@wrongstack/core 0.267.0 → 0.268.0

package/dist/defaults/index.d.ts

@@ -1,39 +1,40 @@
 export { D as DefaultLogger, a as DefaultLoggerOptions, L as LogFormat } from '../logger-DmmQhf4P.js';
-export { A as AbandonedSession, a as AttachmentStoreOptions, C as ConfigLoaderOptions, b as ConfigMigration, c as ConfigMigrationError, d as ConfigSource, D as DEFAULT_CONFIG_MIGRATIONS, e as DefaultAttachmentStore, f as DefaultConfigLoader, g as DefaultConfigStore, h as DefaultMemoryStore, i as DefaultSessionStore, k as MemoryStoreOptions, l as MigrationContext, m as MigrationResult, P as PersistedQueueItem, n as PlanFile, o as PlanItem, p as PlanTemplate, Q as QueueStore, R as RecoveryLock, q as RecoveryLockOptions, S as SessionAnalyzer, r as SessionStoreOptions, T as TodosCheckpointFile, s as addPlanItem, t as attachPlanCheckpoint, u as attachTodosCheckpoint, v as clearPlan, w as deriveTodosFromPlanItem, x as emptyPlan, y as formatPlan, z as formatPlanTemplates, B as getPlanTemplate, E as listPlanTemplates, G as loadPlan, H as loadTodosCheckpoint, K as removePlanItem, L as runConfigMigrations, N as savePlan, O as saveTodosCheckpoint, U as setPlanItemStatus } from '../plan-templates-DSIKCXZN.js';
-export { D as DefaultSessionReader } from '../session-reader-D7Dapswh.js';
-export { A as AuditLevel, S as SessionEventBridge, b as SessionEventBridgeOptions, c as SessionSamplingOptions, T as ToolProgressSamplingOptions, d as createSessionEventBridge, r as resolveAuditLevel, e as resolveSessionLoggingConfig } from '../session-event-bridge-D-araDEz.js';
+export { A as AbandonedSession, a as AttachmentStoreOptions, C as ConfigLoaderOptions, b as ConfigMigration, c as ConfigMigrationError, d as ConfigSource, D as DEFAULT_CONFIG_MIGRATIONS, e as DefaultAttachmentStore, f as DefaultConfigLoader, g as DefaultConfigStore, h as DefaultMemoryStore, i as DefaultSessionStore, k as MemoryStoreOptions, l as MigrationContext, m as MigrationResult, P as PersistedQueueItem, n as PlanFile, o as PlanItem, p as PlanTemplate, Q as QueueStore, R as RecoveryLock, q as RecoveryLockOptions, S as SessionAnalyzer, r as SessionStoreOptions, T as TodosCheckpointFile, s as addPlanItem, t as attachPlanCheckpoint, u as attachTodosCheckpoint, v as clearPlan, w as deriveTodosFromPlanItem, x as emptyPlan, y as formatPlan, z as formatPlanTemplates, B as getPlanTemplate, E as listPlanTemplates, G as loadPlan, H as loadTodosCheckpoint, K as removePlanItem, L as runConfigMigrations, N as savePlan, O as saveTodosCheckpoint, U as setPlanItemStatus } from '../plan-templates-EMsalEtN.js';
+export { D as DefaultSessionReader } from '../session-reader-DD4v2Obw.js';
+export { A as AuditLevel, S as SessionEventBridge, b as SessionEventBridgeOptions, c as SessionSamplingOptions, T as ToolProgressSamplingOptions, d as createSessionEventBridge, r as resolveAuditLevel, e as resolveSessionLoggingConfig } from '../session-event-bridge-Cw7oqmW2.js';
 export { a as DirectorStateCheckpoint, D as DirectorStateSnapshot, b as DirectorSubagentState, c as DirectorTaskState, l as loadDirectorState } from '../director-state-BfeCUbmk.js';
-export { a as DefaultSecretScrubber, D as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-gkvEZZfE.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-DlR9eJAM.js';
-export { C as CompactorOptions, a as DefaultErrorHandler, b as DefaultRetryPolicy, E as EternalAutonomyEngine, c as EternalAutonomyOptions, d as EternalEngineState, H as HybridCompactor, I as IterationStage, P as ParallelEngineState, e as ParallelEternalEngine, f as ParallelEternalOptions, g as ParallelIterationStage, T as ToolExecutor } from '../parallel-eternal-engine-DdNnw9BQ.js';
-export { A as AutoCompactionMiddleware, a as AutonomousRunner, b as AutonomousRunnerOptions, c as AutonomyPromptContributorOptions, C as CompactorStrategy, D as DefaultSkillLoader, d as DoneCheckResult, e as DoneConditionChecker, I as IntelligentCompactor, f as IntelligentCompactorOptions, S as SelectiveCompactor, g as SelectiveCompactorOptions, h as SkillLoaderOptions, i as StrategyCompactorOptions, j as buildGoalPreamble, k as createStrategyCompactor, m as makeAutonomyPromptContributor } from '../goal-preamble-SulMTowG.js';
-import { P as ProviderRunner, R as RunProviderOptions } from '../provider-runner-CX7iIvox.js';
-import { b as Response } from '../context-dT5Ueund.js';
-export { a as AGENTS_BY_PHASE, b as AGENT_CATALOG, c as ALL_AGENT_DEFINITIONS, d as ALL_FLEET_AGENTS, e as AUDIT_LOG_AGENT, f as AutoExtendCeiling, g as AutoExtendPolicy, B as BUG_HUNTER_AGENT, n as CreateDelegateToolOptions, D as DEFAULT_DIRECTOR_PREAMBLE, q as DEFAULT_SUBAGENT_BASELINE, r as DelegateHost, s as Director, w as DirectorPromptParts, x as DirectorSessionFactory, y as DirectorSessionFactoryOptions, F as FLEET_ROSTER, z as FLEET_ROSTER_BUDGETS, J as FleetRosterBudget, K as FleetSpawnBudgetError, L as ICoordinator, M as IFleetManager, O as NULL_FLEET_BUS, R as REFACTOR_PLANNER_AGENT, S as SECURITY_SCANNER_AGENT, V as SubagentPromptParts, W as applyRosterBudget, X as attachAutoExtend, Y as composeDirectorPrompt, Z as composeSubagentPrompt, _ as createDelegateTool, $ as getAgentDefinition, a1 as makeAskTool, a2 as makeAssignTool, a3 as makeAwaitTasksTool, a4 as makeCollabDebugTool, a5 as makeDirectorSessionFactory, a6 as makeFleetEmitTool, a7 as makeFleetHealthTool, a8 as makeFleetSessionTool, a9 as makeFleetStatusTool, aa as makeFleetUsageTool, ab as makeRollUpTool, ac as makeSpawnTool, ad as makeTerminateTool, af as rosterSummaryFromConfigs } from '../null-fleet-bus-CnXa5oTH.js';
-export { c as AgentBudgetTier, d as AgentCapability, b as AgentDefinition, A as AgentPhase, e as DEFAULT_DISPATCH_ROLE, a as DefaultMultiAgentCoordinator, f as DispatchCandidate, D as DispatchClassifier, g as DispatchMethod, h as DispatchOptions, i as DispatchResult, j as MultiAgentCoordinatorOptions, k as dispatchAgent, m as makeLLMClassifier, s as scoreAgents } from '../multi-agent-coordinator-B8R43uPz.js';
-export { h as AgentFactory, v as AgentFactoryResult, w as AgentRunnerOptions, x as BudgetExceededError, y as BudgetKind, z as BudgetLimits, J as BudgetUsage, F as FleetBus, N as FleetEvent, O as FleetHandler, i as FleetUsage, j as FleetUsageAggregator, Q as SubagentBudget, Y as SubagentUsageSnapshot, $ as makeAgentSubagentRunner } from '../agent-subagent-runner-CzPGP3jA.js';
-export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-STJ3JwwK.js';
-export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-BqGZNJQ-.js';
-export { D as DefaultModeStore, L as LLMSelector, a as LLMSelectorOptions, M as ModeLoaderOptions, P as ProviderModelDescriptor, d as describeCatalogModel, l as loadProjectModes, b as loadUserModes, r as resolveProviderModelList } from '../provider-model-resolve-BNRsNuJx.js';
+export { a as DefaultSecretScrubber, D as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-Cgduf5xL.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-uNXC6Kge.js';
+export { C as CompactorOptions, a as DefaultErrorHandler, b as DefaultRetryPolicy, E as EternalAutonomyEngine, c as EternalAutonomyOptions, d as EternalEngineState, H as HybridCompactor, I as IterationStage, P as ParallelEngineState, e as ParallelEternalEngine, f as ParallelEternalOptions, g as ParallelIterationStage, T as ToolExecutor } from '../parallel-eternal-engine-Ci71gYu_.js';
+export { A as AutoCompactionMiddleware, a as AutonomousRunner, b as AutonomousRunnerOptions, c as AutonomyPromptContributorOptions, C as CompactorStrategy, D as DefaultSkillLoader, d as DoneCheckResult, e as DoneConditionChecker, I as IntelligentCompactor, f as IntelligentCompactorOptions, S as SelectiveCompactor, g as SelectiveCompactorOptions, h as SkillLoaderOptions, i as StrategyCompactorOptions, j as buildGoalPreamble, k as createStrategyCompactor, m as makeAutonomyPromptContributor } from '../goal-preamble-CrYjmdw4.js';
+import { P as ProviderRunner, R as RunProviderOptions } from '../provider-runner-DWJbpo70.js';
+import { b as Response } from '../context-C0U8B9NF.js';
+export { a as AGENTS_BY_PHASE, b as AGENT_CATALOG, c as ALL_AGENT_DEFINITIONS, d as ALL_FLEET_AGENTS, e as AUDIT_LOG_AGENT, f as AutoExtendCeiling, g as AutoExtendPolicy, B as BUG_HUNTER_AGENT, n as CreateDelegateToolOptions, D as DEFAULT_DIRECTOR_PREAMBLE, q as DEFAULT_SUBAGENT_BASELINE, r as DelegateHost, s as Director, w as DirectorPromptParts, x as DirectorSessionFactory, y as DirectorSessionFactoryOptions, F as FLEET_ROSTER, z as FLEET_ROSTER_BUDGETS, J as FleetRosterBudget, K as FleetSpawnBudgetError, L as ICoordinator, M as IFleetManager, O as NULL_FLEET_BUS, R as REFACTOR_PLANNER_AGENT, S as SECURITY_SCANNER_AGENT, V as SubagentPromptParts, W as applyRosterBudget, X as attachAutoExtend, Y as composeDirectorPrompt, Z as composeSubagentPrompt, _ as createDelegateTool, $ as getAgentDefinition, a1 as makeAskTool, a2 as makeAssignTool, a3 as makeAwaitTasksTool, a4 as makeCollabDebugTool, a5 as makeDirectorSessionFactory, a6 as makeFleetEmitTool, a7 as makeFleetHealthTool, a8 as makeFleetSessionTool, a9 as makeFleetStatusTool, aa as makeFleetUsageTool, ab as makeRollUpTool, ac as makeSpawnTool, ad as makeTerminateTool, af as rosterSummaryFromConfigs } from '../null-fleet-bus-DA7fvhUg.js';
+export { c as AgentBudgetTier, d as AgentCapability, b as AgentDefinition, A as AgentPhase, e as DEFAULT_DISPATCH_ROLE, a as DefaultMultiAgentCoordinator, f as DispatchCandidate, D as DispatchClassifier, g as DispatchMethod, h as DispatchOptions, i as DispatchResult, j as MultiAgentCoordinatorOptions, k as dispatchAgent, m as makeLLMClassifier, s as scoreAgents } from '../multi-agent-coordinator-BACjsmkC.js';
+export { h as AgentFactory, v as AgentFactoryResult, w as AgentRunnerOptions, x as BudgetExceededError, y as BudgetKind, z as BudgetLimits, J as BudgetUsage, F as FleetBus, N as FleetEvent, O as FleetHandler, i as FleetUsage, j as FleetUsageAggregator, Q as SubagentBudget, Y as SubagentUsageSnapshot, $ as makeAgentSubagentRunner } from '../agent-subagent-runner-Bvtf1o9K.js';
+export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-UhojbpWx.js';
+export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-Bvcl3Vaa.js';
+export { D as DefaultModeStore, L as LLMSelector, a as LLMSelectorOptions, M as ModeLoaderOptions, P as ProviderModelDescriptor, d as describeCatalogModel, l as loadProjectModes, b as loadUserModes, r as resolveProviderModelList } from '../provider-model-resolve-CEb9x886.js';
 export { AISpecBuilder, AISpecBuilderOptions, AISpecPhase, AISpecSession, AutoExecutor, AutoExecutorOptions, BottleneckTask, CollectedAnswer, CriticalPathAnalysis, DefaultTaskStore, ExecutionSummary, GeneratedTask, RunResult, SPEC_TEMPLATES, SddParallelRun, SddParallelRunOptions, SddProgress, SddTaskDecomposer, SddTaskDecomposerOptions, SpecDiff, SpecDrivenDev, SpecDrivenDevOptions, SpecIndexEntry, SpecParser, SpecStore, SpecStoreOptions, SpecVersion, SpecVersioning, TaskBatch, TaskExecutionContext, TaskExecutionResult, TaskFlow, TaskFlowEventMap, TaskFlowEventName, TaskFlowExecutionContext, TaskFlowOptions, TaskFlowPhase, TaskGenerator, TaskGeneratorOptions, TaskGraphIndexEntry, TaskGraphStore, TaskGraphStoreOptions, TaskStore, TaskTracker, TaskTrackerOptions, TaskTransition, WaveResult, analyzeCriticalPath, createAutoExecutor, getTemplate, listTemplates, renderProgress, renderSpecAnalysis, renderTaskGraph, renderTaskList, templateToMarkdown } from '../sdd/index.js';
 export { DefaultHealthRegistry, InMemoryMetricsSink, MetricsServerHandle, MetricsServerOptions, NoopMetricsSink, NoopTracer, OTelTracer, OtlpMetricsExporterHandle, OtlpMetricsExporterOptions, OtlpTraceExporterHandle, OtlpTraceExporterOptions, PROMETHEUS_CONTENT_TYPE, buildOtlpMetricsRequest, buildOtlpTracesRequest, renderPrometheus, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, wireMetricsToEvents } from '../observability/index.js';
-export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, s as sentinelServer, q as slackServer, z as zaiVisionServer } from '../mcp-servers-C2cBTxUR.js';
+export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, p as playwrightServer, s as sentinelServer, q as slackServer, r as sshManagerServer, z as zaiVisionServer } from '../mcp-servers-HT3Fi7Bl.js';
 export { D as DEFAULT_AUTONOMY_CONFIG, b as DEFAULT_CONTEXT_CONFIG, e as DEFAULT_TOOLS_CONFIG } from '../default-config-B0cj-Hry.js';
 import '../logger-B63L5bTg.js';
-import '../brain-Cdg77tVN.js';
-import '../permission-B75JAi3-.js';
+import '../brain-69wzMKp1.js';
+import '../permission-Bd-57Lbl.js';
 import '../wstack-paths-hOpNLmvf.js';
-import '../config-Du3pYYln.js';
+import '../config-VKfOZ-6X.js';
 import '../secret-vault-BAKpgFw_.js';
 import '../input-reader-E-ffP2ee.js';
-import '../retry-policy-BilV1ujH.js';
-import '../compactor-iMZ84CXq.js';
-import '../index-Bms0m4oy.js';
-import '../pipeline-BfD2k1rT.js';
+import '../retry-policy-C3s_lvdK.js';
+import '../compactor-CBQAJoDc.js';
+import '../index-gCv830d7.js';
+import '../pipeline-BDNvENyV.js';
+import '../mailbox-types-Ct2hJq0P.js';
 import '../observability-D-HZN_mF.js';
-import '../goal-store-CABDwdFE.js';
+import '../goal-store-Y_zdLZ3q.js';
 import '../skill-DGIXCtdv.js';
-import '../selector-Bc7eWtT3.js';
+import '../selector-47LBnBVk.js';
 import 'node:events';
 import '../mode-CZlO9iU1.js';
 import '../spec-TBi3Jr6T.js';

package/dist/defaults/index.js

@@ -1088,6 +1088,41 @@ function truncate(s, max) {
   return s.length <= max ? s : `${s.slice(0, max - 1)}\u2026`;
 }
 
+// src/utils/tool-subject.ts
+var GLOB_METACHARACTERS = /[*?[\]]/g;
+function escapeGlobSubject(value) {
+  return value.replace(GLOB_METACHARACTERS, (char) => `\\${char}`);
+}
+function normalizePathSubject(value) {
+  return escapeGlobSubject(value.replace(/\\/g, "/"));
+}
+function isPathSubjectKey(subjectKey) {
+  return subjectKey === "path" || subjectKey === "file" || subjectKey === "files";
+}
+function subjectForToolInput(toolName, input, subjectKey) {
+  if (!input || typeof input !== "object") return void 0;
+  const obj = input;
+  if (subjectKey) {
+    const value = obj[subjectKey];
+    if (typeof value === "string") {
+      return isPathSubjectKey(subjectKey) ? normalizePathSubject(value) : escapeGlobSubject(value);
+    }
+  }
+  if (toolName === "bash" && typeof obj.command === "string") {
+    return escapeGlobSubject(obj.command);
+  }
+  if (typeof obj.path === "string") {
+    return normalizePathSubject(obj.path);
+  }
+  if (typeof obj.url === "string") {
+    return escapeGlobSubject(obj.url);
+  }
+  if (typeof obj.name === "string") {
+    return escapeGlobSubject(obj.name);
+  }
+  return void 0;
+}
+
 // src/utils/tool-wire-compact.ts
 var TOOL_DESCRIPTION_MAX_CHARS = 640;
 var SCHEMA_DESCRIPTION_MAX_CHARS = 180;
@@ -2198,6 +2233,8 @@ var DefaultSessionStore = class _DefaultSessionStore {
       const cached = this._loadCache.get(id);
       if (cached && cached.mtimeMs === stat6.mtimeMs && cached.size === stat6.size) {
         cacheHit = true;
+        this._loadCache.delete(id);
+        this._loadCache.set(id, cached);
         return cached.data;
       }
       const raw = await fsp2.readFile(file, "utf8");
@@ -4900,6 +4937,7 @@ var BEHAVIOR_DEFAULTS = {
     modelsRegistry: true,
     skills: true
   },
+  mcpServers: {},
   indexing: {
     onSessionStart: true,
     onEdit: true,
@@ -6991,7 +7029,7 @@ var DefaultPermissionPolicy = class {
     if (!this.loaded) await this.reload();
     const namespaceEntry = this.findNamespaceEntry(tool.name);
     const entry = this.policy[tool.name] ?? namespaceEntry;
-    const subject = this.subjectFor(tool.name, input, tool.subjectKey);
+    const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
     const cacheKey = `${tool.name}::${subject ?? tool.name}`;
     if (tool.name !== "write") {
       const cached = this._evalCache.get(cacheKey);
@@ -7173,32 +7211,6 @@ var DefaultPermissionPolicy = class {
     this.sessionAllowed.set(`${rule.tool}::${rule.pattern}`, true);
     this._evalCache.clear();
   }
-  subjectFor(toolName, input, subjectKey) {
-    if (!input || typeof input !== "object") return void 0;
-    const obj = input;
-    const globChars = /[*?[\]]/g;
-    const escapeGlob = (s) => s.replace(globChars, (c) => `\\${c}`);
-    const normalizePath = (s) => escapeGlob(s.replace(/\\/g, "/"));
-    if (subjectKey) {
-      const v = obj[subjectKey];
-      if (typeof v === "string") {
-        return subjectKey === "path" || subjectKey === "file" || subjectKey === "files" ? normalizePath(v) : escapeGlob(v);
-      }
-    }
-    if (toolName === "bash" && typeof obj.command === "string") {
-      return escapeGlob(obj.command);
-    }
-    if (typeof obj.path === "string") {
-      return normalizePath(obj.path);
-    }
-    if (typeof obj.url === "string") {
-      return escapeGlob(obj.url);
-    }
-    if (typeof obj.name === "string") {
-      return escapeGlob(obj.name);
-    }
-    return void 0;
-  }
   findNamespaceEntry(toolName) {
     for (const { pattern, value } of this.wildcardEntries) {
       if (matchGlob(pattern, toolName)) return value;
@@ -7221,12 +7233,13 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
     const caps = tool.capabilities ?? [];
     const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
     const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
+    const mcpProxyAllowed = this.allowedCapabilities.includes(ToolCapabilities.MCP_PROXY);
     const dangerousNotAllowed = getDangerousCapabilities(tool).filter(
       (c) => !this.allowedCapabilities.includes(c)
     );
-    const blocked = tool.permission === "deny" || isMcp || !hasAllowedCap || dangerousNotAllowed.length > 0;
+    const blocked = tool.permission === "deny" || isMcp && !mcpProxyAllowed || !hasAllowedCap || dangerousNotAllowed.length > 0;
     if (blocked) {
-      const reason = isMcp ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow it explicitly` : tool.permission === "deny" ? "tool default deny" : dangerousNotAllowed.length > 0 ? `tool requires un-granted dangerous capability (needs: ${dangerousNotAllowed.join(", ")}, allowed: ${this.allowedCapabilities.join(", ")})` : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
+      const reason = isMcp && !mcpProxyAllowed ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow mcp.proxy explicitly` : tool.permission === "deny" ? "tool default deny" : dangerousNotAllowed.length > 0 ? `tool requires un-granted dangerous capability (needs: ${dangerousNotAllowed.join(", ")}, allowed: ${this.allowedCapabilities.join(", ")})` : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
       return {
         permission: "deny",
         source: "subagent_guard",
@@ -9566,7 +9579,7 @@ ${errorDetails}`,
             return { result, tool, durationMs: Date.now() - start };
           }
         } else {
-          const suggestedPattern = this.subjectFor(tool.name, use.input, tool.subjectKey) ?? tool.name;
+          const suggestedPattern = subjectForToolInput(tool.name, use.input, tool.subjectKey) ?? tool.name;
           const pending = {
             type: "tool_confirm_pending",
             toolUseId: use.id,
@@ -9845,38 +9858,6 @@ ${excerpt}`;
   budgetForString(content, budget) {
     return Math.max(0, budget - Buffer.byteLength(content, "utf8"));
   }
-  /**
-   * Compute the suggestedPattern string for a tool+input pair.
-   * Matches the logic in DefaultPermissionPolicy so the TUI shows the
-   * same subject that the trust file would use.
-   */
-  subjectFor(toolName, input, subjectKey) {
-    if (!input || typeof input !== "object") return void 0;
-    const obj = input;
-    const globChars = /[*?[\]]/g;
-    const escapeGlob = (s) => s.replace(globChars, (c) => `\\${c}`);
-    const normalizePath = (s) => escapeGlob(s.replace(/\\/g, "/"));
-    if (subjectKey) {
-      const v = obj[subjectKey];
-      if (typeof v === "string") {
-        const isPathKey = subjectKey === "path" || subjectKey === "file" || subjectKey === "files";
-        return isPathKey ? normalizePath(v) : escapeGlob(v);
-      }
-    }
-    if (toolName === "bash" && typeof obj.command === "string") {
-      return escapeGlob(obj.command);
-    }
-    if (typeof obj.path === "string") {
-      return normalizePath(obj.path);
-    }
-    if (typeof obj.url === "string") {
-      return escapeGlob(obj.url);
-    }
-    if (typeof obj.name === "string") {
-      return escapeGlob(obj.name);
-    }
-    return void 0;
-  }
 };
 function clampTimeoutMs(timeoutMs, maxTimeoutMs) {
   const fallback = 3e5;
@@ -13702,7 +13683,27 @@ Working rules:
       id: "devops",
       name: "DevOps",
       role: "devops",
-      tools: [...TOOLS.build],
+      tools: [
+        ...TOOLS.build,
+        "mcp__ssh__ssh_list_servers",
+        "mcp__ssh__ssh_connection_status",
+        "mcp__ssh__ssh_execute",
+        "mcp__ssh__ssh_execute_sudo",
+        "mcp__ssh__ssh_upload",
+        "mcp__ssh__ssh_download",
+        "mcp__ssh__ssh_sync",
+        "mcp__ssh__ssh_deploy",
+        "mcp__ssh__ssh_health_check",
+        "mcp__ssh__ssh_service_status",
+        "mcp__ssh__ssh_process_manager",
+        "mcp__ssh__ssh_tunnel",
+        "mcp__ssh__ssh_backup_create",
+        "mcp__ssh__ssh_backup_list",
+        "mcp__ssh__ssh_backup_restore",
+        "mcp__ssh__ssh_db_list",
+        "mcp__ssh__ssh_db_query",
+        "mcp__ssh__ssh_profile"
+      ],
       prompt: `You are the DevOps agent. Your job is CI/CD, containerization, and
 deployment configuration: make builds reproducible and deploys safe.
 
@@ -13711,6 +13712,7 @@ Scope:
 - Write Dockerfiles/compose and optimize image size and layer caching
 - Configure deployment (env, secrets handling, health checks, rollback)
 - Diagnose flaky/broken pipelines
+- Use optional SSH MCP tools for remote hosts when the 'ssh' MCP server is enabled: list servers, run health checks, inspect services, transfer/deploy files, and open tunnels
 
 Input format you accept:
 { "task": "ci | container | deploy | fix-pipeline", "platform": "github-actions | gitlab | docker | k8s", "target": "<what>" }
@@ -13725,7 +13727,8 @@ Working rules:
 - Never hardcode secrets in config; reference the secret store
 - Pin versions for reproducible builds; avoid floating :latest
 - Every deploy path needs a rollback and a health check
-- Treat CI/CD changes as high-risk \u2014 explain blast radius before applying`
+- Treat CI/CD changes as high-risk \u2014 explain blast radius before applying
+- For remote SSH work, start with ssh_list_servers / ssh_connection_status, prefer read-only checks first, and do not run destructive commands without explicit user approval`
     },
     budget: MEDIUM_BUDGET,
     capability: {
@@ -13742,6 +13745,13 @@ Working rules:
         "kubernetes",
         "k8s",
         "deploy",
+        "ssh",
+        "remote ssh",
+        "remote server",
+        "sftp",
+        "tunnel",
+        "bastion",
+        "jump host",
         "github actions",
         "container"
       ]
@@ -15513,6 +15523,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
         subagentId: result.subagentId,
         taskId: result.taskId,
         status: result.status,
+        result: result.result,
         iterations: result.iterations,
         toolCalls: result.toolCalls,
         durationMs: result.durationMs
@@ -19705,10 +19716,11 @@ var DefaultModelsRegistry = class {
       capabilities: {
         tools: model.tool_call ?? false,
         vision: Boolean(model.modalities?.input?.includes("image")),
-        reasoning: model.reasoning ?? false,
+        reasoning: model.reasoning ?? model.reasoningConfig !== void 0,
         maxContext: model.limit?.context ?? 0,
         maxOutput: model.limit?.output,
-        knowledge: model.knowledge
+        knowledge: model.knowledge,
+        reasoningConfig: model.reasoningConfig
       },
       cost: model.cost
     };
@@ -24025,6 +24037,19 @@ var miniMaxVisionServer = () => ({
   allowedTools: ["understand_image"],
   permission: "auto"
 });
+var sshManagerServer = () => ({
+  name: "ssh",
+  description: "Remote SSH management \u2014 execute commands, transfer files, tunnels, health checks (mcp-ssh-manager)",
+  transport: "stdio",
+  command: "npx",
+  args: ["-y", "mcp-ssh-manager"],
+  env: {
+    MCP_SSH_COMPACT_JSON: "true",
+    MCP_SSH_DEFAULT_TIMEOUT: "120000"
+  },
+  permission: "confirm",
+  requestTimeoutMs: 18e4
+});
 var allServers = () => ({
   filesystem: { ...filesystemServer(), enabled: false },
   github: { ...githubServer(), enabled: false },
@@ -24038,9 +24063,10 @@ var allServers = () => ({
   sentinel: { ...sentinelServer(), enabled: false },
   "zai-vision": { ...zaiVisionServer(), enabled: false },
   "minimax-vision": { ...miniMaxVisionServer(), enabled: false },
-  playwright: { ...playwrightServer(), enabled: false }
+  playwright: { ...playwrightServer(), enabled: false },
+  ssh: { ...sshManagerServer(), enabled: false }
 });
 
-export { AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, ConfigMigrationError, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorStateCheckpoint, DoneConditionChecker, EternalAutonomyEngine, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FleetBus, FleetSpawnBudgetError, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, SddParallelRun, SddTaskDecomposer, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, ToolExecutor, addPlanItem, allServers, analyzeCriticalPath, applyRosterBudget, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, clearPlan, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createAutoExecutor, createContextManagerTool, createDelegateTool, createMessage, createSessionEventBridge, createStrategyCompactor, decryptConfigSecrets, deriveTodosFromPlanItem, describeCatalogModel, dispatchAgent, emptyPlan, encryptConfigSecrets, everArtServer, filesystemServer, formatPlan, formatPlanTemplates, getAgentDefinition, getPlanTemplate, getTemplate, githubServer, googleMapsServer, listPlanTemplates, listTemplates, loadDirectorState, loadPlan, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetHealthTool, makeFleetSessionTool, makeFleetStatusTool, makeFleetUsageTool, makeLLMClassifier, makeRollUpTool, makeSpawnTool, makeTerminateTool, migratePlaintextSecrets, miniMaxVisionServer, removePlanItem, renderProgress, renderPrometheus, renderSpecAnalysis, renderTaskGraph, renderTaskList, resolveAuditLevel, resolveProviderModelList, resolveSessionLoggingConfig, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, savePlan, saveTodosCheckpoint, scoreAgents, sentinelServer, setPlanItemStatus, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, templateToMarkdown, wireMetricsToEvents, zaiVisionServer };
+export { AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, ConfigMigrationError, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorStateCheckpoint, DoneConditionChecker, EternalAutonomyEngine, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FleetBus, FleetSpawnBudgetError, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, SddParallelRun, SddTaskDecomposer, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, ToolExecutor, addPlanItem, allServers, analyzeCriticalPath, applyRosterBudget, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, clearPlan, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createAutoExecutor, createContextManagerTool, createDelegateTool, createMessage, createSessionEventBridge, createStrategyCompactor, decryptConfigSecrets, deriveTodosFromPlanItem, describeCatalogModel, dispatchAgent, emptyPlan, encryptConfigSecrets, everArtServer, filesystemServer, formatPlan, formatPlanTemplates, getAgentDefinition, getPlanTemplate, getTemplate, githubServer, googleMapsServer, listPlanTemplates, listTemplates, loadDirectorState, loadPlan, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetHealthTool, makeFleetSessionTool, makeFleetStatusTool, makeFleetUsageTool, makeLLMClassifier, makeRollUpTool, makeSpawnTool, makeTerminateTool, migratePlaintextSecrets, miniMaxVisionServer, playwrightServer, removePlanItem, renderProgress, renderPrometheus, renderSpecAnalysis, renderTaskGraph, renderTaskList, resolveAuditLevel, resolveProviderModelList, resolveSessionLoggingConfig, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, savePlan, saveTodosCheckpoint, scoreAgents, sentinelServer, setPlanItemStatus, slackServer, sshManagerServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, templateToMarkdown, wireMetricsToEvents, zaiVisionServer };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map