@wrongstack/core 0.286.0 → 0.287.0

package/dist/models/llm-selector.d.ts

@@ -1,6 +1,7 @@
 import type { Message } from '../types/messages.js';
 import type { Provider } from '../types/provider.js';
 import type { MessageSelector, SelectorResult } from '../types/selector.js';
+import type { OneShotOrchestrator } from '../execution/one-shot-llm.js';
 export interface LLMSelectorOptions {
     /** Provider used for the selector LLM call. Required. */
     provider: Provider;
@@ -22,6 +23,11 @@ export interface LLMSelectorOptions {
      * history text budget calculation (default: 1024).
      */
     maxOutputTokens?: number | undefined;
+    /**
+     * OneShotOrchestrator for the selector LLM call. When set, uses it
+     * instead of direct provider.complete(), gaining fallback chain support.
+     */
+    oneShotOrchestrator?: OneShotOrchestrator | undefined;
 }
 /**
  * LLM-powered message selector. Calls a sub-LLM to analyze the
@@ -34,6 +40,7 @@ export declare class LLMSelector implements MessageSelector {
     private readonly maxContextTokens;
     private readonly systemPrompt;
     private readonly maxOutputTokens;
+    private readonly oneShotOrchestrator?;
     constructor(opts: LLMSelectorOptions);
     select(messages: Message[], maxToKeep: number): Promise<SelectorResult>;
     private fallbackSelect;

package/dist/models/llm-selector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"llm-selector.d.ts","sourceRoot":"","sources":["../../src/models/llm-selector.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE5E,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,QAAQ,EAAE,QAAQ,CAAC;IACnB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAuCD;;;;GAIG;AACH,qBAAa,WAAY,YAAW,eAAe;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,YAAY,IAAI,EAAE,kBAAkB,EAcnC;IAEK,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAwD5E;IAED,OAAO,CAAC,cAAc;IAiCtB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;CAiF5B"}
+{"version":3,"file":"llm-selector.d.ts","sourceRoot":"","sources":["../../src/models/llm-selector.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,QAAQ,EAAE,QAAQ,CAAC;IACnB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACvD;AAuCD;;;;GAIG;AACH,qBAAa,WAAY,YAAW,eAAe;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAkC;IAEvE,YAAY,IAAI,EAAE,kBAAkB,EAenC;IAEK,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmE5E;IAED,OAAO,CAAC,cAAc;IAiCtB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;CAiF5B"}

package/dist/plugins/auto-review-plugin.d.ts

@@ -0,0 +1,36 @@
+import type { Plugin } from '../types/plugin.js';
+export interface AutoReviewConfig {
+    enabled?: boolean | undefined;
+    /** Provider for review subagents. Falls back to session provider. */
+    provider?: string | undefined;
+    /** Model for review subagents. Falls back to session model. */
+    model?: string | undefined;
+    /** Ordered fallback models chain. */
+    fallbackModels?: string[] | undefined;
+    /** Debounce window in ms — wait for quiet before firing review (default 5000). */
+    debounceMs?: number | undefined;
+    /** Max files per review batch (default 15). */
+    maxFilesPerBatch?: number | undefined;
+    /** Max concurrent in-flight reviews (default 2). */
+    maxConcurrentReviews?: number | undefined;
+    /**
+     * Cascade severity threshold: when a review finds findings at or above this
+     * level, spawn follow-up agents automatically. "off" disables cascading,
+     * "high" cascades on High+, "critical" cascades only on Critical.
+     * Default: "off".
+     */
+    cascadeOn?: 'off' | 'critical' | 'high' | undefined;
+}
+export interface ResolvedAutoReviewConfig {
+    enabled: boolean;
+    provider: string;
+    model: string;
+    fallbackModels: string[];
+    debounceMs: number;
+    maxFilesPerBatch: number;
+    maxConcurrentReviews: number;
+    cascadeOn: 'off' | 'critical' | 'high';
+}
+export declare function resolveAutoReviewConfig(cfg: AutoReviewConfig, sessionProvider: string, sessionModel: string): ResolvedAutoReviewConfig;
+export declare function createAutoReviewPlugin(): Plugin;
+//# sourceMappingURL=auto-review-plugin.d.ts.map

package/dist/plugins/auto-review-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-review-plugin.d.ts","sourceRoot":"","sources":["../../src/plugins/auto-review-plugin.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAQjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,qCAAqC;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACtC,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;CACrD;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,SAAS,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;CACxC;AAMD,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,gBAAgB,EACrB,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,MAAM,GACnB,wBAAwB,CAW1B;AAoID,wBAAgB,sBAAsB,IAAI,MAAM,CA4O/C"}

package/dist/plugins/chimera-plugin.d.ts

@@ -4,6 +4,13 @@ interface ChimeraConfig {
     provider?: string | undefined;
     model?: string | undefined;
     maxFiles?: number | undefined;
+    /**
+     * How to handle chimera review findings:
+     * - `off` (default): Send result to mailbox; leader waits for user command.
+     * - `ask`: Send ask to mailbox; leader prompts user for permission.
+     * - `auto`: Spawn a fix subagent automatically with the review report.
+     */
+    autoFix?: 'off' | 'ask' | 'auto' | undefined;
     /**
      * @deprecated Removed. The subagent's `Request.maxTokens` now defaults to
      * the provider's `capabilities.maxOutput`, so Chimera reports can run up
@@ -17,6 +24,7 @@ export interface ResolvedChimeraConfig {
     provider: string;
     model: string;
     maxFiles: number;
+    autoFix: 'off' | 'ask' | 'auto';
 }
 export declare function resolveChimeraConfig(cfg: ChimeraConfig, sessionProvider: string, sessionModel: string): ResolvedChimeraConfig;
 export interface ChimeraReviewNeededPayload {

package/dist/plugins/chimera-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chimera-plugin.d.ts","sourceRoot":"","sources":["../../src/plugins/chimera-plugin.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAQjD,UAAU,aAAa;IACrB,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,aAAa,EAClB,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,MAAM,GACnB,qBAAqB,CAOvB;AAKD,MAAM,WAAW,0BAA0B;IACzC,8BAA8B;IAC9B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/E;AAKD,eAAO,MAAM,qBAAqB,QAAsD,CAAC;AA+GzF,wBAAgB,mBAAmB,IAAI,MAAM,CA2G5C"}
+{"version":3,"file":"chimera-plugin.d.ts","sourceRoot":"","sources":["../../src/plugins/chimera-plugin.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAQjD,UAAU,aAAa;IACrB,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;CACjC;AAID,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,aAAa,EAClB,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,MAAM,GACnB,qBAAqB,CAQvB;AAKD,MAAM,WAAW,0BAA0B;IACzC,8BAA8B;IAC9B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/E;AAKD,eAAO,MAAM,qBAAqB,QAAsD,CAAC;AA4IzF,wBAAgB,mBAAmB,IAAI,MAAM,CA2G5C"}

package/dist/security/index.js

@@ -116,7 +116,12 @@ function hasCredentialAnchors(text) {
   text.includes("_TOKEN=") || // ACCESS_TOKEN=, AUTH_TOKEN=, ...
   text.includes("_SECRET=") || // API_SECRET=, CLIENT_SECRET=, ...
   text.includes("_PASSWORD=") || // DB_PASSWORD=, ROOT_PASSWORD=, ...
-  text.includes("mongodb://") || text.includes("mongodb+srv://") || text.includes("postgres://") || text.includes("postgresql://") || text.includes("mysql://") || text.includes("redis://");
+  text.includes("mongodb://") || text.includes("mongodb+srv://") || text.includes("postgres://") || text.includes("postgresql://") || text.includes("mysql://") || text.includes("redis://") || // JSON-style credential keys: tool outputs often serialise objects as
+  // raw JSON strings rather than parsed objects. The value may not start
+  // with a recognisable prefix (sk-, ghp_, etc.), so we anchor on common
+  // key names. The `"` prefix avoids matching prose that happens to mention
+  // these words — JSON serialisation always quotes string keys.
+  text.includes('"apiKey"') || text.includes('"api_key"') || text.includes('"token"') || text.includes('"secret"') || text.includes('"password"') || text.includes('"authorization"') || text.includes('"bearer"') || text.includes('"private_key"') || text.includes('"access_token"') || text.includes('"refresh_token"') || text.includes('"client_secret"');
 }
 var DefaultSecretScrubber = class {
   scrub(text) {
@@ -612,7 +617,7 @@ function walk(node, vault, transform) {
   }
   return out;
 }
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key)/i;
+var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
 var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
 function isSecretField(name) {
   const lc = name.toLowerCase();