@wrongstack/plugins 0.281.0 → 0.281.1

package/dist/notify-hub.js

@@ -18,6 +18,31 @@ var DEFAULTS = {
   timeoutMs: 5e3,
   maxConsecutiveFailures: 5
 };
+function isPrivateIPv4(hostname) {
+  const parts = hostname.split(".").map((p) => Number(p));
+  if (parts.length !== 4 || parts.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) {
+    return false;
+  }
+  const [a, b] = parts;
+  return a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+}
+function isBlockedHostname(hostname) {
+  const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  return h === "localhost" || h.endsWith(".localhost") || h === "::1" || h === "0:0:0:0:0:0:0:1" || h.startsWith("fc") || h.startsWith("fd") || h.startsWith("fe80:") || isPrivateIPv4(h);
+}
+function normalizeWebhookUrl(raw) {
+  if (typeof raw !== "string" || raw.trim().length === 0) return "";
+  try {
+    const url = new URL(raw.trim());
+    if (url.protocol !== "https:" && url.protocol !== "http:") return "";
+    if (url.username || url.password) return "";
+    if (!url.hostname || isBlockedHostname(url.hostname)) return "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return "";
+  }
+}
 function readConfig(raw) {
   if (!raw || typeof raw !== "object") return { ...DEFAULTS, events: [...DEFAULTS.events] };
   const r = raw;
@@ -29,7 +54,7 @@ function readConfig(raw) {
   }
   return {
     enabled: r["enabled"] !== false,
-    webhookUrl: typeof r["webhookUrl"] === "string" ? r["webhookUrl"] : "",
+    webhookUrl: normalizeWebhookUrl(r["webhookUrl"]),
     events: Array.isArray(r["events"]) ? r["events"].filter((e) => KNOWN_EVENTS.includes(e)) : [...DEFAULTS.events],
     headers,
     timeoutMs: typeof r["timeoutMs"] === "number" && r["timeoutMs"] >= 500 && r["timeoutMs"] <= 6e4 ? r["timeoutMs"] : DEFAULTS.timeoutMs,

package/dist/semver-bump.js

@@ -2,10 +2,18 @@ import { expectDefined } from '@wrongstack/core';
 import { toErrorMessage } from '@wrongstack/core/utils';
 import { execFileSync } from 'child_process';
 import { existsSync, readFileSync, writeFileSync, readdirSync } from 'fs';
-import { join } from 'path';
+import { join, resolve, isAbsolute, relative } from 'path';
 
 // src/semver-bump/index.ts
 var API_VERSION = "^0.1.10";
+function resolveProjectRoot(rawCwd, root = process.cwd()) {
+  if (typeof rawCwd !== "string" || rawCwd.length === 0) return root;
+  const base = resolve(root);
+  const resolved = isAbsolute(rawCwd) ? resolve(rawCwd) : resolve(base, rawCwd);
+  const rel = relative(base, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel)) return resolved;
+  return null;
+}
 var state = {
   /** Total invocations across all three tools this session. */
   invocationCount: 0,
@@ -56,7 +64,11 @@ function collectManifests(root) {
 function parseVersion(v) {
   const m = v.match(/^v?(\d+)\.(\d+)\.(\d+)/);
   if (!m) return [0, 0, 0];
-  return [Number.parseInt(expectDefined(m[1]), 10), Number.parseInt(expectDefined(m[2]), 10), Number.parseInt(expectDefined(m[3]), 10)];
+  return [
+    Number.parseInt(expectDefined(m[1]), 10),
+    Number.parseInt(expectDefined(m[2]), 10),
+    Number.parseInt(expectDefined(m[3]), 10)
+  ];
 }
 function bumpVersion(version, part) {
   let [major, minor, patch] = parseVersion(version);
@@ -192,6 +204,11 @@ var plugin = {
       defaultPart = readDefaultPart(next);
     });
     async function performBump(part, dryRun, cwd) {
+      const safeCwd = resolveProjectRoot(cwd);
+      if (!safeCwd) {
+        return { ok: false, error: "cwd must stay within the current project directory" };
+      }
+      cwd = safeCwd;
       const pkg = getPackageJson(cwd);
       if (!pkg) {
         return { ok: false, error: "No package.json found" };
@@ -299,7 +316,12 @@ var plugin = {
         properties: {
           cwd: { type: "string", description: "Working directory (defaults to project root)" },
           dry_run: { type: "boolean", default: false },
-          part: { type: "string", enum: ["major", "minor", "patch", "auto"], default: defaultPart, description: "Version part to bump. Omitted \u2192 the configured default (/settings semver-part, factory default: patch). Use auto to infer from commits." }
+          part: {
+            type: "string",
+            enum: ["major", "minor", "patch", "auto"],
+            default: defaultPart,
+            description: "Version part to bump. Omitted \u2192 the configured default (/settings semver-part, factory default: patch). Use auto to infer from commits."
+          }
         }
       },
       permission: "confirm",
@@ -363,7 +385,11 @@ var plugin = {
         if (mode !== "patch" && mode !== "minor" && mode !== "major" && mode !== "auto") {
           return { message: `Unknown mode "${mode}". Use status, patch, minor, major or auto.` };
         }
-        const result = await performBump(mode, dry, cwd);
+        const safeCwd = resolveProjectRoot(cwd);
+        if (!safeCwd) {
+          return { message: "cwd must stay within the current project directory" };
+        }
+        const result = await performBump(mode, dry, safeCwd);
         return { message: String(result["message"] ?? result["error"] ?? JSON.stringify(result)) };
       }
     });
@@ -381,16 +407,20 @@ var plugin = {
       async execute(input) {
         state.invocationCount += 1;
         state.perTool["semver_current"] = (state.perTool["semver_current"] ?? 0) + 1;
-        const cwd = input["cwd"];
-        const pkg = getPackageJson(cwd);
+        const cwdInput = input["cwd"];
+        const safeCwd = resolveProjectRoot(cwdInput);
+        if (!safeCwd) {
+          return { ok: false, error: "cwd must stay within the current project directory" };
+        }
+        const pkg = getPackageJson(safeCwd);
         const currentVersion = pkg?.version ?? "unknown";
         let latestTag = null;
         let commitsSinceTag = 0;
         try {
-          const tagsOutput = runGit(["describe", "--tags", "--abbrev=0"], cwd);
+          const tagsOutput = runGit(["describe", "--tags", "--abbrev=0"], safeCwd);
           latestTag = tagsOutput || null;
           if (latestTag) {
-            const countOutput = runGit(["rev-list", "--count", `${latestTag}..HEAD`], cwd);
+            const countOutput = runGit(["rev-list", "--count", `${latestTag}..HEAD`], safeCwd);
             commitsSinceTag = Number.parseInt(countOutput, 10) || 0;
           }
         } catch {
@@ -425,11 +455,15 @@ var plugin = {
         const from = input["from"];
         const to = input["to"] ?? "HEAD";
         const cwd = input["cwd"];
+        const safeCwd = resolveProjectRoot(cwd);
+        if (!safeCwd) {
+          return { ok: false, error: "cwd must stay within the current project directory" };
+        }
         const format = input["format"] ?? "markdown";
         const range = from ? `${from}..${to}` : to;
         let commits;
         try {
-          const output = runGit(["log", range === to ? "-30" : range, "--format=%H %s"], cwd);
+          const output = runGit(["log", range === to ? "-30" : range, "--format=%H %s"], safeCwd);
           commits = output.split("\n").filter(Boolean).map((line) => {
             const spaceIdx = line.indexOf(" ");
             const hash = line.slice(0, spaceIdx);

package/dist/spec-linker.js

@@ -1,7 +1,7 @@
 import { existsSync, statSync } from 'fs';
 import * as fsp from 'fs/promises';
-import 'child_process';
 import 'path';
+import 'child_process';
 import '@wrongstack/core';
 import 'os';
 import 'crypto';
@@ -292,9 +292,26 @@ function isWrappedAsLinkOrCode(line, name) {
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function mapMarkdownFences(lines) {
+  const fenced = new Array(lines.length).fill(false);
+  let inFence = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (/^\s*```/.test(line)) {
+      fenced[i] = true;
+      inFence = !inFence;
+      continue;
+    }
+    fenced[i] = inFence;
+  }
+  return fenced;
+}
 function findUnlinkedReferences(lines, names) {
   const found = /* @__PURE__ */ new Map();
-  for (const line of lines) {
+  const fencedLines = mapMarkdownFences(lines);
+  for (let i = 0; i < lines.length; i++) {
+    if (fencedLines[i]) continue;
+    const line = lines[i];
     if (line.length === 0) continue;
     for (const name of names) {
       const re = new RegExp(`(^|[^\\w-])${escapeRegExp(name)}(?![\\w-])`, "i");
@@ -307,8 +324,10 @@ function findUnlinkedReferences(lines, names) {
 }
 function wrapUnlinkedReferences(content) {
   const lines = content.split("\n");
+  const fencedLines = mapMarkdownFences(lines);
   let changed = false;
   for (let i = 0; i < lines.length; i++) {
+    if (fencedLines[i]) continue;
     const line = lines[i];
     if (line.length === 0) continue;
     const newLine = wrapLineReferences(line);
@@ -424,7 +443,9 @@ var plugin36 = {
       state32.unlinkedCount += 1;
       const limited = unlinked.slice(0, cfg.maxReferences);
       const overflow = unlinked.length - limited.length;
-      const lines = limited.map((name) => `- \`${name}\` \u2192 \`[${name}](${PLUGIN_CATALOG.get(name) ?? `./src/${name}`})\``).join("\n");
+      const lines = limited.map(
+        (name) => `- \`${name}\` \u2192 \`[${name}](${PLUGIN_CATALOG.get(name) ?? `./src/${name}`})\``
+      ).join("\n");
       const overflowNote = overflow > 0 ? `
 - \u2026and ${overflow} more` : "";
       return {

package/dist/template-engine.js

@@ -13,27 +13,21 @@ function expandTemplate(template, variables) {
   return result;
 }
 function expandConditionals(template, variables) {
-  return template.replace(
-    /\{\{#if\s+(\w+)\}\}([\s\S]*?)\{\{\/if\}\}/g,
-    (_, key, content) => {
-      const val = variables[key];
-      return val !== void 0 && val !== "" && val !== "false" && val !== "0" ? content : "";
-    }
-  );
+  return template.replace(/\{\{#if\s+(\w+)\}\}([\s\S]*?)\{\{\/if\}\}/g, (_, key, content) => {
+    const val = variables[key];
+    return val !== void 0 && val !== "" && val !== "false" && val !== "0" ? content : "";
+  });
 }
 function expandLoops(template, variables) {
-  return template.replace(
-    /\{\{#each\s+(\w+)\}\}([\s\S]*?)\{\{\/each\}\}/g,
-    (_, key, content) => {
-      const val = variables[key];
-      if (!val) return "";
-      if (typeof val === "string" && val.includes(",")) {
-        const items = val.split(",").map((s) => s.trim());
-        return items.map((item) => expandTemplate(content, { ...variables, [key]: item })).join("\n");
-      }
-      return expandTemplate(content, variables);
+  return template.replace(/\{\{#each\s+(\w+)\}\}([\s\S]*?)\{\{\/each\}\}/g, (_, key, content) => {
+    const val = variables[key];
+    if (!val) return "";
+    if (typeof val === "string" && val.includes(",")) {
+      const items = val.split(",").map((s) => s.trim());
+      return items.map((item) => expandTemplate(content, { ...variables, [key]: item })).join("\n");
     }
-  );
+    return expandTemplate(content, variables);
+  });
 }
 function renderTemplate(template, variables, escapeHtml = true) {
   let result = template;
@@ -52,6 +46,12 @@ function renderTemplateRaw(template, variables) {
   result = expandTemplate(result, variables);
   return result;
 }
+function validateRelativeTemplatePath(field, value) {
+  if (isAbsolute(value) || value.split(/[\\/]+/).includes("..")) {
+    return `${field} must be a relative path without ".." components`;
+  }
+  return null;
+}
 var plugin = {
   name: "template-engine",
   version: "0.1.0",
@@ -80,13 +80,19 @@ var plugin = {
       inputSchema: {
         type: "object",
         properties: {
-          template: { type: "string", description: "Template string with {{variable}} placeholders" },
+          template: {
+            type: "string",
+            description: "Template string with {{variable}} placeholders"
+          },
           variables: {
             type: "object",
             description: "Variables to substitute into the template",
             additionalProperties: { type: "string" }
           },
-          output_path: { type: "string", description: "Optional path to write the expanded result" },
+          output_path: {
+            type: "string",
+            description: "Optional path to write the expanded result"
+          },
           raw: { type: "boolean", default: false, description: "Disable HTML auto-escaping" }
         },
         required: ["template", "variables"]
@@ -112,9 +118,8 @@ var plugin = {
           return { ok: false, error: String(err) };
         }
         if (output_path) {
-          if (isAbsolute(output_path) || output_path.includes("..")) {
-            return { ok: false, error: 'output_path must be a relative path without ".." components' };
-          }
+          const pathError = validateRelativeTemplatePath("output_path", output_path);
+          if (pathError) return { ok: false, error: pathError };
           const { writeFileSync } = await import('fs');
           writeFileSync(output_path, result, "utf-8");
           return {
@@ -144,7 +149,10 @@ var plugin = {
             description: "Variables to substitute",
             additionalProperties: { type: "string" }
           },
-          output_path: { type: "string", description: "Optional path to write the rendered result" },
+          output_path: {
+            type: "string",
+            description: "Optional path to write the rendered result"
+          },
           raw: { type: "boolean", default: false }
         },
         required: ["template_path", "variables"]
@@ -159,6 +167,8 @@ var plugin = {
         if (!template_path || typeof template_path !== "string") {
           return { ok: false, error: "template_path is required and must be a string" };
         }
+        const templatePathError = validateRelativeTemplatePath("template_path", template_path);
+        if (templatePathError) return { ok: false, error: templatePathError };
         if (!variables || typeof variables !== "object") {
           return { ok: false, error: "variables is required and must be an object" };
         }
@@ -176,9 +186,8 @@ var plugin = {
           return { ok: false, error: `Template rendering failed: ${err}` };
         }
         if (output_path) {
-          if (isAbsolute(output_path) || output_path.includes("..")) {
-            return { ok: false, error: 'output_path must be a relative path without ".." components' };
-          }
+          const pathError = validateRelativeTemplatePath("output_path", output_path);
+          if (pathError) return { ok: false, error: pathError };
           const { writeFileSync } = await import('fs');
           writeFileSync(output_path, result, "utf-8");
           return {
@@ -203,8 +212,14 @@ var plugin = {
         type: "object",
         properties: {
           name: { type: "string", description: "Unique name for this template" },
-          content: { type: "string", description: "Template content with {{variable}} placeholders" },
-          description: { type: "string", description: "Optional description of what this template is for" }
+          content: {
+            type: "string",
+            description: "Template content with {{variable}} placeholders"
+          },
+          description: {
+            type: "string",
+            description: "Optional description of what this template is for"
+          }
         },
         required: ["name", "content"]
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/plugins",
-  "version": "0.281.0",
+  "version": "0.281.1",
   "description": "Official WrongStack plugin collection — auto-doc, git-autocommit, shell-check, cost-tracker, file-watcher, cron, template-engine, semver-bump, secret-scanner, todo-tracker, token-budget, lint-gate, branch-guard, diff-summary, commit-validator, format-on-save, test-runner-gate, import-organizer, todo-listener, session-recap, spec-linker, loop-breaker, path-guard, context-pins, checkpoint, error-lens, dep-guard, config-validator, notify-hub, changelog-writer, injection-shield, llm-cache, model-router, prompt-firewall, auto-escalate, token-throttle",
   "license": "MIT",
   "author": "ECOSTACK TECHNOLOGY OÜ",
@@ -167,8 +167,8 @@
     "vitest": "^4.1.9"
   },
   "dependencies": {
-    "@wrongstack/core": "0.281.0",
-    "@wrongstack/tools": "0.281.0"
+    "@wrongstack/core": "0.281.1",
+    "@wrongstack/tools": "0.281.1"
   },
   "scripts": {
     "build": "tsup",