@wrongstack/core 0.310.0 → 0.310.1

package/dist/index.js

@@ -3484,6 +3484,7 @@ function resolveTokenSavingTier(val, maxContext) {
 }
 var DEFAULT_TUI_THINKING_WORD = "thinking";
 var MAX_TUI_THINKING_WORD_LENGTH = 16;
+var MAX_WRONGPROXY_URL_LENGTH = 2048;
 function normalizeTuiThinkingWord(value) {
   if (typeof value !== "string") return DEFAULT_TUI_THINKING_WORD;
   const word = value.trim();
@@ -92933,6 +92934,7 @@ export {
   MAX_SUBAGENT_STRUCTURED_REPORT_CHARS,
   MAX_SUBJECT_LEN,
   MAX_TUI_THINKING_WORD_LENGTH,
+  MAX_WRONGPROXY_URL_LENGTH,
   MEDIUM_BUDGET,
   MEMORY_EVIDENCE_TAG,
   MEMORY_TYPE_LABELS,

package/dist/types/config/runtime.d.ts

@@ -162,6 +162,13 @@ export declare function normalizeTokenSavingTier(val?: TokenSavingTier | boolean
 export declare function resolveTokenSavingTier(val: TokenSavingTier | boolean | undefined, maxContext: number | undefined): ConcreteTokenSavingTier;
 export declare const DEFAULT_TUI_THINKING_WORD = "thinking";
 export declare const MAX_TUI_THINKING_WORD_LENGTH = 16;
+/**
+ * Hard cap on the WrongProxy / WrongTrace URL draft. URLs don't have a
+ * strict length limit, but capping to a sane 2 KiB prevents a runaway
+ * paste from bloating the `settingsPicker` slice. The runtime probe
+ * accepts any well-formed URL up to whatever the OS / fetch allow.
+ */
+export declare const MAX_WRONGPROXY_URL_LENGTH = 2048;
 /**
  * Normalize the configurable statusline word shown while the TUI is working.
  * The value must be a single short word; invalid values fall back to the default.

package/dist/types/config/tools.d.ts

@@ -109,6 +109,36 @@ export interface ToolsConfig {
      * in the next session (same as `features.tokenSavingMode`).
      */
     nextsteps?: NextStepsToolConfig | undefined;
+    /**
+     * WrongProxy / WrongTrace: automatic base-URL rerouting through a
+     * local proxy daemon (default `http://localhost:8000`). When
+     * `enabled` is true AND the daemon at `url` is reachable, every
+     * provider's base URL is rewritten through
+     * `${url}/proxy/<host><path>`. openai-codex is excluded by spec.
+     *
+     * Mirrors the WebUI `LocalPrefs` shape (single object with two
+     * fields, not two top-level keys). Persisted to the encrypted
+     * profile config and mirrored into `ctx.meta` by the TUI settings
+     * adapter so the runtime probe can read it mid-session.
+     */
+    wrongProxy?: WrongProxyToolConfig | undefined;
+}
+/** WrongProxy / WrongTrace tool-config (`tools.wrongProxy`). */
+export interface WrongProxyToolConfig {
+    /**
+     * Master switch. When true AND the daemon at `url` is reachable,
+     * every provider's base URL is rewritten through
+     * `${url}/proxy/<host><path>`. openai-codex is excluded by spec.
+     * Default: false.
+     */
+    enabled?: boolean | undefined;
+    /**
+     * Where the local proxy daemon listens. Default
+     * `http://localhost:8000`. The CLI's periodic probe targets
+     * `<url>/api/health`; a 2xx response flips the runtime's
+     * `active` flag.
+     */
+    url?: string | undefined;
 }
 /** Opt-in switch for the agent-callable `nextsteps` tool (`tools.nextsteps`). */
 export interface NextStepsToolConfig {

package/dist/types/index.d.ts

@@ -4,7 +4,7 @@ export type { ContentBlock, ImageBlock, TextBlock, ThinkingBlock, ToolResultBloc
 export { isImageBlock, isTextBlock, isToolResultBlock, isToolUseBlock } from './blocks.js';
 export type { Compactor, CompactReport } from './compactor.js';
 export type { AdaptiveConcurrencyConfig, AgentLearningConfig, AutonomyConfig, BrainConfig, BrainCouncilConfig, BrainCouncilVoterConfig, BrainModelEntry, CircuitBreakerRuntimeConfig, ConcreteTokenSavingTier, Config, ConfigLoader, ConfigStore, ContextConfig, CouncilPersonaDefinition, CouncilToolConfig, CouncilToolProfileDefinition, CustomModelDefinition, ExecDangerConfig, ExecToolConfig, FeaturesConfig, FleetChatVerbosity, FleetConfig, FleetSupervisorConfig, GitBehaviorConfig, HqClientConfig, IndexingConfig, InputHistoryConfig, LaunchConfig, LaunchMenuChoice, LogConfig, LoopDetectionConfig, MCPHealthConfig, MCPHealthThresholds, MCPServerConfig, ModelMatrixEntry, ModelRuntimeCacheConfig, ModelRuntimeConfig, ModelRuntimeParametersConfig, ModelRuntimeReasoningConfig, NextStepsToolConfig, PluginConfig, PluginManagerConfig, ProviderApiKey, ProviderConfig, SageConfig, SessionLoggingConfig, SkillsConfig, SyncCategory, SyncConfig, ThemePresetId, TokenSavingTier, ToolDescriptionMode, ToolDescriptionModeConfig, ToolResultRenderMode, ToolResultRenderModeConfig, ToolsConfig, } from './config.js';
-export { DEFAULT_TUI_THINKING_WORD, FLEET_CHAT_VERBOSITY_VALUES, MAX_TUI_THINKING_WORD_LENGTH, normalizeTokenSavingTier, normalizeTuiThinkingWord, resolveFleetChatVerbosity, resolveTokenSavingTier, THEME_PRESET_IDS, } from './config.js';
+export { DEFAULT_TUI_THINKING_WORD, FLEET_CHAT_VERBOSITY_VALUES, MAX_TUI_THINKING_WORD_LENGTH, MAX_WRONGPROXY_URL_LENGTH, normalizeTokenSavingTier, normalizeTuiThinkingWord, resolveFleetChatVerbosity, resolveTokenSavingTier, THEME_PRESET_IDS, } from './config.js';
 export type { CompletedWorkEvidence, CompletedWorkSource, ContextEvidenceState, ContextFileEvidence, ContextIntentEvidence, ContextRepeatedReadEvidence, ToolEvidenceStatus, ToolOutputMetadata, } from './context-evidence.js';
 export type { ContextSnapshot, ContextWindowAggressiveOn, ContextWindowConfigLike, ContextWindowMode, ContextWindowModeId, ContextWindowModeSelectionId, ContextWindowPolicy, ContextWindowThresholds, DeprecatedContextWindowModeId, } from './context-window.js';
 export { CONTEXT_WINDOW_MODE_PINNED_META_KEY, CONTEXT_WINDOW_MODES, DEFAULT_CONTEXT_WINDOW_MODE_ID, DEPRECATED_CONTEXT_WINDOW_MODE_ALIASES, formatContextWindowModeList, getContextWindowMode, isContextWindowModeId, isContextWindowModeSelectionId, isDeprecatedContextWindowModeId, LARGE_WINDOW_DEEP_MODE_THRESHOLD, listContextWindowModes, normalizeContextWindowModeId, resolveContextWindowPolicy, } from './context-window.js';

package/dist/types/index.js

@@ -49,6 +49,7 @@ function resolveTokenSavingTier(val, maxContext) {
 }
 var DEFAULT_TUI_THINKING_WORD = "thinking";
 var MAX_TUI_THINKING_WORD_LENGTH = 16;
+var MAX_WRONGPROXY_URL_LENGTH = 2048;
 function normalizeTuiThinkingWord(value) {
   if (typeof value !== "string") return DEFAULT_TUI_THINKING_WORD;
   const word = value.trim();
@@ -1367,6 +1368,7 @@ export {
   LARGE_WINDOW_DEEP_MODE_THRESHOLD,
   MALFORMED_ARG_MARKERS,
   MAX_TUI_THINKING_WORD_LENGTH,
+  MAX_WRONGPROXY_URL_LENGTH,
   MEMORY_TYPE_LABELS,
   PROMPT_CATEGORY_LABELS,
   ParseError,

package/dist/wiring/proxy-rewrite.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Automatic proxy/trace rerouting for provider base URLs.
+ *
+ * Lives in `@wrongstack/core` so both `cli` and `runtime` packages can
+ * import the same pure-logic rewriter without reaching across workspaces.
+ * The CLI's `proxy-probe` (side-effectful, owns `setInterval`) lives in
+ * `@wrongstack/cli` and pushes state into this module via `applyProxyConfig`.
+ *
+ * Example:
+ *   original  = "https://api.openai.com/v1"
+ *   proxyUrl  = "http://localhost:8000"
+ *   output    = "http://localhost:8000/proxy/api.openai.com/v1"
+ *
+ * The host appears *without* a scheme in the path; the proxy terminates
+ * TLS (or speaks plain HTTP for localhost) and forwards the original
+ * scheme in the `X-Forwarded-Proto` header.
+ */
+/**
+ * Providers whose base URLs MUST NOT be rewritten. openai-codex talks
+ * directly to the ChatGPT backend over an OAuth-issued token, and the
+ * `client_id` / audience in the token constrains the request origin —
+ * routing it through a generic proxy breaks the auth check.
+ */
+export declare const PROXY_EXCLUDED_PROVIDERS: ReadonlySet<string>;
+/**
+ * Decide whether a provider id is eligible for proxy rerouting.
+ *
+ * - `openai-codex` is excluded by spec.
+ * - Everything else (openai, anthropic, google, openai-compatible,
+ *   custom saved-config aliases) flows through.
+ */
+export declare function isProxyEligible(providerId: string): boolean;
+/**
+ * Rewrite a provider base URL through the proxy.
+ *
+ * Returns the original input (passthrough) when the input is missing or
+ * malformed — we never want the proxy rewriter to be the reason a request
+ * fails when the proxy itself is misconfigured. The guards below are
+ * deliberately permissive: a misconfigured proxy must NOT silently turn
+ * into a hard error during provider construction.
+ */
+export declare function rewriteBaseUrl(originalBaseUrl: string | undefined, proxyUrl: string | undefined): string | undefined;
+/**
+ * Active proxy configuration consumed by `resolveProviderCfg`. Module-scoped
+ * so the wiring layer can read it without threading state through every
+ * call site; updates from `applyProxyConfig()` are atomic from the JS
+ * perspective (a single assignment).
+ */
+export interface ProxyConfig {
+    /** Master switch — when false, no rewrite happens regardless of url. */
+    enabled: boolean;
+    /** Where the proxy listens. Empty string = unset (treated as disabled). */
+    url: string;
+    /** Last-known reachability state from the periodic probe. */
+    active: boolean;
+}
+/** Read the current proxy configuration. Safe to call from any layer. */
+export declare function getProxyConfig(): ProxyConfig;
+/**
+ * Apply a new proxy configuration. Returns the previous config so callers
+ * (notably the probe) can decide whether the change requires an immediate
+ * probe vs. waiting for the next tick.
+ */
+export declare function applyProxyConfig(next: Partial<ProxyConfig>): ProxyConfig;
+/**
+ * Convenience: should the rewriter run for a given provider id given the
+ * current configuration? Centralizes the "is proxy on AND active AND not
+ * excluded" rule so future call sites can't accidentally skip a check.
+ */
+export declare function shouldRewriteFor(providerId: string): boolean;
+/**
+ * Reset to defaults. Intended for tests; do NOT call from production code
+ * (the singleton lives for the lifetime of the process).
+ */
+export declare function __resetProxyConfigForTests(): void;
+//# sourceMappingURL=proxy-rewrite.d.ts.map

package/dist/wiring/proxy-rewrite.js

@@ -0,0 +1,70 @@
+// src/wiring/proxy-rewrite.ts
+var PROXY_PATH_PREFIX = "/proxy/";
+var PROXY_EXCLUDED_PROVIDERS = /* @__PURE__ */ new Set(["openai-codex"]);
+function isProxyEligible(providerId) {
+  if (!providerId) return false;
+  if (PROXY_EXCLUDED_PROVIDERS.has(providerId)) return false;
+  return true;
+}
+function rewriteBaseUrl(originalBaseUrl, proxyUrl) {
+  if (!originalBaseUrl) return void 0;
+  if (!proxyUrl) return originalBaseUrl;
+  if (!isProxyEligibleForRewrite(originalBaseUrl, proxyUrl)) return originalBaseUrl;
+  return composeRewrittenUrl(originalBaseUrl, proxyUrl);
+}
+function isProxyEligibleForRewrite(originalBaseUrl, proxyUrl) {
+  if (!originalBaseUrl.includes("://")) return false;
+  if (!proxyUrl.includes("://")) return false;
+  const normalizedProxy = proxyUrl.replace(/\/+$/, "");
+  if (originalBaseUrl.startsWith(`${normalizedProxy}${PROXY_PATH_PREFIX}`)) {
+    return false;
+  }
+  try {
+    const parsed = new URL(originalBaseUrl);
+    const isLoopback = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || // WHATWG URL serializes IPv6 hosts with brackets — `[::1]`, not `::1`.
+    parsed.hostname === "[::1]";
+    if (isLoopback && parsed.port !== "") return false;
+  } catch {
+  }
+  return true;
+}
+function composeRewrittenUrl(originalBaseUrl, proxyUrl) {
+  const parsedOriginal = new URL(originalBaseUrl);
+  const hostAndPath = `${parsedOriginal.host}${parsedOriginal.pathname}`;
+  const trailingQuery = parsedOriginal.search || "";
+  const trailingHash = parsedOriginal.hash || "";
+  const proxyRoot = proxyUrl.replace(/\/+$/, "");
+  return `${proxyRoot}${PROXY_PATH_PREFIX}${hostAndPath}${trailingQuery}${trailingHash}`;
+}
+var DEFAULT_PROXY_CONFIG = { enabled: false, url: "", active: false };
+var currentConfig = { ...DEFAULT_PROXY_CONFIG };
+function getProxyConfig() {
+  return currentConfig;
+}
+function applyProxyConfig(next) {
+  const previous = currentConfig;
+  currentConfig = {
+    enabled: next.enabled ?? previous.enabled,
+    url: next.url ?? previous.url,
+    active: next.active ?? previous.active
+  };
+  return previous;
+}
+function shouldRewriteFor(providerId) {
+  const cfg = currentConfig;
+  if (!cfg.enabled || !cfg.active || !cfg.url) return false;
+  return isProxyEligible(providerId);
+}
+function __resetProxyConfigForTests() {
+  currentConfig = { ...DEFAULT_PROXY_CONFIG };
+}
+export {
+  PROXY_EXCLUDED_PROVIDERS,
+  __resetProxyConfigForTests,
+  applyProxyConfig,
+  getProxyConfig,
+  isProxyEligible,
+  rewriteBaseUrl,
+  shouldRewriteFor
+};
+//# sourceMappingURL=proxy-rewrite.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/core",
-  "version": "0.310.0",
+  "version": "0.310.1",
   "license": "MIT",
   "description": "WrongStack core: kernel, types, and shared utilities for the WrongStack CLI agent.",
   "repository": {
@@ -165,6 +165,10 @@
     "./replay": {
       "types": "./dist/replay/index.d.ts",
       "import": "./dist/replay/index.js"
+    },
+    "./wiring/proxy-rewrite": {
+      "types": "./dist/wiring/proxy-rewrite.d.ts",
+      "import": "./dist/wiring/proxy-rewrite.js"
     }
   },
   "files": [
@@ -178,9 +182,9 @@
   "wrongstackApiVersion": "0.1.10",
   "dependencies": {
     "zod": "4.4.3",
-    "@wrongstack/primitives": "0.310.0",
-    "@wrongstack/kanban": "0.310.0",
-    "@wrongstack/persistence": "0.310.0"
+    "@wrongstack/primitives": "0.310.1",
+    "@wrongstack/kanban": "0.310.1",
+    "@wrongstack/persistence": "0.310.1"
   },
   "devDependencies": {
     "@types/node": "^22.19.0",