@wrongstack/plugins 0.297.0 → 0.298.0

package/dist/index.js

@@ -5469,18 +5469,12 @@ async function gatherFiles(root, depth, cfg) {
 function stripNoise(content) {
   let stripped = content.replace(/\/\/.*$/gm, " ");
   stripped = stripped.replace(/\/\*[\s\S]*?\*\//g, " ");
-  stripped = stripped.replace(
-    /'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`/g,
-    " "
-  );
+  stripped = stripped.replace(/'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`/g, " ");
   return stripped;
 }
 function lineNumber(content, index) {
   return content.slice(0, index).split(/\r?\n/).length;
 }
-function escapeRegex(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 var DECLARATION_EXPORT_RE = /export\s+(?:async\s+|abstract\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
 var NAMED_EXPORT_RE = /export\s*\{([^}]+)\}/g;
 function extractExports2(content, filePath) {
@@ -5513,26 +5507,33 @@ function extractExports2(content, filePath) {
   }
   return exports;
 }
-function findUnusedSymbols(files) {
+async function findUnusedSymbols(files) {
   const suspicious = [];
+  const exportedNames = new Set(files.flatMap((file) => file.exports.map((exp) => exp.identifier)));
+  const filesContainingIdentifier = /* @__PURE__ */ new Map();
+  const identifierPattern = /[A-Za-z_$][A-Za-z0-9_$]*/g;
   for (const file of files) {
-    const fileExports = extractExports2(file.content, file.path);
-    for (const exp of fileExports) {
-      const pattern = new RegExp(
-        `(?<![A-Za-z0-9_$])${escapeRegex(exp.identifier)}(?![A-Za-z0-9_$])`,
-        "g"
+    let content;
+    try {
+      content = await readFile5(file.path, "utf-8");
+    } catch {
+      continue;
+    }
+    const seenInFile = /* @__PURE__ */ new Set();
+    for (const match of stripNoise(content).matchAll(identifierPattern)) {
+      const identifier = match[0];
+      if (exportedNames.has(identifier)) seenInFile.add(identifier);
+    }
+    for (const identifier of seenInFile) {
+      filesContainingIdentifier.set(
+        identifier,
+        (filesContainingIdentifier.get(identifier) ?? 0) + 1
       );
-      let usedElsewhere = false;
-      for (const other of files) {
-        if (other.path === file.path) continue;
-        if (pattern.test(other.stripped)) {
-          usedElsewhere = true;
-          break;
-        }
-      }
-      if (!usedElsewhere) {
-        suspicious.push(exp);
-      }
+    }
+  }
+  for (const file of files) {
+    for (const exp of file.exports) {
+      if ((filesContainingIdentifier.get(exp.identifier) ?? 0) <= 1) suspicious.push(exp);
     }
   }
   suspicious.sort((a, b) => {
@@ -5548,11 +5549,11 @@ async function scan(root, depth, cfg) {
   for (const p of filePaths) {
     try {
       const content = await readFile5(p, "utf-8");
-      files.push({ path: p, content, stripped: stripNoise(content) });
+      files.push({ path: p, exports: extractExports2(content, p) });
     } catch {
     }
   }
-  return { findings: findUnusedSymbols(files), scannedFiles: files.length };
+  return { findings: await findUnusedSymbols(files), scannedFiles: files.length };
 }
 async function resolveScanRoot(rawPath) {
   const resolved = resolve10(process.cwd(), rawPath);
@@ -5648,16 +5649,16 @@ var plugin16 = {
       }
       state15.hitCount += 1;
       state15.warningCount += relevant.length;
-      const list = relevant.map(
-        (f) => `  - ${f.identifier} (${f.exportType}) at ${relativePath2(f.file)}:${f.line}`
-      ).join("\n");
+      const list = relevant.map((f) => `  - ${f.identifier} (${f.exportType}) at ${relativePath2(f.file)}:${f.line}`).join("\n");
       const message = `
 \u26A0\uFE0F dead-code-detector: ${relevant.length} exported symbol(s) in ${sourcePath} look unused:
 ${list}
 Consider removing the export if it is not part of the public API.`;
       return { additionalContext: message };
     };
-    state15.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state15.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "dead_code_scan",
       description: "Scan TypeScript/JavaScript source files for exported symbols that appear unused anywhere in the project.",
@@ -8019,6 +8020,9 @@ function nextId() {
 }
 var watches = /* @__PURE__ */ new Map();
 var debounceTimers = /* @__PURE__ */ new Map();
+var MAX_WATCH_GROUPS = 32;
+var MAX_PATHS_PER_WATCH = 16;
+var MAX_FILESYSTEM_WATCHERS = 64;
 var plugin24 = {
   name: "file-watcher",
   version: "0.1.0",
@@ -8156,8 +8160,10 @@ var plugin24 = {
           api.log.warn(`file-watcher: error on ${dirPath}: ${err}`);
         });
         handle.watchers.push(watcher);
+        return true;
       } catch (err) {
         api.log.warn(`file-watcher: could not watch ${dirPath}: ${err}`);
+        return false;
       }
     }
     api.tools.register({
@@ -8169,6 +8175,7 @@ var plugin24 = {
           paths: {
             type: "array",
             items: { type: "string" },
+            maxItems: MAX_PATHS_PER_WATCH,
             description: "File or directory paths to watch"
           },
           events: {
@@ -8197,7 +8204,7 @@ var plugin24 = {
             watch_id: null
           };
         }
-        const paths = rawPaths;
+        const paths = [...new Set(rawPaths)];
         if (paths.length === 0) {
           return {
             ok: false,
@@ -8205,6 +8212,31 @@ var plugin24 = {
             watch_id: null
           };
         }
+        if (paths.length > MAX_PATHS_PER_WATCH) {
+          return {
+            ok: false,
+            error: `a watch may contain at most ${MAX_PATHS_PER_WATCH} unique paths`,
+            watch_id: null
+          };
+        }
+        if (watches.size >= MAX_WATCH_GROUPS) {
+          return {
+            ok: false,
+            error: `active watch group limit reached (${MAX_WATCH_GROUPS})`,
+            watch_id: null
+          };
+        }
+        const activeFilesystemWatchers = [...watches.values()].reduce(
+          (total, handle2) => total + handle2.watchers.length,
+          0
+        );
+        if (activeFilesystemWatchers + paths.length > MAX_FILESYSTEM_WATCHERS) {
+          return {
+            ok: false,
+            error: `filesystem watcher limit reached (${MAX_FILESYSTEM_WATCHERS})`,
+            watch_id: null
+          };
+        }
         const events = input["events"] ?? ["change", "add", "delete"];
         const recursive = input["recursive"] ?? true;
         const bad = paths.find((p) => !withinProject3(p));
@@ -8225,18 +8257,20 @@ var plugin24 = {
           watchers: [],
           createdAt: (/* @__PURE__ */ new Date()).toISOString()
         };
+        const watchedPaths = [];
         for (const p of paths) {
-          safeWatchDir(p, recursive, handle);
+          if (safeWatchDir(p, recursive, handle)) watchedPaths.push(p);
         }
+        handle.paths = watchedPaths;
         watches.set(id, handle);
         api.metrics.gauge("active_watches", watches.size);
         return {
           ok: true,
           watch_id: id,
-          paths,
+          paths: watchedPaths,
           events,
           recursive,
-          message: `Started watching ${paths.length} path(s). Use watch_stop to cancel.`
+          message: `Started watching ${watchedPaths.length} path(s). Use watch_stop to cancel.`
         };
       }
     });
@@ -11402,6 +11436,7 @@ var llm_cache_default = plugin33;
 
 // src/loop-breaker/index.ts
 import { execFile as execFile9 } from "node:child_process";
+import { isAbsolute as isAbsolute17, relative as relative17 } from "node:path";
 var state31 = {
   lastFingerprint: null,
   streak: 0,
@@ -11511,20 +11546,24 @@ function hashString2(value) {
   }
   return String(h >>> 0);
 }
-async function gitDiffFingerprint(cwd, signal) {
+async function gitDiffFingerprint(cwd, targetPath, signal) {
+  const pathspec = isAbsolute17(targetPath) ? relative17(cwd, targetPath) : targetPath;
+  if (!pathspec || pathspec === ".." || pathspec.startsWith("../") || pathspec.startsWith("..\\")) {
+    return null;
+  }
   try {
     const diff = await new Promise((resolve28, reject) => {
       execFile9(
         "git",
-        ["diff", "--no-ext-diff", "--"],
+        ["diff", "--no-ext-diff", "--", pathspec],
         {
           cwd,
           encoding: "utf8",
           timeout: 1e3,
-          // Large dirty worktrees are common during an agent run. The hash
-          // itself is capped below, but the subprocess must still be allowed to
-          // finish so an oversized diff is not mistaken for "git unavailable".
-          maxBuffer: 16 * 1024 * 1024,
+          // The hook follows only the file touched by this edit/write. A whole
+          // repository diff duplicated diff-summary and could retain 16 MiB on
+          // every mutation in a large dirty worktree.
+          maxBuffer: 2 * 1024 * 1024,
           windowsHide: true,
           signal
         },
@@ -11735,7 +11774,14 @@ var plugin34 = {
       state31.lastErrorFingerprint = null;
       state31.repeatedErrorStreak = 0;
       if (!MUTATING_TOOLS.has(toolName)) return;
-      const diffFingerprint = await gitDiffFingerprint(input.cwd ?? process.cwd(), runtime.signal);
+      const toolInput = input.toolInput ?? {};
+      const targetPath = toolInput["path"];
+      if (typeof targetPath !== "string" || targetPath.length === 0) return;
+      const diffFingerprint = await gitDiffFingerprint(
+        input.cwd ?? process.cwd(),
+        targetPath,
+        runtime.signal
+      );
       if (diffFingerprint === null) return;
       if (diffFingerprint === state31.lastDiffFingerprint) {
         state31.noDiffStreak += 1;
@@ -13259,7 +13305,7 @@ var path_guard_default = plugin38;
 
 // src/performance-regression-gate/index.ts
 import { existsSync as existsSync5, readFileSync as readFileSync11 } from "node:fs";
-import { isAbsolute as isAbsolute17, relative as relative17, resolve as resolve18 } from "node:path";
+import { isAbsolute as isAbsolute18, relative as relative18, resolve as resolve18 } from "node:path";
 var API_VERSION25 = "^0.1.10";
 var state36 = {
   invocationCount: 0,
@@ -13285,17 +13331,17 @@ function readConfig34(raw) {
 function withinProject4(p, cwd = process.cwd()) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = resolve18(cwd);
-  const resolved = isAbsolute17(p) ? resolve18(p) : resolve18(root, p);
-  const rel = relative17(root, resolved);
+  const resolved = isAbsolute18(p) ? resolve18(p) : resolve18(root, p);
+  const rel = relative18(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute17(rel)) return false;
+  if (isAbsolute18(rel)) return false;
   return true;
 }
 function resolveProjectPath6(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
   const root = resolve18(cwd);
-  const resolved = isAbsolute17(rawPath) ? resolve18(rawPath) : resolve18(root, rawPath);
+  const resolved = isAbsolute18(rawPath) ? resolve18(rawPath) : resolve18(root, rawPath);
   if (!withinProject4(resolved, cwd)) return null;
   return resolved;
 }
@@ -13710,7 +13756,7 @@ var plugin_stack_observer_default = PLUGIN;
 // src/pr-drafter/index.ts
 import { execFile as execFile10 } from "node:child_process";
 import { mkdir as mkdir2, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname7, isAbsolute as isAbsolute18, relative as relative18, resolve as resolve19 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute19, relative as relative19, resolve as resolve19 } from "node:path";
 var API_VERSION26 = "^0.1.10";
 var state38 = {
   commits: [],
@@ -13750,9 +13796,9 @@ function readConfig36(raw) {
 function resolveProjectPath7(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
   const root = resolve19(cwd);
-  const resolved = isAbsolute18(rawPath) ? resolve19(rawPath) : resolve19(root, rawPath);
-  const rel = relative18(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute18(rel)) return resolved;
+  const resolved = isAbsolute19(rawPath) ? resolve19(rawPath) : resolve19(root, rawPath);
+  const rel = relative19(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute19(rel)) return resolved;
   return null;
 }
 function runGit4(args, timeout) {
@@ -14611,7 +14657,7 @@ var prompt_firewall_default = plugin42;
 
 // src/refactor-suggester/index.ts
 import { readFile as readFile11 } from "node:fs/promises";
-import { isAbsolute as isAbsolute19, relative as relative19, resolve as resolve20 } from "node:path";
+import { isAbsolute as isAbsolute20, relative as relative20, resolve as resolve20 } from "node:path";
 var API_VERSION27 = "^0.1.10";
 var HOOK_WARNING_COOLDOWN_MS2 = 6e4;
 var state41 = {
@@ -14655,7 +14701,7 @@ function toPosix6(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath6(p) {
-  return toPosix6(relative19(process.cwd(), p));
+  return toPosix6(relative20(process.cwd(), p));
 }
 function leadingIndentLevel(line) {
   const leading = line.match(/^(\s*)/)?.[1] ?? "";
@@ -14742,7 +14788,7 @@ function detectSmells(filePath, content, rules) {
 }
 async function scanPath4(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute19(rawPath) ? resolve20(rawPath) : resolve20(root, rawPath);
+  const resolved = isAbsolute20(rawPath) ? resolve20(rawPath) : resolve20(root, rawPath);
   const exts = normalizeExtensions5(cfg.extensions);
   const files = await collectSourceFilesAsync(resolved, { extensions: exts });
   const suggestions = [];
@@ -16055,7 +16101,7 @@ var secret_scanner_default = plugin46;
 
 // src/security-hotspot-scanner/index.ts
 import { readdir as readdir2, readFile as readFile12, stat as stat5 } from "node:fs/promises";
-import { isAbsolute as isAbsolute20, relative as relative20, resolve as resolve21 } from "node:path";
+import { isAbsolute as isAbsolute21, relative as relative21, resolve as resolve21 } from "node:path";
 var API_VERSION30 = "^0.1.10";
 var state45 = {
   scanCount: 0,
@@ -16146,7 +16192,7 @@ function isSourceFile2(filePath, extensions) {
 async function scanPath5(inputPath, cfg) {
   const start = Date.now();
   const root = process.cwd();
-  const resolved = isAbsolute20(inputPath) ? resolve21(inputPath) : resolve21(root, inputPath);
+  const resolved = isAbsolute21(inputPath) ? resolve21(inputPath) : resolve21(root, inputPath);
   if (!withinProject(inputPath)) {
     return {
       path: inputPath,
@@ -16167,7 +16213,7 @@ async function scanPath5(inputPath, cfg) {
       filesScanned += 1;
       const findings = scanSource(content, maxPerFile);
       for (const f of findings) {
-        allFindings.push({ ...f, snippet: `${relative20(root, filePath)}:${f.line}: ${f.snippet}` });
+        allFindings.push({ ...f, snippet: `${relative21(root, filePath)}:${f.line}: ${f.snippet}` });
         if (allFindings.length >= cfg.maxFindings) return;
       }
     } catch {
@@ -16451,10 +16497,10 @@ var security_hotspot_scanner_default = plugin47;
 
 // src/semantic-search-indexer/index.ts
 import * as fs2 from "node:fs/promises";
-import { isAbsolute as isAbsolute21, relative as relative21, resolve as resolve22 } from "node:path";
+import { isAbsolute as isAbsolute22, relative as relative22, resolve as resolve22 } from "node:path";
 import { DEFAULT_WALK_IGNORE_DIRS } from "@wrongstack/core/utils";
 var API_VERSION31 = "^0.1.10";
-var escapeRegex2 = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 var state46 = {
   index: null,
   cachedPath: null,
@@ -16499,7 +16545,7 @@ var DEFAULTS41 = {
     ".html"
   ],
   excludePatterns: [
-    ...DEFAULT_WALK_IGNORE_DIRS.map(escapeRegex2),
+    ...DEFAULT_WALK_IGNORE_DIRS.map(escapeRegex),
     "\\.wrongstack",
     "\\.temp_files"
   ],
@@ -16532,18 +16578,18 @@ function normalizeSlashes2(p) {
 function withinProject5(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = normalizeSlashes2(process.cwd());
-  const resolved = normalizeSlashes2(isAbsolute21(p) ? resolve22(p) : resolve22(root, p));
-  const rel = normalizeSlashes2(relative21(root, resolved));
+  const resolved = normalizeSlashes2(isAbsolute22(p) ? resolve22(p) : resolve22(root, p));
+  const rel = normalizeSlashes2(relative22(root, resolved));
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute21(rel)) return false;
+  if (isAbsolute22(rel)) return false;
   return true;
 }
 function resolveProjectPath8(p) {
   const raw = typeof p === "string" && p.length > 0 ? p : ".";
   if (!withinProject5(raw)) return null;
   const root = normalizeSlashes2(process.cwd());
-  return normalizeSlashes2(isAbsolute21(raw) ? resolve22(raw) : resolve22(root, raw));
+  return normalizeSlashes2(isAbsolute22(raw) ? resolve22(raw) : resolve22(root, raw));
 }
 function tokenize(text, minLength) {
   const tokens = [];
@@ -16628,7 +16674,7 @@ async function walkDirectory(absPath, cfg, excludes, fileBatch) {
       return;
     }
     const absChild = normalizeSlashes2(resolve22(absPath, ent.name));
-    const relChild = normalizeSlashes2(relative21(root, absChild));
+    const relChild = normalizeSlashes2(relative22(root, absChild));
     if (relChild === "" || relChild === ".") continue;
     if (excludes.some((re) => re.test(relChild))) continue;
     if (ent.isDirectory()) {
@@ -16670,7 +16716,7 @@ async function buildIndex(rootPath, cfg) {
     return;
   }
   if (rootStats.isFile()) {
-    const relPath = normalizeSlashes2(relative21(normalizeSlashes2(process.cwd()), rootPath));
+    const relPath = normalizeSlashes2(relative22(normalizeSlashes2(process.cwd()), rootPath));
     await indexFileFromStats(rootPath, relPath === "" ? "." : relPath, rootStats, cfg);
     state46.fileCount = state46.index.files.size;
   } else if (rootStats.isDirectory()) {
@@ -16967,14 +17013,14 @@ import { expectDefined as expectDefined2 } from "@wrongstack/core/utils";
 import { toErrorMessage } from "@wrongstack/core/utils";
 import { execFile as execFile12 } from "node:child_process";
 import { access as access3, readFile as readFile14, readdir as readdir4, writeFile as writeFile4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute22, join as join5, relative as relative22, resolve as resolve23 } from "node:path";
+import { isAbsolute as isAbsolute23, join as join5, relative as relative23, resolve as resolve23 } from "node:path";
 var API_VERSION32 = "^0.1.10";
 function resolveProjectRoot(rawCwd, root = process.cwd()) {
   if (typeof rawCwd !== "string" || rawCwd.length === 0) return root;
   const base = resolve23(root);
-  const resolved = isAbsolute22(rawCwd) ? resolve23(rawCwd) : resolve23(base, rawCwd);
-  const rel = relative22(base, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute22(rel)) return resolved;
+  const resolved = isAbsolute23(rawCwd) ? resolve23(rawCwd) : resolve23(base, rawCwd);
+  const rel = relative23(base, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute23(rel)) return resolved;
   return null;
 }
 var state47 = {
@@ -17613,25 +17659,59 @@ function topN(map, n) {
     return 0;
   }).slice(0, n);
 }
+var TRANSCRIPT_TAIL_READ_BYTES = 1024 * 1024;
+var TRANSCRIPT_TAIL_CHUNK_BYTES = 64 * 1024;
 async function readTranscriptTail(transcriptPath, n) {
   if (!transcriptPath || n <= 0) return [];
-  let raw;
+  let handle;
   try {
-    const { readFile: readFile18 } = await import("node:fs/promises");
-    raw = await readFile18(transcriptPath, "utf-8");
+    const { open } = await import("node:fs/promises");
+    handle = await open(transcriptPath, "r");
+    const size = (await handle.stat()).size;
+    if (size === 0) return [];
+    let position = size;
+    let retainedBytes = 0;
+    let newlines = 0;
+    const chunks = [];
+    while (position > 0 && retainedBytes < TRANSCRIPT_TAIL_READ_BYTES) {
+      const length = Math.min(
+        TRANSCRIPT_TAIL_CHUNK_BYTES,
+        position,
+        TRANSCRIPT_TAIL_READ_BYTES - retainedBytes
+      );
+      position -= length;
+      const buffer = Buffer.allocUnsafe(length);
+      const { bytesRead } = await handle.read(buffer, 0, length, position);
+      if (bytesRead === 0) break;
+      const chunk = bytesRead === length ? buffer : buffer.subarray(0, bytesRead);
+      chunks.unshift(chunk);
+      retainedBytes += bytesRead;
+      let offset = chunk.indexOf(10);
+      while (offset !== -1) {
+        newlines++;
+        offset = chunk.indexOf(10, offset + 1);
+      }
+      if (position === 0) break;
+      if (newlines > n) break;
+    }
+    const joined = Buffer.concat(chunks).toString("utf8");
+    const truncatedHead = position > 0;
+    const allLines = joined.split("\n");
+    const candidateLines = truncatedHead ? allLines.slice(1) : allLines;
+    const tail = candidateLines.filter((line) => line.length > 0).slice(-n);
+    const out = [];
+    for (const l of tail) {
+      try {
+        out.push(JSON.parse(l));
+      } catch {
+      }
+    }
+    return out;
   } catch {
     return [];
+  } finally {
+    await handle?.close().catch(() => void 0);
   }
-  const lines = raw.split("\n").filter((l) => l.length > 0);
-  const tail = lines.slice(-n);
-  const out = [];
-  for (const l of tail) {
-    try {
-      out.push(JSON.parse(l));
-    } catch {
-    }
-  }
-  return out;
 }
 function truncate2(s, max) {
   return s.length > max ? s.slice(0, max) + `
@@ -17959,15 +18039,15 @@ var session_recap_default = plugin50;
 // src/shell-check/index.ts
 import { execFile as execFile13 } from "node:child_process";
 import { readdir as readdir5 } from "node:fs/promises";
-import { isAbsolute as isAbsolute23, join as join6, relative as relative23, resolve as resolve24 } from "node:path";
+import { isAbsolute as isAbsolute24, join as join6, relative as relative24, resolve as resolve24 } from "node:path";
 var API_VERSION33 = "^0.1.10";
 function withinProject6(p) {
   const root = process.cwd();
-  const resolved = isAbsolute23(p) ? resolve24(p) : resolve24(root, p);
-  const rel = relative23(root, resolved);
+  const resolved = isAbsolute24(p) ? resolve24(p) : resolve24(root, p);
+  const rel = relative24(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute23(rel)) return false;
+  if (isAbsolute24(rel)) return false;
   return true;
 }
 var MAX_PATH_LEN = 4096;
@@ -18260,7 +18340,7 @@ var shell_check_default = plugin51;
 
 // src/smart-rename/index.ts
 import { readFileSync as readFileSync13, writeFileSync as writeFileSync2 } from "node:fs";
-import { extname as extname6, isAbsolute as isAbsolute24, relative as relative24, resolve as resolve25 } from "node:path";
+import { extname as extname6, isAbsolute as isAbsolute25, relative as relative25, resolve as resolve25 } from "node:path";
 var API_VERSION34 = "^0.1.10";
 var state50 = {
   renameCount: 0,
@@ -18282,20 +18362,20 @@ function readConfig46(raw) {
 function withinProject7(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute24(p) ? resolve25(p) : resolve25(root, p);
-  const rel = relative24(root, resolved);
+  const resolved = isAbsolute25(p) ? resolve25(p) : resolve25(root, p);
+  const rel = relative25(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute24(rel)) return false;
+  if (isAbsolute25(rel)) return false;
   return true;
 }
 function toPosix7(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath7(p) {
-  return toPosix7(relative24(process.cwd(), p));
+  return toPosix7(relative25(process.cwd(), p));
 }
-function escapeRegex3(s) {
+function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var IDENTIFIER_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
@@ -18304,7 +18384,7 @@ function isIdentifier(name) {
 }
 function renameInContent(content, oldName, newName) {
   const re = new RegExp(
-    `(?<![A-Za-z0-9_$])${escapeRegex3(oldName)}(?![A-Za-z0-9_$])`,
+    `(?<![A-Za-z0-9_$])${escapeRegex2(oldName)}(?![A-Za-z0-9_$])`,
     "g"
   );
   let replacements = 0;
@@ -18487,7 +18567,6 @@ var OFFICIAL_PLUGIN_NAMES = [
   "type-gate",
   "token-throttle",
   "plugin-stack-observer",
-  "dead-code-detector",
   "dependency-vulnerability-gate",
   "migration-planner",
   "semantic-search-indexer",
@@ -18500,6 +18579,7 @@ var OFFICIAL_PLUGIN_NAMES = [
   "license-audit-gate",
   "accessibility-auditor",
   "security-hotspot-scanner",
+  "dead-code-detector",
   "duplicate-code-detector",
   "code-metrics",
   "refactor-suggester",
@@ -18926,9 +19006,17 @@ var spec_linker_default = plugin53;
 
 // src/template-engine/index.ts
 import { readFile as readFile16, writeFile as writeFile5 } from "node:fs/promises";
-import { isAbsolute as isAbsolute25 } from "node:path";
+import { isAbsolute as isAbsolute26 } from "node:path";
 var API_VERSION35 = "^0.1.10";
 var templates = /* @__PURE__ */ new Map();
+var MAX_TEMPLATES = 256;
+var MAX_TEMPLATE_NAME_CHARS = 128;
+var MAX_TEMPLATE_CONTENT_CHARS = 256 * 1024;
+var MAX_TEMPLATE_DESCRIPTION_CHARS = 4 * 1024;
+var MAX_TOTAL_TEMPLATE_CHARS = 8 * 1024 * 1024;
+function templateChars(template) {
+  return template.name.length + template.content.length + (template.description?.length ?? 0);
+}
 var contributorUnregister = null;
 function expandTemplate(template, variables) {
   let result = template;
@@ -18974,7 +19062,7 @@ function renderTemplateRaw(template, variables) {
   return result;
 }
 function validateRelativeTemplatePath(field, value) {
-  if (isAbsolute25(value) || value.split(/[\\/]+/).includes("..")) {
+  if (isAbsolute26(value) || value.split(/[\\/]+/).includes("..")) {
     return `${field} must be a relative path without ".." components`;
   }
   if (!withinProject(value)) {
@@ -19138,13 +19226,19 @@ var plugin54 = {
       inputSchema: {
         type: "object",
         properties: {
-          name: { type: "string", description: "Unique name for this template" },
+          name: {
+            type: "string",
+            maxLength: MAX_TEMPLATE_NAME_CHARS,
+            description: "Unique name for this template"
+          },
           content: {
             type: "string",
+            maxLength: MAX_TEMPLATE_CONTENT_CHARS,
             description: "Template content with {{variable}} placeholders"
           },
           description: {
             type: "string",
+            maxLength: MAX_TEMPLATE_DESCRIPTION_CHARS,
             description: "Optional description of what this template is for"
           }
         },
@@ -19162,8 +19256,26 @@ var plugin54 = {
         if (!content || typeof content !== "string") {
           return { ok: false, error: "content is required and must be a string" };
         }
+        if (name.length > MAX_TEMPLATE_NAME_CHARS) {
+          return { ok: false, error: `name exceeds ${MAX_TEMPLATE_NAME_CHARS} characters` };
+        }
+        if (content.length > MAX_TEMPLATE_CONTENT_CHARS) {
+          return {
+            ok: false,
+            error: `content exceeds ${MAX_TEMPLATE_CONTENT_CHARS} characters`
+          };
+        }
+        if (description && description.length > MAX_TEMPLATE_DESCRIPTION_CHARS) {
+          return {
+            ok: false,
+            error: `description exceeds ${MAX_TEMPLATE_DESCRIPTION_CHARS} characters`
+          };
+        }
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const existing = templates.get(name);
+        if (!existing && templates.size >= MAX_TEMPLATES) {
+          return { ok: false, error: `template limit reached (${MAX_TEMPLATES})` };
+        }
         const tmpl = {
           name,
           content,
@@ -19171,6 +19283,15 @@ var plugin54 = {
           createdAt: existing?.createdAt ?? now,
           updatedAt: now
         };
+        let retainedChars = 0;
+        for (const stored of templates.values()) retainedChars += templateChars(stored);
+        const nextChars = retainedChars - (existing ? templateChars(existing) : 0) + templateChars(tmpl);
+        if (nextChars > MAX_TOTAL_TEMPLATE_CHARS) {
+          return {
+            ok: false,
+            error: `template store exceeds ${MAX_TOTAL_TEMPLATE_CHARS} retained characters`
+          };
+        }
         templates.set(name, tmpl);
         api.metrics.gauge("template_count", templates.size);
         return {
@@ -19496,7 +19617,7 @@ var test_coverage_gate_default = plugin55;
 import { execFile as execFile14 } from "node:child_process";
 import { readFileSync as readFileSync15 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname8, isAbsolute as isAbsolute26, relative as relative25, resolve as resolve26 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute27, relative as relative26, resolve as resolve26 } from "node:path";
 var API_VERSION37 = "^0.1.10";
 var state53 = {
   invocationCount: 0,
@@ -19568,14 +19689,14 @@ var ALLOWED_RUNNER_FLAGS = /* @__PURE__ */ new Set([
 function withinProject8(p) {
   if (p.length === 0 || p.length > 4096 || p.startsWith("-")) return false;
   const root = resolve26(process.cwd());
-  const resolved = isAbsolute26(p) ? resolve26(p) : resolve26(root, p);
-  const rel = relative25(root, resolved);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute26(rel);
+  const resolved = isAbsolute27(p) ? resolve26(p) : resolve26(root, p);
+  const rel = relative26(root, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute27(rel);
 }
 function isInside3(parent, child) {
   if (parent === child) return true;
-  const rel = relative25(parent, child);
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute26(rel);
+  const rel = relative26(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute27(rel);
 }
 function tokenizeCommand(command) {
   const trimmed = command.trim();
@@ -19619,7 +19740,7 @@ function resolveTestCommand(baseCommand, testPattern) {
     if (!relativeBin) return null;
     const packageDir = dirname8(packagePath);
     const candidate = resolve26(packageDir, relativeBin);
-    if (isAbsolute26(relativeBin) || !isInside3(packageDir, candidate)) {
+    if (isAbsolute27(relativeBin) || !isInside3(packageDir, candidate)) {
       return null;
     }
     resolvedEntry = candidate;
@@ -19862,7 +19983,7 @@ var test_flake_detector_default = plugin56;
 
 // src/test-generator/index.ts
 import { readFileSync as readFileSync16 } from "node:fs";
-import { isAbsolute as isAbsolute27, relative as relative26, resolve as resolve27 } from "node:path";
+import { isAbsolute as isAbsolute28, relative as relative27, resolve as resolve27 } from "node:path";
 var API_VERSION38 = "^0.1.10";
 var state54 = {
   generateCount: 0,
@@ -19897,18 +20018,18 @@ function readConfig50(raw) {
 function withinProject9(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute27(p) ? resolve27(p) : resolve27(root, p);
-  const rel = relative26(root, resolved);
+  const resolved = isAbsolute28(p) ? resolve27(p) : resolve27(root, p);
+  const rel = relative27(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute27(rel)) return false;
+  if (isAbsolute28(rel)) return false;
   return true;
 }
 function toPosix8(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath8(p) {
-  return toPosix8(relative26(process.cwd(), p));
+  return toPosix8(relative27(process.cwd(), p));
 }
 function detectExports(content) {
   const exports = [];
@@ -20207,7 +20328,7 @@ var test_generator_default = plugin57;
 // src/test-runner-gate/index.ts
 import { execFile as execFile15 } from "node:child_process";
 import { access as access4 } from "node:fs/promises";
-import { basename as basename6, dirname as dirname9, isAbsolute as isAbsolute28, join as join7 } from "node:path";
+import { basename as basename6, dirname as dirname9, isAbsolute as isAbsolute29, join as join7 } from "node:path";
 import { buildWin32CmdShimInvocation as buildWin32CmdShimInvocation2, resolveWin32Command as resolveWin32Command2 } from "@wrongstack/tools/win32";
 function resolveExec(command, args) {
   const resolved = resolveWin32Command2(command);
@@ -20376,7 +20497,7 @@ function resolveAllowedCommand2(customCommand) {
   if (ALLOWED_COMMAND_TOKENS.has(head)) {
     return { cmd: head, args: tokens.slice(1) };
   }
-  if (isAbsolute28(head)) {
+  if (isAbsolute29(head)) {
     if (!withinProject(head)) return null;
     const base = basename6(head);
     if (ALLOWED_COMMAND_TOKENS.has(base)) {