@wrongstack/tools 0.306.3 → 0.307.0

package/dist/exec.js

@@ -289,9 +289,33 @@ var RULES = [
     id: "shell-launcher",
     level: "caution",
     test: (cmd, args) => {
-      const launchers = ["env", "timeout", "nohup", "nice", "script", "expect", "tmux", "screen", "byobu", "dtach"];
+      const launchers = [
+        "env",
+        "timeout",
+        "nohup",
+        "nice",
+        "script",
+        "expect",
+        "tmux",
+        "screen",
+        "byobu",
+        "dtach"
+      ];
       if (!launchers.includes(cmd)) return false;
-      const shells = ["sh", "bash", "zsh", "fish", "python", "python3", "perl", "ruby", "node", "pwsh", "powershell", "cmd"];
+      const shells = [
+        "sh",
+        "bash",
+        "zsh",
+        "fish",
+        "python",
+        "python3",
+        "perl",
+        "ruby",
+        "node",
+        "pwsh",
+        "powershell",
+        "cmd"
+      ];
       if (cmd === "env") {
         const prog = args.find((a) => !a.includes("=") && !a.startsWith("-"));
         return prog !== void 0 && shells.includes(prog);
@@ -487,8 +511,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
@@ -887,13 +912,16 @@ function killWin32Tree(pid, opts = {}) {
     };
     child.on("error", settle);
     child.on("close", settle);
-    timeout = setTimeout(() => {
-      try {
-        child.kill();
-      } catch {
-      }
-      settle();
-    }, Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS));
+    timeout = setTimeout(
+      () => {
+        try {
+          child.kill();
+        } catch {
+        }
+        settle();
+      },
+      Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS)
+    );
     timeout.unref?.();
     child.unref();
     return true;
@@ -1067,7 +1095,10 @@ var ProcessRegistryImpl = class {
   getBreakerCountdown() {
     if (this.autoKillArmedAt === null || this.autoKillResetMs <= 0) return null;
     const elapsed = Date.now() - this.autoKillArmedAt;
-    return { remainingMs: Math.max(0, this.autoKillResetMs - elapsed), totalMs: this.autoKillResetMs };
+    return {
+      remainingMs: Math.max(0, this.autoKillResetMs - elapsed),
+      totalMs: this.autoKillResetMs
+    };
   }
   /**
    * Subscribe to countdown arm/cancel events. Returns an unsubscribe function.
@@ -1382,12 +1413,16 @@ async function readRegistryFile(filePath) {
 }
 async function writeRegistryFile(filePath, data) {
   const tmpPath = `${filePath}.tmp.${process.pid}`;
-  const content = JSON.stringify(data, (_k, v) => {
-    if (v instanceof Map) {
-      return Array.from(v.entries());
-    }
-    return v;
-  }, 2);
+  const content = JSON.stringify(
+    data,
+    (_k, v) => {
+      if (v instanceof Map) {
+        return Array.from(v.entries());
+      }
+      return v;
+    },
+    2
+  );
   await fs2.writeFile(tmpPath, content, "utf-8");
   await fs2.rename(tmpPath, filePath);
 }
@@ -1415,7 +1450,12 @@ var PersistentProcessRegistry = class {
     this.lockPath = path4.join(globalRoot, LOCKFILE);
     this.baseRegistry = baseRegistry ?? getProcessRegistry();
     this.ensureDirectory().catch((err) => {
-      emitStructuredLog("warn", "process_registry.dir_create_failed", "PersistentProcessRegistry: failed to create .wrongstack directory", err);
+      emitStructuredLog(
+        "warn",
+        "process_registry.dir_create_failed",
+        "PersistentProcessRegistry: failed to create .wrongstack directory",
+        err
+      );
     });
   }
   async ensureDirectory() {
@@ -1606,7 +1646,12 @@ var PersistentProcessRegistry = class {
       data.lastCleanup = now;
       await writeRegistryFile(this.registryPath, data);
     } catch (err) {
-      emitStructuredLog("warn", "process_registry.sync_failed", "PersistentProcessRegistry: sync failed", err);
+      emitStructuredLog(
+        "warn",
+        "process_registry.sync_failed",
+        "PersistentProcessRegistry: sync failed",
+        err
+      );
     } finally {
       await release();
     }
@@ -1645,7 +1690,12 @@ var PersistentProcessRegistry = class {
         await writeRegistryFile(this.registryPath, data);
       }
     } catch (err) {
-      emitStructuredLog("warn", "process_registry.cleanup_failed", "PersistentProcessRegistry: cleanup failed", err);
+      emitStructuredLog(
+        "warn",
+        "process_registry.cleanup_failed",
+        "PersistentProcessRegistry: cleanup failed",
+        err
+      );
     } finally {
       await release();
     }
@@ -1794,7 +1844,11 @@ async function checkExecKillCommand(cmd, args) {
           if (filterArg) {
             const nameMatch = filterArg.match(/IMAGENAME\s+eq\s+"?([^"\s]+)/i);
             if (nameMatch?.[1]) {
-              const result = await checkKillTarget({ name: nameMatch[1], signal, cmd: fullCommand });
+              const result = await checkKillTarget({
+                name: nameMatch[1],
+                signal,
+                cmd: fullCommand
+              });
               if (result.blocked) return result;
             }
           }

package/dist/fetch.js

@@ -5,10 +5,7 @@ import TurndownService from "turndown";
 // src/_fetch-guard.ts
 import * as dns from "node:dns/promises";
 import * as net from "node:net";
-import {
-  isPrivateIPv4,
-  isPrivateIPv6
-} from "@wrongstack/core/utils";
+import { isPrivateIPv4, isPrivateIPv6 } from "@wrongstack/core/utils";
 import { FetchError, ToolValidationError } from "@wrongstack/core/types";
 import { Agent, fetch as undiciFetch } from "undici";
 var nativeGlobalFetch = globalThis.fetch;
@@ -275,11 +272,16 @@ var fetchTool = {
     await assertNotPrivate(u.hostname);
     yield { type: "log", text: `GET ${input.url}` };
     const ctrl = new AbortController();
-    const timer = setTimeout(() => ctrl.abort(new ToolError({
-      message: "fetch timeout",
-      code: "TOOL_TIMEOUT",
-      toolName: "fetch"
-    })), TIMEOUT_MS);
+    const timer = setTimeout(
+      () => ctrl.abort(
+        new ToolError({
+          message: "fetch timeout",
+          code: "TOOL_TIMEOUT",
+          toolName: "fetch"
+        })
+      ),
+      TIMEOUT_MS
+    );
     const combined = combineSignals([opts.signal, ctrl.signal]);
     try {
       let res;

package/dist/format.js

@@ -422,13 +422,16 @@ function killWin32Tree(pid, opts = {}) {
     };
     child.on("error", settle);
     child.on("close", settle);
-    timeout = setTimeout(() => {
-      try {
-        child.kill();
-      } catch {
-      }
-      settle();
-    }, Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS));
+    timeout = setTimeout(
+      () => {
+        try {
+          child.kill();
+        } catch {
+        }
+        settle();
+      },
+      Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS)
+    );
     timeout.unref?.();
     child.unref();
     return true;
@@ -602,7 +605,10 @@ var ProcessRegistryImpl = class {
   getBreakerCountdown() {
     if (this.autoKillArmedAt === null || this.autoKillResetMs <= 0) return null;
     const elapsed = Date.now() - this.autoKillArmedAt;
-    return { remainingMs: Math.max(0, this.autoKillResetMs - elapsed), totalMs: this.autoKillResetMs };
+    return {
+      remainingMs: Math.max(0, this.autoKillResetMs - elapsed),
+      totalMs: this.autoKillResetMs
+    };
   }
   /**
    * Subscribe to countdown arm/cancel events. Returns an unsubscribe function.
@@ -1041,6 +1047,7 @@ function utf8Prefix(text, maxBytes) {
 }
 
 // src/_util.ts
+import * as fsp2 from "node:fs/promises";
 import * as path3 from "node:path";
 import * as Core from "@wrongstack/core/utils";
 function resolvePath(input, ctx) {
@@ -1064,6 +1071,40 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
+  const realRoots = await Promise.all(
+    allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path3.resolve(r)))
+  );
+  let probe = absPath;
+  const pendingTail = [];
+  for (; ; ) {
+    let real;
+    try {
+      real = await fsp2.realpath(probe);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        const parent = path3.dirname(probe);
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path3.basename(probe));
+        probe = parent;
+        continue;
+      }
+      throw err;
+    }
+    const candidate = pendingTail.length > 0 ? path3.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
+    }
+    throw new Error(
+      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
+    );
+  }
+}
+async function safeResolveReal(input, ctx) {
+  const abs = safeResolve(input, ctx);
+  return await resolveRealInsideRoot(abs, ctx);
+}
 var COMMAND_OUTPUT_MAX_BYTES = 32768;
 var REPEAT_RUN_THRESHOLD = 3;
 function collapseCarriageReturns(text) {
@@ -3590,7 +3631,7 @@ var formatTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    const cwd = input.cwd ? safeResolve(input.cwd, ctx) : ctx.cwd;
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const fixer = input.fixer ?? "auto";
     if (fixer === "auto" && !input.files) {
       const op = input.check ? "format-check" : "format-write";

package/dist/glob.js

@@ -125,8 +125,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
@@ -266,7 +267,11 @@ var globTool = {
       await mapWithConcurrency(matchedFiles, WALK_CONCURRENCY, pushResult);
       if (truncated) return;
       const remainingSubdirs = truncated ? [] : subdirs;
-      await mapWithConcurrency(remainingSubdirs, WALK_CONCURRENCY, ({ full, rel }) => walk(full, rel));
+      await mapWithConcurrency(
+        remainingSubdirs,
+        WALK_CONCURRENCY,
+        ({ full, rel }) => walk(full, rel)
+      );
     };
     await walk(base, "");
     results.sort((a, b) => b.mtime - a.mtime);

package/dist/grep.js

@@ -199,8 +199,9 @@ async function resolveRealInsideRoot(absPath, ctx) {
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) {
-      return pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    const candidate = pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    if (isInsideAny(candidate, realRoots)) {
+      return candidate;
     }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
@@ -405,7 +406,10 @@ async function* runRgStream(input, base, mode, limit, signal) {
     args.push("--glob", `!${ignored}/**`, "--glob", `!**/${ignored}/**`);
   }
   const gitignorePath = path3.join(base, ".gitignore");
-  if (await fs2.access(gitignorePath).then(() => true, () => false)) {
+  if (await fs2.access(gitignorePath).then(
+    () => true,
+    () => false
+  )) {
     args.push("--ignore-file", gitignorePath);
   }
   if (input.glob) args.push("--glob", input.glob);
@@ -439,14 +443,12 @@ async function* runRgStream(input, base, mode, limit, signal) {
     }
   };
   const pauseIfFlooded = () => {
-    if (paused || queue.length < RG_MAX_QUEUE_CHUNKS && queuedChars < RG_MAX_QUEUE_CHARS)
-      return;
+    if (paused || queue.length < RG_MAX_QUEUE_CHUNKS && queuedChars < RG_MAX_QUEUE_CHARS) return;
     paused = true;
     child.stdout?.pause();
   };
   const resumeIfDrained = () => {
-    if (!paused || queue.length >= RG_MAX_QUEUE_CHUNKS || queuedChars >= RG_MAX_QUEUE_CHARS)
-      return;
+    if (!paused || queue.length >= RG_MAX_QUEUE_CHUNKS || queuedChars >= RG_MAX_QUEUE_CHARS) return;
     paused = false;
     child.stdout?.resume();
   };
@@ -606,7 +608,12 @@ async function runNative(input, base, mode, limit, signal) {
         const buffer = Buffer.allocUnsafe(Math.min(NATIVE_READ_CHUNK_BYTES, maxBytes));
         while (!stopped && !signal.aborted && bytesReadTotal < maxBytes) {
           const remaining = maxBytes - bytesReadTotal;
-          const { bytesRead } = await file.read(buffer, 0, Math.min(buffer.length, remaining), null);
+          const { bytesRead } = await file.read(
+            buffer,
+            0,
+            Math.min(buffer.length, remaining),
+            null
+          );
           if (bytesRead === 0) break;
           const chunk = buffer.subarray(0, bytesRead);
           if (!binaryChecked) {
@@ -664,7 +671,8 @@ async function runNative(input, base, mode, limit, signal) {
           if (mode === "files_with_matches" && matches.length >= limit) stopped = true;
         }
         if (mode === "content" && matches.length >= limit) stopped = true;
-        if (mode === "count" && matches.length >= limit && (countOnlyFirstHit || mode !== "count")) stopped = true;
+        if (mode === "count" && matches.length >= limit && (countOnlyFirstHit || mode !== "count"))
+          stopped = true;
       } finally {
         await file.close();
       }
@@ -695,7 +703,11 @@ async function runNative(input, base, mode, limit, signal) {
         files.push({ full, name: e.name });
       }
     }
-    await mapWithConcurrency(files, NATIVE_SCAN_CONCURRENCY, ({ full, name }) => scanFile(full, name));
+    await mapWithConcurrency(
+      files,
+      NATIVE_SCAN_CONCURRENCY,
+      ({ full, name }) => scanFile(full, name)
+    );
     await mapWithConcurrency(
       subdirs,
       Math.min(16, NATIVE_SCAN_CONCURRENCY),

package/dist/index.d.ts

@@ -8,7 +8,8 @@ export * from './browser/index.js';
 export { builtinTools, OFF_ONLY_TOOLS, OPTIONAL_TOOLS, TIER1_TOOLS, TIER2_TOOLS, TIER3_TOOLS, } from './builtin.js';
 export { CircuitBreaker, type CircuitBreakerConfig, type CircuitBreakerSnapshot, } from './circuit-breaker.js';
 export type { CircuitSnapshot, CircuitState, CodeMapGraph, DeadCodeScanInput, DeadCodeScanOutput, DeadFile, DeadPackage, DeadSymbol, GraphEdge, GraphNode, ProjectIndexDaemonAvailability, ProjectIndexServerActivity, ProjectIndexServerClientHealth, ProjectIndexServerConnectionState, ProjectIndexServerConnectionStatus, ProjectIndexServerHealth, } from './codebase-index/index.js';
-export { CircuitOpenError, cancelPendingReindexes, checkCodebaseIndexServerHealth, codebaseIndexStats, codebaseIndexTool, codebaseSearchTool, codebaseStatsTool, deadCodeScanTool, enqueueReindex, ensureCodebaseIndexServer, fileGraphService, getIndexState, IndexCircuitBreaker, IndexTimeoutError, indexCircuitBreaker, isIndexableFile, isIndexing, isIndexReady, onIndexStateChange, packageGraphService, resetIndexCircuitBreaker, resolveProjectIndexDaemonAvailability, runDeadCodeScan, runStartupIndex, searchCodebaseIndex, shutdownCodebaseIndexHost, shutdownCodebaseIndexServer, symbolGraphService, } from './codebase-index/index.js';
+export { clarifyTool, type ClarifyQuestionInput, type ClarifyOutput, } from './clarify.js';
+export { CircuitOpenError, cancelPendingReindexes, checkCodebaseIndexServerHealth, codebaseAstReplaceTool, codebaseImpactAnalysisTool, codebaseIndexStats, codebaseIndexTool, codebaseRepoMapTool, codebaseSearchTool, codebaseSkeletonTool, codebaseStatsTool, codebaseTargetedTestTool, deadCodeScanTool, enqueueReindex, ensureCodebaseIndexServer, extractDirectorySkeleton, extractFileSkeleton, generateRepoMap, replaceSymbolInFile, type FileSkeletonResult, type MutateSymbolOptions, type MutateSymbolResult, type RepoMapOptions, type RepoMapResult, type SkeletonOptions, type SkeletonSymbolRange, fileGraphService, getIndexState, IndexCircuitBreaker, IndexTimeoutError, indexCircuitBreaker, isIndexableFile, isIndexing, isIndexReady, onIndexStateChange, packageGraphService, resetIndexCircuitBreaker, resolveProjectIndexDaemonAvailability, runDeadCodeScan, runStartupIndex, searchCodebaseIndex, shutdownCodebaseIndexHost, shutdownCodebaseIndexServer, symbolGraphService, } from './codebase-index/index.js';
 export { designTool } from './design.js';
 export { diffTool } from './diff.js';
 export { documentTool } from './document.js';
@@ -43,6 +44,7 @@ export { readTool } from './read.js';
 export { replaceTool } from './replace.js';
 export { scaffoldTool } from './scaffold.js';
 export { searchTool } from './search.js';
+export { analyzeSecurityAndPerformance, securityAstScanTool, type SecurityFinding, type SecurityScanInput, type SecurityScanOutput, } from './security-ast-scan-tool.js';
 export { applySessionKanbanBoardToTodos, applySessionKanbanTaskToSource, attachSessionKanbanMirror, ensureSessionKanbanBoard, hydrateSessionKanban, mirrorSessionPlanToKanban, mirrorSessionTasksToKanban, mirrorSessionTodosToKanban, projectSessionPlanToKanban, projectSessionTasksToKanban, projectSessionTodosToKanban, rebindSessionKanbanTask, SESSION_KANBAN_COLUMNS, } from './session-kanban.js';
 export { makeSkillTool } from './skill.js';
 export { taskTool } from './task.js';