@wrongstack/plugin-sdk 0.319.1 → 1.0.0

package/dist/runtime/bounded-map.js

@@ -0,0 +1,136 @@
+// src/runtime/bounded-map.ts
+var BoundedMap = class {
+  map = /* @__PURE__ */ new Map();
+  max;
+  ttlMs;
+  now;
+  /** Entries dropped to stay under `max`. Surfaced by plugin health(). */
+  evictions = 0;
+  constructor(options) {
+    const normalizedMax = Math.floor(options.max);
+    this.max = Number.isSafeInteger(normalizedMax) ? Math.max(1, normalizedMax) : 1;
+    this.ttlMs = options.ttlMs;
+    this.now = options.now ?? Date.now;
+  }
+  expired(entry) {
+    return this.ttlMs !== void 0 && this.now() - entry.storedAt > this.ttlMs;
+  }
+  get(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return void 0;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return void 0;
+    }
+    this.map.delete(key);
+    this.map.set(key, entry);
+    return entry.value;
+  }
+  /**
+   * Read without promoting the key to most-recently-used. Use for
+   * diagnostics that must not perturb the eviction order.
+   */
+  peek(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0 || this.expired(entry)) return void 0;
+    return entry.value;
+  }
+  has(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return false;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return false;
+    }
+    return true;
+  }
+  set(key, value) {
+    this.map.delete(key);
+    this.map.set(key, { value, storedAt: this.now() });
+    if (this.map.size > this.max && this.ttlMs !== void 0) {
+      this.prune();
+    }
+    while (this.map.size > this.max) {
+      const coldest = this.map.keys().next().value;
+      if (coldest === void 0) break;
+      this.map.delete(coldest);
+      this.evictions += 1;
+    }
+    return this;
+  }
+  delete(key) {
+    return this.map.delete(key);
+  }
+  clear() {
+    this.map.clear();
+    this.evictions = 0;
+  }
+  get size() {
+    if (this.ttlMs !== void 0) {
+      this.prune();
+    }
+    return this.map.size;
+  }
+  /** How many entries have been dropped to respect `max`, since the last clear. */
+  get evictionCount() {
+    return this.evictions;
+  }
+  /** Drop every expired entry. Cheap enough to call from a status tool. */
+  prune() {
+    if (this.ttlMs === void 0) return 0;
+    let removed = 0;
+    for (const [key, entry] of this.map) {
+      if (this.expired(entry)) {
+        this.map.delete(key);
+        removed += 1;
+      }
+    }
+    return removed;
+  }
+  /** Live (non-expired) entries, coldest first. */
+  *entries() {
+    for (const [key, entry] of this.map) {
+      if (!this.expired(entry)) yield [key, entry.value];
+    }
+  }
+  [Symbol.iterator]() {
+    return this.entries();
+  }
+};
+var BoundedSet = class {
+  inner;
+  constructor(options) {
+    this.inner = new BoundedMap(options);
+  }
+  has(value) {
+    return this.inner.has(value);
+  }
+  add(value) {
+    this.inner.set(value, true);
+    return this;
+  }
+  delete(value) {
+    return this.inner.delete(value);
+  }
+  clear() {
+    this.inner.clear();
+  }
+  get size() {
+    return this.inner.size;
+  }
+  /** How many entries have been dropped to respect `max`, since the last clear. */
+  get evictionCount() {
+    return this.inner.evictionCount;
+  }
+  *values() {
+    for (const [key] of this.inner) yield key;
+  }
+  [Symbol.iterator]() {
+    return this.values();
+  }
+};
+export {
+  BoundedMap,
+  BoundedSet
+};
+//# sourceMappingURL=bounded-map.js.map

package/dist/runtime/credential-patterns.js

@@ -0,0 +1,154 @@
+// src/runtime/credential-patterns.ts
+var CREDENTIAL_PATTERNS = [
+  // LLM provider keys
+  {
+    type: "anthropic_key",
+    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g
+  },
+  {
+    type: "openai_key",
+    regex: /(?<![A-Za-z0-9])sk-(?!ant)(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g
+  },
+  // GitHub. `ghp_` is only the personal-access-token prefix — the OAuth
+  // (`gho_`), user-to-server (`ghu_`), server-to-server (`ghs_`) and
+  // refresh (`ghr_`) tokens grant the same or broader access and were
+  // previously not detected at all.
+  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g },
+  {
+    type: "github_oauth_token",
+    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g
+  },
+  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g },
+  // GitLab
+  { type: "gitlab_pat", regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  {
+    type: "gitlab_runner_token",
+    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  // npm — a leaked publish token is a supply-chain compromise.
+  { type: "npm_token", regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g },
+  // AWS
+  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g },
+  // GCP
+  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g },
+  // Slack. `xoxe` (token-rotation) and `xapp` (app-level) were missing;
+  // both are as sensitive as the bot/user tokens already covered.
+  {
+    type: "slack_token",
+    regex: /(?<![A-Za-z0-9-])xox[abposer]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g
+  },
+  { type: "slack_app_token", regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g },
+  {
+    type: "slack_webhook",
+    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g
+  },
+  // Stripe
+  {
+    type: "stripe_key",
+    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g
+  },
+  // Twilio
+  { type: "twilio_sid", regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g },
+  // Telegram
+  {
+    type: "telegram_bot_token",
+    regex: /(?:(?<![A-Za-z0-9_])|(?<=(?:^|[^A-Za-z0-9_])bot))\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  // JWT
+  {
+    type: "jwt",
+    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g
+  },
+  // Private keys
+  {
+    type: "private_key",
+    regex: /(?:^|\n)(?:-----BEGIN (?:RSA|EC|OPENSSH|DSA)? ?PRIVATE KEY-----[\s\S]*?-----END (?:RSA|EC|OPENSSH|DSA)? ?PRIVATE KEY-----|-----BEGIN PGP PRIVATE KEY BLOCK-----[\s\S]*?-----END PGP PRIVATE KEY BLOCK-----)(?!\S)/g
+  },
+  // AI/ML provider tokens
+  { type: "huggingface_token", regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g },
+  { type: "replicate_token", regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "perplexity_key", regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "groq_key", regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  // SaaS / infrastructure tokens — each grants API access on the user's
+  // account, and each was previously invisible to this gate.
+  {
+    type: "sendgrid_key",
+    regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  { type: "digitalocean_token", regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g },
+  {
+    type: "doppler_token",
+    regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+  },
+  {
+    type: "shopify_token",
+    regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g
+  },
+  { type: "docker_pat", regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  { type: "linear_key", regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  {
+    type: "atlassian_token",
+    regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g
+  },
+  {
+    type: "square_token",
+    regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  {
+    type: "azure_storage_key",
+    regex: /AccountKey=[A-Za-z0-9+/]{80,}={0,2}/g
+  },
+  {
+    type: "google_oauth_client_secret",
+    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  // Bearer tokens
+  {
+    type: "bearer_token",
+    regex: /(?<![A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?![A-Za-z0-9._~+/-])/g
+  },
+  // Database URIs. Require password-bearing user-info; credential-free values stay scannable.
+  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
+  {
+    type: "postgres_uri",
+    // Query parsers decode percent-encoded parameter names. Recognize each
+    // encoded character in `password` so mixed forms such as `pass%77ord`
+    // cannot bypass detection while keeping the scan strictly bounded.
+    regex: /postgres(?:ql)?:\/\/(?:[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+|[^&\s?"'`#]{1,2048}\?(?:(?!(?:p|%70)(?:a|%61)(?:s|%73)(?:s|%73)(?:w|%77)(?:o|%6[fF])(?:r|%72)(?:d|%64)=)[^&\s#"'`]{1,256}&){0,32}(?:p|%70)(?:a|%61)(?:s|%73)(?:s|%73)(?:w|%77)(?:o|%6[fF])(?:r|%72)(?:d|%64)=[^&\s#"'`]{1,4096})/g
+  },
+  { type: "mysql_uri", regex: /mysql:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
+  { type: "redis_uri", regex: /redis:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
+  {
+    // Credentials serialised as JSON, keyed rather than prefixed. Every other
+    // entry in this table recognises a credential by its SHAPE (`ghp_`, `sk-`,
+    // `eyJ`), which means a key with no distinctive prefix — Azure, a
+    // self-hosted gateway, an Anthropic/Codex OAuth token — was invisible to
+    // both surfaces. `prompt-firewall` guards the outgoing provider request, so
+    // this is what stops a JSON-shaped tool result carrying such a value to a
+    // third party.
+    //
+    // The key is matched in a LOOKBEHIND, so the reported match is the secret
+    // itself and the pattern keeps zero capturing groups — `secret-scanner`
+    // maps a combined-regex group index back to the pattern that fired, and an
+    // inner group would shift that mapping (see the style note above, enforced
+    // by credential-pattern-parity.test.ts).
+    //
+    // Mirrors `json_credential_key` in
+    // `@wrongstack/core` → `src/security/secret-scrubber.ts`. Keep the two key
+    // lists in step; the core side additionally preserves the key name when it
+    // rewrites, which is why it is written with capture groups instead.
+    type: "json_credential_key",
+    regex: /(?<="[A-Za-z0-9_]{0,64}(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s{0,8}:\s{0,8}")[^"\\]{8,512}(?=")/gi
+  }
+];
+function cloneCredentialPatterns() {
+  return CREDENTIAL_PATTERNS.map((p) => ({
+    type: p.type,
+    regex: new RegExp(p.regex.source, p.regex.flags)
+  }));
+}
+export {
+  CREDENTIAL_PATTERNS,
+  cloneCredentialPatterns
+};
+//# sourceMappingURL=credential-patterns.js.map

package/dist/runtime/h1-state.js

@@ -0,0 +1,45 @@
+// src/runtime/h1-state.ts
+function createH1State(initial) {
+  const handles = /* @__PURE__ */ new Map();
+  const safeRelease = (unregister) => {
+    try {
+      unregister();
+    } catch {
+    }
+  };
+  return {
+    state: initial,
+    register(key, unregister) {
+      const prior = handles.get(key);
+      if (prior) {
+        safeRelease(prior);
+        handles.delete(key);
+      }
+      if (unregister) {
+        handles.set(key, unregister);
+      }
+    },
+    release(key) {
+      const prior = handles.get(key);
+      if (!prior) return;
+      handles.delete(key);
+      safeRelease(prior);
+    },
+    releaseAll() {
+      for (const unregister of handles.values()) {
+        safeRelease(unregister);
+      }
+      handles.clear();
+    },
+    size() {
+      return handles.size;
+    },
+    keys() {
+      return [...handles.keys()];
+    }
+  };
+}
+export {
+  createH1State
+};
+//# sourceMappingURL=h1-state.js.map

package/dist/runtime/handles.js

@@ -0,0 +1,20 @@
+// src/runtime/handles.ts
+function releaseHandle(off) {
+  if (off) {
+    try {
+      off();
+    } catch {
+    }
+  }
+  return null;
+}
+function releaseHandles(state, keys) {
+  for (const key of keys) {
+    state[key] = releaseHandle(state[key]);
+  }
+}
+export {
+  releaseHandle,
+  releaseHandles
+};
+//# sourceMappingURL=handles.js.map

package/dist/runtime/llm.js

@@ -0,0 +1,91 @@
+// src/runtime/llm.ts
+function stripOuterMarkdownFence(text) {
+  const trimmed = text.trim();
+  const match = trimmed.match(/^```(?:[a-z0-9_-]+)?\s*\r?\n([\s\S]*?)\r?\n```$/i);
+  return (match?.[1] ?? trimmed).trim();
+}
+function parseLlmJsonObject(text) {
+  const candidate = stripOuterMarkdownFence(text);
+  try {
+    const parsed = JSON.parse(candidate);
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function runOptionalPluginLlm(request) {
+  if (!request.requested) {
+    return { used: false, value: null, fallbackReason: "not-requested" };
+  }
+  if (!request.api.llm) {
+    return { used: false, value: null, fallbackReason: "unavailable" };
+  }
+  if (request.options?.signal?.aborted) {
+    return { used: false, value: null, fallbackReason: "cancelled" };
+  }
+  try {
+    const response = await request.api.llm.complete(request.prompt, request.options);
+    const parsed = request.parse(response.text);
+    if (parsed === null) {
+      request.api.log.warn(`${request.label}: ignored invalid LLM response`);
+      return { used: false, value: null, fallbackReason: "invalid-response" };
+    }
+    return { used: true, value: parsed, fallbackReason: null };
+  } catch (error) {
+    const cancelled = request.options?.signal?.aborted === true;
+    request.api.log.warn(`${request.label}: LLM enrichment failed; using deterministic fallback`, {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return {
+      used: false,
+      value: null,
+      fallbackReason: cancelled ? "cancelled" : "provider-error"
+    };
+  }
+}
+async function runOptionalPluginCouncil(request) {
+  if (!request.requested) {
+    return { used: false, value: null, fallbackReason: "not-requested" };
+  }
+  if (request.options?.signal?.aborted) {
+    return { used: false, value: null, fallbackReason: "cancelled" };
+  }
+  const council = request.api.llm?.council;
+  if (council) {
+    try {
+      const result = await council(request.prompt, {
+        ...request.context ? { context: request.context } : {},
+        ...request.profile ? { profile: request.profile } : {},
+        ...request.councilOptions ? { options: request.councilOptions } : {},
+        ...request.options?.signal ? { signal: request.options.signal } : {}
+      });
+      if (result.status === "cancelled") {
+        return { used: false, value: null, fallbackReason: "cancelled" };
+      }
+      const parsed = result.status === "decided" ? request.parse(result.answer ?? "") : null;
+      if (parsed !== null) return { used: true, value: parsed, fallbackReason: null };
+      request.api.log.warn(
+        `${request.label}: Council did not return a valid answer; trying One Shot`,
+        {
+          status: result.status,
+          resolution: result.resolution
+        }
+      );
+    } catch (error) {
+      if (request.options?.signal?.aborted) {
+        return { used: false, value: null, fallbackReason: "cancelled" };
+      }
+      request.api.log.warn(`${request.label}: Council failed; trying One Shot`, {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return runOptionalPluginLlm(request);
+}
+export {
+  parseLlmJsonObject,
+  runOptionalPluginCouncil,
+  runOptionalPluginLlm,
+  stripOuterMarkdownFence
+};
+//# sourceMappingURL=llm.js.map

package/dist/runtime/local-bin.js

@@ -0,0 +1,102 @@
+// src/runtime/local-bin.ts
+import { createRequire } from "node:module";
+import { delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { accessSync, constants, readFileSync } from "node:fs";
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+function resolveExecInvocation(command, args = []) {
+  const resolved = resolveWin32Command(command);
+  const normalizedResolved = resolved.toLowerCase();
+  const needsShell = process.platform === "win32" && (normalizedResolved.endsWith(".cmd") || normalizedResolved.endsWith(".bat"));
+  if (needsShell) {
+    const shim = buildWin32CmdShimInvocation(resolved, args);
+    return { cmd: shim.command, args: shim.args, windowsVerbatimArguments: true };
+  }
+  return { cmd: resolved, args: [...args], windowsVerbatimArguments: false };
+}
+function findOnPath(cmd) {
+  if (!cmd) return null;
+  const exists = (p) => {
+    try {
+      accessSync(p, constants.X_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  if (cmd.includes("/") || cmd.includes("\\")) {
+    return exists(cmd) ? resolve(cmd) : null;
+  }
+  const suffixes = process.platform === "win32" && extname(cmd) === "" ? (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  for (const dir of (process.env["PATH"] ?? "").split(delimiter)) {
+    if (!dir) continue;
+    const base = join(dir, cmd);
+    for (const suffix of suffixes) {
+      const candidate = `${base}${suffix}`;
+      if (exists(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+function isInside(parent, candidate) {
+  const rel = relative(parent, candidate);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel);
+}
+var binCache = /* @__PURE__ */ new Map();
+var BIN_CACHE_MAX = 64;
+var NEGATIVE_BIN_CACHE_TTL_MS = 5e3;
+function cachePut(key, value) {
+  while (binCache.size >= BIN_CACHE_MAX) {
+    const oldest = binCache.keys().next().value;
+    if (oldest === void 0) break;
+    binCache.delete(oldest);
+  }
+  binCache.set(key, { value, cachedAt: Date.now() });
+  return value;
+}
+function clearLocalBinCache() {
+  binCache.clear();
+}
+function resolveNodeBin(packageName, binName, cwd, extraArgs = []) {
+  const key = `${packageName}|${binName}|${cwd}`;
+  const cached = binCache.get(key);
+  if (cached !== void 0) {
+    if (cached.value !== null || Date.now() - cached.cachedAt < NEGATIVE_BIN_CACHE_TTL_MS) {
+      return cached.value === null ? null : { ...cached.value, args: [cached.value.entry, ...extraArgs] };
+    }
+    binCache.delete(key);
+  }
+  let resolved = null;
+  try {
+    const requireFromProject = createRequire(resolve(cwd, "package.json"));
+    const packagePath = requireFromProject.resolve(`${packageName}/package.json`);
+    const packageJson = JSON.parse(readFileSync(packagePath, "utf-8"));
+    const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[binName] ?? Object.values(packageJson.bin ?? {})[0];
+    if (relativeBin && !isAbsolute(relativeBin)) {
+      const packageDir = dirname(packagePath);
+      const entry = resolve(packageDir, relativeBin);
+      if (isInside(packageDir, entry)) {
+        resolved = { cmd: process.execPath, args: [entry], entry };
+      }
+    }
+  } catch {
+    resolved = null;
+  }
+  cachePut(key, resolved);
+  return resolved === null ? null : { ...resolved, args: [resolved.entry, ...extraArgs] };
+}
+function resolveFirstNodeBin(candidates, cwd) {
+  for (const c of candidates) {
+    const hit = resolveNodeBin(c.packageName, c.binName, cwd, c.args ?? []);
+    if (hit) return { ...hit, packageName: c.packageName, binName: c.binName };
+  }
+  return null;
+}
+export {
+  clearLocalBinCache,
+  findOnPath,
+  resolveExecInvocation,
+  resolveFirstNodeBin,
+  resolveNodeBin,
+  resolveWin32Command
+};
+//# sourceMappingURL=local-bin.js.map

package/dist/runtime/redos-guard.js

@@ -0,0 +1,96 @@
+// src/runtime/redos-guard.ts
+import { Worker } from "node:worker_threads";
+var warm = null;
+var callSeq = 0;
+function withReDoSGuard(re, input, budgetMs = 50, options = {}) {
+  const opts = { budgetMs, ...options };
+  const start = Date.now();
+  const id = ++callSeq;
+  let worker;
+  if (warm !== null) {
+    worker = warm;
+  } else {
+    worker = spawnPoolWorker();
+  }
+  warm = null;
+  worker.ref();
+  return new Promise((resolve) => {
+    let settled = false;
+    const settle = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      worker.off("message", onMessage);
+      worker.off("error", onError);
+      resolve(result);
+    };
+    const onMessage = (msg) => {
+      if (settled || msg.id !== id) return;
+      worker.unref();
+      if (warm === null) {
+        warm = worker;
+      } else {
+        worker.terminate().catch(() => {
+        });
+      }
+      if (!msg.ok) {
+        settle({ timedOut: true, match: null });
+        return;
+      }
+      settle({ timedOut: false, match: msg.match });
+    };
+    const onError = () => {
+      if (settled) return;
+      settle({ timedOut: true, match: null });
+    };
+    const timer = setTimeout(() => {
+      if (settled) return;
+      const elapsedMs = Date.now() - start;
+      worker.terminate().catch(() => {
+      });
+      try {
+        opts.onTimeout?.({
+          regex: re,
+          input,
+          budgetMs: opts.budgetMs,
+          elapsedMs
+        });
+      } catch {
+      }
+      settle({ timedOut: true, match: null });
+    }, opts.budgetMs);
+    timer.unref?.();
+    worker.once("message", onMessage);
+    worker.once("error", onError);
+    worker.postMessage({ id, source: re.source, flags: re.flags, input });
+  });
+}
+var POOLED_WORKER_SOURCE = `
+const { parentPort } = require('node:worker_threads');
+parentPort.on('message', (msg) => {
+  const { id, source, flags, input } = msg;
+  try {
+    const re = new RegExp(source, flags);
+    const match = re.exec(input);
+    parentPort.postMessage({ id, ok: true, match });
+  } catch (err) {
+    parentPort.postMessage({ id, ok: false, error: err && err.message ? err.message : String(err) });
+  }
+});
+`;
+function spawnPoolWorker() {
+  const worker = new Worker(POOLED_WORKER_SOURCE, {
+    eval: true,
+    name: "redos-guard:pool"
+  });
+  worker.unref();
+  return worker;
+}
+function guardedMatcher(re, budgetMs = 50, onTimeout) {
+  return (input) => withReDoSGuard(re, input, budgetMs, onTimeout ? { onTimeout } : {});
+}
+export {
+  guardedMatcher,
+  withReDoSGuard
+};
+//# sourceMappingURL=redos-guard.js.map

package/dist/runtime/safe-json.js

@@ -0,0 +1,27 @@
+// src/runtime/safe-json.ts
+var UNSERIALIZABLE = "[unserializable]";
+function safeJsonStringify(value, indent) {
+  try {
+    const stack = [];
+    const out = JSON.stringify(
+      value,
+      function replacer(_key, val) {
+        if (typeof val === "bigint") return `${val.toString()}n`;
+        if (val === null || typeof val !== "object") return val;
+        while (stack.length > 0 && stack[stack.length - 1] !== this) stack.pop();
+        if (stack.includes(val)) return "[circular]";
+        stack.push(val);
+        return val;
+      },
+      indent
+    );
+    return out ?? String(value);
+  } catch {
+    return UNSERIALIZABLE;
+  }
+}
+export {
+  UNSERIALIZABLE,
+  safeJsonStringify
+};
+//# sourceMappingURL=safe-json.js.map

package/dist/runtime/sandbox.js

@@ -0,0 +1,50 @@
+// src/runtime/sandbox.ts
+import { realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+var MAX_PATH_BYTES = 4096;
+function safePath(input, options = {}) {
+  if (typeof input !== "string") return null;
+  if (input.length === 0 || input.length > MAX_PATH_BYTES) return null;
+  if (input.startsWith("-")) return null;
+  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  const lexical = isAbsolute(input) ? resolve(input) : resolve(projectRoot, input);
+  if (!withinLexical(projectRoot, lexical)) return null;
+  if (options.followSymlinks !== false) {
+    const real = realpathWithMissingLeaf(lexical);
+    if (real === null || !withinLexical(projectRoot, real)) return null;
+    return real;
+  }
+  return lexical;
+}
+function realpathWithMissingLeaf(candidate) {
+  let current = candidate;
+  const missing = [];
+  while (true) {
+    try {
+      const resolved = realpathSync(current);
+      return missing.reduceRight((parent, part) => join(parent, part), resolved);
+    } catch (error) {
+      const code = error.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") return null;
+      const parent = dirname(current);
+      if (parent === current) return null;
+      missing.push(basename(current));
+      current = parent;
+    }
+  }
+}
+function withinLexical(projectRoot, candidate) {
+  const rel = relative(projectRoot, candidate);
+  if (rel === "" || rel === ".") return true;
+  if (rel.startsWith("..")) return false;
+  if (isAbsolute(rel)) return false;
+  return true;
+}
+function isInsideProject(input, options = {}) {
+  return safePath(input, options) !== null;
+}
+export {
+  isInsideProject,
+  safePath
+};
+//# sourceMappingURL=sandbox.js.map

package/dist/runtime.js

@@ -1,8 +1,8 @@
 // src/runtime/index.ts
 import { execFile } from "node:child_process";
 import { existsSync, readdirSync, statSync } from "node:fs";
-import { basename, extname as extname2, isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3 } from "node:path";
-import { buildChildEnv } from "@wrongstack/core/utils";
+import { basename as basename2, extname as extname2, isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3 } from "node:path";
+import { buildChildEnv } from "@wrongstack/core/utils/child-env";
 
 // src/runtime/llm.ts
 function stripOuterMarkdownFence(text) {
@@ -506,39 +506,51 @@ function releaseHandles(state, keys) {
 
 // src/runtime/redos-guard.ts
 import { Worker } from "node:worker_threads";
+var warm = null;
+var callSeq = 0;
 function withReDoSGuard(re, input, budgetMs = 50, options = {}) {
   const opts = { budgetMs, ...options };
   const start = Date.now();
-  const workerSource = buildWorkerSource(re.source, input, re.flags);
-  const worker = new Worker(workerSource, {
-    eval: true,
-    name: `redos-guard:${re.source.slice(0, 32)}`
-  });
+  const id = ++callSeq;
+  let worker;
+  if (warm !== null) {
+    worker = warm;
+  } else {
+    worker = spawnPoolWorker();
+  }
+  warm = null;
+  worker.ref();
   return new Promise((resolve4) => {
     let settled = false;
-    const onMessage = (msg) => {
+    const settle = (result) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      worker.terminate().catch(() => {
-      });
+      worker.off("message", onMessage);
+      worker.off("error", onError);
+      resolve4(result);
+    };
+    const onMessage = (msg) => {
+      if (settled || msg.id !== id) return;
+      worker.unref();
+      if (warm === null) {
+        warm = worker;
+      } else {
+        worker.terminate().catch(() => {
+        });
+      }
       if (!msg.ok) {
-        resolve4({ timedOut: true, match: null });
+        settle({ timedOut: true, match: null });
         return;
       }
-      resolve4({ timedOut: false, match: msg.match });
+      settle({ timedOut: false, match: msg.match });
     };
     const onError = () => {
       if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      worker.terminate().catch(() => {
-      });
-      resolve4({ timedOut: true, match: null });
+      settle({ timedOut: true, match: null });
     };
     const timer = setTimeout(() => {
       if (settled) return;
-      settled = true;
       const elapsedMs = Date.now() - start;
       worker.terminate().catch(() => {
       });
@@ -551,34 +563,34 @@ function withReDoSGuard(re, input, budgetMs = 50, options = {}) {
         });
       } catch {
       }
-      resolve4({ timedOut: true, match: null });
+      settle({ timedOut: true, match: null });
     }, opts.budgetMs);
     timer.unref?.();
-    worker.on("message", onMessage);
-    worker.on("error", onError);
+    worker.once("message", onMessage);
+    worker.once("error", onError);
+    worker.postMessage({ id, source: re.source, flags: re.flags, input });
   });
 }
-function buildWorkerSource(source, input, flags) {
-  const S = JSON.stringify(source);
-  const I = JSON.stringify(input);
-  const F = JSON.stringify(flags);
-  return `
+var POOLED_WORKER_SOURCE = `
 const { parentPort } = require('node:worker_threads');
-const source = ${S};
-const input = ${I};
-const flags = ${F};
-try {
-  const re = new RegExp(source, flags);
-  const match = re.exec(input);
-  // parentPort.postMessage, NOT bare postMessage: with eval:true
-  // workers this Node version does not expose the bare postMessage
-  // global \u2014 the worker throws ReferenceError at startup and the
-  // host misreads it as a timeout (positive-path regression).
-  parentPort.postMessage({ ok: true, match });
-} catch (err) {
-  parentPort.postMessage({ ok: false, error: err && err.message ? err.message : String(err) });
-}
+parentPort.on('message', (msg) => {
+  const { id, source, flags, input } = msg;
+  try {
+    const re = new RegExp(source, flags);
+    const match = re.exec(input);
+    parentPort.postMessage({ id, ok: true, match });
+  } catch (err) {
+    parentPort.postMessage({ id, ok: false, error: err && err.message ? err.message : String(err) });
+  }
+});
 `;
+function spawnPoolWorker() {
+  const worker = new Worker(POOLED_WORKER_SOURCE, {
+    eval: true,
+    name: "redos-guard:pool"
+  });
+  worker.unref();
+  return worker;
 }
 function guardedMatcher(re, budgetMs = 50, onTimeout) {
   return (input) => withReDoSGuard(re, input, budgetMs, onTimeout ? { onTimeout } : {});
@@ -586,7 +598,7 @@ function guardedMatcher(re, budgetMs = 50, onTimeout) {
 
 // src/runtime/sandbox.ts
 import { realpathSync } from "node:fs";
-import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
+import { basename, dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2 } from "node:path";
 var MAX_PATH_BYTES = 4096;
 function safePath(input, options = {}) {
   if (typeof input !== "string") return null;
@@ -596,17 +608,29 @@ function safePath(input, options = {}) {
   const lexical = isAbsolute2(input) ? resolve2(input) : resolve2(projectRoot, input);
   if (!withinLexical(projectRoot, lexical)) return null;
   if (options.followSymlinks !== false) {
-    let real;
-    try {
-      real = realpathSync(lexical);
-    } catch {
-      return null;
-    }
-    if (!withinLexical(projectRoot, real)) return null;
+    const real = realpathWithMissingLeaf(lexical);
+    if (real === null || !withinLexical(projectRoot, real)) return null;
     return real;
   }
   return lexical;
 }
+function realpathWithMissingLeaf(candidate) {
+  let current = candidate;
+  const missing = [];
+  while (true) {
+    try {
+      const resolved = realpathSync(current);
+      return missing.reduceRight((parent, part) => join2(parent, part), resolved);
+    } catch (error) {
+      const code = error.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") return null;
+      const parent = dirname2(current);
+      if (parent === current) return null;
+      missing.push(basename(current));
+      current = parent;
+    }
+  }
+}
 function withinLexical(projectRoot, candidate) {
   const rel = relative2(projectRoot, candidate);
   if (rel === "" || rel === ".") return true;
@@ -731,7 +755,7 @@ function resolveRunnerCommand(runtime, command, options = {}) {
   }
   if (isAbsolute3(head)) {
     if (!withinProjectPath(projectRoot, head)) return null;
-    const base = basename(head);
+    const base = basename2(head);
     if (base !== runtime.executable && base !== launcher) return null;
     if (second !== runtime.executable) return null;
     if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/plugin-sdk",
-  "version": "0.319.1",
+  "version": "1.0.0",
   "description": "Authoring SDK for WrongStack plugins — the plugin contract types, definePlugin, and shared runtime helpers. Third-party plugins should depend on this package only.",
   "license": "MIT",
   "author": "ECOSTACK TECHNOLOGY OÜ",
@@ -16,6 +16,42 @@
       "types": "./dist/runtime.d.ts",
       "import": "./dist/runtime.js"
     },
+    "./runtime/bounded-map": {
+      "types": "./dist/runtime/bounded-map.d.ts",
+      "import": "./dist/runtime/bounded-map.js"
+    },
+    "./runtime/credential-patterns": {
+      "types": "./dist/runtime/credential-patterns.d.ts",
+      "import": "./dist/runtime/credential-patterns.js"
+    },
+    "./runtime/h1-state": {
+      "types": "./dist/runtime/h1-state.d.ts",
+      "import": "./dist/runtime/h1-state.js"
+    },
+    "./runtime/handles": {
+      "types": "./dist/runtime/handles.d.ts",
+      "import": "./dist/runtime/handles.js"
+    },
+    "./runtime/llm": {
+      "types": "./dist/runtime/llm.d.ts",
+      "import": "./dist/runtime/llm.js"
+    },
+    "./runtime/local-bin": {
+      "types": "./dist/runtime/local-bin.d.ts",
+      "import": "./dist/runtime/local-bin.js"
+    },
+    "./runtime/redos-guard": {
+      "types": "./dist/runtime/redos-guard.d.ts",
+      "import": "./dist/runtime/redos-guard.js"
+    },
+    "./runtime/safe-json": {
+      "types": "./dist/runtime/safe-json.d.ts",
+      "import": "./dist/runtime/safe-json.js"
+    },
+    "./runtime/sandbox": {
+      "types": "./dist/runtime/sandbox.d.ts",
+      "import": "./dist/runtime/sandbox.js"
+    },
     "./package.json": "./package.json"
   },
   "files": [
@@ -29,8 +65,8 @@
     "vitest": "^4.1.11"
   },
   "dependencies": {
-    "@wrongstack/core": "0.319.1",
-    "@wrongstack/tools": "0.319.1"
+    "@wrongstack/core": "1.0.0",
+    "@wrongstack/tools": "1.0.0"
   },
   "scripts": {
     "build": "node ../../scripts/build-package.mjs",