@wrongstack/plugins 0.307.1 → 0.308.0

package/dist/license-audit-gate/index.d.ts

@@ -27,6 +27,7 @@
  * @public
  */
 import type { Plugin } from '@wrongstack/core/types';
+export declare function parsePackageNames(command: string): string[];
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/license-audit-gate.js

@@ -1,8 +1,383 @@
 // src/license-audit-gate/index.ts
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
-var API_VERSION = "^0.1.10";
+
+// src/dep-guard/index.ts
 var state = {
+  invocations: 0,
+  installsSeen: 0,
+  blocks: 0,
+  warns: 0,
+  llmConfirmCount: 0,
+  llmConfirmErrors: 0,
+  lastBlock: null,
+  hookUnregister: null
+};
+var DEFAULTS = {
+  enabled: true,
+  mode: "block",
+  deny: [],
+  allow: [],
+  warnOnUnpinned: false,
+  typosquatCheck: true,
+  confirmTyposquatsWithLlm: false
+};
+function readConfig(raw) {
+  if (!raw || typeof raw !== "object") return { ...DEFAULTS };
+  const r = raw;
+  const strings = (v) => Array.isArray(v) ? v.filter((s) => typeof s === "string" && s.length > 0) : [];
+  return {
+    enabled: r["enabled"] !== false,
+    mode: r["mode"] === "warn" ? "warn" : "block",
+    deny: strings(r["deny"]),
+    allow: strings(r["allow"]),
+    warnOnUnpinned: r["warnOnUnpinned"] === true,
+    typosquatCheck: r["typosquatCheck"] !== false,
+    confirmTyposquatsWithLlm: r["confirmTyposquatsWithLlm"] === true
+  };
+}
+var INSTALL_RE = /(?:^|[;&|]\s*)(npm|pnpm|yarn|bun)\s+(?:install|i|add)\s+([^;&|]+)|(?:^|[;&|]\s*)(pip3?|uv)\s+(?:pip\s+)?install\s+([^;&|]+)|(?:^|[;&|]\s*)(cargo)\s+add\s+([^;&|]+)/gi;
+function parseInstallCommands(command) {
+  const out = [];
+  INSTALL_RE.lastIndex = 0;
+  let m = INSTALL_RE.exec(command);
+  while (m !== null) {
+    const manager = (m[1] ?? m[3] ?? m[5] ?? "").toLowerCase();
+    const argString = m[2] ?? m[4] ?? m[6] ?? "";
+    const packages = [];
+    for (const token of argString.split(/\s+/)) {
+      if (!token || token.startsWith("-")) continue;
+      if (/^(\.|\/|file:|git\+|https?:)/i.test(token) || token.endsWith(".tgz")) continue;
+      const cleaned = token.replace(/^['"]|['"]$/g, "");
+      if (!cleaned) continue;
+      let name = cleaned;
+      let version = null;
+      const pipMatch = /^([A-Za-z0-9_.-]+(?:\[[^\]]+\])?)\s*(==|>=|<=|~=|!=|>|<)\s*(.+)$/.exec(cleaned);
+      if (pipMatch?.[1]) {
+        name = pipMatch[1];
+        const op = pipMatch[2] ?? "";
+        const ver = (pipMatch[3] ?? "").trim();
+        version = op === "==" || op === "" ? ver || null : `${op}${ver}`;
+      } else {
+        const at = cleaned.lastIndexOf("@");
+        if (at > 0) {
+          name = cleaned.slice(0, at);
+          version = cleaned.slice(at + 1) || null;
+        }
+      }
+      if (name) packages.push({ name, version });
+    }
+    out.push({ manager, packages });
+    m = INSTALL_RE.exec(command);
+  }
+  return out;
+}
+function matchesPattern(name, pattern) {
+  if (pattern.endsWith("*"))
+    return name.toLowerCase().startsWith(pattern.slice(0, -1).toLowerCase());
+  return name.toLowerCase() === pattern.toLowerCase();
+}
+var POPULAR_PACKAGES = [
+  "react",
+  "react-dom",
+  "express",
+  "lodash",
+  "axios",
+  "typescript",
+  "vite",
+  "vitest",
+  "next",
+  "vue",
+  "svelte",
+  "zod",
+  "prettier",
+  "eslint",
+  "jest",
+  "webpack",
+  "commander",
+  "chalk",
+  "dotenv",
+  "requests",
+  "numpy",
+  "pandas",
+  "flask",
+  "django",
+  "serde",
+  "tokio"
+];
+function editDistance(a, b) {
+  if (a === b) return 0;
+  if (Math.abs(a.length - b.length) > 2) return 3;
+  const d = Array.from({ length: a.length + 1 }, (_, i) => {
+    const row = new Array(b.length + 1).fill(0);
+    row[0] = i;
+    return row;
+  });
+  for (let j = 0; j <= b.length; j++) d[0][j] = j;
+  for (let i = 1; i <= a.length; i++) {
+    for (let j = 1; j <= b.length; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      const row = d[i];
+      const prevRow = d[i - 1];
+      row[j] = Math.min(
+        prevRow[j] + 1,
+        row[j - 1] + 1,
+        prevRow[j - 1] + cost
+      );
+      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+        row[j] = Math.min(row[j], d[i - 2][j - 2] + 1);
+      }
+    }
+  }
+  return d[a.length][b.length];
+}
+function typosquatOf(name) {
+  const lower = name.toLowerCase().replace(/^@[^/]+\//, "");
+  if (POPULAR_PACKAGES.includes(lower)) return null;
+  for (const popular of POPULAR_PACKAGES) {
+    if (editDistance(lower, popular) === 1) return popular;
+  }
+  return null;
+}
+var plugin = {
+  name: "dep-guard",
+  version: "0.1.0",
+  description: "Supervises dependency installs: blocks deny-listed packages, flags typosquat lookalikes, and optionally warns on unpinned versions",
+  apiVersion: "^0.1.10",
+  capabilities: { tools: true, hooks: true, llm: true },
+  defaultConfig: { ...DEFAULTS },
+  configSchema: {
+    type: "object",
+    properties: {
+      enabled: { type: "boolean", default: true, description: "Master switch." },
+      mode: {
+        type: "string",
+        enum: ["block", "warn"],
+        default: "block",
+        description: "How deny-list hits are handled."
+      },
+      deny: {
+        type: "array",
+        items: { type: "string" },
+        default: [],
+        description: 'Package names (exact) or prefix globs ("@evil/*") that must not be installed.'
+      },
+      allow: {
+        type: "array",
+        items: { type: "string" },
+        default: [],
+        description: "Exemptions that override deny."
+      },
+      warnOnUnpinned: {
+        type: "boolean",
+        default: false,
+        description: "Warn when a package is installed without an explicit version."
+      },
+      typosquatCheck: {
+        type: "boolean",
+        default: true,
+        description: "Warn when a package name is one edit away from a well-known package."
+      },
+      confirmTyposquatsWithLlm: {
+        type: "boolean",
+        default: false,
+        description: "Ask the risk-review Council to assess a flagged typosquat, with One Shot fallback. Appended to the warn context, never escalates to a block. Off by default."
+      }
+    }
+  },
+  setup(api) {
+    state.invocations = 0;
+    state.installsSeen = 0;
+    state.blocks = 0;
+    state.warns = 0;
+    state.llmConfirmCount = 0;
+    state.llmConfirmErrors = 0;
+    state.lastBlock = null;
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
+    const cfg = readConfig(api.config.extensions?.["dep-guard"]);
+    const hook = async (input) => {
+      if (!cfg.enabled) return;
+      state.invocations += 1;
+      const ti = input.toolInput ?? {};
+      const command = typeof ti["command"] === "string" ? ti["command"] : "";
+      if (!command) return;
+      const installs = parseInstallCommands(command);
+      const packages = installs.flatMap((i) => i.packages);
+      if (packages.length === 0) return;
+      state.installsSeen += 1;
+      api.metrics.counter("installs_seen");
+      const notes = [];
+      for (const pkg of packages) {
+        const allowed = cfg.allow.some((p) => matchesPattern(pkg.name, p));
+        const denied = !allowed && cfg.deny.some((p) => matchesPattern(pkg.name, p));
+        if (denied) {
+          if (cfg.mode === "block") {
+            state.blocks += 1;
+            state.lastBlock = {
+              pkg: pkg.name,
+              command: command.slice(0, 200),
+              when: (/* @__PURE__ */ new Date()).toISOString()
+            };
+            api.metrics.counter("blocks");
+            return {
+              decision: "block",
+              reason: `dep-guard: package "${pkg.name}" is on the deny list (config.extensions["dep-guard"].deny) \u2014 install refused. Ask the user before adding this dependency, or add an \`allow\` entry.`
+            };
+          }
+          notes.push(
+            `"${pkg.name}" is DENY-LISTED \u2014 do not add it without explicit user approval.`
+          );
+        }
+        if (cfg.typosquatCheck) {
+          const lookalike = typosquatOf(pkg.name);
+          if (lookalike) {
+            const baseNote = `"${pkg.name}" is one edit away from the well-known package "${lookalike}" \u2014 possible typosquat. Verify the name before installing.`;
+            if (cfg.confirmTyposquatsWithLlm && api.llm) {
+              try {
+                const question = `Classify whether npm package "${pkg.name}" is likely a typo or typosquat of "${lookalike}".`;
+                const council = api.llm.council ? await api.llm.council(question, {
+                  context: "The only supplied evidence is that the names have edit distance 1. Do not invent registry, download, ownership, or provenance facts.",
+                  profile: "risk-review",
+                  options: [
+                    { id: "typo", label: "Likely typo or typosquat" },
+                    { id: "real", label: "Likely distinct real package" },
+                    { id: "uncertain", label: "Insufficient evidence" }
+                  ]
+                }) : null;
+                const councilVerdict = council?.status === "decided" && council.optionId ? `${council.optionId.toUpperCase()}: ${council.reason ?? council.answer ?? "no rationale"}` : null;
+                const t = councilVerdict ? councilVerdict : (await api.llm.complete(
+                  `${question} Reply with ONE sentence starting with "TYPO:", "REAL:", or "UNCERTAIN:".`,
+                  {
+                    system: "You are a supply-chain security assistant. Use only supplied evidence and preserve uncertainty.",
+                    role: "security-reviewer",
+                    maxTokens: 100
+                  }
+                )).text.trim();
+                if (t) {
+                  state.llmConfirmCount += 1;
+                  api.metrics.counter("llm_confirm");
+                  notes.push(`${baseNote} LLM verdict: ${t.slice(0, 300)}`);
+                } else {
+                  notes.push(baseNote);
+                }
+              } catch {
+                state.llmConfirmErrors += 1;
+                notes.push(baseNote);
+              }
+            } else {
+              notes.push(baseNote);
+            }
+          }
+        }
+        if (cfg.warnOnUnpinned && pkg.version === null) {
+          notes.push(`"${pkg.name}" has no pinned version \u2014 consider "${pkg.name}@<version>".`);
+        }
+      }
+      if (notes.length > 0) {
+        state.warns += 1;
+        api.metrics.counter("warns");
+        return {
+          decision: "allow",
+          additionalContext: `dep-guard:
+${notes.map((n) => `  - ${n}`).join("\n")}`
+        };
+      }
+      return {
+        decision: "allow",
+        additionalContext: `dep-guard: this command adds ${packages.length} dependenc${packages.length === 1 ? "y" : "ies"}: ${packages.map((p) => p.name).join(", ")}. Confirm each is intentional.`
+      };
+    };
+    state.hookUnregister = api.registerHook("PreToolUse", "bash|exec", hook, {
+      name: "dep-guard",
+      stage: "validate",
+      failurePolicy: "closed",
+      policy: true
+    });
+    api.tools.register({
+      name: "dep_guard_status",
+      description: "Reports dep-guard state: deny/allow lists, mode, and counters (installs seen, blocks, warns).",
+      inputSchema: { type: "object", properties: {} },
+      permission: "auto",
+      category: "Diagnostics",
+      mutating: false,
+      async execute() {
+        return {
+          ok: true,
+          enabled: cfg.enabled,
+          mode: cfg.mode,
+          deny: cfg.deny,
+          allow: cfg.allow,
+          warnOnUnpinned: cfg.warnOnUnpinned,
+          typosquatCheck: cfg.typosquatCheck,
+          counters: {
+            invocations: state.invocations,
+            installsSeen: state.installsSeen,
+            llmConfirmCount: state.llmConfirmCount,
+            llmConfirmErrors: state.llmConfirmErrors,
+            blocks: state.blocks,
+            warns: state.warns
+          },
+          lastBlock: state.lastBlock
+        };
+      }
+    });
+    api.log.info("dep-guard plugin loaded", {
+      version: "0.1.0",
+      enabled: cfg.enabled,
+      mode: cfg.mode,
+      denyCount: cfg.deny.length
+    });
+  },
+  teardown(api) {
+    if (state.hookUnregister) {
+      try {
+        state.hookUnregister();
+      } catch {
+      }
+      state.hookUnregister = null;
+    }
+    const final = {
+      invocations: state.invocations,
+      installsSeen: state.installsSeen,
+      llmConfirmCount: state.llmConfirmCount,
+      llmConfirmErrors: state.llmConfirmErrors,
+      blocks: state.blocks,
+      warns: state.warns
+    };
+    state.invocations = 0;
+    state.installsSeen = 0;
+    state.blocks = 0;
+    state.warns = 0;
+    state.llmConfirmCount = 0;
+    state.llmConfirmErrors = 0;
+    state.lastBlock = null;
+    api.log.info("dep-guard: teardown complete", { final });
+  },
+  async health() {
+    return {
+      ok: true,
+      message: state.lastBlock === null ? `dep-guard: ${state.installsSeen} install command(s) seen, ${state.blocks} block(s), ${state.warns} warn(s)` : `dep-guard: last block on "${state.lastBlock.pkg}" at ${state.lastBlock.when}`,
+      counters: {
+        invocations: state.invocations,
+        installsSeen: state.installsSeen,
+        llmConfirmCount: state.llmConfirmCount,
+        llmConfirmErrors: state.llmConfirmErrors,
+        blocks: state.blocks,
+        warns: state.warns
+      }
+    };
+  }
+};
+
+// src/license-audit-gate/index.ts
+var API_VERSION = "^0.1.10";
+var state2 = {
   invocations: 0,
   installsSeen: 0,
   packagesAudited: 0,
@@ -13,7 +388,7 @@ var state = {
   lastResult: null,
   hookUnregister: null
 };
-var DEFAULTS = {
+var DEFAULTS2 = {
   enabled: true,
   allowedLicenses: ["MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "0BSD", "Unlicense"],
   block: true
@@ -22,13 +397,13 @@ function normalizeStrings(v) {
   if (!Array.isArray(v)) return [];
   return v.filter((s) => typeof s === "string" && s.length > 0).map((s) => s.trim());
 }
-function readConfig(raw) {
-  if (!raw || typeof raw !== "object") return { ...DEFAULTS };
+function readConfig2(raw) {
+  if (!raw || typeof raw !== "object") return { ...DEFAULTS2 };
   const r = raw;
   const allowed = normalizeStrings(r["allowedLicenses"]);
   return {
     enabled: r["enabled"] !== false,
-    allowedLicenses: allowed.length > 0 ? allowed : [...DEFAULTS.allowedLicenses],
+    allowedLicenses: allowed.length > 0 ? allowed : [...DEFAULTS2.allowedLicenses],
     block: r["block"] !== false
   };
 }
@@ -50,24 +425,10 @@ function extractLicenseStrings(pkg) {
   }
   return [...new Set(out)];
 }
-var INSTALL_RE = /(?:^|[;&|]\s*)(npm|pnpm|yarn|bun)\s+(?:install|i|add)\s+([^;&|]+)/gi;
 function parsePackageNames(command) {
-  const names = [];
-  INSTALL_RE.lastIndex = 0;
-  for (const m of command.matchAll(INSTALL_RE)) {
-    const argString = m[2] ?? "";
-    for (const token of argString.split(/\s+/)) {
-      if (!token || token.startsWith("-")) continue;
-      if (/^(\.|\/|file:|git\+|https?:)/i.test(token) || token.endsWith(".tgz")) continue;
-      const cleaned = token.replace(/^['"]|['"]$/g, "");
-      if (!cleaned) continue;
-      let name = cleaned;
-      const at = cleaned.lastIndexOf("@");
-      if (at > 0) name = cleaned.slice(0, at);
-      if (name) names.push(name);
-    }
-  }
-  return [...new Set(names)];
+  return [
+    ...new Set(parseInstallCommands(command).flatMap((entry) => entry.packages.map((pkg) => pkg.name)))
+  ];
 }
 function auditPackages(names, allowedLicenses) {
   const results = [];
@@ -88,13 +449,13 @@ function auditPackages(names, allowedLicenses) {
   const ok = errors.length === 0 && results.every((r) => r.allowed);
   return { ok, results, errors };
 }
-var plugin = {
+var plugin2 = {
   name: "license-audit-gate",
   version: "0.1.0",
   description: "PostToolUse hook that audits dependency licenses after package-manager install/add commands and blocks disallowed licenses",
   apiVersion: API_VERSION,
   capabilities: { tools: true, hooks: true },
-  defaultConfig: { ...DEFAULTS },
+  defaultConfig: { ...DEFAULTS2 },
   configSchema: {
     type: "object",
     properties: {
@@ -106,7 +467,7 @@ var plugin = {
       allowedLicenses: {
         type: "array",
         items: { type: "string" },
-        default: DEFAULTS.allowedLicenses,
+        default: DEFAULTS2.allowedLicenses,
         description: "List of allowed SPDX/license identifiers."
       },
       block: {
@@ -117,39 +478,39 @@ var plugin = {
     }
   },
   setup(api) {
-    state.invocations = 0;
-    state.installsSeen = 0;
-    state.packagesAudited = 0;
-    state.allowedCount = 0;
-    state.deniedCount = 0;
-    state.blockedCount = 0;
-    state.errorCount = 0;
-    state.lastResult = null;
-    if (state.hookUnregister) {
+    state2.invocations = 0;
+    state2.installsSeen = 0;
+    state2.packagesAudited = 0;
+    state2.allowedCount = 0;
+    state2.deniedCount = 0;
+    state2.blockedCount = 0;
+    state2.errorCount = 0;
+    state2.lastResult = null;
+    if (state2.hookUnregister) {
       try {
-        state.hookUnregister();
+        state2.hookUnregister();
       } catch {
       }
-      state.hookUnregister = null;
+      state2.hookUnregister = null;
     }
-    const cfg = readConfig(api.config.extensions?.["license-audit-gate"]);
+    const cfg = readConfig2(api.config.extensions?.["license-audit-gate"]);
     const hook = (input) => {
       if (!cfg.enabled) return;
       if (input.toolResult?.isError) return;
       const ti = input.toolInput ?? {};
       const command = typeof ti["command"] === "string" ? ti["command"] : "";
       if (!command) return;
-      state.invocations += 1;
+      state2.invocations += 1;
       const names = parsePackageNames(command);
       if (names.length === 0) return;
-      state.installsSeen += 1;
+      state2.installsSeen += 1;
       const audit = auditPackages(names, cfg.allowedLicenses);
-      state.packagesAudited += names.length;
+      state2.packagesAudited += names.length;
       const denied = audit.results.filter((r) => !r.allowed).map((r) => r.name);
-      state.allowedCount += audit.results.filter((r) => r.allowed).length;
-      state.deniedCount += denied.length;
-      state.errorCount += audit.errors.length;
-      state.lastResult = {
+      state2.allowedCount += audit.results.filter((r) => r.allowed).length;
+      state2.deniedCount += denied.length;
+      state2.errorCount += audit.errors.length;
+      state2.lastResult = {
         passed: audit.ok,
         denied,
         when: (/* @__PURE__ */ new Date()).toISOString()
@@ -167,7 +528,7 @@ var plugin = {
 Allowed licenses: ${cfg.allowedLicenses.join(", ")}
 ` + lines.join("\n");
       if (cfg.block) {
-        state.blockedCount += 1;
+        state2.blockedCount += 1;
         return {
           decision: "block",
           reason: message,
@@ -176,7 +537,7 @@ Allowed licenses: ${cfg.allowedLicenses.join(", ")}
       }
       return { additionalContext: message };
     };
-    state.hookUnregister = api.registerHook("PostToolUse", "bash|exec", hook);
+    state2.hookUnregister = api.registerHook("PostToolUse", "bash|exec", hook);
     api.tools.register({
       name: "license_audit_status",
       description: "Reports license-audit-gate state: allowlist, block mode, and per-session audit counters.",
@@ -191,15 +552,15 @@ Allowed licenses: ${cfg.allowedLicenses.join(", ")}
           allowedLicenses: cfg.allowedLicenses,
           block: cfg.block,
           counters: {
-            invocations: state.invocations,
-            installsSeen: state.installsSeen,
-            packagesAudited: state.packagesAudited,
-            allowed: state.allowedCount,
-            denied: state.deniedCount,
-            blocked: state.blockedCount,
-            errors: state.errorCount
+            invocations: state2.invocations,
+            installsSeen: state2.installsSeen,
+            packagesAudited: state2.packagesAudited,
+            allowed: state2.allowedCount,
+            denied: state2.deniedCount,
+            blocked: state2.blockedCount,
+            errors: state2.errorCount
           },
-          lastResult: state.lastResult
+          lastResult: state2.lastResult
         };
       }
     });
@@ -210,50 +571,51 @@ Allowed licenses: ${cfg.allowedLicenses.join(", ")}
     });
   },
   teardown(api) {
-    if (state.hookUnregister) {
+    if (state2.hookUnregister) {
       try {
-        state.hookUnregister();
+        state2.hookUnregister();
       } catch {
       }
-      state.hookUnregister = null;
+      state2.hookUnregister = null;
     }
     const final = {
-      invocations: state.invocations,
-      installsSeen: state.installsSeen,
-      packagesAudited: state.packagesAudited,
-      allowed: state.allowedCount,
-      denied: state.deniedCount,
-      blocked: state.blockedCount,
-      errors: state.errorCount
+      invocations: state2.invocations,
+      installsSeen: state2.installsSeen,
+      packagesAudited: state2.packagesAudited,
+      allowed: state2.allowedCount,
+      denied: state2.deniedCount,
+      blocked: state2.blockedCount,
+      errors: state2.errorCount
     };
-    state.invocations = 0;
-    state.installsSeen = 0;
-    state.packagesAudited = 0;
-    state.allowedCount = 0;
-    state.deniedCount = 0;
-    state.blockedCount = 0;
-    state.errorCount = 0;
-    state.lastResult = null;
+    state2.invocations = 0;
+    state2.installsSeen = 0;
+    state2.packagesAudited = 0;
+    state2.allowedCount = 0;
+    state2.deniedCount = 0;
+    state2.blockedCount = 0;
+    state2.errorCount = 0;
+    state2.lastResult = null;
     api.log.info("license-audit-gate: teardown complete", { final });
   },
   async health() {
     return {
       ok: true,
-      message: state.lastResult ? `license-audit-gate: ${state.installsSeen} install command(s) seen, ${state.deniedCount} denied, ${state.blockedCount} blocked` : `license-audit-gate: ${state.invocations} invocation(s), ${state.packagesAudited} package(s) audited`,
+      message: state2.lastResult ? `license-audit-gate: ${state2.installsSeen} install command(s) seen, ${state2.deniedCount} denied, ${state2.blockedCount} blocked` : `license-audit-gate: ${state2.invocations} invocation(s), ${state2.packagesAudited} package(s) audited`,
       counters: {
-        invocations: state.invocations,
-        installsSeen: state.installsSeen,
-        packagesAudited: state.packagesAudited,
-        allowed: state.allowedCount,
-        denied: state.deniedCount,
-        blocked: state.blockedCount,
-        errors: state.errorCount
+        invocations: state2.invocations,
+        installsSeen: state2.installsSeen,
+        packagesAudited: state2.packagesAudited,
+        allowed: state2.allowedCount,
+        denied: state2.deniedCount,
+        blocked: state2.blockedCount,
+        errors: state2.errorCount
       },
-      lastResult: state.lastResult
+      lastResult: state2.lastResult
     };
   }
 };
-var license_audit_gate_default = plugin;
+var license_audit_gate_default = plugin2;
 export {
-  license_audit_gate_default as default
+  license_audit_gate_default as default,
+  parsePackageNames
 };

package/dist/lint-gate/index.d.ts

@@ -26,6 +26,19 @@
  * @public
  */
 import type { Plugin } from '@wrongstack/core/types';
+interface ResolvedLinter {
+    /** Always the current Node executable; never a shell or package-manager shim. */
+    cmd: string;
+    /** Local package bin entry followed by linter-specific arguments. */
+    args: string[];
+    name: 'biome' | 'eslint';
+}
+/**
+ * Resolve a linter's project-local JavaScript bin entry from package metadata.
+ * Using `node <entry>` avoids npx, shell configuration, and Windows `.cmd`
+ * shims while still respecting Node's normal project-local package lookup.
+ */
+export declare function resolveLocalLinter(name: 'biome' | 'eslint', cwd: string): ResolvedLinter | null;
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map