@wrongstack/core 0.8.6 → 0.9.1

package/dist/infrastructure/index.d.ts

@@ -1,10 +1,10 @@
 export { D as DefaultLogger, a as DefaultLoggerOptions } from '../logger-bOzkF5LL.js';
-export { D as DefaultPathResolver, a as DefaultTokenCounter } from '../path-resolver-DnC1nOjb.js';
-export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, s as sentinelServer, p as slackServer, z as zaiVisionServer } from '../mcp-servers-n2L9ohMX.js';
+export { D as DefaultPathResolver, a as DefaultTokenCounter } from '../path-resolver-TcJfc29Y.js';
+export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, s as sentinelServer, p as slackServer, z as zaiVisionServer } from '../mcp-servers-jEoMIBZv.js';
 import '../logger-DDd5C--Z.js';
-import '../events-yCpJD4wa.js';
-import '../context-z2x5gv_V.js';
+import '../events-CiG9qUM_.js';
+import '../context-BRNbHmRM.js';
 import '../models-registry-BcYJDKLm.js';
 import '../path-resolver-CPRj4bFY.js';
-import '../compactor-Mw7-rNyb.js';
-import '../config-Bi4Q0fnz.js';
+import '../compactor-DVTKL7XD.js';
+import '../config-DoUAEvXH.js';

package/dist/kernel/index.d.ts

@@ -1,17 +1,17 @@
-export { B as BindOptions, C as Container, D as Decorator, F as Factory, M as Middleware, b as MiddlewareHandler, N as NextFn, P as Pipeline, d as PipelineOptions, T as Token } from '../system-prompt-CWA6ml-d.js';
-export { E as EventBus, a as EventLogger, b as EventMap, c as EventName, L as Listener, S as ScopedEventBus } from '../events-yCpJD4wa.js';
-export { R as RunController, b as RunControllerOptions, T as TOKENS } from '../index-BvZld4Dr.js';
-import '../context-z2x5gv_V.js';
-import '../compactor-Mw7-rNyb.js';
-import '../config-Bi4Q0fnz.js';
+export { B as BindOptions, C as Container, D as Decorator, F as Factory, M as Middleware, b as MiddlewareHandler, N as NextFn, P as Pipeline, d as PipelineOptions, T as Token } from '../system-prompt-Bs-Wliab.js';
+export { E as EventBus, a as EventLogger, b as EventMap, c as EventName, L as Listener, S as ScopedEventBus } from '../events-CiG9qUM_.js';
+export { R as RunController, b as RunControllerOptions, T as TOKENS } from '../index-u2ROAV0F.js';
+import '../context-BRNbHmRM.js';
+import '../compactor-DVTKL7XD.js';
+import '../config-DoUAEvXH.js';
 import '../models-registry-BcYJDKLm.js';
-import '../retry-policy-OwtKNxo8.js';
+import '../retry-policy-BYkq0ugs.js';
 import '../input-reader-E-ffP2ee.js';
 import '../logger-DDd5C--Z.js';
 import '../memory-CEXuo7sz.js';
 import '../mode-CV077NjV.js';
 import '../path-resolver-CPRj4bFY.js';
-import '../secret-scrubber-CyE1-EMG.js';
-import '../provider-runner-C4ouU7--.js';
+import '../secret-scrubber-DttNiGYA.js';
+import '../provider-runner-BEpikbbN.js';
 import '../observability-BhnVLBLS.js';
 import '../skill-CxuWrsKK.js';

package/dist/{mcp-servers-n2L9ohMX.d.ts → mcp-servers-jEoMIBZv.d.ts}

@@ -1,6 +1,6 @@
-import { a as Compactor } from './compactor-Mw7-rNyb.js';
-import { M as Message, Q as Tool } from './context-z2x5gv_V.js';
-import { M as MCPServerConfig } from './config-Bi4Q0fnz.js';
+import { a as Compactor } from './compactor-DVTKL7XD.js';
+import { M as Message, Q as Tool } from './context-BRNbHmRM.js';
+import { M as MCPServerConfig } from './config-DoUAEvXH.js';
 
 type ContextManagerAction = 'check' | 'summary' | 'prune' | 'add_note' | 'compact' | 'repair';
 interface ContextManagerInput {

package/dist/models/index.d.ts

@@ -1,7 +1,7 @@
 export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from '../models-registry-OG_30xqZ.js';
 import { c as ModeStore, a as ModeConfig, M as Mode } from '../mode-CV077NjV.js';
-import { m as Provider, M as Message } from '../context-z2x5gv_V.js';
-import { M as MessageSelector, S as SelectorResult } from '../selector-DkvgYVS4.js';
+import { m as Provider, M as Message } from '../context-BRNbHmRM.js';
+import { M as MessageSelector, S as SelectorResult } from '../selector-pox8abg0.js';
 import '../models-registry-BcYJDKLm.js';
 
 declare class DefaultModeStore implements ModeStore {

package/dist/{multi-agent-C8uY45AY.d.ts → multi-agent-3ZnTB1aT.d.ts}

@@ -1,5 +1,5 @@
-import { $ as Usage } from './context-z2x5gv_V.js';
-import { E as EventBus } from './events-yCpJD4wa.js';
+import { $ as Usage } from './context-BRNbHmRM.js';
+import { E as EventBus } from './events-CiG9qUM_.js';
 
 type BridgeMessageType = 'task' | 'result' | 'progress' | 'error' | 'heartbeat' | 'stop' | 'delegate' | 'budget_threshold';
 interface BridgeMessage<T = unknown> {

package/dist/{multi-agent-coordinator-C7YbZUY8.d.ts → multi-agent-coordinator-COwCGIrU.d.ts}

@@ -1,5 +1,5 @@
-import { n as SubagentConfig, l as MultiAgentCoordinator, M as MultiAgentConfig, t as SubagentRunner, S as SpawnResult, v as TaskSpec, B as BridgeMessage, A as AgentBridge, k as CoordinatorStatus, u as TaskResult } from './multi-agent-C8uY45AY.js';
-import { F as FleetBus } from './agent-subagent-runner-Cc8sRJOF.js';
+import { n as SubagentConfig, l as MultiAgentCoordinator, M as MultiAgentConfig, t as SubagentRunner, S as SpawnResult, v as TaskSpec, B as BridgeMessage, A as AgentBridge, k as CoordinatorStatus, u as TaskResult } from './multi-agent-3ZnTB1aT.js';
+import { F as FleetBus } from './agent-subagent-runner-R0I0Xusn.js';
 import { EventEmitter } from 'node:events';
 
 /**

package/dist/{null-fleet-bus-Bb2jVLKr.d.ts → null-fleet-bus-C1grTnOF.d.ts}

@@ -1,10 +1,10 @@
-import { c as AgentPhase, b as AgentDefinition, d as DefaultMultiAgentCoordinator, f as DispatchClassifier } from './multi-agent-coordinator-C7YbZUY8.js';
-import { n as SubagentConfig, u as TaskResult, k as CoordinatorStatus, v as TaskSpec, M as MultiAgentConfig, t as SubagentRunner } from './multi-agent-C8uY45AY.js';
-import { B as SessionWriter, Q as Tool, y as SessionStore } from './context-z2x5gv_V.js';
+import { c as AgentPhase, b as AgentDefinition, d as DefaultMultiAgentCoordinator, f as DispatchClassifier } from './multi-agent-coordinator-COwCGIrU.js';
+import { n as SubagentConfig, u as TaskResult, k as CoordinatorStatus, v as TaskSpec, M as MultiAgentConfig, t as SubagentRunner } from './multi-agent-3ZnTB1aT.js';
+import { B as SessionWriter, Q as Tool, y as SessionStore } from './context-BRNbHmRM.js';
 import { a as DirectorStateSnapshot } from './director-state-BmYi3DGA.js';
-import { I as InMemoryAgentBridge } from './agent-bridge-Bad3ZGQ7.js';
-import { F as FleetBus, e as FleetUsage, f as FleetUsageAggregator } from './agent-subagent-runner-Cc8sRJOF.js';
-import { E as EventBus } from './events-yCpJD4wa.js';
+import { I as InMemoryAgentBridge } from './agent-bridge-DMVOX0cF.js';
+import { F as FleetBus, e as FleetUsage, f as FleetUsageAggregator } from './agent-subagent-runner-R0I0Xusn.js';
+import { E as EventBus } from './events-CiG9qUM_.js';
 
 /**
  * Agent catalog aggregator.

package/dist/observability/index.d.ts

@@ -1,6 +1,6 @@
 import { e as MetricsSink, M as MetricLabels, f as MetricsSnapshot, b as HealthRegistry, H as HealthCheck, A as AggregateHealth, T as Tracer, S as Span } from '../observability-BhnVLBLS.js';
-import { E as EventBus } from '../events-yCpJD4wa.js';
-import '../context-z2x5gv_V.js';
+import { E as EventBus } from '../events-CiG9qUM_.js';
+import '../context-BRNbHmRM.js';
 
 /**
  * In-memory metrics sink. Suitable for embedded use, tests, and /metrics

package/dist/{path-resolver-DnC1nOjb.d.ts → path-resolver-TcJfc29Y.d.ts}

@@ -1,6 +1,6 @@
-import { E as EventBus } from './events-yCpJD4wa.js';
+import { E as EventBus } from './events-CiG9qUM_.js';
 import { b as ModelsRegistry, R as ResolvedModel } from './models-registry-BcYJDKLm.js';
-import { O as TokenCounter, $ as Usage, C as CacheStats } from './context-z2x5gv_V.js';
+import { O as TokenCounter, $ as Usage, C as CacheStats } from './context-BRNbHmRM.js';
 import { P as PathResolver } from './path-resolver-CPRj4bFY.js';
 
 /**

package/dist/{permission-policy-BBa1M1xc.d.ts → permission-policy-BpCGYBud.d.ts}

@@ -1,6 +1,6 @@
-import { Q as Tool, d as Context } from './context-z2x5gv_V.js';
+import { Q as Tool, d as Context } from './context-BRNbHmRM.js';
 import { I as InputReader } from './input-reader-E-ffP2ee.js';
-import { a as PermissionPolicy, P as PermissionDecision } from './secret-scrubber-CyE1-EMG.js';
+import { a as PermissionPolicy, P as PermissionDecision } from './secret-scrubber-DttNiGYA.js';
 
 interface PermissionPolicyOptions {
     trustFile: string;

package/dist/{plan-templates-Cqdy6rtM.d.ts → plan-templates-ByT1HcRI.d.ts}

@@ -1,9 +1,9 @@
-import { E as EventBus } from './events-yCpJD4wa.js';
-import { y as SessionStore, x as SessionMetadata, B as SessionWriter, r as ResumedSession, S as SessionData, z as SessionSummary, c as ContentBlock, w as SessionEvent, N as TodoItem, f as ConversationState } from './context-z2x5gv_V.js';
-import { e as AttachmentStore, A as AddAttachmentInput, d as AttachmentRef, a as Attachment } from './session-reader-DsadjyF9.js';
+import { E as EventBus } from './events-CiG9qUM_.js';
+import { y as SessionStore, x as SessionMetadata, B as SessionWriter, r as ResumedSession, S as SessionData, z as SessionSummary, c as ContentBlock, w as SessionEvent, N as TodoItem, f as ConversationState } from './context-BRNbHmRM.js';
+import { e as AttachmentStore, A as AddAttachmentInput, d as AttachmentRef, a as Attachment } from './session-reader-CSWcb5Ga.js';
 import { b as MemoryStore, a as MemoryScope } from './memory-CEXuo7sz.js';
 import { a as WstackPaths } from './wstack-paths-CJYrjQU8.js';
-import { c as ConfigStore, a as Config, b as ConfigLoader } from './config-Bi4Q0fnz.js';
+import { c as ConfigStore, a as Config, b as ConfigLoader } from './config-DoUAEvXH.js';
 import { S as SecretVault } from './secret-vault-DoISxaKO.js';
 
 interface SessionStoreOptions {
@@ -15,10 +15,15 @@ declare class DefaultSessionStore implements SessionStore {
     private readonly dir;
     private readonly events?;
     constructor(opts: SessionStoreOptions);
+    /** Join session ID to its absolute path within the store directory. */
+    private sessionPath;
+    private ensureShardDir;
     create(meta: Omit<SessionMetadata, 'startedAt'>): Promise<SessionWriter>;
     resume(id: string): Promise<ResumedSession>;
     load(id: string): Promise<SessionData>;
     list(limit?: number): Promise<SessionSummary[]>;
+    /** Recursively collect all session IDs from shard subdirectories. */
+    private collectSessionIds;
     private summaryFor;
     delete(id: string): Promise<void>;
     clearHistory(id: string): Promise<void>;
@@ -331,9 +336,14 @@ declare class RecoveryLock {
      */
     checkAbandoned(): Promise<AbandonedSession | null>;
     /**
-     * Claim the lock for the given session. Overwrites any existing lock
-     * — the caller should have already handled abandonment (via
-     * `checkAbandoned`) before calling this.
+     * Claim the lock for the given session. Uses exclusive-create (`O_EXCL`)
+     * to detect whether another process acquired the lock between our
+     * `checkAbandoned()` call and now. If the file already exists, it means
+     * another process won the race and we throw instead of silently
+     * overwriting their recovery record.
+     *
+     * The caller MUST have already called `checkAbandoned()` and handled its
+     * null return before calling this.
      */
     write(sessionId: string): Promise<void>;
     /**

package/dist/{provider-runner-C4ouU7--.d.ts → provider-runner-BEpikbbN.d.ts}

@@ -1,8 +1,8 @@
-import { E as EventBus } from './events-yCpJD4wa.js';
+import { E as EventBus } from './events-CiG9qUM_.js';
 import { a as Logger } from './logger-DDd5C--Z.js';
 import { T as Tracer } from './observability-BhnVLBLS.js';
-import { m as Provider, p as Request, d as Context, q as Response } from './context-z2x5gv_V.js';
-import { a as RetryPolicy } from './retry-policy-OwtKNxo8.js';
+import { m as Provider, p as Request, d as Context, q as Response } from './context-BRNbHmRM.js';
+import { a as RetryPolicy } from './retry-policy-BYkq0ugs.js';
 
 /**
  * Options passed to a ProviderRunner when calling the provider.

package/dist/{retry-policy-OwtKNxo8.d.ts → retry-policy-BYkq0ugs.d.ts}

@@ -1,4 +1,4 @@
-import { q as Response, d as Context, n as ProviderError } from './context-z2x5gv_V.js';
+import { q as Response, d as Context, n as ProviderError } from './context-BRNbHmRM.js';
 
 type RecoveryDecision = {
     /**

package/dist/sdd/index.d.ts

@@ -1,14 +1,14 @@
 import { h as Specification, S as SpecAnalysis, g as SpecValidationResult, l as TaskGraph, m as TaskNode, k as TaskFilter, p as TaskSort, o as TaskProgress, r as TaskType, n as TaskPriority, e as SpecStatus, f as SpecTemplate, b as SpecRequirement } from '../task-graph-D1YQbpxF.js';
-import { E as EventBus } from '../events-yCpJD4wa.js';
-import { D as DoneCondition, u as TaskResult } from '../multi-agent-C8uY45AY.js';
-import { c as Agent } from '../index-SxpnwRlJ.js';
-import { A as AgentFactory } from '../agent-subagent-runner-Cc8sRJOF.js';
-import '../context-z2x5gv_V.js';
+import { E as EventBus } from '../events-CiG9qUM_.js';
+import { D as DoneCondition, u as TaskResult } from '../multi-agent-3ZnTB1aT.js';
+import { c as Agent } from '../index-bOl8lzFV.js';
+import { A as AgentFactory } from '../agent-subagent-runner-R0I0Xusn.js';
+import '../context-BRNbHmRM.js';
 import '../logger-DDd5C--Z.js';
-import '../system-prompt-CWA6ml-d.js';
+import '../system-prompt-Bs-Wliab.js';
 import '../observability-BhnVLBLS.js';
-import '../secret-scrubber-CyE1-EMG.js';
-import '../config-Bi4Q0fnz.js';
+import '../secret-scrubber-DttNiGYA.js';
+import '../config-DoUAEvXH.js';
 import '../models-registry-BcYJDKLm.js';
 
 declare class SpecParser {

package/dist/{secret-scrubber-CyE1-EMG.d.ts → secret-scrubber-DttNiGYA.d.ts}

@@ -1,4 +1,4 @@
-import { Q as Tool, d as Context, P as Permission } from './context-z2x5gv_V.js';
+import { Q as Tool, d as Context, P as Permission } from './context-BRNbHmRM.js';
 
 interface TrustPolicy {
     [toolNameOrPattern: string]: {

package/dist/{secret-scrubber-C0n1EqrC.d.ts → secret-scrubber-QSeI0ADi.d.ts}

@@ -1,5 +1,5 @@
 import { S as SecretVault } from './secret-vault-DoISxaKO.js';
-import { S as SecretScrubber } from './secret-scrubber-CyE1-EMG.js';
+import { S as SecretScrubber } from './secret-scrubber-DttNiGYA.js';
 
 interface SecretVaultOptions {
     /** Absolute path to the key file. Created with mode 0o600 if missing. */

package/dist/security/index.d.ts

@@ -1,8 +1,8 @@
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-scrubber-C0n1EqrC.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-BBa1M1xc.js';
+export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-scrubber-QSeI0ADi.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-BpCGYBud.js';
 import '../secret-vault-DoISxaKO.js';
-import '../secret-scrubber-CyE1-EMG.js';
-import '../context-z2x5gv_V.js';
+import '../secret-scrubber-DttNiGYA.js';
+import '../context-BRNbHmRM.js';
 import '../input-reader-E-ffP2ee.js';
 
 declare function isSecretField(name: string): boolean;

package/dist/security/index.js

@@ -48,7 +48,10 @@ var PATTERNS = [
     type: "bearer_token",
     // Anchored with alternation instead of negative lookahead — avoids V8
     // backtracking risk on adversarial input. Bounded at 512 chars.
-    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{20,512}=*(?:$|[^A-Za-z0-9_.~+/-])/g
+    // Min 12 chars: some OAuth providers issue shorter-lived tokens (< 20
+    // chars). A 12-char base64 string has ~71 bits of entropy — above the
+    // threshold where random strings are unlikely to produce false matches.
+    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?:$|[^A-Za-z0-9_.~+/-])/g
   },
   {
     type: "high_entropy_env",
@@ -609,7 +612,7 @@ var DefaultPermissionPolicy = class {
         return { permission: "auto", source: "context", reason: "file already read in this session" };
       }
     }
-    if (tool.permission === "auto") {
+    if (tool.permission === "auto" && !tool.mutating) {
       return { permission: "auto", source: "default" };
     }
     if (this.promptDelegate) {