@wrongstack/core 0.313.0 → 0.316.1

package/dist/chunk-O37BQ65S.js

@@ -0,0 +1,21 @@
+// src/types/blocks.ts
+function isTextBlock(b) {
+  return b.type === "text";
+}
+function isToolUseBlock(b) {
+  return b.type === "tool_use";
+}
+function isToolResultBlock(b) {
+  return b.type === "tool_result";
+}
+function isImageBlock(b) {
+  return b.type === "image";
+}
+
+export {
+  isTextBlock,
+  isToolUseBlock,
+  isToolResultBlock,
+  isImageBlock
+};
+//# sourceMappingURL=chunk-O37BQ65S.js.map

package/dist/chunk-OOYZPOXM.js

@@ -0,0 +1,308 @@
+// src/security/kanban-governance-port.ts
+var notWired = () => {
+  throw new Error(
+    "KanbanGovernancePort is not wired \u2014 register the implementation at the CLI composition root (see setKanbanGovernance)."
+  );
+};
+var port;
+function setKanbanGovernance(impl) {
+  port = impl;
+}
+function kanbanGovernance() {
+  return port ?? notWired();
+}
+
+// src/security/kanban-boundary.ts
+import { realpath } from "node:fs/promises";
+import * as path from "node:path";
+var GOVERNANCE_CONTROL_TOOLS = /* @__PURE__ */ new Set(["kanban", "plan", "task", "todo", "nextsteps"]);
+var PATH_KEYS = /* @__PURE__ */ new Set([
+  "path",
+  "paths",
+  "file",
+  "files",
+  "directory",
+  "dir",
+  "cwd",
+  "root",
+  "baseDir",
+  "out",
+  "outputPath",
+  "sourcePath",
+  "targetPath",
+  "destinationPath",
+  "fromPath",
+  "toPath",
+  "worktreePath"
+]);
+var TOOL_PATH_KEYS = {
+  // `target` is an identifier in tools such as plan/task/document, but a
+  // filesystem target in language_info. Keep ambiguous names tool-specific.
+  language_info: ["target"]
+};
+async function evaluateToolKanbanBoundary(tool, input, ctx, options = {}) {
+  if (tool.name === "kanban") return { decision: "allow" };
+  const identity = resolveKanbanIdentity(ctx);
+  const governanceRequired = options.requireGovernance && isGovernedMutation(tool, input);
+  if (!identity.boardId) {
+    return governanceRequired ? {
+      decision: "block",
+      reason: "Kanban governance is mandatory before product mutation. Create a managed card, add its required details and executable acceptance criteria, then call kanban start_task to bind it to this run."
+    } : { decision: "allow" };
+  }
+  const board = await kanbanGovernance().readBoard(
+    identity.policyRoot ?? ctx.projectRoot,
+    identity.boardId
+  );
+  if (!board) {
+    return governanceRequired ? {
+      decision: "block",
+      reason: `Active Kanban board not found: ${identity.boardId}. Recreate or select a valid managed card before mutation.`,
+      boardId: identity.boardId,
+      ...identity.taskId ? { taskId: identity.taskId } : {}
+    } : { decision: "allow" };
+  }
+  const task = identity.taskId ? board.tasks.find((candidate) => candidate.id === identity.taskId) : void 0;
+  if (governanceRequired && board.lifecycle?.mode === "managed") {
+    if (!identity.taskId) {
+      return {
+        decision: "block",
+        reason: "Kanban governance requires an active task, not only a board. Complete the card details and call kanban start_task before mutation.",
+        boardId: board.id
+      };
+    }
+    if (!task) {
+      return {
+        decision: "block",
+        reason: `Active Kanban task not found: ${identity.taskId}. Call kanban start_task with a valid card.`,
+        boardId: board.id,
+        taskId: identity.taskId
+      };
+    }
+    const readiness = kanbanGovernance().evaluateContractGraphReadiness(board, task.id);
+    if (!readiness.ready) {
+      const issueLines = readiness.issues.map((issue, index) => `  ${index + 1}. ${issue.message}`).join("\n");
+      return {
+        decision: "block",
+        reason: `Active card failed contract-readiness check (${readiness.issues.length} issue(s)):
+` + issueLines + `
+Resolve the readiness issues, then call kanban start_task to retry.`,
+        boardId: board.id,
+        taskId: task.id,
+        readinessIssues: readiness.issues
+      };
+    }
+    const lifecycleStage = task.lifecycle?.currentStage;
+    const assignmentStatus = task.assignment?.status;
+    const lifecycleOk = lifecycleStage === "running";
+    const assignmentOk = assignmentStatus === "running";
+    if (!lifecycleOk || !assignmentOk) {
+      const failed = [];
+      let reassessmentNote = "";
+      if (!lifecycleOk) {
+        failed.push(`lifecycle.currentStage (got: ${lifecycleStage ?? "missing"}; want: 'running')`);
+      }
+      if (!assignmentOk) {
+        failed.push(`assignment.status (got: ${assignmentStatus ?? "missing"}; want: 'running')`);
+        if (lifecycleOk && (assignmentStatus === "queued" || assignmentStatus === void 0 || assignmentStatus === null)) {
+          reassessmentNote = '\nNote: lifecycle is still "running" but the assignment was cleared \u2014 the automated kanban reassessment agent likely reset the binding. Re-issue kanban start_task to re-bind the leader to this card.';
+        }
+      }
+      return {
+        decision: "block",
+        reason: `Active card failed ${failed.length} governance check(s) before product mutation:
+` + failed.map((line, index) => `  ${index + 1}. ${line}`).join("\n") + reassessmentNote,
+        boardId: board.id,
+        taskId: task.id
+      };
+    }
+  }
+  if (identity.leaseId && task?.assignment) {
+    const caps2 = tool.capabilities ?? [];
+    const isWrite = caps2.includes("fs.write") || caps2.includes("fs.write.outside-project") || caps2.some((c) => c.startsWith("shell."));
+    if (isWrite && tool.name !== "kanban" && task.assignment.leaseId !== identity.leaseId) {
+      return {
+        decision: "block",
+        reason: `Task ${task.id} lease mismatch: the current worker's lease (${identity.leaseId}) does not match the active lease on the board (${task.assignment.leaseId}). This task was likely recovered and reassigned to another worker. File modifications from a stale worker are blocked. Use kanban mark_assignment with expectedLeaseId to resolve, or use kanban get_board to reassess the current state.`,
+        boardId: board.id,
+        taskId: task.id
+      };
+    }
+  }
+  const layers = kanbanGovernance().resolveKanbanBoundaryLayers(board, task);
+  if (layers.length === 0) return { decision: "allow" };
+  const caps = tool.capabilities ?? [];
+  const access = caps.includes("fs.write") || caps.includes("fs.write.outside-project") ? "write" : caps.includes("fs.read") ? "read" : void 0;
+  const shellLike = caps.some((capability) => capability.startsWith("shell."));
+  const candidates = access ? await extractCandidatePaths(tool.name, input, ctx) : [];
+  let evaluation;
+  if (shellLike || access && candidates.length === 0) {
+    evaluation = kanbanGovernance().evaluateKanbanBoundaryOpaque(layers, tool.name);
+  } else if (access) {
+    const results = candidates.map(
+      (candidate) => kanbanGovernance().evaluateKanbanBoundaryPath(layers, candidate, access)
+    );
+    evaluation = results.find((result) => result.decision === "block") ?? results.find((result) => result.decision === "confirm") ?? { decision: "allow" };
+  } else {
+    evaluation = { decision: "allow" };
+  }
+  return {
+    ...evaluation,
+    boardId: board.id,
+    ...task ? { taskId: task.id } : {}
+  };
+}
+function isGovernedMutation(tool, input) {
+  if (!tool.mutating || GOVERNANCE_CONTROL_TOOLS.has(tool.name)) return false;
+  if (tool.capabilities?.includes("tool.meta")) return false;
+  if (tool.name === "git") {
+    const command = input["command"];
+    if (command === "status" || command === "log" || command === "diff") return false;
+    if (command === "worktree" && input["worktreeAction"] === "list") return false;
+  }
+  const capabilities = tool.capabilities ?? [];
+  return capabilities.some(
+    (capability) => capability === "fs.write" || capability === "fs.write.outside-project" || capability === "package.install" || capability === "tool.mutate.any" || capability.startsWith("shell.") || capability === "net.outbound"
+  );
+}
+function resolveKanbanIdentity(ctx) {
+  const metaKanban = ctx.meta["kanban"];
+  const record = metaKanban && typeof metaKanban === "object" ? metaKanban : void 0;
+  const boardId = ctx.currentKanbanBoardId ?? (typeof record?.["boardId"] === "string" ? record["boardId"] : void 0);
+  const taskId = ctx.currentKanbanTaskId ?? (typeof record?.["taskId"] === "string" ? record["taskId"] : void 0);
+  const policyRoot = typeof record?.["projectRoot"] === "string" ? record["projectRoot"] : void 0;
+  const leaseId = typeof record?.["leaseId"] === "string" ? record["leaseId"] : void 0;
+  return {
+    ...boardId ? { boardId } : {},
+    ...taskId ? { taskId } : {},
+    ...policyRoot ? { policyRoot } : {},
+    ...leaseId ? { leaseId } : {}
+  };
+}
+async function extractCandidatePaths(toolName, input, ctx) {
+  if (toolName === "patch" && typeof input["patch"] === "string") {
+    const directoryInput = stringValue(input["directory"]) ?? ctx.workingDir;
+    const directory = path.isAbsolute(directoryInput) ? directoryInput : path.resolve(ctx.workingDir, directoryInput);
+    const strip = Math.max(1, numericValue(input["strip"]) ?? 1);
+    const targets = extractPatchTargets(input["patch"], strip).map(
+      (target) => relativeToProject(path.resolve(directory, target), ctx.projectRoot)
+    );
+    return Promise.all(targets.map((target) => canonicalizeCandidatePath(target, ctx)));
+  }
+  const values = [];
+  const pathKeys = new Set(PATH_KEYS);
+  for (const key of TOOL_PATH_KEYS[toolName] ?? []) pathKeys.add(key);
+  collectPathValues(input, values, pathKeys);
+  if (toolName === "scaffold" && typeof input["name"] === "string") {
+    const cwd = stringValue(input["cwd"]) ?? ctx.workingDir;
+    values.push(path.join(cwd, input["name"]));
+  }
+  const candidates = [
+    ...new Set(values.flatMap(splitPathList).map((value) => resolveInputPath(value, ctx)))
+  ];
+  return Promise.all(candidates.map((candidate) => canonicalizeCandidatePath(candidate, ctx)));
+}
+async function canonicalizeCandidatePath(candidate, ctx) {
+  if (path.isAbsolute(candidate)) return candidate;
+  const absolute = path.resolve(ctx.projectRoot, candidate);
+  const canonicalRoot = await realpath(ctx.projectRoot).catch(() => ctx.projectRoot);
+  let probe = absolute;
+  const missingSegments = [];
+  while (true) {
+    try {
+      const canonical = path.join(await realpath(probe), ...missingSegments);
+      return relativeToProject(canonical, canonicalRoot);
+    } catch (cause) {
+      const code = cause.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") return absolute;
+      const parent = path.dirname(probe);
+      if (parent === probe) return absolute;
+      missingSegments.unshift(path.basename(probe));
+      probe = parent;
+    }
+  }
+}
+function collectPathValues(value, output, pathKeys, key) {
+  if (typeof value === "string") {
+    if (key && pathKeys.has(key)) output.push(value);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectPathValues(item, output, pathKeys, key);
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [childKey, child] of Object.entries(value)) {
+    collectPathValues(child, output, pathKeys, childKey);
+  }
+}
+function splitPathList(value) {
+  return value.split(",").map((item) => item.trim()).filter(Boolean);
+}
+function resolveInputPath(value, ctx) {
+  const absolute = path.isAbsolute(value) ? value : path.resolve(ctx.workingDir, value);
+  return relativeToProject(absolute, ctx.projectRoot);
+}
+function relativeToProject(absolute, projectRoot) {
+  const relative2 = path.relative(projectRoot, absolute).replace(/\\/g, "/");
+  return relative2.startsWith("../") || path.isAbsolute(relative2) ? absolute : relative2 || ".";
+}
+function extractPatchTargets(patchText, strip) {
+  const targets = [];
+  for (const match of patchText.matchAll(/^\+\+\+\s+([^\t\r\n]+)/gm)) {
+    const raw = match[1]?.trim();
+    if (!raw || raw === "/dev/null") continue;
+    const parts = raw.replace(/\\/g, "/").split("/").filter((part) => part && part !== ".");
+    if (parts.length > strip) targets.push(parts.slice(strip).join("/"));
+  }
+  return targets;
+}
+function stringValue(value) {
+  return typeof value === "string" && value.trim() ? value : void 0;
+}
+function numericValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+
+// src/utils/lru-cache.ts
+var LruCache = class {
+  store = /* @__PURE__ */ new Map();
+  capacity;
+  constructor(capacity) {
+    if (capacity < 1) throw new Error(`LruCache capacity must be >= 1, got ${capacity}`);
+    this.capacity = capacity;
+  }
+  get(key) {
+    if (!this.store.has(key)) return void 0;
+    const value = this.store.get(key);
+    this.store.delete(key);
+    this.store.set(key, value);
+    return value;
+  }
+  set(key, value) {
+    if (this.store.has(key)) this.store.delete(key);
+    this.store.set(key, value);
+    while (this.store.size > this.capacity) {
+      const oldest = this.store.keys().next();
+      if (oldest.done) break;
+      this.store.delete(oldest.value);
+    }
+  }
+  has(key) {
+    return this.store.has(key);
+  }
+  clear() {
+    this.store.clear();
+  }
+  get size() {
+    return this.store.size;
+  }
+};
+
+export {
+  LruCache,
+  setKanbanGovernance,
+  kanbanGovernance,
+  evaluateToolKanbanBoundary
+};
+//# sourceMappingURL=chunk-OOYZPOXM.js.map

package/dist/chunk-OSGLYW5J.js

@@ -0,0 +1,28 @@
+import {
+  FsError
+} from "./chunk-25LSLC3G.js";
+
+// src/utils/atomic-write.ts
+import {
+  createPersistencePrimitives
+} from "@wrongstack/persistence";
+var primitives = createPersistencePrimitives({
+  createLockTimeoutError: ({ targetPath, timeoutMs }) => new FsError({
+    message: `Timed out waiting for file lock: ${targetPath}`,
+    code: "FS_ATOMIC_WRITE_FAILED",
+    path: targetPath,
+    context: { timeoutMs }
+  })
+});
+var atomicWrite = primitives.atomicWrite;
+var atomicReplaceWithWriter = primitives.atomicReplaceWithWriter;
+var ensureDir = primitives.ensureDir;
+var withFileLock = primitives.withFileLock;
+
+export {
+  atomicWrite,
+  atomicReplaceWithWriter,
+  ensureDir,
+  withFileLock
+};
+//# sourceMappingURL=chunk-OSGLYW5J.js.map