@wrongstack/plugins 1.0.7 → 1.0.10

package/dist/interface-contract-guard/index.d.ts

@@ -23,7 +23,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core/types';
+import { type Plugin } from '@wrongstack/core/types';
 export interface InterfaceContractFinding {
     interfaceName: string;
     file: string;

package/dist/interface-contract-guard.js

@@ -13,8 +13,9 @@ var __copyProps = (to, from, except, desc) => {
 var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 
 // src/interface-contract-guard/index.ts
-import { readFile } from "node:fs/promises";
+import { readFile, stat } from "node:fs/promises";
 import { isAbsolute, relative, resolve } from "node:path";
+import { ToolValidationError } from "@wrongstack/core/types";
 
 // src/runtime/index.ts
 var runtime_exports = {};
@@ -216,19 +217,26 @@ If you changed member shapes, search the project for implementers/\`satisfies\`/
       category: "Diagnostics",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "interface-contract-guard is disabled" };
+        if (!cfg.enabled) throw new Error("interface-contract-guard is disabled");
         const raw = input ?? {};
         const rawPath = (typeof input.path === "string" && input.path.trim().length > 0 ? input.path.trim() : void 0) ?? (typeof raw["directory"] === "string" ? raw["directory"] : void 0) ?? (typeof raw["dir"] === "string" ? raw["dir"] : void 0) ?? (typeof raw["SearchDirectory"] === "string" ? raw["SearchDirectory"] : void 0) ?? (typeof raw["TargetFile"] === "string" ? raw["TargetFile"] : void 0) ?? (typeof raw["filePath"] === "string" ? raw["filePath"] : void 0) ?? (typeof raw["targetFile"] === "string" ? raw["targetFile"] : void 0) ?? (typeof raw["file"] === "string" ? raw["file"] : void 0) ?? ".";
         if (!(0, runtime_exports.withinProject)(rawPath)) {
-          return { ok: false, error: "path is outside the project root" };
+          throw new ToolValidationError({
+            message: "path is outside the project root",
+            field: "path"
+          });
         }
         state.scanCount += 1;
         let result;
         try {
+          await stat(resolve(process.cwd(), rawPath));
           result = await scanPath(rawPath, cfg);
         } catch (err) {
           state.errorCount += 1;
-          return { ok: false, error: String(err) };
+          throw new Error(
+            `check_interface_contracts failed for ${rawPath}: ${err instanceof Error ? err.message : String(err)}`,
+            { cause: err }
+          );
         }
         state.findingCount += result.findings.length;
         return {

package/dist/knowledge-graph/index.d.ts

@@ -28,7 +28,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core/types';
+import { type Plugin } from '@wrongstack/core/types';
 export interface Fact {
     id: string;
     subject: string;

package/dist/knowledge-graph.js

@@ -1,6 +1,7 @@
 // src/knowledge-graph/index.ts
 import { readFileSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { ToolValidationError } from "@wrongstack/core/types";
 import { atomicWrite, ensureDir } from "@wrongstack/core/utils";
 var API_VERSION = "^0.1.10";
 var state = {
@@ -171,12 +172,9 @@ var plugin = {
       category: "Memory",
       mutating: true,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "knowledge-graph is disabled" };
+        if (!cfg.enabled) throw new Error("knowledge-graph is disabled");
         if (state.facts.length >= cfg.maxFacts) {
-          return {
-            ok: false,
-            error: `fact limit reached (${cfg.maxFacts}). Remove old facts first.`
-          };
+          throw new Error(`fact limit reached (${cfg.maxFacts}). Remove old facts first.`);
         }
         const trim = (s) => String(s ?? "").trim().slice(0, cfg.maxFactChars);
         const raw = input;
@@ -190,7 +188,10 @@ var plugin = {
           input.object ?? raw["target"] ?? raw["val"] ?? raw["value"] ?? raw["obj"] ?? raw["targetEntity"]
         );
         if (!subject || !relation || !object) {
-          return { ok: false, error: "subject, relation, and object are required" };
+          throw new ToolValidationError({
+            message: "subject, relation, and object are required",
+            field: !subject ? "subject" : !relation ? "relation" : "object"
+          });
         }
         const rawConf = typeof input.confidence === "string" ? input.confidence.trim().toLowerCase() : "";
         const confidence = rawConf === "low" || rawConf === "high" || rawConf === "medium" ? rawConf : "medium";
@@ -227,7 +228,7 @@ var plugin = {
       category: "Memory",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "knowledge-graph is disabled" };
+        if (!cfg.enabled) throw new Error("knowledge-graph is disabled");
         state.queries += 1;
         const raw = input;
         const rawQ = (typeof raw["query"] === "string" ? raw["query"] : void 0) ?? (typeof raw["q"] === "string" ? raw["q"] : void 0);
@@ -272,16 +273,17 @@ var plugin = {
       category: "Memory",
       mutating: true,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "knowledge-graph is disabled" };
+        if (!cfg.enabled) throw new Error("knowledge-graph is disabled");
         const before = state.facts.length;
         const raw = input ?? {};
         const rawId = String(input.id ?? raw["factId"] ?? raw["fact_id"] ?? "").trim();
+        if (!rawId) throw new ToolValidationError({ message: "id is required", field: "id" });
         const normalized = rawId.toLowerCase().startsWith("kg-") ? rawId.toLowerCase() : `kg-${rawId.toLowerCase()}`;
         state.facts = state.facts.filter(
           (f) => f.id.toLowerCase() !== normalized && f.id !== rawId
         );
         const removed = before - state.facts.length;
-        if (removed === 0) return { ok: false, error: `no fact matches "${input.id ?? rawId}"` };
+        if (removed === 0) throw new Error(`no fact matches "${input.id ?? rawId}"`);
         state.removals += removed;
         api.metrics.counter("removals", removed);
         const persisted = await persistFacts(resolved);

package/dist/migration-planner/index.d.ts

@@ -25,7 +25,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core/types';
+import { type Plugin } from '@wrongstack/core/types';
 export interface MigrationAiAnalysis {
     summary: string;
     riskLevel: 'low' | 'medium' | 'high' | 'unknown';

package/dist/migration-planner.js

@@ -14,6 +14,7 @@ var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "defau
 
 // src/migration-planner/index.ts
 import { existsSync, readFileSync } from "node:fs";
+import { ToolValidationError } from "@wrongstack/core/types";
 
 // src/runtime/index.ts
 var runtime_exports = {};
@@ -392,7 +393,7 @@ var plugin = {
       category: "Planning",
       mutating: false,
       async execute(input, _ctx, execOpts) {
-        if (!cfg.enabled) return { ok: false, error: "migration-planner is disabled" };
+        if (!cfg.enabled) throw new Error("migration-planner is disabled");
         execOpts?.signal?.throwIfAborted();
         const raw = input ?? {};
         const rawPackage = input.packageName || raw["package"] || raw["pkg"] || raw["name"] || raw["package_name"] || raw["packageName"] || raw["dependency"] || raw["dep"] || raw["module"];
@@ -403,7 +404,10 @@ var plugin = {
         const fromVersion = String(rawFrom ?? "").trim();
         const toVersion = String(rawTo ?? "").trim();
         if (!packageName || !fromVersion || !toVersion) {
-          return { ok: false, error: "packageName, fromVersion, and toVersion are required" };
+          throw new ToolValidationError({
+            message: "packageName, fromVersion, and toVersion are required",
+            field: !packageName ? "packageName" : !fromVersion ? "fromVersion" : "toVersion"
+          });
         }
         const changelog = readChangelog(packageName, cfg);
         let breakingChanges;

package/dist/notify-hub/index.d.ts

@@ -1,4 +1,4 @@
-import type { Plugin } from '@wrongstack/core/types';
+import { type Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/notify-hub.js

@@ -14,6 +14,7 @@ var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "defau
 
 // src/notify-hub/index.ts
 import { lookup } from "node:dns/promises";
+import { ToolValidationError } from "@wrongstack/core/types";
 
 // src/runtime/index.ts
 var runtime_exports = {};
@@ -421,18 +422,19 @@ var plugin = {
       category: "Notifications",
       mutating: true,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "notify-hub is disabled" };
+        if (!cfg.enabled) throw new Error("notify-hub is disabled");
         const ch = state.channel;
         if (!ch) {
-          return {
-            ok: false,
-            error: 'no webhookUrl configured \u2014 set config.extensions["notify-hub"].webhookUrl to enable deliveries'
-          };
+          throw new Error(
+            'no webhookUrl configured \u2014 set config.extensions["notify-hub"].webhookUrl to enable deliveries'
+          );
         }
         const inp = input ?? {};
         const rawMsg = inp["message"] ?? inp["body"] ?? inp["text"] ?? inp["content"] ?? inp["msg"];
         const message = typeof rawMsg === "string" && rawMsg.trim().length > 0 ? rawMsg.trim() : "";
-        if (!message) return { ok: false, error: "message is required" };
+        if (!message) {
+          throw new ToolValidationError({ message: "message is required", field: "message" });
+        }
         const rawTitle = inp["title"] ?? inp["subject"] ?? inp["header"];
         const title = typeof rawTitle === "string" && rawTitle.trim() ? rawTitle.trim() : "WrongStack notification";
         const result = await deliverViaChannel(ch, "manual", {
@@ -441,11 +443,10 @@ var plugin = {
           level: input.level === "warning" || input.level === "critical" ? input.level : "info",
           source: "manual"
         });
-        return {
-          ok: result.ok,
-          circuitOpen: ch.circuitStatus().open,
-          ...result.ok ? {} : { error: result.error ?? "delivery failed" }
-        };
+        if (!result.ok) {
+          throw new Error(`notification delivery failed: ${result.error ?? "unknown error"}`);
+        }
+        return { ok: true, circuitOpen: ch.circuitStatus().open };
       }
     });
     api.tools.register({

package/dist/performance-regression-gate/index.d.ts

@@ -25,7 +25,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core/types';
+import { type Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/performance-regression-gate.js

@@ -1,6 +1,7 @@
 // src/performance-regression-gate/index.ts
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
+import { ToolValidationError } from "@wrongstack/core/types";
 var API_VERSION = "^0.1.10";
 var state = {
   invocationCount: 0,
@@ -67,10 +68,11 @@ function flattenResults(results) {
 function loadResults(path) {
   if (!path || !existsSync(path)) return null;
   try {
-    const raw = JSON.parse(readFileSync(path, "utf-8"));
-    return raw;
-  } catch {
-    return null;
+    return JSON.parse(readFileSync(path, "utf-8"));
+  } catch (err) {
+    throw new Error(`Could not read benchmark results at ${path}: ${String(err)}`, {
+      cause: err
+    });
   }
 }
 function stripVariantSuffix(name) {
@@ -197,7 +199,7 @@ var plugin = {
       mutating: false,
       async execute(input) {
         if (!cfg.enabled) {
-          return { ok: false, error: "performance-regression-gate is disabled" };
+          throw new Error("performance-regression-gate is disabled");
         }
         state.invocationCount += 1;
         const raw = input ?? {};
@@ -208,11 +210,23 @@ var plugin = {
         const resultsPath = resolveProjectPath(resultsPathStr) ?? "";
         if (!resultsPath) {
           state.errorCount += 1;
-          return { ok: false, error: "invalid results path (must be inside project)" };
+          throw new ToolValidationError({
+            message: "invalid results path (must be inside project)",
+            field: "resultsPath"
+          });
+        }
+        let results;
+        try {
+          results = loadResults(resultsPath);
+        } catch (err) {
+          state.errorCount += 1;
+          throw err;
         }
-        const results = loadResults(resultsPath);
         if (!results) {
           state.missingResultsCount += 1;
+          if (resultsPathStr !== "bench-results.json" || rawResultsPath !== "bench-results.json") {
+            throw new Error(`No benchmark results found at ${resultsPathStr}.`);
+          }
           return {
             ok: true,
             hasResults: false,
@@ -241,15 +255,21 @@ var plugin = {
           const baselineResolved = resolveProjectPath(baselinePathStr) ?? "";
           if (!baselineResolved) {
             state.errorCount += 1;
-            return { ok: false, error: "invalid baseline path (must be inside project)" };
+            throw new ToolValidationError({
+              message: "invalid baseline path (must be inside project)",
+              field: "baselinePath"
+            });
+          }
+          let baselineResults;
+          try {
+            baselineResults = loadResults(baselineResolved);
+          } catch (err) {
+            state.errorCount += 1;
+            throw err;
           }
-          const baselineResults = loadResults(baselineResolved);
           if (!baselineResults) {
             state.errorCount += 1;
-            return {
-              ok: false,
-              error: `Could not read baseline results at ${baselinePathStr}.`
-            };
+            throw new Error(`Could not read baseline results at ${baselinePathStr}.`);
           }
           const baseline = flattenResults(baselineResults);
           pairs = pairCrossFile(baseline, current);

package/dist/pr-drafter/index.d.ts

@@ -27,7 +27,16 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core/types';
+import { type Plugin } from '@wrongstack/core/types';
+/**
+ * Extract the commit from git_autocommit's serialized result (`{ok, hash, message, …, diff}`).
+ * Regex, not JSON.parse: the trailing diff can push the text past the output budget and
+ * truncate it. A dry run carries no `hash`, so it records nothing.
+ */
+export declare function parseAutocommitResult(content: string): {
+    hash: string;
+    message: string;
+} | null;
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/pr-drafter.js

@@ -16,6 +16,7 @@ var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "defau
 import { execFile } from "node:child_process";
 import { mkdir, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { ToolValidationError } from "@wrongstack/core/types";
 
 // src/runtime/index.ts
 var runtime_exports = {};
@@ -35,8 +36,23 @@ var state = {
   draftErrors: 0,
   stopInvocations: 0,
   stopHookUnregister: null,
+  postHookUnregister: null,
   eventUnsubscribers: []
 };
+var TRACKED_FILE_TOOLS = /* @__PURE__ */ new Set(["write", "edit", "write_to_file", "replace_file_content"]);
+function parseAutocommitResult(content) {
+  const hash = /"hash":\s*"([0-9a-f]{7,64})"/.exec(content)?.[1];
+  if (!hash) return null;
+  const rawMessage = /"message":\s*("(?:[^"\\]|\\.)*")/.exec(content)?.[1];
+  let message = "commit";
+  if (rawMessage) {
+    try {
+      message = JSON.parse(rawMessage);
+    } catch {
+    }
+  }
+  return { hash, message };
+}
 var DEFAULTS = {
   enabled: true,
   outputPath: ".wrongstack/PR_DRAFT.md",
@@ -219,6 +235,7 @@ var plugin = {
     state.draftErrors = 0;
     state.stopInvocations = 0;
     state.stopHookUnregister = (0, runtime_exports.releaseHandle)(state.stopHookUnregister);
+    state.postHookUnregister = (0, runtime_exports.releaseHandle)(state.postHookUnregister);
     for (const off of state.eventUnsubscribers) {
       try {
         off();
@@ -228,22 +245,24 @@ var plugin = {
     state.eventUnsubscribers = [];
     const cfg = readConfig(api.config.extensions?.["pr-drafter"]);
     if (api.onPattern) {
-      const offTool = api.onPattern("tool.completed", (_event, payload) => {
-        const p = payload;
-        const toolName = p?.tool;
+      const offTool = api.onPattern("tool.completed", () => {
         state.toolCalls += 1;
-        if (toolName === "git_autocommit" && p?.result?.committed) {
-          const msg = p.result.commitMessage ?? p.input?.message ?? "commit";
-          state.commits.push(msg);
-        }
-        const rawInput = p?.input ?? {};
-        const filePath = typeof rawInput["path"] === "string" && rawInput["path"] || typeof rawInput["filePath"] === "string" && rawInput["filePath"] || typeof rawInput["file_path"] === "string" && rawInput["file_path"] || typeof rawInput["TargetFile"] === "string" && rawInput["TargetFile"] || typeof rawInput["targetFile"] === "string" && rawInput["targetFile"] || typeof rawInput["file"] === "string" && rawInput["file"];
-        if ((toolName === "write" || toolName === "edit" || toolName === "write_to_file" || toolName === "replace_file_content") && filePath) {
-          state.files.add(filePath);
-        }
       });
       state.eventUnsubscribers.push(offTool);
     }
+    const postHook = (input) => {
+      if (!input.toolResult || input.toolResult.isError) return;
+      const toolName = input.toolName;
+      if (toolName === "git_autocommit") {
+        const commit = parseAutocommitResult(String(input.toolResult.content ?? ""));
+        if (commit) state.commits.push(commit.message);
+        return;
+      }
+      if (!toolName || !TRACKED_FILE_TOOLS.has(toolName)) return;
+      const rawInput = input.toolInput ?? {};
+      const filePath = ["path", "filePath", "file_path", "TargetFile", "targetFile", "file"].map((key) => rawInput[key]).find((value) => typeof value === "string" && value.length > 0);
+      if (filePath) state.files.add(filePath);
+    };
     if (api.onEvent) {
       const offUsage = api.onEvent("provider.response", (payload) => {
         const p = payload;
@@ -262,6 +281,11 @@ var plugin = {
       await writeDraft(cfg, api.llm);
     };
     state.stopHookUnregister = api.registerHook("Stop", void 0, stopHook);
+    state.postHookUnregister = api.registerHook(
+      "PostToolUse",
+      "git_autocommit|write|edit|write_to_file|replace_file_content",
+      postHook
+    );
     api.tools.register({
       name: "pr_draft",
       description: "Generate or refresh the pull-request draft for the current session. Writes the markdown file and returns its path + title.",
@@ -284,7 +308,7 @@ var plugin = {
       mutating: true,
       capabilities: ["fs.write"],
       async execute(input = {}) {
-        if (!cfg.enabled) return { ok: false, error: "pr-drafter is disabled" };
+        if (!cfg.enabled) throw new Error("pr-drafter is disabled");
         const raw = input ?? {};
         const preview = Boolean(
           input?.preview ?? raw["dryRun"] ?? raw["dry_run"] ?? raw["dry"] ?? raw["previewOnly"]
@@ -296,24 +320,29 @@ var plugin = {
           return { ok: true, preview: true, title: draft.title, body: draft.body };
         }
         const resolved = resolveProjectPath(outputPathStr);
-        if (!resolved) return { ok: false, error: "outputPath resolves outside project" };
+        if (!resolved) {
+          throw new ToolValidationError({
+            message: "outputPath resolves outside project",
+            field: "outputPath"
+          });
+        }
         try {
           await mkdir(dirname(resolved), { recursive: true });
           await writeFile(resolved, draft.body);
-          state.draftsWritten += 1;
-          return {
-            ok: true,
-            path: outputPathStr,
-            resolvedPath: resolved,
-            title: draft.title
-          };
         } catch (err) {
           state.draftErrors += 1;
-          return {
-            ok: false,
-            error: err instanceof Error ? err.message : String(err)
-          };
+          throw new Error(
+            `Could not write PR draft to ${outputPathStr}: ${err instanceof Error ? err.message : String(err)}`,
+            { cause: err }
+          );
         }
+        state.draftsWritten += 1;
+        return {
+          ok: true,
+          path: outputPathStr,
+          resolvedPath: resolved,
+          title: draft.title
+        };
       }
     });
     api.log.info("pr-drafter plugin loaded", {
@@ -330,6 +359,7 @@ var plugin = {
       }
       state.stopHookUnregister = null;
     }
+    state.postHookUnregister = (0, runtime_exports.releaseHandle)(state.postHookUnregister);
     for (const off of state.eventUnsubscribers) {
       try {
         off();
@@ -371,5 +401,6 @@ var plugin = {
 };
 var pr_drafter_default = plugin;
 export {
-  pr_drafter_default as default
+  pr_drafter_default as default,
+  parseAutocommitResult
 };

package/dist/refactor-suggester/index.d.ts

@@ -23,7 +23,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core/types';
+import { type Plugin } from '@wrongstack/core/types';
 export type SmellType = 'long-function' | 'deep-nesting' | 'many-parameters' | 'magic-number' | 'console-log';
 export interface RefactorSuggestion {
     file: string;

package/dist/refactor-suggester.js

@@ -13,8 +13,9 @@ var __copyProps = (to, from, except, desc) => {
 var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 
 // src/refactor-suggester/index.ts
-import { readFile } from "node:fs/promises";
+import { readFile, stat } from "node:fs/promises";
 import { isAbsolute, relative, resolve } from "node:path";
+import { ToolValidationError } from "@wrongstack/core/types";
 
 // src/runtime/index.ts
 var runtime_exports = {};
@@ -311,11 +312,23 @@ var plugin = {
       category: "Diagnostics",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "refactor-suggester is disabled" };
+        if (!cfg.enabled) throw new Error("refactor-suggester is disabled");
         const raw = input ?? {};
         const rawPath = (typeof input.path === "string" && input.path.trim().length > 0 ? input.path.trim() : void 0) ?? (typeof raw["directory"] === "string" ? raw["directory"] : void 0) ?? (typeof raw["dir"] === "string" ? raw["dir"] : void 0) ?? (typeof raw["SearchDirectory"] === "string" ? raw["SearchDirectory"] : void 0) ?? (typeof raw["TargetFile"] === "string" ? raw["TargetFile"] : void 0) ?? (typeof raw["filePath"] === "string" ? raw["filePath"] : void 0) ?? (typeof raw["targetFile"] === "string" ? raw["targetFile"] : void 0) ?? ".";
         if (!(0, runtime_exports.withinProject)(rawPath)) {
-          return { ok: false, error: "path is outside the project root" };
+          throw new ToolValidationError({
+            message: "path is outside the project root",
+            field: "path"
+          });
+        }
+        try {
+          await stat(resolve(process.cwd(), rawPath));
+        } catch (err) {
+          throw new ToolValidationError({
+            message: `path does not exist or cannot be read: ${rawPath}`,
+            field: "path",
+            cause: err
+          });
         }
         state.scanCount += 1;
         let result;
@@ -323,7 +336,7 @@ var plugin = {
           result = await scanPath(rawPath, cfg);
         } catch (err) {
           state.errorCount += 1;
-          return { ok: false, error: String(err) };
+          throw new Error(`refactor scan failed: ${String(err)}`, { cause: err });
         }
         state.suggestionCount += result.suggestions.length;
         return {

package/dist/release-notes-generator.js

@@ -284,7 +284,7 @@ var plugin = {
       category: "Development",
       mutating: false,
       async execute(input, _ctx, execOpts) {
-        if (!cfg.enabled) return { ok: false, error: "release-notes-generator is disabled" };
+        if (!cfg.enabled) throw new Error("release-notes-generator is disabled");
         execOpts?.signal?.throwIfAborted();
         const raw = input ?? {};
         const rawTo = input.to ?? raw["to_ref"] ?? raw["toRef"] ?? raw["until"] ?? raw["end"];
@@ -299,7 +299,7 @@ var plugin = {
           commits = await getCommits(fromRef, toRef, execOpts?.signal);
         } catch (err) {
           state.errorCount += 1;
-          return { ok: false, error: String(err) };
+          throw new Error(`Could not read git history: ${String(err)}`, { cause: err });
         }
         state.commitCount += commits.length;
         execOpts?.signal?.throwIfAborted();

package/dist/secret-scanner/index.d.ts

@@ -26,7 +26,7 @@
  * They share the same threat model but act at different points in the
  * pipeline.
  */
-import type { Plugin } from '@wrongstack/core/types';
+import { type Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/secret-scanner.js

@@ -12,6 +12,9 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 
+// src/secret-scanner/index.ts
+import { ToolValidationError } from "@wrongstack/core/types";
+
 // src/runtime/credential-patterns.ts
 import {
   cloneCredentialPatterns,
@@ -447,9 +450,14 @@ var plugin = {
       mutating: false,
       async execute(input) {
         activateRuntime(runtime);
-        const rawText = input["text"] ?? input["content"] ?? input["string"] ?? input["input"] ?? input["code"] ?? input["value"] ?? "";
-        const text = typeof rawText === "string" ? rawText : "";
-        const matched = findMatches(text);
+        const rawText = input["text"] ?? input["content"] ?? input["string"] ?? input["input"] ?? input["code"] ?? input["value"];
+        if (typeof rawText !== "string") {
+          throw new ToolValidationError({
+            message: "text is required and must be a string",
+            field: "text"
+          });
+        }
+        const matched = findMatches(rawText);
         return {
           ok: true,
           matched,

package/dist/security-hotspot-scanner/index.d.ts

@@ -22,7 +22,7 @@
  *
  * @public
  */
-import type { Plugin } from '@wrongstack/core/types';
+import { type Plugin } from '@wrongstack/core/types';
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/security-hotspot-scanner.js

@@ -15,6 +15,7 @@ var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "defau
 // src/security-hotspot-scanner/index.ts
 import { readdir, readFile, stat } from "node:fs/promises";
 import { extname, isAbsolute, relative, resolve } from "node:path";
+import { ToolValidationError } from "@wrongstack/core/types";
 
 // src/runtime/index.ts
 var runtime_exports = {};
@@ -335,7 +336,7 @@ Review or remove the risky pattern(s).`;
       category: "Security",
       mutating: false,
       async execute(input) {
-        if (!cfg.enabled) return { ok: false, error: "security-hotspot-scanner is disabled" };
+        if (!cfg.enabled) throw new Error("security-hotspot-scanner is disabled");
         const raw = input;
         const targetPath = (typeof input.path === "string" ? input.path : void 0) ?? (typeof raw["directory"] === "string" ? raw["directory"] : void 0) ?? (typeof raw["dir"] === "string" ? raw["dir"] : void 0) ?? (typeof raw["SearchDirectory"] === "string" ? raw["SearchDirectory"] : void 0) ?? (typeof raw["TargetFile"] === "string" ? raw["TargetFile"] : void 0) ?? (typeof raw["filePath"] === "string" ? raw["filePath"] : void 0) ?? (typeof raw["targetFile"] === "string" ? raw["targetFile"] : void 0) ?? ".";
         const result = await scanPath(targetPath, cfg);
@@ -343,7 +344,10 @@ Review or remove the risky pattern(s).`;
         state.fileScanCount += result.filesScanned;
         state.findingCount += result.findings.length;
         if (!result.scanned) {
-          return { ok: false, error: result.error, path: targetPath };
+          throw new ToolValidationError({
+            message: `cannot scan ${targetPath}: ${result.error ?? "unknown error"}`,
+            field: "path"
+          });
         }
         state.lastResult = {
           path: result.path,