@wrongstack/core 0.3.3 → 0.3.7

package/dist/index.js

@@ -806,7 +806,7 @@ function walk(node, vault, transform) {
   if (Array.isArray(node)) {
     return node.map((item) => walk(item, vault, transform));
   }
-  const out = {};
+  const out = /* @__PURE__ */ Object.create(null);
   for (const [k, v] of Object.entries(node)) {
     if (typeof v === "string" && isSecretField(k)) {
       out[k] = transform(v, k);
@@ -1770,6 +1770,7 @@ var FAMILY_BY_NPM = {
   "@ai-sdk/xai": "openai-compatible",
   "@ai-sdk/cerebras": "openai-compatible",
   "@ai-sdk/togetherai": "openai-compatible",
+  "@ai-sdk/mistral": "openai-compatible",
   "@ai-sdk/perplexity": "openai-compatible",
   "@ai-sdk/deepinfra": "openai-compatible",
   "@openrouter/ai-sdk-provider": "openai-compatible",
@@ -2241,6 +2242,13 @@ var InMemoryAgentBridge = class {
         this.pendingRequests.delete(correlationId);
         reject(new Error(`Request ${correlationId} timed out after ${timeout}ms`));
       }, timeout);
+      if (this.stopped) {
+        clearTimeout(timer);
+        this.inflightGuards.delete(correlationId);
+        this.pendingRequests.delete(correlationId);
+        reject(new Error("Bridge stopped"));
+        return;
+      }
       this.pendingRequests.set(correlationId, {
         resolve: resolve4,
         reject,
@@ -2444,6 +2452,15 @@ var ToolExecutor = class {
   opts;
   serializer;
   iterationTimeoutMs;
+  /**
+   * Clear the interactive confirm awaiter so the executor returns
+   * `ToolConfirmPendingResult` instead of blocking on stdin. Used by
+   * the CLI to switch from inline prompts (REPL) to event-driven
+   * confirmation (TUI) at runtime.
+   */
+  clearConfirmAwaiter() {
+    this.opts.confirmAwaiter = void 0;
+  }
   /**
    * Execute a batch of tool uses using the configured strategy.
    * Returns the execution results and the remaining output budget.
@@ -2692,6 +2709,42 @@ var ToolExecutor = class {
   }
 };
 
+// src/utils/regex-guard.ts
+var MAX_PATTERN_LEN = 512;
+var DANGEROUS_PATTERNS = [
+  /(\([^)]*[+*][^)]*\))[+*]/,
+  // (a+)+, (.*)+, etc
+  /(\(\?:[^)]*[+*][^)]*\))[+*]/
+  // same, with non-capturing group
+];
+function compileUserRegex(pattern, flags) {
+  if (typeof pattern !== "string") {
+    return { ok: false, reason: "pattern must be a string" };
+  }
+  if (pattern.length === 0) {
+    return { ok: false, reason: "pattern is empty" };
+  }
+  if (pattern.length > MAX_PATTERN_LEN) {
+    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
+  }
+  for (const rx of DANGEROUS_PATTERNS) {
+    if (rx.test(pattern)) {
+      return {
+        ok: false,
+        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
+      };
+    }
+  }
+  try {
+    return { ok: true, regex: new RegExp(pattern, flags) };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: err instanceof Error ? err.message : "invalid regex"
+    };
+  }
+}
+
 // src/storage/session-reader.ts
 var DefaultSessionReader = class {
   store;
@@ -2786,7 +2839,11 @@ function buildMatcher(q) {
   const ci = q.caseInsensitive ?? true;
   if (q.regex) {
     const flags = ci ? "i" : "";
-    const re = new RegExp(q.query, flags);
+    const compiled = compileUserRegex(q.query, flags);
+    if (!compiled.ok) {
+      throw new Error(`Invalid search regex "${q.query}": ${compiled.reason}`);
+    }
+    const re = compiled.regex;
     return (text) => {
       const m = re.exec(text);
       return m ? { start: m.index, end: m.index + m[0].length } : null;
@@ -3079,7 +3136,11 @@ function getCachedGlob(pattern) {
   COMPILED_GLOB_CACHE.set(pattern, re);
   return re;
 }
+var MAX_GLOB_PATTERN_LEN = 1024;
 function compileGlob(pattern) {
+  if (pattern.length > MAX_GLOB_PATTERN_LEN) {
+    throw new Error(`Glob pattern exceeds ${MAX_GLOB_PATTERN_LEN} characters`);
+  }
   let i = 0;
   let re = "^";
   while (i < pattern.length) {
@@ -3842,6 +3903,7 @@ var QueueStore = class {
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return [];
+      console.warn(`[QueueStore] failed to read queue file "${this.file}":`, err instanceof Error ? err.message : String(err));
       return [];
     }
     let parsed;
@@ -3941,6 +4003,13 @@ var DefaultAttachmentStore = class {
     return mergeAdjacentText(blocks);
   }
   async clear() {
+    if (this.spoolDir) {
+      const toDelete = [];
+      for (const att of this.items.values()) {
+        if (att.path) toDelete.push(att.path);
+      }
+      await Promise.all(toDelete.map((p) => fsp2.unlink(p).catch(() => void 0)));
+    }
     this.items.clear();
     this.refs.length = 0;
     this.nextSeq = { text: 0, image: 0, file: 0 };
@@ -4956,6 +5025,10 @@ var DirectorStateCheckpoint = class {
       this.timer = null;
     }
     await this.persist();
+    if (this.rewriteRequested) {
+      this.rewriteRequested = false;
+      await this.persist();
+    }
   }
   bumpUpdatedAt() {
     this.snapshot = { ...this.snapshot, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
@@ -4996,12 +5069,49 @@ var DefaultPermissionPolicy = class {
   loaded = false;
   trustFile;
   yolo;
+  /**
+   * Session-scoped "soft deny" map. When the user presses 'n' (block once),
+   * the tool+pattern is added here. If the LLM retries in the same session,
+   * we return deny directly without asking again.
+   *
+   * Cleared on reload() since reload = fresh trust file snapshot.
+   */
+  sessionDenied = /* @__PURE__ */ new Map();
+  /**
+   * Session-scoped "soft trust" map. When the user presses 'a' (allow once),
+   * the tool+pattern is added here. If the LLM retries in the same session,
+   * we return auto directly without asking again.
+   *
+   * Cleared on reload().
+   */
+  sessionAllowed = /* @__PURE__ */ new Map();
+  /**
+   * Interactive prompt delegate. When set, `evaluate()` calls it to get a
+   * user decision synchronously (CLI REPL path). When cleared (TUI / WebUI),
+   * `evaluate()` returns `confirm` so the caller can emit
+   * `tool.confirm_needed` for the UI layer to handle.
+   *
+   * Mutable so the host can switch from CLI-prompt to event-driven
+   * confirmation at runtime (e.g. when `--goal` forces TUI mode after
+   * the agent was already constructed).
+   */
   promptDelegate;
+  /** Pre-compiled wildcard patterns — rebuilt on reload for O(1) lookup. */
+  wildcardEntries = [];
   constructor(opts) {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
     this.promptDelegate = opts.promptDelegate;
   }
+  /**
+   * Replace (or clear) the interactive prompt delegate at runtime.
+   * Used by the CLI to switch from inline prompts (REPL) to event-driven
+   * confirmation (TUI) when the run mode is determined after the policy
+   * was constructed (e.g. `--goal` auto-flipping to TUI).
+   */
+  setPromptDelegate(delegate) {
+    this.promptDelegate = delegate;
+  }
   async reload() {
     try {
       const raw = await fsp2.readFile(this.trustFile, "utf8");
@@ -5010,13 +5120,26 @@ var DefaultPermissionPolicy = class {
     } catch {
       this.policy = {};
     }
+    this.wildcardEntries = [];
+    for (const [key, val] of Object.entries(this.policy)) {
+      if (key.includes("*")) this.wildcardEntries.push({ pattern: key, value: val });
+    }
+    this.sessionDenied.clear();
+    this.sessionAllowed.clear();
     this.loaded = true;
   }
-  async evaluate(tool, input, _ctx) {
+  async evaluate(tool, input, ctx) {
     if (!this.loaded) await this.reload();
     const namespaceEntry = this.findNamespaceEntry(tool.name);
     const entry = this.policy[tool.name] ?? namespaceEntry;
     const subject = this.subjectFor(tool.name, input, tool.subjectKey);
+    const subjectKey = `${tool.name}::${subject ?? tool.name}`;
+    if (this.sessionDenied.has(subjectKey)) {
+      return { permission: "deny", source: "deny", reason: "session soft deny (user pressed no)" };
+    }
+    if (this.sessionAllowed.has(subjectKey)) {
+      return { permission: "auto", source: "trust", reason: "session soft allow (user pressed yes)" };
+    }
     if (entry?.deny && subject && matchAny(entry.deny, subject)) {
       return { permission: "deny", source: "deny", reason: "matched deny pattern" };
     }
@@ -5032,6 +5155,11 @@ var DefaultPermissionPolicy = class {
     if (this.yolo) {
       return { permission: "auto", source: "yolo" };
     }
+    if (tool.name === "write" && subject) {
+      if (ctx.hasRead(subject)) {
+        return { permission: "auto", source: "context", reason: "file already read in this session" };
+      }
+    }
     if (tool.permission === "auto") {
       return { permission: "auto", source: "default" };
     }
@@ -5042,6 +5170,7 @@ var DefaultPermissionPolicy = class {
         return { permission: "auto", source: "user", reason: "user always-allowed" };
       }
       if (decision === "deny") {
+        await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
         return { permission: "deny", source: "user", reason: "user denied" };
       }
       return { permission: decision === "yes" ? "auto" : "deny", source: "user" };
@@ -5064,6 +5193,31 @@ var DefaultPermissionPolicy = class {
       throw err;
     }
   }
+  /** Persist a deny rule — this tool+pattern pair is permanently blocked. */
+  async deny(rule) {
+    if (!this.loaded) await this.reload();
+    const entry = this.policy[rule.tool] ?? {};
+    entry.deny = Array.from(/* @__PURE__ */ new Set([...entry.deny ?? [], rule.pattern]));
+    this.policy[rule.tool] = entry;
+    try {
+      await atomicWrite(this.trustFile, JSON.stringify(this.policy, null, 2));
+    } catch (err) {
+      const existing = this.policy[rule.tool];
+      if (existing?.deny) {
+        const idx = existing.deny.indexOf(rule.pattern);
+        if (idx !== -1) existing.deny.splice(idx, 1);
+      }
+      throw err;
+    }
+  }
+  /** Block this tool+pattern for the rest of this session (no trust file). */
+  denyOnce(rule) {
+    this.sessionDenied.set(`${rule.tool}::${rule.pattern}`, true);
+  }
+  /** Auto-approve this tool+pattern for the rest of this session (no trust file). */
+  allowOnce(rule) {
+    this.sessionAllowed.set(`${rule.tool}::${rule.pattern}`, true);
+  }
   subjectFor(toolName, input, subjectKey) {
     if (!input || typeof input !== "object") return void 0;
     const obj = input;
@@ -5091,10 +5245,8 @@ var DefaultPermissionPolicy = class {
     return void 0;
   }
   findNamespaceEntry(toolName) {
-    for (const key of Object.keys(this.policy)) {
-      if (key.includes("*") && matchGlob(key, toolName)) {
-        return this.policy[key];
-      }
+    for (const { pattern, value } of this.wildcardEntries) {
+      if (matchGlob(pattern, toolName)) return value;
     }
     return void 0;
   }
@@ -5108,6 +5260,12 @@ var AutoApprovePermissionPolicy = class {
   }
   async trust() {
   }
+  async deny() {
+  }
+  denyOnce() {
+  }
+  allowOnce() {
+  }
   async reload() {
   }
 };
@@ -6224,7 +6382,15 @@ var AutoCompactionMiddleware = class {
 var DoneConditionChecker = class {
   constructor(condition) {
     this.condition = condition;
-    this.compiledRegex = condition.type === "output_match" && condition.pattern ? new RegExp(condition.pattern) : null;
+    if (condition.type === "output_match" && condition.pattern) {
+      const result = compileUserRegex(condition.pattern, "");
+      this.compiledRegex = result.ok ? result.regex : null;
+      if (!result.ok) {
+        console.warn(`[DoneConditionChecker] Invalid regex pattern "${condition.pattern}": ${result.reason}`);
+      }
+    } else {
+      this.compiledRegex = null;
+    }
   }
   condition;
   compiledRegex;
@@ -6842,8 +7008,8 @@ var DefaultMultiAgentCoordinator = class extends EventEmitter {
   // --- internal dispatching ---------------------------------------------
   tryDispatchNext() {
     while (this.canDispatch()) {
-      const subagentId = this.findIdleSubagent();
-      if (!subagentId) {
+      const dispatchable = this.takeNextDispatchableTask();
+      if (!dispatchable) {
         if (this.pendingTasks.length > 0 && !this.hasLiveSubagent()) {
           this.drainPendingAsAborted(
             "No live subagent available \u2014 all stopped or mid-termination"
@@ -6851,8 +7017,7 @@ var DefaultMultiAgentCoordinator = class extends EventEmitter {
         }
         return;
       }
-      const task = this.pendingTasks.shift();
-      if (!task) return;
+      const { subagentId, task } = dispatchable;
       this.runDispatched(subagentId, task).catch((err) => {
         this.recordCompletion({
           subagentId,
@@ -6870,12 +7035,26 @@ var DefaultMultiAgentCoordinator = class extends EventEmitter {
     const max = this.config.maxConcurrent ?? 4;
     return this.inFlight < max && this.pendingTasks.length > 0;
   }
+  takeNextDispatchableTask() {
+    for (let i = 0; i < this.pendingTasks.length; i++) {
+      const task = this.pendingTasks[i];
+      const subagentId = task.subagentId ? this.isIdleSubagent(task.subagentId) ? task.subagentId : null : this.findIdleSubagent();
+      if (!subagentId) continue;
+      this.pendingTasks.splice(i, 1);
+      return { subagentId, task };
+    }
+    return null;
+  }
   findIdleSubagent() {
     for (const [id, s] of this.subagents) {
       if (s.status === "idle" && !this.terminating.has(id)) return id;
     }
     return null;
   }
+  isIdleSubagent(id) {
+    const subagent = this.subagents.get(id);
+    return !!subagent && subagent.status === "idle" && !this.terminating.has(id);
+  }
   /**
    * Returns true iff at least one spawned subagent could still
    * process a task. A "live" subagent is one that is not stopped
@@ -7060,10 +7239,11 @@ var DefaultMultiAgentCoordinator = class extends EventEmitter {
 };
 function classifySubagentError(err, hints = {}) {
   const cause = err instanceof Error ? { name: err.name, message: err.message, stack: err.stack } : void 0;
-  const baseMessage = err instanceof Error ? err.message : String(err);
   if (err instanceof ProviderError) {
-    return providerErrorToSubagentError(err, baseMessage, cause);
+    const baseMessage2 = err.describe();
+    return providerErrorToSubagentError(err, baseMessage2, cause);
   }
+  const baseMessage = err instanceof Error ? err.message : String(err);
   if (err instanceof BudgetExceededError) {
     const map = {
       iterations: "budget_iterations",
@@ -7180,7 +7360,7 @@ function makeSpawnTool(director, roster) {
       if (role && !base) {
         return { error: `unknown role "${role}". roster has: ${roster ? Object.keys(roster).join(", ") : "(empty)"}` };
       }
-      const cfg = { ...base ?? { name: i.name ?? "subagent" } };
+      const cfg = base ? instantiateRosterConfig(role, base) : { name: i.name ?? "subagent" };
       if (typeof i.name === "string") cfg.name = i.name;
       if (typeof i.provider === "string") cfg.provider = i.provider;
       if (typeof i.model === "string") cfg.model = i.model;
@@ -7200,6 +7380,14 @@ function makeSpawnTool(director, roster) {
     }
   };
 }
+function instantiateRosterConfig(role, base) {
+  return {
+    ...base,
+    // Roster entries are templates. A director may spawn several
+    // workers with the same role, so never reuse the template id.
+    id: `${role}-${randomUUID().slice(0, 8)}`
+  };
+}
 function makeAssignTool(director) {
   const inputSchema = {
     type: "object",
@@ -7517,8 +7705,8 @@ var Director = class {
     if (this.spawnCount >= this.maxSpawns) {
       throw new DirectorBudgetError("max_spawns", this.maxSpawns, this.spawnCount + 1);
     }
-    this.spawnCount += 1;
     const result = await this.coordinator.spawn(config);
+    this.spawnCount += 1;
     this.subagentMeta.set(result.subagentId, {
       provider: config.provider,
       model: config.model
@@ -7961,7 +8149,7 @@ function createDelegateTool(opts) {
             error: `Unknown role "${i.role}". Available: ${rosterIds.join(", ") || "(no roster configured)"}.`
           };
         }
-        cfg = { ...base };
+        cfg = instantiateRosterConfig2(i.role, base);
         if (i.systemPromptOverride) cfg.systemPromptOverride = i.systemPromptOverride;
         if (i.provider) cfg.provider = i.provider;
         if (i.model) cfg.model = i.model;
@@ -8047,6 +8235,14 @@ function createDelegateTool(opts) {
     }
   };
 }
+function instantiateRosterConfig2(role, base) {
+  return {
+    ...base,
+    // Roster entries are templates. Give each spawn a fresh id so
+    // parallel or repeated delegates can use the same role safely.
+    id: `${role}-${randomUUID().slice(0, 8)}`
+  };
+}
 function hintForKind(kind, retryable, backoffMs) {
   if (!kind) return void 0;
   switch (kind) {
@@ -10616,12 +10812,14 @@ function requestLimitExtension(opts) {
   const { events, currentIterations, currentLimit, autoExtend, timeoutMs = 3e4 } = opts;
   return new Promise((resolve4) => {
     let resolved = false;
-    const timer = setTimeout(() => {
+    const timerFired = () => {
       if (!resolved) {
         resolved = true;
         resolve4(0);
       }
-    }, timeoutMs);
+    };
+    const timer = setTimeout(timerFired, timeoutMs);
+    timer.unref();
     const deny = () => {
       if (!resolved) {
         resolved = true;
@@ -10733,6 +10931,25 @@ var Agent = class {
   get renderer() {
     return this.container.has(TOKENS.Renderer) ? this.container.resolve(TOKENS.Renderer) : void 0;
   }
+  /**
+   * Switch from inline CLI prompts to event-driven confirmation.
+   * Clears both the ToolExecutor's confirmAwaiter (so it returns
+   * `ToolConfirmPendingResult`) and the permission policy's
+   * promptDelegate (so `evaluate()` returns `confirm`).
+   *
+   * Call this before entering TUI or any mode where stdin is owned
+   * by a UI framework (Ink, WebUI WS bridge). Without this, the
+   * inline prompt writes to stdout and blocks on stdin — both of
+   * which are owned by the framework — making the prompt invisible
+   * and the input deadlocked.
+   */
+  disableInteractiveConfirmation() {
+    this.toolExecutor.clearConfirmAwaiter();
+    const policy = this.permission;
+    if (typeof policy.setPromptDelegate === "function") {
+      policy.setPromptDelegate(void 0);
+    }
+  }
   register(tool) {
     this.tools.register(tool);
   }
@@ -10740,6 +10957,22 @@ var Agent = class {
     await plugin.setup(api);
     this.plugins.push({ plugin, api });
   }
+  /** Tear down all plugins in reverse order, calling their teardown hooks. */
+  async teardown() {
+    const errors = [];
+    for (const { plugin, api } of this.plugins.toReversed()) {
+      if (typeof plugin.teardown !== "function") continue;
+      try {
+        await plugin.teardown(api);
+      } catch (err) {
+        errors.push(err);
+      }
+    }
+    this.plugins.length = 0;
+    if (errors.length > 0) {
+      throw new Error(`Agent teardown failed: ${errors.map(String).join("; ")}`);
+    }
+  }
   async run(userInput, opts = {}) {
     const controller = new RunController({ parentSignal: opts.signal });
     const signal = controller.signal;
@@ -11007,11 +11240,52 @@ var Agent = class {
           toolUseId: result.toolUseId,
           suggestedPattern: result.suggestedPattern
         });
-        const reRunResult = await this.executeSingleWithDecision(
+        if (decision === "always") {
+          try {
+            await this.permission.trust({
+              tool: tool.name,
+              pattern: result.suggestedPattern
+            });
+            this.events.emit("trust.persisted", {
+              tool: tool.name,
+              pattern: result.suggestedPattern,
+              decision
+            });
+          } catch {
+          }
+        } else if (decision === "deny") {
+          try {
+            await this.permission.deny({
+              tool: tool.name,
+              pattern: result.suggestedPattern
+            });
+            this.events.emit("trust.persisted", {
+              tool: tool.name,
+              pattern: result.suggestedPattern,
+              decision
+            });
+          } catch {
+          }
+        }
+        if (decision === "yes") {
+          const p = this.permission;
+          p.allowOnce?.({ tool: tool.name, pattern: result.suggestedPattern });
+        } else if (decision === "no") {
+          const p = this.permission;
+          p.denyOnce?.({ tool: tool.name, pattern: result.suggestedPattern });
+        }
+        const reRunResult = decision === "yes" || decision === "always" ? await this.executeSingleWithDecision(
           tool,
-          { id: result.toolUseId, name: tool.name, input: result.input },
-          decision
-        );
+          { id: result.toolUseId, name: tool.name, input: result.input }
+        ) : {
+          result: {
+            type: "tool_result",
+            tool_use_id: result.toolUseId,
+            content: decision === "deny" ? `Tool "${tool.name}" denied and blocked for this pattern.` : `Tool "${tool.name}" denied by user.`,
+            is_error: true
+          },
+          durationMs: 0
+        };
         const use2 = useById.get(reRunResult.result.tool_use_id);
         if (use2) {
           await this.pipelines.toolCall.run({
@@ -11091,19 +11365,8 @@ var Agent = class {
       });
     });
   }
-  async executeSingleWithDecision(tool, use, decision) {
+  async executeSingleWithDecision(tool, use) {
     const start = Date.now();
-    if (decision === "no" || decision === "deny") {
-      return {
-        result: {
-          type: "tool_result",
-          tool_use_id: use.id,
-          content: `Tool "${tool.name}" denied by user.`,
-          is_error: true
-        },
-        durationMs: Date.now() - start
-      };
-    }
     try {
       const result = await this.toolExecutor.executeTool(
         tool,
@@ -11291,9 +11554,10 @@ var Context = class {
   }
   /**
    * Register a teardown hook tied to the current run's abort signal. The
-   * hook fires when the run aborts OR ends normally — Agent.run wires
-   * this through a RunController. When no run is active the hook fires
-   * immediately so callers don't leak resources.
+   * hook fires when the run aborts or ends normally — Agent.run wires this
+   * through a RunController. Hooks registered before a run starts are stored
+   * and fired when the next run ends; there is no "immediate fire" when no
+   * run is active.
    *
    * **Scope:** these hooks fire on the **whole agent run's** abort, not on
    * an individual tool call. For per-tool teardown of resources owned by
@@ -11463,6 +11727,7 @@ You operate inside the user's terminal with direct read and write access to thei
 - **Task is clear, approach is unknown** \u2192 try one approach, report what happened
 - **Tool fails** \u2192 retry once with adjusted params, then report failure
 - **Permission prompt shown** \u2192 wait for user, do not act unilaterally
+- **Tool denied by user** \u2192 do NOT retry the same tool in the next iteration. If the user denies a write, bash, or any tool, respect that decision. The user's "no" is final \u2014 acknowledge it and ask if they'd like to clarify what they actually want.
 - **Context window filling up** \u2192 use context_manager proactively; don't wait to be told
 
 ## How you work
@@ -11471,6 +11736,8 @@ You operate inside the user's terminal with direct read and write access to thei
 - **Comment with purpose.** Add comments only when they explain why, not what. The code already says what.
 - **Own your output.** Never call work "production-ready" or "fully tested" \u2014 the user makes that call.
 - **Move on from mistakes.** When something fails, report what happened and what you'll do next. No apologies, no hand-wringing.
+- **Respect denied tools.** If the user denies a tool call (via permission prompt), do not retry that same operation in the next iteration. The user's "no" means "find another way or ask". Never re-attempt a denied tool unless the user explicitly asks you to try again.
+- **When denied, ask.** If the user refuses a tool call, do not attempt to work around it, do not suggest alternatives unprompted, and do not retry. Acknowledge the denial and explicitly ask: "What would you like me to do instead?"
 - **Stay in your lane.** Don't lecture about software engineering principles unless explicitly asked \u2014 the user is the expert on their codebase.`;
 var DefaultSystemPromptBuilder = class {
   constructor(opts = {}) {
@@ -12535,6 +12802,6 @@ function wrapApiForCapabilityCheck(plugin, api, log, enforce = false) {
   });
 }
 
-export { ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, Agent, AgentError, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, CONTEXT_WINDOW_MODES, ConfigError, ConfigMigrationError, Container, Context, ConversationState, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_WINDOW_MODE_ID, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_MAX_ITERATIONS, DEFAULT_MODES, DEFAULT_RECOVERY_STRATEGIES, DEFAULT_SPEC_TEMPLATE, DEFAULT_SUBAGENT_BASELINE, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultPluginAPI, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultTaskStore, DefaultTokenCounter, Director, DirectorBudgetError, DirectorStateCheckpoint, DoneConditionChecker, EventBus, ExtensionRegistry, FLEET_ROSTER, FleetBus, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, InputBuilder, IntelligentCompactor, KERNEL_API_VERSION, LAYER_1_IDENTITY, LLMSelector, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, Pipeline, PluginError, ProviderError, ProviderRegistry, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, RunController, SECURITY_SCANNER_AGENT, SelectiveCompactor, SessionAnalyzer, SessionError, SlashCommandRegistry, SpecDrivenDev, SpecParser, SubagentBudget, TOKENS, TaskFlow, TaskGenerator, TaskTracker, ToolError, ToolExecutor, ToolRegistry, WrongStackError, addPlanItem, allServers, asBlocks, asText, atomicWrite, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildChildEnv, buildOtlpMetricsRequest, buildOtlpTracesRequest, buildRecoveryStrategies, classifyFamily, clearPlan, color, compileGlob, composeDirectorPrompt, composeSubagentPrompt, computeTaskProgress, context7Server, contextManagerTool, createContextManagerTool, createDefaultPipelines, createDelegateTool, createMessage, createToolOutputSerializer, decryptConfigSecrets, detectNewlineStyle, emptyPlan, encryptConfigSecrets, ensureDir, estimateTextTokens, estimateToolInputTokens, estimateToolResultTokens, everArtServer, extractRunEnv, filesystemServer, findCriticalPath, formatContextWindowModeList, formatPlan, formatTodosList, getContextWindowMode, githubServer, googleMapsServer, isAgentError, isConfigError, isContextWindowModeId, isImageBlock, isPluginError, isSessionError, isTextBlock, isThinkingBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, listContextWindowModes, loadDirectorState, loadPlan, loadPlugins, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeDirectorSessionFactory, matchAny, matchGlob, migratePlaintextSecrets, miniMaxVisionServer, normalizeToLf, projectHash, removePlanItem, renderPrometheus, repairToolUseAdjacency, resolveContextWindowPolicy, resolveWstackPaths, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, safeParse, safeStringify, sanitizeJsonString, savePlan, saveTodosCheckpoint, sentinelServer, setPlanItemStatus, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, stripAnsi, toStyle, toWrongStackError, topologicalSort, unifiedDiff, unloadPlugins, validateAgainstSchema, wireMetricsToEvents, wrapAsState, zaiVisionServer };
+export { ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, Agent, AgentError, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, CONTEXT_WINDOW_MODES, ConfigError, ConfigMigrationError, Container, Context, ConversationState, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_WINDOW_MODE_ID, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_MAX_ITERATIONS, DEFAULT_MODES, DEFAULT_RECOVERY_STRATEGIES, DEFAULT_SPEC_TEMPLATE, DEFAULT_SUBAGENT_BASELINE, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultPluginAPI, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultTaskStore, DefaultTokenCounter, Director, DirectorBudgetError, DirectorStateCheckpoint, DoneConditionChecker, EventBus, ExtensionRegistry, FLEET_ROSTER, FleetBus, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, InputBuilder, IntelligentCompactor, KERNEL_API_VERSION, LAYER_1_IDENTITY, LLMSelector, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, Pipeline, PluginError, ProviderError, ProviderRegistry, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, RunController, SECURITY_SCANNER_AGENT, SelectiveCompactor, SessionAnalyzer, SessionError, SlashCommandRegistry, SpecDrivenDev, SpecParser, SubagentBudget, TOKENS, TaskFlow, TaskGenerator, TaskTracker, ToolError, ToolExecutor, ToolRegistry, WrongStackError, addPlanItem, allServers, asBlocks, asText, atomicWrite, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildChildEnv, buildOtlpMetricsRequest, buildOtlpTracesRequest, buildRecoveryStrategies, classifyFamily, clearPlan, color, compileGlob, compileUserRegex, composeDirectorPrompt, composeSubagentPrompt, computeTaskProgress, context7Server, contextManagerTool, createContextManagerTool, createDefaultPipelines, createDelegateTool, createMessage, createToolOutputSerializer, decryptConfigSecrets, detectNewlineStyle, emptyPlan, encryptConfigSecrets, ensureDir, estimateTextTokens, estimateToolInputTokens, estimateToolResultTokens, everArtServer, extractRunEnv, filesystemServer, findCriticalPath, formatContextWindowModeList, formatPlan, formatTodosList, getContextWindowMode, githubServer, googleMapsServer, isAgentError, isConfigError, isContextWindowModeId, isImageBlock, isPluginError, isSessionError, isTextBlock, isThinkingBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, listContextWindowModes, loadDirectorState, loadPlan, loadPlugins, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeDirectorSessionFactory, matchAny, matchGlob, migratePlaintextSecrets, miniMaxVisionServer, normalizeToLf, projectHash, removePlanItem, renderPrometheus, repairToolUseAdjacency, resolveContextWindowPolicy, resolveWstackPaths, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, safeParse, safeStringify, sanitizeJsonString, savePlan, saveTodosCheckpoint, sentinelServer, setPlanItemStatus, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, stripAnsi, toStyle, toWrongStackError, topologicalSort, unifiedDiff, unloadPlugins, validateAgainstSchema, wireMetricsToEvents, wrapAsState, zaiVisionServer };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map