@wrongstack/tools 0.284.0 → 0.285.0

package/dist/_util.d.ts

@@ -0,0 +1,68 @@
+import type { Context } from '@wrongstack/core';
+/**
+ * sha-256 hex of a UTF-8 string. Used by the file tools to record a content
+ * hash alongside the mtime in `ctx.recordRead` — the hash is the authoritative
+ * staleness arbiter for `edit` (mtime has a 2 s tolerance window on Windows).
+ */
+export declare function sha256hex(content: string): string;
+/** Detected package manager for a project directory. */
+export type PackageManager = 'pnpm' | 'yarn' | 'npm';
+/**
+ * Detect the project's package manager by inspecting lockfiles in `cwd`.
+ * Order: pnpm → yarn → npm (default). Missing or unreadable directories fall
+ * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that
+ * happens to be empty never aborts the tool.
+ */
+export declare function detectPackageManager(cwd: string): Promise<PackageManager>;
+export declare function resolvePath(input: string, ctx: Context): string;
+export declare function ensureInsideRoot(absPath: string, ctx: Context): string;
+export declare function safeResolve(input: string, ctx: Context): string;
+/**
+ * Defense against in-root→out-of-root symlink escape (CWE-59). `safeResolve`
+ * only does a syntactic `../` check, so a symlink that lives *inside* the
+ * project root but points outside still passes it. This resolves the path
+ * through `fs.realpath` and re-verifies containment against the realpath of
+ * the project root (comparing like-for-like, since the root itself may be a
+ * symlink — macOS `/var`→`/private/var`, Windows 8.3 short names). For a path
+ * that does not exist yet (e.g. a `write` to a new file) the nearest existing
+ * ancestor directory is checked instead. Throws if the real target escapes.
+ *
+ * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied
+ * to single-file `read`/`edit`/`write` it throws (rather than skips) because
+ * the caller named exactly one file.
+ */
+export declare function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void>;
+/** `safeResolve` + symlink realpath containment check. Async. */
+export declare function safeResolveReal(input: string, ctx: Context): Promise<string>;
+export declare function truncateMiddle(s: string, max: number): string;
+export declare function isBinaryBuffer(buf: Buffer): boolean;
+/** Unified byte cap for all command tool output fed to the model. */
+export declare const COMMAND_OUTPUT_MAX_BYTES = 32768;
+/**
+ * Collapse carriage-return overwrites the way a terminal would: `\r\n` becomes
+ * `\n`, and a bare `\r` (progress redraw) keeps only the text after the LAST
+ * `\r` on its physical line. Without this, a single progress bar that redraws
+ * 200 times explodes into 200 lines.
+ */
+export declare function collapseCarriageReturns(text: string): string;
+/**
+ * Collapse a run of `minRun`+ identical consecutive lines into the line once
+ * plus a marker. Consecutive-only — it never reorders or dedups non-adjacent
+ * lines, so diffs/source stay intact.
+ */
+export declare function collapseConsecutiveDuplicates(text: string, minRun?: number): string;
+/**
+ * Truncate to `maxBytes` keeping BOTH ends — the head (what ran / early context)
+ * and the tail (errors and summaries usually land last), biased ~45/55 toward
+ * the tail. The result never exceeds `maxBytes`.
+ */
+export declare function truncateHeadTail(s: string, maxBytes: number): string;
+/**
+ * Full token-saving pipeline for command tool output: strip ANSI → collapse
+ * carriage-return progress → trim trailing whitespace → collapse identical
+ * consecutive lines → squeeze blank-line runs → head+tail truncate to the cap.
+ */
+export declare function normalizeCommandOutput(raw: string, opts?: {
+    maxBytes?: number | undefined;
+}): string;
+//# sourceMappingURL=_util.d.ts.map

package/dist/_util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_util.d.ts","sourceRoot":"","sources":["../src/_util.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD;AACD,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;AAErD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAe/E;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAE/D;AAmBD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAMtE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BvF;AAED,iEAAiE;AACjE,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAIlF;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQ7D;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMnD;AAUD,qEAAqE;AACrE,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAK/C;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,SAAuB,GAAG,MAAM,CAgBjG;AAgCD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAYpE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GAC3C,MAAM,CAQR"}

package/dist/_win32-resolve.d.ts

@@ -0,0 +1,42 @@
+/**
+ * On Windows, Node.js `spawn()` without a shell does NOT resolve .cmd/.bat
+ * extensions through PATHEXT — it only auto-resolves .exe. Most Node.js CLI
+ * tools (npx, pnpm, biome, tsc, vitest, etc.) ship as .cmd wrappers on
+ * Windows. This function resolves the command name to its full path so spawn
+ * can find it without relying on shell-mode argument concatenation.
+ *
+ * On non-Windows, returns the command unchanged.
+ */
+export declare function resolveWin32Command(cmd: string): string;
+/**
+ * Resolve a PowerShell binary by name. `pickShell` in `_shell-pick.ts`
+ * already decides whether the user wants `'pwsh'` (PowerShell 7+) or
+ * `'powershell'` (Windows PowerShell 5.1). This helper turns that decision
+ * into a real on-disk path.
+ *
+ * Order:
+ *   1. If `cmd` is `pwsh` and a `pwsh.exe` exists on PATH → return that.
+ *   2. If `cmd` is `pwsh` and only `powershell.exe` exists → fall back to
+ *      that (the alternative is a cryptic ENOENT for the user).
+ *   3. Symmetric for `powershell`: prefer `powershell.exe`, fall back to
+ *      `pwsh.exe` if installed and the legacy binary is missing.
+ *   4. Anything else → delegate to `resolveWin32Command` (handles `.cmd`
+ *      shims a sysadmin might drop in place, etc.).
+ *
+ * Returns the original command on ENOENT — `spawn()` will surface a clean
+ * ENOENT and the user sees "PowerShell not installed", which is the right
+ * diagnostic. We never throw from here.
+ */
+export declare function resolvePowerShell(cmd: string): string;
+export interface Win32CmdShimInvocation {
+    command: string;
+    args: string[];
+    windowsVerbatimArguments: true;
+}
+/**
+ * Throw if any argument contains a cmd.exe command-injection metacharacter.
+ * Call this ONLY on the Windows `.cmd`/`.bat` shim path. A no-op for safe args.
+ */
+export declare function assertSafeWin32ShellArgs(args: readonly unknown[]): void;
+export declare function buildWin32CmdShimInvocation(command: string, args?: readonly string[]): Win32CmdShimInvocation;
+//# sourceMappingURL=_win32-resolve.d.ts.map

package/dist/_win32-resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_win32-resolve.d.ts","sourceRoot":"","sources":["../src/_win32-resolve.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAkCvD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBrD;AAkBD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,wBAAwB,EAAE,IAAI,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAWvE;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,SAAS,MAAM,EAAO,GAC3B,sBAAsB,CAQxB"}

package/dist/audit.d.ts

@@ -1,5 +1,4 @@
-import { Tool } from '@wrongstack/core';
-
+import type { Tool } from '@wrongstack/core';
 interface AuditInput {
     cwd?: string | undefined;
     level?: 'low' | 'moderate' | 'high' | 'critical' | undefined;
@@ -20,6 +19,6 @@ interface AuditOutput {
     output: string;
     truncated: boolean;
 }
-declare const auditTool: Tool<AuditInput, AuditOutput>;
-
-export { auditTool };
+export declare const auditTool: Tool<AuditInput, AuditOutput>;
+export {};
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAmB,MAAM,kBAAkB,CAAC;AAK9D,UAAU,UAAU;IAClB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,KAAK,CAAC,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC7D,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;CAC1C;AAED,UAAU,kBAAkB;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,UAAU,WAAW;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,kBAAkB,EAAE,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CA+FnD,CAAC"}