@wrongstack/core 0.300.0 → 0.302.0

package/dist/storage/index.js

@@ -854,6 +854,9 @@ function canonicalProjectRoot(absRoot) {
     const commonDirFile = path2.join(gitDir, "commondir");
     if (!fs2.statSync(commonDirFile).isFile()) return checkoutRoot;
     const commonDir = path2.resolve(gitDir, fs2.readFileSync(commonDirFile, "utf8").trim());
+    const worktreesDir = path2.dirname(gitDir);
+    if (path2.basename(worktreesDir).toLowerCase() !== "worktrees") return checkoutRoot;
+    if (path2.resolve(worktreesDir, "..") !== commonDir) return checkoutRoot;
     if (path2.basename(commonDir).toLowerCase() !== ".git") return checkoutRoot;
     return path2.dirname(commonDir);
   } catch {
@@ -876,7 +879,7 @@ function safeProfileName(name) {
   const safe = (name ?? "").replace(/[/\\:]/g, "_").replace(/\.\./g, "_").trim();
   return safe || "default";
 }
-function activeProfileName(globalRoot) {
+function bootstrapProfileName(globalRoot) {
   try {
     const parsed = JSON.parse(fs2.readFileSync(path2.join(globalRoot, "config.json"), "utf8"));
     return safeProfileName(
@@ -894,7 +897,7 @@ function wstackGlobalRoot() {
 function resolveWstackPaths(opts) {
   const globalRoot = opts.globalRoot ?? (opts.userHome ? path2.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
   const homeDir = opts.userHome ?? os.homedir();
-  const profileName = safeProfileName(opts.profileName ?? activeProfileName(globalRoot));
+  const profileName = safeProfileName(opts.profileName ?? bootstrapProfileName(globalRoot));
   const profileDir = path2.join(globalRoot, "profiles", profileName);
   const hash = projectHash(opts.projectRoot);
   const slug = projectSlug(opts.projectRoot);
@@ -964,7 +967,12 @@ function resolveWstackPaths(opts) {
     projectRequirementIntakes: path2.join(projectDir, "requirement-intakes"),
     syncConfig: path2.join(profileDir, "sync.json"),
     configHistoryDir: path2.join(globalRoot, "config-history"),
-    projectStatus: (projectHash2) => path2.join(globalRoot, "projects", projectHash2, "status.json")
+    projectStatus: (statusProjectSlug) => {
+      if (!/^[a-z0-9](?:[a-z0-9-]{0,39})-[a-f0-9]{6}$/.test(statusProjectSlug)) {
+        throw new Error(`Invalid project slug: ${statusProjectSlug}`);
+      }
+      return path2.join(globalRoot, "projects", statusProjectSlug, "status.json");
+    }
   };
 }
 
@@ -1056,13 +1064,93 @@ function ulid(seedTime = Date.now()) {
 }
 
 // src/utils/regex-guard.ts
-var MAX_PATTERN_LEN = 512;
+var MAX_PATTERN_LEN = 256;
 var DANGEROUS_PATTERNS = [
+  // (a+)+, (.*)+, etc — nested quantifier on a group with internal quantifier
   /(\([^)]*[+*][^)]*\))[+*]/,
-  // (a+)+, (.*)+, etc
-  /(\(\?:[^)]*[+*][^)]*\))[+*]/
-  // same, with non-capturing group
+  /(\(\?:[^)]*[+*][^)]*\))[+*]/,
+  // Adjacent quantifiers: a++ a*+
+  /[+*]{2,}/,
+  // Quantifier on alternation with length 2+
+  /\([^|)]+\|[^)]+\)[+*][+*]/,
+  // Greedy quantifier inside lookahead/lookbehind — (?!.*a+)
+  /[([][^)\]]*[+*][^)\]]*[)\]][^)]*\?\??/
 ];
+function hasAmbiguousQuantifiedAlternation(pattern) {
+  for (let i = 0; i < pattern.length; i++) {
+    if (pattern[i] !== "(") continue;
+    if (i > 0 && pattern[i - 1] === "\\") continue;
+    let depth = 0;
+    let inClass = false;
+    let j = i;
+    for (; j < pattern.length; j++) {
+      const ch = pattern[j];
+      if (ch === "\\") {
+        j++;
+        continue;
+      }
+      if (inClass) {
+        if (ch === "]") inClass = false;
+        continue;
+      }
+      if (ch === "[") {
+        inClass = true;
+        continue;
+      }
+      if (ch === "(") depth++;
+      else if (ch === ")") {
+        depth--;
+        if (depth === 0) break;
+      }
+    }
+    if (j >= pattern.length) return false;
+    const next = pattern[j + 1];
+    if (next !== "+" && next !== "*" && next !== "{") continue;
+    let inner = pattern.slice(i + 1, j);
+    inner = inner.replace(/^\?(?::|<?[=!])/u, "");
+    const branches = [];
+    let current = "";
+    let d = 0;
+    let cls = false;
+    for (let k = 0; k < inner.length; k++) {
+      const ch = inner[k];
+      if (ch === "\\") {
+        current += ch + (inner[k + 1] ?? "");
+        k++;
+        continue;
+      }
+      if (cls) {
+        if (ch === "]") cls = false;
+        current += ch;
+        continue;
+      }
+      if (ch === "[") {
+        cls = true;
+        current += ch;
+        continue;
+      }
+      if (ch === "(") d++;
+      if (ch === ")") d--;
+      if (ch === "|" && d === 0) {
+        branches.push(current);
+        current = "";
+        continue;
+      }
+      current += ch;
+    }
+    branches.push(current);
+    if (branches.length < 2) continue;
+    for (let a = 0; a < branches.length; a++) {
+      for (let b = a + 1; b < branches.length; b++) {
+        const x = branches[a];
+        const y = branches[b];
+        if (x === "" || y === "") return true;
+        if (x === y || x.startsWith(y) || y.startsWith(x)) return true;
+      }
+    }
+  }
+  return false;
+}
 function compileUserRegex(pattern, flags) {
   if (typeof pattern !== "string") {
     return { ok: false, reason: "pattern must be a string" };
@@ -1081,6 +1169,12 @@ function compileUserRegex(pattern, flags) {
       };
     }
   }
+  if (hasAmbiguousQuantifiedAlternation(pattern)) {
+    return {
+      ok: false,
+      reason: "pattern quantifies an alternation with overlapping branches \u2014 rewrite so no two branches can match the same text"
+    };
+  }
   try {
     return { ok: true, regex: new RegExp(pattern, flags) };
   } catch (err) {
@@ -1090,6 +1184,7 @@ function compileUserRegex(pattern, flags) {
     };
   }
 }
+var MAX_SUBJECT_LEN = 64 * 1024;
 
 // src/utils/safe-json.ts
 function safeParse(input, maxBytes = 5e6) {
@@ -2731,8 +2826,8 @@ function scrubPersistedSessionEvent(event, scrubber) {
 function scrubPersistedSessionData(data, scrubber) {
   return scrubber.scrubObject(data);
 }
-function scrubPersistedSessionSummary(summary, scrubber) {
-  const scrubbed = scrubber.scrubObject(summary);
+function scrubPersistedSessionSummary(summary2, scrubber) {
+  const scrubbed = scrubber.scrubObject(summary2);
   const { name: _name, lastUserMessage: _lastUserMessage, ...rest } = scrubbed;
   const title = sessionContentText(scrubbed.title) || "(empty session)";
   const name = scrubbed.name === void 0 ? "" : sessionContentText(scrubbed.name);
@@ -3639,15 +3734,15 @@ function compareSessionSummaries(a, b) {
   if (a.startedAt > b.startedAt) return -1;
   return a.id.localeCompare(b.id);
 }
-function matchesSessionFilter(summary, criteria) {
-  if (criteria.since && summary.startedAt < criteria.since) return false;
-  if (criteria.until && summary.startedAt > criteria.until) return false;
-  if (criteria.provider && summary.provider !== criteria.provider) return false;
-  if (criteria.model && summary.model !== criteria.model) return false;
-  if (criteria.minTokens !== void 0 && summary.tokenTotal < criteria.minTokens) return false;
+function matchesSessionFilter(summary2, criteria) {
+  if (criteria.since && summary2.startedAt < criteria.since) return false;
+  if (criteria.until && summary2.startedAt > criteria.until) return false;
+  if (criteria.provider && summary2.provider !== criteria.provider) return false;
+  if (criteria.model && summary2.model !== criteria.model) return false;
+  if (criteria.minTokens !== void 0 && summary2.tokenTotal < criteria.minTokens) return false;
   if (criteria.titleContains) {
     const needle = criteria.titleContains.toLocaleLowerCase();
-    if (!summary.title.toLocaleLowerCase().includes(needle)) return false;
+    if (!summary2.title.toLocaleLowerCase().includes(needle)) return false;
   }
   return true;
 }
@@ -3670,15 +3765,15 @@ async function readOrBuildShardManifestEntry(opts) {
     async (ref) => {
       const manifest = await opts.readSummaryManifest(ref.id);
       if (manifest) return { summary: manifest, needsBackfill: false };
-      const summary = await opts.summaryHeaderFor(ref);
-      if (!summary) return null;
-      const hydrated = await opts.summaryFor(summary.id).catch(() => summary);
+      const summary2 = await opts.summaryHeaderFor(ref);
+      if (!summary2) return null;
+      const hydrated = await opts.summaryFor(summary2.id).catch(() => summary2);
       return { summary: hydrated, needsBackfill: false };
     }
   );
   const summaries = candidates.filter((candidate) => candidate !== null).map((candidate) => candidate.summary);
   summaries.sort(compareSessionSummaries);
-  const entry = { summaries, ids: summaries.map((summary) => summary.id) };
+  const entry = { summaries, ids: summaries.map((summary2) => summary2.id) };
   await atomicWrite(opts.manifestPath, JSON.stringify(entry), { mode: 384 }).catch(
     () => void 0
   );
@@ -3925,7 +4020,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
   }
   scrubSummaries(summaries) {
-    return summaries.map((summary) => scrubPersistedSessionSummary(summary, this.secretScrubber));
+    return summaries.map((summary2) => scrubPersistedSessionSummary(summary2, this.secretScrubber));
   }
   /**
    * Clear the load() cache. Useful for testing or when the caller knows
@@ -4304,12 +4399,12 @@ var DefaultSessionStore = class _DefaultSessionStore {
   indexAppendCount = 0;
   static COMPACT_EVERY = 30;
   /** Append a session summary to the index, propagating persistence failures. */
-  async appendToIndexStrict(summary) {
+  async appendToIndexStrict(summary2) {
     await ensureDir(this.dir);
     let shouldCompact = false;
     await withFileLock(this.indexFile, async () => {
-      await this.invalidateShardManifestBySessionId(summary.id);
-      const line = JSON.stringify(summary) + "\n";
+      await this.invalidateShardManifestBySessionId(summary2.id);
+      const line = JSON.stringify(summary2) + "\n";
       await fsp12.appendFile(this.indexFile, line, { encoding: "utf8", mode: SECRET_FILE_MODE });
       this._indexCache = null;
       this.indexAppendCount++;
@@ -4323,8 +4418,8 @@ var DefaultSessionStore = class _DefaultSessionStore {
     }
   }
   /** Best-effort index append used by writer close. */
-  async appendToIndex(summary) {
-    await this.appendToIndexStrict(summary).catch(() => {
+  async appendToIndex(summary2) {
+    await this.appendToIndexStrict(summary2).catch(() => {
     });
   }
   /** Append a tombstone entry for a deleted session. */
@@ -4457,8 +4552,8 @@ var DefaultSessionStore = class _DefaultSessionStore {
     );
     const out = [];
     for (const entry of shardEntries) {
-      for (const summary of entry.summaries) {
-        out.push({ summary, needsBackfill: false });
+      for (const summary2 of entry.summaries) {
+        out.push({ summary: summary2, needsBackfill: false });
       }
     }
     out.sort((a, b) => compareSessionSummaries(a.summary, b.summary));
@@ -4529,8 +4624,8 @@ var DefaultSessionStore = class _DefaultSessionStore {
     try {
       const full = this.sessionPath(id, ".jsonl");
       const stat15 = await fsp12.stat(full);
-      const summary = await this.summarize(id, stat15.mtime.toISOString());
-      await atomicWrite(manifest, JSON.stringify(summary), { mode: 384 }).catch((err) => {
+      const summary2 = await this.summarize(id, stat15.mtime.toISOString());
+      await atomicWrite(manifest, JSON.stringify(summary2), { mode: 384 }).catch((err) => {
         const msg = toErrorMessage(err);
         emitSessionStoreError(this.events, id, manifest, "summary_fallback", msg, true);
         this.logWarn("Session manifest write failed", {
@@ -4550,7 +4645,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         Date.now() - t0,
         errorMsg
       );
-      return summary;
+      return summary2;
     } catch (err) {
       outcome = "failure";
       errorMsg = toErrorMessage(err);
@@ -4623,14 +4718,14 @@ var DefaultSessionStore = class _DefaultSessionStore {
     let updated;
     try {
       updated = await withFileLock(manifest, async () => {
-        const summary = await this.readSummaryManifest(id) ?? await this.summaryFor(id);
-        const { name: _drop, ...rest } = summary;
+        const summary2 = await this.readSummaryManifest(id) ?? await this.summaryFor(id);
+        const { name: _drop, ...rest } = summary2;
         const next = trimmed ? { ...rest, name: trimmed } : rest;
         await atomicWrite(manifest, JSON.stringify(next), { mode: 384 });
         try {
           await this.appendToIndexStrict(next);
         } catch (err) {
-          await atomicWrite(manifest, JSON.stringify(summary), { mode: 384 });
+          await atomicWrite(manifest, JSON.stringify(summary2), { mode: 384 });
           throw err;
         }
         return next;
@@ -6607,7 +6702,7 @@ var CONFIG_BEHAVIOR_DEFAULTS = {
       enabled: false
     }
   },
-  skills: { readClaudeSkills: true },
+  skills: { readClaudeSkills: true, mode: "progressive" },
   mcpServers: {},
   fallbackAuto: true,
   maxConcurrent: 4,
@@ -6707,19 +6802,19 @@ function repairConfigDefaults(input) {
       });
     }
     for (const [key, defaultValue] of Object.entries(defaults)) {
-      const path30 = prefix ? `${prefix}.${key}` : key;
+      const path31 = prefix ? `${prefix}.${key}` : key;
       if (!Object.hasOwn(target, key)) {
         target[key] = cloneJsonValue(defaultValue);
-        changes.push({ path: path30, action: "added" });
+        changes.push({ path: path31, action: "added" });
         continue;
       }
       const current = target[key];
       if (isPlainRecord(defaultValue)) {
         if (isPlainRecord(current)) {
-          repair(current, defaultValue, path30, depth + 1);
+          repair(current, defaultValue, path31, depth + 1);
         } else {
           target[key] = cloneJsonValue(defaultValue);
-          changes.push({ path: path30, action: "replaced" });
+          changes.push({ path: path31, action: "replaced" });
         }
         continue;
       }
@@ -6727,7 +6822,7 @@ function repairConfigDefaults(input) {
       const compatible = defaultIsArray ? Array.isArray(current) : !Array.isArray(current) && typeof current === typeof defaultValue;
       if (!compatible) {
         target[key] = cloneJsonValue(defaultValue);
-        changes.push({ path: path30, action: "replaced" });
+        changes.push({ path: path31, action: "replaced" });
       }
     }
   };
@@ -6849,6 +6944,10 @@ var KNOWN_DENIED_IN_PROJECT = [
     reason: "Controls which plugin boot states the LLM may mutate; user-owned trust policy."
   },
   { key: "sync", reason: "Carries githubToken credential and target repo." },
+  {
+    key: "cloudSync",
+    reason: "Carries the my.wrongstack.com machine token credential and endpoint URL."
+  },
   { key: "yolo", reason: "Disables all permission confirmation prompts." },
   { key: "extensions", reason: "Per-plugin config can carry command/credential fields." },
   { key: "hq", reason: "Carries HQ client token credential and endpoint URL." },
@@ -6911,6 +7010,7 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "modelRuntime",
   "hq",
   "sync",
+  "cloudSync",
   "extensions",
   "acp",
   "fleet",
@@ -6967,8 +7067,8 @@ var IN_PROJECT_DENIED_PATHS = [
     reason: "The other half of the filesystem confinement switch."
   }
 ];
-function deleteNestedPath(target, path30) {
-  const segments = path30.split(".");
+function deleteNestedPath(target, path31) {
+  const segments = path31.split(".");
   const last = segments[segments.length - 1];
   if (last === void 0) return false;
   let cursor = target;
@@ -7025,16 +7125,16 @@ function assertInProjectAllowListComplete() {
     );
   }
   const orphanedPaths = IN_PROJECT_DENIED_PATHS.filter(
-    ({ path: path30 }) => !IN_PROJECT_ALLOWED_KEYS.has(path30.split(".")[0] ?? "")
-  ).map(({ path: path30 }) => path30);
+    ({ path: path31 }) => !IN_PROJECT_ALLOWED_KEYS.has(path31.split(".")[0] ?? "")
+  ).map(({ path: path31 }) => path31);
   if (orphanedPaths.length > 0) {
     problems.push(
       `IN_PROJECT_DENIED_PATHS entr(ies) whose top-level parent is not allowed: ` + orphanedPaths.join(", ") + ". The parent is already stripped wholesale, so the nested denial is dead \u2014 remove it."
     );
   }
   const malformedPaths = IN_PROJECT_DENIED_PATHS.filter(
-    ({ path: path30 }) => path30.split(".").length < 2 || path30.split(".").some((s) => s.length === 0)
-  ).map(({ path: path30 }) => path30);
+    ({ path: path31 }) => path31.split(".").length < 2 || path31.split(".").some((s) => s.length === 0)
+  ).map(({ path: path31 }) => path31);
   if (malformedPaths.length > 0) {
     problems.push(
       `IN_PROJECT_DENIED_PATHS entr(ies) are not dotted nested paths: ` + malformedPaths.join(", ") + ". Top-level keys belong in KNOWN_DENIED_IN_PROJECT instead."
@@ -7062,8 +7162,8 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
     }
     stripped.push(k);
   }
-  for (const { path: path30 } of IN_PROJECT_DENIED_PATHS) {
-    if (deleteNestedPath(out, path30)) stripped.push(path30);
+  for (const { path: path31 } of IN_PROJECT_DENIED_PATHS) {
+    if (deleteNestedPath(out, path31)) stripped.push(path31);
   }
   if (stripped.length > 0) {
     warn(
@@ -9618,30 +9718,86 @@ import * as path24 from "node:path";
 // src/session-registry-atomic-file.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import * as fs11 from "node:fs/promises";
+import { hostname as hostname2 } from "node:os";
 import * as path23 from "node:path";
 var STALE_LOCK_MS = 1e4;
+var SAME_HOST_STALE_MS = 2 * STALE_LOCK_MS;
 var STALE_TMP_MS = 6e4;
 var MAX_STALE_TMP_FILES = 20;
+var HOST_NAME = hostname2();
+function lockOwnerStamp() {
+  return `${HOST_NAME}:${process.pid}`;
+}
+async function maybeUnlinkOwnedLock(lockPath) {
+  const owner = await fs11.readFile(lockPath, "utf8").catch(() => null);
+  if (owner === null || owner.trim() !== lockOwnerStamp()) return;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try {
+      await fs11.unlink(lockPath);
+      return;
+    } catch {
+      if (attempt < 2) await new Promise((resolve11) => setTimeout(resolve11, 5));
+    }
+  }
+}
 async function breakStaleLock(lockPath) {
   try {
-    const [stat15, content] = await Promise.all([
-      fs11.stat(lockPath),
-      /* v8 ignore start -- best-effort lock-content read; .catch only fires if the lock vanished */
-      fs11.readFile(lockPath, "utf8").catch(() => "")
-      /* v8 ignore stop */
-    ]);
-    const ageMs = Date.now() - stat15.mtimeMs;
-    const ownerPid = Number.parseInt(content.trim(), 10);
-    const ownerDead = Number.isInteger(ownerPid) && ownerPid > 0 && ownerPid !== process.pid && !isPidAlive(ownerPid);
-    if (ownerDead || ageMs > STALE_LOCK_MS) {
-      await fs11.unlink(lockPath).catch(() => void 0);
-      return true;
+    const content = await fs11.readFile(lockPath, "utf8").catch(() => "");
+    const trimmed = content.trim();
+    const colonIdx = trimmed.indexOf(":");
+    if (colonIdx === -1) {
+      const barePid = Number.parseInt(trimmed, 10);
+      if (Number.isInteger(barePid) && barePid > 0 && !isPidAlive(barePid)) {
+        return await breakStaleLockVerified(lockPath, async () => {
+          const reread = await fs11.readFile(lockPath, "utf8").catch(() => "");
+          return reread.trim() === trimmed;
+        });
+      }
+      return await breakStaleLockVerified(lockPath, async () => {
+        const st = await fs11.stat(lockPath);
+        return Date.now() - st.mtimeMs > STALE_LOCK_MS;
+      });
     }
-    return false;
+    const ownerHost = trimmed.slice(0, colonIdx);
+    const ownerPid = Number.parseInt(trimmed.slice(colonIdx + 1), 10);
+    if (ownerHost === HOST_NAME && Number.isInteger(ownerPid) && ownerPid > 0) {
+      if (isPidAlive(ownerPid)) {
+        const stat15 = await fs11.stat(lockPath);
+        if (Date.now() - stat15.mtimeMs > SAME_HOST_STALE_MS) {
+          return await breakStaleLockVerified(lockPath, async () => {
+            const st = await fs11.stat(lockPath);
+            return Date.now() - st.mtimeMs > SAME_HOST_STALE_MS;
+          });
+        }
+        return false;
+      }
+      return await breakStaleLockVerified(lockPath, async () => {
+        const reread = await fs11.readFile(lockPath, "utf8").catch(() => "");
+        return reread.trim() === trimmed;
+      });
+    }
+    return await breakStaleLockVerified(lockPath, async () => {
+      const st = await fs11.stat(lockPath);
+      return Date.now() - st.mtimeMs > STALE_LOCK_MS;
+    });
   } catch {
     return true;
   }
 }
+async function breakStaleLockVerified(lockPath, verify) {
+  if (!await verify()) return false;
+  return await breakLockAtomically(lockPath) === true;
+}
+async function breakLockAtomically(lockPath) {
+  const tombstone = `${lockPath}.stale-${randomUUID5()}.tmp`;
+  try {
+    await fs11.rename(lockPath, tombstone);
+  } catch {
+    return false;
+  }
+  void fs11.unlink(tombstone).catch(() => void 0);
+  return true;
+}
 async function writeAtomicFile(filePath, registry) {
   const tmp = path23.join(
     path23.dirname(filePath),
@@ -10102,16 +10258,33 @@ var SessionRegistry = class {
             continue;
           }
         }
+        let stampFailed = false;
         try {
-          await lockHandle.writeFile(String(process.pid)).catch(() => void 0);
+          let stamped = false;
+          for (let stampAttempt = 0; stampAttempt < 3 && !stamped; stampAttempt++) {
+            try {
+              await lockHandle.writeFile(lockOwnerStamp());
+              stamped = true;
+            } catch {
+              if (stampAttempt < 2) await new Promise((resolve11) => setTimeout(resolve11, 5));
+            }
+          }
+          if (!stamped) {
+            stampFailed = true;
+            throw new Error("failed to stamp session-registry lock owner");
+          }
           const raw = await fs12.readFile(this.filePath, "utf8").catch(() => "{}");
           const registry = parseRegistry(raw);
           fn(registry);
           await this.writeAtomicWithRetry(registry);
           return;
         } finally {
-          await lockHandle.close();
-          await fs12.unlink(lockPath).catch(() => void 0);
+          await lockHandle.close().catch(() => void 0);
+          if (stampFailed) {
+            await fs12.unlink(lockPath).catch(() => void 0);
+          } else {
+            await maybeUnlinkOwnedLock(lockPath);
+          }
         }
       } catch (err) {
         if (err instanceof SessionOwnershipConflictError) throw err;
@@ -11915,7 +12088,7 @@ async function mutateTasks(filePath, sessionId, fn, events, traceId) {
 
 // src/storage/director-state.ts
 import * as fsp21 from "node:fs/promises";
-import { hostname as hostname2 } from "node:os";
+import { hostname as hostname3 } from "node:os";
 async function loadDirectorState(filePath) {
   let raw;
   try {
@@ -11946,7 +12119,7 @@ async function acquireDirectorStateLock(lockPath, processId = process.pid) {
   }
   const lock = {
     pid: processId,
-    hostname: hostname2(),
+    hostname: hostname3(),
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   await atomicWrite(lockPath, JSON.stringify(lock), { mode: 384 });
@@ -13529,6 +13702,613 @@ function timeAgo(iso) {
   return `${days}d ago`;
 }
 
+// src/storage/cloud-config-sync.ts
+import { createHash as createHash9, randomUUID as nodeRandomUUID } from "node:crypto";
+import * as fs18 from "node:fs/promises";
+import * as path30 from "node:path";
+
+// src/storage/cloud-config-sync/sanitize.ts
+var SAGE_TREE = {
+  enabled: true,
+  storage: { projectLocal: true, directory: true },
+  inject: {
+    turnContext: true,
+    toolResults: true,
+    taskAware: true,
+    maxHintsPerTool: true,
+    maxCharsPerTool: true,
+    minScore: true,
+    repeatCooldownMs: true,
+    maxTurnMemories: true,
+    maxCharsPerTurn: true,
+    minImportance: true,
+    relationFloor: true
+  },
+  hygiene: {
+    autoAfterSession: true,
+    autoOnFileChange: true,
+    retentionDays: true,
+    archiveLowConfidenceAfterDays: true
+  },
+  embeddings: { enabled: true }
+};
+var CORE_RUNTIME_TREE = {
+  maxConcurrent: true,
+  context: {
+    mode: true,
+    autoCompact: true,
+    strategy: true,
+    warnThreshold: true,
+    softThreshold: true,
+    hardThreshold: true,
+    preserveK: true,
+    eliseThreshold: true,
+    targetLoad: true
+  },
+  tools: {
+    defaultExecutionStrategy: true,
+    maxIterations: true,
+    iterationTimeoutMs: true,
+    sessionTimeoutMs: true,
+    perIterationOutputCapBytes: true,
+    autoExtendLimit: true,
+    restrictToProjectRoot: true,
+    descriptionMode: true,
+    disabledTools: true,
+    maxToolTimeoutMs: true,
+    loopDetection: {
+      mode: true,
+      steerThreshold: true,
+      cutThreshold: true,
+      windowSize: true,
+      callRepeatThreshold: true
+    }
+  },
+  log: { level: true, format: true },
+  features: {
+    mcp: true,
+    plugins: true,
+    memory: true,
+    modelsRegistry: true,
+    skills: true,
+    prompts: true,
+    tokenSavingMode: true,
+    allowOutsideProjectRoot: true,
+    developerMode: true
+  },
+  session: { auditLevel: true, sampling: { toolProgress: { sampleRate: true } } },
+  indexing: { onSessionStart: true, onEdit: true, watchExternal: true, debounceMs: true },
+  circuitBreaker: { enabled: true, autoKillResetMs: true },
+  modelRuntime: {
+    reasoning: { mode: true, effort: true, preserve: true },
+    cache: { ttl: true }
+  },
+  systemPrompt: { variant: true },
+  skills: { readClaudeSkills: true },
+  Sage: SAGE_TREE,
+  fallbackAuto: true,
+  yolo: true,
+  nextPrediction: true,
+  hints: true,
+  debugStream: true
+};
+var UI_PREFERENCES_TREE = {
+  autonomy: {
+    defaultMode: true,
+    autoProceedDelayMs: true,
+    autoProceedMaxIterations: true,
+    autonomyNextPrompt: true,
+    terminalTitleAnimation: true,
+    yolo: true,
+    streamFleet: true,
+    chime: true,
+    confirmExit: true,
+    mouseMode: true,
+    enhance: true,
+    enhanceDelayMs: true,
+    enhanceCountdownMs: true,
+    enhanceLanguage: true,
+    statuslineMode: true,
+    thinkingWord: true,
+    midRunSendPicker: true,
+    animationStyle: true,
+    fleetChatVerbosity: true,
+    refinerFallbackProfile: true,
+    refinerProvider: true,
+    refinerModel: true,
+    showModelReasoning: true,
+    shellBangWarningDontShowAgain: true,
+    showAgentSwarmPanel: true,
+    showSageMemoryInject: true,
+    readAdvancedMode: true,
+    panelPositions: true
+  },
+  launch: { mode: true, autonomy: true },
+  uiLocale: true
+};
+var MODELS_ROUTING_TREE = {
+  provider: true,
+  model: true,
+  favoriteModels: true,
+  favoriteModelsOnly: true,
+  fallbackModels: true,
+  fallbackProfiles: true,
+  modelMatrix: { "*": { fallbackProfile: true } },
+  brain: {
+    mode: true,
+    maxAutoRisk: true,
+    models: true,
+    strategy: true,
+    decisionTimeoutMs: true,
+    humanTimeoutMs: true,
+    council: {
+      enabled: true,
+      minRisk: true,
+      voters: true
+    },
+    ledger: { enabled: true, autoDenyAfterFailures: true },
+    trace: { enabled: true }
+  }
+};
+var PROVIDERS_CATALOG_TREE = {
+  providers: {
+    "*": {
+      type: true,
+      family: true,
+      baseUrl: true,
+      envVars: true,
+      models: true,
+      activeKey: true
+    }
+  }
+};
+var MCP_SERVERS_TREE = {
+  mcpServers: {
+    "*": {
+      name: true,
+      transport: true,
+      command: true,
+      args: true,
+      url: true,
+      description: true,
+      permission: true,
+      enabled: true,
+      lazy: true,
+      envVars: true
+    }
+  }
+};
+var EXTENSIONS_PLUGINS_TREE = {
+  plugins: true,
+  extensions: true
+};
+var CLOUD_SYNC_CONTRACT = {
+  "core.runtime": CORE_RUNTIME_TREE,
+  "ui.preferences": UI_PREFERENCES_TREE,
+  "models.routing": MODELS_ROUTING_TREE,
+  "providers.catalog": PROVIDERS_CATALOG_TREE,
+  "mcp.servers": MCP_SERVERS_TREE,
+  "extensions.plugins": EXTENSIONS_PLUGINS_TREE
+};
+var CLOUD_SYNC_NAMESPACES = Object.keys(CLOUD_SYNC_CONTRACT);
+var NAMESPACE_SCHEMA_VERSIONS = {
+  "core.runtime": 1,
+  "ui.preferences": 1,
+  "models.routing": 1,
+  "providers.catalog": 1,
+  "mcp.servers": 2,
+  "extensions.plugins": 1
+};
+var LOCAL_ONLY_TOP_LEVEL = [
+  "version",
+  "configScope",
+  "hq",
+  "cloudSync",
+  "sync",
+  "models",
+  "apiKey",
+  "baseUrl"
+];
+var ENCRYPTED_VALUE = /enc:v\d+:/;
+var SECRET_KEY = /^(api[-_]?key|apikeys|.*token|secret.*|.*secret|password|passwd|credential.*|private[-_]?key|authorization)$/i;
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stripSecretMaterial(value) {
+  if (typeof value === "string") {
+    return ENCRYPTED_VALUE.test(value) ? void 0 : value;
+  }
+  if (Array.isArray(value)) {
+    const cleaned = value.map((entry) => stripSecretMaterial(entry));
+    return cleaned.filter((entry) => entry !== void 0);
+  }
+  if (isPlainObject(value)) {
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+      if (SECRET_KEY.test(key)) continue;
+      const cleaned = stripSecretMaterial(child);
+      if (cleaned !== void 0) out[key] = cleaned;
+    }
+    return out;
+  }
+  return value;
+}
+function project(value, tree) {
+  if (tree === true) return value;
+  if (!isPlainObject(value)) return void 0;
+  const wildcard = tree["*"];
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    const node = Object.hasOwn(tree, key) && key !== "*" ? tree[key] : wildcard;
+    if (node === void 0) continue;
+    const projected = project(child, node);
+    if (projected !== void 0) out[key] = projected;
+  }
+  return out;
+}
+function buildNamespacePayloads(config) {
+  const payloads = {};
+  for (const [namespace, tree] of Object.entries(CLOUD_SYNC_CONTRACT)) {
+    if (tree === true) continue;
+    const payload = {};
+    for (const [key, node] of Object.entries(tree)) {
+      if (!(key in config) || config[key] === void 0) continue;
+      const projected = project(config[key], node);
+      if (projected === void 0) continue;
+      const cleaned = stripSecretMaterial(projected);
+      if (cleaned === void 0) continue;
+      if (isPlainObject(cleaned) && Object.keys(cleaned).length === 0 && node !== true) continue;
+      payload[key] = cleaned;
+    }
+    if (Object.keys(payload).length > 0) payloads[namespace] = payload;
+  }
+  return payloads;
+}
+function reinjectLocalSecrets(local, incoming) {
+  if (!isPlainObject(local) || !isPlainObject(incoming)) return incoming;
+  const out = { ...incoming };
+  for (const [key, value] of Object.entries(local)) {
+    const secretish = SECRET_KEY.test(key) || typeof value === "string" && ENCRYPTED_VALUE.test(value);
+    if (secretish && !(key in incoming)) {
+      out[key] = value;
+      continue;
+    }
+    if (isPlainObject(value) && isPlainObject(incoming[key])) {
+      out[key] = reinjectLocalSecrets(value, incoming[key]);
+    }
+  }
+  return out;
+}
+function mergeAtContract(local, incoming, tree) {
+  if (tree === true) return reinjectLocalSecrets(local, incoming);
+  if (!isPlainObject(incoming)) return local;
+  const base = isPlainObject(local) ? { ...local } : {};
+  const wildcard = tree["*"];
+  for (const [key, child] of Object.entries(incoming)) {
+    const node = Object.hasOwn(tree, key) && key !== "*" ? tree[key] : wildcard;
+    if (node === void 0) continue;
+    base[key] = mergeAtContract(base[key], child, node);
+  }
+  return base;
+}
+function applyNamespacePayload(config, namespace, payload) {
+  const tree = CLOUD_SYNC_CONTRACT[namespace];
+  if (!tree || tree === true) return config;
+  const next = { ...config };
+  for (const [key, incoming] of Object.entries(payload)) {
+    const node = Object.hasOwn(tree, key) ? tree[key] : void 0;
+    if (node === void 0) continue;
+    next[key] = mergeAtContract(next[key], incoming, node);
+  }
+  return next;
+}
+
+// src/storage/cloud-config-sync.ts
+var EMPTY_STATE = {
+  version: 1,
+  cursor: 0,
+  namespaceRevisions: {},
+  syncedHashes: {},
+  syncedPayloads: {},
+  pendingMutations: {},
+  rejectedHashes: {}
+};
+function stableStringify3(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map((entry) => stableStringify3(entry)).join(",")}]`;
+  }
+  if (typeof value === "object" && value !== null) {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify3(v)}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+function hashPayload(payload) {
+  return createHash9("sha256").update(stableStringify3(payload)).digest("hex");
+}
+function deepEquals(a, b) {
+  return stableStringify3(a) === stableStringify3(b);
+}
+var CloudConfigSync = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.fetchImpl = deps.fetchImpl ?? fetch;
+    this.uuid = deps.randomUUID ?? (() => nodeRandomUUID());
+    this.timeoutMs = deps.requestTimeoutMs ?? 15e3;
+  }
+  deps;
+  state = null;
+  fetchImpl;
+  uuid;
+  timeoutMs;
+  /** One full pull-then-push-then-heartbeat pass. Never throws; failures are summarized. */
+  async syncOnce() {
+    const settings = this.deps.getSettings();
+    if (!settings?.enabled || !settings.url || !settings.token) {
+      return summary({ skipped: true, message: "Cloud sync is not configured." });
+    }
+    const state = await this.loadState();
+    const pulled = [];
+    const pushed = [];
+    const conflicted = [];
+    const rejected = [];
+    try {
+      await this.pullChanges(settings, state, pulled);
+      await this.pushDirty(settings, state, { pushed, conflicted, rejected });
+      await this.heartbeat(settings, state);
+      state.lastSyncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      await this.saveState(state);
+      return summary({
+        ok: true,
+        pulled,
+        pushed,
+        conflicted,
+        rejected,
+        message: pulled.length + pushed.length === 0 ? "Already in sync." : `Pulled ${pulled.length}, pushed ${pushed.length} namespace(s).`
+      });
+    } catch (error) {
+      await this.saveState(state).catch(() => {
+      });
+      const message = error instanceof Error ? error.message : String(error);
+      this.deps.logger?.warn(`cloud-config-sync: pass failed: ${message}`);
+      return summary({ pulled, pushed, conflicted, rejected, message });
+    }
+  }
+  /** Human-readable status for the slash command. */
+  async statusText() {
+    const settings = this.deps.getSettings();
+    if (!settings?.enabled) {
+      return "Cloud config sync: disabled. Run `/cloudsync on` after setting url + token.";
+    }
+    const state = await this.loadState();
+    const dirty = await this.dirtyNamespaces(state);
+    const rejectedList = Object.keys(state.rejectedHashes);
+    const lines = [
+      "Cloud config sync: enabled",
+      `  url:        ${settings.url}`,
+      `  cursor:     ${state.cursor}`,
+      `  last sync:  ${state.lastSyncedAt ?? "never"}`,
+      `  dirty:      ${dirty.length > 0 ? dirty.join(", ") : "none"}`
+    ];
+    if (rejectedList.length > 0) {
+      lines.push(`  rejected:   ${rejectedList.join(", ")} (kept local; edit to retry)`);
+    }
+    return lines.join("\n");
+  }
+  // ── Pull ────────────────────────────────────────────────────────────────
+  async pullChanges(settings, state, pulled) {
+    const delta = (await this.request(settings, "GET", `/api/sync/v1/config?since=${state.cursor}`)).json;
+    const toRead = delta.full ? CLOUD_SYNC_NAMESPACES.map((namespace) => ({ namespace })) : delta.changed.filter(
+      (entry) => CLOUD_SYNC_NAMESPACES.includes(entry.namespace) && entry.revision > (state.namespaceRevisions[entry.namespace] ?? 0)
+    );
+    const dirtyBefore = new Set(await this.dirtyNamespaces(state));
+    for (const entry of toRead) {
+      const snapshot = (await this.request(
+        settings,
+        "GET",
+        `/api/sync/v1/config/${encodeURIComponent(entry.namespace)}`
+      )).json;
+      if ((state.namespaceRevisions[entry.namespace] ?? 0) >= snapshot.revision) continue;
+      if (snapshot.revision === 0) {
+        state.namespaceRevisions[entry.namespace] = 0;
+        continue;
+      }
+      if (dirtyBefore.has(entry.namespace)) {
+        const local = await this.deps.readLocalConfig();
+        const localPayload = buildNamespacePayloads(local)[entry.namespace] ?? {};
+        const base = state.syncedPayloads[entry.namespace] ?? {};
+        const merged = { ...snapshot.payload };
+        for (const [key, localValue] of Object.entries(localPayload)) {
+          if (!deepEquals(localValue, base[key])) merged[key] = localValue;
+        }
+        await this.deps.writeLocalConfig(
+          (config) => applyNamespacePayload(config, entry.namespace, merged)
+        );
+        state.namespaceRevisions[entry.namespace] = snapshot.revision;
+        state.syncedPayloads[entry.namespace] = snapshot.payload;
+      } else {
+        await this.applySnapshot(entry.namespace, snapshot, state);
+      }
+      pulled.push(entry.namespace);
+    }
+    state.cursor = Math.max(state.cursor, delta.cursor);
+  }
+  async applySnapshot(namespace, snapshot, state) {
+    await this.deps.writeLocalConfig(
+      (config) => applyNamespacePayload(config, namespace, snapshot.payload)
+    );
+    state.namespaceRevisions[namespace] = snapshot.revision;
+    state.syncedPayloads[namespace] = snapshot.payload;
+    const local = await this.deps.readLocalConfig();
+    const projected = buildNamespacePayloads(local)[namespace] ?? {};
+    state.syncedHashes[namespace] = hashPayload(projected);
+    delete state.pendingMutations[namespace];
+    delete state.rejectedHashes[namespace];
+  }
+  // ── Push ────────────────────────────────────────────────────────────────
+  async dirtyNamespaces(state) {
+    const local = await this.deps.readLocalConfig();
+    const payloads = buildNamespacePayloads(local);
+    return Object.entries(payloads).filter(([namespace, payload]) => hashPayload(payload) !== state.syncedHashes[namespace]).map(([namespace]) => namespace);
+  }
+  async pushDirty(settings, state, out) {
+    const local = await this.deps.readLocalConfig();
+    const payloads = buildNamespacePayloads(local);
+    for (const [namespace, payload] of Object.entries(payloads)) {
+      const hash = hashPayload(payload);
+      if (hash === state.syncedHashes[namespace]) continue;
+      if (state.rejectedHashes[namespace] === hash) continue;
+      const pending = state.pendingMutations[namespace];
+      const mutationId = pending?.hash === hash ? pending.mutationId : this.uuid();
+      state.pendingMutations[namespace] = { mutationId, hash };
+      await this.saveState(state);
+      const result = await this.putNamespace(settings, state, namespace, payload, mutationId);
+      if (result.kind === "applied") {
+        out.pushed.push(namespace);
+      } else if (result.kind === "conflict") {
+        out.conflicted.push(namespace);
+        await this.resolveConflict(settings, state, namespace, payload, result.server, out);
+      } else {
+        state.rejectedHashes[namespace] = hash;
+        delete state.pendingMutations[namespace];
+        out.rejected.push(namespace);
+        this.deps.logger?.warn(
+          `cloud-config-sync: server rejected ${namespace} (${result.code}); keeping it local until the config changes.`
+        );
+      }
+    }
+  }
+  async putNamespace(settings, state, namespace, payload, mutationId) {
+    const response = await this.request(
+      settings,
+      "PUT",
+      `/api/sync/v1/config/${encodeURIComponent(namespace)}`,
+      {
+        baseRevision: state.namespaceRevisions[namespace] ?? 0,
+        mutationId,
+        schemaVersion: NAMESPACE_SCHEMA_VERSIONS[namespace] ?? 1,
+        payload
+      },
+      // 409 (conflict) and 422 (contract mismatch) are protocol answers, not failures.
+      [409, 422]
+    );
+    if (response.status === 422) {
+      const code = response.json.error?.code;
+      return { kind: "rejected", code: code ?? "invalid_payload" };
+    }
+    const body = response.json;
+    if (response.status === 409) {
+      return { kind: "conflict", server: body };
+    }
+    state.namespaceRevisions[namespace] = body.revision;
+    state.syncedHashes[namespace] = hashPayload(payload);
+    state.syncedPayloads[namespace] = payload;
+    if (typeof body.cursor === "number") state.cursor = Math.max(state.cursor, body.cursor);
+    delete state.pendingMutations[namespace];
+    delete state.rejectedHashes[namespace];
+    return { kind: "applied" };
+  }
+  /**
+   * Three-way merge at owned-top-level-key granularity: keys unchanged locally since the
+   * last sync adopt the server value; locally-changed keys win and are re-pushed on top
+   * of the server revision with a fresh mutation id.
+   */
+  async resolveConflict(settings, state, namespace, localPayload, server, out) {
+    const base = state.syncedPayloads[namespace] ?? {};
+    const merged = { ...server.payload };
+    for (const [key, localValue] of Object.entries(localPayload)) {
+      if (!deepEquals(localValue, base[key])) merged[key] = localValue;
+    }
+    await this.deps.writeLocalConfig((config) => applyNamespacePayload(config, namespace, merged));
+    state.namespaceRevisions[namespace] = server.revision;
+    const mutationId = this.uuid();
+    const hash = hashPayload(merged);
+    state.pendingMutations[namespace] = { mutationId, hash };
+    await this.saveState(state);
+    const result = await this.putNamespace(settings, state, namespace, merged, mutationId);
+    if (result.kind === "applied") {
+      out.pushed.push(namespace);
+    } else {
+      this.deps.logger?.warn(
+        `cloud-config-sync: conflict resolution for ${namespace} did not converge (${result.kind}); will retry next pass.`
+      );
+    }
+  }
+  // ── Heartbeat ───────────────────────────────────────────────────────────
+  async heartbeat(settings, state) {
+    await this.request(settings, "POST", "/api/sync/v1/heartbeat", {
+      transport: "poll",
+      syncCursor: state.cursor,
+      namespaceRevisions: state.namespaceRevisions
+    }).catch((error) => {
+      const message = error instanceof Error ? error.message : String(error);
+      this.deps.logger?.warn(`cloud-config-sync: heartbeat failed: ${message}`);
+    });
+  }
+  // ── HTTP + state plumbing ───────────────────────────────────────────────
+  async request(settings, method, pathname, body, acceptStatuses = []) {
+    const url = `${settings.url.replace(/\/+$/, "")}${pathname}`;
+    const headers = {
+      Authorization: `Bearer ${settings.token}`,
+      "X-WrongStack-Version": this.deps.appVersion ?? "unknown"
+    };
+    if (body !== void 0) headers["Content-Type"] = "application/json";
+    const init = {
+      method,
+      headers,
+      signal: AbortSignal.timeout(this.timeoutMs)
+    };
+    if (body !== void 0) init.body = JSON.stringify(body);
+    const response = await this.fetchImpl(url, init);
+    const ok = response.ok || acceptStatuses.includes(response.status);
+    if (!ok) {
+      if (response.status === 401) {
+        throw new Error("unauthorized: the machine token is invalid, expired, or revoked.");
+      }
+      if (response.status === 429) {
+        throw new Error("rate limited by the portal; backing off until the next pass.");
+      }
+      throw new Error(`${method} ${pathname} failed with HTTP ${response.status}.`);
+    }
+    const json = response.status === 204 ? null : await response.json().catch(() => null);
+    return { status: response.status, json };
+  }
+  async loadState() {
+    if (this.state) return this.state;
+    try {
+      const raw = await fs18.readFile(this.deps.statePath, "utf8");
+      const parsed = JSON.parse(raw);
+      this.state = {
+        ...structuredClone(EMPTY_STATE),
+        ...parsed,
+        version: 1
+      };
+    } catch {
+      this.state = structuredClone(EMPTY_STATE);
+    }
+    return this.state;
+  }
+  async saveState(state) {
+    this.state = state;
+    await fs18.mkdir(path30.dirname(this.deps.statePath), { recursive: true });
+    await atomicWrite(this.deps.statePath, `${JSON.stringify(state, null, 2)}
+`, {
+      mode: 384
+    });
+  }
+};
+function summary(partial) {
+  return {
+    ok: partial.ok ?? false,
+    skipped: partial.skipped ?? false,
+    pulled: partial.pulled ?? [],
+    pushed: partial.pushed ?? [],
+    conflicted: partial.conflicted ?? [],
+    rejected: partial.rejected ?? [],
+    message: partial.message
+  };
+}
+
 // src/storage/session-event-bridge.ts
 var CORE_RECONSTRUCT_EVENTS = /* @__PURE__ */ new Set([
   "session_start",
@@ -13669,8 +14449,11 @@ export {
   ALL_SYNC_CATEGORIES,
   AgentStatusTracker,
   AnnotationsStore,
+  CLOUD_SYNC_CONTRACT,
+  CLOUD_SYNC_NAMESPACES,
   CONFIG_BEHAVIOR_DEFAULTS,
   CORE_RECONSTRUCT_EVENTS,
+  CloudConfigSync,
   CloudSync,
   ConfigMigrationError,
   DEFAULT_CONFIG_MIGRATIONS,
@@ -13687,8 +14470,10 @@ export {
   GraphMemoryBackend,
   INPUT_HISTORY_DEFAULT_MAX,
   InputHistoryStore,
+  LOCAL_ONLY_TOP_LEVEL,
   MAX_JOURNAL_ENTRIES,
   MAX_PROGRESS_HISTORY,
+  NAMESPACE_SCHEMA_VERSIONS,
   PromptUsageStore,
   QUEUE_MAX_BYTES,
   QUEUE_MAX_ITEMS,
@@ -13706,9 +14491,11 @@ export {
   addPlanItem,
   appendJournal,
   applyGoalDeliverableCompletions,
+  applyNamespacePayload,
   applyRewindToConversation,
   attachPlanCheckpoint,
   attachTodosCheckpoint,
+  buildNamespacePayloads,
   clearPlan,
   coordinateGoalIteration,
   createGoalKanbanBoard,
@@ -13770,6 +14557,7 @@ export {
   setPlanItemStatus,
   setProgress,
   stripGoalDeliverableMarker,
+  stripSecretMaterial,
   summarizeUsage,
   watchProviderConfig
 };