@wrongstack/tools 0.313.0 → 0.313.1

package/dist/chunk-2CTB3UK5.js

@@ -0,0 +1,197 @@
+import {
+  buildWin32CmdShimInvocation,
+  resolveWin32Command
+} from "./chunk-V43EQ6VR.js";
+import {
+  COMMAND_OUTPUT_MAX_BYTES,
+  detectPackageManager,
+  normalizeCommandOutput,
+  safeResolveReal
+} from "./chunk-D33S4RQG.js";
+
+// src/outdated.ts
+import { spawn } from "node:child_process";
+import { buildChildEnv } from "@wrongstack/core/utils";
+var outdatedTool = {
+  name: "outdated",
+  category: "Package Management",
+  description: "Check for outdated dependencies in the project. Reports current, wanted (semver range), and latest versions available.",
+  usageHint: "MAINTENANCE & SECURITY TOOL:\n\n- Run periodically or before dependency-related work.\n- Helps surface packages that may need updates for security or features.\n- Hits the package registry over HTTP, so it is NOT purely local \u2014 flagged as mutating for the confirmation gate.\nUse the output to decide on upgrades. Prefer this over manual shell commands for dependency hygiene.",
+  permission: "confirm",
+  icon: "package",
+  // Network side-effecting (registry HTTP). Pairs with `mutating: true`
+  // so the H7 invariant test (`no auto-permission tool declares
+  // mutating: true`) passes — a tool claiming `'auto'` must be purely
+  // read-only, but `outdated` makes outbound HTTP calls to the
+  // registry. The 'confirm' permission routes the call through the
+  // tool.confirm_needed flow on every invocation. M-1 originally
+  // fixed four sibling tools (mcp_control, shellcheck, shellcheck (scan mode),
+  // search) but missed this one; applying the same contract here.
+  // WS-046: gives permission decisions something to key on.
+  // The working directory scanned.
+  subjectKey: "cwd",
+  mutating: true,
+  // Capability is outbound network — the tool only hits the package
+  // registry over HTTP, never touches the filesystem or runs shell.
+  // Use the canonical `net.outbound` capability (not the non-existent
+  // `network` string) so the subagent allowlist recognises it and
+  // permits read-only registry lookups under a director.
+  // The H7 invariant test requires this array to be non-empty for
+  // any mutating:true tool (meta-tools whitelisted). See
+  // tests/permission-mutating-invariant.test.ts:92.
+  capabilities: ["net.outbound"],
+  timeoutMs: 6e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      cwd: { type: "string", description: "Working directory (default: cwd)" }
+    }
+  },
+  async execute(input, ctx, opts) {
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
+    const manager = await detectPackageManager(cwd, ctx.projectRoot);
+    if (manager === "npm") {
+      try {
+        const { detectNonJsEcosystem } = await import("./legacy-bridge-7UKZT46G.js");
+        const nonJs = await detectNonJsEcosystem(cwd, ctx.projectRoot);
+        if (nonJs) {
+          const { planLanguageOperation, executePackagePlan } = await import("./languages/index.js");
+          const planResult = await planLanguageOperation({
+            projectRoot: ctx.projectRoot,
+            cwd,
+            operation: "package-outdated",
+            language: nonJs,
+            signal: opts.signal
+          });
+          if (planResult.status === "planned") {
+            const runner = executePackagePlan({
+              projectRoot: ctx.projectRoot,
+              workspace: planResult.workspace,
+              plan: planResult.plan,
+              packages: [],
+              signal: opts.signal
+            });
+            let outcome = null;
+            for (; ; ) {
+              const next = await runner.next();
+              if (next.done) {
+                outcome = next.value;
+                break;
+              }
+            }
+            if (outcome) {
+              const packages = outcome.outdated.map((o) => ({
+                name: o.name,
+                current: o.previous ?? "unknown",
+                latest: o.resolved ?? "unknown",
+                wanted: o.requested ?? o.resolved ?? "unknown",
+                type: "unknown",
+                location: o.name
+              }));
+              return {
+                exit_code: outcome.run?.exitCode ?? 0,
+                packages,
+                total: packages.length,
+                output: outcome.run?.output ?? (packages.length === 0 ? "All packages up to date" : ""),
+                truncated: outcome.run?.truncated ?? false
+              };
+            }
+          }
+        }
+      } catch {
+      }
+    }
+    const args = ["outdated", "--json"];
+    return runOutdated(manager, args, cwd, opts.signal);
+  }
+};
+function runOutdated(manager, args, cwd, signal) {
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    const MAX = 1e5;
+    const resolved = resolveWin32Command(manager);
+    const needsShell = process.platform === "win32" && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
+    const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
+    const spawnCmd = shim?.command ?? resolved;
+    const spawnArgs = shim?.args ?? args;
+    const child = spawn(spawnCmd, spawnArgs, {
+      cwd,
+      signal,
+      env: buildChildEnv(),
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+      ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
+    });
+    child.stdout?.on("data", (c) => {
+      if (stdout.length < MAX) stdout += c.toString();
+    });
+    child.stderr?.on("data", (c) => {
+      if (stderr.length < MAX) stderr += c.toString();
+    });
+    child.on("close", (code) => {
+      const result = parseOutdatedOutput(stdout, code ?? 0);
+      resolve(result);
+    });
+    child.on("error", (e) => {
+      resolve({
+        exit_code: 1,
+        packages: [],
+        total: 0,
+        output: e.message,
+        truncated: false
+      });
+    });
+  });
+}
+function parseOutdatedOutput(json, exitCode) {
+  const packages = [];
+  if (!json) {
+    return {
+      exit_code: exitCode,
+      packages: [],
+      total: 0,
+      output: exitCode === 0 ? "All packages up to date" : "Could not check outdated packages",
+      truncated: false
+    };
+  }
+  const truncated = json.length >= 1e5 || Buffer.byteLength(json, "utf8") > COMMAND_OUTPUT_MAX_BYTES;
+  let parsedOk = false;
+  try {
+    const data = JSON.parse(json);
+    parsedOk = true;
+    for (const name of Object.keys(data)) {
+      const info = data[name] ?? {};
+      const str = (v) => typeof v === "string" ? v : void 0;
+      packages.push({
+        name,
+        current: str(info["current"]) ?? "unknown",
+        latest: str(info["latest"]) ?? "unknown",
+        wanted: str(info["wanted"]) ?? "unknown",
+        // npm calls it `type`; pnpm calls it `dependencyType`.
+        type: str(info["type"]) ?? str(info["dependencyType"]) ?? "unknown",
+        location: str(info["location"]) ?? name
+      });
+    }
+  } catch {
+  }
+  const outdatedFound = parsedOk && exitCode === 1;
+  let output = normalizeCommandOutput(json);
+  if (outdatedFound) {
+    output = `${output}
+
+Note: exit code 1 from \`outdated\` means outdated packages were found (expected); treated as success.`;
+  }
+  return {
+    exit_code: outdatedFound ? 0 : exitCode,
+    packages,
+    total: packages.length,
+    output,
+    truncated
+  };
+}
+
+export {
+  outdatedTool
+};
+//# sourceMappingURL=chunk-2CTB3UK5.js.map