@wrongstack/tools 0.305.1 → 0.306.2

package/dist/memory.d.ts

@@ -16,10 +16,18 @@ interface RememberOutput {
 interface ForgetInput {
     query: string;
     scope?: MemoryScope | undefined;
+    /** Preview: list what WOULD be deleted without deleting anything. */
+    dry_run?: boolean | undefined;
 }
 interface ForgetOutput {
     removed: number;
     scope: MemoryScope;
+    /** True when this was a preview run — nothing was deleted. */
+    dryRun?: boolean | undefined;
+    /** dry_run only: texts of the entries the query matches (capped at 20). */
+    matches?: string[] | undefined;
+    /** dry_run only: total number of matching entries (may exceed matches.length). */
+    matched?: number | undefined;
 }
 export declare function rememberTool(memory: MemoryStore): Tool<RememberInput, RememberOutput>;
 export declare function forgetTool(memory: MemoryStore): Tool<ForgetInput, ForgetOutput>;

package/dist/memory.js

@@ -62,17 +62,25 @@ function forgetTool(memory) {
   return {
     name: "forget",
     category: "Session",
-    description: "Remove memory entries that contain the given substring (case-insensitive). Use with caution.",
-    usageHint: "This permanently deletes matching memories in the chosen scope.\n- Provide a reasonably specific `query` to avoid deleting unrelated memories.\n- Always double-check before calling with broad queries.\n- Use `remember` + `forget` together to maintain clean long-term memory.",
+    description: "Remove memory entries that contain the given substring (case-insensitive). Use with caution. Pass `dry_run: true` to preview the matching entries (capped at 20) without deleting anything.",
+    usageHint: "This permanently deletes matching memories in the chosen scope.\n- Provide a reasonably specific `query` to avoid deleting unrelated memories.\n- Always double-check before calling with broad queries \u2014 `dry_run: true` previews the matches without deleting.\n- Use `remember` + `forget` together to maintain clean long-term memory.",
     permission: "confirm",
+    // WS-046: gives permission decisions something to key on — the substring
+    // being forgotten.
+    subjectKey: "query",
     mutating: true,
     timeoutMs: 2e3,
     capabilities: ["memory.delete"],
+    icon: "settings",
     inputSchema: {
       type: "object",
       properties: {
         query: { type: "string" },
-        scope: { type: "string", enum: ["project-agents", "project-memory", "user-memory"] }
+        scope: { type: "string", enum: ["project-agents", "project-memory", "user-memory"] },
+        dry_run: {
+          type: "boolean",
+          description: "When true, return the matched entries (capped at 20) WITHOUT deleting them. Default false."
+        }
       },
       required: ["query"]
     },
@@ -84,6 +92,18 @@ function forgetTool(memory) {
         });
       }
       const scope = input.scope ?? "project-memory";
+      if (input.dry_run) {
+        const entries = await memory.list(scope);
+        const needle = input.query.toLowerCase();
+        const matching = entries.filter((entry) => entry.text.toLowerCase().includes(needle));
+        return {
+          removed: 0,
+          scope,
+          dryRun: true,
+          matched: matching.length,
+          matches: matching.slice(0, 20).map((entry) => entry.text)
+        };
+      }
       const removed = await memory.forget(input.query, scope);
       return { removed, scope };
     }

package/dist/mode.d.ts

@@ -8,7 +8,7 @@ interface ModeOutput {
     action: string;
     currentMode?: string | undefined;
     modes?: {
-        id: string | undefined;
+        id: string;
         name: string;
         description: string;
         family: ModeFamily;

package/dist/mode.js

@@ -12,6 +12,9 @@ function createModeTool(modeStore) {
     description: "Manage agent operating modes. Modes change the agent's behavior, personality, and system prompt for different workflows (e.g. coding, security review, planning).",
     usageHint: "POWERFUL BEHAVIOR CONTROL TOOL:\n\n- Use `list` to see available modes.\n- Use `set <modeId>` to switch the agent into a specific role/mode.\n- Use `get` to check current mode.\n- Use `clear` to return to default behavior.\nSwitching modes is very effective for specialized tasks. The mode change affects how the agent reasons and which guidelines it follows.",
     permission: "confirm",
+    // WS-046: gives permission decisions something to key on — the mode being
+    // activated. Permission semantics are unchanged.
+    subjectKey: "mode",
     mutating: true,
     timeoutMs: 5e3,
     capabilities: ["session.mode"],

package/dist/next-steps.d.ts

@@ -73,12 +73,11 @@ export declare function isFinalTurnStopReason(stopReason: string | undefined): b
  * Parse canonical "<nextsteps>" blocks from assistant output (or raw numbered lines).
  *
  * @param content        — raw assistant message text or subagent output
- * @param strict         — retained for compatibility; assistant-output paths always require the canonical XML tag.
- * @param requireHeading — when true, a canonical XML tag must precede the item list.
+ * @param requireHeading — when true (default), a canonical XML tag must precede the item list.
  *                        when false, numbered/bullet items are parsed from anywhere in text
  *                        (used by /suggest subagent output which has no heading).
  */
-export declare function parseNextSteps(content: string, strict?: boolean, requireHeading?: boolean): ParseNextStepsResult;
+export declare function parseNextSteps(content: string, requireHeading?: boolean): ParseNextStepsResult;
 /**
  * Strip <nextsteps>...</nextsteps> blocks from subagent output text.
  * Subagent results should not contain suggestion blocks — those belong to

package/dist/next-steps.js

@@ -5,9 +5,9 @@ function isFinalTurnStopReason(stopReason) {
 var NEXT_STEPS_TAG_RE = /<nextsteps\b[^>]*>\s*\n+/i;
 var ITEM_RE = /^(?:(\d+)[.)]\s*|[-*•]\s*)(.+?)(\s+auto="true")?$/;
 var MAX_STEPS = 6;
-function parseNextSteps(content, strict = false, requireHeading = true) {
+function parseNextSteps(content, requireHeading = true) {
   if (requireHeading) {
-    return parseWithHeading(content, strict);
+    return parseWithHeading(content);
   }
   return parseRawNumbered(content);
 }
@@ -44,7 +44,7 @@ function parseRawNumbered(content) {
     autoTexts: steps.filter((s) => s.auto).map((s) => s.text)
   };
 }
-function parseWithHeading(content, _strict) {
+function parseWithHeading(content) {
   const headingMatch = NEXT_STEPS_TAG_RE.exec(content);
   if (!headingMatch) {
     return { steps: [], texts: [], stripped: content, autoTexts: [] };

package/dist/outdated.d.ts

@@ -1,9 +1,6 @@
 import type { Tool } from '@wrongstack/core/types';
 interface OutdatedInput {
     cwd?: string | undefined;
-    format?: 'list' | 'table' | undefined;
-    include_deprecated?: boolean | undefined;
-    check?: string | string[] | undefined;
 }
 interface OutdatedPackage {
     name: string;

package/dist/outdated.js

@@ -17,19 +17,48 @@ var __export = (target, all) => {
 import * as fsp from "node:fs/promises";
 import * as path from "node:path";
 import * as Core from "@wrongstack/core/utils";
-async function detectPackageManager(cwd) {
-  const { stat: stat5 } = await import("node:fs/promises");
-  try {
-    await stat5(`${cwd}/pnpm-lock.yaml`);
-    return "pnpm";
-  } catch {
+async function detectPackageManager(cwd, stopAt) {
+  let dir = path.resolve(cwd);
+  const stop = stopAt ? path.resolve(stopAt) : dir;
+  for (; ; ) {
+    const found = await detectPackageManagerInDir(dir);
+    if (found) return found;
+    if (dir === stop) break;
+    const parent = path.dirname(dir);
+    const relParent = path.relative(stop, parent);
+    if (parent === dir || relParent.startsWith("..") || path.isAbsolute(relParent)) break;
+    dir = parent;
   }
+  return "npm";
+}
+async function detectPackageManagerInDir(dir) {
+  const fs6 = await import("node:fs/promises");
   try {
-    await stat5(`${cwd}/yarn.lock`);
-    return "yarn";
+    const raw = await fs6.readFile(path.join(dir, "package.json"), "utf8");
+    const declared = JSON.parse(raw).packageManager;
+    if (typeof declared === "string") {
+      const name = declared.split("@")[0] ?? "";
+      if (name === "pnpm" || name === "yarn") return name;
+      if (name === "npm" || name === "bun") return "npm";
+    }
   } catch {
   }
-  return "npm";
+  const lockfiles = [
+    ["pnpm-lock.yaml", "pnpm"],
+    ["yarn.lock", "yarn"],
+    ["bun.lockb", "npm"],
+    ["bun.lock", "npm"],
+    ["package-lock.json", "npm"],
+    ["npm-shrinkwrap.json", "npm"]
+  ];
+  for (const [file, manager] of lockfiles) {
+    try {
+      await fs6.stat(`${dir}/${file}`);
+      return manager;
+    } catch {
+    }
+  }
+  return null;
 }
 function resolvePath(input, ctx) {
   return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);
@@ -2719,8 +2748,11 @@ var init_redact_command = __esm({
       /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
       // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
       // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
+      // The value must be token-like (>= 8 chars) so ordinary combined flags such
+      // as `tar -tf` / `ssh -tt` are not eaten. Global flag: EVERY occurrence is
+      // redacted, not just the first.
       // NOTE: synced with @wrongstack/core observability/redact-command.ts.
-      /(?<![-\w])-t(?:[=\s]+)?[^\s,-]+/,
+      /(?<![-\w])-t(?:[=\s]+)?[^\s,-]{8,}/g,
       // -p|-password|-a (redis auth) short flags: attached + separated + =value.
       // Same token-start anchor; over-redaction is an accepted tradeoff for a
       // redaction function. Synced with core copy.
@@ -2728,8 +2760,9 @@ var init_redact_command = __esm({
       // env var–style secrets: TOKEN=x, API_KEY=y, etc.
       /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
       // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
-      // when preceded by a flag name (e.g. --github-token=EyJ...).
-      /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/
+      // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
+      // every such flag in the command line is redacted, not just the first.
+      /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/g
     ];
   }
 });
@@ -2815,11 +2848,15 @@ var init_process_registry = __esm({
         return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
       }
       _canSignalProcessGroup(p) {
-        return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && typeof p.child.pid === "number" && p.child.pid === p.pid;
+        return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && p.child !== null && typeof p.child.pid === "number" && p.child.pid === p.pid;
       }
       _killChildDirect(p, signal) {
         try {
-          p.child.kill(signal);
+          if (p.child) {
+            p.child.kill(signal);
+            return;
+          }
+          if (this._isSafeSignalPid(p.pid)) process.kill(p.pid, signal);
         } catch {
         }
       }
@@ -3017,15 +3054,15 @@ var init_process_registry = __esm({
         this._pruneStale(pid);
         const p = this.processes.get(pid);
         if (!p) return false;
-        if (p.killed) return true;
+        if (p.killed && opts.force !== true) return true;
         if (p.protected && opts.includeProtected !== true) return false;
         if (opts.preserveBackground && p.background) return false;
         const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
         const isWin2 = os.platform() === "win32";
         if (isWin2) {
-          const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
+          const liveRealChild = p.child === null || p.child.exitCode === null && typeof p.child.pid === "number";
           const directFallback = () => {
-            if (p.child.exitCode === null) {
+            if (p.child && p.child.exitCode === null) {
               try {
                 p.child.kill("SIGKILL");
               } catch {
@@ -3037,10 +3074,7 @@ var init_process_registry = __esm({
             onSettled: directFallback
           })) {
           } else {
-            try {
-              p.child.kill(force ? "SIGKILL" : "SIGTERM");
-            } catch {
-            }
+            this._killChildDirect(p, force ? "SIGKILL" : "SIGTERM");
           }
           p.killed = true;
           return true;
@@ -3051,7 +3085,7 @@ var init_process_registry = __esm({
           } else {
             this._killPosix(p, "SIGTERM");
             const timer = setTimeout(() => {
-              if (this.processes.has(pid) && !p.child.killed) {
+              if (this.processes.has(pid) && !p.child?.killed) {
                 this._killPosix(p, "SIGKILL");
               }
             }, graceMs);
@@ -3106,6 +3140,16 @@ var init_process_registry = __esm({
        * before reusing a PID, but we want to clean up before that becomes a risk.
        */
       _isStaleEntry(entry) {
+        if (entry.child === null) {
+          if (Date.now() - entry.startedAt <= 6e4) return false;
+          if (os.platform() === "win32") return false;
+          try {
+            process.kill(entry.pid, 0);
+            return false;
+          } catch (err) {
+            return err.code !== "EPERM";
+          }
+        }
         return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
       }
       /**
@@ -4972,25 +5016,12 @@ var outdatedTool = {
   inputSchema: {
     type: "object",
     properties: {
-      cwd: { type: "string", description: "Working directory (default: cwd)" },
-      format: {
-        type: "string",
-        enum: ["list", "table"],
-        description: "Output format (default: list)"
-      },
-      include_deprecated: {
-        type: "boolean",
-        description: "Include deprecated packages (default: false)"
-      },
-      check: {
-        type: "string",
-        description: "Specific package(s) to check (comma-separated)"
-      }
+      cwd: { type: "string", description: "Working directory (default: cwd)" }
     }
   },
   async execute(input, ctx, opts) {
     const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
-    const manager = await detectPackageManager(cwd);
+    const manager = await detectPackageManager(cwd, ctx.projectRoot);
     if (manager === "npm") {
       try {
         const { detectNonJsEcosystem: detectNonJsEcosystem2 } = await Promise.resolve().then(() => (init_legacy_bridge(), legacy_bridge_exports));
@@ -5043,8 +5074,6 @@ var outdatedTool = {
       }
     }
     const args = ["outdated", "--json"];
-    if (input.format === "table") args.push("--table");
-    if (input.include_deprecated) args.push("--include", "deprecated");
     return runOutdated(manager, args, cwd, opts.signal);
   }
 };
@@ -5098,27 +5127,39 @@ function parseOutdatedOutput(json, exitCode) {
       truncated: false
     };
   }
+  const truncated = json.length >= 1e5 || Buffer.byteLength(json, "utf8") > COMMAND_OUTPUT_MAX_BYTES;
+  let parsedOk = false;
   try {
     const data = JSON.parse(json);
+    parsedOk = true;
     for (const name of Object.keys(data)) {
-      const info = data[name];
+      const info = data[name] ?? {};
+      const str = (v) => typeof v === "string" ? v : void 0;
       packages.push({
         name,
-        current: info.current ?? "unknown",
-        latest: info.latest ?? "unknown",
-        wanted: info.wanted ?? "unknown",
-        type: info.type ?? "unknown",
-        location: info.location ?? name
+        current: str(info["current"]) ?? "unknown",
+        latest: str(info["latest"]) ?? "unknown",
+        wanted: str(info["wanted"]) ?? "unknown",
+        // npm calls it `type`; pnpm calls it `dependencyType`.
+        type: str(info["type"]) ?? str(info["dependencyType"]) ?? "unknown",
+        location: str(info["location"]) ?? name
       });
     }
   } catch {
+  }
+  const outdatedFound = parsedOk && exitCode === 1;
+  let output = normalizeCommandOutput(json);
+  if (outdatedFound) {
+    output = `${output}
+
+Note: exit code 1 from \`outdated\` means outdated packages were found (expected); treated as success.`;
   }
   return {
-    exit_code: exitCode,
+    exit_code: outdatedFound ? 0 : exitCode,
     packages,
     total: packages.length,
-    output: json,
-    truncated: json.length >= 1e5
+    output,
+    truncated
   };
 }
 export {