@wrongstack/core 0.306.3 → 0.307.0

package/dist/session-catalog/store-rebuild.d.ts

@@ -0,0 +1,9 @@
+import type { DatabaseSync } from 'node:sqlite';
+import type { SessionSummary } from '../types/session.js';
+export declare function walkSessionFiles(root: string, suffix: string): string[];
+export declare function summarizeTranscriptFile(transcriptFilePath: string, id: string): SessionSummary;
+export declare function rebuildCatalogIndex(db: DatabaseSync, sessionsDir: string, containedPathFn: (relative: string) => string, transactionFn: <T>(run: () => T) => T, bumpGenerationFn: () => number): {
+    indexed: number;
+    damaged: number;
+};
+//# sourceMappingURL=store-rebuild.d.ts.map

package/dist/session-catalog/store-schema.d.ts

@@ -0,0 +1,48 @@
+import type { DatabaseSync } from 'node:sqlite';
+import type { SessionRegistryEntry } from '../session-registry-types.js';
+export declare const SCHEMA_VERSION = 1;
+export declare const MAX_LEASE_MS = 120000;
+export declare const MAX_RESERVATION_MS = 60000;
+export declare const MAX_MAINTENANCE_MS: number;
+export declare const MAX_PAGE = 1000;
+export interface LeaseRow {
+    session_id: string;
+    lease_id: string;
+    lease_secret_hash: string;
+    owner_instance_id: string;
+    owner_pid: number;
+    owner_started_at: string;
+    entry_json: string;
+    agent_revision: number;
+    status: SessionRegistryEntry['status'];
+    last_heartbeat_at: number;
+    lease_expires_at: number;
+}
+export interface ReservationRow {
+    reservation_id: string;
+    target_session_id: string;
+    requester_instance_id: string;
+    current_session_id: string | null;
+    expires_at: number;
+}
+export interface CatalogRow {
+    session_id: string;
+    transcript_relative_path: string;
+    summary_relative_path: string;
+    summary_json: string;
+    transcript_size: number;
+    transcript_mtime_ms: number;
+    summary_revision: number;
+    indexed_at: string;
+    damaged: number;
+}
+export declare function hashSecret(secret: string): string;
+export declare function secretMatches(secret: string, expectedHex: string): boolean;
+export declare function boundedMs(value: number | undefined, fallback: number, max: number): number;
+export declare function parseJson<T>(value: string): T;
+export declare function conflict(message: string): Error;
+export declare function assertId(value: string, label?: string): void;
+export declare function boundPresenceValue(value: unknown, depth: number): unknown;
+export declare function configureCatalogDatabase(db: DatabaseSync): void;
+export declare function initializeCatalogSchema(db: DatabaseSync): void;
+//# sourceMappingURL=store-schema.d.ts.map

package/dist/session-catalog/store.d.ts

@@ -17,21 +17,6 @@ export declare class SessionCatalogStore {
     private reapExpired;
     private maintenanceExists;
     private leaseRow;
-    /**
-     * True when `sessionId` has a live `session_leases` row owned by a
-     * different OS process than the *caller*. Used by
-     * `acquireMaintenance` to distinguish "another running wstack" (which
-     * must be fenced off) from "this very TUI owning its own session"
-     * (which is allowed to claim a non-destructive maintenance lease on
-     * its own transcript).
-     *
-     * `callerPid` must be the pid of the process that asked for the lease,
-     * NOT `process.pid`. In the built runtime this store lives inside the
-     * detached project-catalog daemon, so `process.pid` is the daemon's and
-     * would mark every lease — including the caller's own session — foreign,
-     * making `/clear` and `/rewind` fail with "Session … is live". Callers
-     * that run the store in-process may omit it.
-     */
     private foreignLiveLease;
     private verifyCredential;
     private createLease;
@@ -64,8 +49,6 @@ export declare class SessionCatalogStore {
         indexed: number;
         damaged: number;
     };
-    private walkFiles;
-    private summarizeTranscript;
     health(base: Omit<SessionCatalogHealth, 'catalogRows' | 'damagedRows' | 'liveLeases' | 'reservations' | 'maintenanceLeases' | 'generation' | 'lastReconciliation'>): SessionCatalogHealth;
 }
 //# sourceMappingURL=store.d.ts.map

package/dist/storage/cloud-config-sync/sanitize.d.ts

@@ -15,6 +15,13 @@
  *
  * Stripping is therefore structural (projection), with `stripSecretMaterial` as a final
  * defense-in-depth pass mirroring the server's own scan.
+ *
+ * The two directions do NOT share one gate. "What may leave this machine" and "what may
+ * a remote peer write into the trusted profile config" are different questions, and the
+ * outbound tree is a wrong — dangerously permissive — answer to the second: it names
+ * `mcpServers.*.command`, `plugins`, `providers.*.baseUrl` and `yolo` as contract-owned,
+ * because pushing them is harmless. Pulls are therefore gated on `INBOUND_CONTRACT`, the
+ * outbound tree minus `INBOUND_DENIED_PATHS`.
  */
 /** `true` = the whole value is contract-owned; an object = recurse per key; `'*'` = record wildcard. */
 export type ContractNode = true | {
@@ -23,6 +30,17 @@ export type ContractNode = true | {
 /** Namespace → the contract tree over the `config.json` top-level keys it owns. */
 export declare const CLOUD_SYNC_CONTRACT: Readonly<Record<string, ContractNode>>;
 export declare const CLOUD_SYNC_NAMESPACES: string[];
+/**
+ * Every inbound-denied path must still resolve against the outbound contract.
+ *
+ * A denylist that silently stops matching is worse than no denylist: it reads
+ * as protection while granting the field. Renaming `mcpServers.*.command` in
+ * the contract without updating the entry here must break the build, not
+ * quietly re-open remote code execution.
+ */
+export declare function assertInboundDenyListResolves(): void;
+/** Exposed for tests and diagnostics — the effective pull-side allow tree. */
+export declare function inboundContractFor(namespace: string): ContractNode | undefined;
 /** Server-side schema versions, sent in every push envelope. */
 export declare const NAMESPACE_SCHEMA_VERSIONS: Readonly<Record<string, number>>;
 /**

package/dist/storage/cloud-config-sync.d.ts

@@ -1,4 +1,4 @@
-export { applyNamespacePayload, buildNamespacePayloads, CLOUD_SYNC_CONTRACT, CLOUD_SYNC_NAMESPACES, LOCAL_ONLY_TOP_LEVEL, NAMESPACE_SCHEMA_VERSIONS, stripSecretMaterial, } from './cloud-config-sync/sanitize.js';
+export { applyNamespacePayload, assertInboundDenyListResolves, buildNamespacePayloads, CLOUD_SYNC_CONTRACT, CLOUD_SYNC_NAMESPACES, inboundContractFor, LOCAL_ONLY_TOP_LEVEL, NAMESPACE_SCHEMA_VERSIONS, stripSecretMaterial, } from './cloud-config-sync/sanitize.js';
 /**
  * CloudConfigSync — synchronizes the profile config with my.wrongstack.com over the
  * namespaced sync API v1 (server repo: docs/CLIENT_SYNC_CONTRACT.md).

package/dist/storage/director-state.d.ts

@@ -127,6 +127,12 @@ export declare class DirectorStateCheckpoint {
      * checkpoint continues from there.
      */
     resume(snapshot: DirectorStateSnapshot): void;
+    /**
+     * Reconciles tasks and worktrees that were left in 'running' or 'allocated'
+     * state when the previous director crashed. Transitions abandoned tasks to
+     * 'failed' with a descriptive error and returns the list of repaired task IDs.
+     */
+    reconcileCrashedState(reason?: string): string[];
     /**
      * After resume, pin the live spawn ceiling from the current profile/flag
      * while preserving `spawnCount` (cumulative used budget). Checkpoint

package/dist/storage/file-session-writer.d.ts

@@ -20,10 +20,8 @@ export declare class FileSessionWriter implements SessionWriter {
     private closed;
     private closePromise;
     private manifestFile;
-    private summary;
-    private tokenIn;
-    private tokenOut;
-    private baseTokenTotal;
+    private readonly summaryTracker;
+    private readonly buffer;
     private readonly filePath;
     get transcriptPath(): string | undefined;
     /**
@@ -35,8 +33,6 @@ export declare class FileSessionWriter implements SessionWriter {
     private initPromise;
     private ensureInit;
     private readonly resumed;
-    private appendFailCount;
-    private lastAppendWarnAt;
     private readonly secretScrubber?;
     private readonly checkpointCas?;
     /** Mutable slot for onAppend callback — constructor opts seed it, setOnAppend replaces it. */
@@ -50,7 +46,6 @@ export declare class FileSessionWriter implements SessionWriter {
     get onAppendBatch(): ((events: SessionEvent[]) => void) | undefined;
     set onAppendBatch(cb: ((events: SessionEvent[]) => void) | undefined);
     private readonly onCloseCb?;
-    private readonly resolveNameCb?;
     /** Implements SessionWriter.traceId — propagated from ContextInit.traceId. */
     traceId: string | undefined;
     /**
@@ -62,39 +57,12 @@ export declare class FileSessionWriter implements SessionWriter {
      * Set or replace the onAppendBatch callback.
      */
     setOnAppendBatch(cb: ((events: SessionEvent[]) => void) | undefined): void;
-    private writeBuffer;
-    private writeBufferBytes;
-    private flushTimer;
-    private static readonly FLUSH_INTERVAL_MS;
-    private static readonly FLUSH_SIZE;
-    private static readonly WRITE_BUFFER_MAX_EVENTS;
-    private static readonly WRITE_BUFFER_MAX_BYTES;
-    private bufferOverflowCount;
-    private lastBufferOverflowWarnAt;
-    private eventBytes;
-    private pushWriteBuffer;
-    private writeChain;
-    private flushPromise;
-    /** Enqueue a write on the FIFO chain. Resolves/rejects with that write. */
-    private enqueueWrite;
-    private iterationCount;
-    private toolCallCount;
-    private toolErrorCount;
-    private toolBreakdown;
-    private fileChangeCount;
-    private compactionCount;
-    private messageCount;
-    private lastUserMessage;
-    private lastActivityAt;
-    private outcome;
     private pendingFileSnapshots;
     private pendingFileSnapshotBytes;
     private static readonly PENDING_FILE_SNAPSHOT_MAX_ENTRIES;
     private static readonly PENDING_FILE_SNAPSHOT_MAX_BYTES;
     /** Prompt whose tool work is currently executing. Set by writeCheckpoint. */
     private activePromptIndex;
-    /** Tracks open tool_use IDs during the current run to serialize on close for resume. */
-    private openToolUses;
     /**
      * Buffer an event from a synchronous Context callback. ensureInit() starts
      * by pushing the lifecycle preamble synchronously, so session_start always
@@ -159,30 +127,6 @@ export declare class FileSessionWriter implements SessionWriter {
      * be cut off by the exit regardless; errors here are swallowed.
      */
     flushSync(): void;
-    /** Schedule a deferred flush. No-op if a timer is already pending. */
-    private scheduleFlush;
-    /**
-     * Flush all buffered events to disk as a single appendFile call.
-     * Concurrent callers join one coalesced drain. On failure the drained batch
-     * is prepended to the live buffer, preserving chronology and allowing the
-     * next timer/boundary flush to retry it. Warnings retain the existing
-     * throttled behavior.
-     */
-    private flushBuffer;
-    private flushBufferOnce;
-    /**
-     * Rebuild every accumulated summary counter by replaying the JSONL as it now
-     * stands on disk.
-     *
-     * Only truncation needs this: the counters are fed by `observeForSummary` as
-     * events go by and cannot un-count. Stream the JSONL so a very long session
-     * does not need a second file-sized allocation during rewind.
-     *
-     * `title` is deliberately re-derived too: the first surviving user_input may
-     * differ once earlier prompts are gone.
-     */
-    private recomputeSummaryFromDisk;
-    private observeForSummary;
     close(): Promise<void>;
     private doClose;
     writeCheckpoint(promptIndex: number, promptPreview: string): Promise<void>;

package/dist/storage/index.d.ts

@@ -30,6 +30,7 @@ export { type PromptUsage, PromptUsageStore } from './prompt-usage-store.js';
 export { type ProviderConfigSnapshot, readProviderSnapshot, type WatchProviderConfigOptions, watchProviderConfig, } from './provider-config-watcher.js';
 export { type PersistedQueueItem, QUEUE_MAX_BYTES, QUEUE_MAX_ITEM_BYTES, QUEUE_MAX_ITEMS, QueueStore, retainPersistedQueueItems, } from './queue-store.js';
 export { type AbandonedSession, RecoveryLock, type RecoveryLockOptions, } from './recovery-lock.js';
+export { cleanOrphanLocks, type OrphanLockCleanResult, } from './orphan-lock-cleaner.js';
 export { type ReplayEntry, ReplayLogStore, type ReplayLogStoreOptions, } from './replay-log-store.js';
 export { SessionAnalyzer } from './session-analyzer.js';
 export { type CheckpointGitResult, SessionCheckpointCas, type SessionCheckpointCasOptions, } from './session-checkpoint-cas.js';
@@ -38,7 +39,7 @@ export { generateSessionId, sanitizeModel } from './session-id.js';
 export { resolveSessionId, type SessionIdResolution, sessionIdResolutionError, } from './session-id-resolver.js';
 export { scrubPersistedSessionData, scrubPersistedSessionEvent, scrubPersistedSessionSummary, } from './session-read-scrubber.js';
 export { DefaultSessionReader } from './session-reader.js';
-export { type RecoveryPlan, SessionRecovery, type StaleSession, } from './session-recovery.js';
+export { extractInterruptedTools, type InterruptedToolDetail, type RecoveryPlan, SessionRecovery, type StaleSession, } from './session-recovery.js';
 export { type ApplyRewindOptions, type ApplyRewindResult, applyRewindToConversation, type RewindableConversation, } from './session-rewind-apply.js';
 export { DefaultSessionRewinder, type SessionRewinderOptions, } from './session-rewinder.js';
 export { DefaultSessionStore, type SessionStoreOptions, } from './session-store.js';