@wrongstack/plugins 0.284.1 → 0.286.0

package/dist/runtime/index.d.ts

@@ -0,0 +1,124 @@
+/**
+ * @wrongstack/plugins — Language-agnostic runtime helper.
+ *
+ * Plugins that need to invoke a build-time or test-time tool
+ * (TypeScript's `tsc`, Node's `vitest`, Python's `pytest`, Rust's
+ * `cargo`, Go's `go test`, etc.) share this module instead of
+ * re-implementing argv/sandbox/allowlist logic.
+ *
+ * Why one module instead of three plugin-local copies?
+ * - One audit surface for security-sensitive code: arg-splitting,
+ *   sandboxing, execFile-with-shell-false, maxBuffer, timeout.
+ * - Plugins stay focused on their domain (linters, type-checkers,
+ *   test runners); the runtime helper owns the cross-cutting concern.
+ * - New languages opt in by adding a `LanguageRuntime` entry; the
+ *   plugin layer keeps working unchanged.
+ *
+ * The public API is intentionally small:
+ *   - `LanguageRuntime`: declares which language a plugin targets.
+ *   - `resolveRunnerCommand(runtime, command, options)`: validate +
+ *     split a user-supplied command into a safe argv array.
+ *   - `sanitizeRunnerPath(value, options)`: reject paths outside
+ *     the project or that start with `-` (option smuggling).
+ *   - `runRunnerCommand(argv, options)`: spawn the resolved argv
+ *     with `shell:false`, capture stdout/stderr/code, and apply
+ *     timeout/abort.
+ *   - `probeRunner(runtime, argv, options)`: cheap availability check.
+ *
+ * Anything language-specific (flag tables, default commands,
+ * output parsing) stays in the plugin that owns that language.
+ */
+export type LanguageId = 'typescript' | 'javascript' | 'python' | 'go' | 'rust' | 'shell' | 'ruby' | 'java' | 'kotlin' | 'dotnet' | 'generic';
+export type PackageManagerId = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'pip' | 'poetry' | 'go' | 'cargo' | 'gem' | 'maven' | 'gradle' | 'dotnet' | 'none';
+export interface LanguageRuntime {
+    /** Stable identifier for diagnostics and logging. */
+    id: LanguageId;
+    /**
+     * Default package manager launcher if the plugin must spawn a tool
+     * (e.g. `npx vitest` or `cargo test`). `none` means the executable
+     * itself is invoked directly (no launcher).
+     */
+    packageManager: PackageManagerId;
+    /**
+     * Executable token that must appear as the second argv element when
+     * a launcher is used (e.g. `vitest` after `pnpm exec`, `test` after
+     * `cargo`). When `subcommands.length === 0` and the package manager
+     * has no subcommand step, this is also accepted as the head token.
+     */
+    executable: string;
+    /**
+     * Allowlisted flag values, in addition to positional arguments and
+     * file paths. `null` means "no flag allowlist enforced" — every
+     * leading-dash token is still rejected, but no flag whitelist applies.
+     */
+    allowedFlags: ReadonlySet<string> | null;
+    /**
+     * Optional list of subcommand tokens that may follow the launcher,
+     * e.g. `['exec']` for `pnpm exec tsc`. Empty array means the runner
+     * executable must appear immediately as the second token (e.g.
+     * `cargo test`, `go test`).
+     */
+    subcommands: readonly string[];
+    /**
+     * Default command spelling for `resolveRunnerCommand` when no
+     * custom command is supplied. Plugins can override via config.
+     */
+    defaultCommand: string;
+}
+export interface ResolvedCommand {
+    cmd: string;
+    args: readonly string[];
+    display: string;
+}
+export interface ResolveOptions {
+    /**
+     * Project root used to sandbox absolute executable paths. Defaults
+     * to `process.cwd()`. Absolute executable paths must resolve inside
+     * this directory; relative basenames must match `LanguageRuntime.executable`.
+     */
+    projectRoot?: string;
+}
+export interface RunOptions extends ResolveOptions {
+    cwd: string;
+    timeoutMs: number;
+    signal?: AbortSignal;
+}
+export interface RunResult {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+    /** True when the executable could not be spawned (ENOENT, EPERM, …). */
+    spawnError: boolean;
+}
+/**
+ * Validate `value` as a sandboxed path inside the project. Returns the
+ * canonical absolute path on success, `null` on rejection (empty,
+ * outside the project, leading-dash, or longer than 4096 bytes).
+ */
+export declare function sanitizeRunnerPath(value: string, options?: ResolveOptions): string | null;
+/**
+ * Resolve a user-supplied command string into an argv-style invocation
+ * using the language runtime's allowlist. Returns `null` if the command
+ * fails closed (unknown launcher, unknown subcommand, disallowed flag,
+ * metacharacters, leading-dash injection, absolute-path escape).
+ */
+export declare function resolveRunnerCommand(runtime: LanguageRuntime, command: string, options?: ResolveOptions): ResolvedCommand | null;
+/**
+ * Spawn the resolved argv with `shell:false`. Always uses
+ * `execFile` (no shell, argv), captures stdout/stderr with a hard
+ * `maxBuffer`, and respects `signal` + `timeoutMs`. Plugins can layer
+ * language-specific output parsing on top of `RunResult`.
+ */
+export declare function runRunnerCommand(argv: readonly string[], options: RunOptions): Promise<RunResult>;
+/**
+ * Cheap availability check. Calls the runner's `--version`-like command
+ * with a short timeout; returns true only when exit code is zero.
+ */
+export declare function probeRunner(runtime: LanguageRuntime, probeArg: string | undefined, options: RunOptions): Promise<boolean>;
+/**
+ * Convenience: locate the runner binary on disk inside the project.
+ * Returns the absolute path or `null`.
+ */
+export declare function locateRunnerEntry(runtime: LanguageRuntime, projectRoot: string): string | null;
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAMH,MAAM,MAAM,UAAU,GAClB,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,MAAM,gBAAgB,GACxB,KAAK,GACL,MAAM,GACN,MAAM,GACN,KAAK,GACL,KAAK,GACL,QAAQ,GACR,IAAI,GACJ,OAAO,GACP,KAAK,GACL,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,EAAE,EAAE,UAAU,CAAC;IACf;;;;OAIG;IACH,cAAc,EAAE,gBAAgB,CAAC;IACjC;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACzC;;;;;OAKG;IACH,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,wEAAwE;IACxE,UAAU,EAAE,OAAO,CAAC;CACrB;AAkDD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,cAAmB,GAC3B,MAAM,GAAG,IAAI,CAKf;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,cAAmB,GAC3B,eAAe,GAAG,IAAI,CAoExB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,SAAS,CAAC,CAwHpB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,YAAc,EAC9B,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,eAAe,EACxB,WAAW,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI,CAWf"}

package/dist/runtime.d.ts

@@ -0,0 +1 @@
+export * from './runtime/index.js';

package/dist/runtime.js

@@ -0,0 +1,216 @@
+// src/runtime/index.ts
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { basename, isAbsolute, relative, resolve } from "node:path";
+var META_CHARS = /["'`;&|<>\r\n]/;
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+function hasLeadingDash(arg) {
+  return arg.length > 0 && arg.startsWith("-");
+}
+function safeSplit(command) {
+  const trimmed = command.trim();
+  if (!trimmed || META_CHARS.test(trimmed)) return null;
+  return trimmed.split(/\s+/).filter(Boolean);
+}
+function withinProjectPath(projectRoot, candidate) {
+  if (candidate.length === 0 || candidate.length > 4096) return false;
+  if (hasLeadingDash(candidate)) return false;
+  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(projectRoot, candidate);
+  const rel = relative(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function everyFlagAllowed(allowed, args) {
+  for (const arg of args) {
+    if (!hasLeadingDash(arg)) continue;
+    if (allowed === null) return false;
+    if (!allowed.has(arg)) return false;
+  }
+  return true;
+}
+function sanitizeRunnerPath(value, options = {}) {
+  if (!value || hasLeadingDash(value)) return null;
+  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  if (!withinProjectPath(projectRoot, value)) return null;
+  return isAbsolute(value) ? resolve(value) : resolve(projectRoot, value);
+}
+function resolveRunnerCommand(runtime, command, options = {}) {
+  const tokens = safeSplit(command);
+  if (!tokens || tokens.length === 0) return null;
+  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  const launcher = runtime.packageManager;
+  const [head, second, ...rest] = tokens;
+  if (!head) return null;
+  const display = tokens.join(" ");
+  if (launcher !== "none" && tokens.length === 1 && head === launcher) {
+    return null;
+  }
+  if (head === runtime.executable) {
+    if (!everyFlagAllowed(runtime.allowedFlags, [second, ...rest].filter((v) => Boolean(v)))) {
+      return null;
+    }
+    return {
+      cmd: head,
+      args: [second, ...rest].filter((v) => Boolean(v)),
+      display
+    };
+  }
+  if (launcher !== "none" && head === launcher && runtime.subcommands.length === 0 && second === runtime.executable) {
+    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
+    return { cmd: head, args: [second, ...rest], display };
+  }
+  if (launcher !== "none" && head === launcher && runtime.subcommands.length > 0) {
+    const subcommand = runtime.subcommands[0];
+    const exe = rest[0];
+    if (second === subcommand && exe === runtime.executable) {
+      const tail = rest.slice(1);
+      if (!everyFlagAllowed(runtime.allowedFlags, tail)) return null;
+      return { cmd: head, args: [second, exe, ...tail], display };
+    }
+  }
+  if (isAbsolute(head)) {
+    if (!withinProjectPath(projectRoot, head)) return null;
+    const base = basename(head);
+    if (base !== runtime.executable && base !== launcher) return null;
+    if (second !== runtime.executable) return null;
+    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
+    return { cmd: head, args: [second, ...rest], display };
+  }
+  return null;
+}
+function runRunnerCommand(argv, options) {
+  if (argv.length === 0) {
+    return Promise.resolve({
+      code: null,
+      stdout: "",
+      stderr: "runtime helper: empty argv",
+      timedOut: false,
+      spawnError: true
+    });
+  }
+  return new Promise((resolvePromise) => {
+    const projectRoot = resolve(options.projectRoot ?? process.cwd());
+    const trimmedCwd = options.cwd.trim();
+    if (!withinProjectPath(projectRoot, trimmedCwd)) {
+      resolvePromise({
+        code: null,
+        stdout: "",
+        stderr: "runtime helper: cwd outside project",
+        timedOut: false,
+        spawnError: true
+      });
+      return;
+    }
+    const timedOut = false;
+    let spawnErrored = false;
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    const child = execFile(
+      argv[0],
+      argv.slice(1),
+      {
+        cwd: trimmedCwd,
+        timeout: options.timeoutMs,
+        signal: options.signal,
+        maxBuffer: MAX_BUFFER_BYTES,
+        windowsHide: true,
+        shell: false
+      },
+      (err, stdout, stderr) => {
+        if (timedOut) {
+          resolvePromise({
+            code: null,
+            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
+            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            timedOut: true,
+            spawnError: false
+          });
+          return;
+        }
+        if (spawnErrored) {
+          resolvePromise({
+            code: 127,
+            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
+            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            timedOut: false,
+            spawnError: true
+          });
+          return;
+        }
+        if (err) {
+          const anyErr = err;
+          const code = typeof anyErr.code === "number" ? anyErr.code : 1;
+          resolvePromise({
+            code,
+            stdout: Buffer.concat([
+              ...stdoutChunks,
+              ...anyErr.stdout ? [Buffer.isBuffer(anyErr.stdout) ? anyErr.stdout : Buffer.from(anyErr.stdout)] : []
+            ]).toString("utf8"),
+            stderr: Buffer.concat([
+              ...stderrChunks,
+              ...anyErr.stderr ? [Buffer.isBuffer(anyErr.stderr) ? anyErr.stderr : Buffer.from(anyErr.stderr)] : []
+            ]).toString("utf8"),
+            timedOut: false,
+            spawnError: false
+          });
+          return;
+        }
+        resolvePromise({
+          code: 0,
+          stdout: Buffer.concat([
+            ...stdoutChunks,
+            ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]
+          ]).toString("utf8"),
+          stderr: Buffer.concat([
+            ...stderrChunks,
+            ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]
+          ]).toString("utf8"),
+          timedOut: false,
+          spawnError: false
+        });
+      }
+    );
+    child.stdout?.on("data", (chunk) => {
+      stdoutBytes += chunk.length;
+      if (stdoutBytes <= MAX_BUFFER_BYTES) stdoutChunks.push(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderrBytes += chunk.length;
+      if (stderrBytes <= MAX_BUFFER_BYTES) stderrChunks.push(chunk);
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT" || err.code === "EPERM" || err.code === "EACCES") {
+        spawnErrored = true;
+      }
+    });
+  });
+}
+async function probeRunner(runtime, probeArg = "--version", options) {
+  const resolved = resolveRunnerCommand(runtime, `${runtime.executable} ${probeArg}`, options);
+  if (!resolved) return false;
+  const result = await runRunnerCommand([resolved.cmd, ...resolved.args], {
+    ...options,
+    timeoutMs: Math.min(options.timeoutMs, 5e3)
+  });
+  return result.code === 0;
+}
+function locateRunnerEntry(runtime, projectRoot) {
+  const root = resolve(projectRoot);
+  const candidates = [
+    resolve(root, "node_modules", ".bin", runtime.executable),
+    resolve(root, "node_modules", ".bin", `${runtime.executable}.cmd`),
+    resolve(root, "node_modules", ".bin", `${runtime.executable}.ps1`)
+  ];
+  for (const c of candidates) {
+    if (existsSync(c)) return c;
+  }
+  return null;
+}
+export {
+  locateRunnerEntry,
+  probeRunner,
+  resolveRunnerCommand,
+  runRunnerCommand,
+  sanitizeRunnerPath
+};

package/dist/schema-evolution-guard/index.d.ts

@@ -0,0 +1,40 @@
+/**
+ * schema-evolution-guard plugin — guards database/API schema changes.
+ *
+ * Registers a `PostToolUse` hook on `write|edit` that scans files matching
+ * schema-related patterns for destructive changes:
+ *
+ *   - DROP TABLE / DROP COLUMN (Prisma migrations, raw SQL)
+ *   - NOT NULL added without a default (SQL)
+ *   - Required field without a default (Prisma, TypeScript schema files)
+ *   - Required field added to an OpenAPI schema (YAML/JSON)
+ *
+ * When a destructive pattern is found the plugin either injects an
+ * `additionalContext` warning or blocks the tool, depending on `failSeverity`.
+ *
+ * Tools registered:
+ *   - schema_evolution_status : counters + config snapshot.
+ *
+ * Config (`config.extensions['schema-evolution-guard']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "failSeverity": "warn", // "warn" | "block"
+ *   "maxFindings": 5,
+ *   "filePatterns": [
+ *     "*.prisma",
+ *     "*migration*.sql",
+ *     "*openapi*.yaml",
+ *     "*openapi*.json",
+ *     "*schema*.ts"
+ *   ]
+ * }
+ * ```
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/schema-evolution-guard/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schema-evolution-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAkN/C,QAAA,MAAM,MAAM,EAAE,MAgNb,CAAC;eAEa,MAAM"}

package/dist/schema-evolution-guard.d.ts

@@ -1,42 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * schema-evolution-guard plugin — guards database/API schema changes.
- *
- * Registers a `PostToolUse` hook on `write|edit` that scans files matching
- * schema-related patterns for destructive changes:
- *
- *   - DROP TABLE / DROP COLUMN (Prisma migrations, raw SQL)
- *   - NOT NULL added without a default (SQL)
- *   - Required field without a default (Prisma, TypeScript schema files)
- *   - Required field added to an OpenAPI schema (YAML/JSON)
- *
- * When a destructive pattern is found the plugin either injects an
- * `additionalContext` warning or blocks the tool, depending on `failSeverity`.
- *
- * Tools registered:
- *   - schema_evolution_status : counters + config snapshot.
- *
- * Config (`config.extensions['schema-evolution-guard']`):
- *
- * ```jsonc
- * {
- *   "enabled": true,
- *   "failSeverity": "warn", // "warn" | "block"
- *   "maxFindings": 5,
- *   "filePatterns": [
- *     "*.prisma",
- *     "*migration*.sql",
- *     "*openapi*.yaml",
- *     "*openapi*.json",
- *     "*schema*.ts"
- *   ]
- * }
- * ```
- *
- * @public
- */
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './schema-evolution-guard/index.js';
+export { default } from './schema-evolution-guard/index.js';

package/dist/schema-evolution-guard.js

@@ -1,7 +1,6 @@
-import { readFileSync } from 'fs';
-import { basename, isAbsolute, resolve, relative } from 'path';
-
 // src/schema-evolution-guard/index.ts
+import { readFileSync } from "node:fs";
+import { basename, isAbsolute, relative, resolve } from "node:path";
 var API_VERSION = "^0.1.10";
 var state = {
   invocationCount: 0,
@@ -315,5 +314,6 @@ ${body}${suffix}`;
   }
 };
 var schema_evolution_guard_default = plugin;
-
-export { schema_evolution_guard_default as default };
+export {
+  schema_evolution_guard_default as default
+};

package/dist/secret-scanner/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * secret-scanner plugin — Pre-tool and post-tool hooks that block, redact,
+ * or warn about plaintext credentials flowing into or out of tools.
+ *
+ * Tools registered:
+ * - secret_scanner_status  : Show which patterns are active, recent
+ *                            blocks/leaks, and current mode.
+ * - secret_scanner_test    : Run the scanner against a user-supplied
+ *                            string and report which patterns matched.
+ *
+ * Hooks registered:
+ * - PreToolUse with matcher `bash|write|edit` (configurable). Default
+ *   action is to BLOCK; the plugin can also auto-redact the offending
+ *   fields via `HookOutcome.modifiedInput`.
+ * - PostToolUse with matcher `*` (configurable via `postToolUseMatcher`).
+ *   Scans tool OUTPUT for secrets that leaked through. Since the tool
+ *   has already run, the hook cannot block — instead it injects an
+ *   `additionalContext` warning so the LLM knows the output contains
+ *   a secret and should NOT echo it, store it, or commit it.
+ *
+ * Why a separate plugin from the built-in `DefaultSecretScrubber`?
+ * The scrubber is *output* sanitization (replace secrets with
+ * `[REDACTED:type]` before they leave the system). The scanner is
+ * *prevention* (stop the tool from running with a secret in the first
+ *   place) + *detection* (flag secrets that leaked through the output).
+ * They share the same threat model but act at different points in the
+ * pipeline.
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/secret-scanner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secret-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAua/C,QAAA,MAAM,MAAM,EAAE,MAgOb,CAAC;eAEa,MAAM"}

package/dist/secret-scanner.d.ts

@@ -1,34 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * secret-scanner plugin — Pre-tool and post-tool hooks that block, redact,
- * or warn about plaintext credentials flowing into or out of tools.
- *
- * Tools registered:
- * - secret_scanner_status  : Show which patterns are active, recent
- *                            blocks/leaks, and current mode.
- * - secret_scanner_test    : Run the scanner against a user-supplied
- *                            string and report which patterns matched.
- *
- * Hooks registered:
- * - PreToolUse with matcher `bash|write|edit` (configurable). Default
- *   action is to BLOCK; the plugin can also auto-redact the offending
- *   fields via `HookOutcome.modifiedInput`.
- * - PostToolUse with matcher `*` (configurable via `postToolUseMatcher`).
- *   Scans tool OUTPUT for secrets that leaked through. Since the tool
- *   has already run, the hook cannot block — instead it injects an
- *   `additionalContext` warning so the LLM knows the output contains
- *   a secret and should NOT echo it, store it, or commit it.
- *
- * Why a separate plugin from the built-in `DefaultSecretScrubber`?
- * The scrubber is *output* sanitization (replace secrets with
- * `[REDACTED:type]` before they leave the system). The scanner is
- * *prevention* (stop the tool from running with a secret in the first
- *   place) + *detection* (flag secrets that leaked through the output).
- * They share the same threat model but act at different points in the
- * pipeline.
- */
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './secret-scanner/index.js';
+export { default } from './secret-scanner/index.js';

package/dist/secret-scanner.js

@@ -420,5 +420,6 @@ var plugin = {
   }
 };
 var secret_scanner_default = plugin;
-
-export { secret_scanner_default as default };
+export {
+  secret_scanner_default as default
+};

package/dist/security-hotspot-scanner/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * security-hotspot-scanner plugin — scans source code for common security
+ * anti-patterns and reports them via tools + a PostToolUse hook.
+ *
+ * Tools registered:
+ * - security_hotspot_scan   : scan a file or directory for security hotspots
+ * - security_hotspot_status : config + per-session counters
+ *
+ * Hooks registered:
+ * - PostToolUse with matcher `write|edit` to warn about newly introduced hotspots.
+ *
+ * Config (`config.extensions['security-hotspot-scanner']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "severity": "warn",          // "warn" | "block"
+ *   "maxFindings": 10,
+ *   "scanOnChange": [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".py"]
+ * }
+ * ```
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/security-hotspot-scanner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security-hotspot-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAwQ/C,QAAA,MAAM,MAAM,EAAE,MAiQb,CAAC;eAEa,MAAM"}

package/dist/security-hotspot-scanner.d.ts

@@ -1,30 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * security-hotspot-scanner plugin — scans source code for common security
- * anti-patterns and reports them via tools + a PostToolUse hook.
- *
- * Tools registered:
- * - security_hotspot_scan   : scan a file or directory for security hotspots
- * - security_hotspot_status : config + per-session counters
- *
- * Hooks registered:
- * - PostToolUse with matcher `write|edit` to warn about newly introduced hotspots.
- *
- * Config (`config.extensions['security-hotspot-scanner']`):
- *
- * ```jsonc
- * {
- *   "enabled": true,
- *   "severity": "warn",          // "warn" | "block"
- *   "maxFindings": 10,
- *   "scanOnChange": [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".py"]
- * }
- * ```
- *
- * @public
- */
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './security-hotspot-scanner/index.js';
+export { default } from './security-hotspot-scanner/index.js';

package/dist/security-hotspot-scanner.js

@@ -1,7 +1,6 @@
-import { statSync, readdirSync, readFileSync } from 'fs';
-import { isAbsolute, resolve, relative } from 'path';
-
 // src/security-hotspot-scanner/index.ts
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
 var API_VERSION = "^0.1.10";
 var state = {
   scanCount: 0,
@@ -46,7 +45,7 @@ var PATTERNS = [
   {
     type: "hardcoded_http",
     severity: "medium",
-    regex: /http:\/\/[a-zA-Z0-9][^\s'"\)\\]*/i
+    regex: /http:\/\/[a-zA-Z0-9][^\s'")\\]*/i
   },
   {
     type: "console_log_credentials",
@@ -398,5 +397,6 @@ Review or remove the risky pattern(s).`;
   }
 };
 var security_hotspot_scanner_default = plugin;
-
-export { security_hotspot_scanner_default as default };
+export {
+  security_hotspot_scanner_default as default
+};

package/dist/semantic-search-indexer/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * semantic-search-indexer plugin — lightweight keyword-based search over
+ * project source files.
+ *
+ * The plugin builds an in-memory inverted index (no persistence, no
+ * embeddings) and exposes two tools:
+ *
+ *  - `semantic_search`       — ranked keyword search with TF scoring
+ *  - `semantic_index_status` — index counters and configuration
+ *
+ * Files are tokenized into lowercase alphanumeric terms and indexed with
+ * per-document term frequencies. Queries are scored by summing the TF of
+ * each matched query token, then results are returned with the matching
+ * file path, score, and a handful of matched lines.
+ *
+ * Config (`config.extensions['semantic-search-indexer']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "includeExtensions": [".ts", ".tsx", ".js", ".jsx"],
+ *   "excludePatterns": ["node_modules", "\\.git", "dist"],
+ *   "maxFileBytes": 1_000_000,
+ *   "defaultLimit": 10,
+ *   "minTokenLength": 2,
+ *   "maxMatchesPerFile": 10,
+ *   "maxFiles": 5000
+ * }
+ * ```
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/semantic-search-indexer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/semantic-search-indexer/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA6b/C,QAAA,MAAM,MAAM,EAAE,MA6Nb,CAAC;eAEa,MAAM"}