@wrongstack/plugins 0.291.1 → 0.292.0

package/dist/spec-linker.js

@@ -5036,8 +5036,8 @@ var plugin15 = {
 var file_watcher_default = plugin15;
 
 // src/format-on-save/index.ts
-import { execFileSync as execFileSync2, execSync } from "node:child_process";
-import { existsSync as existsSync2, statSync as statSync4 } from "node:fs";
+import { execFile as execFile3 } from "node:child_process";
+import { access, stat as stat2 } from "node:fs/promises";
 var API_VERSION8 = "^0.1.10";
 var state14 = {
   invocationCount: 0,
@@ -5096,29 +5096,46 @@ function evictExpired(ttlMs) {
     if (ts < cutoff) recentlyCovered.delete(path);
   }
 }
-function formatFile(filePath, timeoutMs) {
+async function formatFile(filePath, timeoutMs) {
   if (!withinProject(filePath)) return null;
-  if (!existsSync2(filePath)) return null;
+  try {
+    await access(filePath);
+  } catch {
+    return null;
+  }
   let bytesBefore;
   try {
-    bytesBefore = statSync4(filePath).size;
+    bytesBefore = (await stat2(filePath)).size;
   } catch {
     return null;
   }
   try {
-    execFileSync2("npx", ["biome", "format", "--write", filePath], {
-      encoding: "utf-8",
-      timeout: timeoutMs,
-      cwd: process.cwd(),
-      stdio: ["pipe", "pipe", "pipe"]
+    await new Promise((resolve28, reject) => {
+      execFile3(
+        "npx",
+        ["biome", "format", "--write", filePath],
+        {
+          encoding: "utf-8",
+          timeout: timeoutMs,
+          cwd: process.cwd(),
+          windowsHide: true,
+          maxBuffer: 16 * 1024 * 1024
+        },
+        (err) => {
+          if (err) {
+            const e = err;
+            if (e.killed) return reject(err);
+          }
+          resolve28();
+        }
+      );
     });
-  } catch (err) {
-    const e = err;
-    if (e.killed) return null;
+  } catch {
+    return null;
   }
   let bytesAfter;
   try {
-    bytesAfter = statSync4(filePath).size;
+    bytesAfter = (await stat2(filePath)).size;
   } catch {
     return null;
   }
@@ -5126,11 +5143,22 @@ function formatFile(filePath, timeoutMs) {
     return { changed: true, bytesBefore, bytesAfter };
   }
   try {
-    execFileSync2("npx", ["biome", "format", filePath], {
-      encoding: "utf-8",
-      timeout: timeoutMs,
-      cwd: process.cwd(),
-      stdio: ["pipe", "pipe", "pipe"]
+    await new Promise((resolve28, reject) => {
+      execFile3(
+        "npx",
+        ["biome", "format", filePath],
+        {
+          encoding: "utf-8",
+          timeout: timeoutMs,
+          cwd: process.cwd(),
+          windowsHide: true,
+          maxBuffer: 16 * 1024 * 1024
+        },
+        (err) => {
+          if (err) return reject(err);
+          resolve28();
+        }
+      );
     });
     return { changed: false, bytesBefore, bytesAfter };
   } catch {
@@ -5171,7 +5199,7 @@ var plugin16 = {
       }
     }
   },
-  setup(api) {
+  async setup(api) {
     clearRegistrations();
     state14.invocationCount = 0;
     state14.formattedCount = 0;
@@ -5183,11 +5211,21 @@ var plugin16 = {
     const cfg = readConfig12(api.config.extensions?.["format-on-save"]);
     let biomeAvailable = false;
     try {
-      execSync("npx biome --version", {
-        encoding: "utf-8",
-        timeout: 5e3,
-        cwd: process.cwd(),
-        stdio: ["pipe", "pipe", "pipe"]
+      await new Promise((resolve28, reject) => {
+        execFile3(
+          "npx",
+          ["biome", "--version"],
+          {
+            encoding: "utf-8",
+            timeout: 5e3,
+            cwd: process.cwd(),
+            windowsHide: true
+          },
+          (err) => {
+            if (err) reject(err);
+            else resolve28();
+          }
+        );
       });
       biomeAvailable = true;
       api.log.info("format-on-save: biome detected");
@@ -5195,7 +5233,7 @@ var plugin16 = {
       biomeAvailable = false;
       api.log.warn("format-on-save: biome not found \u2014 hook will be a no-op");
     }
-    const hook = (input) => {
+    const hook = async (input) => {
       if (!cfg.enabled || !biomeAvailable) return;
       if (input.toolResult?.isError) return;
       const toolName = input.toolName ?? "";
@@ -5217,7 +5255,7 @@ var plugin16 = {
         }
       }
       state14.invocationCount += 1;
-      const result = formatFile(filePath, cfg.timeoutMs);
+      const result = await formatFile(filePath, cfg.timeoutMs);
       if (!result) {
         state14.errorCount += 1;
         return;
@@ -5323,56 +5361,68 @@ var plugin16 = {
 var format_on_save_default = plugin16;
 
 // src/git-autocommit/index.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync3 } from "node:fs";
+import { execFile as execFile4 } from "node:child_process";
+import { existsSync as existsSync2 } from "node:fs";
 var API_VERSION9 = "^0.1.10";
 var commitCount = { value: 0 };
 var lastCommit = { hash: null, at: null };
 var llmGenerated = { value: 0 };
 var DEFAULT_GIT_TIMEOUT_MS = 3e4;
 var GIT_COMMIT_TIMEOUT_MS = 5 * 6e4;
-function runGit2(args, cwd, timeoutMs = DEFAULT_GIT_TIMEOUT_MS) {
-  try {
-    return execFileSync3("git", args, {
-      encoding: "utf-8",
-      cwd,
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: timeoutMs,
-      maxBuffer: 10 * 1024 * 1024,
-      windowsHide: true
-    }).trim();
-  } catch (err) {
-    const e = err;
-    throw new Error(`git command failed: ${e.message ?? e.stderr ?? String(err)}`);
-  }
+async function runGit2(args, cwd, timeoutMs = DEFAULT_GIT_TIMEOUT_MS) {
+  return await new Promise((resolvePromise, rejectPromise) => {
+    execFile4(
+      "git",
+      args,
+      {
+        encoding: "utf-8",
+        cwd,
+        windowsHide: true,
+        timeout: timeoutMs,
+        maxBuffer: 10 * 1024 * 1024
+      },
+      (err, stdout) => {
+        if (err) {
+          const e = err;
+          rejectPromise(
+            new Error(
+              `git command failed: ${e.message ?? e.stderr ?? String(err)}`
+            )
+          );
+          return;
+        }
+        resolvePromise(stdout.trim());
+      }
+    );
+  });
 }
-function getChangedFiles(cwd) {
-  const output = runGit2(["status", "--porcelain"], cwd);
+async function getChangedFiles(cwd) {
+  const output = await runGit2(["status", "--porcelain"], cwd);
   if (!output) return [];
   return output.split("\n").filter((l) => l.trim()).map((l) => l.slice(3).trim());
 }
-function getStagedFiles(cwd) {
-  const output = runGit2(["diff", "--cached", "--name-only"], cwd);
+async function getStagedFiles(cwd) {
+  const output = await runGit2(["diff", "--cached", "--name-only"], cwd);
   return output ? output.split("\n").filter(Boolean) : [];
 }
-function stageFiles(files, cwd) {
+async function stageFiles(files, cwd) {
   if (!files || !Array.isArray(files)) return;
   const existing = files.filter((f) => {
     try {
-      return existsSync3(f);
+      return existsSync2(f);
     } catch {
       return false;
     }
   });
   if (existing.length === 0) throw new Error("No files exist to stage");
-  runGit2(["add", ...existing], cwd);
+  await runGit2(["add", ...existing], cwd);
 }
-function commitWithMessage(message, cwd) {
-  return runGit2(["commit", "-m", message], cwd, GIT_COMMIT_TIMEOUT_MS);
+async function commitWithMessage(message, cwd) {
+  return await runGit2(["commit", "-m", message], cwd, GIT_COMMIT_TIMEOUT_MS);
 }
-function getWorktrees(cwd) {
+async function getWorktrees(cwd) {
   try {
-    const out = runGit2(["worktree", "list", "--porcelain"], cwd);
+    const out = await runGit2(["worktree", "list", "--porcelain"], cwd);
     if (!out) return [];
     const entries = [];
     let current = {};
@@ -5392,28 +5442,28 @@ function getWorktrees(cwd) {
     return [];
   }
 }
-function simultaneousEditWarning(cwd) {
-  const worktrees = getWorktrees(cwd);
+async function simultaneousEditWarning(cwd) {
+  const worktrees = await getWorktrees(cwd);
   if (worktrees.length > 1) {
     const otherBranches = worktrees.filter((wt) => wt.branch).map((wt) => wt.branch.replace("refs/heads/", ""));
     return `\u26A0 Simultaneous edits detected: ${worktrees.length} active worktrees (${otherBranches.join(", ")}). Changes from other agents may mix into this commit. Consider using worktree isolation or verifying the diff below before committing.`;
   }
   return null;
 }
-function getStagedDiff(cwd) {
+async function getStagedDiff(cwd) {
   try {
-    const stat4 = runGit2(["diff", "--cached", "--stat"], cwd);
-    const diff = runGit2(["diff", "--cached"], cwd);
+    const stat5 = await runGit2(["diff", "--cached", "--stat"], cwd);
+    const diff = await runGit2(["diff", "--cached"], cwd);
     const MAX_DIFF = 2e4;
     const truncated = diff.length > MAX_DIFF ? diff.slice(0, MAX_DIFF) + "\n\n... (diff truncated)" : diff;
-    return { stat: stat4 || "(no stat)", diff: truncated || "(clean)" };
+    return { stat: stat5 || "(no stat)", diff: truncated || "(clean)" };
   } catch {
     return { stat: "(unavailable)", diff: "(unavailable)" };
   }
 }
-function externalChangesSinceStage(cwd) {
+async function externalChangesSinceStage(cwd) {
   try {
-    const out = runGit2(["status", "--porcelain"], cwd);
+    const out = await runGit2(["status", "--porcelain"], cwd);
     if (!out) return null;
     const unstaged = out.split("\n").filter((l) => l.trim()).filter((l) => {
       const idx = l[0] ?? " ";
@@ -5444,14 +5494,14 @@ var VALID_TYPES = [
   "build",
   "revert"
 ];
-async function generateCommitFromDiff(api, stat4, diff) {
+async function generateCommitFromDiff(api, stat5, diff) {
   if (!api.llm) return null;
   try {
     const result = await api.llm.complete(
       `Write a Conventional Commits message for this staged git diff. Respond with ONLY a JSON object of the form {"type": string, "scope": string, "summary": string, "body": string}. type is one of: ${VALID_TYPES.join(", ")}. scope is a short area (empty string if unclear). summary is an imperative, lower-case, <=72-char subject with no trailing period. body is an optional short explanation (empty string if not needed). No prose outside the JSON.
 
 Stat:
-${stat4}
+${stat5}
 
 Diff:
 ${diff}`,
@@ -5588,7 +5638,7 @@ var plugin17 = {
           }
           if (files && files.length > 0) {
             try {
-              stageFiles(files);
+              await stageFiles(files);
             } catch (err) {
               return {
                 ok: false,
@@ -5598,20 +5648,20 @@ var plugin17 = {
           }
           let staged = [];
           try {
-            staged = getStagedFiles();
+            staged = await getStagedFiles();
           } catch {
             staged = [];
           }
           if (staged.length === 0) {
             try {
-              const changed = getChangedFiles();
+              const changed = await getChangedFiles();
               if (changed.length > 0) {
                 try {
-                  stageFiles(changed);
+                  await stageFiles(changed);
                 } catch {
                 }
                 try {
-                  staged = getStagedFiles();
+                  staged = await getStagedFiles();
                 } catch {
                   staged = [];
                 }
@@ -5619,10 +5669,10 @@ var plugin17 = {
             } catch {
             }
           }
-          const { stat: stat4, diff: stagedDiff } = getStagedDiff();
+          const { stat: stat5, diff: stagedDiff } = await getStagedDiff();
           let generatedByLlm = false;
           if (wantGenerate && staged.length > 0) {
-            const g = await generateCommitFromDiff(api, stat4, stagedDiff);
+            const g = await generateCommitFromDiff(api, stat5, stagedDiff);
             if (g) {
               type = g.type;
               if (g.scope) scope = g.scope;
@@ -5665,8 +5715,8 @@ var plugin17 = {
               error: "Nothing staged. Add files with git add or provide files input."
             };
           }
-          const worktreeWarn = simultaneousEditWarning();
-          const externalChanges = externalChangesSinceStage();
+          const worktreeWarn = await simultaneousEditWarning();
+          const externalChanges = await externalChangesSinceStage();
           let externalWarning = null;
           if (externalChanges && externalChanges.length > 0) {
             const preview = externalChanges.slice(0, 10).join(", ");
@@ -5683,7 +5733,7 @@ var plugin17 = {
               stagedDiff: `
 ## Staged changes (dry run)
 
-${stat4}
+${stat5}
 
 \`\`\`diff
 ${stagedDiff}
@@ -5691,15 +5741,15 @@ ${stagedDiff}
             };
           }
           let preCommitDiff = stagedDiff;
-          let preCommitStat = stat4;
+          let preCommitStat = stat5;
           if (staged.length === 0) {
-            const fresh = getStagedDiff();
+            const fresh = await getStagedDiff();
             preCommitDiff = fresh.diff;
             preCommitStat = fresh.stat;
           }
           let hash = "";
           try {
-            hash = commitWithMessage(msg);
+            hash = await commitWithMessage(msg);
           } catch (err) {
             return {
               ok: false,
@@ -5784,7 +5834,7 @@ var git_autocommit_default = plugin17;
 
 // src/import-organizer/index.ts
 import { spawn } from "node:child_process";
-import { existsSync as existsSync4, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync3, statSync as statSync4 } from "node:fs";
 import { basename as basename2, isAbsolute as isAbsolute7 } from "node:path";
 var ALLOWED_FIRST_TOKENS = /* @__PURE__ */ new Set([
   "npx",
@@ -5883,10 +5933,10 @@ function runCommand(command, args, timeoutMs, cwd) {
 }
 async function organizeImports(filePath, cfg, cwd) {
   if (!withinProject(filePath)) return null;
-  if (!existsSync4(filePath)) return null;
+  if (!existsSync3(filePath)) return null;
   let bytesBefore;
   try {
-    bytesBefore = statSync5(filePath).size;
+    bytesBefore = statSync4(filePath).size;
   } catch {
     return null;
   }
@@ -5907,7 +5957,7 @@ async function organizeImports(filePath, cfg, cwd) {
   if (result.code === 127) return null;
   let bytesAfter;
   try {
-    bytesAfter = statSync5(filePath).size;
+    bytesAfter = statSync4(filePath).size;
   } catch {
     return null;
   }
@@ -6632,7 +6682,7 @@ var plugin20 = {
 var knowledge_graph_default = plugin20;
 
 // src/lint-gate/index.ts
-import { execFile as execFile3 } from "node:child_process";
+import { execFile as execFile5 } from "node:child_process";
 import { readFileSync as readFileSync6 } from "node:fs";
 import { mkdtemp, readFile as readFile2, rm, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
@@ -6702,7 +6752,7 @@ function resolveLocalLinter(name, cwd) {
 function runCommand2(command, args, timeoutMs, cwd, signal) {
   return new Promise((resolveResult) => {
     try {
-      execFile3(
+      execFile5(
         command,
         args,
         {
@@ -7345,7 +7395,7 @@ var plugin22 = {
 var llm_cache_default = plugin22;
 
 // src/loop-breaker/index.ts
-import { execFile as execFile4 } from "node:child_process";
+import { execFile as execFile6 } from "node:child_process";
 var state20 = {
   lastFingerprint: null,
   streak: 0,
@@ -7442,7 +7492,7 @@ function hashString2(value) {
 async function gitDiffFingerprint(cwd, signal) {
   try {
     const diff = await new Promise((resolve28, reject) => {
-      execFile4(
+      execFile6(
         "git",
         ["diff", "--no-ext-diff", "--"],
         {
@@ -8010,15 +8060,134 @@ var plugin24 = {
 var model_router_default = plugin24;
 
 // src/notify-hub/index.ts
+import { lookup } from "node:dns/promises";
+
+// src/notify-hub/webhook-channel.ts
+function freshCircuit() {
+  return { open: false, consecutiveFailures: 0 };
+}
+var WebhookNotificationChannel = class {
+  name = "webhook";
+  type = "webhook";
+  #url;
+  #headers;
+  #timeoutMs;
+  #maxFailures;
+  #circuit;
+  /** Total deliveries attempted (across all resets). */
+  #totalAttempted = 0;
+  /** Total successful deliveries. */
+  #totalDelivered = 0;
+  /** Total failed deliveries. */
+  #totalFailed = 0;
+  /** Total suppressed by circuit breaker. */
+  #totalSuppressed = 0;
+  constructor(opts) {
+    this.#url = opts.webhookUrl;
+    this.#headers = opts.headers ?? {};
+    this.#timeoutMs = opts.timeoutMs ?? 5e3;
+    this.#maxFailures = opts.maxConsecutiveFailures ?? 5;
+    this.#circuit = freshCircuit();
+  }
+  // -----------------------------------------------------------------------
+  // NotificationChannel
+  // -----------------------------------------------------------------------
+  async deliver(msg) {
+    const deliveredAt = (/* @__PURE__ */ new Date()).toISOString();
+    if (this.#circuit.open && this.#maxFailures > 0) {
+      this.#totalSuppressed += 1;
+      return {
+        ok: false,
+        channel: this.name,
+        error: `circuit open after ${this.#circuit.consecutiveFailures} consecutive failures`,
+        deliveredAt
+      };
+    }
+    this.#totalAttempted += 1;
+    const body = JSON.stringify({
+      source: "wrongstack/notify-hub",
+      event: msg.source,
+      ts: deliveredAt,
+      title: msg.title,
+      message: msg.body,
+      level: msg.level,
+      ...msg.metadata ?? {}
+    });
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), this.#timeoutMs);
+      try {
+        const res = await fetch(this.#url, {
+          method: "POST",
+          headers: { "content-type": "application/json", ...this.#headers },
+          body,
+          signal: controller.signal
+        });
+        if (!res.ok) throw new Error(`webhook responded ${res.status}`);
+      } finally {
+        clearTimeout(timer);
+      }
+      this.#totalDelivered += 1;
+      this.#circuit.consecutiveFailures = 0;
+      this.#circuit.open = false;
+      return { ok: true, channel: this.name, deliveredAt };
+    } catch (err) {
+      this.#totalFailed += 1;
+      this.#circuit.consecutiveFailures += 1;
+      if (this.#maxFailures > 0 && this.#circuit.consecutiveFailures >= this.#maxFailures) {
+        this.#circuit.open = true;
+      }
+      return {
+        ok: false,
+        channel: this.name,
+        error: err instanceof Error ? err.message : String(err),
+        deliveredAt
+      };
+    }
+  }
+  async ping() {
+    if (!this.#url) {
+      return { ok: false, error: "no webhookUrl configured" };
+    }
+    if (this.#circuit.open) {
+      return {
+        ok: false,
+        error: `circuit open after ${this.#circuit.consecutiveFailures} consecutive failures`
+      };
+    }
+    return { ok: true };
+  }
+  // -----------------------------------------------------------------------
+  // Diagnostics (not part of NotificationChannel)
+  // -----------------------------------------------------------------------
+  /** Reset the circuit breaker (e.g. after config update). */
+  resetCircuit() {
+    this.#circuit.open = false;
+    this.#circuit.consecutiveFailures = 0;
+  }
+  /** Current circuit breaker state. */
+  circuitStatus() {
+    return { open: this.#circuit.open, consecutiveFailures: this.#circuit.consecutiveFailures };
+  }
+  /** Lifetime delivery counters (never reset). */
+  counters() {
+    return {
+      attempted: this.#totalAttempted,
+      delivered: this.#totalDelivered,
+      failed: this.#totalFailed,
+      suppressed: this.#totalSuppressed
+    };
+  }
+};
+
+// src/notify-hub/index.ts
+var _pluginLog = null;
 var state22 = {
-  sent: 0,
-  failed: 0,
-  suppressed: 0,
-  consecutiveFailures: 0,
-  circuitOpen: false,
+  channel: null,
   lastDelivery: null,
   stopHookUnregister: null,
-  eventUnsubscribers: []
+  eventUnsubscribers: [],
+  circuitWarned: false
 };
 var KNOWN_EVENTS = ["session.stop", "tool.error", "budget.threshold"];
 var DEFAULTS19 = {
@@ -8041,6 +8210,21 @@ function isBlockedHostname(hostname) {
   const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
   return h === "localhost" || h.endsWith(".localhost") || h === "::1" || h === "0:0:0:0:0:0:0:1" || h.startsWith("fc") || h.startsWith("fd") || h.startsWith("fe80:") || isPrivateIPv4(h);
 }
+async function hasPrivateResolvedIP(hostname) {
+  try {
+    const entries = await lookup(hostname, { all: true, verbatim: true });
+    for (const { address } of entries) {
+      if (isPrivateIPv4(address)) return true;
+      const lower = address.toLowerCase();
+      if (lower === "::1" || lower === "0:0:0:0:0:0:0:1" || lower.startsWith("fc") || lower.startsWith("fd") || lower.startsWith("fe80:")) {
+        return true;
+      }
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
 function normalizeWebhookUrl(raw) {
   if (typeof raw !== "string" || raw.trim().length === 0) return "";
   try {
@@ -8072,49 +8256,37 @@ function readConfig20(raw) {
     maxConsecutiveFailures: typeof r["maxConsecutiveFailures"] === "number" && r["maxConsecutiveFailures"] >= 1 ? r["maxConsecutiveFailures"] : DEFAULTS19.maxConsecutiveFailures
   };
 }
-async function deliver(cfg, event, payload, log) {
-  if (!cfg.webhookUrl) return false;
-  if (state22.circuitOpen) {
-    state22.suppressed += 1;
+async function deliver(event, payload) {
+  const ch = state22.channel;
+  if (!ch) {
     return false;
   }
-  const body = JSON.stringify({
-    source: "wrongstack/notify-hub",
-    event,
-    ts: (/* @__PURE__ */ new Date()).toISOString(),
-    ...payload
+  const result = await deliverViaChannel(ch, event, {
+    title: typeof payload.title === "string" ? payload.title : event,
+    body: typeof payload.message === "string" ? payload.message : typeof payload.error === "string" ? payload.error : JSON.stringify(payload),
+    level: event === "tool.error" || event === "budget.threshold" ? "warning" : "info",
+    source: event,
+    metadata: payload
   });
-  try {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), cfg.timeoutMs);
-    try {
-      const res = await fetch(cfg.webhookUrl, {
-        method: "POST",
-        headers: { "content-type": "application/json", ...cfg.headers },
-        body,
-        signal: controller.signal
-      });
-      if (!res.ok) throw new Error(`webhook responded ${res.status}`);
-    } finally {
-      clearTimeout(timer);
-    }
-    state22.sent += 1;
-    state22.consecutiveFailures = 0;
+  return result.ok;
+}
+async function deliverViaChannel(ch, event, msg) {
+  const result = await ch.deliver(msg);
+  if (result.ok) {
+    state22.circuitWarned = false;
     state22.lastDelivery = { event, ok: true, when: (/* @__PURE__ */ new Date()).toISOString() };
-    return true;
-  } catch (err) {
-    state22.failed += 1;
-    state22.consecutiveFailures += 1;
+  } else {
     state22.lastDelivery = { event, ok: false, when: (/* @__PURE__ */ new Date()).toISOString() };
-    if (state22.consecutiveFailures >= cfg.maxConsecutiveFailures) {
-      state22.circuitOpen = true;
-      log.warn(
-        `notify-hub: ${state22.consecutiveFailures} consecutive delivery failures \u2014 circuit opened, further notifications suppressed`,
-        { error: err instanceof Error ? err.message : String(err) }
+    const cs = ch.circuitStatus();
+    if (cs.open && !state22.circuitWarned) {
+      state22.circuitWarned = true;
+      _pluginLog?.warn(
+        `notify-hub: ${cs.consecutiveFailures} consecutive delivery failures \u2014 circuit opened, further notifications suppressed`,
+        { consecutiveFailures: cs.consecutiveFailures, event }
       );
     }
-    return false;
   }
+  return result;
 }
 function truncateText(s, max) {
   return s.length > max ? `${s.slice(0, max)}\u2026` : s;
@@ -8161,12 +8333,10 @@ var plugin25 = {
       }
     }
   },
-  setup(api) {
-    state22.sent = 0;
-    state22.failed = 0;
-    state22.suppressed = 0;
-    state22.consecutiveFailures = 0;
-    state22.circuitOpen = false;
+  async setup(api) {
+    _pluginLog = api.log;
+    state22.circuitWarned = false;
+    state22.channel = null;
     state22.lastDelivery = null;
     if (state22.stopHookUnregister) {
       try {
@@ -8183,15 +8353,35 @@ var plugin25 = {
     }
     state22.eventUnsubscribers = [];
     const cfg = readConfig20(api.config.extensions?.["notify-hub"]);
-    const active = cfg.enabled && cfg.webhookUrl.length > 0;
+    let active = cfg.enabled && cfg.webhookUrl.length > 0;
+    if (active) {
+      try {
+        const url = new URL(cfg.webhookUrl);
+        const hostnameBlocked = await hasPrivateResolvedIP(url.hostname);
+        if (hostnameBlocked) {
+          api.log.warn(
+            `notify-hub: webhook URL resolves to a private/local IP (${url.hostname}) \u2014 disabling plugin`
+          );
+          active = false;
+        }
+      } catch {
+      }
+    }
+    if (active) {
+      state22.channel = new WebhookNotificationChannel({
+        webhookUrl: cfg.webhookUrl,
+        headers: cfg.headers,
+        timeoutMs: cfg.timeoutMs,
+        maxConsecutiveFailures: cfg.maxConsecutiveFailures
+      });
+      api.notifier?.registerChannel(state22.channel);
+    }
     if (active && cfg.events.includes("session.stop")) {
       const stopHook = (input) => {
-        void deliver(
-          cfg,
-          "session.stop",
-          { sessionId: input.sessionId ?? null, cwd: input.cwd ?? null },
-          api.log
-        );
+        void deliver("session.stop", {
+          sessionId: input.sessionId ?? null,
+          cwd: input.cwd ?? null
+        });
       };
       state22.stopHookUnregister = api.registerHook("Stop", void 0, stopHook);
     }
@@ -8199,26 +8389,21 @@ var plugin25 = {
       const off = api.onPattern("tool.*", (eventName, payload) => {
         if (!/error|failed/.test(eventName)) return;
         const p = payload;
-        void deliver(
-          cfg,
-          "tool.error",
-          {
-            tool: p?.tool ?? p?.name ?? "unknown",
-            busEvent: eventName,
-            error: truncateText(
-              p?.error instanceof Error ? p.error.message : String(p?.error ?? ""),
-              500
-            )
-          },
-          api.log
-        );
+        void deliver("tool.error", {
+          tool: p?.tool ?? p?.name ?? "unknown",
+          busEvent: eventName,
+          error: truncateText(
+            p?.error instanceof Error ? p.error.message : String(p?.error ?? ""),
+            500
+          )
+        });
       });
       state22.eventUnsubscribers.push(off);
     }
     if (active && cfg.events.includes("budget.threshold")) {
       const off = api.onPattern("budget.*", (eventName, payload) => {
         if (!eventName.includes("threshold")) return;
-        void deliver(cfg, "budget.threshold", { busEvent: eventName, detail: payload }, api.log);
+        void deliver("budget.threshold", { busEvent: eventName, detail: payload });
       });
       state22.eventUnsubscribers.push(off);
     }
@@ -8243,26 +8428,23 @@ var plugin25 = {
       mutating: true,
       async execute(input) {
         if (!cfg.enabled) return { ok: false, error: "notify-hub is disabled" };
-        if (!cfg.webhookUrl) {
+        const ch = state22.channel;
+        if (!ch) {
           return {
             ok: false,
             error: 'no webhookUrl configured \u2014 set config.extensions["notify-hub"].webhookUrl to enable deliveries'
           };
         }
-        const delivered = await deliver(
-          cfg,
-          "manual",
-          {
-            title: truncateText(String(input.title ?? "WrongStack notification"), 200),
-            message: truncateText(String(input.message ?? ""), 2e3),
-            level: input.level === "warning" || input.level === "critical" ? input.level : "info"
-          },
-          api.log
-        );
+        const result = await deliverViaChannel(ch, "manual", {
+          title: truncateText(String(input.title ?? "WrongStack notification"), 200),
+          body: truncateText(String(input.message ?? ""), 2e3),
+          level: input.level === "warning" || input.level === "critical" ? input.level : "info",
+          source: "manual"
+        });
         return {
-          ok: delivered,
-          circuitOpen: state22.circuitOpen,
-          ...delivered ? {} : { error: "delivery failed (see notify_hub_status)" }
+          ok: result.ok,
+          circuitOpen: ch.circuitStatus().open,
+          ...result.ok ? {} : { error: result.error ?? "delivery failed" }
         };
       }
     });
@@ -8274,18 +8456,26 @@ var plugin25 = {
       category: "Diagnostics",
       mutating: false,
       async execute() {
+        const ch = state22.channel;
+        const counters = ch?.counters() ?? {
+          attempted: 0,
+          delivered: 0,
+          failed: 0,
+          suppressed: 0
+        };
         return {
           ok: true,
           enabled: cfg.enabled,
           webhookConfigured: cfg.webhookUrl.length > 0,
           events: cfg.events,
           timeoutMs: cfg.timeoutMs,
-          circuitOpen: state22.circuitOpen,
+          circuitOpen: ch?.circuitStatus().open ?? false,
           counters: {
-            sent: state22.sent,
-            failed: state22.failed,
-            suppressed: state22.suppressed,
-            consecutiveFailures: state22.consecutiveFailures
+            sent: counters.delivered,
+            failed: counters.failed,
+            suppressed: counters.suppressed,
+            consecutiveFailures: ch?.circuitStatus().consecutiveFailures ?? 0,
+            totalAttempted: counters.attempted
           },
           lastDelivery: state22.lastDelivery
         };
@@ -8299,6 +8489,8 @@ var plugin25 = {
     });
   },
   teardown(api) {
+    _pluginLog = null;
+    state22.circuitWarned = false;
     if (state22.stopHookUnregister) {
       try {
         state22.stopHookUnregister();
@@ -8313,25 +8505,22 @@ var plugin25 = {
       }
     }
     state22.eventUnsubscribers = [];
-    const final = { sent: state22.sent, failed: state22.failed, suppressed: state22.suppressed };
-    state22.sent = 0;
-    state22.failed = 0;
-    state22.suppressed = 0;
-    state22.consecutiveFailures = 0;
-    state22.circuitOpen = false;
+    const channelCounters = state22.channel?.counters();
+    state22.channel = null;
     state22.lastDelivery = null;
-    api.log.info("notify-hub: teardown complete", { final });
+    api.log.info("notify-hub: teardown complete", { channelCounters });
   },
   async health() {
+    const ch = state22.channel;
+    const cs = ch?.circuitStatus();
+    const channelCounters = ch?.counters();
+    const sent = channelCounters?.delivered ?? 0;
+    const failed = channelCounters?.failed ?? 0;
+    const suppressed = channelCounters?.suppressed ?? 0;
     return {
-      ok: !state22.circuitOpen,
-      message: state22.circuitOpen ? `notify-hub: circuit OPEN after ${state22.consecutiveFailures} consecutive failures \u2014 deliveries suppressed` : `notify-hub: ${state22.sent} sent, ${state22.failed} failed, ${state22.suppressed} suppressed`,
-      counters: {
-        sent: state22.sent,
-        failed: state22.failed,
-        suppressed: state22.suppressed,
-        consecutiveFailures: state22.consecutiveFailures
-      }
+      ok: !cs?.open,
+      message: cs?.open ? `notify-hub: circuit OPEN after ${cs.consecutiveFailures} consecutive failures \u2014 deliveries suppressed` : ch ? `notify-hub: ${sent} sent, ${failed} failed, ${suppressed} suppressed` : `notify-hub: idle \u2014 no webhook channel configured`,
+      counters: { sent, failed, suppressed, consecutiveFailures: cs?.consecutiveFailures ?? 0 }
     };
   }
 };
@@ -8862,7 +9051,7 @@ function readConfig23(raw) {
 var plugin_stack_observer_default = PLUGIN;
 
 // src/pr-drafter/index.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync2 } from "node:child_process";
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import { dirname as dirname5, isAbsolute as isAbsolute10, relative as relative9, resolve as resolve9 } from "node:path";
 var API_VERSION13 = "^0.1.10";
@@ -8911,7 +9100,7 @@ function resolveProjectPath6(rawPath, cwd = process.cwd()) {
 }
 function gitBranch() {
   try {
-    const out = execFileSync4("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    const out = execFileSync2("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
       encoding: "utf-8",
       cwd: process.cwd(),
       stdio: ["pipe", "pipe", "ignore"],
@@ -8924,7 +9113,7 @@ function gitBranch() {
 }
 function gitDiff() {
   try {
-    return execFileSync4("git", ["diff", "--stat"], {
+    return execFileSync2("git", ["diff", "--stat"], {
       encoding: "utf-8",
       cwd: process.cwd(),
       stdio: ["pipe", "pipe", "ignore"],
@@ -9924,8 +10113,8 @@ var secret_scanner_default = plugin30;
 // src/semver-bump/index.ts
 import { expectDefined as expectDefined2 } from "@wrongstack/core";
 import { toErrorMessage } from "@wrongstack/core/utils";
-import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync7, readdirSync as readdirSync2, writeFileSync as writeFileSync6 } from "node:fs";
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync7, readdirSync as readdirSync2, writeFileSync as writeFileSync6 } from "node:fs";
 import { isAbsolute as isAbsolute11, join as join3, relative as relative10, resolve as resolve10 } from "node:path";
 var API_VERSION14 = "^0.1.10";
 function resolveProjectRoot(rawCwd, root = process.cwd()) {
@@ -9946,7 +10135,7 @@ var state29 = {
 };
 function runGit3(args, cwd) {
   try {
-    return execFileSync5("git", args, {
+    return execFileSync3("git", args, {
       encoding: "utf-8",
       cwd,
       stdio: ["pipe", "pipe", "pipe"],
@@ -9961,7 +10150,7 @@ function runGit3(args, cwd) {
 }
 function getPackageJson(cwd) {
   const path = cwd ? `${cwd}/package.json` : "package.json";
-  if (!existsSync5(path)) return null;
+  if (!existsSync4(path)) return null;
   try {
     return JSON.parse(readFileSync7(path, "utf-8"));
   } catch {
@@ -9971,14 +10160,14 @@ function getPackageJson(cwd) {
 function collectManifests(root) {
   const paths = [];
   const rootPkg = join3(root, "package.json");
-  if (existsSync5(rootPkg)) paths.push(rootPkg);
+  if (existsSync4(rootPkg)) paths.push(rootPkg);
   for (const group of ["packages", "apps"]) {
     const groupDir = join3(root, group);
-    if (!existsSync5(groupDir)) continue;
+    if (!existsSync4(groupDir)) continue;
     for (const entry of readdirSync2(groupDir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       const candidate = join3(groupDir, entry.name, "package.json");
-      if (existsSync5(candidate)) paths.push(candidate);
+      if (existsSync4(candidate)) paths.push(candidate);
     }
   }
   return paths;
@@ -10170,9 +10359,9 @@ var plugin31 = {
       const root = cwd ?? process.cwd();
       const bumpScript = join3(root, "scripts", "bump-version.mjs");
       const changed = collectManifests(root);
-      if (existsSync5(bumpScript)) {
+      if (existsSync4(bumpScript)) {
         try {
-          execFileSync5(process.execPath, [bumpScript, "set", newVersion], {
+          execFileSync3(process.execPath, [bumpScript, "set", newVersion], {
             cwd: root,
             stdio: ["pipe", "pipe", "pipe"],
             timeout: 3e4,
@@ -10184,7 +10373,7 @@ var plugin31 = {
         }
         for (const rel of ["package.json", "package-lock.json", "src/lib/utils.ts", "index.html"]) {
           const p = join3(root, "website", rel);
-          if (existsSync5(p)) changed.push(p);
+          if (existsSync4(p)) changed.push(p);
         }
       } else {
         for (const manifest of changed) {
@@ -10862,8 +11051,8 @@ Tokens: ${recap.tokens.total.input} in / ${recap.tokens.total.output} out
 var session_recap_default = plugin32;
 
 // src/shell-check/index.ts
-import { execFileSync as execFileSync6, execSync as execSync2 } from "node:child_process";
-import { existsSync as existsSync6, readdirSync as readdirSync3 } from "node:fs";
+import { execFile as execFile7 } from "node:child_process";
+import { readdir } from "node:fs/promises";
 import { isAbsolute as isAbsolute12, join as join4, relative as relative11, resolve as resolve11 } from "node:path";
 var API_VERSION15 = "^0.1.10";
 function withinProject3(p) {
@@ -10884,15 +11073,23 @@ var state31 = {
   /** Most recent run summary, surfaced by health(). */
   lastRun: null
 };
-function runShellCheck(files, severity, cwd) {
-  if (!existsSync6("shellcheck")) {
-    try {
-      execSync2("shellcheck --version", { encoding: "utf-8", stdio: "ignore", windowsHide: true });
-    } catch {
-      throw new Error(
-        "shellcheck is not installed. Install via: apt install shellcheck / brew install shellcheck"
+async function runShellCheck(files, severity, cwd) {
+  try {
+    await new Promise((resolvePromise, rejectPromise) => {
+      execFile7(
+        "shellcheck",
+        ["--version"],
+        { encoding: "utf-8", windowsHide: true },
+        (err) => {
+          if (err) rejectPromise(err);
+          else resolvePromise();
+        }
       );
-    }
+    });
+  } catch {
+    throw new Error(
+      "shellcheck is not installed. Install via: apt install shellcheck / brew install shellcheck"
+    );
   }
   const levelMap = {
     error: "error",
@@ -10904,20 +11101,34 @@ function runShellCheck(files, severity, cwd) {
   const args = ["-f", "json", "-S", severityFlag, ...files];
   let raw;
   try {
-    raw = execFileSync6("shellcheck", args, {
-      encoding: "utf-8",
-      cwd,
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 6e4,
-      windowsHide: true
+    raw = await new Promise((resolvePromise, rejectPromise) => {
+      execFile7(
+        "shellcheck",
+        args,
+        {
+          encoding: "utf-8",
+          cwd,
+          windowsHide: true,
+          timeout: 6e4,
+          maxBuffer: 16 * 1024 * 1024
+        },
+        (err, stdout, stderr) => {
+          if (err) {
+            const e = err;
+            const diagnostic = stdout || e.stdout?.toString() || stderr || e.stderr?.toString() || "";
+            if (diagnostic.trim()) {
+              resolvePromise(diagnostic);
+              return;
+            }
+            rejectPromise(err);
+            return;
+          }
+          resolvePromise(stdout);
+        }
+      );
     });
-  } catch (err) {
-    const e = err;
-    if (e.stderr && !e.stderr.includes("shellcheck")) {
-      raw = e.stderr;
-    } else {
-      return [];
-    }
+  } catch {
+    return [];
   }
   if (!raw.trim()) return [];
   try {
@@ -10934,21 +11145,23 @@ function runShellCheck(files, severity, cwd) {
     return [];
   }
 }
-function findShellFiles(dir, pattern) {
+async function findShellFiles(dir, pattern) {
   const results = [];
+  let entries;
   try {
-    const entries = readdirSync3(dir, { withFileTypes: true });
-    for (const entry of entries) {
-      const full = join4(dir, entry.name);
-      if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== ".git") {
-        results.push(...findShellFiles(full, pattern));
-      } else if (entry.isFile() && (entry.name.endsWith(".sh") || entry.name === "Dockerfile")) {
-        if (!pattern || entry.name.includes(pattern)) {
-          results.push(full);
-        }
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return results;
+  }
+  for (const entry of entries) {
+    const full = join4(dir, entry.name);
+    if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== ".git") {
+      results.push(...await findShellFiles(full, pattern));
+    } else if (entry.isFile() && (entry.name.endsWith(".sh") || entry.name === "Dockerfile")) {
+      if (!pattern || entry.name.includes(pattern)) {
+        results.push(full);
       }
     }
-  } catch {
   }
   return results;
 }
@@ -11049,7 +11262,7 @@ var plugin33 = {
         if (files && files.length > 0) {
           checkFiles = files;
         } else {
-          checkFiles = findShellFiles(directory, pattern);
+          checkFiles = await findShellFiles(directory, pattern);
           scannedDirectories = true;
         }
         if (checkFiles.length === 0) {
@@ -11070,7 +11283,7 @@ var plugin33 = {
         }
         let issues;
         try {
-          issues = runShellCheck(checkFiles, severity);
+          issues = await runShellCheck(checkFiles, severity);
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           return { ok: false, error: msg, issues: [], filesScanned: 0 };
@@ -11709,8 +11922,8 @@ var plugin35 = {
 var test_coverage_gate_default = plugin35;
 
 // src/test-runner-gate/index.ts
-import { execFile as execFile5 } from "node:child_process";
-import { access } from "node:fs/promises";
+import { execFile as execFile8 } from "node:child_process";
+import { access as access2 } from "node:fs/promises";
 import { basename as basename3, dirname as dirname6, isAbsolute as isAbsolute15, join as join5 } from "node:path";
 var API_VERSION18 = "^0.1.10";
 var state33 = {
@@ -11813,7 +12026,7 @@ async function findTestFile(sourcePath, patterns) {
   const candidates = resolveTestFiles(sourcePath, patterns);
   for (const candidate of candidates) {
     try {
-      await access(candidate);
+      await access2(candidate);
       return candidate;
     } catch {
     }
@@ -11831,7 +12044,7 @@ async function detectRunner(requested) {
     if (!match) return null;
     try {
       await new Promise((resolve28, reject) => {
-        execFile5("npx", [`${match.name}`, "--version"], {
+        execFile8("npx", [`${match.name}`, "--version"], {
           encoding: "utf-8",
           timeout: 5e3,
           cwd: process.cwd()
@@ -11845,7 +12058,7 @@ async function detectRunner(requested) {
   for (const candidate of candidates) {
     try {
       await new Promise((resolve28, reject) => {
-        execFile5("npx", [`${candidate.name}`, "--version"], {
+        execFile8("npx", [`${candidate.name}`, "--version"], {
           encoding: "utf-8",
           timeout: 5e3,
           cwd: process.cwd()
@@ -11896,7 +12109,7 @@ async function runTests(testFile, runner, customCommand, timeoutMs) {
   try {
     const { stdout: out } = await new Promise(
       (resolve28, reject) => {
-        execFile5(
+        execFile8(
           cmd,
           fullArgs,
           { encoding: "utf-8", timeout: timeoutMs, cwd: process.cwd() },
@@ -12198,8 +12411,7 @@ Fix the failing tests or revert the change if it broke something.`
 var test_runner_gate_default = plugin36;
 
 // src/type-gate/index.ts
-import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
 var API_VERSION19 = "^0.1.10";
 var state34 = {
   invocationCount: 0,
@@ -12253,7 +12465,7 @@ function validateTsConfigPath(p) {
   const sanitized = sanitizeRunnerPath(p);
   return sanitized;
 }
-function runTypeCheck(cfg) {
+async function runTypeCheck(cfg) {
   const start = Date.now();
   const rawTsConfig = cfg.tsConfigPath;
   const validTsConfig = rawTsConfig && rawTsConfig !== "tsconfig.json" ? validateTsConfigPath(rawTsConfig) : null;
@@ -12267,32 +12479,22 @@ function runTypeCheck(cfg) {
     if (!resolved) return null;
     argv = [resolved.cmd, ...resolved.args];
   } else {
-    argv = ["npx", "tsc", "--noEmit"];
+    argv = ["npx", "tsc", "--noEmit", "--incremental"];
     if (tsConfig && tsConfig !== "tsconfig.json") {
       argv = [...argv, "-p", tsConfig];
     }
   }
-  if (!cfg.command && tsConfig && !existsSync7(tsConfig)) {
+  if (!cfg.command && tsConfig && !existsSync5(tsConfig)) {
     return null;
   }
-  let stdout = "";
-  let stderr = "";
-  try {
-    const out = execFileSync7(argv[0], argv.slice(1), {
-      encoding: "utf-8",
-      timeout: cfg.timeoutMs,
-      cwd: process.cwd(),
-      stdio: ["pipe", "pipe", "pipe"],
-      shell: false
-    });
-    stdout = out;
-  } catch (err) {
-    const e = err;
-    if (e.killed) return null;
-    stdout = e.stdout ?? "";
-    stderr = e.stderr ?? "";
-  }
-  void runRunnerCommand;
+  const result = await runRunnerCommand([argv[0], ...argv.slice(1)], {
+    cwd: process.cwd(),
+    timeoutMs: cfg.timeoutMs
+  });
+  if (result.timedOut) return null;
+  if (result.spawnError) return null;
+  const stdout = result.stdout;
+  const stderr = result.stderr;
   const combined = `${stdout}
 ${stderr}`.trim();
   const durationMs = Date.now() - start;
@@ -12375,7 +12577,7 @@ var plugin37 = {
     state34.lastResult = null;
     state34.hookUnregister = null;
     const cfg = readConfig30(api.config.extensions?.["type-gate"]);
-    const hook = (input) => {
+    const hook = async (input) => {
       if (!cfg.enabled) return;
       if (input.toolResult?.isError) return;
       const inp = input.toolInput ?? {};
@@ -12388,7 +12590,7 @@ var plugin37 = {
         return;
       }
       state34.invocationCount += 1;
-      const result = runTypeCheck(cfg);
+      const result = await runTypeCheck(cfg);
       if (!result) {
         state34.errorCount += 1;
         return;
@@ -13968,8 +14170,8 @@ var plugin42 = {
 var accessibility_auditor_default = plugin42;
 
 // src/api-compatibility-gate/index.ts
-import { execFileSync as execFileSync8 } from "node:child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync10 } from "node:fs";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync10 } from "node:fs";
 import { basename as basename4, dirname as dirname7, extname as extname2, isAbsolute as isAbsolute17, relative as relative14, resolve as resolve14 } from "node:path";
 var API_VERSION22 = "^0.1.10";
 var state40 = {
@@ -14050,7 +14252,7 @@ function isPackageEntryPoint(filePath) {
   const resolved = resolveToProjectRoot(filePath);
   const dir = dirname7(resolved);
   const pkgPath = resolve14(dir, "package.json");
-  if (!existsSync8(pkgPath)) return false;
+  if (!existsSync6(pkgPath)) return false;
   try {
     const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
     const entries = [];
@@ -14125,7 +14327,7 @@ function readGitVersion(filePath) {
   const resolved = resolveToProjectRoot(filePath);
   const relPath = normalizePath2(relative14(process.cwd(), resolved));
   try {
-    const out = execFileSync8("git", ["show", `HEAD:${relPath}`], {
+    const out = execFileSync4("git", ["show", `HEAD:${relPath}`], {
       encoding: "utf-8",
       cwd: process.cwd(),
       stdio: ["pipe", "pipe", "pipe"]
@@ -14930,7 +15132,7 @@ var plugin45 = {
 var code_metrics_default = plugin45;
 
 // src/dead-code-detector/index.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync13, statSync as statSync6 } from "node:fs";
+import { readdirSync as readdirSync3, readFileSync as readFileSync13, statSync as statSync5 } from "node:fs";
 import { extname as extname3, join as join6, relative as relative16, resolve as resolve16 } from "node:path";
 var API_VERSION25 = "^0.1.10";
 var state43 = {
@@ -14965,7 +15167,7 @@ function gatherFiles(root, depth, cfg) {
   function walk(dir, remaining) {
     let entries;
     try {
-      entries = readdirSync4(dir, { withFileTypes: true });
+      entries = readdirSync3(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -15068,7 +15270,7 @@ function scan(root, depth, cfg) {
 function resolveScanRoot(rawPath) {
   const resolved = resolve16(process.cwd(), rawPath);
   try {
-    const stats = statSync6(resolved);
+    const stats = statSync5(resolved);
     if (!stats.isDirectory()) {
       return resolve16(resolved, "..");
     }
@@ -15271,8 +15473,8 @@ Consider removing the export if it is not part of the public API.`;
 var dead_code_detector_default = plugin46;
 
 // src/dependency-vulnerability-gate/index.ts
-import { execFileSync as execFileSync9 } from "node:child_process";
-import { existsSync as existsSync9 } from "node:fs";
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { existsSync as existsSync7 } from "node:fs";
 var API_VERSION26 = "^0.1.10";
 var state44 = {
   invocations: 0,
@@ -15385,14 +15587,14 @@ function isInstallCommand(input) {
   return INSTALL_RE2.test(command);
 }
 function detectManager() {
-  return existsSync9("pnpm-lock.yaml") ? "pnpm" : "npm";
+  return existsSync7("pnpm-lock.yaml") ? "pnpm" : "npm";
 }
 function runAudit(cfg) {
   const manager = detectManager();
   const start = Date.now();
   let stdout = "";
   try {
-    stdout = execFileSync9(manager, ["audit", "--json"], {
+    stdout = execFileSync5(manager, ["audit", "--json"], {
       encoding: "utf-8",
       timeout: cfg.timeoutMs,
       cwd: process.cwd(),
@@ -15788,7 +15990,7 @@ Consider mentioning these changes in the documentation.`;
 var doc_sync_guard_default = plugin48;
 
 // src/duplicate-code-detector/index.ts
-import { readFileSync as readFileSync14 } from "node:fs";
+import { readFileSync as readFileSync14, statSync as statSync6 } from "node:fs";
 import { isAbsolute as isAbsolute19, relative as relative17, resolve as resolve17 } from "node:path";
 var API_VERSION28 = "^0.1.10";
 var state46 = {
@@ -15798,7 +16000,8 @@ var state46 = {
   warningCount: 0,
   errorCount: 0,
   hookUnregister: null,
-  lastHookWarning: /* @__PURE__ */ new Map()
+  lastHookWarning: /* @__PURE__ */ new Map(),
+  fileIndex: /* @__PURE__ */ new Map()
 };
 var DEFAULTS38 = {
   enabled: false,
@@ -15946,6 +16149,7 @@ var plugin49 = {
     state46.warningCount = 0;
     state46.errorCount = 0;
     state46.lastHookWarning.clear();
+    state46.fileIndex.clear();
     if (state46.hookUnregister) {
       try {
         state46.hookUnregister();
@@ -15954,6 +16158,27 @@ var plugin49 = {
       state46.hookUnregister = null;
     }
     const cfg = readConfig41(api.config.extensions?.["duplicate-code-detector"]);
+    function readCachedWindows(filePath, minLines) {
+      let st;
+      try {
+        st = statSync6(filePath);
+      } catch {
+        return null;
+      }
+      const cached = state46.fileIndex.get(filePath);
+      if (cached && cached.mtimeMs === st.mtimeMs && cached.size === st.size) {
+        return cached.windows;
+      }
+      let content;
+      try {
+        content = readFileSync14(filePath, "utf-8");
+      } catch {
+        return null;
+      }
+      const windows = extractWindows(filePath, content, minLines);
+      state46.fileIndex.set(filePath, { mtimeMs: st.mtimeMs, size: st.size, windows });
+      return windows;
+    }
     const hook = (input) => {
       if (!cfg.enabled) return;
       if (input.toolResult?.isError) return;
@@ -15968,33 +16193,27 @@ var plugin49 = {
       const lastWarning = state46.lastHookWarning.get(sourcePath);
       if (lastWarning !== void 0 && now - lastWarning < 6e4) return;
       const changedFile = resolve17(process.cwd(), sourcePath);
-      let content;
-      try {
-        content = readFileSync14(changedFile, "utf-8");
-      } catch {
+      const changedWindows = readCachedWindows(changedFile, cfg.minLines);
+      if (changedWindows === null) {
         state46.errorCount += 1;
         return;
       }
-      const changedWindows = extractWindows(changedFile, content, cfg.minLines);
       if (changedWindows.length === 0) return;
       const projectRoot = resolve17(process.cwd());
-      let otherFiles;
+      let otherFilePaths;
       try {
-        const filePaths = collectSourceFiles(projectRoot, { extensions: cfg.extensions, excludeDirs: cfg.excludeDirs }).filter((p) => p !== changedFile);
-        otherFiles = /* @__PURE__ */ new Map();
-        for (const p of filePaths) {
-          try {
-            otherFiles.set(p, readFileSync14(p, "utf-8"));
-          } catch {
-          }
-        }
+        otherFilePaths = collectSourceFiles(projectRoot, {
+          extensions: cfg.extensions,
+          excludeDirs: cfg.excludeDirs
+        }).filter((p) => p !== changedFile);
       } catch {
         state46.errorCount += 1;
         return;
       }
       const existingWindows = [];
-      for (const [p, c] of otherFiles.entries()) {
-        existingWindows.push(...extractWindows(p, c, cfg.minLines));
+      for (const p of otherFilePaths) {
+        const w = readCachedWindows(p, cfg.minLines);
+        if (w !== null) existingWindows.push(...w);
       }
       const hits = [];
       for (const cw of changedWindows) {
@@ -16895,7 +17114,7 @@ Allowed licenses: ${cfg.allowedLicenses.join(", ")}
 var license_audit_gate_default = plugin52;
 
 // src/migration-planner/index.ts
-import { existsSync as existsSync10, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync18 } from "node:fs";
 var API_VERSION32 = "^0.1.10";
 var state50 = {
   plansGenerated: 0,
@@ -16933,7 +17152,7 @@ function readChangelog(packageName, cfg) {
   candidates.push(`node_modules/${packageName}/changelog.md`);
   for (const candidate of candidates) {
     if (!withinProject(candidate)) continue;
-    if (existsSync10(candidate)) {
+    if (existsSync8(candidate)) {
       try {
         const content = readFileSync18(candidate, "utf-8");
         return { source: candidate, content: content.slice(0, cfg.maxChars) };
@@ -17357,7 +17576,7 @@ var plugin53 = {
 var migration_planner_default = plugin53;
 
 // src/performance-regression-gate/index.ts
-import { existsSync as existsSync11, readFileSync as readFileSync19 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync19 } from "node:fs";
 import { isAbsolute as isAbsolute22, relative as relative20, resolve as resolve21 } from "node:path";
 var API_VERSION33 = "^0.1.10";
 var state51 = {
@@ -17423,7 +17642,7 @@ function flattenResults(results) {
   return flat;
 }
 function loadResults(path) {
-  if (!path || !existsSync11(path)) return null;
+  if (!path || !existsSync9(path)) return null;
   try {
     const raw = JSON.parse(readFileSync19(path, "utf-8"));
     return raw;
@@ -18001,7 +18220,7 @@ var plugin55 = {
 var refactor_suggester_default = plugin55;
 
 // src/release-notes-generator/index.ts
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 var API_VERSION35 = "^0.1.10";
 var state53 = {
   generateCount: 0,
@@ -18060,7 +18279,7 @@ function resolveFromRef(defaultFrom, inputFrom) {
   if (inputFrom) return inputFrom;
   if (defaultFrom === "latest-tag") {
     try {
-      return execFileSync10("git", ["describe", "--tags", "--abbrev=0"], GIT_OPTIONS).trim();
+      return execFileSync6("git", ["describe", "--tags", "--abbrev=0"], GIT_OPTIONS).trim();
     } catch {
       return "";
     }
@@ -18068,7 +18287,7 @@ function resolveFromRef(defaultFrom, inputFrom) {
   return defaultFrom;
 }
 function resolveCommit(ref) {
-  const resolved = execFileSync10(
+  const resolved = execFileSync6(
     "git",
     ["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`],
     GIT_OPTIONS
@@ -18081,7 +18300,7 @@ function resolveCommit(ref) {
 function getCommits(from, to) {
   const toCommit = resolveCommit(to);
   const range = from ? `${resolveCommit(from)}..${toCommit}` : toCommit;
-  const output = execFileSync10(
+  const output = execFileSync6(
     "git",
     ["log", "--pretty=format:%H%x09%s", "--end-of-options", range],
     GIT_OPTIONS
@@ -18634,7 +18853,7 @@ ${body}${suffix}`;
 var schema_evolution_guard_default = plugin57;
 
 // src/security-hotspot-scanner/index.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync22, statSync as statSync7 } from "node:fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync22, statSync as statSync7 } from "node:fs";
 import { isAbsolute as isAbsolute24, relative as relative22, resolve as resolve23 } from "node:path";
 var API_VERSION37 = "^0.1.10";
 var state55 = {
@@ -18750,7 +18969,7 @@ function scanPath5(inputPath, cfg) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = readdirSync5(dir);
+      entries = readdirSync4(dir);
     } catch {
       return;
     }
@@ -19699,7 +19918,7 @@ var plugin60 = {
 var smart_rename_default = plugin60;
 
 // src/test-flake-detector/index.ts
-import { execFileSync as execFileSync11 } from "node:child_process";
+import { execFileSync as execFileSync7 } from "node:child_process";
 import { readFileSync as readFileSync24 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { dirname as dirname8, isAbsolute as isAbsolute27, relative as relative25, resolve as resolve26 } from "node:path";
@@ -19845,7 +20064,7 @@ function resolveTestCommand(baseCommand, testPattern) {
 }
 function runOnce(command, timeoutMs) {
   try {
-    const output = execFileSync11(command.cmd, command.args, {
+    const output = execFileSync7(command.cmd, command.args, {
       encoding: "utf-8",
       timeout: timeoutMs,
       cwd: process.cwd(),
@@ -20679,8 +20898,8 @@ var plugin63 = {
       state60.postInvocations += 1;
       let content;
       try {
-        const stat4 = await fs3.stat(filePath);
-        if (!stat4.isFile()) return;
+        const stat5 = await fs3.stat(filePath);
+        if (!stat5.isFile()) return;
         content = await fs3.readFile(filePath, "utf-8");
       } catch {
         state60.readErrorCount += 1;