@wrongstack/core 0.1.7 → 0.1.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.js CHANGED
@@ -1383,11 +1383,11 @@ function validateAgainstSchema(value, schema) {
1383
1383
  walk(value, schema, "", errors);
1384
1384
  return { ok: errors.length === 0, errors };
1385
1385
  }
1386
- function walk(value, schema, path15, errors) {
1386
+ function walk(value, schema, path17, errors) {
1387
1387
  if (schema.enum !== void 0) {
1388
1388
  if (!schema.enum.some((e) => deepEqual(e, value))) {
1389
1389
  errors.push({
1390
- path: path15 || "<root>",
1390
+ path: path17 || "<root>",
1391
1391
  message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
1392
1392
  });
1393
1393
  return;
@@ -1396,7 +1396,7 @@ function walk(value, schema, path15, errors) {
1396
1396
  if (typeof schema.type === "string") {
1397
1397
  if (!checkType(value, schema.type)) {
1398
1398
  errors.push({
1399
- path: path15 || "<root>",
1399
+ path: path17 || "<root>",
1400
1400
  message: `expected ${schema.type}, got ${describeType(value)}`
1401
1401
  });
1402
1402
  return;
@@ -1406,19 +1406,19 @@ function walk(value, schema, path15, errors) {
1406
1406
  const obj = value;
1407
1407
  for (const req of schema.required ?? []) {
1408
1408
  if (!(req in obj)) {
1409
- errors.push({ path: joinPath(path15, req), message: "required property missing" });
1409
+ errors.push({ path: joinPath(path17, req), message: "required property missing" });
1410
1410
  }
1411
1411
  }
1412
1412
  if (schema.properties) {
1413
1413
  for (const [key, subSchema] of Object.entries(schema.properties)) {
1414
1414
  if (key in obj) {
1415
- walk(obj[key], subSchema, joinPath(path15, key), errors);
1415
+ walk(obj[key], subSchema, joinPath(path17, key), errors);
1416
1416
  }
1417
1417
  }
1418
1418
  }
1419
1419
  }
1420
1420
  if (schema.type === "array" && Array.isArray(value) && schema.items) {
1421
- value.forEach((item, i) => walk(item, schema.items, `${path15}[${i}]`, errors));
1421
+ value.forEach((item, i) => walk(item, schema.items, `${path17}[${i}]`, errors));
1422
1422
  }
1423
1423
  }
1424
1424
  function checkType(value, type) {
@@ -4710,6 +4710,182 @@ function defaultFormatTaskInput(task) {
4710
4710
  return task.description ?? "";
4711
4711
  }
4712
4712
 
4713
+ // src/defaults/fleet-bus.ts
4714
+ var FleetBus = class {
4715
+ byId = /* @__PURE__ */ new Map();
4716
+ byType = /* @__PURE__ */ new Map();
4717
+ any = /* @__PURE__ */ new Set();
4718
+ /**
4719
+ * Hook a subagent's EventBus into the fleet. EventBus is strongly
4720
+ * typed and doesn't expose an `onAny` hook, so we subscribe to the
4721
+ * canonical set of event types a subagent emits during a run. New
4722
+ * event types added to the kernel must be added here too — but the
4723
+ * cost is a tiny single line per type, and the explicit list keeps
4724
+ * the wire format clear.
4725
+ *
4726
+ * Returns a disposer that detaches every subscription; call on
4727
+ * subagent teardown so the listeners don't outlive the run.
4728
+ */
4729
+ attach(subagentId, bus, taskId) {
4730
+ const FORWARDED_TYPES = [
4731
+ "tool.started",
4732
+ "tool.executed",
4733
+ "tool.progress",
4734
+ "tool.confirm_needed",
4735
+ "iteration.started",
4736
+ "iteration.completed",
4737
+ "provider.text_delta",
4738
+ "provider.response",
4739
+ "provider.retry",
4740
+ "provider.error",
4741
+ "session.started",
4742
+ "session.ended",
4743
+ "token.threshold"
4744
+ ];
4745
+ const offs = [];
4746
+ for (const t2 of FORWARDED_TYPES) {
4747
+ offs.push(
4748
+ bus.on(t2, (payload) => {
4749
+ this.emit({ subagentId, taskId, ts: Date.now(), type: t2, payload });
4750
+ })
4751
+ );
4752
+ }
4753
+ return () => {
4754
+ for (const off of offs) off();
4755
+ };
4756
+ }
4757
+ /** Subscribe to every event from one subagent. */
4758
+ subscribe(subagentId, handler) {
4759
+ let set = this.byId.get(subagentId);
4760
+ if (!set) {
4761
+ set = /* @__PURE__ */ new Set();
4762
+ this.byId.set(subagentId, set);
4763
+ }
4764
+ set.add(handler);
4765
+ return () => {
4766
+ set.delete(handler);
4767
+ };
4768
+ }
4769
+ /** Subscribe to one event type across all subagents. */
4770
+ filter(type, handler) {
4771
+ let set = this.byType.get(type);
4772
+ if (!set) {
4773
+ set = /* @__PURE__ */ new Set();
4774
+ this.byType.set(type, set);
4775
+ }
4776
+ set.add(handler);
4777
+ return () => {
4778
+ set.delete(handler);
4779
+ };
4780
+ }
4781
+ /** Subscribe to literally everything. The fleet roll-up uses this. */
4782
+ onAny(handler) {
4783
+ this.any.add(handler);
4784
+ return () => {
4785
+ this.any.delete(handler);
4786
+ };
4787
+ }
4788
+ emit(event) {
4789
+ const byId = this.byId.get(event.subagentId);
4790
+ if (byId) for (const h of byId) {
4791
+ try {
4792
+ h(event);
4793
+ } catch {
4794
+ }
4795
+ }
4796
+ const byType = this.byType.get(event.type);
4797
+ if (byType) for (const h of byType) {
4798
+ try {
4799
+ h(event);
4800
+ } catch {
4801
+ }
4802
+ }
4803
+ for (const h of this.any) {
4804
+ try {
4805
+ h(event);
4806
+ } catch {
4807
+ }
4808
+ }
4809
+ }
4810
+ };
4811
+ var FleetUsageAggregator = class {
4812
+ constructor(bus, priceLookup, metaLookup) {
4813
+ this.bus = bus;
4814
+ this.priceLookup = priceLookup;
4815
+ this.metaLookup = metaLookup;
4816
+ bus.filter("provider.response", (e) => this.onProviderResponse(e));
4817
+ bus.filter("tool.executed", (e) => this.onToolExecuted(e));
4818
+ bus.filter("iteration.started", (e) => this.onIterationStarted(e));
4819
+ }
4820
+ bus;
4821
+ priceLookup;
4822
+ metaLookup;
4823
+ perSubagent = /* @__PURE__ */ new Map();
4824
+ total = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0 };
4825
+ /** Live snapshot — safe to call from a tool's execute() body. */
4826
+ snapshot() {
4827
+ return {
4828
+ total: { ...this.total },
4829
+ perSubagent: Object.fromEntries(
4830
+ Array.from(this.perSubagent.entries()).map(([k, v]) => [k, { ...v }])
4831
+ )
4832
+ };
4833
+ }
4834
+ ensure(subagentId) {
4835
+ let snap = this.perSubagent.get(subagentId);
4836
+ if (!snap) {
4837
+ const meta = this.metaLookup?.(subagentId);
4838
+ snap = {
4839
+ subagentId,
4840
+ provider: meta?.provider,
4841
+ model: meta?.model,
4842
+ input: 0,
4843
+ output: 0,
4844
+ cacheRead: 0,
4845
+ cacheWrite: 0,
4846
+ cost: 0,
4847
+ toolCalls: 0,
4848
+ iterations: 0,
4849
+ startedAt: Date.now(),
4850
+ lastEventAt: Date.now()
4851
+ };
4852
+ this.perSubagent.set(subagentId, snap);
4853
+ }
4854
+ return snap;
4855
+ }
4856
+ onProviderResponse(e) {
4857
+ const snap = this.ensure(e.subagentId);
4858
+ const p = e.payload;
4859
+ const usage = p?.usage;
4860
+ if (!usage) return;
4861
+ snap.input += usage.input ?? 0;
4862
+ snap.output += usage.output ?? 0;
4863
+ snap.cacheRead += usage.cacheRead ?? 0;
4864
+ snap.cacheWrite += usage.cacheWrite ?? 0;
4865
+ this.total.input += usage.input ?? 0;
4866
+ this.total.output += usage.output ?? 0;
4867
+ this.total.cacheRead += usage.cacheRead ?? 0;
4868
+ this.total.cacheWrite += usage.cacheWrite ?? 0;
4869
+ const price = this.priceLookup?.(e.subagentId);
4870
+ if (price) {
4871
+ const delta = (usage.input ?? 0) / 1e6 * (price.input ?? 0) + (usage.output ?? 0) / 1e6 * (price.output ?? 0) + (usage.cacheRead ?? 0) / 1e6 * (price.cacheRead ?? 0) + (usage.cacheWrite ?? 0) / 1e6 * (price.cacheWrite ?? 0);
4872
+ snap.cost += delta;
4873
+ this.total.cost += delta;
4874
+ }
4875
+ snap.lastEventAt = e.ts;
4876
+ }
4877
+ onToolExecuted(e) {
4878
+ const snap = this.ensure(e.subagentId);
4879
+ snap.toolCalls += 1;
4880
+ snap.lastEventAt = e.ts;
4881
+ }
4882
+ onIterationStarted(e) {
4883
+ const snap = this.ensure(e.subagentId);
4884
+ snap.iterations += 1;
4885
+ snap.lastEventAt = e.ts;
4886
+ }
4887
+ };
4888
+
4713
4889
  // src/defaults/transport/in-memory-transport.ts
4714
4890
  var InMemoryBridgeTransport = class {
4715
4891
  subs = /* @__PURE__ */ new Map();
@@ -4837,6 +5013,914 @@ function createMessage(type, from, payload, to) {
4837
5013
  };
4838
5014
  }
4839
5015
 
5016
+ // src/defaults/director-prompts.ts
5017
+ var DEFAULT_DIRECTOR_PREAMBLE = `You are the Director of a multi-agent fleet. You orchestrate worker
5018
+ subagents by spawning them, assigning tasks, awaiting completions, and
5019
+ rolling up their outputs into your next decision.
5020
+
5021
+ Core fleet tools available to you:
5022
+ - spawn_subagent \u2014 create a worker with a chosen provider / model / role
5023
+ - assign_task \u2014 hand a piece of work to a specific subagent
5024
+ - await_tasks \u2014 block until named task ids complete (parallel-safe)
5025
+ - ask_subagent \u2014 synchronously query a running subagent via the bridge
5026
+ - roll_up \u2014 aggregate finished tasks into a markdown/json summary
5027
+ - terminate_subagent \u2014 abort a stuck worker (use sparingly)
5028
+ - fleet_status \u2014 snapshot of all subagents and pending tasks
5029
+ - fleet_usage \u2014 token + cost breakdown per subagent and total
5030
+
5031
+ Working rules:
5032
+ 1. Decompose first. Before spawning, decide which sub-tasks are
5033
+ independent and can run in parallel. Sequential work doesn't need a
5034
+ subagent \u2014 do it yourself.
5035
+ 2. Match worker to job. Cheap/fast model for triage, capable model for
5036
+ synthesis. Different providers per sibling is allowed and encouraged.
5037
+ 3. Always pair an assign with an await. Don't fire-and-forget; you owe
5038
+ the user a single coherent answer at the end.
5039
+ 4. Roll up before deciding. After await_tasks resolves, call roll_up so
5040
+ the results are folded back into your context in a compact form.
5041
+ 5. Budget is real. Check fleet_usage periodically. If a subagent is
5042
+ thrashing, terminate it rather than letting cost climb silently.
5043
+ 6. Never claim a subagent's work as your own without verifying it. If a
5044
+ result looks wrong, ask_subagent for clarification before passing it
5045
+ to the user.`;
5046
+ var DEFAULT_SUBAGENT_BASELINE = `You are a subagent operating under a Director. You were spawned to handle
5047
+ a specific slice of a larger plan \u2014 do that slice well and report back.
5048
+
5049
+ Bridge contract:
5050
+ - You have a parent (the Director). You may call \`request\` on the
5051
+ parent bridge to ask a clarifying question. Use this sparingly; the
5052
+ parent is also working.
5053
+ - You MAY NOT request the parent's system prompt, tool list, or other
5054
+ subagents' context. Those are not yours to read.
5055
+ - Your final task output is what the Director sees. Be concise,
5056
+ structured, and self-contained \u2014 assume the Director will paste your
5057
+ output into its own context.`;
5058
+ function composeDirectorPrompt(parts = {}) {
5059
+ const sections = [];
5060
+ const preamble = parts.directorPreamble ?? DEFAULT_DIRECTOR_PREAMBLE;
5061
+ if (preamble && preamble.trim().length > 0) sections.push(preamble.trim());
5062
+ if (parts.rosterSummary && parts.rosterSummary.trim().length > 0) {
5063
+ sections.push(`Available roles you can spawn:
5064
+ ${parts.rosterSummary.trim()}`);
5065
+ }
5066
+ if (parts.basePrompt && parts.basePrompt.trim().length > 0) {
5067
+ sections.push(parts.basePrompt.trim());
5068
+ }
5069
+ return sections.join("\n\n");
5070
+ }
5071
+ function composeSubagentPrompt(parts = {}) {
5072
+ const sections = [];
5073
+ const baseline = parts.baseline ?? DEFAULT_SUBAGENT_BASELINE;
5074
+ if (baseline && baseline.trim().length > 0) sections.push(baseline.trim());
5075
+ if (parts.role && parts.role.trim().length > 0) {
5076
+ sections.push(`Role:
5077
+ ${parts.role.trim()}`);
5078
+ }
5079
+ if (parts.task && parts.task.trim().length > 0) {
5080
+ sections.push(`Task:
5081
+ ${parts.task.trim()}`);
5082
+ }
5083
+ if (parts.sharedScratchpad && parts.sharedScratchpad.trim().length > 0) {
5084
+ sections.push(
5085
+ `Shared notes:
5086
+ A scratchpad shared with the rest of the fleet is mounted at \`${parts.sharedScratchpad.trim()}\`.
5087
+ - Write your final findings as markdown files there (e.g. \`findings.md\`, \`security.md\`).
5088
+ - Before starting, list the directory and read any sibling files relevant to your task \u2014 they may already contain context you can build on.
5089
+ - Use stable filenames (one file per concern); overwrite instead of appending so the Director sees the latest state.`
5090
+ );
5091
+ }
5092
+ if (parts.override && parts.override.trim().length > 0) {
5093
+ sections.push(parts.override.trim());
5094
+ }
5095
+ return sections.join("\n\n");
5096
+ }
5097
+ function rosterSummaryFromConfigs(roster) {
5098
+ const lines = [];
5099
+ for (const [roleId, cfg] of Object.entries(roster)) {
5100
+ const tag = cfg.provider && cfg.model ? ` (${cfg.provider}/${cfg.model})` : "";
5101
+ const headline = cfg.prompt ? (cfg.prompt.split("\n").find((l) => l.trim().length > 0) ?? "").trim().slice(0, 80) : "";
5102
+ const tail = headline ? ` \u2014 ${headline}` : "";
5103
+ lines.push(`- ${roleId}: ${cfg.name}${tag}${tail}`);
5104
+ }
5105
+ return lines.join("\n");
5106
+ }
5107
+
5108
+ // src/defaults/director.ts
5109
+ var DirectorBudgetError = class extends Error {
5110
+ kind;
5111
+ limit;
5112
+ observed;
5113
+ constructor(kind, limit, observed) {
5114
+ super(
5115
+ kind === "max_spawns" ? `Director spawn budget exceeded: tried to spawn #${observed} but maxSpawns is ${limit}` : `Director spawn depth budget exceeded: this director is at depth ${observed} and maxSpawnDepth is ${limit}`
5116
+ );
5117
+ this.name = "DirectorBudgetError";
5118
+ this.kind = kind;
5119
+ this.limit = limit;
5120
+ this.observed = observed;
5121
+ }
5122
+ };
5123
+ var Director = class {
5124
+ id;
5125
+ fleet;
5126
+ usage;
5127
+ /**
5128
+ * Director-side bridge endpoint. Subagents are wired to the same
5129
+ * in-memory transport so the director can `ask()` them synchronously
5130
+ * and they can `send()` progress back. Exposed so external code (e.g.
5131
+ * the TUI) can subscribe to inbound messages.
5132
+ */
5133
+ bridge;
5134
+ transport;
5135
+ coordinator;
5136
+ /** Resolves with the matching `TaskResult` the first time the
5137
+ * coordinator emits `task.completed` for a given task id. Each entry
5138
+ * is created lazily on first poll/await and cleared once consumed. */
5139
+ taskWaiters = /* @__PURE__ */ new Map();
5140
+ /** Cache of completed results in case the consumer asks AFTER the
5141
+ * coordinator already fired the event — `awaitTasks(['t-1'])` after
5142
+ * t-1 finished should resolve immediately, not hang. */
5143
+ completed = /* @__PURE__ */ new Map();
5144
+ /** Per-subagent provider/model metadata, captured at spawn time so the
5145
+ * FleetUsageAggregator's metaLookup can surface readable rows. */
5146
+ subagentMeta = /* @__PURE__ */ new Map();
5147
+ priceLookups = /* @__PURE__ */ new Map();
5148
+ /** Bridge endpoints we created per subagent (so we can `stop()` them
5149
+ * on shutdown and free transport subscriptions). */
5150
+ subagentBridges = /* @__PURE__ */ new Map();
5151
+ /** Tracks per-spawn config + assigned task ids for manifest writing. */
5152
+ manifestEntries = /* @__PURE__ */ new Map();
5153
+ manifestPath;
5154
+ roster;
5155
+ directorPreamble;
5156
+ subagentBaseline;
5157
+ /** Absolute path to the fleet's shared scratchpad directory, or null
5158
+ * when none was configured. Exposed as a readonly getter for callers
5159
+ * that need to surface the path to the user (e.g. the CLI logging
5160
+ * the location after `--director` boots). */
5161
+ sharedScratchpadPath;
5162
+ /** Spawn cap (lifetime total). Infinity means unlimited. */
5163
+ maxSpawns;
5164
+ /** Nesting cap. The N-th director in a chain has `spawnDepth = N-1`. */
5165
+ maxSpawnDepth;
5166
+ /** This director's position in a director chain. Root director = 0. */
5167
+ spawnDepth;
5168
+ /** Live spawn counter for `maxSpawns` enforcement. */
5169
+ spawnCount = 0;
5170
+ constructor(opts) {
5171
+ this.id = opts.config.coordinatorId || randomUUID();
5172
+ this.manifestPath = opts.manifestPath;
5173
+ this.roster = opts.roster;
5174
+ this.directorPreamble = opts.directorPreamble ?? DEFAULT_DIRECTOR_PREAMBLE;
5175
+ this.subagentBaseline = opts.subagentBaseline ?? DEFAULT_SUBAGENT_BASELINE;
5176
+ this.sharedScratchpadPath = opts.sharedScratchpadPath ?? null;
5177
+ this.maxSpawns = opts.maxSpawns ?? Infinity;
5178
+ this.maxSpawnDepth = opts.maxSpawnDepth ?? 2;
5179
+ this.spawnDepth = opts.spawnDepth ?? 0;
5180
+ if (this.sharedScratchpadPath) {
5181
+ void fsp.mkdir(this.sharedScratchpadPath, { recursive: true }).catch(() => void 0);
5182
+ }
5183
+ this.transport = new InMemoryBridgeTransport();
5184
+ this.bridge = new InMemoryAgentBridge(
5185
+ { agentId: this.id, coordinatorId: this.id },
5186
+ this.transport
5187
+ );
5188
+ this.fleet = new FleetBus();
5189
+ this.usage = new FleetUsageAggregator(
5190
+ this.fleet,
5191
+ (id) => this.priceLookups.get(id),
5192
+ (id) => this.subagentMeta.get(id)
5193
+ );
5194
+ this.coordinator = new DefaultMultiAgentCoordinator(
5195
+ { ...opts.config, coordinatorId: this.id },
5196
+ { runner: opts.runner }
5197
+ );
5198
+ this.coordinator.on("task.completed", (payload) => {
5199
+ const r = payload.result;
5200
+ this.completed.set(r.taskId, r);
5201
+ const waiter = this.taskWaiters.get(r.taskId);
5202
+ if (waiter) {
5203
+ waiter.resolve(r);
5204
+ this.taskWaiters.delete(r.taskId);
5205
+ }
5206
+ });
5207
+ }
5208
+ /**
5209
+ * Spawn a subagent. Identical to the coordinator's `spawn()` but
5210
+ * captures provider/model metadata for the usage aggregator and
5211
+ * lets the FleetBus attach to the runner's EventBus when the task
5212
+ * actually runs (see `attachSubagentBus`).
5213
+ *
5214
+ * Caller-supplied `priceLookup` is optional but recommended — without
5215
+ * it the `cost` column in `usage.snapshot()` stays at 0.
5216
+ */
5217
+ async spawn(config, priceLookup) {
5218
+ if (this.spawnDepth >= this.maxSpawnDepth) {
5219
+ throw new DirectorBudgetError("max_spawn_depth", this.maxSpawnDepth, this.spawnDepth);
5220
+ }
5221
+ if (this.spawnCount >= this.maxSpawns) {
5222
+ throw new DirectorBudgetError("max_spawns", this.maxSpawns, this.spawnCount + 1);
5223
+ }
5224
+ this.spawnCount += 1;
5225
+ const result = await this.coordinator.spawn(config);
5226
+ this.subagentMeta.set(result.subagentId, {
5227
+ provider: config.provider,
5228
+ model: config.model
5229
+ });
5230
+ if (priceLookup) this.priceLookups.set(result.subagentId, priceLookup);
5231
+ const subagentBridge = new InMemoryAgentBridge(
5232
+ { agentId: result.subagentId, coordinatorId: this.id },
5233
+ this.transport
5234
+ );
5235
+ this.coordinator.setSubagentBridge(result.subagentId, subagentBridge);
5236
+ this.subagentBridges.set(result.subagentId, subagentBridge);
5237
+ this.manifestEntries.set(result.subagentId, {
5238
+ subagentId: result.subagentId,
5239
+ name: config.name,
5240
+ role: config.role,
5241
+ provider: config.provider,
5242
+ model: config.model,
5243
+ taskIds: []
5244
+ });
5245
+ return result.subagentId;
5246
+ }
5247
+ /**
5248
+ * Synchronously ask a subagent something via the bridge. Sends a
5249
+ * `task` message addressed to the subagent and awaits a matching
5250
+ * reply (matched by message id). Subagent runners that handle these
5251
+ * requests subscribe to `ctx.bridge` and reply with a message whose
5252
+ * `id` equals the incoming request's id (see `InMemoryAgentBridge`'s
5253
+ * `request<T>` implementation).
5254
+ *
5255
+ * Returns the response payload directly (the bridge wrapper is
5256
+ * unwrapped for ergonomics). Times out after `timeoutMs` (default
5257
+ * matches the bridge's own default of 30s) — surface those rejections
5258
+ * to the caller as actionable errors instead of letting tools hang.
5259
+ */
5260
+ async ask(subagentId, payload, timeoutMs) {
5261
+ if (!this.subagentBridges.has(subagentId)) {
5262
+ throw new Error(
5263
+ `ask: unknown subagent "${subagentId}" (spawn() it first; current fleet: ${Array.from(this.subagentBridges.keys()).join(", ") || "(empty)"})`
5264
+ );
5265
+ }
5266
+ const msg = {
5267
+ id: randomUUID(),
5268
+ type: "task",
5269
+ from: this.id,
5270
+ to: subagentId,
5271
+ payload,
5272
+ timestamp: Date.now(),
5273
+ priority: "normal"
5274
+ };
5275
+ const reply = await this.bridge.request(msg, timeoutMs);
5276
+ return reply.payload;
5277
+ }
5278
+ /**
5279
+ * Read completed task results and format them as a structured text
5280
+ * block the director's LLM can paste into its own context. The
5281
+ * Director keeps every completed `TaskResult` in `completed` so this
5282
+ * is a pure read — no bridge round-trip, cheap to call.
5283
+ *
5284
+ * The returned string is intentionally markdown-flavored: headers per
5285
+ * subagent, a one-line meta row (iter / tools / ms), and the task's
5286
+ * result text. Pass `style: 'json'` for a programmatic shape instead
5287
+ * (useful when the director model is doing structured-output work).
5288
+ */
5289
+ rollUp(taskIds, style = "markdown") {
5290
+ const rows = taskIds.map((id) => this.completed.get(id)).filter(
5291
+ (r) => !!r
5292
+ );
5293
+ if (style === "json") {
5294
+ return JSON.stringify(
5295
+ rows.map((r) => ({
5296
+ taskId: r.taskId,
5297
+ subagentId: r.subagentId,
5298
+ status: r.status,
5299
+ iterations: r.iterations,
5300
+ toolCalls: r.toolCalls,
5301
+ durationMs: r.durationMs,
5302
+ result: r.result,
5303
+ error: r.error
5304
+ })),
5305
+ null,
5306
+ 2
5307
+ );
5308
+ }
5309
+ if (rows.length === 0) {
5310
+ return "_No completed tasks for the requested ids \u2014 try waiting first._";
5311
+ }
5312
+ const lines = [];
5313
+ for (const r of rows) {
5314
+ const meta = this.subagentMeta.get(r.subagentId);
5315
+ const tag = meta?.provider && meta?.model ? ` \xB7 ${meta.provider}/${meta.model}` : "";
5316
+ lines.push(`### ${r.subagentId}${tag}`);
5317
+ lines.push(
5318
+ `_${r.status} \u2014 ${r.iterations} iter \xB7 ${r.toolCalls} tools \xB7 ${r.durationMs}ms_`
5319
+ );
5320
+ lines.push("");
5321
+ if (r.error) lines.push(`**Error:** ${r.error}`);
5322
+ else if (typeof r.result === "string") lines.push(r.result);
5323
+ else if (r.result !== void 0) lines.push("```json\n" + JSON.stringify(r.result, null, 2) + "\n```");
5324
+ else lines.push("_(no output)_");
5325
+ lines.push("");
5326
+ }
5327
+ return lines.join("\n").trimEnd();
5328
+ }
5329
+ /**
5330
+ * Write the fleet manifest to `manifestPath`. Returns the path written
5331
+ * or null when no path was configured. Captures every spawn + its
5332
+ * assigned tasks — paired with per-subagent JSONLs, this is enough to
5333
+ * replay an entire director run.
5334
+ */
5335
+ async writeManifest() {
5336
+ if (!this.manifestPath) return null;
5337
+ const manifest = {
5338
+ directorRunId: this.id,
5339
+ writtenAt: (/* @__PURE__ */ new Date()).toISOString(),
5340
+ children: Array.from(this.manifestEntries.values()).map((e) => ({
5341
+ ...e,
5342
+ // Surface final status from `completed` when available — manifest
5343
+ // becomes much more useful for replay when it carries the
5344
+ // success/failure state.
5345
+ results: e.taskIds.map((tid) => {
5346
+ const r = this.completed.get(tid);
5347
+ return r ? {
5348
+ taskId: tid,
5349
+ status: r.status,
5350
+ iterations: r.iterations,
5351
+ toolCalls: r.toolCalls,
5352
+ durationMs: r.durationMs
5353
+ } : { taskId: tid, status: "pending" };
5354
+ })
5355
+ })),
5356
+ usage: this.usage.snapshot()
5357
+ };
5358
+ await fsp.mkdir(path2.dirname(this.manifestPath), { recursive: true });
5359
+ await fsp.writeFile(this.manifestPath, JSON.stringify(manifest, null, 2), { mode: 384 });
5360
+ return this.manifestPath;
5361
+ }
5362
+ /**
5363
+ * Tear down the director: stop every subagent, close every bridge
5364
+ * endpoint, and (when configured) write the final manifest. Idempotent
5365
+ * — calling shutdown twice is a no-op on the second invocation.
5366
+ */
5367
+ async shutdown() {
5368
+ await this.coordinator.stopAll();
5369
+ for (const b of this.subagentBridges.values()) {
5370
+ await b.stop().catch(() => void 0);
5371
+ }
5372
+ this.subagentBridges.clear();
5373
+ await this.bridge.stop().catch(() => void 0);
5374
+ if (this.manifestPath) await this.writeManifest().catch(() => void 0);
5375
+ }
5376
+ /**
5377
+ * Hand a task to the coordinator. Returns the assigned task id so
5378
+ * callers can wait on it via `awaitTasks([id])`. The coordinator's
5379
+ * concurrency limit applies — the task may queue before running.
5380
+ */
5381
+ async assign(task) {
5382
+ const taskWithId = task.id ? task : { ...task, id: randomUUID() };
5383
+ if (task.subagentId) {
5384
+ const entry = this.manifestEntries.get(task.subagentId);
5385
+ if (entry) entry.taskIds.push(taskWithId.id);
5386
+ }
5387
+ await this.coordinator.assign(taskWithId);
5388
+ return taskWithId.id;
5389
+ }
5390
+ /**
5391
+ * Block until every task id resolves. Returns results in the same
5392
+ * order as the input. If any task hasn't completed by the time this
5393
+ * is called, the promise hangs until it does — pair with a timeout
5394
+ * at the caller if that's a concern. Resolves immediately for ids
5395
+ * whose results were already cached.
5396
+ */
5397
+ awaitTasks(taskIds) {
5398
+ return Promise.all(taskIds.map((id) => {
5399
+ const cached = this.completed.get(id);
5400
+ if (cached) return cached;
5401
+ const existing = this.taskWaiters.get(id);
5402
+ if (existing) return existing.promise;
5403
+ let resolve4;
5404
+ const promise = new Promise((res) => {
5405
+ resolve4 = res;
5406
+ });
5407
+ this.taskWaiters.set(id, { promise, resolve: resolve4 });
5408
+ return promise;
5409
+ }));
5410
+ }
5411
+ async terminate(subagentId) {
5412
+ await this.coordinator.stop(subagentId);
5413
+ }
5414
+ async terminateAll() {
5415
+ await this.coordinator.stopAll();
5416
+ }
5417
+ status() {
5418
+ return this.coordinator.getStatus();
5419
+ }
5420
+ /**
5421
+ * Subscribe to coordinator events. Currently only `task.completed` is
5422
+ * exposed (the others are internal lifecycle). Returns an unsubscribe
5423
+ * function. External callers (e.g. the CLI's `MultiAgentHost`) use this
5424
+ * to drive their own pending/results tracking without poking the
5425
+ * coordinator directly.
5426
+ */
5427
+ on(event, handler) {
5428
+ this.coordinator.on(event, handler);
5429
+ return () => {
5430
+ this.coordinator.off(event, handler);
5431
+ };
5432
+ }
5433
+ /**
5434
+ * Snapshot of every task that has resolved (success, failed, timeout,
5435
+ * stopped) since the director started. Returned in completion order
5436
+ * via the internal map's iteration order. Used by `/fleet status` to
5437
+ * paint the completed table without reaching into private state.
5438
+ */
5439
+ completedResults() {
5440
+ return Array.from(this.completed.values());
5441
+ }
5442
+ snapshot() {
5443
+ return this.usage.snapshot();
5444
+ }
5445
+ /**
5446
+ * Compose the leader/director-agent system prompt: fleet preamble +
5447
+ * (optional) roster summary + user base prompt. Pass the result to your
5448
+ * leader Agent's `ctx.systemPrompt` when constructing it.
5449
+ *
5450
+ * `basePrompt` defaults to `config.leaderSystemPrompt` so callers can
5451
+ * use the no-arg form when the multi-agent config already carries it.
5452
+ */
5453
+ leaderSystemPrompt(basePrompt) {
5454
+ return composeDirectorPrompt({
5455
+ basePrompt: basePrompt ?? this.coordinator.config.leaderSystemPrompt,
5456
+ directorPreamble: this.directorPreamble,
5457
+ rosterSummary: this.roster ? rosterSummaryFromConfigs(this.roster) : void 0
5458
+ });
5459
+ }
5460
+ /**
5461
+ * Compose a subagent's system prompt for a given `SubagentConfig`:
5462
+ * baseline + role + task + per-spawn override. Returned by value — does
5463
+ * not mutate the config. Factories (the user-supplied `AgentFactory`)
5464
+ * should call this when building each subagent's Agent so the bridge
5465
+ * contract, role context, and override are all surfaced.
5466
+ *
5467
+ * When `taskBrief` is omitted the Task section is dropped. Pass the
5468
+ * actual task description here to reinforce it in the system prompt
5469
+ * (the runner already passes it as user input — duplicating in the
5470
+ * system prompt is optional but improves anchoring on small models).
5471
+ */
5472
+ subagentSystemPrompt(config, taskBrief) {
5473
+ return composeSubagentPrompt({
5474
+ baseline: this.subagentBaseline,
5475
+ role: config.prompt,
5476
+ task: taskBrief,
5477
+ sharedScratchpad: this.sharedScratchpadPath ?? void 0,
5478
+ override: config.systemPromptOverride
5479
+ });
5480
+ }
5481
+ /**
5482
+ * Build the tool set the LLM-driven director uses to orchestrate.
5483
+ * Returns an array of `Tool` definitions; register these on the
5484
+ * director's `Agent` to expose `spawn_subagent`, `assign_task`, etc.
5485
+ * Each tool's `execute()` delegates straight to the matching method
5486
+ * above.
5487
+ *
5488
+ * Tools all carry `permission: 'auto'` — the *user* has already
5489
+ * approved running the director when they kicked off the run, so
5490
+ * gating individual orchestration calls behind a confirm prompt
5491
+ * would just be noise. The actual subagent tools they spawn are
5492
+ * still permission-checked normally.
5493
+ */
5494
+ tools(roster) {
5495
+ const t2 = [
5496
+ makeSpawnTool(this, roster),
5497
+ makeAssignTool(this),
5498
+ makeAwaitTasksTool(this),
5499
+ makeAskTool(this),
5500
+ makeRollUpTool(this),
5501
+ makeTerminateTool(this),
5502
+ makeFleetStatusTool(this),
5503
+ makeFleetUsageTool(this)
5504
+ ];
5505
+ return t2;
5506
+ }
5507
+ };
5508
+ function makeSpawnTool(director, roster) {
5509
+ const inputSchema = {
5510
+ type: "object",
5511
+ properties: {
5512
+ role: { type: "string", description: "Roster role id (preferred). When set, the spawn uses the matching config from the roster and ignores other fields." },
5513
+ name: { type: "string", description: "Display name for the subagent. Required when not using roster." },
5514
+ provider: { type: "string", description: 'Provider id (e.g. "anthropic", "openai"). Defaults to the leader provider when omitted.' },
5515
+ model: { type: "string", description: "Model id within the provider. Defaults to the leader model when omitted." },
5516
+ systemPromptOverride: { type: "string", description: "Extra prompt text appended after the role-base prompt." },
5517
+ maxIterations: { type: "number" },
5518
+ maxToolCalls: { type: "number" },
5519
+ maxCostUsd: { type: "number" }
5520
+ },
5521
+ required: []
5522
+ };
5523
+ return {
5524
+ name: "spawn_subagent",
5525
+ description: "Create a new subagent under this director. Returns the subagent id. Use this when you need a worker with a specific provider, model, or role to handle a piece of the plan.",
5526
+ usageHint: "Either pass `role` (matches the roster) OR pass `name` + optional `provider`/`model`. Returns `{ subagentId }`.",
5527
+ permission: "auto",
5528
+ mutating: false,
5529
+ inputSchema,
5530
+ async execute(input) {
5531
+ const i = input ?? {};
5532
+ const role = typeof i.role === "string" ? i.role : void 0;
5533
+ const base = role && roster ? roster[role] : void 0;
5534
+ if (role && !base) {
5535
+ return { error: `unknown role "${role}". roster has: ${roster ? Object.keys(roster).join(", ") : "(empty)"}` };
5536
+ }
5537
+ const cfg = {
5538
+ ...base ?? { name: i.name ?? "subagent" }
5539
+ };
5540
+ if (typeof i.name === "string") cfg.name = i.name;
5541
+ if (typeof i.provider === "string") cfg.provider = i.provider;
5542
+ if (typeof i.model === "string") cfg.model = i.model;
5543
+ if (typeof i.systemPromptOverride === "string") cfg.systemPromptOverride = i.systemPromptOverride;
5544
+ if (typeof i.maxIterations === "number") cfg.maxIterations = i.maxIterations;
5545
+ if (typeof i.maxToolCalls === "number") cfg.maxToolCalls = i.maxToolCalls;
5546
+ if (typeof i.maxCostUsd === "number") cfg.maxCostUsd = i.maxCostUsd;
5547
+ try {
5548
+ const subagentId = await director.spawn(cfg);
5549
+ return { subagentId, provider: cfg.provider, model: cfg.model, name: cfg.name };
5550
+ } catch (err) {
5551
+ if (err instanceof DirectorBudgetError) {
5552
+ return { error: err.message, kind: err.kind, limit: err.limit, observed: err.observed };
5553
+ }
5554
+ return { error: err instanceof Error ? err.message : String(err) };
5555
+ }
5556
+ }
5557
+ };
5558
+ }
5559
+ function makeAssignTool(director) {
5560
+ const inputSchema = {
5561
+ type: "object",
5562
+ properties: {
5563
+ subagentId: { type: "string", description: "Target subagent id. Required." },
5564
+ description: { type: "string", description: "The task in natural language \u2014 what you want this subagent to do." },
5565
+ maxToolCalls: { type: "number", description: "Optional per-task tool-call budget override." },
5566
+ timeoutMs: { type: "number", description: "Optional per-task timeout in ms." }
5567
+ },
5568
+ required: ["subagentId", "description"]
5569
+ };
5570
+ return {
5571
+ name: "assign_task",
5572
+ description: "Hand a task to a previously spawned subagent. Returns the task id \u2014 pass it to `await_tasks` to block on completion.",
5573
+ permission: "auto",
5574
+ mutating: false,
5575
+ inputSchema,
5576
+ async execute(input) {
5577
+ const i = input;
5578
+ const task = {
5579
+ id: randomUUID(),
5580
+ description: i.description,
5581
+ subagentId: i.subagentId,
5582
+ maxToolCalls: i.maxToolCalls,
5583
+ timeoutMs: i.timeoutMs
5584
+ };
5585
+ const taskId = await director.assign(task);
5586
+ return { taskId, subagentId: i.subagentId };
5587
+ }
5588
+ };
5589
+ }
5590
+ function makeAwaitTasksTool(director) {
5591
+ const inputSchema = {
5592
+ type: "object",
5593
+ properties: {
5594
+ taskIds: {
5595
+ type: "array",
5596
+ items: { type: "string" },
5597
+ description: "One or more task ids returned by `assign_task`. The call blocks until every id resolves."
5598
+ }
5599
+ },
5600
+ required: ["taskIds"]
5601
+ };
5602
+ return {
5603
+ name: "await_tasks",
5604
+ description: "Block until every named task completes. Returns the array of TaskResult \u2014 use this to gather subagent output before deciding the next step.",
5605
+ permission: "auto",
5606
+ mutating: false,
5607
+ inputSchema,
5608
+ async execute(input) {
5609
+ const i = input;
5610
+ const results = await director.awaitTasks(i.taskIds);
5611
+ return { results };
5612
+ }
5613
+ };
5614
+ }
5615
+ function makeAskTool(director) {
5616
+ const inputSchema = {
5617
+ type: "object",
5618
+ properties: {
5619
+ subagentId: { type: "string", description: "Subagent to ask. Must be a previously spawned id." },
5620
+ question: { type: "string", description: "The question or instruction. Sent as the bridge message payload." },
5621
+ timeoutMs: { type: "number", description: "Optional timeout in ms (default 30s)." }
5622
+ },
5623
+ required: ["subagentId", "question"]
5624
+ };
5625
+ return {
5626
+ name: "ask_subagent",
5627
+ description: "Synchronously ask a subagent a question. Blocks until the subagent replies via the bridge (or the timeout fires). Use this when you need a one-shot answer without spawning a fresh task.",
5628
+ permission: "auto",
5629
+ mutating: false,
5630
+ inputSchema,
5631
+ async execute(input) {
5632
+ const i = input;
5633
+ try {
5634
+ const answer = await director.ask(i.subagentId, { question: i.question }, i.timeoutMs);
5635
+ return { ok: true, answer };
5636
+ } catch (err) {
5637
+ return { ok: false, error: err instanceof Error ? err.message : String(err) };
5638
+ }
5639
+ }
5640
+ };
5641
+ }
5642
+ function makeRollUpTool(director) {
5643
+ const inputSchema = {
5644
+ type: "object",
5645
+ properties: {
5646
+ taskIds: {
5647
+ type: "array",
5648
+ items: { type: "string" },
5649
+ description: "Completed task ids to aggregate. Pass the ids returned by previous `assign_task` calls."
5650
+ },
5651
+ style: {
5652
+ type: "string",
5653
+ enum: ["markdown", "json"],
5654
+ description: "Output flavor \u2014 markdown (default) for in-prompt summarization, json for structured downstream processing."
5655
+ }
5656
+ },
5657
+ required: ["taskIds"]
5658
+ };
5659
+ return {
5660
+ name: "roll_up",
5661
+ description: "Aggregate completed task results into a single formatted summary. Use this after `await_tasks` to fold subagent outputs back into the director's context before deciding the next step.",
5662
+ permission: "auto",
5663
+ mutating: false,
5664
+ inputSchema,
5665
+ async execute(input) {
5666
+ const i = input;
5667
+ const summary = director.rollUp(i.taskIds, i.style ?? "markdown");
5668
+ return { summary, count: i.taskIds.length };
5669
+ }
5670
+ };
5671
+ }
5672
+ function makeTerminateTool(director) {
5673
+ const inputSchema = {
5674
+ type: "object",
5675
+ properties: {
5676
+ subagentId: { type: "string", description: "Subagent to abort." }
5677
+ },
5678
+ required: ["subagentId"]
5679
+ };
5680
+ return {
5681
+ name: "terminate_subagent",
5682
+ description: 'Forcibly abort a subagent. Use sparingly \u2014 prefer waiting on the natural budget to expire. The current task (if any) ends with status "stopped".',
5683
+ permission: "auto",
5684
+ mutating: true,
5685
+ inputSchema,
5686
+ async execute(input) {
5687
+ const i = input;
5688
+ await director.terminate(i.subagentId);
5689
+ return { ok: true };
5690
+ }
5691
+ };
5692
+ }
5693
+ function makeFleetStatusTool(director) {
5694
+ return {
5695
+ name: "fleet_status",
5696
+ description: "Snapshot of the fleet \u2014 every subagent's current status, pending vs. completed task counts, and the running total iteration count. Cheap; call freely.",
5697
+ permission: "auto",
5698
+ mutating: false,
5699
+ inputSchema: { type: "object", properties: {}, required: [] },
5700
+ async execute() {
5701
+ return director.status();
5702
+ }
5703
+ };
5704
+ }
5705
+ function makeFleetUsageTool(director) {
5706
+ return {
5707
+ name: "fleet_usage",
5708
+ description: "Token + cost breakdown across the fleet, per-subagent and totals. Use this to reason about which workers to assign costly tasks to or when to wrap up to stay within budget.",
5709
+ permission: "auto",
5710
+ mutating: false,
5711
+ inputSchema: { type: "object", properties: {}, required: [] },
5712
+ async execute() {
5713
+ return director.snapshot();
5714
+ }
5715
+ };
5716
+ }
5717
+ function makeDirectorSessionFactory(opts) {
5718
+ const runId = opts.directorRunId ?? `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-director`;
5719
+ let store;
5720
+ let dir;
5721
+ if (opts.store) {
5722
+ store = opts.store;
5723
+ dir = opts.sessionsRoot ? path2.join(opts.sessionsRoot, runId) : "(caller-managed)";
5724
+ } else if (opts.sessionsRoot) {
5725
+ dir = path2.join(opts.sessionsRoot, runId);
5726
+ store = new DefaultSessionStore({ dir });
5727
+ } else {
5728
+ throw new Error(
5729
+ "makeDirectorSessionFactory requires either `store` or `sessionsRoot`"
5730
+ );
5731
+ }
5732
+ return {
5733
+ dir,
5734
+ directorRunId: runId,
5735
+ async createSubagentSession({ subagentId, provider, model, title }) {
5736
+ return store.create({
5737
+ id: subagentId,
5738
+ title: title ?? subagentId,
5739
+ provider: provider ?? "unknown",
5740
+ model: model ?? "unknown"
5741
+ });
5742
+ }
5743
+ };
5744
+ }
5745
+
5746
+ // src/defaults/agents/fleet.ts
5747
+ var AUDIT_LOG_AGENT = {
5748
+ id: "audit-log",
5749
+ name: "Audit Log",
5750
+ role: "audit-log",
5751
+ prompt: `You are the Audit Log agent. Your job is to analyze structured JSONL
5752
+ session logs and produce actionable markdown reports.
5753
+
5754
+ Scope:
5755
+ - Parse session logs (iteration counts, tool calls, errors, usage)
5756
+ - Detect repeated failure patterns across multiple runs
5757
+ - Identify tool usage anomalies (over-use, failures, unexpected chains)
5758
+ - Track token consumption trends
5759
+ - Generate structured audit reports with severity ratings
5760
+
5761
+ Input format you accept:
5762
+ { "task": "analyze | report | trends", "sessionPath": "<path>", "focus": "errors | tools | usage | all" }
5763
+
5764
+ Output: Markdown audit report with sections:
5765
+ - ## Summary (totals, error rate)
5766
+ - ## Top Errors (count + context)
5767
+ - ## Tool Usage (table with calls, failures, avg duration)
5768
+ - ## Anomalies (pattern \u2192 severity)
5769
+
5770
+ Working rules:
5771
+ - Never fabricate numbers \u2014 read the actual logs first
5772
+ - Always include file:line references for errors
5773
+ - If sessionPath is missing, ask the director to provide it
5774
+ - Report confidence level: high (>90% accuracy), medium, low`,
5775
+ maxIterations: 50,
5776
+ maxToolCalls: 200,
5777
+ timeoutMs: 12e4
5778
+ };
5779
+ var BUG_HUNTER_AGENT = {
5780
+ id: "bug-hunter",
5781
+ name: "Bug Hunter",
5782
+ role: "bug-hunter",
5783
+ prompt: `You are the Bug Hunter agent. Your job is to systematically scan
5784
+ source code for bugs, anti-patterns, and code smells using pattern matching
5785
+ and heuristics. Output a prioritized hit list with file:line references.
5786
+
5787
+ Scope:
5788
+ - Detect common bug patterns (uncaught errors, resource leaks, race conditions)
5789
+ - Identify anti-patterns (callback hell, God objects, circular deps)
5790
+ - Find TypeScript-specific issues (unsafe any, missing null checks, branded types)
5791
+ - Flag security-sensitive constructs (eval, innerHTML, hardcoded secrets)
5792
+ - Rank findings: critical > high > medium > low
5793
+
5794
+ Input format you accept:
5795
+ { "task": "scan | hunt | check", "paths": ["src/**/*.ts"], "focus": "bugs | patterns | security | all", "severityThreshold": "medium" }
5796
+
5797
+ Output: Markdown bug hunt report:
5798
+ - ## Critical (must fix first)
5799
+ - ## High (should fix)
5800
+ - ## Medium
5801
+ - ## Low (consider)
5802
+ Each entry: **[TYPE]** \`file:line\` \u2014 description + suggested fix
5803
+
5804
+ Bug pattern reference you know:
5805
+ | Pattern | Regex hint | Severity |
5806
+ |---------|------------|----------|
5807
+ | Uncaught promise | /.then\\(.*\\)/ without catch | high |
5808
+ | Event leak | on\\( without off/removeListener | high |
5809
+ | Hardcoded secret | [a-zA-Z0-9/_-]{20,} in config files | critical |
5810
+ | unsafe any | : any\\b or <any> | medium |
5811
+ | innerHTML | innerHTML\\s*= | high |
5812
+
5813
+ Working rules:
5814
+ - Never scan node_modules \u2014 it's noise
5815
+ - Always include file:line for every finding
5816
+ - If >30% of findings are false positives, note the confidence level
5817
+ - Ask director for clarification if paths are ambiguous`,
5818
+ maxIterations: 80,
5819
+ maxToolCalls: 300,
5820
+ timeoutMs: 18e4
5821
+ };
5822
+ var REFACTOR_PLANNER_AGENT = {
5823
+ id: "refactor-planner",
5824
+ name: "Refactor Planner",
5825
+ role: "refactor-planner",
5826
+ prompt: `You are the Refactor Planner agent. Your job is to analyze code
5827
+ structure and produce a concrete, phased refactoring plan with risk
5828
+ assessment, dependency ordering, and rollback strategy.
5829
+
5830
+ Scope:
5831
+ - Map module-level dependencies (import graph)
5832
+ - Identify coupling hotspots (high fan-in/out modules)
5833
+ - Assess refactoring risk by complexity and test coverage
5834
+ - Generate phased plans with checkpoint milestones
5835
+ - Produce diff-friendly task lists (one task = one concern)
5836
+
5837
+ Input format you accept:
5838
+ { "task": "plan | assess | roadmap", "target": "src/core", "constraint": "no-breaking-changes | minimal-downtime | full-rewrite", "focus": "architecture | performance | maintainability" }
5839
+
5840
+ Output: Markdown refactor plan:
5841
+ - ## Phase 1: Low Risk / High Payoff (do first)
5842
+ Table: | # | Task | Module | Risk | Est. Time |
5843
+ - ## Phase 2: Medium Risk
5844
+ - ## Phase 3: High Risk (requires full regression)
5845
+ - ## Dependency Graph (abbreviated ASCII)
5846
+ - ## Rollback Strategy
5847
+ - ## Exit Criteria (checkbox list)
5848
+
5849
+ Risk scoring criteria:
5850
+ | Factor | Low | Medium | High |
5851
+ |--------|-----|--------|------|
5852
+ | Cyclomatic complexity | <10 | 10-20 | >20 |
5853
+ | Test coverage | >80% | 50-80% | <50% |
5854
+ | Fan-out (imports) | <5 | 5-15 | >15 |
5855
+
5856
+ Working rules:
5857
+ - Always include rollback strategy \u2014 every refactor can fail
5858
+ - Merge tasks that take <1h into a single phase
5859
+ - Respect team constraints (reviewer availability, parallelization)
5860
+ - Never plan without analyzing the actual code first`,
5861
+ maxIterations: 60,
5862
+ maxToolCalls: 250,
5863
+ timeoutMs: 15e4
5864
+ };
5865
+ var SECURITY_SCANNER_AGENT = {
5866
+ id: "security-scanner",
5867
+ name: "Security Scanner",
5868
+ role: "security-scanner",
5869
+ prompt: `You are the Security Scanner agent. Your job is to scan code,
5870
+ configs, and dependencies for security issues from hardcoded secrets to
5871
+ supply chain risks.
5872
+
5873
+ Scope:
5874
+ - Detect hardcoded secrets: API keys, tokens, passwords, private keys
5875
+ - Find injection vectors: eval, innerHTML, SQL concat, shell injection
5876
+ - Identify insecure patterns: weak crypto, hardcoded IVs, disabled TLS
5877
+ - Scan dependencies for known CVEs (via npm/pnpm audit)
5878
+ - Flag supply chain risks: postinstall hooks, unverified scripts, .npmrc
5879
+
5880
+ Input format you accept:
5881
+ { "task": "scan | audit | secrets | dependencies", "paths": ["src", "config"], "depth": "quick | normal | deep" }
5882
+
5883
+ Output: Markdown security report:
5884
+ - ## CRITICAL: Secrets Found (with code snippets)
5885
+ - ## HIGH: Injection Vectors
5886
+ - ## MEDIUM: Insecure Patterns
5887
+ - ## Dependency Issues (CVE list)
5888
+ - ## Summary table (severity \u2192 count)
5889
+ - ## Remediation Checklist (with checkboxes)
5890
+
5891
+ Secret patterns you detect:
5892
+ | Pattern | Example | Severity |
5893
+ |---------|---------|----------|
5894
+ | AWS Access Key | AKIAIOSFODNN7EXAMPLE | critical |
5895
+ | AWS Secret Key | [a-zA-Z0-9/+=]{40} base64 | critical |
5896
+ | GitHub Token | ghp_[a-zA-Z0-9]{36} | critical |
5897
+ | Private Key PEM | -----BEGIN.*PRIVATE KEY----- | critical |
5898
+ | JWT | eyJ[a-zA-Z0-9_-]+ | high |
5899
+
5900
+ Injection patterns:
5901
+ | Construct | Safe alternative |
5902
+ |-----------|-----------------|
5903
+ | eval(str) | new Function() or parse |
5904
+ | innerHTML = x | textContent or sanitize |
5905
+ | exec(\`cmd \${x}\`) | execFile with args array |
5906
+
5907
+ Working rules:
5908
+ - Never scan node_modules \u2014 use npm audit instead
5909
+ - Always provide remediation steps, not just findings
5910
+ - Verify regex-based secrets before flagging (false positive risk)
5911
+ - When in doubt, flag as medium rather than ignoring potential issues`,
5912
+ maxIterations: 70,
5913
+ maxToolCalls: 280,
5914
+ timeoutMs: 16e4
5915
+ };
5916
+ var FLEET_ROSTER = {
5917
+ "audit-log": AUDIT_LOG_AGENT,
5918
+ "bug-hunter": BUG_HUNTER_AGENT,
5919
+ "refactor-planner": REFACTOR_PLANNER_AGENT,
5920
+ "security-scanner": SECURITY_SCANNER_AGENT
5921
+ };
5922
+ var ALL_FLEET_AGENTS = Object.values(FLEET_ROSTER);
5923
+
4840
5924
  // src/defaults/autonomous-runner.ts
4841
5925
  var DoneConditionChecker = class {
4842
5926
  constructor(condition) {
@@ -4878,6 +5962,16 @@ var AutonomousRunner = class {
4878
5962
  stopped = false;
4879
5963
  doneChecker;
4880
5964
  async run() {
5965
+ const offToolExecuted = this.opts.agent.events?.on?.("tool.executed", () => {
5966
+ this.toolCalls++;
5967
+ });
5968
+ try {
5969
+ return await this.runLoop();
5970
+ } finally {
5971
+ offToolExecuted?.();
5972
+ }
5973
+ }
5974
+ async runLoop() {
4881
5975
  while (!this.stopped) {
4882
5976
  const check = this.doneChecker.check({
4883
5977
  iterations: this.iterations,
@@ -4904,7 +5998,6 @@ var AutonomousRunner = class {
4904
5998
  );
4905
5999
  this.iterations++;
4906
6000
  this.lastOutput = result.finalText;
4907
- this.toolCalls++;
4908
6001
  if (result.status === "failed" || result.status === "aborted") {
4909
6002
  const failedResult = {
4910
6003
  status: result.status,
@@ -6711,7 +7804,7 @@ var PROMETHEUS_CONTENT_TYPE = "text/plain; version=0.0.4; charset=utf-8";
6711
7804
  async function startMetricsServer(opts) {
6712
7805
  const { createServer } = await import('http');
6713
7806
  const host = opts.host ?? "127.0.0.1";
6714
- const path15 = opts.path ?? "/metrics";
7807
+ const path17 = opts.path ?? "/metrics";
6715
7808
  const healthPath = opts.healthPath ?? "/healthz";
6716
7809
  const healthRegistry = opts.healthRegistry;
6717
7810
  const server = createServer((req, res) => {
@@ -6721,7 +7814,7 @@ async function startMetricsServer(opts) {
6721
7814
  return;
6722
7815
  }
6723
7816
  const url = req.url.split("?")[0];
6724
- if (url === path15) {
7817
+ if (url === path17) {
6725
7818
  let body;
6726
7819
  try {
6727
7820
  body = renderPrometheus(opts.sink.snapshot());
@@ -6772,7 +7865,7 @@ async function startMetricsServer(opts) {
6772
7865
  const boundPort = typeof addr === "object" && addr ? addr.port : opts.port;
6773
7866
  return {
6774
7867
  port: boundPort,
6775
- url: `http://${host}:${boundPort}${path15}`,
7868
+ url: `http://${host}:${boundPort}${path17}`,
6776
7869
  close: () => new Promise((resolve4, reject) => {
6777
7870
  server.close((err) => err ? reject(err) : resolve4());
6778
7871
  })
@@ -8810,7 +9903,7 @@ var noopSlashCommands = {
8810
9903
  };
8811
9904
 
8812
9905
  // src/plugin/loader.ts
8813
- var KERNEL_API_VERSION = "0.1.1";
9906
+ var KERNEL_API_VERSION = "0.1.9";
8814
9907
  function parseSemver(v) {
8815
9908
  const parts = v.replace(/^[^0-9]*/, "").split(".").map((s) => Number.parseInt(s, 10) || 0);
8816
9909
  return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
@@ -9042,6 +10135,6 @@ function wrapApiForCapabilityCheck(plugin, api, log) {
9042
10135
  });
9043
10136
  }
9044
10137
 
9045
- export { Agent, AgentError, AutoCompactionMiddleware, AutonomousRunner, BudgetExceededError, ConfigError, ConfigMigrationError, Container, Context, ConversationState, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_MAX_ITERATIONS, DEFAULT_MODES, DEFAULT_SPEC_TEMPLATE, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultPluginAPI, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultTaskStore, DefaultTokenCounter, DoneConditionChecker, ENCRYPTED_PREFIX, EventBus, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, InputBuilder, IntelligentCompactor, KERNEL_API_VERSION, LAYER_1_IDENTITY, LLMSelector, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, Pipeline, PluginError, ProviderError, ProviderRegistry, QueueStore, RecoveryLock, RunController, SelectiveCompactor, SessionError, SlashCommandRegistry, SpecDrivenDev, SpecParser, SubagentBudget, TOKENS, TaskFlow, TaskGenerator, TaskTracker, ToolError, ToolExecutor, ToolRegistry, WrongStackError, allServers, asBlocks, asText, atomicWrite, awsServer, blockServer, braveSearchServer, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, color, compileGlob, computeTaskProgress, context7Server, contextManagerTool, createContextManagerTool, createDefaultPipelines, createMessage, createToolOutputSerializer, decryptConfigSecrets, detectNewlineStyle, encryptConfigSecrets, ensureDir, estimateTextTokens, estimateToolInputTokens, estimateToolResultTokens, everArtServer, extractRunEnv, filesystemServer, findCriticalPath, githubServer, googleMapsServer, isAgentError, isConfigError, isImageBlock, isPluginError, isSessionError, isTextBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, loadPlugins, loadProjectModes, loadUserModes, makeAgentSubagentRunner, matchAny, matchGlob, migratePlaintextSecrets, normalizeToLf, projectHash, renderPrometheus, resolveWstackPaths, rewriteConfigEncrypted, runConfigMigrations, safeParse, safeStringify, sanitizeJsonString, sentinelServer, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, stripAnsi, toStyle, toWrongStackError, topologicalSort, unifiedDiff, unloadPlugins, validateAgainstSchema, wireMetricsToEvents, wrapAsState };
10138
+ export { ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, Agent, AgentError, AutoCompactionMiddleware, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, ConfigError, ConfigMigrationError, Container, Context, ConversationState, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_MAX_ITERATIONS, DEFAULT_MODES, DEFAULT_SPEC_TEMPLATE, DEFAULT_SUBAGENT_BASELINE, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultPluginAPI, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultTaskStore, DefaultTokenCounter, Director, DirectorBudgetError, DoneConditionChecker, ENCRYPTED_PREFIX, EventBus, FLEET_ROSTER, FleetBus, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, InputBuilder, IntelligentCompactor, KERNEL_API_VERSION, LAYER_1_IDENTITY, LLMSelector, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, Pipeline, PluginError, ProviderError, ProviderRegistry, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, RunController, SECURITY_SCANNER_AGENT, SelectiveCompactor, SessionError, SlashCommandRegistry, SpecDrivenDev, SpecParser, SubagentBudget, TOKENS, TaskFlow, TaskGenerator, TaskTracker, ToolError, ToolExecutor, ToolRegistry, WrongStackError, allServers, asBlocks, asText, atomicWrite, awsServer, blockServer, braveSearchServer, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, color, compileGlob, composeDirectorPrompt, composeSubagentPrompt, computeTaskProgress, context7Server, contextManagerTool, createContextManagerTool, createDefaultPipelines, createMessage, createToolOutputSerializer, decryptConfigSecrets, detectNewlineStyle, encryptConfigSecrets, ensureDir, estimateTextTokens, estimateToolInputTokens, estimateToolResultTokens, everArtServer, extractRunEnv, filesystemServer, findCriticalPath, githubServer, googleMapsServer, isAgentError, isConfigError, isImageBlock, isPluginError, isSessionError, isTextBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, loadPlugins, loadProjectModes, loadUserModes, makeAgentSubagentRunner, makeDirectorSessionFactory, matchAny, matchGlob, migratePlaintextSecrets, normalizeToLf, projectHash, renderPrometheus, resolveWstackPaths, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, safeParse, safeStringify, sanitizeJsonString, sentinelServer, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, stripAnsi, toStyle, toWrongStackError, topologicalSort, unifiedDiff, unloadPlugins, validateAgainstSchema, wireMetricsToEvents, wrapAsState };
9046
10139
  //# sourceMappingURL=index.js.map
9047
10140
  //# sourceMappingURL=index.js.map