@wrongstack/core 0.299.0 → 0.300.0

package/dist/defaults/index.js

@@ -295,7 +295,7 @@ var InMemoryAgentBridge = class {
       });
     }
     this.inflightGuards.add(correlationId);
-    return new Promise((resolve17, reject) => {
+    return new Promise((resolve19, reject) => {
       const timer = setTimeout(() => {
         this.inflightGuards.delete(correlationId);
         this.pendingRequests.delete(correlationId);
@@ -314,7 +314,7 @@ var InMemoryAgentBridge = class {
         return;
       }
       this.pendingRequests.set(correlationId, {
-        resolve: resolve17,
+        resolve: resolve19,
         reject,
         timer
       });
@@ -663,13 +663,13 @@ var SubagentBudget = class _SubagentBudget {
     if (!bus?.hasListenerFor("budget.threshold_reached")) {
       return Promise.resolve("stop");
     }
-    return new Promise((resolve17) => {
+    return new Promise((resolve19) => {
       let resolved = false;
       const respond = (d) => {
         if (resolved) return;
         resolved = true;
         clearTimeout(fallback);
-        resolve17(d);
+        resolve19(d);
       };
       const fallback = setTimeout(() => respond("stop"), _SubagentBudget.DECISION_TIMEOUT_MS);
       const sessionId = this.currentSessionId();
@@ -5306,7 +5306,7 @@ function createDelegateTool(opts) {
   };
 }
 async function awaitDelegateAttempt(director, subagentId, taskId, timeoutMs, abortSignal) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve19) => {
     let settled = false;
     let timer;
     let offAbort = () => {
@@ -5319,7 +5319,7 @@ async function awaitDelegateAttempt(director, subagentId, taskId, timeoutMs, abo
       offIter();
       offProgress();
       offAbort();
-      resolve17(value);
+      resolve19(value);
     };
     const arm = () => {
       if (timer) clearTimeout(timer);
@@ -5661,6 +5661,21 @@ var DirectorStateCheckpoint = class {
   resume(snapshot) {
     this.snapshot = snapshot;
   }
+  /**
+   * After resume, pin the live spawn ceiling from the current profile/flag
+   * while preserving `spawnCount` (cumulative used budget). Checkpoint
+   * metadata previously stored a historical `maxSpawns` that can diverge
+   * from the live runtime ceiling — operators need the live value to win.
+   */
+  applyLiveMaxSpawns(maxSpawns) {
+    if (this.snapshot.maxSpawns === maxSpawns) return;
+    this.snapshot = {
+      ...this.snapshot,
+      maxSpawns
+    };
+    this.bumpUpdatedAt();
+    this.schedule();
+  }
   current() {
     return this.snapshot;
   }
@@ -7173,10 +7188,10 @@ var DirectorTaskRegistry = class _DirectorTaskRegistry {
         pending: taskIds.filter((id) => !done.has(id))
       });
     }
-    return new Promise((resolve17) => {
+    return new Promise((resolve19) => {
       const entry = {
         ids: new Set(taskIds),
-        resolve: (result) => resolve17({
+        resolve: (result) => resolve19({
           completed: [result],
           pending: taskIds.filter((id) => id !== result.taskId)
         })
@@ -7184,7 +7199,7 @@ var DirectorTaskRegistry = class _DirectorTaskRegistry {
       if (opts?.timeoutMs !== void 0) {
         entry.timer = setTimeout(() => {
           this.anyWaiters.delete(entry);
-          resolve17({ completed: [], pending: [...taskIds], timedOut: true });
+          resolve19({ completed: [], pending: [...taskIds], timedOut: true });
         }, opts.timeoutMs);
       }
       this.anyWaiters.add(entry);
@@ -7302,11 +7317,11 @@ ${JSON.stringify(result.result, null, 2)}
         this.makeStoppedResult(taskId, "director", `Unknown task id "${taskId}" \u2014 never assigned`)
       );
     }
-    let resolve17;
+    let resolve19;
     const promise = new Promise((done) => {
-      resolve17 = done;
+      resolve19 = done;
     });
-    this.taskWaiters.set(taskId, { promise, resolve: resolve17 });
+    this.taskWaiters.set(taskId, { promise, resolve: resolve19 });
     return promise;
   }
   recordAssignment(task) {
@@ -11060,7 +11075,7 @@ async function spawn(host, config, priceLookup) {
     if (host.spawnDepth >= maxSpawnDepth) {
       throw new FleetSpawnBudgetError("max_spawn_depth", maxSpawnDepth, host.spawnDepth);
     }
-    if (host.spawnCount >= host.maxSpawns) {
+    if (host.spawnCount >= host.maxSpawns && !config.spawnBudgetExempt) {
       throw new FleetSpawnBudgetError("max_spawns", host.maxSpawns, host.spawnCount + 1);
     }
     if (host.maxFleetCostUsd < Number.POSITIVE_INFINITY) {
@@ -11111,7 +11126,9 @@ async function spawn(host, config, priceLookup) {
       ...Number.isFinite(budget?.remainingSpawns ?? host.maxSpawns - host.spawnCount) ? {
         remainingSpawns: Math.max(
           0,
-          (budget?.remainingSpawns ?? host.maxSpawns - host.spawnCount) - 1
+          // Exempt spawns don't consume leader budget, so the reported
+          // headroom is not decremented for them.
+          (budget?.remainingSpawns ?? host.maxSpawns - host.spawnCount) - (config.spawnBudgetExempt ? 0 : 1)
         )
       } : {},
       ...Number.isFinite(maxFleetTokens) ? { maxTokens: maxFleetTokens } : {},
@@ -11124,7 +11141,9 @@ async function spawn(host, config, priceLookup) {
   if (host.fleetManager) {
     host.fleetManager.recordSpawn(result.subagentId, config, priceLookup);
   } else {
-    host.spawnCount += 1;
+    if (!config.spawnBudgetExempt) {
+      host.spawnCount += 1;
+    }
     host.subagentMeta.set(result.subagentId, {
       provider: config.provider,
       model: config.model
@@ -11476,12 +11495,12 @@ async function executeSubagentWithTimeout({
           }
           return new Promise((resolveDecision) => {
             let settled = false;
-            const resolve17 = (d) => {
+            const resolve19 = (d) => {
               if (settled) return;
               settled = true;
               resolveDecision(d);
             };
-            const fallback = setTimeout(() => resolve17("stop"), DECISION_TIMEOUT_MS);
+            const fallback = setTimeout(() => resolve19("stop"), DECISION_TIMEOUT_MS);
             const sessionId = currentSessionId();
             budget._events?.emit("budget.threshold_reached", {
               ...sessionId ? { sessionId } : {},
@@ -11491,11 +11510,11 @@ async function executeSubagentWithTimeout({
               timeoutMs: DECISION_TIMEOUT_MS,
               extend: (extra) => {
                 clearTimeout(fallback);
-                queueMicrotask(() => resolve17({ extend: extra }));
+                queueMicrotask(() => resolve19({ extend: extra }));
               },
               deny: () => {
                 clearTimeout(fallback);
-                resolve17("stop");
+                resolve19("stop");
               }
             });
           });
@@ -11882,7 +11901,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       taskIds.map((id) => {
         const cached = this.completedResults.find((r) => r.taskId === id);
         if (cached) return cached;
-        return new Promise((resolve17, reject) => {
+        return new Promise((resolve19, reject) => {
           const timeout = setTimeout(() => {
             this.off("task.completed", handler);
             reject(new Error(`awaitTasks timed out waiting for task "${id}"`));
@@ -11891,7 +11910,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
             if (result.taskId === id) {
               clearTimeout(timeout);
               this.off("task.completed", handler);
-              resolve17(result);
+              resolve19(result);
             }
           };
           this.on("task.completed", handler);
@@ -11916,13 +11935,13 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       const done = new Set(completed.map((r) => r.taskId));
       return { completed, pending: taskIds.filter((id) => !done.has(id)) };
     }
-    return new Promise((resolve17) => {
+    return new Promise((resolve19) => {
       let timer;
       const handler = ({ result }) => {
         if (!ids.has(result.taskId)) return;
         if (timer) clearTimeout(timer);
         this.off("task.completed", handler);
-        resolve17({
+        resolve19({
           completed: [result],
           pending: taskIds.filter((id) => id !== result.taskId)
         });
@@ -11930,7 +11949,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       if (opts?.timeoutMs !== void 0) {
         timer = setTimeout(() => {
           this.off("task.completed", handler);
-          resolve17({ completed: [], pending: [...taskIds], timedOut: true });
+          resolve19({ completed: [], pending: [...taskIds], timedOut: true });
         }, opts.timeoutMs);
       }
       this.on("task.completed", handler);
@@ -12049,8 +12068,17 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
       durationMs: 0
     };
     this.completedResults.push(synthetic);
+    this.trimCompletedResults();
     this.emit("task.completed", { task, result: synthetic });
   }
+  trimCompletedResults() {
+    if (this.completedResults.length > _DefaultMultiAgentCoordinator.MAX_COMPLETED_RESULTS) {
+      this.completedResults.splice(
+        0,
+        this.completedResults.length - _DefaultMultiAgentCoordinator.MAX_COMPLETED_RESULTS
+      );
+    }
+  }
   async runDispatched(subagentId, task) {
     const subagent = this.subagents.get(subagentId);
     if (!subagent) return;
@@ -12184,12 +12212,7 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
   }
   recordCompletion(result) {
     this.completedResults.push(result);
-    if (this.completedResults.length > _DefaultMultiAgentCoordinator.MAX_COMPLETED_RESULTS) {
-      this.completedResults.splice(
-        0,
-        this.completedResults.length - _DefaultMultiAgentCoordinator.MAX_COMPLETED_RESULTS
-      );
-    }
+    this.trimCompletedResults();
     this.totalIterations += result.iterations;
     if (this.inFlight > 0) {
       this.inFlight--;
@@ -13607,10 +13630,10 @@ function validateAgainstSchema(value, schema) {
   return { ok: errors.length === 0, errors };
 }
 var MAX_SCHEMA_DEPTH = 64;
-function walk(value, schema, path40, errors, depth) {
+function walk(value, schema, path42, errors, depth) {
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path40 || "<root>",
+      path: path42 || "<root>",
       message: `schema nesting exceeds maximum depth (${MAX_SCHEMA_DEPTH})`
     });
     return;
@@ -13618,7 +13641,7 @@ function walk(value, schema, path40, errors, depth) {
   if (schema.enum !== void 0) {
     if (!enumIncludes(schema.enum, value)) {
       errors.push({
-        path: path40 || "<root>",
+        path: path42 || "<root>",
         message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
       });
       return;
@@ -13627,7 +13650,7 @@ function walk(value, schema, path40, errors, depth) {
   if (typeof schema.type === "string") {
     if (!checkType(value, schema.type)) {
       errors.push({
-        path: path40 || "<root>",
+        path: path42 || "<root>",
         message: `expected ${schema.type}, got ${describeType(value)} (${previewValue(value)})`
       });
       return;
@@ -13639,7 +13662,7 @@ function walk(value, schema, path40, errors, depth) {
       if (!(req in obj)) {
         const expected = schema.properties?.[req]?.type;
         errors.push({
-          path: joinPath(path40, req),
+          path: joinPath(path42, req),
           message: `required property missing${typeof expected === "string" ? ` (expected ${expected})` : ""}`
         });
       }
@@ -13647,14 +13670,14 @@ function walk(value, schema, path40, errors, depth) {
     if (schema.properties) {
       for (const [key, subSchema] of Object.entries(schema.properties)) {
         if (key in obj) {
-          walk(obj[key], subSchema, joinPath(path40, key), errors, depth + 1);
+          walk(obj[key], subSchema, joinPath(path42, key), errors, depth + 1);
         }
       }
     }
   }
   if (schema.type === "array" && Array.isArray(value) && schema.items) {
     for (let i = 0; i < value.length; i++) {
-      walk(value[i], schema.items, `${path40}[${i}]`, errors, depth + 1);
+      walk(value[i], schema.items, `${path42}[${i}]`, errors, depth + 1);
     }
   }
 }
@@ -13950,7 +13973,7 @@ function invalid(sessionId) {
 
 // src/utils/sleep.ts
 function sleep(ms) {
-  return new Promise((resolve17) => setTimeout(resolve17, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 
 // src/utils/slug.ts
@@ -16221,7 +16244,7 @@ var SessionCheckpointCas = class {
   }
 };
 function defaultRunGit(args, cwd) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve19) => {
     const stdoutChunks = [];
     const stderrChunks = [];
     let stdoutBytes = 0;
@@ -16264,8 +16287,8 @@ function defaultRunGit(args, cwd) {
       stdoutTruncated,
       stderrTruncated
     });
-    child.on("error", (err) => resolve17(result(1, err.message)));
-    child.on("close", (code) => resolve17(result(code ?? 1)));
+    child.on("error", (err) => resolve19(result(1, err.message)));
+    child.on("close", (code) => resolve19(result(code ?? 1)));
   });
 }
 
@@ -18905,6 +18928,7 @@ var Director = class _Director {
   }
   setCheckpointState(snapshot) {
     setCheckpointState(this.checkpointHost(), snapshot);
+    this.applyResumeBudget(snapshot);
   }
   async readSession(subagentId, tail) {
     return readDirectorSubagentSession({
@@ -18956,6 +18980,22 @@ var Director = class _Director {
   }
   resumeFromCheckpoint(snapshot) {
     resumeFromCheckpoint(this.checkpointHost(), snapshot);
+    this.applyResumeBudget(snapshot);
+  }
+  /**
+   * After re-attaching checkpoint metadata, pin the live maxSpawns ceiling
+   * (profile/flag/env wins over historical checkpoint metadata). The
+   * historical cumulative spawn counter is deliberately NOT restored — the
+   * lifetime budget is scoped to this director run, so a restarted session
+   * resumes with a fresh budget rather than a possibly-exhausted counter.
+   */
+  applyResumeBudget(snapshot) {
+    if (this.fleetManager) {
+      this.fleetManager.restoreFromCheckpoint(snapshot);
+    }
+    this.stateCheckpoint?.applyLiveMaxSpawns(
+      Number.isFinite(this.maxSpawns) ? this.maxSpawns : void 0
+    );
   }
 };
 
@@ -21623,12 +21663,12 @@ function verifyFiles(tokens, files) {
   const violations = [];
   let onPalette = 0;
   let offPalette = 0;
-  for (const { path: path40, text } of files) {
+  for (const { path: path42, text } of files) {
     const lines = text.split("\n");
     lines.forEach((lineText, i) => {
       const lineNo = i + 1;
       const flag = (snippet, reason, axis = "color") => {
-        violations.push({ file: path40, line: lineNo, snippet: snippet.slice(0, 80), reason, axis });
+        violations.push({ file: path42, line: lineNo, snippet: snippet.slice(0, 80), reason, axis });
       };
       for (const re of [HEX_RE, FUNC_COLOR_RE]) {
         re.lastIndex = 0;
@@ -22311,9 +22351,9 @@ function buildRecoveryStrategies(opts) {
         const delayMs = err.body?.retryAfterMs ?? 5e3;
         const delay = Math.min(6e4, Math.max(1e3, delayMs));
         if (ctx?.signal) {
-          await new Promise((resolve17) => {
+          await new Promise((resolve19) => {
             if (ctx.signal.aborted) {
-              resolve17();
+              resolve19();
               return;
             }
             let settled = false;
@@ -22324,7 +22364,7 @@ function buildRecoveryStrategies(opts) {
               settled = true;
               if (timer !== void 0) clearTimeout(timer);
               ctx.signal.removeEventListener("abort", onAbort);
-              resolve17();
+              resolve19();
             };
             timer = setTimeout(finish, delay);
             ctx.signal.addEventListener("abort", onAbort, { once: true });
@@ -24517,8 +24557,8 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
         });
         await Promise.race([
           drainPromise,
-          new Promise((resolve17) => {
-            drainTimer = setTimeout(resolve17, STREAM_DRAIN_TIMEOUT_MS);
+          new Promise((resolve19) => {
+            drainTimer = setTimeout(resolve19, STREAM_DRAIN_TIMEOUT_MS);
           })
         ]);
       } finally {
@@ -24869,7 +24909,7 @@ async function runProviderWithRetry(opts) {
         description,
         ...providerErrorBody ? { errorBody: providerErrorBody } : {}
       });
-      await new Promise((resolve17, reject) => {
+      await new Promise((resolve19, reject) => {
         let settled = false;
         const cleanup = () => {
           clearTimeout(t);
@@ -24885,7 +24925,7 @@ async function runProviderWithRetry(opts) {
           if (settled) return;
           settled = true;
           cleanup();
-          resolve17();
+          resolve19();
         }, delay);
         if (signal.aborted) {
           onAbort();
@@ -27147,18 +27187,18 @@ ${errorDetails}`,
         if (this.opts.confirmAwaiter) {
           const awaiter = this.opts.confirmAwaiter;
           const choice = await new Promise(
-            (resolve17, reject) => {
+            (resolve19, reject) => {
               const signal = ctx.signal;
-              const onAbort = () => resolve17("abort");
+              const onAbort = () => resolve19("abort");
               if (signal.aborted) {
-                resolve17("abort");
+                resolve19("abort");
                 return;
               }
               signal.addEventListener("abort", onAbort, { once: true });
               awaiter(tool, use.input, use.id, suggestedPattern).then(
                 (c) => {
                   signal.removeEventListener("abort", onAbort);
-                  resolve17(c);
+                  resolve19(c);
                 },
                 (e) => {
                   signal.removeEventListener("abort", onAbort);
@@ -27496,7 +27536,7 @@ ${post.additionalContext}`;
     toolPromise.catch(() => {
     });
     try {
-      output = await new Promise((resolve17, reject) => {
+      output = await new Promise((resolve19, reject) => {
         const onAbort = () => {
           setTimeout(() => reject(abortReasonToError(combined.reason)), 0);
         };
@@ -27504,7 +27544,7 @@ ${post.additionalContext}`;
         toolPromise.then(
           (v) => {
             combined.removeEventListener("abort", onAbort);
-            resolve17(v);
+            resolve19(v);
           },
           (e) => {
             combined.removeEventListener("abort", onAbort);
@@ -28452,7 +28492,7 @@ var DefaultModelsRegistry = class {
   async load(opts = {}) {
     if (this.payload && !opts.force) return this.payload;
     if (this.seed) {
-      this.payload = this.seed;
+      this.payload = this.withExtraOverlay(this.seed);
       this.fetchedAt = /* @__PURE__ */ new Date();
       return this.payload;
     }
@@ -29072,9 +29112,9 @@ var DefaultHealthRegistry = class {
   }
   async runOne(check) {
     let timer = null;
-    const timeout = new Promise((resolve17) => {
+    const timeout = new Promise((resolve19) => {
       timer = setTimeout(
-        () => resolve17({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
+        () => resolve19({ status: "unhealthy", detail: `timeout after ${this.timeoutMs}ms` }),
         this.timeoutMs
       );
     });
@@ -29272,7 +29312,7 @@ async function startMetricsServer(opts) {
   const tls = opts.tls;
   const useHttps = !!(tls?.cert && tls?.key);
   const host = opts.host ?? "127.0.0.1";
-  const path40 = opts.path ?? "/metrics";
+  const path42 = opts.path ?? "/metrics";
   const healthPath = opts.healthPath ?? "/healthz";
   const healthRegistry = opts.healthRegistry;
   const token = opts.token;
@@ -29295,7 +29335,7 @@ async function startMetricsServer(opts) {
       return;
     }
     const url = req.url.split("?")[0];
-    if (url === path40) {
+    if (url === path42) {
       let body;
       try {
         body = renderPrometheus(opts.sink.snapshot());
@@ -29341,14 +29381,14 @@ async function startMetricsServer(opts) {
     const { createServer } = await import("node:http");
     server = createServer(listener);
   }
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve19, reject) => {
     const onError = (err) => {
       server.off("listening", onListening);
       reject(err);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve17();
+      resolve19();
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -29359,9 +29399,9 @@ async function startMetricsServer(opts) {
   const protocol = useHttps ? "https" : "http";
   return {
     port: boundPort,
-    url: `${protocol}://${host}:${boundPort}${path40}`,
-    close: () => new Promise((resolve17, reject) => {
-      server.close((err) => err ? reject(err) : resolve17());
+    url: `${protocol}://${host}:${boundPort}${path42}`,
+    close: () => new Promise((resolve19, reject) => {
+      server.close((err) => err ? reject(err) : resolve19());
     })
   };
 }
@@ -29632,6 +29672,7 @@ function startOtlpTraceExporter(opts) {
 
 // src/security/permission-policy.ts
 import * as fs12 from "node:fs/promises";
+import * as path36 from "node:path";
 
 // src/security/permission-policy-schema.ts
 var TRUST_POLICY_LIMITS = Object.freeze({
@@ -29676,19 +29717,19 @@ var UNSAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set(["__proto__", "prototype", "
 function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function error(diagnostics, code, path40, message) {
-  diagnostics.push({ severity: "error", code, path: path40, message });
+function error(diagnostics, code, path42, message) {
+  diagnostics.push({ severity: "error", code, path: path42, message });
 }
-function validatePatterns(value, path40, diagnostics) {
+function validatePatterns(value, path42, diagnostics) {
   if (!Array.isArray(value)) {
-    error(diagnostics, "invalid_pattern_list", path40, "must be an array of strings");
+    error(diagnostics, "invalid_pattern_list", path42, "must be an array of strings");
     return void 0;
   }
   if (value.length > TRUST_POLICY_LIMITS.maxPatternsPerRule) {
     error(
       diagnostics,
       "too_many_patterns",
-      path40,
+      path42,
       `must contain at most ${TRUST_POLICY_LIMITS.maxPatternsPerRule} patterns`
     );
     return void 0;
@@ -29696,7 +29737,7 @@ function validatePatterns(value, path40, diagnostics) {
   const patterns = [];
   const seen = /* @__PURE__ */ new Set();
   for (const [index, pattern] of value.entries()) {
-    const itemPath = `${path40}[${index}]`;
+    const itemPath = `${path42}[${index}]`;
     if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > TRUST_POLICY_LIMITS.maxPatternChars) {
       error(
         diagnostics,
@@ -30111,6 +30152,8 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
 };
 
 // src/security/permission-helpers.ts
+import { realpathSync } from "node:fs";
+import * as path35 from "node:path";
 function matchesTrust(patterns, subject) {
   return patterns.includes(subject) || matchAny(patterns, subject);
 }
@@ -30181,9 +30224,51 @@ var SHELL_READ_VERBS = /* @__PURE__ */ new Set([
 function stripShellQuotes(value) {
   return value.replace(/^['"]|['"]$/g, "");
 }
+var AGENT_STATE_SENSITIVE_BASENAMES = /^(?:config\.json|config\.local\.json|trust\.json|auth\.json|\.key)$/i;
+function unescapeGlobSubject(value) {
+  return value.replace(/\\([*?[\]])/g, "$1");
+}
+function normalizeForCompare(value) {
+  const forward = unescapeGlobSubject(value).replace(/\\/g, "/").replace(/\/+$/, "");
+  return process.platform === "win32" ? forward.toLowerCase() : forward;
+}
+function realpathOfNearestExisting(p) {
+  let probe = p;
+  const tail = [];
+  for (; ; ) {
+    try {
+      return tail.length === 0 ? realpathSync(probe) : path35.join(realpathSync(probe), ...tail);
+    } catch {
+      const parent = path35.dirname(probe);
+      if (parent === probe) return p;
+      tail.unshift(path35.basename(probe));
+      probe = parent;
+    }
+  }
+}
+var agentStateRootRealCache = /* @__PURE__ */ new Map();
+function isInsideAgentStateRoot(absPath) {
+  const lexicalRoot = normalizeForCompare(path35.resolve(wstackGlobalRoot()));
+  if (!lexicalRoot) return false;
+  const target = normalizeForCompare(absPath);
+  if (target === lexicalRoot || target.startsWith(`${lexicalRoot}/`)) return true;
+  let realRoot = agentStateRootRealCache.get(lexicalRoot);
+  if (realRoot === void 0) {
+    realRoot = normalizeForCompare(realpathOfNearestExisting(path35.resolve(wstackGlobalRoot())));
+    agentStateRootRealCache.set(lexicalRoot, realRoot);
+  }
+  if (!realRoot || realRoot === lexicalRoot) return false;
+  const realTarget = normalizeForCompare(realpathOfNearestExisting(absPath));
+  return realTarget === realRoot || realTarget.startsWith(`${realRoot}/`);
+}
+function isProtectedAgentStatePath(absPath) {
+  if (!isInsideAgentStateRoot(absPath)) return false;
+  return AGENT_STATE_SENSITIVE_BASENAMES.test(path35.basename(normalizeForCompare(absPath)));
+}
 function pathLooksSensitive(rawPath) {
   const normalized = stripShellQuotes(rawPath).replace(/\\/g, "/");
-  return SENSITIVE_READ_PATHS.some((pattern) => pattern.test(normalized));
+  if (SENSITIVE_READ_PATHS.some((pattern) => pattern.test(normalized))) return true;
+  return isProtectedAgentStatePath(normalized);
 }
 function inputPathLooksSensitive(input) {
   if (!input || typeof input !== "object") return false;
@@ -30207,6 +30292,34 @@ function shellCommandReadsSensitivePath(command) {
 }
 
 // src/security/permission-policy.ts
+function fsWriteTargetPaths(input) {
+  const out = [];
+  if (!input || typeof input !== "object") return out;
+  const obj = input;
+  for (const key of [
+    "path",
+    "file_path",
+    "file",
+    "filePath",
+    "files",
+    "target",
+    "targetPath",
+    "out",
+    "directory",
+    "cwd",
+    "template"
+  ]) {
+    const value = obj[key];
+    if (typeof value === "string") {
+      if (value.length > 0) out.push(value);
+    } else if (Array.isArray(value)) {
+      for (const item of value) {
+        if (typeof item === "string" && item.length > 0) out.push(item);
+      }
+    }
+  }
+  return out;
+}
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -30292,6 +30405,30 @@ var DefaultPermissionPolicy = class {
   getYoloDestructive() {
     return this.yoloDestructive;
   }
+  /**
+   * True when this call is an FS_WRITE whose target lands inside WrongStack's
+   * own state root.
+   *
+   * FS_WRITE tools disagree on where the target path lives: write/edit use
+   * `path`, replace/format/git `files` (string OR array), patch `directory`,
+   * design `out`, scaffold writes under `cwd`/`template`. Checking only
+   * `path`/`file_path` let a state-root write merely switch tools, so every
+   * path-bearing key is inspected.
+   *
+   * Shared by the YOLO carve-out and the eval-cache guard so the two cannot
+   * drift: the carve-out scans all path keys while the cache key fingerprints
+   * only the subject key, so the cache must consult the same predicate or a
+   * secondary state-root key can be replayed a cached `auto`.
+   */
+  hasAgentStateWriteTarget(tool, input, ctx) {
+    if (!hasCapability(tool, ToolCapabilities.FS_WRITE)) return false;
+    for (const targetPath of fsWriteTargetPaths(input)) {
+      const base = ctx.workingDir ?? ctx.cwd;
+      const resolved = base ? path36.resolve(base, targetPath) : path36.resolve(targetPath);
+      if (isInsideAgentStateRoot(resolved)) return true;
+    }
+    return false;
+  }
   /**
    * True when YOLO is on but this specific call is a destructive shell command
    * the user has not opted to auto-approve. Shared by `evaluate()` and the
@@ -30299,6 +30436,7 @@ var DefaultPermissionPolicy = class {
    */
   yoloBlockedAsDestructive(tool, input, ctx) {
     if (!this.yolo || this.yoloDestructive) return false;
+    if (this.hasAgentStateWriteTarget(tool, input, ctx)) return true;
     const isShellSurface = tool.name === "bash" || tool.name === "exec" || (tool.capabilities ?? []).includes("shell.arbitrary");
     if (!isShellSurface) return false;
     const command = getInputString(input, "command") ?? shellCommandLineFromInput(input);
@@ -30405,7 +30543,7 @@ var DefaultPermissionPolicy = class {
     const subject = subjectForToolInput(tool.name, input, tool.subjectKey);
     const cacheKey = `${tool.name}::${subject ?? tool.name}`;
     const evalKey = `${cacheKey}::${permissionFingerprint(tool)}`;
-    if (tool.name !== "write") {
+    if (tool.name !== "write" && !this.hasAgentStateWriteTarget(tool, input, ctx)) {
       const cached = this._evalCache.get(evalKey);
       if (cached !== void 0) return cached;
     }
@@ -30513,7 +30651,7 @@ var DefaultPermissionPolicy = class {
       return decision;
     }
     if (tool.name === "write" && subject) {
-      if (ctx.hasRead(subject)) {
+      if (ctx.hasRead(subject) && !isInsideAgentStateRoot(subject)) {
         return {
           permission: "auto",
           source: "context",
@@ -30863,13 +31001,14 @@ var DefaultPermissionPolicy = class {
     }
     add("yolo", false, "auto", "yolo", "YOLO mode is not active");
     if (tool.name === "write" && subject) {
-      const hasRead = ctx.hasRead(subject);
+      const isAgentState = isInsideAgentStateRoot(subject);
+      const hasRead = ctx.hasRead(subject) && !isAgentState;
       add(
         "write smart bypass",
         hasRead,
         "auto",
         "context",
-        hasRead ? `file "${subject}" was already read in this session \u2014 auto-approving write` : `file "${subject}" was not read in this session \u2014 bypass does not apply`
+        isAgentState ? `file "${subject}" is WrongStack's own state \u2014 bypass never applies, write always confirms` : hasRead ? `file "${subject}" was already read in this session \u2014 auto-approving write` : `file "${subject}" was not read in this session \u2014 bypass does not apply`
       );
       if (hasRead) {
         winnerIndex = steps.length - 1;
@@ -30954,7 +31093,7 @@ var DefaultPermissionPolicy = class {
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes3, scryptSync } from "node:crypto";
 import * as fs13 from "node:fs";
 import * as fsp22 from "node:fs/promises";
-import * as path35 from "node:path";
+import * as path37 from "node:path";
 
 // src/types/secret-vault.ts
 var ENCRYPTED_PREFIX_PATTERN = /^enc:v(\d+):/;
@@ -31247,7 +31386,7 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes3(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs13.mkdirSync(path35.dirname(this.keyFile), { recursive: true });
+    fs13.mkdirSync(path37.dirname(this.keyFile), { recursive: true });
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
@@ -31334,7 +31473,7 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs13.mkdirSync(path35.dirname(this.keyFile), { recursive: true });
+    fs13.mkdirSync(path37.dirname(this.keyFile), { recursive: true });
     const key = randomBytes3(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
@@ -31394,7 +31533,7 @@ async function rewriteConfigEncrypted(configPath, vault, patch) {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fsp22.mkdir(path35.dirname(configPath), { recursive: true });
+  await fsp22.mkdir(path37.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions2(configPath);
   await vault.flushHardening?.();
@@ -31449,7 +31588,7 @@ function walkCount(node, vault, counter) {
 // src/storage/attachment-store.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 import * as fsp23 from "node:fs/promises";
-import * as path36 from "node:path";
+import * as path38 from "node:path";
 var DEFAULT_SPOOL_THRESHOLD = 256 * 1024;
 var PLACEHOLDER_RE = /\[(pasted|image|file) #(\d+)[^\]]*\]|\[file:([^\]]+)\]/g;
 var DefaultAttachmentStore = class {
@@ -31470,7 +31609,7 @@ var DefaultAttachmentStore = class {
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
       await fsp23.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path36.join(this.spoolDir, `${id}.bin`);
+      spooledPath = path38.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -32003,8 +32142,8 @@ var IN_PROJECT_DENIED_PATHS = [
     reason: "The other half of the filesystem confinement switch."
   }
 ];
-function deleteNestedPath(target, path40) {
-  const segments = path40.split(".");
+function deleteNestedPath(target, path42) {
+  const segments = path42.split(".");
   const last = segments[segments.length - 1];
   if (last === void 0) return false;
   let cursor = target;
@@ -32061,16 +32200,16 @@ function assertInProjectAllowListComplete() {
     );
   }
   const orphanedPaths = IN_PROJECT_DENIED_PATHS.filter(
-    ({ path: path40 }) => !IN_PROJECT_ALLOWED_KEYS.has(path40.split(".")[0] ?? "")
-  ).map(({ path: path40 }) => path40);
+    ({ path: path42 }) => !IN_PROJECT_ALLOWED_KEYS.has(path42.split(".")[0] ?? "")
+  ).map(({ path: path42 }) => path42);
   if (orphanedPaths.length > 0) {
     problems.push(
       `IN_PROJECT_DENIED_PATHS entr(ies) whose top-level parent is not allowed: ` + orphanedPaths.join(", ") + ". The parent is already stripped wholesale, so the nested denial is dead \u2014 remove it."
     );
   }
   const malformedPaths = IN_PROJECT_DENIED_PATHS.filter(
-    ({ path: path40 }) => path40.split(".").length < 2 || path40.split(".").some((s) => s.length === 0)
-  ).map(({ path: path40 }) => path40);
+    ({ path: path42 }) => path42.split(".").length < 2 || path42.split(".").some((s) => s.length === 0)
+  ).map(({ path: path42 }) => path42);
   if (malformedPaths.length > 0) {
     problems.push(
       `IN_PROJECT_DENIED_PATHS entr(ies) are not dotted nested paths: ` + malformedPaths.join(", ") + ". Top-level keys belong in KNOWN_DENIED_IN_PROJECT instead."
@@ -32098,8 +32237,8 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
     }
     stripped.push(k);
   }
-  for (const { path: path40 } of IN_PROJECT_DENIED_PATHS) {
-    if (deleteNestedPath(out, path40)) stripped.push(path40);
+  for (const { path: path42 } of IN_PROJECT_DENIED_PATHS) {
+    if (deleteNestedPath(out, path42)) stripped.push(path42);
   }
   if (stripped.length > 0) {
     warn(
@@ -32288,10 +32427,10 @@ function removeLegacySageEngine(config) {
 }
 
 // src/storage/config-loader/path-identity.ts
-import * as path37 from "node:path";
+import * as path39 from "node:path";
 function samePath(a, b) {
-  let ra = path37.resolve(a);
-  let rb = path37.resolve(b);
+  let ra = path39.resolve(a);
+  let rb = path39.resolve(b);
   if (process.platform === "win32" || process.platform === "darwin") {
     ra = ra.toLowerCase();
     rb = rb.toLowerCase();
@@ -33272,7 +33411,7 @@ ${cat}:`);
 
 // src/storage/queue-store.ts
 import * as fsp25 from "node:fs/promises";
-import * as path38 from "node:path";
+import * as path40 from "node:path";
 var QUEUE_MAX_ITEMS = 100;
 var QUEUE_MAX_BYTES = 16 * 1024 * 1024;
 var QUEUE_MAX_ITEM_BYTES = 8 * 1024 * 1024;
@@ -33305,7 +33444,7 @@ var QueueStore = class {
   traceId;
   logger;
   constructor(opts) {
-    this.file = path38.join(opts.dir, "queue.json");
+    this.file = path40.join(opts.dir, "queue.json");
     this.events = opts.events;
     this.traceId = opts.traceId;
     this.logger = opts.logger;
@@ -33521,7 +33660,7 @@ function isPersistedQueueItem(v) {
 // src/storage/recovery-lock.ts
 import * as fsp26 from "node:fs/promises";
 import * as os2 from "node:os";
-import * as path39 from "node:path";
+import * as path41 from "node:path";
 var LOCK_FILE = "active.json";
 var DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 var RecoveryLock = class {
@@ -33532,7 +33671,7 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path39.join(opts.dir, LOCK_FILE);
+    this.file = path41.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
     this.hostname = opts.hostname ?? os2.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
@@ -33606,7 +33745,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path39.dirname(this.file));
+    await ensureDir(path41.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,