@wrongstack/plugins 0.308.7 → 0.309.1

package/dist/dependency-vulnerability-gate.js

@@ -402,6 +402,7 @@ var state2 = {
   auditsRun: 0,
   blocks: 0,
   warns: 0,
+  belowThresholdWarns: 0,
   errors: 0,
   lastResult: null,
   hookUnregister: null
@@ -449,9 +450,11 @@ function parseAuditJson(jsonString) {
     return null;
   }
   const out = { maxSeverity: null, counts: {}, total: 0 };
-  if (parsed && typeof parsed === "object") {
+  let recognizedShape = false;
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
     const vulnerabilities = parsed["vulnerabilities"];
     if (vulnerabilities && typeof vulnerabilities === "object" && !Array.isArray(vulnerabilities)) {
+      recognizedShape = true;
       for (const entry of Object.values(vulnerabilities)) {
         if (entry && typeof entry === "object") {
           const severity = entry["severity"];
@@ -464,7 +467,8 @@ function parseAuditJson(jsonString) {
     if (out.total === 0) {
       const metadata = parsed["metadata"];
       const metaVulns = metadata && typeof metadata === "object" ? metadata["vulnerabilities"] : void 0;
-      if (metaVulns && typeof metaVulns === "object") {
+      if (metaVulns && typeof metaVulns === "object" && !Array.isArray(metaVulns)) {
+        recognizedShape = true;
         for (const [key, value] of Object.entries(metaVulns)) {
           const count = typeof value === "number" ? value : 0;
           if (count > 0 && SEVERITY_RANK[key] != null) {
@@ -480,6 +484,7 @@ function parseAuditJson(jsonString) {
     }
   }
   if (Array.isArray(parsed)) {
+    recognizedShape = true;
     for (const entry of parsed) {
       if (entry && typeof entry === "object") {
         const severity = entry["severity"];
@@ -489,6 +494,7 @@ function parseAuditJson(jsonString) {
       }
     }
   }
+  if (!recognizedShape) return null;
   return out;
 }
 function exceedsThreshold(report, threshold) {
@@ -598,6 +604,7 @@ var plugin2 = {
     state2.auditsRun = 0;
     state2.blocks = 0;
     state2.warns = 0;
+    state2.belowThresholdWarns = 0;
     state2.errors = 0;
     state2.lastResult = null;
     if (state2.hookUnregister) {
@@ -618,7 +625,13 @@ var plugin2 = {
       const result = await runAudit(cfg);
       if (!result) {
         state2.errors += 1;
-        return;
+        api.metrics.counter("audit_errors");
+        api.log.warn("dependency-vulnerability-gate: audit did not complete; install not vetted", {
+          managerHint: "see dependency_audit_status for counters"
+        });
+        return {
+          additionalContext: "\n\u26A0\uFE0F dependency-vulnerability-gate: the package audit could not be completed (timeout or unreadable output), so these dependencies were NOT checked for known vulnerabilities."
+        };
       }
       state2.auditsRun += 1;
       state2.lastResult = {
@@ -630,6 +643,17 @@ var plugin2 = {
         when: (/* @__PURE__ */ new Date()).toISOString()
       };
       if (!exceedsThreshold(result.report, cfg.severityThreshold)) {
+        if (result.report.total > 0) {
+          state2.belowThresholdWarns += 1;
+          api.metrics.counter("below_threshold_warns");
+          const belowCounts = Object.entries(result.report.counts).filter(([, count]) => count > 0).map(([sev, count]) => `${sev}: ${count}`).join(", ");
+          return {
+            additionalContext: `
+\u2139\uFE0F dependency-vulnerability-gate: ${result.manager} audit found vulnerabilities BELOW the configured threshold (${cfg.severityThreshold}); not blocking.
+  Max severity: ${result.report.maxSeverity}
+  Counts: ${belowCounts || "unknown"}`
+          };
+        }
         return;
       }
       const countsText = Object.entries(result.report.counts).filter(([, count]) => count > 0).map(([sev, count]) => `${sev}: ${count}`).join(", ");
@@ -671,6 +695,7 @@ Review the audit output or adjust the dependency choice.`;
             auditsRun: state2.auditsRun,
             blocks: state2.blocks,
             warns: state2.warns,
+            belowThresholdWarns: state2.belowThresholdWarns,
             errors: state2.errors
           },
           lastResult: state2.lastResult
@@ -697,6 +722,7 @@ Review the audit output or adjust the dependency choice.`;
       auditsRun: state2.auditsRun,
       blocks: state2.blocks,
       warns: state2.warns,
+      belowThresholdWarns: state2.belowThresholdWarns,
       errors: state2.errors
     };
     state2.invocations = 0;
@@ -704,6 +730,7 @@ Review the audit output or adjust the dependency choice.`;
     state2.auditsRun = 0;
     state2.blocks = 0;
     state2.warns = 0;
+    state2.belowThresholdWarns = 0;
     state2.errors = 0;
     state2.lastResult = null;
     api.log.info("dependency-vulnerability-gate: teardown complete", { final });
@@ -718,6 +745,7 @@ Review the audit output or adjust the dependency choice.`;
         auditsRun: state2.auditsRun,
         blocks: state2.blocks,
         warns: state2.warns,
+        belowThresholdWarns: state2.belowThresholdWarns,
         errors: state2.errors
       },
       lastResult: state2.lastResult

package/dist/index.js

@@ -5713,6 +5713,7 @@ var state17 = {
   auditsRun: 0,
   blocks: 0,
   warns: 0,
+  belowThresholdWarns: 0,
   errors: 0,
   lastResult: null,
   hookUnregister: null
@@ -5760,9 +5761,11 @@ function parseAuditJson(jsonString) {
     return null;
   }
   const out = { maxSeverity: null, counts: {}, total: 0 };
-  if (parsed && typeof parsed === "object") {
+  let recognizedShape = false;
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
     const vulnerabilities = parsed["vulnerabilities"];
     if (vulnerabilities && typeof vulnerabilities === "object" && !Array.isArray(vulnerabilities)) {
+      recognizedShape = true;
       for (const entry of Object.values(vulnerabilities)) {
         if (entry && typeof entry === "object") {
           const severity = entry["severity"];
@@ -5775,7 +5778,8 @@ function parseAuditJson(jsonString) {
     if (out.total === 0) {
       const metadata = parsed["metadata"];
       const metaVulns = metadata && typeof metadata === "object" ? metadata["vulnerabilities"] : void 0;
-      if (metaVulns && typeof metaVulns === "object") {
+      if (metaVulns && typeof metaVulns === "object" && !Array.isArray(metaVulns)) {
+        recognizedShape = true;
         for (const [key, value] of Object.entries(metaVulns)) {
           const count = typeof value === "number" ? value : 0;
           if (count > 0 && SEVERITY_RANK[key] != null) {
@@ -5791,6 +5795,7 @@ function parseAuditJson(jsonString) {
     }
   }
   if (Array.isArray(parsed)) {
+    recognizedShape = true;
     for (const entry of parsed) {
       if (entry && typeof entry === "object") {
         const severity = entry["severity"];
@@ -5800,6 +5805,7 @@ function parseAuditJson(jsonString) {
       }
     }
   }
+  if (!recognizedShape) return null;
   return out;
 }
 function exceedsThreshold(report, threshold) {
@@ -5909,6 +5915,7 @@ var plugin18 = {
     state17.auditsRun = 0;
     state17.blocks = 0;
     state17.warns = 0;
+    state17.belowThresholdWarns = 0;
     state17.errors = 0;
     state17.lastResult = null;
     if (state17.hookUnregister) {
@@ -5929,7 +5936,13 @@ var plugin18 = {
       const result = await runAudit(cfg);
       if (!result) {
         state17.errors += 1;
-        return;
+        api.metrics.counter("audit_errors");
+        api.log.warn("dependency-vulnerability-gate: audit did not complete; install not vetted", {
+          managerHint: "see dependency_audit_status for counters"
+        });
+        return {
+          additionalContext: "\n\u26A0\uFE0F dependency-vulnerability-gate: the package audit could not be completed (timeout or unreadable output), so these dependencies were NOT checked for known vulnerabilities."
+        };
       }
       state17.auditsRun += 1;
       state17.lastResult = {
@@ -5941,6 +5954,17 @@ var plugin18 = {
         when: (/* @__PURE__ */ new Date()).toISOString()
       };
       if (!exceedsThreshold(result.report, cfg.severityThreshold)) {
+        if (result.report.total > 0) {
+          state17.belowThresholdWarns += 1;
+          api.metrics.counter("below_threshold_warns");
+          const belowCounts = Object.entries(result.report.counts).filter(([, count]) => count > 0).map(([sev, count]) => `${sev}: ${count}`).join(", ");
+          return {
+            additionalContext: `
+\u2139\uFE0F dependency-vulnerability-gate: ${result.manager} audit found vulnerabilities BELOW the configured threshold (${cfg.severityThreshold}); not blocking.
+  Max severity: ${result.report.maxSeverity}
+  Counts: ${belowCounts || "unknown"}`
+          };
+        }
         return;
       }
       const countsText = Object.entries(result.report.counts).filter(([, count]) => count > 0).map(([sev, count]) => `${sev}: ${count}`).join(", ");
@@ -5982,6 +6006,7 @@ Review the audit output or adjust the dependency choice.`;
             auditsRun: state17.auditsRun,
             blocks: state17.blocks,
             warns: state17.warns,
+            belowThresholdWarns: state17.belowThresholdWarns,
             errors: state17.errors
           },
           lastResult: state17.lastResult
@@ -6008,6 +6033,7 @@ Review the audit output or adjust the dependency choice.`;
       auditsRun: state17.auditsRun,
       blocks: state17.blocks,
       warns: state17.warns,
+      belowThresholdWarns: state17.belowThresholdWarns,
       errors: state17.errors
     };
     state17.invocations = 0;
@@ -6015,6 +6041,7 @@ Review the audit output or adjust the dependency choice.`;
     state17.auditsRun = 0;
     state17.blocks = 0;
     state17.warns = 0;
+    state17.belowThresholdWarns = 0;
     state17.errors = 0;
     state17.lastResult = null;
     api.log.info("dependency-vulnerability-gate: teardown complete", { final });
@@ -6029,6 +6056,7 @@ Review the audit output or adjust the dependency choice.`;
         auditsRun: state17.auditsRun,
         blocks: state17.blocks,
         warns: state17.warns,
+        belowThresholdWarns: state17.belowThresholdWarns,
         errors: state17.errors
       },
       lastResult: state17.lastResult
@@ -13612,7 +13640,7 @@ function stripLauncherAtBoundary(command, launcher, valueTaking) {
   }
   return `${command.slice(0, match.index)}${boundary}${after.slice(consumed).replace(/^\s+/, "")}`;
 }
-var XARGS_OPTIONS = String.raw`(?:\s+(?:(?:-[InLsPjeE]|--(?:arg-file|replace|max-args|max-lines|max-chars|max-procs))\s+[^\s]+|-[^\s]+))*`;
+var XARGS_OPTIONS = String.raw`(?:\s+(?:(?:-[InLsPjeE]|--(?:arg-file|replace|max-args|max-lines|max-chars|max-procs))\s+[^\s-][^\s]*|-[^\s]+))*`;
 var COMMAND_BOUNDARY = String.raw`(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs${XARGS_OPTIONS}\s+)`;
 function commandRecursivelyDeletes(command) {
   const stripped = stripTransparentLaunchers(maskNonExecutingHeredocBodies(command));
@@ -13944,19 +13972,13 @@ function destructiveTargetsAtDepth(command, depth) {
     if (destination) targets.push(destination);
     c = copy.exec(normalizedCommand);
   }
-  const tee = new RegExp(
-    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)`,
-    "gi"
-  );
+  const tee = new RegExp(String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)`, "gi");
   let t = tee.exec(normalizedCommand);
   while (t !== null) {
     if (!tokenIsQuoted(t, t[1] ?? "")) targets.push(...shellArgs(t[2] ?? ""));
     t = tee.exec(normalizedCommand);
   }
-  const dd = new RegExp(
-    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)`,
-    "gi"
-  );
+  const dd = new RegExp(String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)`, "gi");
   let d = dd.exec(normalizedCommand);
   while (d !== null) {
     if (!tokenIsQuoted(d, d[1] ?? "")) {

package/dist/path-guard.js

@@ -505,7 +505,7 @@ function stripLauncherAtBoundary(command, launcher, valueTaking) {
   }
   return `${command.slice(0, match.index)}${boundary}${after.slice(consumed).replace(/^\s+/, "")}`;
 }
-var XARGS_OPTIONS = String.raw`(?:\s+(?:(?:-[InLsPjeE]|--(?:arg-file|replace|max-args|max-lines|max-chars|max-procs))\s+[^\s]+|-[^\s]+))*`;
+var XARGS_OPTIONS = String.raw`(?:\s+(?:(?:-[InLsPjeE]|--(?:arg-file|replace|max-args|max-lines|max-chars|max-procs))\s+[^\s-][^\s]*|-[^\s]+))*`;
 var COMMAND_BOUNDARY = String.raw`(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs${XARGS_OPTIONS}\s+)`;
 function commandRecursivelyDeletes(command) {
   const stripped = stripTransparentLaunchers(maskNonExecutingHeredocBodies(command));
@@ -837,19 +837,13 @@ function destructiveTargetsAtDepth(command, depth) {
     if (destination) targets.push(destination);
     c = copy.exec(normalizedCommand);
   }
-  const tee = new RegExp(
-    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)`,
-    "gi"
-  );
+  const tee = new RegExp(String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)`, "gi");
   let t = tee.exec(normalizedCommand);
   while (t !== null) {
     if (!tokenIsQuoted(t, t[1] ?? "")) targets.push(...shellArgs(t[2] ?? ""));
     t = tee.exec(normalizedCommand);
   }
-  const dd = new RegExp(
-    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)`,
-    "gi"
-  );
+  const dd = new RegExp(String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)`, "gi");
   let d = dd.exec(normalizedCommand);
   while (d !== null) {
     if (!tokenIsQuoted(d, d[1] ?? "")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/plugins",
-  "version": "0.308.7",
+  "version": "0.309.1",
   "description": "Official WrongStack collection of focused plugins for code quality, security, observability, planning, and agent coordination",
   "license": "MIT",
   "author": "ECOSTACK TECHNOLOGY OÜ",
@@ -300,12 +300,12 @@
   "devDependencies": {
     "@types/node": "^26.2.0",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "dependencies": {
-    "@wrongstack/core": "0.308.7",
-    "@wrongstack/tools": "0.308.7",
-    "@wrongstack/plugin-sdk": "0.308.7"
+    "@wrongstack/plugin-sdk": "0.309.1",
+    "@wrongstack/core": "0.309.1",
+    "@wrongstack/tools": "0.309.1"
   },
   "scripts": {
     "build": "node ../../scripts/build-package.mjs",