@wrongstack/core 0.313.0 → 0.316.1

package/dist/security/index.js

@@ -1,308 +1,77 @@
-// src/types/secret-vault.ts
-var ENCRYPTED_PREFIX_PATTERN = /^enc:v(\d+):/;
-function encryptedPrefixForVersion(version) {
-  return `enc:v${version}:`;
-}
-var noOpVault = {
-  encrypt: (v) => v,
-  decrypt: (v) => v,
-  isEncrypted: () => false,
-  keyVersion: 1
-};
-
-// src/security/capabilities.ts
-var ToolCapabilities = {
-  /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
-  SHELL_ARBITRARY: "shell.arbitrary",
-  /**
-   * Can execute the `exec` tool's allowlisted commands.
-   *
-   * "Restricted" describes the command NAME check, not the resulting power.
-   * Treat this as equivalent to {@link SHELL_ARBITRARY} when deciding what to
-   * grant: the allowlist includes general-purpose interpreters (`node`,
-   * `python`, `perl`, `ruby`) and, on Windows, the platform shells (`cmd`,
-   * `powershell`, `pwsh`) — deliberately, since without them `exec` cannot run
-   * `dir`/`type`/any cmdlet. `node -e …` or `cmd /c …` therefore reaches
-   * arbitrary execution, and per-argument denylisting cannot close that while
-   * the shells remain (blocking `node -e` still leaves `cmd /c node -e`).
-   *
-   * What actually bounds this is downstream, not the name check: the permission
-   * policy reconstructs the full command line and runs it through the
-   * destructive classifier, so destructive calls still require confirmation.
-   *
-   * Granting `shell.restricted` while withholding `shell.arbitrary` therefore
-   * buys no meaningful reduction in blast radius. Documented rather than
-   * silently implied, because the two read as a narrow/wide pair (WS-083).
-   */
-  SHELL_RESTRICTED: "shell.restricted",
-  /** Can run a restricted project formatter/linter-style command. */
-  SHELL_EXEC: "shell.exec",
-  /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
-  FS_READ: "fs.read",
-  /** Can write / modify / delete files inside the project. */
-  FS_WRITE: "fs.write",
-  /** Can write files outside the current project root (very high risk). */
-  FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project",
-  /** Can perform outbound network requests. */
-  NET_OUTBOUND: "net.outbound",
-  /** Can mutate in-memory session todos only. */
-  SESSION_TODO: "session.todo",
-  /** Can park after-task `<nextsteps>` suggestions for the current turn. */
-  SESSION_NEXTSTEPS: "session.nextsteps",
-  /** Can mutate in-memory session mode only. */
-  SESSION_MODE: "session.mode",
-  /** Can inspect registered tool metadata. */
-  TOOL_META: "tool.meta",
-  /** Can invoke arbitrary registered tools through a meta-tool. */
-  TOOL_MUTATE_ANY: "tool.mutate.any",
-  /** Can read persistent memory. */
-  MEMORY_READ: "memory.read",
-  /** Can write persistent memory. */
-  MEMORY_WRITE: "memory.write",
-  /** Can delete persistent memory. */
-  MEMORY_DELETE: "memory.delete",
-  /** Proxies tools from external MCP servers (unknown capability). */
-  MCP_PROXY: "mcp.proxy",
-  /** Can spawn or manage subagents / multi-agent tasks. */
-  SUBAGENT_SPAWN: "subagent.spawn",
-  /** Can inspect fleet/subagent coordination state without mutating it. */
-  COORDINATION_FLEET_READ: "coordination.fleet.read",
-  /** Can publish attributed, schema-checked events onto the fleet bus. */
-  COORDINATION_FLEET_EMIT: "coordination.fleet.emit",
-  /** Can submit a task-local structured result to the parent Director. */
-  COORDINATION_RESULT_SUBMIT: "coordination.result.submit",
-  /** Can read or write inter-agent mailbox messages. */
-  COORDINATION_MAIL: "coordination.mail",
-  /** Can schedule, inspect, or cancel in-session cron jobs. */
-  COORDINATION_CRON: "coordination.cron",
-  /** Can mutate global or session configuration / trust state. */
-  CONFIG_MUTATE: "config.mutate",
-  /** Can install packages or run package managers with side effects. */
-  PACKAGE_INSTALL: "package.install"
-};
-var DANGEROUS_FOR_SUBAGENTS = [
-  ToolCapabilities.SHELL_ARBITRARY,
-  ToolCapabilities.SHELL_RESTRICTED,
-  ToolCapabilities.SHELL_EXEC,
-  ToolCapabilities.FS_WRITE,
-  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
-  ToolCapabilities.TOOL_MUTATE_ANY,
-  ToolCapabilities.MEMORY_WRITE,
-  ToolCapabilities.MEMORY_DELETE,
-  ToolCapabilities.MCP_PROXY,
-  ToolCapabilities.SUBAGENT_SPAWN,
-  ToolCapabilities.CONFIG_MUTATE,
-  ToolCapabilities.PACKAGE_INSTALL
-];
-var WIDE_SUBAGENT_CAPABILITIES = [
-  ToolCapabilities.FS_READ,
-  ToolCapabilities.FS_WRITE,
-  ToolCapabilities.NET_OUTBOUND,
-  ToolCapabilities.SESSION_TODO,
-  ToolCapabilities.TOOL_META,
-  ToolCapabilities.MEMORY_READ,
-  ToolCapabilities.SHELL_ARBITRARY,
-  ToolCapabilities.SHELL_RESTRICTED,
-  ToolCapabilities.SHELL_EXEC,
-  ToolCapabilities.PACKAGE_INSTALL,
-  // Read-only fleet visibility (fleet_status) — peer awareness has no blast
-  // radius and every fleet worker should coordinate around its peers.
-  ToolCapabilities.COORDINATION_FLEET_READ,
-  ToolCapabilities.COORDINATION_RESULT_SUBMIT
-];
-function clampSubagentCapabilities(requested, ceiling = WIDE_SUBAGENT_CAPABILITIES) {
-  const ceilingSet = new Set(ceiling);
-  const requestedSet = new Set(requested);
-  return {
-    granted: ceiling.filter((capability) => requestedSet.has(capability)),
-    dropped: [...requestedSet].filter((capability) => !ceilingSet.has(capability))
-  };
-}
-function hasDangerousCapabilityForSubagents(toolOrCaps) {
-  if (!toolOrCaps) return false;
-  const input = toolOrCaps;
-  const caps = Array.isArray(toolOrCaps) ? toolOrCaps : input.capabilities ?? [];
-  return caps.some((c) => DANGEROUS_FOR_SUBAGENTS.includes(c));
-}
-function hasCapability(toolOrCaps, capability) {
-  if (!toolOrCaps) return false;
-  const input = toolOrCaps;
-  const caps = Array.isArray(toolOrCaps) ? toolOrCaps : input.capabilities ?? [];
-  const toCheck = Array.isArray(capability) ? capability : [capability];
-  return toCheck.some((c) => caps.includes(c));
-}
-function getDangerousCapabilities(toolOrCaps) {
-  if (!toolOrCaps) return [];
-  const input = toolOrCaps;
-  const caps = Array.isArray(toolOrCaps) ? toolOrCaps : input.capabilities ?? [];
-  return caps.filter(
-    (c) => DANGEROUS_FOR_SUBAGENTS.includes(c)
-  );
-}
-
-// src/security/config-secrets.ts
-function decryptConfigSecrets(cfg, vault, opts) {
-  const warn = opts?.warn ?? ((msg) => console.warn(msg));
-  return walk(cfg, vault, (v, key) => {
-    try {
-      return vault.decrypt(v);
-    } catch (err) {
-      warn(
-        `[secret-vault] Failed to decrypt "${key}": ${err instanceof Error ? err.message : err}`
-      );
-      return "";
-    }
-  });
-}
-function encryptConfigSecrets(cfg, vault, _opts) {
-  return walk(cfg, vault, (v) => vault.encrypt(v));
-}
-function walk(node, vault, transform) {
-  if (node === null || node === void 0) return node;
-  if (typeof node !== "object") return node;
-  if (Array.isArray(node)) {
-    return node.map((item) => walk(item, vault, transform));
-  }
-  const out = /* @__PURE__ */ Object.create(null);
-  for (const [k, v] of Object.entries(node)) {
-    if (typeof v === "string" && isSecretField(k)) {
-      out[k] = transform(v, k);
-    } else if (typeof v === "object" && v !== null) {
-      out[k] = walk(v, vault, transform);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
-}
-var SECRET_KEY_PATTERN = /(?:api[-_]?key|auth[-_]?token|authorization|proxy-authorization|cookie|bearer|secret|password|passwd|pwd|refresh[-_]?token|session[-_]?key|access[_-]?token|private[_-]?key|token\b)/i;
-var NON_SECRET_OVERRIDES = /* @__PURE__ */ new Set(["publickey", "public_key"]);
-function isSecretField(name) {
-  const lc = name.toLowerCase();
-  if (NON_SECRET_OVERRIDES.has(lc)) return false;
-  return SECRET_KEY_PATTERN.test(lc);
-}
-
-// src/security/kanban-governance-port.ts
-var notWired = () => {
-  throw new Error(
-    "KanbanGovernancePort is not wired \u2014 register the implementation at the CLI composition root (see setKanbanGovernance)."
-  );
-};
-var port = void 0;
-function setKanbanGovernance(impl) {
-  port = impl;
-}
-function kanbanGovernance() {
-  return port ?? notWired();
-}
+import {
+  TRUST_POLICY_JSON_SCHEMA,
+  TRUST_POLICY_LIMITS,
+  TRUST_POLICY_SCHEMA_VERSION,
+  validateTrustPolicy
+} from "../chunk-SXMVYC5H.js";
+import {
+  DefaultSecretVault,
+  migratePlaintextSecrets,
+  noOpVault,
+  rewriteConfigEncrypted,
+  rotateConfigKeys
+} from "../chunk-CU546ESW.js";
+import {
+  ReadOnlyPermissionPolicy,
+  toolMutates
+} from "../chunk-JFPJ6LLQ.js";
+import {
+  decryptConfigSecrets,
+  encryptConfigSecrets,
+  isSecretField
+} from "../chunk-YY6APYUM.js";
+import {
+  LruCache,
+  evaluateToolKanbanBoundary,
+  kanbanGovernance,
+  setKanbanGovernance
+} from "../chunk-OOYZPOXM.js";
+import {
+  matchAny,
+  matchAnyCommand,
+  matchGlob,
+  subjectForToolInput
+} from "../chunk-WAHQVNWT.js";
+import {
+  safeParse
+} from "../chunk-W5VITDM2.js";
+import "../chunk-B7F4WVP4.js";
+import {
+  ERROR_DETAIL_MAX,
+  sanitizeApiError,
+  scrubErrorDetail,
+  scrubErrorText
+} from "../chunk-Y5YXDM7D.js";
+import {
+  DefaultSecretScrubber
+} from "../chunk-QSTSJOCK.js";
+import {
+  SECRET_DIR_MODE,
+  SECRET_FILE_MODE,
+  restrictDirPermissions,
+  restrictFilePermissions
+} from "../chunk-6FHWXLPT.js";
+import {
+  DANGEROUS_FOR_SUBAGENTS,
+  ToolCapabilities,
+  WIDE_SUBAGENT_CAPABILITIES,
+  clampSubagentCapabilities,
+  getDangerousCapabilities,
+  hasCapability,
+  hasDangerousCapabilityForSubagents
+} from "../chunk-UBGDX6FI.js";
+import {
+  atomicWrite
+} from "../chunk-OSGLYW5J.js";
+import {
+  wstackGlobalRoot
+} from "../chunk-SAFHACFA.js";
+import "../chunk-PFZO3C6H.js";
+import "../chunk-25LSLC3G.js";
+import "../chunk-TBRL2RCC.js";
 
 // src/security/directory-permission-policy.ts
 import * as path from "node:path";
-
-// src/utils/expect-defined.ts
-function expectDefined(value, label) {
-  if (value === null || value === void 0) {
-    const err = new Error(label ? `Expected ${label} to be defined` : "Expected value to be defined");
-    err.name = "ExpectDefinedError";
-    throw err;
-  }
-  return value;
-}
-
-// src/utils/glob-match.ts
-function escapeRegex(s) {
-  return s.replace(/[.+^${}()|\\]/g, "\\$&");
-}
-var COMPILED_GLOB_CACHE = /* @__PURE__ */ new Map();
-var CACHE_MAX_SIZE = 2e3;
-var NEVER_MATCH = /[^\s\S]/;
-var COMMAND_WILDCARD_STOP = ";&|\\n\\r`$<>";
-function getCachedGlob(pattern, commandSubject = false) {
-  const cacheKey = commandSubject ? `cmd\0${pattern}` : pattern;
-  const cached = COMPILED_GLOB_CACHE.get(cacheKey);
-  if (cached) return cached;
-  if (COMPILED_GLOB_CACHE.size >= CACHE_MAX_SIZE) {
-    const keys = [...COMPILED_GLOB_CACHE.keys()];
-    for (let i = 0; i < Math.floor(CACHE_MAX_SIZE / 4); i++) {
-      COMPILED_GLOB_CACHE.delete(expectDefined(keys[i]));
-    }
-  }
-  let re;
-  try {
-    re = compileGlob(pattern, commandSubject);
-  } catch {
-    re = NEVER_MATCH;
-  }
-  COMPILED_GLOB_CACHE.set(cacheKey, re);
-  return re;
-}
-var MAX_GLOB_PATTERN_LEN = 1024;
-function compileGlob(pattern, commandSubject = false) {
-  if (pattern.length > MAX_GLOB_PATTERN_LEN) {
-    throw new Error(`Glob pattern exceeds ${MAX_GLOB_PATTERN_LEN} characters`);
-  }
-  const star = commandSubject ? `[^/${COMMAND_WILDCARD_STOP}]*` : "[^/]*";
-  const question = commandSubject ? `[^/${COMMAND_WILDCARD_STOP}]` : "[^/]";
-  let i = 0;
-  let re = "^";
-  while (i < pattern.length) {
-    const c = pattern[i];
-    if (c === "*") {
-      if (pattern[i + 1] === "*") {
-        re += commandSubject ? `[^${COMMAND_WILDCARD_STOP}]*` : ".*";
-        i += 2;
-        if (pattern[i] === "/") i++;
-      } else {
-        re += star;
-        i++;
-      }
-    } else if (c === "?") {
-      re += question;
-      i++;
-    } else if (c === "[") {
-      let cls = "[";
-      i++;
-      if (pattern[i] === "!" || pattern[i] === "^") {
-        cls += "^";
-        i++;
-      }
-      while (i < pattern.length && pattern[i] !== "]") {
-        const ch = pattern[i] ?? "";
-        if (ch === "\\") {
-          cls += "\\\\";
-        } else if (ch === "]" || ch === "^") {
-          cls += `\\${ch}`;
-        } else {
-          cls += ch;
-        }
-        i++;
-      }
-      cls += "]";
-      re += cls;
-      i++;
-    } else {
-      re += escapeRegex(c ?? "");
-      i++;
-    }
-  }
-  re += "$";
-  return new RegExp(re);
-}
-function matchGlob(pattern, input) {
-  return getCachedGlob(pattern).test(input);
-}
-function matchAny(patterns, input) {
-  return patterns.some((p) => matchGlob(p, input));
-}
-function matchCommandGlob(pattern, input) {
-  return getCachedGlob(pattern, true).test(input);
-}
-function matchAnyCommand(patterns, input) {
-  return patterns.some((p) => matchCommandGlob(p, input));
-}
-
-// src/security/directory-permission-policy.ts
 var PATH_KEYS = /* @__PURE__ */ new Set([
   "path",
   "paths",
@@ -728,22 +497,22 @@ var UNSAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set(["__proto__", "prototype", "
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function error(diagnostics, code, path9, message) {
-  diagnostics.push({ severity: "error", code, path: path9, message });
+function error(diagnostics, code, path5, message) {
+  diagnostics.push({ severity: "error", code, path: path5, message });
 }
-function validateStringList(value, path9, diagnostics, limits) {
+function validateStringList(value, path5, diagnostics, limits) {
   if (!Array.isArray(value)) {
-    error(diagnostics, limits.listErrorCode, path9, `must be an array of strings`);
+    error(diagnostics, limits.listErrorCode, path5, `must be an array of strings`);
     return void 0;
   }
   if (value.length > limits.maxItems) {
-    error(diagnostics, limits.tooManyCode, path9, `must contain at most ${limits.maxItems} ${limits.itemLabel}s`);
+    error(diagnostics, limits.tooManyCode, path5, `must contain at most ${limits.maxItems} ${limits.itemLabel}s`);
     return void 0;
   }
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const [index, entry] of value.entries()) {
-    const itemPath = `${path9}[${index}]`;
+    const itemPath = `${path5}[${index}]`;
     if (typeof entry !== "string" || entry.length === 0 || entry.length > limits.maxChars) {
       error(
         diagnostics,
@@ -904,973 +673,17 @@ function validateDirectoryPolicy(value) {
   return { ok: true, policy: { schemaVersion: DIRECTORY_POLICY_SCHEMA_VERSION, rules }, diagnostics };
 }
 
-// src/security/error-sanitize.ts
-import { homedir } from "node:os";
-
-// src/security/secret-scrubber.ts
-var JSON_CREDENTIAL_KEY_ANCHORS = [
-  'Key"',
-  'key"',
-  'KEY"',
-  'token"',
-  'Token"',
-  'TOKEN"',
-  'secret"',
-  'Secret"',
-  'SECRET"',
-  'password"',
-  'Password"',
-  'PASSWORD"',
-  'authorization"',
-  'Authorization"',
-  'bearer"',
-  'Bearer"'
-];
-var PATTERNS = [
-  // Anchored at the start where possible so partial matches inside larger
-  // strings don't trigger false positives.
-  {
-    type: "anthropic_key",
-    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g,
-    anchor: "sk-ant-"
-  },
-  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
-  {
-    // `xai` is a first-class provider in this codebase, but its key shape was
-    // absent here — so the one credential format WrongStack itself hands users
-    // was the one the scrubber could not recognize (audit 2026-08-20).
-    type: "xai_key",
-    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
-    anchor: "xai-"
-  },
-  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
-  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
-  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
-  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g, anchor: "AIza" },
-  { type: "slack_token", regex: /(?<![A-Za-z0-9-])xox[abpos]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g, anchor: "xox" },
-  {
-    type: "stripe_key",
-    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g,
-    anchor: "sk_"
-  },
-  {
-    type: "twilio_sid",
-    regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g,
-    anchor: "AC"
-  },
-  {
-    type: "telegram_bot_token",
-    // Telegram tokens are of the form  bot<digits>:<alphanum>  in URL paths
-    regex: /\/bot\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "/bot"
-  },
-  {
-    type: "jwt",
-    // Anchored: look for literal "eyJ" which is unambiguous for JWT header
-    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g,
-    anchor: "eyJ"
-  },
-  {
-    type: "private_key",
-    // Anchored: start must be BEGIN, end must be END with no extra dashes after END
-    regex: /(?:^|\n)-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END[^-]*-----(?:\n|$)/g,
-    anchor: "-----BEGIN"
-  },
-  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s"'`]+/g, anchor: "mongodb" },
-  { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g, anchor: "postgres" },
-  { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g, anchor: "mysql://" },
-  { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g, anchor: "redis://" },
-  // AI/ML provider keys — modern LLM services with well-known prefixes
-  {
-    type: "huggingface_token",
-    // HuggingFace tokens: hf_ followed by 34 alphanumeric chars
-    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g,
-    anchor: "hf_"
-  },
-  {
-    type: "replicate_token",
-    // Replicate tokens: r8_ followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "r8_"
-  },
-  {
-    type: "perplexity_key",
-    // Perplexity API keys: pplx- followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "pplx-"
-  },
-  {
-    type: "groq_key",
-    // Groq API keys: gsk_ followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "gsk_"
-  },
-  {
-    type: "bearer_token",
-    // Anchored with alternation instead of negative lookahead — avoids V8
-    // backtracking risk on adversarial input. Bounded at 512 chars.
-    // Min 12 chars: some OAuth providers issue shorter-lived tokens (< 20
-    // chars). A 12-char base64 string has ~71 bits of entropy — above the
-    // threshold where random strings are unlikely to produce false matches.
-    // The trailing boundary is a NON-consuming lookahead: two adjacent bearer
-    // tokens sharing a single delimiter (`Bearer a… Bearer b…`) must both be
-    // redacted. A consuming trailing delimiter would eat the separator the
-    // next match needs for its leading anchor, leaking the second token.
-    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?=$|[^A-Za-z0-9_.~+/-])/g,
-    anchor: "Bearer"
-  },
-  {
-    type: "high_entropy_env",
-    // Anchored with alternation instead of lookbehind to avoid backtracking.
-    // Value bounded at 512 chars.
-    // The trailing boundary is a NON-consuming lookahead so two secrets
-    // separated by a single delimiter (one space OR one newline, e.g.
-    // `printenv` / `.env` dumps: `API_KEY=… \n SESSION_TOKEN=…`) are BOTH
-    // redacted. A consuming trailing `\s` would swallow the separator the
-    // next match needs for its leading anchor, so every other secret would
-    // leak in plaintext.
-    // The leading delimiter is CAPTURED (group 1) and re-emitted by the
-    // replacement so the separator between adjacent secrets is preserved
-    // rather than collapsed. Capture groups are therefore: 1=leading
-    // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
-  },
-  {
-    type: "json_credential_key",
-    // The JSON counterpart to `high_entropy_env`, and the pattern that the
-    // now-deleted `JSON_KEY_ANCHORS` list was written for. Without it those
-    // anchors only widened the cheap pre-scan — `hasCredentialAnchors` said
-    // "this text may hold a secret", every pattern then declined to match, and
-    // the value went out verbatim. `high_entropy_env` cannot cover these: it
-    // requires an UPPERCASE unquoted key (`API_KEY=…`), so `{"apiKey":"…"}`
-    // never matched.
-    //
-    // Tool results are routinely serialised as JSON, and a credential with no
-    // recognisable prefix (Azure, self-hosted gateways, Anthropic/Codex OAuth)
-    // has no other pattern that can catch it — this is the only thing standing
-    // between such a value and the session JSONL, chronicle, HQ broadcast and
-    // the model's own context.
-    //
-    // The key may carry a prefix (`"anthropicApiKey"`), but the credential word
-    // must END the key: `"tokenCount"` and `"maxTokens"` do not match, because
-    // the closing quote has to follow the word immediately.
-    // Value floor of 8 chars keeps enum-ish values (`"authorization":"none"`)
-    // out. Capture groups: 1=key + punctuation, 2=value, 3=closing quote.
-    regex: /("[A-Za-z0-9_]*(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s*:\s*")([^"\\]{8,512})(")/gi,
-    anchor: JSON_CREDENTIAL_KEY_ANCHORS
-  },
-  // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
-  // The plugin runtime carried 37 patterns while this scrubber — the one that
-  // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
-  // audit — carried 22. The plugin side already had a parity test; it just did
-  // not cover core. Most consequential: WrongStack mints `gho_` tokens itself
-  // in the Copilot OAuth flow, and `gh[ousr]_` was absent here.
-  {
-    type: "github_oauth_token",
-    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g,
-    anchor: ["gho_", "ghu_", "ghs_", "ghr_"]
-  },
-  {
-    type: "gitlab_pat",
-    regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "glpat-"
-  },
-  {
-    type: "gitlab_runner_token",
-    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "glrt-"
-  },
-  {
-    type: "npm_token",
-    regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g,
-    anchor: "npm_"
-  },
-  {
-    type: "slack_app_token",
-    regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
-    anchor: "xapp-"
-  },
-  {
-    type: "slack_webhook",
-    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g,
-    anchor: "hooks.slack.com"
-  },
-  {
-    type: "sendgrid_key",
-    regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "SG."
-  },
-  {
-    type: "digitalocean_token",
-    regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g,
-    anchor: "dop_v1_"
-  },
-  {
-    type: "doppler_token",
-    regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "dp."
-  },
-  {
-    type: "shopify_token",
-    regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g,
-    anchor: "shp"
-  },
-  {
-    type: "docker_pat",
-    regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "dckr_pat_"
-  },
-  {
-    type: "linear_key",
-    regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "lin_api_"
-  },
-  {
-    type: "atlassian_token",
-    regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g,
-    anchor: "ATATT3"
-  },
-  {
-    type: "square_token",
-    regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: ["sq0atp-", "sq0csp-", "EAAA"]
-  },
-  {
-    type: "google_oauth_client_secret",
-    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "GOCSPX-"
-  }
-];
-var SIMPLE_PATTERNS = PATTERNS.filter(
-  (p) => p.type !== "high_entropy_env" && p.type !== "json_credential_key"
-);
-var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
-var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
-var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key").regex;
-var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
-var SCRUB_CHUNK_BYTES = 64 * 1024;
-var SCRUB_OVERLAP_BYTES = 1024;
-var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
-var PEM_END_MARKER = "-----END";
-var MAX_PEM_BLOCK_BYTES = 64 * 1024;
-var PEM_END_LINE_TOLERANCE = 64;
-function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
-  const head = text.slice(chunkStart, proposedEnd);
-  const lastBegin = head.lastIndexOf("-----BEGIN ");
-  if (lastBegin === -1) return proposedEnd;
-  const fromBegin = text.slice(chunkStart + lastBegin);
-  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
-  if (!marker || marker.index !== 0) return proposedEnd;
-  const bodyStart = marker[0].length;
-  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
-  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
-  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
-    return proposedEnd;
-  }
-  const lineEnd = fromBegin.indexOf("\n", closeIdx);
-  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
-  return Math.max(proposedEnd, end);
-}
-var PATTERN_ANCHORS = [
-  ...new Set(
-    PATTERNS.flatMap(
-      (pattern) => typeof pattern.anchor === "string" ? [pattern.anchor] : [...pattern.anchor]
-    )
-  )
-];
-var ALL_ANCHORS = PATTERN_ANCHORS;
-function hasCredentialAnchors(text) {
-  for (const anchor of ALL_ANCHORS) {
-    if (text.includes(anchor)) return true;
-  }
-  return false;
-}
-var DefaultSecretScrubber = class {
-  scrub(text) {
-    if (!text) return text;
-    if (!hasCredentialAnchors(text)) return text;
-    if (text.length <= SCRUB_CHUNK_BYTES) {
-      return this.scrubOne(text);
-    }
-    const out = [];
-    let i = 0;
-    while (i < text.length) {
-      let end = Math.min(i + SCRUB_CHUNK_BYTES, text.length);
-      if (end < text.length) {
-        const limit = Math.min(end + SCRUB_OVERLAP_BYTES, text.length);
-        let safe = -1;
-        for (let j = end; j < limit; j++) {
-          const ch = text.charCodeAt(j);
-          if (ch === 32 || ch === 9 || ch === 10 || ch === 13) {
-            safe = j;
-            break;
-          }
-        }
-        end = safe === -1 ? end : safe + 1;
-        end = extendChunkBoundaryPastPem(text, i, end);
-      }
-      out.push(this.scrubOne(text.slice(i, end)));
-      i = end;
-    }
-    return out.join("");
-  }
-  scrubOne(text) {
-    if (!hasCredentialAnchors(text)) return text;
-    let out = text.replace(
-      COMBINED_REGEX,
-      (match, ...groups) => {
-        const idx = groups.findIndex((g) => g !== void 0);
-        if (idx < 0) return match;
-        const replacement = COMBINED_REPLACEMENTS[idx];
-        return replacement !== void 0 ? replacement : match;
-      }
-    );
-    out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
-      return `${lead}${key}=[REDACTED:high_entropy_env]`;
-    });
-    out = out.replace(JSON_CREDENTIAL_REGEX, (_match, keyPrefix, _value, closingQuote) => {
-      return `${keyPrefix}[REDACTED:json_credential_key]${closingQuote}`;
-    });
-    return out;
-  }
-  /**
-   * Recursively scrub every string value in an object/array graph. Secrets can
-   * appear under any key — a URL query param, an `authorization` header, an
-   * arbitrarily-named nested field — so we don't gate recursion on key names.
-   * The per-string `scrub()` fast-path (anchor pre-scan) keeps this cheap: any
-   * value without a credential anchor returns immediately without regex work.
-   */
-  scrubObject(obj) {
-    const seen = /* @__PURE__ */ new WeakSet();
-    const visit = (v) => {
-      if (typeof v === "string") return this.scrub(v);
-      if (v === null || typeof v !== "object") return v;
-      if (seen.has(v)) return v;
-      seen.add(v);
-      if (Array.isArray(v)) return v.map(visit);
-      const out = {};
-      for (const [k, val] of Object.entries(v)) {
-        out[k] = visit(val);
-      }
-      return out;
-    };
-    return visit(obj);
-  }
-};
-
-// src/security/error-sanitize.ts
-var scrubber = new DefaultSecretScrubber();
-var ERROR_DETAIL_MAX = 500;
-function messageOf(err) {
-  if (err instanceof Error) return err.message;
-  if (typeof err === "string") return err;
-  try {
-    return String(err);
-  } catch {
-    return "unknown error";
-  }
-}
-function sanitizeApiError(err) {
-  const lower = messageOf(err).toLowerCase();
-  if (lower.includes("enoent") || lower.includes("no such file")) {
-    return "resource not found";
-  }
-  if (lower.includes("eacces") || lower.includes("permission")) {
-    return "permission denied";
-  }
-  if (lower.includes("json") && (lower.includes("parse") || lower.includes("unexpected"))) {
-    return "malformed data";
-  }
-  return "internal error";
-}
-function scrubErrorDetail(err) {
-  const out = scrubErrorText(messageOf(err));
-  return out.length > ERROR_DETAIL_MAX ? `${out.slice(0, ERROR_DETAIL_MAX - 1)}\u2026` : out;
-}
-function scrubErrorText(text) {
-  if (!text) return text;
-  let out = scrubber.scrub(text);
-  const home = safeHomedir();
-  if (home && home.length > 2) {
-    out = replaceAllCaseInsensitive(out, home, "~");
-    const alt = home.includes("\\") ? home.replace(/\\/g, "/") : home.replace(/\//g, "\\");
-    if (alt !== home) out = replaceAllCaseInsensitive(out, alt, "~");
-  }
-  return out;
-}
-function safeHomedir() {
-  try {
-    return homedir();
-  } catch {
-    return "";
-  }
-}
-function replaceAllCaseInsensitive(haystack, needle, replacement) {
-  const lowerHay = haystack.toLowerCase();
-  const lowerNeedle = needle.toLowerCase();
-  let idx = lowerHay.indexOf(lowerNeedle);
-  if (idx === -1) return haystack;
-  let out = "";
-  let from = 0;
-  while (idx !== -1) {
-    out += haystack.slice(from, idx) + replacement;
-    from = idx + needle.length;
-    idx = lowerHay.indexOf(lowerNeedle, from);
-  }
-  return out + haystack.slice(from);
-}
-
-// src/security/file-permissions.ts
-import {
-  restrictDirPermissions,
-  restrictFilePermissions,
-  SECRET_DIR_MODE,
-  SECRET_FILE_MODE
-} from "@wrongstack/persistence";
-
-// src/security/kanban-boundary.ts
-import { realpath } from "node:fs/promises";
-import * as path2 from "node:path";
-var GOVERNANCE_CONTROL_TOOLS = /* @__PURE__ */ new Set(["kanban", "plan", "task", "todo", "nextsteps"]);
-var PATH_KEYS2 = /* @__PURE__ */ new Set([
-  "path",
-  "paths",
-  "file",
-  "files",
-  "directory",
-  "dir",
-  "cwd",
-  "root",
-  "baseDir",
-  "out",
-  "outputPath",
-  "sourcePath",
-  "targetPath",
-  "destinationPath",
-  "fromPath",
-  "toPath",
-  "worktreePath"
-]);
-var TOOL_PATH_KEYS = {
-  // `target` is an identifier in tools such as plan/task/document, but a
-  // filesystem target in language_info. Keep ambiguous names tool-specific.
-  language_info: ["target"]
-};
-async function evaluateToolKanbanBoundary(tool, input, ctx, options = {}) {
-  if (tool.name === "kanban") return { decision: "allow" };
-  const identity = resolveKanbanIdentity(ctx);
-  const governanceRequired = options.requireGovernance && isGovernedMutation(tool, input);
-  if (!identity.boardId) {
-    return governanceRequired ? {
-      decision: "block",
-      reason: "Kanban governance is mandatory before product mutation. Create a managed card, add its required details and executable acceptance criteria, then call kanban start_task to bind it to this run."
-    } : { decision: "allow" };
-  }
-  const board = await kanbanGovernance().readBoard(
-    identity.policyRoot ?? ctx.projectRoot,
-    identity.boardId
-  );
-  if (!board) {
-    return governanceRequired ? {
-      decision: "block",
-      reason: `Active Kanban board not found: ${identity.boardId}. Recreate or select a valid managed card before mutation.`,
-      boardId: identity.boardId,
-      ...identity.taskId ? { taskId: identity.taskId } : {}
-    } : { decision: "allow" };
-  }
-  const task = identity.taskId ? board.tasks.find((candidate) => candidate.id === identity.taskId) : void 0;
-  if (governanceRequired && board.lifecycle?.mode === "managed") {
-    if (!identity.taskId) {
-      return {
-        decision: "block",
-        reason: "Kanban governance requires an active task, not only a board. Complete the card details and call kanban start_task before mutation.",
-        boardId: board.id
-      };
-    }
-    if (!task) {
-      return {
-        decision: "block",
-        reason: `Active Kanban task not found: ${identity.taskId}. Call kanban start_task with a valid card.`,
-        boardId: board.id,
-        taskId: identity.taskId
-      };
-    }
-    const readiness = kanbanGovernance().evaluateContractGraphReadiness(board, task.id);
-    if (!readiness.ready) {
-      const issueLines = readiness.issues.map((issue, index) => `  ${index + 1}. ${issue.message}`).join("\n");
-      return {
-        decision: "block",
-        reason: `Active card failed contract-readiness check (${readiness.issues.length} issue(s)):
-` + issueLines + `
-Resolve the readiness issues, then call kanban start_task to retry.`,
-        boardId: board.id,
-        taskId: task.id,
-        readinessIssues: readiness.issues
-      };
-    }
-    const lifecycleStage = task.lifecycle?.currentStage;
-    const assignmentStatus = task.assignment?.status;
-    const lifecycleOk = lifecycleStage === "running";
-    const assignmentOk = assignmentStatus === "running";
-    if (!lifecycleOk || !assignmentOk) {
-      const failed = [];
-      let reassessmentNote = "";
-      if (!lifecycleOk) {
-        failed.push(`lifecycle.currentStage (got: ${lifecycleStage ?? "missing"}; want: 'running')`);
-      }
-      if (!assignmentOk) {
-        failed.push(`assignment.status (got: ${assignmentStatus ?? "missing"}; want: 'running')`);
-        if (lifecycleOk && (assignmentStatus === "queued" || assignmentStatus === void 0 || assignmentStatus === null)) {
-          reassessmentNote = '\nNote: lifecycle is still "running" but the assignment was cleared \u2014 the automated kanban reassessment agent likely reset the binding. Re-issue kanban start_task to re-bind the leader to this card.';
-        }
-      }
-      return {
-        decision: "block",
-        reason: `Active card failed ${failed.length} governance check(s) before product mutation:
-` + failed.map((line, index) => `  ${index + 1}. ${line}`).join("\n") + reassessmentNote,
-        boardId: board.id,
-        taskId: task.id
-      };
-    }
-  }
-  if (identity.leaseId && task?.assignment) {
-    const caps2 = tool.capabilities ?? [];
-    const isWrite = caps2.includes("fs.write") || caps2.includes("fs.write.outside-project") || caps2.some((c) => c.startsWith("shell."));
-    if (isWrite && tool.name !== "kanban" && task.assignment.leaseId !== identity.leaseId) {
-      return {
-        decision: "block",
-        reason: `Task ${task.id} lease mismatch: the current worker's lease (${identity.leaseId}) does not match the active lease on the board (${task.assignment.leaseId}). This task was likely recovered and reassigned to another worker. File modifications from a stale worker are blocked. Use kanban mark_assignment with expectedLeaseId to resolve, or use kanban get_board to reassess the current state.`,
-        boardId: board.id,
-        taskId: task.id
-      };
-    }
-  }
-  const layers = kanbanGovernance().resolveKanbanBoundaryLayers(board, task);
-  if (layers.length === 0) return { decision: "allow" };
-  const caps = tool.capabilities ?? [];
-  const access = caps.includes("fs.write") || caps.includes("fs.write.outside-project") ? "write" : caps.includes("fs.read") ? "read" : void 0;
-  const shellLike = caps.some((capability) => capability.startsWith("shell."));
-  const candidates = access ? await extractCandidatePaths(tool.name, input, ctx) : [];
-  let evaluation;
-  if (shellLike || access && candidates.length === 0) {
-    evaluation = kanbanGovernance().evaluateKanbanBoundaryOpaque(layers, tool.name);
-  } else if (access) {
-    const results = candidates.map(
-      (candidate) => kanbanGovernance().evaluateKanbanBoundaryPath(layers, candidate, access)
-    );
-    evaluation = results.find((result) => result.decision === "block") ?? results.find((result) => result.decision === "confirm") ?? { decision: "allow" };
-  } else {
-    evaluation = { decision: "allow" };
-  }
-  return {
-    ...evaluation,
-    boardId: board.id,
-    ...task ? { taskId: task.id } : {}
-  };
-}
-function isGovernedMutation(tool, input) {
-  if (!tool.mutating || GOVERNANCE_CONTROL_TOOLS.has(tool.name)) return false;
-  if (tool.capabilities?.includes("tool.meta")) return false;
-  if (tool.name === "git") {
-    const command = input["command"];
-    if (command === "status" || command === "log" || command === "diff") return false;
-    if (command === "worktree" && input["worktreeAction"] === "list") return false;
-  }
-  const capabilities = tool.capabilities ?? [];
-  return capabilities.some(
-    (capability) => capability === "fs.write" || capability === "fs.write.outside-project" || capability === "package.install" || capability === "tool.mutate.any" || capability.startsWith("shell.") || capability === "net.outbound"
-  );
-}
-function resolveKanbanIdentity(ctx) {
-  const metaKanban = ctx.meta["kanban"];
-  const record = metaKanban && typeof metaKanban === "object" ? metaKanban : void 0;
-  const boardId = ctx.currentKanbanBoardId ?? (typeof record?.["boardId"] === "string" ? record["boardId"] : void 0);
-  const taskId = ctx.currentKanbanTaskId ?? (typeof record?.["taskId"] === "string" ? record["taskId"] : void 0);
-  const policyRoot = typeof record?.["projectRoot"] === "string" ? record["projectRoot"] : void 0;
-  const leaseId = typeof record?.["leaseId"] === "string" ? record["leaseId"] : void 0;
-  return {
-    ...boardId ? { boardId } : {},
-    ...taskId ? { taskId } : {},
-    ...policyRoot ? { policyRoot } : {},
-    ...leaseId ? { leaseId } : {}
-  };
-}
-async function extractCandidatePaths(toolName, input, ctx) {
-  if (toolName === "patch" && typeof input["patch"] === "string") {
-    const directoryInput = stringValue(input["directory"]) ?? ctx.workingDir;
-    const directory = path2.isAbsolute(directoryInput) ? directoryInput : path2.resolve(ctx.workingDir, directoryInput);
-    const strip = Math.max(1, numericValue(input["strip"]) ?? 1);
-    const targets = extractPatchTargets(input["patch"], strip).map(
-      (target) => relativeToProject(path2.resolve(directory, target), ctx.projectRoot)
-    );
-    return Promise.all(targets.map((target) => canonicalizeCandidatePath(target, ctx)));
-  }
-  const values = [];
-  const pathKeys = new Set(PATH_KEYS2);
-  for (const key of TOOL_PATH_KEYS[toolName] ?? []) pathKeys.add(key);
-  collectPathValues(input, values, pathKeys);
-  if (toolName === "scaffold" && typeof input["name"] === "string") {
-    const cwd = stringValue(input["cwd"]) ?? ctx.workingDir;
-    values.push(path2.join(cwd, input["name"]));
-  }
-  const candidates = [
-    ...new Set(values.flatMap(splitPathList).map((value) => resolveInputPath(value, ctx)))
-  ];
-  return Promise.all(candidates.map((candidate) => canonicalizeCandidatePath(candidate, ctx)));
-}
-async function canonicalizeCandidatePath(candidate, ctx) {
-  if (path2.isAbsolute(candidate)) return candidate;
-  const absolute = path2.resolve(ctx.projectRoot, candidate);
-  const canonicalRoot = await realpath(ctx.projectRoot).catch(() => ctx.projectRoot);
-  let probe = absolute;
-  const missingSegments = [];
-  while (true) {
-    try {
-      const canonical = path2.join(await realpath(probe), ...missingSegments);
-      return relativeToProject(canonical, canonicalRoot);
-    } catch (cause) {
-      const code = cause.code;
-      if (code !== "ENOENT" && code !== "ENOTDIR") return absolute;
-      const parent = path2.dirname(probe);
-      if (parent === probe) return absolute;
-      missingSegments.unshift(path2.basename(probe));
-      probe = parent;
-    }
-  }
-}
-function collectPathValues(value, output, pathKeys, key) {
-  if (typeof value === "string") {
-    if (key && pathKeys.has(key)) output.push(value);
-    return;
-  }
-  if (Array.isArray(value)) {
-    for (const item of value) collectPathValues(item, output, pathKeys, key);
-    return;
-  }
-  if (!value || typeof value !== "object") return;
-  for (const [childKey, child] of Object.entries(value)) {
-    collectPathValues(child, output, pathKeys, childKey);
-  }
-}
-function splitPathList(value) {
-  return value.split(",").map((item) => item.trim()).filter(Boolean);
-}
-function resolveInputPath(value, ctx) {
-  const absolute = path2.isAbsolute(value) ? value : path2.resolve(ctx.workingDir, value);
-  return relativeToProject(absolute, ctx.projectRoot);
-}
-function relativeToProject(absolute, projectRoot) {
-  const relative4 = path2.relative(projectRoot, absolute).replace(/\\/g, "/");
-  return relative4.startsWith("../") || path2.isAbsolute(relative4) ? absolute : relative4 || ".";
-}
-function extractPatchTargets(patchText, strip) {
-  const targets = [];
-  for (const match of patchText.matchAll(/^\+\+\+\s+([^\t\r\n]+)/gm)) {
-    const raw = match[1]?.trim();
-    if (!raw || raw === "/dev/null") continue;
-    const parts = raw.replace(/\\/g, "/").split("/").filter((part) => part && part !== ".");
-    if (parts.length > strip) targets.push(parts.slice(strip).join("/"));
-  }
-  return targets;
-}
-function stringValue(value) {
-  return typeof value === "string" && value.trim() ? value : void 0;
-}
-function numericValue(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-
 // src/security/permission-policy.ts
 import * as fs from "node:fs/promises";
-import * as path6 from "node:path";
-
-// src/utils/atomic-write.ts
-import {
-  createPersistencePrimitives
-} from "@wrongstack/persistence";
-
-// src/utils/error.ts
-function toErrorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-
-// src/types/errors.ts
-var ERROR_CODES = {
-  // Provider
-  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
-  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
-  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
-  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
-  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
-  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
-  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
-  // Tool
-  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
-  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
-  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
-  TOOL_TIMEOUT: "TOOL_TIMEOUT",
-  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
-  // Config
-  CONFIG_INVALID: "CONFIG_INVALID",
-  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
-  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
-  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
-  // Plugin
-  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
-  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
-  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
-  // Agent
-  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
-  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
-  AGENT_ABORTED: "AGENT_ABORTED",
-  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
-  // Session
-  SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
-  SESSION_CORRUPTED: "SESSION_CORRUPTED",
-  SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
-  // Container / Registry
-  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
-  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
-  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
-  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
-  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
-  REGISTRY_INVALID: "REGISTRY_INVALID",
-  // File system
-  FS_READ_FAILED: "FS_READ_FAILED",
-  FS_WRITE_FAILED: "FS_WRITE_FAILED",
-  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
-  FS_DELETE_FAILED: "FS_DELETE_FAILED",
-  FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
-  // SDD (Spec-Driven Development)
-  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
-  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
-  SDD_INVALID_STATE: "SDD_INVALID_STATE",
-  SDD_NOT_READY: "SDD_NOT_READY",
-  // General
-  VALIDATION_ERROR: "VALIDATION_ERROR",
-  PARSE_FAILED: "PARSE_FAILED",
-  UNKNOWN: "UNKNOWN"
-};
-var WrongStackError = class extends Error {
-  code;
-  subsystem;
-  severity;
-  recoverable;
-  context;
-  constructor(opts) {
-    super(opts.message, { cause: opts.cause });
-    this.name = "WrongStackError";
-    this.code = opts.code;
-    this.subsystem = opts.subsystem;
-    this.severity = opts.severity ?? "error";
-    this.recoverable = opts.recoverable ?? false;
-    this.context = opts.context;
-  }
-  /**
-   * Render a one-line user-facing description.
-   * Subclasses should override for domain-specific formatting.
-   */
-  describe() {
-    const ctx = this.context ? ` ${formatContext(this.context)}` : "";
-    return `${this.code}: ${this.message}${ctx}`;
-  }
-};
-function formatContext(ctx) {
-  const parts = Object.entries(ctx).filter(([, v]) => v !== void 0).slice(0, 3).map(([k, v]) => `${k}=${String(v)}`);
-  return parts.length > 0 ? `[${parts.join(" ")}]` : "";
-}
-var ConfigError = class extends WrongStackError {
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "config",
-      severity: "fatal",
-      recoverable: false,
-      context: opts.context,
-      cause: opts.cause
-    });
-    this.name = "ConfigError";
-  }
-};
-var FsError = class extends WrongStackError {
-  path;
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "fs",
-      severity: "error",
-      recoverable: opts.code !== ERROR_CODES.FS_READ_FAILED,
-      context: { path: opts.path, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "FsError";
-    this.path = opts.path;
-  }
-};
-
-// src/utils/atomic-write.ts
-var primitives = createPersistencePrimitives({
-  createLockTimeoutError: ({ targetPath, timeoutMs }) => new FsError({
-    message: `Timed out waiting for file lock: ${targetPath}`,
-    code: "FS_ATOMIC_WRITE_FAILED",
-    path: targetPath,
-    context: { timeoutMs }
-  })
-});
-var atomicWrite = primitives.atomicWrite;
-var atomicReplaceWithWriter = primitives.atomicReplaceWithWriter;
-var ensureDir = primitives.ensureDir;
-var withFileLock = primitives.withFileLock;
-
-// src/utils/lru-cache.ts
-var LruCache = class {
-  store = /* @__PURE__ */ new Map();
-  capacity;
-  constructor(capacity) {
-    if (capacity < 1) throw new Error(`LruCache capacity must be >= 1, got ${capacity}`);
-    this.capacity = capacity;
-  }
-  get(key) {
-    if (!this.store.has(key)) return void 0;
-    const value = this.store.get(key);
-    this.store.delete(key);
-    this.store.set(key, value);
-    return value;
-  }
-  set(key, value) {
-    if (this.store.has(key)) this.store.delete(key);
-    this.store.set(key, value);
-    while (this.store.size > this.capacity) {
-      const oldest = this.store.keys().next();
-      if (oldest.done) break;
-      this.store.delete(oldest.value);
-    }
-  }
-  has(key) {
-    return this.store.has(key);
-  }
-  clear() {
-    this.store.clear();
-  }
-  get size() {
-    return this.store.size;
-  }
-};
-
-// src/utils/safe-json.ts
-function safeParse(input, maxBytes = 5e6) {
-  if (Buffer.byteLength(input, "utf8") > maxBytes) {
-    return { ok: false, error: `Input exceeds limit (${maxBytes} bytes)` };
-  }
-  try {
-    return { ok: true, value: JSON.parse(input) };
-  } catch (err) {
-    return {
-      ok: false,
-      error: toErrorMessage(err)
-    };
-  }
-}
-
-// src/utils/tool-subject.ts
-var GLOB_METACHARACTERS = /[*?[\]]/g;
-function escapeGlobSubject(value) {
-  return value.replace(GLOB_METACHARACTERS, (char) => `\\${char}`);
-}
-function normalizePathSubject(value) {
-  return escapeGlobSubject(value.replace(/\\/g, "/"));
-}
-function isPathSubjectKey(subjectKey) {
-  return subjectKey === "path" || subjectKey === "file" || subjectKey === "files";
-}
-function renderCommandLine(command, args) {
-  if (!Array.isArray(args) || args.length === 0) return command;
-  const rendered = args.map((arg) => {
-    const str = String(arg);
-    return /\s/.test(str) ? `"${str.replace(/"/g, '\\"')}"` : str;
-  });
-  return [command, ...rendered].join(" ");
-}
-function renderSubjectFields(obj, fields) {
-  const parts = [];
-  for (const field of fields) {
-    const value = obj[field];
-    if (value === void 0 || value === null || value === "" || value === false) continue;
-    const str = String(value);
-    parts.push(`${field}=${/\s/.test(str) ? `"${str.replace(/"/g, '\\"')}"` : str}`);
-  }
-  return parts.join(" ");
-}
-function subjectForToolInput(toolName, input, subjectKey, subjectFields) {
-  if (!input || typeof input !== "object") return void 0;
-  const obj = input;
-  const extra = subjectFields && subjectFields.length > 0 ? renderSubjectFields(obj, subjectFields) : "";
-  const withExtra = (base) => extra ? `${base} ${extra}` : base;
-  if (subjectKey) {
-    const value = obj[subjectKey];
-    if (Array.isArray(value)) {
-      return escapeGlobSubject(JSON.stringify(value));
-    }
-    if (typeof value === "string") {
-      if (isPathSubjectKey(subjectKey)) {
-        const normalized = normalizePathSubject(value);
-        if (subjectKey === "files" && obj["check"] === true) return `${normalized}:check`;
-        if (subjectKey === "files" && obj["dry_run"] === true) return `${normalized}:dry-run`;
-        return normalized;
-      }
-      if (subjectKey === "command") {
-        const rendered = renderCommandLine(value, obj["args"]);
-        if (value === "commit" && obj["dry_run"] === true) {
-          return `${escapeGlobSubject(withExtra(rendered))}:dry-run`;
-        }
-        return escapeGlobSubject(withExtra(rendered));
-      }
-      if (subjectKey === "directory" && obj["dry_run"] === true) {
-        return `${escapeGlobSubject(value)}:dry-run`;
-      }
-      if (subjectKey === "packages" && obj["dry_run"] === true) {
-        return `${escapeGlobSubject(value)}:dry-run`;
-      }
-      if (subjectKey === "name" && obj["dry_run"] === true) {
-        return `${escapeGlobSubject(value)}:dry-run`;
-      }
-      return escapeGlobSubject(value);
-    }
-  }
-  if (toolName === "bash" && typeof obj.command === "string") {
-    return escapeGlobSubject(obj.command);
-  }
-  if (typeof obj.path === "string") {
-    return normalizePathSubject(obj.path);
-  }
-  if (typeof obj.url === "string") {
-    return escapeGlobSubject(obj.url);
-  }
-  if (typeof obj.name === "string") {
-    return escapeGlobSubject(obj.name);
-  }
-  return void 0;
-}
+import * as path4 from "node:path";
 
 // src/security/permission-helpers.ts
 import { realpathSync } from "node:fs";
-import * as path5 from "node:path";
-
-// src/utils/wstack-paths.ts
-import * as os from "node:os";
 import * as path3 from "node:path";
-function wstackGlobalRoot() {
-  const fromEnv = process.env["WRONGSTACK_HOME"];
-  if (fromEnv && fromEnv.trim().length > 0) return path3.resolve(fromEnv);
-  return path3.join(os.homedir(), ".wrongstack");
-}
 
 // src/security/yolo-risk.ts
-import * as os2 from "node:os";
-import * as path4 from "node:path";
+import * as os from "node:os";
+import * as path2 from "node:path";
 var PROTECTED_STATE_BASENAMES = /^(?:config\.json|config\.local\.json|trust\.json|auth\.json|\.key)$/i;
 var CATASTROPHIC_PATTERNS = [
   /\b(?:mkfs(?:\.[a-z0-9]+)?|mke2fs|newfs)\b/i,
@@ -1931,9 +744,9 @@ function getInputString(input, key) {
 function pathLooksInsideProject(rawPath, projectRoot) {
   if (!projectRoot) return false;
   if (rawPath === "~" || rawPath.startsWith("~/") || rawPath.startsWith("~\\")) return false;
-  const resolved = path4.resolve(projectRoot, rawPath);
-  const relative4 = path4.relative(projectRoot, resolved);
-  return !!relative4 && !relative4.startsWith("..") && !path4.isAbsolute(relative4);
+  const resolved = path2.resolve(projectRoot, rawPath);
+  const relative3 = path2.relative(projectRoot, resolved);
+  return !!relative3 && !relative3.startsWith("..") && !path2.isAbsolute(relative3);
 }
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
@@ -2146,15 +959,15 @@ function hasWriteToAgentStateRoot(command) {
   return false;
 }
 function looksLikeAgentStateTarget(rawPath) {
-  const expanded = rawPath.replace(/^~([\\/])/, (_, sep2) => `${os2.homedir()}${sep2}`);
-  const resolved = path4.resolve(expanded);
+  const expanded = rawPath.replace(/^~([\\/])/, (_, sep) => `${os.homedir()}${sep}`);
+  const resolved = path2.resolve(expanded);
   const rootStr = wstackGlobalRoot();
   const resolvedNorm = resolved.replace(/\\/g, "/").toLowerCase();
-  const rootNorm = path4.resolve(rootStr).replace(/\\/g, "/").toLowerCase();
+  const rootNorm = path2.resolve(rootStr).replace(/\\/g, "/").toLowerCase();
   if (!resolvedNorm.startsWith(rootNorm) && !resolvedNorm.includes(".wrongstack")) {
     return false;
   }
-  return PROTECTED_STATE_BASENAMES.test(path4.basename(resolved));
+  return PROTECTED_STATE_BASENAMES.test(path2.basename(resolved));
 }
 function isClearlyDestructiveBashCommand(command, projectRoot) {
   const trimmed = command.trim();
@@ -2305,24 +1118,24 @@ function realpathOfNearestExisting(p) {
   const tail = [];
   for (; ; ) {
     try {
-      return tail.length === 0 ? realpathSync(probe) : path5.join(realpathSync(probe), ...tail);
+      return tail.length === 0 ? realpathSync(probe) : path3.join(realpathSync(probe), ...tail);
     } catch {
-      const parent = path5.dirname(probe);
+      const parent = path3.dirname(probe);
       if (parent === probe) return p;
-      tail.unshift(path5.basename(probe));
+      tail.unshift(path3.basename(probe));
       probe = parent;
     }
   }
 }
 var agentStateRootRealCache = /* @__PURE__ */ new Map();
 function isInsideAgentStateRoot(absPath) {
-  const lexicalRoot = normalizeForCompare(path5.resolve(wstackGlobalRoot()));
+  const lexicalRoot = normalizeForCompare(path3.resolve(wstackGlobalRoot()));
   if (!lexicalRoot) return false;
   const target = normalizeForCompare(absPath);
   if (target === lexicalRoot || target.startsWith(`${lexicalRoot}/`)) return true;
   let realRoot = agentStateRootRealCache.get(lexicalRoot);
   if (realRoot === void 0) {
-    realRoot = normalizeForCompare(realpathOfNearestExisting(path5.resolve(wstackGlobalRoot())));
+    realRoot = normalizeForCompare(realpathOfNearestExisting(path3.resolve(wstackGlobalRoot())));
     agentStateRootRealCache.set(lexicalRoot, realRoot);
   }
   if (!realRoot || realRoot === lexicalRoot) return false;
@@ -2331,7 +1144,7 @@ function isInsideAgentStateRoot(absPath) {
 }
 function isProtectedAgentStatePath(absPath) {
   if (!isInsideAgentStateRoot(absPath)) return false;
-  return AGENT_STATE_SENSITIVE_BASENAMES.test(path5.basename(normalizeForCompare(absPath)));
+  return AGENT_STATE_SENSITIVE_BASENAMES.test(path3.basename(normalizeForCompare(absPath)));
 }
 function pathLooksSensitive(rawPath) {
   const normalized = stripAdsSuffix(stripShellQuotes(rawPath).replace(/\\/g, "/"));
@@ -2655,205 +1468,38 @@ function explainPermissionTrace(state, tool, input, ctx) {
       "safe default auto",
       true,
       "auto",
-      "default",
-      `tool "${tool.name}" has auto permission and is not mutating \u2014 safe to auto-approve`
-    );
-    winnerIndex = steps.length - 1;
-    return {
-      toolName: tool.name,
-      subject,
-      steps,
-      winnerIndex,
-      decision: { permission: "auto", source: "default" }
-    };
-  }
-  add(
-    "mutating default confirm",
-    true,
-    "confirm",
-    "default",
-    isMutating ? `tool "${tool.name}" is mutating (default auto not enough) \u2014 needs confirmation` : `tool "${tool.name}" has "${tool.permission}" permission \u2014 needs confirmation`
-  );
-  winnerIndex = steps.length - 1;
-  const hasDelegate = state.promptDelegatePresent;
-  return {
-    toolName: tool.name,
-    subject,
-    steps,
-    winnerIndex,
-    decision: {
-      permission: "confirm",
-      source: "default",
-      ...hasDelegate ? { reason: "would prompt user via delegate" } : {}
-    }
-  };
-}
-
-// src/security/permission-policy-schema.ts
-var TRUST_POLICY_SCHEMA_VERSION = 1;
-var TRUST_POLICY_LIMITS = Object.freeze({
-  maxTools: 1e3,
-  maxPatternsPerRule: 1e3,
-  maxToolNameChars: 256,
-  maxPatternChars: 4096
-});
-var TRUST_POLICY_JSON_SCHEMA = Object.freeze({
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://wrongstack.dev/schemas/trust-policy-v1.json",
-  title: "WrongStack Trust Policy",
-  type: "object",
-  maxProperties: TRUST_POLICY_LIMITS.maxTools,
-  propertyNames: {
-    minLength: 1,
-    maxLength: TRUST_POLICY_LIMITS.maxToolNameChars,
-    not: { enum: ["__proto__", "prototype", "constructor"] }
-  },
-  additionalProperties: {
-    type: "object",
-    additionalProperties: false,
-    properties: {
-      allow: {
-        type: "array",
-        maxItems: TRUST_POLICY_LIMITS.maxPatternsPerRule,
-        items: { type: "string", minLength: 1, maxLength: TRUST_POLICY_LIMITS.maxPatternChars }
-      },
-      deny: {
-        type: "array",
-        maxItems: TRUST_POLICY_LIMITS.maxPatternsPerRule,
-        items: { type: "string", minLength: 1, maxLength: TRUST_POLICY_LIMITS.maxPatternChars }
-      },
-      auto: { type: "boolean" },
-      trustWorkdir: { type: "boolean" },
-      denyPrivate: { type: "boolean" }
-    }
-  }
-});
-var RULE_FIELDS2 = /* @__PURE__ */ new Set(["allow", "deny", "auto", "trustWorkdir", "denyPrivate"]);
-var UNSAFE_PROPERTY_NAMES2 = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function error2(diagnostics, code, path9, message) {
-  diagnostics.push({ severity: "error", code, path: path9, message });
-}
-function validatePatterns(value, path9, diagnostics) {
-  if (!Array.isArray(value)) {
-    error2(diagnostics, "invalid_pattern_list", path9, "must be an array of strings");
-    return void 0;
-  }
-  if (value.length > TRUST_POLICY_LIMITS.maxPatternsPerRule) {
-    error2(
-      diagnostics,
-      "too_many_patterns",
-      path9,
-      `must contain at most ${TRUST_POLICY_LIMITS.maxPatternsPerRule} patterns`
-    );
-    return void 0;
-  }
-  const patterns = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const [index, pattern] of value.entries()) {
-    const itemPath = `${path9}[${index}]`;
-    if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > TRUST_POLICY_LIMITS.maxPatternChars) {
-      error2(
-        diagnostics,
-        "invalid_pattern",
-        itemPath,
-        `must be a non-empty string up to ${TRUST_POLICY_LIMITS.maxPatternChars} characters`
-      );
-      continue;
-    }
-    if (seen.has(pattern)) {
-      diagnostics.push({
-        severity: "warning",
-        code: "duplicate_pattern",
-        path: itemPath,
-        message: "duplicates an earlier pattern and was normalized away"
-      });
-      continue;
-    }
-    seen.add(pattern);
-    patterns.push(pattern);
-  }
-  return patterns;
-}
-function validateTrustPolicy(value) {
-  const diagnostics = [];
-  if (!isRecord2(value)) {
+      "default",
+      `tool "${tool.name}" has auto permission and is not mutating \u2014 safe to auto-approve`
+    );
+    winnerIndex = steps.length - 1;
     return {
-      ok: false,
-      diagnostics: [
-        {
-          severity: "error",
-          code: "invalid_root",
-          path: "$",
-          message: "trust policy must be an object"
-        }
-      ]
+      toolName: tool.name,
+      subject,
+      steps,
+      winnerIndex,
+      decision: { permission: "auto", source: "default" }
     };
   }
-  const entries = Object.entries(value);
-  if (entries.length > TRUST_POLICY_LIMITS.maxTools) {
-    error2(
-      diagnostics,
-      "too_many_tools",
-      "$",
-      `must contain at most ${TRUST_POLICY_LIMITS.maxTools} tool rules`
-    );
-  }
-  const policy = {};
-  for (const [toolName, rawRule] of entries.slice(0, TRUST_POLICY_LIMITS.maxTools)) {
-    const toolPath = `$[${JSON.stringify(toolName)}]`;
-    if (toolName.length === 0 || toolName.length > TRUST_POLICY_LIMITS.maxToolNameChars) {
-      error2(
-        diagnostics,
-        "invalid_tool_name",
-        toolPath,
-        `tool name must be 1-${TRUST_POLICY_LIMITS.maxToolNameChars} characters`
-      );
-      continue;
-    }
-    if (UNSAFE_PROPERTY_NAMES2.has(toolName)) {
-      error2(
-        diagnostics,
-        "unsafe_tool_name",
-        toolPath,
-        "reserved object property names are not valid tool rules"
-      );
-      continue;
-    }
-    if (!isRecord2(rawRule)) {
-      error2(diagnostics, "invalid_rule", toolPath, "tool rule must be an object");
-      continue;
-    }
-    for (const field of Object.keys(rawRule)) {
-      if (!RULE_FIELDS2.has(field)) {
-        error2(
-          diagnostics,
-          "unknown_field",
-          `${toolPath}.${field}`,
-          `unknown policy field "${field}"`
-        );
-      }
-    }
-    const rule = {};
-    for (const field of ["allow", "deny"]) {
-      if (rawRule[field] === void 0) continue;
-      const patterns = validatePatterns(rawRule[field], `${toolPath}.${field}`, diagnostics);
-      if (patterns) rule[field] = patterns;
-    }
-    for (const field of ["auto", "trustWorkdir", "denyPrivate"]) {
-      const setting = rawRule[field];
-      if (setting === void 0) continue;
-      if (typeof setting !== "boolean") {
-        error2(diagnostics, "invalid_boolean", `${toolPath}.${field}`, "must be a boolean");
-      } else {
-        rule[field] = setting;
-      }
+  add(
+    "mutating default confirm",
+    true,
+    "confirm",
+    "default",
+    isMutating ? `tool "${tool.name}" is mutating (default auto not enough) \u2014 needs confirmation` : `tool "${tool.name}" has "${tool.permission}" permission \u2014 needs confirmation`
+  );
+  winnerIndex = steps.length - 1;
+  const hasDelegate = state.promptDelegatePresent;
+  return {
+    toolName: tool.name,
+    subject,
+    steps,
+    winnerIndex,
+    decision: {
+      permission: "confirm",
+      source: "default",
+      ...hasDelegate ? { reason: "would prompt user via delegate" } : {}
     }
-    policy[toolName] = rule;
-  }
-  return diagnostics.some((diagnostic) => diagnostic.severity === "error") ? { ok: false, diagnostics } : { ok: true, policy, diagnostics };
+  };
 }
 
 // src/security/auto-approve-policy.ts
@@ -2994,13 +1640,13 @@ var DefaultPermissionPolicy = class {
     if (!hasCapability(tool, ToolCapabilities.FS_WRITE)) return false;
     for (const targetPath of fsWriteTargetPaths(input)) {
       const base = ctx.workingDir ?? ctx.cwd;
-      const resolved = base ? path6.resolve(base, targetPath) : path6.resolve(targetPath);
+      const resolved = base ? path4.resolve(base, targetPath) : path4.resolve(targetPath);
       if (isInsideAgentStateRoot(resolved)) return true;
     }
     return false;
   }
   yoloBlockedAsDestructive(tool, input, ctx) {
-    if (!this.yolo || this.yoloDestructive) return false;
+    if (!this.effectiveYolo(ctx) || this.yoloDestructive) return false;
     if (this.hasAgentStateWriteTarget(tool, input, ctx)) return true;
     if (attachesWellKnownCredential(input)) return true;
     const isShellSurface = tool.name === "bash" || tool.name === "exec" || (tool.capabilities ?? []).includes("shell.arbitrary");
@@ -3012,6 +1658,20 @@ var DefaultPermissionPolicy = class {
   setPromptDelegate(delegate) {
     this.promptDelegate = delegate;
   }
+  /**
+   * YOLO as it applies to ONE conversation.
+   *
+   * `this.yolo` is a process-wide switch, which is right for a CLI or a TUI —
+   * one process, one conversation. A WebUI holds four at once, and YOLO is a
+   * per-tab preference stored on each session's own context meta, so reading
+   * the process switch meant turning YOLO on in one tab auto-approved the
+   * tools of the other three. The instance flag stays as the fallback for
+   * hosts (and tests) that never write the meta key.
+   */
+  effectiveYolo(ctx) {
+    const scoped = ctx?.meta?.["yolo"];
+    return typeof scoped === "boolean" ? scoped : this.yolo;
+  }
   setYolo(enabled) {
     if (this.yolo !== enabled) this._evalCache.clear();
     this.yolo = enabled;
@@ -3099,7 +1759,7 @@ var DefaultPermissionPolicy = class {
     const entry = mergeTrustEntries(this.policy[tool.name], namespaceEntry);
     const subject = subjectForToolInput(tool.name, input, tool.subjectKey, tool.subjectFields);
     const cacheKey = `${tool.name}::${subject ?? tool.name}`;
-    const evalKey = `${cacheKey}::${permissionFingerprint(tool)}`;
+    const evalKey = `${ctx.session?.id ?? "__default__"}::${cacheKey}::${permissionFingerprint(tool)}::y${this.effectiveYolo(ctx) ? 1 : 0}`;
     if (tool.name !== "write" && !this.hasAgentStateWriteTarget(tool, input, ctx)) {
       const cached = this._evalCache.get(evalKey);
       if (cached !== void 0) return cached;
@@ -3159,7 +1819,7 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(evalKey, decision);
       return decision;
     }
-    if (!this.yolo && this.isSensitiveReadCall(tool, input)) {
+    if (!this.effectiveYolo(ctx) && this.isSensitiveReadCall(tool, input)) {
       if (this.promptDelegate) {
         const userDecision = await this.promptDelegate(tool, input, subject ?? tool.name);
         if (userDecision === "always") {
@@ -3195,7 +1855,7 @@ var DefaultPermissionPolicy = class {
         reason: "sensitive file read needs explicit approval"
       };
     }
-    if (this.yolo) {
+    if (this.effectiveYolo(ctx)) {
       if (this.yoloBlockedAsDestructive(tool, input, ctx)) {
         return {
           permission: "confirm",
@@ -3316,7 +1976,7 @@ var DefaultPermissionPolicy = class {
         wildcardEntries: this.wildcardEntries,
         sessionDenied: this.sessionDenied,
         sessionAllowed: this.sessionAllowed,
-        yolo: this.yolo,
+        yolo: this.effectiveYolo(ctx),
         promptDelegatePresent: this.promptDelegate !== void 0,
         isSensitiveReadCall: (t, inp) => this.isSensitiveReadCall(t, inp),
         yoloBlockedAsDestructive: (t, inp, c) => this.yoloBlockedAsDestructive(t, inp, c)
@@ -3334,126 +1994,6 @@ var DefaultPermissionPolicy = class {
   }
 };
 
-// src/security/readonly-permission-policy.ts
-import * as path7 from "node:path";
-var MUTATION_CAPABILITIES = /* @__PURE__ */ new Set([
-  ToolCapabilities.FS_WRITE,
-  ToolCapabilities.FS_WRITE_OUTSIDE_PROJECT,
-  ToolCapabilities.MEMORY_WRITE,
-  ToolCapabilities.MEMORY_DELETE,
-  ToolCapabilities.SHELL_ARBITRARY,
-  ToolCapabilities.SHELL_RESTRICTED,
-  ToolCapabilities.SHELL_EXEC,
-  ToolCapabilities.TOOL_MUTATE_ANY,
-  ToolCapabilities.CONFIG_MUTATE,
-  ToolCapabilities.PACKAGE_INSTALL,
-  ToolCapabilities.SUBAGENT_SPAWN
-]);
-function toolMutates(tool) {
-  if (tool.mutating === true) return true;
-  return (tool.capabilities ?? []).some((c) => MUTATION_CAPABILITIES.has(c));
-}
-var hasMutationCapability = toolMutates;
-function isAllowedReportFile(input, projectRoot) {
-  if (!input || typeof input !== "object") return false;
-  const record = input;
-  const inputPath = record["path"];
-  if (typeof inputPath !== "string") return false;
-  if (!inputPath.endsWith(".md")) return false;
-  try {
-    const resolved = path7.resolve(projectRoot, inputPath);
-    const tempDir = path7.resolve(projectRoot, ".temp_files");
-    if (!resolved.startsWith(tempDir + path7.sep) && resolved !== tempDir) return false;
-    return true;
-  } catch {
-    return false;
-  }
-}
-var ReadOnlyPermissionPolicy = class {
-  constructor(inner, projectRoot) {
-    this.inner = inner;
-    this.projectRoot = projectRoot;
-  }
-  inner;
-  projectRoot;
-  async evaluate(tool, input, ctx) {
-    if (ctx.meta["readOnly"] !== true) {
-      return this.inner.evaluate(tool, input, ctx);
-    }
-    if (!hasMutationCapability(tool)) {
-      return this.inner.evaluate(tool, input, ctx);
-    }
-    if (isAllowedReportFile(input, this.projectRoot)) {
-      return this.inner.evaluate(tool, input, ctx);
-    }
-    const matched = (tool.capabilities ?? []).filter((c) => MUTATION_CAPABILITIES.has(c));
-    const why = matched.length > 0 ? `requires mutation capabilities (${matched.join(", ")})` : "is declared mutating";
-    return {
-      permission: "deny",
-      source: "readonly_mode",
-      reason: `Session is in read-only mode: tool "${tool.name}" ${why}, which is not allowed. Only .md report files under .temp_files/ may be written.`
-    };
-  }
-  async trust(rule) {
-    return this.inner.trust(rule);
-  }
-  async deny(rule) {
-    return this.inner.deny(rule);
-  }
-  denyOnce(rule) {
-    this.inner.denyOnce(rule);
-  }
-  allowOnce(rule) {
-    this.inner.allowOnce(rule);
-  }
-  async reload() {
-    if ("reload" in this.inner && typeof this.inner.reload === "function") {
-      await this.inner.reload();
-    }
-  }
-  async explain(tool, input, ctx) {
-    if (ctx.meta["readOnly"] !== true) {
-      if (this.inner.explain) return this.inner.explain(tool, input, ctx);
-      const decision = await this.inner.evaluate(tool, input, ctx);
-      return {
-        toolName: tool.name,
-        subject: null,
-        steps: [{ rule: "inner", matched: true, decision: decision.permission === "deny" ? "deny" : "auto", source: decision.source, detail: decision.reason ?? "Inner policy decision" }],
-        winnerIndex: 0,
-        decision
-      };
-    }
-    if (!hasMutationCapability(tool) || isAllowedReportFile(input, this.projectRoot)) {
-      if (this.inner.explain) return this.inner.explain(tool, input, ctx);
-      const decision = await this.evaluate(tool, input, ctx);
-      return {
-        toolName: tool.name,
-        subject: null,
-        steps: [{ rule: "readonly_mode", matched: decision.permission === "deny", decision: decision.permission === "deny" ? "deny" : "auto", source: "readonly_mode", detail: decision.reason ?? "Read-only mode" }],
-        winnerIndex: 0,
-        decision
-      };
-    }
-    return {
-      toolName: tool.name,
-      subject: null,
-      steps: [{
-        rule: "readonly_mode",
-        matched: true,
-        decision: "deny",
-        source: "readonly_mode",
-        detail: `Read-only mode blocks ${tool.name} because it carries mutation capabilities (${(tool.capabilities ?? []).filter((c) => MUTATION_CAPABILITIES.has(c)).join(", ")}). Only .md files under .temp_files/ may be written.`
-      }],
-      winnerIndex: 0,
-      decision: {
-        permission: "deny",
-        source: "readonly_mode",
-        reason: `Read-only mode: ${tool.name} requires mutation capabilities.`
-      }
-    };
-  }
-};
-
 // src/security/totp.ts
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
@@ -3572,620 +2112,6 @@ function verifyRecoveryCode(code, storedHashes) {
   return false;
 }
 
-// src/security/secret-vault.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes2, scryptSync } from "node:crypto";
-import * as fs2 from "node:fs";
-import * as fsp from "node:fs/promises";
-import * as path8 from "node:path";
-
-// src/utils/deep-merge.ts
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
-function isPrimitiveArray(a) {
-  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
-}
-function deepMerge(base, patch, options = {}) {
-  const {
-    conflictResolution = "prefer-patch",
-    arrayMode = "replace",
-    protectProto = true,
-    onNonPrimitiveArrayReplace
-  } = options;
-  if (typeof base !== "object" || base === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (typeof patch !== "object" || patch === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) && Array.isArray(patch)) {
-    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
-      return [.../* @__PURE__ */ new Set([...base, ...patch])];
-    }
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) || Array.isArray(patch)) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  const baseObj = base;
-  const patchObj = patch;
-  const out = { ...baseObj };
-  for (const [k, v] of Object.entries(patchObj)) {
-    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v, options);
-    } else if (Array.isArray(v) && Array.isArray(existing)) {
-      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
-        onNonPrimitiveArrayReplace(k, existing.length, v.length);
-      }
-      out[k] = deepMerge(existing, v, options);
-    } else if (v !== void 0) {
-      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
-        const existingLen = Array.isArray(existing) ? existing.length : 0;
-        onNonPrimitiveArrayReplace(k, existingLen, v.length);
-      }
-      out[k] = v;
-    }
-  }
-  return out;
-}
-
-// src/security/secret-vault.ts
-var KEY_BYTES = 32;
-var IV_BYTES = 12;
-var TAG_BYTES = 16;
-var ALGO = "aes-256-gcm";
-var KEY_FILE_MODE = 384;
-var KEY_FILE_MAGIC = Buffer.from("WSKV", "ascii");
-var VERSIONED_KEY_FILE_SIZE = KEY_FILE_MAGIC.length + 1 + KEY_BYTES;
-var KEK_MAGIC = Buffer.from("WSKW", "ascii");
-var KEK_SALT_BYTES = 16;
-var WRAPPED_KEY_FILE_SIZE = KEK_MAGIC.length + 1 + KEK_SALT_BYTES + IV_BYTES + TAG_BYTES + KEY_BYTES;
-var SCRYPT_N = 1 << 15;
-var SCRYPT_R = 8;
-var SCRYPT_P = 1;
-var SCRYPT_MAXMEM = 64 * 1024 * 1024;
-function getVaultPassphrase() {
-  const v = process.env["WRONGSTACK_VAULT_PASSPHRASE"];
-  return v && v.length > 0 ? v : void 0;
-}
-function isWrappedKeyFile(buf) {
-  return buf.length === WRAPPED_KEY_FILE_SIZE && buf.subarray(0, KEK_MAGIC.length).equals(KEK_MAGIC);
-}
-function deriveKEK(passphrase, salt) {
-  return scryptSync(passphrase, salt, KEY_BYTES, {
-    N: SCRYPT_N,
-    r: SCRYPT_R,
-    p: SCRYPT_P,
-    maxmem: SCRYPT_MAXMEM
-  });
-}
-function wrapDataKey(dataKey, keyVersion, passphrase) {
-  const salt = randomBytes2(KEK_SALT_BYTES);
-  const iv = randomBytes2(IV_BYTES);
-  const kek = deriveKEK(passphrase, salt);
-  const cipher = createCipheriv(ALGO, kek, iv);
-  const ct = Buffer.concat([cipher.update(dataKey), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  const out = Buffer.alloc(WRAPPED_KEY_FILE_SIZE);
-  let off = 0;
-  KEK_MAGIC.copy(out, off);
-  off += KEK_MAGIC.length;
-  out[off] = keyVersion & 255;
-  off += 1;
-  salt.copy(out, off);
-  off += KEK_SALT_BYTES;
-  iv.copy(out, off);
-  off += IV_BYTES;
-  tag.copy(out, off);
-  off += TAG_BYTES;
-  ct.copy(out, off);
-  return out;
-}
-function unwrapDataKey(buf, keyFile) {
-  const passphrase = getVaultPassphrase();
-  if (!passphrase) {
-    throw new ConfigError({
-      message: `SecretVault: key file ${keyFile} is passphrase-protected \u2014 set the WRONGSTACK_VAULT_PASSPHRASE environment variable to unlock it.`,
-      code: ERROR_CODES.CONFIG_INVALID,
-      context: { keyFile }
-    });
-  }
-  let off = KEK_MAGIC.length;
-  const version = buf[off];
-  off += 1;
-  const salt = buf.subarray(off, off + KEK_SALT_BYTES);
-  off += KEK_SALT_BYTES;
-  const iv = buf.subarray(off, off + IV_BYTES);
-  off += IV_BYTES;
-  const tag = buf.subarray(off, off + TAG_BYTES);
-  off += TAG_BYTES;
-  const ct = buf.subarray(off, off + KEY_BYTES);
-  const kek = deriveKEK(passphrase, salt);
-  const decipher = createDecipheriv(ALGO, kek, iv);
-  decipher.setAuthTag(tag);
-  try {
-    const key = Buffer.concat([decipher.update(ct), decipher.final()]);
-    return { key: Buffer.from(key), version };
-  } catch {
-    throw new ConfigError({
-      message: `SecretVault: failed to unlock key file ${keyFile} \u2014 wrong WRONGSTACK_VAULT_PASSPHRASE (key unwrap authentication failed).`,
-      code: ERROR_CODES.CONFIG_INVALID,
-      context: { keyFile }
-    });
-  }
-}
-function keyFileNeedsHardening(keyFile, opts) {
-  if (process.platform === "win32") return false;
-  const warn = opts?.warn ?? ((msg) => console.warn(msg));
-  try {
-    const stat = fs2.statSync(keyFile);
-    const actualMode = stat.mode & 511;
-    if (actualMode !== KEY_FILE_MODE) {
-      warn(
-        `Key file ${keyFile} has mode ${actualMode.toString(8)} \u2014 expected ${KEY_FILE_MODE.toString(8)}. Hardening\u2026`
-      );
-      return true;
-    }
-  } catch {
-  }
-  return false;
-}
-function mkdirSecretDirSync(dir) {
-  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
-  if (process.platform === "win32") return;
-  try {
-    fs2.chmodSync(dir, 448);
-  } catch {
-  }
-}
-function writeKeyFileAtomicSync(keyFile, content) {
-  const tmp = `${keyFile}.${randomBytes2(4).toString("hex")}.tmp`;
-  const fd = fs2.openSync(tmp, "w", 384);
-  try {
-    fs2.writeFileSync(fd, content);
-    try {
-      fs2.fsyncSync(fd);
-    } catch {
-    }
-  } finally {
-    fs2.closeSync(fd);
-  }
-  try {
-    fs2.renameSync(tmp, keyFile);
-  } catch (err) {
-    try {
-      fs2.unlinkSync(tmp);
-    } catch {
-    }
-    throw err;
-  }
-}
-var DefaultSecretVault = class {
-  keyFile;
-  logger;
-  key;
-  _keyVersion = 1;
-  /**
-   * Pending key-file hardening promises (Windows ACL restrictions via icacls).
-   * Tracked so async callers can `flushHardening()` before returning, ensuring
-   * a short-lived CLI process does not exit before the hardening resolves.
-   * Sync-only callers (encrypt/decrypt lazy-load) leave these pending —
-   * hardening remains best-effort in that case.
-   */
-  pendingHardening = [];
-  constructor(opts) {
-    this.keyFile = opts.keyFile;
-    this.logger = opts.logger;
-  }
-  /**
-   * Emit a structured warning. Uses the configured Logger when available;
-   * falls back to console.warn(JSON) so warnings are never silently dropped
-   * during early boot.
-   */
-  logWarn(msg, ctx) {
-    if (this.logger) {
-      this.logger.warn(msg, ctx);
-    } else {
-      console.warn(JSON.stringify({ ...ctx, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
-    }
-  }
-  /**
-   * Schedule best-effort key-file hardening and track the promise so async
-   * callers can await it via `flushHardening()` before returning. Rejections
-   * are swallowed here (the helper already warns on failure) so a rejection
-   * can never become an unhandled one.
-   */
-  scheduleKeyHardening() {
-    const p = restrictFilePermissions(this.keyFile, {
-      label: "secret-vault-key",
-      warn: (msg) => this.logWarn(msg)
-    }).catch(() => void 0);
-    this.pendingHardening.push(p);
-  }
-  /** Detect and schedule repair of a pre-existing POSIX key with loose mode bits. */
-  checkKeyFilePermissions() {
-    if (keyFileNeedsHardening(this.keyFile, {
-      warn: (msg) => this.logWarn(msg)
-    })) {
-      this.scheduleKeyHardening();
-    }
-  }
-  /** Flush all pending key-file hardening promises. */
-  flushHardening() {
-    if (this.pendingHardening.length === 0) return Promise.resolve();
-    const all = Promise.all(this.pendingHardening).then(() => void 0);
-    this.pendingHardening = [];
-    return all;
-  }
-  /** Current key version. Starts at 1; incremented by rotateKey(). */
-  get keyVersion() {
-    if (!this.key) this.loadOrCreateKey();
-    return this._keyVersion;
-  }
-  isEncrypted(value) {
-    return typeof value === "string" && ENCRYPTED_PREFIX_PATTERN.test(value);
-  }
-  encrypt(plaintext) {
-    if (this.isEncrypted(plaintext)) return plaintext;
-    const key = this.loadOrCreateKey();
-    const iv = randomBytes2(IV_BYTES);
-    const cipher = createCipheriv(ALGO, key, iv);
-    const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    const prefix = encryptedPrefixForVersion(this._keyVersion);
-    return `${prefix}${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
-  }
-  decrypt(value) {
-    if (!this.isEncrypted(value)) return value;
-    const prefixMatch = value.match(ENCRYPTED_PREFIX_PATTERN);
-    if (!prefixMatch) {
-      throw new ConfigError({
-        message: "SecretVault: malformed encrypted value",
-        code: ERROR_CODES.CONFIG_PARSE_FAILED,
-        context: { field: "encrypted_value" }
-      });
-    }
-    const rest = value.slice(prefixMatch[0].length);
-    const parts = rest.split(":");
-    if (parts.length !== 3) {
-      throw new ConfigError({
-        message: "SecretVault: malformed encrypted value",
-        code: ERROR_CODES.CONFIG_PARSE_FAILED,
-        context: { field: "encrypted_value" }
-      });
-    }
-    const [ivB64, tagB64, ctB64] = parts;
-    const iv = Buffer.from(ivB64, "base64");
-    const tag = Buffer.from(tagB64, "base64");
-    const ct = Buffer.from(ctB64, "base64");
-    if (iv.length !== IV_BYTES)
-      throw new ConfigError({
-        message: "SecretVault: bad IV length",
-        code: ERROR_CODES.CONFIG_PARSE_FAILED,
-        context: { expected: IV_BYTES, actual: iv.length }
-      });
-    if (tag.length !== TAG_BYTES)
-      throw new ConfigError({
-        message: "SecretVault: bad tag length",
-        code: ERROR_CODES.CONFIG_PARSE_FAILED,
-        context: { expected: TAG_BYTES, actual: tag.length }
-      });
-    const key = this.loadOrCreateKey();
-    const decipher = createDecipheriv(ALGO, key, iv);
-    decipher.setAuthTag(tag);
-    const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
-    return pt.toString("utf8");
-  }
-  /**
-   * Generate a new encryption key, write it to disk, and increment the key version.
-   * After rotation, encrypt() emits the new version prefix (e.g. enc:v2:).
-   * The caller must re-encrypt existing config values (see rotateConfigKeys()).
-   */
-  rotateKey() {
-    const oldVersion = this._keyVersion;
-    const newKey = randomBytes2(KEY_BYTES);
-    const newVersion = oldVersion + 1;
-    mkdirSecretDirSync(path8.dirname(this.keyFile));
-    const passphrase = getVaultPassphrase();
-    if (passphrase) {
-      writeKeyFileAtomicSync(this.keyFile, wrapDataKey(newKey, newVersion, passphrase));
-    } else {
-      const keyFileBuf = Buffer.alloc(VERSIONED_KEY_FILE_SIZE);
-      KEY_FILE_MAGIC.copy(keyFileBuf, 0);
-      keyFileBuf[KEY_FILE_MAGIC.length] = newVersion;
-      newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
-      writeKeyFileAtomicSync(this.keyFile, keyFileBuf);
-    }
-    this.scheduleKeyHardening();
-    this.checkKeyFilePermissions();
-    this.key = newKey;
-    this._keyVersion = newVersion;
-    return { oldVersion, newVersion };
-  }
-  /**
-   * If WRONGSTACK_VAULT_PASSPHRASE is set but the key on disk is still stored
-   * unwrapped (legacy v1 / versioned v2), re-write it in passphrase-wrapped (v3)
-   * form. The data key is preserved, so all existing ciphertext keeps
-   * decrypting. Best-effort: a write failure leaves the working unwrapped file
-   * in place and is not fatal to load.
-   */
-  migrateToWrappedIfPassphrase() {
-    const passphrase = getVaultPassphrase();
-    if (!passphrase || !this.key) return;
-    try {
-      writeKeyFileAtomicSync(this.keyFile, wrapDataKey(this.key, this._keyVersion, passphrase));
-      this.scheduleKeyHardening();
-      this.checkKeyFilePermissions();
-    } catch {
-    }
-  }
-  loadOrCreateKey() {
-    if (this.key) return this.key;
-    try {
-      const buf = fs2.readFileSync(this.keyFile);
-      if (isWrappedKeyFile(buf)) {
-        const { key: key2, version } = unwrapDataKey(buf, this.keyFile);
-        this.key = key2;
-        this._keyVersion = version;
-        this.checkKeyFilePermissions();
-        return this.key;
-      }
-      if (buf.length === KEY_BYTES) {
-        this.key = buf;
-        this._keyVersion = 1;
-        this.checkKeyFilePermissions();
-        this.migrateToWrappedIfPassphrase();
-        return this.key;
-      }
-      if (buf.length === VERSIONED_KEY_FILE_SIZE) {
-        const magic = buf.subarray(0, KEY_FILE_MAGIC.length);
-        if (!magic.equals(KEY_FILE_MAGIC)) {
-          throw new ConfigError({
-            message: `SecretVault: key file ${this.keyFile} has invalid magic header`,
-            code: ERROR_CODES.CONFIG_INVALID,
-            context: { keyFile: this.keyFile }
-          });
-        }
-        const version = buf[KEY_FILE_MAGIC.length];
-        const key2 = buf.subarray(KEY_FILE_MAGIC.length + 1);
-        if (key2.length !== KEY_BYTES) {
-          throw new ConfigError({
-            message: `SecretVault: key file ${this.keyFile} has wrong key size (${key2.length} bytes, expected ${KEY_BYTES})`,
-            code: ERROR_CODES.CONFIG_INVALID,
-            context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: key2.length }
-          });
-        }
-        this.key = Buffer.from(key2);
-        this._keyVersion = version;
-        this.checkKeyFilePermissions();
-        this.migrateToWrappedIfPassphrase();
-        return this.key;
-      }
-      throw new ConfigError({
-        message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES} for v1 or ${VERSIONED_KEY_FILE_SIZE} for v2+). Remove it manually to generate a new key.`,
-        code: ERROR_CODES.CONFIG_INVALID,
-        context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
-      });
-    } catch (err) {
-      if (err.code !== "ENOENT") throw err;
-    }
-    mkdirSecretDirSync(path8.dirname(this.keyFile));
-    const key = randomBytes2(KEY_BYTES);
-    const passphrase = getVaultPassphrase();
-    const initialBytes = passphrase ? wrapDataKey(key, 1, passphrase) : key;
-    try {
-      fs2.writeFileSync(this.keyFile, initialBytes, { mode: 384, flag: "wx" });
-      this.scheduleKeyHardening();
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
-      this.scheduleKeyHardening();
-      const buf = fs2.readFileSync(this.keyFile);
-      if (isWrappedKeyFile(buf)) {
-        const { key: winnerKey, version } = unwrapDataKey(buf, this.keyFile);
-        this.key = winnerKey;
-        this._keyVersion = version;
-        this.checkKeyFilePermissions();
-        return this.key;
-      }
-      if (buf.length === KEY_BYTES) {
-        this.key = buf;
-        this._keyVersion = 1;
-        this.checkKeyFilePermissions();
-        return this.key;
-      }
-      if (buf.length === VERSIONED_KEY_FILE_SIZE) {
-        const magic = buf.subarray(0, KEY_FILE_MAGIC.length);
-        if (!magic.equals(KEY_FILE_MAGIC)) {
-          throw new ConfigError({
-            message: `SecretVault: key file ${this.keyFile} has invalid magic header`,
-            code: ERROR_CODES.CONFIG_INVALID,
-            context: { keyFile: this.keyFile }
-          });
-        }
-        const version = buf[KEY_FILE_MAGIC.length];
-        const winnerKey = buf.subarray(KEY_FILE_MAGIC.length + 1);
-        this.key = Buffer.from(winnerKey);
-        this._keyVersion = version;
-        this.checkKeyFilePermissions();
-        return this.key;
-      }
-      throw new ConfigError({
-        message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES} for v1 or ${VERSIONED_KEY_FILE_SIZE} for v2+). Remove it manually to generate a new key.`,
-        code: ERROR_CODES.CONFIG_INVALID,
-        context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
-      });
-    }
-    this.key = key;
-    this._keyVersion = 1;
-    return key;
-  }
-};
-async function rewriteConfigEncrypted(configPath, vault, patch) {
-  let current = {};
-  try {
-    const raw = await fsp.readFile(configPath, "utf8");
-    current = JSON.parse(raw);
-  } catch {
-  }
-  const merged = deepMerge(current, patch ?? {});
-  const encrypted = encryptConfigSecrets(merged, vault);
-  await fsp.mkdir(path8.dirname(configPath), { recursive: true });
-  await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
-  await restrictFilePermissions2(configPath);
-  await vault.flushHardening?.();
-}
-async function migratePlaintextSecrets(configPath, vault, logger) {
-  let raw;
-  try {
-    raw = await fsp.readFile(configPath, "utf8");
-  } catch {
-    return { migrated: 0, file: configPath };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return { migrated: 0, file: configPath };
-  }
-  const counter = { n: 0 };
-  const migrated = walkCount(parsed, vault, counter);
-  if (counter.n === 0) return { migrated: 0, file: configPath };
-  await atomicWrite(configPath, JSON.stringify(migrated, null, 2), { mode: 384 });
-  await restrictFilePermissions2(
-    configPath,
-    logger ? { warn: (msg) => logger.warn(msg) } : void 0
-  );
-  await vault.flushHardening?.();
-  return { migrated: counter.n, file: configPath };
-}
-async function rotateConfigKeys(configPath, vault, logger) {
-  const log = logger?.info ?? (() => {
-  });
-  const warn = logger?.warn ?? ((msg) => console.warn(msg));
-  let raw;
-  try {
-    raw = await fsp.readFile(configPath, "utf8");
-  } catch {
-    const { oldVersion: oldVersion2, newVersion: newVersion2 } = vault.rotateKey();
-    log(
-      `[secret-vault] Key rotated (v${oldVersion2} \u2192 v${newVersion2}) \u2014 no config file to re-encrypt`
-    );
-    await vault.flushHardening?.();
-    return { rotated: 0, oldVersion: oldVersion2, newVersion: newVersion2, file: configPath };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    warn(`[secret-vault] Config file ${configPath} is not valid JSON \u2014 skipping rotation`);
-    return {
-      rotated: 0,
-      oldVersion: vault.keyVersion,
-      newVersion: vault.keyVersion,
-      file: configPath
-    };
-  }
-  const counter = { n: 0, failed: [] };
-  const decrypted = walkDecryptCount(parsed, vault, counter);
-  if (counter.failed.length > 0) {
-    throw new Error(
-      `[secret-vault] Aborting key rotation: ${counter.failed.length} field(s) could not be decrypted with the current key and would be permanently lost on rotation: ${counter.failed.join(", ")}. Restore or remove these fields before rotating.`
-    );
-  }
-  if (counter.n === 0) {
-    const { oldVersion: oldVersion2, newVersion: newVersion2 } = vault.rotateKey();
-    log(
-      `[secret-vault] Key rotated (v${oldVersion2} \u2192 v${newVersion2}) \u2014 no encrypted fields to re-encrypt`
-    );
-    await vault.flushHardening?.();
-    return { rotated: 0, oldVersion: oldVersion2, newVersion: newVersion2, file: configPath };
-  }
-  const { oldVersion, newVersion } = vault.rotateKey();
-  const reencrypted = walkReencrypt(decrypted, vault);
-  await atomicWrite(configPath, JSON.stringify(reencrypted, null, 2), { mode: 384 });
-  await restrictFilePermissions2(configPath, { warn });
-  log(
-    `[secret-vault] Key rotated (v${oldVersion} \u2192 v${newVersion}) \u2014 re-encrypted ${counter.n} field(s)`
-  );
-  await vault.flushHardening?.();
-  return { rotated: counter.n, oldVersion, newVersion, file: configPath };
-}
-function walkDecryptCount(node, vault, counter, pathPrefix = "") {
-  if (node === null || node === void 0) return node;
-  if (typeof node !== "object") return node;
-  if (Array.isArray(node)) {
-    return node.map(
-      (item, i) => walkDecryptCount(item, vault, counter, `${pathPrefix}[${i}]`)
-    );
-  }
-  const out = /* @__PURE__ */ Object.create(null);
-  for (const [k, v] of Object.entries(node)) {
-    const keyPath = pathPrefix ? `${pathPrefix}.${k}` : k;
-    if (typeof v === "string" && vault.isEncrypted(v)) {
-      try {
-        out[k] = vault.decrypt(v);
-        counter.n++;
-      } catch {
-        counter.failed.push(keyPath);
-        out[k] = v;
-      }
-    } else if (typeof v === "object" && v !== null) {
-      out[k] = walkDecryptCount(v, vault, counter, keyPath);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
-}
-function walkReencrypt(node, vault) {
-  if (node === null || node === void 0) return node;
-  if (typeof node !== "object") return node;
-  if (Array.isArray(node)) {
-    return node.map((item) => walkReencrypt(item, vault));
-  }
-  const out = /* @__PURE__ */ Object.create(null);
-  for (const [k, v] of Object.entries(node)) {
-    if (typeof v === "string" && isSecretField(k) && v.length > 0 && !vault.isEncrypted(v)) {
-      out[k] = vault.encrypt(v);
-    } else if (typeof v === "object" && v !== null) {
-      out[k] = walkReencrypt(v, vault);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
-}
-async function restrictFilePermissions2(filePath, opts) {
-  await restrictFilePermissions(filePath, { label: "secret-vault", warn: opts?.warn });
-}
-function walkCount(node, vault, counter) {
-  if (node === null || node === void 0) return node;
-  if (typeof node !== "object") return node;
-  if (Array.isArray(node)) {
-    return node.map((item) => walkCount(item, vault, counter));
-  }
-  const out = /* @__PURE__ */ Object.create(null);
-  for (const [k, v] of Object.entries(node)) {
-    if (typeof v === "string" && isSecretField(k) && !vault.isEncrypted(v) && v.length > 0) {
-      out[k] = vault.encrypt(v);
-      counter.n++;
-    } else if (typeof v === "object" && v !== null) {
-      out[k] = walkCount(v, vault, counter);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
-}
-
 // src/security/trust-boundary.ts
 var TRUST_BOUNDARY_VERSION = 1;
 function createCompatibilityTrustBoundary(options = {}) {
@@ -4256,36 +2182,36 @@ var RESERVED_BYPASS_FIELDS = /* @__PURE__ */ new Set([
   "skipAuthorization",
   "skip_authorization"
 ]);
-function isRecord3(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function addString(issues, value, path9, required = true) {
+function addString(issues, value, path5, required = true) {
   if (typeof value === "string" && value.trim().length > 0) return true;
   if (!required && value === void 0) return false;
-  issues.push({ path: path9, message: "must be a non-empty string" });
+  issues.push({ path: path5, message: "must be a non-empty string" });
   return false;
 }
-function addEnum(issues, value, path9, values) {
+function addEnum(issues, value, path5, values) {
   if (typeof value === "string" && values.has(value)) return true;
-  issues.push({ path: path9, message: `must be one of: ${[...values].join(", ")}` });
+  issues.push({ path: path5, message: `must be one of: ${[...values].join(", ")}` });
   return false;
 }
-function validateAttributes(issues, value, path9) {
-  if (!isRecord3(value)) {
-    issues.push({ path: path9, message: "must be an object" });
+function validateAttributes(issues, value, path5) {
+  if (!isRecord2(value)) {
+    issues.push({ path: path5, message: "must be an object" });
     return false;
   }
   let valid = true;
   for (const [key, item] of Object.entries(value)) {
     if (RESERVED_BYPASS_FIELDS.has(key)) {
       issues.push({
-        path: `${path9}.${key}`,
+        path: `${path5}.${key}`,
         message: "generic authorization bypass fields are forbidden"
       });
       valid = false;
     } else if (item !== null && !["string", "number", "boolean"].includes(typeof item)) {
       issues.push({
-        path: `${path9}.${key}`,
+        path: `${path5}.${key}`,
         message: "must be a string, number, boolean, or null"
       });
       valid = false;
@@ -4293,21 +2219,21 @@ function validateAttributes(issues, value, path9) {
   }
   return valid;
 }
-function validateScope(issues, value, path9) {
-  if (!isRecord3(value)) {
-    issues.push({ path: path9, message: "must be an object" });
+function validateScope(issues, value, path5) {
+  if (!isRecord2(value)) {
+    issues.push({ path: path5, message: "must be an object" });
     return false;
   }
   for (const field of ["projectId", "sessionId", "cwd"]) {
-    if (value[field] !== void 0) addString(issues, value[field], `${path9}.${field}`);
+    if (value[field] !== void 0) addString(issues, value[field], `${path5}.${field}`);
   }
   if (value.constraints !== void 0)
-    validateAttributes(issues, value.constraints, `${path9}.constraints`);
+    validateAttributes(issues, value.constraints, `${path5}.constraints`);
   return true;
 }
 function decodeTrustBoundaryRequest(input) {
   const issues = [];
-  if (!isRecord3(input)) return { ok: false, issues: [{ path: "$", message: "must be an object" }] };
+  if (!isRecord2(input)) return { ok: false, issues: [{ path: "$", message: "must be an object" }] };
   for (const field of RESERVED_BYPASS_FIELDS) {
     if (field in input)
       issues.push({
@@ -4321,14 +2247,14 @@ function decodeTrustBoundaryRequest(input) {
   addEnum(issues, input.surface, "$.surface", SURFACES);
   addString(issues, input.capability, "$.capability");
   addEnum(issues, input.risk, "$.risk", RISKS);
-  if (!isRecord3(input.actor)) issues.push({ path: "$.actor", message: "must be an object" });
+  if (!isRecord2(input.actor)) issues.push({ path: "$.actor", message: "must be an object" });
   else {
     addEnum(issues, input.actor.kind, "$.actor.kind", ACTORS);
     if (input.actor.id !== void 0) addString(issues, input.actor.id, "$.actor.id");
     if (input.actor.sessionId !== void 0)
       addString(issues, input.actor.sessionId, "$.actor.sessionId");
   }
-  if (!isRecord3(input.subject)) issues.push({ path: "$.subject", message: "must be an object" });
+  if (!isRecord2(input.subject)) issues.push({ path: "$.subject", message: "must be an object" });
   else {
     addEnum(issues, input.subject.kind, "$.subject.kind", SUBJECT_KINDS);
     addString(issues, input.subject.id, "$.subject.id");
@@ -4338,7 +2264,7 @@ function decodeTrustBoundaryRequest(input) {
   validateScope(issues, input.scope, "$.scope");
   if (input.metadata !== void 0) validateAttributes(issues, input.metadata, "$.metadata");
   if (input.authContext !== void 0) {
-    if (!isRecord3(input.authContext))
+    if (!isRecord2(input.authContext))
       issues.push({ path: "$.authContext", message: "must be an object" });
     else {
       addEnum(issues, input.authContext.method, "$.authContext.method", AUTH_METHODS);
@@ -4354,7 +2280,7 @@ function decodeTrustBoundaryRequest(input) {
 }
 function decodeTrustBoundaryDecision(input) {
   const issues = [];
-  if (!isRecord3(input)) return { ok: false, issues: [{ path: "$", message: "must be an object" }] };
+  if (!isRecord2(input)) return { ok: false, issues: [{ path: "$", message: "must be an object" }] };
   if (!["allow", "deny", "confirm", "scoped-token"].includes(String(input.kind))) {
     issues.push({ path: "$.kind", message: "must be one of: allow, deny, confirm, scoped-token" });
   }