@wrongstack/plugins 0.300.0 → 0.301.0

package/README.md

@@ -725,7 +725,9 @@ warning depending on `mode`.
 
 Protects sensitive paths from accidental writes/edits and destructive shell
 commands. Defaults cover lockfiles, `.env`, `.git`, and migration-like paths;
-use `mode: "warn"` for advisory-only enforcement.
+use `mode: "warn"` for advisory-only enforcement. Writer globs are blocked when
+their unresolved scope overlaps a protected path; narrow the target or add an
+`allow` glob to exempt an intentional scope.
 
 ```jsonc
 {

package/dist/config-validator.js

@@ -1,5 +1,30 @@
 // src/config-validator/index.ts
 import { readFileSync, statSync } from "node:fs";
+
+// src/runtime/index.ts
+import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/index.ts
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+function hasLeadingDash(arg) {
+  return arg.length > 0 && arg.startsWith("-");
+}
+function withinProjectPath(projectRoot, candidate) {
+  if (candidate.length === 0 || candidate.length > 4096) return false;
+  if (hasLeadingDash(candidate)) return false;
+  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(projectRoot, candidate);
+  const rel = relative(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function withinProject(p) {
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative(cwd, p) === ".";
+}
+
+// src/config-validator/index.ts
 var state = {
   invocations: 0,
   filesChecked: 0,
@@ -79,6 +104,9 @@ function positionToLineCol(text, pos) {
   const col = pos - upTo.lastIndexOf("\n");
   return { line, col };
 }
+function redactParseSnippet(message) {
+  return message.replace(/"[\s\S]{0,200}?"(?= is not valid JSON)/g, '"\u2026"');
+}
 function validateJson(text, isJsonc, fileName) {
   const source = isJsonc ? stripJsonc(text) : text;
   try {
@@ -112,10 +140,10 @@ function validateJson(text, isJsonc, fileName) {
       const idx = source.indexOf(snippetMatch[1]);
       if (idx >= 0) {
         const { line } = positionToLineCol(source, idx);
-        return [`JSON parse error near line ${line}: ${message.split("\n")[0]}`];
+        return [`JSON parse error near line ${line}`];
       }
     }
-    return [`JSON parse error: ${message.split("\n")[0]}`];
+    return [`JSON parse error: ${redactParseSnippet(message.split("\n")[0] ?? "")}`];
   }
 }
 function validateYaml(text) {
@@ -252,10 +280,12 @@ var plugin = {
     const cfg = readConfig(api.config.extensions?.["config-validator"]);
     const hook = (input) => {
       if (!cfg.enabled) return;
+      if (input.toolResult?.isError) return;
       state.invocations += 1;
       const ti = input.toolInput ?? {};
       const raw = ti["path"] ?? ti["file_path"] ?? ti["filePath"];
       if (typeof raw !== "string" || raw.length === 0) return;
+      if (!withinProject(raw)) return;
       const lower = raw.toLowerCase();
       if (!cfg.extensions.some((ext) => lower.endsWith(ext))) return;
       let text;