@wrongstack/core 0.296.4 → 0.298.0

package/dist/infrastructure/index.js

@@ -865,7 +865,7 @@ var DefaultLogger = class _DefaultLogger {
         root.pendingFileWrites += 1;
         root.pendingFileBytes += bytes;
         this.enqueueRotate(this.file);
-        this._tail = this._tail.then(() => fsp.appendFile(this.file, line)).catch(() => void 0).finally(() => {
+        this._tail = this._tail.then(() => fsp.appendFile(this.file, line, { mode: 384 })).catch(() => void 0).finally(() => {
           root.pendingFileWrites = Math.max(0, root.pendingFileWrites - 1);
           root.pendingFileBytes = Math.max(0, root.pendingFileBytes - bytes);
         });
@@ -2227,6 +2227,47 @@ function isSecretField(name) {
   return SECRET_KEY_PATTERN.test(lc);
 }
 
+// src/security/file-permissions.ts
+import { chmod } from "node:fs/promises";
+var SECRET_FILE_MODE = 384;
+async function restrictFilePermissions(filePath, opts) {
+  const label = opts?.label ?? "file-permissions";
+  const warn = opts?.warn ?? ((msg) => console.warn(msg));
+  if (process.platform === "win32") {
+    try {
+      const { execFile } = await import("node:child_process");
+      const { promisify } = await import("node:util");
+      const execFileAsync = promisify(execFile);
+      const user = windowsAccountName();
+      if (!user) {
+        warn(
+          `[${label}] Could not determine the current Windows user for ${filePath}; skipping icacls hardening.`
+        );
+        return;
+      }
+      await execFileAsync("icacls", [filePath, "/inheritance:r", "/grant:r", `${user}:(F)`], {
+        windowsHide: true
+      });
+    } catch {
+      warn(
+        `[${label}] Could not restrict permissions on ${filePath} \u2014 it may be readable by other users on this system.`
+      );
+    }
+  } else {
+    try {
+      await chmod(filePath, SECRET_FILE_MODE);
+    } catch {
+    }
+  }
+}
+function windowsAccountName() {
+  const username = process.env.USERNAME || process.env.USER;
+  if (!username || username.includes("\0")) return void 0;
+  const domain = process.env.USERDOMAIN;
+  if (domain && !domain.includes("\0")) return `${domain}\\${username}`;
+  return username;
+}
+
 // src/utils/deep-merge.ts
 var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
   "__proto__",
@@ -2378,8 +2419,12 @@ function checkKeyFilePermissions(keyFile, opts) {
     const stat5 = fs2.statSync(keyFile);
     const actualMode = stat5.mode & 511;
     if (actualMode !== KEY_FILE_MODE) {
+      void restrictFilePermissions(keyFile, {
+        label: "secret-vault",
+        warn
+      }).catch(() => void 0);
       warn(
-        `Key file ${keyFile} has mode ${actualMode.toString(8)} \u2014 expected ${KEY_FILE_MODE.toString(8)}. Run: chmod ${KEY_FILE_MODE.toString(8)} ${keyFile}`
+        `Key file ${keyFile} has mode ${actualMode.toString(8)} \u2014 expected ${KEY_FILE_MODE.toString(8)}. Hardening\u2026`
       );
     }
   } catch {
@@ -2412,6 +2457,14 @@ var DefaultSecretVault = class {
   logger;
   key;
   _keyVersion = 1;
+  /**
+   * Pending key-file hardening promises (Windows ACL restrictions via icacls).
+   * Tracked so async callers can `flushHardening()` before returning, ensuring
+   * a short-lived CLI process does not exit before the hardening resolves.
+   * Sync-only callers (encrypt/decrypt lazy-load) leave these pending —
+   * hardening remains best-effort in that case.
+   */
+  pendingHardening = [];
   constructor(opts) {
     this.keyFile = opts.keyFile;
     this.logger = opts.logger;
@@ -2428,6 +2481,26 @@ var DefaultSecretVault = class {
       console.warn(JSON.stringify({ ...ctx, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
     }
   }
+  /**
+   * Schedule best-effort key-file hardening and track the promise so async
+   * callers can await it via `flushHardening()` before returning. Rejections
+   * are swallowed here (the helper already warns on failure) so a rejection
+   * can never become an unhandled one.
+   */
+  scheduleKeyHardening() {
+    const p = restrictFilePermissions(this.keyFile, {
+      label: "secret-vault-key",
+      warn: (msg) => this.logWarn(msg)
+    }).catch(() => void 0);
+    this.pendingHardening.push(p);
+  }
+  /** Flush all pending key-file hardening promises. */
+  flushHardening() {
+    if (this.pendingHardening.length === 0) return Promise.resolve();
+    const all = Promise.all(this.pendingHardening).then(() => void 0);
+    this.pendingHardening = [];
+    return all;
+  }
   /** Current key version. Starts at 1; incremented by rotateKey(). */
   get keyVersion() {
     if (!this.key) this.loadOrCreateKey();
@@ -2469,16 +2542,18 @@ var DefaultSecretVault = class {
     const iv = Buffer.from(ivB64, "base64");
     const tag = Buffer.from(tagB64, "base64");
     const ct = Buffer.from(ctB64, "base64");
-    if (iv.length !== IV_BYTES) throw new ConfigError({
-      message: "SecretVault: bad IV length",
-      code: ERROR_CODES.CONFIG_PARSE_FAILED,
-      context: { expected: IV_BYTES, actual: iv.length }
-    });
-    if (tag.length !== TAG_BYTES) throw new ConfigError({
-      message: "SecretVault: bad tag length",
-      code: ERROR_CODES.CONFIG_PARSE_FAILED,
-      context: { expected: TAG_BYTES, actual: tag.length }
-    });
+    if (iv.length !== IV_BYTES)
+      throw new ConfigError({
+        message: "SecretVault: bad IV length",
+        code: ERROR_CODES.CONFIG_PARSE_FAILED,
+        context: { expected: IV_BYTES, actual: iv.length }
+      });
+    if (tag.length !== TAG_BYTES)
+      throw new ConfigError({
+        message: "SecretVault: bad tag length",
+        code: ERROR_CODES.CONFIG_PARSE_FAILED,
+        context: { expected: TAG_BYTES, actual: tag.length }
+      });
     const key = this.loadOrCreateKey();
     const decipher = createDecipheriv(ALGO, key, iv);
     decipher.setAuthTag(tag);
@@ -2505,6 +2580,7 @@ var DefaultSecretVault = class {
       newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
       writeKeyFileAtomicSync(this.keyFile, keyFileBuf);
     }
+    this.scheduleKeyHardening();
     checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
     this.key = newKey;
     this._keyVersion = newVersion;
@@ -2521,7 +2597,11 @@ var DefaultSecretVault = class {
     const passphrase = getVaultPassphrase();
     if (!passphrase || !this.key) return;
     try {
-      writeKeyFileAtomicSync(this.keyFile, wrapDataKey(this.key, this._keyVersion, passphrase));
+      writeKeyFileAtomicSync(
+        this.keyFile,
+        wrapDataKey(this.key, this._keyVersion, passphrase)
+      );
+      this.scheduleKeyHardening();
       checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
     } catch {
     }
@@ -2582,8 +2662,10 @@ var DefaultSecretVault = class {
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
     try {
       fs2.writeFileSync(this.keyFile, initialBytes, { mode: 384, flag: "wx" });
+      this.scheduleKeyHardening();
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
+      this.scheduleKeyHardening();
       const buf = fs2.readFileSync(this.keyFile);
       if (isWrappedKeyFile(buf)) {
         const { key: winnerKey, version } = unwrapDataKey(buf, this.keyFile);
@@ -2642,45 +2724,15 @@ async function migratePlaintextSecrets(configPath, vault, logger) {
   const migrated = walkCount(parsed, vault, counter);
   if (counter.n === 0) return { migrated: 0, file: configPath };
   await atomicWrite(configPath, JSON.stringify(migrated, null, 2), { mode: 384 });
-  await restrictFilePermissions(
+  await restrictFilePermissions2(
     configPath,
     logger ? { warn: (msg) => logger.warn(msg) } : void 0
   );
+  await vault.flushHardening?.();
   return { migrated: counter.n, file: configPath };
 }
-async function restrictFilePermissions(filePath, opts) {
-  const warn = opts?.warn ?? ((msg) => console.warn(msg));
-  if (process.platform === "win32") {
-    try {
-      const { execFile } = await import("node:child_process");
-      const { promisify } = await import("node:util");
-      const execFileAsync = promisify(execFile);
-      const user = windowsAccountName();
-      if (!user) {
-        warn(
-          `[secret-vault] Could not determine the current Windows user for ${filePath}; skipping icacls hardening.`
-        );
-        return;
-      }
-      await execFileAsync("icacls", [filePath, "/inheritance:r", "/grant:r", `${user}:(F)`]);
-    } catch {
-      warn(
-        `[secret-vault] Could not restrict permissions on ${filePath} \u2014 config file may be readable by other users on this system.`
-      );
-    }
-  } else {
-    try {
-      await fsp2.chmod(filePath, 384);
-    } catch {
-    }
-  }
-}
-function windowsAccountName() {
-  const username = process.env.USERNAME || process.env.USER;
-  if (!username || username.includes("\0")) return void 0;
-  const domain = process.env.USERDOMAIN;
-  if (domain && !domain.includes("\0")) return `${domain}\\${username}`;
-  return username;
+async function restrictFilePermissions2(filePath, opts) {
+  await restrictFilePermissions(filePath, { label: "secret-vault", warn: opts?.warn });
 }
 function walkCount(node, vault, counter) {
   if (node === null || node === void 0) return node;
@@ -3041,7 +3093,13 @@ var CONFIG_BEHAVIOR_DEFAULTS = {
     // models still get cost savings without capability loss. Explicit tiers
     // are respected verbatim.
     tokenSavingMode: "auto",
-    allowOutsideProjectRoot: true
+    // Derived, never written by hand: this and `tools.restrictToProjectRoot`
+    // (line 41) are the two halves of one switch, and they used to be declared
+    // independently in this same object — one `true`, one `true` — with
+    // session.ts resolving the contradiction via `??` in favour of the
+    // permissive half. The confinement guard therefore shipped disabled on a
+    // fresh install even though the other half asked for it (WS-075).
+    allowOutsideProjectRoot: !DEFAULT_TOOLS_CONFIG.restrictToProjectRoot
   },
   Sage: {
     enabled: true,
@@ -3120,7 +3178,9 @@ var CONFIG_BEHAVIOR_DEFAULTS = {
     enhance: true,
     enhanceDelayMs: 6e4,
     enhanceLanguage: "original",
-    statuslineMode: "detailed",
+    // Product-wide statusline density default. Mirrored by the TUI's
+    // DEFAULT_STATUSLINE_MODE (packages/tui/src/components/settings-picker-model.ts).
+    statuslineMode: "minimum",
     thinkingWord: DEFAULT_TUI_THINKING_WORD,
     showAgentSwarmPanel: true
   },
@@ -3249,6 +3309,7 @@ var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "maxConcurrent",
   "uiLocale",
   "fallbackModels",
+  "fallbackBridge",
   "fallbackProfiles",
   "favoriteModels",
   "favoriteModelsOnly",
@@ -3311,6 +3372,7 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "tools",
   "mcpServers",
   "fallbackModels",
+  "fallbackBridge",
   "fallbackProfiles",
   "favoriteModels",
   "favoriteModelsOnly",
@@ -3345,6 +3407,75 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "brain",
   "git"
 ]);
+var IN_PROJECT_DENIED_PATHS = [
+  {
+    path: "tools.exec.allow",
+    reason: "Extends the exec allow-list; a repo could authorise its own binaries."
+  },
+  { path: "tools.exec.danger", reason: "Weakens the destructive-command banner." },
+  { path: "skills.extraDirs", reason: "Loads skill definitions from repo-chosen directories." },
+  { path: "skills.registryUrl", reason: "Redirects skill installs to a repo-chosen host." },
+  // Deliberately NOT denied: skills.mode and skills.eagerMaxChars. The audit
+  // suggested stripping both, but config-loader-extra.test.ts classifies `mode`
+  // as a safe preference with a stated rationale, and a repo can only use these
+  // to move injection volume in either direction — the trust problem was that
+  // repo-supplied skill bodies were indistinguishable from the user's own, which
+  // the provenance tag in system-prompt-skill-bodies.ts now fixes. Re-classifying
+  // them is a product call.
+  { path: "Sage.storage.directory", reason: "Redirects memory storage outside the profile." },
+  {
+    path: "autonomy.yolo",
+    reason: "Alias for the denied top-level `yolo`, and it wins over the user setting \u2014 a repo-committed config could disable every permission prompt."
+  },
+  {
+    path: "autonomy.defaultMode",
+    reason: "Sets the startup autonomy mode; autonomy is user-owned, never repo-owned."
+  },
+  // Deliberately NOT denied: autonomy.autoProceedDelayMs and
+  // autoProceedMaxIterations. They tune a mode the user has already switched on
+  // rather than granting it, and config-loader-extra.test.ts classifies the
+  // delay as a benign project preference. Re-classifying them is a product call.
+  {
+    path: "launch.autonomy",
+    reason: "Launch-time autonomy mode; same user-owned boundary as autonomy.defaultMode."
+  },
+  {
+    path: "features.allowOutsideProjectRoot",
+    reason: "Short-circuits both the project-root containment check and the symlink realpath check in the file tools."
+  },
+  {
+    path: "tools.restrictToProjectRoot",
+    reason: "The other half of the filesystem confinement switch."
+  }
+];
+function deleteNestedPath(target, path11) {
+  const segments = path11.split(".");
+  const last = segments[segments.length - 1];
+  if (last === void 0) return false;
+  let cursor = target;
+  const chain = [];
+  for (const segment of segments.slice(0, -1)) {
+    const next = cursor[segment];
+    if (!next || typeof next !== "object" || Array.isArray(next)) return false;
+    chain.push({ parent: cursor, key: segment });
+    cursor = next;
+  }
+  if (!(last in cursor)) return false;
+  const clonedLeaf = { ...cursor };
+  delete clonedLeaf[last];
+  let replacement = clonedLeaf;
+  for (let i = chain.length - 1; i >= 0; i--) {
+    const link = chain[i];
+    if (!link) continue;
+    replacement = { ...link.parent, [link.key]: replacement };
+    if (i === 0) {
+      for (const [k, v] of Object.entries(replacement)) target[k] = v;
+      return true;
+    }
+  }
+  for (const [k, v] of Object.entries(replacement)) target[k] = v;
+  return true;
+}
 function assertInProjectAllowListComplete() {
   const missingFromBoth = [];
   for (const key of KNOWN_CONFIG_TOP_LEVEL_KEYS) {
@@ -3374,6 +3505,22 @@ function assertInProjectAllowListComplete() {
       `field(s) appear in BOTH IN_PROJECT_ALLOWED_KEYS and KNOWN_DENIED_IN_PROJECT: ` + duplicate.join(", ") + ". The allow-list wins at runtime; remove from one of the two."
     );
   }
+  const orphanedPaths = IN_PROJECT_DENIED_PATHS.filter(
+    ({ path: path11 }) => !IN_PROJECT_ALLOWED_KEYS.has(path11.split(".")[0] ?? "")
+  ).map(({ path: path11 }) => path11);
+  if (orphanedPaths.length > 0) {
+    problems.push(
+      `IN_PROJECT_DENIED_PATHS entr(ies) whose top-level parent is not allowed: ` + orphanedPaths.join(", ") + ". The parent is already stripped wholesale, so the nested denial is dead \u2014 remove it."
+    );
+  }
+  const malformedPaths = IN_PROJECT_DENIED_PATHS.filter(
+    ({ path: path11 }) => path11.split(".").length < 2 || path11.split(".").some((s) => s.length === 0)
+  ).map(({ path: path11 }) => path11);
+  if (malformedPaths.length > 0) {
+    problems.push(
+      `IN_PROJECT_DENIED_PATHS entr(ies) are not dotted nested paths: ` + malformedPaths.join(", ") + ". Top-level keys belong in KNOWN_DENIED_IN_PROJECT instead."
+    );
+  }
   if (problems.length > 0) {
     throw new Error(
       `stripUnsafeInProjectFields drift check failed:
@@ -3396,58 +3543,8 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
     }
     stripped.push(k);
   }
-  const outTools = out["tools"];
-  if (outTools && typeof outTools === "object") {
-    const execCfg = outTools["exec"];
-    if (execCfg && typeof execCfg === "object") {
-      const hasAllow = "allow" in execCfg;
-      const hasDanger = "danger" in execCfg;
-      if (hasAllow || hasDanger) {
-        const clonedExec = { ...execCfg };
-        if (hasAllow) {
-          delete clonedExec["allow"];
-          stripped.push("tools.exec.allow");
-        }
-        if (hasDanger) {
-          delete clonedExec["danger"];
-          stripped.push("tools.exec.danger");
-        }
-        out["tools"] = {
-          ...outTools,
-          exec: clonedExec
-        };
-      }
-    }
-  }
-  const outSkills = out["skills"];
-  if (outSkills && typeof outSkills === "object") {
-    const skillsRec = outSkills;
-    const needsClone = "extraDirs" in skillsRec || "registryUrl" in skillsRec;
-    if (needsClone) {
-      const clonedSkills = { ...skillsRec };
-      if ("extraDirs" in clonedSkills) {
-        delete clonedSkills["extraDirs"];
-        stripped.push("skills.extraDirs");
-      }
-      if ("registryUrl" in clonedSkills) {
-        delete clonedSkills["registryUrl"];
-        stripped.push("skills.registryUrl");
-      }
-      out["skills"] = clonedSkills;
-    }
-  }
-  const outSage = out["Sage"];
-  if (outSage && typeof outSage === "object") {
-    const storage = outSage["storage"];
-    if (storage && typeof storage === "object" && "directory" in storage) {
-      const clonedStorage = { ...storage };
-      delete clonedStorage["directory"];
-      out["Sage"] = {
-        ...outSage,
-        storage: clonedStorage
-      };
-      stripped.push("Sage.storage.directory");
-    }
+  for (const { path: path11 } of IN_PROJECT_DENIED_PATHS) {
+    if (deleteNestedPath(out, path11)) stripped.push(path11);
   }
   if (stripped.length > 0) {
     warn(

package/dist/kernel/events/session-events.d.ts

@@ -1,5 +1,6 @@
 import type { Context } from '../../core/context.js';
 import type { Usage } from '../../types/provider.js';
+import type { WorkspaceCheckpointRef } from '../../types/session.js';
 import type { TrackedAgentSnapshot } from '../events.js';
 export interface SessionEventMap {
     'session.started': {
@@ -223,6 +224,8 @@ export interface SessionEventMap {
         promptPreview: string;
         ts: string;
         fileCount: number;
+        /** Deterministic Git HEAD + dirty workspace identity, absent when capture failed. */
+        workspaceCheckpoint?: WorkspaceCheckpointRef | undefined;
     };
     /**
      * Fired by SessionWriter.writeInFlightMarker() — the agent loop has

package/dist/kernel/events/tool-events.d.ts

@@ -1,7 +1,7 @@
 import type { Context } from '../../core/context.js';
+import type { ToolOutputMetadata } from '../../types/context-evidence.js';
 import type { PermissionDecision } from '../../types/permission.js';
 import type { RiskTier, Tool, ToolErrorCategory, ToolProgressEvent } from '../../types/tool.js';
-import type { ToolOutputMetadata } from '../../types/context-evidence.js';
 export interface ToolEventMap {
     'tool.started': {
         sessionId?: string | undefined;
@@ -197,6 +197,8 @@ export interface ToolEventMap {
         name: string;
         durationMs: number;
         ok: boolean;
+        /** Canonical tool-registry mutation classification; absent only on legacy emit sites. */
+        mutating?: boolean | undefined;
         input?: unknown | undefined;
         output?: string | undefined;
         /**

package/dist/models/index.js

@@ -227,7 +227,7 @@ var DefaultLogger = class _DefaultLogger {
         root.pendingFileWrites += 1;
         root.pendingFileBytes += bytes;
         this.enqueueRotate(this.file);
-        this._tail = this._tail.then(() => fsp.appendFile(this.file, line)).catch(() => void 0).finally(() => {
+        this._tail = this._tail.then(() => fsp.appendFile(this.file, line, { mode: 384 })).catch(() => void 0).finally(() => {
           root.pendingFileWrites = Math.max(0, root.pendingFileWrites - 1);
           root.pendingFileBytes = Math.max(0, root.pendingFileBytes - bytes);
         });

package/dist/observability/index.d.ts

@@ -1,4 +1,4 @@
-export { InMemoryMetricsSink, NoopMetricsSink } from './metrics.js';
+export { InMemoryMetricsSink, type InMemoryMetricsSinkOptions, NoopMetricsSink, } from './metrics.js';
 export { DefaultHealthRegistry } from './health.js';
 export { NoopTracer } from './tracer.js';
 export { OTelTracer } from './otel-tracer.js';

package/dist/observability/index.js

@@ -14,7 +14,25 @@ var InMemoryMetricsSink = class {
   counters = /* @__PURE__ */ new Map();
   gauges = /* @__PURE__ */ new Map();
   histograms = /* @__PURE__ */ new Map();
+  /**
+   * Per-metric dropped observation counts. Keyed by the metric's full name
+   * (counter / gauge / histogram families share a name space by convention;
+   * families are tracked in the respective `droppedByMetric` Map).
+   */
+  droppedByMetric = /* @__PURE__ */ new Map();
+  maxSeriesPerMetric;
+  constructor(opts = {}) {
+    const cap = opts.maxSeriesPerMetric;
+    this.maxSeriesPerMetric = cap !== void 0 && cap > 0 ? cap : void 0;
+  }
   counter(name, value = 1, labels) {
+    if (this.maxSeriesPerMetric !== void 0) {
+      const series2 = this.counters.get(name) ?? /* @__PURE__ */ new Map();
+      if (!series2.has(labelKey(labels)) && series2.size >= this.maxSeriesPerMetric) {
+        this.recordDrop(name);
+        return;
+      }
+    }
     const series = this.getOrCreate(this.counters, name);
     const key = labelKey(labels);
     const state = series.get(key) ?? { value: 0 };
@@ -22,17 +40,36 @@ var InMemoryMetricsSink = class {
     series.set(key, state);
   }
   gauge(name, value, labels) {
+    if (this.maxSeriesPerMetric !== void 0) {
+      const series2 = this.gauges.get(name) ?? /* @__PURE__ */ new Map();
+      if (!series2.has(labelKey(labels)) && series2.size >= this.maxSeriesPerMetric) {
+        this.recordDrop(name);
+        return;
+      }
+    }
     const series = this.getOrCreate(this.gauges, name);
     series.set(labelKey(labels), { value });
   }
   histogram(name, value, labels) {
+    if (this.maxSeriesPerMetric !== void 0) {
+      const series2 = this.histograms.get(name) ?? /* @__PURE__ */ new Map();
+      if (!series2.has(labelKey(labels)) && series2.size >= this.maxSeriesPerMetric) {
+        this.recordDrop(name);
+        return;
+      }
+    }
     const series = this.getOrCreate(this.histograms, name);
     const key = labelKey(labels);
-    let state = series.get(key);
-    if (!state) {
-      state = { count: 0, sum: 0, min: value, max: value, samples: [] };
-      series.set(key, state);
+    const existing = series.get(key);
+    if (!existing) {
+      const created = { count: 0, sum: 0, min: value, max: value, samples: [] };
+      series.set(key, created);
+      this.advanceHistogram(created, value);
+      return;
     }
+    this.advanceHistogram(existing, value);
+  }
+  advanceHistogram(state, value) {
     state.count++;
     state.sum += value;
     if (value < state.min) state.min = value;
@@ -85,12 +122,40 @@ var InMemoryMetricsSink = class {
         });
       }
     }
-    return { timestamp: Date.now(), series };
+    return { timestamp: Date.now(), series, droppedObservations: this.droppedByMetricSnapshot() };
+  }
+  /**
+   * Cumulative drop counts across all metrics. Use to detect cardinality
+   * explosions (drift upward) without scraping the full snapshot. Returns 0
+   * for a sink created without `maxSeriesPerMetric`.
+   */
+  droppedObservations() {
+    let total = 0;
+    for (const n of this.droppedByMetric.values()) total += n;
+    return total;
+  }
+  /**
+   * Drop count for a single metric, or 0 if no drops have been recorded.
+   * Cheaper than `droppedObservations()` for one-name lookups.
+   */
+  droppedFor(name) {
+    return this.droppedByMetric.get(name) ?? 0;
+  }
+  /**
+   * Snapshot of per-metric drop counts. `undefined` for sinks without a cap
+   * (caller can treat the absence as "no drops possible"). For capped sinks
+   * an empty object means "cap set, no drops yet".
+   */
+  droppedByMetricSnapshot() {
+    if (this.maxSeriesPerMetric === void 0) return void 0;
+    if (this.droppedByMetric.size === 0) return {};
+    return Object.fromEntries(this.droppedByMetric);
   }
   reset() {
     this.counters.clear();
     this.gauges.clear();
     this.histograms.clear();
+    this.droppedByMetric.clear();
   }
   getOrCreate(bag, name) {
     let series = bag.get(name);
@@ -100,6 +165,9 @@ var InMemoryMetricsSink = class {
     }
     return series;
   }
+  recordDrop(name) {
+    this.droppedByMetric.set(name, (this.droppedByMetric.get(name) ?? 0) + 1);
+  }
 };
 function parseLabelKey(key) {
   if (!key) return {};
@@ -120,6 +188,9 @@ var NoopMetricsSink = class {
   snapshot() {
     return { timestamp: Date.now(), series: [] };
   }
+  droppedObservations() {
+    return 0;
+  }
   reset() {
   }
 };
@@ -558,6 +629,7 @@ function hash(value) {
 }
 
 // src/observability/prometheus.ts
+import { timingSafeEqual } from "node:crypto";
 var NUMBER_FORMAT_INFINITY = "NaN";
 function escapeLabelValue(v) {
   return v.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/"/g, '\\"');
@@ -614,6 +686,19 @@ function renderPrometheus(snapshot) {
   return lines.join("\n") + "\n";
 }
 var PROMETHEUS_CONTENT_TYPE = "text/plain; version=0.0.4; charset=utf-8";
+function isLoopbackBindHost(host) {
+  const h = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+  return h === "127.0.0.1" || h === "localhost" || h === "::1" || h.startsWith("127.");
+}
+function bearerMatches(header, token) {
+  if (!header) return false;
+  const prefix = "bearer ";
+  if (!header.toLowerCase().startsWith(prefix)) return false;
+  const supplied = Buffer.from(header.slice(prefix.length).trim(), "utf8");
+  const expected = Buffer.from(token, "utf8");
+  if (supplied.length !== expected.length) return false;
+  return timingSafeEqual(supplied, expected);
+}
 async function startMetricsServer(opts) {
   const tls = opts.tls;
   const useHttps = !!(tls?.cert && tls?.key);
@@ -621,12 +706,25 @@ async function startMetricsServer(opts) {
   const path = opts.path ?? "/metrics";
   const healthPath = opts.healthPath ?? "/healthz";
   const healthRegistry = opts.healthRegistry;
+  const token = opts.token;
+  if (!isLoopbackBindHost(host) && !token) {
+    throw new Error(
+      `startMetricsServer: refusing to bind to non-loopback host "${host}" without a token \u2014 pass a token to expose metrics to the network, or bind to 127.0.0.1.`
+    );
+  }
   const listener = (req, res) => {
     if (!req.url || req.method !== "GET") {
       res.statusCode = req.url ? 405 : 400;
       res.end();
       return;
     }
+    if (token && !bearerMatches(req.headers.authorization, token)) {
+      res.statusCode = 401;
+      res.setHeader("www-authenticate", "Bearer");
+      res.setHeader("content-type", "text/plain; charset=utf-8");
+      res.end("Unauthorized");
+      return;
+    }
     const url = req.url.split("?")[0];
     if (url === path) {
       let body;