@wrongstack/tools 0.306.3 → 0.307.0

package/dist/audit.js

@@ -422,13 +422,16 @@ function killWin32Tree(pid, opts = {}) {
     };
     child.on("error", settle);
     child.on("close", settle);
-    timeout = setTimeout(() => {
-      try {
-        child.kill();
-      } catch {
-      }
-      settle();
-    }, Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS));
+    timeout = setTimeout(
+      () => {
+        try {
+          child.kill();
+        } catch {
+        }
+        settle();
+      },
+      Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS)
+    );
     timeout.unref?.();
     child.unref();
     return true;
@@ -602,7 +605,10 @@ var ProcessRegistryImpl = class {
   getBreakerCountdown() {
     if (this.autoKillArmedAt === null || this.autoKillResetMs <= 0) return null;
     const elapsed = Date.now() - this.autoKillArmedAt;
-    return { remainingMs: Math.max(0, this.autoKillResetMs - elapsed), totalMs: this.autoKillResetMs };
+    return {
+      remainingMs: Math.max(0, this.autoKillResetMs - elapsed),
+      totalMs: this.autoKillResetMs
+    };
   }
   /**
    * Subscribe to countdown arm/cancel events. Returns an unsubscribe function.
@@ -1041,6 +1047,7 @@ function utf8Prefix(text, maxBytes) {
 }
 
 // src/_util.ts
+import * as fsp2 from "node:fs/promises";
 import * as path3 from "node:path";
 import * as Core from "@wrongstack/core/utils";
 async function detectPackageManager(cwd, stopAt) {
@@ -1107,6 +1114,40 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
+  const realRoots = await Promise.all(
+    allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path3.resolve(r)))
+  );
+  let probe = absPath;
+  const pendingTail = [];
+  for (; ; ) {
+    let real;
+    try {
+      real = await fsp2.realpath(probe);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        const parent = path3.dirname(probe);
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path3.basename(probe));
+        probe = parent;
+        continue;
+      }
+      throw err;
+    }
+    const candidate = pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
+    }
+    throw new Error(
+      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
+    );
+  }
+}
+async function safeResolveReal(input, ctx) {
+  const abs = safeResolve(input, ctx);
+  return await resolveRealInsideRoot(abs, ctx);
+}
 var COMMAND_OUTPUT_MAX_BYTES = 32768;
 var REPEAT_RUN_THRESHOLD = 3;
 function collapseCarriageReturns(text) {
@@ -3890,7 +3931,7 @@ var auditTool = {
         "audit: `fix: true` is not supported \u2014 this tool is read-only (mutating: false). To remediate vulnerabilities, upgrade the affected packages with the `install` tool (or `language_package` for non-JS ecosystems)."
       );
     }
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const bridge = await tryLegacyPackageOperation("package-audit", {
       cwd,
       projectRoot: ctx.projectRoot,

package/dist/auto-proceed-loop-guard.js

@@ -54,7 +54,10 @@ var ADVANCE_PREAMBLES = [
 ];
 function generateAdvancementPrompt(stalledTodo, nextTodo, attemptCount, todos) {
   const idx = Math.max(0, Math.min(attemptCount - 1, ADVANCE_PREAMBLES.length - 1));
-  const preamble = ADVANCE_PREAMBLES[idx].replace(/\{attempts\}/g, () => String(attemptCount)).replace(/\{label\}/g, () => stalledTodo.content.slice(0, 72));
+  const preamble = ADVANCE_PREAMBLES[idx].replace(
+    /\{attempts\}/g,
+    () => String(attemptCount)
+  ).replace(/\{label\}/g, () => stalledTodo.content.slice(0, 72));
   if (!nextTodo) {
     return [
       preamble,
@@ -76,7 +79,10 @@ function generateAdvancementPrompt(stalledTodo, nextTodo, attemptCount, todos) {
       })
     );
   }
-  lines.push("", "If this item is already done, mark it complete and move to the next open todo. Keep the board honest as you work.");
+  lines.push(
+    "",
+    "If this item is already done, mark it complete and move to the next open todo. Keep the board honest as you work."
+  );
   return lines.join("\n");
 }
 function matchTodoIdFromPrompt(todos, prompt) {

package/dist/bash.js

@@ -453,13 +453,16 @@ function killWin32Tree(pid, opts = {}) {
     };
     child.on("error", settle);
     child.on("close", settle);
-    timeout = setTimeout(() => {
-      try {
-        child.kill();
-      } catch {
-      }
-      settle();
-    }, Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS));
+    timeout = setTimeout(
+      () => {
+        try {
+          child.kill();
+        } catch {
+        }
+        settle();
+      },
+      Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS)
+    );
     timeout.unref?.();
     child.unref();
     return true;
@@ -633,7 +636,10 @@ var ProcessRegistryImpl = class {
   getBreakerCountdown() {
     if (this.autoKillArmedAt === null || this.autoKillResetMs <= 0) return null;
     const elapsed = Date.now() - this.autoKillArmedAt;
-    return { remainingMs: Math.max(0, this.autoKillResetMs - elapsed), totalMs: this.autoKillResetMs };
+    return {
+      remainingMs: Math.max(0, this.autoKillResetMs - elapsed),
+      totalMs: this.autoKillResetMs
+    };
   }
   /**
    * Subscribe to countdown arm/cancel events. Returns an unsubscribe function.
@@ -955,12 +961,16 @@ async function readRegistryFile(filePath) {
 }
 async function writeRegistryFile(filePath, data) {
   const tmpPath = `${filePath}.tmp.${process.pid}`;
-  const content = JSON.stringify(data, (_k, v) => {
-    if (v instanceof Map) {
-      return Array.from(v.entries());
-    }
-    return v;
-  }, 2);
+  const content = JSON.stringify(
+    data,
+    (_k, v) => {
+      if (v instanceof Map) {
+        return Array.from(v.entries());
+      }
+      return v;
+    },
+    2
+  );
   await fs.writeFile(tmpPath, content, "utf-8");
   await fs.rename(tmpPath, filePath);
 }
@@ -988,7 +998,12 @@ var PersistentProcessRegistry = class {
     this.lockPath = path2.join(globalRoot, LOCKFILE);
     this.baseRegistry = baseRegistry ?? getProcessRegistry();
     this.ensureDirectory().catch((err) => {
-      emitStructuredLog("warn", "process_registry.dir_create_failed", "PersistentProcessRegistry: failed to create .wrongstack directory", err);
+      emitStructuredLog(
+        "warn",
+        "process_registry.dir_create_failed",
+        "PersistentProcessRegistry: failed to create .wrongstack directory",
+        err
+      );
     });
   }
   async ensureDirectory() {
@@ -1179,7 +1194,12 @@ var PersistentProcessRegistry = class {
       data.lastCleanup = now;
       await writeRegistryFile(this.registryPath, data);
     } catch (err) {
-      emitStructuredLog("warn", "process_registry.sync_failed", "PersistentProcessRegistry: sync failed", err);
+      emitStructuredLog(
+        "warn",
+        "process_registry.sync_failed",
+        "PersistentProcessRegistry: sync failed",
+        err
+      );
     } finally {
       await release();
     }
@@ -1218,7 +1238,12 @@ var PersistentProcessRegistry = class {
         await writeRegistryFile(this.registryPath, data);
       }
     } catch (err) {
-      emitStructuredLog("warn", "process_registry.cleanup_failed", "PersistentProcessRegistry: cleanup failed", err);
+      emitStructuredLog(
+        "warn",
+        "process_registry.cleanup_failed",
+        "PersistentProcessRegistry: cleanup failed",
+        err
+      );
     } finally {
       await release();
     }
@@ -1663,7 +1688,9 @@ function looksLikePowerShell(command) {
   if (/&\s+\$/.test(trimmed)) return true;
   if (/(^|\s)@\s*\(/.test(trimmed)) return true;
   if (/(^|\s)@\{/.test(trimmed)) return true;
-  if (/(?:^|[\s[({,;])(?:-eq|-ne|-lt|-gt|-le|-ge|-like|-notlike|-match|-notmatch|-contains|-notcontains|-in|-notin|-and|-or|-not|-band|-bor|-bxor|-replace|-isplit|-csplit|-osplit|-join|-is|-as|-f)(?:$|[\s\])},;])/i.test(trimmed)) {
+  if (/(?:^|[\s[({,;])(?:-eq|-ne|-lt|-gt|-le|-ge|-like|-notlike|-match|-notmatch|-contains|-notcontains|-in|-notin|-and|-or|-not|-band|-bor|-bxor|-replace|-isplit|-csplit|-osplit|-join|-is|-as|-f)(?:$|[\s\])},;])/i.test(
+    trimmed
+  )) {
     return true;
   }
   if (PS_VERB_RE.test(trimmed)) return true;
@@ -1679,7 +1706,9 @@ function looksLikePowerShellExtended(command) {
   if (/(?:^|\s)[-/](?:WhatIf|Confirm|ErrorAction)(?::[^\s]+|\s|=|$)/i.test(trimmed)) {
     return true;
   }
-  if (/(?:^|[\s;&|])(Where-Object|ForEach-Object|Select-Object|Sort-Object|Group-Object|Measure-Object|Compare-Object|Tee-Object)(?:\s|$)/i.test(trimmed)) {
+  if (/(?:^|[\s;&|])(Where-Object|ForEach-Object|Select-Object|Sort-Object|Group-Object|Measure-Object|Compare-Object|Tee-Object)(?:\s|$)/i.test(
+    trimmed
+  )) {
     return true;
   }
   if (/\bWrite-(?:Host|Output|Error|Warning|Verbose|Debug|Information)(?:\s|$)/i.test(trimmed)) {
@@ -1690,7 +1719,9 @@ function looksLikePowerShellExtended(command) {
     return true;
   }
   if (/^\s*<#|#>\s*$/m.test(trimmed)) return true;
-  if (/(?:^|\s)[-//](?:AsPlainText|PipelineVariable|pv|FilterHashtable|OutVariable|ov)(?:\s|=|$)/i.test(trimmed)) {
+  if (/(?:^|\s)[-//](?:AsPlainText|PipelineVariable|pv|FilterHashtable|OutVariable|ov)(?:\s|=|$)/i.test(
+    trimmed
+  )) {
     return true;
   }
   return false;
@@ -1733,7 +1764,9 @@ function diagnoseBashism(command, shell) {
     );
   }
   if (shell === "powershell" && /(&&|\|\|)/.test(command)) {
-    add("Windows PowerShell 5.1 has no `&&`/`||` \u2014 separate commands with `;` (check `$LASTEXITCODE`)");
+    add(
+      "Windows PowerShell 5.1 has no `&&`/`||` \u2014 separate commands with `;` (check `$LASTEXITCODE`)"
+    );
   }
   if (/\brm\s+-[A-Za-z]*[rf]/.test(command)) {
     add(
@@ -1741,7 +1774,9 @@ function diagnoseBashism(command, shell) {
     );
   }
   if (/\bwhich\s+\S/.test(command)) {
-    add(isCmd ? "use `where <cmd>` instead of `which`" : "use `Get-Command <cmd>` instead of `which`");
+    add(
+      isCmd ? "use `where <cmd>` instead of `which`" : "use `Get-Command <cmd>` instead of `which`"
+    );
   }
   if (hints.length === 0) return void 0;
   const label = isCmd ? "cmd.exe" : shell === "pwsh" ? "PowerShell 7" : "Windows PowerShell";

package/dist/builtin.d.ts

@@ -43,13 +43,13 @@ export declare const TIER1_TOOLS: Tool[];
  */
 export declare const TIER2_TOOLS: Tool[];
 /**
- * Tier 3 tool set — specialized/optional tools for specific workflows.
- * Adds 10 tools: deadCodeScan, outdated, logs, document, scaffold,
- * toolSearch, toolUse, batchToolUse, toolHelp, setWorkingDir.
+ * Tier 3 tool set — specialized, administrative, and exploratory tools.
+ * Adds 12 tools: outdated, logs, document, scaffold, dead-code-scan,
+ * tool-search, tool-use, batch-tool-use, tool-help, set-working-dir.
  *
- * These tools are rarely used in typical development (once-per-session,
- * debugging, or one-time generation) and can be safely omitted in any
- * token-saving tier to save ~800 tokens per prompt.
+ * These tools are situational (e.g. documentation generation, scaffolding,
+ * log tailing, dependency audits). Omitting them in standard tier saves
+ * tokens while keeping all core capabilities available.
  */
 export declare const TIER3_TOOLS: Tool[];
 export declare const builtinTools: Tool[];