@wrongstack/tools 0.319.0 → 0.320.1

package/dist/{chunk-PMHVSHMU.js → chunk-OTPTQBYE.js}

@@ -3,27 +3,28 @@ import {
 } from "./chunk-BTSFTGIL.js";
 import {
   getPersistentProcessRegistry
-} from "./chunk-NKNOBUBU.js";
+} from "./chunk-QGF2C7TF.js";
 import {
   createOutputSpool,
   spoolNote
-} from "./chunk-2VSZC6QM.js";
+} from "./chunk-SCMRM6NL.js";
 import {
   getProcessRegistry,
   redactCommand
-} from "./chunk-3PVYQFRQ.js";
+} from "./chunk-ESLPBT5A.js";
 import {
   buildWin32CmdShimInvocation,
   resolveWin32Command
-} from "./chunk-V43EQ6VR.js";
+} from "./chunk-KE7A76VC.js";
 import {
   COMMAND_OUTPUT_MAX_BYTES,
   normalizeCommandOutput,
   safeResolveReal
-} from "./chunk-QLF74MSV.js";
+} from "./chunk-ZUFHAHTE.js";
 
 // src/exec.ts
 import { spawn } from "node:child_process";
+import { StringDecoder } from "node:string_decoder";
 import {
   emitProcessCompleted,
   emitProcessOutput,
@@ -85,9 +86,9 @@ var RULES = [
     level: "destructive",
     test: (cmd, args) => {
       if (cmd !== "powershell" && cmd !== "pwsh") return false;
-      const hasRecurse = argMatches(args, /^-(?:r|recurse)/i);
-      const hasForce = argMatches(args, /^-(?:f|force)$/i);
-      if (argMatches(args, /^-whatif$/i)) return false;
+      const hasRecurse = argMatches(args, /^-(?:r|recurse)(?::\$true)?$/i);
+      const hasForce = argMatches(args, /^-(?:f|force)(?::\$true)?$/i);
+      if (argMatches(args, /^-whatif(?::\$true)?$/i)) return false;
       return hasRecurse && hasForce;
     },
     reason: "Remove-Item with -Recurse -Force"
@@ -99,7 +100,9 @@ var RULES = [
     test: (cmd, args) => {
       if (cmd !== "powershell" && cmd !== "pwsh") return false;
       return args.some(
-        (a) => /^(?:Format-Volume|Clear-Disk|Initialize-Disk|Remove-Partition|Clear-Volume)(?:\s|$)/i.test(a)
+        (a) => /^(?:Format-Volume|Clear-Disk|Initialize-Disk|Remove-Partition|Clear-Volume)(?:\s|$)/i.test(
+          a
+        )
       );
     },
     reason: "PowerShell disk/volume partition destruction"
@@ -233,6 +236,7 @@ var RULES = [
           continue;
         }
         if (a.startsWith("--force")) return true;
+        if (/^-[a-z]+$/i.test(a) && a.toLowerCase().includes("f")) return true;
       }
       return false;
     },
@@ -424,12 +428,14 @@ var RULES = [
   }
 ];
 function detectDanger(cmd, args, bypass) {
+  if (typeof cmd !== "string") return { level: "safe", reasons: [] };
+  const safeArgs = Array.isArray(args) ? args : [];
   const reasons = [];
   let level = "safe";
   let matchedRule;
   for (const rule of RULES) {
     if (bypass?.has(rule.id)) continue;
-    if (!rule.test(cmd, args)) continue;
+    if (!rule.test(cmd, safeArgs)) continue;
     reasons.push(rule.reason);
     if (matchedRule === void 0 || levelRank(rule.level) >= levelRank(level)) {
       matchedRule = rule.id;
@@ -1537,7 +1543,8 @@ var execTool = {
       };
     }
     const args = (input.args ?? []).slice(0, MAX_ARGS);
-    const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS));
+    const rawTimeout = typeof input.timeout === "number" && !Number.isNaN(input.timeout) ? input.timeout : DEFAULT_TIMEOUT_MS;
+    const timeout = Math.max(1, Math.min(rawTimeout, MAX_TIMEOUT_MS));
     const danger = detectDanger(cmd, args, dangerBypass);
     const killCheck = await checkExecKillCommand(cmd, args);
     if (killCheck.blocked) {
@@ -1582,7 +1589,30 @@ var execTool = {
       };
     }
     const signal = opts?.signal ?? ctx.signal ?? new AbortController().signal;
+    if (signal.aborted) {
+      return {
+        command: cmd,
+        args,
+        stdout: "",
+        stderr: "Aborted",
+        exitCode: 124,
+        truncated: false,
+        allowed: true,
+        danger
+      };
+    }
     return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id, danger);
+  },
+  async cleanup(_input, ctx) {
+    const registry = getProcessRegistry();
+    const sessionId = ctx.session?.id;
+    if (!sessionId) return;
+    for (const entry of registry.bySession(sessionId)) {
+      if (entry.name !== "exec") continue;
+      if (entry.child && entry.child.exitCode !== null) continue;
+      if (entry.protected) continue;
+      registry.kill(entry.pid, { force: true });
+    }
   }
 };
 function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
@@ -1602,6 +1632,20 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     let telemetryCompleted = false;
     let timedOut = false;
     const spool = createOutputSpool({ tool: `exec-${cmd}`, thresholdBytes: MAX_OUTPUT });
+    if (signal.aborted) {
+      spool.finalize();
+      finish({
+        command: cmd,
+        args,
+        stdout: "",
+        stderr: "Aborted",
+        exitCode: 124,
+        truncated: false,
+        allowed: true,
+        danger
+      });
+      return;
+    }
     const resolved = resolveWin32Command(cmd);
     const needsShell = isWin2 && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
     const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
@@ -1711,19 +1755,25 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
       if (signal.aborted) onAbort();
       else signal.addEventListener("abort", onAbort, { once: true });
     }
+    const stdoutDecoder = new StringDecoder("utf8");
+    const stderrDecoder = new StringDecoder("utf8");
     child.stdout?.on("data", (chunk) => {
-      const text = chunk.toString();
+      const text = stdoutDecoder.write(chunk);
       stdoutBytes += chunk.byteLength;
       emitProcessOutput({ pid, stream: "stdout", chunk });
-      if (stdout.length < MAX_OUTPUT) stdout += text;
-      spool.write(text);
+      if (text.length > 0) {
+        if (stdout.length < MAX_OUTPUT) stdout += text.slice(0, MAX_OUTPUT - stdout.length);
+        spool.write(text);
+      }
     });
     child.stderr?.on("data", (chunk) => {
-      const text = chunk.toString();
+      const text = stderrDecoder.write(chunk);
       stderrBytes += chunk.byteLength;
       emitProcessOutput({ pid, stream: "stderr", chunk });
-      if (stderr.length < MAX_OUTPUT) stderr += text;
-      spool.write(text);
+      if (text.length > 0) {
+        if (stderr.length < MAX_OUTPUT) stderr += text.slice(0, MAX_OUTPUT - stderr.length);
+        spool.write(text);
+      }
     });
     child.on("close", (code) => {
       clearTimeout(timer);
@@ -1733,14 +1783,25 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
       const exitCode = killed ? 124 : code ?? 1;
       emitCompletedOnce(exitCode, pid);
       registry.afterCall(durationMs, exitCode !== 0);
+      const stdoutTail = stdoutDecoder.end();
+      if (stdoutTail) {
+        if (stdout.length < MAX_OUTPUT) stdout += stdoutTail.slice(0, MAX_OUTPUT - stdout.length);
+        spool.write(stdoutTail);
+      }
+      const stderrTail = stderrDecoder.end();
+      if (stderrTail) {
+        if (stderr.length < MAX_OUTPUT) stderr += stderrTail.slice(0, MAX_OUTPUT - stderr.length);
+        spool.write(stderrTail);
+      }
       const spooled = spool.finalize();
+      const isTruncated = stdoutBytes > MAX_OUTPUT || stderrBytes > MAX_OUTPUT || Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES || Buffer.byteLength(stderr, "utf8") > COMMAND_OUTPUT_MAX_BYTES;
       finish({
         command: cmd,
         args,
         stdout: normalizeCommandOutput(stdout) + (spooled ? spoolNote(spooled) : ""),
         stderr: normalizeCommandOutput(stderr),
         exitCode,
-        truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES || Buffer.byteLength(stderr, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
+        truncated: isTruncated,
         allowed: true,
         danger
       });
@@ -1760,4 +1821,4 @@ export {
   getExecAllowlist,
   execTool
 };
-//# sourceMappingURL=chunk-PMHVSHMU.js.map
+//# sourceMappingURL=chunk-OTPTQBYE.js.map

package/dist/{chunk-ZHH3BEWU.js → chunk-OYP27E3I.js}

@@ -1,15 +1,15 @@
 import {
   createOutputSpool,
   spoolNote
-} from "./chunk-2VSZC6QM.js";
+} from "./chunk-SCMRM6NL.js";
 import {
   getProcessRegistry,
   redactCommand
-} from "./chunk-3PVYQFRQ.js";
+} from "./chunk-ESLPBT5A.js";
 import {
   buildWin32CmdShimInvocation,
   resolveWin32Command
-} from "./chunk-V43EQ6VR.js";
+} from "./chunk-KE7A76VC.js";
 
 // src/_spawn-stream.ts
 import { spawn } from "node:child_process";
@@ -258,4 +258,4 @@ function utf8Prefix(text, maxBytes) {
 export {
   spawnStream
 };
-//# sourceMappingURL=chunk-ZHH3BEWU.js.map
+//# sourceMappingURL=chunk-OYP27E3I.js.map

package/dist/{chunk-W4GAAI3M.js → chunk-PV6HIZQD.js}

@@ -1,6 +1,6 @@
 import {
   resolveIndexDir
-} from "./chunk-TFMVHYJI.js";
+} from "./chunk-J43O3BOX.js";
 
 // src/codebase-index/binary-frame.ts
 import { decode, encode } from "@msgpack/msgpack";
@@ -120,4 +120,4 @@ export {
   PROJECT_INDEX_SERVER_MAX_FRAME_CHARS,
   encodeProjectServerMessage
 };
-//# sourceMappingURL=chunk-W4GAAI3M.js.map
+//# sourceMappingURL=chunk-PV6HIZQD.js.map

package/dist/{chunk-NKNOBUBU.js → chunk-QGF2C7TF.js}

@@ -1,6 +1,6 @@
 import {
   getProcessRegistry
-} from "./chunk-3PVYQFRQ.js";
+} from "./chunk-ESLPBT5A.js";
 
 // src/process-registry-persistent.ts
 import * as fs from "node:fs/promises";
@@ -519,4 +519,4 @@ export {
   getPersistentProcessRegistry,
   resetPersistentProcessRegistry
 };
-//# sourceMappingURL=chunk-NKNOBUBU.js.map
+//# sourceMappingURL=chunk-QGF2C7TF.js.map

package/dist/{chunk-PQTONQ4P.js → chunk-QPNYDH5B.js}

@@ -56,17 +56,19 @@ var searchTool = {
     return final;
   },
   async *executeStream(input, ctx, opts) {
-    if (!input?.query || input.query.trim() === "") {
+    if (!input?.query || typeof input.query !== "string" || input.query.trim() === "") {
       throw new ToolValidationError({
         message: "search: query is required and must be a non-empty string",
         field: "query"
       });
     }
     const signal = opts?.signal ?? ctx?.signal ?? new AbortController().signal;
-    const num = Math.max(1, Math.min(input.num_results ?? DEFAULT_NUM, MAX_RESULTS));
+    const rawNum = typeof input.num_results === "number" && !Number.isNaN(input.num_results) ? input.num_results : DEFAULT_NUM;
+    const num = Math.max(1, Math.min(Math.floor(rawNum), MAX_RESULTS));
     const source = input.source ?? "duckduckgo";
     const skipCache = input.skip_cache ?? false;
-    const cacheKey = `${source}:${input.query}`;
+    const normalizedQuery = input.query.trim().toLowerCase().replace(/\s+/g, " ");
+    const cacheKey = `${source}:${normalizedQuery}`;
     if (!skipCache) {
       const entry = cache.get(cacheKey);
       if (entry && Date.now() - entry.timestamp < CACHE_TTL_MS) {
@@ -426,11 +428,23 @@ function capSnippet(snippet) {
   return snippet.length > MAX_SNIPPET_CHARS ? `${snippet.slice(0, MAX_SNIPPET_CHARS - 1)}\u2026` : snippet;
 }
 function decodeHtmlEntities(text) {
-  return text.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
+  return text.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&#x27;/gi, "'").replace(/&#039;/g, "'").replace(/&nbsp;/g, " ").replace(/&ndash;/g, "\u2013").replace(/&mdash;/g, "\u2014").replace(/&ldquo;|&rdquo;/g, '"').replace(/&lsquo;|&rsquo;/g, "'").replace(/&#(\d+);/g, (_, code) => {
+    try {
+      return String.fromCodePoint(Number(code));
+    } catch {
+      return _;
+    }
+  }).replace(/&#x([0-9a-f]+);/gi, (_, hex) => {
+    try {
+      return String.fromCodePoint(parseInt(hex, 16));
+    } catch {
+      return _;
+    }
+  });
 }
 
 export {
   searchTool,
   __clearSearchCache
 };
-//# sourceMappingURL=chunk-PQTONQ4P.js.map
+//# sourceMappingURL=chunk-QPNYDH5B.js.map

package/dist/{chunk-VFF3Q5Z3.js → chunk-QSNVDHOZ.js}

@@ -1,17 +1,18 @@
 import {
   tryLegacyCodeOperation
-} from "./chunk-ZDUGI5BC.js";
+} from "./chunk-I7FBZOEP.js";
 import {
   spawnStream
-} from "./chunk-ZHH3BEWU.js";
+} from "./chunk-OYP27E3I.js";
 import {
   detectPackageManager,
   normalizeCommandOutput,
   safeResolveReal
-} from "./chunk-QLF74MSV.js";
+} from "./chunk-ZUFHAHTE.js";
 
 // src/typecheck.ts
 import * as path from "node:path";
+import { ToolValidationError } from "@wrongstack/core/types";
 var typecheckTool = {
   name: "typecheck",
   category: "Code Quality",
@@ -50,6 +51,21 @@ var typecheckTool = {
   async *executeStream(input, ctx, opts) {
     const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const signal = opts?.signal ?? ctx.signal ?? new AbortController().signal;
+    signal.throwIfAborted();
+    if (input.all && input.project !== void 0) {
+      throw new ToolValidationError({
+        message: 'typecheck: cannot specify both "all: true" and "project"',
+        field: "project"
+      });
+    }
+    if (input.project !== void 0) {
+      if (typeof input.project !== "string" || !input.project.trim()) {
+        throw new ToolValidationError({
+          message: 'typecheck: "project" must be a non-empty string path',
+          field: "project"
+        });
+      }
+    }
     const bridge = await tryLegacyCodeOperation("semantic", {
       cwd,
       projectRoot: ctx.projectRoot,
@@ -86,7 +102,7 @@ var typecheckTool = {
         cmdArgs = ["tsc", ...tscArgs];
       }
     } else {
-      const tsconfig = input.project ? await safeResolveReal(input.project, ctx) : await findTsConfig(cwd);
+      const tsconfig = input.project ? await safeResolveReal(input.project.trim(), ctx) : await findTsConfig(cwd);
       const tscArgs = ["--noEmit"];
       if (input.strict) tscArgs.push("--strict");
       if (tsconfig) tscArgs.push("--project", tsconfig);
@@ -104,8 +120,13 @@ var typecheckTool = {
     });
     const combined = `${result.stdout}
 ${result.stderr}`;
-    const errors = [...combined.matchAll(/^.*\berror TS\d+:/gm)].length;
-    const warnings = [...combined.matchAll(/^.*\bwarning TS\d+:/gm)].length;
+    let errors = [...combined.matchAll(/^.*\berror TS\d+:/gmi)].length;
+    const warnings = [...combined.matchAll(/^.*\bwarning TS\d+:/gmi)].length;
+    if (errors === 0 && result.exitCode !== 0) {
+      errors = 1;
+    }
+    const rawOutput = result.stdout && result.stderr ? `${result.stdout}
+${result.stderr}` : result.stdout || result.stderr || result.error || "";
     yield {
       type: "final",
       output: {
@@ -113,7 +134,7 @@ ${result.stderr}`;
         exit_code: result.exitCode,
         errors,
         warnings,
-        output: normalizeCommandOutput(result.stdout || result.stderr || result.error || ""),
+        output: normalizeCommandOutput(rawOutput),
         truncated: result.truncated
       }
     };
@@ -121,7 +142,14 @@ ${result.stderr}`;
 };
 async function findTsConfig(cwd) {
   const { stat } = await import("node:fs/promises");
-  const candidates = ["tsconfig.json", "tsconfig.base.json"];
+  const candidates = [
+    "tsconfig.json",
+    "tsconfig.base.json",
+    "tsconfig.build.json",
+    "tsconfig.app.json",
+    "tsconfig.node.json",
+    "tsconfig.lib.json"
+  ];
   for (const f of candidates) {
     try {
       const s = await stat(path.join(cwd, f));
@@ -135,4 +163,4 @@ async function findTsConfig(cwd) {
 export {
   typecheckTool
 };
-//# sourceMappingURL=chunk-VFF3Q5Z3.js.map
+//# sourceMappingURL=chunk-QSNVDHOZ.js.map

package/dist/{chunk-45JPRMC2.js → chunk-QWKSKFKZ.js}

@@ -214,6 +214,7 @@ function unbracket(hostname) {
 function safeBrowserUrl(rawUrl) {
   try {
     const url = new URL(rawUrl);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return "about:blank";
     url.username = "";
     url.password = "";
     url.search = "";
@@ -224,8 +225,11 @@ function safeBrowserUrl(rawUrl) {
   }
 }
 function redactBrowserText(text) {
-  return text.replace(/\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi, "Bearer [REDACTED]").replace(
-    /\b(api[-_ ]?key|access[-_ ]?token|auth[-_ ]?token|token|password|secret)\b\s*[:=]\s*[^\s,;]+/gi,
+  return text.replace(/\bauthorization\b\s*[:=]\s*[^\r\n]+/gi, "Authorization=[REDACTED]").replace(
+    /\bauthorization\b\s*[:=]\s*(?:Basic|Bearer)\s+[^\s,;]+/gi,
+    "Authorization=[REDACTED]"
+  ).replace(/\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi, "Bearer [REDACTED]").replace(
+    /\b(authorization|set[-_ ]?cookie|cookie|api[-_ ]?key|private[-_ ]?key|client[-_ ]?secret|access[-_ ]?token|refresh[-_ ]?token|session[-_ ]?token|auth[-_ ]?token|token|password|secret)\b\s*[:=]\s*[^\s,;]+/gi,
     "$1=[REDACTED]"
   );
 }
@@ -1394,4 +1398,4 @@ export {
   browserTools,
   shutdownBrowserTools
 };
-//# sourceMappingURL=chunk-45JPRMC2.js.map
+//# sourceMappingURL=chunk-QWKSKFKZ.js.map

package/dist/{chunk-2VSZC6QM.js → chunk-SCMRM6NL.js}

@@ -29,13 +29,15 @@ function sweepOldSpoolFiles(dir) {
   })();
 }
 function spoolNote(info) {
+  if (!info) return "";
   const dropped = info.droppedBytes > 0 ? `, ~${info.droppedBytes} bytes dropped under backpressure` : "";
   return `
 [output truncated \u2014 full ${info.bytes} bytes at ${info.path}${dropped}; read/grep that file selectively instead of re-running with more output]`;
 }
 function createOutputSpool(opts) {
-  const threshold = opts.thresholdBytes ?? 32768;
-  const safeTool = opts.tool.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
+  const threshold = opts?.thresholdBytes ?? 32768;
+  const toolName = typeof opts?.tool === "string" ? opts.tool : "tool";
+  const safeTool = toolName.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
   let head = "";
   let headBytes = 0;
   let totalBytes = 0;
@@ -68,7 +70,7 @@ function createOutputSpool(opts) {
   };
   return {
     write(text) {
-      if (finalized || !text) return;
+      if (finalized || typeof text !== "string" || !text) return;
       const textBytes = Buffer.byteLength(text, "utf8");
       totalBytes += textBytes;
       if (!stream && !failed) {
@@ -110,4 +112,4 @@ export {
   spoolNote,
   createOutputSpool
 };
-//# sourceMappingURL=chunk-2VSZC6QM.js.map
+//# sourceMappingURL=chunk-SCMRM6NL.js.map

package/dist/{chunk-RJZQWEMS.js → chunk-T77XOX7E.js}

@@ -39,7 +39,8 @@ var toolSearchTool = {
     }
   },
   async execute(input, ctx) {
-    const limit = Math.min(input.limit ?? 20, 100);
+    const rawLimit = typeof input.limit === "number" && Number.isFinite(input.limit) ? input.limit : 20;
+    const limit = Math.max(1, Math.min(Math.floor(rawLimit), 100));
     const tools = ctx.catalogTools ?? ctx.tools;
     const query = input.query?.toLowerCase() ?? "";
     const filtered = tools.filter((t) => {
@@ -81,4 +82,4 @@ var toolSearchTool = {
 export {
   toolSearchTool
 };
-//# sourceMappingURL=chunk-RJZQWEMS.js.map
+//# sourceMappingURL=chunk-T77XOX7E.js.map

package/dist/{chunk-QZDOQRF7.js → chunk-UZFY3CKD.js}

@@ -1,17 +1,18 @@
 import {
   tryLegacyPackageOperation
-} from "./chunk-ZDUGI5BC.js";
+} from "./chunk-I7FBZOEP.js";
 import {
   spawnStream
-} from "./chunk-ZHH3BEWU.js";
+} from "./chunk-OYP27E3I.js";
 import {
   COMMAND_OUTPUT_MAX_BYTES,
   detectPackageManager,
   normalizeCommandOutput,
   safeResolveReal
-} from "./chunk-QLF74MSV.js";
+} from "./chunk-ZUFHAHTE.js";
 
 // src/audit.ts
+import { ToolValidationError } from "@wrongstack/core/types";
 var SEVERITY_RANK = {
   info: 0,
   low: 1,
@@ -56,12 +57,21 @@ var auditTool = {
   },
   async *executeStream(input, ctx, opts) {
     if (input.fix === true) {
-      throw new Error(
-        "audit: `fix: true` is not supported \u2014 this tool is read-only (mutating: false). To remediate vulnerabilities, upgrade the affected packages with the `install` tool (or `language_package` for non-JS ecosystems)."
-      );
+      throw new ToolValidationError({
+        message: "audit: `fix: true` is not supported \u2014 this tool is read-only (mutating: false). To remediate vulnerabilities, upgrade the affected packages with the `install` tool (or `language_package` for non-JS ecosystems).",
+        field: "fix"
+      });
+    }
+    const VALID_LEVELS = /* @__PURE__ */ new Set(["low", "moderate", "high", "critical"]);
+    if (input.level !== void 0 && !VALID_LEVELS.has(input.level)) {
+      throw new ToolValidationError({
+        message: `audit: invalid severity level "${input.level}". Allowed: low, moderate, high, critical`,
+        field: "level"
+      });
     }
     const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const signal = opts?.signal ?? ctx.signal ?? new AbortController().signal;
+    signal.throwIfAborted();
     const bridge = await tryLegacyPackageOperation("package-audit", {
       cwd,
       projectRoot: ctx.projectRoot,
@@ -173,13 +183,24 @@ function extractAdvisories(data) {
     for (const [pkg, value] of Object.entries(vulns)) {
       const vuln = value ?? {};
       const via = Array.isArray(vuln["via"]) ? vuln["via"] : [];
-      const detail = via.find((v) => !!v && typeof v === "object");
-      advisories.push({
-        severity: typeof vuln["severity"] === "string" ? vuln["severity"] : "unknown",
-        package: pkg,
-        title: detail && typeof detail["title"] === "string" ? detail["title"] : "Unknown vulnerability",
-        url: detail && typeof detail["url"] === "string" ? detail["url"] : ""
-      });
+      const details = via.filter((v) => !!v && typeof v === "object");
+      if (details.length > 0) {
+        for (const detail of details) {
+          advisories.push({
+            severity: typeof detail["severity"] === "string" ? detail["severity"] : typeof vuln["severity"] === "string" ? vuln["severity"] : "unknown",
+            package: pkg,
+            title: typeof detail["title"] === "string" ? detail["title"] : "Unknown vulnerability",
+            url: typeof detail["url"] === "string" ? detail["url"] : ""
+          });
+        }
+      } else {
+        advisories.push({
+          severity: typeof vuln["severity"] === "string" ? vuln["severity"] : "unknown",
+          package: pkg,
+          title: "Unknown vulnerability",
+          url: ""
+        });
+      }
     }
   }
   return advisories;
@@ -188,4 +209,4 @@ function extractAdvisories(data) {
 export {
   auditTool
 };
-//# sourceMappingURL=chunk-QZDOQRF7.js.map
+//# sourceMappingURL=chunk-UZFY3CKD.js.map