@wrongstack/plugins 0.293.0 → 0.295.1

package/dist/code-metrics.js

@@ -1,10 +1,14 @@
 // src/code-metrics/index.ts
-import { readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
 import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
 
 // src/runtime/index.ts
-import { existsSync, readdirSync, statSync } from "node:fs";
 import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/index.ts
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {
   return arg.length > 0 && arg.startsWith("-");
@@ -17,44 +21,45 @@ function withinProjectPath(projectRoot, candidate) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
 }
 function withinProject(p) {
-  return withinProjectPath(process.cwd(), p) || relative(process.cwd(), p) === ".";
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative(cwd, p) === ".";
 }
 var DEFAULT_EXCLUDE_DIRS = ["node_modules", "dist", ".git", "coverage"];
-function collectSourceFiles(root, opts) {
+async function collectSourceFilesAsync(root, opts) {
+  const { readdir, stat } = await import("node:fs/promises");
   const files = [];
-  if (!existsSync(root)) return files;
-  const s = statSync(root);
-  if (s.isFile()) {
-    if (matchesExtension(root, opts.extensions)) files.push(root);
+  try {
+    const s = await stat(root);
+    if (s.isFile()) {
+      if (matchesExtension(root, opts.extensions)) files.push(root);
+      return files;
+    }
+    if (!s.isDirectory()) return files;
+  } catch {
     return files;
   }
-  if (!s.isDirectory()) return files;
   const exclude = opts.excludeDirs ?? DEFAULT_EXCLUDE_DIRS;
-  function walk(dir, depth) {
+  const excludeSet = new Set(exclude);
+  async function walk(dir, depth) {
     if (opts.maxDepth !== void 0 && depth > opts.maxDepth) return;
     let entries;
     try {
-      entries = readdirSync(dir);
+      entries = await readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      if (exclude.includes(entry)) continue;
-      const full = resolve(dir, entry);
-      let st;
-      try {
-        st = statSync(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        walk(full, depth + 1);
-      } else if (st.isFile() && matchesExtension(full, opts.extensions)) {
+      if (excludeSet.has(entry.name)) continue;
+      const full = resolve(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full, depth + 1);
+      } else if (entry.isFile() && matchesExtension(full, opts.extensions)) {
         files.push(full);
       }
     }
   }
-  walk(root, 0);
+  await walk(root, 0);
   return files;
 }
 function matchesExtension(p, exts) {
@@ -166,16 +171,16 @@ function analyzeFile(filePath, content) {
     complexity: countComplexity(content)
   };
 }
-function measurePath(rawPath, cfg) {
+async function measurePath(rawPath, cfg) {
   const root = process.cwd();
   const resolved = isAbsolute2(rawPath) ? resolve2(rawPath) : resolve2(root, rawPath);
   const exts = normalizeExtensions(cfg.extensions);
-  const allFiles = collectSourceFiles(resolved, { extensions: exts });
+  const allFiles = await collectSourceFilesAsync(resolved, { extensions: exts });
   const files = allFiles.slice(0, cfg.maxFiles);
   const metrics = [];
   for (const p of files) {
     try {
-      const content = readFileSync(p, "utf-8");
+      const content = await readFile(p, "utf-8");
       metrics.push(analyzeFile(p, content));
     } catch {
     }
@@ -221,7 +226,7 @@ var plugin = {
       state.hookUnregister = null;
     }
     const cfg = readConfig(api.config.extensions?.["code-metrics"]);
-    const hook = (input) => {
+    const hook = async (input) => {
       if (!cfg.enabled) return;
       if (input.toolResult?.isError) return;
       const inp = input.toolInput ?? {};
@@ -234,7 +239,7 @@ var plugin = {
       const resolved = resolve2(process.cwd(), sourcePath);
       let content;
       try {
-        content = readFileSync(resolved, "utf-8");
+        content = await readFile(resolved, "utf-8");
       } catch {
         state.errorCount += 1;
         return;
@@ -267,7 +272,7 @@ var plugin = {
         state.measureCount += 1;
         let result;
         try {
-          result = measurePath(rawPath, cfg);
+          result = await measurePath(rawPath, cfg);
         } catch (err) {
           state.errorCount += 1;
           return { ok: false, error: String(err) };

package/dist/commit-validator/index.d.ts

@@ -25,7 +25,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/commit-validator/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/commit-validator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAsP/C,QAAA,MAAM,MAAM,EAAE,MAgSb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/commit-validator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAiRrD,QAAA,MAAM,MAAM,EAAE,MAgSb,CAAC;eAEa,MAAM"}

package/dist/commit-validator.js

@@ -116,14 +116,24 @@ function parseCommitMessage(message, cfg) {
     errors
   };
 }
+var GIT_MESSAGE_FLAG_RE = new RegExp(
+  [
+    // -m "…" | -m '…' | -m=… ; --message "…" | --message='…' | --message=…
+    String.raw`(?:^|\s)(?:-m|--message)(?:\s+|=)"([^"]*)"`,
+    String.raw`(?:^|\s)(?:-m|--message)(?:\s+|=)'([^']*)'`,
+    // Bare value: stops at whitespace or a shell separator.
+    String.raw`(?:^|\s)(?:-m|--message)(?:\s+|=)([^\s;&|"']+)`
+  ].join("|"),
+  "g"
+);
 function extractMessageFromBash(command) {
-  const flags = [];
-  const doubleQuoted = command.matchAll(/-m\s+"([^"]*)"/g);
-  const singleQuoted = command.matchAll(/-m\s+'([^']*)'/g);
-  for (const m of doubleQuoted) flags.push(m[1] ?? "");
-  for (const m of singleQuoted) flags.push(m[1] ?? "");
-  if (flags.length === 0) return null;
-  return flags.join("\n");
+  const parts = [];
+  for (const m of command.matchAll(GIT_MESSAGE_FLAG_RE)) {
+    const value = m[1] ?? m[2] ?? m[3];
+    if (value !== void 0) parts.push(value);
+  }
+  if (parts.length === 0) return null;
+  return parts.join("\n");
 }
 var plugin = {
   name: "commit-validator",

package/dist/config-validator/index.d.ts

@@ -36,7 +36,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 export declare function validateJson(text: string, isJsonc: boolean, fileName: string): string[];
 export declare function validateYaml(text: string): string[];
 export declare function validateToml(text: string): string[];

package/dist/config-validator/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config-validator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA0H/C,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CA2CvF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuDnD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuCnD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAOjE;AAMD,QAAA,MAAM,MAAM,EAAE,MAqJb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config-validator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA0HrD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CA2CvF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuDnD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuCnD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAOjE;AAMD,QAAA,MAAM,MAAM,EAAE,MAqJb,CAAC;eAEa,MAAM"}

package/dist/context-pins/index.d.ts

@@ -31,7 +31,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 export interface Pin {
     id: string;
     label: string | null;

package/dist/context-pins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/context-pins/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM/C,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AA8GD,QAAA,MAAM,MAAM,EAAE,MA8Mb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/context-pins/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAOrD,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAoHD,QAAA,MAAM,MAAM,EAAE,MA8Mb,CAAC;eAEa,MAAM"}

package/dist/context-pins.js

@@ -1,6 +1,7 @@
 // src/context-pins/index.ts
 import * as fs from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { atomicWrite, ensureDir } from "@wrongstack/core/utils";
 var state = {
   pins: [],
   nextId: 1,
@@ -47,11 +48,11 @@ function loadPins(filePath) {
     return { pins: [], nextId: 1 };
   }
 }
-function persistPins(filePath) {
+async function persistPins(filePath) {
   if (!filePath) return true;
   try {
-    fs.mkdirSync(dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, JSON.stringify({ pins: state.pins, nextId: state.nextId }, null, 2));
+    await ensureDir(dirname(filePath));
+    await atomicWrite(filePath, JSON.stringify({ pins: state.pins, nextId: state.nextId }, null, 2));
     return true;
   } catch {
     state.persistErrors += 1;
@@ -149,7 +150,7 @@ var plugin = {
         state.pins.push(pin);
         state.adds += 1;
         api.metrics.counter("adds");
-        const persisted = persistPins(cfg.filePath);
+        const persisted = await persistPins(cfg.filePath);
         return { ok: true, pin, persisted, totalPins: state.pins.length };
       }
     });
@@ -175,7 +176,7 @@ var plugin = {
         if (removed === 0) return { ok: false, error: `no pin matches "${key}"` };
         state.removals += removed;
         api.metrics.counter("removals", removed);
-        const persisted = persistPins(cfg.filePath);
+        const persisted = await persistPins(cfg.filePath);
         return { ok: true, removed, persisted, totalPins: state.pins.length };
       }
     });

package/dist/cost-tracker/index.d.ts

@@ -30,7 +30,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 /**
  * Per-model pricing in USD per 1 million tokens.
  *

package/dist/cost-tracker/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cost-tracker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAK/C;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB;AAyKD,QAAA,MAAM,MAAM,EAAE,MA8Zb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cost-tracker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAMrD;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB;AAuLD,QAAA,MAAM,MAAM,EAAE,MAoab,CAAC;eAEa,MAAM"}

package/dist/cost-tracker.js

@@ -1,5 +1,105 @@
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/bounded-map.ts
+var BoundedMap = class {
+  map = /* @__PURE__ */ new Map();
+  max;
+  ttlMs;
+  now;
+  /** Entries dropped to stay under `max`. Surfaced by plugin health(). */
+  evictions = 0;
+  constructor(options) {
+    const normalizedMax = Math.floor(options.max);
+    this.max = Number.isSafeInteger(normalizedMax) ? Math.max(1, normalizedMax) : 1;
+    this.ttlMs = options.ttlMs;
+    this.now = options.now ?? Date.now;
+  }
+  expired(entry) {
+    return this.ttlMs !== void 0 && this.now() - entry.storedAt > this.ttlMs;
+  }
+  get(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return void 0;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return void 0;
+    }
+    this.map.delete(key);
+    this.map.set(key, entry);
+    return entry.value;
+  }
+  /**
+   * Read without promoting the key to most-recently-used. Use for
+   * diagnostics that must not perturb the eviction order.
+   */
+  peek(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0 || this.expired(entry)) return void 0;
+    return entry.value;
+  }
+  has(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return false;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return false;
+    }
+    return true;
+  }
+  set(key, value) {
+    this.map.delete(key);
+    this.map.set(key, { value, storedAt: this.now() });
+    while (this.map.size > this.max) {
+      const coldest = this.map.keys().next().value;
+      if (coldest === void 0) break;
+      this.map.delete(coldest);
+      this.evictions += 1;
+    }
+    return this;
+  }
+  delete(key) {
+    return this.map.delete(key);
+  }
+  clear() {
+    this.map.clear();
+    this.evictions = 0;
+  }
+  get size() {
+    return this.map.size;
+  }
+  /** How many entries have been dropped to respect `max`, since the last clear. */
+  get evictionCount() {
+    return this.evictions;
+  }
+  /** Drop every expired entry. Cheap enough to call from a status tool. */
+  prune() {
+    if (this.ttlMs === void 0) return 0;
+    let removed = 0;
+    for (const [key, entry] of this.map) {
+      if (this.expired(entry)) {
+        this.map.delete(key);
+        removed += 1;
+      }
+    }
+    return removed;
+  }
+  /** Live (non-expired) entries, coldest first. */
+  *entries() {
+    for (const [key, entry] of this.map) {
+      if (!this.expired(entry)) yield [key, entry.value];
+    }
+  }
+  [Symbol.iterator]() {
+    return this.entries();
+  }
+};
+
+// src/runtime/index.ts
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+
 // src/cost-tracker/index.ts
-import { expectDefined } from "@wrongstack/core";
+import { expectDefined } from "@wrongstack/core/utils";
 var API_VERSION = "^0.1.10";
 var PRICING = {
   "gpt-4o": { input: 5, output: 15 },
@@ -28,8 +128,13 @@ function readCostTrackerConfig(raw) {
     mailboxDigestTo: typeof digestTo === "string" && digestTo.length > 0 ? digestTo : "cost-tracker"
   };
 }
+var modelKeyCache = new BoundedMap({ max: 256 });
 function estimateCost(model, promptTokens, completionTokens) {
-  const key = model.toLowerCase();
+  let key = modelKeyCache.get(model);
+  if (!key) {
+    key = model.toLowerCase();
+    modelKeyCache.set(model, key);
+  }
   const pricing = pricingOverrides[key] ?? bundledFromRegistry[key] ?? PRICING[key] ?? DEFAULT_PRICING;
   const inputCost = promptTokens / 1e6 * pricing.input;
   const outputCost = completionTokens / 1e6 * pricing.output;
@@ -86,6 +191,7 @@ var plugin = {
     for (const k of Object.keys(bundledFromRegistry)) {
       delete bundledFromRegistry[k];
     }
+    modelKeyCache.clear();
     lastCost.usd = 0;
     lastCost.model = null;
     lastCost.at = null;
@@ -331,6 +437,7 @@ by model: ${top || "(none)"}`
     for (const k of Object.keys(bundledFromRegistry)) {
       delete bundledFromRegistry[k];
     }
+    modelKeyCache.clear();
     const finalLast = { ...lastCost };
     lastCost.usd = 0;
     lastCost.model = null;

package/dist/cron/index.d.ts

@@ -6,7 +6,7 @@
  * - cron_list: List all scheduled jobs
  * - cron_cancel: Cancel a scheduled job
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/cron/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cron/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA+F/C,QAAA,MAAM,MAAM,EAAE,MAqRb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cron/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA+FrD,QAAA,MAAM,MAAM,EAAE,MA2Rb,CAAC;eAEa,MAAM"}

package/dist/cron.js

@@ -82,6 +82,7 @@ var plugin = {
         api.metrics.histogram("cron_job_interval_ms", job.intervalMs, { job: name });
         scheduleNextRun(name);
       }, delay);
+      timer.unref?.();
       state.timers.set(name, timer);
     }
     function cancelJob(name) {

package/dist/dead-code-detector/index.d.ts

@@ -26,7 +26,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/dead-code-detector/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dead-code-detector/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAiQ/C,QAAA,MAAM,MAAM,EAAE,MAkOb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dead-code-detector/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAiSrD,QAAA,MAAM,MAAM,EAAE,MAkOb,CAAC;eAEa,MAAM"}

package/dist/dead-code-detector.js

@@ -1,9 +1,14 @@
 // src/dead-code-detector/index.ts
-import { readdirSync, readFileSync, statSync } from "node:fs";
+import { readdir, readFile, stat } from "node:fs/promises";
 import { extname as extname2, join, relative as relative2, resolve as resolve2 } from "node:path";
 
 // src/runtime/index.ts
 import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/index.ts
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {
   return arg.length > 0 && arg.startsWith("-");
@@ -16,7 +21,8 @@ function withinProjectPath(projectRoot, candidate) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
 }
 function withinProject(p) {
-  return withinProjectPath(process.cwd(), p) || relative(process.cwd(), p) === ".";
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative(cwd, p) === ".";
 }
 
 // src/dead-code-detector/index.ts
@@ -48,19 +54,21 @@ function readConfig(raw) {
     excludeDirs: Array.isArray(r["excludeDirs"]) ? r["excludeDirs"].filter((x) => typeof x === "string") : DEFAULTS.excludeDirs
   };
 }
-function gatherFiles(root, depth, cfg) {
+async function gatherFiles(root, depth, cfg) {
   const files = [];
-  function walk(dir, remaining) {
+  const excludeSet = new Set(cfg.excludeDirs);
+  async function walk(dir, remaining) {
     let entries;
     try {
-      entries = readdirSync(dir, { withFileTypes: true });
+      entries = await readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (remaining > 0 && !cfg.excludeDirs.includes(entry.name)) {
-          walk(join(dir, entry.name), remaining - 1);
+        if (remaining > 0 && !excludeSet.has(entry.name)) {
+          await walk(join(dir, entry.name), remaining - 1);
         }
       } else if (entry.isFile()) {
         const ext = extname2(entry.name).toLowerCase();
@@ -70,7 +78,7 @@ function gatherFiles(root, depth, cfg) {
       }
     }
   }
-  walk(resolve2(root), depth);
+  await walk(resolve2(root), depth);
   return files;
 }
 function stripNoise(content) {
@@ -139,24 +147,29 @@ function findUnusedSymbols(files) {
       }
     }
   }
+  suspicious.sort((a, b) => {
+    const fileCompare = a.file.localeCompare(b.file);
+    if (fileCompare !== 0) return fileCompare;
+    return a.line - b.line;
+  });
   return suspicious;
 }
-function scan(root, depth, cfg) {
-  const filePaths = gatherFiles(root, depth, cfg);
+async function scan(root, depth, cfg) {
+  const filePaths = await gatherFiles(root, depth, cfg);
   const files = [];
   for (const p of filePaths) {
     try {
-      const content = readFileSync(p, "utf-8");
+      const content = await readFile(p, "utf-8");
       files.push({ path: p, content, stripped: stripNoise(content) });
     } catch {
     }
   }
   return { findings: findUnusedSymbols(files), scannedFiles: files.length };
 }
-function resolveScanRoot(rawPath) {
+async function resolveScanRoot(rawPath) {
   const resolved = resolve2(process.cwd(), rawPath);
   try {
-    const stats = statSync(resolved);
+    const stats = await stat(resolved);
     if (!stats.isDirectory()) {
       return resolve2(resolved, "..");
     }
@@ -221,7 +234,7 @@ var plugin = {
       state.hookUnregister = null;
     }
     const cfg = readConfig(api.config.extensions?.["dead-code-detector"]);
-    const hook = (input) => {
+    const hook = async (input) => {
       if (!cfg.enabled) return;
       if (input.toolResult?.isError) return;
       const inp = input.toolInput ?? {};
@@ -231,10 +244,10 @@ var plugin = {
       const ext = sourcePath.includes(".") ? sourcePath.slice(sourcePath.lastIndexOf(".")).toLowerCase() : "";
       if (!cfg.extensions.includes(ext)) return;
       state.hookInvocationCount += 1;
-      const scanRoot = resolveScanRoot(sourcePath);
+      const scanRoot = await resolveScanRoot(sourcePath);
       let result;
       try {
-        result = scan(scanRoot, 1, cfg);
+        result = await scan(scanRoot, 1, cfg);
       } catch {
         state.errorCount += 1;
         return;
@@ -289,10 +302,10 @@ Consider removing the export if it is not part of the public API.`;
           return { ok: false, error: "scan path is outside the project root" };
         }
         state.scanCount += 1;
-        const scanRoot = resolveScanRoot(rawPath);
+        const scanRoot = await resolveScanRoot(rawPath);
         let result;
         try {
-          result = scan(scanRoot, depth, cfg);
+          result = await scan(scanRoot, depth, cfg);
         } catch (err) {
           state.errorCount += 1;
           return { ok: false, error: String(err) };

package/dist/dep-guard/index.d.ts

@@ -35,7 +35,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 export interface ParsedInstall {
     manager: string;
     packages: Array<{

package/dist/dep-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dep-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAmF/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC3D;AAKD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAmCrE;AA0CD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAyBzD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOvD;AAMD,QAAA,MAAM,MAAM,EAAE,MAwPb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dep-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAmFrD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC3D;AAKD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAmCrE;AA0CD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAyBzD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOvD;AAMD,QAAA,MAAM,MAAM,EAAE,MAwPb,CAAC;eAEa,MAAM"}

package/dist/dependency-vulnerability-gate/index.d.ts

@@ -27,7 +27,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/dependency-vulnerability-gate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dependency-vulnerability-gate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAuO/C,QAAA,MAAM,MAAM,EAAE,MAwMb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dependency-vulnerability-gate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA2RrD,QAAA,MAAM,MAAM,EAAE,MAwMb,CAAC;eAEa,MAAM"}