@wrongstack/tools 0.310.1 → 0.313.1

package/dist/chunk-H5OHH6F4.js

@@ -0,0 +1,223 @@
+import {
+  tryLegacyPackageOperation
+} from "./chunk-NHA6BEIH.js";
+import {
+  spawnStream
+} from "./chunk-MAN26PZ5.js";
+import {
+  detectPackageManager,
+  normalizeCommandOutput,
+  safeResolveReal
+} from "./chunk-D33S4RQG.js";
+
+// src/install.ts
+import { join } from "node:path";
+import {
+  detectEcosystem as detectPackageEcosystem,
+  recordPackageAction
+} from "@wrongstack/core/coordination";
+var installTool = {
+  name: "install",
+  category: "Package Management",
+  description: "Install, update or manage packages using the detected package manager (pnpm/npm/yarn). Strongly preferred over raw shell commands for dependency management because it is structured and safer.",
+  usageHint: "ALWAYS USE THIS INSTEAD OF BASH FOR PACKAGE WORK:\n\n- Empty `packages` \u2192 normal `install` (respects lockfile).\n- Provide names \u2192 adds/updates specific packages.\n- `dry_run: true` for safe preview.\n- Set `save` appropriately.\nThis tool has proper capability declaration and is heavily recommended in the security posture of the project.",
+  permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // What gets installed is the subject — installing a package runs its
+  // lifecycle scripts, so `express` and `evil-pkg` must not be interchangeable.
+  subjectKey: "packages",
+  mutating: true,
+  riskTier: "standard",
+  icon: "package",
+  timeoutMs: 12e4,
+  capabilities: ["package.install", "shell.restricted"],
+  inputSchema: {
+    type: "object",
+    properties: {
+      packages: {
+        type: "string",
+        description: "Package(s) to install: single name, comma-separated list, or empty for all deps"
+      },
+      save: {
+        type: "string",
+        enum: ["dependency", "dev", "optional"],
+        description: 'Where to save the package(s): "dependency", "devDependencies", or "optionalDependencies".'
+      },
+      cwd: {
+        type: "string",
+        description: "Working directory for the install command (must stay inside project)."
+      },
+      dry_run: {
+        type: "boolean",
+        description: "If true, show what would be installed without actually modifying package.json or node_modules."
+      },
+      global: {
+        type: "boolean",
+        description: "Whether to perform a global install (use with caution)."
+      },
+      lifecycleScripts: {
+        type: "boolean",
+        description: "Opt in to running package lifecycle scripts (preinstall / install / postinstall / prepare / \u2026). Default: false \u2014 installs pass --ignore-scripts so a malicious package cannot execute arbitrary code at install time. Set true to opt back in to the legacy npm/pnpm/yarn default."
+      }
+    }
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    const executeStream = installTool.executeStream;
+    if (!executeStream) throw new Error("installTool: stream execution unavailable");
+    for await (const ev of executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("install: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
+    if (!input.global) {
+      const pkgList2 = input.packages ? Array.isArray(input.packages) ? input.packages : input.packages.split(",").map((p) => p.trim()) : [];
+      const bridge = await tryLegacyPackageOperation(
+        "package-install",
+        {
+          cwd,
+          projectRoot: ctx.projectRoot,
+          signal: opts.signal
+        },
+        pkgList2
+      );
+      if (bridge?.outcome) {
+        const outcome = bridge.outcome;
+        const run = outcome.run;
+        yield {
+          type: "final",
+          output: {
+            exit_code: run?.exitCode ?? 0,
+            packages: [],
+            output: normalizeCommandOutput(
+              run?.output || outcome.manifestsChanged.join(", ") || "ok"
+            ),
+            truncated: run?.truncated ?? false,
+            dry_run: input.dry_run ?? false
+          }
+        };
+        return;
+      }
+    }
+    const pkgManager = await detectPackageManager(cwd, ctx.projectRoot);
+    yield { type: "log", text: `Resolving with ${pkgManager}\u2026`, data: { phase: "resolve" } };
+    const globalFlag = input.global ? ["-g"] : [];
+    const ignoreScripts = input.lifecycleScripts !== true;
+    const pkgList = input.packages ? (Array.isArray(input.packages) ? input.packages : input.packages.split(",")).map(
+      (p) => p.trim()
+    ) : [];
+    const PKG_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+(?:@[a-z0-9^~><=*.+-]+)?$/i;
+    for (const pkg of pkgList) {
+      if (!PKG_NAME_RE.test(pkg) || pkg.startsWith("-") || pkg.length > 200) {
+        yield {
+          type: "final",
+          output: {
+            packages: pkgList,
+            exit_code: 1,
+            output: `Invalid package name "${pkg}". Names must match ${PKG_NAME_RE} and not start with "-".`,
+            dry_run: Boolean(input.dry_run),
+            truncated: false
+          }
+        };
+        return;
+      }
+    }
+    const hasPkgs = pkgList.length > 0;
+    const args = [];
+    if (input.dry_run) args.push("--dry-run");
+    if (ignoreScripts) args.push("--ignore-scripts");
+    if (pkgManager === "pnpm") {
+      if (hasPkgs) {
+        if (input.save === "dev") args.push("-D");
+        else if (input.save === "optional") args.push("-O");
+        args.push("add", ...globalFlag);
+      } else {
+        args.push("install", ...globalFlag);
+      }
+    } else if (pkgManager === "yarn") {
+      if (hasPkgs) {
+        args.push("add", ...globalFlag);
+        if (input.save === "dev") args.push("--dev");
+        else if (input.save === "optional") args.push("--optional");
+      } else {
+        args.push("install", ...globalFlag);
+      }
+    } else {
+      args.push("install", ...globalFlag);
+      if (hasPkgs) {
+        if (input.save === "dev") args.push("--save-dev");
+        else if (input.save === "optional") args.push("--save-optional");
+      }
+    }
+    if (hasPkgs) args.push(...pkgList);
+    yield {
+      type: "log",
+      text: `Fetching ${pkgList.length || "all"} packages\u2026`,
+      data: { phase: "fetch" }
+    };
+    const result = yield* spawnStream({
+      cmd: pkgManager,
+      args,
+      cwd,
+      signal: opts.signal,
+      maxBytes: 1e5
+    });
+    const output = {
+      packages: pkgList,
+      exit_code: result.exitCode,
+      output: normalizeCommandOutput(result.stdout || result.stderr || result.error || ""),
+      dry_run: args.includes("--dry-run"),
+      truncated: result.truncated
+    };
+    const isSuccess = result.exitCode === 0 && !output.dry_run && !input.global;
+    if (isSuccess && pkgList.length > 0) {
+      const trackerOpts = ctx.meta?.["packageTrackerOpts"];
+      if (trackerOpts) {
+        const manifestPath = resolveManifestPath(cwd, pkgManager);
+        for (const pkg of pkgList) {
+          try {
+            await recordPackageAction(trackerOpts, {
+              manifestPath,
+              packageName: pkg,
+              versionSpec: "latest",
+              // exact version resolved by package manager at install time
+              ecosystem: detectPackageEcosystem(manifestPath),
+              agentId: ctx.agentId,
+              agentName: ctx.agentName,
+              sessionId: ctx.session.id
+            });
+          } catch {
+          }
+        }
+      }
+    }
+    ctx.recordSideEffect?.({
+      toolUseId: `install-${Date.now()}`,
+      toolName: "install",
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      input: { packages: pkgList, cwd, dry_run: Boolean(input.dry_run) },
+      outcome: output.dry_run ? "dry run" : result.exitCode === 0 ? `installed ${pkgList.length || "all"} packages` : `failed (exit ${result.exitCode})`,
+      risk: "package"
+    });
+    yield { type: "final", output };
+  }
+};
+function resolveManifestPath(cwd, pkgManager) {
+  switch (pkgManager) {
+    case "pnpm":
+    case "yarn":
+    case "npm":
+      return join(cwd, "package.json");
+    /* v8 ignore next 2 -- pkgManager is always pnpm/yarn/npm; the default is defensive. */
+    default:
+      return join(cwd, "package.json");
+  }
+}
+
+export {
+  installTool
+};
+//# sourceMappingURL=chunk-H5OHH6F4.js.map

package/dist/chunk-HC5RM4WY.js

@@ -0,0 +1,199 @@
+import {
+  tryLegacyCodeOperation
+} from "./chunk-NHA6BEIH.js";
+import {
+  spawnStream
+} from "./chunk-MAN26PZ5.js";
+import {
+  normalizeCommandOutput,
+  safeResolveReal
+} from "./chunk-D33S4RQG.js";
+
+// src/test.ts
+import * as path from "node:path";
+var testTool = {
+  name: "test",
+  category: "Code Quality",
+  description: "Execute the project's test suite. This is one of the most critical tools for validating that your changes are correct.",
+  usageHint: "ESSENTIAL BEFORE CONSIDERING WORK DONE:\n\n- Use `files` or `grep` to run only relevant tests during development.\n- `coverage: true` is useful when working on critical paths.\nRun tests frequently. A clean test run is usually required before the task can be considered complete.",
+  permission: "confirm",
+  mutating: false,
+  icon: "test",
+  timeoutMs: 12e4,
+  capabilities: ["shell.restricted"],
+  inputSchema: {
+    type: "object",
+    properties: {
+      files: {
+        type: "string",
+        description: 'Test files: single path, comma-separated list, or glob (e.g. "**/*.test.ts")'
+      },
+      runner: {
+        type: "string",
+        enum: ["vitest", "jest", "mocha", "auto"],
+        description: "Test runner (default: auto-detect)"
+      },
+      watch: { type: "boolean", description: "Run in watch mode (default: false)" },
+      coverage: { type: "boolean", description: "Generate coverage report (default: false)" },
+      cwd: { type: "string", description: "Working directory (default: cwd)" },
+      grep: { type: "string", description: "Filter tests by name pattern (default: none)" },
+      timeout: { type: "integer", description: "Test timeout in ms (default: 30000)" },
+      verbose: {
+        type: "boolean",
+        description: "Per-test verbose reporter output (default: false \u2014 the summary reporter is used; full output is always saved to a log file referenced in the result)"
+      }
+    }
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    const executeStream = testTool.executeStream;
+    if (!executeStream) throw new Error("testTool: stream execution unavailable");
+    for await (const ev of executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("test: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
+    const runner = input.runner ?? "auto";
+    if (runner === "auto") {
+      const bridge = await tryLegacyCodeOperation("test", {
+        cwd,
+        projectRoot: ctx.projectRoot,
+        signal: opts.signal
+      });
+      if (bridge?.run) {
+        const run = bridge.run;
+        yield {
+          type: "final",
+          output: {
+            runner: bridge.language,
+            exit_code: run.exitCode ?? 0,
+            tests_run: (run.summary.passed ?? 0) + (run.summary.failed ?? 0),
+            passed: run.summary.passed ?? 0,
+            failed: run.summary.failed ?? 0,
+            duration_ms: run.durationMs,
+            output: normalizeCommandOutput(run.output || run.error || ""),
+            truncated: run.truncated
+          }
+        };
+        return;
+      }
+    }
+    const detected = runner === "auto" ? await detectRunner(cwd) : runner;
+    if (!detected) {
+      yield {
+        type: "final",
+        output: {
+          runner: "none",
+          exit_code: 0,
+          tests_run: 0,
+          passed: 0,
+          failed: 0,
+          duration_ms: 0,
+          output: "No test runner found (vitest.config.ts, jest.config.js, .mocharc.json)",
+          truncated: false
+        }
+      };
+      return;
+    }
+    yield { type: "log", text: `Running ${detected}\u2026`, data: { runner: detected } };
+    const start = Date.now();
+    const args = buildArgs(detected, input);
+    const result = yield* spawnStream({
+      cmd: detected,
+      args,
+      cwd,
+      signal: opts.signal,
+      maxBytes: 2e5
+    });
+    const duration = Date.now() - start;
+    yield { type: "final", output: parseResult(detected, result, duration) };
+  }
+};
+async function detectRunner(cwd) {
+  const { stat } = await import("node:fs/promises");
+  const candidates = ["vitest.config.ts", "jest.config.js", ".mocharc.json"];
+  for (const f of candidates) {
+    try {
+      await stat(path.join(cwd, f));
+      if (f.includes("vitest")) return "vitest";
+      if (f.includes("jest")) return "jest";
+      if (f.includes("mocha")) return "mocha";
+    } catch {
+    }
+  }
+  return null;
+}
+function buildArgs(runner, input) {
+  const args = [];
+  const timeout = input.timeout ?? 3e4;
+  switch (runner) {
+    case "vitest":
+      args.push(input.watch ? "watch" : "run");
+      if (input.verbose) args.push("--reporter=verbose");
+      if (input.coverage) args.push("--coverage");
+      if (input.grep) args.push("--testNamePattern", input.grep);
+      args.push("--testTimeout", String(timeout));
+      break;
+    case "jest":
+      if (input.verbose) args.push("--verbose");
+      if (input.watch) args.push("--watch");
+      if (input.coverage) args.push("--coverage");
+      if (input.grep) args.push("--testPathPattern", input.grep);
+      args.push("--testTimeout", String(timeout));
+      break;
+    case "mocha":
+      args.push("--reporter", "spec");
+      if (input.grep) args.push("--grep", input.grep);
+      args.push("--timeout", String(timeout));
+      break;
+  }
+  if (input.files) {
+    const files = Array.isArray(input.files) ? input.files : input.files.split(",");
+    args.push("--", ...files.map((f) => f.trim()));
+  }
+  return args;
+}
+function parseResult(runner, result, duration) {
+  const out = result.stdout + result.stderr;
+  let tests_run = 0;
+  let passed = 0;
+  let failed = 0;
+  if (runner === "vitest") {
+    const passedMatch = out.match(/(\d+) passed/);
+    const failedMatch = out.match(/(\d+) failed/);
+    if (passedMatch?.[1]) passed = Number.parseInt(passedMatch[1], 10);
+    if (failedMatch?.[1]) failed = Number.parseInt(failedMatch[1], 10);
+    tests_run = passed + failed;
+  } else if (runner === "jest") {
+    const suitesMatch = out.match(/Test Suites:\s+(\d+)\s+total/);
+    const passedMatch = out.match(/Tests:\s+(\d+)\s+passed/);
+    const failedMatch = out.match(/Tests:\s+(\d+)\s+failed/);
+    tests_run = Number.parseInt(suitesMatch?.[1] ?? "0", 10);
+    passed = Number.parseInt(passedMatch?.[1] ?? "0", 10);
+    failed = Number.parseInt(failedMatch?.[1] ?? "0", 10);
+  }
+  return {
+    runner,
+    exit_code: result.exitCode,
+    tests_run,
+    passed,
+    failed,
+    duration_ms: duration,
+    // A passing run only needs the tail summary in chat history — counts are
+    // already parsed above and the FULL log is on disk (spool marker rides
+    // the stdout tail). Failures keep the standard command-output cap so
+    // the agent sees the failure details inline.
+    output: normalizeCommandOutput(result.stdout || result.error || "", {
+      maxBytes: result.exitCode === 0 ? 4096 : void 0
+    }),
+    truncated: result.truncated
+  };
+}
+
+export {
+  testTool
+};
+//# sourceMappingURL=chunk-HC5RM4WY.js.map

package/dist/chunk-HEQFMLZ7.js

@@ -0,0 +1,190 @@
+import {
+  tryLegacyPackageOperation
+} from "./chunk-NHA6BEIH.js";
+import {
+  spawnStream
+} from "./chunk-MAN26PZ5.js";
+import {
+  COMMAND_OUTPUT_MAX_BYTES,
+  detectPackageManager,
+  normalizeCommandOutput,
+  safeResolveReal
+} from "./chunk-D33S4RQG.js";
+
+// src/audit.ts
+var SEVERITY_RANK = {
+  info: 0,
+  low: 1,
+  moderate: 2,
+  high: 3,
+  critical: 4
+};
+var auditTool = {
+  name: "audit",
+  category: "Package Management",
+  description: "Run a security audit against project dependencies (using pnpm/npm audit). Reports known vulnerabilities with severity.",
+  usageHint: "CRITICAL SECURITY TOOL:\n\n- Run regularly and especially before any release.\n- Use `level` to focus on high/critical issues.\n- This tool is read-only: to remediate, use `install` (or `language_package`) to upgrade the affected packages.\nThis is one of the most important tools for supply chain security.",
+  permission: "confirm",
+  mutating: false,
+  capabilities: ["shell.restricted"],
+  icon: "package",
+  timeoutMs: 6e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      cwd: { type: "string", description: "Working directory (default: cwd)" },
+      level: {
+        type: "string",
+        enum: ["low", "moderate", "high", "critical"],
+        description: "Minimum severity level to report"
+      },
+      fix: {
+        type: "boolean",
+        description: "Deprecated and rejected \u2014 this tool is read-only and never modifies dependencies. Use `install` (or `language_package`) to remediate vulnerabilities."
+      }
+    }
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    const executeStream = auditTool.executeStream;
+    if (!executeStream) throw new Error("auditTool: stream execution unavailable");
+    for await (const ev of executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("audit: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    if (input.fix === true) {
+      throw new Error(
+        "audit: `fix: true` is not supported \u2014 this tool is read-only (mutating: false). To remediate vulnerabilities, upgrade the affected packages with the `install` tool (or `language_package` for non-JS ecosystems)."
+      );
+    }
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
+    const bridge = await tryLegacyPackageOperation("package-audit", {
+      cwd,
+      projectRoot: ctx.projectRoot,
+      signal: opts.signal
+    });
+    if (bridge?.outcome) {
+      const outcome = bridge.outcome;
+      const vulns = outcome.vulnerabilities.map((v) => ({
+        severity: v.severity,
+        package: v.package,
+        title: v.advisory ?? "Unknown vulnerability",
+        url: v.url ?? ""
+      }));
+      const total = vulns.length;
+      const summary = total === 0 ? "No vulnerabilities found" : `Found ${total} vulnerabilities: ${vulns.filter((a) => a.severity === "critical").length} critical, ${vulns.filter((a) => a.severity === "high").length} high`;
+      yield {
+        type: "final",
+        output: {
+          exit_code: outcome.run?.exitCode ?? 0,
+          vulnerabilities: vulns,
+          total,
+          summary,
+          output: outcome.run?.output ?? "",
+          truncated: outcome.run?.truncated ?? false
+        }
+      };
+      return;
+    }
+    const manager = await detectPackageManager(cwd, ctx.projectRoot);
+    yield { type: "log", text: `Auditing with ${manager}\u2026`, data: { manager } };
+    const args = ["audit", "--json"];
+    if (input.level && (manager === "npm" || manager === "pnpm")) {
+      args.push(`--audit-level=${input.level}`);
+    }
+    const result = yield* spawnStream({
+      cmd: manager,
+      args,
+      cwd,
+      signal: opts.signal,
+      maxBytes: 1e5
+    });
+    yield {
+      type: "final",
+      output: parseAuditOutput(result.stdout, result.exitCode, {
+        level: input.level,
+        spawnTruncated: result.truncated
+      })
+    };
+  }
+};
+function parseAuditOutput(json, exitCode, opts = {}) {
+  if (!json) {
+    return {
+      exit_code: exitCode,
+      vulnerabilities: [],
+      total: 0,
+      summary: exitCode === 0 ? "No vulnerabilities found" : "Audit failed",
+      output: "",
+      truncated: false
+    };
+  }
+  const cappedOutput = normalizeCommandOutput(json);
+  const truncated = opts.spawnTruncated === true || Buffer.byteLength(json, "utf8") > COMMAND_OUTPUT_MAX_BYTES;
+  try {
+    const data = JSON.parse(json);
+    let advisories = extractAdvisories(data);
+    const minRank = opts.level ? SEVERITY_RANK[opts.level] ?? 0 : 0;
+    if (minRank > 0) {
+      advisories = advisories.filter((a) => (SEVERITY_RANK[a.severity] ?? 0) >= minRank);
+    }
+    const total = advisories.length;
+    const summary = total === 0 ? "No vulnerabilities found" : `Found ${total} vulnerabilities: ${advisories.filter((a) => a.severity === "critical").length} critical, ${advisories.filter((a) => a.severity === "high").length} high`;
+    return {
+      exit_code: exitCode,
+      vulnerabilities: advisories,
+      total,
+      summary,
+      output: cappedOutput,
+      truncated
+    };
+  } catch {
+    return {
+      exit_code: exitCode,
+      vulnerabilities: [],
+      total: 0,
+      summary: "Could not parse audit output",
+      output: cappedOutput,
+      truncated
+    };
+  }
+}
+function extractAdvisories(data) {
+  const advisories = [];
+  const ads = data["advisories"];
+  if (ads && typeof ads === "object") {
+    for (const [id, value] of Object.entries(ads)) {
+      const adv = value ?? {};
+      advisories.push({
+        severity: typeof adv["severity"] === "string" ? adv["severity"] : "unknown",
+        package: typeof adv["module_name"] === "string" ? adv["module_name"] : id,
+        title: typeof adv["title"] === "string" ? adv["title"] : "Unknown vulnerability",
+        url: typeof adv["url"] === "string" ? adv["url"] : ""
+      });
+    }
+    return advisories;
+  }
+  const vulns = data["vulnerabilities"];
+  if (vulns && typeof vulns === "object") {
+    for (const [pkg, value] of Object.entries(vulns)) {
+      const vuln = value ?? {};
+      const via = Array.isArray(vuln["via"]) ? vuln["via"] : [];
+      const detail = via.find((v) => !!v && typeof v === "object");
+      advisories.push({
+        severity: typeof vuln["severity"] === "string" ? vuln["severity"] : "unknown",
+        package: pkg,
+        title: detail && typeof detail["title"] === "string" ? detail["title"] : "Unknown vulnerability",
+        url: detail && typeof detail["url"] === "string" ? detail["url"] : ""
+      });
+    }
+  }
+  return advisories;
+}
+
+export {
+  auditTool
+};
+//# sourceMappingURL=chunk-HEQFMLZ7.js.map