@webpresso/agent-kit 3.1.30 → 3.2.0

package/dist/esm/test/worker-budget.d.ts

@@ -7,4 +7,10 @@ export interface VitestWorkerBudget {
     readonly subprocess: number;
 }
 export declare function parsePositiveInteger(value: string | undefined): number | undefined;
+/**
+ * Allocate one worker ceiling across concurrently running Vitest projects.
+ * Standalone project runs keep `computeVitestWorkerBudget`; only the supervisor
+ * uses this aggregate contract.
+ */
+export declare function computeConcurrentVitestWorkerBudget(options?: VitestWorkerBudgetOptions): VitestWorkerBudget;
 export declare function computeVitestWorkerBudget(options?: VitestWorkerBudgetOptions): VitestWorkerBudget;

package/dist/esm/test/worker-budget.js

@@ -9,12 +9,70 @@ function splitSharedBudget(totalWorkers) {
     if (totalWorkers <= 2) {
         return { unit: 1, subprocess: 1 };
     }
-    const unit = Math.max(1, Math.round(totalWorkers * (2 / 3)));
+    // Even split. The lanes carry near-equal total work (measured 2026-07-23 on
+    // an 8-core host: unit ≈320 worker-seconds, subprocess ≈266 — see
+    // docs/ci-test-perf.md), so the previous 2/3-unit skew starved the
+    // subprocess lane: its makespan, not unit's, bounded the whole run
+    // (subprocess lane >296s at 2 workers vs 168s at 4 on the same host).
+    // CI is unaffected — it pins WP_VITEST_MAX_WORKERS=2, taking the early
+    // return above.
+    const unit = Math.max(1, Math.round(totalWorkers / 2));
     return {
         unit,
         subprocess: Math.max(1, totalWorkers - unit),
     };
 }
+function readWorkerOverride(env, name) {
+    const raw = env[name];
+    if (raw === undefined)
+        return;
+    const parsed = parsePositiveInteger(raw);
+    if (parsed === undefined) {
+        throw new Error(`${name} must be a positive integer, got ${JSON.stringify(raw)}`);
+    }
+    return parsed;
+}
+/**
+ * Allocate one worker ceiling across concurrently running Vitest projects.
+ * Standalone project runs keep `computeVitestWorkerBudget`; only the supervisor
+ * uses this aggregate contract.
+ */
+export function computeConcurrentVitestWorkerBudget(options = {}) {
+    const env = options.env ?? process.env;
+    const sharedOverride = readWorkerOverride(env, "WP_VITEST_MAX_WORKERS");
+    const unitOverride = readWorkerOverride(env, "WP_VITEST_UNIT_MAX_WORKERS");
+    const subprocessOverride = readWorkerOverride(env, "WP_VITEST_SUBPROCESS_MAX_WORKERS");
+    if (sharedOverride === undefined &&
+        unitOverride !== undefined &&
+        subprocessOverride !== undefined) {
+        return { unit: unitOverride, subprocess: subprocessOverride };
+    }
+    const total = sharedOverride ?? (env.CI === "true" ? 2 : defaultSharedWorkers(options));
+    if (total < 2) {
+        throw new Error(`WP_VITEST_MAX_WORKERS must be at least 2 for concurrent projects, got ${total}`);
+    }
+    if (unitOverride !== undefined && subprocessOverride !== undefined) {
+        if (unitOverride + subprocessOverride > total) {
+            throw new Error(`Lane worker overrides (${unitOverride + subprocessOverride}) exceed aggregate worker budget ${total}`);
+        }
+        return { unit: unitOverride, subprocess: subprocessOverride };
+    }
+    if (unitOverride !== undefined) {
+        const subprocess = total - unitOverride;
+        if (subprocess < 1) {
+            throw new Error(`Unit worker override ${unitOverride} leaves no aggregate subprocess worker`);
+        }
+        return { unit: unitOverride, subprocess };
+    }
+    if (subprocessOverride !== undefined) {
+        const unit = total - subprocessOverride;
+        if (unit < 1) {
+            throw new Error(`Subprocess worker override ${subprocessOverride} leaves no aggregate unit worker`);
+        }
+        return { unit, subprocess: subprocessOverride };
+    }
+    return splitSharedBudget(total);
+}
 export function computeVitestWorkerBudget(options = {}) {
     const env = options.env ?? process.env;
     const sharedOverride = parsePositiveInteger(env.WP_VITEST_MAX_WORKERS);

package/dist/esm/test-helpers/global-setup.d.ts

@@ -1,3 +1,3 @@
 import type { TestProject } from "vitest/node";
 export declare function shouldPrepareDistForProject(projectName: string | undefined): boolean;
-export declare function setup(project?: Pick<TestProject, "name">): void;
+export declare function setup(project?: Pick<TestProject, "name">): Promise<void>;

package/dist/esm/test-helpers/global-setup.js

@@ -1,44 +1,88 @@
 import { execFileSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
+import lockfile from "proper-lockfile";
 import { syncSastRuleAssets } from "#build/sast-rule-assets.js";
+import { runFormat } from "#format/index.js";
 import { ensureHostRuntimeArtifactsForSerialTests } from "./runtime-binary-artifacts.js";
 const REPO_ROOT = process.cwd();
 const DIST_SENTINEL = join(REPO_ROOT, "dist", "esm", "index.js");
 const MIGRATION_SENTINEL = join(REPO_ROOT, "dist", "esm", "blueprint", "db", "migrations", "0001_seed.sql");
+// Lock target lives outside dist/ (tshy rewrites dist/) and under the always-present, gitignored
+// node_modules/.cache so a concurrent test run cannot clobber it mid-build.
+const BUILD_LOCK_TARGET = join(REPO_ROOT, "node_modules", ".cache", "wp-test-setup");
 const DIST_PREP_PROJECTS = new Set(["subprocess", "serial-subprocess"]);
 export function shouldPrepareDistForProject(projectName) {
     return projectName !== undefined && DIST_PREP_PROJECTS.has(projectName);
 }
+// Serialize the dist build across concurrent test runs sharing this checkout: tshy's non-atomic
+// dist/package.json writes corrupt each other if two runs build at once. proper-lockfile gives a
+// bounded wait plus native stale-owner recovery (a dead builder's lock is reclaimed after `stale`).
+// The retry budget spans well past a cold build so a second run waits rather than failing closed.
+async function withDistBuildLock(fn) {
+    mkdirSync(join(REPO_ROOT, "node_modules", ".cache"), { recursive: true });
+    const release = await lockfile.lock(BUILD_LOCK_TARGET, {
+        realpath: false,
+        stale: 120_000,
+        retries: { retries: 40, factor: 1.4, minTimeout: 200, maxTimeout: 5_000 },
+    });
+    try {
+        return await fn();
+    }
+    finally {
+        await release();
+    }
+}
 // Build before subprocess workers fork — tshy's non-atomic package.json write races with bun subprocess reads in init.e2e.test.ts.
 // Unit-only runs should not pay this build/setup cost, and Vitest passes the selected TestProject to globalSetup.
-export function setup(project) {
+export async function setup(project) {
     syncSastRuleAssets(REPO_ROOT);
     if (!shouldPrepareDistForProject(project?.name))
         return;
-    let builtDist = false;
-    if (!existsSync(DIST_SENTINEL)) {
-        execFileSync("./node_modules/.bin/tshy", [], {
-            cwd: REPO_ROOT,
-            encoding: "utf8",
-            env: { ...process.env, HUSKY: "0" },
-        });
-        builtDist = true;
-    }
-    if (!existsSync(MIGRATION_SENTINEL)) {
-        execFileSync("bun", ["src/build/blueprint-migration-assets.ts"], {
-            cwd: REPO_ROOT,
-            encoding: "utf8",
-            env: { ...process.env, HUSKY: "0" },
-        });
-    }
-    if (builtDist) {
-        execFileSync("bun", ["src/build/normalize-tsconfig-json-exports.ts"], {
-            cwd: REPO_ROOT,
-            encoding: "utf8",
-            env: { ...process.env, HUSKY: "0" },
-        });
+    // Fast path: nothing to build. Only pay the lock when a build artifact is actually missing.
+    if (existsSync(DIST_SENTINEL) && existsSync(MIGRATION_SENTINEL)) {
+        if (project?.name === "serial-subprocess") {
+            ensureHostRuntimeArtifactsForSerialTests({ rootDir: REPO_ROOT });
+        }
+        return;
     }
+    await withDistBuildLock(async () => {
+        let builtDist = false;
+        // Re-check under the lock: another run may have completed the build while we waited.
+        if (!existsSync(DIST_SENTINEL)) {
+            execFileSync("./node_modules/.bin/tshy", [], {
+                cwd: REPO_ROOT,
+                encoding: "utf8",
+                env: { ...process.env, HUSKY: "0" },
+            });
+            builtDist = true;
+            // tshy rewrites package.json's exports with a trailing newline the repo formatter forbids
+            // (`.editorconfig [*.json] insert_final_newline = false`), which would leave a clean worktree
+            // dirty. The real `build` script (package.json `"build"`) restores it with `wp format --file
+            // package.json`; mirror that here in-process (runFormat spawns only `vp fmt`, avoiding a second
+            // cold CLI launch) so `wp test` never dirties package.json. See package-scripts.test.ts.
+            // Fail loudly if the restore does not succeed — a silent failure would ship a dirty package.json.
+            const restored = await runFormat({ files: ["package.json"], cwd: REPO_ROOT });
+            if (!restored.passed) {
+                throw new Error(`global-setup: could not restore package.json formatting after tshy (exit ${restored.exitCode})` +
+                    `${restored.spawnError ? `: ${restored.spawnError}` : ""}\n${restored.output}`);
+            }
+        }
+        if (!existsSync(MIGRATION_SENTINEL)) {
+            execFileSync("bun", ["src/build/blueprint-migration-assets.ts"], {
+                cwd: REPO_ROOT,
+                encoding: "utf8",
+                env: { ...process.env, HUSKY: "0" },
+            });
+        }
+        if (builtDist) {
+            execFileSync("bun", ["src/build/normalize-tsconfig-json-exports.ts"], {
+                cwd: REPO_ROOT,
+                encoding: "utf8",
+                env: { ...process.env, HUSKY: "0" },
+            });
+        }
+    });
     if (project?.name === "serial-subprocess") {
         ensureHostRuntimeArtifactsForSerialTests({ rootDir: REPO_ROOT });
     }

package/dist/esm/ultragoal/service.d.ts

@@ -70,6 +70,13 @@ export declare function decideUltragoalRun(input: {
     readonly currentSourceSnapshot?: string;
     readonly now?: Date;
 }): UltragoalRunDecision;
+/**
+ * Preflight every blueprint's document shape BEFORE a durable state
+ * transition. Ledger callbacks run after state is committed, so a flat
+ * blueprint must be rejected here or the command throws with state already
+ * written. Missing blueprints are tolerated exactly like the ledger append.
+ */
+export declare function assertUltragoalBlueprintShapes(cwd: string, slugs: readonly string[]): void;
 export declare function createUltragoal(input: {
     readonly cwd?: string;
     readonly brief: string;

package/dist/esm/ultragoal/service.js

@@ -7,6 +7,7 @@ import { BlueprintCreationService } from "#service/BlueprintCreationService.js";
 import { BlueprintService } from "#service/BlueprintService.js";
 import { scanBlueprintDirectory } from "#service/scanner.js";
 import { resolveBlueprintRoot } from "#utils/blueprint-root.js";
+import { assertFolderBlueprintIdentity, resolveBlueprintDocumentIdentity, } from "#utils/document-paths.js";
 import { assertUltragoalEnabled, assertUltragoalMutationAllowed } from "./guards.js";
 import { evaluateUltragoalCompletion, hasRepeatedQaError, MAX_STOP_STREAK, MAX_VALIDATION_ROUNDS, } from "./completion.js";
 import { formatUltragoalHandoff } from "./handoff.js";
@@ -222,14 +223,43 @@ export function decideUltragoalRun(input) {
     }
 }
 function findBlueprint(cwd, slug) {
+    const baseDir = resolveBlueprintRoot(cwd);
     const entries = scanBlueprintDirectory({
-        baseDir: resolveBlueprintRoot(cwd),
+        baseDir,
         includeSpecialFolders: true,
     });
     const found = entries.find((entry) => entry.slug === slug || entry.slug.endsWith(`/${slug}`));
     if (!found)
         throw new Error(`Blueprint not found: ${slug}`);
-    return found;
+    const identity = resolveBlueprintDocumentIdentity(baseDir, found.path);
+    if (!identity) {
+        throw new Error(`Blueprint ${found.slug} resolved to an invalid document path: ${found.path}`);
+    }
+    return { path: found.path, shape: identity.shape, slug: found.slug };
+}
+/**
+ * Preflight every blueprint's document shape BEFORE a durable state
+ * transition. Ledger callbacks run after state is committed, so a flat
+ * blueprint must be rejected here or the command throws with state already
+ * written. Missing blueprints are tolerated exactly like the ledger append.
+ */
+export function assertUltragoalBlueprintShapes(cwd, slugs) {
+    for (const slug of slugs) {
+        let found;
+        try {
+            found = findBlueprint(cwd, slug);
+        }
+        catch (error) {
+            if (error instanceof Error && error.message === `Blueprint not found: ${slug}`)
+                continue;
+            throw error;
+        }
+        assertFolderBlueprintIdentity({
+            documentPath: found.path,
+            lifecycleSlug: found.slug,
+            shape: found.shape,
+        });
+    }
 }
 function appendUltragoalLedgerEvent(cwd, slug, state, event) {
     let found;
@@ -241,6 +271,11 @@ function appendUltragoalLedgerEvent(cwd, slug, state, event) {
             return;
         throw error;
     }
+    assertFolderBlueprintIdentity({
+        documentPath: found.path,
+        lifecycleSlug: found.slug,
+        shape: found.shape,
+    });
     const reviewsPath = join(dirname(found.path), "reviews.md");
     mkdirSync(dirname(reviewsPath), { recursive: true });
     const prefix = existsSync(reviewsPath) ? "\n" : "# Blueprint reviews\n\n";
@@ -281,6 +316,7 @@ export async function createUltragoal(input) {
         sessionId: input.sessionId ?? process.env.WP_SESSION_ID ?? randomUUID(),
         ultragoalId: input.ultragoalId ?? `ultragoal-${randomUUID()}`,
     });
+    assertUltragoalBlueprintShapes(cwd, blueprintSlugs);
     await initializeUltragoalState(state, cwd, (written) => {
         for (const slug of blueprintSlugs)
             appendUltragoalLedgerEvent(cwd, slug, written, "created");
@@ -337,6 +373,9 @@ export async function getUltragoalHandoff(cwd = process.cwd()) {
 }
 export async function cancelUltragoal(cwd = process.cwd()) {
     assertUltragoalMutationAllowed(cwd);
+    const current = await readUltragoalState(cwd);
+    if (current)
+        assertUltragoalBlueprintShapes(cwd, current.blueprintSlugs);
     const next = await updateUltragoalState((state) => transitionUltragoalState(state, "cancelled"), cwd, (written) => {
         for (const slug of written.blueprintSlugs) {
             appendUltragoalLedgerEvent(cwd, slug, written, "cancelled");
@@ -394,6 +433,7 @@ export async function runCurrentUltragoal(cwd = process.cwd(), deps = {}) {
         now: deps.now?.() ?? new Date(),
     });
     if (committedDecision.state !== status.state) {
+        assertUltragoalBlueprintShapes(cwd, committedDecision.state.blueprintSlugs);
         await updateUltragoalState((current) => {
             if (current.ultragoalId !== status.state?.ultragoalId ||
                 current.updatedAt !== status.state.updatedAt ||

package/dist/esm/utils/write-json-file.js

@@ -1,4 +1,4 @@
-import { closeSync, copyFileSync, existsSync, fdatasyncSync, fsyncSync, openSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { closeSync, copyFileSync, existsSync, fdatasyncSync, fchmodSync, fsyncSync, openSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { dirname } from "node:path";
 export function writeJsonFile(path, data, options = {}) {
@@ -45,6 +45,8 @@ function writeFileAtomicWithPolicy(path, content, options, allowCrossDeviceFallb
     let installed = false;
     try {
         fd = openSync(tmpPath, "w", normalized.mode);
+        if (normalized.mode !== undefined)
+            fchmodSync(fd, normalized.mode);
         writeFileSync(fd, content, normalized.writeOptions);
         fdatasyncSync(fd);
         closeSync(fd);

package/dist/esm/worktrees/codex-project-trust.d.ts

@@ -0,0 +1,15 @@
+export interface RemoveCodexProjectTrustOptions {
+    readonly configFilePath?: string;
+}
+/**
+ * Remove the exact Codex project-trust table for a worktree that has just been
+ * removed. This deliberately does not touch nested hook state or other project
+ * entries, which may remain valid user-owned configuration.
+ */
+export declare function removeCodexProjectTrust(worktreePath: string, options?: RemoveCodexProjectTrustOptions): Promise<"removed" | "unchanged">;
+/**
+ * Remove exact Codex project-trust tables in one locked rewrite. Prune can
+ * reconcile several externally deleted worktrees at once, so batching avoids
+ * taking the global config lock and rewriting the file for every entry.
+ */
+export declare function removeCodexProjectTrusts(worktreePaths: readonly string[], options?: RemoveCodexProjectTrustOptions): Promise<"removed" | "unchanged">;

package/dist/esm/worktrees/codex-project-trust.js

@@ -0,0 +1,56 @@
+import { existsSync, readFileSync } from "node:fs";
+import lockfile from "proper-lockfile";
+import { defaultCodexConfigFilePath } from "#cli/commands/init/scaffolders/agent-hooks/codex-trust-sync.js";
+import { writeFileAtomic } from "#shared-utils/write-json-file.js";
+/**
+ * Remove the exact Codex project-trust table for a worktree that has just been
+ * removed. This deliberately does not touch nested hook state or other project
+ * entries, which may remain valid user-owned configuration.
+ */
+export function removeCodexProjectTrust(worktreePath, options = {}) {
+    return removeCodexProjectTrusts([worktreePath], options);
+}
+/**
+ * Remove exact Codex project-trust tables in one locked rewrite. Prune can
+ * reconcile several externally deleted worktrees at once, so batching avoids
+ * taking the global config lock and rewriting the file for every entry.
+ */
+export async function removeCodexProjectTrusts(worktreePaths, options = {}) {
+    if (worktreePaths.length === 0)
+        return "unchanged";
+    const configFilePath = options.configFilePath ?? defaultCodexConfigFilePath();
+    if (!existsSync(configFilePath))
+        return "unchanged";
+    const release = await lockfile.lock(configFilePath, {
+        realpath: false,
+        retries: { retries: 8, factor: 1.5, minTimeout: 25, maxTimeout: 250 },
+    });
+    try {
+        const existing = readFileSync(configFilePath, "utf8");
+        const next = removeProjectTrustTables(existing, worktreePaths);
+        if (next === existing)
+            return "unchanged";
+        writeFileAtomic(configFilePath, next, "utf8");
+        return "removed";
+    }
+    finally {
+        await release();
+    }
+}
+function removeProjectTrustTables(config, worktreePaths) {
+    const lines = config.split("\n");
+    const headers = new Set(worktreePaths.map((worktreePath) => `[projects.${JSON.stringify(worktreePath)}]`));
+    let removed = false;
+    for (let start = 0; start < lines.length;) {
+        if (!headers.has(lines[start]?.trim() ?? "")) {
+            start += 1;
+            continue;
+        }
+        let end = start + 1;
+        while (end < lines.length && !/^\s*\[.+\]\s*$/u.test(lines[end] ?? ""))
+            end += 1;
+        lines.splice(start, end - start);
+        removed = true;
+    }
+    return removed ? lines.join("\n") : config;
+}

package/dist/esm/worktrees/registry.d.ts

@@ -50,6 +50,13 @@ export interface PruneStaleWorktreeRegistryOptions extends RegistryOptions {
     readonly inventory: WorktreeInventory;
     readonly scope: MembershipScope;
 }
+export interface StaleWorktreeRegistryPrunePlan {
+    readonly kept: ManagedWorktreeEntry[];
+    readonly removed: ManagedWorktreeEntry[];
+    readonly warnings: string[];
+    /** Persist the already-classified registry mutation after dependent cleanup succeeds. */
+    commit(): void;
+}
 /** Read one physical registry file at `root`. */
 export declare function readPhysicalRegistry(root: string): WorktreeRegistry;
 /** Write one physical registry file at `root`. */
@@ -100,6 +107,7 @@ export declare function removeWorktreeRegistryEntries(predicate: (entry: Managed
  * when it is PROVEN-SAME-REPO and STALE against a COMPLETE inventory; unknown,
  * other-repo, and present entries are RETAINED.
  */
+export declare function planStaleWorktreeRegistryPrune(options: PruneStaleWorktreeRegistryOptions): StaleWorktreeRegistryPrunePlan;
 export declare function pruneStaleWorktreeRegistryEntries(options: PruneStaleWorktreeRegistryOptions): {
     kept: ManagedWorktreeEntry[];
     removed: ManagedWorktreeEntry[];

package/dist/esm/worktrees/registry.js

@@ -193,7 +193,7 @@ export function removeWorktreeRegistryEntries(predicate, options = {}) {
  * when it is PROVEN-SAME-REPO and STALE against a COMPLETE inventory; unknown,
  * other-repo, and present entries are RETAINED.
  */
-export function pruneStaleWorktreeRegistryEntries(options) {
+export function planStaleWorktreeRegistryPrune(options) {
     const resolveKey = options.scope.resolveMembershipRepoKey ?? ((dir) => resolveRepoIdentity(dir));
     const shouldPrune = (entry) => {
         const membership = classifyMembership(entry.repoRoot, options.scope.authoritativeRepoKey, resolveKey);
@@ -205,16 +205,31 @@ export function pruneStaleWorktreeRegistryEntries(options) {
     };
     const kept = [];
     const removed = [];
+    const pendingWrites = [];
     for (const root of physicalRoots(options)) {
         const registry = readPhysicalRegistry(root);
         const rootRemoved = registry.entries.filter(shouldPrune);
         const rootKept = registry.entries.filter((entry) => !shouldPrune(entry));
         if (rootRemoved.length > 0)
-            writePhysicalRegistry({ version: 1, entries: rootKept }, root);
+            pendingWrites.push({ root, entries: rootKept });
         kept.push(...rootKept);
         removed.push(...rootRemoved);
     }
-    return { kept, removed, warnings: [...options.inventory.warnings] };
+    return {
+        kept,
+        removed,
+        warnings: [...options.inventory.warnings],
+        commit() {
+            for (const pendingWrite of pendingWrites) {
+                writePhysicalRegistry({ version: 1, entries: pendingWrite.entries }, pendingWrite.root);
+            }
+        },
+    };
+}
+export function pruneStaleWorktreeRegistryEntries(options) {
+    const plan = planStaleWorktreeRegistryPrune(options);
+    plan.commit();
+    return plan;
 }
 /**
  * LISTING-ONLY logical lookup by id. Identity-sensitive owner resolution must

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpresso/agent-kit",
-  "version": "3.1.30",
+  "version": "3.2.0",
   "private": false,
   "description": "TypeScript-first agent harness for guarded develop/deploy workflows: wp CLI gates, MCP tools, hooks, memory, worktrees, secrets, audits, and evidence checks.",
   "keywords": [
@@ -365,7 +365,7 @@
     "version": "changeset version && vp run sync-marketplace-version && vp run generate-skills && ./bin/wp format",
     "release:publish": "bun scripts/release-publish.ts",
     "typecheck": "./bin/wp typecheck",
-    "test": "vitest run",
+    "test": "bun scripts/run-vitest-projects.ts",
     "test:mutation": "bun stryker run stryker.config.ts",
     "eval": "bun src/runners/evals/index.ts",
     "bench:dash": "bun scripts/bench/wp-dash-menu.tsx",
@@ -392,6 +392,9 @@
     "audits:check": "./bin/wp audit guardrails && vp run workflow-actions:check && vp run hooks:doctor:ci && vp run check:blueprint-done-ledger",
     "hooks:doctor": "./bin/wp hooks doctor",
     "hooks:doctor:ci": "./bin/wp hooks doctor --skip-mcp && PATH=\"$PWD/bin:$PATH\" ./bin/wp hooks conformance --hosts codex,claude,opencode --lanes generated,repo,runtime,global,plugin --strict",
+    "proof:host-native": "bun scripts/host-native-proof.ts",
+    "proof:host-native:claude": "bun scripts/host-native-proof.ts --host claude",
+    "proof:host-native:grok": "bun scripts/host-native-proof.ts --host grok",
     "qa": "vp run build && bun scripts/run-parallel-checks.ts",
     "changeset": "changeset",
     "changeset:status": "GIT_WORK_TREE=$PWD changeset status",
@@ -502,16 +505,16 @@
     "setupWpActionRef": "c2c71a7a4be446fc6858e6b57bf55a11ccfa2d88"
   },
   "optionalDependencies": {
-    "@webpresso/agent-kit-runtime-darwin-arm64": "3.1.30",
-    "@webpresso/agent-kit-runtime-darwin-x64": "3.1.30",
-    "@webpresso/agent-kit-runtime-linux-x64": "3.1.30",
-    "@webpresso/agent-kit-runtime-linux-arm64": "3.1.30",
-    "@webpresso/agent-kit-runtime-windows-x64": "3.1.30",
-    "@webpresso/agent-kit-session-memory-darwin-x64": "3.1.30",
-    "@webpresso/agent-kit-session-memory-darwin-arm64": "3.1.30",
-    "@webpresso/agent-kit-session-memory-linux-x64": "3.1.30",
-    "@webpresso/agent-kit-session-memory-linux-arm64": "3.1.30",
-    "@webpresso/agent-kit-session-memory-win32-x64": "3.1.30",
-    "@webpresso/agent-kit-session-memory-win32-arm64": "3.1.30"
+    "@webpresso/agent-kit-runtime-darwin-arm64": "3.2.0",
+    "@webpresso/agent-kit-runtime-darwin-x64": "3.2.0",
+    "@webpresso/agent-kit-runtime-linux-x64": "3.2.0",
+    "@webpresso/agent-kit-runtime-linux-arm64": "3.2.0",
+    "@webpresso/agent-kit-runtime-windows-x64": "3.2.0",
+    "@webpresso/agent-kit-session-memory-darwin-x64": "3.2.0",
+    "@webpresso/agent-kit-session-memory-darwin-arm64": "3.2.0",
+    "@webpresso/agent-kit-session-memory-linux-x64": "3.2.0",
+    "@webpresso/agent-kit-session-memory-linux-arm64": "3.2.0",
+    "@webpresso/agent-kit-session-memory-win32-x64": "3.2.0",
+    "@webpresso/agent-kit-session-memory-win32-arm64": "3.2.0"
   }
 }