@wrongstack/plugins 0.284.1 → 0.285.0

package/dist/runtime.js

@@ -0,0 +1,216 @@
+// src/runtime/index.ts
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { basename, isAbsolute, relative, resolve } from "node:path";
+var META_CHARS = /["'`;&|<>\r\n]/;
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+function hasLeadingDash(arg) {
+  return arg.length > 0 && arg.startsWith("-");
+}
+function safeSplit(command) {
+  const trimmed = command.trim();
+  if (!trimmed || META_CHARS.test(trimmed)) return null;
+  return trimmed.split(/\s+/).filter(Boolean);
+}
+function withinProjectPath(projectRoot, candidate) {
+  if (candidate.length === 0 || candidate.length > 4096) return false;
+  if (hasLeadingDash(candidate)) return false;
+  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(projectRoot, candidate);
+  const rel = relative(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function everyFlagAllowed(allowed, args) {
+  for (const arg of args) {
+    if (!hasLeadingDash(arg)) continue;
+    if (allowed === null) return false;
+    if (!allowed.has(arg)) return false;
+  }
+  return true;
+}
+function sanitizeRunnerPath(value, options = {}) {
+  if (!value || hasLeadingDash(value)) return null;
+  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  if (!withinProjectPath(projectRoot, value)) return null;
+  return isAbsolute(value) ? resolve(value) : resolve(projectRoot, value);
+}
+function resolveRunnerCommand(runtime, command, options = {}) {
+  const tokens = safeSplit(command);
+  if (!tokens || tokens.length === 0) return null;
+  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  const launcher = runtime.packageManager;
+  const [head, second, ...rest] = tokens;
+  if (!head) return null;
+  const display = tokens.join(" ");
+  if (launcher !== "none" && tokens.length === 1 && head === launcher) {
+    return null;
+  }
+  if (head === runtime.executable) {
+    if (!everyFlagAllowed(runtime.allowedFlags, [second, ...rest].filter((v) => Boolean(v)))) {
+      return null;
+    }
+    return {
+      cmd: head,
+      args: [second, ...rest].filter((v) => Boolean(v)),
+      display
+    };
+  }
+  if (launcher !== "none" && head === launcher && runtime.subcommands.length === 0 && second === runtime.executable) {
+    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
+    return { cmd: head, args: [second, ...rest], display };
+  }
+  if (launcher !== "none" && head === launcher && runtime.subcommands.length > 0) {
+    const subcommand = runtime.subcommands[0];
+    const exe = rest[0];
+    if (second === subcommand && exe === runtime.executable) {
+      const tail = rest.slice(1);
+      if (!everyFlagAllowed(runtime.allowedFlags, tail)) return null;
+      return { cmd: head, args: [second, exe, ...tail], display };
+    }
+  }
+  if (isAbsolute(head)) {
+    if (!withinProjectPath(projectRoot, head)) return null;
+    const base = basename(head);
+    if (base !== runtime.executable && base !== launcher) return null;
+    if (second !== runtime.executable) return null;
+    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
+    return { cmd: head, args: [second, ...rest], display };
+  }
+  return null;
+}
+function runRunnerCommand(argv, options) {
+  if (argv.length === 0) {
+    return Promise.resolve({
+      code: null,
+      stdout: "",
+      stderr: "runtime helper: empty argv",
+      timedOut: false,
+      spawnError: true
+    });
+  }
+  return new Promise((resolvePromise) => {
+    const projectRoot = resolve(options.projectRoot ?? process.cwd());
+    const trimmedCwd = options.cwd.trim();
+    if (!withinProjectPath(projectRoot, trimmedCwd)) {
+      resolvePromise({
+        code: null,
+        stdout: "",
+        stderr: "runtime helper: cwd outside project",
+        timedOut: false,
+        spawnError: true
+      });
+      return;
+    }
+    let timedOut = false;
+    let spawnErrored = false;
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    const child = execFile(
+      argv[0],
+      argv.slice(1),
+      {
+        cwd: trimmedCwd,
+        timeout: options.timeoutMs,
+        signal: options.signal,
+        maxBuffer: MAX_BUFFER_BYTES,
+        windowsHide: true,
+        shell: false
+      },
+      (err, stdout, stderr) => {
+        if (timedOut) {
+          resolvePromise({
+            code: null,
+            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
+            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            timedOut: true,
+            spawnError: false
+          });
+          return;
+        }
+        if (spawnErrored) {
+          resolvePromise({
+            code: 127,
+            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
+            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            timedOut: false,
+            spawnError: true
+          });
+          return;
+        }
+        if (err) {
+          const anyErr = err;
+          const code = typeof anyErr.code === "number" ? anyErr.code : 1;
+          resolvePromise({
+            code,
+            stdout: Buffer.concat([
+              ...stdoutChunks,
+              ...anyErr.stdout ? [Buffer.isBuffer(anyErr.stdout) ? anyErr.stdout : Buffer.from(anyErr.stdout)] : []
+            ]).toString("utf8"),
+            stderr: Buffer.concat([
+              ...stderrChunks,
+              ...anyErr.stderr ? [Buffer.isBuffer(anyErr.stderr) ? anyErr.stderr : Buffer.from(anyErr.stderr)] : []
+            ]).toString("utf8"),
+            timedOut: false,
+            spawnError: false
+          });
+          return;
+        }
+        resolvePromise({
+          code: 0,
+          stdout: Buffer.concat([
+            ...stdoutChunks,
+            ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]
+          ]).toString("utf8"),
+          stderr: Buffer.concat([
+            ...stderrChunks,
+            ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]
+          ]).toString("utf8"),
+          timedOut: false,
+          spawnError: false
+        });
+      }
+    );
+    child.stdout?.on("data", (chunk) => {
+      stdoutBytes += chunk.length;
+      if (stdoutBytes <= MAX_BUFFER_BYTES) stdoutChunks.push(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderrBytes += chunk.length;
+      if (stderrBytes <= MAX_BUFFER_BYTES) stderrChunks.push(chunk);
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT" || err.code === "EPERM" || err.code === "EACCES") {
+        spawnErrored = true;
+      }
+    });
+  });
+}
+async function probeRunner(runtime, probeArg = "--version", options) {
+  const resolved = resolveRunnerCommand(runtime, `${runtime.executable} ${probeArg}`, options);
+  if (!resolved) return false;
+  const result = await runRunnerCommand([resolved.cmd, ...resolved.args], {
+    ...options,
+    timeoutMs: Math.min(options.timeoutMs, 5e3)
+  });
+  return result.code === 0;
+}
+function locateRunnerEntry(runtime, projectRoot) {
+  const root = resolve(projectRoot);
+  const candidates = [
+    resolve(root, "node_modules", ".bin", runtime.executable),
+    resolve(root, "node_modules", ".bin", `${runtime.executable}.cmd`),
+    resolve(root, "node_modules", ".bin", `${runtime.executable}.ps1`)
+  ];
+  for (const c of candidates) {
+    if (existsSync(c)) return c;
+  }
+  return null;
+}
+export {
+  locateRunnerEntry,
+  probeRunner,
+  resolveRunnerCommand,
+  runRunnerCommand,
+  sanitizeRunnerPath
+};

package/dist/schema-evolution-guard/index.d.ts

@@ -0,0 +1,40 @@
+/**
+ * schema-evolution-guard plugin — guards database/API schema changes.
+ *
+ * Registers a `PostToolUse` hook on `write|edit` that scans files matching
+ * schema-related patterns for destructive changes:
+ *
+ *   - DROP TABLE / DROP COLUMN (Prisma migrations, raw SQL)
+ *   - NOT NULL added without a default (SQL)
+ *   - Required field without a default (Prisma, TypeScript schema files)
+ *   - Required field added to an OpenAPI schema (YAML/JSON)
+ *
+ * When a destructive pattern is found the plugin either injects an
+ * `additionalContext` warning or blocks the tool, depending on `failSeverity`.
+ *
+ * Tools registered:
+ *   - schema_evolution_status : counters + config snapshot.
+ *
+ * Config (`config.extensions['schema-evolution-guard']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "failSeverity": "warn", // "warn" | "block"
+ *   "maxFindings": 5,
+ *   "filePatterns": [
+ *     "*.prisma",
+ *     "*migration*.sql",
+ *     "*openapi*.yaml",
+ *     "*openapi*.json",
+ *     "*schema*.ts"
+ *   ]
+ * }
+ * ```
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/schema-evolution-guard/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schema-evolution-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAkN/C,QAAA,MAAM,MAAM,EAAE,MAgNb,CAAC;eAEa,MAAM"}

package/dist/schema-evolution-guard.d.ts

@@ -1,42 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * schema-evolution-guard plugin — guards database/API schema changes.
- *
- * Registers a `PostToolUse` hook on `write|edit` that scans files matching
- * schema-related patterns for destructive changes:
- *
- *   - DROP TABLE / DROP COLUMN (Prisma migrations, raw SQL)
- *   - NOT NULL added without a default (SQL)
- *   - Required field without a default (Prisma, TypeScript schema files)
- *   - Required field added to an OpenAPI schema (YAML/JSON)
- *
- * When a destructive pattern is found the plugin either injects an
- * `additionalContext` warning or blocks the tool, depending on `failSeverity`.
- *
- * Tools registered:
- *   - schema_evolution_status : counters + config snapshot.
- *
- * Config (`config.extensions['schema-evolution-guard']`):
- *
- * ```jsonc
- * {
- *   "enabled": true,
- *   "failSeverity": "warn", // "warn" | "block"
- *   "maxFindings": 5,
- *   "filePatterns": [
- *     "*.prisma",
- *     "*migration*.sql",
- *     "*openapi*.yaml",
- *     "*openapi*.json",
- *     "*schema*.ts"
- *   ]
- * }
- * ```
- *
- * @public
- */
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './schema-evolution-guard/index.js';
+export { default } from './schema-evolution-guard/index.js';

package/dist/schema-evolution-guard.js

@@ -1,7 +1,6 @@
-import { readFileSync } from 'fs';
-import { basename, isAbsolute, resolve, relative } from 'path';
-
 // src/schema-evolution-guard/index.ts
+import { readFileSync } from "node:fs";
+import { basename, isAbsolute, relative, resolve } from "node:path";
 var API_VERSION = "^0.1.10";
 var state = {
   invocationCount: 0,
@@ -315,5 +314,6 @@ ${body}${suffix}`;
   }
 };
 var schema_evolution_guard_default = plugin;
-
-export { schema_evolution_guard_default as default };
+export {
+  schema_evolution_guard_default as default
+};

package/dist/secret-scanner/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * secret-scanner plugin — Pre-tool and post-tool hooks that block, redact,
+ * or warn about plaintext credentials flowing into or out of tools.
+ *
+ * Tools registered:
+ * - secret_scanner_status  : Show which patterns are active, recent
+ *                            blocks/leaks, and current mode.
+ * - secret_scanner_test    : Run the scanner against a user-supplied
+ *                            string and report which patterns matched.
+ *
+ * Hooks registered:
+ * - PreToolUse with matcher `bash|write|edit` (configurable). Default
+ *   action is to BLOCK; the plugin can also auto-redact the offending
+ *   fields via `HookOutcome.modifiedInput`.
+ * - PostToolUse with matcher `*` (configurable via `postToolUseMatcher`).
+ *   Scans tool OUTPUT for secrets that leaked through. Since the tool
+ *   has already run, the hook cannot block — instead it injects an
+ *   `additionalContext` warning so the LLM knows the output contains
+ *   a secret and should NOT echo it, store it, or commit it.
+ *
+ * Why a separate plugin from the built-in `DefaultSecretScrubber`?
+ * The scrubber is *output* sanitization (replace secrets with
+ * `[REDACTED:type]` before they leave the system). The scanner is
+ * *prevention* (stop the tool from running with a secret in the first
+ *   place) + *detection* (flag secrets that leaked through the output).
+ * They share the same threat model but act at different points in the
+ * pipeline.
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/secret-scanner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secret-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAua/C,QAAA,MAAM,MAAM,EAAE,MAgOb,CAAC;eAEa,MAAM"}

package/dist/secret-scanner.d.ts

@@ -1,34 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * secret-scanner plugin — Pre-tool and post-tool hooks that block, redact,
- * or warn about plaintext credentials flowing into or out of tools.
- *
- * Tools registered:
- * - secret_scanner_status  : Show which patterns are active, recent
- *                            blocks/leaks, and current mode.
- * - secret_scanner_test    : Run the scanner against a user-supplied
- *                            string and report which patterns matched.
- *
- * Hooks registered:
- * - PreToolUse with matcher `bash|write|edit` (configurable). Default
- *   action is to BLOCK; the plugin can also auto-redact the offending
- *   fields via `HookOutcome.modifiedInput`.
- * - PostToolUse with matcher `*` (configurable via `postToolUseMatcher`).
- *   Scans tool OUTPUT for secrets that leaked through. Since the tool
- *   has already run, the hook cannot block — instead it injects an
- *   `additionalContext` warning so the LLM knows the output contains
- *   a secret and should NOT echo it, store it, or commit it.
- *
- * Why a separate plugin from the built-in `DefaultSecretScrubber`?
- * The scrubber is *output* sanitization (replace secrets with
- * `[REDACTED:type]` before they leave the system). The scanner is
- * *prevention* (stop the tool from running with a secret in the first
- *   place) + *detection* (flag secrets that leaked through the output).
- * They share the same threat model but act at different points in the
- * pipeline.
- */
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './secret-scanner/index.js';
+export { default } from './secret-scanner/index.js';

package/dist/secret-scanner.js

@@ -420,5 +420,6 @@ var plugin = {
   }
 };
 var secret_scanner_default = plugin;
-
-export { secret_scanner_default as default };
+export {
+  secret_scanner_default as default
+};

package/dist/security-hotspot-scanner/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * security-hotspot-scanner plugin — scans source code for common security
+ * anti-patterns and reports them via tools + a PostToolUse hook.
+ *
+ * Tools registered:
+ * - security_hotspot_scan   : scan a file or directory for security hotspots
+ * - security_hotspot_status : config + per-session counters
+ *
+ * Hooks registered:
+ * - PostToolUse with matcher `write|edit` to warn about newly introduced hotspots.
+ *
+ * Config (`config.extensions['security-hotspot-scanner']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "severity": "warn",          // "warn" | "block"
+ *   "maxFindings": 10,
+ *   "scanOnChange": [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".py"]
+ * }
+ * ```
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/security-hotspot-scanner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security-hotspot-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAwQ/C,QAAA,MAAM,MAAM,EAAE,MAiQb,CAAC;eAEa,MAAM"}

package/dist/security-hotspot-scanner.d.ts

@@ -1,30 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * security-hotspot-scanner plugin — scans source code for common security
- * anti-patterns and reports them via tools + a PostToolUse hook.
- *
- * Tools registered:
- * - security_hotspot_scan   : scan a file or directory for security hotspots
- * - security_hotspot_status : config + per-session counters
- *
- * Hooks registered:
- * - PostToolUse with matcher `write|edit` to warn about newly introduced hotspots.
- *
- * Config (`config.extensions['security-hotspot-scanner']`):
- *
- * ```jsonc
- * {
- *   "enabled": true,
- *   "severity": "warn",          // "warn" | "block"
- *   "maxFindings": 10,
- *   "scanOnChange": [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".py"]
- * }
- * ```
- *
- * @public
- */
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './security-hotspot-scanner/index.js';
+export { default } from './security-hotspot-scanner/index.js';

package/dist/security-hotspot-scanner.js

@@ -1,7 +1,6 @@
-import { statSync, readdirSync, readFileSync } from 'fs';
-import { isAbsolute, resolve, relative } from 'path';
-
 // src/security-hotspot-scanner/index.ts
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
 var API_VERSION = "^0.1.10";
 var state = {
   scanCount: 0,
@@ -398,5 +397,6 @@ Review or remove the risky pattern(s).`;
   }
 };
 var security_hotspot_scanner_default = plugin;
-
-export { security_hotspot_scanner_default as default };
+export {
+  security_hotspot_scanner_default as default
+};

package/dist/semantic-search-indexer/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * semantic-search-indexer plugin — lightweight keyword-based search over
+ * project source files.
+ *
+ * The plugin builds an in-memory inverted index (no persistence, no
+ * embeddings) and exposes two tools:
+ *
+ *  - `semantic_search`       — ranked keyword search with TF scoring
+ *  - `semantic_index_status` — index counters and configuration
+ *
+ * Files are tokenized into lowercase alphanumeric terms and indexed with
+ * per-document term frequencies. Queries are scored by summing the TF of
+ * each matched query token, then results are returned with the matching
+ * file path, score, and a handful of matched lines.
+ *
+ * Config (`config.extensions['semantic-search-indexer']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "includeExtensions": [".ts", ".tsx", ".js", ".jsx"],
+ *   "excludePatterns": ["node_modules", "\\.git", "dist"],
+ *   "maxFileBytes": 1_000_000,
+ *   "defaultLimit": 10,
+ *   "minTokenLength": 2,
+ *   "maxMatchesPerFile": 10,
+ *   "maxFiles": 5000
+ * }
+ * ```
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/semantic-search-indexer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/semantic-search-indexer/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA6b/C,QAAA,MAAM,MAAM,EAAE,MA6Nb,CAAC;eAEa,MAAM"}

package/dist/semantic-search-indexer.d.ts

@@ -1,38 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * semantic-search-indexer plugin — lightweight keyword-based search over
- * project source files.
- *
- * The plugin builds an in-memory inverted index (no persistence, no
- * embeddings) and exposes two tools:
- *
- *  - `semantic_search`       — ranked keyword search with TF scoring
- *  - `semantic_index_status` — index counters and configuration
- *
- * Files are tokenized into lowercase alphanumeric terms and indexed with
- * per-document term frequencies. Queries are scored by summing the TF of
- * each matched query token, then results are returned with the matching
- * file path, score, and a handful of matched lines.
- *
- * Config (`config.extensions['semantic-search-indexer']`):
- *
- * ```jsonc
- * {
- *   "enabled": true,
- *   "includeExtensions": [".ts", ".tsx", ".js", ".jsx"],
- *   "excludePatterns": ["node_modules", "\\.git", "dist"],
- *   "maxFileBytes": 1_000_000,
- *   "defaultLimit": 10,
- *   "minTokenLength": 2,
- *   "maxMatchesPerFile": 10,
- *   "maxFiles": 5000
- * }
- * ```
- *
- * @public
- */
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './semantic-search-indexer/index.js';
+export { default } from './semantic-search-indexer/index.js';

package/dist/semantic-search-indexer.js

@@ -1,7 +1,6 @@
-import * as fs from 'fs/promises';
-import { isAbsolute, resolve, relative } from 'path';
-
 // src/semantic-search-indexer/index.ts
+import * as fs from "node:fs/promises";
+import { isAbsolute, relative, resolve } from "node:path";
 var API_VERSION = "^0.1.10";
 var state = {
   index: null,
@@ -12,7 +11,9 @@ var state = {
   truncated: false,
   queryCount: 0,
   reindexCount: 0,
-  buildPromise: null};
+  buildPromise: null,
+  hookUnregister: null
+};
 var DEFAULTS = {
   enabled: true,
   includeExtensions: [
@@ -372,6 +373,13 @@ var plugin = {
     state.queryCount = 0;
     state.reindexCount = 0;
     state.buildPromise = null;
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
     const cfg = readConfig(api.config.extensions?.["semantic-search-indexer"]);
     api.tools.register({
       name: "semantic_search",
@@ -457,6 +465,13 @@ var plugin = {
     });
   },
   teardown(api) {
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
     const final = {
       fileCount: state.fileCount,
       termCount: state.termCount,
@@ -489,5 +504,6 @@ var plugin = {
   }
 };
 var semantic_search_indexer_default = plugin;
-
-export { semantic_search_indexer_default as default };
+export {
+  semantic_search_indexer_default as default
+};

package/dist/semver-bump/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * semver-bump plugin — Conventional-commit-driven semver version bumps.
+ *
+ * Tools registered:
+ * - semver_bump: Determine and apply the next version bump
+ * - semver_current: Show the current version from package.json
+ * - semver_changelog: Generate a changelog between two versions
+ */
+import type { Plugin } from '@wrongstack/core';
+type BumpType = 'major' | 'minor' | 'patch' | 'auto';
+interface ConventionalCommit {
+    hash: string;
+    type: string;
+    scope?: string | undefined;
+    message: string;
+    breaking: boolean;
+}
+/** Parse a conventional-commit subject line. Accepts the breaking `!` both
+ * before and after the scope (`feat!: x`, `feat(api)!: x`). */
+export declare function parseConventional(subject: string): Omit<ConventionalCommit, 'hash'>;
+export declare function determineBump(commits: ConventionalCommit[]): BumpType;
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/semver-bump/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/semver-bump/index.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAuC/C,KAAK,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;AAErD,UAAU,kBAAkB;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAoFD;+DAC+D;AAC/D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAQnF;AAmBD,wBAAgB,aAAa,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,QAAQ,CAIrE;AAmED,QAAA,MAAM,MAAM,EAAE,MA6bb,CAAC;eAEa,MAAM"}