@wrongstack/cli 0.1.1 → 0.1.3

package/dist/index.js

@@ -1,13 +1,16 @@
 #!/usr/bin/env node
-import { color, DefaultPathResolver, resolveWstackPaths, DefaultSecretVault, migratePlaintextSecrets, DefaultConfigLoader, DefaultLogger, DefaultModelsRegistry, Container, TOKENS, DefaultSecretScrubber, DefaultRetryPolicy, DefaultErrorHandler, DefaultTokenCounter, DefaultSessionStore, DefaultMemoryStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultPermissionPolicy, HybridCompactor, ProviderRegistry, ToolRegistry, createContextManagerTool, EventBus, RecoveryLock, DefaultAttachmentStore, QueueStore, Context, createDefaultPipelines, AutoCompactionMiddleware, Agent, SlashCommandRegistry, loadPlugins, InputBuilder, DefaultPluginAPI, rewriteConfigEncrypted, atomicWrite } from '@wrongstack/core';
-import * as fs2 from 'fs/promises';
+import { color, DefaultLogger, DefaultModelsRegistry, Container, DefaultConfigStore, TOKENS, DefaultSecretScrubber, DefaultRetryPolicy, DefaultErrorHandler, DefaultTokenCounter, DefaultSessionStore, DefaultMemoryStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultPermissionPolicy, HybridCompactor, ProviderRegistry, ToolRegistry, createContextManagerTool, EventBus, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, RecoveryLock, DefaultAttachmentStore, QueueStore, Context, createDefaultPipelines, AutoCompactionMiddleware, Agent, SlashCommandRegistry, loadPlugins, DefaultPathResolver, resolveWstackPaths, DefaultSecretVault, migratePlaintextSecrets, DefaultConfigLoader, InputBuilder, DefaultPluginAPI, DefaultSessionReader, atomicWrite, makeAgentSubagentRunner, DefaultMultiAgentCoordinator, decryptConfigSecrets, encryptConfigSecrets } from '@wrongstack/core';
+import * as fs6 from 'fs/promises';
+import { writeFileSync } from 'fs';
 import { createRequire } from 'module';
-import * as os2 from 'os';
-import * as path2 from 'path';
+import * as path5 from 'path';
 import { MCPRegistry } from '@wrongstack/mcp';
 import { buildProviderFactoriesFromRegistry, makeProviderFromConfig, capabilitiesFor } from '@wrongstack/providers';
-import { builtinTools, rememberTool, forgetTool } from '@wrongstack/tools';
+import { rememberTool, forgetTool } from '@wrongstack/tools';
+import { builtinTools } from '@wrongstack/tools/builtin';
 import * as readline from 'readline';
+import * as os3 from 'os';
+import { randomUUID } from 'crypto';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -37,11 +40,11 @@ var ReadlineInputReader = class {
   history = [];
   pending = false;
   constructor(opts = {}) {
-    this.historyFile = opts.historyFile ?? path2.join(os2.homedir(), ".wrongstack", "history");
+    this.historyFile = opts.historyFile ?? path5.join(os3.homedir(), ".wrongstack", "history");
   }
   async loadHistory() {
     try {
-      const raw = await fs2.readFile(this.historyFile, "utf8");
+      const raw = await fs6.readFile(this.historyFile, "utf8");
       this.history = raw.split("\n").filter(Boolean).slice(-1e3);
     } catch {
       this.history = [];
@@ -49,8 +52,8 @@ var ReadlineInputReader = class {
   }
   async saveHistory() {
     try {
-      await fs2.mkdir(path2.dirname(this.historyFile), { recursive: true });
-      await fs2.writeFile(this.historyFile, this.history.slice(-1e3).join("\n"));
+      await fs6.mkdir(path5.dirname(this.historyFile), { recursive: true });
+      await fs6.writeFile(this.historyFile, this.history.slice(-1e3).join("\n"));
     } catch {
     }
   }
@@ -68,7 +71,7 @@ var ReadlineInputReader = class {
   async readLine(prompt) {
     if (this.history.length === 0) await this.loadHistory();
     while (this.pending) {
-      await new Promise((resolve2) => setTimeout(resolve2, 50));
+      await new Promise((resolve3) => setTimeout(resolve3, 50));
     }
     this.pending = true;
     try {
@@ -78,13 +81,13 @@ var ReadlineInputReader = class {
         this.rl = void 0;
       }
       const fresh = this.ensure();
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve3, reject) => {
         fresh.question(prompt ?? "> ", (line) => {
           if (line.trim()) {
             this.history.push(line);
             void this.saveHistory();
           }
-          resolve2(line);
+          resolve3(line);
         });
         fresh.once("close", () => reject(new Error("EOF")));
       });
@@ -94,7 +97,7 @@ var ReadlineInputReader = class {
   }
   async readKey(prompt, options) {
     process.stdout.write(prompt);
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const stdin = process.stdin;
       const wasRaw = stdin.isRaw;
       const wasPaused = stdin.isPaused();
@@ -109,7 +112,7 @@ var ReadlineInputReader = class {
           cleanup();
           process.stdout.write(`${opt.key}
 `);
-          resolve2(opt.value);
+          resolve3(opt.value);
         }
       };
       const cleanup = () => {
@@ -121,9 +124,14 @@ var ReadlineInputReader = class {
     });
   }
   /**
-   * Read a single line of input without echoing it to the terminal. Used
-   * for API keys / passwords. Non-TTY input is read normally — there's
-   * nothing to hide when piped.
+   * Read a line of input while masking each character with a bullet so the
+   * user gets visual confirmation that bytes are arriving (especially on
+   * paste, which previously felt like nothing happened). Pasted chunks
+   * are echoed as a run of bullets, Backspace/DEL erases one bullet, and
+   * Ctrl+U / Ctrl+W are honored. Non-TTY input is read normally — there's
+   * nothing to hide when piped, and echoing bullets to a file is noise.
+   *
+   * Returns the raw entered string (no trim — caller decides).
    */
   async readSecret(prompt) {
     const stdin = process.stdin;
@@ -131,18 +139,25 @@ var ReadlineInputReader = class {
     this.rl?.close();
     this.rl = void 0;
     process.stdout.write(prompt);
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       let buf = "";
       const wasRaw = stdin.isRaw;
       stdin.setRawMode(true);
       stdin.resume();
       stdin.setEncoding("utf8");
+      const eraseChar = () => {
+        process.stdout.write("\b \b");
+      };
+      const eraseAll = () => {
+        for (let i = 0; i < buf.length; i++) eraseChar();
+      };
       const onData = (chunk) => {
         for (const ch of chunk) {
           if (ch === "\r" || ch === "\n") {
             cleanup();
-            process.stdout.write("\n");
-            resolve2(buf);
+            process.stdout.write(`  ${dim(`[${buf.length} chars]`)}
+`);
+            resolve3(buf);
             return;
           }
           if (ch === "") {
@@ -150,11 +165,28 @@ var ReadlineInputReader = class {
             process.stdout.write("\n");
             process.exit(130);
           }
+          if (ch === "") {
+            eraseAll();
+            buf = "";
+            continue;
+          }
+          if (ch === "") {
+            const m = buf.match(/(\S+\s*)$/);
+            const drop = m ? m[0].length : buf.length;
+            for (let i = 0; i < drop; i++) eraseChar();
+            buf = buf.slice(0, buf.length - drop);
+            continue;
+          }
           if (ch === "\x7F" || ch === "\b") {
-            buf = buf.slice(0, -1);
+            if (buf.length > 0) {
+              buf = buf.slice(0, -1);
+              eraseChar();
+            }
             continue;
           }
+          if (ch < " ") continue;
           buf += ch;
+          process.stdout.write("\u2022");
         }
       };
       const cleanup = () => {
@@ -171,6 +203,10 @@ var ReadlineInputReader = class {
     this.rl = void 0;
   }
 };
+function dim(s) {
+  if (!process.stdout.isTTY) return s;
+  return `\x1B[2m${s}\x1B[22m`;
+}
 function renderDiff(diff) {
   if (!diff) return "";
   const lines = diff.split("\n");
@@ -221,6 +257,13 @@ ${theme.primary("\u258D")} ${theme.bold(tool.name)}
     return answer;
   };
 }
+function makeConfirmAwaiter(reader) {
+  const delegate = makePromptDelegate(reader);
+  return async (tool, input, _toolUseId, suggestedPattern) => {
+    const result = await delegate(tool, input, suggestedPattern);
+    return result;
+  };
+}
 function stringifyInput(input) {
   if (!input || typeof input !== "object") return "";
   const obj = input;
@@ -236,8 +279,10 @@ function hasDiff(input) {
 }
 function hasApiKey(provider, config) {
   if (provider.envVars.some((v) => !!process.env[v])) return true;
-  const stored = config?.providers?.[provider.id]?.apiKey;
-  if (typeof stored === "string" && stored.length > 0) return true;
+  const entry = config?.providers?.[provider.id];
+  if (!entry) return false;
+  if (typeof entry.apiKey === "string" && entry.apiKey.length > 0) return true;
+  if (Array.isArray(entry.apiKeys) && entry.apiKeys.some((k) => k?.apiKey)) return true;
   return false;
 }
 async function runPicker(deps) {
@@ -254,15 +299,53 @@ ${color.bold(theme2.primary("WrongStack") + color.dim(" \u2014 Provider & Model
     return void 0;
   }
   const supported = providers.filter((p) => p.family !== "unsupported");
-  if (supported.length === 0) {
+  const catalogById = new Map(supported.map((p) => [p.id, p]));
+  const overlay = config?.providers ?? {};
+  const seen = /* @__PURE__ */ new Set();
+  const merged = [];
+  for (const p of supported) {
+    const cfg = overlay[p.id];
+    seen.add(p.id);
+    if (cfg) {
+      merged.push({
+        ...p,
+        family: cfg.family ?? p.family,
+        apiBase: cfg.baseUrl ?? p.apiBase,
+        envVars: cfg.envVars && cfg.envVars.length > 0 ? cfg.envVars : p.envVars,
+        // When the user has saved an explicit model list, it wins — they
+        // know which models their endpoint actually serves (e.g. LM
+        // Studio, vLLM, or a proxy with custom model ids). Otherwise the
+        // catalog list keeps providing suggestions.
+        models: cfg.models && cfg.models.length > 0 ? cfg.models.map((m) => ({ id: m, name: m })) : p.models
+      });
+    } else {
+      merged.push(p);
+    }
+  }
+  for (const [id, cfg] of Object.entries(overlay)) {
+    if (seen.has(id)) continue;
+    if (!cfg?.family || cfg.family === "unsupported") continue;
+    const catalogType = cfg.type && cfg.type !== id ? cfg.type : void 0;
+    const inherited = catalogType ? catalogById.get(catalogType) : void 0;
+    merged.push({
+      id,
+      name: inherited ? `${inherited.name} ${color.dim("(alias)")}` : id,
+      family: cfg.family,
+      apiBase: cfg.baseUrl ?? inherited?.apiBase,
+      envVars: cfg.envVars ?? inherited?.envVars ?? [],
+      models: cfg.models && cfg.models.length > 0 ? cfg.models.map((m) => ({ id: m, name: m })) : inherited?.models ?? [],
+      npm: inherited?.npm
+    });
+  }
+  if (merged.length === 0) {
     renderer.writeError("No supported providers found in catalog.");
     return void 0;
   }
-  const keyed = supported.filter((p) => hasApiKey(p, config));
+  const keyed = merged.filter((p) => hasApiKey(p, config));
   let displayList = keyed;
   let showingFallback = false;
   if (keyed.length === 0) {
-    displayList = supported;
+    displayList = merged;
     showingFallback = true;
   }
   const families = /* @__PURE__ */ new Map();
@@ -283,7 +366,8 @@ ${color.bold(theme2.primary("WrongStack") + color.dim(" \u2014 Provider & Model
 `);
     for (const p of list) {
       const envFound = p.envVars.some((v) => !!process.env[v]);
-      const configKey = typeof config?.providers?.[p.id]?.apiKey === "string" && config.providers[p.id].apiKey.length > 0;
+      const entry = config?.providers?.[p.id];
+      const configKey = typeof entry?.apiKey === "string" && entry.apiKey.length > 0 || Array.isArray(entry?.apiKeys) && entry.apiKeys.some((k) => k?.apiKey);
       const marker = envFound ? color.green("\u25CF") : configKey ? color.cyan("\u25C9") : color.dim("\u25CB");
       const isDefault = p.id === defaultProvider;
       if (isDefault) defaultIdx = idx;
@@ -321,7 +405,7 @@ ${color.amber("?")} Select provider (1-${ordered.length})${defaultHint}: `)).tri
     renderer.write(color.dim("Cancelled.\n"));
     return void 0;
   }
-  const providerIdx = parseInt(providerAnswer, 10);
+  const providerIdx = Number.parseInt(providerAnswer, 10);
   if (Number.isNaN(providerIdx) || providerIdx < 1 || providerIdx > ordered.length) {
     const byId = ordered.find((o) => o.provider.id.toLowerCase() === providerAnswer.toLowerCase());
     if (!byId) {
@@ -399,7 +483,7 @@ ${color.amber("?")} Select model (1-${models.length})${defaultHint}: `)).trim();
   return resolveModelSelection(answer, models, provider, registry, renderer);
 }
 async function resolveModelSelection(answer, models, provider, _registry, renderer, _reader) {
-  const idx = parseInt(answer, 10);
+  const idx = Number.parseInt(answer, 10);
   let modelId;
   if (!Number.isNaN(idx) && idx >= 1 && idx <= models.length) {
     modelId = models[idx - 1].id;
@@ -432,17 +516,17 @@ async function resolveModelSelection(answer, models, provider, _registry, render
 var theme2 = { primary: color.amber };
 async function saveToGlobalConfig(configPath, provider, model) {
   try {
-    const { atomicWrite: atomicWrite2 } = await import('@wrongstack/core');
-    const fs6 = await import('fs/promises');
+    const { atomicWrite: atomicWrite3 } = await import('@wrongstack/core');
+    const fs8 = await import('fs/promises');
     let existing = {};
     try {
-      const raw = await fs6.readFile(configPath, "utf8");
+      const raw = await fs8.readFile(configPath, "utf8");
       existing = JSON.parse(raw);
     } catch {
     }
     existing.provider = provider;
     existing.model = model;
-    await atomicWrite2(configPath, JSON.stringify(existing, null, 2));
+    await atomicWrite3(configPath, JSON.stringify(existing, null, 2));
     return true;
   } catch {
     return false;
@@ -455,58 +539,103 @@ function buildBuiltinSlashCommands(opts) {
     clearCommand(opts),
     compactCommand(opts),
     contextCommand(opts),
-    usageCommand(opts),
     toolsCommand(opts),
     skillCommand(opts),
-    useCommand(opts),
-    modelCommand(opts),
     diagCommand(opts),
     statsCommand(opts),
+    spawnCommand(opts),
+    agentsCommand(opts),
+    metricsCommand(opts),
+    healthCommand(opts),
+    memoryCommand(opts),
     saveCommand(opts),
     loadCommand(opts),
     exitCommand(opts)
   ];
 }
+function memoryCommand(opts) {
+  return {
+    name: "memory",
+    description: "Inspect or edit persistent memory: /memory [show|remember <text>|forget <query>|clear]",
+    async run(args) {
+      const store = opts.memoryStore;
+      if (!store) return { message: "No memory store configured." };
+      const [verb, ...rest] = args.trim().split(/\s+/);
+      const restJoined = rest.join(" ").trim();
+      switch (verb) {
+        case "":
+        case "show":
+        case "list": {
+          const text = await store.readAll();
+          return {
+            message: text.trim().length === 0 ? "Memory is empty. Add an entry with `/memory remember <text>`." : text
+          };
+        }
+        case "remember":
+        case "add": {
+          if (!restJoined) return { message: "Usage: /memory remember <text>" };
+          await store.remember(restJoined);
+          return { message: `Remembered: ${restJoined}` };
+        }
+        case "forget":
+        case "rm": {
+          if (!restJoined) return { message: "Usage: /memory forget <query>" };
+          const n = await store.forget(restJoined);
+          return {
+            message: n === 0 ? `No entries matched "${restJoined}".` : `Forgot ${n} entries.`
+          };
+        }
+        case "clear": {
+          await store.clear();
+          return { message: "Cleared all memory scopes." };
+        }
+        default:
+          return {
+            message: `Unknown subcommand "${verb}". Try: show | remember <text> | forget <query> | clear`
+          };
+      }
+    }
+  };
+}
 function initCommand(opts) {
   return {
     name: "init",
     description: "Scaffold .wrongstack/AGENTS.md in the current project.",
     async run(args, ctx) {
       const force = args.trim() === "--force";
-      const dir = path2.join(ctx.projectRoot, ".wrongstack");
-      const file = path2.join(dir, "AGENTS.md");
+      const dir = path5.join(ctx.projectRoot, ".wrongstack");
+      const file = path5.join(dir, "AGENTS.md");
       try {
-        await fs2.access(file);
+        await fs6.access(file);
         if (!force) {
-          const msg = `AGENTS.md already exists at ${file}. Use "/init --force" to overwrite.`;
-          opts.renderer.writeWarning(msg);
-          return { message: msg };
+          const msg2 = `AGENTS.md already exists at ${file}. Use "/init --force" to overwrite.`;
+          opts.renderer.writeWarning(msg2);
+          return { message: msg2 };
         }
       } catch {
       }
       const detected = await detectProjectFacts(ctx.projectRoot);
       const body = renderAgentsTemplate(detected);
-      await fs2.mkdir(dir, { recursive: true });
-      await fs2.writeFile(file, body, "utf8");
+      await fs6.mkdir(dir, { recursive: true });
+      await fs6.writeFile(file, body, "utf8");
       if (detected.hints.length > 0) {
-        const msg = `Wrote ${file}
+        const msg2 = `Wrote ${file}
 Pre-filled: ${detected.hints.join(", ")}. Edit the file to add anything else worth remembering.`;
         opts.renderer.writeInfo(`Wrote ${file}`);
         opts.renderer.writeInfo(`Pre-filled: ${detected.hints.join(", ")}. Edit the file to add anything else worth remembering.`);
-        return { message: msg };
-      } else {
-        const msg = `Wrote ${file}
-No project type auto-detected. Edit the file to add build/test commands and conventions.`;
-        opts.renderer.writeInfo(`Wrote ${file}`);
-        return { message: msg };
+        return { message: msg2 };
       }
+      const msg = `Wrote ${file}
+No project type auto-detected. Edit the file to add build/test commands and conventions.`;
+      opts.renderer.writeInfo(`Wrote ${file}`);
+      return { message: msg };
     }
   };
 }
 async function detectProjectFacts(root) {
   const facts = { hints: [] };
   try {
-    const pkg = JSON.parse(await fs2.readFile(path2.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(await fs6.readFile(path5.join(root, "package.json"), "utf8"));
     const scripts = pkg.scripts ?? {};
     const pm = (pkg.packageManager ?? "npm").split("@")[0] ?? "npm";
     if (scripts["build"]) facts.build = `${pm} run build`;
@@ -517,28 +646,28 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    await fs2.access(path2.join(root, "pyproject.toml"));
+    await fs6.access(path5.join(root, "pyproject.toml"));
     facts.test ??= "pytest";
     facts.lint ??= "ruff check .";
     facts.hints.push("pyproject.toml");
   } catch {
   }
   try {
-    await fs2.access(path2.join(root, "go.mod"));
+    await fs6.access(path5.join(root, "go.mod"));
     facts.build ??= "go build ./...";
     facts.test ??= "go test ./...";
     facts.hints.push("go.mod");
   } catch {
   }
   try {
-    await fs2.access(path2.join(root, "Cargo.toml"));
+    await fs6.access(path5.join(root, "Cargo.toml"));
     facts.build ??= "cargo build";
     facts.test ??= "cargo test";
     facts.hints.push("Cargo.toml");
   } catch {
   }
   try {
-    await fs2.access(path2.join(root, "Makefile"));
+    await fs6.access(path5.join(root, "Makefile"));
     facts.build ??= "make";
     facts.test ??= "make test";
     facts.hints.push("Makefile");
@@ -586,12 +715,8 @@ function diagCommand(opts) {
     name: "diag",
     description: "Show runtime diagnostics (provider, tokens, tools, MCP).",
     async run() {
-      if (opts.onDiag) {
-        opts.onDiag();
-        return { message: "diag" };
-      } else {
-        return { message: "Diag not available in this context." };
-      }
+      if (!opts.onDiag) return { message: "Diag not available in this context." };
+      return { message: opts.onDiag() };
     }
   };
 }
@@ -600,28 +725,73 @@ function statsCommand(opts) {
     name: "stats",
     description: "Show session report: tokens, requests, tools, files, cost.",
     async run() {
-      if (opts.onStats) {
-        opts.onStats();
-        return { message: "stats" };
-      } else {
-        return { message: "Stats not available in this context." };
-      }
+      if (!opts.onStats) return { message: "Stats not available in this context." };
+      const text = opts.onStats();
+      return { message: text ?? "No session activity recorded yet." };
     }
   };
 }
 function helpCommand(opts) {
   return {
     name: "help",
-    description: "Show available slash commands.",
-    async run() {
+    description: "Show available slash commands. Pass a name for detailed help.",
+    help: [
+      "Usage:",
+      "  /help            List every command with its one-line description.",
+      "  /help <name>     Show detailed help for one command (falls back to the description).",
+      "",
+      "Examples:",
+      "  /help",
+      "  /help context",
+      "  /help model"
+    ].join("\n"),
+    async run(args) {
+      const query = args.trim();
+      if (query) {
+        const needle = query.startsWith("/") ? query.slice(1) : query;
+        let match;
+        for (const entry of opts.registry.listWithOwner()) {
+          const aliases = entry.cmd.aliases ?? [];
+          const candidates = [
+            entry.cmd.name,
+            entry.fullName,
+            ...aliases,
+            ...aliases.map(
+              (a) => entry.owner === "core" ? a : `${entry.owner}:${a}`
+            )
+          ];
+          if (candidates.includes(needle)) {
+            match = entry;
+            break;
+          }
+        }
+        if (!match) {
+          return { message: `Unknown command: /${needle}. Run /help to list commands.` };
+        }
+        const prefix = match.owner === "core" ? "" : `${match.owner}:`;
+        const header = `/${prefix}${match.cmd.name}`;
+        const aliasLine = match.cmd.aliases && match.cmd.aliases.length > 0 ? `Aliases: ${match.cmd.aliases.map((a) => `/${prefix}${a}`).join(", ")}
+` : "";
+        const body = match.cmd.help ?? match.cmd.description;
+        return {
+          message: [
+            header,
+            "\u2500".repeat(header.length),
+            aliasLine + (match.cmd.help ? "" : `${match.cmd.description}
+`),
+            body
+          ].filter(Boolean).join("\n")
+        };
+      }
       const lines = ["Available slash commands:"];
-      for (const { cmd, owner, fullName } of opts.registry.listWithOwner()) {
+      for (const { cmd, owner } of opts.registry.listWithOwner()) {
         const isBuiltin = owner === "core";
         const prefix = isBuiltin ? "" : `${owner}:`;
         const aliases = cmd.aliases ? cmd.aliases.map((a) => `/${prefix}${a}`).join(", ") : "";
         const aliasStr = aliases ? ` (${aliases})` : "";
         lines.push(`  /${prefix}${cmd.name}${aliasStr} \u2014 ${cmd.description}`);
       }
+      lines.push("", "Run `/help <name>` for detailed help on a specific command.");
       return { message: lines.join("\n") };
     }
   };
@@ -630,6 +800,14 @@ function clearCommand(opts) {
   return {
     name: "clear",
     description: "Reset the session and start a new one.",
+    help: [
+      "Usage:",
+      "  /clear",
+      "",
+      "Wipes everything in the current REPL state: messages, todos, read-file tracking,",
+      "file mtimes, meta. Memory store entries (all scopes) are cleared too. The terminal",
+      "is wiped. Use this when you want a fresh conversation without restarting `wstack`."
+    ].join("\n"),
     async run(_args, ctx) {
       if (ctx) {
         ctx.messages = [];
@@ -652,6 +830,14 @@ function contextCommand(opts) {
     name: "context",
     aliases: ["ctx"],
     description: "Show context window summary.",
+    help: [
+      "Usage:",
+      "  /context           Show counts: messages, est. tokens, tool calls, todos, read files.",
+      "  /context detail    As above, plus model, cwd, projectRoot, and the file list.",
+      "",
+      "Token estimate is a `chars \xF7 4` heuristic, not a real tokenizer call \u2014",
+      "good enough to spot growth between turns."
+    ].join("\n"),
     async run(args, ctx) {
       const messages = ctx.messages;
       const detailed = args.trim() === "detail";
@@ -732,6 +918,14 @@ function compactCommand(opts) {
   return {
     name: "compact",
     description: "Compact the context window.",
+    help: [
+      "Usage:",
+      "  /compact              Run the configured compactor with default settings.",
+      "  /compact aggressive   Compact more aggressively \u2014 keeps fewer recent turns verbatim.",
+      "",
+      "The compactor summarizes older turns to reclaim tokens. The default keeps the most",
+      "recent K message pairs untouched; aggressive halves that window."
+    ].join("\n"),
     async run(args, ctx) {
       if (!opts.compactor) {
         const msg2 = "No compactor configured.";
@@ -746,26 +940,6 @@ function compactCommand(opts) {
     }
   };
 }
-function usageCommand(opts) {
-  return {
-    name: "usage",
-    aliases: ["cost"],
-    description: "Show token usage and estimated cost.",
-    async run() {
-      const total = opts.tokenCounter.total();
-      const cost = opts.tokenCounter.estimateCost();
-      const msg = `${color.bold("Usage")}
-  input:       ${total.input}
-  output:      ${total.output}
-  cache read:  ${total.cacheRead ?? 0}
-  cache write: ${total.cacheWrite ?? 0}
-  cost:        $${cost.total.toFixed(4)} (input $${cost.input.toFixed(4)} / output $${cost.output.toFixed(4)})
-`;
-      opts.renderer.write(msg);
-      return { message: msg };
-    }
-  };
-}
 function toolsCommand(opts) {
   return {
     name: "tools",
@@ -803,47 +977,14 @@ function skillCommand(opts) {
 ${lines.join("\n")}
 `;
         return { message: msg };
-      } else {
-        const skill = await opts.skillLoader.find(args.trim());
-        if (!skill) {
-          const msg = `Skill "${args.trim()}" not found.`;
-          return { message: msg };
-        }
-        const body = await opts.skillLoader.readBody(skill.name);
-        return { message: body };
-      }
-    }
-  };
-}
-function useCommand(opts) {
-  return {
-    name: "use",
-    description: "Switch provider mid-session: /use <provider>",
-    async run(args) {
-      const name = args.trim();
-      if (!name) {
-        const msg2 = "Usage: /use <provider-name>";
-        return { message: msg2 };
       }
-      opts.onSwitchProvider?.(name);
-      const msg = `Switched provider to "${name}".`;
-      return { message: msg };
-    }
-  };
-}
-function modelCommand(opts) {
-  return {
-    name: "model",
-    description: "Switch model mid-session: /model <model>",
-    async run(args) {
-      const name = args.trim();
-      if (!name) {
-        const msg2 = "Usage: /model <model-name>";
-        return { message: msg2 };
+      const skill = await opts.skillLoader.find(args.trim());
+      if (!skill) {
+        const msg = `Skill "${args.trim()}" not found.`;
+        return { message: msg };
       }
-      opts.onSwitchModel?.(name);
-      const msg = `Switched model to "${name}".`;
-      return { message: msg };
+      const body = await opts.skillLoader.readBody(skill.name);
+      return { message: body };
     }
   };
 }
@@ -901,6 +1042,102 @@ function exitCommand(opts) {
     }
   };
 }
+function metricsCommand(opts) {
+  return {
+    name: "metrics",
+    description: "Show metrics snapshot (requires --metrics flag).",
+    async run() {
+      if (!opts.metricsSink) {
+        return { message: "Metrics not enabled. Restart with --metrics to collect." };
+      }
+      const snap = opts.metricsSink.snapshot();
+      if (snap.series.length === 0) {
+        return { message: "No metrics recorded yet." };
+      }
+      const lines = [];
+      const byName = /* @__PURE__ */ new Map();
+      for (const s of snap.series) {
+        const bucket = byName.get(s.name) ?? [];
+        bucket.push(s);
+        byName.set(s.name, bucket);
+      }
+      for (const [name, series] of [...byName.entries()].sort()) {
+        lines.push(color.dim(`# ${name}`));
+        for (const s of series) {
+          const labels = Object.entries(s.labels).map(([k, v]) => `${k}=${v}`).join(" ");
+          const labelStr = labels ? color.dim(` {${labels}}`) : "";
+          if (s.type === "histogram") {
+            lines.push(
+              `  count=${s.values.count} sum=${s.values.sum} min=${s.values.min} max=${s.values.max} p50=${s.values.p50} p95=${s.values.p95} p99=${s.values.p99}${labelStr}`
+            );
+          } else {
+            lines.push(`  ${s.values.value}${labelStr}`);
+          }
+        }
+      }
+      const msg = lines.join("\n");
+      return { message: msg };
+    }
+  };
+}
+function healthCommand(opts) {
+  return {
+    name: "health",
+    description: "Run health checks (requires --metrics flag).",
+    async run() {
+      if (!opts.healthRegistry) {
+        return { message: "Health checks not enabled. Restart with --metrics." };
+      }
+      const result = await opts.healthRegistry.run();
+      const lines = [
+        `${statusIcon(result.status)} overall: ${result.status}`,
+        ...result.checks.map((c) => {
+          const detail = c.detail ? color.dim(` \u2014 ${c.detail}`) : "";
+          return `  ${statusIcon(c.status)} ${c.name}: ${c.status}${detail}`;
+        })
+      ];
+      return { message: lines.join("\n") };
+    }
+  };
+}
+function statusIcon(status) {
+  if (status === "healthy") return color.green("\u25CF");
+  if (status === "degraded") return color.yellow("\u25CF");
+  return color.red("\u25CF");
+}
+function spawnCommand(opts) {
+  return {
+    name: "spawn",
+    description: "Spawn an isolated subagent to handle a task. Usage: /spawn <task description>",
+    async run(args) {
+      const description = args.trim();
+      if (!description) return { message: "Usage: /spawn <task description>" };
+      if (!opts.onSpawn) {
+        return { message: "Multi-agent is not enabled in this session." };
+      }
+      try {
+        const summary = await opts.onSpawn(description);
+        return { message: summary };
+      } catch (err) {
+        return {
+          message: `Spawn failed: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    }
+  };
+}
+function agentsCommand(opts) {
+  return {
+    name: "agents",
+    description: "Show status of spawned subagents (pending + completed tasks).",
+    async run() {
+      if (!opts.onAgents) {
+        return { message: "Multi-agent is not enabled in this session." };
+      }
+      return { message: opts.onAgents() };
+    }
+  };
+}
 
 // src/pre-launch.ts
 var MANIFESTS = [
@@ -917,13 +1154,13 @@ var MANIFESTS = [
 ];
 async function detectProjectKind(projectRoot) {
   try {
-    await fs2.access(path2.join(projectRoot, ".wrongstack", "AGENTS.md"));
+    await fs6.access(path5.join(projectRoot, ".wrongstack", "AGENTS.md"));
     return "initialized";
   } catch {
   }
   for (const m of MANIFESTS) {
     try {
-      await fs2.access(path2.join(projectRoot, m));
+      await fs6.access(path5.join(projectRoot, m));
       return "project";
     } catch {
     }
@@ -931,12 +1168,12 @@ async function detectProjectKind(projectRoot) {
   return "empty";
 }
 async function scaffoldAgentsMd(projectRoot) {
-  const dir = path2.join(projectRoot, ".wrongstack");
-  const file = path2.join(dir, "AGENTS.md");
+  const dir = path5.join(projectRoot, ".wrongstack");
+  const file = path5.join(dir, "AGENTS.md");
   const facts = await detectProjectFacts(projectRoot);
   const body = renderAgentsTemplate(facts);
-  await fs2.mkdir(dir, { recursive: true });
-  await fs2.writeFile(file, body, "utf8");
+  await fs6.mkdir(dir, { recursive: true });
+  await fs6.writeFile(file, body, "utf8");
   return file;
 }
 async function runProjectCheck(opts) {
@@ -945,7 +1182,7 @@ async function runProjectCheck(opts) {
   if (kind === "initialized") {
     renderer.write(
       `
-  ${color.green("\u2713")} Project initialized ${color.dim(`(${path2.join(projectRoot, ".wrongstack", "AGENTS.md")})`)}
+  ${color.green("\u2713")} Project initialized ${color.dim(`(${path5.join(projectRoot, ".wrongstack", "AGENTS.md")})`)}
 `
     );
     return true;
@@ -1214,14 +1451,14 @@ function summarize(value, name) {
   if (typeof v === "object" && v !== null) {
     const o = v;
     if (name === "edit") {
-      const path6 = typeof o["path"] === "string" ? o["path"] : "";
+      const path7 = typeof o["path"] === "string" ? o["path"] : "";
       const reps = typeof o["replacements"] === "number" ? o["replacements"] : 0;
-      return `${path6}  ${reps} replacement${reps === 1 ? "" : "s"}`.trim();
+      return `${path7}  ${reps} replacement${reps === 1 ? "" : "s"}`.trim();
     }
     if (name === "write") {
-      const path6 = typeof o["path"] === "string" ? o["path"] : "";
+      const path7 = typeof o["path"] === "string" ? o["path"] : "";
       const bytes = typeof o["bytes"] === "number" ? o["bytes"] : void 0;
-      return bytes !== void 0 ? `${path6}  ${bytes}B` : path6;
+      return bytes !== void 0 ? `${path7}  ${bytes}B` : path7;
     }
     if (typeof o["count"] === "number") {
       return `${o["count"]} match${o["count"] === 1 ? "" : "es"}`;
@@ -1229,6 +1466,37 @@ function summarize(value, name) {
   }
   return "";
 }
+var req = createRequire(import.meta.url);
+function readOwnVersion() {
+  const candidates = ["../package.json", "../../package.json"];
+  for (const rel of candidates) {
+    try {
+      const pkg = req(rel);
+      if (typeof pkg.version === "string" && pkg.version.length > 0) return pkg.version;
+    } catch {
+    }
+  }
+  return "dev";
+}
+var CLI_VERSION = readOwnVersion();
+var API_VERSION = "0.0.0";
+try {
+  const corePkg = req("@wrongstack/core/package.json");
+  if (corePkg.wrongstackApiVersion) API_VERSION = corePkg.wrongstackApiVersion;
+} catch {
+}
+
+// src/utils.ts
+function fmtTok(n) {
+  if (n < 1e3) return String(n);
+  if (n < 1e6) return `${(n / 1e3).toFixed(n < 1e4 ? 1 : 0)}k`;
+  return `${(n / 1e6).toFixed(1)}M`;
+}
+function patchConfig(base, patch) {
+  return Object.freeze({ ...base, ...patch });
+}
+
+// src/repl.ts
 async function runRepl(opts) {
   if (opts.banner !== false) printBanner(opts.renderer);
   let activeCtrl;
@@ -1289,9 +1557,13 @@ async function runRepl(opts) {
       if (result.status === "aborted") {
         opts.renderer.writeWarning("Aborted.");
       } else if (result.status === "failed") {
-        opts.renderer.writeError(
-          `Failed: ${result.error instanceof Error ? result.error.message : String(result.error)}`
-        );
+        const err = result.error;
+        if (err) {
+          const tag = err.recoverable ? " (recoverable)" : "";
+          opts.renderer.writeError(`Failed [${err.severity}]${tag}: ${err.describe()}`);
+        } else {
+          opts.renderer.writeError("Failed.");
+        }
       } else if (result.status === "max_iterations") {
         opts.renderer.writeWarning(`Hit max iterations (${result.iterations}).`);
       }
@@ -1338,11 +1610,6 @@ async function readPossiblyMultiline(opts) {
   }
   return buf;
 }
-function fmtTok(n) {
-  if (n < 1e3) return String(n);
-  if (n < 1e6) return `${(n / 1e3).toFixed(n < 1e4 ? 1 : 0)}k`;
-  return `${(n / 1e6).toFixed(1)}M`;
-}
 var FILLED = "\u2588";
 var EMPTY = "\u2591";
 function renderContextChip(used, max) {
@@ -1359,7 +1626,7 @@ function renderProgress(ratio, width) {
 }
 function printBanner(renderer) {
   const lines = [
-    theme.primary(theme.bold("WrongStack")) + color.dim(" v0.0.1"),
+    theme.primary(theme.bold("WrongStack")) + color.dim(` v${CLI_VERSION}`),
     color.dim("Built on the wrong stack. Shipped anyway."),
     color.dim("Type /help for commands, /exit to quit."),
     ""
@@ -1401,11 +1668,11 @@ var SessionStats = class {
       if (e.name === "bash") this.bashCommands++;
       else if (e.name === "fetch") this.fetches++;
       if (!e.ok) return;
-      const path6 = typeof input?.path === "string" ? input.path : void 0;
-      if (e.name === "read" && path6) this.readPaths.add(path6);
-      else if (e.name === "edit" && path6) this.editedPaths.add(path6);
-      else if (e.name === "write" && path6) {
-        this.writtenPaths.add(path6);
+      const path7 = typeof input?.path === "string" ? input.path : void 0;
+      if (e.name === "read" && path7) this.readPaths.add(path7);
+      else if (e.name === "edit" && path7) this.editedPaths.add(path7);
+      else if (e.name === "write" && path7) {
+        this.writtenPaths.add(path7);
         const content = typeof input?.content === "string" ? input.content : "";
         this.bytesWritten += Buffer.byteLength(content, "utf8");
       }
@@ -1414,8 +1681,15 @@ var SessionStats = class {
   hasActivity() {
     return this.apiRequests > 0 || this.iterations > 0 || this.toolStats.size > 0 || this.tokenCounter.total().input > 0;
   }
-  render(renderer) {
-    if (!this.hasActivity()) return;
+  /**
+   * Build the report string. Returns null when there's no recorded
+   * activity yet — caller decides whether to emit a placeholder or stay
+   * silent. Splitting `format()` out of `render()` lets the TUI's slash
+   * dispatcher take the string and turn it into a history entry, while
+   * REPL keeps the old direct-write path.
+   */
+  format() {
+    if (!this.hasActivity()) return null;
     const u = this.tokenCounter.total();
     const cost = this.tokenCounter.estimateCost();
     const elapsedSec = ((Date.now() - this.startedAt) / 1e3).toFixed(1);
@@ -1430,12 +1704,12 @@ var SessionStats = class {
       lines.push(`  Errors:        ${color.yellow(String(this.errors))}`);
     }
     lines.push("");
-    lines.push(`  Tokens:        in ${fmtTok2(u.input)}   out ${fmtTok2(u.output)}${u.cacheRead ? `   cacheR ${fmtTok2(u.cacheRead)}` : ""}${u.cacheWrite ? `   cacheW ${fmtTok2(u.cacheWrite)}` : ""}`);
+    lines.push(`  Tokens:        in ${fmtTok(u.input)}   out ${fmtTok(u.output)}${u.cacheRead ? `   cacheR ${fmtTok(u.cacheRead)}` : ""}${u.cacheWrite ? `   cacheW ${fmtTok(u.cacheWrite)}` : ""}`);
     const cache = this.tokenCounter.cacheStats();
     if (cache.readTokens > 0 || cache.writeTokens > 0) {
       const pct = (cache.hitRatio * 100).toFixed(1);
       lines.push(
-        `  Prompt cache:  ${pct}% hit  ${color.dim(`(${fmtTok2(cache.readTokens)} read / ${fmtTok2(cache.writeTokens)} write)`)}`
+        `  Prompt cache:  ${pct}% hit  ${color.dim(`(${fmtTok(cache.readTokens)} read / ${fmtTok(cache.writeTokens)} write)`)}`
       );
     }
     if (cost.total > 0) {
@@ -1476,15 +1750,15 @@ var SessionStats = class {
       if (this.fetches > 0) lines.push(`  Web fetches:     ${this.fetches}`);
     }
     lines.push("");
-    renderer.write(`${lines.join("\n")}
+    return lines.join("\n");
+  }
+  render(renderer) {
+    const text = this.format();
+    if (text === null) return;
+    renderer.write(`${text}
 `);
   }
 };
-function fmtTok2(n) {
-  if (n < 1e3) return String(n);
-  if (n < 1e6) return `${(n / 1e3).toFixed(n < 1e4 ? 1 : 0)}k`;
-  return `${(n / 1e6).toFixed(1)}M`;
-}
 function samplePaths(set) {
   const arr = [...set];
   if (arr.length <= 2) return arr.join(", ");
@@ -1555,7 +1829,7 @@ function renderContextChip2(ctx) {
   const pct = Math.round(ratio * 100);
   const chipColor = ratio >= 0.85 ? color.red : ratio >= 0.65 ? color.yellow : color.cyan;
   const bar = renderProgress2(ratio, 8);
-  return color.dim("ctx ") + chipColor(bar) + chipColor(` ${pct}%`) + color.dim(` (${fmtTok3(ctx.used)}/${fmtTok3(ctx.max)})`);
+  return color.dim("ctx ") + chipColor(bar) + chipColor(` ${pct}%`) + color.dim(` (${fmtTok(ctx.used)}/${fmtTok(ctx.max)})`);
 }
 function renderProgress2(ratio, width) {
   const clamped = Math.max(0, Math.min(1, ratio));
@@ -1563,92 +1837,888 @@ function renderProgress2(ratio, width) {
   const capped = Math.min(width, filled);
   return FILLED2.repeat(capped) + EMPTY2.repeat(width - capped);
 }
-function fmtTok3(n) {
-  if (n < 1e3) return String(n);
-  if (n < 1e6) return `${(n / 1e3).toFixed(n < 1e4 ? 1 : 0)}k`;
-  return `${(n / 1e6).toFixed(1)}M`;
+async function bootConfig(flags) {
+  const cwd = typeof flags["cwd"] === "string" ? path5.resolve(flags["cwd"]) : process.cwd();
+  const pathResolver = new DefaultPathResolver(cwd);
+  const projectRoot = pathResolver.projectRoot;
+  const userHome = os3.homedir();
+  const wpaths = resolveWstackPaths({ projectRoot, userHome });
+  await ensureProjectMeta(wpaths, projectRoot);
+  const vault = new DefaultSecretVault({ keyFile: wpaths.secretsKey });
+  for (const file of [wpaths.globalConfig, wpaths.projectLocalConfig]) {
+    try {
+      const { migrated } = await migratePlaintextSecrets(file, vault);
+      if (migrated > 0) {
+        process.stderr.write(`[wstack] Encrypted ${migrated} plaintext secret(s) in ${file}
+`);
+      }
+    } catch {
+    }
+  }
+  const configLoader = new DefaultConfigLoader({ paths: wpaths, vault });
+  const config = await configLoader.load({ cliFlags: flagsToConfigPatch(flags) });
+  return {
+    paths: { cwd, projectRoot, userHome, wpaths, pathResolver },
+    config,
+    vault
+  };
 }
-var subcommands = {
-  init: initCmd,
-  auth: authCmd,
-  // `resume <id>` is special-cased in src/index.ts: it's lifted into
-  // `--resume <id>` so the normal REPL bootstrap runs with a pre-loaded
-  // session. There is no standalone subcommand handler.
-  sessions: sessionsCmd,
-  config: configCmd,
-  tools: toolsCmd,
-  skills: skillsCmd,
-  providers: providersCmd,
-  models: modelsCmd,
-  mcp: mcpCmd,
-  plugin: pluginCmd,
-  diag: diagCmd,
-  usage: usageCmd,
-  version: versionCmd,
-  help: helpCmd,
-  projects: projectsCmd
-};
-async function authCmd(args, deps) {
-  const flags = parseAuthFlags(args);
-  let providerId = flags.positional[0];
-  if (!providerId) {
-    providerId = (await deps.reader.readLine("Provider id: ")).trim();
+function flagsToConfigPatch(flags) {
+  const patch = {};
+  if (typeof flags["provider"] === "string") patch.provider = flags["provider"];
+  if (typeof flags["model"] === "string") patch.model = flags["model"];
+  if (typeof flags["cwd"] === "string") patch.cwd = flags["cwd"];
+  if (typeof flags["log-level"] === "string") {
+    patch.log = { level: flags["log-level"] };
+  } else if (flags["verbose"]) {
+    patch.log = { level: "debug" };
+  } else if (flags["trace"]) {
+    patch.log = { level: "trace" };
   }
-  if (!providerId) {
-    deps.renderer.writeError("Provider id is required.");
-    return 1;
+  if (flags["yolo"]) patch.yolo = true;
+  if (flags["no-features"]) {
+    patch.features = {
+      mcp: false,
+      plugins: false,
+      memory: false,
+      modelsRegistry: false,
+      skills: false
+    };
   }
-  let family = flags.family;
-  let baseUrl = flags.baseUrl;
-  let envVars = flags.envVars;
+  return patch;
+}
+async function ensureProjectMeta(paths, projectRoot) {
   try {
-    const known = await deps.modelsRegistry.getProvider(providerId);
-    if (known) {
-      if (!family) family = known.family;
-      if (!baseUrl) baseUrl = known.apiBase;
-      if (!envVars) envVars = known.envVars;
-    }
+    await fs6.mkdir(paths.projectDir, { recursive: true });
+    const meta = {
+      hash: paths.projectHash,
+      root: projectRoot,
+      lastSeen: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await fs6.writeFile(paths.projectMeta, JSON.stringify(meta, null, 2));
   } catch {
   }
-  if (!family) {
-    deps.renderer.writeError(
-      `Provider "${providerId}" not in catalog. Pass --family <anthropic|openai|openai-compatible|google> to register it manually.`
+}
+var MultiAgentHost = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  coordinator;
+  pending = /* @__PURE__ */ new Map();
+  results = [];
+  async ensureCoordinator() {
+    if (this.coordinator) return this.coordinator;
+    const config = this.deps.configStore.get();
+    const factory = async (subCfg) => {
+      const events = new EventBus();
+      const provider = await this.buildSubagentProvider(config);
+      const baseSystem = await this.deps.systemPromptBuilder.build({
+        cwd: this.deps.cwd,
+        projectRoot: this.deps.projectRoot,
+        tools: this.filterTools(subCfg.tools),
+        model: subCfg.model ?? config.model,
+        provider: config.provider
+      });
+      const parentSession = this.deps.session;
+      const subSession = {
+        id: parentSession.id,
+        append: (ev) => parentSession.append({ ...ev })
+      };
+      const ctx = new Context({
+        systemPrompt: baseSystem,
+        provider,
+        session: subSession,
+        signal: new AbortController().signal,
+        tokenCounter: this.deps.tokenCounter,
+        cwd: this.deps.cwd,
+        projectRoot: this.deps.projectRoot,
+        model: subCfg.model ?? config.model,
+        tools: this.filterTools(subCfg.tools)
+      });
+      const agent = new Agent({
+        container: this.deps.container,
+        tools: this.subagentToolRegistry(subCfg.tools),
+        providers: this.deps.providerRegistry,
+        events,
+        pipelines: createDefaultPipelines(),
+        context: ctx
+      });
+      return { agent, events };
+    };
+    const runner = makeAgentSubagentRunner({ factory });
+    this.coordinator = new DefaultMultiAgentCoordinator(
+      {
+        coordinatorId: randomUUID(),
+        doneCondition: { type: "all_tasks_done" },
+        maxConcurrent: 2,
+        defaultBudget: { maxToolCalls: 20, maxIterations: 20, timeoutMs: 12e4 }
+      },
+      { runner }
     );
-    return 1;
+    this.coordinator.on(
+      "task.completed",
+      ({ task, result }) => {
+        this.results.push(result);
+        this.pending.delete(task.id);
+      }
+    );
+    return this.coordinator;
   }
-  const apiKey = (await deps.reader.readSecret(
-    `API key for ${providerId} (hidden, stored encrypted in ${deps.paths.globalConfig}): `
-  )).trim();
-  if (!apiKey) {
-    deps.renderer.writeError("No key entered. Nothing saved.");
-    return 1;
+  async buildSubagentProvider(config) {
+    const newCfg = config.providers?.[config.provider] ?? {
+      type: config.provider,
+      apiKey: config.apiKey,
+      baseUrl: config.baseUrl
+    };
+    return makeProviderFromConfig(config.provider, {
+      ...newCfg,
+      type: config.provider
+    });
   }
-  const patch = {
-    providers: {
-      [providerId]: {
-        type: providerId,
-        apiKey,
-        family,
-        ...baseUrl ? { baseUrl } : {},
-        ...envVars && envVars.length > 0 ? { envVars } : {}
-      }
+  /** Returns a tool slice for the subagent — full set unless restricted. */
+  filterTools(allow) {
+    const all = this.deps.toolRegistry.list();
+    if (!allow || allow.length === 0) return all;
+    const allowSet = new Set(allow);
+    return all.filter((t) => allowSet.has(t.name));
+  }
+  subagentToolRegistry(allow) {
+    if (!allow || allow.length === 0) return this.deps.toolRegistry;
+    const cloneCtor = this.deps.toolRegistry.constructor;
+    const sub = new cloneCtor();
+    for (const t of this.filterTools(allow)) sub.register(t);
+    return sub;
+  }
+  /** Spawn a fresh subagent and assign a single task. Returns task id. */
+  async spawn(description) {
+    const coord = await this.ensureCoordinator();
+    const spawned = await coord.spawn({
+      name: "adhoc",
+      role: "general",
+      maxToolCalls: 20,
+      maxIterations: 20
+    });
+    const taskId = randomUUID();
+    this.pending.set(taskId, { description, subagentId: spawned.subagentId });
+    await coord.assign({
+      id: taskId,
+      description,
+      subagentId: spawned.subagentId,
+      maxToolCalls: 20
+    });
+    return { subagentId: spawned.subagentId, taskId };
+  }
+  status() {
+    const pending = Array.from(this.pending.entries()).map(([taskId, v]) => ({
+      taskId,
+      description: v.description,
+      subagentId: v.subagentId
+    }));
+    const summary = !this.coordinator ? "No subagents have been spawned." : `${pending.length} pending, ${this.results.length} completed.`;
+    return { pending, completed: this.results, summary };
+  }
+  async stopAll() {
+    if (this.coordinator) {
+      await this.coordinator.stopAll();
     }
-  };
-  try {
-    await rewriteConfigEncrypted(deps.paths.globalConfig, deps.vault, patch);
-    deps.renderer.writeInfo(`Stored encrypted key for ${providerId}.`);
-    deps.renderer.writeInfo(`Use: wstack --provider ${providerId} "<task>"`);
-    return 0;
-  } catch (err) {
-    deps.renderer.writeError(`auth: ${err instanceof Error ? err.message : String(err)}`);
-    return 1;
   }
-}
-function parseAuthFlags(args) {
+};
+async function runAuthMenu(deps) {
+  for (; ; ) {
+    const providers = await loadProviders(deps);
+    renderTopMenu(deps.renderer, providers);
+    const ids = Object.keys(providers).sort();
+    const choice = (await deps.reader.readLine(`
+${color.amber("?")} Pick: `)).trim().toLowerCase();
+    if (!choice || choice === "q" || choice === "quit" || choice === "exit") {
+      deps.renderer.write(color.dim("Done.\n"));
+      return 0;
+    }
+    if (choice === "a" || choice === "add") {
+      await addForNewProvider(deps);
+      continue;
+    }
+    if (choice === "c" || choice === "custom") {
+      await addCustomProvider(deps);
+      continue;
+    }
+    const idx = Number.parseInt(choice, 10);
+    if (!Number.isNaN(idx) && idx >= 1 && idx <= ids.length) {
+      const pid = ids[idx - 1];
+      await manageProvider(pid, deps);
+      continue;
+    }
+    const byId = ids.find((id) => id.toLowerCase() === choice);
+    if (byId) {
+      await manageProvider(byId, deps);
+      continue;
+    }
+    deps.renderer.writeError(`Unknown selection: "${choice}"`);
+  }
+}
+function renderTopMenu(renderer, providers) {
+  renderer.write(`
+${color.bold("WrongStack")} ${color.dim("\u2014 API keys")}
+
+`);
+  const ids = Object.keys(providers).sort();
+  if (ids.length === 0) {
+    renderer.write(color.dim("  No providers configured yet.\n"));
+  } else {
+    renderer.write(`  ${color.dim("Saved providers:")}
+`);
+    let idx = 1;
+    for (const id of ids) {
+      const cfg = providers[id];
+      const keys = normalizeKeys(cfg);
+      const active = activeLabel(cfg, keys);
+      const summary = keys.length === 0 ? color.dim("(no keys)") : keys.length === 1 ? maskedKey(keys[0].apiKey) : `${color.dim(`${keys.length} keys`)} ${color.dim("active:")} ${color.bold(active ?? "?")} ${maskedKey(keys.find((k) => k.label === active)?.apiKey ?? keys[0].apiKey)}`;
+      const fam = cfg.family ? color.dim(`[${cfg.family}]`) : "";
+      const aliasHint = cfg.type && cfg.type !== id ? color.dim(`\u2192 ${cfg.type}`) : "";
+      renderer.write(
+        `    ${color.dim(`${idx}.`.padStart(4))} ${id.padEnd(22)} ${fam} ${aliasHint} ${summary}
+`
+      );
+      idx++;
+    }
+  }
+  renderer.write(`
+  ${color.dim("Actions:")}
+`);
+  renderer.write(`    ${color.bold("a")}  Add key for a new provider (from catalog)
+`);
+  renderer.write(`    ${color.bold("c")}  Add custom provider (type + family + baseUrl)
+`);
+  renderer.write(`    ${color.bold("q")}  Quit
+`);
+  if (ids.length > 0) {
+    renderer.write(color.dim(`
+  Pick a number to manage that provider's keys.
+`));
+  }
+}
+async function manageProvider(providerId, deps) {
+  for (; ; ) {
+    const providers = await loadProviders(deps);
+    const cfg = providers[providerId];
+    if (!cfg) {
+      deps.renderer.writeError(`Provider "${providerId}" no longer in config.`);
+      return;
+    }
+    const keys = normalizeKeys(cfg);
+    const active = activeLabel(cfg, keys);
+    deps.renderer.write(`
+${color.bold(providerId)} ${cfg.family ? color.dim(`[${cfg.family}]`) : color.amber("[no family]")}
+`);
+    deps.renderer.write(
+      color.dim(`  type:    ${cfg.type ?? providerId}
+`) + color.dim(`  family:  ${cfg.family ?? "(unset \u2192 resolved from models.dev when type matches)"}
+`) + color.dim(`  baseUrl: ${cfg.baseUrl ?? "(unset \u2192 catalog default)"}
+`)
+    );
+    if (cfg.envVars && cfg.envVars.length > 0) {
+      deps.renderer.write(color.dim(`  envVars: ${cfg.envVars.join(", ")}
+`));
+    }
+    if (cfg.models && cfg.models.length > 0) {
+      deps.renderer.write(color.dim(`  models:  ${cfg.models.join(", ")}
+`));
+    }
+    if (keys.length === 0) {
+      deps.renderer.write(color.dim("  (no keys saved)\n"));
+    } else {
+      for (let i = 0; i < keys.length; i++) {
+        const k = keys[i];
+        const marker = k.label === active ? color.green("\u25CF") : color.dim("\u25CB");
+        deps.renderer.write(
+          `  ${color.dim(`${i + 1}.`.padStart(4))} ${marker} ${k.label.padEnd(20)} ${maskedKey(k.apiKey)}  ${color.dim(k.createdAt)}
+`
+        );
+      }
+    }
+    deps.renderer.write(`
+  ${color.dim("Actions:")}
+`);
+    deps.renderer.write(`    ${color.bold("a")}        Add another key
+`);
+    if (keys.length > 0) {
+      deps.renderer.write(`    ${color.bold("u")} <n>    Update key <n>
+`);
+      deps.renderer.write(`    ${color.bold("d")} <n>    Delete key <n>
+`);
+      deps.renderer.write(`    ${color.bold("s")} <n>    Set key <n> as active
+`);
+    }
+    deps.renderer.write(`    ${color.bold("f")}        Edit family
+`);
+    deps.renderer.write(`    ${color.bold("B")}        Edit baseUrl
+`);
+    deps.renderer.write(`    ${color.bold("m")}        Edit visible model list
+`);
+    deps.renderer.write(`    ${color.bold("x")}        Remove this provider entirely
+`);
+    deps.renderer.write(`    ${color.bold("b")}        Back
+`);
+    const raw = (await deps.reader.readLine(`
+${color.amber("?")} ${providerId} > `)).trim();
+    if (!raw || raw === "b" || raw === "back") return;
+    const [verb, argRaw] = raw.split(/\s+/, 2);
+    const arg = argRaw ? Number.parseInt(argRaw, 10) : Number.NaN;
+    if (verb === "a" || verb === "add") {
+      await addKeyForProvider(providerId, deps, cfg);
+      continue;
+    }
+    if (verb === "x" || verb === "remove") {
+      const confirm = (await deps.reader.readLine(
+        `  ${color.amber("?")} Remove provider "${providerId}" and ${keys.length} key(s)? ${color.dim("[y/N]")} `
+      )).trim().toLowerCase();
+      if (confirm === "y" || confirm === "yes") {
+        await mutateProviders(deps, (all) => {
+          delete all[providerId];
+        });
+        deps.renderer.write(`  ${color.green("\u2713")} Removed ${providerId}.
+`);
+        return;
+      }
+      continue;
+    }
+    if (verb === "u" || verb === "update") {
+      if (!Number.isFinite(arg) || arg < 1 || arg > keys.length) {
+        deps.renderer.writeError(`Usage: u <1-${keys.length}>`);
+        continue;
+      }
+      const target = keys[arg - 1];
+      const newKey = await readKeyInput(deps, `Updated key for ${target.label}`);
+      if (!newKey) continue;
+      await mutateProviders(deps, (all) => {
+        const p = all[providerId];
+        if (!p) return;
+        const list = normalizeKeys(p).map(
+          (k) => k.label === target.label ? { ...k, apiKey: newKey, createdAt: nowIso() } : k
+        );
+        writeKeysBack(p, list);
+      });
+      deps.renderer.write(`  ${color.green("\u2713")} Updated ${providerId}/${target.label}.
+`);
+      continue;
+    }
+    if (verb === "d" || verb === "delete" || verb === "rm") {
+      if (!Number.isFinite(arg) || arg < 1 || arg > keys.length) {
+        deps.renderer.writeError(`Usage: d <1-${keys.length}>`);
+        continue;
+      }
+      const target = keys[arg - 1];
+      const confirm = (await deps.reader.readLine(
+        `  ${color.amber("?")} Delete key "${target.label}" (${maskedKey(target.apiKey)})? ${color.dim("[y/N]")} `
+      )).trim().toLowerCase();
+      if (confirm !== "y" && confirm !== "yes") continue;
+      await mutateProviders(deps, (all) => {
+        const p = all[providerId];
+        if (!p) return;
+        const list = normalizeKeys(p).filter((k) => k.label !== target.label);
+        writeKeysBack(p, list);
+        if (p.activeKey === target.label) {
+          p.activeKey = list[0]?.label;
+        }
+      });
+      deps.renderer.write(`  ${color.green("\u2713")} Deleted ${providerId}/${target.label}.
+`);
+      continue;
+    }
+    if (verb === "f" || verb === "family") {
+      const current = cfg.family ?? "";
+      const ans = (await deps.reader.readLine(
+        `  ${color.amber("?")} Family ${color.dim(`(anthropic | openai | openai-compatible | google, empty = unset, current: ${current || "unset"})`)}: `
+      )).trim();
+      if (ans !== "" && !["anthropic", "openai", "openai-compatible", "google"].includes(ans)) {
+        deps.renderer.writeError(`Invalid family: "${ans}"`);
+        continue;
+      }
+      await mutateProviders(deps, (all) => {
+        const p = all[providerId];
+        if (!p) return;
+        if (ans === "") delete p.family;
+        else p.family = ans;
+      });
+      deps.renderer.write(`  ${color.green("\u2713")} family \u2192 ${ans || "(unset)"}
+`);
+      continue;
+    }
+    if (verb === "B" || verb === "baseurl" || verb === "base-url") {
+      const current = cfg.baseUrl ?? "";
+      const ans = (await deps.reader.readLine(
+        `  ${color.amber("?")} Base URL ${color.dim(`(empty = unset, current: ${current || "unset"})`)}: `
+      )).trim();
+      await mutateProviders(deps, (all) => {
+        const p = all[providerId];
+        if (!p) return;
+        if (ans === "") delete p.baseUrl;
+        else p.baseUrl = ans;
+      });
+      deps.renderer.write(`  ${color.green("\u2713")} baseUrl \u2192 ${ans || "(unset)"}
+`);
+      continue;
+    }
+    if (verb === "m" || verb === "models") {
+      const current = (cfg.models ?? []).join(", ");
+      const ans = (await deps.reader.readLine(
+        `  ${color.amber("?")} Model ids ${color.dim(`(comma-separated, empty = catalog default, current: ${current || "none"})`)}: `
+      )).trim();
+      const list = ans ? ans.split(",").map((s) => s.trim()).filter(Boolean) : [];
+      await mutateProviders(deps, (all) => {
+        const p = all[providerId];
+        if (!p) return;
+        if (list.length === 0) delete p.models;
+        else p.models = list;
+      });
+      deps.renderer.write(`  ${color.green("\u2713")} models \u2192 ${list.length === 0 ? "(catalog default)" : list.join(", ")}
+`);
+      continue;
+    }
+    if (verb === "s" || verb === "set" || verb === "active") {
+      if (!Number.isFinite(arg) || arg < 1 || arg > keys.length) {
+        deps.renderer.writeError(`Usage: s <1-${keys.length}>`);
+        continue;
+      }
+      const target = keys[arg - 1];
+      await mutateProviders(deps, (all) => {
+        const p = all[providerId];
+        if (!p) return;
+        const list = normalizeKeys(p);
+        writeKeysBack(p, list);
+        p.activeKey = target.label;
+      });
+      deps.renderer.write(`  ${color.green("\u2713")} Active key for ${providerId} \u2192 ${color.bold(target.label)}.
+`);
+      continue;
+    }
+    deps.renderer.writeError(`Unknown action: "${raw}"`);
+  }
+}
+async function addForNewProvider(deps) {
+  let catalog = [];
+  try {
+    catalog = (await deps.modelsRegistry.listProviders()).filter((p) => p.family !== "unsupported");
+  } catch {
+    deps.renderer.writeWarning("Catalog unavailable \u2014 falling back to manual entry.");
+  }
+  if (catalog.length === 0) {
+    const pid = (await deps.reader.readLine(`  ${color.amber("?")} Provider id: `)).trim();
+    if (!pid) return;
+    const fam = (await deps.reader.readLine(
+      `  ${color.amber("?")} Family (anthropic/openai/openai-compatible/google): `
+    )).trim();
+    const baseUrl2 = (await deps.reader.readLine(
+      `  ${color.amber("?")} Base URL ${color.dim("(optional)")}: `
+    )).trim();
+    await addKeyForProvider(pid, deps, {
+      type: pid,
+      family: fam || void 0,
+      ...baseUrl2 ? { baseUrl: baseUrl2 } : {}
+    });
+    return;
+  }
+  const saved = new Set(Object.keys(await loadProviders(deps)));
+  deps.renderer.write(
+    color.dim(`  Catalog has ${catalog.length} providers. Filter by name to narrow, or "s" for unsaved-only.
+`)
+  );
+  const filterRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Filter ${color.dim('(substring of id/name, "s" for unsaved-only, empty = all)')}: `
+  )).trim();
+  const filterLc = filterRaw.toLowerCase();
+  const showUnsavedOnly = filterLc === "s" || filterLc === "unsaved";
+  const matches = (p) => {
+    if (showUnsavedOnly) return !saved.has(p.id);
+    if (!filterLc) return true;
+    return p.id.toLowerCase().includes(filterLc) || p.name.toLowerCase().includes(filterLc);
+  };
+  const byFamily = /* @__PURE__ */ new Map();
+  let filteredCount = 0;
+  for (const p of catalog) {
+    if (!matches(p)) continue;
+    filteredCount++;
+    const list = byFamily.get(p.family) ?? [];
+    list.push(p);
+    byFamily.set(p.family, list);
+  }
+  if (filteredCount === 0) {
+    deps.renderer.writeError(
+      `No providers match "${filterRaw}". Try a shorter substring or check \`wstack providers\` for valid ids.`
+    );
+    return;
+  }
+  if (filterRaw && !showUnsavedOnly) {
+    deps.renderer.write(
+      color.dim(`  ${filteredCount} match${filteredCount === 1 ? "" : "es"} for "${filterRaw}".
+`)
+    );
+  }
+  const ordered = [];
+  const familyOrder = ["anthropic", "openai", "google", "openai-compatible"];
+  let idx = 1;
+  deps.renderer.write("\n");
+  for (const fam of familyOrder) {
+    const list = byFamily.get(fam);
+    if (!list || list.length === 0) continue;
+    deps.renderer.write(`  ${color.bold(fam)}
+`);
+    for (const p of list) {
+      const savedMark = saved.has(p.id) ? color.cyan("\u25C9") : color.dim("\u25CB");
+      const env = p.envVars[0] ? color.dim(`[${p.envVars[0]}]`) : "";
+      deps.renderer.write(
+        `    ${color.dim(`${idx}.`.padStart(4))} ${savedMark} ${p.id.padEnd(22)} ${color.dim(p.name)} ${env}
+`
+      );
+      ordered.push(p);
+      idx++;
+    }
+  }
+  deps.renderer.write(`
+  ${color.dim("\u25C9 already saved   \u25CB no key yet")}
+`);
+  const answer = (await deps.reader.readLine(
+    `
+${color.amber("?")} Pick (1-${ordered.length}) or type provider id: `
+  )).trim();
+  if (!answer) return;
+  let chosen;
+  const num = Number.parseInt(answer, 10);
+  if (!Number.isNaN(num) && num >= 1 && num <= ordered.length) {
+    chosen = ordered[num - 1];
+  } else {
+    chosen = ordered.find((p) => p.id.toLowerCase() === answer.toLowerCase()) ?? catalog.find((p) => p.id.toLowerCase() === answer.toLowerCase());
+  }
+  if (!chosen) {
+    deps.renderer.writeError(`No such provider: "${answer}"`);
+    return;
+  }
+  deps.renderer.write(
+    color.dim(`
+  Defaults from models.dev \u2014 press Enter to keep, or type a new value.
+`)
+  );
+  const famRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Family ${color.dim(`[${chosen.family}]`)}: `
+  )).trim();
+  let family = chosen.family;
+  if (famRaw) {
+    if (!["anthropic", "openai", "openai-compatible", "google"].includes(famRaw)) {
+      deps.renderer.writeError(`Invalid family: "${famRaw}" (must be anthropic | openai | openai-compatible | google).`);
+      return;
+    }
+    family = famRaw;
+  }
+  const baseRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Base URL ${color.dim(`[${chosen.apiBase ?? "unset"}]`)}: `
+  )).trim();
+  const baseUrl = baseRaw || chosen.apiBase;
+  const providersNow = await loadProviders(deps);
+  let suggestedAlias = chosen.id;
+  if (family !== chosen.family) {
+    let candidate = `${chosen.id}-${family}`;
+    let n = 2;
+    while (providersNow[candidate]) {
+      candidate = `${chosen.id}-${family}-${n}`;
+      n++;
+    }
+    suggestedAlias = candidate;
+  }
+  const aliasRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Save under alias ${color.dim(`[${suggestedAlias}]`)} ${color.dim("(used as `--provider <alias>`)")}: `
+  )).trim();
+  const alias = aliasRaw || suggestedAlias;
+  const existing = providersNow[alias];
+  if (existing) {
+    const sameFamily = (existing.family ?? chosen.family) === family;
+    const sameBase = (existing.baseUrl ?? chosen.apiBase) === baseUrl;
+    if (!sameFamily || !sameBase) {
+      deps.renderer.writeError(
+        `Alias "${alias}" already exists with different family/baseUrl.
+  Existing: family=${existing.family ?? "(unset)"}, baseUrl=${existing.baseUrl ?? "(unset)"}
+  New:      family=${family}, baseUrl=${baseUrl ?? "(unset)"}
+  Pick a different alias to keep them separate.`
+      );
+      return;
+    }
+  }
+  await addKeyForProvider(alias, deps, {
+    type: chosen.id,
+    family,
+    baseUrl,
+    envVars: chosen.envVars
+  });
+}
+async function addCustomProvider(deps) {
+  deps.renderer.write(`
+${color.bold("Custom provider")} ${color.dim("\u2014 for local models or proxies not in the models.dev catalog.")}
+`);
+  const type = (await deps.reader.readLine(
+    `  ${color.amber("?")} Provider id ${color.dim('(e.g. "local-llama", "my-proxy")')}: `
+  )).trim();
+  if (!type) return;
+  const existing = (await loadProviders(deps))[type];
+  if (existing) {
+    deps.renderer.writeWarning(`"${type}" already exists. Pick it from the main menu to edit.`);
+    return;
+  }
+  const familyRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Wire family ${color.dim("(anthropic | openai | openai-compatible | google)")}: `
+  )).trim();
+  if (!["anthropic", "openai", "openai-compatible", "google"].includes(familyRaw)) {
+    deps.renderer.writeError(`Invalid family: "${familyRaw}"`);
+    return;
+  }
+  const family = familyRaw;
+  const baseUrl = (await deps.reader.readLine(
+    `  ${color.amber("?")} Base URL ${color.dim("(e.g. http://localhost:11434/v1, leave empty if not needed)")}: `
+  )).trim();
+  const modelsRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Model ids ${color.dim("(comma-separated, optional)")}: `
+  )).trim();
+  const models = modelsRaw ? modelsRaw.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+  const envVarsRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Env var names ${color.dim("(comma-separated, optional fallback for the key)")}: `
+  )).trim();
+  const envVars = envVarsRaw ? envVarsRaw.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+  await addKeyForProvider(type, deps, {
+    type,
+    family,
+    ...baseUrl ? { baseUrl } : {},
+    ...models ? { models } : {},
+    ...envVars ? { envVars } : {}
+  });
+}
+async function addKeyForProvider(providerId, deps, template) {
+  const providers = await loadProviders(deps);
+  const existing = providers[providerId];
+  const existingKeys = existing ? normalizeKeys(existing) : [];
+  const usedLabels = new Set(existingKeys.map((k) => k.label));
+  let defaultLabel = "default";
+  if (usedLabels.has(defaultLabel)) {
+    let n = 2;
+    while (usedLabels.has(`key${n}`)) n++;
+    defaultLabel = `key${n}`;
+  }
+  const labelRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Label for this key ${color.dim(`[${defaultLabel}]`)}: `
+  )).trim();
+  const label = labelRaw || defaultLabel;
+  if (usedLabels.has(label)) {
+    deps.renderer.writeError(`Label "${label}" already used for ${providerId}. Use update (u) instead.`);
+    return;
+  }
+  const apiKey = await readKeyInput(deps, `API key for ${providerId}/${label}`);
+  if (!apiKey) {
+    deps.renderer.writeError("No key entered. Nothing saved.");
+    return;
+  }
+  await mutateProviders(deps, (all) => {
+    const existingProv = all[providerId] ?? { type: providerId, ...template };
+    if (!existingProv.type) existingProv.type = providerId;
+    if (!existingProv.family && template.family) existingProv.family = template.family;
+    if (!existingProv.baseUrl && template.baseUrl) existingProv.baseUrl = template.baseUrl;
+    if (!existingProv.envVars && template.envVars) existingProv.envVars = template.envVars;
+    const list = normalizeKeys(existingProv);
+    list.push({ label, apiKey, createdAt: nowIso() });
+    writeKeysBack(existingProv, list);
+    if (!existingProv.activeKey) existingProv.activeKey = label;
+    all[providerId] = existingProv;
+  });
+  deps.renderer.write(
+    `  ${color.green("\u2713")} Saved ${color.bold(providerId)}/${color.bold(label)}. ${color.dim("Use `wstack --provider " + providerId + ' "<task>"` to launch.')}
+`
+  );
+}
+async function runAuthDirect(deps, opts) {
+  const { providerId } = opts;
+  const providers = await loadProviders(deps);
+  const existing = providers[providerId];
+  if (!existing && !opts.family) {
+    let knownFamily;
+    let knownBase;
+    let knownEnv;
+    try {
+      const k = await deps.modelsRegistry.getProvider(providerId);
+      if (k) {
+        knownFamily = k.family;
+        knownBase = k.apiBase;
+        knownEnv = k.envVars;
+      }
+    } catch {
+    }
+    if (!knownFamily || knownFamily === "unsupported") {
+      deps.renderer.writeError(
+        `Provider "${providerId}" not in catalog. Pass --family <anthropic|openai|openai-compatible|google>.`
+      );
+      return 1;
+    }
+    opts.family = knownFamily;
+    opts.baseUrl ??= knownBase;
+    opts.envVars ??= knownEnv;
+  }
+  const usedLabels = new Set(
+    existing ? normalizeKeys(existing).map((k) => k.label) : []
+  );
+  let label = opts.label ?? "default";
+  if (usedLabels.has(label)) {
+    let n = 2;
+    while (usedLabels.has(`${label}-${n}`)) n++;
+    label = `${label}-${n}`;
+    deps.renderer.writeInfo(`Label collided; saving as "${label}".`);
+  }
+  const apiKey = await readKeyInput(deps, `API key for ${providerId}/${label}`);
+  if (!apiKey) return 1;
+  await mutateProviders(deps, (all) => {
+    const p = all[providerId] ?? { type: providerId };
+    if (!p.type) p.type = providerId;
+    if (!p.family && opts.family) p.family = opts.family;
+    if (!p.baseUrl && opts.baseUrl) p.baseUrl = opts.baseUrl;
+    if (!p.envVars && opts.envVars) p.envVars = opts.envVars;
+    const list = normalizeKeys(p);
+    list.push({ label, apiKey, createdAt: nowIso() });
+    writeKeysBack(p, list);
+    if (!p.activeKey) p.activeKey = label;
+    all[providerId] = p;
+  });
+  deps.renderer.writeInfo(`Stored encrypted key for ${providerId} (label "${label}").`);
+  deps.renderer.writeInfo(`Use: wstack --provider ${providerId} "<task>"`);
+  return 0;
+}
+async function readKeyInput(deps, intent) {
+  const key = (await deps.reader.readSecret(`  ${color.amber("?")} ${intent} ${color.dim("(hidden, paste OK)")}: `)).trim();
+  if (!key) {
+    deps.renderer.writeError("No key entered.");
+    return void 0;
+  }
+  return key;
+}
+async function loadProviders(deps) {
+  let raw;
+  try {
+    raw = await fs6.readFile(deps.globalConfigPath, "utf8");
+  } catch {
+    return {};
+  }
+  let parsed = {};
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {};
+  }
+  const decrypted = decryptConfigSecrets(parsed, deps.vault);
+  return decrypted.providers ?? {};
+}
+async function mutateProviders(deps, mutator) {
+  let raw;
+  try {
+    raw = await fs6.readFile(deps.globalConfigPath, "utf8");
+  } catch {
+    raw = "{}";
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    parsed = {};
+  }
+  const decrypted = decryptConfigSecrets(parsed, deps.vault);
+  const providers = decrypted.providers ?? {};
+  mutator(providers);
+  decrypted.providers = providers;
+  const encrypted = encryptConfigSecrets(decrypted, deps.vault);
+  await atomicWrite(deps.globalConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+}
+function normalizeKeys(cfg) {
+  if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {
+    return cfg.apiKeys.map((k) => ({ ...k }));
+  }
+  if (typeof cfg.apiKey === "string" && cfg.apiKey.length > 0) {
+    return [{ label: "default", apiKey: cfg.apiKey, createdAt: "" }];
+  }
+  return [];
+}
+function writeKeysBack(cfg, keys) {
+  if (keys.length === 0) {
+    delete cfg.apiKeys;
+    delete cfg.apiKey;
+    delete cfg.activeKey;
+    return;
+  }
+  cfg.apiKeys = keys;
+  const active = keys.find((k) => k.label === cfg.activeKey) ?? keys[0];
+  cfg.apiKey = active.apiKey;
+  if (!cfg.activeKey || !keys.some((k) => k.label === cfg.activeKey)) {
+    cfg.activeKey = active.label;
+  }
+}
+function activeLabel(cfg, keys) {
+  if (cfg.activeKey && keys.some((k) => k.label === cfg.activeKey)) return cfg.activeKey;
+  return keys[0]?.label;
+}
+function maskedKey(key) {
+  if (!key) return color.dim("\u2014");
+  if (key.length <= 8) return color.dim("\u2022".repeat(key.length));
+  const head = key.slice(0, 4);
+  const tail = key.slice(-4);
+  return `${color.dim(head + "\u2026")}${tail}`;
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+
+// src/subcommands/index.ts
+var subcommands = {
+  init: initCmd,
+  auth: authCmd,
+  // `resume <id>` is special-cased in src/index.ts: it's lifted into
+  // `--resume <id>` so the normal REPL bootstrap runs with a pre-loaded
+  // session. There is no standalone subcommand handler.
+  sessions: sessionsCmd,
+  config: configCmd,
+  tools: toolsCmd,
+  skills: skillsCmd,
+  providers: providersCmd,
+  models: modelsCmd,
+  mcp: mcpCmd,
+  plugin: pluginCmd,
+  diag: diagCmd,
+  doctor: doctorCmd,
+  export: exportCmd,
+  usage: usageCmd,
+  version: versionCmd,
+  help: helpCmd,
+  projects: projectsCmd
+};
+async function authCmd(args, deps) {
+  const flags = parseAuthFlags(args);
+  const menuDeps = {
+    renderer: deps.renderer,
+    reader: deps.reader,
+    modelsRegistry: deps.modelsRegistry,
+    vault: deps.vault,
+    globalConfigPath: deps.paths.globalConfig
+  };
+  if (flags.positional.length === 0) {
+    return runAuthMenu(menuDeps);
+  }
+  return runAuthDirect(menuDeps, {
+    providerId: flags.positional[0],
+    label: flags.label,
+    family: flags.family,
+    baseUrl: flags.baseUrl,
+    envVars: flags.envVars
+  });
+}
+function parseAuthFlags(args) {
   const out = { positional: [] };
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
-    if (a === "--family") {
+    if (a === "--label") {
+      const v = args[++i];
+      if (v) out.label = v;
+    } else if (a === "--family") {
       const v = args[++i];
       if (v) out.family = v;
     } else if (a === "--base-url") {
@@ -1710,7 +2780,7 @@ async function initCmd(_args, deps) {
   } else {
     deps.renderer.writeInfo(`Found API key in env (${provider.envVars.join(" / ")}).`);
   }
-  await fs2.mkdir(deps.paths.globalRoot, { recursive: true });
+  await fs6.mkdir(deps.paths.globalRoot, { recursive: true });
   const config = {
     version: 1,
     provider: providerId,
@@ -1718,10 +2788,10 @@ async function initCmd(_args, deps) {
   };
   if (apiKey) config.apiKey = apiKey;
   await atomicWrite(deps.paths.globalConfig, JSON.stringify(config, null, 2));
-  await fs2.mkdir(path2.join(deps.projectRoot, ".wrongstack"), { recursive: true });
-  const agentsFile = path2.join(deps.projectRoot, ".wrongstack", "AGENTS.md");
+  await fs6.mkdir(path5.join(deps.projectRoot, ".wrongstack"), { recursive: true });
+  const agentsFile = path5.join(deps.projectRoot, ".wrongstack", "AGENTS.md");
   try {
-    await fs2.access(agentsFile);
+    await fs6.access(agentsFile);
   } catch {
     await atomicWrite(
       agentsFile,
@@ -1853,25 +2923,42 @@ async function modelsCmd(args, deps) {
     deps.renderer.writeError("Usage: wstack models <provider> | refresh");
     return 1;
   }
-  const provider = await deps.modelsRegistry.getProvider(providerId);
+  let lookupId = providerId;
+  const savedAlias = deps.config.providers?.[providerId];
+  if (savedAlias?.type && savedAlias.type !== providerId) {
+    lookupId = savedAlias.type;
+  }
+  const provider = await deps.modelsRegistry.getProvider(lookupId);
   if (!provider) {
-    deps.renderer.writeError(`Provider "${providerId}" not in catalog.`);
+    deps.renderer.writeError(
+      lookupId !== providerId ? `Alias "${providerId}" points at catalog id "${lookupId}" which is not in the cache.` : `Provider "${providerId}" not in catalog.`
+    );
     return 1;
   }
+  if (lookupId !== providerId) {
+    deps.renderer.write(color.dim(`(showing catalog models for "${lookupId}" via alias "${providerId}")
+`));
+  }
   deps.renderer.write(`${color.bold(provider.name)} ${color.dim(`(${provider.id})`)}
 `);
   if (provider.doc) deps.renderer.write(color.dim(`Docs: ${provider.doc}
 `));
-  const sorted = [...provider.models].sort(
+  const userModels = deps.config.providers?.[providerId]?.models;
+  const catalogById = new Map(provider.models.map((m) => [m.id, m]));
+  const sorted = userModels && userModels.length > 0 ? userModels.map((id) => catalogById.get(id) ?? { id, name: id }) : [...provider.models].sort(
     (a, b) => (b.release_date ?? "").localeCompare(a.release_date ?? "")
   );
+  if (userModels && userModels.length > 0) {
+    deps.renderer.write(color.dim(`(${userModels.length} model(s) from your saved config)
+`));
+  }
   for (const m of sorted) {
     const caps = [];
-    if (m.tool_call) caps.push("tools");
-    if (m.reasoning) caps.push("reasoning");
-    if (m.modalities?.input?.includes("image")) caps.push("vision");
-    const ctx = m.limit?.context ? `${(m.limit.context / 1e3).toFixed(0)}k` : "?";
-    const cost = m.cost?.input !== void 0 ? `$${m.cost.input}/$${m.cost.output ?? "?"}` : "";
+    if ("tool_call" in m && m.tool_call) caps.push("tools");
+    if ("reasoning" in m && m.reasoning) caps.push("reasoning");
+    if ("modalities" in m && m.modalities?.input?.includes("image")) caps.push("vision");
+    const ctx = "limit" in m && m.limit?.context ? `${(m.limit.context / 1e3).toFixed(0)}k` : "?";
+    const cost = "cost" in m && m.cost?.input !== void 0 ? `$${m.cost.input}/$${m.cost.output ?? "?"}` : "";
     deps.renderer.write(
       `  ${m.id.padEnd(40)} ${color.dim(ctx.padStart(6))}  ${color.dim(cost.padEnd(14))} ${color.dim(caps.join(","))}
 `
@@ -1893,16 +2980,46 @@ async function mcpCmd(args, deps) {
     const servers = deps.config.mcpServers ?? {};
     if (Object.keys(servers).length === 0) {
       deps.renderer.write("No MCP servers configured.\n");
+      deps.renderer.write("Use `wstack mcp add <name>` or set mcpServers in your config.\n");
       return 0;
     }
     for (const [name, cfg] of Object.entries(servers)) {
+      const status = cfg.enabled === false ? "disabled" : "enabled";
+      const desc = cfg.description ? `  # ${cfg.description}` : "";
       deps.renderer.write(
-        `  ${name.padEnd(20)} ${cfg.transport}  ${cfg.enabled === false ? "disabled" : "enabled"}
+        `  ${name.padEnd(20)} ${cfg.transport.padEnd(16)} ${status}${desc}
 `
       );
     }
     return 0;
   }
+  if (sub === "add") {
+    const name = args[1];
+    if (!name) {
+      deps.renderer.writeError("Usage: wstack mcp add <name>\n");
+      deps.renderer.write("Available servers:\n");
+      for (const [sname, scfg] of Object.entries(deps.config.mcpServers ?? {})) {
+        deps.renderer.write(`  ${sname.padEnd(20)} ${scfg.description ?? scfg.transport}
+`);
+      }
+      if (Object.keys(deps.config.mcpServers ?? {}).length === 0) {
+        deps.renderer.write(
+          "  filesystem       filesystem (read/write/navigate)\n  github           github (issues, PRs, repos)\n  context7         context7 (codebase docs & Q&A)\n  brave-search     brave search (web search)\n  block            block (Postgres via SQL)\n  everart          everart (AI image generation)\n  slack            slack (messaging & channels)\n  aws              aws (EC2, S3, Lambda, IAM)\n  google-maps      google-maps (directions, geocoding)\n  sentinel         sentinel (security vulnerabilities)\n"
+        );
+      }
+      deps.renderer.write("\nRun `wstack mcp add <name> --enable` to enable immediately.\n");
+      return 1;
+    }
+    return addMcpServer(args, deps);
+  }
+  if (sub === "remove") {
+    const name = args[1];
+    if (!name) {
+      deps.renderer.writeError("Usage: wstack mcp remove <name>\n");
+      return 1;
+    }
+    return removeMcpServer(name, deps);
+  }
   if (sub === "restart") {
     deps.renderer.writeWarning("mcp restart is only available in REPL mode.");
     return 0;
@@ -1910,6 +3027,70 @@ async function mcpCmd(args, deps) {
   deps.renderer.writeError(`Unknown mcp subcommand: ${sub}`);
   return 1;
 }
+async function addMcpServer(args, deps) {
+  const name = args[1];
+  const enable = args.includes("--enable") || args.includes("-e");
+  const builtIn = {
+    filesystem: { name: "filesystem", transport: "stdio", command: "npx", args: ["-y", "@modelcontextprotocol/server-filesystem", "."], permission: "confirm", description: "Read, write, and navigate the local filesystem" },
+    github: { name: "github", transport: "stdio", command: "npx", args: ["-y", "@modelcontextprotocol/server-github"], permission: "confirm", description: "GitHub API \u2014 issues, PRs, repos, search" },
+    "context7": { name: "context7", transport: "streamable-http", url: "https://server.context7.ai/mcp", permission: "confirm", description: "Codebase-aware documentation and Q&A" },
+    "brave-search": { name: "brave-search", transport: "stdio", command: "npx", args: ["-y", "@modelcontextprotocol/server-brave-search"], permission: "confirm", description: "Web search (Brave)" },
+    block: { name: "block", transport: "stdio", command: "npx", args: ["-y", "@modelcontextprotocol/server-block"], permission: "confirm", description: "Postgres database via SQL" },
+    everart: { name: "everart", transport: "stdio", command: "npx", args: ["-y", "@modelcontextprotocol/server-everart"], permission: "confirm", description: "AI image generation" },
+    slack: { name: "slack", transport: "stdio", command: "npx", args: ["-y", "@modelcontextprotocol/server-slack"], permission: "confirm", description: "Slack messaging & channels" },
+    aws: { name: "aws", transport: "stdio", command: "npx", args: ["-y", "@modelcontextprotocol/server-aws"], permission: "confirm", description: "AWS \u2014 EC2, S3, Lambda, IAM" },
+    "google-maps": { name: "google-maps", transport: "stdio", command: "npx", args: ["-y", "@modelcontextprotocol/server-google-maps"], permission: "confirm", description: "Google Maps \u2014 directions, geocoding, places" },
+    sentinel: { name: "sentinel", transport: "streamable-http", url: "https://mcp.sentinel.ai", permission: "deny", description: "Security vulnerability scanning" }
+  };
+  const factory = builtIn[name];
+  if (!factory) {
+    deps.renderer.writeError(`Unknown server "${name}". Run \`wstack mcp add\` without args to see available servers.
+`);
+    return 1;
+  }
+  const serverCfg = { ...factory };
+  if (!enable) serverCfg.enabled = false;
+  let existing = {};
+  try {
+    const raw = await fs6.readFile(deps.paths.globalConfig, "utf8");
+    existing = JSON.parse(raw);
+  } catch {
+  }
+  const mcpServers = existing.mcpServers ?? {};
+  if (mcpServers[name]) {
+    deps.renderer.writeWarning(`Server "${name}" already in config. Updating.
+`);
+  }
+  mcpServers[name] = serverCfg;
+  existing.mcpServers = mcpServers;
+  await atomicWrite(deps.paths.globalConfig, JSON.stringify(existing, null, 2));
+  const verb = enable ? "Enabled" : "Added (disabled \u2014 set enabled:true to activate)";
+  deps.renderer.writeInfo(`${verb} "${name}" (${serverCfg.transport}). Config written to ${deps.paths.globalConfig}.
+`);
+  return 0;
+}
+async function removeMcpServer(name, deps) {
+  let existing = {};
+  try {
+    const raw = await fs6.readFile(deps.paths.globalConfig, "utf8");
+    existing = JSON.parse(raw);
+  } catch {
+    deps.renderer.writeError("No config file found.\n");
+    return 1;
+  }
+  const mcpServers = existing.mcpServers ?? {};
+  if (!mcpServers[name]) {
+    deps.renderer.writeError(`Server "${name}" not in config.
+`);
+    return 1;
+  }
+  delete mcpServers[name];
+  existing.mcpServers = mcpServers;
+  await atomicWrite(deps.paths.globalConfig, JSON.stringify(existing, null, 2));
+  deps.renderer.writeInfo(`Removed "${name}" from config.
+`);
+  return 0;
+}
 async function pluginCmd(args, deps) {
   const sub = args[0];
   if (!sub || sub === "list") {
@@ -1934,7 +3115,7 @@ async function diagCmd(_args, deps) {
   const age = await deps.modelsRegistry.ageSeconds();
   const lines = [
     color.bold("WrongStack diagnostics"),
-    `  apiVersion:    0.0.1`,
+    `  apiVersion:    ${API_VERSION}`,
     `  cwd:           ${deps.cwd}`,
     `  projectRoot:   ${deps.projectRoot}`,
     `  projectHash:   ${deps.paths.projectHash}`,
@@ -1943,7 +3124,7 @@ async function diagCmd(_args, deps) {
     `  modelsCache:   ${deps.paths.modelsCache}`,
     `  cacheAge:      ${isFinite(age) ? `${Math.round(age / 60)}m` : "never"}`,
     `  node:          ${process.version}`,
-    `  os:            ${os2.platform()} ${os2.release()}`,
+    `  os:            ${os3.platform()} ${os3.release()}`,
     `  provider:      ${cfg.provider ?? "<unset>"}`,
     `  model:         ${cfg.model ?? "<unset>"}`,
     `  tools:         ${deps.toolRegistry?.list().length ?? 0}`,
@@ -1953,6 +3134,182 @@ async function diagCmd(_args, deps) {
   deps.renderer.write(lines.join("\n") + "\n");
   return 0;
 }
+async function doctorCmd(_args, deps) {
+  const checks = [];
+  const cfg = deps.config;
+  if (!cfg.provider) {
+    checks.push({ name: "provider", status: "fail", detail: "no provider configured \u2014 run `wstack init` or `wstack auth`" });
+  } else {
+    checks.push({ name: "provider", status: "ok", detail: cfg.provider });
+  }
+  if (!cfg.model) {
+    checks.push({ name: "model", status: "fail", detail: "no model configured \u2014 run `wstack init`" });
+  } else {
+    checks.push({ name: "model", status: "ok", detail: cfg.model });
+  }
+  if (cfg.provider) {
+    const providerCfg = cfg.providers?.[cfg.provider];
+    const hasVaultKey = typeof providerCfg?.apiKey === "string" && providerCfg.apiKey.length > 0;
+    const envHit = providerCfg?.envVars?.some((v) => process.env[v]) ?? false;
+    if (hasVaultKey || envHit) {
+      checks.push({
+        name: "api key",
+        status: "ok",
+        detail: hasVaultKey ? "found in vault" : "found in env"
+      });
+    } else {
+      checks.push({
+        name: "api key",
+        status: "fail",
+        detail: `no key for "${cfg.provider}" in vault or env \u2014 run \`wstack auth ${cfg.provider}\``
+      });
+    }
+  }
+  try {
+    const age = await deps.modelsRegistry.ageSeconds();
+    if (!isFinite(age)) {
+      checks.push({ name: "models cache", status: "warn", detail: "never fetched \u2014 run `wstack models refresh`" });
+    } else if (age > 7 * 24 * 3600) {
+      checks.push({
+        name: "models cache",
+        status: "warn",
+        detail: `${Math.round(age / 86400)} days old \u2014 run \`wstack models refresh\``
+      });
+    } else {
+      checks.push({ name: "models cache", status: "ok", detail: `${Math.round(age / 60)}m old` });
+    }
+  } catch (err) {
+    checks.push({
+      name: "models cache",
+      status: "warn",
+      detail: `read failed: ${err instanceof Error ? err.message : String(err)}`
+    });
+  }
+  try {
+    await fs6.access(deps.paths.secretsKey);
+    checks.push({ name: "secret vault", status: "ok", detail: deps.paths.secretsKey });
+  } catch {
+    checks.push({
+      name: "secret vault",
+      status: "warn",
+      detail: "not yet initialized (created lazily on first encrypt)"
+    });
+  }
+  try {
+    await fs6.mkdir(deps.paths.projectSessions, { recursive: true });
+    const probe = path5.join(deps.paths.projectSessions, `.probe-${Date.now()}`);
+    await fs6.writeFile(probe, "");
+    await fs6.unlink(probe);
+    checks.push({ name: "sessions writable", status: "ok", detail: deps.paths.projectSessions });
+  } catch (err) {
+    checks.push({
+      name: "sessions writable",
+      status: "fail",
+      detail: `cannot write to ${deps.paths.projectSessions}: ${err instanceof Error ? err.message : String(err)}`
+    });
+  }
+  const mcpEntries = Object.entries(cfg.mcpServers ?? {});
+  for (const [name, srv] of mcpEntries) {
+    if (!srv.enabled) continue;
+    if ((srv.transport === "sse" || srv.transport === "streamable-http") && !srv.url) {
+      checks.push({ name: `mcp:${name}`, status: "fail", detail: "transport requires url" });
+    } else if (srv.transport === "stdio" && !srv.command) {
+      checks.push({ name: `mcp:${name}`, status: "fail", detail: "stdio transport requires command" });
+    } else {
+      checks.push({ name: `mcp:${name}`, status: "ok", detail: `${srv.transport} ${srv.command ?? srv.url ?? ""}`.trim() });
+    }
+  }
+  const major = Number.parseInt(process.version.replace(/^v/, "").split(".")[0] ?? "0", 10);
+  if (major < 22) {
+    checks.push({ name: "node", status: "fail", detail: `${process.version} (need \u226522)` });
+  } else {
+    checks.push({ name: "node", status: "ok", detail: process.version });
+  }
+  deps.renderer.write(color.bold("WrongStack doctor\n\n"));
+  let failed = 0;
+  let warned = 0;
+  for (const c of checks) {
+    const icon = c.status === "ok" ? color.green("\u2713") : c.status === "warn" ? color.amber("\u25CF") : color.red("\u2717");
+    deps.renderer.write(`  ${icon} ${c.name.padEnd(20)} ${color.dim(c.detail)}
+`);
+    if (c.status === "fail") failed++;
+    if (c.status === "warn") warned++;
+  }
+  deps.renderer.write("\n");
+  if (failed > 0) {
+    deps.renderer.write(color.red(`${failed} failed, ${warned} warning${warned === 1 ? "" : "s"}
+`));
+    return 1;
+  }
+  if (warned > 0) {
+    deps.renderer.write(color.amber(`All checks passed (${warned} warning${warned === 1 ? "" : "s"})
+`));
+    return 0;
+  }
+  deps.renderer.write(color.green("All checks passed.\n"));
+  return 0;
+}
+async function exportCmd(args, deps) {
+  if (!deps.sessionStore) {
+    deps.renderer.writeError("No session store configured.");
+    return 1;
+  }
+  let format = "markdown";
+  let output;
+  let includeTools = true;
+  let includeDiagnostics = true;
+  let sessionId;
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--format" || a === "-f") {
+      const v = args[++i];
+      if (v !== "markdown" && v !== "json" && v !== "text") {
+        deps.renderer.writeError(`Unknown --format ${v}. Use markdown, json, or text.`);
+        return 1;
+      }
+      format = v;
+    } else if (a === "--out" || a === "-o") {
+      output = args[++i];
+    } else if (a === "--no-tools") {
+      includeTools = false;
+    } else if (a === "--no-diagnostics") {
+      includeDiagnostics = false;
+    } else if (a.startsWith("-")) {
+      deps.renderer.writeError(`Unknown flag: ${a}`);
+      return 1;
+    } else if (!sessionId) {
+      sessionId = a;
+    }
+  }
+  if (!sessionId) {
+    deps.renderer.writeError("Usage: wstack export <sessionId> [--format markdown|json|text] [--out <file>] [--no-tools] [--no-diagnostics]");
+    return 1;
+  }
+  const reader = new DefaultSessionReader({ store: deps.sessionStore });
+  let rendered;
+  try {
+    rendered = await reader.export(sessionId, {
+      format,
+      includeTools,
+      includeDiagnostics
+    });
+  } catch (err) {
+    deps.renderer.writeError(
+      `Export failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return 1;
+  }
+  if (output) {
+    await fs6.mkdir(path5.dirname(path5.resolve(deps.cwd, output)), { recursive: true });
+    await fs6.writeFile(path5.resolve(deps.cwd, output), rendered, "utf8");
+    deps.renderer.write(`Wrote ${rendered.length} bytes to ${output}
+`);
+  } else {
+    deps.renderer.write(rendered);
+    if (!rendered.endsWith("\n")) deps.renderer.write("\n");
+  }
+  return 0;
+}
 async function usageCmd(_args, deps) {
   if (!deps.sessionStore) return 0;
   const list = await deps.sessionStore.list(100);
@@ -1964,7 +3321,7 @@ async function usageCmd(_args, deps) {
 }
 async function versionCmd(_args, deps) {
   deps.renderer.write(
-    `WrongStack 0.0.1 (apiVersion 0.0.1, node ${process.version}, ${os2.platform()})
+    `WrongStack ${CLI_VERSION} (apiVersion ${API_VERSION}, node ${process.version}, ${os3.platform()})
 `
   );
   return 0;
@@ -1978,7 +3335,8 @@ async function helpCmd(_args, deps) {
     "  wstack resume [<id>]         Resume a session",
     "  wstack sessions              List recent sessions",
     "  wstack init                  Pick provider + model from models.dev",
-    "  wstack auth <provider>       Store API key (encrypted at rest)",
+    "  wstack auth                  Interactive key manager (list/add/update/delete)",
+    "  wstack auth <provider>       Append one key for a provider (encrypted at rest)",
     "  wstack resume <id>           Resume a session (loads transcript + appends)",
     "  wstack config [show|edit]    Show or edit effective config",
     "  wstack tools                 List registered tools",
@@ -1990,6 +3348,8 @@ async function helpCmd(_args, deps) {
     "  wstack plugin [list]         List plugins",
     "  wstack projects              List projects tracked in ~/.wrongstack/projects/",
     "  wstack diag                  Full diagnostics",
+    "  wstack doctor                Health checks (config, keys, MCP, node)",
+    "  wstack export <id> [opts]    Render a session (--format markdown|json|text, --out <file>)",
     "  wstack usage                 Token + cost summary",
     "  wstack version               Print version",
     "",
@@ -2000,9 +3360,9 @@ async function helpCmd(_args, deps) {
   return 0;
 }
 async function projectsCmd(_args, deps) {
-  const projectsRoot = path2.join(deps.paths.globalRoot, "projects");
+  const projectsRoot = path5.join(deps.paths.globalRoot, "projects");
   try {
-    const entries = await fs2.readdir(projectsRoot);
+    const entries = await fs6.readdir(projectsRoot);
     if (entries.length === 0) {
       deps.renderer.write("No projects tracked.\n");
       return 0;
@@ -2010,7 +3370,7 @@ async function projectsCmd(_args, deps) {
     for (const hash of entries) {
       try {
         const meta = JSON.parse(
-          await fs2.readFile(path2.join(projectsRoot, hash, "meta.json"), "utf8")
+          await fs6.readFile(path5.join(projectsRoot, hash, "meta.json"), "utf8")
         );
         deps.renderer.write(
           `  ${color.dim(hash)}  ${color.dim(meta.lastSeen ?? "")}  ${meta.root ?? "?"}
@@ -2057,7 +3417,8 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "no-alt-screen",
   "alt-screen",
   "output-json",
-  "prompt"
+  "prompt",
+  "metrics"
 ]);
 function parseArgs(argv) {
   const flags = {};
@@ -2095,96 +3456,32 @@ function parseArgs(argv) {
   }
   return { flags, positional };
 }
-function flagsToConfigPatch(flags) {
-  const patch = {};
-  if (typeof flags["provider"] === "string") patch.provider = flags["provider"];
-  if (typeof flags["model"] === "string") patch.model = flags["model"];
-  if (typeof flags["cwd"] === "string") patch.cwd = flags["cwd"];
-  if (typeof flags["log-level"] === "string") {
-    patch.log = { level: flags["log-level"] };
-  } else if (flags["verbose"]) {
-    patch.log = { level: "debug" };
-  } else if (flags["trace"]) {
-    patch.log = { level: "trace" };
-  }
-  if (flags["yolo"]) patch.yolo = true;
-  if (flags["no-features"]) {
-    patch.features = {
-      mcp: false,
-      plugins: false,
-      memory: false,
-      modelsRegistry: false,
-      skills: false
-    };
-  }
-  return patch;
-}
 function resolveBundledSkillsDir() {
   try {
-    const req = createRequire(import.meta.url);
-    const corePkg = req.resolve("@wrongstack/core/package.json");
-    return path2.join(path2.dirname(corePkg), "skills");
+    const req2 = createRequire(import.meta.url);
+    const corePkg = req2.resolve("@wrongstack/core/package.json");
+    return path5.join(path5.dirname(corePkg), "skills");
   } catch {
     return void 0;
   }
 }
-function readOwnVersion() {
-  const req = createRequire(import.meta.url);
-  const candidates = ["../package.json", "../../package.json"];
-  for (const rel of candidates) {
-    try {
-      const pkg = req(rel);
-      if (typeof pkg.version === "string" && pkg.version.length > 0) return pkg.version;
-    } catch {
-    }
-  }
-  return "dev";
-}
-var CLI_VERSION = readOwnVersion();
-async function ensureProjectMeta(paths, projectRoot) {
-  try {
-    await fs2.mkdir(paths.projectDir, { recursive: true });
-    const meta = {
-      hash: paths.projectHash,
-      root: projectRoot,
-      lastSeen: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    await fs2.writeFile(paths.projectMeta, JSON.stringify(meta, null, 2));
-  } catch {
-  }
-}
 async function main(argv) {
   const { flags, positional } = parseArgs(argv);
-  const cwd = typeof flags["cwd"] === "string" ? path2.resolve(flags["cwd"]) : process.cwd();
-  const pathResolver = new DefaultPathResolver(cwd);
-  const projectRoot = pathResolver.projectRoot;
-  const userHome = os2.homedir();
-  const wpaths = resolveWstackPaths({ projectRoot, userHome });
-  await ensureProjectMeta(wpaths, projectRoot);
   if (positional[0] === "resume" && positional[1] && !subcommands["__noop_resume_marker"]) {
     flags["resume"] = positional[1];
     positional.splice(0, 2);
   }
-  const vault = new DefaultSecretVault({ keyFile: wpaths.secretsKey });
-  for (const file of [wpaths.globalConfig, wpaths.projectLocalConfig]) {
-    try {
-      const { migrated } = await migratePlaintextSecrets(file, vault);
-      if (migrated > 0) {
-        process.stderr.write(`[wstack] Encrypted ${migrated} plaintext secret(s) in ${file}
-`);
-      }
-    } catch {
-    }
-  }
-  const configLoader = new DefaultConfigLoader({ paths: wpaths, vault });
-  let config;
+  let boot;
   try {
-    config = await configLoader.load({ cliFlags: flagsToConfigPatch(flags) });
+    boot = await bootConfig(flags);
   } catch (err) {
     process.stderr.write(`Config error: ${err instanceof Error ? err.message : String(err)}
 `);
     return 2;
   }
+  const { paths, config: _config, vault } = boot;
+  let config = _config;
+  const { cwd, projectRoot, userHome, wpaths, pathResolver } = paths;
   const logger = new DefaultLogger({
     level: config.log.level,
     file: wpaths.logFile
@@ -2251,7 +3548,7 @@ async function main(argv) {
       } else {
         const prevProvider = config.provider;
         const prevModel = config.model;
-        config = Object.freeze({ ...config, provider: picked.provider, model: picked.model });
+        config = patchConfig(config, { provider: picked.provider, model: picked.model });
         if (picked.provider !== prevProvider || picked.model !== prevModel) {
           const saved = await saveToGlobalConfig(
             wpaths.globalConfig,
@@ -2286,15 +3583,21 @@ async function main(argv) {
       flags["no-tui"] = true;
     }
     if (choices.yolo !== config.yolo) {
-      config = Object.freeze({ ...config, yolo: choices.yolo });
+      config = patchConfig(config, { yolo: choices.yolo });
     }
   }
-  const resolvedProvider = await modelsRegistry.getProvider(config.provider).catch(() => void 0);
+  const savedProviderCfg = config.providers?.[config.provider];
+  let resolvedProvider = await modelsRegistry.getProvider(config.provider).catch(() => void 0);
+  if (!resolvedProvider && savedProviderCfg?.type && savedProviderCfg.type !== config.provider) {
+    resolvedProvider = await modelsRegistry.getProvider(savedProviderCfg.type).catch(() => void 0);
+  }
   if (!resolvedProvider) {
-    logger.warn(
-      `Provider "${config.provider}" not found in models.dev. Continuing with raw config.`
-    );
-  } else if (resolvedProvider.family === "unsupported") {
+    if (!savedProviderCfg?.family) {
+      logger.warn(
+        `Provider "${config.provider}" not found in models.dev. Continuing with raw config.`
+      );
+    }
+  } else if (resolvedProvider.family === "unsupported" && !savedProviderCfg?.family) {
     process.stderr.write(
       `Provider "${config.provider}" uses an unsupported wire family (${resolvedProvider.npm}). Install a plugin to enable it, or pick a different provider.
 `
@@ -2303,6 +3606,8 @@ async function main(argv) {
     return 2;
   }
   const container = new Container();
+  const configStore = new DefaultConfigStore(config);
+  container.bind(TOKENS.ConfigStore, () => configStore);
   container.bind(TOKENS.Logger, () => logger);
   container.bind(TOKENS.PathResolver, () => pathResolver);
   container.bind(TOKENS.SecretScrubber, () => new DefaultSecretScrubber());
@@ -2377,6 +3682,68 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
   }
   const events = new EventBus();
   events.setLogger(logger);
+  let metricsSink;
+  let healthRegistry;
+  let metricsServerHandle;
+  const metricsPortFlag = flags["metrics-port"];
+  const metricsPort = typeof metricsPortFlag === "string" && metricsPortFlag.length > 0 ? Number.parseInt(metricsPortFlag, 10) : void 0;
+  if (metricsPort !== void 0 && !flags.metrics) flags.metrics = true;
+  if (flags.metrics) {
+    metricsSink = new InMemoryMetricsSink();
+    wireMetricsToEvents(events, metricsSink);
+    healthRegistry = new DefaultHealthRegistry();
+    healthRegistry.register({
+      name: "session-store",
+      check: async () => {
+        try {
+          await fs6.access(wpaths.projectSessions);
+          return { status: "healthy" };
+        } catch (e) {
+          return { status: "unhealthy", detail: e instanceof Error ? e.message : "access denied" };
+        }
+      }
+    });
+    healthRegistry.register({
+      name: "provider",
+      check: async () => ({
+        status: "healthy",
+        data: { id: config.provider, model: config.model }
+      })
+    });
+    const dumpMetrics = () => {
+      if (!metricsSink) return;
+      try {
+        const out = path5.join(wpaths.projectSessions, "metrics.json");
+        const snap = metricsSink.snapshot();
+        writeFileSync(out, JSON.stringify(snap, null, 2));
+      } catch {
+      }
+    };
+    process.on("exit", dumpMetrics);
+    process.on("SIGINT", () => {
+      dumpMetrics();
+      process.exit(130);
+    });
+    if (metricsPort !== void 0 && Number.isFinite(metricsPort)) {
+      try {
+        metricsServerHandle = await startMetricsServer({
+          port: metricsPort,
+          host: process.env.METRICS_HOST ?? "127.0.0.1",
+          sink: metricsSink,
+          // V2-C: mount /healthz on the same listener so k8s probes can
+          // hit one endpoint per pod for both observability and liveness.
+          healthRegistry
+        });
+        logger.info(`metrics endpoint listening on ${metricsServerHandle.url} (healthz on same port)`);
+        process.on("exit", () => {
+          void metricsServerHandle?.close().catch(() => {
+          });
+        });
+      } catch (err) {
+        logger.warn(`metrics endpoint failed to start: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  }
   const spinner = new Spinner();
   let lastInputTokens = 0;
   events.on("provider.response", (e) => {
@@ -2434,13 +3801,11 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
   };
   let provider;
   try {
-    if (config.features.modelsRegistry) {
-      provider = providerRegistry.create({ ...providerConfig, type: config.provider });
+    const cfgWithType = { ...providerConfig, type: config.provider };
+    if (config.features.modelsRegistry && providerRegistry.has(config.provider)) {
+      provider = providerRegistry.create(cfgWithType);
     } else {
-      provider = makeProviderFromConfig(config.provider, {
-        ...providerConfig,
-        type: config.provider
-      });
+      provider = makeProviderFromConfig(config.provider, cfgWithType);
     }
   } catch (err) {
     process.stderr.write(
@@ -2505,13 +3870,21 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
   }
   await recoveryLock.write(session.id).catch(() => void 0);
   const attachments = new DefaultAttachmentStore({
-    spoolDir: path2.join(wpaths.projectSessions, session.id, "attachments")
+    spoolDir: path5.join(wpaths.projectSessions, session.id, "attachments")
   });
   const queueStore = new QueueStore({
-    dir: path2.join(wpaths.projectSessions, session.id)
+    dir: path5.join(wpaths.projectSessions, session.id)
   });
   const tokenCounter = container.resolve(TOKENS.TokenCounter);
   const stats = new SessionStats(events, tokenCounter);
+  const errorRing = [];
+  events.on("error", (e) => {
+    const err = e.err;
+    const code2 = err && typeof err === "object" && "code" in err && typeof err.code === "string" ? err.code : "UNKNOWN";
+    const message = e.err instanceof Error ? e.err.message : String(e.err);
+    errorRing.push({ ts: (/* @__PURE__ */ new Date()).toISOString(), phase: e.phase, code: code2, message });
+    if (errorRing.length > 5) errorRing.shift();
+  });
   const ctxSignal = new AbortController().signal;
   const context = new Context({
     systemPrompt,
@@ -2527,6 +3900,26 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
     context.messages.push(...restoredMessages);
   }
   const pipelines = createDefaultPipelines();
+  const installBoundary = (p) => {
+    p.setErrorHandler((ev) => {
+      const fromPlugin = !!ev.owner && ev.owner !== "core";
+      logger.error(
+        `Pipeline middleware "${ev.middleware}" crashed (owner=${ev.owner ?? "unknown"}); ${fromPlugin ? "swallowed" : "rethrown"}`,
+        ev.err
+      );
+      events.emit("error", {
+        err: ev.err instanceof Error ? ev.err : new Error(String(ev.err)),
+        phase: `pipeline:${ev.middleware}`
+      });
+      return fromPlugin ? "swallow" : "rethrow";
+    });
+  };
+  installBoundary(pipelines.request);
+  installBoundary(pipelines.response);
+  installBoundary(pipelines.toolCall);
+  installBoundary(pipelines.userInput);
+  installBoundary(pipelines.assistantOutput);
+  installBoundary(pipelines.contextWindow);
   const compactor = container.resolve(TOKENS.Compactor);
   const resolvedCaps = await capabilitiesFor(modelsRegistry, config.provider, context.model).catch(
     () => void 0
@@ -2581,7 +3974,8 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
     maxIterations: config.tools.maxIterations,
     iterationTimeoutMs: config.tools.iterationTimeoutMs,
     executionStrategy: config.tools.defaultExecutionStrategy,
-    perIterationOutputCapBytes: config.tools.perIterationOutputCapBytes
+    perIterationOutputCapBytes: config.tools.perIterationOutputCapBytes,
+    confirmAwaiter: makeConfirmAwaiter(reader)
   });
   const mcpRegistry = new MCPRegistry({ toolRegistry, events, log: logger });
   if (config.features.mcp) {
@@ -2609,6 +4003,11 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
       const { default: createApi2 } = await Promise.resolve().then(() => (init_plugin_api_factory(), plugin_api_factory_exports));
       await loadPlugins(resolvedPlugins, {
         log: logger,
+        // Each plugin's `configSchema` is validated against the matching
+        // `Config.extensions[name]` subtree before its `setup()` runs.
+        // The plugin then reads the same data through `api.config.extensions`
+        // (or, once L1-B lands, via `ConfigStore.getExtension(name)`).
+        pluginOptions: config.extensions ?? {},
         apiFactory: (plugin) => createApi2(plugin.name, {
           container,
           events,
@@ -2623,6 +4022,73 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
       });
     }
   }
+  const buildPickableProviders = async () => {
+    const overlay = config.providers ?? {};
+    let catalog = [];
+    try {
+      catalog = await modelsRegistry.listProviders();
+    } catch {
+    }
+    const catalogById = new Map(catalog.map((p) => [p.id, p]));
+    const hasKey = (id) => {
+      const entry = overlay[id];
+      const envHit = catalogById.get(id)?.envVars.some((v) => !!process.env[v]);
+      if (envHit) return true;
+      if (!entry) return false;
+      if (typeof entry.apiKey === "string" && entry.apiKey.length > 0) return true;
+      if (Array.isArray(entry.apiKeys) && entry.apiKeys.some((k) => k?.apiKey)) return true;
+      return false;
+    };
+    const seen = /* @__PURE__ */ new Set();
+    const out = [];
+    for (const [id, cfg] of Object.entries(overlay)) {
+      if (!hasKey(id)) continue;
+      seen.add(id);
+      const catalogType = cfg.type && cfg.type !== id ? cfg.type : id;
+      const inherited = catalogById.get(catalogType);
+      const family = cfg.family ?? inherited?.family ?? "unsupported";
+      if (family === "unsupported") continue;
+      const models = cfg.models && cfg.models.length > 0 ? [...cfg.models] : (inherited?.models ?? []).map((m) => m.id);
+      out.push({ id, family, models });
+    }
+    for (const p of catalog) {
+      if (seen.has(p.id)) continue;
+      if (p.family === "unsupported") continue;
+      if (!hasKey(p.id)) continue;
+      out.push({ id: p.id, family: p.family, models: p.models.map((m) => m.id) });
+    }
+    return out;
+  };
+  const switchProviderAndModel = (providerId, modelId) => {
+    try {
+      const newCfg = config.providers?.[providerId] ?? {
+        type: providerId,
+        apiKey: config.apiKey,
+        baseUrl: config.baseUrl
+      };
+      const cfgWithType = { ...newCfg, type: providerId };
+      const newProvider = config.features.modelsRegistry && providerRegistry.has(providerId) ? providerRegistry.create(cfgWithType) : makeProviderFromConfig(providerId, cfgWithType);
+      context.provider = newProvider;
+      context.model = modelId;
+      config = patchConfig(config, { provider: providerId, model: modelId });
+      configStore.update({ provider: providerId, model: modelId });
+      return null;
+    } catch (err) {
+      return err instanceof Error ? err.message : String(err);
+    }
+  };
+  const multiAgentHost = new MultiAgentHost({
+    container,
+    toolRegistry,
+    providerRegistry,
+    configStore,
+    events,
+    systemPromptBuilder: promptBuilder,
+    session,
+    tokenCounter,
+    projectRoot,
+    cwd
+  });
   const slashCmds = buildBuiltinSlashCommands({
     registry: slashRegistry,
     toolRegistry,
@@ -2633,53 +4099,56 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
     renderer,
     memoryStore,
     context,
+    metricsSink,
+    healthRegistry,
+    onSpawn: async (description) => {
+      const { subagentId, taskId } = await multiAgentHost.spawn(description);
+      return `Spawned subagent ${subagentId} for task ${taskId}. Use /agents to track progress.`;
+    },
+    onAgents: () => {
+      const s = multiAgentHost.status();
+      const lines = [s.summary];
+      for (const p of s.pending) {
+        lines.push(`  pending  ${p.taskId.slice(0, 8)} \u2192 ${p.description.slice(0, 60)}`);
+      }
+      for (const r of s.completed) {
+        lines.push(
+          `  ${r.status === "success" ? color.green("\u2713") : color.red("\u2717")}        ${r.taskId.slice(0, 8)} ${r.iterations}it ${r.toolCalls}tc ${r.durationMs}ms`
+        );
+      }
+      return lines.join("\n");
+    },
     onExit: () => {
       void mcpRegistry.stopAll();
     },
     onClear: () => {
+      if (flags.tui && !flags["no-tui"]) return;
       try {
         process.stdout.write("\x1B[2J\x1B[3J\x1B[H");
       } catch {
       }
     },
-    onSwitchModel: (name) => {
-      context.model = name;
-    },
-    onSwitchProvider: (name) => {
-      try {
-        const newCfg = config.providers?.[name] ?? {
-          type: name,
-          apiKey: config.apiKey,
-          baseUrl: config.baseUrl
-        };
-        const newProvider = providerRegistry.create({ ...newCfg, type: name });
-        context.provider = newProvider;
-        config = Object.freeze({ ...config, provider: name });
-      } catch (err) {
-        renderer.writeError(
-          `Cannot switch to "${name}": ${err instanceof Error ? err.message : err}`
-        );
-      }
-    },
     onDiag: () => {
       const u = tokenCounter.total();
       const cost = tokenCounter.estimateCost();
-      renderer.write(
-        [
-          `${color.bold("WrongStack diag")}`,
-          `  provider:     ${config.provider} / ${context.model}`,
-          `  projectRoot:  ${projectRoot}`,
-          `  tokens:       in ${u.input}  out ${u.output}  cacheR ${u.cacheRead ?? 0}`,
-          `  cost:         $${cost.total.toFixed(4)}`,
-          `  tools:        ${toolRegistry.list().length}`,
-          `  mcpServers:   ${mcpRegistry.list().length}`,
-          ""
-        ].join("\n")
-      );
+      const errSection = errorRing.length === 0 ? [] : [
+        "",
+        `${color.bold("Recent errors")} (last ${errorRing.length}):`,
+        ...errorRing.map((e) => `  [${e.ts}] ${e.phase} ${e.code} \u2014 ${e.message}`)
+      ];
+      const liveCfg = configStore.get();
+      return [
+        `${color.bold("WrongStack diag")}`,
+        `  provider:     ${liveCfg.provider} / ${context.model}`,
+        `  projectRoot:  ${projectRoot}`,
+        `  tokens:       in ${u.input}  out ${u.output}  cacheR ${u.cacheRead ?? 0}`,
+        `  cost:         $${cost.total.toFixed(4)}`,
+        `  tools:        ${toolRegistry.list().length}`,
+        `  mcpServers:   ${mcpRegistry.list().length}`,
+        ...errSection
+      ].join("\n");
     },
-    onStats: () => {
-      stats.render(renderer);
-    }
+    onStats: () => stats.format()
   });
   for (const cmd of slashCmds) slashRegistry.register(cmd);
   let code = 0;
@@ -2715,16 +4184,27 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
         const json = JSON.stringify({
           status: result.status,
           finalText: result.finalText ?? null,
-          error: result.error instanceof Error ? result.error.message : result.error ?? null,
+          error: result.error ? {
+            code: result.error.code,
+            subsystem: result.error.subsystem,
+            severity: result.error.severity,
+            recoverable: result.error.recoverable,
+            message: result.error.message,
+            context: result.error.context ?? null
+          } : null,
           usage
         });
         process.stdout.write(json + "\n");
       } else {
         if (result.status === "failed") {
           code = 1;
-          renderer.writeError(
-            "Failed: " + (result.error instanceof Error ? result.error.message : String(result.error))
-          );
+          const err = result.error;
+          if (err) {
+            const tag = err.recoverable ? " (recoverable)" : "";
+            renderer.writeError(`Failed [${err.severity}]${tag}: ${err.describe()}`);
+          } else {
+            renderer.writeError("Failed.");
+          }
         } else if (result.status === "aborted") {
           code = 130;
           renderer.writeWarning("Aborted.");
@@ -2735,13 +4215,16 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
         if (result.finalText) renderer.write("\n" + result.finalText + "\n");
         renderer.write(
           "\n" + color.dim(
-            `[in: ${fmtTok4(usage.input)}  out: ${fmtTok4(usage.output)}  iters: ${usage.iterations}  cost: ${usage.cost.toFixed(4)}  ${(usage.elapsedMs / 1e3).toFixed(1)}s]`
+            `[in: ${fmtTok(usage.input)}  out: ${fmtTok(usage.output)}  iters: ${usage.iterations}  cost: ${usage.cost.toFixed(4)}  ${(usage.elapsedMs / 1e3).toFixed(1)}s]`
           ) + "\n"
         );
       }
     } else if (flags.tui && !flags["no-tui"]) {
       const { runTui } = await import('@wrongstack/tui');
       renderer.setSilent(true);
+      const banneredFamily = savedProviderCfg?.family ?? resolvedProvider?.family;
+      const banneredKey = savedProviderCfg?.apiKey ?? config.apiKey ?? (resolvedProvider?.envVars ?? savedProviderCfg?.envVars ?? []).map((v) => process.env[v]).find((v) => !!v);
+      const banneredKeyTail = banneredKey && banneredKey.length >= 3 ? banneredKey.slice(-3) : void 0;
       try {
         code = await runTui({
           agent,
@@ -2755,6 +4238,10 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
           yolo: !!config.yolo,
           appVersion: CLI_VERSION,
           provider: config.provider,
+          family: banneredFamily,
+          keyTail: banneredKeyTail,
+          getPickableProviders: buildPickableProviders,
+          switchProviderAndModel,
           effectiveMaxContext,
           // Opt-in: alt-screen disables the terminal's native scrollback,
           // so we default to false. `--no-alt-screen` is kept as a no-op
@@ -2828,11 +4315,6 @@ async function promptRecovery(reader, renderer, abandoned, autoRecover) {
   );
   return answer;
 }
-function fmtTok4(n) {
-  if (n < 1e3) return String(n);
-  if (n < 1e6) return `${(n / 1e3).toFixed(n < 1e4 ? 1 : 0)}k`;
-  return `${(n / 1e6).toFixed(1)}M`;
-}
 var isMain = import.meta.url === `file://${process.argv[1]?.replace(/\\/g, "/")}` || process.argv[1]?.endsWith("/cli/dist/index.js") || process.argv[1]?.endsWith("\\cli\\dist\\index.js");
 if (isMain) {
   main(process.argv.slice(2)).then(
@@ -2848,6 +4330,6 @@ if (isMain) {
   );
 }
 
-export { main };
+export { CLI_VERSION, main };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map