@wrongstack/plugins 0.307.1 → 0.308.1

package/dist/accessibility-auditor/index.d.ts

@@ -32,6 +32,11 @@ export interface A11yFinding {
     rule: A11yRule;
     severity: 'error' | 'warning';
     message: string;
+    /**
+     * Optional scan limitation. Cross-file labels (e.g. `<Label>` in a
+     * sibling component) are invisible to this single-file regex walk.
+     */
+    note?: string;
 }
 declare const plugin: Plugin;
 export default plugin;

package/dist/accessibility-auditor.js

@@ -115,15 +115,40 @@ var INPUT_BUTTON = /<input\b[^>]*\btype\s*=\s*["'](submit|button|reset)["'][^>]*
 var ATTR_ID = /\bid\s*=\s*["']([^"']+)["']/gi;
 var ATTR_ALT = /\balt\s*=/i;
 var ATTR_ARIA_LABEL = /\b(?:aria-label|aria-labelledby)\s*=/i;
+var ATTR_ARIA_DESCRIBEDBY = /\baria-describedby\s*=/i;
 var ATTR_TITLE = /\btitle\s*=/i;
 var ATTR_PLACEHOLDER = /\bplaceholder\s*=/i;
 var ATTR_VALUE = /\bvalue\s*=/i;
+var ATTR_ROLE_DECORATIVE = /\brole\s*=\s*["'](?:presentation|none)["']/i;
+var SINGLE_FILE_LABEL_NOTE = "Single-file heuristic: a label declared in a sibling component file is not visible to this scan.";
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function hasMeaningfulAlt(tag) {
   const m = ATTR_ALT.exec(tag);
   ATTR_ALT.lastIndex = 0;
   if (!m) return false;
   const valMatch = tag.match(/\balt\s*=\s*["']?([^"'\s>]*)["']?/i);
-  return valMatch ? valMatch[1].trim().length > 0 : false;
+  const alt = valMatch ? valMatch[1].trim() : "";
+  if (alt.length > 0) return true;
+  return ATTR_ROLE_DECORATIVE.test(tag);
+}
+function hasFieldsetLegendLabel(tag, content) {
+  const labelledBy = tag.match(/\baria-labelledby\s*=\s*["']([^"']+)["']/i);
+  if (labelledBy?.[1]) {
+    for (const id of labelledBy[1].split(/\s+/).filter(Boolean)) {
+      const idRe = new RegExp(`\\bid\\s*=\\s*["']${escapeRegExp(id)}["']`, "i");
+      if (idRe.test(content)) return true;
+    }
+  }
+  const typeMatch = tag.match(/\btype\s*=\s*["']?([^"'\s>]*)["']?/i);
+  const type = typeMatch ? typeMatch[1].toLowerCase() : "text";
+  if (type === "checkbox" || type === "radio") {
+    return /<fieldset\b[\s\S]*?<legend\b[\s\S]*?<\/legend>[\s\S]*?<input\b[\s\S]*?<\/fieldset>/i.test(
+      content
+    );
+  }
+  return false;
 }
 async function auditFile(filePath, projectRoot) {
   let content;
@@ -135,13 +160,14 @@ async function auditFile(filePath, projectRoot) {
   const findings = [];
   const lines = content.split(/\r?\n/);
   const idsByValue = /* @__PURE__ */ new Map();
-  function add(line, rule, severity, message) {
+  function add(line, rule, severity, message, note) {
     findings.push({
       file: relative2(projectRoot, filePath),
       line,
       rule,
       severity,
-      message
+      message,
+      ...note ? { note } : {}
     });
   }
   for (let i = 0; i < lines.length; i++) {
@@ -169,17 +195,36 @@ async function auditFile(filePath, projectRoot) {
         continue;
       }
       const hasAriaLabel = ATTR_ARIA_LABEL.test(tag);
+      const hasDescribedBy = ATTR_ARIA_DESCRIBEDBY.test(tag);
       const hasTitle = ATTR_TITLE.test(tag);
       const idMatchLocal = tag.match(/\bid\s*=\s*["']([^"']+)["']/i);
       const id = idMatchLocal ? idMatchLocal[1] : null;
       let hasLabelFor = false;
       if (id) {
-        const labelForRe = new RegExp(`<label\\b[^>]*\\bfor\\s*=\\s*["']${id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}["']`, "i");
+        const labelForRe = new RegExp(
+          `<label\\b[^>]*\\bfor\\s*=\\s*["']${escapeRegExp(id)}["']`,
+          "i"
+        );
         hasLabelFor = labelForRe.test(content);
       }
       const wrappedInLabel = /<label\b[\s\S]*?<input\b[\s\S]*?<\/label>/i.test(content);
-      if (!hasAriaLabel && !hasTitle && !hasLabelFor && !wrappedInLabel) {
-        add(lineNo, "missing-input-label", "error", `<input type="${type}"> is missing an associated label`);
+      const hasLegend = hasFieldsetLegendLabel(tag, content);
+      const hasPrimaryLabel = hasAriaLabel || hasTitle || hasLabelFor || wrappedInLabel || hasLegend;
+      if (!hasPrimaryLabel && hasDescribedBy) {
+        add(
+          lineNo,
+          "low-contrast-placeholder",
+          "warning",
+          `<input type="${type}"> uses aria-describedby as a description (supplementary, not a primary label)`
+        );
+      } else if (!hasPrimaryLabel) {
+        add(
+          lineNo,
+          "missing-input-label",
+          "error",
+          `<input type="${type}"> is missing an associated label`,
+          SINGLE_FILE_LABEL_NOTE
+        );
       }
       if (ATTR_PLACEHOLDER.test(tag)) {
         add(lineNo, "low-contrast-placeholder", "warning", "<input> uses placeholder text (often low contrast and disappears on input)");
@@ -239,15 +284,24 @@ async function auditPath(rawPath, cfg) {
     truncated
   };
 }
+function truncationWarning(result) {
+  if (!result.truncated) return "";
+  const unexamined = Math.max(0, result.fileCount - (result.scannedFiles ?? result.fileCount));
+  return `partial scan \u2014 ${unexamined} files not examined`;
+}
 function formatSummary(result) {
+  const trunc = truncationWarning(result);
   if (result.findings.length === 0) {
-    return `
+    const clean = `
 \u2705 accessibility-auditor: no issues found in ${result.path} (${result.fileCount} file${result.fileCount === 1 ? "" : "s"}).`;
+    return trunc ? `${clean}
+\u26A0\uFE0F ${trunc}` : clean;
   }
   const lines = result.findings.map((f) => `  - ${f.file}:${f.line} \u2014 ${f.message} (${f.rule})`);
   return `
 \u26A0\uFE0F accessibility-auditor: ${result.findings.length} issue(s) in ${result.path} (${result.fileCount} file${result.fileCount === 1 ? "" : "s"}):
-` + lines.join("\n") + "\nConsider adding missing labels/alt text or resolving duplicate ids.";
+` + lines.join("\n") + "\nConsider adding missing labels/alt text or resolving duplicate ids." + (trunc ? `
+\u26A0\uFE0F ${trunc}` : "");
 }
 var plugin = {
   name: "accessibility-auditor",
@@ -318,9 +372,9 @@ var plugin = {
         findingCount: result.findings.length,
         when: (/* @__PURE__ */ new Date()).toISOString()
       };
-      if (result.findings.length === 0) return;
+      if (result.findings.length === 0 && !result.truncated) return;
       const summary = formatSummary(result);
-      if (cfg.severity === "block") {
+      if (cfg.severity === "block" && result.findings.length > 0) {
         return { decision: "block", reason: summary };
       }
       return { additionalContext: summary };
@@ -361,6 +415,7 @@ var plugin = {
           findingCount: result.findings.length,
           when: (/* @__PURE__ */ new Date()).toISOString()
         };
+        const warning = truncationWarning(result);
         return {
           ok: true,
           path: result.path,
@@ -370,7 +425,8 @@ var plugin = {
           // that reports few findings must not read as a clean result.
           truncated: result.truncated,
           findingCount: result.findings.length,
-          findings: result.findings
+          findings: result.findings,
+          ...warning ? { additionalContext: `\u26A0\uFE0F ${warning}`, warning } : {}
         };
       }
     });

package/dist/audit/index.d.ts

@@ -208,6 +208,12 @@ export declare const OFFICIAL_PLUGIN_AUDIT_ENTRIES: readonly [{
     readonly summary: 'Scans tool output (fetched pages, files) for prompt-injection patterns and warns the model that content is data, not instructions';
     readonly defaultState: 'active';
     readonly canDisable: true;
+}, {
+    readonly name: 'prompt-firewall';
+    readonly risk: 'high';
+    readonly summary: 'Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.';
+    readonly defaultState: 'inactive';
+    readonly canDisable: true;
 }, {
     readonly name: 'llm-cache';
     readonly risk: 'medium';
@@ -226,12 +232,6 @@ export declare const OFFICIAL_PLUGIN_AUDIT_ENTRIES: readonly [{
     readonly summary: 'Collects session work (commits, edited files, diff) and drafts a pull-request description';
     readonly defaultState: 'inactive';
     readonly canDisable: true;
-}, {
-    readonly name: 'prompt-firewall';
-    readonly risk: 'high';
-    readonly summary: 'Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.';
-    readonly defaultState: 'inactive';
-    readonly canDisable: true;
 }, {
     readonly name: 'auto-escalate';
     readonly risk: 'medium';

package/dist/audit.js

@@ -245,6 +245,13 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "active",
     canDisable: true
   },
+  {
+    name: "prompt-firewall",
+    risk: "high",
+    summary: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
+    defaultState: "inactive",
+    canDisable: true
+  },
   {
     name: "llm-cache",
     risk: "medium",
@@ -266,13 +273,6 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "inactive",
     canDisable: true
   },
-  {
-    name: "prompt-firewall",
-    risk: "high",
-    summary: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
-    defaultState: "inactive",
-    canDisable: true
-  },
   {
     name: "auto-escalate",
     risk: "medium",

package/dist/code-metrics/index.d.ts

@@ -24,6 +24,15 @@
  * @public
  */
 import type { Plugin } from '@wrongstack/core/types';
+/**
+ * Heuristic cyclomatic-complexity formula (per file, not per function):
+ *   control keywords (if | else if | for | while | switch | catch)
+ *   + short-circuit / nullish operators (&& || ??)
+ *   + assignment-or operators (||= &&= ??=)
+ *   + ternary `?`
+ * Optional chaining (`?.`) is not a decision point — `a?.b ?? c` adds 1.
+ */
+export declare const COMPLEXITY_FORMULA = "control(if|else if|for|while|switch|catch) + (&& || ?? ||= &&= ??=) + ternary ?; optional chaining ?. is not counted";
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/code-metrics.js

@@ -115,36 +115,65 @@ function countFunctions(content) {
   for (const _match of content.matchAll(arrowRe)) count++;
   return count;
 }
+var COMPLEXITY_FORMULA = "control(if|else if|for|while|switch|catch) + (&& || ?? ||= &&= ??=) + ternary ?; optional chaining ?. is not counted";
 function countComplexity(content) {
   const controlRe = /\b(if|else\s+if|for|while|switch|catch)\b/g;
-  const operatorRe = /[?&|]/g;
   let complexity = 0;
   controlRe.lastIndex = 0;
   for (const _match of content.matchAll(controlRe)) complexity++;
-  operatorRe.lastIndex = 0;
-  for (const match of content.matchAll(operatorRe)) {
-    const ch = match[0];
-    if (ch === "?") {
+  for (let i = 0; i < content.length; i++) {
+    const c = content[i];
+    const n1 = content[i + 1];
+    const n2 = content[i + 2];
+    if (c === "?" && n1 === "?" && n2 === "=") {
       complexity++;
-    } else {
-      const next = content[match.index + 1];
-      if (next === ch) complexity++;
+      i += 2;
+      continue;
+    }
+    if (c === "|" && n1 === "|" && n2 === "=" || c === "&" && n1 === "&" && n2 === "=") {
+      complexity++;
+      i += 2;
+      continue;
+    }
+    if (c === "?" && n1 === "?" || c === "|" && n1 === "|" || c === "&" && n1 === "&") {
+      complexity++;
+      i += 1;
+      continue;
     }
+    if (c === "?" && n1 === ".") {
+      i += 1;
+      continue;
+    }
+    if (c === "?") complexity++;
   }
   return complexity;
 }
 function analyzeFile(filePath, content) {
+  if (content.length === 0) {
+    return {
+      file: relativePath(filePath),
+      lines: 0,
+      codeLines: 0,
+      commentLines: 0,
+      blankLines: 0,
+      functionCount: 0,
+      complexity: 0
+    };
+  }
   const lines = content.split(/\r?\n/);
   let codeLines = 0;
   let commentLines = 0;
   let blankLines = 0;
   let inBlockComment = false;
-  for (const rawLine of lines) {
-    const line = rawLine.trim();
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i].trim();
     if (line.length === 0) {
       blankLines++;
       continue;
     }
+    if (i === 0 && line.startsWith("#!")) {
+      continue;
+    }
     if (inBlockComment) {
       commentLines++;
       if (line.includes("*/")) inBlockComment = false;
@@ -305,7 +334,8 @@ var plugin = {
             files: state.fileCount,
             hookInvocations: state.hookInvocationCount,
             errors: state.errorCount
-          }
+          },
+          complexityFormula: COMPLEXITY_FORMULA
         };
       }
     });
@@ -350,5 +380,6 @@ var plugin = {
 };
 var code_metrics_default = plugin;
 export {
+  COMPLEXITY_FORMULA,
   code_metrics_default as default
 };

package/dist/dep-guard.js

@@ -48,10 +48,12 @@ function parseInstallCommands(command) {
       if (!cleaned) continue;
       let name = cleaned;
       let version = null;
-      const pipMatch = /^([A-Za-z0-9_.-]+)\s*(?:==|>=|<=|~=|!=|>|<)\s*(.+)$/.exec(cleaned);
+      const pipMatch = /^([A-Za-z0-9_.-]+(?:\[[^\]]+\])?)\s*(==|>=|<=|~=|!=|>|<)\s*(.+)$/.exec(cleaned);
       if (pipMatch?.[1]) {
         name = pipMatch[1];
-        version = pipMatch[2] ?? null;
+        const op = pipMatch[2] ?? "";
+        const ver = (pipMatch[3] ?? "").trim();
+        version = op === "==" || op === "" ? ver || null : `${op}${ver}`;
       } else {
         const at = cleaned.lastIndexOf("@");
         if (at > 0) {

package/dist/dependency-vulnerability-gate/index.d.ts

@@ -28,6 +28,10 @@
  * @public
  */
 import type { Plugin } from '@wrongstack/core/types';
+export declare function isInstallCommand(input: {
+    toolName?: string | undefined;
+    toolInput?: unknown;
+}): boolean;
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map