@wrongstack/tools 0.296.4 → 0.298.0

package/dist/diff.js

@@ -31,6 +31,7 @@ function safeResolve(input, ctx) {
 }
 
 // src/diff.ts
+var MAX_FILE_DUMP_BYTES = 5 * 1024 * 1024;
 var diffTool = {
   name: "diff",
   category: "Filesystem",
@@ -38,6 +39,7 @@ var diffTool = {
   usageHint: 'USE FOR CODE REVIEW AND CHANGE INSPECTION:\n\n- `files` + no `a`/`b` \u2192 show file content with line numbers (NOT a unified diff; no +/- prefixes).\n- `a` and/or `b` \u2192 git-style commit/branch diff (unified format, real +/- prefixes).\n- `staged: true` \u2192 only show staged changes.\n- `mode` can be "unified", "stat", or "side-by-side" (only affects the git-diff path).\n\nNOTE: For a true file-vs-file unified diff, supply `a` and `b` so the tool delegates to `git diff`. The `files`-only path is a line-numbered dump, not a diff.\n\nThis tool has important safety guards against flag injection (see previous security findings).',
   permission: "auto",
   mutating: false,
+  maxOutputBytes: 262144,
   capabilities: ["fs.read"],
   icon: "diff",
   timeoutMs: 1e4,
@@ -156,10 +158,18 @@ async function fileDiff(input, ctx, _signal) {
     };
   }
   const results = [];
+  let truncated = false;
   for (const file of files) {
     const absPath = safeResolve(file, ctx);
     const stat2 = await fs.stat(absPath).catch(() => null);
     if (!stat2?.isFile()) continue;
+    if (stat2.size > MAX_FILE_DUMP_BYTES) {
+      truncated = true;
+      results.push(
+        `--- ${file} (skipped: ${stat2.size} bytes exceeds the ${MAX_FILE_DUMP_BYTES} limit; use the read tool with offset/limit) ---`
+      );
+      continue;
+    }
     const content = await fs.readFile(absPath, "utf8");
     const lines = content.split(/\r?\n/);
     results.push(formatWithLineNumbers(file, lines));
@@ -167,7 +177,7 @@ async function fileDiff(input, ctx, _signal) {
   return {
     diff: results.join("\n\n"),
     files,
-    truncated: false,
+    truncated,
     mode: input.mode ?? "unified"
   };
 }

package/dist/e2e.js

@@ -27,12 +27,13 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
-async function assertRealInsideRoot(absPath, ctx) {
-  if (ctx.allowOutsideProjectRoot) return;
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
   const realRoots = await Promise.all(
     allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r)))
   );
   let probe = absPath;
+  const pendingTail = [];
   for (; ; ) {
     let real;
     try {
@@ -40,13 +41,16 @@ async function assertRealInsideRoot(absPath, ctx) {
     } catch (err) {
       if (err.code === "ENOENT") {
         const parent = path.dirname(probe);
-        if (parent === probe) return;
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path.basename(probe));
         probe = parent;
         continue;
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) return;
+    if (isInsideAny(real, realRoots)) {
+      return pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
     );
@@ -54,8 +58,7 @@ async function assertRealInsideRoot(absPath, ctx) {
 }
 async function safeResolveReal(input, ctx) {
   const abs = safeResolve(input, ctx);
-  await assertRealInsideRoot(abs, ctx);
-  return abs;
+  return await resolveRealInsideRoot(abs, ctx);
 }
 
 // src/e2e.ts

package/dist/edit.js

@@ -348,12 +348,13 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
-async function assertRealInsideRoot(absPath, ctx) {
-  if (ctx.allowOutsideProjectRoot) return;
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
   const realRoots = await Promise.all(
     allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path2.resolve(r)))
   );
   let probe = absPath;
+  const pendingTail = [];
   for (; ; ) {
     let real;
     try {
@@ -361,13 +362,16 @@ async function assertRealInsideRoot(absPath, ctx) {
     } catch (err) {
       if (err.code === "ENOENT") {
         const parent = path2.dirname(probe);
-        if (parent === probe) return;
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path2.basename(probe));
         probe = parent;
         continue;
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) return;
+    if (isInsideAny(real, realRoots)) {
+      return pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
     );
@@ -375,8 +379,7 @@ async function assertRealInsideRoot(absPath, ctx) {
 }
 async function safeResolveReal(input, ctx) {
   const abs = safeResolve(input, ctx);
-  await assertRealInsideRoot(abs, ctx);
-  return abs;
+  return await resolveRealInsideRoot(abs, ctx);
 }
 
 // src/edit.ts