@wrongstack/plugins 0.277.1 → 0.280.0

package/dist/cost-tracker.js

@@ -14,6 +14,9 @@ var PRICING = {
   "default": { input: 5, output: 15 }
 };
 var DEFAULT_PRICING = { input: 5, output: 15 };
+var pricingOverrides = {};
+var bundledFromRegistry = {};
+var lastCost = { usd: 0, model: null, at: null };
 function readCostTrackerConfig(raw) {
   return {
     budgetLimit: typeof raw?.["budgetLimit"] === "number" ? raw["budgetLimit"] : 0,
@@ -21,7 +24,8 @@ function readCostTrackerConfig(raw) {
   };
 }
 function estimateCost(model, promptTokens, completionTokens) {
-  const pricing = PRICING[model.toLowerCase()] ?? DEFAULT_PRICING;
+  const key = model.toLowerCase();
+  const pricing = pricingOverrides[key] ?? bundledFromRegistry[key] ?? PRICING[key] ?? DEFAULT_PRICING;
   const inputCost = promptTokens / 1e6 * pricing.input;
   const outputCost = completionTokens / 1e6 * pricing.output;
   return inputCost + outputCost;
@@ -36,7 +40,8 @@ var plugin = {
     trackPerModel: true,
     trackPerUser: false,
     budgetLimit: 0,
-    warningThreshold: 80
+    warningThreshold: 80,
+    pricingOverrides: {}
   },
   configSchema: {
     type: "object",
@@ -44,10 +49,73 @@ var plugin = {
       trackPerModel: { type: "boolean", default: true },
       trackPerUser: { type: "boolean", default: false },
       budgetLimit: { type: "number", default: 0, description: "Budget limit in USD (0 = no limit)" },
-      warningThreshold: { type: "number", default: 80, description: "Warning threshold as percentage of budget" }
+      warningThreshold: { type: "number", default: 80, description: "Warning threshold as percentage of budget" },
+      pricingOverrides: {
+        type: "object",
+        description: "Per-model pricing overrides in USD per 1M tokens. Keys are lowercased model names; values are { input, output }. Takes precedence over the bundled PRICING table.",
+        additionalProperties: {
+          type: "object",
+          properties: {
+            input: { type: "number", minimum: 0, description: "Cost per 1M input tokens in USD" },
+            output: { type: "number", minimum: 0, description: "Cost per 1M output tokens in USD" }
+          },
+          required: ["input", "output"],
+          additionalProperties: false
+        },
+        default: {}
+      }
     }
   },
-  setup(api) {
+  async setup(api) {
+    for (const k of Object.keys(pricingOverrides)) {
+      delete pricingOverrides[k];
+    }
+    for (const k of Object.keys(bundledFromRegistry)) {
+      delete bundledFromRegistry[k];
+    }
+    lastCost.usd = 0;
+    lastCost.model = null;
+    lastCost.at = null;
+    const rawConfig = api.config.extensions?.["cost-tracker"];
+    const userOverrides = rawConfig?.["pricingOverrides"];
+    if (userOverrides && typeof userOverrides === "object") {
+      for (const [model, value] of Object.entries(userOverrides)) {
+        if (!value || typeof value !== "object") continue;
+        const v = value;
+        const input = v["input"];
+        const output = v["output"];
+        if (typeof input !== "number" || typeof output !== "number") continue;
+        pricingOverrides[model.toLowerCase()] = { input, output };
+      }
+    }
+    if (api.modelsRegistry) {
+      try {
+        const payload = await api.modelsRegistry.load();
+        let hydrated = 0;
+        for (const provider of Object.values(payload)) {
+          const providerModels = provider?.models;
+          if (!providerModels) continue;
+          for (const [modelId, model] of Object.entries(providerModels)) {
+            const cost = model?.cost;
+            if (cost && typeof cost.input === "number" && typeof cost.output === "number") {
+              bundledFromRegistry[modelId.toLowerCase()] = {
+                input: cost.input,
+                output: cost.output
+              };
+              hydrated += 1;
+            }
+          }
+        }
+        api.log.info("cost-tracker: hydrated pricing from models registry", {
+          models: hydrated
+        });
+      } catch (err) {
+        api.log.warn(
+          "cost-tracker: failed to hydrate pricing from models registry \u2014 using bundled PRICING",
+          err
+        );
+      }
+    }
     const sessionCost = {
       requests: [],
       totalPromptTokens: 0,
@@ -85,6 +153,9 @@ var plugin = {
       slot.requests += 1;
       api.metrics.counter("tokens_total", totalTokens, { model });
       api.metrics.histogram("cost_usd", costUsd, { model });
+      lastCost.usd = costUsd;
+      lastCost.model = model;
+      lastCost.at = (/* @__PURE__ */ new Date()).toISOString();
     });
     api.tools.register({
       name: "cost_summary",
@@ -216,6 +287,36 @@ var plugin = {
       }
     });
     api.log.info("cost-tracker plugin loaded", { version: "0.1.0" });
+  },
+  teardown(api) {
+    const overrideCount = Object.keys(pricingOverrides).length;
+    const registryCount = Object.keys(bundledFromRegistry).length;
+    for (const k of Object.keys(pricingOverrides)) {
+      delete pricingOverrides[k];
+    }
+    for (const k of Object.keys(bundledFromRegistry)) {
+      delete bundledFromRegistry[k];
+    }
+    const finalLast = { ...lastCost };
+    lastCost.usd = 0;
+    lastCost.model = null;
+    lastCost.at = null;
+    api.log.info("cost-tracker: teardown complete", {
+      overrideCount,
+      registryCount,
+      lastModel: finalLast.model
+    });
+  },
+  async health() {
+    return {
+      ok: true,
+      message: lastCost.model === null ? "cost-tracker: no requests recorded yet this session" : `cost-tracker: last ${lastCost.model} cost=${lastCost.usd.toFixed(6)} at ${lastCost.at}`,
+      overrideCount: Object.keys(pricingOverrides).length,
+      registryCount: Object.keys(bundledFromRegistry).length,
+      lastCostUsd: lastCost.usd,
+      lastCostModel: lastCost.model,
+      lastCostAt: lastCost.at
+    };
   }
 };
 var cost_tracker_default = plugin;

package/dist/dep-guard.d.ts

@@ -0,0 +1,65 @@
+import { Plugin } from '@wrongstack/core';
+
+/**
+ * dep-guard plugin — supervises dependency-install commands.
+ *
+ * Supply-chain safety at the point of no return: a `PreToolUse` hook
+ * on `bash|exec` parses package-manager install commands
+ * (`npm i`, `pnpm add`, `yarn add`, `bun add`, `pip install`,
+ * `cargo add`) and extracts the package names being added:
+ *
+ *  - packages on the `deny` list        → blocked (or warned in
+ *    warn mode) with the configured reason
+ *  - typosquat lookalikes of `popular`  → warned ("did you mean
+ *    react? you typed raect") via Levenshtein distance 1
+ *  - unpinned installs (no version)     → optional warning when
+ *    `warnOnUnpinned` is set
+ *  - every install                      → a compact context note so
+ *    the model consciously confirms new dependencies
+ *
+ * Non-install commands pass through untouched.
+ *
+ * Config (`config.extensions['dep-guard']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "mode": "block",           // "block" | "warn" (deny-list handling)
+ *   "deny": [],                 // exact names or prefix globs ("left-pad", "@evil/*")
+ *   "allow": [],                // exemptions from deny
+ *   "warnOnUnpinned": false,    // warn when no version is specified
+ *   "typosquatCheck": true      // warn on 1-edit lookalikes of popular packages
+ * }
+ * ```
+ *
+ * Toggle off with `{ "name": "dep-guard", "enabled": false }` in
+ * `config.plugins`, or `"enabled": false` in the options above.
+ *
+ * @public
+ */
+
+interface ParsedInstall {
+    manager: string;
+    packages: Array<{
+        name: string;
+        version: string | null;
+    }>;
+}
+/**
+ * Parse a shell command for dependency installs. Returns one entry
+ * per install segment found (compound commands can contain several).
+ * Bare `npm install` (restore from lockfile, no packages) yields an
+ * empty package list and is NOT treated as adding dependencies.
+ */
+declare function parseInstallCommands(command: string): ParsedInstall[];
+/**
+ * Optimal-string-alignment distance (Levenshtein + adjacent
+ * transposition). Transpositions count as ONE edit because they are
+ * the classic typosquat vector: `lodahs` → `lodash`, `raect` → `react`.
+ * Package names are short, so the full matrix is cheap.
+ */
+declare function editDistance(a: string, b: string): number;
+declare function typosquatOf(name: string): string | null;
+declare const plugin: Plugin;
+
+export { type ParsedInstall, plugin as default, editDistance, parseInstallCommands, typosquatOf };

package/dist/dep-guard.js

@@ -0,0 +1,316 @@
+// src/dep-guard/index.ts
+var state = {
+  invocations: 0,
+  installsSeen: 0,
+  blocks: 0,
+  warns: 0,
+  lastBlock: null,
+  hookUnregister: null
+};
+var DEFAULTS = {
+  enabled: true,
+  mode: "block",
+  deny: [],
+  allow: [],
+  warnOnUnpinned: false,
+  typosquatCheck: true
+};
+function readConfig(raw) {
+  if (!raw || typeof raw !== "object") return { ...DEFAULTS };
+  const r = raw;
+  const strings = (v) => Array.isArray(v) ? v.filter((s) => typeof s === "string" && s.length > 0) : [];
+  return {
+    enabled: r["enabled"] !== false,
+    mode: r["mode"] === "warn" ? "warn" : "block",
+    deny: strings(r["deny"]),
+    allow: strings(r["allow"]),
+    warnOnUnpinned: r["warnOnUnpinned"] === true,
+    typosquatCheck: r["typosquatCheck"] !== false
+  };
+}
+var INSTALL_RE = /(?:^|[;&|]\s*)(npm|pnpm|yarn|bun)\s+(?:install|i|add)\s+([^;&|]+)|(?:^|[;&|]\s*)(pip3?|uv)\s+(?:pip\s+)?install\s+([^;&|]+)|(?:^|[;&|]\s*)(cargo)\s+add\s+([^;&|]+)/gi;
+function parseInstallCommands(command) {
+  const out = [];
+  INSTALL_RE.lastIndex = 0;
+  let m = INSTALL_RE.exec(command);
+  while (m !== null) {
+    const manager = (m[1] ?? m[3] ?? m[5] ?? "").toLowerCase();
+    const argString = m[2] ?? m[4] ?? m[6] ?? "";
+    const packages = [];
+    for (const token of argString.split(/\s+/)) {
+      if (!token || token.startsWith("-")) continue;
+      if (/^(\.|\/|file:|git\+|https?:)/i.test(token) || token.endsWith(".tgz")) continue;
+      const cleaned = token.replace(/^['"]|['"]$/g, "");
+      if (!cleaned) continue;
+      let name = cleaned;
+      let version = null;
+      const pipMatch = /^([A-Za-z0-9_.-]+)\s*(?:==|>=|<=|~=|!=|>|<)\s*(.+)$/.exec(cleaned);
+      if (pipMatch?.[1]) {
+        name = pipMatch[1];
+        version = pipMatch[2] ?? null;
+      } else {
+        const at = cleaned.lastIndexOf("@");
+        if (at > 0) {
+          name = cleaned.slice(0, at);
+          version = cleaned.slice(at + 1) || null;
+        }
+      }
+      if (name) packages.push({ name, version });
+    }
+    out.push({ manager, packages });
+    m = INSTALL_RE.exec(command);
+  }
+  return out;
+}
+function matchesPattern(name, pattern) {
+  if (pattern.endsWith("*"))
+    return name.toLowerCase().startsWith(pattern.slice(0, -1).toLowerCase());
+  return name.toLowerCase() === pattern.toLowerCase();
+}
+var POPULAR_PACKAGES = [
+  "react",
+  "react-dom",
+  "express",
+  "lodash",
+  "axios",
+  "typescript",
+  "vite",
+  "vitest",
+  "next",
+  "vue",
+  "svelte",
+  "zod",
+  "prettier",
+  "eslint",
+  "jest",
+  "webpack",
+  "commander",
+  "chalk",
+  "dotenv",
+  "requests",
+  "numpy",
+  "pandas",
+  "flask",
+  "django",
+  "serde",
+  "tokio"
+];
+function editDistance(a, b) {
+  if (a === b) return 0;
+  if (Math.abs(a.length - b.length) > 2) return 3;
+  const d = Array.from({ length: a.length + 1 }, (_, i) => {
+    const row = new Array(b.length + 1).fill(0);
+    row[0] = i;
+    return row;
+  });
+  for (let j = 0; j <= b.length; j++) d[0][j] = j;
+  for (let i = 1; i <= a.length; i++) {
+    for (let j = 1; j <= b.length; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      const row = d[i];
+      const prevRow = d[i - 1];
+      row[j] = Math.min(
+        prevRow[j] + 1,
+        row[j - 1] + 1,
+        prevRow[j - 1] + cost
+      );
+      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+        row[j] = Math.min(row[j], d[i - 2][j - 2] + 1);
+      }
+    }
+  }
+  return d[a.length][b.length];
+}
+function typosquatOf(name) {
+  const lower = name.toLowerCase().replace(/^@[^/]+\//, "");
+  if (POPULAR_PACKAGES.includes(lower)) return null;
+  for (const popular of POPULAR_PACKAGES) {
+    if (editDistance(lower, popular) === 1) return popular;
+  }
+  return null;
+}
+var plugin = {
+  name: "dep-guard",
+  version: "0.1.0",
+  description: "Supervises dependency installs: blocks deny-listed packages, flags typosquat lookalikes, and optionally warns on unpinned versions",
+  apiVersion: "^0.1.10",
+  capabilities: { tools: true, hooks: true },
+  defaultConfig: { ...DEFAULTS },
+  configSchema: {
+    type: "object",
+    properties: {
+      enabled: { type: "boolean", default: true, description: "Master switch." },
+      mode: {
+        type: "string",
+        enum: ["block", "warn"],
+        default: "block",
+        description: "How deny-list hits are handled."
+      },
+      deny: {
+        type: "array",
+        items: { type: "string" },
+        default: [],
+        description: 'Package names (exact) or prefix globs ("@evil/*") that must not be installed.'
+      },
+      allow: {
+        type: "array",
+        items: { type: "string" },
+        default: [],
+        description: "Exemptions that override deny."
+      },
+      warnOnUnpinned: {
+        type: "boolean",
+        default: false,
+        description: "Warn when a package is installed without an explicit version."
+      },
+      typosquatCheck: {
+        type: "boolean",
+        default: true,
+        description: "Warn when a package name is one edit away from a well-known package."
+      }
+    }
+  },
+  setup(api) {
+    state.invocations = 0;
+    state.installsSeen = 0;
+    state.blocks = 0;
+    state.warns = 0;
+    state.lastBlock = null;
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
+    const cfg = readConfig(api.config.extensions?.["dep-guard"]);
+    const hook = (input) => {
+      if (!cfg.enabled) return;
+      state.invocations += 1;
+      const ti = input.toolInput ?? {};
+      const command = typeof ti["command"] === "string" ? ti["command"] : "";
+      if (!command) return;
+      const installs = parseInstallCommands(command);
+      const packages = installs.flatMap((i) => i.packages);
+      if (packages.length === 0) return;
+      state.installsSeen += 1;
+      api.metrics.counter("installs_seen");
+      const notes = [];
+      for (const pkg of packages) {
+        const allowed = cfg.allow.some((p) => matchesPattern(pkg.name, p));
+        const denied = !allowed && cfg.deny.some((p) => matchesPattern(pkg.name, p));
+        if (denied) {
+          if (cfg.mode === "block") {
+            state.blocks += 1;
+            state.lastBlock = {
+              pkg: pkg.name,
+              command: command.slice(0, 200),
+              when: (/* @__PURE__ */ new Date()).toISOString()
+            };
+            api.metrics.counter("blocks");
+            return {
+              decision: "block",
+              reason: `dep-guard: package "${pkg.name}" is on the deny list (config.extensions["dep-guard"].deny) \u2014 install refused. Ask the user before adding this dependency, or add an \`allow\` entry.`
+            };
+          }
+          notes.push(
+            `"${pkg.name}" is DENY-LISTED \u2014 do not add it without explicit user approval.`
+          );
+        }
+        if (cfg.typosquatCheck) {
+          const lookalike = typosquatOf(pkg.name);
+          if (lookalike) {
+            notes.push(
+              `"${pkg.name}" is one edit away from the well-known package "${lookalike}" \u2014 possible typosquat. Verify the name before installing.`
+            );
+          }
+        }
+        if (cfg.warnOnUnpinned && pkg.version === null) {
+          notes.push(`"${pkg.name}" has no pinned version \u2014 consider "${pkg.name}@<version>".`);
+        }
+      }
+      if (notes.length > 0) {
+        state.warns += 1;
+        api.metrics.counter("warns");
+        return {
+          decision: "allow",
+          additionalContext: `dep-guard:
+${notes.map((n) => `  - ${n}`).join("\n")}`
+        };
+      }
+      return {
+        decision: "allow",
+        additionalContext: `dep-guard: this command adds ${packages.length} dependenc${packages.length === 1 ? "y" : "ies"}: ${packages.map((p) => p.name).join(", ")}. Confirm each is intentional.`
+      };
+    };
+    state.hookUnregister = api.registerHook("PreToolUse", "bash|exec", hook);
+    api.tools.register({
+      name: "dep_guard_status",
+      description: "Reports dep-guard state: deny/allow lists, mode, and counters (installs seen, blocks, warns).",
+      inputSchema: { type: "object", properties: {} },
+      permission: "auto",
+      category: "Diagnostics",
+      mutating: false,
+      async execute() {
+        return {
+          ok: true,
+          enabled: cfg.enabled,
+          mode: cfg.mode,
+          deny: cfg.deny,
+          allow: cfg.allow,
+          warnOnUnpinned: cfg.warnOnUnpinned,
+          typosquatCheck: cfg.typosquatCheck,
+          counters: {
+            invocations: state.invocations,
+            installsSeen: state.installsSeen,
+            blocks: state.blocks,
+            warns: state.warns
+          },
+          lastBlock: state.lastBlock
+        };
+      }
+    });
+    api.log.info("dep-guard plugin loaded", {
+      version: "0.1.0",
+      enabled: cfg.enabled,
+      mode: cfg.mode,
+      denyCount: cfg.deny.length
+    });
+  },
+  teardown(api) {
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
+    const final = {
+      invocations: state.invocations,
+      installsSeen: state.installsSeen,
+      blocks: state.blocks,
+      warns: state.warns
+    };
+    state.invocations = 0;
+    state.installsSeen = 0;
+    state.blocks = 0;
+    state.warns = 0;
+    state.lastBlock = null;
+    api.log.info("dep-guard: teardown complete", { final });
+  },
+  async health() {
+    return {
+      ok: true,
+      message: state.lastBlock === null ? `dep-guard: ${state.installsSeen} install command(s) seen, ${state.blocks} block(s), ${state.warns} warn(s)` : `dep-guard: last block on "${state.lastBlock.pkg}" at ${state.lastBlock.when}`,
+      counters: {
+        invocations: state.invocations,
+        installsSeen: state.installsSeen,
+        blocks: state.blocks,
+        warns: state.warns
+      }
+    };
+  }
+};
+var dep_guard_default = plugin;
+
+export { dep_guard_default as default, editDistance, parseInstallCommands, typosquatOf };

package/dist/diff-summary.d.ts

@@ -0,0 +1,36 @@
+import { Plugin } from '@wrongstack/core';
+
+/**
+ * diff-summary plugin — PostToolUse hook that injects a compact diff
+ * into the LLM's context after every `write` or `edit`.
+ *
+ * Tools registered:
+ * - diff_summary_status : Show config + per-session counters.
+ *
+ * Hooks registered:
+ * - PostToolUse with matcher `write|edit`. After the tool completes,
+ *   runs `git diff -- <path>` to capture what changed and injects a
+ *   capped unified diff (or stat summary) as `additionalContext`.
+ *
+ * Config (`config.extensions['diff-summary']`):
+ *
+ * ```jsonc
+ * {
+ *   "maxLines": 50,       // cap diff context at N lines
+ *   "showStat": true,     // include "+N -M" summary line
+ *   "mode": "diff"        // "diff" (unified diff) | "stat" (counts only) | "off"
+ * }
+ * ```
+ *
+ * Why: The `write` tool's result doesn't include a diff. The `edit`
+ * tool shows the replacement but not the full file context. This
+ * plugin gives the LLM consistent, compact visibility into what its
+ * change actually did to the file — confirming the edit applied
+ * correctly and showing surrounding context.
+ *
+ * @public
+ */
+
+declare const plugin: Plugin;
+
+export { plugin as default };