@wrongstack/tools 0.313.0 → 0.316.1

package/dist/chunk-VFKPWSOX.js

@@ -0,0 +1,154 @@
+import {
+  checkSyntax
+} from "./chunk-FQZOHLG3.js";
+import {
+  enqueueReindex
+} from "./chunk-HYX2TZ7O.js";
+import {
+  safeResolveReal,
+  sha256hex,
+  truncateDiffPayload
+} from "./chunk-D33S4RQG.js";
+
+// src/write.ts
+import * as fs from "node:fs/promises";
+import { ToolValidationError } from "@wrongstack/core/types";
+import {
+  atomicWrite,
+  detectNewlineStyle,
+  normalizeToLf,
+  toStyle,
+  unifiedDiff
+} from "@wrongstack/core/utils";
+var MAX_DIFF_BYTES = 262144;
+var writeTool = {
+  name: "write",
+  category: "Filesystem",
+  description: "Write or completely overwrite a file on disk. This is a high-privilege operation. For modifying existing files, you should almost always prefer the `edit` tool instead, because `edit` is safer and works on the last-read version of the file.",
+  usageHint: "RULES FOR CORRECT USAGE:\n- Use `write` primarily for **new files** or when you want to replace the entire content.\n- For any existing file, strongly prefer `edit` (it requires a prior `read` in the same session and is more precise).\n- When overwriting an existing file, the tool reads the current content itself to compute the diff \u2014 but still `read` the file first before large rewrites so you know what you are replacing.\n- When overwriting an existing file, the content is normalized to the dominant line-ending style (CRLF/LF) of the existing file; new files are written verbatim.\n- The path is resolved relative to the project root and protected against escaping the workspace.",
+  selection: {
+    doNotUseWhen: "making a precise change to part of an existing file.",
+    useInstead: ["edit"]
+  },
+  permission: "confirm",
+  // WS-046: gives permission decisions something to key on — the file being
+  // written, so trust rules can scope by path.
+  subjectKey: "path",
+  mutating: true,
+  timeoutMs: 5e3,
+  maxOutputBytes: 262144,
+  capabilities: ["fs.write"],
+  icon: "file",
+  inputSchema: {
+    type: "object",
+    properties: {
+      path: {
+        type: "string",
+        description: "Relative path from project root. Must not escape the project."
+      },
+      content: {
+        type: "string",
+        description: "The complete new content of the file."
+      }
+    },
+    required: ["path", "content"]
+  },
+  async execute(input, ctx, opts) {
+    return writeFile(input, ctx, opts?.signal);
+  },
+  async *executeStream(input, ctx, opts) {
+    const prepared = await prepareWrite(input, ctx);
+    if (!prepared.existed) {
+      for (const line of input.content.split("\n")) {
+        yield { type: "partial_output", text: `${line}
+`, data: { livePreview: true } };
+      }
+    }
+    yield { type: "final", output: await finishWrite(input, ctx, prepared, opts?.signal) };
+  }
+};
+async function writeFile(input, ctx, signal) {
+  return finishWrite(input, ctx, await prepareWrite(input, ctx), signal);
+}
+async function prepareWrite(input, ctx) {
+  if (!input?.path) {
+    throw new ToolValidationError({
+      message: "write: path is required",
+      field: "path"
+    });
+  }
+  if (input.content === void 0) {
+    throw new ToolValidationError({
+      message: "write: content is required",
+      field: "content"
+    });
+  }
+  const absPath = await safeResolveReal(input.path, ctx);
+  let existed = false;
+  let prev = "";
+  try {
+    const stat2 = await fs.stat(absPath);
+    existed = stat2.isFile();
+    if (existed) {
+      if (!ctx.hasRead(absPath)) {
+        prev = await fs.readFile(absPath, "utf8");
+        ctx.recordRead(absPath, stat2.mtimeMs, "write", sha256hex(prev));
+      } else {
+        prev = await fs.readFile(absPath, "utf8");
+      }
+    }
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      throw err;
+    }
+  }
+  return { absPath, existed, prev };
+}
+async function finishWrite(input, ctx, prepared, signal) {
+  const content = prepared.existed ? toStyle(normalizeToLf(input.content), detectNewlineStyle(prepared.prev)) : input.content;
+  signal?.throwIfAborted();
+  await atomicWrite(prepared.absPath, content);
+  try {
+    enqueueReindex({ projectRoot: ctx.projectRoot, files: [prepared.absPath] });
+  } catch {
+  }
+  const rawDiff = prepared.existed ? unifiedDiff(prepared.prev, content, { fromFile: input.path, toFile: input.path }) : `+++ ${input.path}
++ (new file, ${content.split("\n").length} lines)`;
+  const { text: diff, truncated: diffTruncated } = truncateDiffPayload(rawDiff, MAX_DIFF_BYTES);
+  const stat2 = await fs.stat(prepared.absPath);
+  ctx.recordRead(prepared.absPath, stat2.mtimeMs, "write", sha256hex(content));
+  ctx.session?.recordFileChange?.({
+    path: prepared.absPath,
+    action: prepared.existed ? "modified" : "created",
+    before: prepared.existed ? prepared.prev : null,
+    after: content
+  });
+  const syntax = await checkSyntax(
+    prepared.absPath,
+    content,
+    prepared.existed ? prepared.prev : void 0
+  ).catch(() => void 0);
+  const hasSyntaxErrors = syntax !== void 0 && syntax.errors.length > 0;
+  const notes = [];
+  if (diffTruncated) {
+    notes.push("Diff truncated to the 256 KiB output budget \u2014 the full write is on disk.");
+  }
+  if (hasSyntaxErrors) {
+    notes.push(
+      syntax.preExisting ? "Syntax check: the file still has parse errors (they pre-date this write) \u2014 see syntax_errors." : `Syntax check: the written content has ${syntax.errors.length} parse error(s) \u2014 fix them now, see syntax_errors.`
+    );
+  }
+  return {
+    path: prepared.absPath,
+    bytes_written: Buffer.byteLength(content, "utf8"),
+    created: !prepared.existed,
+    diff,
+    syntax_errors: hasSyntaxErrors ? syntax.errors : void 0,
+    note: notes.length > 0 ? notes.join("\n") : void 0
+  };
+}
+
+export {
+  writeTool
+};
+//# sourceMappingURL=chunk-VFKPWSOX.js.map

package/dist/chunk-VJNHFZ7J.js

@@ -0,0 +1,190 @@
+import {
+  tryLegacyPackageOperation
+} from "./chunk-PQKK5JH7.js";
+import {
+  spawnStream
+} from "./chunk-22B7GE5T.js";
+import {
+  COMMAND_OUTPUT_MAX_BYTES,
+  detectPackageManager,
+  normalizeCommandOutput,
+  safeResolveReal
+} from "./chunk-D33S4RQG.js";
+
+// src/audit.ts
+var SEVERITY_RANK = {
+  info: 0,
+  low: 1,
+  moderate: 2,
+  high: 3,
+  critical: 4
+};
+var auditTool = {
+  name: "audit",
+  category: "Package Management",
+  description: "Run a security audit against project dependencies (using pnpm/npm audit). Reports known vulnerabilities with severity.",
+  usageHint: "CRITICAL SECURITY TOOL:\n\n- Run regularly and especially before any release.\n- Use `level` to focus on high/critical issues.\n- This tool is read-only: to remediate, use `install` (or `language_package`) to upgrade the affected packages.\nThis is one of the most important tools for supply chain security.",
+  permission: "confirm",
+  mutating: false,
+  capabilities: ["shell.restricted"],
+  icon: "package",
+  timeoutMs: 6e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      cwd: { type: "string", description: "Working directory (default: cwd)" },
+      level: {
+        type: "string",
+        enum: ["low", "moderate", "high", "critical"],
+        description: "Minimum severity level to report"
+      },
+      fix: {
+        type: "boolean",
+        description: "Deprecated and rejected \u2014 this tool is read-only and never modifies dependencies. Use `install` (or `language_package`) to remediate vulnerabilities."
+      }
+    }
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    const executeStream = auditTool.executeStream;
+    if (!executeStream) throw new Error("auditTool: stream execution unavailable");
+    for await (const ev of executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("audit: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    if (input.fix === true) {
+      throw new Error(
+        "audit: `fix: true` is not supported \u2014 this tool is read-only (mutating: false). To remediate vulnerabilities, upgrade the affected packages with the `install` tool (or `language_package` for non-JS ecosystems)."
+      );
+    }
+    const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
+    const bridge = await tryLegacyPackageOperation("package-audit", {
+      cwd,
+      projectRoot: ctx.projectRoot,
+      signal: opts.signal
+    });
+    if (bridge?.outcome) {
+      const outcome = bridge.outcome;
+      const vulns = outcome.vulnerabilities.map((v) => ({
+        severity: v.severity,
+        package: v.package,
+        title: v.advisory ?? "Unknown vulnerability",
+        url: v.url ?? ""
+      }));
+      const total = vulns.length;
+      const summary = total === 0 ? "No vulnerabilities found" : `Found ${total} vulnerabilities: ${vulns.filter((a) => a.severity === "critical").length} critical, ${vulns.filter((a) => a.severity === "high").length} high`;
+      yield {
+        type: "final",
+        output: {
+          exit_code: outcome.run?.exitCode ?? 0,
+          vulnerabilities: vulns,
+          total,
+          summary,
+          output: outcome.run?.output ?? "",
+          truncated: outcome.run?.truncated ?? false
+        }
+      };
+      return;
+    }
+    const manager = await detectPackageManager(cwd, ctx.projectRoot);
+    yield { type: "log", text: `Auditing with ${manager}\u2026`, data: { manager } };
+    const args = ["audit", "--json"];
+    if (input.level && (manager === "npm" || manager === "pnpm")) {
+      args.push(`--audit-level=${input.level}`);
+    }
+    const result = yield* spawnStream({
+      cmd: manager,
+      args,
+      cwd,
+      signal: opts.signal,
+      maxBytes: 1e5
+    });
+    yield {
+      type: "final",
+      output: parseAuditOutput(result.stdout, result.exitCode, {
+        level: input.level,
+        spawnTruncated: result.truncated
+      })
+    };
+  }
+};
+function parseAuditOutput(json, exitCode, opts = {}) {
+  if (!json) {
+    return {
+      exit_code: exitCode,
+      vulnerabilities: [],
+      total: 0,
+      summary: exitCode === 0 ? "No vulnerabilities found" : "Audit failed",
+      output: "",
+      truncated: false
+    };
+  }
+  const cappedOutput = normalizeCommandOutput(json);
+  const truncated = opts.spawnTruncated === true || Buffer.byteLength(json, "utf8") > COMMAND_OUTPUT_MAX_BYTES;
+  try {
+    const data = JSON.parse(json);
+    let advisories = extractAdvisories(data);
+    const minRank = opts.level ? SEVERITY_RANK[opts.level] ?? 0 : 0;
+    if (minRank > 0) {
+      advisories = advisories.filter((a) => (SEVERITY_RANK[a.severity] ?? 0) >= minRank);
+    }
+    const total = advisories.length;
+    const summary = total === 0 ? "No vulnerabilities found" : `Found ${total} vulnerabilities: ${advisories.filter((a) => a.severity === "critical").length} critical, ${advisories.filter((a) => a.severity === "high").length} high`;
+    return {
+      exit_code: exitCode,
+      vulnerabilities: advisories,
+      total,
+      summary,
+      output: cappedOutput,
+      truncated
+    };
+  } catch {
+    return {
+      exit_code: exitCode,
+      vulnerabilities: [],
+      total: 0,
+      summary: "Could not parse audit output",
+      output: cappedOutput,
+      truncated
+    };
+  }
+}
+function extractAdvisories(data) {
+  const advisories = [];
+  const ads = data["advisories"];
+  if (ads && typeof ads === "object") {
+    for (const [id, value] of Object.entries(ads)) {
+      const adv = value ?? {};
+      advisories.push({
+        severity: typeof adv["severity"] === "string" ? adv["severity"] : "unknown",
+        package: typeof adv["module_name"] === "string" ? adv["module_name"] : id,
+        title: typeof adv["title"] === "string" ? adv["title"] : "Unknown vulnerability",
+        url: typeof adv["url"] === "string" ? adv["url"] : ""
+      });
+    }
+    return advisories;
+  }
+  const vulns = data["vulnerabilities"];
+  if (vulns && typeof vulns === "object") {
+    for (const [pkg, value] of Object.entries(vulns)) {
+      const vuln = value ?? {};
+      const via = Array.isArray(vuln["via"]) ? vuln["via"] : [];
+      const detail = via.find((v) => !!v && typeof v === "object");
+      advisories.push({
+        severity: typeof vuln["severity"] === "string" ? vuln["severity"] : "unknown",
+        package: pkg,
+        title: detail && typeof detail["title"] === "string" ? detail["title"] : "Unknown vulnerability",
+        url: detail && typeof detail["url"] === "string" ? detail["url"] : ""
+      });
+    }
+  }
+  return advisories;
+}
+
+export {
+  auditTool
+};
+//# sourceMappingURL=chunk-VJNHFZ7J.js.map