@wrongstack/core 0.9.7 → 0.9.20

package/dist/storage/index.js

@@ -1,6 +1,6 @@
 import { randomBytes, randomUUID, createHash } from 'crypto';
 import * as fsp from 'fs/promises';
-import * as path7 from 'path';
+import * as path11 from 'path';
 import * as os from 'os';
 
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
@@ -10,9 +10,9 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 async function atomicWrite(targetPath, content, opts = {}) {
-  const dir = path7.dirname(targetPath);
+  const dir = path11.dirname(targetPath);
   await fsp.mkdir(dir, { recursive: true });
-  const tmp = path7.join(dir, `.${path7.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
+  const tmp = path11.join(dir, `.${path11.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
   try {
     if (typeof content === "string") {
       await fsp.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
@@ -170,13 +170,15 @@ function isEmptyMessage(msg) {
 var DefaultSessionStore = class {
   dir;
   events;
+  secretScrubber;
   constructor(opts) {
     this.dir = opts.dir;
     this.events = opts.events;
+    this.secretScrubber = opts.secretScrubber;
   }
   /** Join session ID to its absolute path within the store directory. */
   sessionPath(id, ext) {
-    return path7.join(this.dir, `${id}${ext}`);
+    return path11.join(this.dir, `${id}${ext}`);
   }
   async ensureShardDir(_id) {
     await ensureDir(this.dir);
@@ -186,7 +188,7 @@ var DefaultSessionStore = class {
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const id = meta.id ?? `${startedAt.replace(/[:.]/g, "-")}-${randomBytes(2).toString("hex")}`;
     const shardDir = await this.ensureShardDir(id);
-    const file = path7.join(shardDir, `${id}.jsonl`);
+    const file = path11.join(shardDir, `${id}.jsonl`);
     let handle;
     try {
       handle = await fsp.open(file, "a", 384);
@@ -197,7 +199,11 @@ var DefaultSessionStore = class {
       );
     }
     try {
-      return new FileSessionWriter(id, handle, startedAt, meta, this.events, { dir: shardDir, filePath: file });
+      return new FileSessionWriter(id, handle, startedAt, meta, this.events, {
+        dir: shardDir,
+        filePath: file,
+        secretScrubber: this.secretScrubber
+      });
     } catch (err) {
       await handle.close().catch(() => {
       });
@@ -227,7 +233,7 @@ var DefaultSessionStore = class {
           provider: data.metadata.provider
         },
         this.events,
-        { resumed: true, dir: this.dir, filePath: file }
+        { resumed: true, dir: this.dir, filePath: file, secretScrubber: this.secretScrubber }
       );
       return { writer, data };
     } catch (err) {
@@ -275,7 +281,7 @@ var DefaultSessionStore = class {
     const ids = [];
     const entries = await fsp.readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = path7.join(dir, entry.name);
+      const full = path11.join(dir, entry.name);
       if (entry.isDirectory()) {
         ids.push(...await this.collectSessionIds(full));
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
@@ -431,8 +437,9 @@ var FileSessionWriter = class {
     this.meta = meta;
     this.events = events;
     this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path7.join(opts.dir, `${id}.summary.json`) : "";
+    this.manifestFile = opts.dir ? path11.join(opts.dir, `${id}.summary.json`) : "";
     this.filePath = opts.filePath ?? "";
+    this.secretScrubber = opts.secretScrubber;
     this.summary = {
       id,
       title: "(empty session)",
@@ -461,7 +468,29 @@ var FileSessionWriter = class {
   resumed;
   appendFailCount = 0;
   lastAppendWarnAt = 0;
-  promptIndex = 0;
+  secretScrubber;
+  /**
+   * Scrub secrets out of conversation-turn events before they are observed
+   * for the summary, written to the JSONL log, or surfaced on resume. Only
+   * `user_input` / `llm_response` carry free-form user/model text; other event
+   * types either have no secret-bearing content or are already scrubbed
+   * upstream (tool results). Returns the event unchanged when no scrubber is
+   * configured.
+   */
+  scrubEvent(event) {
+    const s = this.secretScrubber;
+    if (!s) return event;
+    if (event.type === "user_input") {
+      return {
+        ...event,
+        content: typeof event.content === "string" ? s.scrub(event.content) : s.scrubObject(event.content)
+      };
+    }
+    if (event.type === "llm_response") {
+      return { ...event, content: s.scrubObject(event.content) };
+    }
+    return event;
+  }
   pendingFileSnapshots = [];
   /** Tracks open tool_use IDs during the current run to serialize on close for resume. */
   openToolUses = /* @__PURE__ */ new Set();
@@ -493,9 +522,10 @@ var FileSessionWriter = class {
       this.initDone = true;
       await this.writeSessionStartLazy();
     }
-    this.observeForSummary(event);
+    const scrubbed = this.scrubEvent(event);
+    this.observeForSummary(scrubbed);
     try {
-      await this.handle.appendFile(`${JSON.stringify(event)}
+      await this.handle.appendFile(`${JSON.stringify(scrubbed)}
 `, "utf8");
     } catch (err) {
       this.appendFailCount++;
@@ -551,7 +581,6 @@ var FileSessionWriter = class {
       await this.writeFileSnapshot(promptIndex, [...this.pendingFileSnapshots]);
       this.pendingFileSnapshots = [];
     }
-    this.promptIndex = promptIndex + 1;
     await this.append({
       type: "checkpoint",
       ts: (/* @__PURE__ */ new Date()).toISOString(),
@@ -647,6 +676,38 @@ var FileSessionWriter = class {
 `;
     await fsp.writeFile(this.filePath, record, "utf8");
   }
+  /**
+   * Idea #1 — write an in-flight marker. The agent loop should call
+   * this at the start of each long-running operation; a matching
+   * `clearInFlightMarker` follows on clean exit. A stale marker
+   * (no end) is what `SessionRecovery.detectStale` looks for.
+   */
+  async writeInFlightMarker(context) {
+    if (!context || context.length > 500) {
+      throw new Error("In-flight context must be 1..500 chars");
+    }
+    await this.append({
+      type: "in_flight_start",
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      context
+    });
+    this.events?.emit("in_flight.started", { context, ts: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+  /**
+   * Idea #1 — close the in-flight marker. Idempotent in spirit
+   * (you can call it after a successful iteration even if you
+   * didn't open one this round) — but the session log records
+   * every call so postmortem tooling can see "the agent finished
+   * cleanly X times, then died without finishing Y".
+   */
+  async clearInFlightMarker(reason) {
+    await this.append({
+      type: "in_flight_end",
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      reason
+    });
+    this.events?.emit("in_flight.ended", { reason, ts: (/* @__PURE__ */ new Date()).toISOString() });
+  }
 };
 function userInputTitle(content) {
   const text = typeof content === "string" ? content : content.filter((b) => b.type === "text").map((b) => b.text).join(" ");
@@ -655,7 +716,7 @@ function userInputTitle(content) {
 var QueueStore = class {
   file;
   constructor(opts) {
-    this.file = path7.join(opts.dir, "queue.json");
+    this.file = path11.join(opts.dir, "queue.json");
   }
   async write(items) {
     if (items.length === 0) {
@@ -722,7 +783,7 @@ var DefaultAttachmentStore = class {
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
       await fsp.mkdir(this.spoolDir, { recursive: true });
-      spooledPath = path7.join(this.spoolDir, `${id}.bin`);
+      spooledPath = path11.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
       });
@@ -892,7 +953,7 @@ ${body.trim()}`);
   async remember(text, scope = "project-memory") {
     return this.runSerialized(scope, async () => {
       const file = this.files[scope];
-      await ensureDir(path7.dirname(file));
+      await ensureDir(path11.dirname(file));
       let existing = "";
       try {
         existing = await fsp.readFile(file, "utf8");
@@ -1349,6 +1410,40 @@ var DefaultConfigLoader = class {
     }
     return Object.freeze(cfg);
   }
+  /**
+   * Persist a sync config to ~/.wrongstack/sync.json, with the token encrypted
+   * by the vault (if provided). The file is isolated from the main config
+   * hierarchy to prevent accidental commits.
+   */
+  async persistSyncConfig(cfg) {
+    let toWrite = { ...cfg };
+    if (this.vault && toWrite.githubToken && !toWrite.githubToken.startsWith("enc:")) {
+      toWrite = { ...toWrite, githubToken: this.vault.encrypt(toWrite.githubToken) };
+    }
+    await atomicWrite(this.paths.syncConfig, JSON.stringify(toWrite, null, 2), { mode: 384 });
+  }
+  /**
+   * Read ~/.wrongstack/sync.json (encrypted GitHub token storage) and decrypt
+   * the token if a vault is available. Returns null if the file doesn't exist.
+   * This is separate from main config loading because sync.json is intentionally
+   * isolated — it should never be part of project-local or env-driven config.
+   */
+  async loadSyncConfig() {
+    try {
+      const raw = await fsp.readFile(this.paths.syncConfig, "utf8");
+      const parsed = safeParse(raw);
+      if (!parsed.ok || !parsed.value) return null;
+      if (this.vault) {
+        const decrypted = decryptConfigSecrets({ sync: parsed.value }, this.vault);
+        return decrypted.sync ?? null;
+      }
+      return parsed.value;
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      console.warn("[config] Failed to load sync config:", err);
+      return null;
+    }
+  }
   async readJson(file) {
     let raw;
     try {
@@ -1464,7 +1559,7 @@ var RecoveryLock = class {
   sessionStore;
   probe;
   constructor(opts) {
-    this.file = path7.join(opts.dir, LOCK_FILE);
+    this.file = path11.join(opts.dir, LOCK_FILE);
     this.pid = opts.pid ?? process.pid;
     this.hostname = opts.hostname ?? os.hostname();
     this.maxAgeMs = opts.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
@@ -1522,7 +1617,7 @@ var RecoveryLock = class {
    * null return before calling this.
    */
   async write(sessionId) {
-    await ensureDir(path7.dirname(this.file));
+    await ensureDir(path11.dirname(this.file));
     const lock = {
       v: 1,
       sessionId,
@@ -1884,6 +1979,613 @@ function renderPlainText(meta, events) {
   }
   return lines.join("\n");
 }
+var FILE_VERSION = 1;
+var MAX_TEXT_LENGTH = 2e3;
+var MAX_ANNOTATIONS = 1e3;
+var AnnotationsStore = class {
+  dir;
+  /** Per-session write queue. Created lazily on first add. */
+  writeChains = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.dir = opts.dir;
+  }
+  // ── Reads ──────────────────────────────────────────────────────────────
+  /**
+   * Return all annotations for `sessionId` in insertion order
+   * (oldest first). Returns an empty array when no file exists
+   * yet (the normal case for a fresh session).
+   */
+  async list(sessionId) {
+    const file = await this.readFile(sessionId);
+    return file ? file.annotations : [];
+  }
+  /**
+   * Convenience: only unresolved annotations, newest first — the
+   * common UI rendering for "what still needs attention?".
+   */
+  async listOpen(sessionId) {
+    const all = await this.list(sessionId);
+    return all.filter((a) => !a.resolved).reverse();
+  }
+  // ── Writes ─────────────────────────────────────────────────────────────
+  /**
+   * Add a new annotation. Returns the persisted record (with id
+   * and timestamps filled in). Throws when `text` is empty or
+   * exceeds `MAX_TEXT_LENGTH`.
+   */
+  async add(input) {
+    const text = input.text.trim();
+    if (text.length === 0) {
+      throw new Error("Annotation text must be non-empty");
+    }
+    if (text.length > MAX_TEXT_LENGTH) {
+      throw new Error(
+        `Annotation text exceeds ${MAX_TEXT_LENGTH} chars (got ${text.length})`
+      );
+    }
+    if (!Number.isInteger(input.atEventIndex) || input.atEventIndex < 0) {
+      throw new Error("atEventIndex must be a non-negative integer");
+    }
+    const annotation = {
+      id: randomUUID(),
+      sessionId: input.sessionId,
+      atEventIndex: input.atEventIndex,
+      authorId: input.authorId,
+      authorRole: "annotator",
+      text,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      resolved: false
+    };
+    await this.enqueue(input.sessionId, async () => {
+      const all = await this.list(input.sessionId);
+      all.push(annotation);
+      if (all.length > MAX_ANNOTATIONS) {
+        const sorted = all.map((a, i) => ({ a, i })).sort((x, y) => {
+          if (x.a.resolved !== y.a.resolved) return x.a.resolved ? 1 : -1;
+          return x.a.createdAt.localeCompare(y.a.createdAt);
+        });
+        const evictCount = all.length - MAX_ANNOTATIONS;
+        const toEvict = new Set(sorted.slice(0, evictCount).map((s) => s.a.id));
+        const kept = all.filter((a) => !toEvict.has(a.id));
+        await this.writeFile(input.sessionId, { version: FILE_VERSION, annotations: kept });
+      } else {
+        await this.writeFile(input.sessionId, { version: FILE_VERSION, annotations: all });
+      }
+    });
+    return annotation;
+  }
+  /**
+   * Mark an annotation as resolved. Returns the updated record, or
+   * `null` if no annotation with that id exists in this session.
+   * Idempotent: resolving an already-resolved annotation refreshes
+   * `resolvedAt` / `resolvedBy` to the latest call.
+   */
+  async resolve(input) {
+    let updated = null;
+    await this.enqueue(input.sessionId, async () => {
+      const all = await this.list(input.sessionId);
+      const idx = all.findIndex((a) => a.id === input.annotationId);
+      if (idx === -1) {
+        updated = null;
+        return;
+      }
+      const next = {
+        ...all[idx],
+        resolved: true,
+        resolvedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        resolvedBy: input.resolvedBy
+      };
+      all[idx] = next;
+      await this.writeFile(input.sessionId, { version: FILE_VERSION, annotations: all });
+      updated = next;
+    });
+    return updated;
+  }
+  // ── Internals ──────────────────────────────────────────────────────────
+  filePath(sessionId) {
+    if (!sessionId || sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
+      throw new Error(`Invalid sessionId: ${sessionId}`);
+    }
+    return path11.join(this.dir, `${sessionId}.annotations.json`);
+  }
+  async readFile(sessionId) {
+    const fp = this.filePath(sessionId);
+    try {
+      const raw = await fsp.readFile(fp, "utf8");
+      const parsed = JSON.parse(raw);
+      if (parsed.version !== FILE_VERSION) {
+        return { version: FILE_VERSION, annotations: [] };
+      }
+      return parsed;
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      return { version: FILE_VERSION, annotations: [] };
+    }
+  }
+  async writeFile(sessionId, file) {
+    const fp = this.filePath(sessionId);
+    await atomicWrite(fp, JSON.stringify(file, null, 2));
+  }
+  /**
+   * Serialize writes per-sessionId. We chain promises instead of
+   * using a Mutex class so the contract is obvious from the
+   * call-site: `enqueue(sid, fn)` runs `fn` after every prior
+   * enqueue for `sid` has settled.
+   */
+  enqueue(sessionId, fn) {
+    const prev = this.writeChains.get(sessionId) ?? Promise.resolve();
+    const next = prev.then(fn, fn);
+    this.writeChains.set(
+      sessionId,
+      next.catch(() => void 0)
+    );
+    return next;
+  }
+};
+function stableStringify(value) {
+  return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+  if (Array.isArray(value)) return value.map(sortKeys);
+  if (value && typeof value === "object") {
+    const obj = value;
+    const sorted = {};
+    for (const key of Object.keys(obj).sort()) {
+      sorted[key] = sortKeys(obj[key]);
+    }
+    return sorted;
+  }
+  return value;
+}
+function hashRequest(request) {
+  const payload = {
+    model: request.model,
+    system: request.system,
+    messages: request.messages,
+    tools: request.tools,
+    maxTokens: request.maxTokens,
+    temperature: request.temperature,
+    topP: request.topP,
+    stopSequences: request.stopSequences,
+    toolChoice: request.toolChoice
+  };
+  const json = stableStringify(payload);
+  const digest = createHash("sha256").update(json, "utf8").digest("hex");
+  return `sha256:${digest}`;
+}
+var DEFAULT_MAX_ENTRIES = 1e3;
+var ReplayLogStore = class {
+  dir;
+  writeChains = /* @__PURE__ */ new Map();
+  /** Per-session hash → entry index, kept in memory after the first load. */
+  cache = /* @__PURE__ */ new Map();
+  maxEntries;
+  constructor(opts) {
+    this.dir = opts.dir;
+    this.maxEntries = opts.maxEntries ?? DEFAULT_MAX_ENTRIES;
+  }
+  // ── Writes ──────────────────────────────────────────────────────────────
+  /**
+   * Record a request/response pair. Idempotent on hash: a second
+   * `record` for the same hash is a no-op (the existing entry wins).
+   * Returns the hash.
+   */
+  async record(input) {
+    const hash = hashRequest(input.request);
+    await this.enqueue(input.sessionId, async () => {
+      const cache = await this.ensureCache(input.sessionId);
+      if (cache.has(hash)) return;
+      const entry = {
+        hash,
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        request: input.request,
+        response: input.response
+      };
+      let all = [...cache.values(), entry];
+      if (all.length > this.maxEntries) {
+        const evictCount = all.length - this.maxEntries;
+        all = all.slice(evictCount);
+      }
+      await this.writeAll(input.sessionId, all);
+      cache.clear();
+      for (const e of all) cache.set(e.hash, e);
+    });
+    return hash;
+  }
+  // ── Reads ───────────────────────────────────────────────────────────────
+  /**
+   * Look up an entry by hash. Returns `null` when the request has
+   * not been recorded for this session. O(1) after the first call
+   * per session (in-memory cache).
+   */
+  async lookup(sessionId, hash) {
+    const cache = await this.ensureCache(sessionId);
+    return cache.get(hash) ?? null;
+  }
+  /** All recorded entries for a session, in insertion order. */
+  async load(sessionId) {
+    const cache = await this.ensureCache(sessionId);
+    return [...cache.values()];
+  }
+  /**
+   * List every session id that has a replay log in the store dir.
+   * Returns an array of `{ sessionId, entryCount, path }` sorted
+   * by sessionId for stable output. Used by `wstack replay --list`.
+   */
+  async list() {
+    let entries;
+    try {
+      entries = await fsp.readdir(this.dir);
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      return [];
+    }
+    const out = [];
+    for (const name of entries) {
+      if (!name.endsWith(".replay.jsonl")) continue;
+      const sessionId = name.slice(0, -".replay.jsonl".length);
+      const all = await this.load(sessionId);
+      out.push({
+        sessionId,
+        entryCount: all.length,
+        path: path11.join(this.dir, name)
+      });
+    }
+    return out.sort((a, b) => a.sessionId.localeCompare(b.sessionId));
+  }
+  // ── Internals ───────────────────────────────────────────────────────────
+  filePath(sessionId) {
+    if (!sessionId || sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
+      throw new Error(`Invalid sessionId: ${sessionId}`);
+    }
+    return path11.join(this.dir, `${sessionId}.replay.jsonl`);
+  }
+  async readAll(sessionId) {
+    const fp = this.filePath(sessionId);
+    try {
+      const raw = await fsp.readFile(fp, "utf8");
+      const out = [];
+      for (const line of raw.split("\n")) {
+        if (!line.trim()) continue;
+        try {
+          const parsed = JSON.parse(line);
+          if ("entry" in parsed && parsed.entry) {
+            out.push(parsed.entry);
+          } else {
+            out.push(parsed);
+          }
+        } catch {
+        }
+      }
+      return out;
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      return [];
+    }
+  }
+  async writeAll(sessionId, entries) {
+    const fp = this.filePath(sessionId);
+    const body = entries.map((e) => JSON.stringify(e)).join("\n") + (entries.length ? "\n" : "");
+    await atomicWrite(fp, body);
+  }
+  async ensureCache(sessionId) {
+    let cache = this.cache.get(sessionId);
+    if (cache) return cache;
+    const all = await this.readAll(sessionId);
+    cache = /* @__PURE__ */ new Map();
+    for (const e of all) cache.set(e.hash, e);
+    this.cache.set(sessionId, cache);
+    return cache;
+  }
+  enqueue(sessionId, fn) {
+    const prev = this.writeChains.get(sessionId) ?? Promise.resolve();
+    const next = prev.then(fn, fn);
+    this.writeChains.set(
+      sessionId,
+      next.catch(() => void 0)
+    );
+    return next;
+  }
+};
+var SessionRecovery = class {
+  constructor(dir) {
+    this.dir = dir;
+  }
+  dir;
+  /**
+   * Scan a session log and return a `StaleSession` if and only
+   * if the last event is an `in_flight_start` without a matching
+   * `in_flight_end`. Returns `null` when:
+   *   - the log does not exist;
+   *   - the log is empty;
+   *   - the last event is `in_flight_end` (clean shutdown);
+   *   - the last event is something else (e.g. an unannotated
+   *     legacy log without in-flight markers).
+   */
+  async detectStale(sessionId) {
+    const fp = this.filePath(sessionId);
+    let raw;
+    try {
+      raw = await fsp.readFile(fp, "utf8");
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      return null;
+    }
+    return this.parseForStale(sessionId, fp, raw);
+  }
+  /**
+   * Generate a recovery plan for a session. The plan describes
+   * "what would be re-executed" if the user chose to resume —
+   * everything after the last `checkpoint` event, plus the
+   * dangling in-flight marker if present.
+   *
+   * Returns a non-null plan for ANY session that has at least
+   * one event after a checkpoint (or, for legacy sessions, at
+   * least one event). Pure read; no mutation.
+   */
+  async recover(sessionId) {
+    const fp = this.filePath(sessionId);
+    let raw;
+    try {
+      raw = await fsp.readFile(fp, "utf8");
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      return null;
+    }
+    const events = [];
+    for (const line of raw.split("\n")) {
+      if (!line.trim()) continue;
+      try {
+        events.push(JSON.parse(line));
+      } catch {
+      }
+    }
+    if (events.length === 0) return null;
+    let lastCheckpoint = null;
+    let lastCheckpointIdx = -1;
+    for (let i = 0; i < events.length; i++) {
+      if (events[i].type === "checkpoint") {
+        lastCheckpoint = events[i];
+        lastCheckpointIdx = i;
+      }
+    }
+    const pendingEvents = lastCheckpointIdx >= 0 ? events.slice(lastCheckpointIdx + 1) : events;
+    const lastEv = events[events.length - 1];
+    const inFlightStart = lastEv.type === "in_flight_start" ? lastEv : null;
+    const context = inFlightStart && inFlightStart.type === "in_flight_start" ? inFlightStart.context : null;
+    return {
+      sessionId,
+      stale: inFlightStart !== null,
+      lastCheckpoint,
+      pendingEvents,
+      inFlightStart,
+      context
+    };
+  }
+  /**
+   * List every stale session in a directory. Returns an array
+   * (possibly empty) sorted by `lastEventTs` descending — most
+   * recent crash first.
+   */
+  async listResumable() {
+    let entries;
+    try {
+      entries = await fsp.readdir(this.dir);
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      return [];
+    }
+    const out = [];
+    for (const name of entries) {
+      if (!name.endsWith(".jsonl")) continue;
+      const sessionId = name.slice(0, -".jsonl".length);
+      if (sessionId.includes(".replay") || sessionId.includes(".annotations")) continue;
+      const stale = await this.detectStale(sessionId);
+      if (stale) out.push(stale);
+    }
+    return out.sort((a, b) => b.lastEventTs.localeCompare(a.lastEventTs));
+  }
+  // ── Internals ──────────────────────────────────────────────────────────
+  filePath(sessionId) {
+    if (!sessionId || sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
+      throw new Error(`Invalid sessionId: ${sessionId}`);
+    }
+    return path11.join(this.dir, `${sessionId}.jsonl`);
+  }
+  /**
+   * Stream-parse the last few lines of a JSONL log. We do NOT load
+   * the whole file into memory — for long-running sessions the log
+   * can be megabytes. Instead we read tail-ward and find the last
+   * `in_flight_start` / `in_flight_end` pair.
+   */
+  async parseForStale(sessionId, fp, raw) {
+    const lines = raw.split("\n");
+    let lastEvent = null;
+    let eventCount = 0;
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      try {
+        const ev = JSON.parse(line);
+        lastEvent = ev;
+        eventCount++;
+      } catch {
+      }
+    }
+    if (!lastEvent) return null;
+    if (lastEvent.type === "in_flight_start") {
+      return {
+        sessionId,
+        path: fp,
+        lastEventTs: lastEvent.ts,
+        context: lastEvent.context,
+        eventCount
+      };
+    }
+    return null;
+  }
+};
+var GENESIS_PREV = "0".repeat(64);
+var ToolAuditLog = class {
+  dir;
+  /** In-memory cache of the last entry's hash (per session), to compute chains efficiently. */
+  tailHash = /* @__PURE__ */ new Map();
+  writeChains = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.dir = opts.dir;
+  }
+  /**
+   * Append a tool call/result pair to the chain. Returns the
+   * resulting entry. Idempotency is not guaranteed — if you
+   * record the same tool_use twice you get two entries. That's
+   * intentional: the audit log is a record, not a cache.
+   */
+  async record(input) {
+    let entry = null;
+    await this.enqueue(input.sessionId, async () => {
+      const prevHash = this.tailHash.get(input.sessionId) ?? GENESIS_PREV;
+      const id = randomUUID();
+      const ts = (/* @__PURE__ */ new Date()).toISOString();
+      const content = {
+        id,
+        ts,
+        prevHash,
+        toolName: input.toolName,
+        toolUseId: input.toolUseId,
+        input: input.input,
+        output: input.output,
+        isError: input.isError
+      };
+      const hash = createHash("sha256").update(stableStringify2(content), "utf8").digest("hex");
+      entry = {
+        index: this.tailHash.has(input.sessionId) ? -1 : 0,
+        // placeholder; recomputed below
+        id,
+        ts,
+        prevHash,
+        hash,
+        toolName: input.toolName,
+        toolUseId: input.toolUseId,
+        input: input.input,
+        output: input.output,
+        isError: input.isError
+      };
+      const existing = await this.readAll(input.sessionId);
+      const index = existing.length;
+      const finalContent = { ...content, index };
+      const finalHash = createHash("sha256").update(stableStringify2(finalContent), "utf8").digest("hex");
+      entry = { ...entry, index, hash: finalHash };
+      await this.appendLine(input.sessionId, entry);
+      this.tailHash.set(input.sessionId, finalHash);
+    });
+    return entry;
+  }
+  /**
+   * Walk the chain and verify every entry's hash and prevHash.
+   * Returns a structured verdict — never throws.
+   */
+  async verify(sessionId) {
+    const entries = await this.readAll(sessionId);
+    if (entries.length === 0) return { ok: true, entries: 0 };
+    if (entries[0].prevHash !== GENESIS_PREV) {
+      return {
+        ok: false,
+        brokenAt: 0,
+        reason: "first entry is not the genesis (prevHash != 0\u20260)"
+      };
+    }
+    let prevHash = GENESIS_PREV;
+    for (let i = 0; i < entries.length; i++) {
+      const e = entries[i];
+      if (e.prevHash !== prevHash) {
+        return {
+          ok: false,
+          brokenAt: i,
+          reason: `prevHash mismatch at entry ${i} (expected ${prevHash.slice(0, 8)}\u2026, got ${e.prevHash.slice(0, 8)}\u2026)`
+        };
+      }
+      const content = {
+        id: e.id,
+        ts: e.ts,
+        prevHash: e.prevHash,
+        toolName: e.toolName,
+        toolUseId: e.toolUseId,
+        input: e.input,
+        output: e.output,
+        isError: e.isError,
+        index: e.index
+      };
+      const expectedHash = createHash("sha256").update(stableStringify2(content), "utf8").digest("hex");
+      if (expectedHash !== e.hash) {
+        return {
+          ok: false,
+          brokenAt: i,
+          reason: `hash mismatch at entry ${i} (entry content was modified)`
+        };
+      }
+      prevHash = e.hash;
+    }
+    return { ok: true, entries: entries.length };
+  }
+  /** All entries for a session, in insertion order. */
+  async load(sessionId) {
+    return this.readAll(sessionId);
+  }
+  // ── Internals ────────────────────────────────────────────────────────────
+  filePath(sessionId) {
+    if (!sessionId || sessionId.includes("/") || sessionId.includes("\\") || sessionId.includes("..")) {
+      throw new Error(`Invalid sessionId: ${sessionId}`);
+    }
+    return path11.join(this.dir, `${sessionId}.audit.jsonl`);
+  }
+  async readAll(sessionId) {
+    const fp = this.filePath(sessionId);
+    try {
+      const raw = await fsp.readFile(fp, "utf8");
+      const out = [];
+      for (const line of raw.split("\n")) {
+        if (!line.trim()) continue;
+        try {
+          out.push(JSON.parse(line));
+        } catch {
+        }
+      }
+      return out;
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      return [];
+    }
+  }
+  async appendLine(sessionId, entry) {
+    const fp = this.filePath(sessionId);
+    const existing = await this.readAll(sessionId);
+    const all = [...existing, entry];
+    await atomicWrite(fp, all.map((e) => JSON.stringify(e)).join("\n") + (all.length ? "\n" : ""));
+  }
+  enqueue(sessionId, fn) {
+    const prev = this.writeChains.get(sessionId) ?? Promise.resolve();
+    const next = prev.then(fn, fn);
+    this.writeChains.set(
+      sessionId,
+      next.catch(() => void 0)
+    );
+    return next;
+  }
+};
+function stableStringify2(value) {
+  return JSON.stringify(sortKeys2(value));
+}
+function sortKeys2(value) {
+  if (Array.isArray(value)) return value.map(sortKeys2);
+  if (value && typeof value === "object") {
+    const obj = value;
+    const sorted = {};
+    for (const key of Object.keys(obj).sort()) {
+      sorted[key] = sortKeys2(obj[key]);
+    }
+    return sorted;
+  }
+  return value;
+}
 
 // src/storage/session-analyzer.ts
 var SessionAnalyzer = class {
@@ -1989,7 +2691,7 @@ var DefaultSessionRewinder = class {
   sessionsDir;
   projectRoot;
   async listCheckpoints(sessionId) {
-    const file = path7.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path11.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     const fileCountMap = /* @__PURE__ */ new Map();
@@ -2014,7 +2716,7 @@ var DefaultSessionRewinder = class {
     return checkpoints;
   }
   async rewindToCheckpoint(sessionId, checkpointIndex) {
-    const file = path7.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path11.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     let targetIdx = -1;
@@ -2049,7 +2751,7 @@ var DefaultSessionRewinder = class {
     return { ...result, toPromptIndex: checkpointIndex, removedEvents };
   }
   async rewindLastN(sessionId, n) {
-    const file = path7.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path11.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     const checkpoints = [];
@@ -2078,7 +2780,7 @@ var DefaultSessionRewinder = class {
     return { ...result, toPromptIndex: targetIndex, removedEvents: snapshotsToRevert.length };
   }
   async rewindToStart(sessionId) {
-    const file = path7.join(this.sessionsDir, `${sessionId}.jsonl`);
+    const file = path11.join(this.sessionsDir, `${sessionId}.jsonl`);
     const raw = await fsp.readFile(file, "utf8");
     const events = parseEvents(raw);
     const allSnapshots = [];
@@ -2114,10 +2816,10 @@ async function revertSnapshots(snapshots, projectRoot) {
   for (const snapshot of snapshots) {
     for (const file of snapshot.files) {
       try {
-        const absPath = path7.resolve(file.path);
-        const root = path7.resolve(projectRoot);
-        const rel = path7.relative(root, absPath);
-        if (rel.startsWith("..") || path7.isAbsolute(rel)) {
+        const absPath = path11.resolve(file.path);
+        const root = path11.resolve(projectRoot);
+        const rel = path11.relative(root, absPath);
+        if (rel.startsWith("..") || path11.isAbsolute(rel)) {
           errors.push(`${file.path}: path resolves outside project root \u2014 skipping`);
           continue;
         }
@@ -2676,8 +3378,8 @@ var FsError = class extends WrongStackError {
 // src/storage/goal-store.ts
 var MAX_JOURNAL_ENTRIES = 500;
 function goalFilePath(projectRoot) {
-  const hash = createHash("sha256").update(path7.resolve(projectRoot)).digest("hex").slice(0, 12);
-  return path7.join(os.homedir(), ".wrongstack", "projects", hash, "goal.json");
+  const hash = createHash("sha256").update(path11.resolve(projectRoot)).digest("hex").slice(0, 12);
+  return path11.join(os.homedir(), ".wrongstack", "projects", hash, "goal.json");
 }
 async function loadGoal(filePath) {
   let raw;
@@ -2785,14 +3487,14 @@ var DefaultPromptStore = class {
   }
   async list() {
     await ensureDir(this.dir);
-    let entries = [];
+    const entries = [];
     try {
       const files = await fsp.readdir(this.dir);
       for (const file of files) {
         if (!file.endsWith(".json")) continue;
         try {
           const raw = JSON.parse(
-            await fsp.readFile(path7.join(this.dir, file), "utf8")
+            await fsp.readFile(path11.join(this.dir, file), "utf8")
           );
           entries.push(raw.entry);
         } catch {
@@ -2805,7 +3507,7 @@ var DefaultPromptStore = class {
     );
   }
   async get(id) {
-    const file = path7.join(this.dir, `${id}.json`);
+    const file = path11.join(this.dir, `${id}.json`);
     try {
       const raw = JSON.parse(await fsp.readFile(file, "utf8"));
       return raw.entry;
@@ -2815,12 +3517,12 @@ var DefaultPromptStore = class {
   }
   async save(entry) {
     await ensureDir(this.dir);
-    const file = path7.join(this.dir, `${entry.id}.json`);
+    const file = path11.join(this.dir, `${entry.id}.json`);
     const raw = { version: 1, entry };
     await atomicWrite(file, JSON.stringify(raw, null, 2));
   }
   async delete(id) {
-    const file = path7.join(this.dir, `${id}.json`);
+    const file = path11.join(this.dir, `${id}.json`);
     try {
       await fsp.unlink(file);
       return true;
@@ -2854,7 +3556,7 @@ var CloudSync = class {
     this.paths = paths;
     this.getConfig = getConfig;
     this.setConfig = setConfig;
-    this.statePath = path7.join(paths.globalRoot, "sync-state.json");
+    this.statePath = path11.join(paths.globalRoot, "sync-state.json");
   }
   paths;
   getConfig;
@@ -2904,7 +3606,25 @@ var CloudSync = class {
       baseTreeSha,
       `Sync ${cfg.categories.join(", ")} \u2014 ${(/* @__PURE__ */ new Date()).toISOString()}`
     );
-    await this.updateRef(token, owner, repoName, branch, commitSha);
+    try {
+      await this.updateRef(token, owner, repoName, branch, commitSha);
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("422")) {
+        const remote = await this.getRef(token, owner, repoName, branch);
+        const currentSha = remote.object.sha;
+        const rebasedCommitSha = await this.createCommit(
+          token,
+          owner,
+          repoName,
+          newTreeSha,
+          currentSha,
+          `Sync ${cfg.categories.join(", ")} \u2014 ${(/* @__PURE__ */ new Date()).toISOString()}`
+        );
+        await this.updateRef(token, owner, repoName, branch, rebasedCommitSha);
+      } else {
+        throw err;
+      }
+    }
     const syncState = {
       version: 1,
       sha: commitSha,
@@ -2941,9 +3661,9 @@ var CloudSync = class {
       const localPath = this.categoryToPath(cat);
       if (!localPath) continue;
       const rel = segments.slice(2).join("/");
-      const destPath = rel ? path7.join(localPath, rel) : localPath;
+      const destPath = rel ? path11.join(localPath, rel) : localPath;
       const blobData = await this.getBlob(token, owner, repoName, entry.sha);
-      await fsp.mkdir(path7.dirname(destPath), { recursive: true });
+      await fsp.mkdir(path11.dirname(destPath), { recursive: true });
       await fsp.writeFile(destPath, Buffer.from(blobData, "base64"));
     }
     const localRev = await this.hashLocalCategories(cfg.categories);
@@ -3048,7 +3768,7 @@ var CloudSync = class {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
             const content = await fsp.readFile(file, "utf8");
-            const rel = path7.relative(localPath, file).replace(/\\/g, "/");
+            const rel = path11.relative(localPath, file).replace(/\\/g, "/");
             entries.push({ path: `data/${cat}/${rel}`, content, mode: "100644" });
             hashes.push(content);
           }
@@ -3105,7 +3825,7 @@ var CloudSync = class {
     const results = [];
     const entries = await fsp.readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = path7.join(dir, entry.name);
+      const full = path11.join(dir, entry.name);
       if (entry.isDirectory()) {
         results.push(...await this.walkDir(full, base));
       } else {
@@ -3126,6 +3846,6 @@ function timeAgo(iso) {
   return `${days}d ago`;
 }
 
-export { ALL_SYNC_CATEGORIES, CloudSync, ConfigMigrationError, DEFAULT_CONFIG_MIGRATIONS, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultMemoryStore, DefaultPromptStore, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, DirectorStateCheckpoint, MAX_JOURNAL_ENTRIES, QueueStore, RecoveryLock, SessionAnalyzer, addPlanItem, appendJournal, attachPlanCheckpoint, attachTodosCheckpoint, clearPlan, deriveTodosFromPlanItem, emptyGoal, emptyPlan, formatGoal, formatPlan, formatPlanTemplates, getPlanTemplate, goalFilePath, listPlanTemplates, loadDirectorState, loadGoal, loadPlan, loadTodosCheckpoint, removePlanItem, runConfigMigrations, saveGoal, savePlan, saveTodosCheckpoint, setPlanItemStatus, summarizeUsage };
+export { ALL_SYNC_CATEGORIES, AnnotationsStore, CloudSync, ConfigMigrationError, DEFAULT_CONFIG_MIGRATIONS, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultMemoryStore, DefaultPromptStore, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, DirectorStateCheckpoint, MAX_JOURNAL_ENTRIES, QueueStore, RecoveryLock, ReplayLogStore, SessionAnalyzer, SessionRecovery, ToolAuditLog, addPlanItem, appendJournal, attachPlanCheckpoint, attachTodosCheckpoint, clearPlan, deriveTodosFromPlanItem, emptyGoal, emptyPlan, formatGoal, formatPlan, formatPlanTemplates, getPlanTemplate, goalFilePath, listPlanTemplates, loadDirectorState, loadGoal, loadPlan, loadTodosCheckpoint, removePlanItem, runConfigMigrations, saveGoal, savePlan, saveTodosCheckpoint, setPlanItemStatus, summarizeUsage };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map