@wrongstack/plugins 0.287.0 → 0.289.0

package/dist/runtime.js

@@ -1,7 +1,7 @@
 // src/runtime/index.ts
 import { execFile } from "node:child_process";
-import { existsSync } from "node:fs";
-import { basename, isAbsolute, relative, resolve } from "node:path";
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { basename, extname, isAbsolute, relative, resolve } from "node:path";
 
 // src/runtime/llm.ts
 function stripOuterMarkdownFence(text) {
@@ -148,12 +148,15 @@ function runRunnerCommand(argv, options) {
       });
       return;
     }
-    const timedOut = false;
+    let timedOut = false;
     let spawnErrored = false;
     const stdoutChunks = [];
     const stderrChunks = [];
     let stdoutBytes = 0;
     let stderrBytes = 0;
+    options.signal?.addEventListener("abort", () => {
+      timedOut = true;
+    }, { once: true });
     const child = execFile(
       argv[0],
       argv.slice(1),
@@ -165,12 +168,12 @@ function runRunnerCommand(argv, options) {
         windowsHide: true,
         shell: false
       },
-      (err, stdout, stderr) => {
+      (err) => {
         if (timedOut) {
           resolvePromise({
             code: null,
-            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
-            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+            stderr: Buffer.concat(stderrChunks).toString("utf8"),
             timedOut: true,
             spawnError: false
           });
@@ -179,8 +182,8 @@ function runRunnerCommand(argv, options) {
         if (spawnErrored) {
           resolvePromise({
             code: 127,
-            stdout: Buffer.concat([...stdoutChunks, ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]]).toString("utf8"),
-            stderr: Buffer.concat([...stderrChunks, ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]]).toString("utf8"),
+            stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+            stderr: Buffer.concat(stderrChunks).toString("utf8"),
             timedOut: false,
             spawnError: true
           });
@@ -191,14 +194,8 @@ function runRunnerCommand(argv, options) {
           const code = typeof anyErr.code === "number" ? anyErr.code : 1;
           resolvePromise({
             code,
-            stdout: Buffer.concat([
-              ...stdoutChunks,
-              ...anyErr.stdout ? [Buffer.isBuffer(anyErr.stdout) ? anyErr.stdout : Buffer.from(anyErr.stdout)] : []
-            ]).toString("utf8"),
-            stderr: Buffer.concat([
-              ...stderrChunks,
-              ...anyErr.stderr ? [Buffer.isBuffer(anyErr.stderr) ? anyErr.stderr : Buffer.from(anyErr.stderr)] : []
-            ]).toString("utf8"),
+            stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+            stderr: Buffer.concat(stderrChunks).toString("utf8"),
             timedOut: false,
             spawnError: false
           });
@@ -206,19 +203,18 @@ function runRunnerCommand(argv, options) {
         }
         resolvePromise({
           code: 0,
-          stdout: Buffer.concat([
-            ...stdoutChunks,
-            ...Buffer.isBuffer(stdout) ? [stdout] : [Buffer.from(stdout)]
-          ]).toString("utf8"),
-          stderr: Buffer.concat([
-            ...stderrChunks,
-            ...Buffer.isBuffer(stderr) ? [stderr] : [Buffer.from(stderr)]
-          ]).toString("utf8"),
+          stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+          stderr: Buffer.concat(stderrChunks).toString("utf8"),
           timedOut: false,
           spawnError: false
         });
       }
     );
+    child.on("exit", (_code, signal) => {
+      if (signal !== null) {
+        timedOut = true;
+      }
+    });
     child.stdout?.on("data", (chunk) => {
       stdoutBytes += chunk.length;
       if (stdoutBytes <= MAX_BUFFER_BYTES) stdoutChunks.push(chunk);
@@ -258,8 +254,51 @@ function locateRunnerEntry(runtime, projectRoot) {
   }
   return null;
 }
+var DEFAULT_EXCLUDE_DIRS = ["node_modules", "dist", ".git", "coverage"];
+function collectSourceFiles(root, opts) {
+  const files = [];
+  if (!existsSync(root)) return files;
+  const s = statSync(root);
+  if (s.isFile()) {
+    if (matchesExtension(root, opts.extensions)) files.push(root);
+    return files;
+  }
+  if (!s.isDirectory()) return files;
+  const exclude = opts.excludeDirs ?? DEFAULT_EXCLUDE_DIRS;
+  function walk(dir, depth) {
+    if (opts.maxDepth !== void 0 && depth > opts.maxDepth) return;
+    let entries;
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (exclude.includes(entry)) continue;
+      const full = resolve(dir, entry);
+      let st;
+      try {
+        st = statSync(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        walk(full, depth + 1);
+      } else if (st.isFile() && matchesExtension(full, opts.extensions)) {
+        files.push(full);
+      }
+    }
+  }
+  walk(root, 0);
+  return files;
+}
+function matchesExtension(p, exts) {
+  return exts.includes(extname(p).toLowerCase());
+}
 export {
+  collectSourceFiles,
   locateRunnerEntry,
+  matchesExtension,
   parseLlmJsonObject,
   probeRunner,
   resolveRunnerCommand,

package/dist/schema-evolution-guard.js

@@ -3,7 +3,7 @@ import { readFileSync } from "node:fs";
 import { basename as basename2 } from "node:path";
 
 // src/runtime/index.ts
-import { basename, isAbsolute, relative, resolve } from "node:path";
+import { basename, extname, isAbsolute, relative, resolve } from "node:path";
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {
   return arg.length > 0 && arg.startsWith("-");

package/dist/secret-scanner/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secret-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAua/C,QAAA,MAAM,MAAM,EAAE,MAgOb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secret-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAqd/C,QAAA,MAAM,MAAM,EAAE,MAgOb,CAAC;eAEa,MAAM"}

package/dist/secret-scanner.js

@@ -55,6 +55,8 @@ var BASE_PATTERNS = [
 ];
 var PATTERNS = [...BASE_PATTERNS];
 var COMBINED_REGEX = buildCombinedRegex(PATTERNS);
+var RE_DOS_MAX_SCAN_LENGTH = 1e5;
+var RE_DOS_TIMEOUT_MS = 100;
 function buildCombinedRegex(patterns) {
   return new RegExp(patterns.map((p) => `(${p.regex.source})`).join("|"), "g");
 }
@@ -75,10 +77,17 @@ var state = {
 };
 function findMatches(text) {
   if (!text) return [];
+  if (text.length > RE_DOS_MAX_SCAN_LENGTH) return [];
   const found = /* @__PURE__ */ new Set();
   COMBINED_REGEX.lastIndex = 0;
   let m;
+  const startTime = performance.now();
   while ((m = COMBINED_REGEX.exec(text)) !== null) {
+    if (performance.now() - startTime > RE_DOS_TIMEOUT_MS) {
+      throw new Error(
+        `secret-scanner: ReDoS timeout \u2014 regex scan exceeded ${RE_DOS_TIMEOUT_MS}ms on ${text.length}-char input`
+      );
+    }
     for (let i = 0; i < PATTERNS.length; i++) {
       if (m[i + 1] !== void 0) {
         found.add(PATTERNS[i].type);
@@ -91,30 +100,32 @@ function findMatches(text) {
   }
   return Array.from(found);
 }
-function scanInput(input) {
+function scanInput(input, depth = 0) {
   if (input === null || input === void 0) return null;
+  if (depth > 50) return null;
   if (typeof input === "string") {
     const found = findMatches(input);
     return found.length > 0 ? found : null;
   }
   if (Array.isArray(input)) {
     for (const item of input) {
-      const found = scanInput(item);
+      const found = scanInput(item, depth + 1);
       if (found) return found;
     }
     return null;
   }
   if (typeof input === "object") {
     for (const value of Object.values(input)) {
-      const found = scanInput(value);
+      const found = scanInput(value, depth + 1);
       if (found) return found;
     }
     return null;
   }
   return null;
 }
-function redactInput(input) {
+function redactInput(input, depth = 0) {
   if (input === null || input === void 0) return input;
+  if (depth > 50) return input;
   if (typeof input === "string") {
     return input.replace(COMBINED_REGEX, (_match, ...groups) => {
       for (let i = 0; i < PATTERNS.length; i++) {
@@ -126,12 +137,12 @@ function redactInput(input) {
     });
   }
   if (Array.isArray(input)) {
-    return input.map((item) => redactInput(item));
+    return input.map((item) => redactInput(item, depth + 1));
   }
   if (typeof input === "object") {
     const out = {};
     for (const [k, v] of Object.entries(input)) {
-      out[k] = redactInput(v);
+      out[k] = redactInput(v, depth + 1);
     }
     return out;
   }

package/dist/security-hotspot-scanner.js

@@ -3,7 +3,7 @@ import { readdirSync, readFileSync, statSync } from "node:fs";
 import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
 
 // src/runtime/index.ts
-import { basename, isAbsolute, relative, resolve } from "node:path";
+import { basename, extname, isAbsolute, relative, resolve } from "node:path";
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {
   return arg.length > 0 && arg.startsWith("-");