@wrongstack/plugins 0.286.0 → 0.289.0

package/dist/secret-scanner.js

@@ -55,6 +55,8 @@ var BASE_PATTERNS = [
 ];
 var PATTERNS = [...BASE_PATTERNS];
 var COMBINED_REGEX = buildCombinedRegex(PATTERNS);
+var RE_DOS_MAX_SCAN_LENGTH = 1e5;
+var RE_DOS_TIMEOUT_MS = 100;
 function buildCombinedRegex(patterns) {
   return new RegExp(patterns.map((p) => `(${p.regex.source})`).join("|"), "g");
 }
@@ -75,10 +77,17 @@ var state = {
 };
 function findMatches(text) {
   if (!text) return [];
+  if (text.length > RE_DOS_MAX_SCAN_LENGTH) return [];
   const found = /* @__PURE__ */ new Set();
   COMBINED_REGEX.lastIndex = 0;
   let m;
+  const startTime = performance.now();
   while ((m = COMBINED_REGEX.exec(text)) !== null) {
+    if (performance.now() - startTime > RE_DOS_TIMEOUT_MS) {
+      throw new Error(
+        `secret-scanner: ReDoS timeout \u2014 regex scan exceeded ${RE_DOS_TIMEOUT_MS}ms on ${text.length}-char input`
+      );
+    }
     for (let i = 0; i < PATTERNS.length; i++) {
       if (m[i + 1] !== void 0) {
         found.add(PATTERNS[i].type);
@@ -91,30 +100,32 @@ function findMatches(text) {
   }
   return Array.from(found);
 }
-function scanInput(input) {
+function scanInput(input, depth = 0) {
   if (input === null || input === void 0) return null;
+  if (depth > 50) return null;
   if (typeof input === "string") {
     const found = findMatches(input);
     return found.length > 0 ? found : null;
   }
   if (Array.isArray(input)) {
     for (const item of input) {
-      const found = scanInput(item);
+      const found = scanInput(item, depth + 1);
       if (found) return found;
     }
     return null;
   }
   if (typeof input === "object") {
     for (const value of Object.values(input)) {
-      const found = scanInput(value);
+      const found = scanInput(value, depth + 1);
       if (found) return found;
     }
     return null;
   }
   return null;
 }
-function redactInput(input) {
+function redactInput(input, depth = 0) {
   if (input === null || input === void 0) return input;
+  if (depth > 50) return input;
   if (typeof input === "string") {
     return input.replace(COMBINED_REGEX, (_match, ...groups) => {
       for (let i = 0; i < PATTERNS.length; i++) {
@@ -126,12 +137,12 @@ function redactInput(input) {
     });
   }
   if (Array.isArray(input)) {
-    return input.map((item) => redactInput(item));
+    return input.map((item) => redactInput(item, depth + 1));
   }
   if (typeof input === "object") {
     const out = {};
     for (const [k, v] of Object.entries(input)) {
-      out[k] = redactInput(v);
+      out[k] = redactInput(v, depth + 1);
     }
     return out;
   }

package/dist/security-hotspot-scanner/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security-hotspot-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAwQ/C,QAAA,MAAM,MAAM,EAAE,MAiQb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security-hotspot-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAgQ/C,QAAA,MAAM,MAAM,EAAE,MAiQb,CAAC;eAEa,MAAM"}

package/dist/security-hotspot-scanner.js

@@ -1,6 +1,25 @@
 // src/security-hotspot-scanner/index.ts
 import { readdirSync, readFileSync, statSync } from "node:fs";
-import { isAbsolute, relative, resolve } from "node:path";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
+
+// src/runtime/index.ts
+import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+function hasLeadingDash(arg) {
+  return arg.length > 0 && arg.startsWith("-");
+}
+function withinProjectPath(projectRoot, candidate) {
+  if (candidate.length === 0 || candidate.length > 4096) return false;
+  if (hasLeadingDash(candidate)) return false;
+  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(projectRoot, candidate);
+  const rel = relative(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function withinProject(p) {
+  return withinProjectPath(process.cwd(), p) || relative(process.cwd(), p) === ".";
+}
+
+// src/security-hotspot-scanner/index.ts
 var API_VERSION = "^0.1.10";
 var state = {
   scanCount: 0,
@@ -82,20 +101,10 @@ function isSourceFile(filePath, extensions) {
   const lower = filePath.toLowerCase();
   return extensions.some((ext) => lower.endsWith(ext));
 }
-function withinProject(p) {
-  if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
-  const root = process.cwd();
-  const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);
-  const rel = relative(root, resolved);
-  if (rel === "" || rel === ".") return true;
-  if (rel.startsWith("..")) return false;
-  if (isAbsolute(rel)) return false;
-  return true;
-}
 function scanPath(inputPath, cfg) {
   const start = Date.now();
   const root = process.cwd();
-  const resolved = isAbsolute(inputPath) ? resolve(inputPath) : resolve(root, inputPath);
+  const resolved = isAbsolute2(inputPath) ? resolve2(inputPath) : resolve2(root, inputPath);
   if (!withinProject(inputPath)) {
     return {
       path: inputPath,
@@ -116,7 +125,7 @@ function scanPath(inputPath, cfg) {
       filesScanned += 1;
       const findings = scanSource(content, maxPerFile);
       for (const f of findings) {
-        allFindings.push({ ...f, snippet: `${relative(root, filePath)}:${f.line}: ${f.snippet}` });
+        allFindings.push({ ...f, snippet: `${relative2(root, filePath)}:${f.line}: ${f.snippet}` });
         if (allFindings.length >= cfg.maxFindings) return;
       }
     } catch {
@@ -131,7 +140,7 @@ function scanPath(inputPath, cfg) {
     }
     for (const entry of entries) {
       if (allFindings.length >= cfg.maxFindings) return;
-      const full = resolve(dir, entry);
+      const full = resolve2(dir, entry);
       try {
         const st = statSync(full);
         if (st.isDirectory()) {
@@ -279,7 +288,7 @@ Review or remove the risky pattern(s).`;
       }
       return { additionalContext: message };
     };
-    state.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook);
+    state.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
     api.tools.register({
       name: "security_hotspot_scan",
       description: "Scan a file or directory for security anti-patterns (eval, Function constructor, innerHTML, SQL concatenation, http URLs, credential logging, variable exec commands).",

package/dist/session-recap.js

@@ -106,7 +106,7 @@ var plugin = {
   version: "0.1.0",
   description: "Stop hook that posts a one-page session summary (tokens, tools, commits, last activity) to the project mailbox",
   apiVersion: "^0.1.10",
-  capabilities: { tools: true, hooks: true },
+  capabilities: { tools: true, hooks: true, llm: true },
   defaultConfig: { ...DEFAULTS },
   configSchema: {
     type: "object",