@wrongstack/plugin-sdk 1.0.9 → 1.0.11

package/dist/runtime/index.d.ts

@@ -28,15 +28,15 @@
  * Anything language-specific (flag tables, default commands,
  * output parsing) stays in the plugin that owns that language.
  */
-export { parseLlmJsonObject, runOptionalPluginCouncil, runOptionalPluginLlm, stripOuterMarkdownFence, type OptionalCouncilRequest, type OptionalLlmRequest, type OptionalLlmResult, } from './llm.js';
-export { BoundedMap, BoundedSet, type BoundedMapOptions } from './bounded-map.js';
-export { cloneCredentialPatterns, CREDENTIAL_PATTERNS, type CredentialPattern, } from './credential-patterns.js';
-export { UNSERIALIZABLE, safeJsonStringify } from './safe-json.js';
-export { releaseHandle, releaseHandles, type Unregister } from './handles.js';
-export { withReDoSGuard, guardedMatcher, type ReDoSResult, type ReDoSOptions, } from './redos-guard.js';
-export { safePath, isInsideProject, type SafePathOptions, } from './sandbox.js';
+export { type OptionalCouncilRequest, type OptionalLlmRequest, type OptionalLlmResult, parseLlmJsonObject, runOptionalPluginCouncil, runOptionalPluginLlm, stripOuterMarkdownFence, } from './llm.js';
+export { BoundedMap, type BoundedMapOptions, BoundedSet } from './bounded-map.js';
+export { CREDENTIAL_PATTERNS, type CredentialPattern, cloneCredentialPatterns, } from './credential-patterns.js';
 export { createH1State, type H1State, } from './h1-state.js';
-export { clearLocalBinCache, findOnPath, resolveExecInvocation, resolveFirstNodeBin, resolveNodeBin, resolveWin32Command, type ExecInvocation, type ResolvedNodeBin, } from './local-bin.js';
+export { releaseHandle, releaseHandles, type Unregister } from './handles.js';
+export { clearLocalBinCache, type ExecInvocation, findOnPath, type ResolvedNodeBin, resolveExecInvocation, resolveFirstNodeBin, resolveNodeBin, resolveWin32Command, } from './local-bin.js';
+export { guardedMatcher, type ReDoSOptions, type ReDoSResult, withReDoSGuard, } from './redos-guard.js';
+export { safeJsonStringify, UNSERIALIZABLE } from './safe-json.js';
+export { isInsideProject, type SafePathOptions, safePath, } from './sandbox.js';
 export type LanguageId = 'typescript' | 'javascript' | 'python' | 'go' | 'rust' | 'shell' | 'ruby' | 'java' | 'kotlin' | 'dotnet' | 'generic';
 export type PackageManagerId = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'pip' | 'poetry' | 'go' | 'cargo' | 'gem' | 'maven' | 'gradle' | 'dotnet' | 'none';
 export interface LanguageRuntime {

package/dist/runtime/sandbox.js

@@ -1,6 +1,6 @@
 // src/runtime/sandbox.ts
 import { realpathSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 var MAX_PATH_BYTES = 4096;
 function safePath(input, options = {}) {
   if (typeof input !== "string") return null;
@@ -36,7 +36,7 @@ function realpathWithMissingLeaf(candidate) {
 function withinLexical(projectRoot, candidate) {
   const rel = relative(projectRoot, candidate);
   if (rel === "" || rel === ".") return true;
-  if (rel.startsWith("..")) return false;
+  if (rel === ".." || rel.startsWith(`..${sep}`)) return false;
   if (isAbsolute(rel)) return false;
   return true;
 }

package/dist/runtime.js

@@ -1,7 +1,7 @@
 // src/runtime/index.ts
 import { execFile } from "node:child_process";
 import { existsSync, readdirSync, statSync } from "node:fs";
-import { basename as basename2, extname as extname2, isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3 } from "node:path";
+import { basename as basename2, extname as extname2, isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3, sep as sep3 } from "node:path";
 import { buildChildEnv } from "@wrongstack/core/utils/child-env";
 
 // src/runtime/llm.ts
@@ -494,27 +494,46 @@ function cloneCredentialPatterns() {
   }));
 }
 
-// src/runtime/safe-json.ts
-var UNSERIALIZABLE = "[unserializable]";
-function safeJsonStringify(value, indent) {
-  try {
-    const stack = [];
-    const out = JSON.stringify(
-      value,
-      function replacer(_key, val) {
-        if (typeof val === "bigint") return `${val.toString()}n`;
-        if (val === null || typeof val !== "object") return val;
-        while (stack.length > 0 && stack[stack.length - 1] !== this) stack.pop();
-        if (stack.includes(val)) return "[circular]";
-        stack.push(val);
-        return val;
-      },
-      indent
-    );
-    return out ?? String(value);
-  } catch {
-    return UNSERIALIZABLE;
-  }
+// src/runtime/h1-state.ts
+function createH1State(initial) {
+  const handles = /* @__PURE__ */ new Map();
+  const safeRelease = (unregister) => {
+    try {
+      unregister();
+    } catch {
+    }
+  };
+  return {
+    state: initial,
+    register(key, unregister) {
+      const prior = handles.get(key);
+      if (prior) {
+        safeRelease(prior);
+        handles.delete(key);
+      }
+      if (unregister) {
+        handles.set(key, unregister);
+      }
+    },
+    release(key) {
+      const prior = handles.get(key);
+      if (!prior) return;
+      handles.delete(key);
+      safeRelease(prior);
+    },
+    releaseAll() {
+      for (const unregister of handles.values()) {
+        safeRelease(unregister);
+      }
+      handles.clear();
+    },
+    size() {
+      return handles.size;
+    },
+    keys() {
+      return [...handles.keys()];
+    }
+  };
 }
 
 // src/runtime/handles.ts
@@ -625,9 +644,32 @@ function guardedMatcher(re, budgetMs = 50, onTimeout) {
   return (input) => withReDoSGuard(re, input, budgetMs, onTimeout ? { onTimeout } : {});
 }
 
+// src/runtime/safe-json.ts
+var UNSERIALIZABLE = "[unserializable]";
+function safeJsonStringify(value, indent) {
+  try {
+    const stack = [];
+    const out = JSON.stringify(
+      value,
+      function replacer(_key, val) {
+        if (typeof val === "bigint") return `${val.toString()}n`;
+        if (val === null || typeof val !== "object") return val;
+        while (stack.length > 0 && stack[stack.length - 1] !== this) stack.pop();
+        if (stack.includes(val)) return "[circular]";
+        stack.push(val);
+        return val;
+      },
+      indent
+    );
+    return out ?? String(value);
+  } catch {
+    return UNSERIALIZABLE;
+  }
+}
+
 // src/runtime/sandbox.ts
 import { realpathSync } from "node:fs";
-import { basename, dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2 } from "node:path";
+import { basename, dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
 var MAX_PATH_BYTES = 4096;
 function safePath(input, options = {}) {
   if (typeof input !== "string") return null;
@@ -663,7 +705,7 @@ function realpathWithMissingLeaf(candidate) {
 function withinLexical(projectRoot, candidate) {
   const rel = relative2(projectRoot, candidate);
   if (rel === "" || rel === ".") return true;
-  if (rel.startsWith("..")) return false;
+  if (rel === ".." || rel.startsWith(`..${sep2}`)) return false;
   if (isAbsolute2(rel)) return false;
   return true;
 }
@@ -671,48 +713,6 @@ function isInsideProject(input, options = {}) {
   return safePath(input, options) !== null;
 }
 
-// src/runtime/h1-state.ts
-function createH1State(initial) {
-  const handles = /* @__PURE__ */ new Map();
-  const safeRelease = (unregister) => {
-    try {
-      unregister();
-    } catch {
-    }
-  };
-  return {
-    state: initial,
-    register(key, unregister) {
-      const prior = handles.get(key);
-      if (prior) {
-        safeRelease(prior);
-        handles.delete(key);
-      }
-      if (unregister) {
-        handles.set(key, unregister);
-      }
-    },
-    release(key) {
-      const prior = handles.get(key);
-      if (!prior) return;
-      handles.delete(key);
-      safeRelease(prior);
-    },
-    releaseAll() {
-      for (const unregister of handles.values()) {
-        safeRelease(unregister);
-      }
-      handles.clear();
-    },
-    size() {
-      return handles.size;
-    },
-    keys() {
-      return [...handles.keys()];
-    }
-  };
-}
-
 // src/runtime/index.ts
 var META_CHARS = /["'`;&|<>\r\n]/;
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
@@ -729,7 +729,7 @@ function withinProjectPath(projectRoot, candidate) {
   if (hasLeadingDash(candidate)) return false;
   const resolved = isAbsolute3(candidate) ? resolve3(candidate) : resolve3(projectRoot, candidate);
   const rel = relative3(projectRoot, resolved);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute3(rel);
 }
 function everyFlagAllowed(allowed, args) {
   for (const arg of args) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/plugin-sdk",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "description": "Authoring SDK for WrongStack plugins — the plugin contract types, definePlugin, and shared runtime helpers. Third-party plugins should depend on this package only.",
   "license": "MIT",
   "author": "ECOSTACK TECHNOLOGY OÜ",
@@ -65,8 +65,8 @@
     "vitest": "^5.0.0"
   },
   "dependencies": {
-    "@wrongstack/core": "1.0.9",
-    "@wrongstack/tools": "1.0.9"
+    "@wrongstack/core": "1.0.11",
+    "@wrongstack/tools": "1.0.11"
   },
   "scripts": {
     "build": "node ../../scripts/build-package.mjs",