@wrongstack/plugins 0.281.3 → 0.282.1

package/dist/schema-evolution-guard.js

@@ -0,0 +1,319 @@
+import { readFileSync } from 'fs';
+import { basename, isAbsolute, resolve, relative } from 'path';
+
+// src/schema-evolution-guard/index.ts
+var API_VERSION = "^0.1.10";
+var state = {
+  invocationCount: 0,
+  scannedCount: 0,
+  skippedCount: 0,
+  hitCount: 0,
+  warningCount: 0,
+  blockedCount: 0,
+  lastFinding: null,
+  hookUnregister: null
+};
+var DEFAULT_FILE_PATTERNS = [
+  "*.prisma",
+  "*migration*.sql",
+  "*openapi*.yaml",
+  "*openapi*.json",
+  "*schema*.ts"
+];
+var DEFAULTS = {
+  enabled: true,
+  failSeverity: "warn",
+  maxFindings: 5,
+  filePatterns: [...DEFAULT_FILE_PATTERNS]
+};
+function readConfig(raw) {
+  if (!raw || typeof raw !== "object") return { ...DEFAULTS };
+  const r = raw;
+  return {
+    enabled: r["enabled"] !== false,
+    failSeverity: r["failSeverity"] === "block" ? "block" : DEFAULTS.failSeverity,
+    maxFindings: typeof r["maxFindings"] === "number" && Number.isFinite(r["maxFindings"]) && r["maxFindings"] >= 1 && r["maxFindings"] <= 50 ? Math.floor(r["maxFindings"]) : DEFAULTS.maxFindings,
+    filePatterns: Array.isArray(r["filePatterns"]) ? r["filePatterns"].filter((x) => typeof x === "string") : DEFAULTS.filePatterns
+  };
+}
+function patternToRegExp(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`, "i");
+}
+function matchesAnyPattern(fileName, patterns) {
+  return patterns.some((p) => patternToRegExp(p).test(fileName));
+}
+function fileKind(fileName) {
+  const n = fileName.toLowerCase();
+  if (n.endsWith(".prisma")) return "prisma";
+  if (n.endsWith(".sql")) return "sql";
+  if (n.endsWith(".yaml") || n.endsWith(".yml") || n.endsWith(".json")) return "openapi";
+  if (n.endsWith(".ts")) return "typescript-schema";
+  return null;
+}
+function withinProject(p) {
+  if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
+  const root = process.cwd();
+  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
+  const rel = relative(root, resolved);
+  if (rel === "" || rel === ".") return true;
+  if (rel.startsWith("..")) return false;
+  if (isAbsolute(rel)) return false;
+  return true;
+}
+function findIssues(content, kind, maxFindings) {
+  const findings = [];
+  const lines = content.split(/\r?\n/);
+  let inOpenApiRequiredList = false;
+  for (let i = 0; i < lines.length && findings.length < maxFindings; i++) {
+    const line = lines[i];
+    const lineNumber = i + 1;
+    switch (kind) {
+      case "sql": {
+        if (/DROP\s+TABLE\b/i.test(line)) {
+          findings.push(`DROP TABLE at line ${lineNumber}`);
+          continue;
+        }
+        if (/DROP\s+COLUMN\b/i.test(line)) {
+          findings.push(`DROP COLUMN at line ${lineNumber}`);
+          continue;
+        }
+        if (/\bNOT\s+NULL\b/i.test(line) && !/DEFAULT\b/i.test(line) && !/DROP\b/i.test(line)) {
+          findings.push(`NOT NULL added without default at line ${lineNumber}`);
+        }
+        break;
+      }
+      case "prisma": {
+        const match = line.match(/^\s+([A-Za-z_]\w*)\s+([A-Za-z_]\w+)(\?)?(\s+@.*)?$/);
+        if (match && !match[3] && !match[4]?.includes("@default")) {
+          findings.push(
+            `required field without default at line ${lineNumber}: ${match[1]} (${match[2]})`
+          );
+        }
+        break;
+      }
+      case "openapi": {
+        const requiredMatch = line.match(/\b["']?required["']?\s*:\s*(.*)/i);
+        if (requiredMatch) {
+          const rest = (requiredMatch[1] ?? "").trim();
+          if (rest.startsWith("[")) {
+            const close = rest.indexOf("]");
+            const inner = close >= 0 ? rest.slice(1, close) : rest.slice(1);
+            const items = inner.split(",").map((s) => s.trim().replace(/^["']|["']$/g, "")).filter(Boolean);
+            for (const item of items) {
+              if (findings.length >= maxFindings) break;
+              findings.push(
+                `required field added to OpenAPI schema at line ${lineNumber}: ${item}`
+              );
+            }
+            inOpenApiRequiredList = false;
+          } else if (rest === "") {
+            inOpenApiRequiredList = true;
+          } else {
+            inOpenApiRequiredList = false;
+          }
+          continue;
+        }
+        if (inOpenApiRequiredList) {
+          const listMatch = line.match(/^\s*-\s*(\w+)/);
+          if (listMatch) {
+            findings.push(
+              `required field added to OpenAPI schema at line ${lineNumber}: ${listMatch[1]}`
+            );
+            continue;
+          }
+          if (line.trim() !== "" && !/^\s*#/.test(line)) {
+            inOpenApiRequiredList = false;
+          }
+        }
+        break;
+      }
+      case "typescript-schema": {
+        const match = line.match(/^\s*(\w+)(\?)?\s*:\s*([^=;\n]+?);?$/);
+        if (match && !match[2] && !match[3]?.includes("=")) {
+          findings.push(`required field without default at line ${lineNumber}: ${match[1]}`);
+        }
+        break;
+      }
+    }
+  }
+  return findings;
+}
+var plugin = {
+  name: "schema-evolution-guard",
+  version: "0.1.0",
+  description: "PostToolUse hook that guards database/API schema changes by detecting destructive patterns in schema files",
+  apiVersion: API_VERSION,
+  capabilities: { tools: true, hooks: true },
+  defaultConfig: { ...DEFAULTS },
+  configSchema: {
+    type: "object",
+    properties: {
+      enabled: {
+        type: "boolean",
+        default: true,
+        description: "Master switch."
+      },
+      failSeverity: {
+        type: "string",
+        enum: ["warn", "block"],
+        default: "warn",
+        description: "warn = inject additionalContext; block = refuse the mutating tool."
+      },
+      maxFindings: {
+        type: "number",
+        minimum: 1,
+        maximum: 50,
+        default: 5,
+        description: "Maximum destructive findings reported per file."
+      },
+      filePatterns: {
+        type: "array",
+        items: { type: "string" },
+        default: DEFAULT_FILE_PATTERNS,
+        description: "Basename patterns that trigger the scan."
+      }
+    }
+  },
+  setup(api) {
+    state.invocationCount = 0;
+    state.scannedCount = 0;
+    state.skippedCount = 0;
+    state.hitCount = 0;
+    state.warningCount = 0;
+    state.blockedCount = 0;
+    state.lastFinding = null;
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
+    const cfg = readConfig(api.config.extensions?.["schema-evolution-guard"]);
+    const hook = (input) => {
+      if (!cfg.enabled) return;
+      if (input.toolResult?.isError) return;
+      const toolInput = input.toolInput ?? {};
+      const filePath = typeof toolInput["path"] === "string" ? toolInput["path"] : void 0;
+      if (!filePath) return;
+      state.invocationCount += 1;
+      const fileName = basename(filePath);
+      if (!matchesAnyPattern(fileName, cfg.filePatterns)) {
+        state.skippedCount += 1;
+        return;
+      }
+      const kind = fileKind(fileName);
+      if (!kind) {
+        state.skippedCount += 1;
+        return;
+      }
+      let content;
+      if (typeof toolInput["content"] === "string") {
+        content = toolInput["content"];
+      } else if (withinProject(filePath)) {
+        try {
+          content = readFileSync(filePath, "utf-8");
+        } catch {
+          content = void 0;
+        }
+      }
+      if (content === void 0) {
+        state.skippedCount += 1;
+        return;
+      }
+      state.scannedCount += 1;
+      const findings = findIssues(content, kind, cfg.maxFindings);
+      if (findings.length === 0) return;
+      state.hitCount += 1;
+      state.lastFinding = findings[0] ?? null;
+      const header = `
+\u26A0\uFE0F schema-evolution-guard: destructive schema pattern(s) detected in ${filePath}`;
+      const body = findings.map((f) => `  - ${f}`).join("\n");
+      const suffix = cfg.failSeverity === "block" ? "\nThis change is blocked. Add a safe migration path (e.g. default value, multi-step alter) and retry." : "\nReview the change before proceeding; consider a safer migration path.";
+      const message = `${header}
+${body}${suffix}`;
+      if (cfg.failSeverity === "block") {
+        state.blockedCount += 1;
+        return { decision: "block", reason: message };
+      }
+      state.warningCount += 1;
+      return { additionalContext: message };
+    };
+    state.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook);
+    api.tools.register({
+      name: "schema_evolution_status",
+      description: "Reports schema-evolution-guard state: config, file patterns, and per-session counters.",
+      inputSchema: { type: "object", properties: {} },
+      permission: "auto",
+      category: "Diagnostics",
+      mutating: false,
+      async execute() {
+        return {
+          ok: true,
+          enabled: cfg.enabled,
+          failSeverity: cfg.failSeverity,
+          maxFindings: cfg.maxFindings,
+          filePatterns: cfg.filePatterns,
+          counters: {
+            invocations: state.invocationCount,
+            scanned: state.scannedCount,
+            skipped: state.skippedCount,
+            hits: state.hitCount,
+            warnings: state.warningCount,
+            blocked: state.blockedCount
+          },
+          lastFinding: state.lastFinding
+        };
+      }
+    });
+    api.log.info("schema-evolution-guard plugin loaded", {
+      version: "0.1.0",
+      failSeverity: cfg.failSeverity,
+      filePatterns: cfg.filePatterns
+    });
+  },
+  teardown(api) {
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
+    const final = {
+      invocations: state.invocationCount,
+      scanned: state.scannedCount,
+      skipped: state.skippedCount,
+      hits: state.hitCount,
+      warnings: state.warningCount,
+      blocked: state.blockedCount
+    };
+    state.invocationCount = 0;
+    state.scannedCount = 0;
+    state.skippedCount = 0;
+    state.hitCount = 0;
+    state.warningCount = 0;
+    state.blockedCount = 0;
+    state.lastFinding = null;
+    api.log.info("schema-evolution-guard: teardown complete", { final });
+  },
+  async health() {
+    return {
+      ok: true,
+      message: `schema-evolution-guard: ${state.scannedCount} scan(s), ${state.hitCount} hit(s), ${state.blockedCount} blocked`,
+      counters: {
+        invocations: state.invocationCount,
+        scanned: state.scannedCount,
+        skipped: state.skippedCount,
+        hits: state.hitCount,
+        warnings: state.warningCount,
+        blocked: state.blockedCount
+      },
+      lastFinding: state.lastFinding
+    };
+  }
+};
+var schema_evolution_guard_default = plugin;
+
+export { schema_evolution_guard_default as default };

package/dist/security-hotspot-scanner.d.ts

@@ -0,0 +1,30 @@
+import { Plugin } from '@wrongstack/core';
+
+/**
+ * security-hotspot-scanner plugin — scans source code for common security
+ * anti-patterns and reports them via tools + a PostToolUse hook.
+ *
+ * Tools registered:
+ * - security_hotspot_scan   : scan a file or directory for security hotspots
+ * - security_hotspot_status : config + per-session counters
+ *
+ * Hooks registered:
+ * - PostToolUse with matcher `write|edit` to warn about newly introduced hotspots.
+ *
+ * Config (`config.extensions['security-hotspot-scanner']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "severity": "warn",          // "warn" | "block"
+ *   "maxFindings": 10,
+ *   "scanOnChange": [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".py"]
+ * }
+ * ```
+ *
+ * @public
+ */
+
+declare const plugin: Plugin;
+
+export { plugin as default };