@wrongstack/plugins 0.277.2 → 0.280.0

package/dist/model-router.js

@@ -0,0 +1,198 @@
+// src/model-router/index.ts
+var DEFAULTS = {
+  enabled: false,
+  dryRun: true,
+  rules: []
+};
+function readConfig(raw) {
+  if (!raw || typeof raw !== "object") return { ...DEFAULTS, rules: [] };
+  const r = raw;
+  const rules = Array.isArray(r["rules"]) ? r["rules"].filter(
+    (x) => !!x && typeof x === "object" && typeof x.model === "string"
+  ).map((x) => ({
+    model: x["model"],
+    ...typeof x["maxChars"] === "number" ? { maxChars: x["maxChars"] } : {},
+    ...typeof x["minChars"] === "number" ? { minChars: x["minChars"] } : {},
+    ...typeof x["hasTools"] === "boolean" ? { hasTools: x["hasTools"] } : {}
+  })) : [];
+  return {
+    enabled: r["enabled"] === true,
+    dryRun: r["dryRun"] !== false,
+    rules
+  };
+}
+var state = {
+  invocations: 0,
+  routed: 0,
+  passthrough: 0,
+  routes: /* @__PURE__ */ new Map(),
+  extensionUnregister: null
+};
+function requestCharSize(request) {
+  let size = 0;
+  const walk = (v) => {
+    if (typeof v === "string") {
+      size += v.length;
+    } else if (Array.isArray(v)) {
+      for (const item of v) walk(item);
+    } else if (v && typeof v === "object") {
+      const o = v;
+      if (typeof o["text"] === "string") size += o["text"].length;
+      if (o["content"] !== void 0) walk(o["content"]);
+    }
+  };
+  walk(request["system"]);
+  walk(request["messages"]);
+  return size;
+}
+function pickRule(rules, size, hasTools) {
+  for (const rule of rules) {
+    if (rule.maxChars !== void 0 && size > rule.maxChars) continue;
+    if (rule.minChars !== void 0 && size < rule.minChars) continue;
+    if (rule.hasTools !== void 0 && rule.hasTools !== hasTools) continue;
+    return rule;
+  }
+  return null;
+}
+var plugin = {
+  name: "model-router",
+  version: "0.1.0",
+  description: "Routes each provider call to a different model by declarative size/tool rules (wrapProviderRunner). Opt-in; dry-run by default; routes within the active provider only.",
+  apiVersion: "^0.1.10",
+  capabilities: { tools: true },
+  defaultConfig: { ...DEFAULTS },
+  configSchema: {
+    type: "object",
+    properties: {
+      enabled: {
+        type: "boolean",
+        default: false,
+        description: "Master switch. OFF by default because rerouting changes which model serves each turn."
+      },
+      dryRun: {
+        type: "boolean",
+        default: true,
+        description: "Observe and count routing decisions without actually rewriting request.model."
+      },
+      rules: {
+        type: "array",
+        description: "Ordered rules. Each has an optional maxChars/minChars/hasTools condition and a required target model. First all-conditions-match wins.",
+        items: {
+          type: "object",
+          properties: {
+            maxChars: { type: "number", description: "Match when request char size <= this." },
+            minChars: { type: "number", description: "Match when request char size >= this." },
+            hasTools: { type: "boolean", description: "Match on tools present/absent." },
+            model: {
+              type: "string",
+              description: "Target model id (must be served by the active provider)."
+            }
+          },
+          required: ["model"]
+        }
+      }
+    }
+  },
+  setup(api) {
+    state.invocations = 0;
+    state.routed = 0;
+    state.passthrough = 0;
+    state.routes.clear();
+    if (state.extensionUnregister) {
+      try {
+        state.extensionUnregister();
+      } catch {
+      }
+      state.extensionUnregister = null;
+    }
+    const cfg = readConfig(api.config.extensions?.["model-router"]);
+    if (cfg.enabled && cfg.rules.length > 0) {
+      state.extensionUnregister = api.extensions.register({
+        name: "model-router",
+        owner: "model-router",
+        async wrapProviderRunner(_ctx, request, inner) {
+          const req = request ?? {};
+          state.invocations += 1;
+          const size = requestCharSize(req);
+          const hasTools = Array.isArray(req["tools"]) && req["tools"].length > 0;
+          const rule = pickRule(cfg.rules, size, hasTools);
+          const from = typeof req["model"] === "string" ? req["model"] : "unknown";
+          if (!rule || rule.model === from) {
+            state.passthrough += 1;
+            return inner(_ctx, request);
+          }
+          const routeKey = `${from}\u2192${rule.model}`;
+          state.routes.set(routeKey, (state.routes.get(routeKey) ?? 0) + 1);
+          state.routed += 1;
+          api.metrics.counter("routed", 1, { from, to: rule.model });
+          if (cfg.dryRun) {
+            return inner(_ctx, request);
+          }
+          return inner(_ctx, { ...req, model: rule.model });
+        }
+      });
+    }
+    api.tools.register({
+      name: "model_router_status",
+      description: "Reports model-router state: enabled, dryRun, rules, and per-route counts (from\u2192to).",
+      inputSchema: { type: "object", properties: {} },
+      permission: "auto",
+      category: "Diagnostics",
+      mutating: false,
+      async execute() {
+        return {
+          ok: true,
+          enabled: cfg.enabled,
+          dryRun: cfg.dryRun,
+          ruleCount: cfg.rules.length,
+          rules: cfg.rules,
+          counters: {
+            invocations: state.invocations,
+            routed: state.routed,
+            passthrough: state.passthrough
+          },
+          routes: Object.fromEntries(state.routes)
+        };
+      }
+    });
+    api.log.info("model-router plugin loaded", {
+      version: "0.1.0",
+      enabled: cfg.enabled,
+      dryRun: cfg.dryRun,
+      rules: cfg.rules.length
+    });
+  },
+  teardown(api) {
+    if (state.extensionUnregister) {
+      try {
+        state.extensionUnregister();
+      } catch {
+      }
+      state.extensionUnregister = null;
+    }
+    const final = {
+      invocations: state.invocations,
+      routed: state.routed,
+      passthrough: state.passthrough
+    };
+    state.invocations = 0;
+    state.routed = 0;
+    state.passthrough = 0;
+    state.routes.clear();
+    api.log.info("model-router: teardown complete", { final });
+  },
+  async health() {
+    return {
+      ok: true,
+      message: `model-router: ${state.routed} routed / ${state.passthrough} passthrough of ${state.invocations} call(s)`,
+      counters: {
+        invocations: state.invocations,
+        routed: state.routed,
+        passthrough: state.passthrough
+      }
+    };
+  }
+};
+var model_router_default = plugin;
+
+export { model_router_default as default, pickRule, requestCharSize };

package/dist/notify-hub.d.ts

@@ -0,0 +1,45 @@
+import { Plugin } from '@wrongstack/core';
+
+/**
+ * notify-hub plugin — pushes session events to a webhook.
+ *
+ * Long-running autonomous sessions need a way to reach the user when
+ * something noteworthy happens and nobody is watching the terminal.
+ * notify-hub POSTs compact JSON payloads to a configurable webhook
+ * URL (Slack/Discord-compatible via generic JSON, n8n, ntfy, or any
+ * HTTP endpoint) for a configurable set of events:
+ *
+ *  - `session.stop`      — the agent loop ended (Stop hook)
+ *  - `tool.error`        — a tool invocation failed
+ *  - `budget.threshold`  — a budget threshold event fired on the bus
+ *
+ * Deliveries are fire-and-forget with a timeout — a dead webhook can
+ * never stall the agent. Failures are counted and reported via
+ * `notify_hub_status` / `health()`, and delivery stops trying after
+ * `maxConsecutiveFailures` (circuit breaker) until setup runs again.
+ *
+ * The agent can also send an ad-hoc notification with `notify_send`
+ * ("tell the user the migration finished").
+ *
+ * Config (`config.extensions['notify-hub']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "webhookUrl": "",                  // empty = plugin idles
+ *   "events": ["session.stop", "tool.error"],
+ *   "headers": {},                     // extra HTTP headers (auth…)
+ *   "timeoutMs": 5000,
+ *   "maxConsecutiveFailures": 5
+ * }
+ * ```
+ *
+ * Toggle off with `{ "name": "notify-hub", "enabled": false }` in
+ * `config.plugins`, or `"enabled": false` in the options above.
+ *
+ * @public
+ */
+
+declare const plugin: Plugin;
+
+export { plugin as default };

package/dist/notify-hub.js

@@ -0,0 +1,304 @@
+// src/notify-hub/index.ts
+var state = {
+  sent: 0,
+  failed: 0,
+  suppressed: 0,
+  consecutiveFailures: 0,
+  circuitOpen: false,
+  lastDelivery: null,
+  stopHookUnregister: null,
+  eventUnsubscribers: []
+};
+var KNOWN_EVENTS = ["session.stop", "tool.error", "budget.threshold"];
+var DEFAULTS = {
+  enabled: true,
+  webhookUrl: "",
+  events: ["session.stop", "tool.error"],
+  headers: {},
+  timeoutMs: 5e3,
+  maxConsecutiveFailures: 5
+};
+function readConfig(raw) {
+  if (!raw || typeof raw !== "object") return { ...DEFAULTS, events: [...DEFAULTS.events] };
+  const r = raw;
+  const headers = {};
+  if (r["headers"] && typeof r["headers"] === "object" && !Array.isArray(r["headers"])) {
+    for (const [k, v] of Object.entries(r["headers"])) {
+      if (typeof v === "string") headers[k] = v;
+    }
+  }
+  return {
+    enabled: r["enabled"] !== false,
+    webhookUrl: typeof r["webhookUrl"] === "string" ? r["webhookUrl"] : "",
+    events: Array.isArray(r["events"]) ? r["events"].filter((e) => KNOWN_EVENTS.includes(e)) : [...DEFAULTS.events],
+    headers,
+    timeoutMs: typeof r["timeoutMs"] === "number" && r["timeoutMs"] >= 500 && r["timeoutMs"] <= 6e4 ? r["timeoutMs"] : DEFAULTS.timeoutMs,
+    maxConsecutiveFailures: typeof r["maxConsecutiveFailures"] === "number" && r["maxConsecutiveFailures"] >= 1 ? r["maxConsecutiveFailures"] : DEFAULTS.maxConsecutiveFailures
+  };
+}
+async function deliver(cfg, event, payload, log) {
+  if (!cfg.webhookUrl) return false;
+  if (state.circuitOpen) {
+    state.suppressed += 1;
+    return false;
+  }
+  const body = JSON.stringify({
+    source: "wrongstack/notify-hub",
+    event,
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    ...payload
+  });
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), cfg.timeoutMs);
+    try {
+      const res = await fetch(cfg.webhookUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json", ...cfg.headers },
+        body,
+        signal: controller.signal
+      });
+      if (!res.ok) throw new Error(`webhook responded ${res.status}`);
+    } finally {
+      clearTimeout(timer);
+    }
+    state.sent += 1;
+    state.consecutiveFailures = 0;
+    state.lastDelivery = { event, ok: true, when: (/* @__PURE__ */ new Date()).toISOString() };
+    return true;
+  } catch (err) {
+    state.failed += 1;
+    state.consecutiveFailures += 1;
+    state.lastDelivery = { event, ok: false, when: (/* @__PURE__ */ new Date()).toISOString() };
+    if (state.consecutiveFailures >= cfg.maxConsecutiveFailures) {
+      state.circuitOpen = true;
+      log.warn(
+        `notify-hub: ${state.consecutiveFailures} consecutive delivery failures \u2014 circuit opened, further notifications suppressed`,
+        { error: err instanceof Error ? err.message : String(err) }
+      );
+    }
+    return false;
+  }
+}
+function truncateText(s, max) {
+  return s.length > max ? `${s.slice(0, max)}\u2026` : s;
+}
+var plugin = {
+  name: "notify-hub",
+  version: "0.1.0",
+  description: "POSTs session events (stop, tool errors, budget thresholds) and ad-hoc notify_send messages to a configurable webhook",
+  apiVersion: "^0.1.10",
+  capabilities: { tools: true, hooks: true },
+  defaultConfig: { ...DEFAULTS },
+  configSchema: {
+    type: "object",
+    properties: {
+      enabled: { type: "boolean", default: true, description: "Master switch." },
+      webhookUrl: {
+        type: "string",
+        default: "",
+        description: "HTTP(S) endpoint that receives JSON POSTs. Empty = plugin idles."
+      },
+      events: {
+        type: "array",
+        items: { type: "string", enum: KNOWN_EVENTS },
+        default: ["session.stop", "tool.error"],
+        description: "Which events trigger a webhook delivery."
+      },
+      headers: {
+        type: "object",
+        default: {},
+        description: "Extra HTTP headers sent with every delivery (e.g. Authorization)."
+      },
+      timeoutMs: {
+        type: "number",
+        minimum: 500,
+        maximum: 6e4,
+        default: 5e3,
+        description: "Per-delivery timeout."
+      },
+      maxConsecutiveFailures: {
+        type: "number",
+        minimum: 1,
+        default: 5,
+        description: "Circuit breaker: stop trying after this many consecutive failures."
+      }
+    }
+  },
+  setup(api) {
+    state.sent = 0;
+    state.failed = 0;
+    state.suppressed = 0;
+    state.consecutiveFailures = 0;
+    state.circuitOpen = false;
+    state.lastDelivery = null;
+    if (state.stopHookUnregister) {
+      try {
+        state.stopHookUnregister();
+      } catch {
+      }
+      state.stopHookUnregister = null;
+    }
+    for (const off of state.eventUnsubscribers) {
+      try {
+        off();
+      } catch {
+      }
+    }
+    state.eventUnsubscribers = [];
+    const cfg = readConfig(api.config.extensions?.["notify-hub"]);
+    const active = cfg.enabled && cfg.webhookUrl.length > 0;
+    if (active && cfg.events.includes("session.stop")) {
+      const stopHook = (input) => {
+        void deliver(
+          cfg,
+          "session.stop",
+          { sessionId: input.sessionId ?? null, cwd: input.cwd ?? null },
+          api.log
+        );
+      };
+      state.stopHookUnregister = api.registerHook("Stop", void 0, stopHook);
+    }
+    if (active && cfg.events.includes("tool.error")) {
+      const off = api.onPattern("tool.*", (eventName, payload) => {
+        if (!/error|failed/.test(eventName)) return;
+        const p = payload;
+        void deliver(
+          cfg,
+          "tool.error",
+          {
+            tool: p?.tool ?? p?.name ?? "unknown",
+            busEvent: eventName,
+            error: truncateText(
+              p?.error instanceof Error ? p.error.message : String(p?.error ?? ""),
+              500
+            )
+          },
+          api.log
+        );
+      });
+      state.eventUnsubscribers.push(off);
+    }
+    if (active && cfg.events.includes("budget.threshold")) {
+      const off = api.onPattern("budget.*", (eventName, payload) => {
+        if (!eventName.includes("threshold")) return;
+        void deliver(cfg, "budget.threshold", { busEvent: eventName, detail: payload }, api.log);
+      });
+      state.eventUnsubscribers.push(off);
+    }
+    api.tools.register({
+      name: "notify_send",
+      description: 'Send an ad-hoc notification to the configured webhook (e.g. "migration finished", "need input"). No-op when notify-hub has no webhookUrl.',
+      inputSchema: {
+        type: "object",
+        properties: {
+          title: { type: "string", description: "Short notification title." },
+          message: { type: "string", description: "Notification body." },
+          level: {
+            type: "string",
+            enum: ["info", "warning", "critical"],
+            description: "Severity hint for the receiver (default info)."
+          }
+        },
+        required: ["message"]
+      },
+      permission: "auto",
+      category: "Notifications",
+      mutating: true,
+      async execute(input) {
+        if (!cfg.enabled) return { ok: false, error: "notify-hub is disabled" };
+        if (!cfg.webhookUrl) {
+          return {
+            ok: false,
+            error: 'no webhookUrl configured \u2014 set config.extensions["notify-hub"].webhookUrl to enable deliveries'
+          };
+        }
+        const delivered = await deliver(
+          cfg,
+          "manual",
+          {
+            title: truncateText(String(input.title ?? "WrongStack notification"), 200),
+            message: truncateText(String(input.message ?? ""), 2e3),
+            level: input.level === "warning" || input.level === "critical" ? input.level : "info"
+          },
+          api.log
+        );
+        return {
+          ok: delivered,
+          circuitOpen: state.circuitOpen,
+          ...delivered ? {} : { error: "delivery failed (see notify_hub_status)" }
+        };
+      }
+    });
+    api.tools.register({
+      name: "notify_hub_status",
+      description: "Reports notify-hub state: webhook configuration (URL redacted), subscribed events, and delivery counters.",
+      inputSchema: { type: "object", properties: {} },
+      permission: "auto",
+      category: "Diagnostics",
+      mutating: false,
+      async execute() {
+        return {
+          ok: true,
+          enabled: cfg.enabled,
+          webhookConfigured: cfg.webhookUrl.length > 0,
+          events: cfg.events,
+          timeoutMs: cfg.timeoutMs,
+          circuitOpen: state.circuitOpen,
+          counters: {
+            sent: state.sent,
+            failed: state.failed,
+            suppressed: state.suppressed,
+            consecutiveFailures: state.consecutiveFailures
+          },
+          lastDelivery: state.lastDelivery
+        };
+      }
+    });
+    api.log.info("notify-hub plugin loaded", {
+      version: "0.1.0",
+      enabled: cfg.enabled,
+      webhookConfigured: cfg.webhookUrl.length > 0,
+      events: cfg.events
+    });
+  },
+  teardown(api) {
+    if (state.stopHookUnregister) {
+      try {
+        state.stopHookUnregister();
+      } catch {
+      }
+      state.stopHookUnregister = null;
+    }
+    for (const off of state.eventUnsubscribers) {
+      try {
+        off();
+      } catch {
+      }
+    }
+    state.eventUnsubscribers = [];
+    const final = { sent: state.sent, failed: state.failed, suppressed: state.suppressed };
+    state.sent = 0;
+    state.failed = 0;
+    state.suppressed = 0;
+    state.consecutiveFailures = 0;
+    state.circuitOpen = false;
+    state.lastDelivery = null;
+    api.log.info("notify-hub: teardown complete", { final });
+  },
+  async health() {
+    return {
+      ok: !state.circuitOpen,
+      message: state.circuitOpen ? `notify-hub: circuit OPEN after ${state.consecutiveFailures} consecutive failures \u2014 deliveries suppressed` : `notify-hub: ${state.sent} sent, ${state.failed} failed, ${state.suppressed} suppressed`,
+      counters: {
+        sent: state.sent,
+        failed: state.failed,
+        suppressed: state.suppressed,
+        consecutiveFailures: state.consecutiveFailures
+      }
+    };
+  }
+};
+var notify_hub_default = plugin;
+
+export { notify_hub_default as default };

package/dist/path-guard.d.ts

@@ -0,0 +1,54 @@
+import { Plugin } from '@wrongstack/core';
+
+/**
+ * path-guard plugin — blocks (or warns about) writes, edits, and
+ * destructive shell commands that touch protected paths.
+ *
+ * `branch-guard` protects git *branches*; this plugin protects
+ * *files and directories*. A `PreToolUse` hook on `write|edit|bash`
+ * matches the target path against a configurable glob list:
+ *
+ *  - `write` / `edit` → the `path` / `file_path` input field
+ *  - `bash`           → destructive commands only (`rm`, `rmdir`,
+ *    `mv`, `del`, output redirection `>` / `>>`, `truncate`) whose
+ *    arguments mention a protected path
+ *
+ * Default protected set: lockfiles, `.env*` secrets, `.git/`
+ * internals, and production migration folders — files an agent
+ * should virtually never rewrite by hand.
+ *
+ * Config (`config.extensions['path-guard']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "mode": "block",                     // "block" | "warn"
+ *   "protect": ["pnpm-lock.yaml", ".env*", ".git/**", "**/migrations/**"],
+ *   "allow": []                          // globs that override protect
+ * }
+ * ```
+ *
+ * Toggle off with `{ "name": "path-guard", "enabled": false }` in
+ * `config.plugins`, or `"enabled": false` in the options above.
+ *
+ * @public
+ */
+
+/**
+ * Compile a glob pattern to a RegExp. Supports `**` (any depth),
+ * `*` (within one segment), and `?` (single char). Matching is done
+ * against forward-slash-normalized relative-ish paths, and a pattern
+ * without a slash matches the basename anywhere in the tree
+ * (`.env` matches `sub/dir/.env`).
+ */
+declare function compilePathGlob(pattern: string): RegExp;
+/**
+ * Extract candidate target paths from a shell command, but only when
+ * the command looks destructive. Non-destructive commands (cat, ls,
+ * grep …) never trigger the guard, even if they mention a protected
+ * path.
+ */
+declare function destructiveTargets(command: string): string[];
+declare const plugin: Plugin;
+
+export { compilePathGlob, plugin as default, destructiveTargets };