@wrongstack/core 0.148.0 → 0.155.0

package/dist/utils/index.d.ts

@@ -275,6 +275,70 @@ declare function sleep(ms: number): Promise<void>;
  */
 declare function assertNever(x: never, message?: string): never;
 
+/**
+ * Deep merge utility — safely merges nested objects with configurable
+ * conflict resolution, array merging, and prototype-pollution guarding.
+ *
+ * Used by:
+ * - config-loader  (config layer merging with primitive-array concatenation)
+ * - secret-vault   (config patching)
+ * - json-path       (json_merge tool with prefer-base / prefer-patch semantics)
+ *
+ * @module utils/deep-merge
+ */
+declare const FORBIDDEN_PROTO_KEYS: Set<string>;
+/** True when every element is a primitive or null (no nested objects/arrays). */
+declare function isPrimitiveArray(a: unknown[]): boolean;
+interface DeepMergeOptions {
+    /**
+     * Which side wins on collision for scalars and arrays.
+     *
+     * - `'prefer-patch'` (default): patch value replaces base value.
+     * - `'prefer-base'`:  base value is kept, patch value is ignored.
+     */
+    conflictResolution?: 'prefer-base' | 'prefer-patch';
+    /**
+     * How to handle array values.
+     *
+     * - `'replace'` (default): patch array replaces base array entirely.
+     * - `'concat-primitives'`: when both values are primitive arrays,
+     *   they are concatenated and deduped (via Set).  Non-primitive
+     *   arrays still replace the base wholesale.
+     */
+    arrayMode?: 'replace' | 'concat-primitives';
+    /**
+     * Skip prototype-pollution keys (`__proto__`, `constructor`, etc.).
+     * Enabled by default.  Only disable when you control both inputs
+     * and the keyset (e.g. when merging trusted JSON schemas).
+     */
+    protectProto?: boolean;
+    /**
+     * Optional callback fired when a non-primitive (object) array is
+     * replaced wholesale (only relevant with `arrayMode: 'concat-primitives'`).
+     * Receives the key name, existing array length, and patch array length.
+     * Used by config-loader for debug logging.
+     */
+    onNonPrimitiveArrayReplace?: (key: string, existingLen: number, patchLen: number) => void;
+}
+/**
+ * Recursively merge `patch` into `base`, returning a new object.
+ *
+ * - Nested plain objects are merged recursively.
+ * - Arrays are handled per `options.arrayMode`.
+ * - Scalar collisions are resolved per `options.conflictResolution`.
+ * - `null` and non-object values in `patch` replace the base value
+ *   (unless `conflictResolution` is `'prefer-base'`).
+ * - Keys in `base` that are absent from `patch` are preserved.
+ * - `FORBIDDEN_PROTO_KEYS` are skipped in the patch (unless
+ *   `options.protectProto` is set to `false`).
+ *
+ * The function is generic over `T extends Record<string, unknown>` for
+ * callers that pass typed config objects, but the runtime signature
+ * also accepts `unknown` inputs (used by the json-path plugin).
+ */
+declare function deepMerge<T extends Record<string, unknown>>(base: T, patch: Record<string, unknown>, options?: DeepMergeOptions): T;
+declare function deepMerge(base: unknown, patch: unknown, options?: DeepMergeOptions): unknown;
+
 /**
  * Tool output serialization utilities.
  * Extracted from Agent.executeTools to allow reuse and consistent output handling.
@@ -517,4 +581,4 @@ declare function mergeModelsPayload(base: ModelsDevPayload, overlay: ModelsDevPa
  */
 declare function mergeCustomModelDefs(providerCustomModels: Record<string, CustomModelDefinition> | undefined, configModels: Record<string, CustomModelDefinition> | undefined): Record<string, CustomModelDefinition> | undefined;
 
-export { type AtomicWriteOptions, type BuildChildEnvOptions, type CompileFail, type CompileResult, type FileLockOptions, type MessageRepairReport, type MessageRepairResult, type NewlineStyle, type OutputLineGuard, type RequestTokenBreakdown, type SafeParseResult, type ToolOutputSerializerOptions, type UnifiedDiffOptions, type ValidationError, type ValidationResult, assertNever, atomicWrite, buildChildEnv, color, compileGlob, compileUserRegex, completePartialObject, createToolOutputSerializer, detectNewlineStyle, ensureDir, estimateMessageTokens, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, expandGlob, formatTodosList, getCalibrationState, getTermSize, isInteractive, isStdinTTY, isStdoutTTY, matchAny, matchGlob, mergeCustomModelDefs, mergeModelsPayload, normalizeToLf, onResize, recordActualUsage, repairToolUseAdjacency, resetCalibration, safeParse, safeStringify, sanitizeJsonString, setOutputLineGuard, setRawMode, sleep, stripAnsi, toStyle, unifiedDiff, validateAgainstSchema, withFileLock, writeErr, writeOut };
+export { type AtomicWriteOptions, type BuildChildEnvOptions, type CompileFail, type CompileResult, type DeepMergeOptions, FORBIDDEN_PROTO_KEYS, type FileLockOptions, type MessageRepairReport, type MessageRepairResult, type NewlineStyle, type OutputLineGuard, type RequestTokenBreakdown, type SafeParseResult, type ToolOutputSerializerOptions, type UnifiedDiffOptions, type ValidationError, type ValidationResult, assertNever, atomicWrite, buildChildEnv, color, compileGlob, compileUserRegex, completePartialObject, createToolOutputSerializer, deepMerge, detectNewlineStyle, ensureDir, estimateMessageTokens, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, expandGlob, formatTodosList, getCalibrationState, getTermSize, isInteractive, isPrimitiveArray, isStdinTTY, isStdoutTTY, matchAny, matchGlob, mergeCustomModelDefs, mergeModelsPayload, normalizeToLf, onResize, recordActualUsage, repairToolUseAdjacency, resetCalibration, safeParse, safeStringify, sanitizeJsonString, setOutputLineGuard, setRawMode, sleep, stripAnsi, toStyle, unifiedDiff, validateAgainstSchema, withFileLock, writeErr, writeOut };

package/dist/utils/index.js

@@ -823,7 +823,7 @@ function buildChildEnv(optsOrSessionId) {
   const passthrough = hasOwn && process.env["WRONGSTACK_CHILD_ENV_PASSTHROUGH"] === "1" || legacyHasOwn && process.env["WRONGSTACK_BASH_ENV_PASSTHROUGH"] === "1";
   if (passthrough && !process.env["CI"]) {
     console.warn(
-      "[WrongStack] WARNING: WRONGSTACK_*_ENV_PASSTHROUGH=1 is active \u2014\n  all parent env vars (including API keys) forwarded to child processes.\n  Do not use on shared or multi-tenant systems."
+      "[agent] WARNING: WRONGSTACK_*_ENV_PASSTHROUGH=1 is active \u2014\n  all parent env vars (including API keys) forwarded to child processes.\n  Do not use on shared or multi-tenant systems."
     );
   }
   const out = {};
@@ -862,6 +862,65 @@ function assertNever(x, message) {
   );
 }
 
+// src/utils/deep-merge.ts
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
+function isPrimitiveArray(a) {
+  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
+}
+function deepMerge(base, patch, options = {}) {
+  const {
+    conflictResolution = "prefer-patch",
+    arrayMode = "replace",
+    protectProto = true,
+    onNonPrimitiveArrayReplace
+  } = options;
+  if (typeof base !== "object" || base === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (typeof patch !== "object" || patch === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
+      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+    }
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) || Array.isArray(patch)) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  const baseObj = base;
+  const patchObj = patch;
+  const out = { ...baseObj };
+  for (const [k, v] of Object.entries(patchObj)) {
+    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge(existing, v, options);
+    } else if (Array.isArray(v) && Array.isArray(existing)) {
+      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
+        onNonPrimitiveArrayReplace(k, existing.length, v.length);
+      }
+      out[k] = deepMerge(existing, v, options);
+    } else if (v !== void 0) {
+      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
+        const existingLen = Array.isArray(existing) ? existing.length : 0;
+        onNonPrimitiveArrayReplace(k, existingLen, v.length);
+      }
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
 // src/utils/tool-output-serializer.ts
 function createToolOutputSerializer(opts = {}) {
   const capBytes = opts.perIterationOutputCapBytes ?? 1e5;
@@ -1566,6 +1625,6 @@ function mergeCustomModelDefs(providerCustomModels, configModels) {
   return out;
 }
 
-export { assertNever, atomicWrite, buildChildEnv, color, compileGlob, compileUserRegex, completePartialObject, computeTaskItemProgress, createToolOutputSerializer, detectNewlineStyle, ensureDir, estimateMessageTokens, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, expandGlob, expectDefined, formatTaskList, formatTaskProgress, formatTodosList, getCalibrationState, getTermSize, isInteractive, isStdinTTY, isStdoutTTY, matchAny, matchGlob, mergeCustomModelDefs, mergeModelsPayload, normalizeToLf, onResize, projectHash, projectSlug, recordActualUsage, repairToolUseAdjacency, resetCalibration, resolveWstackPaths, safeParse, safeStringify, sanitizeJsonString, setOutputLineGuard, setRawMode, sleep, stripAnsi, toStyle, unifiedDiff, validateAgainstSchema, withFileLock, writeErr, writeOut };
+export { FORBIDDEN_PROTO_KEYS, assertNever, atomicWrite, buildChildEnv, color, compileGlob, compileUserRegex, completePartialObject, computeTaskItemProgress, createToolOutputSerializer, deepMerge, detectNewlineStyle, ensureDir, estimateMessageTokens, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, expandGlob, expectDefined, formatTaskList, formatTaskProgress, formatTodosList, getCalibrationState, getTermSize, isInteractive, isPrimitiveArray, isStdinTTY, isStdoutTTY, matchAny, matchGlob, mergeCustomModelDefs, mergeModelsPayload, normalizeToLf, onResize, projectHash, projectSlug, recordActualUsage, repairToolUseAdjacency, resetCalibration, resolveWstackPaths, safeParse, safeStringify, sanitizeJsonString, setOutputLineGuard, setRawMode, sleep, stripAnsi, toStyle, unifiedDiff, validateAgainstSchema, withFileLock, writeErr, writeOut };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map