@wrongstack/core 0.6.3 → 0.6.5

package/dist/utils/index.d.ts

@@ -1,4 +1,4 @@
-import { a5 as TodoItem, M as Message, J as JSONSchema } from '../context-CDRyrkKQ.js';
+import { a5 as TodoItem, M as Message, J as JSONSchema } from '../context-DN5v-uQX.js';
 export { a as WstackPathOptions, W as WstackPaths, p as projectHash, r as resolveWstackPaths } from '../wstack-paths-86YPFktR.js';
 
 interface AtomicWriteOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/core",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "license": "MIT",
   "description": "WrongStack core: kernel, types, defaults, and shared utilities for the WrongStack CLI agent.",
   "repository": {

package/skills/audit-log/SKILL.md

@@ -1,31 +1,46 @@
 ---
 name: audit-log
 description: |
-  System-wide audit log analysis. Covers log parsing, anomaly detection,
-  pattern recognition across sessions, and structured reporting.
-  Use for post-mortems, trend analysis, and operational insights.
-version: 1.0.0
+  Use this skill when analyzing WrongStack session logs, event streams, or
+  system traces to surface patterns, anomalies, or operational insights.
+  Triggers: user says "audit", "session analysis", "log analysis", "usage patterns".
+version: 1.1.0
 ---
 
-# Audit Log Agent
+# Audit Log Agent — WrongStack
 
-Analyzes session logs, event streams, and system traces to surface patterns,
-anomalies, and actionable insights.
+Analyzes session logs, event streams, and system traces to surface patterns, anomalies, and actionable insights.
 
-## Capabilities
+## Workflow
 
-- Parse structured JSONL session logs
-- Detect repeated failure patterns across runs
-- Identify tool usage anomalies (over-use, misuse, failures)
-- Track token consumption trends per agent/session
-- Generate markdown audit reports
+```
+1. Collect:  Read session logs from path or sessionRoot
+2. Parse:    Extract events: tool calls, iterations, errors, usage
+3. Analyze:  Group by category, detect anomalies
+4. Report:  Structured markdown summary
+```
 
-## Workflow
+## What to look for
+
+### Tool usage patterns
+- Over-used tools (100+ calls to the same tool = possibly a loop)
+- Tools that consistently fail (repeated failures = bug or misconfiguration)
+- Unusual tool sequences (e.g., 50 writes in a row with no reads)
 
-1. **Collect** — Read session logs from `sessionRoot` or provided path
-2. **Parse** — Extract events: tool calls, iterations, errors, usage
-3. **Analyze** — Group by category, detect anomalies
-4. **Report** — Output structured markdown summary
+### Error patterns
+- Same error repeating across iterations
+- Error rate by type: what's most common?
+- Errors clustered in specific packages or tools
+
+### Cost patterns
+- Tokens per iteration: is it growing?
+- Which provider/model combination is most expensive?
+- Any unexpected cost spikes?
+
+### Context management
+- Iterations with very high tool count (possible loop)
+- Context compaction triggered frequently
+- Session that keeps restarting
 
 ## Input
 
@@ -37,31 +52,45 @@ anomalies, and actionable insights.
 }
 ```
 
-## Output Format
+## Output format
 
 ```
 ## Audit Report — <date>
 
 ### Summary
-- Total sessions: N
+- Total iterations: N
 - Total tool calls: N
 - Error rate: X%
+- Cost: $X.XX
 
-### Top Errors
-1. <error-type>: <count>x — <context>
-2. ...
+### Top Errors (by count)
+1. `ToolExecutionError` — 47x —集中在 `bash` tool, command timeout
+2. `PermissionDenied` — 12x — `exec` tool, no trust file entry
 
 ### Tool Usage
 | Tool | Calls | Failures | Avg Duration |
 |------|-------|----------|--------------|
-| read | 142   | 3        | 45ms         |
+| read | 142   | 3        | 45ms |
+| bash | 89    | 12       | 2300ms |
 
 ### Anomalies
-- `<pattern-detected>` — <severity: low/medium/high>
+- High bash failure rate (13.5%) — likely command timeout
+- 3 iterations with >50 tool calls — possible loop, review iteration 14
+
+### Cost Trend
+- Iteration 1-10: avg $0.04/iteration
+- Iteration 11-20: avg $0.11/iteration (context growth)
 ```
 
 ## Anti-patterns
 
-- Don't summarize what you didn't parse — be precise
-- Don't mix session paths — analyze one at a time or aggregate clearly
-- Don't skip error context — the user's log is the source of truth
+- **Don't summarize what you didn't parse** — be precise, cite the data
+- **Don't mix sessions** — analyze one at a time or aggregate clearly
+- **Don't skip error context** — the raw error message is the source of truth
+- **Don't ignore cost trends** — growing costs indicate context bloat
+- **Don't ignore repeated failures** — same tool failing 5x = real issue
+
+## Skills in scope
+
+- `bug-hunter` — for turning audit findings into concrete bugs to fix
+- `refactor-planner` — for addressing systemic issues found in logs

package/skills/bug-hunter/SKILL.md

@@ -1,87 +1,111 @@
 ---
 name: bug-hunter
 description: |
-  Systematic bug and code smell detection. Covers static analysis patterns,
-  anti-pattern recognition, error-prone construct detection, and severity ranking.
-  Use before refactoring or as a standalone health check.
-version: 1.0.0
+  Use this skill when scanning source code for bugs, anti-patterns, code smells,
+  or quality issues in a WrongStack project. Triggers: user says "bug", "bug hunt",
+  "scan for issues", "find problems", "anti-pattern", "code smell", "static analysis".
+version: 1.1.0
 ---
 
-# Bug Hunter Agent
+# Bug Hunter — WrongStack
 
-Scans source code for bugs, anti-patterns, and code smells using pattern matching
-and heuristics. Outputs a prioritized hit list with file:line references.
+Scans code for bugs and code smells. Outputs a prioritized hit list with file:line references.
 
-## Capabilities
+## Workflow
 
-- Detect common bug patterns (uncaught errors, resource leaks, race conditions)
-- Identify anti-patterns (callback hell, God objects, circular deps)
-- Find TypeScript-specific issues (unsafe any, missing null checks)
-- Flag security-sensitive constructs (eval, innerHTML, hardcoded secrets)
-- Rank findings by severity: critical > high > medium > low
+```
+1. Scope:  Accept file/dir globs or explicit paths
+2. Scan:   grep/read across target files
+3. Classify: Categorize by type and severity
+4. Rank:   Sort: critical > high > medium > low
+5. Report: Markdown with fix suggestions
+```
 
-## Workflow
+## Severity levels
+
+| Level | Meaning | Action |
+|-------|---------|--------|
+| **Critical** | Security breach, data loss, crash | Fix immediately |
+| **High** | Logic bug, race condition, memory leak | Fix before release |
+| **Medium** | Error handling gap, type unsafety | Fix soon |
+| **Low** | Style, minor code smell | Consider fixing |
+
+## Bug patterns to find
+
+```
+| Pattern | Regex hint | Severity |
+|---------|------------|----------|
+| Uncaught promise | /\.then\([^]*\.catch/ but missing catch | high |
+| Event listener leak | `on(` without `off/removeListener` | high |
+| Hardcoded secret | `[A-Za-z0-9/+=]{40}` in config or code | critical |
+| unsafe any | `: any\b` or `as any` | medium |
+| innerHTML assignment | `innerHTML\s*=` | high |
+| Missing await | `await` not used on async call | high |
+| Unhandled rejection | `process.on('unhandledRejection'` | medium |
+| SQL concatenation | `"SELECT * FROM " + table` | critical |
+| Shell injection | `exec(\`cmd ${input}\`)` | critical |
+```
+
+## Real examples
+
+```typescript
+// ❌ CRITICAL — hardcoded API key
+const apiKey = "sk-abc123xyz789...";
+
+// ❌ HIGH — innerHTML XSS
+element.innerHTML = userInput;
 
-1. **Scope** — Accept file/dir globs or explicit paths
-2. **Scan** — Run grep/read across target files
-3. **Classify** — Categorize findings by type and severity
-4. **Rank** — Sort by severity, then frequency
-5. **Report** — Markdown output with fix suggestions
-
-## Input
-
-```json
-{
-  "task": "scan | hunt | check",
-  "paths": ["src/**/*.ts", "lib/*.js"],
-  "focus": "bugs | patterns | security | all",
-  "severityThreshold": "medium"
-}
+// ❌ HIGH — unhandled promise (then without catch)
+fetchData().then(processData);
+
+// ❌ HIGH — shell injection
+exec(`echo ${userInput}`);
+
+// ❌ HIGH — unsafe any
+const data: any = response.json();
+
+// ✅ FIXED — use textContent
+element.textContent = userInput;
+
+// ✅ FIXED — parameterized query
+db.query("SELECT * FROM users WHERE id = $1", [userId]);
 ```
 
-## Output Format
+## Anti-patterns
+
+- **Don't scan `node_modules`** — waste of time, false positives
+- **Don't report without file:line** — useless for fixing
+- **Don't ignore false positive rate** — if >30% of findings are noise, note it
+- **Don't report style issues as bugs** — those are lint findings
+- **Don't flag deprecated without severity** — some deprecations are fine
+
+## Output format
 
 ```
 ## Bug Hunt Report — <scope>
 
 ### Critical (must fix)
-1. **[RACE]** `src/auth.ts:47` — setTimeout without clearTimeout in loop
-2. **[SECRET]** `lib/config.ts:12` — hardcoded API key detected
+1. [SHELL-INJ] `tools/shell.ts:42` — template literal in exec()
+   `exec(\`echo ${userInput}\`)` → use execFile with args array
+2. [SECRET] `lib/config.ts:8` — API key hardcoded
 
-### High (should fix)
-3. **[MEMORY]** `tools/pool.ts:89` — event listener never removed
-4. **[TYPE]** `core/agent.ts:103` — unsafe `any` cast loses type safety
+### High
+3. [MEMORY] `tools/pool.ts:89` — event listener never removed
+4. [TYPE] `core/agent.ts:103` — unsafe `any` cast
 
-### Medium
-...
-
-### Low (consider)
-...
-
-## Summary
+### Summary
 | Severity | Count |
 |----------|-------|
-| Critical | 2     |
-| High     | 4     |
-| Medium   | 7     |
-| Low      | 3     |
+| Critical | 2 |
+| High     | 4 |
+| Medium   | 7 |
+| Low      | 3 |
 
 Total: 16 findings in 12 files
 ```
 
-## Bug Pattern Reference
-
-| Pattern | Regex Hint | Severity |
-|---------|------------|----------|
-| Uncaught promise | `\.then\(` without `catch` | high |
-| Event leak | `on\(` without `off`/`removeListener` | high |
-| Hardcoded secret | `[a-zA-Z0-9/_-]{20,}` in config | critical |
-| unsafe any | `: any\b` or `<any>` | medium |
-| innerHTML | `innerHTML\s*=` | high |
-| TODO without FIXME | `TODO(?!.*FIXME)` | low |
-
-## Anti-patterns
+## Skills in scope
 
-- Don't scan node_modules — waste of time and false positives
-- Don't report without file:line — useless for fixing
-- Don't ignore false positive rates — if >30% of findings are noise, lower confidence
+- `security-scanner` — for hardcoded secrets and injection vectors
+- `refactor-planner` — for fixing findings across multiple files
+- `typescript-strict` — for type-safety related findings

package/skills/git-flow/SKILL.md

@@ -1,32 +1,87 @@
 ---
 name: git-flow
 description: |
-  Use this skill when proposing, creating, or reviewing git commits, branches,
-  and PRs. Covers commit message style, branch hygiene, and safe history operations.
-version: 1.0.0
+  Use this skill when proposing, reviewing, or troubleshooting git commits,
+  branches, pull requests, or merge strategies in a WrongStack project session.
+  Triggers: user mentions "commit", "branch", "PR", "merge", "rebase", "stash", "diff".
+version: 1.1.0
 ---
 
-# Git workflow
+# Git Workflow — WrongStack
 
-## Commits
+## Commit messages
 
-- Subject line: imperative mood, ≤ 72 chars, no trailing period.
-- Body: explain *why*, not *what* (the diff shows what).
-- Group by intent, not by file.
+Format: `type: short description`
 
-## Branches
+Types: `fix`, `feat`, `docs`, `refactor`, `test`, `chore`, `perf`, `ci`
 
-- One topic per branch. Rebase before merging when safe.
-- Delete branches after merge.
+Rules:
+- Subject ≤ 72 chars, imperative mood, no trailing period
+- Body: explain **why**, not what (the diff shows what)
+- Reference issues: `Fix #123` or `Closes GH-456`
+
+```
+# Good
+fix: correct race condition in token refresh
+Retry logic now respects backoff multiplier. Without this,
+repeated failures would hammer the provider instead of backing off.
+
+# Bad — what, not why
+fix: fixed bug
+```
+
+## Branch strategy
+
+- One topic per branch: `feat/login`, `fix/session-leak`, `refactor/auth-layer`
+- Delete branches after merge (unless shared/releasing)
+- Rebase onto `main` before PR when safe (cleaner history)
+- Never `git push --force` to shared branches — use `--force-with-lease`
 
 ## Safety rules
 
-- Never `git push --force` to shared branches (use `--force-with-lease` for your own).
-- Never `git reset --hard` without inspecting `git status` first.
-- Don't amend already-pushed commits to shared branches.
+| Action | Safe? | Rule |
+|--------|-------|------|
+| `push --force` to own branch | ✅ | `--force-with-lease` preferred |
+| `push --force` to shared branch | ❌ | Always use PR + merge |
+| `reset --hard` with uncommitted work | ❌ | `git stash` first |
+| `amend` a pushed commit | ❌ | It rewrites shared history |
+| `merge` vs `rebase` | Context | Rebase for feature branches; merge for PRs |
+
+## Pull requests
+
+- Title: same format as commit messages
+- Body: link to issue, describe tradeoffs, list changed files
+- Keep PRs small: one reviewable concern per PR
+- Self-review diff before requesting review
+
+## Merge strategies
+
+```
+# Fast-forward merge (clean topic branch)
+git checkout feature && git merge --ff-only main
+
+# Merge commit (preserves branch history)
+git merge --no-ff feature
+
+# Rebase and fast-forward (clean linear history)
+git rebase main && git merge --ff-only feature
+```
+
+## WrongStack-specific notes
+
+- WrongStack uses `pnpm` workspaces — `git status` may show many modified files across packages
+- Use `pnpm -r` for recursive commands across packages
+- Check `pnpm-lock.yaml` changes — don't merge lockfile updates with unrelated changes
+- When in doubt: small, frequent commits with clear messages beat large, vague ones
+
+## Anti-patterns
+
+- **Mega-commits**: "Update stuff" across 15 packages — split it
+- **WIP commits left in main**: Use `git stash` or a feature branch, not a commit message like "WIP"
+- **Committing lockfile with logic changes**: Keep them separate for easier rollbacks
+- **Branching from branches**: Always branch from `main` or a stable release tag
 
-## PRs
+## Skills in scope
 
-- Subject summarizes the change, body links the issue and lists tradeoffs.
-- Keep PRs small: one reviewable change per PR.
-- Self-review the diff before requesting review.
+- `refactor-planner` — when a refactor involves multiple git-managed changes
+- `multi-agent` — for fleet-wide version audits across packages

package/skills/multi-agent/SKILL.md

@@ -1,62 +1,91 @@
 ---
 name: multi-agent
 description: |
-  Multi-agent orchestration workflow. Covers leader/worker roles,
-  task delegation, done conditions, and result aggregation.
-  Use for parallel task execution.
-version: 1.0.0
+  Use this skill when a task would benefit from parallel execution across
+  multiple AI agents, or when orchestrating leader/worker patterns in WrongStack.
+  Triggers: user says "fan out", "parallel", "delegate", "subagent", "fleet", "coordinator".
+version: 1.1.0
 ---
 
-# Multi-Agent Coordination
+# Multi-Agent Coordination — WrongStack
 
-Guide for orchestrating multiple agents to work together on complex tasks.
+## When to fan out
 
-## When to use multiple agents
+✅ Good fits:
+- "Audit these 50 files for X" — one subagent per chunk of 5-10 files
+- "Run tests in all 12 packages" — parallel `pnpm test` across packages
+- "Refactor 3 independent modules" — separate agents for each
+- "Review this PR + check the tests + check docs" — three parallel workers
 
-- Large refactoring across multiple modules
-- Parallel feature development
-- Code review + implementation simultaneously
-- Any task where separation of concerns speeds things up
+❌ Avoid:
+- Single atomic task under 5 tool calls — overhead exceeds benefit
+- Tasks requiring shared state — subagents have isolated contexts
+- Long sequential dependencies — chain within one agent, don't fan out
 
-## Agent roles
+## Roles
 
-Define clear roles to avoid overlap:
+| Role | Responsibility | Tools |
+|------|---------------|-------|
+| **Leader** | Coordinates, delegates, synthesizes | `delegate`, `plan`, `read` |
+| **Worker** | Executes a narrow subtask | Any needed tools |
+| **Reviewer** | Validates worker output, approves/rejects | `grep`, `test`, `read` |
+| **Architect** | Makes design decisions when workers hit ambiguity | `read`, `glob`, `grep` |
 
-- **Leader** — Coordinates, delegates, synthesizes
-- **Worker** — Executes specific tasks
-- **Reviewer** — Reviews and approves
-- **Architect** — Makes design decisions
-- **Debugger** — Root cause analysis
+## Delegation patterns
 
-## Task delegation principles
+### One-shot fan-out (all workers in one turn)
 
-1. **Atomic tasks** — Each task should be independently executable
-2. **Clear boundaries** — Tasks should not overlap
-3. **Dependency awareness** — Respect task dependencies
-4. **Result aggregation** — Leader synthesizes worker results
+```
+batch_tool_use([
+  { tool: "delegate", input: { task: "Audit auth/session.ts for null-deref bugs", role: "bug-hunter" }},
+  { tool: "delegate", input: { task: "Audit auth/token.ts for null-deref bugs", role: "bug-hunter" }},
+  { tool: "delegate", input: { task: "Audit auth/refresh.ts for null-deref bugs", role: "bug-hunter" }},
+])
+```
 
-## Communication
+### Fleet pattern (stateful, multiple turns)
+
+```
+delegate → spawn N subagents → assign_task per subagent → await_tasks
+```
 
-Agents communicate via structured messages:
+Use this when the task has dependencies — subagent 2 waits for subagent 1's artifact.
+
+## Communication
 
-- `task` — Assign work
-- `result` — Return output
-- `progress` — Status updates
-- `error` — Failures
-- `stop` — Cancellation
+Workers return structured results. Read `stopReason`:
+- `end_turn` — clean finish, check `result`
+- `budget_exhausted` — task too broad, narrow and retry
+- `error` — infrastructure issue, surface it to user
+- `aborted` — user cancelled, don't retry silently
 
-## Done conditions
+## Result aggregation
 
-Choose appropriate done condition:
+Leader collects and synthesizes:
 
-- `all_tasks_done` — Wait for all tasks
-- `critical_path_done` — Wait for critical path
-- `first_completion` — Stop at first success
-- `max_iterations` — Bounded execution
+```
+For each worker result:
+  - Extract key findings (don't just paste raw output)
+  - Deduplicate (multiple workers may find the same issue)
+  - Prioritize: critical > high > medium > low
+  - Present as unified report
+```
 
 ## Anti-patterns
 
-- Over-delegation — Don't fragment work too much
-- Under-delegation — Single agent bottleneck
-- Role confusion — Workers doing leadership work
-- Result loss — Not aggregating agent outputs
+- **Over-delegation**: Firing 50 subagents in one turn — model context explodes, nothing gets done
+- **Under-delegation**: One agent doing everything — defeats the purpose, burns budget
+- **Role mismatch**: Using `bug-hunter` to write documentation, or `refactor-planner` for security audits
+- **Result loss**: Subagents return useful data but leader doesn't aggregate — always check `result`
+- **Silent failure**: `budget_exhausted` subagent output ignored — partial results are still results
+
+## Context sharing
+
+Subagents share **nothing** — no memory, no session state, no variable scope. If subagent B needs output from subagent A, the leader must pass it explicitly as part of the task description or pass it via a shared file the leader writes before delegating.
+
+## Skills in scope
+
+- `bug-hunter` — parallel file audits
+- `security-scanner` — parallel security scans
+- `refactor-planner` — parallel module analysis
+- `audit-log` — aggregating multiple session analyses