@wrongstack/core 0.309.0 → 0.309.1

package/dist/skills/index.js

@@ -888,6 +888,32 @@ function numField(rec, key) {
 import { spawn } from "node:child_process";
 import * as fs3 from "node:fs/promises";
 import * as path3 from "node:path";
+
+// src/utils/win32-cmd.ts
+var WIN32_CMD_META = /[&|<>"%\r\n\0]/;
+function buildWin32CmdShimInvocation(command, args = []) {
+  assertSafeWin32CmdArgs([command, ...args]);
+  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
+  return {
+    command: process.env["COMSPEC"] ?? "cmd.exe",
+    args: ["/d", "/c", line],
+    windowsVerbatimArguments: true
+  };
+}
+function assertSafeWin32CmdArgs(args) {
+  for (const arg of args) {
+    if (typeof arg === "string" && WIN32_CMD_META.test(arg)) {
+      throw new Error(
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+      );
+    }
+  }
+}
+function quoteWin32CmdArg(arg) {
+  return `"${arg}"`;
+}
+
+// src/skills/skill-generator.ts
 async function validateSkillNameAvailable(name, loader) {
   const formatViolations = validateSkillName(name);
   const conflicts = loader ? (await loader.listEntries()).filter((e) => e.name === name) : [];
@@ -989,14 +1015,21 @@ async function openInEditor(filePath, env = process.env) {
       context: { filePath }
     });
   }
-  const child = spawn(parts[0], [...parts.slice(1), filePath], {
+  const editorArgs = [...parts.slice(1), filePath];
+  const child = shell ? (() => {
+    const inv = buildWin32CmdShimInvocation(parts[0], editorArgs);
+    return spawn(inv.command, inv.args, {
+      stdio: "ignore",
+      detached: true,
+      windowsVerbatimArguments: inv.windowsVerbatimArguments,
+      // Suppresses the console flash the cmd.exe wrapper would otherwise
+      // show before the editor appears. Repo convention — see
+      // `core/tests/architecture/spawn-convention.test.ts`.
+      windowsHide: true
+    });
+  })() : spawn(parts[0], editorArgs, {
     stdio: "ignore",
     detached: true,
-    shell,
-    // `shell` routes through cmd.exe on win32, which flashes a console window
-    // before the editor appears. A GUI editor is unaffected by the flag; the
-    // shell wrapper is what it suppresses. Repo convention — see
-    // `core/tests/architecture/spawn-convention.test.ts`.
     windowsHide: true
   });
   child.unref();

package/dist/storage/index.js

@@ -1738,6 +1738,14 @@ var PATTERNS = [
     anchor: "sk-ant-"
   },
   { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  {
+    // `xai` is a first-class provider in this codebase, but its key shape was
+    // absent here — so the one credential format WrongStack itself hands users
+    // was the one the scrubber could not recognize (audit 2026-08-20).
+    type: "xai_key",
+    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    anchor: "xai-"
+  },
   { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
   { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
   { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
@@ -1828,8 +1836,8 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
   },
   {
     type: "json_credential_key",
@@ -1946,6 +1954,27 @@ var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
+var PEM_END_MARKER = "-----END";
+var MAX_PEM_BLOCK_BYTES = 64 * 1024;
+var PEM_END_LINE_TOLERANCE = 64;
+function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
+  const head = text.slice(chunkStart, proposedEnd);
+  const lastBegin = head.lastIndexOf("-----BEGIN ");
+  if (lastBegin === -1) return proposedEnd;
+  const fromBegin = text.slice(chunkStart + lastBegin);
+  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
+  if (!marker || marker.index !== 0) return proposedEnd;
+  const bodyStart = marker[0].length;
+  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
+  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
+  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
+    return proposedEnd;
+  }
+  const lineEnd = fromBegin.indexOf("\n", closeIdx);
+  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
+  return Math.max(proposedEnd, end);
+}
 var PATTERN_ANCHORS = [
   ...new Set(
     PATTERNS.flatMap(
@@ -1982,6 +2011,7 @@ var DefaultSecretScrubber = class {
           }
         }
         end = safe === -1 ? end : safe + 1;
+        end = extendChunkBoundaryPastPem(text, i, end);
       }
       out.push(this.scrubOne(text.slice(i, end)));
       i = end;
@@ -4639,7 +4669,7 @@ function walk(node, vault, transform) {
   }
   return out;
 }
-var SECRET_KEY_PATTERN = /(?:apikey|api_key|authtoken|auth_token|bearer|secret|password|passwd|pwd|refreshtoken|refresh_token|sessionkey|session_key|access[_-]?token|private[_-]?key|token\b)/i;
+var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
 var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
 function isSecretField(name) {
   const lc = name.toLowerCase();
@@ -5344,6 +5374,17 @@ var IN_PROJECT_DENIED_PATHS = [
     // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
     path: "features.mailboxBridge",
     reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
+  },
+  {
+    // `plugins` is already denied above, so a repo cannot ADD a plugin. This
+    // closes the other half: a repo could previously ship
+    // `{"features":{"pluginsTrust":false}}` and switch off the integrity gate
+    // for plugins the user had ALREADY installed globally — disarming the
+    // trust-on-first-use pin that exists to catch a supply-chain update
+    // rewriting a plugin's entry file. Same operator-owned class as the
+    // switches above.
+    path: "features.pluginsTrust",
+    reason: "Disables the plugin trust-on-first-use integrity gate, re-trusting changed code in already-installed global plugins."
   }
 ];
 function deleteNestedPath(target, path36) {

package/dist/types/tool.d.ts

@@ -101,6 +101,21 @@ export interface Tool<I = unknown, O = unknown> {
      * fall back to the heuristic.
      */
     subjectKey?: string | undefined;
+    /**
+     * Extra input fields folded into the permission subject, after `subjectKey`.
+     *
+     * For a shell-style tool the subject is the whole command line, so the trust
+     * rule is as specific as the invocation. A tool whose parameters are NAMED
+     * FIELDS rather than an argv array has no such luck: `git` sets
+     * `subjectKey: 'command'`, whose value is an enum subcommand, so every
+     * `git push` — any branch, `force` or not — rendered to the subject `"push"`
+     * and one "always allow" covered them all (audit 2026-08-20).
+     *
+     * List the fields that change what the call actually does. Absent fields are
+     * skipped, so adding a field only narrows existing rules (they degrade to a
+     * confirm prompt) and never silently widens one.
+     */
+    subjectFields?: readonly string[] | undefined;
     maxOutputBytes?: number | undefined;
     timeoutMs?: number | undefined;
     /**

package/dist/utils/index.d.ts

@@ -44,6 +44,7 @@ export { withSqliteExperimentalWarningSuppressed } from './sqlite-warning.js';
 export * from './string.js';
 export * from './task-format.js';
 export { buildSgrSequence, buildTitleSequence, type ColorDepth, detectTerminal, ESCAPE_TERMINATOR, type EscapeEmitResult, type EscapeSequence, isStdinTTY, type MouseProtocol, onResize, safeEmit, setOutputLineGuard, setRawMode, setTitle, type TerminalCapability, TerminalLifecycle, writeErr, writeOut, } from './term.js';
+export { sanitizeTerminalPreview, sanitizeTerminalText } from './terminal-sanitize.js';
 export * from './todos-format.js';
 export { computeMessageTokens, estimateMessageTokens, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, getCalibrationState, type RequestTokenBreakdown, recordActualUsage, resetCalibration, } from './token-estimate.js';
 export { applyToolDescriptionModes, applyToolDescriptionModeToTool, DEFAULT_TOOL_DESCRIPTION_MODE, getToolDescriptionMode, normalizeToolDescriptionMode, resolveToolDescriptionMode, setToolDescriptionMode, simplifyToolDescription, type ToolDescriptionRegistryLike, } from './tool-description-mode.js';

package/dist/utils/index.js

@@ -4710,6 +4710,42 @@ function formatTaskList(tasks) {
   return lines.join("\n");
 }
 
+// src/utils/terminal-sanitize.ts
+var ANSI_RE = /\x1b\[[0-?]*[ -/]*[@-~]/g;
+var ANSI_OSC_RE = /\x1b\][\s\S]*?(?:\x07|\x1b\\)/g;
+var ANSI_CONTROL_STRING_RE = /\x1b[P^_X][\s\S]*?\x1b\\/g;
+var ANSI_ESCAPE_RE = /\x1b[ -/]*[@-~]/g;
+var BIDI_AND_ZERO_WIDTH_RE = /[​-‏‪-‮⁦-⁩]/g;
+function sanitizeTerminalText(value, tabWidth = 2) {
+  const tab = " ".repeat(Math.max(1, Math.min(8, Math.floor(tabWidth))));
+  const withoutEscapes = value.replace(ANSI_OSC_RE, "").replace(ANSI_CONTROL_STRING_RE, "").replace(ANSI_RE, "").replace(ANSI_ESCAPE_RE, "").replace(BIDI_AND_ZERO_WIDTH_RE, "").replace(/\t/g, tab).replace(/\r/g, "");
+  let safe = "";
+  for (const char of withoutEscapes) {
+    const code = char.codePointAt(0) ?? 0;
+    if (char === "\n" || code >= 32 && code !== 127 && !(code >= 128 && code <= 159)) {
+      safe += char;
+    }
+  }
+  return safe;
+}
+function sanitizeTerminalPreview(value, opts = {}) {
+  const maxLines = opts.maxLines ?? 40;
+  const maxChars = opts.maxChars ?? 8e3;
+  const safe = sanitizeTerminalText(value, opts.tabWidth);
+  let truncated = false;
+  let clipped = safe;
+  if (clipped.length > maxChars) {
+    clipped = clipped.slice(0, maxChars);
+    truncated = true;
+  }
+  const lines = clipped.split("\n");
+  if (lines.length > maxLines) {
+    clipped = lines.slice(0, maxLines).join("\n");
+    truncated = true;
+  }
+  return { text: clipped, truncated };
+}
+
 // src/utils/tool-description-mode.ts
 var DEFAULT_TOOL_DESCRIPTION_MODE = "extend";
 var ORIGINAL_TOOL_DESCRIPTION = /* @__PURE__ */ Symbol.for("wrongstack.tool.originalDescription");
@@ -5589,9 +5625,21 @@ function renderCommandLine(command, args) {
   });
   return [command, ...rendered].join(" ");
 }
-function subjectForToolInput(toolName, input, subjectKey) {
+function renderSubjectFields(obj, fields) {
+  const parts = [];
+  for (const field of fields) {
+    const value = obj[field];
+    if (value === void 0 || value === null || value === "" || value === false) continue;
+    const str = String(value);
+    parts.push(`${field}=${/\s/.test(str) ? `"${str.replace(/"/g, '\\"')}"` : str}`);
+  }
+  return parts.join(" ");
+}
+function subjectForToolInput(toolName, input, subjectKey, subjectFields) {
   if (!input || typeof input !== "object") return void 0;
   const obj = input;
+  const extra = subjectFields && subjectFields.length > 0 ? renderSubjectFields(obj, subjectFields) : "";
+  const withExtra = (base) => extra ? `${base} ${extra}` : base;
   if (subjectKey) {
     const value = obj[subjectKey];
     if (Array.isArray(value)) {
@@ -5607,9 +5655,9 @@ function subjectForToolInput(toolName, input, subjectKey) {
       if (subjectKey === "command") {
         const rendered = renderCommandLine(value, obj["args"]);
         if (value === "commit" && obj["dry_run"] === true) {
-          return `${escapeGlobSubject(rendered)}:dry-run`;
+          return `${escapeGlobSubject(withExtra(rendered))}:dry-run`;
         }
-        return escapeGlobSubject(rendered);
+        return escapeGlobSubject(withExtra(rendered));
       }
       if (subjectKey === "directory" && obj["dry_run"] === true) {
         return `${escapeGlobSubject(value)}:dry-run`;
@@ -5662,7 +5710,7 @@ var DEFAULT_WALK_IGNORE_DIRS = Object.freeze([
 var DEFAULT_WALK_IGNORE_SET = new Set(DEFAULT_WALK_IGNORE_DIRS);
 
 // src/utils/win32-cmd.ts
-var WIN32_CMD_META = /[&|<>"\r\n\0]/;
+var WIN32_CMD_META = /[&|<>"%\r\n\0]/;
 function buildWin32CmdShimInvocation(command, args = []) {
   assertSafeWin32CmdArgs([command, ...args]);
   const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
@@ -5893,6 +5941,8 @@ export {
   sanitizeMemoryEvidenceBody,
   sanitizeMemoryEvidenceSource,
   sanitizeNodeOptions,
+  sanitizeTerminalPreview,
+  sanitizeTerminalText,
   sanitizeWireToolName,
   sessionScopedPath,
   setJsonPath,

package/dist/utils/terminal-sanitize.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Sanitize untrusted text before it is written to a terminal.
+ *
+ * Any surface that renders model-supplied, file-supplied or MCP-supplied text
+ * into a TTY must run it through here first. Escape sequences in that text can
+ * paint outside the region that owns it: `\x1b[2J\x1b[H` clears the screen and
+ * homes the cursor, which lets a payload erase a permission prompt's header and
+ * repaint a convincing fake above the genuine key prompt. The user then answers
+ * the real prompt while reading the attacker's body.
+ *
+ * Bidi and zero-width controls are stripped for the same reason at a different
+ * layer: they reorder or hide characters so the rendered string differs from
+ * the string that will actually be executed (the "Trojan Source" class).
+ *
+ * This is the single source. `@wrongstack/tui` has its own copy for layout
+ * measurement; the CLI permission prompt and diff renderer call this one.
+ */
+/**
+ * Strip terminal escapes, bidi/zero-width controls and non-printable characters
+ * from `value`, normalizing tabs to a fixed-width separator.
+ *
+ * Newlines are preserved; carriage returns are removed so a payload cannot
+ * return to the start of a line and overwrite what was already drawn.
+ */
+export declare function sanitizeTerminalText(value: string, tabWidth?: number): string;
+/**
+ * Sanitize and hard-cap untrusted text destined for a terminal preview.
+ *
+ * A line cap alone is not a bound: a single 200,000-character line passes a
+ * 40-line limit untouched and can scroll a prompt off screen. Callers that show
+ * a preview of attacker-influenced content should bound both dimensions.
+ */
+export declare function sanitizeTerminalPreview(value: string, opts?: {
+    maxLines?: number;
+    maxChars?: number;
+    tabWidth?: number;
+}): {
+    text: string;
+    truncated: boolean;
+};
+//# sourceMappingURL=terminal-sanitize.d.ts.map

package/dist/utils/tool-subject.d.ts

@@ -1,5 +1,5 @@
 export declare function escapeGlobSubject(value: string): string;
 export declare function normalizePathSubject(value: string): string;
 export declare function isPathSubjectKey(subjectKey: string): boolean;
-export declare function subjectForToolInput(toolName: string, input: unknown, subjectKey?: string): string | undefined;
+export declare function subjectForToolInput(toolName: string, input: unknown, subjectKey?: string, subjectFields?: readonly string[]): string | undefined;
 //# sourceMappingURL=tool-subject.d.ts.map

package/instructions/agents/chaos-monkey.md

@@ -23,6 +23,10 @@ execution order and diagnosis, never the mutation set.
 3. Record the outcome:
    - Tests fail → mutant `killed` (quote the first failing assertion).
    - Tests pass → mutant `survived` (this is a weak-test finding, not your failure).
+   - The test command times out or is aborted → mutant `killed-by-hang`
+     (the mutation broke the suite by non-termination — a kill, NOT a
+     survivor; record the timeout as evidence). Never report a hung
+     command as `survived`.
 4. Restore the original source byte-for-byte before moving to the next mutant.
    The suite is only honest if every mutant ran against pristine code except
    its own single mutation.
@@ -47,7 +51,7 @@ Submit via `submit_result`, then repeat it as your final text (fenced JSON):
   "summary": "<one line: N killed / M survived / K skipped>",
   "mutants": [
     { "id": "<plan id>", "file": "...", "line": 0, "kind": "...",
-      "status": "killed | survived | skipped",
+      "status": "killed | survived | skipped | killed-by-hang",
       "evidence": "<failing assertion, or 'suite green' for survivors>" }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/core",
-  "version": "0.309.0",
+  "version": "0.309.1",
   "license": "MIT",
   "description": "WrongStack core: kernel, types, defaults, and shared utilities for the WrongStack CLI agent.",
   "repository": {
@@ -182,8 +182,8 @@
   "wrongstackApiVersion": "0.1.10",
   "dependencies": {
     "zod": "4.4.3",
-    "@wrongstack/kanban": "0.309.0",
-    "@wrongstack/persistence": "0.309.0"
+    "@wrongstack/kanban": "0.309.1",
+    "@wrongstack/persistence": "0.309.1"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
@@ -193,7 +193,7 @@
     "access": "public"
   },
   "optionalDependencies": {
-    "@datadog/pprof": "5.18.0"
+    "@datadog/pprof": "5.18.1"
   },
   "scripts": {
     "build": "node ../../scripts/build-package.mjs",