@wrongstack/tools 0.1.9 → 0.2.0

package/dist/audit.js

@@ -1,22 +1,8 @@
-import * as path from 'path';
 import { spawn } from 'child_process';
+import { buildChildEnv } from '@wrongstack/core';
+import * as path from 'path';
 
-// src/_util.ts
-function resolvePath(input, ctx) {
-  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);
-}
-function ensureInsideRoot(absPath, ctx) {
-  const root = path.resolve(ctx.projectRoot);
-  const target = path.resolve(absPath);
-  const rel = path.relative(root, target);
-  if (rel.startsWith("..") || path.isAbsolute(rel)) {
-    throw new Error(`Path "${absPath}" is outside project root "${root}"`);
-  }
-  return target;
-}
-function safeResolve(input, ctx) {
-  return ensureInsideRoot(resolvePath(input, ctx), ctx);
-}
+// src/_spawn-stream.ts
 async function* spawnStream(opts) {
   const max = opts.maxBytes;
   const flushAt = opts.flushBytes ?? 4 * 1024;
@@ -27,6 +13,7 @@ async function* spawnStream(opts) {
   const child = spawn(opts.cmd, opts.args, {
     cwd: opts.cwd,
     signal: opts.signal,
+    env: buildChildEnv(),
     stdio: ["ignore", "pipe", "pipe"]
   });
   const queue = [];
@@ -94,6 +81,21 @@ async function* spawnStream(opts) {
     error
   };
 }
+function resolvePath(input, ctx) {
+  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);
+}
+function ensureInsideRoot(absPath, ctx) {
+  const root = path.resolve(ctx.projectRoot);
+  const target = path.resolve(absPath);
+  const rel = path.relative(root, target);
+  if (rel.startsWith("..") || path.isAbsolute(rel)) {
+    throw new Error(`Path "${absPath}" is outside project root "${root}"`);
+  }
+  return target;
+}
+function safeResolve(input, ctx) {
+  return ensureInsideRoot(resolvePath(input, ctx), ctx);
+}
 
 // src/audit.ts
 var auditTool = {

package/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/_util.ts","../src/_spawn-stream.ts","../src/audit.ts"],"names":["resolve"],"mappings":";;;;AAGO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAY,IAAA,CAAA,UAAA,CAAW,KAAK,CAAA,GAAS,IAAA,CAAA,SAAA,CAAU,KAAK,CAAA,GAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AACrF;AAEO,SAAS,gBAAA,CAAiB,SAAiB,GAAA,EAAsB;AACtE,EAAA,MAAM,IAAA,GAAY,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AACzC,EAAA,MAAM,MAAA,GAAc,aAAQ,OAAO,CAAA;AACnC,EAAA,MAAM,GAAA,GAAW,IAAA,CAAA,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AACtC,EAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,IAAU,IAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AAChD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,OAAO,CAAA,2BAAA,EAA8B,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,EACvE;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAO,gBAAA,CAAiB,WAAA,CAAY,KAAA,EAAO,GAAG,GAAG,GAAG,CAAA;AACtD;ACSA,gBAAuB,YACrB,IAAA,EACsD;AACtD,EAAA,MAAM,GAAA,GAAM,KAAK,QAAY;AAC7B,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,IAAc,CAAA,GAAI,IAAA;AACvC,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,IAAI,KAAA;AAEJ,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,IAAA,CAAK,GAAA,EAAK,KAAK,IAAA,EAAM;AAAA,IACvC,KAAK,IAAA,CAAK,GAAA;AAAA,IACV,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,GACjC,CAAA;AAGD,EAAA,MAAM,QAAiB,EAAC;AACxB,EAAA,IAAI,MAAA;AACJ,EAAA,MAAM,OAAO,MAAM;AACjB,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAM,CAAA,GAAI,MAAA;AACV,MAAA,MAAA,GAAS,MAAA;AACT,MAAA,CAAA,EAAE;AAAA,IACJ;AAAA,EACF,CAAA;AAEA,EAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,IAAA,MAAM,CAAA,GAAI,EAAE,QAAA,EAAS;AACrB,IAAA,IAAI,MAAA,CAAO,MAAA,GAAS,GAAA,EAAK,MAAA,IAAU,CAAA;AACnC,IAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,GAAG,CAAA;AACnC,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AACD,EAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,IAAA,MAAM,CAAA,GAAI,EAAE,QAAA,EAAS;AACrB,IAAA,IAAI,MAAA,CAAO,MAAA,GAAS,GAAA,EAAK,MAAA,IAAU,CAAA;AACnC,IAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,GAAG,CAAA;AACnC,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AACD,EAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,CAAA,KAAM;AACvB,IAAA,KAAA,GAAQ,CAAA,CAAE,OAAA;AACV,IAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,SAAS,IAAA,EAAM,CAAA,CAAE,SAAS,CAAA;AAC7C,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AACD,EAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,IAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,EAAA,EAAI,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,CAAA;AACvD,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AAED,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,IAAI,WAAA,GAAc,KAAA;AAClB,EAAA,WAAS;AACP,IAAA,OAAO,KAAA,CAAM,WAAW,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,OAAA,CAAc,CAACA,QAAAA,KAAY;AACnC,QAAA,MAAA,GAASA,QAAAA;AAAA,MACX,CAAC,CAAA;AAAA,IACH;AACA,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,EAAM;AAC1B,IAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAG1B,MAAA,IAAI,CAAC,WAAA,EAAa,QAAA,GAAW,KAAA,CAAM,IAAA,IAAQ,CAAA;AAC3C,MAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,MAAA,WAAA,GAAc,IAAA;AACd,MAAA,QAAA,GAAW,CAAA;AAEX,MAAA;AAAA,IACF;AACA,IAAA,OAAA,IAAW,KAAA,CAAM,IAAA;AACjB,IAAA,IAAI,OAAA,CAAQ,UAAU,OAAA,EAAS;AAC7B,MAAA,MAAM,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,OAAA,EAAQ;AAC9C,MAAA,OAAA,GAAU,EAAA;AAAA,IACZ;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,MAAM,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,OAAA,EAAQ;AAAA,EAChD;AAEA,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,SAAA,EAAW,MAAA,CAAO,MAAA,IAAU,GAAA,IAAO,OAAO,MAAA,IAAU,GAAA;AAAA,IACpD;AAAA,GACF;AACF;;;ACxFO,IAAM,SAAA,GAA2C;AAAA,EACtD,IAAA,EAAM,OAAA;AAAA,EACN,WAAA,EACE,0EAAA;AAAA,EACF,SAAA,EACE,uGAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,KAAA;AAAA,EACV,SAAA,EAAW,GAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,kCAAA,EAAmC;AAAA,MACvE,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,KAAA,EAAO,UAAA,EAAY,QAAQ,UAAU,CAAA;AAAA,QAC5C,WAAA,EAAa;AAAA,OACf;AAAA,MACA,GAAA,EAAK,EAAE,IAAA,EAAM,SAAA,EAAW,aAAa,iDAAA,EAAkD;AAAA,MACvF,QAAA,EAAU,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,gDAAA;AAAiD;AAC5F,GACF;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,KAAA;AACJ,IAAA,WAAA,MAAiB,MAAM,SAAA,CAAU,aAAA,CAAe,KAAA,EAAO,GAAA,EAAK,IAAI,CAAA,EAAG;AACjE,MAAA,IAAI,EAAA,CAAG,IAAA,KAAS,OAAA,EAAS,KAAA,GAAQ,EAAA,CAAG,MAAA;AAAA,IACtC;AACA,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,yCAAyC,CAAA;AACrE,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAAA,EACA,OAAO,aAAA,CAAc,KAAA,EAAO,GAAA,EAAK,IAAA,EAAoD;AACnF,IAAA,MAAM,GAAA,GAAM,MAAM,GAAA,GAAM,WAAA,CAAY,MAAM,GAAA,EAAK,GAAG,IAAI,GAAA,CAAI,GAAA;AAC1D,IAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,GAAG,CAAA;AACvC,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA,cAAA,EAAiB,OAAO,CAAA,MAAA,CAAA,EAAK,IAAA,EAAM,EAAE,OAAA,EAAQ,EAAE;AAE1E,IAAA,MAAM,IAAA,GAAO,CAAC,OAAA,EAAS,QAAQ,CAAA;AAC/B,IAAA,IAAI,KAAA,CAAM,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA;AAChC,IAAA,IAAI,MAAM,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,GAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA,GAAI,KAAA,CAAM,QAAA,GAAW,KAAA,CAAM,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AACtF,MAAA,IAAA,CAAK,IAAA,CAAK,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAc,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAAA,IAChD;AAEA,IAAA,MAAM,MAAA,GAAS,OAAO,WAAA,CAAY;AAAA,MAChC,GAAA,EAAK,OAAA;AAAA,MACL,IAAA;AAAA,MACA,GAAA;AAAA,MACA,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACX,CAAA;AAED,IAAA,MAAM,EAAE,MAAM,OAAA,EAAS,MAAA,EAAQ,iBAAiB,MAAA,CAAO,MAAA,EAAQ,MAAA,CAAO,QAAQ,CAAA,EAAE;AAAA,EAClF;AACF;AAEA,eAAe,cAAc,GAAA,EAA8B;AACzD,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,OAAO,aAAkB,CAAA;AAChD,EAAA,IAAI;AAAE,IAAA,MAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,eAAA,CAAiB,CAAA;AAAG,IAAA,OAAO,MAAA;AAAA,EAAQ,CAAA,CAAA,MAAQ;AAAA,EAAQ;AAC1E,EAAA,IAAI;AAAE,IAAA,MAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,UAAA,CAAY,CAAA;AAAG,IAAA,OAAO,MAAA;AAAA,EAAQ,CAAA,CAAA,MAAQ;AAAA,EAAQ;AACrE,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,gBAAA,CAAiB,MAAc,QAAA,EAA+B;AACrE,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,iBAAiB,EAAC;AAAA,MAClB,KAAA,EAAO,CAAA;AAAA,MACP,OAAA,EAAS,QAAA,KAAa,CAAA,GAAI,0BAAA,GAA6B,cAAA;AAAA,MACvD,MAAA,EAAQ,EAAA;AAAA,MACR,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC5B,IAAA,MAAM,aAAmC,EAAC;AAC1C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,UAAA,IAAc,EAAC;AAChC,IAAA,KAAA,MAAW,EAAA,IAAM,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AACjC,MAAA,MAAM,GAAA,GAAM,IAAI,EAAE,CAAA;AAClB,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,QAAA,EAAU,IAAI,QAAA,IAAY,SAAA;AAAA,QAC1B,OAAA,EAAS,IAAI,WAAA,IAAe,EAAA;AAAA,QAC5B,KAAA,EAAO,IAAI,KAAA,IAAS,uBAAA;AAAA,QACpB,GAAA,EAAK,IAAI,GAAA,IAAO;AAAA,OACjB,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAA;AACzB,IAAA,MAAM,OAAA,GAAU,KAAA,KAAU,CAAA,GACtB,0BAAA,GACA,CAAA,MAAA,EAAS,KAAK,CAAA,kBAAA,EAAqB,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,UAAU,CAAA,CAAE,MAAM,CAAA,WAAA,EAAc,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,KAAa,MAAM,CAAA,CAAE,MAAM,CAAA,KAAA,CAAA;AAErK,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,eAAA,EAAiB,UAAA;AAAA,MACjB,KAAA;AAAA,MACA,OAAA;AAAA,MACA,MAAA,EAAQ,IAAA;AAAA,MACR,SAAA,EAAW,KAAK,MAAA,IAAU;AAAA,KAC5B;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,iBAAiB,EAAC;AAAA,MAClB,KAAA,EAAO,CAAA;AAAA,MACP,OAAA,EAAS,8BAAA;AAAA,MACT,MAAA,EAAQ,IAAA;AAAA,MACR,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AACF","file":"audit.js","sourcesContent":["import * as path from 'node:path';\nimport type { Context } from '@wrongstack/core';\n\r\nexport function resolvePath(input: string, ctx: Context): string {\r\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);\r\n}\r\n\r\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\r\n  const root = path.resolve(ctx.projectRoot);\r\n  const target = path.resolve(absPath);\r\n  const rel = path.relative(root, target);\r\n  if (rel.startsWith('..') || path.isAbsolute(rel)) {\r\n    throw new Error(`Path \"${absPath}\" is outside project root \"${root}\"`);\r\n  }\r\n  return target;\r\n}\r\n\r\nexport function safeResolve(input: string, ctx: Context): string {\r\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\r\n}\r\n\r\nexport function truncateMiddle(s: string, max: number): string {\r\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\r\n  const half = Math.floor(max / 2);\r\n  return (\r\n    s.slice(0, half) +\r\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\r\n    s.slice(-half)\r\n  );\r\n}\r\n\r\nexport function isBinaryBuffer(buf: Buffer): boolean {\r\n  const len = Math.min(buf.length, 8192);\r\n  for (let i = 0; i < len; i++) {\r\n    if (buf[i] === 0) return true;\r\n  }\r\n  return false;\r\n}\r\n\r\n","import { spawn } from 'node:child_process';\nimport type { ToolProgressEvent } from '@wrongstack/core';\n\nexport interface SpawnStreamResult {\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  truncated: boolean;\n  error?: string;\n}\n\nexport interface SpawnStreamOptions {\n  cmd: string;\n  args: string[];\n  cwd: string;\n  signal: AbortSignal;\n  maxBytes?: number;\n  /** Bytes of new stdout/stderr to accumulate before yielding a `partial_output` event. */\n  flushBytes?: number;\n}\n\n/**\n * Spawn a child process and yield `partial_output` progress events as\n * stdout/stderr arrive (batched by byte threshold), then return the full\n * buffered result. Shared between install/lint/format/typecheck/test/audit\n * so the TUI live tail sees consistent progress regardless of which tool\n * is running.\n */\nexport async function* spawnStream(\n  opts: SpawnStreamOptions,\n): AsyncGenerator<ToolProgressEvent, SpawnStreamResult> {\n  const max = opts.maxBytes ?? 200_000;\n  const flushAt = opts.flushBytes ?? 4 * 1024;\n  let stdout = '';\n  let stderr = '';\n  let pending = '';\n  let error: string | undefined;\n\n  const child = spawn(opts.cmd, opts.args, {\n    cwd: opts.cwd,\n    signal: opts.signal,\n    stdio: ['ignore', 'pipe', 'pipe'],\n  });\n\n  type Chunk = { kind: 'out' | 'err' | 'close' | 'error'; data: string; code?: number };\n  const queue: Chunk[] = [];\n  let waiter: (() => void) | undefined;\n  const wake = () => {\n    if (waiter) {\n      const w = waiter;\n      waiter = undefined;\n      w();\n    }\n  };\n\n  child.stdout?.on('data', (c) => {\n    const s = c.toString();\n    if (stdout.length < max) stdout += s;\n    queue.push({ kind: 'out', data: s });\n    wake();\n  });\n  child.stderr?.on('data', (c) => {\n    const s = c.toString();\n    if (stderr.length < max) stderr += s;\n    queue.push({ kind: 'err', data: s });\n    wake();\n  });\n  child.on('error', (e) => {\n    error = e.message;\n    queue.push({ kind: 'error', data: e.message });\n    wake();\n  });\n  child.on('close', (code) => {\n    queue.push({ kind: 'close', data: '', code: code ?? 0 });\n    wake();\n  });\n\n  let exitCode = 0;\n  let spawnFailed = false;\n  for (;;) {\n    while (queue.length === 0) {\n      await new Promise<void>((resolve) => {\n        waiter = resolve;\n      });\n    }\n    const chunk = queue.shift()!;\n    if (chunk.kind === 'close') {\n      // If we already saw a spawn error (ENOENT etc.), keep exitCode=1\n      // rather than the negative platform code Node fabricates.\n      if (!spawnFailed) exitCode = chunk.code ?? 0;\n      break;\n    }\n    if (chunk.kind === 'error') {\n      spawnFailed = true;\n      exitCode = 1;\n      // close usually follows\n      continue;\n    }\n    pending += chunk.data;\n    if (pending.length >= flushAt) {\n      yield { type: 'partial_output', text: pending };\n      pending = '';\n    }\n  }\n  if (pending.length > 0) {\n    yield { type: 'partial_output', text: pending };\n  }\n\n  return {\n    stdout,\n    stderr,\n    exitCode,\n    truncated: stdout.length >= max || stderr.length >= max,\n    error,\n  };\n}\n","import type { Tool, ToolStreamEvent } from '@wrongstack/core';\r\nimport { safeResolve } from './_util.js';\nimport { spawnStream } from './_spawn-stream.js';\n\r\ninterface AuditInput {\r\n  cwd?: string;\r\n  level?: 'low' | 'moderate' | 'high' | 'critical';\r\n  fix?: boolean;\r\n  packages?: string | string[];\r\n}\r\n\r\ninterface AuditVulnerability {\r\n  severity: string;\r\n  package: string;\r\n  title: string;\r\n  url: string;\r\n}\r\n\r\ninterface AuditOutput {\r\n  exit_code: number;\r\n  vulnerabilities: AuditVulnerability[];\r\n  total: number;\r\n  summary: string;\r\n  output: string;\r\n  truncated: boolean;\r\n}\r\n\r\nexport const auditTool: Tool<AuditInput, AuditOutput> = {\r\n  name: 'audit',\r\n  description:\r\n    'Run npm/pnpm security audit. Returns vulnerabilities sorted by severity.',\r\n  usageHint:\r\n    'Set `level` to filter minimum severity. `fix` attempts auto-fix. `packages` checks specific packages.',\r\n  permission: 'confirm',\r\n  mutating: false,\r\n  timeoutMs: 60_000,\r\n  inputSchema: {\r\n    type: 'object',\r\n    properties: {\r\n      cwd: { type: 'string', description: 'Working directory (default: cwd)' },\r\n      level: {\r\n        type: 'string',\r\n        enum: ['low', 'moderate', 'high', 'critical'],\r\n        description: 'Minimum severity level to report',\r\n      },\r\n      fix: { type: 'boolean', description: 'Attempt to fix vulnerabilities (default: false)' },\r\n      packages: { type: 'string', description: 'Specific package(s) to audit (comma-separated)' },\r\n    },\r\n  },\r\n  async execute(input, ctx, opts) {\r\n    let final: AuditOutput | undefined;\r\n    for await (const ev of auditTool.executeStream!(input, ctx, opts)) {\r\n      if (ev.type === 'final') final = ev.output;\r\n    }\r\n    if (!final) throw new Error('audit: stream ended without final event');\r\n    return final;\r\n  },\r\n  async *executeStream(input, ctx, opts): AsyncGenerator<ToolStreamEvent<AuditOutput>> {\r\n    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;\r\n    const manager = await detectManager(cwd);\r\n    yield { type: 'log', text: `Auditing with ${manager}…`, data: { manager } };\r\n\r\n    const args = ['audit', '--json'];\r\n    if (input.fix) args.push('--fix');\r\n    if (input.packages) {\r\n      const pkgs = Array.isArray(input.packages) ? input.packages : input.packages.split(',');\r\n      args.push(...pkgs.map((p: string) => p.trim()));\r\n    }\r\n\r\n    const result = yield* spawnStream({\r\n      cmd: manager,\r\n      args,\r\n      cwd,\r\n      signal: opts.signal,\r\n      maxBytes: 100_000,\r\n    });\r\n\r\n    yield { type: 'final', output: parseAuditOutput(result.stdout, result.exitCode) };\r\n  },\r\n};\r\n\r\nasync function detectManager(cwd: string): Promise<string> {\r\n  const { stat } = await import('node:fs/promises');\r\n  try { await stat(`${cwd}/pnpm-lock.yaml`); return 'pnpm'; } catch { /* */ }\r\n  try { await stat(`${cwd}/yarn.lock`); return 'yarn'; } catch { /* */ }\r\n  return 'npm';\r\n}\r\n\r\nfunction parseAuditOutput(json: string, exitCode: number): AuditOutput {\r\n  if (!json) {\r\n    return {\r\n      exit_code: exitCode,\r\n      vulnerabilities: [],\r\n      total: 0,\r\n      summary: exitCode === 0 ? 'No vulnerabilities found' : 'Audit failed',\r\n      output: '',\r\n      truncated: false,\r\n    };\r\n  }\r\n\r\n  try {\r\n    const data = JSON.parse(json);\r\n    const advisories: AuditVulnerability[] = [];\r\n    const ads = data.advisories ?? {};\r\n    for (const id of Object.keys(ads)) {\r\n      const adv = ads[id];\r\n      advisories.push({\r\n        severity: adv.severity ?? 'unknown',\r\n        package: adv.module_name ?? id,\r\n        title: adv.title ?? 'Unknown vulnerability',\r\n        url: adv.url ?? '',\r\n      });\r\n    }\r\n\r\n    const total = advisories.length;\r\n    const summary = total === 0\r\n      ? 'No vulnerabilities found'\r\n      : `Found ${total} vulnerabilities: ${advisories.filter((a) => a.severity === 'critical').length} critical, ${advisories.filter((a) => a.severity === 'high').length} high`;\r\n\r\n    return {\r\n      exit_code: exitCode,\r\n      vulnerabilities: advisories,\r\n      total,\r\n      summary,\r\n      output: json,\r\n      truncated: json.length >= 100_000,\r\n    };\r\n  } catch {\r\n    return {\r\n      exit_code: exitCode,\r\n      vulnerabilities: [],\r\n      total: 0,\r\n      summary: 'Could not parse audit output',\r\n      output: json,\r\n      truncated: false,\r\n    };\r\n  }\r\n}\r\n"]}
+{"version":3,"sources":["../src/_spawn-stream.ts","../src/_util.ts","../src/audit.ts"],"names":["resolve"],"mappings":";;;;;AA6BA,gBAAuB,YACrB,IAAA,EACsD;AACtD,EAAA,MAAM,GAAA,GAAM,KAAK,QAAY;AAC7B,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,IAAc,CAAA,GAAI,IAAA;AACvC,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,IAAI,KAAA;AAEJ,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,IAAA,CAAK,GAAA,EAAK,KAAK,IAAA,EAAM;AAAA,IACvC,KAAK,IAAA,CAAK,GAAA;AAAA,IACV,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,KAAK,aAAA,EAAc;AAAA,IACnB,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,GACjC,CAAA;AAGD,EAAA,MAAM,QAAiB,EAAC;AACxB,EAAA,IAAI,MAAA;AACJ,EAAA,MAAM,OAAO,MAAM;AACjB,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAM,CAAA,GAAI,MAAA;AACV,MAAA,MAAA,GAAS,MAAA;AACT,MAAA,CAAA,EAAE;AAAA,IACJ;AAAA,EACF,CAAA;AAEA,EAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,IAAA,MAAM,CAAA,GAAI,EAAE,QAAA,EAAS;AACrB,IAAA,IAAI,MAAA,CAAO,MAAA,GAAS,GAAA,EAAK,MAAA,IAAU,CAAA;AACnC,IAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,GAAG,CAAA;AACnC,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AACD,EAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAM;AAC9B,IAAA,MAAM,CAAA,GAAI,EAAE,QAAA,EAAS;AACrB,IAAA,IAAI,MAAA,CAAO,MAAA,GAAS,GAAA,EAAK,MAAA,IAAU,CAAA;AACnC,IAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,GAAG,CAAA;AACnC,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AACD,EAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,CAAA,KAAM;AACvB,IAAA,KAAA,GAAQ,CAAA,CAAE,OAAA;AACV,IAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,SAAS,IAAA,EAAM,CAAA,CAAE,SAAS,CAAA;AAC7C,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AACD,EAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,IAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,EAAA,EAAI,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,CAAA;AACvD,IAAA,IAAA,EAAK;AAAA,EACP,CAAC,CAAA;AAED,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,IAAI,WAAA,GAAc,KAAA;AAClB,EAAA,WAAS;AACP,IAAA,OAAO,KAAA,CAAM,WAAW,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,OAAA,CAAc,CAACA,QAAAA,KAAY;AACnC,QAAA,MAAA,GAASA,QAAAA;AAAA,MACX,CAAC,CAAA;AAAA,IACH;AACA,IAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,EAAM;AAC1B,IAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAG1B,MAAA,IAAI,CAAC,WAAA,EAAa,QAAA,GAAW,KAAA,CAAM,IAAA,IAAQ,CAAA;AAC3C,MAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,MAAA,WAAA,GAAc,IAAA;AACd,MAAA,QAAA,GAAW,CAAA;AAEX,MAAA;AAAA,IACF;AACA,IAAA,OAAA,IAAW,KAAA,CAAM,IAAA;AACjB,IAAA,IAAI,OAAA,CAAQ,UAAU,OAAA,EAAS;AAC7B,MAAA,MAAM,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,OAAA,EAAQ;AAC9C,MAAA,OAAA,GAAU,EAAA;AAAA,IACZ;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,MAAM,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,OAAA,EAAQ;AAAA,EAChD;AAEA,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,SAAA,EAAW,MAAA,CAAO,MAAA,IAAU,GAAA,IAAO,OAAO,MAAA,IAAU,GAAA;AAAA,IACpD;AAAA,GACF;AACF;AClHO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAY,IAAA,CAAA,UAAA,CAAW,KAAK,CAAA,GAAS,IAAA,CAAA,SAAA,CAAU,KAAK,CAAA,GAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AACrF;AAEO,SAAS,gBAAA,CAAiB,SAAiB,GAAA,EAAsB;AACtE,EAAA,MAAM,IAAA,GAAY,IAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AACzC,EAAA,MAAM,MAAA,GAAc,aAAQ,OAAO,CAAA;AACnC,EAAA,MAAM,GAAA,GAAW,IAAA,CAAA,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AACtC,EAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,IAAU,IAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AAChD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,MAAA,EAAS,OAAO,CAAA,2BAAA,EAA8B,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,EACvE;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,WAAA,CAAY,OAAe,GAAA,EAAsB;AAC/D,EAAA,OAAO,gBAAA,CAAiB,WAAA,CAAY,KAAA,EAAO,GAAG,GAAG,GAAG,CAAA;AACtD;;;ACQO,IAAM,SAAA,GAA2C;AAAA,EACtD,IAAA,EAAM,OAAA;AAAA,EACN,WAAA,EAAa,0EAAA;AAAA,EACb,SAAA,EACE,uGAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,KAAA;AAAA,EACV,SAAA,EAAW,GAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,kCAAA,EAAmC;AAAA,MACvE,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,KAAA,EAAO,UAAA,EAAY,QAAQ,UAAU,CAAA;AAAA,QAC5C,WAAA,EAAa;AAAA,OACf;AAAA,MACA,GAAA,EAAK,EAAE,IAAA,EAAM,SAAA,EAAW,aAAa,iDAAA,EAAkD;AAAA,MACvF,QAAA,EAAU,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,gDAAA;AAAiD;AAC5F,GACF;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,KAAA;AACJ,IAAA,WAAA,MAAiB,MAAM,SAAA,CAAU,aAAA,CAAe,KAAA,EAAO,GAAA,EAAK,IAAI,CAAA,EAAG;AACjE,MAAA,IAAI,EAAA,CAAG,IAAA,KAAS,OAAA,EAAS,KAAA,GAAQ,EAAA,CAAG,MAAA;AAAA,IACtC;AACA,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,yCAAyC,CAAA;AACrE,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAAA,EACA,OAAO,aAAA,CAAc,KAAA,EAAO,GAAA,EAAK,IAAA,EAAoD;AACnF,IAAA,MAAM,GAAA,GAAM,MAAM,GAAA,GAAM,WAAA,CAAY,MAAM,GAAA,EAAK,GAAG,IAAI,GAAA,CAAI,GAAA;AAC1D,IAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc,GAAG,CAAA;AACvC,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA,cAAA,EAAiB,OAAO,CAAA,MAAA,CAAA,EAAK,IAAA,EAAM,EAAE,OAAA,EAAQ,EAAE;AAE1E,IAAA,MAAM,IAAA,GAAO,CAAC,OAAA,EAAS,QAAQ,CAAA;AAC/B,IAAA,IAAI,KAAA,CAAM,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA;AAChC,IAAA,IAAI,MAAM,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,GAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA,GAAI,KAAA,CAAM,QAAA,GAAW,KAAA,CAAM,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AACtF,MAAA,IAAA,CAAK,IAAA,CAAK,GAAG,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAc,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAAA,IAChD;AAEA,IAAA,MAAM,MAAA,GAAS,OAAO,WAAA,CAAY;AAAA,MAChC,GAAA,EAAK,OAAA;AAAA,MACL,IAAA;AAAA,MACA,GAAA;AAAA,MACA,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACX,CAAA;AAED,IAAA,MAAM,EAAE,MAAM,OAAA,EAAS,MAAA,EAAQ,iBAAiB,MAAA,CAAO,MAAA,EAAQ,MAAA,CAAO,QAAQ,CAAA,EAAE;AAAA,EAClF;AACF;AAEA,eAAe,cAAc,GAAA,EAA8B;AACzD,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,OAAO,aAAkB,CAAA;AAChD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,eAAA,CAAiB,CAAA;AAClC,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,UAAA,CAAY,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,gBAAA,CAAiB,MAAc,QAAA,EAA+B;AACrE,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,iBAAiB,EAAC;AAAA,MAClB,KAAA,EAAO,CAAA;AAAA,MACP,OAAA,EAAS,QAAA,KAAa,CAAA,GAAI,0BAAA,GAA6B,cAAA;AAAA,MACvD,MAAA,EAAQ,EAAA;AAAA,MACR,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC5B,IAAA,MAAM,aAAmC,EAAC;AAC1C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,UAAA,IAAc,EAAC;AAChC,IAAA,KAAA,MAAW,EAAA,IAAM,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AACjC,MAAA,MAAM,GAAA,GAAM,IAAI,EAAE,CAAA;AAClB,MAAA,UAAA,CAAW,IAAA,CAAK;AAAA,QACd,QAAA,EAAU,IAAI,QAAA,IAAY,SAAA;AAAA,QAC1B,OAAA,EAAS,IAAI,WAAA,IAAe,EAAA;AAAA,QAC5B,KAAA,EAAO,IAAI,KAAA,IAAS,uBAAA;AAAA,QACpB,GAAA,EAAK,IAAI,GAAA,IAAO;AAAA,OACjB,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAA;AACzB,IAAA,MAAM,OAAA,GACJ,KAAA,KAAU,CAAA,GACN,0BAAA,GACA,CAAA,MAAA,EAAS,KAAK,CAAA,kBAAA,EAAqB,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,UAAU,CAAA,CAAE,MAAM,CAAA,WAAA,EAAc,UAAA,CAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,KAAa,MAAM,CAAA,CAAE,MAAM,CAAA,KAAA,CAAA;AAEvK,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,eAAA,EAAiB,UAAA;AAAA,MACjB,KAAA;AAAA,MACA,OAAA;AAAA,MACA,MAAA,EAAQ,IAAA;AAAA,MACR,SAAA,EAAW,KAAK,MAAA,IAAU;AAAA,KAC5B;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,QAAA;AAAA,MACX,iBAAiB,EAAC;AAAA,MAClB,KAAA,EAAO,CAAA;AAAA,MACP,OAAA,EAAS,8BAAA;AAAA,MACT,MAAA,EAAQ,IAAA;AAAA,MACR,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AACF","file":"audit.js","sourcesContent":["import { spawn } from 'node:child_process';\nimport { buildChildEnv } from '@wrongstack/core';\nimport type { ToolProgressEvent } from '@wrongstack/core';\n\nexport interface SpawnStreamResult {\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  truncated: boolean;\n  error?: string;\n}\n\nexport interface SpawnStreamOptions {\n  cmd: string;\n  args: string[];\n  cwd: string;\n  signal: AbortSignal;\n  maxBytes?: number;\n  /** Bytes of new stdout/stderr to accumulate before yielding a `partial_output` event. */\n  flushBytes?: number;\n}\n\n/**\n * Spawn a child process and yield `partial_output` progress events as\n * stdout/stderr arrive (batched by byte threshold), then return the full\n * buffered result. Shared between install/lint/format/typecheck/test/audit\n * so the TUI live tail sees consistent progress regardless of which tool\n * is running.\n */\nexport async function* spawnStream(\n  opts: SpawnStreamOptions,\n): AsyncGenerator<ToolProgressEvent, SpawnStreamResult> {\n  const max = opts.maxBytes ?? 200_000;\n  const flushAt = opts.flushBytes ?? 4 * 1024;\n  let stdout = '';\n  let stderr = '';\n  let pending = '';\n  let error: string | undefined;\n\n  const child = spawn(opts.cmd, opts.args, {\n    cwd: opts.cwd,\n    signal: opts.signal,\n    env: buildChildEnv(),\n    stdio: ['ignore', 'pipe', 'pipe'],\n  });\n\n  type Chunk = { kind: 'out' | 'err' | 'close' | 'error'; data: string; code?: number };\n  const queue: Chunk[] = [];\n  let waiter: (() => void) | undefined;\n  const wake = () => {\n    if (waiter) {\n      const w = waiter;\n      waiter = undefined;\n      w();\n    }\n  };\n\n  child.stdout?.on('data', (c) => {\n    const s = c.toString();\n    if (stdout.length < max) stdout += s;\n    queue.push({ kind: 'out', data: s });\n    wake();\n  });\n  child.stderr?.on('data', (c) => {\n    const s = c.toString();\n    if (stderr.length < max) stderr += s;\n    queue.push({ kind: 'err', data: s });\n    wake();\n  });\n  child.on('error', (e) => {\n    error = e.message;\n    queue.push({ kind: 'error', data: e.message });\n    wake();\n  });\n  child.on('close', (code) => {\n    queue.push({ kind: 'close', data: '', code: code ?? 0 });\n    wake();\n  });\n\n  let exitCode = 0;\n  let spawnFailed = false;\n  for (;;) {\n    while (queue.length === 0) {\n      await new Promise<void>((resolve) => {\n        waiter = resolve;\n      });\n    }\n    const chunk = queue.shift()!;\n    if (chunk.kind === 'close') {\n      // If we already saw a spawn error (ENOENT etc.), keep exitCode=1\n      // rather than the negative platform code Node fabricates.\n      if (!spawnFailed) exitCode = chunk.code ?? 0;\n      break;\n    }\n    if (chunk.kind === 'error') {\n      spawnFailed = true;\n      exitCode = 1;\n      // close usually follows\n      continue;\n    }\n    pending += chunk.data;\n    if (pending.length >= flushAt) {\n      yield { type: 'partial_output', text: pending };\n      pending = '';\n    }\n  }\n  if (pending.length > 0) {\n    yield { type: 'partial_output', text: pending };\n  }\n\n  return {\n    stdout,\n    stderr,\n    exitCode,\n    truncated: stdout.length >= max || stderr.length >= max,\n    error,\n  };\n}\n","import * as path from 'node:path';\nimport type { Context } from '@wrongstack/core';\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const root = path.resolve(ctx.projectRoot);\n  const target = path.resolve(absPath);\n  const rel = path.relative(root, target);\n  if (rel.startsWith('..') || path.isAbsolute(rel)) {\n    throw new Error(`Path \"${absPath}\" is outside project root \"${root}\"`);\n  }\n  return target;\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n","import type { Tool, ToolStreamEvent } from '@wrongstack/core';\nimport { spawnStream } from './_spawn-stream.js';\nimport { safeResolve } from './_util.js';\n\ninterface AuditInput {\n  cwd?: string;\n  level?: 'low' | 'moderate' | 'high' | 'critical';\n  fix?: boolean;\n  packages?: string | string[];\n}\n\ninterface AuditVulnerability {\n  severity: string;\n  package: string;\n  title: string;\n  url: string;\n}\n\ninterface AuditOutput {\n  exit_code: number;\n  vulnerabilities: AuditVulnerability[];\n  total: number;\n  summary: string;\n  output: string;\n  truncated: boolean;\n}\n\nexport const auditTool: Tool<AuditInput, AuditOutput> = {\n  name: 'audit',\n  description: 'Run npm/pnpm security audit. Returns vulnerabilities sorted by severity.',\n  usageHint:\n    'Set `level` to filter minimum severity. `fix` attempts auto-fix. `packages` checks specific packages.',\n  permission: 'confirm',\n  mutating: false,\n  timeoutMs: 60_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      cwd: { type: 'string', description: 'Working directory (default: cwd)' },\n      level: {\n        type: 'string',\n        enum: ['low', 'moderate', 'high', 'critical'],\n        description: 'Minimum severity level to report',\n      },\n      fix: { type: 'boolean', description: 'Attempt to fix vulnerabilities (default: false)' },\n      packages: { type: 'string', description: 'Specific package(s) to audit (comma-separated)' },\n    },\n  },\n  async execute(input, ctx, opts) {\n    let final: AuditOutput | undefined;\n    for await (const ev of auditTool.executeStream!(input, ctx, opts)) {\n      if (ev.type === 'final') final = ev.output;\n    }\n    if (!final) throw new Error('audit: stream ended without final event');\n    return final;\n  },\n  async *executeStream(input, ctx, opts): AsyncGenerator<ToolStreamEvent<AuditOutput>> {\n    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;\n    const manager = await detectManager(cwd);\n    yield { type: 'log', text: `Auditing with ${manager}…`, data: { manager } };\n\n    const args = ['audit', '--json'];\n    if (input.fix) args.push('--fix');\n    if (input.packages) {\n      const pkgs = Array.isArray(input.packages) ? input.packages : input.packages.split(',');\n      args.push(...pkgs.map((p: string) => p.trim()));\n    }\n\n    const result = yield* spawnStream({\n      cmd: manager,\n      args,\n      cwd,\n      signal: opts.signal,\n      maxBytes: 100_000,\n    });\n\n    yield { type: 'final', output: parseAuditOutput(result.stdout, result.exitCode) };\n  },\n};\n\nasync function detectManager(cwd: string): Promise<string> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* */\n  }\n  return 'npm';\n}\n\nfunction parseAuditOutput(json: string, exitCode: number): AuditOutput {\n  if (!json) {\n    return {\n      exit_code: exitCode,\n      vulnerabilities: [],\n      total: 0,\n      summary: exitCode === 0 ? 'No vulnerabilities found' : 'Audit failed',\n      output: '',\n      truncated: false,\n    };\n  }\n\n  try {\n    const data = JSON.parse(json);\n    const advisories: AuditVulnerability[] = [];\n    const ads = data.advisories ?? {};\n    for (const id of Object.keys(ads)) {\n      const adv = ads[id];\n      advisories.push({\n        severity: adv.severity ?? 'unknown',\n        package: adv.module_name ?? id,\n        title: adv.title ?? 'Unknown vulnerability',\n        url: adv.url ?? '',\n      });\n    }\n\n    const total = advisories.length;\n    const summary =\n      total === 0\n        ? 'No vulnerabilities found'\n        : `Found ${total} vulnerabilities: ${advisories.filter((a) => a.severity === 'critical').length} critical, ${advisories.filter((a) => a.severity === 'high').length} high`;\n\n    return {\n      exit_code: exitCode,\n      vulnerabilities: advisories,\n      total,\n      summary,\n      output: json,\n      truncated: json.length >= 100_000,\n    };\n  } catch {\n    return {\n      exit_code: exitCode,\n      vulnerabilities: [],\n      total: 0,\n      summary: 'Could not parse audit output',\n      output: json,\n      truncated: false,\n    };\n  }\n}\n"]}

package/dist/bash.js

@@ -1,6 +1,6 @@
 import { spawn } from 'child_process';
 import * as os from 'os';
-import { stripAnsi } from '@wrongstack/core';
+import { buildChildEnv, stripAnsi } from '@wrongstack/core';
 import 'path';
 
 // src/bash.ts
@@ -12,84 +12,6 @@ function truncateMiddle(s, max) {
 ` + s.slice(-half);
 }
 
-// src/_env.ts
-var ALLOWED_KEYS = /* @__PURE__ */ new Set([
-  "PATH",
-  "HOME",
-  "USER",
-  "USERNAME",
-  "LOGNAME",
-  "SHELL",
-  "LANG",
-  "LC_ALL",
-  "LC_CTYPE",
-  "TERM",
-  "TZ",
-  "TMPDIR",
-  "TEMP",
-  "TMP",
-  "PWD",
-  "OLDPWD",
-  "COMSPEC",
-  "SYSTEMROOT",
-  "SYSTEMDRIVE",
-  "WINDIR",
-  "PROGRAMFILES",
-  "PROGRAMFILES(X86)",
-  "PROGRAMDATA",
-  "APPDATA",
-  "LOCALAPPDATA",
-  "USERPROFILE",
-  "PUBLIC",
-  "PATHEXT"
-]);
-var SECRET_NAME_PARTS = [
-  "TOKEN",
-  "SECRET",
-  "PASSWORD",
-  "PASSWD",
-  "AUTH",
-  "CRED",
-  "BEARER",
-  "COOKIE",
-  "PRIVATE"
-];
-function looksSecret(name) {
-  const upper = name.toUpperCase();
-  for (const p of SECRET_NAME_PARTS) {
-    if (upper.includes(p)) return true;
-  }
-  if (/(?:^|_)KEY(?:$|_|S$)/i.test(upper)) return true;
-  if (/API[_-]?KEY/i.test(upper)) return true;
-  if (/ACCESS[_-]?KEY/i.test(upper)) return true;
-  if (/SESSION[_-]?ID/i.test(upper) === false && /SESSION/i.test(upper)) {
-    return true;
-  }
-  return false;
-}
-function buildChildEnv(sessionId) {
-  const passthrough = process.env["WRONGSTACK_BASH_ENV_PASSTHROUGH"] === "1";
-  const out = {};
-  for (const [k, v] of Object.entries(process.env)) {
-    if (v === void 0) continue;
-    if (passthrough) {
-      out[k] = v;
-      continue;
-    }
-    const upper = k.toUpperCase();
-    if (ALLOWED_KEYS.has(upper)) {
-      out[k] = v;
-      continue;
-    }
-    if (looksSecret(upper)) continue;
-    if (upper.startsWith("NODE_") || upper.startsWith("NPM_") || upper.startsWith("PNPM_") || upper.startsWith("YARN_") || upper.startsWith("GIT_") || upper.startsWith("CI") || upper.startsWith("XDG_") || upper === "EDITOR" || upper === "VISUAL" || upper === "PAGER") {
-      out[k] = v;
-    }
-  }
-  if (sessionId) out["WRONGSTACK_SESSION_ID"] = sessionId;
-  return out;
-}
-
 // src/bash.ts
 var MAX_OUTPUT = 32768;
 var DEFAULT_TIMEOUT = 3e4;
@@ -127,7 +49,7 @@ var bashTool = {
   },
   async *executeStream(input, ctx, opts) {
     if (!input?.command) throw new Error("bash: command is required");
-    const timeoutMs = Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT, 6e5);
+    const timeoutMs = Math.max(1, Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT, 6e5));
     const isWin = os.platform() === "win32";
     const shell = isWin ? process.env["COMSPEC"] ?? "cmd.exe" : process.env["SHELL"] ?? "/bin/bash";
     const args = isWin ? ["/c", input.command] : ["-c", input.command];

package/dist/bash.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/_util.ts","../src/_env.ts","../src/bash.ts"],"names":["resolve"],"mappings":";;;;;;AAqBO,SAAS,cAAA,CAAe,GAAW,GAAA,EAAqB;AAC7D,EAAA,IAAI,OAAO,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,IAAK,KAAK,OAAO,CAAA;AAChD,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAC/B,EAAA,OACE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,GACf;AAAA,iBAAA,EAAiB,MAAA,CAAO,UAAA,CAAW,CAAA,EAAG,MAAM,IAAI,GAAG,CAAA;AAAA,CAAA,GACnD,CAAA,CAAE,KAAA,CAAM,CAAC,IAAI,CAAA;AAEjB;;;ACTA,IAAM,YAAA,uBAAmB,GAAA,CAAY;AAAA,EACnC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,IAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,YAAA;AAAA,EACA,aAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,mBAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAMD,IAAM,iBAAA,GAAoB;AAAA,EACxB,OAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,YAAY,IAAA,EAAuB;AAC1C,EAAA,MAAM,KAAA,GAAQ,KAAK,WAAA,EAAY;AAC/B,EAAA,KAAA,MAAW,KAAK,iBAAA,EAAmB;AACjC,IAAA,IAAI,KAAA,CAAM,QAAA,CAAS,CAAC,CAAA,EAAG,OAAO,IAAA;AAAA,EAChC;AAGA,EAAA,IAAI,uBAAA,CAAwB,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AAChD,EAAA,IAAI,cAAA,CAAe,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AACvC,EAAA,IAAI,iBAAA,CAAkB,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AAC1C,EAAA,IAAI,iBAAA,CAAkB,KAAK,KAAK,CAAA,KAAM,SAAS,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,EAAG;AAGrE,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,cAAc,SAAA,EAAuC;AACnE,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,GAAA,CAAI,iCAAiC,CAAA,KAAM,GAAA;AACvE,EAAA,MAAM,MAAyB,EAAC;AAEhC,EAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,EAAG;AAChD,IAAA,IAAI,MAAM,MAAA,EAAW;AACrB,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AACT,MAAA;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAQ,EAAE,WAAA,EAAY;AAG5B,IAAA,IAAI,YAAA,CAAa,GAAA,CAAI,KAAK,CAAA,EAAG;AAC3B,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AACT,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,WAAA,CAAY,KAAK,CAAA,EAAG;AAGxB,IAAA,IACE,KAAA,CAAM,UAAA,CAAW,OAAO,CAAA,IACxB,MAAM,UAAA,CAAW,MAAM,CAAA,IACvB,KAAA,CAAM,UAAA,CAAW,OAAO,CAAA,IACxB,KAAA,CAAM,WAAW,OAAO,CAAA,IACxB,KAAA,CAAM,UAAA,CAAW,MAAM,CAAA,IACvB,KAAA,CAAM,UAAA,CAAW,IAAI,CAAA,IACrB,KAAA,CAAM,UAAA,CAAW,MAAM,KACvB,KAAA,KAAU,QAAA,IACV,KAAA,KAAU,QAAA,IACV,UAAU,OAAA,EACV;AACA,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,IACX;AAAA,EACF;AAEA,EAAA,IAAI,SAAA,EAAW,GAAA,CAAI,uBAAuB,CAAA,GAAI,SAAA;AAC9C,EAAA,OAAO,GAAA;AACT;;;ACxGA,IAAM,UAAA,GAAa,KAAA;AACnB,IAAM,eAAA,GAAkB,GAAA;AAIxB,IAAM,wBAAA,GAA2B,GAAA;AACjC,IAAM,qBAAqB,CAAA,GAAI,IAAA;AAExB,IAAM,QAAA,GAAwC;AAAA,EACnD,IAAA,EAAM,MAAA;AAAA,EACN,WAAA,EAAa,oDAAA;AAAA,EACb,SAAA,EACE,4KAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,IAAA;AAAA;AAAA;AAAA;AAAA,EAIV,UAAA,EAAY,SAAA;AAAA,EACZ,SAAA,EAAW,GAAA;AAAA,EACX,cAAA,EAAgB,UAAA;AAAA,EAChB,mBAAA,EAAqB,GAAA;AAAA,EACrB,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MAC1B,UAAA,EAAY,EAAE,IAAA,EAAM,SAAA,EAAU;AAAA,MAC9B,UAAA,EAAY,EAAE,IAAA,EAAM,SAAA;AAAU,KAChC;AAAA,IACA,QAAA,EAAU,CAAC,SAAS;AAAA,GACtB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,KAAA;AACJ,IAAA,WAAA,MAAiB,MAAM,QAAA,CAAS,aAAA,CAAe,KAAA,EAAO,GAAA,EAAK,IAAI,CAAA,EAAG;AAChE,MAAA,IAAI,EAAA,CAAG,IAAA,KAAS,OAAA,EAAS,KAAA,GAAQ,EAAA,CAAG,MAAA;AAAA,IACtC;AACA,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,wCAAwC,CAAA;AACpE,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAAA,EACA,OAAO,aAAA,CAAc,KAAA,EAAO,GAAA,EAAK,IAAA,EAAmD;AAClF,IAAA,IAAI,CAAC,KAAA,EAAO,OAAA,EAAS,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAChE,IAAA,MAAM,YAAY,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,UAAA,IAAc,iBAAiB,GAAO,CAAA;AAEvE,IAAA,MAAM,KAAA,GAAW,aAAS,KAAM,OAAA;AAChC,IAAA,MAAM,KAAA,GAAQ,KAAA,GACV,OAAA,CAAQ,GAAA,CAAI,SAAS,KAAK,SAAA,GAC1B,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,IAAK,WAAA;AAC5B,IAAA,MAAM,IAAA,GAAO,KAAA,GAAQ,CAAC,IAAA,EAAM,KAAA,CAAM,OAAO,CAAA,GAAI,CAAC,IAAA,EAAM,KAAA,CAAM,OAAO,CAAA;AAEjE,IAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,OAAA,EAAS,EAAE,CAAA;AAQzC,IAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAC,CAAC,MAAM,UAAA,GAAa,IAAA;AAC9C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,EAAO,IAAA,EAAM;AAAA,MAC/B,KAAK,GAAA,CAAI,WAAA;AAAA,MACT,GAAA;AAAA,MACA,OAAO,KAAA,CAAM,UAAA,GAAa,WAAW,CAAC,QAAA,EAAU,QAAQ,MAAM,CAAA;AAAA,MAC9D,QAAA;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAED,IAAA,IAAI,MAAM,UAAA,EAAY;AACpB,MAAA,MAAM,MAAM,KAAA,CAAM,GAAA;AAClB,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,KAAA,CAAM,KAAA,EAAM;AACzC,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,OAAA;AAAA,QACN,MAAA,EAAQ;AAAA,UACN,MAAA,EAAQ,CAAA,iBAAA,EAAoB,GAAA,IAAO,SAAS,CAAA,CAAA;AAAA,UAC5C,SAAA,EAAW,IAAA;AAAA,UACX,SAAA,EAAW,KAAA;AAAA,UACX;AAAA;AACF,OACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,IAAI,OAAA,GAAU,EAAA;AACd,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,MAAM,SAA2B,EAAC;AAClC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,IAAI;AAAE,UAAA,KAAA,CAAM,IAAA,EAAK;AAAA,QAAG,CAAA,CAAA,MAAQ;AAAA,QAAe;AAAA,MAC7C,CAAA,MAAO;AACL,QAAA,IAAI;AAIF,UAAA,IAAI,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU;AACjC,YAAA,IAAI;AAAE,cAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,CAAM,GAAA,EAAK,SAAS,CAAA;AAAA,YAAG,CAAA,CAAA,MAAQ;AAAE,cAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,YAAG;AAAA,UAC9E,CAAA,MAAO;AACL,YAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,UACtB;AACA,UAAA,MAAM,SAAA,GAAY,WAAW,MAAM;AACjC,YAAA,IAAI;AACF,cAAA,IAAI,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU;AACjC,gBAAA,IAAI;AAAE,kBAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,CAAM,GAAA,EAAK,SAAS,CAAA;AAAA,gBAAG,CAAA,CAAA,MAAQ;AAAE,kBAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,gBAAG;AAAA,cAC9E,CAAA,MAAO;AACL,gBAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,cACtB;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAAe;AAAA,UACzB,GAAG,GAAI,CAAA;AACP,UAAA,MAAA,CAAO,KAAK,SAAS,CAAA;AAAA,QACvB,CAAA,CAAA,MAAQ;AAAA,QAAe;AAAA,MACzB;AAAA,IACF,GAAG,SAAS,CAAA;AACZ,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,IAAA,KAAA,CAAM,KAAA,IAAQ;AAMd,IAAA,MAAM,QAAiB,EAAC;AACxB,IAAA,IAAI,WAAA,GAA2C,IAAA;AAC/C,IAAA,MAAM,IAAA,GAAO,CAAC,CAAA,KAAa;AACzB,MAAA,IAAI,WAAA,EAAa;AACf,QAAA,MAAM,CAAA,GAAI,WAAA;AACV,QAAA,WAAA,GAAc,IAAA;AACd,QAAA,CAAA,CAAE,CAAC,CAAA;AAAA,MACL,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AAAA,MACd;AAAA,IACF,CAAA;AACA,IAAA,MAAM,IAAA,GAAO,MAAsB,IAAI,OAAA,CAAQ,CAACA,QAAAA,KAAY;AAC1D,MAAA,MAAM,CAAA,GAAI,MAAM,KAAA,EAAM;AACtB,MAAA,IAAI,CAAA,EAAGA,QAAAA,CAAQ,CAAC,CAAA;AAAA,WACX,WAAA,GAAcA,QAAAA;AAAA,IACrB,CAAC,CAAA;AAED,IAAA,IAAI,SAAA,GAAY,KAAK,GAAA,EAAI;AACzB,IAAA,MAAM,QAAQ,MAAM;AAClB,MAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACjC,MAAA,MAAM,IAAA,GAAO,OAAA;AACb,MAAA,OAAA,GAAU,EAAA;AACV,MAAA,SAAA,GAAY,KAAK,GAAA,EAAI;AACrB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAEA,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAU;AAClC,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,EAAS;AAC5B,MAAA,GAAA,IAAO,IAAA;AACP,MAAA,OAAA,IAAW,IAAA;AACX,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IAC7B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAU;AAClC,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,EAAS;AAC5B,MAAA,GAAA,IAAO,IAAA;AACP,MAAA,OAAA,IAAW,IAAA;AACX,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IAC7B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,YAAA,CAAa,CAAC,CAAA;AACtC,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,CAAA;AAAA,IAC7B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,YAAA,CAAa,CAAC,CAAA;AACtC,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAC5B,CAAC,CAAA;AAED,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,EAAM;AACX,QAAA,MAAM,CAAA,GAAI,MAAM,IAAA,EAAK;AACrB,QAAA,IAAI,CAAA,CAAE,IAAA,KAAS,OAAA,EAAS,MAAM,CAAA,CAAE,GAAA;AAChC,QAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACpB,UAAA,MAAM,YAAY,KAAA,EAAM;AACxB,UAAA,IAAI,cAAc,IAAA,EAAM;AACtB,YAAA,MAAM,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,SAAA,EAAU;AAAA,UAClD;AACA,UAAA,MAAM,UAAU,SAAA,CAAU,GAAG,CAAA,CAAE,OAAA,CAAQ,UAAU,IAAI,CAAA;AACrD,UAAA,MAAM;AAAA,YACJ,IAAA,EAAM,OAAA;AAAA,YACN,MAAA,EAAQ;AAAA,cACN,MAAA,EAAQ,cAAA,CAAe,OAAA,EAAS,UAAU,CAAA;AAAA,cAC1C,WAAW,CAAA,CAAE,IAAA;AAAA,cACb,SAAA,EAAW;AAAA;AACb,WACF;AACA,UAAA;AAAA,QACF;AAIA,QAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,QAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,kBAAA,IAAsB,GAAA,GAAM,aAAa,wBAAA,EAA0B;AACvF,UAAA,MAAM,OAAO,KAAA,EAAM;AACnB,UAAA,IAAI,IAAA,EAAM,MAAM,EAAE,IAAA,EAAM,kBAAkB,IAAA,EAAK;AAAA,QACjD;AAAA,MACF;AAAA,IACF,CAAA,SAAE;AACA,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,YAAA,CAAa,CAAC,CAAA;AAAA,IACxC;AAAA,EACF;AACF","file":"bash.js","sourcesContent":["import * as path from 'node:path';\nimport type { Context } from '@wrongstack/core';\n\r\nexport function resolvePath(input: string, ctx: Context): string {\r\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);\r\n}\r\n\r\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\r\n  const root = path.resolve(ctx.projectRoot);\r\n  const target = path.resolve(absPath);\r\n  const rel = path.relative(root, target);\r\n  if (rel.startsWith('..') || path.isAbsolute(rel)) {\r\n    throw new Error(`Path \"${absPath}\" is outside project root \"${root}\"`);\r\n  }\r\n  return target;\r\n}\r\n\r\nexport function safeResolve(input: string, ctx: Context): string {\r\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\r\n}\r\n\r\nexport function truncateMiddle(s: string, max: number): string {\r\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\r\n  const half = Math.floor(max / 2);\r\n  return (\r\n    s.slice(0, half) +\r\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\r\n    s.slice(-half)\r\n  );\r\n}\r\n\r\nexport function isBinaryBuffer(buf: Buffer): boolean {\r\n  const len = Math.min(buf.length, 8192);\r\n  for (let i = 0; i < len; i++) {\r\n    if (buf[i] === 0) return true;\r\n  }\r\n  return false;\r\n}\r\n\r\n","/**\n * Build a sanitized child-process environment.\n *\n * The bash/exec tools execute LLM-generated commands. The parent process\n * carries provider API keys (ANTHROPIC_API_KEY, OPENAI_API_KEY, ...), VCS\n * tokens (GITHUB_TOKEN), and cloud credentials. Forwarding those to a child\n * is an exfiltration vector even with `permission: 'confirm'` — a model can\n * compose a command whose secret-leaking effect is not obvious from a quick\n * read of the shell pipeline.\n *\n * Strategy: copy a small, explicit allowlist of variables that real builds\n * need, then copy anything else that does NOT look secret-bearing. This\n * preserves user-friendly behavior (locale, terminal, npm config) while\n * blocking the obvious leak channels.\n *\n * Override with `WRONGSTACK_BASH_ENV_PASSTHROUGH=1` to forward the full\n * parent environment unchanged (opt-in for advanced users who understand\n * the risk).\n */\n\nconst ALLOWED_KEYS = new Set<string>([\n  'PATH',\n  'HOME',\n  'USER',\n  'USERNAME',\n  'LOGNAME',\n  'SHELL',\n  'LANG',\n  'LC_ALL',\n  'LC_CTYPE',\n  'TERM',\n  'TZ',\n  'TMPDIR',\n  'TEMP',\n  'TMP',\n  'PWD',\n  'OLDPWD',\n  'COMSPEC',\n  'SYSTEMROOT',\n  'SYSTEMDRIVE',\n  'WINDIR',\n  'PROGRAMFILES',\n  'PROGRAMFILES(X86)',\n  'PROGRAMDATA',\n  'APPDATA',\n  'LOCALAPPDATA',\n  'USERPROFILE',\n  'PUBLIC',\n  'PATHEXT',\n]);\n\n// Substring match against env-var names (case-insensitive). Bias toward\n// false-positives — a missing var is recoverable, an exfiltrated key is not.\n// Only consulted for vars NOT on the curated allowlist; PWD/PASSWD-style\n// false positives there are avoided by checking allowlist first.\nconst SECRET_NAME_PARTS = [\n  'TOKEN',\n  'SECRET',\n  'PASSWORD',\n  'PASSWD',\n  'AUTH',\n  'CRED',\n  'BEARER',\n  'COOKIE',\n  'PRIVATE',\n];\n\nfunction looksSecret(name: string): boolean {\n  const upper = name.toUpperCase();\n  for (const p of SECRET_NAME_PARTS) {\n    if (upper.includes(p)) return true;\n  }\n  // KEY is tricky — PUBLIC_KEY is fine to forward but most _KEY vars are\n  // secrets. Require word boundary so KEYBOARD_LAYOUT etc. are not flagged.\n  if (/(?:^|_)KEY(?:$|_|S$)/i.test(upper)) return true;\n  if (/API[_-]?KEY/i.test(upper)) return true;\n  if (/ACCESS[_-]?KEY/i.test(upper)) return true;\n  if (/SESSION[_-]?ID/i.test(upper) === false && /SESSION/i.test(upper)) {\n    // SESSION_ID is metadata (we set our own); other SESSION_* often holds\n    // session cookies. Be conservative.\n    return true;\n  }\n  return false;\n}\n\nexport function buildChildEnv(sessionId?: string): NodeJS.ProcessEnv {\n  const passthrough = process.env['WRONGSTACK_BASH_ENV_PASSTHROUGH'] === '1';\n  const out: NodeJS.ProcessEnv = {};\n\n  for (const [k, v] of Object.entries(process.env)) {\n    if (v === undefined) continue;\n    if (passthrough) {\n      out[k] = v;\n      continue;\n    }\n    const upper = k.toUpperCase();\n    // 1. Forward names on the explicit allowlist — these are well-known\n    //    non-secret system variables (PATH, HOME, LANG, ...).\n    if (ALLOWED_KEYS.has(upper)) {\n      out[k] = v;\n      continue;\n    }\n    // 2. Strip anything that looks like a secret.\n    if (looksSecret(upper)) continue;\n    // 3. Forward tooling-prefixed vars that builds commonly need, unless\n    //    they already failed the secret check above.\n    if (\n      upper.startsWith('NODE_') ||\n      upper.startsWith('NPM_') ||\n      upper.startsWith('PNPM_') ||\n      upper.startsWith('YARN_') ||\n      upper.startsWith('GIT_') ||\n      upper.startsWith('CI') ||\n      upper.startsWith('XDG_') ||\n      upper === 'EDITOR' ||\n      upper === 'VISUAL' ||\n      upper === 'PAGER'\n    ) {\n      out[k] = v;\n    }\n  }\n\n  if (sessionId) out['WRONGSTACK_SESSION_ID'] = sessionId;\n  return out;\n}\n","import { spawn } from 'node:child_process';\r\nimport * as os from 'node:os';\r\nimport type { Tool, ToolStreamEvent } from '@wrongstack/core';\r\nimport { stripAnsi } from '@wrongstack/core';\r\nimport { truncateMiddle } from './_util.js';\r\nimport { buildChildEnv } from './_env.js';\r\n\r\ninterface BashInput {\r\n  command: string;\r\n  timeout_ms?: number;\r\n  background?: boolean;\r\n}\r\n\r\ninterface BashOutput {\r\n  output: string;\r\n  exit_code: number | null;\r\n  timed_out: boolean;\r\n  pid?: number;\r\n}\r\n\r\nconst MAX_OUTPUT = 32_768;\r\nconst DEFAULT_TIMEOUT = 30_000;\r\n// Flush partial_output every 200ms or when 4 KiB accumulates — whichever\r\n// comes first. Smaller batches make the TUI feel responsive; larger ones\r\n// keep EventBus traffic reasonable on chatty processes.\r\nconst STREAM_FLUSH_INTERVAL_MS = 200;\r\nconst STREAM_FLUSH_BYTES = 4 * 1024;\r\n\r\nexport const bashTool: Tool<BashInput, BashOutput> = {\r\n  name: 'bash',\r\n  description: 'Run a shell command. stdout and stderr are merged.',\r\n  usageHint:\r\n    'Runs via `bash -c` (or `cmd /c` on Windows). Cwd is the project root. Default timeout 30s. Output truncated from the middle if oversized. Use for git, npm, builds, tests.',\r\n  permission: 'confirm',\r\n  mutating: true,\r\n  // Trust rules match on the literal `command` string. Without subjectKey\r\n  // the policy heuristic would have done the same here, but declaring it\r\n  // explicitly removes the implicit cross-tool aliasing.\r\n  subjectKey: 'command',\r\n  timeoutMs: 30_000,\r\n  maxOutputBytes: MAX_OUTPUT,\r\n  estimatedDurationMs: 3_000,\r\n  inputSchema: {\r\n    type: 'object',\r\n    properties: {\r\n      command: { type: 'string' },\r\n      timeout_ms: { type: 'integer' },\r\n      background: { type: 'boolean' },\r\n    },\r\n    required: ['command'],\r\n  },\r\n  async execute(input, ctx, opts) {\r\n    let final: BashOutput | undefined;\r\n    for await (const ev of bashTool.executeStream!(input, ctx, opts)) {\r\n      if (ev.type === 'final') final = ev.output;\r\n    }\r\n    if (!final) throw new Error('bash: stream ended without final event');\r\n    return final;\r\n  },\r\n  async *executeStream(input, ctx, opts): AsyncGenerator<ToolStreamEvent<BashOutput>> {\r\n    if (!input?.command) throw new Error('bash: command is required');\r\n    const timeoutMs = Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT, 600_000);\r\n\r\n    const isWin = os.platform() === 'win32';\r\n    const shell = isWin\r\n      ? process.env['COMSPEC'] ?? 'cmd.exe'\r\n      : process.env['SHELL'] ?? '/bin/bash';\r\n    const args = isWin ? ['/c', input.command] : ['-c', input.command];\r\n\r\n    const env = buildChildEnv(ctx.session?.id);\r\n\r\n    // On POSIX we put the shell in its own process group so that timeout /\r\n    // abort can kill the entire group with `process.kill(-pid)`. Otherwise\r\n    // `bash -c \"sleep 9999 & disown\"` would leave the grandchild running.\r\n    // `detached: true` is also reused for the user-facing background mode;\r\n    // we always want detached on POSIX, only on Windows is it tied to the\r\n    // explicit background flag.\r\n    const detached = isWin ? !!input.background : true;\r\n    const child = spawn(shell, args, {\r\n      cwd: ctx.projectRoot,\r\n      env,\r\n      stdio: input.background ? 'ignore' : ['ignore', 'pipe', 'pipe'],\r\n      detached,\r\n      signal: opts.signal,\r\n    });\r\n\r\n    if (input.background) {\r\n      const pid = child.pid;\r\n      if (typeof pid === 'number') child.unref();\r\n      yield {\r\n        type: 'final',\r\n        output: {\r\n          output: `[background] pid=${pid ?? 'unknown'}`,\r\n          exit_code: null,\r\n          timed_out: false,\r\n          pid,\r\n        },\r\n      };\r\n      return;\r\n    }\r\n\r\n    let buf = '';\r\n    let pending = '';\r\n    let timedOut = false;\r\n    const timers: NodeJS.Timeout[] = [];\r\n    const timer = setTimeout(() => {\r\n      timedOut = true;\r\n      if (isWin) {\r\n        try { child.kill(); } catch { /* ignore */ }\r\n      } else {\r\n        try {\r\n          // Kill the process group, not just the shell — pid is positive,\r\n          // group id is the negated pid. Without this a runaway grandchild\r\n          // ('sleep 9999 & disown') survives bash termination.\r\n          if (typeof child.pid === 'number') {\r\n            try { process.kill(-child.pid, 'SIGTERM'); } catch { child.kill('SIGTERM'); }\r\n          } else {\r\n            child.kill('SIGTERM');\r\n          }\r\n          const killTimer = setTimeout(() => {\r\n            try {\r\n              if (typeof child.pid === 'number') {\r\n                try { process.kill(-child.pid, 'SIGKILL'); } catch { child.kill('SIGKILL'); }\r\n              } else {\r\n                child.kill('SIGKILL');\r\n              }\r\n            } catch { /* ignore */ }\r\n          }, 2000);\r\n          timers.push(killTimer);\r\n        } catch { /* ignore */ }\r\n      }\r\n    }, timeoutMs);\r\n    timers.push(timer);\r\n    timer.unref?.();\r\n\r\n    // Bridge the EventEmitter-style child to an async iterator. We push\r\n    // chunks into a queue and let the generator pull them; this lets us\r\n    // yield 'partial_output' events to the executor at flush boundaries.\r\n    type Chunk = { kind: 'data'; text: string } | { kind: 'end'; code: number | null } | { kind: 'error'; err: Error };\r\n    const queue: Chunk[] = [];\r\n    let resolveNext: ((c: Chunk) => void) | null = null;\r\n    const push = (c: Chunk) => {\r\n      if (resolveNext) {\r\n        const r = resolveNext;\r\n        resolveNext = null;\r\n        r(c);\r\n      } else {\r\n        queue.push(c);\r\n      }\r\n    };\r\n    const next = (): Promise<Chunk> => new Promise((resolve) => {\r\n      const c = queue.shift();\r\n      if (c) resolve(c);\r\n      else resolveNext = resolve;\r\n    });\r\n\r\n    let lastFlush = Date.now();\r\n    const flush = () => {\r\n      if (pending.length === 0) return null;\r\n      const text = pending;\r\n      pending = '';\r\n      lastFlush = Date.now();\r\n      return text;\r\n    };\r\n\r\n    child.stdout?.on('data', (chunk) => {\r\n      const text = chunk.toString();\r\n      buf += text;\r\n      pending += text;\r\n      push({ kind: 'data', text });\r\n    });\r\n    child.stderr?.on('data', (chunk) => {\r\n      const text = chunk.toString();\r\n      buf += text;\r\n      pending += text;\r\n      push({ kind: 'data', text });\r\n    });\r\n    child.on('error', (err) => {\r\n      for (const t of timers) clearTimeout(t);\r\n      push({ kind: 'error', err });\r\n    });\r\n    child.on('close', (code) => {\r\n      for (const t of timers) clearTimeout(t);\r\n      push({ kind: 'end', code });\r\n    });\r\n\r\n    try {\r\n      while (true) {\r\n        const c = await next();\r\n        if (c.kind === 'error') throw c.err;\r\n        if (c.kind === 'end') {\r\n          const remainder = flush();\r\n          if (remainder !== null) {\r\n            yield { type: 'partial_output', text: remainder };\r\n          }\r\n          const cleaned = stripAnsi(buf).replace(/\\r\\n?/g, '\\n');\r\n          yield {\r\n            type: 'final',\r\n            output: {\r\n              output: truncateMiddle(cleaned, MAX_OUTPUT),\r\n              exit_code: c.code,\r\n              timed_out: timedOut,\r\n            },\r\n          };\r\n          return;\r\n        }\r\n        // Decide whether to flush. Time-based OR size-based to keep latency\r\n        // low for slow-emitting commands without overwhelming the TUI for\r\n        // chatty ones.\r\n        const now = Date.now();\r\n        if (pending.length >= STREAM_FLUSH_BYTES || now - lastFlush >= STREAM_FLUSH_INTERVAL_MS) {\r\n          const text = flush();\r\n          if (text) yield { type: 'partial_output', text };\r\n        }\r\n      }\r\n    } finally {\r\n      for (const t of timers) clearTimeout(t);\r\n    }\r\n  },\r\n};\r\n\r\n// Re-export types so consumers can narrow on stream events.\r\nexport type { BashInput, BashOutput };\r\n"]}
+{"version":3,"sources":["../src/_util.ts","../src/bash.ts"],"names":["resolve"],"mappings":";;;;;;AAqBO,SAAS,cAAA,CAAe,GAAW,GAAA,EAAqB;AAC7D,EAAA,IAAI,OAAO,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,IAAK,KAAK,OAAO,CAAA;AAChD,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAC/B,EAAA,OACE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,GACf;AAAA,iBAAA,EAAiB,MAAA,CAAO,UAAA,CAAW,CAAA,EAAG,MAAM,IAAI,GAAG,CAAA;AAAA,CAAA,GACnD,CAAA,CAAE,KAAA,CAAM,CAAC,IAAI,CAAA;AAEjB;;;ACTA,IAAM,UAAA,GAAa,KAAA;AACnB,IAAM,eAAA,GAAkB,GAAA;AAIxB,IAAM,wBAAA,GAA2B,GAAA;AACjC,IAAM,qBAAqB,CAAA,GAAI,IAAA;AAExB,IAAM,QAAA,GAAwC;AAAA,EACnD,IAAA,EAAM,MAAA;AAAA,EACN,WAAA,EAAa,oDAAA;AAAA,EACb,SAAA,EACE,4KAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,IAAA;AAAA;AAAA;AAAA;AAAA,EAIV,UAAA,EAAY,SAAA;AAAA,EACZ,SAAA,EAAW,GAAA;AAAA,EACX,cAAA,EAAgB,UAAA;AAAA,EAChB,mBAAA,EAAqB,GAAA;AAAA,EACrB,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MAC1B,UAAA,EAAY,EAAE,IAAA,EAAM,SAAA,EAAU;AAAA,MAC9B,UAAA,EAAY,EAAE,IAAA,EAAM,SAAA;AAAU,KAChC;AAAA,IACA,QAAA,EAAU,CAAC,SAAS;AAAA,GACtB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,KAAA;AACJ,IAAA,WAAA,MAAiB,MAAM,QAAA,CAAS,aAAA,CAAe,KAAA,EAAO,GAAA,EAAK,IAAI,CAAA,EAAG;AAChE,MAAA,IAAI,EAAA,CAAG,IAAA,KAAS,OAAA,EAAS,KAAA,GAAQ,EAAA,CAAG,MAAA;AAAA,IACtC;AACA,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,wCAAwC,CAAA;AACpE,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAAA,EACA,OAAO,aAAA,CAAc,KAAA,EAAO,GAAA,EAAK,IAAA,EAAmD;AAClF,IAAA,IAAI,CAAC,KAAA,EAAO,OAAA,EAAS,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAChE,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,KAAA,CAAM,UAAA,IAAc,eAAA,EAAiB,GAAO,CAAC,CAAA;AAEpF,IAAA,MAAM,KAAA,GAAW,aAAS,KAAM,OAAA;AAChC,IAAA,MAAM,KAAA,GAAQ,KAAA,GACT,OAAA,CAAQ,GAAA,CAAI,SAAS,KAAK,SAAA,GAC1B,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,IAAK,WAAA;AAC7B,IAAA,MAAM,IAAA,GAAO,KAAA,GAAQ,CAAC,IAAA,EAAM,KAAA,CAAM,OAAO,CAAA,GAAI,CAAC,IAAA,EAAM,KAAA,CAAM,OAAO,CAAA;AAEjE,IAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,OAAA,EAAS,EAAE,CAAA;AAQzC,IAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAC,CAAC,MAAM,UAAA,GAAa,IAAA;AAC9C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,EAAO,IAAA,EAAM;AAAA,MAC/B,KAAK,GAAA,CAAI,WAAA;AAAA,MACT,GAAA;AAAA,MACA,OAAO,KAAA,CAAM,UAAA,GAAa,WAAW,CAAC,QAAA,EAAU,QAAQ,MAAM,CAAA;AAAA,MAC9D,QAAA;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAED,IAAA,IAAI,MAAM,UAAA,EAAY;AACpB,MAAA,MAAM,MAAM,KAAA,CAAM,GAAA;AAClB,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,KAAA,CAAM,KAAA,EAAM;AACzC,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,OAAA;AAAA,QACN,MAAA,EAAQ;AAAA,UACN,MAAA,EAAQ,CAAA,iBAAA,EAAoB,GAAA,IAAO,SAAS,CAAA,CAAA;AAAA,UAC5C,SAAA,EAAW,IAAA;AAAA,UACX,SAAA,EAAW,KAAA;AAAA,UACX;AAAA;AACF,OACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,IAAI,OAAA,GAAU,EAAA;AACd,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,MAAM,SAA2B,EAAC;AAClC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,IAAI;AACF,UAAA,KAAA,CAAM,IAAA,EAAK;AAAA,QACb,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF,CAAA,MAAO;AACL,QAAA,IAAI;AAIF,UAAA,IAAI,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU;AACjC,YAAA,IAAI;AACF,cAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,CAAM,GAAA,EAAK,SAAS,CAAA;AAAA,YACpC,CAAA,CAAA,MAAQ;AACN,cAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,YACtB;AAAA,UACF,CAAA,MAAO;AACL,YAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,UACtB;AACA,UAAA,MAAM,SAAA,GAAY,WAAW,MAAM;AACjC,YAAA,IAAI;AACF,cAAA,IAAI,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU;AACjC,gBAAA,IAAI;AACF,kBAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,CAAM,GAAA,EAAK,SAAS,CAAA;AAAA,gBACpC,CAAA,CAAA,MAAQ;AACN,kBAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,gBACtB;AAAA,cACF,CAAA,MAAO;AACL,gBAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,cACtB;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF,GAAG,GAAI,CAAA;AACP,UAAA,MAAA,CAAO,KAAK,SAAS,CAAA;AAAA,QACvB,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,GAAG,SAAS,CAAA;AACZ,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,IAAA,KAAA,CAAM,KAAA,IAAQ;AASd,IAAA,MAAM,QAAiB,EAAC;AACxB,IAAA,IAAI,WAAA,GAA2C,IAAA;AAC/C,IAAA,MAAM,IAAA,GAAO,CAAC,CAAA,KAAa;AACzB,MAAA,IAAI,WAAA,EAAa;AACf,QAAA,MAAM,CAAA,GAAI,WAAA;AACV,QAAA,WAAA,GAAc,IAAA;AACd,QAAA,CAAA,CAAE,CAAC,CAAA;AAAA,MACL,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AAAA,MACd;AAAA,IACF,CAAA;AACA,IAAA,MAAM,IAAA,GAAO,MACX,IAAI,OAAA,CAAQ,CAACA,QAAAA,KAAY;AACvB,MAAA,MAAM,CAAA,GAAI,MAAM,KAAA,EAAM;AACtB,MAAA,IAAI,CAAA,EAAGA,QAAAA,CAAQ,CAAC,CAAA;AAAA,WACX,WAAA,GAAcA,QAAAA;AAAA,IACrB,CAAC,CAAA;AAEH,IAAA,IAAI,SAAA,GAAY,KAAK,GAAA,EAAI;AACzB,IAAA,MAAM,QAAQ,MAAM;AAClB,MAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACjC,MAAA,MAAM,IAAA,GAAO,OAAA;AACb,MAAA,OAAA,GAAU,EAAA;AACV,MAAA,SAAA,GAAY,KAAK,GAAA,EAAI;AACrB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAEA,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAU;AAClC,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,EAAS;AAC5B,MAAA,GAAA,IAAO,IAAA;AACP,MAAA,OAAA,IAAW,IAAA;AACX,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IAC7B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAU;AAClC,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,EAAS;AAC5B,MAAA,GAAA,IAAO,IAAA;AACP,MAAA,OAAA,IAAW,IAAA;AACX,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IAC7B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,YAAA,CAAa,CAAC,CAAA;AACtC,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,CAAA;AAAA,IAC7B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,YAAA,CAAa,CAAC,CAAA;AACtC,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAC5B,CAAC,CAAA;AAED,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,EAAM;AACX,QAAA,MAAM,CAAA,GAAI,MAAM,IAAA,EAAK;AACrB,QAAA,IAAI,CAAA,CAAE,IAAA,KAAS,OAAA,EAAS,MAAM,CAAA,CAAE,GAAA;AAChC,QAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACpB,UAAA,MAAM,YAAY,KAAA,EAAM;AACxB,UAAA,IAAI,cAAc,IAAA,EAAM;AACtB,YAAA,MAAM,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,SAAA,EAAU;AAAA,UAClD;AACA,UAAA,MAAM,UAAU,SAAA,CAAU,GAAG,CAAA,CAAE,OAAA,CAAQ,UAAU,IAAI,CAAA;AACrD,UAAA,MAAM;AAAA,YACJ,IAAA,EAAM,OAAA;AAAA,YACN,MAAA,EAAQ;AAAA,cACN,MAAA,EAAQ,cAAA,CAAe,OAAA,EAAS,UAAU,CAAA;AAAA,cAC1C,WAAW,CAAA,CAAE,IAAA;AAAA,cACb,SAAA,EAAW;AAAA;AACb,WACF;AACA,UAAA;AAAA,QACF;AAIA,QAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,QAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,kBAAA,IAAsB,GAAA,GAAM,aAAa,wBAAA,EAA0B;AACvF,UAAA,MAAM,OAAO,KAAA,EAAM;AACnB,UAAA,IAAI,IAAA,EAAM,MAAM,EAAE,IAAA,EAAM,kBAAkB,IAAA,EAAK;AAAA,QACjD;AAAA,MACF;AAAA,IACF,CAAA,SAAE;AACA,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,YAAA,CAAa,CAAC,CAAA;AAAA,IACxC;AAAA,EACF;AACF","file":"bash.js","sourcesContent":["import * as path from 'node:path';\nimport type { Context } from '@wrongstack/core';\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const root = path.resolve(ctx.projectRoot);\n  const target = path.resolve(absPath);\n  const rel = path.relative(root, target);\n  if (rel.startsWith('..') || path.isAbsolute(rel)) {\n    throw new Error(`Path \"${absPath}\" is outside project root \"${root}\"`);\n  }\n  return target;\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n","import { spawn } from 'node:child_process';\nimport * as os from 'node:os';\nimport type { Tool, ToolStreamEvent } from '@wrongstack/core';\nimport { stripAnsi } from '@wrongstack/core';\nimport { buildChildEnv } from './_env.js';\nimport { truncateMiddle } from './_util.js';\n\ninterface BashInput {\n  command: string;\n  timeout_ms?: number;\n  background?: boolean;\n}\n\ninterface BashOutput {\n  output: string;\n  exit_code: number | null;\n  timed_out: boolean;\n  pid?: number;\n}\n\nconst MAX_OUTPUT = 32_768;\nconst DEFAULT_TIMEOUT = 30_000;\n// Flush partial_output every 200ms or when 4 KiB accumulates — whichever\n// comes first. Smaller batches make the TUI feel responsive; larger ones\n// keep EventBus traffic reasonable on chatty processes.\nconst STREAM_FLUSH_INTERVAL_MS = 200;\nconst STREAM_FLUSH_BYTES = 4 * 1024;\n\nexport const bashTool: Tool<BashInput, BashOutput> = {\n  name: 'bash',\n  description: 'Run a shell command. stdout and stderr are merged.',\n  usageHint:\n    'Runs via `bash -c` (or `cmd /c` on Windows). Cwd is the project root. Default timeout 30s. Output truncated from the middle if oversized. Use for git, npm, builds, tests.',\n  permission: 'confirm',\n  mutating: true,\n  // Trust rules match on the literal `command` string. Without subjectKey\n  // the policy heuristic would have done the same here, but declaring it\n  // explicitly removes the implicit cross-tool aliasing.\n  subjectKey: 'command',\n  timeoutMs: 30_000,\n  maxOutputBytes: MAX_OUTPUT,\n  estimatedDurationMs: 3_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      command: { type: 'string' },\n      timeout_ms: { type: 'integer' },\n      background: { type: 'boolean' },\n    },\n    required: ['command'],\n  },\n  async execute(input, ctx, opts) {\n    let final: BashOutput | undefined;\n    for await (const ev of bashTool.executeStream!(input, ctx, opts)) {\n      if (ev.type === 'final') final = ev.output;\n    }\n    if (!final) throw new Error('bash: stream ended without final event');\n    return final;\n  },\n  async *executeStream(input, ctx, opts): AsyncGenerator<ToolStreamEvent<BashOutput>> {\n    if (!input?.command) throw new Error('bash: command is required');\n    const timeoutMs = Math.max(1, Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT, 600_000));\n\n    const isWin = os.platform() === 'win32';\n    const shell = isWin\n      ? (process.env['COMSPEC'] ?? 'cmd.exe')\n      : (process.env['SHELL'] ?? '/bin/bash');\n    const args = isWin ? ['/c', input.command] : ['-c', input.command];\n\n    const env = buildChildEnv(ctx.session?.id);\n\n    // On POSIX we put the shell in its own process group so that timeout /\n    // abort can kill the entire group with `process.kill(-pid)`. Otherwise\n    // `bash -c \"sleep 9999 & disown\"` would leave the grandchild running.\n    // `detached: true` is also reused for the user-facing background mode;\n    // we always want detached on POSIX, only on Windows is it tied to the\n    // explicit background flag.\n    const detached = isWin ? !!input.background : true;\n    const child = spawn(shell, args, {\n      cwd: ctx.projectRoot,\n      env,\n      stdio: input.background ? 'ignore' : ['ignore', 'pipe', 'pipe'],\n      detached,\n      signal: opts.signal,\n    });\n\n    if (input.background) {\n      const pid = child.pid;\n      if (typeof pid === 'number') child.unref();\n      yield {\n        type: 'final',\n        output: {\n          output: `[background] pid=${pid ?? 'unknown'}`,\n          exit_code: null,\n          timed_out: false,\n          pid,\n        },\n      };\n      return;\n    }\n\n    let buf = '';\n    let pending = '';\n    let timedOut = false;\n    const timers: NodeJS.Timeout[] = [];\n    const timer = setTimeout(() => {\n      timedOut = true;\n      if (isWin) {\n        try {\n          child.kill();\n        } catch {\n          /* ignore */\n        }\n      } else {\n        try {\n          // Kill the process group, not just the shell — pid is positive,\n          // group id is the negated pid. Without this a runaway grandchild\n          // ('sleep 9999 & disown') survives bash termination.\n          if (typeof child.pid === 'number') {\n            try {\n              process.kill(-child.pid, 'SIGTERM');\n            } catch {\n              child.kill('SIGTERM');\n            }\n          } else {\n            child.kill('SIGTERM');\n          }\n          const killTimer = setTimeout(() => {\n            try {\n              if (typeof child.pid === 'number') {\n                try {\n                  process.kill(-child.pid, 'SIGKILL');\n                } catch {\n                  child.kill('SIGKILL');\n                }\n              } else {\n                child.kill('SIGKILL');\n              }\n            } catch {\n              /* ignore */\n            }\n          }, 2000);\n          timers.push(killTimer);\n        } catch {\n          /* ignore */\n        }\n      }\n    }, timeoutMs);\n    timers.push(timer);\n    timer.unref?.();\n\n    // Bridge the EventEmitter-style child to an async iterator. We push\n    // chunks into a queue and let the generator pull them; this lets us\n    // yield 'partial_output' events to the executor at flush boundaries.\n    type Chunk =\n      | { kind: 'data'; text: string }\n      | { kind: 'end'; code: number | null }\n      | { kind: 'error'; err: Error };\n    const queue: Chunk[] = [];\n    let resolveNext: ((c: Chunk) => void) | null = null;\n    const push = (c: Chunk) => {\n      if (resolveNext) {\n        const r = resolveNext;\n        resolveNext = null;\n        r(c);\n      } else {\n        queue.push(c);\n      }\n    };\n    const next = (): Promise<Chunk> =>\n      new Promise((resolve) => {\n        const c = queue.shift();\n        if (c) resolve(c);\n        else resolveNext = resolve;\n      });\n\n    let lastFlush = Date.now();\n    const flush = () => {\n      if (pending.length === 0) return null;\n      const text = pending;\n      pending = '';\n      lastFlush = Date.now();\n      return text;\n    };\n\n    child.stdout?.on('data', (chunk) => {\n      const text = chunk.toString();\n      buf += text;\n      pending += text;\n      push({ kind: 'data', text });\n    });\n    child.stderr?.on('data', (chunk) => {\n      const text = chunk.toString();\n      buf += text;\n      pending += text;\n      push({ kind: 'data', text });\n    });\n    child.on('error', (err) => {\n      for (const t of timers) clearTimeout(t);\n      push({ kind: 'error', err });\n    });\n    child.on('close', (code) => {\n      for (const t of timers) clearTimeout(t);\n      push({ kind: 'end', code });\n    });\n\n    try {\n      while (true) {\n        const c = await next();\n        if (c.kind === 'error') throw c.err;\n        if (c.kind === 'end') {\n          const remainder = flush();\n          if (remainder !== null) {\n            yield { type: 'partial_output', text: remainder };\n          }\n          const cleaned = stripAnsi(buf).replace(/\\r\\n?/g, '\\n');\n          yield {\n            type: 'final',\n            output: {\n              output: truncateMiddle(cleaned, MAX_OUTPUT),\n              exit_code: c.code,\n              timed_out: timedOut,\n            },\n          };\n          return;\n        }\n        // Decide whether to flush. Time-based OR size-based to keep latency\n        // low for slow-emitting commands without overwhelming the TUI for\n        // chatty ones.\n        const now = Date.now();\n        if (pending.length >= STREAM_FLUSH_BYTES || now - lastFlush >= STREAM_FLUSH_INTERVAL_MS) {\n          const text = flush();\n          if (text) yield { type: 'partial_output', text };\n        }\n      }\n    } finally {\n      for (const t of timers) clearTimeout(t);\n    }\n  },\n};\n\n// Re-export types so consumers can narrow on stream events.\nexport type { BashInput, BashOutput };\n"]}

package/dist/batch-tool-use.js

@@ -4,7 +4,7 @@ var batchToolUseTool = {
   description: "Execute multiple tool calls in sequence or parallel. Returns all results.",
   usageHint: "Set `calls` array with tool names and inputs. `stop_on_error` halts on first failure. `parallel` runs concurrently (default: true).",
   permission: "confirm",
-  mutating: false,
+  mutating: true,
   timeoutMs: 12e4,
   inputSchema: {
     type: "object",

package/dist/batch-tool-use.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/batch-tool-use.ts"],"names":[],"mappings":";AAyBO,IAAM,gBAAA,GAAgE;AAAA,EAC3E,IAAA,EAAM,gBAAA;AAAA,EACN,WAAA,EACE,2EAAA;AAAA,EACF,SAAA,EACE,qIAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,KAAA;AAAA,EACV,SAAA,EAAW,IAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,OAAA;AAAA,QACN,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,QAAA;AAAA,UACN,UAAA,EAAY;AAAA,YACV,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,YACvB,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA;AAAS,WAC1B;AAAA,UACA,QAAA,EAAU,CAAC,MAAM;AAAA,SACnB;AAAA,QACA,WAAA,EAAa;AAAA,OACf;AAAA,MACA,aAAA,EAAe;AAAA,QACb,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,QAAA,EAAU;AAAA,QACR,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf,KACF;AAAA,IACA,QAAA,EAAU,CAAC,OAAO;AAAA,GACpB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,CAAC,KAAA,EAAO,KAAA,IAAS,KAAA,CAAM,KAAA,CAAM,WAAW,CAAA,EAAG;AAC7C,MAAA,OAAO;AAAA,QACL,SAAS,EAAC;AAAA,QACV,KAAA,EAAO,CAAA;AAAA,QACP,SAAA,EAAW,CAAA;AAAA,QACX,MAAA,EAAQ,CAAA;AAAA,QACR,aAAA,EAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,MAAM,UAAyC,EAAC;AAChD,IAAA,IAAI,SAAA,GAAY,CAAA;AAChB,IAAA,IAAI,MAAA,GAAS,CAAA;AAEb,IAAA,IAAI,KAAA,CAAM,aAAa,KAAA,EAAO;AAC5B,MAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,CAAM,GAAA,CAAI,OAAO,SAAS,aAAA,CAAc,IAAA,EAAM,GAAA,EAAK,IAAI,CAAC,CAAA;AAC/E,MAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AAC7C,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,UAAU,CAAA;AAC1B,MAAA,SAAA,GAAY,WAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,CAAA,CAAE,MAAA;AAChD,MAAA,MAAA,GAAS,WAAW,MAAA,CAAO,CAAC,MAAM,CAAC,CAAA,CAAE,OAAO,CAAA,CAAE,MAAA;AAAA,IAChD,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAM,KAAA,EAAO;AAC9B,QAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,IAAA,EAAM,KAAK,IAAI,CAAA;AAClD,QAAA,OAAA,CAAQ,KAAK,MAAM,CAAA;AACnB,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,SAAA,EAAA;AAAA,QACF,CAAA,MAAO;AACL,UAAA,MAAA,EAAA;AACA,UAAA,IAAI,MAAM,aAAA,EAAe;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,KAAA,EAAO,MAAM,KAAA,CAAM,MAAA;AAAA,MACnB,SAAA;AAAA,MACA,MAAA;AAAA,MACA,aAAA,EAAe,MAAM,aAAA,IAAiB;AAAA,KACxC;AAAA,EACF;AACF;AAEA,eAAe,aAAA,CACb,IAAA,EACA,GAAA,EACA,IAAA,EAC2C;AAC3C,EAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,EAAA,MAAM,IAAA,GAAO,IAAI,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAY,CAAA,CAAE,IAAA,KAAS,IAAA,CAAK,IAAI,CAAA;AAE7D,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO,CAAA,MAAA,EAAS,IAAA,CAAK,IAAI,CAAA,WAAA,CAAA;AAAA,MACzB,WAAA,EAAa,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,KAC5B;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA,EAAO,KAAK,IAAI,CAAA;AACvD,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,OAAA,EAAS,IAAA;AAAA,MACT,MAAA;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,KAC5B;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,OAAA,EAAS,KAAA;AAAA,MACT,OAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,OAAO,CAAC,CAAA;AAAA,MAChD,WAAA,EAAa,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,KAC5B;AAAA,EACF;AACF","file":"batch-tool-use.js","sourcesContent":["import type { Tool } from '@wrongstack/core';\n\ninterface BatchToolUseInput {\n  calls: {\n    tool: string;\n    input: Record<string, unknown>;\n  }[];\n  stop_on_error?: boolean;\n  parallel?: boolean;\n}\n\ninterface BatchToolUseOutput {\n  results: {\n    tool: string;\n    success: boolean;\n    result?: unknown;\n    error?: string;\n    executionMs: number;\n  }[];\n  total: number;\n  succeeded: number;\n  failed: number;\n  stop_on_error: boolean;\n}\n\nexport const batchToolUseTool: Tool<BatchToolUseInput, BatchToolUseOutput> = {\n  name: 'batch_tool_use',\n  description:\n    'Execute multiple tool calls in sequence or parallel. Returns all results.',\n  usageHint:\n    'Set `calls` array with tool names and inputs. `stop_on_error` halts on first failure. `parallel` runs concurrently (default: true).',\n  permission: 'confirm',\n  mutating: false,\n  timeoutMs: 120_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      calls: {\n        type: 'array',\n        items: {\n          type: 'object',\n          properties: {\n            tool: { type: 'string' },\n            input: { type: 'object' },\n          },\n          required: ['tool'],\n        },\n        description: 'Array of tool calls to execute',\n      },\n      stop_on_error: {\n        type: 'boolean',\n        description: 'Stop execution on first error (default: false)',\n      },\n      parallel: {\n        type: 'boolean',\n        description: 'Execute calls in parallel (default: true)',\n      },\n    },\n    required: ['calls'],\n  },\n  async execute(input, ctx, opts) {\n    if (!input?.calls || input.calls.length === 0) {\n      return {\n        results: [],\n        total: 0,\n        succeeded: 0,\n        failed: 0,\n        stop_on_error: false,\n      };\n    }\n\n    const results: BatchToolUseOutput['results'] = [];\n    let succeeded = 0;\n    let failed = 0;\n\n    if (input.parallel !== false) {\n      const promises = input.calls.map(async (call) => executeSingle(call, ctx, opts));\n      const allResults = await Promise.all(promises);\n      results.push(...allResults);\n      succeeded = allResults.filter((r) => r.success).length;\n      failed = allResults.filter((r) => !r.success).length;\n    } else {\n      for (const call of input.calls) {\n        const result = await executeSingle(call, ctx, opts);\n        results.push(result);\n        if (result.success) {\n          succeeded++;\n        } else {\n          failed++;\n          if (input.stop_on_error) break;\n        }\n      }\n    }\n\n    return {\n      results,\n      total: input.calls.length,\n      succeeded,\n      failed,\n      stop_on_error: input.stop_on_error ?? false,\n    };\n  },\n};\n\nasync function executeSingle(\n  call: { tool: string; input: Record<string, unknown> },\n  ctx: import('@wrongstack/core').Context,\n  opts: { signal: AbortSignal },\n): Promise<BatchToolUseOutput['results'][0]> {\n  const start = Date.now();\n  const tool = ctx.tools.find((t: Tool) => t.name === call.tool);\n\n  if (!tool) {\n    return {\n      tool: call.tool,\n      success: false,\n      error: `tool \"${call.tool}\" not found`,\n      executionMs: Date.now() - start,\n    };\n  }\n\n  try {\n    const result = await tool.execute(call.input, ctx, opts);\n    return {\n      tool: call.tool,\n      success: true,\n      result,\n      executionMs: Date.now() - start,\n    };\n  } catch (e) {\n    return {\n      tool: call.tool,\n      success: false,\n      error: e instanceof Error ? e.message : String(e),\n      executionMs: Date.now() - start,\n    };\n  }\n}"]}
+{"version":3,"sources":["../src/batch-tool-use.ts"],"names":[],"mappings":";AAyBO,IAAM,gBAAA,GAAgE;AAAA,EAC3E,IAAA,EAAM,gBAAA;AAAA,EACN,WAAA,EAAa,2EAAA;AAAA,EACb,SAAA,EACE,qIAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,IAAA;AAAA,EACV,SAAA,EAAW,IAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,OAAA;AAAA,QACN,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,QAAA;AAAA,UACN,UAAA,EAAY;AAAA,YACV,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,YACvB,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA;AAAS,WAC1B;AAAA,UACA,QAAA,EAAU,CAAC,MAAM;AAAA,SACnB;AAAA,QACA,WAAA,EAAa;AAAA,OACf;AAAA,MACA,aAAA,EAAe;AAAA,QACb,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,QAAA,EAAU;AAAA,QACR,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf,KACF;AAAA,IACA,QAAA,EAAU,CAAC,OAAO;AAAA,GACpB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,CAAC,KAAA,EAAO,KAAA,IAAS,KAAA,CAAM,KAAA,CAAM,WAAW,CAAA,EAAG;AAC7C,MAAA,OAAO;AAAA,QACL,SAAS,EAAC;AAAA,QACV,KAAA,EAAO,CAAA;AAAA,QACP,SAAA,EAAW,CAAA;AAAA,QACX,MAAA,EAAQ,CAAA;AAAA,QACR,aAAA,EAAe;AAAA,OACjB;AAAA,IACF;AAEA,IAAA,MAAM,UAAyC,EAAC;AAChD,IAAA,IAAI,SAAA,GAAY,CAAA;AAChB,IAAA,IAAI,MAAA,GAAS,CAAA;AAEb,IAAA,IAAI,KAAA,CAAM,aAAa,KAAA,EAAO;AAC5B,MAAA,MAAM,QAAA,GAAW,KAAA,CAAM,KAAA,CAAM,GAAA,CAAI,OAAO,SAAS,aAAA,CAAc,IAAA,EAAM,GAAA,EAAK,IAAI,CAAC,CAAA;AAC/E,MAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AAC7C,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,UAAU,CAAA;AAC1B,MAAA,SAAA,GAAY,WAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,CAAA,CAAE,MAAA;AAChD,MAAA,MAAA,GAAS,WAAW,MAAA,CAAO,CAAC,MAAM,CAAC,CAAA,CAAE,OAAO,CAAA,CAAE,MAAA;AAAA,IAChD,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAM,KAAA,EAAO;AAC9B,QAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,IAAA,EAAM,KAAK,IAAI,CAAA;AAClD,QAAA,OAAA,CAAQ,KAAK,MAAM,CAAA;AACnB,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,SAAA,EAAA;AAAA,QACF,CAAA,MAAO;AACL,UAAA,MAAA,EAAA;AACA,UAAA,IAAI,MAAM,aAAA,EAAe;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,KAAA,EAAO,MAAM,KAAA,CAAM,MAAA;AAAA,MACnB,SAAA;AAAA,MACA,MAAA;AAAA,MACA,aAAA,EAAe,MAAM,aAAA,IAAiB;AAAA,KACxC;AAAA,EACF;AACF;AAEA,eAAe,aAAA,CACb,IAAA,EACA,GAAA,EACA,IAAA,EAC2C;AAC3C,EAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,EAAA,MAAM,IAAA,GAAO,IAAI,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAY,CAAA,CAAE,IAAA,KAAS,IAAA,CAAK,IAAI,CAAA;AAE7D,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO,CAAA,MAAA,EAAS,IAAA,CAAK,IAAI,CAAA,WAAA,CAAA;AAAA,MACzB,WAAA,EAAa,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,KAC5B;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA,EAAO,KAAK,IAAI,CAAA;AACvD,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,OAAA,EAAS,IAAA;AAAA,MACT,MAAA;AAAA,MACA,WAAA,EAAa,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,KAC5B;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,OAAA,EAAS,KAAA;AAAA,MACT,OAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,OAAO,CAAC,CAAA;AAAA,MAChD,WAAA,EAAa,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,KAC5B;AAAA,EACF;AACF","file":"batch-tool-use.js","sourcesContent":["import type { Tool } from '@wrongstack/core';\n\ninterface BatchToolUseInput {\n  calls: {\n    tool: string;\n    input: Record<string, unknown>;\n  }[];\n  stop_on_error?: boolean;\n  parallel?: boolean;\n}\n\ninterface BatchToolUseOutput {\n  results: {\n    tool: string;\n    success: boolean;\n    result?: unknown;\n    error?: string;\n    executionMs: number;\n  }[];\n  total: number;\n  succeeded: number;\n  failed: number;\n  stop_on_error: boolean;\n}\n\nexport const batchToolUseTool: Tool<BatchToolUseInput, BatchToolUseOutput> = {\n  name: 'batch_tool_use',\n  description: 'Execute multiple tool calls in sequence or parallel. Returns all results.',\n  usageHint:\n    'Set `calls` array with tool names and inputs. `stop_on_error` halts on first failure. `parallel` runs concurrently (default: true).',\n  permission: 'confirm',\n  mutating: true,\n  timeoutMs: 120_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      calls: {\n        type: 'array',\n        items: {\n          type: 'object',\n          properties: {\n            tool: { type: 'string' },\n            input: { type: 'object' },\n          },\n          required: ['tool'],\n        },\n        description: 'Array of tool calls to execute',\n      },\n      stop_on_error: {\n        type: 'boolean',\n        description: 'Stop execution on first error (default: false)',\n      },\n      parallel: {\n        type: 'boolean',\n        description: 'Execute calls in parallel (default: true)',\n      },\n    },\n    required: ['calls'],\n  },\n  async execute(input, ctx, opts) {\n    if (!input?.calls || input.calls.length === 0) {\n      return {\n        results: [],\n        total: 0,\n        succeeded: 0,\n        failed: 0,\n        stop_on_error: false,\n      };\n    }\n\n    const results: BatchToolUseOutput['results'] = [];\n    let succeeded = 0;\n    let failed = 0;\n\n    if (input.parallel !== false) {\n      const promises = input.calls.map(async (call) => executeSingle(call, ctx, opts));\n      const allResults = await Promise.all(promises);\n      results.push(...allResults);\n      succeeded = allResults.filter((r) => r.success).length;\n      failed = allResults.filter((r) => !r.success).length;\n    } else {\n      for (const call of input.calls) {\n        const result = await executeSingle(call, ctx, opts);\n        results.push(result);\n        if (result.success) {\n          succeeded++;\n        } else {\n          failed++;\n          if (input.stop_on_error) break;\n        }\n      }\n    }\n\n    return {\n      results,\n      total: input.calls.length,\n      succeeded,\n      failed,\n      stop_on_error: input.stop_on_error ?? false,\n    };\n  },\n};\n\nasync function executeSingle(\n  call: { tool: string; input: Record<string, unknown> },\n  ctx: import('@wrongstack/core').Context,\n  opts: { signal: AbortSignal },\n): Promise<BatchToolUseOutput['results'][0]> {\n  const start = Date.now();\n  const tool = ctx.tools.find((t: Tool) => t.name === call.tool);\n\n  if (!tool) {\n    return {\n      tool: call.tool,\n      success: false,\n      error: `tool \"${call.tool}\" not found`,\n      executionMs: Date.now() - start,\n    };\n  }\n\n  try {\n    const result = await tool.execute(call.input, ctx, opts);\n    return {\n      tool: call.tool,\n      success: true,\n      result,\n      executionMs: Date.now() - start,\n    };\n  } catch (e) {\n    return {\n      tool: call.tool,\n      success: false,\n      error: e instanceof Error ? e.message : String(e),\n      executionMs: Date.now() - start,\n    };\n  }\n}\n"]}