@wrongstack/core 0.282.0 → 0.282.2

package/README.md

@@ -12,7 +12,7 @@ If you're just using WrongStack from the terminal, install [`wrongstack`](../../
 pnpm add @wrongstack/core
 ```
 
-Requires **Node.js ≥ 22.0.0**.
+Requires **Node.js ≥ 22.19.0**.
 
 ## What's in here
 

package/dist/{agent-subagent-runner-Dksf0QVU.d.ts → agent-subagent-runner-DCczSoQj.d.ts}

@@ -1,12 +1,12 @@
-import { T as ToolCallPipelinePayload, a as ToolWrapper, E as ExtensionRegistry, S as SystemPromptContributor, b as ToolRegistry, P as ProviderRegistry, A as AgentPipelines, c as ToolExecutorLike, d as AgentInit, e as AgentInput, R as RunResult } from './index-D5HB7WkV.js';
-import { C as Container, R as ReadonlyPipeline, a as Renderer } from './pipeline-DM-CPTUs.js';
-import { E as EventBus, a as EventName, L as Listener } from './events-CovDylaH.js';
+import { T as ToolCallPipelinePayload, a as ToolWrapper, E as ExtensionRegistry, S as SystemPromptContributor, b as ToolRegistry, P as ProviderRegistry, A as AgentPipelines, c as ToolExecutorLike, d as AgentInit, e as AgentInput, R as RunResult } from './index-Dd-PJJ8A.js';
+import { C as Container, R as ReadonlyPipeline, a as Renderer } from './pipeline-ixSFe5jg.js';
+import { E as EventBus, a as EventName, L as Listener } from './events-BOv8h6I1.js';
 import { R as RetryPolicy, E as ErrorHandler } from './retry-policy-V67lBOJz.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { T as Tracer } from './observability-D-HZN_mF.js';
 import { P as PermissionPolicy } from './permission-B6YAtNFz.js';
 import { d as Context, J as JSONSchema, c as Request, e as Response, i as ContentBlock, s as TextBlock, g as Tool, P as Provider, t as RunOptions, U as Usage } from './tool-LVSLiE1s.js';
-import { W as WireFamily, H as HookEvent, f as HookMatcher, I as InProcessHook, C as Config, M as ModelsRegistry, h as ModelRuntimeConfig } from './config-BCAEJicb.js';
+import { W as WireFamily, H as HookEvent, f as HookMatcher, I as InProcessHook, C as Config, M as ModelsRegistry, h as ModelRuntimeConfig } from './config-DkCbA3Bw.js';
 import { b as Mailbox } from './mailbox-types-BGZWrYTJ.js';
 
 type BridgeMessageType = 'task' | 'result' | 'progress' | 'error' | 'heartbeat' | 'stop' | 'delegate' | 'budget_threshold';
@@ -857,8 +857,8 @@ interface SubagentConfig {
     worktree?: boolean | 'auto' | 'required' | 'off' | undefined;
     /**
      * Provider registry id (e.g. `'anthropic'`, `'openai'`, `'google'`).
-     * Allows a director to mix providers across siblings — one subagent on
-     * Sonnet, another on GPT-5, another on Haiku. Falls back to the
+     * Allows a director to mix providers across siblings — for example, one
+     * subagent on a planner model and another on a verifier model. Falls back to the
      * factory's default provider when omitted, which is the legacy
      * single-provider behavior.
      */

package/dist/{config-BCAEJicb.d.ts → config-DkCbA3Bw.d.ts}

@@ -441,6 +441,8 @@ interface ToolsConfig {
     defaultExecutionStrategy: 'parallel' | 'sequential' | 'smart';
     maxIterations: number;
     iterationTimeoutMs: number;
+    /** Hard upper bound for a single tool call timeout. Defaults to 5 minutes. */
+    maxToolTimeoutMs?: number | undefined;
     sessionTimeoutMs: number;
     perIterationOutputCapBytes: number;
     /**
@@ -695,6 +697,26 @@ interface MCPServerConfig {
      * eager connect at boot.
      */
     lazy?: boolean | undefined;
+    /**
+     * Allowlist of environment variable names to forward from the parent process
+     * to this MCP server's child process. The values are resolved from
+     * `process.env` at spawn time, NOT stored in the config file.
+     *
+     * Why this exists: WrongStack's `buildChildEnv()` security filter scrubs
+     * env vars whose names look like secrets (TOKEN, SECRET, AUTH, KEY, ...)
+     * from all child processes — this prevents a compromised MCP server from
+     * exfiltrating provider API keys. But most MCP servers (GitHub, Slack,
+     * Brave Search, ...) need their own API tokens from the environment.
+     * `passthroughEnv` is the explicit bypass: only vars listed here survive
+     * the filter, and they go through the `extra` path (unfiltered merge).
+     *
+     * Built-in presets declare their required env vars here so they work
+     * out of the box when the user has the corresponding env vars exported
+     * in their shell. Users can also add entries for custom servers.
+     *
+     * Example: passthroughEnv: ['GITHUB_PERSONAL_ACCESS_TOKEN', 'GITHUB_TOKEN']
+     */
+    passthroughEnv?: string[] | undefined;
 }
 interface LogConfig {
     level: 'error' | 'warn' | 'info' | 'debug' | 'trace';

package/dist/coordination/index.d.ts

@@ -1,24 +1,24 @@
-import { H as FleetManager, s as Director } from '../null-fleet-bus-DuvA8PIR.js';
-export { A as ACP_AGENTS, a as AGENTS_BY_PHASE, b as AGENT_CATALOG, c as ALL_AGENT_DEFINITIONS, d as ALL_FLEET_AGENTS, e as AUDIT_LOG_AGENT, f as AutoExtendCeiling, g as AutoExtendPolicy, B as BUG_HUNTER_AGENT, h as BugFinding, C as CollabBudgetConfig, i as CollabBudgetOverrides, j as CollabBudgetWarningPayload, k as CollabDebugReport, l as CollabSession, m as CollabSessionOptions, n as CreateDelegateToolOptions, o as CriticConcern, p as CriticEvaluation, D as DEFAULT_DIRECTOR_PREAMBLE, q as DEFAULT_SUBAGENT_BASELINE, r as DelegateHost, t as DirectorAlert, u as DirectorAlertLevel, v as DirectorCancelCollabPayload, w as DirectorPromptParts, x as DirectorSessionFactory, y as DirectorSessionFactoryOptions, F as FLEET_ROSTER, z as FLEET_ROSTER_BUDGETS, E as FLEET_ROSTER_WITHACP, G as FleetCostCapError, I as FleetManagerOptions, J as FleetRosterBudget, K as FleetSpawnBudgetError, L as FleetWorktreePolicy, M as ICoordinator, N as IFleetManager, O as InMemoryAgentBridge, P as InMemoryBridgeTransport, Q as LargeAnswerStore, R as NULL_FLEET_BUS, S as REFACTOR_PLANNER_AGENT, T as RefactorPhase, U as RefactorPlan, V as SECURITY_SCANNER_AGENT, W as SharedFileEntry, X as SharedFileSnapshot, Y as SubagentPromptParts, Z as TaskResultNotification, _ as WorktreeIntegrationError, $ as WorktreeIsolationDecision, a0 as WorktreeTaskRunnerOptions, a1 as WorktreeTaskStateUpdate, a2 as applyRosterBudget, a3 as attachAutoExtend, a4 as composeDirectorPrompt, a5 as composeSubagentPrompt, a6 as createDelegateTool, a7 as createMessage, a8 as getAgentDefinition, a9 as makeAskResultTool, aa as makeAskTool, ab as makeAssignTool, ac as makeAwaitTasksTool, ad as makeCollabDebugTool, ae as makeDirectorSessionFactory, af as makeFleetEmitTool, ag as makeFleetHealthTool, ag as makeFleetSessionTool, ag as makeFleetTool, ag as makeFleetUsageTool, ah as makeQualityGateTool, ai as makeRollUpTool, aj as makeSpawnTool, ak as makeTerminateAllTool, al as makeTerminateTool, am as makeWorkCompleteTool, an as resolveSubagentWorktreeDecision, ao as rosterSummaryFromConfigs, ap as subagentNeedsWorktree, aq as wrapSubagentRunnerWithWorktrees } from '../null-fleet-bus-DuvA8PIR.js';
-import { F as FleetBus, T as TaskSpec } from '../agent-subagent-runner-Dksf0QVU.js';
-export { a as AgentFactory, y as AgentFactoryResult, z as AgentRunnerOptions, E as BudgetExceededError, G as BudgetKind, H as BudgetLimits, I as BudgetNegotiationMode, J as BudgetThresholdDecision, K as BudgetThresholdHandler, L as BudgetThresholdSignal, N as BudgetUsage, Q as DECISION_TIMEOUT_MS, R as FleetEvent, U as FleetHandler, k as FleetUsage, l as FleetUsageAggregator, X as SubagentBudget, a1 as SubagentUsageSnapshot, a2 as TIMEOUT_PREEMPT_FRACTION, a4 as makeAgentSubagentRunner, a5 as withDisabledToolFiltering } from '../agent-subagent-runner-Dksf0QVU.js';
-import { E as EventBus, B as BrainArbiter, f as BrainDecisionOption, k as BrainRisk, h as BrainDecisionRequest, e as BrainDecision, i as BrainDecisionSource } from '../events-CovDylaH.js';
-export { g as BrainDecisionQueue, j as BrainFallback, D as DefaultBrainArbiter, l as DefaultBrainArbiterOptions, H as HumanEscalatingBrainArbiter, O as ObservableBrainArbiter, w as formatHumanPrompt } from '../events-CovDylaH.js';
+import { H as FleetManager, s as Director } from '../null-fleet-bus-BkptvIVo.js';
+export { A as ACP_AGENTS, a as AGENTS_BY_PHASE, b as AGENT_CATALOG, c as ALL_AGENT_DEFINITIONS, d as ALL_FLEET_AGENTS, e as AUDIT_LOG_AGENT, f as AutoExtendCeiling, g as AutoExtendPolicy, B as BUG_HUNTER_AGENT, h as BugFinding, C as CollabBudgetConfig, i as CollabBudgetOverrides, j as CollabBudgetWarningPayload, k as CollabDebugReport, l as CollabSession, m as CollabSessionOptions, n as CreateDelegateToolOptions, o as CriticConcern, p as CriticEvaluation, D as DEFAULT_DIRECTOR_PREAMBLE, q as DEFAULT_SUBAGENT_BASELINE, r as DelegateHost, t as DirectorAlert, u as DirectorAlertLevel, v as DirectorCancelCollabPayload, w as DirectorPromptParts, x as DirectorSessionFactory, y as DirectorSessionFactoryOptions, F as FLEET_ROSTER, z as FLEET_ROSTER_BUDGETS, E as FLEET_ROSTER_WITHACP, G as FleetCostCapError, I as FleetManagerOptions, J as FleetRosterBudget, K as FleetSpawnBudgetError, L as FleetWorktreePolicy, M as ICoordinator, N as IFleetManager, O as InMemoryAgentBridge, P as InMemoryBridgeTransport, Q as LargeAnswerStore, R as NULL_FLEET_BUS, S as REFACTOR_PLANNER_AGENT, T as RefactorPhase, U as RefactorPlan, V as SECURITY_SCANNER_AGENT, W as SharedFileEntry, X as SharedFileSnapshot, Y as SubagentPromptParts, Z as TaskResultNotification, _ as WorktreeIntegrationError, $ as WorktreeIsolationDecision, a0 as WorktreeTaskRunnerOptions, a1 as WorktreeTaskStateUpdate, a2 as applyRosterBudget, a3 as attachAutoExtend, a4 as composeDirectorPrompt, a5 as composeSubagentPrompt, a6 as createDelegateTool, a7 as createMessage, a8 as getAgentDefinition, a9 as makeAskResultTool, aa as makeAskTool, ab as makeAssignTool, ac as makeAwaitTasksTool, ad as makeCollabDebugTool, ae as makeDirectorSessionFactory, af as makeFleetEmitTool, ag as makeFleetHealthTool, ag as makeFleetSessionTool, ag as makeFleetTool, ag as makeFleetUsageTool, ah as makeKanbanQueueTool, ai as makeQualityGateTool, aj as makeRollUpTool, ak as makeSpawnTool, al as makeTerminateAllTool, am as makeTerminateTool, an as makeWorkCompleteTool, ao as resolveSubagentWorktreeDecision, ap as rosterSummaryFromConfigs, aq as subagentNeedsWorktree, ar as wrapSubagentRunnerWithWorktrees } from '../null-fleet-bus-BkptvIVo.js';
+import { F as FleetBus, T as TaskSpec } from '../agent-subagent-runner-DCczSoQj.js';
+export { a as AgentFactory, y as AgentFactoryResult, z as AgentRunnerOptions, E as BudgetExceededError, G as BudgetKind, H as BudgetLimits, I as BudgetNegotiationMode, J as BudgetThresholdDecision, K as BudgetThresholdHandler, L as BudgetThresholdSignal, N as BudgetUsage, Q as DECISION_TIMEOUT_MS, R as FleetEvent, U as FleetHandler, k as FleetUsage, l as FleetUsageAggregator, X as SubagentBudget, a1 as SubagentUsageSnapshot, a2 as TIMEOUT_PREEMPT_FRACTION, a4 as makeAgentSubagentRunner, a5 as withDisabledToolFiltering } from '../agent-subagent-runner-DCczSoQj.js';
+import { E as EventBus, B as BrainArbiter, f as BrainDecisionOption, k as BrainRisk, h as BrainDecisionRequest, e as BrainDecision, i as BrainDecisionSource } from '../events-BOv8h6I1.js';
+export { g as BrainDecisionQueue, j as BrainFallback, D as DefaultBrainArbiter, l as DefaultBrainArbiterOptions, H as HumanEscalatingBrainArbiter, O as ObservableBrainArbiter, w as formatHumanPrompt } from '../events-BOv8h6I1.js';
 import { b as Mailbox, c as MailboxSendInput, M as MailboxMessage, d as MailboxQuery, e as MailboxAckInput, f as MailboxAckBatchInput, a as MailboxAgentStatus, A as AgentRegistrationInput, g as AgentHeartbeatInput, P as PurgeOptions, j as PurgeResult, C as ClientRegistrationInput, h as ClientHeartbeatInput, i as ClientStatus } from '../mailbox-types-BGZWrYTJ.js';
 export { k as ClientSource, l as MailboxMessageType, m as MailboxTaskContext, R as ReadReceipts, n as RegisteredAgent, o as normalizeRecipient } from '../mailbox-types-BGZWrYTJ.js';
-import { b as AgentDefinition } from '../multi-agent-coordinator-4DC31QWu.js';
-export { T as AGENT_TOOL_PRESETS, c as AgentBudgetTier, d as AgentCapability, A as AgentPhase, e as DEFAULT_DISPATCH_ROLE, a as DefaultMultiAgentCoordinator, f as DispatchCandidate, D as DispatchClassifier, g as DispatchMethod, h as DispatchOptions, i as DispatchResult, H as HEAVY_BUDGET, L as LIGHT_BUDGET, M as MEDIUM_BUDGET, j as MultiAgentCoordinatorOptions, k as dispatchAgent, m as makeLLMClassifier, s as scoreAgents } from '../multi-agent-coordinator-4DC31QWu.js';
+import { b as AgentDefinition } from '../multi-agent-coordinator-BRqtpn-a.js';
+export { T as AGENT_TOOL_PRESETS, c as AgentBudgetTier, d as AgentCapability, A as AgentPhase, e as DEFAULT_DISPATCH_ROLE, a as DefaultMultiAgentCoordinator, f as DispatchCandidate, D as DispatchClassifier, g as DispatchMethod, h as DispatchOptions, i as DispatchResult, H as HEAVY_BUDGET, L as LIGHT_BUDGET, M as MEDIUM_BUDGET, j as MultiAgentCoordinatorOptions, k as dispatchAgent, m as makeLLMClassifier, s as scoreAgents } from '../multi-agent-coordinator-BRqtpn-a.js';
 import { A as AgentEntry } from '../session-registry-Dvg7i_IA.js';
 import { d as Context, g as Tool } from '../tool-LVSLiE1s.js';
-import { J as FleetSupervisorConfig, a as ModelMatrixEntry, C as Config, A as AdaptiveConcurrencyConfig } from '../config-BCAEJicb.js';
-import { G as GlobalMailbox } from '../global-mailbox-CNfgvRw3.js';
-export { aA as resolveProjectDir } from '../global-mailbox-CNfgvRw3.js';
+import { J as FleetSupervisorConfig, a as ModelMatrixEntry, C as Config, A as AdaptiveConcurrencyConfig } from '../config-DkCbA3Bw.js';
+import { G as GlobalMailbox } from '../global-mailbox-MDDFhLYh.js';
+export { aA as resolveProjectDir } from '../global-mailbox-MDDFhLYh.js';
 import { L as Logger } from '../logger-B63L5bTg.js';
 import 'node:events';
 import '../director-state-B_GPa78Q.js';
-import '../worktree-manager-BBXdJq-Y.js';
-import '../index-D5HB7WkV.js';
-import '../pipeline-DM-CPTUs.js';
+import '../worktree-manager-BrtjUFYk.js';
+import '../index-Dd-PJJ8A.js';
+import '../pipeline-ixSFe5jg.js';
 import '../permission-B6YAtNFz.js';
 import '../observability-D-HZN_mF.js';
 import '../secret-scrubber-3MHDDAtm.js';
@@ -684,7 +684,7 @@ declare function actionToAckInput(action: Exclude<MailboxMessageAction, 'soft-de
  *     mailbox,
  *     url: 'http://127.0.0.1:7788',
  *     probeIntervalMs: 15_000,
- *     onAlert: (event) => console.warn('mailbox bridge', event.kind),
+ *     onAlert: (event) => console.warn(event),
  *   });
  *   await watchdog.start();
  *   // ...later...