@wrongstack/plugins 0.308.0 → 0.308.1

package/dist/audit/index.d.ts

@@ -208,6 +208,12 @@ export declare const OFFICIAL_PLUGIN_AUDIT_ENTRIES: readonly [{
     readonly summary: 'Scans tool output (fetched pages, files) for prompt-injection patterns and warns the model that content is data, not instructions';
     readonly defaultState: 'active';
     readonly canDisable: true;
+}, {
+    readonly name: 'prompt-firewall';
+    readonly risk: 'high';
+    readonly summary: 'Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.';
+    readonly defaultState: 'inactive';
+    readonly canDisable: true;
 }, {
     readonly name: 'llm-cache';
     readonly risk: 'medium';
@@ -226,12 +232,6 @@ export declare const OFFICIAL_PLUGIN_AUDIT_ENTRIES: readonly [{
     readonly summary: 'Collects session work (commits, edited files, diff) and drafts a pull-request description';
     readonly defaultState: 'inactive';
     readonly canDisable: true;
-}, {
-    readonly name: 'prompt-firewall';
-    readonly risk: 'high';
-    readonly summary: 'Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.';
-    readonly defaultState: 'inactive';
-    readonly canDisable: true;
 }, {
     readonly name: 'auto-escalate';
     readonly risk: 'medium';

package/dist/audit.js

@@ -245,6 +245,13 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "active",
     canDisable: true
   },
+  {
+    name: "prompt-firewall",
+    risk: "high",
+    summary: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
+    defaultState: "inactive",
+    canDisable: true
+  },
   {
     name: "llm-cache",
     risk: "medium",
@@ -266,13 +273,6 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "inactive",
     canDisable: true
   },
-  {
-    name: "prompt-firewall",
-    risk: "high",
-    summary: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
-    defaultState: "inactive",
-    canDisable: true
-  },
   {
     name: "auto-escalate",
     risk: "medium",

package/dist/factories/index.d.ts

@@ -1,4 +1,4 @@
 import type { Plugin } from '@wrongstack/core/types';
-export declare const OFFICIAL_PLUGIN_SPECIFIERS: readonly ['@wrongstack/plugins/agent-handoff', '@wrongstack/plugins/cost-tracker', '@wrongstack/plugins/file-watcher', '@wrongstack/plugins/git-autocommit', '@wrongstack/plugins/auto-doc', '@wrongstack/plugins/shell-check', '@wrongstack/plugins/cron', '@wrongstack/plugins/template-engine', '@wrongstack/plugins/semver-bump', '@wrongstack/plugins/secret-scanner', '@wrongstack/plugins/todo-tracker', '@wrongstack/plugins/token-budget', '@wrongstack/plugins/lint-gate', '@wrongstack/plugins/branch-guard', '@wrongstack/plugins/diff-summary', '@wrongstack/plugins/commit-validator', '@wrongstack/plugins/format-on-save', '@wrongstack/plugins/test-runner-gate', '@wrongstack/plugins/import-organizer', '@wrongstack/plugins/knowledge-graph', '@wrongstack/plugins/todo-listener', '@wrongstack/plugins/session-recap', '@wrongstack/plugins/spec-linker', '@wrongstack/plugins/loop-breaker', '@wrongstack/plugins/gitignore-guard', '@wrongstack/plugins/path-guard', '@wrongstack/plugins/process-guard', '@wrongstack/plugins/context-pins', '@wrongstack/plugins/checkpoint', '@wrongstack/plugins/error-lens', '@wrongstack/plugins/dep-guard', '@wrongstack/plugins/config-validator', '@wrongstack/plugins/notify-hub', '@wrongstack/plugins/changelog-writer', '@wrongstack/plugins/injection-shield', '@wrongstack/plugins/llm-cache', '@wrongstack/plugins/model-router', '@wrongstack/plugins/pr-drafter', '@wrongstack/plugins/prompt-firewall', '@wrongstack/plugins/auto-escalate', '@wrongstack/plugins/test-coverage-gate', '@wrongstack/plugins/type-gate', '@wrongstack/plugins/token-throttle', '@wrongstack/plugins/plugin-stack-observer', '@wrongstack/plugins/dependency-vulnerability-gate', '@wrongstack/plugins/migration-planner', '@wrongstack/plugins/semantic-search-indexer', '@wrongstack/plugins/auto-i18n-extractor', '@wrongstack/plugins/doc-sync-guard', '@wrongstack/plugins/api-compatibility-gate', '@wrongstack/plugins/performance-regression-gate', '@wrongstack/plugins/test-flake-detector', '@wrongstack/plugins/schema-evolution-guard', '@wrongstack/plugins/license-audit-gate', '@wrongstack/plugins/accessibility-auditor', '@wrongstack/plugins/security-hotspot-scanner', '@wrongstack/plugins/dead-code-detector', '@wrongstack/plugins/duplicate-code-detector', '@wrongstack/plugins/code-metrics', '@wrongstack/plugins/refactor-suggester', '@wrongstack/plugins/test-generator', '@wrongstack/plugins/release-notes-generator', '@wrongstack/plugins/smart-rename', '@wrongstack/plugins/feature-flag-tracker', '@wrongstack/plugins/interface-contract-guard'];
+export declare const OFFICIAL_PLUGIN_SPECIFIERS: readonly ['@wrongstack/plugins/agent-handoff', '@wrongstack/plugins/cost-tracker', '@wrongstack/plugins/file-watcher', '@wrongstack/plugins/git-autocommit', '@wrongstack/plugins/auto-doc', '@wrongstack/plugins/shell-check', '@wrongstack/plugins/cron', '@wrongstack/plugins/template-engine', '@wrongstack/plugins/semver-bump', '@wrongstack/plugins/secret-scanner', '@wrongstack/plugins/todo-tracker', '@wrongstack/plugins/token-budget', '@wrongstack/plugins/lint-gate', '@wrongstack/plugins/branch-guard', '@wrongstack/plugins/diff-summary', '@wrongstack/plugins/commit-validator', '@wrongstack/plugins/format-on-save', '@wrongstack/plugins/test-runner-gate', '@wrongstack/plugins/import-organizer', '@wrongstack/plugins/knowledge-graph', '@wrongstack/plugins/todo-listener', '@wrongstack/plugins/session-recap', '@wrongstack/plugins/spec-linker', '@wrongstack/plugins/loop-breaker', '@wrongstack/plugins/gitignore-guard', '@wrongstack/plugins/path-guard', '@wrongstack/plugins/process-guard', '@wrongstack/plugins/context-pins', '@wrongstack/plugins/checkpoint', '@wrongstack/plugins/error-lens', '@wrongstack/plugins/dep-guard', '@wrongstack/plugins/config-validator', '@wrongstack/plugins/notify-hub', '@wrongstack/plugins/changelog-writer', '@wrongstack/plugins/injection-shield', '@wrongstack/plugins/prompt-firewall', '@wrongstack/plugins/llm-cache', '@wrongstack/plugins/model-router', '@wrongstack/plugins/pr-drafter', '@wrongstack/plugins/auto-escalate', '@wrongstack/plugins/test-coverage-gate', '@wrongstack/plugins/type-gate', '@wrongstack/plugins/token-throttle', '@wrongstack/plugins/plugin-stack-observer', '@wrongstack/plugins/dependency-vulnerability-gate', '@wrongstack/plugins/migration-planner', '@wrongstack/plugins/semantic-search-indexer', '@wrongstack/plugins/auto-i18n-extractor', '@wrongstack/plugins/doc-sync-guard', '@wrongstack/plugins/api-compatibility-gate', '@wrongstack/plugins/performance-regression-gate', '@wrongstack/plugins/test-flake-detector', '@wrongstack/plugins/schema-evolution-guard', '@wrongstack/plugins/license-audit-gate', '@wrongstack/plugins/accessibility-auditor', '@wrongstack/plugins/security-hotspot-scanner', '@wrongstack/plugins/dead-code-detector', '@wrongstack/plugins/duplicate-code-detector', '@wrongstack/plugins/code-metrics', '@wrongstack/plugins/refactor-suggester', '@wrongstack/plugins/test-generator', '@wrongstack/plugins/release-notes-generator', '@wrongstack/plugins/smart-rename', '@wrongstack/plugins/feature-flag-tracker', '@wrongstack/plugins/interface-contract-guard'];
 export declare const OFFICIAL_PLUGIN_FACTORIES: readonly (() => Promise<Plugin>)[];
 //# sourceMappingURL=index.d.ts.map

package/dist/factories.js

@@ -35,10 +35,10 @@ var OFFICIAL_PLUGIN_SPECIFIERS = [
   "@wrongstack/plugins/notify-hub",
   "@wrongstack/plugins/changelog-writer",
   "@wrongstack/plugins/injection-shield",
+  "@wrongstack/plugins/prompt-firewall",
   "@wrongstack/plugins/llm-cache",
   "@wrongstack/plugins/model-router",
   "@wrongstack/plugins/pr-drafter",
-  "@wrongstack/plugins/prompt-firewall",
   "@wrongstack/plugins/auto-escalate",
   "@wrongstack/plugins/test-coverage-gate",
   "@wrongstack/plugins/type-gate",

package/dist/import-organizer.js

@@ -37,6 +37,9 @@ function cachePut(key, value) {
   binCache.set(key, { value, cachedAt: Date.now() });
   return value;
 }
+function clearLocalBinCache() {
+  binCache.clear();
+}
 function resolveNodeBin(packageName, binName, cwd, extraArgs = []) {
   const key = `${packageName}|${binName}|${cwd}`;
   const cached = binCache.get(key);
@@ -450,6 +453,7 @@ ${result.stderr.trim()}`
     });
   },
   teardown(api) {
+    clearLocalBinCache();
     if (state.hookUnregister) {
       try {
         state.hookUnregister();

package/dist/index.js

@@ -10298,6 +10298,7 @@ ${result.stderr.trim()}`
     });
   },
   teardown(api) {
+    clearLocalBinCache();
     if (state25.hookUnregister) {
       try {
         state25.hookUnregister();
@@ -11951,6 +11952,12 @@ var plugin34 = {
   description: "Caches identical provider requests and short-circuits the provider call on a hit (wrapProviderRunner). Opt-in; deterministic-only by default.",
   apiVersion: "^0.1.10",
   capabilities: { tools: true },
+  // Wrap-stack contract (issue #362): ExtensionRegistry composes wrappers
+  // first-registered = outermost, and both dependsOn and optionalDeps load
+  // dependencies first. Declaring prompt-firewall here guarantees the
+  // firewall wraps OUTSIDE this cache even if the manifest order changes —
+  // otherwise a cache hit short-circuits `inner` and bypasses redaction.
+  optionalDeps: ["prompt-firewall"],
   defaultConfig: { ...DEFAULTS28 },
   configSchema: {
     type: "object",
@@ -16226,6 +16233,9 @@ var plugin42 = {
 };
 var process_guard_default = plugin42;
 
+// src/prompt-firewall/index.ts
+import { performance as performance2 } from "node:perf_hooks";
+
 // src/runtime/credential-patterns.ts
 var CREDENTIAL_PATTERNS = [
   // LLM provider keys
@@ -16397,32 +16407,156 @@ var PATTERNS2 = [
   })),
   ...EXTRA_PATTERNS
 ];
-function detectSecrets(text, allow) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const p of PATTERNS2) {
-    p.re.lastIndex = 0;
-    let m = p.re.exec(text);
+var PATTERN_BUDGET_MS = 250;
+var GUARD_PROBE_LENGTH = 1e5;
+var GUARD_PROBE_OVERLAP = 4096;
+var SCAN_PASS_BUDGET_MS = 250;
+function createScanDeadline() {
+  return { deadline: performance2.now() + SCAN_PASS_BUDGET_MS, tripped: /* @__PURE__ */ new Set() };
+}
+var SCAN_WINDOW_STRIDE = GUARD_PROBE_LENGTH - GUARD_PROBE_OVERLAP;
+var SCAN_WINDOW_TAIL = 65536;
+var SCAN_WINDOW_LIMIT = GUARD_PROBE_LENGTH + SCAN_WINDOW_TAIL;
+var SCAN_MAX_GROWTH = 16;
+function growMatch(re, p, text, absStart, deadline) {
+  let size = GUARD_PROBE_LENGTH;
+  for (let grown = 0; grown < SCAN_MAX_GROWTH; grown++) {
+    if (deadline && performance2.now() > deadline.deadline) {
+      deadline.tripped.add(p.kind);
+      return null;
+    }
+    const extEnd = Math.min(text.length, absStart + size);
+    const ext = text.slice(absStart, extEnd);
+    re.lastIndex = 0;
+    const em = re.exec(ext);
+    if (!em || em.index !== 0 || em[0].length === 0) return null;
+    const end = absStart + em[0].length;
+    if (end < extEnd || extEnd === text.length) {
+      return { start: absStart, end, matched: em[0] };
+    }
+    size *= 2;
+  }
+  return null;
+}
+function* execWindowed(p, text, deadline) {
+  const re = new RegExp(p.re.source, p.re.flags);
+  let acceptLo = 0;
+  let highWater = 0;
+  for (let window = 0; acceptLo < text.length; window++) {
+    const sliceStart = window === 0 ? 0 : acceptLo - GUARD_PROBE_OVERLAP;
+    const sliceEnd = Math.min(text.length, sliceStart + SCAN_WINDOW_LIMIT);
+    const slice = text.slice(sliceStart, sliceEnd);
+    const acceptHi = Math.min(acceptLo + SCAN_WINDOW_STRIDE, text.length);
+    re.lastIndex = 0;
+    let m = re.exec(slice);
     while (m !== null) {
+      if (deadline && performance2.now() > deadline.deadline) {
+        deadline.tripped.add(p.kind);
+        return;
+      }
       const matched = m[0];
-      if (!allow.some((a) => a.test(matched))) {
-        counts.set(p.kind, (counts.get(p.kind) ?? 0) + 1);
+      if (matched.length === 0) {
+        re.lastIndex += 1;
+        m = re.exec(slice);
+        continue;
+      }
+      const absStart = sliceStart + m.index;
+      const absEnd = absStart + matched.length;
+      if (absStart >= acceptLo && absStart < acceptHi) {
+        let final = { start: absStart, end: absEnd, matched };
+        if (absEnd === sliceEnd && sliceEnd < text.length) {
+          final = growMatch(re, p, text, absStart, deadline) ?? final;
+          re.lastIndex = m.index + final.matched.length;
+        }
+        if (final.start >= highWater) {
+          highWater = Math.max(highWater, final.end);
+          yield final;
+        }
       }
-      m = p.re.exec(text);
+      m = re.exec(slice);
+    }
+    acceptLo += SCAN_WINDOW_STRIDE;
+  }
+}
+function countMatches(p, text, allow, counts, deadline) {
+  if (deadline && performance2.now() > deadline.deadline) {
+    deadline.tripped.add(p.kind);
+    return;
+  }
+  for (const m of execWindowed(p, text, deadline)) {
+    if (!allow.some((a) => a.test(m.matched))) {
+      counts.set(p.kind, (counts.get(p.kind) ?? 0) + 1);
     }
   }
-  return [...counts.entries()].map(([kind, count]) => ({ kind, count }));
 }
-function redactSecrets(text, allow) {
+function replacePattern(p, text, allow, redactions, deadline) {
+  if (deadline && performance2.now() > deadline.deadline) {
+    deadline.tripped.add(p.kind);
+    return text;
+  }
+  let out = "";
+  let copied = 0;
+  for (const m of execWindowed(p, text, deadline)) {
+    out += text.slice(copied, m.start);
+    if (allow.some((a) => a.test(m.matched))) {
+      out += m.matched;
+    } else {
+      redactions.n += 1;
+      out += `[REDACTED:${p.kind}]`;
+    }
+    copied = m.end;
+  }
+  return out + text.slice(copied);
+}
+function redactSecrets(text, allow, deadline) {
+  const redactions = { n: 0 };
   let out = text;
-  let redactions = 0;
-  for (const p of PATTERNS2) {
-    out = out.replace(new RegExp(p.re.source, p.re.flags), (match) => {
-      if (allow.some((a) => a.test(match))) return match;
-      redactions += 1;
-      return `[REDACTED:${p.kind}]`;
+  for (const p of PATTERNS2) out = replacePattern(p, out, allow, redactions, deadline);
+  return { text: out, redactions: redactions.n };
+}
+var DISTINCT_PATTERN_KINDS = new Set(PATTERNS2.map((p) => p.kind)).size;
+async function probeTimedOutPatterns(text) {
+  const timedOut = /* @__PURE__ */ new Set();
+  if (text.length === 0) return timedOut;
+  const probeWindow = (offset) => {
+    const window = text.slice(offset, offset + GUARD_PROBE_LENGTH);
+    const combined = new RegExp(PATTERNS2.map((p) => `(${p.re.source})`).join("|"), "gi");
+    return withReDoSGuard(combined, window, PATTERN_BUDGET_MS).then(async (combinedResult) => {
+      if (!combinedResult.timedOut) return;
+      for (const p of PATTERNS2) {
+        if (timedOut.has(p.kind)) continue;
+        const result = await withReDoSGuard(p.re, window, PATTERN_BUDGET_MS);
+        if (result.timedOut) timedOut.add(p.kind);
+      }
     });
+  };
+  const stride = GUARD_PROBE_LENGTH - GUARD_PROBE_OVERLAP;
+  for (let offset = 0; offset < text.length; offset += stride) {
+    if (timedOut.size >= DISTINCT_PATTERN_KINDS) break;
+    await probeWindow(offset);
+  }
+  return timedOut;
+}
+async function detectSecretsGuarded(text, allow) {
+  const timedOut = await probeTimedOutPatterns(text);
+  const deadline = createScanDeadline();
+  const counts = /* @__PURE__ */ new Map();
+  for (const p of PATTERNS2) {
+    if (!timedOut.has(p.kind)) countMatches(p, text, allow, counts, deadline);
   }
-  return { text: out, redactions };
+  const allSkipped = /* @__PURE__ */ new Set([...timedOut, ...deadline.tripped]);
+  return {
+    detections: [...counts.entries()].map(([kind, count]) => ({ kind, count })),
+    skipped: [...allSkipped].sort().map((kind) => ({ kind, reason: "redos-timeout" }))
+  };
+}
+function redactSecretsGuarded(text, allow, skip, deadline) {
+  const redactions = { n: 0 };
+  let out = text;
+  for (const p of PATTERNS2) {
+    if (!skip.has(p.kind)) out = replacePattern(p, out, allow, redactions, deadline);
+  }
+  return { text: out, redactions: redactions.n };
 }
 function collectText(request) {
   const parts = [];
@@ -16436,17 +16570,27 @@ function collectText(request) {
   walk(request["messages"]);
   return parts.join("\n");
 }
-function redactDeep(value, allow, counter) {
+var RESPONSE_SCAN_BUDGET = 1e6;
+function redactDeep(value, allow, counter, skip, budget, deadline) {
   if (typeof value === "string") {
-    const { text, redactions } = redactSecrets(value, allow);
+    if (budget) {
+      if (value.length > budget.remaining) {
+        budget.remaining = 0;
+        budget.truncated = true;
+        return value;
+      }
+      budget.remaining -= value.length;
+    }
+    const { text, redactions } = skip ? redactSecretsGuarded(value, allow, skip, deadline) : redactSecrets(value, allow, deadline);
     counter.n += redactions;
     return text;
   }
-  if (Array.isArray(value)) return value.map((v) => redactDeep(v, allow, counter));
+  if (Array.isArray(value))
+    return value.map((v) => redactDeep(v, allow, counter, skip, budget, deadline));
   if (value && typeof value === "object") {
     const out = {};
     for (const [k, v] of Object.entries(value)) {
-      out[k] = redactDeep(v, allow, counter);
+      out[k] = redactDeep(v, allow, counter, skip, budget, deadline);
     }
     return out;
   }
@@ -16482,16 +16626,33 @@ var state40 = {
   responseRedactions: 0,
   blocked: 0,
   timeoutCount: 0,
+  skippedPatterns: [],
+  responseTruncated: false,
   byKind: /* @__PURE__ */ new Map(),
   lastDetection: null,
   extensionUnregister: null
 };
+function surfaceScanTrips(api, tripped) {
+  for (const kind of tripped) {
+    if (!state40.skippedPatterns.includes(kind)) state40.skippedPatterns.push(kind);
+  }
+  state40.timeoutCount += 1;
+  api.metrics.counter("redos_skips", 1);
+  api.log.warn("prompt-firewall: scan-pass budget exceeded \u2014 patterns skipped mid-pass (issue #370)", {
+    skipped: [...tripped]
+  });
+}
 var plugin43 = {
   name: "prompt-firewall",
   version: "0.1.0",
   description: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
   apiVersion: "^0.1.10",
   capabilities: { tools: true },
+  // Wrap-stack contract (issue #362): ExtensionRegistry composes wrappers
+  // first-registered = outermost. The manifest lists this plugin before
+  // llm-cache, and llm-cache declares this plugin in optionalDeps, so the
+  // firewall is the outer wrap: every request is scanned/redacted before
+  // llm-cache can fingerprint or cache it.
   defaultConfig: { enabled: false, mode: "redact", scanResponse: true, allow: [] },
   configSchema: {
     type: "object",
@@ -16527,6 +16688,8 @@ var plugin43 = {
     state40.responseRedactions = 0;
     state40.blocked = 0;
     state40.timeoutCount = 0;
+    state40.skippedPatterns = [];
+    state40.responseTruncated = false;
     state40.byKind.clear();
     state40.lastDetection = null;
     if (state40.extensionUnregister) {
@@ -16550,15 +16713,16 @@ var plugin43 = {
           const req = request ?? {};
           state40.invocations += 1;
           const requestText = collectText(req);
-          for (const extra of EXTRA_PATTERNS) {
-            const guarded = await withReDoSGuard(extra.re, requestText, 250, {
-              onTimeout: () => {
-                state40.timeoutCount += 1;
-              }
+          const { detections, skipped } = await detectSecretsGuarded(requestText, cfg.allow);
+          state40.skippedPatterns = skipped.map((s) => s.kind);
+          if (skipped.length > 0) {
+            state40.timeoutCount += 1;
+            api.log.warn("prompt-firewall: ReDoS budget exceeded, patterns skipped", {
+              skipped: state40.skippedPatterns
             });
-            if (guarded.timedOut) break;
+            api.metrics.counter("redos_skips", 1);
           }
-          const detections = detectSecrets(requestText, cfg.allow);
+          const skipSet = new Set(state40.skippedPatterns);
           if (detections.length > 0) {
             state40.requestsWithSecrets += 1;
             for (const d of detections) {
@@ -16577,27 +16741,39 @@ var plugin43 = {
             }
             if (cfg.mode === "redact") {
               const counter = { n: 0 };
-              const redactedReq = redactDeep(req, cfg.allow, counter);
+              const deadline = createScanDeadline();
+              const redactedReq = redactDeep(req, cfg.allow, counter, skipSet, void 0, deadline);
               state40.requestRedactions += counter.n;
               api.metrics.counter("request_redactions", counter.n);
+              if (deadline.tripped.size > 0) surfaceScanTrips(api, deadline.tripped);
               const response2 = await inner(_ctx, redactedReq);
-              return cfg.scanResponse ? redactResponse(response2, cfg.allow) : response2;
+              return cfg.scanResponse ? redactResponse(response2, cfg.allow, skipSet) : response2;
             }
           }
           const response = await inner(_ctx, request);
           if (cfg.mode === "redact" && cfg.scanResponse) {
-            return redactResponse(response, cfg.allow);
+            return redactResponse(response, cfg.allow, skipSet);
           }
           return response;
         }
       });
     }
-    function redactResponse(response, allow) {
+    function redactResponse(response, allow, skip) {
       if (!response || typeof response !== "object") return response;
       const counter = { n: 0 };
       const content = response.content;
       if (content === void 0) return response;
-      const redacted = redactDeep(content, allow, counter);
+      const budget = { remaining: RESPONSE_SCAN_BUDGET, truncated: false };
+      const deadline = createScanDeadline();
+      const redacted = redactDeep(content, allow, counter, skip, budget, deadline);
+      if (deadline.tripped.size > 0) surfaceScanTrips(api, deadline.tripped);
+      if (budget.truncated) {
+        state40.responseTruncated = true;
+        api.log.warn(
+          "prompt-firewall: response scan budget exhausted \u2014 part of the response was returned unredacted"
+        );
+        api.metrics.counter("response_scan_truncated", 1);
+      }
       if (counter.n > 0) {
         state40.responseRedactions += counter.n;
         api.metrics.counter("response_redactions", counter.n);
@@ -16623,6 +16799,8 @@ var plugin43 = {
           mode: cfg.mode,
           scanResponse: cfg.scanResponse,
           patterns: PATTERNS2.map((p) => p.kind),
+          skippedPatterns: state40.skippedPatterns,
+          responseTruncated: state40.responseTruncated,
           counters: {
             invocations: state40.invocations,
             requestsWithSecrets: state40.requestsWithSecrets,
@@ -16656,13 +16834,17 @@ var plugin43 = {
       requestsWithSecrets: state40.requestsWithSecrets,
       requestRedactions: state40.requestRedactions,
       responseRedactions: state40.responseRedactions,
-      blocked: state40.blocked
+      blocked: state40.blocked,
+      timeoutCount: state40.timeoutCount
     };
     state40.invocations = 0;
     state40.requestsWithSecrets = 0;
     state40.requestRedactions = 0;
     state40.responseRedactions = 0;
     state40.blocked = 0;
+    state40.timeoutCount = 0;
+    state40.skippedPatterns = [];
+    state40.responseTruncated = false;
     state40.byKind.clear();
     state40.lastDetection = null;
     api.log.info("prompt-firewall: teardown complete", { final });
@@ -20629,10 +20811,10 @@ var OFFICIAL_PLUGIN_NAMES = [
   "notify-hub",
   "changelog-writer",
   "injection-shield",
+  "prompt-firewall",
   "llm-cache",
   "model-router",
   "pr-drafter",
-  "prompt-firewall",
   "auto-escalate",
   "test-coverage-gate",
   "type-gate",

package/dist/llm-cache.js

@@ -82,6 +82,12 @@ var plugin = {
   description: "Caches identical provider requests and short-circuits the provider call on a hit (wrapProviderRunner). Opt-in; deterministic-only by default.",
   apiVersion: "^0.1.10",
   capabilities: { tools: true },
+  // Wrap-stack contract (issue #362): ExtensionRegistry composes wrappers
+  // first-registered = outermost, and both dependsOn and optionalDeps load
+  // dependencies first. Declaring prompt-firewall here guarantees the
+  // firewall wraps OUTSIDE this cache even if the manifest order changes —
+  // otherwise a cache hit short-circuits `inner` and bypasses redaction.
+  optionalDeps: ["prompt-firewall"],
   defaultConfig: { ...DEFAULTS },
   configSchema: {
     type: "object",

package/dist/manifest.js

@@ -35,10 +35,10 @@ var OFFICIAL_PLUGIN_NAMES = [
   "notify-hub",
   "changelog-writer",
   "injection-shield",
+  "prompt-firewall",
   "llm-cache",
   "model-router",
   "pr-drafter",
-  "prompt-firewall",
   "auto-escalate",
   "test-coverage-gate",
   "type-gate",

package/dist/plugin-audit-catalog.js

@@ -245,6 +245,13 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "active",
     canDisable: true
   },
+  {
+    name: "prompt-firewall",
+    risk: "high",
+    summary: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
+    defaultState: "inactive",
+    canDisable: true
+  },
   {
     name: "llm-cache",
     risk: "medium",
@@ -266,13 +273,6 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "inactive",
     canDisable: true
   },
-  {
-    name: "prompt-firewall",
-    risk: "high",
-    summary: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
-    defaultState: "inactive",
-    canDisable: true
-  },
   {
     name: "auto-escalate",
     risk: "medium",

package/dist/prompt-firewall/index.d.ts

@@ -1,43 +1,3 @@
-/**
- * prompt-firewall plugin — inspects and redacts secrets on the provider
- * wire, before context leaves for the LLM API and as it returns.
- *
- * Distinct from `secret-scanner` (which guards the TOOL boundary): this
- * sits on `AgentExtension.wrapProviderRunner`, so it sees the FULL
- * request that is about to be sent to a third-party LLM provider —
- * regardless of how a secret entered the conversation. It scans the
- * outgoing request's system + message text for high-confidence
- * credential patterns and, depending on `mode`:
- *
- *  - `warn`   — logs + counts + emits a `prompt-firewall:leak`
- *    event; the request goes through unchanged
- *  - `redact` (default) — replaces each match with `[REDACTED:<kind>]` in a CLONE
- *    of the request before sending, and also redacts secrets echoed back
- *    in the response
- *  - `block`  — throws before the request is sent (the agent's error
- *    path surfaces it), so the secret never reaches the provider
- *
- * Safety posture: opt-in — loads inert until
- * `config.extensions['prompt-firewall'].enabled = true`. `redact` is the
- * default so secrets are automatically stripped; switch to `warn` only
- * for detection-mode diagnostics without data loss.
- *
- * Config (`config.extensions['prompt-firewall']`):
- *
- * ```jsonc
- * {
- *   "enabled": false,
- *   "mode": "redact",        // "warn" | "redact" | "block"
- *   "scanResponse": true,     // redact secrets echoed back (redact mode)
- *   "allow": []               // regex source strings to exempt (false positives)
- * }
- * ```
- *
- * Tools:
- *  - `prompt_firewall_status` — mode, pattern names, detection counters
- *
- * @public
- */
 import type { Plugin } from '@wrongstack/core/types';
 /**
  * Legacy `kind` names for the shapes this plugin already reported, so the
@@ -50,10 +10,52 @@ export interface Detection {
     kind: string;
     count: number;
 }
+/**
+ * A pattern excluded from a scan pass. `redos-timeout` = the pattern blew
+ * its wall-clock budget on the guarded probe and was skipped (fail-open
+ * with a visible counter — this surface trades blocking for availability;
+ * `secret-scanner` is the fail-closed tool-side gate).
+ */
+export interface ScanSkip {
+    kind: string;
+    reason: 'redos-timeout';
+}
+/**
+ * Mutable deadline shared across one scan pass. `tripped` collects the
+ * kinds that blew the budget mid-pass; the caller merges them into the
+ * visible skip surface (status + counters + warn log).
+ */
+interface ScanDeadline {
+    deadline: number;
+    tripped: Set<string>;
+}
+/**
+ * Hard bound on any single synchronous regex input in a scan pass. The
+ * structural guarantee of #371: even a growth-loop re-measure never hands
+ * a regex the full unbounded leaf.
+ */
+export declare const SCAN_WINDOW_LIMIT: number;
 /** Detect secret matches in text. Returns per-kind counts (no values). */
 export declare function detectSecrets(text: string, allow: RegExp[]): Detection[];
 /** Redact secret matches in text, replacing each with `[REDACTED:<kind>]`. */
-export declare function redactSecrets(text: string, allow: RegExp[]): {
+export declare function redactSecrets(text: string, allow: RegExp[], deadline?: ScanDeadline): {
+    text: string;
+    redactions: number;
+};
+/**
+ * Detect secret matches, skipping patterns that blow the ReDoS budget on
+ * the guarded probe. The skip set is returned so callers can surface it
+ * (status counters / logs) instead of silently trusting the result.
+ */
+export declare function detectSecretsGuarded(text: string, allow: RegExp[]): Promise<{
+    detections: Detection[];
+    skipped: ScanSkip[];
+}>;
+/**
+ * Redact secret matches, skipping the given timed-out patterns (reuse the
+ * set from `detectSecretsGuarded` so a request pays the probe once).
+ */
+export declare function redactSecretsGuarded(text: string, allow: RegExp[], skip: ReadonlySet<string>, deadline?: ScanDeadline): {
     text: string;
     redactions: number;
 };

package/dist/prompt-firewall.js

@@ -1,3 +1,6 @@
+// src/prompt-firewall/index.ts
+import { performance } from "node:perf_hooks";
+
 // src/runtime/credential-patterns.ts
 var CREDENTIAL_PATTERNS = [
   // LLM provider keys
@@ -246,32 +249,161 @@ var PATTERNS = [
   })),
   ...EXTRA_PATTERNS
 ];
-function detectSecrets(text, allow) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const p of PATTERNS) {
-    p.re.lastIndex = 0;
-    let m = p.re.exec(text);
+var PATTERN_BUDGET_MS = 250;
+var GUARD_PROBE_LENGTH = 1e5;
+var GUARD_PROBE_OVERLAP = 4096;
+var SCAN_PASS_BUDGET_MS = 250;
+function createScanDeadline() {
+  return { deadline: performance.now() + SCAN_PASS_BUDGET_MS, tripped: /* @__PURE__ */ new Set() };
+}
+var SCAN_WINDOW_STRIDE = GUARD_PROBE_LENGTH - GUARD_PROBE_OVERLAP;
+var SCAN_WINDOW_TAIL = 65536;
+var SCAN_WINDOW_LIMIT = GUARD_PROBE_LENGTH + SCAN_WINDOW_TAIL;
+var SCAN_MAX_GROWTH = 16;
+function growMatch(re, p, text, absStart, deadline) {
+  let size = GUARD_PROBE_LENGTH;
+  for (let grown = 0; grown < SCAN_MAX_GROWTH; grown++) {
+    if (deadline && performance.now() > deadline.deadline) {
+      deadline.tripped.add(p.kind);
+      return null;
+    }
+    const extEnd = Math.min(text.length, absStart + size);
+    const ext = text.slice(absStart, extEnd);
+    re.lastIndex = 0;
+    const em = re.exec(ext);
+    if (!em || em.index !== 0 || em[0].length === 0) return null;
+    const end = absStart + em[0].length;
+    if (end < extEnd || extEnd === text.length) {
+      return { start: absStart, end, matched: em[0] };
+    }
+    size *= 2;
+  }
+  return null;
+}
+function* execWindowed(p, text, deadline) {
+  const re = new RegExp(p.re.source, p.re.flags);
+  let acceptLo = 0;
+  let highWater = 0;
+  for (let window = 0; acceptLo < text.length; window++) {
+    const sliceStart = window === 0 ? 0 : acceptLo - GUARD_PROBE_OVERLAP;
+    const sliceEnd = Math.min(text.length, sliceStart + SCAN_WINDOW_LIMIT);
+    const slice = text.slice(sliceStart, sliceEnd);
+    const acceptHi = Math.min(acceptLo + SCAN_WINDOW_STRIDE, text.length);
+    re.lastIndex = 0;
+    let m = re.exec(slice);
     while (m !== null) {
+      if (deadline && performance.now() > deadline.deadline) {
+        deadline.tripped.add(p.kind);
+        return;
+      }
       const matched = m[0];
-      if (!allow.some((a) => a.test(matched))) {
-        counts.set(p.kind, (counts.get(p.kind) ?? 0) + 1);
+      if (matched.length === 0) {
+        re.lastIndex += 1;
+        m = re.exec(slice);
+        continue;
       }
-      m = p.re.exec(text);
+      const absStart = sliceStart + m.index;
+      const absEnd = absStart + matched.length;
+      if (absStart >= acceptLo && absStart < acceptHi) {
+        let final = { start: absStart, end: absEnd, matched };
+        if (absEnd === sliceEnd && sliceEnd < text.length) {
+          final = growMatch(re, p, text, absStart, deadline) ?? final;
+          re.lastIndex = m.index + final.matched.length;
+        }
+        if (final.start >= highWater) {
+          highWater = Math.max(highWater, final.end);
+          yield final;
+        }
+      }
+      m = re.exec(slice);
+    }
+    acceptLo += SCAN_WINDOW_STRIDE;
+  }
+}
+function countMatches(p, text, allow, counts, deadline) {
+  if (deadline && performance.now() > deadline.deadline) {
+    deadline.tripped.add(p.kind);
+    return;
+  }
+  for (const m of execWindowed(p, text, deadline)) {
+    if (!allow.some((a) => a.test(m.matched))) {
+      counts.set(p.kind, (counts.get(p.kind) ?? 0) + 1);
+    }
+  }
+}
+function replacePattern(p, text, allow, redactions, deadline) {
+  if (deadline && performance.now() > deadline.deadline) {
+    deadline.tripped.add(p.kind);
+    return text;
+  }
+  let out = "";
+  let copied = 0;
+  for (const m of execWindowed(p, text, deadline)) {
+    out += text.slice(copied, m.start);
+    if (allow.some((a) => a.test(m.matched))) {
+      out += m.matched;
+    } else {
+      redactions.n += 1;
+      out += `[REDACTED:${p.kind}]`;
     }
+    copied = m.end;
   }
+  return out + text.slice(copied);
+}
+function detectSecrets(text, allow) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const p of PATTERNS) countMatches(p, text, allow, counts);
   return [...counts.entries()].map(([kind, count]) => ({ kind, count }));
 }
-function redactSecrets(text, allow) {
+function redactSecrets(text, allow, deadline) {
+  const redactions = { n: 0 };
   let out = text;
-  let redactions = 0;
-  for (const p of PATTERNS) {
-    out = out.replace(new RegExp(p.re.source, p.re.flags), (match) => {
-      if (allow.some((a) => a.test(match))) return match;
-      redactions += 1;
-      return `[REDACTED:${p.kind}]`;
+  for (const p of PATTERNS) out = replacePattern(p, out, allow, redactions, deadline);
+  return { text: out, redactions: redactions.n };
+}
+var DISTINCT_PATTERN_KINDS = new Set(PATTERNS.map((p) => p.kind)).size;
+async function probeTimedOutPatterns(text) {
+  const timedOut = /* @__PURE__ */ new Set();
+  if (text.length === 0) return timedOut;
+  const probeWindow = (offset) => {
+    const window = text.slice(offset, offset + GUARD_PROBE_LENGTH);
+    const combined = new RegExp(PATTERNS.map((p) => `(${p.re.source})`).join("|"), "gi");
+    return withReDoSGuard(combined, window, PATTERN_BUDGET_MS).then(async (combinedResult) => {
+      if (!combinedResult.timedOut) return;
+      for (const p of PATTERNS) {
+        if (timedOut.has(p.kind)) continue;
+        const result = await withReDoSGuard(p.re, window, PATTERN_BUDGET_MS);
+        if (result.timedOut) timedOut.add(p.kind);
+      }
     });
+  };
+  const stride = GUARD_PROBE_LENGTH - GUARD_PROBE_OVERLAP;
+  for (let offset = 0; offset < text.length; offset += stride) {
+    if (timedOut.size >= DISTINCT_PATTERN_KINDS) break;
+    await probeWindow(offset);
+  }
+  return timedOut;
+}
+async function detectSecretsGuarded(text, allow) {
+  const timedOut = await probeTimedOutPatterns(text);
+  const deadline = createScanDeadline();
+  const counts = /* @__PURE__ */ new Map();
+  for (const p of PATTERNS) {
+    if (!timedOut.has(p.kind)) countMatches(p, text, allow, counts, deadline);
+  }
+  const allSkipped = /* @__PURE__ */ new Set([...timedOut, ...deadline.tripped]);
+  return {
+    detections: [...counts.entries()].map(([kind, count]) => ({ kind, count })),
+    skipped: [...allSkipped].sort().map((kind) => ({ kind, reason: "redos-timeout" }))
+  };
+}
+function redactSecretsGuarded(text, allow, skip, deadline) {
+  const redactions = { n: 0 };
+  let out = text;
+  for (const p of PATTERNS) {
+    if (!skip.has(p.kind)) out = replacePattern(p, out, allow, redactions, deadline);
   }
-  return { text: out, redactions };
+  return { text: out, redactions: redactions.n };
 }
 function collectText(request) {
   const parts = [];
@@ -285,17 +417,27 @@ function collectText(request) {
   walk(request["messages"]);
   return parts.join("\n");
 }
-function redactDeep(value, allow, counter) {
+var RESPONSE_SCAN_BUDGET = 1e6;
+function redactDeep(value, allow, counter, skip, budget, deadline) {
   if (typeof value === "string") {
-    const { text, redactions } = redactSecrets(value, allow);
+    if (budget) {
+      if (value.length > budget.remaining) {
+        budget.remaining = 0;
+        budget.truncated = true;
+        return value;
+      }
+      budget.remaining -= value.length;
+    }
+    const { text, redactions } = skip ? redactSecretsGuarded(value, allow, skip, deadline) : redactSecrets(value, allow, deadline);
     counter.n += redactions;
     return text;
   }
-  if (Array.isArray(value)) return value.map((v) => redactDeep(v, allow, counter));
+  if (Array.isArray(value))
+    return value.map((v) => redactDeep(v, allow, counter, skip, budget, deadline));
   if (value && typeof value === "object") {
     const out = {};
     for (const [k, v] of Object.entries(value)) {
-      out[k] = redactDeep(v, allow, counter);
+      out[k] = redactDeep(v, allow, counter, skip, budget, deadline);
     }
     return out;
   }
@@ -331,16 +473,33 @@ var state = {
   responseRedactions: 0,
   blocked: 0,
   timeoutCount: 0,
+  skippedPatterns: [],
+  responseTruncated: false,
   byKind: /* @__PURE__ */ new Map(),
   lastDetection: null,
   extensionUnregister: null
 };
+function surfaceScanTrips(api, tripped) {
+  for (const kind of tripped) {
+    if (!state.skippedPatterns.includes(kind)) state.skippedPatterns.push(kind);
+  }
+  state.timeoutCount += 1;
+  api.metrics.counter("redos_skips", 1);
+  api.log.warn("prompt-firewall: scan-pass budget exceeded \u2014 patterns skipped mid-pass (issue #370)", {
+    skipped: [...tripped]
+  });
+}
 var plugin = {
   name: "prompt-firewall",
   version: "0.1.0",
   description: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
   apiVersion: "^0.1.10",
   capabilities: { tools: true },
+  // Wrap-stack contract (issue #362): ExtensionRegistry composes wrappers
+  // first-registered = outermost. The manifest lists this plugin before
+  // llm-cache, and llm-cache declares this plugin in optionalDeps, so the
+  // firewall is the outer wrap: every request is scanned/redacted before
+  // llm-cache can fingerprint or cache it.
   defaultConfig: { enabled: false, mode: "redact", scanResponse: true, allow: [] },
   configSchema: {
     type: "object",
@@ -376,6 +535,8 @@ var plugin = {
     state.responseRedactions = 0;
     state.blocked = 0;
     state.timeoutCount = 0;
+    state.skippedPatterns = [];
+    state.responseTruncated = false;
     state.byKind.clear();
     state.lastDetection = null;
     if (state.extensionUnregister) {
@@ -399,15 +560,16 @@ var plugin = {
           const req = request ?? {};
           state.invocations += 1;
           const requestText = collectText(req);
-          for (const extra of EXTRA_PATTERNS) {
-            const guarded = await withReDoSGuard(extra.re, requestText, 250, {
-              onTimeout: () => {
-                state.timeoutCount += 1;
-              }
+          const { detections, skipped } = await detectSecretsGuarded(requestText, cfg.allow);
+          state.skippedPatterns = skipped.map((s) => s.kind);
+          if (skipped.length > 0) {
+            state.timeoutCount += 1;
+            api.log.warn("prompt-firewall: ReDoS budget exceeded, patterns skipped", {
+              skipped: state.skippedPatterns
             });
-            if (guarded.timedOut) break;
+            api.metrics.counter("redos_skips", 1);
           }
-          const detections = detectSecrets(requestText, cfg.allow);
+          const skipSet = new Set(state.skippedPatterns);
           if (detections.length > 0) {
             state.requestsWithSecrets += 1;
             for (const d of detections) {
@@ -426,27 +588,39 @@ var plugin = {
             }
             if (cfg.mode === "redact") {
               const counter = { n: 0 };
-              const redactedReq = redactDeep(req, cfg.allow, counter);
+              const deadline = createScanDeadline();
+              const redactedReq = redactDeep(req, cfg.allow, counter, skipSet, void 0, deadline);
               state.requestRedactions += counter.n;
               api.metrics.counter("request_redactions", counter.n);
+              if (deadline.tripped.size > 0) surfaceScanTrips(api, deadline.tripped);
               const response2 = await inner(_ctx, redactedReq);
-              return cfg.scanResponse ? redactResponse(response2, cfg.allow) : response2;
+              return cfg.scanResponse ? redactResponse(response2, cfg.allow, skipSet) : response2;
             }
           }
           const response = await inner(_ctx, request);
           if (cfg.mode === "redact" && cfg.scanResponse) {
-            return redactResponse(response, cfg.allow);
+            return redactResponse(response, cfg.allow, skipSet);
           }
           return response;
         }
       });
     }
-    function redactResponse(response, allow) {
+    function redactResponse(response, allow, skip) {
       if (!response || typeof response !== "object") return response;
       const counter = { n: 0 };
       const content = response.content;
       if (content === void 0) return response;
-      const redacted = redactDeep(content, allow, counter);
+      const budget = { remaining: RESPONSE_SCAN_BUDGET, truncated: false };
+      const deadline = createScanDeadline();
+      const redacted = redactDeep(content, allow, counter, skip, budget, deadline);
+      if (deadline.tripped.size > 0) surfaceScanTrips(api, deadline.tripped);
+      if (budget.truncated) {
+        state.responseTruncated = true;
+        api.log.warn(
+          "prompt-firewall: response scan budget exhausted \u2014 part of the response was returned unredacted"
+        );
+        api.metrics.counter("response_scan_truncated", 1);
+      }
       if (counter.n > 0) {
         state.responseRedactions += counter.n;
         api.metrics.counter("response_redactions", counter.n);
@@ -472,6 +646,8 @@ var plugin = {
           mode: cfg.mode,
           scanResponse: cfg.scanResponse,
           patterns: PATTERNS.map((p) => p.kind),
+          skippedPatterns: state.skippedPatterns,
+          responseTruncated: state.responseTruncated,
           counters: {
             invocations: state.invocations,
             requestsWithSecrets: state.requestsWithSecrets,
@@ -505,13 +681,17 @@ var plugin = {
       requestsWithSecrets: state.requestsWithSecrets,
       requestRedactions: state.requestRedactions,
       responseRedactions: state.responseRedactions,
-      blocked: state.blocked
+      blocked: state.blocked,
+      timeoutCount: state.timeoutCount
     };
     state.invocations = 0;
     state.requestsWithSecrets = 0;
     state.requestRedactions = 0;
     state.responseRedactions = 0;
     state.blocked = 0;
+    state.timeoutCount = 0;
+    state.skippedPatterns = [];
+    state.responseTruncated = false;
     state.byKind.clear();
     state.lastDetection = null;
     api.log.info("prompt-firewall: teardown complete", { final });
@@ -533,8 +713,11 @@ var plugin = {
 var prompt_firewall_default = plugin;
 export {
   KIND_ALIASES,
+  SCAN_WINDOW_LIMIT,
   prompt_firewall_default as default,
   detectSecrets,
+  detectSecretsGuarded,
   readConfig,
-  redactSecrets
+  redactSecrets,
+  redactSecretsGuarded
 };

package/dist/spec-linker.js

@@ -55,10 +55,10 @@ var OFFICIAL_PLUGIN_NAMES = [
   "notify-hub",
   "changelog-writer",
   "injection-shield",
+  "prompt-firewall",
   "llm-cache",
   "model-router",
   "pr-drafter",
-  "prompt-firewall",
   "auto-escalate",
   "test-coverage-gate",
   "type-gate",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/plugins",
-  "version": "0.308.0",
+  "version": "0.308.1",
   "description": "Official WrongStack collection of focused plugins for code quality, security, observability, planning, and agent coordination",
   "license": "MIT",
   "author": "ECOSTACK TECHNOLOGY OÜ",
@@ -168,6 +168,10 @@
       "types": "./dist/injection-shield.d.ts",
       "import": "./dist/injection-shield.js"
     },
+    "./prompt-firewall": {
+      "types": "./dist/prompt-firewall.d.ts",
+      "import": "./dist/prompt-firewall.js"
+    },
     "./llm-cache": {
       "types": "./dist/llm-cache.d.ts",
       "import": "./dist/llm-cache.js"
@@ -180,10 +184,6 @@
       "types": "./dist/pr-drafter.d.ts",
       "import": "./dist/pr-drafter.js"
     },
-    "./prompt-firewall": {
-      "types": "./dist/prompt-firewall.d.ts",
-      "import": "./dist/prompt-firewall.js"
-    },
     "./auto-escalate": {
       "types": "./dist/auto-escalate.d.ts",
       "import": "./dist/auto-escalate.js"
@@ -303,8 +303,8 @@
     "vitest": "^4.1.10"
   },
   "dependencies": {
-    "@wrongstack/tools": "0.308.0",
-    "@wrongstack/core": "0.308.0"
+    "@wrongstack/core": "0.308.1",
+    "@wrongstack/tools": "0.308.1"
   },
   "scripts": {
     "build": "node ../../scripts/build-package.mjs",