@wrongstack/core 0.302.0 → 0.303.0

package/dist/security/index.js

@@ -1298,11 +1298,13 @@ function windowsAccountName() {
 import { realpath } from "node:fs/promises";
 import * as path2 from "node:path";
 import {
+  evaluateContractGraphReadiness,
   evaluateKanbanBoundaryOpaque,
   evaluateKanbanBoundaryPath,
   readBoard,
   resolveKanbanBoundaryLayers
 } from "@wrongstack/kanban";
+var GOVERNANCE_CONTROL_TOOLS = /* @__PURE__ */ new Set(["kanban", "plan", "task", "todo"]);
 var PATH_KEYS2 = /* @__PURE__ */ new Set([
   "path",
   "paths",
@@ -1327,12 +1329,60 @@ var TOOL_PATH_KEYS = {
   // filesystem target in language_info. Keep ambiguous names tool-specific.
   language_info: ["target"]
 };
-async function evaluateToolKanbanBoundary(tool, input, ctx) {
+async function evaluateToolKanbanBoundary(tool, input, ctx, options = {}) {
+  if (tool.name === "kanban") return { decision: "allow" };
   const identity = resolveKanbanIdentity(ctx);
-  if (!identity.boardId) return { decision: "allow" };
+  const governanceRequired = options.requireGovernance && isGovernedMutation(tool, input);
+  if (!identity.boardId) {
+    return governanceRequired ? {
+      decision: "block",
+      reason: "Kanban governance is mandatory before product mutation. Create a managed card, add its required details and executable acceptance criteria, then call kanban start_task to bind it to this run."
+    } : { decision: "allow" };
+  }
   const board = await readBoard(identity.policyRoot ?? ctx.projectRoot, identity.boardId);
-  if (!board) return { decision: "allow" };
+  if (!board) {
+    return governanceRequired ? {
+      decision: "block",
+      reason: `Active Kanban board not found: ${identity.boardId}. Recreate or select a valid managed card before mutation.`,
+      boardId: identity.boardId,
+      ...identity.taskId ? { taskId: identity.taskId } : {}
+    } : { decision: "allow" };
+  }
   const task = identity.taskId ? board.tasks.find((candidate) => candidate.id === identity.taskId) : void 0;
+  if (governanceRequired) {
+    if (!identity.taskId) {
+      return {
+        decision: "block",
+        reason: "Kanban governance requires an active task, not only a board. Complete the card details and call kanban start_task before mutation.",
+        boardId: board.id
+      };
+    }
+    if (!task) {
+      return {
+        decision: "block",
+        reason: `Active Kanban task not found: ${identity.taskId}. Call kanban start_task with a valid card.`,
+        boardId: board.id,
+        taskId: identity.taskId
+      };
+    }
+    const readiness = evaluateContractGraphReadiness(board, task.id);
+    if (!readiness.ready) {
+      return {
+        decision: "block",
+        reason: "Active card is not implementation-ready: " + readiness.issues.map((issue) => issue.message).join(" | "),
+        boardId: board.id,
+        taskId: task.id
+      };
+    }
+    if (task.lifecycle?.currentStage !== "running" || task.assignment?.status !== "running") {
+      return {
+        decision: "block",
+        reason: "Active card must be in Running with a live assignment before product mutation. Call kanban start_task after completing the required card details.",
+        boardId: board.id,
+        taskId: task.id
+      };
+    }
+  }
   if (identity.leaseId && task?.assignment) {
     const caps2 = tool.capabilities ?? [];
     const isWrite = caps2.includes("fs.write") || caps2.includes("fs.write.outside-project") || caps2.some((c) => c.startsWith("shell."));
@@ -1368,6 +1418,19 @@ async function evaluateToolKanbanBoundary(tool, input, ctx) {
     ...task ? { taskId: task.id } : {}
   };
 }
+function isGovernedMutation(tool, input) {
+  if (!tool.mutating || GOVERNANCE_CONTROL_TOOLS.has(tool.name)) return false;
+  if (tool.capabilities?.includes("tool.meta")) return false;
+  if (tool.name === "git") {
+    const command = input["command"];
+    if (command === "status" || command === "log" || command === "diff") return false;
+    if (command === "worktree" && input["worktreeAction"] === "list") return false;
+  }
+  const capabilities = tool.capabilities ?? [];
+  return capabilities.some(
+    (capability) => capability === "fs.write" || capability === "fs.write.outside-project" || capability === "package.install" || capability === "tool.mutate.any" || capability.startsWith("shell.") || capability === "net.outbound"
+  );
+}
 function resolveKanbanIdentity(ctx) {
   const metaKanban = ctx.meta["kanban"];
   const record = metaKanban && typeof metaKanban === "object" ? metaKanban : void 0;
@@ -1685,6 +1748,9 @@ function subjectForToolInput(toolName, input, subjectKey) {
   const obj = input;
   if (subjectKey) {
     const value = obj[subjectKey];
+    if (Array.isArray(value)) {
+      return escapeGlobSubject(JSON.stringify(value));
+    }
     if (typeof value === "string") {
       if (isPathSubjectKey(subjectKey)) {
         const normalized = normalizePathSubject(value);

package/dist/security/kanban-boundary.d.ts

@@ -5,6 +5,10 @@ export interface ToolKanbanBoundaryEvaluation extends KanbanBoundaryEvaluation {
     boardId?: string | undefined;
     taskId?: string | undefined;
 }
+export interface ToolKanbanGovernanceOptions {
+    /** Require every product mutation to run inside a ready, running Kanban card. */
+    requireGovernance?: boolean | undefined;
+}
 /** Resolve the live board/task policy and gate one tool invocation. */
-export declare function evaluateToolKanbanBoundary(tool: Tool, input: Record<string, unknown>, ctx: Context): Promise<ToolKanbanBoundaryEvaluation>;
+export declare function evaluateToolKanbanBoundary(tool: Tool, input: Record<string, unknown>, ctx: Context, options?: ToolKanbanGovernanceOptions): Promise<ToolKanbanBoundaryEvaluation>;
 //# sourceMappingURL=kanban-boundary.d.ts.map

package/dist/session-catalog/client.d.ts

@@ -0,0 +1,62 @@
+import { type SessionCatalogEvent, type SessionCatalogOperationName, type SessionCatalogOperations } from './protocol.js';
+export interface SessionCatalogProjectClientOptions {
+    projectDir: string;
+    projectRoot: string;
+}
+export type SessionCatalogDaemonAvailability = {
+    kind: 'available';
+    url: URL;
+} | {
+    kind: 'inline-requested';
+} | {
+    kind: 'missing-build';
+};
+export declare function resolveSessionCatalogDaemonAvailability(moduleUrl?: string, exists?: (filePath: string) => boolean): SessionCatalogDaemonAvailability;
+export declare function resolveSessionCatalogProjectServerUrl(moduleUrl?: string, exists?: (filePath: string) => boolean): URL | null;
+export declare class SessionCatalogProjectClient {
+    readonly options: SessionCatalogProjectClientOptions;
+    readonly endpoint: string;
+    private socket;
+    private info;
+    private buffer;
+    private connecting;
+    private connectResolve;
+    private connectReject;
+    private authToken;
+    private nextId;
+    private readonly pending;
+    private readonly eventListeners;
+    private reconnectTimer;
+    private explicitlyClosed;
+    constructor(options: SessionCatalogProjectClientOptions);
+    call<O extends SessionCatalogOperationName>(op: O, args: SessionCatalogOperations[O]['args'], options?: {
+        timeoutMs?: number;
+    }): Promise<SessionCatalogOperations[O]['result']>;
+    /**
+     * Call an already-running project daemon without starting one.
+     *
+     * Cross-project discovery must use this path: observing another project is
+     * never sufficient authority to wake that project's IPC owner.
+     */
+    callExisting<O extends SessionCatalogOperationName>(op: O, args: SessionCatalogOperations[O]['args'], options?: {
+        timeoutMs?: number;
+    }): Promise<SessionCatalogOperations[O]['result']>;
+    ping(): Promise<SessionCatalogOperations['ping']['result']>;
+    subscribe(listener: (event: SessionCatalogEvent) => void): Promise<() => Promise<void>>;
+    shutdown(reason?: string): Promise<{
+        stopped: boolean;
+        pid?: number;
+    }>;
+    close(): Promise<void>;
+    private ensureConnected;
+    private connectWithElection;
+    private connectOnce;
+    private currentAuthToken;
+    private request;
+    private onData;
+    private onMessage;
+    private onClose;
+    private scheduleSubscriptionReconnect;
+    private spawnDetached;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/session-catalog/endpoint.d.ts

@@ -0,0 +1,6 @@
+export declare const SESSION_CATALOG_METADATA_FILE = ".session-catalog-server.json";
+export declare function sessionCatalogProjectServerKey(projectDir: string): string;
+export declare function sessionCatalogProjectServerEndpoint(projectDir: string): string;
+export declare function sessionCatalogProjectServerMetadataPath(projectDir: string): string;
+export declare function ensureSessionCatalogSocketDirectory(endpoint: string): void;
+//# sourceMappingURL=endpoint.d.ts.map

package/dist/session-catalog/index.d.ts

@@ -0,0 +1,6 @@
+export * from './client.js';
+export * from './endpoint.js';
+export * from './protocol.js';
+export * from './registry.js';
+export * from './store.js';
+//# sourceMappingURL=index.d.ts.map