@wrongstack/plugins 0.283.0 → 0.284.0

package/dist/branch-guard.js

@@ -1,4 +1,4 @@
-import { execSync } from 'child_process';
+import { execFile } from 'child_process';
 
 // src/branch-guard/index.ts
 var API_VERSION = "^0.1.10";
@@ -52,29 +52,34 @@ function hasDisabledPluginEntry(raw) {
     return name === "branch-guard" || name === "@wrongstack/plugins/branch-guard";
   });
 }
-function getCurrentBranch(cwd) {
+function runGit(args, cwd, signal) {
+  return new Promise((resolve, reject) => {
+    execFile(
+      "git",
+      args,
+      { encoding: "utf-8", timeout: 3e3, cwd, windowsHide: true, signal },
+      (error, stdout) => {
+        if (error) reject(error);
+        else resolve(stdout);
+      }
+    );
+  });
+}
+async function getCurrentBranch(cwd, signal) {
   try {
-    const branch = execSync("git branch --show-current", {
-      encoding: "utf-8",
-      timeout: 3e3,
-      cwd,
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
+    const branch = (await runGit(["branch", "--show-current"], cwd, signal)).trim();
     return branch || null;
-  } catch {
+  } catch (err) {
+    if (signal.aborted) throw err;
     return null;
   }
 }
-function detectUncommittedChanges(cwd) {
+async function detectUncommittedChanges(cwd, signal) {
   try {
-    const output = execSync("git status --porcelain", {
-      encoding: "utf-8",
-      timeout: 3e3,
-      cwd,
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
+    const output = (await runGit(["status", "--porcelain"], cwd, signal)).trim();
     return output.length > 0;
-  } catch {
+  } catch (err) {
+    if (signal.aborted) throw err;
     return false;
   }
 }
@@ -158,7 +163,7 @@ var plugin = {
       cfg = readHostConfig(next);
     });
     const cwd = typeof process.cwd === "function" ? process.cwd() : void 0;
-    const hook = (input) => {
+    const hook = async (input, runtime = { signal: new AbortController().signal }) => {
       const toolName = input.toolName ?? "";
       const inp = input.toolInput ?? {};
       state.invocationCount += 1;
@@ -176,13 +181,13 @@ var plugin = {
       }
       if (!gitOp) return;
       if (!shouldBlock(gitOp.type, cfg)) return;
-      const branch = getCurrentBranch(cwd);
+      const branch = await getCurrentBranch(cwd, runtime.signal);
       if (!branch) return;
       const protectedSet = new Set(cfg.branches);
       if (!protectedSet.has(branch)) return;
       const when = (/* @__PURE__ */ new Date()).toISOString();
       const opVerb = gitOp.type === "commit" ? "committing to" : gitOp.type === "push" ? "pushing from" : "merging into";
-      const hasUncommitted = detectUncommittedChanges(cwd);
+      const hasUncommitted = await detectUncommittedChanges(cwd, runtime.signal);
       const retryStep = toolName === "git_autocommit" ? "retry git_autocommit" : `git ${gitOp.type} ...`;
       const suggestionParts = [];
       if (hasUncommitted) {
@@ -215,7 +220,13 @@ var plugin = {
 \u26A0\uFE0F branch-guard: you are ${opVerb} protected branch '${branch}'. ` + (hasUncommitted ? `You have uncommitted changes \u2014 consider \`git stash\` before switching branches. ` : "") + `Use a feature branch instead. Protected: ${cfg.branches.join(", ")}.`
       };
     };
-    state.hookUnregister = api.registerHook("PreToolUse", "bash|git|git_autocommit", hook);
+    state.hookUnregister = api.registerHook("PreToolUse", "bash|git|git_autocommit", hook, {
+      name: "branch-guard",
+      stage: "validate",
+      timeoutMs: 7e3,
+      failurePolicy: "closed",
+      policy: true
+    });
     api.tools.register({
       name: "branch_guard_status",
       description: "Reports branch-guard state: protected branches, mode, and per-session invocation/block/warn counters.",

package/dist/checkpoint.js

@@ -1,4 +1,5 @@
 import { mkdirSync, writeFileSync, statSync, readFileSync } from 'fs';
+import { stat, readFile } from 'fs/promises';
 import { dirname, resolve, isAbsolute, relative } from 'path';
 
 // src/checkpoint/index.ts
@@ -51,6 +52,19 @@ function captureFile(path, maxBytes) {
     return { path, content: null, bytes: 0 };
   }
 }
+async function captureFileForHook(path, maxBytes, signal) {
+  try {
+    signal.throwIfAborted();
+    const st = await stat(path);
+    if (st.size > maxBytes) return "too-large";
+    const content = await readFile(path, "utf-8");
+    signal.throwIfAborted();
+    return { path, content, bytes: st.size };
+  } catch (err) {
+    if (signal.aborted) throw err;
+    return { path, content: null, bytes: 0 };
+  }
+}
 function pushSnapshot(snapshot, maxSnapshots) {
   state.snapshots.push(snapshot);
   if (state.snapshots.length > maxSnapshots) {
@@ -103,13 +117,13 @@ var plugin = {
     }
     const cfg = readConfig(api.config.extensions?.["checkpoint"]);
     if (cfg.enabled && cfg.autoCapture) {
-      const hook = (input) => {
+      const hook = async (input, runtime = { signal: new AbortController().signal }) => {
         const ti = input.toolInput ?? {};
         const raw = ti["path"] ?? ti["file_path"] ?? ti["filePath"];
         if (typeof raw !== "string" || raw.length === 0) return;
         const safePath = resolveProjectPath(raw);
         if (!safePath) return;
-        const captured = captureFile(safePath, cfg.maxFileBytes);
+        const captured = await captureFileForHook(safePath, cfg.maxFileBytes, runtime.signal);
         if (captured === "too-large") {
           state.skippedLarge += 1;
           return;
@@ -136,7 +150,13 @@ var plugin = {
           when: (/* @__PURE__ */ new Date()).toISOString()
         });
       };
-      state.hookUnregister = api.registerHook("PreToolUse", "write|edit", hook);
+      state.hookUnregister = api.registerHook("PreToolUse", "write|edit", hook, {
+        name: "checkpoint-guard",
+        stage: "validate",
+        // Checkpointing is recovery automation, not an enforcement boundary.
+        // A transient read failure must not stall normal/YOLO writes.
+        failurePolicy: "open"
+      });
     }
     api.tools.register({
       name: "checkpoint_create",

package/dist/commit-validator.js

@@ -292,7 +292,12 @@ Suggested rewrite (${suggest.model}):
         additionalContext: baseContext
       };
     };
-    state.hookUnregister = api.registerHook("PreToolUse", "bash|git_autocommit", hook);
+    state.hookUnregister = api.registerHook("PreToolUse", "bash|git_autocommit", hook, {
+      name: "commit-validator",
+      stage: "validate",
+      failurePolicy: "closed",
+      policy: true
+    });
     api.tools.register({
       name: "commit_validator_status",
       description: "Reports commit-validator state: mode, allowedTypes, maxSubjectLength, and per-session valid/invalid counters.",

package/dist/dep-guard.js

@@ -276,7 +276,12 @@ ${notes.map((n) => `  - ${n}`).join("\n")}`
         additionalContext: `dep-guard: this command adds ${packages.length} dependenc${packages.length === 1 ? "y" : "ies"}: ${packages.map((p) => p.name).join(", ")}. Confirm each is intentional.`
       };
     };
-    state.hookUnregister = api.registerHook("PreToolUse", "bash|exec", hook);
+    state.hookUnregister = api.registerHook("PreToolUse", "bash|exec", hook, {
+      name: "dep-guard",
+      stage: "validate",
+      failurePolicy: "closed",
+      policy: true
+    });
     api.tools.register({
       name: "dep_guard_status",
       description: "Reports dep-guard state: deny/allow lists, mode, and counters (installs seen, blocks, warns).",