@wrongstack/plugins 0.302.2 → 0.305.0

package/dist/path-guard.js

@@ -1,11 +1,9 @@
 // src/path-guard/index.ts
-var state = {
-  invocations: 0,
-  blocks: 0,
-  warns: 0,
-  lastBlock: null,
-  hookUnregister: null
-};
+function createState() {
+  return { invocations: 0, blocks: 0, warns: 0, lastBlock: null, hookUnregister: null };
+}
+var states = /* @__PURE__ */ new WeakMap();
+var latestState = createState();
 var DEFAULT_PROTECT = [
   "pnpm-lock.yaml",
   "package-lock.json",
@@ -1273,17 +1271,16 @@ var plugin = {
     }
   },
   setup(api) {
-    state.invocations = 0;
-    state.blocks = 0;
-    state.warns = 0;
-    state.lastBlock = null;
-    if (state.hookUnregister) {
+    const previous = states.get(api);
+    if (previous?.hookUnregister) {
       try {
-        state.hookUnregister();
+        previous.hookUnregister();
       } catch {
       }
-      state.hookUnregister = null;
     }
+    const state = createState();
+    states.set(api, state);
+    latestState = state;
     const cfg = readConfig(api.config.extensions?.["path-guard"]);
     const protectRes = cfg.protect.map(compilePathGlob);
     const allowRes = cfg.allow.map(compilePathGlob);
@@ -1397,6 +1394,8 @@ var plugin = {
     });
   },
   teardown(api) {
+    const state = states.get(api);
+    if (!state) return;
     if (state.hookUnregister) {
       try {
         state.hookUnregister();
@@ -1409,9 +1408,11 @@ var plugin = {
     state.blocks = 0;
     state.warns = 0;
     state.lastBlock = null;
+    states.delete(api);
     api.log.info("path-guard: teardown complete", { final });
   },
   async health() {
+    const state = latestState;
     return {
       ok: true,
       message: state.lastBlock === null ? `path-guard: ${state.invocations} invocation(s), ${state.blocks} block(s), ${state.warns} warn(s)` : `path-guard: last block on "${state.lastBlock.path}" (${state.lastBlock.tool}) at ${state.lastBlock.when}`,

package/dist/secret-scanner.js

@@ -1,20 +1,3 @@
-// src/runtime/local-bin.ts
-import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
-
-// src/runtime/handles.ts
-function releaseHandle(off) {
-  if (off) {
-    try {
-      off();
-    } catch {
-    }
-  }
-  return null;
-}
-
-// src/runtime/index.ts
-var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
-
 // src/runtime/credential-patterns.ts
 var CREDENTIAL_PATTERNS = [
   // LLM provider keys
@@ -125,10 +108,26 @@ function cloneCredentialPatterns() {
   }));
 }
 
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/handles.ts
+function releaseHandle(off) {
+  if (off) {
+    try {
+      off();
+    } catch {
+    }
+  }
+  return null;
+}
+
+// src/runtime/index.ts
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+
 // src/secret-scanner/index.ts
 var BASE_PATTERNS = cloneCredentialPatterns();
 var PATTERNS = [...BASE_PATTERNS];
-var patternCacheKey = "";
 var GROUP_INDEX_OF_PATTERN = [];
 var COMBINED_REGEX = buildCombinedRegex(PATTERNS);
 var SCAN_WINDOW_LENGTH = 1e5;
@@ -151,11 +150,6 @@ function patternTypeForGroups(groups) {
   return void 0;
 }
 function buildCombinedRegex(patterns) {
-  const newCacheKey = JSON.stringify(patterns.map((p) => [p.type, p.regex.source]));
-  if (newCacheKey === patternCacheKey && COMBINED_REGEX) {
-    return COMBINED_REGEX;
-  }
-  patternCacheKey = newCacheKey;
   const offsets = [];
   let cursor = 0;
   for (const p of patterns) {
@@ -165,21 +159,30 @@ function buildCombinedRegex(patterns) {
   GROUP_INDEX_OF_PATTERN = offsets;
   return new RegExp(patterns.map((p) => `(${p.regex.source})`).join("|"), "g");
 }
-var state = {
-  blockCount: 0,
-  redactCount: 0,
-  allowCount: 0,
-  /** PostToolUse: secrets detected in tool output. */
-  leakCount: 0,
-  /** Most recent PreToolUse block — surfaced by `secret_scanner_status`. */
-  lastBlock: null,
-  /** Most recent PostToolUse leak — surfaced by `secret_scanner_status`. */
-  lastLeak: null,
-  /** PreToolUse hook handle so teardown can unregister. */
-  hookUnregister: null,
-  /** PostToolUse hook handle so teardown can unregister. */
-  postHookUnregister: null
-};
+function createState() {
+  return {
+    blockCount: 0,
+    redactCount: 0,
+    allowCount: 0,
+    /** PostToolUse: secrets detected in tool output. */
+    leakCount: 0,
+    /** Most recent PreToolUse block — surfaced by `secret_scanner_status`. */
+    lastBlock: null,
+    /** Most recent PostToolUse leak — surfaced by `secret_scanner_status`. */
+    lastLeak: null,
+    /** PreToolUse hook handle so teardown can unregister. */
+    hookUnregister: null,
+    /** PostToolUse hook handle so teardown can unregister. */
+    postHookUnregister: null
+  };
+}
+var runtimes = /* @__PURE__ */ new WeakMap();
+var latestRuntime;
+function activateRuntime(runtime) {
+  PATTERNS = runtime.patterns;
+  COMBINED_REGEX = runtime.combinedRegex;
+  GROUP_INDEX_OF_PATTERN = runtime.groupIndexes;
+}
 function scanWindow(window, found, startTime) {
   COMBINED_REGEX.lastIndex = 0;
   let m;
@@ -325,8 +328,10 @@ function readConfig(raw) {
     customPatterns
   };
 }
-function buildHook(cfg, log) {
+function buildHook(cfg, log, runtime) {
   return (input) => {
+    activateRuntime(runtime);
+    const { state } = runtime;
     if (!cfg.enabled) return;
     const toolName = input.toolName ?? "unknown";
     const matched = scanInput(input.toolInput);
@@ -368,8 +373,10 @@ function buildHook(cfg, log) {
     return void 0;
   };
 }
-function buildPostHook(cfg, log) {
+function buildPostHook(cfg, log, runtime) {
   return (input) => {
+    activateRuntime(runtime);
+    const { state } = runtime;
     if (!cfg.enabled) return;
     const result = input.toolResult;
     if (!result || typeof result.content !== "string") return;
@@ -446,14 +453,11 @@ var plugin = {
     }
   },
   setup(api) {
-    state.blockCount = 0;
-    state.redactCount = 0;
-    state.allowCount = 0;
-    state.leakCount = 0;
-    state.lastBlock = null;
-    state.lastLeak = null;
-    state.hookUnregister = releaseHandle(state.hookUnregister);
-    state.postHookUnregister = releaseHandle(state.postHookUnregister);
+    const previous = runtimes.get(api);
+    if (previous) {
+      previous.state.hookUnregister = releaseHandle(previous.state.hookUnregister);
+      previous.state.postHookUnregister = releaseHandle(previous.state.postHookUnregister);
+    }
     const cfg = readConfig(api.config.extensions?.["secret-scanner"]);
     PATTERNS = [...BASE_PATTERNS];
     for (const cp of cfg.customPatterns) {
@@ -463,11 +467,20 @@ var plugin = {
       }
     }
     COMBINED_REGEX = buildCombinedRegex(PATTERNS);
+    const runtime = {
+      state: createState(),
+      patterns: PATTERNS,
+      combinedRegex: COMBINED_REGEX,
+      groupIndexes: [...GROUP_INDEX_OF_PATTERN]
+    };
+    runtimes.set(api, runtime);
+    latestRuntime = runtime;
+    const { state } = runtime;
     const log = {
       warn: (msg, ...rest) => api.log.warn(msg, ...rest),
       info: (msg, ...rest) => api.log.info(msg, ...rest)
     };
-    const hook = buildHook(cfg, log);
+    const hook = buildHook(cfg, log, runtime);
     state.hookUnregister = api.registerHook("PreToolUse", cfg.matcher, hook, {
       name: "secret-scanner",
       // Redaction rewrites arguments; block/allow modes must inspect the final
@@ -477,7 +490,7 @@ var plugin = {
       failurePolicy: "closed",
       policy: true
     });
-    const postHook = buildPostHook(cfg, log);
+    const postHook = buildPostHook(cfg, log, runtime);
     state.postHookUnregister = api.registerHook("PostToolUse", cfg.postToolUseMatcher, postHook);
     api.tools.register({
       name: "secret_scanner_status",
@@ -486,6 +499,7 @@ var plugin = {
       permission: "auto",
       mutating: false,
       async execute() {
+        activateRuntime(runtime);
         return {
           ok: true,
           enabled: cfg.enabled,
@@ -518,6 +532,7 @@ var plugin = {
       permission: "auto",
       mutating: false,
       async execute(input) {
+        activateRuntime(runtime);
         const text = typeof input["text"] === "string" ? input["text"] : "";
         const matched = findMatches(text);
         return {
@@ -535,6 +550,9 @@ var plugin = {
     });
   },
   teardown(api) {
+    const runtime = runtimes.get(api);
+    if (!runtime) return;
+    const { state } = runtime;
     if (state.hookUnregister) {
       try {
         state.hookUnregister();
@@ -561,11 +579,11 @@ var plugin = {
     state.leakCount = 0;
     state.lastBlock = null;
     state.lastLeak = null;
-    PATTERNS = [...BASE_PATTERNS];
-    COMBINED_REGEX = buildCombinedRegex(PATTERNS);
+    runtimes.delete(api);
     api.log.info("secret-scanner: teardown complete", { counters: finalCounters });
   },
   async health() {
+    const state = latestRuntime?.state ?? createState();
     return {
       ok: true,
       message: state.lastLeak !== null ? `secret-scanner: last leak at ${state.lastLeak.when} on ${state.lastLeak.toolName} (${state.lastLeak.matchedTypes.join(", ")})` : state.lastBlock !== null ? `secret-scanner: last block at ${state.lastBlock.when} on ${state.lastBlock.toolName} (${state.lastBlock.matchedTypes.join(", ")})` : `secret-scanner: ${state.blockCount + state.redactCount + state.allowCount + state.leakCount} invocations, no blocks or leaks`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/plugins",
-  "version": "0.302.2",
+  "version": "0.305.0",
   "description": "Official WrongStack collection of focused plugins for code quality, security, observability, planning, and agent coordination",
   "license": "MIT",
   "author": "ECOSTACK TECHNOLOGY OÜ",
@@ -299,8 +299,8 @@
     "vitest": "^4.1.10"
   },
   "dependencies": {
-    "@wrongstack/core": "0.302.2",
-    "@wrongstack/tools": "0.302.2"
+    "@wrongstack/tools": "0.305.0",
+    "@wrongstack/core": "0.305.0"
   },
   "scripts": {
     "build": "node ../../scripts/build-package.mjs",