@wrongstack/plugins 0.284.1 → 0.286.0

package/dist/type-gate.js

@@ -1,6 +1,195 @@
-import { execFileSync } from 'child_process';
-import { existsSync } from 'fs';
-import { isAbsolute, resolve, relative } from 'path';
+// src/type-gate/index.ts
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
+
+// src/runtime/index.ts
+import { execFile } from "node:child_process";
+import { basename, isAbsolute, relative, resolve } from "node:path";
+var META_CHARS = /["'`;&|<>\r\n]/;
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+function hasLeadingDash(arg) {
+  return arg.length > 0 && arg.startsWith("-");
+}
+function safeSplit(command) {
+  const trimmed = command.trim();
+  if (!trimmed || META_CHARS.test(trimmed)) return null;
+  return trimmed.split(/\s+/).filter(Boolean);
+}
+function withinProjectPath(projectRoot, candidate) {
+  if (candidate.length === 0 || candidate.length > 4096) return false;
+  if (hasLeadingDash(candidate)) return false;
+  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(projectRoot, candidate);
+  const rel = relative(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function everyFlagAllowed(allowed, args) {
+  for (const arg of args) {
+    if (!hasLeadingDash(arg)) continue;
+    if (allowed === null) return false;
+    if (!allowed.has(arg)) return false;
+  }
+  return true;
+}
+function sanitizeRunnerPath(value, options = {}) {
+  if (!value || hasLeadingDash(value)) return null;
+  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  if (!withinProjectPath(projectRoot, value)) return null;
+  return isAbsolute(value) ? resolve(value) : resolve(projectRoot, value);
+}
+function resolveRunnerCommand(runtime, command, options = {}) {
+  const tokens = safeSplit(command);
+  if (!tokens || tokens.length === 0) return null;
+  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  const launcher = runtime.packageManager;
+  const [head, second, ...rest] = tokens;
+  if (!head) return null;
+  const display = tokens.join(" ");
+  if (launcher !== "none" && tokens.length === 1 && head === launcher) {
+    return null;
+  }
+  if (head === runtime.executable) {
+    if (!everyFlagAllowed(runtime.allowedFlags, [second, ...rest].filter((v) => Boolean(v)))) {
+      return null;
+    }
+    return {
+      cmd: head,
+      args: [second, ...rest].filter((v) => Boolean(v)),
+      display
+    };
+  }
+  if (launcher !== "none" && head === launcher && runtime.subcommands.length === 0 && second === runtime.executable) {
+    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
+    return { cmd: head, args: [second, ...rest], display };
+  }
+  if (launcher !== "none" && head === launcher && runtime.subcommands.length > 0) {
+    const subcommand = runtime.subcommands[0];
+    const exe = rest[0];
+    if (second === subcommand && exe === runtime.executable) {
+      const tail = rest.slice(1);
+      if (!everyFlagAllowed(runtime.allowedFlags, tail)) return null;
+      return { cmd: head, args: [second, exe, ...tail], display };
+    }
+  }
+  if (isAbsolute(head)) {
+    if (!withinProjectPath(projectRoot, head)) return null;
+    const base = basename(head);
+    if (base !== runtime.executable && base !== launcher) return null;
+    if (second !== runtime.executable) return null;
+    if (!everyFlagAllowed(runtime.allowedFlags, rest)) return null;
+    return { cmd: head, args: [second, ...rest], display };
+  }
+  return null;
+}
+function runRunnerCommand(argv, options) {
+  if (argv.length === 0) {
+    return Promise.resolve({
+      code: null,
+      stdout: "",
+      stderr: "runtime helper: empty argv",
+      timedOut: false,
+      spawnError: true
+    });
+  }
+  return new Promise((resolvePromise) => {
+    const projectRoot = resolve(options.projectRoot ?? process.cwd());
+    const trimmedCwd = options.cwd.trim();
+    if (!withinProjectPath(projectRoot, trimmedCwd)) {
+      resolvePromise({
+        code: null,
+        stdout: "",
+        stderr: "runtime helper: cwd outside project",
+        timedOut: false,
+        spawnError: true
+      });
+      return;
+    }
+    const timedOut = false;
+    let spawnErrored = false;
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    const child = execFile(
+      argv[0],
+      argv.slice(1),
+      {
+        cwd: trimmedCwd,
+        timeout: options.timeoutMs,
+        signal: options.signal,
+        maxBuffer: MAX_BUFFER_BYTES,
+        windowsHide: true,
+        shell: false
+      },
+      (err, stdout, stderr) => {
+        if (timedOut) {
+          resolvePromise({
+            code: null,
+            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
+            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            timedOut: true,
+            spawnError: false
+          });
+          return;
+        }
+        if (spawnErrored) {
+          resolvePromise({
+            code: 127,
+            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
+            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            timedOut: false,
+            spawnError: true
+          });
+          return;
+        }
+        if (err) {
+          const anyErr = err;
+          const code = typeof anyErr.code === "number" ? anyErr.code : 1;
+          resolvePromise({
+            code,
+            stdout: Buffer.concat([
+              ...stdoutChunks,
+              ...anyErr.stdout ? [Buffer.isBuffer(anyErr.stdout) ? anyErr.stdout : Buffer.from(anyErr.stdout)] : []
+            ]).toString("utf8"),
+            stderr: Buffer.concat([
+              ...stderrChunks,
+              ...anyErr.stderr ? [Buffer.isBuffer(anyErr.stderr) ? anyErr.stderr : Buffer.from(anyErr.stderr)] : []
+            ]).toString("utf8"),
+            timedOut: false,
+            spawnError: false
+          });
+          return;
+        }
+        resolvePromise({
+          code: 0,
+          stdout: Buffer.concat([
+            ...stdoutChunks,
+            ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]
+          ]).toString("utf8"),
+          stderr: Buffer.concat([
+            ...stderrChunks,
+            ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]
+          ]).toString("utf8"),
+          timedOut: false,
+          spawnError: false
+        });
+      }
+    );
+    child.stdout?.on("data", (chunk) => {
+      stdoutBytes += chunk.length;
+      if (stdoutBytes <= MAX_BUFFER_BYTES) stdoutChunks.push(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderrBytes += chunk.length;
+      if (stderrBytes <= MAX_BUFFER_BYTES) stderrChunks.push(chunk);
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT" || err.code === "EPERM" || err.code === "EACCES") {
+        spawnErrored = true;
+      }
+    });
+  });
+}
 
 // src/type-gate/index.ts
 var API_VERSION = "^0.1.10";
@@ -39,54 +228,50 @@ function readConfig(raw) {
 function withinProject(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
+  const resolved = isAbsolute2(p) ? resolve2(p) : resolve2(root, p);
+  const rel = relative2(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
+  if (isAbsolute2(rel)) return false;
   return true;
 }
-var ALLOWED_COMMAND_TOKENS = /* @__PURE__ */ new Set([
-  "npx",
-  "pnpm",
-  "npm",
-  "yarn",
-  "bun",
-  "tsc",
-  "node",
-  "tsx"
-]);
-function resolveAllowedCommand(customCommand) {
-  const tokens = customCommand.split(/\s+/).filter(Boolean);
-  if (tokens.length === 0) return null;
-  const head = tokens[0];
-  if (ALLOWED_COMMAND_TOKENS.has(head)) {
-    return { cmd: head, args: tokens.slice(1) };
-  }
-  if (isAbsolute(head)) {
-    if (!withinProject(head)) return null;
-    const base = head.split(/[/\\]/).pop() ?? "";
-    if (ALLOWED_COMMAND_TOKENS.has(base)) {
-      return { cmd: head, args: tokens.slice(1) };
-    }
-  }
-  return null;
+var TSC_RUNTIME = {
+  id: "typescript",
+  packageManager: "pnpm",
+  executable: "tsc",
+  allowedFlags: /* @__PURE__ */ new Set([
+    "--noEmit",
+    "--pretty",
+    "--pretty=false",
+    "--incremental",
+    "--watch",
+    "--build",
+    "--filter"
+  ]),
+  subcommands: ["exec"],
+  defaultCommand: "pnpm exec tsc --noEmit"
+};
+function validateTsConfigPath(p) {
+  const sanitized = sanitizeRunnerPath(p);
+  return sanitized;
 }
 function runTypeCheck(cfg) {
   const start = Date.now();
-  const tsConfig = cfg.tsConfigPath;
-  let cmd;
-  let args;
+  const rawTsConfig = cfg.tsConfigPath;
+  const validTsConfig = rawTsConfig && rawTsConfig !== "tsconfig.json" ? validateTsConfigPath(rawTsConfig) : null;
+  if (rawTsConfig && rawTsConfig !== "tsconfig.json" && !validTsConfig) {
+    return null;
+  }
+  const tsConfig = validTsConfig ?? (rawTsConfig || "tsconfig.json");
+  let argv;
   if (cfg.command) {
-    const resolved = resolveAllowedCommand(cfg.command);
+    const resolved = resolveRunnerCommand(TSC_RUNTIME, cfg.command);
     if (!resolved) return null;
-    cmd = resolved.cmd;
-    args = resolved.args;
+    argv = [resolved.cmd, ...resolved.args];
   } else {
-    cmd = "npx";
-    args = ["tsc", "--noEmit"];
+    argv = ["npx", "tsc", "--noEmit"];
     if (tsConfig && tsConfig !== "tsconfig.json") {
-      args.push("-p", tsConfig);
+      argv = [...argv, "-p", tsConfig];
     }
   }
   if (!cfg.command && tsConfig && !existsSync(tsConfig)) {
@@ -95,7 +280,7 @@ function runTypeCheck(cfg) {
   let stdout = "";
   let stderr = "";
   try {
-    const out = execFileSync(cmd, args, {
+    const out = execFileSync(argv[0], argv.slice(1), {
       encoding: "utf-8",
       timeout: cfg.timeoutMs,
       cwd: process.cwd(),
@@ -109,6 +294,7 @@ function runTypeCheck(cfg) {
     stdout = e.stdout ?? "";
     stderr = e.stderr ?? "";
   }
+  void runRunnerCommand;
   const combined = `${stdout}
 ${stderr}`.trim();
   const durationMs = Date.now() - start;
@@ -126,6 +312,12 @@ ${stderr}`.trim();
 var plugin = {
   name: "type-gate",
   version: "0.1.0",
+  runtime: {
+    language: "typescript",
+    packageManager: "pnpm",
+    executable: "tsc",
+    defaultCommand: "pnpm exec tsc --noEmit"
+  },
   description: "PostToolUse hook that runs TypeScript type-checking after every write or edit to a source file",
   apiVersion: API_VERSION,
   capabilities: { tools: true, hooks: true },
@@ -307,5 +499,6 @@ Fix the type error(s) or adjust the change.`;
   }
 };
 var type_gate_default = plugin;
-
-export { type_gate_default as default };
+export {
+  type_gate_default as default
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@wrongstack/plugins",
-  "version": "0.284.1",
-  "description": "Official WrongStack plugin collection — 62 focused, single-purpose plugins for code quality, security, observability, planning, and agent coordination",
+  "version": "0.286.0",
+  "description": "Official WrongStack plugin collection — 63 focused, single-purpose plugins for code quality, security, observability, planning, and agent coordination",
   "license": "MIT",
   "author": "ECOSTACK TECHNOLOGY OÜ",
   "type": "module",
@@ -263,6 +263,10 @@
     "./test-generator": {
       "types": "./dist/test-generator.d.ts",
       "import": "./dist/test-generator.js"
+    },
+    "./runtime": {
+      "types": "./dist/runtime.d.ts",
+      "import": "./dist/runtime.js"
     }
   },
   "files": [
@@ -270,16 +274,15 @@
   ],
   "devDependencies": {
     "@types/node": "^26.0.1",
-    "tsup": "^8.5.1",
-    "typescript": "^6.0.3",
+    "typescript": "^7.0.2",
     "vitest": "^4.1.9"
   },
   "dependencies": {
-    "@wrongstack/tools": "0.284.1",
-    "@wrongstack/core": "0.284.1"
+    "@wrongstack/core": "0.286.0",
+    "@wrongstack/tools": "0.286.0"
   },
   "scripts": {
-    "build": "tsup",
+    "build": "node ../../scripts/build-package.mjs",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",