@wrongstack/plugins 0.293.0 → 0.295.1

package/dist/runtime.js

@@ -1,7 +1,7 @@
 // src/runtime/index.ts
 import { execFile } from "node:child_process";
 import { existsSync, readdirSync, statSync } from "node:fs";
-import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+import { basename, extname as extname2, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
 
 // src/runtime/llm.ts
 function stripOuterMarkdownFence(text) {
@@ -49,6 +49,249 @@ async function runOptionalPluginLlm(request) {
   }
 }
 
+// src/runtime/local-bin.ts
+import { createRequire } from "node:module";
+import { delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { accessSync, constants, readFileSync } from "node:fs";
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+function resolveExecInvocation(command, args = []) {
+  const resolved = resolveWin32Command(command);
+  const normalizedResolved = resolved.toLowerCase();
+  const needsShell = process.platform === "win32" && (normalizedResolved.endsWith(".cmd") || normalizedResolved.endsWith(".bat"));
+  if (needsShell) {
+    const shim = buildWin32CmdShimInvocation(resolved, args);
+    return { cmd: shim.command, args: shim.args, windowsVerbatimArguments: true };
+  }
+  return { cmd: resolved, args: [...args], windowsVerbatimArguments: false };
+}
+function findOnPath(cmd) {
+  if (!cmd) return null;
+  const exists = (p) => {
+    try {
+      accessSync(p, constants.X_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  if (cmd.includes("/") || cmd.includes("\\")) {
+    return exists(cmd) ? resolve(cmd) : null;
+  }
+  const suffixes = process.platform === "win32" && extname(cmd) === "" ? (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  for (const dir of (process.env["PATH"] ?? "").split(delimiter)) {
+    if (!dir) continue;
+    const base = join(dir, cmd);
+    for (const suffix of suffixes) {
+      const candidate = `${base}${suffix}`;
+      if (exists(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+function isInside(parent, candidate) {
+  const rel = relative(parent, candidate);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel);
+}
+var binCache = /* @__PURE__ */ new Map();
+var BIN_CACHE_MAX = 64;
+var NEGATIVE_BIN_CACHE_TTL_MS = 5e3;
+function cachePut(key, value) {
+  while (binCache.size >= BIN_CACHE_MAX) {
+    const oldest = binCache.keys().next().value;
+    if (oldest === void 0) break;
+    binCache.delete(oldest);
+  }
+  binCache.set(key, { value, cachedAt: Date.now() });
+  return value;
+}
+function clearLocalBinCache() {
+  binCache.clear();
+}
+function resolveNodeBin(packageName, binName, cwd, extraArgs = []) {
+  const key = `${packageName}|${binName}|${cwd}`;
+  const cached = binCache.get(key);
+  if (cached !== void 0) {
+    if (cached.value !== null || Date.now() - cached.cachedAt < NEGATIVE_BIN_CACHE_TTL_MS) {
+      return cached.value === null ? null : { ...cached.value, args: [cached.value.entry, ...extraArgs] };
+    }
+    binCache.delete(key);
+  }
+  let resolved = null;
+  try {
+    const requireFromProject = createRequire(resolve(cwd, "package.json"));
+    const packagePath = requireFromProject.resolve(`${packageName}/package.json`);
+    const packageJson = JSON.parse(readFileSync(packagePath, "utf-8"));
+    const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[binName] ?? Object.values(packageJson.bin ?? {})[0];
+    if (relativeBin && !isAbsolute(relativeBin)) {
+      const packageDir = dirname(packagePath);
+      const entry = resolve(packageDir, relativeBin);
+      if (isInside(packageDir, entry)) {
+        resolved = { cmd: process.execPath, args: [entry], entry };
+      }
+    }
+  } catch {
+    resolved = null;
+  }
+  cachePut(key, resolved);
+  return resolved === null ? null : { ...resolved, args: [resolved.entry, ...extraArgs] };
+}
+function resolveFirstNodeBin(candidates, cwd) {
+  for (const c of candidates) {
+    const hit = resolveNodeBin(c.packageName, c.binName, cwd, c.args ?? []);
+    if (hit) return { ...hit, packageName: c.packageName, binName: c.binName };
+  }
+  return null;
+}
+
+// src/runtime/bounded-map.ts
+var BoundedMap = class {
+  map = /* @__PURE__ */ new Map();
+  max;
+  ttlMs;
+  now;
+  /** Entries dropped to stay under `max`. Surfaced by plugin health(). */
+  evictions = 0;
+  constructor(options) {
+    const normalizedMax = Math.floor(options.max);
+    this.max = Number.isSafeInteger(normalizedMax) ? Math.max(1, normalizedMax) : 1;
+    this.ttlMs = options.ttlMs;
+    this.now = options.now ?? Date.now;
+  }
+  expired(entry) {
+    return this.ttlMs !== void 0 && this.now() - entry.storedAt > this.ttlMs;
+  }
+  get(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return void 0;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return void 0;
+    }
+    this.map.delete(key);
+    this.map.set(key, entry);
+    return entry.value;
+  }
+  /**
+   * Read without promoting the key to most-recently-used. Use for
+   * diagnostics that must not perturb the eviction order.
+   */
+  peek(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0 || this.expired(entry)) return void 0;
+    return entry.value;
+  }
+  has(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return false;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return false;
+    }
+    return true;
+  }
+  set(key, value) {
+    this.map.delete(key);
+    this.map.set(key, { value, storedAt: this.now() });
+    while (this.map.size > this.max) {
+      const coldest = this.map.keys().next().value;
+      if (coldest === void 0) break;
+      this.map.delete(coldest);
+      this.evictions += 1;
+    }
+    return this;
+  }
+  delete(key) {
+    return this.map.delete(key);
+  }
+  clear() {
+    this.map.clear();
+    this.evictions = 0;
+  }
+  get size() {
+    return this.map.size;
+  }
+  /** How many entries have been dropped to respect `max`, since the last clear. */
+  get evictionCount() {
+    return this.evictions;
+  }
+  /** Drop every expired entry. Cheap enough to call from a status tool. */
+  prune() {
+    if (this.ttlMs === void 0) return 0;
+    let removed = 0;
+    for (const [key, entry] of this.map) {
+      if (this.expired(entry)) {
+        this.map.delete(key);
+        removed += 1;
+      }
+    }
+    return removed;
+  }
+  /** Live (non-expired) entries, coldest first. */
+  *entries() {
+    for (const [key, entry] of this.map) {
+      if (!this.expired(entry)) yield [key, entry.value];
+    }
+  }
+  [Symbol.iterator]() {
+    return this.entries();
+  }
+};
+var BoundedSet = class {
+  inner;
+  constructor(options) {
+    this.inner = new BoundedMap(options);
+  }
+  has(value) {
+    return this.inner.has(value);
+  }
+  add(value) {
+    this.inner.set(value, true);
+    return this;
+  }
+  delete(value) {
+    return this.inner.delete(value);
+  }
+  clear() {
+    this.inner.clear();
+  }
+  get size() {
+    return this.inner.size;
+  }
+  /** How many entries have been dropped to respect `max`, since the last clear. */
+  get evictionCount() {
+    return this.inner.evictionCount;
+  }
+  *values() {
+    for (const [key] of this.inner) yield key;
+  }
+  [Symbol.iterator]() {
+    return this.values();
+  }
+};
+
+// src/runtime/safe-json.ts
+var UNSERIALIZABLE = "[unserializable]";
+function safeJsonStringify(value, indent) {
+  try {
+    const stack = [];
+    const out = JSON.stringify(
+      value,
+      function replacer(_key, val) {
+        if (typeof val === "bigint") return `${val.toString()}n`;
+        if (val === null || typeof val !== "object") return val;
+        while (stack.length > 0 && stack[stack.length - 1] !== this) stack.pop();
+        if (stack.includes(val)) return "[circular]";
+        stack.push(val);
+        return val;
+      },
+      indent
+    );
+    return out ?? String(value);
+  } catch {
+    return UNSERIALIZABLE;
+  }
+}
+
 // src/runtime/index.ts
 var META_CHARS = /["'`;&|<>\r\n]/;
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
@@ -63,9 +306,9 @@ function safeSplit(command) {
 function withinProjectPath(projectRoot, candidate) {
   if (candidate.length === 0 || candidate.length > 4096) return false;
   if (hasLeadingDash(candidate)) return false;
-  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(projectRoot, candidate);
-  const rel = relative(projectRoot, resolved);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+  const resolved = isAbsolute2(candidate) ? resolve2(candidate) : resolve2(projectRoot, candidate);
+  const rel = relative2(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
 }
 function everyFlagAllowed(allowed, args) {
   for (const arg of args) {
@@ -77,14 +320,14 @@ function everyFlagAllowed(allowed, args) {
 }
 function sanitizeRunnerPath(value, options = {}) {
   if (!value || hasLeadingDash(value)) return null;
-  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  const projectRoot = resolve2(options.projectRoot ?? process.cwd());
   if (!withinProjectPath(projectRoot, value)) return null;
-  return isAbsolute(value) ? resolve(value) : resolve(projectRoot, value);
+  return isAbsolute2(value) ? resolve2(value) : resolve2(projectRoot, value);
 }
 function resolveRunnerCommand(runtime, command, options = {}) {
   const tokens = safeSplit(command);
   if (!tokens || tokens.length === 0) return null;
-  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  const projectRoot = resolve2(options.projectRoot ?? process.cwd());
   const launcher = runtime.packageManager;
   const [head, second, ...rest] = tokens;
   if (!head) return null;
@@ -115,7 +358,7 @@ function resolveRunnerCommand(runtime, command, options = {}) {
       return { cmd: head, args: [second, exe, ...tail], display };
     }
   }
-  if (isAbsolute(head)) {
+  if (isAbsolute2(head)) {
     if (!withinProjectPath(projectRoot, head)) return null;
     const base = basename(head);
     if (base !== runtime.executable && base !== launcher) return null;
@@ -136,7 +379,7 @@ function runRunnerCommand(argv, options) {
     });
   }
   return new Promise((resolvePromise) => {
-    const projectRoot = resolve(options.projectRoot ?? process.cwd());
+    const projectRoot = resolve2(options.projectRoot ?? process.cwd());
     const trimmedCwd = options.cwd.trim();
     if (!withinProjectPath(projectRoot, trimmedCwd)) {
       resolvePromise({
@@ -154,21 +397,37 @@ function runRunnerCommand(argv, options) {
     const stderrChunks = [];
     let stdoutBytes = 0;
     let stderrBytes = 0;
-    options.signal?.addEventListener("abort", () => {
+    const onAbort = () => {
       timedOut = true;
-    }, { once: true });
+    };
+    let invocation;
+    try {
+      invocation = resolveExecInvocation(argv[0], argv.slice(1));
+    } catch (err) {
+      resolvePromise({
+        code: null,
+        stdout: "",
+        stderr: `runtime helper: ${err instanceof Error ? err.message : String(err)}`,
+        timedOut: false,
+        spawnError: true
+      });
+      return;
+    }
+    options.signal?.addEventListener("abort", onAbort, { once: true });
     const child = execFile(
-      argv[0],
-      argv.slice(1),
+      invocation.cmd,
+      invocation.args,
       {
         cwd: trimmedCwd,
         timeout: options.timeoutMs,
         signal: options.signal,
         maxBuffer: MAX_BUFFER_BYTES,
         windowsHide: true,
-        shell: false
+        shell: false,
+        ...invocation.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
       },
       (err) => {
+        options.signal?.removeEventListener("abort", onAbort);
         if (timedOut) {
           resolvePromise({
             code: null,
@@ -240,14 +499,15 @@ async function probeRunner(runtime, probeArg = "--version", options) {
   return result.code === 0;
 }
 function withinProject(p) {
-  return withinProjectPath(process.cwd(), p) || relative(process.cwd(), p) === ".";
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative2(cwd, p) === ".";
 }
 function locateRunnerEntry(runtime, projectRoot) {
-  const root = resolve(projectRoot);
+  const root = resolve2(projectRoot);
   const candidates = [
-    resolve(root, "node_modules", ".bin", runtime.executable),
-    resolve(root, "node_modules", ".bin", `${runtime.executable}.cmd`),
-    resolve(root, "node_modules", ".bin", `${runtime.executable}.ps1`)
+    resolve2(root, "node_modules", ".bin", runtime.executable),
+    resolve2(root, "node_modules", ".bin", `${runtime.executable}.cmd`),
+    resolve2(root, "node_modules", ".bin", `${runtime.executable}.ps1`)
   ];
   for (const c of candidates) {
     if (existsSync(c)) return c;
@@ -265,6 +525,7 @@ function collectSourceFiles(root, opts) {
   }
   if (!s.isDirectory()) return files;
   const exclude = opts.excludeDirs ?? DEFAULT_EXCLUDE_DIRS;
+  const excludeSet = new Set(exclude);
   function walk(dir, depth) {
     if (opts.maxDepth !== void 0 && depth > opts.maxDepth) return;
     let entries;
@@ -273,9 +534,10 @@ function collectSourceFiles(root, opts) {
     } catch {
       return;
     }
+    entries.sort();
     for (const entry of entries) {
-      if (exclude.includes(entry)) continue;
-      const full = resolve(dir, entry);
+      if (excludeSet.has(entry)) continue;
+      const full = resolve2(dir, entry);
       let st;
       try {
         st = statSync(full);
@@ -292,18 +554,66 @@ function collectSourceFiles(root, opts) {
   walk(root, 0);
   return files;
 }
+async function collectSourceFilesAsync(root, opts) {
+  const { readdir, stat } = await import("node:fs/promises");
+  const files = [];
+  try {
+    const s = await stat(root);
+    if (s.isFile()) {
+      if (matchesExtension(root, opts.extensions)) files.push(root);
+      return files;
+    }
+    if (!s.isDirectory()) return files;
+  } catch {
+    return files;
+  }
+  const exclude = opts.excludeDirs ?? DEFAULT_EXCLUDE_DIRS;
+  const excludeSet = new Set(exclude);
+  async function walk(dir, depth) {
+    if (opts.maxDepth !== void 0 && depth > opts.maxDepth) return;
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      if (excludeSet.has(entry.name)) continue;
+      const full = resolve2(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full, depth + 1);
+      } else if (entry.isFile() && matchesExtension(full, opts.extensions)) {
+        files.push(full);
+      }
+    }
+  }
+  await walk(root, 0);
+  return files;
+}
 function matchesExtension(p, exts) {
-  return exts.includes(extname(p).toLowerCase());
+  return exts.includes(extname2(p).toLowerCase());
 }
 export {
+  BoundedMap,
+  BoundedSet,
+  UNSERIALIZABLE,
+  clearLocalBinCache,
   collectSourceFiles,
+  collectSourceFilesAsync,
+  findOnPath,
   locateRunnerEntry,
   matchesExtension,
   parseLlmJsonObject,
   probeRunner,
+  resolveExecInvocation,
+  resolveFirstNodeBin,
+  resolveNodeBin,
   resolveRunnerCommand,
+  resolveWin32Command,
   runOptionalPluginLlm,
   runRunnerCommand,
+  safeJsonStringify,
   sanitizeRunnerPath,
   stripOuterMarkdownFence,
   withinProject

package/dist/schema-evolution-guard/index.d.ts

@@ -34,7 +34,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/schema-evolution-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schema-evolution-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA0M/C,QAAA,MAAM,MAAM,EAAE,MAgNb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schema-evolution-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA0MrD,QAAA,MAAM,MAAM,EAAE,MAgNb,CAAC;eAEa,MAAM"}

package/dist/schema-evolution-guard.js

@@ -4,6 +4,11 @@ import { basename as basename2 } from "node:path";
 
 // src/runtime/index.ts
 import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/index.ts
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {
   return arg.length > 0 && arg.startsWith("-");
@@ -16,7 +21,8 @@ function withinProjectPath(projectRoot, candidate) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
 }
 function withinProject(p) {
-  return withinProjectPath(process.cwd(), p) || relative(process.cwd(), p) === ".";
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative(cwd, p) === ".";
 }
 
 // src/schema-evolution-guard/index.ts

package/dist/secret-scanner/index.d.ts

@@ -26,7 +26,7 @@
  * They share the same threat model but act at different points in the
  * pipeline.
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/secret-scanner/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secret-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAqd/C,QAAA,MAAM,MAAM,EAAE,MAgOb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secret-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAwmBrD,QAAA,MAAM,MAAM,EAAE,MAgOb,CAAC;eAEa,MAAM"}