@wrongstack/core 0.313.0 → 0.316.1

package/dist/chunk-5YPSXQXM.js

@@ -0,0 +1,1443 @@
+import {
+  decryptConfigSecrets
+} from "./chunk-YY6APYUM.js";
+import {
+  backupConfigFile
+} from "./chunk-ZT7JNIGX.js";
+import {
+  safeParse
+} from "./chunk-W5VITDM2.js";
+import {
+  FORBIDDEN_PROTO_KEYS,
+  deepMerge
+} from "./chunk-B7F4WVP4.js";
+import {
+  atomicWrite,
+  withFileLock
+} from "./chunk-OSGLYW5J.js";
+import {
+  safeProfileName
+} from "./chunk-SAFHACFA.js";
+import {
+  DEFAULT_AUTONOMY_CONFIG,
+  DEFAULT_CIRCUIT_BREAKER_CONFIG,
+  DEFAULT_CONTEXT_CONFIG,
+  DEFAULT_CONTEXT_WINDOW_MODE_ID,
+  DEFAULT_SESSION_LOGGING_CONFIG,
+  DEFAULT_TOOLS_CONFIG,
+  isContextWindowModeSelectionId,
+  listContextWindowModes,
+  normalizeContextWindowModeId
+} from "./chunk-DLHHXUAM.js";
+import {
+  DEFAULT_TUI_THINKING_WORD
+} from "./chunk-KJ2ZTQSL.js";
+import {
+  ConfigError,
+  ERROR_CODES
+} from "./chunk-25LSLC3G.js";
+import {
+  toErrorMessage
+} from "./chunk-TBRL2RCC.js";
+
+// src/storage/config-loader/defaults.ts
+var CONFIG_BEHAVIOR_DEFAULTS = {
+  version: 1,
+  context: {
+    mode: DEFAULT_CONTEXT_WINDOW_MODE_ID,
+    warnThreshold: DEFAULT_CONTEXT_CONFIG.warnThreshold,
+    softThreshold: DEFAULT_CONTEXT_CONFIG.softThreshold,
+    hardThreshold: DEFAULT_CONTEXT_CONFIG.hardThreshold,
+    targetLoad: DEFAULT_CONTEXT_CONFIG.targetLoad,
+    autoCompact: true,
+    preserveK: DEFAULT_CONTEXT_CONFIG.preserveK,
+    eliseThreshold: DEFAULT_CONTEXT_CONFIG.eliseThreshold,
+    strategy: "hybrid"
+  },
+  tools: {
+    defaultExecutionStrategy: DEFAULT_TOOLS_CONFIG.defaultExecutionStrategy,
+    maxIterations: DEFAULT_TOOLS_CONFIG.maxIterations,
+    iterationTimeoutMs: DEFAULT_TOOLS_CONFIG.iterationTimeoutMs,
+    maxToolTimeoutMs: DEFAULT_TOOLS_CONFIG.maxToolTimeoutMs,
+    sessionTimeoutMs: DEFAULT_TOOLS_CONFIG.sessionTimeoutMs,
+    perIterationOutputCapBytes: DEFAULT_TOOLS_CONFIG.perIterationOutputCapBytes,
+    descriptionMode: DEFAULT_TOOLS_CONFIG.descriptionMode,
+    disabledTools: DEFAULT_TOOLS_CONFIG.disabledTools,
+    autoExtendLimit: DEFAULT_TOOLS_CONFIG.autoExtendLimit,
+    restrictToProjectRoot: DEFAULT_TOOLS_CONFIG.restrictToProjectRoot,
+    kanbanGovernance: DEFAULT_TOOLS_CONFIG.kanbanGovernance,
+    loopDetection: DEFAULT_TOOLS_CONFIG.loopDetection,
+    autoThin: { ...DEFAULT_TOOLS_CONFIG.autoThin }
+  },
+  log: { level: "info" },
+  features: {
+    mcp: true,
+    plugins: true,
+    memory: true,
+    modelsRegistry: true,
+    skills: true,
+    prompts: true,
+    // 'auto' → resolveTokenSavingTier picks a concrete tier from the model's
+    // context window ONCE per session (cache-safe): lean prompt on small
+    // windows (<32k medium, <128k light) where the fixed identity+tool prose
+    // is a big fraction; minimal trimming on >=128k so modern large-window
+    // models still get cost savings without capability loss. Explicit tiers
+    // are respected verbatim.
+    tokenSavingMode: "auto",
+    // Derived, never written by hand: this and `tools.restrictToProjectRoot`
+    // (line 41) are the two halves of one switch, and they used to be declared
+    // independently in this same object — one `true`, one `true` — with
+    // session.ts resolving the contradiction via `??` in favour of the
+    // permissive half. The confinement guard therefore shipped disabled on a
+    // fresh install even though the other half asked for it (WS-075).
+    allowOutsideProjectRoot: !DEFAULT_TOOLS_CONFIG.restrictToProjectRoot
+  },
+  Sage: {
+    enabled: true,
+    storage: {
+      projectLocal: true,
+      directory: ".wrongstack/memories"
+    },
+    inject: {
+      // Keep the ordinary turn prompt clean. Project memory is surfaced
+      // on-demand beside relevant tool results, where the path/query that
+      // caused retrieval is known and the hint can be independently capped.
+      turnContext: false,
+      toolResults: true,
+      // Off: task text searches for what the operator is doing, not for the
+      // file the tool touched, and every match it adds is unrelated to the
+      // result it lands on.
+      taskAware: false,
+      maxHintsPerTool: 8,
+      maxCharsPerTool: 2800,
+      maxTurnMemories: 8,
+      maxCharsPerTurn: 2400,
+      minScore: 0.72,
+      minImportance: 0.5,
+      // 0 = once per session. Re-showing a memory the model has already been
+      // given spends context and adds nothing.
+      repeatCooldownMs: 0
+    },
+    hygiene: {
+      autoAfterSession: true,
+      autoOnFileChange: true,
+      retentionDays: 90,
+      archiveLowConfidenceAfterDays: 30
+    },
+    embeddings: {
+      enabled: false
+    }
+  },
+  skills: { readClaudeSkills: true, mode: "progressive" },
+  mcpServers: {},
+  fallbackAuto: true,
+  maxConcurrent: 4,
+  // YOLO opt-in: users who want auto-approve behaviour set `yolo: true`.
+  // Off by default so prompt injection in repository content, fetched
+  // content, or mailbox messages cannot induce arbitrary shell calls or
+  // write operations without human confirmation.
+  yolo: false,
+  nextPrediction: false,
+  hints: true,
+  debugStream: false,
+  configScope: "global",
+  indexing: {
+    onSessionStart: true,
+    onEdit: true,
+    watchExternal: true,
+    debounceMs: 400
+  },
+  session: { ...DEFAULT_SESSION_LOGGING_CONFIG },
+  autonomy: {
+    // 'auto' by default: the agent self-drives (picks the top next-step after
+    // each turn). This is a startup default, not a runtime flip — the
+    // autoProceedMaxIterations cap + autoProceedDelayMs cooldown + Ctrl+C /
+    // [GOAL_COMPLETE] stops remain in force. Explicit 'off'
+    // in a config file is preserved (opt-out respected).
+    defaultMode: "auto",
+    autoProceedDelayMs: DEFAULT_AUTONOMY_CONFIG.autoProceedDelayMs,
+    autoProceedMaxIterations: 50,
+    autonomyNextPrompt: "auto {{suggestion}}",
+    terminalTitleAnimation: true,
+    // Mirrored from the top-level yolo default so the autonomy subsystem
+    // (which reads autonomy.yolo) stays consistent with config.yolo.
+    yolo: false,
+    fleetChatVerbosity: "off",
+    chime: false,
+    confirmExit: true,
+    mouseMode: false,
+    enhance: true,
+    enhanceDelayMs: 6e4,
+    enhanceLanguage: "original",
+    // Product-wide statusline density default. Mirrored by the TUI's
+    // DEFAULT_STATUSLINE_MODE (packages/tui/src/components/settings-picker-model.ts).
+    statuslineMode: "minimum",
+    thinkingWord: DEFAULT_TUI_THINKING_WORD,
+    showAgentSwarmPanel: "bottom"
+  },
+  circuitBreaker: { ...DEFAULT_CIRCUIT_BREAKER_CONFIG },
+  modelRuntime: {
+    // `effort` is intentionally undefined by default. Leaving it unset lets
+    // each model use its provider-recommended reasoning effort (or none at
+    // all) instead of forcing an opinionated value that may be unsupported,
+    // silently omitted, and surfaced as a per-request warning. Users who
+    // want a specific effort can opt in via `/settings` or the WebUI panel.
+    reasoning: { mode: "auto" },
+    cache: { ttl: "1h" }
+  },
+  systemPrompt: { variant: "default" }
+};
+
+// src/storage/config-loader/default-repair.ts
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+}
+function cloneJsonValue(value) {
+  return structuredClone(value);
+}
+function fillMissingDefaults(target, defaults) {
+  const value = cloneJsonValue(target);
+  const changed = fillMissingDefaultsInPlace(value, defaults);
+  return { value, changed };
+}
+function fillMissingDefaultsInPlace(target, defaults) {
+  let changed = false;
+  for (const [key, defaultValue] of Object.entries(defaults)) {
+    if (!Object.hasOwn(target, key)) {
+      target[key] = cloneJsonValue(defaultValue);
+      changed = true;
+      continue;
+    }
+    const current = target[key];
+    if (isPlainRecord(current) && isPlainRecord(defaultValue)) {
+      changed = fillMissingDefaultsInPlace(current, defaultValue) || changed;
+    }
+  }
+  return changed;
+}
+function repairConfigDefaults(input) {
+  const fixed = cloneJsonValue(input);
+  const changes = [];
+  const MAX_REPAIR_DEPTH = 20;
+  const repair = (target, defaults, prefix, depth = 0) => {
+    if (depth > MAX_REPAIR_DEPTH) {
+      throw new ConfigError({
+        message: `Config repair exceeded maximum depth (${MAX_REPAIR_DEPTH}) at "${prefix}". This likely indicates a circular reference or deeply nested user-provided config.`,
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { depth, prefix }
+      });
+    }
+    for (const [key, defaultValue] of Object.entries(defaults)) {
+      const path2 = prefix ? `${prefix}.${key}` : key;
+      if (!Object.hasOwn(target, key)) {
+        target[key] = cloneJsonValue(defaultValue);
+        changes.push({ path: path2, action: "added" });
+        continue;
+      }
+      const current = target[key];
+      if (isPlainRecord(defaultValue)) {
+        if (isPlainRecord(current)) {
+          repair(current, defaultValue, path2, depth + 1);
+        } else {
+          target[key] = cloneJsonValue(defaultValue);
+          changes.push({ path: path2, action: "replaced" });
+        }
+        continue;
+      }
+      const defaultIsArray = Array.isArray(defaultValue);
+      const defaultIsNumber = typeof defaultValue === "number";
+      const compatible = defaultIsArray ? Array.isArray(current) : defaultIsNumber ? typeof current === "number" && Number.isFinite(current) : !Array.isArray(current) && typeof current === typeof defaultValue;
+      if (!compatible) {
+        target[key] = cloneJsonValue(defaultValue);
+        changes.push({ path: path2, action: "replaced" });
+      }
+    }
+  };
+  repair(fixed, CONFIG_BEHAVIOR_DEFAULTS, "");
+  return { fixed, changes, changed: changes.length > 0 };
+}
+
+// src/storage/config-loader.ts
+import * as fs from "node:fs/promises";
+
+// src/storage/config-loader/bootstrap.ts
+var BOOTSTRAP_KEYS = /* @__PURE__ */ new Set(["version", "activeProfile"]);
+function isBootstrapOnly(config) {
+  return Object.keys(config).every((k) => BOOTSTRAP_KEYS.has(k));
+}
+
+// src/storage/config-loader/diagnostics.ts
+function storageErrorString(err) {
+  if (err instanceof Error) {
+    const code = err.code;
+    return code ? `${code}: ${err.message}` : err.message;
+  }
+  return String(err);
+}
+
+// src/storage/config-loader/env-overrides.ts
+function envBool(v) {
+  return !/^(0|false|no|off)$/i.test(v.trim());
+}
+function envBoolOptional(v) {
+  return v !== void 0 && envBool(v);
+}
+var LOG_LEVELS = /* @__PURE__ */ new Set(["error", "warn", "info", "debug", "trace"]);
+function envLogLevel(v) {
+  const norm = v.trim().toLowerCase();
+  return LOG_LEVELS.has(norm) ? norm : "info";
+}
+var defaultIndexing = {
+  onSessionStart: true,
+  onEdit: true,
+  watchExternal: true,
+  debounceMs: 400
+};
+var ENV_MAP = {
+  WRONGSTACK_PROVIDER: (c, v) => {
+    c.provider = v;
+    if (c._envSource === void 0) c._envSource = /* @__PURE__ */ new Set();
+    c._envSource.add("provider");
+  },
+  WRONGSTACK_MODEL: (c, v) => {
+    c.model = v;
+    if (c._envSource === void 0) c._envSource = /* @__PURE__ */ new Set();
+    c._envSource.add("model");
+  },
+  WRONGSTACK_API_KEY: (c, v) => {
+    c.apiKey = v;
+    if (c._envSource === void 0) c._envSource = /* @__PURE__ */ new Set();
+    c._envSource.add("apiKey");
+  },
+  WRONGSTACK_BASE_URL: (c, v) => {
+    c.baseUrl = v;
+    if (c._envSource === void 0) c._envSource = /* @__PURE__ */ new Set();
+    c._envSource.add("baseUrl");
+  },
+  WRONGSTACK_LOG_LEVEL: (c, v) => {
+    if (!c.log) c.log = { level: "info" };
+    c.log.level = envLogLevel(v);
+  },
+  WRONGSTACK_INDEX_ON_START: (c, v) => {
+    c.indexing = { ...defaultIndexing, ...c.indexing, onSessionStart: envBool(v) };
+  },
+  WRONGSTACK_INDEX_ON_EDIT: (c, v) => {
+    c.indexing = { ...defaultIndexing, ...c.indexing, onEdit: envBool(v) };
+  },
+  WRONGSTACK_INDEX_WATCH: (c, v) => {
+    c.indexing = { ...defaultIndexing, ...c.indexing, watchExternal: envBool(v) };
+  }
+};
+
+// src/storage/config-loader/in-project-policy.ts
+var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
+  "version",
+  "model",
+  "cwd",
+  "context",
+  "tools",
+  "features",
+  "Sage",
+  "skills",
+  "autonomy",
+  "indexing",
+  "session",
+  // Journal retention. 'retentionDays' is clamped up to 7 on read precisely so
+  // a repo-committed config cannot flush recent evidence; 0 (auto-purge off)
+  // only ever keeps more.
+  "chronicle",
+  "log",
+  "launch",
+  "nextPrediction",
+  "hints",
+  "debugStream",
+  "configScope",
+  "maxConcurrent",
+  "uiLocale",
+  // Cosmetic only: the TUI owns the canonical preset list and falls back to
+  // 'catppuccin' for an unknown value, so the worst a repo can do is pick a
+  // colour scheme.
+  "themePreset",
+  "fallbackModels",
+  "fallbackBridge",
+  "fallbackProfiles",
+  // The profile SELECTOR. No broader than its siblings: a repo that can write
+  // `fallbackModels` and `fallbackProfiles` already controls the chain outright,
+  // and this one can only name a profile the user already defined.
+  "fallbackProfile",
+  "favoriteModels",
+  "favoriteModelsOnly",
+  "modelAvailabilitySchedule",
+  "fallbackAuto",
+  "fallbackStickiness",
+  // The countdown before the UI auto-accepts the next fallback candidate.
+  // Grants a repo nothing it does not already have: 'fallbackModels' and
+  // 'fallbackProfiles' above already let it choose the candidate itself.
+  "fallbackGateSeconds",
+  "models",
+  "modelMatrix",
+  // Same class as 'modelMatrix' and 'fallbackProfiles' directly above: a tier
+  // only NAMES a profile/provider/model the user already configured, and its
+  // budget fields (maxCostUsd / maxIterations / timeoutMs) can only clamp a
+  // subagent DOWNWARD. No credential or exec surface.
+  "modelTiers",
+  "circuitBreaker",
+  "adaptiveConcurrency",
+  "modelRuntime"
+]);
+var KNOWN_DENIED_IN_PROJECT = [
+  {
+    key: "activeProfile",
+    reason: "Only the trusted root bootstrap may select the active profile."
+  },
+  { key: "provider", reason: "Provider id override; can intercept prompts/responses." },
+  { key: "apiKey", reason: "Overrides user API key; exfiltrates prompts." },
+  { key: "baseUrl", reason: "Redirects provider endpoint; leaks real API key." },
+  { key: "providers", reason: "Per-provider apiKey/baseUrl/oauthConfig; same redirect/exfil." },
+  { key: "mcpServers", reason: "Arbitrary command/args/env spawned at boot (RCE)." },
+  { key: "hooks", reason: "Shell command arrays on lifecycle events (RCE)." },
+  { key: "plugins", reason: "Dynamic npm package load at boot (RCE)." },
+  {
+    key: "pluginManager",
+    reason: "Controls which plugin boot states the LLM may mutate; user-owned trust policy."
+  },
+  { key: "sync", reason: "Carries githubToken credential and target repo." },
+  {
+    key: "cloudSync",
+    reason: "Carries the my.wrongstack.com machine token credential and endpoint URL."
+  },
+  { key: "yolo", reason: "Disables all permission confirmation prompts." },
+  {
+    key: "systemPrompt",
+    reason: "Selects the baseline identity prompt. The 'lite' variant drops whole sections of system.md \u2014 including 'Tool output trust boundary', the passage that tells the agent not to obey instructions found in repo content. A repo-committed config could therefore switch off the very rule that protects the user from that repo."
+  },
+  { key: "extensions", reason: "Per-plugin config can carry command/credential fields." },
+  { key: "hq", reason: "Carries HQ client token credential and endpoint URL." },
+  { key: "acp", reason: "Per-agent ACP command/args/env override \u2192 arbitrary command exec (RCE)." },
+  {
+    key: "fleet",
+    reason: "Fleet supervision knobs: a repo-committed config could enable autonomous subagent spawning/steering/termination and mailbox traffic on the victim machine."
+  },
+  {
+    key: "brain",
+    reason: "Brain decision-layer knobs: a repo-committed config could raise the autonomy risk ceiling, switch the Brain to headless (removing the human tier), or reroute Brain decisions to an attacker-chosen provider/model."
+  },
+  {
+    key: "git",
+    reason: "Carries git.identity (GIT_AUTHOR_*/GIT_COMMITTER_* injection): a repo-committed config could spoof the author identity written into the victim's commit history (impersonation)."
+  },
+  {
+    key: "fallbackMaxLastResortCandidates",
+    reason: "Bounds how many of the user's OTHER configured providers may be swept in as last-resort failover. Setting it to 0 from a repo-committed config would silently strip that depth during an outage. It was already stripped in practice (absent from the allow-list) but was missing from the key registry, so this gate never checked it."
+  }
+];
+var KNOWN_CONFIG_TOP_LEVEL_KEY_LIST = [
+  "version",
+  "activeProfile",
+  "provider",
+  "model",
+  "apiKey",
+  "baseUrl",
+  "maxConcurrent",
+  "uiLocale",
+  "providers",
+  "models",
+  "modelMatrix",
+  "context",
+  "tools",
+  "mcpServers",
+  "fallbackModels",
+  "fallbackBridge",
+  "fallbackProfiles",
+  "fallbackProfile",
+  "favoriteModels",
+  "favoriteModelsOnly",
+  "modelAvailabilitySchedule",
+  "fallbackAuto",
+  "fallbackStickiness",
+  "fallbackMaxLastResortCandidates",
+  "hooks",
+  "plugins",
+  "pluginManager",
+  "log",
+  "features",
+  "Sage",
+  "skills",
+  "yolo",
+  "nextPrediction",
+  "cwd",
+  "autonomy",
+  "hints",
+  "debugStream",
+  "configScope",
+  "indexing",
+  "circuitBreaker",
+  "adaptiveConcurrency",
+  "launch",
+  "session",
+  "modelRuntime",
+  "hq",
+  "sync",
+  "cloudSync",
+  "extensions",
+  "acp",
+  "fleet",
+  "brain",
+  "git",
+  "themePreset",
+  "modelTiers",
+  "fallbackGateSeconds",
+  "chronicle",
+  "systemPrompt"
+];
+var KNOWN_CONFIG_TOP_LEVEL_KEYS = new Set(
+  KNOWN_CONFIG_TOP_LEVEL_KEY_LIST
+);
+var IN_PROJECT_DENIED_PATHS = [
+  {
+    path: "tools.exec.allow",
+    reason: "Extends the exec allow-list; a repo could authorise its own binaries."
+  },
+  { path: "tools.exec.danger", reason: "Weakens the destructive-command banner." },
+  {
+    // The whole subtree, not just the dangerous leaves: a persona's
+    // `instruction` is rendered into the voter SYSTEM prompt, a profile seat
+    // may pin providerId/model, and `defaultProfile` selects which of those
+    // runs when the agent names no profile. Denying the parent leaves no leaf
+    // to reclassify wrongly later.
+    path: "tools.council",
+    reason: "Council tool panel definitions: persona instructions are injected into the voter SYSTEM prompt and profile seats can pin an attacker-chosen providerId/model."
+  },
+  { path: "skills.extraDirs", reason: "Loads skill definitions from repo-chosen directories." },
+  { path: "skills.registryUrl", reason: "Redirects skill installs to a repo-chosen host." },
+  // Deliberately NOT denied: skills.mode and skills.eagerMaxChars. The audit
+  // suggested stripping both, but config-loader-extra.test.ts classifies `mode`
+  // as a safe preference with a stated rationale, and a repo can only use these
+  // to move injection volume in either direction — the trust problem was that
+  // repo-supplied skill bodies were indistinguishable from the user's own, which
+  // the provenance tag in system-prompt-skill-bodies.ts now fixes. Re-classifying
+  // them is a product call.
+  { path: "Sage.storage.directory", reason: "Redirects memory storage outside the profile." },
+  {
+    path: "autonomy.yolo",
+    reason: "Alias for the denied top-level `yolo`, and it wins over the user setting \u2014 a repo-committed config could disable every permission prompt."
+  },
+  {
+    path: "autonomy.defaultMode",
+    reason: "Sets the startup autonomy mode; autonomy is user-owned, never repo-owned."
+  },
+  // Deliberately NOT denied: autonomy.autoProceedDelayMs and
+  // autoProceedMaxIterations. They tune a mode the user has already switched on
+  // rather than granting it, and config-loader-extra.test.ts classifies the
+  // delay as a benign project preference. Re-classifying them is a product call.
+  {
+    path: "launch.autonomy",
+    reason: "Launch-time autonomy mode; same user-owned boundary as autonomy.defaultMode."
+  },
+  {
+    path: "features.allowOutsideProjectRoot",
+    reason: "Short-circuits both the project-root containment check and the symlink realpath check in the file tools."
+  },
+  {
+    path: "tools.restrictToProjectRoot",
+    reason: "The other half of the filesystem confinement switch."
+  },
+  {
+    // Denied for the direction that loosens: the flag defaults to false, so a
+    // repo can only ever use it to turn OFF a gate the user deliberately
+    // enabled. Same class as `tools.restrictToProjectRoot` — a control the
+    // operator owns, not the checked-out repository.
+    path: "tools.kanbanGovernance",
+    reason: "Repo-committed config could disable a Kanban governance gate the operator switched on, letting product mutations run outside any managed card."
+  },
+  {
+    // The whole subtree, not just `enabled`: a repo could ship
+    // `tools.autoThin = { enabled: true, idleDays: 0, minInvocations: 999 }`
+    // and disable every tool the operator wants, on first boot, before any
+    // user-facing dry-run. Same operator-owned class as `tools.exec.allow`.
+    path: "tools.autoThin",
+    reason: "Stats-driven tool auto-thinning is an operator decision: a repo-committed config could disable tools the operator wants by shipping a permissive threshold."
+  },
+  {
+    // The audit-trail parallel of `disabledTools`. A repo could otherwise
+    // downgrade every user disable to `auto-thinned`, hiding operator intent
+    // in `/tool autothin status` and undoing it en masse.
+    path: "tools.disabledToolMeta",
+    reason: "Disabled-tool audit-trail metadata; a repo-committed entry could obscure operator-authored disables as auto-thinned."
+  },
+  {
+    // The bridge spawn path resolves the CLI entry by walking UP from the
+    // project root, so a repo that ships its own `packages/cli/dist/index.js`
+    // gets that file spawned with `process.execPath` on WebUI boot — no
+    // prompt, no banner. Turning the feature on is therefore equivalent to
+    // arbitrary code execution for a hostile checkout, which makes this an
+    // operator-owned switch and never a repo-owned one.
+    // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
+    path: "features.mailboxBridge",
+    reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
+  },
+  {
+    // `plugins` is already denied above, so a repo cannot ADD a plugin. This
+    // closes the other half: a repo could previously ship
+    // `{"features":{"pluginsTrust":false}}` and switch off the integrity gate
+    // for plugins the user had ALREADY installed globally — disarming the
+    // trust-on-first-use pin that exists to catch a supply-chain update
+    // rewriting a plugin's entry file. Same operator-owned class as the
+    // switches above.
+    path: "features.pluginsTrust",
+    reason: "Disables the plugin trust-on-first-use integrity gate, re-trusting changed code in already-installed global plugins."
+  }
+];
+function deleteNestedPath(target, path2) {
+  const segments = path2.split(".");
+  const last = segments[segments.length - 1];
+  if (last === void 0) return false;
+  let cursor = target;
+  const chain = [];
+  for (const segment of segments.slice(0, -1)) {
+    const next = cursor[segment];
+    if (!next || typeof next !== "object" || Array.isArray(next)) return false;
+    chain.push({ parent: cursor, key: segment });
+    cursor = next;
+  }
+  if (!(last in cursor)) return false;
+  const clonedLeaf = { ...cursor };
+  delete clonedLeaf[last];
+  let replacement = clonedLeaf;
+  for (let i = chain.length - 1; i >= 0; i--) {
+    const link = chain[i];
+    if (!link) continue;
+    replacement = { ...link.parent, [link.key]: replacement };
+    if (i === 0) {
+      for (const [k, v] of Object.entries(replacement)) target[k] = v;
+      return true;
+    }
+  }
+  for (const [k, v] of Object.entries(replacement)) target[k] = v;
+  return true;
+}
+function assertInProjectAllowListComplete() {
+  const missingFromBoth = [];
+  for (const key of KNOWN_CONFIG_TOP_LEVEL_KEYS) {
+    if (IN_PROJECT_ALLOWED_KEYS.has(key)) continue;
+    const denied = KNOWN_DENIED_IN_PROJECT.find((d) => d.key === key);
+    if (!denied) missingFromBoth.push(key);
+  }
+  const staleDenials = KNOWN_DENIED_IN_PROJECT.filter(
+    (d) => !KNOWN_CONFIG_TOP_LEVEL_KEYS.has(d.key)
+  ).map((d) => d.key);
+  const duplicate = KNOWN_DENIED_IN_PROJECT.filter((d) => IN_PROJECT_ALLOWED_KEYS.has(d.key)).map(
+    (d) => d.key
+  );
+  const problems = [];
+  if (missingFromBoth.length > 0) {
+    problems.push(
+      `new Config field(s) not classified as allowed or denied for in-project config: ` + missingFromBoth.join(", ") + ". Add each to IN_PROJECT_ALLOWED_KEYS (if safe) or KNOWN_DENIED_IN_PROJECT (with a reason)."
+    );
+  }
+  if (staleDenials.length > 0) {
+    problems.push(
+      `KNOWN_DENIED_IN_PROJECT references keys that no longer exist on Config: ` + staleDenials.join(", ") + ". Remove them or restore the field on Config."
+    );
+  }
+  if (duplicate.length > 0) {
+    problems.push(
+      `field(s) appear in BOTH IN_PROJECT_ALLOWED_KEYS and KNOWN_DENIED_IN_PROJECT: ` + duplicate.join(", ") + ". The allow-list wins at runtime; remove from one of the two."
+    );
+  }
+  const orphanedPaths = IN_PROJECT_DENIED_PATHS.filter(
+    ({ path: path2 }) => !IN_PROJECT_ALLOWED_KEYS.has(path2.split(".")[0] ?? "")
+  ).map(({ path: path2 }) => path2);
+  if (orphanedPaths.length > 0) {
+    problems.push(
+      `IN_PROJECT_DENIED_PATHS entr(ies) whose top-level parent is not allowed: ` + orphanedPaths.join(", ") + ". The parent is already stripped wholesale, so the nested denial is dead \u2014 remove it."
+    );
+  }
+  const malformedPaths = IN_PROJECT_DENIED_PATHS.filter(
+    ({ path: path2 }) => path2.split(".").length < 2 || path2.split(".").some((s) => s.length === 0)
+  ).map(({ path: path2 }) => path2);
+  if (malformedPaths.length > 0) {
+    problems.push(
+      `IN_PROJECT_DENIED_PATHS entr(ies) are not dotted nested paths: ` + malformedPaths.join(", ") + ". Top-level keys belong in KNOWN_DENIED_IN_PROJECT instead."
+    );
+  }
+  if (problems.length > 0) {
+    throw new Error(
+      `stripUnsafeInProjectFields drift check failed:
+  - ${problems.join("\n  - ")}`
+    );
+  }
+}
+var driftChecked = false;
+function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => console.warn(msg)) {
+  if (!driftChecked) {
+    assertInProjectAllowListComplete();
+    driftChecked = true;
+  }
+  const stripped = [];
+  const out = {};
+  for (const [k, v] of Object.entries(inProject)) {
+    if (IN_PROJECT_ALLOWED_KEYS.has(k)) {
+      out[k] = v;
+      continue;
+    }
+    stripped.push(k);
+  }
+  for (const { path: path2 } of IN_PROJECT_DENIED_PATHS) {
+    if (deleteNestedPath(out, path2)) stripped.push(path2);
+  }
+  if (stripped.length > 0) {
+    warn(
+      JSON.stringify({
+        level: "warn",
+        event: "config.in_project_unsafe_fields_ignored",
+        path: sourcePath,
+        ignoredKeys: stripped,
+        message: `Ignored ${stripped.length} field(s) from the repo-committed config "${sourcePath}": ${stripped.join(", ")}. Only a small allow-list of benign preferences (model, context, tools limits, features, \u2026) may be set by <project>/.wrongstack/config.json. Everything else must live in your active profile config.`,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+  }
+  return out;
+}
+
+// src/storage/config-loader/inline-provider-models.ts
+var BOOLEAN_CAPABILITIES = [
+  "tools",
+  "parallelTools",
+  "vision",
+  "streaming",
+  "promptCache",
+  "systemPrompt",
+  "jsonMode",
+  "reasoning",
+  "topK",
+  "frequencyPenalty",
+  "presencePenalty",
+  "seed",
+  "structuredOutput",
+  "logprobs",
+  "audio",
+  "multipleCompletions"
+];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function positiveNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
+}
+function readCapabilities(model) {
+  const raw = isRecord(model["capabilities"]) ? model["capabilities"] : void 0;
+  const capabilities = {};
+  if (raw) {
+    for (const key of BOOLEAN_CAPABILITIES) {
+      const value = raw[key];
+      if (typeof value === "boolean") capabilities[key] = value;
+    }
+    const cacheControl = raw["cacheControl"];
+    if (cacheControl === "native" || cacheControl === "auto" || cacheControl === "none") {
+      capabilities.cacheControl = cacheControl;
+    }
+  }
+  const limit = isRecord(model["limit"]) ? model["limit"] : void 0;
+  const maxContext = positiveNumber(raw?.["maxContext"]) ?? positiveNumber(model["maxContext"]) ?? positiveNumber(model["contextWindow"]) ?? positiveNumber(limit?.["context"]);
+  if (maxContext !== void 0) capabilities.maxContext = maxContext;
+  const capabilityMaxOutput = positiveNumber(raw?.["maxOutput"]);
+  if (capabilityMaxOutput !== void 0) capabilities.maxOutput = capabilityMaxOutput;
+  if (typeof model["tool_call"] === "boolean" && capabilities.tools === void 0) {
+    capabilities.tools = model["tool_call"];
+  }
+  if (typeof model["reasoning"] === "boolean" && capabilities.reasoning === void 0) {
+    capabilities.reasoning = model["reasoning"];
+  }
+  const modalities = isRecord(model["modalities"]) ? model["modalities"] : void 0;
+  const inputModalities = modalities?.["input"];
+  if (Array.isArray(inputModalities) && capabilities.vision === void 0) {
+    capabilities.vision = inputModalities.includes("image");
+  }
+  return Object.keys(capabilities).length > 0 ? capabilities : void 0;
+}
+function inlineDefinition(model) {
+  const definition = {};
+  const name = model["name"];
+  if (typeof name === "string" && name.trim().length > 0) definition.name = name;
+  const provider = model["provider"];
+  if (typeof provider === "string" && provider.trim().length > 0) {
+    definition.provider = provider;
+  }
+  const limit = isRecord(model["limit"]) ? model["limit"] : void 0;
+  const maxOutput = positiveNumber(model["maxOutput"]) ?? positiveNumber(limit?.["output"]) ?? positiveNumber(
+    isRecord(model["capabilities"]) ? model["capabilities"]["maxOutput"] : void 0
+  );
+  if (maxOutput !== void 0) definition.maxOutput = maxOutput;
+  const capabilities = readCapabilities(model);
+  if (capabilities) definition.capabilities = capabilities;
+  const { id: _id, ...rest } = model;
+  if (Object.keys(rest).length > 0) {
+    definition.modelsDev = rest;
+  }
+  return definition;
+}
+function mergeDefinitions(base, patch) {
+  const mergedModelsDev = (() => {
+    if (!base?.modelsDev && !patch.modelsDev) return void 0;
+    const baseMd = base?.modelsDev ?? {};
+    const patchMd = patch.modelsDev ?? {};
+    const result = { ...baseMd, ...patchMd };
+    for (const nestedKey of ["limit", "cost", "modalities"]) {
+      const bn = baseMd?.[nestedKey];
+      const pn = patchMd?.[nestedKey];
+      if (bn || pn) {
+        result[nestedKey] = { ...bn ?? {}, ...pn ?? {} };
+      }
+    }
+    return result;
+  })();
+  return {
+    ...base,
+    ...patch,
+    ...base?.capabilities || patch.capabilities ? { capabilities: { ...base?.capabilities, ...patch.capabilities } } : {},
+    ...mergedModelsDev ? { modelsDev: mergedModelsDev } : {}
+  };
+}
+function normalizeInlineProviderModels(config, warn) {
+  const providers = config["providers"];
+  if (!isRecord(providers)) return;
+  for (const [providerId, rawProvider] of Object.entries(providers)) {
+    if (!isRecord(rawProvider) || !Array.isArray(rawProvider["models"])) continue;
+    const ids = [];
+    const seen = /* @__PURE__ */ new Set();
+    const derived = /* @__PURE__ */ new Map();
+    for (const [index, entry] of rawProvider["models"].entries()) {
+      let id;
+      let definition;
+      if (typeof entry === "string" && entry.length > 0) {
+        id = entry;
+      } else if (isRecord(entry)) {
+        const rawId = entry["id"];
+        if (typeof rawId === "string" && rawId.trim().length > 0) {
+          id = rawId.trim();
+          if (!FORBIDDEN_PROTO_KEYS.has(id)) definition = inlineDefinition(entry);
+        }
+      }
+      if (!id || FORBIDDEN_PROTO_KEYS.has(id)) {
+        warn?.("Ignoring invalid inline provider model entry", {
+          event: "config.invalid_inline_provider_model",
+          provider: providerId,
+          index
+        });
+        continue;
+      }
+      if (!seen.has(id)) {
+        seen.add(id);
+        ids.push(id);
+      }
+      if (definition) derived.set(id, mergeDefinitions(derived.get(id), definition));
+    }
+    rawProvider["models"] = ids;
+    if (derived.size === 0) continue;
+    const explicit = isRecord(rawProvider["customModels"]) ? rawProvider["customModels"] : void 0;
+    const normalized = /* @__PURE__ */ Object.create(null);
+    for (const [id, definition] of derived) normalized[id] = definition;
+    if (explicit) {
+      for (const [id, value] of Object.entries(explicit)) {
+        if (FORBIDDEN_PROTO_KEYS.has(id) || !isRecord(value)) continue;
+        normalized[id] = mergeDefinitions(normalized[id], value);
+      }
+    }
+    rawProvider["customModels"] = normalized;
+  }
+}
+
+// src/storage/config-loader/legacy-sage-migration.ts
+function migrateLegacySuperMemoryKey(config) {
+  const legacy = config["superMemory"];
+  if (legacy === void 0) return false;
+  if (isPlainRecord(legacy)) {
+    const current = config["Sage"];
+    config["Sage"] = isPlainRecord(current) ? { ...legacy, ...current } : { ...legacy };
+  }
+  delete config["superMemory"];
+  return true;
+}
+function removeLegacySageEngine(config) {
+  const migratedKey = migrateLegacySuperMemoryKey(config);
+  const Sage = config["Sage"];
+  if (!isPlainRecord(Sage)) return migratedKey;
+  const storage = Sage["storage"];
+  if (!isPlainRecord(storage) || !Object.hasOwn(storage, "engine")) {
+    return migratedKey;
+  }
+  delete storage["engine"];
+  return true;
+}
+
+// src/storage/config-loader/path-identity.ts
+import * as path from "node:path";
+function samePath(a, b) {
+  let ra = path.resolve(a);
+  let rb = path.resolve(b);
+  if (process.platform === "win32" || process.platform === "darwin") {
+    ra = ra.toLowerCase();
+    rb = rb.toLowerCase();
+  }
+  return ra === rb;
+}
+
+// src/storage/config-loader.ts
+function deepMerge2(base, patch) {
+  const opts = { arrayMode: "concat-primitives" };
+  if (envBoolOptional(process.env.WRONGSTACK_DEBUG_CONFIG)) {
+    opts.onNonPrimitiveArrayReplace = (key, existingLen, patchLen) => {
+      console.warn(
+        `[config] Non-primitive array for "${key}" replaced (global + local config merge). Global entries: ${existingLen}, local entries: ${patchLen}.`
+      );
+    };
+  }
+  return deepMerge(
+    base,
+    patch,
+    opts
+  );
+}
+var DefaultConfigLoader = class _DefaultConfigLoader {
+  paths;
+  strict;
+  vault;
+  extraSources;
+  events;
+  traceId;
+  logger;
+  jsonCache = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.paths = opts.paths;
+    this.strict = opts.strict ?? false;
+    this.vault = opts.vault;
+    this.extraSources = opts.sources ?? [];
+    this.events = opts.events;
+    this.traceId = opts.traceId;
+    this.logger = opts.logger;
+  }
+  /**
+   * Emit a structured warning. Uses the configured Logger when available;
+   * falls back to console.warn(JSON) so warnings are never silently dropped
+   * during early boot (before a Logger is constructed).
+   */
+  logWarn(msg, ctx) {
+    if (this.logger) {
+      this.logger.warn(msg, ctx);
+    } else {
+      console.warn(JSON.stringify({ ...ctx, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+    }
+  }
+  async load(opts = {}) {
+    let cfg = { ...CONFIG_BEHAVIOR_DEFAULTS };
+    await this.ensureGlobalDefaults();
+    const inProjectCollides = samePath(this.paths.inProjectConfig, this.paths.globalConfig) || samePath(this.paths.inProjectConfig, this.paths.projectLocalConfig);
+    const [bootstrap, local, inProject] = await Promise.all([
+      this.readJson(this.paths.globalConfig),
+      this.readJson(this.paths.projectLocalConfig),
+      inProjectCollides ? Promise.resolve({}) : this.readJson(this.paths.inProjectConfig)
+    ]);
+    const bootstrapMetadata = {
+      ...typeof bootstrap.version === "number" ? { version: bootstrap.version } : {},
+      ...typeof bootstrap.activeProfile === "string" ? { activeProfile: safeProfileName(bootstrap.activeProfile) } : {}
+    };
+    cfg = deepMerge2(cfg, bootstrapMetadata);
+    const profileName = safeProfileName(
+      bootstrap.activeProfile
+    );
+    const profileCfg = await this.readJson(this.paths.profileConfig(profileName));
+    if (Object.keys(profileCfg).length > 0) {
+      const profileSettings = { ...profileCfg };
+      delete profileSettings["version"];
+      delete profileSettings["activeProfile"];
+      cfg = deepMerge2(cfg, profileSettings);
+    }
+    const localSettings = { ...local };
+    delete localSettings["version"];
+    delete localSettings["activeProfile"];
+    cfg = deepMerge2(cfg, localSettings);
+    cfg = deepMerge2(
+      cfg,
+      stripUnsafeInProjectFields(
+        inProject,
+        this.paths.inProjectConfig,
+        this.logger ? (msg) => this.logger.warn(msg) : void 0
+      )
+    );
+    for (const [key, fn] of Object.entries(ENV_MAP)) {
+      const v = process.env[key];
+      if (v) fn(cfg, v);
+    }
+    const sorted = [...this.extraSources].sort((a, b) => {
+      const pd = (a.priority ?? 50) - (b.priority ?? 50);
+      if (pd !== 0) return pd;
+      return a.name.localeCompare(b.name);
+    });
+    for (const src of sorted) {
+      try {
+        const patch = await src.read();
+        if (patch && Object.keys(patch).length > 0) {
+          cfg = deepMerge2(cfg, patch);
+        }
+      } catch (err) {
+        this.logWarn("Config source load failed", {
+          event: "config.source_load_failed",
+          source: src.name,
+          message: toErrorMessage(err)
+        });
+      }
+    }
+    if (opts.cliFlags) {
+      cfg = deepMerge2(cfg, opts.cliFlags);
+    }
+    normalizeInlineProviderModels(
+      cfg,
+      (message, context) => this.logWarn(message, context)
+    );
+    if (this.vault) {
+      cfg = decryptConfigSecrets(cfg, this.vault);
+    }
+    if (cfg.providers) {
+      for (const pcfg of Object.values(cfg.providers)) {
+        if (!pcfg || typeof pcfg !== "object") continue;
+        const rawKeys = pcfg.apiKeys;
+        if (!Array.isArray(rawKeys) || rawKeys.length === 0) continue;
+        const keys = rawKeys.filter(
+          (k) => !!k && typeof k === "object" && typeof k.label === "string" && typeof k.apiKey === "string"
+        );
+        if (keys.length === 0) continue;
+        const existing = pcfg.apiKey;
+        if (existing && existing.length > 0) continue;
+        const activeLabel = pcfg.activeKey;
+        const chosen = activeLabel ? keys.find((k) => k.label === activeLabel) ?? keys[0] : keys[0];
+        if (chosen?.apiKey) {
+          pcfg.apiKey = chosen.apiKey;
+        }
+      }
+    }
+    removeLegacySageEngine(cfg);
+    this.validateBehavior(cfg);
+    if (this.strict && !opts.skipIdentityValidation) {
+      this.validateIdentity(cfg);
+    }
+    return Object.freeze(cfg);
+  }
+  /** Check whether a config object contains only the two bootstrap keys. */
+  static isBootstrapOnly(config) {
+    return isBootstrapOnly(config);
+  }
+  async ensureGlobalDefaults() {
+    const fp = this.paths.globalConfig;
+    const t0 = Date.now();
+    try {
+      await withFileLock(fp, async () => {
+        let parsed;
+        let fileExisted = true;
+        try {
+          const raw = await fs.readFile(fp, "utf8");
+          const result = safeParse(raw);
+          if (!result.ok || !isPlainRecord(result.value)) {
+            return;
+          }
+          parsed = result.value;
+        } catch (err) {
+          if (err.code !== "ENOENT") {
+            this.events?.emit("storage.error", {
+              sessionId: "~config~",
+              store: "config",
+              filePath: fp,
+              operation: "ensure_defaults",
+              outcome: "failure",
+              error: storageErrorString(err),
+              recoverable: false,
+              durationMs: Date.now() - t0,
+              ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+            });
+            this.logWarn("Config defaults read failed", {
+              event: "config.defaults_read_failed",
+              path: fp,
+              message: toErrorMessage(err)
+            });
+            return;
+          }
+          fileExisted = false;
+          parsed = {};
+        }
+        if (parsed["version"] !== void 0 && parsed["version"] !== 1) return;
+        const rawProfileName = parsed.activeProfile;
+        const profileName = safeProfileName(rawProfileName);
+        const profileFp = this.paths.profileConfig(profileName);
+        await this.ensureProfileConfig(profileFp, parsed, fileExisted);
+        const bootstrap = {
+          version: 1,
+          activeProfile: profileName
+        };
+        let needsBootstrapWrite = false;
+        if (parsed.version !== 1) {
+          needsBootstrapWrite = true;
+        }
+        if (parsed.activeProfile === void 0 || parsed.activeProfile !== profileName) {
+          needsBootstrapWrite = true;
+        }
+        if (!_DefaultConfigLoader.isBootstrapOnly(parsed)) {
+          needsBootstrapWrite = true;
+        }
+        if (needsBootstrapWrite) {
+          await backupConfigFile(fp, this.paths);
+          await atomicWrite(fp, JSON.stringify(bootstrap, null, 2), { mode: 384 });
+          this.events?.emit("storage.write", {
+            sessionId: "~config~",
+            store: "config",
+            filePath: fp,
+            operation: "ensure_defaults",
+            outcome: "success",
+            durationMs: Date.now() - t0,
+            ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+          });
+        }
+      });
+    } catch (err) {
+      this.events?.emit("storage.error", {
+        sessionId: "~config~",
+        store: "config",
+        filePath: fp,
+        operation: "ensure_defaults",
+        outcome: "failure",
+        error: storageErrorString(err),
+        recoverable: false,
+        durationMs: Date.now() - t0,
+        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+      });
+      this.logWarn("Config defaults write failed", {
+        event: "config.defaults_write_failed",
+        path: fp,
+        message: toErrorMessage(err)
+      });
+    }
+  }
+  /**
+   * Ensure a profile config file exists at the given path.
+   * On first boot: migrate content from the old flat global config, or seed
+   * with behavior defaults. Subsequent boots: fill any missing keys from
+   * CONFIG_BEHAVIOR_DEFAULTS (keeping user settings intact).
+   *
+   * Once a profile file exists, settings found in the root bootstrap are
+   * ignored. This prevents stale or accidentally-written root values from
+   * becoming a hidden settings source alongside profiles.
+   */
+  async ensureProfileConfig(profileFp, oldGlobalParsed, oldFileExisted) {
+    const t0 = Date.now();
+    let parsed;
+    let existed = true;
+    try {
+      const raw = await fs.readFile(profileFp, "utf8");
+      const result = safeParse(raw);
+      if (!result.ok || !isPlainRecord(result.value)) {
+        this.logWarn("Profile config parse failed \u2014 falling back to defaults", {
+          event: "config.profile_parse_failed",
+          path: profileFp
+        });
+        parsed = {};
+      } else {
+        parsed = result.value;
+      }
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        this.logWarn("Profile config read failed", {
+          event: "config.profile_read_failed",
+          path: profileFp,
+          message: toErrorMessage(err)
+        });
+        return;
+      }
+      existed = false;
+      parsed = {};
+    }
+    const removedLegacyEngine = removeLegacySageEngine(parsed);
+    let seed;
+    if (!existed && oldFileExisted && Object.keys(oldGlobalParsed).length >= 1) {
+      seed = { ...oldGlobalParsed };
+      delete seed["activeProfile"];
+      removeLegacySageEngine(seed);
+      const filled = fillMissingDefaults(seed, CONFIG_BEHAVIOR_DEFAULTS);
+      seed = filled.value;
+    } else {
+      const filled = fillMissingDefaults(
+        parsed,
+        CONFIG_BEHAVIOR_DEFAULTS
+      );
+      if (!filled.changed && !removedLegacyEngine) return;
+      seed = filled.value;
+    }
+    await backupConfigFile(profileFp, this.paths);
+    await atomicWrite(profileFp, JSON.stringify(seed, null, 2), { mode: 384 });
+    this.events?.emit("storage.write", {
+      sessionId: "~config~",
+      store: "config",
+      filePath: profileFp,
+      operation: "ensure_profile_defaults",
+      outcome: "success",
+      durationMs: Date.now() - t0,
+      ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+    });
+  }
+  /**
+   * Persist sync config to the active profile's sync.json, with the token encrypted
+   * by the vault (if provided). The file is isolated from the main config
+   * hierarchy to prevent accidental commits.
+   */
+  async persistSyncConfig(cfg) {
+    let toWrite = { ...cfg };
+    if (this.vault && toWrite.githubToken && !toWrite.githubToken.startsWith("enc:")) {
+      toWrite = { ...toWrite, githubToken: this.vault.encrypt(toWrite.githubToken) };
+    }
+    const fp = this.paths.syncConfig;
+    const t0 = Date.now();
+    try {
+      await atomicWrite(fp, JSON.stringify(toWrite, null, 2), { mode: 384 });
+      this.events?.emit("storage.write", {
+        sessionId: "~config~",
+        store: "config",
+        filePath: fp,
+        operation: "persist_sync",
+        outcome: "success",
+        durationMs: Date.now() - t0,
+        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+      });
+    } catch (err) {
+      this.events?.emit("storage.error", {
+        sessionId: "~config~",
+        store: "config",
+        filePath: fp,
+        operation: "persist_sync",
+        outcome: "failure",
+        error: storageErrorString(err),
+        recoverable: false,
+        durationMs: Date.now() - t0,
+        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+      });
+      throw err;
+    }
+  }
+  /**
+   * Read the active profile's sync.json (encrypted GitHub token storage) and decrypt
+   * the token if a vault is available. Returns null if the file doesn't exist.
+   * This is separate from main config loading because sync.json is intentionally
+   * isolated — it should never be part of project-local or env-driven config.
+   */
+  async loadSyncConfig() {
+    const fp = this.paths.syncConfig;
+    const t0 = Date.now();
+    try {
+      const raw = await fs.readFile(fp, "utf8");
+      const parsed = safeParse(raw);
+      if (!parsed.ok || !parsed.value) {
+        this.events?.emit("storage.read", {
+          sessionId: "~config~",
+          store: "config",
+          filePath: fp,
+          operation: "load_sync",
+          outcome: "failure",
+          durationMs: Date.now() - t0,
+          error: "parse error or empty file",
+          ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+        });
+        return null;
+      }
+      if (this.vault) {
+        const decrypted = decryptConfigSecrets({ sync: parsed.value }, this.vault);
+        const result = decrypted.sync ?? null;
+        this.events?.emit("storage.read", {
+          sessionId: "~config~",
+          store: "config",
+          filePath: fp,
+          operation: "load_sync",
+          outcome: "success",
+          durationMs: Date.now() - t0,
+          ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+        });
+        return result;
+      }
+      this.events?.emit("storage.read", {
+        sessionId: "~config~",
+        store: "config",
+        filePath: fp,
+        operation: "load_sync",
+        outcome: "success",
+        durationMs: Date.now() - t0,
+        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+      });
+      return parsed.value;
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      this.events?.emit("storage.read", {
+        sessionId: "~config~",
+        store: "config",
+        filePath: fp,
+        operation: "load_sync",
+        outcome: "failure",
+        durationMs: Date.now() - t0,
+        error: storageErrorString(err),
+        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+      });
+      this.logWarn("Config sync load failed", {
+        event: "config.sync_load_failed",
+        message: toErrorMessage(err)
+      });
+      return null;
+    }
+  }
+  async readJson(file) {
+    const t0 = Date.now();
+    let mtimeMs = null;
+    try {
+      const stat2 = await fs.stat(file);
+      mtimeMs = stat2.mtimeMs;
+      const cached = this.jsonCache.get(file);
+      if (cached && cached.mtimeMs === mtimeMs) {
+        return structuredClone(cached.value);
+      }
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        this.jsonCache.set(file, { mtimeMs: null, value: {} });
+        return {};
+      }
+      this.events?.emit("storage.read", {
+        sessionId: "~config~",
+        store: "config",
+        filePath: file,
+        operation: "read_json",
+        outcome: "failure",
+        durationMs: Date.now() - t0,
+        error: storageErrorString(err),
+        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+      });
+      this.logWarn("Config read failed (stat)", {
+        event: "config.read_failed",
+        path: file,
+        message: toErrorMessage(err)
+      });
+      return {};
+    }
+    let raw;
+    try {
+      raw = await fs.readFile(file, "utf8");
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        this.events?.emit("storage.read", {
+          sessionId: "~config~",
+          store: "config",
+          filePath: file,
+          operation: "read_json",
+          outcome: "failure",
+          durationMs: Date.now() - t0,
+          error: storageErrorString(err),
+          ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+        });
+        this.logWarn("Config read failed (read)", {
+          event: "config.read_failed",
+          path: file,
+          message: toErrorMessage(err)
+        });
+      }
+      this.jsonCache.set(file, { mtimeMs: null, value: {} });
+      return {};
+    }
+    const parsed = safeParse(raw);
+    if (!parsed.ok || !parsed.value) {
+      this.events?.emit("storage.read", {
+        sessionId: "~config~",
+        store: "config",
+        filePath: file,
+        operation: "read_json",
+        outcome: "failure",
+        durationMs: Date.now() - t0,
+        error: "parse error or empty file",
+        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+      });
+      this.logWarn("Config parse failed \u2014 falling back to defaults", {
+        event: "config.parse_failed",
+        path: file
+      });
+      return {};
+    }
+    migrateLegacySuperMemoryKey(parsed.value);
+    this.jsonCache.set(file, { mtimeMs, value: structuredClone(parsed.value) });
+    return parsed.value;
+  }
+  validateBehavior(cfg) {
+    if (cfg.version === void 0)
+      throw new ConfigError({
+        message: "Config: missing version field",
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { field: "version" }
+      });
+    if (cfg.version !== 1)
+      throw new ConfigError({
+        message: `Config: unsupported version ${cfg.version}`,
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { field: "version", actual: cfg.version }
+      });
+    const c = cfg.context;
+    if (!c)
+      throw new ConfigError({
+        message: "Config: missing context section",
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { field: "context" }
+      });
+    const fields = ["warnThreshold", "softThreshold", "hardThreshold"];
+    for (const f of fields) {
+      const v = c[f];
+      if (typeof v !== "number" || !Number.isFinite(v)) {
+        throw new ConfigError({
+          message: `Config: context.${String(f)} must be a finite number (got ${typeof v})`,
+          code: ERROR_CODES.CONFIG_INVALID,
+          context: { field: `context.${String(f)}`, actualType: typeof v }
+        });
+      }
+    }
+    if (c.warnThreshold >= c.softThreshold || c.softThreshold >= c.hardThreshold) {
+      throw new ConfigError({
+        message: "Config: context thresholds must satisfy warn < soft < hard",
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { warn: c.warnThreshold, soft: c.softThreshold, hard: c.hardThreshold }
+      });
+    }
+    if (c.mode !== void 0 && !isContextWindowModeSelectionId(c.mode)) {
+      const known = listContextWindowModes().map((m) => m.id).join(", ");
+      this.logWarn(
+        `Ignoring unknown context.mode "${c.mode}" \u2014 falling back to "${DEFAULT_CONTEXT_WINDOW_MODE_ID}"`,
+        { event: "config.unknown_context_mode", mode: c.mode, known }
+      );
+      c.mode = DEFAULT_CONTEXT_WINDOW_MODE_ID;
+    } else if (c.mode !== void 0) {
+      c.mode = normalizeContextWindowModeId(c.mode) ?? DEFAULT_CONTEXT_WINDOW_MODE_ID;
+    }
+  }
+  validateIdentity(cfg) {
+    if (!cfg.provider) {
+      throw new ConfigError({
+        message: "Config: no provider configured. Run `wstack init` or set WRONGSTACK_PROVIDER.",
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { field: "provider" }
+      });
+    }
+    if (!cfg.model) {
+      throw new ConfigError({
+        message: "Config: no model configured. Run `wstack init` or set WRONGSTACK_MODEL.",
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { field: "model" }
+      });
+    }
+  }
+};
+
+export {
+  CONFIG_BEHAVIOR_DEFAULTS,
+  repairConfigDefaults,
+  normalizeInlineProviderModels,
+  DefaultConfigLoader
+};
+//# sourceMappingURL=chunk-5YPSXQXM.js.map