@wrongstack/tools 0.306.4 → 0.307.0

package/dist/search.js

@@ -5,10 +5,7 @@ import { expectDefined } from "@wrongstack/core/utils";
 // src/_fetch-guard.ts
 import * as dns from "node:dns/promises";
 import * as net from "node:net";
-import {
-  isPrivateIPv4,
-  isPrivateIPv6
-} from "@wrongstack/core/utils";
+import { isPrivateIPv4, isPrivateIPv6 } from "@wrongstack/core/utils";
 import { FetchError, ToolValidationError } from "@wrongstack/core/types";
 import { Agent, fetch as undiciFetch } from "undici";
 var nativeGlobalFetch = globalThis.fetch;
@@ -491,18 +488,27 @@ async function bingSearch(query, signal) {
 }
 function parseBingResults(html, num) {
   const results = [];
-  const blocks = [...html.matchAll(/<li\b[^>]*class=(["'])[^"']*\bb_algo\b[^"']*\1[^>]*>([\s\S]*?)(?=<li\b[^>]*class=(["'])[^"']*\bb_algo\b[^"']*\3|<\/ol>)/gi)].map((m) => expectDefined(m[2]));
+  const blocks = [
+    ...html.matchAll(
+      /<li\b[^>]*class=(["'])[^"']*\bb_algo\b[^"']*\1[^>]*>([\s\S]*?)(?=<li\b[^>]*class=(["'])[^"']*\bb_algo\b[^"']*\3|<\/ol>)/gi
+    )
+  ].map((m) => expectDefined(m[2]));
   const candidates = blocks.length > 0 ? blocks : [html];
-  const entries = takeFrom(candidates.flatMap((block) => {
-    const titleMatch = /<h2[^>]*>\s*<a\b([^>]*)>([\s\S]*?)<\/a>\s*<\/h2>/i.exec(block);
-    if (!titleMatch) return [];
-    const href = getHtmlAttr(expectDefined(titleMatch[1]), "href");
-    const title = stripTags(expectDefined(titleMatch[2]));
-    if (!href || !title) return [];
-    const snippetMatch = /<p\b[^>]*class=(["'])[^"']*\b(?:b_paractl|b_lineclamp\d*)\b[^"']*\1[^>]*>([\s\S]*?)<\/p>/i.exec(block) ?? /<p\b[^>]*>([\s\S]*?)<\/p>/i.exec(block);
-    const snippet = snippetMatch ? capSnippet(stripTags(expectDefined(snippetMatch.at(-1)))) : "";
-    return [{ url: normalizeBingUrl(href), title, snippet, score: 1 }];
-  }), num);
+  const entries = takeFrom(
+    candidates.flatMap((block) => {
+      const titleMatch = /<h2[^>]*>\s*<a\b([^>]*)>([\s\S]*?)<\/a>\s*<\/h2>/i.exec(block);
+      if (!titleMatch) return [];
+      const href = getHtmlAttr(expectDefined(titleMatch[1]), "href");
+      const title = stripTags(expectDefined(titleMatch[2]));
+      if (!href || !title) return [];
+      const snippetMatch = /<p\b[^>]*class=(["'])[^"']*\b(?:b_paractl|b_lineclamp\d*)\b[^"']*\1[^>]*>([\s\S]*?)<\/p>/i.exec(
+        block
+      ) ?? /<p\b[^>]*>([\s\S]*?)<\/p>/i.exec(block);
+      const snippet = snippetMatch ? capSnippet(stripTags(expectDefined(snippetMatch.at(-1)))) : "";
+      return [{ url: normalizeBingUrl(href), title, snippet, score: 1 }];
+    }),
+    num
+  );
   for (let i = 0; i < entries.length; i++) {
     const entry = entries[i];
     if (entry) {

package/dist/security-ast-scan-tool.d.ts

@@ -0,0 +1,43 @@
+/**
+ * `security-ast-scan` tool — Contract-based Security & Performance AST Radar.
+ *
+ * Scans code files or snippets for anti-patterns that static types cannot catch:
+ * 1. N+1 Database Query loops (Performance critical)
+ * 2. SQL Injection / Raw query interpolation (Security critical)
+ * 3. Hardcoded secrets, API tokens, and private keys
+ * 4. Prototype Pollution vulnerabilities
+ * 5. ReDoS (Regular Expression Denial of Service) nested backtracking
+ * 6. Unsafe dynamic execution (eval, new Function, unsanitized child_process.exec)
+ */
+import type { Tool } from '@wrongstack/core/types';
+export interface SecurityFinding {
+    ruleId: 'perf/n-plus-one-query' | 'sec/sql-injection' | 'sec/hardcoded-secret' | 'sec/prototype-pollution' | 'sec/redos-vulnerable-regex' | 'sec/unsafe-dynamic-exec';
+    category: 'security' | 'performance';
+    severity: 'critical' | 'warning' | 'info';
+    file: string;
+    line: number;
+    message: string;
+    snippet: string;
+    recommendation: string;
+}
+export interface SecurityScanInput {
+    /** File path to scan (relative to project root or absolute). */
+    file?: string | undefined;
+    /** Direct code content to scan (optional, if scanning unwritten draft). */
+    content?: string | undefined;
+    /** Specific rule IDs to enable or filter by. */
+    rules?: string[] | undefined;
+}
+export interface SecurityScanOutput {
+    status: 'clean' | 'findings_detected' | 'error';
+    filesScanned: number;
+    totalFindings: number;
+    criticalCount: number;
+    warningCount: number;
+    findings: SecurityFinding[];
+    summary: string;
+    error?: string | undefined;
+}
+export declare function analyzeSecurityAndPerformance(filePath: string, content: string): SecurityFinding[];
+export declare const securityAstScanTool: Tool<SecurityScanInput, SecurityScanOutput>;
+//# sourceMappingURL=security-ast-scan-tool.d.ts.map

package/dist/session-kanban-graph.d.ts

@@ -0,0 +1,9 @@
+import type { TodoItem } from '@wrongstack/core/agent';
+import type { PlanItem } from '@wrongstack/core/storage';
+import type { SerializedTaskGraph, TaskStatus } from '@wrongstack/core/types';
+import type { TaskItem } from '@wrongstack/core/utils';
+export declare const PLAN_STATUS_TO_TASK: Record<PlanItem['status'], TaskStatus>;
+export declare function todoListToSerializedGraph(todos: readonly TodoItem[], sessionId: string): SerializedTaskGraph;
+export declare function taskFileToSerializedGraph(tasks: readonly TaskItem[], sessionId: string): SerializedTaskGraph;
+export declare function planFileToSerializedGraph(items: readonly PlanItem[], sessionId: string): SerializedTaskGraph;
+//# sourceMappingURL=session-kanban-graph.d.ts.map

package/dist/session-kanban-sync.d.ts

@@ -0,0 +1,31 @@
+import type { Context, TodoItem } from '@wrongstack/core/agent';
+import { type PlanFile, type TaskFile } from '@wrongstack/core/storage';
+import type { TaskStatus } from '@wrongstack/core/types';
+import { type KanbanBoard, type KanbanTask } from '@wrongstack/kanban';
+export interface SessionKanbanSourceUpdate {
+    source: 'todo' | 'task' | 'plan' | null;
+    todos?: TodoItem[] | undefined;
+    tasks?: TaskFile | undefined;
+    plan?: PlanFile | undefined;
+}
+export declare function sourceStatus(task: KanbanTask): TaskStatus;
+export declare function todoStatus(task: KanbanTask): TodoItem['status'];
+export declare function sessionTodoFromTask(task: KanbanTask, board?: KanbanBoard): TodoItem;
+export declare function managedTodoFromTask(task: KanbanTask, board: KanbanBoard): TodoItem;
+export declare function blockingTitles(board: KanbanBoard, task: KanbanTask): string[];
+export declare function orderTasksForTodos(board: KanbanBoard, tasks: readonly KanbanTask[]): KanbanTask[];
+export declare function sameTodos(left: readonly TodoItem[], right: readonly TodoItem[]): boolean;
+export declare function broadcastTodoUpdate(context: Context, todos: readonly TodoItem[]): void;
+export declare function notifyTodoUpdate(context: Context, todos: readonly TodoItem[]): void;
+export declare function todosNeedingSessionMirror(todos: readonly TodoItem[], activeBoardId: string | undefined): readonly TodoItem[];
+export declare function applySessionKanbanBoardToTodos(context: Context, board: KanbanBoard, options: {
+    sessionIdFromTags: (tags: readonly string[] | undefined) => string | null;
+    isOwnedSessionBoard: (tags: readonly string[] | undefined) => boolean;
+    hasInFlightTodoMirror: (projectRoot: string | undefined, sessionId: string) => boolean;
+    suppressedTodoMirrors: WeakSet<Context>;
+}): TodoItem[];
+export declare function applyManagedKanbanBoardToTodos(context: Context, board: KanbanBoard, suppressedTodoMirrors: WeakSet<Context>): TodoItem[];
+export declare function applySessionKanbanTaskToSource(context: Context, task: KanbanTask, suppressedTodoMirrors: WeakSet<Context>, options?: {
+    remove?: boolean | undefined;
+}): Promise<SessionKanbanSourceUpdate>;
+//# sourceMappingURL=session-kanban-sync.d.ts.map

package/dist/session-kanban.d.ts

@@ -1,167 +1,31 @@
 import type { Context, TodoItem } from '@wrongstack/core/agent';
-import { type PlanFile, type PlanItem, type TaskFile } from '@wrongstack/core/storage';
-import type { SerializedTaskGraph } from '@wrongstack/core/types';
-import { type TaskItem } from '@wrongstack/core/utils';
+import { type PlanItem } from '@wrongstack/core/storage';
+import type { TaskItem } from '@wrongstack/core/utils';
 import { type KanbanBoard, type KanbanColumn, type KanbanTask } from '@wrongstack/kanban';
-/**
- * The canonical workflow shared by WebUI and TUI session boards.
- *
- * Session boards now use the same 5 standard columns as every other board
- * (backlog, todo, in-progress, review, done). Formerly this shipped a 4-column
- * variant without a backlog; the column lock unified the layout. Existing
- * 4-column session_mirror boards are migrated automatically on the next session
- * touch: `ensureSessionKanbanBoard`'s `sameColumns` check detects the drift
- * and `updateBoard` reconciles to DEFAULT_COLUMNS.
- */
+import { type SessionKanbanSourceUpdate } from './session-kanban-sync.js';
+export { PLAN_STATUS_TO_TASK, planFileToSerializedGraph, taskFileToSerializedGraph, todoListToSerializedGraph, } from './session-kanban-graph.js';
+export { blockingTitles, orderTasksForTodos, type SessionKanbanSourceUpdate, todosNeedingSessionMirror, } from './session-kanban-sync.js';
 export declare const SESSION_KANBAN_COLUMNS: KanbanColumn[];
-/** Create (or migrate) the single Kanban board owned by a session. */
 export declare function ensureSessionKanbanBoard(projectRoot: string | undefined, sessionId: string): Promise<KanbanBoard | null>;
-/**
- * Remove an inactive session's observational mirror, including its cards.
- * The durable source remains the session todo/task/plan files; retaining the
- * mirror after detach only creates historical duplicate work in project views.
- */
 export declare function cleanupSessionKanbanBoard(projectRoot: string | undefined, sessionId: string): Promise<string[]>;
-/** Remove a particular inactive session's system-owned board when it has no cards. */
 export declare function cleanupSessionKanbanBoardIfEmpty(projectRoot: string | undefined, sessionId: string): Promise<string[]>;
-/** Prune stale empty session boards while preserving manual and live boards. */
 export declare function cleanupEmptySessionKanbanBoards(projectRoot: string | undefined, activeSessionId?: string): Promise<string[]>;
-/**
- * Consume the last unreported mirror failure for a session, if any.
- *
- * The mirror is asynchronous and fire-and-forget, so a rejected projection
- * used to be observable only in stdout. The `todo` tool drains this on its
- * next call and reports it as a warning, so a board that stopped tracking the
- * session is surfaced where the divergence actually matters.
- */
 export declare function takeSessionMirrorFailure(projectRoot: string | undefined, sessionId: string): string | undefined;
-export declare function todoListToSerializedGraph(todos: readonly TodoItem[], sessionId: string): SerializedTaskGraph;
-export declare function taskFileToSerializedGraph(tasks: readonly TaskItem[], sessionId: string): SerializedTaskGraph;
-export declare function planFileToSerializedGraph(items: readonly PlanItem[], sessionId: string): SerializedTaskGraph;
 export declare function projectSessionTodosToKanban(projectRoot: string | undefined, todos: readonly TodoItem[], sessionId: string): Promise<KanbanBoard | null>;
 export declare function projectSessionTasksToKanban(projectRoot: string | undefined, tasks: readonly TaskItem[], sessionId: string): Promise<KanbanBoard | null>;
 export declare function projectSessionPlanToKanban(projectRoot: string | undefined, items: readonly PlanItem[], sessionId: string): Promise<KanbanBoard | null>;
-/**
- * The todo rows that still need the session mirror: those not already cards on
- * the board this session is working on.
- *
- * The rule used to be all-or-nothing — the mirror was skipped only when EVERY
- * row was bound. A single unbound row (a todo the model added to the chat list
- * without also filing a card) sent the whole list to a separate session board,
- * so work already tracked on the real board showed up a second time there, and
- * one stray row was enough to leave a session board holding a single card.
- *
- * With no active board every row still needs mirroring, since there is no other
- * place the work is being recorded.
- */
-export declare function todosNeedingSessionMirror(todos: readonly TodoItem[], activeBoardId: string | undefined): readonly TodoItem[];
 export declare function mirrorSessionTodosToKanban(projectRoot: string | undefined, todos: readonly TodoItem[], sessionId: string): void;
 export declare function mirrorSessionTasksToKanban(projectRoot: string | undefined, tasks: readonly TaskItem[], sessionId: string): void;
 export declare function mirrorSessionPlanToKanban(projectRoot: string | undefined, items: readonly PlanItem[], sessionId: string): void;
-/**
- * Bind all live session work paths to Kanban. Todo changes are observed from
- * ConversationState; plan/task sidecars are watched so slash commands, WebUI,
- * plugins, and tools all pass through the same board.
- */
 export declare function attachSessionKanbanMirror(context: Context): () => void;
-/** Fully hydrate a session board before a host announces the session as ready. */
-/**
- * Re-bind the card this session was working, after a restart or `--resume`.
- *
- * The binding produced by `start_task` lives in `ctx.meta.kanban`, which is
- * conversation state — nothing restores it. So a resumed session came back
- * with `currentKanbanTaskId` undefined while its card still sat in Running on
- * the board: file events lost their task attribution, and under
- * `tools.kanbanGovernance` the run was un-bound until the model happened to
- * call `start_task` again.
- *
- * Board presence is the durable anchor. It is keyed `<sessionId>:<agentId>`,
- * carries the `taskId`, and is stored on the board record itself, so it
- * survives the restart even though its derived `active` flag does not (the TTL
- * is two minutes). Matching it against the cards that are actually still
- * running gives an unambiguous answer without guessing from free-text agent
- * ids.
- *
- * Deliberately conservative — it prefers to do nothing over binding the wrong
- * card:
- * - never overrides a binding this process already has;
- * - only considers cards whose assignment is still `running`;
- * - skips an expired lease, because `recover_stale` may have reassigned that
- *   card to another worker;
- * - picks the most recently seen entry when a session touched several.
- *
- * Session mirrors and archived boards are excluded by the snapshot's default
- * board-kind filter, which is correct: `start_task` never targets them.
- */
 export declare function rebindSessionKanbanTask(context: Context): Promise<{
     boardId: string;
     taskId: string;
 } | null>;
-/**
- * Why session Kanban is unavailable, or undefined while it is healthy.
- *
- * Surfaces exist so a startup path can tell the user their board will not sync
- * without having to catch and classify the failure itself. Cleared on the
- * first hydrate that succeeds, so a daemon that comes back stops being
- * reported as down.
- */
 export declare function sessionKanbanDegradation(): string | undefined;
-/**
- * Project the session's todos, plan, and tasks onto its Kanban board.
- *
- * Kanban is a projection: every card here is derived from state that lives
- * somewhere else and is authoritative there. Losing the board costs the user a
- * view, not any work — so an unreachable Kanban daemon degrades this to `null`
- * rather than propagating.
- *
- * That distinction used to be missing, and it cost an entire session. When a
- * killed daemon left a stale IPC endpoint behind, the connect error thrown
- * here unwound through `setupSession` and killed `wstack` at startup: no
- * prompt, no session, just a socket path in a stack trace — for a board the
- * user had not asked to see. `bindProjectEndpoint` now stops the daemon from
- * wedging in the first place, but the call site must still hold: an optional
- * view may never take down the session it decorates.
- */
 export declare function hydrateSessionKanban(context: Context): Promise<KanbanBoard | null>;
-export interface SessionKanbanSourceUpdate {
-    source: 'todo' | 'task' | 'plan' | null;
-    todos?: TodoItem[] | undefined;
-    tasks?: TaskFile | undefined;
-    plan?: PlanFile | undefined;
-}
-/**
- * Human-readable titles of the unfinished dependencies blocking a card.
- *
- * The board recomputes readiness on every mutation; this only carries the
- * result to the todo surface. Titles rather than ids, because the row is read
- * by a model and a human, neither of whom can resolve a raw card id.
- */
-export declare function blockingTitles(board: KanbanBoard, task: KanbanTask): string[];
-/**
- * Order cards the way they must actually be worked: dependencies first, then
- * priority, then the board's own column/manual order.
- *
- * The managed projection previously sorted by `createdAt` — the moment a card
- * happened to be created — which is unrelated to execution order, so the list
- * the model reads top-to-bottom was not a plan. A dependency-respecting
- * (Kahn) order makes the visible sequence the executable sequence; ties fall
- * back to the deterministic board order so the list never reshuffles on its
- * own. Any card left over by a dependency cycle is appended rather than
- * dropped — the board rejects cycles, but a projection must never lose work.
- */
-export declare function orderTasksForTodos(board: KanbanBoard, tasks: readonly KanbanTask[]): KanbanTask[];
-/**
- * Replace the tactical todo list from the current cards on a session-owned board.
- *
- * Existing mirrored todo cards retain their stable source ids. New cards created
- * by a Kanban worker become todos under their card ids, so reassessment can add,
- * split, merge, reprioritize, or remove work without being overwritten by the
- * todo list that happened to exist when the run started.
- */
 export declare function applySessionKanbanBoardToTodos(context: Context, board: KanbanBoard): TodoItem[];
-/** Project a durable managed board into the session's compact todo surface. */
 export declare function applyManagedKanbanBoardToTodos(context: Context, board: KanbanBoard): TodoItem[];
-/** Reflect a TUI/WebUI Kanban card edit back to its originating work list. */
 export declare function applySessionKanbanTaskToSource(context: Context, task: KanbanTask, options?: {
     remove?: boolean | undefined;
 }): Promise<SessionKanbanSourceUpdate>;