@wrongstack/core 0.265.1 → 0.268.0

package/dist/{secret-vault-B2yw84VT.d.ts → secret-vault-Cgduf5xL.d.ts}

@@ -1,4 +1,4 @@
-import { S as SecretScrubber } from './permission-B9SB45lp.js';
+import { S as SecretScrubber } from './permission-Bd-57Lbl.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { R as RotatableSecretVault, S as SecretVault } from './secret-vault-BAKpgFw_.js';
 
@@ -107,4 +107,4 @@ declare function rotateConfigKeys(configPath: string, vault: RotatableSecretVaul
     file: string;
 }>;
 
-export { DefaultSecretScrubber as D, type SecretVaultOptions as S, DefaultSecretVault as a, rotateConfigKeys as b, decryptConfigSecrets as d, encryptConfigSecrets as e, isSecretField as i, migratePlaintextSecrets as m, rewriteConfigEncrypted as r };
+export { DefaultSecretVault as D, type SecretVaultOptions as S, DefaultSecretScrubber as a, rotateConfigKeys as b, decryptConfigSecrets as d, encryptConfigSecrets as e, isSecretField as i, migratePlaintextSecrets as m, rewriteConfigEncrypted as r };

package/dist/security/index.d.ts

@@ -1,70 +1,8 @@
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, b as rotateConfigKeys } from '../secret-vault-B2yw84VT.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-CkjSXabK.js';
-import '../permission-B9SB45lp.js';
-import '../context-MRk5PhNv.js';
+export { a as DefaultSecretScrubber, D as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, b as rotateConfigKeys } from '../secret-vault-Cgduf5xL.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-uNXC6Kge.js';
+export { D as DANGEROUS_FOR_SUBAGENTS, T as ToolCapabilities, a as ToolCapability, g as getDangerousCapabilities, h as hasCapability, b as hasDangerousCapabilityForSubagents } from '../index-BfaS-f_m.js';
+import '../permission-Bd-57Lbl.js';
+import '../context-C0U8B9NF.js';
 import '../logger-B63L5bTg.js';
 import '../secret-vault-BAKpgFw_.js';
 import '../input-reader-E-ffP2ee.js';
-
-/**
- * Well-known tool capabilities used for authorization decisions.
- *
- * These are the preferred values for `Tool.capabilities`.
- * New capabilities should be added here with clear documentation.
- *
- * Philosophy (2026-06+):
- * - Prefer capabilities over exact tool name matching.
- * - Subagent guards and future policies should primarily key off capabilities.
- * - Name-based denylists are legacy and will be phased down.
- */
-declare const ToolCapabilities: {
-    /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
-    readonly SHELL_ARBITRARY: "shell.arbitrary";
-    /** Can execute a restricted set of commands (the `exec` tool). */
-    readonly SHELL_RESTRICTED: "shell.restricted";
-    /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
-    readonly FS_READ: "fs.read";
-    /** Can write / modify / delete files inside the project. */
-    readonly FS_WRITE: "fs.write";
-    /** Can write files outside the current project root (very high risk). */
-    readonly FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project";
-    /** Can perform outbound network requests. */
-    readonly NET_OUTBOUND: "net.outbound";
-    /** Proxies tools from external MCP servers (unknown capability). */
-    readonly MCP_PROXY: "mcp.proxy";
-    /** Can spawn or manage subagents / multi-agent tasks. */
-    readonly SUBAGENT_SPAWN: "subagent.spawn";
-    /** Can mutate global or session configuration / trust state. */
-    readonly CONFIG_MUTATE: "config.mutate";
-    /** Can install packages or run package managers with side effects. */
-    readonly PACKAGE_INSTALL: "package.install";
-};
-type ToolCapability = (typeof ToolCapabilities)[keyof typeof ToolCapabilities];
-/**
- * Set of capabilities that are considered dangerous for subagents by default.
- * Subagents should not receive these capabilities unless the leader explicitly
- * allows the specific tool at spawn time.
- */
-declare const DANGEROUS_FOR_SUBAGENTS: readonly ToolCapability[];
-/**
- * Check if a tool (or its capabilities array) includes any dangerous capability
- * for subagent execution.
- */
-declare function hasDangerousCapabilityForSubagents(toolOrCaps: {
-    capabilities?: readonly string[] | undefined;
-} | readonly string[] | undefined): boolean;
-/**
- * Check if a tool declares a specific capability (or any of the provided ones).
- */
-declare function hasCapability(toolOrCaps: {
-    capabilities?: readonly string[] | undefined;
-} | readonly string[] | undefined, capability: ToolCapability | ToolCapability[]): boolean;
-/**
- * Returns the intersection of a tool's capabilities with the dangerous set.
- * Useful for logging and audit trails.
- */
-declare function getDangerousCapabilities(toolOrCaps: {
-    capabilities?: readonly string[] | undefined;
-} | readonly string[] | undefined): ToolCapability[];
-
-export { DANGEROUS_FOR_SUBAGENTS, ToolCapabilities, type ToolCapability, getDangerousCapabilities, hasCapability, hasDangerousCapabilityForSubagents };

package/dist/security/index.js

@@ -230,24 +230,68 @@ async function renameWithRetry(from, to) {
   throw lastErr;
 }
 
-// src/utils/error.ts
-function toErrorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
+// src/utils/deep-merge.ts
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
+function isPrimitiveArray(a) {
+  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
 }
-
-// src/utils/safe-json.ts
-function safeParse(input, maxBytes = 5e6) {
-  if (input.length > maxBytes) {
-    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
+function deepMerge(base, patch, options = {}) {
+  const {
+    conflictResolution = "prefer-patch",
+    arrayMode = "replace",
+    protectProto = true,
+    onNonPrimitiveArrayReplace
+  } = options;
+  if (typeof base !== "object" || base === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
   }
-  try {
-    return { ok: true, value: JSON.parse(input) };
-  } catch (err) {
-    return {
-      ok: false,
-      error: toErrorMessage(err)
-    };
+  if (typeof patch !== "object" || patch === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
   }
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
+      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+    }
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) || Array.isArray(patch)) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  const baseObj = base;
+  const patchObj = patch;
+  const out = { ...baseObj };
+  for (const [k, v] of Object.entries(patchObj)) {
+    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge(existing, v, options);
+    } else if (Array.isArray(v) && Array.isArray(existing)) {
+      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
+        onNonPrimitiveArrayReplace(k, existing.length, v.length);
+      }
+      out[k] = deepMerge(existing, v, options);
+    } else if (v !== void 0) {
+      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
+        const existingLen = Array.isArray(existing) ? existing.length : 0;
+        onNonPrimitiveArrayReplace(k, existingLen, v.length);
+      }
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
+// src/utils/error.ts
+function toErrorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
 }
 
 // src/utils/expect-defined.ts
@@ -336,63 +380,54 @@ function matchAny(patterns, input) {
   return patterns.some((p) => matchGlob(p, input));
 }
 
-// src/utils/deep-merge.ts
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
-function isPrimitiveArray(a) {
-  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
-}
-function deepMerge(base, patch, options = {}) {
-  const {
-    conflictResolution = "prefer-patch",
-    arrayMode = "replace",
-    protectProto = true,
-    onNonPrimitiveArrayReplace
-  } = options;
-  if (typeof base !== "object" || base === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
+// src/utils/safe-json.ts
+function safeParse(input, maxBytes = 5e6) {
+  if (input.length > maxBytes) {
+    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
   }
-  if (typeof patch !== "object" || patch === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
+  try {
+    return { ok: true, value: JSON.parse(input) };
+  } catch (err) {
+    return {
+      ok: false,
+      error: toErrorMessage(err)
+    };
   }
-  if (Array.isArray(base) && Array.isArray(patch)) {
-    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
-      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+}
+
+// src/utils/tool-subject.ts
+var GLOB_METACHARACTERS = /[*?[\]]/g;
+function escapeGlobSubject(value) {
+  return value.replace(GLOB_METACHARACTERS, (char) => `\\${char}`);
+}
+function normalizePathSubject(value) {
+  return escapeGlobSubject(value.replace(/\\/g, "/"));
+}
+function isPathSubjectKey(subjectKey) {
+  return subjectKey === "path" || subjectKey === "file" || subjectKey === "files";
+}
+function subjectForToolInput(toolName, input, subjectKey) {
+  if (!input || typeof input !== "object") return void 0;
+  const obj = input;
+  if (subjectKey) {
+    const value = obj[subjectKey];
+    if (typeof value === "string") {
+      return isPathSubjectKey(subjectKey) ? normalizePathSubject(value) : escapeGlobSubject(value);
     }
-    return conflictResolution === "prefer-patch" ? patch : base;
   }
-  if (Array.isArray(base) || Array.isArray(patch)) {
-    return conflictResolution === "prefer-patch" ? patch : base;
+  if (toolName === "bash" && typeof obj.command === "string") {
+    return escapeGlobSubject(obj.command);
   }
-  const baseObj = base;
-  const patchObj = patch;
-  const out = { ...baseObj };
-  for (const [k, v] of Object.entries(patchObj)) {
-    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v, options);
-    } else if (Array.isArray(v) && Array.isArray(existing)) {
-      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
-        onNonPrimitiveArrayReplace(k, existing.length, v.length);
-      }
-      out[k] = deepMerge(existing, v, options);
-    } else if (v !== void 0) {
-      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
-        const existingLen = Array.isArray(existing) ? existing.length : 0;
-        onNonPrimitiveArrayReplace(k, existingLen, v.length);
-      }
-      out[k] = v;
-    }
+  if (typeof obj.path === "string") {
+    return normalizePathSubject(obj.path);
   }
-  return out;
+  if (typeof obj.url === "string") {
+    return escapeGlobSubject(obj.url);
+  }
+  if (typeof obj.name === "string") {
+    return escapeGlobSubject(obj.name);
+  }
+  return void 0;
 }
 
 // src/types/errors.ts
@@ -788,8 +823,13 @@ async function rotateConfigKeys(configPath, vault, logger) {
     warn(`[secret-vault] Config file ${configPath} is not valid JSON \u2014 skipping rotation`);
     return { rotated: 0, oldVersion: vault.keyVersion, newVersion: vault.keyVersion, file: configPath };
   }
-  const counter = { n: 0 };
+  const counter = { n: 0, failed: [] };
   const decrypted = walkDecryptCount(parsed, vault, counter);
+  if (counter.failed.length > 0) {
+    throw new Error(
+      `[secret-vault] Aborting key rotation: ${counter.failed.length} field(s) could not be decrypted with the current key and would be permanently lost on rotation: ${counter.failed.join(", ")}. Restore or remove these fields before rotating.`
+    );
+  }
   if (counter.n === 0) {
     const { oldVersion: oldVersion2, newVersion: newVersion2 } = vault.rotateKey();
     log(`[secret-vault] Key rotated (v${oldVersion2} \u2192 v${newVersion2}) \u2014 no encrypted fields to re-encrypt`);
@@ -802,23 +842,27 @@ async function rotateConfigKeys(configPath, vault, logger) {
   log(`[secret-vault] Key rotated (v${oldVersion} \u2192 v${newVersion}) \u2014 re-encrypted ${counter.n} field(s)`);
   return { rotated: counter.n, oldVersion, newVersion, file: configPath };
 }
-function walkDecryptCount(node, vault, counter) {
+function walkDecryptCount(node, vault, counter, pathPrefix = "") {
   if (node === null || node === void 0) return node;
   if (typeof node !== "object") return node;
   if (Array.isArray(node)) {
-    return node.map((item) => walkDecryptCount(item, vault, counter));
+    return node.map(
+      (item, i) => walkDecryptCount(item, vault, counter, `${pathPrefix}[${i}]`)
+    );
   }
   const out = /* @__PURE__ */ Object.create(null);
   for (const [k, v] of Object.entries(node)) {
+    const keyPath = pathPrefix ? `${pathPrefix}.${k}` : k;
     if (typeof v === "string" && vault.isEncrypted(v)) {
       try {
         out[k] = vault.decrypt(v);
         counter.n++;
       } catch {
+        counter.failed.push(keyPath);
         out[k] = v;
       }
     } else if (typeof v === "object" && v !== null) {
-      out[k] = walkDecryptCount(v, vault, counter);
+      out[k] = walkDecryptCount(v, vault, counter, keyPath);
     } else {
       out[k] = v;
     }
@@ -930,6 +974,14 @@ var DANGEROUS_FOR_SUBAGENTS = [
   ToolCapabilities.CONFIG_MUTATE,
   ToolCapabilities.PACKAGE_INSTALL
 ];
+[
+  ToolCapabilities.FS_READ,
+  ToolCapabilities.FS_WRITE,
+  ToolCapabilities.NET_OUTBOUND,
+  ToolCapabilities.SHELL_ARBITRARY,
+  ToolCapabilities.SHELL_RESTRICTED,
+  ToolCapabilities.PACKAGE_INSTALL
+];
 function hasDangerousCapabilityForSubagents(toolOrCaps) {
   if (!toolOrCaps) return false;
   const input = toolOrCaps;
@@ -1150,7 +1202,7 @@ var DefaultPermissionPolicy = class {
     if (!this.loaded) await this.reload();
     const namespaceEntry = this.findNamespaceEntry(tool.name);
     const entry = this.policy[tool.name] ?? namespaceEntry;
-    const subject = this.subjectFor(tool.name, input, tool.subjectKey);
+    const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
     const cacheKey = `${tool.name}::${subject ?? tool.name}`;
     if (tool.name !== "write") {
       const cached = this._evalCache.get(cacheKey);
@@ -1332,32 +1384,6 @@ var DefaultPermissionPolicy = class {
     this.sessionAllowed.set(`${rule.tool}::${rule.pattern}`, true);
     this._evalCache.clear();
   }
-  subjectFor(toolName, input, subjectKey) {
-    if (!input || typeof input !== "object") return void 0;
-    const obj = input;
-    const globChars = /[*?[\]]/g;
-    const escapeGlob = (s) => s.replace(globChars, (c) => `\\${c}`);
-    const normalizePath = (s) => escapeGlob(s.replace(/\\/g, "/"));
-    if (subjectKey) {
-      const v = obj[subjectKey];
-      if (typeof v === "string") {
-        return subjectKey === "path" || subjectKey === "file" || subjectKey === "files" ? normalizePath(v) : escapeGlob(v);
-      }
-    }
-    if (toolName === "bash" && typeof obj.command === "string") {
-      return escapeGlob(obj.command);
-    }
-    if (typeof obj.path === "string") {
-      return normalizePath(obj.path);
-    }
-    if (typeof obj.url === "string") {
-      return escapeGlob(obj.url);
-    }
-    if (typeof obj.name === "string") {
-      return escapeGlob(obj.name);
-    }
-    return void 0;
-  }
   findNamespaceEntry(toolName) {
     for (const { pattern, value } of this.wildcardEntries) {
       if (matchGlob(pattern, toolName)) return value;
@@ -1380,9 +1406,13 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
     const caps = tool.capabilities ?? [];
     const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
     const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
-    const blocked = tool.permission === "deny" || isMcp || !hasAllowedCap;
+    const mcpProxyAllowed = this.allowedCapabilities.includes(ToolCapabilities.MCP_PROXY);
+    const dangerousNotAllowed = getDangerousCapabilities(tool).filter(
+      (c) => !this.allowedCapabilities.includes(c)
+    );
+    const blocked = tool.permission === "deny" || isMcp && !mcpProxyAllowed || !hasAllowedCap || dangerousNotAllowed.length > 0;
     if (blocked) {
-      const reason = isMcp ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow it explicitly` : tool.permission === "deny" ? "tool default deny" : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
+      const reason = isMcp && !mcpProxyAllowed ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow mcp.proxy explicitly` : tool.permission === "deny" ? "tool default deny" : dangerousNotAllowed.length > 0 ? `tool requires un-granted dangerous capability (needs: ${dangerousNotAllowed.join(", ")}, allowed: ${this.allowedCapabilities.join(", ")})` : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
       return {
         permission: "deny",
         source: "subagent_guard",