@wrongstack/tools 1.0.7 → 1.0.9

package/dist/{chunk-A3LNNBYO.js → chunk-QAWI3RSK.js}

@@ -14,8 +14,9 @@ import {
 } from "./chunk-HDYUBRMF.js";
 import {
   buildWin32CmdShimInvocation,
+  isWinCmdShim,
   resolveWin32Command
-} from "./chunk-5U5ULQX2.js";
+} from "./chunk-XZLVJD56.js";
 import {
   COMMAND_OUTPUT_MAX_BYTES,
   normalizeCommandOutput,
@@ -272,8 +273,10 @@ var RULES = [
       if (cmd !== "git") return false;
       const cleanIdx = args.indexOf("clean");
       if (cleanIdx < 0) return false;
-      return args.slice(cleanIdx + 1).some(
-        (a) => a === "-f" || a === "--force" || a.startsWith("-f") || a.startsWith("--force=")
+      const after = args.slice(cleanIdx + 1);
+      if (after.some((a) => a === "--dry-run" || /^-[a-z]*n[a-z]*$/i.test(a))) return false;
+      return after.some(
+        (a) => a === "--force" || a.startsWith("--force=") || /^-[a-z]+$/i.test(a) && a.toLowerCase().includes("f")
       );
     },
     reason: "git clean -f (deletes untracked files)"
@@ -1471,7 +1474,6 @@ function validateArgs(cmd, args) {
   }
   return null;
 }
-var SAFE_DANGER = { level: "safe", reasons: [] };
 var execTool = {
   name: "exec",
   category: "Shell",
@@ -1524,43 +1526,23 @@ var execTool = {
     },
     required: ["command"]
   },
+  // Refusals (breaker, allowlist, blocked args, kill guard, cwd containment)
+  // and launch failures THROW: a returned `allowed: false` / `exitCode: 1`
+  // payload was recorded by the executor as a successful call. Non-zero
+  // exits, timeouts and aborts remain data (the command did run).
   async execute(input, ctx, opts) {
     const registry = getProcessRegistry();
     if (!registry.canProceed) {
-      return {
-        command: input.command,
-        args: input.args ?? [],
-        stdout: "",
-        stderr: "Circuit breaker is open \u2014 too many consecutive failures. Use /kill reset to recover.",
-        exitCode: 1,
-        truncated: false,
-        allowed: false,
-        danger: SAFE_DANGER
-      };
+      throw new Error(
+        "exec: circuit breaker is open \u2014 too many consecutive failures. Use /kill reset to recover."
+      );
     }
-    const cmd = input.command.trim();
-    if (!cmd)
-      return {
-        command: cmd,
-        args: [],
-        stdout: "",
-        stderr: "Empty command",
-        exitCode: 1,
-        truncated: false,
-        allowed: false,
-        danger: SAFE_DANGER
-      };
+    const cmd = (input.command ?? "").trim();
+    if (!cmd) throw new Error("exec: empty command");
     if (!isExecCommandAllowed(cmd)) {
-      return {
-        command: cmd,
-        args: input.args ?? [],
-        stdout: "",
-        stderr: `Command "${cmd}" not in allowlist. Add it to your active profile config (~/.wrongstack/profiles/<name>/config.json) under "tools": { "exec": { "allow": ["${cmd}"] } }, or use the bash tool for one-off arbitrary commands.`,
-        exitCode: 1,
-        truncated: false,
-        allowed: false,
-        danger: SAFE_DANGER
-      };
+      throw new Error(
+        `exec: command "${cmd}" not in allowlist. Add it to your active profile config (~/.wrongstack/profiles/<name>/config.json) under "tools": { "exec": { "allow": ["${cmd}"] } }, or use the bash tool for one-off arbitrary commands.`
+      );
     }
     const args = (input.args ?? []).slice(0, MAX_ARGS);
     const rawTimeout = typeof input.timeout === "number" && !Number.isNaN(input.timeout) ? input.timeout : DEFAULT_TIMEOUT_MS;
@@ -1568,45 +1550,22 @@ var execTool = {
     const danger = detectDanger(cmd, args, dangerBypass);
     const killCheck = await checkExecKillCommand(cmd, args);
     if (killCheck.blocked) {
-      return {
-        command: cmd,
-        args,
-        stdout: "",
-        stderr: killCheck.reason ?? "Kill command blocked: targets a protected WrongStack process.",
-        exitCode: 1,
-        truncated: false,
-        allowed: false,
-        danger
-      };
+      throw new Error(
+        `exec: ${killCheck.reason ?? "Kill command blocked: targets a protected WrongStack process."}`
+      );
     }
     const argError = validateArgs(cmd, args);
     if (argError) {
-      return {
-        command: cmd,
-        args,
-        stdout: "",
-        stderr: argError,
-        exitCode: 1,
-        truncated: false,
-        allowed: false,
-        danger
-      };
+      throw new Error(`exec: ${argError}`);
     }
     const defaultCwd = ctx.workingDir ?? ctx.cwd;
     let cwd;
     try {
       cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : await safeResolveReal(defaultCwd, ctx);
-    } catch {
-      return {
-        command: cmd,
-        args,
-        stdout: "",
-        stderr: `cwd "${input.cwd ?? defaultCwd}" resolves outside project root`,
-        exitCode: 1,
-        truncated: false,
-        allowed: false,
-        danger
-      };
+    } catch (err) {
+      throw new Error(`exec: cwd "${input.cwd ?? defaultCwd}" resolves outside project root`, {
+        cause: err
+      });
     }
     const signal = opts?.signal ?? ctx.signal ?? new AbortController().signal;
     if (signal.aborted) {
@@ -1636,7 +1595,7 @@ var execTool = {
   }
 };
 function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
-  return new Promise((resolve) => {
+  return new Promise((resolve, reject) => {
     let stdout = "";
     let stderr = "";
     let killed = false;
@@ -1646,6 +1605,11 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
       resolvedOnce.value = true;
       resolve(result);
     };
+    const fail = (err) => {
+      if (resolvedOnce.value) return;
+      resolvedOnce.value = true;
+      reject(err);
+    };
     const startedAt = Date.now();
     let stdoutBytes = 0;
     let stderrBytes = 0;
@@ -1683,7 +1647,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     let child;
     try {
       const resolved = resolveWin32Command(cmd);
-      const needsShell = isWin2 && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
+      const needsShell = isWin2 && isWinCmdShim(resolved);
       const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
       const spawnCmd = shim?.command ?? resolved;
       const spawnArgs = shim?.args ?? args;
@@ -1707,16 +1671,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
         startedAt: new Date(startedAt).toISOString()
       });
       emitCompletedOnce(1, void 0);
-      finish({
-        command: cmd,
-        args,
-        stdout: "",
-        stderr: `spawn failed: ${toErrorMessage(err)}`,
-        exitCode: 1,
-        truncated: false,
-        allowed: true,
-        danger
-      });
+      fail(new Error(`exec: spawn failed: ${toErrorMessage(err)}`, { cause: err }));
       return;
     }
     emitProcessStarted({
@@ -1738,19 +1693,22 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
     };
     child.on("error", (err) => {
       const isAbort = err && err.code === "ABORT_ERR";
-      const stderrText = isAbort ? `Aborted: ${err.message}` : err.message;
       if (timer !== void 0) clearTimeout(timer);
       if (isWin2) signal.removeEventListener("abort", onAbort);
       if (typeof pid === "number") registry.unregister(pid);
       registry.afterCall(Date.now() - startedAt, true);
       spool.finalize();
       emitCompletedOnce(isAbort ? 124 : 1, child.pid, isAbort ? "ABORT" : void 0);
+      if (!isAbort) {
+        fail(new Error(`exec: process error: ${err.message}`, { cause: err }));
+        return;
+      }
       finish({
         command: cmd,
         args,
         stdout: normalizeCommandOutput(stdout),
-        stderr: stderrText,
-        exitCode: isAbort ? 124 : 1,
+        stderr: `Aborted: ${err.message}`,
+        exitCode: 124,
         truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
         allowed: true,
         danger
@@ -1844,4 +1802,4 @@ export {
   getExecAllowlist,
   execTool
 };
-//# sourceMappingURL=chunk-A3LNNBYO.js.map
+//# sourceMappingURL=chunk-QAWI3RSK.js.map

package/dist/{chunk-ZMCV3XOV.js → chunk-SPNXDTCJ.js}

@@ -110,29 +110,18 @@ var gitTool = {
       });
     }
     if (input.command === "commit" && !input.message) {
-      return {
-        command: "commit",
-        stdout: "",
-        stderr: "git commit requires a message (-m flag)",
-        exitCode: 1,
-        truncated: false
-      };
+      throw new ToolValidationError({
+        message: "git: commit requires a message",
+        field: "message"
+      });
     }
-    const branchGuard = validateBranchInput(input);
-    if (branchGuard) return branchGuard;
+    assertSafeBranch(input);
     if (input.command === "worktree") {
-      const guard = validateWorktreeInput(input, ctx.projectRoot);
-      if (guard) return guard;
+      assertSafeWorktreeInput(input, ctx.projectRoot);
     }
     const gitDir = findGitDir(ctx.cwd, ctx.projectRoot);
     if (!gitDir) {
-      return {
-        command: input.command,
-        stdout: "",
-        stderr: "Not in a git repository (within project root)",
-        exitCode: 128,
-        truncated: false
-      };
+      throw new Error(`git: Not in a git repository (within project root ${ctx.projectRoot})`);
     }
     const args = buildArgs(input);
     const signal = opts?.signal ?? ctx.signal ?? new AbortController().signal;
@@ -169,37 +158,32 @@ var gitTool = {
     return result;
   }
 };
-function validateBranchInput(input) {
+function assertSafeBranch(input) {
   const branch = input.branch;
-  if (branch === void 0) return null;
-  if (!branch.startsWith("-") && !branch.includes(" --")) return null;
-  return {
-    command: input.command,
-    stdout: "",
-    stderr: `unsafe branch name (parsed as a git option): ${branch}`,
-    exitCode: 1,
-    truncated: false
-  };
-}
-function validateWorktreeInput(input, projectRoot) {
-  const reject = (stderr) => ({
-    command: "worktree",
-    stdout: "",
-    stderr,
-    exitCode: 1,
-    truncated: false
+  if (branch === void 0) return;
+  if (!branch.startsWith("-") && !branch.includes(" --")) return;
+  throw new ToolValidationError({
+    message: `git: unsafe branch name (parsed as a git option): ${branch}`,
+    field: "branch"
   });
+}
+function assertSafeWorktreeInput(input, projectRoot) {
+  const reject = (message) => {
+    throw new ToolValidationError({ message: `git: ${message}`, field: "worktreePath" });
+  };
   if (input.worktreePath?.startsWith("-")) {
-    return reject(`unsafe worktree path: ${input.worktreePath}`);
+    reject(`unsafe worktree path: ${input.worktreePath}`);
+  }
+  if (input.worktreeAction === "add" && !input.worktreePath) {
+    reject("worktree add requires worktreePath");
   }
   if ((input.worktreeAction === "add" || input.worktreeAction === "remove") && input.worktreePath) {
     const root = resolve(projectRoot);
     const abs = resolve(root, input.worktreePath);
     if (abs !== root && !abs.startsWith(root + sep)) {
-      return reject(`unsafe worktree path (escapes project root): ${input.worktreePath}`);
+      reject(`unsafe worktree path (escapes project root): ${input.worktreePath}`);
     }
   }
-  return null;
 }
 function findGitDir(cwd, projectRoot) {
   const root = projectRoot;
@@ -296,15 +280,9 @@ function buildArgs(input) {
 }
 function runGit(args, cwd, signal) {
   if (signal.aborted) {
-    return Promise.resolve({
-      command: args[0],
-      stdout: "",
-      stderr: "Aborted",
-      exitCode: 124,
-      truncated: false
-    });
+    return Promise.reject(signal.reason ?? new Error("git: aborted"));
   }
-  return new Promise((resolve2) => {
+  return new Promise((resolve2, reject) => {
     let stdout = "";
     let stderr = "";
     let stdoutBytes = 0;
@@ -333,21 +311,9 @@ function runGit(args, cwd, signal) {
       }
     });
     child.on("error", (err) => {
-      const stdoutTail = stdoutDecoder.end();
-      if (stdoutTail && stdout.length < MAX_OUTPUT) {
-        stdout += stdoutTail.slice(0, MAX_OUTPUT - stdout.length);
-      }
-      const stderrTail = stderrDecoder.end();
-      if (stderrTail && stderr.length < MAX_OUTPUT) {
-        stderr += stderrTail.slice(0, MAX_OUTPUT - stderr.length);
-      }
-      resolve2({
-        command: args[0],
-        stdout: normalizeCommandOutput(stdout),
-        stderr: err.message,
-        exitCode: 1,
-        truncated: stdoutBytes > MAX_OUTPUT || Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES
-      });
+      reject(
+        err.code === "ABORT_ERR" ? err : new Error(`git: could not run git ${args[0] ?? ""}: ${err.message}`, { cause: err })
+      );
     });
     child.on("close", (code) => {
       const stdoutTail = stdoutDecoder.end();
@@ -373,4 +339,4 @@ function runGit(args, cwd, signal) {
 export {
   gitTool
 };
-//# sourceMappingURL=chunk-ZMCV3XOV.js.map
+//# sourceMappingURL=chunk-SPNXDTCJ.js.map

package/dist/{chunk-H2VB7GCR.js → chunk-ULI2J6TX.js}

@@ -1,9 +1,9 @@
 import {
   tryLegacyPackageOperation
-} from "./chunk-3LQJXJDM.js";
+} from "./chunk-E7A4SLKR.js";
 import {
   spawnStream
-} from "./chunk-EMA2XENR.js";
+} from "./chunk-UVYRQKPZ.js";
 import {
   detectPackageManager,
   normalizeCommandOutput,
@@ -119,6 +119,11 @@ var installTool = {
       if (bridge?.outcome) {
         const outcome = bridge.outcome;
         const run = outcome.run;
+        if (outcome.status !== "passed") {
+          throw new Error(
+            `install: ${bridge.language} package install ${outcome.status}${run?.exitCode != null ? ` (exit ${run.exitCode})` : ""}${run?.error ? `: ${run.error}` : ""}${failureTail(run?.output ?? "")}`
+          );
+        }
         yield {
           type: "final",
           output: {
@@ -143,17 +148,10 @@ var installTool = {
     const PKG_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+(?:@[a-z0-9^~><=*.+-]+)?$/i;
     for (const pkg of pkgList) {
       if (!PKG_NAME_RE.test(pkg) || pkg.startsWith("-") || pkg.length > 200) {
-        yield {
-          type: "final",
-          output: {
-            packages: pkgList,
-            exit_code: 1,
-            output: `Invalid package name "${pkg}". Names must match ${PKG_NAME_RE} and not start with "-".`,
-            dry_run: Boolean(input.dry_run),
-            truncated: false
-          }
-        };
-        return;
+        throw new ToolValidationError({
+          message: `install: Invalid package name "${pkg}". Names must match ${PKG_NAME_RE} and not start with "-".`,
+          field: "packages"
+        });
       }
     }
     const hasPkgs = pkgList.length > 0;
@@ -196,6 +194,9 @@ var installTool = {
       signal,
       maxBytes: 1e5
     });
+    if (result.error) {
+      throw new Error(`install: could not run ${pkgManager}: ${result.error}`);
+    }
     const rawOutput = result.stdout && result.stderr ? `${result.stdout}
 ${result.stderr}` : result.stdout || result.stderr || result.error || "";
     const output = {
@@ -235,9 +236,21 @@ ${result.stderr}` : result.stdout || result.stderr || result.error || "";
       outcome: output.dry_run ? "dry run" : result.exitCode === 0 ? `installed ${pkgList.length || "all"} packages` : `failed (exit ${result.exitCode})`,
       risk: "package"
     });
+    if (result.exitCode !== 0) {
+      throw new Error(
+        `install: ${pkgManager} ${args.filter((a) => !a.startsWith("-")).join(" ")} failed (exit ${result.exitCode})${failureTail(output.output)}`
+      );
+    }
     yield { type: "final", output };
   }
 };
+function failureTail(output) {
+  const trimmed = output.trim();
+  if (!trimmed) return "";
+  const MAX = 4e3;
+  return `:
+${trimmed.length > MAX ? `\u2026${trimmed.slice(-MAX)}` : trimmed}`;
+}
 function resolveManifestPath(cwd, pkgManager) {
   switch (pkgManager) {
     case "pnpm":
@@ -253,4 +266,4 @@ function resolveManifestPath(cwd, pkgManager) {
 export {
   installTool
 };
-//# sourceMappingURL=chunk-H2VB7GCR.js.map
+//# sourceMappingURL=chunk-ULI2J6TX.js.map

package/dist/{chunk-EMA2XENR.js → chunk-UVYRQKPZ.js}

@@ -8,8 +8,9 @@ import {
 } from "./chunk-HDYUBRMF.js";
 import {
   buildWin32CmdShimInvocation,
+  isWinCmdShim,
   resolveWin32Command
-} from "./chunk-5U5ULQX2.js";
+} from "./chunk-XZLVJD56.js";
 
 // src/_spawn-stream.ts
 import { spawn } from "node:child_process";
@@ -35,7 +36,7 @@ async function* spawnStream(opts) {
   let error;
   const spool = createOutputSpool({ tool: opts.cmd, thresholdBytes: max });
   const resolved = resolveWin32Command(opts.cmd);
-  const needsShell = isWin && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
+  const needsShell = isWin && isWinCmdShim(resolved);
   const shim = needsShell ? buildWin32CmdShimInvocation(resolved, opts.args) : null;
   const cmd = shim?.command ?? resolved;
   const args = shim?.args ?? opts.args;
@@ -285,4 +286,4 @@ function utf8Prefix(text, maxBytes) {
 export {
   spawnStream
 };
-//# sourceMappingURL=chunk-EMA2XENR.js.map
+//# sourceMappingURL=chunk-UVYRQKPZ.js.map