@wrongstack/core 0.284.1 → 0.285.0

package/dist/secret-vault-DxohkUBc.d.ts

@@ -1,272 +0,0 @@
-import { g as Tool, d as Context } from './tool-BNlnIJvo.js';
-import { I as InputReader } from './input-reader-E-ffP2ee.js';
-import { P as PermissionPolicy, a as PermissionDecision } from './permission-ByDKXEcG.js';
-import { S as SecretScrubber } from './secret-scrubber-3MHDDAtm.js';
-import { L as Logger } from './logger-B63L5bTg.js';
-import { R as RotatableSecretVault, S as SecretVault } from './secret-vault-BAKpgFw_.js';
-
-interface PermissionPolicyOptions {
-    trustFile: string;
-    yolo?: boolean | undefined;
-    /**
-     * @deprecated Kept for CLI compatibility only. YOLO no longer bypasses
-     *   destructive-operation confirmation.
-     */
-    yoloDestructive?: boolean | undefined;
-    /** @deprecated Use `yoloDestructive`. */
-    forceAllYolo?: boolean | undefined;
-    /**
-     * @deprecated Destructive confirmation is always enabled in YOLO mode.
-     * Kept for compatibility with older callers.
-     */
-    confirmDestructive?: boolean | undefined;
-    promptDelegate?: (tool: Tool, input: unknown, suggestedPattern: string) => Promise<'yes' | 'no' | 'always' | 'deny'>;
-    inputReader?: InputReader | undefined;
-}
-declare class DefaultPermissionPolicy implements PermissionPolicy {
-    private policy;
-    private loaded;
-    private readonly trustFile;
-    private yolo;
-    private yoloDestructive;
-    /** When true, destructive ops still require confirmation even in YOLO mode. */
-    private confirmDestructive;
-    /**
-     * Session-scoped "soft deny" map. When the user presses 'n' (block once),
-     * the tool+pattern is added here. If the LLM retries in the same session,
-     * we return deny directly without asking again.
-     *
-     * Cleared on reload() since reload = fresh trust file snapshot.
-     */
-    private sessionDenied;
-    /**
-     * Session-scoped one-shot "soft trust" map. When the user presses 'y', the
-     * tool+pattern is added here so the immediate confirm re-run can proceed.
-     * The entry is consumed on first use; future calls must ask again unless the
-     * user chose persistent trust.
-     *
-     * Cleared on reload().
-     */
-    private sessionAllowed;
-    /**
-     * Interactive prompt delegate. When set, `evaluate()` calls it to get a
-     * user decision synchronously (CLI REPL path). When cleared (TUI / WebUI),
-     * `evaluate()` returns `confirm` so the caller can emit
-     * `tool.confirm_needed` for the UI layer to handle.
-     *
-     * Mutable so the host can switch from CLI-prompt to event-driven
-     * confirmation at runtime (e.g. when `--goal` forces TUI mode after
-     * the agent was already constructed).
-     */
-    private promptDelegate?;
-    /** Pre-compiled wildcard patterns — rebuilt on reload for O(1) lookup. */
-    private wildcardEntries;
-    /**
-     * Evaluate-result cache. Keyed by `tool.name::subject` so repeated calls
-     * with the same tool+input skip namespace matching, subject computation,
-     * pattern matching (matchAny), and YOLO destructive gating.
-     *
-     * Cleared on any state change (reload, trust, deny, yolo toggle) because
-     * the result depends on the full policy state. The write-tool smart-bypass
-     * (step 7 in `evaluate()`) is not cached since `ctx.hasRead()` changes
-     * dynamically within a session.
-     *
-     * P3 #17 (before-release.md): capped at 500 entries via LRU eviction. An
-     * iteration that evaluates thousands of unique tool+subject combinations
-     * (e.g. repeated `tool-help` or `bash` with different commands) can grow
-     * the cache without bound. 500 is far more than any single iteration needs;
-     * the LRU evicts the least-recently-used entries first.
-     */
-    private _evalCache;
-    constructor(opts: PermissionPolicyOptions);
-    /**
-     * Replace (or clear) the interactive prompt delegate at runtime.
-     * Used by the CLI to switch from inline prompts (REPL) to event-driven
-     * confirmation (TUI) when the run mode is determined after the policy
-     * was constructed (e.g. `--goal` auto-flipping to TUI).
-     */
-    setPromptDelegate(delegate: PermissionPolicyOptions['promptDelegate']): void;
-    /** Toggle YOLO (auto-approve) mode at runtime. */
-    setYolo(enabled: boolean): void;
-    /** Check whether YOLO mode is currently active. */
-    getYolo(): boolean;
-    /** Toggle the destructive YOLO override at runtime. */
-    setYoloDestructive(enabled: boolean): void;
-    /** Check whether the destructive YOLO override is active. */
-    getYoloDestructive(): boolean;
-    /** Toggle destructive confirmation gate (only meaningful when yolo is active). */
-    setConfirmDestructive(_enabled: boolean): void;
-    /** Check whether destructive confirmation gate is active. */
-    getConfirmDestructive(): boolean;
-    reload(): Promise<void>;
-    evaluate(tool: Tool, input: unknown, ctx: Context): Promise<PermissionDecision>;
-    private isDestructiveByCapability;
-    private isDestructiveYoloCall;
-    private isSensitiveReadCall;
-    trust(rule: {
-        tool: string;
-        pattern: string;
-    }): Promise<void>;
-    /** Persist a deny rule — this tool+pattern pair is permanently blocked. */
-    deny(rule: {
-        tool: string;
-        pattern: string;
-    }): Promise<void>;
-    /** Block this tool+pattern for the rest of this session (no trust file). */
-    denyOnce(rule: {
-        tool: string;
-        pattern: string;
-    }): void;
-    /** Auto-approve this tool+pattern once (no trust file). */
-    allowOnce(rule: {
-        tool: string;
-        pattern: string;
-    }): void;
-    private findNamespaceEntry;
-}
-/**
- * Auto-approving PermissionPolicy used for subagents. Subagents run
- * non-interactively under a director — they cannot answer permission
- * prompts, so a non-YOLO policy on the leader would silently hang the
- * delegated run on the first sensitive tool call. The user already
- * authorized the delegation when they invoked the leader; subagents
- * inherit that authorization automatically.
- *
- * Tool defaults of `permission: 'deny'` are still honored (this is a
- * subagent capability override, not a deny-bypass).
- *
- * 2026-06+: Primary decision is now based on declared `Tool.capabilities`
- * (capability allowlist / denylist model). The legacy name-based DENY set
- * is kept only for backward compatibility with tools that have not yet
- * declared capabilities.
- *
- * 2026-06-13+: Switched to allowlist-by-default. Only tools with explicitly
- * allowed capabilities are auto-approved. Everything else is denied.
- * Default allowed: fs.read, net.outbound (read-only, safe operations).
- */
-declare class AutoApprovePermissionPolicy implements PermissionPolicy {
-    private readonly allowedCapabilities;
-    constructor(allowedCapabilities?: readonly string[]);
-    private static isMcpTool;
-    evaluate(tool: Tool): Promise<PermissionDecision>;
-    trust(): Promise<void>;
-    deny(): Promise<void>;
-    denyOnce(): void;
-    allowOnce(): void;
-    reload(): Promise<void>;
-}
-
-declare class DefaultSecretScrubber implements SecretScrubber {
-    scrub(text: string): string;
-    private scrubOne;
-    /**
-     * Recursively scrub every string value in an object/array graph. Secrets can
-     * appear under any key — a URL query param, an `authorization` header, an
-     * arbitrarily-named nested field — so we don't gate recursion on key names.
-     * The per-string `scrub()` fast-path (anchor pre-scan) keeps this cheap: any
-     * value without a credential anchor returns immediately without regex work.
-     */
-    scrubObject<T>(obj: T): T;
-}
-
-interface SecretVaultOptions {
-    /** Absolute path to the key file. Created with mode 0o600 if missing. */
-    keyFile: string;
-}
-/**
- * Default vault: AES-256-GCM with a key stored at `keyFile` (mode 0o600).
- * The key is loaded lazily on first encrypt/decrypt; if it does not exist,
- * a fresh one is generated. Decryption of plaintext values is a no-op so
- * legacy configs continue to work.
- *
- * Key file format:
- *   - Legacy (v1): exactly 32 raw bytes
- *   - Versioned (v2+): 4-byte magic `WSKV` + 1-byte version + 32-byte key (37 bytes)
- *
- * Encrypted value format: `enc:v<N>:<iv>:<tag>:<ciphertext>` where N is the
- * key version. After rotation, encrypt() emits the new version prefix.
- */
-declare class DefaultSecretVault implements RotatableSecretVault {
-    private readonly keyFile;
-    private key?;
-    private _keyVersion;
-    constructor(opts: SecretVaultOptions);
-    /** Current key version. Starts at 1; incremented by rotateKey(). */
-    get keyVersion(): number;
-    isEncrypted(value: string): boolean;
-    encrypt(plaintext: string): string;
-    decrypt(value: string): string;
-    /**
-     * Generate a new encryption key, write it to disk, and increment the key version.
-     * After rotation, encrypt() emits the new version prefix (e.g. enc:v2:).
-     * The caller must re-encrypt existing config values (see rotateConfigKeys()).
-     */
-    rotateKey(): {
-        oldVersion: number;
-        newVersion: number;
-    };
-    /**
-     * If WRONGSTACK_VAULT_PASSPHRASE is set but the key on disk is still stored
-     * unwrapped (legacy v1 / versioned v2), re-write it in passphrase-wrapped (v3)
-     * form. The data key is preserved, so all existing ciphertext keeps
-     * decrypting. Best-effort: a write failure leaves the working unwrapped file
-     * in place and is not fatal to load.
-     */
-    private migrateToWrappedIfPassphrase;
-    private loadOrCreateKey;
-}
-/**
- * Walk a Config-shaped object and decrypt any apiKey-like fields in place,
- * returning a new object. Used by the config loader so the rest of the
- * system never has to know about the wire format.
- *
- * @param warn — callback for decryption warnings. Defaults to `console.warn`
- *   for backward compatibility; pass `logger.warn` when a structured logger
- *   is available (preferred in long-running/server contexts).
- */
-declare function decryptConfigSecrets<T>(cfg: T, vault: SecretVault, opts?: {
-    warn?: (msg: string) => void;
-}): T;
-declare function encryptConfigSecrets<T>(cfg: T, vault: SecretVault, _opts?: {
-    warn?: (msg: string) => void;
-}): T;
-declare function isSecretField(name: string): boolean;
-/**
- * Re-write `~/.wrongstack/config.json` (or any path) with all secret-bearing
- * fields encrypted. Used by the `wstack auth` subcommand.
- */
-declare function rewriteConfigEncrypted(configPath: string, vault: SecretVault, patch?: Record<string, unknown>): Promise<void>;
-/**
- * Scan a config file on disk for plaintext secret-bearing fields and
- * rewrite the file with them encrypted in place. Returns a count of how
- * many fields were migrated. Idempotent — calling on a fully-encrypted
- * file is a no-op and writes nothing. Used by the CLI on every boot so
- * users who had plaintext keys before the vault landed are upgraded
- * transparently.
- */
-declare function migratePlaintextSecrets(configPath: string, vault: SecretVault, logger?: Pick<Logger, 'warn'>): Promise<{
-    migrated: number;
-    file: string;
-}>;
-/**
- * Rotate the vault's encryption key and re-encrypt all secret-bearing
- * fields in a config file. This is the atomic key rotation operation:
- *
- * 1. Read the config file
- * 2. Decrypt all encrypted values with the old key
- * 3. Generate a new key (vault.rotateKey())
- * 4. Re-encrypt all values with the new key (new version prefix)
- * 5. Write the config file atomically
- *
- * Returns the number of fields re-encrypted and the version transition.
- * If the config file doesn't exist or has no encrypted fields, returns
- * { rotated: 0 } without modifying the key.
- */
-declare function rotateConfigKeys(configPath: string, vault: RotatableSecretVault, logger?: Pick<Logger, 'warn' | 'info'>): Promise<{
-    rotated: number;
-    oldVersion: number;
-    newVersion: number;
-    file: string;
-}>;
-
-export { AutoApprovePermissionPolicy as A, DefaultSecretVault as D, type PermissionPolicyOptions as P, type SecretVaultOptions as S, DefaultPermissionPolicy as a, DefaultSecretScrubber as b, rotateConfigKeys as c, decryptConfigSecrets as d, encryptConfigSecrets as e, isSecretField as i, migratePlaintextSecrets as m, rewriteConfigEncrypted as r };

package/dist/session-reader-7Esxrkpw.d.ts

@@ -1,155 +0,0 @@
-import { i as ContentBlock, S as SessionEvent, j as SessionMetadata, k as SessionStore } from './tool-BNlnIJvo.js';
-
-type AttachmentKind = 'text' | 'image' | 'file';
-interface AttachmentMeta {
-    /** Display label for the placeholder e.g. "123 lines" or "PNG 412 KB". */
-    label?: string | undefined;
-    /** Original filename if known. */
-    filename?: string | undefined;
-    /** MIME type if known. Required for images. */
-    mediaType?: string | undefined;
-}
-interface Attachment {
-    readonly id: string;
-    readonly kind: AttachmentKind;
-    readonly meta: AttachmentMeta;
-    /** In-memory payload. For images this is base64; for text/file it's the raw text. */
-    readonly data?: string | undefined;
-    /** Disk location if spooled. Mutually exclusive with `data` for large payloads. */
-    readonly path?: string | undefined;
-    readonly bytes: number;
-    readonly createdAt: string;
-}
-interface AttachmentRef {
-    readonly id: string;
-    readonly kind: AttachmentKind;
-    /** Index for display, e.g. `#1`. Stable for the lifetime of a session. */
-    readonly seq: number;
-    readonly meta: AttachmentMeta;
-}
-interface AddAttachmentInput {
-    kind: AttachmentKind;
-    data: string;
-    meta?: AttachmentMeta | undefined;
-}
-/**
- * Session-scoped store for content that is too big to inline in display
- * but must be sent to the model as a real ContentBlock. The input layer
- * (CLI/TUI) puts pasted text, dropped files, and pasted images here, gets
- * back a stable AttachmentRef, and shows a placeholder like `[pasted #1]`
- * to the user. At submit time, `expand()` swaps placeholders for the real
- * payload as ContentBlock[].
- */
-interface AttachmentStore {
-    add(input: AddAttachmentInput): Promise<AttachmentRef>;
-    get(id: string): Promise<Attachment | undefined>;
-    list(): AttachmentRef[];
-    /**
-     * Replace all known placeholder tokens in `text` (e.g. `[pasted #1]`,
-     * `[image #2]`) with the corresponding ContentBlock(s) and return the
-     * mixed array. Unknown placeholders are left as plain text.
-     */
-    expand(text: string): Promise<ContentBlock[]>;
-    clear(): Promise<void>;
-}
-
-/**
- * L2-A: SessionReader — query, replay, search, export over a `SessionStore`.
- *
- * Keeps a clean read-only interface (no `append`, no `delete`) so analytics
- * code can be wired against a store without granting it the writer surface.
- */
-type SessionEventType = SessionEvent['type'];
-interface SessionQuery {
-    /** Filter by start timestamp (ISO). Sessions started before this are excluded. */
-    since?: string | undefined;
-    /** Filter by start timestamp (ISO). Sessions started after this are excluded. */
-    until?: string | undefined;
-    /** Substring match against title (case-insensitive). */
-    titleContains?: string | undefined;
-    /** Filter by provider id. */
-    provider?: string | undefined;
-    /** Filter by model id. */
-    model?: string | undefined;
-    /** Minimum total tokens (input+output) to keep. */
-    minTokens?: number | undefined;
-    /** Limit result count. Defaults to no limit. */
-    limit?: number | undefined;
-}
-interface SessionSearchHit {
-    sessionId: string;
-    eventIndex: number;
-    ts: string;
-    type: SessionEventType;
-    /** Short snippet of the matched text — null for events without text content. */
-    snippet: string | null;
-}
-interface SessionSearchQuery {
-    /** Plain text or regex pattern. */
-    query: string;
-    /** Treat `query` as a regex. Defaults to false (literal substring). */
-    regex?: boolean | undefined;
-    /** Case-insensitive match. Defaults to true. */
-    caseInsensitive?: boolean | undefined;
-    /** Limit only to these event types. Defaults to all event types. */
-    types?: SessionEventType[] | undefined;
-    /** Limit hit count. Defaults to 100. */
-    limit?: number | undefined;
-}
-interface SessionExportOptions {
-    /** "markdown" produces a human-readable chat log; "json" passes through raw events. */
-    format: 'markdown' | 'json' | 'text';
-    /** Include tool_use/tool_result blocks. Defaults to true. */
-    includeTools?: boolean | undefined;
-    /** Include system/diagnostic events (errors, compaction). Defaults to true. */
-    includeDiagnostics?: boolean | undefined;
-}
-interface SessionSummaryLite {
-    id: string;
-    title: string;
-    startedAt: string;
-    endedAt?: string | undefined;
-    provider: string;
-    model: string;
-    tokenTotal: number;
-}
-interface SessionReader {
-    /** List sessions matching the query. Uses the underlying store's summary cache. */
-    query(q?: SessionQuery): Promise<SessionSummaryLite[]>;
-    /** Yield events for `sessionId` in chronological order. */
-    replay(sessionId: string): AsyncIterable<SessionEvent>;
-    /**
-     * Full-text/regex search across one or all sessions.
-     * @param sessionQuery - Optional filter to apply to sessions before searching events.
-     *                       Reduces I/O by loading events only from matching sessions.
-     */
-    search(q: SessionSearchQuery, sessionId?: string | undefined, sessionQuery?: SessionQuery): Promise<SessionSearchHit[]> | undefined;
-    /** Render a session for human or downstream-tool consumption. */
-    export(sessionId: string, opts: SessionExportOptions): Promise<string>;
-    /** Read the metadata header without loading the full event stream. */
-    metadata(sessionId: string): Promise<SessionMetadata>;
-}
-interface DefaultSessionReaderOptions {
-    store: SessionStore;
-}
-
-/**
- * L2-A: read-only view over a `SessionStore` with query, replay, search,
- * and export helpers. Implemented on top of the public `SessionStore`
- * surface so any concrete store can be inspected without re-implementation.
- */
-declare class DefaultSessionReader implements SessionReader {
-    private readonly store;
-    private readonly eventCache;
-    private readonly eventCacheMtimes;
-    private static readonly EVENT_CACHE_MAX_ENTRIES;
-    constructor(opts: DefaultSessionReaderOptions);
-    private loadCachedSessionData;
-    query(q?: SessionQuery): Promise<SessionSummaryLite[]>;
-    replay(sessionId: string): AsyncIterable<SessionEvent>;
-    search(q: SessionSearchQuery, sessionId?: string | undefined, sessionQuery?: SessionQuery): Promise<SessionSearchHit[]>;
-    export(sessionId: string, opts: SessionExportOptions): Promise<string>;
-    metadata(sessionId: string): Promise<SessionMetadata>;
-}
-
-export { type AttachmentStore as A, DefaultSessionReader as D, type SessionReader as S, type AddAttachmentInput as a, type AttachmentRef as b, type Attachment as c, type AttachmentKind as d, type AttachmentMeta as e, type DefaultSessionReaderOptions as f };

package/dist/task-format-GX0B1mMC.d.ts

@@ -1,23 +0,0 @@
-import { T as TaskType, a as TaskPriority, b as TaskStatus, c as TaskProgress } from './task-graph-CH3acNQ7.js';
-
-interface TaskItem {
-    id: string;
-    title: string;
-    description?: string | undefined;
-    type: TaskType;
-    priority: TaskPriority;
-    status: TaskStatus;
-    /** IDs of tasks this one depends on. */
-    dependsOn?: string[] | undefined;
-    /** Agent/subagent name assigned to this task. */
-    assignee?: string | undefined;
-    estimateHours?: number | undefined;
-    tags?: string[] | undefined;
-    createdAt: string;
-    updatedAt: string;
-}
-declare function computeTaskItemProgress(tasks: TaskItem[]): TaskProgress;
-declare function formatTaskProgress(tasks: TaskItem[]): string;
-declare function formatTaskList(tasks: TaskItem[]): string;
-
-export { type TaskItem as T, formatTaskProgress as a, computeTaskItemProgress as c, formatTaskList as f };