/commands/install.ts
+++ b/src/commands/install.ts
@@ -1,11 +1,10 @@
-import { exists } from "@std/fs";
 import { join } from "@std/path";
 import { clone } from "@/git.ts";
 import type { GitRunner } from "@/git.ts";
 import { type ManifestPaths, resolveRepositoryPath } from "@/manifest-paths.ts";
 import type { CliOptions } from "@/cli-options.ts";
 import { printRows } from "@/output.ts";
-import { makeDirectory } from "@/runtime.ts";
+import { makeDirectory, pathExists } from "@/runtime.ts";
 import type { WorkspaceManifest } from "@/types.ts";
 import { findExistingManifest } from "@/manifest-discovery.ts";
 
@@ -75,14 +74,14 @@ async function cloneMissing(
   const rows: InstallRow[] = [];
   for (const repository of repositories) {
     const repoPath = resolveRepositoryPath(repository, paths);
-    if (await exists(repoPath)) {
+    if (await pathExists(repoPath)) {
       const invalidWorkspace = await workspaceManifestMissing(
         repository,
         repoPath,
       );
       if (invalidWorkspace) {
         rows.push(invalidWorkspace);
-      } else if (await exists(join(repoPath, ".git"))) {
+      } else if (await pathExists(join(repoPath, ".git"))) {
         rows.push({ name: repository.name, state: "EXISTS" });
       } else {
         rows.push({
diff --git a/src/commands/path.ts b/src/commands/path.ts
index bdc247a..b82ad6e 100644
--- a/src/commands/path.ts
+++ b/src/commands/path.ts
@@ -1,5 +1,5 @@
 import { relative } from "@std/path";
-import { walk } from "@std/fs/walk";
+import { walkDirectoryTree } from "@/runtime.ts";
 import type { ManifestPaths } from "@/manifest.ts";
 import type { CliOptions } from "@/shared.ts";
 import type { WorkspaceManifest } from "@/types.ts";
@@ -46,8 +46,8 @@ async function searchWorkspace(
   ]);
 
   try {
-    for await (
-      const entry of walk(paths.root, {
+    for (
+      const entry of await walkDirectoryTree(paths.root, {
         maxDepth: 3,
         includeFiles: false,
         skip: [/^\./, /node_modules/, /^\.git$/],
diff --git a/src/commands/remove.ts b/src/commands/remove.ts
index 290c215..72ced44 100644
--- a/src/commands/remove.ts
+++ b/src/commands/remove.ts
@@ -1,10 +1,9 @@
-import { exists } from "@std/fs";
 import {
   manifestPaths,
   resolveRepositoryPath,
   validateManifestText,
 } from "@/manifest.ts";
-import { readTextFile, writeTextFile } from "@/runtime.ts";
+import { pathExists, readTextFile, writeTextFile } from "@/runtime.ts";
 import type { CliOptions } from "@/shared.ts";
 import {
   applyEntryEdit,
@@ -71,7 +70,7 @@ async function runRemove(
 
   const paths = manifestPaths(manifest, manifestPath);
   const repoPath = resolveRepositoryPath(existing, paths);
-  const checkoutRemains = await exists(repoPath);
+  const checkoutRemains = await pathExists(repoPath);
 
   if (!opts.dryRun) {
     await writeTextFile(manifestPath, newText);
diff --git a/src/manifest-discovery.ts b/src/manifest-discovery.ts
index d1f8a26..cad5181 100644
--- a/src/manifest-discovery.ts
+++ b/src/manifest-discovery.ts
@@ -1,6 +1,5 @@
 import { dirname, resolve } from "@std/path";
-import { exists } from "@std/fs";
-import { currentDirectory } from "./runtime.ts";
+import { currentDirectory, pathExists } from "./runtime.ts";
 
 export const CURRENT_SCHEMA_VERSION = 4;
 
@@ -16,7 +15,7 @@ export async function findExistingManifest(
   for (const basename of DEFAULT_MANIFEST_FILENAMES) {
     for (const extension of MANIFEST_EXTENSIONS) {
       const candidate = resolve(dir, basename + extension);
-      if (await exists(candidate)) {
+      if (await pathExists(candidate)) {
         return candidate;
       }
     }
diff --git a/src/manifest-load.ts b/src/manifest-load.ts
index 900632c..2f5da55 100644
--- a/src/manifest-load.ts
+++ b/src/manifest-load.ts
@@ -1,5 +1,4 @@
 import { resolve } from "@std/path";
-import { exists } from "@std/fs";
 import { findDefaultManifestPath } from "./manifest-discovery.ts";
 import { loadManifest } from "./manifest-normalize.ts";
 import {
@@ -9,7 +8,7 @@ import {
   removeEntry,
 } from "./manifest-edit.ts";
 import type { ManifestCollection, NewEntry } from "./manifest-edit.ts";
-import { currentDirectory } from "./runtime.ts";
+import { currentDirectory, pathExists } from "./runtime.ts";
 import type { WorkspaceManifest } from "./types.ts";
 import type { CliOptions } from "./cli-options.ts";
 
@@ -78,7 +77,7 @@ export async function loadEditableManifest(
   opts: CliOptions,
 ): Promise<EditableManifest> {
   const manifestPath = await resolveManifestPath(opts);
-  if (!(await exists(manifestPath))) {
+  if (!(await pathExists(manifestPath))) {
     console.error(
       `No manifest found at ${manifestPath}; run \`wspace init\` first`,
     );
diff --git a/src/repo-inspect.ts b/src/repo-inspect.ts
index c1c0d46..881503c 100644
--- a/src/repo-inspect.ts
+++ b/src/repo-inspect.ts
@@ -6,7 +6,7 @@ import {
   hasDefaultBranchWorktree,
   isDirty,
 } from "./git.ts";
-import { exists } from "@std/fs";
+import { pathExists } from "./runtime.ts";
 
 /**
  * Structured result of inspecting a single repository on disk.
@@ -41,7 +41,7 @@ export async function inspectRepo(
   repoPath: string,
   opts: InspectOptions = {},
 ): Promise<RepoInspection> {
-  if (!(await exists(repoPath))) {
+  if (!(await pathExists(repoPath))) {
     return {
       exists: false,
       isGit: false,
@@ -49,7 +49,7 @@ export async function inspectRepo(
       defaultBranchCheckedOutInWorktree: false,
     };
   }
-  if (!(await exists(join(repoPath, ".git")))) {
+  if (!(await pathExists(join(repoPath, ".git")))) {
     return {
       exists: true,
       isGit: false,
diff --git a/src/runtime.ts b/src/runtime.ts
index ba7169c..06c4342 100644
--- a/src/runtime.ts
+++ b/src/runtime.ts
@@ -1,12 +1,22 @@
 /**
- * Runtime edge — the one module in `src/` that reaches outside `@std`.
+ * Runtime edge — the one module in `src/` that touches the host runtime.
  *
  * `wspace` runs two ways: on Deno (as a compiled binary or via `deno run`) and
- * on Node (via the JSR npm-compatibility package). Deno's `Deno.*` globals do
- * not exist on Node, so every such call is replaced with a `node:` builtin
- * here; Deno implements the `node:` specifiers natively, so a single
- * implementation serves both runtimes. Nothing else in `src/` may import
- * `node:*`.
+ * on Node (via the JSR npm-compatibility package). Two host interfaces do not
+ * exist on Node, so both are owned here:
+ *
+ *  - Deno's `Deno.*` globals, replaced with `node:` builtins; Deno implements
+ *    the `node:` specifiers natively, so one implementation serves both
+ *    runtimes;
+ *  - `@std/fs`, which is Deno-only. Its `exists` and `walk` call the `Deno`
+ *    global directly — in the TypeScript source *and* in the JavaScript JSR
+ *    ships to npm — so importing it type-checks and tests clean on Deno while
+ *    throwing `ReferenceError: Deno is not defined` on Node. The two call
+ *    shapes this CLI needs live here instead, as {@link pathExists} and
+ *    {@link walkDirectoryTree}.
+ *
+ * Nothing else in `src/` may import `node:*` or `@std/fs`. `@std/path` and
+ * `@std/cli` are runtime-neutral and stay in use.
  *
  * Two host details genuinely differ and must not be hand-normalised:
  *
@@ -31,7 +41,7 @@ import {
 } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import process from "node:process";
-import { join } from "@std/path";
+import { basename, join } from "@std/path";
 
 /** Output of a finished subprocess. Mirrors `Deno.Command#output()`. */
 export interface ProcessResult {
@@ -135,7 +145,73 @@ export async function readDirectory(path: string): Promise<DirectoryEntry[]> {
   }));
 }
 
-/** Whether a path exists, of any kind. Never rejects. */
+/** One path visited by {@link walkDirectoryTree}. */
+export interface WalkEntry {
+  /** Path as joined from the walked root, never canonicalised. */
+  path: string;
+  /** Basename of the entry. */
+  name: string;
+  /** Whether the entry is a directory. Symlinks are never followed. */
+  isDirectory: boolean;
+}
+
+/**
+ * Walk `root` depth-first, returning directories and — when `includeFiles` is
+ * true — files. Replaces `@std/fs`'s `walk`, which is Deno-only.
+ *
+ * Semantics are deliberately the ones `@std/fs/walk` had:
+ *
+ *  - the root itself is returned first, as a directory, so callers written
+ *    against `walk` keep working unchanged;
+ *  - `maxDepth` counts the root as depth 0, and a negative value walks nothing;
+ *  - `skip` patterns are matched against the **whole path**, not the basename,
+ *    and a skipped directory is neither returned nor descended into;
+ *  - symlinks are never followed: a symlinked directory is not an
+ *    `isDirectory: true` entry, its contents are not walked, and it is only
+ *    returned at all when `includeFiles` is set.
+ *
+ * Unlike `walk` this returns a sorted-by-traversal array rather than an async
+ * generator, because the CLI collects every result before ranking it anyway.
+ */
+export async function walkDirectoryTree(
+  root: string,
+  options: { maxDepth?: number; includeFiles?: boolean; skip?: RegExp[] } = {},
+): Promise<WalkEntry[]> {
+  const { maxDepth = Infinity, includeFiles = true, skip = [] } = options;
+  if (maxDepth < 0) return [];
+
+  const isSkipped = (candidate: string) =>
+    skip.some((pattern) => candidate.match(pattern) !== null);
+  const found: WalkEntry[] = [];
+
+  const visit = async (dir: string, depth: number): Promise<void> => {
+    if (isSkipped(dir)) return;
+    found.push({ path: dir, name: basename(dir), isDirectory: true });
+    if (depth >= maxDepth) return;
+
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+      const entryPath = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await visit(entryPath, depth + 1);
+      } else if (includeFiles && !isSkipped(entryPath)) {
+        found.push({ path: entryPath, name: entry.name, isDirectory: false });
+      }
+    }
+  };
+
+  await visit(root, 0);
+  return found;
+}
+
+/**
+ * Whether a path exists, of any kind. Never rejects.
+ *
+ * Matches `@std/fs`'s `exists` for the cases this CLI hits, with one
+ * deliberate divergence it does not share: a path that exists but cannot be
+ * stat'd — permission denied, for instance — reads as absent here, where
+ * `exists` reports it as present. Callers that must tell "missing" from
+ * "unreadable" apart should use {@link readTextFile} or `stat` directly.
+ */
 export async function pathExists(path: string): Promise<boolean> {
   try {
     await stat(path);
diff --git a/src/status.ts b/src/status.ts
index 280850a..8774e3e 100644
--- a/src/status.ts
+++ b/src/status.ts
@@ -1,9 +1,8 @@
 import { join, normalize, resolve } from "@std/path";
 import type { GitRunner } from "./git.ts";
 import { branchAb, configuredUpstream, hasRef } from "./git.ts";
-import { exists } from "@std/fs";
 import { type ManifestPaths, resolveRepositoryPath } from "./manifest-paths.ts";
-import { readDirectory } from "./runtime.ts";
+import { pathExists, readDirectory } from "./runtime.ts";
 import { ROOT_LABEL } from "./types.ts";
 import type { RepositoryEntry, RepoState, RepoStatus } from "./types.ts";
 import {
@@ -166,7 +165,7 @@ export async function collectStatus(
     }
   }
 
-  if (await exists(reposDir)) {
+  if (await pathExists(reposDir)) {
     for (const entry of await readDirectory(reposDir)) {
       if (!entry.isDirectory || entry.name === ".git") {
         continue;
@@ -178,7 +177,7 @@ export async function collectStatus(
       if (managedPaths.has(candidatePath)) {
         continue;
       }
-      if (await exists(join(candidatePath, ".git"))) {
+      if (await pathExists(join(candidatePath, ".git"))) {
         rows.push(
           await repoStatus(
             g,
diff --git a/src/workspace-tree.ts b/src/workspace-tree.ts
index 08cc993..df6fe68 100644
--- a/src/workspace-tree.ts
+++ b/src/workspace-tree.ts
@@ -1,5 +1,5 @@
-import { exists } from "@std/fs";
 import { join, normalize, resolve } from "@std/path";
+import { pathExists } from "./runtime.ts";
 import { findExistingManifest } from "./manifest-discovery.ts";
 import { loadManifest } from "./manifest-normalize.ts";
 import {
@@ -72,8 +72,8 @@ export async function resolveWorkspaceTree(
       declaredWorkspaceNames.add(workspace.name);
 
       const checkoutPath = workspace.resolvedPath!;
-      const checkoutExists = await exists(checkoutPath);
-      if (checkoutExists && !(await exists(join(checkoutPath, ".git")))) {
+      const checkoutExists = await pathExists(checkoutPath);
+      if (checkoutExists && !(await pathExists(join(checkoutPath, ".git")))) {
         workspace.error =
           `Workspace repository "${workspace.name}" at ${checkoutPath} is not a Git repository`;
         continue;
diff --git a/tests/runtime_test.ts b/tests/runtime_test.ts
index eab4030..d8680b6 100644
--- a/tests/runtime_test.ts
+++ b/tests/runtime_test.ts
@@ -4,7 +4,7 @@ import {
   assertRejects,
   assertStringIncludes,
 } from "@std/assert";
-import { join } from "@std/path";
+import { join, relative } from "@std/path";
 import {
   currentDirectory,
   isWindows,
@@ -15,6 +15,7 @@ import {
   readTextFile,
   removePath,
   runProcess,
+  walkDirectoryTree,
   writeTextFile,
 } from "@/runtime.ts";
 
@@ -96,3 +97,142 @@ Deno.test("makeTempDirectory creates a prefixed directory under the temp root",
     await removePath(dir);
   }
 });
+
+/**
+ * A walk entry's label: its path relative to the walked root, with the root
+ * itself spelled `"."`. Separators are normalised so expectations read the
+ * same on Windows and Linux.
+ */
+function relativeLabel(root: string, path: string): string {
+  if (path === root) return ".";
+  return relative(root, path).replaceAll("\\", "/");
+}
+
+Deno.test("walkDirectoryTree returns the root, then its depth-first descendants", async () => {
+  const dir = await makeTempDirectory("wspace-runtime-test-");
+  try {
+    await makeDirectory(join(dir, "a", "sub"));
+    await makeDirectory(join(dir, "b"));
+    await writeTextFile(join(dir, "top.txt"), "top");
+    await writeTextFile(join(dir, "a", "file.txt"), "a");
+    await writeTextFile(join(dir, "a", "sub", "deep.txt"), "deep");
+
+    const entries = await walkDirectoryTree(dir, { maxDepth: 3 });
+    const seen = entries
+      .map((entry) =>
+        `${relativeLabel(dir, entry.path)}${entry.isDirectory ? "/" : ""}`
+      )
+      .sort();
+    assertEquals(seen, [
+      "./",
+      "a/",
+      "a/file.txt",
+      "a/sub/",
+      "a/sub/deep.txt",
+      "b/",
+      "top.txt",
+    ]);
+  } finally {
+    await removePath(dir);
+  }
+});
+
+Deno.test("walkDirectoryTree counts the root as depth 0 for maxDepth", async () => {
+  const dir = await makeTempDirectory("wspace-runtime-test-");
+  try {
+    await makeDirectory(join(dir, "one", "two"));
+    const depth1 = (await walkDirectoryTree(dir, {
+      maxDepth: 1,
+      includeFiles: false,
+    })).map((entry) => relativeLabel(dir, entry.path)).sort();
+    assertEquals(depth1, [".", "one"]);
+  } finally {
+    await removePath(dir);
+  }
+});
+
+Deno.test("walkDirectoryTree walks nothing for a negative maxDepth", async () => {
+  const dir = await makeTempDirectory("wspace-runtime-test-");
+  try {
+    assertEquals(await walkDirectoryTree(dir, { maxDepth: -1 }), []);
+  } finally {
+    await removePath(dir);
+  }
+});
+
+Deno.test("walkDirectoryTree does not descend into skipped directories", async () => {
+  const dir = await makeTempDirectory("wspace-runtime-test-");
+  try {
+    await makeDirectory(join(dir, "node_modules", "pkg"));
+    await writeTextFile(join(dir, "node_modules", "pkg", "index.js"), "x");
+    await makeDirectory(join(dir, "keep"));
+
+    const entries = await walkDirectoryTree(dir, { skip: [/node_modules/] });
+    assertEquals(
+      entries.map((entry) => relativeLabel(dir, entry.path)).sort(),
+      [".", "keep"],
+    );
+  } finally {
+    await removePath(dir);
+  }
+});
+
+Deno.test("walkDirectoryTree matches skip against the whole path, not the basename", async () => {
+  const dir = await makeTempDirectory("wspace-runtime-test-");
+  try {
+    await makeDirectory(join(dir, ".hidden", "inner"));
+
+    // `@std/fs/walk` tested skip patterns against the full path, and so does
+    // this. `/^\./` anchored to an absolute path therefore does not prune a
+    // dot-directory under the root; `src/commands/path.ts` relies on its depth
+    // rules for that. Pinning it here keeps a future "match the basename
+    // instead" cleanup from silently changing `wspace path`.
+    const entries = await walkDirectoryTree(dir, { skip: [/^\./] });
+    assert(
+      entries.some((entry) => entry.name === ".hidden"),
+      "a dot-directory under the root is not skipped by /^\\./",
+    );
+  } finally {
+    await removePath(dir);
+  }
+});
+
+Deno.test({
+  name:
+    "walkDirectoryTree reports a symlinked directory as a non-directory and does not follow it",
+  // Creating symlinks on Windows needs Developer Mode or elevation.
+  ignore: isWindows(),
+  fn: async () => {
+    const dir = await makeTempDirectory("wspace-runtime-test-");
+    try {
+      await makeDirectory(join(dir, "real"));
+      await writeTextFile(join(dir, "real", "inner.txt"), "x");
+      await Deno.symlink(join(dir, "real"), join(dir, "link"));
+
+      const entries = await walkDirectoryTree(dir);
+      const link = entries.find((entry) => entry.name === "link");
+      assert(link, "expected the symlink to be reported");
+      assertEquals(link.isDirectory, false);
+      assertEquals(
+        entries.some((entry) => entry.path === join(dir, "link", "inner.txt")),
+        false,
+        "the symlink must not be followed",
+      );
+    } finally {
+      await removePath(dir);
+    }
+  },
+});
+
+Deno.test("pathExists resolves false for a path that cannot be stat'd", async () => {
+  const dir = await makeTempDirectory("wspace-runtime-test-");
+  try {
+    const file = join(dir, "file.txt");
+    await writeTextFile(file, "x");
+    // A child of a regular file fails with ENOTDIR rather than NotFound, and
+    // `pathExists` still resolves rather than rejecting.
+    assertEquals(await pathExists(join(file, "child")), false);
+  } finally {
+    await removePath(dir);
+  }
+});