@wrongstack/tools 0.299.0 → 0.301.0

package/dist/install.js

@@ -673,7 +673,7 @@ var ProcessRegistryImpl = class {
     const p = this.processes.get(pid);
     if (!p) return false;
     if (p.killed) return true;
-    if (p.protected) return false;
+    if (p.protected && opts.includeProtected !== true) return false;
     if (opts.preserveBackground && p.background) return false;
     const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
     const isWin2 = os.platform() === "win32";
@@ -724,9 +724,13 @@ var ProcessRegistryImpl = class {
   killAll(opts = {}) {
     const pids = Array.from(this.processes.keys());
     const killed = [];
+    const includeProtected = opts.includeProtected === true;
     for (const pid of pids) {
       const p = this.processes.get(pid);
-      if (p && !p.protected && this.kill(pid, opts)) killed.push(pid);
+      if (!p) continue;
+      if (p.protected && !includeProtected) continue;
+      if (opts.preserveBackground && p.background) continue;
+      if (this.kill(pid, opts)) killed.push(pid);
     }
     return killed;
   }

package/dist/json.js

@@ -2,6 +2,132 @@
 import * as fs from "node:fs/promises";
 import { deepMerge as deepMergeCore } from "@wrongstack/core/utils";
 
+// src/_regex.ts
+var MAX_PATTERN_LEN = 256;
+var DANGEROUS_PATTERNS = [
+  // (a+)+, (.*)+, etc — nested quantifier on a group with internal quantifier
+  /(\([^)]*[+*][^)]*\))[+*]/,
+  /(\(\?:[^)]*[+*][^)]*\))[+*]/,
+  // Adjacent quantifiers: a++ a*+
+  /[+*]{2,}/,
+  // Quantifier on alternation with length 2+
+  /\([^|)]+\|[^)]+\)[+*][+*]/,
+  // Greedy quantifier inside lookahead/lookbehind — (?!.*a+)
+  /[([][^)\]]*[+*][^)\]]*[)\]][^)]*\?\??/
+];
+function hasAmbiguousQuantifiedAlternation(pattern) {
+  for (let i = 0; i < pattern.length; i++) {
+    if (pattern[i] !== "(") continue;
+    if (i > 0 && pattern[i - 1] === "\\") continue;
+    let depth = 0;
+    let inClass = false;
+    let j = i;
+    for (; j < pattern.length; j++) {
+      const ch = pattern[j];
+      if (ch === "\\") {
+        j++;
+        continue;
+      }
+      if (inClass) {
+        if (ch === "]") inClass = false;
+        continue;
+      }
+      if (ch === "[") {
+        inClass = true;
+        continue;
+      }
+      if (ch === "(") depth++;
+      else if (ch === ")") {
+        depth--;
+        if (depth === 0) break;
+      }
+    }
+    if (j >= pattern.length) return false;
+    const next = pattern[j + 1];
+    if (next !== "+" && next !== "*" && next !== "{") continue;
+    let inner = pattern.slice(i + 1, j);
+    inner = inner.replace(/^\?(?::|<?[=!])/u, "");
+    const branches = [];
+    let current = "";
+    let d = 0;
+    let cls = false;
+    for (let k = 0; k < inner.length; k++) {
+      const ch = inner[k];
+      if (ch === "\\") {
+        current += ch + (inner[k + 1] ?? "");
+        k++;
+        continue;
+      }
+      if (cls) {
+        if (ch === "]") cls = false;
+        current += ch;
+        continue;
+      }
+      if (ch === "[") {
+        cls = true;
+        current += ch;
+        continue;
+      }
+      if (ch === "(") d++;
+      if (ch === ")") d--;
+      if (ch === "|" && d === 0) {
+        branches.push(current);
+        current = "";
+        continue;
+      }
+      current += ch;
+    }
+    branches.push(current);
+    if (branches.length < 2) continue;
+    for (let a = 0; a < branches.length; a++) {
+      for (let b = a + 1; b < branches.length; b++) {
+        const x = branches[a];
+        const y = branches[b];
+        if (x === "" || y === "") return true;
+        if (x === y || x.startsWith(y) || y.startsWith(x)) return true;
+      }
+    }
+  }
+  return false;
+}
+function compileUserRegex(pattern, flags) {
+  if (typeof pattern !== "string") {
+    return { ok: false, reason: "pattern must be a string" };
+  }
+  if (pattern.length === 0) {
+    return { ok: false, reason: "pattern is empty" };
+  }
+  if (pattern.length > MAX_PATTERN_LEN) {
+    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
+  }
+  for (const rx of DANGEROUS_PATTERNS) {
+    if (rx.test(pattern)) {
+      return {
+        ok: false,
+        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
+      };
+    }
+  }
+  if (hasAmbiguousQuantifiedAlternation(pattern)) {
+    return {
+      ok: false,
+      reason: "pattern quantifies an alternation with overlapping branches \u2014 rewrite so no two branches can match the same text"
+    };
+  }
+  try {
+    return { ok: true, regex: new RegExp(pattern, flags) };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: err instanceof Error ? err.message : "invalid regex"
+    };
+  }
+}
+var MAX_SUBJECT_LEN = 64 * 1024;
+function capSubject(line) {
+  return line.length > MAX_SUBJECT_LEN ? line.slice(0, MAX_SUBJECT_LEN) : line;
+}
+
 // src/_util.ts
 import * as fsp from "node:fs/promises";
 import * as path from "node:path";
@@ -500,8 +626,12 @@ function validateJsonSchema(data, schema) {
       }
     }
     if (typeof value === "string" && s["pattern"]) {
-      const re = new RegExp(s["pattern"]);
-      if (!re.test(value)) errors.push(`${path2}: does not match pattern ${s["pattern"]}`);
+      const compiled = compileUserRegex(s["pattern"], "");
+      if (!compiled.ok) {
+        errors.push(`${path2}: invalid schema pattern \u2014 ${compiled.reason}`);
+      } else if (!compiled.regex.test(capSubject(value))) {
+        errors.push(`${path2}: does not match pattern ${s["pattern"]}`);
+      }
     }
     if (typeof value === "string" && s["minLength"] !== void 0 && value.length < s["minLength"]) {
       errors.push(`${path2}: string too short (min ${s["minLength"]})`);

package/dist/languages/index.js

@@ -2794,7 +2794,7 @@ var ProcessRegistryImpl = class {
     const p = this.processes.get(pid);
     if (!p) return false;
     if (p.killed) return true;
-    if (p.protected) return false;
+    if (p.protected && opts.includeProtected !== true) return false;
     if (opts.preserveBackground && p.background) return false;
     const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
     const isWin2 = os.platform() === "win32";
@@ -2845,9 +2845,13 @@ var ProcessRegistryImpl = class {
   killAll(opts = {}) {
     const pids = Array.from(this.processes.keys());
     const killed = [];
+    const includeProtected = opts.includeProtected === true;
     for (const pid of pids) {
       const p = this.processes.get(pid);
-      if (p && !p.protected && this.kill(pid, opts)) killed.push(pid);
+      if (!p) continue;
+      if (p.protected && !includeProtected) continue;
+      if (opts.preserveBackground && p.background) continue;
+      if (this.kill(pid, opts)) killed.push(pid);
     }
     return killed;
   }

package/dist/lint.js

@@ -666,7 +666,7 @@ var ProcessRegistryImpl = class {
     const p = this.processes.get(pid);
     if (!p) return false;
     if (p.killed) return true;
-    if (p.protected) return false;
+    if (p.protected && opts.includeProtected !== true) return false;
     if (opts.preserveBackground && p.background) return false;
     const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
     const isWin2 = os.platform() === "win32";
@@ -717,9 +717,13 @@ var ProcessRegistryImpl = class {
   killAll(opts = {}) {
     const pids = Array.from(this.processes.keys());
     const killed = [];
+    const includeProtected = opts.includeProtected === true;
     for (const pid of pids) {
       const p = this.processes.get(pid);
-      if (p && !p.protected && this.kill(pid, opts)) killed.push(pid);
+      if (!p) continue;
+      if (p.protected && !includeProtected) continue;
+      if (opts.preserveBackground && p.background) continue;
+      if (this.kill(pid, opts)) killed.push(pid);
     }
     return killed;
   }

package/dist/logs.js

@@ -15,6 +15,81 @@ var DANGEROUS_PATTERNS = [
   // Greedy quantifier inside lookahead/lookbehind — (?!.*a+)
   /[([][^)\]]*[+*][^)\]]*[)\]][^)]*\?\??/
 ];
+function hasAmbiguousQuantifiedAlternation(pattern) {
+  for (let i = 0; i < pattern.length; i++) {
+    if (pattern[i] !== "(") continue;
+    if (i > 0 && pattern[i - 1] === "\\") continue;
+    let depth = 0;
+    let inClass = false;
+    let j = i;
+    for (; j < pattern.length; j++) {
+      const ch = pattern[j];
+      if (ch === "\\") {
+        j++;
+        continue;
+      }
+      if (inClass) {
+        if (ch === "]") inClass = false;
+        continue;
+      }
+      if (ch === "[") {
+        inClass = true;
+        continue;
+      }
+      if (ch === "(") depth++;
+      else if (ch === ")") {
+        depth--;
+        if (depth === 0) break;
+      }
+    }
+    if (j >= pattern.length) return false;
+    const next = pattern[j + 1];
+    if (next !== "+" && next !== "*" && next !== "{") continue;
+    let inner = pattern.slice(i + 1, j);
+    inner = inner.replace(/^\?(?::|<?[=!])/u, "");
+    const branches = [];
+    let current = "";
+    let d = 0;
+    let cls = false;
+    for (let k = 0; k < inner.length; k++) {
+      const ch = inner[k];
+      if (ch === "\\") {
+        current += ch + (inner[k + 1] ?? "");
+        k++;
+        continue;
+      }
+      if (cls) {
+        if (ch === "]") cls = false;
+        current += ch;
+        continue;
+      }
+      if (ch === "[") {
+        cls = true;
+        current += ch;
+        continue;
+      }
+      if (ch === "(") d++;
+      if (ch === ")") d--;
+      if (ch === "|" && d === 0) {
+        branches.push(current);
+        current = "";
+        continue;
+      }
+      current += ch;
+    }
+    branches.push(current);
+    if (branches.length < 2) continue;
+    for (let a = 0; a < branches.length; a++) {
+      for (let b = a + 1; b < branches.length; b++) {
+        const x = branches[a];
+        const y = branches[b];
+        if (x === "" || y === "") return true;
+        if (x === y || x.startsWith(y) || y.startsWith(x)) return true;
+      }
+    }
+  }
+  return false;
+}
 function compileUserRegex(pattern, flags) {
   if (typeof pattern !== "string") {
     return { ok: false, reason: "pattern must be a string" };
@@ -33,6 +108,12 @@ function compileUserRegex(pattern, flags) {
       };
     }
   }
+  if (hasAmbiguousQuantifiedAlternation(pattern)) {
+    return {
+      ok: false,
+      reason: "pattern quantifies an alternation with overlapping branches \u2014 rewrite so no two branches can match the same text"
+    };
+  }
   try {
     return { ok: true, regex: new RegExp(pattern, flags) };
   } catch (err) {

package/dist/next-steps-tool.d.ts

@@ -0,0 +1,26 @@
+import type { Tool } from '@wrongstack/core/types';
+/**
+ * Structured alternative to typing a `<nextsteps>` block into the final message.
+ *
+ * Both routes are equally valid and produce the same result — the runtime folds
+ * whatever this tool parks into the turn-ending response (see
+ * `next-steps-slot.ts` in core), so every surface reads it through the same
+ * parser it already uses. What the tool buys is that the schema enforces the
+ * shape: a block cannot arrive unbalanced, `auto` cannot land on the wrong
+ * item, and item count cannot drift past the contract.
+ *
+ * Opt-in via `tools.nextsteps.enabled`; registered for the leader only.
+ */
+interface NextStepsInput {
+    steps: Array<{
+        text: string;
+        auto?: boolean;
+    }>;
+}
+interface NextStepsOutput {
+    accepted: number;
+    auto: boolean;
+}
+export declare const nextStepsTool: Tool<NextStepsInput, NextStepsOutput>;
+export {};
+//# sourceMappingURL=next-steps-tool.d.ts.map

package/dist/outdated.js

@@ -3018,7 +3018,7 @@ var init_process_registry = __esm({
         const p = this.processes.get(pid);
         if (!p) return false;
         if (p.killed) return true;
-        if (p.protected) return false;
+        if (p.protected && opts.includeProtected !== true) return false;
         if (opts.preserveBackground && p.background) return false;
         const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
         const isWin2 = os.platform() === "win32";
@@ -3069,9 +3069,13 @@ var init_process_registry = __esm({
       killAll(opts = {}) {
         const pids = Array.from(this.processes.keys());
         const killed = [];
+        const includeProtected = opts.includeProtected === true;
         for (const pid of pids) {
           const p = this.processes.get(pid);
-          if (p && !p.protected && this.kill(pid, opts)) killed.push(pid);
+          if (!p) continue;
+          if (p.protected && !includeProtected) continue;
+          if (opts.preserveBackground && p.background) continue;
+          if (this.kill(pid, opts)) killed.push(pid);
         }
         return killed;
       }