@wrongstack/core 0.309.0 → 0.310.0

package/dist/types/tool.d.ts

@@ -1,4 +1,4 @@
-import type { Context } from '../core/context.js';
+import type { AgentContext } from './context.js';
 export type Permission = 'auto' | 'confirm' | 'deny';
 /**
  * Risk tier for tools in UI/audit surfaces. YOLO auto-approves non-denied
@@ -101,6 +101,21 @@ export interface Tool<I = unknown, O = unknown> {
      * fall back to the heuristic.
      */
     subjectKey?: string | undefined;
+    /**
+     * Extra input fields folded into the permission subject, after `subjectKey`.
+     *
+     * For a shell-style tool the subject is the whole command line, so the trust
+     * rule is as specific as the invocation. A tool whose parameters are NAMED
+     * FIELDS rather than an argv array has no such luck: `git` sets
+     * `subjectKey: 'command'`, whose value is an enum subcommand, so every
+     * `git push` — any branch, `force` or not — rendered to the subject `"push"`
+     * and one "always allow" covered them all (audit 2026-08-20).
+     *
+     * List the fields that change what the call actually does. Absent fields are
+     * skipped, so adding a field only narrows existing rules (they degrade to a
+     * confirm prompt) and never silently widens one.
+     */
+    subjectFields?: readonly string[] | undefined;
     maxOutputBytes?: number | undefined;
     timeoutMs?: number | undefined;
     /**
@@ -135,7 +150,7 @@ export interface Tool<I = unknown, O = unknown> {
      * Each UI maps this id to its own icon library.
      */
     icon?: ToolIconId | undefined;
-    execute(input: I, ctx: Context, opts: {
+    execute(input: I, ctx: AgentContext, opts: {
         signal: AbortSignal;
     }): Promise<O>;
     /**
@@ -161,7 +176,7 @@ export interface Tool<I = unknown, O = unknown> {
      * have intermediate state shouldn't implement this; the default `execute`
      * path is more efficient.
      */
-    executeStream?(input: I, ctx: Context, opts: {
+    executeStream?(input: I, ctx: AgentContext, opts: {
         signal: AbortSignal;
     }): AsyncIterable<ToolStreamEvent<O>>;
     /**
@@ -207,7 +222,7 @@ export interface Tool<I = unknown, O = unknown> {
      * Avoid double-free by gating one on the other's effect, or pick a single
      * teardown channel per resource.
      */
-    cleanup?(input: I, ctx: Context): Promise<void>;
+    cleanup?(input: I, ctx: AgentContext): Promise<void>;
     /**
      * Optional custom output serializer. When present, the executor's output
      * serializer calls this INSTEAD of the central `renderToolObject()` switch
@@ -228,7 +243,7 @@ export interface ToolCallContext {
     tool: Tool;
     input: unknown;
     callId: string;
-    ctx: Context;
+    ctx: AgentContext;
     signal: AbortSignal;
 }
 /**

package/dist/utils/context-breakdown.d.ts

@@ -1,4 +1,4 @@
-import type { Context } from '../core/context.js';
+import type { AgentContext } from '../types/context.js';
 import { type SystemBlockSource } from '../core/system-prompt-builder.js';
 /**
  * Real, per-category token accounting for the live context window — the data
@@ -61,5 +61,5 @@ export interface ContextBreakdown {
  * interactively (e.g. from `/context`): it walks the full message array once, so
  * it is O(messages·blocks), not the O(1) cached path the per-turn bar uses.
  */
-export declare function getContextBreakdown(ctx: Context): ContextBreakdown;
+export declare function getContextBreakdown(ctx: AgentContext): ContextBreakdown;
 //# sourceMappingURL=context-breakdown.d.ts.map

package/dist/utils/context-evidence.d.ts

@@ -1,4 +1,4 @@
-import type { Context } from '../core/context.js';
+import type { AgentContext } from '../types/context.js';
 import { type TextBlock } from '../types/blocks.js';
 import type { CompactReport } from '../types/compactor.js';
 import type { CompletedWorkEvidence, CompletedWorkSource, ContextEvidenceState, ToolOutputMetadata } from '../types/context-evidence.js';
@@ -13,7 +13,7 @@ export interface RecordToolOutputEvidenceInput {
     outputTokens?: number | undefined;
     outputLines?: number | undefined;
 }
-export declare function recordUserIntentEvidence(ctx: Context, text: string): void;
+export declare function recordUserIntentEvidence(ctx: AgentContext, text: string): void;
 /** Runtime steering/status blocks must not displace real conversation turns. */
 export declare function isRuntimeContextInput(text: string): boolean;
 /**
@@ -25,11 +25,11 @@ export declare function isRuntimeContextInput(text: string): boolean;
  * It is volatile provider evidence, so it never grows the durable chat log or
  * invalidates the cached base prompt.
  */
-export declare function buildConversationContinuityBlock(ctx: Pick<Context, 'contextEvidence' | 'messages'>): TextBlock | undefined;
-export declare function recordToolOutputEvidence(ctx: Context, input: RecordToolOutputEvidenceInput): ToolOutputMetadata;
-export declare function markAssistantReferencedEvidence(ctx: Context, text: string): void;
-export declare function buildContextEvidenceDigest(ctx: Context): string;
-export declare function repeatedReadPressure(ctx: Context): number;
+export declare function buildConversationContinuityBlock(ctx: Pick<AgentContext, 'contextEvidence' | 'messages'>): TextBlock | undefined;
+export declare function recordToolOutputEvidence(ctx: AgentContext, input: RecordToolOutputEvidenceInput): ToolOutputMetadata;
+export declare function markAssistantReferencedEvidence(ctx: AgentContext, text: string): void;
+export declare function buildContextEvidenceDigest(ctx: AgentContext): string;
+export declare function repeatedReadPressure(ctx: AgentContext): number;
 /**
  * Deterministic post-compaction sanity check. Cheap and local: records whether
  * the compacted context still carries an intent anchor and a tool/path trail.
@@ -37,7 +37,7 @@ export declare function repeatedReadPressure(ctx: Context): number;
  * only HybridCompactor did). Advisory on its own — pair with
  * `injectEvidenceFloor` to actually repair a flagged loss.
  */
-export declare function checkCompactionQuality(ctx: Context, opts: {
+export declare function checkCompactionQuality(ctx: AgentContext, opts: {
     collapsedDigest?: string | undefined;
     evidenceDigest?: string | undefined;
     reduced: boolean;
@@ -50,7 +50,7 @@ export declare function checkCompactionQuality(ctx: Context, opts: {
  * no-op when quality is fine or there is no evidence to inject. Returns true
  * when it injected a block (so the caller re-estimates tokens).
  */
-export declare function injectEvidenceFloor(ctx: Context, quality: CompactReport['quality'] | undefined): boolean;
+export declare function injectEvidenceFloor(ctx: AgentContext, quality: CompactReport['quality'] | undefined): boolean;
 /** Marker prefixing the ledger's system-prompt block (also used to find/replace it). */
 export declare const COMPLETED_WORK_LEDGER_MARKER = "[completed_work_ledger]";
 export interface RecordCompletedWorkInput {
@@ -68,14 +68,14 @@ export interface RecordCompletedWorkInput {
  * composer renders this state as a volatile tail block; the stable system-prompt
  * prefix is never mutated here.
  */
-export declare function recordCompletedWorkEvidence(ctx: Context, input: RecordCompletedWorkInput): CompletedWorkEvidence;
+export declare function recordCompletedWorkEvidence(ctx: AgentContext, input: RecordCompletedWorkInput): CompletedWorkEvidence;
 /** Render the ledger's system-prompt block text (marker + newest entries). */
 export declare function formatCompletedWorkLedger(items: readonly CompletedWorkEvidence[]): string;
 /** Build the current volatile completed-work block without mutating the prompt. */
-export declare function buildCompletedWorkLedgerBlock(ctx: Context): TextBlock | undefined;
+export declare function buildCompletedWorkLedgerBlock(ctx: AgentContext): TextBlock | undefined;
 /**
  * @deprecated Volatile state must be composed at request time. Kept as a
  * compatibility no-op for embedders importing the old helper.
  */
-export declare function syncCompletedWorkLedgerBlock(_ctx: Context): void;
+export declare function syncCompletedWorkLedgerBlock(_ctx: AgentContext): void;
 //# sourceMappingURL=context-evidence.d.ts.map

package/dist/utils/crash-shield.d.ts

@@ -1,3 +1,12 @@
+/** Register a synchronous salvage hook. Returns an unregister function. */
+export declare function addFatalSalvageHook(hook: () => void): () => void;
+/**
+ * Run every registered salvage hook once. Swallows individual hook failures
+ * so one broken hook cannot skip the remaining ones. Safe to call multiple
+ * times — hooks are expected to be idempotent (a drained buffer stays
+ * drained).
+ */
+export declare function runFatalSalvageSync(): void;
 interface CrashShieldTarget {
     on(event: 'unhandledRejection' | 'uncaughtException', listener: (reason: unknown) => void): unknown;
     off(event: 'unhandledRejection' | 'uncaughtException', listener: (reason: unknown) => void): unknown;

package/dist/utils/heap-watchdog.js

@@ -2,7 +2,10 @@
 import * as fs from "node:fs";
 import * as fsp2 from "node:fs/promises";
 import * as path3 from "node:path";
-import { PerformanceObserver, constants as performanceConstants } from "node:perf_hooks";
+import {
+  PerformanceObserver,
+  constants as performanceConstants
+} from "node:perf_hooks";
 import * as v8 from "node:v8";
 
 // src/utils/memory-flight-recorder.ts
@@ -308,7 +311,8 @@ function createMemoryFlightRecorder(options = {}) {
   const now = options.now ?? Date.now;
   const startedAt = now();
   const root = options.diagnosticsRoot ?? path2.join(wstackGlobalRoot(), "diagnostics", "memory");
-  const enabled = options.enabled ?? (process.env["WRONGSTACK_MEMORY_FLIGHT_RECORDER"] !== "0" && process.env["NODE_ENV"] !== "test");
+  const isBunRuntime = typeof globalThis.Bun !== "undefined";
+  const enabled = options.enabled ?? (!isBunRuntime && process.env["WRONGSTACK_MEMORY_FLIGHT_RECORDER"] !== "0" && process.env["NODE_ENV"] !== "test");
   const writer = options.captureWriter ?? (enabled ? new ContinuousMemoryCaptureWriter(root) : disabledWriter(path2.join(root, `${timestampSlug()}-pid-${process.pid}`)));
   const observations = [];
   const windowMs = options.windowMs ?? DEFAULT_WINDOW_MS;
@@ -418,7 +422,11 @@ function defaultHeapLogPath() {
 function takeHeapSample() {
   const m = process.memoryUsage();
   const heap = v8.getHeapStatistics();
-  const spaces = v8.getHeapSpaceStatistics();
+  let spaces = [];
+  try {
+    spaces = v8.getHeapSpaceStatistics();
+  } catch {
+  }
   const spaceUsed = (name) => spaces.find((space) => space.space_name === name)?.space_used_size ?? 0;
   const limit = heap.heap_size_limit || 0;
   let activeResources = 0;

package/dist/utils/index.d.ts

@@ -7,7 +7,7 @@ export * from './config-backup.js';
 export * from './config-json.js';
 export { checkConnectivity, resetConnectivityCache } from './connectivity.js';
 export { type ContextBreakdown, getContextBreakdown } from './context-breakdown.js';
-export { type CrashShieldOptions, installCrashShield } from './crash-shield.js';
+export { addFatalSalvageHook, runFatalSalvageSync, type CrashShieldOptions, installCrashShield, } from './crash-shield.js';
 export { buildCompletedWorkLedgerBlock, buildContextEvidenceDigest, COMPLETED_WORK_LEDGER_MARKER, createContextEvidenceState, formatCompletedWorkLedger, markAssistantReferencedEvidence, type RecordCompletedWorkInput, type RecordToolOutputEvidenceInput, recordCompletedWorkEvidence, recordToolOutputEvidence, recordUserIntentEvidence, repeatedReadPressure, syncCompletedWorkLedgerBlock, } from './context-evidence.js';
 export { type DeepMergeOptions, deepMerge, FORBIDDEN_PROTO_KEYS, isPrimitiveArray, } from './deep-merge.js';
 export * from './diff.js';
@@ -44,6 +44,7 @@ export { withSqliteExperimentalWarningSuppressed } from './sqlite-warning.js';
 export * from './string.js';
 export * from './task-format.js';
 export { buildSgrSequence, buildTitleSequence, type ColorDepth, detectTerminal, ESCAPE_TERMINATOR, type EscapeEmitResult, type EscapeSequence, isStdinTTY, type MouseProtocol, onResize, safeEmit, setOutputLineGuard, setRawMode, setTitle, type TerminalCapability, TerminalLifecycle, writeErr, writeOut, } from './term.js';
+export { sanitizeTerminalPreview, sanitizeTerminalText } from './terminal-sanitize.js';
 export * from './todos-format.js';
 export { computeMessageTokens, estimateMessageTokens, estimateRequestTokens, estimateRequestTokensCalibrated, estimateTextTokens, estimateToolDefTokens, estimateToolInputTokens, estimateToolResultTokens, getCalibrationState, type RequestTokenBreakdown, recordActualUsage, resetCalibration, } from './token-estimate.js';
 export { applyToolDescriptionModes, applyToolDescriptionModeToTool, DEFAULT_TOOL_DESCRIPTION_MODE, getToolDescriptionMode, normalizeToolDescriptionMode, resolveToolDescriptionMode, setToolDescriptionMode, simplifyToolDescription, type ToolDescriptionRegistryLike, } from './tool-description-mode.js';

package/dist/utils/index.js

@@ -1915,6 +1915,22 @@ function getContextBreakdown(ctx) {
 // src/utils/crash-shield.ts
 var CRASH_STORM_WINDOW_MS = 6e4;
 var CRASH_STORM_LIMIT = 20;
+var fatalSalvageHooks = [];
+function addFatalSalvageHook(hook) {
+  fatalSalvageHooks.push(hook);
+  return () => {
+    const idx = fatalSalvageHooks.indexOf(hook);
+    if (idx >= 0) fatalSalvageHooks.splice(idx, 1);
+  };
+}
+function runFatalSalvageSync() {
+  for (const hook of [...fatalSalvageHooks]) {
+    try {
+      hook();
+    } catch {
+    }
+  }
+}
 function isBrokenOutputConsumer(error) {
   if (typeof error !== "object" || error === null || !("code" in error)) return false;
   return error.code === "EPIPE" || error.code === "ECONNRESET" || error.code === "ECONNABORTED";
@@ -1950,6 +1966,7 @@ function installCrashShield(options = {}) {
           `error storm: >${CRASH_STORM_LIMIT} in ${CRASH_STORM_WINDOW_MS / 1e3}s \u2014 exiting`
         )
       );
+      runFatalSalvageSync();
       exit(1);
     }
   };
@@ -2232,49 +2249,57 @@ async function expandGlob(pattern) {
   async function walk2(dir, pat) {
     let entries;
     try {
-      entries = await fsp.readdir(dir);
+      entries = await fsp.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
-    const firstGlob = pat.search(/[*?[[]/);
-    if (firstGlob < 0) {
-      const re = globToRegex(pat);
+    if (pat.startsWith("**/")) {
+      const rest = pat.slice(3);
+      await walk2(dir, rest);
       for (const e of entries) {
-        if (re.test(e)) {
-          const full = `${dir}${SEP}${e}`;
-          results.add(abs ? resolve2(full) : full);
+        if (e.isDirectory()) {
+          const subDir = `${dir}${SEP}${e.name}`;
+          await walk2(subDir, pat);
         }
       }
       return;
     }
-    const before = pat.slice(0, firstGlob);
-    const rest = pat.slice(firstGlob);
-    if (before.endsWith("**")) {
-      await walk2(dir, rest);
+    if (pat === "**") {
       for (const e of entries) {
-        const full = `${dir}${SEP}${e}`;
-        try {
-          const stat4 = await fsp.stat(full);
-          if (stat4.isDirectory()) await walk2(full, rest);
-        } catch {
+        const full = `${dir}${SEP}${e.name}`;
+        results.add(abs ? resolve2(full) : full);
+        if (e.isDirectory()) {
+          await walk2(full, "**");
         }
       }
-    } else if (before === "") {
-      const re = globToRegex(rest);
+      return;
+    }
+    const firstSlash = pat.indexOf("/");
+    if (firstSlash < 0) {
+      const re = globToRegex(pat);
       for (const e of entries) {
-        if (re.test(e)) {
-          const full = `${dir}${SEP}${e}`;
+        if (re.test(e.name)) {
+          const full = `${dir}${SEP}${e.name}`;
           results.add(abs ? resolve2(full) : full);
         }
       }
+      return;
+    }
+    const currentSeg = pat.slice(0, firstSlash);
+    const remainingPat = pat.slice(firstSlash + 1);
+    if (isGlob(currentSeg)) {
+      const re = globToRegex(currentSeg);
+      for (const e of entries) {
+        if (e.isDirectory() && re.test(e.name)) {
+          const subDir = `${dir}${SEP}${e.name}`;
+          await walk2(subDir, remainingPat);
+        }
+      }
     } else {
-      const seg = before.replace(/[*?[\]]/g, "").replace(/\/$/, "");
-      if (entries.includes(seg)) {
-        const full = `${dir}${SEP}${seg}`;
-        try {
-          const stat4 = await fsp.stat(full);
-          if (stat4.isDirectory()) await walk2(full, rest);
-        } catch {
+      for (const e of entries) {
+        if (e.isDirectory() && e.name === currentSeg) {
+          const subDir = `${dir}${SEP}${e.name}`;
+          await walk2(subDir, remainingPat);
         }
       }
     }
@@ -2379,7 +2404,10 @@ function matchAnyCommand(patterns, input) {
 import * as fs4 from "node:fs";
 import * as fsp3 from "node:fs/promises";
 import * as path5 from "node:path";
-import { PerformanceObserver, constants as performanceConstants } from "node:perf_hooks";
+import {
+  PerformanceObserver,
+  constants as performanceConstants
+} from "node:perf_hooks";
 import * as v8 from "node:v8";
 
 // src/utils/memory-flight-recorder.ts
@@ -2696,8 +2724,8 @@ async function pruneOldSessions(root, currentDir) {
   const sessions = await Promise.all(
     entries.filter((entry) => entry.isDirectory() && entry.name !== path4.basename(currentDir)).map(async (entry) => {
       const fullPath = path4.join(root, entry.name);
-      const stat4 = await fsp2.stat(fullPath);
-      return { fullPath, mtimeMs: stat4.mtimeMs };
+      const stat3 = await fsp2.stat(fullPath);
+      return { fullPath, mtimeMs: stat3.mtimeMs };
     })
   );
   sessions.sort((a, b) => b.mtimeMs - a.mtimeMs);
@@ -2815,7 +2843,8 @@ function createMemoryFlightRecorder(options = {}) {
   const now = options.now ?? Date.now;
   const startedAt = now();
   const root = options.diagnosticsRoot ?? path4.join(wstackGlobalRoot(), "diagnostics", "memory");
-  const enabled = options.enabled ?? (process.env["WRONGSTACK_MEMORY_FLIGHT_RECORDER"] !== "0" && process.env["NODE_ENV"] !== "test");
+  const isBunRuntime = typeof globalThis.Bun !== "undefined";
+  const enabled = options.enabled ?? (!isBunRuntime && process.env["WRONGSTACK_MEMORY_FLIGHT_RECORDER"] !== "0" && process.env["NODE_ENV"] !== "test");
   const writer = options.captureWriter ?? (enabled ? new ContinuousMemoryCaptureWriter(root) : disabledWriter(path4.join(root, `${timestampSlug()}-pid-${process.pid}`)));
   const observations = [];
   const windowMs = options.windowMs ?? DEFAULT_WINDOW_MS;
@@ -2925,7 +2954,11 @@ function defaultHeapLogPath() {
 function takeHeapSample() {
   const m = process.memoryUsage();
   const heap = v8.getHeapStatistics();
-  const spaces = v8.getHeapSpaceStatistics();
+  let spaces = [];
+  try {
+    spaces = v8.getHeapSpaceStatistics();
+  } catch {
+  }
   const spaceUsed = (name) => spaces.find((space) => space.space_name === name)?.space_used_size ?? 0;
   const limit = heap.heap_size_limit || 0;
   let activeResources = 0;
@@ -4270,130 +4303,11 @@ function watchProjectTree(root, listener, opts) {
 }
 
 // src/utils/regex-guard.ts
-var MAX_PATTERN_LEN = 256;
-var DANGEROUS_PATTERNS = [
-  // (a+)+, (.*)+, etc — nested quantifier on a group with internal quantifier
-  /(\([^)]*[+*][^)]*\))[+*]/,
-  /(\(\?:[^)]*[+*][^)]*\))[+*]/,
-  // Adjacent quantifiers: a++ a*+
-  /[+*]{2,}/,
-  // Quantifier on alternation with length 2+
-  /\([^|)]+\|[^)]+\)[+*][+*]/,
-  // Greedy quantifier inside lookahead/lookbehind — (?!.*a+)
-  /[([][^)\]]*[+*][^)\]]*[)\]][^)]*\?\??/
-];
-function hasAmbiguousQuantifiedAlternation(pattern) {
-  for (let i = 0; i < pattern.length; i++) {
-    if (pattern[i] !== "(") continue;
-    if (i > 0 && pattern[i - 1] === "\\") continue;
-    let depth = 0;
-    let inClass = false;
-    let j = i;
-    for (; j < pattern.length; j++) {
-      const ch = pattern[j];
-      if (ch === "\\") {
-        j++;
-        continue;
-      }
-      if (inClass) {
-        if (ch === "]") inClass = false;
-        continue;
-      }
-      if (ch === "[") {
-        inClass = true;
-        continue;
-      }
-      if (ch === "(") depth++;
-      else if (ch === ")") {
-        depth--;
-        if (depth === 0) break;
-      }
-    }
-    if (j >= pattern.length) return false;
-    const next = pattern[j + 1];
-    if (next !== "+" && next !== "*" && next !== "{") continue;
-    let inner = pattern.slice(i + 1, j);
-    inner = inner.replace(/^\?(?::|<?[=!])/u, "");
-    const branches = [];
-    let current = "";
-    let d = 0;
-    let cls = false;
-    for (let k = 0; k < inner.length; k++) {
-      const ch = inner[k];
-      if (ch === "\\") {
-        current += ch + (inner[k + 1] ?? "");
-        k++;
-        continue;
-      }
-      if (cls) {
-        if (ch === "]") cls = false;
-        current += ch;
-        continue;
-      }
-      if (ch === "[") {
-        cls = true;
-        current += ch;
-        continue;
-      }
-      if (ch === "(") d++;
-      if (ch === ")") d--;
-      if (ch === "|" && d === 0) {
-        branches.push(current);
-        current = "";
-        continue;
-      }
-      current += ch;
-    }
-    branches.push(current);
-    if (branches.length < 2) continue;
-    for (let a = 0; a < branches.length; a++) {
-      for (let b = a + 1; b < branches.length; b++) {
-        const x = branches[a];
-        const y = branches[b];
-        if (x === "" || y === "") return true;
-        if (x === y || x.startsWith(y) || y.startsWith(x)) return true;
-      }
-    }
-  }
-  return false;
-}
-function compileUserRegex(pattern, flags) {
-  if (typeof pattern !== "string") {
-    return { ok: false, reason: "pattern must be a string" };
-  }
-  if (pattern.length === 0) {
-    return { ok: false, reason: "pattern is empty" };
-  }
-  if (pattern.length > MAX_PATTERN_LEN) {
-    return { ok: false, reason: `pattern exceeds ${MAX_PATTERN_LEN} characters` };
-  }
-  for (const rx of DANGEROUS_PATTERNS) {
-    if (rx.test(pattern)) {
-      return {
-        ok: false,
-        reason: "pattern looks vulnerable to catastrophic backtracking \u2014 rewrite without nested quantifiers"
-      };
-    }
-  }
-  if (hasAmbiguousQuantifiedAlternation(pattern)) {
-    return {
-      ok: false,
-      reason: "pattern quantifies an alternation with overlapping branches \u2014 rewrite so no two branches can match the same text"
-    };
-  }
-  try {
-    return { ok: true, regex: new RegExp(pattern, flags) };
-  } catch (err) {
-    return {
-      ok: false,
-      reason: err instanceof Error ? err.message : "invalid regex"
-    };
-  }
-}
-var MAX_SUBJECT_LEN = 64 * 1024;
-function capSubject(line) {
-  return line.length > MAX_SUBJECT_LEN ? line.slice(0, MAX_SUBJECT_LEN) : line;
-}
+import {
+  capSubject,
+  compileUserRegex,
+  MAX_SUBJECT_LEN
+} from "@wrongstack/primitives";
 
 // src/utils/safe-json.ts
 function safeParse(input, maxBytes = 5e6) {
@@ -4710,6 +4624,42 @@ function formatTaskList(tasks) {
   return lines.join("\n");
 }
 
+// src/utils/terminal-sanitize.ts
+var ANSI_RE = /\x1b\[[0-?]*[ -/]*[@-~]/g;
+var ANSI_OSC_RE = /\x1b\][\s\S]*?(?:\x07|\x1b\\)/g;
+var ANSI_CONTROL_STRING_RE = /\x1b[P^_X][\s\S]*?\x1b\\/g;
+var ANSI_ESCAPE_RE = /\x1b[ -/]*[@-~]/g;
+var BIDI_AND_ZERO_WIDTH_RE = /[​-‏‪-‮⁦-⁩]/g;
+function sanitizeTerminalText(value, tabWidth = 2) {
+  const tab = " ".repeat(Math.max(1, Math.min(8, Math.floor(tabWidth))));
+  const withoutEscapes = value.replace(ANSI_OSC_RE, "").replace(ANSI_CONTROL_STRING_RE, "").replace(ANSI_RE, "").replace(ANSI_ESCAPE_RE, "").replace(BIDI_AND_ZERO_WIDTH_RE, "").replace(/\t/g, tab).replace(/\r/g, "");
+  let safe = "";
+  for (const char of withoutEscapes) {
+    const code = char.codePointAt(0) ?? 0;
+    if (char === "\n" || code >= 32 && code !== 127 && !(code >= 128 && code <= 159)) {
+      safe += char;
+    }
+  }
+  return safe;
+}
+function sanitizeTerminalPreview(value, opts = {}) {
+  const maxLines = opts.maxLines ?? 40;
+  const maxChars = opts.maxChars ?? 8e3;
+  const safe = sanitizeTerminalText(value, opts.tabWidth);
+  let truncated = false;
+  let clipped = safe;
+  if (clipped.length > maxChars) {
+    clipped = clipped.slice(0, maxChars);
+    truncated = true;
+  }
+  const lines = clipped.split("\n");
+  if (lines.length > maxLines) {
+    clipped = lines.slice(0, maxLines).join("\n");
+    truncated = true;
+  }
+  return { text: clipped, truncated };
+}
+
 // src/utils/tool-description-mode.ts
 var DEFAULT_TOOL_DESCRIPTION_MODE = "extend";
 var ORIGINAL_TOOL_DESCRIPTION = /* @__PURE__ */ Symbol.for("wrongstack.tool.originalDescription");
@@ -5589,9 +5539,21 @@ function renderCommandLine(command, args) {
   });
   return [command, ...rendered].join(" ");
 }
-function subjectForToolInput(toolName, input, subjectKey) {
+function renderSubjectFields(obj, fields) {
+  const parts = [];
+  for (const field of fields) {
+    const value = obj[field];
+    if (value === void 0 || value === null || value === "" || value === false) continue;
+    const str = String(value);
+    parts.push(`${field}=${/\s/.test(str) ? `"${str.replace(/"/g, '\\"')}"` : str}`);
+  }
+  return parts.join(" ");
+}
+function subjectForToolInput(toolName, input, subjectKey, subjectFields) {
   if (!input || typeof input !== "object") return void 0;
   const obj = input;
+  const extra = subjectFields && subjectFields.length > 0 ? renderSubjectFields(obj, subjectFields) : "";
+  const withExtra = (base) => extra ? `${base} ${extra}` : base;
   if (subjectKey) {
     const value = obj[subjectKey];
     if (Array.isArray(value)) {
@@ -5607,9 +5569,9 @@ function subjectForToolInput(toolName, input, subjectKey) {
       if (subjectKey === "command") {
         const rendered = renderCommandLine(value, obj["args"]);
         if (value === "commit" && obj["dry_run"] === true) {
-          return `${escapeGlobSubject(rendered)}:dry-run`;
+          return `${escapeGlobSubject(withExtra(rendered))}:dry-run`;
         }
-        return escapeGlobSubject(rendered);
+        return escapeGlobSubject(withExtra(rendered));
       }
       if (subjectKey === "directory" && obj["dry_run"] === true) {
         return `${escapeGlobSubject(value)}:dry-run`;
@@ -5662,7 +5624,7 @@ var DEFAULT_WALK_IGNORE_DIRS = Object.freeze([
 var DEFAULT_WALK_IGNORE_SET = new Set(DEFAULT_WALK_IGNORE_DIRS);
 
 // src/utils/win32-cmd.ts
-var WIN32_CMD_META = /[&|<>"\r\n\0]/;
+var WIN32_CMD_META = /[&|<>"%\r\n\0]/;
 function buildWin32CmdShimInvocation(command, args = []) {
   assertSafeWin32CmdArgs([command, ...args]);
   const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
@@ -5751,6 +5713,7 @@ export {
   WIRE_TOOL_NAME_MAX_LENGTH,
   WIRE_TOOL_NAME_PATTERN,
   activateProjectStateGuard,
+  addFatalSalvageHook,
   applyToolDescriptionModeToTool,
   applyToolDescriptionModes,
   applyToolResultRenderModes,
@@ -5885,6 +5848,7 @@ export {
   resolveToolDescriptionMode,
   resolveToolResultRenderMode,
   resolveWstackPaths,
+  runFatalSalvageSync,
   safeEmit,
   safeParse,
   safeProfileName,
@@ -5893,6 +5857,8 @@ export {
   sanitizeMemoryEvidenceBody,
   sanitizeMemoryEvidenceSource,
   sanitizeNodeOptions,
+  sanitizeTerminalPreview,
+  sanitizeTerminalText,
   sanitizeWireToolName,
   sessionScopedPath,
   setJsonPath,

package/dist/utils/regex-guard.d.ts

@@ -1,35 +1,12 @@
 /**
  * Compile a user-supplied regex with conservative bounds against ReDoS.
  *
- * Duplicated from @wrongstack/tools/_regex.ts to avoid a circular
- * dependency (tools depends on core, not vice versa). There is a THIRD copy —
- * `@wrongstack/kanban/src/verification/safe-regex.ts` — which sits below both
- * in the workspace DAG for the same reason. This header used to say "keep
- * both copies in sync", unaware of the third, and this copy had drifted the
- * furthest: 2 of the 5 heuristics, a 512-character cap instead of 256, and no
- * subject cap at all. `packages/tools/tests/regex-guard-parity.test.ts` now
- * holds all three to the same verdicts — change one, change all three.
- *
- * V8's regex engine is backtracking-based and cannot interrupt a
- * synchronous match — a pattern like `(a+)+$` against a sufficiently
- * long line will pin a worker for seconds.
- */
-export interface CompileResult {
-    ok: true;
-    regex: RegExp;
-}
-export interface CompileFail {
-    ok: false;
-    reason: string;
-}
-export declare function compileUserRegex(pattern: string, flags: string): CompileResult | CompileFail;
-/**
- * Truncate a subject line to a safe length for synchronous regex eval.
- *
- * The canonical copy has always shipped this; this one did not, so callers
- * here bounded the pattern but never the SUBJECT — and a linear-time pattern
- * over a multi-megabyte line is still a stall.
+ * Canonical home since card #5: `@wrongstack/primitives/src/regex-guard.ts`
+ * (a dependency leaf, so every workspace tier — including kanban, which sits
+ * below core and tools — can share one implementation). This module is now a
+ * re-export shim: importers of `@wrongstack/core/utils` keep working, and
+ * `tools/tests/regex-guard-parity.test.ts` still pins all three historical
+ * entry points to identical verdicts (now trivially true — one code path).
  */
-export declare const MAX_SUBJECT_LEN: number;
-export declare function capSubject(line: string): string;
+export { type CompileFail, type CompileResult, capSubject, compileUserRegex, MAX_SUBJECT_LEN, } from '@wrongstack/primitives';
 //# sourceMappingURL=regex-guard.d.ts.map