@wrongstack/core 0.269.0 → 0.272.0

package/dist/types/index.js

@@ -1,4 +1,4 @@
-import { randomBytes, createCipheriv, createDecipheriv, randomUUID } from 'crypto';
+import { randomBytes, createCipheriv, createDecipheriv, randomUUID, scryptSync } from 'crypto';
 import * as fs from 'fs/promises';
 import * as path6 from 'path';
 import * as os from 'os';
@@ -703,18 +703,20 @@ function calState(key) {
   return state;
 }
 var ESTIMATE_CACHE = /* @__PURE__ */ new Map();
+var _estimateCacheOrder = [];
 var ESTIMATE_CACHE_MAX_SIZE = 5e4;
 function getCachedEstimate(key, compute) {
   const existing = ESTIMATE_CACHE.get(key);
   if (existing !== void 0) return existing;
   if (ESTIMATE_CACHE.size >= ESTIMATE_CACHE_MAX_SIZE) {
-    for (const k of ESTIMATE_CACHE.keys()) {
-      if (ESTIMATE_CACHE.size <= Math.floor(ESTIMATE_CACHE_MAX_SIZE / 2)) break;
-      ESTIMATE_CACHE.delete(k);
+    while (ESTIMATE_CACHE.size > Math.floor(ESTIMATE_CACHE_MAX_SIZE / 2)) {
+      const oldest = _estimateCacheOrder.shift();
+      if (oldest !== void 0) ESTIMATE_CACHE.delete(oldest);
     }
   }
   const estimate = compute(key);
   ESTIMATE_CACHE.set(key, estimate);
+  _estimateCacheOrder.push(key);
   return estimate;
 }
 function estimateToolInputTokens(input) {
@@ -1864,6 +1866,83 @@ var ALGO = "aes-256-gcm";
 var KEY_FILE_MODE = 384;
 var KEY_FILE_MAGIC = Buffer.from("WSKV", "ascii");
 var VERSIONED_KEY_FILE_SIZE = KEY_FILE_MAGIC.length + 1 + KEY_BYTES;
+var KEK_MAGIC = Buffer.from("WSKW", "ascii");
+var KEK_SALT_BYTES = 16;
+var WRAPPED_KEY_FILE_SIZE = KEK_MAGIC.length + 1 + KEK_SALT_BYTES + IV_BYTES + TAG_BYTES + KEY_BYTES;
+var SCRYPT_N = 1 << 15;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SCRYPT_MAXMEM = 64 * 1024 * 1024;
+function getVaultPassphrase() {
+  const v = process.env["WRONGSTACK_VAULT_PASSPHRASE"];
+  return v && v.length > 0 ? v : void 0;
+}
+function isWrappedKeyFile(buf) {
+  return buf.length === WRAPPED_KEY_FILE_SIZE && buf.subarray(0, KEK_MAGIC.length).equals(KEK_MAGIC);
+}
+function deriveKEK(passphrase, salt) {
+  return scryptSync(passphrase, salt, KEY_BYTES, {
+    N: SCRYPT_N,
+    r: SCRYPT_R,
+    p: SCRYPT_P,
+    maxmem: SCRYPT_MAXMEM
+  });
+}
+function wrapDataKey(dataKey, keyVersion, passphrase) {
+  const salt = randomBytes(KEK_SALT_BYTES);
+  const iv = randomBytes(IV_BYTES);
+  const kek = deriveKEK(passphrase, salt);
+  const cipher = createCipheriv(ALGO, kek, iv);
+  const ct = Buffer.concat([cipher.update(dataKey), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const out = Buffer.alloc(WRAPPED_KEY_FILE_SIZE);
+  let off = 0;
+  KEK_MAGIC.copy(out, off);
+  off += KEK_MAGIC.length;
+  out[off] = keyVersion & 255;
+  off += 1;
+  salt.copy(out, off);
+  off += KEK_SALT_BYTES;
+  iv.copy(out, off);
+  off += IV_BYTES;
+  tag.copy(out, off);
+  off += TAG_BYTES;
+  ct.copy(out, off);
+  return out;
+}
+function unwrapDataKey(buf, keyFile) {
+  const passphrase = getVaultPassphrase();
+  if (!passphrase) {
+    throw new ConfigError({
+      message: `SecretVault: key file ${keyFile} is passphrase-protected \u2014 set the WRONGSTACK_VAULT_PASSPHRASE environment variable to unlock it.`,
+      code: ERROR_CODES.CONFIG_INVALID,
+      context: { keyFile }
+    });
+  }
+  let off = KEK_MAGIC.length;
+  const version = buf[off];
+  off += 1;
+  const salt = buf.subarray(off, off + KEK_SALT_BYTES);
+  off += KEK_SALT_BYTES;
+  const iv = buf.subarray(off, off + IV_BYTES);
+  off += IV_BYTES;
+  const tag = buf.subarray(off, off + TAG_BYTES);
+  off += TAG_BYTES;
+  const ct = buf.subarray(off, off + KEY_BYTES);
+  const kek = deriveKEK(passphrase, salt);
+  const decipher = createDecipheriv(ALGO, kek, iv);
+  decipher.setAuthTag(tag);
+  try {
+    const key = Buffer.concat([decipher.update(ct), decipher.final()]);
+    return { key: Buffer.from(key), version };
+  } catch {
+    throw new ConfigError({
+      message: `SecretVault: failed to unlock key file ${keyFile} \u2014 wrong WRONGSTACK_VAULT_PASSPHRASE (key unwrap authentication failed).`,
+      code: ERROR_CODES.CONFIG_INVALID,
+      context: { keyFile }
+    });
+  }
+}
 function checkKeyFilePermissions(keyFile) {
   if (process.platform === "win32") return;
   try {
@@ -1956,25 +2035,56 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    const keyFileBuf = Buffer.alloc(VERSIONED_KEY_FILE_SIZE);
-    KEY_FILE_MAGIC.copy(keyFileBuf, 0);
-    keyFileBuf[KEY_FILE_MAGIC.length] = newVersion;
-    newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
     fs2.mkdirSync(path6.dirname(this.keyFile), { recursive: true });
-    fs2.writeFileSync(this.keyFile, keyFileBuf, { mode: 384 });
+    const passphrase = getVaultPassphrase();
+    if (passphrase) {
+      fs2.writeFileSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase), { mode: 384 });
+    } else {
+      const keyFileBuf = Buffer.alloc(VERSIONED_KEY_FILE_SIZE);
+      KEY_FILE_MAGIC.copy(keyFileBuf, 0);
+      keyFileBuf[KEY_FILE_MAGIC.length] = newVersion;
+      newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
+      fs2.writeFileSync(this.keyFile, keyFileBuf, { mode: 384 });
+    }
     checkKeyFilePermissions(this.keyFile);
     this.key = newKey;
     this._keyVersion = newVersion;
     return { oldVersion, newVersion };
   }
+  /**
+   * If WRONGSTACK_VAULT_PASSPHRASE is set but the key on disk is still stored
+   * unwrapped (legacy v1 / versioned v2), re-write it in passphrase-wrapped (v3)
+   * form. The data key is preserved, so all existing ciphertext keeps
+   * decrypting. Best-effort: a write failure leaves the working unwrapped file
+   * in place and is not fatal to load.
+   */
+  migrateToWrappedIfPassphrase() {
+    const passphrase = getVaultPassphrase();
+    if (!passphrase || !this.key) return;
+    try {
+      fs2.writeFileSync(this.keyFile, wrapDataKey(this.key, this._keyVersion, passphrase), {
+        mode: 384
+      });
+      checkKeyFilePermissions(this.keyFile);
+    } catch {
+    }
+  }
   loadOrCreateKey() {
     if (this.key) return this.key;
     try {
       const buf = fs2.readFileSync(this.keyFile);
+      if (isWrappedKeyFile(buf)) {
+        const { key: key2, version } = unwrapDataKey(buf, this.keyFile);
+        this.key = key2;
+        this._keyVersion = version;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
+      }
       if (buf.length === KEY_BYTES) {
         this.key = buf;
         this._keyVersion = 1;
         checkKeyFilePermissions(this.keyFile);
+        this.migrateToWrappedIfPassphrase();
         return this.key;
       }
       if (buf.length === VERSIONED_KEY_FILE_SIZE) {
@@ -1998,6 +2108,7 @@ var DefaultSecretVault = class {
         this.key = Buffer.from(key2);
         this._keyVersion = version;
         checkKeyFilePermissions(this.keyFile);
+        this.migrateToWrappedIfPassphrase();
         return this.key;
       }
       throw new ConfigError({
@@ -2010,11 +2121,20 @@ var DefaultSecretVault = class {
     }
     fs2.mkdirSync(path6.dirname(this.keyFile), { recursive: true });
     const key = randomBytes(KEY_BYTES);
+    const passphrase = getVaultPassphrase();
+    const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
     try {
-      fs2.writeFileSync(this.keyFile, key, { mode: 384, flag: "wx" });
+      fs2.writeFileSync(this.keyFile, initialBytes, { mode: 384, flag: "wx" });
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
       const buf = fs2.readFileSync(this.keyFile);
+      if (isWrappedKeyFile(buf)) {
+        const { key: winnerKey, version } = unwrapDataKey(buf, this.keyFile);
+        this.key = winnerKey;
+        this._keyVersion = version;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
+      }
       if (buf.length === KEY_BYTES) {
         this.key = buf;
         this._keyVersion = 1;
@@ -2618,17 +2738,9 @@ function findPreserveStart(messages, preserveK) {
     const prev = messages[preserveStart - 1];
     if (!first || !prev || first.role !== "user" || prev.role !== "assistant") break;
     if (typeof first.content === "string" || typeof prev.content === "string") break;
-    const resultIds = /* @__PURE__ */ new Set();
-    for (const block of first.content) {
-      pairRepairInnerIterations++;
-      if (block.type === "tool_result") resultIds.add(block.tool_use_id);
-    }
-    if (resultIds.size === 0) break;
-    const hasMatchingUse = prev.content.some((block) => {
-      pairRepairInnerIterations++;
-      return block.type === "tool_use" && resultIds.has(block.id);
-    });
-    if (!hasMatchingUse) break;
+    const pairCheck = hasMatchingToolPair(first.content, prev.content);
+    pairRepairInnerIterations += pairCheck.iterations;
+    if (!pairCheck.matched) break;
     preserveStart--;
   }
   if (compactionDebugEnabled()) {
@@ -2647,9 +2759,34 @@ function findPreserveStart(messages, preserveK) {
   }
   return preserveStart;
 }
+function hasMatchingToolPair(resultContent, useContent) {
+  let iterations = 0;
+  let firstResultId;
+  let resultIds;
+  for (const block of resultContent) {
+    iterations++;
+    if (block.type !== "tool_result") continue;
+    if (firstResultId === void 0) {
+      firstResultId = block.tool_use_id;
+    } else {
+      resultIds ??= /* @__PURE__ */ new Set([firstResultId]);
+      resultIds.add(block.tool_use_id);
+    }
+  }
+  if (firstResultId === void 0) return { matched: false, iterations };
+  for (const block of useContent) {
+    iterations++;
+    if (block.type !== "tool_use") continue;
+    if (resultIds ? resultIds.has(block.id) : block.id === firstResultId) {
+      return { matched: true, iterations };
+    }
+  }
+  return { matched: false, iterations };
+}
 function eliseOldToolResults(messages, opts) {
   const preserveStart = findPreserveStart(messages, opts.preserveK);
   let hasOversized = false;
+  let firstOversizedIndex = -1;
   let fastPathIterations = 0;
   let fastPathInnerIterations = 0;
   for (let i = 0; i < preserveStart && !hasOversized; i++) {
@@ -2661,6 +2798,7 @@ function eliseOldToolResults(messages, opts) {
       const oversized = b.type === "tool_result" && estimateToolResultTokens(b.content) >= opts.eliseThreshold || b.type === "tool_use" && estimateToolInputTokens(b.input) >= opts.eliseThreshold;
       if (oversized) {
         hasOversized = true;
+        firstOversizedIndex = i;
         break;
       }
     }
@@ -2683,26 +2821,29 @@ function eliseOldToolResults(messages, opts) {
   let changed = false;
   let fullPassIterations = 0;
   let fullPassInnerIterations = 0;
-  const next = new Array(messages.length);
-  for (let i = 0; i < messages.length; i++) {
+  let next;
+  for (let i = firstOversizedIndex; i < preserveStart; i++) {
     fullPassIterations++;
     const msg = messages[i];
-    if (i >= preserveStart || !msg || !Array.isArray(msg.content)) {
-      next[i] = msg;
-      continue;
-    }
+    if (!msg || !Array.isArray(msg.content)) continue;
     const original = msg.content;
-    const newContent = original.map((b) => {
+    let newContent;
+    for (let idx = 0; idx < original.length; idx++) {
+      fullPassInnerIterations++;
+      const b = original[idx];
+      if (!b) continue;
       if (b.type === "tool_use") {
         const tokens2 = estimateToolInputTokens(b.input);
-        if (tokens2 < opts.eliseThreshold) return b;
+        if (tokens2 < opts.eliseThreshold) continue;
         const elidedInput = summarizeToolUseInputElision(b, tokens2);
         saved += Math.max(0, tokens2 - estimateToolInputTokens(elidedInput));
-        return { ...b, input: elidedInput };
+        newContent ??= original.slice();
+        newContent[idx] = { ...b, input: elidedInput };
+        continue;
       }
-      if (b.type !== "tool_result") return b;
+      if (b.type !== "tool_result") continue;
       const tokens = estimateToolResultTokens(b.content);
-      if (tokens < opts.eliseThreshold) return b;
+      if (tokens < opts.eliseThreshold) continue;
       saved += tokens;
       const elided = {
         type: "tool_result",
@@ -2710,15 +2851,14 @@ function eliseOldToolResults(messages, opts) {
         content: summarizeToolResultElision(b, tokens),
         is_error: b.is_error
       };
-      return elided;
-    });
-    if (newContent.every((b, idx) => b === original[idx])) {
-      next[i] = msg;
-    } else {
+      newContent ??= original.slice();
+      newContent[idx] = elided;
+    }
+    if (newContent) {
+      next ??= messages.slice();
       next[i] = { ...msg, content: newContent };
       changed = true;
     }
-    fullPassInnerIterations += original.length;
     if (compactionDebugEnabled()) {
       const ratio = fullPassInnerIterations / fullPassIterations;
       if (ratio > 10) {
@@ -2745,7 +2885,7 @@ function eliseOldToolResults(messages, opts) {
     tokensSaved: saved,
     changed
   });
-  return { messages: changed ? next : messages, saved, changed };
+  return { messages: changed && next ? next : messages, saved, changed };
 }
 function summarizeToolUseInputElision(block, tokens) {
   const fields = {};
@@ -3471,6 +3611,7 @@ var DefaultSecretScrubber = class {
   }
 };
 var DEFAULT_URL = "https://models.dev/api.json";
+var ENV_URL_KEY = "WRONGSTACK_MODELS_DEV_URL";
 var DEFAULT_TTL_SECONDS = 24 * 3600;
 var DEFAULT_REFRESH_TIMEOUT_MS = 15e3;
 var FAMILY_BY_NPM = {
@@ -3516,7 +3657,7 @@ var DefaultModelsRegistry = class {
   overlayCacheFile;
   constructor(opts) {
     this.cacheFile = opts.cacheFile;
-    this.url = opts.url ?? DEFAULT_URL;
+    this.url = opts.url ?? process.env[ENV_URL_KEY] ?? DEFAULT_URL;
     this.ttlMs = (opts.ttlSeconds ?? DEFAULT_TTL_SECONDS) * 1e3;
     this.fetchImpl = opts.fetchImpl ?? fetch;
     this.seed = opts.seed;
@@ -3561,6 +3702,10 @@ var DefaultModelsRegistry = class {
       const cached = await this.readCacheAt(this.cacheFile);
       if (cached && this.isWithinMaxStaleAge(cached.fetchedAt)) {
         this.fetchedAt = new Date(cached.fetchedAt);
+        const ageSeconds = Math.floor((Date.now() - this.fetchedAt.getTime()) / 1e3);
+        console.warn(
+          `ModelsRegistry: models.dev unavailable (${toErrorMessage(err)}); using stale cache from ${formatAge(ageSeconds)} ago. Run \`wstack models refresh\` to retry.`
+        );
         return cached.payload;
       }
       if (overlayAvailable) {
@@ -3646,7 +3791,13 @@ var DefaultModelsRegistry = class {
       return json;
     } catch {
       const cached = await this.readCacheAt(this.overlayCacheFile);
-      if (cached && this.isWithinMaxStaleAge(cached.fetchedAt)) return cached.payload;
+      if (cached && this.isWithinMaxStaleAge(cached.fetchedAt)) {
+        const ageSeconds = Math.floor((Date.now() - new Date(cached.fetchedAt).getTime()) / 1e3);
+        console.warn(
+          `ModelsRegistry: overlay unavailable; using stale overlay from ${formatAge(ageSeconds)} ago.`
+        );
+        return cached.payload;
+      }
       return void 0;
     }
   }
@@ -3743,6 +3894,16 @@ var DefaultModelsRegistry = class {
     return path6.resolve(this.cacheFile);
   }
 };
+function formatAge(seconds) {
+  if (seconds < 60) return "<1m";
+  if (seconds < 3600) return `${Math.floor(seconds / 60)}m`;
+  if (seconds < 86400) {
+    const h = Math.floor(seconds / 3600);
+    const m = Math.floor(seconds % 3600 / 60);
+    return m > 0 ? `${h}h ${m}m` : `${h}h`;
+  }
+  return `${Math.floor(seconds / 86400)}d`;
+}
 function hasEntries(payload) {
   return payload !== void 0 && Object.keys(payload).length > 0;
 }