@wrongstack/core 0.297.0 → 0.298.1

package/dist/execution/skill-loader.d.ts

@@ -1,4 +1,4 @@
-import type { SkillEntry, SkillLoader, SkillManifest } from '../types/skill.js';
+import type { SkillEntry, SkillLoader, SkillLoaderDiagnostics, SkillManifest } from '../types/skill.js';
 import type { WstackPaths } from '../utils/wstack-paths.js';
 export interface SkillLoaderOptions {
     paths: WstackPaths;
@@ -31,12 +31,21 @@ export declare class DefaultSkillLoader implements SkillLoader {
     private cache?;
     private entriesCache?;
     private readonly bodyCache;
+    /** Load-time diagnostics from the most recent full `list()` scan. */
+    private skipped;
+    private shadowed;
     constructor(opts: SkillLoaderOptions);
     list(): Promise<SkillManifest[]>;
     find(name: string): Promise<SkillManifest | undefined>;
     manifestText(): Promise<string>;
     listEntries(): Promise<SkillEntry[]>;
     invalidateCache(): void;
+    /**
+     * Load-time diagnostics from the most recent full `list()` scan: skills
+     * skipped as malformed and skills shadowed by a higher-priority layer.
+     * Returns copies so callers cannot mutate internal state.
+     */
+    diagnostics(): SkillLoaderDiagnostics;
     readBody(name: string): Promise<string>;
     readSaveBody(name: string): Promise<string>;
 }

package/dist/execution/tool-error-taxonomy.d.ts

@@ -0,0 +1,31 @@
+import type { ToolErrorCategory, ToolErrorInfo } from '../types/tool.js';
+import type { ToolResultBlock, ToolUseBlock } from '../types/blocks.js';
+/**
+ * Format a tool execution error into a ToolResultBlock with structured
+ * ToolErrorInfo attached. The agent sees both a human-readable message
+ * and a machine-readable category/retryable pair so it can decide
+ * whether to retry, adjust arguments, or abandon the approach.
+ *
+ * Every tool-originated error flows through this function so the output
+ * shape is identical regardless of which path produced the error
+ * (exec, bash, runtime, subagent, permission denial, hook block, etc.).
+ */
+export declare function toolErrorResult(use: ToolUseBlock, err: unknown, opts?: {
+    scrubber?: (s: string) => string;
+}): ToolResultBlock;
+/**
+ * Create a tool error result from a pre-classified category + message.
+ * Used by permission denials, hook blocks, and validation errors that
+ * don't flow through classifyToolError (they're known at the call site).
+ */
+export declare function classifiedToolErrorResult(use: ToolUseBlock, category: ToolErrorCategory, message: string, opts?: {
+    retryable?: boolean;
+    detail?: string;
+}): ToolResultBlock;
+/**
+ * Extract structured ToolErrorInfo from a ToolResultBlock if present.
+ * Returns undefined for non-error results or results without the
+ * structured extension.
+ */
+export declare function getToolErrorInfo(block: ToolResultBlock): ToolErrorInfo | undefined;
+//# sourceMappingURL=tool-error-taxonomy.d.ts.map

package/dist/execution/tool-executor.d.ts

@@ -15,6 +15,7 @@ export declare class ToolExecutor {
     private readonly serializer;
     private readonly iterationTimeoutMs;
     private readonly maxToolTimeoutMs;
+    private readonly maxParallelTools;
     constructor(registry: {
         get(name: string): Tool | undefined;
         list(): Tool[];

package/dist/goal/index.js

@@ -958,7 +958,7 @@ var DefaultLogger = class _DefaultLogger {
         root.pendingFileWrites += 1;
         root.pendingFileBytes += bytes;
         this.enqueueRotate(this.file);
-        this._tail = this._tail.then(() => fsp.appendFile(this.file, line)).catch(() => void 0).finally(() => {
+        this._tail = this._tail.then(() => fsp.appendFile(this.file, line, { mode: 384 })).catch(() => void 0).finally(() => {
           root.pendingFileWrites = Math.max(0, root.pendingFileWrites - 1);
           root.pendingFileBytes = Math.max(0, root.pendingFileBytes - bytes);
         });
@@ -1531,6 +1531,8 @@ var PhaseOrchestrator = class {
         this.updatePhaseStatus(phase, "paused");
       }
     }
+    this.trackerCache.clear();
+    this.taskRetryCounts.clear();
     if (this.worktrees) {
       for (const handle of this.worktrees.list()) {
         void this.worktrees.release(handle, { keep: true }).catch(() => {

package/dist/hooks/index.js

@@ -37,6 +37,11 @@ var SECRET_NAME_PARTS = [
   "SECRET",
   "PASSWORD",
   "PASSWD",
+  // WRONGSTACK_VAULT_PASSPHRASE is the vault KEK. Without this entry it matched
+  // no rule here and fell through to the `WRONGSTACK_` prefix allow-rule, so the
+  // key that protects the credential vault was forwarded to every child process
+  // — including the agent's own exec/bash tools and MCP stdio servers (WS-033).
+  "PASSPHRASE",
   "AUTH",
   "CRED",
   "BEARER",

package/dist/hq/auth-audit.d.ts

@@ -87,6 +87,12 @@ export interface HqAuthAuditEntry {
 }
 /** Path to `auth-audit.jsonl` under the given data dir. */
 export declare function hqAuthAuditPath(dataDir: string): string;
+/**
+ * Read the last `maxEntries` entries from the audit log.
+ * Returns entries newest-first. If the file doesn't exist or is empty,
+ * returns an empty array.
+ */
+export declare function readHqAuthAuditTail(dataDir: string, maxEntries?: number): HqAuthAuditEntry[];
 /**
  * Append a single audit entry to `<dataDir>/auth-audit.jsonl`.
  *

package/dist/hq/auth-store.d.ts

@@ -56,7 +56,38 @@ export interface HqToken {
      * rather than the local wall clock.
      */
     expiresAt?: string;
+    /**
+     * `sha256(secret)`, hex. WS-044: browser tokens used to sit in `auth.json`
+     * in cleartext, directly beside a correctly scrypt-hashed password — so a
+     * copy of the file (a home-directory backup, a synced folder, a support
+     * bundle) handed over working bearer credentials. Browser tokens are now
+     * persisted as a verifier only, and `token` is blanked on write.
+     *
+     * Client tokens deliberately keep their cleartext `token`: a local agent
+     * process reads it back out of `auth.json` to attach itself as an HQ client
+     * (`hq/factory.ts readFirstClientTokenFromAuthFile`). Hashing them would
+     * only move the secret to another file on the same disk. Their control is
+     * the owner-only file mode (WS-045), not a one-way hash.
+     */
+    verifier?: string;
 }
+/**
+ * The one-way verifier for an HQ token secret.
+ *
+ * Plain SHA-256, not scrypt: unlike the operator password, a token is 64 hex
+ * characters of `randomUUID()` entropy, so there is nothing to brute-force
+ * and the verifier sits on the per-request auth path where a deliberately
+ * slow KDF would be a self-inflicted DoS.
+ */
+export declare function hqTokenVerifier(secret: string): string;
+/**
+ * Lookup key for a stored token — its verifier, derived from a legacy
+ * cleartext `token` when the file predates WS-044. Every live-token Set/Map
+ * in the HQ server is keyed on this, and the presented secret is hashed with
+ * {@link hqTokenVerifier} before lookup, so both formats authenticate during
+ * the migration window.
+ */
+export declare function hqTokenKey(token: Pick<HqToken, 'token' | 'verifier'>): string;
 /**
  * True when a token has a wall-clock expiry that has already passed.
  * Returns `false` when `expiresAt` is absent (the pre-TTL default).
@@ -115,6 +146,27 @@ export interface HqAuthFile {
     passwordHash?: string;
     /** Secret used to sign browser session cookies. */
     cookieSecret?: string;
+    /**
+     * Base32-encoded TOTP secret (RFC 6238) for HQ 2FA — ACTIVE. Login checks
+     * this field, not `totpPendingSecret`, so an unconfirmed setup cannot lock
+     * the operator out. Only set after `/api/auth/totp/enable` confirms a
+     * valid code.
+     */
+    totpSecret?: string;
+    /**
+     * Base32-encoded TOTP secret written by `/api/auth/totp/setup` but NOT
+     * yet confirmed. Promoted to `totpSecret` (active) only after
+     * `/api/auth/totp/enable` verifies a code. If the operator abandons
+     * enrollment (restarts, logs out), the pending secret is inert — login
+     * never checks this field.
+     */
+    totpPendingSecret?: string;
+    /**
+     * SHA-256 hashes of single-use recovery codes. Like token verifiers
+     * (WS-044), only the hash is persisted so a leaked `auth.json` cannot
+     * reveal unused codes. Each code is consumed on first successful use.
+     */
+    totpRecoveryCodes?: string[];
     /**
      * Operator-configured alert-rule thresholds. When present, these override
      * the built-in defaults for the alert engine (cost ceiling, stale-machine
@@ -176,9 +228,13 @@ export declare function readHqAuthFile(dataDir: string, _opts?: {
     warn?: (msg: string) => void;
 }): Promise<HqAuthFile>;
 /**
- * Write `auth.json` atomically with mode 0o600. Creates the data directory
- * if needed. Throws on I/O failure — callers (CLI commands) should surface
- * the error to the operator.
+ * Write `auth.json` atomically, owner-only. Creates the data directory if
+ * needed. Throws on I/O failure — callers (CLI commands) should surface the
+ * error to the operator.
+ *
+ * WS-045: the `mode: 0o600` here was the whole protection, and Windows ignores
+ * it. The file holds browser and client bearer tokens; it now also goes
+ * through the icacls path so it is genuinely owner-only on both platforms.
  */
 export declare function writeHqAuthFile(dataDir: string, file: HqAuthFile): Promise<void>;
 export interface EnsureHqFirstRunAuthOptions {