@wrongstack/core 0.270.0 → 0.272.0

package/dist/storage/index.js

@@ -1,9 +1,10 @@
-import { randomBytes, randomUUID, createHash } from 'crypto';
+import { createReadStream } from 'fs';
 import * as fsp from 'fs/promises';
 import * as path2 from 'path';
+import { createInterface } from 'readline';
+import { randomBytes, randomUUID, createHash } from 'crypto';
 import * as os from 'os';
 import { hostname } from 'os';
-import 'fs';
 
 // src/storage/session-store.ts
 async function atomicWrite(targetPath, content, opts = {}) {
@@ -430,8 +431,6 @@ function resolveWstackPaths(opts) {
     projectStatus: (projectHash2) => path2.join(globalRoot, "projects", projectHash2, "status.json")
   };
 }
-
-// src/storage/session-store.ts
 function sanitizeModel(model) {
   return model.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 40);
 }
@@ -442,6 +441,8 @@ function generateSessionId(startedAt, model) {
   const modelPart = model ? `_${sanitizeModel(model)}` : "";
   return `${date}/${time}Z${modelPart}_${suffix}`;
 }
+
+// src/storage/session-store.ts
 var DefaultSessionStore = class _DefaultSessionStore {
   dir;
   events;
@@ -459,6 +460,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
   _loadCache = /* @__PURE__ */ new Map();
   _indexCache = null;
   static LOAD_CACHE_MAX_ENTRIES = 50;
+  static LIST_SCAN_CONCURRENCY = 32;
   constructor(opts) {
     this.dir = opts.dir;
     this.events = opts.events;
@@ -681,15 +683,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         });
         return indexed.slice(0, limit);
       }
-      const ids = await this.collectSessionIds(this.dir);
-      const sessions = await Promise.all(ids.map((id) => this.summaryFor(id).catch(() => null)));
-      const out = sessions.filter((s) => s !== null);
-      out.sort((a, b) => {
-        if (a.startedAt < b.startedAt) return 1;
-        if (a.startedAt > b.startedAt) return -1;
-        return a.id.localeCompare(b.id);
-      });
-      return out.slice(0, limit);
+      return await this.listFromDirectoryScan(limit);
     } catch {
       return [];
     }
@@ -814,43 +808,102 @@ var DefaultSessionStore = class _DefaultSessionStore {
     this._indexCache = null;
     return valid.length;
   }
+  async listFromDirectoryScan(limit) {
+    const refs = await this.collectSessionFiles(this.dir);
+    const candidates = await mapWithConcurrency(
+      refs,
+      _DefaultSessionStore.LIST_SCAN_CONCURRENCY,
+      async (ref) => {
+        const manifest = await this.readSummaryManifest(ref.id);
+        if (manifest) return { summary: manifest, needsBackfill: false };
+        const summary = await this.summaryHeaderFor(ref);
+        return summary ? { summary, needsBackfill: true } : null;
+      }
+    );
+    const out = candidates.filter((s) => s !== null);
+    out.sort((a, b) => compareSessionSummaries(a.summary, b.summary));
+    const selected = out.slice(0, limit);
+    const summaries = await mapWithConcurrency(
+      selected,
+      Math.min(_DefaultSessionStore.LIST_SCAN_CONCURRENCY, Math.max(1, limit)),
+      async (candidate) => {
+        if (!candidate.needsBackfill) return candidate.summary;
+        return await this.summaryFor(candidate.summary.id).catch(() => candidate.summary);
+      }
+    );
+    return summaries.filter((s) => s !== null);
+  }
+  async collectSessionFiles(dir, prefix = "", depth = 0) {
+    let entries;
+    try {
+      entries = await fsp.readdir(dir, { withFileTypes: true });
+    } catch {
+      return [];
+    }
+    const dirEntries = [];
+    const files = [];
+    for (const entry of entries) {
+      if (entry.name.startsWith(".") && entry.name !== ".wrongstack") continue;
+      if (entry.name === "shared" || entry.name === "subagents" || entry.name === "attachments")
+        continue;
+      if (entry.isDirectory()) {
+        dirEntries.push(entry);
+      } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
+        if (entry.name === "_index.jsonl") continue;
+        const base = entry.name.replace(/\.jsonl$/, "");
+        const id = prefix ? `${prefix}/${base}` : base;
+        files.push({ id, filePath: path2.join(dir, entry.name) });
+      }
+    }
+    const childFileArrays = await Promise.all(
+      dirEntries.map((entry) => {
+        const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
+        return this.collectSessionFiles(path2.join(dir, entry.name), childPrefix, depth + 1);
+      })
+    );
+    return [...childFileArrays.flat(), ...files];
+  }
   /** Recursively collect session IDs from date-shard subdirectories.
    *  IDs include the date-prefix path (e.g. "2026-06-06/17-46-57Z_…").
    *  Skips `.jsonl`/`.summary.json` root files, dot-files, and
    *  sub-directories that belong to fleet/subagent sessions. */
   async collectSessionIds(dir, prefix = "", depth = 0) {
-    const ids = [];
     let entries;
     try {
       entries = await fsp.readdir(dir, { withFileTypes: true });
     } catch {
-      return ids;
+      return [];
     }
+    const dirEntries = [];
+    const fileIds = [];
     for (const entry of entries) {
       if (entry.name.startsWith(".") && entry.name !== ".wrongstack") continue;
       if (entry.name === "shared" || entry.name === "subagents" || entry.name === "attachments")
         continue;
       if (entry.isDirectory()) {
-        const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        ids.push(...await this.collectSessionIds(path2.join(dir, entry.name), childPrefix, depth + 1));
+        dirEntries.push(entry);
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
         if (entry.name === "_index.jsonl") continue;
         const base = entry.name.replace(/\.jsonl$/, "");
-        ids.push(prefix ? `${prefix}/${base}` : base);
+        fileIds.push(prefix ? `${prefix}/${base}` : base);
       }
     }
-    return ids;
+    const childIdArrays = await Promise.all(
+      dirEntries.map((entry) => {
+        const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
+        return this.collectSessionIds(path2.join(dir, entry.name), childPrefix, depth + 1);
+      })
+    );
+    return [...childIdArrays.flat(), ...fileIds];
   }
   async summaryFor(id) {
     const manifest = this.sessionPath(id, ".summary.json");
     const t0 = Date.now();
     let outcome = "success";
     let errorMsg;
+    const fromManifest = await this.readSummaryManifest(id, t0);
+    if (fromManifest) return fromManifest;
     try {
-      const raw = await fsp.readFile(manifest, "utf8");
-      this.emitRead(id, manifest, "summary", "success", Date.now() - t0);
-      return JSON.parse(raw);
-    } catch {
       const full = this.sessionPath(id, ".jsonl");
       const stat7 = await fsp.stat(full);
       const summary = await this.summarize(id, stat7.mtime.toISOString());
@@ -869,6 +922,78 @@ var DefaultSessionStore = class _DefaultSessionStore {
       errorMsg = "summary fallback \u2014 manifest rebuilt";
       this.emitRead(id, manifest, "summary", outcome, Date.now() - t0, errorMsg);
       return summary;
+    } catch (err) {
+      outcome = "failure";
+      errorMsg = toErrorMessage(err);
+      this.emitRead(id, manifest, "summary", outcome, Date.now() - t0, errorMsg);
+      return {
+        id,
+        title: "(damaged)",
+        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        model: "unknown",
+        provider: "unknown",
+        tokenTotal: 0
+      };
+    }
+  }
+  async readSummaryManifest(id, startTime = Date.now()) {
+    const manifest = this.sessionPath(id, ".summary.json");
+    try {
+      const raw = await fsp.readFile(manifest, "utf8");
+      this.emitRead(id, manifest, "summary", "success", Date.now() - startTime);
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  async summaryHeaderFor(ref) {
+    let mtime = (/* @__PURE__ */ new Date(0)).toISOString();
+    try {
+      const stat7 = await fsp.stat(ref.filePath);
+      if (!stat7.isFile()) {
+        return {
+          id: ref.id,
+          title: "(damaged)",
+          startedAt: stat7.mtime.toISOString(),
+          model: "unknown",
+          provider: "unknown",
+          tokenTotal: 0
+        };
+      }
+      mtime = stat7.mtime.toISOString();
+    } catch {
+      return null;
+    }
+    try {
+      for await (const event of this.iterSessionEvents(ref.filePath)) {
+        if (event.type === "session_start") {
+          return {
+            id: ref.id,
+            title: "(empty session)",
+            startedAt: event.ts,
+            model: event.model ?? "unknown",
+            provider: event.provider ?? "unknown",
+            tokenTotal: 0
+          };
+        }
+      }
+      return {
+        id: ref.id,
+        title: "(empty session)",
+        startedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
+        model: "unknown",
+        provider: "unknown",
+        tokenTotal: 0
+      };
+    } catch {
+      return {
+        id: ref.id,
+        title: "(damaged)",
+        startedAt: mtime,
+        model: "unknown",
+        provider: "unknown",
+        tokenTotal: 0
+      };
     }
   }
   /**
@@ -993,39 +1118,62 @@ var DefaultSessionStore = class _DefaultSessionStore {
   }
   async summarize(id, mtime) {
     try {
-      const data = await this.load(id);
-      const firstUser = data.events.find((e) => e.type === "user_input");
-      const title = firstUser && firstUser.type === "user_input" ? userInputTitle(firstUser.content) : "(empty session)";
+      const file = this.sessionPath(id, ".jsonl");
+      let title = "(empty session)";
+      let startedAt = (/* @__PURE__ */ new Date(0)).toISOString();
+      let endedAt;
+      let model = "unknown";
+      let provider = "unknown";
+      let tokenIn = 0;
+      let tokenOut = 0;
       let iterationCount = 0;
       let toolCallCount = 0;
       let toolErrorCount = 0;
       let fileChangeCount = 0;
       const toolBreakdown = {};
       let outcome;
-      const lastEvent = data.events[data.events.length - 1];
-      for (const e of data.events) {
-        if (e.type === "in_flight_start") iterationCount++;
+      let lastEventType;
+      let hasError = false;
+      let sawStart = false;
+      for await (const e of this.iterSessionEvents(file)) {
+        lastEventType = e.type;
+        if (e.type === "session_start") {
+          if (!sawStart) {
+            sawStart = true;
+            startedAt = e.ts;
+            model = e.model ?? "unknown";
+            provider = e.provider ?? "unknown";
+          }
+        } else if (e.type === "session_end") {
+          endedAt = e.ts;
+        } else if (e.type === "user_input") {
+          if (title === "(empty session)") title = userInputTitle(e.content);
+        } else if (e.type === "llm_response") {
+          tokenIn += e.usage.input ?? 0;
+          tokenOut += e.usage.output ?? 0;
+        } else if (e.type === "in_flight_start") iterationCount++;
         else if (e.type === "tool_call_start") {
           toolCallCount++;
           toolBreakdown[e.name] = (toolBreakdown[e.name] ?? 0) + 1;
         } else if (e.type === "tool_result" && e.isError) toolErrorCount++;
         else if (e.type === "file_snapshot") fileChangeCount += e.files.length;
+        else if (e.type === "error" || e.type === "provider_error") hasError = true;
       }
-      if (lastEvent?.type === "session_end") {
+      if (lastEventType === "session_end") {
         outcome = "completed";
-      } else if (lastEvent?.type === "in_flight_start") {
+      } else if (lastEventType === "in_flight_start") {
         outcome = "aborted";
-      } else if (data.events.some((e) => e.type === "error")) {
+      } else if (hasError) {
         outcome = "error";
       }
       return {
         id,
         title,
-        startedAt: data.metadata.startedAt,
-        endedAt: data.metadata.endedAt,
-        model: data.metadata.model ?? "unknown",
-        provider: data.metadata.provider ?? "unknown",
-        tokenTotal: data.usage.input + data.usage.output,
+        startedAt,
+        endedAt,
+        model,
+        provider,
+        tokenTotal: tokenIn + tokenOut,
         iterationCount: iterationCount > 0 ? iterationCount : void 0,
         toolCallCount: toolCallCount > 0 ? toolCallCount : void 0,
         toolErrorCount: toolErrorCount > 0 ? toolErrorCount : void 0,
@@ -1044,6 +1192,25 @@ var DefaultSessionStore = class _DefaultSessionStore {
       };
     }
   }
+  async *iterSessionEvents(file) {
+    const stream = createReadStream(file, { encoding: "utf8" });
+    const lines = createInterface({ input: stream, crlfDelay: Infinity });
+    try {
+      for await (const line of lines) {
+        if (!line.trim()) continue;
+        try {
+          const parsed = JSON.parse(line);
+          if (parsed !== null && typeof parsed === "object" && typeof parsed.type === "string" && typeof parsed.ts === "string") {
+            yield parsed;
+          }
+        } catch {
+        }
+      }
+    } finally {
+      lines.close();
+      stream.destroy();
+    }
+  }
   metaFromEvents(id, events) {
     const start = events.find((e) => e.type === "session_start");
     const end = events.findLast((e) => e.type === "session_end");
@@ -1707,6 +1874,27 @@ function userInputTitle(content) {
   const text = typeof content === "string" ? content : content.filter((b) => b.type === "text").map((b) => b.text).join(" ");
   return (text || "(non-text input)").slice(0, 60);
 }
+function compareSessionSummaries(a, b) {
+  if (a.startedAt < b.startedAt) return 1;
+  if (a.startedAt > b.startedAt) return -1;
+  return a.id.localeCompare(b.id);
+}
+async function mapWithConcurrency(items, concurrency, fn) {
+  if (items.length === 0) return [];
+  const out = new Array(items.length);
+  let next = 0;
+  const workerCount = Math.min(Math.max(1, concurrency), items.length);
+  const workers = Array.from({ length: workerCount }, async () => {
+    for (; ; ) {
+      const idx = next++;
+      if (idx >= items.length) return;
+      const item = items[idx];
+      if (item !== void 0) out[idx] = await fn(item);
+    }
+  });
+  await Promise.all(workers);
+  return out;
+}
 var QueueStore = class {
   file;
   // Use `| undefined` (not `?`) so exactOptionalPropertyTypes doesn't
@@ -2767,6 +2955,12 @@ var GraphMemoryBackend = class {
   edges = [];
   loadedScope = null;
   loaded = false;
+  /**
+   * Promise that resolves when the current in-flight _saveGraph completes.
+   * Tests call flush() to await this before deleting the backend or its temp dir.
+   * Each save operation chains onto the previous one so concurrent saves are serialised.
+   */
+  _saveDone = Promise.resolve();
   constructor(opts) {
     this.file = new FileMemoryBackend({ paths: opts.paths });
     this.graphFile = opts.graphPath ?? `${opts.paths.projectDir}/memory-graph.json`;
@@ -2793,7 +2987,8 @@ var GraphMemoryBackend = class {
         tags: entry.tags,
         priority: entry.priority
       });
-      for (const [, other] of this.nodes) {
+      const recentNodes = [...this.nodes.values()].slice(-100);
+      for (const other of recentNodes) {
         if (other.id === nodeId) continue;
         const sim = wordOverlap(entry.text, other.entry.text);
         const tagSim = sharedTags(entry.tags ?? [], other.tags ?? []);
@@ -2809,7 +3004,8 @@ var GraphMemoryBackend = class {
         }
       }
     }
-    await this.saveGraph(scope);
+    this._saveDone = this._saveGraph(scope);
+    await this._saveDone;
   }
   async forget(scope, query, filePath) {
     const removed = await this.file.forget(scope, query, filePath);
@@ -2824,7 +3020,8 @@ var GraphMemoryBackend = class {
       }
       for (const id of toRemove) this.nodes.delete(id);
       this.edges = this.edges.filter((e) => !toRemove.includes(e.from) && !toRemove.includes(e.to));
-      await this.saveGraph(scope);
+      this._saveDone = this._saveGraph(scope);
+      await this._saveDone;
     }
     return removed;
   }
@@ -2936,7 +3133,8 @@ var GraphMemoryBackend = class {
     this.loadedScope = scope;
     this.loaded = true;
   }
-  async saveGraph(scope) {
+  /** Fire-and-forget graph persistence. Named _saveGraph to signal it must not be awaited. */
+  async _saveGraph(scope) {
     this.loadedScope = scope;
     this.loaded = true;
     try {
@@ -2944,16 +3142,21 @@ var GraphMemoryBackend = class {
         nodes: [...this.nodes.entries()],
         edges: this.edges
       };
-      await fsp.mkdir(
-        this.graphFile.substring(0, this.graphFile.lastIndexOf("/")),
-        { recursive: true }
-      );
+      const dir = this.graphFile.substring(0, this.graphFile.lastIndexOf("/"));
+      await fsp.mkdir(dir, { recursive: true });
       const tmp = `${this.graphFile}.tmp`;
       await fsp.writeFile(tmp, JSON.stringify(data));
       await fsp.rename(tmp, this.graphFile);
     } catch {
     }
   }
+  /**
+   * Wait for all in-flight _saveGraph operations to complete.
+   * Call this before deleting the backend or its temp directory.
+   */
+  async flush() {
+    await this._saveDone;
+  }
 };
 function wordOverlap(a, b) {
   const wordsA = new Set(a.toLowerCase().split(/\s+/).filter((w) => w.length > 2));
@@ -3054,84 +3257,89 @@ var SessionMemoryConsolidator = class {
     this.minIterations = opts.minIterations ?? 2;
     this.maxExistingEntries = opts.maxExistingEntries ?? 15;
   }
-  afterRun = async (ctx, result) => {
+  afterRun = (ctx, result) => {
     if (result.status !== "done") return;
     if (!result.finalText || result.finalText.trim().length < 20) return;
     if (result.iterations < this.minIterations) return;
     const provider = this.provider ?? ctx.provider;
     if (!provider?.complete) return;
-    try {
-      const existingEntries = await this.memoryStore.list("project-memory", this.maxExistingEntries);
-      const prompt = buildConsolidationPrompt(
-        result.finalText,
-        result.iterations,
-        existingEntries
-      );
-      const signal = AbortSignal.timeout(15e3);
-      const response = await provider.complete(
-        {
-          model: this.model ?? ctx.model,
-          system: [{ type: "text", text: prompt }],
-          messages: [
-            { role: "user", content: "Review the session and return memory operations as JSON." }
-          ],
-          maxTokens: 500
-        },
-        { signal }
-      );
-      const text = response.content.filter((b) => b.type === "text").map((b) => b.text).join("").trim();
-      if (!text) return;
-      const jsonMatch = text.match(/\{[\s\S]*\}/);
-      if (!jsonMatch) return;
-      const parsed = JSON.parse(jsonMatch[0]);
-      if (!Array.isArray(parsed.operations) || parsed.operations.length === 0) return;
-      let added = 0;
-      let edited = 0;
-      let deleted = 0;
-      for (const op of parsed.operations) {
-        switch (op.action) {
-          case "add": {
-            if (op.text?.trim()) {
-              await this.memoryStore.remember(op.text.trim(), void 0, {
-                type: op.type,
-                tags: op.tags,
-                priority: op.priority
-              });
-              added++;
+    const _finalText = result.finalText;
+    const _iterations = result.iterations;
+    const _model = this.model ?? ctx.model;
+    void (async () => {
+      try {
+        const existingEntries = await this.memoryStore.list("project-memory", this.maxExistingEntries);
+        const prompt = buildConsolidationPrompt(
+          _finalText,
+          _iterations,
+          existingEntries
+        );
+        const signal = AbortSignal.timeout(15e3);
+        const response = await provider.complete(
+          {
+            model: _model,
+            system: [{ type: "text", text: prompt }],
+            messages: [
+              { role: "user", content: "Review the session and return memory operations as JSON." }
+            ],
+            maxTokens: 500
+          },
+          { signal }
+        );
+        const text = response.content.filter((b) => b.type === "text").map((b) => b.text).join("").trim();
+        if (!text) return;
+        const jsonMatch = text.match(/\{[\s\S]*\}/);
+        if (!jsonMatch) return;
+        const parsed = JSON.parse(jsonMatch[0]);
+        if (!Array.isArray(parsed.operations) || parsed.operations.length === 0) return;
+        let added = 0;
+        let edited = 0;
+        let deleted = 0;
+        for (const op of parsed.operations) {
+          switch (op.action) {
+            case "add": {
+              if (op.text?.trim()) {
+                await this.memoryStore.remember(op.text.trim(), void 0, {
+                  type: op.type,
+                  tags: op.tags,
+                  priority: op.priority
+                });
+                added++;
+              }
+              break;
             }
-            break;
-          }
-          case "edit": {
-            if (op.query && op.text?.trim()) {
-              await this.memoryStore.forget(op.query);
-              await this.memoryStore.remember(op.text.trim(), void 0, {
-                type: op.type,
-                tags: op.tags,
-                priority: op.priority
-              });
-              edited++;
+            case "edit": {
+              if (op.query && op.text?.trim()) {
+                await this.memoryStore.forget(op.query);
+                await this.memoryStore.remember(op.text.trim(), void 0, {
+                  type: op.type,
+                  tags: op.tags,
+                  priority: op.priority
+                });
+                edited++;
+              }
+              break;
             }
-            break;
-          }
-          case "delete": {
-            if (op.query) {
-              const n = await this.memoryStore.forget(op.query);
-              deleted += n;
+            case "delete": {
+              if (op.query) {
+                const n = await this.memoryStore.forget(op.query);
+                deleted += n;
+              }
+              break;
             }
-            break;
           }
         }
-      }
-      if (added > 0 || edited > 0 || deleted > 0) {
-        const parts = [];
-        if (added) parts.push(`${added} added`);
-        if (edited) parts.push(`${edited} edited`);
-        if (deleted) parts.push(`${deleted} deleted`);
-        process.stderr.write(`[memory] Session consolidation: ${parts.join(", ")}
+        if (added > 0 || edited > 0 || deleted > 0) {
+          const parts = [];
+          if (added) parts.push(`${added} added`);
+          if (edited) parts.push(`${edited} edited`);
+          if (deleted) parts.push(`${deleted} deleted`);
+          process.stderr.write(`[memory] Session consolidation: ${parts.join(", ")}
 `);
+        }
+      } catch {
       }
-    } catch {
-    }
+    })();
   };
 };
 
@@ -3297,8 +3505,13 @@ function deepFreeze(obj) {
   return Object.freeze(obj);
 }
 var KEY_BYTES = 32;
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
 var KEY_FILE_MAGIC = Buffer.from("WSKV", "ascii");
 KEY_FILE_MAGIC.length + 1 + KEY_BYTES;
+var KEK_MAGIC = Buffer.from("WSKW", "ascii");
+var KEK_SALT_BYTES = 16;
+KEK_MAGIC.length + 1 + KEK_SALT_BYTES + IV_BYTES + TAG_BYTES + KEY_BYTES;
 function decryptConfigSecrets(cfg, vault, opts) {
   const warn = ((msg) => console.warn(msg));
   return walk(cfg, vault, (v, key) => {
@@ -3514,6 +3727,42 @@ var defaultIndexing = {
   watchExternal: true,
   debounceMs: 400
 };
+var IN_PROJECT_FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
+  "provider",
+  "apiKey",
+  "baseUrl",
+  "providers",
+  "mcpServers",
+  "hooks",
+  "plugins",
+  "sync",
+  "yolo",
+  "extensions"
+]);
+function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => console.warn(msg)) {
+  const stripped = [];
+  const out = {};
+  for (const [k, v] of Object.entries(inProject)) {
+    if (IN_PROJECT_FORBIDDEN_KEYS.has(k)) {
+      stripped.push(k);
+      continue;
+    }
+    out[k] = v;
+  }
+  if (stripped.length > 0) {
+    warn(
+      JSON.stringify({
+        level: "warn",
+        event: "config.in_project_unsafe_fields_ignored",
+        path: sourcePath,
+        ignoredKeys: stripped,
+        message: `Ignored ${stripped.length} unsafe field(s) from the repo-committed config "${sourcePath}": ${stripped.join(", ")}. These can only be set in your personal ~/.wrongstack/config.json, not in a project-committed file.`,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+  }
+  return out;
+}
 function deepMerge2(base, patch) {
   const opts = { arrayMode: "concat-primitives" };
   if (envBoolOptional(process.env.WRONGSTACK_DEBUG_CONFIG)) {
@@ -3549,7 +3798,7 @@ var DefaultConfigLoader = class {
     ]);
     cfg = deepMerge2(cfg, global);
     cfg = deepMerge2(cfg, local);
-    cfg = deepMerge2(cfg, inProject);
+    cfg = deepMerge2(cfg, stripUnsafeInProjectFields(inProject, this.paths.inProjectConfig));
     for (const [key, fn] of Object.entries(ENV_MAP)) {
       const v = process.env[key];
       if (v) fn(cfg, v);
@@ -5814,6 +6063,9 @@ var AgentStatusTracker = class {
   leaderName;
   // Live agent map: agentId → AgentEntry
   agents = /* @__PURE__ */ new Map();
+  // Last full agent list flushed (leader + subagents). Lets external consumers
+  // read the current state synchronously without re-deriving it.
+  lastAgents = [];
   // Leader tracking
   leaderStatus = "idle";
   leaderCurrentTool;
@@ -5835,6 +6087,10 @@ var AgentStatusTracker = class {
     this.leaderName = opts.leaderName ?? "leader";
     this.onUpdate = opts.onUpdate;
   }
+  /** Current full agent list (leader + subagents) as of the last flush. */
+  getAgents() {
+    return this.lastAgents.length > 0 ? [...this.lastAgents] : [];
+  }
   start() {
     this.unsubscribers.push(
       this.events.onPattern("agent.run.started", () => {
@@ -6076,6 +6332,11 @@ var AgentStatusTracker = class {
       lastActivityAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     const allAgents = [leaderEntry, ...this.agents.values()];
+    this.lastAgents = allAgents;
+    try {
+      this.events.emit("session.agents_updated", { agents: allAgents });
+    } catch {
+    }
     this.registry.updateAgents(allAgents).then(() => {
       try {
         this.onUpdate?.();
@@ -7831,6 +8092,6 @@ function resolveSessionLoggingConfig(cfg) {
   };
 }
 
-export { ALL_SYNC_CATEGORIES, AgentStatusTracker, AnnotationsStore, CORE_RECONSTRUCT_EVENTS, CloudSync, ConfigMigrationError, DEFAULT_CONFIG_MIGRATIONS, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultMemoryStore, DefaultPromptStore, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, DirectorStateCheckpoint, FileMemoryBackend, FleetNotifier, GraphMemoryBackend, MAX_JOURNAL_ENTRIES, MAX_PROGRESS_HISTORY, QueueStore, RecoveryLock, ReplayLogStore, STANDARD_AUDIT_EVENTS, SessionAnalyzer, SessionMemoryConsolidator, SessionRecovery, SessionRegistry, ToolAuditLog, addPlanItem, appendJournal, attachPlanCheckpoint, attachTodosCheckpoint, clearPlan, createSessionEventBridge, deriveTodosFromPlanItem, emptyGoal, emptyPlan, emptyTaskFile, formatGoal, formatPlan, formatPlanTemplates, getPlanTemplate, getSessionRegistry, goalFilePath, hasSessionRegistry, listPlanTemplates, loadDirectorState, loadGoal, loadPlan, loadTasks, loadTodosCheckpoint, mutatePlan, mutateTasks, parseEntries, parseProgressFromText, recordProgress, removePlanItem, resolveAuditLevel, resolveSessionLoggingConfig, runConfigMigrations, saveGoal, savePlan, saveTasks, saveTodosCheckpoint, setPlanItemStatus, setProgress, summarizeUsage };
+export { ALL_SYNC_CATEGORIES, AgentStatusTracker, AnnotationsStore, CORE_RECONSTRUCT_EVENTS, CloudSync, ConfigMigrationError, DEFAULT_CONFIG_MIGRATIONS, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultMemoryStore, DefaultPromptStore, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, DirectorStateCheckpoint, FileMemoryBackend, FleetNotifier, GraphMemoryBackend, MAX_JOURNAL_ENTRIES, MAX_PROGRESS_HISTORY, QueueStore, RecoveryLock, ReplayLogStore, STANDARD_AUDIT_EVENTS, SessionAnalyzer, SessionMemoryConsolidator, SessionRecovery, SessionRegistry, ToolAuditLog, addPlanItem, appendJournal, attachPlanCheckpoint, attachTodosCheckpoint, clearPlan, createSessionEventBridge, deriveTodosFromPlanItem, emptyGoal, emptyPlan, emptyTaskFile, formatGoal, formatPlan, formatPlanTemplates, generateSessionId, getPlanTemplate, getSessionRegistry, goalFilePath, hasSessionRegistry, listPlanTemplates, loadDirectorState, loadGoal, loadPlan, loadTasks, loadTodosCheckpoint, mutatePlan, mutateTasks, parseEntries, parseProgressFromText, recordProgress, removePlanItem, resolveAuditLevel, resolveSessionLoggingConfig, runConfigMigrations, sanitizeModel, saveGoal, savePlan, saveTasks, saveTodosCheckpoint, setPlanItemStatus, setProgress, summarizeUsage };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map