@wrongstack/core 0.107.2 → 0.119.1

package/dist/defaults/index.js

@@ -1,7 +1,7 @@
 import * as crypto2 from 'crypto';
 import { randomBytes, randomUUID, createCipheriv, createDecipheriv, createHash } from 'crypto';
 import * as fsp from 'fs/promises';
-import * as path3 from 'path';
+import * as path11 from 'path';
 import { isAbsolute, resolve } from 'path';
 import * as fs5 from 'fs';
 import * as os from 'os';
@@ -28,9 +28,9 @@ __export(atomic_write_exports, {
   withFileLock: () => withFileLock
 });
 async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path3.dirname(targetPath);
+  const dir = path11.dirname(targetPath);
   await fsp.mkdir(dir, { recursive: true });
-  const tmp = path3.join(dir, `.${path3.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const tmp = path11.join(dir, `.${path11.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
   try {
     if (typeof content === "string") {
       await fsp.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
@@ -69,9 +69,9 @@ async function ensureDir(dir) {
   await fsp.mkdir(dir, { recursive: true });
 }
 async function withFileLock(targetPath, fn, opts = {}) {
-  const dir = path3.dirname(targetPath);
+  const dir = path11.dirname(targetPath);
   await fsp.mkdir(dir, { recursive: true });
-  const lockPath = path3.join(dir, `.${path3.basename(targetPath)}.lock`);
+  const lockPath = path11.join(dir, `.${path11.basename(targetPath)}.lock`);
   const timeoutMs = opts.timeoutMs ?? 5e3;
   const staleMs = opts.staleMs ?? 3e4;
   const started = Date.now();
@@ -218,7 +218,7 @@ var DefaultLogger = class _DefaultLogger {
     this.stderr = opts.stderr !== false;
     if (this.file) {
       try {
-        fs5.mkdirSync(path3.dirname(this.file), { recursive: true });
+        fs5.mkdirSync(path11.dirname(this.file), { recursive: true });
       } catch {
       }
     }
@@ -414,11 +414,11 @@ var DefaultSessionStore = class _DefaultSessionStore {
   }
   /** Absolute path to the session index file. */
   get indexFile() {
-    return path3.join(this.dir, "_index.jsonl");
+    return path11.join(this.dir, "_index.jsonl");
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
-    return path3.join(this.dir, `${id}${ext}`);
+    return path11.join(this.dir, `${id}${ext}`);
   }
   /**
    * Ensure the directory implied by the session ID exists. When the ID
@@ -426,7 +426,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
    * subdirectory so sessions group naturally by day.
    */
   async ensureShardDir(id) {
-    const dirPath = path3.dirname(path3.join(this.dir, id));
+    const dirPath = path11.dirname(path11.join(this.dir, id));
     await ensureDir(dirPath);
     return dirPath;
   }
@@ -434,7 +434,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const id = meta.id && meta.id.length > 0 ? meta.id : generateSessionId(startedAt, meta.model ?? meta.provider);
     const shardDir = await this.ensureShardDir(id);
-    const file = path3.join(shardDir, `${path3.basename(id)}.jsonl`);
+    const file = path11.join(shardDir, `${path11.basename(id)}.jsonl`);
     let handle;
     try {
       handle = await fsp.open(file, "a", 384);
@@ -642,7 +642,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         continue;
       if (entry.isDirectory()) {
         const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        ids.push(...await this.collectSessionIds(path3.join(dir, entry.name), childPrefix, depth + 1));
+        ids.push(...await this.collectSessionIds(path11.join(dir, entry.name), childPrefix, depth + 1));
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
         if (entry.name === "_index.jsonl") continue;
         const base = entry.name.replace(/\.jsonl$/, "");
@@ -676,12 +676,12 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async deleteSession(id) {
     await fsp.unlink(this.sessionPath(id, ".jsonl")).catch(() => void 0);
     await fsp.unlink(this.sessionPath(id, ".summary.json")).catch(() => void 0);
-    const shardDir = path3.dirname(path3.join(this.dir, id));
-    const base = path3.basename(id);
+    const shardDir = path11.dirname(path11.join(this.dir, id));
+    const base = path11.basename(id);
     for (const ext of [".plan.json", ".todos.json"]) {
-      await fsp.unlink(path3.join(shardDir, `${base}${ext}`)).catch(() => void 0);
+      await fsp.unlink(path11.join(shardDir, `${base}${ext}`)).catch(() => void 0);
     }
-    const sessDir = path3.join(shardDir, base);
+    const sessDir = path11.join(shardDir, base);
     await fsp.rm(sessDir, { recursive: true, force: true }).catch(() => void 0);
     await this.writeTombstone(id);
   }
@@ -693,7 +693,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     let deleted = 0;
     let activeSessionId = null;
     try {
-      const raw = await fsp.readFile(path3.join(this.dir, "active.json"), "utf8");
+      const raw = await fsp.readFile(path11.join(this.dir, "active.json"), "utf8");
       const active = JSON.parse(raw);
       activeSessionId = active.sessionId ?? null;
     } catch {
@@ -701,11 +701,11 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const entries = await fsp.readdir(this.dir, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const dateDir = path3.join(this.dir, entry.name);
+      const dateDir = path11.join(this.dir, entry.name);
       const files = await fsp.readdir(dateDir, { withFileTypes: true }).catch(() => []);
       for (const file of files) {
         if (!file.isFile() || !file.name.endsWith(".jsonl")) continue;
-        const jsonlPath = path3.join(dateDir, file.name);
+        const jsonlPath = path11.join(dateDir, file.name);
         try {
           const stat6 = await fsp.stat(jsonlPath);
           if (stat6.mtimeMs >= cutoff) continue;
@@ -723,7 +723,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const dateDir = path3.join(this.dir, entry.name);
+      const dateDir = path11.join(this.dir, entry.name);
       try {
         const remaining = await fsp.readdir(dateDir);
         if (remaining.length === 0) {
@@ -888,7 +888,7 @@ var FileSessionWriter = class {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path3.join(opts.dir, `${path3.basename(id)}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path11.join(opts.dir, `${path11.basename(id)}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.onCloseCb = opts.onClose;
@@ -1211,7 +1211,7 @@ init_atomic_write();
 var QueueStore = class {
   file;
   constructor(opts) {
-    this.file = path3.join(opts.dir, "queue.json");
+    this.file = path11.join(opts.dir, "queue.json");
   }
   async write(items) {
     if (items.length === 0) {
@@ -1281,7 +1281,7 @@ var DefaultAttachmentStore = class {
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
       await fsp.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path3.join(this.spoolDir, `${id}.bin`);
+      spooledPath = path11.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -1493,7 +1493,7 @@ var FileMemoryBackend = class {
   }
   async remember(scope, entry, filePath) {
     const file = this.resolveFile(filePath, scope);
-    await ensureDir(path3.dirname(file));
+    await ensureDir(path11.dirname(file));
     let existing = "";
     try {
       existing = await fsp.readFile(file, "utf8");
@@ -1510,39 +1510,41 @@ ${line}`;
   }
   async forget(scope, query, filePath) {
     const file = this.resolveFile(filePath, scope);
-    let existing;
-    try {
-      existing = await fsp.readFile(file, "utf8");
-    } catch {
-      return 0;
-    }
-    const needle = query.toLowerCase();
-    const idMatcher = /mem_\d+_\w+/;
-    let removed = 0;
-    const lines = existing.split("\n").filter((line) => {
-      const trimmed = line.trim();
-      if (!trimmed.startsWith("- ")) return true;
-      if (idMatcher.test(query)) {
-        const entryIdMatch = /mem_\d+_\w+/.exec(trimmed);
-        if (entryIdMatch && entryIdMatch[0] === query) {
+    return withFileLock(file, async () => {
+      let existing;
+      try {
+        existing = await fsp.readFile(file, "utf8");
+      } catch {
+        return 0;
+      }
+      const needle = query.toLowerCase();
+      const idMatcher = /mem_\d+_\w+/;
+      let removed = 0;
+      const lines = existing.split("\n").filter((line) => {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("- ")) return true;
+        if (idMatcher.test(query)) {
+          const entryIdMatch = /mem_\d+_\w+/.exec(trimmed);
+          if (entryIdMatch && entryIdMatch[0] === query) {
+            removed++;
+            return false;
+          }
+        }
+        if (trimmed.toLowerCase().includes(needle)) {
           removed++;
           return false;
         }
+        return true;
+      });
+      if (removed > 0) {
+        if (lines.length === 0 || lines.length === 1 && !lines[0]?.trim()) {
+          await atomicWrite(file, "");
+        } else {
+          await atomicWrite(file, lines.join("\n"));
+        }
       }
-      if (trimmed.toLowerCase().includes(needle)) {
-        removed++;
-        return false;
-      }
-      return true;
+      return removed;
     });
-    if (removed > 0) {
-      if (lines.length === 0 || lines.length === 1 && !lines[0]?.trim()) {
-        await atomicWrite(file, "");
-      } else {
-        await atomicWrite(file, lines.join("\n"));
-      }
-    }
-    return removed;
   }
   async readAll(scope, filePath) {
     const file = this.resolveFile(filePath, scope);
@@ -2255,12 +2257,14 @@ var DefaultConfigLoader = class {
   }
   async load(opts = {}) {
     let cfg = { ...BEHAVIOR_DEFAULTS };
-    const [global, local] = await Promise.all([
+    const [global, local, inProject] = await Promise.all([
       this.readJson(this.paths.globalConfig),
-      this.readJson(this.paths.projectLocalConfig)
+      this.readJson(this.paths.projectLocalConfig),
+      this.readJson(this.paths.inProjectConfig)
     ]);
     cfg = deepMerge(cfg, global);
     cfg = deepMerge(cfg, local);
+    cfg = deepMerge(cfg, inProject);
     for (const [key, fn] of Object.entries(ENV_MAP)) {
       const v = process.env[key];
       if (v) fn(cfg, v);
@@ -2462,7 +2466,7 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path3.join(opts.dir, LOCK_FILE);
+    this.file = path11.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
     this.hostname = opts.hostname ?? os.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
@@ -2520,7 +2524,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path3.dirname(this.file));
+    await ensureDir(path11.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -3753,7 +3757,7 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs5.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    fs5.mkdirSync(path11.dirname(this.keyFile), { recursive: true });
     const key = randomBytes(KEY_BYTES);
     try {
       fs5.writeFileSync(this.keyFile, key, { mode: 384, flag: "wx" });
@@ -3822,7 +3826,7 @@ async function rewriteConfigEncrypted(configPath, vault, patch) {
   }
   const merged = deepMerge2(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fsp.mkdir(path3.dirname(configPath), { recursive: true });
+  await fsp.mkdir(path11.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions(configPath);
 }
@@ -4063,9 +4067,9 @@ function getInputString(input, key) {
 function pathLooksInsideProject(rawPath, projectRoot) {
   if (!projectRoot) return false;
   if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
-  const resolved = path3.resolve(projectRoot, rawPath);
-  const relative2 = path3.relative(projectRoot, resolved);
-  return !!relative2 && !relative2.startsWith("..") && !path3.isAbsolute(relative2);
+  const resolved = path11.resolve(projectRoot, rawPath);
+  const relative2 = path11.relative(projectRoot, resolved);
+  return !!relative2 && !relative2.startsWith("..") && !path11.isAbsolute(relative2);
 }
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
@@ -4075,7 +4079,7 @@ function pathTokenIsOutsideProject(token, projectRoot) {
   if (token === "/" || token === "~" || token === "." || token === "..") return token !== ".";
   if (token.includes("*")) return true;
   if (token.startsWith("..") || token.includes("../") || token.includes("..\\")) return true;
-  if (path3.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
+  if (path11.isAbsolute(token) || token.startsWith("~/")) return !pathLooksInsideProject(token, projectRoot);
   return false;
 }
 function hasDangerousDeleteTarget(tokens, start, projectRoot) {
@@ -4612,6 +4616,7 @@ var DefaultRetryPolicy = class {
     if (err instanceof ProviderError) {
       if (err.status === 429) return 5;
       if (err.status === 529) return 3;
+      if (err.status === 599) return 5;
       if (err.status >= 500) return 3;
       return 0;
     }
@@ -4731,7 +4736,7 @@ var DefaultSkillLoader = class {
         const entries = await fsp.readdir(dir, { withFileTypes: true });
         for (const e of entries) {
           if (!e.isDirectory()) continue;
-          const skillFile = path3.join(dir, e.name, "SKILL.md");
+          const skillFile = path11.join(dir, e.name, "SKILL.md");
           try {
             const raw = await fsp.readFile(skillFile, "utf8");
             const meta = parseFrontmatter(raw);
@@ -7037,25 +7042,82 @@ var AutonomousRunner = class {
 
 // src/storage/goal-store.ts
 init_atomic_write();
+function projectHash(absRoot) {
+  return createHash("sha256").update(path11.resolve(absRoot)).digest("hex").slice(0, 12);
+}
+function projectSlug(absRoot) {
+  const base = slugify(path11.basename(absRoot));
+  const hash = createHash("sha256").update(path11.resolve(absRoot)).digest("hex").slice(0, 6);
+  return `${base}-${hash}`;
+}
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
+}
+function resolveWstackPaths(opts) {
+  const home = opts.userHome ?? os.homedir();
+  const globalRoot = opts.globalRoot ?? path11.join(home, ".wrongstack");
+  const hash = projectHash(opts.projectRoot);
+  const slug = projectSlug(opts.projectRoot);
+  const projectDir = path11.join(globalRoot, "projects", slug);
+  return {
+    globalRoot,
+    configDir: globalRoot,
+    globalConfig: path11.join(globalRoot, "config.json"),
+    secretsKey: path11.join(globalRoot, ".key"),
+    globalMemory: path11.join(globalRoot, "memory.md"),
+    globalSkills: path11.join(globalRoot, "skills"),
+    globalPrompts: path11.join(globalRoot, "prompts"),
+    cacheDir: path11.join(globalRoot, "cache"),
+    modelsCache: path11.join(globalRoot, "cache", "models.dev.json"),
+    modelsOverlayCache: path11.join(globalRoot, "cache", "models-overlay.json"),
+    historyFile: path11.join(globalRoot, "history"),
+    logFile: path11.join(globalRoot, "logs", "wrongstack.log"),
+    projectDir,
+    projectCodebaseIndex: path11.join(projectDir, "codebase-index"),
+    projectMemory: path11.join(projectDir, "memory.md"),
+    projectSessions: path11.join(projectDir, "sessions"),
+    projectTrust: path11.join(projectDir, "trust.json"),
+    projectMeta: path11.join(projectDir, "meta.json"),
+    projectLocalConfig: path11.join(projectDir, "config.local.json"),
+    inProjectConfig: path11.join(opts.projectRoot, ".wrongstack", "config.json"),
+    inProjectAgentsFile: path11.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
+    inProjectSkills: path11.join(opts.projectRoot, ".wrongstack", "skills"),
+    inProjectWorktrees: path11.join(opts.projectRoot, ".wrongstack", "worktrees"),
+    projectHash: hash,
+    projectSlug: slug,
+    projectGoal: path11.join(projectDir, "goal.json"),
+    projectSpecs: path11.join(projectDir, "specs"),
+    projectTaskGraphs: path11.join(projectDir, "task-graphs"),
+    projectSddSession: path11.join(projectDir, "sdd-session.json"),
+    projectPlan: path11.join(projectDir, "plan.json"),
+    projectAutophase: path11.join(projectDir, "autophase"),
+    syncConfig: path11.join(globalRoot, "sync.json")
+  };
+}
+
+// src/storage/goal-store.ts
 var MAX_JOURNAL_ENTRIES = 500;
 function goalFilePath(projectRoot) {
-  const hash = createHash("sha256").update(path3.resolve(projectRoot)).digest("hex").slice(0, 12);
-  return path3.join(os.homedir(), ".wrongstack", "projects", hash, "goal.json");
+  return resolveWstackPaths({ projectRoot }).projectGoal;
 }
 async function loadGoal(filePath) {
   let raw;
   try {
     raw = await fsp.readFile(filePath, "utf8");
-  } catch {
-    return null;
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") return null;
+    throw err;
   }
   try {
     const parsed = JSON.parse(raw);
     if (parsed?.version !== 1 || typeof parsed.goal !== "string" || !Array.isArray(parsed.journal)) {
+      console.warn(`[goal-store] Corrupt goal.json at ${filePath} \u2014 invalid schema. Consider deleting it and re-creating.`);
       return null;
     }
     return parsed;
   } catch {
+    console.warn(`[goal-store] Corrupt goal.json at ${filePath} \u2014 JSON parse failed. Consider deleting it and re-creating.`);
     return null;
   }
 }
@@ -7109,7 +7171,7 @@ function computeTrend(history) {
   const recent = history.slice(-5);
   const deltas = [];
   for (let i = 1; i < recent.length; i++) {
-    deltas.push(recent[i].progress - recent[i - 1].progress);
+    deltas.push((recent[i]?.progress ?? 0) - (recent[i - 1]?.progress ?? 0));
   }
   if (deltas.length < 2) return void 0;
   const avgDelta = deltas.reduce((a, b) => a + b, 0) / deltas.length;
@@ -7701,8 +7763,8 @@ ${recentJournal}` : "No prior iterations.",
       await saveGoal(this.goalPath, abandoned);
     }
     try {
-      const { unlink: unlink9 } = await import('fs/promises');
-      await unlink9(this.goalPath);
+      const { unlink: unlink10 } = await import('fs/promises');
+      await unlink10(this.goalPath);
     } catch {
     }
     this.opts.onEternalStop?.();
@@ -8703,6 +8765,53 @@ Working rules:
         "flaws"
       ]
     }
+  },
+  {
+    config: {
+      id: "refactor-planner",
+      name: "Refactor Planner",
+      role: "refactor-planner",
+      tools: [...PLAN_TOOLS, "diff"],
+      prompt: `You are the Refactor Planner agent. Your job is to analyze code
+structure and produce a concrete, phased refactoring plan with risk
+assessment, dependency ordering, and rollback strategy.
+
+Scope:
+- Map module-level dependencies (import graph)
+- Identify coupling hotspots (high fan-in/out modules)
+- Assess refactoring risk by complexity and test coverage
+- Generate phased plans with checkpoint milestones
+- Produce diff-friendly task lists (one task = one concern)
+
+Input format you accept:
+{ "task": "plan | assess | roadmap", "target": "src/core", "constraint": "no-breaking-changes | minimal-downtime | full-rewrite", "focus": "architecture | performance | maintainability" }
+
+Output: Markdown refactor plan with phases (Low Risk / Medium Risk / High Risk),
+dependency graph, rollback strategy, and exit criteria.
+
+Working rules:
+- Always include rollback strategy \u2014 every refactor can fail
+- Merge tasks that take <1h into a single phase
+- Respect team constraints (reviewer availability, parallelization)
+- Never plan without analyzing the actual code first`
+    },
+    budget: HEAVY_BUDGET,
+    capability: {
+      phase: "planning",
+      summary: "Refactoring planner: analyzes code structure, maps dependencies, produces risk-scored phased plans with rollback strategy.",
+      keywords: [
+        "refactor",
+        "refactoring",
+        "restructure",
+        "debt",
+        "technical debt",
+        "clean up",
+        "modularize",
+        "decouple",
+        "dependency graph",
+        "code structure"
+      ]
+    }
   }
 ];
 
@@ -9242,6 +9351,157 @@ Working rules:
         "robustness"
       ]
     }
+  },
+  {
+    config: {
+      id: "security-scanner",
+      name: "Security Scanner",
+      role: "security-scanner",
+      tools: [...TOOLS.inspect],
+      prompt: `You are the Security Scanner agent. Your job is to scan code,
+configs, and dependencies for security issues from hardcoded secrets to
+supply chain risks.
+
+Scope:
+- Detect hardcoded secrets: API keys, tokens, passwords, private keys
+- Find injection vectors: eval, innerHTML, SQL concat, shell injection
+- Identify insecure patterns: weak crypto, hardcoded IVs, disabled TLS
+- Scan dependencies for known CVEs (via npm/pnpm audit)
+- Flag supply chain risks: postinstall hooks, unverified scripts
+
+Input format you accept:
+{ "task": "scan | audit | secrets | dependencies", "paths": ["src", "config"], "depth": "quick | normal | deep" }
+
+Output: Markdown security report with severity-ranked findings, injection
+vectors, dependency issues, and a remediation checklist.
+
+Working rules:
+- Never scan node_modules \u2014 use npm audit instead
+- Always provide remediation steps, not just findings
+- Verify regex-based secrets before flagging (false positive risk)
+- When in doubt, flag as medium rather than ignoring potential issues`
+    },
+    budget: HEAVY_BUDGET,
+    capability: {
+      phase: "verify",
+      summary: "Security scanner: detects hardcoded secrets, injection vectors, insecure patterns, and supply-chain risks with remediation.",
+      keywords: [
+        "security",
+        "scan",
+        "vulnerability",
+        "secret",
+        "api key",
+        "hardcoded",
+        "injection",
+        "cve",
+        "audit dependencies",
+        "supply chain",
+        "xss",
+        "sqli",
+        "shell injection",
+        "sensitive data",
+        "credential"
+      ]
+    }
+  },
+  {
+    config: {
+      id: "bug-hunter",
+      name: "Bug Hunter",
+      role: "bug-hunter",
+      tools: [...TOOLS.inspect],
+      prompt: `You are the Bug Hunter agent. Your job is to systematically scan
+source code for bugs, anti-patterns, and code smells using pattern matching
+and heuristics. Output a prioritized hit list with file:line references.
+
+Scope:
+- Detect common bug patterns (uncaught errors, resource leaks, race conditions)
+- Identify anti-patterns (callback hell, God objects, circular deps)
+- Find TypeScript-specific issues (unsafe any, missing null checks, branded types)
+- Flag security-sensitive constructs (eval, innerHTML, hardcoded secrets)
+- Rank findings: critical > high > medium > low
+
+Input format you accept:
+{ "task": "scan | hunt | check", "paths": ["src/**/*.ts"], "focus": "bugs | patterns | security | all", "severityThreshold": "medium" }
+
+Output: Markdown bug hunt report with critically/high/medium/low sections.
+Each entry: **[TYPE]** \`file:line\` \u2014 description + suggested fix
+
+Working rules:
+- Never scan node_modules \u2014 it's noise
+- Always include file:line for every finding
+- If >30% of findings are false positives, note the confidence level
+- Ask director for clarification if paths are ambiguous`
+    },
+    budget: HEAVY_BUDGET,
+    capability: {
+      phase: "verify",
+      summary: "Bug hunter: scans source code for bugs, anti-patterns, and code smells, producing a file:line-ranked hit list with fixes.",
+      keywords: [
+        "bug",
+        "hunt",
+        "scan",
+        "code smell",
+        "anti-pattern",
+        "race condition",
+        "memory leak",
+        "null deref",
+        "type safety",
+        "unhandled error",
+        "find bugs",
+        "audit code",
+        "code quality"
+      ]
+    }
+  },
+  {
+    config: {
+      id: "audit-log",
+      name: "Audit Log",
+      role: "audit-log",
+      tools: [...TOOLS.inspect],
+      prompt: `You are the Audit Log agent. Your job is to analyze structured JSONL
+session logs and produce actionable markdown reports.
+
+Scope:
+- Parse session logs (iteration counts, tool calls, errors, usage)
+- Detect repeated failure patterns across multiple runs
+- Identify tool usage anomalies (over-use, failures, unexpected chains)
+- Track token consumption trends
+- Generate structured audit reports with severity ratings
+
+Input format you accept:
+{ "task": "analyze | report | trends", "sessionPath": "<path>", "focus": "errors | tools | usage | all" }
+
+Output: Markdown audit report with Summary, Top Errors, Tool Usage table,
+Anomalies, and Cost Trend sections.
+
+Working rules:
+- Never fabricate numbers \u2014 read the actual logs first
+- Always include file:line references for errors
+- If sessionPath is missing, ask the director to provide it
+- Report confidence level: high (>90% accuracy), medium, low`
+    },
+    budget: MEDIUM_BUDGET,
+    capability: {
+      phase: "verify",
+      summary: "Audit log analyzer: parses session JSONL, detects failure patterns, tool anomalies, and cost trends with structured reports.",
+      keywords: [
+        "audit",
+        "log",
+        "logs",
+        "session",
+        "trace",
+        "analyze logs",
+        "error patterns",
+        "cost analysis",
+        "tool usage",
+        "token usage",
+        "post-mortem",
+        "trend",
+        "anomaly"
+      ]
+    }
   }
 ];
 
@@ -14900,7 +15160,7 @@ var Director = class _Director {
       })),
       usage: this.usage.snapshot()
     };
-    await fsp.mkdir(path3.dirname(this.manifestPath), { recursive: true });
+    await fsp.mkdir(path11.dirname(this.manifestPath), { recursive: true });
     await atomicWrite(this.manifestPath, JSON.stringify(manifest, null, 2), { mode: 384 });
     return this.manifestPath;
   }
@@ -15106,7 +15366,7 @@ var Director = class _Director {
    */
   async readSession(subagentId, tail) {
     if (!this.sessionsRoot) return null;
-    const filePath = path3.join(this.sessionsRoot, this.directorRunId, `${subagentId}.jsonl`);
+    const filePath = path11.join(this.sessionsRoot, this.directorRunId, `${subagentId}.jsonl`);
     let raw;
     try {
       raw = await fsp.readFile(filePath, "utf8");
@@ -15630,13 +15890,13 @@ async function readSubagentPartial(opts, subagentId) {
   if (!opts.sessionsRoot) return void 0;
   const candidates = [];
   if (opts.directorRunId) {
-    candidates.push(path3.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
+    candidates.push(path11.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
   } else {
     try {
       const entries = await fsp.readdir(opts.sessionsRoot, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
-          candidates.push(path3.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
+          candidates.push(path11.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
         }
       }
     } catch {
@@ -15685,9 +15945,9 @@ function makeDirectorSessionFactory(opts) {
   let dir;
   if (opts.store) {
     store = opts.store;
-    dir = opts.sessionsRoot ? path3.join(opts.sessionsRoot, runId) : "(caller-managed)";
+    dir = opts.sessionsRoot ? path11.join(opts.sessionsRoot, runId) : "(caller-managed)";
   } else if (opts.sessionsRoot) {
-    dir = path3.join(opts.sessionsRoot, runId);
+    dir = path11.join(opts.sessionsRoot, runId);
     store = new DefaultSessionStore({ dir });
   } else {
     throw new Error("makeDirectorSessionFactory requires either `store` or `sessionsRoot`");
@@ -15894,7 +16154,7 @@ var DefaultModelsRegistry = class {
     this.overlay = opts.overlay;
     this.overlayUrl = opts.overlayUrl;
     this.overlayFile = opts.overlayFile;
-    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path3.join(path3.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
+    this.overlayCacheFile = opts.overlayCacheFile ?? (opts.overlayUrl ? path11.join(path11.dirname(opts.cacheFile), "models-overlay-cache.json") : void 0);
   }
   async load(opts = {}) {
     if (this.payload && !opts.force) return this.payload;
@@ -16107,7 +16367,7 @@ var DefaultModelsRegistry = class {
   }
   /** Used by `wstack models refresh` to expose where the cache lives. */
   cacheLocation() {
-    return path3.resolve(this.cacheFile);
+    return path11.resolve(this.cacheFile);
   }
 };
 function hasEntries(payload) {
@@ -16403,7 +16663,7 @@ var DefaultModeStore = class {
   }
   async loadActiveMode() {
     try {
-      const configPath = path3.join(this.configDir, "mode.json");
+      const configPath = path11.join(this.configDir, "mode.json");
       const content = await fsp.readFile(configPath, "utf8");
       const data = JSON.parse(content);
       this.activeModeId = data.activeMode ?? null;
@@ -16414,7 +16674,7 @@ var DefaultModeStore = class {
   async saveActiveMode() {
     try {
       await fsp.mkdir(this.configDir, { recursive: true });
-      const configPath = path3.join(this.configDir, "mode.json");
+      const configPath = path11.join(this.configDir, "mode.json");
       await atomicWrite(
         configPath,
         JSON.stringify({ activeMode: this.activeModeId }, null, 2)
@@ -16429,11 +16689,11 @@ async function loadProjectModes(modesDir) {
     const entries = await fsp.readdir(modesDir);
     for (const entry of entries) {
       if (!entry.endsWith(".md") && !entry.endsWith(".txt")) continue;
-      const filePath = path3.join(modesDir, entry);
+      const filePath = path11.join(modesDir, entry);
       const stat6 = await fsp.stat(filePath);
       if (!stat6.isFile()) continue;
       const content = await fsp.readFile(filePath, "utf8");
-      const id = path3.basename(entry, path3.extname(entry));
+      const id = path11.basename(entry, path11.extname(entry));
       modes.push({
         id,
         name: id.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()),
@@ -16449,7 +16709,7 @@ async function loadProjectModes(modesDir) {
 async function loadUserModes(modesDir) {
   const modes = [];
   try {
-    const manifestPath = path3.join(modesDir, "modes.json");
+    const manifestPath = path11.join(modesDir, "modes.json");
     const content = await fsp.readFile(manifestPath, "utf8");
     const manifest = JSON.parse(content);
     for (const mode of manifest.modes) {
@@ -17366,7 +17626,7 @@ var SpecStore = class {
   indexPath;
   constructor(opts) {
     this.baseDir = opts.baseDir;
-    this.indexPath = path3.join(this.baseDir, "_index.json");
+    this.indexPath = path11.join(this.baseDir, "_index.json");
   }
   async save(spec) {
     await ensureDir(this.baseDir);
@@ -17435,7 +17695,7 @@ var SpecStore = class {
     return updated;
   }
   filePath(id) {
-    return path3.join(this.baseDir, `${id}.json`);
+    return path11.join(this.baseDir, `${id}.json`);
   }
   async readIndex() {
     try {
@@ -17492,7 +17752,7 @@ var TaskGraphStore = class {
   indexPath;
   constructor(opts) {
     this.baseDir = opts.baseDir;
-    this.indexPath = path3.join(this.baseDir, "_index.json");
+    this.indexPath = path11.join(this.baseDir, "_index.json");
   }
   async save(graph) {
     await ensureDir(this.baseDir);
@@ -17530,7 +17790,7 @@ var TaskGraphStore = class {
     }
   }
   filePath(id) {
-    return path3.join(this.baseDir, `${id}.json`);
+    return path11.join(this.baseDir, `${id}.json`);
   }
   async readIndex() {
     try {