@wrongstack/core 0.287.0 → 0.291.0

package/dist/plugins/chimera-plugin.d.ts

@@ -11,6 +11,19 @@ interface ChimeraConfig {
      * - `auto`: Spawn a fix subagent automatically with the review report.
      */
     autoFix?: 'off' | 'ask' | 'auto' | undefined;
+    /**
+     * Cascade severity threshold for follow-up agents. When the post-session
+     * review finds findings at or above this level, security-scanner and/or
+     * bug-hunter agents are spawned to investigate and fix. Mirrors the
+     * auto-review plugin's cascadeOn. Default: "off" (no cascade).
+     */
+    cascadeOn?: 'off' | 'critical' | 'high' | undefined;
+    /**
+     * Maximum cascade fix→re-review cycles before the self-correcting loop
+     * stops. Default: 2. 0 disables re-review (fix agents run once, no
+     * re-check). Mirrors the auto-review plugin's maxCascadeDepth.
+     */
+    maxCascadeDepth?: number | undefined;
     /**
      * @deprecated Removed. The subagent's `Request.maxTokens` now defaults to
      * the provider's `capabilities.maxOutput`, so Chimera reports can run up
@@ -25,20 +38,166 @@ export interface ResolvedChimeraConfig {
     model: string;
     maxFiles: number;
     autoFix: 'off' | 'ask' | 'auto';
+    cascadeOn: 'off' | 'critical' | 'high';
+    maxCascadeDepth: number;
 }
 export declare function resolveChimeraConfig(cfg: ChimeraConfig, sessionProvider: string, sessionModel: string): ResolvedChimeraConfig;
-export interface ChimeraReviewNeededPayload {
+/**
+ * A single changed file with its content and, for modified files, a
+ * unified diff against HEAD so the reviewer can focus on what changed.
+ */
+export interface ReviewFileEntry {
+    path: string;
+    status: 'added' | 'modified';
+    content: string;
+    /**
+     * Unified diff against HEAD for modified files.
+     * For added files, this is undefined (content is the full file).
+     * Capped at a reasonable size to avoid bloating the subagent task.
+     */
+    diff?: string | undefined;
+}
+/**
+ * Context bundle that enriches a review beyond "here are N files."
+ * Collects the *story*: what task motivated the change, what else
+ * changed alongside it, and what the recent commit history looks like.
+ *
+ * The review subagent receives this so it can:
+ * - Focus on the diff (what changed) rather than re-reviewing unchanged code
+ * - Understand the task intent (todos, narrative) to judge correctness
+ * - See sibling changes for cross-file consistency
+ * - Avoid re-reporting known issues (commit history context)
+ */
+export interface ReviewContextBundle {
     /** Resolved chimera config */
     config: ResolvedChimeraConfig;
     /** Project root for git operations */
     cwd: string;
-    /** Changed files with their contents */
-    files: Array<{
+    /** Changed files with their contents and diffs */
+    files: ReviewFileEntry[];
+    /**
+     * Auto-review-specific fallback chain, already resolved to provider/model refs.
+     * Absent for ordinary Chimera and manual review triggers.
+     */
+    reviewFallbackModels?: string[] | undefined;
+    /**
+     * Cascade severity threshold from the auto-review plugin config.
+     * When the review subagent finds findings at or above this level, a
+     * follow-up agent (security-scanner, bug-hunter) is spawned to
+     * investigate. Set by the auto-review plugin when it builds the
+     * bundle; absent for chimera-plugin and /review triggers (no cascade).
+     *
+     * `'off'` disables cascading; `'high'` cascades on High+; `'critical'`
+     * cascades only on Critical.
+     */
+    cascadeOn?: 'off' | 'critical' | 'high' | undefined;
+    /**
+     * Current cascade iteration depth (0 for the initial review, 1 after
+     * the first fix+re-review cycle, etc.). The cascade handler increments
+     * this on each re-review emission and stops when it reaches
+     * `maxCascadeDepth`. Absent (treated as 0) for non-cascade triggers.
+     */
+    cascadeDepth?: number | undefined;
+    /**
+     * Maximum cascade iterations before the self-correcting loop stops.
+     * Prevents infinite fix → re-review → fix cycles. Default 2. Set by
+     * the auto-review plugin; absent for non-cascade triggers.
+     */
+    maxCascadeDepth?: number | undefined;
+    /**
+     * All files changed in the working tree, including ones not in the
+     * current review batch. Lets the reviewer understand the broader
+     * change set without expanding its review scope.
+     */
+    allChangedFiles?: Array<{
         path: string;
-        status: 'added' | 'modified';
+        status: string;
+    }> | undefined;
+    /**
+     * Recent commit messages (oneline), newest first.
+     * Helps the reviewer understand what was already committed vs.
+     * what's still uncommitted working-tree changes.
+     */
+    recentCommits?: string[] | undefined;
+    /**
+     * Active todo items from the session Context at review-trigger time.
+     * Lets the reviewer understand what task motivated the file changes
+     * so it can judge correctness against intent, not just code shape.
+     */
+    activeTodos?: Array<{
+        id: string;
         content: string;
-    }>;
+        status: string;
+    }> | undefined;
+    /**
+     * The active kanban card, if the session uses a kanban board.
+     * Provides title, description, and success criteria so the
+     * reviewer can verify the change satisfies the stated requirements.
+     */
+    kanbanCard?: {
+        id: string;
+        title: string;
+        description?: string | undefined;
+        successCriteria?: string[] | undefined;
+    } | undefined;
+    /**
+     * File provenance from the Chronicle journal: which agent/session/task
+     * last touched each file and when. Helps the reviewer attribute
+     * changes and understand the broader edit chain.
+     */
+    fileProvenance?: Array<{
+        path: string;
+        agentId?: string | undefined;
+        taskId?: string | undefined;
+        eventType?: string | undefined;
+        observedAt?: string | undefined;
+    }> | undefined;
+}
+/** Legacy alias — the payload type is the bundle type. */
+export type ChimeraReviewNeededPayload = ReviewContextBundle;
+/**
+ * Payload emitted as `chimera.review_complete` after the review subagent
+ * finishes (success or failure). Consumed by the auto-review plugin's
+ * cascade listener to parse severity and decide whether to emit
+ * `chimera.cascade_needed`.
+ */
+export interface ChimeraReviewCompletePayload {
+    /** The original review context bundle that triggered this review. */
+    bundle: ReviewContextBundle;
+    /** The review report text the subagent produced (empty on failure). */
+    reviewText: string;
+    /** Whether the subagent succeeded (`'success'`) or failed otherwise. */
+    status: string;
+    /** Project root. */
+    cwd: string;
+}
+/**
+ * Payload emitted as `chimera.cascade_needed` when a review report
+ * contains findings at or above the configured `cascadeOn` threshold.
+ * Consumed by execution.ts to spawn follow-up investigation agents.
+ */
+export interface ChimeraCascadeNeededPayload {
+    /** The original review context bundle (carries cwd + files). */
+    bundle: ReviewContextBundle;
+    /** The review report text that triggered the cascade. */
+    reviewText: string;
+    /** The parsed severity counts that crossed the threshold. */
+    severities: {
+        critical: number;
+        high: number;
+        medium: number;
+    };
+    /** The threshold that was crossed (`'high'` or `'critical'`). */
+    threshold: 'high' | 'critical';
+    /** Follow-up agent roles to spawn, derived from the finding types. */
+    agents: CascadeAgentKind[];
 }
+/**
+ * Follow-up cascade agent kinds. Each maps to a roster role and a
+ * tailored task description. Multiple may be spawned in parallel when
+ * a review surfaces both security and correctness concerns.
+ */
+export type CascadeAgentKind = 'security-scanner' | 'bug-hunter';
 export declare const CHIMERA_REVIEW_PROMPT: string;
 export declare function createChimeraPlugin(): Plugin;
 export {};

package/dist/plugins/chimera-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chimera-plugin.d.ts","sourceRoot":"","sources":["../../src/plugins/chimera-plugin.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAQjD,UAAU,aAAa;IACrB,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;CACjC;AAID,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,aAAa,EAClB,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,MAAM,GACnB,qBAAqB,CAQvB;AAKD,MAAM,WAAW,0BAA0B;IACzC,8BAA8B;IAC9B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/E;AAKD,eAAO,MAAM,qBAAqB,QAAsD,CAAC;AA4IzF,wBAAgB,mBAAmB,IAAI,MAAM,CA2G5C"}
+{"version":3,"file":"chimera-plugin.d.ts","sourceRoot":"","sources":["../../src/plugins/chimera-plugin.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AASjD,UAAU,aAAa;IACrB,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;IACpD;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAChC,SAAS,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,aAAa,EAClB,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,MAAM,GACnB,qBAAqB,CAUvB;AAMD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,8BAA8B;IAC9B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;IACpD;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAGrC;;;;OAIG;IACH,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAGtE;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAGrC;;;;OAIG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAEjF;;;;OAIG;IACH,UAAU,CAAC,EACP;QACE,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;KACxC,GACD,SAAS,CAAC;IAEd;;;;OAIG;IACH,cAAc,CAAC,EACX,KAAK,CAAC;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACjC,CAAC,GACF,SAAS,CAAC;CACf;AAED,0DAA0D;AAC1D,MAAM,MAAM,0BAA0B,GAAG,mBAAmB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,qEAAqE;IACrE,MAAM,EAAE,mBAAmB,CAAC;IAC5B,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gEAAgE;IAChE,MAAM,EAAE,mBAAmB,CAAC;IAC5B,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,iEAAiE;IACjE,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;IAC/B,sEAAsE;IACtE,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,GAAG,YAAY,CAAC;AAKjE,eAAO,MAAM,qBAAqB,QAAsD,CAAC;AAgJzF,wBAAgB,mBAAmB,IAAI,MAAM,CAgH5C"}

package/dist/plugins/review-context-builder.d.ts

@@ -0,0 +1,52 @@
+import type { ReviewContextBundle, ResolvedChimeraConfig } from './chimera-plugin.js';
+export interface BuildReviewContextOptions {
+    cwd: string;
+    config: ResolvedChimeraConfig;
+    /** Files to review, with content already read. */
+    files: Array<{
+        path: string;
+        status: 'added' | 'modified';
+        content: string;
+    }>;
+    /**
+     * Active todo items from the session Context (P1 enrichment).
+     * Available from `ctx.todos` in the iteration.completed handler.
+     * Passed in by the caller — the builder itself has no ctx access.
+     */
+    activeTodos?: Array<{
+        id: string;
+        content: string;
+        status: string;
+    }> | undefined;
+    /**
+     * Cascade severity threshold from the auto-review plugin config.
+     * Threaded into the bundle so execution.ts and the cascade listener
+     * can decide whether findings warrant a follow-up agent. Absent for
+     * non-auto-review triggers (chimera plugin, /review slash command).
+     */
+    cascadeOn?: 'off' | 'critical' | 'high' | undefined;
+    /**
+     * Current cascade depth (0 = initial review). Increments on each
+     * fix+re-review cycle; the cascade stops at maxCascadeDepth.
+     */
+    cascadeDepth?: number | undefined;
+    /**
+     * Maximum cascade iterations before the self-correcting loop stops.
+     * Default 2. Absent for non-auto-review triggers.
+     */
+    maxCascadeDepth?: number | undefined;
+}
+/**
+ * Enrich a bare file list with diffs, sibling-change awareness, and
+ * recent commit history — the minimal "story" a reviewer needs to
+ * judge changes in context rather than in isolation.
+ *
+ * This is the P0 subset: diffs + siblings + commits.
+ * Future additions: todos, kanban card, prompt chain, prior findings.
+ *
+ * The function never throws — all enrichment is best-effort. If a git
+ * operation fails, the corresponding field is simply left `undefined`,
+ * and the caller still gets a valid bundle with the original file data.
+ */
+export declare function buildReviewContext(opts: BuildReviewContextOptions): Promise<ReviewContextBundle>;
+//# sourceMappingURL=review-context-builder.d.ts.map

package/dist/plugins/review-context-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-context-builder.d.ts","sourceRoot":"","sources":["../../src/plugins/review-context-builder.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAmB,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAqGvG,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,qBAAqB,CAAC;IAC9B,kDAAkD;IAClD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E;;;;OAIG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IACjF;;;;;OAKG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;IACpD;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CA+E9B"}

package/dist/security/index.d.ts

@@ -4,4 +4,5 @@ export { decryptConfigSecrets, encryptConfigSecrets, isSecretField } from './con
 export { DefaultPermissionPolicy, AutoApprovePermissionPolicy, type PermissionPolicyOptions, } from './permission-policy.js';
 export { TRUST_POLICY_JSON_SCHEMA, TRUST_POLICY_LIMITS, TRUST_POLICY_SCHEMA_VERSION, type TrustPolicyDiagnostic, type TrustPolicyDiagnosticCode, type TrustPolicyValidationResult, validateTrustPolicy, } from './permission-policy-schema.js';
 export { ToolCapabilities, DANGEROUS_FOR_SUBAGENTS, type ToolCapability, hasDangerousCapabilityForSubagents, hasCapability, getDangerousCapabilities, } from './capabilities.js';
+export { evaluateToolKanbanBoundary, type ToolKanbanBoundaryEvaluation, } from './kanban-boundary.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,cAAc,EACnB,kCAAkC,EAClC,aAAa,EACb,wBAAwB,GACzB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,cAAc,EACnB,kCAAkC,EAClC,aAAa,EACb,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,0BAA0B,EAC1B,KAAK,4BAA4B,GAClC,MAAM,sBAAsB,CAAC"}

package/dist/security/index.js

@@ -264,7 +264,7 @@ async function renameWithRetry(from, to) {
       if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {
         throw err;
       }
-      await new Promise((resolve) => setTimeout(resolve, delays[i]));
+      await new Promise((resolve2) => setTimeout(resolve2, delays[i]));
     }
   }
   throw lastErr;
@@ -428,7 +428,7 @@ function matchAny(patterns, input) {
 
 // src/utils/safe-json.ts
 function safeParse(input, maxBytes = 5e6) {
-  if (input.length > maxBytes) {
+  if (Buffer.byteLength(input, "utf8") > maxBytes) {
     return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
   }
   try {
@@ -1265,19 +1265,19 @@ var UNSAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set(["__proto__", "prototype", "
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function error(diagnostics, code, path3, message) {
-  diagnostics.push({ severity: "error", code, path: path3, message });
+function error(diagnostics, code, path4, message) {
+  diagnostics.push({ severity: "error", code, path: path4, message });
 }
-function validatePatterns(value, path3, diagnostics) {
+function validatePatterns(value, path4, diagnostics) {
   if (!Array.isArray(value)) {
-    error(diagnostics, "invalid_pattern_list", path3, "must be an array of strings");
+    error(diagnostics, "invalid_pattern_list", path4, "must be an array of strings");
     return void 0;
   }
   if (value.length > TRUST_POLICY_LIMITS.maxPatternsPerRule) {
     error(
       diagnostics,
       "too_many_patterns",
-      path3,
+      path4,
       `must contain at most ${TRUST_POLICY_LIMITS.maxPatternsPerRule} patterns`
     );
     return void 0;
@@ -1285,7 +1285,7 @@ function validatePatterns(value, path3, diagnostics) {
   const patterns = [];
   const seen = /* @__PURE__ */ new Set();
   for (const [index, pattern] of value.entries()) {
-    const itemPath = `${path3}[${index}]`;
+    const itemPath = `${path4}[${index}]`;
     if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > TRUST_POLICY_LIMITS.maxPatternChars) {
       error(
         diagnostics,
@@ -1397,8 +1397,8 @@ var LruCache = class {
     this.capacity = capacity;
   }
   get(key) {
+    if (!this.store.has(key)) return void 0;
     const value = this.store.get(key);
-    if (value === void 0) return void 0;
     this.store.delete(key);
     this.store.set(key, value);
     return value;
@@ -1655,9 +1655,21 @@ var DefaultPermissionPolicy = class {
     this._evalCache.clear();
     this.loaded = true;
   }
+  _logDeny(tool, subject, reason) {
+    console.warn(JSON.stringify({
+      level: "warn",
+      event: "permission.denied",
+      message: `Permission denied: ${tool}${subject ? ` (subject: ${subject})` : ""} \u2014 ${reason}`,
+      tool,
+      subject,
+      reason,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    }));
+  }
   async evaluate(tool, input, ctx) {
     if (!this.loaded) await this.reload();
     if (this.policyInvalid) {
+      this._logDeny(tool.name, void 0, "trust policy is invalid");
       return {
         permission: "deny",
         source: "deny",
@@ -1673,6 +1685,7 @@ var DefaultPermissionPolicy = class {
       if (cached !== void 0) return cached;
     }
     if (this.sessionDenied.has(cacheKey)) {
+      this._logDeny(tool.name, subject, "session soft deny (user pressed no)");
       const decision = { permission: "deny", source: "deny", reason: "session soft deny (user pressed no)" };
       this._evalCache.set(cacheKey, decision);
       return decision;
@@ -1687,11 +1700,13 @@ var DefaultPermissionPolicy = class {
       return decision;
     }
     if (entry?.deny && subject && matchesTrust(entry.deny, subject)) {
+      this._logDeny(tool.name, subject, "matched deny pattern");
       const decision = { permission: "deny", source: "deny", reason: "matched deny pattern" };
       this._evalCache.set(cacheKey, decision);
       return decision;
     }
     if (tool.permission === "deny") {
+      this._logDeny(tool.name, subject, "tool default deny");
       const decision = { permission: "deny", source: "default", reason: "tool default deny" };
       this._evalCache.set(cacheKey, decision);
       return decision;
@@ -1719,6 +1734,7 @@ var DefaultPermissionPolicy = class {
         }
         if (userDecision === "deny") {
           await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
+          this._logDeny(tool.name, subject, "user denied sensitive read");
           return { permission: "deny", source: "user", reason: "user denied sensitive read" };
         }
         return {
@@ -1771,6 +1787,7 @@ var DefaultPermissionPolicy = class {
       }
       if (decision === "deny") {
         await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
+        this._logDeny(tool.name, subject, "user denied");
         return { permission: "deny", source: "user", reason: "user denied" };
       }
       return { permission: decision === "yes" ? "auto" : "deny", source: "user" };
@@ -1890,6 +1907,165 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   async reload() {
   }
 };
+
+// src/security/kanban-boundary.ts
+import { realpath } from "node:fs/promises";
+import * as path3 from "node:path";
+import {
+  evaluateKanbanBoundaryOpaque,
+  evaluateKanbanBoundaryPath,
+  readBoard,
+  resolveKanbanBoundaryLayers
+} from "@wrongstack/kanban";
+var PATH_KEYS = /* @__PURE__ */ new Set([
+  "path",
+  "paths",
+  "file",
+  "files",
+  "directory",
+  "dir",
+  "cwd",
+  "root",
+  "baseDir",
+  "out",
+  "outputPath",
+  "sourcePath",
+  "targetPath",
+  "destinationPath",
+  "fromPath",
+  "toPath",
+  "worktreePath"
+]);
+var TOOL_PATH_KEYS = {
+  // `target` is an identifier in tools such as plan/task/document, but a
+  // filesystem target in language_info. Keep ambiguous names tool-specific.
+  language_info: ["target"]
+};
+async function evaluateToolKanbanBoundary(tool, input, ctx) {
+  const identity = resolveKanbanIdentity(ctx);
+  if (!identity.boardId) return { decision: "allow" };
+  const board = await readBoard(identity.policyRoot ?? ctx.projectRoot, identity.boardId);
+  if (!board) return { decision: "allow" };
+  const task = identity.taskId ? board.tasks.find((candidate) => candidate.id === identity.taskId) : void 0;
+  const layers = resolveKanbanBoundaryLayers(board, task);
+  if (layers.length === 0) return { decision: "allow" };
+  const caps = tool.capabilities ?? [];
+  const access2 = caps.includes("fs.write") || caps.includes("fs.write.outside-project") ? "write" : caps.includes("fs.read") ? "read" : void 0;
+  const shellLike = caps.some((capability) => capability.startsWith("shell."));
+  const candidates = access2 ? await extractCandidatePaths(tool.name, input, ctx) : [];
+  let evaluation;
+  if (shellLike || access2 && candidates.length === 0) {
+    evaluation = evaluateKanbanBoundaryOpaque(layers, tool.name);
+  } else if (access2) {
+    const results = candidates.map(
+      (candidate) => evaluateKanbanBoundaryPath(layers, candidate, access2)
+    );
+    evaluation = results.find((result) => result.decision === "block") ?? results.find((result) => result.decision === "confirm") ?? { decision: "allow" };
+  } else {
+    evaluation = { decision: "allow" };
+  }
+  return {
+    ...evaluation,
+    boardId: board.id,
+    ...task ? { taskId: task.id } : {}
+  };
+}
+function resolveKanbanIdentity(ctx) {
+  const metaKanban = ctx.meta["kanban"];
+  const record = metaKanban && typeof metaKanban === "object" ? metaKanban : void 0;
+  const boardId = ctx.currentKanbanBoardId ?? (typeof record?.["boardId"] === "string" ? record["boardId"] : void 0);
+  const taskId = ctx.currentKanbanTaskId ?? (typeof record?.["taskId"] === "string" ? record["taskId"] : void 0);
+  const policyRoot = typeof record?.["projectRoot"] === "string" ? record["projectRoot"] : void 0;
+  return {
+    ...boardId ? { boardId } : {},
+    ...taskId ? { taskId } : {},
+    ...policyRoot ? { policyRoot } : {}
+  };
+}
+async function extractCandidatePaths(toolName, input, ctx) {
+  if (toolName === "patch" && typeof input["patch"] === "string") {
+    const directoryInput = stringValue(input["directory"]) ?? ctx.workingDir;
+    const directory = path3.isAbsolute(directoryInput) ? directoryInput : path3.resolve(ctx.workingDir, directoryInput);
+    const strip = Math.max(1, numericValue(input["strip"]) ?? 1);
+    const targets = extractPatchTargets(input["patch"], strip).map(
+      (target) => relativeToProject(path3.resolve(directory, target), ctx.projectRoot)
+    );
+    return Promise.all(targets.map((target) => canonicalizeCandidatePath(target, ctx)));
+  }
+  const values = [];
+  const pathKeys = new Set(PATH_KEYS);
+  for (const key of TOOL_PATH_KEYS[toolName] ?? []) pathKeys.add(key);
+  collectPathValues(input, values, pathKeys);
+  if (toolName === "scaffold" && typeof input["name"] === "string") {
+    const cwd = stringValue(input["cwd"]) ?? ctx.workingDir;
+    values.push(path3.join(cwd, input["name"]));
+  }
+  const candidates = [
+    ...new Set(values.flatMap(splitPathList).map((value) => resolveInputPath(value, ctx)))
+  ];
+  return Promise.all(candidates.map((candidate) => canonicalizeCandidatePath(candidate, ctx)));
+}
+async function canonicalizeCandidatePath(candidate, ctx) {
+  if (path3.isAbsolute(candidate)) return candidate;
+  const absolute = path3.resolve(ctx.projectRoot, candidate);
+  const canonicalRoot = await realpath(ctx.projectRoot).catch(() => ctx.projectRoot);
+  let probe = absolute;
+  const missingSegments = [];
+  while (true) {
+    try {
+      const canonical = path3.join(await realpath(probe), ...missingSegments);
+      return relativeToProject(canonical, canonicalRoot);
+    } catch (cause) {
+      const code = cause.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") return absolute;
+      const parent = path3.dirname(probe);
+      if (parent === probe) return absolute;
+      missingSegments.unshift(path3.basename(probe));
+      probe = parent;
+    }
+  }
+}
+function collectPathValues(value, output, pathKeys, key) {
+  if (typeof value === "string") {
+    if (key && pathKeys.has(key)) output.push(value);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectPathValues(item, output, pathKeys, key);
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [childKey, child] of Object.entries(value)) {
+    collectPathValues(child, output, pathKeys, childKey);
+  }
+}
+function splitPathList(value) {
+  return value.split(",").map((item) => item.trim()).filter(Boolean);
+}
+function resolveInputPath(value, ctx) {
+  const absolute = path3.isAbsolute(value) ? value : path3.resolve(ctx.workingDir, value);
+  return relativeToProject(absolute, ctx.projectRoot);
+}
+function relativeToProject(absolute, projectRoot) {
+  const relative2 = path3.relative(projectRoot, absolute).replace(/\\/g, "/");
+  return relative2.startsWith("../") || path3.isAbsolute(relative2) ? absolute : relative2 || ".";
+}
+function extractPatchTargets(patchText, strip) {
+  const targets = [];
+  for (const match of patchText.matchAll(/^\+\+\+\s+([^\t\r\n]+)/gm)) {
+    const raw = match[1]?.trim();
+    if (!raw || raw === "/dev/null") continue;
+    const parts = raw.replace(/\\/g, "/").split("/").filter((part) => part && part !== ".");
+    if (parts.length > strip) targets.push(parts.slice(strip).join("/"));
+  }
+  return targets;
+}
+function stringValue(value) {
+  return typeof value === "string" && value.trim() ? value : void 0;
+}
+function numericValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
 export {
   AutoApprovePermissionPolicy,
   DANGEROUS_FOR_SUBAGENTS,
@@ -1902,6 +2078,7 @@ export {
   ToolCapabilities,
   decryptConfigSecrets,
   encryptConfigSecrets,
+  evaluateToolKanbanBoundary,
   getDangerousCapabilities,
   hasCapability,
   hasDangerousCapabilityForSubagents,