@wrongstack/plugins 0.284.1 → 0.286.0

package/dist/plugin-stack-observer.d.ts

@@ -1,35 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * plugin-stack-observer — observability over the providerRunner wrap stack.
- *
- * Several official plugins (llm-cache, model-router, prompt-firewall,
- * token-throttle) register `AgentExtension.wrapProviderRunner` to
- * intercept every provider call. The runtime composes them in
- * registration order — but until now there was no way for an operator
- * (or the LLM itself) to see WHICH wraps are active in what order.
- *
- * Each wrap plugin emits `customEvent('provider.wrap:loaded', …)` on
- * setup. This plugin subscribes via `onPattern('provider.wrap:loaded')`
- * and:
- *
- *   1. Builds an in-memory stack (preserves emission order)
- *   2. Registers a system-prompt contributor that, when any wraps are
- *      present, emits a compact one-line block listing them. The LLM
- *      sees who is wrapping what, in registration order — making the
- *      stack visible without /diag round-trips.
- *
- * Disabled by default (enabled=false) because not every user wants
- * the LLM to be aware of the wrap stack. The plugin_stack tool is
- * always registered so operators can read the stack at runtime
- * regardless of the contributor setting.
- *
- * Tools registered:
- *  - plugin_stack_status : Read the active wrap stack + load order
- *
- * @public
- */
-
-declare const PLUGIN: Plugin;
-
-export { PLUGIN as default };
+export * from './plugin-stack-observer/index.js';
+export { default } from './plugin-stack-observer/index.js';

package/dist/plugin-stack-observer.js

@@ -134,5 +134,6 @@ function readConfig(raw) {
   };
 }
 var plugin_stack_observer_default = PLUGIN;
-
-export { plugin_stack_observer_default as default };
+export {
+  plugin_stack_observer_default as default
+};

package/dist/pr-drafter/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * pr-drafter plugin — collects work done during a session and drafts a
+ * pull-request description.
+ *
+ * As the session runs, the plugin listens to:
+ *  - `tool.completed` events for `git_autocommit` (records commit messages)
+ *  - `tool.completed` events for `write`/`edit` (records changed files)
+ *  - `provider.response` events (records model usage)
+ *
+ * On `Stop` it composes a markdown PR body and writes it to a configurable
+ * file (default: `.wrongstack/PR_DRAFT.md`). A `pr_draft` tool lets the
+ * agent request the draft on demand.
+ *
+ * Config (`config.extensions['pr-drafter']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "outputPath": ".wrongstack/PR_DRAFT.md",
+ *   "writeOnStop": true,
+ *   "includeDiff": true,
+ *   "includeCommits": true,
+ *   "includeFiles": true,
+ *   "aiSummary": false
+ * }
+ * ```
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/pr-drafter/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/pr-drafter/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAa,MAAM,kBAAkB,CAAC;AA4M1D,QAAA,MAAM,MAAM,EAAE,MAyNb,CAAC;eAEa,MAAM"}

package/dist/pr-drafter.d.ts

@@ -1,35 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * pr-drafter plugin — collects work done during a session and drafts a
- * pull-request description.
- *
- * As the session runs, the plugin listens to:
- *  - `tool.completed` events for `git_autocommit` (records commit messages)
- *  - `tool.completed` events for `write`/`edit` (records changed files)
- *  - `provider.response` events (records model usage)
- *
- * On `Stop` it composes a markdown PR body and writes it to a configurable
- * file (default: `.wrongstack/PR_DRAFT.md`). A `pr_draft` tool lets the
- * agent request the draft on demand.
- *
- * Config (`config.extensions['pr-drafter']`):
- *
- * ```jsonc
- * {
- *   "enabled": true,
- *   "outputPath": ".wrongstack/PR_DRAFT.md",
- *   "writeOnStop": true,
- *   "includeDiff": true,
- *   "includeCommits": true,
- *   "includeFiles": true,
- *   "aiSummary": false
- * }
- * ```
- *
- * @public
- */
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './pr-drafter/index.js';
+export { default } from './pr-drafter/index.js';

package/dist/pr-drafter.js

@@ -1,8 +1,7 @@
-import { execFileSync } from 'child_process';
-import { mkdirSync, writeFileSync } from 'fs';
-import { dirname, resolve, isAbsolute, relative } from 'path';
-
 // src/pr-drafter/index.ts
+import { execFileSync } from "node:child_process";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
 var API_VERSION = "^0.1.10";
 var state = {
   commits: [],
@@ -330,5 +329,6 @@ var plugin = {
   }
 };
 var pr_drafter_default = plugin;
-
-export { pr_drafter_default as default };
+export {
+  pr_drafter_default as default
+};

package/dist/prompt-firewall/index.d.ts

@@ -0,0 +1,55 @@
+/**
+ * prompt-firewall plugin — inspects and redacts secrets on the provider
+ * wire, before context leaves for the LLM API and as it returns.
+ *
+ * Distinct from `secret-scanner` (which guards the TOOL boundary): this
+ * sits on `AgentExtension.wrapProviderRunner`, so it sees the FULL
+ * request that is about to be sent to a third-party LLM provider —
+ * regardless of how a secret entered the conversation. It scans the
+ * outgoing request's system + message text for high-confidence
+ * credential patterns and, depending on `mode`:
+ *
+ *  - `warn`   (default) — logs + counts + emits a `prompt-firewall:leak`
+ *    event; the request goes through unchanged
+ *  - `redact` — replaces each match with `[REDACTED:<kind>]` in a CLONE
+ *    of the request before sending, and also redacts secrets echoed back
+ *    in the response
+ *  - `block`  — throws before the request is sent (the agent's error
+ *    path surfaces it), so the secret never reaches the provider
+ *
+ * Safety posture: opt-in — loads inert until
+ * `config.extensions['prompt-firewall'].enabled = true`. `warn` is the
+ * default so it can never corrupt context until you deliberately choose
+ * `redact`/`block`.
+ *
+ * Config (`config.extensions['prompt-firewall']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": false,
+ *   "mode": "warn",          // "warn" | "redact" | "block"
+ *   "scanResponse": true,     // redact secrets echoed back (redact mode)
+ *   "allow": []               // regex source strings to exempt (false positives)
+ * }
+ * ```
+ *
+ * Tools:
+ *  - `prompt_firewall_status` — mode, pattern names, detection counters
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+export interface Detection {
+    kind: string;
+    count: number;
+}
+/** Detect secret matches in text. Returns per-kind counts (no values). */
+export declare function detectSecrets(text: string, allow: RegExp[]): Detection[];
+/** Redact secret matches in text, replacing each with `[REDACTED:<kind>]`. */
+export declare function redactSecrets(text: string, allow: RegExp[]): {
+    text: string;
+    redactions: number;
+};
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/prompt-firewall/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/prompt-firewall/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAa,MAAM,kBAAkB,CAAC;AA+B1D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAcxE;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAWjG;AA6GD,QAAA,MAAM,MAAM,EAAE,MAkNb,CAAC;eAEa,MAAM"}

package/dist/prompt-firewall.d.ts

@@ -1,57 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * prompt-firewall plugin — inspects and redacts secrets on the provider
- * wire, before context leaves for the LLM API and as it returns.
- *
- * Distinct from `secret-scanner` (which guards the TOOL boundary): this
- * sits on `AgentExtension.wrapProviderRunner`, so it sees the FULL
- * request that is about to be sent to a third-party LLM provider —
- * regardless of how a secret entered the conversation. It scans the
- * outgoing request's system + message text for high-confidence
- * credential patterns and, depending on `mode`:
- *
- *  - `warn`   (default) — logs + counts + emits a `prompt-firewall:leak`
- *    event; the request goes through unchanged
- *  - `redact` — replaces each match with `[REDACTED:<kind>]` in a CLONE
- *    of the request before sending, and also redacts secrets echoed back
- *    in the response
- *  - `block`  — throws before the request is sent (the agent's error
- *    path surfaces it), so the secret never reaches the provider
- *
- * Safety posture: opt-in — loads inert until
- * `config.extensions['prompt-firewall'].enabled = true`. `warn` is the
- * default so it can never corrupt context until you deliberately choose
- * `redact`/`block`.
- *
- * Config (`config.extensions['prompt-firewall']`):
- *
- * ```jsonc
- * {
- *   "enabled": false,
- *   "mode": "warn",          // "warn" | "redact" | "block"
- *   "scanResponse": true,     // redact secrets echoed back (redact mode)
- *   "allow": []               // regex source strings to exempt (false positives)
- * }
- * ```
- *
- * Tools:
- *  - `prompt_firewall_status` — mode, pattern names, detection counters
- *
- * @public
- */
-
-interface Detection {
-    kind: string;
-    count: number;
-}
-/** Detect secret matches in text. Returns per-kind counts (no values). */
-declare function detectSecrets(text: string, allow: RegExp[]): Detection[];
-/** Redact secret matches in text, replacing each with `[REDACTED:<kind>]`. */
-declare function redactSecrets(text: string, allow: RegExp[]): {
-    text: string;
-    redactions: number;
-};
-declare const plugin: Plugin;
-
-export { type Detection, plugin as default, detectSecrets, redactSecrets };
+export * from './prompt-firewall/index.js';
+export { default } from './prompt-firewall/index.js';

package/dist/prompt-firewall.js

@@ -291,5 +291,8 @@ var plugin = {
   }
 };
 var prompt_firewall_default = plugin;
-
-export { prompt_firewall_default as default, detectSecrets, redactSecrets };
+export {
+  prompt_firewall_default as default,
+  detectSecrets,
+  redactSecrets
+};

package/dist/refactor-suggester/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * refactor-suggester plugin — regex-based smell detector that suggests
+ * refactoring opportunities in source files.
+ *
+ * Tools registered:
+ * - suggest_refactors : Scan a file or directory for smells.
+ * - refactor_status : Report config + counters.
+ *
+ * Hooks registered:
+ * - PostToolUse with matcher `write|edit` to source files, injecting
+ *   suggestions for the changed file.
+ *
+ * Config (`config.extensions['refactor-suggester']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "extensions": [".ts", ".tsx", ".js", ".jsx"],
+ *   "maxSuggestions": 20,
+ *   "rules": { "longFunctionLines": 50, "maxParams": 5, "maxNesting": 3 }
+ * }
+ * ```
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+export type SmellType = 'long-function' | 'deep-nesting' | 'many-parameters' | 'magic-number' | 'console-log';
+export interface RefactorSuggestion {
+    file: string;
+    line: number;
+    type: SmellType;
+    message: string;
+}
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/refactor-suggester/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/refactor-suggester/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAQ/C,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,aAAa,CAAC;AAElB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAgRD,QAAA,MAAM,MAAM,EAAE,MA4Nb,CAAC;eAEa,MAAM"}

package/dist/refactor-suggester.d.ts

@@ -1,38 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * refactor-suggester plugin — regex-based smell detector that suggests
- * refactoring opportunities in source files.
- *
- * Tools registered:
- * - suggest_refactors : Scan a file or directory for smells.
- * - refactor_status : Report config + counters.
- *
- * Hooks registered:
- * - PostToolUse with matcher `write|edit` to source files, injecting
- *   suggestions for the changed file.
- *
- * Config (`config.extensions['refactor-suggester']`):
- *
- * ```jsonc
- * {
- *   "enabled": true,
- *   "extensions": [".ts", ".tsx", ".js", ".jsx"],
- *   "maxSuggestions": 20,
- *   "rules": { "longFunctionLines": 50, "maxParams": 5, "maxNesting": 3 }
- * }
- * ```
- *
- * @public
- */
-
-type SmellType = 'long-function' | 'deep-nesting' | 'many-parameters' | 'magic-number' | 'console-log';
-interface RefactorSuggestion {
-    file: string;
-    line: number;
-    type: SmellType;
-    message: string;
-}
-declare const plugin: Plugin;
-
-export { type RefactorSuggestion, type SmellType, plugin as default };
+export * from './refactor-suggester/index.js';
+export { default } from './refactor-suggester/index.js';

package/dist/refactor-suggester.js

@@ -1,7 +1,6 @@
-import { readFileSync, existsSync, statSync, readdirSync } from 'fs';
-import { resolve, isAbsolute, relative, extname } from 'path';
-
 // src/refactor-suggester/index.ts
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { extname, isAbsolute, relative, resolve } from "node:path";
 var API_VERSION = "^0.1.10";
 var state = {
   scanCount: 0,
@@ -105,21 +104,20 @@ function detectSmells(filePath, content, rules) {
   const lines = content.split(/\r?\n/);
   const stripped = content.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, " ");
   const functionLikeRe = /(?:export\s+)?(?:async\s+)?(?:function\s+)?([A-Za-z_$][A-Za-z0-9_$]*)\s*\(([^)]*)\)\s*\{/g;
-  let m;
   functionLikeRe.lastIndex = 0;
-  while ((m = functionLikeRe.exec(stripped)) !== null) {
-    const name = m[1];
-    const paramsRaw = m[2];
+  for (const match of stripped.matchAll(functionLikeRe)) {
+    const name = match[1];
+    const paramsRaw = match[2];
     const params = paramsRaw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
     if (params.length > rules.maxParams) {
       suggestions.push({
         file: relativePath(filePath),
-        line: content.slice(0, m.index).split(/\r?\n/).length,
+        line: content.slice(0, match.index).split(/\r?\n/).length,
         type: "many-parameters",
         message: `${name} has ${params.length} parameters (limit ${rules.maxParams})`
       });
     }
-    const bodyStart = m.index + m[0].length;
+    const bodyStart = match.index + match[0].length;
     let depth = 1;
     let lineEnd = bodyStart;
     for (let i = bodyStart; i < stripped.length && depth > 0; i++) {
@@ -132,7 +130,7 @@ function detectSmells(filePath, content, rules) {
     if (bodyLines > rules.longFunctionLines) {
       suggestions.push({
         file: relativePath(filePath),
-        line: content.slice(0, m.index).split(/\r?\n/).length,
+        line: content.slice(0, match.index).split(/\r?\n/).length,
         type: "long-function",
         message: `${name} spans ~${bodyLines} lines (limit ${rules.longFunctionLines})`
       });
@@ -163,15 +161,15 @@ function detectSmells(filePath, content, rules) {
   const magicRe = /\b-?\d+(?:\.\d+)?\b/g;
   const allowed = /* @__PURE__ */ new Set(["0", "1", "-1", "2"]);
   magicRe.lastIndex = 0;
-  while ((m = magicRe.exec(content)) !== null) {
-    const match = m[0];
+  for (const magicNumberMatch of content.matchAll(magicRe)) {
+    const match = magicNumberMatch[0];
     if (allowed.has(match)) continue;
-    const before = content[m.index - 1];
-    const after = content[m.index + match.length];
+    const before = content[magicNumberMatch.index - 1];
+    const after = content[magicNumberMatch.index + match.length];
     if (before === "[" && after === "]") continue;
     suggestions.push({
       file: relativePath(filePath),
-      line: content.slice(0, m.index).split(/\r?\n/).length,
+      line: content.slice(0, magicNumberMatch.index).split(/\r?\n/).length,
       type: "magic-number",
       message: `magic number ${match} should be a named constant`
     });
@@ -378,5 +376,6 @@ var plugin = {
   }
 };
 var refactor_suggester_default = plugin;
-
-export { refactor_suggester_default as default };
+export {
+  refactor_suggester_default as default
+};

package/dist/release-notes-generator/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * release-notes-generator plugin — generates grouped release notes from git
+ * history using conventional-commit parsing.
+ *
+ * Tool registered:
+ * - generate_release_notes : Produce grouped notes between two refs.
+ *
+ * No hooks are registered.
+ *
+ * Config (`config.extensions['release-notes-generator']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "includeScope": true,
+ *   "defaultFrom": "latest-tag"
+ * }
+ * ```
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/release-notes-generator/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release-notes-generator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAmL/C,QAAA,MAAM,MAAM,EAAE,MA+Gb,CAAC;eAEa,MAAM"}

package/dist/release-notes-generator.d.ts

@@ -1,27 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * release-notes-generator plugin — generates grouped release notes from git
- * history using conventional-commit parsing.
- *
- * Tool registered:
- * - generate_release_notes : Produce grouped notes between two refs.
- *
- * No hooks are registered.
- *
- * Config (`config.extensions['release-notes-generator']`):
- *
- * ```jsonc
- * {
- *   "enabled": true,
- *   "includeScope": true,
- *   "defaultFrom": "latest-tag"
- * }
- * ```
- *
- * @public
- */
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './release-notes-generator/index.js';
+export { default } from './release-notes-generator/index.js';

package/dist/release-notes-generator.js

@@ -1,6 +1,5 @@
-import { execSync } from 'child_process';
-
 // src/release-notes-generator/index.ts
+import { execFileSync } from "node:child_process";
 var API_VERSION = "^0.1.10";
 var state = {
   generateCount: 0,
@@ -41,23 +40,41 @@ function formatCommit(c, includeScope) {
   line += ` ${c.description}`;
   return line;
 }
+var GIT_OPTIONS = {
+  encoding: "utf-8",
+  stdio: ["pipe", "pipe", "ignore"],
+  shell: false
+};
 function resolveFromRef(defaultFrom, inputFrom) {
   if (inputFrom) return inputFrom;
   if (defaultFrom === "latest-tag") {
     try {
-      return execSync("git describe --tags --abbrev=0", { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }).trim();
+      return execFileSync("git", ["describe", "--tags", "--abbrev=0"], GIT_OPTIONS).trim();
     } catch {
       return "";
     }
   }
   return defaultFrom;
 }
+function resolveCommit(ref) {
+  const resolved = execFileSync(
+    "git",
+    ["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`],
+    GIT_OPTIONS
+  ).trim();
+  if (!/^[0-9a-f]{40,64}$/i.test(resolved)) {
+    throw new Error(`git returned an invalid commit id for ref ${JSON.stringify(ref)}`);
+  }
+  return resolved;
+}
 function getCommits(from, to) {
-  const range = from ? `${from}..${to}` : to;
-  const output = execSync(`git log --pretty=format:'%H%x09%s' ${range}`, {
-    encoding: "utf-8",
-    stdio: ["pipe", "pipe", "ignore"]
-  });
+  const toCommit = resolveCommit(to);
+  const range = from ? `${resolveCommit(from)}..${toCommit}` : toCommit;
+  const output = execFileSync(
+    "git",
+    ["log", "--pretty=format:%H%x09%s", "--end-of-options", range],
+    GIT_OPTIONS
+  );
   if (!output.trim()) return [];
   const commits = [];
   for (const line of output.split(/\r?\n/)) {
@@ -205,5 +222,6 @@ var plugin = {
   }
 };
 var release_notes_generator_default = plugin;
-
-export { release_notes_generator_default as default };
+export {
+  release_notes_generator_default as default
+};