@wrongstack/core 0.309.0 → 0.310.0

package/dist/core/index.js

@@ -1751,6 +1751,14 @@ var PATTERNS = [
     anchor: "sk-ant-"
   },
   { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  {
+    // `xai` is a first-class provider in this codebase, but its key shape was
+    // absent here — so the one credential format WrongStack itself hands users
+    // was the one the scrubber could not recognize (audit 2026-08-20).
+    type: "xai_key",
+    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    anchor: "xai-"
+  },
   { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
   { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
   { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
@@ -1841,8 +1849,8 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
   },
   {
     type: "json_credential_key",
@@ -1959,6 +1967,27 @@ var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
+var PEM_END_MARKER = "-----END";
+var MAX_PEM_BLOCK_BYTES = 64 * 1024;
+var PEM_END_LINE_TOLERANCE = 64;
+function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
+  const head = text.slice(chunkStart, proposedEnd);
+  const lastBegin = head.lastIndexOf("-----BEGIN ");
+  if (lastBegin === -1) return proposedEnd;
+  const fromBegin = text.slice(chunkStart + lastBegin);
+  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
+  if (!marker || marker.index !== 0) return proposedEnd;
+  const bodyStart = marker[0].length;
+  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
+  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
+  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
+    return proposedEnd;
+  }
+  const lineEnd = fromBegin.indexOf("\n", closeIdx);
+  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
+  return Math.max(proposedEnd, end);
+}
 var PATTERN_ANCHORS = [
   ...new Set(
     PATTERNS.flatMap(
@@ -1995,6 +2024,7 @@ var DefaultSecretScrubber = class {
           }
         }
         end = safe === -1 ? end : safe + 1;
+        end = extendChunkBoundaryPastPem(text, i, end);
       }
       out.push(this.scrubOne(text.slice(i, end)));
       i = end;
@@ -4732,7 +4762,9 @@ function hasToolUseBlock(message) {
   return message?.role === "assistant" && Array.isArray(message.content) && message.content.some((block) => block.type === "tool_use");
 }
 var ConversationState = class {
+  /** Owning context; public for structural typing (Roadmap 10A). */
   ctx;
+  /** Subscribers; public for structural typing (Roadmap 10A). */
   listeners = /* @__PURE__ */ new Set();
   _revision = 0;
   constructor(ctx) {
@@ -4787,9 +4819,8 @@ var ConversationState = class {
   }
   /**
    * How many of the oldest messages must be dropped to satisfy both retention
-   * caps — count ({@link Context.MAX_MESSAGES}) and size
-   * ({@link Context.MAX_MESSAGE_TOKENS}). Returns 0 when the history already
-   * fits, which is the overwhelmingly common case.
+   * caps — count and size (see {@link AgentContext.messageLimits}). Returns 0
+   * when the history already fits, which is the overwhelmingly common case.
    *
    * The size pass reads the per-message `_estTokens` cache populated at
    * mutation time, so it is a sum over numbers rather than a re-walk of
@@ -4797,9 +4828,7 @@ var ConversationState = class {
    * cap determines the starting index for the sum but does not gate it.
    */
   overflowCount(arr) {
-    const contextClass = this.ctx.constructor;
-    const maxMessages = contextClass.MAX_MESSAGES;
-    const maxMessageTokens = contextClass.MAX_MESSAGE_TOKENS;
+    const { maxMessages, maxMessageTokens } = this.ctx.messageLimits;
     let drop = maxMessages > 0 ? Math.max(0, arr.length - maxMessages) : 0;
     if (maxMessageTokens <= 0) return this.protocolSafeDropCount(arr, drop);
     let total = 0;
@@ -5073,6 +5102,10 @@ var Context = class _Context {
    * so storage operations can include it in `storage.*` events.
    */
   traceId;
+  /** Logical provider request whose response produced the current tool calls. */
+  activeLogicalRequestId = void 0;
+  /** Content-addressed prompt composition for {@link activeLogicalRequestId}. */
+  activePromptManifestId = void 0;
   /**
    * Session id pinned to the currently-executing run. Set by `Agent.run()`
    * at run start and cleared when the run ends. Event-emission sites must
@@ -5098,6 +5131,7 @@ var Context = class _Context {
     return resolveEventSessionId(this);
   }
   /** Callbacks fired when `setWorkingDir()` changes the working directory. */
+  /** WorkingDir-change callbacks; public for structural typing (Roadmap 10A). */
   _onWorkingDirChanged = [];
   /**
    * Serializes externally requested provider/model changes. Request creation
@@ -5353,7 +5387,16 @@ var Context = class _Context {
    * For hooks that must survive across run boundaries (mailbox heartbeat,
    * awareness polling, HQ publisher), prefer `registerAgentHook` instead.
    */
+  /** Run-scoped abort hooks (drained by drainAbortHooks). Public for structural typing (Roadmap 10A). */
   abortHooks = /* @__PURE__ */ new Set();
+  /** Retention limits honoring runtime subclass overrides of the statics. */
+  get messageLimits() {
+    const cls = this.constructor;
+    return Object.freeze({
+      maxMessages: cls.MAX_MESSAGES,
+      maxMessageTokens: cls.MAX_MESSAGE_TOKENS
+    });
+  }
   registerAbortHook(fn) {
     this.abortHooks.add(fn);
     return () => this.abortHooks.delete(fn);
@@ -5378,6 +5421,7 @@ var Context = class _Context {
    * awareness polling interval, HQ publisher connection, and auto-compaction
    * timer — resources that must survive from the first run to the last.
    */
+  /** Session-lifetime teardown hooks (drained by drainAgentHooks). Public for structural typing (Roadmap 10A). */
   agentHooks = /* @__PURE__ */ new Set();
   registerAgentHook(fn) {
     this.agentHooks.add(fn);
@@ -5558,6 +5602,9 @@ var Context = class _Context {
       agentName: this.agentName,
       provider: typeof this.provider === "object" ? this.provider.id : String(this.provider),
       model: this.model,
+      ...this.activeLogicalRequestId ? { logicalRequestId: this.activeLogicalRequestId } : {},
+      ...this.activePromptManifestId ? { promptManifestId: this.activePromptManifestId } : {},
+      provenanceConfidence: this.activeLogicalRequestId && this.activePromptManifestId ? "explicit" : "unknown",
       toolName: input.toolName,
       toolUseId: input.toolUseId,
       scope,
@@ -5585,6 +5632,9 @@ var Context = class _Context {
       agentName: this.agentName,
       provider: record.provider,
       model: record.model,
+      ...record.logicalRequestId ? { logicalRequestId: record.logicalRequestId } : {},
+      ...record.promptManifestId ? { promptManifestId: record.promptManifestId } : {},
+      provenanceConfidence: record.provenanceConfidence,
       toolName: input.toolName,
       toolUseId: input.toolUseId,
       scope,
@@ -6240,6 +6290,7 @@ function maybeAppendPendingNextSteps(ctx, res) {
 // src/prompts/prompt-journal.ts
 import * as fs5 from "node:fs/promises";
 import * as path11 from "node:path";
+var defaultScrubber2 = new DefaultSecretScrubber();
 async function ensureGitignore(projectRoot) {
   const gitignorePath = path11.join(projectRoot, ".gitignore");
   try {
@@ -6267,7 +6318,9 @@ async function recordPromptJournalEntry(opts) {
   const monthStr = dateStr.slice(0, 7);
   const sessionId = opts.sessionId && opts.sessionId.trim() ? opts.sessionId.trim() : "general";
   const id = `pmt_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
-  const content = opts.content ?? "";
+  const content = defaultScrubber2.scrub(opts.content ?? "");
+  const rawContent = typeof opts.rawContent === "string" && opts.rawContent.length > 0 ? defaultScrubber2.scrub(opts.rawContent) : opts.rawContent;
+  const decisionReason = typeof opts.decisionReason === "string" && opts.decisionReason.length > 0 ? defaultScrubber2.scrub(opts.decisionReason) : opts.decisionReason;
   const lines = content.split("\n");
   const characterCount = content.length;
   const lineCount = lines.length;
@@ -6280,7 +6333,7 @@ async function recordPromptJournalEntry(opts) {
     role: opts.role ?? (opts.category === "system_prompt" ? "system" : "user"),
     category: opts.category,
     content,
-    rawContent: opts.rawContent,
+    rawContent,
     metadata: {
       model: opts.model,
       provider: opts.provider,
@@ -6291,7 +6344,7 @@ async function recordPromptJournalEntry(opts) {
       activeTools: opts.activeTools,
       contextFiles: opts.contextFiles,
       durationMs: opts.durationMs,
-      decisionReason: opts.decisionReason,
+      decisionReason,
       tags: opts.tags
     }
   };
@@ -6739,7 +6792,12 @@ async function streamProviderToResponse(provider, req, signal, ctx, events, logg
             const idVal = ev.id;
             const nameVal = ev.name;
             handleToolUseStart(state, { id: idVal, name: nameVal });
-            const emittedPayload = { sessionId, ctx, id: idVal ?? "unknown", name: nameVal ?? "unknown" };
+            const emittedPayload = {
+              sessionId,
+              ctx,
+              id: idVal ?? "unknown",
+              name: nameVal ?? "unknown"
+            };
             events.emit("provider.tool_use_start", emittedPayload);
             break;
           }
@@ -7042,6 +7100,8 @@ async function runProviderWithRetry(opts) {
   const { provider, request, signal, ctx, events, retry, logger, tracer } = opts;
   const logicalRequestId = randomUUID5();
   const promptManifest = createChroniclePromptManifest(request);
+  ctx.activeLogicalRequestId = logicalRequestId;
+  ctx.activePromptManifestId = promptManifest.manifestId;
   let attempt = 0;
   for (; ; ) {
     const attemptId = randomUUID5();
@@ -7052,6 +7112,7 @@ async function runProviderWithRetry(opts) {
       ...ctx.traceId ? { traceId: ctx.traceId } : {},
       ...ctx.agentId ? { agentId: ctx.agentId } : {},
       logicalRequestId,
+      promptManifestId: promptManifest.manifestId,
       attemptId,
       attempt,
       providerId: provider.id,
@@ -7075,15 +7136,18 @@ async function runProviderWithRetry(opts) {
     });
     logger.debug(`Provider attempt ${attempt + 1} starting`, providerLogCtx(provider, request));
     try {
-      const res = await runWithNetworkTelemetry({
-        events,
-        sessionId: resolveEventSessionId(ctx),
-        ...ctx.traceId ? { traceId: ctx.traceId } : {},
-        ...ctx.agentId ? { agentId: ctx.agentId } : {},
-        attemptId,
-        initiator: "provider",
-        operationName: `${provider.id}.complete`
-      }, () => provider.capabilities.streaming ? streamProviderToResponse(provider, request, signal, ctx, events, logger) : provider.complete(request, { signal }));
+      const res = await runWithNetworkTelemetry(
+        {
+          events,
+          sessionId: resolveEventSessionId(ctx),
+          ...ctx.traceId ? { traceId: ctx.traceId } : {},
+          ...ctx.agentId ? { agentId: ctx.agentId } : {},
+          attemptId,
+          initiator: "provider",
+          operationName: `${provider.id}.complete`
+        },
+        () => provider.capabilities.streaming ? streamProviderToResponse(provider, request, signal, ctx, events, logger) : provider.complete(request, { signal })
+      );
       span?.setAttribute("provider.stopReason", res.stopReason);
       span?.setAttribute("provider.usage_in", res.usage.input);
       span?.setAttribute("provider.usage_out", res.usage.output);
@@ -8824,6 +8888,8 @@ function createAgentToolHandler(a) {
     a.events.emit("tool.executed", {
       sessionId: resolveEventSessionId(a.ctx),
       ...a.ctx.traceId ? { traceId: a.ctx.traceId } : {},
+      ...a.ctx.activeLogicalRequestId ? { logicalRequestId: a.ctx.activeLogicalRequestId } : {},
+      ...a.ctx.activePromptManifestId ? { promptManifestId: a.ctx.activePromptManifestId } : {},
       agentId: a.ctx.agentId,
       agentName: a.ctx.agentName,
       id: toolUseId,
@@ -8891,10 +8957,7 @@ function createAgentToolHandler(a) {
           } catch {
           }
         }
-        if (decision === "yes") {
-          const p = a.permission;
-          p.allowOnce?.({ tool: tool.name, pattern: result.suggestedPattern });
-        } else if (decision === "no") {
+        if (decision === "no") {
           const p = a.permission;
           p.denyOnce?.({ tool: tool.name, pattern: result.suggestedPattern });
         }
@@ -9338,6 +9401,8 @@ var Agent = class {
     const sessionId = sessionWriter.id;
     this.ctx.activeRunSessionWriter = sessionWriter;
     this.ctx.activeRunSessionId = sessionId;
+    this.ctx.activeLogicalRequestId = void 0;
+    this.ctx.activePromptManifestId = void 0;
     controller.onAbort(() => this.ctx.drainAbortHooks());
     controller.onAbort(async () => {
       await sessionWriter.flush().catch(() => {
@@ -9441,6 +9506,8 @@ var Agent = class {
       } finally {
         this.ctx.activeRunSessionId = void 0;
         this.ctx.activeRunSessionWriter = void 0;
+        this.ctx.activeLogicalRequestId = void 0;
+        this.ctx.activePromptManifestId = void 0;
         this._runInProgress = false;
       }
     }

package/dist/core/provider-runner.d.ts

@@ -3,12 +3,12 @@ import type { Logger } from '../types/logger.js';
 import type { Tracer } from '../types/observability.js';
 import type { Provider, Request, Response } from '../types/provider.js';
 import type { RetryPolicy } from '../types/retry-policy.js';
-import { type Context } from './context.js';
+import type { AgentContext } from '../types/context.js';
 export interface RunProviderOptions {
     provider: Provider;
     request: Request;
     signal: AbortSignal;
-    ctx: Context;
+    ctx: AgentContext;
     events: EventBus;
     retry: RetryPolicy;
     logger: Logger;

package/dist/core/run-env.d.ts

@@ -1,9 +1,5 @@
-import type { TextBlock } from '../types/blocks.js';
-import type { Provider } from '../types/provider.js';
-import type { SessionWriter } from '../types/session.js';
-import type { TokenCounter } from '../types/token-counter.js';
-import type { Tool } from '../types/tool.js';
 import type { Context } from './context.js';
+import type { RunEnv } from '../types/run-env.js';
 /**
  * Immutable run environment — the set-once dependencies for an agent run.
  *
@@ -18,32 +14,15 @@ import type { Context } from './context.js';
  * references. The opposite direction (set things on Context) still works,
  * and `extractRunEnv` rebuilds the view if you need a snapshot.
  *
+ * Roadmap 10A: the interface itself now lives in `types/run-env.ts` (a
+ * dependency leaf that never imports `core/`), so the type module graph
+ * stays acyclic; this module keeps `extractRunEnv` and re-exports the
+ * interface for existing import paths.
+ *
  * Migration path: new APIs accept `RunEnv` instead of `Context` when they
  * only need read access. Existing APIs continue to accept `Context` until
  * a full split is scheduled.
  */
-export interface RunEnv {
-    readonly provider: Provider;
-    readonly session: SessionWriter;
-    readonly signal: AbortSignal;
-    readonly tokenCounter: TokenCounter;
-    readonly cwd: string;
-    readonly projectRoot: string;
-    /** Mutable working directory — starts as `cwd`. */
-    readonly workingDir: string;
-    readonly model: string;
-    readonly systemPrompt: readonly TextBlock[];
-    readonly tools: readonly Tool[];
-    readonly agentId: string;
-    readonly agentName: string;
-}
-/**
- * Build a `RunEnv` view from a Context. The returned object is a shallow
- * frozen view — mutations to `Context` are visible (it's the same
- * references), but the view itself can't be mutated.
- *
- * Use this in subsystems that want to declare "I only need read access to
- * the env" without rewriting their signature to accept the full Context.
- */
+export type { RunEnv } from '../types/run-env.js';
 export declare function extractRunEnv(ctx: Context): RunEnv;
 //# sourceMappingURL=run-env.d.ts.map

package/dist/core/streaming-response-builder.d.ts

@@ -1,7 +1,7 @@
 import type { EventBus } from '../kernel/events.js';
 import type { Logger } from '../types/logger.js';
 import type { Provider, Request, Response } from '../types/provider.js';
-import { type Context } from './context.js';
+import type { AgentContext } from '../types/context.js';
 interface ThinkingEntry {
     textBuf: string;
     signature?: string | undefined;
@@ -73,6 +73,6 @@ export declare function handleMessageStop(state: StreamingState, ev: {
     stopReason?: Response['stopReason'] | undefined;
     usage?: Response['usage'] | undefined;
 }): void;
-export declare function streamProviderToResponse(provider: Provider, req: Request, signal: AbortSignal, ctx: Context, events: EventBus, logger: Logger): Promise<Response>;
+export declare function streamProviderToResponse(provider: Provider, req: Request, signal: AbortSignal, ctx: AgentContext, events: EventBus, logger: Logger): Promise<Response>;
 export {};
 //# sourceMappingURL=streaming-response-builder.d.ts.map