@wrongstack/plugin-sdk 0.308.7

package/dist/runtime.js

@@ -0,0 +1,1004 @@
+// src/runtime/index.ts
+import { execFile } from "node:child_process";
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { basename, extname as extname2, isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3 } from "node:path";
+
+// src/runtime/llm.ts
+function stripOuterMarkdownFence(text) {
+  const trimmed = text.trim();
+  const match = trimmed.match(/^```(?:[a-z0-9_-]+)?\s*\r?\n([\s\S]*?)\r?\n```$/i);
+  return (match?.[1] ?? trimmed).trim();
+}
+function parseLlmJsonObject(text) {
+  const candidate = stripOuterMarkdownFence(text);
+  try {
+    const parsed = JSON.parse(candidate);
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function runOptionalPluginLlm(request) {
+  if (!request.requested) {
+    return { used: false, value: null, fallbackReason: "not-requested" };
+  }
+  if (!request.api.llm) {
+    return { used: false, value: null, fallbackReason: "unavailable" };
+  }
+  if (request.options?.signal?.aborted) {
+    return { used: false, value: null, fallbackReason: "cancelled" };
+  }
+  try {
+    const response = await request.api.llm.complete(request.prompt, request.options);
+    const parsed = request.parse(response.text);
+    if (parsed === null) {
+      request.api.log.warn(`${request.label}: ignored invalid LLM response`);
+      return { used: false, value: null, fallbackReason: "invalid-response" };
+    }
+    return { used: true, value: parsed, fallbackReason: null };
+  } catch (error) {
+    const cancelled = request.options?.signal?.aborted === true;
+    request.api.log.warn(`${request.label}: LLM enrichment failed; using deterministic fallback`, {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return {
+      used: false,
+      value: null,
+      fallbackReason: cancelled ? "cancelled" : "provider-error"
+    };
+  }
+}
+async function runOptionalPluginCouncil(request) {
+  if (!request.requested) {
+    return { used: false, value: null, fallbackReason: "not-requested" };
+  }
+  if (request.options?.signal?.aborted) {
+    return { used: false, value: null, fallbackReason: "cancelled" };
+  }
+  const council = request.api.llm?.council;
+  if (council) {
+    try {
+      const result = await council(request.prompt, {
+        ...request.context ? { context: request.context } : {},
+        ...request.profile ? { profile: request.profile } : {},
+        ...request.councilOptions ? { options: request.councilOptions } : {},
+        ...request.options?.signal ? { signal: request.options.signal } : {}
+      });
+      if (result.status === "cancelled") {
+        return { used: false, value: null, fallbackReason: "cancelled" };
+      }
+      const parsed = result.status === "decided" ? request.parse(result.answer ?? "") : null;
+      if (parsed !== null) return { used: true, value: parsed, fallbackReason: null };
+      request.api.log.warn(
+        `${request.label}: Council did not return a valid answer; trying One Shot`,
+        {
+          status: result.status,
+          resolution: result.resolution
+        }
+      );
+    } catch (error) {
+      if (request.options?.signal?.aborted) {
+        return { used: false, value: null, fallbackReason: "cancelled" };
+      }
+      request.api.log.warn(`${request.label}: Council failed; trying One Shot`, {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return runOptionalPluginLlm(request);
+}
+
+// src/runtime/local-bin.ts
+import { createRequire } from "node:module";
+import { delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { accessSync, constants, readFileSync } from "node:fs";
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+function resolveExecInvocation(command, args = []) {
+  const resolved = resolveWin32Command(command);
+  const normalizedResolved = resolved.toLowerCase();
+  const needsShell = process.platform === "win32" && (normalizedResolved.endsWith(".cmd") || normalizedResolved.endsWith(".bat"));
+  if (needsShell) {
+    const shim = buildWin32CmdShimInvocation(resolved, args);
+    return { cmd: shim.command, args: shim.args, windowsVerbatimArguments: true };
+  }
+  return { cmd: resolved, args: [...args], windowsVerbatimArguments: false };
+}
+function findOnPath(cmd) {
+  if (!cmd) return null;
+  const exists = (p) => {
+    try {
+      accessSync(p, constants.X_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  if (cmd.includes("/") || cmd.includes("\\")) {
+    return exists(cmd) ? resolve(cmd) : null;
+  }
+  const suffixes = process.platform === "win32" && extname(cmd) === "" ? (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  for (const dir of (process.env["PATH"] ?? "").split(delimiter)) {
+    if (!dir) continue;
+    const base = join(dir, cmd);
+    for (const suffix of suffixes) {
+      const candidate = `${base}${suffix}`;
+      if (exists(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+function isInside(parent, candidate) {
+  const rel = relative(parent, candidate);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel);
+}
+var binCache = /* @__PURE__ */ new Map();
+var BIN_CACHE_MAX = 64;
+var NEGATIVE_BIN_CACHE_TTL_MS = 5e3;
+function cachePut(key, value) {
+  while (binCache.size >= BIN_CACHE_MAX) {
+    const oldest = binCache.keys().next().value;
+    if (oldest === void 0) break;
+    binCache.delete(oldest);
+  }
+  binCache.set(key, { value, cachedAt: Date.now() });
+  return value;
+}
+function clearLocalBinCache() {
+  binCache.clear();
+}
+function resolveNodeBin(packageName, binName, cwd, extraArgs = []) {
+  const key = `${packageName}|${binName}|${cwd}`;
+  const cached = binCache.get(key);
+  if (cached !== void 0) {
+    if (cached.value !== null || Date.now() - cached.cachedAt < NEGATIVE_BIN_CACHE_TTL_MS) {
+      return cached.value === null ? null : { ...cached.value, args: [cached.value.entry, ...extraArgs] };
+    }
+    binCache.delete(key);
+  }
+  let resolved = null;
+  try {
+    const requireFromProject = createRequire(resolve(cwd, "package.json"));
+    const packagePath = requireFromProject.resolve(`${packageName}/package.json`);
+    const packageJson = JSON.parse(readFileSync(packagePath, "utf-8"));
+    const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[binName] ?? Object.values(packageJson.bin ?? {})[0];
+    if (relativeBin && !isAbsolute(relativeBin)) {
+      const packageDir = dirname(packagePath);
+      const entry = resolve(packageDir, relativeBin);
+      if (isInside(packageDir, entry)) {
+        resolved = { cmd: process.execPath, args: [entry], entry };
+      }
+    }
+  } catch {
+    resolved = null;
+  }
+  cachePut(key, resolved);
+  return resolved === null ? null : { ...resolved, args: [resolved.entry, ...extraArgs] };
+}
+function resolveFirstNodeBin(candidates, cwd) {
+  for (const c of candidates) {
+    const hit = resolveNodeBin(c.packageName, c.binName, cwd, c.args ?? []);
+    if (hit) return { ...hit, packageName: c.packageName, binName: c.binName };
+  }
+  return null;
+}
+
+// src/runtime/bounded-map.ts
+var BoundedMap = class {
+  map = /* @__PURE__ */ new Map();
+  max;
+  ttlMs;
+  now;
+  /** Entries dropped to stay under `max`. Surfaced by plugin health(). */
+  evictions = 0;
+  constructor(options) {
+    const normalizedMax = Math.floor(options.max);
+    this.max = Number.isSafeInteger(normalizedMax) ? Math.max(1, normalizedMax) : 1;
+    this.ttlMs = options.ttlMs;
+    this.now = options.now ?? Date.now;
+  }
+  expired(entry) {
+    return this.ttlMs !== void 0 && this.now() - entry.storedAt > this.ttlMs;
+  }
+  get(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return void 0;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return void 0;
+    }
+    this.map.delete(key);
+    this.map.set(key, entry);
+    return entry.value;
+  }
+  /**
+   * Read without promoting the key to most-recently-used. Use for
+   * diagnostics that must not perturb the eviction order.
+   */
+  peek(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0 || this.expired(entry)) return void 0;
+    return entry.value;
+  }
+  has(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return false;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return false;
+    }
+    return true;
+  }
+  set(key, value) {
+    this.map.delete(key);
+    this.map.set(key, { value, storedAt: this.now() });
+    while (this.map.size > this.max) {
+      const coldest = this.map.keys().next().value;
+      if (coldest === void 0) break;
+      this.map.delete(coldest);
+      this.evictions += 1;
+    }
+    return this;
+  }
+  delete(key) {
+    return this.map.delete(key);
+  }
+  clear() {
+    this.map.clear();
+    this.evictions = 0;
+  }
+  get size() {
+    return this.map.size;
+  }
+  /** How many entries have been dropped to respect `max`, since the last clear. */
+  get evictionCount() {
+    return this.evictions;
+  }
+  /** Drop every expired entry. Cheap enough to call from a status tool. */
+  prune() {
+    if (this.ttlMs === void 0) return 0;
+    let removed = 0;
+    for (const [key, entry] of this.map) {
+      if (this.expired(entry)) {
+        this.map.delete(key);
+        removed += 1;
+      }
+    }
+    return removed;
+  }
+  /** Live (non-expired) entries, coldest first. */
+  *entries() {
+    for (const [key, entry] of this.map) {
+      if (!this.expired(entry)) yield [key, entry.value];
+    }
+  }
+  [Symbol.iterator]() {
+    return this.entries();
+  }
+};
+var BoundedSet = class {
+  inner;
+  constructor(options) {
+    this.inner = new BoundedMap(options);
+  }
+  has(value) {
+    return this.inner.has(value);
+  }
+  add(value) {
+    this.inner.set(value, true);
+    return this;
+  }
+  delete(value) {
+    return this.inner.delete(value);
+  }
+  clear() {
+    this.inner.clear();
+  }
+  get size() {
+    return this.inner.size;
+  }
+  /** How many entries have been dropped to respect `max`, since the last clear. */
+  get evictionCount() {
+    return this.inner.evictionCount;
+  }
+  *values() {
+    for (const [key] of this.inner) yield key;
+  }
+  [Symbol.iterator]() {
+    return this.values();
+  }
+};
+
+// src/runtime/credential-patterns.ts
+var CREDENTIAL_PATTERNS = [
+  // LLM provider keys
+  {
+    type: "anthropic_key",
+    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g
+  },
+  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?!ant)(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g },
+  // GitHub. `ghp_` is only the personal-access-token prefix — the OAuth
+  // (`gho_`), user-to-server (`ghu_`), server-to-server (`ghs_`) and
+  // refresh (`ghr_`) tokens grant the same or broader access and were
+  // previously not detected at all.
+  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g },
+  {
+    type: "github_oauth_token",
+    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g
+  },
+  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g },
+  // GitLab
+  { type: "gitlab_pat", regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  {
+    type: "gitlab_runner_token",
+    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  // npm — a leaked publish token is a supply-chain compromise.
+  { type: "npm_token", regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g },
+  // AWS
+  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g },
+  // GCP
+  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g },
+  // Slack. `xoxe` (token-rotation) and `xapp` (app-level) were missing;
+  // both are as sensitive as the bot/user tokens already covered.
+  {
+    type: "slack_token",
+    regex: /(?<![A-Za-z0-9-])xox[abposer]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g
+  },
+  { type: "slack_app_token", regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g },
+  {
+    type: "slack_webhook",
+    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g
+  },
+  // Stripe
+  {
+    type: "stripe_key",
+    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g
+  },
+  // Twilio
+  { type: "twilio_sid", regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g },
+  // Telegram
+  {
+    type: "telegram_bot_token",
+    regex: /(?:(?<![A-Za-z0-9_])|(?<=(?:^|[^A-Za-z0-9_])bot))\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  // JWT
+  {
+    type: "jwt",
+    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g
+  },
+  // Private keys
+  {
+    type: "private_key",
+    regex: /(?:^|\n)(?:-----BEGIN (?:RSA|EC|OPENSSH|DSA)? ?PRIVATE KEY-----[\s\S]*?-----END (?:RSA|EC|OPENSSH|DSA)? ?PRIVATE KEY-----|-----BEGIN PGP PRIVATE KEY BLOCK-----[\s\S]*?-----END PGP PRIVATE KEY BLOCK-----)(?!\S)/g
+  },
+  // AI/ML provider tokens
+  { type: "huggingface_token", regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g },
+  { type: "replicate_token", regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "perplexity_key", regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "groq_key", regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  // SaaS / infrastructure tokens — each grants API access on the user's
+  // account, and each was previously invisible to this gate.
+  { type: "sendgrid_key", regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  { type: "digitalocean_token", regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g },
+  { type: "doppler_token", regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "shopify_token", regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g },
+  { type: "docker_pat", regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  { type: "linear_key", regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "atlassian_token", regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g },
+  { type: "square_token", regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  {
+    type: "azure_storage_key",
+    regex: /AccountKey=[A-Za-z0-9+/]{80,}={0,2}/g
+  },
+  {
+    type: "google_oauth_client_secret",
+    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  // Bearer tokens
+  {
+    type: "bearer_token",
+    regex: /(?<![A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?![A-Za-z0-9._~+/-])/g
+  },
+  // Database URIs. Require password-bearing user-info; credential-free values stay scannable.
+  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
+  {
+    type: "postgres_uri",
+    // Query parsers decode percent-encoded parameter names. Recognize each
+    // encoded character in `password` so mixed forms such as `pass%77ord`
+    // cannot bypass detection while keeping the scan strictly bounded.
+    regex: /postgres(?:ql)?:\/\/(?:[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+|[^&\s?"'`#]{1,2048}\?(?:(?!(?:p|%70)(?:a|%61)(?:s|%73)(?:s|%73)(?:w|%77)(?:o|%6[fF])(?:r|%72)(?:d|%64)=)[^&\s#"'`]{1,256}&){0,32}(?:p|%70)(?:a|%61)(?:s|%73)(?:s|%73)(?:w|%77)(?:o|%6[fF])(?:r|%72)(?:d|%64)=[^&\s#"'`]{1,4096})/g
+  },
+  { type: "mysql_uri", regex: /mysql:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
+  { type: "redis_uri", regex: /redis:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
+  {
+    // Credentials serialised as JSON, keyed rather than prefixed. Every other
+    // entry in this table recognises a credential by its SHAPE (`ghp_`, `sk-`,
+    // `eyJ`), which means a key with no distinctive prefix — Azure, a
+    // self-hosted gateway, an Anthropic/Codex OAuth token — was invisible to
+    // both surfaces. `prompt-firewall` guards the outgoing provider request, so
+    // this is what stops a JSON-shaped tool result carrying such a value to a
+    // third party.
+    //
+    // The key is matched in a LOOKBEHIND, so the reported match is the secret
+    // itself and the pattern keeps zero capturing groups — `secret-scanner`
+    // maps a combined-regex group index back to the pattern that fired, and an
+    // inner group would shift that mapping (see the style note above, enforced
+    // by credential-pattern-parity.test.ts).
+    //
+    // Mirrors `json_credential_key` in
+    // `@wrongstack/core` → `src/security/secret-scrubber.ts`. Keep the two key
+    // lists in step; the core side additionally preserves the key name when it
+    // rewrites, which is why it is written with capture groups instead.
+    type: "json_credential_key",
+    regex: /(?<="[A-Za-z0-9_]{0,64}(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s{0,8}:\s{0,8}")[^"\\]{8,512}(?=")/gi
+  }
+];
+function cloneCredentialPatterns() {
+  return CREDENTIAL_PATTERNS.map((p) => ({
+    type: p.type,
+    regex: new RegExp(p.regex.source, p.regex.flags)
+  }));
+}
+
+// src/runtime/safe-json.ts
+var UNSERIALIZABLE = "[unserializable]";
+function safeJsonStringify(value, indent) {
+  try {
+    const stack = [];
+    const out = JSON.stringify(
+      value,
+      function replacer(_key, val) {
+        if (typeof val === "bigint") return `${val.toString()}n`;
+        if (val === null || typeof val !== "object") return val;
+        while (stack.length > 0 && stack[stack.length - 1] !== this) stack.pop();
+        if (stack.includes(val)) return "[circular]";
+        stack.push(val);
+        return val;
+      },
+      indent
+    );
+    return out ?? String(value);
+  } catch {
+    return UNSERIALIZABLE;
+  }
+}
+
+// src/runtime/handles.ts
+function releaseHandle(off) {
+  if (off) {
+    try {
+      off();
+    } catch {
+    }
+  }
+  return null;
+}
+function releaseHandles(state, keys) {
+  for (const key of keys) {
+    state[key] = releaseHandle(state[key]);
+  }
+}
+
+// src/runtime/redos-guard.ts
+import { Worker } from "node:worker_threads";
+function withReDoSGuard(re, input, budgetMs = 50, options = {}) {
+  const opts = { budgetMs, ...options };
+  const start = Date.now();
+  const workerSource = buildWorkerSource(re.source, input, re.flags);
+  const worker = new Worker(workerSource, {
+    eval: true,
+    name: `redos-guard:${re.source.slice(0, 32)}`
+  });
+  return new Promise((resolve4) => {
+    let settled = false;
+    const onMessage = (msg) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      worker.terminate().catch(() => {
+      });
+      if (!msg.ok) {
+        resolve4({ timedOut: true, match: null });
+        return;
+      }
+      resolve4({ timedOut: false, match: msg.match });
+    };
+    const onError = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      worker.terminate().catch(() => {
+      });
+      resolve4({ timedOut: true, match: null });
+    };
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      const elapsedMs = Date.now() - start;
+      worker.terminate().catch(() => {
+      });
+      try {
+        opts.onTimeout?.({
+          regex: re,
+          input,
+          budgetMs: opts.budgetMs,
+          elapsedMs
+        });
+      } catch {
+      }
+      resolve4({ timedOut: true, match: null });
+    }, opts.budgetMs);
+    timer.unref?.();
+    worker.on("message", onMessage);
+    worker.on("error", onError);
+  });
+}
+function buildWorkerSource(source, input, flags) {
+  const S = JSON.stringify(source);
+  const I = JSON.stringify(input);
+  const F = JSON.stringify(flags);
+  return `
+const { parentPort } = require('node:worker_threads');
+const source = ${S};
+const input = ${I};
+const flags = ${F};
+try {
+  const re = new RegExp(source, flags);
+  const match = re.exec(input);
+  // parentPort.postMessage, NOT bare postMessage: with eval:true
+  // workers this Node version does not expose the bare postMessage
+  // global \u2014 the worker throws ReferenceError at startup and the
+  // host misreads it as a timeout (positive-path regression).
+  parentPort.postMessage({ ok: true, match });
+} catch (err) {
+  parentPort.postMessage({ ok: false, error: err && err.message ? err.message : String(err) });
+}
+`;
+}
+function guardedMatcher(re, budgetMs = 50, onTimeout) {
+  return (input) => withReDoSGuard(re, input, budgetMs, onTimeout ? { onTimeout } : {});
+}
+
+// src/runtime/sandbox.ts
+import { realpathSync } from "node:fs";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
+var MAX_PATH_BYTES = 4096;
+function safePath(input, options = {}) {
+  if (typeof input !== "string") return null;
+  if (input.length === 0 || input.length > MAX_PATH_BYTES) return null;
+  if (input.startsWith("-")) return null;
+  const projectRoot = resolve2(options.projectRoot ?? process.cwd());
+  const lexical = isAbsolute2(input) ? resolve2(input) : resolve2(projectRoot, input);
+  if (!withinLexical(projectRoot, lexical)) return null;
+  if (options.followSymlinks !== false) {
+    let real;
+    try {
+      real = realpathSync(lexical);
+    } catch {
+      return null;
+    }
+    if (!withinLexical(projectRoot, real)) return null;
+    return real;
+  }
+  return lexical;
+}
+function withinLexical(projectRoot, candidate) {
+  const rel = relative2(projectRoot, candidate);
+  if (rel === "" || rel === ".") return true;
+  if (rel.startsWith("..")) return false;
+  if (isAbsolute2(rel)) return false;
+  return true;
+}
+function isInsideProject(input, options = {}) {
+  return safePath(input, options) !== null;
+}
+
+// src/runtime/h1-state.ts
+function createH1State(initial) {
+  const handles = /* @__PURE__ */ new Map();
+  const safeRelease = (unregister) => {
+    try {
+      unregister();
+    } catch {
+    }
+  };
+  return {
+    state: initial,
+    register(key, unregister) {
+      const prior = handles.get(key);
+      if (prior) {
+        safeRelease(prior);
+        handles.delete(key);
+      }
+      if (unregister) {
+        handles.set(key, unregister);
+      }
+    },
+    release(key) {
+      const prior = handles.get(key);
+      if (!prior) return;
+      handles.delete(key);
+      safeRelease(prior);
+    },
+    releaseAll() {
+      for (const unregister of handles.values()) {
+        safeRelease(unregister);
+      }
+      handles.clear();
+    },
+    size() {
+      return handles.size;
+    },
+    keys() {
+      return [...handles.keys()];
+    }
+  };
+}
+
+// src/runtime/index.ts
+var META_CHARS = /["'`;&|<>\r\n]/;
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+function hasLeadingDash(arg) {
+  return arg.length > 0 && arg.startsWith("-");
+}
+function safeSplit(command) {
+  const trimmed = command.trim();
+  if (!trimmed || META_CHARS.test(trimmed)) return null;
+  return trimmed.split(/\s+/).filter(Boolean);
+}
+function withinProjectPath(projectRoot, candidate) {
+  if (candidate.length === 0 || candidate.length > 4096) return false;
+  if (hasLeadingDash(candidate)) return false;
+  const resolved = isAbsolute3(candidate) ? resolve3(candidate) : resolve3(projectRoot, candidate);
+  const rel = relative3(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
+}
+function everyFlagAllowed(allowed, args) {
+  for (const arg of args) {
+    if (!hasLeadingDash(arg)) continue;
+    if (allowed === null) return false;
+    if (!allowed.has(arg)) return false;
+  }
+  return true;
+}
+function sanitizeRunnerPath(value, options = {}) {
+  if (!value || hasLeadingDash(value)) return null;
+  const projectRoot = resolve3(options.projectRoot ?? process.cwd());
+  if (!withinProjectPath(projectRoot, value)) return null;
+  return isAbsolute3(value) ? resolve3(value) : resolve3(projectRoot, value);
+}
+function resolveRunnerCommand(runtime, command, options = {}) {
+  const tokens = safeSplit(command);
+  if (!tokens || tokens.length === 0) return null;
+  const projectRoot = resolve3(options.projectRoot ?? process.cwd());
+  const launcher = runtime.packageManager;
+  const [head, second, ...rest] = tokens;
+  if (!head) return null;
+  const display = tokens.join(" ");
+  if (launcher !== "none" && tokens.length === 1 && head === launcher) {
+    return null;
+  }
+  if (head === runtime.executable) {
+    if (!everyFlagAllowed(runtime.allowedFlags, [second, ...rest].filter((v) => Boolean(v)))) {
+      return null;
+    }
+    return {
+      cmd: head,
+      args: [second, ...rest].filter((v) => Boolean(v)),
+      display
+    };
+  }
+  if (launcher !== "none" && head === launcher && runtime.subcommands.length === 0 && second === runtime.executable) {
+    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
+    return { cmd: head, args: [second, ...rest], display };
+  }
+  if (launcher !== "none" && head === launcher && runtime.subcommands.length > 0) {
+    const subcommand = runtime.subcommands[0];
+    const exe = rest[0];
+    if (second === subcommand && exe === runtime.executable) {
+      const tail = rest.slice(1);
+      if (!everyFlagAllowed(runtime.allowedFlags, tail)) return null;
+      return { cmd: head, args: [second, exe, ...tail], display };
+    }
+  }
+  if (isAbsolute3(head)) {
+    if (!withinProjectPath(projectRoot, head)) return null;
+    const base = basename(head);
+    if (base !== runtime.executable && base !== launcher) return null;
+    if (second !== runtime.executable) return null;
+    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
+    return { cmd: head, args: [second, ...rest], display };
+  }
+  return null;
+}
+function runRunnerCommand(argv, options) {
+  if (argv.length === 0) {
+    return Promise.resolve({
+      code: null,
+      stdout: "",
+      stderr: "runtime helper: empty argv",
+      timedOut: false,
+      spawnError: true
+    });
+  }
+  return new Promise((resolvePromise) => {
+    const projectRoot = resolve3(options.projectRoot ?? process.cwd());
+    const trimmedCwd = options.cwd.trim();
+    if (!withinProjectPath(projectRoot, trimmedCwd)) {
+      resolvePromise({
+        code: null,
+        stdout: "",
+        stderr: "runtime helper: cwd outside project",
+        timedOut: false,
+        spawnError: true
+      });
+      return;
+    }
+    let timedOut = false;
+    let spawnErrored = false;
+    const start = Date.now();
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    const onAbort = () => {
+      timedOut = true;
+    };
+    let invocation;
+    try {
+      invocation = resolveExecInvocation(argv[0], argv.slice(1));
+    } catch (err) {
+      resolvePromise({
+        code: null,
+        stdout: "",
+        stderr: `runtime helper: ${err instanceof Error ? err.message : String(err)}`,
+        timedOut: false,
+        spawnError: true
+      });
+      return;
+    }
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    const child = execFile(
+      invocation.cmd,
+      invocation.args,
+      {
+        cwd: trimmedCwd,
+        timeout: options.timeoutMs,
+        signal: options.signal,
+        maxBuffer: MAX_BUFFER_BYTES,
+        // execFile defaults `encoding` to 'utf8', which makes the
+        // stdout/stderr `data` events emit *strings*. The chunk arrays
+        // below are typed Buffer[] and every consumer runs them through
+        // Buffer.concat(...).toString('utf8'), which throws
+        // ERR_INVALID_ARG_TYPE on any non-empty string output. Pin the
+        // streams to buffers so the declared contract holds (regression:
+        // runRunnerCommand crashed on any child that actually wrote
+        // output; only the maxBuffer fixture exercised this path).
+        encoding: "buffer",
+        windowsHide: true,
+        shell: false,
+        ...invocation.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
+      },
+      (err) => {
+        options.signal?.removeEventListener("abort", onAbort);
+        if (timedOut) {
+          resolvePromise({
+            code: null,
+            stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+            stderr: Buffer.concat(stderrChunks).toString("utf8"),
+            timedOut: true,
+            spawnError: false
+          });
+          return;
+        }
+        if (spawnErrored) {
+          resolvePromise({
+            code: 127,
+            stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+            stderr: Buffer.concat(stderrChunks).toString("utf8"),
+            timedOut: false,
+            spawnError: true
+          });
+          return;
+        }
+        if (err) {
+          const anyErr = err;
+          if ((anyErr.killed === true || anyErr.signal === "SIGTERM") && // maxBuffer overflow must NOT be misreported as a timeout
+          // — it's a real failure (the child wrote too much) and
+          // downstream callers (type-gate/index.ts:227) return
+          // null on timedOut=true, which would silently swallow
+          // maxBuffer overflow into a confusing empty-output
+          // result. Skip the timeout resolve when the err shape
+          // names maxBuffer explicitly.
+          !/maxBuffer length exceeded/i.test(anyErr.message ?? "") && // And only count it as a timeout if the wall clock has
+          // actually elapsed past the budget. External SIGTERMs and
+          // races against the exit handler don't satisfy this.
+          Date.now() - start >= options.timeoutMs) {
+            resolvePromise({
+              code: null,
+              stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
+              stderr: Buffer.concat(stderrChunks).toString("utf-8"),
+              timedOut: true,
+              spawnError: false
+            });
+            return;
+          }
+          const code = typeof anyErr.code === "number" ? anyErr.code : 1;
+          resolvePromise({
+            code,
+            stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
+            stderr: Buffer.concat(stderrChunks).toString("utf-8"),
+            timedOut: false,
+            spawnError: false
+          });
+          return;
+        }
+        resolvePromise({
+          code: 0,
+          stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+          stderr: Buffer.concat(stderrChunks).toString("utf8"),
+          timedOut: false,
+          spawnError: false
+        });
+      }
+    );
+    child.on("exit", (_code, signal) => {
+      if (signal !== null && Date.now() - start >= options.timeoutMs) {
+        timedOut = true;
+      }
+    });
+    child.stdout?.on("data", (chunk) => {
+      stdoutBytes += chunk.length;
+      if (stdoutBytes <= MAX_BUFFER_BYTES) stdoutChunks.push(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderrBytes += chunk.length;
+      if (stderrBytes <= MAX_BUFFER_BYTES) stderrChunks.push(chunk);
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT" || err.code === "EPERM" || err.code === "EACCES") {
+        spawnErrored = true;
+      }
+    });
+  });
+}
+async function probeRunner(runtime, probeArg = "--version", options) {
+  const resolved = resolveRunnerCommand(runtime, `${runtime.executable} ${probeArg}`, options);
+  if (!resolved) return false;
+  const result = await runRunnerCommand([resolved.cmd, ...resolved.args], {
+    ...options,
+    timeoutMs: Math.min(options.timeoutMs, 5e3)
+  });
+  return result.code === 0;
+}
+function withinProject(p) {
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative3(cwd, p) === ".";
+}
+function locateRunnerEntry(runtime, projectRoot) {
+  const root = resolve3(projectRoot);
+  const candidates = [
+    resolve3(root, "node_modules", ".bin", runtime.executable),
+    resolve3(root, "node_modules", ".bin", `${runtime.executable}.cmd`),
+    resolve3(root, "node_modules", ".bin", `${runtime.executable}.ps1`)
+  ];
+  for (const c of candidates) {
+    if (existsSync(c)) return c;
+  }
+  return null;
+}
+var DEFAULT_EXCLUDE_DIRS = ["node_modules", "dist", ".git", "coverage"];
+function collectSourceFiles(root, opts) {
+  const files = [];
+  if (!existsSync(root)) return files;
+  const s = statSync(root);
+  if (s.isFile()) {
+    if (matchesExtension(root, opts.extensions)) files.push(root);
+    return files;
+  }
+  if (!s.isDirectory()) return files;
+  const exclude = opts.excludeDirs ?? DEFAULT_EXCLUDE_DIRS;
+  const excludeSet = new Set(exclude);
+  function walk(dir, depth) {
+    if (opts.maxDepth !== void 0 && depth > opts.maxDepth) return;
+    let entries;
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return;
+    }
+    entries.sort();
+    for (const entry of entries) {
+      if (excludeSet.has(entry)) continue;
+      const full = resolve3(dir, entry);
+      let st;
+      try {
+        st = statSync(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        walk(full, depth + 1);
+      } else if (st.isFile() && matchesExtension(full, opts.extensions)) {
+        files.push(full);
+      }
+    }
+  }
+  walk(root, 0);
+  return files;
+}
+async function collectSourceFilesAsync(root, opts) {
+  const { readdir, stat } = await import("node:fs/promises");
+  const files = [];
+  try {
+    const s = await stat(root);
+    if (s.isFile()) {
+      if (matchesExtension(root, opts.extensions)) files.push(root);
+      return files;
+    }
+    if (!s.isDirectory()) return files;
+  } catch {
+    return files;
+  }
+  const exclude = opts.excludeDirs ?? DEFAULT_EXCLUDE_DIRS;
+  const excludeSet = new Set(exclude);
+  async function walk(dir, depth) {
+    if (opts.maxDepth !== void 0 && depth > opts.maxDepth) return;
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      if (excludeSet.has(entry.name)) continue;
+      const full = resolve3(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full, depth + 1);
+      } else if (entry.isFile() && matchesExtension(full, opts.extensions)) {
+        files.push(full);
+      }
+    }
+  }
+  await walk(root, 0);
+  return files;
+}
+function matchesExtension(p, exts) {
+  return exts.includes(extname2(p).toLowerCase());
+}
+export {
+  BoundedMap,
+  BoundedSet,
+  CREDENTIAL_PATTERNS,
+  UNSERIALIZABLE,
+  clearLocalBinCache,
+  cloneCredentialPatterns,
+  collectSourceFiles,
+  collectSourceFilesAsync,
+  createH1State,
+  findOnPath,
+  guardedMatcher,
+  isInsideProject,
+  locateRunnerEntry,
+  matchesExtension,
+  parseLlmJsonObject,
+  probeRunner,
+  releaseHandle,
+  releaseHandles,
+  resolveExecInvocation,
+  resolveFirstNodeBin,
+  resolveNodeBin,
+  resolveRunnerCommand,
+  resolveWin32Command,
+  runOptionalPluginCouncil,
+  runOptionalPluginLlm,
+  runRunnerCommand,
+  safeJsonStringify,
+  safePath,
+  sanitizeRunnerPath,
+  stripOuterMarkdownFence,
+  withReDoSGuard,
+  withinProject
+};
+//# sourceMappingURL=runtime.js.map