@wrongstack/plugins 0.293.0 → 0.295.1

package/dist/dependency-vulnerability-gate.js

@@ -1,6 +1,24 @@
 // src/dependency-vulnerability-gate/index.ts
-import { execFileSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { execFile } from "node:child_process";
+import { access } from "node:fs/promises";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+function resolveExecInvocation(command, args = []) {
+  const resolved = resolveWin32Command(command);
+  const normalizedResolved = resolved.toLowerCase();
+  const needsShell = process.platform === "win32" && (normalizedResolved.endsWith(".cmd") || normalizedResolved.endsWith(".bat"));
+  if (needsShell) {
+    const shim = buildWin32CmdShimInvocation(resolved, args);
+    return { cmd: shim.command, args: shim.args, windowsVerbatimArguments: true };
+  }
+  return { cmd: resolved, args: [...args], windowsVerbatimArguments: false };
+}
+
+// src/runtime/index.ts
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+
+// src/dependency-vulnerability-gate/index.ts
 var API_VERSION = "^0.1.10";
 var state = {
   invocations: 0,
@@ -112,26 +130,55 @@ function isInstallCommand(input) {
   const command = typeof ti["command"] === "string" ? ti["command"] : "";
   return INSTALL_RE.test(command);
 }
-function detectManager() {
-  return existsSync("pnpm-lock.yaml") ? "pnpm" : "npm";
+var LOCKFILE_MANAGERS = [
+  { file: "pnpm-lock.yaml", manager: "pnpm" },
+  { file: "bun.lockb", manager: "bun" },
+  { file: "bun.lock", manager: "bun" },
+  { file: "yarn.lock", manager: "yarn" },
+  { file: "package-lock.json", manager: "npm" }
+];
+async function detectManager() {
+  for (const { file, manager } of LOCKFILE_MANAGERS) {
+    try {
+      await access(file);
+      return manager;
+    } catch {
+    }
+  }
+  return "npm";
 }
-function runAudit(cfg) {
-  const manager = detectManager();
+async function runAudit(cfg) {
+  const manager = await detectManager();
   const start = Date.now();
-  let stdout = "";
+  let invocation;
   try {
-    stdout = execFileSync(manager, ["audit", "--json"], {
-      encoding: "utf-8",
-      timeout: cfg.timeoutMs,
-      cwd: process.cwd(),
-      stdio: ["pipe", "pipe", "pipe"],
-      shell: false
-    });
-  } catch (err) {
-    const e = err;
-    if (e.killed) return null;
-    stdout = e.stdout ?? "";
+    invocation = resolveExecInvocation(manager, ["audit", "--json"]);
+  } catch {
+    return null;
   }
+  const stdout = await new Promise((resolve) => {
+    execFile(
+      invocation.cmd,
+      invocation.args,
+      {
+        encoding: "utf8",
+        timeout: cfg.timeoutMs,
+        cwd: process.cwd(),
+        windowsHide: true,
+        maxBuffer: 10 * 1024 * 1024,
+        shell: false,
+        ...invocation.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
+      },
+      (error, output) => {
+        if (error && error.killed) {
+          resolve(null);
+          return;
+        }
+        resolve(output);
+      }
+    );
+  });
+  if (stdout === null) return null;
   const report = parseAuditJson(stdout);
   if (!report) return null;
   return { manager, report, durationMs: Date.now() - start };
@@ -186,14 +233,14 @@ var plugin = {
       state.hookUnregister = null;
     }
     const cfg = readConfig(api.config.extensions?.["dependency-vulnerability-gate"]);
-    const hook = (input) => {
+    const hook = async (input) => {
       if (!cfg.enabled) return;
       state.invocations += 1;
       if (input.toolResult?.isError) return;
       if (!isInstallCommand(input)) return;
       state.installsSeen += 1;
       api.metrics.counter("installs_seen");
-      const result = runAudit(cfg);
+      const result = await runAudit(cfg);
       if (!result) {
         state.errors += 1;
         return;

package/dist/diff-summary/index.d.ts

@@ -28,7 +28,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/diff-summary/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/diff-summary/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAwP/C,QAAA,MAAM,MAAM,EAAE,MA4Pb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/diff-summary/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA+PrD,QAAA,MAAM,MAAM,EAAE,MA4Pb,CAAC;eAEa,MAAM"}

package/dist/diff-summary.js

@@ -1,8 +1,107 @@
 // src/diff-summary/index.ts
-import { execFileSync } from "node:child_process";
+import { execFile } from "node:child_process";
 
 // src/runtime/index.ts
 import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/bounded-map.ts
+var BoundedMap = class {
+  map = /* @__PURE__ */ new Map();
+  max;
+  ttlMs;
+  now;
+  /** Entries dropped to stay under `max`. Surfaced by plugin health(). */
+  evictions = 0;
+  constructor(options) {
+    const normalizedMax = Math.floor(options.max);
+    this.max = Number.isSafeInteger(normalizedMax) ? Math.max(1, normalizedMax) : 1;
+    this.ttlMs = options.ttlMs;
+    this.now = options.now ?? Date.now;
+  }
+  expired(entry) {
+    return this.ttlMs !== void 0 && this.now() - entry.storedAt > this.ttlMs;
+  }
+  get(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return void 0;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return void 0;
+    }
+    this.map.delete(key);
+    this.map.set(key, entry);
+    return entry.value;
+  }
+  /**
+   * Read without promoting the key to most-recently-used. Use for
+   * diagnostics that must not perturb the eviction order.
+   */
+  peek(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0 || this.expired(entry)) return void 0;
+    return entry.value;
+  }
+  has(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return false;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return false;
+    }
+    return true;
+  }
+  set(key, value) {
+    this.map.delete(key);
+    this.map.set(key, { value, storedAt: this.now() });
+    while (this.map.size > this.max) {
+      const coldest = this.map.keys().next().value;
+      if (coldest === void 0) break;
+      this.map.delete(coldest);
+      this.evictions += 1;
+    }
+    return this;
+  }
+  delete(key) {
+    return this.map.delete(key);
+  }
+  clear() {
+    this.map.clear();
+    this.evictions = 0;
+  }
+  get size() {
+    return this.map.size;
+  }
+  /** How many entries have been dropped to respect `max`, since the last clear. */
+  get evictionCount() {
+    return this.evictions;
+  }
+  /** Drop every expired entry. Cheap enough to call from a status tool. */
+  prune() {
+    if (this.ttlMs === void 0) return 0;
+    let removed = 0;
+    for (const [key, entry] of this.map) {
+      if (this.expired(entry)) {
+        this.map.delete(key);
+        removed += 1;
+      }
+    }
+    return removed;
+  }
+  /** Live (non-expired) entries, coldest first. */
+  *entries() {
+    for (const [key, entry] of this.map) {
+      if (!this.expired(entry)) yield [key, entry.value];
+    }
+  }
+  [Symbol.iterator]() {
+    return this.entries();
+  }
+};
+
+// src/runtime/index.ts
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {
   return arg.length > 0 && arg.startsWith("-");
@@ -15,7 +114,8 @@ function withinProjectPath(projectRoot, candidate) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
 }
 function withinProject(p) {
-  return withinProjectPath(process.cwd(), p) || relative(process.cwd(), p) === ".";
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative(cwd, p) === ".";
 }
 
 // src/diff-summary/index.ts
@@ -63,37 +163,35 @@ function contentHash(s) {
   }
   return h >>> 0;
 }
-var pathMemo = /* @__PURE__ */ new Map();
-function getGitDiff(filePath, contextLines, cwd) {
-  const opts = {
-    encoding: "utf-8",
-    timeout: 3e3,
-    cwd,
-    stdio: ["pipe", "pipe", "pipe"]
-  };
-  let isTracked = false;
-  try {
-    execFileSync("git", ["ls-files", "--error-unmatch", "--", filePath], opts);
-    isTracked = true;
-  } catch {
-    isTracked = false;
-  }
+var pathMemo = new BoundedMap({ max: 512 });
+function runGit(args, cwd) {
+  return new Promise((resolveCommand) => {
+    execFile(
+      "git",
+      args,
+      {
+        encoding: "utf8",
+        timeout: 3e3,
+        cwd,
+        windowsHide: true,
+        maxBuffer: 5 * 1024 * 1024
+      },
+      (error, stdout) => resolveCommand({ ok: !error, stdout })
+    );
+  });
+}
+async function getGitDiff(filePath, contextLines, cwd) {
+  const tracked = await runGit(["ls-files", "--error-unmatch", "--", filePath], cwd);
+  const isTracked = tracked.ok;
   try {
     let rawDiff;
     const contextFlag = `-U${contextLines}`;
     if (isTracked) {
-      rawDiff = execFileSync("git", ["diff", contextFlag, "--", filePath], opts);
+      const result = await runGit(["diff", contextFlag, "--", filePath], cwd);
+      if (!result.ok) return null;
+      rawDiff = result.stdout;
     } else {
-      try {
-        rawDiff = execFileSync(
-          "git",
-          ["diff", "--no-index", contextFlag, "/dev/null", filePath],
-          opts
-        );
-      } catch (err) {
-        const e = err;
-        rawDiff = e.stdout ?? "";
-      }
+      rawDiff = (await runGit(["diff", "--no-index", contextFlag, "/dev/null", filePath], cwd)).stdout;
     }
     if (!rawDiff.trim()) {
       return { diff: "", added: 0, removed: 0, isNewFile: !isTracked };
@@ -185,7 +283,7 @@ var plugin = {
     pathMemo.clear();
     const cfg = readConfig(api.config.extensions?.["diff-summary"]);
     const cwd = typeof process.cwd === "function" ? process.cwd() : void 0;
-    const hook = (input) => {
+    const hook = async (input) => {
       if (cfg.mode === "off") return;
       if (input.toolResult?.isError) return;
       const toolName = input.toolName ?? "";
@@ -212,7 +310,7 @@ var plugin = {
           return;
         }
       }
-      const result = getGitDiff(filePath, cfg.includeContext, cwd);
+      const result = await getGitDiff(filePath, cfg.includeContext, cwd);
       if (!result) {
         state.fallbackCount += 1;
         return;

package/dist/doc-sync-guard/index.d.ts

@@ -25,7 +25,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/doc-sync-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/doc-sync-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA0I/C,QAAA,MAAM,MAAM,EAAE,MAuJb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/doc-sync-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA0IrD,QAAA,MAAM,MAAM,EAAE,MAuJb,CAAC;eAEa,MAAM"}

package/dist/doc-sync-guard.js

@@ -3,6 +3,11 @@ import { basename as basename2, extname as extname2 } from "node:path";
 
 // src/runtime/index.ts
 import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/index.ts
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {
   return arg.length > 0 && arg.startsWith("-");
@@ -15,7 +20,8 @@ function withinProjectPath(projectRoot, candidate) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
 }
 function withinProject(p) {
-  return withinProjectPath(process.cwd(), p) || relative(process.cwd(), p) === ".";
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative(cwd, p) === ".";
 }
 
 // src/doc-sync-guard/index.ts

package/dist/duplicate-code-detector/index.d.ts

@@ -25,7 +25,32 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
+/**
+ * Tunable budgets that bound the hook fingerprint index. Keeping the defaults
+ * together makes the file, fingerprint, and byte limits explicit.
+ */
+export declare const hookIndexBudgets: {
+    /** Max number of files retained in the hook fingerprint index (LRU-evicted). */
+    maxFiles: number;
+    /** Max total fingerprints across the whole index (running-sum enforced, LRU-evicted). */
+    maxFingerprints: number;
+    /**
+     * Max candidate windows hashed and cached per file by the advisory hook. The
+     * on-demand detect_duplicate_code tool intentionally scans every window.
+     */
+    maxFingerprintsPerFile: number;
+    /** Files larger than this are skipped entirely by the hook (never read/extracted/cached). */
+    maxFileBytes: number;
+};
+/**
+ * Compact 53-bit hash of a fingerprint string. The hook index can retain up to
+ * 300k fingerprints, where a 32-bit hash has a material birthday-collision risk
+ * and can emit a false duplicate warning. The result remains a JS-safe integer,
+ * so the index keeps the compact `Set<number>` representation instead of storing
+ * raw fingerprint text.
+ */
+export declare function hashFingerprint(fp: string): number;
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/duplicate-code-detector/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/duplicate-code-detector/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAiN/C,QAAA,MAAM,MAAM,EAAE,MAySb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/duplicate-code-detector/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA8FrD;;;GAGG;AACH,eAAO,MAAM,gBAAgB;IAC3B,gFAAgF;IAChF,QAAQ;IACR,yFAAyF;IACzF,eAAe;IACf;;;OAGG;IACH,sBAAsB;IACtB,6FAA6F;IAC7F,YAAY;CACb,CAAC;AAyGF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAelD;AA4HD,QAAA,MAAM,MAAM,EAAE,MA4Wb,CAAC;eAEa,MAAM"}