@wrongstack/cli 0.257.0 → 0.257.2

package/dist/index.js

@@ -5729,15 +5729,14 @@ function gitText(args, cwd) {
       reject(err);
       return;
     }
-    let out = "";
-    child.stdout?.on("data", (c) => {
-      if (out.length < MAX_CMD_OUTPUT) out += c.toString();
-    });
-    child.stderr?.on("data", (c) => {
-      if (out.length < MAX_CMD_OUTPUT) out += c.toString();
-    });
-    child.on("error", () => resolve10({ code: 1, out }));
-    child.on("close", (code) => resolve10({ code: code ?? 1, out: out.trim() }));
+    const chunks = [];
+    const emit = (c) => {
+      if (chunks.join("").length < MAX_CMD_OUTPUT) chunks.push(c.toString());
+    };
+    child.stdout?.on("data", emit);
+    child.stderr?.on("data", emit);
+    child.on("error", () => resolve10({ code: 1, out: chunks.join("") }));
+    child.on("close", (code) => resolve10({ code: code ?? 1, out: chunks.join("").trim() }));
   });
 }
 async function isGitRepo(cwd) {
@@ -5774,7 +5773,7 @@ function runCmd(cmd, args, cwd, shell = false) {
     }
   }
   return new Promise((resolve10, reject) => {
-    let out = "";
+    const chunks = [];
     let child;
     try {
       child = spawn(cmd, args, {
@@ -5792,13 +5791,16 @@ function runCmd(cmd, args, cwd, shell = false) {
       return;
     }
     const append = (c) => {
-      out += c.toString();
-      if (out.length > MAX_CMD_OUTPUT) out = out.slice(-MAX_CMD_OUTPUT);
+      chunks.push(c.toString());
     };
     child.stdout?.on("data", append);
     child.stderr?.on("data", append);
-    child.on("error", (e) => resolve10({ code: 1, out: `${out}${String(e)}` }));
-    child.on("close", (code) => resolve10({ code: code ?? 1, out: out.trim() }));
+    child.on("error", (e) => resolve10({ code: 1, out: `${chunks.join("")}${String(e)}` }));
+    child.on("close", (code) => {
+      let out = chunks.join("");
+      if (out.length > MAX_CMD_OUTPUT) out = out.slice(-MAX_CMD_OUTPUT);
+      resolve10({ code: code ?? 1, out: out.trim() });
+    });
   });
 }
 function detectPackageManager(root) {
@@ -8651,8 +8653,19 @@ function listRoles() {
 }
 var DEFAULT_TIMEOUT_MS = 6e4;
 var MAX_OUTPUT_LINES = 500;
+var WINDOWS_CMD_METACHARACTERS = /[;&|<>^$,(){}[\]!#%'"\\/`]/;
+function validateCommand(cmd) {
+  if (process.platform !== "win32") return;
+  if (WINDOWS_CMD_METACHARACTERS.test(cmd)) {
+    throw new Error(
+      `Command contains disallowed metacharacters for Windows: ${cmd.match(WINDOWS_CMD_METACHARACTERS)?.[0] ?? "?"}
+The following characters are not allowed: ; & | < > ^ $ , ( ) { } [ ] ! # % ' " \\ / \` * ?`
+    );
+  }
+}
 function runCommand(cmd, cwd, timeout) {
   return new Promise((resolve10) => {
+    validateCommand(cmd);
     const opts = {
       cwd,
       timeout,
@@ -8733,6 +8746,7 @@ Examples:
   /dev git diff --stat`
         };
       }
+      validateCommand(cmd);
       const cwd = opts.cwd;
       const startedAt = Date.now();
       opts.renderer.write(color.dim(`$ ${cmd}`));
@@ -10430,11 +10444,11 @@ function classifyError(input) {
 }
 function extractCode(s) {
   const ts = /\bTS\d+\b|\bCS\d+\b/.exec(s);
-  if (ts) return ts[0];
+  if (ts !== null) return ts[0];
   const rust = /\bE\d{4,}\b/.exec(s);
-  if (rust) return rust[0];
+  if (rust !== null) return rust[0];
   const c = /\bc\d+\b/i.exec(s);
-  if (c) return c[0];
+  if (c !== null) return c[0];
   return void 0;
 }
 function needsSubagent(c) {
@@ -12160,8 +12174,20 @@ async function runAdd(name, enable, configured, configPath2, mcpRegistry, all) {
 }
 async function runRemove(name, configured, configPath2, mcpRegistry) {
   if (!configured[name]) return `Server "${name}" is not in config.`;
-  await mcpRegistry.stop(name).catch(() => {
-  });
+  try {
+    await mcpRegistry.stop(name);
+  } catch (err) {
+    console.error(
+      JSON.stringify({
+        level: "warn",
+        event: "mcp.stop_failed_on_remove",
+        server: name,
+        message: err instanceof Error ? err.message : String(err),
+        note: "config entry removed but server may still be running",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+  }
   const full = await readConfig(configPath2);
   const mcpServers = {
     ...full.mcpServers ?? {}
@@ -12200,8 +12226,20 @@ async function runEnable(name, configured, configPath2, mcpRegistry) {
 async function runDisable(name, configured, configPath2, mcpRegistry) {
   const cfg = configured[name];
   if (!cfg) return `Server "${name}" is not in config.`;
-  await mcpRegistry.stop(name).catch(() => {
-  });
+  try {
+    await mcpRegistry.stop(name);
+  } catch (err) {
+    console.error(
+      JSON.stringify({
+        level: "warn",
+        event: "mcp.stop_failed_on_disable",
+        server: name,
+        message: err instanceof Error ? err.message : String(err),
+        note: "config marked disabled but server may still be running",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+  }
   const full = await readConfig(configPath2);
   const mcpServers = {
     ...full.mcpServers ?? {}
@@ -21735,22 +21773,22 @@ function renderFleetLine(states, now, columns, version) {
   const visible = line.replace(/\x1b\[[0-9;]*m/g, "");
   if (visible.length > max) {
     let count = 0;
-    let out = "";
+    const out = [];
     let i = 0;
     while (i < line.length && count < max - 1) {
       if (line[i] === "\x1B") {
         const end = line.indexOf("m", i);
         if (end !== -1) {
-          out += line.slice(i, end + 1);
+          out.push(line.slice(i, end + 1));
           i = end + 1;
           continue;
         }
       }
-      out += line[i];
+      if (line[i] !== void 0) out.push(line[i]);
       count++;
       i++;
     }
-    line = out + "\u2026";
+    line = out.join("") + "\u2026";
   }
   return line;
 }
@@ -23537,31 +23575,35 @@ async function execute(deps) {
             const metaMode = context.meta?.["mode"];
             return typeof metaMode === "string" ? metaMode : modeId ?? "default";
           },
-          registerDebugStreamCallback: (cb) => {
-            void import('@wrongstack/providers').then(({ setDebugStreamCallback }) => setDebugStreamCallback(cb)).catch(
-              (err) => console.error(
+          registerDebugStreamCallback: async (cb) => {
+            try {
+              const { setDebugStreamCallback } = await import('@wrongstack/providers');
+              setDebugStreamCallback(cb);
+            } catch (err) {
+              console.error(
                 JSON.stringify({
                   level: "error",
                   event: "execution.debug_stream_register_failed",
                   message: err instanceof Error ? err.message : String(err),
                   timestamp: (/* @__PURE__ */ new Date()).toISOString()
                 })
-              )
-            );
+              );
+            }
           },
-          restoreDebugStreamCallback: () => {
-            void import('@wrongstack/providers').then(
-              ({ setDebugStreamCallback, defaultDebugStreamCallback }) => setDebugStreamCallback(defaultDebugStreamCallback)
-            ).catch(
-              (err) => console.error(
+          restoreDebugStreamCallback: async () => {
+            try {
+              const { setDebugStreamCallback, defaultDebugStreamCallback } = await import('@wrongstack/providers');
+              setDebugStreamCallback(defaultDebugStreamCallback);
+            } catch (err) {
+              console.error(
                 JSON.stringify({
                   level: "error",
                   event: "execution.debug_stream_restore_failed",
                   message: err instanceof Error ? err.message : String(err),
                   timestamp: (/* @__PURE__ */ new Date()).toISOString()
                 })
-              )
-            );
+              );
+            }
           },
           restoredMessages,
           restoredToolCalls,
@@ -23616,12 +23658,14 @@ async function execute(deps) {
               if (oldWriter && oldWriter !== resumed.writer) {
                 const endedUsage = tokenCounter.total();
                 void (async () => {
+                  let appendOk = false;
                   try {
                     await oldWriter.append({
                       type: "session_end",
                       ts: (/* @__PURE__ */ new Date()).toISOString(),
                       usage: endedUsage
                     });
+                    appendOk = true;
                   } catch (err) {
                     console.error(
                       JSON.stringify({
@@ -23632,32 +23676,50 @@ async function execute(deps) {
                       })
                     );
                   }
-                  try {
-                    await oldWriter.close();
-                  } catch (err) {
-                    console.error(
-                      JSON.stringify({
-                        level: "error",
-                        event: "execution.session_close_failed",
-                        message: err instanceof Error ? err.message : String(err),
-                        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-                      })
-                    );
+                  if (appendOk) {
+                    try {
+                      await oldWriter.close();
+                    } catch (err) {
+                      console.error(
+                        JSON.stringify({
+                          level: "error",
+                          event: "execution.session_close_failed",
+                          message: err instanceof Error ? err.message : String(err),
+                          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+                        })
+                      );
+                    }
                   }
                 })();
               }
               agent.ctx.session = resumed.writer;
               tokenCounter.reset();
-              void recoveryLock.clear().then(() => recoveryLock.write(resumed.writer.id)).catch(
-                (err) => console.error(
-                  JSON.stringify({
-                    level: "error",
-                    event: "execution.recovery_lock_update_failed",
-                    message: err instanceof Error ? err.message : String(err),
-                    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-                  })
-                )
-              );
+              void (async () => {
+                try {
+                  await recoveryLock.clear();
+                } catch (err) {
+                  console.error(
+                    JSON.stringify({
+                      level: "warn",
+                      event: "execution.recovery_lock_clear_failed",
+                      message: err instanceof Error ? err.message : String(err),
+                      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+                    })
+                  );
+                }
+                try {
+                  await recoveryLock.write(resumed.writer.id);
+                } catch (err) {
+                  console.error(
+                    JSON.stringify({
+                      level: "error",
+                      event: "execution.recovery_lock_update_failed",
+                      message: err instanceof Error ? err.message : String(err),
+                      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+                    })
+                  );
+                }
+              })();
               const { replaySessionEvents } = await import('@wrongstack/tui');
               const entries = replaySessionEvents(
                 resumed.data.events,
@@ -24003,7 +24065,7 @@ function buildRoutingRunner(config, host) {
 }
 
 // src/fleet/host.ts
-var MultiAgentHost = class {
+var MultiAgentHost = class _MultiAgentHost {
   constructor(deps, opts = {}) {
     this.deps = deps;
     this.opts = opts;
@@ -24032,6 +24094,19 @@ var MultiAgentHost = class {
    * actionable error instead of a generic "Director could not be activated".
    */
   promotionBlockReason = null;
+  /** Guards `buildDirector` from overwriting a runner set by `spawnACP`. */
+  directorRunnerSet = false;
+  /** Event-bus off-handles registered in `buildDirector` — cleaned up in `dispose()`. */
+  directorOffHandles = [];
+  /** Coordinator task.assigned listener — cleaned up in `dispose()`. */
+  coordinatorOffHandle = null;
+  /** ACP runner cache — keyed by role/subagentId, reused across tasks to avoid
+   *  creating a new transport process on every ACP task dispatch. Stores the
+   *  pending promise so concurrent calls for the same subagentId share one spawn.
+   *  Bounded to 20 entries with LRU eviction to prevent unbounded memory growth. */
+  acpRunnerCache = /* @__PURE__ */ new Map();
+  acpRunnerAccessOrder = [];
+  static ACP_CACHE_MAX = 20;
   /**
    * Force the lazy build path to run *now* and return the live Director,
    * or null when director mode is off. Used by the CLI to register the
@@ -24113,60 +24188,71 @@ var MultiAgentHost = class {
       this.fleetManager?.removePendingTask(task.id);
       this.emitLifecycleCompleted(task.id, result);
     });
-    this.director.fleet.filter("budget.threshold_reached", (e) => {
-      const payload = e.payload;
-      this.deps.events.emit("subagent.budget_warning", {
-        subagentId: e.subagentId,
-        kind: payload.kind,
-        used: payload.used,
-        limit: payload.limit
-      });
-    });
-    this.director.fleet.filter("budget.extended", (e) => {
-      const payload = e.payload;
-      this.deps.events.emit("subagent.budget_extended", {
-        subagentId: e.subagentId,
-        kind: payload.kind,
-        newLimit: payload.newLimit,
-        totalExtensions: payload.totalExtensions
-      });
-    });
-    this.director.fleet.filter("ctx.pct", (e) => {
-      const payload = e.payload;
-      this.deps.events.emit("subagent.ctx_pct", {
-        subagentId: e.subagentId,
-        load: payload.load,
-        tokens: payload.tokens,
-        maxContext: payload.maxContext
-      });
-    });
-    this.director.fleet.filter("subagent.spawned", (e) => {
-      const payload = e.payload;
-      this.deps.events.emit("subagent.spawned", {
-        subagentId: payload.subagentId,
-        taskId: payload.taskId,
-        name: payload.name,
-        provider: payload.provider,
-        model: payload.model
-      });
-    });
-    this.getCoordinator().on(
-      "task.assigned",
-      ({
-        task,
-        subagentId
-      }) => {
-        this.deps.events.emit("subagent.task_started", {
-          subagentId,
-          taskId: task.id,
-          description: task.description
+    this.directorOffHandles.push(
+      this.director.fleet.filter("budget.threshold_reached", (e) => {
+        const payload = e.payload;
+        this.deps.events.emit("subagent.budget_warning", {
+          subagentId: e.subagentId,
+          kind: payload.kind,
+          used: payload.used,
+          limit: payload.limit
         });
-      }
+      })
+    );
+    this.directorOffHandles.push(
+      this.director.fleet.filter("budget.extended", (e) => {
+        const payload = e.payload;
+        this.deps.events.emit("subagent.budget_extended", {
+          subagentId: e.subagentId,
+          kind: payload.kind,
+          newLimit: payload.newLimit,
+          totalExtensions: payload.totalExtensions
+        });
+      })
+    );
+    this.directorOffHandles.push(
+      this.director.fleet.filter("ctx.pct", (e) => {
+        const payload = e.payload;
+        this.deps.events.emit("subagent.ctx_pct", {
+          subagentId: e.subagentId,
+          load: payload.load,
+          tokens: payload.tokens,
+          maxContext: payload.maxContext
+        });
+      })
     );
+    this.directorOffHandles.push(
+      this.director.fleet.filter("subagent.spawned", (e) => {
+        const payload = e.payload;
+        this.deps.events.emit("subagent.spawned", {
+          subagentId: payload.subagentId,
+          taskId: payload.taskId,
+          name: payload.name,
+          provider: payload.provider,
+          model: payload.model
+        });
+      })
+    );
+    const coordinatorTaskAssignedHandler = ({
+      task,
+      subagentId
+    }) => {
+      this.deps.events.emit("subagent.task_started", {
+        subagentId,
+        taskId: task.id,
+        description: task.description
+      });
+    };
+    const coordinator = this.getCoordinator();
+    coordinator.on("task.assigned", coordinatorTaskAssignedHandler);
+    this.coordinatorOffHandle = () => coordinator.off("task.assigned", coordinatorTaskAssignedHandler);
     this.fleetEmitTool = makeFleetEmitTool(this.director);
     this.fleetStatusTool = makeFleetStatusTool(this.director);
     const runner = await this.buildSubagentRunner(config);
-    this.getCoordinator().setRunner(runner);
+    if (!this.directorRunnerSet) {
+      this.getCoordinator().setRunner(runner);
+      this.directorRunnerSet = true;
+    }
   }
   /**
    * Returns the FleetEmitTool for director-mode subagents, if the director
@@ -24368,9 +24454,23 @@ var MultiAgentHost = class {
     return buildRoutingRunner(config, this);
   }
   async buildACPRunner(subagentId) {
+    const cached = this.acpRunnerCache.get(subagentId);
+    if (cached) {
+      const idx = this.acpRunnerAccessOrder.indexOf(subagentId);
+      if (idx !== -1) this.acpRunnerAccessOrder.splice(idx, 1);
+      this.acpRunnerAccessOrder.push(subagentId);
+      return cached;
+    }
     const cmd = ACP_AGENT_COMMANDS[subagentId];
     if (!cmd) throw new Error(`Unknown ACP agent: ${subagentId}`);
-    return makeACPSubagentRunner(cmd);
+    while (this.acpRunnerAccessOrder.length >= _MultiAgentHost.ACP_CACHE_MAX) {
+      const oldest = this.acpRunnerAccessOrder.shift();
+      if (oldest) this.acpRunnerCache.delete(oldest);
+    }
+    const p = makeACPSubagentRunner(cmd);
+    this.acpRunnerCache.set(subagentId, p);
+    this.acpRunnerAccessOrder.push(subagentId);
+    return p;
   }
   /**
    * Build a Provider for a subagent. When `overrideId` is supplied (from
@@ -24413,6 +24513,7 @@ var MultiAgentHost = class {
     const coordinator = this.getCoordinator();
     const acpRunner = await this.buildACPRunner(subagentId);
     coordinator.setRunner(acpRunner);
+    this.directorRunnerSet = true;
     await coordinator.spawn({
       id: subagentId,
       name: subagentId,
@@ -24482,8 +24583,9 @@ var MultiAgentHost = class {
    */
   async spawnAndWait(description, opts) {
     const { taskId } = await this.spawn(description, opts);
-    if (!this.director) throw new Error("Director is not initialized");
-    const results = await this.director.awaitTasks([taskId]);
+    const director = this.director;
+    if (!director) throw new Error("Director is not initialized");
+    const results = await director.awaitTasks([taskId]);
     const result = results[0];
     if (!result) throw new Error(`Task ${taskId} completed but no result returned`);
     return result;
@@ -24697,6 +24799,24 @@ var MultiAgentHost = class {
       this.getCoordinator().setMaxConcurrent(v);
     }
   }
+  /**
+   * Clean up all listeners and resources held by the host.
+   * Unregisters all EventBus/FleetBus listeners registered in `buildDirector`
+   * and stops the Director and its coordinator.
+   *
+   * Safe to call multiple times — subsequent calls are no-ops.
+   */
+  async dispose() {
+    for (const off of this.directorOffHandles) {
+      off();
+    }
+    this.directorOffHandles.length = 0;
+    this.coordinatorOffHandle?.();
+    this.coordinatorOffHandle = null;
+    if (this.director) {
+      await this.director.shutdown();
+    }
+  }
 };
 
 // src/session-stats.ts
@@ -27033,6 +27153,9 @@ Restart WrongStack to load or unload plugin code in this session.`;
       brainMonitor.stop();
       brainQueue.dispose();
       void mcpRegistry.stopAll();
+      multiAgentHost.dispose().catch(
+        (err) => logger.warn(`multiAgentHost.dispose() failed: ${err instanceof Error ? err.message : String(err)}`)
+      );
     },
     onBeforeExit: async () => {
       const cwd2 = projectRoot;
@@ -27314,8 +27437,11 @@ Reply YES to auto-proceed, NO to wait for human input.`
     brain,
     brainSettings,
     getBrainLog: () => brainLog,
-    // Clean up SessionStats event listeners when the REPL exits.
-    onDestroy: () => stats.destroy(events)
+    // Clean up SessionStats event listeners and all EventBus handlers when the REPL exits.
+    onDestroy: () => {
+      teardownHandlers.forEach((fn) => fn());
+      stats.destroy(events);
+    }
   });
 }
 var isMain = import.meta.url === `file://${process.argv[1]?.replace(/\\/g, "/")}` || process.argv[1]?.endsWith("/cli/dist/index.js") || process.argv[1]?.endsWith("\\cli\\dist\\index.js");