@wrongstack/core 0.313.0 → 0.316.1

package/dist/security/permission-policy.d.ts

@@ -4,7 +4,7 @@ import type { PermissionDecision, PermissionPolicy, PermissionTrace, TrustPolicy
 import type { Tool } from '../types/tool.js';
 import { type TrustPolicyDiagnostic } from './permission-policy-schema.js';
 export { AutoApprovePermissionPolicy } from './auto-approve-policy.js';
-export { alwaysAllowUnavailableReason, matchesTrust, matchesCommandTrust, hasShellSubject, permissionFingerprint, shellCommandLineFromInput, inputPathLooksSensitive, shellCommandReadsSensitivePath, } from './permission-helpers.js';
+export { alwaysAllowUnavailableReason, inputPathLooksSensitive, matchesTrust, shellCommandLineFromInput, shellCommandReadsSensitivePath } from './permission-helpers.js';
 /**
  * Combine an exact-name trust entry with the wildcard entry that also matched.
  *
@@ -40,6 +40,17 @@ export declare class DefaultPermissionPolicy implements PermissionPolicy {
     private hasAgentStateWriteTarget;
     private yoloBlockedAsDestructive;
     setPromptDelegate(delegate: PermissionPolicyOptions['promptDelegate']): void;
+    /**
+     * YOLO as it applies to ONE conversation.
+     *
+     * `this.yolo` is a process-wide switch, which is right for a CLI or a TUI —
+     * one process, one conversation. A WebUI holds four at once, and YOLO is a
+     * per-tab preference stored on each session's own context meta, so reading
+     * the process switch meant turning YOLO on in one tab auto-approved the
+     * tools of the other three. The instance flag stays as the fallback for
+     * hosts (and tests) that never write the meta key.
+     */
+    private effectiveYolo;
     setYolo(enabled: boolean): void;
     getYolo(): boolean;
     getPolicyDiagnostics(): readonly TrustPolicyDiagnostic[];

package/dist/security/secret-scrubber.d.ts

@@ -10,5 +10,20 @@ export declare class DefaultSecretScrubber implements SecretScrubber {
      * value without a credential anchor returns immediately without regex work.
      */
     scrubObject<T>(obj: T): T;
+    /**
+     * Copy-on-write {@link scrubObject}: clean subtrees come back by reference.
+     *
+     * `scrubObject` rebuilds the entire graph unconditionally — a new object for
+     * every node, a new array for every array — whether or not anything was
+     * redacted. On the read path that is almost all waste: measured over a real
+     * 133 MB journal, 488k nodes and 309k strings were rebuilt so that FOUR
+     * strings could be redacted, costing ~480 ms of allocation and the GC
+     * pressure that comes with it. Rebuilding only the spine above an actual
+     * redaction gives the same output for a fraction of the garbage.
+     *
+     * The sharing is why this is a separate method rather than a change to
+     * `scrubObject`: see the contract note on `SecretScrubber.scrubObjectShared`.
+     */
+    scrubObjectShared<T>(obj: T): T;
 }
 //# sourceMappingURL=secret-scrubber.d.ts.map

package/dist/session-catalog/index.d.ts

@@ -2,5 +2,6 @@ export * from './client.js';
 export * from './endpoint.js';
 export * from './protocol.js';
 export * from './registry.js';
+export * from './session-agents.js';
 export * from './store.js';
 //# sourceMappingURL=index.d.ts.map