@wrongstack/plugins 0.281.1 → 0.282.0

package/dist/dead-code-detector.js

@@ -0,0 +1,354 @@
+import { statSync, readFileSync, readdirSync } from 'fs';
+import { resolve, isAbsolute, relative, join, extname } from 'path';
+
+// src/dead-code-detector/index.ts
+var API_VERSION = "^0.1.10";
+var state = {
+  scanCount: 0,
+  hitCount: 0,
+  missCount: 0,
+  hookInvocationCount: 0,
+  warningCount: 0,
+  errorCount: 0,
+  hookUnregister: null
+};
+var DEFAULTS = {
+  enabled: false,
+  extensions: [".ts", ".tsx", ".js", ".jsx"],
+  defaultDepth: 3,
+  maxDepth: 10,
+  excludeDirs: ["node_modules", "dist", ".git", "coverage"]
+};
+function readConfig(raw) {
+  if (!raw || typeof raw !== "object") return { ...DEFAULTS };
+  const r = raw;
+  return {
+    enabled: r["enabled"] === true,
+    extensions: Array.isArray(r["extensions"]) ? r["extensions"].filter((x) => typeof x === "string") : DEFAULTS.extensions,
+    defaultDepth: typeof r["defaultDepth"] === "number" && r["defaultDepth"] >= 0 && r["defaultDepth"] <= DEFAULTS.maxDepth ? r["defaultDepth"] : DEFAULTS.defaultDepth,
+    maxDepth: DEFAULTS.maxDepth,
+    excludeDirs: Array.isArray(r["excludeDirs"]) ? r["excludeDirs"].filter((x) => typeof x === "string") : DEFAULTS.excludeDirs
+  };
+}
+function gatherFiles(root, depth, cfg) {
+  const files = [];
+  function walk(dir, remaining) {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (remaining > 0 && !cfg.excludeDirs.includes(entry.name)) {
+          walk(join(dir, entry.name), remaining - 1);
+        }
+      } else if (entry.isFile()) {
+        const ext = extname(entry.name).toLowerCase();
+        if (cfg.extensions.includes(ext)) {
+          files.push(join(dir, entry.name));
+        }
+      }
+    }
+  }
+  walk(resolve(root), depth);
+  return files;
+}
+function stripNoise(content) {
+  let stripped = content.replace(/\/\/.*$/gm, " ");
+  stripped = stripped.replace(/\/\*[\s\S]*?\*\//g, " ");
+  stripped = stripped.replace(
+    /'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`/g,
+    " "
+  );
+  return stripped;
+}
+function lineNumber(content, index) {
+  return content.slice(0, index).split(/\r?\n/).length;
+}
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var DECLARATION_EXPORT_RE = /export\s+(?:async\s+|abstract\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
+var NAMED_EXPORT_RE = /export\s*\{([^}]+)\}/g;
+function extractExports(content, filePath) {
+  const exports = [];
+  let match;
+  DECLARATION_EXPORT_RE.lastIndex = 0;
+  while ((match = DECLARATION_EXPORT_RE.exec(content)) !== null) {
+    exports.push({
+      identifier: match[1],
+      file: filePath,
+      line: lineNumber(content, match.index),
+      exportType: "declaration"
+    });
+  }
+  NAMED_EXPORT_RE.lastIndex = 0;
+  while ((match = NAMED_EXPORT_RE.exec(content)) !== null) {
+    const line = lineNumber(content, match.index);
+    const names = match[1].split(",").map((s) => s.trim()).filter(Boolean);
+    for (const name of names) {
+      const parts = name.split(/\s+as\s+/);
+      const exportedName = parts.length > 1 ? parts[parts.length - 1].trim() : name;
+      if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(exportedName)) {
+        exports.push({
+          identifier: exportedName,
+          file: filePath,
+          line,
+          exportType: "named"
+        });
+      }
+    }
+  }
+  return exports;
+}
+function findUnusedSymbols(files) {
+  const suspicious = [];
+  for (const file of files) {
+    const fileExports = extractExports(file.content, file.path);
+    for (const exp of fileExports) {
+      const pattern = new RegExp(`\\b${escapeRegex(exp.identifier)}\\b`, "g");
+      let usedElsewhere = false;
+      for (const other of files) {
+        if (other.path === file.path) continue;
+        if (pattern.test(other.stripped)) {
+          usedElsewhere = true;
+          break;
+        }
+      }
+      if (!usedElsewhere) {
+        suspicious.push(exp);
+      }
+    }
+  }
+  return suspicious;
+}
+function scan(root, depth, cfg) {
+  const filePaths = gatherFiles(root, depth, cfg);
+  const files = [];
+  for (const p of filePaths) {
+    try {
+      const content = readFileSync(p, "utf-8");
+      files.push({ path: p, content, stripped: stripNoise(content) });
+    } catch {
+    }
+  }
+  return { findings: findUnusedSymbols(files), scannedFiles: files.length };
+}
+function withinProject(p) {
+  if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
+  const root = process.cwd();
+  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
+  const rel = relative(root, resolved);
+  if (rel === "" || rel === ".") return true;
+  if (rel.startsWith("..")) return false;
+  if (isAbsolute(rel)) return false;
+  return true;
+}
+function resolveScanRoot(rawPath) {
+  const resolved = resolve(process.cwd(), rawPath);
+  try {
+    const stats = statSync(resolved);
+    if (!stats.isDirectory()) {
+      return resolve(resolved, "..");
+    }
+  } catch {
+  }
+  return resolved;
+}
+function toPosix(p) {
+  return p.replace(/\\/g, "/");
+}
+function relativePath(p) {
+  return toPosix(relative(process.cwd(), p));
+}
+var plugin = {
+  name: "dead-code-detector",
+  version: "0.1.0",
+  description: "Lightweight regex-based scan for exported identifiers that appear unused anywhere in the project",
+  apiVersion: API_VERSION,
+  capabilities: { tools: true, hooks: true },
+  defaultConfig: { ...DEFAULTS },
+  configSchema: {
+    type: "object",
+    properties: {
+      enabled: {
+        type: "boolean",
+        default: false,
+        description: "Master switch."
+      },
+      extensions: {
+        type: "array",
+        items: { type: "string" },
+        default: [".ts", ".tsx", ".js", ".jsx"],
+        description: "File extensions to scan."
+      },
+      defaultDepth: {
+        type: "number",
+        minimum: 0,
+        maximum: 10,
+        default: 3,
+        description: "Default recursion depth for scans."
+      },
+      excludeDirs: {
+        type: "array",
+        items: { type: "string" },
+        default: ["node_modules", "dist", ".git", "coverage"],
+        description: "Directory names to skip while scanning."
+      }
+    }
+  },
+  setup(api) {
+    state.scanCount = 0;
+    state.hitCount = 0;
+    state.missCount = 0;
+    state.hookInvocationCount = 0;
+    state.warningCount = 0;
+    state.errorCount = 0;
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
+    const cfg = readConfig(api.config.extensions?.["dead-code-detector"]);
+    const hook = (input) => {
+      if (!cfg.enabled) return;
+      if (input.toolResult?.isError) return;
+      const inp = input.toolInput ?? {};
+      const sourcePath = inp["path"];
+      if (!sourcePath || typeof sourcePath !== "string") return;
+      if (!withinProject(sourcePath)) return;
+      const ext = sourcePath.includes(".") ? sourcePath.slice(sourcePath.lastIndexOf(".")).toLowerCase() : "";
+      if (!cfg.extensions.includes(ext)) return;
+      state.hookInvocationCount += 1;
+      const scanRoot = resolveScanRoot(sourcePath);
+      let result;
+      try {
+        result = scan(scanRoot, 1, cfg);
+      } catch (err) {
+        state.errorCount += 1;
+        return;
+      }
+      const changedFile = resolve(process.cwd(), sourcePath);
+      const relevant = result.findings.filter((f) => resolve(f.file) === changedFile);
+      if (relevant.length === 0) {
+        state.missCount += 1;
+        return;
+      }
+      state.hitCount += 1;
+      state.warningCount += relevant.length;
+      const list = relevant.map(
+        (f) => `  - ${f.identifier} (${f.exportType}) at ${relativePath(f.file)}:${f.line}`
+      ).join("\n");
+      const message = `
+\u26A0\uFE0F dead-code-detector: ${relevant.length} exported symbol(s) in ${sourcePath} look unused:
+${list}
+Consider removing the export if it is not part of the public API.`;
+      return { additionalContext: message };
+    };
+    state.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook);
+    api.tools.register({
+      name: "dead_code_scan",
+      description: "Scan TypeScript/JavaScript source files for exported symbols that appear unused anywhere in the project.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          path: {
+            type: "string",
+            default: ".",
+            description: "Directory or file path to scan."
+          },
+          depth: {
+            type: "number",
+            default: 3,
+            minimum: 0,
+            maximum: 10,
+            description: "Maximum recursion depth."
+          }
+        }
+      },
+      permission: "auto",
+      category: "Diagnostics",
+      mutating: false,
+      async execute(input) {
+        if (!cfg.enabled) return { ok: false, error: "dead-code-detector is disabled" };
+        const rawPath = typeof input.path === "string" ? input.path : ".";
+        const rawDepth = typeof input.depth === "number" ? input.depth : cfg.defaultDepth;
+        const depth = Math.max(0, Math.min(Math.floor(rawDepth), cfg.maxDepth));
+        if (!withinProject(rawPath)) {
+          return { ok: false, error: "scan path is outside the project root" };
+        }
+        state.scanCount += 1;
+        const scanRoot = resolveScanRoot(rawPath);
+        let result;
+        try {
+          result = scan(scanRoot, depth, cfg);
+        } catch (err) {
+          state.errorCount += 1;
+          return { ok: false, error: String(err) };
+        }
+        return {
+          ok: true,
+          scanRoot: relativePath(scanRoot),
+          depth,
+          scannedFiles: result.scannedFiles,
+          findings: result.findings.map((f) => ({
+            identifier: f.identifier,
+            file: relativePath(f.file),
+            line: f.line,
+            exportType: f.exportType
+          }))
+        };
+      }
+    });
+    api.log.info("dead-code-detector plugin loaded", {
+      version: "0.1.0",
+      extensions: cfg.extensions,
+      defaultDepth: cfg.defaultDepth
+    });
+  },
+  teardown(api) {
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
+    const final = {
+      scans: state.scanCount,
+      hits: state.hitCount,
+      misses: state.missCount,
+      hookInvocations: state.hookInvocationCount,
+      warnings: state.warningCount,
+      errors: state.errorCount
+    };
+    state.scanCount = 0;
+    state.hitCount = 0;
+    state.missCount = 0;
+    state.hookInvocationCount = 0;
+    state.warningCount = 0;
+    state.errorCount = 0;
+    api.log.info("dead-code-detector: teardown complete", { final });
+  },
+  async health() {
+    return {
+      ok: state.errorCount === 0,
+      message: state.errorCount ? `dead-code-detector: ${state.errorCount} error(s)` : `dead-code-detector: ${state.scanCount} scan(s), ${state.hitCount} finding(s), ${state.warningCount} warning(s)`,
+      counters: {
+        scans: state.scanCount,
+        hits: state.hitCount,
+        misses: state.missCount,
+        hookInvocations: state.hookInvocationCount,
+        warnings: state.warningCount,
+        errors: state.errorCount
+      }
+    };
+  }
+};
+var dead_code_detector_default = plugin;
+
+export { dead_code_detector_default as default };

package/dist/dep-guard.js

@@ -4,6 +4,8 @@ var state = {
   installsSeen: 0,
   blocks: 0,
   warns: 0,
+  llmConfirmCount: 0,
+  llmConfirmErrors: 0,
   lastBlock: null,
   hookUnregister: null
 };
@@ -13,7 +15,8 @@ var DEFAULTS = {
   deny: [],
   allow: [],
   warnOnUnpinned: false,
-  typosquatCheck: true
+  typosquatCheck: true,
+  confirmTyposquatsWithLlm: false
 };
 function readConfig(raw) {
   if (!raw || typeof raw !== "object") return { ...DEFAULTS };
@@ -25,7 +28,8 @@ function readConfig(raw) {
     deny: strings(r["deny"]),
     allow: strings(r["allow"]),
     warnOnUnpinned: r["warnOnUnpinned"] === true,
-    typosquatCheck: r["typosquatCheck"] !== false
+    typosquatCheck: r["typosquatCheck"] !== false,
+    confirmTyposquatsWithLlm: r["confirmTyposquatsWithLlm"] === true
   };
 }
 var INSTALL_RE = /(?:^|[;&|]\s*)(npm|pnpm|yarn|bun)\s+(?:install|i|add)\s+([^;&|]+)|(?:^|[;&|]\s*)(pip3?|uv)\s+(?:pip\s+)?install\s+([^;&|]+)|(?:^|[;&|]\s*)(cargo)\s+add\s+([^;&|]+)/gi;
@@ -167,6 +171,11 @@ var plugin = {
         type: "boolean",
         default: true,
         description: "Warn when a package name is one edit away from a well-known package."
+      },
+      confirmTyposquatsWithLlm: {
+        type: "boolean",
+        default: false,
+        description: "Ask the host LLM to confirm whether a flagged typosquat is real-but-obscure or genuinely a typo. Appended to the warn context, never escalates to a block. Off by default."
       }
     }
   },
@@ -175,6 +184,8 @@ var plugin = {
     state.installsSeen = 0;
     state.blocks = 0;
     state.warns = 0;
+    state.llmConfirmCount = 0;
+    state.llmConfirmErrors = 0;
     state.lastBlock = null;
     if (state.hookUnregister) {
       try {
@@ -184,7 +195,7 @@ var plugin = {
       state.hookUnregister = null;
     }
     const cfg = readConfig(api.config.extensions?.["dep-guard"]);
-    const hook = (input) => {
+    const hook = async (input) => {
       if (!cfg.enabled) return;
       state.invocations += 1;
       const ti = input.toolInput ?? {};
@@ -220,9 +231,31 @@ var plugin = {
         if (cfg.typosquatCheck) {
           const lookalike = typosquatOf(pkg.name);
           if (lookalike) {
-            notes.push(
-              `"${pkg.name}" is one edit away from the well-known package "${lookalike}" \u2014 possible typosquat. Verify the name before installing.`
-            );
+            const baseNote = `"${pkg.name}" is one edit away from the well-known package "${lookalike}" \u2014 possible typosquat. Verify the name before installing.`;
+            if (cfg.confirmTyposquatsWithLlm && api.llm) {
+              try {
+                const verdict = await api.llm.complete(
+                  `A user is installing the npm package "${pkg.name}" which is 1 edit away from the well-known "${lookalike}". Is "${pkg.name}" likely a typo of "${lookalike}" or a real-but-obscure package? Reply with ONE sentence starting with "TYPO:" or "REAL:".`,
+                  {
+                    system: "You are a supply-chain security assistant. Reply tersely with a single TYPO: or REAL: verdict.",
+                    maxTokens: 80
+                  }
+                );
+                const t = verdict.text.trim();
+                if (t) {
+                  state.llmConfirmCount += 1;
+                  api.metrics.counter("llm_confirm");
+                  notes.push(`${baseNote} LLM verdict: ${t.slice(0, 300)}`);
+                } else {
+                  notes.push(baseNote);
+                }
+              } catch {
+                state.llmConfirmErrors += 1;
+                notes.push(baseNote);
+              }
+            } else {
+              notes.push(baseNote);
+            }
           }
         }
         if (cfg.warnOnUnpinned && pkg.version === null) {
@@ -263,6 +296,8 @@ ${notes.map((n) => `  - ${n}`).join("\n")}`
           counters: {
             invocations: state.invocations,
             installsSeen: state.installsSeen,
+            llmConfirmCount: state.llmConfirmCount,
+            llmConfirmErrors: state.llmConfirmErrors,
             blocks: state.blocks,
             warns: state.warns
           },
@@ -288,6 +323,8 @@ ${notes.map((n) => `  - ${n}`).join("\n")}`
     const final = {
       invocations: state.invocations,
       installsSeen: state.installsSeen,
+      llmConfirmCount: state.llmConfirmCount,
+      llmConfirmErrors: state.llmConfirmErrors,
       blocks: state.blocks,
       warns: state.warns
     };
@@ -295,6 +332,8 @@ ${notes.map((n) => `  - ${n}`).join("\n")}`
     state.installsSeen = 0;
     state.blocks = 0;
     state.warns = 0;
+    state.llmConfirmCount = 0;
+    state.llmConfirmErrors = 0;
     state.lastBlock = null;
     api.log.info("dep-guard: teardown complete", { final });
   },
@@ -305,6 +344,8 @@ ${notes.map((n) => `  - ${n}`).join("\n")}`
       counters: {
         invocations: state.invocations,
         installsSeen: state.installsSeen,
+        llmConfirmCount: state.llmConfirmCount,
+        llmConfirmErrors: state.llmConfirmErrors,
         blocks: state.blocks,
         warns: state.warns
       }

package/dist/dependency-vulnerability-gate.d.ts

@@ -0,0 +1,35 @@
+import { Plugin } from '@wrongstack/core';
+
+/**
+ * dependency-vulnerability-gate plugin — PostToolUse hook that audits
+ * dependencies after install commands.
+ *
+ * Runs `npm audit --json` (or `pnpm audit --json` when pnpm-lock.yaml is
+ * present) after the `install` tool or bash/exec commands containing
+ * `npm install`/`pnpm add`/`yarn add`. Parses the audit report and blocks
+ * or warns when any vulnerability severity meets or exceeds the configured
+ * threshold.
+ *
+ * Tool registered:
+ * - dependency_audit_status : Show config + per-session counters.
+ *
+ * Hooks registered:
+ * - PostToolUse with matcher `install|bash|exec`.
+ *
+ * Config (`config.extensions['dependency-vulnerability-gate']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "severityThreshold": "high",  // "low" | "moderate" | "high" | "critical"
+ *   "block": true,                // true = block, false = warn
+ *   "timeoutMs": 120000
+ * }
+ * ```
+ *
+ * @public
+ */
+
+declare const plugin: Plugin;
+
+export { plugin as default };