@wrongstack/core 0.257.2 → 0.264.0

package/dist/{secret-vault-gxtFZYBt.d.ts → secret-vault-CxiVLbt1.d.ts}

@@ -1,4 +1,4 @@
-import { S as SecretScrubber } from './permission-CwBBpCoF.js';
+import { S as SecretScrubber } from './permission-4yvGmMRB.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { S as SecretVault } from './secret-vault-BJDY28ev.js';
 

package/dist/security/index.d.ts

@@ -1,7 +1,7 @@
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-gxtFZYBt.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-B8rSu908.js';
-import '../permission-CwBBpCoF.js';
-import '../context-CGdgA0q6.js';
+export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-CxiVLbt1.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-C6XpsBOy.js';
+import '../permission-4yvGmMRB.js';
+import '../context-BGSpZNSE.js';
 import '../logger-B63L5bTg.js';
 import '../secret-vault-BJDY28ev.js';
 import '../input-reader-E-ffP2ee.js';

package/dist/security/index.js

@@ -143,108 +143,6 @@ var DefaultSecretScrubber = class {
     return visit(obj);
   }
 };
-
-// src/types/errors.ts
-var ERROR_CODES = {
-  // Provider
-  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
-  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
-  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
-  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
-  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
-  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
-  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
-  // Tool
-  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
-  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
-  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
-  TOOL_TIMEOUT: "TOOL_TIMEOUT",
-  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
-  // Config
-  CONFIG_INVALID: "CONFIG_INVALID",
-  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
-  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
-  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
-  // Plugin
-  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
-  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
-  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
-  // Agent
-  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
-  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
-  AGENT_ABORTED: "AGENT_ABORTED",
-  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
-  // Session
-  SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
-  SESSION_CORRUPTED: "SESSION_CORRUPTED",
-  SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
-  // Container / Registry
-  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
-  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
-  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
-  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
-  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
-  REGISTRY_INVALID: "REGISTRY_INVALID",
-  // File system
-  FS_READ_FAILED: "FS_READ_FAILED",
-  FS_WRITE_FAILED: "FS_WRITE_FAILED",
-  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
-  FS_DELETE_FAILED: "FS_DELETE_FAILED",
-  FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
-  // SDD (Spec-Driven Development)
-  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
-  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
-  SDD_INVALID_STATE: "SDD_INVALID_STATE",
-  SDD_NOT_READY: "SDD_NOT_READY",
-  // General
-  VALIDATION_ERROR: "VALIDATION_ERROR",
-  UNKNOWN: "UNKNOWN"
-};
-var WrongStackError = class extends Error {
-  code;
-  subsystem;
-  severity;
-  recoverable;
-  context;
-  constructor(opts) {
-    super(opts.message, { cause: opts.cause });
-    this.name = "WrongStackError";
-    this.code = opts.code;
-    this.subsystem = opts.subsystem;
-    this.severity = opts.severity ?? "error";
-    this.recoverable = opts.recoverable ?? false;
-    this.context = opts.context;
-  }
-  /**
-   * Render a one-line user-facing description.
-   * Subclasses should override for domain-specific formatting.
-   */
-  describe() {
-    const ctx = this.context ? ` ${formatContext(this.context)}` : "";
-    return `${this.code}: ${this.message}${ctx}`;
-  }
-};
-function formatContext(ctx) {
-  const parts = Object.entries(ctx).filter(([, v]) => v !== void 0).slice(0, 3).map(([k, v]) => `${k}=${String(v)}`);
-  return parts.length > 0 ? `[${parts.join(" ")}]` : "";
-}
-var ConfigError = class extends WrongStackError {
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "config",
-      severity: "fatal",
-      recoverable: false,
-      context: opts.context,
-      cause: opts.cause
-    });
-    this.name = "ConfigError";
-  }
-};
-
-// src/types/secret-vault.ts
-var ENCRYPTED_PREFIX = "enc:v1:";
 async function atomicWrite(targetPath, content, opts = {}) {
   const dir = path3.dirname(targetPath);
   await fs.mkdir(dir, { recursive: true });
@@ -307,6 +205,112 @@ async function renameWithRetry(from, to) {
   throw lastErr;
 }
 
+// src/utils/error.ts
+function toErrorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// src/utils/safe-json.ts
+function safeParse(input, maxBytes = 5e6) {
+  if (input.length > maxBytes) {
+    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
+  }
+  try {
+    return { ok: true, value: JSON.parse(input) };
+  } catch (err) {
+    return {
+      ok: false,
+      error: toErrorMessage(err)
+    };
+  }
+}
+
+// src/utils/expect-defined.ts
+function expectDefined(value, label) {
+  if (value === null || value === void 0) {
+    const err = new Error("Expected value to be defined");
+    err.name = "ExpectDefinedError";
+    throw err;
+  }
+  return value;
+}
+
+// src/utils/glob-match.ts
+function escapeRegex(s) {
+  return s.replace(/[.+^${}()|\\]/g, "\\$&");
+}
+var COMPILED_GLOB_CACHE = /* @__PURE__ */ new Map();
+var CACHE_MAX_SIZE = 2e3;
+function getCachedGlob(pattern) {
+  const cached = COMPILED_GLOB_CACHE.get(pattern);
+  if (cached) return cached;
+  if (COMPILED_GLOB_CACHE.size >= CACHE_MAX_SIZE) {
+    const keys = [...COMPILED_GLOB_CACHE.keys()];
+    for (let i = 0; i < Math.floor(CACHE_MAX_SIZE / 4); i++) {
+      COMPILED_GLOB_CACHE.delete(expectDefined(keys[i]));
+    }
+  }
+  const re = compileGlob(pattern);
+  COMPILED_GLOB_CACHE.set(pattern, re);
+  return re;
+}
+var MAX_GLOB_PATTERN_LEN = 1024;
+function compileGlob(pattern) {
+  if (pattern.length > MAX_GLOB_PATTERN_LEN) {
+    throw new Error(`Glob pattern exceeds ${MAX_GLOB_PATTERN_LEN} characters`);
+  }
+  let i = 0;
+  let re = "^";
+  while (i < pattern.length) {
+    const c = pattern[i];
+    if (c === "*") {
+      if (pattern[i + 1] === "*") {
+        re += ".*";
+        i += 2;
+        if (pattern[i] === "/") i++;
+      } else {
+        re += "[^/]*";
+        i++;
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+      i++;
+    } else if (c === "[") {
+      let cls = "[";
+      i++;
+      if (pattern[i] === "!" || pattern[i] === "^") {
+        cls += "^";
+        i++;
+      }
+      while (i < pattern.length && pattern[i] !== "]") {
+        const ch = pattern[i] ?? "";
+        if (ch === "\\") {
+          cls += "\\\\";
+        } else if (ch === "]" || ch === "^") {
+          cls += `\\${ch}`;
+        } else {
+          cls += ch;
+        }
+        i++;
+      }
+      cls += "]";
+      re += cls;
+      i++;
+    } else {
+      re += escapeRegex(c ?? "");
+      i++;
+    }
+  }
+  re += "$";
+  return new RegExp(re);
+}
+function matchGlob(pattern, input) {
+  return getCachedGlob(pattern).test(input);
+}
+function matchAny(patterns, input) {
+  return patterns.some((p) => matchGlob(p, input));
+}
+
 // src/utils/deep-merge.ts
 var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
   "__proto__",
@@ -366,6 +370,108 @@ function deepMerge(base, patch, options = {}) {
   return out;
 }
 
+// src/types/errors.ts
+var ERROR_CODES = {
+  // Provider
+  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
+  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
+  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
+  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
+  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
+  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
+  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
+  // Tool
+  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
+  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
+  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
+  TOOL_TIMEOUT: "TOOL_TIMEOUT",
+  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
+  // Config
+  CONFIG_INVALID: "CONFIG_INVALID",
+  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
+  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
+  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
+  // Plugin
+  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
+  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
+  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
+  // Agent
+  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
+  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
+  AGENT_ABORTED: "AGENT_ABORTED",
+  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
+  // Session
+  SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
+  SESSION_CORRUPTED: "SESSION_CORRUPTED",
+  SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
+  // Container / Registry
+  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
+  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
+  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
+  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
+  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
+  REGISTRY_INVALID: "REGISTRY_INVALID",
+  // File system
+  FS_READ_FAILED: "FS_READ_FAILED",
+  FS_WRITE_FAILED: "FS_WRITE_FAILED",
+  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
+  FS_DELETE_FAILED: "FS_DELETE_FAILED",
+  FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
+  // SDD (Spec-Driven Development)
+  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
+  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
+  SDD_INVALID_STATE: "SDD_INVALID_STATE",
+  SDD_NOT_READY: "SDD_NOT_READY",
+  // General
+  VALIDATION_ERROR: "VALIDATION_ERROR",
+  UNKNOWN: "UNKNOWN"
+};
+var WrongStackError = class extends Error {
+  code;
+  subsystem;
+  severity;
+  recoverable;
+  context;
+  constructor(opts) {
+    super(opts.message, { cause: opts.cause });
+    this.name = "WrongStackError";
+    this.code = opts.code;
+    this.subsystem = opts.subsystem;
+    this.severity = opts.severity ?? "error";
+    this.recoverable = opts.recoverable ?? false;
+    this.context = opts.context;
+  }
+  /**
+   * Render a one-line user-facing description.
+   * Subclasses should override for domain-specific formatting.
+   */
+  describe() {
+    const ctx = this.context ? ` ${formatContext(this.context)}` : "";
+    return `${this.code}: ${this.message}${ctx}`;
+  }
+};
+function formatContext(ctx) {
+  const parts = Object.entries(ctx).filter(([, v]) => v !== void 0).slice(0, 3).map(([k, v]) => `${k}=${String(v)}`);
+  return parts.length > 0 ? `[${parts.join(" ")}]` : "";
+}
+var ConfigError = class extends WrongStackError {
+  constructor(opts) {
+    super({
+      message: opts.message,
+      code: opts.code,
+      subsystem: "config",
+      severity: "fatal",
+      recoverable: false,
+      context: opts.context,
+      cause: opts.cause
+    });
+    this.name = "ConfigError";
+  }
+};
+
+// src/types/secret-vault.ts
+var ENCRYPTED_PREFIX = "enc:v1:";
+
 // src/security/secret-vault.ts
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
@@ -664,107 +770,6 @@ function getDangerousCapabilities(toolOrCaps) {
     (c) => DANGEROUS_FOR_SUBAGENTS.includes(c)
   );
 }
-
-// src/utils/expect-defined.ts
-function expectDefined(value, label) {
-  if (value === null || value === void 0) {
-    const err = new Error("Expected value to be defined");
-    err.name = "ExpectDefinedError";
-    throw err;
-  }
-  return value;
-}
-
-// src/utils/glob-match.ts
-function escapeRegex(s) {
-  return s.replace(/[.+^${}()|\\]/g, "\\$&");
-}
-var COMPILED_GLOB_CACHE = /* @__PURE__ */ new Map();
-var CACHE_MAX_SIZE = 2e3;
-function getCachedGlob(pattern) {
-  const cached = COMPILED_GLOB_CACHE.get(pattern);
-  if (cached) return cached;
-  if (COMPILED_GLOB_CACHE.size >= CACHE_MAX_SIZE) {
-    const keys = [...COMPILED_GLOB_CACHE.keys()];
-    for (let i = 0; i < Math.floor(CACHE_MAX_SIZE / 4); i++) {
-      COMPILED_GLOB_CACHE.delete(expectDefined(keys[i]));
-    }
-  }
-  const re = compileGlob(pattern);
-  COMPILED_GLOB_CACHE.set(pattern, re);
-  return re;
-}
-var MAX_GLOB_PATTERN_LEN = 1024;
-function compileGlob(pattern) {
-  if (pattern.length > MAX_GLOB_PATTERN_LEN) {
-    throw new Error(`Glob pattern exceeds ${MAX_GLOB_PATTERN_LEN} characters`);
-  }
-  let i = 0;
-  let re = "^";
-  while (i < pattern.length) {
-    const c = pattern[i];
-    if (c === "*") {
-      if (pattern[i + 1] === "*") {
-        re += ".*";
-        i += 2;
-        if (pattern[i] === "/") i++;
-      } else {
-        re += "[^/]*";
-        i++;
-      }
-    } else if (c === "?") {
-      re += "[^/]";
-      i++;
-    } else if (c === "[") {
-      let cls = "[";
-      i++;
-      if (pattern[i] === "!" || pattern[i] === "^") {
-        cls += "^";
-        i++;
-      }
-      while (i < pattern.length && pattern[i] !== "]") {
-        const ch = pattern[i] ?? "";
-        if (ch === "\\") {
-          cls += "\\\\";
-        } else if (ch === "]" || ch === "^") {
-          cls += `\\${ch}`;
-        } else {
-          cls += ch;
-        }
-        i++;
-      }
-      cls += "]";
-      re += cls;
-      i++;
-    } else {
-      re += escapeRegex(c ?? "");
-      i++;
-    }
-  }
-  re += "$";
-  return new RegExp(re);
-}
-function matchGlob(pattern, input) {
-  return getCachedGlob(pattern).test(input);
-}
-function matchAny(patterns, input) {
-  return patterns.some((p) => matchGlob(p, input));
-}
-
-// src/utils/safe-json.ts
-function safeParse(input, maxBytes = 5e6) {
-  if (input.length > maxBytes) {
-    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
-  }
-  try {
-    return { ok: true, value: JSON.parse(input) };
-  } catch (err) {
-    return {
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
 var DESTRUCTIVE_BASH_PATTERNS = [
   /\bgit\s+(?:clean\s+-[^\s]*[xdf]|reset\s+--hard)\b/i,
   /\b(?:drop|truncate)\s+(?:table|database|schema)\b/i,
@@ -1041,7 +1046,16 @@ var DefaultPermissionPolicy = class {
         };
       }
     }
-    if (tool.permission === "auto" && !tool.mutating) {
+    const hasWriteCap = hasCapability(tool, ToolCapabilities.FS_WRITE);
+    const hasShellCap = hasCapability(tool, [
+      ToolCapabilities.SHELL_ARBITRARY,
+      ToolCapabilities.SHELL_RESTRICTED
+    ]);
+    const hasInstallCap = hasCapability(tool, ToolCapabilities.PACKAGE_INSTALL);
+    const hasConfigCap = hasCapability(tool, ToolCapabilities.CONFIG_MUTATE);
+    const hasSubagentCap = hasCapability(tool, ToolCapabilities.SUBAGENT_SPAWN);
+    const isMutating = tool.mutating || hasWriteCap || hasShellCap || hasInstallCap || hasConfigCap || hasSubagentCap;
+    if (tool.permission === "auto" && !isMutating) {
       const decision = { permission: "auto", source: "default" };
       this._evalCache.set(cacheKey, decision);
       return decision;
@@ -1060,7 +1074,27 @@ var DefaultPermissionPolicy = class {
     }
     return { permission: "confirm", source: "default" };
   }
+  // Capability-based destructive check (preferred over name-based)
+  isDestructiveByCapability(tool) {
+    const caps = tool.capabilities ?? [];
+    if (caps.includes("shell.arbitrary")) return true;
+    if (caps.includes("fs.write")) return true;
+    if (caps.includes("fs.write.outside-project")) return true;
+    return false;
+  }
   isDestructiveYoloCall(tool, input, ctx) {
+    if (this.isDestructiveByCapability(tool)) {
+      if (tool.name === "bash") {
+        const command = getInputString(input, "command");
+        return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : true;
+      }
+      if (tool.name === "write" || tool.name === "edit" || tool.name === "replace" || tool.name === "patch") {
+        const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
+        if (!targetPath || !ctx.projectRoot) return false;
+        return !pathLooksInsideProject(targetPath, ctx.projectRoot);
+      }
+      return true;
+    }
     if (tool.name === "bash") {
       const command = getInputString(input, "command");
       return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : true;