@wrongstack/core 0.1.8 → 0.1.10

package/dist/types/index.js

@@ -1,3 +1,8 @@
+import { randomBytes, createCipheriv, createDecipheriv, randomUUID } from 'crypto';
+import * as fs from 'fs';
+import * as fs4 from 'fs/promises';
+import * as path3 from 'path';
+
 // src/types/blocks.ts
 function isTextBlock(b) {
   return b.type === "text";
@@ -11,6 +16,9 @@ function isToolResultBlock(b) {
 function isImageBlock(b) {
   return b.type === "image";
 }
+function isThinkingBlock(b) {
+  return b.type === "thinking";
+}
 
 // src/types/messages.ts
 function asBlocks(content) {
@@ -228,6 +236,1069 @@ function providerStatusToCode(status, type) {
 // src/types/secret-vault.ts
 var ENCRYPTED_PREFIX = "enc:v1:";
 
+// src/security/secret-vault.ts
+var KEY_BYTES = 32;
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+var ALGO = "aes-256-gcm";
+var DefaultSecretVault = class {
+  keyFile;
+  key;
+  constructor(opts) {
+    this.keyFile = opts.keyFile;
+  }
+  isEncrypted(value) {
+    return typeof value === "string" && value.startsWith(ENCRYPTED_PREFIX);
+  }
+  encrypt(plaintext) {
+    if (this.isEncrypted(plaintext)) return plaintext;
+    const key = this.loadOrCreateKey();
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv(ALGO, key, iv);
+    const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${ENCRYPTED_PREFIX}${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
+  }
+  decrypt(value) {
+    if (!this.isEncrypted(value)) return value;
+    const rest = value.slice(ENCRYPTED_PREFIX.length);
+    const parts = rest.split(":");
+    if (parts.length !== 3) {
+      throw new Error("SecretVault: malformed encrypted value");
+    }
+    const [ivB64, tagB64, ctB64] = parts;
+    const iv = Buffer.from(ivB64, "base64");
+    const tag = Buffer.from(tagB64, "base64");
+    const ct = Buffer.from(ctB64, "base64");
+    if (iv.length !== IV_BYTES) throw new Error("SecretVault: bad IV length");
+    if (tag.length !== TAG_BYTES) throw new Error("SecretVault: bad tag length");
+    const key = this.loadOrCreateKey();
+    const decipher = createDecipheriv(ALGO, key, iv);
+    decipher.setAuthTag(tag);
+    const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+    return pt.toString("utf8");
+  }
+  loadOrCreateKey() {
+    if (this.key) return this.key;
+    try {
+      const buf = fs.readFileSync(this.keyFile);
+      if (buf.length !== KEY_BYTES) {
+        throw new Error(`SecretVault: key file ${this.keyFile} has wrong size`);
+      }
+      this.key = buf;
+      return this.key;
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+    fs.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    const key = randomBytes(KEY_BYTES);
+    try {
+      fs.writeFileSync(this.keyFile, key, { mode: 384, flag: "wx" });
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      const buf = fs.readFileSync(this.keyFile);
+      if (buf.length !== KEY_BYTES) {
+        throw new Error(`SecretVault: key file ${this.keyFile} has wrong size`);
+      }
+      this.key = buf;
+      return this.key;
+    }
+    this.key = key;
+    return key;
+  }
+};
+function decryptConfigSecrets(cfg, vault) {
+  return walk(cfg, vault, (v, key) => {
+    try {
+      return vault.decrypt(v);
+    } catch (err) {
+      console.warn(
+        `[secret-vault] Failed to decrypt "${key}":`,
+        err instanceof Error ? err.message : err
+      );
+      return "";
+    }
+  });
+}
+function encryptConfigSecrets(cfg, vault) {
+  return walk(cfg, vault, (v) => vault.encrypt(v));
+}
+function walk(node, vault, transform) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walk(item, vault, transform));
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && isSecretField(k)) {
+      out[k] = transform(v, k);
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walk(v, vault, transform);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key)/i;
+var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
+function isSecretField(name) {
+  const lc = name.toLowerCase();
+  if (NON_SECRET_OVERRIDES.has(lc)) return false;
+  return SECRET_KEY_PATTERN.test(lc);
+}
+async function rewriteConfigEncrypted(configPath, vault, patch) {
+  let current = {};
+  try {
+    const raw = await fs4.readFile(configPath, "utf8");
+    current = JSON.parse(raw);
+  } catch {
+  }
+  const merged = deepMerge(current, patch ?? {});
+  const encrypted = encryptConfigSecrets(merged, vault);
+  await fs4.mkdir(path3.dirname(configPath), { recursive: true });
+  await fs4.writeFile(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  try {
+    await fs4.chmod(configPath, 384);
+  } catch {
+  }
+}
+async function migratePlaintextSecrets(configPath, vault) {
+  let raw;
+  try {
+    raw = await fs4.readFile(configPath, "utf8");
+  } catch {
+    return { migrated: 0, file: configPath };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { migrated: 0, file: configPath };
+  }
+  const counter = { n: 0 };
+  const migrated = walkCount(parsed, vault, counter);
+  if (counter.n === 0) return { migrated: 0, file: configPath };
+  await fs4.writeFile(configPath, JSON.stringify(migrated, null, 2), { mode: 384 });
+  try {
+    await fs4.chmod(configPath, 384);
+  } catch {
+  }
+  return { migrated: counter.n, file: configPath };
+}
+function walkCount(node, vault, counter) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walkCount(item, vault, counter));
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && isSecretField(k) && !vault.isEncrypted(v) && v.length > 0) {
+      out[k] = vault.encrypt(v);
+      counter.n++;
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walkCount(v, vault, counter);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function deepMerge(a, b) {
+  const out = { ...a };
+  for (const [k, v] of Object.entries(b)) {
+    if (FORBIDDEN_PROTO_KEYS.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge(existing, v);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
+// src/utils/color.ts
+var isColorTty = () => {
+  if (process.env.NO_COLOR) return false;
+  if (process.env.FORCE_COLOR) return true;
+  return Boolean(process.stdout?.isTTY);
+};
+var COLOR = isColorTty();
+var wrap = (open2, close) => (s) => COLOR ? `\x1B[${open2}m${s}\x1B[${close}m` : s;
+var color = {
+  reset: wrap("0", "0"),
+  bold: wrap("1", "22"),
+  dim: wrap("2", "22"),
+  italic: wrap("3", "23"),
+  underline: wrap("4", "24"),
+  red: wrap("31", "39"),
+  green: wrap("32", "39"),
+  yellow: wrap("33", "39"),
+  blue: wrap("34", "39"),
+  magenta: wrap("35", "39"),
+  cyan: wrap("36", "39"),
+  gray: wrap("90", "39"),
+  amber: wrap("38;5;214", "39"),
+  pink: wrap("38;5;205", "39"),
+  bgRed: wrap("41", "49"),
+  bgGreen: wrap("42", "49")
+};
+
+// src/infrastructure/logger.ts
+var LEVEL_RANK = {
+  error: 0,
+  warn: 1,
+  info: 2,
+  debug: 3,
+  trace: 4
+};
+var COLORS = {
+  error: color.red,
+  warn: color.yellow,
+  info: color.cyan,
+  debug: color.gray,
+  trace: color.dim
+};
+var DefaultLogger = class _DefaultLogger {
+  level;
+  file;
+  bindings;
+  pretty;
+  constructor(opts = {}) {
+    this.level = opts.level ?? process.env.WRONGSTACK_LOG_LEVEL ?? "info";
+    this.file = opts.file;
+    this.bindings = opts.bindings ?? {};
+    this.pretty = opts.pretty ?? true;
+    if (this.file) {
+      try {
+        fs.mkdirSync(path3.dirname(this.file), { recursive: true });
+      } catch {
+      }
+    }
+  }
+  error(msg, ctx) {
+    this.log("error", msg, ctx);
+  }
+  warn(msg, ctx) {
+    this.log("warn", msg, ctx);
+  }
+  info(msg, ctx) {
+    this.log("info", msg, ctx);
+  }
+  debug(msg, ctx) {
+    this.log("debug", msg, ctx);
+  }
+  trace(msg, ctx) {
+    this.log("trace", msg, ctx);
+  }
+  child(bindings) {
+    return new _DefaultLogger({
+      level: this.level,
+      file: this.file,
+      pretty: this.pretty,
+      bindings: { ...this.bindings, ...bindings }
+    });
+  }
+  log(level, msg, ctx) {
+    const r = LEVEL_RANK[level];
+    const allowed = LEVEL_RANK[this.level];
+    if (r > allowed) return;
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    const entry = { ts, level, msg, ...this.bindings };
+    if (ctx !== void 0) {
+      entry.ctx = ctx instanceof Error ? { message: ctx.message, stack: ctx.stack } : ctx;
+    }
+    if (this.file) {
+      try {
+        fs.appendFileSync(this.file, `${JSON.stringify(entry)}
+`);
+      } catch {
+      }
+    }
+    if (r <= LEVEL_RANK.warn || this.level === "debug" || this.level === "trace") {
+      const head = `${color.dim(ts)} ${COLORS[level](level.toUpperCase().padEnd(5))} ${msg}`;
+      if (ctx !== void 0) {
+        process.stderr.write(`${head} ${formatCtx(ctx)}
+`);
+      } else {
+        process.stderr.write(`${head}
+`);
+      }
+    }
+  }
+};
+function formatCtx(ctx) {
+  if (ctx instanceof Error) return color.dim(ctx.message);
+  if (typeof ctx === "string") return color.dim(ctx);
+  try {
+    return color.dim(JSON.stringify(ctx));
+  } catch {
+    return color.dim(String(ctx));
+  }
+}
+
+// src/infrastructure/token-counter.ts
+var DefaultTokenCounter = class {
+  input = 0;
+  output = 0;
+  cacheRead = 0;
+  cacheWrite = 0;
+  costInput = 0;
+  costOutput = 0;
+  registry;
+  providerId;
+  events;
+  priceCache = /* @__PURE__ */ new Map();
+  constructor(opts = {}) {
+    this.registry = opts.registry;
+    this.providerId = opts.providerId;
+    this.events = opts.events;
+  }
+  account(usage, model) {
+    this.input += usage.input;
+    this.output += usage.output;
+    this.cacheRead += usage.cacheRead ?? 0;
+    this.cacheWrite += usage.cacheWrite ?? 0;
+    const price = model ? this.priceCache.get(model) : void 0;
+    if (price) {
+      this.applyPrice(usage, price);
+    } else if (this.registry && this.providerId && model) {
+      void this.registry.getModel(this.providerId, model).then((m) => {
+        if (m) {
+          const p = priceFromModel(m);
+          this.priceCache.set(model, p);
+          this.applyPrice(usage, p);
+        }
+      }).catch(() => {
+        this.events?.emit("token.cost_estimate_unavailable", { model: model ?? "<unknown>" });
+        return void 0;
+      });
+    }
+  }
+  /** Synchronous variant for code paths that have already resolved the model. */
+  accountWithModel(usage, resolved) {
+    this.input += usage.input;
+    this.output += usage.output;
+    this.cacheRead += usage.cacheRead ?? 0;
+    this.cacheWrite += usage.cacheWrite ?? 0;
+    const price = priceFromModel(resolved);
+    this.priceCache.set(resolved.modelId, price);
+    this.applyPrice(usage, price);
+  }
+  total() {
+    return {
+      input: this.input,
+      output: this.output,
+      cacheRead: this.cacheRead,
+      cacheWrite: this.cacheWrite
+    };
+  }
+  estimateCost() {
+    return {
+      input: round4(this.costInput),
+      output: round4(this.costOutput),
+      total: round4(this.costInput + this.costOutput),
+      currency: "USD"
+    };
+  }
+  cacheStats() {
+    const denom = this.cacheRead + this.input;
+    return {
+      readTokens: this.cacheRead,
+      writeTokens: this.cacheWrite,
+      hitRatio: denom === 0 ? 0 : this.cacheRead / denom
+    };
+  }
+  /** Invalidate cached prices so the next account() call fetches fresh data. */
+  invalidateCache() {
+    this.priceCache.clear();
+  }
+  reset() {
+    this.input = 0;
+    this.output = 0;
+    this.cacheRead = 0;
+    this.cacheWrite = 0;
+    this.costInput = 0;
+    this.costOutput = 0;
+  }
+  applyPrice(usage, price) {
+    if (price.input) this.costInput += usage.input / 1e6 * price.input;
+    if (price.output) this.costOutput += usage.output / 1e6 * price.output;
+    if (usage.cacheRead && price.cacheRead) {
+      this.costInput += usage.cacheRead / 1e6 * price.cacheRead;
+    }
+    if (usage.cacheWrite && price.cacheWrite) {
+      this.costInput += usage.cacheWrite / 1e6 * price.cacheWrite;
+    }
+  }
+};
+function priceFromModel(m) {
+  return {
+    input: m.cost?.input,
+    output: m.cost?.output,
+    cacheRead: m.cost?.cache_read,
+    cacheWrite: m.cost?.cache_write
+  };
+}
+function round4(n) {
+  return Math.round(n * 1e4) / 1e4;
+}
+
+// src/utils/token-estimate.ts
+var RoughTokenEstimate = (text) => Math.max(1, Math.ceil(text.length / 4));
+var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
+var ESTIMATE_CACHE_MAX_SIZE = 1e4;
+function getCachedEstimate(key, compute) {
+  const existing = ESTIMATE_CACHE.get(key);
+  if (existing !== void 0) return existing;
+  if (ESTIMATE_CACHE.size >= ESTIMATE_CACHE_MAX_SIZE) {
+    const keys = [...ESTIMATE_CACHE.keys()];
+    for (let i = 0; i < Math.floor(ESTIMATE_CACHE_MAX_SIZE / 4); i++) {
+      ESTIMATE_CACHE.delete(keys[i]);
+    }
+  }
+  const estimate = compute();
+  ESTIMATE_CACHE.set(key, estimate);
+  return estimate;
+}
+function estimateToolInputTokens(input) {
+  if (typeof input === "string") return RoughTokenEstimate(input);
+  if (input === null || typeof input !== "object") {
+    return RoughTokenEstimate(String(input));
+  }
+  const key = JSON.stringify(input);
+  return getCachedEstimate(key, () => RoughTokenEstimate(key));
+}
+function estimateToolResultTokens(content) {
+  if (typeof content === "string") return RoughTokenEstimate(content);
+  const key = JSON.stringify(content);
+  return getCachedEstimate(key, () => RoughTokenEstimate(key));
+}
+function estimateTextTokens(text) {
+  return RoughTokenEstimate(text);
+}
+
+// src/execution/compactor.ts
+var HybridCompactor = class {
+  preserveK;
+  eliseThreshold;
+  estimator;
+  constructor(opts = {}) {
+    this.preserveK = opts.preserveK ?? 10;
+    this.eliseThreshold = opts.eliseThreshold ?? 2e3;
+    this.estimator = opts.estimator ?? estimateTextTokens;
+  }
+  async compact(ctx, opts = {}) {
+    const beforeTokens = this.estimateMessages(ctx.messages);
+    const reductions = [];
+    const phase1Saved = this.eliseOldToolResults(ctx);
+    if (phase1Saved > 0) reductions.push({ phase: "elision", saved: phase1Saved });
+    if (opts.aggressive) {
+      const phase2Saved = this.collapseAncientTurns(ctx);
+      if (phase2Saved > 0) reductions.push({ phase: "summary", saved: phase2Saved });
+    }
+    const afterTokens = this.estimateMessages(ctx.messages);
+    return { before: beforeTokens, after: afterTokens, reductions };
+  }
+  eliseOldToolResults(ctx) {
+    const messages = ctx.messages;
+    let pairCount = 0;
+    let preserveStart = messages.length;
+    for (let i = messages.length - 1; i >= 0 && pairCount < this.preserveK; i--) {
+      const m = messages[i];
+      if (!m) continue;
+      if (m.role === "user" || m.role === "assistant") {
+        pairCount++;
+        preserveStart = i;
+      }
+    }
+    let saved = 0;
+    let changed = false;
+    const nextMessages = new Array(messages.length);
+    for (let i = 0; i < messages.length; i++) {
+      const msg = messages[i];
+      if (i >= preserveStart) {
+        nextMessages[i] = msg;
+        continue;
+      }
+      if (!msg || !Array.isArray(msg.content)) {
+        nextMessages[i] = msg;
+        continue;
+      }
+      const newContent = msg.content.map((b) => {
+        if (b.type !== "tool_result") return b;
+        const tokens = estimateToolResultTokens(b.content);
+        if (tokens < this.eliseThreshold) return b;
+        saved += tokens;
+        const elided = {
+          type: "tool_result",
+          tool_use_id: b.tool_use_id,
+          content: `[elided: ~${tokens} tokens removed. Call the tool again if needed.]`,
+          is_error: b.is_error
+        };
+        return elided;
+      });
+      if (newContent.length === msg.content.length && newContent.every((b, idx) => b === msg.content[idx])) {
+        nextMessages[i] = msg;
+      } else {
+        nextMessages[i] = { ...msg, content: newContent };
+        changed = true;
+      }
+    }
+    if (changed) ctx.state.replaceMessages(nextMessages);
+    return saved;
+  }
+  collapseAncientTurns(ctx) {
+    const messages = ctx.messages;
+    const cutTarget = Math.max(0, messages.length - this.preserveK * 2);
+    if (cutTarget <= 0) return 0;
+    let boundary = -1;
+    for (let i = cutTarget; i < messages.length; i++) {
+      const m = messages[i];
+      if (!m) continue;
+      if (m.role === "user" && hasTextContent(m)) {
+        boundary = i;
+        break;
+      }
+    }
+    if (boundary <= 0) return 0;
+    const removed = messages.slice(0, boundary);
+    const removedTokens = this.estimateMessages(removed);
+    const summary = [
+      {
+        role: "user",
+        content: `[previous_session_summary: ${removed.length} earlier turns compacted. Todo state preserved in context.]`
+      },
+      { role: "assistant", content: "Continuing from compacted context." }
+    ];
+    const tail = ctx.messages.slice(boundary);
+    ctx.state.replaceMessages([...summary, ...tail]);
+    return Math.max(0, removedTokens - this.estimateMessages(summary));
+  }
+  estimateMessages(messages) {
+    let total = 0;
+    for (const m of messages) {
+      if (typeof m.content === "string") {
+        total += this.estimator(m.content);
+      } else {
+        for (const b of m.content) {
+          if (b.type === "text") total += this.estimator(b.text);
+          else if (b.type === "tool_use") total += estimateToolInputTokens(b.input);
+          else if (b.type === "tool_result") total += estimateToolResultTokens(b.content);
+        }
+      }
+    }
+    return total;
+  }
+};
+function hasTextContent(m) {
+  if (typeof m.content === "string") return m.content.trim().length > 0;
+  return m.content.some((b) => b.type === "text" && b.text.trim().length > 0);
+}
+var PROJECT_MARKERS = [
+  ".git",
+  "package.json",
+  "pnpm-workspace.yaml",
+  "go.mod",
+  "Cargo.toml",
+  "pyproject.toml",
+  ".wrongstack"
+];
+var DefaultPathResolver = class {
+  projectRoot;
+  cwd;
+  constructor(cwd = process.cwd()) {
+    this.cwd = path3.resolve(cwd);
+    this.projectRoot = this.detectProjectRoot(this.cwd);
+  }
+  detectProjectRoot(start) {
+    let dir = path3.resolve(start);
+    const root = path3.parse(dir).root;
+    while (dir !== root) {
+      for (const marker of PROJECT_MARKERS) {
+        try {
+          fs.accessSync(path3.join(dir, marker));
+          return dir;
+        } catch {
+        }
+      }
+      const parent = path3.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+    return path3.resolve(start);
+  }
+  resolve(input) {
+    const abs = path3.isAbsolute(input) ? input : path3.resolve(this.cwd, input);
+    let real;
+    try {
+      real = fs.realpathSync(abs);
+    } catch {
+      real = path3.normalize(abs);
+    }
+    return real;
+  }
+  isInsideRoot(absPath) {
+    const normalized = path3.normalize(absPath);
+    const root = path3.normalize(this.projectRoot);
+    if (normalized === root) return true;
+    const rel = path3.relative(root, normalized);
+    return !rel.startsWith("..") && !path3.isAbsolute(rel);
+  }
+  ensureInsideRoot(absPath) {
+    const resolved = this.resolve(absPath);
+    if (!this.isInsideRoot(resolved)) {
+      const display = path3.isAbsolute(absPath) ? path3.basename(absPath) : absPath;
+      const err = new Error(`Path "${display}" resolves outside the project root`);
+      err.fullPath = absPath;
+      err.projectRoot = this.projectRoot;
+      throw err;
+    }
+    return resolved;
+  }
+};
+
+// src/execution/error-handler.ts
+var CONTEXT_OVERFLOW_RE = /context|too long|tokens/i;
+var NETWORK_ERR_RE = /ECONN|ETIMEDOUT|ETIME|ENOTFOUND|EAI_AGAIN|fetch failed/i;
+function buildRecoveryStrategies(opts) {
+  return [
+    {
+      label: "context_overflow_reduce",
+      compactor: opts?.compactor,
+      async attempt(err, ctx) {
+        if (!(err instanceof ProviderError)) return null;
+        if (err.status !== 413 && !CONTEXT_OVERFLOW_RE.test(err.message)) return null;
+        if (this.compactor) {
+          try {
+            const report = await this.compactor.compact(ctx, { aggressive: true });
+            if (report.after < report.before) {
+              return { action: "retry", reason: "context_compacted" };
+            }
+          } catch {
+          }
+        }
+        return null;
+      }
+    },
+    {
+      label: "rate_limit_backoff",
+      async attempt(err) {
+        if (!(err instanceof ProviderError) || err.status !== 429) return null;
+        const delayMs = err.body?.retryAfterMs ?? 5e3;
+        const delay = Math.max(1e3, Math.min(delayMs, 6e4));
+        await new Promise((r) => setTimeout(r, delay));
+        return { action: "retry", reason: "rate_limit_backoff" };
+      }
+    },
+    {
+      label: "downgrade_model",
+      async attempt(err, ctx) {
+        if (!(err instanceof ProviderError)) return null;
+        if (err.status !== 429 && err.status !== 529 && err.status < 500) return null;
+        const registry = opts?.modelsRegistry;
+        if (!registry) return null;
+        try {
+          const providerId = ctx.provider?.id;
+          if (!providerId) return null;
+          const provider = await registry.getProvider(providerId);
+          if (!provider) return null;
+          const currentModel = await registry.getModel(providerId, ctx.model);
+          if (!currentModel) return null;
+          const candidates = provider.models.filter((m) => {
+            const modelCost = m.cost?.input ?? Number.POSITIVE_INFINITY;
+            const currentCost = currentModel.cost?.input ?? Number.POSITIVE_INFINITY;
+            if (modelCost >= currentCost) return false;
+            if (currentModel.capabilities.tools && !m.tool_call) return false;
+            if (currentModel.capabilities.vision && !m.modalities?.input?.includes("image"))
+              return false;
+            return true;
+          });
+          if (candidates.length === 0) return null;
+          const fallback = candidates.reduce(
+            (prev, curr) => (curr.cost?.input ?? 0) < (prev.cost?.input ?? 0) ? curr : prev
+          );
+          return {
+            action: "retry",
+            reason: "model_downgrade",
+            model: fallback.id
+          };
+        } catch {
+          return null;
+        }
+      }
+    }
+  ];
+}
+var DEFAULT_RECOVERY_STRATEGIES = buildRecoveryStrategies();
+var DefaultErrorHandler = class {
+  strategies;
+  constructor(strategies = DEFAULT_RECOVERY_STRATEGIES) {
+    this.strategies = strategies;
+  }
+  classify(err) {
+    if (typeof DOMException !== "undefined" && err instanceof DOMException && err.name === "AbortError") {
+      return { kind: "abort", retryable: false };
+    }
+    if (err instanceof Error && err.name === "AbortError") {
+      return { kind: "abort", retryable: false };
+    }
+    if (err instanceof ProviderError) {
+      if (err.status === 429) return { kind: "rate_limit", retryable: true };
+      if (err.status === 529) return { kind: "overloaded", retryable: true };
+      if (err.status >= 500) return { kind: "server", retryable: true };
+      if (err.status === 413 || CONTEXT_OVERFLOW_RE.test(err.message)) {
+        return { kind: "context_overflow", retryable: false };
+      }
+      if (err.status >= 400) return { kind: "client", retryable: false };
+    }
+    if (err instanceof Error && NETWORK_ERR_RE.test(err.message)) {
+      return { kind: "network", retryable: true };
+    }
+    return { kind: "unknown", retryable: false };
+  }
+  async recover(err, ctx) {
+    for (const strategy of this.strategies) {
+      const result = await strategy.attempt(err, ctx);
+      if (result !== null) return result;
+    }
+    return null;
+  }
+};
+
+// src/execution/retry-policy.ts
+var DefaultRetryPolicy = class _DefaultRetryPolicy {
+  static NETWORK_ERR_RE = /ECONN|ETIMEDOUT|ETIME|ENOTFOUND|EAI_AGAIN|fetch failed/i;
+  shouldRetry(err, attempt) {
+    if (err instanceof ProviderError) {
+      if (!err.retryable) return false;
+      return attempt < this.maxAttempts(err);
+    }
+    const msg = err.message ?? "";
+    const isNetwork = _DefaultRetryPolicy.NETWORK_ERR_RE.test(msg);
+    if (isNetwork) return attempt < 2;
+    return false;
+  }
+  maxAttempts(err) {
+    if (err instanceof ProviderError) {
+      if (err.status === 429) return 5;
+      if (err.status === 529) return 3;
+      if (err.status >= 500) return 3;
+      return 0;
+    }
+    return 2;
+  }
+  delayMs(attempt) {
+    const base = 1e3;
+    const exp = base * 2 ** attempt;
+    const jitter = Math.random() * base;
+    return Math.min(3e4, exp + jitter);
+  }
+};
+
+// src/security/secret-scrubber.ts
+var PATTERNS = [
+  // Anchored at the start where possible so partial matches inside larger
+  // strings don't trigger false positives.
+  {
+    type: "anthropic_key",
+    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g
+  },
+  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g },
+  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g },
+  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g },
+  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g },
+  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g },
+  { type: "slack_token", regex: /(?<![A-Za-z0-9-])xox[abpos]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g },
+  {
+    type: "stripe_key",
+    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g
+  },
+  { type: "twilio_sid", regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g },
+  {
+    type: "jwt",
+    // Anchored: look for literal "eyJ" which is unambiguous for JWT header
+    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g
+  },
+  {
+    type: "private_key",
+    // Anchored: start must be BEGIN, end must be END with no extra dashes after END
+    regex: /(?:^|\n)-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END[^-]*-----(?:\n|$)/g
+  },
+  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s"'`]+/g },
+  { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g },
+  { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g },
+  { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g },
+  {
+    type: "bearer_token",
+    regex: /(?<![A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{20,}=*(?![A-Za-z0-9_.~+/-])/g
+  },
+  {
+    type: "high_entropy_env",
+    // Value-side word boundary + length gate to avoid matching short random strings
+    regex: /\b([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,})['"]?(?!\s*[A-Za-z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))/g
+  }
+];
+var SCRUB_CHUNK_BYTES = 64 * 1024;
+var DefaultSecretScrubber = class {
+  scrub(text) {
+    if (!text) return text;
+    if (text.length <= SCRUB_CHUNK_BYTES) {
+      return this.scrubOne(text);
+    }
+    const out = [];
+    let i = 0;
+    while (i < text.length) {
+      let end = Math.min(i + SCRUB_CHUNK_BYTES, text.length);
+      if (end < text.length) {
+        const nl = text.lastIndexOf("\n", end);
+        if (nl > i + SCRUB_CHUNK_BYTES / 2) end = nl + 1;
+      }
+      out.push(this.scrubOne(text.slice(i, end)));
+      i = end;
+    }
+    return out.join("");
+  }
+  scrubOne(text) {
+    let out = text;
+    for (const p of PATTERNS) {
+      out = out.replace(p.regex, (_match, group1, group2) => {
+        if (p.type === "high_entropy_env" && group1 && group2) {
+          return `${group1}=[REDACTED:${p.type}]`;
+        }
+        return `[REDACTED:${p.type}]`;
+      });
+    }
+    return out;
+  }
+  scrubObject(obj) {
+    const seen = /* @__PURE__ */ new WeakSet();
+    const visit = (v) => {
+      if (typeof v === "string") return this.scrub(v);
+      if (v === null || typeof v !== "object") return v;
+      if (seen.has(v)) return v;
+      seen.add(v);
+      if (Array.isArray(v)) return v.map(visit);
+      const out = {};
+      for (const [k, val] of Object.entries(v)) {
+        out[k] = visit(val);
+      }
+      return out;
+    };
+    return visit(obj);
+  }
+};
+async function atomicWrite(targetPath, content, opts = {}) {
+  const dir = path3.dirname(targetPath);
+  await fs4.mkdir(dir, { recursive: true });
+  const tmp = path3.join(dir, `.${path3.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  try {
+    if (typeof content === "string") {
+      await fs4.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
+    } else {
+      await fs4.writeFile(tmp, content, { flag: "wx" });
+    }
+    try {
+      const fh = await fs4.open(tmp, "r+");
+      try {
+        await fh.sync();
+      } finally {
+        await fh.close();
+      }
+    } catch {
+    }
+    let mode;
+    try {
+      const stat2 = await fs4.stat(targetPath);
+      mode = stat2.mode & 511;
+    } catch {
+      mode = opts.mode;
+    }
+    if (mode !== void 0) {
+      await fs4.chmod(tmp, mode);
+    }
+    await fs4.rename(tmp, targetPath);
+  } catch (err) {
+    try {
+      await fs4.unlink(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+
+// src/models/models-registry.ts
+var DEFAULT_URL = "https://models.dev/api.json";
+var DEFAULT_TTL_SECONDS = 24 * 3600;
+var FAMILY_BY_NPM = {
+  "@ai-sdk/anthropic": "anthropic",
+  "@ai-sdk/google-vertex/anthropic": "anthropic",
+  "@ai-sdk/openai": "openai",
+  "@ai-sdk/openai-compatible": "openai-compatible",
+  "@ai-sdk/groq": "openai-compatible",
+  "@ai-sdk/xai": "openai-compatible",
+  "@ai-sdk/cerebras": "openai-compatible",
+  "@ai-sdk/togetherai": "openai-compatible",
+  "@ai-sdk/perplexity": "openai-compatible",
+  "@ai-sdk/deepinfra": "openai-compatible",
+  "@openrouter/ai-sdk-provider": "openai-compatible",
+  "ai-gateway-provider": "openai-compatible",
+  "@ai-sdk/vercel": "openai-compatible",
+  "@ai-sdk/gateway": "openai-compatible",
+  "@aihubmix/ai-sdk-provider": "openai-compatible",
+  "venice-ai-sdk-provider": "openai-compatible",
+  "@ai-sdk/google": "google"
+};
+function classifyFamily(npm) {
+  if (!npm) return "unsupported";
+  return FAMILY_BY_NPM[npm] ?? "unsupported";
+}
+var DefaultModelsRegistry = class {
+  payload;
+  fetchedAt;
+  cacheFile;
+  url;
+  ttlMs;
+  fetchImpl;
+  seed;
+  maxStaleAgeMs;
+  constructor(opts) {
+    this.cacheFile = opts.cacheFile;
+    this.url = opts.url ?? DEFAULT_URL;
+    this.ttlMs = (opts.ttlSeconds ?? DEFAULT_TTL_SECONDS) * 1e3;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.seed = opts.seed;
+    const maxStaleSeconds = opts.maxStaleAgeSeconds ?? 7 * 24 * 3600;
+    this.maxStaleAgeMs = maxStaleSeconds * 1e3;
+  }
+  async load(opts = {}) {
+    if (this.payload && !opts.force) return this.payload;
+    if (this.seed) {
+      this.payload = this.seed;
+      this.fetchedAt = /* @__PURE__ */ new Date();
+      return this.payload;
+    }
+    if (!opts.force) {
+      const cached = await this.readCache();
+      if (cached && this.isFresh(cached.fetchedAt)) {
+        this.payload = cached.payload;
+        this.fetchedAt = new Date(cached.fetchedAt);
+        return cached.payload;
+      }
+    }
+    try {
+      return await this.refresh();
+    } catch (err) {
+      const cached = await this.readCache();
+      if (cached && this.isWithinMaxStaleAge(cached.fetchedAt)) {
+        this.payload = cached.payload;
+        this.fetchedAt = new Date(cached.fetchedAt);
+        return cached.payload;
+      }
+      throw err;
+    }
+  }
+  async refresh() {
+    const res = await this.fetchImpl(this.url, {
+      method: "GET",
+      headers: { accept: "application/json" }
+    });
+    if (!res.ok) {
+      throw new Error(`ModelsRegistry: HTTP ${res.status} fetching ${this.url}`);
+    }
+    const json = await res.json();
+    this.payload = json;
+    this.fetchedAt = /* @__PURE__ */ new Date();
+    const envelope = {
+      fetchedAt: this.fetchedAt.toISOString(),
+      url: this.url,
+      payload: json
+    };
+    await atomicWrite(this.cacheFile, JSON.stringify(envelope));
+    return json;
+  }
+  async listProviders() {
+    const payload = await this.load();
+    return Object.values(payload).map((p) => this.resolveProvider(p));
+  }
+  async getProvider(id) {
+    const payload = await this.load();
+    const p = payload[id];
+    return p ? this.resolveProvider(p) : void 0;
+  }
+  async getModel(providerId, modelId) {
+    const provider = await this.getProvider(providerId);
+    if (!provider) return void 0;
+    const model = provider.models.find((m) => m.id === modelId);
+    if (!model) return void 0;
+    return {
+      providerId,
+      modelId,
+      capabilities: {
+        tools: model.tool_call ?? false,
+        vision: Boolean(model.modalities?.input?.includes("image")),
+        reasoning: model.reasoning ?? false,
+        maxContext: model.limit?.context ?? 0,
+        maxOutput: model.limit?.output,
+        knowledge: model.knowledge
+      },
+      cost: model.cost
+    };
+  }
+  async suggestModel(providerId) {
+    const provider = await this.getProvider(providerId);
+    if (!provider || provider.models.length === 0) return void 0;
+    const ranked = [...provider.models].sort((a, b) => {
+      const at = a.release_date ?? a.last_updated ?? "";
+      const bt = b.release_date ?? b.last_updated ?? "";
+      return bt.localeCompare(at);
+    });
+    return ranked[0]?.id;
+  }
+  async ageSeconds() {
+    if (!this.fetchedAt) {
+      const cached = await this.readCache();
+      if (!cached) return Number.POSITIVE_INFINITY;
+      return (Date.now() - new Date(cached.fetchedAt).getTime()) / 1e3;
+    }
+    return (Date.now() - this.fetchedAt.getTime()) / 1e3;
+  }
+  resolveProvider(p) {
+    return {
+      id: p.id,
+      name: p.name,
+      family: classifyFamily(p.npm),
+      apiBase: p.api,
+      envVars: p.env ?? [],
+      doc: p.doc,
+      models: Object.values(p.models ?? {}),
+      npm: p.npm
+    };
+  }
+  isFresh(fetchedAtIso) {
+    return Date.now() - new Date(fetchedAtIso).getTime() < this.ttlMs;
+  }
+  isWithinMaxStaleAge(fetchedAtIso) {
+    return Date.now() - new Date(fetchedAtIso).getTime() < this.maxStaleAgeMs;
+  }
+  async readCache() {
+    try {
+      const raw = await fs4.readFile(this.cacheFile, "utf8");
+      return JSON.parse(raw);
+    } catch {
+      return void 0;
+    }
+  }
+  /** Used by `wstack models refresh` to expose where the cache lives. */
+  cacheLocation() {
+    return path3.resolve(this.cacheFile);
+  }
+};
+
 // src/types/mode.ts
 var DEFAULT_MODES = [
   {
@@ -363,6 +1434,144 @@ When refactoring code:
   }
 ];
 
+// src/coordination/in-memory-transport.ts
+var InMemoryBridgeTransport = class {
+  subs = /* @__PURE__ */ new Map();
+  send(msg, to) {
+    if (to === "*") {
+      for (const [id, handlers2] of this.subs) {
+        if (id === msg.from) continue;
+        for (const h of handlers2) {
+          try {
+            h(msg);
+          } catch {
+          }
+        }
+      }
+      return Promise.resolve();
+    }
+    const handlers = this.subs.get(to);
+    if (handlers) {
+      for (const h of handlers) {
+        try {
+          h(msg);
+        } catch {
+        }
+      }
+    }
+    return Promise.resolve();
+  }
+  subscribe(agentId, handler) {
+    if (!this.subs.has(agentId)) this.subs.set(agentId, /* @__PURE__ */ new Set());
+    this.subs.get(agentId).add(handler);
+    return () => this.subs.get(agentId)?.delete(handler);
+  }
+  close(agentId) {
+    this.subs.delete(agentId);
+    return Promise.resolve();
+  }
+};
+
+// src/coordination/agent-bridge.ts
+var InMemoryAgentBridge = class {
+  agentId;
+  coordinatorId;
+  transport;
+  subscriptions = /* @__PURE__ */ new Set();
+  pendingRequests = /* @__PURE__ */ new Map();
+  stopped = false;
+  timeoutMs;
+  /** Guards request() so concurrent calls on the same id can't silently overwrite. */
+  inflightGuards = /* @__PURE__ */ new Set();
+  constructor(config, transport) {
+    this.agentId = config.agentId;
+    this.coordinatorId = config.coordinatorId;
+    this.transport = transport;
+    this.timeoutMs = config.timeoutMs ?? 3e4;
+    this.transport.subscribe(this.agentId, (msg) => {
+      if (msg.type === "heartbeat") return;
+      const pending = this.pendingRequests.get(msg.id);
+      if (pending) {
+        clearTimeout(pending.timer);
+        this.pendingRequests.delete(msg.id);
+        this.inflightGuards.delete(msg.id);
+        pending.resolve(msg);
+        return;
+      }
+      for (const h of this.subscriptions) {
+        try {
+          h(msg);
+        } catch {
+        }
+      }
+    });
+  }
+  async send(msg) {
+    msg.timestamp = Date.now();
+    await this.transport.send(msg, msg.to ?? this.coordinatorId);
+  }
+  async broadcast(msg) {
+    msg.timestamp = Date.now();
+    msg.to = "*";
+    await this.transport.send(msg, "*");
+  }
+  subscribe(handler) {
+    this.subscriptions.add(handler);
+    return () => this.subscriptions.delete(handler);
+  }
+  async request(msg, timeoutMs) {
+    if (this.stopped) throw new Error("Bridge is stopped");
+    const timeout = timeoutMs ?? this.timeoutMs;
+    const correlationId = msg.id;
+    if (this.inflightGuards.has(correlationId)) {
+      throw new Error(
+        `Bridge request id "${correlationId}" collides with an in-flight request \u2014 caller is reusing message ids`
+      );
+    }
+    this.inflightGuards.add(correlationId);
+    return new Promise((resolve3, reject) => {
+      const timer = setTimeout(() => {
+        this.inflightGuards.delete(correlationId);
+        this.pendingRequests.delete(correlationId);
+        reject(new Error(`Request ${correlationId} timed out after ${timeout}ms`));
+      }, timeout);
+      this.pendingRequests.set(correlationId, {
+        resolve: resolve3,
+        reject,
+        timer
+      });
+      msg.timestamp = Date.now();
+      this.transport.send(msg, msg.to ?? this.coordinatorId).catch((e) => {
+        clearTimeout(timer);
+        this.inflightGuards.delete(correlationId);
+        this.pendingRequests.delete(correlationId);
+        reject(e);
+      });
+    });
+  }
+  async stop() {
+    this.stopped = true;
+    for (const [, p] of this.pendingRequests) {
+      clearTimeout(p.timer);
+    }
+    this.pendingRequests.clear();
+    this.inflightGuards.clear();
+    this.subscriptions.clear();
+    await this.transport.close(this.agentId);
+  }
+};
+function createMessage(type, from, payload, to) {
+  return {
+    id: randomUUID(),
+    type,
+    from,
+    to,
+    payload,
+    timestamp: Date.now(),
+    priority: "normal"
+  };
+}
+
 // src/types/spec.ts
 var DEFAULT_SPEC_TEMPLATE = {
   id: "default",
@@ -379,14 +1588,26 @@ var DEFAULT_SPEC_TEMPLATE = {
   ],
   defaultRequirements: [
     { type: "functional", priority: "high", acceptanceCriteria: [], blockedBy: [], implements: [] },
-    { type: "non-functional", priority: "medium", acceptanceCriteria: [], blockedBy: [], implements: [] }
+    {
+      type: "non-functional",
+      priority: "medium",
+      acceptanceCriteria: [],
+      blockedBy: [],
+      implements: []
+    }
   ]
 };
 
 // src/types/task-graph.ts
 function computeTaskProgress(graph) {
-  let completed = 0, pending = 0, inProgress = 0, blocked = 0, failed = 0, review = 0;
-  let estimatedHours = 0, actualHours = 0;
+  let completed = 0;
+  let pending = 0;
+  let inProgress = 0;
+  let blocked = 0;
+  let failed = 0;
+  let review = 0;
+  let estimatedHours = 0;
+  let actualHours = 0;
   for (const n of graph.nodes.values()) {
     switch (n.status) {
       case "completed":
@@ -458,6 +1679,568 @@ function topologicalSort(graph) {
   return result;
 }
 
-export { AgentError, ConfigError, DEFAULT_MODES, DEFAULT_SPEC_TEMPLATE, ENCRYPTED_PREFIX, PluginError, ProviderError, SessionError, ToolError, WrongStackError, asBlocks, asText, computeTaskProgress, findCriticalPath, isAgentError, isConfigError, isImageBlock, isPluginError, isSessionError, isTextBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, toWrongStackError, topologicalSort };
+// src/utils/tool-output-serializer.ts
+function createToolOutputSerializer(opts = {}) {
+  const capBytes = opts.perIterationOutputCapBytes ?? 1e5;
+  function serialize(value) {
+    if (typeof value === "string") return value;
+    if (value === null || value === void 0) return "";
+    if (typeof value === "object") {
+      if (Array.isArray(value)) return value.map(serialize).join("\n");
+      if ("text" in value) {
+        const t = value.text;
+        return typeof t === "string" ? t : JSON.stringify(value, null, 2);
+      }
+      try {
+        return JSON.stringify(value, null, 2);
+      } catch {
+        return String(value);
+      }
+    }
+    return String(value);
+  }
+  function enforceCap(text, remainingBudget) {
+    if (remainingBudget <= 0) {
+      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
+    }
+    const textBytes = Buffer.byteLength(text, "utf8");
+    if (textBytes <= remainingBudget) {
+      return { text, newBudget: remainingBudget - textBytes };
+    }
+    const marker = `
+\u2026[truncated ${textBytes - remainingBudget} bytes]\u2026
+`;
+    const markerBytes = Buffer.byteLength(marker, "utf8");
+    const available = remainingBudget - markerBytes;
+    if (available <= 0) {
+      return { text: "[truncated: iteration output cap exceeded]", newBudget: 0 };
+    }
+    const half = Math.floor(available / 2);
+    const first = text.slice(0, half);
+    const second = text.slice(text.length - half);
+    return { text: `${first}${marker}${second}`, newBudget: 0 };
+  }
+  return { serialize, enforceCap, capBytes };
+}
+
+// src/execution/tool-executor.ts
+var ToolExecutor = class {
+  constructor(registry, opts) {
+    this.registry = registry;
+    this.opts = opts;
+    this.iterationTimeoutMs = opts.iterationTimeoutMs ?? 3e5;
+    this.serializer = createToolOutputSerializer({
+      perIterationOutputCapBytes: opts.perIterationOutputCapBytes ?? 1e5
+    });
+  }
+  registry;
+  opts;
+  serializer;
+  iterationTimeoutMs;
+  /**
+   * Execute a batch of tool uses using the configured strategy.
+   * Returns the execution results and the remaining output budget.
+   */
+  async executeBatch(toolUses, ctx, strategy) {
+    let budget = this.opts.perIterationOutputCapBytes ?? 1e5;
+    const runOne = async (use) => {
+      const start = Date.now();
+      const tool = this.registry.get(use.name);
+      if (!tool) {
+        const result = this.unknownToolResult(use, () => this.registry.list().map((t) => t.name));
+        budget = this.decrementBudget(result, budget);
+        return { result, tool, durationMs: Date.now() - start };
+      }
+      const decision = await this.opts.permissionPolicy.evaluate(tool, use.input, ctx);
+      if (decision.permission === "deny") {
+        const result = this.deniedResult(use, decision.reason);
+        budget = this.decrementBudget(result, budget);
+        return { result, tool, durationMs: Date.now() - start };
+      }
+      if (decision.permission === "confirm") {
+        if (this.opts.confirmAwaiter) {
+          const choice = await this.opts.confirmAwaiter(tool, use.input, use.id, tool.name);
+          if (choice !== "yes" && choice !== "always") {
+            const result = {
+              type: "tool_result",
+              tool_use_id: use.id,
+              content: `Tool "${tool.name}" denied by user.`,
+              is_error: true
+            };
+            budget = this.decrementBudget(result, budget);
+            return { result, tool, durationMs: Date.now() - start };
+          }
+        } else {
+          const suggestedPattern = this.subjectFor(tool.name, use.input, tool.subjectKey) ?? tool.name;
+          const pending = {
+            type: "tool_confirm_pending",
+            toolUseId: use.id,
+            toolName: tool.name,
+            input: use.input,
+            suggestedPattern
+          };
+          return { result: pending, tool, durationMs: Date.now() - start };
+        }
+      }
+      const span = this.opts.tracer?.startSpan(`tool.${tool.name}`, {
+        "tool.name": tool.name,
+        "tool.mutating": tool.mutating,
+        "tool.permission": tool.permission
+      });
+      try {
+        const result = await this.executeTool(tool, use, ctx, budget);
+        budget = this.decrementBudget(result, budget);
+        span?.setAttribute("tool.is_error", !!result.is_error);
+        span?.setAttribute(
+          "tool.output_bytes",
+          typeof result.content === "string" ? result.content.length : 0
+        );
+        return { result, tool, durationMs: Date.now() - start };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        const scrubbed = this.opts.secretScrubber.scrub(msg);
+        this.opts.renderer?.writeToolResult(tool.name, scrubbed, true);
+        const result = {
+          type: "tool_result",
+          tool_use_id: use.id,
+          content: `Tool "${tool.name}" threw: ${scrubbed}`,
+          is_error: true
+        };
+        budget = this.decrementBudget(result, budget);
+        if (err instanceof Error) span?.recordError(err);
+        span?.setAttribute("tool.is_error", true);
+        return { result, tool, durationMs: Date.now() - start };
+      } finally {
+        span?.end();
+      }
+    };
+    const safeRun = async (use) => {
+      try {
+        return await runOne(use);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        const scrubbed = this.opts.secretScrubber.scrub(msg);
+        const result = {
+          type: "tool_result",
+          tool_use_id: use.id,
+          content: `Tool "${use.name}" execution failed: ${scrubbed}`,
+          is_error: true
+        };
+        budget = this.decrementBudget(result, budget);
+        return { result, tool: this.registry.get(use.name), durationMs: 0 };
+      }
+    };
+    if (strategy === "sequential") {
+      const outputs = [];
+      for (const use of toolUses) {
+        if (use) outputs.push(await safeRun(use));
+      }
+      return { outputs, remainingBudget: budget };
+    }
+    if (strategy === "parallel") {
+      const outputs = await Promise.all(toolUses.map((use) => safeRun(use)));
+      return { outputs, remainingBudget: budget };
+    }
+    const nonMutating = [];
+    const mutating = [];
+    for (const use of toolUses) {
+      if (!use) continue;
+      const tool = this.registry.get(use.name);
+      if (tool?.mutating) mutating.push(use);
+      else nonMutating.push(use);
+    }
+    const firstPass = await Promise.all(nonMutating.map((use) => safeRun(use)));
+    const secondPass = [];
+    for (const use of mutating) {
+      secondPass.push(await safeRun(use));
+    }
+    return {
+      outputs: [...firstPass, ...secondPass],
+      remainingBudget: budget
+    };
+  }
+  /**
+   * Execute a single tool with timeout, permission check, and output capping.
+   * Emits `tool.started` via the injected EventBus (if any) right before
+   * invoking the tool — closes the observability gap between "model decided
+   * to call a tool" and "tool.executed".
+   */
+  async executeTool(tool, use, ctx, budget) {
+    this.opts.events?.emit("tool.started", {
+      name: tool.name,
+      id: use.id,
+      input: use.input
+    });
+    this.opts.renderer?.writeToolCall(tool.name, use.input);
+    const output = await this.runWithTimeout(tool, use.input, ctx.signal, ctx, use.id);
+    const text = this.serializer.serialize(output);
+    const scrubbed = this.opts.secretScrubber.scrub(text);
+    const { text: capped } = this.serializer.enforceCap(scrubbed, budget);
+    this.opts.renderer?.writeToolResult(tool.name, capped, false);
+    return {
+      type: "tool_result",
+      tool_use_id: use.id,
+      name: tool.name,
+      content: capped,
+      is_error: false
+    };
+  }
+  async runWithTimeout(tool, input, parentSignal, ctx, toolUseId) {
+    if (parentSignal.aborted) {
+      if (parentSignal.reason instanceof Error) throw parentSignal.reason;
+      throw new Error(typeof parentSignal.reason === "string" ? parentSignal.reason : "aborted");
+    }
+    const timeoutMs = tool.timeoutMs ?? this.iterationTimeoutMs;
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(new Error("tool timeout")), timeoutMs);
+    const combined = AbortSignal.any([parentSignal, ctrl.signal]);
+    try {
+      if (typeof tool.executeStream === "function") {
+        return await this.runStreamedTool(tool, input, ctx, combined, toolUseId);
+      }
+      return await tool.execute(input, ctx, { signal: combined });
+    } catch (err) {
+      if (combined.aborted && typeof tool.cleanup === "function") {
+        try {
+          await tool.cleanup(input, ctx);
+        } catch {
+        }
+      }
+      throw err;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async runStreamedTool(tool, input, ctx, signal, toolUseId) {
+    let finalOutput;
+    let sawFinal = false;
+    const stream = tool.executeStream(input, ctx, { signal });
+    for await (const ev of stream) {
+      if (ev.type === "final") {
+        finalOutput = ev.output;
+        sawFinal = true;
+        break;
+      }
+      this.opts.events?.emit("tool.progress", {
+        name: tool.name,
+        id: toolUseId ?? "<unknown>",
+        event: ev
+      });
+    }
+    if (!sawFinal) {
+      throw new Error(`tool "${tool.name}" executeStream completed without a 'final' event`);
+    }
+    return finalOutput;
+  }
+  unknownToolResult(use, listFns) {
+    return {
+      type: "tool_result",
+      tool_use_id: use.id,
+      content: `Tool "${use.name}" is not registered. Available tools: ${listFns().join(", ")}`,
+      is_error: true
+    };
+  }
+  deniedResult(use, reason) {
+    return {
+      type: "tool_result",
+      tool_use_id: use.id,
+      content: `Tool "${use.name}" denied: ${reason ?? "policy"}`,
+      is_error: true
+    };
+  }
+  decrementBudget(result, budget) {
+    const contentBytes = typeof result.content === "string" ? Buffer.byteLength(result.content, "utf8") : Buffer.byteLength(JSON.stringify(result.content), "utf8");
+    return Math.max(0, budget - contentBytes);
+  }
+  /**
+   * Compute the suggestedPattern string for a tool+input pair.
+   * Matches the logic in DefaultPermissionPolicy so the TUI shows the
+   * same subject that the trust file would use.
+   */
+  subjectFor(toolName, input, subjectKey) {
+    if (!input || typeof input !== "object") return void 0;
+    const obj = input;
+    const globChars = /[*?\[\]]/g;
+    const escapeGlob = (s) => s.replace(globChars, (c) => `\\${c}`);
+    const normalizePath = (s) => escapeGlob(s.replace(/\\/g, "/"));
+    if (subjectKey) {
+      const v = obj[subjectKey];
+      if (typeof v === "string") {
+        return subjectKey === "path" || subjectKey === "file" || subjectKey === "files" ? normalizePath(v) : escapeGlob(v);
+      }
+    }
+    if (toolName === "bash" && typeof obj.command === "string") {
+      return escapeGlob(obj.command);
+    }
+    if (typeof obj.path === "string") {
+      return normalizePath(obj.path);
+    }
+    if (typeof obj.url === "string") {
+      return escapeGlob(obj.url);
+    }
+    if (typeof obj.name === "string") {
+      return escapeGlob(obj.name);
+    }
+    return void 0;
+  }
+};
+
+// src/storage/session-reader.ts
+var DefaultSessionReader = class {
+  store;
+  constructor(opts) {
+    this.store = opts.store;
+  }
+  async query(q = {}) {
+    const raw = await this.store.list(q.limit ? Math.max(q.limit * 4, 100) : 1e3);
+    const titleNeedle = q.titleContains?.toLowerCase();
+    const filtered = raw.filter((s) => {
+      if (q.since && s.startedAt < q.since) return false;
+      if (q.until && s.startedAt > q.until) return false;
+      if (q.provider && s.provider !== q.provider) return false;
+      if (q.model && s.model !== q.model) return false;
+      if (q.minTokens !== void 0 && s.tokenTotal < q.minTokens) return false;
+      if (titleNeedle && !s.title.toLowerCase().includes(titleNeedle)) return false;
+      return true;
+    });
+    const out = filtered.map((s) => ({
+      id: s.id,
+      title: s.title,
+      startedAt: s.startedAt,
+      provider: s.provider,
+      model: s.model,
+      tokenTotal: s.tokenTotal
+    }));
+    return q.limit ? out.slice(0, q.limit) : out;
+  }
+  async *replay(sessionId) {
+    const data = await this.store.load(sessionId);
+    for (const e of data.events) yield e;
+  }
+  async search(q, sessionId) {
+    const limit = q.limit ?? 100;
+    const matcher = buildMatcher(q);
+    const allowedTypes = q.types ? new Set(q.types) : null;
+    const ids = sessionId ? [sessionId] : (await this.store.list(1e3)).map((s) => s.id);
+    const hits = [];
+    for (const id of ids) {
+      let data;
+      try {
+        data = await this.store.load(id);
+      } catch {
+        continue;
+      }
+      for (let i = 0; i < data.events.length; i++) {
+        const ev = data.events[i];
+        if (allowedTypes && !allowedTypes.has(ev.type)) continue;
+        const text = eventText(ev);
+        if (text === null) continue;
+        const hit = matcher(text);
+        if (!hit) continue;
+        hits.push({
+          sessionId: id,
+          eventIndex: i,
+          ts: ev.ts,
+          type: ev.type,
+          snippet: snippetOf(text, hit.start, hit.end)
+        });
+        if (hits.length >= limit) return hits;
+      }
+    }
+    return hits;
+  }
+  async export(sessionId, opts) {
+    const data = await this.store.load(sessionId);
+    const includeTools = opts.includeTools ?? true;
+    const includeDiagnostics = opts.includeDiagnostics ?? true;
+    const filtered = data.events.filter((e) => {
+      if (!includeTools && (e.type === "tool_use" || e.type === "tool_result" || e.type === "tool_call_start" || e.type === "tool_call_end")) {
+        return false;
+      }
+      if (!includeDiagnostics && (e.type === "error" || e.type === "compaction" || e.type === "message_truncated")) {
+        return false;
+      }
+      return true;
+    });
+    if (opts.format === "json") {
+      return JSON.stringify({ metadata: data.metadata, events: filtered }, null, 2);
+    }
+    if (opts.format === "text") {
+      return renderPlainText(data.metadata, filtered);
+    }
+    return renderMarkdown(data.metadata, filtered);
+  }
+  async metadata(sessionId) {
+    const data = await this.store.load(sessionId);
+    return data.metadata;
+  }
+};
+function buildMatcher(q) {
+  const ci = q.caseInsensitive ?? true;
+  if (q.regex) {
+    const flags = ci ? "i" : "";
+    const re = new RegExp(q.query, flags);
+    return (text) => {
+      const m = re.exec(text);
+      return m ? { start: m.index, end: m.index + m[0].length } : null;
+    };
+  }
+  const needle = ci ? q.query.toLowerCase() : q.query;
+  return (text) => {
+    const hay = ci ? text.toLowerCase() : text;
+    const idx = hay.indexOf(needle);
+    return idx === -1 ? null : { start: idx, end: idx + needle.length };
+  };
+}
+function eventText(e) {
+  switch (e.type) {
+    case "user_input":
+      return contentToString(e.content);
+    case "llm_response":
+      return contentToString(e.content);
+    case "tool_use":
+      return `${e.name} ${JSON.stringify(e.input)}`;
+    case "tool_result":
+      return typeof e.content === "string" ? e.content : JSON.stringify(e.content);
+    case "error":
+      return `${e.phase}: ${e.message}`;
+    case "session_start":
+    case "session_resumed":
+      return `${e.model}/${e.provider}`;
+    case "task_created":
+    case "task_completed":
+      return e.title;
+    case "task_failed":
+      return `${e.title}: ${e.error}`;
+    case "skill_activated":
+    case "skill_deactivated":
+      return e.skillName;
+    default:
+      return null;
+  }
+}
+function contentToString(content) {
+  if (typeof content === "string") return content;
+  return content.map((b) => {
+    switch (b.type) {
+      case "text":
+        return b.text;
+      case "tool_use":
+        return `[tool_use:${b.name} ${JSON.stringify(b.input)}]`;
+      case "tool_result":
+        return typeof b.content === "string" ? b.content : JSON.stringify(b.content);
+      default:
+        return "";
+    }
+  }).join("\n");
+}
+var SNIPPET_RADIUS = 60;
+function snippetOf(text, start, end) {
+  const from = Math.max(0, start - SNIPPET_RADIUS);
+  const to = Math.min(text.length, end + SNIPPET_RADIUS);
+  const prefix = from > 0 ? "\u2026" : "";
+  const suffix = to < text.length ? "\u2026" : "";
+  return prefix + text.slice(from, to).replace(/\s+/g, " ").trim() + suffix;
+}
+function renderMarkdown(meta, events) {
+  const lines = [];
+  lines.push(`# Session ${meta.id}`);
+  lines.push("");
+  if (meta.model || meta.provider) {
+    lines.push(`- **Model:** ${meta.provider ?? "?"}/${meta.model ?? "?"}`);
+  }
+  lines.push(`- **Started:** ${meta.startedAt}`);
+  if (meta.endedAt) lines.push(`- **Ended:** ${meta.endedAt}`);
+  lines.push("");
+  lines.push("---");
+  lines.push("");
+  for (const e of events) {
+    switch (e.type) {
+      case "user_input": {
+        lines.push(`## User \u2014 ${e.ts}`);
+        lines.push("");
+        lines.push(contentToString(e.content));
+        lines.push("");
+        break;
+      }
+      case "llm_response": {
+        lines.push(`## Assistant \u2014 ${e.ts}`);
+        lines.push("");
+        lines.push(contentToString(e.content));
+        if (e.stopReason && e.stopReason !== "end_turn") {
+          lines.push("");
+          lines.push(`*stop: ${e.stopReason}*`);
+        }
+        lines.push("");
+        break;
+      }
+      case "tool_use": {
+        lines.push(`### Tool call: \`${e.name}\``);
+        lines.push("");
+        lines.push("```json");
+        lines.push(JSON.stringify(e.input, null, 2));
+        lines.push("```");
+        lines.push("");
+        break;
+      }
+      case "tool_result": {
+        const body = typeof e.content === "string" ? e.content : JSON.stringify(e.content, null, 2);
+        lines.push(`### Tool result${e.isError ? " (error)" : ""}`);
+        lines.push("");
+        lines.push("```");
+        lines.push(body);
+        lines.push("```");
+        lines.push("");
+        break;
+      }
+      case "error": {
+        lines.push(`> **Error** (${e.phase}): ${e.message}`);
+        lines.push("");
+        break;
+      }
+      case "compaction": {
+        lines.push(`> **Compaction**: ${e.before} \u2192 ${e.after} tokens`);
+        lines.push("");
+        break;
+      }
+    }
+  }
+  return lines.join("\n");
+}
+function renderPlainText(meta, events) {
+  const lines = [];
+  lines.push(
+    `Session ${meta.id} \u2014 ${meta.provider ?? "?"}/${meta.model ?? "?"} \u2014 started ${meta.startedAt}`
+  );
+  lines.push("".padEnd(72, "-"));
+  for (const e of events) {
+    switch (e.type) {
+      case "user_input":
+        lines.push(`[${e.ts}] USER`);
+        lines.push(contentToString(e.content));
+        lines.push("");
+        break;
+      case "llm_response":
+        lines.push(`[${e.ts}] ASSISTANT`);
+        lines.push(contentToString(e.content));
+        lines.push("");
+        break;
+      case "tool_use":
+        lines.push(`[${e.ts}] TOOL_USE ${e.name} ${JSON.stringify(e.input)}`);
+        break;
+      case "tool_result":
+        lines.push(
+          `[${e.ts}] TOOL_RESULT${e.isError ? " (error)" : ""} ${typeof e.content === "string" ? e.content : JSON.stringify(e.content)}`
+        );
+        break;
+      case "error":
+        lines.push(`[${e.ts}] ERROR (${e.phase}): ${e.message}`);
+        break;
+    }
+  }
+  return lines.join("\n");
+}
+
+export { AgentError, ConfigError, DEFAULT_MODES, DEFAULT_RECOVERY_STRATEGIES, DEFAULT_SPEC_TEMPLATE, DefaultErrorHandler, DefaultLogger, DefaultModelsRegistry, DefaultPathResolver, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultTokenCounter, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, PluginError, ProviderError, SessionError, ToolError, ToolExecutor, WrongStackError, asBlocks, asText, buildRecoveryStrategies, classifyFamily, computeTaskProgress, createMessage, decryptConfigSecrets, encryptConfigSecrets, findCriticalPath, isAgentError, isConfigError, isImageBlock, isPluginError, isSessionError, isTextBlock, isThinkingBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, migratePlaintextSecrets, rewriteConfigEncrypted, toWrongStackError, topologicalSort };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map