@wrongstack/tools 0.309.1 → 0.310.1

package/dist/_regex.d.ts

@@ -1,39 +1,11 @@
 /**
  * Compile a user-supplied regex with conservative bounds against ReDoS.
  *
- * Node's regex engine (V8) is backtracking-based and cannot interrupt a
- * synchronous match — a pattern like `(a+)+$` against a sufficiently long
- * line will pin a worker for seconds. The executor's outer `timeoutMs` only
- * fires between async boundaries, so a long regex eval inside a sync loop
- * is uninterruptible.
- *
- * We can't fully prevent ReDoS without an alternative engine (re2-wasm), but
- * we can sharply limit the blast radius:
- *
- *  1. Cap pattern length — practically all legitimate user patterns are
- *     under 256 characters. A 4 KB pattern is almost certainly malicious
- *     or a copy-paste accident.
- *  2. Reject patterns containing the most obvious super-linear structures.
- *     This is a coarse filter (false-positives are likely; we accept that
- *     for hostile-input contexts).
- *
- * Callers should additionally bound the *subject* length (e.g. by capping
- * line size before matching).
- */
-export interface CompileResult {
-    ok: true;
-    regex: RegExp;
-}
-export interface CompileFail {
-    ok: false;
-    reason: string;
-}
-export declare function compileUserRegex(pattern: string, flags: string): CompileResult | CompileFail;
-/**
- * Truncate a subject line to a safe length for synchronous regex eval.
- * The cap is conservative; tools that need exact-line matching against very
- * long lines should use ripgrep externally rather than the native walker.
+ * Canonical home since card #5: `@wrongstack/primitives/src/regex-guard.ts`.
+ * This module is now a re-export shim kept for its four importers
+ * (grep.ts, json.ts, logs.ts, replace.ts); `tools/tests/regex-guard-parity.test.ts`
+ * still pins the three historical entry points to identical verdicts —
+ * now trivially true, because all three resolve to the same code path.
  */
-export declare const MAX_SUBJECT_LEN: number;
-export declare function capSubject(line: string): string;
+export { type CompileFail, type CompileResult, capSubject, compileUserRegex, MAX_SUBJECT_LEN, } from '@wrongstack/primitives';
 //# sourceMappingURL=_regex.d.ts.map

package/dist/bash.js

@@ -1826,10 +1826,10 @@ function resolvePowerShell(cmd) {
   if (lower !== "pwsh" && lower !== "powershell" && lower !== "pwsh.exe" && lower !== "powershell.exe") {
     return resolveWin32Command(cmd);
   }
-  const primary = lower.startsWith("pwsh") ? "pwsh.exe" : "powershell.exe";
-  const fallback = lower.startsWith("pwsh") ? "powershell.exe" : "pwsh.exe";
+  const primary = lower.startsWith("pwsh") ? "pwsh" : "powershell";
+  const fallback = lower.startsWith("pwsh") ? "powershell" : "pwsh";
   const resolved = resolveWin32Command(primary);
-  if (resolved !== primary) {
+  if (resolved === primary) {
     const fb = resolveWin32Command(fallback);
     return fb === fallback ? cmd : fb;
   }

package/dist/builtin.d.ts

@@ -18,25 +18,28 @@ export declare const OPTIONAL_TOOLS: Tool[];
 export declare const OFF_ONLY_TOOLS: Tool[];
 /**
  * Tier 1 (Token Saving) tool set — the absolute minimum for useful work.
- * 15 tools covering core file ops, indexed project discovery, shell, search,
- * and utilities. Codebase index lifecycle tools stay available at every tier
- * so token saving does not force broad filesystem scans.
- * Saves ~3500-5500 tokens vs full mode by omitting specialized schemas from
- * direct provider exposure; hosts may retain those tools in a lazy catalog.
+ * 23 tools covering core file ops, indexed project discovery, structured
+ * edits, shell, search, and utilities. Codebase index lifecycle tools stay
+ * available at every tier so token saving does not force broad filesystem
+ * scans. Saves ~3500-5500 tokens vs full mode by omitting specialized
+ * schemas from direct provider exposure; hosts may retain those tools in a
+ * lazy catalog.
  *
  * Tier 1 tools:
- *   read, write, edit                         — file operations
- *   codebase-stats, codebase-search/index     — indexed project discovery
- *   bash, grep, glob                          — shell + exact/path fallback
- *   diff, patch, json                         — utility
- *   search                                   — web research
+ *   read, write, edit, clarify                 — file operations
+ *   codebase-stats/search/index/skeleton/repo-map/impact/targeted-test/
+ *   incoming-calls/outgoing-calls/ast-replace/invariant-check,
+ *   security-ast-scan                          — indexed project discovery
+ *   bash, grep, glob                           — shell + exact/path fallback
+ *   diff, patch, json                          — utility
+ *   search                                     — web research
  */
 export declare const TIER1_TOOLS: Tool[];
 /**
  * Tier 2 tool set — standard development tools useful for non-trivial work.
- * Adds 19 tools: replace, exec, fetch, git, tree, lint, format, typecheck,
- * test, languageInfo, language, languagePackage, todo, plan, kanban, task,
- * install, audit, design.
+ * Adds 20 tools: replace, exec, pwsh, fetch, git, tree, lint, format,
+ * typecheck, test, languageInfo, language, languagePackage, todo, plan,
+ * kanban, task, install, audit, design.
  *
  * These tools are used regularly during development but are not essential for
  * every turn. Omitting them in minimal/light tier saves ~900 tokens per prompt.
@@ -44,7 +47,7 @@ export declare const TIER1_TOOLS: Tool[];
 export declare const TIER2_TOOLS: Tool[];
 /**
  * Tier 3 tool set — specialized, administrative, and exploratory tools.
- * Adds 12 tools: outdated, logs, document, scaffold, dead-code-scan,
+ * Adds 10 tools: outdated, logs, document, scaffold, dead-code-scan,
  * tool-search, tool-use, batch-tool-use, tool-help, set-working-dir.
  *
  * These tools are situational (e.g. documentation generation, scaffolding,