@wrongstack/core 0.303.0 → 0.305.1

package/dist/plugin/index.js

@@ -2443,12 +2443,97 @@ var FallbackProfileManager = class {
     return this.resolveRefs([ref], exclude);
   }
   /**
-   * Resolve every usable configured target as an uncapped last-resort chain.
+   * Resolve every usable configured target as a bounded last-resort chain.
    * Normal smart defaults stay bounded; callers append this only after the
-   * preferred chain and only when automatic fallback is enabled.
+   * preferred chain and only when automatic fallback is enabled. The cap
+   * ({@link MAX_LAST_RESORT_CANDIDATES}) prevents a config with many providers
+   * from producing a degenerate chain of doomed requests during a systemic
+   * outage — by this point the smart default, bridge, and default profile
+   * have already failed.
    */
   resolveAllConfigured(exclude) {
-    return this.smartDefault(exclude, Number.POSITIVE_INFINITY);
+    return this.smartDefault(exclude, this.lastResortCap());
+  }
+  /**
+   * Effective cap for the last-resort append. Reads the user-configurable
+   * {@link Config.fallbackMaxLastResortCandidates} when set and valid;
+   * otherwise falls back to the compiled-in default
+   * {@link MAX_LAST_RESORT_CANDIDATES}.
+   */
+  lastResortCap() {
+    const configured = this.config.fallbackMaxLastResortCandidates;
+    if (typeof configured === "number" && Number.isFinite(configured) && configured >= 0) {
+      return Math.floor(configured);
+    }
+    return MAX_LAST_RESORT_CANDIDATES;
+  }
+  /**
+   * Build the complete fallback candidate chain shared by the agent-loop
+   * extension and the one-shot orchestrator. Centralizes the bridge → primary →
+   * selected → default-profile → all-configured ladder and the fromExplicitSource
+   * gate so both consumers produce identical ordering and depth semantics.
+   *
+   * Layering (each step deduped against all prior):
+   *  1. Bridge (emergency continuity route).
+   *  2. Configured primary, when the live context drifted from it.
+   *  3. The selected chain (explicit refs → named profile → smart default),
+   *     via {@link resolveEffective}.
+   *  4. The "default" profile — extra depth, ONLY when the chain was auto-derived.
+   *  5. Every other configured provider — last resort, ONLY when the chain was
+   *     auto-derived AND `effectiveFallbackAuto` is true.
+   *
+   * Returns the empty chain when `closedWorld` is true and no explicit
+   * refs/profile resolved — a model allowlist never leaks to unlisted models.
+   *
+   * @internal caller-aware options (primary, closedWorld) are accepted because
+   *   the agent loop has context the manager does not own; the resolution
+   *   pipeline itself is identical for both callers.
+   */
+  resolveCandidates(current, opts = {}) {
+    const configuredPrimary = opts.primary ?? {
+      providerId: this.config.provider,
+      model: this.config.model
+    };
+    const configFallbackAuto = this.config.fallbackAuto;
+    const effectiveFallbackAuto = configFallbackAuto !== void 0 && configFallbackAuto !== null ? configFallbackAuto : !opts.closedWorld;
+    const explicitRefs = opts.fallbackModels ?? this.config.fallbackModels;
+    const explicitUsable = explicitRefs !== void 0 && explicitRefs.length > 0 && this.resolveRefs(explicitRefs, current).length > 0;
+    const profileUsable = opts.fallbackProfile !== void 0 && this.hasProfile(opts.fallbackProfile) && this.resolve(opts.fallbackProfile, { exclude: current }).length > 0;
+    const fromExplicitSource = explicitUsable || profileUsable;
+    const selectedChain = opts.closedWorld ? explicitRefs && explicitRefs.length > 0 ? this.resolveRefs(explicitRefs, current) : opts.fallbackProfile ? this.resolve(opts.fallbackProfile, { exclude: current }) : FREEZER_EMPTY : this.resolveEffective({
+      fallbackModels: explicitRefs,
+      fallbackProfile: opts.fallbackProfile,
+      fallbackAuto: effectiveFallbackAuto,
+      exclude: current
+    });
+    const candidates = [];
+    if (opts.closedWorld) {
+      candidates.push(...selectedChain);
+    } else {
+      candidates.push(...this.resolveBridge(current));
+      if (!(configuredPrimary.providerId === current.providerId && configuredPrimary.model === current.model)) {
+        candidates.push({
+          providerId: configuredPrimary.providerId,
+          model: configuredPrimary.model,
+          providerSwitched: configuredPrimary.providerId !== current.providerId
+        });
+      }
+      candidates.push(...selectedChain);
+      if (!fromExplicitSource && effectiveFallbackAuto && opts.fallbackProfile !== "default") {
+        candidates.push(...this.resolve("default", { exclude: current }));
+      }
+      if (!fromExplicitSource && effectiveFallbackAuto) {
+        const cap = this.lastResortCap();
+        if (cap > 0) {
+          const usedKeys = new Set(
+            candidates.map((c) => `${c.providerId}/${c.model}`)
+          );
+          const lastResort = this.smartDefault(current, Number.POSITIVE_INFINITY).filter((c) => !usedKeys.has(`${c.providerId}/${c.model}`)).slice(0, cap);
+          candidates.push(...lastResort);
+        }
+      }
+    }
+    return dedupeChain(candidates, current);
   }
   // ── Provider availability (read-only) ──────────────────────────────────
   checkProvider(providerId) {
@@ -2572,7 +2657,20 @@ var FallbackProfileManager = class {
     );
   }
 };
+var MAX_LAST_RESORT_CANDIDATES = 12;
 var FREEZER_EMPTY = Object.freeze([]);
+function dedupeChain(entries, current) {
+  const seen = /* @__PURE__ */ new Set();
+  const currentKey = `${current.providerId}/${current.model}`;
+  return Object.freeze(
+    entries.filter((entry) => {
+      const key = `${entry.providerId}/${entry.model}`;
+      if (key === currentKey || seen.has(key)) return false;
+      seen.add(key);
+      return true;
+    })
+  );
+}
 
 // src/plugins/auto-review-plugin.ts
 init_error();

package/dist/registry/index.js

@@ -759,6 +759,17 @@ var ToolRegistry = class _ToolRegistry {
     this._providerListSnapshotVersion = this._version;
     return arr;
   }
+  /**
+   * Whether an enabled catalog tool is part of the direct provider surface.
+   *
+   * This is intentionally different from `get()`/`list()`: a tool can remain
+   * executable through a lazy gateway while its schema is omitted from the
+   * next provider request. Disabled and unknown tools always return false.
+   */
+  isExposedToProvider(name) {
+    if (this._disabled.has(name) || !this.tools.has(name)) return false;
+    return this._providerToolNames?.has(name) ?? true;
+  }
   /**
    * Group tools by their `category` field. Tools without a category
    * are placed under the key `""` (empty string). Returns a Map of

package/dist/registry/tool-registry.d.ts

@@ -149,6 +149,14 @@ export declare class ToolRegistry {
     exposeToProvider(names: string | readonly string[]): void;
     /** Tools serialized into provider requests and described by the system prompt. */
     listForProvider(): Tool[];
+    /**
+     * Whether an enabled catalog tool is part of the direct provider surface.
+     *
+     * This is intentionally different from `get()`/`list()`: a tool can remain
+     * executable through a lazy gateway while its schema is omitted from the
+     * next provider request. Disabled and unknown tools always return false.
+     */
+    isExposedToProvider(name: string): boolean;
     /**
      * Group tools by their `category` field. Tools without a category
      * are placed under the key `""` (empty string). Returns a Map of

package/dist/replay/hash.d.ts

@@ -17,6 +17,15 @@ import type { Request } from '../types/provider.js';
  *     sampling knobs (`temperature`, `topP`, `stopSequences`,
  *     `toolChoice`). Anything else on the `Request` (metadata,
  *     future extensions) is ignored so replay stays forward-compat.
+ *   - The same rule applies *inside* each message. `Request.messages`
+ *     is the live `ctx.messages` array, whose entries carry local
+ *     bookkeeping the provider adapters explicitly drop: `ts` (wall
+ *     clock at the moment the turn was created), `_estTokens` (a
+ *     mutation-time cache) and `origin`. Hashing those made every
+ *     hash a function of when the run happened, so a recorded
+ *     response could never be found again and `mode: 'replay'` threw
+ *     on the first call it was asked to serve. See
+ *     {@link semanticMessage}.
  *   - We serialize to JSON. The `ContentBlock` and `Message` shapes
  *     are pure data; this works as long as no `undefined` values
  *     sneak in (those get dropped by `JSON.stringify`, which is

package/dist/replay/index.js

@@ -15,11 +15,15 @@ function sortKeys(value) {
   }
   return value;
 }
+function semanticMessage(message) {
+  const { ts: _ts, _estTokens: _estimate, origin: _origin, ...semantic } = message;
+  return semantic;
+}
 function hashRequest(request) {
   const payload = {
     model: request.model,
     system: request.system,
-    messages: request.messages,
+    messages: request.messages.map(semanticMessage),
     tools: request.tools,
     maxTokens: request.maxTokens,
     temperature: request.temperature,
@@ -40,16 +44,22 @@ var ReplayProviderRunner = class {
   }
   inner;
   opts;
+  /** Resolve the target session for this call. See {@link ReplayProviderRunnerOptions.sessionId}. */
+  resolveSessionId() {
+    const { sessionId } = this.opts;
+    return typeof sessionId === "function" ? sessionId() : sessionId;
+  }
   async run(runOpts) {
     const hash = hashRequest(runOpts.request);
-    const cached = await this.opts.log.lookup(this.opts.sessionId, hash);
+    const sessionId = this.resolveSessionId();
+    const cached = await this.opts.log.lookup(sessionId, hash);
     if (this.opts.mode === "replay") {
       if (!cached) {
         this.opts.logger?.warn?.(
           `replay: no recorded response for hash ${hash} (model ${runOpts.request.model})`
         );
         throw new Error(
-          `ReplayProviderRunner: no recorded response for hash ${hash} in session ${this.opts.sessionId}. Either the request changed since recording, or this session has no replay log.`
+          `ReplayProviderRunner: no recorded response for hash ${hash} in session ${sessionId}. Either the request changed since recording, or this session has no replay log.`
         );
       }
       this.opts.logger?.debug?.(
@@ -65,7 +75,7 @@ var ReplayProviderRunner = class {
     }
     const response = await this.inner.run(runOpts);
     await this.opts.log.record({
-      sessionId: this.opts.sessionId,
+      sessionId,
       request: runOpts.request,
       response
     });

package/dist/replay/replay-provider-runner.d.ts

@@ -26,11 +26,39 @@ import type { Response } from '../types/provider.js';
  *     a particular request is seen, it's recorded; the next time
  *     the same request is made, the recorded response is served.
  *     This is the cheapest path to a deterministic test harness.
+ *
+ * ## What a hit requires
+ *
+ * The lookup key is `hashRequest`, which covers everything the provider is
+ * actually sent — including `system`. The agent loop appends volatile blocks
+ * to the system prompt on every request (the continuity ledger, the live
+ * next-steps gate, memory evidence; see `agent-response.ts`), and those blocks
+ * describe the state of *this* run. A re-run whose ledger or retrieved memory
+ * differs therefore produces a different request, and correctly misses: the
+ * recorded response answered a different prompt.
+ *
+ * So `mode: 'replay'` reproduces a run faithfully only when the loop is driven
+ * back through the same states — which is what a test harness does, and what a
+ * fresh interactive session does not. In an interactive session, prefer
+ * `'record'` (build the log) and use `'replay'` from a harness that pins the
+ * volatile inputs. `hashRequest` itself is stable across time: local message
+ * bookkeeping (`ts`, `_estTokens`, `origin`) is stripped before hashing.
  */
 export type ReplayMode = 'record' | 'replay' | 'auto';
 export interface ReplayProviderRunnerOptions {
     log: ReplayLogStore;
-    sessionId: string;
+    /**
+     * Which session's log to read and write.
+     *
+     * Accepts a resolver because recording is wired before the session exists:
+     * the boot path binds this runner while the session writer is still being
+     * created, and the user may then swap sessions (`/resume`, new session)
+     * without the runner being rebuilt. A frozen string there meant the log was
+     * filed under a synthetic id with no session behind it. A resolver keeps the
+     * log next to the transcript it belongs to, for the session that is actually
+     * live at the time of the call.
+     */
+    sessionId: string | (() => string);
     mode: ReplayMode;
     /**
      * Optional logger — receives a debug line on every replay hit
@@ -48,6 +76,8 @@ export declare class ReplayProviderRunner implements ProviderRunner {
     private readonly inner;
     private readonly opts;
     constructor(inner: ProviderRunner, opts: ReplayProviderRunnerOptions);
+    /** Resolve the target session for this call. See {@link ReplayProviderRunnerOptions.sessionId}. */
+    private resolveSessionId;
     run(runOpts: RunProviderOptions): Promise<Response>;
 }
 //# sourceMappingURL=replay-provider-runner.d.ts.map

package/dist/security/index.js

@@ -1349,7 +1349,7 @@ async function evaluateToolKanbanBoundary(tool, input, ctx, options = {}) {
     } : { decision: "allow" };
   }
   const task = identity.taskId ? board.tasks.find((candidate) => candidate.id === identity.taskId) : void 0;
-  if (governanceRequired) {
+  if (governanceRequired && board.lifecycle?.mode === "managed") {
     if (!identity.taskId) {
       return {
         decision: "block",
@@ -1375,9 +1375,11 @@ async function evaluateToolKanbanBoundary(tool, input, ctx, options = {}) {
       };
     }
     if (task.lifecycle?.currentStage !== "running" || task.assignment?.status !== "running") {
+      const lifecycleStage = task.lifecycle?.currentStage ?? "missing";
+      const assignmentStatus = task.assignment?.status ?? "missing";
       return {
         decision: "block",
-        reason: "Active card must be in Running with a live assignment before product mutation. Call kanban start_task after completing the required card details.",
+        reason: `Active card must be in Running with a live assignment before product mutation (lifecycle: ${lifecycleStage}; assignment: ${assignmentStatus}). Call kanban start_task after completing the required card details.`,
         boardId: board.id,
         taskId: task.id
       };
@@ -3607,23 +3609,21 @@ function unwrapDataKey(buf, keyFile) {
     });
   }
 }
-function checkKeyFilePermissions(keyFile, opts) {
-  if (process.platform === "win32") return;
+function keyFileNeedsHardening(keyFile, opts) {
+  if (process.platform === "win32") return false;
   const warn = opts?.warn ?? ((msg) => console.warn(msg));
   try {
     const stat = fs2.statSync(keyFile);
     const actualMode = stat.mode & 511;
     if (actualMode !== KEY_FILE_MODE) {
-      void restrictFilePermissions(keyFile, {
-        label: "secret-vault",
-        warn
-      }).catch(() => void 0);
       warn(
         `Key file ${keyFile} has mode ${actualMode.toString(8)} \u2014 expected ${KEY_FILE_MODE.toString(8)}. Hardening\u2026`
       );
+      return true;
     }
   } catch {
   }
+  return false;
 }
 function writeKeyFileAtomicSync(keyFile, content) {
   const tmp = `${keyFile}.${randomBytes2(4).toString("hex")}.tmp`;
@@ -3689,6 +3689,14 @@ var DefaultSecretVault = class {
     }).catch(() => void 0);
     this.pendingHardening.push(p);
   }
+  /** Detect and schedule repair of a pre-existing POSIX key with loose mode bits. */
+  checkKeyFilePermissions() {
+    if (keyFileNeedsHardening(this.keyFile, {
+      warn: (msg) => this.logWarn(msg)
+    })) {
+      this.scheduleKeyHardening();
+    }
+  }
   /** Flush all pending key-file hardening promises. */
   flushHardening() {
     if (this.pendingHardening.length === 0) return Promise.resolve();
@@ -3776,7 +3784,7 @@ var DefaultSecretVault = class {
       writeKeyFileAtomicSync(this.keyFile, keyFileBuf);
     }
     this.scheduleKeyHardening();
-    checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
+    this.checkKeyFilePermissions();
     this.key = newKey;
     this._keyVersion = newVersion;
     return { oldVersion, newVersion };
@@ -3792,12 +3800,9 @@ var DefaultSecretVault = class {
     const passphrase = getVaultPassphrase();
     if (!passphrase || !this.key) return;
     try {
-      writeKeyFileAtomicSync(
-        this.keyFile,
-        wrapDataKey(this.key, this._keyVersion, passphrase)
-      );
+      writeKeyFileAtomicSync(this.keyFile, wrapDataKey(this.key, this._keyVersion, passphrase));
       this.scheduleKeyHardening();
-      checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
+      this.checkKeyFilePermissions();
     } catch {
     }
   }
@@ -3809,13 +3814,13 @@ var DefaultSecretVault = class {
         const { key: key2, version } = unwrapDataKey(buf, this.keyFile);
         this.key = key2;
         this._keyVersion = version;
-        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
+        this.checkKeyFilePermissions();
         return this.key;
       }
       if (buf.length === KEY_BYTES) {
         this.key = buf;
         this._keyVersion = 1;
-        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
+        this.checkKeyFilePermissions();
         this.migrateToWrappedIfPassphrase();
         return this.key;
       }
@@ -3839,7 +3844,7 @@ var DefaultSecretVault = class {
         }
         this.key = Buffer.from(key2);
         this._keyVersion = version;
-        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
+        this.checkKeyFilePermissions();
         this.migrateToWrappedIfPassphrase();
         return this.key;
       }
@@ -3866,13 +3871,13 @@ var DefaultSecretVault = class {
         const { key: winnerKey, version } = unwrapDataKey(buf, this.keyFile);
         this.key = winnerKey;
         this._keyVersion = version;
-        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
+        this.checkKeyFilePermissions();
         return this.key;
       }
       if (buf.length === KEY_BYTES) {
         this.key = buf;
         this._keyVersion = 1;
-        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
+        this.checkKeyFilePermissions();
         return this.key;
       }
       if (buf.length === VERSIONED_KEY_FILE_SIZE) {
@@ -3888,7 +3893,7 @@ var DefaultSecretVault = class {
         const winnerKey = buf.subarray(KEY_FILE_MAGIC.length + 1);
         this.key = Buffer.from(winnerKey);
         this._keyVersion = version;
-        checkKeyFilePermissions(this.keyFile, { warn: (msg) => this.logWarn(msg) });
+        this.checkKeyFilePermissions();
         return this.key;
       }
       throw new ConfigError({

package/dist/security/secret-vault.d.ts

@@ -46,6 +46,8 @@ export declare class DefaultSecretVault implements RotatableSecretVault {
      * can never become an unhandled one.
      */
     private scheduleKeyHardening;
+    /** Detect and schedule repair of a pre-existing POSIX key with loose mode bits. */
+    private checkKeyFilePermissions;
     /** Flush all pending key-file hardening promises. */
     flushHardening(): Promise<void>;
     /** Current key version. Starts at 1; incremented by rotateKey(). */

package/dist/session-catalog/index.js

@@ -1198,6 +1198,22 @@ function isPidAlive(pid) {
   }
 }
 
+// src/utils/session-scoped-path.ts
+var SESSION_SIDECAR_JSONL_SUFFIXES = [
+  ".replay.jsonl",
+  ".audit.jsonl",
+  ".annotations.jsonl"
+];
+var RESERVED_SESSION_JSONL_NAMES = /* @__PURE__ */ new Set([
+  "_index.jsonl",
+  "_mailbox.jsonl"
+]);
+function isSessionTranscriptFileName(name) {
+  if (!name.endsWith(".jsonl")) return false;
+  if (RESERVED_SESSION_JSONL_NAMES.has(name)) return false;
+  return !SESSION_SIDECAR_JSONL_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
+
 // src/session-catalog/store.ts
 var SCHEMA_VERSION = 1;
 var MAX_LEASE_MS = 12e4;
@@ -1683,13 +1699,51 @@ var SessionCatalogStore = class {
       damaged: row.damaged !== 0
     };
   }
-  listCatalog(limit = 100, search) {
-    const bounded = Math.min(MAX_PAGE, Math.max(1, Math.floor(limit)));
-    const rows = search?.trim() ? this.db.prepare(
-      "SELECT * FROM sessions WHERE session_id LIKE ? OR json_extract(summary_json,'$.title') LIKE ? OR json_extract(summary_json,'$.name') LIKE ? ORDER BY COALESCE(json_extract(summary_json,'$.lastActivityAt'),json_extract(summary_json,'$.startedAt')) DESC LIMIT ?"
-    ).all(`%${search.trim()}%`, `%${search.trim()}%`, `%${search.trim()}%`, bounded) : this.db.prepare(
-      "SELECT * FROM sessions ORDER BY COALESCE(json_extract(summary_json,'$.lastActivityAt'),json_extract(summary_json,'$.startedAt')) DESC LIMIT ?"
-    ).all(bounded);
+  listCatalog(criteria = {}) {
+    const requestedLimit = criteria.limit ?? 100;
+    if (!Number.isFinite(requestedLimit)) throw new TypeError("Invalid session catalog limit");
+    const bounded = Math.min(MAX_PAGE, Math.max(1, Math.floor(requestedLimit)));
+    const clauses = [];
+    const values = [];
+    const jsonText = (field) => `CASE WHEN json_valid(summary_json) THEN json_extract(summary_json,'$.${field}') END`;
+    const literalLike = (value) => `%${value.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_")}%`;
+    const search = criteria.search?.trim();
+    if (search) {
+      const pattern = literalLike(search);
+      clauses.push(
+        `(session_id LIKE ? ESCAPE '\\' OR ${jsonText("title")} LIKE ? ESCAPE '\\' OR ${jsonText("name")} LIKE ? ESCAPE '\\')`
+      );
+      values.push(pattern, pattern, pattern);
+    }
+    if (criteria.since) {
+      clauses.push(`${jsonText("startedAt")}>=?`);
+      values.push(criteria.since);
+    }
+    if (criteria.until) {
+      clauses.push(`${jsonText("startedAt")}<=?`);
+      values.push(criteria.until);
+    }
+    if (criteria.provider) {
+      clauses.push(`${jsonText("provider")}=?`);
+      values.push(criteria.provider);
+    }
+    if (criteria.model) {
+      clauses.push(`${jsonText("model")}=?`);
+      values.push(criteria.model);
+    }
+    if (criteria.minTokens !== void 0) {
+      if (!Number.isFinite(criteria.minTokens)) throw new TypeError("Invalid minimum token count");
+      clauses.push(`CAST(COALESCE(${jsonText("tokenTotal")},0) AS REAL)>=?`);
+      values.push(criteria.minTokens);
+    }
+    if (criteria.titleContains) {
+      clauses.push(`${jsonText("title")} LIKE ? ESCAPE '\\'`);
+      values.push(literalLike(criteria.titleContains.toLocaleLowerCase()));
+    }
+    const where = clauses.length > 0 ? ` WHERE ${clauses.join(" AND ")}` : "";
+    const rows = this.db.prepare(
+      `SELECT * FROM sessions${where} ORDER BY COALESCE(${jsonText("lastActivityAt")},${jsonText("endedAt")},${jsonText("startedAt")}) DESC,${jsonText("startedAt")} DESC,session_id ASC LIMIT ?`
+    ).all(...values, bounded);
     return rows.map((row) => this.catalogRecord(row));
   }
   getSummary(sessionId) {
@@ -1844,7 +1898,7 @@ var SessionCatalogStore = class {
   rebuildCatalog() {
     const summaries = this.walkFiles(this.sessionsDir, ".summary.json");
     const transcripts = this.walkFiles(this.sessionsDir, ".jsonl").filter(
-      (file) => !file.endsWith("_index.jsonl")
+      (file) => isSessionTranscriptFileName(path4.basename(file))
     );
     const ids = /* @__PURE__ */ new Set();
     for (const file of [...summaries, ...transcripts]) {