@wrongstack/plugins 0.295.0 → 0.295.1

package/dist/interface-contract-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/interface-contract-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AASrD,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAwID,QAAA,MAAM,MAAM,EAAE,MAuMb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/interface-contract-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AASrD,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAqLD,QAAA,MAAM,MAAM,EAAE,MAyNb,CAAC;eAEa,MAAM"}

package/dist/interface-contract-guard.js

@@ -4,6 +4,11 @@ import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 }
 
 // src/runtime/index.ts
 import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/index.ts
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {
   return arg.length > 0 && arg.startsWith("-");
@@ -74,7 +79,8 @@ var state = {
 var DEFAULTS = {
   enabled: false,
   extensions: [".ts", ".tsx"],
-  maxFindings: 50
+  maxFindings: 50,
+  maxFiles: 2e3
 };
 function readConfig(raw) {
   if (!raw || typeof raw !== "object") return { ...DEFAULTS };
@@ -82,7 +88,8 @@ function readConfig(raw) {
   return {
     enabled: r["enabled"] !== false,
     extensions: Array.isArray(r["extensions"]) ? r["extensions"].filter((x) => typeof x === "string") : DEFAULTS.extensions,
-    maxFindings: typeof r["maxFindings"] === "number" && r["maxFindings"] >= 1 && r["maxFindings"] <= 500 ? r["maxFindings"] : DEFAULTS.maxFindings
+    maxFindings: typeof r["maxFindings"] === "number" && r["maxFindings"] >= 1 && r["maxFindings"] <= 500 ? r["maxFindings"] : DEFAULTS.maxFindings,
+    maxFiles: typeof r["maxFiles"] === "number" && r["maxFiles"] >= 1 && r["maxFiles"] <= 5e4 ? Math.floor(r["maxFiles"]) : DEFAULTS.maxFiles
   };
 }
 function normalizeExtensions(exts) {
@@ -98,47 +105,60 @@ var INTERFACE_RE = /(?:export\s+)?interface\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
 function extractInterfaceNames(content) {
   const names = [];
   INTERFACE_RE.lastIndex = 0;
+  let searchedUpTo = 0;
+  let line = 1;
   for (const m of content.matchAll(INTERFACE_RE)) {
-    names.push({ name: m[1], line: content.slice(0, m.index).split(/\r?\n/).length });
+    const index = m.index ?? 0;
+    for (let i = searchedUpTo; i < index; i++) {
+      if (content.charCodeAt(i) === 10) line += 1;
+    }
+    searchedUpTo = index;
+    names.push({ name: m[1], line });
   }
   return names;
 }
-function hasImplementer(name, contents) {
-  const implRe = new RegExp(`(?:implements|satisfies|\\bas)\\s+${name}\\b`, "g");
-  for (const content of contents) {
-    if (implRe.test(content)) return true;
+var IMPLEMENTER_RE = /(?:implements|satisfies|\bas)\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
+function collectImplementedNames(content, into) {
+  IMPLEMENTER_RE.lastIndex = 0;
+  for (const m of content.matchAll(IMPLEMENTER_RE)) {
+    const name = m[1];
+    if (name) into.add(name);
   }
-  return false;
 }
 async function scanPath(rawPath, cfg) {
   const root = process.cwd();
   const resolved = isAbsolute2(rawPath) ? resolve2(rawPath) : resolve2(root, rawPath);
   const exts = normalizeExtensions(cfg.extensions);
-  const files = await collectSourceFilesAsync(resolved, { extensions: exts });
-  const contents = [];
+  const allFiles = await collectSourceFilesAsync(resolved, { extensions: exts });
+  const files = allFiles.slice(0, cfg.maxFiles);
+  const implemented = /* @__PURE__ */ new Set();
+  const declarations = [];
+  let scannedFiles = 0;
   for (const p of files) {
+    let content;
     try {
-      contents.push({ path: p, content: await readFile(p, "utf-8") });
+      content = await readFile(p, "utf-8");
     } catch {
+      continue;
     }
-  }
-  const allContentStrings = contents.map((c) => c.content);
-  const findings = [];
-  for (const { path, content } of contents) {
+    scannedFiles += 1;
+    collectImplementedNames(content, implemented);
     for (const { name, line } of extractInterfaceNames(content)) {
-      if (!hasImplementer(name, allContentStrings)) {
-        findings.push({
-          interfaceName: name,
-          file: relativePath(path),
-          line,
-          message: `interface "${name}" is declared but has no visible implementer`
-        });
-        if (findings.length >= cfg.maxFindings) break;
-      }
+      declarations.push({ name, line, file: p });
     }
+  }
+  const findings = [];
+  for (const { name, line, file } of declarations) {
+    if (implemented.has(name)) continue;
+    findings.push({
+      interfaceName: name,
+      file: relativePath(file),
+      line,
+      message: `interface "${name}" is declared but has no visible implementer`
+    });
     if (findings.length >= cfg.maxFindings) break;
   }
-  return { findings, scannedFiles: contents.length };
+  return { findings, scannedFiles, truncated: allFiles.length > files.length };
 }
 var plugin = {
   name: "interface-contract-guard",
@@ -157,6 +177,13 @@ var plugin = {
         default: [".ts", ".tsx"],
         description: "File extensions to scan."
       },
+      maxFiles: {
+        type: "number",
+        minimum: 1,
+        maximum: 5e4,
+        default: 2e3,
+        description: "Upper bound on files read per scan."
+      },
       maxFindings: {
         type: "number",
         minimum: 1,
@@ -240,7 +267,14 @@ If you changed member shapes, search the project for implementers/\`satisfies\`/
           ok: true,
           path: relativePath(resolve2(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
-          findings: result.findings
+          findings: result.findings,
+          // Say so when the corpus was cut short. A partial scan that
+          // reports "no findings" is not the same as a clean result, and
+          // the caller has no other way to tell the difference.
+          truncated: result.truncated,
+          ...result.truncated ? {
+            note: `Scan stopped at the maxFiles limit (${cfg.maxFiles}); results are partial. Raise \`maxFiles\` or scan a narrower path for full coverage.`
+          } : {}
         };
       }
     });

package/dist/knowledge-graph/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/knowledge-graph/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAQrD,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AA2HD,QAAA,MAAM,MAAM,EAAE,MA2Sb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/knowledge-graph/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AASrD,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AAiID,QAAA,MAAM,MAAM,EAAE,MA2Sb,CAAC;eAEa,MAAM"}

package/dist/knowledge-graph.js

@@ -1,6 +1,7 @@
 // src/knowledge-graph/index.ts
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { atomicWrite, ensureDir } from "@wrongstack/core/utils";
 var API_VERSION = "^0.1.10";
 var state = {
   facts: [],
@@ -52,11 +53,11 @@ function loadFacts(filePath) {
     return { facts: [], nextId: 1 };
   }
 }
-function persistFacts(filePath) {
+async function persistFacts(filePath) {
   if (!filePath) return true;
   try {
-    mkdirSync(dirname(filePath), { recursive: true });
-    writeFileSync(
+    await ensureDir(dirname(filePath));
+    await atomicWrite(
       filePath,
       JSON.stringify({ facts: state.facts, nextId: state.nextId }, null, 2)
     );
@@ -187,7 +188,7 @@ var plugin = {
         state.facts.push(fact);
         state.adds += 1;
         api.metrics.counter("adds");
-        const persisted = persistFacts(resolved);
+        const persisted = await persistFacts(resolved);
         return { ok: true, fact, persisted, totalFacts: state.facts.length };
       }
     });
@@ -247,7 +248,7 @@ var plugin = {
         if (removed === 0) return { ok: false, error: `no fact matches "${input.id}"` };
         state.removals += removed;
         api.metrics.counter("removals", removed);
-        const persisted = persistFacts(resolved);
+        const persisted = await persistFacts(resolved);
         return { ok: true, removed, persisted, totalFacts: state.facts.length };
       }
     });

package/dist/lint-gate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lint-gate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAQH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA8VrD,QAAA,MAAM,MAAM,EAAE,MA2Wb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lint-gate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAQH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA+VrD,QAAA,MAAM,MAAM,EAAE,MA2Wb,CAAC;eAEa,MAAM"}

package/dist/lint-gate.js

@@ -5,6 +5,108 @@ import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/bounded-map.ts
+var BoundedMap = class {
+  map = /* @__PURE__ */ new Map();
+  max;
+  ttlMs;
+  now;
+  /** Entries dropped to stay under `max`. Surfaced by plugin health(). */
+  evictions = 0;
+  constructor(options) {
+    const normalizedMax = Math.floor(options.max);
+    this.max = Number.isSafeInteger(normalizedMax) ? Math.max(1, normalizedMax) : 1;
+    this.ttlMs = options.ttlMs;
+    this.now = options.now ?? Date.now;
+  }
+  expired(entry) {
+    return this.ttlMs !== void 0 && this.now() - entry.storedAt > this.ttlMs;
+  }
+  get(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return void 0;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return void 0;
+    }
+    this.map.delete(key);
+    this.map.set(key, entry);
+    return entry.value;
+  }
+  /**
+   * Read without promoting the key to most-recently-used. Use for
+   * diagnostics that must not perturb the eviction order.
+   */
+  peek(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0 || this.expired(entry)) return void 0;
+    return entry.value;
+  }
+  has(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return false;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return false;
+    }
+    return true;
+  }
+  set(key, value) {
+    this.map.delete(key);
+    this.map.set(key, { value, storedAt: this.now() });
+    while (this.map.size > this.max) {
+      const coldest = this.map.keys().next().value;
+      if (coldest === void 0) break;
+      this.map.delete(coldest);
+      this.evictions += 1;
+    }
+    return this;
+  }
+  delete(key) {
+    return this.map.delete(key);
+  }
+  clear() {
+    this.map.clear();
+    this.evictions = 0;
+  }
+  get size() {
+    return this.map.size;
+  }
+  /** How many entries have been dropped to respect `max`, since the last clear. */
+  get evictionCount() {
+    return this.evictions;
+  }
+  /** Drop every expired entry. Cheap enough to call from a status tool. */
+  prune() {
+    if (this.ttlMs === void 0) return 0;
+    let removed = 0;
+    for (const [key, entry] of this.map) {
+      if (this.expired(entry)) {
+        this.map.delete(key);
+        removed += 1;
+      }
+    }
+    return removed;
+  }
+  /** Live (non-expired) entries, coldest first. */
+  *entries() {
+    for (const [key, entry] of this.map) {
+      if (!this.expired(entry)) yield [key, entry.value];
+    }
+  }
+  [Symbol.iterator]() {
+    return this.entries();
+  }
+};
+
+// src/runtime/index.ts
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+
+// src/lint-gate/index.ts
 var API_VERSION = "^0.1.10";
 var state = {
   /** Total PreToolUse invocations. */
@@ -42,7 +144,7 @@ var LINTER_PACKAGES = {
   biome: "@biomejs/biome",
   eslint: "eslint"
 };
-var linterCache = /* @__PURE__ */ new Map();
+var linterCache = new BoundedMap({ max: 32, ttlMs: 3e5 });
 function isInside(parent, candidate) {
   const rel = relative(parent, candidate);
   return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel);

package/dist/loop-breaker/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/loop-breaker/index.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAqQrD,QAAA,MAAM,MAAM,EAAE,MA+Yb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/loop-breaker/index.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAmSrD,QAAA,MAAM,MAAM,EAAE,MA+Yb,CAAC;eAEa,MAAM"}

package/dist/loop-breaker.js

@@ -66,16 +66,26 @@ function canonicalize(value) {
     return String(value);
   }
 }
-function sortKeys(value) {
-  if (Array.isArray(value)) return value.map(sortKeys);
-  if (value && typeof value === "object") {
+var CANONICALIZE_MAX_DEPTH = 12;
+function sortKeys(value, depth = 0, seen = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value !== "object") return value;
+  if (seen.has(value)) return "[circular]";
+  if (depth >= CANONICALIZE_MAX_DEPTH) {
+    return Array.isArray(value) ? `[array:${value.length}]` : "[deep-object]";
+  }
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return value.map((v) => sortKeys(v, depth + 1, seen));
+    }
     const out = {};
     for (const key of Object.keys(value).sort()) {
-      out[key] = sortKeys(value[key]);
+      out[key] = sortKeys(value[key], depth + 1, seen);
     }
     return out;
+  } finally {
+    seen.delete(value);
   }
-  return value;
 }
 function fingerprint(toolName, toolInput) {
   return `${toolName}\0${canonicalize(toolInput)}`;

package/dist/migration-planner.js

@@ -50,6 +50,9 @@ async function runOptionalPluginLlm(request) {
   }
 }
 
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
 // src/runtime/index.ts
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {

package/dist/notify-hub/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/notify-hub/index.ts"],"names":[],"mappings":"AAyDA,OAAO,KAAK,EAAU,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA8N7D,QAAA,MAAM,MAAM,EAAE,MAwRb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/notify-hub/index.ts"],"names":[],"mappings":"AAyDA,OAAO,KAAK,EAAU,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAiP7D,QAAA,MAAM,MAAM,EAAE,MAwRb,CAAC;eAEa,MAAM"}

package/dist/notify-hub.js

@@ -1,6 +1,35 @@
 // src/notify-hub/index.ts
 import { lookup } from "node:dns/promises";
 
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/safe-json.ts
+var UNSERIALIZABLE = "[unserializable]";
+function safeJsonStringify(value, indent) {
+  try {
+    const stack = [];
+    const out = JSON.stringify(
+      value,
+      function replacer(_key, val) {
+        if (typeof val === "bigint") return `${val.toString()}n`;
+        if (val === null || typeof val !== "object") return val;
+        while (stack.length > 0 && stack[stack.length - 1] !== this) stack.pop();
+        if (stack.includes(val)) return "[circular]";
+        stack.push(val);
+        return val;
+      },
+      indent
+    );
+    return out ?? String(value);
+  } catch {
+    return UNSERIALIZABLE;
+  }
+}
+
+// src/runtime/index.ts
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+
 // src/notify-hub/webhook-channel.ts
 function freshCircuit() {
   return { open: false, consecutiveFailures: 0 };
@@ -202,13 +231,21 @@ async function deliver(event, payload) {
   }
   const result = await deliverViaChannel(ch, event, {
     title: typeof payload.title === "string" ? payload.title : event,
-    body: typeof payload.message === "string" ? payload.message : typeof payload.error === "string" ? payload.error : JSON.stringify(payload),
+    body: typeof payload.message === "string" ? payload.message : typeof payload.error === "string" ? payload.error : safeJsonStringify(payload),
     level: event === "tool.error" || event === "budget.threshold" ? "warning" : "info",
     source: event,
     metadata: payload
   });
   return result.ok;
 }
+function deliverDetached(event, payload) {
+  deliver(event, payload).catch((err) => {
+    _pluginLog?.warn("notify-hub: notification delivery failed", {
+      event,
+      error: err instanceof Error ? err.message : String(err)
+    });
+  });
+}
 async function deliverViaChannel(ch, event, msg) {
   const result = await ch.deliver(msg);
   if (result.ok) {
@@ -317,7 +354,7 @@ var plugin = {
     }
     if (active && cfg.events.includes("session.stop")) {
       const stopHook = (input) => {
-        void deliver("session.stop", {
+        deliverDetached("session.stop", {
           sessionId: input.sessionId ?? null,
           cwd: input.cwd ?? null
         });
@@ -328,7 +365,7 @@ var plugin = {
       const off = api.onPattern("tool.*", (eventName, payload) => {
         if (!/error|failed/.test(eventName)) return;
         const p = payload;
-        void deliver("tool.error", {
+        deliverDetached("tool.error", {
           tool: p?.tool ?? p?.name ?? "unknown",
           busEvent: eventName,
           error: truncateText(
@@ -342,7 +379,7 @@ var plugin = {
     if (active && cfg.events.includes("budget.threshold")) {
       const off = api.onPattern("budget.*", (eventName, payload) => {
         if (!eventName.includes("threshold")) return;
-        void deliver("budget.threshold", { busEvent: eventName, detail: payload });
+        deliverDetached("budget.threshold", { busEvent: eventName, detail: payload });
       });
       state.eventUnsubscribers.push(off);
     }

package/dist/prompt-firewall/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/prompt-firewall/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAa,MAAM,wBAAwB,CAAC;AA+BhE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAcxE;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAWjG;AA0CD,KAAK,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEhD,UAAU,oBAAoB;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CA0B7D;AAgCD,QAAA,MAAM,MAAM,EAAE,MAkNb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/prompt-firewall/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAa,MAAM,wBAAwB,CAAC;AA2EhE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAcxE;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAWjG;AA0CD,KAAK,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEhD,UAAU,oBAAoB;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CA0B7D;AAgCD,QAAA,MAAM,MAAM,EAAE,MAkNb,CAAC;eAEa,MAAM"}

package/dist/prompt-firewall.js

@@ -1,23 +1,152 @@
+// src/runtime/credential-patterns.ts
+var CREDENTIAL_PATTERNS = [
+  // LLM provider keys
+  {
+    type: "anthropic_key",
+    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g
+  },
+  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?!ant)(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g },
+  // GitHub. `ghp_` is only the personal-access-token prefix — the OAuth
+  // (`gho_`), user-to-server (`ghu_`), server-to-server (`ghs_`) and
+  // refresh (`ghr_`) tokens grant the same or broader access and were
+  // previously not detected at all.
+  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g },
+  {
+    type: "github_oauth_token",
+    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g
+  },
+  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g },
+  // GitLab
+  { type: "gitlab_pat", regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  {
+    type: "gitlab_runner_token",
+    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  // npm — a leaked publish token is a supply-chain compromise.
+  { type: "npm_token", regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g },
+  // AWS
+  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g },
+  // GCP
+  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g },
+  // Slack. `xoxe` (token-rotation) and `xapp` (app-level) were missing;
+  // both are as sensitive as the bot/user tokens already covered.
+  {
+    type: "slack_token",
+    regex: /(?<![A-Za-z0-9-])xox[abposer]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g
+  },
+  { type: "slack_app_token", regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g },
+  {
+    type: "slack_webhook",
+    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g
+  },
+  // Stripe
+  {
+    type: "stripe_key",
+    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g
+  },
+  // Twilio
+  { type: "twilio_sid", regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g },
+  // Telegram
+  {
+    type: "telegram_bot_token",
+    regex: /(?:(?<![A-Za-z0-9_])|(?<=(?:^|[^A-Za-z0-9_])bot))\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  // JWT
+  {
+    type: "jwt",
+    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g
+  },
+  // Private keys
+  {
+    type: "private_key",
+    regex: /(?:^|\n)(?:-----BEGIN (?:RSA|EC|OPENSSH|DSA)? ?PRIVATE KEY-----[\s\S]*?-----END (?:RSA|EC|OPENSSH|DSA)? ?PRIVATE KEY-----|-----BEGIN PGP PRIVATE KEY BLOCK-----[\s\S]*?-----END PGP PRIVATE KEY BLOCK-----)(?!\S)/g
+  },
+  // AI/ML provider tokens
+  { type: "huggingface_token", regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g },
+  { type: "replicate_token", regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "perplexity_key", regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "groq_key", regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  // SaaS / infrastructure tokens — each grants API access on the user's
+  // account, and each was previously invisible to this gate.
+  { type: "sendgrid_key", regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  { type: "digitalocean_token", regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g },
+  { type: "doppler_token", regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "shopify_token", regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g },
+  { type: "docker_pat", regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  { type: "linear_key", regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g },
+  { type: "atlassian_token", regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g },
+  { type: "square_token", regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g },
+  {
+    type: "azure_storage_key",
+    regex: /AccountKey=[A-Za-z0-9+/]{80,}={0,2}/g
+  },
+  {
+    type: "google_oauth_client_secret",
+    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+  },
+  // Bearer tokens
+  {
+    type: "bearer_token",
+    regex: /(?<![A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?![A-Za-z0-9._~+/-])/g
+  },
+  // Database URIs. Require password-bearing user-info; credential-free values stay scannable.
+  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
+  {
+    type: "postgres_uri",
+    // Query parsers decode percent-encoded parameter names. Recognize each
+    // encoded character in `password` so mixed forms such as `pass%77ord`
+    // cannot bypass detection while keeping the scan strictly bounded.
+    regex: /postgres(?:ql)?:\/\/(?:[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+|[^&\s?"'`#]{1,2048}\?(?:(?!(?:p|%70)(?:a|%61)(?:s|%73)(?:s|%73)(?:w|%77)(?:o|%6[fF])(?:r|%72)(?:d|%64)=)[^&\s#"'`]{1,256}&){0,32}(?:p|%70)(?:a|%61)(?:s|%73)(?:s|%73)(?:w|%77)(?:o|%6[fF])(?:r|%72)(?:d|%64)=[^&\s#"'`]{1,4096})/g
+  },
+  { type: "mysql_uri", regex: /mysql:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
+  { type: "redis_uri", regex: /redis:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g }
+];
+function cloneCredentialPatterns() {
+  return CREDENTIAL_PATTERNS.map((p) => ({
+    type: p.type,
+    regex: new RegExp(p.regex.source, p.regex.flags)
+  }));
+}
+
 // src/prompt-firewall/index.ts
-var PATTERNS = [
-  { kind: "aws-access-key", re: /\bAKIA[0-9A-Z]{16}\b/g },
+var KIND_ALIASES = {
+  aws_access_key: "aws-access-key",
+  private_key: "private-key-block",
+  github_pat: "github-token",
+  github_oauth_token: "github-token",
+  openai_key: "openai-key",
+  anthropic_key: "anthropic-key",
+  slack_token: "slack-token",
+  gcp_key: "google-api-key",
+  bearer_token: "bearer-token"
+};
+var EXTRA_PATTERNS = [
   {
+    // AWS secret access keys have no prefix — only a 40-char base64-ish
+    // shape — so they need a nearby `aws`/`secret` mention to be worth
+    // acting on.
+    //
+    // The previous spelling required the word "aws" to appear AFTER the
+    // key and wrapped the run in `\b`. Both are wrong: the real layout is
+    // `AWS_SECRET_ACCESS_KEY=<key>` (context first), and a `\b` cannot
+    // hold next to the `+` or `/` that base64 keys routinely end with. The
+    // pattern therefore never fired on a real key. Anchor on the context
+    // token instead and let the key follow it.
     kind: "aws-secret-key",
-    re: /\b(?<![A-Za-z0-9/+])[A-Za-z0-9/+]{40}(?![A-Za-z0-9/+])\b(?=.*aws)/gi
+    re: /(?:aws|amazon)[A-Za-z0-9_-]*(?:secret|key)[A-Za-z0-9_-]*\s*[:=]\s*['"]?([A-Za-z0-9/+]{40})(?![A-Za-z0-9/+])/gi
   },
-  { kind: "private-key-block", re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/g },
-  { kind: "github-token", re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
-  { kind: "openai-key", re: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g },
-  { kind: "anthropic-key", re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
-  { kind: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
-  { kind: "google-api-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
-  { kind: "jwt", re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
-  { kind: "bearer-token", re: /\bBearer\s+[A-Za-z0-9._-]{20,}\b/g },
   {
     kind: "generic-secret-assignment",
     re: /\b(?:api[_-]?key|secret|password|passwd|token)\s*[:=]\s*['"]?[A-Za-z0-9._/+-]{12,}['"]?/gi
   }
 ];
+var PATTERNS = [
+  ...cloneCredentialPatterns().map((p) => ({
+    kind: KIND_ALIASES[p.type] ?? p.type,
+    re: p.regex
+  })),
+  ...EXTRA_PATTERNS
+];
 function detectSecrets(text, allow) {
   const counts = /* @__PURE__ */ new Map();
   for (const p of PATTERNS) {

package/dist/refactor-suggester/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/refactor-suggester/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AASrD,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,aAAa,CAAC;AAElB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAgOD,QAAA,MAAM,MAAM,EAAE,MAoOb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/refactor-suggester/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AASrD,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,aAAa,CAAC;AASlB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AA8PD,QAAA,MAAM,MAAM,EAAE,MAwOb,CAAC;eAEa,MAAM"}