@wrongstack/core 0.5.7 → 0.6.1

package/dist/{tool-executor-DbAFkHdP.d.ts → tool-executor-40Q6shR-.d.ts}

@@ -2,7 +2,7 @@ import { a2 as Context, h as ProviderError, v as Tool, G as ToolUseBlock, B as T
 import { a as Compactor, C as CompactReport } from './compactor-RIPuTtWK.js';
 import { a as RecoveryDecision, E as ErrorHandler, R as RetryPolicy } from './retry-policy-LKS8MHsB.js';
 import { M as ModelsRegistry } from './models-registry-Y2xbog0E.js';
-import { k as ToolExecutorOptions, l as ToolExecutorStrategy, m as ToolBatchResult } from './index-j2WyAyML.js';
+import { k as ToolExecutorOptions, l as ToolExecutorStrategy, m as ToolBatchResult } from './index-BkKLQjea.js';
 
 interface CompactorOptions {
     preserveK?: number;

package/dist/types/index.d.ts

@@ -1,5 +1,5 @@
 export { A as AgentError, C as Capabilities, a as ConfigError, b as ContentBlock, E as ErrorCode, c as ErrorSeverity, d as ErrorSubsystem, F as FileSnapshot, I as ImageBlock, J as JSONSchema, M as Message, e as MessageRole, P as Permission, f as PluginError, g as Provider, h as ProviderError, i as ProviderErrorBody, R as Request, j as Response, k as ResumedSession, l as RiskTier, S as SessionData, m as SessionError, n as SessionEvent, o as SessionMetadata, p as SessionStore, q as SessionSummary, r as SessionWriter, s as StopReason, t as StreamEvent, T as TextBlock, u as ThinkingBlock, v as Tool, w as ToolCallContext, x as ToolError, y as ToolFinalEvent, z as ToolProgressEvent, B as ToolResultBlock, D as ToolStreamEvent, G as ToolUseBlock, U as Usage, W as WrongStackError, H as asBlocks, K as asText, L as isAgentError, N as isConfigError, O as isImageBlock, Q as isPluginError, V as isSessionError, X as isTextBlock, Y as isThinkingBlock, Z as isToolError, _ as isToolResultBlock, $ as isToolUseBlock, a0 as isWrongStackError, a1 as toWrongStackError } from '../context-CDRyrkKQ.js';
-export { P as ProviderRunner, R as RunProviderOptions } from '../provider-runner-hl4Il3xS.js';
+export { P as ProviderRunner, R as RunProviderOptions } from '../provider-runner-CZYIzeBp.js';
 export { C as CONTEXT_WINDOW_MODES, a as Config, b as ConfigLoader, c as ConfigStore, d as ContextConfig, e as ContextWindowAggressiveOn, f as ContextWindowConfigLike, g as ContextWindowMode, h as ContextWindowModeId, i as ContextWindowPolicy, j as ContextWindowThresholds, D as DEFAULT_CONTEXT_WINDOW_MODE_ID, F as FeaturesConfig, L as LogConfig, M as MCPServerConfig, P as PluginConfig, k as ProviderApiKey, l as ProviderConfig, T as ToolsConfig, m as formatContextWindowModeList, n as getContextWindowMode, o as isContextWindowModeId, p as listContextWindowModes, r as resolveContextWindowPolicy } from '../config-BGGuP_Ar.js';
 export { C as CompactReport, a as Compactor } from '../compactor-RIPuTtWK.js';
 export { P as PermissionDecision, a as PermissionPolicy, T as TrustPolicy } from '../secret-scrubber-CfMdAJ_l.js';
@@ -7,20 +7,20 @@ export { C as CheckpointInfo, R as RewindResult, a as RewindResultExtended, S as
 export { A as AddAttachmentInput, a as Attachment, b as AttachmentKind, c as AttachmentMeta, d as AttachmentRef, e as AttachmentStore, D as DefaultSessionReader } from '../session-reader-CzfRA6Vk.js';
 export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-scrubber-BzQR5BiL.js';
 export { D as DefaultLogger, a as DefaultLoggerOptions } from '../logger-BH6AE0W9.js';
-export { D as DefaultPathResolver, a as DefaultTokenCounter } from '../path-resolver--g_hKJ7V.js';
+export { D as DefaultPathResolver, a as DefaultTokenCounter } from '../path-resolver-CWINz5XR.js';
 export { M as MemoryEntry, a as MemoryScope, b as MemoryStore } from '../memory-CEXuo7sz.js';
-export { C as CompactorOptions, D as DEFAULT_RECOVERY_STRATEGIES, a as DefaultErrorHandler, b as DefaultRetryPolicy, H as HybridCompactor, R as RecoveryStrategy, T as ToolExecutor, c as buildRecoveryStrategies } from '../tool-executor-DbAFkHdP.js';
+export { C as CompactorOptions, D as DEFAULT_RECOVERY_STRATEGIES, a as DefaultErrorHandler, b as DefaultRetryPolicy, H as HybridCompactor, R as RecoveryStrategy, T as ToolExecutor, c as buildRecoveryStrategies } from '../tool-executor-40Q6shR-.js';
 export { S as SkillEntry, a as SkillLoader, b as SkillManifest } from '../skill-CxuWrsKK.js';
 export { B as BuildContext, M as ModelCapabilities, R as Renderer, S as SystemPromptBuilder } from '../system-prompt-Dl2QY1_B.js';
 export { I as InputReader, P as PromptOption } from '../input-reader-E-ffP2ee.js';
-export { M as MCPRegistryView, a as MetricsSinkView, P as Plugin, b as PluginAPI, c as PluginCapabilities, d as PluginDependency, e as PluginPipelines, f as ProviderFactory, g as ProviderRegistryView, S as SessionWriterView, h as SlashCommand, i as SlashCommandRegistryView, j as SystemPromptContributor, T as ToolRegistryView } from '../index-j2WyAyML.js';
+export { M as MCPRegistryView, a as MetricsSinkView, P as Plugin, b as PluginAPI, c as PluginCapabilities, d as PluginDependency, e as PluginPipelines, f as ProviderFactory, g as ProviderRegistryView, S as SessionWriterView, h as SlashCommand, i as SlashCommandRegistryView, j as SystemPromptContributor, T as ToolRegistryView } from '../index-BkKLQjea.js';
 export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-DqzwpBQy.js';
 export { D as DEFAULT_MODES, M as Mode, a as ModeConfig, b as ModeManifest, c as ModeStore } from '../mode-CV077NjV.js';
-export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-BKNiE1VH.js';
-export { C as CoordinatorEvents, a as CoordinatorStatus, D as DoneCondition, M as MultiAgentConfig, b as MultiAgentCoordinator, S as SpawnResult, c as SubagentConfig, d as SubagentContext, e as SubagentError, f as SubagentErrorKind, g as SubagentRunContext, h as SubagentRunOutcome, i as SubagentRunner, T as TaskDelegation, j as TaskResult, k as TaskSpec } from '../multi-agent-Cpp7FXUl.js';
+export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from '../agent-bridge-DaCvA_uK.js';
+export { C as CoordinatorEvents, a as CoordinatorStatus, D as DoneCondition, M as MultiAgentConfig, b as MultiAgentCoordinator, S as SpawnResult, c as SubagentConfig, d as SubagentContext, e as SubagentError, f as SubagentErrorKind, g as SubagentRunContext, h as SubagentRunOutcome, i as SubagentRunner, T as TaskDelegation, j as TaskResult, k as TaskSpec } from '../multi-agent-MfI6dmv-.js';
 export { C as CriticalPathResult, D as DEFAULT_SPEC_TEMPLATE, S as SpecAnalysis, a as SpecApiEndpoint, b as SpecRequirement, c as SpecSection, d as SpecSectionType, e as SpecStatus, f as SpecTemplate, g as SpecValidationResult, h as Specification, T as TaskAssignment, i as TaskDependency, j as TaskEdge, k as TaskFilter, l as TaskGraph, m as TaskNode, n as TaskPriority, o as TaskProgress, p as TaskSort, q as TaskStatus, r as TaskType, s as computeTaskProgress, t as findCriticalPath, u as topologicalSort } from '../task-graph-BITvWt4t.js';
 export { A as AggregateHealth, H as HealthCheck, a as HealthCheckResult, b as HealthRegistry, c as HealthStatus, M as MetricLabels, d as MetricSeries, e as MetricsSink, f as MetricsSnapshot, S as Span, T as Tracer } from '../observability-BhnVLBLS.js';
-import '../events-DPQKFX7W.js';
+import '../events-CzkeaVVl.js';
 import '../logger-BMQgxvdy.js';
 import '../retry-policy-LKS8MHsB.js';
 import '../models-registry-Y2xbog0E.js';

package/dist/types/index.js

@@ -1,7 +1,7 @@
 import { randomBytes, createCipheriv, createDecipheriv, randomUUID } from 'crypto';
-import * as fs from 'fs';
-import * as fs4 from 'fs/promises';
-import * as path3 from 'path';
+import * as fs2 from 'fs';
+import * as fs from 'fs/promises';
+import * as path4 from 'path';
 
 // src/types/blocks.ts
 function isTextBlock(b) {
@@ -235,6 +235,67 @@ function providerStatusToCode(status, type) {
 
 // src/types/secret-vault.ts
 var ENCRYPTED_PREFIX = "enc:v1:";
+async function atomicWrite(targetPath, content, opts = {}) {
+  const dir = path4.dirname(targetPath);
+  await fs.mkdir(dir, { recursive: true });
+  const tmp = path4.join(dir, `.${path4.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  try {
+    if (typeof content === "string") {
+      await fs.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
+    } else {
+      await fs.writeFile(tmp, content, { flag: "wx" });
+    }
+    try {
+      const fh = await fs.open(tmp, "r+");
+      try {
+        await fh.sync();
+      } finally {
+        await fh.close();
+      }
+    } catch {
+    }
+    let mode;
+    try {
+      const stat2 = await fs.stat(targetPath);
+      mode = stat2.mode & 511;
+    } catch {
+      mode = opts.mode;
+    }
+    if (mode !== void 0) {
+      await fs.chmod(tmp, mode);
+    }
+    await renameWithRetry(tmp, targetPath);
+  } catch (err) {
+    try {
+      await fs.unlink(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+var TRANSIENT_RENAME_CODES = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES", "ENOTEMPTY"]);
+async function renameWithRetry(from, to) {
+  if (process.platform !== "win32") {
+    await fs.rename(from, to);
+    return;
+  }
+  const delays = [10, 25, 60, 120, 250];
+  let lastErr;
+  for (let i = 0; i <= delays.length; i++) {
+    try {
+      await fs.rename(from, to);
+      return;
+    } catch (err) {
+      lastErr = err;
+      const code = err?.code;
+      if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {
+        throw err;
+      }
+      await new Promise((resolve3) => setTimeout(resolve3, delays[i]));
+    }
+  }
+  throw lastErr;
+}
 
 // src/security/secret-vault.ts
 var KEY_BYTES = 32;
@@ -281,7 +342,7 @@ var DefaultSecretVault = class {
   loadOrCreateKey() {
     if (this.key) return this.key;
     try {
-      const buf = fs.readFileSync(this.keyFile);
+      const buf = fs2.readFileSync(this.keyFile);
       if (buf.length !== KEY_BYTES) {
         throw new Error(`SecretVault: key file ${this.keyFile} has wrong size`);
       }
@@ -290,13 +351,13 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
-    fs.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    fs2.mkdirSync(path4.dirname(this.keyFile), { recursive: true });
     const key = randomBytes(KEY_BYTES);
     try {
-      fs.writeFileSync(this.keyFile, key, { mode: 384, flag: "wx" });
+      fs2.writeFileSync(this.keyFile, key, { mode: 384, flag: "wx" });
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
-      const buf = fs.readFileSync(this.keyFile);
+      const buf = fs2.readFileSync(this.keyFile);
       if (buf.length !== KEY_BYTES) {
         throw new Error(`SecretVault: key file ${this.keyFile} has wrong size`);
       }
@@ -351,23 +412,23 @@ function isSecretField(name) {
 async function rewriteConfigEncrypted(configPath, vault, patch) {
   let current = {};
   try {
-    const raw = await fs4.readFile(configPath, "utf8");
+    const raw = await fs.readFile(configPath, "utf8");
     current = JSON.parse(raw);
   } catch {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fs4.mkdir(path3.dirname(configPath), { recursive: true });
-  await fs4.writeFile(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  await fs.mkdir(path4.dirname(configPath), { recursive: true });
+  await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   try {
-    await fs4.chmod(configPath, 384);
+    await fs.chmod(configPath, 384);
   } catch {
   }
 }
 async function migratePlaintextSecrets(configPath, vault) {
   let raw;
   try {
-    raw = await fs4.readFile(configPath, "utf8");
+    raw = await fs.readFile(configPath, "utf8");
   } catch {
     return { migrated: 0, file: configPath };
   }
@@ -380,9 +441,9 @@ async function migratePlaintextSecrets(configPath, vault) {
   const counter = { n: 0 };
   const migrated = walkCount(parsed, vault, counter);
   if (counter.n === 0) return { migrated: 0, file: configPath };
-  await fs4.writeFile(configPath, JSON.stringify(migrated, null, 2), { mode: 384 });
+  await atomicWrite(configPath, JSON.stringify(migrated, null, 2), { mode: 384 });
   try {
-    await fs4.chmod(configPath, 384);
+    await fs.chmod(configPath, 384);
   } catch {
   }
   return { migrated: counter.n, file: configPath };
@@ -483,7 +544,7 @@ var DefaultLogger = class _DefaultLogger {
     this.pretty = opts.pretty ?? true;
     if (this.file) {
       try {
-        fs.mkdirSync(path3.dirname(this.file), { recursive: true });
+        fs2.mkdirSync(path4.dirname(this.file), { recursive: true });
       } catch {
       }
     }
@@ -522,7 +583,7 @@ var DefaultLogger = class _DefaultLogger {
     }
     if (this.file) {
       try {
-        fs.appendFileSync(this.file, `${JSON.stringify(entry)}
+        fs2.appendFileSync(this.file, `${JSON.stringify(entry)}
 `);
       } catch {
       }
@@ -947,47 +1008,47 @@ var DefaultPathResolver = class {
   projectRoot;
   cwd;
   constructor(cwd = process.cwd()) {
-    this.cwd = path3.resolve(cwd);
+    this.cwd = path4.resolve(cwd);
     this.projectRoot = this.detectProjectRoot(this.cwd);
   }
   detectProjectRoot(start) {
-    let dir = path3.resolve(start);
-    const root = path3.parse(dir).root;
+    let dir = path4.resolve(start);
+    const root = path4.parse(dir).root;
     while (dir !== root) {
       for (const marker of PROJECT_MARKERS) {
         try {
-          fs.accessSync(path3.join(dir, marker));
+          fs2.accessSync(path4.join(dir, marker));
           return dir;
         } catch {
         }
       }
-      const parent = path3.dirname(dir);
+      const parent = path4.dirname(dir);
       if (parent === dir) break;
       dir = parent;
     }
-    return path3.resolve(start);
+    return path4.resolve(start);
   }
   resolve(input) {
-    const abs = path3.isAbsolute(input) ? input : path3.resolve(this.cwd, input);
+    const abs = path4.isAbsolute(input) ? input : path4.resolve(this.cwd, input);
     let real;
     try {
-      real = fs.realpathSync(abs);
+      real = fs2.realpathSync(abs);
     } catch {
-      real = path3.normalize(abs);
+      real = path4.normalize(abs);
     }
     return real;
   }
   isInsideRoot(absPath) {
-    const normalized = path3.normalize(absPath);
-    const root = path3.normalize(this.projectRoot);
+    const normalized = path4.normalize(absPath);
+    const root = path4.normalize(this.projectRoot);
     if (normalized === root) return true;
-    const rel = path3.relative(root, normalized);
-    return !rel.startsWith("..") && !path3.isAbsolute(rel);
+    const rel = path4.relative(root, normalized);
+    return !rel.startsWith("..") && !path4.isAbsolute(rel);
   }
   ensureInsideRoot(absPath) {
     const resolved = this.resolve(absPath);
     if (!this.isInsideRoot(resolved)) {
-      const display = path3.isAbsolute(absPath) ? path3.basename(absPath) : absPath;
+      const display = path4.isAbsolute(absPath) ? path4.basename(absPath) : absPath;
       const err = new Error(`Path "${display}" resolves outside the project root`);
       err.fullPath = absPath;
       err.projectRoot = this.projectRoot;
@@ -1025,7 +1086,7 @@ function buildRecoveryStrategies(opts) {
       async attempt(err) {
         if (!(err instanceof ProviderError) || err.status !== 429) return null;
         const delayMs = err.body?.retryAfterMs ?? 5e3;
-        const delay = Math.max(1e3, Math.min(delayMs, 6e4));
+        const delay = Math.min(6e4, Math.max(1e3, delayMs));
         await new Promise((r) => setTimeout(r, delay));
         return { action: "retry", reason: "rate_limit_backoff" };
       }
@@ -1178,15 +1239,15 @@ var PATTERNS = [
   { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g },
   {
     type: "bearer_token",
-    // Bounded at 512 chars to prevent catastrophic backtracking on adversarial input.
-    // Negative lookahead is a simple single-char check — no backtracking risk.
-    regex: /(?<![A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{20,512}=*(?![A-Za-z0-9_.~+/-])/g
+    // Anchored with alternation instead of negative lookahead — avoids V8
+    // backtracking risk on adversarial input. Bounded at 512 chars.
+    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{20,512}=*(?:$|[^A-Za-z0-9_.~+/-])/g
   },
   {
     type: "high_entropy_env",
-    // Value bounded at 512 chars; negative lookahead simplified to avoid
-    // nested quantifier backtracking on adversarial input.
-    regex: /\b([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?/g
+    // Anchored with alternation instead of lookbehind to avoid backtracking.
+    // Value bounded at 512 chars.
+    regex: /(?:^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?:\s|$)/g
   }
 ];
 var SCRUB_CHUNK_BYTES = 64 * 1024;
@@ -1238,69 +1299,6 @@ var DefaultSecretScrubber = class {
     return visit(obj);
   }
 };
-async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path3.dirname(targetPath);
-  await fs4.mkdir(dir, { recursive: true });
-  const tmp = path3.join(dir, `.${path3.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
-  try {
-    if (typeof content === "string") {
-      await fs4.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
-    } else {
-      await fs4.writeFile(tmp, content, { flag: "wx" });
-    }
-    try {
-      const fh = await fs4.open(tmp, "r+");
-      try {
-        await fh.sync();
-      } finally {
-        await fh.close();
-      }
-    } catch {
-    }
-    let mode;
-    try {
-      const stat2 = await fs4.stat(targetPath);
-      mode = stat2.mode & 511;
-    } catch {
-      mode = opts.mode;
-    }
-    if (mode !== void 0) {
-      await fs4.chmod(tmp, mode);
-    }
-    await renameWithRetry(tmp, targetPath);
-  } catch (err) {
-    try {
-      await fs4.unlink(tmp);
-    } catch {
-    }
-    throw err;
-  }
-}
-var TRANSIENT_RENAME_CODES = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES", "ENOTEMPTY"]);
-async function renameWithRetry(from, to) {
-  if (process.platform !== "win32") {
-    await fs4.rename(from, to);
-    return;
-  }
-  const delays = [10, 25, 60, 120, 250];
-  let lastErr;
-  for (let i = 0; i <= delays.length; i++) {
-    try {
-      await fs4.rename(from, to);
-      return;
-    } catch (err) {
-      lastErr = err;
-      const code = err?.code;
-      if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {
-        throw err;
-      }
-      await new Promise((resolve3) => setTimeout(resolve3, delays[i]));
-    }
-  }
-  throw lastErr;
-}
-
-// src/models/models-registry.ts
 var DEFAULT_URL = "https://models.dev/api.json";
 var DEFAULT_TTL_SECONDS = 24 * 3600;
 var FAMILY_BY_NPM = {
@@ -1457,7 +1455,7 @@ var DefaultModelsRegistry = class {
   }
   async readCache() {
     try {
-      const raw = await fs4.readFile(this.cacheFile, "utf8");
+      const raw = await fs.readFile(this.cacheFile, "utf8");
       return JSON.parse(raw);
     } catch {
       return void 0;
@@ -1465,7 +1463,7 @@ var DefaultModelsRegistry = class {
   }
   /** Used by `wstack models refresh` to expose where the cache lives. */
   cacheLocation() {
-    return path3.resolve(this.cacheFile);
+    return path4.resolve(this.cacheFile);
   }
 };
 
@@ -2266,13 +2264,17 @@ var ToolExecutor = class {
     const ctrl = new AbortController();
     const timer = setTimeout(() => ctrl.abort(new Error("tool timeout")), timeoutMs);
     const combined = AbortSignal.any([parentSignal, ctrl.signal]);
+    let cleanupCalled = false;
+    let caught = false;
     try {
       if (typeof tool.executeStream === "function") {
         return await this.runStreamedTool(tool, input, ctx, combined, toolUseId);
       }
       return await tool.execute(input, ctx, { signal: combined });
     } catch (err) {
+      caught = true;
       if (combined.aborted && typeof tool.cleanup === "function") {
+        cleanupCalled = true;
         try {
           await tool.cleanup(input, ctx);
         } catch {
@@ -2281,6 +2283,16 @@ var ToolExecutor = class {
       throw err;
     } finally {
       clearTimeout(timer);
+      if (combined.aborted && !caught) {
+        if (!cleanupCalled && typeof tool.cleanup === "function") {
+          try {
+            await tool.cleanup(input, ctx);
+          } catch {
+          }
+        }
+        const reason = combined.reason instanceof Error ? combined.reason : new Error(typeof combined.reason === "string" ? combined.reason : "aborted");
+        throw reason;
+      }
     }
   }
   async runStreamedTool(tool, input, ctx, signal, toolUseId) {
@@ -2338,7 +2350,8 @@ var ToolExecutor = class {
     if (subjectKey) {
       const v = obj[subjectKey];
       if (typeof v === "string") {
-        return subjectKey === "path" || subjectKey === "file" || subjectKey === "files" ? normalizePath(v) : escapeGlob(v);
+        const isPathKey = subjectKey === "path" || subjectKey === "file" || subjectKey === "files";
+        return isPathKey ? normalizePath(v) : escapeGlob(v);
       }
     }
     if (toolName === "bash" && typeof obj.command === "string") {