@wrongstack/core 0.310.1 → 0.313.1

package/dist/chunk-JVGPR3TS.js

@@ -0,0 +1,365 @@
+import {
+  SECRET_FILE_MODE
+} from "./chunk-H5E77KUJ.js";
+import {
+  atomicWrite,
+  withFileLock
+} from "./chunk-7ZHZE5EO.js";
+
+// src/plugins/review-finding-store.ts
+import { randomUUID } from "node:crypto";
+import * as fsp from "node:fs/promises";
+import * as path from "node:path";
+
+// src/plugins/review-finding-types.ts
+import { createHash } from "node:crypto";
+var InvalidTransitionError = class extends Error {
+  from;
+  to;
+  constructor(from, to, reason) {
+    const msg = reason ?? `Invalid transition from "${from}" to "${to}"`;
+    super(msg);
+    this.name = "InvalidTransitionError";
+    this.from = from;
+    this.to = to;
+  }
+};
+function normalizeFingerprintTitle(title) {
+  return title.trim().toLowerCase().replace(/[^\w\s]/g, "").replace(/\s+/g, " ").trim();
+}
+function computeFindingFingerprint(file, line, title) {
+  const normalizedTitle = normalizeFingerprintTitle(title);
+  const normalizedFile = file.replace(/\\/g, "/").trim().toLowerCase();
+  const lineStr = line != null && line >= 0 ? String(line) : "0";
+  const hash = createHash("sha256");
+  hash.update(`${normalizedFile}:${lineStr}:${normalizedTitle}`);
+  return hash.digest("hex");
+}
+var TRANSITION_MATRIX = {
+  active: /* @__PURE__ */ new Set(["triaged", "ignored", "resolved"]),
+  triaged: /* @__PURE__ */ new Set(["in_progress", "ignored", "resolved"]),
+  in_progress: /* @__PURE__ */ new Set(["resolved", "active"]),
+  ignored: /* @__PURE__ */ new Set(["active"]),
+  resolved: /* @__PURE__ */ new Set(["active"])
+};
+function validateTransition(from, to) {
+  if (from === to) return;
+  const allowed = TRANSITION_MATRIX[from];
+  if (!allowed?.has(to)) {
+    throw new InvalidTransitionError(from, to);
+  }
+}
+function validateResolution(status, outcome) {
+  if (status !== "resolved") return;
+  if (!outcome) {
+    throw new InvalidTransitionError(
+      "active",
+      "resolved",
+      'A resolution outcome is required when transitioning to "resolved"'
+    );
+  }
+}
+
+// src/plugins/review-finding-store.ts
+var FINDING_RESOLVED_RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
+var FINDING_IGNORED_RETENTION_MS = 14 * 24 * 60 * 60 * 1e3;
+var FINDING_DEFAULT_PAGE_SIZE = 50;
+var NL = "\n";
+var LINE_SEPARATOR = NL;
+var FINDING_STORE_FILE = "review-findings.jsonl";
+function resolveFindingStorePath(projectDir) {
+  return path.join(projectDir, FINDING_STORE_FILE);
+}
+var JsonlFindingStore = class {
+  filePath;
+  constructor(projectDir) {
+    this.filePath = resolveFindingStorePath(projectDir);
+  }
+  get storePath() {
+    return this.filePath;
+  }
+  // ── Path helpers ─────────────────────────────────────────────────
+  async upsert(newFindings, context) {
+    if (newFindings.length === 0) return { created: 0, relinked: 0, reopened: 0 };
+    const result = { created: 0, relinked: 0, reopened: 0 };
+    return withFileLock(this.filePath, async () => {
+      const existing = await this._readAll();
+      for (const finding of newFindings) {
+        const match = existing.find((e) => e.finding.fingerprint === finding.fingerprint);
+        if (match) {
+          const materialized = this._materialize(match);
+          if (materialized.status === "resolved" || materialized.status === "ignored") {
+            const reopenEvent = this._makeEvent(
+              match.finding.id,
+              "reopened",
+              materialized.status,
+              "active",
+              context
+            );
+            match.finding.status = "active";
+            match.finding.resolution = void 0;
+            const updatedRecord = { __finding: 1, data: match.finding };
+            await fsp.appendFile(
+              this.filePath,
+              JSON.stringify(updatedRecord) + LINE_SEPARATOR + JSON.stringify({ __findingEvent: 1, data: reopenEvent }) + LINE_SEPARATOR,
+              { encoding: "utf8", mode: SECRET_FILE_MODE }
+            );
+            result.reopened++;
+          } else {
+            const relinkEvent = this._makeEvent(
+              match.finding.id,
+              "relinked",
+              match.finding.status,
+              match.finding.status,
+              context
+            );
+            await fsp.appendFile(
+              this.filePath,
+              JSON.stringify({ __findingEvent: 1, data: relinkEvent }) + LINE_SEPARATOR,
+              { encoding: "utf8", mode: SECRET_FILE_MODE }
+            );
+            result.relinked++;
+          }
+        } else {
+          const record = { __finding: 1, data: finding };
+          const createdEvent = this._makeEvent(finding.id, "created", null, "active", context);
+          const lines = JSON.stringify(record) + LINE_SEPARATOR + JSON.stringify({ __findingEvent: 1, data: createdEvent }) + LINE_SEPARATOR;
+          await fsp.appendFile(this.filePath, lines, { encoding: "utf8", mode: SECRET_FILE_MODE });
+          result.created++;
+        }
+      }
+      return result;
+    });
+  }
+  async transition(findingId, to, actor, opts) {
+    return withFileLock(this.filePath, async () => {
+      const all = await this._readAll();
+      const entry = all.find((e) => e.finding.id === findingId);
+      if (!entry) throw new Error(`Finding not found: ${findingId}`);
+      const from = this._materialize(entry).status;
+      validateTransition(from, to);
+      validateResolution(to, opts?.outcome);
+      const event = {
+        id: randomUUID(),
+        findingId,
+        eventType: to === "resolved" ? "resolved" : to === "ignored" ? "ignored" : this._eventTypeFor(to),
+        fromStatus: from,
+        toStatus: to,
+        actorId: actor.id,
+        actorKind: actor.kind,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        reason: opts?.reason
+      };
+      entry.finding.status = to;
+      if (to === "resolved" && opts?.outcome) {
+        entry.finding.resolution = {
+          outcome: opts.outcome,
+          resolvedAt: event.timestamp,
+          resolvedBy: actor.id,
+          notes: opts.reason
+        };
+      }
+      const updatedRecord = { __finding: 1, data: entry.finding };
+      await fsp.appendFile(
+        this.filePath,
+        JSON.stringify(updatedRecord) + LINE_SEPARATOR + JSON.stringify({ __findingEvent: 1, data: event }) + LINE_SEPARATOR,
+        { encoding: "utf8", mode: SECRET_FILE_MODE }
+      );
+      return { ...entry.finding };
+    });
+  }
+  async list(opts) {
+    const all = await this._readAll();
+    let findings = all.map((e) => this._materialize(e));
+    if (opts?.severities && opts.severities.length > 0) {
+      const sevs = new Set(opts.severities);
+      findings = findings.filter((f) => sevs.has(f.severity));
+    }
+    if (opts?.statuses && opts.statuses.length > 0) {
+      const sts = new Set(opts.statuses);
+      findings = findings.filter((f) => sts.has(f.status));
+    }
+    if (opts?.file) {
+      const pattern = opts.file.toLowerCase();
+      findings = findings.filter((f) => f.location?.file.toLowerCase().includes(pattern));
+    }
+    if (opts?.reportId) {
+      findings = findings.filter((f) => f.originReport.reportId === opts.reportId);
+    }
+    const severityRank = {
+      critical: 0,
+      high: 1,
+      medium: 2,
+      low: 3
+    };
+    findings.sort((a, b) => {
+      const sa = severityRank[a.severity] - severityRank[b.severity];
+      if (sa !== 0) return sa;
+      return a.createdAt.localeCompare(b.createdAt);
+    });
+    const limit = opts?.limit ?? FINDING_DEFAULT_PAGE_SIZE;
+    return findings.slice(0, limit);
+  }
+  async get(idOrFingerprint) {
+    const all = await this._readAll();
+    const entry = all.find(
+      (e) => e.finding.id === idOrFingerprint || e.finding.fingerprint === idOrFingerprint
+    );
+    return entry ? this._materialize(entry) : null;
+  }
+  async getEvents(findingId) {
+    const all = await this._readAllLines();
+    const events = [];
+    for (const line of all) {
+      try {
+        const parsed = JSON.parse(line);
+        if (this._isLifecycleEvent(parsed) && parsed.data.findingId === findingId) {
+          events.push(parsed.data);
+        }
+      } catch {
+      }
+    }
+    return events.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+  }
+  async compact(opts) {
+    return withFileLock(this.filePath, async () => {
+      const resolvedMaxAge = opts?.resolvedMaxAgeMs ?? FINDING_RESOLVED_RETENTION_MS;
+      const ignoredMaxAge = opts?.ignoredMaxAgeMs ?? FINDING_IGNORED_RETENTION_MS;
+      const now = Date.now();
+      const all = await this._readAll();
+      const kept = [];
+      let removed = 0;
+      let eventsFolded = 0;
+      for (const entry of all) {
+        const age = now - new Date(entry.finding.createdAt).getTime();
+        const isResolved = entry.finding.status === "resolved";
+        const isIgnored = entry.finding.status === "ignored";
+        const maxAge = isResolved ? resolvedMaxAge : isIgnored ? ignoredMaxAge : Infinity;
+        if (age > maxAge && (isResolved || isIgnored)) {
+          removed++;
+          eventsFolded += entry.events.length;
+          continue;
+        }
+        const oldEvents = entry.events.filter(
+          (ev) => now - new Date(ev.timestamp).getTime() > maxAge
+        );
+        if (oldEvents.length > 1) {
+          eventsFolded += oldEvents.length - 1;
+          const newestOld = oldEvents.sort((a, b) => b.timestamp.localeCompare(a.timestamp))[0];
+          entry.events = [
+            newestOld,
+            ...entry.events.filter((ev) => now - new Date(ev.timestamp).getTime() <= maxAge)
+          ];
+        }
+        kept.push({ record: { __finding: 1, data: entry.finding }, events: entry.events });
+      }
+      const lines = [];
+      for (const { record, events } of kept) {
+        if (record) lines.push(JSON.stringify(record));
+        for (const ev of events) {
+          lines.push(JSON.stringify({ __findingEvent: 1, data: ev }));
+        }
+      }
+      lines.push(
+        JSON.stringify({
+          __findingCompact: 1,
+          compactedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          removedFindings: removed,
+          foldedEvents: eventsFolded
+        })
+      );
+      await atomicWrite(this.filePath, lines.join(LINE_SEPARATOR) + LINE_SEPARATOR, {
+        mode: 384
+      });
+      return { removed, eventsFolded };
+    });
+  }
+  // ── Private helpers ──────────────────────────────────────────────
+  async _readAllLines() {
+    try {
+      const raw = await fsp.readFile(this.filePath, "utf8");
+      return raw.split(LINE_SEPARATOR).filter((l) => l.trim().length > 0);
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      throw err;
+    }
+  }
+  _isFindingRecord(v) {
+    return typeof v === "object" && v !== null && v["__finding"] === 1;
+  }
+  _isLifecycleEvent(v) {
+    return typeof v === "object" && v !== null && v["__findingEvent"] === 1;
+  }
+  async _readAll() {
+    const lines = await this._readAllLines();
+    const findings = /* @__PURE__ */ new Map();
+    const eventsMap = /* @__PURE__ */ new Map();
+    for (const line of lines) {
+      try {
+        const parsed = JSON.parse(line);
+        if (this._isFindingRecord(parsed)) {
+          findings.set(parsed.data.id, parsed.data);
+          if (!eventsMap.has(parsed.data.id)) eventsMap.set(parsed.data.id, []);
+        } else if (this._isLifecycleEvent(parsed)) {
+          const list = eventsMap.get(parsed.data.findingId);
+          if (list) list.push(parsed.data);
+        }
+      } catch {
+      }
+    }
+    return Array.from(findings.entries()).map(([id, finding]) => ({
+      finding,
+      events: eventsMap.get(id) ?? []
+    }));
+  }
+  /** Materialize a finding's current status from its events. */
+  _materialize(entry) {
+    if (entry.events.length === 0) return { ...entry.finding };
+    const sorted = [...entry.events].sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+    const latest = sorted[sorted.length - 1];
+    return {
+      ...entry.finding,
+      status: latest.toStatus
+    };
+  }
+  _makeEvent(findingId, eventType, fromStatus, toStatus, context) {
+    return {
+      id: randomUUID(),
+      findingId,
+      eventType,
+      fromStatus,
+      toStatus,
+      actorId: context.agentId,
+      actorKind: "agent",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      reason: `session:${context.sessionId} report:${context.reportId}`
+    };
+  }
+  _eventTypeFor(to) {
+    switch (to) {
+      case "triaged":
+        return "triaged";
+      case "in_progress":
+        return "started";
+      case "resolved":
+        return "resolved";
+      case "ignored":
+        return "ignored";
+      case "active":
+        return "reopened";
+      default:
+        return "created";
+    }
+  }
+};
+
+export {
+  computeFindingFingerprint,
+  FINDING_RESOLVED_RETENTION_MS,
+  FINDING_IGNORED_RETENTION_MS,
+  FINDING_DEFAULT_PAGE_SIZE,
+  FINDING_STORE_FILE,
+  resolveFindingStorePath,
+  JsonlFindingStore
+};
+//# sourceMappingURL=chunk-JVGPR3TS.js.map

package/dist/chunk-JVKB2TBL.js

@@ -0,0 +1,48 @@
+// src/skills/foreign-sources.ts
+var FOREIGN_SKILL_TOOLS = [
+  { id: "agents", subdir: "skills" },
+  // shared store (asm / agentskills.io ecosystem)
+  { id: "codex", subdir: "skills" },
+  // OpenAI Codex CLI
+  { id: "gemini", subdir: "skills" },
+  // Gemini CLI
+  { id: "cursor", subdir: "skills" },
+  // Cursor (standard subdir, aligned with skills.sh ecosystem)
+  { id: "qwen", subdir: "skills" },
+  // Qwen Code
+  { id: "trae", subdir: "skills" },
+  // Trae
+  { id: "windsurf", subdir: "skills" }
+  // Windsurf
+];
+var KNOWN_FOREIGN_IDS = new Set(FOREIGN_SKILL_TOOLS.map((t) => t.id));
+function resolveForeignToolIds(opt) {
+  return resolveForeignToolIdsWithWarnings(opt).ids;
+}
+function resolveForeignToolIdsWithWarnings(opt) {
+  if (opt === false) return { ids: [], unknownIds: [] };
+  if (Array.isArray(opt)) {
+    const ids = [];
+    const unknownIds = [];
+    for (const id of opt) {
+      if (KNOWN_FOREIGN_IDS.has(id)) ids.push(id);
+      else unknownIds.push(id);
+    }
+    return { ids, unknownIds };
+  }
+  return { ids: FOREIGN_SKILL_TOOLS.map((t) => t.id), unknownIds: [] };
+}
+function securityScoreToTier(score) {
+  if (score == null || Number.isNaN(score)) return "low";
+  if (score < 30) return "low";
+  if (score < 70) return "medium";
+  return "high";
+}
+
+export {
+  FOREIGN_SKILL_TOOLS,
+  resolveForeignToolIds,
+  resolveForeignToolIdsWithWarnings,
+  securityScoreToTier
+};
+//# sourceMappingURL=chunk-JVKB2TBL.js.map

package/dist/chunk-JX7VBZDK.js

@@ -0,0 +1,31 @@
+// src/coordination/mailbox-events.ts
+var MailboxEventEmitter = class {
+  listeners = /* @__PURE__ */ new Set();
+  subscribe(fn) {
+    this.listeners.add(fn);
+    return () => {
+      this.listeners.delete(fn);
+    };
+  }
+  emit(event) {
+    const snapshot = [...this.listeners];
+    for (const fn of snapshot) {
+      try {
+        fn(event);
+      } catch {
+      }
+    }
+  }
+  /** Number of active subscribers (for observability / metrics). */
+  get subscriberCount() {
+    return this.listeners.size;
+  }
+  clear() {
+    this.listeners.clear();
+  }
+};
+
+export {
+  MailboxEventEmitter
+};
+//# sourceMappingURL=chunk-JX7VBZDK.js.map