@wrongstack/tools 0.319.0 → 0.319.1

package/dist/{chunk-UMXVT7ST.js → chunk-6AAOT4PW.js}

@@ -1,13 +1,15 @@
 import {
   COMMAND_OUTPUT_MAX_BYTES,
   normalizeCommandOutput
-} from "./chunk-QLF74MSV.js";
+} from "./chunk-ZUFHAHTE.js";
 
 // src/git.ts
 import { spawn } from "node:child_process";
 import { statSync } from "node:fs";
 import { dirname, resolve, sep } from "node:path";
+import { StringDecoder } from "node:string_decoder";
 import { assessCommitSafety } from "@wrongstack/core/coordination";
+import { ToolValidationError } from "@wrongstack/core/types";
 import { buildChildEnv } from "@wrongstack/core/utils";
 var TIMEOUT_MS = 3e4;
 var MAX_OUTPUT = 1e5;
@@ -89,7 +91,18 @@ var gitTool = {
     required: ["command"]
   },
   async execute(input, ctx, opts) {
-    if (!input?.command) throw new Error("git: command is required");
+    if (!input?.command || typeof input.command !== "string" || !input.command.trim()) {
+      throw new ToolValidationError({
+        message: "git: command is required and cannot be empty",
+        field: "command"
+      });
+    }
+    if (input.command.startsWith("-") || input.command.includes(" --")) {
+      throw new ToolValidationError({
+        message: `git: unsafe subcommand name "${input.command}"`,
+        field: "command"
+      });
+    }
     if (input.command === "commit" && !input.message) {
       return {
         command: "commit",
@@ -187,7 +200,7 @@ function findGitDir(cwd, projectRoot) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat = statSync(`${dir}/.git`);
+      const stat = statSync(resolve(dir, ".git"));
       if (stat.isDirectory() || stat.isFile()) return dir;
     } catch {
     }
@@ -199,8 +212,9 @@ function findGitDir(cwd, projectRoot) {
   return null;
 }
 function buildArgs(input) {
-  const limit = input.limit ?? 20;
-  const files = input.files ? (Array.isArray(input.files) ? input.files : input.files.split(",")).map((s) => s.trim()).filter(Boolean) : [];
+  const rawLimit = typeof input.limit === "number" && Number.isFinite(input.limit) && input.limit > 0 ? Math.floor(input.limit) : 20;
+  const limit = Math.max(1, rawLimit);
+  const files = input.files ? (Array.isArray(input.files) ? input.files : input.files.split(",")).map((s) => s.trim().replace(/\\/g, "/")).filter(Boolean) : [];
   switch (input.command) {
     case "status":
       return ["status", ...files.length ? ["--", ...files] : []];
@@ -269,9 +283,22 @@ function buildArgs(input) {
   }
 }
 function runGit(args, cwd, signal) {
+  if (signal.aborted) {
+    return Promise.resolve({
+      command: args[0],
+      stdout: "",
+      stderr: "Aborted",
+      exitCode: 124,
+      truncated: false
+    });
+  }
   return new Promise((resolve2) => {
     let stdout = "";
     let stderr = "";
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    const stdoutDecoder = new StringDecoder("utf8");
+    const stderrDecoder = new StringDecoder("utf8");
     const child = spawn("git", args, {
       cwd,
       signal,
@@ -280,31 +307,52 @@ function runGit(args, cwd, signal) {
       windowsHide: true
     });
     child.stdout?.on("data", (chunk) => {
+      stdoutBytes += chunk.byteLength;
       if (stdout.length < MAX_OUTPUT) {
-        stdout += chunk.toString();
+        const text = stdoutDecoder.write(chunk);
+        if (text) stdout += text.slice(0, MAX_OUTPUT - stdout.length);
       }
     });
     child.stderr?.on("data", (chunk) => {
+      stderrBytes += chunk.byteLength;
       if (stderr.length < MAX_OUTPUT) {
-        stderr += chunk.toString();
+        const text = stderrDecoder.write(chunk);
+        if (text) stderr += text.slice(0, MAX_OUTPUT - stderr.length);
       }
     });
     child.on("error", (err) => {
+      const stdoutTail = stdoutDecoder.end();
+      if (stdoutTail && stdout.length < MAX_OUTPUT) {
+        stdout += stdoutTail.slice(0, MAX_OUTPUT - stdout.length);
+      }
+      const stderrTail = stderrDecoder.end();
+      if (stderrTail && stderr.length < MAX_OUTPUT) {
+        stderr += stderrTail.slice(0, MAX_OUTPUT - stderr.length);
+      }
       resolve2({
         command: args[0],
         stdout: normalizeCommandOutput(stdout),
         stderr: err.message,
         exitCode: 1,
-        truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES
+        truncated: stdoutBytes > MAX_OUTPUT || Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES
       });
     });
     child.on("close", (code) => {
+      const stdoutTail = stdoutDecoder.end();
+      if (stdoutTail && stdout.length < MAX_OUTPUT) {
+        stdout += stdoutTail.slice(0, MAX_OUTPUT - stdout.length);
+      }
+      const stderrTail = stderrDecoder.end();
+      if (stderrTail && stderr.length < MAX_OUTPUT) {
+        stderr += stderrTail.slice(0, MAX_OUTPUT - stderr.length);
+      }
+      const isTruncated = stdoutBytes > MAX_OUTPUT || stderrBytes > MAX_OUTPUT || Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES || Buffer.byteLength(stderr, "utf8") > COMMAND_OUTPUT_MAX_BYTES;
       resolve2({
         command: args[0],
         stdout: normalizeCommandOutput(stdout),
         stderr: normalizeCommandOutput(stderr),
         exitCode: code ?? 1,
-        truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES || Buffer.byteLength(stderr, "utf8") > COMMAND_OUTPUT_MAX_BYTES
+        truncated: isTruncated
       });
     });
   });
@@ -313,4 +361,4 @@ function runGit(args, cwd, signal) {
 export {
   gitTool
 };
-//# sourceMappingURL=chunk-UMXVT7ST.js.map
+//# sourceMappingURL=chunk-6AAOT4PW.js.map

package/dist/{chunk-WNUJR3H4.js → chunk-AKHYMB4V.js}

@@ -17,7 +17,7 @@ import {
 } from "./chunk-V43EQ6VR.js";
 import {
   normalizeCommandOutput
-} from "./chunk-QLF74MSV.js";
+} from "./chunk-ZUFHAHTE.js";
 
 // src/bash.ts
 import { spawn } from "node:child_process";
@@ -28,6 +28,7 @@ import {
   emitProcessOutput,
   emitProcessStarted
 } from "@wrongstack/core/observability";
+import { ToolValidationError } from "@wrongstack/core/types";
 
 // src/_shell-pick.ts
 var POSIX_DEFAULT = "cmd";
@@ -539,7 +540,12 @@ var bashTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    if (!input?.command) throw new Error("bash: command is required");
+    if (!input?.command || typeof input.command !== "string" || !input.command.trim()) {
+      throw new ToolValidationError({
+        message: "bash: command is required and cannot be empty",
+        field: "command"
+      });
+    }
     const registry = getProcessRegistry();
     const bypassBreaker = !!input.background;
     if (!registry.beforeCall(bypassBreaker)) {
@@ -571,7 +577,8 @@ var bashTool = {
     }
     const PIPE_TO_SHELL_PATTERN = /\|\s*(sh|bash|ksh|zsh|fish|cmd|powershell|pwsh)/i;
     const pipeToShellNote = PIPE_TO_SHELL_PATTERN.test(input.command) ? "\n\n[wrongstack] Caution: this command pipes output into a shell interpreter (pipe-to-shell). Piped content executes as arbitrary code \u2014 review the source before trusting the result, and prefer downloading to a file and inspecting it first." : "";
-    const timeoutMs = Math.max(1, Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT_MS, 6e5));
+    const rawTimeout = typeof input.timeout_ms === "number" && !Number.isNaN(input.timeout_ms) ? input.timeout_ms : DEFAULT_TIMEOUT_MS;
+    const timeoutMs = Math.max(1, Math.min(rawTimeout, 6e5));
     const isWin2 = os2.platform() === "win32";
     let plan;
     let winShellKind;
@@ -605,6 +612,18 @@ var bashTool = {
     const env = buildChildEnv(ctx.session?.id);
     const spawnCwd = ctx.workingDir ?? ctx.projectRoot;
     const callerSignal = opts?.signal ?? ctx.signal ?? new AbortController().signal;
+    if (callerSignal.aborted) {
+      yield {
+        type: "final",
+        output: {
+          output: "Aborted",
+          exit_code: 124,
+          timed_out: true,
+          pid: null
+        }
+      };
+      return;
+    }
     const detached = !isWin2;
     const startedAt = Date.now();
     if (input.background) {
@@ -829,13 +848,15 @@ var bashTool = {
       if (stream === "stdout") stdoutBytes += chunk.byteLength;
       else stderrBytes += chunk.byteLength;
       emitProcessOutput({ pid, stream, chunk });
-      if (buf.length < MAX_OUTPUT) {
-        buf += text.slice(0, MAX_OUTPUT - buf.length);
+      if (text.length > 0) {
+        if (buf.length < MAX_OUTPUT) {
+          buf += text.slice(0, MAX_OUTPUT - buf.length);
+        }
+        spool.write(text);
+        pending += text;
+        push({ kind: "data", text });
+        pauseIfFlooded();
       }
-      spool.write(text);
-      pending += text;
-      push({ kind: "data", text });
-      pauseIfFlooded();
     };
     const onStdoutData = (chunk) => onData(chunk, "stdout");
     const onStderrData = (chunk) => onData(chunk, "stderr");
@@ -872,14 +893,17 @@ var bashTool = {
           }
           const spooled = spool.finalize();
           const hint = !timedOut && typeof c.code === "number" && c.code !== 0 && winShellKind ? diagnoseBashism(input.command, winShellKind) : void 0;
+          const isAborted = callerSignal.aborted;
           yield {
             type: "final",
             output: {
               output: normalizeCommandOutput(buf) + (spooled ? spoolNote(spooled) : "") + (hint ? `
 
 ${hint}` : "") + pipeToShellNote,
-              exit_code: c.code,
-              timed_out: timedOut
+              exit_code: timedOut || isAborted ? 124 : c.code,
+              timed_out: timedOut || isAborted,
+              pid: pid ?? null,
+              error: isAborted ? "Command aborted by user or signal" : void 0
             }
           };
           ctx.recordSideEffect?.({
@@ -953,4 +977,4 @@ export {
   checkAndBlockKillCommand,
   bashTool
 };
-//# sourceMappingURL=chunk-WNUJR3H4.js.map
+//# sourceMappingURL=chunk-AKHYMB4V.js.map

package/dist/{chunk-ZDUGI5BC.js → chunk-ATSKPZUK.js}

@@ -2,7 +2,7 @@ import {
   executeLanguagePlan,
   executePackagePlan,
   planLanguageOperation
-} from "./chunk-UC3RKRIV.js";
+} from "./chunk-TTZOK6IY.js";
 
 // src/languages/legacy-bridge.ts
 import * as fs from "node:fs/promises";
@@ -98,4 +98,4 @@ export {
   tryLegacyCodeOperation,
   tryLegacyPackageOperation
 };
-//# sourceMappingURL=chunk-ZDUGI5BC.js.map
+//# sourceMappingURL=chunk-ATSKPZUK.js.map

package/dist/{chunk-H6AWAZ2Y.js → chunk-B4HTSV6Z.js}

@@ -1,9 +1,9 @@
 import {
   todoTool
-} from "./chunk-5ZYEGP2P.js";
+} from "./chunk-BK732J7I.js";
 import {
   projectSessionPlanToKanban
-} from "./chunk-CWALNI6K.js";
+} from "./chunk-X6KXNHUO.js";
 
 // src/plan.ts
 import { randomUUID } from "node:crypto";
@@ -13,11 +13,13 @@ import {
   deriveTodosFromPlanItem,
   formatPlan,
   getPlanTemplate,
+  loadPlan,
   mutatePlan,
   mutateTasks,
   removePlanItem,
   setPlanItemStatus
 } from "@wrongstack/core/storage";
+import { ToolValidationError } from "@wrongstack/core/types";
 import { formatTaskList } from "@wrongstack/core/utils";
 var planTool = {
   name: "plan",
@@ -85,8 +87,35 @@ var planTool = {
     },
     required: ["action"]
   },
-  async execute(input, ctx) {
-    const sessionPlanPath = ctx.meta["plan.path"];
+  async execute(input, ctx, _opts) {
+    const signal = _opts?.signal ?? ctx?.signal;
+    signal?.throwIfAborted();
+    const VALID_ACTIONS = /* @__PURE__ */ new Set([
+      "show",
+      "add",
+      "status",
+      "start",
+      "done",
+      "remove",
+      "promote",
+      "template_use",
+      "clear",
+      "taskify"
+    ]);
+    if (!input?.action || !VALID_ACTIONS.has(input.action)) {
+      throw new ToolValidationError({
+        message: `plan: unknown or missing action "${input?.action}". Allowed actions: ${[...VALID_ACTIONS].join(", ")}`,
+        field: "action"
+      });
+    }
+    if (input.scope !== void 0 && input.scope !== "session" && input.scope !== "project") {
+      throw new ToolValidationError({
+        message: `plan: invalid scope "${input.scope}". Allowed: session, project`,
+        field: "scope"
+      });
+    }
+    const meta = ctx.meta ??= {};
+    const sessionPlanPath = meta["plan.path"];
     let planPath;
     if (input.scope === "project") {
       if (typeof sessionPlanPath === "string") {
@@ -118,6 +147,16 @@ var planTool = {
       };
     }
     const sessionId = ctx.session?.id ?? "unknown";
+    if (input.action === "show") {
+      meta["plan.path.resolved"] = planPath;
+      const plan2 = await loadPlan(planPath) ?? {
+        version: 1,
+        sessionId,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        items: []
+      };
+      return mkResult(plan2, true, "Plan show ok.");
+    }
     let early = null;
     const taskifyMeta = { title: "", details: "" };
     let didTaskify = false;
@@ -159,6 +198,7 @@ var planTool = {
             return next;
           }
           case "status": {
+            const VALID_PLAN_STATUSES = /* @__PURE__ */ new Set(["open", "in_progress", "done"]);
             if (!input.target || !input.status) {
               early = mkResult(
                 p,
@@ -167,6 +207,14 @@ var planTool = {
               );
               return p;
             }
+            if (!VALID_PLAN_STATUSES.has(input.status)) {
+              early = mkResult(
+                p,
+                false,
+                `status requires valid status ('open' | 'in_progress' | 'done'), got "${input.status}".`
+              );
+              return p;
+            }
             const next = setPlanItemStatus(p, input.target, input.status);
             if (next === p) {
               early = mkResult(p, false, `No plan item matched "${input.target}".`);
@@ -348,7 +396,10 @@ ${formatTaskList(taskFile.tasks)}`
   }
 };
 function mkResult(plan, ok, message, todos) {
-  const open = plan.items.filter((i) => i.status !== "done").length;
+  let open = 0;
+  for (let i = 0; i < plan.items.length; i++) {
+    if (plan.items[i].status !== "done") open++;
+  }
   const result = {
     ok,
     message,
@@ -363,4 +414,4 @@ function mkResult(plan, ok, message, todos) {
 export {
   planTool
 };
-//# sourceMappingURL=chunk-H6AWAZ2Y.js.map
+//# sourceMappingURL=chunk-B4HTSV6Z.js.map

package/dist/{chunk-5ZYEGP2P.js → chunk-BK732J7I.js}

@@ -1,12 +1,12 @@
 import {
   kanbanTool
-} from "./chunk-FJEQZHZN.js";
+} from "./chunk-W2CECGTG.js";
 import {
   applyManagedKanbanBoardToTodos,
   blockingTitles,
   mirrorSessionTodosToKanban,
   takeSessionMirrorFailure
-} from "./chunk-CWALNI6K.js";
+} from "./chunk-X6KXNHUO.js";
 
 // src/todo.ts
 import {
@@ -16,6 +16,7 @@ import {
   saveTasks,
   setPlanItemStatus
 } from "@wrongstack/core/storage";
+import { ToolValidationError } from "@wrongstack/core/types";
 import { addTask, getBoard } from "@wrongstack/kanban";
 function normalizedTitle(value) {
   return value.trim().toLocaleLowerCase().replace(/\s+/g, " ");
@@ -27,6 +28,10 @@ function activeBoardId(items, ctx) {
 }
 function bindTodosToBoard(items, previous, board) {
   const previousById = new Map(previous.map((item) => [item.id, item]));
+  const taskById = new Map(board.tasks.map((task) => [task.id, task]));
+  const taskByOriginId = new Map(
+    board.tasks.filter((task) => task.origin?.taskId).map((task) => [task.origin.taskId, task])
+  );
   const available = board.tasks.filter(
     (task) => task.status !== "archived" && task.mergedIntoTaskId === void 0 && (!task.childTaskIds || task.childTaskIds.length === 0)
   ).sort(
@@ -38,9 +43,9 @@ function bindTodosToBoard(items, previous, board) {
     const requestedTaskId = item.kanbanBoardId === board.id ? item.kanbanTaskId : previousItem?.kanbanBoardId === board.id ? previousItem.kanbanTaskId : void 0;
     const title = normalizedTitle(item.content);
     const candidates = [
-      requestedTaskId ? board.tasks.find((task2) => task2.id === requestedTaskId) : void 0,
-      board.tasks.find((task2) => task2.id === item.id),
-      board.tasks.find((task2) => task2.origin?.taskId === item.id),
+      requestedTaskId ? taskById.get(requestedTaskId) : void 0,
+      taskById.get(item.id),
+      taskByOriginId.get(item.id),
       available.find((task2) => !used.has(task2.id) && normalizedTitle(task2.title) === title)
     ];
     const task = candidates.find((candidate) => candidate && !used.has(candidate.id));
@@ -80,7 +85,10 @@ async function createMissingManagedCards(items, board, ctx, warnings) {
           description: item.activeForm?.trim() || `Added from the session todo list: ${item.content}`
         },
         // The card mirrors this session's todo row, so the session owns it.
-        { sessionId: ctx.eventSessionId?.() ?? ctx.session?.id ?? "default-session", actor: "todo" }
+        {
+          sessionId: ctx.eventSessionId?.() ?? ctx.session?.id ?? "default-session",
+          actor: "todo"
+        }
       );
       if (!result) {
         warnings.push(`Could not open a Kanban card for "${item.content}": board not found.`);
@@ -287,8 +295,40 @@ var todoTool = {
     required: ["todos"]
   },
   async execute(input, ctx, call) {
+    const signal = call?.signal ?? ctx.signal ?? new AbortController().signal;
+    signal.throwIfAborted();
     if (!Array.isArray(input?.todos)) {
-      throw new Error("todo: todos must be an array");
+      throw new ToolValidationError({
+        message: "todo: todos must be an array",
+        field: "todos"
+      });
+    }
+    const VALID_STATUSES = /* @__PURE__ */ new Set(["pending", "in_progress", "completed"]);
+    for (const item of input.todos) {
+      if (!item || typeof item !== "object") {
+        throw new ToolValidationError({
+          message: "todo: each item in todos must be an object",
+          field: "todos"
+        });
+      }
+      if (!item.id || typeof item.id !== "string" || !item.id.trim()) {
+        throw new ToolValidationError({
+          message: 'todo: each item must have a non-empty string "id"',
+          field: "todos"
+        });
+      }
+      if (item.content === void 0 || typeof item.content !== "string") {
+        throw new ToolValidationError({
+          message: `todo: item "${item.id}" must have a string "content"`,
+          field: "todos"
+        });
+      }
+      if (item.status !== void 0 && !VALID_STATUSES.has(item.status)) {
+        throw new ToolValidationError({
+          message: `todo: item "${item.id}" has invalid status "${item.status}". Allowed: pending, in_progress, completed`,
+          field: "todos"
+        });
+      }
     }
     const items = input.todos.filter((t) => Boolean(t?.id && t.content));
     const todoIdentity = (item) => item.kanbanBoardId && item.kanbanTaskId ? `kanban:${item.kanbanBoardId}:${item.kanbanTaskId}` : item.promotedFromTask ? `task:${item.promotedFromTask}` : item.promotedFromPlan ? `plan:${item.promotedFromPlan}` : `todo:${item.id}`;
@@ -330,7 +370,7 @@ var todoTool = {
       boundItems = demoteBlockedInProgress(boundItems, creationWarnings);
     }
     ctx.state.replaceTodos(boundItems);
-    const kanbanSync = managed && board ? await synchronizeManagedKanban(boundItems, board, ctx, call.signal) : { synced: 0, warnings: [] };
+    const kanbanSync = managed && board ? await synchronizeManagedKanban(boundItems, board, ctx, signal) : { synced: 0, warnings: [] };
     kanbanSync.warnings.unshift(...creationWarnings);
     if (managed && board) {
       const unresolved = boundItems.filter(
@@ -371,34 +411,39 @@ var todoTool = {
         );
       }
     }
-    for (const planId of completedPlanIds) {
-      if (pendingPlanIds.has(planId)) continue;
-      const meta = ctx.meta;
-      const planPath = meta["plan.path.resolved"] ?? meta["plan.path"];
-      if (typeof planPath !== "string" || !planPath) continue;
+    const meta = ctx.meta;
+    const planPath = meta?.["plan.path.resolved"] ?? meta?.["plan.path"];
+    if (typeof planPath === "string" && planPath && completedPlanIds.size > 0) {
       try {
-        const plan = await loadPlan(planPath);
+        let plan = await loadPlan(planPath);
         if (plan) {
-          const updated = setPlanItemStatus(plan, planId, "done");
-          await savePlan(planPath, updated);
+          let modified = false;
+          for (const planId of completedPlanIds) {
+            if (pendingPlanIds.has(planId)) continue;
+            plan = setPlanItemStatus(plan, planId, "done");
+            modified = true;
+          }
+          if (modified) await savePlan(planPath, plan);
         }
       } catch {
       }
     }
-    for (const taskId of completedTaskIds) {
-      if (pendingTaskIds.has(taskId)) continue;
-      const meta = ctx.meta;
-      const taskPath = meta["task.path.resolved"] ?? meta["task.path"];
-      if (typeof taskPath !== "string" || !taskPath) continue;
+    const taskPath = meta?.["task.path.resolved"] ?? meta?.["task.path"];
+    if (typeof taskPath === "string" && taskPath && completedTaskIds.size > 0) {
       try {
         const file = await loadTasks(taskPath);
         if (file) {
-          const task = file.tasks.find((t) => t.id === taskId);
-          if (task && task.status !== "completed") {
-            task.status = "completed";
-            task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-            await saveTasks(taskPath, file);
+          let modified = false;
+          for (const taskId of completedTaskIds) {
+            if (pendingTaskIds.has(taskId)) continue;
+            const task = file.tasks.find((t) => t.id === taskId);
+            if (task && task.status !== "completed") {
+              task.status = "completed";
+              task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+              modified = true;
+            }
           }
+          if (modified) await saveTasks(taskPath, file);
         }
       } catch {
       }
@@ -431,4 +476,4 @@ var todoTool = {
 export {
   todoTool
 };
-//# sourceMappingURL=chunk-5ZYEGP2P.js.map
+//# sourceMappingURL=chunk-BK732J7I.js.map