@wrongstack/plugins 0.295.0 → 0.296.2

package/dist/runtime/local-bin.d.ts

@@ -0,0 +1,120 @@
+/**
+ * @wrongstack/plugins — project-local binary resolution.
+ *
+ * Why this module exists
+ * ----------------------
+ * Several plugins need to run a Node CLI that ships with the project
+ * (`biome`, `eslint`, `tsc`, `vitest`, …). The obvious spelling —
+ * `execFile('npx', ['biome', …])` — is wrong in three separate ways:
+ *
+ *  1. **It does not run on Windows at all.** `npx`/`pnpm`/`npm` are
+ *     `.cmd` shims there, and `execFile`/`spawn` without a shell do not
+ *     consult `PATHEXT`. The call fails `ENOENT`, plugins swallow the
+ *     error as "tool not installed", and the feature silently no-ops on
+ *     every Windows machine.
+ *  2. **It is slow.** `npx` re-resolves the package on each invocation,
+ *     and for a missing package it may try to *download* one — on a hook
+ *     that fires after every write.
+ *  3. **It is a weaker sandbox.** The shim is a shell script; arguments
+ *     cross a `cmd.exe` boundary on Windows (the BatBadBut class).
+ *
+ * `lint-gate` and `test-flake-detector` already solved this locally by
+ * resolving the package's `bin` entry through `createRequire` and running
+ * it as `process.execPath <entry>`. That is the correct pattern: no shell,
+ * no shim, no network, identical on every platform. This module promotes
+ * that proven approach to a shared helper so every plugin gets it.
+ *
+ * Fallback: when the package is genuinely absent from the project,
+ * `resolveNodeBin` returns `null` and the caller decides whether to
+ * degrade gracefully or fall back to a PATH lookup via
+ * `resolveWin32Command` (exported here for that purpose).
+ */
+import { resolveWin32Command } from '@wrongstack/tools/win32';
+export { resolveWin32Command };
+/** A spawn-ready invocation, already adjusted for the host platform. */
+export interface ExecInvocation {
+    cmd: string;
+    args: string[];
+    /** Only ever true on the Windows `.cmd`/`.bat` shim path. */
+    windowsVerbatimArguments: boolean;
+}
+/**
+ * Turn a `(command, args)` pair into something `execFile`/`spawn` can
+ * actually launch on this platform.
+ *
+ * On Windows, `npx`/`npm`/`pnpm`/`biome`/`tsc`/… ship as `.cmd` wrappers.
+ * `execFile` and `spawn` without a shell ignore `PATHEXT`, so a bare
+ * `execFile('npx', …)` fails `ENOENT` — and because every plugin treats a
+ * spawn failure as "tool not installed", the feature silently no-ops on
+ * every Windows machine. This resolves the real path first and, for a
+ * `.cmd`/`.bat` shim, routes through `cmd.exe` with per-argument quoting
+ * and a metacharacter guard (the BatBadBut argument-injection class), so
+ * a dynamic path argument still cannot chain a second command.
+ *
+ * On non-Windows, and for real `.exe` binaries, this is a passthrough.
+ *
+ * Throws when an argument carries a `cmd.exe` metacharacter on the shim
+ * path — callers should treat that as "skip", never as "run anyway".
+ *
+ * Prefer {@link resolveNodeBin} when the target is a Node CLI that the
+ * project depends on: `node <bin-entry>` needs no shim at all.
+ */
+export declare function resolveExecInvocation(command: string, args?: readonly string[]): ExecInvocation;
+/**
+ * Locate `cmd` on `PATH`, or return `null` if it is not there.
+ *
+ * This is the existence check `resolveWin32Command` deliberately does not
+ * provide: that function returns its input unchanged when nothing matches,
+ * so a caller cannot distinguish "found `biome`" from "gave up and handed
+ * back the string `biome`". Treating the passthrough as success makes a
+ * missing tool look installed — the caller then spawns it, gets `ENOENT`,
+ * and (because plugins read a spawn failure as "not installed") silently
+ * does nothing while reporting itself healthy.
+ *
+ * Returns the resolved path on success. Walks `PATH` directly, applying
+ * `PATHEXT` suffixes on Windows for a bare name and checking the execute
+ * bit on POSIX.
+ */
+export declare function findOnPath(cmd: string): string | null;
+/** A resolved, directly-spawnable invocation. Never a shell or a shim. */
+export interface ResolvedNodeBin {
+    /** Always `process.execPath` — the Node binary running this process. */
+    cmd: string;
+    /** `[binEntryPath, ...extraArgs]`. */
+    args: string[];
+    /** Absolute path of the package's bin entry, for diagnostics. */
+    entry: string;
+}
+/** Drop every cached resolution. Call from `teardown()`. */
+export declare function clearLocalBinCache(): void;
+/**
+ * Resolve a project-local Node CLI to a `process.execPath <entry>`
+ * invocation.
+ *
+ * @param packageName npm package to resolve, e.g. `@biomejs/biome`.
+ * @param binName     which `bin` key to prefer when the package declares
+ *                    several. Falls back to the sole/first entry.
+ * @param cwd         project root whose `package.json` anchors resolution.
+ * @param extraArgs   arguments appended after the bin entry.
+ *
+ * Returns `null` when the package is not installed, declares no `bin`, or
+ * the declared entry escapes its own package directory (a tampered
+ * `package.json` must not become an arbitrary-file execution primitive).
+ */
+export declare function resolveNodeBin(packageName: string, binName: string, cwd: string, extraArgs?: readonly string[]): ResolvedNodeBin | null;
+/**
+ * Resolve the first installed package from `candidates`.
+ *
+ * Used by plugins that accept several equivalent tools (biome *or*
+ * eslint, vitest *or* jest) and want the first one the project actually
+ * has, without probing each with a subprocess.
+ */
+export declare function resolveFirstNodeBin(candidates: readonly {
+    packageName: string;
+    binName: string;
+    args?: readonly string[];
+}[], cwd: string): (ResolvedNodeBin & {
+    packageName: string;
+    binName: string;
+}) | null;
+//# sourceMappingURL=local-bin.d.ts.map

package/dist/runtime/local-bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-bin.d.ts","sourceRoot":"","sources":["../../src/runtime/local-bin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,OAAO,EAA+B,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE3F,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,6DAA6D;IAC7D,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,SAAS,MAAM,EAAO,GAC3B,cAAc,CAWhB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoCrD;AAED,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;CACf;AAqCD,4DAA4D;AAC5D,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,SAAS,MAAM,EAAO,GAChC,eAAe,GAAG,IAAI,CAwCxB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,SAAS;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACzF,GAAG,EAAE,MAAM,GACV,CAAC,eAAe,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAMrE"}

package/dist/runtime/safe-json.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @wrongstack/plugins — serialisation that cannot take the process down.
+ *
+ * Plugins routinely stringify values they did not construct: event-bus
+ * payloads, tool results, mailbox bodies. `JSON.stringify` throws on a
+ * circular reference and on `BigInt`, and several of these call sites sit
+ * inside detached (fire-and-forget) work where a throw becomes an
+ * unhandled rejection rather than a handled failure.
+ *
+ * `safeJsonStringify` never throws. A value it cannot represent is
+ * replaced with a marker, so the surrounding feature degrades to "this
+ * field is unreadable" instead of failing — or crashing — outright.
+ */
+/** Placeholder substituted for a value that cannot be serialised. */
+export declare const UNSERIALIZABLE = "[unserializable]";
+/**
+ * `JSON.stringify` with cycle handling and a total-failure fallback.
+ *
+ * @param value  anything
+ * @param indent passed through to `JSON.stringify` (e.g. `2` to pretty-print)
+ * @returns a JSON string, or a marker string when the value resists
+ *          serialisation entirely. Never throws.
+ */
+export declare function safeJsonStringify(value: unknown, indent?: number): string;
+//# sourceMappingURL=safe-json.d.ts.map

package/dist/runtime/safe-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-json.d.ts","sourceRoot":"","sources":["../../src/runtime/safe-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,qEAAqE;AACrE,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAyBzE"}

package/dist/runtime.js

@@ -1,7 +1,7 @@
 // src/runtime/index.ts
 import { execFile } from "node:child_process";
 import { existsSync, readdirSync, statSync } from "node:fs";
-import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+import { basename, extname as extname2, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "node:path";
 
 // src/runtime/llm.ts
 function stripOuterMarkdownFence(text) {
@@ -49,6 +49,265 @@ async function runOptionalPluginLlm(request) {
   }
 }
 
+// src/runtime/local-bin.ts
+import { createRequire } from "node:module";
+import { delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { accessSync, constants, readFileSync } from "node:fs";
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+function resolveExecInvocation(command, args = []) {
+  const resolved = resolveWin32Command(command);
+  const normalizedResolved = resolved.toLowerCase();
+  const needsShell = process.platform === "win32" && (normalizedResolved.endsWith(".cmd") || normalizedResolved.endsWith(".bat"));
+  if (needsShell) {
+    const shim = buildWin32CmdShimInvocation(resolved, args);
+    return { cmd: shim.command, args: shim.args, windowsVerbatimArguments: true };
+  }
+  return { cmd: resolved, args: [...args], windowsVerbatimArguments: false };
+}
+function findOnPath(cmd) {
+  if (!cmd) return null;
+  const exists = (p) => {
+    try {
+      accessSync(p, constants.X_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  if (cmd.includes("/") || cmd.includes("\\")) {
+    return exists(cmd) ? resolve(cmd) : null;
+  }
+  const suffixes = process.platform === "win32" && extname(cmd) === "" ? (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  for (const dir of (process.env["PATH"] ?? "").split(delimiter)) {
+    if (!dir) continue;
+    const base = join(dir, cmd);
+    for (const suffix of suffixes) {
+      const candidate = `${base}${suffix}`;
+      if (exists(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+function isInside(parent, candidate) {
+  const rel = relative(parent, candidate);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel);
+}
+var binCache = /* @__PURE__ */ new Map();
+var BIN_CACHE_MAX = 64;
+var NEGATIVE_BIN_CACHE_TTL_MS = 5e3;
+function cachePut(key, value) {
+  while (binCache.size >= BIN_CACHE_MAX) {
+    const oldest = binCache.keys().next().value;
+    if (oldest === void 0) break;
+    binCache.delete(oldest);
+  }
+  binCache.set(key, { value, cachedAt: Date.now() });
+  return value;
+}
+function clearLocalBinCache() {
+  binCache.clear();
+}
+function resolveNodeBin(packageName, binName, cwd, extraArgs = []) {
+  const key = `${packageName}|${binName}|${cwd}`;
+  const cached = binCache.get(key);
+  if (cached !== void 0) {
+    if (cached.value !== null || Date.now() - cached.cachedAt < NEGATIVE_BIN_CACHE_TTL_MS) {
+      return cached.value === null ? null : { ...cached.value, args: [cached.value.entry, ...extraArgs] };
+    }
+    binCache.delete(key);
+  }
+  let resolved = null;
+  try {
+    const requireFromProject = createRequire(resolve(cwd, "package.json"));
+    const packagePath = requireFromProject.resolve(`${packageName}/package.json`);
+    const packageJson = JSON.parse(readFileSync(packagePath, "utf-8"));
+    const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[binName] ?? Object.values(packageJson.bin ?? {})[0];
+    if (relativeBin && !isAbsolute(relativeBin)) {
+      const packageDir = dirname(packagePath);
+      const entry = resolve(packageDir, relativeBin);
+      if (isInside(packageDir, entry)) {
+        resolved = { cmd: process.execPath, args: [entry], entry };
+      }
+    }
+  } catch {
+    resolved = null;
+  }
+  cachePut(key, resolved);
+  return resolved === null ? null : { ...resolved, args: [resolved.entry, ...extraArgs] };
+}
+function resolveFirstNodeBin(candidates, cwd) {
+  for (const c of candidates) {
+    const hit = resolveNodeBin(c.packageName, c.binName, cwd, c.args ?? []);
+    if (hit) return { ...hit, packageName: c.packageName, binName: c.binName };
+  }
+  return null;
+}
+
+// src/runtime/bounded-map.ts
+var BoundedMap = class {
+  map = /* @__PURE__ */ new Map();
+  max;
+  ttlMs;
+  now;
+  /** Entries dropped to stay under `max`. Surfaced by plugin health(). */
+  evictions = 0;
+  constructor(options) {
+    const normalizedMax = Math.floor(options.max);
+    this.max = Number.isSafeInteger(normalizedMax) ? Math.max(1, normalizedMax) : 1;
+    this.ttlMs = options.ttlMs;
+    this.now = options.now ?? Date.now;
+  }
+  expired(entry) {
+    return this.ttlMs !== void 0 && this.now() - entry.storedAt > this.ttlMs;
+  }
+  get(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return void 0;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return void 0;
+    }
+    this.map.delete(key);
+    this.map.set(key, entry);
+    return entry.value;
+  }
+  /**
+   * Read without promoting the key to most-recently-used. Use for
+   * diagnostics that must not perturb the eviction order.
+   */
+  peek(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0 || this.expired(entry)) return void 0;
+    return entry.value;
+  }
+  has(key) {
+    const entry = this.map.get(key);
+    if (entry === void 0) return false;
+    if (this.expired(entry)) {
+      this.map.delete(key);
+      return false;
+    }
+    return true;
+  }
+  set(key, value) {
+    this.map.delete(key);
+    this.map.set(key, { value, storedAt: this.now() });
+    while (this.map.size > this.max) {
+      const coldest = this.map.keys().next().value;
+      if (coldest === void 0) break;
+      this.map.delete(coldest);
+      this.evictions += 1;
+    }
+    return this;
+  }
+  delete(key) {
+    return this.map.delete(key);
+  }
+  clear() {
+    this.map.clear();
+    this.evictions = 0;
+  }
+  get size() {
+    return this.map.size;
+  }
+  /** How many entries have been dropped to respect `max`, since the last clear. */
+  get evictionCount() {
+    return this.evictions;
+  }
+  /** Drop every expired entry. Cheap enough to call from a status tool. */
+  prune() {
+    if (this.ttlMs === void 0) return 0;
+    let removed = 0;
+    for (const [key, entry] of this.map) {
+      if (this.expired(entry)) {
+        this.map.delete(key);
+        removed += 1;
+      }
+    }
+    return removed;
+  }
+  /** Live (non-expired) entries, coldest first. */
+  *entries() {
+    for (const [key, entry] of this.map) {
+      if (!this.expired(entry)) yield [key, entry.value];
+    }
+  }
+  [Symbol.iterator]() {
+    return this.entries();
+  }
+};
+var BoundedSet = class {
+  inner;
+  constructor(options) {
+    this.inner = new BoundedMap(options);
+  }
+  has(value) {
+    return this.inner.has(value);
+  }
+  add(value) {
+    this.inner.set(value, true);
+    return this;
+  }
+  delete(value) {
+    return this.inner.delete(value);
+  }
+  clear() {
+    this.inner.clear();
+  }
+  get size() {
+    return this.inner.size;
+  }
+  /** How many entries have been dropped to respect `max`, since the last clear. */
+  get evictionCount() {
+    return this.inner.evictionCount;
+  }
+  *values() {
+    for (const [key] of this.inner) yield key;
+  }
+  [Symbol.iterator]() {
+    return this.values();
+  }
+};
+
+// src/runtime/safe-json.ts
+var UNSERIALIZABLE = "[unserializable]";
+function safeJsonStringify(value, indent) {
+  try {
+    const stack = [];
+    const out = JSON.stringify(
+      value,
+      function replacer(_key, val) {
+        if (typeof val === "bigint") return `${val.toString()}n`;
+        if (val === null || typeof val !== "object") return val;
+        while (stack.length > 0 && stack[stack.length - 1] !== this) stack.pop();
+        if (stack.includes(val)) return "[circular]";
+        stack.push(val);
+        return val;
+      },
+      indent
+    );
+    return out ?? String(value);
+  } catch {
+    return UNSERIALIZABLE;
+  }
+}
+
+// src/runtime/handles.ts
+function releaseHandle(off) {
+  if (off) {
+    try {
+      off();
+    } catch {
+    }
+  }
+  return null;
+}
+function releaseHandles(state, keys) {
+  for (const key of keys) {
+    state[key] = releaseHandle(state[key]);
+  }
+}
+
 // src/runtime/index.ts
 var META_CHARS = /["'`;&|<>\r\n]/;
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
@@ -63,9 +322,9 @@ function safeSplit(command) {
 function withinProjectPath(projectRoot, candidate) {
   if (candidate.length === 0 || candidate.length > 4096) return false;
   if (hasLeadingDash(candidate)) return false;
-  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(projectRoot, candidate);
-  const rel = relative(projectRoot, resolved);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+  const resolved = isAbsolute2(candidate) ? resolve2(candidate) : resolve2(projectRoot, candidate);
+  const rel = relative2(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
 }
 function everyFlagAllowed(allowed, args) {
   for (const arg of args) {
@@ -77,14 +336,14 @@ function everyFlagAllowed(allowed, args) {
 }
 function sanitizeRunnerPath(value, options = {}) {
   if (!value || hasLeadingDash(value)) return null;
-  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  const projectRoot = resolve2(options.projectRoot ?? process.cwd());
   if (!withinProjectPath(projectRoot, value)) return null;
-  return isAbsolute(value) ? resolve(value) : resolve(projectRoot, value);
+  return isAbsolute2(value) ? resolve2(value) : resolve2(projectRoot, value);
 }
 function resolveRunnerCommand(runtime, command, options = {}) {
   const tokens = safeSplit(command);
   if (!tokens || tokens.length === 0) return null;
-  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  const projectRoot = resolve2(options.projectRoot ?? process.cwd());
   const launcher = runtime.packageManager;
   const [head, second, ...rest] = tokens;
   if (!head) return null;
@@ -115,7 +374,7 @@ function resolveRunnerCommand(runtime, command, options = {}) {
       return { cmd: head, args: [second, exe, ...tail], display };
     }
   }
-  if (isAbsolute(head)) {
+  if (isAbsolute2(head)) {
     if (!withinProjectPath(projectRoot, head)) return null;
     const base = basename(head);
     if (base !== runtime.executable && base !== launcher) return null;
@@ -136,7 +395,7 @@ function runRunnerCommand(argv, options) {
     });
   }
   return new Promise((resolvePromise) => {
-    const projectRoot = resolve(options.projectRoot ?? process.cwd());
+    const projectRoot = resolve2(options.projectRoot ?? process.cwd());
     const trimmedCwd = options.cwd.trim();
     if (!withinProjectPath(projectRoot, trimmedCwd)) {
       resolvePromise({
@@ -154,21 +413,37 @@ function runRunnerCommand(argv, options) {
     const stderrChunks = [];
     let stdoutBytes = 0;
     let stderrBytes = 0;
-    options.signal?.addEventListener("abort", () => {
+    const onAbort = () => {
       timedOut = true;
-    }, { once: true });
+    };
+    let invocation;
+    try {
+      invocation = resolveExecInvocation(argv[0], argv.slice(1));
+    } catch (err) {
+      resolvePromise({
+        code: null,
+        stdout: "",
+        stderr: `runtime helper: ${err instanceof Error ? err.message : String(err)}`,
+        timedOut: false,
+        spawnError: true
+      });
+      return;
+    }
+    options.signal?.addEventListener("abort", onAbort, { once: true });
     const child = execFile(
-      argv[0],
-      argv.slice(1),
+      invocation.cmd,
+      invocation.args,
       {
         cwd: trimmedCwd,
         timeout: options.timeoutMs,
         signal: options.signal,
         maxBuffer: MAX_BUFFER_BYTES,
         windowsHide: true,
-        shell: false
+        shell: false,
+        ...invocation.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
       },
       (err) => {
+        options.signal?.removeEventListener("abort", onAbort);
         if (timedOut) {
           resolvePromise({
             code: null,
@@ -241,14 +516,14 @@ async function probeRunner(runtime, probeArg = "--version", options) {
 }
 function withinProject(p) {
   const cwd = process.cwd();
-  return withinProjectPath(cwd, p) || relative(cwd, p) === ".";
+  return withinProjectPath(cwd, p) || relative2(cwd, p) === ".";
 }
 function locateRunnerEntry(runtime, projectRoot) {
-  const root = resolve(projectRoot);
+  const root = resolve2(projectRoot);
   const candidates = [
-    resolve(root, "node_modules", ".bin", runtime.executable),
-    resolve(root, "node_modules", ".bin", `${runtime.executable}.cmd`),
-    resolve(root, "node_modules", ".bin", `${runtime.executable}.ps1`)
+    resolve2(root, "node_modules", ".bin", runtime.executable),
+    resolve2(root, "node_modules", ".bin", `${runtime.executable}.cmd`),
+    resolve2(root, "node_modules", ".bin", `${runtime.executable}.ps1`)
   ];
   for (const c of candidates) {
     if (existsSync(c)) return c;
@@ -278,7 +553,7 @@ function collectSourceFiles(root, opts) {
     entries.sort();
     for (const entry of entries) {
       if (excludeSet.has(entry)) continue;
-      const full = resolve(dir, entry);
+      const full = resolve2(dir, entry);
       let st;
       try {
         st = statSync(full);
@@ -321,7 +596,7 @@ async function collectSourceFilesAsync(root, opts) {
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       if (excludeSet.has(entry.name)) continue;
-      const full = resolve(dir, entry.name);
+      const full = resolve2(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(full, depth + 1);
       } else if (entry.isFile() && matchesExtension(full, opts.extensions)) {
@@ -333,18 +608,30 @@ async function collectSourceFilesAsync(root, opts) {
   return files;
 }
 function matchesExtension(p, exts) {
-  return exts.includes(extname(p).toLowerCase());
+  return exts.includes(extname2(p).toLowerCase());
 }
 export {
+  BoundedMap,
+  BoundedSet,
+  UNSERIALIZABLE,
+  clearLocalBinCache,
   collectSourceFiles,
   collectSourceFilesAsync,
+  findOnPath,
   locateRunnerEntry,
   matchesExtension,
   parseLlmJsonObject,
   probeRunner,
+  releaseHandle,
+  releaseHandles,
+  resolveExecInvocation,
+  resolveFirstNodeBin,
+  resolveNodeBin,
   resolveRunnerCommand,
+  resolveWin32Command,
   runOptionalPluginLlm,
   runRunnerCommand,
+  safeJsonStringify,
   sanitizeRunnerPath,
   stripOuterMarkdownFence,
   withinProject

package/dist/schema-evolution-guard.js

@@ -4,6 +4,11 @@ import { basename as basename2 } from "node:path";
 
 // src/runtime/index.ts
 import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/index.ts
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
 function hasLeadingDash(arg) {
   return arg.length > 0 && arg.startsWith("-");

package/dist/secret-scanner/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secret-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AA6erD,QAAA,MAAM,MAAM,EAAE,MAgOb,CAAC;eAEa,MAAM"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secret-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAymBrD,QAAA,MAAM,MAAM,EAAE,MAgOb,CAAC;eAEa,MAAM"}