@wrongstack/plugins 0.308.0 → 0.308.2

package/dist/audit/index.d.ts

@@ -208,6 +208,12 @@ export declare const OFFICIAL_PLUGIN_AUDIT_ENTRIES: readonly [{
     readonly summary: 'Scans tool output (fetched pages, files) for prompt-injection patterns and warns the model that content is data, not instructions';
     readonly defaultState: 'active';
     readonly canDisable: true;
+}, {
+    readonly name: 'prompt-firewall';
+    readonly risk: 'high';
+    readonly summary: 'Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.';
+    readonly defaultState: 'inactive';
+    readonly canDisable: true;
 }, {
     readonly name: 'llm-cache';
     readonly risk: 'medium';
@@ -226,12 +232,6 @@ export declare const OFFICIAL_PLUGIN_AUDIT_ENTRIES: readonly [{
     readonly summary: 'Collects session work (commits, edited files, diff) and drafts a pull-request description';
     readonly defaultState: 'inactive';
     readonly canDisable: true;
-}, {
-    readonly name: 'prompt-firewall';
-    readonly risk: 'high';
-    readonly summary: 'Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.';
-    readonly defaultState: 'inactive';
-    readonly canDisable: true;
 }, {
     readonly name: 'auto-escalate';
     readonly risk: 'medium';

package/dist/audit.js

@@ -245,6 +245,13 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "active",
     canDisable: true
   },
+  {
+    name: "prompt-firewall",
+    risk: "high",
+    summary: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
+    defaultState: "inactive",
+    canDisable: true
+  },
   {
     name: "llm-cache",
     risk: "medium",
@@ -266,13 +273,6 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "inactive",
     canDisable: true
   },
-  {
-    name: "prompt-firewall",
-    risk: "high",
-    summary: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
-    defaultState: "inactive",
-    canDisable: true
-  },
   {
     name: "auto-escalate",
     risk: "medium",

package/dist/factories/index.d.ts

@@ -1,4 +1,4 @@
 import type { Plugin } from '@wrongstack/core/types';
-export declare const OFFICIAL_PLUGIN_SPECIFIERS: readonly ['@wrongstack/plugins/agent-handoff', '@wrongstack/plugins/cost-tracker', '@wrongstack/plugins/file-watcher', '@wrongstack/plugins/git-autocommit', '@wrongstack/plugins/auto-doc', '@wrongstack/plugins/shell-check', '@wrongstack/plugins/cron', '@wrongstack/plugins/template-engine', '@wrongstack/plugins/semver-bump', '@wrongstack/plugins/secret-scanner', '@wrongstack/plugins/todo-tracker', '@wrongstack/plugins/token-budget', '@wrongstack/plugins/lint-gate', '@wrongstack/plugins/branch-guard', '@wrongstack/plugins/diff-summary', '@wrongstack/plugins/commit-validator', '@wrongstack/plugins/format-on-save', '@wrongstack/plugins/test-runner-gate', '@wrongstack/plugins/import-organizer', '@wrongstack/plugins/knowledge-graph', '@wrongstack/plugins/todo-listener', '@wrongstack/plugins/session-recap', '@wrongstack/plugins/spec-linker', '@wrongstack/plugins/loop-breaker', '@wrongstack/plugins/gitignore-guard', '@wrongstack/plugins/path-guard', '@wrongstack/plugins/process-guard', '@wrongstack/plugins/context-pins', '@wrongstack/plugins/checkpoint', '@wrongstack/plugins/error-lens', '@wrongstack/plugins/dep-guard', '@wrongstack/plugins/config-validator', '@wrongstack/plugins/notify-hub', '@wrongstack/plugins/changelog-writer', '@wrongstack/plugins/injection-shield', '@wrongstack/plugins/llm-cache', '@wrongstack/plugins/model-router', '@wrongstack/plugins/pr-drafter', '@wrongstack/plugins/prompt-firewall', '@wrongstack/plugins/auto-escalate', '@wrongstack/plugins/test-coverage-gate', '@wrongstack/plugins/type-gate', '@wrongstack/plugins/token-throttle', '@wrongstack/plugins/plugin-stack-observer', '@wrongstack/plugins/dependency-vulnerability-gate', '@wrongstack/plugins/migration-planner', '@wrongstack/plugins/semantic-search-indexer', '@wrongstack/plugins/auto-i18n-extractor', '@wrongstack/plugins/doc-sync-guard', '@wrongstack/plugins/api-compatibility-gate', '@wrongstack/plugins/performance-regression-gate', '@wrongstack/plugins/test-flake-detector', '@wrongstack/plugins/schema-evolution-guard', '@wrongstack/plugins/license-audit-gate', '@wrongstack/plugins/accessibility-auditor', '@wrongstack/plugins/security-hotspot-scanner', '@wrongstack/plugins/dead-code-detector', '@wrongstack/plugins/duplicate-code-detector', '@wrongstack/plugins/code-metrics', '@wrongstack/plugins/refactor-suggester', '@wrongstack/plugins/test-generator', '@wrongstack/plugins/release-notes-generator', '@wrongstack/plugins/smart-rename', '@wrongstack/plugins/feature-flag-tracker', '@wrongstack/plugins/interface-contract-guard'];
+export declare const OFFICIAL_PLUGIN_SPECIFIERS: readonly ['@wrongstack/plugins/agent-handoff', '@wrongstack/plugins/cost-tracker', '@wrongstack/plugins/file-watcher', '@wrongstack/plugins/git-autocommit', '@wrongstack/plugins/auto-doc', '@wrongstack/plugins/shell-check', '@wrongstack/plugins/cron', '@wrongstack/plugins/template-engine', '@wrongstack/plugins/semver-bump', '@wrongstack/plugins/secret-scanner', '@wrongstack/plugins/todo-tracker', '@wrongstack/plugins/token-budget', '@wrongstack/plugins/lint-gate', '@wrongstack/plugins/branch-guard', '@wrongstack/plugins/diff-summary', '@wrongstack/plugins/commit-validator', '@wrongstack/plugins/format-on-save', '@wrongstack/plugins/test-runner-gate', '@wrongstack/plugins/import-organizer', '@wrongstack/plugins/knowledge-graph', '@wrongstack/plugins/todo-listener', '@wrongstack/plugins/session-recap', '@wrongstack/plugins/spec-linker', '@wrongstack/plugins/loop-breaker', '@wrongstack/plugins/gitignore-guard', '@wrongstack/plugins/path-guard', '@wrongstack/plugins/process-guard', '@wrongstack/plugins/context-pins', '@wrongstack/plugins/checkpoint', '@wrongstack/plugins/error-lens', '@wrongstack/plugins/dep-guard', '@wrongstack/plugins/config-validator', '@wrongstack/plugins/notify-hub', '@wrongstack/plugins/changelog-writer', '@wrongstack/plugins/injection-shield', '@wrongstack/plugins/prompt-firewall', '@wrongstack/plugins/llm-cache', '@wrongstack/plugins/model-router', '@wrongstack/plugins/pr-drafter', '@wrongstack/plugins/auto-escalate', '@wrongstack/plugins/test-coverage-gate', '@wrongstack/plugins/type-gate', '@wrongstack/plugins/token-throttle', '@wrongstack/plugins/plugin-stack-observer', '@wrongstack/plugins/dependency-vulnerability-gate', '@wrongstack/plugins/migration-planner', '@wrongstack/plugins/semantic-search-indexer', '@wrongstack/plugins/auto-i18n-extractor', '@wrongstack/plugins/doc-sync-guard', '@wrongstack/plugins/api-compatibility-gate', '@wrongstack/plugins/performance-regression-gate', '@wrongstack/plugins/test-flake-detector', '@wrongstack/plugins/schema-evolution-guard', '@wrongstack/plugins/license-audit-gate', '@wrongstack/plugins/accessibility-auditor', '@wrongstack/plugins/security-hotspot-scanner', '@wrongstack/plugins/dead-code-detector', '@wrongstack/plugins/duplicate-code-detector', '@wrongstack/plugins/code-metrics', '@wrongstack/plugins/refactor-suggester', '@wrongstack/plugins/test-generator', '@wrongstack/plugins/release-notes-generator', '@wrongstack/plugins/smart-rename', '@wrongstack/plugins/feature-flag-tracker', '@wrongstack/plugins/interface-contract-guard'];
 export declare const OFFICIAL_PLUGIN_FACTORIES: readonly (() => Promise<Plugin>)[];
 //# sourceMappingURL=index.d.ts.map

package/dist/factories.js

@@ -35,10 +35,10 @@ var OFFICIAL_PLUGIN_SPECIFIERS = [
   "@wrongstack/plugins/notify-hub",
   "@wrongstack/plugins/changelog-writer",
   "@wrongstack/plugins/injection-shield",
+  "@wrongstack/plugins/prompt-firewall",
   "@wrongstack/plugins/llm-cache",
   "@wrongstack/plugins/model-router",
   "@wrongstack/plugins/pr-drafter",
-  "@wrongstack/plugins/prompt-firewall",
   "@wrongstack/plugins/auto-escalate",
   "@wrongstack/plugins/test-coverage-gate",
   "@wrongstack/plugins/type-gate",

package/dist/import-organizer.js

@@ -37,6 +37,9 @@ function cachePut(key, value) {
   binCache.set(key, { value, cachedAt: Date.now() });
   return value;
 }
+function clearLocalBinCache() {
+  binCache.clear();
+}
 function resolveNodeBin(packageName, binName, cwd, extraArgs = []) {
   const key = `${packageName}|${binName}|${cwd}`;
   const cached = binCache.get(key);
@@ -450,6 +453,7 @@ ${result.stderr.trim()}`
     });
   },
   teardown(api) {
+    clearLocalBinCache();
     if (state.hookUnregister) {
       try {
         state.hookUnregister();

package/dist/index.js

@@ -10298,6 +10298,7 @@ ${result.stderr.trim()}`
     });
   },
   teardown(api) {
+    clearLocalBinCache();
     if (state25.hookUnregister) {
       try {
         state25.hookUnregister();
@@ -11951,6 +11952,12 @@ var plugin34 = {
   description: "Caches identical provider requests and short-circuits the provider call on a hit (wrapProviderRunner). Opt-in; deterministic-only by default.",
   apiVersion: "^0.1.10",
   capabilities: { tools: true },
+  // Wrap-stack contract (issue #362): ExtensionRegistry composes wrappers
+  // first-registered = outermost, and both dependsOn and optionalDeps load
+  // dependencies first. Declaring prompt-firewall here guarantees the
+  // firewall wraps OUTSIDE this cache even if the manifest order changes —
+  // otherwise a cache hit short-circuits `inner` and bypasses redaction.
+  optionalDeps: ["prompt-firewall"],
   defaultConfig: { ...DEFAULTS28 },
   configSchema: {
     type: "object",
@@ -14263,14 +14270,19 @@ function stripLauncherAtBoundary(command, launcher, valueTaking) {
   }
   return `${command.slice(0, match.index)}${boundary}${after.slice(consumed).replace(/^\s+/, "")}`;
 }
+var XARGS_OPTIONS = String.raw`(?:\s+(?:(?:-[InLsPjeE]|--(?:arg-file|replace|max-args|max-lines|max-chars|max-procs))\s+[^\s]+|-[^\s]+))*`;
+var COMMAND_BOUNDARY = String.raw`(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs${XARGS_OPTIONS}\s+)`;
 function commandRecursivelyDeletes(command) {
   const stripped = stripTransparentLaunchers(maskNonExecutingHeredocBodies(command));
-  if (/(?:^|[;&|\r\n]\s*|\$\(\s*|\(\s*|`\s*)find\b[^;&|)`]*(?:-delete\b|-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)/i.test(
+  if (/(?:^|[;&|\r\n]\s*|\{\s*|\$\(\s*|\(\s*|`\s*)find\b[^;&|)`]*(?:-delete\b|-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)/i.test(
     stripped
   )) {
     return true;
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(rm|rmdir|del|rd|Remove-Item)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(rm|rmdir|del|rd|Remove-Item)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)`,
+    "gi"
+  );
   let match = destructive.exec(stripped);
   while (match !== null) {
     const tool = match[1]?.toLowerCase();
@@ -14487,6 +14499,27 @@ ${remainingCommand}`;
   if (heredoc !== null) maskBody(heredoc.bodyStart, lines.length, heredoc.quoted);
   return lines.join("");
 }
+function stripSubshellClosers(raw) {
+  let result = raw.trimEnd();
+  while (result.endsWith(")")) {
+    if (quoteIsEscaped(result, result.length - 1)) break;
+    let quote = null;
+    let depth = 0;
+    for (let index = 0; index < result.length - 1; index += 1) {
+      const char = result[index];
+      if (isQuoteBoundary(result, index, quote)) {
+        quote = quote === char ? null : char === "'" ? "'" : '"';
+        continue;
+      }
+      if (quote !== null) continue;
+      if (char === "(" && !quoteIsEscaped(result, index)) depth += 1;
+      else if (char === ")" && !quoteIsEscaped(result, index)) depth -= 1;
+    }
+    if (depth > 0) break;
+    result = result.slice(0, -1).trimEnd();
+  }
+  return result;
+}
 function destructiveTargets(command) {
   return destructiveTargetsAtDepth(command, 0);
 }
@@ -14533,20 +14566,26 @@ function destructiveTargetsAtDepth(command, depth) {
     }
     targets.push(...destructiveTargetsAtDepth(executableBody, depth + 1));
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(?:sudo\s+)?(rm|rmdir|del|rd|Remove-Item|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(rm|rmdir|del|rd|Remove-Item|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)`,
+    "gi"
+  );
   let m = destructive.exec(normalizedCommand);
   while (m !== null) {
     if (!tokenIsQuoted(m, m[1] ?? "")) targets.push(...shellArgs(m[2] ?? ""));
     m = destructive.exec(normalizedCommand);
   }
-  const copy = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(cp|install)\s+([^;&|\r\n]+)/gi;
+  const copy = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(cp|install)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let c = copy.exec(normalizedCommand);
   while (c !== null) {
     if (tokenIsQuoted(c, c[1] ?? "")) {
       c = copy.exec(normalizedCommand);
       continue;
     }
-    const tokens = shellTokens(c[2] ?? "");
+    const tokens = shellTokens(stripSubshellClosers(c[2] ?? ""));
     let destination;
     for (let index = 0; index < tokens.length; index += 1) {
       const token = tokens[index];
@@ -14563,23 +14602,32 @@ function destructiveTargetsAtDepth(command, depth) {
     if (destination) targets.push(destination);
     c = copy.exec(normalizedCommand);
   }
-  const tee = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)/gi;
+  const tee = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let t = tee.exec(normalizedCommand);
   while (t !== null) {
     if (!tokenIsQuoted(t, t[1] ?? "")) targets.push(...shellArgs(t[2] ?? ""));
     t = tee.exec(normalizedCommand);
   }
-  const dd = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)/gi;
+  const dd = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let d = dd.exec(normalizedCommand);
   while (d !== null) {
     if (!tokenIsQuoted(d, d[1] ?? "")) {
       const outputMatch = /(?:^|\s)of=("[^"]*"|'[^']*'|[^\s]+)/i.exec(d[2] ?? "");
-      const output = outputMatch?.[1]?.replace(/^['"]|['"]$/g, "");
+      const output = outputMatch?.[1] ? stripSubshellClosers(outputMatch[1]).replace(/^['"]|['"]$/g, "") : void 0;
       if (output) targets.push(output);
     }
     d = dd.exec(normalizedCommand);
   }
-  const overwrite = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(sed|ln)\s+([^;&|\r\n]+)/gi;
+  const overwrite = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(sed|ln)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let o = overwrite.exec(normalizedCommand);
   while (o !== null) {
     const rawArgs = o[2] ?? "";
@@ -14597,7 +14645,10 @@ function destructiveTargetsAtDepth(command, depth) {
     }
     o = overwrite.exec(normalizedCommand);
   }
-  const xargsPipeline = /\b(?:echo|printf)\s+([^|]+)\|\s*xargs(?:\s+-[^\s]+)*\s+(?:sudo\s+)?(?:rm|rmdir|del|unlink|truncate|shred)\b/gi;
+  const xargsPipeline = new RegExp(
+    String.raw`\b(?:echo|printf)\s+([^|]+)\|\s*xargs${XARGS_OPTIONS}\s+(?:sudo\s+)?(?:rm|rmdir|del|unlink|truncate|shred)\b`,
+    "gi"
+  );
   let x = xargsPipeline.exec(normalizedCommand);
   while (x !== null) {
     if (!tokenIsQuoted(x, "xargs")) targets.push(...shellArgs(x[1] ?? ""));
@@ -14714,7 +14765,7 @@ function destructiveTargetsAtDepth(command, depth) {
         targets.push(gitTarget("."));
     }
   }
-  const findDelete = /(?:^|[;&|\r\n]\s*|\$\(\s*|\(\s*|`\s*)find\b([^;&|)`]*(?:\s-delete(?:\s|$)|\s-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)[^;&|)`]*)/gi;
+  const findDelete = /(?:^|[;&|\r\n]\s*|\{\s*|\$\(\s*|\(\s*|`\s*)find\b([^;&|)`]*(?:\s-delete(?:[\s;})]|$)|\s-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)[^;&|)`]*)/gi;
   let f = findDelete.exec(normalizedCommand);
   while (f !== null) {
     const tokens = shellTokens(f[1] ?? "");
@@ -15147,10 +15198,19 @@ var plugin39 = {
       const ti = input.toolInput ?? {};
       const command = typeof ti["command"] === "string" ? ti["command"] : "";
       const commandArgs = Array.isArray(ti["args"]) ? ti["args"].filter((arg) => typeof arg === "string") : [];
-      const commandForInspection = [
-        command,
-        ...commandArgs.map((arg) => /^[\w./:@%+=,-]+$/.test(arg) ? arg : JSON.stringify(arg))
-      ].join(" ");
+      const serializeArgForInspection = (arg) => {
+        if (/^[\w./:@%+=,-]+$/.test(arg)) return arg;
+        const assignment = /^([A-Za-z_]\w*)=(.+)$/.exec(arg);
+        const key = assignment?.[1];
+        const value = assignment?.[2];
+        if (key !== void 0 && value !== void 0) {
+          return `${key}="${value.replaceAll('"', "")}"`;
+        }
+        return JSON.stringify(arg);
+      };
+      const commandForInspection = [command, ...commandArgs.map(serializeArgForInspection)].join(
+        " "
+      );
       if (command && executesShell({
         toolName: input.toolName,
         toolInput: ti,
@@ -16226,6 +16286,9 @@ var plugin42 = {
 };
 var process_guard_default = plugin42;
 
+// src/prompt-firewall/index.ts
+import { performance as performance2 } from "node:perf_hooks";
+
 // src/runtime/credential-patterns.ts
 var CREDENTIAL_PATTERNS = [
   // LLM provider keys
@@ -16397,32 +16460,156 @@ var PATTERNS2 = [
   })),
   ...EXTRA_PATTERNS
 ];
-function detectSecrets(text, allow) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const p of PATTERNS2) {
-    p.re.lastIndex = 0;
-    let m = p.re.exec(text);
+var PATTERN_BUDGET_MS = 250;
+var GUARD_PROBE_LENGTH = 1e5;
+var GUARD_PROBE_OVERLAP = 4096;
+var SCAN_PASS_BUDGET_MS = 250;
+function createScanDeadline() {
+  return { deadline: performance2.now() + SCAN_PASS_BUDGET_MS, tripped: /* @__PURE__ */ new Set() };
+}
+var SCAN_WINDOW_STRIDE = GUARD_PROBE_LENGTH - GUARD_PROBE_OVERLAP;
+var SCAN_WINDOW_TAIL = 65536;
+var SCAN_WINDOW_LIMIT = GUARD_PROBE_LENGTH + SCAN_WINDOW_TAIL;
+var SCAN_MAX_GROWTH = 16;
+function growMatch(re, p, text, absStart, deadline) {
+  let size = GUARD_PROBE_LENGTH;
+  for (let grown = 0; grown < SCAN_MAX_GROWTH; grown++) {
+    if (deadline && performance2.now() > deadline.deadline) {
+      deadline.tripped.add(p.kind);
+      return null;
+    }
+    const extEnd = Math.min(text.length, absStart + size);
+    const ext = text.slice(absStart, extEnd);
+    re.lastIndex = 0;
+    const em = re.exec(ext);
+    if (!em || em.index !== 0 || em[0].length === 0) return null;
+    const end = absStart + em[0].length;
+    if (end < extEnd || extEnd === text.length) {
+      return { start: absStart, end, matched: em[0] };
+    }
+    size *= 2;
+  }
+  return null;
+}
+function* execWindowed(p, text, deadline) {
+  const re = new RegExp(p.re.source, p.re.flags);
+  let acceptLo = 0;
+  let highWater = 0;
+  for (let window = 0; acceptLo < text.length; window++) {
+    const sliceStart = window === 0 ? 0 : acceptLo - GUARD_PROBE_OVERLAP;
+    const sliceEnd = Math.min(text.length, sliceStart + SCAN_WINDOW_LIMIT);
+    const slice = text.slice(sliceStart, sliceEnd);
+    const acceptHi = Math.min(acceptLo + SCAN_WINDOW_STRIDE, text.length);
+    re.lastIndex = 0;
+    let m = re.exec(slice);
     while (m !== null) {
+      if (deadline && performance2.now() > deadline.deadline) {
+        deadline.tripped.add(p.kind);
+        return;
+      }
       const matched = m[0];
-      if (!allow.some((a) => a.test(matched))) {
-        counts.set(p.kind, (counts.get(p.kind) ?? 0) + 1);
+      if (matched.length === 0) {
+        re.lastIndex += 1;
+        m = re.exec(slice);
+        continue;
       }
-      m = p.re.exec(text);
+      const absStart = sliceStart + m.index;
+      const absEnd = absStart + matched.length;
+      if (absStart >= acceptLo && absStart < acceptHi) {
+        let final = { start: absStart, end: absEnd, matched };
+        if (absEnd === sliceEnd && sliceEnd < text.length) {
+          final = growMatch(re, p, text, absStart, deadline) ?? final;
+          re.lastIndex = m.index + final.matched.length;
+        }
+        if (final.start >= highWater) {
+          highWater = Math.max(highWater, final.end);
+          yield final;
+        }
+      }
+      m = re.exec(slice);
     }
+    acceptLo += SCAN_WINDOW_STRIDE;
   }
-  return [...counts.entries()].map(([kind, count]) => ({ kind, count }));
 }
-function redactSecrets(text, allow) {
+function countMatches(p, text, allow, counts, deadline) {
+  if (deadline && performance2.now() > deadline.deadline) {
+    deadline.tripped.add(p.kind);
+    return;
+  }
+  for (const m of execWindowed(p, text, deadline)) {
+    if (!allow.some((a) => a.test(m.matched))) {
+      counts.set(p.kind, (counts.get(p.kind) ?? 0) + 1);
+    }
+  }
+}
+function replacePattern(p, text, allow, redactions, deadline) {
+  if (deadline && performance2.now() > deadline.deadline) {
+    deadline.tripped.add(p.kind);
+    return text;
+  }
+  let out = "";
+  let copied = 0;
+  for (const m of execWindowed(p, text, deadline)) {
+    out += text.slice(copied, m.start);
+    if (allow.some((a) => a.test(m.matched))) {
+      out += m.matched;
+    } else {
+      redactions.n += 1;
+      out += `[REDACTED:${p.kind}]`;
+    }
+    copied = m.end;
+  }
+  return out + text.slice(copied);
+}
+function redactSecrets(text, allow, deadline) {
+  const redactions = { n: 0 };
   let out = text;
-  let redactions = 0;
-  for (const p of PATTERNS2) {
-    out = out.replace(new RegExp(p.re.source, p.re.flags), (match) => {
-      if (allow.some((a) => a.test(match))) return match;
-      redactions += 1;
-      return `[REDACTED:${p.kind}]`;
+  for (const p of PATTERNS2) out = replacePattern(p, out, allow, redactions, deadline);
+  return { text: out, redactions: redactions.n };
+}
+var DISTINCT_PATTERN_KINDS = new Set(PATTERNS2.map((p) => p.kind)).size;
+async function probeTimedOutPatterns(text) {
+  const timedOut = /* @__PURE__ */ new Set();
+  if (text.length === 0) return timedOut;
+  const probeWindow = (offset) => {
+    const window = text.slice(offset, offset + GUARD_PROBE_LENGTH);
+    const combined = new RegExp(PATTERNS2.map((p) => `(${p.re.source})`).join("|"), "gi");
+    return withReDoSGuard(combined, window, PATTERN_BUDGET_MS).then(async (combinedResult) => {
+      if (!combinedResult.timedOut) return;
+      for (const p of PATTERNS2) {
+        if (timedOut.has(p.kind)) continue;
+        const result = await withReDoSGuard(p.re, window, PATTERN_BUDGET_MS);
+        if (result.timedOut) timedOut.add(p.kind);
+      }
     });
+  };
+  const stride = GUARD_PROBE_LENGTH - GUARD_PROBE_OVERLAP;
+  for (let offset = 0; offset < text.length; offset += stride) {
+    if (timedOut.size >= DISTINCT_PATTERN_KINDS) break;
+    await probeWindow(offset);
+  }
+  return timedOut;
+}
+async function detectSecretsGuarded(text, allow) {
+  const timedOut = await probeTimedOutPatterns(text);
+  const deadline = createScanDeadline();
+  const counts = /* @__PURE__ */ new Map();
+  for (const p of PATTERNS2) {
+    if (!timedOut.has(p.kind)) countMatches(p, text, allow, counts, deadline);
   }
-  return { text: out, redactions };
+  const allSkipped = /* @__PURE__ */ new Set([...timedOut, ...deadline.tripped]);
+  return {
+    detections: [...counts.entries()].map(([kind, count]) => ({ kind, count })),
+    skipped: [...allSkipped].sort().map((kind) => ({ kind, reason: "redos-timeout" }))
+  };
+}
+function redactSecretsGuarded(text, allow, skip, deadline) {
+  const redactions = { n: 0 };
+  let out = text;
+  for (const p of PATTERNS2) {
+    if (!skip.has(p.kind)) out = replacePattern(p, out, allow, redactions, deadline);
+  }
+  return { text: out, redactions: redactions.n };
 }
 function collectText(request) {
   const parts = [];
@@ -16436,17 +16623,27 @@ function collectText(request) {
   walk(request["messages"]);
   return parts.join("\n");
 }
-function redactDeep(value, allow, counter) {
+var RESPONSE_SCAN_BUDGET = 1e6;
+function redactDeep(value, allow, counter, skip, budget, deadline) {
   if (typeof value === "string") {
-    const { text, redactions } = redactSecrets(value, allow);
+    if (budget) {
+      if (value.length > budget.remaining) {
+        budget.remaining = 0;
+        budget.truncated = true;
+        return value;
+      }
+      budget.remaining -= value.length;
+    }
+    const { text, redactions } = skip ? redactSecretsGuarded(value, allow, skip, deadline) : redactSecrets(value, allow, deadline);
     counter.n += redactions;
     return text;
   }
-  if (Array.isArray(value)) return value.map((v) => redactDeep(v, allow, counter));
+  if (Array.isArray(value))
+    return value.map((v) => redactDeep(v, allow, counter, skip, budget, deadline));
   if (value && typeof value === "object") {
     const out = {};
     for (const [k, v] of Object.entries(value)) {
-      out[k] = redactDeep(v, allow, counter);
+      out[k] = redactDeep(v, allow, counter, skip, budget, deadline);
     }
     return out;
   }
@@ -16482,16 +16679,33 @@ var state40 = {
   responseRedactions: 0,
   blocked: 0,
   timeoutCount: 0,
+  skippedPatterns: [],
+  responseTruncated: false,
   byKind: /* @__PURE__ */ new Map(),
   lastDetection: null,
   extensionUnregister: null
 };
+function surfaceScanTrips(api, tripped) {
+  for (const kind of tripped) {
+    if (!state40.skippedPatterns.includes(kind)) state40.skippedPatterns.push(kind);
+  }
+  state40.timeoutCount += 1;
+  api.metrics.counter("redos_skips", 1);
+  api.log.warn("prompt-firewall: scan-pass budget exceeded \u2014 patterns skipped mid-pass (issue #370)", {
+    skipped: [...tripped]
+  });
+}
 var plugin43 = {
   name: "prompt-firewall",
   version: "0.1.0",
   description: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
   apiVersion: "^0.1.10",
   capabilities: { tools: true },
+  // Wrap-stack contract (issue #362): ExtensionRegistry composes wrappers
+  // first-registered = outermost. The manifest lists this plugin before
+  // llm-cache, and llm-cache declares this plugin in optionalDeps, so the
+  // firewall is the outer wrap: every request is scanned/redacted before
+  // llm-cache can fingerprint or cache it.
   defaultConfig: { enabled: false, mode: "redact", scanResponse: true, allow: [] },
   configSchema: {
     type: "object",
@@ -16527,6 +16741,8 @@ var plugin43 = {
     state40.responseRedactions = 0;
     state40.blocked = 0;
     state40.timeoutCount = 0;
+    state40.skippedPatterns = [];
+    state40.responseTruncated = false;
     state40.byKind.clear();
     state40.lastDetection = null;
     if (state40.extensionUnregister) {
@@ -16550,15 +16766,16 @@ var plugin43 = {
           const req = request ?? {};
           state40.invocations += 1;
           const requestText = collectText(req);
-          for (const extra of EXTRA_PATTERNS) {
-            const guarded = await withReDoSGuard(extra.re, requestText, 250, {
-              onTimeout: () => {
-                state40.timeoutCount += 1;
-              }
+          const { detections, skipped } = await detectSecretsGuarded(requestText, cfg.allow);
+          state40.skippedPatterns = skipped.map((s) => s.kind);
+          if (skipped.length > 0) {
+            state40.timeoutCount += 1;
+            api.log.warn("prompt-firewall: ReDoS budget exceeded, patterns skipped", {
+              skipped: state40.skippedPatterns
             });
-            if (guarded.timedOut) break;
+            api.metrics.counter("redos_skips", 1);
           }
-          const detections = detectSecrets(requestText, cfg.allow);
+          const skipSet = new Set(state40.skippedPatterns);
           if (detections.length > 0) {
             state40.requestsWithSecrets += 1;
             for (const d of detections) {
@@ -16577,27 +16794,39 @@ var plugin43 = {
             }
             if (cfg.mode === "redact") {
               const counter = { n: 0 };
-              const redactedReq = redactDeep(req, cfg.allow, counter);
+              const deadline = createScanDeadline();
+              const redactedReq = redactDeep(req, cfg.allow, counter, skipSet, void 0, deadline);
               state40.requestRedactions += counter.n;
               api.metrics.counter("request_redactions", counter.n);
+              if (deadline.tripped.size > 0) surfaceScanTrips(api, deadline.tripped);
               const response2 = await inner(_ctx, redactedReq);
-              return cfg.scanResponse ? redactResponse(response2, cfg.allow) : response2;
+              return cfg.scanResponse ? redactResponse(response2, cfg.allow, skipSet) : response2;
             }
           }
           const response = await inner(_ctx, request);
           if (cfg.mode === "redact" && cfg.scanResponse) {
-            return redactResponse(response, cfg.allow);
+            return redactResponse(response, cfg.allow, skipSet);
           }
           return response;
         }
       });
     }
-    function redactResponse(response, allow) {
+    function redactResponse(response, allow, skip) {
       if (!response || typeof response !== "object") return response;
       const counter = { n: 0 };
       const content = response.content;
       if (content === void 0) return response;
-      const redacted = redactDeep(content, allow, counter);
+      const budget = { remaining: RESPONSE_SCAN_BUDGET, truncated: false };
+      const deadline = createScanDeadline();
+      const redacted = redactDeep(content, allow, counter, skip, budget, deadline);
+      if (deadline.tripped.size > 0) surfaceScanTrips(api, deadline.tripped);
+      if (budget.truncated) {
+        state40.responseTruncated = true;
+        api.log.warn(
+          "prompt-firewall: response scan budget exhausted \u2014 part of the response was returned unredacted"
+        );
+        api.metrics.counter("response_scan_truncated", 1);
+      }
       if (counter.n > 0) {
         state40.responseRedactions += counter.n;
         api.metrics.counter("response_redactions", counter.n);
@@ -16623,6 +16852,8 @@ var plugin43 = {
           mode: cfg.mode,
           scanResponse: cfg.scanResponse,
           patterns: PATTERNS2.map((p) => p.kind),
+          skippedPatterns: state40.skippedPatterns,
+          responseTruncated: state40.responseTruncated,
           counters: {
             invocations: state40.invocations,
             requestsWithSecrets: state40.requestsWithSecrets,
@@ -16656,13 +16887,17 @@ var plugin43 = {
       requestsWithSecrets: state40.requestsWithSecrets,
       requestRedactions: state40.requestRedactions,
       responseRedactions: state40.responseRedactions,
-      blocked: state40.blocked
+      blocked: state40.blocked,
+      timeoutCount: state40.timeoutCount
     };
     state40.invocations = 0;
     state40.requestsWithSecrets = 0;
     state40.requestRedactions = 0;
     state40.responseRedactions = 0;
     state40.blocked = 0;
+    state40.timeoutCount = 0;
+    state40.skippedPatterns = [];
+    state40.responseTruncated = false;
     state40.byKind.clear();
     state40.lastDetection = null;
     api.log.info("prompt-firewall: teardown complete", { final });
@@ -20629,10 +20864,10 @@ var OFFICIAL_PLUGIN_NAMES = [
   "notify-hub",
   "changelog-writer",
   "injection-shield",
+  "prompt-firewall",
   "llm-cache",
   "model-router",
   "pr-drafter",
-  "prompt-firewall",
   "auto-escalate",
   "test-coverage-gate",
   "type-gate",

package/dist/llm-cache.js

@@ -82,6 +82,12 @@ var plugin = {
   description: "Caches identical provider requests and short-circuits the provider call on a hit (wrapProviderRunner). Opt-in; deterministic-only by default.",
   apiVersion: "^0.1.10",
   capabilities: { tools: true },
+  // Wrap-stack contract (issue #362): ExtensionRegistry composes wrappers
+  // first-registered = outermost, and both dependsOn and optionalDeps load
+  // dependencies first. Declaring prompt-firewall here guarantees the
+  // firewall wraps OUTSIDE this cache even if the manifest order changes —
+  // otherwise a cache hit short-circuits `inner` and bypasses redaction.
+  optionalDeps: ["prompt-firewall"],
   defaultConfig: { ...DEFAULTS },
   configSchema: {
     type: "object",