@wrongstack/core 0.270.0 → 0.272.1

package/dist/utils/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Context, z as ContextEvidenceState, k as ToolOutputMetadata, J as JSONSchema, M as Message, w as TodoItem } from '../context-Dp87Bcaq.js';
+import { C as Context, B as ContextEvidenceState, m as ToolOutputMetadata, J as JSONSchema, M as Message, x as TodoItem } from '../context-Dw55zZ_Q.js';
 export { H as HttpDispatcher, a as HttpsAgentAsDispatcher } from '../dispatcher-types.d-BBeXBQgS.js';
 export { toErrorMessage } from './error.js';
 export { expectDefined } from './expect-defined.js';
-import { v as CustomModelDefinition, a as ModelsDevPayload } from '../config-C_ae2k86.js';
+import { w as CustomModelDefinition, a as ModelsDevPayload } from '../config-rRS8yorV.js';
 export { T as TaskItem, c as computeTaskItemProgress, f as formatTaskList, a as formatTaskProgress } from '../task-format-vGOIftmK.js';
 export { a as WstackPathOptions, W as WstackPaths, p as projectHash, b as projectSlug, r as resolveWstackPaths, w as wstackGlobalRoot } from '../wstack-paths-hOpNLmvf.js';
 export { a as TaskPriority, b as TaskStatus, T as TaskType } from '../task-graph-u1q9Jkyk.js';
@@ -48,12 +48,25 @@ declare function withFileLock<T>(targetPath: string, fn: () => Promise<T>, opts?
  * Strategy: copy a small, explicit allowlist of variables that real builds
  * need, then copy anything else that does NOT look secret-bearing. This
  * preserves user-friendly behavior (locale, terminal, npm config) while
- * blocking the obvious leak channels.
+ * blocking the obvious leak channels. Two value-side guards back up the
+ * name-based filter:
+ *   - any value carrying an embedded URI credential (`scheme://user:pass@host`,
+ *     e.g. `DATABASE_URL`/`REDIS_URL`/`*_DSN`) is dropped (WS-01);
+ *   - `NODE_OPTIONS` is forwarded but with module-preload directives
+ *     (`--require`/`--import`/`--loader`) stripped so a parent-set value can't
+ *     inject code into node children (WS-02).
  *
  * Override with `WRONGSTACK_CHILD_ENV_PASSTHROUGH=1` to forward the full
  * parent environment unchanged (opt-in for advanced users who understand
  * the risk).
  */
+/**
+ * Strip module-preload directives from a `NODE_OPTIONS` value while preserving
+ * benign flags (`--no-warnings`, `--max-old-space-size=…`, etc.). Handles both
+ * the `--require=./x.js` and space-separated `--require ./x.js` forms. Returns
+ * the sanitized string (possibly empty).
+ */
+declare function sanitizeNodeOptions(value: string): string;
 interface BuildChildEnvOptions {
     /** Session ID to inject as WRONGSTACK_SESSION_ID. */
     sessionId?: string | undefined;
@@ -707,4 +720,4 @@ interface CompactWireToolDefinition {
 declare function compactToolDefinitionForWire(tool: ToolWireDefinitionLike, opts?: CompactToolDefinitionForWireOptions): CompactWireToolDefinition;
 declare function compactSchemaDescriptions(schema: unknown, maxDescriptionChars?: number): Record<string, unknown>;
 
-export { type AtomicWriteOptions, type BuildChildEnvOptions, type CompactToolDefinitionForWireOptions, type CompactWireToolDefinition, type CompileFail, type CompileResult, type DeepMergeOptions, FORBIDDEN_PROTO_KEYS, type FileLockOptions, type JsonObject, type JsonPath, type JsonPathSegment, type MessageRepairReport, type MessageRepairResult, type NewlineStyle, type OutputLineGuard, type RecordToolOutputEvidenceInput, type RequestTokenBreakdown, type SafeParseResult, type ToolOutputSerializerOptions, type ToolWireDefinitionLike, type UnifiedDiffOptions, type ValidationError, type ValidationResult, assertNever, assertNotPrivateHost, atomicWrite, buildChildEnv, buildContextEvidenceDigest, color, compactSchemaDescriptions, compactToolDefinitionForWire, compileGlob, compileUserRegex, completePartialObject, computeMessageTokens, createContextEvidenceState, createToolOutputSerializer, deepMerge, detectNewlineStyle, ensureDir, escapeGlobSubject, estimateMessageTokens, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, expandGlob, expandIPv6, formatTodosList, getCalibrationState, getJsonPath, getTermSize, isInteractive, isJsonObject, isPathSubjectKey, isPrimitiveArray, isPrivateIPv4, isPrivateIPv6, isStdinTTY, isStdoutTTY, jsonObjectFileExists, markAssistantReferencedEvidence, matchAny, matchGlob, mergeCustomModelDefs, mergeModelsPayload, normalizePathSubject, normalizeToLf, onResize, readJsonObjectFile, recordActualUsage, recordToolOutputEvidence, recordUserIntentEvidence, removeJsonPath, removeJsonPathInFile, repairToolUseAdjacency, repeatedReadPressure, resetCalibration, safeParse, safeStringify, sanitizeJsonString, setJsonPath, setJsonPathInFile, setOutputLineGuard, setRawMode, sleep, stripAnsi, subjectForToolInput, toStyle, truncate, unifiedDiff, updateJsonObjectFile, validateAgainstSchema, withFileLock, writeErr, writeJsonObjectFile, writeOut };
+export { type AtomicWriteOptions, type BuildChildEnvOptions, type CompactToolDefinitionForWireOptions, type CompactWireToolDefinition, type CompileFail, type CompileResult, type DeepMergeOptions, FORBIDDEN_PROTO_KEYS, type FileLockOptions, type JsonObject, type JsonPath, type JsonPathSegment, type MessageRepairReport, type MessageRepairResult, type NewlineStyle, type OutputLineGuard, type RecordToolOutputEvidenceInput, type RequestTokenBreakdown, type SafeParseResult, type ToolOutputSerializerOptions, type ToolWireDefinitionLike, type UnifiedDiffOptions, type ValidationError, type ValidationResult, assertNever, assertNotPrivateHost, atomicWrite, buildChildEnv, buildContextEvidenceDigest, color, compactSchemaDescriptions, compactToolDefinitionForWire, compileGlob, compileUserRegex, completePartialObject, computeMessageTokens, createContextEvidenceState, createToolOutputSerializer, deepMerge, detectNewlineStyle, ensureDir, escapeGlobSubject, estimateMessageTokens, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, expandGlob, expandIPv6, formatTodosList, getCalibrationState, getJsonPath, getTermSize, isInteractive, isJsonObject, isPathSubjectKey, isPrimitiveArray, isPrivateIPv4, isPrivateIPv6, isStdinTTY, isStdoutTTY, jsonObjectFileExists, markAssistantReferencedEvidence, matchAny, matchGlob, mergeCustomModelDefs, mergeModelsPayload, normalizePathSubject, normalizeToLf, onResize, readJsonObjectFile, recordActualUsage, recordToolOutputEvidence, recordUserIntentEvidence, removeJsonPath, removeJsonPathInFile, repairToolUseAdjacency, repeatedReadPressure, resetCalibration, safeParse, safeStringify, sanitizeJsonString, sanitizeNodeOptions, setJsonPath, setJsonPathInFile, setOutputLineGuard, setRawMode, sleep, stripAnsi, subjectForToolInput, toStyle, truncate, unifiedDiff, updateJsonObjectFile, validateAgainstSchema, withFileLock, writeErr, writeJsonObjectFile, writeOut };

package/dist/utils/index.js

@@ -182,6 +182,25 @@ function looksSecret(name) {
   }
   return false;
 }
+function valueHasEmbeddedCredential(value) {
+  return /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:@]*:[^/\s@]+@/i.test(value);
+}
+var NODE_OPTIONS_INJECTION_FLAG = /^(?:--require|-r|--import|--loader|--experimental-loader)$/;
+var NODE_OPTIONS_INJECTION_FLAG_EQ = /^(?:--require|-r|--import|--loader|--experimental-loader)=/;
+function sanitizeNodeOptions(value) {
+  const tokens = value.split(/\s+/).filter(Boolean);
+  const kept = [];
+  for (let i = 0; i < tokens.length; i++) {
+    const tok = tokens[i];
+    if (NODE_OPTIONS_INJECTION_FLAG_EQ.test(tok)) continue;
+    if (NODE_OPTIONS_INJECTION_FLAG.test(tok)) {
+      i++;
+      continue;
+    }
+    kept.push(tok);
+  }
+  return kept.join(" ");
+}
 function buildChildEnv(optsOrSessionId) {
   const opts = typeof optsOrSessionId === "string" ? { sessionId: optsOrSessionId } : optsOrSessionId ?? {};
   const hasOwn = Object.hasOwn(process.env, "WRONGSTACK_CHILD_ENV_PASSTHROUGH");
@@ -202,11 +221,17 @@ function buildChildEnv(optsOrSessionId) {
       continue;
     }
     const upper = k.toUpperCase();
+    if (valueHasEmbeddedCredential(v)) continue;
     if (ALLOWED_KEYS.has(upper)) {
       out[k] = v;
       continue;
     }
     if (looksSecret(upper)) continue;
+    if (upper === "NODE_OPTIONS") {
+      const sanitized = sanitizeNodeOptions(v);
+      if (sanitized) out[k] = sanitized;
+      continue;
+    }
     if (upper.startsWith("NODE_") || upper.startsWith("NPM_") || upper.startsWith("PNPM_") || upper.startsWith("YARN_") || upper.startsWith("GIT_") || upper.startsWith("CI") || upper.startsWith("XDG_") || // Our own non-secret knobs (WRONGSTACK_HOME, WRONGSTACK_SESSION_ID, …).
     // Secrets never live in WRONGSTACK_* env vars (they're in the encrypted
     // vault). Forwarding keeps child wstack processes — e.g. ones spawned
@@ -425,6 +450,9 @@ var MAX_TOOL_CALLS = 80;
 var MAX_FACTS = 40;
 var MAX_ERRORS = 20;
 var MAX_DIGEST_CHARS = 4e3;
+var RECENT_TOOL_CALL_SCAN_LIMIT = 20;
+var EXTRACT_CONTENT_CAP_CHARS = 1e4;
+var EXTRACT_ERROR_TAIL_LINES = 200;
 var WRITE_TOOLS = /* @__PURE__ */ new Set(["edit", "write", "replace", "patch"]);
 var READ_TOOLS = /* @__PURE__ */ new Set(["read", "grep", "glob", "ls", "tree"]);
 function createContextEvidenceState() {
@@ -450,8 +478,9 @@ function recordUserIntentEvidence(ctx, text) {
 }
 function recordToolOutputEvidence(ctx, input) {
   const state = ensureEvidence(ctx);
-  const files = extractFiles(ctx, input.toolName, input.input, input.content);
-  const symbols = extractSymbols(input.content, input.input);
+  const scanContent = input.content.length > EXTRACT_CONTENT_CAP_CHARS ? input.content.slice(0, EXTRACT_CONTENT_CAP_CHARS) : input.content;
+  const files = extractFiles(ctx, input.toolName, input.input, scanContent);
+  const symbols = extractSymbols(scanContent, input.input);
   const commands = extractCommands(input.toolName, input.input);
   const errors = extractErrors(input.content);
   const summary = summarizeToolOutput(input.toolName, input.input, input.content, {
@@ -494,7 +523,8 @@ function markAssistantReferencedEvidence(ctx, text) {
   const state = ensureEvidence(ctx);
   const haystack = text.toLowerCase();
   if (!haystack.trim()) return;
-  for (const tool of state.toolCalls) {
+  const recent = state.toolCalls.length > RECENT_TOOL_CALL_SCAN_LIMIT ? state.toolCalls.slice(-RECENT_TOOL_CALL_SCAN_LIMIT) : state.toolCalls;
+  for (const tool of recent) {
     if (!metadataReferencedByText(tool, haystack)) continue;
     tool.status = "referenced";
     tool.referenceCount++;
@@ -649,7 +679,8 @@ function extractCommands(toolName, input) {
   return [command.slice(0, 220)];
 }
 function extractErrors(content) {
-  const lines = content.split(/\r?\n/);
+  const allLines = content.split(/\r?\n/);
+  const lines = allLines.length > EXTRACT_ERROR_TAIL_LINES ? allLines.slice(-EXTRACT_ERROR_TAIL_LINES) : allLines;
   const errors = [];
   for (const line of lines) {
     if (!/\b(error|exception|failed|failure|fatal|panic|timeout|denied|enoent|eacces|eperm|typeerror|syntaxerror)\b/i.test(line)) continue;
@@ -1093,6 +1124,7 @@ function escapeRegex(s) {
 }
 var COMPILED_GLOB_CACHE = /* @__PURE__ */ new Map();
 var CACHE_MAX_SIZE = 2e3;
+var NEVER_MATCH = /[^\s\S]/;
 function getCachedGlob(pattern) {
   const cached = COMPILED_GLOB_CACHE.get(pattern);
   if (cached) return cached;
@@ -1102,7 +1134,12 @@ function getCachedGlob(pattern) {
       COMPILED_GLOB_CACHE.delete(expectDefined(keys[i]));
     }
   }
-  const re = compileGlob(pattern);
+  let re;
+  try {
+    re = compileGlob(pattern);
+  } catch {
+    re = NEVER_MATCH;
+  }
   COMPILED_GLOB_CACHE.set(pattern, re);
   return re;
 }
@@ -2048,18 +2085,20 @@ var MODEL_FAMILY_RATIO = {
   deepseek: 3.5
 };
 var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
+var _estimateCacheOrder = [];
 var ESTIMATE_CACHE_MAX_SIZE = 5e4;
 function getCachedEstimate(key, compute) {
   const existing = ESTIMATE_CACHE.get(key);
   if (existing !== void 0) return existing;
   if (ESTIMATE_CACHE.size >= ESTIMATE_CACHE_MAX_SIZE) {
-    for (const k of ESTIMATE_CACHE.keys()) {
-      if (ESTIMATE_CACHE.size <= Math.floor(ESTIMATE_CACHE_MAX_SIZE / 2)) break;
-      ESTIMATE_CACHE.delete(k);
+    while (ESTIMATE_CACHE.size > Math.floor(ESTIMATE_CACHE_MAX_SIZE / 2)) {
+      const oldest = _estimateCacheOrder.shift();
+      if (oldest !== void 0) ESTIMATE_CACHE.delete(oldest);
     }
   }
   const estimate = compute(key);
   ESTIMATE_CACHE.set(key, estimate);
+  _estimateCacheOrder.push(key);
   return estimate;
 }
 function estimateToolInputTokens(input) {
@@ -2925,6 +2964,6 @@ function resolveWstackPaths(opts) {
   };
 }
 
-export { FORBIDDEN_PROTO_KEYS, assertNever, assertNotPrivateHost, atomicWrite, buildChildEnv, buildContextEvidenceDigest, color, compactSchemaDescriptions, compactToolDefinitionForWire, compileGlob, compileUserRegex, completePartialObject, computeMessageTokens, computeTaskItemProgress, createContextEvidenceState, createToolOutputSerializer, deepMerge, detectNewlineStyle, ensureDir, escapeGlobSubject, estimateMessageTokens, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, expandGlob, expandIPv6, expectDefined, formatTaskList, formatTaskProgress, formatTodosList, getCalibrationState, getJsonPath, getTermSize, isInteractive, isJsonObject, isPathSubjectKey, isPrimitiveArray, isPrivateIPv4, isPrivateIPv6, isStdinTTY, isStdoutTTY, jsonObjectFileExists, markAssistantReferencedEvidence, matchAny, matchGlob, mergeCustomModelDefs, mergeModelsPayload, normalizePathSubject, normalizeToLf, onResize, projectHash, projectSlug, readJsonObjectFile, recordActualUsage, recordToolOutputEvidence, recordUserIntentEvidence, removeJsonPath, removeJsonPathInFile, repairToolUseAdjacency, repeatedReadPressure, resetCalibration, resolveWstackPaths, safeParse, safeStringify, sanitizeJsonString, setJsonPath, setJsonPathInFile, setOutputLineGuard, setRawMode, sleep, stripAnsi, subjectForToolInput, toErrorMessage, toStyle, truncate, unifiedDiff, updateJsonObjectFile, validateAgainstSchema, withFileLock, writeErr, writeJsonObjectFile, writeOut, wstackGlobalRoot };
+export { FORBIDDEN_PROTO_KEYS, assertNever, assertNotPrivateHost, atomicWrite, buildChildEnv, buildContextEvidenceDigest, color, compactSchemaDescriptions, compactToolDefinitionForWire, compileGlob, compileUserRegex, completePartialObject, computeMessageTokens, computeTaskItemProgress, createContextEvidenceState, createToolOutputSerializer, deepMerge, detectNewlineStyle, ensureDir, escapeGlobSubject, estimateMessageTokens, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, expandGlob, expandIPv6, expectDefined, formatTaskList, formatTaskProgress, formatTodosList, getCalibrationState, getJsonPath, getTermSize, isInteractive, isJsonObject, isPathSubjectKey, isPrimitiveArray, isPrivateIPv4, isPrivateIPv6, isStdinTTY, isStdoutTTY, jsonObjectFileExists, markAssistantReferencedEvidence, matchAny, matchGlob, mergeCustomModelDefs, mergeModelsPayload, normalizePathSubject, normalizeToLf, onResize, projectHash, projectSlug, readJsonObjectFile, recordActualUsage, recordToolOutputEvidence, recordUserIntentEvidence, removeJsonPath, removeJsonPathInFile, repairToolUseAdjacency, repeatedReadPressure, resetCalibration, resolveWstackPaths, safeParse, safeStringify, sanitizeJsonString, sanitizeNodeOptions, setJsonPath, setJsonPathInFile, setOutputLineGuard, setRawMode, sleep, stripAnsi, subjectForToolInput, toErrorMessage, toStyle, truncate, unifiedDiff, updateJsonObjectFile, validateAgainstSchema, withFileLock, writeErr, writeJsonObjectFile, writeOut, wstackGlobalRoot };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map