@wrongstack/core 0.306.3 → 0.307.0

package/dist/infrastructure/index.js

@@ -3158,7 +3158,9 @@ var DEFAULT_TOOLS_CONFIG = Object.freeze({
   perIterationOutputCapBytes: 1e5,
   descriptionMode: Object.freeze({}),
   disabledTools: Object.freeze([]),
-  autoExtendLimit: true,
+  // Extension requires an explicit host/user policy. Without that boundary a
+  // nominal maxIterations cap can grow forever in autonomous sessions.
+  autoExtendLimit: false,
   restrictToProjectRoot: true,
   // Off by default: the board is a record of the work, not a permit for it.
   // See ToolsConfig.kanbanGovernance for what turning it on costs and gates.
@@ -3456,6 +3458,10 @@ var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "fallbackModels",
   "fallbackBridge",
   "fallbackProfiles",
+  // The profile SELECTOR. No broader than its siblings: a repo that can write
+  // `fallbackModels` and `fallbackProfiles` already controls the chain outright,
+  // and this one can only name a profile the user already defined.
+  "fallbackProfile",
   "favoriteModels",
   "favoriteModelsOnly",
   "modelAvailabilitySchedule",
@@ -3503,6 +3509,10 @@ var KNOWN_DENIED_IN_PROJECT = [
   {
     key: "git",
     reason: "Carries git.identity (GIT_AUTHOR_*/GIT_COMMITTER_* injection): a repo-committed config could spoof the author identity written into the victim's commit history (impersonation)."
+  },
+  {
+    key: "fallbackMaxLastResortCandidates",
+    reason: "Bounds how many of the user's OTHER configured providers may be swept in as last-resort failover. Setting it to 0 from a repo-committed config would silently strip that depth during an outage. It was already stripped in practice (absent from the allow-list) but was missing from the key registry, so this gate never checked it."
   }
 ];
 var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
@@ -3523,11 +3533,13 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "fallbackModels",
   "fallbackBridge",
   "fallbackProfiles",
+  "fallbackProfile",
   "favoriteModels",
   "favoriteModelsOnly",
   "modelAvailabilitySchedule",
   "fallbackAuto",
   "fallbackStickiness",
+  "fallbackMaxLastResortCandidates",
   "hooks",
   "plugins",
   "pluginManager",
@@ -3613,6 +3625,17 @@ var IN_PROJECT_DENIED_PATHS = [
     // operator owns, not the checked-out repository.
     path: "tools.kanbanGovernance",
     reason: "Repo-committed config could disable a Kanban governance gate the operator switched on, letting product mutations run outside any managed card."
+  },
+  {
+    // The bridge spawn path resolves the CLI entry by walking UP from the
+    // project root, so a repo that ships its own `packages/cli/dist/index.js`
+    // gets that file spawned with `process.execPath` on WebUI boot — no
+    // prompt, no banner. Turning the feature on is therefore equivalent to
+    // arbitrary code execution for a hostile checkout, which makes this an
+    // operator-owned switch and never a repo-owned one.
+    // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
+    path: "features.mailboxBridge",
+    reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
   }
 ];
 function deleteNestedPath(target, path13) {

package/dist/kernel/events/agent-events.d.ts

@@ -40,6 +40,8 @@ export interface AgentEventMap {
         target: string;
         /** The task instruction handed to the subagent (untruncated — UIs trim). */
         task: string;
+        /** Runtime identity for the spawned delegate, when creation succeeded. */
+        subagentId?: string | undefined;
     };
     /**
      * Fired by the `delegate` tool once the subagent settles (success,

package/dist/kernel/events/provider-events.d.ts

@@ -168,6 +168,19 @@ export interface ProviderEventMap {
             currentTokens?: number | undefined;
         } | undefined;
     };
+    /**
+     * The fallback extension deferred a half-open primary recovery probe because
+     * the target model's known context window cannot fit the current request.
+     * The active fallback stays selected; no doomed primary request is sent.
+     */
+    'provider.primary_probe_context_blocked': {
+        sessionId?: string | undefined;
+        providerId: string;
+        model: string;
+        currentTokens: number;
+        maxContext: number;
+        timestamp: number;
+    };
     /**
      * Fired by the fallback gate function (supplied to the fallback-model
      * extension via `FallbackModelDeps.fallbackGate`) when the chain is about