@wrongstack/tools 0.319.0 → 0.320.1

package/dist/{chunk-UMXVT7ST.js → chunk-6AAOT4PW.js}

@@ -1,13 +1,15 @@
 import {
   COMMAND_OUTPUT_MAX_BYTES,
   normalizeCommandOutput
-} from "./chunk-QLF74MSV.js";
+} from "./chunk-ZUFHAHTE.js";
 
 // src/git.ts
 import { spawn } from "node:child_process";
 import { statSync } from "node:fs";
 import { dirname, resolve, sep } from "node:path";
+import { StringDecoder } from "node:string_decoder";
 import { assessCommitSafety } from "@wrongstack/core/coordination";
+import { ToolValidationError } from "@wrongstack/core/types";
 import { buildChildEnv } from "@wrongstack/core/utils";
 var TIMEOUT_MS = 3e4;
 var MAX_OUTPUT = 1e5;
@@ -89,7 +91,18 @@ var gitTool = {
     required: ["command"]
   },
   async execute(input, ctx, opts) {
-    if (!input?.command) throw new Error("git: command is required");
+    if (!input?.command || typeof input.command !== "string" || !input.command.trim()) {
+      throw new ToolValidationError({
+        message: "git: command is required and cannot be empty",
+        field: "command"
+      });
+    }
+    if (input.command.startsWith("-") || input.command.includes(" --")) {
+      throw new ToolValidationError({
+        message: `git: unsafe subcommand name "${input.command}"`,
+        field: "command"
+      });
+    }
     if (input.command === "commit" && !input.message) {
       return {
         command: "commit",
@@ -187,7 +200,7 @@ function findGitDir(cwd, projectRoot) {
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
-      const stat = statSync(`${dir}/.git`);
+      const stat = statSync(resolve(dir, ".git"));
       if (stat.isDirectory() || stat.isFile()) return dir;
     } catch {
     }
@@ -199,8 +212,9 @@ function findGitDir(cwd, projectRoot) {
   return null;
 }
 function buildArgs(input) {
-  const limit = input.limit ?? 20;
-  const files = input.files ? (Array.isArray(input.files) ? input.files : input.files.split(",")).map((s) => s.trim()).filter(Boolean) : [];
+  const rawLimit = typeof input.limit === "number" && Number.isFinite(input.limit) && input.limit > 0 ? Math.floor(input.limit) : 20;
+  const limit = Math.max(1, rawLimit);
+  const files = input.files ? (Array.isArray(input.files) ? input.files : input.files.split(",")).map((s) => s.trim().replace(/\\/g, "/")).filter(Boolean) : [];
   switch (input.command) {
     case "status":
       return ["status", ...files.length ? ["--", ...files] : []];
@@ -269,9 +283,22 @@ function buildArgs(input) {
   }
 }
 function runGit(args, cwd, signal) {
+  if (signal.aborted) {
+    return Promise.resolve({
+      command: args[0],
+      stdout: "",
+      stderr: "Aborted",
+      exitCode: 124,
+      truncated: false
+    });
+  }
   return new Promise((resolve2) => {
     let stdout = "";
     let stderr = "";
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    const stdoutDecoder = new StringDecoder("utf8");
+    const stderrDecoder = new StringDecoder("utf8");
     const child = spawn("git", args, {
       cwd,
       signal,
@@ -280,31 +307,52 @@ function runGit(args, cwd, signal) {
       windowsHide: true
     });
     child.stdout?.on("data", (chunk) => {
+      stdoutBytes += chunk.byteLength;
       if (stdout.length < MAX_OUTPUT) {
-        stdout += chunk.toString();
+        const text = stdoutDecoder.write(chunk);
+        if (text) stdout += text.slice(0, MAX_OUTPUT - stdout.length);
       }
     });
     child.stderr?.on("data", (chunk) => {
+      stderrBytes += chunk.byteLength;
       if (stderr.length < MAX_OUTPUT) {
-        stderr += chunk.toString();
+        const text = stderrDecoder.write(chunk);
+        if (text) stderr += text.slice(0, MAX_OUTPUT - stderr.length);
       }
     });
     child.on("error", (err) => {
+      const stdoutTail = stdoutDecoder.end();
+      if (stdoutTail && stdout.length < MAX_OUTPUT) {
+        stdout += stdoutTail.slice(0, MAX_OUTPUT - stdout.length);
+      }
+      const stderrTail = stderrDecoder.end();
+      if (stderrTail && stderr.length < MAX_OUTPUT) {
+        stderr += stderrTail.slice(0, MAX_OUTPUT - stderr.length);
+      }
       resolve2({
         command: args[0],
         stdout: normalizeCommandOutput(stdout),
         stderr: err.message,
         exitCode: 1,
-        truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES
+        truncated: stdoutBytes > MAX_OUTPUT || Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES
       });
     });
     child.on("close", (code) => {
+      const stdoutTail = stdoutDecoder.end();
+      if (stdoutTail && stdout.length < MAX_OUTPUT) {
+        stdout += stdoutTail.slice(0, MAX_OUTPUT - stdout.length);
+      }
+      const stderrTail = stderrDecoder.end();
+      if (stderrTail && stderr.length < MAX_OUTPUT) {
+        stderr += stderrTail.slice(0, MAX_OUTPUT - stderr.length);
+      }
+      const isTruncated = stdoutBytes > MAX_OUTPUT || stderrBytes > MAX_OUTPUT || Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES || Buffer.byteLength(stderr, "utf8") > COMMAND_OUTPUT_MAX_BYTES;
       resolve2({
         command: args[0],
         stdout: normalizeCommandOutput(stdout),
         stderr: normalizeCommandOutput(stderr),
         exitCode: code ?? 1,
-        truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES || Buffer.byteLength(stderr, "utf8") > COMMAND_OUTPUT_MAX_BYTES
+        truncated: isTruncated
       });
     });
   });
@@ -313,4 +361,4 @@ function runGit(args, cwd, signal) {
 export {
   gitTool
 };
-//# sourceMappingURL=chunk-UMXVT7ST.js.map
+//# sourceMappingURL=chunk-6AAOT4PW.js.map

package/dist/{chunk-H6AWAZ2Y.js → chunk-B4HTSV6Z.js}

@@ -1,9 +1,9 @@
 import {
   todoTool
-} from "./chunk-5ZYEGP2P.js";
+} from "./chunk-BK732J7I.js";
 import {
   projectSessionPlanToKanban
-} from "./chunk-CWALNI6K.js";
+} from "./chunk-X6KXNHUO.js";
 
 // src/plan.ts
 import { randomUUID } from "node:crypto";
@@ -13,11 +13,13 @@ import {
   deriveTodosFromPlanItem,
   formatPlan,
   getPlanTemplate,
+  loadPlan,
   mutatePlan,
   mutateTasks,
   removePlanItem,
   setPlanItemStatus
 } from "@wrongstack/core/storage";
+import { ToolValidationError } from "@wrongstack/core/types";
 import { formatTaskList } from "@wrongstack/core/utils";
 var planTool = {
   name: "plan",
@@ -85,8 +87,35 @@ var planTool = {
     },
     required: ["action"]
   },
-  async execute(input, ctx) {
-    const sessionPlanPath = ctx.meta["plan.path"];
+  async execute(input, ctx, _opts) {
+    const signal = _opts?.signal ?? ctx?.signal;
+    signal?.throwIfAborted();
+    const VALID_ACTIONS = /* @__PURE__ */ new Set([
+      "show",
+      "add",
+      "status",
+      "start",
+      "done",
+      "remove",
+      "promote",
+      "template_use",
+      "clear",
+      "taskify"
+    ]);
+    if (!input?.action || !VALID_ACTIONS.has(input.action)) {
+      throw new ToolValidationError({
+        message: `plan: unknown or missing action "${input?.action}". Allowed actions: ${[...VALID_ACTIONS].join(", ")}`,
+        field: "action"
+      });
+    }
+    if (input.scope !== void 0 && input.scope !== "session" && input.scope !== "project") {
+      throw new ToolValidationError({
+        message: `plan: invalid scope "${input.scope}". Allowed: session, project`,
+        field: "scope"
+      });
+    }
+    const meta = ctx.meta ??= {};
+    const sessionPlanPath = meta["plan.path"];
     let planPath;
     if (input.scope === "project") {
       if (typeof sessionPlanPath === "string") {
@@ -118,6 +147,16 @@ var planTool = {
       };
     }
     const sessionId = ctx.session?.id ?? "unknown";
+    if (input.action === "show") {
+      meta["plan.path.resolved"] = planPath;
+      const plan2 = await loadPlan(planPath) ?? {
+        version: 1,
+        sessionId,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        items: []
+      };
+      return mkResult(plan2, true, "Plan show ok.");
+    }
     let early = null;
     const taskifyMeta = { title: "", details: "" };
     let didTaskify = false;
@@ -159,6 +198,7 @@ var planTool = {
             return next;
           }
           case "status": {
+            const VALID_PLAN_STATUSES = /* @__PURE__ */ new Set(["open", "in_progress", "done"]);
             if (!input.target || !input.status) {
               early = mkResult(
                 p,
@@ -167,6 +207,14 @@ var planTool = {
               );
               return p;
             }
+            if (!VALID_PLAN_STATUSES.has(input.status)) {
+              early = mkResult(
+                p,
+                false,
+                `status requires valid status ('open' | 'in_progress' | 'done'), got "${input.status}".`
+              );
+              return p;
+            }
             const next = setPlanItemStatus(p, input.target, input.status);
             if (next === p) {
               early = mkResult(p, false, `No plan item matched "${input.target}".`);
@@ -348,7 +396,10 @@ ${formatTaskList(taskFile.tasks)}`
   }
 };
 function mkResult(plan, ok, message, todos) {
-  const open = plan.items.filter((i) => i.status !== "done").length;
+  let open = 0;
+  for (let i = 0; i < plan.items.length; i++) {
+    if (plan.items[i].status !== "done") open++;
+  }
   const result = {
     ok,
     message,
@@ -363,4 +414,4 @@ function mkResult(plan, ok, message, todos) {
 export {
   planTool
 };
-//# sourceMappingURL=chunk-H6AWAZ2Y.js.map
+//# sourceMappingURL=chunk-B4HTSV6Z.js.map

package/dist/{chunk-5ZYEGP2P.js → chunk-BK732J7I.js}

@@ -1,12 +1,12 @@
 import {
   kanbanTool
-} from "./chunk-FJEQZHZN.js";
+} from "./chunk-W2CECGTG.js";
 import {
   applyManagedKanbanBoardToTodos,
   blockingTitles,
   mirrorSessionTodosToKanban,
   takeSessionMirrorFailure
-} from "./chunk-CWALNI6K.js";
+} from "./chunk-X6KXNHUO.js";
 
 // src/todo.ts
 import {
@@ -16,6 +16,7 @@ import {
   saveTasks,
   setPlanItemStatus
 } from "@wrongstack/core/storage";
+import { ToolValidationError } from "@wrongstack/core/types";
 import { addTask, getBoard } from "@wrongstack/kanban";
 function normalizedTitle(value) {
   return value.trim().toLocaleLowerCase().replace(/\s+/g, " ");
@@ -27,6 +28,10 @@ function activeBoardId(items, ctx) {
 }
 function bindTodosToBoard(items, previous, board) {
   const previousById = new Map(previous.map((item) => [item.id, item]));
+  const taskById = new Map(board.tasks.map((task) => [task.id, task]));
+  const taskByOriginId = new Map(
+    board.tasks.filter((task) => task.origin?.taskId).map((task) => [task.origin.taskId, task])
+  );
   const available = board.tasks.filter(
     (task) => task.status !== "archived" && task.mergedIntoTaskId === void 0 && (!task.childTaskIds || task.childTaskIds.length === 0)
   ).sort(
@@ -38,9 +43,9 @@ function bindTodosToBoard(items, previous, board) {
     const requestedTaskId = item.kanbanBoardId === board.id ? item.kanbanTaskId : previousItem?.kanbanBoardId === board.id ? previousItem.kanbanTaskId : void 0;
     const title = normalizedTitle(item.content);
     const candidates = [
-      requestedTaskId ? board.tasks.find((task2) => task2.id === requestedTaskId) : void 0,
-      board.tasks.find((task2) => task2.id === item.id),
-      board.tasks.find((task2) => task2.origin?.taskId === item.id),
+      requestedTaskId ? taskById.get(requestedTaskId) : void 0,
+      taskById.get(item.id),
+      taskByOriginId.get(item.id),
       available.find((task2) => !used.has(task2.id) && normalizedTitle(task2.title) === title)
     ];
     const task = candidates.find((candidate) => candidate && !used.has(candidate.id));
@@ -80,7 +85,10 @@ async function createMissingManagedCards(items, board, ctx, warnings) {
           description: item.activeForm?.trim() || `Added from the session todo list: ${item.content}`
         },
         // The card mirrors this session's todo row, so the session owns it.
-        { sessionId: ctx.eventSessionId?.() ?? ctx.session?.id ?? "default-session", actor: "todo" }
+        {
+          sessionId: ctx.eventSessionId?.() ?? ctx.session?.id ?? "default-session",
+          actor: "todo"
+        }
       );
       if (!result) {
         warnings.push(`Could not open a Kanban card for "${item.content}": board not found.`);
@@ -287,8 +295,40 @@ var todoTool = {
     required: ["todos"]
   },
   async execute(input, ctx, call) {
+    const signal = call?.signal ?? ctx.signal ?? new AbortController().signal;
+    signal.throwIfAborted();
     if (!Array.isArray(input?.todos)) {
-      throw new Error("todo: todos must be an array");
+      throw new ToolValidationError({
+        message: "todo: todos must be an array",
+        field: "todos"
+      });
+    }
+    const VALID_STATUSES = /* @__PURE__ */ new Set(["pending", "in_progress", "completed"]);
+    for (const item of input.todos) {
+      if (!item || typeof item !== "object") {
+        throw new ToolValidationError({
+          message: "todo: each item in todos must be an object",
+          field: "todos"
+        });
+      }
+      if (!item.id || typeof item.id !== "string" || !item.id.trim()) {
+        throw new ToolValidationError({
+          message: 'todo: each item must have a non-empty string "id"',
+          field: "todos"
+        });
+      }
+      if (item.content === void 0 || typeof item.content !== "string") {
+        throw new ToolValidationError({
+          message: `todo: item "${item.id}" must have a string "content"`,
+          field: "todos"
+        });
+      }
+      if (item.status !== void 0 && !VALID_STATUSES.has(item.status)) {
+        throw new ToolValidationError({
+          message: `todo: item "${item.id}" has invalid status "${item.status}". Allowed: pending, in_progress, completed`,
+          field: "todos"
+        });
+      }
     }
     const items = input.todos.filter((t) => Boolean(t?.id && t.content));
     const todoIdentity = (item) => item.kanbanBoardId && item.kanbanTaskId ? `kanban:${item.kanbanBoardId}:${item.kanbanTaskId}` : item.promotedFromTask ? `task:${item.promotedFromTask}` : item.promotedFromPlan ? `plan:${item.promotedFromPlan}` : `todo:${item.id}`;
@@ -330,7 +370,7 @@ var todoTool = {
       boundItems = demoteBlockedInProgress(boundItems, creationWarnings);
     }
     ctx.state.replaceTodos(boundItems);
-    const kanbanSync = managed && board ? await synchronizeManagedKanban(boundItems, board, ctx, call.signal) : { synced: 0, warnings: [] };
+    const kanbanSync = managed && board ? await synchronizeManagedKanban(boundItems, board, ctx, signal) : { synced: 0, warnings: [] };
     kanbanSync.warnings.unshift(...creationWarnings);
     if (managed && board) {
       const unresolved = boundItems.filter(
@@ -371,34 +411,39 @@ var todoTool = {
         );
       }
     }
-    for (const planId of completedPlanIds) {
-      if (pendingPlanIds.has(planId)) continue;
-      const meta = ctx.meta;
-      const planPath = meta["plan.path.resolved"] ?? meta["plan.path"];
-      if (typeof planPath !== "string" || !planPath) continue;
+    const meta = ctx.meta;
+    const planPath = meta?.["plan.path.resolved"] ?? meta?.["plan.path"];
+    if (typeof planPath === "string" && planPath && completedPlanIds.size > 0) {
       try {
-        const plan = await loadPlan(planPath);
+        let plan = await loadPlan(planPath);
         if (plan) {
-          const updated = setPlanItemStatus(plan, planId, "done");
-          await savePlan(planPath, updated);
+          let modified = false;
+          for (const planId of completedPlanIds) {
+            if (pendingPlanIds.has(planId)) continue;
+            plan = setPlanItemStatus(plan, planId, "done");
+            modified = true;
+          }
+          if (modified) await savePlan(planPath, plan);
         }
       } catch {
       }
     }
-    for (const taskId of completedTaskIds) {
-      if (pendingTaskIds.has(taskId)) continue;
-      const meta = ctx.meta;
-      const taskPath = meta["task.path.resolved"] ?? meta["task.path"];
-      if (typeof taskPath !== "string" || !taskPath) continue;
+    const taskPath = meta?.["task.path.resolved"] ?? meta?.["task.path"];
+    if (typeof taskPath === "string" && taskPath && completedTaskIds.size > 0) {
       try {
         const file = await loadTasks(taskPath);
         if (file) {
-          const task = file.tasks.find((t) => t.id === taskId);
-          if (task && task.status !== "completed") {
-            task.status = "completed";
-            task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-            await saveTasks(taskPath, file);
+          let modified = false;
+          for (const taskId of completedTaskIds) {
+            if (pendingTaskIds.has(taskId)) continue;
+            const task = file.tasks.find((t) => t.id === taskId);
+            if (task && task.status !== "completed") {
+              task.status = "completed";
+              task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+              modified = true;
+            }
           }
+          if (modified) await saveTasks(taskPath, file);
         }
       } catch {
       }
@@ -431,4 +476,4 @@ var todoTool = {
 export {
   todoTool
 };
-//# sourceMappingURL=chunk-5ZYEGP2P.js.map
+//# sourceMappingURL=chunk-BK732J7I.js.map

package/dist/{chunk-KD5EHYA2.js → chunk-C2DQKVLO.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-NBDZMMG2.js";
 import {
   truncateMiddle
-} from "./chunk-QLF74MSV.js";
+} from "./chunk-ZUFHAHTE.js";
 
 // src/fetch.ts
 import { FetchError, ToolError, ToolValidationError } from "@wrongstack/core/types";
@@ -79,13 +79,29 @@ var fetchTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    if (!input?.url) {
+    if (!input?.url || typeof input.url !== "string" || !input.url.trim()) {
       throw new ToolValidationError({
-        message: "fetch: url is required",
+        message: "fetch: url is required and cannot be empty",
         field: "url"
       });
     }
-    const u = new URL(input.url);
+    const trimmedUrl = input.url.trim();
+    let u;
+    try {
+      u = new URL(trimmedUrl);
+    } catch {
+      throw new ToolValidationError({
+        message: `fetch: invalid URL "${input.url}"`,
+        field: "url"
+      });
+    }
+    const ALLOWED_FORMATS = /* @__PURE__ */ new Set(["markdown", "text", "raw"]);
+    if (input.format !== void 0 && !ALLOWED_FORMATS.has(input.format)) {
+      throw new ToolValidationError({
+        message: `fetch: unsupported format "${input.format}". Allowed formats: markdown, text, raw`,
+        field: "format"
+      });
+    }
     if (u.username || u.password) {
       throw new ToolValidationError({
         message: "fetch: URLs with embedded credentials (user:pass@host) are not allowed",
@@ -105,8 +121,9 @@ var fetchTool = {
       });
     }
     await assertNotPrivate(u.hostname);
-    yield { type: "log", text: `GET ${input.url}` };
+    yield { type: "log", text: `GET ${trimmedUrl}` };
     const signal = opts?.signal ?? ctx.signal ?? new AbortController().signal;
+    signal.throwIfAborted();
     const ctrl = new AbortController();
     const timer = setTimeout(
       () => ctrl.abort(
@@ -122,10 +139,10 @@ var fetchTool = {
     try {
       let res;
       try {
-        res = await guardedFetch(input.url, 5, combined);
+        res = await guardedFetch(trimmedUrl, 5, combined);
       } catch (err) {
         if (signal.aborted) throw err;
-        throw describeFetchError(err, input.url, ctrl.signal.aborted);
+        throw describeFetchError(err, trimmedUrl, ctrl.signal.aborted);
       }
       const ct = res.headers.get("content-type") ?? "application/octet-stream";
       if (/^image\/|^audio\/|^video\/|application\/octet-stream/.test(ct)) {
@@ -146,31 +163,46 @@ var fetchTool = {
       let pendingBytes = 0;
       const FLUSH_AT = 4 * 1024;
       if (reader) {
-        for (; ; ) {
-          const { value, done } = await reader.read();
-          if (done) break;
-          if (!value) continue;
-          received += value.byteLength;
-          pendingBytes += value.byteLength;
-          chunks.push(value);
-          if (pendingBytes >= FLUSH_AT) {
-            const recent = Buffer.from(value).toString("utf-8");
-            yield {
-              type: "partial_output",
-              text: recent,
-              data: { received }
-            };
-            pendingBytes = 0;
+        try {
+          for (; ; ) {
+            const { value, done } = await reader.read();
+            if (done) break;
+            if (!value) continue;
+            received += value.byteLength;
+            pendingBytes += value.byteLength;
+            chunks.push(value);
+            if (pendingBytes >= FLUSH_AT) {
+              const recent = Buffer.from(value.buffer, value.byteOffset, value.byteLength).toString(
+                "utf8"
+              );
+              yield {
+                type: "partial_output",
+                text: recent,
+                data: { received }
+              };
+              pendingBytes = 0;
+            }
+            if (received > MAX_BYTES) {
+              await reader.cancel().catch(() => {
+              });
+              break;
+            }
           }
-          if (received > MAX_BYTES) break;
+        } finally {
+          reader.releaseLock();
         }
       }
-      const text = Buffer.concat(chunks.map((c) => Buffer.from(c))).toString("utf8");
-      const format = input.format ?? (ct.includes("text/html") ? "markdown" : "text");
+      const text = Buffer.concat(chunks).toString("utf8");
+      const isHtml = ct.includes("text/html");
+      const isJson = /[\/+]json(;|$)/i.test(ct);
+      const format = input.format ?? (isHtml ? "markdown" : "text");
       let content;
       if (format === "raw") content = text;
-      else if (format === "markdown" && ct.includes("text/html")) content = TD.turndown(text);
-      else if (ct.includes("application/json")) content = prettyJson(text);
+      else if (format === "markdown" && isHtml) content = TD.turndown(text);
+      else if (format === "markdown" && isJson) content = `\`\`\`json
+${prettyJson(text)}
+\`\`\``;
+      else if (isJson) content = prettyJson(text);
       else content = text;
       yield {
         type: "final",
@@ -226,6 +258,7 @@ function describeFetchError(err, url, timedOut) {
   });
 }
 function prettyJson(s) {
+  if (!s || s.length > 5e5) return s;
   try {
     return JSON.stringify(JSON.parse(s), null, 2);
   } catch {
@@ -236,4 +269,4 @@ function prettyJson(s) {
 export {
   fetchTool
 };
-//# sourceMappingURL=chunk-KD5EHYA2.js.map
+//# sourceMappingURL=chunk-C2DQKVLO.js.map