@wrongstack/plugins 0.293.0 → 0.295.1

package/dist/prompt-firewall.js

@@ -1,23 +1,152 @@
+// src/runtime/credential-patterns.ts
+var CREDENTIAL_PATTERNS = [
+  // LLM provider keys
+  {
+    type: "anthropic_key",
+    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g
+  },
+  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?!ant)(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g },
+  // GitHub. `ghp_` is only the personal-access-token prefix — the OAuth
+  // (`gho_`), user-to-server (`ghu_`), server-to-server (`ghs_`) and
+  // refresh (`ghr_`) tokens grant the same or broader access and were
+  // previously not detected at all.
+  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g },
+  {
+    type: "github_oauth_token",
+    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g
+  },
+  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g },
+  // GitLab
+  { type: "gitlab_pat", regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  {
+    type: "gitlab_runner_token",
+    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  // npm — a leaked publish token is a supply-chain compromise.
+  { type: "npm_token", regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g },
+  // AWS
+  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g },
+  // GCP
+  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g },
+  // Slack. `xoxe` (token-rotation) and `xapp` (app-level) were missing;
+  // both are as sensitive as the bot/user tokens already covered.
+  {
+    type: "slack_token",
+    regex: /(?<![A-Za-z0-9-])xox[abposer]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g
+  },
+  { type: "slack_app_token", regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g },
+  {
+    type: "slack_webhook",
+    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g
+  },
+  // Stripe
+  {
+    type: "stripe_key",
+    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g
+  },
+  // Twilio
+  { type: "twilio_sid", regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g },
+  // Telegram
+  {
+    type: "telegram_bot_token",
+    regex: /(?:(?<![A-Za-z0-9_])|(?<=(?:^|[^A-Za-z0-9_])bot))\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  // JWT
+  {
+    type: "jwt",
+    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g
+  },
+  // Private keys
+  {
+    type: "private_key",
+    regex: /(?:^|\n)(?:-----BEGIN (?:RSA|EC|OPENSSH|DSA)? ?PRIVATE KEY-----[\s\S]*?-----END (?:RSA|EC|OPENSSH|DSA)? ?PRIVATE KEY-----|-----BEGIN PGP PRIVATE KEY BLOCK-----[\s\S]*?-----END PGP PRIVATE KEY BLOCK-----)(?!\S)/g
+  },
+  // AI/ML provider tokens
+  { type: "huggingface_token", regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g },
+  { type: "replicate_token", regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "perplexity_key", regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "groq_key", regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  // SaaS / infrastructure tokens — each grants API access on the user's
+  // account, and each was previously invisible to this gate.
+  { type: "sendgrid_key", regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  { type: "digitalocean_token", regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g },
+  { type: "doppler_token", regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "shopify_token", regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g },
+  { type: "docker_pat", regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  { type: "linear_key", regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "atlassian_token", regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g },
+  { type: "square_token", regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  {
+    type: "azure_storage_key",
+    regex: /AccountKey=[A-Za-z0-9+/]{80,}={0,2}/g
+  },
+  {
+    type: "google_oauth_client_secret",
+    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  // Bearer tokens
+  {
+    type: "bearer_token",
+    regex: /(?<![A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?![A-Za-z0-9._~+/-])/g
+  },
+  // Database URIs. Require password-bearing user-info; credential-free values stay scannable.
+  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
+  {
+    type: "postgres_uri",
+    // Query parsers decode percent-encoded parameter names. Recognize each
+    // encoded character in `password` so mixed forms such as `pass%77ord`
+    // cannot bypass detection while keeping the scan strictly bounded.
+    regex: /postgres(?:ql)?:\/\/(?:[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+|[^&\s?"'`#]{1,2048}\?(?:(?!(?:p|%70)(?:a|%61)(?:s|%73)(?:s|%73)(?:w|%77)(?:o|%6[fF])(?:r|%72)(?:d|%64)=)[^&\s#"'`]{1,256}&){0,32}(?:p|%70)(?:a|%61)(?:s|%73)(?:s|%73)(?:w|%77)(?:o|%6[fF])(?:r|%72)(?:d|%64)=[^&\s#"'`]{1,4096})/g
+  },
+  { type: "mysql_uri", regex: /mysql:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
+  { type: "redis_uri", regex: /redis:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g }
+];
+function cloneCredentialPatterns() {
+  return CREDENTIAL_PATTERNS.map((p) => ({
+    type: p.type,
+    regex: new RegExp(p.regex.source, p.regex.flags)
+  }));
+}
+
 // src/prompt-firewall/index.ts
-var PATTERNS = [
-  { kind: "aws-access-key", re: /\bAKIA[0-9A-Z]{16}\b/g },
+var KIND_ALIASES = {
+  aws_access_key: "aws-access-key",
+  private_key: "private-key-block",
+  github_pat: "github-token",
+  github_oauth_token: "github-token",
+  openai_key: "openai-key",
+  anthropic_key: "anthropic-key",
+  slack_token: "slack-token",
+  gcp_key: "google-api-key",
+  bearer_token: "bearer-token"
+};
+var EXTRA_PATTERNS = [
   {
+    // AWS secret access keys have no prefix — only a 40-char base64-ish
+    // shape — so they need a nearby `aws`/`secret` mention to be worth
+    // acting on.
+    //
+    // The previous spelling required the word "aws" to appear AFTER the
+    // key and wrapped the run in `\b`. Both are wrong: the real layout is
+    // `AWS_SECRET_ACCESS_KEY=<key>` (context first), and a `\b` cannot
+    // hold next to the `+` or `/` that base64 keys routinely end with. The
+    // pattern therefore never fired on a real key. Anchor on the context
+    // token instead and let the key follow it.
     kind: "aws-secret-key",
-    re: /\b(?<![A-Za-z0-9/+])[A-Za-z0-9/+]{40}(?![A-Za-z0-9/+])\b(?=.*aws)/gi
+    re: /(?:aws|amazon)[A-Za-z0-9_-]*(?:secret|key)[A-Za-z0-9_-]*\s*[:=]\s*['"]?([A-Za-z0-9/+]{40})(?![A-Za-z0-9/+])/gi
   },
-  { kind: "private-key-block", re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/g },
-  { kind: "github-token", re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
-  { kind: "openai-key", re: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g },
-  { kind: "anthropic-key", re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
-  { kind: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
-  { kind: "google-api-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
-  { kind: "jwt", re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
-  { kind: "bearer-token", re: /\bBearer\s+[A-Za-z0-9._-]{20,}\b/g },
   {
     kind: "generic-secret-assignment",
     re: /\b(?:api[_-]?key|secret|password|passwd|token)\s*[:=]\s*['"]?[A-Za-z0-9._/+-]{12,}['"]?/gi
   }
 ];
+var PATTERNS = [
+  ...cloneCredentialPatterns().map((p) => ({
+    kind: KIND_ALIASES[p.type] ?? p.type,
+    re: p.regex
+  })),
+  ...EXTRA_PATTERNS
+];
 function detectSecrets(text, allow) {
   const counts = /* @__PURE__ */ new Map();
   for (const p of PATTERNS) {

package/dist/refactor-suggester/index.d.ts

@@ -23,7 +23,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 export type SmellType = 'long-function' | 'deep-nesting' | 'many-parameters' | 'magic-number' | 'console-log';
 export interface RefactorSuggestion {
     file: string;

package/dist/refactor-suggester/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/refactor-suggester/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAS/C,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,aAAa,CAAC;AAElB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AA6ND,QAAA,MAAM,MAAM,EAAE,MA4Nb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/refactor-suggester/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AASrD,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,aAAa,CAAC;AASlB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AA8PD,QAAA,MAAM,MAAM,EAAE,MAwOb,CAAC;eAEa,MAAM"}

package/dist/refactor-suggester.js

@@ -1,10 +1,108 @@
 // src/refactor-suggester/index.ts
-import { readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
 import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
 
 // src/runtime/index.ts
-import { existsSync, readdirSync, statSync } from "node:fs";
 import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/bounded-map.ts
+var BoundedMap = class {
+  map = /* @__PURE__ */ new Map();
+  max;
+  ttlMs;
+  now;
+  /** Entries dropped to stay under `max`. Surfaced by plugin health(). */
+  evictions = 0;
+  constructor(options) {
+    const normalizedMax = Math.floor(options.max);
+    this.max = Number.isSafeInteger(normalizedMax) ? Math.max(1, normalizedMax) : 1;
+    this.ttlMs = options.ttlMs;
+    this.now = options.now ?? Date.now;
+  }
+  expired(entry) {
+    return this.ttlMs !== void 0 && this.now() - entry.storedAt > this.ttlMs;
+  }
+  get(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return void 0;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return void 0;
+    }
+    this.map.delete(key);
+    this.map.set(key, entry);
+    return entry.value;
+  }
+  /**
+   * Read without promoting the key to most-recently-used. Use for
+   * diagnostics that must not perturb the eviction order.
+   */
+  peek(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0 || this.expired(entry)) return void 0;
+    return entry.value;
+  }
+  has(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return false;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return false;
+    }
+    return true;
+  }
+  set(key, value) {
+    this.map.delete(key);
+    this.map.set(key, { value, storedAt: this.now() });
+    while (this.map.size > this.max) {
+      const coldest = this.map.keys().next().value;
+      if (coldest === void 0) break;
+      this.map.delete(coldest);
+      this.evictions += 1;
+    }
+    return this;
+  }
+  delete(key) {
+    return this.map.delete(key);
+  }
+  clear() {
+    this.map.clear();
+    this.evictions = 0;
+  }
+  get size() {
+    return this.map.size;
+  }
+  /** How many entries have been dropped to respect `max`, since the last clear. */
+  get evictionCount() {
+    return this.evictions;
+  }
+  /** Drop every expired entry. Cheap enough to call from a status tool. */
+  prune() {
+    if (this.ttlMs === void 0) return 0;
+    let removed = 0;
+    for (const [key, entry] of this.map) {
+      if (this.expired(entry)) {
+        this.map.delete(key);
+        removed += 1;
+      }
+    }
+    return removed;
+  }
+  /** Live (non-expired) entries, coldest first. */
+  *entries() {
+    for (const [key, entry] of this.map) {
+      if (!this.expired(entry)) yield [key, entry.value];
+    }
+  }
+  [Symbol.iterator]() {
+    return this.entries();
+  }
+};
+
+// src/runtime/index.ts
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {
   return arg.length > 0 && arg.startsWith("-");
@@ -17,44 +115,45 @@ function withinProjectPath(projectRoot, candidate) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
 }
 function withinProject(p) {
-  return withinProjectPath(process.cwd(), p) || relative(process.cwd(), p) === ".";
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative(cwd, p) === ".";
 }
 var DEFAULT_EXCLUDE_DIRS = ["node_modules", "dist", ".git", "coverage"];
-function collectSourceFiles(root, opts) {
+async function collectSourceFilesAsync(root, opts) {
+  const { readdir, stat } = await import("node:fs/promises");
   const files = [];
-  if (!existsSync(root)) return files;
-  const s = statSync(root);
-  if (s.isFile()) {
-    if (matchesExtension(root, opts.extensions)) files.push(root);
+  try {
+    const s = await stat(root);
+    if (s.isFile()) {
+      if (matchesExtension(root, opts.extensions)) files.push(root);
+      return files;
+    }
+    if (!s.isDirectory()) return files;
+  } catch {
     return files;
   }
-  if (!s.isDirectory()) return files;
   const exclude = opts.excludeDirs ?? DEFAULT_EXCLUDE_DIRS;
-  function walk(dir, depth) {
+  const excludeSet = new Set(exclude);
+  async function walk(dir, depth) {
     if (opts.maxDepth !== void 0 && depth > opts.maxDepth) return;
     let entries;
     try {
-      entries = readdirSync(dir);
+      entries = await readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      if (exclude.includes(entry)) continue;
-      const full = resolve(dir, entry);
-      let st;
-      try {
-        st = statSync(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        walk(full, depth + 1);
-      } else if (st.isFile() && matchesExtension(full, opts.extensions)) {
+      if (excludeSet.has(entry.name)) continue;
+      const full = resolve(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full, depth + 1);
+      } else if (entry.isFile() && matchesExtension(full, opts.extensions)) {
         files.push(full);
       }
     }
   }
-  walk(root, 0);
+  await walk(root, 0);
   return files;
 }
 function matchesExtension(p, exts) {
@@ -63,6 +162,7 @@ function matchesExtension(p, exts) {
 
 // src/refactor-suggester/index.ts
 var API_VERSION = "^0.1.10";
+var HOOK_WARNING_COOLDOWN_MS = 6e4;
 var state = {
   scanCount: 0,
   suggestionCount: 0,
@@ -70,7 +170,7 @@ var state = {
   warningCount: 0,
   errorCount: 0,
   hookUnregister: null,
-  lastHookWarning: /* @__PURE__ */ new Map()
+  lastHookWarning: new BoundedMap({ max: 512, ttlMs: HOOK_WARNING_COOLDOWN_MS })
 };
 var DEFAULTS = {
   enabled: false,
@@ -189,21 +289,32 @@ function detectSmells(filePath, content, rules) {
   }
   return suggestions;
 }
-function scanPath(rawPath, cfg) {
+async function scanPath(rawPath, cfg) {
   const root = process.cwd();
   const resolved = isAbsolute2(rawPath) ? resolve2(rawPath) : resolve2(root, rawPath);
   const exts = normalizeExtensions(cfg.extensions);
-  const files = collectSourceFiles(resolved, { extensions: exts });
+  const files = await collectSourceFilesAsync(resolved, { extensions: exts });
   const suggestions = [];
+  let scannedFiles = 0;
+  let truncated = false;
   for (const p of files) {
     try {
-      const content = readFileSync(p, "utf-8");
+      const content = await readFile(p, "utf-8");
+      scannedFiles += 1;
       suggestions.push(...detectSmells(p, content, cfg.rules));
-      if (suggestions.length >= cfg.maxSuggestions) break;
+      if (suggestions.length >= cfg.maxSuggestions) {
+        truncated = scannedFiles < files.length;
+        break;
+      }
     } catch {
     }
   }
-  return { suggestions: suggestions.slice(0, cfg.maxSuggestions), scannedFiles: files.length };
+  return {
+    suggestions: suggestions.slice(0, cfg.maxSuggestions),
+    scannedFiles,
+    discoveredFiles: files.length,
+    truncated
+  };
 }
 var plugin = {
   name: "refactor-suggester",
@@ -254,7 +365,7 @@ var plugin = {
       state.hookUnregister = null;
     }
     const cfg = readConfig(api.config.extensions?.["refactor-suggester"]);
-    const hook = (input) => {
+    const hook = async (input) => {
       if (!cfg.enabled) return;
       if (input.toolResult?.isError) return;
       const inp = input.toolInput ?? {};
@@ -266,11 +377,11 @@ var plugin = {
       state.hookInvocationCount += 1;
       const now = Date.now();
       const lastWarning = state.lastHookWarning.get(sourcePath);
-      if (lastWarning !== void 0 && now - lastWarning < 6e4) return;
+      if (lastWarning !== void 0 && now - lastWarning < HOOK_WARNING_COOLDOWN_MS) return;
       const resolved = resolve2(process.cwd(), sourcePath);
       let content;
       try {
-        content = readFileSync(resolved, "utf-8");
+        content = await readFile(resolved, "utf-8");
       } catch {
         state.errorCount += 1;
         return;
@@ -306,7 +417,7 @@ var plugin = {
         state.scanCount += 1;
         let result;
         try {
-          result = scanPath(rawPath, cfg);
+          result = await scanPath(rawPath, cfg);
         } catch (err) {
           state.errorCount += 1;
           return { ok: false, error: String(err) };
@@ -316,6 +427,10 @@ var plugin = {
           ok: true,
           path: relativePath(resolve2(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
+          discoveredFiles: result.discoveredFiles,
+          // Say so when the cap stopped the walk early: a partial scan
+          // that reports few findings must not read as a clean result.
+          truncated: result.truncated,
           suggestions: result.suggestions,
           rules: cfg.rules
         };

package/dist/release-notes-generator/index.d.ts

@@ -21,7 +21,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/release-notes-generator/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release-notes-generator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA6O/C,QAAA,MAAM,MAAM,EAAE,MAwLb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release-notes-generator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAsPrD,QAAA,MAAM,MAAM,EAAE,MAwLb,CAAC;eAEa,MAAM"}

package/dist/release-notes-generator.js

@@ -1,5 +1,5 @@
 // src/release-notes-generator/index.ts
-import { execFileSync } from "node:child_process";
+import { execFile } from "node:child_process";
 
 // src/runtime/llm.ts
 function stripOuterMarkdownFence(text) {
@@ -88,40 +88,47 @@ function formatCommit(c, includeScope) {
   line += ` ${c.description}`;
   return line;
 }
-var GIT_OPTIONS = {
-  encoding: "utf-8",
-  stdio: ["pipe", "pipe", "ignore"],
-  shell: false
-};
-function resolveFromRef(defaultFrom, inputFrom) {
+function runGit(args, signal) {
+  return new Promise((resolveOutput, reject) => {
+    execFile(
+      "git",
+      args,
+      {
+        encoding: "utf8",
+        shell: false,
+        windowsHide: true,
+        timeout: 1e4,
+        maxBuffer: 10 * 1024 * 1024,
+        signal
+      },
+      (error, stdout) => error ? reject(error) : resolveOutput(stdout)
+    );
+  });
+}
+async function resolveFromRef(defaultFrom, inputFrom, signal) {
   if (inputFrom) return inputFrom;
   if (defaultFrom === "latest-tag") {
     try {
-      return execFileSync("git", ["describe", "--tags", "--abbrev=0"], GIT_OPTIONS).trim();
+      return (await runGit(["describe", "--tags", "--abbrev=0"], signal)).trim();
     } catch {
       return "";
     }
   }
   return defaultFrom;
 }
-function resolveCommit(ref) {
-  const resolved = execFileSync(
-    "git",
-    ["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`],
-    GIT_OPTIONS
-  ).trim();
+async function resolveCommit(ref, signal) {
+  const resolved = (await runGit(["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`], signal)).trim();
   if (!/^[0-9a-f]{40,64}$/i.test(resolved)) {
     throw new Error(`git returned an invalid commit id for ref ${JSON.stringify(ref)}`);
   }
   return resolved;
 }
-function getCommits(from, to) {
-  const toCommit = resolveCommit(to);
-  const range = from ? `${resolveCommit(from)}..${toCommit}` : toCommit;
-  const output = execFileSync(
-    "git",
+async function getCommits(from, to, signal) {
+  const toCommit = await resolveCommit(to, signal);
+  const range = from ? `${await resolveCommit(from, signal)}..${toCommit}` : toCommit;
+  const output = await runGit(
     ["log", "--pretty=format:%H%x09%s", "--end-of-options", range],
-    GIT_OPTIONS
+    signal
   );
   if (!output.trim()) return [];
   const commits = [];
@@ -277,11 +284,11 @@ var plugin = {
         if (!cfg.enabled) return { ok: false, error: "release-notes-generator is disabled" };
         execOpts?.signal?.throwIfAborted();
         const toRef = typeof input.to === "string" ? input.to : "HEAD";
-        const fromRef = resolveFromRef(cfg.defaultFrom, input.from);
+        const fromRef = await resolveFromRef(cfg.defaultFrom, input.from, execOpts?.signal);
         state.generateCount += 1;
         let commits;
         try {
-          commits = getCommits(fromRef, toRef);
+          commits = await getCommits(fromRef, toRef, execOpts?.signal);
         } catch (err) {
           state.errorCount += 1;
           return { ok: false, error: String(err) };

package/dist/runtime/bounded-map.d.ts

@@ -0,0 +1,86 @@
+/**
+ * @wrongstack/plugins — bounded key/value cache.
+ *
+ * Several plugins memoise per-path or per-model work in a module-scope
+ * `Map` that is only ever cleared at teardown. In a short test that is
+ * invisible; in a long session over a large repository it is a slow leak —
+ * one entry per file touched, per branch resolved, per model seen — held
+ * for the lifetime of the process.
+ *
+ * `BoundedMap` is a drop-in replacement for those maps: same `get`/`set`/
+ * `delete`/`clear`/`size` surface, plus a hard entry cap with
+ * least-recently-used eviction and an optional per-entry TTL. Nothing
+ * about the call sites has to change beyond the constructor.
+ *
+ * Why LRU rather than insertion-order eviction: the access pattern for
+ * these caches is "a few hot paths, a long tail of cold ones". Evicting by
+ * insertion order throws away the hot entries first, which is exactly
+ * backwards; re-reading a hot entry should keep it.
+ */
+export interface BoundedMapOptions {
+    /** Hard cap on retained entries. Must be a safe integer >= 1. */
+    max: number;
+    /**
+     * Optional per-entry lifetime in ms. An entry older than this is treated
+     * as absent by `get`/`has` and dropped on access. Omit for no expiry.
+     */
+    ttlMs?: number | undefined;
+    /** Clock injection point — tests override this instead of faking timers. */
+    now?: (() => number) | undefined;
+}
+export declare class BoundedMap<K, V> {
+    private readonly map;
+    private readonly max;
+    private readonly ttlMs;
+    private readonly now;
+    /** Entries dropped to stay under `max`. Surfaced by plugin health(). */
+    private evictions;
+    constructor(options: BoundedMapOptions);
+    private expired;
+    get(key: K): V | undefined;
+    /**
+     * Read without promoting the key to most-recently-used. Use for
+     * diagnostics that must not perturb the eviction order.
+     */
+    peek(key: K): V | undefined;
+    has(key: K): boolean;
+    set(key: K, value: V): this;
+    delete(key: K): boolean;
+    clear(): void;
+    get size(): number;
+    /** How many entries have been dropped to respect `max`, since the last clear. */
+    get evictionCount(): number;
+    /** Drop every expired entry. Cheap enough to call from a status tool. */
+    prune(): number;
+    /** Live (non-expired) entries, coldest first. */
+    entries(): IterableIterator<[K, V]>;
+    [Symbol.iterator](): IterableIterator<[K, V]>;
+}
+/**
+ * A `Set` with the same hard cap and LRU eviction as {@link BoundedMap}.
+ *
+ * Plugins use module-scope sets to remember "already reported" keys so a
+ * finding is surfaced once rather than on every scan. That set has to
+ * outlive a single scan, which is why it lives at module scope — but
+ * without a bound it grows one entry per distinct finding for the life of
+ * the process.
+ *
+ * Eviction means a very old key may eventually be reported a second time.
+ * That is the right trade: re-reporting a finding the user last saw
+ * thousands of findings ago is reasonable behaviour, whereas unbounded
+ * growth is not.
+ */
+export declare class BoundedSet<T> {
+    private readonly inner;
+    constructor(options: BoundedMapOptions);
+    has(value: T): boolean;
+    add(value: T): this;
+    delete(value: T): boolean;
+    clear(): void;
+    get size(): number;
+    /** How many entries have been dropped to respect `max`, since the last clear. */
+    get evictionCount(): number;
+    values(): IterableIterator<T>;
+    [Symbol.iterator](): IterableIterator<T>;
+}
+//# sourceMappingURL=bounded-map.d.ts.map

package/dist/runtime/bounded-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-map.d.ts","sourceRoot":"","sources":["../../src/runtime/bounded-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAClC;AAOD,qBAAa,UAAU,CAAC,CAAC,EAAE,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,wEAAwE;IACxE,OAAO,CAAC,SAAS,CAAK;IAEtB,YAAY,OAAO,EAAE,iBAAiB,EAKrC;IAED,OAAO,CAAC,OAAO;IAIf,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,SAAS,CAazB;IAED;;;OAGG;IACH,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,SAAS,CAI1B;IAED,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO,CAQnB;IAED,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAW1B;IAED,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO,CAEtB;IAED,KAAK,IAAI,IAAI,CAGZ;IAED,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,iFAAiF;IACjF,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,yEAAyE;IACzE,KAAK,IAAI,MAAM,CAUd;IAED,iDAAiD;IAChD,OAAO,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAInC;IAED,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAE5C;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,UAAU,CAAC,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAE5C,YAAY,OAAO,EAAE,iBAAiB,EAErC;IAED,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAErB;IAED,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAGlB;IAED,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAExB;IAED,KAAK,IAAI,IAAI,CAEZ;IAED,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,iFAAiF;IACjF,IAAI,aAAa,IAAI,MAAM,CAE1B;IAEA,MAAM,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAE7B;IAED,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAEvC;CACF"}