@wrongstack/core 0.300.0 → 0.302.0

package/dist/plugins/auto-review-plugin.d.ts

@@ -15,6 +15,8 @@ export interface AutoReviewConfig {
      * omitted), and the remaining entries form the fallback chain.
      */
     fallbackProfile?: string | undefined;
+    /** How each review chooses its starting model from the resolved profile pool. */
+    modelSelection?: 'round-robin' | 'random' | undefined;
     /** Debounce window in ms — wait for quiet before firing review (default 15000). */
     debounceMs?: number | undefined;
     /** Max files per review batch (default 15). */
@@ -40,6 +42,7 @@ export interface ResolvedAutoReviewConfig {
     provider: string;
     model: string;
     fallbackModels: string[];
+    modelSelection: 'round-robin' | 'random';
     debounceMs: number;
     maxFilesPerBatch: number;
     maxConcurrentReviews: number;

package/dist/plugins/cloud-config-sync-plugin.d.ts

@@ -0,0 +1,22 @@
+import type { ConfigStore } from '../types/config.js';
+import type { Plugin } from '../types/plugin.js';
+import type { SecretVault } from '../types/secret-vault.js';
+import type { WstackPaths } from '../utils/wstack-paths.js';
+interface CloudConfigSyncPluginOptions {
+    paths?: WstackPaths | undefined;
+    configStore?: ConfigStore | undefined;
+    vault?: SecretVault | undefined;
+    appVersion?: string | undefined;
+}
+/**
+ * CloudConfigSyncPlugin — background config synchronization with my.wrongstack.com.
+ *
+ * Registers `/cloudsync` and, while enabled, runs a pull-then-push pass every
+ * `cloudSync.intervalSeconds` (default 300). Distinct from `wstack-sync` (the legacy
+ * GitHub category sync): this speaks the portal's namespaced, schema-validated,
+ * secret-free sync API v1 and never uploads credential material — the sanitizer in
+ * `storage/cloud-config-sync/sanitize.ts` is the client half of the server's contract.
+ */
+export declare function createCloudConfigSyncPlugin(opts?: CloudConfigSyncPluginOptions): Plugin;
+export {};
+//# sourceMappingURL=cloud-config-sync-plugin.d.ts.map

package/dist/plugins/review-claim-registry.d.ts

@@ -1,24 +1,39 @@
 import type { EventBus } from '../kernel/events.js';
 import type { PluginAPI } from '../types/plugin.js';
 import type { ReviewContextBundle } from './review-types.js';
+export interface ClaimStoreOptions {
+    /**
+     * Override the shared claim-ledger directory. Defaults to `<cwd>/.wrongstack`
+     * (git-ignored, shared by every session on the same working tree). Tests
+     * inject a temp dir; two EventBuses sharing one dir dedupe like two hosts.
+     */
+    storeDir?: string | undefined;
+    /** Claim lifetime in ms before it is treated as stale (default 30 min). */
+    ttlMs?: number | undefined;
+    /** Ledger compaction threshold in lines (default 10,000). Test override. */
+    maxLedgerLines?: number | undefined;
+}
+export declare function breakStaleLock(lockPath: string): Promise<boolean>;
 /**
  * Record review events emitted outside the automatic plugin paths, such as
  * `/review`, so the post-session pass also avoids repeating those files.
  */
-export declare function recordStartedReview(events: EventBus, payload: unknown): void;
+export declare function recordStartedReview(events: EventBus, payload: unknown, opts?: ClaimStoreOptions | undefined): Promise<void>;
 /**
  * Release the exact claims associated with a completed review bundle. Bundle
  * identity prevents an older completion from removing newer in-flight claims.
  */
-export declare function recordCompletedReview(events: EventBus, payload: unknown): void;
+export declare function recordCompletedReview(events: EventBus, payload: unknown): Promise<void>;
 /**
  * Atomically claim review inputs and emit only files whose exact content does
- * not already have a review in progress. The returned bundle contains only
- * claimed files and may be a strict subset of the input.
+ * not already have a review in progress — across every session sharing the
+ * working tree. The returned bundle contains only claimed files and may be a
+ * strict subset of the input.
  *
- * Claims are installed immediately before the synchronous event emission, so
- * concurrent mid/post-session handlers cannot enqueue the same content twice.
- * A synchronous emit failure rolls the claims back.
+ * Claims are installed in the shared ledger (under its exclusive lock) before
+ * the event emission, so concurrent mid/post-session handlers — in this
+ * process or another — cannot enqueue the same content twice. A synchronous
+ * emit failure rolls the claims back.
  */
-export declare function emitReviewIfChanged(api: Pick<PluginAPI, 'events' | 'emitCustom'>, bundle: ReviewContextBundle): ReviewContextBundle | null;
+export declare function emitReviewIfChanged(api: Pick<PluginAPI, 'events' | 'emitCustom'>, bundle: ReviewContextBundle, opts?: ClaimStoreOptions | undefined): Promise<ReviewContextBundle | null>;
 //# sourceMappingURL=review-claim-registry.d.ts.map

package/dist/plugins/review-types.d.ts

@@ -45,6 +45,8 @@ export interface ReviewContextBundle {
      * Absent for ordinary Chimera and manual review triggers.
      */
     reviewFallbackModels?: string[] | undefined;
+    /** Selection policy for the resolved auto-review profile pool. */
+    reviewModelSelection?: 'round-robin' | 'random' | undefined;
     /**
      * Cascade severity threshold from the auto-review plugin config.
      * When the review subagent finds findings at or above this level, a

package/dist/registry/index.js

@@ -269,80 +269,6 @@ function formatContext(ctx) {
   return parts.length > 0 ? `[${parts.join(" ")}]` : "";
 }
 
-// src/utils/tool-description-mode.ts
-var ORIGINAL_TOOL_DESCRIPTION = /* @__PURE__ */ Symbol.for("wrongstack.tool.originalDescription");
-function normalizeToolDescriptionMode(value) {
-  if (typeof value !== "string") return void 0;
-  const raw = value.trim().toLowerCase();
-  if (raw === "extend" || raw === "extended" || raw === "full") return "extend";
-  if (raw === "simple" || raw === "short" || raw === "brief") return "simple";
-  return void 0;
-}
-function simplifyToolDescription(text, opts = {}) {
-  const maxSentences = Math.max(1, opts.maxSentences ?? 2);
-  const maxChars = Math.max(40, opts.maxChars ?? 180);
-  const normalized = text.replace(/\r\n?/g, "\n").split("\n").map((line) => line.trim()).filter(Boolean).join(" ").replace(/\s+/g, " ").trim();
-  if (normalized.length <= maxChars) return normalized;
-  const sentences = normalized.match(/[^.!?]+[.!?]+(?=\s|$)|[^.!?]+$/g) ?? [normalized];
-  const selected = [];
-  for (const sentence of sentences) {
-    selected.push(sentence.trim());
-    const candidate = selected.join(" ");
-    if (selected.length >= maxSentences || candidate.length >= maxChars) break;
-  }
-  const summary = selected.join(" ").trim() || normalized;
-  if (summary.length <= maxChars) return summary;
-  const hardLimit = maxChars - 4;
-  const boundary = findWordBoundary(summary, hardLimit);
-  return `${summary.slice(0, boundary > 0 ? boundary : hardLimit).trimEnd()} ...`;
-}
-function applyToolDescriptionModeToTool(tool, mode) {
-  const existingOriginal = getOriginalDescription(tool);
-  if (mode === "extend" && !existingOriginal) return tool;
-  const original = existingOriginal ?? {
-    description: tool.description,
-    usageHint: tool.usageHint
-  };
-  const next = mode === "simple" ? withDescription(tool, {
-    description: simplifyToolDescription(original.description),
-    usageHint: original.usageHint === void 0 ? void 0 : simplifyToolDescription(original.usageHint)
-  }) : withDescription(tool, original);
-  return attachOriginalDescription(next, original);
-}
-function getOriginalDescription(tool) {
-  return tool[ORIGINAL_TOOL_DESCRIPTION];
-}
-function attachOriginalDescription(tool, original) {
-  Object.defineProperty(tool, ORIGINAL_TOOL_DESCRIPTION, {
-    configurable: true,
-    enumerable: false,
-    value: original,
-    writable: true
-  });
-  return tool;
-}
-function withDescription(tool, next) {
-  const copy = {
-    ...tool,
-    description: next.description,
-    usageHint: next.usageHint
-  };
-  if (next.usageHint === void 0) {
-    delete copy.usageHint;
-  }
-  return copy;
-}
-function findWordBoundary(text, limit) {
-  const semantic = Math.max(
-    text.lastIndexOf(". ", limit),
-    text.lastIndexOf("; ", limit),
-    text.lastIndexOf(", ", limit)
-  );
-  if (semantic > 40) return semantic + 1;
-  const space = text.lastIndexOf(" ", limit);
-  return space > 40 ? space : limit;
-}
-
 // src/utils/tool-wire-compact.ts
 var TOOL_DESCRIPTION_MAX_CHARS = 400;
 var SCHEMA_DESCRIPTION_MAX_CHARS = 120;
@@ -462,6 +388,80 @@ function estimateToolDefTokens(tool) {
   return RoughTokenEstimate(tool.name) + RoughTokenEstimate(compact.description) + RoughTokenEstimate(JSON.stringify(compact.inputSchema));
 }
 
+// src/utils/tool-description-mode.ts
+var ORIGINAL_TOOL_DESCRIPTION = /* @__PURE__ */ Symbol.for("wrongstack.tool.originalDescription");
+function normalizeToolDescriptionMode(value) {
+  if (typeof value !== "string") return void 0;
+  const raw = value.trim().toLowerCase();
+  if (raw === "extend" || raw === "extended" || raw === "full") return "extend";
+  if (raw === "simple" || raw === "short" || raw === "brief") return "simple";
+  return void 0;
+}
+function simplifyToolDescription(text, opts = {}) {
+  const maxSentences = Math.max(1, opts.maxSentences ?? 2);
+  const maxChars = Math.max(40, opts.maxChars ?? 180);
+  const normalized = text.replace(/\r\n?/g, "\n").split("\n").map((line) => line.trim()).filter(Boolean).join(" ").replace(/\s+/g, " ").trim();
+  if (normalized.length <= maxChars) return normalized;
+  const sentences = normalized.match(/[^.!?]+[.!?]+(?=\s|$)|[^.!?]+$/g) ?? [normalized];
+  const selected = [];
+  for (const sentence of sentences) {
+    selected.push(sentence.trim());
+    const candidate = selected.join(" ");
+    if (selected.length >= maxSentences || candidate.length >= maxChars) break;
+  }
+  const summary = selected.join(" ").trim() || normalized;
+  if (summary.length <= maxChars) return summary;
+  const hardLimit = maxChars - 4;
+  const boundary = findWordBoundary(summary, hardLimit);
+  return `${summary.slice(0, boundary > 0 ? boundary : hardLimit).trimEnd()} ...`;
+}
+function applyToolDescriptionModeToTool(tool, mode) {
+  const existingOriginal = getOriginalDescription(tool);
+  if (mode === "extend" && !existingOriginal) return tool;
+  const original = existingOriginal ?? {
+    description: tool.description,
+    usageHint: tool.usageHint
+  };
+  const next = mode === "simple" ? withDescription(tool, {
+    description: simplifyToolDescription(original.description),
+    usageHint: original.usageHint === void 0 ? void 0 : simplifyToolDescription(original.usageHint)
+  }) : withDescription(tool, original);
+  return attachOriginalDescription(next, original);
+}
+function getOriginalDescription(tool) {
+  return tool[ORIGINAL_TOOL_DESCRIPTION];
+}
+function attachOriginalDescription(tool, original) {
+  Object.defineProperty(tool, ORIGINAL_TOOL_DESCRIPTION, {
+    configurable: true,
+    enumerable: false,
+    value: original,
+    writable: true
+  });
+  return tool;
+}
+function withDescription(tool, next) {
+  const copy = {
+    ...tool,
+    description: next.description,
+    usageHint: next.usageHint
+  };
+  if (next.usageHint === void 0) {
+    delete copy.usageHint;
+  }
+  return copy;
+}
+function findWordBoundary(text, limit) {
+  const semantic = Math.max(
+    text.lastIndexOf(". ", limit),
+    text.lastIndexOf("; ", limit),
+    text.lastIndexOf(", ", limit)
+  );
+  if (semantic > 40) return semantic + 1;
+  const space = text.lastIndexOf(" ", limit);
+  return space > 40 ? space : limit;
+}
+
 // src/registry/tool-registry.ts
 var ToolRegistry = class _ToolRegistry {
   tools = /* @__PURE__ */ new Map();
@@ -477,6 +477,15 @@ var ToolRegistry = class _ToolRegistry {
   /** Cached `list()` result, frozen after build. Invalidated on _version change. */
   _listSnapshot;
   _listSnapshotVersion = -1;
+  /**
+   * Optional direct provider surface. `undefined` preserves the legacy
+   * behaviour (every enabled catalog tool is direct); when set, `list()` still
+   * exposes the complete executable catalog while `listForProvider()` returns
+   * only these names. This keeps lazy tools discoverable by tool_search/tool_use.
+   */
+  _providerToolNames;
+  _providerListSnapshot;
+  _providerListSnapshotVersion = -1;
   /** Pre-compute tool definition token estimate once at registration time. */
   _stampDefTokens(tool) {
     if (tool._estDefTokens === void 0) {
@@ -726,6 +735,30 @@ var ToolRegistry = class _ToolRegistry {
     this._listSnapshotVersion = this._version;
     return arr;
   }
+  /** Replace the direct provider surface. Pass `undefined` to expose the catalog. */
+  setProviderToolNames(names) {
+    this._providerToolNames = names ? new Set(names) : void 0;
+    this._version++;
+  }
+  /** Add registered or future tool names to the direct provider surface. */
+  exposeToProvider(names) {
+    if (!this._providerToolNames) return;
+    for (const name of typeof names === "string" ? [names] : names) {
+      this._providerToolNames.add(name);
+    }
+    this._version++;
+  }
+  /** Tools serialized into provider requests and described by the system prompt. */
+  listForProvider() {
+    if (!this._providerToolNames) return this.list();
+    if (this._providerListSnapshot && this._version === this._providerListSnapshotVersion) {
+      return this._providerListSnapshot;
+    }
+    const arr = Array.from(this.tools.entries()).filter(([name]) => !this._disabled.has(name) && this._providerToolNames?.has(name) === true).map(([, entry]) => entry.tool);
+    this._providerListSnapshot = arr;
+    this._providerListSnapshotVersion = this._version;
+    return arr;
+  }
   /**
    * Group tools by their `category` field. Tools without a category
    * are placed under the key `""` (empty string). Returns a Map of
@@ -752,6 +785,7 @@ var ToolRegistry = class _ToolRegistry {
     this.tools.clear();
     this.descriptionModes.clear();
     this._disabled.clear();
+    this._providerToolNames = void 0;
     this._version++;
   }
   /**
@@ -770,6 +804,7 @@ var ToolRegistry = class _ToolRegistry {
     for (const name of this._disabled) {
       copy._disabled.add(name);
     }
+    copy._providerToolNames = this._providerToolNames ? new Set(this._providerToolNames) : void 0;
     copy._version = this._version;
     return copy;
   }

package/dist/registry/tool-registry.d.ts

@@ -36,6 +36,15 @@ export declare class ToolRegistry {
     /** Cached `list()` result, frozen after build. Invalidated on _version change. */
     private _listSnapshot;
     private _listSnapshotVersion;
+    /**
+     * Optional direct provider surface. `undefined` preserves the legacy
+     * behaviour (every enabled catalog tool is direct); when set, `list()` still
+     * exposes the complete executable catalog while `listForProvider()` returns
+     * only these names. This keeps lazy tools discoverable by tool_search/tool_use.
+     */
+    private _providerToolNames;
+    private _providerListSnapshot;
+    private _providerListSnapshotVersion;
     /** Pre-compute tool definition token estimate once at registration time. */
     private _stampDefTokens;
     /** Apply the description mode transform and stamp token estimates. */
@@ -134,6 +143,12 @@ export declare class ToolRegistry {
         owner: string;
     }[];
     list(): Tool[];
+    /** Replace the direct provider surface. Pass `undefined` to expose the catalog. */
+    setProviderToolNames(names: readonly string[] | undefined): void;
+    /** Add registered or future tool names to the direct provider surface. */
+    exposeToProvider(names: string | readonly string[]): void;
+    /** Tools serialized into provider requests and described by the system prompt. */
+    listForProvider(): Tool[];
     /**
      * Group tools by their `category` field. Tools without a category
      * are placed under the key `""` (empty string). Returns a Map of

package/dist/security/capabilities.d.ts

@@ -45,6 +45,8 @@ export declare const ToolCapabilities: {
     readonly NET_OUTBOUND: 'net.outbound';
     /** Can mutate in-memory session todos only. */
     readonly SESSION_TODO: 'session.todo';
+    /** Can park after-task `<nextsteps>` suggestions for the current turn. */
+    readonly SESSION_NEXTSTEPS: 'session.nextsteps';
     /** Can mutate in-memory session mode only. */
     readonly SESSION_MODE: 'session.mode';
     /** Can inspect registered tool metadata. */

package/dist/security/index.d.ts

@@ -8,7 +8,7 @@ export { restrictDirPermissions, restrictFilePermissions, SECRET_DIR_MODE, SECRE
 export { evaluateToolKanbanBoundary, type ToolKanbanBoundaryEvaluation, } from './kanban-boundary.js';
 export { AutoApprovePermissionPolicy, alwaysAllowUnavailableReason, DefaultPermissionPolicy, type PermissionPolicyOptions, } from './permission-policy.js';
 export { TRUST_POLICY_JSON_SCHEMA, TRUST_POLICY_LIMITS, TRUST_POLICY_SCHEMA_VERSION, type TrustPolicyDiagnostic, type TrustPolicyDiagnosticCode, type TrustPolicyValidationResult, validateTrustPolicy, } from './permission-policy-schema.js';
-export { ReadOnlyPermissionPolicy } from './readonly-permission-policy.js';
+export { ReadOnlyPermissionPolicy, toolMutates } from './readonly-permission-policy.js';
 export { DefaultSecretScrubber } from './secret-scrubber.js';
 export { base32Decode, base32Encode, buildOtpAuthUri, generateRecoveryCodes, generateTotpSecret, generateTotp, hashRecoveryCode, verifyRecoveryCode, verifyTotp, verifyTotpCounter, } from './totp.js';
 export { DefaultSecretVault, migratePlaintextSecrets, rewriteConfigEncrypted, rotateConfigKeys, type SecretVaultOptions, } from './secret-vault.js';

package/dist/security/index.js

@@ -47,6 +47,8 @@ var ToolCapabilities = {
   NET_OUTBOUND: "net.outbound",
   /** Can mutate in-memory session todos only. */
   SESSION_TODO: "session.todo",
+  /** Can park after-task `<nextsteps>` suggestions for the current turn. */
+  SESSION_NEXTSTEPS: "session.nextsteps",
   /** Can mutate in-memory session mode only. */
   SESSION_MODE: "session.mode",
   /** Can inspect registered tool metadata. */
@@ -3166,9 +3168,11 @@ var MUTATION_CAPABILITIES = /* @__PURE__ */ new Set([
   ToolCapabilities.PACKAGE_INSTALL,
   ToolCapabilities.SUBAGENT_SPAWN
 ]);
-function hasMutationCapability(tool) {
+function toolMutates(tool) {
+  if (tool.mutating === true) return true;
   return (tool.capabilities ?? []).some((c) => MUTATION_CAPABILITIES.has(c));
 }
+var hasMutationCapability = toolMutates;
 function isAllowedReportFile(input, projectRoot) {
   if (!input || typeof input !== "object") return false;
   const record = input;
@@ -3201,10 +3205,12 @@ var ReadOnlyPermissionPolicy = class {
     if (isAllowedReportFile(input, this.projectRoot)) {
       return this.inner.evaluate(tool, input, ctx);
     }
+    const matched = (tool.capabilities ?? []).filter((c) => MUTATION_CAPABILITIES.has(c));
+    const why = matched.length > 0 ? `requires mutation capabilities (${matched.join(", ")})` : "is declared mutating";
     return {
       permission: "deny",
       source: "readonly_mode",
-      reason: `Session is in read-only mode: tool "${tool.name}" requires mutation capabilities (${(tool.capabilities ?? []).filter((c) => MUTATION_CAPABILITIES.has(c)).join(", ")}) which are not allowed. Only .md report files under .temp_files/ may be written.`
+      reason: `Session is in read-only mode: tool "${tool.name}" ${why}, which is not allowed. Only .md report files under .temp_files/ may be written.`
     };
   }
   async trust(rule) {
@@ -4227,6 +4233,7 @@ export {
   sanitizeApiError,
   scrubErrorDetail,
   scrubErrorText,
+  toolMutates,
   validateDirectoryPolicy,
   validateTrustPolicy,
   verifyRecoveryCode,

package/dist/security/readonly-permission-policy.d.ts

@@ -31,6 +31,26 @@
 import type { Context } from '../core/context.js';
 import type { PermissionDecision, PermissionPolicy, PermissionTrace } from '../types/permission.js';
 import type { Tool } from '../types/tool.js';
+/**
+ * Does this tool change something?
+ *
+ * `capabilities` is the precise answer and stays authoritative — but it is
+ * OPT-IN metadata, and a repo-wide count found 154 tools declaring
+ * `mutating: true` of which 121 carried no mutation capability at all (28 of
+ * those at `permission: 'auto'`, including tools that write API keys and one
+ * that sends messages outbound). Read-only mode consulted only `capabilities`,
+ * so every one of them ran unblocked and unprompted, while
+ * `permission-policy.ts` was already answering the same question with
+ * `tool.mutating || …`.
+ *
+ * Trusting `mutating` here closes all 121 at once and makes the two policies
+ * agree. It fails in the safe direction: a tool that declares itself mutating
+ * is blocked in read-only mode even if its capability list is incomplete.
+ * Fixing the capability labels is still worth doing — it is what the finer
+ * grained gates key on — but it is no longer what stands between read-only
+ * mode and a write.
+ */
+export declare function toolMutates(tool: Tool): boolean;
 /**
  * Read-only permission policy — session-scoped toggle via ctx.meta['readOnly'].
  *

package/dist/session-registry-atomic-file.d.ts

@@ -1,12 +1,39 @@
 import type { SessionRegistryEntry } from './session-registry-types.js';
 /** Also the scan interval for {@link pruneStaleTempFiles} — see its caller. */
 export declare const STALE_TMP_MS = 60000;
+/** `host:pid` owner stamp written into the advisory lock on acquisition. */
+export declare function lockOwnerStamp(): string;
 /**
- * Break a contended lock if it is stale: the recorded owner pid is no longer
- * alive, or the lock is older than {@link STALE_LOCK_MS}. Returns true when the
- * lock was removed (caller should retry acquisition). Best-effort and
- * race-tolerant — a fresh lock (age ~0, live owner) is never broken, so the
- * common concurrent case self-heals on the next heartbeat.
+ * Unlink `lockPath` only if it still carries OUR exact host:pid stamp. A
+ * stale-lock breaker may have stolen the lock and re-stamped it with another
+ * host:pid; the resumed holder must not remove the new owner's lock. An EMPTY
+ * read is never ours to remove either — it may be the new owner's lock in its
+ * open-to-stamp gap (that lock is mtime-bounded instead).
+ *
+ * Residual race: between the owner read and the unlink, a foreign-host lease
+ * break could replace the lock; unlinking would then remove the new owner's
+ * lock. Exploiting it requires a >STALE_LOCK_MS hold AND a rename+stamp
+ * landing inside that microsecond window, so it is accepted and bounded by
+ * the same foreign-lease logic that enabled it.
+ */
+export declare function maybeUnlinkOwnedLock(lockPath: string): Promise<void>;
+/**
+ * Break a contended lock if it is stale: a same-host owner pid that is no
+ * longer alive, or a foreign-host/ownerless lock older than
+ * {@link STALE_LOCK_MS}. A live same-host owner's lock is only broken past
+ * {@link SAME_HOST_STALE_MS} — a live-but-wedged holder must not degrade
+ * cross-session writes forever, but mtime alone must not false-positive while
+ * the holder is mid-critical-section. Returns true when the lock was removed
+ * (caller should retry acquisition).
+ *
+ * Removal is an atomic RENAME to a unique tombstone, never unlink: with
+ * unlink, two waiters can both read a stale lock and one's unlink can remove
+ * the OTHER's fresh lock, letting both into the critical section (POSIX).
+ * Rename wins for exactly one waiter; losers get ENOENT and simply retry.
+ * (A rename landing after the winner re-created the lock could still move the
+ * winner's fresh lock — a pre-existing microsecond TOCTOU; the caller's
+ * stamp-guarded cleanup prevents the resumed holder from unlinking the new
+ * owner's lock.)
  */
 export declare function breakStaleLock(lockPath: string): Promise<boolean>;
 export declare function writeAtomicFile(filePath: string, registry: Record<string, SessionRegistryEntry>): Promise<void>;

package/dist/session-registry-types.d.ts

@@ -109,6 +109,21 @@ export interface AgentEntry {
     lastActivityAt: string;
 }
 export type SessionLiveStatus = 'active' | 'idle' | 'closing' | 'stale' | 'lost';
+export interface SessionWebUIEndpointHint {
+    role: 'standalone' | 'parent-shell' | 'session-child';
+    surface: 'webui' | 'simpleui' | string;
+    host: string;
+    httpPort: number;
+    url: string;
+    /** Redundant owner PID used to cross-check against WebUI instance records. */
+    pid: number;
+    parentPid?: number | undefined;
+    parentShellId?: string | undefined;
+    runtimeId?: string | undefined;
+    attachable?: boolean | undefined;
+    protocolVersion?: number | undefined;
+    capabilities?: string[] | undefined;
+}
 export interface SessionRegistryEntry {
     sessionId: string;
     projectSlug: string;
@@ -132,5 +147,7 @@ export interface SessionRegistryEntry {
     /** Count of tracked agents */
     agentCount: number;
     agents: AgentEntry[];
+    /** Optional WebUI endpoint hint. Session ownership remains keyed by `sessionId` + `pid`. */
+    webuiEndpoint?: SessionWebUIEndpointHint | undefined;
 }
 //# sourceMappingURL=session-registry-types.d.ts.map

package/dist/session-registry.d.ts

@@ -13,7 +13,7 @@
  * @module session-registry
  */
 import type { AgentEntry, SessionRegistryEntry } from './session-registry-types.js';
-export type { AgentActivityTotals, AgentEntry, AgentLiveStatus, AgentRecentMail, AgentRecentTool, AgentTodoItem, SessionLiveStatus, SessionRegistryEntry, } from './session-registry-types.js';
+export type { AgentActivityTotals, AgentEntry, AgentLiveStatus, AgentRecentMail, AgentRecentTool, AgentTodoItem, SessionLiveStatus, SessionRegistryEntry, SessionWebUIEndpointHint, } from './session-registry-types.js';
 export declare class SessionRegistry {
     private readonly filePath;
     private heartbeatTimer;

package/dist/skills/frontmatter.d.ts

@@ -28,6 +28,12 @@ export interface ParsedSkillFrontmatter {
      * consult this field, so it neither grants nor restricts any tool.
      */
     allowedTools?: string[] | undefined;
+    /** WrongStack stable runtime capabilities required before this skill may load. */
+    requiredCapabilities?: string[] | undefined;
+    /** Exact registered tool names required before this skill may render or load. */
+    requiredTools?: string[] | undefined;
+    /** Capabilities that improve the workflow but have documented fallbacks. */
+    optionalCapabilities?: string[] | undefined;
 }
 /**
  * Parse the YAML frontmatter block from a raw SKILL.md file. Returns `{}` when

package/dist/skills/index.js

@@ -40,7 +40,14 @@ function securityScoreToTier(score) {
 }
 
 // src/skills/frontmatter.ts
-var SCALAR_KEYS = /* @__PURE__ */ new Set(["name", "description", "trigger", "version", "license", "compatibility"]);
+var SCALAR_KEYS = /* @__PURE__ */ new Set([
+  "name",
+  "description",
+  "trigger",
+  "version",
+  "license",
+  "compatibility"
+]);
 function parseSkillFrontmatter(raw) {
   const text = normalizeLineEndings(raw);
   if (!text.startsWith("---")) return {};
@@ -99,8 +106,9 @@ function parseFrontmatterBlock(block) {
       out[normalizeKey(key)] = collected.join("\n").trim();
       continue;
     }
-    if (key === "allowed-tools" || key === "allowedTools") {
-      out.allowedTools = rest.split(/[\s,]+/).filter(Boolean);
+    if (key === "allowed-tools" || key === "allowedTools" || key === "required-capabilities" || key === "requiredCapabilities" || key === "required-tools" || key === "requiredTools" || key === "optional-capabilities" || key === "optionalCapabilities") {
+      const values = rest.replace(/^\[/, "").replace(/\]$/, "").split(/[\s,]+/).map(unquote).filter(Boolean);
+      out[normalizeKey(key)] = values;
       i++;
       continue;
     }
@@ -114,7 +122,11 @@ function parseFrontmatterBlock(block) {
   return out;
 }
 function normalizeKey(key) {
-  return key === "allowed-tools" ? "allowedTools" : key;
+  if (key === "allowed-tools") return "allowedTools";
+  if (key === "required-capabilities") return "requiredCapabilities";
+  if (key === "required-tools") return "requiredTools";
+  if (key === "optional-capabilities") return "optionalCapabilities";
+  return key;
 }
 function unquote(s) {
   if (s.length >= 2 && (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'"))) {
@@ -980,7 +992,12 @@ async function openInEditor(filePath, env = process.env) {
   const child = spawn(parts[0], [...parts.slice(1), filePath], {
     stdio: "ignore",
     detached: true,
-    shell
+    shell,
+    // `shell` routes through cmd.exe on win32, which flashes a console window
+    // before the editor appears. A GUI editor is unaffected by the flag; the
+    // shell wrapper is what it suppresses. Repo convention — see
+    // `core/tests/architecture/spawn-convention.test.ts`.
+    windowsHide: true
   });
   child.unref();
 }

package/dist/storage/cloud-config-sync/sanitize.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Contract-aware partitioning and sanitization for my.wrongstack.com config sync.
+ *
+ * The portal's namespace registry owns a fixed set of `config.json` top-level keys and
+ * validates each payload against a strict, recursively-specified schema (server repo:
+ * `docs/CLIENT_SYNC_CONTRACT.md`). This module is the client half of that contract:
+ *
+ * - `buildNamespacePayloads` projects the local config onto the contract field tree, so a
+ *   payload can never carry a field the server does not know (which would 422) — and, more
+ *   importantly, can never carry credential material: secret-bearing paths simply are not
+ *   in the tree.
+ * - `applyNamespacePayload` merges a pulled server payload back at contract-field
+ *   granularity, so locally-kept fields the contract does not own (e.g. `tools.exec`,
+ *   `mcpServers.*.env`, every `providers.*.apiKey`) are never clobbered by a pull.
+ *
+ * Stripping is therefore structural (projection), with `stripSecretMaterial` as a final
+ * defense-in-depth pass mirroring the server's own scan.
+ */
+/** `true` = the whole value is contract-owned; an object = recurse per key; `'*'` = record wildcard. */
+export type ContractNode = true | {
+    [key: string]: ContractNode;
+};
+/** Namespace → the contract tree over the `config.json` top-level keys it owns. */
+export declare const CLOUD_SYNC_CONTRACT: Readonly<Record<string, ContractNode>>;
+export declare const CLOUD_SYNC_NAMESPACES: string[];
+/** Server-side schema versions, sent in every push envelope. */
+export declare const NAMESPACE_SCHEMA_VERSIONS: Readonly<Record<string, number>>;
+/**
+ * Top-level keys that must never leave the machine, per the contract. Everything not in a
+ * contract tree stays local implicitly; this list exists for documentation and tests.
+ */
+export declare const LOCAL_ONLY_TOP_LEVEL: readonly ['version', 'configScope', 'hq', 'cloudSync', 'sync', 'models', 'apiKey', 'baseUrl'];
+/**
+ * Defense-in-depth sweep run over every outgoing payload after projection: drops any
+ * secret-named key and any string value that is (or contains) an encrypted blob. Returns
+ * `undefined` when nothing survives.
+ */
+export declare function stripSecretMaterial(value: unknown): unknown;
+/**
+ * Builds the per-namespace payloads to push. Sections absent locally are omitted (every
+ * top-level contract key is optional server-side); a namespace with nothing to say is
+ * omitted entirely.
+ */
+export declare function buildNamespacePayloads(config: Record<string, unknown>): Record<string, Record<string, unknown>>;
+/**
+ * Applies a pulled namespace snapshot to the local config object, returning a new object.
+ *
+ * Only keys present in the payload are touched (an omitted optional section means "the
+ * server doesn't know", never "deleted"), and inside each section only contract-owned
+ * paths are replaced — `providers.*.apiKey`, `mcpServers.*.env`, `tools.exec`, and any
+ * field newer than the contract stay exactly as they are locally.
+ */
+export declare function applyNamespacePayload(config: Record<string, unknown>, namespace: string, payload: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=sanitize.d.ts.map