@wrongstack/tools 0.300.0 → 0.301.0

package/dist/json.js

@@ -15,6 +15,81 @@ var DANGEROUS_PATTERNS = [
   // Greedy quantifier inside lookahead/lookbehind — (?!.*a+)
   /[([][^)\]]*[+*][^)\]]*[)\]][^)]*\?\??/
 ];
+function hasAmbiguousQuantifiedAlternation(pattern) {
+  for (let i = 0; i < pattern.length; i++) {
+    if (pattern[i] !== "(") continue;
+    if (i > 0 && pattern[i - 1] === "\\") continue;
+    let depth = 0;
+    let inClass = false;
+    let j = i;
+    for (; j < pattern.length; j++) {
+      const ch = pattern[j];
+      if (ch === "\\") {
+        j++;
+        continue;
+      }
+      if (inClass) {
+        if (ch === "]") inClass = false;
+        continue;
+      }
+      if (ch === "[") {
+        inClass = true;
+        continue;
+      }
+      if (ch === "(") depth++;
+      else if (ch === ")") {
+        depth--;
+        if (depth === 0) break;
+      }
+    }
+    if (j >= pattern.length) return false;
+    const next = pattern[j + 1];
+    if (next !== "+" && next !== "*" && next !== "{") continue;
+    let inner = pattern.slice(i + 1, j);
+    inner = inner.replace(/^\?(?::|<?[=!])/u, "");
+    const branches = [];
+    let current = "";
+    let d = 0;
+    let cls = false;
+    for (let k = 0; k < inner.length; k++) {
+      const ch = inner[k];
+      if (ch === "\\") {
+        current += ch + (inner[k + 1] ?? "");
+        k++;
+        continue;
+      }
+      if (cls) {
+        if (ch === "]") cls = false;
+        current += ch;
+        continue;
+      }
+      if (ch === "[") {
+        cls = true;
+        current += ch;
+        continue;
+      }
+      if (ch === "(") d++;
+      if (ch === ")") d--;
+      if (ch === "|" && d === 0) {
+        branches.push(current);
+        current = "";
+        continue;
+      }
+      current += ch;
+    }
+    branches.push(current);
+    if (branches.length < 2) continue;
+    for (let a = 0; a < branches.length; a++) {
+      for (let b = a + 1; b < branches.length; b++) {
+        const x = branches[a];
+        const y = branches[b];
+        if (x === "" || y === "") return true;
+        if (x === y || x.startsWith(y) || y.startsWith(x)) return true;
+      }
+    }
+  }
+  return false;
+}
 function compileUserRegex(pattern, flags) {
   if (typeof pattern !== "string") {
     return { ok: false, reason: "pattern must be a string" };
@@ -33,6 +108,12 @@ function compileUserRegex(pattern, flags) {
       };
     }
   }
+  if (hasAmbiguousQuantifiedAlternation(pattern)) {
+    return {
+      ok: false,
+      reason: "pattern quantifies an alternation with overlapping branches \u2014 rewrite so no two branches can match the same text"
+    };
+  }
   try {
     return { ok: true, regex: new RegExp(pattern, flags) };
   } catch (err) {

package/dist/logs.js

@@ -15,6 +15,81 @@ var DANGEROUS_PATTERNS = [
   // Greedy quantifier inside lookahead/lookbehind — (?!.*a+)
   /[([][^)\]]*[+*][^)\]]*[)\]][^)]*\?\??/
 ];
+function hasAmbiguousQuantifiedAlternation(pattern) {
+  for (let i = 0; i < pattern.length; i++) {
+    if (pattern[i] !== "(") continue;
+    if (i > 0 && pattern[i - 1] === "\\") continue;
+    let depth = 0;
+    let inClass = false;
+    let j = i;
+    for (; j < pattern.length; j++) {
+      const ch = pattern[j];
+      if (ch === "\\") {
+        j++;
+        continue;
+      }
+      if (inClass) {
+        if (ch === "]") inClass = false;
+        continue;
+      }
+      if (ch === "[") {
+        inClass = true;
+        continue;
+      }
+      if (ch === "(") depth++;
+      else if (ch === ")") {
+        depth--;
+        if (depth === 0) break;
+      }
+    }
+    if (j >= pattern.length) return false;
+    const next = pattern[j + 1];
+    if (next !== "+" && next !== "*" && next !== "{") continue;
+    let inner = pattern.slice(i + 1, j);
+    inner = inner.replace(/^\?(?::|<?[=!])/u, "");
+    const branches = [];
+    let current = "";
+    let d = 0;
+    let cls = false;
+    for (let k = 0; k < inner.length; k++) {
+      const ch = inner[k];
+      if (ch === "\\") {
+        current += ch + (inner[k + 1] ?? "");
+        k++;
+        continue;
+      }
+      if (cls) {
+        if (ch === "]") cls = false;
+        current += ch;
+        continue;
+      }
+      if (ch === "[") {
+        cls = true;
+        current += ch;
+        continue;
+      }
+      if (ch === "(") d++;
+      if (ch === ")") d--;
+      if (ch === "|" && d === 0) {
+        branches.push(current);
+        current = "";
+        continue;
+      }
+      current += ch;
+    }
+    branches.push(current);
+    if (branches.length < 2) continue;
+    for (let a = 0; a < branches.length; a++) {
+      for (let b = a + 1; b < branches.length; b++) {
+        const x = branches[a];
+        const y = branches[b];
+        if (x === "" || y === "") return true;
+        if (x === y || x.startsWith(y) || y.startsWith(x)) return true;
+      }
+    }
+  }
+  return false;
+}
 function compileUserRegex(pattern, flags) {
   if (typeof pattern !== "string") {
     return { ok: false, reason: "pattern must be a string" };
@@ -33,6 +108,12 @@ function compileUserRegex(pattern, flags) {
       };
     }
   }
+  if (hasAmbiguousQuantifiedAlternation(pattern)) {
+    return {
+      ok: false,
+      reason: "pattern quantifies an alternation with overlapping branches \u2014 rewrite so no two branches can match the same text"
+    };
+  }
   try {
     return { ok: true, regex: new RegExp(pattern, flags) };
   } catch (err) {

package/dist/next-steps-tool.d.ts

@@ -0,0 +1,26 @@
+import type { Tool } from '@wrongstack/core/types';
+/**
+ * Structured alternative to typing a `<nextsteps>` block into the final message.
+ *
+ * Both routes are equally valid and produce the same result — the runtime folds
+ * whatever this tool parks into the turn-ending response (see
+ * `next-steps-slot.ts` in core), so every surface reads it through the same
+ * parser it already uses. What the tool buys is that the schema enforces the
+ * shape: a block cannot arrive unbalanced, `auto` cannot land on the wrong
+ * item, and item count cannot drift past the contract.
+ *
+ * Opt-in via `tools.nextsteps.enabled`; registered for the leader only.
+ */
+interface NextStepsInput {
+    steps: Array<{
+        text: string;
+        auto?: boolean;
+    }>;
+}
+interface NextStepsOutput {
+    accepted: number;
+    auto: boolean;
+}
+export declare const nextStepsTool: Tool<NextStepsInput, NextStepsOutput>;
+export {};
+//# sourceMappingURL=next-steps-tool.d.ts.map