@wrongstack/plugins 0.292.1 → 0.295.0

package/dist/checkpoint.js

@@ -1,6 +1,5 @@
 // src/checkpoint/index.ts
-import { mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { readFile, stat } from "node:fs/promises";
+import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 var state = {
   snapshots: [],
@@ -41,11 +40,11 @@ function hashContent(s) {
   }
   return h >>> 0;
 }
-function captureFile(path, maxBytes) {
+async function captureFile(path, maxBytes) {
   try {
-    const st = statSync(path);
+    const st = await stat(path);
     if (st.size > maxBytes) return "too-large";
-    const content = readFileSync(path, "utf-8");
+    const content = await readFile(path, "utf-8");
     return { path, content, bytes: st.size };
   } catch {
     return { path, content: null, bytes: 0 };
@@ -188,7 +187,7 @@ var plugin = {
             rejectedOutsideProject.push(p);
             continue;
           }
-          const captured = captureFile(safePath, cfg.maxFileBytes);
+          const captured = await captureFile(safePath, cfg.maxFileBytes);
           if (captured === "too-large") {
             skipped += 1;
             state.skippedLarge += 1;
@@ -298,8 +297,8 @@ var plugin = {
             continue;
           }
           try {
-            mkdirSync(dirname(f.path), { recursive: true });
-            writeFileSync(f.path, f.content);
+            await mkdir(dirname(f.path), { recursive: true });
+            await writeFile(f.path, f.content);
             restored.push(f.path);
           } catch (err) {
             errors.push({ path: f.path, error: err instanceof Error ? err.message : String(err) });

package/dist/code-metrics/index.d.ts

@@ -23,7 +23,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/code-metrics/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/code-metrics/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA0M/C,QAAA,MAAM,MAAM,EAAE,MAgMb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/code-metrics/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA6MrD,QAAA,MAAM,MAAM,EAAE,MAgMb,CAAC;eAEa,MAAM"}

package/dist/code-metrics.js

@@ -1,9 +1,8 @@
 // src/code-metrics/index.ts
-import { readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
 import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
 
 // src/runtime/index.ts
-import { existsSync, readdirSync, statSync } from "node:fs";
 import { basename, extname, isAbsolute, relative, resolve } from "node:path";
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {
@@ -17,44 +16,45 @@ function withinProjectPath(projectRoot, candidate) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
 }
 function withinProject(p) {
-  return withinProjectPath(process.cwd(), p) || relative(process.cwd(), p) === ".";
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative(cwd, p) === ".";
 }
 var DEFAULT_EXCLUDE_DIRS = ["node_modules", "dist", ".git", "coverage"];
-function collectSourceFiles(root, opts) {
+async function collectSourceFilesAsync(root, opts) {
+  const { readdir, stat } = await import("node:fs/promises");
   const files = [];
-  if (!existsSync(root)) return files;
-  const s = statSync(root);
-  if (s.isFile()) {
-    if (matchesExtension(root, opts.extensions)) files.push(root);
+  try {
+    const s = await stat(root);
+    if (s.isFile()) {
+      if (matchesExtension(root, opts.extensions)) files.push(root);
+      return files;
+    }
+    if (!s.isDirectory()) return files;
+  } catch {
     return files;
   }
-  if (!s.isDirectory()) return files;
   const exclude = opts.excludeDirs ?? DEFAULT_EXCLUDE_DIRS;
-  function walk(dir, depth) {
+  const excludeSet = new Set(exclude);
+  async function walk(dir, depth) {
     if (opts.maxDepth !== void 0 && depth > opts.maxDepth) return;
     let entries;
     try {
-      entries = readdirSync(dir);
+      entries = await readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      if (exclude.includes(entry)) continue;
-      const full = resolve(dir, entry);
-      let st;
-      try {
-        st = statSync(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        walk(full, depth + 1);
-      } else if (st.isFile() && matchesExtension(full, opts.extensions)) {
+      if (excludeSet.has(entry.name)) continue;
+      const full = resolve(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full, depth + 1);
+      } else if (entry.isFile() && matchesExtension(full, opts.extensions)) {
         files.push(full);
       }
     }
   }
-  walk(root, 0);
+  await walk(root, 0);
   return files;
 }
 function matchesExtension(p, exts) {
@@ -166,16 +166,16 @@ function analyzeFile(filePath, content) {
     complexity: countComplexity(content)
   };
 }
-function measurePath(rawPath, cfg) {
+async function measurePath(rawPath, cfg) {
   const root = process.cwd();
   const resolved = isAbsolute2(rawPath) ? resolve2(rawPath) : resolve2(root, rawPath);
   const exts = normalizeExtensions(cfg.extensions);
-  const allFiles = collectSourceFiles(resolved, { extensions: exts });
+  const allFiles = await collectSourceFilesAsync(resolved, { extensions: exts });
   const files = allFiles.slice(0, cfg.maxFiles);
   const metrics = [];
   for (const p of files) {
     try {
-      const content = readFileSync(p, "utf-8");
+      const content = await readFile(p, "utf-8");
       metrics.push(analyzeFile(p, content));
     } catch {
     }
@@ -221,7 +221,7 @@ var plugin = {
       state.hookUnregister = null;
     }
     const cfg = readConfig(api.config.extensions?.["code-metrics"]);
-    const hook = (input) => {
+    const hook = async (input) => {
       if (!cfg.enabled) return;
       if (input.toolResult?.isError) return;
       const inp = input.toolInput ?? {};
@@ -234,7 +234,7 @@ var plugin = {
       const resolved = resolve2(process.cwd(), sourcePath);
       let content;
       try {
-        content = readFileSync(resolved, "utf-8");
+        content = await readFile(resolved, "utf-8");
       } catch {
         state.errorCount += 1;
         return;
@@ -267,7 +267,7 @@ var plugin = {
         state.measureCount += 1;
         let result;
         try {
-          result = measurePath(rawPath, cfg);
+          result = await measurePath(rawPath, cfg);
         } catch (err) {
           state.errorCount += 1;
           return { ok: false, error: String(err) };

package/dist/commit-validator/index.d.ts

@@ -25,7 +25,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/commit-validator/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/commit-validator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAsP/C,QAAA,MAAM,MAAM,EAAE,MAgSb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/commit-validator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAsPrD,QAAA,MAAM,MAAM,EAAE,MAgSb,CAAC;eAEa,MAAM"}

package/dist/config-validator/index.d.ts

@@ -36,7 +36,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 export declare function validateJson(text: string, isJsonc: boolean, fileName: string): string[];
 export declare function validateYaml(text: string): string[];
 export declare function validateToml(text: string): string[];

package/dist/config-validator/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config-validator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA0H/C,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CA2CvF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuDnD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuCnD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAOjE;AAMD,QAAA,MAAM,MAAM,EAAE,MAqJb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config-validator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA0HrD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CA2CvF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuDnD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuCnD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAOjE;AAMD,QAAA,MAAM,MAAM,EAAE,MAqJb,CAAC;eAEa,MAAM"}

package/dist/context-pins/index.d.ts

@@ -31,7 +31,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 export interface Pin {
     id: string;
     label: string | null;

package/dist/context-pins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/context-pins/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM/C,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AA8GD,QAAA,MAAM,MAAM,EAAE,MA8Mb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/context-pins/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAMrD,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AA8GD,QAAA,MAAM,MAAM,EAAE,MA8Mb,CAAC;eAEa,MAAM"}

package/dist/cost-tracker/index.d.ts

@@ -30,7 +30,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 /**
  * Per-model pricing in USD per 1 million tokens.
  *

package/dist/cost-tracker/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cost-tracker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAK/C;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB;AAyKD,QAAA,MAAM,MAAM,EAAE,MA8Zb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cost-tracker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAKrD;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB;AAoLD,QAAA,MAAM,MAAM,EAAE,MAoab,CAAC;eAEa,MAAM"}

package/dist/cost-tracker.js

@@ -1,5 +1,5 @@
 // src/cost-tracker/index.ts
-import { expectDefined } from "@wrongstack/core";
+import { expectDefined } from "@wrongstack/core/utils";
 var API_VERSION = "^0.1.10";
 var PRICING = {
   "gpt-4o": { input: 5, output: 15 },
@@ -28,8 +28,13 @@ function readCostTrackerConfig(raw) {
     mailboxDigestTo: typeof digestTo === "string" && digestTo.length > 0 ? digestTo : "cost-tracker"
   };
 }
+var modelKeyCache = /* @__PURE__ */ new Map();
 function estimateCost(model, promptTokens, completionTokens) {
-  const key = model.toLowerCase();
+  let key = modelKeyCache.get(model);
+  if (!key) {
+    key = model.toLowerCase();
+    modelKeyCache.set(model, key);
+  }
   const pricing = pricingOverrides[key] ?? bundledFromRegistry[key] ?? PRICING[key] ?? DEFAULT_PRICING;
   const inputCost = promptTokens / 1e6 * pricing.input;
   const outputCost = completionTokens / 1e6 * pricing.output;
@@ -86,6 +91,7 @@ var plugin = {
     for (const k of Object.keys(bundledFromRegistry)) {
       delete bundledFromRegistry[k];
     }
+    modelKeyCache.clear();
     lastCost.usd = 0;
     lastCost.model = null;
     lastCost.at = null;
@@ -331,6 +337,7 @@ by model: ${top || "(none)"}`
     for (const k of Object.keys(bundledFromRegistry)) {
       delete bundledFromRegistry[k];
     }
+    modelKeyCache.clear();
     const finalLast = { ...lastCost };
     lastCost.usd = 0;
     lastCost.model = null;

package/dist/cron/index.d.ts

@@ -6,7 +6,7 @@
  * - cron_list: List all scheduled jobs
  * - cron_cancel: Cancel a scheduled job
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/cron/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cron/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA+F/C,QAAA,MAAM,MAAM,EAAE,MAqRb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cron/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA+FrD,QAAA,MAAM,MAAM,EAAE,MAqRb,CAAC;eAEa,MAAM"}

package/dist/dead-code-detector/index.d.ts

@@ -26,7 +26,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/dead-code-detector/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dead-code-detector/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAiQ/C,QAAA,MAAM,MAAM,EAAE,MAkOb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dead-code-detector/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAiSrD,QAAA,MAAM,MAAM,EAAE,MAkOb,CAAC;eAEa,MAAM"}

package/dist/dead-code-detector.js

@@ -1,5 +1,5 @@
 // src/dead-code-detector/index.ts
-import { readdirSync, readFileSync, statSync } from "node:fs";
+import { readdir, readFile, stat } from "node:fs/promises";
 import { extname as extname2, join, relative as relative2, resolve as resolve2 } from "node:path";
 
 // src/runtime/index.ts
@@ -16,7 +16,8 @@ function withinProjectPath(projectRoot, candidate) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
 }
 function withinProject(p) {
-  return withinProjectPath(process.cwd(), p) || relative(process.cwd(), p) === ".";
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative(cwd, p) === ".";
 }
 
 // src/dead-code-detector/index.ts
@@ -48,19 +49,21 @@ function readConfig(raw) {
     excludeDirs: Array.isArray(r["excludeDirs"]) ? r["excludeDirs"].filter((x) => typeof x === "string") : DEFAULTS.excludeDirs
   };
 }
-function gatherFiles(root, depth, cfg) {
+async function gatherFiles(root, depth, cfg) {
   const files = [];
-  function walk(dir, remaining) {
+  const excludeSet = new Set(cfg.excludeDirs);
+  async function walk(dir, remaining) {
     let entries;
     try {
-      entries = readdirSync(dir, { withFileTypes: true });
+      entries = await readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (remaining > 0 && !cfg.excludeDirs.includes(entry.name)) {
-          walk(join(dir, entry.name), remaining - 1);
+        if (remaining > 0 && !excludeSet.has(entry.name)) {
+          await walk(join(dir, entry.name), remaining - 1);
         }
       } else if (entry.isFile()) {
         const ext = extname2(entry.name).toLowerCase();
@@ -70,7 +73,7 @@ function gatherFiles(root, depth, cfg) {
       }
     }
   }
-  walk(resolve2(root), depth);
+  await walk(resolve2(root), depth);
   return files;
 }
 function stripNoise(content) {
@@ -139,24 +142,29 @@ function findUnusedSymbols(files) {
       }
     }
   }
+  suspicious.sort((a, b) => {
+    const fileCompare = a.file.localeCompare(b.file);
+    if (fileCompare !== 0) return fileCompare;
+    return a.line - b.line;
+  });
   return suspicious;
 }
-function scan(root, depth, cfg) {
-  const filePaths = gatherFiles(root, depth, cfg);
+async function scan(root, depth, cfg) {
+  const filePaths = await gatherFiles(root, depth, cfg);
   const files = [];
   for (const p of filePaths) {
     try {
-      const content = readFileSync(p, "utf-8");
+      const content = await readFile(p, "utf-8");
       files.push({ path: p, content, stripped: stripNoise(content) });
     } catch {
     }
   }
   return { findings: findUnusedSymbols(files), scannedFiles: files.length };
 }
-function resolveScanRoot(rawPath) {
+async function resolveScanRoot(rawPath) {
   const resolved = resolve2(process.cwd(), rawPath);
   try {
-    const stats = statSync(resolved);
+    const stats = await stat(resolved);
     if (!stats.isDirectory()) {
       return resolve2(resolved, "..");
     }
@@ -221,7 +229,7 @@ var plugin = {
       state.hookUnregister = null;
     }
     const cfg = readConfig(api.config.extensions?.["dead-code-detector"]);
-    const hook = (input) => {
+    const hook = async (input) => {
       if (!cfg.enabled) return;
       if (input.toolResult?.isError) return;
       const inp = input.toolInput ?? {};
@@ -231,10 +239,10 @@ var plugin = {
       const ext = sourcePath.includes(".") ? sourcePath.slice(sourcePath.lastIndexOf(".")).toLowerCase() : "";
       if (!cfg.extensions.includes(ext)) return;
       state.hookInvocationCount += 1;
-      const scanRoot = resolveScanRoot(sourcePath);
+      const scanRoot = await resolveScanRoot(sourcePath);
       let result;
       try {
-        result = scan(scanRoot, 1, cfg);
+        result = await scan(scanRoot, 1, cfg);
       } catch {
         state.errorCount += 1;
         return;
@@ -289,10 +297,10 @@ Consider removing the export if it is not part of the public API.`;
           return { ok: false, error: "scan path is outside the project root" };
         }
         state.scanCount += 1;
-        const scanRoot = resolveScanRoot(rawPath);
+        const scanRoot = await resolveScanRoot(rawPath);
         let result;
         try {
-          result = scan(scanRoot, depth, cfg);
+          result = await scan(scanRoot, depth, cfg);
         } catch (err) {
           state.errorCount += 1;
           return { ok: false, error: String(err) };

package/dist/dep-guard/index.d.ts

@@ -35,7 +35,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 export interface ParsedInstall {
     manager: string;
     packages: Array<{

package/dist/dep-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dep-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAmF/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC3D;AAKD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAmCrE;AA0CD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAyBzD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOvD;AAMD,QAAA,MAAM,MAAM,EAAE,MAwPb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dep-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAmFrD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC3D;AAKD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAmCrE;AA0CD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAyBzD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOvD;AAMD,QAAA,MAAM,MAAM,EAAE,MAwPb,CAAC;eAEa,MAAM"}

package/dist/dependency-vulnerability-gate/index.d.ts

@@ -27,7 +27,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/dependency-vulnerability-gate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dependency-vulnerability-gate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAuO/C,QAAA,MAAM,MAAM,EAAE,MAwMb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dependency-vulnerability-gate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAqPrD,QAAA,MAAM,MAAM,EAAE,MAwMb,CAAC;eAEa,MAAM"}

package/dist/dependency-vulnerability-gate.js

@@ -1,6 +1,6 @@
 // src/dependency-vulnerability-gate/index.ts
-import { execFileSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { execFile } from "node:child_process";
+import { access } from "node:fs/promises";
 var API_VERSION = "^0.1.10";
 var state = {
   invocations: 0,
@@ -112,26 +112,38 @@ function isInstallCommand(input) {
   const command = typeof ti["command"] === "string" ? ti["command"] : "";
   return INSTALL_RE.test(command);
 }
-function detectManager() {
-  return existsSync("pnpm-lock.yaml") ? "pnpm" : "npm";
-}
-function runAudit(cfg) {
-  const manager = detectManager();
-  const start = Date.now();
-  let stdout = "";
+async function detectManager() {
   try {
-    stdout = execFileSync(manager, ["audit", "--json"], {
-      encoding: "utf-8",
-      timeout: cfg.timeoutMs,
-      cwd: process.cwd(),
-      stdio: ["pipe", "pipe", "pipe"],
-      shell: false
-    });
-  } catch (err) {
-    const e = err;
-    if (e.killed) return null;
-    stdout = e.stdout ?? "";
+    await access("pnpm-lock.yaml");
+    return "pnpm";
+  } catch {
+    return "npm";
   }
+}
+async function runAudit(cfg) {
+  const manager = await detectManager();
+  const start = Date.now();
+  const stdout = await new Promise((resolve) => {
+    execFile(
+      manager,
+      ["audit", "--json"],
+      {
+        encoding: "utf8",
+        timeout: cfg.timeoutMs,
+        cwd: process.cwd(),
+        windowsHide: true,
+        maxBuffer: 10 * 1024 * 1024
+      },
+      (error, output) => {
+        if (error && error.killed) {
+          resolve(null);
+          return;
+        }
+        resolve(output);
+      }
+    );
+  });
+  if (stdout === null) return null;
   const report = parseAuditJson(stdout);
   if (!report) return null;
   return { manager, report, durationMs: Date.now() - start };
@@ -186,14 +198,14 @@ var plugin = {
       state.hookUnregister = null;
     }
     const cfg = readConfig(api.config.extensions?.["dependency-vulnerability-gate"]);
-    const hook = (input) => {
+    const hook = async (input) => {
       if (!cfg.enabled) return;
       state.invocations += 1;
       if (input.toolResult?.isError) return;
       if (!isInstallCommand(input)) return;
       state.installsSeen += 1;
       api.metrics.counter("installs_seen");
-      const result = runAudit(cfg);
+      const result = await runAudit(cfg);
       if (!result) {
         state.errors += 1;
         return;

package/dist/diff-summary/index.d.ts

@@ -28,7 +28,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/diff-summary/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/diff-summary/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAwP/C,QAAA,MAAM,MAAM,EAAE,MA4Pb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/diff-summary/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA2PrD,QAAA,MAAM,MAAM,EAAE,MA4Pb,CAAC;eAEa,MAAM"}