@wrongstack/core 0.298.2 → 0.299.0

package/dist/index.js

@@ -3207,7 +3207,9 @@ function safeProfileName(name) {
 function activeProfileName(globalRoot) {
   try {
     const parsed = JSON.parse(fs4.readFileSync(path5.join(globalRoot, "config.json"), "utf8"));
-    return safeProfileName(typeof parsed.activeProfile === "string" ? parsed.activeProfile : void 0);
+    return safeProfileName(
+      typeof parsed.activeProfile === "string" ? parsed.activeProfile : void 0
+    );
   } catch {
     return "default";
   }
@@ -3287,6 +3289,7 @@ function resolveWstackPaths(opts) {
     projectPlan: path5.join(projectDir, "plan.json"),
     projectAutophase: path5.join(projectDir, "autophase"),
     projectSddBoards: path5.join(projectDir, "sdd-boards"),
+    projectRequirementIntakes: path5.join(projectDir, "requirement-intakes"),
     syncConfig: path5.join(profileDir, "sync.json"),
     configHistoryDir: path5.join(globalRoot, "config-history"),
     projectStatus: (projectHash2) => path5.join(globalRoot, "projects", projectHash2, "status.json")
@@ -3795,6 +3798,15 @@ var IN_PROJECT_DENIED_PATHS = [
     reason: "Extends the exec allow-list; a repo could authorise its own binaries."
   },
   { path: "tools.exec.danger", reason: "Weakens the destructive-command banner." },
+  {
+    // The whole subtree, not just the dangerous leaves: a persona's
+    // `instruction` is rendered into the voter SYSTEM prompt, a profile seat
+    // may pin providerId/model, and `defaultProfile` selects which of those
+    // runs when the agent names no profile. Denying the parent leaves no leaf
+    // to reclassify wrongly later.
+    path: "tools.council",
+    reason: "Council tool panel definitions: persona instructions are injected into the voter SYSTEM prompt and profile seats can pin an attacker-chosen providerId/model."
+  },
   { path: "skills.extraDirs", reason: "Loads skill definitions from repo-chosen directories." },
   { path: "skills.registryUrl", reason: "Redirects skill installs to a repo-chosen host." },
   // Deliberately NOT denied: skills.mode and skills.eagerMaxChars. The audit
@@ -29664,7 +29676,7 @@ var ROUTE_SCOPED_QUOTA_RE = /\b(?:for|on)\s+(?:(?:this|the)\s+)?(?:route|model)\
 function effectiveInputTokens(usage) {
   return usage.input + (usage.cacheRead ?? 0) + (usage.cacheWrite ?? 0);
 }
-var CONTEXT_OVERFLOW_RE = /context.length|context.window|maximum context|max.*tokens?.*exceeded|prompt is too long|too long|exceeds the context|\btokens\b.*exceed|too many tokens|reduce the length|resulted in \d+ tokens|input.{0,12}too (?:large|long)|context_length_exceeded/i;
+var CONTEXT_OVERFLOW_RE = /context.length|context.window|maximum context|max.*tokens?.*exceeded|(?:prompt|request|input|messages?).{0,12}too (?:large|long)|exceeds the context|\btokens\b.*exceed|too many tokens|reduce the length|resulted in \d+ tokens|context_length_exceeded/i;
 var CONTENT_FILTER_RE = /content.(filter|policy|moderation)|safety (system|filter)/i;
 var RATE_LIMIT_EXCEEDED_RE = /rate[-_\s]*limit[-_\s]*exceeded/i;
 function classifyProviderError(status, body, message) {
@@ -29674,7 +29686,7 @@ function classifyProviderError(status, body, message) {
   if (status === 408) return "timeout";
   if (status === 599) return "stream_hang";
   if (status === 402 || QUOTA_EXHAUSTED_RE.test(text2)) return "quota_exhausted";
-  if (status === 429 && body?.message && RATE_LIMIT_EXCEEDED_RE.test(body.message)) {
+  if (status === 429 && body?.message && body.type !== "rate_limit_exceeded" && RATE_LIMIT_EXCEEDED_RE.test(body.message)) {
     return "quota_exhausted";
   }
   if (type === "rate_limit_error" || status === 429) return "rate_limit";
@@ -29810,7 +29822,7 @@ var ProviderError = class extends WrongStackError {
     const e = err;
     const name = e.name;
     if (typeof name !== "string" || !name.endsWith("Error")) return false;
-    return typeof e.status === "number" && typeof e.retryable === "boolean" && typeof e.kind === "string";
+    return typeof e.status === "number" && typeof e.retryable === "boolean" && typeof e.kind === "string" && typeof e.describe === "function";
   }
   constructor(message, status, retryable, providerId, opts = {}) {
     const kind = opts.kind ?? classifyProviderError(status, opts.body, message);
@@ -47391,7 +47403,8 @@ var KNOWN_HQ_CLIENT_FRAME_TYPES = /* @__PURE__ */ new Set([
   "client.event",
   "client.command_poll",
   "client.command_ack",
-  "client.resume"
+  "client.resume",
+  "client.event_poll"
 ]);
 var HQ_CLIENT_KINDS = /* @__PURE__ */ new Set([
   "tui",
@@ -49918,6 +49931,16 @@ function hash3(value) {
 
 // src/core/provider-runner.ts
 import { randomUUID as randomUUID31 } from "node:crypto";
+function scrubProviderBody(body) {
+  if (!body) return void 0;
+  return {
+    ...body,
+    ...body.type !== void 0 ? { type: scrubErrorText(body.type) } : {},
+    ...body.message !== void 0 ? { message: scrubErrorText(body.message) } : {},
+    ...body.raw !== void 0 ? { raw: scrubErrorText(body.raw) } : {},
+    ...body.requestId !== void 0 ? { requestId: scrubErrorText(body.requestId) } : {}
+  };
+}
 function providerLogCtx(p, r) {
   return {
     providerId: p.id,
@@ -50002,7 +50025,10 @@ async function runProviderWithRetry(opts) {
       const isProviderErr = err instanceof ProviderError || ProviderError.isProviderError(err);
       const errAsErr = err instanceof Error ? err : new Error(String(err));
       const canRetry = retry.shouldRetry(isProviderErr ? err : errAsErr, attempt);
-      const description = isProviderErr ? err.describe() : errAsErr.message;
+      const providerErrorBody = isProviderErr ? scrubProviderBody(err.body) : void 0;
+      const description = scrubErrorText(
+        isProviderErr ? err.describe() : errAsErr.message
+      );
       const delay3 = canRetry ? Math.round(retry.delayMs(attempt, isProviderErr ? err : errAsErr)) : void 0;
       events.emit("provider.attempt.failed", {
         ...correlation,
@@ -50015,7 +50041,8 @@ async function runProviderWithRetry(opts) {
         retryable: canRetry,
         retryScheduled: canRetry,
         ...delay3 !== void 0 ? { retryDelayMs: delay3 } : {},
-        ...isProviderErr && err.body?.requestId ? { providerRequestId: err.body.requestId } : {}
+        ...providerErrorBody?.requestId ? { providerRequestId: providerErrorBody.requestId } : {},
+        ...providerErrorBody ? { errorBody: providerErrorBody } : {}
       });
       if (!canRetry) {
         events.emit("provider.error", {
@@ -50023,13 +50050,15 @@ async function runProviderWithRetry(opts) {
           providerId: isProviderErr ? err.providerId : provider.id,
           status: isProviderErr ? err.status : 0,
           description,
-          retryable: false
+          retryable: false,
+          ...providerErrorBody ? { errorBody: providerErrorBody } : {}
         });
         logger.error(`Provider call failed after ${attempt + 1} attempt(s) \u2014 ${description}`, {
           ...providerLogCtx(provider, request),
           attempts: attempt + 1,
           errorDescription: description,
           status: isProviderErr ? err.status : void 0,
+          errorBody: providerErrorBody,
           errorName: err instanceof Error ? err.name : void 0,
           errorStack: err instanceof Error ? err.stack?.split("\n").slice(0, 3).join("\n") : void 0
         });
@@ -50043,7 +50072,8 @@ async function runProviderWithRetry(opts) {
         maxAttempts,
         delayMs: delay3,
         errorDescription: description,
-        status: isProviderErr ? err.status : void 0
+        status: isProviderErr ? err.status : void 0,
+        errorBody: providerErrorBody
       });
       events.emit("provider.retry", {
         sessionId: resolveEventSessionId(ctx),
@@ -50051,7 +50081,8 @@ async function runProviderWithRetry(opts) {
         attempt: attemptNum,
         delayMs: delay3,
         status: isProviderErr ? err.status : 0,
-        description
+        description,
+        ...providerErrorBody ? { errorBody: providerErrorBody } : {}
       });
       await new Promise((resolve50, reject) => {
         let settled = false;
@@ -60665,6 +60696,38 @@ var sshManagerServer = () => ({
   permission: "confirm",
   requestTimeoutMs: 18e4
 });
+var requirementIntakeServer = () => ({
+  name: "requirement-intake",
+  description: "WrongStack Requirements Intake \u2014 list intake records and file new ones (project-scoped, --writable)",
+  transport: "stdio",
+  command: "wstack-requirement-intake-mcp",
+  args: ["--project-root", ".", "--writable"],
+  permission: "auto"
+});
+var kanbanServer = () => ({
+  name: "kanban",
+  description: "WrongStack Kanban \u2014 inspect and manage project work boards (project-scoped, manage tier, no destructive ops)",
+  transport: "stdio",
+  command: "wstack-kanban-mcp",
+  args: ["--project-root", ".", "--writable"],
+  permission: "confirm"
+});
+var mailboxServer = () => ({
+  name: "mailbox",
+  description: "WrongStack Mailbox \u2014 read and send project agent mail (project-scoped, no admin/credentials)",
+  transport: "stdio",
+  command: "wstack-mailbox-mcp",
+  args: ["--project-root", ".", "--actor", "external-agent", "--writable"],
+  permission: "auto"
+});
+var codebaseIndexServer = () => ({
+  name: "codebase-index",
+  description: "WrongStack Codebase Index \u2014 symbol search and dependency graphs (project-scoped, --writable)",
+  transport: "stdio",
+  command: "wstack-codebase-index-mcp",
+  args: ["--project-root", ".", "--writable"],
+  permission: "auto"
+});
 var allServers = () => ({
   filesystem: { ...filesystemServer(), enabled: false },
   github: { ...githubServer(), enabled: false },
@@ -60679,7 +60742,11 @@ var allServers = () => ({
   "zai-vision": { ...zaiVisionServer(), enabled: false },
   "minimax-vision": { ...miniMaxVisionServer(), enabled: false },
   playwright: { ...playwrightServer(), enabled: false },
-  ssh: { ...sshManagerServer(), enabled: false }
+  ssh: { ...sshManagerServer(), enabled: false },
+  kanban: { ...kanbanServer(), enabled: false },
+  mailbox: { ...mailboxServer(), enabled: false },
+  "codebase-index": { ...codebaseIndexServer(), enabled: false },
+  "requirement-intake": { ...requirementIntakeServer(), enabled: false }
 });
 
 // src/models/codex-catalog.ts
@@ -65416,6 +65483,9 @@ var BUILTIN_COUNCIL_PERSONAS = Object.freeze([
     tags: ["users", "usability", "accessibility"]
   })
 ]);
+var BUILTIN_COUNCIL_PERSONA_IDS = Object.freeze(
+  BUILTIN_COUNCIL_PERSONAS.map((persona) => persona.id)
+);
 var CouncilPersonaRegistry = class _CouncilPersonaRegistry {
   byId;
   constructor(personas = []) {
@@ -66537,6 +66607,44 @@ function errorMessage3(error2) {
 }
 
 // src/execution/council-brain.ts
+var MAX_CUSTOM_PERSONA_ID_CHARS = 48;
+function customPersonaId(raw, index) {
+  const slug = raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, MAX_CUSTOM_PERSONA_ID_CHARS).replace(/-+$/g, "");
+  return slug ? `custom-${slug}` : `custom-${index + 1}`;
+}
+function resolvePersonaRegistry(voters) {
+  let registry2 = DEFAULT_COUNCIL_PERSONA_REGISTRY;
+  const personaIds = [];
+  const byRawText = /* @__PURE__ */ new Map();
+  voters.forEach((voter, index) => {
+    const raw = voter.persona?.trim();
+    if (!raw) {
+      personaIds.push("executor");
+      return;
+    }
+    if (registry2.has(raw)) {
+      personaIds.push(raw);
+      return;
+    }
+    const existing = byRawText.get(raw);
+    if (existing) {
+      personaIds.push(existing);
+      return;
+    }
+    let id = customPersonaId(raw, index);
+    let suffix = 2;
+    while (registry2.has(id)) id = `${customPersonaId(raw, index)}-${suffix++}`;
+    registry2 = registry2.with({
+      id,
+      name: raw.length <= 40 ? raw : `${raw.slice(0, 39)}\u2026`,
+      description: "Custom decision lens supplied by the host configuration.",
+      instruction: raw
+    });
+    byRawText.set(raw, id);
+    personaIds.push(id);
+  });
+  return { registry: registry2, personaIds };
+}
 function createCouncilBrainArbiter(opts) {
   if (opts.voters.length === 0) {
     throw new Error("createCouncilBrainArbiter: at least one voter is required.");
@@ -66602,14 +66710,15 @@ function createCouncilBrainArbiter(opts) {
     }
     return makeSeatCallerForVoter(voter);
   };
+  const { registry: personas, personaIds } = resolvePersonaRegistry(opts.voters);
   const seats = opts.voters.map((voter, i) => ({
     id: `voter-${i}`,
     label: voter.label ?? voter.model,
-    persona: voter.persona ?? "executor",
+    persona: personaIds[i] ?? "executor",
     target: {
       providerId: voter.provider.id,
       model: voter.model,
-      role: voter.persona ?? "executor"
+      role: personaIds[i] ?? "executor"
     },
     weight: voter.weight,
     veto: voter.veto
@@ -66631,6 +66740,9 @@ function createCouncilBrainArbiter(opts) {
   };
   const orchestrator = new CouncilOrchestrator({
     defaultProfile: "brain-council-adapter",
+    // Carries the ad-hoc lenses registered above; without it the orchestrator
+    // falls back to the built-in registry and rejects every custom persona.
+    personas,
     // Previously never passed, so the panel was pinned at the orchestrator's
     // default of 3 concurrent seats no matter how many voters were configured.
     ...opts.maxConcurrency !== void 0 ? { maxConcurrency: opts.maxConcurrency } : {},
@@ -67984,7 +68096,8 @@ var OneShotOrchestrator = class {
   resolveTarget(input, config) {
     if (input.role && this.opts.modelRouter) {
       const pick = this.opts.modelRouter.pickForTask(input.role, "");
-      if (pick) {
+      const hasExplicitTarget = Boolean(input.providerId || input.model);
+      if (pick && (pick.fromMatrix === true || !hasExplicitTarget)) {
         return { providerId: pick.provider, model: pick.model };
       }
     }
@@ -71265,18 +71378,26 @@ function parseHookOutcome(stdout) {
 // src/hooks/http-executor.ts
 var DEFAULT_TIMEOUT_MS6 = 5e3;
 var MAX_OUTPUT_BYTES2 = 64 * 1024;
-function isAllowedUrl(raw) {
+async function isAllowedUrl(raw) {
+  let url;
   try {
-    const url = new URL(raw);
-    if (url.protocol === "https:") return true;
-    if (url.protocol !== "http:") return false;
-    return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    url = new URL(raw);
   } catch {
     return false;
   }
+  if (url.protocol === "https:") {
+    try {
+      await assertNotPrivateHost(url.hostname);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  if (url.protocol !== "http:") return false;
+  return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
 }
 async function runHttpHookDetailed(spec, input, logger, options = {}) {
-  if (!isAllowedUrl(spec.url)) {
+  if (!await isAllowedUrl(spec.url)) {
     return {
       outcome: null,
       failure: {
@@ -74070,6 +74191,7 @@ var HqBootstrapCodeStore = class {
 };
 
 // src/hq/exposure.ts
+import { isIP as isIP2 } from "node:net";
 var HQ_CLI_DEFAULT_HOST = "0.0.0.0";
 var HqInsecureExposureError = class extends Error {
   constructor(message) {
@@ -74079,8 +74201,15 @@ var HqInsecureExposureError = class extends Error {
 };
 function isLoopbackHost(host) {
   const normalized = host.trim().toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
-  if (normalized === "localhost" || normalized === "::1") return true;
-  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(normalized);
+  if (normalized === "localhost") return true;
+  const family = isIP2(normalized);
+  if (family === 4) {
+    return normalized.startsWith("127.");
+  }
+  if (family === 6) {
+    return normalized === "::1" || /^::ffff:127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(normalized);
+  }
+  return false;
 }
 function isOpenMode(input) {
   return !input.hasBrowserTokens && !input.hasPassword;
@@ -85082,7 +85211,7 @@ var INPUT_SCHEMA = {
     },
     profile: {
       type: "string",
-      description: "Registered Council profile id. Defaults to the host-configured profile."
+      description: 'Registered Council profile id (e.g. "balanced", "fast", "risk-review"). Defaults to the host-configured profile.'
     }
   },
   required: ["question"],
@@ -85093,10 +85222,12 @@ function createCouncilTool(opts) {
     ...opts,
     fallbackProfileManager: opts.fallbackProfileManager
   });
+  const profiles = opts.profiles ?? DEFAULT_COUNCIL_PROFILE_REGISTRY;
+  const profileIds = profiles.list().map((profile) => profile.id);
   return {
     name: COUNCIL_TOOL_NAME,
     description: "Ask an independent, multi-persona Council to evaluate a decision or synthesize an answer. Uses bounded parallel voters, quorum/veto/weighted resolution, optional judging, model routing, fallback chains, and cancellation.",
-    usageHint: "Use for consequential or disputed decisions that benefit from independent lenses. Provide `options` for a vote or omit them for an open answer. Keep context evidence-focused; the Council treats it as untrusted data.",
+    usageHint: `Use for consequential or disputed decisions that benefit from independent lenses. Provide \`options\` for a vote or omit them for an open answer. Keep context evidence-focused; the Council treats it as untrusted data. Available profiles: ${profileIds.join(", ")}.`,
     category: "meta",
     inputSchema: INPUT_SCHEMA,
     permission: "auto",
@@ -85114,11 +85245,17 @@ function createCouncilTool(opts) {
       };
       return orchestrator.ask(question);
     },
-    validate: validateCouncilToolInput
+    validate: (input) => validateCouncilToolInput(input, profileIds)
   };
 }
-function validateCouncilToolInput(input) {
+function validateCouncilToolInput(input, profileIds) {
   const errors = [];
+  if (typeof input.profile === "string" && input.profile.trim()) {
+    const id = input.profile.trim();
+    if (!profileIds.includes(id)) {
+      errors.push(`Unknown \`profile\` "${id}". Available: ${profileIds.join(", ")}.`);
+    }
+  }
   const question = input.question?.trim() ?? "";
   if (!question) errors.push("`question` must not be empty.");
   if (question.length > MAX_COUNCIL_QUESTION_CHARS) {
@@ -87075,7 +87212,7 @@ var DEFAULT_SPEC_TEMPLATE = {
 
 // src/worktree/worktree-manager.ts
 init_error();
-import { mkdir as mkdir31 } from "node:fs/promises";
+import { mkdir as mkdir31, readFile as readFile66 } from "node:fs/promises";
 import { join as join85, resolve as resolve49, sep as sep8 } from "node:path";
 
 // src/worktree/worktree-git.ts
@@ -87456,6 +87593,10 @@ ${merged.stderr}`);
    * Safe because SDD merges are serialized — no other commit lands in between.
    */
   async revertBaseTo(handle, sha) {
+    const status = await this.runGit(["status", "--porcelain"], this.projectRoot);
+    if (status.code !== 0) return false;
+    const hasTrackedDirt = status.stdout.split("\n").some((line) => line.trim().length > 0 && !line.startsWith("??"));
+    if (hasTrackedDirt) return false;
     const co = await this.runGit(["checkout", handle.baseBranch], this.projectRoot);
     if (co.code !== 0) return false;
     const reset = await this.runGit(["reset", "--hard", sha], this.projectRoot);
@@ -87670,29 +87811,47 @@ ${merged.stderr}`);
   /**
    * True when staged content still carries conflict markers.
    *
-   * Primary probe: `git grep --cached` scans the STAGED blobs directly for a
-   * full marker line (`<<<<<<< `, `=======`, `>>>>>>> `, `||||||| `) — exit 0
-   * means found. This is byte-level and independent of git version, locale,
-   * and human-output phrasing. When the caller knows which files conflicted,
-   * the scan is restricted to them so an unrelated `=======` underline in
-   * some document can't false-positive.
+   * Reads the working-tree files directly and matches a full marker line
+   * (`<<<<<<< `, `=======`, `>>>>>>> `, `||||||| `) with a lenient regex
+   * (`{7,}`) that stays platform- and config-independent — unlike the old
+   * `git diff --check` (only fires when `core.whitespace` opts in) and
+   * `git grep` (assumes the default 7-char markers).
+   *
+   * Scan set: when the caller supplies the conflicted paths (the normal
+   * path from {@link tryResolveConflict}), ONLY those files are scanned so
+   * an unrelated `=======` setext-heading underline in a staged document
+   * can't false-positive and discard valid resolution work. The staged-file
+   * listing (`git diff --cached --name-only`) is used only as a fallback
+   * when no paths are given.
    *
-   * Fallback probe: `git diff --cached --check` prints a "leftover conflict
-   * marker" line per survivor. Kept as belt-and-braces — it was the original
-   * sole probe, but CI runners were observed to miss markers through it
-   * (output parsing), which let a half-resolved merge commit.
+   * CRLF caveat: conflicted files checked out with CRLF (`core.autocrlf=true`,
+   * `.gitattributes eol=crlf`) carry bare markers as `=======\r\n`. Because
+   * `$` in multiline mode matches only before `\n`, carriage returns are
+   * stripped before matching so `\r` never defeats the end-of-line anchor.
    */
   async hasConflictMarkers(files) {
-    const pathspec = files && files.length > 0 ? ["--", ...files] : [];
-    const grep = await this.runGit(
-      ["grep", "--cached", "-q", "-E", "^(<{7} |={7}$|>{7} |\\|{7} )", ...pathspec],
-      this.projectRoot
-    );
-    if (grep.code === 0) return true;
-    const check = await this.runGit(["diff", "--cached", "--check"], this.projectRoot);
-    if (check.code === 0) return false;
-    return /conflict marker/i.test(`${check.stdout}
-${check.stderr}`);
+    const listed = files ?? [];
+    const paths = listed.length > 0 ? listed : (await this.runGit(["diff", "--cached", "--name-only", "-z"], this.projectRoot)).stdout.split("\0").filter(Boolean);
+    const marker = /^(?:<{7,}(?: |$)|={7,}$|>{7,}(?: |$)|\|{7,}(?: |$))/m;
+    const startMarker = /^(?:<{7,}(?: |$)|\|{7,}(?: |$))/m;
+    for (const rel of paths) {
+      try {
+        const content = (await readFile66(join85(this.projectRoot, rel), "utf8")).replace(/\r/g, "");
+        const lines = content.split("\n");
+        let seenStart = false;
+        for (const line of lines) {
+          if (!marker.test(line)) continue;
+          if (line.startsWith("=====")) {
+            if (!seenStart) continue;
+          } else if (startMarker.test(line)) {
+            seenStart = true;
+          }
+          return true;
+        }
+      } catch {
+      }
+    }
+    return false;
   }
   /**
    * Remove the worktree + branch. Conflicted/failed handles (or `keep:true`)
@@ -87826,6 +87985,7 @@ export {
   BUG_HUNTER_AGENT,
   BUILD_AGENTS,
   BUILTIN_COUNCIL_PERSONAS,
+  BUILTIN_COUNCIL_PERSONA_IDS,
   BUILTIN_COUNCIL_PROFILES,
   BUILTIN_PROMPT_CATEGORIES,
   BrainCircuitBreaker,

package/dist/infrastructure/index.js

@@ -1397,6 +1397,38 @@ var sshManagerServer = () => ({
   permission: "confirm",
   requestTimeoutMs: 18e4
 });
+var requirementIntakeServer = () => ({
+  name: "requirement-intake",
+  description: "WrongStack Requirements Intake \u2014 list intake records and file new ones (project-scoped, --writable)",
+  transport: "stdio",
+  command: "wstack-requirement-intake-mcp",
+  args: ["--project-root", ".", "--writable"],
+  permission: "auto"
+});
+var kanbanServer = () => ({
+  name: "kanban",
+  description: "WrongStack Kanban \u2014 inspect and manage project work boards (project-scoped, manage tier, no destructive ops)",
+  transport: "stdio",
+  command: "wstack-kanban-mcp",
+  args: ["--project-root", ".", "--writable"],
+  permission: "confirm"
+});
+var mailboxServer = () => ({
+  name: "mailbox",
+  description: "WrongStack Mailbox \u2014 read and send project agent mail (project-scoped, no admin/credentials)",
+  transport: "stdio",
+  command: "wstack-mailbox-mcp",
+  args: ["--project-root", ".", "--actor", "external-agent", "--writable"],
+  permission: "auto"
+});
+var codebaseIndexServer = () => ({
+  name: "codebase-index",
+  description: "WrongStack Codebase Index \u2014 symbol search and dependency graphs (project-scoped, --writable)",
+  transport: "stdio",
+  command: "wstack-codebase-index-mcp",
+  args: ["--project-root", ".", "--writable"],
+  permission: "auto"
+});
 var allServers = () => ({
   filesystem: { ...filesystemServer(), enabled: false },
   github: { ...githubServer(), enabled: false },
@@ -1411,7 +1443,11 @@ var allServers = () => ({
   "zai-vision": { ...zaiVisionServer(), enabled: false },
   "minimax-vision": { ...miniMaxVisionServer(), enabled: false },
   playwright: { ...playwrightServer(), enabled: false },
-  ssh: { ...sshManagerServer(), enabled: false }
+  ssh: { ...sshManagerServer(), enabled: false },
+  kanban: { ...kanbanServer(), enabled: false },
+  mailbox: { ...mailboxServer(), enabled: false },
+  "codebase-index": { ...codebaseIndexServer(), enabled: false },
+  "requirement-intake": { ...requirementIntakeServer(), enabled: false }
 });
 
 // src/utils/expect-defined.ts
@@ -2900,7 +2936,9 @@ function safeProfileName(name) {
 function activeProfileName(globalRoot) {
   try {
     const parsed = JSON.parse(fs4.readFileSync(path5.join(globalRoot, "config.json"), "utf8"));
-    return safeProfileName(typeof parsed.activeProfile === "string" ? parsed.activeProfile : void 0);
+    return safeProfileName(
+      typeof parsed.activeProfile === "string" ? parsed.activeProfile : void 0
+    );
   } catch {
     return "default";
   }
@@ -2980,6 +3018,7 @@ function resolveWstackPaths(opts) {
     projectPlan: path5.join(projectDir, "plan.json"),
     projectAutophase: path5.join(projectDir, "autophase"),
     projectSddBoards: path5.join(projectDir, "sdd-boards"),
+    projectRequirementIntakes: path5.join(projectDir, "requirement-intakes"),
     syncConfig: path5.join(profileDir, "sync.json"),
     configHistoryDir: path5.join(globalRoot, "config-history"),
     projectStatus: (projectHash2) => path5.join(globalRoot, "projects", projectHash2, "status.json")
@@ -3413,6 +3452,15 @@ var IN_PROJECT_DENIED_PATHS = [
     reason: "Extends the exec allow-list; a repo could authorise its own binaries."
   },
   { path: "tools.exec.danger", reason: "Weakens the destructive-command banner." },
+  {
+    // The whole subtree, not just the dangerous leaves: a persona's
+    // `instruction` is rendered into the voter SYSTEM prompt, a profile seat
+    // may pin providerId/model, and `defaultProfile` selects which of those
+    // runs when the agent names no profile. Denying the parent leaves no leaf
+    // to reclassify wrongly later.
+    path: "tools.council",
+    reason: "Council tool panel definitions: persona instructions are injected into the voter SYSTEM prompt and profile seats can pin an attacker-chosen providerId/model."
+  },
   { path: "skills.extraDirs", reason: "Loads skill definitions from repo-chosen directories." },
   { path: "skills.registryUrl", reason: "Redirects skill installs to a repo-chosen host." },
   // Deliberately NOT denied: skills.mode and skills.eagerMaxChars. The audit

package/dist/infrastructure/mcp-servers.d.ts

@@ -78,6 +78,41 @@ export declare const miniMaxVisionServer: () => MCPServerConfig;
  * env/TOML config (for example SSH_SERVER_<NAME>_HOST, USER, KEYPATH/PASSWORD) or ssh-agent.
  */
 export declare const sshManagerServer: () => MCPServerConfig;
+/**
+ * WrongStack Requirements Intake — list intake records and file + submit new
+ * ones against the project's intake store (`wstack-requirement-intake-mcp`).
+ * Project-scoped: resolves the project from the spawn cwd (`--project-root .`);
+ * customize the arg for absolute paths. Tools are structured domain tools
+ * (list/submit) with no file, shell, or network surface, so the permission
+ * defaults to `auto`.
+ */
+export declare const requirementIntakeServer: () => MCPServerConfig;
+/**
+ * WrongStack Kanban — inspect and manage durable project work through the
+ * project-scoped Kanban IPC owner (`wstack-kanban-mcp`). The preset exposes
+ * the writable manage tier (create/update/transition tasks, splitting,
+ * assignment) but never `--destructive` (delete/merge/transfer). Mutations
+ * touch durable project board state, so the permission defaults to `confirm`.
+ */
+export declare const kanbanServer: () => MCPServerConfig;
+/**
+ * WrongStack Mailbox — coordinate with project agents through the existing
+ * project-scoped mailbox IPC owner (`wstack-mailbox-mcp`). The preset exposes
+ * the writable tier (send, receipts, self-presence) but never `--admin`
+ * (maintenance + credential operations).
+ *
+ * `--actor` is mandatory: the child CLI exits with code 2 without it. The
+ * default `external-agent` identity should be customized per external agent
+ * (it is the authoritative identity for sends, receipts, and registration).
+ */
+export declare const mailboxServer: () => MCPServerConfig;
+/**
+ * WrongStack Codebase Index — symbol search and dependency graphs over the
+ * project's codebase index (`wstack-codebase-index-mcp`). The preset exposes
+ * `--writable` so `codebase_index` (incremental/full rebuild) is available;
+ * index rebuilds are CPU/disk work with no semantic risk.
+ */
+export declare const codebaseIndexServer: () => MCPServerConfig;
 /** Everything bundled — full set of built-in servers. Useful for `wstack mcp add --all`. */
 export declare const allServers: () => Record<string, MCPServerConfig>;
 //# sourceMappingURL=mcp-servers.d.ts.map

package/dist/kernel/events/provider-events.d.ts

@@ -1,7 +1,7 @@
 import type { ChroniclePromptManifest } from '../../chronicle/prompt-manifest.js';
 import type { Context } from '../../core/context.js';
 import type { ContentBlock } from '../../types/blocks.js';
-import type { Usage } from '../../types/provider.js';
+import type { ProviderErrorBody, Usage } from '../../types/provider.js';
 export interface ProviderEventMap {
     /** Fired before every physical provider/model attempt, including attempt zero. */
     'provider.attempt.started': {
@@ -63,6 +63,8 @@ export interface ProviderEventMap {
         retryScheduled: boolean;
         retryDelayMs?: number | undefined;
         providerRequestId?: string | undefined;
+        /** Scrubbed provider failure envelope/body retained for diagnostics. */
+        errorBody?: ProviderErrorBody | undefined;
         /** Kanban task this provider call belongs to, when known. */
         taskId?: string | undefined;
         /** Kanban board this provider call belongs to, when known. */
@@ -123,6 +125,8 @@ export interface ProviderEventMap {
         delayMs: number;
         status: number;
         description: string;
+        /** Scrubbed provider failure envelope/body retained for diagnostics. */
+        errorBody?: ProviderErrorBody | undefined;
     };
     /**
      * Fired once when a provider call ultimately fails (retries exhausted, or
@@ -134,6 +138,8 @@ export interface ProviderEventMap {
         status: number;
         description: string;
         retryable: boolean;
+        /** Scrubbed provider failure envelope/body retained for diagnostics. */
+        errorBody?: ProviderErrorBody | undefined;
     };
     /**
      * Fired by the fallback-model extension when the primary model is overloaded

package/dist/kernel/events/sdd-events.d.ts

@@ -17,6 +17,8 @@ export interface SddEventMap {
         completed: number;
         failed: number;
         stopped: boolean;
+        /** Fatal, non-recoverable error that hard-stopped the run (implies `stopped: true`). */
+        fatalError?: string | undefined;
     };
     /** A task began executing on a worker (carries who + which worktree). */
     'sdd.task.started': {