@wrongstack/plugins 0.293.0 → 0.295.1

package/dist/generated-plugin-exports.d.ts

@@ -0,0 +1,65 @@
+export { default as accessibilityAuditorPlugin } from './accessibility-auditor/index.js';
+export { default as agentHandoffPlugin } from './agent-handoff/index.js';
+export { default as apiCompatibilityGatePlugin } from './api-compatibility-gate/index.js';
+export { default as autoDocPlugin } from './auto-doc/index.js';
+export { default as autoEscalatePlugin } from './auto-escalate/index.js';
+export { default as autoI18nExtractorPlugin } from './auto-i18n-extractor/index.js';
+export { default as branchGuardPlugin } from './branch-guard/index.js';
+export { default as changelogWriterPlugin } from './changelog-writer/index.js';
+export { default as checkpointPlugin } from './checkpoint/index.js';
+export { default as codeMetricsPlugin } from './code-metrics/index.js';
+export { default as commitValidatorPlugin } from './commit-validator/index.js';
+export { default as configValidatorPlugin } from './config-validator/index.js';
+export { default as contextPinsPlugin } from './context-pins/index.js';
+export { default as costTrackerPlugin } from './cost-tracker/index.js';
+export { default as cronPlugin } from './cron/index.js';
+export { default as deadCodeDetectorPlugin } from './dead-code-detector/index.js';
+export { default as depGuardPlugin } from './dep-guard/index.js';
+export { default as dependencyVulnerabilityGatePlugin } from './dependency-vulnerability-gate/index.js';
+export { default as diffSummaryPlugin } from './diff-summary/index.js';
+export { default as docSyncGuardPlugin } from './doc-sync-guard/index.js';
+export { default as duplicateCodeDetectorPlugin } from './duplicate-code-detector/index.js';
+export { default as errorLensPlugin } from './error-lens/index.js';
+export { default as featureFlagTrackerPlugin } from './feature-flag-tracker/index.js';
+export { default as fileWatcherPlugin } from './file-watcher/index.js';
+export { default as formatOnSavePlugin } from './format-on-save/index.js';
+export { default as gitAutocommitPlugin } from './git-autocommit/index.js';
+export { default as importOrganizerPlugin } from './import-organizer/index.js';
+export { default as injectionShieldPlugin } from './injection-shield/index.js';
+export { default as interfaceContractGuardPlugin } from './interface-contract-guard/index.js';
+export { default as knowledgeGraphPlugin } from './knowledge-graph/index.js';
+export { default as licenseAuditGatePlugin } from './license-audit-gate/index.js';
+export { default as lintGatePlugin } from './lint-gate/index.js';
+export { default as llmCachePlugin } from './llm-cache/index.js';
+export { default as loopBreakerPlugin } from './loop-breaker/index.js';
+export { default as migrationPlannerPlugin } from './migration-planner/index.js';
+export { default as modelRouterPlugin } from './model-router/index.js';
+export { default as notifyHubPlugin } from './notify-hub/index.js';
+export { default as pathGuardPlugin } from './path-guard/index.js';
+export { default as performanceRegressionGatePlugin } from './performance-regression-gate/index.js';
+export { default as pluginStackObserverPlugin } from './plugin-stack-observer/index.js';
+export { default as prDrafterPlugin } from './pr-drafter/index.js';
+export { default as processGuardPlugin } from './process-guard/index.js';
+export { default as promptFirewallPlugin } from './prompt-firewall/index.js';
+export { default as refactorSuggesterPlugin } from './refactor-suggester/index.js';
+export { default as releaseNotesGeneratorPlugin } from './release-notes-generator/index.js';
+export { default as schemaEvolutionGuardPlugin } from './schema-evolution-guard/index.js';
+export { default as secretScannerPlugin } from './secret-scanner/index.js';
+export { default as securityHotspotScannerPlugin } from './security-hotspot-scanner/index.js';
+export { default as semanticSearchIndexerPlugin } from './semantic-search-indexer/index.js';
+export { default as semverBumpPlugin } from './semver-bump/index.js';
+export { default as sessionRecapPlugin } from './session-recap/index.js';
+export { default as shellCheckPlugin } from './shell-check/index.js';
+export { default as smartRenamePlugin } from './smart-rename/index.js';
+export { default as specLinkerPlugin } from './spec-linker/index.js';
+export { default as templateEnginePlugin } from './template-engine/index.js';
+export { default as testCoverageGatePlugin } from './test-coverage-gate/index.js';
+export { default as testFlakeDetectorPlugin } from './test-flake-detector/index.js';
+export { default as testGeneratorPlugin } from './test-generator/index.js';
+export { default as testRunnerGatePlugin } from './test-runner-gate/index.js';
+export { default as todoListenerPlugin } from './todo-listener/index.js';
+export { default as todoTrackerPlugin } from './todo-tracker/index.js';
+export { default as tokenBudgetPlugin } from './token-budget/index.js';
+export { default as tokenThrottlePlugin } from './token-throttle/index.js';
+export { default as typeGatePlugin } from './type-gate/index.js';
+//# sourceMappingURL=generated-plugin-exports.d.ts.map

package/dist/generated-plugin-exports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-plugin-exports.d.ts","sourceRoot":"","sources":["../src/generated-plugin-exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,OAAO,IAAI,iCAAiC,EAAE,MAAM,0CAA0C,CAAC;AACxG,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,OAAO,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,OAAO,IAAI,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,OAAO,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/git-autocommit/index.d.ts

@@ -9,7 +9,7 @@
  * - For staging: use `git_autocommit` with `files` (it stages automatically), or `bash` with `git add`.
  * - For status: use the built-in `git` tool with `command: "status"` or `command: "diff"`.
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/git-autocommit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/git-autocommit/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAoT/C,QAAA,MAAM,MAAM,EAAE,MAsXb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/git-autocommit/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAoTrD,QAAA,MAAM,MAAM,EAAE,MAsXb,CAAC;eAEa,MAAM"}

package/dist/import-organizer/index.d.ts

@@ -44,7 +44,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core';
+import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/import-organizer/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/import-organizer/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAoR/C,QAAA,MAAM,MAAM,EAAE,MA8Nb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/import-organizer/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAiXrD,QAAA,MAAM,MAAM,EAAE,MA8Nb,CAAC;eAEa,MAAM"}

package/dist/import-organizer.js

@@ -1,10 +1,72 @@
 // src/import-organizer/index.ts
 import { spawn } from "node:child_process";
 import { existsSync, statSync } from "node:fs";
-import { basename as basename2, isAbsolute as isAbsolute2 } from "node:path";
+import { basename as basename2, isAbsolute as isAbsolute3 } from "node:path";
+
+// src/runtime/index.ts
+import { basename, extname as extname2, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
+
+// src/runtime/local-bin.ts
+import { createRequire } from "node:module";
+import { delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { accessSync, constants, readFileSync } from "node:fs";
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+function resolveExecInvocation(command, args = []) {
+  const resolved = resolveWin32Command(command);
+  const normalizedResolved = resolved.toLowerCase();
+  const needsShell = process.platform === "win32" && (normalizedResolved.endsWith(".cmd") || normalizedResolved.endsWith(".bat"));
+  if (needsShell) {
+    const shim = buildWin32CmdShimInvocation(resolved, args);
+    return { cmd: shim.command, args: shim.args, windowsVerbatimArguments: true };
+  }
+  return { cmd: resolved, args: [...args], windowsVerbatimArguments: false };
+}
+function isInside(parent, candidate) {
+  const rel = relative(parent, candidate);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel);
+}
+var binCache = /* @__PURE__ */ new Map();
+var BIN_CACHE_MAX = 64;
+var NEGATIVE_BIN_CACHE_TTL_MS = 5e3;
+function cachePut(key, value) {
+  while (binCache.size >= BIN_CACHE_MAX) {
+    const oldest = binCache.keys().next().value;
+    if (oldest === void 0) break;
+    binCache.delete(oldest);
+  }
+  binCache.set(key, { value, cachedAt: Date.now() });
+  return value;
+}
+function resolveNodeBin(packageName, binName, cwd, extraArgs = []) {
+  const key = `${packageName}|${binName}|${cwd}`;
+  const cached = binCache.get(key);
+  if (cached !== void 0) {
+    if (cached.value !== null || Date.now() - cached.cachedAt < NEGATIVE_BIN_CACHE_TTL_MS) {
+      return cached.value === null ? null : { ...cached.value, args: [cached.value.entry, ...extraArgs] };
+    }
+    binCache.delete(key);
+  }
+  let resolved = null;
+  try {
+    const requireFromProject = createRequire(resolve(cwd, "package.json"));
+    const packagePath = requireFromProject.resolve(`${packageName}/package.json`);
+    const packageJson = JSON.parse(readFileSync(packagePath, "utf-8"));
+    const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[binName] ?? Object.values(packageJson.bin ?? {})[0];
+    if (relativeBin && !isAbsolute(relativeBin)) {
+      const packageDir = dirname(packagePath);
+      const entry = resolve(packageDir, relativeBin);
+      if (isInside(packageDir, entry)) {
+        resolved = { cmd: process.execPath, args: [entry], entry };
+      }
+    }
+  } catch {
+    resolved = null;
+  }
+  cachePut(key, resolved);
+  return resolved === null ? null : { ...resolved, args: [resolved.entry, ...extraArgs] };
+}
 
 // src/runtime/index.ts
-import { basename, extname, isAbsolute, relative, resolve } from "node:path";
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {
   return arg.length > 0 && arg.startsWith("-");
@@ -12,12 +74,13 @@ function hasLeadingDash(arg) {
 function withinProjectPath(projectRoot, candidate) {
   if (candidate.length === 0 || candidate.length > 4096) return false;
   if (hasLeadingDash(candidate)) return false;
-  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(projectRoot, candidate);
-  const rel = relative(projectRoot, resolved);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+  const resolved = isAbsolute2(candidate) ? resolve2(candidate) : resolve2(projectRoot, candidate);
+  const rel = relative2(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
 }
 function withinProject(p) {
-  return withinProjectPath(process.cwd(), p) || relative(process.cwd(), p) === ".";
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative2(cwd, p) === ".";
 }
 
 // src/import-organizer/index.ts
@@ -29,23 +92,51 @@ var ALLOWED_FIRST_TOKENS = /* @__PURE__ */ new Set([
   "biome",
   "@biomejs/biome",
   "eslint",
+  "oxlint",
   "node"
   // Recognise a fully-qualified project-local path like
   // "./node_modules/.bin/biome"; basename check kicks in below.
 ]);
+var PACKAGE_RUNNERS = /* @__PURE__ */ new Set(["npx", "pnpm", "npm", "yarn"]);
+var LOCAL_BIN_PACKAGES = {
+  biome: { packageName: "@biomejs/biome", binName: "biome" },
+  "@biomejs/biome": { packageName: "@biomejs/biome", binName: "biome" },
+  eslint: { packageName: "eslint", binName: "eslint" },
+  oxlint: { packageName: "oxlint", binName: "oxlint" }
+};
+function resolveLocalToolCommand(tokens) {
+  if (tokens.length === 0) return null;
+  let i = 0;
+  if (PACKAGE_RUNNERS.has(tokens[i])) {
+    i++;
+    while (i < tokens.length && (tokens[i] === "exec" || tokens[i] === "dlx" || tokens[i] === "run")) {
+      i++;
+    }
+  }
+  const toolToken = tokens[i];
+  if (!toolToken) return null;
+  const rest = tokens.slice(i + 1);
+  const pkg = LOCAL_BIN_PACKAGES[toolToken];
+  if (!pkg) return null;
+  const local = resolveNodeBin(pkg.packageName, pkg.binName, process.cwd(), rest);
+  if (!local) return null;
+  return { cmd: local.cmd, args: local.args };
+}
 function resolveAllowedCommand(command) {
   const tokens = command.split(/\s+/).filter(Boolean);
   if (tokens.length === 0) return null;
   const head = tokens[0];
+  const local = ALLOWED_FIRST_TOKENS.has(head) ? resolveLocalToolCommand(tokens) : null;
+  if (local) return local;
   if (ALLOWED_FIRST_TOKENS.has(head)) {
     return { cmd: head, args: tokens.slice(1) };
   }
-  if (isAbsolute2(head)) {
+  if (isAbsolute3(head)) {
     if (!withinProject(head)) return null;
     const base = basename2(head);
     if (ALLOWED_FIRST_TOKENS.has(base)) return { cmd: head, args: tokens.slice(1) };
   }
-  if (!isAbsolute2(head) && withinProject(head)) {
+  if (!isAbsolute3(head) && withinProject(head)) {
     const base = basename2(head);
     if (ALLOWED_FIRST_TOKENS.has(base)) return { cmd: head, args: tokens.slice(1) };
   }
@@ -80,40 +171,70 @@ function readConfig(raw) {
     notifyFormatOnSave: r["notifyFormatOnSave"] !== false
   };
 }
+var MAX_CAPTURE_BYTES = 4 * 1024 * 1024;
 function runCommand(command, args, timeoutMs, cwd) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     let timedOut = false;
+    let settled = false;
+    const settle = (r) => {
+      if (settled) return;
+      settled = true;
+      resolve3(r);
+    };
     const stdoutChunks = [];
     const stderrChunks = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    const signal = AbortSignal.timeout(timeoutMs);
+    const onAbort = () => {
+      timedOut = true;
+      settle({ code: null, stdout: "", stderr: "", timedOut: true });
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
     let child;
+    let invocation;
     try {
-      child = spawn(command, args, {
+      invocation = resolveExecInvocation(command, args);
+    } catch {
+      signal.removeEventListener("abort", onAbort);
+      settle({ code: 127, stdout: "", stderr: "", timedOut: false });
+      return;
+    }
+    try {
+      child = spawn(invocation.cmd, invocation.args, {
         cwd,
         stdio: ["ignore", "pipe", "pipe"],
-        signal: AbortSignal.timeout(timeoutMs)
+        signal,
+        windowsHide: true,
+        ...invocation.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
       });
     } catch {
-      resolve2({ code: 127, stdout: "", stderr: "", timedOut: false });
+      signal.removeEventListener("abort", onAbort);
+      settle({ code: 127, stdout: "", stderr: "", timedOut: false });
       return;
     }
-    child.stdout?.on("data", (c) => stdoutChunks.push(c));
-    child.stderr?.on("data", (c) => stderrChunks.push(c));
+    child.stdout?.on("data", (c) => {
+      stdoutBytes += c.length;
+      if (stdoutBytes <= MAX_CAPTURE_BYTES) stdoutChunks.push(c);
+    });
+    child.stderr?.on("data", (c) => {
+      stderrBytes += c.length;
+      if (stderrBytes <= MAX_CAPTURE_BYTES) stderrChunks.push(c);
+    });
     child.on("error", () => {
-      resolve2({ code: 127, stdout: "", stderr: "", timedOut: false });
+      signal.removeEventListener("abort", onAbort);
+      settle({ code: 127, stdout: "", stderr: "", timedOut: false });
     });
     child.on("close", (code) => {
+      signal.removeEventListener("abort", onAbort);
       if (timedOut) return;
-      resolve2({
+      settle({
         code,
         stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
         stderr: Buffer.concat(stderrChunks).toString("utf-8"),
         timedOut: false
       });
     });
-    child.on("abort", () => {
-      timedOut = true;
-      resolve2({ code: null, stdout: "", stderr: "", timedOut: true });
-    });
   });
 }
 async function organizeImports(filePath, cfg, cwd) {

package/dist/index.d.ts

@@ -1,187 +1,8 @@
 /**
- * @wrongstack/plugins — Official WrongStack Plugin Suite
+ * @wrongstack/plugins — official plugin suite.
  *
- * Exported plugins (63 total; most use tools or lifecycle hooks, while
- * provider-wire plugins register a full AgentExtension
- * — wrapProviderRunner / onError — wrapping the provider call itself):
- *  1. auto-doc         — Auto-generates JSDoc/TSDoc (dryRun for preview)
- *  2. git-autocommit  — AI-powered commit messages (git_autocommit/status_summary removed)
- *  3. shell-check     — Runs shellcheck on files or directories (merged)
- *  4. cost-tracker    — Tracks LLM token usage and estimated cost per session
- *  5. file-watcher    — Watches project files and emits events on changes
- *  6. cron            — Schedules recurring tasks via extension hooks
- *  7. template-engine — Expands file templates with variable substitution
- *  8. semver-bump     — Conventional-commit-driven semver version bumps
- *  9. secret-scanner  — Pre+post-tool hooks that block, redact, or warn
- *                        about plaintext credentials flowing into/out of tools
- * 10. todo-tracker    — Persistent, project-scoped todo backlog that
- *                        survives across sessions
- * 11. token-budget    — Enforces a per-session token budget — warns at a
- *                        threshold and stops the agent loop when the limit is hit
- * 12. lint-gate       — Pre-tool hook that runs biome/eslint on would-be
- *                        file content before write or edit commits it
- * 13. branch-guard    — Pre-tool hook that blocks commits, pushes, and
- *                        merges to protected branches (default: main, master)
- * 14. diff-summary    — Post-tool hook that injects a compact git diff
- *                        into the LLM context after every write or edit
- * 15. commit-validator — Pre-tool hook that validates conventional-commit
- *                        format before git_autocommit or bash git commit runs
- * 16. format-on-save   — Post-tool hook that runs biome format --write
- *                        on the file after every write or edit
- * 17. test-runner-gate — Post-tool hook that runs the relevant test
- *                        file after every write or edit to a source file
- * 18. import-organizer — Post-tool hook that runs biome check --write --unsafe
- *                        on the file after write or edit, re-sorting imports
- *                        and applying safe fixes (falls back to eslint --fix)
- * 19. todo-listener   — Post-tool hook on `todo` that broadcasts the new list
- *                        to the project mailbox (api.mailbox.send) so other
- *                        agents can see what this one is working on
- * 20. session-recap   — Stop hook that posts a one-page session summary
- *                        (tokens, tool calls, commits, transcript tail) to
- *                        the project mailbox when the agent loop ends
- * 21. spec-linker     — Post-tool hook on write/edit that scans markdown
- *                        files for unlinked plugin references and surfaces
- *                        them to the LLM via additionalContext
- * 22. loop-breaker    — Pre-tool hook that detects runaway tool-call loops
- *                        (identical repeats + A-B-A-B oscillation), warns
- *                        the model, then blocks
- * 23. path-guard      — Pre-tool hook that blocks writes/edits/destructive
- *                        shell commands touching protected paths (lockfiles,
- *                        .env, .git, migrations)
- * 24. context-pins    — pin_add/pin_remove/pin_list tools + system prompt
- *                        contributor: pinned facts survive compaction and
- *                        persist across sessions
- * 25. checkpoint      — In-session file snapshots: auto-captures content
- *                        before write/edit; checkpoint_restore rolls any
- *                        file back to a pre-edit state
- * 26. error-lens      — Post-tool hook that distills failed command output
- *                        into a compact digest (error line + project stack
- *                        frames) and flags repeated failures
- * 27. dep-guard       — Pre-tool hook that supervises dependency installs:
- *                        deny list, typosquat lookalike warnings, unpinned
- *                        version warnings
- * 28. config-validator — Post-tool hook that validates JSON/JSONC/YAML/TOML
- *                        files right after write/edit and reports syntax
- *                        problems in the same turn
- * 29. notify-hub      — POSTs session events (stop, tool errors, budget
- *                        thresholds) and ad-hoc notify_send messages to a
- *                        configurable webhook
- * 30. changelog-writer — Collects session work (commits, edits, manual
- *                        notes) and writes Keep-a-Changelog entries under
- *                        [Unreleased] on demand
- * 31. injection-shield — Post-tool hook that scans tool output for
- *                        prompt-injection patterns and warns the model that
- *                        content is data, not instructions
- * 32. llm-cache       — wrapProviderRunner: caches identical deterministic
- *                        provider requests and short-circuits the call on a hit
- * 33. model-router    — wrapProviderRunner: routes each call to a different
- *                        model by declarative size/tool rules (within the provider)
- * 34. prompt-firewall — wrapProviderRunner: detects/redacts/blocks credential
- *                        leaks on the provider wire (warn/redact/block)
- * 35. auto-escalate   — onError: retries with the next model in an escalation
- *                        ladder on transient provider errors
- * 36. token-throttle  — wrapProviderRunner: rolling-window tokens/min budget
- *                        that delays provider calls to stay under a rate limit
- *
- * New plugins (2026-07 follow-up batch):
- * 37. duplicate-code-detector — Detects duplicate/similar code blocks across
- *                               source files using normalized-line fingerprints
- * 38. code-metrics           — Computes lines-of-code, comment ratio, function
- *                               count, and approximate cyclomatic complexity
- * 39. refactor-suggester     — Flags long functions, deep nesting, many
- *                               parameters, magic numbers, and console.log usage
- * 40. test-generator         — Generates framework-correct test files with an
- *                               optional behavior-focused api.llm pass
- * 41. release-notes-generator — Produces traceable notes with optional,
- *                               hash-preserving api.llm polish
- * 42. smart-rename           — Whole-word symbol rename with preview and
- *                               optional apply
- * 43. feature-flag-tracker   — Scans source files for feature-flag usage and
- *                               reports flag inventory
- * 44. interface-contract-guard — Warns when TypeScript interfaces change or
- *                               lack implementers
- *
- * Plugins 32–36 are OPT-IN (enabled:false by default) because they change
- * provider-call semantics.
- *
- * Removed (use the equivalent built-in tools instead — see
- * `DEPRECATED_PLUGIN_NAMES` in `packages/cli/src/wiring/plugins.ts`
- * for the loader-level migration warning):
- *  - web-search      → built-in `search` + `fetch`
- *  - json-path       → built-in `json` tool (action: query|validate|transform|merge)
- *
- * Usage in WrongStack config:
- * ```json
- * {
- *   "plugins": {
- *     "auto-doc": { "enabled": true },
- *     "git-autocommit": { "conventionalCommits": true }
- *   }
- * }
- * ```
+ * Public exports are generated from the typed manifest. Add or remove plugin
+ * identity in `src/manifest/index.ts`, then run `pnpm plugins:manifest:write`.
  */
-export { default as agentHandoffPlugin } from './agent-handoff/index.js';
-export { default as autoDocPlugin } from './auto-doc/index.js';
-export { default as autoEscalatePlugin } from './auto-escalate/index.js';
-export { default as branchGuardPlugin } from './branch-guard/index.js';
-export { default as changelogWriterPlugin } from './changelog-writer/index.js';
-export { default as checkpointPlugin } from './checkpoint/index.js';
-export { default as commitValidatorPlugin } from './commit-validator/index.js';
-export { default as configValidatorPlugin } from './config-validator/index.js';
-export { default as contextPinsPlugin } from './context-pins/index.js';
-export { default as costTrackerPlugin } from './cost-tracker/index.js';
-export { default as cronPlugin } from './cron/index.js';
-export { default as depGuardPlugin } from './dep-guard/index.js';
-export { default as diffSummaryPlugin } from './diff-summary/index.js';
-export { default as errorLensPlugin } from './error-lens/index.js';
-export { default as fileWatcherPlugin } from './file-watcher/index.js';
-export { default as formatOnSavePlugin } from './format-on-save/index.js';
-export { default as gitAutocommitPlugin } from './git-autocommit/index.js';
-export { default as importOrganizerPlugin } from './import-organizer/index.js';
-export { default as injectionShieldPlugin } from './injection-shield/index.js';
-export { default as knowledgeGraphPlugin } from './knowledge-graph/index.js';
-export { default as lintGatePlugin } from './lint-gate/index.js';
-export { default as llmCachePlugin } from './llm-cache/index.js';
-export { default as loopBreakerPlugin } from './loop-breaker/index.js';
-export { default as modelRouterPlugin } from './model-router/index.js';
-export { default as notifyHubPlugin } from './notify-hub/index.js';
-export { default as pathGuardPlugin } from './path-guard/index.js';
-export { default as processGuardPlugin } from './process-guard/index.js';
-export { default as pluginStackObserverPlugin } from './plugin-stack-observer/index.js';
-export { default as prDrafterPlugin } from './pr-drafter/index.js';
-export { default as promptFirewallPlugin } from './prompt-firewall/index.js';
-export { default as secretScannerPlugin } from './secret-scanner/index.js';
-export { default as semverBumpPlugin } from './semver-bump/index.js';
-export { default as sessionRecapPlugin } from './session-recap/index.js';
-export { default as shellCheckPlugin } from './shell-check/index.js';
-export { default as specLinkerPlugin } from './spec-linker/index.js';
-export { default as templateEnginePlugin } from './template-engine/index.js';
-export { default as testCoverageGatePlugin } from './test-coverage-gate/index.js';
-export { default as testRunnerGatePlugin } from './test-runner-gate/index.js';
-export { default as typeGatePlugin } from './type-gate/index.js';
-export { default as accessibilityAuditorPlugin } from './accessibility-auditor/index.js';
-export { default as apiCompatibilityGatePlugin } from './api-compatibility-gate/index.js';
-export { default as autoI18nExtractorPlugin } from './auto-i18n-extractor/index.js';
-export { default as codeMetricsPlugin } from './code-metrics/index.js';
-export { default as deadCodeDetectorPlugin } from './dead-code-detector/index.js';
-export { default as dependencyVulnerabilityGatePlugin } from './dependency-vulnerability-gate/index.js';
-export { default as docSyncGuardPlugin } from './doc-sync-guard/index.js';
-export { default as duplicateCodeDetectorPlugin } from './duplicate-code-detector/index.js';
-export { default as featureFlagTrackerPlugin } from './feature-flag-tracker/index.js';
-export { default as interfaceContractGuardPlugin } from './interface-contract-guard/index.js';
-export { default as licenseAuditGatePlugin } from './license-audit-gate/index.js';
-export { default as migrationPlannerPlugin } from './migration-planner/index.js';
-export { default as performanceRegressionGatePlugin } from './performance-regression-gate/index.js';
-export { default as refactorSuggesterPlugin } from './refactor-suggester/index.js';
-export { default as releaseNotesGeneratorPlugin } from './release-notes-generator/index.js';
-export { default as schemaEvolutionGuardPlugin } from './schema-evolution-guard/index.js';
-export { default as securityHotspotScannerPlugin } from './security-hotspot-scanner/index.js';
-export { default as semanticSearchIndexerPlugin } from './semantic-search-indexer/index.js';
-export { default as smartRenamePlugin } from './smart-rename/index.js';
-export { default as testFlakeDetectorPlugin } from './test-flake-detector/index.js';
-export { default as testGeneratorPlugin } from './test-generator/index.js';
-export { default as todoListenerPlugin } from './todo-listener/index.js';
-export { default as todoTrackerPlugin } from './todo-tracker/index.js';
-export { default as tokenBudgetPlugin } from './token-budget/index.js';
-export { default as tokenThrottlePlugin } from './token-throttle/index.js';
+export * from './generated-plugin-exports.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyHG;AAEH,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,iCAAiC,EAAE,MAAM,0CAA0C,CAAC;AACxG,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,OAAO,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,OAAO,IAAI,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AACpG,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,OAAO,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,OAAO,IAAI,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,OAAO,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,+BAA+B,CAAC"}