@wrongstack/plugins 0.284.0 → 0.285.0

package/dist/todo-tracker/index.d.ts

@@ -0,0 +1,4 @@
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/todo-tracker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/todo-tracker/index.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAmK/C,QAAA,MAAM,MAAM,EAAE,MAsZb,CAAC;eAEa,MAAM"}

package/dist/todo-tracker.d.ts

@@ -1,5 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './todo-tracker/index.js';
+export { default } from './todo-tracker/index.js';

package/dist/todo-tracker.js

@@ -1,7 +1,6 @@
-import * as fsp from 'fs/promises';
-import { randomUUID } from 'crypto';
-
 // src/todo-tracker/index.ts
+import * as fsp from "node:fs/promises";
+import { randomUUID } from "node:crypto";
 function deriveFilePath(api) {
   const raw = api.config.extensions?.["todo-tracker"];
   const explicit = typeof raw?.["filePath"] === "string" ? raw["filePath"] : null;
@@ -437,5 +436,6 @@ var plugin = {
   }
 };
 var todo_tracker_default = plugin;
-
-export { todo_tracker_default as default };
+export {
+  todo_tracker_default as default
+};

package/dist/token-budget/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * token-budget plugin — Enforces a per-session token budget.
+ *
+ * Complements cost-tracker (which tracks but does not enforce).
+ * When token usage crosses the warning threshold, injects a "wrap up"
+ * signal into the LLM's context. When it crosses the hard limit,
+ * triggers a Stop hook to end the agent loop.
+ *
+ * Tools registered:
+ * - token_budget_status : Show budget limit, current usage, percent
+ *                          consumed, and whether the warning/stop
+ *                          threshold has been crossed.
+ *
+ * Hooks registered:
+ * - Stop : checks whether the budget is exhausted; if so, returns
+ *          `decision: 'block'` with a reason so the agent loop does
+ *          not continue.
+ *
+ * Events subscribed:
+ * - provider.response : accumulates prompt + completion tokens.
+ *
+ * Config surface (`config.extensions['token-budget']`):
+ *
+ * ```jsonc
+ * {
+ *   "limit": 500000,       // hard token limit (prompt + completion)
+ *   "warnPercent": 80,     // inject "wrap up" at this % of limit
+ *   "stopPercent": 100,    // trigger Stop at this % of limit
+ *   "model": null          // null = all models; or restrict to one
+ * }
+ * ```
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/token-budget/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/token-budget/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAqF/C,QAAA,MAAM,MAAM,EAAE,MA8Qb,CAAC;eAEa,MAAM"}

package/dist/token-budget.d.ts

@@ -1,40 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * token-budget plugin — Enforces a per-session token budget.
- *
- * Complements cost-tracker (which tracks but does not enforce).
- * When token usage crosses the warning threshold, injects a "wrap up"
- * signal into the LLM's context. When it crosses the hard limit,
- * triggers a Stop hook to end the agent loop.
- *
- * Tools registered:
- * - token_budget_status : Show budget limit, current usage, percent
- *                          consumed, and whether the warning/stop
- *                          threshold has been crossed.
- *
- * Hooks registered:
- * - Stop : checks whether the budget is exhausted; if so, returns
- *          `decision: 'block'` with a reason so the agent loop does
- *          not continue.
- *
- * Events subscribed:
- * - provider.response : accumulates prompt + completion tokens.
- *
- * Config surface (`config.extensions['token-budget']`):
- *
- * ```jsonc
- * {
- *   "limit": 500000,       // hard token limit (prompt + completion)
- *   "warnPercent": 80,     // inject "wrap up" at this % of limit
- *   "stopPercent": 100,    // trigger Stop at this % of limit
- *   "model": null          // null = all models; or restrict to one
- * }
- * ```
- *
- * @public
- */
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './token-budget/index.js';
+export { default } from './token-budget/index.js';

package/dist/token-budget.js

@@ -250,5 +250,6 @@ var plugin = {
   }
 };
 var token_budget_default = plugin;
-
-export { token_budget_default as default };
+export {
+  token_budget_default as default
+};

package/dist/token-throttle/index.d.ts

@@ -0,0 +1,52 @@
+/**
+ * token-throttle plugin — enforces a rolling-window token budget on the
+ * provider wire, delaying calls to stay under a rate limit.
+ *
+ * Registers an `AgentExtension.wrapProviderRunner`. Before each provider
+ * call it prunes a 60-second sliding window of recorded spend, estimates
+ * the outgoing request's tokens, and if the window's spend plus the
+ * estimate would exceed `tokensPerMinute`, it sleeps just long enough for
+ * older spend to age out of the window (capped at `maxDelayMs`). After
+ * the call it records the response's actual usage. This smooths bursty
+ * agent loops under a provider's TPM limit instead of hitting 429s.
+ *
+ * Safety posture: opt-in — loads inert until
+ * `config.extensions['token-throttle'].enabled = true`. Delay is bounded
+ * by `maxDelayMs` so a mis-set budget can never hang the agent
+ * indefinitely.
+ *
+ * Config (`config.extensions['token-throttle']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": false,
+ *   "tokensPerMinute": 100000,  // rolling-window budget
+ *   "maxDelayMs": 30000,        // hard cap on any single wait
+ *   "charsPerToken": 4          // request-size → token estimate divisor
+ * }
+ * ```
+ *
+ * Tools:
+ *  - `token_throttle_status` — window spend, throttle counters, total delay
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+export interface SpendEntry {
+    at: number;
+    tokens: number;
+}
+/** Drop entries older than the 60s window relative to `now`. */
+export declare function pruneWindow(entries: SpendEntry[], now: number): SpendEntry[];
+/** Sum tokens currently in the window. */
+export declare function windowSpend(entries: SpendEntry[]): number;
+/**
+ * Delay (ms) needed before a request of `projected` tokens can proceed
+ * without the window exceeding `limit`. 0 when it already fits. Computed
+ * by aging out just enough of the oldest spend: we find the earliest
+ * point at which enough tokens have expired to make room.
+ */
+export declare function computeThrottleDelay(entries: SpendEntry[], now: number, limit: number, projected: number): number;
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/token-throttle/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/token-throttle/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAa,MAAM,kBAAkB,CAAC;AA8C1D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gEAAgE;AAChE,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,CAE5E;AAED,0CAA0C;AAC1C,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,UAAU,EAAE,EACrB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,MAAM,CAoBR;AA4CD,QAAA,MAAM,MAAM,EAAE,MAoKb,CAAC;eAEa,MAAM"}

package/dist/token-throttle.d.ts

@@ -1,54 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * token-throttle plugin — enforces a rolling-window token budget on the
- * provider wire, delaying calls to stay under a rate limit.
- *
- * Registers an `AgentExtension.wrapProviderRunner`. Before each provider
- * call it prunes a 60-second sliding window of recorded spend, estimates
- * the outgoing request's tokens, and if the window's spend plus the
- * estimate would exceed `tokensPerMinute`, it sleeps just long enough for
- * older spend to age out of the window (capped at `maxDelayMs`). After
- * the call it records the response's actual usage. This smooths bursty
- * agent loops under a provider's TPM limit instead of hitting 429s.
- *
- * Safety posture: opt-in — loads inert until
- * `config.extensions['token-throttle'].enabled = true`. Delay is bounded
- * by `maxDelayMs` so a mis-set budget can never hang the agent
- * indefinitely.
- *
- * Config (`config.extensions['token-throttle']`):
- *
- * ```jsonc
- * {
- *   "enabled": false,
- *   "tokensPerMinute": 100000,  // rolling-window budget
- *   "maxDelayMs": 30000,        // hard cap on any single wait
- *   "charsPerToken": 4          // request-size → token estimate divisor
- * }
- * ```
- *
- * Tools:
- *  - `token_throttle_status` — window spend, throttle counters, total delay
- *
- * @public
- */
-
-interface SpendEntry {
-    at: number;
-    tokens: number;
-}
-/** Drop entries older than the 60s window relative to `now`. */
-declare function pruneWindow(entries: SpendEntry[], now: number): SpendEntry[];
-/** Sum tokens currently in the window. */
-declare function windowSpend(entries: SpendEntry[]): number;
-/**
- * Delay (ms) needed before a request of `projected` tokens can proceed
- * without the window exceeding `limit`. 0 when it already fits. Computed
- * by aging out just enough of the oldest spend: we find the earliest
- * point at which enough tokens have expired to make room.
- */
-declare function computeThrottleDelay(entries: SpendEntry[], now: number, limit: number, projected: number): number;
-declare const plugin: Plugin;
-
-export { type SpendEntry, computeThrottleDelay, plugin as default, pruneWindow, windowSpend };
+export * from './token-throttle/index.js';
+export { default } from './token-throttle/index.js';

package/dist/token-throttle.js

@@ -204,5 +204,9 @@ var plugin = {
   }
 };
 var token_throttle_default = plugin;
-
-export { computeThrottleDelay, token_throttle_default as default, pruneWindow, windowSpend };
+export {
+  computeThrottleDelay,
+  token_throttle_default as default,
+  pruneWindow,
+  windowSpend
+};

package/dist/type-gate/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * type-gate plugin — PostToolUse hook that runs TypeScript type-checking
+ * after every `write` or `edit` to a source file.
+ *
+ * `lint-gate` validates style; this plugin validates types. It runs
+ * `tsc --noEmit` (or a user-supplied command) and injects the first few
+ * errors as `additionalContext` so the model can fix type regressions in
+ * the same turn.
+ *
+ * Tools registered:
+ * - type_gate_status : Show config + per-session counters.
+ *
+ * Hooks registered:
+ * - PostToolUse with matcher `write|edit`.
+ *
+ * Config (`config.extensions['type-gate']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "command": "npx tsc --noEmit",  // base type-check command
+ *   "tsConfigPath": "tsconfig.json",
+ *   "timeoutMs": 60000,
+ *   "failSeverity": "warn",         // "warn" | "block"
+ *   "maxErrors": 5,                 // errors shown in context
+ *   "runOnChange": [".ts", ".tsx", ".js", ".jsx", ".mts", ".cts"]
+ * }
+ * ```
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/type-gate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/type-gate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA6M/C,QAAA,MAAM,MAAM,EAAE,MAiOb,CAAC;eAEa,MAAM"}

package/dist/type-gate.d.ts

@@ -1,37 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * type-gate plugin — PostToolUse hook that runs TypeScript type-checking
- * after every `write` or `edit` to a source file.
- *
- * `lint-gate` validates style; this plugin validates types. It runs
- * `tsc --noEmit` (or a user-supplied command) and injects the first few
- * errors as `additionalContext` so the model can fix type regressions in
- * the same turn.
- *
- * Tools registered:
- * - type_gate_status : Show config + per-session counters.
- *
- * Hooks registered:
- * - PostToolUse with matcher `write|edit`.
- *
- * Config (`config.extensions['type-gate']`):
- *
- * ```jsonc
- * {
- *   "enabled": true,
- *   "command": "npx tsc --noEmit",  // base type-check command
- *   "tsConfigPath": "tsconfig.json",
- *   "timeoutMs": 60000,
- *   "failSeverity": "warn",         // "warn" | "block"
- *   "maxErrors": 5,                 // errors shown in context
- *   "runOnChange": [".ts", ".tsx", ".js", ".jsx", ".mts", ".cts"]
- * }
- * ```
- *
- * @public
- */
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './type-gate/index.js';
+export { default } from './type-gate/index.js';

package/dist/type-gate.js

@@ -1,6 +1,195 @@
-import { execFileSync } from 'child_process';
-import { existsSync } from 'fs';
-import { isAbsolute, resolve, relative } from 'path';
+// src/type-gate/index.ts
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
+
+// src/runtime/index.ts
+import { execFile } from "node:child_process";
+import { basename, isAbsolute, relative, resolve } from "node:path";
+var META_CHARS = /["'`;&|<>\r\n]/;
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+function hasLeadingDash(arg) {
+  return arg.length > 0 && arg.startsWith("-");
+}
+function safeSplit(command) {
+  const trimmed = command.trim();
+  if (!trimmed || META_CHARS.test(trimmed)) return null;
+  return trimmed.split(/\s+/).filter(Boolean);
+}
+function withinProjectPath(projectRoot, candidate) {
+  if (candidate.length === 0 || candidate.length > 4096) return false;
+  if (hasLeadingDash(candidate)) return false;
+  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(projectRoot, candidate);
+  const rel = relative(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function everyFlagAllowed(allowed, args) {
+  for (const arg of args) {
+    if (!hasLeadingDash(arg)) continue;
+    if (allowed === null) return false;
+    if (!allowed.has(arg)) return false;
+  }
+  return true;
+}
+function sanitizeRunnerPath(value, options = {}) {
+  if (!value || hasLeadingDash(value)) return null;
+  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  if (!withinProjectPath(projectRoot, value)) return null;
+  return isAbsolute(value) ? resolve(value) : resolve(projectRoot, value);
+}
+function resolveRunnerCommand(runtime, command, options = {}) {
+  const tokens = safeSplit(command);
+  if (!tokens || tokens.length === 0) return null;
+  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  const launcher = runtime.packageManager;
+  const [head, second, ...rest] = tokens;
+  if (!head) return null;
+  const display = tokens.join(" ");
+  if (launcher !== "none" && tokens.length === 1 && head === launcher) {
+    return null;
+  }
+  if (head === runtime.executable) {
+    if (!everyFlagAllowed(runtime.allowedFlags, [second, ...rest].filter((v) => Boolean(v)))) {
+      return null;
+    }
+    return {
+      cmd: head,
+      args: [second, ...rest].filter((v) => Boolean(v)),
+      display
+    };
+  }
+  if (launcher !== "none" && head === launcher && runtime.subcommands.length === 0 && second === runtime.executable) {
+    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
+    return { cmd: head, args: [second, ...rest], display };
+  }
+  if (launcher !== "none" && head === launcher && runtime.subcommands.length > 0) {
+    const subcommand = runtime.subcommands[0];
+    const exe = rest[0];
+    if (second === subcommand && exe === runtime.executable) {
+      const tail = rest.slice(1);
+      if (!everyFlagAllowed(runtime.allowedFlags, tail)) return null;
+      return { cmd: head, args: [second, exe, ...tail], display };
+    }
+  }
+  if (isAbsolute(head)) {
+    if (!withinProjectPath(projectRoot, head)) return null;
+    const base = basename(head);
+    if (base !== runtime.executable && base !== launcher) return null;
+    if (second !== runtime.executable) return null;
+    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
+    return { cmd: head, args: [second, ...rest], display };
+  }
+  return null;
+}
+function runRunnerCommand(argv, options) {
+  if (argv.length === 0) {
+    return Promise.resolve({
+      code: null,
+      stdout: "",
+      stderr: "runtime helper: empty argv",
+      timedOut: false,
+      spawnError: true
+    });
+  }
+  return new Promise((resolvePromise) => {
+    const projectRoot = resolve(options.projectRoot ?? process.cwd());
+    const trimmedCwd = options.cwd.trim();
+    if (!withinProjectPath(projectRoot, trimmedCwd)) {
+      resolvePromise({
+        code: null,
+        stdout: "",
+        stderr: "runtime helper: cwd outside project",
+        timedOut: false,
+        spawnError: true
+      });
+      return;
+    }
+    let timedOut = false;
+    let spawnErrored = false;
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    const child = execFile(
+      argv[0],
+      argv.slice(1),
+      {
+        cwd: trimmedCwd,
+        timeout: options.timeoutMs,
+        signal: options.signal,
+        maxBuffer: MAX_BUFFER_BYTES,
+        windowsHide: true,
+        shell: false
+      },
+      (err, stdout, stderr) => {
+        if (timedOut) {
+          resolvePromise({
+            code: null,
+            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
+            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            timedOut: true,
+            spawnError: false
+          });
+          return;
+        }
+        if (spawnErrored) {
+          resolvePromise({
+            code: 127,
+            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
+            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            timedOut: false,
+            spawnError: true
+          });
+          return;
+        }
+        if (err) {
+          const anyErr = err;
+          const code = typeof anyErr.code === "number" ? anyErr.code : 1;
+          resolvePromise({
+            code,
+            stdout: Buffer.concat([
+              ...stdoutChunks,
+              ...anyErr.stdout ? [Buffer.isBuffer(anyErr.stdout) ? anyErr.stdout : Buffer.from(anyErr.stdout)] : []
+            ]).toString("utf8"),
+            stderr: Buffer.concat([
+              ...stderrChunks,
+              ...anyErr.stderr ? [Buffer.isBuffer(anyErr.stderr) ? anyErr.stderr : Buffer.from(anyErr.stderr)] : []
+            ]).toString("utf8"),
+            timedOut: false,
+            spawnError: false
+          });
+          return;
+        }
+        resolvePromise({
+          code: 0,
+          stdout: Buffer.concat([
+            ...stdoutChunks,
+            ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]
+          ]).toString("utf8"),
+          stderr: Buffer.concat([
+            ...stderrChunks,
+            ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]
+          ]).toString("utf8"),
+          timedOut: false,
+          spawnError: false
+        });
+      }
+    );
+    child.stdout?.on("data", (chunk) => {
+      stdoutBytes += chunk.length;
+      if (stdoutBytes <= MAX_BUFFER_BYTES) stdoutChunks.push(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderrBytes += chunk.length;
+      if (stderrBytes <= MAX_BUFFER_BYTES) stderrChunks.push(chunk);
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT" || err.code === "EPERM" || err.code === "EACCES") {
+        spawnErrored = true;
+      }
+    });
+  });
+}
 
 // src/type-gate/index.ts
 var API_VERSION = "^0.1.10";
@@ -39,54 +228,50 @@ function readConfig(raw) {
 function withinProject(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute2(p) ? resolve2(p) : resolve2(root, p);
+  const rel = relative2(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute2(rel)) return false;
   return true;
 }
-var ALLOWED_COMMAND_TOKENS = /* @__PURE__ */ new Set([
-  "npx",
-  "pnpm",
-  "npm",
-  "yarn",
-  "bun",
-  "tsc",
-  "node",
-  "tsx"
-]);
-function resolveAllowedCommand(customCommand) {
-  const tokens = customCommand.split(/\s+/).filter(Boolean);
-  if (tokens.length === 0) return null;
-  const head = tokens[0];
-  if (ALLOWED_COMMAND_TOKENS.has(head)) {
-    return { cmd: head, args: tokens.slice(1) };
-  }
-  if (isAbsolute(head)) {
-    if (!withinProject(head)) return null;
-    const base = head.split(/[/\\]/).pop() ?? "";
-    if (ALLOWED_COMMAND_TOKENS.has(base)) {
-      return { cmd: head, args: tokens.slice(1) };
-    }
-  }
-  return null;
+var TSC_RUNTIME = {
+  id: "typescript",
+  packageManager: "pnpm",
+  executable: "tsc",
+  allowedFlags: /* @__PURE__ */ new Set([
+    "--noEmit",
+    "--pretty",
+    "--pretty=false",
+    "--incremental",
+    "--watch",
+    "--build",
+    "--filter"
+  ]),
+  subcommands: ["exec"],
+  defaultCommand: "pnpm exec tsc --noEmit"
+};
+function validateTsConfigPath(p) {
+  const sanitized = sanitizeRunnerPath(p);
+  return sanitized;
 }
 function runTypeCheck(cfg) {
   const start = Date.now();
-  const tsConfig = cfg.tsConfigPath;
-  let cmd;
-  let args;
+  const rawTsConfig = cfg.tsConfigPath;
+  const validTsConfig = rawTsConfig && rawTsConfig !== "tsconfig.json" ? validateTsConfigPath(rawTsConfig) : null;
+  if (rawTsConfig && rawTsConfig !== "tsconfig.json" && !validTsConfig) {
+    return null;
+  }
+  const tsConfig = validTsConfig ?? (rawTsConfig || "tsconfig.json");
+  let argv;
   if (cfg.command) {
-    const resolved = resolveAllowedCommand(cfg.command);
+    const resolved = resolveRunnerCommand(TSC_RUNTIME, cfg.command);
     if (!resolved) return null;
-    cmd = resolved.cmd;
-    args = resolved.args;
+    argv = [resolved.cmd, ...resolved.args];
   } else {
-    cmd = "npx";
-    args = ["tsc", "--noEmit"];
+    argv = ["npx", "tsc", "--noEmit"];
     if (tsConfig && tsConfig !== "tsconfig.json") {
-      args.push("-p", tsConfig);
+      argv = [...argv, "-p", tsConfig];
     }
   }
   if (!cfg.command && tsConfig && !existsSync(tsConfig)) {
@@ -95,7 +280,7 @@ function runTypeCheck(cfg) {
   let stdout = "";
   let stderr = "";
   try {
-    const out = execFileSync(cmd, args, {
+    const out = execFileSync(argv[0], argv.slice(1), {
       encoding: "utf-8",
       timeout: cfg.timeoutMs,
       cwd: process.cwd(),
@@ -109,6 +294,7 @@ function runTypeCheck(cfg) {
     stdout = e.stdout ?? "";
     stderr = e.stderr ?? "";
   }
+  void runRunnerCommand;
   const combined = `${stdout}
 ${stderr}`.trim();
   const durationMs = Date.now() - start;
@@ -126,6 +312,12 @@ ${stderr}`.trim();
 var plugin = {
   name: "type-gate",
   version: "0.1.0",
+  runtime: {
+    language: "typescript",
+    packageManager: "pnpm",
+    executable: "tsc",
+    defaultCommand: "pnpm exec tsc --noEmit"
+  },
   description: "PostToolUse hook that runs TypeScript type-checking after every write or edit to a source file",
   apiVersion: API_VERSION,
   capabilities: { tools: true, hooks: true },
@@ -307,5 +499,6 @@ Fix the type error(s) or adjust the change.`;
   }
 };
 var type_gate_default = plugin;
-
-export { type_gate_default as default };
+export {
+  type_gate_default as default
+};