@wrongstack/tools 0.296.4 → 0.298.0

package/dist/install.js

@@ -1,5 +1,5 @@
 // src/install.ts
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 import {
   detectEcosystem as detectPackageEcosystem,
   recordPackageAction
@@ -85,11 +85,12 @@ function createOutputSpool(opts) {
   return {
     write(text) {
       if (finalized || !text) return;
-      totalBytes += Buffer.byteLength(text, "utf8");
+      const textBytes = Buffer.byteLength(text, "utf8");
+      totalBytes += textBytes;
       if (!stream && !failed) {
-        if (headBytes + text.length <= threshold) {
+        if (headBytes + textBytes <= threshold) {
           head += text;
-          headBytes += text.length;
+          headBytes += textBytes;
           return;
         }
         head += text;
@@ -99,7 +100,7 @@ function createOutputSpool(opts) {
       }
       if (stream) {
         if (stream.writableLength > SPOOL_WRITE_HWM_BYTES) {
-          droppedBytes += Buffer.byteLength(text, "utf8");
+          droppedBytes += textBytes;
           return;
         }
         stream.write(text);
@@ -121,6 +122,52 @@ function createOutputSpool(opts) {
   };
 }
 
+// src/_win32-resolve.ts
+import * as fs from "node:fs";
+import * as path2 from "node:path";
+function resolveWin32Command(cmd) {
+  if (process.platform !== "win32") return cmd;
+  if (cmd.includes("/") || cmd.includes("\\") || path2.extname(cmd.replace(/\//g, "\\"))) {
+    return cmd;
+  }
+  const pathext = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC").toLowerCase().split(";");
+  const pathDirs = (process.env["PATH"] ?? "").split(path2.delimiter);
+  for (const dir of pathDirs) {
+    const base = path2.join(dir, cmd);
+    for (const ext of pathext) {
+      const full = `${base}${ext}`;
+      try {
+        fs.accessSync(full, fs.constants.X_OK);
+        return full;
+      } catch {
+      }
+    }
+  }
+  return cmd;
+}
+var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
+function assertSafeWin32ShellArgs(args) {
+  for (const arg of args) {
+    if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
+      throw new Error(
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+      );
+    }
+  }
+}
+function buildWin32CmdShimInvocation(command, args = []) {
+  assertSafeWin32ShellArgs([command, ...args]);
+  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
+  return {
+    command: process.env["COMSPEC"] ?? "cmd.exe",
+    args: ["/d", "/c", line],
+    windowsVerbatimArguments: true
+  };
+}
+function quoteWin32CmdArg(arg) {
+  return `"${arg}"`;
+}
+
 // src/process-registry.ts
 import { spawn } from "node:child_process";
 import * as os from "node:os";
@@ -452,6 +499,7 @@ var ProcessRegistryImpl = class {
   }
   /** Get all tracked processes. */
   list() {
+    this._pruneAllStale();
     return Array.from(this.processes.values());
   }
   /** Get processes filtered by name (e.g. 'bash', 'exec'). */
@@ -482,6 +530,7 @@ var ProcessRegistryImpl = class {
    * Combined stats for observability — used by /ps and the TUI status bar.
    */
   stats() {
+    this._pruneAllStale();
     return {
       activeCount: this.activeCount,
       backgroundCount: this.activeBackgroundCount,
@@ -721,6 +770,19 @@ var ProcessRegistryImpl = class {
       this.processes.delete(pid);
     }
   }
+  /**
+   * Remove every stale entry, not just one PID. `list()`/`stats()` — the
+   * surfaces the TUI status bar and `/ps` poll — must prune too: a child
+   * whose 'close' event never fires (e.g. Windows grandchildren holding stdio
+   * open) would otherwise linger in the registry until someone looks up its
+   * exact PID, and PID reuse meanwhile makes `get()`/`kill()` target the
+   * wrong process. RAM-leak audit 2026-07-31, MEDIUM.
+   */
+  _pruneAllStale() {
+    for (const [pid, entry] of this.processes) {
+      if (this._isStaleEntry(entry)) this.processes.delete(pid);
+    }
+  }
 };
 var _registry;
 function getProcessRegistry() {
@@ -730,60 +792,17 @@ function getProcessRegistry() {
   return _registry;
 }
 
-// src/_win32-resolve.ts
-import * as fs from "node:fs";
-import * as path2 from "node:path";
-function resolveWin32Command(cmd) {
-  if (process.platform !== "win32") return cmd;
-  if (cmd.includes("/") || cmd.includes("\\") || path2.extname(cmd.replace(/\//g, "\\"))) {
-    return cmd;
-  }
-  const pathext = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC").toLowerCase().split(";");
-  const pathDirs = (process.env["PATH"] ?? "").split(path2.delimiter);
-  for (const dir of pathDirs) {
-    const base = path2.join(dir, cmd);
-    for (const ext of pathext) {
-      const full = `${base}${ext}`;
-      try {
-        fs.accessSync(full, fs.constants.X_OK);
-        return full;
-      } catch {
-      }
-    }
-  }
-  return cmd;
-}
-var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
-function assertSafeWin32ShellArgs(args) {
-  for (const arg of args) {
-    if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
-      throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
-      );
-    }
-  }
-}
-function buildWin32CmdShimInvocation(command, args = []) {
-  assertSafeWin32ShellArgs([command, ...args]);
-  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
-  return {
-    command: process.env["COMSPEC"] ?? "cmd.exe",
-    args: ["/d", "/c", line],
-    windowsVerbatimArguments: true
-  };
-}
-function quoteWin32CmdArg(arg) {
-  return `"${arg}"`;
-}
-
 // src/_spawn-stream.ts
 var isWin = process.platform === "win32";
 async function* spawnStream(opts) {
   const max = opts.maxBytes ?? 2e5;
   const flushAt = opts.flushBytes ?? 4 * 1024;
   const maxQueue = opts.maxQueueSize ?? 500;
+  const maxQueueBytes = opts.maxQueueBytes ?? 1024 * 1024;
   let stdout = "";
   let stderr = "";
+  let stdoutRetainedBytes = 0;
+  let stderrRetainedBytes = 0;
   let pending = "";
   let error;
   const spool = createOutputSpool({ tool: opts.cmd, thresholdBytes: max });
@@ -825,6 +844,7 @@ async function* spawnStream(opts) {
     });
   }
   const queue = [];
+  let queuedBytes = 0;
   let waiter;
   let paused = false;
   const wake = () => {
@@ -835,7 +855,7 @@ async function* spawnStream(opts) {
     }
   };
   const resume = () => {
-    if (paused && queue.length < maxQueue) {
+    if (paused && queue.length <= Math.floor(maxQueue / 2) && queuedBytes <= Math.floor(maxQueueBytes / 2)) {
       paused = false;
       child.stdout?.resume();
       child.stderr?.resume();
@@ -845,11 +865,16 @@ async function* spawnStream(opts) {
     const s = c.toString();
     stdoutBytes += c.byteLength;
     emitProcessOutput({ pid, stream: "stdout", chunk: c });
-    if (stdout.length < max) stdout += s;
+    if (stdoutRetainedBytes < max) {
+      const retained = utf8Prefix(s, max - stdoutRetainedBytes);
+      stdout += retained;
+      stdoutRetainedBytes += Buffer.byteLength(retained, "utf8");
+    }
     spool.write(s);
-    queue.push({ kind: "out", data: s });
+    queue.push({ kind: "out", data: s, bytes: c.byteLength });
+    queuedBytes += c.byteLength;
     wake();
-    if (!paused && queue.length >= maxQueue) {
+    if (!paused && (queue.length >= maxQueue || queuedBytes >= maxQueueBytes)) {
       paused = true;
       child.stdout?.pause();
       child.stderr?.pause();
@@ -859,11 +884,16 @@ async function* spawnStream(opts) {
     const s = c.toString();
     stderrBytes += c.byteLength;
     emitProcessOutput({ pid, stream: "stderr", chunk: c });
-    if (stderr.length < max) stderr += s;
+    if (stderrRetainedBytes < max) {
+      const retained = utf8Prefix(s, max - stderrRetainedBytes);
+      stderr += retained;
+      stderrRetainedBytes += Buffer.byteLength(retained, "utf8");
+    }
     spool.write(s);
-    queue.push({ kind: "err", data: s });
+    queue.push({ kind: "err", data: s, bytes: c.byteLength });
+    queuedBytes += c.byteLength;
     wake();
-    if (!paused && queue.length >= maxQueue) {
+    if (!paused && (queue.length >= maxQueue || queuedBytes >= maxQueueBytes)) {
       paused = true;
       child.stdout?.pause();
       child.stderr?.pause();
@@ -873,7 +903,9 @@ async function* spawnStream(opts) {
   child.stderr?.on("data", onErr);
   child.on("error", (e) => {
     error = e.message;
-    queue.push({ kind: "error", data: e.message });
+    const bytes = Buffer.byteLength(e.message, "utf8");
+    queue.push({ kind: "error", data: e.message, bytes });
+    queuedBytes += bytes;
     wake();
   });
   const completeTelemetry = (code, signal, timedOut = false) => {
@@ -894,7 +926,13 @@ async function* spawnStream(opts) {
     if (typeof pid === "number") registry.unregister(pid);
     const exitCode2 = code ?? (signal ? 1 : 0);
     completeTelemetry(exitCode2, signal ?? void 0);
-    queue.push({ kind: "close", data: "", code: exitCode2, ...signal ? { signal } : {} });
+    queue.push({
+      kind: "close",
+      data: "",
+      bytes: 0,
+      code: exitCode2,
+      ...signal ? { signal } : {}
+    });
     wake();
   });
   const onAbort = () => {
@@ -906,7 +944,7 @@ async function* spawnStream(opts) {
       } catch {
       }
     }
-    queue.push({ kind: "close", data: "", code: 124 });
+    queue.push({ kind: "close", data: "", bytes: 0, code: 124 });
     completeTelemetry(124, "SIGKILL", true);
     wake();
   };
@@ -924,6 +962,7 @@ async function* spawnStream(opts) {
         });
       }
       const chunk = queue.shift();
+      queuedBytes -= chunk.bytes;
       resume();
       if (chunk.kind === "close") {
         if (!spawnFailed) exitCode = chunk.code ?? 0;
@@ -950,7 +989,7 @@ async function* spawnStream(opts) {
       stdout: spooled ? stdout + spoolNote(spooled) : stdout,
       stderr,
       exitCode,
-      truncated: stdout.length >= max || stderr.length >= max,
+      truncated: stdoutBytes > stdoutRetainedBytes || stderrBytes > stderrRetainedBytes,
       error,
       spoolPath: spooled?.path,
       spoolBytes: spooled?.bytes
@@ -974,6 +1013,20 @@ async function* spawnStream(opts) {
     }
   }
 }
+function utf8Prefix(text, maxBytes) {
+  if (maxBytes <= 0) return "";
+  if (Buffer.byteLength(text, "utf8") <= maxBytes) return text;
+  let low = 0;
+  let high = text.length;
+  while (low < high) {
+    const mid = Math.ceil((low + high) / 2);
+    if (Buffer.byteLength(text.slice(0, mid), "utf8") <= maxBytes) low = mid;
+    else high = mid - 1;
+  }
+  let end = low;
+  if (end > 0 && /[\uD800-\uDBFF]/.test(text[end - 1])) end--;
+  return text.slice(0, end);
+}
 
 // src/_util.ts
 import * as path3 from "node:path";
@@ -2555,8 +2608,8 @@ async function scanDirectory(directory, depth, profiles, limits, state, extraIgn
     collectFileEvidence(directory, fullPath, entry.name, profiles, state);
   }
 }
-function collectFileEvidence(directory, fullPath, basename4, profiles, state) {
-  const lower = basename4.toLowerCase();
+function collectFileEvidence(directory, fullPath, basename5, profiles, state) {
+  const lower = basename5.toLowerCase();
   const extension = path4.extname(lower);
   for (const profile of profiles) {
     const detector = profile.detectors.find(
@@ -2567,7 +2620,7 @@ function collectFileEvidence(directory, fullPath, basename4, profiles, state) {
       candidate.evidence.push({
         kind: detector.kind,
         path: fullPath,
-        value: basename4,
+        value: basename5,
         weight: detector.weight
       });
       if (detector.kind === "manifest" || detector.kind === "config") {
@@ -3186,10 +3239,11 @@ var MAX_ARGUMENTS = 128;
 var MAX_ARGUMENT_LENGTH = 4096;
 var PACKAGE_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+(?:@[a-z0-9*+._~^<>=|-]+)?$/i;
 var COMPOSER_PACKAGE_RE = /^[a-z0-9_.-]+\/[a-z0-9_.-]+(?::[a-z0-9*+._~^<>=|-]+)?$/i;
-var GO_MODULE_RE = /^(?:[a-z0-9.-]+\.)+[a-z0-9.-]+\/[a-z0-9._~+/@-]+$/i;
+var GO_MODULE_RE = /^(?:[a-z0-9-]+\.)+[a-z0-9-]+\/[a-z0-9._~+/@-]+$/i;
 var PYTHON_PACKAGE_RE = /^[a-z0-9._-]+(?:\[[a-z0-9._,-]+\])?==[a-z0-9*+._!~-]+$/i;
 async function planLanguageOperation(options) {
   validateOperationOptions(options.operation, options.operationOptions?.packages);
+  validateFilterOption(options.operationOptions?.filter);
   const detection = await detectLanguageWorkspaces(options);
   const candidates = detection.workspaces.filter(
     (workspace) => workspace.capabilities.includes(options.operation)
@@ -3362,6 +3416,15 @@ function workspaceDepth(workspaceRoot, projectRoot) {
   const relative5 = path6.relative(path6.resolve(projectRoot), path6.resolve(workspaceRoot));
   return relative5 === "" ? 0 : relative5.split(path6.sep).length;
 }
+function validateFilterOption(filter) {
+  if (filter === void 0) return;
+  if (filter.startsWith("-") || filter.includes(" --")) {
+    throw new Error(`Invalid test filter (parsed as a runner option): "${filter}"`);
+  }
+  if (filter.length > MAX_ARGUMENT_LENGTH || /[\r\n\0]/.test(filter)) {
+    throw new Error("Invalid test filter (oversized or contains a control character)");
+  }
+}
 function validateOperationOptions(operation, packages) {
   if (!operation.startsWith("package-") || !packages) return;
   for (const value of packages) {
@@ -3744,6 +3807,10 @@ var installTool = {
   description: "Install, update or manage packages using the detected package manager (pnpm/npm/yarn). Strongly preferred over raw shell commands for dependency management because it is structured and safer.",
   usageHint: "ALWAYS USE THIS INSTEAD OF BASH FOR PACKAGE WORK:\n\n- Empty `packages` \u2192 normal `install` (respects lockfile).\n- Provide names \u2192 adds/updates specific packages.\n- `dry_run: true` for safe preview.\n- Set `save` appropriately.\nThis tool has proper capability declaration and is heavily recommended in the security posture of the project.",
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // What gets installed is the subject — installing a package runs its
+  // lifecycle scripts, so `express` and `evil-pkg` must not be interchangeable.
+  subjectKey: "packages",
   mutating: true,
   riskTier: "standard",
   icon: "package",
@@ -3913,10 +3980,10 @@ function resolveManifestPath(cwd, pkgManager) {
     case "pnpm":
     case "yarn":
     case "npm":
-      return join7(cwd, "package.json");
+      return join8(cwd, "package.json");
     /* v8 ignore next 2 -- pkgManager is always pnpm/yarn/npm; the default is defensive. */
     default:
-      return join7(cwd, "package.json");
+      return join8(cwd, "package.json");
   }
 }
 export {

package/dist/json.js

@@ -27,12 +27,13 @@ function ensureInsideRoot(absPath, ctx) {
 function safeResolve(input, ctx) {
   return ensureInsideRoot(resolvePath(input, ctx), ctx);
 }
-async function assertRealInsideRoot(absPath, ctx) {
-  if (ctx.allowOutsideProjectRoot) return;
+async function resolveRealInsideRoot(absPath, ctx) {
+  if (ctx.allowOutsideProjectRoot) return absPath;
   const realRoots = await Promise.all(
     allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r)))
   );
   let probe = absPath;
+  const pendingTail = [];
   for (; ; ) {
     let real;
     try {
@@ -40,13 +41,16 @@ async function assertRealInsideRoot(absPath, ctx) {
     } catch (err) {
       if (err.code === "ENOENT") {
         const parent = path.dirname(probe);
-        if (parent === probe) return;
+        if (parent === probe) return absPath;
+        pendingTail.unshift(path.basename(probe));
         probe = parent;
         continue;
       }
       throw err;
     }
-    if (isInsideAny(real, realRoots)) return;
+    if (isInsideAny(real, realRoots)) {
+      return pendingTail.length > 0 ? path.join(real, ...pendingTail) : real;
+    }
     throw new Error(
       `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
     );
@@ -54,11 +58,28 @@ async function assertRealInsideRoot(absPath, ctx) {
 }
 async function safeResolveReal(input, ctx) {
   const abs = safeResolve(input, ctx);
-  await assertRealInsideRoot(abs, ctx);
-  return abs;
+  return await resolveRealInsideRoot(abs, ctx);
 }
 
 // src/json.ts
+var MAX_JSON_FILE_BYTES = 16 * 1024 * 1024;
+var MAX_JSON_FILE_BYTES_HUMAN = "16 MiB";
+var JsonFileTooLargeError = class extends Error {
+  constructor(filePath, size) {
+    super(
+      `json: "${filePath}" is ${size} bytes \u2014 exceeds the ${MAX_JSON_FILE_BYTES_HUMAN} file-size limit. Extract the relevant portion into a smaller file first, or use a shell tool to query it directly.`
+    );
+    this.name = "JsonFileTooLargeError";
+  }
+};
+async function readJsonFileBounded(filePath, ctx) {
+  const resolved = await safeResolveReal(filePath, ctx);
+  const stat2 = await fs.stat(resolved);
+  if (stat2.size > MAX_JSON_FILE_BYTES) {
+    throw new JsonFileTooLargeError(filePath, stat2.size);
+  }
+  return fs.readFile(resolved, "utf8");
+}
 var jsonTool = {
   name: "json",
   category: "Data",
@@ -66,6 +87,7 @@ var jsonTool = {
   usageHint: 'VERY USEFUL FOR DATA INSPECTION:\n\n- `action: "parse"` (default): read/pretty-print/convert JSON, JSON5, or YAML from `file` or `data`.\n- `action: "query"`: JMESPath-like query (`a.b[0].c`, `items[*].name`, filters, functions).\n- `action: "validate"`: validate data against a JSON Schema (`schema` param).\n- `action: "transform"`: chain multiple JMESPath transforms (`transforms` param).\n- `action: "merge"`: deep merge `base` and `patch` objects (`conflictResolution` param).\nPrefer this over raw `read` + manual parsing when dealing with configuration or data files.',
   permission: "auto",
   mutating: false,
+  maxOutputBytes: 262144,
   timeoutMs: 5e3,
   capabilities: ["fs.read"],
   icon: "json",
@@ -132,9 +154,15 @@ async function executeParse(input, ctx) {
   let raw;
   if (input.file) {
     try {
-      raw = await fs.readFile(await safeResolveReal(input.file, ctx), "utf8");
-    } catch {
-      return { data: null, formatted: "", type: "unknown", action: "parse", error: "Could not read file" };
+      raw = await readJsonFileBounded(input.file, ctx);
+    } catch (error) {
+      return {
+        data: null,
+        formatted: "",
+        type: "unknown",
+        action: "parse",
+        error: error instanceof JsonFileTooLargeError ? error.message : "Could not read file"
+      };
     }
   } else if (input.data) {
     raw = input.data;
@@ -190,10 +218,16 @@ async function executeQuery(input, ctx) {
   let parsed;
   if (input.file) {
     try {
-      const raw = await fs.readFile(await safeResolveReal(input.file, ctx), "utf8");
+      const raw = await readJsonFileBounded(input.file, ctx);
       parsed = JSON.parse(raw);
-    } catch {
-      return { data: null, formatted: "", type: "unknown", action: "query", error: "Could not read/parse file" };
+    } catch (error) {
+      return {
+        data: null,
+        formatted: "",
+        type: "unknown",
+        action: "query",
+        error: error instanceof JsonFileTooLargeError ? error.message : "Could not read/parse file"
+      };
     }
   } else if (input.data) {
     try {
@@ -232,10 +266,16 @@ async function executeValidate(input, ctx) {
   let parsed;
   if (input.file) {
     try {
-      const raw = await fs.readFile(await safeResolveReal(input.file, ctx), "utf8");
+      const raw = await readJsonFileBounded(input.file, ctx);
       parsed = JSON.parse(raw);
-    } catch {
-      return { data: null, formatted: "", type: "unknown", action: "validate", error: "Could not read/parse file" };
+    } catch (error) {
+      return {
+        data: null,
+        formatted: "",
+        type: "unknown",
+        action: "validate",
+        error: error instanceof JsonFileTooLargeError ? error.message : "Could not read/parse file"
+      };
     }
   } else if (input.data) {
     try {
@@ -274,10 +314,16 @@ async function executeTransform(input, ctx) {
   let parsed;
   if (input.file) {
     try {
-      const raw = await fs.readFile(await safeResolveReal(input.file, ctx), "utf8");
+      const raw = await readJsonFileBounded(input.file, ctx);
       parsed = JSON.parse(raw);
-    } catch {
-      return { data: null, formatted: "", type: "unknown", action: "transform", error: "Could not read/parse file" };
+    } catch (error) {
+      return {
+        data: null,
+        formatted: "",
+        type: "unknown",
+        action: "transform",
+        error: error instanceof JsonFileTooLargeError ? error.message : "Could not read/parse file"
+      };
     }
   } else if (input.data) {
     try {

package/dist/kanban-board-inputs.d.ts

@@ -8,8 +8,17 @@ export declare function boardCreateInput(input: KanbanToolInput, title: string):
         mode: "assess" | "enforce" | "off";
         decomposition: "auto" | "propose";
     };
-    completionGate?: {
-        enforcement: import("@wrongstack/kanban").KanbanCompletionGateEnforcement;
+} | {
+    completionGate: {
+        enforcement: 'strict' | 'soft';
+    };
+    title: string;
+    description?: string;
+    tags?: string[];
+    generatedBy?: string;
+    atomicity?: {
+        mode: "assess" | "enforce" | "off";
+        decomposition: "auto" | "propose";
     };
 };
 export declare function boardUpdatePatch(input: KanbanToolInput): {
@@ -20,8 +29,16 @@ export declare function boardUpdatePatch(input: KanbanToolInput): {
         mode: "assess" | "enforce" | "off";
         decomposition: "auto" | "propose";
     };
-    completionGate?: {
-        enforcement: import("@wrongstack/kanban").KanbanCompletionGateEnforcement;
+} | {
+    completionGate: {
+        enforcement: 'strict' | 'soft';
+    };
+    title?: string;
+    description?: string;
+    tags?: string[];
+    atomicity?: {
+        mode: "assess" | "enforce" | "off";
+        decomposition: "auto" | "propose";
     };
 };
 export declare function duplicateBoardOptions(input: KanbanToolInput): {

package/dist/kanban.js

@@ -345,6 +345,10 @@ async function handleKanbanDetailAction(projectRoot, input) {
 }
 
 // src/kanban-board-inputs.ts
+function agentSettableGate(enforcement) {
+  if (enforcement === void 0 || enforcement === "off") return {};
+  return { completionGate: { enforcement } };
+}
 function boardCreateInput(input, title) {
   return {
     title,
@@ -357,7 +361,7 @@ function boardCreateInput(input, title) {
         decomposition: input.atomicityDecomposition ?? "propose"
       }
     } : {},
-    ...input.gateEnforcement !== void 0 ? { completionGate: { enforcement: input.gateEnforcement } } : {}
+    ...agentSettableGate(input.gateEnforcement)
   };
 }
 function boardUpdatePatch(input) {
@@ -371,7 +375,7 @@ function boardUpdatePatch(input) {
         decomposition: input.atomicityDecomposition ?? "propose"
       }
     } : {},
-    ...input.gateEnforcement !== void 0 ? { completionGate: { enforcement: input.gateEnforcement } } : {}
+    ...agentSettableGate(input.gateEnforcement)
   };
 }
 function duplicateBoardOptions(input) {
@@ -386,6 +390,7 @@ function duplicateBoardOptions(input) {
 
 // src/kanban-task-inputs.ts
 import { randomUUID } from "node:crypto";
+import { clampSubagentCapabilities } from "@wrongstack/core/security";
 function taskInput(input) {
   const assignment = hasAssignmentInput(input) ? assignmentForTaskCreate(input) : void 0;
   return {
@@ -483,6 +488,10 @@ function taskPatch(input) {
     ...input.actualHours !== void 0 ? { actualHours: input.actualHours } : {}
   };
 }
+function clampRequestedCapabilities(requested) {
+  if (requested === void 0) return void 0;
+  return clampSubagentCapabilities(requested).granted;
+}
 function assignmentInput(input) {
   return {
     agentId: input.agentId,
@@ -493,7 +502,7 @@ function assignmentInput(input) {
     fallbackProfile: input.fallbackProfile,
     fallbackModels: input.fallbackModels,
     tools: input.tools,
-    allowedCapabilities: input.allowedCapabilities,
+    allowedCapabilities: clampRequestedCapabilities(input.allowedCapabilities),
     assignee: input.assignee,
     leaseId: input.leaseId,
     claimedAt: input.claimedAt,
@@ -520,7 +529,7 @@ function assignmentForTaskCreate(input) {
     ...input.fallbackProfile !== void 0 ? { fallbackProfile: input.fallbackProfile } : {},
     ...input.fallbackModels !== void 0 ? { fallbackModels: input.fallbackModels } : {},
     ...input.tools !== void 0 ? { tools: input.tools } : {},
-    ...input.allowedCapabilities !== void 0 ? { allowedCapabilities: input.allowedCapabilities } : {},
+    ...input.allowedCapabilities !== void 0 ? { allowedCapabilities: clampRequestedCapabilities(input.allowedCapabilities) } : {},
     ...input.leaseId !== void 0 ? { leaseId: input.leaseId } : {},
     ...input.claimedAt !== void 0 ? { claimedAt: input.claimedAt } : {},
     ...input.heartbeatAt !== void 0 ? { heartbeatAt: input.heartbeatAt } : {},
@@ -731,7 +740,13 @@ var KANBAN_INPUT_SCHEMA = {
     moveTasksToColumnId: { type: "string" },
     atomicityMode: { type: "string", enum: ["off", "assess", "enforce"] },
     atomicityDecomposition: { type: "string", enum: ["auto", "propose"] },
-    gateEnforcement: { type: "string", enum: ["strict", "soft", "off"] },
+    gateEnforcement: {
+      type: "string",
+      // WS-023: `'off'` is deliberately absent. The agent whose work this gate
+      // checks must not be able to switch it off; it may only tighten. Turning
+      // a gate off stays a human decision, made through board config.
+      enum: ["strict", "soft"]
+    },
     subtasks: {
       type: "array",
       minItems: 2,