@wrongstack/core 0.260.0 → 0.264.0

package/dist/storage/index.js

@@ -1,9 +1,9 @@
 import { randomBytes, randomUUID, createHash } from 'crypto';
 import * as fsp from 'fs/promises';
-import * as path13 from 'path';
-import 'fs';
+import * as path2 from 'path';
 import * as os from 'os';
 import { hostname } from 'os';
+import 'fs';
 
 // src/utils/expect-defined.ts
 function expectDefined(value, label) {
@@ -15,9 +15,9 @@ function expectDefined(value, label) {
   return value;
 }
 async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path13.dirname(targetPath);
+  const dir = path2.dirname(targetPath);
   await fsp.mkdir(dir, { recursive: true });
-  const tmp = path13.join(dir, `.${path13.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const tmp = path2.join(dir, `.${path2.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
   try {
     if (typeof content === "string") {
       await fsp.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
@@ -35,8 +35,8 @@ async function atomicWrite(targetPath, content, opts = {}) {
     }
     let mode;
     try {
-      const stat5 = await fsp.stat(targetPath);
-      mode = stat5.mode & 511;
+      const stat6 = await fsp.stat(targetPath);
+      mode = stat6.mode & 511;
     } catch {
       mode = opts.mode;
     }
@@ -56,9 +56,9 @@ async function ensureDir(dir) {
   await fsp.mkdir(dir, { recursive: true });
 }
 async function withFileLock(targetPath, fn, opts = {}) {
-  const dir = path13.dirname(targetPath);
+  const dir = path2.dirname(targetPath);
   await fsp.mkdir(dir, { recursive: true });
-  const lockPath = path13.join(dir, `.${path13.basename(targetPath)}.lock`);
+  const lockPath = path2.join(dir, `.${path2.basename(targetPath)}.lock`);
   const timeoutMs = opts.timeoutMs ?? 5e3;
   const staleMs = opts.staleMs ?? 3e4;
   const started = Date.now();
@@ -69,10 +69,15 @@ async function withFileLock(targetPath, fn, opts = {}) {
       await handle.writeFile(`${process.pid}:${Date.now()}`);
       break;
     } catch (err) {
-      if (err.code !== "EEXIST") throw err;
+      const code = err.code;
+      if (code === "ENOENT") {
+        await fsp.mkdir(dir, { recursive: true });
+        continue;
+      }
+      if (code !== "EEXIST") throw err;
       try {
-        const stat5 = await fsp.stat(lockPath);
-        if (Date.now() - stat5.mtimeMs > staleMs) {
+        const stat6 = await fsp.stat(lockPath);
+        if (Date.now() - stat6.mtimeMs > staleMs) {
           await fsp.unlink(lockPath);
           continue;
         }
@@ -214,6 +219,215 @@ function isEmptyMessage(msg) {
   return msg.content.length === 0;
 }
 
+// src/utils/error.ts
+function toErrorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// src/utils/safe-json.ts
+function safeParse(input, maxBytes = 5e6) {
+  if (input.length > maxBytes) {
+    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
+  }
+  try {
+    return { ok: true, value: JSON.parse(input) };
+  } catch (err) {
+    return {
+      ok: false,
+      error: toErrorMessage(err)
+    };
+  }
+}
+
+// src/utils/term.ts
+var hasStdout = () => typeof process !== "undefined" && !!process.stdout;
+function isStdoutTTY() {
+  return hasStdout() && Boolean(process.stdout.isTTY);
+}
+
+// src/utils/color.ts
+var isColorTty = () => {
+  if (envFlag(process.env.NO_COLOR)) return false;
+  if (envFlag(process.env.FORCE_COLOR)) return true;
+  return isStdoutTTY();
+};
+function envFlag(value) {
+  if (value === void 0) return false;
+  if (value.trim() === "") return false;
+  return !/^(0|false|no|off)$/i.test(value.trim());
+}
+var COLOR = isColorTty();
+var wrap = (open6, close) => (s) => COLOR ? `\x1B[${open6}m${s}\x1B[${close}m` : s;
+var color = {
+  reset: wrap("0", "0"),
+  bold: wrap("1", "22"),
+  dim: wrap("2", "22"),
+  italic: wrap("3", "23"),
+  underline: wrap("4", "24"),
+  red: wrap("31", "39"),
+  green: wrap("32", "39"),
+  yellow: wrap("33", "39"),
+  blue: wrap("34", "39"),
+  magenta: wrap("35", "39"),
+  cyan: wrap("36", "39"),
+  gray: wrap("90", "39"),
+  amber: wrap("38;5;214", "39"),
+  pink: wrap("38;5;205", "39"),
+  bgRed: wrap("41", "49"),
+  bgGreen: wrap("42", "49")
+};
+function projectHash(absRoot) {
+  return createHash("sha256").update(path2.resolve(absRoot)).digest("hex").slice(0, 12);
+}
+function projectSlug(absRoot) {
+  const base = slugify(path2.basename(absRoot));
+  const hash = createHash("sha256").update(path2.resolve(absRoot)).digest("hex").slice(0, 6);
+  return `${base}-${hash}`;
+}
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
+}
+function wstackGlobalRoot() {
+  const fromEnv = process.env["WRONGSTACK_HOME"];
+  if (fromEnv && fromEnv.trim().length > 0) return path2.resolve(fromEnv);
+  return path2.join(os.homedir(), ".wrongstack");
+}
+function resolveWstackPaths(opts) {
+  const globalRoot = opts.globalRoot ?? (opts.userHome ? path2.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
+  const hash = projectHash(opts.projectRoot);
+  const slug = projectSlug(opts.projectRoot);
+  const projectDir = path2.join(globalRoot, "projects", slug);
+  return {
+    globalRoot,
+    configDir: globalRoot,
+    globalConfig: path2.join(globalRoot, "config.json"),
+    secretsKey: path2.join(globalRoot, ".key"),
+    globalMemory: path2.join(globalRoot, "memory.md"),
+    globalSkills: path2.join(globalRoot, "skills"),
+    globalPrompts: path2.join(globalRoot, "prompts"),
+    cacheDir: path2.join(globalRoot, "cache"),
+    modelsCache: path2.join(globalRoot, "cache", "models.dev.json"),
+    modelsOverlayCache: path2.join(globalRoot, "cache", "models-overlay.json"),
+    historyFile: path2.join(globalRoot, "history"),
+    logFile: path2.join(globalRoot, "logs", "wrongstack.log"),
+    projectDir,
+    projectCodebaseIndex: path2.join(projectDir, "codebase-index"),
+    projectMemory: path2.join(projectDir, "memory.md"),
+    projectSessions: path2.join(projectDir, "sessions"),
+    projectTrust: path2.join(projectDir, "trust.json"),
+    projectMeta: path2.join(projectDir, "meta.json"),
+    projectLocalConfig: path2.join(projectDir, "config.local.json"),
+    inProjectConfig: path2.join(opts.projectRoot, ".wrongstack", "config.json"),
+    inProjectAgentsFile: path2.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
+    inProjectSkills: path2.join(opts.projectRoot, ".wrongstack", "skills"),
+    inProjectWorktrees: path2.join(opts.projectRoot, ".wrongstack", "worktrees"),
+    projectHash: hash,
+    projectSlug: slug,
+    projectGoal: path2.join(projectDir, "goal.json"),
+    projectSpecs: path2.join(projectDir, "specs"),
+    projectTaskGraphs: path2.join(projectDir, "task-graphs"),
+    projectSddSession: path2.join(projectDir, "sdd-session.json"),
+    projectPlan: path2.join(projectDir, "plan.json"),
+    projectAutophase: path2.join(projectDir, "autophase"),
+    syncConfig: path2.join(globalRoot, "sync.json")
+  };
+}
+
+// src/utils/deep-merge.ts
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
+function isPrimitiveArray(a) {
+  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
+}
+function deepMerge(base, patch, options = {}) {
+  const {
+    conflictResolution = "prefer-patch",
+    arrayMode = "replace",
+    protectProto = true,
+    onNonPrimitiveArrayReplace
+  } = options;
+  if (typeof base !== "object" || base === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (typeof patch !== "object" || patch === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
+      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+    }
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) || Array.isArray(patch)) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  const baseObj = base;
+  const patchObj = patch;
+  const out = { ...baseObj };
+  for (const [k, v] of Object.entries(patchObj)) {
+    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge(existing, v, options);
+    } else if (Array.isArray(v) && Array.isArray(existing)) {
+      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
+        onNonPrimitiveArrayReplace(k, existing.length, v.length);
+      }
+      out[k] = deepMerge(existing, v, options);
+    } else if (v !== void 0) {
+      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
+        const existingLen = Array.isArray(existing) ? existing.length : 0;
+        onNonPrimitiveArrayReplace(k, existingLen, v.length);
+      }
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
+// src/utils/regex-guard.ts
+var MAX_PATTERN_LEN = 512;
+var DANGEROUS_PATTERNS = [
+  /(\([^)]*[+*][^)]*\))[+*]/,
+  // (a+)+, (.*)+, etc
+  /(\(\?:[^)]*[+*][^)]*\))[+*]/
+  // same, with non-capturing group
+];
+function compileUserRegex(pattern, flags) {
+  if (typeof pattern !== "string") {
+    return { ok: false, reason: "pattern must be a string" };
+  }
+  if (pattern.length === 0) {
+    return { ok: false, reason: "pattern is empty" };
+  }
+  if (pattern.length > MAX_PATTERN_LEN) {
+    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
+  }
+  for (const rx of DANGEROUS_PATTERNS) {
+    if (rx.test(pattern)) {
+      return {
+        ok: false,
+        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
+      };
+    }
+  }
+  try {
+    return { ok: true, regex: new RegExp(pattern, flags) };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: err instanceof Error ? err.message : "invalid regex"
+    };
+  }
+}
+
 // src/storage/session-store.ts
 function sanitizeModel(model) {
   return model.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 40);
@@ -270,11 +484,11 @@ var DefaultSessionStore = class _DefaultSessionStore {
   }
   /** Absolute path to the session index file. */
   get indexFile() {
-    return path13.join(this.dir, "_index.jsonl");
+    return path2.join(this.dir, "_index.jsonl");
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
-    return path13.join(this.dir, `${id}${ext}`);
+    return path2.join(this.dir, `${id}${ext}`);
   }
   /**
    * Ensure the directory implied by the session ID exists. When the ID
@@ -282,7 +496,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
    * subdirectory so sessions group naturally by day.
    */
   async ensureShardDir(id) {
-    const dirPath = path13.dirname(path13.join(this.dir, id));
+    const dirPath = path2.dirname(path2.join(this.dir, id));
     await ensureDir(dirPath);
     return dirPath;
   }
@@ -290,15 +504,15 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const id = meta.id && meta.id.length > 0 ? meta.id : generateSessionId(startedAt, meta.model ?? meta.provider);
     const shardDir = await this.ensureShardDir(id);
-    const file = path13.join(shardDir, `${path13.basename(id)}.jsonl`);
+    const file = path2.join(shardDir, `${path2.basename(id)}.jsonl`);
     const t0 = Date.now();
     let handle;
     try {
       handle = await fsp.open(file, "a", 384);
     } catch (err) {
-      this.emitError(id, file, "create", err instanceof Error ? err.message : String(err), false);
+      this.emitError(id, file, "create", toErrorMessage(err), false);
       throw new Error(
-        `Failed to open session file: ${err instanceof Error ? err.message : String(err)}`,
+        `Failed to open session file: ${toErrorMessage(err)}`,
         { cause: err }
       );
     }
@@ -318,7 +532,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         message: e instanceof Error ? e.message : String(e),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })));
-      this.emitError(id, file, "create", err instanceof Error ? err.message : String(err), true);
+      this.emitError(id, file, "create", toErrorMessage(err), true);
       throw err;
     }
   }
@@ -330,9 +544,9 @@ var DefaultSessionStore = class _DefaultSessionStore {
     try {
       handle = await fsp.open(file, "a", 384);
     } catch (err) {
-      this.emitError(id, file, "resume", err instanceof Error ? err.message : String(err), false);
+      this.emitError(id, file, "resume", toErrorMessage(err), false);
       throw new Error(
-        `Failed to open session "${id}" for append: ${err instanceof Error ? err.message : String(err)}`,
+        `Failed to open session "${id}" for append: ${toErrorMessage(err)}`,
         { cause: err }
       );
     }
@@ -352,7 +566,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
           // Shard directory (sessions/<date>/) — must match create() so the
           // .summary.json sidecar lands next to the JSONL instead of the
           // sessions root (where summaryFor() would never find it).
-          dir: path13.dirname(file),
+          dir: path2.dirname(file),
           filePath: file,
           secretScrubber: this.secretScrubber,
           onClose: (s) => this.appendToIndex(s)
@@ -367,7 +581,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         message: e instanceof Error ? e.message : String(e),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })));
-      this.emitError(id, file, "resume", err instanceof Error ? err.message : String(err), true);
+      this.emitError(id, file, "resume", toErrorMessage(err), true);
       throw err;
     }
   }
@@ -395,7 +609,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
       return { metadata: meta, events, messages, usage, toolCallEnds };
     } catch (err) {
       outcome = "failure";
-      errorMsg = err instanceof Error ? err.message : String(err);
+      errorMsg = toErrorMessage(err);
       throw err;
     } finally {
       this.emitRead(id, file, "load", outcome, Date.now() - t0, errorMsg);
@@ -478,7 +692,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
       await fsp.rename(tmp, this.indexFile);
     } catch (err) {
       outcome = "failure";
-      errorMsg = err instanceof Error ? err.message : String(err);
+      errorMsg = toErrorMessage(err);
     } finally {
       this.emitWrite("~compact~", this.indexFile, "compact", outcome, Date.now() - t0, void 0, errorMsg);
     }
@@ -546,7 +760,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         continue;
       if (entry.isDirectory()) {
         const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        ids.push(...await this.collectSessionIds(path13.join(dir, entry.name), childPrefix, depth + 1));
+        ids.push(...await this.collectSessionIds(path2.join(dir, entry.name), childPrefix, depth + 1));
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
         if (entry.name === "_index.jsonl") continue;
         const base = entry.name.replace(/\.jsonl$/, "");
@@ -566,10 +780,10 @@ var DefaultSessionStore = class _DefaultSessionStore {
       return JSON.parse(raw);
     } catch {
       const full = this.sessionPath(id, ".jsonl");
-      const stat5 = await fsp.stat(full);
-      const summary = await this.summarize(id, stat5.mtime.toISOString());
+      const stat6 = await fsp.stat(full);
+      const summary = await this.summarize(id, stat6.mtime.toISOString());
       await atomicWrite(manifest, JSON.stringify(summary), { mode: 384 }).catch((err) => {
-        const msg = err instanceof Error ? err.message : String(err);
+        const msg = toErrorMessage(err);
         this.emitError(id, manifest, "summary_fallback", msg, true);
         console.warn(JSON.stringify({
           level: "warn",
@@ -597,14 +811,14 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async deleteSession(id) {
     const jsonlPath = this.sessionPath(id, ".jsonl");
     const summaryPath = this.sessionPath(id, ".summary.json");
-    const shardDir = path13.dirname(path13.join(this.dir, id));
-    const base = path13.basename(id);
-    const sessDir = path13.join(shardDir, base);
+    const shardDir = path2.dirname(path2.join(this.dir, id));
+    const base = path2.basename(id);
+    const sessDir = path2.join(shardDir, base);
     const deletions = [
       fsp.unlink(jsonlPath),
       fsp.unlink(summaryPath),
-      fsp.unlink(path13.join(shardDir, `${base}.plan.json`)),
-      fsp.unlink(path13.join(shardDir, `${base}.todos.json`))
+      fsp.unlink(path2.join(shardDir, `${base}.plan.json`)),
+      fsp.unlink(path2.join(shardDir, `${base}.todos.json`))
     ];
     const results = await Promise.allSettled(deletions);
     for (const r of results) {
@@ -626,7 +840,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         level: "warn",
         event: "session_store.rmdir_failed",
         sessionId: id,
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
     });
@@ -640,17 +854,17 @@ var DefaultSessionStore = class _DefaultSessionStore {
     let deleted = 0;
     let activeSessionId = null;
     try {
-      const raw = await fsp.readFile(path13.join(this.dir, "active.json"), "utf8");
+      const raw = await fsp.readFile(path2.join(this.dir, "active.json"), "utf8");
       const active = JSON.parse(raw);
       activeSessionId = active.sessionId ?? null;
     } catch {
     }
     const isPrunableJsonl = (name) => name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
     const pruneFile = async (dir, name, prefix) => {
-      const jsonlPath = path13.join(dir, name);
+      const jsonlPath = path2.join(dir, name);
       try {
-        const stat5 = await fsp.stat(jsonlPath);
-        if (stat5.mtimeMs >= cutoff) return;
+        const stat6 = await fsp.stat(jsonlPath);
+        if (stat6.mtimeMs >= cutoff) return;
       } catch {
         return;
       }
@@ -667,7 +881,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         continue;
       }
       if (!entry.isDirectory()) continue;
-      const dateDir = path13.join(this.dir, entry.name);
+      const dateDir = path2.join(this.dir, entry.name);
       const files = await fsp.readdir(dateDir, { withFileTypes: true }).catch(() => []);
       for (const file of files) {
         if (!file.isFile() || !isPrunableJsonl(file.name)) continue;
@@ -679,7 +893,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const dateDir = path13.join(this.dir, entry.name);
+      const dateDir = path2.join(this.dir, entry.name);
       try {
         const remaining = await fsp.readdir(dateDir);
         if (remaining.length === 0) {
@@ -854,7 +1068,7 @@ var FileSessionWriter = class _FileSessionWriter {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path13.join(opts.dir, `${path13.basename(id)}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path2.join(opts.dir, `${path2.basename(id)}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.onCloseCb = opts.onClose;
@@ -1061,7 +1275,7 @@ var FileSessionWriter = class _FileSessionWriter {
       await this.enqueueWrite(batch);
     } catch (err) {
       outcome = "failure";
-      errorMsg = err instanceof Error ? err.message : String(err);
+      errorMsg = toErrorMessage(err);
       this.appendFailCount += eventCount;
       const now = Date.now();
       if (now - this.lastAppendWarnAt > 5e3) {
@@ -1069,7 +1283,7 @@ var FileSessionWriter = class _FileSessionWriter {
         const tail = suppressed > 0 ? ` (+${suppressed} suppressed)` : "";
         console.warn(
           "[session] flush failed:",
-          err instanceof Error ? err.message : String(err),
+          toErrorMessage(err),
           tail
         );
         this.lastAppendWarnAt = now;
@@ -1159,7 +1373,7 @@ var FileSessionWriter = class _FileSessionWriter {
         await atomicWrite(this.manifestFile, JSON.stringify(this.summary), { mode: 384 });
       } catch (err) {
         outcome = "failure";
-        errorMsg = err instanceof Error ? err.message : String(err);
+        errorMsg = toErrorMessage(err);
       } finally {
         this.events?.emit("storage.write", {
           sessionId: this.id,
@@ -1180,7 +1394,7 @@ var FileSessionWriter = class _FileSessionWriter {
       await this.onCloseCb?.(this.summary);
     } catch (err) {
       idxOutcome = "failure";
-      idxError = err instanceof Error ? err.message : String(err);
+      idxError = toErrorMessage(err);
     } finally {
       this.events?.emit("storage.write", {
         sessionId: this.summary.id,
@@ -1355,7 +1569,7 @@ var QueueStore = class {
   events;
   traceId;
   constructor(opts) {
-    this.file = path13.join(opts.dir, "queue.json");
+    this.file = path2.join(opts.dir, "queue.json");
     this.events = opts.events;
     this.traceId = opts.traceId;
   }
@@ -1383,7 +1597,7 @@ var QueueStore = class {
         filePath: this.file,
         operation: "write",
         outcome: "failure",
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         recoverable: false,
         ...this.traceId !== void 0 && { traceId: this.traceId }
       });
@@ -1391,7 +1605,7 @@ var QueueStore = class {
         level: "warn",
         event: "queue_store.write_failed",
         path: this.file,
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
     }
@@ -1421,7 +1635,7 @@ var QueueStore = class {
         filePath: this.file,
         operation: "read",
         outcome: "failure",
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         recoverable: true,
         ...this.traceId !== void 0 && { traceId: this.traceId }
       });
@@ -1429,7 +1643,7 @@ var QueueStore = class {
         level: "warn",
         event: "queue_store.read_failed",
         path: this.file,
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
       return [];
@@ -1500,7 +1714,7 @@ var QueueStore = class {
         filePath: this.file,
         operation: "clear",
         outcome: "failure",
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         recoverable: true,
         ...this.traceId !== void 0 && { traceId: this.traceId }
       });
@@ -1539,7 +1753,7 @@ var DefaultAttachmentStore = class {
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
       await fsp.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path13.join(this.spoolDir, `${id}.bin`);
+      spooledPath = path2.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -1750,7 +1964,7 @@ var FileMemoryBackend = class {
   }
   async remember(scope, entry, filePath) {
     const file = this.resolveFile(filePath, scope);
-    await ensureDir(path13.dirname(file));
+    await ensureDir(path2.dirname(file));
     let existing = "";
     try {
       existing = await fsp.readFile(file, "utf8");
@@ -1978,7 +2192,7 @@ ${body.trim()}`);
           operation: "readAll",
           outcome: "failure",
           durationMs: dur,
-          error: err instanceof Error ? err.message : String(err),
+          error: toErrorMessage(err),
           ...this.traceId !== void 0 && { traceId: this.traceId }
         });
         throw err;
@@ -2011,7 +2225,7 @@ ${body.trim()}`);
         operation: "read",
         outcome: "failure",
         durationMs: dur,
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         ...this.traceId !== void 0 && { traceId: this.traceId }
       });
       throw err;
@@ -2064,7 +2278,7 @@ ${body.trim()}`);
           operation: "remember",
           outcome: "failure",
           durationMs: dur,
-          error: err instanceof Error ? err.message : String(err),
+          error: toErrorMessage(err),
           ...this.traceId !== void 0 && { traceId: this.traceId }
         });
         throw err;
@@ -2220,7 +2434,7 @@ ${body.trim()}`);
           operation: "forget",
           outcome: "failure",
           durationMs: dur,
-          error: err instanceof Error ? err.message : String(err),
+          error: toErrorMessage(err),
           ...this.traceId !== void 0 && { traceId: this.traceId }
         });
         throw err;
@@ -2262,7 +2476,7 @@ ${body.trim()}`);
           operation: "consolidate",
           outcome: "failure",
           durationMs: dur,
-          error: err instanceof Error ? err.message : String(err),
+          error: toErrorMessage(err),
           ...this.traceId !== void 0 && { traceId: this.traceId }
         });
         throw err;
@@ -2302,7 +2516,7 @@ ${body.trim()}`);
             operation: "clear",
             outcome: "failure",
             durationMs: dur,
-            error: err instanceof Error ? err.message : String(err),
+            error: toErrorMessage(err),
             ...this.traceId !== void 0 && { traceId: this.traceId }
           });
           throw err;
@@ -2338,7 +2552,7 @@ ${body.trim()}`);
               operation: "clear",
               outcome: "failure",
               durationMs: dur,
-              error: err instanceof Error ? err.message : String(err),
+              error: toErrorMessage(err),
               ...this.traceId !== void 0 && { traceId: this.traceId }
             });
             throw err;
@@ -2899,7 +3113,7 @@ var DefaultConfigStore = class {
         console.error(JSON.stringify({
           level: "error",
           event: "config_store.watcher_threw",
-          message: err instanceof Error ? err.message : String(err),
+          message: toErrorMessage(err),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         }));
       }
@@ -2923,67 +3137,6 @@ function deepFreeze(obj) {
   }
   return Object.freeze(obj);
 }
-
-// src/utils/deep-merge.ts
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
-function isPrimitiveArray(a) {
-  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
-}
-function deepMerge(base, patch, options = {}) {
-  const {
-    conflictResolution = "prefer-patch",
-    arrayMode = "replace",
-    protectProto = true,
-    onNonPrimitiveArrayReplace
-  } = options;
-  if (typeof base !== "object" || base === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (typeof patch !== "object" || patch === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) && Array.isArray(patch)) {
-    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
-      return [.../* @__PURE__ */ new Set([...base, ...patch])];
-    }
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) || Array.isArray(patch)) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  const baseObj = base;
-  const patchObj = patch;
-  const out = { ...baseObj };
-  for (const [k, v] of Object.entries(patchObj)) {
-    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v, options);
-    } else if (Array.isArray(v) && Array.isArray(existing)) {
-      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
-        onNonPrimitiveArrayReplace(k, existing.length, v.length);
-      }
-      out[k] = deepMerge(existing, v, options);
-    } else if (v !== void 0) {
-      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
-        const existingLen = Array.isArray(existing) ? existing.length : 0;
-        onNonPrimitiveArrayReplace(k, existingLen, v.length);
-      }
-      out[k] = v;
-    }
-  }
-  return out;
-}
-
-// src/security/secret-vault.ts
 function decryptConfigSecrets(cfg, vault, opts) {
   const warn = ((msg) => console.warn(msg));
   return walk(cfg, vault, (v, key) => {
@@ -3074,21 +3227,6 @@ function isContextWindowModeId(id) {
   return CONTEXT_WINDOW_MODES.some((m) => m.id === id);
 }
 
-// src/utils/safe-json.ts
-function safeParse(input, maxBytes = 5e6) {
-  if (input.length > maxBytes) {
-    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
-  }
-  try {
-    return { ok: true, value: JSON.parse(input) };
-  } catch (err) {
-    return {
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-
 // src/types/default-config.ts
 var DEFAULT_TOOLS_CONFIG = Object.freeze({
   defaultExecutionStrategy: "smart",
@@ -3261,7 +3399,7 @@ var DefaultConfigLoader = class {
           level: "warn",
           event: "config.source_load_failed",
           source: src.name,
-          message: err instanceof Error ? err.message : String(err),
+          message: toErrorMessage(err),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         }));
       }
@@ -3398,7 +3536,7 @@ var DefaultConfigLoader = class {
       console.warn(JSON.stringify({
         level: "warn",
         event: "config.sync_load_failed",
-        message: err instanceof Error ? err.message : String(err),
+        message: toErrorMessage(err),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       }));
       return null;
@@ -3425,7 +3563,7 @@ var DefaultConfigLoader = class {
           level: "warn",
           event: "config.read_failed",
           path: file,
-          message: err instanceof Error ? err.message : String(err),
+          message: toErrorMessage(err),
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         }));
       }
@@ -3576,7 +3714,7 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path13.join(opts.dir, LOCK_FILE);
+    this.file = path2.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
     this.hostname = opts.hostname ?? os.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
@@ -3637,7 +3775,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path13.dirname(this.file));
+    await ensureDir(path2.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -3704,42 +3842,6 @@ function defaultIsPidAlive(pid) {
   }
 }
 
-// src/utils/regex-guard.ts
-var MAX_PATTERN_LEN = 512;
-var DANGEROUS_PATTERNS = [
-  /(\([^)]*[+*][^)]*\))[+*]/,
-  // (a+)+, (.*)+, etc
-  /(\(\?:[^)]*[+*][^)]*\))[+*]/
-  // same, with non-capturing group
-];
-function compileUserRegex(pattern, flags) {
-  if (typeof pattern !== "string") {
-    return { ok: false, reason: "pattern must be a string" };
-  }
-  if (pattern.length === 0) {
-    return { ok: false, reason: "pattern is empty" };
-  }
-  if (pattern.length > MAX_PATTERN_LEN) {
-    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
-  }
-  for (const rx of DANGEROUS_PATTERNS) {
-    if (rx.test(pattern)) {
-      return {
-        ok: false,
-        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
-      };
-    }
-  }
-  try {
-    return { ok: true, regex: new RegExp(pattern, flags) };
-  } catch (err) {
-    return {
-      ok: false,
-      reason: err instanceof Error ? err.message : "invalid regex"
-    };
-  }
-}
-
 // src/storage/session-reader.ts
 var DefaultSessionReader = class {
   store;
@@ -4019,9 +4121,9 @@ function sessionScopedPath(dir, sessionId, suffix) {
   if (!sessionId || sessionId.includes("\\") || sessionId.includes("..")) {
     throw invalid(sessionId);
   }
-  const resolved = path13.resolve(dir, `${sessionId}${suffix}`);
-  const rel = path13.relative(path13.resolve(dir), resolved);
-  if (rel.startsWith("..") || path13.isAbsolute(rel)) {
+  const resolved = path2.resolve(dir, `${sessionId}${suffix}`);
+  const rel = path2.relative(path2.resolve(dir), resolved);
+  if (rel.startsWith("..") || path2.isAbsolute(rel)) {
     throw invalid(sessionId);
   }
   return resolved;
@@ -4083,7 +4185,7 @@ var AnnotationsStore = class {
         operation: "list",
         outcome: "failure",
         durationMs: Date.now() - t0,
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
       });
       return [];
@@ -4188,7 +4290,7 @@ var AnnotationsStore = class {
         filePath: fp,
         operation: "add",
         outcome: "failure",
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         recoverable: false,
         durationMs: Date.now() - t0,
         ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
@@ -4244,7 +4346,7 @@ var AnnotationsStore = class {
         filePath: fp,
         operation: "resolve",
         outcome: "failure",
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         recoverable: false,
         durationMs: Date.now() - t0,
         ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
@@ -4364,22 +4466,40 @@ var ReplayLogStore = class {
     const t0 = Date.now();
     try {
       await this.enqueue(input.sessionId, async () => {
-        await withFileLock(this.filePath(input.sessionId), async () => {
-          const entries = await this.readAll(input.sessionId);
-          if (entries.some((entry2) => entry2.hash === hash)) return;
+        await withFileLock(fp, async () => {
+          const cache = await this.ensureCache(input.sessionId);
+          if (cache.has(hash)) return;
           const entry = {
             hash,
             ts: (/* @__PURE__ */ new Date()).toISOString(),
             request: input.request,
             response: input.response
           };
-          entries.push(entry);
-          const keep = entries.slice(-this.maxEntries);
-          const didEvict = keep.length < entries.length;
-          const cache = /* @__PURE__ */ new Map();
-          for (const e of keep) cache.set(e.hash, e);
-          this.cache.set(input.sessionId, cache);
-          await this.writeAll(input.sessionId, keep, didEvict ? "compact" : "record");
+          const currentCount = this.diskCount.get(input.sessionId) ?? 0;
+          const willEvict = currentCount + 1 > this.maxEntries;
+          if (!willEvict) {
+            await fsp.appendFile(fp, JSON.stringify(entry) + "\n", "utf8");
+            cache.set(hash, entry);
+            this.diskCount.set(input.sessionId, currentCount + 1);
+            this.events?.emit("storage.write", {
+              sessionId: input.sessionId,
+              store: "replay",
+              filePath: fp,
+              operation: "record",
+              outcome: "success",
+              durationMs: Date.now() - t0,
+              ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+            });
+            return;
+          }
+          const all = await this.readAll(input.sessionId);
+          all.push(entry);
+          const keep = all.slice(-this.maxEntries);
+          const refreshed = /* @__PURE__ */ new Map();
+          for (const e of keep) refreshed.set(e.hash, e);
+          this.cache.set(input.sessionId, refreshed);
+          this.diskCount.set(input.sessionId, keep.length);
+          await this.writeAll(input.sessionId, keep, "compact");
         });
       });
       return hash;
@@ -4482,7 +4602,7 @@ var ReplayLogStore = class {
             level: "warn",
             event: "replay_log_store.list_readdir_failed",
             dir,
-            message: err instanceof Error ? err.message : String(err),
+            message: toErrorMessage(err),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           }));
         }
@@ -4491,7 +4611,7 @@ var ReplayLogStore = class {
       for (const entry of entries) {
         if (entry.name.startsWith(".")) continue;
         if (entry.isDirectory()) {
-          if (depth === 0) await scan(path13.join(dir, entry.name), entry.name, depth + 1);
+          if (depth === 0) await scan(path2.join(dir, entry.name), entry.name, depth + 1);
           continue;
         }
         if (!entry.isFile() || !entry.name.endsWith(".replay.jsonl")) continue;
@@ -4501,7 +4621,7 @@ var ReplayLogStore = class {
         out.push({
           sessionId,
           entryCount: all.length,
-          path: path13.join(dir, entry.name)
+          path: path2.join(dir, entry.name)
         });
       }
     };
@@ -4590,15 +4710,15 @@ var SessionRecovery = class {
   async detectStale(sessionId) {
     const fp = this.filePath(sessionId);
     const TAIL_SIZE = 8192;
-    let stat5;
+    let stat6;
     try {
-      stat5 = await fsp.stat(fp);
+      stat6 = await fsp.stat(fp);
     } catch (err) {
       if (err.code === "ENOENT") return null;
       return null;
     }
-    if (stat5.size === 0) return null;
-    const position = Math.max(0, stat5.size - TAIL_SIZE);
+    if (stat6.size === 0) return null;
+    const position = Math.max(0, stat6.size - TAIL_SIZE);
     const buf = Buffer.alloc(TAIL_SIZE);
     let fh;
     try {
@@ -4702,7 +4822,7 @@ var SessionRecovery = class {
           continue;
         if (entry.isDirectory()) {
           if (depth === 0) {
-            await collect(path13.join(dir, entry.name), entry.name, depth + 1);
+            await collect(path2.join(dir, entry.name), entry.name, depth + 1);
           }
           continue;
         }
@@ -4734,6 +4854,13 @@ var ToolAuditLog = class {
   tailHash = /* @__PURE__ */ new Map();
   /** In-memory counter for entry indices — avoids re-reading the file on every write. */
   tailIndex = /* @__PURE__ */ new Map();
+  /**
+   * File mtime+size recorded after our last write, per session. Used to
+   * detect cross-process writes (session handoff, recovery) that would
+   * invalidate the in-memory tail cache: if the stat no longer matches
+   * we re-read the file to re-establish the chain tip before appending.
+   */
+  tailStat = /* @__PURE__ */ new Map();
   /** Tracks writes since last fsync, per session. */
   unSyncedWrites = /* @__PURE__ */ new Map();
   writeChains = /* @__PURE__ */ new Map();
@@ -4757,10 +4884,9 @@ var ToolAuditLog = class {
     try {
       await this.enqueue(input.sessionId, async () => {
         await withFileLock(fp, async () => {
-          const entries = await this.readAll(input.sessionId);
-          const prev = entries.at(-1);
-          const prevHash = prev?.hash ?? GENESIS_PREV;
-          const index = prev ? prev.index + 1 : 0;
+          const tip = await this._resolveChainTip(input.sessionId, fp);
+          const prevHash = tip.prevHash;
+          const index = tip.nextIndex;
           const id = randomUUID();
           const ts = (/* @__PURE__ */ new Date()).toISOString();
           const content = {
@@ -4787,10 +4913,15 @@ var ToolAuditLog = class {
             isError: input.isError,
             index
           };
-          entries.push(entry);
-          await this.writeAll(input.sessionId, entries);
+          await fsp.appendFile(fp, JSON.stringify(entry) + "\n", "utf8");
+          try {
+            const st = await fsp.stat(fp);
+            this.tailStat.set(input.sessionId, { mtimeMs: st.mtimeMs, size: st.size });
+          } catch {
+          }
           this.tailHash.set(input.sessionId, hash);
           this.tailIndex.set(input.sessionId, index + 1);
+          await this._trackUnsynced(input.sessionId, fp);
           const durationMs = Date.now() - t0;
           this.events?.emit("storage.write", {
             sessionId: input.sessionId,
@@ -4811,7 +4942,7 @@ var ToolAuditLog = class {
         filePath: fp,
         operation: "record",
         outcome: "failure",
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         recoverable: false,
         durationMs: Date.now() - t0,
         ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
@@ -4819,6 +4950,45 @@ var ToolAuditLog = class {
       throw err;
     }
   }
+  /**
+   * Resolve the chain tip (previous hash + next index) for an append.
+   * Uses the in-memory `tailHash`/`tailIndex` cache when the file's
+   * stat matches our last known write; falls back to a full read on
+   * cache miss or when an external writer has extended the file.
+   */
+  async _resolveChainTip(sessionId, fp) {
+    const cachedHash = this.tailHash.get(sessionId);
+    const cachedIndex = this.tailIndex.get(sessionId);
+    const cachedStat = this.tailStat.get(sessionId);
+    if (cachedHash !== void 0 && cachedIndex !== void 0 && cachedStat) {
+      try {
+        const st = await fsp.stat(fp);
+        if (st.mtimeMs === cachedStat.mtimeMs && st.size === cachedStat.size) {
+          return { prevHash: cachedHash, nextIndex: cachedIndex };
+        }
+      } catch (err) {
+        if (err.code === "ENOENT") {
+          this.tailHash.delete(sessionId);
+          this.tailIndex.delete(sessionId);
+          this.tailStat.delete(sessionId);
+          return { prevHash: GENESIS_PREV, nextIndex: 0 };
+        }
+        throw err;
+      }
+    }
+    const entries = await this.readAll(sessionId);
+    const prev = entries.at(-1);
+    const prevHash = prev?.hash ?? GENESIS_PREV;
+    const nextIndex = prev ? prev.index + 1 : 0;
+    this.tailHash.set(sessionId, prevHash);
+    this.tailIndex.set(sessionId, nextIndex);
+    try {
+      const st = await fsp.stat(fp);
+      this.tailStat.set(sessionId, { mtimeMs: st.mtimeMs, size: st.size });
+    } catch {
+    }
+    return { prevHash, nextIndex };
+  }
   /**
    * Walk the chain and verify every entry's hash and prevHash.
    * Returns a structured verdict — never throws.
@@ -4837,7 +5007,7 @@ var ToolAuditLog = class {
         operation: "verify",
         outcome: "failure",
         durationMs: Date.now() - t0,
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
       });
       return { ok: true, entries: 0 };
@@ -4921,7 +5091,7 @@ var ToolAuditLog = class {
         operation: "load",
         outcome: "failure",
         durationMs,
-        error: err instanceof Error ? err.message : String(err),
+        error: toErrorMessage(err),
         ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
       });
       throw err;
@@ -4950,10 +5120,12 @@ var ToolAuditLog = class {
       throw err;
     }
   }
-  async writeAll(sessionId, entries) {
-    const fp = this.filePath(sessionId);
-    const line = entries.map((e) => JSON.stringify(e)).join("\n") + (entries.length ? "\n" : "");
-    await atomicWrite(fp, line, { mode: 384 });
+  /**
+   * Tracks writes since last fsync and triggers periodic fsync.
+   * Called after each O(1) append to maintain the same durability
+   * guarantees as the old writeAll approach.
+   */
+  async _trackUnsynced(sessionId, fp) {
     const count = (this.unSyncedWrites.get(sessionId) ?? 0) + 1;
     this.unSyncedWrites.set(sessionId, count);
     if (this.fsyncEvery !== Number.POSITIVE_INFINITY && count % this.fsyncEvery === 0) {
@@ -5122,7 +5294,7 @@ var SessionRegistry = class {
   heartbeatTimer = null;
   currentSessionId = null;
   constructor(globalRoot) {
-    this.filePath = path13.join(globalRoot, REGISTRY_FILE);
+    this.filePath = path2.join(globalRoot, REGISTRY_FILE);
   }
   // ── Public API ──────────────────────────────────────────────────────────
   /**
@@ -5289,7 +5461,7 @@ var SessionRegistry = class {
     const retryDelayMs = 20;
     for (let attempt = 0; attempt < maxRetries; attempt++) {
       try {
-        await fsp.mkdir(path13.dirname(this.filePath), { recursive: true });
+        await fsp.mkdir(path2.dirname(this.filePath), { recursive: true });
         const lockHandle = await fsp.open(lockPath, "wx").catch(() => null);
         if (!lockHandle) {
           await new Promise((r) => setTimeout(r, retryDelayMs * (attempt + 1)));
@@ -5502,7 +5674,7 @@ var DefaultSessionRewinder = class {
   sessionsDir;
   projectRoot;
   async listCheckpoints(sessionId) {
-    const file = path13.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path2.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     const fileCountMap = /* @__PURE__ */ new Map();
@@ -5527,7 +5699,7 @@ var DefaultSessionRewinder = class {
     return checkpoints;
   }
   async rewindToCheckpoint(sessionId, checkpointIndex) {
-    const file = path13.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path2.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     let targetIdx = -1;
@@ -5566,7 +5738,7 @@ var DefaultSessionRewinder = class {
     return { ...result, toPromptIndex: checkpointIndex, removedEvents };
   }
   async rewindLastN(sessionId, n) {
-    const file = path13.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path2.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     const checkpoints = [];
@@ -5595,7 +5767,7 @@ var DefaultSessionRewinder = class {
     return { ...result, toPromptIndex: targetIndex, removedEvents: snapshotsToRevert.length };
   }
   async rewindToStart(sessionId) {
-    const file = path13.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path2.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     const allSnapshots = [];
@@ -5631,10 +5803,10 @@ async function revertSnapshots(snapshots, projectRoot) {
   for (const snapshot of snapshots) {
     for (const file of snapshot.files) {
       try {
-        const absPath = path13.resolve(file.path);
-        const root = path13.resolve(projectRoot);
-        const rel = path13.relative(root, absPath);
-        if (rel.startsWith("..") || path13.isAbsolute(rel)) {
+        const absPath = path2.resolve(file.path);
+        const root = path2.resolve(projectRoot);
+        const rel = path2.relative(root, absPath);
+        if (rel.startsWith("..") || path2.isAbsolute(rel)) {
           errors.push(`${file.path}: path resolves outside project root \u2014 skipping`);
           continue;
         }
@@ -5653,7 +5825,7 @@ async function revertSnapshots(snapshots, projectRoot) {
           }
         }
       } catch (err) {
-        errors.push(`${file.path}: ${err instanceof Error ? err.message : String(err)}`);
+        errors.push(`${file.path}: ${toErrorMessage(err)}`);
       }
     }
   }
@@ -5671,7 +5843,7 @@ async function loadTodosCheckpoint(filePath, events, traceId) {
       filePath,
       operation: "load",
       outcome: "failure",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: true
     });
     return null;
@@ -5743,13 +5915,13 @@ async function saveTodosCheckpoint(filePath, sessionId, todos, events, traceId)
       filePath,
       operation: "save",
       outcome: "failure",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: false
     });
     console.warn(JSON.stringify({
       level: "warn",
       event: "todos_checkpoint.save_failed",
-      message: err instanceof Error ? err.message : String(err),
+      message: toErrorMessage(err),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     }));
   }
@@ -5760,7 +5932,7 @@ function attachTodosCheckpoint(state, filePath, sessionId, events, traceId) {
   let writeChain = Promise.resolve();
   const enqueueWrite = (todos) => {
     writeChain = writeChain.then(() => saveTodosCheckpoint(filePath, sessionId, todos, events, traceId)).catch((err) => {
-      const msg = err instanceof Error ? err.message : String(err);
+      const msg = toErrorMessage(err);
       console.error(JSON.stringify({
         level: "error",
         event: "todos_checkpoint.write_chain_failed",
@@ -5809,7 +5981,7 @@ async function loadPlan(filePath, events) {
       store: "plan",
       filePath,
       operation: "load",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: true
     });
     return null;
@@ -5868,12 +6040,12 @@ async function savePlan(filePath, plan, events) {
       store: "plan",
       filePath,
       operation: "save",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: false
     });
     console.warn(
       "[plan-store] save failed:",
-      err instanceof Error ? err.message : String(err)
+      toErrorMessage(err)
     );
   }
 }
@@ -6116,7 +6288,7 @@ async function loadTasks(filePath, events, traceId) {
       filePath,
       operation: "load",
       outcome: "failure",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: true
     });
     return null;
@@ -6181,13 +6353,13 @@ async function saveTasks(filePath, tasks, events, traceId) {
       filePath,
       operation: "save",
       outcome: "failure",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: false,
       ...traceId !== void 0 && { traceId }
     });
     console.warn(
       "[task-store] save failed:",
-      err instanceof Error ? err.message : String(err)
+      toErrorMessage(err)
     );
   }
 }
@@ -6366,7 +6538,7 @@ var DirectorStateCheckpoint = class {
     } catch (err) {
       console.warn(
         "[director-state] checkpoint write failed:",
-        err instanceof Error ? err.message : String(err)
+        toErrorMessage(err)
       );
     } finally {
       this.writing = false;
@@ -6377,102 +6549,6 @@ var DirectorStateCheckpoint = class {
     }
   }
 };
-
-// src/utils/term.ts
-var hasStdout = () => typeof process !== "undefined" && !!process.stdout;
-function isStdoutTTY() {
-  return hasStdout() && Boolean(process.stdout.isTTY);
-}
-
-// src/utils/color.ts
-var isColorTty = () => {
-  if (envFlag(process.env.NO_COLOR)) return false;
-  if (envFlag(process.env.FORCE_COLOR)) return true;
-  return isStdoutTTY();
-};
-function envFlag(value) {
-  if (value === void 0) return false;
-  if (value.trim() === "") return false;
-  return !/^(0|false|no|off)$/i.test(value.trim());
-}
-var COLOR = isColorTty();
-var wrap = (open6, close) => (s) => COLOR ? `\x1B[${open6}m${s}\x1B[${close}m` : s;
-var color = {
-  reset: wrap("0", "0"),
-  bold: wrap("1", "22"),
-  dim: wrap("2", "22"),
-  italic: wrap("3", "23"),
-  underline: wrap("4", "24"),
-  red: wrap("31", "39"),
-  green: wrap("32", "39"),
-  yellow: wrap("33", "39"),
-  blue: wrap("34", "39"),
-  magenta: wrap("35", "39"),
-  cyan: wrap("36", "39"),
-  gray: wrap("90", "39"),
-  amber: wrap("38;5;214", "39"),
-  pink: wrap("38;5;205", "39"),
-  bgRed: wrap("41", "49"),
-  bgGreen: wrap("42", "49")
-};
-function projectHash(absRoot) {
-  return createHash("sha256").update(path13.resolve(absRoot)).digest("hex").slice(0, 12);
-}
-function projectSlug(absRoot) {
-  const base = slugify(path13.basename(absRoot));
-  const hash = createHash("sha256").update(path13.resolve(absRoot)).digest("hex").slice(0, 6);
-  return `${base}-${hash}`;
-}
-function slugify(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
-}
-function wstackGlobalRoot() {
-  const fromEnv = process.env["WRONGSTACK_HOME"];
-  if (fromEnv && fromEnv.trim().length > 0) return path13.resolve(fromEnv);
-  return path13.join(os.homedir(), ".wrongstack");
-}
-function resolveWstackPaths(opts) {
-  const globalRoot = opts.globalRoot ?? (opts.userHome ? path13.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
-  const hash = projectHash(opts.projectRoot);
-  const slug = projectSlug(opts.projectRoot);
-  const projectDir = path13.join(globalRoot, "projects", slug);
-  return {
-    globalRoot,
-    configDir: globalRoot,
-    globalConfig: path13.join(globalRoot, "config.json"),
-    secretsKey: path13.join(globalRoot, ".key"),
-    globalMemory: path13.join(globalRoot, "memory.md"),
-    globalSkills: path13.join(globalRoot, "skills"),
-    globalPrompts: path13.join(globalRoot, "prompts"),
-    cacheDir: path13.join(globalRoot, "cache"),
-    modelsCache: path13.join(globalRoot, "cache", "models.dev.json"),
-    modelsOverlayCache: path13.join(globalRoot, "cache", "models-overlay.json"),
-    historyFile: path13.join(globalRoot, "history"),
-    logFile: path13.join(globalRoot, "logs", "wrongstack.log"),
-    projectDir,
-    projectCodebaseIndex: path13.join(projectDir, "codebase-index"),
-    projectMemory: path13.join(projectDir, "memory.md"),
-    projectSessions: path13.join(projectDir, "sessions"),
-    projectTrust: path13.join(projectDir, "trust.json"),
-    projectMeta: path13.join(projectDir, "meta.json"),
-    projectLocalConfig: path13.join(projectDir, "config.local.json"),
-    inProjectConfig: path13.join(opts.projectRoot, ".wrongstack", "config.json"),
-    inProjectAgentsFile: path13.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
-    inProjectSkills: path13.join(opts.projectRoot, ".wrongstack", "skills"),
-    inProjectWorktrees: path13.join(opts.projectRoot, ".wrongstack", "worktrees"),
-    projectHash: hash,
-    projectSlug: slug,
-    projectGoal: path13.join(projectDir, "goal.json"),
-    projectSpecs: path13.join(projectDir, "specs"),
-    projectTaskGraphs: path13.join(projectDir, "task-graphs"),
-    projectSddSession: path13.join(projectDir, "sdd-session.json"),
-    projectPlan: path13.join(projectDir, "plan.json"),
-    projectAutophase: path13.join(projectDir, "autophase"),
-    syncConfig: path13.join(globalRoot, "sync.json")
-  };
-}
-
-// src/storage/goal-store.ts
 var MAX_JOURNAL_ENTRIES = 500;
 function goalFilePath(projectRoot) {
   return resolveWstackPaths({ projectRoot }).projectGoal;
@@ -6500,7 +6576,7 @@ async function loadGoal(filePath, events) {
       store: "goal",
       filePath,
       operation: "load",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: false
     });
     throw err;
@@ -6573,11 +6649,11 @@ async function saveGoal(filePath, goal, events) {
       store: "goal",
       filePath,
       operation: "save",
-      error: err instanceof Error ? err.message : String(err),
+      error: toErrorMessage(err),
       recoverable: false
     });
     throw new FsError({
-      message: err instanceof Error ? err.message : String(err),
+      message: toErrorMessage(err),
       code: ERROR_CODES.FS_ATOMIC_WRITE_FAILED,
       path: filePath,
       cause: err
@@ -6739,7 +6815,7 @@ var DefaultPromptStore = class {
         if (!file.endsWith(".json")) continue;
         try {
           const raw = JSON.parse(
-            await fsp.readFile(path13.join(this.dir, file), "utf8")
+            await fsp.readFile(path2.join(this.dir, file), "utf8")
           );
           entries.push(raw.entry);
         } catch {
@@ -6752,7 +6828,7 @@ var DefaultPromptStore = class {
     );
   }
   async get(id) {
-    const file = path13.join(this.dir, `${id}.json`);
+    const file = path2.join(this.dir, `${id}.json`);
     try {
       const raw = JSON.parse(await fsp.readFile(file, "utf8"));
       return raw.entry;
@@ -6762,12 +6838,12 @@ var DefaultPromptStore = class {
   }
   async save(entry) {
     await ensureDir(this.dir);
-    const file = path13.join(this.dir, `${entry.id}.json`);
+    const file = path2.join(this.dir, `${entry.id}.json`);
     const raw = { version: 1, entry };
     await atomicWrite(file, JSON.stringify(raw, null, 2));
   }
   async delete(id) {
-    const file = path13.join(this.dir, `${id}.json`);
+    const file = path2.join(this.dir, `${id}.json`);
     try {
       await fsp.unlink(file);
       return true;
@@ -6801,7 +6877,7 @@ var CloudSync = class {
     this.paths = paths;
     this.getConfig = getConfig;
     this.setConfig = setConfig;
-    this.statePath = path13.join(paths.globalRoot, "sync-state.json");
+    this.statePath = path2.join(paths.globalRoot, "sync-state.json");
   }
   paths;
   getConfig;
@@ -6908,7 +6984,7 @@ var CloudSync = class {
       const rel = segments.slice(2).join("/");
       const destPath = resolvePulledCategoryPath(cat, localPath, rel, entry.path);
       const blobData = await this.getBlob(token, owner, repoName, entry.sha);
-      await fsp.mkdir(path13.dirname(destPath), { recursive: true });
+      await fsp.mkdir(path2.dirname(destPath), { recursive: true });
       await fsp.writeFile(destPath, Buffer.from(blobData, "base64"));
     }
     const localRev = await this.hashLocalCategories(cfg.categories);
@@ -7015,12 +7091,12 @@ var CloudSync = class {
       const localPath = this.categoryToPath(cat);
       if (!localPath) continue;
       try {
-        const stat5 = await fsp.stat(localPath);
-        if (stat5.isDirectory()) {
+        const stat6 = await fsp.stat(localPath);
+        if (stat6.isDirectory()) {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
             const content = await fsp.readFile(file, "utf8");
-            const rel = path13.relative(localPath, file).replace(/\\/g, "/");
+            const rel = path2.relative(localPath, file).replace(/\\/g, "/");
             entries.push({ path: `data/${cat}/${rel}`, content, mode: "100644" });
             hashes.push(content);
           }
@@ -7041,8 +7117,8 @@ var CloudSync = class {
       const localPath = this.categoryToPath(cat);
       if (!localPath) continue;
       try {
-        const stat5 = await fsp.stat(localPath);
-        if (stat5.isDirectory()) {
+        const stat6 = await fsp.stat(localPath);
+        if (stat6.isDirectory()) {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
             const content = await fsp.readFile(file);
@@ -7077,7 +7153,7 @@ var CloudSync = class {
     const results = [];
     const entries = await fsp.readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = path13.join(dir, entry.name);
+      const full = path2.join(dir, entry.name);
       if (entry.isDirectory()) {
         results.push(...await this.walkDir(full, base));
       } else {
@@ -7099,9 +7175,9 @@ function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
     return localPath;
   }
   if (!rel) return localPath;
-  const normalizedRel = path13.normalize(rel);
-  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path13.sep}`);
-  if (path13.isAbsolute(normalizedRel) || traversesUp) {
+  const normalizedRel = path2.normalize(rel);
+  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path2.sep}`);
+  if (path2.isAbsolute(normalizedRel) || traversesUp) {
     throw new FsError({
       message: `Refusing CloudSync path traversal: ${remotePath}`,
       code: ERROR_CODES.FS_DELETE_FAILED,
@@ -7109,10 +7185,10 @@ function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
       context: { reason: "path_traversal", normalizedRel }
     });
   }
-  const dest = path13.resolve(localPath, normalizedRel);
-  const root = path13.resolve(localPath);
-  const relative4 = path13.relative(root, dest);
-  if (relative4.startsWith("..") || path13.isAbsolute(relative4)) {
+  const dest = path2.resolve(localPath, normalizedRel);
+  const root = path2.resolve(localPath);
+  const relative4 = path2.relative(root, dest);
+  if (relative4.startsWith("..") || path2.isAbsolute(relative4)) {
     throw new FsError({
       message: `Refusing CloudSync path outside category root: ${remotePath}`,
       code: ERROR_CODES.FS_DELETE_FAILED,
@@ -7172,7 +7248,7 @@ function isAllowed(type, level) {
   return true;
 }
 function createSessionEventBridge(writer, level = "standard", options = {}) {
-  const normalizedLevel = level ?? "standard";
+  let currentLevel = level ?? "standard";
   const resolveWriter = typeof writer === "function" ? writer : () => writer;
   const progressCounters = /* @__PURE__ */ new Map();
   const toolProgressConfig = options.sampling?.toolProgress ?? {};
@@ -7193,14 +7269,19 @@ function createSessionEventBridge(writer, level = "standard", options = {}) {
     return true;
   }
   return {
-    level: normalizedLevel,
+    get level() {
+      return currentLevel;
+    },
+    setAuditLevel(next) {
+      currentLevel = next ?? "standard";
+    },
     allows(type) {
-      return isAllowed(type, normalizedLevel);
+      return isAllowed(type, currentLevel);
     },
     async append(event) {
       const target = resolveWriter();
       if (!target) return;
-      if (!isAllowed(event.type, normalizedLevel)) return;
+      if (!isAllowed(event.type, currentLevel)) return;
       if (!shouldSample(event)) return;
       try {
         await target.append(event);
@@ -7211,7 +7292,7 @@ function createSessionEventBridge(writer, level = "standard", options = {}) {
       const target = resolveWriter();
       if (!target || events.length === 0) return;
       const allowed = events.filter(
-        (e) => isAllowed(e.type, normalizedLevel) && shouldSample(e)
+        (e) => isAllowed(e.type, currentLevel) && shouldSample(e)
       );
       if (allowed.length === 0) return;
       try {