@wrongstack/plugins 0.297.0 → 0.298.0

package/dist/audit/index.d.ts

@@ -256,12 +256,6 @@ export declare const OFFICIAL_PLUGIN_AUDIT_ENTRIES: readonly [{
     readonly summary: 'Observes the wrapProviderRunner stack and exposes it to operators (plugin_stack_status) and, optionally, to the LLM (system-prompt contributor).';
     readonly defaultState: 'inactive';
     readonly canDisable: true;
-}, {
-    readonly name: 'dead-code-detector';
-    readonly risk: 'low';
-    readonly summary: 'Lightweight regex-based scan for exported identifiers that appear unused anywhere in the project';
-    readonly defaultState: 'inactive';
-    readonly canDisable: true;
 }, {
     readonly name: 'dependency-vulnerability-gate';
     readonly risk: 'high';
@@ -334,6 +328,12 @@ export declare const OFFICIAL_PLUGIN_AUDIT_ENTRIES: readonly [{
     readonly summary: 'Scans source code for security anti-patterns and warns after writes/edits that introduce new hotspots';
     readonly defaultState: 'inactive';
     readonly canDisable: true;
+}, {
+    readonly name: 'dead-code-detector';
+    readonly risk: 'low';
+    readonly summary: 'Lightweight regex-based scan for exported identifiers that appear unused anywhere in the project';
+    readonly defaultState: 'inactive';
+    readonly canDisable: true;
 }, {
     readonly name: 'duplicate-code-detector';
     readonly risk: 'low';

package/dist/audit.js

@@ -301,13 +301,6 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "inactive",
     canDisable: true
   },
-  {
-    name: "dead-code-detector",
-    risk: "low",
-    summary: "Lightweight regex-based scan for exported identifiers that appear unused anywhere in the project",
-    defaultState: "inactive",
-    canDisable: true
-  },
   {
     name: "dependency-vulnerability-gate",
     risk: "high",
@@ -392,6 +385,13 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "inactive",
     canDisable: true
   },
+  {
+    name: "dead-code-detector",
+    risk: "low",
+    summary: "Lightweight regex-based scan for exported identifiers that appear unused anywhere in the project",
+    defaultState: "inactive",
+    canDisable: true
+  },
   {
     name: "duplicate-code-detector",
     risk: "low",

package/dist/dead-code-detector.js

@@ -84,18 +84,12 @@ async function gatherFiles(root, depth, cfg) {
 function stripNoise(content) {
   let stripped = content.replace(/\/\/.*$/gm, " ");
   stripped = stripped.replace(/\/\*[\s\S]*?\*\//g, " ");
-  stripped = stripped.replace(
-    /'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`/g,
-    " "
-  );
+  stripped = stripped.replace(/'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`/g, " ");
   return stripped;
 }
 function lineNumber(content, index) {
   return content.slice(0, index).split(/\r?\n/).length;
 }
-function escapeRegex(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 var DECLARATION_EXPORT_RE = /export\s+(?:async\s+|abstract\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
 var NAMED_EXPORT_RE = /export\s*\{([^}]+)\}/g;
 function extractExports(content, filePath) {
@@ -128,26 +122,33 @@ function extractExports(content, filePath) {
   }
   return exports;
 }
-function findUnusedSymbols(files) {
+async function findUnusedSymbols(files) {
   const suspicious = [];
+  const exportedNames = new Set(files.flatMap((file) => file.exports.map((exp) => exp.identifier)));
+  const filesContainingIdentifier = /* @__PURE__ */ new Map();
+  const identifierPattern = /[A-Za-z_$][A-Za-z0-9_$]*/g;
   for (const file of files) {
-    const fileExports = extractExports(file.content, file.path);
-    for (const exp of fileExports) {
-      const pattern = new RegExp(
-        `(?<![A-Za-z0-9_$])${escapeRegex(exp.identifier)}(?![A-Za-z0-9_$])`,
-        "g"
+    let content;
+    try {
+      content = await readFile(file.path, "utf-8");
+    } catch {
+      continue;
+    }
+    const seenInFile = /* @__PURE__ */ new Set();
+    for (const match of stripNoise(content).matchAll(identifierPattern)) {
+      const identifier = match[0];
+      if (exportedNames.has(identifier)) seenInFile.add(identifier);
+    }
+    for (const identifier of seenInFile) {
+      filesContainingIdentifier.set(
+        identifier,
+        (filesContainingIdentifier.get(identifier) ?? 0) + 1
       );
-      let usedElsewhere = false;
-      for (const other of files) {
-        if (other.path === file.path) continue;
-        if (pattern.test(other.stripped)) {
-          usedElsewhere = true;
-          break;
-        }
-      }
-      if (!usedElsewhere) {
-        suspicious.push(exp);
-      }
+    }
+  }
+  for (const file of files) {
+    for (const exp of file.exports) {
+      if ((filesContainingIdentifier.get(exp.identifier) ?? 0) <= 1) suspicious.push(exp);
     }
   }
   suspicious.sort((a, b) => {
@@ -163,11 +164,11 @@ async function scan(root, depth, cfg) {
   for (const p of filePaths) {
     try {
       const content = await readFile(p, "utf-8");
-      files.push({ path: p, content, stripped: stripNoise(content) });
+      files.push({ path: p, exports: extractExports(content, p) });
     } catch {
     }
   }
-  return { findings: findUnusedSymbols(files), scannedFiles: files.length };
+  return { findings: await findUnusedSymbols(files), scannedFiles: files.length };
 }
 async function resolveScanRoot(rawPath) {
   const resolved = resolve2(process.cwd(), rawPath);
@@ -263,16 +264,16 @@ var plugin = {
       }
       state.hitCount += 1;
       state.warningCount += relevant.length;
-      const list = relevant.map(
-        (f) => `  - ${f.identifier} (${f.exportType}) at ${relativePath(f.file)}:${f.line}`
-      ).join("\n");
+      const list = relevant.map((f) => `  - ${f.identifier} (${f.exportType}) at ${relativePath(f.file)}:${f.line}`).join("\n");
       const message = `
 \u26A0\uFE0F dead-code-detector: ${relevant.length} exported symbol(s) in ${sourcePath} look unused:
 ${list}
 Consider removing the export if it is not part of the public API.`;
       return { additionalContext: message };
     };
-    state.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "dead_code_scan",
       description: "Scan TypeScript/JavaScript source files for exported symbols that appear unused anywhere in the project.",

package/dist/factories/index.d.ts

@@ -1,4 +1,4 @@
 import type { Plugin } from '@wrongstack/core/types';
-export declare const OFFICIAL_PLUGIN_SPECIFIERS: readonly ['@wrongstack/plugins/agent-handoff', '@wrongstack/plugins/cost-tracker', '@wrongstack/plugins/file-watcher', '@wrongstack/plugins/git-autocommit', '@wrongstack/plugins/auto-doc', '@wrongstack/plugins/shell-check', '@wrongstack/plugins/cron', '@wrongstack/plugins/template-engine', '@wrongstack/plugins/semver-bump', '@wrongstack/plugins/secret-scanner', '@wrongstack/plugins/todo-tracker', '@wrongstack/plugins/token-budget', '@wrongstack/plugins/lint-gate', '@wrongstack/plugins/branch-guard', '@wrongstack/plugins/diff-summary', '@wrongstack/plugins/commit-validator', '@wrongstack/plugins/format-on-save', '@wrongstack/plugins/test-runner-gate', '@wrongstack/plugins/import-organizer', '@wrongstack/plugins/knowledge-graph', '@wrongstack/plugins/todo-listener', '@wrongstack/plugins/session-recap', '@wrongstack/plugins/spec-linker', '@wrongstack/plugins/loop-breaker', '@wrongstack/plugins/path-guard', '@wrongstack/plugins/process-guard', '@wrongstack/plugins/context-pins', '@wrongstack/plugins/checkpoint', '@wrongstack/plugins/error-lens', '@wrongstack/plugins/dep-guard', '@wrongstack/plugins/config-validator', '@wrongstack/plugins/notify-hub', '@wrongstack/plugins/changelog-writer', '@wrongstack/plugins/injection-shield', '@wrongstack/plugins/llm-cache', '@wrongstack/plugins/model-router', '@wrongstack/plugins/pr-drafter', '@wrongstack/plugins/prompt-firewall', '@wrongstack/plugins/auto-escalate', '@wrongstack/plugins/test-coverage-gate', '@wrongstack/plugins/type-gate', '@wrongstack/plugins/token-throttle', '@wrongstack/plugins/plugin-stack-observer', '@wrongstack/plugins/dead-code-detector', '@wrongstack/plugins/dependency-vulnerability-gate', '@wrongstack/plugins/migration-planner', '@wrongstack/plugins/semantic-search-indexer', '@wrongstack/plugins/auto-i18n-extractor', '@wrongstack/plugins/doc-sync-guard', '@wrongstack/plugins/api-compatibility-gate', '@wrongstack/plugins/performance-regression-gate', '@wrongstack/plugins/test-flake-detector', '@wrongstack/plugins/schema-evolution-guard', '@wrongstack/plugins/license-audit-gate', '@wrongstack/plugins/accessibility-auditor', '@wrongstack/plugins/security-hotspot-scanner', '@wrongstack/plugins/duplicate-code-detector', '@wrongstack/plugins/code-metrics', '@wrongstack/plugins/refactor-suggester', '@wrongstack/plugins/test-generator', '@wrongstack/plugins/release-notes-generator', '@wrongstack/plugins/smart-rename', '@wrongstack/plugins/feature-flag-tracker', '@wrongstack/plugins/interface-contract-guard'];
+export declare const OFFICIAL_PLUGIN_SPECIFIERS: readonly ['@wrongstack/plugins/agent-handoff', '@wrongstack/plugins/cost-tracker', '@wrongstack/plugins/file-watcher', '@wrongstack/plugins/git-autocommit', '@wrongstack/plugins/auto-doc', '@wrongstack/plugins/shell-check', '@wrongstack/plugins/cron', '@wrongstack/plugins/template-engine', '@wrongstack/plugins/semver-bump', '@wrongstack/plugins/secret-scanner', '@wrongstack/plugins/todo-tracker', '@wrongstack/plugins/token-budget', '@wrongstack/plugins/lint-gate', '@wrongstack/plugins/branch-guard', '@wrongstack/plugins/diff-summary', '@wrongstack/plugins/commit-validator', '@wrongstack/plugins/format-on-save', '@wrongstack/plugins/test-runner-gate', '@wrongstack/plugins/import-organizer', '@wrongstack/plugins/knowledge-graph', '@wrongstack/plugins/todo-listener', '@wrongstack/plugins/session-recap', '@wrongstack/plugins/spec-linker', '@wrongstack/plugins/loop-breaker', '@wrongstack/plugins/path-guard', '@wrongstack/plugins/process-guard', '@wrongstack/plugins/context-pins', '@wrongstack/plugins/checkpoint', '@wrongstack/plugins/error-lens', '@wrongstack/plugins/dep-guard', '@wrongstack/plugins/config-validator', '@wrongstack/plugins/notify-hub', '@wrongstack/plugins/changelog-writer', '@wrongstack/plugins/injection-shield', '@wrongstack/plugins/llm-cache', '@wrongstack/plugins/model-router', '@wrongstack/plugins/pr-drafter', '@wrongstack/plugins/prompt-firewall', '@wrongstack/plugins/auto-escalate', '@wrongstack/plugins/test-coverage-gate', '@wrongstack/plugins/type-gate', '@wrongstack/plugins/token-throttle', '@wrongstack/plugins/plugin-stack-observer', '@wrongstack/plugins/dependency-vulnerability-gate', '@wrongstack/plugins/migration-planner', '@wrongstack/plugins/semantic-search-indexer', '@wrongstack/plugins/auto-i18n-extractor', '@wrongstack/plugins/doc-sync-guard', '@wrongstack/plugins/api-compatibility-gate', '@wrongstack/plugins/performance-regression-gate', '@wrongstack/plugins/test-flake-detector', '@wrongstack/plugins/schema-evolution-guard', '@wrongstack/plugins/license-audit-gate', '@wrongstack/plugins/accessibility-auditor', '@wrongstack/plugins/security-hotspot-scanner', '@wrongstack/plugins/dead-code-detector', '@wrongstack/plugins/duplicate-code-detector', '@wrongstack/plugins/code-metrics', '@wrongstack/plugins/refactor-suggester', '@wrongstack/plugins/test-generator', '@wrongstack/plugins/release-notes-generator', '@wrongstack/plugins/smart-rename', '@wrongstack/plugins/feature-flag-tracker', '@wrongstack/plugins/interface-contract-guard'];
 export declare const OFFICIAL_PLUGIN_FACTORIES: readonly (() => Promise<Plugin>)[];
 //# sourceMappingURL=index.d.ts.map

package/dist/factories.js

@@ -43,7 +43,6 @@ var OFFICIAL_PLUGIN_SPECIFIERS = [
   "@wrongstack/plugins/type-gate",
   "@wrongstack/plugins/token-throttle",
   "@wrongstack/plugins/plugin-stack-observer",
-  "@wrongstack/plugins/dead-code-detector",
   "@wrongstack/plugins/dependency-vulnerability-gate",
   "@wrongstack/plugins/migration-planner",
   "@wrongstack/plugins/semantic-search-indexer",
@@ -56,6 +55,7 @@ var OFFICIAL_PLUGIN_SPECIFIERS = [
   "@wrongstack/plugins/license-audit-gate",
   "@wrongstack/plugins/accessibility-auditor",
   "@wrongstack/plugins/security-hotspot-scanner",
+  "@wrongstack/plugins/dead-code-detector",
   "@wrongstack/plugins/duplicate-code-detector",
   "@wrongstack/plugins/code-metrics",
   "@wrongstack/plugins/refactor-suggester",

package/dist/file-watcher.js

@@ -18,6 +18,9 @@ function nextId() {
 }
 var watches = /* @__PURE__ */ new Map();
 var debounceTimers = /* @__PURE__ */ new Map();
+var MAX_WATCH_GROUPS = 32;
+var MAX_PATHS_PER_WATCH = 16;
+var MAX_FILESYSTEM_WATCHERS = 64;
 var plugin = {
   name: "file-watcher",
   version: "0.1.0",
@@ -155,8 +158,10 @@ var plugin = {
           api.log.warn(`file-watcher: error on ${dirPath}: ${err}`);
         });
         handle.watchers.push(watcher);
+        return true;
       } catch (err) {
         api.log.warn(`file-watcher: could not watch ${dirPath}: ${err}`);
+        return false;
       }
     }
     api.tools.register({
@@ -168,6 +173,7 @@ var plugin = {
           paths: {
             type: "array",
             items: { type: "string" },
+            maxItems: MAX_PATHS_PER_WATCH,
             description: "File or directory paths to watch"
           },
           events: {
@@ -196,7 +202,7 @@ var plugin = {
             watch_id: null
           };
         }
-        const paths = rawPaths;
+        const paths = [...new Set(rawPaths)];
         if (paths.length === 0) {
           return {
             ok: false,
@@ -204,6 +210,31 @@ var plugin = {
             watch_id: null
           };
         }
+        if (paths.length > MAX_PATHS_PER_WATCH) {
+          return {
+            ok: false,
+            error: `a watch may contain at most ${MAX_PATHS_PER_WATCH} unique paths`,
+            watch_id: null
+          };
+        }
+        if (watches.size >= MAX_WATCH_GROUPS) {
+          return {
+            ok: false,
+            error: `active watch group limit reached (${MAX_WATCH_GROUPS})`,
+            watch_id: null
+          };
+        }
+        const activeFilesystemWatchers = [...watches.values()].reduce(
+          (total, handle2) => total + handle2.watchers.length,
+          0
+        );
+        if (activeFilesystemWatchers + paths.length > MAX_FILESYSTEM_WATCHERS) {
+          return {
+            ok: false,
+            error: `filesystem watcher limit reached (${MAX_FILESYSTEM_WATCHERS})`,
+            watch_id: null
+          };
+        }
         const events = input["events"] ?? ["change", "add", "delete"];
         const recursive = input["recursive"] ?? true;
         const bad = paths.find((p) => !withinProject(p));
@@ -224,18 +255,20 @@ var plugin = {
           watchers: [],
           createdAt: (/* @__PURE__ */ new Date()).toISOString()
         };
+        const watchedPaths = [];
         for (const p of paths) {
-          safeWatchDir(p, recursive, handle);
+          if (safeWatchDir(p, recursive, handle)) watchedPaths.push(p);
         }
+        handle.paths = watchedPaths;
         watches.set(id, handle);
         api.metrics.gauge("active_watches", watches.size);
         return {
           ok: true,
           watch_id: id,
-          paths,
+          paths: watchedPaths,
           events,
           recursive,
-          message: `Started watching ${paths.length} path(s). Use watch_stop to cancel.`
+          message: `Started watching ${watchedPaths.length} path(s). Use watch_stop to cancel.`
         };
       }
     });