@wrongstack/tools 0.287.0 → 0.289.0

package/dist/_fetch-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_fetch-guard.d.ts","sourceRoot":"","sources":["../src/_fetch-guard.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,aAAa,SAAwD,CAAC;AAUnF,KAAK,cAAc,GAAG,CACpB,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EACjC,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EACzE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,KACxB,IAAI,CAAC;AAEV;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EACnE,QAAQ,EAAE,cAAc,GACvB,IAAI,CAsCN;AAwCD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAG7B,GACA,OAAO,CAAC,QAAQ,CAAC,CAuDnB;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoDtE"}
+{"version":3,"file":"_fetch-guard.d.ts","sourceRoot":"","sources":["../src/_fetch-guard.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,aAAa,SAAwD,CAAC;AAUnF,KAAK,cAAc,GAAG,CACpB,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EACjC,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EACzE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,KACxB,IAAI,CAAC;AAEV;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EACnE,QAAQ,EAAE,cAAc,GACvB,IAAI,CAsCN;AA6CD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAG7B,GACA,OAAO,CAAC,QAAQ,CAAC,CAuDnB;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoDtE"}

package/dist/_redact-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_redact-command.d.ts","sourceRoot":"","sources":["../src/_redact-command.ts"],"names":[],"mappings":"AAmBA;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAoBjD"}
+{"version":3,"file":"_redact-command.d.ts","sourceRoot":"","sources":["../src/_redact-command.ts"],"names":[],"mappings":"AA4BA;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA6BjD"}

package/dist/_spawn-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_spawn-stream.d.ts","sourceRoot":"","sources":["../src/_spawn-stream.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAS1D,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAuB,WAAW,CAChC,IAAI,EAAE,kBAAkB,GACvB,cAAc,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAuNtD"}
+{"version":3,"file":"_spawn-stream.d.ts","sourceRoot":"","sources":["../src/_spawn-stream.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAS1D,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAuB,WAAW,CAChC,IAAI,EAAE,kBAAkB,GACvB,cAAc,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAyPtD"}

package/dist/audit.js

@@ -1,6 +1,11 @@
 // src/_spawn-stream.ts
 import { spawn as spawn2 } from "node:child_process";
-import { buildChildEnv } from "@wrongstack/core";
+import {
+  buildChildEnv,
+  emitProcessCompleted,
+  emitProcessOutput,
+  emitProcessStarted
+} from "@wrongstack/core";
 
 // src/_output-spool.ts
 import { createWriteStream, mkdirSync } from "node:fs";
@@ -310,9 +315,14 @@ import { expectDefined } from "@wrongstack/core";
 var SENSITIVE_FLAG_PATTERNS = [
   // --flag=value  or  --flag "value"  (value captured up to next space or comma)
   /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
-  // -f "value" style short flags
-  /(?<!\w)-t(?:\s+|\s*=\s*)[^\s,]+/,
-  /(?<!\w)-(?:p|password)(?:\s+|\s*=\s*)[^\s,]+/gi,
+  // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
+  // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
+  // NOTE: synced with @wrongstack/core observability/redact-command.ts.
+  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]+/,
+  // -p|-password|-a (redis auth) short flags: attached + separated + =value.
+  // Same token-start anchor; over-redaction is an accepted tradeoff for a
+  // redaction function. Synced with core copy.
+  /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
   /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
@@ -330,8 +340,10 @@ function redactCommand(cmd) {
         const flag = match.slice(0, match.indexOf(expectDefined(delim)) + 1);
         return `${flag}[REDACTED]`;
       }
-      const flagEnd = match.match(/^--?[a-zA-Z][a-zA-Z0-9_-]*/)?.[0] ?? match;
-      return `${flagEnd}=**redacted**`;
+      if (match.startsWith("--")) {
+        return match;
+      }
+      return `${match.slice(0, 2)}[REDACTED]`;
     });
   }
   return result;
@@ -768,6 +780,19 @@ async function* spawnStream(opts) {
   });
   const registry = getProcessRegistry();
   const pid = child.pid;
+  const processStartedAt = Date.now();
+  let stdoutBytes = 0;
+  let stderrBytes = 0;
+  let telemetryCompleted = false;
+  emitProcessStarted({
+    ...pid !== void 0 ? { pid } : {},
+    parentPid: process.pid,
+    command: redactCommand(`${opts.cmd} ${opts.args.join(" ")}`),
+    args: redactCommand(opts.args.join(" ")).split(" ").filter(Boolean),
+    cwd: opts.cwd,
+    background: false,
+    startedAt: new Date(processStartedAt).toISOString()
+  });
   if (typeof pid === "number") {
     registry.register({
       pid,
@@ -796,6 +821,8 @@ async function* spawnStream(opts) {
   };
   const onOut = (c) => {
     const s = c.toString();
+    stdoutBytes += c.byteLength;
+    emitProcessOutput({ pid, stream: "stdout", chunk: c });
     if (stdout.length < max) stdout += s;
     spool.write(s);
     queue.push({ kind: "out", data: s });
@@ -808,6 +835,8 @@ async function* spawnStream(opts) {
   };
   const onErr = (c) => {
     const s = c.toString();
+    stderrBytes += c.byteLength;
+    emitProcessOutput({ pid, stream: "stderr", chunk: c });
     if (stderr.length < max) stderr += s;
     spool.write(s);
     queue.push({ kind: "err", data: s });
@@ -825,9 +854,25 @@ async function* spawnStream(opts) {
     queue.push({ kind: "error", data: e.message });
     wake();
   });
-  child.on("close", (code) => {
+  const completeTelemetry = (code, signal, timedOut = false) => {
+    if (telemetryCompleted) return;
+    telemetryCompleted = true;
+    emitProcessCompleted({
+      ...pid !== void 0 ? { pid } : {},
+      exitCode: code,
+      ...signal ? { signal } : {},
+      durationMs: Date.now() - processStartedAt,
+      stdoutBytes,
+      stderrBytes,
+      timedOut,
+      endedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  };
+  child.on("close", (code, signal) => {
     if (typeof pid === "number") registry.unregister(pid);
-    queue.push({ kind: "close", data: "", code: code ?? 0 });
+    const exitCode2 = code ?? (signal ? 1 : 0);
+    completeTelemetry(exitCode2, signal ?? void 0);
+    queue.push({ kind: "close", data: "", code: exitCode2, ...signal ? { signal } : {} });
     wake();
   });
   const onAbort = () => {
@@ -840,6 +885,7 @@ async function* spawnStream(opts) {
       }
     }
     queue.push({ kind: "close", data: "", code: 124 });
+    completeTelemetry(124, "SIGKILL", true);
     wake();
   };
   if (isWin) {
@@ -2382,13 +2428,14 @@ async function detectLanguageWorkspaces(options) {
   const target = options.target ? await canonicalInside(resolveFrom(cwd, options.target), projectRoot, "target") : void 0;
   const profiles = (options.profiles ?? languageProfileRegistry.list()).filter((profile) => !options.language || profile.id === options.language).slice().sort((a, b) => a.id.localeCompare(b.id));
   const limits = normalizeLimits(options.limits);
+  const extraIgnores = new Set(options.ignoredDirectories ?? []);
   const state = {
     entries: 0,
     truncated: false,
     sourcePaths: /* @__PURE__ */ new Map(),
     candidates: /* @__PURE__ */ new Map()
   };
-  await scanDirectory(projectRoot, 0, profiles, limits, state, options.signal);
+  await scanDirectory(projectRoot, 0, profiles, limits, state, extraIgnores, options.signal);
   addSourceFallbacks(projectRoot, profiles, state);
   if (target) addTargetEvidence(target, projectRoot, profiles, state);
   const workspaces = await Promise.all(
@@ -2402,7 +2449,7 @@ async function detectLanguageWorkspaces(options) {
     workspaces
   };
 }
-async function scanDirectory(directory, depth, profiles, limits, state, signal) {
+async function scanDirectory(directory, depth, profiles, limits, state, extraIgnores, signal) {
   signal?.throwIfAborted();
   if (depth > limits.maxDepth || state.entries >= limits.maxEntries) {
     state.truncated = true;
@@ -2425,12 +2472,12 @@ async function scanDirectory(directory, depth, profiles, limits, state, signal)
     const fullPath = path4.join(directory, entry.name);
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
-      if (shouldIgnoreDirectory(entry.name, profiles)) continue;
+      if (shouldIgnoreDirectory(entry.name, profiles, extraIgnores)) continue;
       if (depth >= limits.maxDepth) {
         state.truncated = true;
         continue;
       }
-      await scanDirectory(fullPath, depth + 1, profiles, limits, state, signal);
+      await scanDirectory(fullPath, depth + 1, profiles, limits, state, extraIgnores, signal);
       continue;
     }
     if (!entry.isFile()) continue;
@@ -2559,8 +2606,8 @@ function getCandidate(state, profile, root) {
   }
   return candidate;
 }
-function shouldIgnoreDirectory(name, profiles) {
-  if (GLOBAL_IGNORES.has(name) || name.startsWith(".")) return true;
+function shouldIgnoreDirectory(name, profiles, extraIgnores) {
+  if (GLOBAL_IGNORES.has(name) || extraIgnores.has(name) || name.startsWith(".")) return true;
   return profiles.some((profile) => profile.ignoredDirectories.includes(name));
 }
 function normalizeLimits(input) {