@wrongstack/core 0.306.2 → 0.306.4

package/dist/storage/cloud-config-sync/sanitize.d.ts

@@ -15,6 +15,13 @@
  *
  * Stripping is therefore structural (projection), with `stripSecretMaterial` as a final
  * defense-in-depth pass mirroring the server's own scan.
+ *
+ * The two directions do NOT share one gate. "What may leave this machine" and "what may
+ * a remote peer write into the trusted profile config" are different questions, and the
+ * outbound tree is a wrong — dangerously permissive — answer to the second: it names
+ * `mcpServers.*.command`, `plugins`, `providers.*.baseUrl` and `yolo` as contract-owned,
+ * because pushing them is harmless. Pulls are therefore gated on `INBOUND_CONTRACT`, the
+ * outbound tree minus `INBOUND_DENIED_PATHS`.
  */
 /** `true` = the whole value is contract-owned; an object = recurse per key; `'*'` = record wildcard. */
 export type ContractNode = true | {
@@ -23,6 +30,17 @@ export type ContractNode = true | {
 /** Namespace → the contract tree over the `config.json` top-level keys it owns. */
 export declare const CLOUD_SYNC_CONTRACT: Readonly<Record<string, ContractNode>>;
 export declare const CLOUD_SYNC_NAMESPACES: string[];
+/**
+ * Every inbound-denied path must still resolve against the outbound contract.
+ *
+ * A denylist that silently stops matching is worse than no denylist: it reads
+ * as protection while granting the field. Renaming `mcpServers.*.command` in
+ * the contract without updating the entry here must break the build, not
+ * quietly re-open remote code execution.
+ */
+export declare function assertInboundDenyListResolves(): void;
+/** Exposed for tests and diagnostics — the effective pull-side allow tree. */
+export declare function inboundContractFor(namespace: string): ContractNode | undefined;
 /** Server-side schema versions, sent in every push envelope. */
 export declare const NAMESPACE_SCHEMA_VERSIONS: Readonly<Record<string, number>>;
 /**

package/dist/storage/cloud-config-sync.d.ts

@@ -1,4 +1,4 @@
-export { applyNamespacePayload, buildNamespacePayloads, CLOUD_SYNC_CONTRACT, CLOUD_SYNC_NAMESPACES, LOCAL_ONLY_TOP_LEVEL, NAMESPACE_SCHEMA_VERSIONS, stripSecretMaterial, } from './cloud-config-sync/sanitize.js';
+export { applyNamespacePayload, assertInboundDenyListResolves, buildNamespacePayloads, CLOUD_SYNC_CONTRACT, CLOUD_SYNC_NAMESPACES, inboundContractFor, LOCAL_ONLY_TOP_LEVEL, NAMESPACE_SCHEMA_VERSIONS, stripSecretMaterial, } from './cloud-config-sync/sanitize.js';
 /**
  * CloudConfigSync — synchronizes the profile config with my.wrongstack.com over the
  * namespaced sync API v1 (server repo: docs/CLIENT_SYNC_CONTRACT.md).

package/dist/storage/index.js

@@ -1710,6 +1710,24 @@ function resolveWstackPaths(opts) {
 }
 
 // src/security/secret-scrubber.ts
+var JSON_CREDENTIAL_KEY_ANCHORS = [
+  'Key"',
+  'key"',
+  'KEY"',
+  'token"',
+  'Token"',
+  'TOKEN"',
+  'secret"',
+  'Secret"',
+  'SECRET"',
+  'password"',
+  'Password"',
+  'PASSWORD"',
+  'authorization"',
+  'Authorization"',
+  'bearer"',
+  'Bearer"'
+];
 var PATTERNS = [
   // Anchored at the start where possible so partial matches inside larger
   // strings don't trigger false positives.
@@ -1812,6 +1830,30 @@ var PATTERNS = [
     regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
     anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
   },
+  {
+    type: "json_credential_key",
+    // The JSON counterpart to `high_entropy_env`, and the pattern that the
+    // now-deleted `JSON_KEY_ANCHORS` list was written for. Without it those
+    // anchors only widened the cheap pre-scan — `hasCredentialAnchors` said
+    // "this text may hold a secret", every pattern then declined to match, and
+    // the value went out verbatim. `high_entropy_env` cannot cover these: it
+    // requires an UPPERCASE unquoted key (`API_KEY=…`), so `{"apiKey":"…"}`
+    // never matched.
+    //
+    // Tool results are routinely serialised as JSON, and a credential with no
+    // recognisable prefix (Azure, self-hosted gateways, Anthropic/Codex OAuth)
+    // has no other pattern that can catch it — this is the only thing standing
+    // between such a value and the session JSONL, chronicle, HQ broadcast and
+    // the model's own context.
+    //
+    // The key may carry a prefix (`"anthropicApiKey"`), but the credential word
+    // must END the key: `"tokenCount"` and `"maxTokens"` do not match, because
+    // the closing quote has to follow the word immediately.
+    // Value floor of 8 chars keeps enum-ish values (`"authorization":"none"`)
+    // out. Capture groups: 1=key + punctuation, 2=value, 3=closing quote.
+    regex: /("[A-Za-z0-9_]*(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s*:\s*")([^"\\]{8,512})(")/gi,
+    anchor: JSON_CREDENTIAL_KEY_ANCHORS
+  },
   // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
   // The plugin runtime carried 37 patterns while this scrubber — the one that
   // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
@@ -1894,9 +1936,12 @@ var PATTERNS = [
     anchor: "GOCSPX-"
   }
 ];
-var SIMPLE_PATTERNS = PATTERNS.filter((p) => p.type !== "high_entropy_env");
+var SIMPLE_PATTERNS = PATTERNS.filter(
+  (p) => p.type !== "high_entropy_env" && p.type !== "json_credential_key"
+);
 var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
 var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
+var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key").regex;
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
@@ -1907,20 +1952,7 @@ var PATTERN_ANCHORS = [
     )
   )
 ];
-var JSON_KEY_ANCHORS = [
-  '"apiKey"',
-  '"api_key"',
-  '"token"',
-  '"secret"',
-  '"password"',
-  '"authorization"',
-  '"bearer"',
-  '"private_key"',
-  '"access_token"',
-  '"refresh_token"',
-  '"client_secret"'
-];
-var ALL_ANCHORS = [...PATTERN_ANCHORS, ...JSON_KEY_ANCHORS];
+var ALL_ANCHORS = PATTERN_ANCHORS;
 function hasCredentialAnchors(text) {
   for (const anchor of ALL_ANCHORS) {
     if (text.includes(anchor)) return true;
@@ -1969,6 +2001,9 @@ var DefaultSecretScrubber = class {
     out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
       return `${lead}${key}=[REDACTED:high_entropy_env]`;
     });
+    out = out.replace(JSON_CREDENTIAL_REGEX, (_match, keyPrefix, _value, closingQuote) => {
+      return `${keyPrefix}[REDACTED:json_credential_key]${closingQuote}`;
+    });
     return out;
   }
   /**
@@ -2427,8 +2462,8 @@ var SessionRegistry = class {
           if (id !== entry.sessionId) delete registry[id];
           continue;
         }
-        const heartbeatAge = now - new Date(existing.lastHeartbeatAt).getTime();
-        if (heartbeatAge > PID_CHECK_AFTER_MS && !pidAlive2(existing.pid)) {
+        const heartbeatAt = Date.parse(existing.lastHeartbeatAt);
+        if (!Number.isFinite(heartbeatAt) || now - heartbeatAt > PID_CHECK_AFTER_MS && !pidAlive2(existing.pid)) {
           delete registry[id];
         }
       }
@@ -3446,6 +3481,156 @@ var CLOUD_SYNC_CONTRACT = {
   "extensions.plugins": EXTENSIONS_PLUGINS_TREE
 };
 var CLOUD_SYNC_NAMESPACES = Object.keys(CLOUD_SYNC_CONTRACT);
+var INBOUND_DENIED_PATHS = [
+  // ── Code execution ──────────────────────────────────────────────────────
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.command",
+    reason: "Executable spawned for a stdio MCP server."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.args",
+    reason: "Argv for that executable."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.transport",
+    reason: "Switching transport to stdio selects the spawning code path."
+  },
+  {
+    namespace: "extensions.plugins",
+    path: "plugins",
+    reason: "Plugin list is resolved and `await import`ed."
+  },
+  // `extensions` is deliberately NOT denied: it is per-plugin settings read via
+  // `ConfigStore.getExtension(name)`, not a loader list, so it grants no import.
+  // Syncing it is the feature (`extensions.telegram.notifyChatId` and friends).
+  // Residual risk accepted: a plugin whose own settings include a URL can have
+  // that URL rewritten by the portal. Constrain that in the plugin's
+  // `configSchema`, which is where the loader validates it.
+  // ── Credential redirection / exfiltration ───────────────────────────────
+  {
+    namespace: "providers.catalog",
+    path: "providers.*.baseUrl",
+    reason: "Repoints the provider endpoint; reinjectLocalSecrets keeps the local apiKey, so the real key follows the redirect."
+  },
+  {
+    namespace: "providers.catalog",
+    path: "providers.*.envVars",
+    reason: "Chooses which environment variable is read for the key."
+  },
+  {
+    namespace: "providers.catalog",
+    path: "providers.*.activeKey",
+    reason: "Selects which stored key is sent."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.url",
+    reason: "Remote MCP endpoint; receives whatever the transport carries."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.envVars",
+    reason: "Names of environment variables forwarded to the server process."
+  },
+  // ── Operator-owned safety switches ──────────────────────────────────────
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.permission",
+    reason: "Approval requirement for that server\u2019s tools."
+  },
+  { namespace: "core.runtime", path: "yolo", reason: "Disables every permission prompt." },
+  {
+    namespace: "core.runtime",
+    path: "features.allowOutsideProjectRoot",
+    reason: "Short-circuits project-root containment and the symlink realpath check."
+  },
+  {
+    namespace: "core.runtime",
+    path: "tools.restrictToProjectRoot",
+    reason: "The other half of the filesystem confinement switch."
+  },
+  {
+    namespace: "core.runtime",
+    path: "features.developerMode",
+    reason: "Loosens guardrails; an operator opt-in, not a synced preference."
+  },
+  {
+    namespace: "core.runtime",
+    path: "tools.disabledTools",
+    reason: "Could re-enable a tool the operator deliberately switched off."
+  },
+  {
+    namespace: "ui.preferences",
+    path: "autonomy.defaultMode",
+    reason: "Autonomy is user-owned, never remote-owned."
+  },
+  {
+    namespace: "ui.preferences",
+    path: "autonomy.yolo",
+    reason: "Alias for the denied top-level `yolo`, and it wins over the user setting."
+  },
+  {
+    namespace: "ui.preferences",
+    path: "launch.autonomy",
+    reason: "Launch-time autonomy mode; same user-owned boundary."
+  },
+  {
+    namespace: "models.routing",
+    path: "brain.mode",
+    reason: "Selects the policy/LLM/human decision ladder."
+  },
+  {
+    namespace: "models.routing",
+    path: "brain.maxAutoRisk",
+    reason: "The risk ceiling below which actions proceed without asking."
+  }
+];
+function contractHasPath(tree, segments) {
+  if (segments.length === 0) return true;
+  if (tree === true) return false;
+  const [head, ...rest] = segments;
+  if (head === void 0 || !Object.hasOwn(tree, head)) return false;
+  const child = tree[head];
+  return child === void 0 ? false : contractHasPath(child, rest);
+}
+function pruneContractPath(tree, segments) {
+  if (tree === true || segments.length === 0) return tree;
+  const [head, ...rest] = segments;
+  if (head === void 0 || !Object.hasOwn(tree, head)) return tree;
+  const next = { ...tree };
+  if (rest.length === 0) {
+    delete next[head];
+    return next;
+  }
+  const child = next[head];
+  if (child === void 0) return tree;
+  next[head] = pruneContractPath(child, rest);
+  return next;
+}
+function assertInboundDenyListResolves() {
+  const unresolved = INBOUND_DENIED_PATHS.filter((entry) => {
+    const tree = CLOUD_SYNC_CONTRACT[entry.namespace];
+    return tree === void 0 || !contractHasPath(tree, entry.path.split("."));
+  });
+  if (unresolved.length > 0) {
+    throw new Error(
+      "INBOUND_DENIED_PATHS entr(ies) no longer resolve against CLOUD_SYNC_CONTRACT \u2014 a rename would silently re-open them: " + unresolved.map((entry) => `${entry.namespace}:${entry.path}`).join(", ")
+    );
+  }
+}
+var INBOUND_CONTRACT = (() => {
+  assertInboundDenyListResolves();
+  const out = { ...CLOUD_SYNC_CONTRACT };
+  for (const entry of INBOUND_DENIED_PATHS) {
+    const tree = out[entry.namespace];
+    if (tree === void 0) continue;
+    out[entry.namespace] = pruneContractPath(tree, entry.path.split("."));
+  }
+  return out;
+})();
 var NAMESPACE_SCHEMA_VERSIONS = {
   "core.runtime": 1,
   "ui.preferences": 1,
@@ -3547,7 +3732,7 @@ function mergeAtContract(local, incoming, tree) {
   return base;
 }
 function applyNamespacePayload(config, namespace, payload) {
-  const tree = CLOUD_SYNC_CONTRACT[namespace];
+  const tree = INBOUND_CONTRACT[namespace];
   if (!tree || tree === true) return config;
   const next = { ...config };
   for (const [key, incoming] of Object.entries(payload)) {
@@ -4978,6 +5163,10 @@ var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "fallbackModels",
   "fallbackBridge",
   "fallbackProfiles",
+  // The profile SELECTOR. No broader than its siblings: a repo that can write
+  // `fallbackModels` and `fallbackProfiles` already controls the chain outright,
+  // and this one can only name a profile the user already defined.
+  "fallbackProfile",
   "favoriteModels",
   "favoriteModelsOnly",
   "modelAvailabilitySchedule",
@@ -5025,6 +5214,10 @@ var KNOWN_DENIED_IN_PROJECT = [
   {
     key: "git",
     reason: "Carries git.identity (GIT_AUTHOR_*/GIT_COMMITTER_* injection): a repo-committed config could spoof the author identity written into the victim's commit history (impersonation)."
+  },
+  {
+    key: "fallbackMaxLastResortCandidates",
+    reason: "Bounds how many of the user's OTHER configured providers may be swept in as last-resort failover. Setting it to 0 from a repo-committed config would silently strip that depth during an outage. It was already stripped in practice (absent from the allow-list) but was missing from the key registry, so this gate never checked it."
   }
 ];
 var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
@@ -5045,11 +5238,13 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "fallbackModels",
   "fallbackBridge",
   "fallbackProfiles",
+  "fallbackProfile",
   "favoriteModels",
   "favoriteModelsOnly",
   "modelAvailabilitySchedule",
   "fallbackAuto",
   "fallbackStickiness",
+  "fallbackMaxLastResortCandidates",
   "hooks",
   "plugins",
   "pluginManager",
@@ -5135,6 +5330,17 @@ var IN_PROJECT_DENIED_PATHS = [
     // operator owns, not the checked-out repository.
     path: "tools.kanbanGovernance",
     reason: "Repo-committed config could disable a Kanban governance gate the operator switched on, letting product mutations run outside any managed card."
+  },
+  {
+    // The bridge spawn path resolves the CLI entry by walking UP from the
+    // project root, so a repo that ships its own `packages/cli/dist/index.js`
+    // gets that file spawned with `process.execPath` on WebUI boot — no
+    // prompt, no banner. Turning the feature on is therefore equivalent to
+    // arbitrary code execution for a hostile checkout, which makes this an
+    // operator-owned switch and never a repo-owned one.
+    // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
+    path: "features.mailboxBridge",
+    reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
   }
 ];
 function deleteNestedPath(target, path34) {
@@ -8767,6 +8973,15 @@ async function readProviderSnapshot(configPath, vault, warn) {
     snapshot.fallbackBridge = decrypted.fallbackBridge.trim();
   }
   if (decrypted.fallbackProfiles) snapshot.fallbackProfiles = decrypted.fallbackProfiles;
+  if (typeof decrypted.fallbackProfile === "string" && decrypted.fallbackProfile.trim()) {
+    snapshot.fallbackProfile = decrypted.fallbackProfile.trim();
+  }
+  if (decrypted.fallbackStickiness && typeof decrypted.fallbackStickiness === "object") {
+    snapshot.fallbackStickiness = decrypted.fallbackStickiness;
+  }
+  if (typeof decrypted.fallbackMaxLastResortCandidates === "number" && Number.isFinite(decrypted.fallbackMaxLastResortCandidates)) {
+    snapshot.fallbackMaxLastResortCandidates = decrypted.fallbackMaxLastResortCandidates;
+  }
   if (Array.isArray(decrypted.favoriteModels)) snapshot.favoriteModels = decrypted.favoriteModels;
   if (typeof decrypted.favoriteModelsOnly === "boolean")
     snapshot.favoriteModelsOnly = decrypted.favoriteModelsOnly;
@@ -8785,10 +9000,13 @@ function serializeSnapshot(s) {
     fallbackModels: s.fallbackModels ?? null,
     fallbackBridge: s.fallbackBridge ?? null,
     fallbackProfiles: s.fallbackProfiles ?? null,
+    fallbackProfile: s.fallbackProfile ?? null,
     favoriteModels: s.favoriteModels ?? null,
     favoriteModelsOnly: s.favoriteModelsOnly ?? null,
     modelMatrix: s.modelMatrix ?? null,
     fallbackAuto: s.fallbackAuto ?? null,
+    fallbackStickiness: s.fallbackStickiness ?? null,
+    fallbackMaxLastResortCandidates: s.fallbackMaxLastResortCandidates ?? null,
     modelAvailabilitySchedule: s.modelAvailabilitySchedule ?? null
   });
 }
@@ -11491,6 +11709,44 @@ import * as fsp11 from "node:fs/promises";
 import * as path27 from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 
+// src/storage/session-writer-scrubber.ts
+function scrubSessionWriterEvent(event, secretScrubber) {
+  const persistMessage = (message) => {
+    const { _estTokens: _ignored, ...persisted } = message;
+    return {
+      ...persisted,
+      content: typeof persisted.content === "string" ? secretScrubber?.scrub(persisted.content) ?? persisted.content : secretScrubber?.scrubObject(persisted.content) ?? persisted.content
+    };
+  };
+  if (event.type === "context_snapshot" || event.type === "messages_replaced") {
+    return { ...event, messages: event.messages.map(persistMessage) };
+  }
+  if (event.type === "message_appended" || event.type === "message_updated") {
+    return { ...event, message: persistMessage(event.message) };
+  }
+  if (!secretScrubber) return event;
+  if (event.type === "user_input") {
+    return {
+      ...event,
+      content: typeof event.content === "string" ? secretScrubber.scrub(event.content) : secretScrubber.scrubObject(event.content)
+    };
+  }
+  if (event.type === "llm_response") {
+    return { ...event, content: secretScrubber.scrubObject(event.content) };
+  }
+  if (event.type === "file_snapshot") {
+    return {
+      ...event,
+      files: event.files.map((f) => ({
+        ...f,
+        before: f.before !== null ? secretScrubber.scrub(f.before) : null,
+        after: f.after !== null ? secretScrubber.scrub(f.after) : null
+      }))
+    };
+  }
+  return event;
+}
+
 // src/storage/session-writer-truncate.ts
 import * as fsp10 from "node:fs/promises";
 var CHUNK_SIZE = 65536;
@@ -11635,45 +11891,11 @@ async function rewriteSessionToCheckpoint(filePath, checkpointByteOffset) {
   }
 }
 
-// src/storage/session-writer-scrubber.ts
-function scrubSessionWriterEvent(event, secretScrubber) {
-  const persistMessage = (message) => {
-    const { _estTokens: _ignored, ...persisted } = message;
-    return {
-      ...persisted,
-      content: typeof persisted.content === "string" ? secretScrubber?.scrub(persisted.content) ?? persisted.content : secretScrubber?.scrubObject(persisted.content) ?? persisted.content
-    };
-  };
-  if (event.type === "context_snapshot" || event.type === "messages_replaced") {
-    return { ...event, messages: event.messages.map(persistMessage) };
-  }
-  if (event.type === "message_appended" || event.type === "message_updated") {
-    return { ...event, message: persistMessage(event.message) };
-  }
-  if (!secretScrubber) return event;
-  if (event.type === "user_input") {
-    return {
-      ...event,
-      content: typeof event.content === "string" ? secretScrubber.scrub(event.content) : secretScrubber.scrubObject(event.content)
-    };
-  }
-  if (event.type === "llm_response") {
-    return { ...event, content: secretScrubber.scrubObject(event.content) };
-  }
-  if (event.type === "file_snapshot") {
-    return {
-      ...event,
-      files: event.files.map((f) => ({
-        ...f,
-        before: f.before !== null ? secretScrubber.scrub(f.before) : null,
-        after: f.after !== null ? secretScrubber.scrub(f.after) : null
-      }))
-    };
-  }
-  return event;
-}
-
 // src/storage/file-session-writer.ts
+function isClosedHandleError(err) {
+  const code = err?.code;
+  return code === "EBADF" || code === "ERR_CLOSED_RESOURCE" || code === "ERR_INVALID_HANDLE";
+}
 var FileSessionWriter = class _FileSessionWriter {
   constructor(id, handle, startedAt, meta, events, opts = {}, traceId) {
     this.id = id;
@@ -11845,8 +12067,7 @@ var FileSessionWriter = class _FileSessionWriter {
       try {
         return await this.handle.appendFile(data, "utf8");
       } catch (err) {
-        const nodeErr = err;
-        if (nodeErr?.code === "EBADF") {
+        if (isClosedHandleError(err)) {
           this.handle = await fsp11.open(this.filePath, "a", 384);
           return await this.handle.appendFile(data, "utf8");
         }
@@ -11886,8 +12107,8 @@ var FileSessionWriter = class _FileSessionWriter {
   bufferSynchronousEvent(event) {
     if (this.closed) return;
     void this.ensureInit();
-    this.observeForSummary(event);
-    const appendEvent = event.type === "file_snapshot" ? scrubSessionWriterEvent(event, this.secretScrubber) : event;
+    const appendEvent = scrubSessionWriterEvent(event, this.secretScrubber);
+    this.observeForSummary(appendEvent);
     try {
       this._onAppend?.(appendEvent);
     } catch {
@@ -12040,8 +12261,7 @@ var FileSessionWriter = class _FileSessionWriter {
     try {
       await this.handle.datasync();
     } catch (err) {
-      const nodeErr = err;
-      if (nodeErr?.code === "EBADF") {
+      if (isClosedHandleError(err)) {
         this.handle = await fsp11.open(this.filePath, "a", 384);
         return;
       }
@@ -12278,6 +12498,7 @@ var FileSessionWriter = class _FileSessionWriter {
     return this.closePromise;
   }
   async doClose() {
+    await this.ensureInit();
     if (this.pendingFileSnapshots.length > 0) {
       await this.writeFileSnapshot(this.activePromptIndex ?? 0, [...this.pendingFileSnapshots]);
       this.pendingFileSnapshots = [];
@@ -12293,8 +12514,7 @@ var FileSessionWriter = class _FileSessionWriter {
     try {
       await this.handle.datasync();
     } catch (err) {
-      const nodeErr = err;
-      if (nodeErr?.code !== "EBADF") throw err;
+      if (!isClosedHandleError(err)) throw err;
     }
     const endedAt = (/* @__PURE__ */ new Date()).toISOString();
     const observedActivityMs = Date.parse(this.lastActivityAt);
@@ -13494,9 +13714,40 @@ async function readOrBuildShardManifestEntry(opts) {
   return entry;
 }
 
-// src/storage/session-store/summary-builder.ts
+// src/storage/session-store/strict-empty-check.ts
 import { createReadStream as createReadStream4 } from "node:fs";
 import { createInterface as createInterface4 } from "node:readline";
+var EMPTY_SESSION_EVENT_TYPES = /* @__PURE__ */ new Set(["session_start", "session_resumed", "session_end"]);
+async function isStrictlyEmptySessionFile(file) {
+  const input = createReadStream4(file, { encoding: "utf8" });
+  const lines = createInterface4({ input, crlfDelay: Infinity });
+  let sawSessionStart = false;
+  try {
+    for await (const line of lines) {
+      if (!line.trim()) continue;
+      let event;
+      try {
+        event = JSON.parse(line);
+      } catch {
+        return false;
+      }
+      if (event === null || typeof event !== "object" || Array.isArray(event)) return false;
+      const type = event.type;
+      if (typeof type !== "string" || !EMPTY_SESSION_EVENT_TYPES.has(type)) return false;
+      if (type === "session_start") sawSessionStart = true;
+    }
+  } catch {
+    return false;
+  } finally {
+    lines.close();
+    input.destroy();
+  }
+  return sawSessionStart;
+}
+
+// src/storage/session-store/summary-builder.ts
+import { createReadStream as createReadStream5 } from "node:fs";
+import { createInterface as createInterface5 } from "node:readline";
 async function summarizeSessionFile(opts) {
   return summarizeSessionEventSequence({
     id: opts.id,
@@ -13613,8 +13864,8 @@ async function summarizeSessionEventSequence(opts) {
   }
 }
 async function* iterateSessionEvents(file, secretScrubber) {
-  const stream = createReadStream4(file, { encoding: "utf8" });
-  const lines = createInterface4({ input: stream, crlfDelay: Infinity });
+  const stream = createReadStream5(file, { encoding: "utf8" });
+  const lines = createInterface5({ input: stream, crlfDelay: Infinity });
   try {
     for await (const line of lines) {
       if (!line.trim()) continue;
@@ -14510,6 +14761,10 @@ var DefaultSessionStore = class _DefaultSessionStore {
     await deleteSessionArtifacts({ rootDir: this.dir, id, jsonlPath });
     await this.writeTombstone(id);
   }
+  async isEmpty(id) {
+    const canonicalId = await this.resolveId(id);
+    return isStrictlyEmptySessionFile(this.sessionPath(canonicalId, ".jsonl"));
+  }
   async delete(id) {
     if (this.catalogClient) {
       const canonical = await this.resolveId(id);
@@ -14722,10 +14977,10 @@ async function applyRewindToConversation(opts) {
 }
 
 // src/storage/session-rewinder.ts
-import { createReadStream as createReadStream5 } from "node:fs";
+import { createReadStream as createReadStream6 } from "node:fs";
 import * as fsp20 from "node:fs/promises";
 import * as path33 from "node:path";
-import { createInterface as createInterface5 } from "node:readline";
+import { createInterface as createInterface6 } from "node:readline";
 var DefaultSessionRewinder = class {
   constructor(sessionsDir, projectRoot) {
     this.sessionsDir = sessionsDir;
@@ -14737,8 +14992,8 @@ var DefaultSessionRewinder = class {
     return sessionScopedPath(this.sessionsDir, sessionId, ".jsonl");
   }
   async *readEvents(file) {
-    const stream = createReadStream5(file, { encoding: "utf8" });
-    const lines = createInterface5({ input: stream, crlfDelay: Infinity });
+    const stream = createReadStream6(file, { encoding: "utf8" });
+    const lines = createInterface6({ input: stream, crlfDelay: Infinity });
     try {
       for await (const line of lines) {
         if (!line.trim()) continue;

package/dist/storage/provider-config-watcher.d.ts

@@ -24,10 +24,19 @@ export interface ProviderConfigSnapshot {
     fallbackModels?: string[];
     fallbackBridge?: string;
     fallbackProfiles?: Record<string, string[]>;
+    /** Selected named profile (Config.fallbackProfile). */
+    fallbackProfile?: string;
     favoriteModels?: string[];
     favoriteModelsOnly?: boolean;
     modelMatrix?: Record<string, unknown>;
     fallbackAuto?: boolean;
+    /** Primary-probe cooldown / sticky-dwell tuning (Config.fallbackStickiness). */
+    fallbackStickiness?: {
+        primaryProbeInterval?: number;
+        stickyFallbackTurns?: number;
+    };
+    /** Last-resort append cap (Config.fallbackMaxLastResortCandidates). */
+    fallbackMaxLastResortCandidates?: number;
     modelAvailabilitySchedule?: import('../core/model-availability-calendar.js').ModelBlackoutRule[];
 }
 export interface WatchProviderConfigOptions {

package/dist/storage/session-store/strict-empty-check.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Return true only for a well-formed journal containing lifecycle envelope
+ * events and nothing else. Parsing fails closed so a damaged or newer journal
+ * can never be mistaken for an empty session and deleted.
+ */
+export declare function isStrictlyEmptySessionFile(file: string): Promise<boolean>;
+//# sourceMappingURL=strict-empty-check.d.ts.map

package/dist/storage/session-store.d.ts

@@ -205,6 +205,7 @@ export declare class DefaultSessionStore implements SessionStore {
      * to the caller so prune() can report it.
      */
     private deleteSession;
+    isEmpty(id: string): Promise<boolean>;
     delete(id: string): Promise<void>;
     rename(id: string, name: string): Promise<SessionSummary>;
     prune(maxAgeDays?: number): Promise<number>;

package/dist/tools/index.d.ts

@@ -1,5 +1,5 @@
 export { COUNCIL_TOOL_NAME, type CouncilToolInput, type CreateCouncilToolOptions, createCouncilTool, MAX_COUNCIL_CONTEXT_CHARS, MAX_COUNCIL_QUESTION_CHARS, MAX_COUNCIL_TOOL_OPTIONS, } from './council-tool.js';
-export { AGENT_MODEL_ASSIGN_TOOL_NAME, createFallbackManageTools, FALLBACK_CHAIN_MANAGE_TOOL_NAME, FALLBACK_PROFILE_MANAGE_TOOL_NAME, FAVORITE_MANAGE_TOOL_NAME, type FallbackManageToolOptions, LEADER_MODEL_SET_TOOL_NAME, PROVIDER_KEY_SET_TOOL_NAME, PROVIDER_MANAGE_TOOL_NAME, SYSTEM_CONFIG_VIEW_TOOL_NAME, } from './fallback-manage-tools.js';
+export { AGENT_MODEL_ASSIGN_TOOL_NAME, createFallbackManageTools, FALLBACK_CHAIN_MANAGE_TOOL_NAME, FALLBACK_PROFILE_MANAGE_TOOL_NAME, FAVORITE_MANAGE_TOOL_NAME, type FallbackManageToolOptions, LEADER_MODEL_SET_TOOL_NAME, PROVIDER_KEY_SET_TOOL_NAME, PROVIDER_MANAGE_TOOL_NAME, SYSTEM_CONFIG_VIEW_TOOL_NAME, validateProviderBaseUrl, } from './fallback-manage-tools.js';
 export { createMcpControlTool, type MCPRegistryHandle } from './mcp-control.js';
 export { createMcpUseTool } from './mcp-use.js';
 export { type CreateOneShotLLMToolOptions, createOneShotLLMTool, ONE_SHOT_LLM_TOOL_NAME, } from './one-shot-llm-tool.js';