@wrongstack/plugins 0.285.0 → 0.287.0

package/dist/security-hotspot-scanner.js

@@ -1,6 +1,25 @@
 // src/security-hotspot-scanner/index.ts
 import { readdirSync, readFileSync, statSync } from "node:fs";
-import { isAbsolute, relative, resolve } from "node:path";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
+
+// src/runtime/index.ts
+import { basename, isAbsolute, relative, resolve } from "node:path";
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+function hasLeadingDash(arg) {
+  return arg.length > 0 && arg.startsWith("-");
+}
+function withinProjectPath(projectRoot, candidate) {
+  if (candidate.length === 0 || candidate.length > 4096) return false;
+  if (hasLeadingDash(candidate)) return false;
+  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(projectRoot, candidate);
+  const rel = relative(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function withinProject(p) {
+  return withinProjectPath(process.cwd(), p) || relative(process.cwd(), p) === ".";
+}
+
+// src/security-hotspot-scanner/index.ts
 var API_VERSION = "^0.1.10";
 var state = {
   scanCount: 0,
@@ -45,7 +64,7 @@ var PATTERNS = [
   {
     type: "hardcoded_http",
     severity: "medium",
-    regex: /http:\/\/[a-zA-Z0-9][^\s'"\)\\]*/i
+    regex: /http:\/\/[a-zA-Z0-9][^\s'")\\]*/i
   },
   {
     type: "console_log_credentials",
@@ -82,20 +101,10 @@ function isSourceFile(filePath, extensions) {
   const lower = filePath.toLowerCase();
   return extensions.some((ext) => lower.endsWith(ext));
 }
-function withinProject(p) {
-  if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
-  const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
-  if (rel === "" || rel === ".") return true;
-  if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
-  return true;
-}
 function scanPath(inputPath, cfg) {
   const start = Date.now();
   const root = process.cwd();
-  const resolved = isAbsolute(inputPath) ? resolve(inputPath) : resolve(root, inputPath);
+  const resolved = isAbsolute2(inputPath) ? resolve2(inputPath) : resolve2(root, inputPath);
   if (!withinProject(inputPath)) {
     return {
       path: inputPath,
@@ -116,7 +125,7 @@ function scanPath(inputPath, cfg) {
       filesScanned += 1;
       const findings = scanSource(content, maxPerFile);
       for (const f of findings) {
-        allFindings.push({ ...f, snippet: `${relative(root, filePath)}:${f.line}: ${f.snippet}` });
+        allFindings.push({ ...f, snippet: `${relative2(root, filePath)}:${f.line}: ${f.snippet}` });
         if (allFindings.length >= cfg.maxFindings) return;
       }
     } catch {
@@ -131,7 +140,7 @@ function scanPath(inputPath, cfg) {
     }
     for (const entry of entries) {
       if (allFindings.length >= cfg.maxFindings) return;
-      const full = resolve(dir, entry);
+      const full = resolve2(dir, entry);
       try {
         const st = statSync(full);
         if (st.isDirectory()) {
@@ -279,7 +288,7 @@ Review or remove the risky pattern(s).`;
       }
       return { additionalContext: message };
     };
-    state.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook);
+    state.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
     api.tools.register({
       name: "security_hotspot_scan",
       description: "Scan a file or directory for security anti-patterns (eval, Function constructor, innerHTML, SQL concatenation, http URLs, credential logging, variable exec commands).",

package/dist/session-recap.js

@@ -106,7 +106,7 @@ var plugin = {
   version: "0.1.0",
   description: "Stop hook that posts a one-page session summary (tokens, tools, commits, last activity) to the project mailbox",
   apiVersion: "^0.1.10",
-  capabilities: { tools: true, hooks: true },
+  capabilities: { tools: true, hooks: true, llm: true },
   defaultConfig: { ...DEFAULTS },
   configSchema: {
     type: "object",