@wrongstack/core 0.148.0 → 0.236.0

package/dist/{secret-vault-DoISxaKO.d.ts → secret-vault-BJDY28ev.d.ts}

@@ -15,5 +15,11 @@ interface SecretVault {
     decrypt(value: string): string;
     isEncrypted(value: string): boolean;
 }
+/**
+ * No-op SecretVault that passes values through unchanged.
+ * Used in contexts where encryption is not needed — e.g. reading/writing
+ * config sections that contain no secret fields (models, settings, etc.).
+ */
+declare const noOpVault: SecretVault;
 
-export type { SecretVault as S };
+export { type SecretVault as S, noOpVault as n };

package/dist/{secret-vault-BTcC_T5v.d.ts → secret-vault-CeVNiy_f.d.ts}

@@ -1,5 +1,6 @@
-import { S as SecretScrubber } from './permission-B7nKnEvQ.js';
-import { S as SecretVault } from './secret-vault-DoISxaKO.js';
+import { S as SecretScrubber } from './permission-DbWPbuoA.js';
+import { L as Logger } from './logger-B63L5bTg.js';
+import { S as SecretVault } from './secret-vault-BJDY28ev.js';
 
 declare class DefaultSecretScrubber implements SecretScrubber {
     scrub(text: string): string;
@@ -55,7 +56,7 @@ declare function rewriteConfigEncrypted(configPath: string, vault: SecretVault,
  * users who had plaintext keys before the vault landed are upgraded
  * transparently.
  */
-declare function migratePlaintextSecrets(configPath: string, vault: SecretVault): Promise<{
+declare function migratePlaintextSecrets(configPath: string, vault: SecretVault, logger?: Pick<Logger, 'warn'>): Promise<{
     migrated: number;
     file: string;
 }>;

package/dist/security/index.d.ts

@@ -1,8 +1,9 @@
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-BTcC_T5v.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-8-6zBmfA.js';
-import '../permission-B7nKnEvQ.js';
-import '../context-C7G_MtLV.js';
-import '../secret-vault-DoISxaKO.js';
+export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-CeVNiy_f.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-AOk0LVsV.js';
+import '../permission-DbWPbuoA.js';
+import '../context-CLz3z_E8.js';
+import '../logger-B63L5bTg.js';
+import '../secret-vault-BJDY28ev.js';
 import '../input-reader-E-ffP2ee.js';
 
 /**

package/dist/security/index.js

@@ -110,6 +110,105 @@ var DefaultSecretScrubber = class {
   }
 };
 
+// src/types/errors.ts
+var ERROR_CODES = {
+  // Provider
+  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
+  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
+  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
+  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
+  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
+  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
+  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
+  // Tool
+  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
+  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
+  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
+  TOOL_TIMEOUT: "TOOL_TIMEOUT",
+  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
+  // Config
+  CONFIG_INVALID: "CONFIG_INVALID",
+  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
+  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
+  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
+  // Plugin
+  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
+  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
+  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
+  // Agent
+  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
+  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
+  AGENT_ABORTED: "AGENT_ABORTED",
+  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
+  // Session
+  SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
+  SESSION_CORRUPTED: "SESSION_CORRUPTED",
+  SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
+  // Container / Registry
+  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
+  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
+  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
+  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
+  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
+  REGISTRY_INVALID: "REGISTRY_INVALID",
+  // File system
+  FS_READ_FAILED: "FS_READ_FAILED",
+  FS_WRITE_FAILED: "FS_WRITE_FAILED",
+  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
+  FS_DELETE_FAILED: "FS_DELETE_FAILED",
+  FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
+  // SDD (Spec-Driven Development)
+  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
+  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
+  SDD_INVALID_STATE: "SDD_INVALID_STATE",
+  SDD_NOT_READY: "SDD_NOT_READY",
+  // General
+  VALIDATION_ERROR: "VALIDATION_ERROR",
+  UNKNOWN: "UNKNOWN"
+};
+var WrongStackError = class extends Error {
+  code;
+  subsystem;
+  severity;
+  recoverable;
+  context;
+  constructor(opts) {
+    super(opts.message, { cause: opts.cause });
+    this.name = "WrongStackError";
+    this.code = opts.code;
+    this.subsystem = opts.subsystem;
+    this.severity = opts.severity ?? "error";
+    this.recoverable = opts.recoverable ?? false;
+    this.context = opts.context;
+  }
+  /**
+   * Render a one-line user-facing description.
+   * Subclasses should override for domain-specific formatting.
+   */
+  describe() {
+    const ctx = this.context ? ` ${formatContext(this.context)}` : "";
+    return `${this.code}: ${this.message}${ctx}`;
+  }
+};
+function formatContext(ctx) {
+  const parts = Object.entries(ctx).filter(([, v]) => v !== void 0).slice(0, 3).map(([k, v]) => `${k}=${String(v)}`);
+  return parts.length > 0 ? `[${parts.join(" ")}]` : "";
+}
+var ConfigError = class extends WrongStackError {
+  constructor(opts) {
+    super({
+      message: opts.message,
+      code: opts.code,
+      subsystem: "config",
+      severity: "fatal",
+      recoverable: false,
+      context: opts.context,
+      cause: opts.cause
+    });
+    this.name = "ConfigError";
+  }
+};
+
 // src/types/secret-vault.ts
 var ENCRYPTED_PREFIX = "enc:v1:";
 async function atomicWrite(targetPath, content, opts = {}) {
@@ -174,11 +273,90 @@ async function renameWithRetry(from, to) {
   throw lastErr;
 }
 
+// src/utils/deep-merge.ts
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
+function isPrimitiveArray(a) {
+  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
+}
+function deepMerge(base, patch, options = {}) {
+  const {
+    conflictResolution = "prefer-patch",
+    arrayMode = "replace",
+    protectProto = true,
+    onNonPrimitiveArrayReplace
+  } = options;
+  if (typeof base !== "object" || base === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (typeof patch !== "object" || patch === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
+      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+    }
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) || Array.isArray(patch)) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  const baseObj = base;
+  const patchObj = patch;
+  const out = { ...baseObj };
+  for (const [k, v] of Object.entries(patchObj)) {
+    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge(existing, v, options);
+    } else if (Array.isArray(v) && Array.isArray(existing)) {
+      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
+        onNonPrimitiveArrayReplace(k, existing.length, v.length);
+      }
+      out[k] = deepMerge(existing, v, options);
+    } else if (v !== void 0) {
+      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
+        const existingLen = Array.isArray(existing) ? existing.length : 0;
+        onNonPrimitiveArrayReplace(k, existingLen, v.length);
+      }
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
 // src/security/secret-vault.ts
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
 var TAG_BYTES = 16;
 var ALGO = "aes-256-gcm";
+var KEY_FILE_MODE = 384;
+function checkKeyFilePermissions(keyFile) {
+  if (process.platform === "win32") return;
+  try {
+    const stat2 = fs2.statSync(keyFile);
+    const actualMode = stat2.mode & 511;
+    if (actualMode !== KEY_FILE_MODE) {
+      console.warn(JSON.stringify({
+        level: "warn",
+        event: "vault.key_file_wrong_permissions",
+        message: `Key file ${keyFile} has mode ${actualMode.toString(8)} \u2014 expected ${KEY_FILE_MODE.toString(8)}. Run: chmod ${KEY_FILE_MODE.toString(8)} ${keyFile}`,
+        keyFile,
+        expectedMode: KEY_FILE_MODE,
+        actualMode,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      }));
+    }
+  } catch {
+  }
+}
 var DefaultSecretVault = class {
   keyFile;
   key;
@@ -202,14 +380,26 @@ var DefaultSecretVault = class {
     const rest = value.slice(ENCRYPTED_PREFIX.length);
     const parts = rest.split(":");
     if (parts.length !== 3) {
-      throw new Error("SecretVault: malformed encrypted value");
+      throw new ConfigError({
+        message: "SecretVault: malformed encrypted value",
+        code: ERROR_CODES.CONFIG_PARSE_FAILED,
+        context: { field: "encrypted_value" }
+      });
     }
     const [ivB64, tagB64, ctB64] = parts;
     const iv = Buffer.from(ivB64, "base64");
     const tag = Buffer.from(tagB64, "base64");
     const ct = Buffer.from(ctB64, "base64");
-    if (iv.length !== IV_BYTES) throw new Error("SecretVault: bad IV length");
-    if (tag.length !== TAG_BYTES) throw new Error("SecretVault: bad tag length");
+    if (iv.length !== IV_BYTES) throw new ConfigError({
+      message: "SecretVault: bad IV length",
+      code: ERROR_CODES.CONFIG_PARSE_FAILED,
+      context: { expected: IV_BYTES, actual: iv.length }
+    });
+    if (tag.length !== TAG_BYTES) throw new ConfigError({
+      message: "SecretVault: bad tag length",
+      code: ERROR_CODES.CONFIG_PARSE_FAILED,
+      context: { expected: TAG_BYTES, actual: tag.length }
+    });
     const key = this.loadOrCreateKey();
     const decipher = createDecipheriv(ALGO, key, iv);
     decipher.setAuthTag(tag);
@@ -221,11 +411,14 @@ var DefaultSecretVault = class {
     try {
       const buf = fs2.readFileSync(this.keyFile);
       if (buf.length !== KEY_BYTES) {
-        throw new Error(
-          `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES}). Remove it manually to generate a new key.`
-        );
+        throw new ConfigError({
+          message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES}). Remove it manually to generate a new key.`,
+          code: ERROR_CODES.CONFIG_INVALID,
+          context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
+        });
       }
       this.key = buf;
+      checkKeyFilePermissions(this.keyFile);
       return this.key;
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
@@ -238,11 +431,14 @@ var DefaultSecretVault = class {
       if (err.code !== "EEXIST") throw err;
       const buf = fs2.readFileSync(this.keyFile);
       if (buf.length !== KEY_BYTES) {
-        throw new Error(
-          `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES}). Remove it manually to generate a new key.`
-        );
+        throw new ConfigError({
+          message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES}). Remove it manually to generate a new key.`,
+          code: ERROR_CODES.CONFIG_INVALID,
+          context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
+        });
       }
       this.key = buf;
+      checkKeyFilePermissions(this.keyFile);
       return this.key;
     }
     this.key = key;
@@ -303,7 +499,7 @@ async function rewriteConfigEncrypted(configPath, vault, patch) {
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions(configPath);
 }
-async function migratePlaintextSecrets(configPath, vault) {
+async function migratePlaintextSecrets(configPath, vault, logger) {
   let raw;
   try {
     raw = await fs.readFile(configPath, "utf8");
@@ -320,11 +516,14 @@ async function migratePlaintextSecrets(configPath, vault) {
   const migrated = walkCount(parsed, vault, counter);
   if (counter.n === 0) return { migrated: 0, file: configPath };
   await atomicWrite(configPath, JSON.stringify(migrated, null, 2), { mode: 384 });
-  await restrictFilePermissions(configPath);
+  await restrictFilePermissions(
+    configPath,
+    logger ? { warn: (msg) => logger.warn(msg) } : void 0
+  );
   return { migrated: counter.n, file: configPath };
 }
 async function restrictFilePermissions(filePath, opts) {
-  const warn = ((msg) => console.warn(msg));
+  const warn = opts?.warn ?? ((msg) => console.warn(msg));
   if (process.platform === "win32") {
     try {
       const { execFile } = await import('child_process');
@@ -376,28 +575,6 @@ function walkCount(node, vault, counter) {
   }
   return out;
 }
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
-function deepMerge(a, b) {
-  const out = { ...a };
-  for (const [k, v] of Object.entries(b)) {
-    if (FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
-}
 
 // src/security/capabilities.ts
 var ToolCapabilities = {
@@ -457,7 +634,9 @@ function getDangerousCapabilities(toolOrCaps) {
 // src/utils/expect-defined.ts
 function expectDefined(value, label) {
   if (value === null || value === void 0) {
-    throw new Error("Expected value to be defined");
+    const err = new Error("Expected value to be defined");
+    err.name = "ExpectDefinedError";
+    throw err;
   }
   return value;
 }