@wrongstack/tools 1.0.2 → 1.0.3

package/dist/{chunk-HWXIRVKH.js → chunk-PNLDTRC5.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-XRNN44QY.js";
 import {
   spawnStream
-} from "./chunk-DRRY6SCM.js";
+} from "./chunk-EMA2XENR.js";
 import {
   codebaseContext,
   codebaseIndexStats,
@@ -15,7 +15,7 @@ import {
   outgoingCallsService,
   runStartupIndex,
   searchCodebaseIndex
-} from "./chunk-TI5COGLY.js";
+} from "./chunk-CVNCSMVU.js";
 import {
   IndexTimeoutError,
   SCHEMA_VERSION,
@@ -26,7 +26,7 @@ import {
   posixIndexPath,
   resolveIndexDir,
   xxhash64String
-} from "./chunk-52UXXQMP.js";
+} from "./chunk-3JVSOBHU.js";
 import {
   EXT_TO_LANG,
   detectLang,
@@ -875,6 +875,7 @@ var codebaseImpactAnalysisTool = {
 };
 
 // src/codebase-index/codebase-incoming-calls-tool.ts
+import { ToolValidationError } from "@wrongstack/core/types";
 import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
 var codebaseIncomingCallsTool = {
   name: "codebase-incoming-calls",
@@ -912,6 +913,12 @@ var codebaseIncomingCallsTool = {
     required: ["symbol"]
   },
   async execute(input, ctx) {
+    if (!input?.symbol || typeof input.symbol !== "string" || !input.symbol.trim()) {
+      throw new ToolValidationError({
+        message: "codebase-incoming-calls: symbol is required and cannot be empty",
+        field: "symbol"
+      });
+    }
     const state = getIndexState();
     if (state.lastError) {
       const circuit = state.circuit;
@@ -1007,10 +1014,10 @@ var codebaseIncomingCallsTool = {
 };
 
 // src/codebase-index/codebase-index-tool.ts
-import { ToolValidationError as ToolValidationError2 } from "@wrongstack/core/types";
+import { ToolValidationError as ToolValidationError3 } from "@wrongstack/core/types";
 
 // src/codebase-index/codebase-search-tool.ts
-import { ToolValidationError } from "@wrongstack/core/types";
+import { ToolValidationError as ToolValidationError2 } from "@wrongstack/core/types";
 import { toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
 var INDEXABLE_LANG_IDS = [
   ...new Set(Object.values(EXT_TO_LANG))
@@ -1088,13 +1095,13 @@ var codebaseSearchTool = {
   },
   async execute(input, ctx, execOpts) {
     if (!input?.query || typeof input.query !== "string" || !input.query.trim()) {
-      throw new ToolValidationError({
+      throw new ToolValidationError2({
         message: "codebase-search: query is required and cannot be empty",
         field: "query"
       });
     }
     if (input.lspKind !== void 0 && (!Number.isInteger(input.lspKind) || input.lspKind < 1 || input.lspKind > 26)) {
-      throw new ToolValidationError({
+      throw new ToolValidationError2({
         message: "codebase-search: lspKind must be an integer between 1 and 26",
         field: "lspKind"
       });
@@ -1212,7 +1219,7 @@ var codebaseIndexTool = {
     signal?.throwIfAborted();
     if (input.langs) {
       if (!Array.isArray(input.langs) || input.langs.length === 0) {
-        throw new ToolValidationError2({
+        throw new ToolValidationError3({
           message: "codebase-index: langs cannot be an empty array. Pass at least one valid language or omit langs.",
           field: "langs"
         });
@@ -1221,7 +1228,7 @@ var codebaseIndexTool = {
         (lang) => !INDEXABLE_LANG_IDS.includes(lang)
       );
       if (unknown.length > 0) {
-        throw new ToolValidationError2({
+        throw new ToolValidationError3({
           message: `codebase-index: unknown lang(s) ${unknown.map((l) => `"${l}"`).join(", ")}. Valid ids: ${INDEXABLE_LANG_IDS.join(", ")}.`,
           field: "langs"
         });
@@ -1350,6 +1357,7 @@ var codebaseInvariantCheckTool = {
 };
 
 // src/codebase-index/codebase-outgoing-calls-tool.ts
+import { ToolValidationError as ToolValidationError4 } from "@wrongstack/core/types";
 import { toErrorMessage as toErrorMessage6 } from "@wrongstack/core/utils";
 var codebaseOutgoingCallsTool = {
   name: "codebase-outgoing-calls",
@@ -1387,6 +1395,12 @@ var codebaseOutgoingCallsTool = {
     required: ["symbol"]
   },
   async execute(input, ctx) {
+    if (!input?.symbol || typeof input.symbol !== "string" || !input.symbol.trim()) {
+      throw new ToolValidationError4({
+        message: "codebase-outgoing-calls: symbol is required and cannot be empty",
+        field: "symbol"
+      });
+    }
     const state = getIndexState();
     if (state.lastError) {
       const circuit = state.circuit;
@@ -3554,7 +3568,7 @@ async function buildProjectAtlasBrief(projectRoot, opts = {}) {
 }
 
 // src/codebase-index/codebase-context-tool.ts
-import { ToolValidationError as ToolValidationError3 } from "@wrongstack/core/types";
+import { ToolValidationError as ToolValidationError5 } from "@wrongstack/core/types";
 import { toErrorMessage as toErrorMessage11 } from "@wrongstack/core/utils";
 var TOOL_TIMEOUT_MS = 35e3;
 var VECTOR_HIT_LIMIT = 12;
@@ -3617,7 +3631,7 @@ var codebaseContextTool = {
   async execute(input, ctx, execOpts) {
     const query = typeof input.query === "string" ? input.query.trim() : "";
     if (query.length === 0) {
-      throw new ToolValidationError3({
+      throw new ToolValidationError5({
         message: "codebase-context requires a non-empty `query`.",
         field: "query"
       });
@@ -4033,4 +4047,4 @@ export {
   embedFiles,
   embedProjectFiles
 };
-//# sourceMappingURL=chunk-HWXIRVKH.js.map
+//# sourceMappingURL=chunk-PNLDTRC5.js.map

package/dist/{chunk-KVTEIUND.js → chunk-QU2VRCMM.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-MSOAX3GC.js";
 import {
   enqueueReindex
-} from "./chunk-TI5COGLY.js";
+} from "./chunk-CVNCSMVU.js";
 import {
   safeResolveReal,
   sha256hex,
@@ -179,4 +179,4 @@ async function finishWrite(input, ctx, prepared, signal) {
 export {
   writeTool
 };
-//# sourceMappingURL=chunk-KVTEIUND.js.map
+//# sourceMappingURL=chunk-QU2VRCMM.js.map

package/dist/{chunk-3AU6CZWL.js → chunk-REWOZIA4.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-ZKC5UNGD.js";
 import {
   resolveWin32Command
-} from "./chunk-KE7A76VC.js";
+} from "./chunk-5U5ULQX2.js";
 
 // src/codebase-index/py-parser.ts
 import { spawn } from "node:child_process";
@@ -384,4 +384,4 @@ export {
   parseSymbols,
   resolvePythonBinary
 };
-//# sourceMappingURL=chunk-3AU6CZWL.js.map
+//# sourceMappingURL=chunk-REWOZIA4.js.map

package/dist/{chunk-MGPR7VG3.js → chunk-T7YVY2BV.js}

@@ -15,7 +15,7 @@ import {
 import {
   buildWin32CmdShimInvocation,
   resolveWin32Command
-} from "./chunk-KE7A76VC.js";
+} from "./chunk-5U5ULQX2.js";
 import {
   COMMAND_OUTPUT_MAX_BYTES,
   normalizeCommandOutput,
@@ -1835,4 +1835,4 @@ export {
   getExecAllowlist,
   execTool
 };
-//# sourceMappingURL=chunk-MGPR7VG3.js.map
+//# sourceMappingURL=chunk-T7YVY2BV.js.map

package/dist/{chunk-UCXFTCAI.js → chunk-TYRVYBHW.js}

@@ -15,13 +15,13 @@ import {
   codebaseStatsTool,
   codebaseTargetedTestTool,
   deadCodeScanTool
-} from "./chunk-HWXIRVKH.js";
+} from "./chunk-PNLDTRC5.js";
 import {
   planTool
-} from "./chunk-5KS24LTS.js";
+} from "./chunk-NOCU555K.js";
 import {
   taskTool
-} from "./chunk-LQSOU63Z.js";
+} from "./chunk-VKAJMHVG.js";
 import {
   toolSearchTool
 } from "./chunk-24T5XIJU.js";
@@ -39,16 +39,16 @@ import {
 } from "./chunk-IXIS7RSG.js";
 import {
   testTool
-} from "./chunk-QA6IASYX.js";
+} from "./chunk-Z34CUZCZ.js";
 import {
   installTool
-} from "./chunk-O6BY43ZB.js";
+} from "./chunk-MIV2RU5B.js";
 import {
   auditTool
-} from "./chunk-WEEVSWQB.js";
+} from "./chunk-KIQTABBJ.js";
 import {
   outdatedTool
-} from "./chunk-6GOZTS6F.js";
+} from "./chunk-OUEH4I4X.js";
 import {
   logsTool
 } from "./chunk-VU3QBYL4.js";
@@ -63,7 +63,7 @@ import {
 } from "./chunk-AQ5YBURX.js";
 import {
   patchTool
-} from "./chunk-TU5MTW2S.js";
+} from "./chunk-E2ZD4ERD.js";
 import {
   jsonTool
 } from "./chunk-VZGPASGD.js";
@@ -75,21 +75,21 @@ import {
 } from "./chunk-JDOO4P6Z.js";
 import {
   lintTool
-} from "./chunk-3D5DJWOE.js";
+} from "./chunk-FC3X7GGJ.js";
 import {
   formatTool
-} from "./chunk-NJX2RXKJ.js";
+} from "./chunk-YDTRKEYY.js";
 import {
   typecheckTool
-} from "./chunk-4WPBS45A.js";
+} from "./chunk-IRUEHGCR.js";
 import {
   languageInfoTool,
   languagePackageTool,
   languageTool
-} from "./chunk-7N5U2RAU.js";
+} from "./chunk-3LS3FYEF.js";
 import {
   replaceTool
-} from "./chunk-DKHMPKDG.js";
+} from "./chunk-77MBK46T.js";
 import {
   globTool
 } from "./chunk-ASEXQRA7.js";
@@ -101,11 +101,11 @@ import {
   checkAndBlockKillCommand,
   diagnoseBashism,
   shellArgs
-} from "./chunk-6H4ERJP7.js";
+} from "./chunk-KYVOTHG7.js";
 import {
   detectDanger,
   execTool
-} from "./chunk-MGPR7VG3.js";
+} from "./chunk-T7YVY2BV.js";
 import {
   buildChildEnv
 } from "./chunk-BTSFTGIL.js";
@@ -119,13 +119,13 @@ import {
 } from "./chunk-HDYUBRMF.js";
 import {
   fetchTool
-} from "./chunk-MJSJWXBF.js";
+} from "./chunk-DX5KZEMK.js";
 import {
   searchTool
 } from "./chunk-62OAECEQ.js";
 import {
   todoTool
-} from "./chunk-FBUP524S.js";
+} from "./chunk-4YKVHCQC.js";
 import {
   kanbanTool
 } from "./chunk-SMARDKAC.js";
@@ -134,16 +134,16 @@ import {
 } from "./chunk-SOR7OCYP.js";
 import {
   readTool
-} from "./chunk-UOYRAS4J.js";
+} from "./chunk-YECHJJJF.js";
 import {
   writeTool
-} from "./chunk-KVTEIUND.js";
+} from "./chunk-QU2VRCMM.js";
 import {
   editTool
-} from "./chunk-7XUEPBNT.js";
+} from "./chunk-AMURQAJX.js";
 import {
   resolvePowerShell
-} from "./chunk-KE7A76VC.js";
+} from "./chunk-5U5ULQX2.js";
 import {
   normalizeCommandOutput,
   safeResolveProjectPath,
@@ -1438,4 +1438,4 @@ export {
   TIER3_TOOLS,
   builtinTools
 };
-//# sourceMappingURL=chunk-UCXFTCAI.js.map
+//# sourceMappingURL=chunk-TYRVYBHW.js.map

package/dist/{chunk-LQSOU63Z.js → chunk-VKAJMHVG.js}

@@ -1,6 +1,6 @@
 import {
   todoTool
-} from "./chunk-FBUP524S.js";
+} from "./chunk-4YKVHCQC.js";
 import {
   mirrorSessionTasksToKanban
 } from "./chunk-X6KXNHUO.js";
@@ -582,4 +582,4 @@ ${formatTaskList(file.tasks)}` : file.tasks.length > 0 ? formatTaskList(file.tas
 export {
   taskTool
 };
-//# sourceMappingURL=chunk-LQSOU63Z.js.map
+//# sourceMappingURL=chunk-VKAJMHVG.js.map

package/dist/{chunk-EL2NJXSK.js → chunk-VO6M2FVG.js}

@@ -1,6 +1,6 @@
 import {
   builtinTools
-} from "./chunk-UCXFTCAI.js";
+} from "./chunk-TYRVYBHW.js";
 
 // src/pack.ts
 var builtinToolsPack = {
@@ -12,4 +12,4 @@ var builtinToolsPack = {
 export {
   builtinToolsPack
 };
-//# sourceMappingURL=chunk-EL2NJXSK.js.map
+//# sourceMappingURL=chunk-VO6M2FVG.js.map

package/dist/{chunk-NJX2RXKJ.js → chunk-YDTRKEYY.js}

@@ -1,9 +1,9 @@
 import {
   tryLegacyCodeOperation
-} from "./chunk-T3SMFF5Q.js";
+} from "./chunk-GU7QJ37F.js";
 import {
   spawnStream
-} from "./chunk-DRRY6SCM.js";
+} from "./chunk-EMA2XENR.js";
 import {
   ensureInsideRoot,
   normalizeCommandOutput,
@@ -149,6 +149,14 @@ var formatTool = {
         });
       }
     }
+    for (const f of fileList) {
+      if (f.startsWith("-")) {
+        throw new ToolValidationError({
+          message: `format: file path "${f}" may not begin with '-' (flag injection)`,
+          field: "files"
+        });
+      }
+    }
     let args;
     if (detected === "prettier") {
       args = [input.check ? "--check" : "--write"];
@@ -243,4 +251,4 @@ export {
   parseFormatterCounts,
   detectFixer
 };
-//# sourceMappingURL=chunk-NJX2RXKJ.js.map
+//# sourceMappingURL=chunk-YDTRKEYY.js.map

package/dist/{chunk-UOYRAS4J.js → chunk-YECHJJJF.js}

@@ -1,10 +1,10 @@
 import {
   getIndexState,
   searchCodebaseIndex
-} from "./chunk-TI5COGLY.js";
+} from "./chunk-CVNCSMVU.js";
 import {
   codebaseIndexDirOverride
-} from "./chunk-52UXXQMP.js";
+} from "./chunk-3JVSOBHU.js";
 import {
   isBinaryBuffer,
   safeResolveReal,
@@ -340,4 +340,4 @@ ${interesting.join("\n")}` : "symbols/imports: (none detected)"
 export {
   readTool
 };
-//# sourceMappingURL=chunk-UOYRAS4J.js.map
+//# sourceMappingURL=chunk-YECHJJJF.js.map

package/dist/{chunk-QA6IASYX.js → chunk-Z34CUZCZ.js}

@@ -1,9 +1,9 @@
 import {
   tryLegacyCodeOperation
-} from "./chunk-T3SMFF5Q.js";
+} from "./chunk-GU7QJ37F.js";
 import {
   spawnStream
-} from "./chunk-DRRY6SCM.js";
+} from "./chunk-EMA2XENR.js";
 import {
   normalizeCommandOutput,
   safeResolveReal
@@ -231,4 +231,4 @@ ${result.stderr}` : result.stdout || result.stderr || result.error || "";
 export {
   testTool
 };
-//# sourceMappingURL=chunk-QA6IASYX.js.map
+//# sourceMappingURL=chunk-Z34CUZCZ.js.map

package/dist/codebase-index/index.js

@@ -51,9 +51,9 @@ import {
   setContextQueryEmbedder,
   writeAtlas,
   writeProjectAtlas
-} from "../chunk-HWXIRVKH.js";
+} from "../chunk-PNLDTRC5.js";
 import "../chunk-XRNN44QY.js";
-import "../chunk-DRRY6SCM.js";
+import "../chunk-EMA2XENR.js";
 import "../chunk-SCMRM6NL.js";
 import "../chunk-HDYUBRMF.js";
 import "../chunk-7JJFC6CT.js";
@@ -78,11 +78,11 @@ import {
   shutdownCodebaseIndexHost,
   shutdownCodebaseIndexServer,
   symbolGraphService
-} from "../chunk-TI5COGLY.js";
+} from "../chunk-CVNCSMVU.js";
 import {
   projectIndexServerEndpoint,
   projectIndexServerMetadataPath
-} from "../chunk-MBR5VAB5.js";
+} from "../chunk-6ZLRRC74.js";
 import {
   CONCEPT_RELATIONS,
   CONTRADICTED_VISIBILITY_WEIGHT,
@@ -122,9 +122,9 @@ import {
   shouldRefreshRanks,
   toSymbolRankRows,
   tokenise
-} from "../chunk-52UXXQMP.js";
-import "../chunk-DL2ARI4S.js";
-import "../chunk-3AU6CZWL.js";
+} from "../chunk-3JVSOBHU.js";
+import "../chunk-6LCKF5KH.js";
+import "../chunk-REWOZIA4.js";
 import "../chunk-6IEBD27U.js";
 import {
   getCodebaseIndexPerfSnapshot,
@@ -139,7 +139,7 @@ import {
   compileGitignore,
   loadGitignoreMatcher
 } from "../chunk-2CTZW6JQ.js";
-import "../chunk-KE7A76VC.js";
+import "../chunk-5U5ULQX2.js";
 import "../chunk-ZUFHAHTE.js";
 export {
   ATLAS_DIR,

package/dist/codebase-index/parser-worker-script.js

@@ -1,11 +1,11 @@
 import {
   parseFilesContent
-} from "../chunk-DL2ARI4S.js";
-import "../chunk-3AU6CZWL.js";
+} from "../chunk-6LCKF5KH.js";
+import "../chunk-REWOZIA4.js";
 import "../chunk-6IEBD27U.js";
 import "../chunk-ZKC5UNGD.js";
 import "../chunk-YOHO4DVT.js";
-import "../chunk-KE7A76VC.js";
+import "../chunk-5U5ULQX2.js";
 
 // src/codebase-index/parser-worker-script.ts
 import { parentPort, threadId } from "node:worker_threads";

package/dist/codebase-index/project-server.js

@@ -10,7 +10,7 @@ import {
   projectIndexServerBuildId,
   projectIndexServerEndpoint,
   projectIndexServerMetadataPath
-} from "../chunk-MBR5VAB5.js";
+} from "../chunk-6ZLRRC74.js";
 import {
   contextService,
   fileGraphService,
@@ -24,9 +24,9 @@ import {
   statsService,
   symbolGraphService,
   vectorSearchService
-} from "../chunk-52UXXQMP.js";
-import "../chunk-DL2ARI4S.js";
-import "../chunk-3AU6CZWL.js";
+} from "../chunk-3JVSOBHU.js";
+import "../chunk-6LCKF5KH.js";
+import "../chunk-REWOZIA4.js";
 import "../chunk-6IEBD27U.js";
 import {
   recordWriteQueueWait
@@ -35,7 +35,7 @@ import {
   isIndexablePath
 } from "../chunk-YOHO4DVT.js";
 import "../chunk-2CTZW6JQ.js";
-import "../chunk-KE7A76VC.js";
+import "../chunk-5U5ULQX2.js";
 
 // src/codebase-index/project-server.ts
 import { randomBytes } from "node:crypto";

package/dist/codebase-index/worker.js

@@ -9,14 +9,14 @@ import {
   statsService,
   symbolGraphService,
   vectorSearchService
-} from "../chunk-52UXXQMP.js";
-import "../chunk-DL2ARI4S.js";
-import "../chunk-3AU6CZWL.js";
+} from "../chunk-3JVSOBHU.js";
+import "../chunk-6LCKF5KH.js";
+import "../chunk-REWOZIA4.js";
 import "../chunk-6IEBD27U.js";
 import "../chunk-ZKC5UNGD.js";
 import "../chunk-YOHO4DVT.js";
 import "../chunk-2CTZW6JQ.js";
-import "../chunk-KE7A76VC.js";
+import "../chunk-5U5ULQX2.js";
 
 // src/codebase-index/worker.ts
 import { parentPort } from "node:worker_threads";

package/dist/edit.js

@@ -1,17 +1,17 @@
 import {
   editTool
-} from "./chunk-7XUEPBNT.js";
+} from "./chunk-AMURQAJX.js";
 import "./chunk-MSOAX3GC.js";
-import "./chunk-TI5COGLY.js";
-import "./chunk-MBR5VAB5.js";
-import "./chunk-52UXXQMP.js";
-import "./chunk-DL2ARI4S.js";
-import "./chunk-3AU6CZWL.js";
+import "./chunk-CVNCSMVU.js";
+import "./chunk-6ZLRRC74.js";
+import "./chunk-3JVSOBHU.js";
+import "./chunk-6LCKF5KH.js";
+import "./chunk-REWOZIA4.js";
 import "./chunk-6IEBD27U.js";
 import "./chunk-ZKC5UNGD.js";
 import "./chunk-YOHO4DVT.js";
 import "./chunk-2CTZW6JQ.js";
-import "./chunk-KE7A76VC.js";
+import "./chunk-5U5ULQX2.js";
 import "./chunk-ZUFHAHTE.js";
 export {
   editTool

package/dist/exec.js

@@ -7,13 +7,13 @@ import {
   isExecCommandAllowed,
   resetDangerBypass,
   resetExecPolicy
-} from "./chunk-MGPR7VG3.js";
+} from "./chunk-T7YVY2BV.js";
 import "./chunk-BTSFTGIL.js";
 import "./chunk-PVCB7RUZ.js";
 import "./chunk-SCMRM6NL.js";
 import "./chunk-HDYUBRMF.js";
 import "./chunk-7JJFC6CT.js";
-import "./chunk-KE7A76VC.js";
+import "./chunk-5U5ULQX2.js";
 import "./chunk-ZUFHAHTE.js";
 export {
   configureDangerBypass,

package/dist/fetch.js

@@ -1,6 +1,6 @@
 import {
   fetchTool
-} from "./chunk-MJSJWXBF.js";
+} from "./chunk-DX5KZEMK.js";
 import {
   guardedFetch,
   guardedLookup

package/dist/format.js

@@ -2,14 +2,14 @@ import {
   detectFixer,
   formatTool,
   parseFormatterCounts
-} from "./chunk-NJX2RXKJ.js";
-import "./chunk-T3SMFF5Q.js";
-import "./chunk-7N5U2RAU.js";
-import "./chunk-DRRY6SCM.js";
+} from "./chunk-YDTRKEYY.js";
+import "./chunk-GU7QJ37F.js";
+import "./chunk-3LS3FYEF.js";
+import "./chunk-EMA2XENR.js";
 import "./chunk-SCMRM6NL.js";
 import "./chunk-HDYUBRMF.js";
 import "./chunk-7JJFC6CT.js";
-import "./chunk-KE7A76VC.js";
+import "./chunk-5U5ULQX2.js";
 import "./chunk-ZUFHAHTE.js";
 export {
   detectFixer,

package/dist/{go-parser-QIEXU3P2.js → go-parser-EMKTAAD3.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-YOHO4DVT.js";
 import {
   resolveWin32Command
-} from "./chunk-KE7A76VC.js";
+} from "./chunk-5U5ULQX2.js";
 
 // src/codebase-index/go-parser.ts
 import { spawn } from "node:child_process";
@@ -468,4 +468,4 @@ export {
   detectLang,
   parseSymbols
 };
-//# sourceMappingURL=go-parser-QIEXU3P2.js.map
+//# sourceMappingURL=go-parser-EMKTAAD3.js.map