@wrongstack/core 0.109.1 → 0.141.0

package/dist/{parallel-eternal-engine-B2CbsKpc.d.ts → parallel-eternal-engine-Dj2SYzha.d.ts}

@@ -1,12 +1,12 @@
-import { e as ProviderError, C as Context, T as Tool, m as ToolUseBlock, n as ToolResultBlock } from './context-CNRYfhUv.js';
-import { R as RetryPolicy, E as ErrorHandler, a as RecoveryDecision } from './retry-policy-BcmuT_V0.js';
-import { C as Compactor, a as CompactReport } from './compactor-DXLxLcmU.js';
-import { M as ModelsRegistry } from './models-registry-B6_KfS65.js';
-import { T as ToolExecutorOptions, a as ToolExecutorStrategy, b as ToolBatchResult } from './index-DIKEcfgC.js';
-import { g as Agent, h as AgentFactory } from './agent-subagent-runner-DukQLUcS.js';
-import { b as BrainArbiter } from './brain-Dfv4Y82E.js';
+import { e as ProviderError, C as Context, T as Tool, m as ToolUseBlock, n as ToolResultBlock } from './context-C7G_MtLV.js';
+import { R as RetryPolicy, E as ErrorHandler, a as RecoveryDecision } from './retry-policy-rutAfVeR.js';
+import { C as Compactor, a as CompactReport } from './compactor-BueGt7LG.js';
+import { M as ModelsRegistry } from './config-BaVThgnT.js';
+import { T as ToolExecutorOptions, a as ToolExecutorStrategy, b as ToolBatchResult } from './index-CPweVoFM.js';
+import { g as Agent, h as AgentFactory } from './agent-subagent-runner-1GeQE_L0.js';
+import { b as BrainArbiter } from './brain-Cp_3GIS2.js';
 import { J as JournalEntry } from './goal-store-CV9Yz2X_.js';
-import { D as DispatchClassifier, a as DefaultMultiAgentCoordinator } from './multi-agent-coordinator-51LvnXkD.js';
+import { D as DispatchClassifier, a as DefaultMultiAgentCoordinator } from './multi-agent-coordinator-QWEzJDlm.js';
 
 declare class DefaultRetryPolicy implements RetryPolicy {
     shouldRetry(err: Error | ProviderError, attempt: number): boolean;
@@ -48,13 +48,17 @@ declare class DefaultErrorHandler implements ErrorHandler {
 interface CompactorOptions {
     preserveK?: number | undefined;
     eliseThreshold?: number | undefined;
+    /**
+     * @deprecated Ignored. Token estimation is centralized in
+     * `compaction-core`/`token-estimate` so all compactors and the context-pressure
+     * monitor agree on one number. Kept only for backward-compatible call sites.
+     */
     estimator?: (((text: string) => number)) | undefined;
 }
 
 declare class HybridCompactor implements Compactor {
     private readonly preserveK;
     private readonly eliseThreshold;
-    private readonly estimator;
     constructor(opts?: CompactorOptions);
     compact(ctx: Context, opts?: {
         aggressive?: boolean | undefined;
@@ -64,9 +68,18 @@ declare class HybridCompactor implements Compactor {
      * This is the accurate figure for context-window pressure monitoring.
      */
     private estimateFullRequest;
-    private eliseOldToolResults;
+    /**
+     * Lossless rule-based collapse of ancient turns into a single digest message.
+     *
+     * Preserves ALL textual content of the collapsed range — user instructions,
+     * assistant decisions/conclusions, and any prior digests (chained forward so
+     * the digest stays lossless across repeated compactions). Only `tool_use` /
+     * `tool_result` protocol blocks are dropped and replaced with a count marker;
+     * their full payload already lives in the session log. No sub-LLM call.
+     *
+     * Returns the token savings and the digest text (for audit logging).
+     */
     private collapseAncientTurns;
-    private estimateMessages;
 }
 
 declare class ToolExecutor {

package/dist/{path-resolver-DDJiMAtX.d.ts → path-resolver-DRjQBkoO.d.ts}

@@ -1,6 +1,6 @@
-import { E as EventBus } from './brain-Dfv4Y82E.js';
-import { M as ModelsRegistry, b as ResolvedModel } from './models-registry-B6_KfS65.js';
-import { c as TokenCounter, U as Usage, d as CacheStats } from './context-CNRYfhUv.js';
+import { E as EventBus } from './brain-Cp_3GIS2.js';
+import { M as ModelsRegistry, b as ResolvedModel } from './config-BaVThgnT.js';
+import { c as TokenCounter, U as Usage, d as CacheStats } from './context-C7G_MtLV.js';
 import { P as PathResolver } from './path-resolver-CPRj4bFY.js';
 
 /**

package/dist/{permission-BDv7z0mk.d.ts → permission-B7nKnEvQ.d.ts}

@@ -1,4 +1,4 @@
-import { T as Tool, C as Context, f as Permission } from './context-CNRYfhUv.js';
+import { T as Tool, C as Context, f as Permission } from './context-C7G_MtLV.js';
 
 interface SecretScrubber {
     scrub(text: string): string;

package/dist/{permission-policy-dF74EpDp.d.ts → permission-policy-8-6zBmfA.d.ts}

@@ -1,6 +1,6 @@
-import { T as Tool, C as Context } from './context-CNRYfhUv.js';
+import { T as Tool, C as Context } from './context-C7G_MtLV.js';
 import { I as InputReader } from './input-reader-E-ffP2ee.js';
-import { P as PermissionPolicy, a as PermissionDecision } from './permission-BDv7z0mk.js';
+import { P as PermissionPolicy, a as PermissionDecision } from './permission-B7nKnEvQ.js';
 
 interface PermissionPolicyOptions {
     trustFile: string;
@@ -122,17 +122,6 @@ declare class DefaultPermissionPolicy implements PermissionPolicy {
  * declared capabilities.
  */
 declare class AutoApprovePermissionPolicy implements PermissionPolicy {
-    /**
-     * Legacy name-based denylist.
-     * @deprecated Prefer declaring `capabilities` on the Tool and using capability-based checks.
-     */
-    private static readonly LEGACY_NAME_DENY;
-    /**
-     * Tools from MCP servers (`mcp__<server>__<tool>`) are external code of
-     * unknown capability — they may wrap a shell or filesystem. They are
-     * fail-closed here: not auto-approved for subagents by default, so the
-     * leader must allow them explicitly per-spawn.
-     */
     private static isMcpTool;
     evaluate(tool: Tool): Promise<PermissionDecision>;
     trust(): Promise<void>;

package/dist/{pipeline-BqiA_UMr.d.ts → pipeline-BG7UgbDc.d.ts}

@@ -1,5 +1,5 @@
-import { T as Tool, l as TextBlock, g as ContentBlock } from './context-CNRYfhUv.js';
-import { H as HookEvent, a as HookMatcher, I as InProcessHook, S as ShellHook, b as HookEntry } from './config-BSU-6vah.js';
+import { T as Tool, l as TextBlock, g as ContentBlock } from './context-C7G_MtLV.js';
+import { H as HookEvent, e as HookMatcher, I as InProcessHook, S as ShellHook, f as HookEntry } from './config-BaVThgnT.js';
 
 /** Model capabilities relevant to prompt composition. */
 interface ModelCapabilities {

package/dist/{plan-templates-BdDxl9cI.d.ts → plan-templates-CkKNPU3I.d.ts}

@@ -1,9 +1,9 @@
-import { E as EventBus, M as MemoryScope, k as MemoryEntry, l as MemoryStore, m as MemoryRelevanceContext, S as ScoredEntry } from './brain-Dfv4Y82E.js';
-import { S as SecretScrubber } from './permission-BDv7z0mk.js';
-import { i as SessionStore, h as SessionMetadata, a as SessionWriter, p as ResumedSession, q as SessionData, r as SessionSummary, g as ContentBlock, S as SessionEvent, s as TodoItem, t as ConversationState } from './context-CNRYfhUv.js';
-import { A as AttachmentStore, a as AddAttachmentInput, b as AttachmentRef, c as Attachment } from './session-reader-DDz1Ek4V.js';
-import { W as WstackPaths } from './wstack-paths-_lqjzErq.js';
-import { e as ConfigStore, d as Config, f as ConfigLoader, g as SyncConfig } from './config-BSU-6vah.js';
+import { E as EventBus, M as MemoryScope, k as MemoryEntry, l as MemoryStore, m as MemoryRelevanceContext, S as ScoredEntry } from './brain-Cp_3GIS2.js';
+import { S as SecretScrubber } from './permission-B7nKnEvQ.js';
+import { i as SessionStore, h as SessionMetadata, a as SessionWriter, p as ResumedSession, q as SessionData, r as SessionSummary, g as ContentBlock, S as SessionEvent, s as TodoItem, t as ConversationState } from './context-C7G_MtLV.js';
+import { A as AttachmentStore, a as AddAttachmentInput, b as AttachmentRef, c as Attachment } from './session-reader-BAtCxdaw.js';
+import { W as WstackPaths } from './wstack-paths-DD50Omgn.js';
+import { i as ConfigStore, h as Config, j as ConfigLoader, k as SyncConfig } from './config-BaVThgnT.js';
 import { S as SecretVault } from './secret-vault-DoISxaKO.js';
 
 interface SessionStoreOptions {

package/dist/{provider-runner-BUunikwY.d.ts → provider-runner-BNpuIyOL.d.ts}

@@ -1,8 +1,8 @@
-import { E as EventBus } from './brain-Dfv4Y82E.js';
+import { E as EventBus } from './brain-Cp_3GIS2.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { T as Tracer } from './observability-D-HZN_mF.js';
-import { P as Provider, R as Request, C as Context, b as Response } from './context-CNRYfhUv.js';
-import { R as RetryPolicy } from './retry-policy-BcmuT_V0.js';
+import { P as Provider, R as Request, C as Context, b as Response } from './context-C7G_MtLV.js';
+import { R as RetryPolicy } from './retry-policy-rutAfVeR.js';
 
 /**
  * Options passed to a ProviderRunner when calling the provider.

package/dist/{retry-policy-BcmuT_V0.d.ts → retry-policy-rutAfVeR.d.ts}

@@ -1,4 +1,4 @@
-import { C as Context, b as Response, e as ProviderError } from './context-CNRYfhUv.js';
+import { C as Context, b as Response, e as ProviderError } from './context-C7G_MtLV.js';
 
 type RecoveryDecision = {
     /**

package/dist/sdd/index.d.ts

@@ -1,16 +1,15 @@
 import { h as Specification, S as SpecAnalysis, g as SpecValidationResult, e as SpecStatus, f as SpecTemplate, b as SpecRequirement } from '../spec-TBi3Jr6T.js';
 import { d as TaskGraph, e as TaskNode, i as TaskFilter, j as TaskSort, c as TaskProgress, T as TaskType, a as TaskPriority } from '../task-graph-u1q9Jkyk.js';
-import { E as EventBus } from '../brain-Dfv4Y82E.js';
-import { D as DoneCondition, g as Agent, h as AgentFactory, f as TaskResult } from '../agent-subagent-runner-DukQLUcS.js';
-import '../context-CNRYfhUv.js';
-import '../index-DIKEcfgC.js';
+import { E as EventBus } from '../brain-Cp_3GIS2.js';
+import { D as DoneCondition, g as Agent, h as AgentFactory, f as TaskResult } from '../agent-subagent-runner-1GeQE_L0.js';
+import '../context-C7G_MtLV.js';
+import '../index-CPweVoFM.js';
 import '../logger-B63L5bTg.js';
-import '../pipeline-BqiA_UMr.js';
-import '../config-BSU-6vah.js';
-import '../models-registry-B6_KfS65.js';
+import '../pipeline-BG7UgbDc.js';
+import '../config-BaVThgnT.js';
 import '../observability-D-HZN_mF.js';
-import '../permission-BDv7z0mk.js';
-import '../retry-policy-BcmuT_V0.js';
+import '../permission-B7nKnEvQ.js';
+import '../retry-policy-rutAfVeR.js';
 
 declare class SpecParser {
     parse(content: string): Specification;

package/dist/sdd/index.js

@@ -2209,6 +2209,13 @@ function computeParallelGroups(graph, blockedByMap) {
   return groups;
 }
 
+// src/utils/assert-never.ts
+function assertNever(x, message) {
+  throw new Error(
+    `Unhandled case: ${JSON.stringify(x)}`
+  );
+}
+
 // src/sdd/spec-versioning.ts
 var SpecVersioning = class {
   versions = /* @__PURE__ */ new Map();
@@ -2359,6 +2366,8 @@ var SpecVersioning = class {
     switch (type) {
       case "functional":
         return "feature";
+      case "non-functional":
+        return "feature";
       case "security":
         return "feature";
       case "performance":
@@ -2366,7 +2375,7 @@ var SpecVersioning = class {
       case "ux":
         return "feature";
       default:
-        return "feature";
+        return assertNever(type);
     }
   }
 };
@@ -3721,6 +3730,53 @@ Working rules:
         "flaws"
       ]
     }
+  },
+  {
+    config: {
+      id: "refactor-planner",
+      name: "Refactor Planner",
+      role: "refactor-planner",
+      tools: [...PLAN_TOOLS, "diff"],
+      prompt: `You are the Refactor Planner agent. Your job is to analyze code
+structure and produce a concrete, phased refactoring plan with risk
+assessment, dependency ordering, and rollback strategy.
+
+Scope:
+- Map module-level dependencies (import graph)
+- Identify coupling hotspots (high fan-in/out modules)
+- Assess refactoring risk by complexity and test coverage
+- Generate phased plans with checkpoint milestones
+- Produce diff-friendly task lists (one task = one concern)
+
+Input format you accept:
+{ "task": "plan | assess | roadmap", "target": "src/core", "constraint": "no-breaking-changes | minimal-downtime | full-rewrite", "focus": "architecture | performance | maintainability" }
+
+Output: Markdown refactor plan with phases (Low Risk / Medium Risk / High Risk),
+dependency graph, rollback strategy, and exit criteria.
+
+Working rules:
+- Always include rollback strategy \u2014 every refactor can fail
+- Merge tasks that take <1h into a single phase
+- Respect team constraints (reviewer availability, parallelization)
+- Never plan without analyzing the actual code first`
+    },
+    budget: HEAVY_BUDGET,
+    capability: {
+      phase: "planning",
+      summary: "Refactoring planner: analyzes code structure, maps dependencies, produces risk-scored phased plans with rollback strategy.",
+      keywords: [
+        "refactor",
+        "refactoring",
+        "restructure",
+        "debt",
+        "technical debt",
+        "clean up",
+        "modularize",
+        "decouple",
+        "dependency graph",
+        "code structure"
+      ]
+    }
   }
 ];
 
@@ -4260,6 +4316,157 @@ Working rules:
         "robustness"
       ]
     }
+  },
+  {
+    config: {
+      id: "security-scanner",
+      name: "Security Scanner",
+      role: "security-scanner",
+      tools: [...TOOLS.inspect],
+      prompt: `You are the Security Scanner agent. Your job is to scan code,
+configs, and dependencies for security issues from hardcoded secrets to
+supply chain risks.
+
+Scope:
+- Detect hardcoded secrets: API keys, tokens, passwords, private keys
+- Find injection vectors: eval, innerHTML, SQL concat, shell injection
+- Identify insecure patterns: weak crypto, hardcoded IVs, disabled TLS
+- Scan dependencies for known CVEs (via npm/pnpm audit)
+- Flag supply chain risks: postinstall hooks, unverified scripts
+
+Input format you accept:
+{ "task": "scan | audit | secrets | dependencies", "paths": ["src", "config"], "depth": "quick | normal | deep" }
+
+Output: Markdown security report with severity-ranked findings, injection
+vectors, dependency issues, and a remediation checklist.
+
+Working rules:
+- Never scan node_modules \u2014 use npm audit instead
+- Always provide remediation steps, not just findings
+- Verify regex-based secrets before flagging (false positive risk)
+- When in doubt, flag as medium rather than ignoring potential issues`
+    },
+    budget: HEAVY_BUDGET,
+    capability: {
+      phase: "verify",
+      summary: "Security scanner: detects hardcoded secrets, injection vectors, insecure patterns, and supply-chain risks with remediation.",
+      keywords: [
+        "security",
+        "scan",
+        "vulnerability",
+        "secret",
+        "api key",
+        "hardcoded",
+        "injection",
+        "cve",
+        "audit dependencies",
+        "supply chain",
+        "xss",
+        "sqli",
+        "shell injection",
+        "sensitive data",
+        "credential"
+      ]
+    }
+  },
+  {
+    config: {
+      id: "bug-hunter",
+      name: "Bug Hunter",
+      role: "bug-hunter",
+      tools: [...TOOLS.inspect],
+      prompt: `You are the Bug Hunter agent. Your job is to systematically scan
+source code for bugs, anti-patterns, and code smells using pattern matching
+and heuristics. Output a prioritized hit list with file:line references.
+
+Scope:
+- Detect common bug patterns (uncaught errors, resource leaks, race conditions)
+- Identify anti-patterns (callback hell, God objects, circular deps)
+- Find TypeScript-specific issues (unsafe any, missing null checks, branded types)
+- Flag security-sensitive constructs (eval, innerHTML, hardcoded secrets)
+- Rank findings: critical > high > medium > low
+
+Input format you accept:
+{ "task": "scan | hunt | check", "paths": ["src/**/*.ts"], "focus": "bugs | patterns | security | all", "severityThreshold": "medium" }
+
+Output: Markdown bug hunt report with critically/high/medium/low sections.
+Each entry: **[TYPE]** \`file:line\` \u2014 description + suggested fix
+
+Working rules:
+- Never scan node_modules \u2014 it's noise
+- Always include file:line for every finding
+- If >30% of findings are false positives, note the confidence level
+- Ask director for clarification if paths are ambiguous`
+    },
+    budget: HEAVY_BUDGET,
+    capability: {
+      phase: "verify",
+      summary: "Bug hunter: scans source code for bugs, anti-patterns, and code smells, producing a file:line-ranked hit list with fixes.",
+      keywords: [
+        "bug",
+        "hunt",
+        "scan",
+        "code smell",
+        "anti-pattern",
+        "race condition",
+        "memory leak",
+        "null deref",
+        "type safety",
+        "unhandled error",
+        "find bugs",
+        "audit code",
+        "code quality"
+      ]
+    }
+  },
+  {
+    config: {
+      id: "audit-log",
+      name: "Audit Log",
+      role: "audit-log",
+      tools: [...TOOLS.inspect],
+      prompt: `You are the Audit Log agent. Your job is to analyze structured JSONL
+session logs and produce actionable markdown reports.
+
+Scope:
+- Parse session logs (iteration counts, tool calls, errors, usage)
+- Detect repeated failure patterns across multiple runs
+- Identify tool usage anomalies (over-use, failures, unexpected chains)
+- Track token consumption trends
+- Generate structured audit reports with severity ratings
+
+Input format you accept:
+{ "task": "analyze | report | trends", "sessionPath": "<path>", "focus": "errors | tools | usage | all" }
+
+Output: Markdown audit report with Summary, Top Errors, Tool Usage table,
+Anomalies, and Cost Trend sections.
+
+Working rules:
+- Never fabricate numbers \u2014 read the actual logs first
+- Always include file:line references for errors
+- If sessionPath is missing, ask the director to provide it
+- Report confidence level: high (>90% accuracy), medium, low`
+    },
+    budget: MEDIUM_BUDGET,
+    capability: {
+      phase: "verify",
+      summary: "Audit log analyzer: parses session JSONL, detects failure patterns, tool anomalies, and cost trends with structured reports.",
+      keywords: [
+        "audit",
+        "log",
+        "logs",
+        "session",
+        "trace",
+        "analyze logs",
+        "error patterns",
+        "cost analysis",
+        "tool usage",
+        "token usage",
+        "post-mortem",
+        "trend",
+        "anomaly"
+      ]
+    }
   }
 ];