@wrongstack/core 0.308.7 → 0.309.1

package/dist/skills/index.js

@@ -888,6 +888,32 @@ function numField(rec, key) {
 import { spawn } from "node:child_process";
 import * as fs3 from "node:fs/promises";
 import * as path3 from "node:path";
+
+// src/utils/win32-cmd.ts
+var WIN32_CMD_META = /[&|<>"%\r\n\0]/;
+function buildWin32CmdShimInvocation(command, args = []) {
+  assertSafeWin32CmdArgs([command, ...args]);
+  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
+  return {
+    command: process.env["COMSPEC"] ?? "cmd.exe",
+    args: ["/d", "/c", line],
+    windowsVerbatimArguments: true
+  };
+}
+function assertSafeWin32CmdArgs(args) {
+  for (const arg of args) {
+    if (typeof arg === "string" && WIN32_CMD_META.test(arg)) {
+      throw new Error(
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+      );
+    }
+  }
+}
+function quoteWin32CmdArg(arg) {
+  return `"${arg}"`;
+}
+
+// src/skills/skill-generator.ts
 async function validateSkillNameAvailable(name, loader) {
   const formatViolations = validateSkillName(name);
   const conflicts = loader ? (await loader.listEntries()).filter((e) => e.name === name) : [];
@@ -989,14 +1015,21 @@ async function openInEditor(filePath, env = process.env) {
       context: { filePath }
     });
   }
-  const child = spawn(parts[0], [...parts.slice(1), filePath], {
+  const editorArgs = [...parts.slice(1), filePath];
+  const child = shell ? (() => {
+    const inv = buildWin32CmdShimInvocation(parts[0], editorArgs);
+    return spawn(inv.command, inv.args, {
+      stdio: "ignore",
+      detached: true,
+      windowsVerbatimArguments: inv.windowsVerbatimArguments,
+      // Suppresses the console flash the cmd.exe wrapper would otherwise
+      // show before the editor appears. Repo convention — see
+      // `core/tests/architecture/spawn-convention.test.ts`.
+      windowsHide: true
+    });
+  })() : spawn(parts[0], editorArgs, {
     stdio: "ignore",
     detached: true,
-    shell,
-    // `shell` routes through cmd.exe on win32, which flashes a console window
-    // before the editor appears. A GUI editor is unaffected by the flag; the
-    // shell wrapper is what it suppresses. Repo convention — see
-    // `core/tests/architecture/spawn-convention.test.ts`.
     windowsHide: true
   });
   child.unref();

package/dist/storage/index.js

@@ -1738,6 +1738,14 @@ var PATTERNS = [
     anchor: "sk-ant-"
   },
   { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  {
+    // `xai` is a first-class provider in this codebase, but its key shape was
+    // absent here — so the one credential format WrongStack itself hands users
+    // was the one the scrubber could not recognize (audit 2026-08-20).
+    type: "xai_key",
+    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    anchor: "xai-"
+  },
   { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
   { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
   { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
@@ -1828,8 +1836,8 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
   },
   {
     type: "json_credential_key",
@@ -1946,6 +1954,27 @@ var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
+var PEM_END_MARKER = "-----END";
+var MAX_PEM_BLOCK_BYTES = 64 * 1024;
+var PEM_END_LINE_TOLERANCE = 64;
+function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
+  const head = text.slice(chunkStart, proposedEnd);
+  const lastBegin = head.lastIndexOf("-----BEGIN ");
+  if (lastBegin === -1) return proposedEnd;
+  const fromBegin = text.slice(chunkStart + lastBegin);
+  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
+  if (!marker || marker.index !== 0) return proposedEnd;
+  const bodyStart = marker[0].length;
+  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
+  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
+  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
+    return proposedEnd;
+  }
+  const lineEnd = fromBegin.indexOf("\n", closeIdx);
+  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
+  return Math.max(proposedEnd, end);
+}
 var PATTERN_ANCHORS = [
   ...new Set(
     PATTERNS.flatMap(
@@ -1982,6 +2011,7 @@ var DefaultSecretScrubber = class {
           }
         }
         end = safe === -1 ? end : safe + 1;
+        end = extendChunkBoundaryPastPem(text, i, end);
       }
       out.push(this.scrubOne(text.slice(i, end)));
       i = end;
@@ -4639,7 +4669,7 @@ function walk(node, vault, transform) {
   }
   return out;
 }
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
+var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
 var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
 function isSecretField(name) {
   const lc = name.toLowerCase();
@@ -5344,6 +5374,17 @@ var IN_PROJECT_DENIED_PATHS = [
     // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
     path: "features.mailboxBridge",
     reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
+  },
+  {
+    // `plugins` is already denied above, so a repo cannot ADD a plugin. This
+    // closes the other half: a repo could previously ship
+    // `{"features":{"pluginsTrust":false}}` and switch off the integrity gate
+    // for plugins the user had ALREADY installed globally — disarming the
+    // trust-on-first-use pin that exists to catch a supply-chain update
+    // rewriting a plugin's entry file. Same operator-owned class as the
+    // switches above.
+    path: "features.pluginsTrust",
+    reason: "Disables the plugin trust-on-first-use integrity gate, re-trusting changed code in already-installed global plugins."
   }
 ];
 function deleteNestedPath(target, path36) {

package/dist/types/index.d.ts

@@ -34,7 +34,7 @@ export { BUILTIN_PROMPT_CATEGORIES, isBuiltinCategory, PROMPT_CATEGORY_LABELS }
 export type { InstalledPromptEntry, ManifestValidation, PromptManifestData, PromptRegistryManifest, PromptRegistryRef, RegistryDiff, } from './prompt-registry.js';
 export { diffRegistry, validateRegistryManifest } from './prompt-registry.js';
 export type { CacheTtl, Capabilities, JsonSchemaSpec, Provider, ProviderContextLimit, ProviderErrorBody, ProviderErrorKind, ReasoningConfig, ReasoningEffort, ReasoningRequest, Request, RequestCacheControl, Response, ResponseFormat, SafetySetting, StopReason, StreamEvent, Usage, } from './provider.js';
-export { classifyProviderError, effectiveInputTokens, isContextOverflowShaped, isFallbackWorthy, isRetryableKind, ProviderError, StreamHangError, } from './provider.js';
+export { classifyProviderError, effectiveInputTokens, isContextOverflowShaped, isFallbackWorthy, isReasoningEffort, isRetryableKind, ProviderError, REASONING_EFFORT_LEVELS, StreamHangError, } from './provider.js';
 export type { ProviderRunner, RunProviderOptions } from './provider-runner.js';
 export type { Renderer } from './renderer.js';
 export type { SecretScrubber } from './secret-scrubber.js';

package/dist/types/index.js

@@ -914,6 +914,18 @@ function truncate(s, max) {
 var QUOTA_EXHAUSTED_RE = /(?:insufficient|exhausted|depleted|exceeded|no|not enough)[-_\s]*(?:quota|credit|balance)|(?:quota|credit|balance)(?:\s+(?:has|have))?(?:\s+been)?[-_\s]*(?:exhausted|depleted|exceeded|insufficient)|billing[_\s-]*(?:hard[_\s-]*)?limit|payment required|spending limit|plan limit|usage[-_\s]*limit[-_\s]*(?:reached|exceeded)/i;
 
 // src/types/provider.ts
+var REASONING_EFFORT_LEVELS = [
+  "none",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max"
+];
+function isReasoningEffort(value) {
+  return typeof value === "string" && REASONING_EFFORT_LEVELS.includes(value);
+}
 function effectiveInputTokens(usage) {
   return usage.input + (usage.cacheRead ?? 0) + (usage.cacheWrite ?? 0);
 }
@@ -1346,6 +1358,7 @@ export {
   ParseError,
   PluginError,
   ProviderError,
+  REASONING_EFFORT_LEVELS,
   SESSION_MARKER_EVENT_TYPES,
   SYSTEM_INJECTION_PREFIXES,
   SddError,
@@ -1377,6 +1390,7 @@ export {
   isImageBlock,
   isParseError,
   isPluginError,
+  isReasoningEffort,
   isRetryableKind,
   isSddError,
   isSessionError,

package/dist/types/multi-agent.d.ts

@@ -142,6 +142,21 @@ export interface SubagentConfig {
         end: string;
         mode?: 'advisory' | 'enforce' | undefined;
     } | undefined;
+    /**
+     * Model-driven completion policy. When set, this subagent is NEVER killed
+     * by the wall-clock watchdog at its deadline: instead the deadline (or an
+     * explicit `Director.requestFinish()`) triggers an in-band
+     * `subagent.finish_requested` notification that the agent loop folds into
+     * the conversation between tool batches — the model then finishes its task
+     * in its own turn within `graceMs` of legitimate working time. Only after
+     * that grace window elapses does the existing terminal stop apply, so the
+     * subagent still has a bounded maximum lifetime.
+     *
+     * `undefined` (default) keeps the legacy watchdog behavior unchanged.
+     */
+    gracefulFinish?: boolean | {
+        graceMs?: number | undefined;
+    } | undefined;
     /**
      * Runtime request overrides for THIS subagent. When present, these are merged
      * over the leader's `Config.modelRuntime` before the subagent request pipeline

package/dist/types/provider.d.ts

@@ -23,6 +23,21 @@ import type { Tool } from './tool.js';
  * cached tokens twice and skew cache-hit-ratio reporting.
  */
 export type ReasoningEffort = 'none' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max';
+/**
+ * The canonical runtime list of {@link ReasoningEffort} values, in
+ * menu/display order. Single source of truth for every surface that needs to
+ * iterate the levels (CLI `/settings` + `/setmodel`, the TUI picker, the
+ * WebUI dropdown) — import this instead of re-declaring a local array, which
+ * is how drift crept in before.
+ *
+ * `satisfies` pins the literal to the union: a value here core's type doesn't
+ * know is a compile error. Note the reverse is NOT caught — core adding a
+ * level does not force this array to grow, so consumers validating user input
+ * against it must decide deliberately whether to expose the new level.
+ */
+export declare const REASONING_EFFORT_LEVELS: readonly ["none", "minimal", "low", "medium", "high", "xhigh", "max"];
+/** Type guard for untrusted strings (CLI args, WS payloads, config files). */
+export declare function isReasoningEffort(value: unknown): value is ReasoningEffort;
 export type CacheTtl = '5m' | '1h';
 /**
  * Provider-agnostic response-format directive.
@@ -119,7 +134,20 @@ export interface RequestCacheControl {
 export interface ReasoningConfig {
     default: 'enabled' | 'disabled' | 'adaptive' | 'always_on';
     disableSupported: boolean;
-    effortSupported: boolean;
+    /**
+     * Tri-state effort support:
+     *   `true`      — the catalog documents this model's effort levels
+     *                 (`effortLevels` is authoritative).
+     *   `false`     — the catalog documents effort control as absent
+     *                 (toggle-only or budget_tokens-only reasoning options).
+     *   `undefined` — the model is known to reason (`reasoning: true`) but its
+     *                 effort vocabulary is not documented. The resolver forwards
+     *                 the requested effort; each wire adapter then applies its
+     *                 own transport-level gating (allowlist, mapping, or omit),
+     *                 so an undocumented model can only match-or-omit — never
+     *                 receive a field shape it did not advertise.
+     */
+    effortSupported?: boolean | undefined;
     effortLevels: ReasoningEffort[];
     preserveThinking: 'unsupported' | 'optional' | 'always_on';
 }

package/dist/types/tool.d.ts

@@ -101,6 +101,21 @@ export interface Tool<I = unknown, O = unknown> {
      * fall back to the heuristic.
      */
     subjectKey?: string | undefined;
+    /**
+     * Extra input fields folded into the permission subject, after `subjectKey`.
+     *
+     * For a shell-style tool the subject is the whole command line, so the trust
+     * rule is as specific as the invocation. A tool whose parameters are NAMED
+     * FIELDS rather than an argv array has no such luck: `git` sets
+     * `subjectKey: 'command'`, whose value is an enum subcommand, so every
+     * `git push` — any branch, `force` or not — rendered to the subject `"push"`
+     * and one "always allow" covered them all (audit 2026-08-20).
+     *
+     * List the fields that change what the call actually does. Absent fields are
+     * skipped, so adding a field only narrows existing rules (they degrade to a
+     * confirm prompt) and never silently widens one.
+     */
+    subjectFields?: readonly string[] | undefined;
     maxOutputBytes?: number | undefined;
     timeoutMs?: number | undefined;
     /**

package/dist/utils/index.d.ts

@@ -44,6 +44,7 @@ export { withSqliteExperimentalWarningSuppressed } from './sqlite-warning.js';
 export * from './string.js';
 export * from './task-format.js';
 export { buildSgrSequence, buildTitleSequence, type ColorDepth, detectTerminal, ESCAPE_TERMINATOR, type EscapeEmitResult, type EscapeSequence, isStdinTTY, type MouseProtocol, onResize, safeEmit, setOutputLineGuard, setRawMode, setTitle, type TerminalCapability, TerminalLifecycle, writeErr, writeOut, } from './term.js';
+export { sanitizeTerminalPreview, sanitizeTerminalText } from './terminal-sanitize.js';
 export * from './todos-format.js';
 export { computeMessageTokens, estimateMessageTokens, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, getCalibrationState, type RequestTokenBreakdown, recordActualUsage, resetCalibration, } from './token-estimate.js';
 export { applyToolDescriptionModes, applyToolDescriptionModeToTool, DEFAULT_TOOL_DESCRIPTION_MODE, getToolDescriptionMode, normalizeToolDescriptionMode, resolveToolDescriptionMode, setToolDescriptionMode, simplifyToolDescription, type ToolDescriptionRegistryLike, } from './tool-description-mode.js';

package/dist/utils/index.js

@@ -4710,6 +4710,42 @@ function formatTaskList(tasks) {
   return lines.join("\n");
 }
 
+// src/utils/terminal-sanitize.ts
+var ANSI_RE = /\x1b\[[0-?]*[ -/]*[@-~]/g;
+var ANSI_OSC_RE = /\x1b\][\s\S]*?(?:\x07|\x1b\\)/g;
+var ANSI_CONTROL_STRING_RE = /\x1b[P^_X][\s\S]*?\x1b\\/g;
+var ANSI_ESCAPE_RE = /\x1b[ -/]*[@-~]/g;
+var BIDI_AND_ZERO_WIDTH_RE = /[​-‏‪-‮⁦-⁩]/g;
+function sanitizeTerminalText(value, tabWidth = 2) {
+  const tab = " ".repeat(Math.max(1, Math.min(8, Math.floor(tabWidth))));
+  const withoutEscapes = value.replace(ANSI_OSC_RE, "").replace(ANSI_CONTROL_STRING_RE, "").replace(ANSI_RE, "").replace(ANSI_ESCAPE_RE, "").replace(BIDI_AND_ZERO_WIDTH_RE, "").replace(/\t/g, tab).replace(/\r/g, "");
+  let safe = "";
+  for (const char of withoutEscapes) {
+    const code = char.codePointAt(0) ?? 0;
+    if (char === "\n" || code >= 32 && code !== 127 && !(code >= 128 && code <= 159)) {
+      safe += char;
+    }
+  }
+  return safe;
+}
+function sanitizeTerminalPreview(value, opts = {}) {
+  const maxLines = opts.maxLines ?? 40;
+  const maxChars = opts.maxChars ?? 8e3;
+  const safe = sanitizeTerminalText(value, opts.tabWidth);
+  let truncated = false;
+  let clipped = safe;
+  if (clipped.length > maxChars) {
+    clipped = clipped.slice(0, maxChars);
+    truncated = true;
+  }
+  const lines = clipped.split("\n");
+  if (lines.length > maxLines) {
+    clipped = lines.slice(0, maxLines).join("\n");
+    truncated = true;
+  }
+  return { text: clipped, truncated };
+}
+
 // src/utils/tool-description-mode.ts
 var DEFAULT_TOOL_DESCRIPTION_MODE = "extend";
 var ORIGINAL_TOOL_DESCRIPTION = /* @__PURE__ */ Symbol.for("wrongstack.tool.originalDescription");
@@ -5589,9 +5625,21 @@ function renderCommandLine(command, args) {
   });
   return [command, ...rendered].join(" ");
 }
-function subjectForToolInput(toolName, input, subjectKey) {
+function renderSubjectFields(obj, fields) {
+  const parts = [];
+  for (const field of fields) {
+    const value = obj[field];
+    if (value === void 0 || value === null || value === "" || value === false) continue;
+    const str = String(value);
+    parts.push(`${field}=${/\s/.test(str) ? `"${str.replace(/"/g, '\\"')}"` : str}`);
+  }
+  return parts.join(" ");
+}
+function subjectForToolInput(toolName, input, subjectKey, subjectFields) {
   if (!input || typeof input !== "object") return void 0;
   const obj = input;
+  const extra = subjectFields && subjectFields.length > 0 ? renderSubjectFields(obj, subjectFields) : "";
+  const withExtra = (base) => extra ? `${base} ${extra}` : base;
   if (subjectKey) {
     const value = obj[subjectKey];
     if (Array.isArray(value)) {
@@ -5607,9 +5655,9 @@ function subjectForToolInput(toolName, input, subjectKey) {
       if (subjectKey === "command") {
         const rendered = renderCommandLine(value, obj["args"]);
         if (value === "commit" && obj["dry_run"] === true) {
-          return `${escapeGlobSubject(rendered)}:dry-run`;
+          return `${escapeGlobSubject(withExtra(rendered))}:dry-run`;
         }
-        return escapeGlobSubject(rendered);
+        return escapeGlobSubject(withExtra(rendered));
       }
       if (subjectKey === "directory" && obj["dry_run"] === true) {
         return `${escapeGlobSubject(value)}:dry-run`;
@@ -5662,7 +5710,7 @@ var DEFAULT_WALK_IGNORE_DIRS = Object.freeze([
 var DEFAULT_WALK_IGNORE_SET = new Set(DEFAULT_WALK_IGNORE_DIRS);
 
 // src/utils/win32-cmd.ts
-var WIN32_CMD_META = /[&|<>"\r\n\0]/;
+var WIN32_CMD_META = /[&|<>"%\r\n\0]/;
 function buildWin32CmdShimInvocation(command, args = []) {
   assertSafeWin32CmdArgs([command, ...args]);
   const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
@@ -5893,6 +5941,8 @@ export {
   sanitizeMemoryEvidenceBody,
   sanitizeMemoryEvidenceSource,
   sanitizeNodeOptions,
+  sanitizeTerminalPreview,
+  sanitizeTerminalText,
   sanitizeWireToolName,
   sessionScopedPath,
   setJsonPath,

package/dist/utils/terminal-sanitize.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Sanitize untrusted text before it is written to a terminal.
+ *
+ * Any surface that renders model-supplied, file-supplied or MCP-supplied text
+ * into a TTY must run it through here first. Escape sequences in that text can
+ * paint outside the region that owns it: `\x1b[2J\x1b[H` clears the screen and
+ * homes the cursor, which lets a payload erase a permission prompt's header and
+ * repaint a convincing fake above the genuine key prompt. The user then answers
+ * the real prompt while reading the attacker's body.
+ *
+ * Bidi and zero-width controls are stripped for the same reason at a different
+ * layer: they reorder or hide characters so the rendered string differs from
+ * the string that will actually be executed (the "Trojan Source" class).
+ *
+ * This is the single source. `@wrongstack/tui` has its own copy for layout
+ * measurement; the CLI permission prompt and diff renderer call this one.
+ */
+/**
+ * Strip terminal escapes, bidi/zero-width controls and non-printable characters
+ * from `value`, normalizing tabs to a fixed-width separator.
+ *
+ * Newlines are preserved; carriage returns are removed so a payload cannot
+ * return to the start of a line and overwrite what was already drawn.
+ */
+export declare function sanitizeTerminalText(value: string, tabWidth?: number): string;
+/**
+ * Sanitize and hard-cap untrusted text destined for a terminal preview.
+ *
+ * A line cap alone is not a bound: a single 200,000-character line passes a
+ * 40-line limit untouched and can scroll a prompt off screen. Callers that show
+ * a preview of attacker-influenced content should bound both dimensions.
+ */
+export declare function sanitizeTerminalPreview(value: string, opts?: {
+    maxLines?: number;
+    maxChars?: number;
+    tabWidth?: number;
+}): {
+    text: string;
+    truncated: boolean;
+};
+//# sourceMappingURL=terminal-sanitize.d.ts.map

package/dist/utils/tool-subject.d.ts

@@ -1,5 +1,5 @@
 export declare function escapeGlobSubject(value: string): string;
 export declare function normalizePathSubject(value: string): string;
 export declare function isPathSubjectKey(subjectKey: string): boolean;
-export declare function subjectForToolInput(toolName: string, input: unknown, subjectKey?: string): string | undefined;
+export declare function subjectForToolInput(toolName: string, input: unknown, subjectKey?: string, subjectFields?: readonly string[]): string | undefined;
 //# sourceMappingURL=tool-subject.d.ts.map

package/instructions/agents/chaos-monkey.md

@@ -0,0 +1,61 @@
+You are the Chaos Monkey ("Kaos Maymunu") — a mutation-testing saboteur for the
+WrongStack fleet. Your job is to prove whether a test suite actually pins down
+the code it claims to cover, by deliberately breaking that code and watching
+which mutants survive.
+
+Core belief: green tests prove nothing if they cannot detect sabotage. A mutant
+that survives means the tests are fake or insufficient — and that is the most
+valuable finding you can return.
+
+## Your task contract
+
+The director hands you a mutation plan: an exact list of mutation ids, each with
+file, line, column, kind, original token and replacement token. The plan is
+authoritative — you NEVER invent, move, or "improve" mutations. Your freedom is
+execution order and diagnosis, never the mutation set.
+
+## Check pass (per mutant)
+
+1. Apply exactly ONE mutation from the plan to its anchored (file, line, column).
+   If the anchored token no longer matches `original`, mark the mutant
+   `skipped` with the drift as evidence — do not hunt for a "similar" site.
+2. Run the provided test command exactly as given.
+3. Record the outcome:
+   - Tests fail → mutant `killed` (quote the first failing assertion).
+   - Tests pass → mutant `survived` (this is a weak-test finding, not your failure).
+   - The test command times out or is aborted → mutant `killed-by-hang`
+     (the mutation broke the suite by non-termination — a kill, NOT a
+     survivor; record the timeout as evidence). Never report a hung
+     command as `survived`.
+4. Restore the original source byte-for-byte before moving to the next mutant.
+   The suite is only honest if every mutant ran against pristine code except
+   its own single mutation.
+
+## Hard rules
+
+- **One mutation at a time.** Never stack mutants; a stacked run measures nothing.
+- **Always restore.** Your worktree must be clean of sabotage at the end of the
+  pass. If restore fails, stop and report which file is left mutated.
+- **Stay inside the plan's files.** No refactors, no fixes, no formatting churn
+  — even when the mutated code looks wrong to you. You are the saboteur, not
+  the reviewer.
+- **Deterministic.** Same plan + same suite → same report.
+- **One-shot lifecycle.** Finish the assigned pass, submit the report, stop.
+
+## Report
+
+Submit via `submit_result`, then repeat it as your final text (fenced JSON):
+
+```json
+{
+  "summary": "<one line: N killed / M survived / K skipped>",
+  "mutants": [
+    { "id": "<plan id>", "file": "...", "line": 0, "kind": "...",
+      "status": "killed | survived | skipped | killed-by-hang",
+      "evidence": "<failing assertion, or 'suite green' for survivors>" }
+  ]
+}
+```
+
+Order survivors first — they are the actionable findings. For each survivor,
+name the boundary or behavior the tests failed to assert.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/core",
-  "version": "0.308.7",
+  "version": "0.309.1",
   "license": "MIT",
   "description": "WrongStack core: kernel, types, defaults, and shared utilities for the WrongStack CLI agent.",
   "repository": {
@@ -182,8 +182,8 @@
   "wrongstackApiVersion": "0.1.10",
   "dependencies": {
     "zod": "4.4.3",
-    "@wrongstack/persistence": "0.308.7",
-    "@wrongstack/kanban": "0.308.7"
+    "@wrongstack/kanban": "0.309.1",
+    "@wrongstack/persistence": "0.309.1"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
@@ -193,7 +193,7 @@
     "access": "public"
   },
   "optionalDependencies": {
-    "@datadog/pprof": "5.18.0"
+    "@datadog/pprof": "5.18.1"
   },
   "scripts": {
     "build": "node ../../scripts/build-package.mjs",