@wrongstack/plugins 0.293.0 → 0.295.1

package/dist/runtime/credential-patterns.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @wrongstack/plugins — canonical credential-pattern table.
+ *
+ * Two plugins detect credentials, at different points in the pipeline:
+ *
+ *  - `secret-scanner` gates tool *input* and inspects tool *output*.
+ *  - `prompt-firewall` inspects the outgoing *provider request* (and the
+ *    response) so a credential sitting in context is not shipped to a
+ *    third party.
+ *
+ * They previously each carried their own pattern list. The lists drifted:
+ * one grew GitLab, npm, SendGrid and DigitalOcean coverage while the other
+ * did not, so which credentials were caught depended on which side of the
+ * pipeline they crossed. A credential is a credential — the two surfaces
+ * should never disagree about what one looks like.
+ *
+ * This module is the single source of truth. Adding a pattern here
+ * strengthens both surfaces at once.
+ *
+ * Style notes for new entries:
+ *  - Prefer explicit lookaround boundaries — `(?<![A-Za-z0-9])` /
+ *    `(?![A-Za-z0-9])` — over ``. `` is defined against word
+ *    characters, so it silently fails next to the `+`, `/` and `=` that
+ *    base64-shaped secrets routinely end with.
+ *  - Keep every group non-capturing (`(?:…)`). The combined regex maps a
+ *    capture-group index back to the pattern that fired; an inner group
+ *    shifts that mapping. `secret-scanner` compensates for user-supplied
+ *    patterns, but built-ins should not need it.
+ *  - Avoid unbounded `.*` lookarounds: these run on every provider
+ *    request, against the full context.
+ */
+/** One credential shape, with a stable machine-readable id. */
+export interface CredentialPattern {
+    /** Stable id, e.g. `github_pat`. Reported to users and in metrics. */
+    type: string;
+    /** Global-flagged matcher. */
+    regex: RegExp;
+}
+export declare const CREDENTIAL_PATTERNS: readonly CredentialPattern[];
+/** Fresh, independently-stateful copies (RegExp `lastIndex` is mutable). */
+export declare function cloneCredentialPatterns(): CredentialPattern[];
+//# sourceMappingURL=credential-patterns.d.ts.map

package/dist/runtime/credential-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-patterns.d.ts","sourceRoot":"","sources":["../../src/runtime/credential-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,mBAAmB,EAAE,SAAS,iBAAiB,EAwG3D,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,uBAAuB,IAAI,iBAAiB,EAAE,CAK7D"}

package/dist/runtime/index.d.ts

@@ -29,6 +29,9 @@
  * output parsing) stays in the plugin that owns that language.
  */
 export { parseLlmJsonObject, runOptionalPluginLlm, stripOuterMarkdownFence, type OptionalLlmRequest, type OptionalLlmResult, } from './llm.js';
+export { BoundedMap, BoundedSet, type BoundedMapOptions } from './bounded-map.js';
+export { UNSERIALIZABLE, safeJsonStringify } from './safe-json.js';
+export { clearLocalBinCache, findOnPath, resolveExecInvocation, resolveFirstNodeBin, resolveNodeBin, resolveWin32Command, type ExecInvocation, type ResolvedNodeBin, } from './local-bin.js';
 export type LanguageId = 'typescript' | 'javascript' | 'python' | 'go' | 'rust' | 'shell' | 'ruby' | 'java' | 'kotlin' | 'dotnet' | 'generic';
 export type PackageManagerId = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'pip' | 'poetry' | 'go' | 'cargo' | 'gem' | 'maven' | 'gradle' | 'dotnet' | 'none';
 export interface LanguageRuntime {
@@ -126,6 +129,9 @@ export declare function probeRunner(runtime: LanguageRuntime, probeArg: string |
  * This is the canonical sandbox check that every file-mutating or
  * file-reading plugin should call before touching a path supplied
  * by tool input. It replaces 27 identical copies across plugins.
+ *
+ * Performance: caches `process.cwd()` per call to avoid redundant
+ * syscalls when checking multiple paths in the same tick.
  */
 export declare function withinProject(p: string): boolean;
 /**
@@ -149,8 +155,20 @@ export interface CollectOptions {
  *
  * Shared by 6+ plugin source-scan tools that previously duplicated
  * this implementation identically.
+ *
+ * Determinism: returns files in sorted order (locale-aware) so
+ * scan results are reproducible across platforms and file systems.
  */
 export declare function collectSourceFiles(root: string, opts: CollectOptions): string[];
+/**
+ * Async version of `collectSourceFiles` for non-blocking file collection.
+ * Uses `fs.promises` to avoid blocking the event loop on large directory trees.
+ *
+ * Performance: prefer this in hooks and tools that run on every write/edit
+ * (e.g., dead-code-detector, duplicate-code-detector) to keep the agent loop
+ * responsive during large scans.
+ */
+export declare function collectSourceFilesAsync(root: string, opts: CollectOptions): Promise<string[]>;
 /**
  * Check whether `p` has one of the given extensions (case-insensitive).
  * Replaces a 6-copy helper that was duplicated identically across

package/dist/runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAMH,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,UAAU,CAAC;AAElB,MAAM,MAAM,UAAU,GAClB,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,MAAM,gBAAgB,GACxB,KAAK,GACL,MAAM,GACN,MAAM,GACN,KAAK,GACL,KAAK,GACL,QAAQ,GACR,IAAI,GACJ,OAAO,GACP,KAAK,GACL,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,EAAE,EAAE,UAAU,CAAC;IACf;;;;OAIG;IACH,cAAc,EAAE,gBAAgB,CAAC;IACjC;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACzC;;;;;OAKG;IACH,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,wEAAwE;IACxE,UAAU,EAAE,OAAO,CAAC;CACrB;AAkDD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,cAAmB,GAC3B,MAAM,GAAG,IAAI,CAKf;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,cAAmB,GAC3B,eAAe,GAAG,IAAI,CAoExB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,SAAS,CAAC,CAmHpB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,YAAc,EAC9B,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,eAAe,EACxB,WAAW,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI,CAWf;AAMD,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAID;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAsC/E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAEnE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAMH,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,UAAU,CAAC;AAIlB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,UAAU,GAClB,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,MAAM,gBAAgB,GACxB,KAAK,GACL,MAAM,GACN,MAAM,GACN,KAAK,GACL,KAAK,GACL,QAAQ,GACR,IAAI,GACJ,OAAO,GACP,KAAK,GACL,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,EAAE,EAAE,UAAU,CAAC;IACf;;;;OAIG;IACH,cAAc,EAAE,gBAAgB,CAAC;IACjC;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACzC;;;;;OAKG;IACH,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,wEAAwE;IACxE,UAAU,EAAE,OAAO,CAAC;CACrB;AAkDD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,cAAmB,GAC3B,MAAM,GAAG,IAAI,CAKf;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,cAAmB,GAC3B,eAAe,GAAG,IAAI,CAoExB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,SAAS,CAAC,CA+IpB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,YAAc,EAC9B,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAGhD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,eAAe,EACxB,WAAW,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI,CAWf;AAMD,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAyC/E;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAwCnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAEnE"}

package/dist/runtime/llm.d.ts

@@ -6,7 +6,7 @@
  * bounded prompts, cancellation, defensive response parsing, and an explicit
  * deterministic fallback when no provider is wired or generation fails.
  */
-import type { PluginAPI, PluginLLMOptions } from '@wrongstack/core';
+import type { PluginAPI, PluginLLMOptions } from '@wrongstack/core/types';
 export interface OptionalLlmResult<T> {
     used: boolean;
     value: T | null;

package/dist/runtime/llm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"llm.d.ts","sourceRoot":"","sources":["../../src/runtime/llm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpE,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IAChB,cAAc,EACV,eAAe,GACf,aAAa,GACb,WAAW,GACX,gBAAgB,GAChB,kBAAkB,GAClB,IAAI,CAAC;CACV;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACvC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC;IAC9B,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,2EAA2E;AAC3E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAU/E;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CA8B/B"}
+{"version":3,"file":"llm.d.ts","sourceRoot":"","sources":["../../src/runtime/llm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1E,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IAChB,cAAc,EACV,eAAe,GACf,aAAa,GACb,WAAW,GACX,gBAAgB,GAChB,kBAAkB,GAClB,IAAI,CAAC;CACV;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACvC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC;IAC9B,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,2EAA2E;AAC3E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAU/E;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CA8B/B"}

package/dist/runtime/local-bin.d.ts

@@ -0,0 +1,120 @@
+/**
+ * @wrongstack/plugins — project-local binary resolution.
+ *
+ * Why this module exists
+ * ----------------------
+ * Several plugins need to run a Node CLI that ships with the project
+ * (`biome`, `eslint`, `tsc`, `vitest`, …). The obvious spelling —
+ * `execFile('npx', ['biome', …])` — is wrong in three separate ways:
+ *
+ *  1. **It does not run on Windows at all.** `npx`/`pnpm`/`npm` are
+ *     `.cmd` shims there, and `execFile`/`spawn` without a shell do not
+ *     consult `PATHEXT`. The call fails `ENOENT`, plugins swallow the
+ *     error as "tool not installed", and the feature silently no-ops on
+ *     every Windows machine.
+ *  2. **It is slow.** `npx` re-resolves the package on each invocation,
+ *     and for a missing package it may try to *download* one — on a hook
+ *     that fires after every write.
+ *  3. **It is a weaker sandbox.** The shim is a shell script; arguments
+ *     cross a `cmd.exe` boundary on Windows (the BatBadBut class).
+ *
+ * `lint-gate` and `test-flake-detector` already solved this locally by
+ * resolving the package's `bin` entry through `createRequire` and running
+ * it as `process.execPath <entry>`. That is the correct pattern: no shell,
+ * no shim, no network, identical on every platform. This module promotes
+ * that proven approach to a shared helper so every plugin gets it.
+ *
+ * Fallback: when the package is genuinely absent from the project,
+ * `resolveNodeBin` returns `null` and the caller decides whether to
+ * degrade gracefully or fall back to a PATH lookup via
+ * `resolveWin32Command` (exported here for that purpose).
+ */
+import { resolveWin32Command } from '@wrongstack/tools/win32';
+export { resolveWin32Command };
+/** A spawn-ready invocation, already adjusted for the host platform. */
+export interface ExecInvocation {
+    cmd: string;
+    args: string[];
+    /** Only ever true on the Windows `.cmd`/`.bat` shim path. */
+    windowsVerbatimArguments: boolean;
+}
+/**
+ * Turn a `(command, args)` pair into something `execFile`/`spawn` can
+ * actually launch on this platform.
+ *
+ * On Windows, `npx`/`npm`/`pnpm`/`biome`/`tsc`/… ship as `.cmd` wrappers.
+ * `execFile` and `spawn` without a shell ignore `PATHEXT`, so a bare
+ * `execFile('npx', …)` fails `ENOENT` — and because every plugin treats a
+ * spawn failure as "tool not installed", the feature silently no-ops on
+ * every Windows machine. This resolves the real path first and, for a
+ * `.cmd`/`.bat` shim, routes through `cmd.exe` with per-argument quoting
+ * and a metacharacter guard (the BatBadBut argument-injection class), so
+ * a dynamic path argument still cannot chain a second command.
+ *
+ * On non-Windows, and for real `.exe` binaries, this is a passthrough.
+ *
+ * Throws when an argument carries a `cmd.exe` metacharacter on the shim
+ * path — callers should treat that as "skip", never as "run anyway".
+ *
+ * Prefer {@link resolveNodeBin} when the target is a Node CLI that the
+ * project depends on: `node <bin-entry>` needs no shim at all.
+ */
+export declare function resolveExecInvocation(command: string, args?: readonly string[]): ExecInvocation;
+/**
+ * Locate `cmd` on `PATH`, or return `null` if it is not there.
+ *
+ * This is the existence check `resolveWin32Command` deliberately does not
+ * provide: that function returns its input unchanged when nothing matches,
+ * so a caller cannot distinguish "found `biome`" from "gave up and handed
+ * back the string `biome`". Treating the passthrough as success makes a
+ * missing tool look installed — the caller then spawns it, gets `ENOENT`,
+ * and (because plugins read a spawn failure as "not installed") silently
+ * does nothing while reporting itself healthy.
+ *
+ * Returns the resolved path on success. Walks `PATH` directly, applying
+ * `PATHEXT` suffixes on Windows for a bare name and checking the execute
+ * bit on POSIX.
+ */
+export declare function findOnPath(cmd: string): string | null;
+/** A resolved, directly-spawnable invocation. Never a shell or a shim. */
+export interface ResolvedNodeBin {
+    /** Always `process.execPath` — the Node binary running this process. */
+    cmd: string;
+    /** `[binEntryPath, ...extraArgs]`. */
+    args: string[];
+    /** Absolute path of the package's bin entry, for diagnostics. */
+    entry: string;
+}
+/** Drop every cached resolution. Call from `teardown()`. */
+export declare function clearLocalBinCache(): void;
+/**
+ * Resolve a project-local Node CLI to a `process.execPath <entry>`
+ * invocation.
+ *
+ * @param packageName npm package to resolve, e.g. `@biomejs/biome`.
+ * @param binName     which `bin` key to prefer when the package declares
+ *                    several. Falls back to the sole/first entry.
+ * @param cwd         project root whose `package.json` anchors resolution.
+ * @param extraArgs   arguments appended after the bin entry.
+ *
+ * Returns `null` when the package is not installed, declares no `bin`, or
+ * the declared entry escapes its own package directory (a tampered
+ * `package.json` must not become an arbitrary-file execution primitive).
+ */
+export declare function resolveNodeBin(packageName: string, binName: string, cwd: string, extraArgs?: readonly string[]): ResolvedNodeBin | null;
+/**
+ * Resolve the first installed package from `candidates`.
+ *
+ * Used by plugins that accept several equivalent tools (biome *or*
+ * eslint, vitest *or* jest) and want the first one the project actually
+ * has, without probing each with a subprocess.
+ */
+export declare function resolveFirstNodeBin(candidates: readonly {
+    packageName: string;
+    binName: string;
+    args?: readonly string[];
+}[], cwd: string): (ResolvedNodeBin & {
+    packageName: string;
+    binName: string;
+}) | null;
+//# sourceMappingURL=local-bin.d.ts.map

package/dist/runtime/local-bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-bin.d.ts","sourceRoot":"","sources":["../../src/runtime/local-bin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,OAAO,EAA+B,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE3F,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,6DAA6D;IAC7D,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,SAAS,MAAM,EAAO,GAC3B,cAAc,CAWhB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoCrD;AAED,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;CACf;AAqCD,4DAA4D;AAC5D,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,SAAS,MAAM,EAAO,GAChC,eAAe,GAAG,IAAI,CAwCxB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,SAAS;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACzF,GAAG,EAAE,MAAM,GACV,CAAC,eAAe,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAMrE"}

package/dist/runtime/safe-json.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @wrongstack/plugins — serialisation that cannot take the process down.
+ *
+ * Plugins routinely stringify values they did not construct: event-bus
+ * payloads, tool results, mailbox bodies. `JSON.stringify` throws on a
+ * circular reference and on `BigInt`, and several of these call sites sit
+ * inside detached (fire-and-forget) work where a throw becomes an
+ * unhandled rejection rather than a handled failure.
+ *
+ * `safeJsonStringify` never throws. A value it cannot represent is
+ * replaced with a marker, so the surrounding feature degrades to "this
+ * field is unreadable" instead of failing — or crashing — outright.
+ */
+/** Placeholder substituted for a value that cannot be serialised. */
+export declare const UNSERIALIZABLE = "[unserializable]";
+/**
+ * `JSON.stringify` with cycle handling and a total-failure fallback.
+ *
+ * @param value  anything
+ * @param indent passed through to `JSON.stringify` (e.g. `2` to pretty-print)
+ * @returns a JSON string, or a marker string when the value resists
+ *          serialisation entirely. Never throws.
+ */
+export declare function safeJsonStringify(value: unknown, indent?: number): string;
+//# sourceMappingURL=safe-json.d.ts.map

package/dist/runtime/safe-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-json.d.ts","sourceRoot":"","sources":["../../src/runtime/safe-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,qEAAqE;AACrE,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAyBzE"}