@wrongstack/plugins 0.295.0 → 0.295.1

package/dist/refactor-suggester.js

@@ -4,6 +4,105 @@ import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 }
 
 // src/runtime/index.ts
 import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/bounded-map.ts
+var BoundedMap = class {
+  map = /* @__PURE__ */ new Map();
+  max;
+  ttlMs;
+  now;
+  /** Entries dropped to stay under `max`. Surfaced by plugin health(). */
+  evictions = 0;
+  constructor(options) {
+    const normalizedMax = Math.floor(options.max);
+    this.max = Number.isSafeInteger(normalizedMax) ? Math.max(1, normalizedMax) : 1;
+    this.ttlMs = options.ttlMs;
+    this.now = options.now ?? Date.now;
+  }
+  expired(entry) {
+    return this.ttlMs !== void 0 && this.now() - entry.storedAt > this.ttlMs;
+  }
+  get(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return void 0;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return void 0;
+    }
+    this.map.delete(key);
+    this.map.set(key, entry);
+    return entry.value;
+  }
+  /**
+   * Read without promoting the key to most-recently-used. Use for
+   * diagnostics that must not perturb the eviction order.
+   */
+  peek(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0 || this.expired(entry)) return void 0;
+    return entry.value;
+  }
+  has(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return false;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return false;
+    }
+    return true;
+  }
+  set(key, value) {
+    this.map.delete(key);
+    this.map.set(key, { value, storedAt: this.now() });
+    while (this.map.size > this.max) {
+      const coldest = this.map.keys().next().value;
+      if (coldest === void 0) break;
+      this.map.delete(coldest);
+      this.evictions += 1;
+    }
+    return this;
+  }
+  delete(key) {
+    return this.map.delete(key);
+  }
+  clear() {
+    this.map.clear();
+    this.evictions = 0;
+  }
+  get size() {
+    return this.map.size;
+  }
+  /** How many entries have been dropped to respect `max`, since the last clear. */
+  get evictionCount() {
+    return this.evictions;
+  }
+  /** Drop every expired entry. Cheap enough to call from a status tool. */
+  prune() {
+    if (this.ttlMs === void 0) return 0;
+    let removed = 0;
+    for (const [key, entry] of this.map) {
+      if (this.expired(entry)) {
+        this.map.delete(key);
+        removed += 1;
+      }
+    }
+    return removed;
+  }
+  /** Live (non-expired) entries, coldest first. */
+  *entries() {
+    for (const [key, entry] of this.map) {
+      if (!this.expired(entry)) yield [key, entry.value];
+    }
+  }
+  [Symbol.iterator]() {
+    return this.entries();
+  }
+};
+
+// src/runtime/index.ts
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {
   return arg.length > 0 && arg.startsWith("-");
@@ -63,6 +162,7 @@ function matchesExtension(p, exts) {
 
 // src/refactor-suggester/index.ts
 var API_VERSION = "^0.1.10";
+var HOOK_WARNING_COOLDOWN_MS = 6e4;
 var state = {
   scanCount: 0,
   suggestionCount: 0,
@@ -70,7 +170,7 @@ var state = {
   warningCount: 0,
   errorCount: 0,
   hookUnregister: null,
-  lastHookWarning: /* @__PURE__ */ new Map()
+  lastHookWarning: new BoundedMap({ max: 512, ttlMs: HOOK_WARNING_COOLDOWN_MS })
 };
 var DEFAULTS = {
   enabled: false,
@@ -195,15 +295,26 @@ async function scanPath(rawPath, cfg) {
   const exts = normalizeExtensions(cfg.extensions);
   const files = await collectSourceFilesAsync(resolved, { extensions: exts });
   const suggestions = [];
+  let scannedFiles = 0;
+  let truncated = false;
   for (const p of files) {
     try {
       const content = await readFile(p, "utf-8");
+      scannedFiles += 1;
       suggestions.push(...detectSmells(p, content, cfg.rules));
-      if (suggestions.length >= cfg.maxSuggestions) break;
+      if (suggestions.length >= cfg.maxSuggestions) {
+        truncated = scannedFiles < files.length;
+        break;
+      }
     } catch {
     }
   }
-  return { suggestions: suggestions.slice(0, cfg.maxSuggestions), scannedFiles: files.length };
+  return {
+    suggestions: suggestions.slice(0, cfg.maxSuggestions),
+    scannedFiles,
+    discoveredFiles: files.length,
+    truncated
+  };
 }
 var plugin = {
   name: "refactor-suggester",
@@ -266,7 +377,7 @@ var plugin = {
       state.hookInvocationCount += 1;
       const now = Date.now();
       const lastWarning = state.lastHookWarning.get(sourcePath);
-      if (lastWarning !== void 0 && now - lastWarning < 6e4) return;
+      if (lastWarning !== void 0 && now - lastWarning < HOOK_WARNING_COOLDOWN_MS) return;
       const resolved = resolve2(process.cwd(), sourcePath);
       let content;
       try {
@@ -316,6 +427,10 @@ var plugin = {
           ok: true,
           path: relativePath(resolve2(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
+          discoveredFiles: result.discoveredFiles,
+          // Say so when the cap stopped the walk early: a partial scan
+          // that reports few findings must not read as a clean result.
+          truncated: result.truncated,
           suggestions: result.suggestions,
           rules: cfg.rules
         };

package/dist/runtime/bounded-map.d.ts

@@ -0,0 +1,86 @@
+/**
+ * @wrongstack/plugins — bounded key/value cache.
+ *
+ * Several plugins memoise per-path or per-model work in a module-scope
+ * `Map` that is only ever cleared at teardown. In a short test that is
+ * invisible; in a long session over a large repository it is a slow leak —
+ * one entry per file touched, per branch resolved, per model seen — held
+ * for the lifetime of the process.
+ *
+ * `BoundedMap` is a drop-in replacement for those maps: same `get`/`set`/
+ * `delete`/`clear`/`size` surface, plus a hard entry cap with
+ * least-recently-used eviction and an optional per-entry TTL. Nothing
+ * about the call sites has to change beyond the constructor.
+ *
+ * Why LRU rather than insertion-order eviction: the access pattern for
+ * these caches is "a few hot paths, a long tail of cold ones". Evicting by
+ * insertion order throws away the hot entries first, which is exactly
+ * backwards; re-reading a hot entry should keep it.
+ */
+export interface BoundedMapOptions {
+    /** Hard cap on retained entries. Must be a safe integer >= 1. */
+    max: number;
+    /**
+     * Optional per-entry lifetime in ms. An entry older than this is treated
+     * as absent by `get`/`has` and dropped on access. Omit for no expiry.
+     */
+    ttlMs?: number | undefined;
+    /** Clock injection point — tests override this instead of faking timers. */
+    now?: (() => number) | undefined;
+}
+export declare class BoundedMap<K, V> {
+    private readonly map;
+    private readonly max;
+    private readonly ttlMs;
+    private readonly now;
+    /** Entries dropped to stay under `max`. Surfaced by plugin health(). */
+    private evictions;
+    constructor(options: BoundedMapOptions);
+    private expired;
+    get(key: K): V | undefined;
+    /**
+     * Read without promoting the key to most-recently-used. Use for
+     * diagnostics that must not perturb the eviction order.
+     */
+    peek(key: K): V | undefined;
+    has(key: K): boolean;
+    set(key: K, value: V): this;
+    delete(key: K): boolean;
+    clear(): void;
+    get size(): number;
+    /** How many entries have been dropped to respect `max`, since the last clear. */
+    get evictionCount(): number;
+    /** Drop every expired entry. Cheap enough to call from a status tool. */
+    prune(): number;
+    /** Live (non-expired) entries, coldest first. */
+    entries(): IterableIterator<[K, V]>;
+    [Symbol.iterator](): IterableIterator<[K, V]>;
+}
+/**
+ * A `Set` with the same hard cap and LRU eviction as {@link BoundedMap}.
+ *
+ * Plugins use module-scope sets to remember "already reported" keys so a
+ * finding is surfaced once rather than on every scan. That set has to
+ * outlive a single scan, which is why it lives at module scope — but
+ * without a bound it grows one entry per distinct finding for the life of
+ * the process.
+ *
+ * Eviction means a very old key may eventually be reported a second time.
+ * That is the right trade: re-reporting a finding the user last saw
+ * thousands of findings ago is reasonable behaviour, whereas unbounded
+ * growth is not.
+ */
+export declare class BoundedSet<T> {
+    private readonly inner;
+    constructor(options: BoundedMapOptions);
+    has(value: T): boolean;
+    add(value: T): this;
+    delete(value: T): boolean;
+    clear(): void;
+    get size(): number;
+    /** How many entries have been dropped to respect `max`, since the last clear. */
+    get evictionCount(): number;
+    values(): IterableIterator<T>;
+    [Symbol.iterator](): IterableIterator<T>;
+}
+//# sourceMappingURL=bounded-map.d.ts.map

package/dist/runtime/bounded-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-map.d.ts","sourceRoot":"","sources":["../../src/runtime/bounded-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAClC;AAOD,qBAAa,UAAU,CAAC,CAAC,EAAE,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,wEAAwE;IACxE,OAAO,CAAC,SAAS,CAAK;IAEtB,YAAY,OAAO,EAAE,iBAAiB,EAKrC;IAED,OAAO,CAAC,OAAO;IAIf,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,SAAS,CAazB;IAED;;;OAGG;IACH,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,SAAS,CAI1B;IAED,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO,CAQnB;IAED,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAW1B;IAED,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO,CAEtB;IAED,KAAK,IAAI,IAAI,CAGZ;IAED,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,iFAAiF;IACjF,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,yEAAyE;IACzE,KAAK,IAAI,MAAM,CAUd;IAED,iDAAiD;IAChD,OAAO,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAInC;IAED,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAE5C;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,UAAU,CAAC,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAE5C,YAAY,OAAO,EAAE,iBAAiB,EAErC;IAED,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAErB;IAED,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAGlB;IAED,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAExB;IAED,KAAK,IAAI,IAAI,CAEZ;IAED,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,iFAAiF;IACjF,IAAI,aAAa,IAAI,MAAM,CAE1B;IAEA,MAAM,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAE7B;IAED,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAEvC;CACF"}

package/dist/runtime/credential-patterns.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @wrongstack/plugins — canonical credential-pattern table.
+ *
+ * Two plugins detect credentials, at different points in the pipeline:
+ *
+ *  - `secret-scanner` gates tool *input* and inspects tool *output*.
+ *  - `prompt-firewall` inspects the outgoing *provider request* (and the
+ *    response) so a credential sitting in context is not shipped to a
+ *    third party.
+ *
+ * They previously each carried their own pattern list. The lists drifted:
+ * one grew GitLab, npm, SendGrid and DigitalOcean coverage while the other
+ * did not, so which credentials were caught depended on which side of the
+ * pipeline they crossed. A credential is a credential — the two surfaces
+ * should never disagree about what one looks like.
+ *
+ * This module is the single source of truth. Adding a pattern here
+ * strengthens both surfaces at once.
+ *
+ * Style notes for new entries:
+ *  - Prefer explicit lookaround boundaries — `(?<![A-Za-z0-9])` /
+ *    `(?![A-Za-z0-9])` — over ``. `` is defined against word
+ *    characters, so it silently fails next to the `+`, `/` and `=` that
+ *    base64-shaped secrets routinely end with.
+ *  - Keep every group non-capturing (`(?:…)`). The combined regex maps a
+ *    capture-group index back to the pattern that fired; an inner group
+ *    shifts that mapping. `secret-scanner` compensates for user-supplied
+ *    patterns, but built-ins should not need it.
+ *  - Avoid unbounded `.*` lookarounds: these run on every provider
+ *    request, against the full context.
+ */
+/** One credential shape, with a stable machine-readable id. */
+export interface CredentialPattern {
+    /** Stable id, e.g. `github_pat`. Reported to users and in metrics. */
+    type: string;
+    /** Global-flagged matcher. */
+    regex: RegExp;
+}
+export declare const CREDENTIAL_PATTERNS: readonly CredentialPattern[];
+/** Fresh, independently-stateful copies (RegExp `lastIndex` is mutable). */
+export declare function cloneCredentialPatterns(): CredentialPattern[];
+//# sourceMappingURL=credential-patterns.d.ts.map

package/dist/runtime/credential-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-patterns.d.ts","sourceRoot":"","sources":["../../src/runtime/credential-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,mBAAmB,EAAE,SAAS,iBAAiB,EAwG3D,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,uBAAuB,IAAI,iBAAiB,EAAE,CAK7D"}

package/dist/runtime/index.d.ts

@@ -29,6 +29,9 @@
  * output parsing) stays in the plugin that owns that language.
  */
 export { parseLlmJsonObject, runOptionalPluginLlm, stripOuterMarkdownFence, type OptionalLlmRequest, type OptionalLlmResult, } from './llm.js';
+export { BoundedMap, BoundedSet, type BoundedMapOptions } from './bounded-map.js';
+export { UNSERIALIZABLE, safeJsonStringify } from './safe-json.js';
+export { clearLocalBinCache, findOnPath, resolveExecInvocation, resolveFirstNodeBin, resolveNodeBin, resolveWin32Command, type ExecInvocation, type ResolvedNodeBin, } from './local-bin.js';
 export type LanguageId = 'typescript' | 'javascript' | 'python' | 'go' | 'rust' | 'shell' | 'ruby' | 'java' | 'kotlin' | 'dotnet' | 'generic';
 export type PackageManagerId = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'pip' | 'poetry' | 'go' | 'cargo' | 'gem' | 'maven' | 'gradle' | 'dotnet' | 'none';
 export interface LanguageRuntime {

package/dist/runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAMH,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,UAAU,CAAC;AAElB,MAAM,MAAM,UAAU,GAClB,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,MAAM,gBAAgB,GACxB,KAAK,GACL,MAAM,GACN,MAAM,GACN,KAAK,GACL,KAAK,GACL,QAAQ,GACR,IAAI,GACJ,OAAO,GACP,KAAK,GACL,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,EAAE,EAAE,UAAU,CAAC;IACf;;;;OAIG;IACH,cAAc,EAAE,gBAAgB,CAAC;IACjC;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACzC;;;;;OAKG;IACH,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,wEAAwE;IACxE,UAAU,EAAE,OAAO,CAAC;CACrB;AAkDD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,cAAmB,GAC3B,MAAM,GAAG,IAAI,CAKf;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,cAAmB,GAC3B,eAAe,GAAG,IAAI,CAoExB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,SAAS,CAAC,CAmHpB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,YAAc,EAC9B,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAGhD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,eAAe,EACxB,WAAW,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI,CAWf;AAMD,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAyC/E;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAwCnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAEnE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAMH,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,UAAU,CAAC;AAIlB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,UAAU,GAClB,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,MAAM,gBAAgB,GACxB,KAAK,GACL,MAAM,GACN,MAAM,GACN,KAAK,GACL,KAAK,GACL,QAAQ,GACR,IAAI,GACJ,OAAO,GACP,KAAK,GACL,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,EAAE,EAAE,UAAU,CAAC;IACf;;;;OAIG;IACH,cAAc,EAAE,gBAAgB,CAAC;IACjC;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACzC;;;;;OAKG;IACH,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,wEAAwE;IACxE,UAAU,EAAE,OAAO,CAAC;CACrB;AAkDD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,cAAmB,GAC3B,MAAM,GAAG,IAAI,CAKf;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,cAAmB,GAC3B,eAAe,GAAG,IAAI,CAoExB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,SAAS,CAAC,CA+IpB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,YAAc,EAC9B,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAGhD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,eAAe,EACxB,WAAW,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI,CAWf;AAMD,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAyC/E;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAwCnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAEnE"}

package/dist/runtime/local-bin.d.ts

@@ -0,0 +1,120 @@
+/**
+ * @wrongstack/plugins — project-local binary resolution.
+ *
+ * Why this module exists
+ * ----------------------
+ * Several plugins need to run a Node CLI that ships with the project
+ * (`biome`, `eslint`, `tsc`, `vitest`, …). The obvious spelling —
+ * `execFile('npx', ['biome', …])` — is wrong in three separate ways:
+ *
+ *  1. **It does not run on Windows at all.** `npx`/`pnpm`/`npm` are
+ *     `.cmd` shims there, and `execFile`/`spawn` without a shell do not
+ *     consult `PATHEXT`. The call fails `ENOENT`, plugins swallow the
+ *     error as "tool not installed", and the feature silently no-ops on
+ *     every Windows machine.
+ *  2. **It is slow.** `npx` re-resolves the package on each invocation,
+ *     and for a missing package it may try to *download* one — on a hook
+ *     that fires after every write.
+ *  3. **It is a weaker sandbox.** The shim is a shell script; arguments
+ *     cross a `cmd.exe` boundary on Windows (the BatBadBut class).
+ *
+ * `lint-gate` and `test-flake-detector` already solved this locally by
+ * resolving the package's `bin` entry through `createRequire` and running
+ * it as `process.execPath <entry>`. That is the correct pattern: no shell,
+ * no shim, no network, identical on every platform. This module promotes
+ * that proven approach to a shared helper so every plugin gets it.
+ *
+ * Fallback: when the package is genuinely absent from the project,
+ * `resolveNodeBin` returns `null` and the caller decides whether to
+ * degrade gracefully or fall back to a PATH lookup via
+ * `resolveWin32Command` (exported here for that purpose).
+ */
+import { resolveWin32Command } from '@wrongstack/tools/win32';
+export { resolveWin32Command };
+/** A spawn-ready invocation, already adjusted for the host platform. */
+export interface ExecInvocation {
+    cmd: string;
+    args: string[];
+    /** Only ever true on the Windows `.cmd`/`.bat` shim path. */
+    windowsVerbatimArguments: boolean;
+}
+/**
+ * Turn a `(command, args)` pair into something `execFile`/`spawn` can
+ * actually launch on this platform.
+ *
+ * On Windows, `npx`/`npm`/`pnpm`/`biome`/`tsc`/… ship as `.cmd` wrappers.
+ * `execFile` and `spawn` without a shell ignore `PATHEXT`, so a bare
+ * `execFile('npx', …)` fails `ENOENT` — and because every plugin treats a
+ * spawn failure as "tool not installed", the feature silently no-ops on
+ * every Windows machine. This resolves the real path first and, for a
+ * `.cmd`/`.bat` shim, routes through `cmd.exe` with per-argument quoting
+ * and a metacharacter guard (the BatBadBut argument-injection class), so
+ * a dynamic path argument still cannot chain a second command.
+ *
+ * On non-Windows, and for real `.exe` binaries, this is a passthrough.
+ *
+ * Throws when an argument carries a `cmd.exe` metacharacter on the shim
+ * path — callers should treat that as "skip", never as "run anyway".
+ *
+ * Prefer {@link resolveNodeBin} when the target is a Node CLI that the
+ * project depends on: `node <bin-entry>` needs no shim at all.
+ */
+export declare function resolveExecInvocation(command: string, args?: readonly string[]): ExecInvocation;
+/**
+ * Locate `cmd` on `PATH`, or return `null` if it is not there.
+ *
+ * This is the existence check `resolveWin32Command` deliberately does not
+ * provide: that function returns its input unchanged when nothing matches,
+ * so a caller cannot distinguish "found `biome`" from "gave up and handed
+ * back the string `biome`". Treating the passthrough as success makes a
+ * missing tool look installed — the caller then spawns it, gets `ENOENT`,
+ * and (because plugins read a spawn failure as "not installed") silently
+ * does nothing while reporting itself healthy.
+ *
+ * Returns the resolved path on success. Walks `PATH` directly, applying
+ * `PATHEXT` suffixes on Windows for a bare name and checking the execute
+ * bit on POSIX.
+ */
+export declare function findOnPath(cmd: string): string | null;
+/** A resolved, directly-spawnable invocation. Never a shell or a shim. */
+export interface ResolvedNodeBin {
+    /** Always `process.execPath` — the Node binary running this process. */
+    cmd: string;
+    /** `[binEntryPath, ...extraArgs]`. */
+    args: string[];
+    /** Absolute path of the package's bin entry, for diagnostics. */
+    entry: string;
+}
+/** Drop every cached resolution. Call from `teardown()`. */
+export declare function clearLocalBinCache(): void;
+/**
+ * Resolve a project-local Node CLI to a `process.execPath <entry>`
+ * invocation.
+ *
+ * @param packageName npm package to resolve, e.g. `@biomejs/biome`.
+ * @param binName     which `bin` key to prefer when the package declares
+ *                    several. Falls back to the sole/first entry.
+ * @param cwd         project root whose `package.json` anchors resolution.
+ * @param extraArgs   arguments appended after the bin entry.
+ *
+ * Returns `null` when the package is not installed, declares no `bin`, or
+ * the declared entry escapes its own package directory (a tampered
+ * `package.json` must not become an arbitrary-file execution primitive).
+ */
+export declare function resolveNodeBin(packageName: string, binName: string, cwd: string, extraArgs?: readonly string[]): ResolvedNodeBin | null;
+/**
+ * Resolve the first installed package from `candidates`.
+ *
+ * Used by plugins that accept several equivalent tools (biome *or*
+ * eslint, vitest *or* jest) and want the first one the project actually
+ * has, without probing each with a subprocess.
+ */
+export declare function resolveFirstNodeBin(candidates: readonly {
+    packageName: string;
+    binName: string;
+    args?: readonly string[];
+}[], cwd: string): (ResolvedNodeBin & {
+    packageName: string;
+    binName: string;
+}) | null;
+//# sourceMappingURL=local-bin.d.ts.map

package/dist/runtime/local-bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-bin.d.ts","sourceRoot":"","sources":["../../src/runtime/local-bin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,OAAO,EAA+B,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE3F,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,6DAA6D;IAC7D,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,SAAS,MAAM,EAAO,GAC3B,cAAc,CAWhB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoCrD;AAED,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;CACf;AAqCD,4DAA4D;AAC5D,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,SAAS,MAAM,EAAO,GAChC,eAAe,GAAG,IAAI,CAwCxB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,SAAS;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACzF,GAAG,EAAE,MAAM,GACV,CAAC,eAAe,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAMrE"}

package/dist/runtime/safe-json.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @wrongstack/plugins — serialisation that cannot take the process down.
+ *
+ * Plugins routinely stringify values they did not construct: event-bus
+ * payloads, tool results, mailbox bodies. `JSON.stringify` throws on a
+ * circular reference and on `BigInt`, and several of these call sites sit
+ * inside detached (fire-and-forget) work where a throw becomes an
+ * unhandled rejection rather than a handled failure.
+ *
+ * `safeJsonStringify` never throws. A value it cannot represent is
+ * replaced with a marker, so the surrounding feature degrades to "this
+ * field is unreadable" instead of failing — or crashing — outright.
+ */
+/** Placeholder substituted for a value that cannot be serialised. */
+export declare const UNSERIALIZABLE = "[unserializable]";
+/**
+ * `JSON.stringify` with cycle handling and a total-failure fallback.
+ *
+ * @param value  anything
+ * @param indent passed through to `JSON.stringify` (e.g. `2` to pretty-print)
+ * @returns a JSON string, or a marker string when the value resists
+ *          serialisation entirely. Never throws.
+ */
+export declare function safeJsonStringify(value: unknown, indent?: number): string;
+//# sourceMappingURL=safe-json.d.ts.map

package/dist/runtime/safe-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-json.d.ts","sourceRoot":"","sources":["../../src/runtime/safe-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,qEAAqE;AACrE,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAyBzE"}