@wrongstack/plugins 0.309.0 → 0.310.0

package/dist/cost-tracker/index.d.ts

@@ -45,6 +45,8 @@ export interface ModelPricing {
     input: number;
     /** Cost per 1M output (completion) tokens in USD. */
     output: number;
+    /** Cost per 1M prompt-cache read tokens; input rate is the safe fallback. */
+    cacheRead?: number | undefined;
 }
 declare const plugin: Plugin;
 export default plugin;

package/dist/cost-tracker.js

@@ -12,13 +12,15 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 
+// src/cost-tracker/index.ts
+import { expectDefined } from "@wrongstack/core/utils";
+
 // src/runtime/index.ts
 var runtime_exports = {};
 __reExport(runtime_exports, runtime_star);
 import * as runtime_star from "@wrongstack/plugin-sdk/runtime";
 
 // src/cost-tracker/index.ts
-import { expectDefined } from "@wrongstack/core/utils";
 var API_VERSION = "^0.1.10";
 var PRICING = {
   "gpt-4o": { input: 5, output: 15 },
@@ -48,14 +50,14 @@ function readCostTrackerConfig(raw) {
   };
 }
 var modelKeyCache = new runtime_exports.BoundedMap({ max: 256 });
-function estimateCost(model, promptTokens, completionTokens) {
+function estimateCost(model, freshTokens, completionTokens, cachedTokens = 0) {
   let key = modelKeyCache.get(model);
   if (!key) {
     key = model.toLowerCase();
     modelKeyCache.set(model, key);
   }
   const pricing = pricingOverrides[key] ?? bundledFromRegistry[key] ?? PRICING[key] ?? DEFAULT_PRICING;
-  const inputCost = promptTokens / 1e6 * pricing.input;
+  const inputCost = freshTokens / 1e6 * pricing.input + cachedTokens / 1e6 * (pricing.cacheRead ?? pricing.input);
   const outputCost = completionTokens / 1e6 * pricing.output;
   return inputCost + outputCost;
 }
@@ -89,12 +91,17 @@ var plugin = {
       },
       pricingOverrides: {
         type: "object",
-        description: "Per-model pricing overrides in USD per 1M tokens. Keys are lowercased model names; values are { input, output }. Takes precedence over the bundled PRICING table.",
+        description: "Per-model pricing overrides in USD per 1M tokens. Values are { input, output, cacheRead? }.",
         additionalProperties: {
           type: "object",
           properties: {
             input: { type: "number", minimum: 0, description: "Cost per 1M input tokens in USD" },
-            output: { type: "number", minimum: 0, description: "Cost per 1M output tokens in USD" }
+            output: { type: "number", minimum: 0, description: "Cost per 1M output tokens in USD" },
+            cacheRead: {
+              type: "number",
+              minimum: 0,
+              description: "Cost per 1M prompt-cache read tokens in USD"
+            }
           },
           required: ["input", "output"],
           additionalProperties: false
@@ -127,7 +134,12 @@ var plugin = {
         const input = v["input"];
         const output = v["output"];
         if (typeof input !== "number" || typeof output !== "number") continue;
-        pricingOverrides[model.toLowerCase()] = { input, output };
+        const cacheRead = v["cacheRead"];
+        pricingOverrides[model.toLowerCase()] = {
+          input,
+          output,
+          ...typeof cacheRead === "number" ? { cacheRead } : {}
+        };
       }
     }
     if (api.modelsRegistry) {
@@ -142,7 +154,8 @@ var plugin = {
             if (cost && typeof cost.input === "number" && typeof cost.output === "number") {
               bundledFromRegistry[modelId.toLowerCase()] = {
                 input: cost.input,
-                output: cost.output
+                output: cost.output,
+                ...typeof cost.cache_read === "number" ? { cacheRead: cost.cache_read } : {}
               };
               hydrated += 1;
             }
@@ -169,10 +182,12 @@ var plugin = {
     api.onEvent("provider.response", async (payload) => {
       const usage = payload.usage;
       const model = payload.ctx?.model ?? "unknown";
-      const promptTokens = usage.input ?? 0;
+      const cachedTokens = usage.cacheRead ?? 0;
+      const freshTokens = (usage.input ?? 0) + (usage.cacheWrite ?? 0);
+      const promptTokens = freshTokens + cachedTokens;
       const completionTokens = usage.output ?? 0;
       const totalTokens = promptTokens + completionTokens;
-      const costUsd = estimateCost(model, promptTokens, completionTokens);
+      const costUsd = estimateCost(model, freshTokens, completionTokens, cachedTokens);
       const record = {
         promptTokens,
         completionTokens,

package/dist/dependency-vulnerability-gate.js

@@ -402,6 +402,7 @@ var state2 = {
   auditsRun: 0,
   blocks: 0,
   warns: 0,
+  belowThresholdWarns: 0,
   errors: 0,
   lastResult: null,
   hookUnregister: null
@@ -449,9 +450,11 @@ function parseAuditJson(jsonString) {
     return null;
   }
   const out = { maxSeverity: null, counts: {}, total: 0 };
-  if (parsed && typeof parsed === "object") {
+  let recognizedShape = false;
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
     const vulnerabilities = parsed["vulnerabilities"];
     if (vulnerabilities && typeof vulnerabilities === "object" && !Array.isArray(vulnerabilities)) {
+      recognizedShape = true;
       for (const entry of Object.values(vulnerabilities)) {
         if (entry && typeof entry === "object") {
           const severity = entry["severity"];
@@ -464,7 +467,8 @@ function parseAuditJson(jsonString) {
     if (out.total === 0) {
       const metadata = parsed["metadata"];
       const metaVulns = metadata && typeof metadata === "object" ? metadata["vulnerabilities"] : void 0;
-      if (metaVulns && typeof metaVulns === "object") {
+      if (metaVulns && typeof metaVulns === "object" && !Array.isArray(metaVulns)) {
+        recognizedShape = true;
         for (const [key, value] of Object.entries(metaVulns)) {
           const count = typeof value === "number" ? value : 0;
           if (count > 0 && SEVERITY_RANK[key] != null) {
@@ -480,6 +484,7 @@ function parseAuditJson(jsonString) {
     }
   }
   if (Array.isArray(parsed)) {
+    recognizedShape = true;
     for (const entry of parsed) {
       if (entry && typeof entry === "object") {
         const severity = entry["severity"];
@@ -489,6 +494,7 @@ function parseAuditJson(jsonString) {
       }
     }
   }
+  if (!recognizedShape) return null;
   return out;
 }
 function exceedsThreshold(report, threshold) {
@@ -598,6 +604,7 @@ var plugin2 = {
     state2.auditsRun = 0;
     state2.blocks = 0;
     state2.warns = 0;
+    state2.belowThresholdWarns = 0;
     state2.errors = 0;
     state2.lastResult = null;
     if (state2.hookUnregister) {
@@ -618,7 +625,13 @@ var plugin2 = {
       const result = await runAudit(cfg);
       if (!result) {
         state2.errors += 1;
-        return;
+        api.metrics.counter("audit_errors");
+        api.log.warn("dependency-vulnerability-gate: audit did not complete; install not vetted", {
+          managerHint: "see dependency_audit_status for counters"
+        });
+        return {
+          additionalContext: "\n\u26A0\uFE0F dependency-vulnerability-gate: the package audit could not be completed (timeout or unreadable output), so these dependencies were NOT checked for known vulnerabilities."
+        };
       }
       state2.auditsRun += 1;
       state2.lastResult = {
@@ -630,6 +643,17 @@ var plugin2 = {
         when: (/* @__PURE__ */ new Date()).toISOString()
       };
       if (!exceedsThreshold(result.report, cfg.severityThreshold)) {
+        if (result.report.total > 0) {
+          state2.belowThresholdWarns += 1;
+          api.metrics.counter("below_threshold_warns");
+          const belowCounts = Object.entries(result.report.counts).filter(([, count]) => count > 0).map(([sev, count]) => `${sev}: ${count}`).join(", ");
+          return {
+            additionalContext: `
+\u2139\uFE0F dependency-vulnerability-gate: ${result.manager} audit found vulnerabilities BELOW the configured threshold (${cfg.severityThreshold}); not blocking.
+  Max severity: ${result.report.maxSeverity}
+  Counts: ${belowCounts || "unknown"}`
+          };
+        }
         return;
       }
       const countsText = Object.entries(result.report.counts).filter(([, count]) => count > 0).map(([sev, count]) => `${sev}: ${count}`).join(", ");
@@ -671,6 +695,7 @@ Review the audit output or adjust the dependency choice.`;
             auditsRun: state2.auditsRun,
             blocks: state2.blocks,
             warns: state2.warns,
+            belowThresholdWarns: state2.belowThresholdWarns,
             errors: state2.errors
           },
           lastResult: state2.lastResult
@@ -697,6 +722,7 @@ Review the audit output or adjust the dependency choice.`;
       auditsRun: state2.auditsRun,
       blocks: state2.blocks,
       warns: state2.warns,
+      belowThresholdWarns: state2.belowThresholdWarns,
       errors: state2.errors
     };
     state2.invocations = 0;
@@ -704,6 +730,7 @@ Review the audit output or adjust the dependency choice.`;
     state2.auditsRun = 0;
     state2.blocks = 0;
     state2.warns = 0;
+    state2.belowThresholdWarns = 0;
     state2.errors = 0;
     state2.lastResult = null;
     api.log.info("dependency-vulnerability-gate: teardown complete", { final });
@@ -718,6 +745,7 @@ Review the audit output or adjust the dependency choice.`;
         auditsRun: state2.auditsRun,
         blocks: state2.blocks,
         warns: state2.warns,
+        belowThresholdWarns: state2.belowThresholdWarns,
         errors: state2.errors
       },
       lastResult: state2.lastResult

package/dist/index.js

@@ -4370,14 +4370,14 @@ function readCostTrackerConfig(raw) {
   };
 }
 var modelKeyCache = new runtime_exports.BoundedMap({ max: 256 });
-function estimateCost(model, promptTokens, completionTokens) {
+function estimateCost(model, freshTokens, completionTokens, cachedTokens = 0) {
   let key = modelKeyCache.get(model);
   if (!key) {
     key = model.toLowerCase();
     modelKeyCache.set(model, key);
   }
   const pricing = pricingOverrides[key] ?? bundledFromRegistry[key] ?? PRICING[key] ?? DEFAULT_PRICING;
-  const inputCost = promptTokens / 1e6 * pricing.input;
+  const inputCost = freshTokens / 1e6 * pricing.input + cachedTokens / 1e6 * (pricing.cacheRead ?? pricing.input);
   const outputCost = completionTokens / 1e6 * pricing.output;
   return inputCost + outputCost;
 }
@@ -4411,12 +4411,17 @@ var plugin14 = {
       },
       pricingOverrides: {
         type: "object",
-        description: "Per-model pricing overrides in USD per 1M tokens. Keys are lowercased model names; values are { input, output }. Takes precedence over the bundled PRICING table.",
+        description: "Per-model pricing overrides in USD per 1M tokens. Values are { input, output, cacheRead? }.",
         additionalProperties: {
           type: "object",
           properties: {
             input: { type: "number", minimum: 0, description: "Cost per 1M input tokens in USD" },
-            output: { type: "number", minimum: 0, description: "Cost per 1M output tokens in USD" }
+            output: { type: "number", minimum: 0, description: "Cost per 1M output tokens in USD" },
+            cacheRead: {
+              type: "number",
+              minimum: 0,
+              description: "Cost per 1M prompt-cache read tokens in USD"
+            }
           },
           required: ["input", "output"],
           additionalProperties: false
@@ -4449,7 +4454,12 @@ var plugin14 = {
         const input = v["input"];
         const output = v["output"];
         if (typeof input !== "number" || typeof output !== "number") continue;
-        pricingOverrides[model.toLowerCase()] = { input, output };
+        const cacheRead = v["cacheRead"];
+        pricingOverrides[model.toLowerCase()] = {
+          input,
+          output,
+          ...typeof cacheRead === "number" ? { cacheRead } : {}
+        };
       }
     }
     if (api.modelsRegistry) {
@@ -4464,7 +4474,8 @@ var plugin14 = {
             if (cost && typeof cost.input === "number" && typeof cost.output === "number") {
               bundledFromRegistry[modelId.toLowerCase()] = {
                 input: cost.input,
-                output: cost.output
+                output: cost.output,
+                ...typeof cost.cache_read === "number" ? { cacheRead: cost.cache_read } : {}
               };
               hydrated += 1;
             }
@@ -4491,10 +4502,12 @@ var plugin14 = {
     api.onEvent("provider.response", async (payload) => {
       const usage = payload.usage;
       const model = payload.ctx?.model ?? "unknown";
-      const promptTokens = usage.input ?? 0;
+      const cachedTokens = usage.cacheRead ?? 0;
+      const freshTokens = (usage.input ?? 0) + (usage.cacheWrite ?? 0);
+      const promptTokens = freshTokens + cachedTokens;
       const completionTokens = usage.output ?? 0;
       const totalTokens = promptTokens + completionTokens;
-      const costUsd = estimateCost(model, promptTokens, completionTokens);
+      const costUsd = estimateCost(model, freshTokens, completionTokens, cachedTokens);
       const record = {
         promptTokens,
         completionTokens,
@@ -5713,6 +5726,7 @@ var state17 = {
   auditsRun: 0,
   blocks: 0,
   warns: 0,
+  belowThresholdWarns: 0,
   errors: 0,
   lastResult: null,
   hookUnregister: null
@@ -5760,9 +5774,11 @@ function parseAuditJson(jsonString) {
     return null;
   }
   const out = { maxSeverity: null, counts: {}, total: 0 };
-  if (parsed && typeof parsed === "object") {
+  let recognizedShape = false;
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
     const vulnerabilities = parsed["vulnerabilities"];
     if (vulnerabilities && typeof vulnerabilities === "object" && !Array.isArray(vulnerabilities)) {
+      recognizedShape = true;
       for (const entry of Object.values(vulnerabilities)) {
         if (entry && typeof entry === "object") {
           const severity = entry["severity"];
@@ -5775,7 +5791,8 @@ function parseAuditJson(jsonString) {
     if (out.total === 0) {
       const metadata = parsed["metadata"];
       const metaVulns = metadata && typeof metadata === "object" ? metadata["vulnerabilities"] : void 0;
-      if (metaVulns && typeof metaVulns === "object") {
+      if (metaVulns && typeof metaVulns === "object" && !Array.isArray(metaVulns)) {
+        recognizedShape = true;
         for (const [key, value] of Object.entries(metaVulns)) {
           const count = typeof value === "number" ? value : 0;
           if (count > 0 && SEVERITY_RANK[key] != null) {
@@ -5791,6 +5808,7 @@ function parseAuditJson(jsonString) {
     }
   }
   if (Array.isArray(parsed)) {
+    recognizedShape = true;
     for (const entry of parsed) {
       if (entry && typeof entry === "object") {
         const severity = entry["severity"];
@@ -5800,6 +5818,7 @@ function parseAuditJson(jsonString) {
       }
     }
   }
+  if (!recognizedShape) return null;
   return out;
 }
 function exceedsThreshold(report, threshold) {
@@ -5909,6 +5928,7 @@ var plugin18 = {
     state17.auditsRun = 0;
     state17.blocks = 0;
     state17.warns = 0;
+    state17.belowThresholdWarns = 0;
     state17.errors = 0;
     state17.lastResult = null;
     if (state17.hookUnregister) {
@@ -5929,7 +5949,13 @@ var plugin18 = {
       const result = await runAudit(cfg);
       if (!result) {
         state17.errors += 1;
-        return;
+        api.metrics.counter("audit_errors");
+        api.log.warn("dependency-vulnerability-gate: audit did not complete; install not vetted", {
+          managerHint: "see dependency_audit_status for counters"
+        });
+        return {
+          additionalContext: "\n\u26A0\uFE0F dependency-vulnerability-gate: the package audit could not be completed (timeout or unreadable output), so these dependencies were NOT checked for known vulnerabilities."
+        };
       }
       state17.auditsRun += 1;
       state17.lastResult = {
@@ -5941,6 +5967,17 @@ var plugin18 = {
         when: (/* @__PURE__ */ new Date()).toISOString()
       };
       if (!exceedsThreshold(result.report, cfg.severityThreshold)) {
+        if (result.report.total > 0) {
+          state17.belowThresholdWarns += 1;
+          api.metrics.counter("below_threshold_warns");
+          const belowCounts = Object.entries(result.report.counts).filter(([, count]) => count > 0).map(([sev, count]) => `${sev}: ${count}`).join(", ");
+          return {
+            additionalContext: `
+\u2139\uFE0F dependency-vulnerability-gate: ${result.manager} audit found vulnerabilities BELOW the configured threshold (${cfg.severityThreshold}); not blocking.
+  Max severity: ${result.report.maxSeverity}
+  Counts: ${belowCounts || "unknown"}`
+          };
+        }
         return;
       }
       const countsText = Object.entries(result.report.counts).filter(([, count]) => count > 0).map(([sev, count]) => `${sev}: ${count}`).join(", ");
@@ -5982,6 +6019,7 @@ Review the audit output or adjust the dependency choice.`;
             auditsRun: state17.auditsRun,
             blocks: state17.blocks,
             warns: state17.warns,
+            belowThresholdWarns: state17.belowThresholdWarns,
             errors: state17.errors
           },
           lastResult: state17.lastResult
@@ -6008,6 +6046,7 @@ Review the audit output or adjust the dependency choice.`;
       auditsRun: state17.auditsRun,
       blocks: state17.blocks,
       warns: state17.warns,
+      belowThresholdWarns: state17.belowThresholdWarns,
       errors: state17.errors
     };
     state17.invocations = 0;
@@ -6015,6 +6054,7 @@ Review the audit output or adjust the dependency choice.`;
     state17.auditsRun = 0;
     state17.blocks = 0;
     state17.warns = 0;
+    state17.belowThresholdWarns = 0;
     state17.errors = 0;
     state17.lastResult = null;
     api.log.info("dependency-vulnerability-gate: teardown complete", { final });
@@ -6029,6 +6069,7 @@ Review the audit output or adjust the dependency choice.`;
         auditsRun: state17.auditsRun,
         blocks: state17.blocks,
         warns: state17.warns,
+        belowThresholdWarns: state17.belowThresholdWarns,
         errors: state17.errors
       },
       lastResult: state17.lastResult
@@ -13612,7 +13653,7 @@ function stripLauncherAtBoundary(command, launcher, valueTaking) {
   }
   return `${command.slice(0, match.index)}${boundary}${after.slice(consumed).replace(/^\s+/, "")}`;
 }
-var XARGS_OPTIONS = String.raw`(?:\s+(?:(?:-[InLsPjeE]|--(?:arg-file|replace|max-args|max-lines|max-chars|max-procs))\s+[^\s]+|-[^\s]+))*`;
+var XARGS_OPTIONS = String.raw`(?:\s+(?:(?:-[InLsPjeE]|--(?:arg-file|replace|max-args|max-lines|max-chars|max-procs))\s+[^\s-][^\s]*|-[^\s]+))*`;
 var COMMAND_BOUNDARY = String.raw`(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs${XARGS_OPTIONS}\s+)`;
 function commandRecursivelyDeletes(command) {
   const stripped = stripTransparentLaunchers(maskNonExecutingHeredocBodies(command));
@@ -13944,19 +13985,13 @@ function destructiveTargetsAtDepth(command, depth) {
     if (destination) targets.push(destination);
     c = copy.exec(normalizedCommand);
   }
-  const tee = new RegExp(
-    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)`,
-    "gi"
-  );
+  const tee = new RegExp(String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)`, "gi");
   let t = tee.exec(normalizedCommand);
   while (t !== null) {
     if (!tokenIsQuoted(t, t[1] ?? "")) targets.push(...shellArgs(t[2] ?? ""));
     t = tee.exec(normalizedCommand);
   }
-  const dd = new RegExp(
-    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)`,
-    "gi"
-  );
+  const dd = new RegExp(String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)`, "gi");
   let d = dd.exec(normalizedCommand);
   while (d !== null) {
     if (!tokenIsQuoted(d, d[1] ?? "")) {
@@ -22651,9 +22686,10 @@ var plugin60 = {
 var todo_listener_default = plugin60;
 
 // src/todo-tracker/index.ts
-import * as fsp from "node:fs/promises";
 import { randomUUID } from "node:crypto";
+import * as fsp from "node:fs/promises";
 import { atomicWrite as atomicWrite3, ensureDir as ensureDir3 } from "@wrongstack/core/utils";
+import { nowIso } from "@wrongstack/primitives";
 function deriveFilePath(api) {
   const raw = api.config.extensions?.["todo-tracker"];
   const explicit = typeof raw?.["filePath"] === "string" ? raw["filePath"] : null;
@@ -22698,9 +22734,6 @@ var state56 = {
   /** Most recent mutation for /diag plugins visibility. */
   lastMutation: null
 };
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
 function ensureFile() {
   if (!state56.file) {
     state56.file = {

package/dist/path-guard.js

@@ -505,7 +505,7 @@ function stripLauncherAtBoundary(command, launcher, valueTaking) {
   }
   return `${command.slice(0, match.index)}${boundary}${after.slice(consumed).replace(/^\s+/, "")}`;
 }
-var XARGS_OPTIONS = String.raw`(?:\s+(?:(?:-[InLsPjeE]|--(?:arg-file|replace|max-args|max-lines|max-chars|max-procs))\s+[^\s]+|-[^\s]+))*`;
+var XARGS_OPTIONS = String.raw`(?:\s+(?:(?:-[InLsPjeE]|--(?:arg-file|replace|max-args|max-lines|max-chars|max-procs))\s+[^\s-][^\s]*|-[^\s]+))*`;
 var COMMAND_BOUNDARY = String.raw`(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs${XARGS_OPTIONS}\s+)`;
 function commandRecursivelyDeletes(command) {
   const stripped = stripTransparentLaunchers(maskNonExecutingHeredocBodies(command));
@@ -837,19 +837,13 @@ function destructiveTargetsAtDepth(command, depth) {
     if (destination) targets.push(destination);
     c = copy.exec(normalizedCommand);
   }
-  const tee = new RegExp(
-    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)`,
-    "gi"
-  );
+  const tee = new RegExp(String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)`, "gi");
   let t = tee.exec(normalizedCommand);
   while (t !== null) {
     if (!tokenIsQuoted(t, t[1] ?? "")) targets.push(...shellArgs(t[2] ?? ""));
     t = tee.exec(normalizedCommand);
   }
-  const dd = new RegExp(
-    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)`,
-    "gi"
-  );
+  const dd = new RegExp(String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)`, "gi");
   let d = dd.exec(normalizedCommand);
   while (d !== null) {
     if (!tokenIsQuoted(d, d[1] ?? "")) {

package/dist/todo-tracker/index.d.ts

@@ -1,3 +1,32 @@
+/**
+ * todo-tracker plugin — Persistent, project-scoped todo backlog that
+ * survives across sessions.
+ *
+ * Why a separate plugin from the built-in `todo` tool?
+ *   - The built-in `todo` tool mutates `ctx.todos`, which is
+ *     session-scoped and auto-clears when all items complete.
+ *   - todo-tracker writes to disk (`~/.wrongstack/projects/<slug>/todo-tracker.json`)
+ *     and survives across sessions. Items are explicit add/complete;
+ *     no auto-clear.
+ *
+ * Use cases:
+ *   - Backlog of work the user wants to track over days/weeks
+ *   - Items the LLM noticed but didn't finish — pull them into a fresh
+ *     session via `todo_tracker_pull` (the LLM then registers them with
+ *     the session's `ctx.todos` via the built-in `todo` tool)
+ *   - Per-project scratchpad that survives `wstack resume <id>`
+ *
+ * Tools registered:
+ *   - todo_tracker_list     : List items, filterable by status/tag/priority
+ *   - todo_tracker_add      : Append a new item
+ *   - todo_tracker_complete : Mark an item completed (idempotent)
+ *   - todo_tracker_drop     : Mark an item dropped (idempotent)
+ *   - todo_tracker_remove   : Permanently delete by id
+ *   - todo_tracker_pull     : Return pending items for LLM to promote
+ *                             into the session's ctx.todos via the
+ *                             built-in `todo` tool
+ *   - todo_tracker_status   : Counters + last update timestamp
+ */
 import type { Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;

package/dist/todo-tracker.js

@@ -1,7 +1,8 @@
 // src/todo-tracker/index.ts
-import * as fsp from "node:fs/promises";
 import { randomUUID } from "node:crypto";
+import * as fsp from "node:fs/promises";
 import { atomicWrite, ensureDir } from "@wrongstack/core/utils";
+import { nowIso } from "@wrongstack/primitives";
 function deriveFilePath(api) {
   const raw = api.config.extensions?.["todo-tracker"];
   const explicit = typeof raw?.["filePath"] === "string" ? raw["filePath"] : null;
@@ -46,9 +47,6 @@ var state = {
   /** Most recent mutation for /diag plugins visibility. */
   lastMutation: null
 };
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
 function ensureFile() {
   if (!state.file) {
     state.file = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/plugins",
-  "version": "0.309.0",
+  "version": "0.310.0",
   "description": "Official WrongStack collection of focused plugins for code quality, security, observability, planning, and agent coordination",
   "license": "MIT",
   "author": "ECOSTACK TECHNOLOGY OÜ",
@@ -300,12 +300,13 @@
   "devDependencies": {
     "@types/node": "^26.2.0",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "dependencies": {
-    "@wrongstack/plugin-sdk": "0.309.0",
-    "@wrongstack/core": "0.309.0",
-    "@wrongstack/tools": "0.309.0"
+    "@wrongstack/core": "0.310.0",
+    "@wrongstack/tools": "0.310.0",
+    "@wrongstack/primitives": "0.310.0",
+    "@wrongstack/plugin-sdk": "0.310.0"
   },
   "scripts": {
     "build": "node ../../scripts/build-package.mjs",