@wrongstack/core 0.308.7 → 0.309.1

package/dist/infrastructure/index.js

@@ -2378,7 +2378,7 @@ function walk(node, vault, transform) {
   }
   return out;
 }
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
+var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
 var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
 function isSecretField(name) {
   const lc = name.toLowerCase();
@@ -2554,6 +2554,14 @@ function keyFileNeedsHardening(keyFile, opts) {
   }
   return false;
 }
+function mkdirSecretDirSync(dir) {
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (process.platform === "win32") return;
+  try {
+    fs2.chmodSync(dir, 448);
+  } catch {
+  }
+}
 function writeKeyFileAtomicSync(keyFile, content) {
   const tmp = `${keyFile}.${randomBytes(4).toString("hex")}.tmp`;
   const fd = fs2.openSync(tmp, "w", 384);
@@ -2701,7 +2709,7 @@ var DefaultSecretVault = class {
     const oldVersion = this._keyVersion;
     const newKey = randomBytes(KEY_BYTES);
     const newVersion = oldVersion + 1;
-    fs2.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path3.dirname(this.keyFile));
     const passphrase = getVaultPassphrase();
     if (passphrase) {
       writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
@@ -2785,7 +2793,7 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs2.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    mkdirSecretDirSync(path3.dirname(this.keyFile));
     const key = randomBytes(KEY_BYTES);
     const passphrase = getVaultPassphrase();
     const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
@@ -3636,6 +3644,17 @@ var IN_PROJECT_DENIED_PATHS = [
     // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
     path: "features.mailboxBridge",
     reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
+  },
+  {
+    // `plugins` is already denied above, so a repo cannot ADD a plugin. This
+    // closes the other half: a repo could previously ship
+    // `{"features":{"pluginsTrust":false}}` and switch off the integrity gate
+    // for plugins the user had ALREADY installed globally — disarming the
+    // trust-on-first-use pin that exists to catch a supply-chain update
+    // rewriting a plugin's entry file. Same operator-owned class as the
+    // switches above.
+    path: "features.pluginsTrust",
+    reason: "Disables the plugin trust-on-first-use integrity gate, re-trusting changed code in already-installed global plugins."
   }
 ];
 function deleteNestedPath(target, path13) {

package/dist/kernel/events/agent-events.d.ts

@@ -144,8 +144,8 @@ export interface AgentEventMap {
     /**
      * A spawn resolved fewer skills than it selected. Emitted so a skill that
      * silently failed to load — missing from the loader, gated by a capability
-     * the subagent lacks, or cut by the prompt budget — is observable instead of
-     * leaving the agent believing it received guidance it never got.
+     * the subagent lacks, or cut by the prompt budget — is observable instead
+     * of leaving the agent believing it received guidance it never got.
      */
     'subagent.skills.dropped': {
         sessionId?: string | undefined;
@@ -155,6 +155,35 @@ export interface AgentEventMap {
         /** skill → reason it was dropped. */
         dropped: Record<string, string>;
     };
+    /**
+     * In-band graceful-finish request for a background subagent (see
+     * coordination/subagent-finish.ts). Emitted on the subagent's OWN EventBus
+     * when its wall-clock deadline is crossed — or the leader explicitly asked
+     * it to finish (session shutdown) — and the subagent's config opted into
+     * `gracefulFinish`. The runner folds the notice into the conversation as a
+     * `/btw` note at the next iteration boundary; the model then completes its
+     * task in its own turn within the granted grace window. This event is a
+     * notification, never an interrupt: nothing aborts when it fires.
+     */
+    'subagent.finish_requested': {
+        /** Parent/host session id. */
+        sessionId?: string | undefined;
+        /**
+         * Owning subagent id when the budget knows it; omitted when the budget
+         * was constructed without one. An empty string would look like an
+         * address that matches nothing — the runner treats an omitted id as
+         * deliverable (`if (e.subagentId && …)`), so omission is safe.
+         */
+        subagentId?: string | undefined;
+        /** Why the finish was requested (deadline crossed / leader finished). */
+        reason: string;
+        /** Epoch ms by which the subagent should have produced its final output. */
+        deadlineMs: number;
+        /** Granted working-time window in ms. */
+        graceMs: number;
+        /** Ready-to-read notice text; the loop folds it in as a `/btw` note. */
+        notice: string;
+    };
     /**
      * A background learning-distillation pass finished for a roster role.
      * Emitted by the fleet host's auto-optimize scheduler so surfaces can show

package/dist/models/index.js

@@ -877,7 +877,17 @@ function normalizeModelsDevModel(model) {
   const reasoningConfig = {
     default: disableSupported ? "enabled" : "always_on",
     disableSupported,
-    effortSupported: effortLevels.length > 0,
+    // Tri-state (see ReasoningConfig.effortSupported):
+    //   options present  → documented answer (true when effort values exist;
+    //                      an explicitly EMPTY array is a documented "no
+    //                      effort control", not an absent field).
+    //   field ABSENT     → the model is known to reason but its vocabulary is
+    //                      undocumented → `undefined`, so the resolver forwards
+    //                      the request and each wire adapter applies its own
+    //                      transport gating. Sending `false` here would make
+    //                      the resolver claim "does not support effort" — an
+    //                      assertion the catalog never made.
+    ...raw === void 0 ? {} : { effortSupported: effortLevels.length > 0 },
     effortLevels,
     preserveThinking: model.interleaved ? "always_on" : "unsupported"
   };

package/dist/observability/index.js

@@ -388,7 +388,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   // redaction function (false positive = cosmetic noise; false negative = leak).
   /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
+  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
   // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
   // every such flag in the command line is redacted, not just the first.

package/dist/plugin/index.js

@@ -1945,18 +1945,88 @@ var DefaultPluginAPI = class {
       list: () => tr.list()
     };
     const pr = init.providerRegistry;
+    const providerTypesIOwn = /* @__PURE__ */ new Set();
+    const assertCanMutateProvider = (type, op) => {
+      if (isOfficial) return;
+      if (providerTypesIOwn.has(type)) return;
+      if (!pr.has(type)) return;
+      throw new Error(
+        `Plugin "${owner}" may not ${op} provider "${type}" \u2014 it was not registered by this plugin. Replacing an existing provider would route prompts and credentials through plugin code.`
+      );
+    };
     this.providers = {
-      register: (f) => pr.register(f),
-      unregister: (type) => pr.unregister(type),
+      register: (f) => {
+        assertCanMutateProvider(f.type, "replace");
+        pr.register(f);
+        providerTypesIOwn.add(f.type);
+      },
+      unregister: (type) => {
+        assertCanMutateProvider(type, "unregister");
+        providerTypesIOwn.delete(type);
+        return pr.unregister(type);
+      },
       create: (cfg) => pr.create(cfg),
       list: () => pr.list()
     };
-    this.mcp = init.mcpRegistry ?? noopMcp;
+    const mcpRegistry = init.mcpRegistry;
+    if (!mcpRegistry) {
+      this.mcp = noopMcp;
+    } else {
+      const mcpServersIStarted = /* @__PURE__ */ new Set();
+      const assertOwnsMcpServer = (name, op) => {
+        if (isOfficial) return;
+        if (mcpServersIStarted.has(name)) return;
+        if (!mcpRegistry.list().some((s) => s.name === name)) return;
+        throw new Error(
+          `Plugin "${owner}" may not ${op} MCP server "${name}" \u2014 it was not started by this plugin.`
+        );
+      };
+      this.mcp = {
+        start: async (cfg) => {
+          const name = cfg?.name;
+          if (typeof name === "string" && mcpRegistry.list().some((s) => s.name === name)) {
+            assertOwnsMcpServer(name, "start");
+          }
+          await mcpRegistry.start(cfg);
+          if (typeof name === "string") mcpServersIStarted.add(name);
+        },
+        stop: async (name) => {
+          assertOwnsMcpServer(name, "stop");
+          await mcpRegistry.stop(name);
+        },
+        restart: async (name) => {
+          assertOwnsMcpServer(name, "restart");
+          await mcpRegistry.restart(name);
+        },
+        list: () => mcpRegistry.list()
+      };
+    }
     const scr = init.slashCommandRegistry;
     const official = init.official === true;
+    const commandsIOwn = /* @__PURE__ */ new Set();
     this.slashCommands = scr ? {
-      register: (cmd) => scr.register(cmd, owner, { official }),
-      unregister: (name) => scr.unregister(name),
+      register: (cmd) => {
+        scr.register(cmd, owner, { official });
+        for (const key of [cmd.name, ...cmd.aliases ?? []]) {
+          commandsIOwn.add(key);
+          commandsIOwn.add(`${owner}:${key}`);
+        }
+      },
+      unregister: (name) => {
+        if (!official && !commandsIOwn.has(name) && scr.get(name) !== void 0) {
+          throw new Error(
+            `Plugin "${owner}" may not unregister slash command "${name}" \u2014 it was not registered by this plugin.`
+          );
+        }
+        for (const key of [
+          name,
+          `${owner}:${name}`,
+          name.startsWith(`${owner}:`) ? name.slice(owner.length + 1) : name
+        ]) {
+          commandsIOwn.delete(key);
+        }
+        return scr.unregister(name);
+      },
       get: (name) => scr.get(name),
       list: () => scr.list()
     } : noopSlashCommands;
@@ -5829,6 +5899,30 @@ function withSqliteExperimentalWarningSuppressed(run) {
   }
 }
 
+// src/utils/win32-cmd.ts
+var WIN32_CMD_META = /[&|<>"%\r\n\0]/;
+function buildWin32CmdShimInvocation(command, args = []) {
+  assertSafeWin32CmdArgs([command, ...args]);
+  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
+  return {
+    command: process.env["COMSPEC"] ?? "cmd.exe",
+    args: ["/d", "/c", line],
+    windowsVerbatimArguments: true
+  };
+}
+function assertSafeWin32CmdArgs(args) {
+  for (const arg of args) {
+    if (typeof arg === "string" && WIN32_CMD_META.test(arg)) {
+      throw new Error(
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+      );
+    }
+  }
+}
+function quoteWin32CmdArg(arg) {
+  return `"${arg}"`;
+}
+
 // src/chronicle/sqlite-journal-schema.ts
 var CHRONICLE_SQLITE_FILE = "chronicle.sqlite";
 var LEGACY_JSONL_MIGRATION_KEY = "legacy-jsonl-v1";
@@ -11600,14 +11694,21 @@ async function openInEditor(filePath, env = process.env) {
       context: { filePath }
     });
   }
-  const child = spawn5(parts[0], [...parts.slice(1), filePath], {
+  const editorArgs = [...parts.slice(1), filePath];
+  const child = shell ? (() => {
+    const inv = buildWin32CmdShimInvocation(parts[0], editorArgs);
+    return spawn5(inv.command, inv.args, {
+      stdio: "ignore",
+      detached: true,
+      windowsVerbatimArguments: inv.windowsVerbatimArguments,
+      // Suppresses the console flash the cmd.exe wrapper would otherwise
+      // show before the editor appears. Repo convention — see
+      // `core/tests/architecture/spawn-convention.test.ts`.
+      windowsHide: true
+    });
+  })() : spawn5(parts[0], editorArgs, {
     stdio: "ignore",
     detached: true,
-    shell,
-    // `shell` routes through cmd.exe on win32, which flashes a console window
-    // before the editor appears. A GUI editor is unaffected by the flag; the
-    // shell wrapper is what it suppresses. Repo convention — see
-    // `core/tests/architecture/spawn-convention.test.ts`.
     windowsHide: true
   });
   child.unref();
@@ -13789,7 +13890,7 @@ function walk2(node, vault, transform) {
   }
   return out;
 }
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
+var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
 var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
 function isSecretField(name) {
   const lc = name.toLowerCase();