@wrongstack/core 0.284.1 → 0.285.0

package/dist/security/permission-policy.d.ts

@@ -0,0 +1,153 @@
+import type { Context } from '../core/context.js';
+import type { InputReader } from '../types/input-reader.js';
+import type { PermissionDecision, PermissionPolicy } from '../types/permission.js';
+import type { Tool } from '../types/tool.js';
+export interface PermissionPolicyOptions {
+    trustFile: string;
+    yolo?: boolean | undefined;
+    /**
+     * @deprecated Kept for CLI compatibility only. YOLO now auto-approves
+     *   every non-denied tool call, including destructive-classified calls.
+     */
+    yoloDestructive?: boolean | undefined;
+    /** @deprecated Use `yoloDestructive`. */
+    forceAllYolo?: boolean | undefined;
+    /**
+     * @deprecated Destructive confirmation is disabled in YOLO mode.
+     * Kept for compatibility with older callers.
+     */
+    confirmDestructive?: boolean | undefined;
+    promptDelegate?: (tool: Tool, input: unknown, suggestedPattern: string) => Promise<'yes' | 'no' | 'always' | 'deny'>;
+    inputReader?: InputReader | undefined;
+}
+export declare class DefaultPermissionPolicy implements PermissionPolicy {
+    private policy;
+    private loaded;
+    private readonly trustFile;
+    private yolo;
+    private yoloDestructive;
+    /** Deprecated compatibility flag; no longer gates YOLO calls. */
+    private confirmDestructive;
+    /**
+     * Session-scoped "soft deny" map. When the user presses 'n' (block once),
+     * the tool+pattern is added here. If the LLM retries in the same session,
+     * we return deny directly without asking again.
+     *
+     * Cleared on reload() since reload = fresh trust file snapshot.
+     */
+    private sessionDenied;
+    /**
+     * Session-scoped one-shot "soft trust" map. When the user presses 'y', the
+     * tool+pattern is added here so the immediate confirm re-run can proceed.
+     * The entry is consumed on first use; future calls must ask again unless the
+     * user chose persistent trust.
+     *
+     * Cleared on reload().
+     */
+    private sessionAllowed;
+    /**
+     * Interactive prompt delegate. When set, `evaluate()` calls it to get a
+     * user decision synchronously (CLI REPL path). When cleared (TUI / WebUI),
+     * `evaluate()` returns `confirm` so the caller can emit
+     * `tool.confirm_needed` for the UI layer to handle.
+     *
+     * Mutable so the host can switch from CLI-prompt to event-driven
+     * confirmation at runtime (e.g. when `--goal` forces TUI mode after
+     * the agent was already constructed).
+     */
+    private promptDelegate?;
+    /** Pre-compiled wildcard patterns — rebuilt on reload for O(1) lookup. */
+    private wildcardEntries;
+    /**
+     * Evaluate-result cache. Keyed by `tool.name::subject` so repeated calls
+     * with the same tool+input skip namespace matching, subject computation,
+     * and pattern matching (matchAny).
+     *
+     * Cleared on any state change (reload, trust, deny, yolo toggle) because
+     * the result depends on the full policy state. The write-tool smart-bypass
+     * (step 7 in `evaluate()`) is not cached since `ctx.hasRead()` changes
+     * dynamically within a session.
+     *
+     * P3 #17 (before-release.md): capped at 500 entries via LRU eviction. An
+     * iteration that evaluates thousands of unique tool+subject combinations
+     * (e.g. repeated `tool-help` or `bash` with different commands) can grow
+     * the cache without bound. 500 is far more than any single iteration needs;
+     * the LRU evicts the least-recently-used entries first.
+     */
+    private _evalCache;
+    constructor(opts: PermissionPolicyOptions);
+    /**
+     * Replace (or clear) the interactive prompt delegate at runtime.
+     * Used by the CLI to switch from inline prompts (REPL) to event-driven
+     * confirmation (TUI) when the run mode is determined after the policy
+     * was constructed (e.g. `--goal` auto-flipping to TUI).
+     */
+    setPromptDelegate(delegate: PermissionPolicyOptions['promptDelegate']): void;
+    /** Toggle YOLO (auto-approve) mode at runtime. */
+    setYolo(enabled: boolean): void;
+    /** Check whether YOLO mode is currently active. */
+    getYolo(): boolean;
+    /** Toggle the destructive YOLO override at runtime. */
+    setYoloDestructive(enabled: boolean): void;
+    /** Check whether the destructive YOLO override is active. */
+    getYoloDestructive(): boolean;
+    /** Toggle deprecated destructive confirmation compatibility flag. */
+    setConfirmDestructive(enabled: boolean): void;
+    /** Check deprecated destructive confirmation compatibility flag. */
+    getConfirmDestructive(): boolean;
+    reload(): Promise<void>;
+    evaluate(tool: Tool, input: unknown, ctx: Context): Promise<PermissionDecision>;
+    private isSensitiveReadCall;
+    trust(rule: {
+        tool: string;
+        pattern: string;
+    }): Promise<void>;
+    /** Persist a deny rule — this tool+pattern pair is permanently blocked. */
+    deny(rule: {
+        tool: string;
+        pattern: string;
+    }): Promise<void>;
+    /** Block this tool+pattern for the rest of this session (no trust file). */
+    denyOnce(rule: {
+        tool: string;
+        pattern: string;
+    }): void;
+    /** Auto-approve this tool+pattern once (no trust file). */
+    allowOnce(rule: {
+        tool: string;
+        pattern: string;
+    }): void;
+    private findNamespaceEntry;
+}
+/**
+ * Auto-approving PermissionPolicy used for subagents. Subagents run
+ * non-interactively under a director — they cannot answer permission
+ * prompts, so a non-YOLO policy on the leader would silently hang the
+ * delegated run on the first sensitive tool call. The user already
+ * authorized the delegation when they invoked the leader; subagents
+ * inherit that authorization automatically.
+ *
+ * Tool defaults of `permission: 'deny'` are still honored (this is a
+ * subagent capability override, not a deny-bypass).
+ *
+ * 2026-06+: Primary decision is now based on declared `Tool.capabilities`
+ * (capability allowlist / denylist model). The legacy name-based DENY set
+ * is kept only for backward compatibility with tools that have not yet
+ * declared capabilities.
+ *
+ * 2026-06-13+: Switched to allowlist-by-default. Only tools with explicitly
+ * allowed capabilities are auto-approved. Everything else is denied.
+ * Default allowed: fs.read, net.outbound (read-only, safe operations).
+ */
+export declare class AutoApprovePermissionPolicy implements PermissionPolicy {
+    private readonly allowedCapabilities;
+    constructor(allowedCapabilities?: readonly string[]);
+    private static isMcpTool;
+    evaluate(tool: Tool): Promise<PermissionDecision>;
+    trust(): Promise<void>;
+    deny(): Promise<void>;
+    denyOnce(): void;
+    allowOnce(): void;
+    reload(): Promise<void>;
+}
+//# sourceMappingURL=permission-policy.d.ts.map

package/dist/security/permission-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-policy.d.ts","sourceRoot":"","sources":["../../src/security/permission-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAe,MAAM,wBAAwB,CAAC;AAChG,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AA+G7C,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,yCAAyC;IACzC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACzC,cAAc,CAAC,EAAE,CACf,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,OAAO,EACd,gBAAgB,EAAE,MAAM,KACrB,OAAO,CAAC,KAAK,GAAG,IAAI,GAAG,QAAQ,GAAG,MAAM,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CACvC;AAED,qBAAa,uBAAwB,YAAW,gBAAgB;IAC9D,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,IAAI,CAAU;IACtB,OAAO,CAAC,eAAe,CAAU;IACjC,iEAAiE;IACjE,OAAO,CAAC,kBAAkB,CAAU;IACpC;;;;;;OAMG;IACH,OAAO,CAAC,aAAa,CAA8B;IACnD;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAA8B;IACpD;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc,CAAC,CAAwD;IAC/E,0EAA0E;IAC1E,OAAO,CAAC,eAAe,CAAyD;IAChF;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,UAAU,CAAiD;IAEnE,YAAY,IAAI,EAAE,uBAAuB,EAMxC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,QAAQ,EAAE,uBAAuB,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAE3E;IAED,kDAAkD;IAClD,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAG9B;IAED,mDAAmD;IACnD,OAAO,IAAI,OAAO,CAEjB;IAED,uDAAuD;IACvD,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAGzC;IAED,6DAA6D;IAC7D,kBAAkB,IAAI,OAAO,CAE5B;IAED,qEAAqE;IACrE,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAG5C;IAED,oEAAoE;IACpE,qBAAqB,IAAI,OAAO,CAE/B;IAEK,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAkB5B;IAEK,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA+JpF;IAED,OAAO,CAAC,mBAAmB;IAqBrB,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBlE;IAED,2EAA2E;IACrE,IAAI,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjE;IAED,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAGtD;IAED,2DAA2D;IAC3D,SAAS,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAGvD;IAGD,OAAO,CAAC,kBAAkB;CAO3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,2BAA4B,YAAW,gBAAgB;IAClE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAoB;IAExD,YAAY,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,EAMlD;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAIlB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA6CtD;IACK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;IACK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1B;IACD,QAAQ,IAAI,IAAI,CAEf;IACD,SAAS,IAAI,IAAI,CAEhB;IACK,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAE5B;CACF"}

package/dist/security/secret-scrubber.d.ts

@@ -0,0 +1,14 @@
+import type { SecretScrubber } from '../types/secret-scrubber.js';
+export declare class DefaultSecretScrubber implements SecretScrubber {
+    scrub(text: string): string;
+    private scrubOne;
+    /**
+     * Recursively scrub every string value in an object/array graph. Secrets can
+     * appear under any key — a URL query param, an `authorization` header, an
+     * arbitrarily-named nested field — so we don't gate recursion on key names.
+     * The per-string `scrub()` fast-path (anchor pre-scan) keeps this cheap: any
+     * value without a credential anchor returns immediately without regex work.
+     */
+    scrubObject<T>(obj: T): T;
+}
+//# sourceMappingURL=secret-scrubber.d.ts.map

package/dist/security/secret-scrubber.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scrubber.d.ts","sourceRoot":"","sources":["../../src/security/secret-scrubber.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AA4LlE,qBAAa,qBAAsB,YAAW,cAAc;IAC1D,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA6C1B;IAED,OAAO,CAAC,QAAQ;IA8BhB;;;;;;OAMG;IACH,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAexB;CACF"}

package/dist/security/secret-vault.d.ts

@@ -0,0 +1,87 @@
+import type { Logger } from '../types/logger.js';
+import type { RotatableSecretVault, SecretVault } from '../types/secret-vault.js';
+export interface SecretVaultOptions {
+    /** Absolute path to the key file. Created with mode 0o600 if missing. */
+    keyFile: string;
+}
+/**
+ * Default vault: AES-256-GCM with a key stored at `keyFile` (mode 0o600).
+ * The key is loaded lazily on first encrypt/decrypt; if it does not exist,
+ * a fresh one is generated. Decryption of plaintext values is a no-op so
+ * legacy configs continue to work.
+ *
+ * Key file format:
+ *   - Legacy (v1): exactly 32 raw bytes
+ *   - Versioned (v2+): 4-byte magic `WSKV` + 1-byte version + 32-byte key (37 bytes)
+ *
+ * Encrypted value format: `enc:v<N>:<iv>:<tag>:<ciphertext>` where N is the
+ * key version. After rotation, encrypt() emits the new version prefix.
+ */
+export declare class DefaultSecretVault implements RotatableSecretVault {
+    private readonly keyFile;
+    private key?;
+    private _keyVersion;
+    constructor(opts: SecretVaultOptions);
+    /** Current key version. Starts at 1; incremented by rotateKey(). */
+    get keyVersion(): number;
+    isEncrypted(value: string): boolean;
+    encrypt(plaintext: string): string;
+    decrypt(value: string): string;
+    /**
+     * Generate a new encryption key, write it to disk, and increment the key version.
+     * After rotation, encrypt() emits the new version prefix (e.g. enc:v2:).
+     * The caller must re-encrypt existing config values (see rotateConfigKeys()).
+     */
+    rotateKey(): {
+        oldVersion: number;
+        newVersion: number;
+    };
+    /**
+     * If WRONGSTACK_VAULT_PASSPHRASE is set but the key on disk is still stored
+     * unwrapped (legacy v1 / versioned v2), re-write it in passphrase-wrapped (v3)
+     * form. The data key is preserved, so all existing ciphertext keeps
+     * decrypting. Best-effort: a write failure leaves the working unwrapped file
+     * in place and is not fatal to load.
+     */
+    private migrateToWrappedIfPassphrase;
+    private loadOrCreateKey;
+}
+export { decryptConfigSecrets, encryptConfigSecrets, isSecretField } from './config-secrets.js';
+/**
+ * Re-write `~/.wrongstack/config.json` (or any path) with all secret-bearing
+ * fields encrypted. Used by the `wstack auth` subcommand.
+ */
+export declare function rewriteConfigEncrypted(configPath: string, vault: SecretVault, patch?: Record<string, unknown>): Promise<void>;
+/**
+ * Scan a config file on disk for plaintext secret-bearing fields and
+ * rewrite the file with them encrypted in place. Returns a count of how
+ * many fields were migrated. Idempotent — calling on a fully-encrypted
+ * file is a no-op and writes nothing. Used by the CLI on every boot so
+ * users who had plaintext keys before the vault landed are upgraded
+ * transparently.
+ */
+export declare function migratePlaintextSecrets(configPath: string, vault: SecretVault, logger?: Pick<Logger, 'warn'>): Promise<{
+    migrated: number;
+    file: string;
+}>;
+/**
+ * Rotate the vault's encryption key and re-encrypt all secret-bearing
+ * fields in a config file. This is the atomic key rotation operation:
+ *
+ * 1. Read the config file
+ * 2. Decrypt all encrypted values with the old key
+ * 3. Generate a new key (vault.rotateKey())
+ * 4. Re-encrypt all values with the new key (new version prefix)
+ * 5. Write the config file atomically
+ *
+ * Returns the number of fields re-encrypted and the version transition.
+ * If the config file doesn't exist or has no encrypted fields, returns
+ * { rotated: 0 } without modifying the key.
+ */
+export declare function rotateConfigKeys(configPath: string, vault: RotatableSecretVault, logger?: Pick<Logger, 'warn' | 'info'>): Promise<{
+    rotated: number;
+    oldVersion: number;
+    newVersion: number;
+    file: string;
+}>;
+//# sourceMappingURL=secret-vault.d.ts.map

package/dist/security/secret-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-vault.d.ts","sourceRoot":"","sources":["../../src/security/secret-vault.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AASlF,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;CACjB;AA+ID;;;;;;;;;;;;GAYG;AACH,qBAAa,kBAAmB,YAAW,oBAAoB;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,GAAG,CAAC,CAAqB;IACjC,OAAO,CAAC,WAAW,CAAa;IAEhC,YAAY,IAAI,EAAE,kBAAkB,EAEnC;IAED,oEAAoE;IACpE,IAAI,UAAU,IAAI,MAAM,CAIvB;IAED,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAElC;IAED,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CASjC;IAED,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAuC7B;IAED;;;;OAIG;IACH,SAAS,IAAI;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAwBtD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,4BAA4B;IAapC,OAAO,CAAC,eAAe;CAoIxB;AAMD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEhG;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,WAAW,EAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAuB7C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,oBAAoB,EAC3B,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GACrC,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA2DpF"}

package/dist/security/yolo-risk.d.ts

@@ -0,0 +1,11 @@
+export declare function getInputString(input: unknown, key: string): string | undefined;
+export declare function pathLooksInsideProject(rawPath: string, projectRoot: string | undefined): boolean;
+/**
+ * Best-effort detection of a *catastrophic* shell command — system-/disk-/
+ * home-wide, effectively irreversible destruction. `projectRoot` is accepted
+ * for signature stability but is intentionally unused: catastrophic targets are
+ * absolute (filesystem root, a drive root, the home directory, a system
+ * directory) and so are independent of where the project lives.
+ */
+export declare function isClearlyDestructiveBashCommand(command: string, projectRoot: string | undefined): boolean;
+//# sourceMappingURL=yolo-risk.d.ts.map

package/dist/security/yolo-risk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yolo-risk.d.ts","sourceRoot":"","sources":["../../src/security/yolo-risk.ts"],"names":[],"mappings":"AA+CA,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI9E;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAShG;AAsND;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,OAAO,CAWT"}

package/dist/{session-registry-Dvg7i_IA.d.ts → session-registry.d.ts}

@@ -1,6 +1,6 @@
 /** Live status of a single agent within a session. */
-type AgentLiveStatus = 'idle' | 'running' | 'streaming' | 'waiting_user' | 'error';
-interface AgentEntry {
+export type AgentLiveStatus = 'idle' | 'running' | 'streaming' | 'waiting_user' | 'error';
+export interface AgentEntry {
     /** Unique agent id (ULID or UUID). */
     id: string;
     /** Human-readable label (e.g. "leader", "bug-hunter #1"). */
@@ -33,8 +33,8 @@ interface AgentEntry {
     /** UTC ISO timestamp of last activity. */
     lastActivityAt: string;
 }
-type SessionLiveStatus = 'active' | 'idle' | 'closing' | 'stale';
-interface SessionRegistryEntry {
+export type SessionLiveStatus = 'active' | 'idle' | 'closing' | 'stale' | 'lost';
+export interface SessionRegistryEntry {
     sessionId: string;
     projectSlug: string;
     projectRoot: string;
@@ -58,7 +58,7 @@ interface SessionRegistryEntry {
     agentCount: number;
     agents: AgentEntry[];
 }
-declare class SessionRegistry {
+export declare class SessionRegistry {
     private readonly filePath;
     private heartbeatTimer;
     private currentSessionId;
@@ -123,7 +123,6 @@ declare class SessionRegistry {
     private writeAtomicFile;
     private pruneStaleTempFiles;
 }
-declare function getSessionRegistry(globalRoot?: string): SessionRegistry;
-declare function hasSessionRegistry(): boolean;
-
-export { type AgentEntry as A, type SessionLiveStatus as S, type AgentLiveStatus as a, SessionRegistry as b, type SessionRegistryEntry as c, getSessionRegistry as g, hasSessionRegistry as h };
+export declare function getSessionRegistry(globalRoot?: string): SessionRegistry;
+export declare function hasSessionRegistry(): boolean;
+//# sourceMappingURL=session-registry.d.ts.map

package/dist/session-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-registry.d.ts","sourceRoot":"","sources":["../src/session-registry.ts"],"names":[],"mappings":"AAoBA,sDAAsD;AACtD,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,SAAS,GACT,WAAW,GACX,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,eAAe,CAAC;IACxB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,0CAA0C;IAC1C,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,MAAM,GACN,SAAS,GACT,OAAO,GACP,MAAM,CAAC;AAEX,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,KAAK,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACnE,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,eAAe,EAAE,MAAM,CAAC;IACxB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAqDD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,gBAAgB,CAAuB;IAC/C;;;;OAIG;IACH,OAAO,CAAC,SAAS,CAAqC;IAEtD,YAAY,UAAU,EAAE,MAAM,EAE7B;IAID;;;OAGG;IACG,QAAQ,CACZ,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,iBAAiB,GAAG,YAAY,GAAG,QAAQ,CAAC,GAAG;QAC1F,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;KACnC,GACA,OAAO,CAAC,IAAI,CAAC,CAgDf;IAED;;;OAGG;IACG,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BtD;IAED;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAYjC;IAED;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAWhC;IAED;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAG5C;IAED;;OAEG;IACG,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAGtE;IAED;;OAEG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAGxE;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;YAIa,SAAS;YA8BT,YAAY;YAyDZ,YAAY;IA0D1B;;;;;;OAMG;YACW,cAAc;YA0Bd,iBAAiB;IAK/B,qEAAqE;YACvD,WAAW;YAKX,eAAe;YAyBf,mBAAmB;CA8BlC;AAKD,wBAAgB,kBAAkB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,eAAe,CASvE;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C"}

package/dist/skills/foreign-sources.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Well-known foreign coding-agent skill directories. All follow the
+ * agentskills.io `SKILL.md` format, so the same loader reads them — this just
+ * tells it WHERE each agent keeps them.
+ *
+ * Claude is handled separately by the loader (`claude-project` / `claude-user`
+ * sources); this list covers the OTHER agents. Every tool here stores skills
+ * under `~/.<tool>/skills` (+ `<project>/.<tool>/skills`).
+ *
+ * Dirs that don't exist are skipped gracefully, so listing many is cheap.
+ *
+ * NOTE: Cursor previously used a non-standard `skills-cursor` subdir. As of the
+ * 2026-07 alignment with the broader skills.sh / antfu-skills-cli / vercel-labs
+ * ecosystem, Cursor uses the standard `skills` subdir like everyone else.
+ * (`skills-cursor` was WrongStack-only and meant real Cursor skills were never
+ * discovered — see docs/skills.md.)
+ */
+export interface ForeignSkillTool {
+    /** Tool id — also the directory name segment (`~/.<id>/…`). */
+    id: string;
+    /** Skills subdirectory name under `~/.<id>/`. */
+    subdir: string;
+}
+export declare const FOREIGN_SKILL_TOOLS: readonly ForeignSkillTool[];
+/** Result of resolving a `foreignSources` config option. */
+export interface ResolvedForeignTools {
+    /** Tool ids that will be scanned (subset of {@link FOREIGN_SKILL_TOOLS}). */
+    ids: string[];
+    /** Tool ids the user asked for that aren't known — likely typos (e.g. `corser`). */
+    unknownIds: string[];
+}
+/**
+ * Resolve the `config.skills.foreignSources` option into the list of tool ids
+ * to scan. Kept for backward compatibility (returns only `ids`).
+ * - `false` → none
+ * - `string[]` → only those ids (unknown ids silently dropped — see
+ *   {@link resolveForeignToolIdsWithWarnings} to surface them)
+ * - `true` / `undefined` → all well-known tools
+ */
+export declare function resolveForeignToolIds(opt: boolean | string[] | undefined): string[];
+/**
+ * Like {@link resolveForeignToolIds}, but also returns tool ids the caller asked
+ * for that don't match any known agent. Callers that want to warn the user
+ * about a likely typo (e.g. `foreignSources: ["corser"]`) should prefer this.
+ *
+ * - `false` → none
+ * - `string[]` → known ids included, unknown ones returned in `unknownIds`
+ * - `true` / `undefined` → all well-known tools (no unknowns possible)
+ */
+export declare function resolveForeignToolIdsWithWarnings(opt: boolean | string[] | undefined): ResolvedForeignTools;
+/**
+ * Security tier bucket for a registry skill's `securityScore` (0–100).
+ * Mirrors the ags (agentskill-sh/ags) thresholds: skills below 30 need
+ * explicit confirmation before install.
+ */
+export type SkillSecurityTier = 'low' | 'medium' | 'high';
+/** Classify a 0–100 security score into a tier. 0/undefined → unknown → `low`. */
+export declare function securityScoreToTier(score: number | undefined | null): SkillSecurityTier;
+//# sourceMappingURL=foreign-sources.d.ts.map

package/dist/skills/foreign-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"foreign-sources.d.ts","sourceRoot":"","sources":["../../src/skills/foreign-sources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,EAAE,EAAE,MAAM,CAAC;IACX,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAQ1D,CAAC;AAKF,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,oFAAoF;IACpF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAEnF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,GAClC,oBAAoB,CAYtB;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE1D,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,iBAAiB,CAKvF"}

package/dist/skills/frontmatter.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Shared SKILL.md frontmatter parser + agentskills.io name validation.
+ *
+ * The SKILL.md format (https://agentskills.io/specification) is YAML
+ * frontmatter between `---` markers followed by a Markdown body. This parser is
+ * intentionally minimal — it handles the fields skills actually use, with YAML
+ * block scalars (`|` / `>`) for multi-line values and an indented map for
+ * `metadata`. It is NOT a general YAML parser; skill files are trusted markdown.
+ */
+export interface ParsedSkillFrontmatter {
+    name?: string | undefined;
+    description?: string | undefined;
+    /** WrongStack extension; informational only. */
+    version?: string | undefined;
+    license?: string | undefined;
+    compatibility?: string | undefined;
+    metadata?: Record<string, string> | undefined;
+    /** `allowed-tools` (spec, experimental) → split on whitespace. */
+    allowedTools?: string[] | undefined;
+}
+/**
+ * Parse the YAML frontmatter block from a raw SKILL.md file. Returns `{}` when
+ * there is no (or unclosed) frontmatter — callers treat that as "skip".
+ *
+ * Line endings are normalized first: CRLF (and lone CR) would otherwise leave a
+ * trailing `\r` on each line, and since `.` / `$` don't match `\r`, the
+ * `key: value` regex would fail on every line and silently drop the whole
+ * frontmatter. Real skill files are frequently CRLF (Windows / some editors).
+ */
+export declare function parseSkillFrontmatter(raw: string): ParsedSkillFrontmatter;
+/** Strip leading YAML frontmatter (`---\n…\n---`) from a SKILL.md file. */
+export declare function stripFrontmatter(raw: string): string;
+/** True when `name` matches the agentskills.io name format (chars + length only). */
+export declare function isValidSkillNameFormat(name: string): boolean;
+/**
+ * Validate a skill `name` against the agentskills.io spec:
+ * 1-64 chars; lowercase letters, digits, and single hyphens only; no
+ * leading/trailing/consecutive hyphens. Pass the parent directory name to also
+ * enforce the "name must match the parent directory" rule.
+ *
+ * Returns a list of human-readable violations (empty = valid).
+ */
+export declare function validateSkillName(name: string, parentDirName?: string): string[];
+//# sourceMappingURL=frontmatter.d.ts.map

package/dist/skills/frontmatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../src/skills/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC9C,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CACrC;AAKD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAMzE;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQpD;AAqFD,qFAAqF;AACrF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBhF"}

package/dist/skills/github-fetcher.d.ts

@@ -0,0 +1,38 @@
+export interface ParsedRef {
+    owner: string;
+    repo: string;
+    ref: string;
+}
+/**
+ * Parse a skill reference string.
+ * Formats: `user/repo` (default ref: main), `user/repo@ref`
+ */
+export declare function parseSkillRef(input: string): ParsedRef;
+export interface DownloadResult {
+    /** Temp directory containing the extracted repo. Caller must clean up. */
+    tempDir: string;
+}
+/**
+ * Resolve a GitHub auth token, if one is configured.
+ *
+ * Order: `WRONGSTACK_GITHUB_TOKEN` (WrongStack-specific override) → `GITHUB_TOKEN`
+ * → `GH_TOKEN` (the gh CLI convention). Returns `undefined` when none are set,
+ * which means only public repos can be fetched.
+ *
+ * Exposed for testing and for the installer's user-facing messaging (so it can
+ * say "set GITHUB_TOKEN to install private repos" rather than just "403").
+ */
+export declare function resolveGitHubToken(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Download and extract a GitHub repository tarball.
+ *
+ * Auth: reads `WRONGSTACK_GITHUB_TOKEN` / `GITHUB_TOKEN` / `GH_TOKEN` (in that
+ * order). Without a token only public repos work; with one, private repos the
+ * token can read also work, and the API rate limit is the authenticated
+ * (much higher) limit instead of the anonymous 60/hour.
+ *
+ * Returns the path to a temp directory with the extracted contents. The caller
+ * must remove it (the installer does this in a `finally`).
+ */
+export declare function downloadGitHubTarball(parsed: ParsedRef): Promise<DownloadResult>;
+//# sourceMappingURL=github-fetcher.d.ts.map

package/dist/skills/github-fetcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-fetcher.d.ts","sourceRoot":"","sources":["../../src/skills/github-fetcher.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAyBtD;AAED,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAK3F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,CAuHtF"}