@wrongstack/plugins 0.319.0 → 1.0.0

package/dist/index.js

@@ -175,7 +175,12 @@ async function auditFile(filePath, projectRoot) {
         );
       }
       if (!hasPrimaryLabel && ATTR_PLACEHOLDER.test(tag)) {
-        add(lineNo, "low-contrast-placeholder", "warning", "<input> uses placeholder text (often low contrast and disappears on input)");
+        add(
+          lineNo,
+          "low-contrast-placeholder",
+          "warning",
+          "<input> uses placeholder text (often low contrast and disappears on input)"
+        );
       }
     }
     TAG_INPUT.lastIndex = 0;
@@ -186,14 +191,24 @@ async function auditFile(filePath, projectRoot) {
       const hasAriaLabel = ATTR_ARIA_LABEL.test(tag);
       const hasTitle = ATTR_TITLE.test(tag);
       if (!hasText && !hasAriaLabel && !hasTitle) {
-        add(lineNo, "missing-button-text", "error", "<button> has no visible text or accessible label");
+        add(
+          lineNo,
+          "missing-button-text",
+          "error",
+          "<button> has no visible text or accessible label"
+        );
       }
     }
     TAG_BUTTON.lastIndex = 0;
     for (const inputButtonMatch of line.matchAll(INPUT_BUTTON)) {
       const tag = inputButtonMatch[0];
       if (!ATTR_VALUE.test(tag) && !ATTR_ARIA_LABEL.test(tag) && !ATTR_TITLE.test(tag)) {
-        add(lineNo, "missing-button-text", "error", `<input type="${inputButtonMatch[1]}"> is missing value/aria-label/title`);
+        add(
+          lineNo,
+          "missing-button-text",
+          "error",
+          `<input type="${inputButtonMatch[1]}"> is missing value/aria-label/title`
+        );
       }
     }
     INPUT_BUTTON.lastIndex = 0;
@@ -328,7 +343,9 @@ var plugin = {
       }
       return { additionalContext: summary };
     };
-    state.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "a11y_audit",
       description: "Audit a file or directory for accessibility issues. Scans .tsx/.jsx/.html/.vue files for missing alt text, missing labels, low-contrast placeholders, missing button text, and duplicate ids.",
@@ -1058,7 +1075,9 @@ var plugin3 = {
       }
       return { additionalContext: message };
     };
-    state3.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state3.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "api_compat_status",
       description: "Reports api-compatibility-gate state: severity, entry-point patterns, and per-session counters.",
@@ -1760,7 +1779,9 @@ function looksLikeUserText(value, minLength) {
   if (value.length < minLength) return false;
   if (/^\s*$/.test(value)) return false;
   if (/^[0-9\s\W_]+$/.test(value)) return false;
-  if (/^(https?:|ftp:|www\.|\/|\.\/|@|#[0-9a-f]{3,8}$|\.?(jsx?|tsx?|vue|css|scss|json|png|svg|jpg)$)/i.test(value)) {
+  if (/^(https?:|ftp:|www\.|\/|\.\/|@|#[0-9a-f]{3,8}$|\.?(jsx?|tsx?|vue|css|scss|json|png|svg|jpg)$)/i.test(
+    value
+  )) {
     return false;
   }
   return true;
@@ -1768,7 +1789,9 @@ function looksLikeUserText(value, minLength) {
 function isExcludedContext(line, quoteIndex, excludeAttributes) {
   const before = line.slice(0, quoteIndex);
   for (const attr of excludeAttributes) {
-    const re = new RegExp(`\\b${attr.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*=\\s*(?:\\{\\s*)?["']?$`);
+    const re = new RegExp(
+      `\\b${attr.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*=\\s*(?:\\{\\s*)?["']?$`
+    );
     if (re.test(before)) return true;
   }
   return false;
@@ -1900,7 +1923,9 @@ var plugin6 = {
 ${lines.join("\n")}${more}`;
       return { additionalContext: context };
     };
-    state6.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state6.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "i18n_extract",
       description: "Scan a UI source file (.tsx/.jsx/.vue) for hardcoded user-facing string literals and return suggested i18n keys.",
@@ -2710,10 +2735,7 @@ var plugin8 = {
         }
         const rawInput = input ?? {};
         const shouldPolish = input.polish === true || rawInput["use_llm"] === true || rawInput["useLlm"] === true || rawInput["ai"] === true || rawInput["use_ai"] === true;
-        const block = await maybePolish(
-          renderUnreleasedBlock(state8.entries),
-          shouldPolish
-        );
+        const block = await maybePolish(renderUnreleasedBlock(state8.entries), shouldPolish);
         let existing = null;
         try {
           existing = readFileSync3(cfg.filePath, "utf-8");
@@ -2783,7 +2805,7 @@ var plugin8 = {
 var changelog_writer_default = plugin8;
 
 // src/checkpoint/index.ts
-import { mkdir, readFile as readFile3, stat, writeFile } from "node:fs/promises";
+import { mkdir, readFile as readFile3, realpath, stat, writeFile } from "node:fs/promises";
 import { dirname as dirname2, isAbsolute as isAbsolute5, relative as relative5, resolve as resolve5 } from "node:path";
 var state9 = {
   snapshots: [],
@@ -2812,13 +2834,46 @@ function readConfig8(raw) {
     maxFileBytes: typeof r["maxFileBytes"] === "number" && r["maxFileBytes"] >= 1024 ? r["maxFileBytes"] : DEFAULTS8.maxFileBytes
   };
 }
-function resolveProjectPath3(rawPath, cwd = process.cwd()) {
+async function resolveProjectPath3(rawPath, cwd = process.cwd()) {
   if (typeof rawPath !== "string" || rawPath.length === 0) return null;
   const root = resolve5(cwd);
   const resolved = isAbsolute5(rawPath) ? resolve5(rawPath) : resolve5(root, rawPath);
   const rel = relative5(root, resolved);
-  if (rel === "" || !rel.startsWith("..") && !isAbsolute5(rel)) return resolved;
-  return null;
+  const lexicallyInside = rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
+  if (!lexicallyInside) return null;
+  if (await realResolutionEscapes(resolved, root)) return null;
+  return resolved;
+}
+async function realResolutionEscapes(absPath, root) {
+  let real;
+  try {
+    real = await realpath(absPath);
+  } catch {
+    let current = dirname2(absPath);
+    let hops = 0;
+    while (hops < 64 && !await pathExists(current)) {
+      const parent = dirname2(current);
+      if (parent === current) return false;
+      current = parent;
+      hops++;
+    }
+    if (!await pathExists(current)) return false;
+    try {
+      real = await realpath(current);
+    } catch {
+      return false;
+    }
+  }
+  const realRel = relative5(root, real);
+  return realRel !== "" && realRel !== "." && (realRel.startsWith("..") || isAbsolute5(realRel));
+}
+async function pathExists(p) {
+  try {
+    await stat(p);
+    return true;
+  } catch {
+    return false;
+  }
 }
 function hashContent(s) {
   const cap = Math.min(s.length, 65536);
@@ -2919,7 +2974,7 @@ var plugin9 = {
         const ti = input.toolInput ?? {};
         const raw = ti["path"] ?? ti["file_path"] ?? ti["filePath"] ?? ti["TargetFile"] ?? ti["targetFile"] ?? ti["file"];
         if (typeof raw !== "string" || raw.length === 0) return;
-        const safePath = resolveProjectPath3(raw);
+        const safePath = await resolveProjectPath3(raw);
         if (!safePath) return;
         const captured = await captureFileForHook(safePath, cfg.maxFileBytes, runtime.signal);
         if (captured === "too-large") {
@@ -2990,7 +3045,7 @@ var plugin9 = {
         const rejectedOutsideProject = [];
         let skipped = 0;
         for (const p of paths) {
-          const safePath = resolveProjectPath3(p);
+          const safePath = await resolveProjectPath3(p);
           if (!safePath) {
             rejectedOutsideProject.push(p);
             continue;
@@ -3097,7 +3152,7 @@ var plugin9 = {
             error: rawId ? `no snapshot with id "${rawId}"` : "no snapshots captured yet"
           };
         }
-        const targetPath = rawPath ? resolveProjectPath3(rawPath) ?? rawPath : null;
+        const targetPath = rawPath ? await resolveProjectPath3(rawPath) ?? rawPath : null;
         const targets = targetPath ? snapshot.files.filter((f) => f.path === targetPath || f.path === rawPath) : snapshot.files;
         if (targets.length === 0) {
           return { ok: false, error: `snapshot ${snapshot.id} has no entry for "${rawPath}"` };
@@ -3403,7 +3458,9 @@ var plugin10 = {
 \u{1F4CA} code-metrics: ${relativePath(resolved)} \u2014 ${metrics.lines} lines (${metrics.codeLines} code, ${metrics.commentLines} comments, ${metrics.blankLines} blank), ${metrics.functionCount} function(s), complexity ${metrics.complexity}.`
       };
     };
-    state10.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state10.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "measure_code_metrics",
       description: "Measure lines, comments, blank lines, function count, and cyclomatic-complexity-like score for a source file or directory.",
@@ -3920,7 +3977,9 @@ function readConfig11(raw) {
   const rawMax = r["maxFileBytes"] ?? r["max_file_bytes"] ?? r["maxBytes"] ?? r["max_bytes"];
   return {
     enabled: r["enabled"] !== false,
-    extensions: Array.isArray(rawExts) ? rawExts.filter((e) => typeof e === "string" && e.trim().length > 0).map((e) => e.trim().startsWith(".") ? e.trim().toLowerCase() : `.${e.trim().toLowerCase()}`) : [...DEFAULT_EXTENSIONS],
+    extensions: Array.isArray(rawExts) ? rawExts.filter((e) => typeof e === "string" && e.trim().length > 0).map(
+      (e) => e.trim().startsWith(".") ? e.trim().toLowerCase() : `.${e.trim().toLowerCase()}`
+    ) : [...DEFAULT_EXTENSIONS],
     maxFileBytes: typeof rawMax === "number" && rawMax >= 1024 ? rawMax : DEFAULTS11.maxFileBytes
   };
 }
@@ -4214,7 +4273,9 @@ var plugin12 = {
   \u2026 and ${problems.length - 10} more` : "") + "\nFix these before moving on \u2014 downstream tools will fail on this file."
       };
     };
-    state12.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state12.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "config_validator_status",
       description: "Reports config-validator state: watched extensions and counters (files checked, problems found).",
@@ -4335,7 +4396,10 @@ async function persistPins(filePath) {
   if (!filePath) return true;
   try {
     await ensureDir(dirname3(filePath));
-    await atomicWrite(filePath, JSON.stringify({ pins: state13.pins, nextId: state13.nextId }, null, 2));
+    await atomicWrite(
+      filePath,
+      JSON.stringify({ pins: state13.pins, nextId: state13.nextId }, null, 2)
+    );
     return true;
   } catch {
     state13.persistErrors += 1;
@@ -4707,7 +4771,9 @@ var plugin14 = {
       const rawCacheWrite = Number(u["cacheWrite"] ?? u["cache_creation_input_tokens"] ?? 0) || 0;
       const freshTokens = rawInput + rawCacheWrite;
       const promptTokens = freshTokens + cachedTokens;
-      const completionTokens = Number(u["output"] ?? u["completion_tokens"] ?? u["outputTokens"] ?? u["completionTokens"] ?? 0) || 0;
+      const completionTokens = Number(
+        u["output"] ?? u["completion_tokens"] ?? u["outputTokens"] ?? u["completionTokens"] ?? 0
+      ) || 0;
       const totalTokens = promptTokens + completionTokens;
       const costUsd = estimateCost(model, freshTokens, completionTokens, cachedTokens);
       const record = {
@@ -5073,8 +5139,14 @@ var plugin15 = {
         type: "object",
         properties: {
           name: { type: "string", description: "Unique name for this cron job" },
-          intervalMs: { type: "number", description: "Interval between runs in milliseconds (minimum 1000)" },
-          action: { type: "string", description: "Action identifier or description of what to run" },
+          intervalMs: {
+            type: "number",
+            description: "Interval between runs in milliseconds (minimum 1000)"
+          },
+          action: {
+            type: "string",
+            description: "Action identifier or description of what to run"
+          },
           enabled: { type: "boolean", default: true }
         },
         required: ["name", "intervalMs", "action"]
@@ -5602,7 +5674,9 @@ function parseInstallCommands(command) {
       if (!cleaned) continue;
       let name = cleaned;
       let version = null;
-      const pipMatch = /^([A-Za-z0-9_.-]+(?:\[[^\]]+\])?)\s*(==|>=|<=|~=|!=|>|<)\s*(.+)$/.exec(cleaned);
+      const pipMatch = /^([A-Za-z0-9_.-]+(?:\[[^\]]+\])?)\s*(==|>=|<=|~=|!=|>|<)\s*(.+)$/.exec(
+        cleaned
+      );
       if (pipMatch?.[1]) {
         name = pipMatch[1];
         const op = pipMatch[2] ?? "";
@@ -6520,8 +6594,12 @@ var plugin19 = {
         return;
       }
       const oldStr = String(inp["old_string"] ?? inp["TargetContent"] ?? inp["oldContent"] ?? "");
-      const newStr = String(inp["new_string"] ?? inp["ReplacementContent"] ?? inp["newContent"] ?? "");
-      const contentStr = String(inp["content"] ?? inp["CodeContent"] ?? inp["code"] ?? inp["text"] ?? inp["contents"] ?? inp["body"] ?? "");
+      const newStr = String(
+        inp["new_string"] ?? inp["ReplacementContent"] ?? inp["newContent"] ?? ""
+      );
+      const contentStr = String(
+        inp["content"] ?? inp["CodeContent"] ?? inp["code"] ?? inp["text"] ?? inp["contents"] ?? inp["body"] ?? ""
+      );
       const toolInputForHash = oldStr || newStr ? `${oldStr}:::${newStr}` : contentStr;
       const now = Date.now();
       const memo = pathMemo.get(filePath);
@@ -6576,7 +6654,9 @@ var plugin19 = {
         additionalContext: header + summary
       };
     };
-    state18.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state18.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "diff_summary_status",
       description: "Reports diff-summary state: mode, maxLines, and per-session invocation/injected/fallback counters.",
@@ -6804,7 +6884,9 @@ var plugin20 = {
           }
         }
         if (!content || state19.changedFiles.length === 0) return;
-        const missing = state19.changedFiles.filter((changedPath) => !isReferenced(changedPath, content));
+        const missing = state19.changedFiles.filter(
+          (changedPath) => !isReferenced(changedPath, content)
+        );
         if (missing.length === 0) return;
         state19.warningsIssued += 1;
         const missingList = missing.map((p) => `  - ${p}`).join("\n");
@@ -6815,7 +6897,9 @@ Consider mentioning these changes in the documentation.`;
         return { additionalContext: message };
       }
     };
-    state19.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state19.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "doc_sync_status",
       description: "Reports doc-sync-guard state: tracked changed files, doc-write count, and warning count.",
@@ -6880,7 +6964,7 @@ Consider mentioning these changes in the documentation.`;
 var doc_sync_guard_default = plugin20;
 
 // src/duplicate-code-detector/index.ts
-import { readFile as readFile6, realpath, stat as stat3 } from "node:fs/promises";
+import { readFile as readFile6, realpath as realpath2, stat as stat3 } from "node:fs/promises";
 import { extname as extname4, isAbsolute as isAbsolute8, relative as relative9, resolve as resolve9, sep } from "node:path";
 var API_VERSION14 = "^0.1.10";
 var HOOK_WARNING_COOLDOWN_MS = 6e4;
@@ -7239,7 +7323,7 @@ var plugin21 = {
       if (!isWithinRoot(projectRoot, resolvedFile)) return;
       let changedFile;
       try {
-        changedFile = await realpath(resolvedFile);
+        changedFile = await realpath2(resolvedFile);
       } catch {
         state20.errorCount += 1;
         return;
@@ -7908,7 +7992,9 @@ var plugin23 = {
 Make sure flag behavior is intentional and consider updating flag inventory/docs.`
       };
     };
-    state22.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state22.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "scan_feature_flags",
       description: "Scan source files for feature-flag-like expressions (isFeatureEnabled, featureFlags.*, useFeatureFlag, flags.*, plus custom patterns).",
@@ -8678,7 +8764,9 @@ var plugin25 = {
       state23.cleanCount += 1;
       return;
     };
-    state23.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state23.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     state23.patternUnregister = api.onPattern(
       "import-organizer:done",
       (_eventName, payload) => {
@@ -9475,7 +9563,7 @@ function classifyArtifact(relPath, patterns) {
   }
   return null;
 }
-async function pathExists(p) {
+async function pathExists2(p) {
   try {
     await access3(p);
     return true;
@@ -9484,7 +9572,7 @@ async function pathExists(p) {
   }
 }
 async function readGitignoreLines(file) {
-  if (!await pathExists(file)) return [];
+  if (!await pathExists2(file)) return [];
   try {
     const content = await readFile9(file, "utf8");
     return content.split(/\r?\n/);
@@ -9516,7 +9604,7 @@ function relDirOf(rel) {
 }
 async function firstExistingGitignore(candidates) {
   for (const c of candidates) {
-    if (await pathExists(c)) return c;
+    if (await pathExists2(c)) return c;
   }
   return null;
 }
@@ -9527,7 +9615,7 @@ async function appendPatterns(target, patterns, limit) {
   );
   const missing = patterns.filter((p) => !seen.has(p)).slice(0, limit);
   if (missing.length === 0) return { appended: [] };
-  const current = await pathExists(target) ? await readFile9(target, "utf8") : "";
+  const current = await pathExists2(target) ? await readFile9(target, "utf8") : "";
   const base = current.length === 0 ? "" : current.endsWith("\n") ? current : `${current}
 `;
   const next = `${base}${missing.map((p) => `${p}
@@ -10187,7 +10275,9 @@ ${result.stderr.trim()}`
       }
       return;
     };
-    state25.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state25.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "import_organizer_status",
       description: "Reports import-organizer state: linter availability, config, and per-session organized/clean/error counters.",
@@ -10678,7 +10768,9 @@ var plugin30 = {
 If you changed member shapes, search the project for implementers/\`satisfies\`/\`as\` usages and update them accordingly.`
       };
     };
-    state27.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state27.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "check_interface_contracts",
       description: "Scan TypeScript files for interface declarations that have no visible implementer (implements / as / satisfies).",
@@ -11030,9 +11122,12 @@ var plugin31 = {
             const hasMatch = f.subject.toLowerCase().includes(q) || f.relation.toLowerCase().includes(q) || f.object.toLowerCase().includes(q);
             if (!hasMatch) return false;
           }
-          if (input.subject && !f.subject.toLowerCase().includes(input.subject.toLowerCase())) return false;
-          if (input.relation && !f.relation.toLowerCase().includes(input.relation.toLowerCase())) return false;
-          if (input.object && !f.object.toLowerCase().includes(input.object.toLowerCase())) return false;
+          if (input.subject && !f.subject.toLowerCase().includes(input.subject.toLowerCase()))
+            return false;
+          if (input.relation && !f.relation.toLowerCase().includes(input.relation.toLowerCase()))
+            return false;
+          if (input.object && !f.object.toLowerCase().includes(input.object.toLowerCase()))
+            return false;
           if (filterConf && f.confidence.toLowerCase() !== filterConf) return false;
           return true;
         });
@@ -11064,7 +11159,9 @@ var plugin31 = {
         const raw = input ?? {};
         const rawId = String(input.id ?? raw["factId"] ?? raw["fact_id"] ?? "").trim();
         const normalized = rawId.toLowerCase().startsWith("kg-") ? rawId.toLowerCase() : `kg-${rawId.toLowerCase()}`;
-        state28.facts = state28.facts.filter((f) => f.id.toLowerCase() !== normalized && f.id !== rawId);
+        state28.facts = state28.facts.filter(
+          (f) => f.id.toLowerCase() !== normalized && f.id !== rawId
+        );
         const removed = before - state28.facts.length;
         if (removed === 0) return { ok: false, error: `no fact matches "${input.id ?? rawId}"` };
         state28.removals += removed;
@@ -11160,7 +11257,15 @@ var state29 = {
 };
 var DEFAULTS27 = {
   enabled: true,
-  allowedLicenses: ["MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "0BSD", "Unlicense"],
+  allowedLicenses: [
+    "MIT",
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "0BSD",
+    "Unlicense"
+  ],
   block: true
 };
 function normalizeStrings(v) {
@@ -11199,7 +11304,9 @@ function extractLicenseStrings(pkg) {
 }
 function parsePackageNames(command) {
   return [
-    ...new Set(parseInstallCommands(command).flatMap((entry) => entry.packages.map((pkg) => pkg.name)))
+    ...new Set(
+      parseInstallCommands(command).flatMap((entry) => entry.packages.map((pkg) => pkg.name))
+    )
   ];
 }
 function splitTopLevel(expr, separator) {
@@ -12707,7 +12814,7 @@ import {
   runOptionalPluginCouncil,
   runOptionalPluginLlm,
   stripOuterMarkdownFence
-} from "@wrongstack/plugin-sdk/runtime";
+} from "@wrongstack/plugin-sdk/runtime/llm";
 
 // src/migration-planner/index.ts
 var API_VERSION25 = "^0.1.10";
@@ -13959,11 +14066,15 @@ var plugin38 = {
 };
 var notify_hub_default = plugin38;
 
+// src/path-guard/index.ts
+import { existsSync as existsSync6, realpathSync } from "node:fs";
+import { dirname as dirname6, resolve as resolve17 } from "node:path";
+
 // src/runtime/redos-guard.ts
 import {
   withReDoSGuard,
   guardedMatcher
-} from "@wrongstack/plugin-sdk/runtime";
+} from "@wrongstack/plugin-sdk/runtime/redos-guard";
 
 // src/path-guard/glob.ts
 var GLOB_REDOS_BUDGET_MS = 250;
@@ -15249,17 +15360,32 @@ function operationLabel(toolName) {
 }
 
 // src/path-guard/index.ts
-import { realpathSync } from "node:fs";
-import { resolve as resolve17 } from "node:path";
 function isSymlinkEscape(path, cwd) {
   if (!(0, runtime_exports.withinProject)(path)) return false;
+  const abs = resolve17(cwd ?? process.cwd(), path);
+  let real;
   try {
-    const abs = resolve17(cwd ?? process.cwd(), path);
-    const real = realpathSync(abs);
-    return !(0, runtime_exports.withinProject)(real);
+    real = realpathSync(abs);
   } catch {
-    return false;
+    const ancestor = nearestExistingAncestor(abs);
+    if (ancestor === null) return false;
+    try {
+      real = realpathSync(ancestor);
+    } catch {
+      return false;
+    }
   }
+  return !(0, runtime_exports.withinProject)(real);
+}
+function nearestExistingAncestor(abs) {
+  let current = dirname6(abs);
+  for (let hops = 0; hops < 64; hops++) {
+    if (existsSync6(current)) return current;
+    const parent = dirname6(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+  return null;
 }
 function createState() {
   return {
@@ -15408,10 +15534,19 @@ var plugin39 = {
               path: relativeToInvocationCwd(resolveTargetPath(path, effectiveCwd), input.cwd),
               kind: isRootPathScope(path) && deletesImplicitScope || isUnresolvedPathScope(path) || recursivelyDeletes && (isDirectoryAmbiguousPath(path) || hasConfiguredProtectedDescendant(path, cfg.protect)) ? "deletion-scope" : "file"
             };
+            if (target.kind === "file" && isSymlinkEscape(target.path, input.cwd)) {
+              return target;
+            }
             if (targetFullyAllowed(target, cfg.allow, allowRes)) return null;
-            const protectedShellTarget = await targetIntersectsPatternsGuarded(target, cfg.protect, protectRes, { onTimeout: bumpRedos }) || await matchesAnyGuarded(`${target.path.replace(/\/$/, "")}/.path-guard-probe`, protectRes, {
+            const protectedShellTarget = await targetIntersectsPatternsGuarded(target, cfg.protect, protectRes, {
               onTimeout: bumpRedos
-            });
+            }) || await matchesAnyGuarded(
+              `${target.path.replace(/\/$/, "")}/.path-guard-probe`,
+              protectRes,
+              {
+                onTimeout: bumpRedos
+              }
+            );
             return protectedShellTarget ? target : null;
           })
         );
@@ -15529,7 +15664,7 @@ var plugin39 = {
 var path_guard_default = plugin39;
 
 // src/performance-regression-gate/index.ts
-import { existsSync as existsSync6, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync11 } from "node:fs";
 import { isAbsolute as isAbsolute16, relative as relative16, resolve as resolve18 } from "node:path";
 var API_VERSION26 = "^0.1.10";
 var state36 = {
@@ -15595,7 +15730,7 @@ function flattenResults(results) {
   return flat;
 }
 function loadResults(path) {
-  if (!path || !existsSync6(path)) return null;
+  if (!path || !existsSync7(path)) return null;
   try {
     const raw = JSON.parse(readFileSync11(path, "utf-8"));
     return raw;
@@ -15993,7 +16128,7 @@ var plugin_stack_observer_default = PLUGIN;
 // src/pr-drafter/index.ts
 import { execFile as execFile9 } from "node:child_process";
 import { mkdir as mkdir2, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute17, relative as relative17, resolve as resolve19 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute17, relative as relative17, resolve as resolve19 } from "node:path";
 var API_VERSION27 = "^0.1.10";
 var state38 = {
   commits: [],
@@ -16125,7 +16260,7 @@ async function writeDraft(cfg, llm) {
   }
   const draft = await buildDraft(cfg, llm);
   try {
-    await mkdir2(dirname6(resolved), { recursive: true });
+    await mkdir2(dirname7(resolved), { recursive: true });
     await writeFile4(resolved, draft.body);
     state38.draftsWritten += 1;
   } catch {
@@ -16257,7 +16392,9 @@ var plugin41 = {
       async execute(input = {}) {
         if (!cfg.enabled) return { ok: false, error: "pr-drafter is disabled" };
         const raw = input ?? {};
-        const preview = Boolean(input?.preview ?? raw["dryRun"] ?? raw["dry_run"] ?? raw["dry"] ?? raw["previewOnly"]);
+        const preview = Boolean(
+          input?.preview ?? raw["dryRun"] ?? raw["dry_run"] ?? raw["dry"] ?? raw["previewOnly"]
+        );
         const rawOutputPath = raw["outputPath"] ?? raw["output_path"] ?? raw["path"] ?? raw["filePath"] ?? raw["file"] ?? raw["TargetFile"] ?? raw["targetFile"] ?? cfg.outputPath;
         const outputPathStr = typeof rawOutputPath === "string" && rawOutputPath.trim().length > 0 ? rawOutputPath.trim() : cfg.outputPath;
         const draft = await buildDraft(cfg, api.llm);
@@ -16267,7 +16404,7 @@ var plugin41 = {
         const resolved = resolveProjectPath7(outputPathStr);
         if (!resolved) return { ok: false, error: "outputPath resolves outside project" };
         try {
-          await mkdir2(dirname6(resolved), { recursive: true });
+          await mkdir2(dirname7(resolved), { recursive: true });
           await writeFile4(resolved, draft.body);
           state38.draftsWritten += 1;
           return {
@@ -16406,7 +16543,9 @@ var plugin42 = {
       const rawCmd = ti["command"] ?? ti["CommandLine"] ?? ti["cmd"] ?? ti["script"] ?? ti["input"];
       const command = typeof rawCmd === "string" ? rawCmd : "";
       if (!command) return;
-      const isKillRelated = /\b(?:kill|taskkill|stop-process|tskill|pkill|killall|wmic)\b/i.test(command);
+      const isKillRelated = /\b(?:kill|taskkill|stop-process|tskill|pkill|killall|wmic)\b/i.test(
+        command
+      );
       if (!isKillRelated) return;
       state39.detections += 1;
       state39.lastDetection = {
@@ -16495,7 +16634,7 @@ import { performance as performance2 } from "node:perf_hooks";
 import {
   cloneCredentialPatterns,
   CREDENTIAL_PATTERNS
-} from "@wrongstack/plugin-sdk/runtime";
+} from "@wrongstack/plugin-sdk/runtime/credential-patterns";
 
 // src/prompt-firewall/index.ts
 var KIND_ALIASES = {
@@ -16772,9 +16911,12 @@ function surfaceScanTrips(api, tripped) {
   }
   state40.timeoutCount += 1;
   api.metrics.counter("redos_skips", 1);
-  api.log.warn("prompt-firewall: scan-pass budget exceeded \u2014 patterns skipped mid-pass (issue #370)", {
-    skipped: [...tripped]
-  });
+  api.log.warn(
+    "prompt-firewall: scan-pass budget exceeded \u2014 patterns skipped mid-pass (issue #370)",
+    {
+      skipped: [...tripped]
+    }
+  );
 }
 var plugin43 = {
   name: "prompt-firewall",
@@ -16876,7 +17018,14 @@ var plugin43 = {
             if (cfg.mode === "redact") {
               const counter = { n: 0 };
               const deadline = createScanDeadline();
-              const redactedReq = redactDeep(req, cfg.allow, counter, skipSet, void 0, deadline);
+              const redactedReq = redactDeep(
+                req,
+                cfg.allow,
+                counter,
+                skipSet,
+                void 0,
+                deadline
+              );
               state40.requestRedactions += counter.n;
               api.metrics.counter("request_redactions", counter.n);
               if (deadline.tripped.size > 0) surfaceScanTrips(api, deadline.tripped);
@@ -17273,7 +17422,9 @@ var plugin44 = {
         contextAs: "separate"
       };
     };
-    state41.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state41.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "suggest_refactors",
       description: "Scan source files for refactoring smells: long functions, deep nesting, many parameters, magic numbers, and console logging.",
@@ -18600,7 +18751,19 @@ var DEFAULTS42 = {
   enabled: false,
   severity: "warn",
   maxFindings: 10,
-  scanOnChange: [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".py", ".java", ".go", ".rb", ".php"]
+  scanOnChange: [
+    ".js",
+    ".jsx",
+    ".ts",
+    ".tsx",
+    ".mjs",
+    ".cjs",
+    ".py",
+    ".java",
+    ".go",
+    ".rb",
+    ".php"
+  ]
 };
 var scanOnChangeSet = new Set(DEFAULTS42.scanOnChange);
 function readConfig44(raw) {
@@ -18623,7 +18786,11 @@ function readConfig44(raw) {
 }
 var PATTERNS4 = [
   { type: "eval_call", severity: "high", regex: /\beval\s*\(/i },
-  { type: "function_constructor", severity: "high", regex: /\bnew\s+Function\s*\(|\bFunction\s*\(/i },
+  {
+    type: "function_constructor",
+    severity: "high",
+    regex: /\bnew\s+Function\s*\(|\bFunction\s*\(/i
+  },
   {
     type: "unsafe_html",
     severity: "high",
@@ -18861,7 +19028,9 @@ Review or remove the risky pattern(s).`;
       }
       return { additionalContext: message };
     };
-    state44.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state44.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "security_hotspot_scan",
       description: "Scan a file or directory for security anti-patterns (eval, Function constructor, innerHTML, SQL concatenation, http URLs, credential logging, variable exec commands).",
@@ -19036,11 +19205,7 @@ var DEFAULTS43 = {
     ".scss",
     ".html"
   ],
-  excludePatterns: [
-    ...DEFAULT_WALK_IGNORE_DIRS.map(escapeRegex),
-    "\\.wrongstack",
-    "\\.temp_files"
-  ],
+  excludePatterns: [...DEFAULT_WALK_IGNORE_DIRS.map(escapeRegex), "\\.wrongstack", "\\.temp_files"],
   maxFileBytes: 1e6,
   defaultLimit: 10,
   minTokenLength: 2,
@@ -19048,7 +19213,12 @@ var DEFAULTS43 = {
   maxFiles: 5e3
 };
 function readConfig45(raw) {
-  if (!raw || typeof raw !== "object") return { ...DEFAULTS43, includeExtensions: [...DEFAULTS43.includeExtensions], excludePatterns: [...DEFAULTS43.excludePatterns] };
+  if (!raw || typeof raw !== "object")
+    return {
+      ...DEFAULTS43,
+      includeExtensions: [...DEFAULTS43.includeExtensions],
+      excludePatterns: [...DEFAULTS43.excludePatterns]
+    };
   const r = raw;
   const rawExts = r["includeExtensions"] ?? r["include_extensions"] ?? r["extensions"] ?? r["file_extensions"];
   const includeExtensions = Array.isArray(rawExts) ? rawExts.filter((x) => typeof x === "string") : [...DEFAULTS43.includeExtensions];
@@ -19359,7 +19529,11 @@ var plugin49 = {
   description: "Builds an in-memory keyword index over project source files and answers ranked search queries",
   apiVersion: API_VERSION32,
   capabilities: { tools: true },
-  defaultConfig: { ...DEFAULTS43, includeExtensions: [...DEFAULTS43.includeExtensions], excludePatterns: [...DEFAULTS43.excludePatterns] },
+  defaultConfig: {
+    ...DEFAULTS43,
+    includeExtensions: [...DEFAULTS43.includeExtensions],
+    excludePatterns: [...DEFAULTS43.excludePatterns]
+  },
   configSchema: {
     type: "object",
     properties: {
@@ -19644,19 +19818,24 @@ var state46 = {
 };
 function runCommand3(command, args, cwd) {
   return new Promise((resolve28, reject) => {
-    execFile11(command, args, {
-      encoding: "utf-8",
-      cwd,
-      timeout: 3e4,
-      windowsHide: true
-    }, (err, stdout, stderr) => {
-      if (!err) {
-        resolve28(stdout.trim());
-        return;
+    execFile11(
+      command,
+      args,
+      {
+        encoding: "utf-8",
+        cwd,
+        timeout: 3e4,
+        windowsHide: true
+      },
+      (err, stdout, stderr) => {
+        if (!err) {
+          resolve28(stdout.trim());
+          return;
+        }
+        const failure = err;
+        reject(Object.assign(failure, { stderr: stderr || void 0 }));
       }
-      const failure = err;
-      reject(Object.assign(failure, { stderr: stderr || void 0 }));
-    });
+    );
   });
 }
 async function runGit6(args, cwd) {
@@ -20704,15 +20883,10 @@ var state48 = {
 async function runShellCheck(files, severity, cwd) {
   try {
     await new Promise((resolvePromise, rejectPromise) => {
-      execFile12(
-        "shellcheck",
-        ["--version"],
-        { encoding: "utf-8", windowsHide: true },
-        (err) => {
-          if (err) rejectPromise(err);
-          else resolvePromise();
-        }
-      );
+      execFile12("shellcheck", ["--version"], { encoding: "utf-8", windowsHide: true }, (err) => {
+        if (err) rejectPromise(err);
+        else resolvePromise();
+      });
     });
   } catch {
     throw new Error(
@@ -20873,7 +21047,9 @@ var plugin52 = {
           if (typeof rawFiles === "string" && rawFiles.trim().length > 0) {
             files = [rawFiles.trim()];
           } else if (Array.isArray(rawFiles)) {
-            files = rawFiles.filter((f) => typeof f === "string" && f.trim().length > 0);
+            files = rawFiles.filter(
+              (f) => typeof f === "string" && f.trim().length > 0
+            );
           }
         }
         const rawDirectory = inp.directory ?? input["dir"] ?? input["SearchDirectory"];
@@ -21018,7 +21194,8 @@ function normalizeExtensions6(exts) {
   return exts.map((e) => e.startsWith(".") ? e.toLowerCase() : `.${e.toLowerCase()}`);
 }
 function readConfig47(raw) {
-  if (!raw || typeof raw !== "object") return { ...DEFAULTS45, extensions: normalizeExtensions6(DEFAULTS45.extensions) };
+  if (!raw || typeof raw !== "object")
+    return { ...DEFAULTS45, extensions: normalizeExtensions6(DEFAULTS45.extensions) };
   const r = raw;
   const rawExts = r["extensions"] ?? r["file_extensions"] ?? r["fileExtensions"];
   const exts = Array.isArray(rawExts) ? rawExts.filter((x) => typeof x === "string") : DEFAULTS45.extensions;
@@ -21051,10 +21228,7 @@ function isIdentifier(name) {
   return IDENTIFIER_RE2.test(name);
 }
 function renameInContent(content, oldName, newName) {
-  const re = new RegExp(
-    `(?<![A-Za-z0-9_$])${escapeRegex2(oldName)}(?![A-Za-z0-9_$])`,
-    "g"
-  );
+  const re = new RegExp(`(?<![A-Za-z0-9_$])${escapeRegex2(oldName)}(?![A-Za-z0-9_$])`, "g");
   let replacements = 0;
   const preview = content.replace(re, () => {
     replacements++;
@@ -21095,7 +21269,11 @@ var plugin53 = {
           path: { type: "string", description: "Source file path (relative to project root)." },
           oldName: { type: "string", description: "Identifier to replace." },
           newName: { type: "string", description: "New identifier." },
-          apply: { type: "boolean", default: false, description: "When true, write the preview back to disk." }
+          apply: {
+            type: "boolean",
+            default: false,
+            description: "When true, write the preview back to disk."
+          }
         },
         required: ["path", "oldName", "newName"]
       },
@@ -21612,7 +21790,9 @@ var plugin54 = {
 ${lines}${overflowNote}`
       };
     };
-    state50.postHookUnregister = api.registerHook("PostToolUse", "write|edit", postHook, { background: true });
+    state50.postHookUnregister = api.registerHook("PostToolUse", "write|edit", postHook, {
+      background: true
+    });
     if (cfg.autoFix) {
       const preHook = async (input) => {
         if (!cfg.enabled) return;
@@ -21756,21 +21936,27 @@ function expandTemplate(template, variables) {
   return result;
 }
 function expandConditionals(template, variables) {
-  return template.replace(/\{\{#if\s+([\w.-]+)\s*\}\}([\s\S]*?)\{\{\/if\}\}/g, (_, key, content) => {
-    const val = variables[key];
-    return val !== void 0 && val !== "" && val !== "false" && val !== "0" ? content : "";
-  });
+  return template.replace(
+    /\{\{#if\s+([\w.-]+)\s*\}\}([\s\S]*?)\{\{\/if\}\}/g,
+    (_, key, content) => {
+      const val = variables[key];
+      return val !== void 0 && val !== "" && val !== "false" && val !== "0" ? content : "";
+    }
+  );
 }
 function expandLoops(template, variables) {
-  return template.replace(/\{\{#each\s+([\w.-]+)\s*\}\}([\s\S]*?)\{\{\/each\}\}/g, (_, key, content) => {
-    const val = variables[key];
-    if (!val) return "";
-    if (typeof val === "string" && val.includes(",")) {
-      const items = val.split(",").map((s) => s.trim());
-      return items.map((item) => expandTemplate(content, { ...variables, [key]: item, item })).join("\n");
-    }
-    return expandTemplate(content, variables);
-  });
+  return template.replace(
+    /\{\{#each\s+([\w.-]+)\s*\}\}([\s\S]*?)\{\{\/each\}\}/g,
+    (_, key, content) => {
+      const val = variables[key];
+      if (!val) return "";
+      if (typeof val === "string" && val.includes(",")) {
+        const items = val.split(",").map((s) => s.trim());
+        return items.map((item) => expandTemplate(content, { ...variables, [key]: item, item })).join("\n");
+      }
+      return expandTemplate(content, variables);
+    }
+  );
 }
 function renderTemplate(template, variables, escapeHtml = true) {
   let result = template;
@@ -22401,7 +22587,7 @@ var test_coverage_gate_default = plugin56;
 import { execFile as execFile13 } from "node:child_process";
 import { readFileSync as readFileSync15 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname7, isAbsolute as isAbsolute25, relative as relative24, resolve as resolve26 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute25, relative as relative24, resolve as resolve26 } from "node:path";
 var API_VERSION37 = "^0.1.10";
 var state52 = {
   invocationCount: 0,
@@ -22532,7 +22718,7 @@ function resolveTestCommand(baseCommand, testPattern) {
     const packageJson = JSON.parse(readFileSync15(packagePath, "utf8"));
     const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[runner] ?? Object.values(packageJson.bin ?? {})[0];
     if (!relativeBin) return null;
-    const packageDir = dirname7(packagePath);
+    const packageDir = dirname8(packagePath);
     const candidate = resolve26(packageDir, relativeBin);
     if (isAbsolute25(relativeBin) || !isInside2(packageDir, candidate)) {
       return null;
@@ -22661,10 +22847,7 @@ var plugin57 = {
         const commandString = typeof rawCommand === "string" && rawCommand.trim().length > 0 ? rawCommand.trim() : cfg.defaultCommand;
         const rawRuns = input.runs ?? raw["runsRequested"] ?? raw["count"] ?? raw["repeat"] ?? raw["times"];
         const requestedRuns = typeof rawRuns === "number" && rawRuns >= 1 ? Math.min(Math.floor(rawRuns), cfg.maxRuns) : 5;
-        const command = resolveTestCommand(
-          commandString,
-          testPattern
-        );
+        const command = resolveTestCommand(commandString, testPattern);
         if (!command) {
           return {
             ok: false,
@@ -22953,7 +23136,9 @@ function generateTestContent(sourcePath, sourceModule, detected, cfg) {
   }
   if (detected.length === 0) {
     lines.push(`  it('has no exported symbols to test', () => {`);
-    lines.push(cfg.framework === "node:test" ? `    assert.ok(true);` : `    expect(true).toBe(true);`);
+    lines.push(
+      cfg.framework === "node:test" ? `    assert.ok(true);` : `    expect(true).toBe(true);`
+    );
     lines.push(`  });`);
   }
   lines.push(`});`);
@@ -23180,7 +23365,7 @@ var test_generator_default = plugin58;
 // src/test-runner-gate/index.ts
 import { execFile as execFile14 } from "node:child_process";
 import { access as access5 } from "node:fs/promises";
-import { basename as basename6, dirname as dirname8, isAbsolute as isAbsolute27, join as join7 } from "node:path";
+import { basename as basename6, dirname as dirname9, isAbsolute as isAbsolute27, join as join7 } from "node:path";
 import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
 function resolveExec(command, args) {
   const resolved = resolveWin32Command(command);
@@ -23273,7 +23458,7 @@ var ALLOWED_COMMAND_TOKENS = /* @__PURE__ */ new Set([
 function resolveTestFiles(sourcePath, patterns) {
   const name = basename6(sourcePath).replace(/\.[^.]+$/, "");
   const pathNoExt = sourcePath.replace(/\.[^.]+$/, "");
-  const dir = dirname8(sourcePath);
+  const dir = dirname9(sourcePath);
   const candidates = [];
   for (const pattern of patterns) {
     const candidate = pattern.replace(/\{name\}/g, name).replace(/\{path\}/g, pathNoExt).replace(/\{dir\}/g, dir);
@@ -23311,13 +23496,18 @@ async function detectRunner(requested) {
     try {
       await new Promise((resolve28, reject) => {
         const ex = resolveExec("npx", [`${match.name}`, "--version"]);
-        execFile14(ex.cmd, ex.args, {
-          encoding: "utf-8",
-          timeout: 5e3,
-          cwd: process.cwd(),
-          windowsHide: true,
-          ...ex.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
-        }, (err) => err ? reject(err) : resolve28());
+        execFile14(
+          ex.cmd,
+          ex.args,
+          {
+            encoding: "utf-8",
+            timeout: 5e3,
+            cwd: process.cwd(),
+            windowsHide: true,
+            ...ex.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
+          },
+          (err) => err ? reject(err) : resolve28()
+        );
       });
       return match;
     } catch {
@@ -23328,13 +23518,18 @@ async function detectRunner(requested) {
     try {
       await new Promise((resolve28, reject) => {
         const ex = resolveExec("npx", [`${candidate.name}`, "--version"]);
-        execFile14(ex.cmd, ex.args, {
-          encoding: "utf-8",
-          timeout: 5e3,
-          cwd: process.cwd(),
-          windowsHide: true,
-          ...ex.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
-        }, (err) => err ? reject(err) : resolve28());
+        execFile14(
+          ex.cmd,
+          ex.args,
+          {
+            encoding: "utf-8",
+            timeout: 5e3,
+            cwd: process.cwd(),
+            windowsHide: true,
+            ...ex.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
+          },
+          (err) => err ? reject(err) : resolve28()
+        );
       });
       return candidate;
     } catch {
@@ -23602,7 +23797,9 @@ var plugin59 = {
 Fix the failing tests or revert the change if it broke something.`
       };
     };
-    state54.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state54.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "test_gate_status",
       description: "Reports test-runner-gate state: command, patterns, and per-session pass/fail/error/no-test counters.",
@@ -23908,7 +24105,7 @@ var todo_listener_default = plugin60;
 // src/todo-tracker/index.ts
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
-import { dirname as dirname9 } from "node:path";
+import { dirname as dirname10 } from "node:path";
 import { atomicWrite as atomicWrite3, ensureDir as ensureDir3 } from "@wrongstack/core/utils";
 import { nowIso } from "@wrongstack/primitives";
 function deriveFilePath(api) {
@@ -23941,7 +24138,7 @@ async function loadFile(filePath) {
   }
 }
 async function saveFile(filePath, file) {
-  await ensureDir3(dirname9(filePath));
+  await ensureDir3(dirname10(filePath));
   await atomicWrite3(filePath, JSON.stringify(file, null, 2), { mode: 384 });
 }
 var state56 = {
@@ -24848,7 +25045,7 @@ var plugin63 = {
 var token_throttle_default = plugin63;
 
 // src/type-gate/index.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 var API_VERSION41 = "^0.1.10";
 var state59 = {
   invocationCount: 0,
@@ -24932,7 +25129,7 @@ async function runTypeCheck(cfg) {
       argv = [...argv, "-p", tsConfig];
     }
   }
-  if (!cfg.command && tsConfig && !existsSync7(tsConfig)) {
+  if (!cfg.command && tsConfig && !existsSync8(tsConfig)) {
     return null;
   }
   const result = await (0, runtime_exports.runRunnerCommand)([argv[0], ...argv.slice(1)], {
@@ -25070,7 +25267,9 @@ Fix the type error(s) or adjust the change.`;
       }
       return { additionalContext: message };
     };
-    state59.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, { background: true });
+    state59.hookUnregister = api.registerHook("PostToolUse", "write|edit", hook, {
+      background: true
+    });
     api.tools.register({
       name: "type_gate_status",
       description: "Reports type-gate state: command, tsconfig, severity, and per-session pass/fail/error counters.",