@wrongstack/core 0.309.0 → 0.310.0

package/dist/goal/index.js

@@ -207,6 +207,13 @@ var TaskTracker = class _TaskTracker {
   graph = null;
   transitions = [];
   listeners = [];
+  /**
+   * Re-entrancy guard for status cascades: true while an auto-block /
+   * auto-unblock cascade is running. Listener-driven mutations during a
+   * cascade still record their own primary transition — only their
+   * cascading is skipped (prevents unbounded recursion).
+   */
+  cascading = false;
   static MAX_TRANSITIONS = 1e4;
   /**
    * Subscribe to live task mutations (add / update / status change). Returns an
@@ -282,6 +289,28 @@ var TaskTracker = class _TaskTracker {
         message: "No graph loaded",
         code: ERROR_CODES.SDD_INVALID_STATE
       });
+    if (!this.graph.nodes.has(from) || !this.graph.nodes.has(to)) {
+      throw new SddError({
+        message: `Cannot add ${type} edge ${from} -> ${to}: endpoint task is not in the graph`,
+        code: ERROR_CODES.SDD_NOT_READY,
+        context: { from, to, type }
+      });
+    }
+    if (from === to) {
+      throw new SddError({
+        message: `Cannot add ${type} edge: self-loop on task ${from}`,
+        code: ERROR_CODES.SDD_INVALID_STATE,
+        context: { nodeId: from, type }
+      });
+    }
+    if (this.graph.edges.some((e) => e.from === from && e.to === to && e.type === type)) return;
+    if (type === "depends_on" && this.dependsOnTransitively(from, to, /* @__PURE__ */ new Set())) {
+      throw new SddError({
+        message: `Cannot add depends_on edge ${from} -> ${to}: it would create a dependency cycle`,
+        code: ERROR_CODES.SDD_INVALID_STATE,
+        context: { from, to }
+      });
+    }
     this.graph.edges.push({
       id: crypto.randomUUID(),
       from,
@@ -382,7 +411,7 @@ var TaskTracker = class _TaskTracker {
     if (status === "in_progress") {
       node.startedAt = now;
     }
-    this.transitions.push({ from, to: status, timestamp: now, reason });
+    this.transitions.push({ nodeId: id, from, to: status, timestamp: now, reason });
     if (this.transitions.length > _TaskTracker.MAX_TRANSITIONS) {
       this.transitions.splice(0, this.transitions.length - _TaskTracker.MAX_TRANSITIONS);
     }
@@ -398,7 +427,7 @@ var TaskTracker = class _TaskTracker {
       type: "status_changed",
       nodeId: id,
       node,
-      transition: { from, to: status, timestamp: now, reason }
+      transition: { nodeId: id, from, to: status, timestamp: now, reason }
     });
   }
   updateNode(id, patch) {
@@ -489,40 +518,89 @@ var TaskTracker = class _TaskTracker {
     }
     return computeTaskProgress(this.graph);
   }
-  getTransitions(_taskId) {
-    return [...this.transitions];
+  /**
+   * Recorded transitions in insertion order (oldest first — the array is
+   * trimmed from the front). With `taskId`, only that task's transitions are
+   * returned, still oldest-first; a consumer wanting newest-first reverses
+   * the result. Per-task filtering is possible because every TaskTransition
+   * carries `nodeId` (BIZ-005).
+   */
+  getTransitions(taskId) {
+    return taskId === void 0 ? [...this.transitions] : this.transitions.filter((t) => t.nodeId === taskId);
+  }
+  /**
+   * Record a cascade-driven status change (BIZ-003): mutate the node, push a
+   * TaskTransition, persist, and notify subscribers — the same effects an
+   * explicit updateNodeStatus produces — so the board projector's live
+   * snapshot and the transition log observe auto-block/auto-unblock.
+   */
+  recordCascadeStatusChange(nodeId, node, to, reason) {
+    const from = node.status;
+    if (from === to) return;
+    const now = Date.now();
+    node.status = to;
+    node.updatedAt = now;
+    if (this.graph) this.graph.updatedAt = now;
+    this.transitions.push({ nodeId, from, to, timestamp: now, reason });
+    if (this.transitions.length > _TaskTracker.MAX_TRANSITIONS) {
+      this.transitions.splice(0, this.transitions.length - _TaskTracker.MAX_TRANSITIONS);
+    }
+    this.persist();
+    this.notifyChange({
+      type: "status_changed",
+      nodeId,
+      node,
+      transition: { nodeId, from, to, timestamp: now, reason }
+    });
   }
   unblockDependents(completedId) {
-    if (!this.graph) return;
-    const dependents = this.getDependents(completedId);
-    for (const depId of dependents) {
-      const dep = this.graph.nodes.get(depId);
-      if (dep?.status === "blocked") {
+    if (!this.graph || this.cascading) return;
+    this.cascading = true;
+    try {
+      const dependents = this.getDependents(completedId);
+      for (const depId of dependents) {
+        const dep = this.graph.nodes.get(depId);
+        if (dep?.status !== "blocked") continue;
         const remainingBlockers = this.getBlockers(depId);
         const allUnblocked = remainingBlockers.every((id) => {
           const blocker = this.graph?.nodes.get(id);
           return blocker?.status === "completed" || blocker?.status === "failed";
         });
         if (allUnblocked) {
-          dep.status = "pending";
-          dep.updatedAt = Date.now();
+          this.recordCascadeStatusChange(
+            depId,
+            dep,
+            "pending",
+            `auto-unblocked: blocker ${completedId} reached a terminal state`
+          );
         }
       }
+    } finally {
+      this.cascading = false;
     }
   }
   checkAndBlockIfNeeded(taskId) {
-    if (!this.graph) return;
-    const blockers = this.getBlockers(taskId);
-    const someBlocked = blockers.some((id) => {
-      const blocker = this.graph?.nodes.get(id);
-      return blocker?.status !== "completed" && blocker?.status !== "failed";
-    });
-    if (someBlocked) {
-      const node = this.graph.nodes.get(taskId);
-      if (node) {
-        node.status = "blocked";
-        node.updatedAt = Date.now();
+    if (!this.graph || this.cascading) return;
+    this.cascading = true;
+    try {
+      const blockers = this.getBlockers(taskId);
+      const incomplete = blockers.filter((id) => {
+        const blocker = this.graph?.nodes.get(id);
+        return blocker?.status !== "completed" && blocker?.status !== "failed";
+      });
+      if (incomplete.length > 0) {
+        const node = this.graph.nodes.get(taskId);
+        if (node) {
+          this.recordCascadeStatusChange(
+            taskId,
+            node,
+            "blocked",
+            `auto-blocked: incomplete blocker(s) ${incomplete.join(", ")}`
+          );
+        }
       }
+    } finally {
+      this.cascading = false;
     }
   }
   /**

package/dist/hq/auth-store.d.ts

@@ -167,6 +167,15 @@ export interface HqAuthFile {
      * reveal unused codes. Each code is consumed on first successful use.
      */
     totpRecoveryCodes?: string[];
+    /**
+     * Highest TOTP time-step counter already consumed by a successful 2FA
+     * verification (SEC-002: persisted to prevent replay after restart).
+     * Written by the 2FA verification route (`totp-routes.ts`) — not the
+     * initial password check — and read there to reject any counter <= this
+     * value, so an observed code cannot be replayed within its validity
+     * window even across a server restart.
+     */
+    totpLastUsedCounter?: number;
     /**
      * Operator-configured alert-rule thresholds. When present, these override
      * the built-in defaults for the alert engine (cost ceiling, stale-machine

package/dist/hq/cost-bridge.d.ts

@@ -16,8 +16,8 @@
  * @module hq/cost-bridge
  */
 import type { EventBus } from '../kernel/events.js';
-import type { HqEventEnvelope } from './protocol.js';
 import { type BridgeContextOptions } from './bridge-context.js';
+import type { HqEventEnvelope } from './protocol.js';
 export interface CostTelemetryBridgeOptions extends BridgeContextOptions {
     /** Local EventBus emitting `token.accounted`. */
     events: EventBus;

package/dist/hq/index.js

@@ -702,6 +702,14 @@ var PATTERNS = [
     anchor: "sk-ant-"
   },
   { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  {
+    // `xai` is a first-class provider in this codebase, but its key shape was
+    // absent here — so the one credential format WrongStack itself hands users
+    // was the one the scrubber could not recognize (audit 2026-08-20).
+    type: "xai_key",
+    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    anchor: "xai-"
+  },
   { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
   { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
   { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
@@ -792,8 +800,8 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
   },
   {
     type: "json_credential_key",
@@ -910,6 +918,27 @@ var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
+var PEM_END_MARKER = "-----END";
+var MAX_PEM_BLOCK_BYTES = 64 * 1024;
+var PEM_END_LINE_TOLERANCE = 64;
+function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
+  const head = text.slice(chunkStart, proposedEnd);
+  const lastBegin = head.lastIndexOf("-----BEGIN ");
+  if (lastBegin === -1) return proposedEnd;
+  const fromBegin = text.slice(chunkStart + lastBegin);
+  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
+  if (!marker || marker.index !== 0) return proposedEnd;
+  const bodyStart = marker[0].length;
+  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
+  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
+  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
+    return proposedEnd;
+  }
+  const lineEnd = fromBegin.indexOf("\n", closeIdx);
+  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
+  return Math.max(proposedEnd, end);
+}
 var PATTERN_ANCHORS = [
   ...new Set(
     PATTERNS.flatMap(
@@ -946,6 +975,7 @@ var DefaultSecretScrubber = class {
           }
         }
         end = safe === -1 ? end : safe + 1;
+        end = extendChunkBoundaryPastPem(text, i, end);
       }
       out.push(this.scrubOne(text.slice(i, end)));
       i = end;
@@ -2348,6 +2378,7 @@ function hqAuthContentHash(file) {
       ...file.totpSecret !== void 0 ? { totpSecret: REDACTED } : {},
       ...file.totpPendingSecret !== void 0 ? { totpPendingSecret: REDACTED } : {},
       ...file.totpRecoveryCodes !== void 0 ? { totpRecoveryCodes: file.totpRecoveryCodes.map(() => REDACTED) } : {},
+      ...file.totpLastUsedCounter !== void 0 ? { totpLastUsedCounter: file.totpLastUsedCounter } : {},
       ...file.alertRules !== void 0 ? { alertRules: file.alertRules } : {}
     };
     const payload = JSON.stringify(projection);
@@ -3080,6 +3111,15 @@ function deriveSessionStatus(agents) {
     (a) => a.status === "running" || a.status === "streaming" || a.status === "waiting_user"
   ) ? "active" : "idle";
 }
+function downgradeStaleAgentStatuses(agents, nowMs) {
+  const cutoff = nowMs - HQ_STALE_SNAPSHOT_WINDOW_MS;
+  return agents.map((agent) => {
+    if (agent.status !== "running" && agent.status !== "streaming") return agent;
+    const lastActivityAt = Date.parse(agent.lastActivityAt);
+    if (!Number.isFinite(lastActivityAt) || lastActivityAt >= cutoff) return agent;
+    return { ...agent, status: "idle" };
+  });
+}
 function startSessionTelemetryBridge(opts) {
   const now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   const publisher = opts.publisher;
@@ -3100,6 +3140,7 @@ function startSessionTelemetryBridge(opts) {
   let lastPublishedAtMs = Date.now();
   let disposed = false;
   function buildSnapshot() {
+    const effectiveAgents = downgradeStaleAgentStatuses(agents, Date.parse(now()));
     return {
       sessionId: opts.sessionId,
       clientKind: identity.kind,
@@ -3107,11 +3148,11 @@ function startSessionTelemetryBridge(opts) {
       projectId: project.projectId,
       projectName: opts.projectName ?? project.projectName,
       projectRoot: opts.projectRoot,
-      status: deriveSessionStatus(agents),
+      status: deriveSessionStatus(effectiveAgents),
       startedAt,
       lastActivityAt,
-      agentCount: agents.length,
-      agents,
+      agentCount: effectiveAgents.length,
+      agents: effectiveAgents,
       ...identity.hostname !== void 0 ? { hostname: identity.hostname } : {},
       ...identity.pid !== void 0 ? { pid: identity.pid } : {},
       ...opts.gitBranch !== void 0 ? { gitBranch: opts.gitBranch } : {}
@@ -3643,16 +3684,37 @@ function truncateForSummary(output, policy, max = 280) {
   return scrubAndTruncateHqPreview(output, limit) ?? "";
 }
 
+// src/types/provider.ts
+function effectiveInputTokens(usage) {
+  return usage.input + (usage.cacheRead ?? 0) + (usage.cacheWrite ?? 0);
+}
+var MAX_RESET_HINT_MS = 7 * 24 * 60 * 60 * 1e3;
+var KIND_TO_CODE = {
+  network: ERROR_CODES.PROVIDER_NETWORK_ERROR,
+  timeout: ERROR_CODES.PROVIDER_NETWORK_ERROR,
+  rate_limit: ERROR_CODES.PROVIDER_RATE_LIMITED,
+  quota_exhausted: ERROR_CODES.PROVIDER_RATE_LIMITED,
+  auth: ERROR_CODES.PROVIDER_AUTH_FAILED,
+  overloaded: ERROR_CODES.PROVIDER_OVERLOADED,
+  context_overflow: ERROR_CODES.PROVIDER_CONTEXT_OVERFLOW,
+  server: ERROR_CODES.PROVIDER_SERVER_ERROR,
+  stream_hang: ERROR_CODES.PROVIDER_SERVER_ERROR,
+  content_filter: ERROR_CODES.PROVIDER_INVALID_REQUEST,
+  invalid_request: ERROR_CODES.PROVIDER_INVALID_REQUEST,
+  unknown: ERROR_CODES.PROVIDER_INVALID_REQUEST
+};
+
 // src/hq/cost-bridge.ts
 function startCostTelemetryBridge(opts) {
   const { events } = opts;
   const ctx = createBridgeContext(opts);
   const off = events.on("token.accounted", (p) => {
     const usage = p.deltaUsage ?? p.usage;
+    const totalPromptTokens = effectiveInputTokens(usage);
     const payload = {
-      inputTokens: usage.input,
+      inputTokens: totalPromptTokens,
       outputTokens: usage.output,
-      totalTokens: usage.input + usage.output,
+      totalTokens: totalPromptTokens + usage.output,
       costUsd: p.cost.total
     };
     if (p.provider !== void 0) payload.provider = p.provider;

package/dist/index.d.ts

@@ -61,8 +61,15 @@ export { buildQueuedMessagesBlock, consumeQueuedMessagesUpdate, peekQueuedMessag
 export { extractRunEnv, type RunEnv } from './core/run-env.js';
 export { DefaultSystemPromptBuilder, type DefaultSystemPromptBuilderOptions, LAYER_1_IDENTITY, SYSTEM_BLOCK_SOURCE, type SystemBlockSource, } from './core/system-prompt-builder.js';
 export { type DomainGlossaryOptions, renderDomainGlossary, } from './core/system-prompt-glossary.js';
-export * from './defaults/index.js';
-export { AutoCompactionMiddleware, type CompactorOptions, type CompactorStrategy, createStrategyCompactor, HybridCompactor, IntelligentCompactor, type IntelligentCompactorOptions, installSubagentAutoCompaction, SelectiveCompactor, type SelectiveCompactorOptions, type StrategyCompactorOptions, } from './defaults/index.js';
+export { AutoCompactionMiddleware } from './execution/auto-compaction-middleware.js';
+export { DefaultErrorHandler } from './execution/error-handler.js';
+export { DefaultSkillLoader, type SkillLoaderOptions } from './execution/skill-loader.js';
+export { DefaultLogger, type DefaultLoggerOptions, type LogFormat, } from './infrastructure/logger.js';
+export { type CompactorOptions, HybridCompactor } from './execution/compactor.js';
+export { type CompactorStrategy, createStrategyCompactor, type StrategyCompactorOptions, } from './execution/strategy-compactor.js';
+export { IntelligentCompactor, type IntelligentCompactorOptions, } from './execution/intelligent-compactor.js';
+export { installSubagentAutoCompaction } from './execution/subagent-compaction.js';
+export { SelectiveCompactor, type SelectiveCompactorOptions, } from './execution/selective-compactor.js';
 export { type AutonomyBrainOptions, type BrainAutoRisk, type BrainLlmTarget, buildBrainUserMessage, completeBrainLlm, createAutonomyBrain, createTieredBrainArbiter, formatDecisionSummary, parseOptionDecision, type TieredBrainArbiterOptions, } from './execution/autonomy-brain.js';
 export { assembleBrainTiers, type BrainTierAssembly, type BrainTierAssemblyOptions, } from './execution/brain-chain.js';
 export { BrainCircuitBreaker, type BrainCircuitOptions, type BrainCircuitSnapshot, type BrainCircuitState, } from './execution/brain-circuit.js';
@@ -87,7 +94,7 @@ export { allServers } from './infrastructure/mcp-servers.js';
 export { type ProviderCacheEntry, ProviderCacheLedger, } from './infrastructure/provider-cache-ledger.js';
 export * from './kernel/index.js';
 export { attachMailboxChecker } from './mailbox-attach.js';
-export { type CollabPauseMiddlewareOptions, collabInjectMiddleware, collabPauseMiddleware, type InjectedToolResult as CollabInjectedToolResult, } from './middleware/collab-pause.js';
+export { type CollabPauseMiddlewareOptions, collabInjectMiddleware, collabPauseMiddleware, type InjectedToolResult as CollabInjectedToolResult, } from './coordination/collab-pause.js';
 export { type NotificationChannel, type NotificationChannelStatus, type NotificationLevel, type NotificationMessage, type NotificationResult, type Notifier, type NotifierCounters, NotifierImpl, } from './notifications/index.js';
 export * from './observability/network-telemetry.js';
 export * from './observability/process-telemetry.js';
@@ -121,7 +128,7 @@ export { TRUST_POLICY_JSON_SCHEMA, TRUST_POLICY_LIMITS, TRUST_POLICY_SCHEMA_VERS
 export { DefaultSecretScrubber } from './security/secret-scrubber.js';
 export * from './session-catalog/index.js';
 export { getProjectSessionRegistry as getSessionRegistry, hasProjectSessionRegistry as hasSessionRegistry, ProjectSessionRegistry as SessionRegistry, } from './session-catalog/registry.js';
-export type { SessionLiveStatus, SessionRegistryEntry, } from './session-registry.js';
+export type { SessionLiveStatus, SessionRegistryEntry, } from './session-catalog/session-registry.js';
 export * from './skills/index.js';
 export * from './storage/index.js';
 export { type AuditLevel, createSessionEventBridge, resolveAuditLevel, resolveSessionLoggingConfig, type SessionEventBridge, type SessionEventBridgeOptions, type SessionSamplingOptions, type ToolProgressSamplingOptions, } from './storage/session-event-bridge.js';
@@ -144,7 +151,7 @@ export type { ProviderRunner, RunProviderOptions } from './types/provider-runner
 export type { SecretScrubber } from './types/secret-scrubber.js';
 export type { RotatableSecretVault, SecretVault } from './types/secret-vault.js';
 export { encryptedPrefixForVersion, noOpVault, parseEncryptedVersion, } from './types/secret-vault.js';
-export type { CacheStats, TokenCounter } from './types/token-counter.js';
+export type { CacheStats, ProviderCacheStats, TokenCounter } from './types/token-counter.js';
 export { expectDefined } from './utils/expect-defined.js';
 export * from './utils/index.js';
 export { readBundledInstructionText, renderInstructionTemplate, } from './utils/instruction-file.js';