@wrongstack/core 0.255.0 → 0.256.0

package/dist/infrastructure/index.d.ts

@@ -1,9 +1,9 @@
 export { D as DefaultLogger, a as DefaultLoggerOptions, L as LogFormat } from '../logger-DmmQhf4P.js';
-export { D as DefaultPathResolver, a as DefaultTokenCounter } from '../path-resolver-B7VjhUHq.js';
-export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, p as playwrightServer, s as sentinelServer, q as slackServer, z as zaiVisionServer } from '../mcp-servers-DfXxCASH.js';
+export { D as DefaultPathResolver, a as DefaultTokenCounter } from '../path-resolver-CbkT-RMU.js';
+export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, p as playwrightServer, s as sentinelServer, q as slackServer, z as zaiVisionServer } from '../mcp-servers-D8YnLaEp.js';
 import '../logger-B63L5bTg.js';
-import '../brain-BaQsRNka.js';
-import '../context-CLz3z_E8.js';
-import '../config-eSsrto5d.js';
+import '../brain-TjEEwSpw.js';
+import '../context-CGdgA0q6.js';
+import '../config-DuAu23zm.js';
 import '../path-resolver-CPRj4bFY.js';
-import '../compactor-BRfg3QPd.js';
+import '../compactor-C5sT4U7I.js';

package/dist/kernel/index.d.ts

@@ -1,15 +1,15 @@
-export { r as BindOptions, C as Container, D as Decorator, F as Factory, s as Middleware, M as MiddlewareHandler, N as NextFn, P as Pipeline, t as PipelineOptions, T as Token } from '../pipeline-Bxa3wDcy.js';
-export { E as EventBus, n as EventLogger, o as EventMap, a as EventName, L as Listener, w as ScopedEventBus } from '../brain-BaQsRNka.js';
-export { R as RunController, b as RunControllerOptions, T as TOKENS } from '../index-BilZMsOK.js';
-import '../context-CLz3z_E8.js';
-import '../config-eSsrto5d.js';
-import '../compactor-BRfg3QPd.js';
-import '../retry-policy-BVnkbMET.js';
+export { r as BindOptions, C as Container, D as Decorator, F as Factory, s as Middleware, M as MiddlewareHandler, N as NextFn, P as Pipeline, t as PipelineOptions, T as Token } from '../pipeline-JG8XoudC.js';
+export { E as EventBus, n as EventLogger, o as EventMap, a as EventName, L as Listener, w as ScopedEventBus } from '../brain-TjEEwSpw.js';
+export { R as RunController, b as RunControllerOptions, T as TOKENS } from '../index-CC0Mcm05.js';
+import '../context-CGdgA0q6.js';
+import '../config-DuAu23zm.js';
+import '../compactor-C5sT4U7I.js';
+import '../retry-policy-Tg7LXkoK.js';
 import '../input-reader-E-ffP2ee.js';
 import '../logger-B63L5bTg.js';
 import '../mode-CZlO9iU1.js';
 import '../path-resolver-CPRj4bFY.js';
-import '../permission-DbWPbuoA.js';
-import '../provider-runner-C8_e4Lo1.js';
+import '../permission-CwBBpCoF.js';
+import '../provider-runner-hM7EXlLI.js';
 import '../observability-D-HZN_mF.js';
-import '../skill-Bj6Ezqb8.js';
+import '../skill-DGIXCtdv.js';

package/dist/{llm-selector-D22R4AFz.d.ts → llm-selector-CJ4SyAFE.d.ts}

@@ -1,6 +1,6 @@
 import { M as ModeStore, a as ModeConfig, b as Mode } from './mode-CZlO9iU1.js';
-import { P as Provider, M as Message } from './context-CLz3z_E8.js';
-import { M as MessageSelector, S as SelectorResult } from './selector-Cb4_9-hf.js';
+import { P as Provider, M as Message } from './context-CGdgA0q6.js';
+import { M as MessageSelector, S as SelectorResult } from './selector-DWsqVjGf.js';
 
 declare class DefaultModeStore implements ModeStore {
     private activeModeId;

package/dist/{mcp-servers-DfXxCASH.d.ts → mcp-servers-D8YnLaEp.d.ts}

@@ -1,6 +1,6 @@
-import { C as Compactor } from './compactor-BRfg3QPd.js';
-import { M as Message, T as Tool } from './context-CLz3z_E8.js';
-import { c as MCPServerConfig } from './config-eSsrto5d.js';
+import { C as Compactor } from './compactor-C5sT4U7I.js';
+import { M as Message, T as Tool } from './context-CGdgA0q6.js';
+import { c as MCPServerConfig } from './config-DuAu23zm.js';
 
 type ContextManagerAction = 'check' | 'summary' | 'prune' | 'add_note' | 'compact' | 'repair';
 interface ContextManagerInput {

package/dist/models/index.d.ts

@@ -1,9 +1,9 @@
-export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-DpanBg8D.js';
-export { D as DefaultModeStore, L as LLMSelector, a as LLMSelectorOptions, M as ModeLoaderOptions, l as loadProjectModes, b as loadUserModes } from '../llm-selector-D22R4AFz.js';
-import { d as ModelMatrixEntry, P as ProviderConfig } from '../config-eSsrto5d.js';
+export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-ByZCdFuQ.js';
+export { D as DefaultModeStore, L as LLMSelector, a as LLMSelectorOptions, M as ModeLoaderOptions, l as loadProjectModes, b as loadUserModes } from '../llm-selector-CJ4SyAFE.js';
+import { d as ModelMatrixEntry, P as ProviderConfig } from '../config-DuAu23zm.js';
 import '../mode-CZlO9iU1.js';
-import '../context-CLz3z_E8.js';
-import '../selector-Cb4_9-hf.js';
+import '../context-CGdgA0q6.js';
+import '../selector-DWsqVjGf.js';
 
 /**
  * Model Intelligence — knowledge base of model capabilities, strengths,

package/dist/{models-registry-DpanBg8D.d.ts → models-registry-ByZCdFuQ.d.ts}

@@ -1,4 +1,4 @@
-import { M as ModelsRegistry, a as ModelsDevPayload, R as ResolvedProvider, b as ResolvedModel, W as WireFamily } from './config-eSsrto5d.js';
+import { M as ModelsRegistry, a as ModelsDevPayload, R as ResolvedProvider, b as ResolvedModel, W as WireFamily } from './config-DuAu23zm.js';
 
 interface DefaultModelsRegistryOptions {
     cacheFile: string;

package/dist/{multi-agent-coordinator-Bs-M0Mo6.d.ts → multi-agent-coordinator-DqTUEAeC.d.ts}

@@ -1,4 +1,4 @@
-import { S as SubagentConfig, M as MultiAgentCoordinator, c as MultiAgentConfig, d as SubagentRunner, F as FleetBus, e as SpawnResult, T as TaskSpec, a as BridgeMessage, A as AgentBridge, C as CoordinatorStatus, f as TaskResult } from './agent-subagent-runner-DhYLgAJo.js';
+import { S as SubagentConfig, M as MultiAgentCoordinator, c as MultiAgentConfig, d as SubagentRunner, F as FleetBus, e as SpawnResult, T as TaskSpec, a as BridgeMessage, A as AgentBridge, C as CoordinatorStatus, f as TaskResult } from './agent-subagent-runner-US741uBH.js';
 import { EventEmitter } from 'node:events';
 
 /**

package/dist/{null-fleet-bus-CWdU1_cO.d.ts → null-fleet-bus-B5mfTJXT.d.ts}

@@ -1,11 +1,11 @@
-import { d as AgentPhase, A as AgentDefinition, a as DefaultMultiAgentCoordinator, D as DispatchClassifier } from './multi-agent-coordinator-Bs-M0Mo6.js';
-import { F as FleetBus, u as FleetUsage, S as SubagentConfig, v as FleetUsageAggregator, f as TaskResult, C as CoordinatorStatus, T as TaskSpec, c as MultiAgentConfig, d as SubagentRunner } from './agent-subagent-runner-DhYLgAJo.js';
-import { a as SessionWriter, T as Tool, i as SessionStore } from './context-CLz3z_E8.js';
-import { B as BrainArbiter, E as EventBus } from './brain-BaQsRNka.js';
+import { d as AgentPhase, A as AgentDefinition, a as DefaultMultiAgentCoordinator, D as DispatchClassifier } from './multi-agent-coordinator-DqTUEAeC.js';
+import { F as FleetBus, u as FleetUsage, S as SubagentConfig, v as FleetUsageAggregator, f as TaskResult, C as CoordinatorStatus, T as TaskSpec, c as MultiAgentConfig, d as SubagentRunner } from './agent-subagent-runner-US741uBH.js';
+import { a as SessionWriter, T as Tool, i as SessionStore } from './context-CGdgA0q6.js';
+import { B as BrainArbiter, E as EventBus } from './brain-TjEEwSpw.js';
 import { EventEmitter } from 'node:events';
 import { D as DirectorStateSnapshot } from './director-state-BfeCUbmk.js';
-import { d as ModelMatrixEntry } from './config-eSsrto5d.js';
-import { I as InMemoryAgentBridge } from './agent-bridge-l_DsFEbr.js';
+import { d as ModelMatrixEntry } from './config-DuAu23zm.js';
+import { I as InMemoryAgentBridge } from './agent-bridge-BrxWHEOm.js';
 
 /**
  * Alert levels the Director can emit when a collab session needs attention.
@@ -1125,6 +1125,17 @@ declare class Director implements ICoordinator {
      * default cap.
      */
     private taskCompletedListener;
+    /**
+     * Unsub handles for the two `FleetBus.filter()` calls installed in the
+     * constructor for timeout-heartbeat tracking. Without capturing these
+     * and calling them in `shutdown()`, repeated Director construction
+     * (tests, hot reloads, `--director` restarts) accumulates 2 dangling
+     * listeners per Director on the FleetBus, slowly drifting the
+     * EventEmitter past its default cap. Mirrors the rationale on
+     * `taskCompletedListener` above.
+     */
+    private toolExecFilter;
+    private budgetFilter;
     /** Optional LLM classifier for smart dispatch. Passed from options. */
     readonly dispatchClassifier?: DispatchClassifier | undefined;
     /** Leader agent's current context pressure (full request tokens). */

package/dist/observability/index.d.ts

@@ -1,6 +1,6 @@
 import { M as MetricsSink, d as MetricLabels, f as MetricsSnapshot, H as HealthRegistry, a as HealthCheck, A as AggregateHealth, T as Tracer, S as Span } from '../observability-D-HZN_mF.js';
-import { E as EventBus } from '../brain-BaQsRNka.js';
-import '../context-CLz3z_E8.js';
+import { E as EventBus } from '../brain-TjEEwSpw.js';
+import '../context-CGdgA0q6.js';
 
 /**
  * In-memory metrics sink. Suitable for embedded use, tests, and /metrics

package/dist/{package-outdated-watcher-Dz-eNZlQ.d.ts → package-outdated-watcher-BSgR_kK-.d.ts}

@@ -1,6 +1,6 @@
-import { b as Mailbox, c as MailboxSendInput, d as MailboxMessage, e as MailboxQuery, f as MailboxAckInput, g as MailboxAgentStatus, A as AgentRegistrationInput, h as AgentHeartbeatInput, i as ClientRegistrationInput, j as ClientHeartbeatInput, k as ClientStatus } from './pipeline-Bxa3wDcy.js';
-import { E as EventBus, B as BrainArbiter } from './brain-BaQsRNka.js';
-import { C as Context, T as Tool } from './context-CLz3z_E8.js';
+import { b as Mailbox, c as MailboxSendInput, d as MailboxMessage, e as MailboxQuery, f as MailboxAckInput, g as MailboxAgentStatus, A as AgentRegistrationInput, h as AgentHeartbeatInput, i as ClientRegistrationInput, j as ClientHeartbeatInput, k as ClientStatus } from './pipeline-JG8XoudC.js';
+import { E as EventBus, B as BrainArbiter } from './brain-TjEEwSpw.js';
+import { C as Context, T as Tool } from './context-CGdgA0q6.js';
 
 /**
  * DefaultMailbox — append-only JSONL inter-agent mailbox (per-session).

package/dist/{parallel-eternal-engine-CAMabk-X.d.ts → parallel-eternal-engine-C0juOszP.d.ts}

@@ -1,12 +1,12 @@
-import { e as ProviderError, C as Context, T as Tool, l as ToolUseBlock, m as ToolResultBlock } from './context-CLz3z_E8.js';
-import { R as RetryPolicy, E as ErrorHandler, a as RecoveryDecision } from './retry-policy-BVnkbMET.js';
-import { C as Compactor, a as CompactReport } from './compactor-BRfg3QPd.js';
-import { M as ModelsRegistry } from './config-eSsrto5d.js';
-import { T as ToolExecutorOptions, a as ToolExecutorStrategy, b as ToolBatchResult } from './index-Csoc_bKs.js';
-import { g as Agent, h as AgentFactory } from './agent-subagent-runner-DhYLgAJo.js';
-import { B as BrainArbiter } from './brain-BaQsRNka.js';
+import { e as ProviderError, C as Context, T as Tool, l as ToolUseBlock, m as ToolResultBlock } from './context-CGdgA0q6.js';
+import { R as RetryPolicy, E as ErrorHandler, a as RecoveryDecision } from './retry-policy-Tg7LXkoK.js';
+import { C as Compactor, a as CompactReport } from './compactor-C5sT4U7I.js';
+import { M as ModelsRegistry } from './config-DuAu23zm.js';
+import { T as ToolExecutorOptions, a as ToolExecutorStrategy, b as ToolBatchResult } from './index-CitPrI3a.js';
+import { g as Agent, h as AgentFactory } from './agent-subagent-runner-US741uBH.js';
+import { B as BrainArbiter } from './brain-TjEEwSpw.js';
 import { J as JournalEntry } from './goal-store-CV9Yz2X_.js';
-import { D as DispatchClassifier, a as DefaultMultiAgentCoordinator } from './multi-agent-coordinator-Bs-M0Mo6.js';
+import { D as DispatchClassifier, a as DefaultMultiAgentCoordinator } from './multi-agent-coordinator-DqTUEAeC.js';
 
 declare class DefaultRetryPolicy implements RetryPolicy {
     shouldRetry(err: Error | ProviderError, attempt: number): boolean;
@@ -123,14 +123,28 @@ declare class ToolExecutor {
      * invoking the tool — closes the observability gap between "model decided
      * to call a tool" and "tool.executed".
      */
-    executeTool(tool: Tool, use: ToolUseBlock, ctx: Context, budget: number): Promise<ToolResultBlock>;
+    executeTool(tool: Tool, use: ToolUseBlock, ctx: Context, budget: number): Promise<{
+        block: ToolResultBlock;
+        bytes: number;
+    }>;
     private runWithTimeout;
     private runStreamedTool;
     private unknownToolResult;
     private malformedInputResult;
     private deniedResult;
     private blockedByHookResult;
-    private decrementBudget;
+    /**
+     * Subtract a string-content result's UTF-8 byte length from the
+     * iteration output budget. Used for synthesized results (unknown tool,
+     * validation error, blocked, threw) where the content is a small
+     * string built in the executor. The success path no longer goes
+     * through here — `executeTool` carries the exact byte count it spent
+     * in its return value, derived from `enforceCap`'s `newBudget`.
+     *
+     * Floors the result at 0 to match the pre-fix `decrementBudget`
+     * semantics (over-budget spends don't underflow the running total).
+     */
+    private budgetForString;
     /**
      * Compute the suggestedPattern string for a tool+input pair.
      * Matches the logic in DefaultPermissionPolicy so the TUI shows the

package/dist/{path-resolver-B7VjhUHq.d.ts → path-resolver-CbkT-RMU.d.ts}

@@ -1,6 +1,6 @@
-import { E as EventBus } from './brain-BaQsRNka.js';
-import { M as ModelsRegistry, b as ResolvedModel } from './config-eSsrto5d.js';
-import { c as TokenCounter, U as Usage, d as CacheStats } from './context-CLz3z_E8.js';
+import { E as EventBus } from './brain-TjEEwSpw.js';
+import { M as ModelsRegistry, b as ResolvedModel } from './config-DuAu23zm.js';
+import { c as TokenCounter, U as Usage, d as CacheStats } from './context-CGdgA0q6.js';
 import { P as PathResolver } from './path-resolver-CPRj4bFY.js';
 
 /**

package/dist/{permission-DbWPbuoA.d.ts → permission-CwBBpCoF.d.ts}

@@ -1,4 +1,4 @@
-import { T as Tool, C as Context, f as Permission } from './context-CLz3z_E8.js';
+import { T as Tool, C as Context, f as Permission } from './context-CGdgA0q6.js';
 
 interface SecretScrubber {
     scrub(text: string): string;

package/dist/{permission-policy-AOk0LVsV.d.ts → permission-policy-B8rSu908.d.ts}

@@ -1,6 +1,6 @@
-import { T as Tool, C as Context } from './context-CLz3z_E8.js';
+import { T as Tool, C as Context } from './context-CGdgA0q6.js';
 import { I as InputReader } from './input-reader-E-ffP2ee.js';
-import { P as PermissionPolicy, a as PermissionDecision } from './permission-DbWPbuoA.js';
+import { P as PermissionPolicy, a as PermissionDecision } from './permission-CwBBpCoF.js';
 
 interface PermissionPolicyOptions {
     trustFile: string;
@@ -60,6 +60,21 @@ declare class DefaultPermissionPolicy implements PermissionPolicy {
     private promptDelegate?;
     /** Pre-compiled wildcard patterns — rebuilt on reload for O(1) lookup. */
     private wildcardEntries;
+    /**
+     * Evaluate-result cache. Keyed by `tool.name::subject` so repeated calls
+     * with the same tool+input skip namespace matching, subject computation,
+     * pattern matching (matchAny), and YOLO destructive gating.
+     *
+     * Cleared on any state change (reload, trust, deny, yolo toggle) because
+     * the result depends on the full policy state. The write-tool smart-bypass
+     * (step 7 in `evaluate()`) is not cached since `ctx.hasRead()` changes
+     * dynamically within a session.
+     *
+     * LRU eviction is not needed — the cache is cleared on state changes
+     * that are rare (trust file ops, user confirm) and the number of unique
+     * tool+subject pairs per iteration is small (<50).
+     */
+    private _evalCache;
     constructor(opts: PermissionPolicyOptions);
     /**
      * Replace (or clear) the interactive prompt delegate at runtime.
@@ -121,7 +136,29 @@ declare class DefaultPermissionPolicy implements PermissionPolicy {
  * is kept only for backward compatibility with tools that have not yet
  * declared capabilities.
  */
+/**
+ * Auto-approving PermissionPolicy used for subagents. Subagents run
+ * non-interactively under a director — they cannot answer permission
+ * prompts, so a non-YOLO policy on the leader would silently hang the
+ * delegated run on the first sensitive tool call. The user already
+ * authorized the delegation when they invoked the leader; subagents
+ * inherit that authorization automatically.
+ *
+ * Tool defaults of `permission: 'deny'` are still honored (this is a
+ * subagent capability override, not a deny-bypass).
+ *
+ * 2026-06+: Primary decision is now based on declared `Tool.capabilities`
+ * (capability allowlist / denylist model). The legacy name-based DENY set
+ * is kept only for backward compatibility with tools that have not yet
+ * declared capabilities.
+ *
+ * 2026-06-13+: Switched to allowlist-by-default. Only tools with explicitly
+ * allowed capabilities are auto-approved. Everything else is denied.
+ * Default allowed: fs.read, net.outbound (read-only, safe operations).
+ */
 declare class AutoApprovePermissionPolicy implements PermissionPolicy {
+    private readonly allowedCapabilities;
+    constructor(allowedCapabilities?: readonly string[]);
     private static isMcpTool;
     evaluate(tool: Tool): Promise<PermissionDecision>;
     trust(): Promise<void>;

package/dist/{pipeline-Bxa3wDcy.d.ts → pipeline-JG8XoudC.d.ts}

@@ -1,5 +1,5 @@
-import { T as Tool, n as TextBlock, g as ContentBlock } from './context-CLz3z_E8.js';
-import { H as HookEvent, e as HookMatcher, I as InProcessHook, S as ShellHook, f as HookEntry } from './config-eSsrto5d.js';
+import { T as Tool, n as TextBlock, g as ContentBlock } from './context-CGdgA0q6.js';
+import { H as HookEvent, e as HookMatcher, I as InProcessHook, S as ShellHook, f as HookEntry } from './config-DuAu23zm.js';
 
 /**
  * Mailbox — persistent inter-agent messaging system with cross-session support.

package/dist/{plan-templates-D3guWwTi.d.ts → plan-templates-DPiQMkBz.d.ts}

@@ -1,9 +1,9 @@
-import { E as EventBus, M as MemoryScope, k as MemoryEntry, l as MemoryStore, m as MemoryRelevanceContext, S as ScoredEntry } from './brain-BaQsRNka.js';
-import { S as SecretScrubber } from './permission-DbWPbuoA.js';
-import { i as SessionStore, h as SessionMetadata, a as SessionWriter, p as ResumedSession, q as SessionData, r as SessionSummary, g as ContentBlock, S as SessionEvent, s as TodoItem, t as ConversationState } from './context-CLz3z_E8.js';
-import { A as AttachmentStore, a as AddAttachmentInput, b as AttachmentRef, c as Attachment } from './session-reader-CCOssnBS.js';
+import { E as EventBus, M as MemoryScope, k as MemoryEntry, l as MemoryStore, m as MemoryRelevanceContext, S as ScoredEntry } from './brain-TjEEwSpw.js';
+import { S as SecretScrubber } from './permission-CwBBpCoF.js';
+import { i as SessionStore, h as SessionMetadata, a as SessionWriter, p as ResumedSession, q as SessionData, r as SessionSummary, g as ContentBlock, S as SessionEvent, s as TodoItem, t as ConversationState } from './context-CGdgA0q6.js';
+import { A as AttachmentStore, a as AddAttachmentInput, b as AttachmentRef, c as Attachment } from './session-reader-CqRvaL5v.js';
 import { W as WstackPaths } from './wstack-paths-CJjEwPXn.js';
-import { i as ConfigStore, h as Config, j as ConfigLoader, k as SyncConfig } from './config-eSsrto5d.js';
+import { i as ConfigStore, h as Config, j as ConfigLoader, k as SyncConfig } from './config-DuAu23zm.js';
 import { S as SecretVault } from './secret-vault-BJDY28ev.js';
 
 interface SessionStoreOptions {

package/dist/{provider-runner-C8_e4Lo1.d.ts → provider-runner-hM7EXlLI.d.ts}

@@ -1,8 +1,8 @@
-import { E as EventBus } from './brain-BaQsRNka.js';
+import { E as EventBus } from './brain-TjEEwSpw.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { T as Tracer } from './observability-D-HZN_mF.js';
-import { P as Provider, R as Request, C as Context, b as Response } from './context-CLz3z_E8.js';
-import { R as RetryPolicy } from './retry-policy-BVnkbMET.js';
+import { P as Provider, R as Request, C as Context, b as Response } from './context-CGdgA0q6.js';
+import { R as RetryPolicy } from './retry-policy-Tg7LXkoK.js';
 
 /**
  * Options passed to a ProviderRunner when calling the provider.

package/dist/{retry-policy-BVnkbMET.d.ts → retry-policy-Tg7LXkoK.d.ts}

@@ -1,4 +1,4 @@
-import { C as Context, b as Response, e as ProviderError } from './context-CLz3z_E8.js';
+import { C as Context, b as Response, e as ProviderError } from './context-CGdgA0q6.js';
 
 type RecoveryDecision = {
     /**

package/dist/sdd/index.d.ts

@@ -1,15 +1,15 @@
 import { h as Specification, S as SpecAnalysis, g as SpecValidationResult, e as SpecStatus, f as SpecTemplate, b as SpecRequirement } from '../spec-TBi3Jr6T.js';
 import { d as TaskGraph, e as TaskNode, i as TaskFilter, j as TaskSort, c as TaskProgress, T as TaskType, a as TaskPriority } from '../task-graph-u1q9Jkyk.js';
-import { E as EventBus } from '../brain-BaQsRNka.js';
-import { D as DoneCondition, g as Agent, h as AgentFactory, f as TaskResult } from '../agent-subagent-runner-DhYLgAJo.js';
-import '../context-CLz3z_E8.js';
-import '../index-Csoc_bKs.js';
+import { E as EventBus } from '../brain-TjEEwSpw.js';
+import { D as DoneCondition, g as Agent, h as AgentFactory, f as TaskResult } from '../agent-subagent-runner-US741uBH.js';
+import '../context-CGdgA0q6.js';
+import '../index-CitPrI3a.js';
 import '../logger-B63L5bTg.js';
-import '../pipeline-Bxa3wDcy.js';
-import '../config-eSsrto5d.js';
+import '../pipeline-JG8XoudC.js';
+import '../config-DuAu23zm.js';
 import '../observability-D-HZN_mF.js';
-import '../permission-DbWPbuoA.js';
-import '../retry-policy-BVnkbMET.js';
+import '../permission-CwBBpCoF.js';
+import '../retry-policy-Tg7LXkoK.js';
 
 declare class SpecParser {
     parse(content: string): Specification;

package/dist/{secret-vault-CeVNiy_f.d.ts → secret-vault-BkYkJWQs.d.ts}

@@ -1,4 +1,4 @@
-import { S as SecretScrubber } from './permission-DbWPbuoA.js';
+import { S as SecretScrubber } from './permission-CwBBpCoF.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { S as SecretVault } from './secret-vault-BJDY28ev.js';
 

package/dist/security/index.d.ts

@@ -1,7 +1,7 @@
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-CeVNiy_f.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-AOk0LVsV.js';
-import '../permission-DbWPbuoA.js';
-import '../context-CLz3z_E8.js';
+export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-BkYkJWQs.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-B8rSu908.js';
+import '../permission-CwBBpCoF.js';
+import '../context-CGdgA0q6.js';
 import '../logger-B63L5bTg.js';
 import '../secret-vault-BJDY28ev.js';
 import '../input-reader-E-ffP2ee.js';

package/dist/security/index.js

@@ -61,9 +61,28 @@ var PATTERNS = [
   }
 ];
 var SCRUB_CHUNK_BYTES = 64 * 1024;
+function hasCredentialAnchors(text) {
+  return text.includes("-----BEGIN") || // Private keys (most unique → cheap reject)
+  text.includes("sk-") || // Anthropic + OpenAI keys
+  text.includes("sk_") || // Stripe live/test keys
+  text.includes("ghp_") || // GitHub PAT v1
+  text.includes("github_pat_") || // GitHub PAT v2
+  text.includes("eyJ") || // JWT
+  text.includes("AKIA") || // AWS access key
+  text.includes("AIza") || // GCP service key
+  text.includes("xox") || // Slack token (xoxa/xoxb/xoxp/xoxo/xoxs)
+  text.includes("Bearer ") || // Bearer token (space suffix reduces false positives)
+  text.includes("/bot") || // Telegram bot token (URL path pattern)
+  text.includes("_KEY=") || // High-entropy env vars: API_KEY=, SECRET_KEY=, ...
+  text.includes("_TOKEN=") || // ACCESS_TOKEN=, AUTH_TOKEN=, ...
+  text.includes("_SECRET=") || // API_SECRET=, CLIENT_SECRET=, ...
+  text.includes("_PASSWORD=") || // DB_PASSWORD=, ROOT_PASSWORD=, ...
+  text.includes("mongodb://") || text.includes("mongodb+srv://") || text.includes("postgres://") || text.includes("postgresql://") || text.includes("mysql://") || text.includes("redis://");
+}
 var DefaultSecretScrubber = class {
   scrub(text) {
     if (!text) return text;
+    if (!hasCredentialAnchors(text)) return text;
     if (text.length <= SCRUB_CHUNK_BYTES) {
       return this.scrubOne(text);
     }
@@ -81,6 +100,7 @@ var DefaultSecretScrubber = class {
     return out.join("");
   }
   scrubOne(text) {
+    if (!hasCredentialAnchors(text)) return text;
     let out = text;
     for (const p of PATTERNS) {
       out = out.replace(p.regex, (_match, group1, group2) => {
@@ -851,6 +871,21 @@ var DefaultPermissionPolicy = class {
   promptDelegate;
   /** Pre-compiled wildcard patterns — rebuilt on reload for O(1) lookup. */
   wildcardEntries = [];
+  /**
+   * Evaluate-result cache. Keyed by `tool.name::subject` so repeated calls
+   * with the same tool+input skip namespace matching, subject computation,
+   * pattern matching (matchAny), and YOLO destructive gating.
+   *
+   * Cleared on any state change (reload, trust, deny, yolo toggle) because
+   * the result depends on the full policy state. The write-tool smart-bypass
+   * (step 7 in `evaluate()`) is not cached since `ctx.hasRead()` changes
+   * dynamically within a session.
+   *
+   * LRU eviction is not needed — the cache is cleared on state changes
+   * that are rare (trust file ops, user confirm) and the number of unique
+   * tool+subject pairs per iteration is small (<50).
+   */
+  _evalCache = /* @__PURE__ */ new Map();
   constructor(opts) {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
@@ -869,6 +904,7 @@ var DefaultPermissionPolicy = class {
   }
   /** Toggle YOLO (auto-approve) mode at runtime. */
   setYolo(enabled) {
+    if (this.yolo !== enabled) this._evalCache.clear();
     this.yolo = enabled;
   }
   /** Check whether YOLO mode is currently active. */
@@ -877,6 +913,7 @@ var DefaultPermissionPolicy = class {
   }
   /** Toggle the destructive YOLO override at runtime. */
   setYoloDestructive(enabled) {
+    if (this.yoloDestructive !== enabled) this._evalCache.clear();
     this.yoloDestructive = enabled;
   }
   /** Check whether the destructive YOLO override is active. */
@@ -885,6 +922,7 @@ var DefaultPermissionPolicy = class {
   }
   /** Toggle destructive confirmation gate (only meaningful when yolo is active). */
   setConfirmDestructive(enabled) {
+    if (this.confirmDestructive !== enabled) this._evalCache.clear();
     this.confirmDestructive = enabled;
   }
   /** Check whether destructive confirmation gate is active. */
@@ -905,6 +943,7 @@ var DefaultPermissionPolicy = class {
     }
     this.sessionDenied.clear();
     this.sessionAllowed.clear();
+    this._evalCache.clear();
     this.loaded = true;
   }
   async evaluate(tool, input, ctx) {
@@ -912,44 +951,60 @@ var DefaultPermissionPolicy = class {
     const namespaceEntry = this.findNamespaceEntry(tool.name);
     const entry = this.policy[tool.name] ?? namespaceEntry;
     const subject = this.subjectFor(tool.name, input, tool.subjectKey);
-    const subjectKey = `${tool.name}::${subject ?? tool.name}`;
-    if (this.sessionDenied.has(subjectKey)) {
-      return { permission: "deny", source: "deny", reason: "session soft deny (user pressed no)" };
+    const cacheKey = `${tool.name}::${subject ?? tool.name}`;
+    if (tool.name !== "write") {
+      const cached = this._evalCache.get(cacheKey);
+      if (cached !== void 0) return cached;
     }
-    if (this.sessionAllowed.has(subjectKey)) {
-      return {
+    if (this.sessionDenied.has(cacheKey)) {
+      const decision = { permission: "deny", source: "deny", reason: "session soft deny (user pressed no)" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
+    }
+    if (this.sessionAllowed.has(cacheKey)) {
+      const decision = {
         permission: "auto",
         source: "trust",
         reason: "session soft allow (user pressed yes)"
       };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (entry?.deny && subject && matchAny(entry.deny, subject)) {
-      return { permission: "deny", source: "deny", reason: "matched deny pattern" };
+      const decision = { permission: "deny", source: "deny", reason: "matched deny pattern" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (tool.permission === "deny") {
-      return { permission: "deny", source: "default", reason: "tool default deny" };
+      const decision = { permission: "deny", source: "default", reason: "tool default deny" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (entry?.allow && subject && matchAny(entry.allow, subject)) {
-      return { permission: "auto", source: "trust", reason: "matched allow pattern" };
+      const decision = { permission: "auto", source: "trust", reason: "matched allow pattern" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (entry?.auto) {
-      return { permission: "auto", source: "trust" };
+      const decision = { permission: "auto", source: "trust" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (this.yolo) {
       if (this.confirmDestructive) {
         const destructive = this.isDestructiveYoloCall(tool, input, ctx);
         if (destructive) {
           if (this.promptDelegate) {
-            const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
-            if (decision === "always") {
+            const decision2 = await this.promptDelegate(tool, input, subject ?? tool.name);
+            if (decision2 === "always") {
               await this.trust({ tool: tool.name, pattern: subject ?? tool.name });
               return { permission: "auto", source: "user", reason: "destructive yolo always-allowed" };
             }
-            if (decision === "deny") {
+            if (decision2 === "deny") {
               await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
               return { permission: "deny", source: "user", reason: "user denied destructive yolo" };
             }
-            return { permission: decision === "yes" ? "auto" : "deny", source: "user" };
+            return { permission: decision2 === "yes" ? "auto" : "deny", source: "user" };
           }
           return {
             permission: "confirm",
@@ -959,7 +1014,9 @@ var DefaultPermissionPolicy = class {
           };
         }
       }
-      return { permission: "auto", source: "yolo" };
+      const decision = { permission: "auto", source: "yolo" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (tool.name === "write" && subject) {
       if (ctx.hasRead(subject)) {
@@ -971,7 +1028,9 @@ var DefaultPermissionPolicy = class {
       }
     }
     if (tool.permission === "auto" && !tool.mutating) {
-      return { permission: "auto", source: "default" };
+      const decision = { permission: "auto", source: "default" };
+      this._evalCache.set(cacheKey, decision);
+      return decision;
     }
     if (this.promptDelegate) {
       const decision = await this.promptDelegate(tool, input, subject ?? tool.name);
@@ -1004,6 +1063,7 @@ var DefaultPermissionPolicy = class {
     const entry = this.policy[rule.tool] ?? {};
     entry.allow = Array.from(/* @__PURE__ */ new Set([...entry.allow ?? [], rule.pattern]));
     this.policy[rule.tool] = entry;
+    this._evalCache.clear();
     try {
       await atomicWrite(this.trustFile, JSON.stringify(this.policy, null, 2));
     } catch (err) {
@@ -1021,6 +1081,7 @@ var DefaultPermissionPolicy = class {
     const entry = this.policy[rule.tool] ?? {};
     entry.deny = Array.from(/* @__PURE__ */ new Set([...entry.deny ?? [], rule.pattern]));
     this.policy[rule.tool] = entry;
+    this._evalCache.clear();
     try {
       await atomicWrite(this.trustFile, JSON.stringify(this.policy, null, 2));
     } catch (err) {
@@ -1035,10 +1096,12 @@ var DefaultPermissionPolicy = class {
   /** Block this tool+pattern for the rest of this session (no trust file). */
   denyOnce(rule) {
     this.sessionDenied.set(`${rule.tool}::${rule.pattern}`, true);
+    this._evalCache.clear();
   }
   /** Auto-approve this tool+pattern for the rest of this session (no trust file). */
   allowOnce(rule) {
     this.sessionAllowed.set(`${rule.tool}::${rule.pattern}`, true);
+    this._evalCache.clear();
   }
   subjectFor(toolName, input, subjectKey) {
     if (!input || typeof input !== "object") return void 0;
@@ -1074,15 +1137,23 @@ var DefaultPermissionPolicy = class {
   }
 };
 var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
+  allowedCapabilities;
+  constructor(allowedCapabilities) {
+    this.allowedCapabilities = allowedCapabilities ?? [
+      ToolCapabilities.FS_READ,
+      ToolCapabilities.NET_OUTBOUND
+    ];
+  }
   static isMcpTool(name) {
     return name.startsWith("mcp__");
   }
   async evaluate(tool) {
-    const hasDangerousCap = hasDangerousCapabilityForSubagents(tool);
+    const caps = tool.capabilities ?? [];
+    const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
     const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
-    const blocked = tool.permission === "deny" || hasDangerousCap || isMcp;
+    const blocked = tool.permission === "deny" || isMcp || !hasAllowedCap;
     if (blocked) {
-      const reason = hasDangerousCap ? `tool declares dangerous capability (${tool.capabilities?.join(", ")}) \u2014 not auto-approved for subagents` : isMcp ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow it explicitly` : "tool default deny";
+      const reason = isMcp ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow it explicitly` : tool.permission === "deny" ? "tool default deny" : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
       return {
         permission: "deny",
         source: "subagent_guard",