@wrongstack/tools 0.305.0 → 0.306.0

package/dist/search.js

@@ -102,6 +102,10 @@ async function guardedFetch(url, maxRedirects, signal, headers = {
     if (res.status < 300 || res.status > 399) {
       return res;
     }
+    try {
+      await res.body?.cancel();
+    } catch {
+    }
     redirectCount++;
     if (redirectCount > maxRedirects) {
       throw new FetchError({
@@ -167,6 +171,7 @@ async function assertNotPrivate(hostname) {
 import { toErrorMessage } from "@wrongstack/core/utils";
 var DEFAULT_NUM = 10;
 var MAX_RESULTS = 50;
+var MAX_SNIPPET_CHARS = 300;
 var TIMEOUT_MS = 15e3;
 var CACHE_TTL_MS = 3e5;
 var CACHE_MAX_ENTRIES = 200;
@@ -174,7 +179,7 @@ var cache = /* @__PURE__ */ new Map();
 var searchTool = {
   name: "search",
   category: "Search",
-  description: "Perform a web search and return results with title, URL, and snippet. Use this when you need up-to-date external information that is not in the local codebase. Results are cached (5 min TTL) and deduplicated by URL.",
+  description: "Perform a web search and return results with title, URL, and snippet. Use this when you need up-to-date external information that is not in the local codebase. Results are cached (5 min TTL) and deduplicated by URL. google and bing are best-effort HTML scrapes that fall back to duckduckgo when they return nothing usable.",
   usageHint: "Good for: API documentation, error messages, library usage examples, current best practices.\n\n- Prefer specific queries over very broad ones.\n- Results go through the guarded fetch system (same protections as the `fetch` tool).\n- Supports duckduckgo (default), google, and bing sources.\n- Set `skip_cache: true` to force a fresh search.\n- This is often better than the model trying to recall outdated knowledge.",
   permission: "auto",
   mutating: false,
@@ -248,7 +253,7 @@ var searchTool = {
             query: input.query,
             results: results.slice(0, num),
             source: entry.source,
-            truncated: results.length >= num,
+            truncated: results.length > num,
             cached: true
           }
         };
@@ -260,17 +265,17 @@ var searchTool = {
       text: `Querying ${source} for "${input.query}"\u2026`,
       data: { source, query: input.query, cached: false }
     };
-    let rawResults;
+    let engine;
     let effectiveSource = source;
     switch (source) {
       case "duckduckgo":
-        rawResults = await duckduckgoSearch(input.query, num, opts.signal);
+        engine = await duckduckgoSearch(input.query, opts.signal);
         break;
       case "google":
-        rawResults = await googleSearch(input.query, num, opts.signal);
+        engine = await googleSearch(input.query, opts.signal);
         break;
       case "bing":
-        rawResults = await bingSearch(input.query, num, opts.signal);
+        engine = await bingSearch(input.query, opts.signal);
         break;
       default:
         throw new ToolValidationError2({
@@ -278,23 +283,27 @@ var searchTool = {
           field: "source"
         });
     }
-    let ranked = rankSearchResults(rawResults, input.query);
+    let ranked = rankSearchResults(engine.results, input.query);
+    let engineError = engine.error;
     if (source !== "duckduckgo" && shouldFallbackToDuckDuckGo(ranked, input.query)) {
       yield {
         type: "log",
         text: `${source} returned no relevant static results; falling back to duckduckgo`,
         data: { source, fallback: "duckduckgo", query: input.query }
       };
-      rawResults = await duckduckgoSearch(input.query, num, opts.signal);
-      ranked = rankSearchResults(rawResults, input.query);
+      const fallback = await duckduckgoSearch(input.query, opts.signal);
+      ranked = rankSearchResults(fallback.results, input.query);
+      engineError = fallback.error;
       effectiveSource = "duckduckgo";
     }
     const finalResults = ranked.slice(0, num);
-    cache.set(cacheKey, { results: ranked, source: effectiveSource, timestamp: Date.now() });
-    pruneCacheEntries();
+    if (!engineError) {
+      cache.set(cacheKey, { results: ranked, source: effectiveSource, timestamp: Date.now() });
+      pruneCacheEntries();
+    }
     yield {
       type: "partial_output",
-      text: `${finalResults.length} results from ${effectiveSource}`,
+      text: engineError ? `search failed: ${engineError}` : `${finalResults.length} results from ${effectiveSource}`,
       data: { count: finalResults.length, cached: false, source: effectiveSource }
     };
     yield {
@@ -307,8 +316,9 @@ var searchTool = {
           snippet: r.snippet
         })),
         source: effectiveSource,
-        truncated: finalResults.length >= num,
-        cached: false
+        truncated: ranked.length > num,
+        cached: false,
+        ...engineError ? { error: engineError } : {}
       }
     };
   }
@@ -362,18 +372,18 @@ function shouldFallbackToDuckDuckGo(results, query) {
     return terms.some((term) => haystack.includes(term));
   });
 }
-async function duckduckgoSearch(query, num, signal) {
+async function duckduckgoSearch(query, signal) {
   const encoded = encodeURIComponent(query);
   const url = `https://lite.duckduckgo.com/lite/?q=${encoded}&kd=-1&kl=wt-wt`;
   try {
     const response = await fetchWithTimeout(url, signal, TIMEOUT_MS);
     const html = await response.text();
-    return parseDuckDuckGo(html, num);
+    return { results: parseDuckDuckGo(html, MAX_RESULTS) };
   } catch (err) {
     console.log(
       JSON.stringify({ level: "debug", event: "search_failed", query, error: toErrorMessage(err) })
     );
-    return [{ title: "Search unavailable", url: "https://duckduckgo.com/unavailable", snippet: "Could not reach DuckDuckGo", score: 0 }];
+    return { results: [], error: `duckduckgo unreachable: ${toErrorMessage(err)}` };
   }
 }
 function takeFrom(iter, max) {
@@ -407,7 +417,7 @@ function parseDuckDuckGo(html, num) {
       results.push({
         title: entry.title ?? "",
         url: entry.url ?? "",
-        snippet: snippetMatches[i] ?? "",
+        snippet: capSnippet(snippetMatches[i] ?? ""),
         score: 1
       });
     }
@@ -432,11 +442,15 @@ function normalizeDuckDuckGoUrl(raw) {
     return raw;
   }
 }
-async function googleSearch(query, num, signal) {
+async function googleSearch(query, signal) {
   const encoded = encodeURIComponent(query);
   const url = `https://www.google.com/search?q=${encoded}&hl=en`;
-  const html = await fetchWithTimeout(url, signal, TIMEOUT_MS).then((r) => r.text()).catch(() => "");
-  return parseGoogleResults(html, num);
+  try {
+    const html = await fetchWithTimeout(url, signal, TIMEOUT_MS).then((r) => r.text());
+    return { results: parseGoogleResults(html, MAX_RESULTS) };
+  } catch (err) {
+    return { results: [], error: `google unreachable: ${toErrorMessage(err)}` };
+  }
 }
 function parseGoogleResults(html, num) {
   const results = [];
@@ -459,17 +473,21 @@ function parseGoogleResults(html, num) {
     results.push({
       title: titles[i] ?? "",
       url: urls[i] ?? "",
-      snippet: snippets[i] ?? "",
+      snippet: capSnippet(snippets[i] ?? ""),
       score: 1
     });
   }
   return results;
 }
-async function bingSearch(query, num, signal) {
+async function bingSearch(query, signal) {
   const encoded = encodeURIComponent(query);
   const url = `https://www.bing.com/search?q=${encoded}`;
-  const html = await fetchWithTimeout(url, signal, TIMEOUT_MS).then((r) => r.text()).catch(() => "");
-  return parseBingResults(html, num);
+  try {
+    const html = await fetchWithTimeout(url, signal, TIMEOUT_MS).then((r) => r.text());
+    return { results: parseBingResults(html, MAX_RESULTS) };
+  } catch (err) {
+    return { results: [], error: `bing unreachable: ${toErrorMessage(err)}` };
+  }
 }
 function parseBingResults(html, num) {
   const results = [];
@@ -482,7 +500,7 @@ function parseBingResults(html, num) {
     const title = stripTags(expectDefined(titleMatch[2]));
     if (!href || !title) return [];
     const snippetMatch = /<p\b[^>]*class=(["'])[^"']*\b(?:b_paractl|b_lineclamp\d*)\b[^"']*\1[^>]*>([\s\S]*?)<\/p>/i.exec(block) ?? /<p\b[^>]*>([\s\S]*?)<\/p>/i.exec(block);
-    const snippet = snippetMatch ? stripTags(expectDefined(snippetMatch.at(-1))) : "";
+    const snippet = snippetMatch ? capSnippet(stripTags(expectDefined(snippetMatch.at(-1)))) : "";
     return [{ url: normalizeBingUrl(href), title, snippet, score: 1 }];
   }), num);
   for (let i = 0; i < entries.length; i++) {
@@ -549,6 +567,9 @@ function anySignal(...signals) {
 function stripTags(html) {
   return decodeHtmlEntities(html.replace(/<[^>]+>/g, "")).trim();
 }
+function capSnippet(snippet) {
+  return snippet.length > MAX_SNIPPET_CHARS ? `${snippet.slice(0, MAX_SNIPPET_CHARS - 1)}\u2026` : snippet;
+}
 function decodeHtmlEntities(text) {
   return text.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
 }

package/dist/session-kanban.d.ts

@@ -97,6 +97,31 @@ export declare function rebindSessionKanbanTask(context: Context): Promise<{
     boardId: string;
     taskId: string;
 } | null>;
+/**
+ * Why session Kanban is unavailable, or undefined while it is healthy.
+ *
+ * Surfaces exist so a startup path can tell the user their board will not sync
+ * without having to catch and classify the failure itself. Cleared on the
+ * first hydrate that succeeds, so a daemon that comes back stops being
+ * reported as down.
+ */
+export declare function sessionKanbanDegradation(): string | undefined;
+/**
+ * Project the session's todos, plan, and tasks onto its Kanban board.
+ *
+ * Kanban is a projection: every card here is derived from state that lives
+ * somewhere else and is authoritative there. Losing the board costs the user a
+ * view, not any work — so an unreachable Kanban daemon degrades this to `null`
+ * rather than propagating.
+ *
+ * That distinction used to be missing, and it cost an entire session. When a
+ * killed daemon left a stale IPC endpoint behind, the connect error thrown
+ * here unwound through `setupSession` and killed `wstack` at startup: no
+ * prompt, no session, just a socket path in a stack trace — for a board the
+ * user had not asked to see. `bindProjectEndpoint` now stops the daemon from
+ * wedging in the first place, but the call site must still hold: an optional
+ * view may never take down the session it decorates.
+ */
 export declare function hydrateSessionKanban(context: Context): Promise<KanbanBoard | null>;
 export interface SessionKanbanSourceUpdate {
     source: 'todo' | 'task' | 'plan' | null;

package/dist/session-kanban.js

@@ -720,9 +720,24 @@ async function rebindSessionKanbanTask(context) {
   context.setCurrentKanbanTask(best.taskId, best.boardId);
   return { boardId: best.boardId, taskId: best.taskId };
 }
+var degradationReason;
+function sessionKanbanDegradation() {
+  return degradationReason;
+}
 async function hydrateSessionKanban(context) {
   const id = context.session?.id ?? "";
   if (!id) return null;
+  try {
+    const board = await hydrateSessionKanbanBoard(context, id);
+    degradationReason = void 0;
+    return board;
+  } catch (error) {
+    degradationReason = error instanceof Error ? error.message : String(error);
+    fireAndForget("hydrate", Promise.reject(error));
+    return null;
+  }
+}
+async function hydrateSessionKanbanBoard(context, id) {
   await rebindSessionKanbanTask(context);
   await cleanupEmptySessionKanbanBoards(context.projectRoot, id);
   if (context.projectRoot) {
@@ -958,6 +973,7 @@ export {
   projectSessionTasksToKanban,
   projectSessionTodosToKanban,
   rebindSessionKanbanTask,
+  sessionKanbanDegradation,
   takeSessionMirrorFailure,
   taskFileToSerializedGraph,
   todoListToSerializedGraph,

package/dist/skill.d.ts

@@ -27,6 +27,12 @@ interface SkillToolOutput {
     dir: string;
     /** When `resource` was requested: the loaded file. */
     loadedResource?: LoadedResource | undefined;
+    /**
+     * Soft advisory: prose in the skill body mentions tools not registered in
+     * this runtime (e.g. hidden by a token-saving tier). The skill still loads —
+     * only `manifest.requiredTools` hard-fails.
+     */
+    warning?: string | undefined;
 }
 /**
  * Skill tool — the agentskills.io progressive-disclosure primitive.

package/dist/skill.js

@@ -74,12 +74,7 @@ function makeSkillTool(skillLoader) {
         runtimeToolReferencesFromText(raw),
         availableToolNames
       );
-      if (missingBodyTools.length > 0) {
-        throw new ToolValidationError({
-          message: `skill "${name}" references unregistered tools: ${missingBodyTools.join(", ")}`,
-          field: "name"
-        });
-      }
+      const warning = missingBodyTools.length > 0 ? `Warning: skill "${name}" references tools not registered in this runtime: ${missingBodyTools.join(", ")}. Steps that call them may be unavailable.` : void 0;
       const body = stripFrontmatter(raw).trim().slice(0, MAX_BODY_CHARS);
       const resources = loadedResource ? [] : await listResources(dir);
       try {
@@ -96,29 +91,33 @@ function makeSkillTool(skillLoader) {
         body,
         resources,
         dir,
-        loadedResource
+        loadedResource,
+        warning
       };
     },
     serialize(output) {
+      const warningLine = output.warning ? `
+
+${output.warning}` : "";
       if (output.loadedResource) {
         const lr = output.loadedResource;
         const note = lr.truncated ? ` (truncated to ${lr.content.length} chars of ${lr.bytes} B)` : "";
         return `# Resource: ${output.name}/${lr.rel}
 (abs path: ${lr.absPath})${note}
 
-${lr.content}`;
+${lr.content}${warningLine}`;
       }
       const head = `# Skill: ${output.name}
 ${output.description}
 
 ${output.body}`;
-      if (output.resources.length === 0) return head;
+      if (output.resources.length === 0) return `${head}${warningLine}`;
       const listing = output.resources.map((r) => `- ${r.path} (${r.bytes} B)`).join("\n");
       return `${head}
 
 ## Bundled resources (load on demand)
 Load any with: \`skill({ name: "${output.name}", resource: "<path>" })\`. Run scripts via bash using their abs path under ${output.dir}.
-${listing}`;
+${listing}${warningLine}`;
     }
   };
 }

package/dist/task.js

@@ -1350,6 +1350,18 @@ var KANBAN_INPUT_SCHEMA = {
     },
     transitionAction: { type: "string" },
     transitionComment: { type: "string" },
+    tickChecks: {
+      type: "array",
+      items: {
+        type: "object",
+        properties: {
+          checkId: { type: "string" },
+          checkStatus: { type: "string", enum: ["passed", "failed", "skipped"] }
+        },
+        required: ["checkId", "checkStatus"]
+      },
+      description: "`transition_task` (to=done only): flip one or more manual criteria to `passed` before the gate fires. Read ids from kanban get_task. Non-manual criteria are refused."
+    },
     attachmentUrl: { type: "string" },
     attachmentTitle: { type: "string" },
     attachmentType: {
@@ -1537,6 +1549,9 @@ var kanbanTool = {
   description: KANBAN_TOOL_DESCRIPTION,
   usageHint: KANBAN_TOOL_USAGE_HINT,
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // The action performed; kanban has no single file or path subject.
+  subjectKey: "action",
   mutating: true,
   capabilities: ["fs.write"],
   icon: "task",
@@ -1978,6 +1993,7 @@ var kanbanTool = {
               actor: input.author,
               comment: input.transitionComment,
               ...input.transitionAction !== void 0 ? { action: input.transitionAction } : {},
+              ...input.tickChecks !== void 0 ? { tickChecks: input.tickChecks } : {},
               ...input.attachmentUrl !== void 0 ? {
                 attachment: {
                   url: input.attachmentUrl,
@@ -2370,8 +2386,52 @@ var kanbanTool = {
     } catch (err) {
       return fail(stripLifecycleIssues(err instanceof Error ? err.message : String(err)));
     }
+  },
+  serialize(output, input) {
+    return serializeKanbanOutput(output, input);
   }
 };
+var KANBAN_BOARD_TRANSCRIPT_BYTE_CAP = 16384;
+var KANBAN_FULL_BOARD_ACTIONS = /* @__PURE__ */ new Set([
+  "get_board",
+  "export_markdown",
+  "export_task_graph"
+]);
+function serializeKanbanOutput(output, input) {
+  const action = input && typeof input === "object" ? input.action : void 0;
+  const board = output.board;
+  if (board) {
+    const keepFull = typeof action === "string" && KANBAN_FULL_BOARD_ACTIONS.has(action);
+    let boardBytes = 0;
+    if (!keepFull) {
+      try {
+        boardBytes = Buffer.byteLength(JSON.stringify(board), "utf8");
+      } catch {
+        boardBytes = 0;
+      }
+    }
+    if (!keepFull && boardBytes > KANBAN_BOARD_TRANSCRIPT_BYTE_CAP) {
+      const columns = {};
+      for (const column of board.columns) {
+        columns[column.title || column.id] = board.tasks.filter(
+          (task) => task.columnId === column.id
+        ).length;
+      }
+      const compact = {
+        ...output,
+        board: {
+          id: board.id,
+          title: board.title,
+          columns,
+          totalTasks: board.tasks.length,
+          note: `Full board (${boardBytes} bytes) omitted from the transcript; use get_board to load it.`
+        }
+      };
+      return JSON.stringify(compact, null, 2);
+    }
+  }
+  return JSON.stringify(output, null, 2);
+}
 
 // src/todo.ts
 function normalizedTitle(value) {
@@ -2710,7 +2770,8 @@ var todoTool = {
     }
     for (const planId of completedPlanIds) {
       if (pendingPlanIds.has(planId)) continue;
-      const planPath = ctx.meta["plan.path"];
+      const meta = ctx.meta;
+      const planPath = meta["plan.path.resolved"] ?? meta["plan.path"];
       if (typeof planPath !== "string" || !planPath) continue;
       try {
         const plan = await loadPlan2(planPath);
@@ -2723,7 +2784,8 @@ var todoTool = {
     }
     for (const taskId of completedTaskIds) {
       if (pendingTaskIds.has(taskId)) continue;
-      const taskPath = ctx.meta["task.path"];
+      const meta = ctx.meta;
+      const taskPath = meta["task.path.resolved"] ?? meta["task.path"];
       if (typeof taskPath !== "string" || !taskPath) continue;
       try {
         const file = await loadTasks3(taskPath);
@@ -3204,6 +3266,7 @@ var taskTool = {
         inProgress: 0
       };
     }
+    ctx.meta["task.path.resolved"] = taskPath;
     if (todosToReplace) {
       await todoTool.execute({ todos: todosToReplace }, ctx, {
         signal: AbortSignal.timeout(3e4)
@@ -3228,6 +3291,7 @@ var taskTool = {
             formatted = formatPlan(updated);
             return updated;
           });
+          ctx.meta["plan.path.resolved"] = planPath;
         } catch (err) {
           return {
             ok: false,

package/dist/test.js

@@ -367,8 +367,11 @@ var SENSITIVE_FLAG_PATTERNS = [
   /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
   // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
   // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
+  // The value must be token-like (>= 8 chars) so ordinary combined flags such
+  // as `tar -tf` / `ssh -tt` are not eaten. Global flag: EVERY occurrence is
+  // redacted, not just the first.
   // NOTE: synced with @wrongstack/core observability/redact-command.ts.
-  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]+/,
+  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]{8,}/g,
   // -p|-password|-a (redis auth) short flags: attached + separated + =value.
   // Same token-start anchor; over-redaction is an accepted tradeoff for a
   // redaction function. Synced with core copy.
@@ -376,8 +379,9 @@ var SENSITIVE_FLAG_PATTERNS = [
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
   /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
-  // when preceded by a flag name (e.g. --github-token=EyJ...).
-  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/
+  // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
+  // every such flag in the command line is redacted, not just the first.
+  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/g
 ];
 function redactCommand(cmd) {
   let result = cmd;
@@ -466,11 +470,15 @@ var ProcessRegistryImpl = class {
     return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
   }
   _canSignalProcessGroup(p) {
-    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && typeof p.child.pid === "number" && p.child.pid === p.pid;
+    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && p.child !== null && typeof p.child.pid === "number" && p.child.pid === p.pid;
   }
   _killChildDirect(p, signal) {
     try {
-      p.child.kill(signal);
+      if (p.child) {
+        p.child.kill(signal);
+        return;
+      }
+      if (this._isSafeSignalPid(p.pid)) process.kill(p.pid, signal);
     } catch {
     }
   }
@@ -668,15 +676,15 @@ var ProcessRegistryImpl = class {
     this._pruneStale(pid);
     const p = this.processes.get(pid);
     if (!p) return false;
-    if (p.killed) return true;
+    if (p.killed && opts.force !== true) return true;
     if (p.protected && opts.includeProtected !== true) return false;
     if (opts.preserveBackground && p.background) return false;
     const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
     const isWin2 = os.platform() === "win32";
     if (isWin2) {
-      const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
+      const liveRealChild = p.child === null || p.child.exitCode === null && typeof p.child.pid === "number";
       const directFallback = () => {
-        if (p.child.exitCode === null) {
+        if (p.child && p.child.exitCode === null) {
           try {
             p.child.kill("SIGKILL");
           } catch {
@@ -688,10 +696,7 @@ var ProcessRegistryImpl = class {
         onSettled: directFallback
       })) {
       } else {
-        try {
-          p.child.kill(force ? "SIGKILL" : "SIGTERM");
-        } catch {
-        }
+        this._killChildDirect(p, force ? "SIGKILL" : "SIGTERM");
       }
       p.killed = true;
       return true;
@@ -702,7 +707,7 @@ var ProcessRegistryImpl = class {
       } else {
         this._killPosix(p, "SIGTERM");
         const timer = setTimeout(() => {
-          if (this.processes.has(pid) && !p.child.killed) {
+          if (this.processes.has(pid) && !p.child?.killed) {
             this._killPosix(p, "SIGKILL");
           }
         }, graceMs);
@@ -757,6 +762,16 @@ var ProcessRegistryImpl = class {
    * before reusing a PID, but we want to clean up before that becomes a risk.
    */
   _isStaleEntry(entry) {
+    if (entry.child === null) {
+      if (Date.now() - entry.startedAt <= 6e4) return false;
+      if (os.platform() === "win32") return false;
+      try {
+        process.kill(entry.pid, 0);
+        return false;
+      } catch (err) {
+        return err.code !== "EPERM";
+      }
+    }
     return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
   }
   /**

package/dist/todo.js

@@ -870,6 +870,18 @@ var KANBAN_INPUT_SCHEMA = {
     },
     transitionAction: { type: "string" },
     transitionComment: { type: "string" },
+    tickChecks: {
+      type: "array",
+      items: {
+        type: "object",
+        properties: {
+          checkId: { type: "string" },
+          checkStatus: { type: "string", enum: ["passed", "failed", "skipped"] }
+        },
+        required: ["checkId", "checkStatus"]
+      },
+      description: "`transition_task` (to=done only): flip one or more manual criteria to `passed` before the gate fires. Read ids from kanban get_task. Non-manual criteria are refused."
+    },
     attachmentUrl: { type: "string" },
     attachmentTitle: { type: "string" },
     attachmentType: {
@@ -1524,6 +1536,9 @@ var kanbanTool = {
   description: KANBAN_TOOL_DESCRIPTION,
   usageHint: KANBAN_TOOL_USAGE_HINT,
   permission: "confirm",
+  // WS-046: gives permission decisions something to key on.
+  // The action performed; kanban has no single file or path subject.
+  subjectKey: "action",
   mutating: true,
   capabilities: ["fs.write"],
   icon: "task",
@@ -1965,6 +1980,7 @@ var kanbanTool = {
               actor: input.author,
               comment: input.transitionComment,
               ...input.transitionAction !== void 0 ? { action: input.transitionAction } : {},
+              ...input.tickChecks !== void 0 ? { tickChecks: input.tickChecks } : {},
               ...input.attachmentUrl !== void 0 ? {
                 attachment: {
                   url: input.attachmentUrl,
@@ -2357,8 +2373,52 @@ var kanbanTool = {
     } catch (err) {
       return fail(stripLifecycleIssues(err instanceof Error ? err.message : String(err)));
     }
+  },
+  serialize(output, input) {
+    return serializeKanbanOutput(output, input);
   }
 };
+var KANBAN_BOARD_TRANSCRIPT_BYTE_CAP = 16384;
+var KANBAN_FULL_BOARD_ACTIONS = /* @__PURE__ */ new Set([
+  "get_board",
+  "export_markdown",
+  "export_task_graph"
+]);
+function serializeKanbanOutput(output, input) {
+  const action = input && typeof input === "object" ? input.action : void 0;
+  const board = output.board;
+  if (board) {
+    const keepFull = typeof action === "string" && KANBAN_FULL_BOARD_ACTIONS.has(action);
+    let boardBytes = 0;
+    if (!keepFull) {
+      try {
+        boardBytes = Buffer.byteLength(JSON.stringify(board), "utf8");
+      } catch {
+        boardBytes = 0;
+      }
+    }
+    if (!keepFull && boardBytes > KANBAN_BOARD_TRANSCRIPT_BYTE_CAP) {
+      const columns = {};
+      for (const column of board.columns) {
+        columns[column.title || column.id] = board.tasks.filter(
+          (task) => task.columnId === column.id
+        ).length;
+      }
+      const compact = {
+        ...output,
+        board: {
+          id: board.id,
+          title: board.title,
+          columns,
+          totalTasks: board.tasks.length,
+          note: `Full board (${boardBytes} bytes) omitted from the transcript; use get_board to load it.`
+        }
+      };
+      return JSON.stringify(compact, null, 2);
+    }
+  }
+  return JSON.stringify(output, null, 2);
+}
 
 // src/todo.ts
 function normalizedTitle(value) {
@@ -2697,7 +2757,8 @@ var todoTool = {
     }
     for (const planId of completedPlanIds) {
       if (pendingPlanIds.has(planId)) continue;
-      const planPath = ctx.meta["plan.path"];
+      const meta = ctx.meta;
+      const planPath = meta["plan.path.resolved"] ?? meta["plan.path"];
       if (typeof planPath !== "string" || !planPath) continue;
       try {
         const plan = await loadPlan2(planPath);
@@ -2710,7 +2771,8 @@ var todoTool = {
     }
     for (const taskId of completedTaskIds) {
       if (pendingTaskIds.has(taskId)) continue;
-      const taskPath = ctx.meta["task.path"];
+      const meta = ctx.meta;
+      const taskPath = meta["task.path.resolved"] ?? meta["task.path"];
       if (typeof taskPath !== "string" || !taskPath) continue;
       try {
         const file = await loadTasks3(taskPath);

package/dist/tool-icons.js

@@ -60,13 +60,15 @@ var TOOL_ICON_MAP = {
   replace: "edit",
   str_replace: "edit",
   multi_edit: "edit",
-  patch: "diff",
+  // Matches patchTool's own `icon: 'edit'` (tool-icon-map.ts agrees).
+  patch: "edit",
   // ── search ──
   grep: "search",
   search: "search",
   rg: "search",
   ripgrep: "search",
-  glob: "search",
+  // Matches globTool's own `icon: 'folder'` (tool-icon-map.ts agrees).
+  glob: "folder",
   find: "search",
   // ── navigation ──
   folder: "folder",