@wrongstack/plugins 0.307.1 → 0.308.1

package/dist/index.js

@@ -345,6 +345,83 @@ function releaseHandle(off) {
   return null;
 }
 
+// src/runtime/redos-guard.ts
+import { Worker } from "node:worker_threads";
+function withReDoSGuard(re, input, budgetMs = 50, options = {}) {
+  const opts = { budgetMs, ...options };
+  const start = Date.now();
+  const workerSource = buildWorkerSource(re.source, input, re.flags);
+  const worker = new Worker(workerSource, {
+    eval: true,
+    name: `redos-guard:${re.source.slice(0, 32)}`
+  });
+  return new Promise((resolve29) => {
+    let settled = false;
+    const onMessage = (msg) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      worker.terminate().catch(() => {
+      });
+      if (!msg.ok) {
+        resolve29({ timedOut: true, match: null });
+        return;
+      }
+      resolve29({ timedOut: false, match: msg.match });
+    };
+    const onError = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      worker.terminate().catch(() => {
+      });
+      resolve29({ timedOut: true, match: null });
+    };
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      const elapsedMs = Date.now() - start;
+      worker.terminate().catch(() => {
+      });
+      try {
+        opts.onTimeout?.({
+          regex: re,
+          input,
+          budgetMs: opts.budgetMs,
+          elapsedMs
+        });
+      } catch {
+      }
+      resolve29({ timedOut: true, match: null });
+    }, opts.budgetMs);
+    timer.unref?.();
+    worker.on("message", onMessage);
+    worker.on("error", onError);
+  });
+}
+function buildWorkerSource(source, input, flags) {
+  const S = JSON.stringify(source);
+  const I = JSON.stringify(input);
+  const F = JSON.stringify(flags);
+  return `
+const { parentPort } = require('node:worker_threads');
+const source = ${S};
+const input = ${I};
+const flags = ${F};
+try {
+  const re = new RegExp(source, flags);
+  const match = re.exec(input);
+  // parentPort.postMessage, NOT bare postMessage: with eval:true
+  // workers this Node version does not expose the bare postMessage
+  // global \u2014 the worker throws ReferenceError at startup and the
+  // host misreads it as a timeout (positive-path regression).
+  parentPort.postMessage({ ok: true, match });
+} catch (err) {
+  parentPort.postMessage({ ok: false, error: err && err.message ? err.message : String(err) });
+}
+`;
+}
+
 // src/runtime/index.ts
 var META_CHARS = /["'`;&|<>\r\n]/;
 var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
@@ -446,6 +523,7 @@ function runRunnerCommand(argv, options) {
     }
     let timedOut = false;
     let spawnErrored = false;
+    const start = Date.now();
     const stdoutChunks = [];
     const stderrChunks = [];
     let stdoutBytes = 0;
@@ -475,6 +553,15 @@ function runRunnerCommand(argv, options) {
         timeout: options.timeoutMs,
         signal: options.signal,
         maxBuffer: MAX_BUFFER_BYTES,
+        // execFile defaults `encoding` to 'utf8', which makes the
+        // stdout/stderr `data` events emit *strings*. The chunk arrays
+        // below are typed Buffer[] and every consumer runs them through
+        // Buffer.concat(...).toString('utf8'), which throws
+        // ERR_INVALID_ARG_TYPE on any non-empty string output. Pin the
+        // streams to buffers so the declared contract holds (regression:
+        // runRunnerCommand crashed on any child that actually wrote
+        // output; only the maxBuffer fixture exercised this path).
+        encoding: "buffer",
         windowsHide: true,
         shell: false,
         ...invocation.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
@@ -503,11 +590,31 @@ function runRunnerCommand(argv, options) {
         }
         if (err) {
           const anyErr = err;
+          if ((anyErr.killed === true || anyErr.signal === "SIGTERM") && // maxBuffer overflow must NOT be misreported as a timeout
+          // — it's a real failure (the child wrote too much) and
+          // downstream callers (type-gate/index.ts:227) return
+          // null on timedOut=true, which would silently swallow
+          // maxBuffer overflow into a confusing empty-output
+          // result. Skip the timeout resolve when the err shape
+          // names maxBuffer explicitly.
+          !/maxBuffer length exceeded/i.test(anyErr.message ?? "") && // And only count it as a timeout if the wall clock has
+          // actually elapsed past the budget. External SIGTERMs and
+          // races against the exit handler don't satisfy this.
+          Date.now() - start >= options.timeoutMs) {
+            resolvePromise({
+              code: null,
+              stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
+              stderr: Buffer.concat(stderrChunks).toString("utf-8"),
+              timedOut: true,
+              spawnError: false
+            });
+            return;
+          }
           const code = typeof anyErr.code === "number" ? anyErr.code : 1;
           resolvePromise({
             code,
-            stdout: Buffer.concat(stdoutChunks).toString("utf8"),
-            stderr: Buffer.concat(stderrChunks).toString("utf8"),
+            stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
+            stderr: Buffer.concat(stderrChunks).toString("utf-8"),
             timedOut: false,
             spawnError: false
           });
@@ -523,7 +630,7 @@ function runRunnerCommand(argv, options) {
       }
     );
     child.on("exit", (_code, signal) => {
-      if (signal !== null) {
+      if (signal !== null && Date.now() - start >= options.timeoutMs) {
         timedOut = true;
       }
     });
@@ -626,15 +733,40 @@ var INPUT_BUTTON = /<input\b[^>]*\btype\s*=\s*["'](submit|button|reset)["'][^>]*
 var ATTR_ID = /\bid\s*=\s*["']([^"']+)["']/gi;
 var ATTR_ALT = /\balt\s*=/i;
 var ATTR_ARIA_LABEL = /\b(?:aria-label|aria-labelledby)\s*=/i;
+var ATTR_ARIA_DESCRIBEDBY = /\baria-describedby\s*=/i;
 var ATTR_TITLE = /\btitle\s*=/i;
 var ATTR_PLACEHOLDER = /\bplaceholder\s*=/i;
 var ATTR_VALUE = /\bvalue\s*=/i;
+var ATTR_ROLE_DECORATIVE = /\brole\s*=\s*["'](?:presentation|none)["']/i;
+var SINGLE_FILE_LABEL_NOTE = "Single-file heuristic: a label declared in a sibling component file is not visible to this scan.";
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function hasMeaningfulAlt(tag) {
   const m = ATTR_ALT.exec(tag);
   ATTR_ALT.lastIndex = 0;
   if (!m) return false;
   const valMatch = tag.match(/\balt\s*=\s*["']?([^"'\s>]*)["']?/i);
-  return valMatch ? valMatch[1].trim().length > 0 : false;
+  const alt = valMatch ? valMatch[1].trim() : "";
+  if (alt.length > 0) return true;
+  return ATTR_ROLE_DECORATIVE.test(tag);
+}
+function hasFieldsetLegendLabel(tag, content) {
+  const labelledBy = tag.match(/\baria-labelledby\s*=\s*["']([^"']+)["']/i);
+  if (labelledBy?.[1]) {
+    for (const id of labelledBy[1].split(/\s+/).filter(Boolean)) {
+      const idRe = new RegExp(`\\bid\\s*=\\s*["']${escapeRegExp(id)}["']`, "i");
+      if (idRe.test(content)) return true;
+    }
+  }
+  const typeMatch = tag.match(/\btype\s*=\s*["']?([^"'\s>]*)["']?/i);
+  const type = typeMatch ? typeMatch[1].toLowerCase() : "text";
+  if (type === "checkbox" || type === "radio") {
+    return /<fieldset\b[\s\S]*?<legend\b[\s\S]*?<\/legend>[\s\S]*?<input\b[\s\S]*?<\/fieldset>/i.test(
+      content
+    );
+  }
+  return false;
 }
 async function auditFile(filePath, projectRoot) {
   let content;
@@ -646,13 +778,14 @@ async function auditFile(filePath, projectRoot) {
   const findings = [];
   const lines = content.split(/\r?\n/);
   const idsByValue = /* @__PURE__ */ new Map();
-  function add(line, rule, severity, message) {
+  function add(line, rule, severity, message, note) {
     findings.push({
       file: relative3(projectRoot, filePath),
       line,
       rule,
       severity,
-      message
+      message,
+      ...note ? { note } : {}
     });
   }
   for (let i = 0; i < lines.length; i++) {
@@ -680,17 +813,36 @@ async function auditFile(filePath, projectRoot) {
         continue;
       }
       const hasAriaLabel = ATTR_ARIA_LABEL.test(tag);
+      const hasDescribedBy = ATTR_ARIA_DESCRIBEDBY.test(tag);
       const hasTitle = ATTR_TITLE.test(tag);
       const idMatchLocal = tag.match(/\bid\s*=\s*["']([^"']+)["']/i);
       const id = idMatchLocal ? idMatchLocal[1] : null;
       let hasLabelFor = false;
       if (id) {
-        const labelForRe = new RegExp(`<label\\b[^>]*\\bfor\\s*=\\s*["']${id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}["']`, "i");
+        const labelForRe = new RegExp(
+          `<label\\b[^>]*\\bfor\\s*=\\s*["']${escapeRegExp(id)}["']`,
+          "i"
+        );
         hasLabelFor = labelForRe.test(content);
       }
       const wrappedInLabel = /<label\b[\s\S]*?<input\b[\s\S]*?<\/label>/i.test(content);
-      if (!hasAriaLabel && !hasTitle && !hasLabelFor && !wrappedInLabel) {
-        add(lineNo, "missing-input-label", "error", `<input type="${type}"> is missing an associated label`);
+      const hasLegend = hasFieldsetLegendLabel(tag, content);
+      const hasPrimaryLabel = hasAriaLabel || hasTitle || hasLabelFor || wrappedInLabel || hasLegend;
+      if (!hasPrimaryLabel && hasDescribedBy) {
+        add(
+          lineNo,
+          "low-contrast-placeholder",
+          "warning",
+          `<input type="${type}"> uses aria-describedby as a description (supplementary, not a primary label)`
+        );
+      } else if (!hasPrimaryLabel) {
+        add(
+          lineNo,
+          "missing-input-label",
+          "error",
+          `<input type="${type}"> is missing an associated label`,
+          SINGLE_FILE_LABEL_NOTE
+        );
       }
       if (ATTR_PLACEHOLDER.test(tag)) {
         add(lineNo, "low-contrast-placeholder", "warning", "<input> uses placeholder text (often low contrast and disappears on input)");
@@ -750,15 +902,24 @@ async function auditPath(rawPath, cfg) {
     truncated
   };
 }
+function truncationWarning(result) {
+  if (!result.truncated) return "";
+  const unexamined = Math.max(0, result.fileCount - (result.scannedFiles ?? result.fileCount));
+  return `partial scan \u2014 ${unexamined} files not examined`;
+}
 function formatSummary(result) {
+  const trunc = truncationWarning(result);
   if (result.findings.length === 0) {
-    return `
+    const clean = `
 \u2705 accessibility-auditor: no issues found in ${result.path} (${result.fileCount} file${result.fileCount === 1 ? "" : "s"}).`;
+    return trunc ? `${clean}
+\u26A0\uFE0F ${trunc}` : clean;
   }
   const lines = result.findings.map((f) => `  - ${f.file}:${f.line} \u2014 ${f.message} (${f.rule})`);
   return `
 \u26A0\uFE0F accessibility-auditor: ${result.findings.length} issue(s) in ${result.path} (${result.fileCount} file${result.fileCount === 1 ? "" : "s"}):
-` + lines.join("\n") + "\nConsider adding missing labels/alt text or resolving duplicate ids.";
+` + lines.join("\n") + "\nConsider adding missing labels/alt text or resolving duplicate ids." + (trunc ? `
+\u26A0\uFE0F ${trunc}` : "");
 }
 var plugin = {
   name: "accessibility-auditor",
@@ -829,9 +990,9 @@ var plugin = {
         findingCount: result.findings.length,
         when: (/* @__PURE__ */ new Date()).toISOString()
       };
-      if (result.findings.length === 0) return;
+      if (result.findings.length === 0 && !result.truncated) return;
       const summary = formatSummary(result);
-      if (cfg.severity === "block") {
+      if (cfg.severity === "block" && result.findings.length > 0) {
         return { decision: "block", reason: summary };
       }
       return { additionalContext: summary };
@@ -872,6 +1033,7 @@ var plugin = {
           findingCount: result.findings.length,
           when: (/* @__PURE__ */ new Date()).toISOString()
         };
+        const warning = truncationWarning(result);
         return {
           ok: true,
           path: result.path,
@@ -881,7 +1043,8 @@ var plugin = {
           // that reports few findings must not read as a clean result.
           truncated: result.truncated,
           findingCount: result.findings.length,
-          findings: result.findings
+          findings: result.findings,
+          ...warning ? { additionalContext: `\u26A0\uFE0F ${warning}`, warning } : {}
         };
       }
     });
@@ -3299,9 +3462,9 @@ var plugin9 = {
         const ti = input.toolInput ?? {};
         const raw = ti["path"] ?? ti["file_path"] ?? ti["filePath"];
         if (typeof raw !== "string" || raw.length === 0) return;
-        const safePath = resolveProjectPath3(raw);
-        if (!safePath) return;
-        const captured = await captureFileForHook(safePath, cfg.maxFileBytes, runtime.signal);
+        const safePath2 = resolveProjectPath3(raw);
+        if (!safePath2) return;
+        const captured = await captureFileForHook(safePath2, cfg.maxFileBytes, runtime.signal);
         if (captured === "too-large") {
           state9.skippedLarge += 1;
           return;
@@ -3319,7 +3482,7 @@ var plugin9 = {
         state9.captures += 1;
         api.metrics.counter("captures");
         api.emitCustom?.("checkpoint:captured", {
-          path: safePath,
+          path: safePath2,
           bytes: captured.bytes,
           hadContent: captured.content !== null,
           // 32-bit unsigned hash of the captured bytes. Collisions
@@ -3363,12 +3526,12 @@ var plugin9 = {
         const rejectedOutsideProject = [];
         let skipped = 0;
         for (const p of paths) {
-          const safePath = resolveProjectPath3(p);
-          if (!safePath) {
+          const safePath2 = resolveProjectPath3(p);
+          if (!safePath2) {
             rejectedOutsideProject.push(p);
             continue;
           }
-          const captured = await captureFile(safePath, cfg.maxFileBytes);
+          const captured = await captureFile(safePath2, cfg.maxFileBytes);
           if (captured === "too-large") {
             skipped += 1;
             state9.skippedLarge += 1;
@@ -3601,36 +3764,65 @@ function countFunctions(content) {
   for (const _match of content.matchAll(arrowRe)) count++;
   return count;
 }
+var COMPLEXITY_FORMULA = "control(if|else if|for|while|switch|catch) + (&& || ?? ||= &&= ??=) + ternary ?; optional chaining ?. is not counted";
 function countComplexity(content) {
   const controlRe = /\b(if|else\s+if|for|while|switch|catch)\b/g;
-  const operatorRe = /[?&|]/g;
   let complexity = 0;
   controlRe.lastIndex = 0;
   for (const _match of content.matchAll(controlRe)) complexity++;
-  operatorRe.lastIndex = 0;
-  for (const match of content.matchAll(operatorRe)) {
-    const ch = match[0];
-    if (ch === "?") {
+  for (let i = 0; i < content.length; i++) {
+    const c = content[i];
+    const n1 = content[i + 1];
+    const n2 = content[i + 2];
+    if (c === "?" && n1 === "?" && n2 === "=") {
       complexity++;
-    } else {
-      const next = content[match.index + 1];
-      if (next === ch) complexity++;
+      i += 2;
+      continue;
+    }
+    if (c === "|" && n1 === "|" && n2 === "=" || c === "&" && n1 === "&" && n2 === "=") {
+      complexity++;
+      i += 2;
+      continue;
     }
+    if (c === "?" && n1 === "?" || c === "|" && n1 === "|" || c === "&" && n1 === "&") {
+      complexity++;
+      i += 1;
+      continue;
+    }
+    if (c === "?" && n1 === ".") {
+      i += 1;
+      continue;
+    }
+    if (c === "?") complexity++;
   }
   return complexity;
 }
 function analyzeFile(filePath, content) {
+  if (content.length === 0) {
+    return {
+      file: relativePath(filePath),
+      lines: 0,
+      codeLines: 0,
+      commentLines: 0,
+      blankLines: 0,
+      functionCount: 0,
+      complexity: 0
+    };
+  }
   const lines = content.split(/\r?\n/);
   let codeLines = 0;
   let commentLines = 0;
   let blankLines = 0;
   let inBlockComment = false;
-  for (const rawLine of lines) {
-    const line = rawLine.trim();
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i].trim();
     if (line.length === 0) {
       blankLines++;
       continue;
     }
+    if (i === 0 && line.startsWith("#!")) {
+      continue;
+    }
     if (inBlockComment) {
       commentLines++;
       if (line.includes("*/")) inBlockComment = false;
@@ -3791,7 +3983,8 @@ var plugin10 = {
             files: state10.fileCount,
             hookInvocations: state10.hookInvocationCount,
             errors: state10.errorCount
-          }
+          },
+          complexityFormula: COMPLEXITY_FORMULA
         };
       }
     });
@@ -5860,10 +6053,12 @@ function parseInstallCommands(command) {
       if (!cleaned) continue;
       let name = cleaned;
       let version = null;
-      const pipMatch = /^([A-Za-z0-9_.-]+)\s*(?:==|>=|<=|~=|!=|>|<)\s*(.+)$/.exec(cleaned);
+      const pipMatch = /^([A-Za-z0-9_.-]+(?:\[[^\]]+\])?)\s*(==|>=|<=|~=|!=|>|<)\s*(.+)$/.exec(cleaned);
       if (pipMatch?.[1]) {
         name = pipMatch[1];
-        version = pipMatch[2] ?? null;
+        const op = pipMatch[2] ?? "";
+        const ver = (pipMatch[3] ?? "").trim();
+        version = op === "==" || op === "" ? ver || null : `${op}${ver}`;
       } else {
         const at = cleaned.lastIndexOf("@");
         if (at > 0) {
@@ -6288,13 +6483,12 @@ function exceedsThreshold(report, threshold) {
   if (thresholdRank == null || maxRank == null) return false;
   return maxRank >= thresholdRank;
 }
-var INSTALL_RE2 = /\b(?:npm\s+(?:install|i)|pnpm\s+add|yarn\s+add)\b/i;
 function isInstallCommand(input) {
   if (input.toolName === "install") return true;
   if (input.toolName !== "bash" && input.toolName !== "exec") return false;
   const ti = input.toolInput ?? {};
   const command = typeof ti["command"] === "string" ? ti["command"] : "";
-  return INSTALL_RE2.test(command);
+  return parseInstallCommands(command).length > 0;
 }
 var LOCKFILE_MANAGERS = [
   { file: "pnpm-lock.yaml", manager: "pnpm" },
@@ -8067,18 +8261,8 @@ var feature_flag_tracker_default = plugin23;
 
 // src/file-watcher/index.ts
 import { watch as fsWatch } from "node:fs";
-import { isAbsolute as isAbsolute12, join as join3, relative as relative13, resolve as resolve13 } from "node:path";
+import { join as join3 } from "node:path";
 var API_VERSION16 = "^0.1.10";
-function withinProject3(p) {
-  if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
-  const root = process.cwd();
-  const resolved = isAbsolute12(p) ? resolve13(p) : resolve13(root, p);
-  const rel = relative13(root, resolved);
-  if (rel === "" || rel === ".") return true;
-  if (rel.startsWith("..")) return false;
-  if (isAbsolute12(rel)) return false;
-  return true;
-}
 var watch_idCounter = 0;
 function nextId() {
   return `watch_${++watch_idCounter}_${Date.now().toString(36)}`;
@@ -8159,7 +8343,7 @@ var plugin24 = {
     }
     const autoIndex = api.config.extensions?.["file-watcher"]?.["autoIndex"] ?? false;
     const indexProjectRoot = api.config.extensions?.["file-watcher"]?.["indexProjectRoot"] ?? "";
-    const safeIndexRoot = indexProjectRoot !== "" && withinProject3(indexProjectRoot) ? indexProjectRoot : "";
+    const safeIndexRoot = indexProjectRoot !== "" && withinProject(indexProjectRoot) ? indexProjectRoot : "";
     if (indexProjectRoot !== "" && safeIndexRoot === "") {
       api.log.warn(
         "file-watcher: indexProjectRoot is outside the project root \u2014 using watched dirPath instead",
@@ -8304,7 +8488,7 @@ var plugin24 = {
         }
         const events = input["events"] ?? ["change", "add", "delete"];
         const recursive = input["recursive"] ?? true;
-        const bad = paths.find((p) => !withinProject3(p));
+        const bad = paths.find((p) => !withinProject(p));
         if (bad !== void 0) {
           return {
             ok: false,
@@ -8549,6 +8733,7 @@ async function formatFile(filePath, timeoutMs) {
   }
   const formatter = resolveFormatter();
   if (!formatter) return null;
+  const started = Date.now();
   let bytesBefore;
   try {
     bytesBefore = (await stat4(filePath)).size;
@@ -8593,14 +8778,15 @@ async function formatFile(filePath, timeoutMs) {
   } catch {
     return null;
   }
+  const durationMs = Date.now() - started;
   if (bytesAfter !== bytesBefore) {
-    return { changed: true, bytesBefore, bytesAfter };
+    return { changed: true, bytesBefore, bytesAfter, durationMs };
   }
   const hashAfter = await sha256File(filePath);
   if (hashBefore === null || hashAfter === null) {
-    return { changed: false, bytesBefore, bytesAfter };
+    return { changed: false, bytesBefore, bytesAfter, durationMs };
   }
-  return { changed: hashBefore !== hashAfter, bytesBefore, bytesAfter };
+  return { changed: hashBefore !== hashAfter, bytesBefore, bytesAfter, durationMs };
 }
 var plugin25 = {
   name: "format-on-save",
@@ -8689,6 +8875,7 @@ var plugin25 = {
         changed: result.changed,
         bytesBefore: result.bytesBefore,
         bytesAfter: result.bytesAfter,
+        durationMs: result.durationMs,
         when: (/* @__PURE__ */ new Date()).toISOString()
       };
       if (result.changed) {
@@ -8743,7 +8930,10 @@ var plugin25 = {
             formatted: state23.formattedCount,
             clean: state23.cleanCount,
             errors: state23.errorCount,
-            coveredSkips: state23.coveredSkipCount
+            coveredSkips: state23.coveredSkipCount,
+            bytesBefore: state23.lastResult?.bytesBefore ?? 0,
+            bytesAfter: state23.lastResult?.bytesAfter ?? 0,
+            durationMs: state23.lastResult?.durationMs ?? 0
           },
           lastResult: state23.lastResult
         };
@@ -9316,7 +9506,7 @@ var git_autocommit_default = plugin26;
 
 // src/gitignore-guard/index.ts
 import { access as access3, readFile as readFile9, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename4, isAbsolute as isAbsolute13, join as join4, relative as relative14, resolve as resolve14, sep as sep3 } from "node:path";
+import { basename as basename4, isAbsolute as isAbsolute12, join as join4, relative as relative13, resolve as resolve13, sep as sep3 } from "node:path";
 var API_VERSION19 = "^0.1.10";
 var DEFAULT_ARTIFACT_PATTERNS = Object.freeze([
   "dist/",
@@ -9438,9 +9628,9 @@ async function appendPatterns(target, patterns, limit) {
 }
 function projectRelativePath(rawPath, cwd) {
   const root = cwd ?? process.cwd();
-  const abs = isAbsolute13(rawPath) ? rawPath : resolve14(root, rawPath);
-  const rel = toForwardSlashes(relative14(root, abs));
-  if (rel.startsWith("..") || isAbsolute13(rel) || rel === "") return null;
+  const abs = isAbsolute12(rawPath) ? rawPath : resolve13(root, rawPath);
+  const rel = toForwardSlashes(relative13(root, abs));
+  if (rel.startsWith("..") || isAbsolute12(rel) || rel === "") return null;
   return { abs, rel, root };
 }
 var DEFAULTS21 = {
@@ -9752,7 +9942,7 @@ var gitignore_guard_default = plugin27;
 // src/import-organizer/index.ts
 import { spawn } from "node:child_process";
 import { existsSync as existsSync3, statSync as statSync2 } from "node:fs";
-import { basename as basename5, isAbsolute as isAbsolute14 } from "node:path";
+import { basename as basename5, isAbsolute as isAbsolute13 } from "node:path";
 var ALLOWED_FIRST_TOKENS = /* @__PURE__ */ new Set([
   "npx",
   "pnpm",
@@ -9795,17 +9985,31 @@ function resolveAllowedCommand(command) {
   const tokens = command.split(/\s+/).filter(Boolean);
   if (tokens.length === 0) return null;
   const head = tokens[0];
+  if (PACKAGE_RUNNERS.has(head)) {
+    let i = 1;
+    while (i < tokens.length && (tokens[i] === "exec" || tokens[i] === "dlx" || tokens[i] === "run")) {
+      i++;
+    }
+    const toolToken = tokens[i];
+    if (!toolToken || !(toolToken in LOCAL_BIN_PACKAGES)) return null;
+  }
+  if (head === "node") {
+    const target = tokens[1];
+    if (!target) return null;
+    const base = basename5(target);
+    if (!(base in LOCAL_BIN_PACKAGES) && !ALLOWED_FIRST_TOKENS.has(base)) return null;
+  }
   const local = ALLOWED_FIRST_TOKENS.has(head) ? resolveLocalToolCommand(tokens) : null;
   if (local) return local;
   if (ALLOWED_FIRST_TOKENS.has(head)) {
     return { cmd: head, args: tokens.slice(1) };
   }
-  if (isAbsolute14(head)) {
+  if (isAbsolute13(head)) {
     if (!withinProject(head)) return null;
     const base = basename5(head);
     if (ALLOWED_FIRST_TOKENS.has(base)) return { cmd: head, args: tokens.slice(1) };
   }
-  if (!isAbsolute14(head) && withinProject(head)) {
+  if (!isAbsolute13(head) && withinProject(head)) {
     const base = basename5(head);
     if (ALLOWED_FIRST_TOKENS.has(base)) return { cmd: head, args: tokens.slice(1) };
   }
@@ -10032,6 +10236,12 @@ var plugin28 = {
         bytesAfter: result.bytesAfter,
         when: (/* @__PURE__ */ new Date()).toISOString()
       };
+      if (/\boxlint\b/.test(result.command)) {
+        return {
+          additionalContext: `
+\u{1F4E6} import-organizer: oxlint has no import-organize support \u2014 ran '${result.command}' as a no-op for import sorting on '${filePath}'.`
+        };
+      }
       if (result.changed) {
         state25.organizedCount += 1;
         const delta = result.bytesAfter - result.bytesBefore;
@@ -10088,6 +10298,7 @@ ${result.stderr.trim()}`
     });
   },
   teardown(api) {
+    clearLocalBinCache();
     if (state25.hookUnregister) {
       try {
         state25.hookUnregister();
@@ -10342,7 +10553,7 @@ var injection_shield_default = plugin29;
 
 // src/interface-contract-guard/index.ts
 import { readFile as readFile10 } from "node:fs/promises";
-import { isAbsolute as isAbsolute15, relative as relative15, resolve as resolve15 } from "node:path";
+import { isAbsolute as isAbsolute14, relative as relative14, resolve as resolve14 } from "node:path";
 var API_VERSION21 = "^0.1.10";
 var state27 = {
   scanCount: 0,
@@ -10375,7 +10586,7 @@ function toPosix5(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath5(p) {
-  return toPosix5(relative15(process.cwd(), p));
+  return toPosix5(relative14(process.cwd(), p));
 }
 var INTERFACE_RE = /(?:export\s+)?interface\s+([A-Za-z_$][A-Za-z0-9_$]*)/g;
 function extractInterfaceNames(content) {
@@ -10403,7 +10614,7 @@ function collectImplementedNames(content, into) {
 }
 async function scanPath3(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute15(rawPath) ? resolve15(rawPath) : resolve15(root, rawPath);
+  const resolved = isAbsolute14(rawPath) ? resolve14(rawPath) : resolve14(root, rawPath);
   const exts = normalizeExtensions4(cfg.extensions);
   const allFiles = await collectSourceFilesAsync(resolved, { extensions: exts });
   const files = allFiles.slice(0, cfg.maxFiles);
@@ -10493,7 +10704,7 @@ var plugin30 = {
       const exts = normalizeExtensions4(cfg.extensions);
       if (!matchesExtension(sourcePath, exts)) return;
       state27.hookInvocationCount += 1;
-      const resolved = resolve15(process.cwd(), sourcePath);
+      const resolved = resolve14(process.cwd(), sourcePath);
       let content;
       try {
         content = await readFile10(resolved, "utf-8");
@@ -10541,7 +10752,7 @@ If you changed member shapes, search the project for implementers/\`satisfies\`/
         state27.findingCount += result.findings.length;
         return {
           ok: true,
-          path: relativePath5(resolve15(process.cwd(), rawPath)),
+          path: relativePath5(resolve14(process.cwd(), rawPath)),
           scannedFiles: result.scannedFiles,
           findings: result.findings,
           // Say so when the corpus was cut short. A partial scan that
@@ -10622,7 +10833,7 @@ var interface_contract_guard_default = plugin30;
 
 // src/knowledge-graph/index.ts
 import { readFileSync as readFileSync7 } from "node:fs";
-import { dirname as dirname5, isAbsolute as isAbsolute16, relative as relative16, resolve as resolve16 } from "node:path";
+import { dirname as dirname5, isAbsolute as isAbsolute15, relative as relative15, resolve as resolve15 } from "node:path";
 import { atomicWrite as atomicWrite2, ensureDir as ensureDir2 } from "@wrongstack/core/utils";
 var API_VERSION22 = "^0.1.10";
 var state28 = {
@@ -10644,10 +10855,10 @@ var DEFAULTS25 = {
 };
 function resolveProjectPath5(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
-  const root = resolve16(cwd);
-  const resolved = isAbsolute16(rawPath) ? resolve16(rawPath) : resolve16(root, rawPath);
-  const rel = relative16(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute16(rel)) return resolved;
+  const root = resolve15(cwd);
+  const resolved = isAbsolute15(rawPath) ? resolve15(rawPath) : resolve15(root, rawPath);
+  const rel = relative15(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute15(rel)) return resolved;
   return null;
 }
 function readConfig26(raw) {
@@ -10946,7 +11157,7 @@ var knowledge_graph_default = plugin31;
 
 // src/license-audit-gate/index.ts
 import { readFileSync as readFileSync8 } from "node:fs";
-import { resolve as resolve17 } from "node:path";
+import { resolve as resolve16 } from "node:path";
 var API_VERSION23 = "^0.1.10";
 var state29 = {
   invocations: 0,
@@ -10996,24 +11207,10 @@ function extractLicenseStrings(pkg) {
   }
   return [...new Set(out)];
 }
-var INSTALL_RE3 = /(?:^|[;&|]\s*)(npm|pnpm|yarn|bun)\s+(?:install|i|add)\s+([^;&|]+)/gi;
 function parsePackageNames(command) {
-  const names = [];
-  INSTALL_RE3.lastIndex = 0;
-  for (const m of command.matchAll(INSTALL_RE3)) {
-    const argString = m[2] ?? "";
-    for (const token of argString.split(/\s+/)) {
-      if (!token || token.startsWith("-")) continue;
-      if (/^(\.|\/|file:|git\+|https?:)/i.test(token) || token.endsWith(".tgz")) continue;
-      const cleaned = token.replace(/^['"]|['"]$/g, "");
-      if (!cleaned) continue;
-      let name = cleaned;
-      const at = cleaned.lastIndexOf("@");
-      if (at > 0) name = cleaned.slice(0, at);
-      if (name) names.push(name);
-    }
-  }
-  return [...new Set(names)];
+  return [
+    ...new Set(parseInstallCommands(command).flatMap((entry) => entry.packages.map((pkg) => pkg.name)))
+  ];
 }
 function auditPackages(names, allowedLicenses) {
   const results = [];
@@ -11022,7 +11219,7 @@ function auditPackages(names, allowedLicenses) {
   for (const name of names) {
     let licenses = [];
     try {
-      const pkgPath = resolve17("node_modules", name, "package.json");
+      const pkgPath = resolve16("node_modules", name, "package.json");
       const raw = JSON.parse(readFileSync8(pkgPath, "utf-8"));
       licenses = extractLicenseStrings(raw);
     } catch {
@@ -11207,7 +11404,7 @@ import { readFileSync as readFileSync9 } from "node:fs";
 import { mkdtemp, readFile as readFile11, rm, writeFile as writeFile3 } from "node:fs/promises";
 import { createRequire as createRequire2 } from "node:module";
 import { tmpdir } from "node:os";
-import { dirname as dirname6, isAbsolute as isAbsolute17, join as join5, relative as relative17, resolve as resolve18, sep as sep4 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute16, join as join5, relative as relative16, resolve as resolve17, sep as sep4 } from "node:path";
 var API_VERSION24 = "^0.1.10";
 var state30 = {
   /** Total PreToolUse invocations. */
@@ -11247,19 +11444,19 @@ var LINTER_PACKAGES = {
 };
 var linterCache = new BoundedMap({ max: 32, ttlMs: 3e5 });
 function isInside2(parent, candidate) {
-  const rel = relative17(parent, candidate);
-  return rel === "" || !rel.startsWith(`..${sep4}`) && rel !== ".." && !isAbsolute17(rel);
+  const rel = relative16(parent, candidate);
+  return rel === "" || !rel.startsWith(`..${sep4}`) && rel !== ".." && !isAbsolute16(rel);
 }
 function resolveLocalLinter(name, cwd) {
   try {
     const packageName = LINTER_PACKAGES[name];
-    const requireFromProject = createRequire2(resolve18(cwd, "package.json"));
+    const requireFromProject = createRequire2(resolve17(cwd, "package.json"));
     const packagePath = requireFromProject.resolve(`${packageName}/package.json`);
     const packageJson = JSON.parse(readFileSync9(packagePath, "utf-8"));
     const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[name] ?? Object.values(packageJson.bin ?? {})[0];
-    if (!relativeBin || isAbsolute17(relativeBin)) return null;
+    if (!relativeBin || isAbsolute16(relativeBin)) return null;
     const packageDir = dirname6(packagePath);
-    const entry = resolve18(packageDir, relativeBin);
+    const entry = resolve17(packageDir, relativeBin);
     if (!isInside2(packageDir, entry)) return null;
     return {
       cmd: process.execPath,
@@ -11311,9 +11508,10 @@ async function detectLinter(requested, cwd) {
 }
 async function lintContent(content, filePath, linter, timeoutMs, cwd, signal) {
   const ext = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")) : ".ts";
-  const tmpDir = await mkdtemp(join5(tmpdir(), "lint-gate-"));
-  const tmpFile = join5(tmpDir, `input${ext}`);
+  let tmpDir;
   try {
+    tmpDir = await mkdtemp(join5(tmpdir(), "lint-gate-"));
+    const tmpFile = join5(tmpDir, `input${ext}`);
     await writeFile3(tmpFile, content, "utf-8");
     const fullArgs = [...linter.args, tmpFile];
     const result = await runCommand2(linter.cmd, fullArgs, timeoutMs, cwd, signal);
@@ -11324,14 +11522,15 @@ async function lintContent(content, filePath, linter, timeoutMs, cwd, signal) {
     if (signal.aborted) throw signal.reason;
     return null;
   } finally {
-    await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
+    if (tmpDir) await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
   }
 }
 async function lintAndFix(content, filePath, linter, timeoutMs, cwd, signal) {
   const ext = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")) : ".ts";
-  const tmpDir = await mkdtemp(join5(tmpdir(), "lint-gate-fix-"));
-  const tmpFile = join5(tmpDir, `input${ext}`);
+  let tmpDir;
   try {
+    tmpDir = await mkdtemp(join5(tmpdir(), "lint-gate-fix-"));
+    const tmpFile = join5(tmpDir, `input${ext}`);
     await writeFile3(tmpFile, content, "utf-8");
     const fixArgs = linter.name === "biome" ? [linter.args[0], "check", "--write", tmpFile] : [linter.args[0], "--fix", tmpFile];
     await runCommand2(linter.cmd, fixArgs, timeoutMs, cwd, signal);
@@ -11341,7 +11540,7 @@ async function lintAndFix(content, filePath, linter, timeoutMs, cwd, signal) {
     if (signal.aborted) throw signal.reason;
     return content;
   } finally {
-    await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
+    if (tmpDir) await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
   }
 }
 function parseLinterOutput(stdout, linterName) {
@@ -11436,7 +11635,7 @@ var plugin33 = {
     state30.lastResult = null;
     linterCache.clear();
     const cfg = readConfig28(api.config.extensions?.["lint-gate"]);
-    const cwd = resolve18(api.config.cwd ?? process.cwd());
+    const cwd = resolve17(api.config.cwd ?? process.cwd());
     const linterReady = detectLinter(cfg.linter, cwd).then((linter) => {
       if (!linter) {
         api.log.warn("lint-gate: no linter found (biome or eslint) \u2014 hook will be a no-op", {
@@ -11595,9 +11794,9 @@ ${summary}${truncated}`
       name: "lint-gate",
       stage: "mutate",
       timeoutMs: Math.max(1e3, cfg.timeoutMs + 1e3),
-      // Formatter/linter availability must not create approval or denial
-      // loops in YOLO mode. Explicit lint findings still block in block mode.
-      failurePolicy: "open"
+      // Fail closed: a linter crash or timeout must not let unlinted
+      // content through in block mode (issue #363).
+      failurePolicy: "closed"
     });
     api.tools.register({
       name: "lint_gate_status",
@@ -11753,6 +11952,12 @@ var plugin34 = {
   description: "Caches identical provider requests and short-circuits the provider call on a hit (wrapProviderRunner). Opt-in; deterministic-only by default.",
   apiVersion: "^0.1.10",
   capabilities: { tools: true },
+  // Wrap-stack contract (issue #362): ExtensionRegistry composes wrappers
+  // first-registered = outermost, and both dependsOn and optionalDeps load
+  // dependencies first. Declaring prompt-firewall here guarantees the
+  // firewall wraps OUTSIDE this cache even if the manifest order changes —
+  // otherwise a cache hit short-circuits `inner` and bypasses redaction.
+  optionalDeps: ["prompt-firewall"],
   defaultConfig: { ...DEFAULTS28 },
   configSchema: {
     type: "object",
@@ -11933,7 +12138,7 @@ var llm_cache_default = plugin34;
 
 // src/loop-breaker/index.ts
 import { execFile as execFile9 } from "node:child_process";
-import { isAbsolute as isAbsolute18, relative as relative18 } from "node:path";
+import { isAbsolute as isAbsolute17, relative as relative17 } from "node:path";
 var state32 = {
   lastFingerprint: null,
   streak: 0,
@@ -12044,7 +12249,7 @@ function hashString2(value) {
   return String(h >>> 0);
 }
 async function gitDiffFingerprint(cwd, targetPath, signal) {
-  const pathspec = isAbsolute18(targetPath) ? relative18(cwd, targetPath) : targetPath;
+  const pathspec = isAbsolute17(targetPath) ? relative17(cwd, targetPath) : targetPath;
   if (!pathspec || pathspec === ".." || pathspec.startsWith("../") || pathspec.startsWith("..\\")) {
     return null;
   }
@@ -13579,6 +13784,29 @@ var plugin38 = {
 var notify_hub_default = plugin38;
 
 // src/path-guard/glob.ts
+var GLOB_REDOS_BUDGET_MS = 250;
+function mergeGuardedRegex(patterns) {
+  const flags = /* @__PURE__ */ new Set();
+  for (const p of patterns) {
+    for (const f of p.flags) {
+      if (f !== "g" && f !== "y") flags.add(f);
+    }
+  }
+  const uniqueFlags = [...flags].join("");
+  return new RegExp(patterns.map((p) => p.source).join("|"), uniqueFlags);
+}
+async function matchesAnyGuarded(path, patterns, options = {}) {
+  const normalized = normalizePath2(path);
+  if (patterns.length === 0) return false;
+  const result = await withReDoSGuard(
+    mergeGuardedRegex(patterns),
+    normalized,
+    options.budgetMs ?? GLOB_REDOS_BUDGET_MS,
+    options.onTimeout ? { onTimeout: options.onTimeout } : {}
+  );
+  if (result.timedOut) return true;
+  return result.match !== null;
+}
 function compilePathGlob(pattern) {
   const normalized = pattern.replace(/\\/g, "/");
   let source = "";
@@ -13713,8 +13941,7 @@ function scopesMayOverlap(left, right) {
   }
   return hasPartialSegmentWildcard(left) && rightPrefix.startsWith(leftPrefix) || hasPartialSegmentWildcard(right) && leftPrefix.startsWith(rightPrefix);
 }
-function targetIntersectsPatterns(target, patternTexts, patterns) {
-  if (matchesAny(target.path, patterns)) return true;
+function targetIntersectsScope(target, patternTexts) {
   if (target.kind === "file") return false;
   const normalized = normalizePath2(target.path).replace(/\/$/, "");
   if (!isUnresolvedPathScope(normalized)) {
@@ -13726,6 +13953,14 @@ function targetIntersectsPatterns(target, patternTexts, patterns) {
   }
   return patternTexts.some((pattern) => scopesMayOverlap(normalized, normalizePath2(pattern)));
 }
+function targetIntersectsPatterns(target, patternTexts, patterns) {
+  if (matchesAny(target.path, patterns)) return true;
+  return targetIntersectsScope(target, patternTexts);
+}
+async function targetIntersectsPatternsGuarded(target, patternTexts, patterns, options = {}) {
+  if (await matchesAnyGuarded(target.path, patterns, options)) return true;
+  return targetIntersectsScope(target, patternTexts);
+}
 function targetFullyAllowed(target, allowTexts, allowRes) {
   if (target.kind === "file") return matchesAny(target.path, allowRes);
   const normalized = normalizePath2(target.path).replace(/\/$/, "");
@@ -14042,7 +14277,7 @@ function commandRecursivelyDeletes(command) {
   )) {
     return true;
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(rm|rmdir|del)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(rm|rmdir|del|rd|Remove-Item)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
   let match = destructive.exec(stripped);
   while (match !== null) {
     const tool = match[1]?.toLowerCase();
@@ -14055,6 +14290,8 @@ function commandRecursivelyDeletes(command) {
       if (token === "--") break;
       if (tool === "rm") {
         if (token === "--recursive" || /^-[^-]*[rR]/.test(token)) recursive = true;
+      } else if (tool === "remove-item") {
+        if (/^-Recurse$/i.test(token) || /^-r$/i.test(token)) recursive = true;
       } else if (/^\/[a-z]*s[a-z]*$/i.test(token)) {
         recursive = true;
       }
@@ -14303,7 +14540,7 @@ function destructiveTargetsAtDepth(command, depth) {
     }
     targets.push(...destructiveTargetsAtDepth(executableBody, depth + 1));
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(?:sudo\s+)?(rm|rmdir|del|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(?:sudo\s+)?(rm|rmdir|del|rd|Remove-Item|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
   let m = destructive.exec(normalizedCommand);
   while (m !== null) {
     if (!tokenIsQuoted(m, m[1] ?? "")) targets.push(...shellArgs(m[2] ?? ""));
@@ -14791,8 +15028,27 @@ function operationLabel(toolName) {
 }
 
 // src/path-guard/index.ts
+import { realpathSync } from "node:fs";
+import { resolve as resolve18 } from "node:path";
+function isSymlinkEscape(path, cwd) {
+  if (!withinProject(path)) return false;
+  try {
+    const abs = resolve18(cwd ?? process.cwd(), path);
+    const real = realpathSync(abs);
+    return !withinProject(real);
+  } catch {
+    return false;
+  }
+}
 function createState() {
-  return { invocations: 0, blocks: 0, warns: 0, lastBlock: null, hookUnregister: null };
+  return {
+    invocations: 0,
+    blocks: 0,
+    warns: 0,
+    redosTimeouts: 0,
+    lastBlock: null,
+    hookUnregister: null
+  };
 }
 var states = /* @__PURE__ */ new WeakMap();
 var latestState = createState();
@@ -14887,7 +15143,11 @@ var plugin39 = {
         additionalContext: `path-guard (warn mode): ${subject} and this ${operation} would modify it. Double-check this is intentional.`
       };
     };
-    const hook = (input) => {
+    const bumpRedos = () => {
+      state60.redosTimeouts += 1;
+      api.metrics.counter("redos_timeouts");
+    };
+    const hook = async (input) => {
       if (!cfg.enabled) return;
       state60.invocations += 1;
       const toolName = input.toolName ?? "";
@@ -14908,21 +15168,27 @@ var plugin39 = {
         const effectiveCwd = effectiveToolCwd(ti["cwd"], input.cwd);
         const recursivelyDeletes = commandRecursivelyDeletes(commandForInspection);
         const deletesImplicitScope = commandDeletesImplicitScope(commandForInspection);
-        for (const path of shellTargets) {
-          const target = {
-            path: relativeToInvocationCwd(resolveTargetPath(path, effectiveCwd), input.cwd),
-            kind: isRootPathScope(path) && deletesImplicitScope || isUnresolvedPathScope(path) || recursivelyDeletes && (isDirectoryAmbiguousPath(path) || hasConfiguredProtectedDescendant(path, cfg.protect)) ? "deletion-scope" : "file"
-          };
-          if (targetFullyAllowed(target, cfg.allow, allowRes)) continue;
-          const protectedShellTarget = targetIntersectsPatterns(target, cfg.protect, protectRes) || matchesAny(`${target.path.replace(/\/$/, "")}/.path-guard-probe`, protectRes);
-          if (protectedShellTarget) {
-            return verdict(
-              target.path,
-              toolName,
-              "destructive shell command",
-              target.kind !== "file"
-            );
-          }
+        const shellHits = await Promise.all(
+          shellTargets.map(async (path) => {
+            const target = {
+              path: relativeToInvocationCwd(resolveTargetPath(path, effectiveCwd), input.cwd),
+              kind: isRootPathScope(path) && deletesImplicitScope || isUnresolvedPathScope(path) || recursivelyDeletes && (isDirectoryAmbiguousPath(path) || hasConfiguredProtectedDescendant(path, cfg.protect)) ? "deletion-scope" : "file"
+            };
+            if (targetFullyAllowed(target, cfg.allow, allowRes)) return null;
+            const protectedShellTarget = await targetIntersectsPatternsGuarded(target, cfg.protect, protectRes, { onTimeout: bumpRedos }) || await matchesAnyGuarded(`${target.path.replace(/\/$/, "")}/.path-guard-probe`, protectRes, {
+              onTimeout: bumpRedos
+            });
+            return protectedShellTarget ? target : null;
+          })
+        );
+        const firstProtected = shellHits.find((t) => t !== null);
+        if (firstProtected) {
+          return verdict(
+            firstProtected.path,
+            toolName,
+            "destructive shell command",
+            firstProtected.kind !== "file"
+          );
         }
         const writes = writesToDisk({ ...input, toolInput: ti });
         const hasStructuredTarget = [...PATH_FIELDS, ...PATH_LIST_FIELDS].some((field) => ti[field] !== void 0) || typeof ti["patch"] === "string";
@@ -14933,11 +15199,21 @@ var plugin39 = {
       }
       if (!writesToDisk({ ...input, toolInput: ti }) || isReadOnlyInvocation(toolName, ti)) return;
       const targets = pathsFromToolInput(ti, toolName, input.cwd);
-      for (const target of targets) {
-        if (targetFullyAllowed(target, cfg.allow, allowRes)) continue;
-        if (targetIntersectsPatterns(target, cfg.protect, protectRes)) {
-          return verdict(target.path, toolName, operationLabel(toolName), target.kind !== "file");
-        }
+      const writeHits = await Promise.all(
+        targets.map(async (target) => {
+          if (target.kind === "file" && isSymlinkEscape(target.path, input.cwd)) return target;
+          if (targetFullyAllowed(target, cfg.allow, allowRes)) return null;
+          return targetIntersectsPatterns(target, cfg.protect, protectRes) ? target : null;
+        })
+      );
+      const firstProtectedWrite = writeHits.find((t) => t !== null);
+      if (firstProtectedWrite) {
+        return verdict(
+          firstProtectedWrite.path,
+          toolName,
+          operationLabel(toolName),
+          firstProtectedWrite.kind !== "file"
+        );
       }
       return;
     };
@@ -14964,7 +15240,8 @@ var plugin39 = {
           counters: {
             invocations: state60.invocations,
             blocks: state60.blocks,
-            warns: state60.warns
+            warns: state60.warns,
+            redosTimeouts: state60.redosTimeouts
           },
           lastBlock: state60.lastBlock
         };
@@ -14987,10 +15264,16 @@ var plugin39 = {
       }
       state60.hookUnregister = null;
     }
-    const final = { invocations: state60.invocations, blocks: state60.blocks, warns: state60.warns };
+    const final = {
+      invocations: state60.invocations,
+      blocks: state60.blocks,
+      warns: state60.warns,
+      redosTimeouts: state60.redosTimeouts
+    };
     state60.invocations = 0;
     state60.blocks = 0;
     state60.warns = 0;
+    state60.redosTimeouts = 0;
     state60.lastBlock = null;
     states.delete(api);
     api.log.info("path-guard: teardown complete", { final });
@@ -15003,7 +15286,8 @@ var plugin39 = {
       counters: {
         invocations: state60.invocations,
         blocks: state60.blocks,
-        warns: state60.warns
+        warns: state60.warns,
+        redosTimeouts: state60.redosTimeouts
       }
     };
   }
@@ -15012,7 +15296,7 @@ var path_guard_default = plugin39;
 
 // src/performance-regression-gate/index.ts
 import { existsSync as existsSync5, readFileSync as readFileSync11 } from "node:fs";
-import { isAbsolute as isAbsolute19, relative as relative19, resolve as resolve19 } from "node:path";
+import { isAbsolute as isAbsolute18, relative as relative18, resolve as resolve19 } from "node:path";
 var API_VERSION26 = "^0.1.10";
 var state36 = {
   invocationCount: 0,
@@ -15035,21 +15319,21 @@ function readConfig35(raw) {
     thresholdPercent: threshold
   };
 }
-function withinProject4(p, cwd = process.cwd()) {
+function withinProject3(p, cwd = process.cwd()) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = resolve19(cwd);
-  const resolved = isAbsolute19(p) ? resolve19(p) : resolve19(root, p);
-  const rel = relative19(root, resolved);
+  const resolved = isAbsolute18(p) ? resolve19(p) : resolve19(root, p);
+  const rel = relative18(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute19(rel)) return false;
+  if (isAbsolute18(rel)) return false;
   return true;
 }
 function resolveProjectPath6(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
   const root = resolve19(cwd);
-  const resolved = isAbsolute19(rawPath) ? resolve19(rawPath) : resolve19(root, rawPath);
-  if (!withinProject4(resolved, cwd)) return null;
+  const resolved = isAbsolute18(rawPath) ? resolve19(rawPath) : resolve19(root, rawPath);
+  if (!withinProject3(resolved, cwd)) return null;
   return resolved;
 }
 function isValidNumber(n) {
@@ -15463,7 +15747,7 @@ var plugin_stack_observer_default = PLUGIN;
 // src/pr-drafter/index.ts
 import { execFile as execFile10 } from "node:child_process";
 import { mkdir as mkdir2, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname7, isAbsolute as isAbsolute20, relative as relative20, resolve as resolve20 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute19, relative as relative19, resolve as resolve20 } from "node:path";
 var API_VERSION27 = "^0.1.10";
 var state38 = {
   commits: [],
@@ -15503,9 +15787,9 @@ function readConfig37(raw) {
 function resolveProjectPath7(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
   const root = resolve20(cwd);
-  const resolved = isAbsolute20(rawPath) ? resolve20(rawPath) : resolve20(root, rawPath);
-  const rel = relative20(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute20(rel)) return resolved;
+  const resolved = isAbsolute19(rawPath) ? resolve20(rawPath) : resolve20(root, rawPath);
+  const rel = relative19(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute19(rel)) return resolved;
   return null;
 }
 function runGit4(args, timeout) {
@@ -15949,6 +16233,9 @@ var plugin42 = {
 };
 var process_guard_default = plugin42;
 
+// src/prompt-firewall/index.ts
+import { performance as performance2 } from "node:perf_hooks";
+
 // src/runtime/credential-patterns.ts
 var CREDENTIAL_PATTERNS = [
   // LLM provider keys
@@ -16120,32 +16407,156 @@ var PATTERNS2 = [
   })),
   ...EXTRA_PATTERNS
 ];
-function detectSecrets(text, allow) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const p of PATTERNS2) {
-    p.re.lastIndex = 0;
-    let m = p.re.exec(text);
+var PATTERN_BUDGET_MS = 250;
+var GUARD_PROBE_LENGTH = 1e5;
+var GUARD_PROBE_OVERLAP = 4096;
+var SCAN_PASS_BUDGET_MS = 250;
+function createScanDeadline() {
+  return { deadline: performance2.now() + SCAN_PASS_BUDGET_MS, tripped: /* @__PURE__ */ new Set() };
+}
+var SCAN_WINDOW_STRIDE = GUARD_PROBE_LENGTH - GUARD_PROBE_OVERLAP;
+var SCAN_WINDOW_TAIL = 65536;
+var SCAN_WINDOW_LIMIT = GUARD_PROBE_LENGTH + SCAN_WINDOW_TAIL;
+var SCAN_MAX_GROWTH = 16;
+function growMatch(re, p, text, absStart, deadline) {
+  let size = GUARD_PROBE_LENGTH;
+  for (let grown = 0; grown < SCAN_MAX_GROWTH; grown++) {
+    if (deadline && performance2.now() > deadline.deadline) {
+      deadline.tripped.add(p.kind);
+      return null;
+    }
+    const extEnd = Math.min(text.length, absStart + size);
+    const ext = text.slice(absStart, extEnd);
+    re.lastIndex = 0;
+    const em = re.exec(ext);
+    if (!em || em.index !== 0 || em[0].length === 0) return null;
+    const end = absStart + em[0].length;
+    if (end < extEnd || extEnd === text.length) {
+      return { start: absStart, end, matched: em[0] };
+    }
+    size *= 2;
+  }
+  return null;
+}
+function* execWindowed(p, text, deadline) {
+  const re = new RegExp(p.re.source, p.re.flags);
+  let acceptLo = 0;
+  let highWater = 0;
+  for (let window = 0; acceptLo < text.length; window++) {
+    const sliceStart = window === 0 ? 0 : acceptLo - GUARD_PROBE_OVERLAP;
+    const sliceEnd = Math.min(text.length, sliceStart + SCAN_WINDOW_LIMIT);
+    const slice = text.slice(sliceStart, sliceEnd);
+    const acceptHi = Math.min(acceptLo + SCAN_WINDOW_STRIDE, text.length);
+    re.lastIndex = 0;
+    let m = re.exec(slice);
     while (m !== null) {
+      if (deadline && performance2.now() > deadline.deadline) {
+        deadline.tripped.add(p.kind);
+        return;
+      }
       const matched = m[0];
-      if (!allow.some((a) => a.test(matched))) {
-        counts.set(p.kind, (counts.get(p.kind) ?? 0) + 1);
+      if (matched.length === 0) {
+        re.lastIndex += 1;
+        m = re.exec(slice);
+        continue;
+      }
+      const absStart = sliceStart + m.index;
+      const absEnd = absStart + matched.length;
+      if (absStart >= acceptLo && absStart < acceptHi) {
+        let final = { start: absStart, end: absEnd, matched };
+        if (absEnd === sliceEnd && sliceEnd < text.length) {
+          final = growMatch(re, p, text, absStart, deadline) ?? final;
+          re.lastIndex = m.index + final.matched.length;
+        }
+        if (final.start >= highWater) {
+          highWater = Math.max(highWater, final.end);
+          yield final;
+        }
       }
-      m = p.re.exec(text);
+      m = re.exec(slice);
+    }
+    acceptLo += SCAN_WINDOW_STRIDE;
+  }
+}
+function countMatches(p, text, allow, counts, deadline) {
+  if (deadline && performance2.now() > deadline.deadline) {
+    deadline.tripped.add(p.kind);
+    return;
+  }
+  for (const m of execWindowed(p, text, deadline)) {
+    if (!allow.some((a) => a.test(m.matched))) {
+      counts.set(p.kind, (counts.get(p.kind) ?? 0) + 1);
+    }
+  }
+}
+function replacePattern(p, text, allow, redactions, deadline) {
+  if (deadline && performance2.now() > deadline.deadline) {
+    deadline.tripped.add(p.kind);
+    return text;
+  }
+  let out = "";
+  let copied = 0;
+  for (const m of execWindowed(p, text, deadline)) {
+    out += text.slice(copied, m.start);
+    if (allow.some((a) => a.test(m.matched))) {
+      out += m.matched;
+    } else {
+      redactions.n += 1;
+      out += `[REDACTED:${p.kind}]`;
     }
+    copied = m.end;
   }
-  return [...counts.entries()].map(([kind, count]) => ({ kind, count }));
+  return out + text.slice(copied);
 }
-function redactSecrets(text, allow) {
+function redactSecrets(text, allow, deadline) {
+  const redactions = { n: 0 };
   let out = text;
-  let redactions = 0;
-  for (const p of PATTERNS2) {
-    out = out.replace(new RegExp(p.re.source, p.re.flags), (match) => {
-      if (allow.some((a) => a.test(match))) return match;
-      redactions += 1;
-      return `[REDACTED:${p.kind}]`;
+  for (const p of PATTERNS2) out = replacePattern(p, out, allow, redactions, deadline);
+  return { text: out, redactions: redactions.n };
+}
+var DISTINCT_PATTERN_KINDS = new Set(PATTERNS2.map((p) => p.kind)).size;
+async function probeTimedOutPatterns(text) {
+  const timedOut = /* @__PURE__ */ new Set();
+  if (text.length === 0) return timedOut;
+  const probeWindow = (offset) => {
+    const window = text.slice(offset, offset + GUARD_PROBE_LENGTH);
+    const combined = new RegExp(PATTERNS2.map((p) => `(${p.re.source})`).join("|"), "gi");
+    return withReDoSGuard(combined, window, PATTERN_BUDGET_MS).then(async (combinedResult) => {
+      if (!combinedResult.timedOut) return;
+      for (const p of PATTERNS2) {
+        if (timedOut.has(p.kind)) continue;
+        const result = await withReDoSGuard(p.re, window, PATTERN_BUDGET_MS);
+        if (result.timedOut) timedOut.add(p.kind);
+      }
     });
+  };
+  const stride = GUARD_PROBE_LENGTH - GUARD_PROBE_OVERLAP;
+  for (let offset = 0; offset < text.length; offset += stride) {
+    if (timedOut.size >= DISTINCT_PATTERN_KINDS) break;
+    await probeWindow(offset);
   }
-  return { text: out, redactions };
+  return timedOut;
+}
+async function detectSecretsGuarded(text, allow) {
+  const timedOut = await probeTimedOutPatterns(text);
+  const deadline = createScanDeadline();
+  const counts = /* @__PURE__ */ new Map();
+  for (const p of PATTERNS2) {
+    if (!timedOut.has(p.kind)) countMatches(p, text, allow, counts, deadline);
+  }
+  const allSkipped = /* @__PURE__ */ new Set([...timedOut, ...deadline.tripped]);
+  return {
+    detections: [...counts.entries()].map(([kind, count]) => ({ kind, count })),
+    skipped: [...allSkipped].sort().map((kind) => ({ kind, reason: "redos-timeout" }))
+  };
+}
+function redactSecretsGuarded(text, allow, skip, deadline) {
+  const redactions = { n: 0 };
+  let out = text;
+  for (const p of PATTERNS2) {
+    if (!skip.has(p.kind)) out = replacePattern(p, out, allow, redactions, deadline);
+  }
+  return { text: out, redactions: redactions.n };
 }
 function collectText(request) {
   const parts = [];
@@ -16159,17 +16570,27 @@ function collectText(request) {
   walk(request["messages"]);
   return parts.join("\n");
 }
-function redactDeep(value, allow, counter) {
+var RESPONSE_SCAN_BUDGET = 1e6;
+function redactDeep(value, allow, counter, skip, budget, deadline) {
   if (typeof value === "string") {
-    const { text, redactions } = redactSecrets(value, allow);
+    if (budget) {
+      if (value.length > budget.remaining) {
+        budget.remaining = 0;
+        budget.truncated = true;
+        return value;
+      }
+      budget.remaining -= value.length;
+    }
+    const { text, redactions } = skip ? redactSecretsGuarded(value, allow, skip, deadline) : redactSecrets(value, allow, deadline);
     counter.n += redactions;
     return text;
   }
-  if (Array.isArray(value)) return value.map((v) => redactDeep(v, allow, counter));
+  if (Array.isArray(value))
+    return value.map((v) => redactDeep(v, allow, counter, skip, budget, deadline));
   if (value && typeof value === "object") {
     const out = {};
     for (const [k, v] of Object.entries(value)) {
-      out[k] = redactDeep(v, allow, counter);
+      out[k] = redactDeep(v, allow, counter, skip, budget, deadline);
     }
     return out;
   }
@@ -16204,16 +16625,34 @@ var state40 = {
   requestRedactions: 0,
   responseRedactions: 0,
   blocked: 0,
+  timeoutCount: 0,
+  skippedPatterns: [],
+  responseTruncated: false,
   byKind: /* @__PURE__ */ new Map(),
   lastDetection: null,
   extensionUnregister: null
 };
+function surfaceScanTrips(api, tripped) {
+  for (const kind of tripped) {
+    if (!state40.skippedPatterns.includes(kind)) state40.skippedPatterns.push(kind);
+  }
+  state40.timeoutCount += 1;
+  api.metrics.counter("redos_skips", 1);
+  api.log.warn("prompt-firewall: scan-pass budget exceeded \u2014 patterns skipped mid-pass (issue #370)", {
+    skipped: [...tripped]
+  });
+}
 var plugin43 = {
   name: "prompt-firewall",
   version: "0.1.0",
   description: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
   apiVersion: "^0.1.10",
   capabilities: { tools: true },
+  // Wrap-stack contract (issue #362): ExtensionRegistry composes wrappers
+  // first-registered = outermost. The manifest lists this plugin before
+  // llm-cache, and llm-cache declares this plugin in optionalDeps, so the
+  // firewall is the outer wrap: every request is scanned/redacted before
+  // llm-cache can fingerprint or cache it.
   defaultConfig: { enabled: false, mode: "redact", scanResponse: true, allow: [] },
   configSchema: {
     type: "object",
@@ -16248,6 +16687,9 @@ var plugin43 = {
     state40.requestRedactions = 0;
     state40.responseRedactions = 0;
     state40.blocked = 0;
+    state40.timeoutCount = 0;
+    state40.skippedPatterns = [];
+    state40.responseTruncated = false;
     state40.byKind.clear();
     state40.lastDetection = null;
     if (state40.extensionUnregister) {
@@ -16270,7 +16712,17 @@ var plugin43 = {
         async wrapProviderRunner(_ctx, request, inner) {
           const req = request ?? {};
           state40.invocations += 1;
-          const detections = detectSecrets(collectText(req), cfg.allow);
+          const requestText = collectText(req);
+          const { detections, skipped } = await detectSecretsGuarded(requestText, cfg.allow);
+          state40.skippedPatterns = skipped.map((s) => s.kind);
+          if (skipped.length > 0) {
+            state40.timeoutCount += 1;
+            api.log.warn("prompt-firewall: ReDoS budget exceeded, patterns skipped", {
+              skipped: state40.skippedPatterns
+            });
+            api.metrics.counter("redos_skips", 1);
+          }
+          const skipSet = new Set(state40.skippedPatterns);
           if (detections.length > 0) {
             state40.requestsWithSecrets += 1;
             for (const d of detections) {
@@ -16289,27 +16741,39 @@ var plugin43 = {
             }
             if (cfg.mode === "redact") {
               const counter = { n: 0 };
-              const redactedReq = redactDeep(req, cfg.allow, counter);
+              const deadline = createScanDeadline();
+              const redactedReq = redactDeep(req, cfg.allow, counter, skipSet, void 0, deadline);
               state40.requestRedactions += counter.n;
               api.metrics.counter("request_redactions", counter.n);
+              if (deadline.tripped.size > 0) surfaceScanTrips(api, deadline.tripped);
               const response2 = await inner(_ctx, redactedReq);
-              return cfg.scanResponse ? redactResponse(response2, cfg.allow) : response2;
+              return cfg.scanResponse ? redactResponse(response2, cfg.allow, skipSet) : response2;
             }
           }
           const response = await inner(_ctx, request);
           if (cfg.mode === "redact" && cfg.scanResponse) {
-            return redactResponse(response, cfg.allow);
+            return redactResponse(response, cfg.allow, skipSet);
           }
           return response;
         }
       });
     }
-    function redactResponse(response, allow) {
+    function redactResponse(response, allow, skip) {
       if (!response || typeof response !== "object") return response;
       const counter = { n: 0 };
       const content = response.content;
       if (content === void 0) return response;
-      const redacted = redactDeep(content, allow, counter);
+      const budget = { remaining: RESPONSE_SCAN_BUDGET, truncated: false };
+      const deadline = createScanDeadline();
+      const redacted = redactDeep(content, allow, counter, skip, budget, deadline);
+      if (deadline.tripped.size > 0) surfaceScanTrips(api, deadline.tripped);
+      if (budget.truncated) {
+        state40.responseTruncated = true;
+        api.log.warn(
+          "prompt-firewall: response scan budget exhausted \u2014 part of the response was returned unredacted"
+        );
+        api.metrics.counter("response_scan_truncated", 1);
+      }
       if (counter.n > 0) {
         state40.responseRedactions += counter.n;
         api.metrics.counter("response_redactions", counter.n);
@@ -16335,12 +16799,15 @@ var plugin43 = {
           mode: cfg.mode,
           scanResponse: cfg.scanResponse,
           patterns: PATTERNS2.map((p) => p.kind),
+          skippedPatterns: state40.skippedPatterns,
+          responseTruncated: state40.responseTruncated,
           counters: {
             invocations: state40.invocations,
             requestsWithSecrets: state40.requestsWithSecrets,
             requestRedactions: state40.requestRedactions,
             responseRedactions: state40.responseRedactions,
-            blocked: state40.blocked
+            blocked: state40.blocked,
+            timeoutCount: state40.timeoutCount
           },
           byKind: Object.fromEntries(state40.byKind),
           lastDetection: state40.lastDetection
@@ -16367,13 +16834,17 @@ var plugin43 = {
       requestsWithSecrets: state40.requestsWithSecrets,
       requestRedactions: state40.requestRedactions,
       responseRedactions: state40.responseRedactions,
-      blocked: state40.blocked
+      blocked: state40.blocked,
+      timeoutCount: state40.timeoutCount
     };
     state40.invocations = 0;
     state40.requestsWithSecrets = 0;
     state40.requestRedactions = 0;
     state40.responseRedactions = 0;
     state40.blocked = 0;
+    state40.timeoutCount = 0;
+    state40.skippedPatterns = [];
+    state40.responseTruncated = false;
     state40.byKind.clear();
     state40.lastDetection = null;
     api.log.info("prompt-firewall: teardown complete", { final });
@@ -16396,7 +16867,7 @@ var prompt_firewall_default = plugin43;
 
 // src/refactor-suggester/index.ts
 import { readFile as readFile12 } from "node:fs/promises";
-import { isAbsolute as isAbsolute21, relative as relative21, resolve as resolve21 } from "node:path";
+import { isAbsolute as isAbsolute20, relative as relative20, resolve as resolve21 } from "node:path";
 var API_VERSION28 = "^0.1.10";
 var HOOK_WARNING_COOLDOWN_MS2 = 6e4;
 var state41 = {
@@ -16440,7 +16911,7 @@ function toPosix6(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath6(p) {
-  return toPosix6(relative21(process.cwd(), p));
+  return toPosix6(relative20(process.cwd(), p));
 }
 function leadingIndentLevel(line) {
   const leading = line.match(/^(\s*)/)?.[1] ?? "";
@@ -16527,7 +16998,7 @@ function detectSmells(filePath, content, rules) {
 }
 async function scanPath4(rawPath, cfg) {
   const root = process.cwd();
-  const resolved = isAbsolute21(rawPath) ? resolve21(rawPath) : resolve21(root, rawPath);
+  const resolved = isAbsolute20(rawPath) ? resolve21(rawPath) : resolve21(root, rawPath);
   const exts = normalizeExtensions5(cfg.extensions);
   const files = await collectSourceFilesAsync(resolved, { extensions: exts });
   const suggestions = [];
@@ -17423,6 +17894,7 @@ function createState2() {
     allowCount: 0,
     /** PostToolUse: secrets detected in tool output. */
     leakCount: 0,
+    timeoutCount: 0,
     /** Most recent PreToolUse block — surfaced by `secret_scanner_status`. */
     lastBlock: null,
     /** Most recent PostToolUse leak — surfaced by `secret_scanner_status`. */
@@ -17591,7 +18063,19 @@ function buildHook(cfg, log, runtime) {
     const { state: state60 } = runtime;
     if (!cfg.enabled) return;
     const toolName = input.toolName ?? "unknown";
-    const matched = scanInput(input.toolInput);
+    let matched;
+    try {
+      matched = scanInput(input.toolInput);
+    } catch (err) {
+      if (String(err).includes("ReDoS")) {
+        state60.timeoutCount += 1;
+        return {
+          decision: "block",
+          reason: "secret-scanner: ReDoS timeout \u2014 regex scan exceeded the wall-clock budget. Fail-closed: treated as a block."
+        };
+      }
+      throw err;
+    }
     if (!matched) return;
     const summary = matched.join(", ");
     const when = (/* @__PURE__ */ new Date()).toISOString();
@@ -17769,7 +18253,8 @@ var plugin47 = {
             block: state60.blockCount,
             redact: state60.redactCount,
             allow: state60.allowCount,
-            leak: state60.leakCount
+            leak: state60.leakCount,
+            timeoutCount: state60.timeoutCount
           },
           lastBlock: state60.lastBlock,
           lastLeak: state60.lastLeak
@@ -17859,7 +18344,7 @@ var secret_scanner_default = plugin47;
 
 // src/security-hotspot-scanner/index.ts
 import { readdir as readdir2, readFile as readFile13, stat as stat5 } from "node:fs/promises";
-import { isAbsolute as isAbsolute22, relative as relative22, resolve as resolve22 } from "node:path";
+import { isAbsolute as isAbsolute21, relative as relative21, resolve as resolve22 } from "node:path";
 var API_VERSION31 = "^0.1.10";
 var state44 = {
   scanCount: 0,
@@ -17950,7 +18435,7 @@ function isSourceFile2(filePath, extensions) {
 async function scanPath5(inputPath, cfg) {
   const start = Date.now();
   const root = process.cwd();
-  const resolved = isAbsolute22(inputPath) ? resolve22(inputPath) : resolve22(root, inputPath);
+  const resolved = isAbsolute21(inputPath) ? resolve22(inputPath) : resolve22(root, inputPath);
   if (!withinProject(inputPath)) {
     return {
       path: inputPath,
@@ -17971,7 +18456,7 @@ async function scanPath5(inputPath, cfg) {
       filesScanned += 1;
       const findings = scanSource(content, maxPerFile);
       for (const f of findings) {
-        allFindings.push({ ...f, snippet: `${relative22(root, filePath)}:${f.line}: ${f.snippet}` });
+        allFindings.push({ ...f, snippet: `${relative21(root, filePath)}:${f.line}: ${f.snippet}` });
         if (allFindings.length >= cfg.maxFindings) return;
       }
     } catch {
@@ -18255,7 +18740,7 @@ var security_hotspot_scanner_default = plugin48;
 
 // src/semantic-search-indexer/index.ts
 import * as fs2 from "node:fs/promises";
-import { isAbsolute as isAbsolute23, relative as relative23, resolve as resolve23 } from "node:path";
+import { isAbsolute as isAbsolute22, relative as relative22, resolve as resolve23 } from "node:path";
 import { DEFAULT_WALK_IGNORE_DIRS } from "@wrongstack/core/utils";
 var API_VERSION32 = "^0.1.10";
 var escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -18333,21 +18818,21 @@ function readConfig45(raw) {
 function normalizeSlashes2(p) {
   return p.replace(/\\/g, "/");
 }
-function withinProject5(p) {
+function withinProject4(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = normalizeSlashes2(process.cwd());
-  const resolved = normalizeSlashes2(isAbsolute23(p) ? resolve23(p) : resolve23(root, p));
-  const rel = normalizeSlashes2(relative23(root, resolved));
+  const resolved = normalizeSlashes2(isAbsolute22(p) ? resolve23(p) : resolve23(root, p));
+  const rel = normalizeSlashes2(relative22(root, resolved));
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute23(rel)) return false;
+  if (isAbsolute22(rel)) return false;
   return true;
 }
 function resolveProjectPath8(p) {
   const raw = typeof p === "string" && p.length > 0 ? p : ".";
-  if (!withinProject5(raw)) return null;
+  if (!withinProject4(raw)) return null;
   const root = normalizeSlashes2(process.cwd());
-  return normalizeSlashes2(isAbsolute23(raw) ? resolve23(raw) : resolve23(root, raw));
+  return normalizeSlashes2(isAbsolute22(raw) ? resolve23(raw) : resolve23(root, raw));
 }
 function tokenize(text, minLength) {
   const tokens = [];
@@ -18432,7 +18917,7 @@ async function walkDirectory(absPath, cfg, excludes, fileBatch) {
       return;
     }
     const absChild = normalizeSlashes2(resolve23(absPath, ent.name));
-    const relChild = normalizeSlashes2(relative23(root, absChild));
+    const relChild = normalizeSlashes2(relative22(root, absChild));
     if (relChild === "" || relChild === ".") continue;
     if (excludes.some((re) => re.test(relChild))) continue;
     if (ent.isDirectory()) {
@@ -18474,7 +18959,7 @@ async function buildIndex(rootPath, cfg) {
     return;
   }
   if (rootStats.isFile()) {
-    const relPath = normalizeSlashes2(relative23(normalizeSlashes2(process.cwd()), rootPath));
+    const relPath = normalizeSlashes2(relative22(normalizeSlashes2(process.cwd()), rootPath));
     await indexFileFromStats(rootPath, relPath === "" ? "." : relPath, rootStats, cfg);
     state45.fileCount = state45.index.files.size;
   } else if (rootStats.isDirectory()) {
@@ -18771,14 +19256,14 @@ import { expectDefined as expectDefined2 } from "@wrongstack/core/utils";
 import { toErrorMessage } from "@wrongstack/core/utils";
 import { execFile as execFile12 } from "node:child_process";
 import { access as access4, readFile as readFile15, readdir as readdir4, writeFile as writeFile5 } from "node:fs/promises";
-import { isAbsolute as isAbsolute24, join as join6, relative as relative24, resolve as resolve24 } from "node:path";
+import { isAbsolute as isAbsolute23, join as join6, relative as relative23, resolve as resolve24 } from "node:path";
 var API_VERSION33 = "^0.1.10";
 function resolveProjectRoot(rawCwd, root = process.cwd()) {
   if (typeof rawCwd !== "string" || rawCwd.length === 0) return root;
   const base = resolve24(root);
-  const resolved = isAbsolute24(rawCwd) ? resolve24(rawCwd) : resolve24(base, rawCwd);
-  const rel = relative24(base, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute24(rel)) return resolved;
+  const resolved = isAbsolute23(rawCwd) ? resolve24(rawCwd) : resolve24(base, rawCwd);
+  const rel = relative23(base, resolved);
+  if (rel === "" || !rel.startsWith("..") && !isAbsolute23(rel)) return resolved;
   return null;
 }
 var state46 = {
@@ -19801,16 +20286,16 @@ var session_recap_default = plugin51;
 // src/shell-check/index.ts
 import { execFile as execFile13 } from "node:child_process";
 import { readdir as readdir5 } from "node:fs/promises";
-import { isAbsolute as isAbsolute25, join as join7, relative as relative25, resolve as resolve25 } from "node:path";
+import { isAbsolute as isAbsolute24, join as join7, relative as relative24, resolve as resolve25 } from "node:path";
 var API_VERSION34 = "^0.1.10";
-function withinProject6(p) {
+function withinProject5(p) {
   if (p.startsWith("-")) return false;
   const root = process.cwd();
-  const resolved = isAbsolute25(p) ? resolve25(p) : resolve25(root, p);
-  const rel = relative25(root, resolved);
+  const resolved = isAbsolute24(p) ? resolve25(p) : resolve25(root, p);
+  const rel = relative24(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute25(rel)) return false;
+  if (isAbsolute24(rel)) return false;
   return true;
 }
 var MAX_PATH_LEN = 4096;
@@ -19987,7 +20472,7 @@ var plugin52 = {
         const pattern = inp.pattern ?? "";
         const severity = inp.severity ?? "warning";
         state48.invocationCount += 1;
-        const pathIsSafe = (p) => typeof p === "string" && p.length > 0 && p.length <= MAX_PATH_LEN && withinProject6(p);
+        const pathIsSafe = (p) => typeof p === "string" && p.length > 0 && p.length <= MAX_PATH_LEN && withinProject5(p);
         if (!pathIsSafe(directory)) {
           return {
             ok: false,
@@ -20103,7 +20588,7 @@ var shell_check_default = plugin52;
 
 // src/smart-rename/index.ts
 import { readFileSync as readFileSync13, writeFileSync as writeFileSync2 } from "node:fs";
-import { extname as extname6, isAbsolute as isAbsolute26, relative as relative26, resolve as resolve26 } from "node:path";
+import { extname as extname6, isAbsolute as isAbsolute25, relative as relative25, resolve as resolve26 } from "node:path";
 var API_VERSION35 = "^0.1.10";
 var state49 = {
   renameCount: 0,
@@ -20122,21 +20607,21 @@ function readConfig47(raw) {
     extensions: Array.isArray(r["extensions"]) ? r["extensions"].filter((x) => typeof x === "string") : DEFAULTS44.extensions
   };
 }
-function withinProject7(p) {
+function withinProject6(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute26(p) ? resolve26(p) : resolve26(root, p);
-  const rel = relative26(root, resolved);
+  const resolved = isAbsolute25(p) ? resolve26(p) : resolve26(root, p);
+  const rel = relative25(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute26(rel)) return false;
+  if (isAbsolute25(rel)) return false;
   return true;
 }
 function toPosix7(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath7(p) {
-  return toPosix7(relative26(process.cwd(), p));
+  return toPosix7(relative25(process.cwd(), p));
 }
 function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -20221,7 +20706,7 @@ var plugin53 = {
         if (!isIdentifier(newName)) {
           return { ok: false, error: `newName "${newName}" is not a valid identifier` };
         }
-        if (!withinProject7(rawPath)) {
+        if (!withinProject6(rawPath)) {
           return { ok: false, error: "path is outside the project root" };
         }
         const ext = extname6(rawPath).toLowerCase();
@@ -20326,10 +20811,10 @@ var OFFICIAL_PLUGIN_NAMES = [
   "notify-hub",
   "changelog-writer",
   "injection-shield",
+  "prompt-firewall",
   "llm-cache",
   "model-router",
   "pr-drafter",
-  "prompt-firewall",
   "auto-escalate",
   "test-coverage-gate",
   "type-gate",
@@ -20499,7 +20984,7 @@ function isWrappedAsLinkOrCode(line, name) {
   if (lower.includes(`[\``) && lower.includes(`\`](`)) return true;
   return false;
 }
-function escapeRegExp(s) {
+function escapeRegExp2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function mapMarkdownFences(lines) {
@@ -20524,7 +21009,7 @@ function findUnlinkedReferences(lines, names) {
     const line = lines[i];
     if (line.length === 0) continue;
     for (const name of names) {
-      const re = new RegExp(`(^|[^\\w-])${escapeRegExp(name)}(?![\\w-])`, "i");
+      const re = new RegExp(`(^|[^\\w-])${escapeRegExp2(name)}(?![\\w-])`, "i");
       if (re.test(line) && !isWrappedAsLinkOrCode(line, name)) {
         if (!found.has(name)) found.set(name, true);
       }
@@ -20553,7 +21038,7 @@ function wrapLineReferences(line) {
   let cursor = 0;
   const spans = [];
   for (const name of PLUGIN_NAMES) {
-    const re = new RegExp(`(^|[^\\w-])(${escapeRegExp(name)})(?![\\w-])`, "gi");
+    const re = new RegExp(`(^|[^\\w-])(${escapeRegExp2(name)})(?![\\w-])`, "gi");
     let m;
     re.lastIndex = 0;
     while ((m = re.exec(line)) !== null) {
@@ -20774,7 +21259,7 @@ var spec_linker_default = plugin54;
 
 // src/template-engine/index.ts
 import { readFile as readFile17, writeFile as writeFile6 } from "node:fs/promises";
-import { isAbsolute as isAbsolute27 } from "node:path";
+import { isAbsolute as isAbsolute26 } from "node:path";
 var API_VERSION36 = "^0.1.10";
 var templates = /* @__PURE__ */ new Map();
 var MAX_TEMPLATES = 256;
@@ -20830,7 +21315,7 @@ function renderTemplateRaw(template, variables) {
   return result;
 }
 function validateRelativeTemplatePath(field, value) {
-  if (isAbsolute27(value) || value.split(/[\\/]+/).includes("..")) {
+  if (isAbsolute26(value) || value.split(/[\\/]+/).includes("..")) {
     return `${field} must be a relative path without ".." components`;
   }
   if (!withinProject(value)) {
@@ -21430,7 +21915,7 @@ var test_coverage_gate_default = plugin56;
 import { execFile as execFile14 } from "node:child_process";
 import { readFileSync as readFileSync15 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname8, isAbsolute as isAbsolute28, relative as relative27, resolve as resolve27 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute27, relative as relative26, resolve as resolve27 } from "node:path";
 var API_VERSION38 = "^0.1.10";
 var state52 = {
   invocationCount: 0,
@@ -21499,17 +21984,17 @@ var ALLOWED_RUNNER_FLAGS = /* @__PURE__ */ new Set([
   "--reporter=verbose",
   "--reporter=default"
 ]);
-function withinProject8(p) {
+function withinProject7(p) {
   if (p.length === 0 || p.length > 4096 || p.startsWith("-")) return false;
   const root = resolve27(process.cwd());
-  const resolved = isAbsolute28(p) ? resolve27(p) : resolve27(root, p);
-  const rel = relative27(root, resolved);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute28(rel);
+  const resolved = isAbsolute27(p) ? resolve27(p) : resolve27(root, p);
+  const rel = relative26(root, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute27(rel);
 }
 function isInside3(parent, child) {
   if (parent === child) return true;
-  const rel = relative27(parent, child);
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute28(rel);
+  const rel = relative26(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute27(rel);
 }
 function tokenizeCommand(command) {
   const trimmed = command.trim();
@@ -21553,7 +22038,7 @@ function resolveTestCommand(baseCommand, testPattern) {
     if (!relativeBin) return null;
     const packageDir = dirname8(packagePath);
     const candidate = resolve27(packageDir, relativeBin);
-    if (isAbsolute28(relativeBin) || !isInside3(packageDir, candidate)) {
+    if (isAbsolute27(relativeBin) || !isInside3(packageDir, candidate)) {
       return null;
     }
     resolvedEntry = candidate;
@@ -21562,7 +22047,7 @@ function resolveTestCommand(baseCommand, testPattern) {
   }
   const args = [resolvedEntry, ...runnerArgs];
   if (testPattern) {
-    if (!withinProject8(testPattern)) return null;
+    if (!withinProject7(testPattern)) return null;
     args.push(testPattern);
   }
   return {
@@ -21796,7 +22281,7 @@ var test_flake_detector_default = plugin57;
 
 // src/test-generator/index.ts
 import { readFileSync as readFileSync16 } from "node:fs";
-import { isAbsolute as isAbsolute29, relative as relative28, resolve as resolve28 } from "node:path";
+import { isAbsolute as isAbsolute28, relative as relative27, resolve as resolve28 } from "node:path";
 var API_VERSION39 = "^0.1.10";
 var state53 = {
   generateCount: 0,
@@ -21852,21 +22337,21 @@ var SOURCE_EXTENSIONS = [
   ".cpp",
   ".hpp"
 ];
-function withinProject9(p) {
+function withinProject8(p) {
   if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;
   const root = process.cwd();
-  const resolved = isAbsolute29(p) ? resolve28(p) : resolve28(root, p);
-  const rel = relative28(root, resolved);
+  const resolved = isAbsolute28(p) ? resolve28(p) : resolve28(root, p);
+  const rel = relative27(root, resolved);
   if (rel === "" || rel === ".") return true;
   if (rel.startsWith("..")) return false;
-  if (isAbsolute29(rel)) return false;
+  if (isAbsolute28(rel)) return false;
   return true;
 }
 function toPosix8(p) {
   return p.replace(/\\/g, "/");
 }
 function relativePath8(p) {
-  return toPosix8(relative28(process.cwd(), p));
+  return toPosix8(relative27(process.cwd(), p));
 }
 function detectExports(content) {
   const exports = [];
@@ -22076,7 +22561,7 @@ var plugin58 = {
         if (!rawPath || typeof rawPath !== "string") {
           return { ok: false, error: "path is required" };
         }
-        if (!withinProject9(rawPath)) {
+        if (!withinProject8(rawPath)) {
           return { ok: false, error: "path is outside the project root" };
         }
         if (!SOURCE_EXTENSIONS.some((ext) => rawPath.toLowerCase().endsWith(ext))) {
@@ -22172,7 +22657,7 @@ var test_generator_default = plugin58;
 // src/test-runner-gate/index.ts
 import { execFile as execFile15 } from "node:child_process";
 import { access as access5 } from "node:fs/promises";
-import { basename as basename7, dirname as dirname9, isAbsolute as isAbsolute30, join as join8 } from "node:path";
+import { basename as basename7, dirname as dirname9, isAbsolute as isAbsolute29, join as join8 } from "node:path";
 import { buildWin32CmdShimInvocation as buildWin32CmdShimInvocation2, resolveWin32Command as resolveWin32Command2 } from "@wrongstack/tools/win32";
 function resolveExec(command, args) {
   const resolved = resolveWin32Command2(command);
@@ -22341,7 +22826,7 @@ function resolveAllowedCommand2(customCommand) {
   if (ALLOWED_COMMAND_TOKENS.has(head)) {
     return { cmd: head, args: tokens.slice(1) };
   }
-  if (isAbsolute30(head)) {
+  if (isAbsolute29(head)) {
     if (!withinProject(head)) return null;
     const base = basename7(head);
     if (ALLOWED_COMMAND_TOKENS.has(base)) {