@wrongstack/tools 0.313.0 → 0.316.1

package/dist/chunk-LIJQMYYX.js

@@ -0,0 +1,59 @@
+// src/codebase-index/gitignore.ts
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { compileGlob } from "@wrongstack/core/utils";
+function globBody(glob) {
+  return compileGlob(glob).source.replace(/^\^/, "").replace(/\$$/, "");
+}
+function compileGitignore(lines) {
+  const rules = [];
+  for (const raw of lines) {
+    let line = raw.replace(/\r$/, "");
+    if (!line.trim() || line.trimStart().startsWith("#")) continue;
+    line = line.trim();
+    let negated = false;
+    if (line.startsWith("!")) {
+      negated = true;
+      line = line.slice(1);
+    }
+    let dirOnly = false;
+    if (line.endsWith("/")) {
+      dirOnly = true;
+      line = line.slice(0, -1);
+    }
+    if (!line) continue;
+    const anchored = line.startsWith("/") || line.includes("/");
+    if (line.startsWith("/")) line = line.slice(1);
+    const body = globBody(line);
+    const prefix = anchored ? "^" : "(?:^|.*/)";
+    rules.push({
+      eqOrUnder: new RegExp(`${prefix}${body}(?:/.*)?$`),
+      under: new RegExp(`${prefix}${body}/.*$`),
+      negated,
+      dirOnly
+    });
+  }
+  return (relPath, isDir) => {
+    const p = relPath.replace(/\\/g, "/").replace(/^\/+/, "");
+    let ignored = false;
+    for (const r of rules) {
+      const re = r.dirOnly && !isDir ? r.under : r.eqOrUnder;
+      if (re.test(p)) ignored = !r.negated;
+    }
+    return ignored;
+  };
+}
+async function loadGitignoreMatcher(projectRoot) {
+  let lines = [];
+  try {
+    const raw = await fs.readFile(path.join(projectRoot, ".gitignore"), "utf8");
+    lines = raw.split("\n");
+  } catch {
+  }
+  return compileGitignore(lines);
+}
+
+export {
+  loadGitignoreMatcher
+};
+//# sourceMappingURL=chunk-LIJQMYYX.js.map

package/dist/chunk-LWKUTMD5.js

@@ -0,0 +1,197 @@
+import {
+  buildWin32CmdShimInvocation,
+  resolveWin32Command
+} from "./chunk-V43EQ6VR.js";
+import {
+  COMMAND_OUTPUT_MAX_BYTES,
+  detectPackageManager,
+  normalizeCommandOutput,
+  safeResolveReal
+} from "./chunk-D33S4RQG.js";
+
+// src/outdated.ts
+import { spawn } from "node:child_process";
+import { buildChildEnv } from "@wrongstack/core/utils";
+var outdatedTool = {
+  name: "outdated",
+  category: "Package Management",
+  description: "Check for outdated dependencies in the project. Reports current, wanted (semver range), and latest versions available.",
+  usageHint: "MAINTENANCE & SECURITY TOOL:\n\n- Run periodically or before dependency-related work.\n- Helps surface packages that may need updates for security or features.\n- Hits the package registry over HTTP, so it is NOT purely local \u2014 flagged as mutating for the confirmation gate.\nUse the output to decide on upgrades. Prefer this over manual shell commands for dependency hygiene.",
+  permission: "confirm",
+  icon: "package",
+  // Network side-effecting (registry HTTP). Pairs with `mutating: true`
+  // so the H7 invariant test (`no auto-permission tool declares
+  // mutating: true`) passes — a tool claiming `'auto'` must be purely
+  // read-only, but `outdated` makes outbound HTTP calls to the
+  // registry. The 'confirm' permission routes the call through the
+  // tool.confirm_needed flow on every invocation. M-1 originally
+  // fixed four sibling tools (mcp_control, shellcheck, shellcheck (scan mode),
+  // search) but missed this one; applying the same contract here.
+  // WS-046: gives permission decisions something to key on.
+  // The working directory scanned.
+  subjectKey: "cwd",
+  mutating: true,
+  // Capability is outbound network — the tool only hits the package
+  // registry over HTTP, never touches the filesystem or runs shell.
+  // Use the canonical `net.outbound` capability (not the non-existent
+  // `network` string) so the subagent allowlist recognises it and
+  // permits read-only registry lookups under a director.
+  // The H7 invariant test requires this array to be non-empty for
+  // any mutating:true tool (meta-tools whitelisted). See
+  // tests/permission-mutating-invariant.test.ts:92.
+  capabilities: ["net.outbound"],
+  timeoutMs: 6e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      cwd: { type: "string", description: "Working directory (default: cwd)" }
+    }
+  },
+  async execute(input, ctx, opts) {
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
+    const manager = await detectPackageManager(cwd, ctx.projectRoot);
+    if (manager === "npm") {
+      try {
+        const { detectNonJsEcosystem } = await import("./legacy-bridge-7M6QLUQN.js");
+        const nonJs = await detectNonJsEcosystem(cwd, ctx.projectRoot);
+        if (nonJs) {
+          const { planLanguageOperation, executePackagePlan } = await import("./languages/index.js");
+          const planResult = await planLanguageOperation({
+            projectRoot: ctx.projectRoot,
+            cwd,
+            operation: "package-outdated",
+            language: nonJs,
+            signal: opts.signal
+          });
+          if (planResult.status === "planned") {
+            const runner = executePackagePlan({
+              projectRoot: ctx.projectRoot,
+              workspace: planResult.workspace,
+              plan: planResult.plan,
+              packages: [],
+              signal: opts.signal
+            });
+            let outcome = null;
+            for (; ; ) {
+              const next = await runner.next();
+              if (next.done) {
+                outcome = next.value;
+                break;
+              }
+            }
+            if (outcome) {
+              const packages = outcome.outdated.map((o) => ({
+                name: o.name,
+                current: o.previous ?? "unknown",
+                latest: o.resolved ?? "unknown",
+                wanted: o.requested ?? o.resolved ?? "unknown",
+                type: "unknown",
+                location: o.name
+              }));
+              return {
+                exit_code: outcome.run?.exitCode ?? 0,
+                packages,
+                total: packages.length,
+                output: outcome.run?.output ?? (packages.length === 0 ? "All packages up to date" : ""),
+                truncated: outcome.run?.truncated ?? false
+              };
+            }
+          }
+        }
+      } catch {
+      }
+    }
+    const args = ["outdated", "--json"];
+    return runOutdated(manager, args, cwd, opts.signal);
+  }
+};
+function runOutdated(manager, args, cwd, signal) {
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    const MAX = 1e5;
+    const resolved = resolveWin32Command(manager);
+    const needsShell = process.platform === "win32" && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
+    const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
+    const spawnCmd = shim?.command ?? resolved;
+    const spawnArgs = shim?.args ?? args;
+    const child = spawn(spawnCmd, spawnArgs, {
+      cwd,
+      signal,
+      env: buildChildEnv(),
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+      ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
+    });
+    child.stdout?.on("data", (c) => {
+      if (stdout.length < MAX) stdout += c.toString();
+    });
+    child.stderr?.on("data", (c) => {
+      if (stderr.length < MAX) stderr += c.toString();
+    });
+    child.on("close", (code) => {
+      const result = parseOutdatedOutput(stdout, code ?? 0);
+      resolve(result);
+    });
+    child.on("error", (e) => {
+      resolve({
+        exit_code: 1,
+        packages: [],
+        total: 0,
+        output: e.message,
+        truncated: false
+      });
+    });
+  });
+}
+function parseOutdatedOutput(json, exitCode) {
+  const packages = [];
+  if (!json) {
+    return {
+      exit_code: exitCode,
+      packages: [],
+      total: 0,
+      output: exitCode === 0 ? "All packages up to date" : "Could not check outdated packages",
+      truncated: false
+    };
+  }
+  const truncated = json.length >= 1e5 || Buffer.byteLength(json, "utf8") > COMMAND_OUTPUT_MAX_BYTES;
+  let parsedOk = false;
+  try {
+    const data = JSON.parse(json);
+    parsedOk = true;
+    for (const name of Object.keys(data)) {
+      const info = data[name] ?? {};
+      const str = (v) => typeof v === "string" ? v : void 0;
+      packages.push({
+        name,
+        current: str(info["current"]) ?? "unknown",
+        latest: str(info["latest"]) ?? "unknown",
+        wanted: str(info["wanted"]) ?? "unknown",
+        // npm calls it `type`; pnpm calls it `dependencyType`.
+        type: str(info["type"]) ?? str(info["dependencyType"]) ?? "unknown",
+        location: str(info["location"]) ?? name
+      });
+    }
+  } catch {
+  }
+  const outdatedFound = parsedOk && exitCode === 1;
+  let output = normalizeCommandOutput(json);
+  if (outdatedFound) {
+    output = `${output}
+
+Note: exit code 1 from \`outdated\` means outdated packages were found (expected); treated as success.`;
+  }
+  return {
+    exit_code: outdatedFound ? 0 : exitCode,
+    packages,
+    total: packages.length,
+    output,
+    truncated
+  };
+}
+
+export {
+  outdatedTool
+};
+//# sourceMappingURL=chunk-LWKUTMD5.js.map

package/dist/chunk-MQX2KXVW.js

@@ -0,0 +1,54 @@
+import {
+  builtinToolsPack
+} from "./chunk-I64BS3VC.js";
+import {
+  TIER1_TOOLS,
+  TIER2_TOOLS
+} from "./chunk-VXECAJJ7.js";
+
+// src/tool-tier.ts
+function toolNameSet(tools) {
+  return new Set(tools.flatMap((tool) => tool ? [tool.name] : []));
+}
+var BUILTIN_TIER_COUNTS = {
+  off: builtinToolsPack.tools?.length ?? 0,
+  minimal: TIER1_TOOLS.length,
+  light: TIER1_TOOLS.length,
+  medium: TIER1_TOOLS.length + TIER2_TOOLS.length,
+  aggressive: TIER1_TOOLS.length
+};
+function selectBuiltinToolsForTier(tier, allTools) {
+  switch (tier) {
+    case "off":
+      return [...allTools];
+    case "minimal":
+    case "light": {
+      const tier1Names = toolNameSet(TIER1_TOOLS);
+      return allTools.filter((tool) => tier1Names.has(tool.name));
+    }
+    case "medium": {
+      const tier1Names = toolNameSet(TIER1_TOOLS);
+      const tier2Names = toolNameSet(TIER2_TOOLS);
+      return allTools.filter((tool) => tier1Names.has(tool.name) || tier2Names.has(tool.name));
+    }
+    case "aggressive": {
+      const tier1Names = toolNameSet(TIER1_TOOLS);
+      return allTools.filter((tool) => tier1Names.has(tool.name));
+    }
+  }
+}
+function registerBuiltinToolTier(options) {
+  const tools = selectBuiltinToolsForTier(
+    options.tier,
+    options.tools ?? builtinToolsPack.tools ?? []
+  );
+  options.registry.registerAllOrThrow(tools, options.owner ?? builtinToolsPack.name);
+  return tools;
+}
+
+export {
+  BUILTIN_TIER_COUNTS,
+  selectBuiltinToolsForTier,
+  registerBuiltinToolTier
+};
+//# sourceMappingURL=chunk-MQX2KXVW.js.map

package/dist/chunk-MZZN7VCD.js

@@ -0,0 +1,359 @@
+import {
+  compileUserRegex
+} from "./chunk-Q5JPPCZC.js";
+import {
+  enqueueReindex
+} from "./chunk-HYX2TZ7O.js";
+import {
+  isBinaryBuffer,
+  safeResolveReal,
+  sha256hex,
+  truncateDiffPayload
+} from "./chunk-D33S4RQG.js";
+
+// src/replace.ts
+import { spawn } from "node:child_process";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { ToolValidationError } from "@wrongstack/core/types";
+import {
+  atomicWrite,
+  buildChildEnv,
+  compileGlob,
+  detectNewlineStyle,
+  expectDefined,
+  normalizeToLf,
+  toStyle,
+  unifiedDiff
+} from "@wrongstack/core/utils";
+var MAX_DIFF_BYTES = 262144;
+var DEFAULT_IGNORE = ["node_modules", ".git", "dist", "build", ".next", "coverage"];
+var replaceTool = {
+  name: "replace",
+  category: "Transform",
+  description: "Perform a search-and-replace across multiple files using a regex pattern. This is a powerful bulk transformation tool. Dry-run is ON by default \u2014 set `dry_run: false` to apply changes.",
+  usageHint: "DANGEROUS IF USED CARELESSLY \u2014 review the diff output carefully.\n\nRecommended workflow:\n1. Run without `dry_run: false` first to see exactly what would change (dry-run is the default).\n2. Review the diff output, then re-run with `dry_run: false` to apply.\n3. Use a specific enough `pattern` (and `glob` / `files`) to avoid accidental broad changes.\n4. `replace_all` controls whether only the first match per file or all matches are replaced.\n5. `replacement` supports regex substitutions: `$1`\u2013`$9` insert capture groups, `$&` inserts the whole match, and `$$` inserts a literal dollar sign.\nThis tool is excellent for large-scale refactors (renaming, import updates, etc.) but must be used with caution.",
+  permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // The file scope being rewritten, not the pattern: a trust rule should say
+  // where a bulk replace may run.
+  subjectKey: "files",
+  mutating: true,
+  capabilities: ["fs.write"],
+  icon: "edit",
+  timeoutMs: 3e4,
+  maxOutputBytes: 262144,
+  inputSchema: {
+    type: "object",
+    properties: {
+      pattern: { type: "string", description: "Regex pattern to match" },
+      replacement: {
+        type: "string",
+        description: "Replacement string. Supports `$1`\u2013`$9` (capture groups), `$&` (whole match), and `$$` (literal dollar sign) \u2014 same semantics as JavaScript String.replace."
+      },
+      files: {
+        type: "string",
+        description: "File(s) to target: single path, comma-separated list, or glob pattern"
+      },
+      glob: { type: "string", description: 'Additional glob filter (e.g. "*.ts")' },
+      replace_all: {
+        type: "boolean",
+        description: "Replace all occurrences in each file (default: true)"
+      },
+      dry_run: { type: "boolean", description: "Preview changes without writing (default: true)" }
+    },
+    required: ["pattern", "replacement", "files"]
+  },
+  async execute(input, ctx) {
+    if (!input?.pattern) {
+      throw new ToolValidationError({
+        message: "replace: pattern is required",
+        field: "pattern"
+      });
+    }
+    if (input.replacement === void 0) {
+      throw new ToolValidationError({
+        message: "replace: replacement is required",
+        field: "replacement"
+      });
+    }
+    if (!input?.files) {
+      throw new ToolValidationError({
+        message: "replace: files is required",
+        field: "files"
+      });
+    }
+    const replaceAll = input.replace_all ?? true;
+    const compiled = compileUserRegex(input.pattern, "g");
+    if (!compiled.ok) {
+      throw new ToolValidationError({
+        message: `replace: ${compiled.reason}`,
+        field: "pattern"
+      });
+    }
+    const re = compiled.regex;
+    const globRe = input.glob ? compileGlob(input.glob) : null;
+    const dryRun = input.dry_run ?? true;
+    const filesInput = Array.isArray(input.files) ? input.files.join(",") : input.files;
+    const fileList = await resolveFiles(filesInput, ctx, globRe);
+    const realRoot = await fs.realpath(ctx.projectRoot).catch(() => ctx.projectRoot);
+    const results = [];
+    let totalReplacements = 0;
+    let diffBytesUsed = 0;
+    let diffsOmitted = 0;
+    let diffsTruncated = 0;
+    for (const absPath of fileList) {
+      const lstat2 = await fs.lstat(absPath).catch((err) => {
+        if (err.code === "ENOENT") return null;
+        throw err;
+      });
+      if (!lstat2?.isFile()) continue;
+      if (lstat2.isSymbolicLink()) continue;
+      let realPath;
+      try {
+        realPath = await fs.realpath(absPath);
+      } catch {
+        continue;
+      }
+      const rel = path.relative(realRoot, realPath);
+      if (rel.startsWith("..") || path.isAbsolute(rel)) continue;
+      const stat2 = await fs.stat(realPath).catch(() => null);
+      if (!stat2?.isFile()) continue;
+      let content;
+      try {
+        const buf = await fs.readFile(realPath);
+        if (isBinaryBuffer(buf)) continue;
+        content = buf.toString("utf8");
+      } catch {
+        continue;
+      }
+      const style = detectNewlineStyle(content);
+      const contentLf = normalizeToLf(content);
+      re.lastIndex = 0;
+      const allMatches = [...contentLf.matchAll(re)];
+      if (allMatches.length === 0) continue;
+      const matches = replaceAll ? allMatches : allMatches.slice(0, 1);
+      const count = matches.length;
+      let newContentLf = contentLf;
+      for (let i = matches.length - 1; i >= 0; i--) {
+        const m = expectDefined(matches[i]);
+        newContentLf = newContentLf.slice(0, m.index) + expandReplacement(input.replacement, m) + newContentLf.slice(expectDefined(m.index) + m[0].length);
+      }
+      re.lastIndex = 0;
+      totalReplacements += count;
+      if (!dryRun) {
+        const newContent = toStyle(newContentLf, style);
+        await atomicWrite(realPath, newContent, { mode: stat2.mode & 511 });
+        const written = await fs.stat(realPath).catch(() => null);
+        if (written) {
+          ctx.recordRead?.(realPath, written.mtimeMs, "write", sha256hex(newContent));
+        }
+        ctx.session?.recordFileChange?.({
+          path: realPath,
+          action: "modified",
+          before: content,
+          after: newContent
+        });
+      }
+      let diff = dryRun || matches.length > 0 ? unifiedDiff(content, toStyle(newContentLf, style), {
+        fromFile: absPath,
+        toFile: absPath
+      }) : void 0;
+      if (diff !== void 0) {
+        const remaining = MAX_DIFF_BYTES - diffBytesUsed;
+        if (remaining <= 0) {
+          diff = void 0;
+          diffsOmitted++;
+        } else {
+          const capped = truncateDiffPayload(diff, remaining);
+          if (capped.truncated) diffsTruncated++;
+          diff = capped.text;
+          diffBytesUsed += Buffer.byteLength(diff, "utf8");
+        }
+      }
+      results.push({
+        path: absPath,
+        replacements: matches.length,
+        diff
+      });
+    }
+    if (!dryRun && results.length > 0) {
+      try {
+        enqueueReindex({
+          projectRoot: ctx.projectRoot,
+          files: results.map((r) => r.path)
+        });
+      } catch {
+      }
+    }
+    const overBudget = diffsOmitted > 0 || diffsTruncated > 0;
+    return {
+      files_modified: results.length,
+      total_replacements: totalReplacements,
+      results,
+      dry_run: dryRun,
+      note: overBudget ? `Diff payload exceeded the 256 KiB output budget: ${diffsTruncated} diff(s) truncated, ${diffsOmitted} diff(s) omitted. Replacement counts are complete; use the read tool to inspect individual files.` : void 0
+    };
+  }
+};
+function expandReplacement(template, match) {
+  if (!template.includes("$")) return template;
+  let out = "";
+  for (let i = 0; i < template.length; i++) {
+    const ch = template[i];
+    if (ch !== "$") {
+      out += ch;
+      continue;
+    }
+    const next = template[i + 1];
+    if (next === "$") {
+      out += "$";
+      i++;
+    } else if (next === "&") {
+      out += match[0];
+      i++;
+    } else if (next !== void 0 && next >= "1" && next <= "9") {
+      const idx = next.charCodeAt(0) - 48;
+      if (idx < match.length) {
+        out += match[idx] ?? "";
+        i++;
+      } else {
+        out += "$";
+      }
+    } else {
+      out += "$";
+    }
+  }
+  return out;
+}
+function passesExtraGlob(extraGlob, name, full) {
+  extraGlob.lastIndex = 0;
+  const nameMatch = extraGlob.test(name);
+  extraGlob.lastIndex = 0;
+  const fullMatch = extraGlob.test(full);
+  extraGlob.lastIndex = 0;
+  return nameMatch || fullMatch;
+}
+async function resolveFiles(filesInput, ctx, extraGlob) {
+  const base = ctx.cwd;
+  const normalized = filesInput.trim();
+  if (normalized.startsWith("**/") || normalized.startsWith("*") || normalized.includes("**")) {
+    return await globFiles(normalized, base, extraGlob);
+  }
+  const parts = normalized.split(",").map((s) => s.trim()).filter(Boolean);
+  const resolved = [];
+  for (const p of parts) {
+    const absPath = await safeResolveReal(p, ctx);
+    if (extraGlob && !passesExtraGlob(extraGlob, path.basename(absPath), absPath)) continue;
+    const stat2 = await fs.stat(absPath).catch(() => null);
+    if (stat2?.isFile()) {
+      resolved.push(absPath);
+    }
+  }
+  return resolved;
+}
+async function globFiles(pattern, base, extraGlob) {
+  const rgAvailable = await checkRg();
+  if (rgAvailable) {
+    try {
+      const { promise } = spawnRgFind(pattern, base);
+      const files = await promise;
+      if (extraGlob) {
+        return files.filter((f) => passesExtraGlob(extraGlob, path.basename(f), f));
+      }
+      return files;
+    } catch {
+    }
+  }
+  return await globNative(pattern, base, extraGlob);
+}
+var rgAvailabilityCache;
+function __resetRgDetectionForTests() {
+  rgAvailabilityCache = void 0;
+}
+function checkRg() {
+  rgAvailabilityCache ??= new Promise((resolve) => {
+    try {
+      const p = spawn("rg", ["--version"], {
+        env: buildChildEnv(),
+        stdio: "ignore",
+        windowsHide: true
+      });
+      p.on("error", () => resolve(false));
+      p.on("close", (code) => resolve(code === 0));
+    } catch {
+      resolve(false);
+    }
+  });
+  return rgAvailabilityCache;
+}
+function spawnRgFind(pattern, base) {
+  const args = ["--files", "--glob", pattern, base];
+  const child = spawn("rg", args, {
+    signal: AbortSignal.timeout(3e4),
+    env: buildChildEnv(),
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true
+  });
+  const MAX_BUF_CHARS = 8 * 1024 * 1024;
+  let buf = "";
+  let truncated = false;
+  child.stdout?.on("data", (chunk) => {
+    if (truncated) return;
+    buf += chunk.toString();
+    if (buf.length > MAX_BUF_CHARS) {
+      truncated = true;
+      buf = buf.slice(0, buf.lastIndexOf("\n") + 1);
+      child.kill();
+    }
+  });
+  return {
+    promise: new Promise((resolve, reject) => {
+      child.on("error", reject);
+      child.on("close", () => {
+        resolve(buf.split("\n").filter(Boolean));
+      });
+    })
+  };
+}
+async function globNative(pattern, base, extraGlob) {
+  const results = [];
+  const globRe = compileGlob(pattern);
+  const walk = async (dir) => {
+    let entries;
+    try {
+      entries = await fs.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (DEFAULT_IGNORE.includes(e.name)) continue;
+      const full = path.join(dir, e.name);
+      try {
+        const stat2 = await fs.lstat(full);
+        if (stat2.isSymbolicLink()) continue;
+      } catch {
+        continue;
+      }
+      if (e.isDirectory()) {
+        await walk(full);
+      } else if (e.isFile()) {
+        const name = e.name;
+        if (globRe.test(name) || globRe.test(full)) {
+          if (extraGlob && !extraGlob.test(name) && !extraGlob.test(full)) continue;
+          results.push(full);
+        }
+        globRe.lastIndex = 0;
+        if (extraGlob) extraGlob.lastIndex = 0;
+      }
+    }
+  };
+  await walk(base);
+  return results;
+}
+
+export {
+  replaceTool,
+  __resetRgDetectionForTests
+};
+//# sourceMappingURL=chunk-MZZN7VCD.js.map