@wrongstack/core 0.284.1 → 0.286.0

package/dist/registry/provider-registry.d.ts

@@ -0,0 +1,51 @@
+import type { ProviderConfig } from '../types/config.js';
+import type { WireFamily } from '../types/models-registry.js';
+import type { Provider } from '../types/provider.js';
+/**
+ * Factory for constructing a Provider instance. The `family` field
+ * declares the wire protocol so callers can route without inspecting
+ * the returned instance. The `type` is the registry key (e.g. a
+ * provider's models.dev id or a user-chosen alias).
+ */
+export interface ProviderFactory {
+    /**
+     * Unique identifier used as the registry key. When registered via
+     * a plugin, this becomes `cfg.type` in `ProviderRegistry.create(cfg)`.
+     */
+    type: string;
+    /**
+     * Declares the wire protocol family so consumers can route based on
+     * capability (e.g. which tool-format converter to use) without
+     * instantiating the provider.
+     */
+    family: WireFamily;
+    create(cfg: ProviderConfig): Provider;
+}
+export declare class ProviderRegistry {
+    private readonly factories;
+    /**
+     * Register a provider factory. If a factory with the same type already
+     * exists, it is replaced. Use this for both initial registration and
+     * runtime overrides (e.g. from plugins or CLI flags).
+     */
+    register(f: ProviderFactory): void;
+    /**
+     * Bulk-register multiple provider factories at once.
+     */
+    registerAll(factories: ProviderFactory[]): void;
+    /**
+     * Override an existing factory. Throws if no factory is registered
+     * for the given type. Use this to safely replace a provider at runtime
+     * (e.g. in tests or when a plugin provides a custom implementation).
+     */
+    override(type: string, f: ProviderFactory): void;
+    has(type: string): boolean;
+    /**
+     * Unregister a provider factory by type. Returns true if a factory was
+     * removed, false if none was registered for that type.
+     */
+    unregister(type: string): boolean;
+    create(cfg: ProviderConfig): Provider;
+    list(): string[];
+}
+//# sourceMappingURL=provider-registry.d.ts.map

package/dist/registry/provider-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.d.ts","sourceRoot":"","sources":["../../src/registry/provider-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,GAAG,EAAE,cAAc,GAAG,QAAQ,CAAC;CACvC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsC;IAEhE;;;;OAIG;IACH,QAAQ,CAAC,CAAC,EAAE,eAAe,GAAG,IAAI,CAEjC;IAED;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,IAAI,CAE9C;IAED;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,GAAG,IAAI,CAK/C;IAED,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzB;IAED;;;OAGG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhC;IAED,MAAM,CAAC,GAAG,EAAE,cAAc,GAAG,QAAQ,CAQpC;IAED,IAAI,IAAI,MAAM,EAAE,CAEf;CACF"}

package/dist/registry/slash-command-registry.d.ts

@@ -0,0 +1,61 @@
+import type { Context } from '../core/context.js';
+import type { SlashCommand } from '../types/slash-command.js';
+/**
+ * A slash command registered with the CLI or available to plugins.
+ * Plugins receive a view of the registry via PluginAPI.slashCommands.
+ *
+ * Commands registered by plugins use a namespaced name: `pluginName:commandName`.
+ * This prevents collisions with built-in commands and other plugins.
+ */
+export type { SlashCommand };
+export declare class SlashCommandRegistry {
+    private readonly cmds;
+    /**
+     * Register a command.
+     *
+     * Trust tiers, by `owner` and `opts.official`:
+     *
+     *  - **Built-ins** (`owner === 'core'`) and **official plugins**
+     *    (`opts.official === true`, set by the host only for first-party plugins
+     *    loaded from the built-in factory list) claim the **bare** command name
+     *    (`/prompts`). They may override one another — last write wins — so an
+     *    official plugin can replace a built-in. Official plugins are *also*
+     *    reachable under their `owner:name` namespace.
+     *  - **External plugins** (any other `owner`) are isolated under the
+     *    `owner:name` namespace: invocable only as `/owner:cmd`, never by bare
+     *    name, and unable to shadow or override a built-in or official command.
+     *
+     * Officiality is supplied by the host based on the plugin's load source, not
+     * self-declared by the plugin — an external plugin cannot name itself into
+     * the official tier.
+     */
+    register(cmd: SlashCommand, owner?: string, opts?: {
+        official?: boolean | undefined;
+    }): void;
+    unregister(name: string): boolean;
+    /**
+     * Bulk-register multiple slash commands at once.
+     */
+    registerAll(cmds: SlashCommand[], owner?: string): void;
+    get(name: string): SlashCommand | undefined;
+    ownerOf(name: string): string | undefined;
+    list(): SlashCommand[];
+    listWithOwner(): Array<{
+        cmd: SlashCommand;
+        owner: string;
+        fullName: string;
+    }>;
+    /**
+     * Parse a slash command line. Accepts both:
+     *   `/cmd args`          → builtin command (owner=core)
+     *   `/pluginName:cmd args` → plugin command
+     * The command name is split at the first `:` if the prefix matches a known owner.
+     */
+    dispatch(line: string, ctx: Context): Promise<{
+        exit?: boolean | undefined;
+        message?: string | undefined;
+        runText?: string | undefined;
+        metadata?: Record<string, unknown>;
+    } | null>;
+}
+//# sourceMappingURL=slash-command-registry.d.ts.map

package/dist/registry/slash-command-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slash-command-registry.d.ts","sourceRoot":"","sources":["../../src/registry/slash-command-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;GAMG;AACH,YAAY,EAAE,YAAY,EAAE,CAAC;AAG7B,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8E;IAEnG;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,SAAS,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,GAAG,IAAI,CAkC3F;IAED,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUhC;IAED;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,KAAK,SAAS,GAAG,IAAI,CAEtD;IAED,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAE1C;IAED,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExC;IAED,IAAI,IAAI,YAAY,EAAE,CAUrB;IAED,aAAa,IAAI,KAAK,CAAC;QAAE,GAAG,EAAE,YAAY,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAU7E;IAED;;;;;OAKG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,OAAO,GACX,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC,CAqChJ;CACF"}

package/dist/registry/tool-registry.d.ts

@@ -0,0 +1,154 @@
+import type { ToolDescriptionMode, ToolDescriptionModeConfig } from '../types/config.js';
+import type { Tool } from '../types/tool.js';
+/**
+ * A function that wraps (decorates) an existing tool. Receives the
+ * original tool and returns a modified version — typically the same
+ * tool with a wrapped `execute` / `executeStream`, or with modified
+ * metadata (description, permission).
+ *
+ * Use `ToolRegistry.wrap()` to apply; the wrapper is called immediately
+ * and the result replaces the registered tool. Multiple wraps stack —
+ * each wrapper receives the output of the previous.
+ *
+ * @example
+ * ```ts
+ * registry.wrap('read', (original) => ({
+ *   ...original,
+ *   async execute(input, ctx, opts) {
+ *     console.log('read called');
+ *     return original.execute(input, ctx, opts);
+ *   }
+ * }));
+ * ```
+ */
+export type ToolWrapper = (tool: Tool) => Tool;
+export declare class ToolRegistry {
+    private readonly tools;
+    private readonly descriptionModes;
+    /**
+     * Set of tool names that are disabled (hidden from list(), get() and all
+     * other public accessors). The underlying tool data stays in `_tools` so
+     * re-enable is a constant-time operation.
+     */
+    private readonly _disabled;
+    /** Monotonic version bumped on every registry mutation. */
+    private _version;
+    /** Cached `list()` result, frozen after build. Invalidated on _version change. */
+    private _listSnapshot;
+    private _listSnapshotVersion;
+    /** Pre-compute tool definition token estimate once at registration time. */
+    private _stampDefTokens;
+    /** Apply the description mode transform and stamp token estimates. */
+    private _prepareForStorage;
+    register(tool: Tool, owner?: string): void;
+    /**
+     * Attempt to register a tool. Returns true if successful, false if a tool
+     * with the same name is already registered. Useful in multi-agent or plugin
+     * scenarios where duplicate registration may be intentional.
+     */
+    tryRegister(tool: Tool, owner?: string): boolean;
+    /**
+     * Bulk-register multiple tools at once. Each tool that conflicts with an
+     * existing registration is silently skipped — use `registerAllOrThrow`
+     * if you want it to throw on conflicts.
+     */
+    registerAll(tools: Tool[], owner?: string): void;
+    /**
+     * Bulk-register and throw on the first conflict. Use when you need
+     * strict registration (e.g. at boot time).
+     */
+    registerAllOrThrow(tools: Tool[], owner?: string): void;
+    /**
+     * Register a tool as a default. If the tool name is already registered,
+     * this is a no-op — the existing registration (from core or another
+     * plugin) takes precedence. Use `override` to intentionally replace.
+     */
+    registerDefault(tool: Tool, owner?: string): void;
+    unregister(name: string): boolean;
+    /**
+     * Override an existing tool. Throws if the tool is not already registered.
+     * Plugins use this to replace built-in tools with custom implementations.
+     */
+    override(name: string, tool: Tool, owner?: string): void;
+    /**
+     * Wrap (decorate) an existing tool. The wrapper receives the current
+     * tool and must return a new tool — typically the same tool with a
+     * wrapped `execute` or `executeStream`. Throws if the tool is not
+     * registered.
+     *
+     * Multiple wraps stack: each wrapper gets the output of the previous.
+     *
+     * @example
+     * registry.wrap('bash', (t) => ({ ...t, permission: 'confirm' }));
+     */
+    wrap(name: string, wrapper: ToolWrapper, owner?: string): void;
+    setDescriptionMode(name: string, mode: ToolDescriptionMode): boolean;
+    getDescriptionMode(name: string): ToolDescriptionMode;
+    applyDescriptionModes(modes?: ToolDescriptionModeConfig): {
+        applied: number;
+        missing: string[];
+    };
+    get(name: string): Tool | undefined;
+    ownerOf(name: string): string | undefined;
+    /**
+     * Disable a tool by name. The tool is removed from all public accessors
+     * (list(), get(), listByCategory(), listWithOwner()) so it does NOT
+     * appear in the system prompt or provider request. The underlying
+     * registration is preserved in memory — use `enable()` to restore it.
+     *
+     * @returns `true` if the tool was found and disabled; `false` if the
+     *          tool is not registered or is already disabled.
+     */
+    disable(name: string): boolean;
+    /**
+     * Re-enable a previously disabled tool. The tool reappears in all
+     * public accessors and will be included in the next system prompt /
+     * provider request.
+     *
+     * @returns `true` if the tool was disabled and is now re-enabled;
+     *          `false` if the tool was not disabled.
+     */
+    enable(name: string): boolean;
+    /**
+     * Re-enable ALL currently disabled tools at once. Returns the number
+     * of tools that were re-enabled.
+     */
+    enableAll(): number;
+    /**
+     * Check whether a tool is currently disabled.
+     */
+    isDisabled(name: string): boolean;
+    /**
+     * Apply a list of tool names to disable. Tools not in the registry
+     * are silently ignored so config can reference future tools without
+     * error. Returns the number of tools actually disabled.
+     */
+    applyDisabled(names: readonly string[]): number;
+    /**
+     * Return the list of all disabled tool entries (tool + owner). Useful
+     * for the /tools slash command to show disabled tools alongside
+     * enabled ones.
+     */
+    listDisabled(): {
+        tool: Tool;
+        owner: string;
+    }[];
+    list(): Tool[];
+    /**
+     * Group tools by their `category` field. Tools without a category
+     * are placed under the key `""` (empty string). Returns a Map of
+     * category → tools, sorted by registration order within each category.
+     */
+    listByCategory(): Map<string, Tool[]>;
+    listWithOwner(): {
+        tool: Tool;
+        owner: string;
+    }[];
+    clear(): void;
+    /**
+     * Return a new ToolRegistry with the same registered tools and owners.
+     * Useful for creating filtered copies in multi-agent scenarios.
+     */
+    clone(): ToolRegistry;
+}
+//# sourceMappingURL=tool-registry.d.ts.map

package/dist/registry/tool-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-registry.d.ts","sourceRoot":"","sources":["../../src/registry/tool-registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAO7C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;AAE/C,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoD;IAC1E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0C;IAC3E;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAK;IACrB,kFAAkF;IAClF,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,oBAAoB,CAAM;IAElC,4EAA4E;IAC5E,OAAO,CAAC,eAAe;IAMvB,sEAAsE;IACtE,OAAO,CAAC,kBAAkB;IAK1B,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,SAAS,GAAG,IAAI,CAyBzC;IAED;;;;OAIG;IACH,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,SAAS,GAAG,OAAO,CAY/C;IAED;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,SAAS,GAAG,IAAI,CAE/C;IAED;;;OAGG;IACH,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,SAAS,GAAG,IAAI,CAEtD;IAED;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,SAAS,GAAG,IAAI,CAMhD;IAED,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIhC;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,SAAS,GAAG,IAAI,CAavD;IAED;;;;;;;;;;OAUG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,SAAS,GAAG,IAAI,CAiB7D;IAED,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAkBnE;IAED,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAEpD;IAED,qBAAqB,CACnB,KAAK,GAAE,yBAA8B,GACpC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAexC;IAED,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAGlC;IAED,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExC;IAID;;;;;;;;OAQG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK7B;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK5B;IAED;;;OAGG;IACH,SAAS,IAAI,MAAM,CAMlB;IAED;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhC;IAED;;;;OAIG;IACH,aAAa,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAM9C;IAED;;;;OAIG;IACH,YAAY,IAAI;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAO9C;IAED,IAAI,IAAI,IAAI,EAAE,CAUb;IAED;;;;OAIG;IACH,cAAc,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAapC;IAED,aAAa,IAAI;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAI/C;IAED,KAAK,IAAI,IAAI,CAKZ;IAED;;;OAGG;IACH,KAAK,IAAI,YAAY,CAiBpB;CACF"}

package/dist/replay/hash.d.ts

@@ -0,0 +1,31 @@
+import type { Request } from '../types/provider.js';
+/**
+ * Idea #2 from IDEAS.md — Deterministic Replay.
+ *
+ * The hash function is the foundation of replay: given a `Request`,
+ * produce a stable identifier so a recorded `Response` can be looked
+ * up later when we want to "re-run" the same agent loop without
+ * burning API credits.
+ *
+ * Stability rules:
+ *
+ *   - All object keys are sorted recursively before stringification.
+ *     Without this, two semantically identical requests that differ
+ *     only in key insertion order would produce different hashes.
+ *   - We hash ONLY the fields that affect the response: `model`,
+ *     `system`, `messages`, `tools`, `maxTokens`, and the four
+ *     sampling knobs (`temperature`, `topP`, `stopSequences`,
+ *     `toolChoice`). Anything else on the `Request` (metadata,
+ *     future extensions) is ignored so replay stays forward-compat.
+ *   - We serialize to JSON. The `ContentBlock` and `Message` shapes
+ *     are pure data; this works as long as no `undefined` values
+ *     sneak in (those get dropped by `JSON.stringify`, which is
+ *     fine — the structural diff is what matters).
+ *
+ * The SHA-256 output is hex-encoded and prefixed with the algorithm
+ * tag so a future migration to a different hash (e.g. blake3) is
+ * trivial to detect.
+ */
+export declare function stableStringify(value: unknown): string;
+export declare function hashRequest(request: Request): string;
+//# sourceMappingURL=hash.d.ts.map

package/dist/replay/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../src/replay/hash.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD;AAeD,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAgBpD"}

package/dist/replay/replay-provider-runner.d.ts

@@ -0,0 +1,53 @@
+import type { ReplayLogStore } from '../storage/replay-log-store.js';
+import type { ProviderRunner, RunProviderOptions } from '../types/provider-runner.js';
+import type { Response } from '../types/provider.js';
+/**
+ * ReplayProviderRunner — idea #2 from IDEAS.md.
+ *
+ * A drop-in `ProviderRunner` that wraps an inner runner and either
+ *   - records every (request, response) pair it observes (mode: 'record'),
+ *   - serves a recorded response when the request hash matches (mode: 'replay'),
+ *   - or does both: serve when present, record when not (mode: 'auto').
+ *
+ * Bind to `TOKENS.ProviderRunner` to completely replace the default
+ * runner. Or use `AgentExtension.wrapProviderRunner` to chain in
+ * alongside other extensions.
+ *
+ * Mode semantics:
+ *   - 'record' is the production mode. Every real API call is
+ *     persisted; the user can later `wstack replay <sessionId>` to
+ *     re-run with frozen responses.
+ *   - 'replay' is the debugging mode. The agent loop runs normally
+ *     (same permissions, same tool dispatch) but every LLM call
+ *     comes from the recorded log. If a request hash is not in the
+ *     log, we throw — the user is expected to either rebuild the
+ *     session or fall back to record mode.
+ *   - 'auto' is the warm-start mode for development. The first time
+ *     a particular request is seen, it's recorded; the next time
+ *     the same request is made, the recorded response is served.
+ *     This is the cheapest path to a deterministic test harness.
+ */
+export type ReplayMode = 'record' | 'replay' | 'auto';
+export interface ReplayProviderRunnerOptions {
+    log: ReplayLogStore;
+    sessionId: string;
+    mode: ReplayMode;
+    /**
+     * Optional logger — receives a debug line on every replay hit
+     * ("served cached response for hash sha256:…") and a warn on
+     * every miss in 'replay' mode (the throw that follows is the
+     * real signal, but the warn helps when the throw is caught
+     * upstream).
+     */
+    logger?: {
+        debug?: ((msg: string) => void) | undefined;
+        warn?: ((msg: string) => void) | undefined;
+    } | undefined;
+}
+export declare class ReplayProviderRunner implements ProviderRunner {
+    private readonly inner;
+    private readonly opts;
+    constructor(inner: ProviderRunner, opts: ReplayProviderRunnerOptions);
+    run(runOpts: RunProviderOptions): Promise<Response>;
+}
+//# sourceMappingURL=replay-provider-runner.d.ts.map

package/dist/replay/replay-provider-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-provider-runner.d.ts","sourceRoot":"","sources":["../../src/replay/replay-provider-runner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,cAAc,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB;;;;;;OAMG;IACH,MAAM,CAAC,EACH;QACE,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;QAC5C,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;KAC5C,GACD,SAAS,CAAC;CACf;AAED,qBAAa,oBAAqB,YAAW,cAAc;IAEvD,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFvB,YACmB,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,2BAA2B,EAChD;IAEE,GAAG,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmCxD;CACF"}

package/dist/{index-CbyuOE5y.d.ts → security/capabilities.d.ts}

@@ -1,5 +1,3 @@
-import './secret-vault-DxohkUBc.js';
-
 /**
  * Well-known tool capabilities used for authorization decisions.
  *
@@ -11,61 +9,61 @@ import './secret-vault-DxohkUBc.js';
  * - Subagent guards and future policies should primarily key off capabilities.
  * - Name-based denylists are legacy and will be phased down.
  */
-declare const ToolCapabilities: {
+export declare const ToolCapabilities: {
     /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
-    readonly SHELL_ARBITRARY: "shell.arbitrary";
+    readonly SHELL_ARBITRARY: 'shell.arbitrary';
     /** Can execute a restricted set of commands (the `exec` tool). */
-    readonly SHELL_RESTRICTED: "shell.restricted";
+    readonly SHELL_RESTRICTED: 'shell.restricted';
     /** Can run a restricted project formatter/linter-style command. */
-    readonly SHELL_EXEC: "shell.exec";
+    readonly SHELL_EXEC: 'shell.exec';
     /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
-    readonly FS_READ: "fs.read";
+    readonly FS_READ: 'fs.read';
     /** Can write / modify / delete files inside the project. */
-    readonly FS_WRITE: "fs.write";
+    readonly FS_WRITE: 'fs.write';
     /** Can write files outside the current project root (very high risk). */
-    readonly FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project";
+    readonly FS_WRITE_OUTSIDE_PROJECT: 'fs.write.outside-project';
     /** Can perform outbound network requests. */
-    readonly NET_OUTBOUND: "net.outbound";
+    readonly NET_OUTBOUND: 'net.outbound';
     /** Can mutate in-memory session todos only. */
-    readonly SESSION_TODO: "session.todo";
+    readonly SESSION_TODO: 'session.todo';
     /** Can mutate in-memory session mode only. */
-    readonly SESSION_MODE: "session.mode";
+    readonly SESSION_MODE: 'session.mode';
     /** Can inspect registered tool metadata. */
-    readonly TOOL_META: "tool.meta";
+    readonly TOOL_META: 'tool.meta';
     /** Can invoke arbitrary registered tools through a meta-tool. */
-    readonly TOOL_MUTATE_ANY: "tool.mutate.any";
+    readonly TOOL_MUTATE_ANY: 'tool.mutate.any';
     /** Can read persistent memory. */
-    readonly MEMORY_READ: "memory.read";
+    readonly MEMORY_READ: 'memory.read';
     /** Can write persistent memory. */
-    readonly MEMORY_WRITE: "memory.write";
+    readonly MEMORY_WRITE: 'memory.write';
     /** Can delete persistent memory. */
-    readonly MEMORY_DELETE: "memory.delete";
+    readonly MEMORY_DELETE: 'memory.delete';
     /** Proxies tools from external MCP servers (unknown capability). */
-    readonly MCP_PROXY: "mcp.proxy";
+    readonly MCP_PROXY: 'mcp.proxy';
     /** Can spawn or manage subagents / multi-agent tasks. */
-    readonly SUBAGENT_SPAWN: "subagent.spawn";
+    readonly SUBAGENT_SPAWN: 'subagent.spawn';
     /** Can inspect fleet/subagent coordination state without mutating it. */
-    readonly COORDINATION_FLEET_READ: "coordination.fleet.read";
+    readonly COORDINATION_FLEET_READ: 'coordination.fleet.read';
     /** Can publish attributed, schema-checked events onto the fleet bus. */
-    readonly COORDINATION_FLEET_EMIT: "coordination.fleet.emit";
+    readonly COORDINATION_FLEET_EMIT: 'coordination.fleet.emit';
     /** Can submit a task-local structured result to the parent Director. */
-    readonly COORDINATION_RESULT_SUBMIT: "coordination.result.submit";
+    readonly COORDINATION_RESULT_SUBMIT: 'coordination.result.submit';
     /** Can read or write inter-agent mailbox messages. */
-    readonly COORDINATION_MAIL: "coordination.mail";
+    readonly COORDINATION_MAIL: 'coordination.mail';
     /** Can schedule, inspect, or cancel in-session cron jobs. */
-    readonly COORDINATION_CRON: "coordination.cron";
+    readonly COORDINATION_CRON: 'coordination.cron';
     /** Can mutate global or session configuration / trust state. */
-    readonly CONFIG_MUTATE: "config.mutate";
+    readonly CONFIG_MUTATE: 'config.mutate';
     /** Can install packages or run package managers with side effects. */
-    readonly PACKAGE_INSTALL: "package.install";
+    readonly PACKAGE_INSTALL: 'package.install';
 };
-type ToolCapability = (typeof ToolCapabilities)[keyof typeof ToolCapabilities];
+export type ToolCapability = (typeof ToolCapabilities)[keyof typeof ToolCapabilities];
 /**
  * Set of capabilities that are considered dangerous for subagents by default.
  * Subagents should not receive these capabilities unless the leader explicitly
  * allows the specific tool at spawn time.
  */
-declare const DANGEROUS_FOR_SUBAGENTS: readonly ToolCapability[];
+export declare const DANGEROUS_FOR_SUBAGENTS: readonly ToolCapability[];
 /**
  * Wide capability allowlist for subagents that the user has authorized to act
  * with full developer power (the CLI fleet host applies this to any subagent
@@ -84,26 +82,25 @@ declare const DANGEROUS_FOR_SUBAGENTS: readonly ToolCapability[];
  *   - `subagent.spawn` — recursive delegation (the baseline prompt forbids it).
  *   - `config.mutate` — rewriting trust/config is privilege escalation, not work.
  */
-declare const WIDE_SUBAGENT_CAPABILITIES: readonly ToolCapability[];
+export declare const WIDE_SUBAGENT_CAPABILITIES: readonly ToolCapability[];
 /**
  * Check if a tool (or its capabilities array) includes any dangerous capability
  * for subagent execution.
  */
-declare function hasDangerousCapabilityForSubagents(toolOrCaps: {
+export declare function hasDangerousCapabilityForSubagents(toolOrCaps: {
     capabilities?: readonly string[] | undefined;
 } | readonly string[] | undefined): boolean;
 /**
  * Check if a tool declares a specific capability (or any of the provided ones).
  */
-declare function hasCapability(toolOrCaps: {
+export declare function hasCapability(toolOrCaps: {
     capabilities?: readonly string[] | undefined;
 } | readonly string[] | undefined, capability: ToolCapability | ToolCapability[]): boolean;
 /**
  * Returns the intersection of a tool's capabilities with the dangerous set.
  * Useful for logging and audit trails.
  */
-declare function getDangerousCapabilities(toolOrCaps: {
+export declare function getDangerousCapabilities(toolOrCaps: {
     capabilities?: readonly string[] | undefined;
 } | readonly string[] | undefined): ToolCapability[];
-
-export { DANGEROUS_FOR_SUBAGENTS as D, ToolCapabilities as T, WIDE_SUBAGENT_CAPABILITIES as W, type ToolCapability as a, hasDangerousCapabilityForSubagents as b, getDangerousCapabilities as g, hasCapability as h };
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/security/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/security/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB;IAC3B,4EAA4E;aAC5E,eAAe,EAAE,iBAAiB;IAElC,kEAAkE;aAClE,gBAAgB,EAAE,kBAAkB;IAEpC,mEAAmE;aACnE,UAAU,EAAE,YAAY;IAExB,4FAA4F;aAC5F,OAAO,EAAE,SAAS;IAElB,4DAA4D;aAC5D,QAAQ,EAAE,UAAU;IAEpB,yEAAyE;aACzE,wBAAwB,EAAE,0BAA0B;IAEpD,6CAA6C;aAC7C,YAAY,EAAE,cAAc;IAE5B,+CAA+C;aAC/C,YAAY,EAAE,cAAc;IAE5B,8CAA8C;aAC9C,YAAY,EAAE,cAAc;IAE5B,4CAA4C;aAC5C,SAAS,EAAE,WAAW;IAEtB,iEAAiE;aACjE,eAAe,EAAE,iBAAiB;IAElC,kCAAkC;aAClC,WAAW,EAAE,aAAa;IAE1B,mCAAmC;aACnC,YAAY,EAAE,cAAc;IAE5B,oCAAoC;aACpC,aAAa,EAAE,eAAe;IAE9B,oEAAoE;aACpE,SAAS,EAAE,WAAW;IAEtB,yDAAyD;aACzD,cAAc,EAAE,gBAAgB;IAEhC,yEAAyE;aACzE,uBAAuB,EAAE,yBAAyB;IAElD,wEAAwE;aACxE,uBAAuB,EAAE,yBAAyB;IAElD,wEAAwE;aACxE,0BAA0B,EAAE,4BAA4B;IAExD,sDAAsD;aACtD,iBAAiB,EAAE,mBAAmB;IAEtC,6DAA6D;aAC7D,iBAAiB,EAAE,mBAAmB;IAEtC,gEAAgE;aAChE,aAAa,EAAE,eAAe;IAE9B,sEAAsE;aACtE,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAEtF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,cAAc,EAa5D,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,cAAc,EAe/D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kCAAkC,CAChD,UAAU,EAAE;IAAE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,GAC3F,OAAO,CAKT;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE;IAAE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,EAC5F,UAAU,EAAE,cAAc,GAAG,cAAc,EAAE,GAC5C,OAAO,CAMT;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE;IAAE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,GAC3F,cAAc,EAAE,CAOlB"}

package/dist/security/config-secrets.d.ts

@@ -0,0 +1,25 @@
+import type { SecretVault } from '../types/secret-vault.js';
+/**
+ * Config-walking secret helpers, split out of secret-vault.ts so that
+ * consumers which only need the walk logic (config loader, provider-config
+ * watcher) don't pull the AES-GCM vault implementation — and its node:crypto
+ * imports — into their bundle chunk. Everything here operates purely through
+ * the `SecretVault` interface.
+ */
+/**
+ * Walk a Config-shaped object and decrypt any apiKey-like fields in place,
+ * returning a new object. Used by the config loader so the rest of the
+ * system never has to know about the wire format.
+ *
+ * @param warn — callback for decryption warnings. Defaults to `console.warn`
+ *   for backward compatibility; pass `logger.warn` when a structured logger
+ *   is available (preferred in long-running/server contexts).
+ */
+export declare function decryptConfigSecrets<T>(cfg: T, vault: SecretVault, opts?: {
+    warn?: (msg: string) => void;
+}): T;
+export declare function encryptConfigSecrets<T>(cfg: T, vault: SecretVault, _opts?: {
+    warn?: (msg: string) => void;
+}): T;
+export declare function isSecretField(name: string): boolean;
+//# sourceMappingURL=config-secrets.d.ts.map

package/dist/security/config-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-secrets.d.ts","sourceRoot":"","sources":["../../src/security/config-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;;GAMG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,GAAG,EAAE,CAAC,EACN,KAAK,EAAE,WAAW,EAClB,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACtC,CAAC,CAeH;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,GAAG,EAAE,CAAC,EACN,KAAK,EAAE,WAAW,EAClB,KAAK,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACvC,CAAC,CAEH;AAmCD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAInD"}

package/dist/security/index.d.ts

@@ -1,8 +1,7 @@
-export { A as AutoApprovePermissionPolicy, a as DefaultPermissionPolicy, b as DefaultSecretScrubber, D as DefaultSecretVault, P as PermissionPolicyOptions, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, c as rotateConfigKeys } from '../secret-vault-DxohkUBc.js';
-export { D as DANGEROUS_FOR_SUBAGENTS, T as ToolCapabilities, a as ToolCapability, g as getDangerousCapabilities, h as hasCapability, b as hasDangerousCapabilityForSubagents } from '../index-CbyuOE5y.js';
-import '../tool-BNlnIJvo.js';
-import '../input-reader-E-ffP2ee.js';
-import '../permission-ByDKXEcG.js';
-import '../secret-scrubber-3MHDDAtm.js';
-import '../logger-B63L5bTg.js';
-import '../secret-vault-BAKpgFw_.js';
+export { DefaultSecretScrubber } from './secret-scrubber.js';
+export { DefaultSecretVault, type SecretVaultOptions, rewriteConfigEncrypted, migratePlaintextSecrets, rotateConfigKeys, } from './secret-vault.js';
+export { decryptConfigSecrets, encryptConfigSecrets, isSecretField } from './config-secrets.js';
+export { DefaultPermissionPolicy, AutoApprovePermissionPolicy, type PermissionPolicyOptions, } from './permission-policy.js';
+export { TRUST_POLICY_JSON_SCHEMA, TRUST_POLICY_LIMITS, TRUST_POLICY_SCHEMA_VERSION, type TrustPolicyDiagnostic, type TrustPolicyDiagnosticCode, type TrustPolicyValidationResult, validateTrustPolicy, } from './permission-policy-schema.js';
+export { ToolCapabilities, DANGEROUS_FOR_SUBAGENTS, type ToolCapability, hasDangerousCapabilityForSubagents, hasCapability, getDangerousCapabilities, } from './capabilities.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,cAAc,EACnB,kCAAkC,EAClC,aAAa,EACb,wBAAwB,GACzB,MAAM,mBAAmB,CAAC"}