@wrongstack/cli 1.1.4 → 1.1.5

package/dist/{chunk-BIGSVBPI.js → chunk-KNYIEQAY.js}

@@ -1,18 +1,19 @@
 
 // src/config-history.ts
 import { randomUUID } from "node:crypto";
+import * as fs2 from "node:fs/promises";
+import * as path2 from "node:path";
+import { isSecretField as isSecretField2 } from "@wrongstack/core/security";
+import { ERROR_CODES as ERROR_CODES2, FsError as FsError2 } from "@wrongstack/core/types";
+import { atomicWrite, toErrorMessage, withFileLock, writeErr } from "@wrongstack/core/utils";
+
+// src/config-history-support.ts
 import * as fs from "node:fs/promises";
 import os from "node:os";
 import * as path from "node:path";
 import { isSecretField } from "@wrongstack/core/security";
 import { ERROR_CODES, FsError } from "@wrongstack/core/types";
-import {
-  atomicWrite,
-  resolveWstackPaths,
-  toErrorMessage,
-  withFileLock,
-  writeErr
-} from "@wrongstack/core/utils";
+import { resolveWstackPaths } from "@wrongstack/core/utils";
 var defaultUidFn = () => os.userInfo().uid;
 async function getFileUid(filePath) {
   try {
@@ -32,8 +33,6 @@ async function checkConfigOwnership(homeFn, uidFn = defaultUidFn, targetConfigPa
   return fileUid === callerUid;
 }
 var PROTECTED_BASENAMES = /* @__PURE__ */ new Set(["config.json", ".key", "index.json"]);
-var MAX_CONFIG_BACKUPS = 10;
-var MAX_CONFIG_HISTORY_ENTRIES = 50;
 function assertSafeToDelete(filename, parentDir) {
   if (PROTECTED_BASENAMES.has(filename)) {
     throw new FsError({
@@ -72,19 +71,6 @@ function assertSafeToDelete(filename, parentDir) {
     });
   }
 }
-async function safeDelete(filePath) {
-  const dir = path.dirname(filePath);
-  const filename = path.basename(filePath);
-  try {
-    assertSafeToDelete(filename, dir);
-    await fs.unlink(filePath);
-  } catch (err) {
-    if (err instanceof Error && err.message.startsWith("Refusing")) {
-      writeErr(`[config-history] SAFETY: ${err.message}
-`);
-    }
-  }
-}
 var REDACTED = "[REDACTED]";
 function maskValue(v) {
   if (Array.isArray(v)) return v.map(maskValue);
@@ -130,6 +116,31 @@ function reviveSecrets(masked, current) {
   }
   return out;
 }
+var defaultHomeDir = () => os.homedir();
+function activeProfileConfigPath(homeFn) {
+  const paths = homeFn === defaultHomeDir ? resolveWstackPaths({ projectRoot: process.cwd() }) : resolveWstackPaths({ projectRoot: process.cwd(), userHome: homeFn() });
+  return paths.profileConfig(paths.profileName);
+}
+function configPath(homeFn = defaultHomeDir, targetConfigPath) {
+  return targetConfigPath ?? activeProfileConfigPath(homeFn);
+}
+
+// src/config-history.ts
+var MAX_CONFIG_BACKUPS = 10;
+var MAX_CONFIG_HISTORY_ENTRIES = 50;
+async function safeDelete(filePath) {
+  const dir = path2.dirname(filePath);
+  const filename = path2.basename(filePath);
+  try {
+    assertSafeToDelete(filename, dir);
+    await fs2.unlink(filePath);
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("Refusing")) {
+      writeErr(`[config-history] SAFETY: ${err.message}
+`);
+    }
+  }
+}
 function diffSummary(oldCfg, newCfg) {
   const changes = [];
   const allKeys = /* @__PURE__ */ new Set([...Object.keys(oldCfg), ...Object.keys(newCfg)]);
@@ -137,7 +148,7 @@ function diffSummary(oldCfg, newCfg) {
     const o = JSON.stringify(oldCfg[k]);
     const n = JSON.stringify(newCfg[k]);
     if (o !== n) {
-      if (isSecretField(k)) {
+      if (isSecretField2(k)) {
         changes.push(`${k}: [CHANGED]`);
       } else if (typeof newCfg[k] !== "object") {
         changes.push(`${k}: ${oldCfg[k] ?? "(unset)"} \u2192 ${newCfg[k]}`);
@@ -148,24 +159,16 @@ function diffSummary(oldCfg, newCfg) {
   }
   return changes.length > 0 ? changes.slice(0, 5).join(", ") : "no changes";
 }
-var defaultHomeDir = () => os.homedir();
-function activeProfileConfigPath(homeFn) {
-  const paths = homeFn === defaultHomeDir ? resolveWstackPaths({ projectRoot: process.cwd() }) : resolveWstackPaths({ projectRoot: process.cwd(), userHome: homeFn() });
-  return paths.profileConfig(paths.profileName);
-}
 function historyDir(homeFn = defaultHomeDir, targetConfigPath) {
-  return path.join(path.dirname(configPath(homeFn, targetConfigPath)), "config.history", "entries");
+  return path2.join(path2.dirname(configPath(homeFn, targetConfigPath)), "config.history", "entries");
 }
 function historyIndexPath(homeFn = defaultHomeDir, targetConfigPath) {
-  return path.join(
-    path.dirname(configPath(homeFn, targetConfigPath)),
+  return path2.join(
+    path2.dirname(configPath(homeFn, targetConfigPath)),
     "config.history",
     "index.json"
   );
 }
-function configPath(homeFn = defaultHomeDir, targetConfigPath) {
-  return targetConfigPath ?? activeProfileConfigPath(homeFn);
-}
 function backupLastPath(homeFn = defaultHomeDir, targetConfigPath) {
   return `${configPath(homeFn, targetConfigPath)}.last`;
 }
@@ -174,11 +177,11 @@ function entryId(ts) {
 }
 async function ensureHistoryDir(homeFn = defaultHomeDir, targetConfigPath) {
   try {
-    await fs.mkdir(historyDir(homeFn, targetConfigPath), { recursive: true });
+    await fs2.mkdir(historyDir(homeFn, targetConfigPath), { recursive: true });
   } catch (err) {
-    throw new FsError({
+    throw new FsError2({
       message: toErrorMessage(err),
-      code: ERROR_CODES.FS_MKDIR_FAILED,
+      code: ERROR_CODES2.FS_MKDIR_FAILED,
       path: historyDir(homeFn, targetConfigPath),
       cause: err
     });
@@ -187,7 +190,7 @@ async function ensureHistoryDir(homeFn = defaultHomeDir, targetConfigPath) {
 async function readIndex(homeFn = defaultHomeDir, targetConfigPath) {
   let raw;
   try {
-    raw = await fs.readFile(historyIndexPath(homeFn, targetConfigPath), "utf8");
+    raw = await fs2.readFile(historyIndexPath(homeFn, targetConfigPath), "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
     return rebuildIndexFromEntries(homeFn, targetConfigPath);
@@ -208,7 +211,7 @@ async function rebuildIndexFromEntries(homeFn = defaultHomeDir, targetConfigPath
   const dir = historyDir(homeFn, targetConfigPath);
   let files;
   try {
-    files = (await fs.readdir(dir)).filter((file) => file.endsWith(".json"));
+    files = (await fs2.readdir(dir)).filter((file) => file.endsWith(".json"));
   } catch (err) {
     if (err.code === "ENOENT") return { version: 1, entries: [] };
     throw err;
@@ -218,7 +221,7 @@ async function rebuildIndexFromEntries(homeFn = defaultHomeDir, targetConfigPath
     const id = file.slice(0, -".json".length);
     let raw;
     try {
-      raw = await fs.readFile(path.join(dir, file), "utf8");
+      raw = await fs2.readFile(path2.join(dir, file), "utf8");
     } catch (err) {
       if (err.code === "ENOENT") continue;
       entries.push({ id, timestamp: "", description: "" });
@@ -244,9 +247,9 @@ async function writeIndex(idx, homeFn = defaultHomeDir, targetConfigPath) {
   try {
     await atomicWrite(historyIndexPath(homeFn, targetConfigPath), JSON.stringify(idx, null, 2));
   } catch (err) {
-    throw new FsError({
+    throw new FsError2({
       message: toErrorMessage(err),
-      code: ERROR_CODES.FS_ATOMIC_WRITE_FAILED,
+      code: ERROR_CODES2.FS_ATOMIC_WRITE_FAILED,
       path: historyIndexPath(homeFn, targetConfigPath),
       cause: err
     });
@@ -258,16 +261,16 @@ async function pruneHistoryEntries(idx, homeFn = defaultHomeDir, targetConfigPat
   const dir = historyDir(homeFn, targetConfigPath);
   for (const entry of removed) {
     try {
-      await fs.unlink(path.join(dir, `${entry.id}.json`));
+      await fs2.unlink(path2.join(dir, `${entry.id}.json`));
     } catch {
     }
   }
   try {
-    const files = await fs.readdir(dir);
+    const files = await fs2.readdir(dir);
     await Promise.all(
       files.filter((file) => file.endsWith(".json") && !keep.has(file)).map(async (file) => {
         try {
-          await fs.unlink(path.join(dir, file));
+          await fs2.unlink(path2.join(dir, file));
         } catch {
         }
       })
@@ -281,7 +284,7 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
   const ts = Date.now();
   let content;
   try {
-    content = await fs.readFile(cfg, "utf8");
+    content = await fs2.readFile(cfg, "utf8");
   } catch {
   }
   if (content !== void 0) {
@@ -300,11 +303,11 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
     }
   }
   try {
-    const dir = path.dirname(cfg);
-    const files = await fs.readdir(dir);
+    const dir = path2.dirname(cfg);
+    const files = await fs2.readdir(dir);
     const baks = files.filter((f) => f.startsWith("config.json.") && f.endsWith(".bak")).sort().reverse();
     for (const f of baks.slice(MAX_CONFIG_BACKUPS)) {
-      await safeDelete(path.join(dir, f));
+      await safeDelete(path2.join(dir, f));
     }
   } catch (err) {
     writeErr(`[config-history] backup prune failed: ${toErrorMessage(err)}`);
@@ -322,16 +325,16 @@ async function appendHistory(oldCfg, newCfg, description, homeFn = defaultHomeDi
     diffSummary: diffSummary(oldCfg, newCfg)
   };
   try {
-    await fs.writeFile(
-      path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
+    await fs2.writeFile(
+      path2.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
       JSON.stringify(entry, null, 2),
       { encoding: "utf8", mode: 384 }
     );
   } catch (err) {
-    throw new FsError({
+    throw new FsError2({
       message: toErrorMessage(err),
-      code: ERROR_CODES.FS_WRITE_FAILED,
-      path: path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
+      code: ERROR_CODES2.FS_WRITE_FAILED,
+      path: path2.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
       cause: err
     });
   }
@@ -350,10 +353,10 @@ async function listHistory(homeFn = defaultHomeDir, targetConfigPath) {
 }
 async function getHistoryEntry(id, homeFn = defaultHomeDir, targetConfigPath) {
   const dir = historyDir(homeFn, targetConfigPath);
-  const filePath = path.join(dir, `${id}.json`);
-  if (path.dirname(path.resolve(filePath)) !== path.resolve(dir)) return null;
+  const filePath = path2.join(dir, `${id}.json`);
+  if (path2.dirname(path2.resolve(filePath)) !== path2.resolve(dir)) return null;
   try {
-    const raw = await fs.readFile(filePath, "utf8");
+    const raw = await fs2.readFile(filePath, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -374,7 +377,7 @@ async function restoreFromHistory(id, homeFn = defaultHomeDir, targetConfigPath)
     await backupCurrent(homeFn, targetConfigPath);
     let oldCfg = {};
     try {
-      const raw = await fs.readFile(cfg, "utf8");
+      const raw = await fs2.readFile(cfg, "utf8");
       oldCfg = JSON.parse(raw);
     } catch {
     }
@@ -399,7 +402,7 @@ async function restoreLast(homeFn = defaultHomeDir, targetConfigPath) {
   const cfg = configPath(homeFn, targetConfigPath);
   let lastCfg = {};
   try {
-    const raw = await fs.readFile(last, "utf8");
+    const raw = await fs2.readFile(last, "utf8");
     lastCfg = JSON.parse(raw);
   } catch {
     return { ok: false, error: "No prior backup found" };
@@ -410,7 +413,7 @@ async function restoreLast(homeFn = defaultHomeDir, targetConfigPath) {
   return withFileLock(cfg, async () => {
     let oldCfg = {};
     try {
-      const raw = await fs.readFile(cfg, "utf8");
+      const raw = await fs2.readFile(cfg, "utf8");
       oldCfg = JSON.parse(raw);
     } catch {
     }
@@ -439,4 +442,4 @@ export {
   restoreFromHistory,
   restoreLast
 };
-//# sourceMappingURL=chunk-BIGSVBPI.js.map
+//# sourceMappingURL=chunk-KNYIEQAY.js.map

package/dist/{chunk-GKGWPFW2.js → chunk-LUEO5HLZ.js}

@@ -47,4 +47,4 @@ export {
   trackAcpLeader,
   closeAcpLeaderSessions
 };
-//# sourceMappingURL=chunk-GKGWPFW2.js.map
+//# sourceMappingURL=chunk-LUEO5HLZ.js.map

package/dist/chunk-LYWOV4OX.js

@@ -0,0 +1,252 @@
+
+// src/tool-gateway.ts
+import { Context } from "@wrongstack/core/agent";
+import { ToolExecutor } from "@wrongstack/core/execution";
+import { ToolRegistry } from "@wrongstack/core/registry";
+import {
+  AutoApprovePermissionPolicy,
+  DefaultSecretScrubber,
+  ToolCapabilities
+} from "@wrongstack/core/security";
+import { normalizeTokenSavingTier } from "@wrongstack/core/types";
+import { toErrorMessage } from "@wrongstack/core/utils";
+import { systemSessionId } from "@wrongstack/primitives";
+import { wireKanbanPorts } from "@wrongstack/runtime";
+import { BROWSER_TOOL_NAMES } from "@wrongstack/tools/browser";
+import { runStartupIndex, shutdownCodebaseIndexHost } from "@wrongstack/tools/codebase-index";
+import { registerBuiltinToolTier } from "@wrongstack/tools/tool-tier";
+function resolveGatewayRegistry(existing, config) {
+  wireKanbanPorts();
+  if (existing) return existing;
+  const registry = new ToolRegistry();
+  registerBuiltinToolTier({
+    registry,
+    tier: normalizeTokenSavingTier(config.features.tokenSavingMode)
+  });
+  return registry;
+}
+var READ_ONLY_CAPABILITIES = [
+  ToolCapabilities.FS_READ,
+  ToolCapabilities.NET_OUTBOUND
+];
+function parseCapabilityGrants(raw) {
+  if (raw === void 0 || raw === false) return [];
+  if (raw === true || raw.trim() === "") {
+    throw new Error(
+      `--allow needs a comma-separated capability list, e.g. --allow fs.write (known: ${knownCapabilities()})`
+    );
+  }
+  const known = new Set(Object.values(ToolCapabilities));
+  const grants = raw.split(",").map((s) => s.trim()).filter(Boolean);
+  const unknown = grants.filter((g) => !known.has(g));
+  if (unknown.length > 0) {
+    throw new Error(
+      `--allow: unknown capability ${unknown.map((u) => `"${u}"`).join(", ")} (known: ${knownCapabilities()})`
+    );
+  }
+  return [...new Set(grants)];
+}
+function knownCapabilities() {
+  return Object.values(ToolCapabilities).join(", ");
+}
+function yoloServePolicy(yoloPlus) {
+  return new AutoApprovePermissionPolicy(
+    Object.values(ToolCapabilities),
+    yoloPlus ? { yoloPlus } : void 0
+  );
+}
+function resolveServeFsRestriction(config) {
+  return config.tools?.restrictToProjectRoot ?? true;
+}
+var GATEWAY_SESSION_ID = systemSessionId("tool-gateway");
+function makeServeContext(cwd, projectRoot, signal, restrictFsToRoot = true) {
+  const provider = {
+    id: "mcp-serve",
+    capabilities: { maxContext: 0 },
+    complete: async () => {
+      throw new Error("no model provider in tool-gateway mode");
+    },
+    stream: () => {
+      throw new Error("no model provider in tool-gateway mode");
+    }
+  };
+  const session = {
+    id: GATEWAY_SESSION_ID,
+    append: async () => {
+    }
+  };
+  const tokenCounter = {
+    account: () => {
+    },
+    total: () => ({ input: 0, output: 0 }),
+    estimateCost: () => ({ total: 0 })
+  };
+  return new Context({
+    systemPrompt: [],
+    provider,
+    session,
+    signal,
+    tokenCounter,
+    cwd,
+    projectRoot,
+    allowOutsideProjectRoot: !restrictFsToRoot,
+    model: "mcp-serve",
+    tools: []
+  });
+}
+async function selectExposedTools(registry, ctx, policy, whitelist) {
+  const allowed = [];
+  for (const tool of registry.list()) {
+    if (whitelist && !whitelist.has(tool.name)) continue;
+    const decision = await policy.evaluate(tool, {}, ctx);
+    if (decision.permission === "auto") allowed.push(tool);
+  }
+  return allowed;
+}
+var SESSION_BOUND_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "clarify",
+  "tool_use",
+  "tool_script",
+  "tool_search",
+  "present_artifact",
+  "todo",
+  "plan"
+]);
+var PROCESS_BOUND_TOOL_NAMES = new Set(BROWSER_TOOL_NAMES);
+var INDEX_READING_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "codebase-search",
+  "codebase-context",
+  "codebase-impact-analysis",
+  "codebase-incoming-calls",
+  "codebase-outgoing-calls",
+  "codebase-repo-map",
+  "codebase-stats"
+]);
+var REMOTE_CATCH_UP_INTERVAL_MS = 1e3;
+function readsCodebaseIndex(name) {
+  return INDEX_READING_TOOL_NAMES.has(name);
+}
+function oneShotWithholdReason(name) {
+  if (SESSION_BOUND_TOOL_NAMES.has(name)) return "session";
+  if (PROCESS_BOUND_TOOL_NAMES.has(name)) return "process";
+  return void 0;
+}
+function withheldReason(gateway, registry, name) {
+  const bound = gateway.withheldBy(name);
+  if (bound === "session") {
+    return `Tool "${name}" only works inside an agent session and is not exposed here.`;
+  }
+  if (bound === "process") {
+    return `Tool "${name}" keeps its state in a long-lived process; use \`wstack mcp serve\` or \`wstack tools serve\` for it.`;
+  }
+  const tool = registry.get(name);
+  if (!tool) return `Unknown tool "${name}". List the exposed tools first.`;
+  const missing = (tool.capabilities ?? []).filter((c) => !gateway.capabilities.includes(c));
+  return gateway.mode === "yolo" || missing.length === 0 ? `Tool "${name}" is withheld by policy.` : `Tool "${name}" is withheld: it needs ${missing.join(", ")}. Pass --allow ${missing.join(",")} (or --yolo for every capability); deleting outside the project, git-history and download-and-run commands stay refused.`;
+}
+async function createToolGateway(options) {
+  const { registry, config, cwd, projectRoot } = options;
+  const restrictFsToRoot = resolveServeFsRestriction(config);
+  const controller = new AbortController();
+  const grants = options.yolo ? [] : [...new Set(options.allow ?? [])];
+  const mode = options.yolo ? "yolo" : grants.length > 0 ? "granted" : "safe";
+  const capabilities = options.yolo ? Object.values(ToolCapabilities) : [.../* @__PURE__ */ new Set([...READ_ONLY_CAPABILITIES, ...grants])];
+  const permissionPolicy = options.yolo ? yoloServePolicy(options.yoloPlus) : new AutoApprovePermissionPolicy(capabilities);
+  const executor = new ToolExecutor(registry, {
+    permissionPolicy,
+    secretScrubber: new DefaultSecretScrubber(),
+    maxToolTimeoutMs: config.tools?.maxToolTimeoutMs ?? 3e5,
+    perIterationOutputCapBytes: 1e6,
+    // Kanban tracks work; it does not gate it. Off unless the operator opts in.
+    // See wiring/pipeline.ts for why all four hosts must agree.
+    requireKanbanGovernance: config.tools?.kanbanGovernance ?? false
+  });
+  const selectionCtx = makeServeContext(cwd, projectRoot, controller.signal, restrictFsToRoot);
+  const selected = await selectExposedTools(
+    registry,
+    selectionCtx,
+    permissionPolicy,
+    options.whitelist
+  );
+  const withheld = (name) => {
+    const reason = oneShotWithholdReason(name);
+    if (options.oneShot) return reason !== void 0;
+    if (options.remoteAgent) return reason === "session";
+    return false;
+  };
+  const tools = selected.filter((t) => !withheld(t.name));
+  const byName = new Map(tools.map((t) => [t.name, t]));
+  const catchUpIndex = options.catchUpIndex ?? (async (root, signal) => {
+    await runStartupIndex({ projectRoot: root, signal });
+  });
+  let indexCurrent = false;
+  let lastCatchUpAt = 0;
+  let catchUpInFlight;
+  const runCatchUp = async () => {
+    try {
+      await catchUpIndex(projectRoot, controller.signal);
+    } catch (err) {
+      options.onWarning?.(`codebase index catch-up failed: ${toErrorMessage(err)}`);
+    } finally {
+      indexCurrent = true;
+      lastCatchUpAt = Date.now();
+      catchUpInFlight = void 0;
+    }
+  };
+  const indexNeedsCatchUp = () => {
+    if (options.oneShot) return !indexCurrent;
+    if (options.remoteAgent) return Date.now() - lastCatchUpAt >= REMOTE_CATCH_UP_INTERVAL_MS;
+    return false;
+  };
+  let counter = 0;
+  return {
+    mode,
+    capabilities,
+    projectRoot,
+    tools,
+    get: (name) => byName.get(name),
+    withheldBy: (name) => withheld(name) ? oneShotWithholdReason(name) : void 0,
+    async call(name, input, callOptions) {
+      const tool = byName.get(name);
+      if (!tool) return { kind: "not_exposed" };
+      if (readsCodebaseIndex(name) && (catchUpInFlight || indexNeedsCatchUp())) {
+        catchUpInFlight ??= runCatchUp();
+        await catchUpInFlight;
+      }
+      if (tool.mutating) indexCurrent = false;
+      const use = { type: "tool_use", id: `srv_${++counter}`, name, input };
+      const requestCtx = makeServeContext(
+        callOptions?.cwd ?? cwd,
+        projectRoot,
+        controller.signal,
+        restrictFsToRoot
+      );
+      const batch = await executor.executeBatch([use], requestCtx, "sequential");
+      const output = batch.outputs[0];
+      const result = output?.result;
+      if (!output || !result || result.type === "tool_confirm_pending") {
+        return { kind: "confirm_required" };
+      }
+      const isError = Boolean(result.is_error);
+      return {
+        kind: "result",
+        content: result.content,
+        isError,
+        settlement: output.settlement ?? (isError ? "failed" : "completed"),
+        durationMs: output.durationMs
+      };
+    },
+    async close() {
+      controller.abort();
+      await shutdownCodebaseIndexHost();
+    }
+  };
+}
+
+export {
+  resolveGatewayRegistry,
+  parseCapabilityGrants,
+  withheldReason,
+  createToolGateway
+};
+//# sourceMappingURL=chunk-LYWOV4OX.js.map