@wrongstack/cli 1.0.19 → 1.0.24

package/dist/{chunk-SIS37L3W.js → chunk-L2RVEQWO.js}

@@ -1,3 +1,6 @@
+import {
+  backupCurrent
+} from "./chunk-WSTVGC2C.js";
 
 // src/wiring/external-plugins.ts
 import { isAbsolute, join, resolve } from "node:path";
@@ -329,10 +332,8 @@ async function hashPluginClosure(entryPath) {
 }
 
 // src/plugin-management.ts
-import { execFile } from "node:child_process";
-import * as fs from "node:fs/promises";
-import { homedir } from "node:os";
-import { join as join2 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { join as join4 } from "node:path";
 import {
   defaultPluginTrustPath as defaultPluginTrustPath2,
   discoverExternalPlugins as discoverExternalPlugins2,
@@ -344,11 +345,213 @@ import {
   resolvePluginTarget as resolvePluginTarget2,
   unpinPluginTrust
 } from "@wrongstack/core/plugin";
-import { atomicWrite, buildChildEnv } from "@wrongstack/core/utils";
+import { atomicWrite } from "@wrongstack/core/utils";
 import {
   PLUGIN_AUDIT_ENTRIES
 } from "@wrongstack/plugins/plugin-audit-catalog";
+
+// src/plugin-config.ts
+import * as fs from "node:fs/promises";
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+import { updateJsonObjectFile } from "@wrongstack/core/utils";
+async function readConfig(file) {
+  try {
+    return JSON.parse(await fs.readFile(file, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function pluginName(p) {
+  return typeof p === "string" ? p : p.name;
+}
+function pluginEntry(spec, enabled, path) {
+  if (path !== void 0) return { name: spec, path, enabled };
+  return enabled ? spec : { name: spec, enabled: false };
+}
+async function upsertPlugin(spec, opts, deps, verb) {
+  let plugins = [];
+  let features = {};
+  await updateJsonObjectFile(deps.configPath, async (existing) => {
+    await backupCurrent(void 0, deps.configPath);
+    plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
+    const idx = plugins.findIndex((p) => pluginName(p) === spec);
+    const nextEntry = pluginEntry(spec, opts.enabled, opts.path);
+    if (idx >= 0) plugins[idx] = nextEntry;
+    else plugins.push(nextEntry);
+    features = {
+      ...isRecord(deps.config.features) ? deps.config.features : {},
+      ...isRecord(existing.features) ? existing.features : {},
+      plugins: true
+    };
+    existing.plugins = plugins;
+    existing.features = features;
+  });
+  const restartRequired = spec === "branch-guard" && !opts.enabled ? void 0 : true;
+  return {
+    code: 0,
+    level: "info",
+    message: `${verb} "${spec}" (${opts.enabled ? "enabled" : "disabled"}). Config written to ${deps.configPath}.` + (spec === "branch-guard" && !opts.enabled ? " The running branch-guard hook will disable itself on config update." : ""),
+    patch: { plugins, features },
+    restartRequired
+  };
+}
+function errorResult(message) {
+  return { code: 1, level: "error", message };
+}
+function globalPluginsRoot(deps) {
+  return join2(deps.globalRoot ?? join2(homedir(), ".wrongstack"), "plugins");
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/plugin-package-install.ts
+import { execFile } from "node:child_process";
+import * as fs2 from "node:fs/promises";
+import { join as join3 } from "node:path";
+import { buildChildEnv } from "@wrongstack/core/utils";
 import { resolveExecInvocation } from "@wrongstack/plugins/runtime";
+function detectPackageManager(args) {
+  const override = args.find((a) => a.startsWith("--pm="));
+  if (override) {
+    const pm = override.slice(5);
+    if (pm === "npm" || pm === "pnpm" || pm === "yarn" || pm === "bun") return pm;
+  }
+  const idx = args.indexOf("--pm");
+  if (idx >= 0 && args[idx + 1]) {
+    const pm = args[idx + 1];
+    if (pm === "npm" || pm === "pnpm" || pm === "yarn" || pm === "bun") return pm;
+  }
+  const ua = process.env.npm_config_user_agent ?? "";
+  if (ua.startsWith("pnpm")) return "pnpm";
+  if (ua.startsWith("yarn")) return "yarn";
+  if (ua.startsWith("bun")) return "bun";
+  return "npm";
+}
+function packageNameFromSpec(spec) {
+  const stripped = spec.trim();
+  if (stripped.startsWith("@")) {
+    const scopedEnd = stripped.indexOf("/", 1);
+    if (scopedEnd === -1) return stripped.split("@")[0] ?? stripped;
+    const rest = stripped.slice(scopedEnd + 1);
+    const at2 = rest.lastIndexOf("@");
+    return at2 === -1 ? stripped : stripped.slice(0, scopedEnd + 1 + at2);
+  }
+  const at = stripped.indexOf("@");
+  return at === -1 ? stripped : stripped.slice(0, at);
+}
+function buildInstallArgs(pm, targetDir, runScripts, spec) {
+  const ignoreScripts = runScripts ? [] : ["--ignore-scripts"];
+  switch (pm) {
+    case "pnpm":
+      return ["add", "--dir", targetDir, ...ignoreScripts, spec];
+    case "yarn":
+      return ["add", "--cwd", targetDir, ...ignoreScripts, spec];
+    case "bun":
+      return ["add", "--cwd", targetDir, ...ignoreScripts, spec];
+    default:
+      return ["install", "--prefix", targetDir, "--no-audit", "--no-fund", ...ignoreScripts, spec];
+  }
+}
+function runPackageManagerInstall(pm, args, cwd) {
+  return new Promise((resolvePromise) => {
+    let invocation;
+    try {
+      invocation = resolveExecInvocation(pm, args);
+    } catch (err) {
+      resolvePromise({
+        code: 127,
+        stdout: "",
+        stderr: err instanceof Error ? err.message : String(err)
+      });
+      return;
+    }
+    execFile(
+      invocation.cmd,
+      invocation.args,
+      {
+        cwd,
+        // H-8 (security report VF-09): this runs npm/pnpm install — including
+        // untrusted package lifecycle scripts — with the full inherited
+        // environment. Strip credentials via the shared child env.
+        env: buildChildEnv(),
+        timeout: 3e5,
+        maxBuffer: 16 * 1024 * 1024,
+        windowsHide: true,
+        ...invocation.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
+      },
+      (err, stdout, stderr) => {
+        const code = err ? err.code ?? 1 : 0;
+        resolvePromise({
+          code: typeof code === "number" ? code : 1,
+          stdout: typeof stdout === "string" ? stdout : "",
+          stderr: typeof stderr === "string" ? stderr : ""
+        });
+      }
+    );
+  });
+}
+async function installPluginPackage(spec, args, deps) {
+  const pm = detectPackageManager(args);
+  const runScripts = args.includes("--run-scripts");
+  const targetDir = globalPluginsRoot(deps);
+  try {
+    await fs2.mkdir(targetDir, { recursive: true });
+    const pkgJsonPath = join3(targetDir, "package.json");
+    try {
+      await fs2.access(pkgJsonPath);
+    } catch {
+      await fs2.writeFile(
+        pkgJsonPath,
+        `${JSON.stringify({ name: "wrongstack-user-plugins", private: true, version: "0.0.0" }, null, 2)}
+`,
+        "utf8"
+      );
+    }
+  } catch (err) {
+    return errorResult(
+      `Could not prepare plugin directory ${targetDir}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const run = deps.runPackageManager ?? runPackageManagerInstall;
+  const pmArgs = buildInstallArgs(pm, targetDir, runScripts, spec);
+  let result;
+  try {
+    result = await run(pm, pmArgs, targetDir);
+  } catch (err) {
+    return errorResult(
+      `${pm} failed to start: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (result.code !== 0) {
+    const tail = (result.stderr || result.stdout).trim().split("\n").slice(-8).join("\n");
+    return errorResult(`${pm} ${pmArgs.join(" ")} failed (exit ${result.code}):
+${tail}`);
+  }
+  const pkgName = packageNameFromSpec(spec);
+  const installPath = join3(targetDir, "node_modules", ...pkgName.split("/"));
+  try {
+    await fs2.access(installPath);
+  } catch {
+    return errorResult(
+      `${pm} reported success but "${installPath}" does not exist \u2014 check the package name "${pkgName}".`
+    );
+  }
+  const upsert = await upsertPlugin(
+    pkgName,
+    { enabled: !args.includes("--disabled"), path: installPath },
+    deps,
+    "Installed"
+  );
+  if (upsert.code !== 0) return upsert;
+  return {
+    ...upsert,
+    message: `${upsert.message} Loaded from ${installPath}. It will be trusted (pinned) on first load.` + (runScripts ? "" : " Install scripts were skipped (default --ignore-scripts; pass --run-scripts if the package needs build steps).")
+  };
+}
+
+// src/plugin-management.ts
 var OFFICIAL_PLUGINS = [
   {
     alias: "telegram",
@@ -696,20 +899,6 @@ function renderPluginAuditReport(config) {
   );
   return lines.join("\n");
 }
-async function readConfig(file) {
-  try {
-    return JSON.parse(await fs.readFile(file, "utf8"));
-  } catch {
-    return {};
-  }
-}
-function pluginName(p) {
-  return typeof p === "string" ? p : p.name;
-}
-function pluginEntry(spec, enabled, path) {
-  if (path !== void 0) return { name: spec, path, enabled };
-  return enabled ? spec : { name: spec, enabled: false };
-}
 function pluginMatchesToggleSpec(p, spec) {
   const name = pluginName(p);
   if (spec === "telegram") return name === "telegram" || name === "@wrongstack/telegram";
@@ -808,30 +997,6 @@ async function togglePlugin(spec, deps) {
     restartRequired
   };
 }
-async function upsertPlugin(spec, opts, deps, verb) {
-  const existing = await readConfig(deps.configPath);
-  const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
-  const idx = plugins.findIndex((p) => pluginName(p) === spec);
-  const nextEntry = pluginEntry(spec, opts.enabled, opts.path);
-  if (idx >= 0) plugins[idx] = nextEntry;
-  else plugins.push(nextEntry);
-  const features = {
-    ...isRecord(deps.config.features) ? deps.config.features : {},
-    ...isRecord(existing.features) ? existing.features : {},
-    plugins: true
-  };
-  existing.plugins = plugins;
-  existing.features = features;
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
-  const restartRequired = spec === "branch-guard" && !opts.enabled ? void 0 : true;
-  return {
-    code: 0,
-    level: "info",
-    message: `${verb} "${spec}" (${opts.enabled ? "enabled" : "disabled"}). Config written to ${deps.configPath}.` + (spec === "branch-guard" && !opts.enabled ? " The running branch-guard hook will disable itself on config update." : ""),
-    patch: { plugins, features },
-    restartRequired
-  };
-}
 async function removePlugin(spec, deps) {
   const existing = await readConfig(deps.configPath);
   const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
@@ -849,12 +1014,6 @@ async function removePlugin(spec, deps) {
     restartRequired: true
   };
 }
-function errorResult(message) {
-  return { code: 1, level: "error", message };
-}
-function globalPluginsRoot(deps) {
-  return join2(deps.globalRoot ?? join2(homedir(), ".wrongstack"), "plugins");
-}
 async function resolveExternalPluginEntry(name, deps) {
   const projectRoot = process.cwd();
   for (const p of deps.config.plugins ?? []) {
@@ -866,7 +1025,7 @@ async function resolveExternalPluginEntry(name, deps) {
   }
   const { candidates } = await discoverExternalPlugins2([
     globalPluginsRoot(deps),
-    join2(projectRoot, ".wrongstack", "plugins")
+    join4(projectRoot, ".wrongstack", "plugins")
   ]);
   const discovered = candidates.find((c) => c.name === name);
   if (discovered) return discovered.entryPath;
@@ -886,7 +1045,7 @@ var PLUGIN_TRUST_USAGE = [
   "  wstack plugin trust <name> --remove       Drop the pin (plugin re-trusts on next load)."
 ].join("\n");
 async function runPluginTrustCommand(args, deps) {
-  const storePath = defaultPluginTrustPath2(join2(deps.globalRoot ?? join2(homedir(), ".wrongstack")));
+  const storePath = defaultPluginTrustPath2(join4(deps.globalRoot ?? join4(homedir2(), ".wrongstack")));
   const positional = args.filter((a) => !a.startsWith("--"));
   const name = positional[0];
   const remove = args.includes("--remove") || args.includes("--unpin");
@@ -944,151 +1103,10 @@ async function runPluginTrustCommand(args, deps) {
     message: `Re-pinned "${name}" \u2192 ${integrity.slice(0, 19)}\u2026 (${canonical}).`
   };
 }
-function detectPackageManager(args) {
-  const override = args.find((a) => a.startsWith("--pm="));
-  if (override) {
-    const pm = override.slice(5);
-    if (pm === "npm" || pm === "pnpm" || pm === "yarn" || pm === "bun") return pm;
-  }
-  const idx = args.indexOf("--pm");
-  if (idx >= 0 && args[idx + 1]) {
-    const pm = args[idx + 1];
-    if (pm === "npm" || pm === "pnpm" || pm === "yarn" || pm === "bun") return pm;
-  }
-  const ua = process.env.npm_config_user_agent ?? "";
-  if (ua.startsWith("pnpm")) return "pnpm";
-  if (ua.startsWith("yarn")) return "yarn";
-  if (ua.startsWith("bun")) return "bun";
-  return "npm";
-}
-function packageNameFromSpec(spec) {
-  const stripped = spec.trim();
-  if (stripped.startsWith("@")) {
-    const scopedEnd = stripped.indexOf("/", 1);
-    if (scopedEnd === -1) return stripped.split("@")[0] ?? stripped;
-    const rest = stripped.slice(scopedEnd + 1);
-    const at2 = rest.lastIndexOf("@");
-    return at2 === -1 ? stripped : stripped.slice(0, scopedEnd + 1 + at2);
-  }
-  const at = stripped.indexOf("@");
-  return at === -1 ? stripped : stripped.slice(0, at);
-}
-function buildInstallArgs(pm, targetDir, runScripts, spec) {
-  const ignoreScripts = runScripts ? [] : ["--ignore-scripts"];
-  switch (pm) {
-    case "pnpm":
-      return ["add", "--dir", targetDir, ...ignoreScripts, spec];
-    case "yarn":
-      return ["add", "--cwd", targetDir, ...ignoreScripts, spec];
-    case "bun":
-      return ["add", "--cwd", targetDir, ...ignoreScripts, spec];
-    default:
-      return ["install", "--prefix", targetDir, "--no-audit", "--no-fund", ...ignoreScripts, spec];
-  }
-}
-function runPackageManagerInstall(pm, args, cwd) {
-  return new Promise((resolvePromise) => {
-    let invocation;
-    try {
-      invocation = resolveExecInvocation(pm, args);
-    } catch (err) {
-      resolvePromise({
-        code: 127,
-        stdout: "",
-        stderr: err instanceof Error ? err.message : String(err)
-      });
-      return;
-    }
-    execFile(
-      invocation.cmd,
-      invocation.args,
-      {
-        cwd,
-        // H-8 (security report VF-09): this runs npm/pnpm install — including
-        // untrusted package lifecycle scripts — with the full inherited
-        // environment. Strip credentials via the shared child env.
-        env: buildChildEnv(),
-        timeout: 3e5,
-        maxBuffer: 16 * 1024 * 1024,
-        windowsHide: true,
-        ...invocation.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
-      },
-      (err, stdout, stderr) => {
-        const code = err ? err.code ?? 1 : 0;
-        resolvePromise({
-          code: typeof code === "number" ? code : 1,
-          stdout: typeof stdout === "string" ? stdout : "",
-          stderr: typeof stderr === "string" ? stderr : ""
-        });
-      }
-    );
-  });
-}
-async function installPluginPackage(spec, args, deps) {
-  const pm = detectPackageManager(args);
-  const runScripts = args.includes("--run-scripts");
-  const targetDir = globalPluginsRoot(deps);
-  try {
-    await fs.mkdir(targetDir, { recursive: true });
-    const pkgJsonPath = join2(targetDir, "package.json");
-    try {
-      await fs.access(pkgJsonPath);
-    } catch {
-      await fs.writeFile(
-        pkgJsonPath,
-        `${JSON.stringify({ name: "wrongstack-user-plugins", private: true, version: "0.0.0" }, null, 2)}
-`,
-        "utf8"
-      );
-    }
-  } catch (err) {
-    return errorResult(
-      `Could not prepare plugin directory ${targetDir}: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  const run = deps.runPackageManager ?? runPackageManagerInstall;
-  const pmArgs = buildInstallArgs(pm, targetDir, runScripts, spec);
-  let result;
-  try {
-    result = await run(pm, pmArgs, targetDir);
-  } catch (err) {
-    return errorResult(
-      `${pm} failed to start: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  if (result.code !== 0) {
-    const tail = (result.stderr || result.stdout).trim().split("\n").slice(-8).join("\n");
-    return errorResult(`${pm} ${pmArgs.join(" ")} failed (exit ${result.code}):
-${tail}`);
-  }
-  const pkgName = packageNameFromSpec(spec);
-  const installPath = join2(targetDir, "node_modules", ...pkgName.split("/"));
-  try {
-    await fs.access(installPath);
-  } catch {
-    return errorResult(
-      `${pm} reported success but "${installPath}" does not exist \u2014 check the package name "${pkgName}".`
-    );
-  }
-  const upsert = await upsertPlugin(
-    pkgName,
-    { enabled: !args.includes("--disabled"), path: installPath },
-    deps,
-    "Installed"
-  );
-  if (upsert.code !== 0) return upsert;
-  return {
-    ...upsert,
-    message: `${upsert.message} Loaded from ${installPath}. It will be trusted (pinned) on first load.` + (runScripts ? "" : " Install scripts were skipped (default --ignore-scripts; pass --run-scripts if the package needs build steps).")
-  };
-}
-function isRecord(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
 
 export {
   loadExternalPlugins,
   PLUGIN_AUDIT_ENTRIES,
   runPluginManagementCommand
 };
-//# sourceMappingURL=chunk-SIS37L3W.js.map
+//# sourceMappingURL=chunk-L2RVEQWO.js.map