@wrongstack/tools 0.313.0 → 0.316.1

package/dist/chunk-NBDZMMG2.js

@@ -0,0 +1,169 @@
+// src/_fetch-guard.ts
+import * as dns from "node:dns/promises";
+import * as net from "node:net";
+import { isPrivateIPv4, isPrivateIPv6 } from "@wrongstack/core/utils";
+import { FetchError, ToolValidationError } from "@wrongstack/core/types";
+import { Agent, fetch as undiciFetch } from "undici";
+var nativeGlobalFetch = globalThis.fetch;
+var ALLOW_PRIVATE = process.env["WRONGSTACK_FETCH_ALLOW_PRIVATE"] === "1";
+if (ALLOW_PRIVATE && !process.env["CI"]) {
+  console.warn(
+    "[WrongStack] WARNING: WRONGSTACK_FETCH_ALLOW_PRIVATE=1 is active \u2014\n  fetch tool can now access private IPs (10.x, 192.168.x, 169.254.x),\n  cloud metadata endpoints, and plaintext HTTP. Use only on isolated networks."
+  );
+}
+function guardedLookup(hostname, options, callback) {
+  dns.lookup(hostname, { all: true }).then((records) => {
+    const family = options?.family;
+    const byFamily = family === 4 || family === 6 ? records.filter((r) => r.family === family) : records;
+    const list = byFamily.length > 0 ? byFamily : records;
+    if (!ALLOW_PRIVATE) {
+      for (const r of list) {
+        const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);
+        if (bad) {
+          callback(
+            Object.assign(new Error(`fetch: resolved to private address ${r.address}`), {
+              code: "EAI_FAIL"
+            })
+          );
+          return;
+        }
+      }
+    }
+    if (options?.all) {
+      callback(
+        null,
+        list.map((r) => ({ address: r.address, family: r.family }))
+      );
+      return;
+    }
+    const first = list.at(0);
+    if (!first) {
+      callback(
+        Object.assign(new Error(`fetch: no address for ${hostname}`), { code: "ENOTFOUND" })
+      );
+      return;
+    }
+    callback(null, first.address, first.family);
+  }).catch((err) => callback(err));
+}
+var pinnedAgent;
+function getPinnedDispatcher() {
+  if (!pinnedAgent) {
+    pinnedAgent = new Agent({ allowH2: false, connect: { lookup: guardedLookup } });
+  }
+  return pinnedAgent;
+}
+function dispatcherFetch() {
+  return globalThis.fetch === nativeGlobalFetch ? undiciFetch : globalThis.fetch;
+}
+var _beforeExitRegistered = false;
+if (!_beforeExitRegistered) {
+  _beforeExitRegistered = true;
+  process.on("beforeExit", () => {
+    pinnedAgent?.destroy();
+    pinnedAgent = void 0;
+  });
+}
+async function guardedFetch(url, maxRedirects, signal, headers = {
+  "user-agent": "WrongStack/1.0 (+https://wrongstack.com)",
+  accept: "text/html,application/json;q=0.9,text/plain;q=0.8,*/*;q=0.1"
+}) {
+  let redirectCount = 0;
+  let currentUrl = url;
+  for (; ; ) {
+    const parsed = new URL(currentUrl);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+      throw new ToolValidationError({
+        message: `fetch: redirect to unsupported protocol "${parsed.protocol}"`,
+        field: "url"
+      });
+    }
+    if (parsed.protocol === "http:" && !ALLOW_PRIVATE) {
+      throw new ToolValidationError({
+        message: "fetch: redirect to http:// blocked (HTTPS required by default)",
+        field: "url"
+      });
+    }
+    await assertNotPrivate(parsed.hostname);
+    const init = {
+      redirect: "manual",
+      signal,
+      headers,
+      dispatcher: getPinnedDispatcher()
+    };
+    const res = await dispatcherFetch()(currentUrl, init);
+    if (res.status < 300 || res.status > 399) {
+      return res;
+    }
+    try {
+      await res.body?.cancel();
+    } catch {
+    }
+    redirectCount++;
+    if (redirectCount > maxRedirects) {
+      throw new FetchError({
+        message: `fetch: exceeded ${maxRedirects} redirects`,
+        status: res.status,
+        context: { url: currentUrl, maxRedirects, redirectCount }
+      });
+    }
+    const location = res.headers.get("location");
+    if (!location) {
+      throw new FetchError({
+        message: "fetch: redirect status with no location header",
+        status: res.status,
+        context: { url: currentUrl, redirectCount }
+      });
+    }
+    currentUrl = new URL(location, currentUrl).toString();
+  }
+}
+async function assertNotPrivate(hostname) {
+  if (ALLOW_PRIVATE) return;
+  const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  if (host === "localhost" || host.endsWith(".localhost")) {
+    throw new ToolValidationError({
+      message: "fetch: blocked localhost target",
+      field: "url"
+    });
+  }
+  const ipVersion = net.isIP(host);
+  if (ipVersion === 4) {
+    if (isPrivateIPv4(host)) {
+      throw new ToolValidationError({
+        message: `fetch: blocked private/loopback address "${host}"`,
+        field: "url"
+      });
+    }
+  } else if (ipVersion === 6) {
+    if (isPrivateIPv6(host)) {
+      throw new ToolValidationError({
+        message: `fetch: blocked private/loopback address "${host}"`,
+        field: "url"
+      });
+    }
+  } else {
+    try {
+      const records = await dns.lookup(host, { all: true });
+      for (const r of records) {
+        const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);
+        if (bad) {
+          throw new ToolValidationError({
+            message: `fetch: resolved to private address ${r.address}`,
+            field: "url"
+          });
+        }
+      }
+    } catch (err) {
+      if (err instanceof ToolValidationError) throw err;
+    }
+  }
+}
+
+export {
+  ALLOW_PRIVATE,
+  guardedLookup,
+  guardedFetch,
+  assertNotPrivate
+};
+//# sourceMappingURL=chunk-NBDZMMG2.js.map

package/dist/chunk-NKJW5GFO.js

@@ -0,0 +1,366 @@
+import {
+  todoTool
+} from "./chunk-7EY5DCRO.js";
+import {
+  projectSessionPlanToKanban
+} from "./chunk-PY2IOS7C.js";
+
+// src/plan.ts
+import { randomUUID } from "node:crypto";
+import {
+  addPlanItem,
+  clearPlan,
+  deriveTodosFromPlanItem,
+  formatPlan,
+  getPlanTemplate,
+  mutatePlan,
+  mutateTasks,
+  removePlanItem,
+  setPlanItemStatus
+} from "@wrongstack/core/storage";
+import { formatTaskList } from "@wrongstack/core/utils";
+var planTool = {
+  name: "plan",
+  category: "Session",
+  description: 'Manage a session-persistent strategic plan. The plan is written to disk and survives conversation resumptions within the same session, but is isolated to this session \u2014 other sessions have their own separate plans. Unlike todos (which are per-turn and lost on restart), a plan tracks high-level progress across multiple turns. Use this to outline big-picture work, then promote concrete items into the todo list when ready to execute. By default plans are isolated to this session; use `scope: "project"` to store the plan in a shared project-level file visible to all sessions.',
+  usageHint: 'RECOMMENDED FOR COMPLEX, MULTI-PHASE WORK:\n\n- Start by creating a high-level plan with `action: "add"` or using templates (`template_use`).\n- Use `action: "status"` with `open`, `in_progress`, or `done` for exact status changes.\n- Use `promote` to turn a plan item into actionable todos.\n- Use `taskify` to convert a plan item into a structured task (with type/priority/deps).\n- Unfinished plan items cannot be removed or cleared; complete them first.\n- Keep plans at the "why and what" level, and todos at the "how and next step" level.\n- Common templates: "new-feature", "bug-fix", "refactor", "release", "security-audit".\n\nThis tool is excellent for maintaining long-term direction across many turns within a session. Plans survive resume but are not shared across separate sessions.\nUse `scope: "project"` to use a shared project-level plan file.',
+  permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // The action performed; plan has no single file or path subject.
+  subjectKey: "action",
+  mutating: true,
+  capabilities: ["fs.write"],
+  icon: "plan",
+  timeoutMs: 3e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      action: {
+        type: "string",
+        enum: [
+          "show",
+          "add",
+          "status",
+          "start",
+          "done",
+          "remove",
+          "promote",
+          "template_use",
+          "clear",
+          "taskify"
+        ],
+        description: "The operation to perform on the plan board."
+      },
+      title: {
+        type: "string",
+        description: "Title of the plan item. Required for action=add."
+      },
+      details: {
+        type: "string",
+        description: "Additional details or description for a new plan item (action=add)."
+      },
+      target: {
+        type: "string",
+        description: "Identifier for the target plan item (id, 1-based index, or partial title). Required for most actions except add/show/clear."
+      },
+      status: {
+        type: "string",
+        enum: ["open", "in_progress", "done"],
+        description: "Exact plan item status for action=status."
+      },
+      subtasks: {
+        type: "array",
+        items: { type: "string" },
+        description: "List of subtask titles. Used with promote to break a plan item into multiple todos."
+      },
+      template: {
+        type: "string",
+        description: "Template identifier when using action=template_use. Common values: new-feature, bug-fix, refactor, release, security-audit."
+      },
+      scope: {
+        type: "string",
+        enum: ["session", "project"],
+        description: 'Storage scope: "session" (default, isolated to this session) or "project" (shared across all sessions for this project).'
+      }
+    },
+    required: ["action"]
+  },
+  async execute(input, ctx) {
+    const sessionPlanPath = ctx.meta["plan.path"];
+    let planPath;
+    if (input.scope === "project") {
+      if (typeof sessionPlanPath === "string") {
+        const lastSep = Math.max(
+          sessionPlanPath.lastIndexOf("/"),
+          sessionPlanPath.lastIndexOf("\\")
+        );
+        if (lastSep < 0) {
+          return {
+            ok: false,
+            message: `Cannot derive the project-scoped plan path: session plan path "${sessionPlanPath}" has no directory component.`,
+            plan: "",
+            count: 0,
+            open: 0
+          };
+        }
+        planPath = sessionPlanPath.slice(0, lastSep + 1) + "backlog.plan.json";
+      }
+    } else {
+      planPath = sessionPlanPath;
+    }
+    if (typeof planPath !== "string" || !planPath) {
+      return {
+        ok: false,
+        message: "Plan storage path is not configured for this session.",
+        plan: "",
+        count: 0,
+        open: 0
+      };
+    }
+    const sessionId = ctx.session?.id ?? "unknown";
+    let early = null;
+    const taskifyMeta = { title: "", details: "" };
+    let didTaskify = false;
+    let todosToReplace = null;
+    let plan;
+    try {
+      plan = await mutatePlan(planPath, sessionId, async (p) => {
+        switch (input.action) {
+          case "show":
+            break;
+          case "add": {
+            const title = input.title?.trim();
+            if (!title) {
+              early = mkResult(p, false, "add requires `title`.");
+              return p;
+            }
+            const { plan: updated } = addPlanItem(p, title, input.details?.trim() || void 0);
+            return updated;
+          }
+          case "start":
+          case "done": {
+            if (!input.target) {
+              early = mkResult(
+                p,
+                false,
+                `${input.action} requires \`target\` (id|index|substring).`
+              );
+              return p;
+            }
+            const next = setPlanItemStatus(
+              p,
+              input.target,
+              input.action === "start" ? "in_progress" : "done"
+            );
+            if (next === p) {
+              early = mkResult(p, false, `No plan item matched "${input.target}".`);
+              return p;
+            }
+            return next;
+          }
+          case "status": {
+            if (!input.target || !input.status) {
+              early = mkResult(
+                p,
+                false,
+                "status requires `target` (id|index|substring) and `status`."
+              );
+              return p;
+            }
+            const next = setPlanItemStatus(p, input.target, input.status);
+            if (next === p) {
+              early = mkResult(p, false, `No plan item matched "${input.target}".`);
+              return p;
+            }
+            return next;
+          }
+          case "remove": {
+            if (!input.target) {
+              early = mkResult(p, false, "remove requires `target` (id|index|substring).");
+              return p;
+            }
+            const next = removePlanItem(p, input.target);
+            if (next === p) {
+              early = mkResult(p, false, `No plan item matched "${input.target}".`);
+              return p;
+            }
+            const nextIds = new Set(next.items.map((item) => item.id));
+            const removed = p.items.find((item) => !nextIds.has(item.id));
+            if (removed?.status !== "done") {
+              early = mkResult(
+                p,
+                false,
+                `Plan item "${removed?.title ?? input.target}" is not done and cannot be removed. Complete it first.`
+              );
+              return p;
+            }
+            return next;
+          }
+          case "promote": {
+            if (!input.target) {
+              early = mkResult(
+                p,
+                false,
+                `${input.action} requires \`target\` (id|index|substring).`
+              );
+              return p;
+            }
+            const derived = deriveTodosFromPlanItem(p, input.target, input.subtasks);
+            if (!derived) {
+              early = mkResult(p, false, `No plan item matched "${input.target}".`);
+              return p;
+            }
+            todosToReplace = derived.todos;
+            early = mkResult(
+              derived.plan,
+              true,
+              `${input.action} ok \u2014 ${derived.todos.length} todo(s) created.`,
+              derived.todos
+            );
+            return derived.plan;
+          }
+          case "template_use": {
+            const templateName = input.template?.trim();
+            if (!templateName) {
+              early = mkResult(p, false, "template_use requires `template` name.");
+              return p;
+            }
+            const template = getPlanTemplate(templateName);
+            if (!template) {
+              early = mkResult(p, false, `Unknown template "${templateName}".`);
+              return p;
+            }
+            let updated = p;
+            for (const item of template.items) {
+              ({ plan: updated } = addPlanItem(updated, item.title, item.details));
+            }
+            early = mkResult(
+              updated,
+              true,
+              `Applied template "${template.name}" \u2014 ${template.items.length} items added.`
+            );
+            return updated;
+          }
+          case "clear":
+            if (p.items.some((item) => item.status !== "done")) {
+              early = mkResult(
+                p,
+                false,
+                "Plan contains unfinished items and cannot be cleared. Complete them first."
+              );
+              return p;
+            }
+            return clearPlan(p);
+          case "taskify": {
+            if (!input.target) {
+              early = mkResult(
+                p,
+                false,
+                "taskify requires `target` (plan item id|index|substring)."
+              );
+              return p;
+            }
+            let itemIdx = -1;
+            const asNum = Number.parseInt(input.target, 10);
+            if (!Number.isNaN(asNum) && asNum >= 1 && asNum <= p.items.length) {
+              itemIdx = asNum - 1;
+            } else {
+              itemIdx = p.items.findIndex((it) => it.id === input.target);
+              if (itemIdx === -1) {
+                const lower = input.target.toLowerCase();
+                itemIdx = p.items.findIndex((it) => it.title.toLowerCase().includes(lower));
+              }
+            }
+            if (itemIdx === -1 || !p.items[itemIdx]) {
+              early = mkResult(p, false, `No plan item matched "${input.target}".`);
+              return p;
+            }
+            const item = p.items[itemIdx];
+            taskifyMeta.title = item.title;
+            taskifyMeta.details = item.details ?? "";
+            didTaskify = true;
+            break;
+          }
+          default:
+            early = mkResult(p, false, `Unknown action "${input.action}".`);
+            return p;
+        }
+        return p;
+      });
+    } catch (err) {
+      return {
+        ok: false,
+        message: `Plan change not saved \u2014 ${err instanceof Error ? err.message : String(err)}`,
+        plan: "",
+        count: 0,
+        open: 0
+      };
+    }
+    ctx.meta["plan.path.resolved"] = planPath;
+    await projectSessionPlanToKanban(ctx.projectRoot, plan.items, sessionId);
+    if (todosToReplace) {
+      await todoTool.execute({ todos: todosToReplace }, ctx, {
+        signal: AbortSignal.timeout(3e4)
+      });
+    }
+    if (early) return early;
+    if (didTaskify) {
+      const taskPathRaw = ctx.meta["task.path"];
+      if (typeof taskPathRaw !== "string" || !taskPathRaw) {
+        return mkResult(plan, false, "Task storage path not configured \u2014 cannot taskify.");
+      }
+      let taskPath = taskPathRaw;
+      if (input.scope === "project") {
+        const lastSep = Math.max(taskPath.lastIndexOf("/"), taskPath.lastIndexOf("\\"));
+        taskPath = lastSep >= 0 ? taskPath.slice(0, lastSep + 1) + "backlog.tasks.json" : "backlog.tasks.json";
+      }
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      try {
+        const taskFile = await mutateTasks(taskPath, sessionId, (f) => {
+          f.tasks.push({
+            id: `task_${randomUUID()}`,
+            title: taskifyMeta.title,
+            description: taskifyMeta.details || void 0,
+            type: "feature",
+            priority: "medium",
+            status: "pending",
+            createdAt: now,
+            updatedAt: now
+          });
+          return f;
+        });
+        ctx.meta["task.path.resolved"] = taskPath;
+        return mkResult(
+          plan,
+          true,
+          `taskify ok \u2014 added "${taskifyMeta.title}" to tasks.
+${formatTaskList(taskFile.tasks)}`
+        );
+      } catch (err) {
+        return mkResult(
+          plan,
+          false,
+          `taskify: task not saved \u2014 ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+    return mkResult(plan, true, `Plan ${input.action} ok.`);
+  }
+};
+function mkResult(plan, ok, message, todos) {
+  const open = plan.items.filter((i) => i.status !== "done").length;
+  const result = {
+    ok,
+    message,
+    plan: formatPlan(plan),
+    count: plan.items.length,
+    open
+  };
+  if (todos !== void 0) result.todos = todos;
+  return result;
+}
+
+export {
+  planTool
+};
+//# sourceMappingURL=chunk-NKJW5GFO.js.map