@wrongstack/core 0.308.7 → 0.309.1

package/dist/execution/index.js

@@ -11592,7 +11592,7 @@ function resolveReasoningForRequest(settings, rc, warnings) {
   const cfg = settings.reasoning;
   if (!cfg) return void 0;
   const capKnown = rc !== void 0;
-  const supportsReasoning = rc ? rc.default !== "disabled" || rc.disableSupported || rc.effortSupported : false;
+  const supportsReasoning = rc ? rc.default !== "disabled" || rc.disableSupported || rc.effortSupported !== false : false;
   const out = {};
   if (cfg.mode === "off") {
     if (capKnown && rc?.disableSupported) {
@@ -11614,14 +11614,17 @@ function resolveReasoningForRequest(settings, rc, warnings) {
   }
   const effort = cfg.effort;
   if (effort !== void 0) {
-    if (capKnown && rc?.effortSupported && rc.effortLevels.includes(effort)) {
-      out.effort = effort;
-    } else if (capKnown && rc?.effortSupported) {
+    if (!capKnown) {
+    } else if (rc?.effortSupported === false) {
+      warnings.push(
+        `reasoning effort "${effort}" requested, but this model does not support effort control; the setting was omitted.`
+      );
+    } else if (rc?.effortSupported === true && rc.effortLevels.length > 0 && !rc.effortLevels.includes(effort)) {
       warnings.push(
         `reasoning effort "${effort}" not supported by this model (supported: ${rc.effortLevels.join(", ")}); the setting was omitted.`
       );
-    } else if (capKnown) {
-      warnings.push(`reasoning effort "${effort}" requested, but this model does not support effort; the setting was omitted.`);
+    } else {
+      out.effort = effort;
     }
   }
   if (cfg.preserve !== void 0) {
@@ -11973,6 +11976,46 @@ function asTextBlocks(system) {
 // src/execution/parallel-eternal-engine.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 
+// src/core/btw.ts
+var META_KEY2 = "_btwNotes";
+var MAX_PENDING = 20;
+function readQueue(ctx) {
+  const raw = ctx.meta[META_KEY2];
+  return Array.isArray(raw) ? raw : [];
+}
+function setBtwNote(ctx, text) {
+  const trimmed = text.trim();
+  if (!trimmed) return readQueue(ctx).length;
+  const next = [...readQueue(ctx), trimmed].slice(-MAX_PENDING);
+  ctx.meta[META_KEY2] = next;
+  return next.length;
+}
+
+// src/coordination/subagent-finish.ts
+var SUBAGENT_FINISH_REQUESTED_EVENT = "subagent.finish_requested";
+var DEFAULT_SUBAGENT_FINISH_GRACE_MS = 12e4;
+function resolveGracefulFinish(config) {
+  const raw = config.gracefulFinish;
+  if (raw === void 0 || raw === false) return void 0;
+  if (raw === true) return { graceMs: DEFAULT_SUBAGENT_FINISH_GRACE_MS };
+  const graceMs = typeof raw.graceMs === "number" && Number.isFinite(raw.graceMs) && raw.graceMs > 0 ? Math.floor(raw.graceMs) : DEFAULT_SUBAGENT_FINISH_GRACE_MS;
+  return { graceMs };
+}
+function buildSubagentFinishNotice(input) {
+  const localTime = new Date(input.deadlineMs).toISOString();
+  const seconds = Math.max(1, Math.round(input.graceMs / 1e3));
+  const timeLeft = input.graceMs > 0 ? `You have roughly ${seconds} seconds (until ${localTime}) of legitimate working time left.` : `Your working-time window is already spent (deadline was ${localTime}) \u2014 finish now.`;
+  return [
+    "[SUBAGENT FINISH] The leader agent has finished its work.",
+    `Reason: ${input.reason}`,
+    timeLeft,
+    "Finish your task now, in this turn: complete the thought you are working on, stop",
+    "starting new tool calls unless one is strictly required to finish, and write your",
+    "final answer or report as your final output, then end your turn.",
+    "Do not restart the task and do not begin new work."
+  ].join("\n");
+}
+
 // src/coordination/subagent-budget.ts
 var TIMEOUT_PREEMPT_FRACTION = 0.85;
 var DECISION_TIMEOUT_MS = 6e4;
@@ -12030,6 +12073,82 @@ var SubagentBudget = class _SubagentBudget {
       this.limits.idleTimeoutMs = ext.idleTimeoutMs;
     }
   }
+  /**
+   * Graceful-finish state (see coordination/subagent-finish.ts).
+   * `_finishNotified` guards the single in-band emission; `_grace` records a
+   * granted working-time extension past the original wall-clock deadline.
+   * They are separate because the two callers want different semantics:
+   * the watchdog grants grace at the deadline crossing (notify + extend),
+   * while an explicit leader-finished request only notifies — a subagent
+   * well inside its budget keeps its full legitimate working time and simply
+   * accelerates.
+   */
+  _finishNotified = false;
+  _grace = null;
+  /** True once the in-band finish notification has been emitted. */
+  get finishNotified() {
+    return this._finishNotified;
+  }
+  /** True once a grace window has been granted past the original deadline. */
+  get graceGranted() {
+    return this._grace !== null;
+  }
+  /**
+   * Notify the subagent in-band to finish its task in its own turn:
+   * `subagent.finish_requested` is emitted on the wired EventBus and the
+   * agent loop folds the notice into the conversation between tool batches.
+   * Nothing aborts — this is a notification, never an interrupt.
+   *
+   * `opts.graceMs` additionally extends the wall-clock ceiling by that window
+   * (used by the watchdog at a deadline crossing, so the model gets working
+   * time instead of a kill). Omit it to notify without touching the budget —
+   * the subagent keeps its existing time budget and just accelerates.
+   *
+   * Returns `true` when this call did something (emitted the notification
+   * and/or granted grace); `false` when there was nothing to do (already
+   * notified, grace already granted, no EventBus wired, budget not started).
+   */
+  notifyFinish(reason, opts, now = Date.now) {
+    if (!this._events) return false;
+    if (this.startTime === null) return false;
+    const shouldEmit = !this._finishNotified;
+    const rawGrace = opts?.graceMs;
+    const shouldGrant = rawGrace !== void 0 && this._grace === null;
+    if (!shouldEmit && !shouldGrant) return false;
+    let grantedGraceMs = 0;
+    let graceDeadlineMs;
+    if (shouldGrant && rawGrace !== void 0) {
+      grantedGraceMs = Number.isFinite(rawGrace) && rawGrace > 0 ? Math.floor(rawGrace) : DEFAULT_SUBAGENT_FINISH_GRACE_MS;
+      graceDeadlineMs = now() + grantedGraceMs;
+      this._grace = { deadlineMs: graceDeadlineMs, graceMs: grantedGraceMs };
+      this.patchLimits({ timeoutMs: graceDeadlineMs - this.startTime });
+    }
+    if (shouldEmit) {
+      this._finishNotified = true;
+      const effectiveDeadlineMs = graceDeadlineMs ?? (this.limits.timeoutMs !== void 0 ? this.startTime + this.limits.timeoutMs : now() + DEFAULT_SUBAGENT_FINISH_GRACE_MS);
+      const effectiveGraceMs = Math.max(0, effectiveDeadlineMs - now());
+      const subagentId = this._subagentId;
+      this._events.emit(SUBAGENT_FINISH_REQUESTED_EVENT, {
+        // Omitted entirely when the budget was built without an id — an
+        // empty string is an address that matches nothing.
+        ...subagentId !== void 0 ? { subagentId } : {},
+        reason,
+        deadlineMs: effectiveDeadlineMs,
+        graceMs: effectiveGraceMs,
+        notice: buildSubagentFinishNotice({
+          reason,
+          deadlineMs: effectiveDeadlineMs,
+          graceMs: effectiveGraceMs
+        })
+      });
+    }
+    return true;
+  }
+  /** Epoch ms by which the subagent should have produced its final output,
+   *  once a grace window was granted. Undefined before that. */
+  get finishDeadlineMs() {
+    return this._grace?.deadlineMs;
+  }
   iterations = 0;
   toolCalls = 0;
   tokenInput = 0;
@@ -12045,6 +12164,10 @@ var SubagentBudget = class _SubagentBudget {
   lastActivityTime = null;
   _onThreshold;
   _sessionId;
+  /** Owning subagent id — used to address the graceful-finish event. */
+  _subagentId;
+  /** True when only the coordinator watchdog may enforce wall-clock limits. */
+  _wallClockWatchdogOwned;
   /**
    * Hard cap on how long `_negotiateExtension` waits for the coordinator to
    * respond before defaulting to 'stop'. Without this fallback an absent
@@ -12116,6 +12239,8 @@ var SubagentBudget = class _SubagentBudget {
   constructor(limits = {}, mode = "auto", options = {}) {
     this._mode = mode;
     this._sessionId = options.sessionId;
+    this._subagentId = options.subagentId;
+    this._wallClockWatchdogOwned = options.wallClockWatchdogOwned === true;
     this.limits = { ...limits };
   }
   currentSessionId() {
@@ -12194,7 +12319,7 @@ var SubagentBudget = class _SubagentBudget {
       if (this.limits.idleTimeoutMs !== void 0 && idle > this.limits.idleTimeoutMs) {
         exceeded.push({ kind: "idle_timeout", used: idle, limit: this.limits.idleTimeoutMs });
       }
-      const wallOwnedByWatchdog = this._onThreshold !== void 0 && this._watchdogActive === this.limits.timeoutMs;
+      const wallOwnedByWatchdog = this._wallClockWatchdogOwned || this._onThreshold !== void 0 && this._watchdogActive === this.limits.timeoutMs;
       if (this.limits.timeoutMs !== void 0 && elapsedMs > this.limits.timeoutMs && !wallOwnedByWatchdog) {
         exceeded.push({ kind: "timeout", used: elapsedMs, limit: this.limits.timeoutMs });
       }
@@ -12393,7 +12518,7 @@ var SubagentBudget = class _SubagentBudget {
     if (timeoutMs === void 0 && idleTimeoutMs === void 0) return;
     const elapsed = Date.now() - this.startTime;
     const wallSkipped = this._onThreshold !== void 0 && this._watchdogActive !== void 0 && timeoutMs !== void 0 && this._watchdogActive === timeoutMs;
-    const wallTripped = wallSkipped ? false : timeoutMs !== void 0 && elapsed > timeoutMs;
+    const wallTripped = this._wallClockWatchdogOwned || wallSkipped ? false : timeoutMs !== void 0 && elapsed > timeoutMs;
     const idleTripped = idleTimeoutMs !== void 0 && this.idleMs() > idleTimeoutMs;
     if (!wallTripped && !idleTripped) return;
     void this.checkLimits(elapsed);
@@ -12769,6 +12894,14 @@ function makeAgentSubagentRunner(opts) {
     );
     const onParentAbort = () => aborter.abort();
     ctx.signal.addEventListener("abort", onParentAbort);
+    if (resolveGracefulFinish(ctx.config)) {
+      unsub.push(
+        events.on("subagent.finish_requested", (e) => {
+          if (e.subagentId && e.subagentId !== ctx.subagentId) return;
+          setBtwNote(agent.ctx, e.notice);
+        })
+      );
+    }
     let result;
     try {
       result = await agent.run(format(task, ctx.config), { signal: aborter.signal });
@@ -16960,6 +17093,22 @@ var EXPLORE_COMPANION_AGENT = {
   textStream: "silent",
   toolStream: "silent"
 };
+var CHAOS_MONKEY_AGENT = {
+  ...defineAgent("chaos-monkey", "Chaos Monkey"),
+  tools: [...TOOLS.build],
+  skillNames: ["testing", "typescript-strict"],
+  spawnBudgetExempt: true,
+  // Run in the live checkout: mutation targets are usually freshly
+  // written and uncommitted — a worktree spawned from HEAD would not
+  // contain them and every mutant would drift. The mutation_test tool
+  // honors this value as its default; callers can still override per
+  // call via its `chaosWorktree` input when targets are committed and
+  // isolation is wanted.
+  worktree: "off",
+  // Report travels via submit_result + final text, not the leader's stream.
+  textStream: "silent",
+  toolStream: "silent"
+};
 var CRITIC_AGENT = defineAgent("critic", "Critic");
 var GENERIC_AGENT = defineAgent("generic", "Generic Project Agent");
 function withDispatchMetadata(definition) {
@@ -16979,6 +17128,7 @@ var FLEET_ROSTER = {
   generic: GENERIC_AGENT,
   "shadow-agent": SHADOW_AGENT,
   "explore-companion": EXPLORE_COMPANION_AGENT,
+  "chaos-monkey": CHAOS_MONKEY_AGENT,
   ...Object.fromEntries(
     ALL_AGENT_DEFINITIONS.map((d) => [d.config.role, withDispatchMetadata(d)])
   )
@@ -17009,6 +17159,16 @@ var FLEET_ROSTER_BUDGETS = {
     maxTokens: 96e3,
     maxCostUsd: 0.5
   },
+  "chaos-monkey": {
+    // A mutation pass is many short apply/run/restore cycles — per-mutant
+    // work is tiny, but a large plan (25 mutants/file × N files) needs
+    // headroom. Idle-based reaping covers a stalled pass.
+    idleTimeoutMs: DEFAULT_IDLE_TIMEOUT_MS,
+    maxIterations: 2e3,
+    maxToolCalls: 6e3,
+    maxTokens: 96e3,
+    maxCostUsd: 0.5
+  },
   ...Object.fromEntries(
     ALL_AGENT_DEFINITIONS.map((d) => [d.config.role, d.budget])
   )
@@ -17178,7 +17338,8 @@ async function executeSubagentWithTimeout({
   budget,
   preemptFraction = TIMEOUT_PREEMPT_FRACTION,
   abortSubagent,
-  currentSessionId
+  currentSessionId,
+  gracefulFinish
 }) {
   const initialTimeoutMs = budget.limits.timeoutMs;
   const idleLimitMs = budget.limits.idleTimeoutMs;
@@ -17209,9 +17370,17 @@ async function executeSubagentWithTimeout({
     const scheduleNext = () => {
       const wallLimit = budget.limits.timeoutMs ?? initialTimeoutMs;
       const wallRemaining = initialTimeoutMs === void 0 ? Number.POSITIVE_INFINITY : wallLimit - (Date.now() - start);
-      const idleRemaining = idleLimitMs === void 0 ? Number.POSITIVE_INFINITY : (budget.limits.idleTimeoutMs ?? idleLimitMs) - budget.idleMs();
-      const preemptRemaining = initialTimeoutMs === void 0 || preemptedCeiling === wallLimit ? Number.POSITIVE_INFINITY : wallLimit * preemptFraction - (Date.now() - start);
-      armFor(Math.max(25, Math.min(wallRemaining, idleRemaining, preemptRemaining)));
+      const idleRemaining = idleLimitMs === void 0 || gracefulFinish !== void 0 && initialTimeoutMs !== void 0 ? Number.POSITIVE_INFINITY : (budget.limits.idleTimeoutMs ?? idleLimitMs) - budget.idleMs();
+      const preemptRemaining = initialTimeoutMs === void 0 || preemptedCeiling === wallLimit || gracefulFinish !== void 0 ? Number.POSITIVE_INFINITY : wallLimit * preemptFraction - (Date.now() - start);
+      const next = Math.min(wallRemaining, idleRemaining, preemptRemaining);
+      if (!Number.isFinite(next)) {
+        if (timer) {
+          clearTimeout(timer);
+          timer = null;
+        }
+        return;
+      }
+      armFor(Math.max(25, next));
     };
     const negotiateTimeout = async (used, limit) => {
       const handler = budget.onThreshold;
@@ -17260,6 +17429,10 @@ async function executeSubagentWithTimeout({
       const wallExceeded = wallLimit !== void 0 && elapsed >= wallLimit;
       const idleExceeded = idleLimit !== void 0 && budget.idleMs() >= idleLimit;
       if (idleExceeded && !wallExceeded) {
+        if (gracefulFinish !== void 0 && initialTimeoutMs !== void 0) {
+          scheduleNext();
+          return;
+        }
         const sessionId = currentSessionId();
         budget._events?.emit("budget.threshold_reached", {
           ...sessionId ? { sessionId } : {},
@@ -17276,7 +17449,7 @@ async function executeSubagentWithTimeout({
         reject(new BudgetExceededError("idle_timeout", idleLimit ?? 0, budget.idleMs()));
         return;
       }
-      if (wallLimit !== void 0 && !wallExceeded && budget.onThreshold && preemptState === "active" /* ACTIVE */ && elapsed >= wallLimit * preemptFraction) {
+      if (wallLimit !== void 0 && !wallExceeded && gracefulFinish === void 0 && budget.onThreshold && preemptState === "active" /* ACTIVE */ && elapsed >= wallLimit * preemptFraction) {
         const activityTs = Date.now() - budget.idleMs();
         if (activityTs <= lastGrantActivityTs) {
           preemptState = "locked" /* LOCKED */;
@@ -17310,6 +17483,22 @@ async function executeSubagentWithTimeout({
         return;
       }
       const limit = wallLimit ?? 0;
+      if (gracefulFinish !== void 0) {
+        if (!budget.graceGranted) {
+          const reason = `wall-clock budget of ${Math.round(limit / 1e3)}s reached`;
+          if (budget.notifyFinish(reason, { graceMs: gracefulFinish.graceMs })) {
+            scheduleNext();
+            return;
+          }
+          abortSubagent(ctx.subagentId);
+          reject(new BudgetExceededError("timeout", limit, elapsed));
+          return;
+        } else {
+          abortSubagent(ctx.subagentId);
+          reject(new BudgetExceededError("timeout", limit, elapsed));
+          return;
+        }
+      }
       if (!budget.onThreshold) {
         abortSubagent(ctx.subagentId);
         reject(new BudgetExceededError("timeout", limit, elapsed));
@@ -17694,6 +17883,32 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
   completeTask(result) {
     this.recordCompletion(result);
   }
+  /**
+   * Ask every RUNNING subagent that opted into `gracefulFinish` to finish its
+   * task in its own turn (see coordination/subagent-finish.ts). This is the
+   * leader-side entry point for "the leader agent has finished": it delivers
+   * an in-band notification between tool batches — never an interrupt, never
+   * an abort. Each notified subagent keeps its existing time budget and
+   * accelerates; the watchdog still bounds the maximum lifetime.
+   *
+   * Subagents without the policy opted in are deliberately untouched — their
+   * lifecycle remains the legacy watchdog contract.
+   *
+   * Returns the number of subagents actually notified.
+   */
+  requestFinish(reason) {
+    let notified = 0;
+    for (const subagent of this.subagents.values()) {
+      if (subagent.status !== "running") continue;
+      if (!resolveGracefulFinish(subagent.config)) continue;
+      const budget = subagent.activeBudget;
+      if (!budget) continue;
+      const usage = budget.usage();
+      if (usage.iterations === 0 && usage.toolCalls === 0) continue;
+      if (budget.notifyFinish(reason)) notified++;
+    }
+    return notified;
+  }
   // --- internal dispatching ---------------------------------------------
   tryDispatchNext() {
     while (this.canDispatch()) {
@@ -17867,7 +18082,14 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
         idleTimeoutMs: rawIdleTimeoutMs ?? this.config.defaultBudget?.idleTimeoutMs ?? configWithRosterDefaults.idleTimeoutMs
       },
       "auto",
-      { sessionId: () => this.currentSessionId() }
+      {
+        sessionId: () => this.currentSessionId(),
+        subagentId,
+        // Graceful-finish runs own wall-clock enforcement to the watchdog so
+        // the notify-then-bound lifecycle cannot be raced by tool.progress
+        // heartbeats calling checkTimeout() (see subagent-budget.ts).
+        ...resolveGracefulFinish(subagent.config) ? { wallClockWatchdogOwned: true } : {}
+      }
     );
     subagent.activeBudget = budget;
     if (!this.runner) {
@@ -17900,7 +18122,8 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
         task,
         runCtx,
         budget,
-        subagent.config.preemptFraction
+        subagent.config.preemptFraction,
+        resolveGracefulFinish(subagent.config)
       );
       result = {
         subagentId,
@@ -17930,13 +18153,14 @@ var DefaultMultiAgentCoordinator = class _DefaultMultiAgentCoordinator extends E
     }
     this.recordCompletion(result);
   }
-  async executeWithTimeout(runner, task, ctx, budget, preemptFraction) {
+  async executeWithTimeout(runner, task, ctx, budget, preemptFraction, gracefulFinish) {
     return executeSubagentWithTimeout({
       runner,
       task,
       ctx,
       budget,
       preemptFraction,
+      gracefulFinish,
       abortSubagent: (subagentId) => this.subagents.get(subagentId)?.abortController.abort(),
       currentSessionId: () => this.currentSessionId()
     });
@@ -20219,6 +20443,10 @@ var DefaultSkillLoader = class {
         );
         for (const e of entries) {
           if (!await entryIsDirectory(dir, e)) continue;
+          if (!isValidSkillNameFormat(e.name)) {
+            this.skipped.push({ dir, entry: e.name, reason: "invalid-name-format" });
+            continue;
+          }
           const skillFile = path15.join(dir, e.name, "SKILL.md");
           let raw;
           try {
@@ -21288,9 +21516,21 @@ function renderCommandLine(command, args) {
   });
   return [command, ...rendered].join(" ");
 }
-function subjectForToolInput(toolName, input, subjectKey) {
+function renderSubjectFields(obj, fields) {
+  const parts = [];
+  for (const field of fields) {
+    const value = obj[field];
+    if (value === void 0 || value === null || value === "" || value === false) continue;
+    const str = String(value);
+    parts.push(`${field}=${/\s/.test(str) ? `"${str.replace(/"/g, '\\"')}"` : str}`);
+  }
+  return parts.join(" ");
+}
+function subjectForToolInput(toolName, input, subjectKey, subjectFields) {
   if (!input || typeof input !== "object") return void 0;
   const obj = input;
+  const extra = subjectFields && subjectFields.length > 0 ? renderSubjectFields(obj, subjectFields) : "";
+  const withExtra = (base) => extra ? `${base} ${extra}` : base;
   if (subjectKey) {
     const value = obj[subjectKey];
     if (Array.isArray(value)) {
@@ -21306,9 +21546,9 @@ function subjectForToolInput(toolName, input, subjectKey) {
       if (subjectKey === "command") {
         const rendered = renderCommandLine(value, obj["args"]);
         if (value === "commit" && obj["dry_run"] === true) {
-          return `${escapeGlobSubject(rendered)}:dry-run`;
+          return `${escapeGlobSubject(withExtra(rendered))}:dry-run`;
         }
-        return escapeGlobSubject(rendered);
+        return escapeGlobSubject(withExtra(rendered));
       }
       if (subjectKey === "directory" && obj["dry_run"] === true) {
         return `${escapeGlobSubject(value)}:dry-run`;
@@ -22559,7 +22799,7 @@ var ToolExecutor = class _ToolExecutor {
         return { result, tool, durationMs: Date.now() - start };
       }
       if (effectivePermission === "confirm") {
-        const suggestedPattern = boundary.decision === "confirm" ? `kanban-boundary:${boundary.path ?? tool.name}` : subjectForToolInput(tool.name, use.input, tool.subjectKey) ?? tool.name;
+        const suggestedPattern = boundary.decision === "confirm" ? `kanban-boundary:${boundary.path ?? tool.name}` : subjectForToolInput(tool.name, use.input, tool.subjectKey, tool.subjectFields) ?? tool.name;
         if (this.opts.confirmAwaiter) {
           const awaiter = this.opts.confirmAwaiter;
           const choice = await new Promise(

package/dist/hq/index.js

@@ -702,6 +702,14 @@ var PATTERNS = [
     anchor: "sk-ant-"
   },
   { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  {
+    // `xai` is a first-class provider in this codebase, but its key shape was
+    // absent here — so the one credential format WrongStack itself hands users
+    // was the one the scrubber could not recognize (audit 2026-08-20).
+    type: "xai_key",
+    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    anchor: "xai-"
+  },
   { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
   { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
   { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
@@ -792,8 +800,8 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
   },
   {
     type: "json_credential_key",
@@ -910,6 +918,27 @@ var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
+var PEM_END_MARKER = "-----END";
+var MAX_PEM_BLOCK_BYTES = 64 * 1024;
+var PEM_END_LINE_TOLERANCE = 64;
+function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
+  const head = text.slice(chunkStart, proposedEnd);
+  const lastBegin = head.lastIndexOf("-----BEGIN ");
+  if (lastBegin === -1) return proposedEnd;
+  const fromBegin = text.slice(chunkStart + lastBegin);
+  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
+  if (!marker || marker.index !== 0) return proposedEnd;
+  const bodyStart = marker[0].length;
+  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
+  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
+  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
+    return proposedEnd;
+  }
+  const lineEnd = fromBegin.indexOf("\n", closeIdx);
+  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
+  return Math.max(proposedEnd, end);
+}
 var PATTERN_ANCHORS = [
   ...new Set(
     PATTERNS.flatMap(
@@ -946,6 +975,7 @@ var DefaultSecretScrubber = class {
           }
         }
         end = safe === -1 ? end : safe + 1;
+        end = extendChunkBoundaryPastPem(text, i, end);
       }
       out.push(this.scrubOne(text.slice(i, end)));
       i = end;
@@ -3080,6 +3110,15 @@ function deriveSessionStatus(agents) {
     (a) => a.status === "running" || a.status === "streaming" || a.status === "waiting_user"
   ) ? "active" : "idle";
 }
+function downgradeStaleAgentStatuses(agents, nowMs) {
+  const cutoff = nowMs - HQ_STALE_SNAPSHOT_WINDOW_MS;
+  return agents.map((agent) => {
+    if (agent.status !== "running" && agent.status !== "streaming") return agent;
+    const lastActivityAt = Date.parse(agent.lastActivityAt);
+    if (!Number.isFinite(lastActivityAt) || lastActivityAt >= cutoff) return agent;
+    return { ...agent, status: "idle" };
+  });
+}
 function startSessionTelemetryBridge(opts) {
   const now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   const publisher = opts.publisher;
@@ -3100,6 +3139,7 @@ function startSessionTelemetryBridge(opts) {
   let lastPublishedAtMs = Date.now();
   let disposed = false;
   function buildSnapshot() {
+    const effectiveAgents = downgradeStaleAgentStatuses(agents, Date.parse(now()));
     return {
       sessionId: opts.sessionId,
       clientKind: identity.kind,
@@ -3107,11 +3147,11 @@ function startSessionTelemetryBridge(opts) {
       projectId: project.projectId,
       projectName: opts.projectName ?? project.projectName,
       projectRoot: opts.projectRoot,
-      status: deriveSessionStatus(agents),
+      status: deriveSessionStatus(effectiveAgents),
       startedAt,
       lastActivityAt,
-      agentCount: agents.length,
-      agents,
+      agentCount: effectiveAgents.length,
+      agents: effectiveAgents,
       ...identity.hostname !== void 0 ? { hostname: identity.hostname } : {},
       ...identity.pid !== void 0 ? { pid: identity.pid } : {},
       ...opts.gitBranch !== void 0 ? { gitBranch: opts.gitBranch } : {}

package/dist/index.d.ts

@@ -16,7 +16,7 @@ export { DEPENDENCY_FILE_PATTERNS, type DependencyWatcherConfig, type DepWatchEn
 export { attachDepWatcherBridge, type DepWatcherBridgeOptions, } from './coordination/dep-watcher-bridge.js';
 export { Director, FleetCostCapError, FleetSpawnBudgetError, FleetTokenCapError, type TaskResultNotification, } from './coordination/director.js';
 export { type DirectorSessionFactory, type DirectorSessionFactoryOptions, makeDirectorSessionFactory, } from './coordination/director-session.js';
-export { makeAskTool, makeAssignTool, makeAwaitTasksTool, makeCollabDebugTool, makeFleetEmitTool, makeFleetTool, makeKanbanQueueTool, makeQualityGateTool, makeRollUpTool, makeSpawnTool, makeTerminateTool, } from './coordination/director-tools.js';
+export { makeAskTool, makeAssignTool, makeAwaitTasksTool, makeCollabDebugTool, makeFleetEmitTool, makeFleetTool, makeKanbanQueueTool, makeMutationTestTool, makeQualityGateTool, makeRollUpTool, makeSpawnTool, makeTerminateTool, } from './coordination/director-tools.js';
 export { DEFAULT_DISPATCH_ROLE, type DispatchCandidate, type DispatchClassifier, type DispatchMethod, type DispatchOptions, type DispatchResult, dispatchAgent, makeLLMClassifier, scoreAgents, } from './coordination/dispatcher.js';
 export { compactLog, type FileAuthorEntry, type FileAuthorLog, type FileAuthorTrackerOptions, getFileHistory, getFilesByAgent, getFullLog, getLastAuthor, recordFileAction, } from './coordination/file-author-tracker.js';
 export { ACP_AGENTS, ALL_FLEET_AGENTS, applyRosterBudget, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FLEET_ROSTER_WITHACP, type FleetRosterBudget, } from './coordination/fleet.js';