@wrongstack/core 0.89.1 → 0.104.0

package/dist/{wstack-paths-BQMvEllz.d.ts → wstack-paths-_lqjzErq.d.ts}

@@ -93,4 +93,4 @@ interface WstackPathOptions {
 }
 declare function resolveWstackPaths(opts: WstackPathOptions): WstackPaths;
 
-export { type WstackPathOptions as W, type WstackPaths as a, projectSlug as b, projectHash as p, resolveWstackPaths as r };
+export { type WstackPaths as W, type WstackPathOptions as a, projectSlug as b, projectHash as p, resolveWstackPaths as r };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/core",
-  "version": "0.89.1",
+  "version": "0.104.0",
   "license": "MIT",
   "description": "WrongStack core: kernel, types, defaults, and shared utilities for the WrongStack CLI agent.",
   "repository": {
@@ -36,6 +36,10 @@
       "types": "./dist/utils/index.d.ts",
       "import": "./dist/utils/index.js"
     },
+    "./utils/expect-defined": {
+      "types": "./dist/utils/expect-defined.d.ts",
+      "import": "./dist/utils/expect-defined.js"
+    },
     "./execution": {
       "types": "./dist/execution/index.d.ts",
       "import": "./dist/execution/index.js"

package/skills/tech-stack/SKILL.md

@@ -0,0 +1,177 @@
+---
+name: tech-stack
+description: |
+  Use this skill when choosing, installing, or recommending packages, libraries,
+  frameworks, or tooling — any decision that involves a version number or a
+  technology name. This skill enforces latest-version verification, blocks
+  dead/obsolete choices, and intervenes when the LLM hallucinates version
+  numbers or suggests 5+ year-old technology.
+  Triggers: user says "install", "package", "dependency", "upgrade",
+  "latest version", "add package", "npm install", "pnpm add", "what version",
+  "which library", "tech stack", "choose framework".
+version: 1.0.0
+---
+
+# Tech Stack Validator — WrongStack
+
+## Overview
+
+Intervening validation layer that fires before a package, library, or framework
+choice is committed. Verifies that the selected technology and version are
+current, exist in reality, and are not dead/abandoned. Runs as a single-shot
+delegate — fast, read-only, fire-and-forget.
+
+## Rules
+
+1. **Verify existence.** Before accepting a package name, search the npm registry
+   (`https://registry.npmjs.org/<package>/latest`) or the equivalent package
+   index. A package that doesn't exist in the registry is a hallucination.
+
+2. **Check latest version.** Always fetch the actual latest stable version.
+   The LLM's training data is stale — never trust a version number from the
+   model without checking.
+
+3. **Reject dead packages.** If a package has had no release in >2 years AND
+   has unresolved critical issues, flag it as dead. Suggest a maintained
+   replacement.
+
+4. **Reject prehistoric technology.** Any package/library/pattern that was
+   superseded ≥5 years ago is automatically rejected. Examples that MUST be
+   blocked:
+   - `axios`, `node-fetch`, `got` → native `fetch` (Node 18+, 2022)
+   - `request` (deprecated 2020) → native `fetch`
+   - `moment` → `date-fns`, `luxon`, or `Temporal`
+   - `left-pad` → native `String.prototype.padStart`
+   - `crypto-js` → native `Web Crypto` / `node:crypto`
+   - `jQuery` for new projects → vanilla DOM / React
+   - `Backbone`, `Ember` → React / Vue / Svelte
+   - `Gulp`, `Grunt` → `tsup`, `esbuild`, `vite`
+   - `Bower` → npm/pnpm
+   - `CoffeeScript` → TypeScript
+   - `Flow` → TypeScript
+   - `Bluebird` → native Promises
+   - `underscore` → `lodash` or native ES2020+
+   - `classnames` → `clsx` or native `classList`
+
+5. **Intervene with evidence.** When blocking a choice, output the exact phrase
+   **"This isn't code, this is X-year-old technology"** with:
+   - The actual age (X = current year − release year)
+   - What superseded it
+   - A concrete migration path (one package, one import change)
+
+6. **Prefer built-in over third-party.** Every Node.js LTS release adds native
+   APIs that obsolete packages. Check Node 22+ built-ins before suggesting an
+   npm package:
+   - `node:test` over `jest`/`mocha` (for new projects)
+   - `node:sqlite` over `better-sqlite3` (Node 22.5+)
+   - `fetch`, `WebSocket`, `Web Crypto`, `AbortController`, `EventTarget` —
+     all native, no packages needed
+
+7. **Single-shot budget.** This agent is not for deep analysis — it should
+   complete in 1–2 iterations. Search → verify → report. Do not recursively
+   analyze transitive dependencies.
+
+## Patterns
+
+### Do
+
+```
+User: "Add axios for API calls"
+Agent: ❌ REJECTED
+"This isn't code, this is 10-year-old technology."
+axios was released in 2014. Node.js 18+ (2022) includes native fetch with
+AbortSignal.timeout(), streaming, and FormData. No package needed.
+→ Use: `const res = await fetch(url, { signal: AbortSignal.timeout(5000) })`
+```
+
+```
+User: "What version of React should we use?"
+Agent: ✅ React 19.2.1 (latest stable as of 2026-06-08)
+Verified via npm registry. React 19 includes Server Components,
+use() hook, and ref-as-prop. Pin to ^19.2.0 for semver safety.
+```
+
+```
+User: "Install typescript"
+Agent: ✅ TypeScript 5.9.3 (latest stable)
+Verified via npm registry. Use `^5.9.0` to receive patch updates.
+```
+
+### Don't
+
+```
+// ❌ Trusting the LLM's stale training data
+Agent: "Use React 18.3.1 — it's the latest stable."
+// WRONG — React 19 has been stable since Dec 2024. Check npm.
+
+// ❌ Suggesting axios without challenge
+Agent: "npm install axios" — no justification, no fetch alternative mentioned.
+
+// ❌ Accepting a package that doesn't exist
+Agent: "Install @anthropic/sdk version 2.0.0" — verify this version exists first.
+
+// ❌ Suggesting moment.js
+Agent: "Use moment for date formatting" — moment is legacy. Suggest date-fns or Temporal.
+```
+
+## Workflow
+
+```
+1. Receive  — Package name + proposed version (or "latest")
+2. Search   — npm registry: https://registry.npmjs.org/<pkg>/latest
+              OR web search: "<package> latest version npm 2026"
+3. Verify   — Does the package exist? Is the version real?
+4. Audit    — Age check. Last release date > 2 years? Dead?
+              Prehistoric check. Was it superseded ≥5 years ago?
+5. Report   — APPROVED (with latest version) or REJECTED (with replacement)
+              Use the exact phrase "This isn't code, this is X-year-old technology"
+              when rejecting on age grounds.
+```
+
+## Version checking — web sources
+
+When checking a package version, search in this order:
+1. **npm registry**: `fetch('https://registry.npmjs.org/<package>/latest')` → `version` field
+2. **npm API**: `fetch('https://api.npmjs.org/versions/<package>/last-week')`
+3. **Web search**: `"<package> latest version 2026 npm"` on DuckDuckGo/Google
+4. **GitHub releases**: `fetch('https://api.github.com/repos/<owner>/<repo>/releases/latest')`
+
+## Dead package criteria
+
+| Signal | Threshold | Action |
+|--------|-----------|--------|
+| No release | >2 years | Flag + check for replacement |
+| No release + critical CVEs | >1 year | REJECT automatically |
+| Deprecated on npm | Any | REJECT + suggest replacement |
+| Repository archived | Any | REJECT + suggest replacement |
+| <100 weekly downloads | Any | WARN + suggest more popular alternative |
+
+## Output format
+
+```
+### Tech Stack Validation — <package>
+
+**Status**: APPROVED | REJECTED | NEEDS_INVESTIGATION
+
+**Package**: <name>@<version>
+**Source**: <npm registry / GitHub / web search — cite the URL>
+**Age**: <first release year> — <last release date>
+**Verdict**: 1–2 sentence explanation.
+
+When REJECTED:
+**"This isn't code, this is X-year-old technology."**
+**Replaced by**: <modern alternative>
+**Migration**: <one concrete step>
+
+When APPROVED:
+**Install**: `pnpm add <name>@^<major>.<minor>.0`
+**Note**: <any caveats about the version>
+```
+
+## Skills in scope
+
+- `node-modern` — for Node.js built-in vs. third-party decisions
+- `react-modern` — for React version checks
+- `typescript-strict` — for TypeScript version alignment
+- `security-scanner` — for packages with known CVEs
+- `docker-deploy` — for base image version pinning

package/dist/memory-CEXuo7sz.d.ts

@@ -1,16 +0,0 @@
-type MemoryScope = 'project-agents' | 'project-memory' | 'user-memory';
-interface MemoryEntry {
-    scope: MemoryScope;
-    text: string;
-    ts: string;
-}
-interface MemoryStore {
-    readAll(): Promise<string>;
-    read(scope: MemoryScope): Promise<string>;
-    remember(text: string, scope?: MemoryScope): Promise<void>;
-    forget(query: string, scope?: MemoryScope): Promise<number>;
-    consolidate(scope: MemoryScope): Promise<void>;
-    clear(scope?: MemoryScope): Promise<void>;
-}
-
-export type { MemoryEntry as M, MemoryScope as a, MemoryStore as b };

package/dist/secret-scrubber-3MHDDAtm.d.ts

@@ -1,6 +0,0 @@
-interface SecretScrubber {
-    scrub(text: string): string;
-    scrubObject<T>(obj: T): T;
-}
-
-export type { SecretScrubber as S };

package/dist/task-graph-CikNdRTG.d.ts

@@ -1,161 +0,0 @@
-type SpecStatus = 'draft' | 'review' | 'approved' | 'implemented' | 'deprecated';
-type SpecSectionType = 'overview' | 'requirements' | 'architecture' | 'api' | 'data' | 'security' | 'acceptance';
-interface SpecSection {
-    type: SpecSectionType;
-    title: string;
-    content: string;
-    level: number;
-    children?: SpecSection[] | undefined;
-}
-interface SpecRequirement {
-    id: string;
-    type: 'functional' | 'non-functional' | 'security' | 'performance' | 'ux';
-    priority: 'critical' | 'high' | 'medium' | 'low';
-    description: string;
-    acceptanceCriteria: string[];
-    blockedBy?: string[] | undefined;
-    implements?: string[] | undefined;
-}
-interface SpecApiEndpoint {
-    method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
-    path: string;
-    description: string;
-    request?: Record<string, unknown>;
-    response?: Record<string, unknown>;
-    auth?: boolean | undefined;
-}
-interface Specification {
-    id: string;
-    title: string;
-    version: string;
-    status: SpecStatus;
-    overview: string;
-    sections: SpecSection[];
-    requirements: SpecRequirement[];
-    apiEndpoints?: SpecApiEndpoint[] | undefined;
-    dependencies?: string[] | undefined;
-    createdAt: number;
-    updatedAt: number;
-    metadata?: Record<string, unknown>;
-}
-interface SpecAnalysis {
-    specId: string;
-    completeness: number;
-    coverage: {
-        requirements: number;
-        apiEndpoints: number;
-        edgeCases: number;
-        errorHandling: number;
-    };
-    gaps: string[];
-    risks: {
-        requirement: string;
-        risk: string;
-        severity: 'high' | 'medium' | 'low';
-    }[];
-    suggestions: string[];
-}
-interface SpecValidationResult {
-    valid: boolean;
-    errors: {
-        path: string;
-        message: string;
-    }[];
-    warnings: {
-        path: string;
-        message: string;
-    }[];
-}
-interface SpecTemplate {
-    id: string;
-    name: string;
-    description: string;
-    sections: Omit<SpecSection, 'content'>[];
-    defaultRequirements: Omit<SpecRequirement, 'id' | 'description'>[];
-}
-declare const DEFAULT_SPEC_TEMPLATE: SpecTemplate;
-
-type TaskStatus = 'pending' | 'in_progress' | 'blocked' | 'failed' | 'review' | 'completed';
-type TaskPriority = 'critical' | 'high' | 'medium' | 'low';
-type TaskType = 'feature' | 'bugfix' | 'refactor' | 'docs' | 'test' | 'chore';
-interface TaskNode {
-    id: string;
-    title: string;
-    description: string;
-    type: TaskType;
-    priority: TaskPriority;
-    status: TaskStatus;
-    assignee?: string | undefined;
-    estimateHours?: number | undefined;
-    actualHours?: number | undefined;
-    tags?: string[] | undefined;
-    specRequirementId?: string | undefined;
-    parentId?: string | undefined;
-    children?: string[] | undefined;
-    createdAt: number;
-    updatedAt: number;
-    startedAt?: number | undefined;
-    completedAt?: number | undefined;
-    metadata?: Record<string, unknown>;
-}
-interface TaskEdge {
-    id: string;
-    from: string;
-    to: string;
-    type: 'blocks' | 'depends_on' | 'relates_to' | 'implements';
-    weight?: number | undefined;
-}
-interface TaskGraph {
-    id: string;
-    specId: string;
-    title: string;
-    nodes: Map<string, TaskNode>;
-    edges: TaskEdge[];
-    rootNodes: string[];
-    createdAt: number;
-    updatedAt: number;
-}
-interface TaskDependency {
-    taskId: string;
-    blockedBy: string[];
-    blocking: string[];
-}
-interface TaskAssignment {
-    taskId: string;
-    assignee: string;
-    assignedAt: number;
-}
-interface TaskProgress {
-    total: number;
-    pending: number;
-    inProgress: number;
-    blocked: number;
-    failed: number;
-    review: number;
-    completed: number;
-    percentComplete: number;
-    estimatedHours: number;
-    actualHours: number;
-}
-interface TaskFilter {
-    status?: TaskStatus[] | undefined;
-    priority?: TaskPriority[] | undefined;
-    type?: TaskType[] | undefined;
-    assignee?: string[] | undefined;
-    tags?: string[] | undefined;
-    specRequirementId?: string | undefined;
-}
-interface TaskSort {
-    field: 'priority' | 'createdAt' | 'updatedAt' | 'status';
-    direction: 'asc' | 'desc';
-}
-interface CriticalPathResult {
-    taskIds: string[];
-    totalEstimateHours: number;
-    bottleneckTasks: string[];
-}
-declare function computeTaskProgress(graph: TaskGraph): TaskProgress;
-declare function findCriticalPath(graph: TaskGraph): CriticalPathResult;
-declare function topologicalSort(graph: TaskGraph): string[];
-
-export { type CriticalPathResult as C, DEFAULT_SPEC_TEMPLATE as D, type SpecAnalysis as S, type TaskAssignment as T, type SpecApiEndpoint as a, type SpecRequirement as b, type SpecSection as c, type SpecSectionType as d, type SpecStatus as e, type SpecTemplate as f, type SpecValidationResult as g, type Specification as h, type TaskDependency as i, type TaskEdge as j, type TaskFilter as k, type TaskGraph as l, type TaskNode as m, type TaskPriority as n, type TaskProgress as o, type TaskSort as p, type TaskStatus as q, type TaskType as r, computeTaskProgress as s, findCriticalPath as t, topologicalSort as u };