@wrongstack/core 0.51.3 → 0.54.1

package/dist/security/index.d.ts

@@ -1,10 +1,10 @@
 export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-scrubber-7rSC_emZ.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-CtNscWOA.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-CU6sqWxF.js';
 import '../secret-vault-DoISxaKO.js';
 import '../secret-scrubber-3MHDDAtm.js';
-import '../context-7u93AcGD.js';
+import '../context-DtPKqKYV.js';
 import '../input-reader-E-ffP2ee.js';
-import '../permission-B6sldrSp.js';
+import '../permission-Drm7LpPo.js';
 
 declare function isSecretField(name: string): boolean;
 

package/dist/{selector-DmXxpFyM.d.ts → selector-BvSPdJj6.d.ts}

@@ -1,4 +1,4 @@
-import { M as Message } from './context-7u93AcGD.js';
+import { M as Message } from './context-DtPKqKYV.js';
 
 /**
  * Result of LLM-driven message importance analysis.

package/dist/{session-reader-bfgsy2a0.d.ts → session-reader-BGhzMir4.d.ts}

@@ -1,4 +1,4 @@
-import { c as ContentBlock, w as SessionEvent, x as SessionMetadata, y as SessionStore } from './context-7u93AcGD.js';
+import { c as ContentBlock, w as SessionEvent, x as SessionMetadata, y as SessionStore } from './context-DtPKqKYV.js';
 
 type AttachmentKind = 'text' | 'image' | 'file';
 interface AttachmentMeta {

package/dist/storage/index.d.ts

@@ -1,12 +1,12 @@
-export { A as AbandonedSession, a as AttachmentStoreOptions, C as ConfigLoaderOptions, b as ConfigMigration, c as ConfigMigrationError, d as ConfigSource, D as DEFAULT_CONFIG_MIGRATIONS, e as DefaultAttachmentStore, f as DefaultConfigLoader, g as DefaultConfigStore, h as DefaultMemoryStore, i as DefaultSessionStore, M as MemoryStoreOptions, j as MigrationContext, k as MigrationResult, P as PersistedQueueItem, l as PlanFile, m as PlanItem, n as PlanTemplate, Q as QueueStore, R as RecoveryLock, o as RecoveryLockOptions, S as SessionAnalyzer, p as SessionStoreOptions, T as TodosCheckpointFile, q as addPlanItem, r as attachPlanCheckpoint, s as attachTodosCheckpoint, t as clearPlan, u as deriveTodosFromPlanItem, v as emptyPlan, w as formatPlan, x as formatPlanTemplates, y as getPlanTemplate, z as listPlanTemplates, B as loadPlan, E as loadTodosCheckpoint, F as removePlanItem, G as runConfigMigrations, H as savePlan, I as saveTodosCheckpoint, J as setPlanItemStatus } from '../plan-templates-BmDdJ7UL.js';
-export { D as DefaultSessionReader, f as DefaultSessionReaderOptions, S as SessionReader } from '../session-reader-bfgsy2a0.js';
-import { p as Request, q as Response, w as SessionEvent } from '../context-7u93AcGD.js';
+export { A as AbandonedSession, a as AttachmentStoreOptions, C as ConfigLoaderOptions, b as ConfigMigration, c as ConfigMigrationError, d as ConfigSource, D as DEFAULT_CONFIG_MIGRATIONS, e as DefaultAttachmentStore, f as DefaultConfigLoader, g as DefaultConfigStore, h as DefaultMemoryStore, i as DefaultSessionStore, M as MemoryStoreOptions, j as MigrationContext, k as MigrationResult, P as PersistedQueueItem, l as PlanFile, m as PlanItem, n as PlanTemplate, Q as QueueStore, R as RecoveryLock, o as RecoveryLockOptions, S as SessionAnalyzer, p as SessionStoreOptions, T as TodosCheckpointFile, q as addPlanItem, r as attachPlanCheckpoint, s as attachTodosCheckpoint, t as clearPlan, u as deriveTodosFromPlanItem, v as emptyPlan, w as formatPlan, x as formatPlanTemplates, y as getPlanTemplate, z as listPlanTemplates, B as loadPlan, E as loadTodosCheckpoint, F as removePlanItem, G as runConfigMigrations, H as savePlan, I as saveTodosCheckpoint, J as setPlanItemStatus } from '../plan-templates-CLRcurWN.js';
+export { D as DefaultSessionReader, f as DefaultSessionReaderOptions, S as SessionReader } from '../session-reader-BGhzMir4.js';
+import { p as Request, q as Response, w as SessionEvent } from '../context-DtPKqKYV.js';
 import { S as SessionRewinder, C as CheckpointInfo, a as RewindResultExtended } from '../session-rewinder-C9HnMkhP.js';
 export { D as DirectorStateCheckpoint, a as DirectorStateSnapshot, b as DirectorSubagentState, c as DirectorTaskState, l as loadDirectorState } from '../director-state-BmYi3DGA.js';
-export { A as AuditLevel, C as CORE_RECONSTRUCT_EVENTS, G as GoalFile, J as JournalEntry, M as MAX_JOURNAL_ENTRIES, S as STANDARD_AUDIT_EVENTS, a as SessionEventBridge, b as SessionEventBridgeOptions, c as SessionSamplingOptions, T as ToolProgressSamplingOptions, d as appendJournal, e as createSessionEventBridge, f as emptyGoal, g as formatGoal, h as goalFilePath, l as loadGoal, r as resolveAuditLevel, i as resolveSessionLoggingConfig, s as saveGoal, j as summarizeUsage } from '../goal-store-BeRsj7YX.js';
+export { A as AuditLevel, C as CORE_RECONSTRUCT_EVENTS, G as GoalFile, J as JournalEntry, M as MAX_JOURNAL_ENTRIES, S as STANDARD_AUDIT_EVENTS, a as SessionEventBridge, b as SessionEventBridgeOptions, c as SessionSamplingOptions, T as ToolProgressSamplingOptions, d as appendJournal, e as createSessionEventBridge, f as emptyGoal, g as formatGoal, h as goalFilePath, l as loadGoal, r as resolveAuditLevel, i as resolveSessionLoggingConfig, s as saveGoal, j as summarizeUsage } from '../goal-store-DwcTDDiX.js';
 import { a as WstackPaths } from '../wstack-paths-eMXnY1_X.js';
-import { n as SyncCategory, o as SyncConfig } from '../config-ZRCf7sTu.js';
-import '../events-Bt44ikPN.js';
+import { o as SyncCategory, p as SyncConfig } from '../config-bht0txXS.js';
+import '../events-CbHTS4ZZ.js';
 import '../secret-scrubber-3MHDDAtm.js';
 import '../memory-CEXuo7sz.js';
 import '../secret-vault-DoISxaKO.js';

package/dist/storage/index.js

@@ -1,6 +1,6 @@
 import { randomBytes, randomUUID, createHash } from 'crypto';
 import * as fsp from 'fs/promises';
-import * as path11 from 'path';
+import * as path14 from 'path';
 import * as os from 'os';
 
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
@@ -10,9 +10,9 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path11.dirname(targetPath);
+  const dir = path14.dirname(targetPath);
   await fsp.mkdir(dir, { recursive: true });
-  const tmp = path11.join(dir, `.${path11.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const tmp = path14.join(dir, `.${path14.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
   try {
     if (typeof content === "string") {
       await fsp.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
@@ -68,7 +68,7 @@ async function renameWithRetry(from, to) {
       if (!code || !TRANSIENT_RENAME_CODES.has(code) || i === delays.length) {
         throw err;
       }
-      await new Promise((resolve3) => setTimeout(resolve3, delays[i]));
+      await new Promise((resolve4) => setTimeout(resolve4, delays[i]));
     }
   }
   throw lastErr;
@@ -178,7 +178,7 @@ var DefaultSessionStore = class {
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
-    return path11.join(this.dir, `${id}${ext}`);
+    return path14.join(this.dir, `${id}${ext}`);
   }
   async ensureShardDir(_id) {
     await ensureDir(this.dir);
@@ -188,7 +188,7 @@ var DefaultSessionStore = class {
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const id = meta.id ?? `${startedAt.replace(/[:.]/g, "-")}-${randomBytes(2).toString("hex")}`;
     const shardDir = await this.ensureShardDir(id);
-    const file = path11.join(shardDir, `${id}.jsonl`);
+    const file = path14.join(shardDir, `${id}.jsonl`);
     let handle;
     try {
       handle = await fsp.open(file, "a", 384);
@@ -281,7 +281,7 @@ var DefaultSessionStore = class {
     const ids = [];
     const entries = await fsp.readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = path11.join(dir, entry.name);
+      const full = path14.join(dir, entry.name);
       if (entry.isDirectory()) {
         ids.push(...await this.collectSessionIds(full));
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
@@ -437,7 +437,7 @@ var FileSessionWriter = class {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path11.join(opts.dir, `${id}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path14.join(opts.dir, `${id}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.summary = {
@@ -716,7 +716,7 @@ function userInputTitle(content) {
 var QueueStore = class {
   file;
   constructor(opts) {
-    this.file = path11.join(opts.dir, "queue.json");
+    this.file = path14.join(opts.dir, "queue.json");
   }
   async write(items) {
     if (items.length === 0) {
@@ -783,7 +783,7 @@ var DefaultAttachmentStore = class {
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
       await fsp.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path11.join(this.spoolDir, `${id}.bin`);
+      spooledPath = path14.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -968,7 +968,7 @@ ${body.trim()}`);
   async remember(text, scope = "project-memory") {
     return this.runSerialized(scope, async () => {
       const file = this.files[scope];
-      await ensureDir(path11.dirname(file));
+      await ensureDir(path14.dirname(file));
       let existing = "";
       try {
         existing = await fsp.readFile(file, "utf8");
@@ -1583,7 +1583,7 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path11.join(opts.dir, LOCK_FILE);
+    this.file = path14.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
     this.hostname = opts.hostname ?? os.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
@@ -1641,7 +1641,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path11.dirname(this.file));
+    await ensureDir(path14.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -2126,7 +2126,7 @@ var AnnotationsStore = class {
     if (!sessionId || sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
       throw new Error(`Invalid sessionId: ${sessionId}`);
     }
-    return path11.join(this.dir, `${sessionId}.annotations.json`);
+    return path14.join(this.dir, `${sessionId}.annotations.json`);
   }
   async readFile(sessionId) {
     const fp = this.filePath(sessionId);
@@ -2283,7 +2283,7 @@ var ReplayLogStore = class {
       out.push({
         sessionId,
         entryCount: all.length,
-        path: path11.join(this.dir, name)
+        path: path14.join(this.dir, name)
       });
     }
     return out.sort((a, b) => a.sessionId.localeCompare(b.sessionId));
@@ -2293,7 +2293,7 @@ var ReplayLogStore = class {
     if (!sessionId || sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
       throw new Error(`Invalid sessionId: ${sessionId}`);
     }
-    return path11.join(this.dir, `${sessionId}.replay.jsonl`);
+    return path14.join(this.dir, `${sessionId}.replay.jsonl`);
   }
   async readAll(sessionId) {
     const fp = this.filePath(sessionId);
@@ -2482,7 +2482,7 @@ var SessionRecovery = class {
     if (!sessionId || sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
       throw new Error(`Invalid sessionId: ${sessionId}`);
     }
-    return path11.join(this.dir, `${sessionId}.jsonl`);
+    return path14.join(this.dir, `${sessionId}.jsonl`);
   }
 };
 var GENESIS_PREV = "0".repeat(64);
@@ -2600,7 +2600,7 @@ var ToolAuditLog = class {
     if (!sessionId || sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
       throw new Error(`Invalid sessionId: ${sessionId}`);
     }
-    return path11.join(this.dir, `${sessionId}.audit.jsonl`);
+    return path14.join(this.dir, `${sessionId}.audit.jsonl`);
   }
   async readAll(sessionId) {
     const fp = this.filePath(sessionId);
@@ -2781,7 +2781,7 @@ var DefaultSessionRewinder = class {
   sessionsDir;
   projectRoot;
   async listCheckpoints(sessionId) {
-    const file = path11.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path14.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     const fileCountMap = /* @__PURE__ */ new Map();
@@ -2806,7 +2806,7 @@ var DefaultSessionRewinder = class {
     return checkpoints;
   }
   async rewindToCheckpoint(sessionId, checkpointIndex) {
-    const file = path11.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path14.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     let targetIdx = -1;
@@ -2841,7 +2841,7 @@ var DefaultSessionRewinder = class {
     return { ...result, toPromptIndex: checkpointIndex, removedEvents };
   }
   async rewindLastN(sessionId, n) {
-    const file = path11.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path14.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     const checkpoints = [];
@@ -2870,7 +2870,7 @@ var DefaultSessionRewinder = class {
     return { ...result, toPromptIndex: targetIndex, removedEvents: snapshotsToRevert.length };
   }
   async rewindToStart(sessionId) {
-    const file = path11.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path14.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     const allSnapshots = [];
@@ -2906,10 +2906,10 @@ async function revertSnapshots(snapshots, projectRoot) {
   for (const snapshot of snapshots) {
     for (const file of snapshot.files) {
       try {
-        const absPath = path11.resolve(file.path);
-        const root = path11.resolve(projectRoot);
-        const rel = path11.relative(root, absPath);
-        if (rel.startsWith("..") || path11.isAbsolute(rel)) {
+        const absPath = path14.resolve(file.path);
+        const root = path14.resolve(projectRoot);
+        const rel = path14.relative(root, absPath);
+        if (rel.startsWith("..") || path14.isAbsolute(rel)) {
           errors.push(`${file.path}: path resolves outside project root \u2014 skipping`);
           continue;
         }
@@ -3468,8 +3468,8 @@ var FsError = class extends WrongStackError {
 // src/storage/goal-store.ts
 var MAX_JOURNAL_ENTRIES = 500;
 function goalFilePath(projectRoot) {
-  const hash = createHash("sha256").update(path11.resolve(projectRoot)).digest("hex").slice(0, 12);
-  return path11.join(os.homedir(), ".wrongstack", "projects", hash, "goal.json");
+  const hash = createHash("sha256").update(path14.resolve(projectRoot)).digest("hex").slice(0, 12);
+  return path14.join(os.homedir(), ".wrongstack", "projects", hash, "goal.json");
 }
 async function loadGoal(filePath) {
   let raw;
@@ -3584,7 +3584,7 @@ var DefaultPromptStore = class {
         if (!file.endsWith(".json")) continue;
         try {
           const raw = JSON.parse(
-            await fsp.readFile(path11.join(this.dir, file), "utf8")
+            await fsp.readFile(path14.join(this.dir, file), "utf8")
           );
           entries.push(raw.entry);
         } catch {
@@ -3597,7 +3597,7 @@ var DefaultPromptStore = class {
     );
   }
   async get(id) {
-    const file = path11.join(this.dir, `${id}.json`);
+    const file = path14.join(this.dir, `${id}.json`);
     try {
       const raw = JSON.parse(await fsp.readFile(file, "utf8"));
       return raw.entry;
@@ -3607,12 +3607,12 @@ var DefaultPromptStore = class {
   }
   async save(entry) {
     await ensureDir(this.dir);
-    const file = path11.join(this.dir, `${entry.id}.json`);
+    const file = path14.join(this.dir, `${entry.id}.json`);
     const raw = { version: 1, entry };
     await atomicWrite(file, JSON.stringify(raw, null, 2));
   }
   async delete(id) {
-    const file = path11.join(this.dir, `${id}.json`);
+    const file = path14.join(this.dir, `${id}.json`);
     try {
       await fsp.unlink(file);
       return true;
@@ -3646,7 +3646,7 @@ var CloudSync = class {
     this.paths = paths;
     this.getConfig = getConfig;
     this.setConfig = setConfig;
-    this.statePath = path11.join(paths.globalRoot, "sync-state.json");
+    this.statePath = path14.join(paths.globalRoot, "sync-state.json");
   }
   paths;
   getConfig;
@@ -3751,9 +3751,9 @@ var CloudSync = class {
       const localPath = this.categoryToPath(cat);
       if (!localPath) continue;
       const rel = segments.slice(2).join("/");
-      const destPath = rel ? path11.join(localPath, rel) : localPath;
+      const destPath = resolvePulledCategoryPath(cat, localPath, rel, entry.path);
       const blobData = await this.getBlob(token, owner, repoName, entry.sha);
-      await fsp.mkdir(path11.dirname(destPath), { recursive: true });
+      await fsp.mkdir(path14.dirname(destPath), { recursive: true });
       await fsp.writeFile(destPath, Buffer.from(blobData, "base64"));
     }
     const localRev = await this.hashLocalCategories(cfg.categories);
@@ -3858,7 +3858,7 @@ var CloudSync = class {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
             const content = await fsp.readFile(file, "utf8");
-            const rel = path11.relative(localPath, file).replace(/\\/g, "/");
+            const rel = path14.relative(localPath, file).replace(/\\/g, "/");
             entries.push({ path: `data/${cat}/${rel}`, content, mode: "100644" });
             hashes.push(content);
           }
@@ -3915,7 +3915,7 @@ var CloudSync = class {
     const results = [];
     const entries = await fsp.readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = path11.join(dir, entry.name);
+      const full = path14.join(dir, entry.name);
       if (entry.isDirectory()) {
         results.push(...await this.walkDir(full, base));
       } else {
@@ -3925,6 +3925,26 @@ var CloudSync = class {
     return results;
   }
 };
+function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
+  const directoryBacked = cat === "skills" || cat === "prompts";
+  if (!directoryBacked) {
+    if (rel) throw new Error(`Refusing nested CloudSync path for file category: ${remotePath}`);
+    return localPath;
+  }
+  if (!rel) return localPath;
+  const normalizedRel = path14.normalize(rel);
+  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path14.sep}`);
+  if (path14.isAbsolute(normalizedRel) || traversesUp) {
+    throw new Error(`Refusing CloudSync path traversal: ${remotePath}`);
+  }
+  const dest = path14.resolve(localPath, normalizedRel);
+  const root = path14.resolve(localPath);
+  const relative3 = path14.relative(root, dest);
+  if (relative3.startsWith("..") || path14.isAbsolute(relative3)) {
+    throw new Error(`Refusing CloudSync path outside category root: ${remotePath}`);
+  }
+  return dest;
+}
 function timeAgo(iso) {
   const diff = Date.now() - new Date(iso).getTime();
   const mins = Math.floor(diff / 6e4);