@wrongstack/plugins 0.281.3 → 0.282.1

package/dist/security-hotspot-scanner.js

@@ -0,0 +1,402 @@
+import { statSync, readdirSync, readFileSync } from 'fs';
+import { isAbsolute, resolve, relative } from 'path';
+
+// src/security-hotspot-scanner/index.ts
+var API_VERSION = "^0.1.10";
+var state = {
+  scanCount: 0,
+  fileScanCount: 0,
+  findingCount: 0,
+  hookInvocationCount: 0,
+  skippedCount: 0,
+  blockedCount: 0,
+  lastResult: null,
+  knownHotspots: /* @__PURE__ */ new Set(),
+  hookUnregister: null
+};
+var DEFAULTS = {
+  enabled: false,
+  severity: "warn",
+  maxFindings: 10,
+  scanOnChange: [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".py", ".java", ".go", ".rb", ".php"]
+};
+function readConfig(raw) {
+  if (!raw || typeof raw !== "object") return { ...DEFAULTS };
+  const r = raw;
+  return {
+    enabled: r["enabled"] === true,
+    severity: r["severity"] === "block" ? "block" : DEFAULTS.severity,
+    maxFindings: typeof r["maxFindings"] === "number" && r["maxFindings"] >= 1 && r["maxFindings"] <= 100 ? r["maxFindings"] : DEFAULTS.maxFindings,
+    scanOnChange: Array.isArray(r["scanOnChange"]) ? r["scanOnChange"].filter((x) => typeof x === "string") : DEFAULTS.scanOnChange
+  };
+}
+var PATTERNS = [
+  { type: "eval_call", severity: "high", regex: /\beval\s*\(/i },
+  { type: "function_constructor", severity: "high", regex: /\bnew\s+Function\s*\(|\bFunction\s*\(/i },
+  {
+    type: "unsafe_html",
+    severity: "high",
+    regex: /\binnerHTML\s*=|dangerouslySetInnerHTML/i
+  },
+  {
+    type: "sql_concatenation",
+    severity: "high",
+    regex: /\b(SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE)\b[^;]{0,120}(\+|\$\{|\.concat\s*\()/i
+  },
+  {
+    type: "hardcoded_http",
+    severity: "medium",
+    regex: /http:\/\/[a-zA-Z0-9][^\s'"\)\\]*/i
+  },
+  {
+    type: "console_log_credentials",
+    severity: "medium",
+    regex: /\bconsole\.log\s*\([^)]{0,120}(?:password|token|secret|key|credential|apikey|auth)/i
+  },
+  {
+    type: "exec_variable_command",
+    severity: "high",
+    regex: /\bexec\s*\(\s*(?:`[^`]*\$\{[^}]*\}[^`]*`|[a-zA-Z_$][\w$]*)/i
+  }
+];
+function scanSource(content, maxFindings) {
+  const findings = [];
+  const lines = content.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i];
+    for (const pattern of PATTERNS) {
+      const match = pattern.regex.exec(line);
+      if (match) {
+        findings.push({
+          type: pattern.type,
+          severity: pattern.severity,
+          line: i + 1,
+          snippet: line.trim().slice(0, 160)
+        });
+        if (findings.length >= maxFindings) return findings;
+      }
+    }
+  }
+  return findings;
+}
+function isSourceFile(filePath, extensions) {
+  const lower = filePath.toLowerCase();
+  return extensions.some((ext) => lower.endsWith(ext));
+}
+function withinProject(p) {
+  if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
+  const root = process.cwd();
+  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
+  const rel = relative(root, resolved);
+  if (rel === "" || rel === ".") return true;
+  if (rel.startsWith("..")) return false;
+  if (isAbsolute(rel)) return false;
+  return true;
+}
+function scanPath(inputPath, cfg) {
+  const start = Date.now();
+  const root = process.cwd();
+  const resolved = isAbsolute(inputPath) ? resolve(inputPath) : resolve(root, inputPath);
+  if (!withinProject(inputPath)) {
+    return {
+      path: inputPath,
+      scanned: false,
+      findings: [],
+      filesScanned: 0,
+      error: "path is outside the project directory",
+      durationMs: Date.now() - start
+    };
+  }
+  let filesScanned = 0;
+  const allFindings = [];
+  const maxPerFile = Math.max(1, Math.floor(cfg.maxFindings / 2));
+  const scanFile = (filePath) => {
+    if (!isSourceFile(filePath, cfg.scanOnChange)) return;
+    try {
+      const content = readFileSync(filePath, "utf-8");
+      filesScanned += 1;
+      const findings = scanSource(content, maxPerFile);
+      for (const f of findings) {
+        allFindings.push({ ...f, snippet: `${relative(root, filePath)}:${f.line}: ${f.snippet}` });
+        if (allFindings.length >= cfg.maxFindings) return;
+      }
+    } catch {
+    }
+  };
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (allFindings.length >= cfg.maxFindings) return;
+      const full = resolve(dir, entry);
+      try {
+        const st = statSync(full);
+        if (st.isDirectory()) {
+          if (entry.startsWith(".") || entry === "node_modules" || entry === "dist" || entry === "coverage") {
+            continue;
+          }
+          walk(full);
+        } else if (st.isFile()) {
+          scanFile(full);
+        }
+      } catch {
+      }
+    }
+  };
+  try {
+    const st = statSync(resolved);
+    if (st.isDirectory()) {
+      walk(resolved);
+    } else if (st.isFile()) {
+      scanFile(resolved);
+    } else {
+      return {
+        path: inputPath,
+        scanned: false,
+        findings: [],
+        filesScanned: 0,
+        error: "path is not a file or directory",
+        durationMs: Date.now() - start
+      };
+    }
+  } catch {
+    return {
+      path: inputPath,
+      scanned: false,
+      findings: [],
+      filesScanned: 0,
+      error: "path does not exist or cannot be read",
+      durationMs: Date.now() - start
+    };
+  }
+  return {
+    path: inputPath,
+    scanned: true,
+    findings: allFindings,
+    filesScanned,
+    durationMs: Date.now() - start
+  };
+}
+var plugin = {
+  name: "security-hotspot-scanner",
+  version: "0.1.0",
+  description: "Scans source code for security anti-patterns and warns after writes/edits that introduce new hotspots",
+  apiVersion: API_VERSION,
+  capabilities: { tools: true, hooks: true },
+  defaultConfig: { ...DEFAULTS },
+  configSchema: {
+    type: "object",
+    properties: {
+      enabled: { type: "boolean", default: false, description: "Master switch." },
+      severity: {
+        type: "string",
+        enum: ["warn", "block"],
+        default: "warn",
+        description: "warn = inject hotspots as additionalContext; block = refuse the mutating tool."
+      },
+      maxFindings: {
+        type: "number",
+        minimum: 1,
+        maximum: 100,
+        default: 10,
+        description: "Maximum hotspots reported per scan."
+      },
+      scanOnChange: {
+        type: "array",
+        items: { type: "string" },
+        default: DEFAULTS.scanOnChange,
+        description: "Only scan files with one of these extensions."
+      }
+    }
+  },
+  setup(api) {
+    state.scanCount = 0;
+    state.fileScanCount = 0;
+    state.findingCount = 0;
+    state.hookInvocationCount = 0;
+    state.skippedCount = 0;
+    state.blockedCount = 0;
+    state.lastResult = null;
+    state.knownHotspots.clear();
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
+    const cfg = readConfig(api.config.extensions?.["security-hotspot-scanner"]);
+    const hook = (input) => {
+      if (!cfg.enabled) return;
+      if (input.toolResult?.isError) return;
+      const inp = input.toolInput ?? {};
+      const sourcePath = inp["path"];
+      if (!sourcePath || typeof sourcePath !== "string") return;
+      if (!withinProject(sourcePath)) return;
+      const ext = sourcePath.includes(".") ? sourcePath.slice(sourcePath.lastIndexOf(".")).toLowerCase() : "";
+      if (!cfg.scanOnChange.includes(ext)) {
+        state.skippedCount += 1;
+        return;
+      }
+      state.hookInvocationCount += 1;
+      const result = scanPath(sourcePath, cfg);
+      state.scanCount += 1;
+      state.fileScanCount += result.filesScanned;
+      if (!result.scanned) {
+        return;
+      }
+      const newFindings = result.findings.filter((f) => {
+        const key = `${result.path}:${f.type}:${f.line}`;
+        if (state.knownHotspots.has(key)) return false;
+        state.knownHotspots.add(key);
+        return true;
+      });
+      if (newFindings.length === 0) return;
+      state.findingCount += newFindings.length;
+      state.lastResult = {
+        path: result.path,
+        findings: newFindings.length,
+        durationMs: result.durationMs,
+        when: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      const lines = newFindings.map(
+        (f) => `  [${f.severity.toUpperCase()}] ${f.type} at line ${f.line}: ${f.snippet}`
+      );
+      const message = `
+\u{1F6E1}\uFE0F security-hotspot-scanner: ${newFindings.length} new security hotspot(s) introduced by editing ${sourcePath}.
+${lines.join("\n")}` + (result.findings.length >= cfg.maxFindings ? `
+  \u2026 and possibly more (showing first ${cfg.maxFindings})` : "") + `
+Review or remove the risky pattern(s).`;
+      if (cfg.severity === "block") {
+        state.blockedCount += 1;
+        return {
+          decision: "block",
+          reason: message
+        };
+      }
+      return { additionalContext: message };
+    };
+    state.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook);
+    api.tools.register({
+      name: "security_hotspot_scan",
+      description: "Scan a file or directory for security anti-patterns (eval, Function constructor, innerHTML, SQL concatenation, http URLs, credential logging, variable exec commands).",
+      inputSchema: {
+        type: "object",
+        properties: {
+          path: {
+            type: "string",
+            description: "File or directory path to scan (relative or absolute, must be inside the project)."
+          }
+        },
+        required: ["path"]
+      },
+      permission: "auto",
+      category: "Security",
+      mutating: false,
+      async execute(input) {
+        if (!cfg.enabled) return { ok: false, error: "security-hotspot-scanner is disabled" };
+        const result = scanPath(input.path, cfg);
+        state.scanCount += 1;
+        state.fileScanCount += result.filesScanned;
+        state.findingCount += result.findings.length;
+        if (!result.scanned) {
+          return { ok: false, error: result.error, path: input.path };
+        }
+        state.lastResult = {
+          path: result.path,
+          findings: result.findings.length,
+          durationMs: result.durationMs,
+          when: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        return {
+          ok: true,
+          path: input.path,
+          filesScanned: result.filesScanned,
+          findings: result.findings,
+          findingCount: result.findings.length,
+          durationMs: result.durationMs
+        };
+      }
+    });
+    api.tools.register({
+      name: "security_hotspot_status",
+      description: "Reports security-hotspot-scanner state: severity, extensions, pattern types, and per-session counters.",
+      inputSchema: { type: "object", properties: {} },
+      permission: "auto",
+      category: "Security",
+      mutating: false,
+      async execute() {
+        return {
+          ok: true,
+          enabled: cfg.enabled,
+          severity: cfg.severity,
+          maxFindings: cfg.maxFindings,
+          scanOnChange: cfg.scanOnChange,
+          patternTypes: PATTERNS.map((p) => p.type),
+          counters: {
+            scans: state.scanCount,
+            filesScanned: state.fileScanCount,
+            findings: state.findingCount,
+            hookInvocations: state.hookInvocationCount,
+            skipped: state.skippedCount,
+            blocked: state.blockedCount
+          },
+          lastResult: state.lastResult
+        };
+      }
+    });
+    api.log.info("security-hotspot-scanner plugin loaded", {
+      version: "0.1.0",
+      severity: cfg.severity,
+      maxFindings: cfg.maxFindings
+    });
+  },
+  teardown(api) {
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
+    const final = {
+      scans: state.scanCount,
+      filesScanned: state.fileScanCount,
+      findings: state.findingCount,
+      hookInvocations: state.hookInvocationCount,
+      skipped: state.skippedCount,
+      blocked: state.blockedCount
+    };
+    state.scanCount = 0;
+    state.fileScanCount = 0;
+    state.findingCount = 0;
+    state.hookInvocationCount = 0;
+    state.skippedCount = 0;
+    state.blockedCount = 0;
+    state.lastResult = null;
+    state.knownHotspots.clear();
+    api.log.info("security-hotspot-scanner: teardown complete", { final });
+  },
+  async health() {
+    return {
+      ok: true,
+      message: state.lastResult ? `security-hotspot-scanner: ${state.scanCount} scan(s), last scan found ${state.lastResult.findings} hotspot(s)` : `security-hotspot-scanner: ${state.scanCount} scan(s), ${state.findingCount} finding(s)`,
+      counters: {
+        scans: state.scanCount,
+        filesScanned: state.fileScanCount,
+        findings: state.findingCount,
+        hookInvocations: state.hookInvocationCount,
+        skipped: state.skippedCount,
+        blocked: state.blockedCount
+      },
+      lastResult: state.lastResult
+    };
+  }
+};
+var security_hotspot_scanner_default = plugin;
+
+export { security_hotspot_scanner_default as default };

package/dist/semantic-search-indexer.d.ts

@@ -0,0 +1,38 @@
+import { Plugin } from '@wrongstack/core';
+
+/**
+ * semantic-search-indexer plugin — lightweight keyword-based search over
+ * project source files.
+ *
+ * The plugin builds an in-memory inverted index (no persistence, no
+ * embeddings) and exposes two tools:
+ *
+ *  - `semantic_search`       — ranked keyword search with TF scoring
+ *  - `semantic_index_status` — index counters and configuration
+ *
+ * Files are tokenized into lowercase alphanumeric terms and indexed with
+ * per-document term frequencies. Queries are scored by summing the TF of
+ * each matched query token, then results are returned with the matching
+ * file path, score, and a handful of matched lines.
+ *
+ * Config (`config.extensions['semantic-search-indexer']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "includeExtensions": [".ts", ".tsx", ".js", ".jsx"],
+ *   "excludePatterns": ["node_modules", "\\.git", "dist"],
+ *   "maxFileBytes": 1_000_000,
+ *   "defaultLimit": 10,
+ *   "minTokenLength": 2,
+ *   "maxMatchesPerFile": 10,
+ *   "maxFiles": 5000
+ * }
+ * ```
+ *
+ * @public
+ */
+
+declare const plugin: Plugin;
+
+export { plugin as default };