@wrongstack/tools 0.305.1 → 0.306.0

package/dist/tree.js

@@ -47,6 +47,7 @@ var treeTool = {
   mutating: false,
   capabilities: ["fs.read"],
   icon: "tree",
+  maxOutputBytes: 262144,
   timeoutMs: 15e3,
   inputSchema: {
     type: "object",
@@ -195,17 +196,15 @@ async function walkDir(dir, depth, opts) {
     if (opts.exclude.has(e.name)) return false;
     return true;
   });
-  if (depth > 0) {
-    let dirCount = 0;
-    let fileCount = 0;
-    for (const e of filtered) {
-      if (e.isDirectory()) dirCount++;
-      else if (e.isFile()) fileCount++;
-    }
-    opts.totalDirs.value += dirCount;
-    opts.totalFiles.value += fileCount;
-    opts.onProgress?.();
+  let dirCount = 0;
+  let fileCount = 0;
+  for (const e of filtered) {
+    if (e.isDirectory()) dirCount++;
+    else if (e.isFile()) fileCount++;
   }
+  opts.totalDirs.value += dirCount;
+  opts.totalFiles.value += fileCount;
+  opts.onProgress?.();
   const items = filtered.sort((a, b) => {
     if (a.isDirectory() && !b.isDirectory()) return -1;
     if (!a.isDirectory() && b.isDirectory()) return 1;

package/dist/typecheck.d.ts

@@ -4,8 +4,6 @@ interface TypecheckInput {
     cwd?: string | undefined;
     strict?: boolean | undefined;
     all?: boolean | undefined;
-    /** Emit JSON for machine-readable output (default: false). */
-    json?: boolean | undefined;
 }
 interface TypecheckOutput {
     project: string;

package/dist/typecheck.js

@@ -367,8 +367,11 @@ var SENSITIVE_FLAG_PATTERNS = [
   /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
   // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
   // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
+  // The value must be token-like (>= 8 chars) so ordinary combined flags such
+  // as `tar -tf` / `ssh -tt` are not eaten. Global flag: EVERY occurrence is
+  // redacted, not just the first.
   // NOTE: synced with @wrongstack/core observability/redact-command.ts.
-  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]+/,
+  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]{8,}/g,
   // -p|-password|-a (redis auth) short flags: attached + separated + =value.
   // Same token-start anchor; over-redaction is an accepted tradeoff for a
   // redaction function. Synced with core copy.
@@ -376,8 +379,9 @@ var SENSITIVE_FLAG_PATTERNS = [
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
   /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
-  // when preceded by a flag name (e.g. --github-token=EyJ...).
-  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/
+  // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
+  // every such flag in the command line is redacted, not just the first.
+  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/g
 ];
 function redactCommand(cmd) {
   let result = cmd;
@@ -466,11 +470,15 @@ var ProcessRegistryImpl = class {
     return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
   }
   _canSignalProcessGroup(p) {
-    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && typeof p.child.pid === "number" && p.child.pid === p.pid;
+    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && p.child !== null && typeof p.child.pid === "number" && p.child.pid === p.pid;
   }
   _killChildDirect(p, signal) {
     try {
-      p.child.kill(signal);
+      if (p.child) {
+        p.child.kill(signal);
+        return;
+      }
+      if (this._isSafeSignalPid(p.pid)) process.kill(p.pid, signal);
     } catch {
     }
   }
@@ -668,15 +676,15 @@ var ProcessRegistryImpl = class {
     this._pruneStale(pid);
     const p = this.processes.get(pid);
     if (!p) return false;
-    if (p.killed) return true;
+    if (p.killed && opts.force !== true) return true;
     if (p.protected && opts.includeProtected !== true) return false;
     if (opts.preserveBackground && p.background) return false;
     const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
     const isWin2 = os.platform() === "win32";
     if (isWin2) {
-      const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
+      const liveRealChild = p.child === null || p.child.exitCode === null && typeof p.child.pid === "number";
       const directFallback = () => {
-        if (p.child.exitCode === null) {
+        if (p.child && p.child.exitCode === null) {
           try {
             p.child.kill("SIGKILL");
           } catch {
@@ -688,10 +696,7 @@ var ProcessRegistryImpl = class {
         onSettled: directFallback
       })) {
       } else {
-        try {
-          p.child.kill(force ? "SIGKILL" : "SIGTERM");
-        } catch {
-        }
+        this._killChildDirect(p, force ? "SIGKILL" : "SIGTERM");
       }
       p.killed = true;
       return true;
@@ -702,7 +707,7 @@ var ProcessRegistryImpl = class {
       } else {
         this._killPosix(p, "SIGTERM");
         const timer = setTimeout(() => {
-          if (this.processes.has(pid) && !p.child.killed) {
+          if (this.processes.has(pid) && !p.child?.killed) {
             this._killPosix(p, "SIGKILL");
           }
         }, graceMs);
@@ -757,6 +762,16 @@ var ProcessRegistryImpl = class {
    * before reusing a PID, but we want to clean up before that becomes a risk.
    */
   _isStaleEntry(entry) {
+    if (entry.child === null) {
+      if (Date.now() - entry.startedAt <= 6e4) return false;
+      if (os.platform() === "win32") return false;
+      try {
+        process.kill(entry.pid, 0);
+        return false;
+      } catch (err) {
+        return err.code !== "EPERM";
+      }
+    }
     return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
   }
   /**
@@ -1031,6 +1046,49 @@ function utf8Prefix(text, maxBytes) {
 // src/_util.ts
 import * as path3 from "node:path";
 import * as Core from "@wrongstack/core/utils";
+async function detectPackageManager(cwd, stopAt) {
+  let dir = path3.resolve(cwd);
+  const stop = stopAt ? path3.resolve(stopAt) : dir;
+  for (; ; ) {
+    const found = await detectPackageManagerInDir(dir);
+    if (found) return found;
+    if (dir === stop) break;
+    const parent = path3.dirname(dir);
+    const relParent = path3.relative(stop, parent);
+    if (parent === dir || relParent.startsWith("..") || path3.isAbsolute(relParent)) break;
+    dir = parent;
+  }
+  return "npm";
+}
+async function detectPackageManagerInDir(dir) {
+  const fs6 = await import("node:fs/promises");
+  try {
+    const raw = await fs6.readFile(path3.join(dir, "package.json"), "utf8");
+    const declared = JSON.parse(raw).packageManager;
+    if (typeof declared === "string") {
+      const name = declared.split("@")[0] ?? "";
+      if (name === "pnpm" || name === "yarn") return name;
+      if (name === "npm" || name === "bun") return "npm";
+    }
+  } catch {
+  }
+  const lockfiles = [
+    ["pnpm-lock.yaml", "pnpm"],
+    ["yarn.lock", "yarn"],
+    ["bun.lockb", "npm"],
+    ["bun.lock", "npm"],
+    ["package-lock.json", "npm"],
+    ["npm-shrinkwrap.json", "npm"]
+  ];
+  for (const [file, manager] of lockfiles) {
+    try {
+      await fs6.stat(`${dir}/${file}`);
+      return manager;
+    } catch {
+    }
+  }
+  return null;
+}
 function resolvePath(input, ctx) {
   return path3.isAbsolute(input) ? path3.normalize(input) : path3.resolve(ctx.workingDir ?? ctx.cwd, input);
 }
@@ -2665,7 +2723,7 @@ async function finalizeCandidate(candidate, projectRoot) {
   const evidence = dedupeEvidence(candidate.evidence).sort(compareEvidence);
   const manifests = [...new Set(candidate.manifests)].sort();
   const confidence = Math.min(1, evidence.reduce((sum, item) => sum + item.weight, 0) / 100);
-  const packageManager = await detectPackageManager(candidate.profile, candidate.root, evidence);
+  const packageManager = await detectPackageManager2(candidate.profile, candidate.root, evidence);
   const id = createHash("sha256").update(`${candidate.profile.id}\0${path4.relative(projectRoot, candidate.root)}`).digest("hex").slice(0, 16);
   return Object.freeze({
     id,
@@ -2680,7 +2738,7 @@ async function finalizeCandidate(candidate, projectRoot) {
     )
   });
 }
-async function detectPackageManager(profile, root, evidence) {
+async function detectPackageManager2(profile, root, evidence) {
   if (profile.packageManagers.length === 1) return profile.packageManagers[0];
   if (profile.id !== "typescript" && profile.id !== "javascript") return void 0;
   let declared;
@@ -3556,11 +3614,7 @@ var typecheckTool = {
       },
       all: {
         type: "boolean",
-        description: "Type-check all projects (pnpm -r) (default: false)"
-      },
-      json: {
-        type: "boolean",
-        description: "Emit JSON output from tsc (default: false)"
+        description: "Type-check all workspace packages (pnpm workspaces run `pnpm -r exec tsc --noEmit`; other setups run a single `tsc --noEmit` at cwd) (default: false)"
       }
     }
   },
@@ -3596,29 +3650,42 @@ var typecheckTool = {
       };
       return;
     }
-    let args;
+    let cmd;
+    let cmdArgs;
     let project;
     if (input.all) {
-      args = ["--noEmit"];
       project = "workspace";
+      const tscArgs = ["--noEmit"];
+      if (input.strict) tscArgs.push("--strict");
+      const manager = await detectPackageManager(cwd, ctx.projectRoot);
+      if (manager === "pnpm") {
+        cmd = "pnpm";
+        cmdArgs = ["-r", "--no-bail", "exec", "tsc", ...tscArgs];
+      } else {
+        cmd = "npx";
+        cmdArgs = ["tsc", ...tscArgs];
+      }
     } else {
       const tsconfig = input.project ? safeResolve(input.project, ctx) : await findTsConfig(cwd);
-      args = ["--noEmit"];
-      if (input.strict) args.push("--strict");
-      if (tsconfig) args.push("--project", tsconfig);
+      const tscArgs = ["--noEmit"];
+      if (input.strict) tscArgs.push("--strict");
+      if (tsconfig) tscArgs.push("--project", tsconfig);
       project = tsconfig ?? "default";
+      cmd = "npx";
+      cmdArgs = ["tsc", ...tscArgs];
     }
-    if (input.json) args.push("--json");
-    yield { type: "log", text: `tsc ${args.join(" ")}`, data: { project } };
+    yield { type: "log", text: `${cmd} ${cmdArgs.join(" ")}`, data: { project } };
     const result = yield* spawnStream({
-      cmd: "npx",
-      args: ["tsc", ...args],
+      cmd,
+      args: cmdArgs,
       cwd,
       signal: opts.signal,
       maxBytes: 2e5
     });
-    const errors = [...result.stdout.matchAll(/\berror\b/gi)].length;
-    const warnings = [...result.stdout.matchAll(/\bwarning\b/gi)].length;
+    const combined = `${result.stdout}
+${result.stderr}`;
+    const errors = [...combined.matchAll(/^.*\berror TS\d+:/gm)].length;
+    const warnings = [...combined.matchAll(/^.*\bwarning TS\d+:/gm)].length;
     yield {
       type: "final",
       output: {

package/dist/write.js

@@ -1,7 +1,13 @@
 // src/write.ts
 import * as fs from "node:fs/promises";
 import { ToolValidationError } from "@wrongstack/core/types";
-import { atomicWrite, unifiedDiff } from "@wrongstack/core/utils";
+import {
+  atomicWrite,
+  detectNewlineStyle,
+  normalizeToLf,
+  toStyle,
+  unifiedDiff
+} from "@wrongstack/core/utils";
 
 // src/_syntax-check.ts
 import * as path from "node:path";
@@ -150,20 +156,51 @@ async function safeResolveReal(input, ctx) {
   const abs = safeResolve(input, ctx);
   return await resolveRealInsideRoot(abs, ctx);
 }
+function truncateDiffPayload(diff, maxBytes) {
+  const total = Buffer.byteLength(diff, "utf8");
+  if (total <= maxBytes) return { text: diff, truncated: false };
+  const MARKER_RESERVE = 96;
+  let head = takeHeadBytes(diff, Math.max(0, maxBytes - MARKER_RESERVE));
+  const nl = head.lastIndexOf("\n");
+  if (nl > 0) head = head.slice(0, nl);
+  const kept = Buffer.byteLength(head, "utf8");
+  return {
+    text: `${head}
+\u2026[diff truncated: ${total - kept} of ${total} bytes omitted]`,
+    truncated: true
+  };
+}
+function takeHeadBytes(s, maxBytes) {
+  if (maxBytes <= 0) return "";
+  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
+  let lo = 0;
+  let hi = s.length;
+  while (lo < hi) {
+    const mid = Math.ceil((lo + hi) / 2);
+    if (Buffer.byteLength(s.slice(0, mid), "utf8") <= maxBytes) lo = mid;
+    else hi = mid - 1;
+  }
+  return s.slice(0, lo);
+}
 
 // src/write.ts
+var MAX_DIFF_BYTES = 262144;
 var writeTool = {
   name: "write",
   category: "Filesystem",
   description: "Write or completely overwrite a file on disk. This is a high-privilege operation. For modifying existing files, you should almost always prefer the `edit` tool instead, because `edit` is safer and works on the last-read version of the file.",
-  usageHint: "RULES FOR CORRECT USAGE:\n- Use `write` primarily for **new files** or when you want to replace the entire content.\n- For any existing file, strongly prefer `edit` (it requires a prior `read` in the same session and is more precise).\n- You MUST have called `read` on the file earlier in the conversation before using `write` on an existing path (the system enforces this for safety).\n- The path is resolved relative to the project root and protected against escaping the workspace.",
+  usageHint: "RULES FOR CORRECT USAGE:\n- Use `write` primarily for **new files** or when you want to replace the entire content.\n- For any existing file, strongly prefer `edit` (it requires a prior `read` in the same session and is more precise).\n- When overwriting an existing file, the tool reads the current content itself to compute the diff \u2014 but still `read` the file first before large rewrites so you know what you are replacing.\n- When overwriting an existing file, the content is normalized to the dominant line-ending style (CRLF/LF) of the existing file; new files are written verbatim.\n- The path is resolved relative to the project root and protected against escaping the workspace.",
   selection: {
     doNotUseWhen: "making a precise change to part of an existing file.",
     useInstead: ["edit"]
   },
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on — the file being
+  // written, so trust rules can scope by path.
+  subjectKey: "path",
   mutating: true,
   timeoutMs: 5e3,
+  maxOutputBytes: 262144,
   capabilities: ["fs.write"],
   icon: "file",
   inputSchema: {
@@ -232,31 +269,42 @@ async function prepareWrite(input, ctx) {
   return { absPath, existed, prev };
 }
 async function finishWrite(input, ctx, prepared, signal) {
+  const content = prepared.existed ? toStyle(normalizeToLf(input.content), detectNewlineStyle(prepared.prev)) : input.content;
   signal?.throwIfAborted();
-  await atomicWrite(prepared.absPath, input.content);
-  const diff = prepared.existed ? unifiedDiff(prepared.prev, input.content, { fromFile: input.path, toFile: input.path }) : `+++ ${input.path}
-+ (new file, ${input.content.split("\n").length} lines)`;
+  await atomicWrite(prepared.absPath, content);
+  const rawDiff = prepared.existed ? unifiedDiff(prepared.prev, content, { fromFile: input.path, toFile: input.path }) : `+++ ${input.path}
++ (new file, ${content.split("\n").length} lines)`;
+  const { text: diff, truncated: diffTruncated } = truncateDiffPayload(rawDiff, MAX_DIFF_BYTES);
   const stat2 = await fs.stat(prepared.absPath);
-  ctx.recordRead(prepared.absPath, stat2.mtimeMs, "write", sha256hex(input.content));
+  ctx.recordRead(prepared.absPath, stat2.mtimeMs, "write", sha256hex(content));
   ctx.session.recordFileChange({
     path: prepared.absPath,
     action: prepared.existed ? "modified" : "created",
     before: prepared.existed ? prepared.prev : null,
-    after: input.content
+    after: content
   });
   const syntax = await checkSyntax(
     prepared.absPath,
-    input.content,
+    content,
     prepared.existed ? prepared.prev : void 0
   ).catch(() => void 0);
   const hasSyntaxErrors = syntax !== void 0 && syntax.errors.length > 0;
+  const notes = [];
+  if (diffTruncated) {
+    notes.push("Diff truncated to the 256 KiB output budget \u2014 the full write is on disk.");
+  }
+  if (hasSyntaxErrors) {
+    notes.push(
+      syntax.preExisting ? "Syntax check: the file still has parse errors (they pre-date this write) \u2014 see syntax_errors." : `Syntax check: the written content has ${syntax.errors.length} parse error(s) \u2014 fix them now, see syntax_errors.`
+    );
+  }
   return {
     path: prepared.absPath,
-    bytes_written: Buffer.byteLength(input.content, "utf8"),
+    bytes_written: Buffer.byteLength(content, "utf8"),
     created: !prepared.existed,
     diff,
     syntax_errors: hasSyntaxErrors ? syntax.errors : void 0,
-    note: hasSyntaxErrors ? syntax.preExisting ? "Syntax check: the file still has parse errors (they pre-date this write) \u2014 see syntax_errors." : `Syntax check: the written content has ${syntax.errors.length} parse error(s) \u2014 fix them now, see syntax_errors.` : void 0
+    note: notes.length > 0 ? notes.join("\n") : void 0
   };
 }
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/tools",
-  "version": "0.305.1",
+  "version": "0.306.0",
   "license": "MIT",
   "description": "WrongStack built-in tools: read/write/edit, bash/exec, grep/glob, git, fetch, test, lint, and more.",
   "repository": {
@@ -253,9 +253,9 @@
     "turndown": "^7.2.4",
     "undici": "^8.9.0",
     "web-tree-sitter": "0.26.12",
-    "@wrongstack/kanban": "0.305.1",
-    "@wrongstack/core": "0.305.1",
-    "@wrongstack/persistence": "0.305.1"
+    "@wrongstack/core": "0.306.0",
+    "@wrongstack/persistence": "0.306.0",
+    "@wrongstack/kanban": "0.306.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",