@wrongstack/plugins 0.284.1 → 0.285.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (263) hide show
  1. package/README.md +18 -14
  2. package/dist/accessibility-auditor/index.d.ts +38 -0
  3. package/dist/accessibility-auditor/index.d.ts.map +1 -0
  4. package/dist/accessibility-auditor.d.ts +2 -40
  5. package/dist/accessibility-auditor.js +5 -5
  6. package/dist/agent-handoff/index.d.ts +35 -0
  7. package/dist/agent-handoff/index.d.ts.map +1 -0
  8. package/dist/agent-handoff.d.ts +2 -37
  9. package/dist/agent-handoff.js +3 -2
  10. package/dist/api-compatibility-gate/index.d.ts +36 -0
  11. package/dist/api-compatibility-gate/index.d.ts.map +1 -0
  12. package/dist/api-compatibility-gate.d.ts +2 -38
  13. package/dist/api-compatibility-gate.js +6 -6
  14. package/dist/auto-doc/index.d.ts +20 -0
  15. package/dist/auto-doc/index.d.ts.map +1 -0
  16. package/dist/auto-doc.d.ts +2 -22
  17. package/dist/auto-doc.js +5 -5
  18. package/dist/auto-escalate/index.d.ts +43 -0
  19. package/dist/auto-escalate/index.d.ts.map +1 -0
  20. package/dist/auto-escalate.d.ts +2 -45
  21. package/dist/auto-escalate.js +5 -2
  22. package/dist/auto-i18n-extractor/index.d.ts +34 -0
  23. package/dist/auto-i18n-extractor/index.d.ts.map +1 -0
  24. package/dist/auto-i18n-extractor.d.ts +2 -36
  25. package/dist/auto-i18n-extractor.js +5 -5
  26. package/dist/branch-guard/index.d.ts +32 -0
  27. package/dist/branch-guard/index.d.ts.map +1 -0
  28. package/dist/branch-guard.d.ts +2 -34
  29. package/dist/branch-guard.js +4 -4
  30. package/dist/catalog.d.ts +39 -0
  31. package/dist/catalog.d.ts.map +1 -0
  32. package/dist/changelog-writer/index.d.ts +71 -0
  33. package/dist/changelog-writer/index.d.ts.map +1 -0
  34. package/dist/changelog-writer.d.ts +2 -73
  35. package/dist/changelog-writer.js +9 -5
  36. package/dist/checkpoint/index.d.ts +53 -0
  37. package/dist/checkpoint/index.d.ts.map +1 -0
  38. package/dist/checkpoint.d.ts +2 -55
  39. package/dist/checkpoint.js +6 -6
  40. package/dist/code-metrics/index.d.ts +29 -0
  41. package/dist/code-metrics/index.d.ts.map +1 -0
  42. package/dist/code-metrics.d.ts +2 -31
  43. package/dist/code-metrics.js +5 -5
  44. package/dist/commit-validator/index.d.ts +31 -0
  45. package/dist/commit-validator/index.d.ts.map +1 -0
  46. package/dist/commit-validator.d.ts +2 -33
  47. package/dist/commit-validator.js +5 -3
  48. package/dist/config-validator/index.d.ts +46 -0
  49. package/dist/config-validator/index.d.ts.map +1 -0
  50. package/dist/config-validator.d.ts +2 -48
  51. package/dist/config-validator.js +8 -4
  52. package/dist/context-pins/index.d.ts +43 -0
  53. package/dist/context-pins/index.d.ts.map +1 -0
  54. package/dist/context-pins.d.ts +2 -45
  55. package/dist/context-pins.js +5 -5
  56. package/dist/cost-tracker/index.d.ts +51 -0
  57. package/dist/cost-tracker/index.d.ts.map +1 -0
  58. package/dist/cost-tracker.d.ts +2 -53
  59. package/dist/cost-tracker.js +4 -4
  60. package/dist/cron/index.d.ts +12 -0
  61. package/dist/cron/index.d.ts.map +1 -0
  62. package/dist/cron.d.ts +2 -14
  63. package/dist/cron.js +3 -2
  64. package/dist/dead-code-detector/index.d.ts +32 -0
  65. package/dist/dead-code-detector/index.d.ts.map +1 -0
  66. package/dist/dead-code-detector.d.ts +2 -34
  67. package/dist/dead-code-detector.js +5 -5
  68. package/dist/dep-guard/index.d.ts +63 -0
  69. package/dist/dep-guard/index.d.ts.map +1 -0
  70. package/dist/dep-guard.d.ts +2 -65
  71. package/dist/dep-guard.js +6 -2
  72. package/dist/dependency-vulnerability-gate/index.d.ts +33 -0
  73. package/dist/dependency-vulnerability-gate/index.d.ts.map +1 -0
  74. package/dist/dependency-vulnerability-gate.d.ts +2 -35
  75. package/dist/dependency-vulnerability-gate.js +5 -5
  76. package/dist/diff-summary/index.d.ts +34 -0
  77. package/dist/diff-summary/index.d.ts.map +1 -0
  78. package/dist/diff-summary.d.ts +2 -36
  79. package/dist/diff-summary.js +5 -5
  80. package/dist/doc-sync-guard/index.d.ts +31 -0
  81. package/dist/doc-sync-guard/index.d.ts.map +1 -0
  82. package/dist/doc-sync-guard.d.ts +2 -33
  83. package/dist/doc-sync-guard.js +4 -4
  84. package/dist/duplicate-code-detector/index.d.ts +31 -0
  85. package/dist/duplicate-code-detector/index.d.ts.map +1 -0
  86. package/dist/duplicate-code-detector.d.ts +2 -33
  87. package/dist/duplicate-code-detector.js +5 -5
  88. package/dist/error-lens/index.d.ts +65 -0
  89. package/dist/error-lens/index.d.ts.map +1 -0
  90. package/dist/error-lens.d.ts +2 -67
  91. package/dist/error-lens.js +5 -2
  92. package/dist/feature-flag-tracker/index.d.ts +36 -0
  93. package/dist/feature-flag-tracker/index.d.ts.map +1 -0
  94. package/dist/feature-flag-tracker.d.ts +2 -38
  95. package/dist/feature-flag-tracker.js +5 -5
  96. package/dist/file-watcher/index.d.ts +12 -0
  97. package/dist/file-watcher/index.d.ts.map +1 -0
  98. package/dist/file-watcher.d.ts +2 -14
  99. package/dist/file-watcher.js +7 -7
  100. package/dist/format-on-save/index.d.ts +33 -0
  101. package/dist/format-on-save/index.d.ts.map +1 -0
  102. package/dist/format-on-save.d.ts +2 -35
  103. package/dist/format-on-save.js +6 -6
  104. package/dist/git-autocommit/index.d.ts +15 -0
  105. package/dist/git-autocommit/index.d.ts.map +1 -0
  106. package/dist/git-autocommit.d.ts +2 -17
  107. package/dist/git-autocommit.js +5 -5
  108. package/dist/import-organizer/index.d.ts +50 -0
  109. package/dist/import-organizer/index.d.ts.map +1 -0
  110. package/dist/import-organizer.d.ts +2 -52
  111. package/dist/import-organizer.js +6 -6
  112. package/dist/index.d.ts +186 -64
  113. package/dist/index.d.ts.map +1 -0
  114. package/dist/index.js +946 -394
  115. package/dist/injection-shield/index.d.ts +47 -0
  116. package/dist/injection-shield/index.d.ts.map +1 -0
  117. package/dist/injection-shield.d.ts +2 -49
  118. package/dist/injection-shield.js +4 -2
  119. package/dist/interface-contract-guard/index.d.ts +35 -0
  120. package/dist/interface-contract-guard/index.d.ts.map +1 -0
  121. package/dist/interface-contract-guard.d.ts +2 -37
  122. package/dist/interface-contract-guard.js +5 -5
  123. package/dist/knowledge-graph/index.d.ts +43 -0
  124. package/dist/knowledge-graph/index.d.ts.map +1 -0
  125. package/dist/knowledge-graph.d.ts +2 -45
  126. package/dist/knowledge-graph.js +5 -5
  127. package/dist/license-audit-gate/index.d.ts +32 -0
  128. package/dist/license-audit-gate/index.d.ts.map +1 -0
  129. package/dist/license-audit-gate.d.ts +2 -34
  130. package/dist/license-audit-gate.js +5 -5
  131. package/dist/lint-gate/index.d.ts +31 -0
  132. package/dist/lint-gate/index.d.ts.map +1 -0
  133. package/dist/lint-gate.d.ts +2 -33
  134. package/dist/lint-gate.js +7 -7
  135. package/dist/llm-cache/index.d.ts +54 -0
  136. package/dist/llm-cache/index.d.ts.map +1 -0
  137. package/dist/llm-cache.d.ts +2 -56
  138. package/dist/llm-cache.js +6 -4
  139. package/dist/loop-breaker/index.d.ts +4 -0
  140. package/dist/loop-breaker/index.d.ts.map +1 -0
  141. package/dist/loop-breaker.d.ts +2 -5
  142. package/dist/loop-breaker.js +4 -4
  143. package/dist/migration-planner/index.d.ts +28 -0
  144. package/dist/migration-planner/index.d.ts.map +1 -0
  145. package/dist/migration-planner.d.ts +2 -30
  146. package/dist/migration-planner.js +5 -5
  147. package/dist/model-router/index.d.ts +67 -0
  148. package/dist/model-router/index.d.ts.map +1 -0
  149. package/dist/model-router.d.ts +2 -69
  150. package/dist/model-router.js +5 -2
  151. package/dist/notify-hub/index.d.ts +43 -0
  152. package/dist/notify-hub/index.d.ts.map +1 -0
  153. package/dist/notify-hub.d.ts +2 -45
  154. package/dist/notify-hub.js +3 -2
  155. package/dist/path-guard/index.d.ts +52 -0
  156. package/dist/path-guard/index.d.ts.map +1 -0
  157. package/dist/path-guard.d.ts +2 -54
  158. package/dist/path-guard.js +5 -2
  159. package/dist/performance-regression-gate/index.d.ts +31 -0
  160. package/dist/performance-regression-gate/index.d.ts.map +1 -0
  161. package/dist/performance-regression-gate.d.ts +2 -33
  162. package/dist/performance-regression-gate.js +5 -5
  163. package/dist/plugin-stack-observer/index.d.ts +33 -0
  164. package/dist/plugin-stack-observer/index.d.ts.map +1 -0
  165. package/dist/plugin-stack-observer.d.ts +2 -35
  166. package/dist/plugin-stack-observer.js +3 -2
  167. package/dist/pr-drafter/index.d.ts +33 -0
  168. package/dist/pr-drafter/index.d.ts.map +1 -0
  169. package/dist/pr-drafter.d.ts +2 -35
  170. package/dist/pr-drafter.js +6 -6
  171. package/dist/prompt-firewall/index.d.ts +55 -0
  172. package/dist/prompt-firewall/index.d.ts.map +1 -0
  173. package/dist/prompt-firewall.d.ts +2 -57
  174. package/dist/prompt-firewall.js +5 -2
  175. package/dist/refactor-suggester/index.d.ts +36 -0
  176. package/dist/refactor-suggester/index.d.ts.map +1 -0
  177. package/dist/refactor-suggester.d.ts +2 -38
  178. package/dist/refactor-suggester.js +5 -5
  179. package/dist/release-notes-generator/index.d.ts +25 -0
  180. package/dist/release-notes-generator/index.d.ts.map +1 -0
  181. package/dist/release-notes-generator.d.ts +2 -27
  182. package/dist/release-notes-generator.js +28 -10
  183. package/dist/runtime/index.d.ts +124 -0
  184. package/dist/runtime/index.d.ts.map +1 -0
  185. package/dist/runtime.d.ts +1 -0
  186. package/dist/runtime.js +216 -0
  187. package/dist/schema-evolution-guard/index.d.ts +40 -0
  188. package/dist/schema-evolution-guard/index.d.ts.map +1 -0
  189. package/dist/schema-evolution-guard.d.ts +2 -42
  190. package/dist/schema-evolution-guard.js +5 -5
  191. package/dist/secret-scanner/index.d.ts +32 -0
  192. package/dist/secret-scanner/index.d.ts.map +1 -0
  193. package/dist/secret-scanner.d.ts +2 -34
  194. package/dist/secret-scanner.js +3 -2
  195. package/dist/security-hotspot-scanner/index.d.ts +28 -0
  196. package/dist/security-hotspot-scanner/index.d.ts.map +1 -0
  197. package/dist/security-hotspot-scanner.d.ts +2 -30
  198. package/dist/security-hotspot-scanner.js +5 -5
  199. package/dist/semantic-search-indexer/index.d.ts +36 -0
  200. package/dist/semantic-search-indexer/index.d.ts.map +1 -0
  201. package/dist/semantic-search-indexer.d.ts +2 -38
  202. package/dist/semantic-search-indexer.js +22 -6
  203. package/dist/semver-bump/index.d.ts +24 -0
  204. package/dist/semver-bump/index.d.ts.map +1 -0
  205. package/dist/semver-bump.d.ts +2 -26
  206. package/dist/semver-bump.js +10 -8
  207. package/dist/session-recap/index.d.ts +48 -0
  208. package/dist/session-recap/index.d.ts.map +1 -0
  209. package/dist/session-recap.d.ts +2 -50
  210. package/dist/session-recap.js +6 -4
  211. package/dist/shell-check/index.d.ts +14 -0
  212. package/dist/shell-check/index.d.ts.map +1 -0
  213. package/dist/shell-check.d.ts +2 -16
  214. package/dist/shell-check.js +6 -6
  215. package/dist/smart-rename/index.d.ts +24 -0
  216. package/dist/smart-rename/index.d.ts.map +1 -0
  217. package/dist/smart-rename.d.ts +2 -26
  218. package/dist/smart-rename.js +5 -5
  219. package/dist/spec-linker/index.d.ts +49 -0
  220. package/dist/spec-linker/index.d.ts.map +1 -0
  221. package/dist/spec-linker.d.ts +2 -51
  222. package/dist/spec-linker.js +20100 -244
  223. package/dist/template-engine/index.d.ts +13 -0
  224. package/dist/template-engine/index.d.ts.map +1 -0
  225. package/dist/template-engine.d.ts +2 -15
  226. package/dist/template-engine.js +7 -7
  227. package/dist/test-coverage-gate/index.d.ts +35 -0
  228. package/dist/test-coverage-gate/index.d.ts.map +1 -0
  229. package/dist/test-coverage-gate.d.ts +2 -37
  230. package/dist/test-coverage-gate.js +5 -5
  231. package/dist/test-flake-detector/index.d.ts +25 -0
  232. package/dist/test-flake-detector/index.d.ts.map +1 -0
  233. package/dist/test-flake-detector.d.ts +2 -27
  234. package/dist/test-flake-detector.js +98 -13
  235. package/dist/test-generator/index.d.ts +30 -0
  236. package/dist/test-generator/index.d.ts.map +1 -0
  237. package/dist/test-generator.d.ts +2 -32
  238. package/dist/test-generator.js +5 -5
  239. package/dist/test-runner-gate/index.d.ts +35 -0
  240. package/dist/test-runner-gate/index.d.ts.map +1 -0
  241. package/dist/test-runner-gate.d.ts +2 -37
  242. package/dist/test-runner-gate.js +6 -6
  243. package/dist/todo-listener/index.d.ts +35 -0
  244. package/dist/todo-listener/index.d.ts.map +1 -0
  245. package/dist/todo-listener.d.ts +2 -37
  246. package/dist/todo-listener.js +3 -2
  247. package/dist/todo-tracker/index.d.ts +4 -0
  248. package/dist/todo-tracker/index.d.ts.map +1 -0
  249. package/dist/todo-tracker.d.ts +2 -5
  250. package/dist/todo-tracker.js +5 -5
  251. package/dist/token-budget/index.d.ts +38 -0
  252. package/dist/token-budget/index.d.ts.map +1 -0
  253. package/dist/token-budget.d.ts +2 -40
  254. package/dist/token-budget.js +3 -2
  255. package/dist/token-throttle/index.d.ts +52 -0
  256. package/dist/token-throttle/index.d.ts.map +1 -0
  257. package/dist/token-throttle.d.ts +2 -54
  258. package/dist/token-throttle.js +6 -2
  259. package/dist/type-gate/index.d.ts +35 -0
  260. package/dist/type-gate/index.d.ts.map +1 -0
  261. package/dist/type-gate.d.ts +2 -37
  262. package/dist/type-gate.js +236 -43
  263. package/package.json +10 -7
@@ -134,5 +134,6 @@ function readConfig(raw) {
134
134
  };
135
135
  }
136
136
  var plugin_stack_observer_default = PLUGIN;
137
-
138
- export { plugin_stack_observer_default as default };
137
+ export {
138
+ plugin_stack_observer_default as default
139
+ };
@@ -0,0 +1,33 @@
1
+ /**
2
+ * pr-drafter plugin — collects work done during a session and drafts a
3
+ * pull-request description.
4
+ *
5
+ * As the session runs, the plugin listens to:
6
+ * - `tool.completed` events for `git_autocommit` (records commit messages)
7
+ * - `tool.completed` events for `write`/`edit` (records changed files)
8
+ * - `provider.response` events (records model usage)
9
+ *
10
+ * On `Stop` it composes a markdown PR body and writes it to a configurable
11
+ * file (default: `.wrongstack/PR_DRAFT.md`). A `pr_draft` tool lets the
12
+ * agent request the draft on demand.
13
+ *
14
+ * Config (`config.extensions['pr-drafter']`):
15
+ *
16
+ * ```jsonc
17
+ * {
18
+ * "enabled": true,
19
+ * "outputPath": ".wrongstack/PR_DRAFT.md",
20
+ * "writeOnStop": true,
21
+ * "includeDiff": true,
22
+ * "includeCommits": true,
23
+ * "includeFiles": true,
24
+ * "aiSummary": false
25
+ * }
26
+ * ```
27
+ *
28
+ * @public
29
+ */
30
+ import type { Plugin } from '@wrongstack/core';
31
+ declare const plugin: Plugin;
32
+ export default plugin;
33
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/pr-drafter/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAa,MAAM,kBAAkB,CAAC;AA4M1D,QAAA,MAAM,MAAM,EAAE,MAyNb,CAAC;eAEa,MAAM"}
@@ -1,35 +1,2 @@
1
- import { Plugin } from '@wrongstack/core';
2
-
3
- /**
4
- * pr-drafter plugin — collects work done during a session and drafts a
5
- * pull-request description.
6
- *
7
- * As the session runs, the plugin listens to:
8
- * - `tool.completed` events for `git_autocommit` (records commit messages)
9
- * - `tool.completed` events for `write`/`edit` (records changed files)
10
- * - `provider.response` events (records model usage)
11
- *
12
- * On `Stop` it composes a markdown PR body and writes it to a configurable
13
- * file (default: `.wrongstack/PR_DRAFT.md`). A `pr_draft` tool lets the
14
- * agent request the draft on demand.
15
- *
16
- * Config (`config.extensions['pr-drafter']`):
17
- *
18
- * ```jsonc
19
- * {
20
- * "enabled": true,
21
- * "outputPath": ".wrongstack/PR_DRAFT.md",
22
- * "writeOnStop": true,
23
- * "includeDiff": true,
24
- * "includeCommits": true,
25
- * "includeFiles": true,
26
- * "aiSummary": false
27
- * }
28
- * ```
29
- *
30
- * @public
31
- */
32
-
33
- declare const plugin: Plugin;
34
-
35
- export { plugin as default };
1
+ export * from './pr-drafter/index.js';
2
+ export { default } from './pr-drafter/index.js';
@@ -1,8 +1,7 @@
1
- import { execFileSync } from 'child_process';
2
- import { mkdirSync, writeFileSync } from 'fs';
3
- import { dirname, resolve, isAbsolute, relative } from 'path';
4
-
5
1
  // src/pr-drafter/index.ts
2
+ import { execFileSync } from "node:child_process";
3
+ import { mkdirSync, writeFileSync } from "node:fs";
4
+ import { dirname, isAbsolute, relative, resolve } from "node:path";
6
5
  var API_VERSION = "^0.1.10";
7
6
  var state = {
8
7
  commits: [],
@@ -330,5 +329,6 @@ var plugin = {
330
329
  }
331
330
  };
332
331
  var pr_drafter_default = plugin;
333
-
334
- export { pr_drafter_default as default };
332
+ export {
333
+ pr_drafter_default as default
334
+ };
@@ -0,0 +1,55 @@
1
+ /**
2
+ * prompt-firewall plugin — inspects and redacts secrets on the provider
3
+ * wire, before context leaves for the LLM API and as it returns.
4
+ *
5
+ * Distinct from `secret-scanner` (which guards the TOOL boundary): this
6
+ * sits on `AgentExtension.wrapProviderRunner`, so it sees the FULL
7
+ * request that is about to be sent to a third-party LLM provider —
8
+ * regardless of how a secret entered the conversation. It scans the
9
+ * outgoing request's system + message text for high-confidence
10
+ * credential patterns and, depending on `mode`:
11
+ *
12
+ * - `warn` (default) — logs + counts + emits a `prompt-firewall:leak`
13
+ * event; the request goes through unchanged
14
+ * - `redact` — replaces each match with `[REDACTED:<kind>]` in a CLONE
15
+ * of the request before sending, and also redacts secrets echoed back
16
+ * in the response
17
+ * - `block` — throws before the request is sent (the agent's error
18
+ * path surfaces it), so the secret never reaches the provider
19
+ *
20
+ * Safety posture: opt-in — loads inert until
21
+ * `config.extensions['prompt-firewall'].enabled = true`. `warn` is the
22
+ * default so it can never corrupt context until you deliberately choose
23
+ * `redact`/`block`.
24
+ *
25
+ * Config (`config.extensions['prompt-firewall']`):
26
+ *
27
+ * ```jsonc
28
+ * {
29
+ * "enabled": false,
30
+ * "mode": "warn", // "warn" | "redact" | "block"
31
+ * "scanResponse": true, // redact secrets echoed back (redact mode)
32
+ * "allow": [] // regex source strings to exempt (false positives)
33
+ * }
34
+ * ```
35
+ *
36
+ * Tools:
37
+ * - `prompt_firewall_status` — mode, pattern names, detection counters
38
+ *
39
+ * @public
40
+ */
41
+ import type { Plugin } from '@wrongstack/core';
42
+ export interface Detection {
43
+ kind: string;
44
+ count: number;
45
+ }
46
+ /** Detect secret matches in text. Returns per-kind counts (no values). */
47
+ export declare function detectSecrets(text: string, allow: RegExp[]): Detection[];
48
+ /** Redact secret matches in text, replacing each with `[REDACTED:<kind>]`. */
49
+ export declare function redactSecrets(text: string, allow: RegExp[]): {
50
+ text: string;
51
+ redactions: number;
52
+ };
53
+ declare const plugin: Plugin;
54
+ export default plugin;
55
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/prompt-firewall/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAa,MAAM,kBAAkB,CAAC;AA+B1D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAcxE;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAWjG;AA6GD,QAAA,MAAM,MAAM,EAAE,MAkNb,CAAC;eAEa,MAAM"}
@@ -1,57 +1,2 @@
1
- import { Plugin } from '@wrongstack/core';
2
-
3
- /**
4
- * prompt-firewall plugin — inspects and redacts secrets on the provider
5
- * wire, before context leaves for the LLM API and as it returns.
6
- *
7
- * Distinct from `secret-scanner` (which guards the TOOL boundary): this
8
- * sits on `AgentExtension.wrapProviderRunner`, so it sees the FULL
9
- * request that is about to be sent to a third-party LLM provider —
10
- * regardless of how a secret entered the conversation. It scans the
11
- * outgoing request's system + message text for high-confidence
12
- * credential patterns and, depending on `mode`:
13
- *
14
- * - `warn` (default) — logs + counts + emits a `prompt-firewall:leak`
15
- * event; the request goes through unchanged
16
- * - `redact` — replaces each match with `[REDACTED:<kind>]` in a CLONE
17
- * of the request before sending, and also redacts secrets echoed back
18
- * in the response
19
- * - `block` — throws before the request is sent (the agent's error
20
- * path surfaces it), so the secret never reaches the provider
21
- *
22
- * Safety posture: opt-in — loads inert until
23
- * `config.extensions['prompt-firewall'].enabled = true`. `warn` is the
24
- * default so it can never corrupt context until you deliberately choose
25
- * `redact`/`block`.
26
- *
27
- * Config (`config.extensions['prompt-firewall']`):
28
- *
29
- * ```jsonc
30
- * {
31
- * "enabled": false,
32
- * "mode": "warn", // "warn" | "redact" | "block"
33
- * "scanResponse": true, // redact secrets echoed back (redact mode)
34
- * "allow": [] // regex source strings to exempt (false positives)
35
- * }
36
- * ```
37
- *
38
- * Tools:
39
- * - `prompt_firewall_status` — mode, pattern names, detection counters
40
- *
41
- * @public
42
- */
43
-
44
- interface Detection {
45
- kind: string;
46
- count: number;
47
- }
48
- /** Detect secret matches in text. Returns per-kind counts (no values). */
49
- declare function detectSecrets(text: string, allow: RegExp[]): Detection[];
50
- /** Redact secret matches in text, replacing each with `[REDACTED:<kind>]`. */
51
- declare function redactSecrets(text: string, allow: RegExp[]): {
52
- text: string;
53
- redactions: number;
54
- };
55
- declare const plugin: Plugin;
56
-
57
- export { type Detection, plugin as default, detectSecrets, redactSecrets };
1
+ export * from './prompt-firewall/index.js';
2
+ export { default } from './prompt-firewall/index.js';
@@ -291,5 +291,8 @@ var plugin = {
291
291
  }
292
292
  };
293
293
  var prompt_firewall_default = plugin;
294
-
295
- export { prompt_firewall_default as default, detectSecrets, redactSecrets };
294
+ export {
295
+ prompt_firewall_default as default,
296
+ detectSecrets,
297
+ redactSecrets
298
+ };
@@ -0,0 +1,36 @@
1
+ /**
2
+ * refactor-suggester plugin — regex-based smell detector that suggests
3
+ * refactoring opportunities in source files.
4
+ *
5
+ * Tools registered:
6
+ * - suggest_refactors : Scan a file or directory for smells.
7
+ * - refactor_status : Report config + counters.
8
+ *
9
+ * Hooks registered:
10
+ * - PostToolUse with matcher `write|edit` to source files, injecting
11
+ * suggestions for the changed file.
12
+ *
13
+ * Config (`config.extensions['refactor-suggester']`):
14
+ *
15
+ * ```jsonc
16
+ * {
17
+ * "enabled": true,
18
+ * "extensions": [".ts", ".tsx", ".js", ".jsx"],
19
+ * "maxSuggestions": 20,
20
+ * "rules": { "longFunctionLines": 50, "maxParams": 5, "maxNesting": 3 }
21
+ * }
22
+ * ```
23
+ *
24
+ * @public
25
+ */
26
+ import type { Plugin } from '@wrongstack/core';
27
+ export type SmellType = 'long-function' | 'deep-nesting' | 'many-parameters' | 'magic-number' | 'console-log';
28
+ export interface RefactorSuggestion {
29
+ file: string;
30
+ line: number;
31
+ type: SmellType;
32
+ message: string;
33
+ }
34
+ declare const plugin: Plugin;
35
+ export default plugin;
36
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/refactor-suggester/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAQ/C,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,aAAa,CAAC;AAElB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAiRD,QAAA,MAAM,MAAM,EAAE,MA4Nb,CAAC;eAEa,MAAM"}
@@ -1,38 +1,2 @@
1
- import { Plugin } from '@wrongstack/core';
2
-
3
- /**
4
- * refactor-suggester plugin — regex-based smell detector that suggests
5
- * refactoring opportunities in source files.
6
- *
7
- * Tools registered:
8
- * - suggest_refactors : Scan a file or directory for smells.
9
- * - refactor_status : Report config + counters.
10
- *
11
- * Hooks registered:
12
- * - PostToolUse with matcher `write|edit` to source files, injecting
13
- * suggestions for the changed file.
14
- *
15
- * Config (`config.extensions['refactor-suggester']`):
16
- *
17
- * ```jsonc
18
- * {
19
- * "enabled": true,
20
- * "extensions": [".ts", ".tsx", ".js", ".jsx"],
21
- * "maxSuggestions": 20,
22
- * "rules": { "longFunctionLines": 50, "maxParams": 5, "maxNesting": 3 }
23
- * }
24
- * ```
25
- *
26
- * @public
27
- */
28
-
29
- type SmellType = 'long-function' | 'deep-nesting' | 'many-parameters' | 'magic-number' | 'console-log';
30
- interface RefactorSuggestion {
31
- file: string;
32
- line: number;
33
- type: SmellType;
34
- message: string;
35
- }
36
- declare const plugin: Plugin;
37
-
38
- export { type RefactorSuggestion, type SmellType, plugin as default };
1
+ export * from './refactor-suggester/index.js';
2
+ export { default } from './refactor-suggester/index.js';
@@ -1,7 +1,6 @@
1
- import { readFileSync, existsSync, statSync, readdirSync } from 'fs';
2
- import { resolve, isAbsolute, relative, extname } from 'path';
3
-
4
1
  // src/refactor-suggester/index.ts
2
+ import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
3
+ import { extname, isAbsolute, relative, resolve } from "node:path";
5
4
  var API_VERSION = "^0.1.10";
6
5
  var state = {
7
6
  scanCount: 0,
@@ -378,5 +377,6 @@ var plugin = {
378
377
  }
379
378
  };
380
379
  var refactor_suggester_default = plugin;
381
-
382
- export { refactor_suggester_default as default };
380
+ export {
381
+ refactor_suggester_default as default
382
+ };
@@ -0,0 +1,25 @@
1
+ /**
2
+ * release-notes-generator plugin — generates grouped release notes from git
3
+ * history using conventional-commit parsing.
4
+ *
5
+ * Tool registered:
6
+ * - generate_release_notes : Produce grouped notes between two refs.
7
+ *
8
+ * No hooks are registered.
9
+ *
10
+ * Config (`config.extensions['release-notes-generator']`):
11
+ *
12
+ * ```jsonc
13
+ * {
14
+ * "enabled": true,
15
+ * "includeScope": true,
16
+ * "defaultFrom": "latest-tag"
17
+ * }
18
+ * ```
19
+ *
20
+ * @public
21
+ */
22
+ import type { Plugin } from '@wrongstack/core';
23
+ declare const plugin: Plugin;
24
+ export default plugin;
25
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release-notes-generator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAmL/C,QAAA,MAAM,MAAM,EAAE,MA+Gb,CAAC;eAEa,MAAM"}
@@ -1,27 +1,2 @@
1
- import { Plugin } from '@wrongstack/core';
2
-
3
- /**
4
- * release-notes-generator plugin — generates grouped release notes from git
5
- * history using conventional-commit parsing.
6
- *
7
- * Tool registered:
8
- * - generate_release_notes : Produce grouped notes between two refs.
9
- *
10
- * No hooks are registered.
11
- *
12
- * Config (`config.extensions['release-notes-generator']`):
13
- *
14
- * ```jsonc
15
- * {
16
- * "enabled": true,
17
- * "includeScope": true,
18
- * "defaultFrom": "latest-tag"
19
- * }
20
- * ```
21
- *
22
- * @public
23
- */
24
-
25
- declare const plugin: Plugin;
26
-
27
- export { plugin as default };
1
+ export * from './release-notes-generator/index.js';
2
+ export { default } from './release-notes-generator/index.js';
@@ -1,6 +1,5 @@
1
- import { execSync } from 'child_process';
2
-
3
1
  // src/release-notes-generator/index.ts
2
+ import { execFileSync } from "node:child_process";
4
3
  var API_VERSION = "^0.1.10";
5
4
  var state = {
6
5
  generateCount: 0,
@@ -41,23 +40,41 @@ function formatCommit(c, includeScope) {
41
40
  line += ` ${c.description}`;
42
41
  return line;
43
42
  }
43
+ var GIT_OPTIONS = {
44
+ encoding: "utf-8",
45
+ stdio: ["pipe", "pipe", "ignore"],
46
+ shell: false
47
+ };
44
48
  function resolveFromRef(defaultFrom, inputFrom) {
45
49
  if (inputFrom) return inputFrom;
46
50
  if (defaultFrom === "latest-tag") {
47
51
  try {
48
- return execSync("git describe --tags --abbrev=0", { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }).trim();
52
+ return execFileSync("git", ["describe", "--tags", "--abbrev=0"], GIT_OPTIONS).trim();
49
53
  } catch {
50
54
  return "";
51
55
  }
52
56
  }
53
57
  return defaultFrom;
54
58
  }
59
+ function resolveCommit(ref) {
60
+ const resolved = execFileSync(
61
+ "git",
62
+ ["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`],
63
+ GIT_OPTIONS
64
+ ).trim();
65
+ if (!/^[0-9a-f]{40,64}$/i.test(resolved)) {
66
+ throw new Error(`git returned an invalid commit id for ref ${JSON.stringify(ref)}`);
67
+ }
68
+ return resolved;
69
+ }
55
70
  function getCommits(from, to) {
56
- const range = from ? `${from}..${to}` : to;
57
- const output = execSync(`git log --pretty=format:'%H%x09%s' ${range}`, {
58
- encoding: "utf-8",
59
- stdio: ["pipe", "pipe", "ignore"]
60
- });
71
+ const toCommit = resolveCommit(to);
72
+ const range = from ? `${resolveCommit(from)}..${toCommit}` : toCommit;
73
+ const output = execFileSync(
74
+ "git",
75
+ ["log", "--pretty=format:%H%x09%s", "--end-of-options", range],
76
+ GIT_OPTIONS
77
+ );
61
78
  if (!output.trim()) return [];
62
79
  const commits = [];
63
80
  for (const line of output.split(/\r?\n/)) {
@@ -205,5 +222,6 @@ var plugin = {
205
222
  }
206
223
  };
207
224
  var release_notes_generator_default = plugin;
208
-
209
- export { release_notes_generator_default as default };
225
+ export {
226
+ release_notes_generator_default as default
227
+ };
@@ -0,0 +1,124 @@
1
+ /**
2
+ * @wrongstack/plugins — Language-agnostic runtime helper.
3
+ *
4
+ * Plugins that need to invoke a build-time or test-time tool
5
+ * (TypeScript's `tsc`, Node's `vitest`, Python's `pytest`, Rust's
6
+ * `cargo`, Go's `go test`, etc.) share this module instead of
7
+ * re-implementing argv/sandbox/allowlist logic.
8
+ *
9
+ * Why one module instead of three plugin-local copies?
10
+ * - One audit surface for security-sensitive code: arg-splitting,
11
+ * sandboxing, execFile-with-shell-false, maxBuffer, timeout.
12
+ * - Plugins stay focused on their domain (linters, type-checkers,
13
+ * test runners); the runtime helper owns the cross-cutting concern.
14
+ * - New languages opt in by adding a `LanguageRuntime` entry; the
15
+ * plugin layer keeps working unchanged.
16
+ *
17
+ * The public API is intentionally small:
18
+ * - `LanguageRuntime`: declares which language a plugin targets.
19
+ * - `resolveRunnerCommand(runtime, command, options)`: validate +
20
+ * split a user-supplied command into a safe argv array.
21
+ * - `sanitizeRunnerPath(value, options)`: reject paths outside
22
+ * the project or that start with `-` (option smuggling).
23
+ * - `runRunnerCommand(argv, options)`: spawn the resolved argv
24
+ * with `shell:false`, capture stdout/stderr/code, and apply
25
+ * timeout/abort.
26
+ * - `probeRunner(runtime, argv, options)`: cheap availability check.
27
+ *
28
+ * Anything language-specific (flag tables, default commands,
29
+ * output parsing) stays in the plugin that owns that language.
30
+ */
31
+ export type LanguageId = 'typescript' | 'javascript' | 'python' | 'go' | 'rust' | 'shell' | 'ruby' | 'java' | 'kotlin' | 'dotnet' | 'generic';
32
+ export type PackageManagerId = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'pip' | 'poetry' | 'go' | 'cargo' | 'gem' | 'maven' | 'gradle' | 'dotnet' | 'none';
33
+ export interface LanguageRuntime {
34
+ /** Stable identifier for diagnostics and logging. */
35
+ id: LanguageId;
36
+ /**
37
+ * Default package manager launcher if the plugin must spawn a tool
38
+ * (e.g. `npx vitest` or `cargo test`). `none` means the executable
39
+ * itself is invoked directly (no launcher).
40
+ */
41
+ packageManager: PackageManagerId;
42
+ /**
43
+ * Executable token that must appear as the second argv element when
44
+ * a launcher is used (e.g. `vitest` after `pnpm exec`, `test` after
45
+ * `cargo`). When `subcommands.length === 0` and the package manager
46
+ * has no subcommand step, this is also accepted as the head token.
47
+ */
48
+ executable: string;
49
+ /**
50
+ * Allowlisted flag values, in addition to positional arguments and
51
+ * file paths. `null` means "no flag allowlist enforced" — every
52
+ * leading-dash token is still rejected, but no flag whitelist applies.
53
+ */
54
+ allowedFlags: ReadonlySet<string> | null;
55
+ /**
56
+ * Optional list of subcommand tokens that may follow the launcher,
57
+ * e.g. `['exec']` for `pnpm exec tsc`. Empty array means the runner
58
+ * executable must appear immediately as the second token (e.g.
59
+ * `cargo test`, `go test`).
60
+ */
61
+ subcommands: readonly string[];
62
+ /**
63
+ * Default command spelling for `resolveRunnerCommand` when no
64
+ * custom command is supplied. Plugins can override via config.
65
+ */
66
+ defaultCommand: string;
67
+ }
68
+ export interface ResolvedCommand {
69
+ cmd: string;
70
+ args: readonly string[];
71
+ display: string;
72
+ }
73
+ export interface ResolveOptions {
74
+ /**
75
+ * Project root used to sandbox absolute executable paths. Defaults
76
+ * to `process.cwd()`. Absolute executable paths must resolve inside
77
+ * this directory; relative basenames must match `LanguageRuntime.executable`.
78
+ */
79
+ projectRoot?: string;
80
+ }
81
+ export interface RunOptions extends ResolveOptions {
82
+ cwd: string;
83
+ timeoutMs: number;
84
+ signal?: AbortSignal;
85
+ }
86
+ export interface RunResult {
87
+ code: number | null;
88
+ stdout: string;
89
+ stderr: string;
90
+ timedOut: boolean;
91
+ /** True when the executable could not be spawned (ENOENT, EPERM, …). */
92
+ spawnError: boolean;
93
+ }
94
+ /**
95
+ * Validate `value` as a sandboxed path inside the project. Returns the
96
+ * canonical absolute path on success, `null` on rejection (empty,
97
+ * outside the project, leading-dash, or longer than 4096 bytes).
98
+ */
99
+ export declare function sanitizeRunnerPath(value: string, options?: ResolveOptions): string | null;
100
+ /**
101
+ * Resolve a user-supplied command string into an argv-style invocation
102
+ * using the language runtime's allowlist. Returns `null` if the command
103
+ * fails closed (unknown launcher, unknown subcommand, disallowed flag,
104
+ * metacharacters, leading-dash injection, absolute-path escape).
105
+ */
106
+ export declare function resolveRunnerCommand(runtime: LanguageRuntime, command: string, options?: ResolveOptions): ResolvedCommand | null;
107
+ /**
108
+ * Spawn the resolved argv with `shell:false`. Always uses
109
+ * `execFile` (no shell, argv), captures stdout/stderr with a hard
110
+ * `maxBuffer`, and respects `signal` + `timeoutMs`. Plugins can layer
111
+ * language-specific output parsing on top of `RunResult`.
112
+ */
113
+ export declare function runRunnerCommand(argv: readonly string[], options: RunOptions): Promise<RunResult>;
114
+ /**
115
+ * Cheap availability check. Calls the runner's `--version`-like command
116
+ * with a short timeout; returns true only when exit code is zero.
117
+ */
118
+ export declare function probeRunner(runtime: LanguageRuntime, probeArg: string | undefined, options: RunOptions): Promise<boolean>;
119
+ /**
120
+ * Convenience: locate the runner binary on disk inside the project.
121
+ * Returns the absolute path or `null`.
122
+ */
123
+ export declare function locateRunnerEntry(runtime: LanguageRuntime, projectRoot: string): string | null;
124
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAMH,MAAM,MAAM,UAAU,GAClB,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,MAAM,gBAAgB,GACxB,KAAK,GACL,MAAM,GACN,MAAM,GACN,KAAK,GACL,KAAK,GACL,QAAQ,GACR,IAAI,GACJ,OAAO,GACP,KAAK,GACL,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,EAAE,EAAE,UAAU,CAAC;IACf;;;;OAIG;IACH,cAAc,EAAE,gBAAgB,CAAC;IACjC;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACzC;;;;;OAKG;IACH,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,wEAAwE;IACxE,UAAU,EAAE,OAAO,CAAC;CACrB;AAkDD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,cAAmB,GAC3B,MAAM,GAAG,IAAI,CAKf;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,cAAmB,GAC3B,eAAe,GAAG,IAAI,CAoExB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,SAAS,CAAC,CAwHpB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,YAAc,EAC9B,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,eAAe,EACxB,WAAW,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI,CAWf"}
@@ -0,0 +1 @@
1
+ export * from './runtime/index.js';