@wrongstack/cli 0.273.0 → 0.274.0

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
-import { color, writeErr, loadPlugins, renderProgress, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, expectDefined, DefaultTaskStore, TaskTracker, renderTaskGraph, withFileLock, resolveHqDataDir, ensureHqFirstRunAuthFile, DEFAULT_HQ_REDACTION_POLICY, watchHqAuthFile, parseHqFrame, HQ_PROTOCOL_VERSION, parseHqEventPayload, scrubAndTruncateHqPreview, DefaultSecretScrubber, resolveWstackPaths, projectHash, wstackGlobalRoot, TOKENS, ToolRegistry, GlobalMailbox, resolveSessionLoggingConfig, createSessionEventBridge, HookRegistry, HookRunner, normalizeTokenSavingTier, SlashCommandRegistry, attachDepWatcherBridge, createFallbackModelExtension, SessionMemoryConsolidator, BrainDecisionQueue, ObservableBrainArbiter, HumanEscalatingBrainArbiter, createTieredBrainArbiter, DefaultBrainArbiter, BrainMonitor, mailboxSessionTag, createDelegateTool, FLEET_ROSTER, createMcpControlTool, startTechStackConsumer, startPackageOutdatedWatcher, SddRunRegistry, recordFileAction, createAutonomyBrain, DefaultPluginAPI, SpecVersioning, buildTranscriptFromEvents, DEFAULT_CONTEXT_WINDOW_MODE_ID, resolveProjectDir, recentTextTurns, gatedEnhancerReasoning, enhanceUserPrompt, projectSlug, DefaultSystemPromptBuilder, mutateTasks, loadTasks, resolveContextWindowPolicy, repairToolUseAdjacency, mutatePlan, setPlanItemStatus, getPlanTemplate, loadPlan, emptyPlan, addPlanItem, savePlan, resolveProviderModelList, DefaultLogger, DefaultModelsRegistry, isStdinTTY, atomicWrite, DefaultPathResolver, EventBus, runProviderWithRetry, ReplayLogStore, ReplayProviderRunner, mergeCustomModelDefs, makeAutonomyPromptContributor, createContextManagerTool, makeMailboxTool, makeMailSendTool, makeMailInboxTool, applyToolDescriptionModes, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, createHqPublisherFromEnv, DEFAULT_SESSION_PRUNE_DAYS, RecoveryLock, DefaultAttachmentStore, Context, QueueStore, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, createDefaultPipelines, applyModelRuntime, resolveAuditLevel, AutoCompactionMiddleware, estimateRequestTokensCalibrated, Agent, FleetManager, makeDirectorSessionFactory, Director, makeFleetEmitTool, AdaptiveConcurrencyController, resolveModelMatrix, DEFAULT_SUBAGENT_BASELINE, AutoApprovePermissionPolicy, WIDE_SUBAGENT_CAPABILITIES, PhaseStore, AutoPhasePlanner, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, assignNickname, makeLLMClassifier, writeOut, ParallelEternalEngine, EternalAutonomyEngine, allServers as allServers$1, CHIMERA_REVIEW_PROMPT, setQueuedMessagesSnapshot, DefaultSessionRewinder, bootConfig as bootConfig$1, setOutputLineGuard, setRawMode, DefaultSessionReader, ToolAuditLog, DefaultSessionStore as DefaultSessionStore$1, ProviderRegistry, makeAgentSubagentRunner, NULL_FLEET_BUS, buildChildEnv, formatContextWindowModeList, getContextWindowMode, AGENT_CATALOG, dispatchAgent, normalizeToolDescriptionMode, setToolDescriptionMode, getToolDescriptionMode, noOpVault, formatTodosList, formatTaskList, formatTaskProgress, formatPlan, SessionRecovery, loadGoal, goalFilePath, summarizeUsage, saveGoal, formatGoal, emptyGoal, buildGoalPreamble, pendingBtwCount, setBtwNote, readHqRuntimeFileSync, resolveHqConfig, MATRIX_PHASE_KEYS, matrixKeyKind, phaseForRole, onResize, InputBuilder, DefaultSecretVault, decryptConfigSecrets as decryptConfigSecrets$1, encryptConfigSecrets as encryptConfigSecrets$1, HQ_AUTH_FILE_VERSION, FsError, ERROR_CODES, truncate, estimateMessageTokens, AGENTS_BY_PHASE, validateAgainstSchema, ConfigError, resolveMailboxIdentity, smartDefaultFallbackChain, AutonomousCoordinator, mutateHqAuthFile, mintHqToken, readHqAuthFile, DefaultTokenCounter, isSecretField as isSecretField$1, startSessionTelemetryBridge } from '@wrongstack/core';
+import { color, CODEX_MODELS, writeErr, loadPlugins, renderProgress, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, expectDefined, DefaultTaskStore, TaskTracker, renderTaskGraph, withFileLock, resolveHqDataDir, ensureHqFirstRunAuthFile, DEFAULT_HQ_REDACTION_POLICY, watchHqAuthFile, parseHqFrame, HQ_PROTOCOL_VERSION, parseHqEventPayload, scrubAndTruncateHqPreview, DefaultSecretScrubber, resolveWstackPaths, projectHash, wstackGlobalRoot, TOKENS, ToolRegistry, GlobalMailbox, resolveSessionLoggingConfig, createSessionEventBridge, HookRegistry, HookRunner, normalizeTokenSavingTier, SlashCommandRegistry, attachDepWatcherBridge, createFallbackModelExtension, SessionMemoryConsolidator, BrainDecisionQueue, ObservableBrainArbiter, HumanEscalatingBrainArbiter, createTieredBrainArbiter, DefaultBrainArbiter, BrainMonitor, mailboxSessionTag, createDelegateTool, FLEET_ROSTER, createMcpControlTool, startTechStackConsumer, startPackageOutdatedWatcher, SddRunRegistry, recordFileAction, createAutonomyBrain, DefaultPluginAPI, SpecVersioning, buildTranscriptFromEvents, DEFAULT_CONTEXT_WINDOW_MODE_ID, resolveProjectDir, DefaultLogger, DefaultModelsRegistry, isStdinTTY, atomicWrite, DefaultPathResolver, EventBus, runProviderWithRetry, ReplayLogStore, ReplayProviderRunner, mergeCustomModelDefs, DefaultSystemPromptBuilder, makeAutonomyPromptContributor, createContextManagerTool, makeMailboxTool, makeMailSendTool, makeMailInboxTool, applyToolDescriptionModes, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, createHqPublisherFromEnv, DEFAULT_SESSION_PRUNE_DAYS, RecoveryLock, DefaultAttachmentStore, Context, QueueStore, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, loadPlan, createDefaultPipelines, applyModelRuntime, resolveContextWindowPolicy, resolveAuditLevel, AutoCompactionMiddleware, estimateRequestTokensCalibrated, Agent, FleetManager, makeDirectorSessionFactory, Director, makeFleetEmitTool, AdaptiveConcurrencyController, resolveModelMatrix, DEFAULT_SUBAGENT_BASELINE, DefaultTokenCounter, AutoApprovePermissionPolicy, WIDE_SUBAGENT_CAPABILITIES, PhaseStore, AutoPhasePlanner, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, assignNickname, makeLLMClassifier, writeOut, ParallelEternalEngine, EternalAutonomyEngine, allServers as allServers$1, CHIMERA_REVIEW_PROMPT, setQueuedMessagesSnapshot, projectSlug, recentTextTurns, gatedEnhancerReasoning, enhanceUserPrompt, repairToolUseAdjacency, mutateTasks, loadTasks, mutatePlan, setPlanItemStatus, getPlanTemplate, emptyPlan, addPlanItem, savePlan, resolveProviderModelList, bootConfig as bootConfig$1, setOutputLineGuard, setRawMode, DefaultSessionReader, ToolAuditLog, DefaultSessionRewinder, DefaultSessionStore as DefaultSessionStore$1, ProviderRegistry, makeAgentSubagentRunner, NULL_FLEET_BUS, FsError, ERROR_CODES, buildChildEnv, formatContextWindowModeList, getContextWindowMode, AGENT_CATALOG, dispatchAgent, normalizeToolDescriptionMode, setToolDescriptionMode, getToolDescriptionMode, noOpVault, formatTodosList, formatTaskList, formatTaskProgress, formatPlan, SessionRecovery, loadGoal, goalFilePath, summarizeUsage, saveGoal, formatGoal, emptyGoal, buildGoalPreamble, pendingBtwCount, setBtwNote, readHqRuntimeFileSync, resolveHqConfig, MATRIX_PHASE_KEYS, matrixKeyKind, phaseForRole, onResize, InputBuilder, DefaultSecretVault, decryptConfigSecrets as decryptConfigSecrets$1, encryptConfigSecrets as encryptConfigSecrets$1, HQ_AUTH_FILE_VERSION, truncate, estimateMessageTokens, AGENTS_BY_PHASE, validateAgainstSchema, ConfigError, resolveMailboxIdentity, smartDefaultFallbackChain, AutonomousCoordinator, mutateHqAuthFile, mintHqToken, readHqAuthFile, isSecretField as isSecretField$1, startSessionTelemetryBridge } from '@wrongstack/core';
 import * as fs4 from 'fs/promises';
+import { access, readFile } from 'fs/promises';
 import { decryptConfigSecrets, encryptConfigSecrets, DefaultSecretVault as DefaultSecretVault$1, isSecretField } from '@wrongstack/core/security';
 import * as path4 from 'path';
 import { join } from 'path';
@@ -12,14 +13,14 @@ import * as os7 from 'os';
 import os7__default from 'os';
 import { WebSocketServer, WebSocket } from 'ws';
 import { createRequire } from 'module';
-import { findFreePort, AutoPhaseWebSocketHandler, WorktreeWebSocketHandler, SpecsWebSocketHandler, SddBoardWebSocketHandler, SddWizardWebSocketHandler, buildSddWizardDeps, generateAuthToken, verifyClient, handleGitInfo, handleShellOpen, handleGitDiff, handleGitChanges, handleSkillsExport, handleSkillsEdit, handleSkillsCreate, handleSkillsUpdate, handleSkillsUninstall, handleSkillsInstall, handleSkillsContent, handleMcpRestart, handleMcpDisable, handleMcpEnable, handleMcpDiscover, handleMcpSleep, handleMcpWake, handleMcpUpdate, handleMcpRemove, handleMcpAdd, handleMcpList, handleMemoryForget, handleMemoryRemember, handleMemoryList, handleCompletionRequest, createToolLspCompletionSource, handleFilesWrite, handleFilesRead, handleFilesTree, handleFilesList, createEternalSubscription, createHttpServer, registerInstance, openBrowser as openBrowser$1, unregisterInstance, estimateTokens as estimateTokens$1, stringifyContent, messagePreview, messageTokens, createCustomModeStore } from '@wrongstack/webui/server';
+import { envFlag, findFreePort, AutoPhaseWebSocketHandler, WorktreeWebSocketHandler, SpecsWebSocketHandler, SddBoardWebSocketHandler, SddWizardWebSocketHandler, buildSddWizardDeps, resolveAuthToken, buildWebUIAccessUrl, verifyClient, createEternalSubscription, handleShellOpen, handleGitInfo, handleGitDiff, handleGitChanges, handleSkillsExport, handleSkillsEdit, handleSkillsCreate, handleSkillsUpdate, handleSkillsUninstall, handleSkillsInstall, handleSkillsContent, handleMcpRestart, handleMcpDisable, handleMcpEnable, handleMcpDiscover, handleMcpSleep, handleMcpWake, handleMcpUpdate, handleMcpRemove, handleMcpAdd, handleMcpList, handleMemoryForget, handleMemoryRemember, handleMemoryList, handleCompletionRequest, createToolLspCompletionSource, handleFilesWrite, handleFilesRead, handleFilesTree, handleFilesList, createHttpServer, registerInstance, openBrowser as openBrowser$1, unregisterInstance, estimateTokens as estimateTokens$1, stringifyContent, messagePreview, messageTokens, createCustomModeStore } from '@wrongstack/webui/server';
 import { toErrorMessage, readJsonObjectFile, updateJsonObjectFile, setJsonPath, jsonObjectFileExists, removeJsonPath } from '@wrongstack/core/utils';
-import { setOAuthTokenPersister, makeProviderFromConfig, capabilitiesFor, buildProviderFactoriesFromRegistry, refreshCopilotToken, copilotBaseUrlFromToken } from '@wrongstack/providers';
-import { getProcessRegistry, builtinToolsPack, rememberTool, forgetTool, searchMemoryTool, relatedMemoryTool, runStartupIndex, isIndexableFile, enqueueReindex, cancelPendingReindexes, shutdownCodebaseIndexHost, TIER2_TOOLS, TIER3_TOOLS, TIER1_TOOLS, resetIndexCircuitBreaker } from '@wrongstack/tools';
+import { setOAuthTokenPersister, capabilitiesFor, makeProviderFromConfig, buildProviderFactoriesFromRegistry, withCatalogCapabilities, refreshCopilotToken, copilotBaseUrlFromToken } from '@wrongstack/providers';
+import { ensureSessionShell, builtinToolsPack, rememberTool, forgetTool, searchMemoryTool, relatedMemoryTool, configureExecPolicy, runStartupIndex, isIndexableFile, enqueueReindex, cancelPendingReindexes, shutdownCodebaseIndexHost, getProcessRegistry, TIER2_TOOLS, TIER3_TOOLS, TIER1_TOOLS, resetIndexCircuitBreaker } from '@wrongstack/tools';
 import { DefaultSessionStore } from '@wrongstack/core/storage';
 import { probeLocalLlm } from '@wrongstack/runtime/probe';
-import * as fs3 from 'fs';
-import { watch, writeFileSync, existsSync, realpathSync, readFileSync } from 'fs';
+import * as fs37 from 'fs';
+import { watch, writeFileSync, existsSync, realpathSync } from 'fs';
 import { SkillInstaller } from '@wrongstack/core/skills';
 import { spawn, execFile, execFileSync } from 'child_process';
 import { MCPRegistry, MCPServer, serveHttp, serveStdio } from '@wrongstack/mcp';
@@ -166,7 +167,7 @@ function unknownSubcommand(cmd, valid, name) {
   const list = valid.join(", ");
   return name ? `Unknown subcommand "${cmd}" for /${name}. Valid: ${list}.` : `Unknown subcommand "${cmd}". Valid: ${list}.`;
 }
-async function pathExists(file) {
+async function pathExists2(file) {
   try {
     await fs4.access(file);
     return true;
@@ -221,10 +222,10 @@ async function detectPackageManager2(root, declared) {
     const name = declared.split("@")[0];
     if (name) return name;
   }
-  if (await pathExists(path4.join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (await pathExists(path4.join(root, "bun.lockb"))) return "bun";
-  if (await pathExists(path4.join(root, "bun.lock"))) return "bun";
-  if (await pathExists(path4.join(root, "yarn.lock"))) return "yarn";
+  if (await pathExists2(path4.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists2(path4.join(root, "bun.lockb"))) return "bun";
+  if (await pathExists2(path4.join(root, "bun.lock"))) return "bun";
+  if (await pathExists2(path4.join(root, "yarn.lock"))) return "yarn";
   return "npm";
 }
 function hasUsableScript(scripts, name) {
@@ -299,14 +300,14 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "pyproject.toml"))) throw new Error("not python");
+    if (!await pathExists2(path4.join(root, "pyproject.toml"))) throw new Error("not python");
     facts.test ??= "pytest";
     facts.lint ??= "ruff check .";
     facts.hints.push("pyproject.toml");
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "go.mod"))) throw new Error("not go");
+    if (!await pathExists2(path4.join(root, "go.mod"))) throw new Error("not go");
     facts.build ??= "go build ./...";
     facts.test ??= "go test ./...";
     facts.run ??= "go run .";
@@ -314,7 +315,7 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "Cargo.toml"))) throw new Error("not rust");
+    if (!await pathExists2(path4.join(root, "Cargo.toml"))) throw new Error("not rust");
     facts.build ??= "cargo build";
     facts.test ??= "cargo test";
     facts.lint ??= "cargo clippy";
@@ -342,23 +343,23 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "pom.xml"))) throw new Error("not maven");
+    if (!await pathExists2(path4.join(root, "pom.xml"))) throw new Error("not maven");
     facts.build ??= "mvn package";
     facts.test ??= "mvn test";
     facts.hints.push("pom.xml");
   } catch {
   }
   try {
-    const hasGradle = await pathExists(path4.join(root, "build.gradle")) || await pathExists(path4.join(root, "build.gradle.kts"));
+    const hasGradle = await pathExists2(path4.join(root, "build.gradle")) || await pathExists2(path4.join(root, "build.gradle.kts"));
     if (!hasGradle) throw new Error("not gradle");
-    const g = await pathExists(path4.join(root, "gradlew")) ? "./gradlew" : "gradle";
+    const g = await pathExists2(path4.join(root, "gradlew")) ? "./gradlew" : "gradle";
     facts.build ??= `${g} build`;
     facts.test ??= `${g} test`;
     facts.hints.push("Gradle");
   } catch {
   }
   try {
-    const hasDotnet = await pathExists(path4.join(root, "global.json")) || await hasRootFileWithSuffix(root, [".csproj", ".fsproj", ".sln"]);
+    const hasDotnet = await pathExists2(path4.join(root, "global.json")) || await hasRootFileWithSuffix(root, [".csproj", ".fsproj", ".sln"]);
     if (!hasDotnet) throw new Error("not dotnet");
     facts.build ??= "dotnet build";
     facts.test ??= "dotnet test";
@@ -367,7 +368,7 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "mix.exs"))) throw new Error("not elixir");
+    if (!await pathExists2(path4.join(root, "mix.exs"))) throw new Error("not elixir");
     facts.build ??= "mix compile";
     facts.test ??= "mix test";
     facts.lint ??= "mix format --check-formatted";
@@ -376,14 +377,14 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "pubspec.yaml"))) throw new Error("not dart");
+    if (!await pathExists2(path4.join(root, "pubspec.yaml"))) throw new Error("not dart");
     facts.test ??= "dart test";
     facts.lint ??= "dart analyze";
     facts.hints.push("pubspec.yaml");
   } catch {
   }
   try {
-    const hasDeno = await pathExists(path4.join(root, "deno.json")) || await pathExists(path4.join(root, "deno.jsonc"));
+    const hasDeno = await pathExists2(path4.join(root, "deno.json")) || await pathExists2(path4.join(root, "deno.jsonc"));
     if (!hasDeno) throw new Error("not deno");
     facts.test ??= "deno test";
     facts.lint ??= "deno lint";
@@ -391,7 +392,7 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "Package.swift"))) throw new Error("not swift");
+    if (!await pathExists2(path4.join(root, "Package.swift"))) throw new Error("not swift");
     facts.build ??= "swift build";
     facts.test ??= "swift test";
     facts.run ??= "swift run";
@@ -399,20 +400,20 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "Gemfile"))) throw new Error("not ruby");
-    if (await pathExists(path4.join(root, "Rakefile"))) facts.test ??= "bundle exec rake test";
+    if (!await pathExists2(path4.join(root, "Gemfile"))) throw new Error("not ruby");
+    if (await pathExists2(path4.join(root, "Rakefile"))) facts.test ??= "bundle exec rake test";
     facts.hints.push("Gemfile");
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "CMakeLists.txt"))) throw new Error("not cmake");
+    if (!await pathExists2(path4.join(root, "CMakeLists.txt"))) throw new Error("not cmake");
     facts.build ??= "cmake -B build && cmake --build build";
     facts.test ??= "ctest --test-dir build";
     facts.hints.push("CMakeLists.txt");
   } catch {
   }
   try {
-    const hasPip = await pathExists(path4.join(root, "requirements.txt")) || await pathExists(path4.join(root, "setup.py")) || await pathExists(path4.join(root, "setup.cfg"));
+    const hasPip = await pathExists2(path4.join(root, "requirements.txt")) || await pathExists2(path4.join(root, "setup.py")) || await pathExists2(path4.join(root, "setup.cfg"));
     if (!hasPip) throw new Error("not pip");
     facts.test ??= "pytest";
     facts.hints.push("requirements.txt");
@@ -5521,7 +5522,11 @@ function registerWebuiInstance(p, deps = {}) {
       projectRoot: p.projectRoot,
       projectName: path4.basename(p.projectRoot) || p.projectRoot,
       startedAt: p.startedAt,
-      url: `http://${p.host}:${p.httpPort}`
+      url: buildWebUIAccessUrl({
+        host: p.host,
+        port: p.httpPort,
+        publicUrl: p.publicUrl
+      })
     },
     p.registryBaseDir
   ).catch(() => {
@@ -5530,7 +5535,12 @@ function registerWebuiInstance(p, deps = {}) {
 function announceWebuiReady(p) {
   const log = p.log ?? ((m) => console.log(m));
   const launch = p.openBrowserFn ?? openBrowser$1;
-  const openUrl = p.wsToken ? `http://${p.host}:${p.httpPort}?token=${encodeURIComponent(p.wsToken)}` : `http://${p.host}:${p.httpPort}`;
+  const openUrl = buildWebUIAccessUrl({
+    host: p.host,
+    port: p.httpPort,
+    token: p.wsToken,
+    publicUrl: p.publicUrl
+  });
   p.server.on("listening", () => {
     log(
       `
@@ -5667,7 +5677,9 @@ function startStaticServe(opts, deps = {}) {
     wsPort: opts.wsPort,
     globalRoot: opts.globalRoot,
     onFleetPing: opts.onFleetPing,
-    apiToken: opts.apiToken
+    publicWsUrl: opts.publicWsUrl,
+    apiToken: opts.apiToken,
+    requireToken: opts.requireToken
   });
   server.listen(opts.httpPort, opts.host);
   return { server, port: opts.httpPort };
@@ -7298,7 +7310,10 @@ __export(webui_server_exports, {
   runWebUI: () => runWebUI
 });
 async function runWebUI(opts) {
-  const host = "127.0.0.1";
+  const host = opts.host ?? process.env["WEBUI_HOST"] ?? process.env["WS_HOST"] ?? "127.0.0.1";
+  const publicUrl = opts.publicUrl ?? process.env["WEBUI_PUBLIC_URL"];
+  const publicWsUrl = opts.publicWsUrl ?? process.env["WEBUI_PUBLIC_WS_URL"];
+  const requireToken = opts.requireToken ?? envFlag("WEBUI_REQUIRE_TOKEN");
   const requestedWsPort = opts.port ?? 3457;
   const requestedHttpPort = opts.httpPort ?? 3456;
   const strictPort = process.env["WEBUI_STRICT_PORT"] === "1" || process.env["WEBUI_STRICT_PORT"] === "true";
@@ -7435,7 +7450,11 @@ async function runWebUI(opts) {
           });
         }
       });
-      const mailbox = new GlobalMailbox(projectDir, opts.events, () => webuiHqConnection?.getPublisher());
+      const mailbox = new GlobalMailbox(
+        projectDir,
+        opts.events,
+        () => webuiHqConnection?.getPublisher()
+      );
       webuiClientId = `webui@${crypto2.randomUUID().slice(0, 8)}`;
       const projectName = opts.projectRoot ? path4.basename(opts.projectRoot) : "unknown";
       await mailbox.registerClient({
@@ -7468,7 +7487,21 @@ async function runWebUI(opts) {
     webuiHqConnection = void 0;
   };
   registerWebuiClient();
-  const wsToken = generateAuthToken();
+  const wsToken = resolveAuthToken(opts.accessToken);
+  const publicHostnames = [publicUrl, publicWsUrl].map((value) => {
+    if (!value) return void 0;
+    try {
+      return new URL(value).hostname;
+    } catch {
+      return void 0;
+    }
+  }).filter((value) => Boolean(value));
+  const accessUrl = buildWebUIAccessUrl({
+    host,
+    port: httpPort,
+    token: wsToken,
+    publicUrl
+  });
   const wss = new WebSocketServer({ port, host, maxPayload: 1 * 1024 * 1024 });
   console.log(`[WebUI] WebSocket server starting on ws://${host}:${port}`);
   let fleetBroadcastCli = null;
@@ -7480,7 +7513,9 @@ async function runWebUI(opts) {
     onFleetPing: () => {
       void fleetBroadcastCli?.();
     },
-    apiToken: wsToken
+    publicWsUrl,
+    apiToken: wsToken,
+    requireToken
   });
   if (httpServer) {
     announceWebuiReady({
@@ -7489,7 +7524,8 @@ async function runWebUI(opts) {
       httpPort,
       wsPort,
       open: !!opts.open,
-      wsToken
+      wsToken,
+      publicUrl
     });
   } else {
     console.warn(
@@ -7503,6 +7539,7 @@ async function runWebUI(opts) {
       host,
       httpPort,
       wsPort,
+      publicUrl,
       projectRoot: opts.projectRoot,
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       registryBaseDir
@@ -8270,11 +8307,11 @@ ${text}` : text;
     broadcast,
     log: (m) => console.log(m)
   };
-  return new Promise((resolve13) => {
+  const stopped = new Promise((resolve13) => {
     wss.on("listening", () => {
       console.log(`[WebUI] WebSocket server running on ws://${host}:${port}`);
       setupEvents();
-      opts.onListening?.({ httpPort, wsPort, host });
+      opts.onListening?.({ httpPort, wsPort, host, url: accessUrl });
       const globalRoot = opts.globalConfigPath ? path4.dirname(opts.globalConfigPath) : void 0;
       if (globalRoot) {
         const broadcastSessions = async () => {
@@ -8344,7 +8381,10 @@ ${text}` : text;
         remoteAddress: req2.socket.remoteAddress,
         cookieHeader: req2.headers.cookie,
         wsHost: host,
-        expectedToken: wsToken
+        expectedToken: wsToken,
+        requireToken,
+        allowedHostnames: publicHostnames,
+        allowBrowserUrlToken: Boolean(publicWsUrl)
       });
       if (!ok) {
         ws.close(4003, "Forbidden");
@@ -8437,572 +8477,312 @@ ${text}` : text;
     });
     registerWebuiSignalHandlers(signalShutdown);
   });
-  async function handleMessage(ws, _client, msg) {
-    switch (msg.type) {
-      case "user_message":
-        await handleUserMessage(
-          connectionCtx,
-          ws,
-          msg.payload.content
-        );
-        break;
-      case "abort":
-        handleAbort(connectionCtx, ws);
-        break;
-      case "ping":
-        handlePing(connectionCtx, ws);
-        break;
-      case "tool.confirm_result": {
-        const { id, decision } = msg.payload;
-        handleToolConfirmResult(connectionCtx, id, decision);
-        break;
-      }
-      case "providers.list":
-        await handleProvidersList(wsHandlerCtx, ws);
-        break;
-      case "provider.models":
-        await handleProviderModels(
-          wsHandlerCtx,
-          ws,
-          msg.payload.providerId
-        );
-        break;
-      case "providers.saved":
-        await handleProvidersSaved(wsHandlerCtx, ws);
-        break;
-      case "key.add":
-      case "key.update": {
-        const m = msg;
-        await handleKeyUpsert(
-          wsHandlerCtx,
-          ws,
-          m.payload.providerId,
-          m.payload.label,
-          m.payload.apiKey
-        );
-        break;
-      }
-      case "key.delete": {
-        const m = msg;
-        await handleKeyDelete(wsHandlerCtx, ws, m.payload.providerId, m.payload.label);
-        break;
-      }
-      case "key.set_active": {
-        const m = msg;
-        await handleKeySetActive(wsHandlerCtx, ws, m.payload.providerId, m.payload.label);
-        break;
-      }
-      case "provider.add": {
-        const m = msg;
-        await handleProviderAdd(wsHandlerCtx, ws, m.payload);
-        break;
-      }
-      case "provider.remove": {
-        const m = msg;
-        await handleProviderRemove(wsHandlerCtx, ws, m.payload.providerId);
-        break;
-      }
-      case "provider.clear_models": {
-        const m = msg;
-        await handleProviderClearModels(wsHandlerCtx, ws, m.payload.providerId);
-        break;
-      }
-      case "provider.undo_clear": {
-        const m = msg;
-        await handleProviderUndoClear(
-          wsHandlerCtx,
-          ws,
-          m.payload.providerId,
-          m.payload.previousModels
-        );
-        break;
-      }
-      case "provider.update": {
-        const m = msg;
-        await handleProviderUpdate(wsHandlerCtx, ws, m.payload);
-        break;
-      }
-      case "provider.probe": {
-        const m = msg;
-        await handleProviderProbe(wsHandlerCtx, ws, m.payload.providerId, m.payload.timeoutMs);
-        break;
-      }
-      case "todos.get": {
-        handleTodosGet(worklistCtx, ws);
-        break;
-      }
-      case "goal.get": {
-        await handleGoalGet(sessionsCtx);
-        break;
-      }
-      case "sessions.list": {
-        await handleSessionsList(
-          sessionsCtx,
-          ws,
-          msg.payload?.limit ?? 50
-        );
-        break;
-      }
-      case "session.new": {
-        await handleSessionNew(sessionsCtx);
-        break;
-      }
-      case "todos.clear": {
-        handleTodosClear(worklistCtx, ws);
-        break;
-      }
-      case "todos.remove": {
-        handleTodosRemove(
-          worklistCtx,
-          ws,
-          msg.payload
-        );
-        break;
-      }
-      case "todo.update": {
-        handleTodoUpdate(
-          worklistCtx,
-          ws,
-          msg.payload
-        );
-        break;
-      }
-      case "context.clear": {
-        await handleContextClear(contextHandlerCtx, ws);
-        break;
-      }
-      case "process.list": {
-        handleProcessList(wsCommon, ws);
-        break;
-      }
-      case "process.kill": {
-        handleProcessKill(wsCommon, ws, msg.payload.pid);
-        break;
-      }
-      case "process.killAll": {
-        handleProcessKillAll(wsCommon, ws);
-        break;
-      }
-      case "diag.get": {
-        handleDiagGet(introspectionCtx, ws);
-        break;
-      }
-      case "stats.get": {
-        await handleStatsGet(introspectionCtx, ws);
-        break;
-      }
-      case "autonomy.switch": {
-        handleAutonomySwitch(prefsCtx, ws, msg.payload.mode);
-        break;
-      }
-      case "tools.list": {
-        handleToolsList(introspectionCtx, ws);
-        break;
-      }
-      case "session.checkpoints": {
-        await handleSessionCheckpoints(sessionsCtx, ws);
-        break;
-      }
-      case "session.rewind": {
-        await handleSessionRewind(
-          sessionsCtx,
-          ws,
-          msg.payload.checkpointIndex
-        );
-        break;
-      }
-      // ── File operations — delegated to shared handlers (file-handlers.ts) ──
-      // These handlers are also used by the standalone WebUI server. When
-      // adding or modifying file-operation WebSocket messages, update
-      // file-handlers.ts — NOT these case blocks individually.
-      case "files.list": {
-        const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot;
-        return handleFilesList(ws, msg, projectRoot);
-      }
-      case "files.tree": {
-        const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot;
-        return handleFilesTree(ws, msg, projectRoot);
-      }
-      case "files.read": {
-        const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot;
-        return handleFilesRead(ws, msg, projectRoot);
-      }
-      case "files.write": {
-        const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot;
-        return handleFilesWrite(ws, msg, projectRoot);
-      }
-      case "completion.request": {
-        const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot;
-        return handleCompletionRequest(ws, msg, {
-          projectRoot,
-          provider: opts.agent.ctx.provider,
-          model: opts.agent.ctx.model,
-          indexDir: typeof opts.agent.ctx.meta["codebaseIndexDir"] === "string" ? opts.agent.ctx.meta["codebaseIndexDir"] : void 0,
-          lspCompletion: createToolLspCompletionSource(
-            opts.agent.ctx.tools.find((tool) => tool.name === "lsp_completion"),
-            opts.agent.ctx
-          )
+  const noop = () => {
+  };
+  const projectRootFor = () => opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "";
+  const wsRoutes = {
+    // ── Core connection ──
+    user_message: (msg, ws) => handleUserMessage(
+      connectionCtx,
+      ws,
+      msg.payload.content
+    ),
+    abort: (_msg, ws) => handleAbort(connectionCtx, ws),
+    ping: (_msg, ws) => handlePing(connectionCtx, ws),
+    "tool.confirm_result": (msg, _ws) => {
+      const { id, decision } = msg.payload;
+      handleToolConfirmResult(connectionCtx, id, decision);
+    },
+    "webui.shutdown": () => {
+      console.log("[WebUI] Shutdown requested from client");
+      shutdown();
+    },
+    // ── Providers / keys ──
+    "providers.list": (_msg, ws) => handleProvidersList(wsHandlerCtx, ws),
+    "provider.models": (msg, ws) => handleProviderModels(
+      wsHandlerCtx,
+      ws,
+      msg.payload.providerId
+    ),
+    "providers.saved": (_msg, ws) => handleProvidersSaved(wsHandlerCtx, ws),
+    "key.add": (msg, ws) => {
+      const m = msg;
+      handleKeyUpsert(wsHandlerCtx, ws, m.payload.providerId, m.payload.label, m.payload.apiKey);
+    },
+    "key.update": (msg, ws) => {
+      const m = msg;
+      handleKeyUpsert(wsHandlerCtx, ws, m.payload.providerId, m.payload.label, m.payload.apiKey);
+    },
+    "key.delete": (msg, ws) => {
+      const m = msg;
+      handleKeyDelete(wsHandlerCtx, ws, m.payload.providerId, m.payload.label);
+    },
+    "key.set_active": (msg, ws) => {
+      const m = msg;
+      handleKeySetActive(wsHandlerCtx, ws, m.payload.providerId, m.payload.label);
+    },
+    "provider.add": (msg, ws) => handleProviderAdd(
+      wsHandlerCtx,
+      ws,
+      msg.payload
+    ),
+    "provider.remove": (msg, ws) => handleProviderRemove(
+      wsHandlerCtx,
+      ws,
+      msg.payload.providerId
+    ),
+    "provider.clear_models": (msg, ws) => handleProviderClearModels(
+      wsHandlerCtx,
+      ws,
+      msg.payload.providerId
+    ),
+    "provider.undo_clear": (msg, ws) => {
+      const m = msg;
+      handleProviderUndoClear(wsHandlerCtx, ws, m.payload.providerId, m.payload.previousModels);
+    },
+    "provider.update": (msg, ws) => handleProviderUpdate(
+      wsHandlerCtx,
+      ws,
+      msg.payload
+    ),
+    "provider.probe": (msg, ws) => {
+      const m = msg;
+      handleProviderProbe(wsHandlerCtx, ws, m.payload.providerId, m.payload.timeoutMs);
+    },
+    // ── Todos / goals / plans / tasks ──
+    "todos.get": (_msg, ws) => handleTodosGet(worklistCtx, ws),
+    "todos.clear": (_msg, ws) => handleTodosClear(worklistCtx, ws),
+    "todos.remove": (msg, ws) => handleTodosRemove(
+      worklistCtx,
+      ws,
+      msg.payload
+    ),
+    "todo.update": (msg, ws) => handleTodoUpdate(
+      worklistCtx,
+      ws,
+      msg.payload
+    ),
+    "goal.get": (_msg, ws) => handleGoalGet(sessionsCtx),
+    "plan.get": (_msg, ws) => handlePlanGet(worklistCtx, ws),
+    "plan.template_use": (msg, ws) => handlePlanTemplateUse(
+      worklistCtx,
+      ws,
+      msg.payload.template
+    ),
+    "plan.item.update": (msg, ws) => handlePlanItemUpdate(
+      worklistCtx,
+      ws,
+      msg.payload
+    ),
+    "tasks.get": (_msg, ws) => handleTasksGet(worklistCtx, ws),
+    "task.update": (msg, ws) => handleTaskUpdate(
+      worklistCtx,
+      ws,
+      msg.payload
+    ),
+    // ── Sessions ──
+    "sessions.list": (msg, ws) => handleSessionsList(
+      sessionsCtx,
+      ws,
+      msg.payload?.limit ?? 50
+    ),
+    "session.new": (_msg, ws) => handleSessionNew(sessionsCtx),
+    "session.delete": (msg, ws) => handleSessionDelete(sessionsCtx, ws, msg.payload.id),
+    "session.save": (_msg, ws) => handleSessionSave(sessionsCtx, ws),
+    "session.resume": (msg, ws) => handleSessionResume(sessionsCtx, ws, msg.payload.id),
+    "session.checkpoints": (_msg, ws) => handleSessionCheckpoints(sessionsCtx, ws),
+    "session.rewind": (msg, ws) => handleSessionRewind(
+      sessionsCtx,
+      ws,
+      msg.payload.checkpointIndex
+    ),
+    // ── Context ──
+    "context.clear": (_msg, ws) => handleContextClear(contextHandlerCtx, ws),
+    "context.debug": (_msg, ws) => handleContextDebug(contextHandlerCtx, ws),
+    "context.compact": (msg, ws) => handleContextCompact(
+      contextHandlerCtx,
+      ws,
+      !!msg.payload?.aggressive
+    ),
+    "context.repair": (_msg, ws) => handleContextRepair(contextHandlerCtx, ws),
+    "context.modes.list": (_msg, ws) => handleContextModesList(contextHandlerCtx, ws),
+    "context.mode.switch": (msg, ws) => handleContextModeSwitch(
+      contextHandlerCtx,
+      ws,
+      msg.payload.id
+    ),
+    "context.mode.create": (msg, ws) => handleContextModeCreate(
+      contextHandlerCtx,
+      ws,
+      msg.payload
+    ),
+    "context.mode.update": (msg, ws) => handleContextModeUpdate(
+      contextHandlerCtx,
+      ws,
+      msg.payload
+    ),
+    "context.mode.delete": (msg, ws) => handleContextModeDelete(
+      contextHandlerCtx,
+      ws,
+      msg.payload.id
+    ),
+    // ── Agent config: modes / models ──
+    "modes.list": (_msg, ws) => handleModesList(agentConfigCtx, ws),
+    "mode.switch": (msg, ws) => handleModeSwitch(agentConfigCtx, ws, msg.payload.id),
+    "model.switch": (msg, ws) => handleModelSwitch(
+      agentConfigCtx,
+      ws,
+      msg.payload
+    ),
+    "model.refine": (msg, ws) => handleModelRefine(agentConfigCtx, ws, msg.payload.text),
+    // ── Process management ──
+    "process.list": (_msg, ws) => handleProcessList(wsCommon, ws),
+    "process.kill": (msg, ws) => handleProcessKill(wsCommon, ws, msg.payload.pid),
+    "process.killAll": (_msg, ws) => handleProcessKillAll(wsCommon, ws),
+    // ── Diagnostics / introspection ──
+    "diag.get": (_msg, ws) => handleDiagGet(introspectionCtx, ws),
+    "stats.get": (_msg, ws) => handleStatsGet(introspectionCtx, ws),
+    "tools.list": (_msg, ws) => handleToolsList(introspectionCtx, ws),
+    // ── Autonomy ──
+    "autonomy.switch": (msg, ws) => handleAutonomySwitch(prefsCtx, ws, msg.payload.mode),
+    // ── Brain ──
+    "brain.status": (_msg, ws) => handleBrainStatus(brainCtx, ws),
+    "brain.risk": (msg, ws) => handleBrainRisk(brainCtx, ws, msg.payload?.level ?? ""),
+    "brain.ask": (msg, ws) => handleBrainAsk(brainCtx, ws, msg.payload?.question),
+    // ── Preferences ──
+    "prefs.get": (_msg, ws) => handlePrefsGet(prefsCtx, ws),
+    "prefs.update": (msg, ws) => handlePrefsUpdate(prefsCtx, ws, msg.payload),
+    // ── File operations (delegated to shared file-handlers.ts) ──
+    "files.list": (msg, ws) => handleFilesList(ws, msg, projectRootFor()),
+    "files.tree": (msg, ws) => handleFilesTree(ws, msg, projectRootFor()),
+    "files.read": (msg, ws) => handleFilesRead(ws, msg, projectRootFor()),
+    "files.write": (msg, ws) => handleFilesWrite(ws, msg, projectRootFor()),
+    "completion.request": (msg, ws) => handleCompletionRequest(ws, msg, {
+      projectRoot: projectRootFor(),
+      provider: opts.agent.ctx.provider,
+      model: opts.agent.ctx.model,
+      indexDir: typeof opts.agent.ctx.meta["codebaseIndexDir"] === "string" ? opts.agent.ctx.meta["codebaseIndexDir"] : void 0,
+      lspCompletion: createToolLspCompletionSource(
+        opts.agent.ctx.tools.find((tool) => tool.name === "lsp_completion"),
+        opts.agent.ctx
+      )
+    }),
+    // ── Memory (guarded — opts.memoryStore may be undefined) ──
+    "memory.list": (_msg, ws) => {
+      if (!opts.memoryStore) {
+        send(ws, {
+          type: "memory.list",
+          payload: { text: "", error: "Memory store not available" }
         });
+        return;
       }
-      case "session.delete": {
-        await handleSessionDelete(sessionsCtx, ws, msg.payload.id);
-        break;
-      }
-      case "session.save":
-        handleSessionSave(sessionsCtx, ws);
-        break;
-      case "plan.get": {
-        await handlePlanGet(worklistCtx, ws);
-        break;
-      }
-      case "plan.template_use": {
-        await handlePlanTemplateUse(
-          worklistCtx,
-          ws,
-          msg.payload.template
-        );
-        break;
-      }
-      case "plan.item.update": {
-        await handlePlanItemUpdate(
-          worklistCtx,
-          ws,
-          msg.payload
-        );
-        break;
-      }
-      // ── Memory operations — delegated to shared handlers (memory-handlers.ts) ──
-      case "memory.list": {
-        if (!opts.memoryStore) {
-          send(ws, {
-            type: "memory.list",
-            payload: { text: "", error: "Memory store not available" }
-          });
-          break;
-        }
-        return handleMemoryList(ws, opts.memoryStore);
-      }
-      case "memory.remember": {
-        if (!opts.memoryStore) {
-          sendResult10(ws, false, "Memory store not available");
-          break;
-        }
-        return handleMemoryRemember(ws, msg, opts.memoryStore);
-      }
-      case "memory.forget": {
-        if (!opts.memoryStore) {
-          sendResult10(ws, false, "Memory store not available");
-          break;
-        }
-        return handleMemoryForget(ws, msg, opts.memoryStore);
-      }
-      // ── MCP operations — delegated to the shared handlers in
-      // @wrongstack/webui/server, which run against the same on-disk config
-      // and the live MCPRegistry the agent loop + `/mcp` use. ──
-      case "mcp.list":
-        await handleMcpList(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry);
-        break;
-      case "mcp.add":
-        await handleMcpAdd(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry);
-        break;
-      case "mcp.remove":
-        await handleMcpRemove(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry);
-        break;
-      case "mcp.update":
-        await handleMcpUpdate(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry);
-        break;
-      case "mcp.wake":
-        await handleMcpWake(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry);
-        break;
-      case "mcp.sleep":
-        await handleMcpSleep(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry);
-        break;
-      case "mcp.discover":
-        await handleMcpDiscover(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry);
-        break;
-      case "mcp.enable":
-        await handleMcpEnable(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry);
-        break;
-      case "mcp.disable":
-        await handleMcpDisable(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry);
-        break;
-      case "mcp.restart":
-        await handleMcpRestart(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry);
-        break;
-      case "skills.list": {
-        await handleSkillsList(introspectionCtx, ws);
-        break;
-      }
-      case "skills.content": {
-        await handleSkillsContent(ws, skillsCtx, msg);
-        break;
-      }
-      case "skills.install": {
-        await handleSkillsInstall(ws, skillsCtx, msg);
-        break;
-      }
-      case "skills.uninstall": {
-        await handleSkillsUninstall(ws, skillsCtx, msg);
-        break;
-      }
-      case "skills.update": {
-        await handleSkillsUpdate(ws, skillsCtx, msg);
-        break;
-      }
-      case "skills.create": {
-        await handleSkillsCreate(ws, skillsCtx, msg);
-        break;
-      }
-      case "skills.edit": {
-        await handleSkillsEdit(ws, skillsCtx, msg);
-        break;
-      }
-      case "skills.export": {
-        await handleSkillsExport(ws, skillsCtx);
-        break;
-      }
-      case "modes.list": {
-        await handleModesList(agentConfigCtx, ws);
-        break;
-      }
-      case "mode.switch": {
-        await handleModeSwitch(agentConfigCtx, ws, msg.payload.id);
-        break;
-      }
-      case "model.switch": {
-        await handleModelSwitch(
-          agentConfigCtx,
-          ws,
-          msg.payload
-        );
-        break;
-      }
-      case "session.resume": {
-        await handleSessionResume(sessionsCtx, ws, msg.payload.id);
-        break;
-      }
-      case "context.debug": {
-        handleContextDebug(contextHandlerCtx, ws);
-        break;
-      }
-      case "context.compact": {
-        await handleContextCompact(
-          contextHandlerCtx,
-          ws,
-          !!msg.payload?.aggressive
-        );
-        break;
-      }
-      case "context.repair": {
-        handleContextRepair(contextHandlerCtx, ws);
-        break;
-      }
-      case "context.modes.list": {
-        await handleContextModesList(contextHandlerCtx, ws);
-        break;
-      }
-      case "context.mode.switch": {
-        await handleContextModeSwitch(
-          contextHandlerCtx,
-          ws,
-          msg.payload.id
-        );
-        break;
-      }
-      case "context.mode.create": {
-        await handleContextModeCreate(
-          contextHandlerCtx,
-          ws,
-          msg.payload
-        );
-        break;
-      }
-      case "context.mode.update": {
-        await handleContextModeUpdate(
-          contextHandlerCtx,
-          ws,
-          msg.payload
-        );
-        break;
-      }
-      case "context.mode.delete": {
-        await handleContextModeDelete(
-          contextHandlerCtx,
-          ws,
-          msg.payload.id
-        );
-        break;
-      }
-      // ── Brain — status, autonomy ceiling, direct decision support ───
-      // Shares the HOST's brain (TOKENS.BrainArbiter) and the same settings
-      // object the /brain slash command mutates, so the ceiling shown in the
-      // terminal and the WebUI never diverge. These used to be unknown
-      // message types on the embedded server.
-      case "brain.status": {
-        handleBrainStatus(brainCtx, ws);
-        break;
-      }
-      case "brain.risk": {
-        const level = msg.payload?.level ?? "";
-        handleBrainRisk(brainCtx, ws, level);
-        break;
-      }
-      case "brain.ask": {
-        const question = msg.payload?.question;
-        await handleBrainAsk(brainCtx, ws, question);
-        break;
-      }
-      // ── Preferences ──────────────────────────────────────────
-      case "prefs.get": {
-        handlePrefsGet(prefsCtx, ws);
-        break;
-      }
-      case "prefs.update": {
-        handlePrefsUpdate(prefsCtx, ws, msg.payload);
-        break;
-      }
-      // ── Tasks ───────────────────────────────────────────────
-      case "tasks.get": {
-        await handleTasksGet(worklistCtx, ws);
-        break;
-      }
-      case "task.update": {
-        await handleTaskUpdate(
-          worklistCtx,
-          ws,
-          msg.payload
-        );
-        break;
-      }
-      // Collaboration messages — the CLI webui-server doesn't run a
-      // full collab hub; silently acknowledge and ignore. request_pause /
-      // resume / grant_control / inject_tool are included so the CollabPanel's
-      // controller actions don't trip the "Unhandled message type" warning (the
-      // standalone webui server is the one that wires the real
-      // CollaborationWebSocketHandler).
-      case "collab.join":
-      case "collab.leave":
-      case "collab.annotate":
-      case "collab.resolve":
-      case "collab.request_pause":
-      case "collab.resume":
-      case "collab.grant_control":
-      case "collab.inject_tool":
-        break;
-      // Integrated terminal — the CLI embedded server doesn't run a pty
-      // transport (it already has its own terminal); silently acknowledge
-      // and ignore so the browser client's terminal panel doesn't trip the
-      // "Unhandled message type" warning. The standalone webui server wires
-      // the real TerminalWebSocketHandler.
-      case "terminal.create":
-      case "terminal.input":
-      case "terminal.resize":
-      case "terminal.close":
-        break;
-      case "projects.list": {
-        await handleProjectsList(projectsCtx, ws);
-        break;
-      }
-      case "projects.select": {
-        await handleProjectsSelect(
-          projectsCtx,
-          ws,
-          msg.payload
-        );
-        break;
-      }
-      case "projects.add": {
-        await handleProjectsAdd(
-          projectsCtx,
-          ws,
-          msg.payload
-        );
-        break;
-      }
-      case "working_dir.set": {
-        await handleWorkingDirSet(
-          projectsCtx,
-          ws,
-          msg.payload.path
-        );
-        break;
-      }
-      case "git.changes": {
-        const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "";
-        await handleGitChanges(ws, projectRoot);
-        break;
-      }
-      case "git.diff": {
-        const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "";
-        const filePath = msg.payload?.path ?? "";
-        await handleGitDiff(ws, projectRoot, filePath);
-        break;
-      }
-      case "shell.open": {
-        const result = await handleShellOpen(
-          msg.payload,
-          consoleLogger
-        );
-        sendResult10(ws, result.success, result.message);
-        break;
-      }
-      case "model.refine": {
-        await handleModelRefine(
-          agentConfigCtx,
-          ws,
-          msg.payload.text
-        );
-        break;
-      }
-      case "webui.shutdown":
-        console.log("[WebUI] Shutdown requested from client");
-        shutdown();
-        break;
-      // ── Mailbox operations — project-level inter-agent messaging (PR 8 of #30) ────
-      case "mailbox.messages":
-        await handleMailboxMessages(
-          mailboxCtx,
-          msg,
-          ws
-        );
-        break;
-      case "mailbox.agents":
-        await handleMailboxAgents(mailboxCtx, msg, ws);
-        break;
-      case "mailbox.clear":
-        await handleMailboxClear(mailboxCtx, ws);
-        break;
-      case "mailbox.purge":
-        await handleMailboxPurge(mailboxCtx, msg, ws);
-        break;
-      case "git.info": {
-        const projectRoot = opts.projectRoot ?? opts.agent.ctx.projectRoot ?? "";
-        await handleGitInfo(ws, projectRoot);
-        break;
+      return handleMemoryList(ws, opts.memoryStore);
+    },
+    "memory.remember": (msg, ws) => {
+      if (!opts.memoryStore) {
+        sendResult10(ws, false, "Memory store not available");
+        return;
       }
-      default: {
-        const msgType = msg.type;
-        if (msgType.startsWith("autophase.")) {
-          await autoPhaseHandler.handleMessage(
-            msg
-          );
-        } else if (msgType.startsWith("specs.")) {
-          await specsHandler.handleMessage(
-            msg
-          );
-        } else if (msgType.startsWith("sdd.board.")) {
-          await sddBoardHandler.handleMessage(
-            msg
-          );
-        } else if (msgType.startsWith("sdd.spec.") || msgType.startsWith("sdd.run.")) {
-          await sddWizardHandler?.handleMessage(
-            msg
-          );
-        } else {
-          console.debug(`[WebUI] Unhandled message type: ${msgType}`);
-        }
-        break;
+      return handleMemoryRemember(ws, msg, opts.memoryStore);
+    },
+    "memory.forget": (msg, ws) => {
+      if (!opts.memoryStore) {
+        sendResult10(ws, false, "Memory store not available");
+        return;
       }
+      return handleMemoryForget(ws, msg, opts.memoryStore);
+    },
+    // ── MCP operations (shared handlers from @wrongstack/webui/server) ──
+    "mcp.list": (msg, ws) => handleMcpList(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry),
+    "mcp.add": (msg, ws) => handleMcpAdd(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry),
+    "mcp.remove": (msg, ws) => handleMcpRemove(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry),
+    "mcp.update": (msg, ws) => handleMcpUpdate(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry),
+    "mcp.wake": (msg, ws) => handleMcpWake(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry),
+    "mcp.sleep": (msg, ws) => handleMcpSleep(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry),
+    "mcp.discover": (msg, ws) => handleMcpDiscover(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry),
+    "mcp.enable": (msg, ws) => handleMcpEnable(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry),
+    "mcp.disable": (msg, ws) => handleMcpDisable(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry),
+    "mcp.restart": (msg, ws) => handleMcpRestart(ws, msg, opts.globalConfigPath ?? "", opts.mcpRegistry),
+    // ── Skills ──
+    "skills.list": (_msg, ws) => handleSkillsList(introspectionCtx, ws),
+    "skills.content": (msg, ws) => handleSkillsContent(ws, skillsCtx, msg),
+    "skills.install": (msg, ws) => handleSkillsInstall(ws, skillsCtx, msg),
+    "skills.uninstall": (msg, ws) => handleSkillsUninstall(ws, skillsCtx, msg),
+    "skills.update": (msg, ws) => handleSkillsUpdate(ws, skillsCtx, msg),
+    "skills.create": (msg, ws) => handleSkillsCreate(ws, skillsCtx, msg),
+    "skills.edit": (msg, ws) => handleSkillsEdit(ws, skillsCtx, msg),
+    "skills.export": (_msg, ws) => handleSkillsExport(ws, skillsCtx),
+    // ── Projects / working dir ──
+    "projects.list": (_msg, ws) => handleProjectsList(projectsCtx, ws),
+    "projects.select": (msg, ws) => handleProjectsSelect(
+      projectsCtx,
+      ws,
+      msg.payload
+    ),
+    "projects.add": (msg, ws) => handleProjectsAdd(
+      projectsCtx,
+      ws,
+      msg.payload
+    ),
+    "working_dir.set": (msg, ws) => handleWorkingDirSet(projectsCtx, ws, msg.payload.path),
+    // ── Git ──
+    "git.changes": (_msg, ws) => handleGitChanges(ws, projectRootFor()),
+    "git.diff": (msg, ws) => handleGitDiff(
+      ws,
+      projectRootFor(),
+      msg.payload?.path ?? ""
+    ),
+    "git.info": (_msg, ws) => handleGitInfo(ws, projectRootFor()),
+    // ── Shell ──
+    "shell.open": async (msg, ws) => {
+      const result = await handleShellOpen(
+        msg.payload,
+        consoleLogger
+      );
+      sendResult10(ws, result.success, result.message);
+    },
+    // ── Mailbox ──
+    "mailbox.messages": (msg, ws) => handleMailboxMessages(mailboxCtx, msg, ws),
+    "mailbox.agents": (msg, ws) => handleMailboxAgents(mailboxCtx, msg, ws),
+    "mailbox.clear": (_msg, ws) => handleMailboxClear(mailboxCtx, ws),
+    "mailbox.purge": (msg, ws) => handleMailboxPurge(mailboxCtx, msg, ws),
+    // ── Silent no-ops (standalone server wires real handlers) ──
+    "collab.join": noop,
+    "collab.leave": noop,
+    "collab.annotate": noop,
+    "collab.resolve": noop,
+    "collab.request_pause": noop,
+    "collab.resume": noop,
+    "collab.grant_control": noop,
+    "collab.inject_tool": noop,
+    "terminal.create": noop,
+    "terminal.input": noop,
+    "terminal.resize": noop,
+    "terminal.close": noop
+  };
+  async function handleMessage(ws, _client, msg) {
+    const handler = wsRoutes[msg.type];
+    if (handler) {
+      await handler(msg, ws);
+      return;
+    }
+    const msgType = msg.type;
+    if (msgType.startsWith("autophase.")) {
+      await autoPhaseHandler.handleMessage(
+        msg
+      );
+    } else if (msgType.startsWith("specs.")) {
+      await specsHandler.handleMessage(msg);
+    } else if (msgType.startsWith("sdd.board.")) {
+      await sddBoardHandler.handleMessage(
+        msg
+      );
+    } else if (msgType.startsWith("sdd.spec.") || msgType.startsWith("sdd.run.")) {
+      await sddWizardHandler?.handleMessage(
+        msg
+      );
+    } else {
+      console.debug(`[WebUI] Unhandled message type: ${msgType}`);
     }
   }
   function send(ws, msg) {
@@ -9032,6 +8812,7 @@ ${text}` : text;
   function sendResult10(ws, success, message) {
     send(ws, { type: "key.operation_result", payload: { success, message } });
   }
+  return stopped;
 }
 var init_webui_server = __esm({
   "src/webui-server.ts"() {
@@ -9049,6 +8830,14 @@ var init_webui_server = __esm({
 
 // src/cli-main.ts
 init_provider_config_utils();
+async function pathExists(p) {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
 var DEFAULT_TASK_CONCURRENCY = 2;
 function resolveTaskConcurrency() {
   const raw = Number.parseInt(process.env["WRONGSTACK_AUTOPHASE_TASK_CONCURRENCY"] ?? "", 10);
@@ -9073,8 +8862,13 @@ function gitText(args, cwd) {
       return;
     }
     const chunks = [];
+    let total = 0;
     const emit = (c) => {
-      if (chunks.join("").length < MAX_CMD_OUTPUT) chunks.push(c.toString());
+      if (total < MAX_CMD_OUTPUT) {
+        const s = c.toString();
+        chunks.push(s);
+        total += s.length;
+      }
     };
     child.stdout?.on("data", emit);
     child.stderr?.on("data", emit);
@@ -9086,7 +8880,20 @@ async function isGitRepo(cwd) {
   const { code, out } = await gitText(["rev-parse", "--is-inside-work-tree"], cwd);
   return code === 0 && out.trim() === "true";
 }
-var AUTOPHASE_SAFE_CMDS = /* @__PURE__ */ new Set(["pnpm", "npm", "yarn", "bun"]);
+var AUTOPHASE_BASE_SAFE_CMDS = /* @__PURE__ */ new Set(["pnpm", "npm", "yarn", "bun"]);
+var autophaseAllowed = new Set(AUTOPHASE_BASE_SAFE_CMDS);
+function configureAutophasePolicy(opts = {}) {
+  const next = new Set(AUTOPHASE_BASE_SAFE_CMDS);
+  for (const c of opts.allow ?? []) {
+    const n = c.trim();
+    if (n) next.add(n);
+  }
+  for (const c of opts.deny ?? []) next.delete(c.trim());
+  autophaseAllowed = next;
+}
+function isAutophaseCommandAllowed(cmd) {
+  return autophaseAllowed.has(cmd.trim());
+}
 var DESTRUCTIVE_PATTERNS = [
   /\brm\s+-rf\s+\//,
   /\bdangerously\s+(?:force|reset|--hard)\b/,
@@ -9100,10 +8907,10 @@ var DESTRUCTIVE_PATTERNS = [
   // $(...) subshell
 ];
 function runCmd(cmd, args, cwd, shell = false) {
-  if (!AUTOPHASE_SAFE_CMDS.has(cmd)) {
+  if (!isAutophaseCommandAllowed(cmd)) {
     return Promise.resolve({
       code: 1,
-      out: `autophase: command "${cmd}" not in autonomous safe-commands allowlist. Allowed: ${[...AUTOPHASE_SAFE_CMDS].join(", ")}. Set WRONGSTACK_AUTOPHASE_VERIFY_CMD to one of these.`
+      out: `autophase: command "${cmd}" not in autonomous safe-commands allowlist. Allowed: ${[...autophaseAllowed].join(", ")}. Add it to tools.exec.allow in ~/.wrongstack/config.json (trusted config only), or set WRONGSTACK_AUTOPHASE_VERIFY_CMD to an allowed command.`
     });
   }
   const fullCmd = [cmd, ...args].join(" ");
@@ -9146,15 +8953,21 @@ function runCmd(cmd, args, cwd, shell = false) {
     });
   });
 }
-function detectPackageManager(root) {
-  if (existsSync(join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync(join(root, "yarn.lock"))) return "yarn";
-  if (existsSync(join(root, "bun.lockb"))) return "bun";
+async function detectPackageManager(root) {
+  const [pnpm, yarn, bun] = await Promise.all([
+    pathExists(join(root, "pnpm-lock.yaml")),
+    pathExists(join(root, "yarn.lock")),
+    pathExists(join(root, "bun.lockb"))
+  ]);
+  if (pnpm) return "pnpm";
+  if (yarn) return "yarn";
+  if (bun) return "bun";
   return "npm";
 }
-function readScripts(cwd) {
+async function readScripts(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+    const raw = await readFile(join(cwd, "package.json"), "utf8");
+    const pkg = JSON.parse(raw);
     return pkg.scripts ?? {};
   } catch {
     return {};
@@ -9230,7 +9043,7 @@ function createAutoPhaseHost(deps) {
     ].join("\n");
   }
   async function runVerify(cwd) {
-    if (!existsSync(join(cwd, "node_modules")) && !existsSync(join(deps.projectRoot, "node_modules"))) {
+    if (!await pathExists(join(cwd, "node_modules")) && !await pathExists(join(deps.projectRoot, "node_modules"))) {
       return { ok: true, output: "verify skipped: node_modules not found" };
     }
     const custom = process.env["WRONGSTACK_AUTOPHASE_VERIFY_CMD"]?.trim();
@@ -9239,8 +9052,8 @@ function createAutoPhaseHost(deps) {
       return res.code === 0 ? { ok: true } : { ok: false, output: `[verify] exited ${res.code}
 ${res.out}` };
     }
-    const pm = detectPackageManager(deps.projectRoot);
-    const scripts = readScripts(cwd);
+    const pm = await detectPackageManager(deps.projectRoot);
+    const scripts = await readScripts(cwd);
     const steps = ["typecheck", "lint"].filter((s) => typeof scripts[s] === "string");
     if (steps.length === 0) return { ok: true, output: "verify skipped: no typecheck/lint script" };
     for (const step of steps) {
@@ -9378,8 +9191,9 @@ ${res.out}` };
         // WRONGSTACK_AUTOPHASE_TASK_CONCURRENCY (1 = strictly sequential).
         maxConcurrentTasks: resolveTaskConcurrency()
       });
-      const onUntyped = deps.events.on;
-      const offUntyped = deps.events.off;
+      const busOn = deps.events;
+      const onUntyped = (event, handler) => busOn.on(event, handler);
+      const offUntyped = (event, handler) => busOn.off(event, handler);
       const finalizeActiveRun = () => {
         if (active?.graph.id !== graph.id) return;
         active.unsubscribe();
@@ -9519,6 +9333,8 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "metrics",
   "webui",
   "open",
+  "webui-require-token",
+  "require-token",
   "no-check",
   "no-models-refresh",
   "director",
@@ -9987,27 +9803,28 @@ function shouldSuppress(flags) {
   return false;
 }
 var wrap = (n) => (n % GROUPS.length + GROUPS.length) % GROUPS.length;
-function pickGroupIndex(opts) {
+async function pickGroupIndex(opts) {
   if (typeof opts.groupIndex === "number") return wrap(opts.groupIndex);
   if (opts.cursorFile) {
     try {
       let current = 0;
       try {
-        const parsed = Number.parseInt(fs3.readFileSync(opts.cursorFile, "utf8").trim(), 10);
+        const raw = await fs4.readFile(opts.cursorFile, "utf8");
+        const parsed = Number.parseInt(raw.trim(), 10);
         if (Number.isFinite(parsed)) current = wrap(parsed);
       } catch {
       }
-      fs3.mkdirSync(path4.dirname(opts.cursorFile), { recursive: true });
-      fs3.writeFileSync(opts.cursorFile, String(wrap(current + 1)));
+      await fs4.mkdir(path4.dirname(opts.cursorFile), { recursive: true });
+      await fs4.writeFile(opts.cursorFile, String(wrap(current + 1)));
       return current;
     } catch {
     }
   }
   return Math.floor(Math.random() * GROUPS.length);
 }
-function printLaunchHints(renderer, flags, opts = {}) {
+async function printLaunchHints(renderer, flags, opts = {}) {
   if (shouldSuppress(flags)) return;
-  const idx = pickGroupIndex(opts);
+  const idx = await pickGroupIndex(opts);
   const group = GROUPS[idx];
   if (!group) return;
   const lines = [];
@@ -12232,6 +12049,7 @@ var KNOWN_TOP_LEVEL_KEYS = [
   "tools",
   "mcpServers",
   "fallbackModels",
+  "fallbackAuto",
   "hooks",
   "plugins",
   "log",
@@ -12244,8 +12062,12 @@ var KNOWN_TOP_LEVEL_KEYS = [
   "debugStream",
   "configScope",
   "indexing",
+  "circuitBreaker",
+  "adaptiveConcurrency",
   "launch",
   "session",
+  "modelRuntime",
+  "hq",
   "sync",
   "extensions"
 ];
@@ -12345,17 +12167,17 @@ function diagnoseConfig(cfg, plugins = []) {
       delete fixed["maxConcurrent"];
       findings.push({
         path: "maxConcurrent",
-        problem: `expected a positive integer, got ${JSON.stringify(v)}`,
+        problem: `expected a non-negative integer, got ${JSON.stringify(v)}`,
         severity: "error",
         fix: "removed (built-in default applies)"
       });
     } else {
-      const clamped = Math.max(1, Math.floor(n));
+      const clamped = Math.max(0, Math.floor(n));
       if (clamped !== v) {
         fixed["maxConcurrent"] = clamped;
         findings.push({
           path: "maxConcurrent",
-          problem: `expected a positive integer, got ${JSON.stringify(v)}`,
+          problem: `expected a non-negative integer, got ${JSON.stringify(v)}`,
           severity: "error",
           fix: `set to ${clamped}`
         });
@@ -12604,7 +12426,8 @@ var PROJECT_SAFE_FIELDS = /* @__PURE__ */ new Set([
   "indexing",
   "tools",
   "launch",
-  "circuitBreaker"
+  "circuitBreaker",
+  "modelRuntime"
 ]);
 function filterSafeForProject(cfg) {
   const out = {};
@@ -12746,6 +12569,17 @@ async function persistTelegramConfig(deps, mutator) {
     extensions
   });
 }
+function deriveFsAccessPair(input) {
+  if (input.allowOutsideProjectRoot !== void 0) {
+    const allow = input.allowOutsideProjectRoot;
+    return { allowOutsideProjectRoot: allow, restrictToProjectRoot: !allow };
+  }
+  if (input.restrictFsToRoot !== void 0) {
+    const restrict = input.restrictFsToRoot;
+    return { allowOutsideProjectRoot: !restrict, restrictToProjectRoot: restrict };
+  }
+  return void 0;
+}
 
 // src/slash-commands/doctor.ts
 init_helpers();
@@ -18635,7 +18469,7 @@ function buildSettingsCommand(opts) {
     "  /settings context-strategy hybrid|intelligent|selective   Compactor strategy",
     "  /settings context-auto-compact on|off   Auto-compact context when thresholds crossed",
     "  /settings token-saving off|minimal|light|medium|aggressive   Token-saving mode",
-    "  /settings max-concurrent <n>   Max concurrent subagents (0 = unlimited)",
+    "  /settings max-concurrent <n>   Max concurrent subagents (0 = default)",
     "  /settings title-animation on|off   Terminal title animation",
     "  /settings reasoning auto|on|off   Reasoning mode (auto = provider default)",
     "  /settings reasoning-effort none|minimal|low|medium|high|xhigh|max   Reasoning effort",
@@ -18647,7 +18481,7 @@ function buildSettingsCommand(opts) {
     "  /settings hq-raw on|off       Send raw content previews to HQ",
     "  /settings defaults            Show built-in default values",
     "",
-    "Settings are persisted to ~/.wrongstack/config.json."
+    "Settings are persisted to the active config scope: global (~/.wrongstack/config.json) or project (<project>/.wrongstack/config.json)."
   ].join("\n");
   function currentView() {
     const autonomy = opts.configStore.get().autonomy;
@@ -18670,7 +18504,7 @@ function buildSettingsCommand(opts) {
     const contextAutoCompact = context?.autoCompact !== false;
     const features = opts.configStore.get().features;
     const tokenSavingTier = features?.tokenSavingMode ?? "off";
-    const maxConcurrent = opts.configStore.get().maxConcurrent ?? 0;
+    const maxConcurrent = opts.configStore.get().maxConcurrent ?? 4;
     const modelRuntime = opts.configStore.get().modelRuntime;
     const reasoningMode = modelRuntime?.reasoning?.mode ?? "auto";
     const reasoningEffort = modelRuntime?.reasoning?.effort ?? "(unset)";
@@ -18680,6 +18514,7 @@ function buildSettingsCommand(opts) {
     const hqEnabled = hq?.enabled === true;
     const hqUrl = hq?.url ?? "(auto/local)";
     const hqToken = hq?.token ? `${hq.token.slice(0, 6)}\u2026${hq.token.slice(-4)} (${hq.token.length} chars)` : "(auto/local)";
+    const persistedTo = configScope === "project" ? "<project>/.wrongstack/config.json" : "~/.wrongstack/config.json";
     return [
       `${color.bold("WrongStack")} ${color.dim("\u2014 Settings")}`,
       "",
@@ -18698,7 +18533,7 @@ function buildSettingsCommand(opts) {
       `  context strategy:    ${color.cyan(contextStrategy)}   ${color.dim("change: /settings context-strategy hybrid|intelligent|selective")}`,
       `  context auto-compact: ${contextAutoCompact ? color.cyan("on") : color.dim("off")}   ${color.dim("change: /settings context-auto-compact on|off")}`,
       `  token-saving:       ${color.cyan(tokenSavingTier)}   ${color.dim("change: /settings token-saving off|minimal|light|medium|aggressive")}`,
-      `  max-concurrent:     ${color.cyan(maxConcurrent === 0 ? "unlimited" : String(maxConcurrent))}   ${color.dim("change: /settings max-concurrent <n>")}`,
+      `  max-concurrent:     ${color.cyan(maxConcurrent === 0 ? "default" : String(maxConcurrent))}   ${color.dim("change: /settings max-concurrent <n>")}`,
       `  reasoning mode:     ${color.cyan(reasoningMode)}   ${color.dim("change: /settings reasoning auto|on|off")}`,
       `  reasoning effort:   ${color.cyan(reasoningEffort)}   ${color.dim("change: /settings reasoning-effort <level>")}`,
       `  reasoning preserve: ${reasoningPreserve ? color.cyan("on") : color.dim("off")}   ${color.dim("change: /settings reasoning-preserve on|off")}`,
@@ -18708,7 +18543,7 @@ function buildSettingsCommand(opts) {
       `  HQ token:          ${color.cyan(hqToken)}   ${color.dim("change: /settings hq-token <token>")}`,
       `  HQ raw content:    ${hq?.rawContent === true ? color.cyan("on") : color.dim("off")}   ${color.dim("change: /settings hq-raw on|off")}`,
       "",
-      color.dim("  Persisted to ~/.wrongstack/config.json \xB7 /settings help for more")
+      color.dim(`  Persisted to ${persistedTo} \xB7 /settings help for more`)
     ].join("\n");
   }
   return {
@@ -18739,6 +18574,7 @@ function buildSettingsCommand(opts) {
             `  iteration timeout:     ${color.cyan("5 min")}`,
             `  session timeout:       ${color.cyan("30 min")}`,
             `  max iterations:        ${color.cyan("100")}`,
+            `  max concurrent:        ${color.cyan("4")}`,
             `  semver default part:   ${color.cyan("patch")}`
           ].join("\n")
         };
@@ -18879,12 +18715,13 @@ function buildSettingsCommand(opts) {
             return { message: `${color.amber("Usage:")} /settings fs-access unrestricted|project` };
           }
           const restrict = raw === "project";
+          const fsAccess = deriveFsAccessPair({ restrictFsToRoot: restrict });
           await persistConfigSetting(persistDeps, (cfg) => {
             const tools = cfg.tools ?? {};
-            tools.restrictToProjectRoot = restrict;
+            tools.restrictToProjectRoot = fsAccess.restrictToProjectRoot;
             cfg.tools = tools;
             const features = cfg.features ?? {};
-            features.allowOutsideProjectRoot = !restrict;
+            features.allowOutsideProjectRoot = fsAccess.allowOutsideProjectRoot;
             cfg.features = features;
           });
           const label = restrict ? `${color.cyan("project")} \u2014 file tools confined to the project root` : `${color.cyan("unrestricted")} \u2014 file tools may access paths outside the project root`;
@@ -19054,20 +18891,20 @@ function buildSettingsCommand(opts) {
           const raw = rest[0];
           if (raw === void 0) {
             return {
-              message: `${color.amber("Usage:")} /settings max-concurrent <n>   ${color.dim("(0 = unlimited)")}`
+              message: `${color.amber("Usage:")} /settings max-concurrent <n>   ${color.dim("(0 = default)")}`
             };
           }
           const n = Number.parseInt(raw, 10);
           if (Number.isNaN(n) || n < 0) {
             return {
-              message: `${color.red("Invalid number")}: "${raw}". Enter a non-negative integer (0 = unlimited)`
+              message: `${color.red("Invalid number")}: "${raw}". Enter a non-negative integer (0 = default)`
             };
           }
           await persistConfigSetting(persistDeps, (cfg) => {
             cfg.maxConcurrent = n;
           });
           return {
-            message: `${color.green("\u2713")} max-concurrent \u2192 ${color.cyan(n === 0 ? "unlimited" : String(n))}   ${color.dim("max concurrent subagents")}`
+            message: `${color.green("\u2713")} max-concurrent \u2192 ${color.cyan(n === 0 ? "default" : String(n))}   ${color.dim("max concurrent subagents")}`
           };
         }
         if (sub === "title-animation") {
@@ -19491,28 +19328,129 @@ function buildDirectorCommand(opts) {
 }
 var CONFIG_ENV = "WRONGSTACK_STATUSLINE_CONFIG";
 var DEFAULTS = {
+  version: true,
+  state: true,
+  model: true,
   todos: true,
   plan: true,
   tasks: true,
   fleet: true,
+  fleet_agents: true,
   git: true,
   elapsed: true,
   context: true,
+  tokens: true,
+  cache: true,
   cost: true,
-  working_dir: true
+  queue: true,
+  processes: true,
+  hint: true,
+  index: true,
+  breaker: true,
+  working_dir: true,
+  project: true,
+  yolo: true,
+  autonomy: true,
+  eternal_stage: true,
+  goal: true,
+  mode: true,
+  auto_proceed: true,
+  sessions: true,
+  tools: true,
+  token_saving: true,
+  brain: true,
+  mailbox: true,
+  enhance: true,
+  debug_stream: true,
+  next_steps: true
 };
+var STATUSLINE_CONFIG_KEYS = [
+  "version",
+  "state",
+  "model",
+  "context",
+  "tokens",
+  "cache",
+  "cost",
+  "queue",
+  "processes",
+  "hint",
+  "index",
+  "breaker",
+  "yolo",
+  "autonomy",
+  "eternal_stage",
+  "elapsed",
+  "project",
+  "working_dir",
+  "goal",
+  "mode",
+  "auto_proceed",
+  "git",
+  "sessions",
+  "tools",
+  "token_saving",
+  "todos",
+  "plan",
+  "tasks",
+  "fleet",
+  "brain",
+  "debug_stream",
+  "enhance",
+  "next_steps",
+  "mailbox",
+  "fleet_agents"
+];
 function resolveConfigPath() {
   return process.env[CONFIG_ENV] ?? path4.join(process.env.HOME ?? "", ".wrongstack", "statusline.json");
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeStatuslineConfig(value) {
+  const cfg = { ...DEFAULTS };
+  if (!isRecord(value)) return cfg;
+  for (const key of STATUSLINE_CONFIG_KEYS) {
+    const raw = value[key];
+    if (typeof raw === "boolean") cfg[key] = raw;
+  }
+  return cfg;
+}
+function isMissingKnownStatuslineKeys(value) {
+  if (!isRecord(value)) return true;
+  return STATUSLINE_CONFIG_KEYS.some((key) => typeof value[key] !== "boolean");
+}
+function hasFsCode(err, code) {
+  return isRecord(err) && err["code"] === code;
+}
 async function loadStatuslineConfig() {
   const p = resolveConfigPath();
   try {
     const raw = await fs4.readFile(p, "utf8");
-    return { ...DEFAULTS, ...JSON.parse(raw) };
+    return normalizeStatuslineConfig(JSON.parse(raw));
   } catch {
     return { ...DEFAULTS };
   }
 }
+async function ensureStatuslineConfig() {
+  const p = resolveConfigPath();
+  try {
+    const raw = await fs4.readFile(p, "utf8");
+    const parsed = JSON.parse(raw);
+    const cfg = normalizeStatuslineConfig(parsed);
+    if (isMissingKnownStatuslineKeys(parsed)) {
+      await saveStatuslineConfig(cfg);
+    }
+    return cfg;
+  } catch (err) {
+    if (hasFsCode(err, "ENOENT")) {
+      const cfg = { ...DEFAULTS };
+      await saveStatuslineConfig(cfg);
+      return cfg;
+    }
+    return { ...DEFAULTS };
+  }
+}
 async function saveStatuslineConfig(cfg) {
   const p = resolveConfigPath();
   try {
@@ -19528,27 +19466,43 @@ async function saveStatuslineConfig(cfg) {
   }
 }
 var ITEM_DESCRIPTIONS = {
+  version: "WrongStack version chip",
+  state: "Agent run state / thinking spinner",
+  model: "Current provider/model id",
   todos: "Todo items (pending/in-progress/done counts)",
   plan: "Plan board items (open/in-progress/done)",
   tasks: "Task board items (structured work with type/priority)",
   fleet: "Fleet agent status (running/idle/pending/completed)",
+  fleet_agents: "Per-agent live detail row",
   git: "Git branch name",
   elapsed: "Session elapsed time",
   context: "Context window usage (input tokens)",
+  tokens: "Input/output token counters",
+  cache: "Prompt cache hit ratio",
   cost: "Token cost estimate (input/output/total)",
-  working_dir: "Current working directory"
+  queue: "Queued prompt count",
+  processes: "Tracked shell/process count",
+  hint: "Transient status hint text",
+  index: "Codebase indexing status",
+  breaker: "Process breaker countdown",
+  working_dir: "Current working directory",
+  project: "Project name",
+  yolo: "YOLO permission mode",
+  autonomy: "Autonomy mode",
+  eternal_stage: "Autonomy stage",
+  goal: "Active goal summary",
+  mode: "Active agent mode label",
+  auto_proceed: "Auto-proceed countdown",
+  sessions: "Live session count",
+  tools: "Registered tool count",
+  token_saving: "Token-saving mode indicator",
+  brain: "Brain arbiter decisions",
+  mailbox: "Mailbox unread messages and peers",
+  enhance: "Prompt-enhance countdown",
+  debug_stream: "Stream debug telemetry",
+  next_steps: "Next-step auto-submit countdown"
 };
-var ALL_CONFIG_KEYS = [
-  "todos",
-  "plan",
-  "tasks",
-  "fleet",
-  "git",
-  "elapsed",
-  "context",
-  "cost",
-  "working_dir"
-];
+var ALL_CONFIG_KEYS = STATUSLINE_CONFIG_KEYS;
 function buildStatuslineCommand(deps) {
   return {
     name: "statusline",
@@ -21903,6 +21857,388 @@ function summarize(value, name) {
 
 // src/boot.ts
 init_project_utils();
+
+// src/auth-menu/openai-codex-oauth.ts
+init_provider_config_utils();
+var CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+var AUTH_BASE_URL = "https://auth.openai.com";
+var AUTHORIZE_URL = `${AUTH_BASE_URL}/oauth/authorize`;
+var TOKEN_URL = `${AUTH_BASE_URL}/oauth/token`;
+var REDIRECT_PORT = 1455;
+var REDIRECT_HOST = "127.0.0.1";
+var REDIRECT_PATH = "/auth/callback";
+var REDIRECT_URI = `http://localhost:${REDIRECT_PORT}${REDIRECT_PATH}`;
+var SCOPE = "openid profile email offline_access";
+var JWT_CLAIM_PATH = "https://api.openai.com/auth";
+var ORIGINATOR = "wrongstack";
+var CODEX_PROVIDER_ID = "openai-codex";
+var CODEX_BASE_URL = "https://chatgpt.com/backend-api";
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generatePkce() {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function createState() {
+  return randomBytes(16).toString("hex");
+}
+function buildAuthorizeUrl(challenge, state) {
+  const url = new URL(AUTHORIZE_URL);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", CLIENT_ID);
+  url.searchParams.set("redirect_uri", REDIRECT_URI);
+  url.searchParams.set("scope", SCOPE);
+  url.searchParams.set("code_challenge", challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("state", state);
+  url.searchParams.set("id_token_add_organizations", "true");
+  url.searchParams.set("codex_cli_simplified_flow", "true");
+  url.searchParams.set("originator", ORIGINATOR);
+  return url.toString();
+}
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const json = Buffer.from(parts[1], "base64url").toString("utf8");
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+function extractAccountId(token) {
+  const payload = decodeJwtPayload(token);
+  const auth = payload?.[JWT_CLAIM_PATH];
+  const id = auth?.chatgpt_account_id;
+  return typeof id === "string" && id.length > 0 ? id : null;
+}
+var FALLBACK_CODEX_MODELS = CODEX_MODELS.map(
+  (m) => ({ id: m.id, name: m.name })
+);
+var CODEX_CATALOG_FAMILIES = /* @__PURE__ */ new Set(["gpt-codex", "gpt-codex-spark"]);
+function fallbackCodexModelIds() {
+  return FALLBACK_CODEX_MODELS.map((m) => m.id);
+}
+function fallbackCodexProviderModels() {
+  return FALLBACK_CODEX_MODELS.map((m) => ({ id: m.id, name: m.name }));
+}
+function filterCurrentCodexModelIds(ids) {
+  const available = new Set(ids);
+  return FALLBACK_CODEX_MODELS.map((m) => m.id).filter((id) => available.has(id));
+}
+function isCodexCatalogModel(model) {
+  return typeof model.family === "string" && CODEX_CATALOG_FAMILIES.has(model.family);
+}
+async function resolveCodexModels(modelsRegistry, accessToken, baseUrl, signal) {
+  const token = typeof accessToken === "string" ? accessToken : await accessToken;
+  const live = filterCurrentCodexModelIds(await fetchCodexModels(token, baseUrl, signal));
+  if (live.length > 0) return live;
+  try {
+    const openaiProvider = await modelsRegistry.getProvider("openai");
+    if (openaiProvider) {
+      const catalog = openaiProvider.models.filter(isCodexCatalogModel).map((m) => m.id).filter((id) => typeof id === "string" && id.length > 0);
+      const currentCatalog = filterCurrentCodexModelIds(catalog);
+      if (currentCatalog.length > 0) return currentCatalog;
+    }
+  } catch {
+  }
+  return fallbackCodexModelIds();
+}
+async function fetchCodexModels(accessToken, baseUrl, signal) {
+  const url = `${(baseUrl).replace(/\/+$/, "")}/models`;
+  try {
+    const res = await fetch(url, {
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${accessToken}`,
+        originator: "wrongstack",
+        "OpenAI-Beta": "responses=experimental"
+      },
+      signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(8e3)]) : AbortSignal.timeout(8e3)
+    });
+    if (!res.ok) return [];
+    const json = await res.json();
+    if (!json) return [];
+    const rawList = "data" in json && Array.isArray(json.data) ? json.data : "models" in json && Array.isArray(json.models) ? json.models : [];
+    const ids = [];
+    for (const entry of rawList) {
+      if (!entry || typeof entry !== "object") continue;
+      const id = entry.id;
+      if (typeof id === "string" && id.length > 0) ids.push(id);
+    }
+    return ids;
+  } catch {
+    return [];
+  }
+}
+async function readTokens(res, op) {
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Codex token ${op} failed (${res.status}): ${text || res.statusText}`);
+  }
+  const json = await res.json();
+  if (!json?.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
+    throw new Error(`Codex token ${op} response missing fields`);
+  }
+  return {
+    access: json.access_token,
+    refresh: json.refresh_token,
+    expires: Date.now() + json.expires_in * 1e3
+  };
+}
+async function exchangeAuthorizationCode(code, verifier, signal) {
+  const res = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID,
+      code,
+      code_verifier: verifier,
+      redirect_uri: REDIRECT_URI
+    }).toString(),
+    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(3e4)]) : AbortSignal.timeout(3e4)
+  });
+  return readTokens(res, "exchange");
+}
+function callbackHtml(ok, message) {
+  const heading = ok ? "Authentication successful" : "Authentication failed";
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"/><title>${heading}</title><style>body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#09090b;color:#fafafa;font-family:ui-sans-serif,system-ui,sans-serif;text-align:center}h1{font-size:26px;margin:0 0 8px}p{color:#a1a1aa}</style></head><body><main><h1>${heading}</h1><p>${message}</p></main></body></html>`;
+}
+function startLoopbackServer(state) {
+  let resolveCode = () => {
+  };
+  const codePromise = new Promise((resolve13) => {
+    let settled = false;
+    resolveCode = (v) => {
+      if (settled) return;
+      settled = true;
+      resolve13(v);
+    };
+  });
+  const server = createServer((req2, res) => {
+    let url;
+    try {
+      url = new URL(req2.url ?? "", `http://${REDIRECT_HOST}`);
+    } catch {
+      res.statusCode = 400;
+      res.end();
+      return;
+    }
+    if (url.pathname !== REDIRECT_PATH) {
+      res.statusCode = 404;
+      res.setHeader("content-type", "text/html; charset=utf-8");
+      res.end(callbackHtml(false, "Callback route not found."));
+      return;
+    }
+    res.setHeader("content-type", "text/html; charset=utf-8");
+    const err = url.searchParams.get("error");
+    if (err) {
+      res.statusCode = 400;
+      res.end(callbackHtml(false, `Authorization error: ${err}`));
+      resolveCode(null);
+      return;
+    }
+    if (url.searchParams.get("state") !== state) {
+      res.statusCode = 400;
+      res.end(callbackHtml(false, "State mismatch \u2014 please restart the login."));
+      resolveCode(null);
+      return;
+    }
+    const code = url.searchParams.get("code");
+    if (!code) {
+      res.statusCode = 400;
+      res.end(callbackHtml(false, "Missing authorization code."));
+      return;
+    }
+    res.statusCode = 200;
+    res.end(callbackHtml(true, "You can close this window and return to the terminal."));
+    resolveCode(code);
+  });
+  return new Promise((resolve13) => {
+    server.on("error", () => {
+      resolveCode(null);
+      resolve13({
+        bound: false,
+        waitForCode: () => Promise.resolve(null),
+        close: () => {
+          try {
+            server.close();
+          } catch {
+          }
+        }
+      });
+    });
+    server.listen(REDIRECT_PORT, REDIRECT_HOST, () => {
+      resolve13({
+        bound: true,
+        waitForCode: () => codePromise,
+        close: () => {
+          resolveCode(null);
+          try {
+            server.close();
+          } catch {
+          }
+        }
+      });
+    });
+  });
+}
+function openBrowser(url) {
+  try {
+    const platform3 = process.platform;
+    const { command: command2, args } = platform3 === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : platform3 === "darwin" ? { command: "open", args: [url] } : { command: "xdg-open", args: [url] };
+    const child = spawn(command2, args, { stdio: "ignore", windowsHide: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+function parseAuthorizationInput(input) {
+  const value = input.trim();
+  if (!value) return {};
+  try {
+    const url = new URL(value);
+    return {
+      code: url.searchParams.get("code") ?? void 0,
+      state: url.searchParams.get("state") ?? void 0
+    };
+  } catch {
+  }
+  if (value.includes("code=")) {
+    const params = new URLSearchParams(value);
+    return {
+      code: params.get("code") ?? void 0,
+      state: params.get("state") ?? void 0
+    };
+  }
+  return { code: value };
+}
+async function runCodexOAuthLogin(deps, opts = {}) {
+  const providerId = opts.providerId ?? CODEX_PROVIDER_ID;
+  const pkce = generatePkce();
+  const state = createState();
+  const authorizeUrl = buildAuthorizeUrl(pkce.challenge, state);
+  const ac = new AbortController();
+  const onSig = () => ac.abort();
+  process.on("SIGINT", onSig);
+  const server = await startLoopbackServer(state);
+  deps.renderer.write(
+    color.bold(`
+  Sign in with ChatGPT \u2014 ${color.cyan(providerId)}
+`) + color.dim("  Uses your ChatGPT Plus/Pro/Team subscription (not an API key).\n") + color.amber("  \u26A0 Using a subscription outside the official Codex client may violate\n") + color.amber("    OpenAI\u2019s Terms \u2014 your account could be rate-limited or banned.\n") + color.dim("    Sanctioned programmatic use = an API key: ") + color.bold("wstack auth openai") + color.dim("\n\n") + color.bold(`  ${"\u2500".repeat(56)}
+`) + color.bold("  Open this URL in your browser to sign in:\n") + color.cyan(`  ${authorizeUrl}
+`) + color.bold(`  ${"\u2500".repeat(56)}
+
+`)
+  );
+  if (server.bound) {
+    openBrowser(authorizeUrl);
+    deps.renderer.write(
+      color.dim("  A browser window should open. Waiting for you to finish signing in...\n") + color.dim("  (Listening on http://localhost:1455 \u2014 press Ctrl+C to cancel.)\n")
+    );
+  } else {
+    deps.renderer.write(
+      color.amber("  \u26A0 Could not start the local callback listener (port 1455 in use).\n") + color.dim("  After signing in, copy the full redirect URL from your browser\n") + color.dim("  (it starts with http://localhost:1455/auth/callback) and paste it below.\n")
+    );
+  }
+  let code;
+  try {
+    if (server.bound) {
+      const got = await server.waitForCode();
+      if (got) code = got;
+    }
+    if (!code) {
+      const input = (await deps.reader.readLine(
+        `
+  ${color.amber("?")} Paste the redirect URL or code ${color.dim("(or q to cancel)")}: `
+      )).trim();
+      if (input.toLowerCase() === "q" || input === "") {
+        deps.renderer.write(color.dim("  Cancelled.\n"));
+        return 1;
+      }
+      const parsed = parseAuthorizationInput(input);
+      if (parsed.state && parsed.state !== state) {
+        deps.renderer.writeError("  State mismatch \u2014 please restart the login flow.");
+        return 1;
+      }
+      code = parsed.code;
+    }
+    if (!code) {
+      deps.renderer.writeError("  No authorization code received.");
+      return 1;
+    }
+    deps.renderer.write(color.dim("\n  Exchanging authorization code for tokens...\n"));
+    const tokens = await exchangeAuthorizationCode(code, pkce.verifier, ac.signal);
+    const accountId = extractAccountId(tokens.access);
+    if (!accountId) {
+      deps.renderer.writeError(
+        "  Signed in, but the token has no ChatGPT account id.\n  This account may not have Codex/ChatGPT subscription access."
+      );
+      return 1;
+    }
+    deps.renderer.write(color.dim("  Fetching available models...\n"));
+    const models = await resolveCodexModels(
+      deps.modelsRegistry,
+      tokens.access,
+      CODEX_BASE_URL,
+      ac.signal
+    );
+    const saved = await saveCodexTokens(deps, providerId, tokens, accountId, models);
+    if (!saved) return 1;
+    const modelHint = models[0] ?? "gpt-5.5";
+    deps.renderer.write(color.green("\n  \u2713 Signed in with ChatGPT!\n"));
+    deps.renderer.writeInfo(
+      `  Saved as provider ${color.bold(providerId)}${models.length > 0 ? ` (${models.length} models)` : ""}.
+  Use: ${color.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
+` + color.dim("  Tokens refresh automatically before they expire.\n")
+    );
+    return 0;
+  } catch (err) {
+    const msg = err instanceof DOMException && err.name === "AbortError" ? "Login cancelled." : err.message;
+    deps.renderer.writeError(`  Login failed: ${msg}`);
+    return 1;
+  } finally {
+    server.close();
+    process.off("SIGINT", onSig);
+  }
+}
+async function saveCodexTokens(deps, providerId, tokens, accountId, models) {
+  const entry = {
+    label: "oauth-default",
+    apiKey: tokens.access,
+    createdAt: nowIso(),
+    authMethod: "oauth",
+    expiresAt: new Date(tokens.expires).toISOString(),
+    refreshToken: tokens.refresh,
+    tokenType: "bearer",
+    scope: SCOPE,
+    accountId
+  };
+  try {
+    await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
+      const existing = all[providerId];
+      const p = existing ? { ...existing } : { type: providerId };
+      p.family = "openai-codex";
+      if (!p.baseUrl) p.baseUrl = CODEX_BASE_URL;
+      p.models = [...models];
+      const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
+      keys.push(entry);
+      writeKeysBack(p, keys);
+      p.activeKey = entry.label;
+      all[providerId] = p;
+    });
+    return true;
+  } catch (err) {
+    deps.renderer.writeError(`  Failed to save tokens: ${err.message}`);
+    return false;
+  }
+}
+
+// src/wiring/provider.ts
 async function setupProvider(params) {
   const { config, modelsRegistry, logger } = params;
   const savedProviderCfg = config.providers?.[config.provider];
@@ -21912,13 +22248,36 @@ async function setupProvider(params) {
   }
   if (!resolvedProvider) {
     if (savedProviderCfg?.family) {
+      const family = savedProviderCfg.family;
+      const savedModels = savedProviderCfg.models;
+      let models;
+      if (savedModels && savedModels.length > 0) {
+        models = savedModels.map((m) => ({ id: m, name: m }));
+      } else if (family === "openai-codex") {
+        const openaiProvider = await modelsRegistry.getProvider("openai").catch(() => void 0);
+        if (openaiProvider) {
+          const catalogById = new Map(
+            openaiProvider.models.filter(isCodexCatalogModel).map((m) => [m.id, { id: m.id, name: m.name }])
+          );
+          const catalogModels = filterCurrentCodexModelIds(catalogById.keys()).map((id) => catalogById.get(id)).filter((m) => Boolean(m));
+          if (catalogModels.length > 0) {
+            models = catalogModels;
+          } else {
+            models = fallbackCodexProviderModels();
+          }
+        } else {
+          models = fallbackCodexProviderModels();
+        }
+      } else {
+        models = [];
+      }
       resolvedProvider = {
         id: config.provider,
         name: config.provider,
-        family: savedProviderCfg.family,
+        family,
         apiBase: savedProviderCfg.baseUrl,
         envVars: savedProviderCfg.envVars ?? [],
-        models: (savedProviderCfg.models ?? []).map((m) => ({ id: m, name: m })),
+        models,
         npm: void 0
       };
     } else {
@@ -21965,6 +22324,15 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
   } catch (err) {
     throw new Error(`Failed to create provider: ${err instanceof Error ? err.message : err}`);
   }
+  if (config.features.modelsRegistry) {
+    provider = await withCatalogCapabilities(
+      modelsRegistry,
+      config.provider,
+      provider,
+      { ...providerConfig, type: config.provider, model: config.model },
+      logger
+    );
+  }
   return { resolvedProvider, provider, providerRegistry };
 }
 
@@ -22667,38 +23035,38 @@ init_provider_config_utils();
 
 // src/auth-menu/anthropic-oauth.ts
 init_provider_config_utils();
-var CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-var TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
-var REDIRECT_PORT = 53692;
-var REDIRECT_HOST = "127.0.0.1";
-var REDIRECT_PATH = "/callback";
-var REDIRECT_URI = `http://localhost:${REDIRECT_PORT}${REDIRECT_PATH}`;
+var CLIENT_ID2 = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+var AUTHORIZE_URL2 = "https://claude.ai/oauth/authorize";
+var TOKEN_URL2 = "https://platform.claude.com/v1/oauth/token";
+var REDIRECT_PORT2 = 53692;
+var REDIRECT_HOST2 = "127.0.0.1";
+var REDIRECT_PATH2 = "/callback";
+var REDIRECT_URI2 = `http://localhost:${REDIRECT_PORT2}${REDIRECT_PATH2}`;
 var SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
 var CLAUDE_PROVIDER_ID = "anthropic-oauth";
 var CLAUDE_BASE_URL = "https://api.anthropic.com";
-function base64url(buf) {
+function base64url2(buf) {
   return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function generatePkce() {
-  const verifier = base64url(randomBytes(32));
-  const challenge = base64url(createHash("sha256").update(verifier).digest());
+function generatePkce2() {
+  const verifier = base64url2(randomBytes(32));
+  const challenge = base64url2(createHash("sha256").update(verifier).digest());
   return { verifier, challenge };
 }
-function buildAuthorizeUrl(challenge, verifier) {
+function buildAuthorizeUrl2(challenge, verifier) {
   const params = new URLSearchParams({
     code: "true",
-    client_id: CLIENT_ID,
+    client_id: CLIENT_ID2,
     response_type: "code",
-    redirect_uri: REDIRECT_URI,
+    redirect_uri: REDIRECT_URI2,
     scope: SCOPES,
     code_challenge: challenge,
     code_challenge_method: "S256",
     state: verifier
   });
-  return `${AUTHORIZE_URL}?${params.toString()}`;
+  return `${AUTHORIZE_URL2}?${params.toString()}`;
 }
-function parseAuthorizationInput(input) {
+function parseAuthorizationInput2(input) {
   const value = input.trim();
   if (!value) return {};
   try {
@@ -22722,7 +23090,7 @@ function parseAuthorizationInput(input) {
   }
   return { code: value };
 }
-async function readTokens(res, op) {
+async function readTokens2(res, op) {
   if (!res.ok) {
     const text = await res.text().catch(() => "");
     throw new Error(`Claude token ${op} failed (${res.status}): ${text || res.statusText}`);
@@ -22737,21 +23105,21 @@ async function readTokens(res, op) {
     expires: Date.now() + json.expires_in * 1e3
   };
 }
-async function exchangeAuthorizationCode(code, state, verifier, signal) {
-  const res = await fetch(TOKEN_URL, {
+async function exchangeAuthorizationCode2(code, state, verifier, signal) {
+  const res = await fetch(TOKEN_URL2, {
     method: "POST",
     headers: { "content-type": "application/json", accept: "application/json" },
     body: JSON.stringify({
       grant_type: "authorization_code",
-      client_id: CLIENT_ID,
+      client_id: CLIENT_ID2,
       code,
       state,
-      redirect_uri: REDIRECT_URI,
+      redirect_uri: REDIRECT_URI2,
       code_verifier: verifier
     }),
     signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(3e4)]) : AbortSignal.timeout(3e4)
   });
-  return readTokens(res, "exchange");
+  return readTokens2(res, "exchange");
 }
 async function fetchClaudeModels(accessToken, signal) {
   try {
@@ -22772,11 +23140,11 @@ async function fetchClaudeModels(accessToken, signal) {
     return [];
   }
 }
-function callbackHtml(ok, message) {
+function callbackHtml2(ok, message) {
   const heading = ok ? "Authentication successful" : "Authentication failed";
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"/><title>${heading}</title><style>body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#09090b;color:#fafafa;font-family:ui-sans-serif,system-ui,sans-serif;text-align:center}h1{font-size:26px;margin:0 0 8px}p{color:#a1a1aa}</style></head><body><main><h1>${heading}</h1><p>${message}</p></main></body></html>`;
 }
-function startLoopbackServer(expectedState) {
+function startLoopbackServer2(expectedState) {
   let resolveCode = () => {
   };
   const codePromise = new Promise((resolve13) => {
@@ -22790,23 +23158,23 @@ function startLoopbackServer(expectedState) {
   const server = createServer((req2, res) => {
     let url;
     try {
-      url = new URL(req2.url ?? "", `http://${REDIRECT_HOST}`);
+      url = new URL(req2.url ?? "", `http://${REDIRECT_HOST2}`);
     } catch {
       res.statusCode = 400;
       res.end();
       return;
     }
-    if (url.pathname !== REDIRECT_PATH) {
+    if (url.pathname !== REDIRECT_PATH2) {
       res.statusCode = 404;
       res.setHeader("content-type", "text/html; charset=utf-8");
-      res.end(callbackHtml(false, "Callback route not found."));
+      res.end(callbackHtml2(false, "Callback route not found."));
       return;
     }
     res.setHeader("content-type", "text/html; charset=utf-8");
     const err = url.searchParams.get("error");
     if (err) {
       res.statusCode = 400;
-      res.end(callbackHtml(false, `Authorization error: ${err}`));
+      res.end(callbackHtml2(false, `Authorization error: ${err}`));
       resolveCode(null);
       return;
     }
@@ -22814,17 +23182,17 @@ function startLoopbackServer(expectedState) {
     const state = url.searchParams.get("state");
     if (!code || !state) {
       res.statusCode = 400;
-      res.end(callbackHtml(false, "Missing code or state."));
+      res.end(callbackHtml2(false, "Missing code or state."));
       return;
     }
     if (state !== expectedState) {
       res.statusCode = 400;
-      res.end(callbackHtml(false, "State mismatch \u2014 please restart the login."));
+      res.end(callbackHtml2(false, "State mismatch \u2014 please restart the login."));
       resolveCode(null);
       return;
     }
     res.statusCode = 200;
-    res.end(callbackHtml(true, "You can close this window and return to the terminal."));
+    res.end(callbackHtml2(true, "You can close this window and return to the terminal."));
     resolveCode({ code, state });
   });
   return new Promise((resolve13) => {
@@ -22841,7 +23209,7 @@ function startLoopbackServer(expectedState) {
         }
       });
     });
-    server.listen(REDIRECT_PORT, REDIRECT_HOST, () => {
+    server.listen(REDIRECT_PORT2, REDIRECT_HOST2, () => {
       resolve13({
         bound: true,
         waitForCode: () => codePromise,
@@ -22856,7 +23224,7 @@ function startLoopbackServer(expectedState) {
     });
   });
 }
-function openBrowser(url) {
+function openBrowser2(url) {
   try {
     const platform3 = process.platform;
     const { command: command2, args } = platform3 === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : platform3 === "darwin" ? { command: "open", args: [url] } : { command: "xdg-open", args: [url] };
@@ -22869,13 +23237,13 @@ function openBrowser(url) {
 }
 async function runClaudeOAuthLogin(deps, opts = {}) {
   const providerId = opts.providerId ?? CLAUDE_PROVIDER_ID;
-  const { verifier, challenge } = generatePkce();
+  const { verifier, challenge } = generatePkce2();
   const state = verifier;
-  const authorizeUrl = buildAuthorizeUrl(challenge, verifier);
+  const authorizeUrl = buildAuthorizeUrl2(challenge, verifier);
   const ac = new AbortController();
   const onSig = () => ac.abort();
   process.on("SIGINT", onSig);
-  const server = await startLoopbackServer(state);
+  const server = await startLoopbackServer2(state);
   deps.renderer.write(
     color.bold(`
   Sign in with Claude \u2014 ${color.cyan(providerId)}
@@ -22886,7 +23254,7 @@ async function runClaudeOAuthLogin(deps, opts = {}) {
 `)
   );
   if (server.bound) {
-    openBrowser(authorizeUrl);
+    openBrowser2(authorizeUrl);
     deps.renderer.write(
       color.dim("  A browser window should open. Waiting for you to finish signing in...\n") + color.dim("  (Listening on http://localhost:53692 \u2014 press Ctrl+C to cancel.)\n")
     );
@@ -22904,527 +23272,6 @@ async function runClaudeOAuthLogin(deps, opts = {}) {
     if (!code) {
       const input = (await deps.reader.readLine(
         `
-  ${color.amber("?")} Paste the redirect URL or code ${color.dim("(or q to cancel)")}: `
-      )).trim();
-      if (input.toLowerCase() === "q" || input === "") {
-        deps.renderer.write(color.dim("  Cancelled.\n"));
-        return 1;
-      }
-      const parsed = parseAuthorizationInput(input);
-      if (parsed.state && parsed.state !== state) {
-        deps.renderer.writeError("  State mismatch \u2014 please restart the login flow.");
-        return 1;
-      }
-      code = parsed.code;
-    }
-    if (!code) {
-      deps.renderer.writeError("  No authorization code received.");
-      return 1;
-    }
-    deps.renderer.write(color.dim("\n  Exchanging authorization code for tokens...\n"));
-    const tokens = await exchangeAuthorizationCode(code, state, verifier, ac.signal);
-    const models = await fetchClaudeModels(tokens.access, ac.signal);
-    const saved = await saveClaudeTokens(deps, providerId, tokens, models);
-    if (!saved) return 1;
-    deps.renderer.write(color.green("\n  \u2713 Signed in with Claude!\n"));
-    const modelHint = models.find((m) => m.includes("sonnet")) ?? models[0] ?? "claude-sonnet-4-6";
-    deps.renderer.writeInfo(
-      `  Saved as provider ${color.bold(providerId)}${models.length ? ` (${models.length} models)` : ""}.
-  Use: ${color.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
-` + color.dim("  Tokens refresh automatically before they expire.\n")
-    );
-    return 0;
-  } catch (err) {
-    const msg = err instanceof DOMException && err.name === "AbortError" ? "Login cancelled." : err.message;
-    deps.renderer.writeError(`  Login failed: ${msg}`);
-    return 1;
-  } finally {
-    server.close();
-    process.off("SIGINT", onSig);
-  }
-}
-async function saveClaudeTokens(deps, providerId, tokens, models) {
-  const entry = {
-    label: "oauth-default",
-    apiKey: tokens.access,
-    createdAt: nowIso(),
-    authMethod: "oauth",
-    expiresAt: new Date(tokens.expires).toISOString(),
-    refreshToken: tokens.refresh,
-    tokenType: "bearer",
-    scope: SCOPES
-  };
-  try {
-    await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
-      const existing = all[providerId];
-      const p = existing ? { ...existing } : { type: providerId };
-      p.family = "anthropic-oauth";
-      if (!p.baseUrl) p.baseUrl = CLAUDE_BASE_URL;
-      if (models.length > 0) p.models = models;
-      else if (!p.models || p.models.length === 0)
-        p.models = ["claude-sonnet-4-6", "claude-opus-4-8"];
-      const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
-      keys.push(entry);
-      writeKeysBack(p, keys);
-      p.activeKey = entry.label;
-      all[providerId] = p;
-    });
-    return true;
-  } catch (err) {
-    deps.renderer.writeError(`  Failed to save tokens: ${err.message}`);
-    return false;
-  }
-}
-
-// src/auth-menu/github-copilot-oauth.ts
-init_provider_config_utils();
-var CLIENT_ID2 = "Iv1.b507a08c87ecfe98";
-var DEVICE_CODE_URL = "https://github.com/login/device/code";
-var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
-var COPILOT_HEADERS = {
-  "User-Agent": "GitHubCopilotChat/0.35.0",
-  "Editor-Version": "vscode/1.107.0",
-  "Editor-Plugin-Version": "copilot-chat/0.35.0",
-  "Copilot-Integration-Id": "vscode-chat"
-};
-var COPILOT_API_VERSION = "2026-06-01";
-var COPILOT_PROVIDER_ID = "github-copilot";
-function openBrowser2(url) {
-  try {
-    const platform3 = process.platform;
-    const { command: command2, args } = platform3 === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : platform3 === "darwin" ? { command: "open", args: [url] } : { command: "xdg-open", args: [url] };
-    const child = spawn(command2, args, { stdio: "ignore", windowsHide: true });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
-}
-function sleep(ms, signal) {
-  return new Promise((resolve13, reject) => {
-    if (signal.aborted) return reject(new DOMException("Aborted", "AbortError"));
-    const t = setTimeout(resolve13, ms);
-    signal.addEventListener(
-      "abort",
-      () => {
-        clearTimeout(t);
-        reject(new DOMException("Aborted", "AbortError"));
-      },
-      { once: true }
-    );
-  });
-}
-async function startDeviceFlow(signal) {
-  const res = await fetch(DEVICE_CODE_URL, {
-    method: "POST",
-    headers: {
-      accept: "application/json",
-      "content-type": "application/x-www-form-urlencoded",
-      "user-agent": COPILOT_HEADERS["User-Agent"]
-    },
-    body: new URLSearchParams({ client_id: CLIENT_ID2, scope: "read:user" }).toString(),
-    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15e3)]) : AbortSignal.timeout(15e3)
-  });
-  if (!res.ok) throw new Error(`GitHub device-code request failed (${res.status})`);
-  const json = await res.json();
-  if (!json?.device_code || !json.user_code || !json.verification_uri || typeof json.expires_in !== "number") {
-    throw new Error("Invalid device-code response");
-  }
-  return {
-    device_code: json.device_code,
-    user_code: json.user_code,
-    verification_uri: json.verification_uri,
-    interval: json.interval ?? 5,
-    expires_in: json.expires_in
-  };
-}
-async function pollForGitHubToken(device, signal) {
-  let intervalMs = device.interval * 1e3;
-  const expiresAt = Date.now() + device.expires_in * 1e3;
-  while (Date.now() < expiresAt) {
-    await sleep(intervalMs, signal);
-    const res = await fetch(ACCESS_TOKEN_URL, {
-      method: "POST",
-      headers: {
-        accept: "application/json",
-        "content-type": "application/x-www-form-urlencoded",
-        "user-agent": COPILOT_HEADERS["User-Agent"]
-      },
-      body: new URLSearchParams({
-        client_id: CLIENT_ID2,
-        device_code: device.device_code,
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-      }).toString(),
-      signal: AbortSignal.any([signal, AbortSignal.timeout(15e3)])
-    });
-    const json = await res.json().catch(() => ({}));
-    if (json.access_token) return json.access_token;
-    if (json.error === "authorization_pending") continue;
-    if (json.error === "slow_down") {
-      intervalMs += 5e3;
-      continue;
-    }
-    throw new Error(`Device flow failed: ${json.error ?? "unknown error"}`);
-  }
-  throw new Error("Device code expired \u2014 please restart the login.");
-}
-function isUsableCopilotChatModel(item) {
-  if (typeof item.id !== "string" || item.id.length === 0) return false;
-  const cap = item.capabilities;
-  if (cap?.type !== "chat") return false;
-  if (cap.supports?.tool_calls !== true) return false;
-  const eps = item.supported_endpoints;
-  if (Array.isArray(eps) && !eps.includes("/chat/completions")) return false;
-  if (item.policy?.state === "disabled") return false;
-  if (item.vendor === "Experimental") return false;
-  return true;
-}
-async function fetchCopilotModels(copilotToken, signal) {
-  try {
-    const base = copilotBaseUrlFromToken(copilotToken);
-    const res = await fetch(`${base}/models`, {
-      headers: {
-        accept: "application/json",
-        authorization: `Bearer ${copilotToken}`,
-        "X-GitHub-Api-Version": COPILOT_API_VERSION,
-        ...COPILOT_HEADERS
-      },
-      signal: AbortSignal.any([signal, AbortSignal.timeout(8e3)])
-    });
-    if (!res.ok) return [];
-    const json = await res.json();
-    const data = json?.data;
-    if (!Array.isArray(data)) return [];
-    const usable = data.filter(isUsableCopilotChatModel);
-    usable.sort((a, b) => copilotModelRank(a) - copilotModelRank(b));
-    return usable.map((m) => m.id);
-  } catch {
-    return [];
-  }
-}
-function copilotModelRank(item) {
-  if (item.is_chat_default === true) return 0;
-  if (item.is_chat_fallback === true) return 1;
-  return 2;
-}
-async function runCopilotOAuthLogin(deps, opts = {}) {
-  const providerId = opts.providerId ?? COPILOT_PROVIDER_ID;
-  const ac = new AbortController();
-  const onSig = () => ac.abort();
-  process.on("SIGINT", onSig);
-  try {
-    deps.renderer.write(
-      color.bold(`
-  Sign in with GitHub Copilot \u2014 ${color.cyan(providerId)}
-`) + color.dim("  Uses your GitHub Copilot subscription (not an API key).\n") + color.amber("  \u26A0 Using Copilot outside its official editor integrations may violate\n") + color.amber("    GitHub\u2019s Terms \u2014 your account could be rate-limited or banned.\n\n")
-    );
-    const device = await startDeviceFlow(ac.signal);
-    deps.renderer.write(
-      color.bold(`  ${"\u2500".repeat(56)}
-`) + color.bold("  Open this URL and enter the code:\n") + color.cyan(`  ${device.verification_uri}
-`) + color.bold("  Code: ") + color.green(color.bold(device.user_code)) + "\n" + color.bold(`  ${"\u2500".repeat(56)}
-
-`)
-    );
-    openBrowser2(device.verification_uri);
-    deps.renderer.write(color.dim("  Waiting for you to authorize in the browser...\n"));
-    const githubToken = await pollForGitHubToken(device, ac.signal);
-    deps.renderer.write(color.dim("  Authorized. Fetching your Copilot token...\n"));
-    const copilot = await refreshCopilotToken(githubToken, ac.signal);
-    const models = await fetchCopilotModels(copilot.token, ac.signal);
-    const saved = await saveCopilotTokens(
-      deps,
-      providerId,
-      copilot.token,
-      githubToken,
-      copilot.expires,
-      models
-    );
-    if (!saved) return 1;
-    deps.renderer.write(color.green("\n  \u2713 Signed in with GitHub Copilot!\n"));
-    const modelHint = models[0] ?? "gpt-4o";
-    deps.renderer.writeInfo(
-      `  Saved as provider ${color.bold(providerId)}${models.length ? ` (${models.length} models)` : ""}.
-  Use: ${color.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
-` + color.dim("  The Copilot token refreshes automatically.\n")
-    );
-    return 0;
-  } catch (err) {
-    const msg = err instanceof DOMException && err.name === "AbortError" ? "Login cancelled." : err.message;
-    deps.renderer.writeError(`  Login failed: ${msg}`);
-    return 1;
-  } finally {
-    process.off("SIGINT", onSig);
-  }
-}
-async function saveCopilotTokens(deps, providerId, copilotToken, githubToken, expires, models) {
-  const entry = {
-    label: "oauth-default",
-    apiKey: copilotToken,
-    createdAt: nowIso(),
-    authMethod: "oauth",
-    expiresAt: new Date(expires).toISOString(),
-    refreshToken: githubToken,
-    tokenType: "bearer"
-  };
-  try {
-    await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
-      const existing = all[providerId];
-      const p = existing ? { ...existing } : { type: providerId };
-      p.family = "github-copilot";
-      if (!p.baseUrl) p.baseUrl = copilotBaseUrlFromToken(copilotToken);
-      if (models.length > 0) p.models = models;
-      else if (!p.models || p.models.length === 0) p.models = ["gpt-4o"];
-      const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
-      keys.push(entry);
-      writeKeysBack(p, keys);
-      p.activeKey = entry.label;
-      all[providerId] = p;
-    });
-    return true;
-  } catch (err) {
-    deps.renderer.writeError(`  Failed to save tokens: ${err.message}`);
-    return false;
-  }
-}
-
-// src/auth-menu/openai-codex-oauth.ts
-init_provider_config_utils();
-var CLIENT_ID3 = "app_EMoamEEZ73f0CkXaXp7hrann";
-var AUTH_BASE_URL = "https://auth.openai.com";
-var AUTHORIZE_URL2 = `${AUTH_BASE_URL}/oauth/authorize`;
-var TOKEN_URL2 = `${AUTH_BASE_URL}/oauth/token`;
-var REDIRECT_PORT2 = 1455;
-var REDIRECT_HOST2 = "127.0.0.1";
-var REDIRECT_PATH2 = "/auth/callback";
-var REDIRECT_URI2 = `http://localhost:${REDIRECT_PORT2}${REDIRECT_PATH2}`;
-var SCOPE = "openid profile email offline_access";
-var JWT_CLAIM_PATH = "https://api.openai.com/auth";
-var ORIGINATOR = "wrongstack";
-var CODEX_PROVIDER_ID = "openai-codex";
-var CODEX_BASE_URL = "https://chatgpt.com/backend-api";
-function base64url2(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function generatePkce2() {
-  const verifier = base64url2(randomBytes(32));
-  const challenge = base64url2(createHash("sha256").update(verifier).digest());
-  return { verifier, challenge };
-}
-function createState() {
-  return randomBytes(16).toString("hex");
-}
-function buildAuthorizeUrl2(challenge, state) {
-  const url = new URL(AUTHORIZE_URL2);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", CLIENT_ID3);
-  url.searchParams.set("redirect_uri", REDIRECT_URI2);
-  url.searchParams.set("scope", SCOPE);
-  url.searchParams.set("code_challenge", challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", state);
-  url.searchParams.set("id_token_add_organizations", "true");
-  url.searchParams.set("codex_cli_simplified_flow", "true");
-  url.searchParams.set("originator", ORIGINATOR);
-  return url.toString();
-}
-function decodeJwtPayload(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    const json = Buffer.from(parts[1], "base64url").toString("utf8");
-    return JSON.parse(json);
-  } catch {
-    return null;
-  }
-}
-function extractAccountId(token) {
-  const payload = decodeJwtPayload(token);
-  const auth = payload?.[JWT_CLAIM_PATH];
-  const id = auth?.chatgpt_account_id;
-  return typeof id === "string" && id.length > 0 ? id : null;
-}
-async function readTokens2(res, op) {
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Codex token ${op} failed (${res.status}): ${text || res.statusText}`);
-  }
-  const json = await res.json();
-  if (!json?.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
-    throw new Error(`Codex token ${op} response missing fields`);
-  }
-  return {
-    access: json.access_token,
-    refresh: json.refresh_token,
-    expires: Date.now() + json.expires_in * 1e3
-  };
-}
-async function exchangeAuthorizationCode2(code, verifier, signal) {
-  const res = await fetch(TOKEN_URL2, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: CLIENT_ID3,
-      code,
-      code_verifier: verifier,
-      redirect_uri: REDIRECT_URI2
-    }).toString(),
-    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(3e4)]) : AbortSignal.timeout(3e4)
-  });
-  return readTokens2(res, "exchange");
-}
-function callbackHtml2(ok, message) {
-  const heading = ok ? "Authentication successful" : "Authentication failed";
-  return `<!doctype html><html lang="en"><head><meta charset="utf-8"/><title>${heading}</title><style>body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#09090b;color:#fafafa;font-family:ui-sans-serif,system-ui,sans-serif;text-align:center}h1{font-size:26px;margin:0 0 8px}p{color:#a1a1aa}</style></head><body><main><h1>${heading}</h1><p>${message}</p></main></body></html>`;
-}
-function startLoopbackServer2(state) {
-  let resolveCode = () => {
-  };
-  const codePromise = new Promise((resolve13) => {
-    let settled = false;
-    resolveCode = (v) => {
-      if (settled) return;
-      settled = true;
-      resolve13(v);
-    };
-  });
-  const server = createServer((req2, res) => {
-    let url;
-    try {
-      url = new URL(req2.url ?? "", `http://${REDIRECT_HOST2}`);
-    } catch {
-      res.statusCode = 400;
-      res.end();
-      return;
-    }
-    if (url.pathname !== REDIRECT_PATH2) {
-      res.statusCode = 404;
-      res.setHeader("content-type", "text/html; charset=utf-8");
-      res.end(callbackHtml2(false, "Callback route not found."));
-      return;
-    }
-    res.setHeader("content-type", "text/html; charset=utf-8");
-    const err = url.searchParams.get("error");
-    if (err) {
-      res.statusCode = 400;
-      res.end(callbackHtml2(false, `Authorization error: ${err}`));
-      resolveCode(null);
-      return;
-    }
-    if (url.searchParams.get("state") !== state) {
-      res.statusCode = 400;
-      res.end(callbackHtml2(false, "State mismatch \u2014 please restart the login."));
-      resolveCode(null);
-      return;
-    }
-    const code = url.searchParams.get("code");
-    if (!code) {
-      res.statusCode = 400;
-      res.end(callbackHtml2(false, "Missing authorization code."));
-      return;
-    }
-    res.statusCode = 200;
-    res.end(callbackHtml2(true, "You can close this window and return to the terminal."));
-    resolveCode(code);
-  });
-  return new Promise((resolve13) => {
-    server.on("error", () => {
-      resolveCode(null);
-      resolve13({
-        bound: false,
-        waitForCode: () => Promise.resolve(null),
-        close: () => {
-          try {
-            server.close();
-          } catch {
-          }
-        }
-      });
-    });
-    server.listen(REDIRECT_PORT2, REDIRECT_HOST2, () => {
-      resolve13({
-        bound: true,
-        waitForCode: () => codePromise,
-        close: () => {
-          resolveCode(null);
-          try {
-            server.close();
-          } catch {
-          }
-        }
-      });
-    });
-  });
-}
-function openBrowser3(url) {
-  try {
-    const platform3 = process.platform;
-    const { command: command2, args } = platform3 === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : platform3 === "darwin" ? { command: "open", args: [url] } : { command: "xdg-open", args: [url] };
-    const child = spawn(command2, args, { stdio: "ignore", windowsHide: true });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
-}
-function parseAuthorizationInput2(input) {
-  const value = input.trim();
-  if (!value) return {};
-  try {
-    const url = new URL(value);
-    return {
-      code: url.searchParams.get("code") ?? void 0,
-      state: url.searchParams.get("state") ?? void 0
-    };
-  } catch {
-  }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value);
-    return {
-      code: params.get("code") ?? void 0,
-      state: params.get("state") ?? void 0
-    };
-  }
-  return { code: value };
-}
-async function runCodexOAuthLogin(deps, opts = {}) {
-  const providerId = opts.providerId ?? CODEX_PROVIDER_ID;
-  const pkce = generatePkce2();
-  const state = createState();
-  const authorizeUrl = buildAuthorizeUrl2(pkce.challenge, state);
-  const ac = new AbortController();
-  const onSig = () => ac.abort();
-  process.on("SIGINT", onSig);
-  const server = await startLoopbackServer2(state);
-  deps.renderer.write(
-    color.bold(`
-  Sign in with ChatGPT \u2014 ${color.cyan(providerId)}
-`) + color.dim("  Uses your ChatGPT Plus/Pro/Team subscription (not an API key).\n") + color.amber("  \u26A0 Using a subscription outside the official Codex client may violate\n") + color.amber("    OpenAI\u2019s Terms \u2014 your account could be rate-limited or banned.\n") + color.dim("    Sanctioned programmatic use = an API key: ") + color.bold("wstack auth openai") + color.dim("\n\n") + color.bold(`  ${"\u2500".repeat(56)}
-`) + color.bold("  Open this URL in your browser to sign in:\n") + color.cyan(`  ${authorizeUrl}
-`) + color.bold(`  ${"\u2500".repeat(56)}
-
-`)
-  );
-  if (server.bound) {
-    openBrowser3(authorizeUrl);
-    deps.renderer.write(
-      color.dim("  A browser window should open. Waiting for you to finish signing in...\n") + color.dim("  (Listening on http://localhost:1455 \u2014 press Ctrl+C to cancel.)\n")
-    );
-  } else {
-    deps.renderer.write(
-      color.amber("  \u26A0 Could not start the local callback listener (port 1455 in use).\n") + color.dim("  After signing in, copy the full redirect URL from your browser\n") + color.dim("  (it starts with http://localhost:1455/auth/callback) and paste it below.\n")
-    );
-  }
-  let code;
-  try {
-    if (server.bound) {
-      const got = await server.waitForCode();
-      if (got) code = got;
-    }
-    if (!code) {
-      const input = (await deps.reader.readLine(
-        `
   ${color.amber("?")} Paste the redirect URL or code ${color.dim("(or q to cancel)")}: `
       )).trim();
       if (input.toLowerCase() === "q" || input === "") {
@@ -23443,20 +23290,15 @@ async function runCodexOAuthLogin(deps, opts = {}) {
       return 1;
     }
     deps.renderer.write(color.dim("\n  Exchanging authorization code for tokens...\n"));
-    const tokens = await exchangeAuthorizationCode2(code, pkce.verifier, ac.signal);
-    const accountId = extractAccountId(tokens.access);
-    if (!accountId) {
-      deps.renderer.writeError(
-        "  Signed in, but the token has no ChatGPT account id.\n  This account may not have Codex/ChatGPT subscription access."
-      );
-      return 1;
-    }
-    const saved = await saveCodexTokens(deps, providerId, tokens, accountId);
+    const tokens = await exchangeAuthorizationCode2(code, state, verifier, ac.signal);
+    const models = await fetchClaudeModels(tokens.access, ac.signal);
+    const saved = await saveClaudeTokens(deps, providerId, tokens, models);
     if (!saved) return 1;
-    deps.renderer.write(color.green("\n  \u2713 Signed in with ChatGPT!\n"));
+    deps.renderer.write(color.green("\n  \u2713 Signed in with Claude!\n"));
+    const modelHint = models.find((m) => m.includes("sonnet")) ?? models[0] ?? "claude-sonnet-4-6";
     deps.renderer.writeInfo(
-      `  Saved as provider ${color.bold(providerId)}.
-  Use: ${color.bold(`wstack --provider ${providerId} --model gpt-5.5`)} "<task>"
+      `  Saved as provider ${color.bold(providerId)}${models.length ? ` (${models.length} models)` : ""}.
+  Use: ${color.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
 ` + color.dim("  Tokens refresh automatically before they expire.\n")
     );
     return 0;
@@ -23469,7 +23311,7 @@ async function runCodexOAuthLogin(deps, opts = {}) {
     process.off("SIGINT", onSig);
   }
 }
-async function saveCodexTokens(deps, providerId, tokens, accountId) {
+async function saveClaudeTokens(deps, providerId, tokens, models) {
   const entry = {
     label: "oauth-default",
     apiKey: tokens.access,
@@ -23478,18 +23320,229 @@ async function saveCodexTokens(deps, providerId, tokens, accountId) {
     expiresAt: new Date(tokens.expires).toISOString(),
     refreshToken: tokens.refresh,
     tokenType: "bearer",
-    scope: SCOPE,
-    accountId
+    scope: SCOPES
   };
   try {
     await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
       const existing = all[providerId];
       const p = existing ? { ...existing } : { type: providerId };
-      p.family = "openai-codex";
-      if (!p.baseUrl) p.baseUrl = CODEX_BASE_URL;
-      if (!p.models || p.models.length === 0) {
-        p.models = ["gpt-5.5", "gpt-5.4", "gpt-5.4-mini", "gpt-5.3-codex-spark"];
-      }
+      p.family = "anthropic-oauth";
+      if (!p.baseUrl) p.baseUrl = CLAUDE_BASE_URL;
+      if (models.length > 0) p.models = models;
+      else if (!p.models || p.models.length === 0)
+        p.models = ["claude-sonnet-4-6", "claude-opus-4-8"];
+      const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
+      keys.push(entry);
+      writeKeysBack(p, keys);
+      p.activeKey = entry.label;
+      all[providerId] = p;
+    });
+    return true;
+  } catch (err) {
+    deps.renderer.writeError(`  Failed to save tokens: ${err.message}`);
+    return false;
+  }
+}
+
+// src/auth-menu/github-copilot-oauth.ts
+init_provider_config_utils();
+var CLIENT_ID3 = "Iv1.b507a08c87ecfe98";
+var DEVICE_CODE_URL = "https://github.com/login/device/code";
+var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+var COPILOT_HEADERS = {
+  "User-Agent": "GitHubCopilotChat/0.35.0",
+  "Editor-Version": "vscode/1.107.0",
+  "Editor-Plugin-Version": "copilot-chat/0.35.0",
+  "Copilot-Integration-Id": "vscode-chat"
+};
+var COPILOT_API_VERSION = "2026-06-01";
+var COPILOT_PROVIDER_ID = "github-copilot";
+function openBrowser3(url) {
+  try {
+    const platform3 = process.platform;
+    const { command: command2, args } = platform3 === "win32" ? { command: "cmd", args: ["/c", "start", "", url] } : platform3 === "darwin" ? { command: "open", args: [url] } : { command: "xdg-open", args: [url] };
+    const child = spawn(command2, args, { stdio: "ignore", windowsHide: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+function sleep(ms, signal) {
+  return new Promise((resolve13, reject) => {
+    if (signal.aborted) return reject(new DOMException("Aborted", "AbortError"));
+    const t = setTimeout(resolve13, ms);
+    signal.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(t);
+        reject(new DOMException("Aborted", "AbortError"));
+      },
+      { once: true }
+    );
+  });
+}
+async function startDeviceFlow(signal) {
+  const res = await fetch(DEVICE_CODE_URL, {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      "content-type": "application/x-www-form-urlencoded",
+      "user-agent": COPILOT_HEADERS["User-Agent"]
+    },
+    body: new URLSearchParams({ client_id: CLIENT_ID3, scope: "read:user" }).toString(),
+    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15e3)]) : AbortSignal.timeout(15e3)
+  });
+  if (!res.ok) throw new Error(`GitHub device-code request failed (${res.status})`);
+  const json = await res.json();
+  if (!json?.device_code || !json.user_code || !json.verification_uri || typeof json.expires_in !== "number") {
+    throw new Error("Invalid device-code response");
+  }
+  return {
+    device_code: json.device_code,
+    user_code: json.user_code,
+    verification_uri: json.verification_uri,
+    interval: json.interval ?? 5,
+    expires_in: json.expires_in
+  };
+}
+async function pollForGitHubToken(device, signal) {
+  let intervalMs = device.interval * 1e3;
+  const expiresAt = Date.now() + device.expires_in * 1e3;
+  while (Date.now() < expiresAt) {
+    await sleep(intervalMs, signal);
+    const res = await fetch(ACCESS_TOKEN_URL, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/x-www-form-urlencoded",
+        "user-agent": COPILOT_HEADERS["User-Agent"]
+      },
+      body: new URLSearchParams({
+        client_id: CLIENT_ID3,
+        device_code: device.device_code,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+      }).toString(),
+      signal: AbortSignal.any([signal, AbortSignal.timeout(15e3)])
+    });
+    const json = await res.json().catch(() => ({}));
+    if (json.access_token) return json.access_token;
+    if (json.error === "authorization_pending") continue;
+    if (json.error === "slow_down") {
+      intervalMs += 5e3;
+      continue;
+    }
+    throw new Error(`Device flow failed: ${json.error ?? "unknown error"}`);
+  }
+  throw new Error("Device code expired \u2014 please restart the login.");
+}
+function isUsableCopilotChatModel(item) {
+  if (typeof item.id !== "string" || item.id.length === 0) return false;
+  const cap = item.capabilities;
+  if (cap?.type !== "chat") return false;
+  if (cap.supports?.tool_calls !== true) return false;
+  const eps = item.supported_endpoints;
+  if (Array.isArray(eps) && !eps.includes("/chat/completions")) return false;
+  if (item.policy?.state === "disabled") return false;
+  if (item.vendor === "Experimental") return false;
+  return true;
+}
+async function fetchCopilotModels(copilotToken, signal) {
+  try {
+    const base = copilotBaseUrlFromToken(copilotToken);
+    const res = await fetch(`${base}/models`, {
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${copilotToken}`,
+        "X-GitHub-Api-Version": COPILOT_API_VERSION,
+        ...COPILOT_HEADERS
+      },
+      signal: AbortSignal.any([signal, AbortSignal.timeout(8e3)])
+    });
+    if (!res.ok) return [];
+    const json = await res.json();
+    const data = json?.data;
+    if (!Array.isArray(data)) return [];
+    const usable = data.filter(isUsableCopilotChatModel);
+    usable.sort((a, b) => copilotModelRank(a) - copilotModelRank(b));
+    return usable.map((m) => m.id);
+  } catch {
+    return [];
+  }
+}
+function copilotModelRank(item) {
+  if (item.is_chat_default === true) return 0;
+  if (item.is_chat_fallback === true) return 1;
+  return 2;
+}
+async function runCopilotOAuthLogin(deps, opts = {}) {
+  const providerId = opts.providerId ?? COPILOT_PROVIDER_ID;
+  const ac = new AbortController();
+  const onSig = () => ac.abort();
+  process.on("SIGINT", onSig);
+  try {
+    deps.renderer.write(
+      color.bold(`
+  Sign in with GitHub Copilot \u2014 ${color.cyan(providerId)}
+`) + color.dim("  Uses your GitHub Copilot subscription (not an API key).\n") + color.amber("  \u26A0 Using Copilot outside its official editor integrations may violate\n") + color.amber("    GitHub\u2019s Terms \u2014 your account could be rate-limited or banned.\n\n")
+    );
+    const device = await startDeviceFlow(ac.signal);
+    deps.renderer.write(
+      color.bold(`  ${"\u2500".repeat(56)}
+`) + color.bold("  Open this URL and enter the code:\n") + color.cyan(`  ${device.verification_uri}
+`) + color.bold("  Code: ") + color.green(color.bold(device.user_code)) + "\n" + color.bold(`  ${"\u2500".repeat(56)}
+
+`)
+    );
+    openBrowser3(device.verification_uri);
+    deps.renderer.write(color.dim("  Waiting for you to authorize in the browser...\n"));
+    const githubToken = await pollForGitHubToken(device, ac.signal);
+    deps.renderer.write(color.dim("  Authorized. Fetching your Copilot token...\n"));
+    const copilot = await refreshCopilotToken(githubToken, ac.signal);
+    const models = await fetchCopilotModels(copilot.token, ac.signal);
+    const saved = await saveCopilotTokens(
+      deps,
+      providerId,
+      copilot.token,
+      githubToken,
+      copilot.expires,
+      models
+    );
+    if (!saved) return 1;
+    deps.renderer.write(color.green("\n  \u2713 Signed in with GitHub Copilot!\n"));
+    const modelHint = models[0] ?? "gpt-4o";
+    deps.renderer.writeInfo(
+      `  Saved as provider ${color.bold(providerId)}${models.length ? ` (${models.length} models)` : ""}.
+  Use: ${color.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
+` + color.dim("  The Copilot token refreshes automatically.\n")
+    );
+    return 0;
+  } catch (err) {
+    const msg = err instanceof DOMException && err.name === "AbortError" ? "Login cancelled." : err.message;
+    deps.renderer.writeError(`  Login failed: ${msg}`);
+    return 1;
+  } finally {
+    process.off("SIGINT", onSig);
+  }
+}
+async function saveCopilotTokens(deps, providerId, copilotToken, githubToken, expires, models) {
+  const entry = {
+    label: "oauth-default",
+    apiKey: copilotToken,
+    createdAt: nowIso(),
+    authMethod: "oauth",
+    expiresAt: new Date(expires).toISOString(),
+    refreshToken: githubToken,
+    tokenType: "bearer"
+  };
+  try {
+    await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
+      const existing = all[providerId];
+      const p = existing ? { ...existing } : { type: providerId };
+      p.family = "github-copilot";
+      if (!p.baseUrl) p.baseUrl = copilotBaseUrlFromToken(copilotToken);
+      if (models.length > 0) p.models = models;
+      else if (!p.models || p.models.length === 0) p.models = ["gpt-4o"];
       const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
       keys.push(entry);
       writeKeysBack(p, keys);
@@ -25170,7 +25223,7 @@ async function addMcpServer(args, deps) {
   const serverCfg = { ...factory };
   serverCfg.enabled = enable;
   const existing = await readJsonObjectFile(deps.paths.globalConfig);
-  const mcpServers = isRecord(existing.mcpServers) ? existing.mcpServers : {};
+  const mcpServers = isRecord2(existing.mcpServers) ? existing.mcpServers : {};
   if (mcpServers[name])
     deps.renderer.writeWarning(`Server "${name}" already in config. Updating.
 `);
@@ -25190,7 +25243,7 @@ async function removeMcpServer(name, deps) {
     return 1;
   }
   const existing = await readJsonObjectFile(deps.paths.globalConfig);
-  const mcpServers = isRecord(existing.mcpServers) ? existing.mcpServers : {};
+  const mcpServers = isRecord2(existing.mcpServers) ? existing.mcpServers : {};
   if (!mcpServers[name]) {
     deps.renderer.writeError(`Server "${name}" not in config.
 `);
@@ -25203,7 +25256,7 @@ async function removeMcpServer(name, deps) {
 `);
   return 0;
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var MODEL_PROFILES = [
@@ -25455,13 +25508,12 @@ function roleCat(role) {
 }
 function createProviderForId(providerId, cfg) {
   const savedCfg = cfg.providers?.[providerId];
-  const resolvedProviderId = savedCfg?.type ?? providerId;
   const cfgWithType = Object.assign(
-    { type: resolvedProviderId },
+    { type: providerId },
     savedCfg ?? { apiKey: cfg.apiKey, baseUrl: cfg.baseUrl }
   );
   try {
-    return makeProviderFromConfig(resolvedProviderId, cfgWithType);
+    return makeProviderFromConfig(providerId, cfgWithType);
   } catch {
     return void 0;
   }
@@ -26237,8 +26289,8 @@ async function upsertPlugin(spec, opts, deps, verb) {
   if (idx >= 0) plugins[idx] = nextEntry;
   else plugins.push(nextEntry);
   const features = {
-    ...isRecord2(deps.config.features) ? deps.config.features : {},
-    ...isRecord2(existing.features) ? existing.features : {},
+    ...isRecord3(deps.config.features) ? deps.config.features : {},
+    ...isRecord3(existing.features) ? existing.features : {},
     plugins: true
   };
   existing.plugins = plugins;
@@ -26272,7 +26324,7 @@ async function removePlugin(spec, deps) {
 function errorResult(message) {
   return { code: 1, level: "error", message };
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -27131,37 +27183,38 @@ async function listFleetRuns(deps) {
     return 1;
   }
   const runs = [];
-  for (const id of entries) {
-    const runDir = path4.join(deps.paths.projectSessions, id);
-    let stat8;
-    try {
-      stat8 = await fs4.stat(runDir);
-    } catch {
-      continue;
-    }
-    if (!stat8.isDirectory()) continue;
-    let manifest = false;
-    let checkpoint = false;
-    let subagentCount = 0;
-    let subagentsDir;
-    try {
-      await fs4.access(path4.join(runDir, "fleet.json"));
-      manifest = true;
-    } catch {
-    }
-    try {
-      await fs4.access(path4.join(runDir, "checkpoint.json"));
-      checkpoint = true;
-    } catch {
-    }
-    try {
-      subagentsDir = path4.join(runDir, "subagents");
-      const files = await fs4.readdir(subagentsDir);
-      subagentCount = files.filter((f) => f.endsWith(".jsonl")).length;
-    } catch {
-    }
-    runs.push({ id, manifest, checkpoint, subagents: subagentCount });
-  }
+  const perEntry = await Promise.all(
+    entries.map(async (id) => {
+      const runDir = path4.join(deps.paths.projectSessions, id);
+      try {
+        const stat8 = await fs4.stat(runDir);
+        if (!stat8.isDirectory()) return null;
+      } catch {
+        return null;
+      }
+      const [manifestResult, checkpointResult, subagentFilesResult] = await Promise.all([
+        fs4.access(path4.join(runDir, "fleet.json")).then(
+          () => true,
+          () => false
+        ),
+        fs4.access(path4.join(runDir, "checkpoint.json")).then(
+          () => true,
+          () => false
+        ),
+        fs4.readdir(path4.join(runDir, "subagents")).then(
+          (files) => files.filter((f) => f.endsWith(".jsonl")).length,
+          () => 0
+        )
+      ]);
+      return {
+        id,
+        manifest: manifestResult,
+        checkpoint: checkpointResult,
+        subagents: subagentFilesResult
+      };
+    })
+  );
+  for (const r of perEntry) if (r) runs.push(r);
   if (runs.length === 0) {
     deps.renderer.write("No fleet runs found.\n");
     return 0;
@@ -27275,17 +27328,22 @@ Fleet Run: ${runId}
     deps.renderer.write(`
   Subagent transcripts (${subagentFiles.length}):
 `);
-    for (const f of subagentFiles.sort()) {
-      const filePath = path4.join(subagentsDir, f);
-      let size;
-      try {
-        const s = await fs4.stat(filePath);
-        size = s.size;
-      } catch {
-        size = 0;
-      }
+    const sortedFiles = subagentFiles.sort();
+    const sizes = await Promise.all(
+      sortedFiles.map(async (f) => {
+        const filePath = path4.join(subagentsDir, f);
+        try {
+          const s = await fs4.stat(filePath);
+          return s.size;
+        } catch {
+          return 0;
+        }
+      })
+    );
+    for (let i = 0; i < sortedFiles.length; i++) {
+      const size = sizes[i] ?? 0;
       const sizeStr = size > 1024 * 1024 ? `${(size / 1024 / 1024).toFixed(1)}MB` : `${(size / 1024).toFixed(0)}KB`;
-      deps.renderer.write(`    ${color.dim(f)}  ${color.dim(sizeStr)}
+      deps.renderer.write(`    ${color.dim(sortedFiles[i] ?? "")}  ${color.dim(sizeStr)}
 `);
     }
   } else {
@@ -27689,9 +27747,10 @@ var helpCmd = async (_args, deps) => {
     "  --yolo-destructive            Deprecated \u2014 YOLO now auto-approves everything by default",
     "  --tui / --no-tui             Force or disable TUI mode",
     "  --mouse                      Full mouse mode in the TUI (in-app scroll + clickable UI)",
-    "  --webui [--port <n>] [--open] Serve the browser UI + WS bridge (prints a URL,",
-    "                               --open pops the browser; shares this terminal's",
-    "                               agent; auto-picks free ports)",
+    "  --webui [--host <h>] [--webui-port <n>] [--ws-port <n>] [--webui-token <t>] [--open]",
+    "          [--webui-public-url <url>] [--webui-public-ws-url <url>] [--webui-require-token]",
+    "                               Serve the browser UI + WS bridge (prints a token URL,",
+    "                               --open pops the browser; shares this terminal's agent)",
     '  --eternal "<mission>"        Start an eternal-autonomy loop',
     "  --no-hints                   Hide launch hints",
     "  --skip-index                 Skip codebase indexing and the large-codebase prompt"
@@ -28046,7 +28105,7 @@ async function boot(argv) {
       await persistLaunchChoices(wpaths.globalConfig, toPersist);
     } catch {
     }
-    printLaunchHints(renderer, flags, {
+    await printLaunchHints(renderer, flags, {
       cursorFile: path4.join(wpaths.cacheDir, "hint-cursor")
     });
   } else {
@@ -28188,6 +28247,8 @@ function registerBuiltinTools(deps) {
     makeMailInboxTool({ projectDir: deps.wpaths.projectDir, events: deps.events })
   );
   applyToolDescriptionModes(deps.toolRegistry, deps.config.tools?.descriptionMode);
+  configureExecPolicy(deps.config.tools?.exec ?? {});
+  configureAutophasePolicy(deps.config.tools?.exec ?? {});
 }
 
 // src/cli-eternal-flag.ts
@@ -28291,6 +28352,9 @@ function applyNodeEnvDefault() {
     process.env["WRONGSTACK_NODE_ENV_DEFAULTED"] = "1";
   }
 }
+function applySessionShellDefault() {
+  ensureSessionShell();
+}
 async function applyPrintUpdateNotice(initialUpdateInfo) {
   return await printUpdateNotice(initialUpdateInfo);
 }
@@ -28302,6 +28366,7 @@ async function applyDebugStreamSeed(config) {
 }
 async function runPreflight(config, initialUpdateInfo) {
   applyNodeEnvDefault();
+  applySessionShellDefault();
   const updateInfo = await applyPrintUpdateNotice(initialUpdateInfo);
   await applyDebugStreamSeed(config);
   return {
@@ -28786,11 +28851,79 @@ async function runWebUIDispatch(ctx) {
   agent.disableInteractiveConfirmation();
   renderer.setSilent(true);
   const { runWebUI: runWebUI2 } = await Promise.resolve().then(() => (init_webui_server(), webui_server_exports));
+  const flagValue = (names) => {
+    for (const name of names) {
+      if (!Object.prototype.hasOwnProperty.call(flags, name)) continue;
+      const value = flags[name];
+      if (typeof value === "string" && value.trim() !== "") return value.trim();
+      throw new Error(`--${name} requires a value`);
+    }
+    return void 0;
+  };
+  const flagBoolean = (names) => {
+    for (const name of names) {
+      if (!Object.prototype.hasOwnProperty.call(flags, name)) continue;
+      const value = flags[name];
+      if (value === void 0) continue;
+      if (typeof value === "boolean") return value;
+      const normalized = value.trim().toLowerCase();
+      if (["1", "true", "yes", "on"].includes(normalized)) return true;
+      if (["0", "false", "no", "off"].includes(normalized)) return false;
+      throw new Error(`--${name} must be a boolean value`);
+    }
+    return void 0;
+  };
+  const envFlag2 = (name) => {
+    const value = process.env[name]?.trim().toLowerCase();
+    return value === "1" || value === "true" || value === "yes" || value === "on";
+  };
+  const parsePort = (value, fallback, label) => {
+    if (value === void 0) return fallback;
+    const parsed = Number.parseInt(value, 10);
+    if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
+      throw new Error(`${label} must be a port between 1 and 65535`);
+    }
+    return parsed;
+  };
+  let webuiHost;
+  let webuiHttpPort;
+  let webuiWsPort;
+  let webuiAccessToken;
+  let webuiPublicUrl;
+  let webuiPublicWsUrl;
+  let webuiRequireToken;
+  try {
+    webuiHost = flagValue(["webui-host", "host"]) ?? process.env["WEBUI_HOST"] ?? process.env["WS_HOST"] ?? "127.0.0.1";
+    webuiHttpPort = parsePort(
+      flagValue(["webui-port", "http-port"]) ?? process.env["WEBUI_PORT"] ?? process.env["PORT"],
+      3456,
+      "--webui-port"
+    );
+    webuiWsPort = parsePort(
+      flagValue(["ws-port"]) ?? flagValue(["port"]) ?? process.env["WS_PORT"],
+      3457,
+      "--ws-port"
+    );
+    webuiAccessToken = flagValue(["webui-token"]) ?? process.env["WEBUI_TOKEN"] ?? process.env["WEBUI_AUTH_TOKEN"];
+    webuiPublicUrl = flagValue(["webui-public-url", "public-url"]) ?? process.env["WEBUI_PUBLIC_URL"];
+    webuiPublicWsUrl = flagValue(["webui-public-ws-url", "public-ws-url"]) ?? process.env["WEBUI_PUBLIC_WS_URL"];
+    webuiRequireToken = flagBoolean(["webui-require-token", "require-token"]) ?? envFlag2("WEBUI_REQUIRE_TOKEN");
+  } catch (err) {
+    renderer.setSilent(false);
+    renderer.writeInfo(color.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    return 1;
+  }
   const webuiPromise = runWebUI2({
     agent,
     events,
     session,
-    port: Number.parseInt(String(flags.port ?? "3457"), 10),
+    host: webuiHost,
+    port: webuiWsPort,
+    httpPort: webuiHttpPort,
+    accessToken: webuiAccessToken,
+    publicUrl: webuiPublicUrl,
+    publicWsUrl: webuiPublicWsUrl,
+    requireToken: webuiRequireToken,
     projectRoot,
     appConfig: config,
     open: !!flags.open,
@@ -28814,16 +28947,13 @@ async function runWebUIDispatch(ctx) {
     needsSetup,
     sddSubagentFactory,
     // Print the "open this" banner only once the server is actually
-    // listening, using the RESOLVED ports. The requested port
-    // (flags.port) auto-advances past busy ports inside runWebUI, so a
-    // banner printed up-front with flags.port lies whenever 3456/3457 are
-    // taken (a second instance, leftover sockets). Bind is 127.0.0.1-only,
-    // so the host must be the literal IPv4 loopback — `localhost` resolves
-    // to `::1` first on Windows and never reaches the server.
-    onListening: ({ httpPort: boundHttpPort }) => {
+    // listening, using the RESOLVED ports. Requested ports auto-advance past
+    // busy ports inside runWebUI, so a banner printed up-front lies whenever
+    // 3456/3457 are taken (a second instance, leftover sockets).
+    onListening: ({ url }) => {
       renderer.writeInfo(
         color.green(
-          `  \u2726 WebUI running \u2192 ${color.bold(`http://127.0.0.1:${boundHttpPort}`)}`
+          `  \u2726 WebUI running \u2192 ${color.bold(url)}`
         )
       );
       renderer.writeInfo(
@@ -29481,19 +29611,26 @@ async function resumeSession(ctx, sessionId) {
 }
 function createSettingsAdapter(ctx) {
   const { configStore, wpaths, fleetStreamController, applyLiveSettings } = ctx;
+  const deriveFsAccess = deriveFsAccessPair;
   function getSettings() {
     const cfg = configStore.get();
     const autonomy = cfg.autonomy;
     const rawMode = autonomy?.defaultMode;
     const mode = rawMode === "suggest" || rawMode === "auto" ? rawMode : "off";
     const modelRuntime = cfg.modelRuntime;
+    const contextModeRaw = cfg.context?.mode;
+    const contextMode = contextModeRaw === "frugal" || contextModeRaw === "deep" || contextModeRaw === "archival" ? contextModeRaw : "balanced";
     const reasoningEffortRaw = modelRuntime?.reasoning?.effort;
     const reasoningEffort = reasoningEffortRaw === "none" || reasoningEffortRaw === "minimal" || reasoningEffortRaw === "low" || reasoningEffortRaw === "medium" || reasoningEffortRaw === "high" || reasoningEffortRaw === "xhigh" || reasoningEffortRaw === "max" ? reasoningEffortRaw : "high";
+    const featuresAllow = cfg.features?.allowOutsideProjectRoot;
+    const toolsRestrict = cfg.tools?.restrictToProjectRoot;
+    const resolvedAllow = featuresAllow !== void 0 ? featuresAllow : toolsRestrict !== void 0 ? !toolsRestrict : true;
+    const resolvedRestrict = !resolvedAllow;
     return {
       mode,
       delayMs: autonomy?.autoProceedDelayMs ?? 45e3,
       titleAnimation: autonomy?.terminalTitleAnimation !== false,
-      yolo: autonomy?.yolo ?? false,
+      yolo: cfg.yolo ?? (autonomy?.yolo ?? false),
       streamFleet: autonomy?.streamFleet !== false,
       chime: autonomy?.chime ?? false,
       confirmExit: autonomy?.confirmExit !== false,
@@ -29504,15 +29641,16 @@ function createSettingsAdapter(ctx) {
       featureSkills: cfg.features?.skills !== false,
       featureModelsRegistry: cfg.features?.modelsRegistry !== false,
       featureTokenSaving: normalizeTokenSavingTier(cfg.features?.tokenSavingMode),
-      allowOutsideProjectRoot: cfg.features?.allowOutsideProjectRoot ?? true,
+      allowOutsideProjectRoot: resolvedAllow,
       contextAutoCompact: cfg.context?.autoCompact !== false,
       contextStrategy: cfg.context?.strategy ?? "hybrid",
-      maxConcurrent: cfg.maxConcurrent ?? 0,
+      contextMode,
+      maxConcurrent: cfg.maxConcurrent ?? 4,
       logLevel: cfg.log?.level ?? "info",
       auditLevel: cfg.session?.auditLevel ?? "standard",
       indexOnStart: cfg.indexing?.onSessionStart !== false,
       maxIterations: cfg.tools?.maxIterations ?? 500,
-      restrictFsToRoot: cfg.tools?.restrictToProjectRoot ?? false,
+      restrictFsToRoot: resolvedRestrict,
       autoProceedMaxIterations: cfg.autonomy?.autoProceedMaxIterations ?? 50,
       debugStream: cfg.debugStream ?? false,
       statuslineMode: autonomy?.statuslineMode === "minimum" ? "minimum" : "detailed",
@@ -29533,48 +29671,46 @@ function createSettingsAdapter(ctx) {
   }
   async function saveSettings(s) {
     try {
-      await persistAutonomySetting(
-        {
-          configStore,
-          globalConfigPath: wpaths.globalConfig,
-          inProjectConfigPath: wpaths.inProjectConfig,
-          vault: noOpVault
-        },
-        (autonomy) => {
-          autonomy.defaultMode = s.mode;
-          autonomy.autoProceedDelayMs = s.delayMs;
-          const a = autonomy;
-          a["terminalTitleAnimation"] = s.titleAnimation ?? true;
-          a["yolo"] = s.yolo ?? false;
-          a["streamFleet"] = s.streamFleet ?? true;
-          a["chime"] = s.chime ?? false;
-          a["confirmExit"] = s.confirmExit ?? true;
-          if (s.mouseMode !== void 0) a["mouseMode"] = s.mouseMode;
-          if (s.enhanceEnabled !== void 0) a["enhance"] = s.enhanceEnabled;
-          if (s.enhanceLanguage !== void 0) a["enhanceLanguage"] = s.enhanceLanguage;
-          if (s.statuslineMode !== void 0) a["statuslineMode"] = s.statuslineMode;
-          if (s.thinkingWord !== void 0) a["thinkingWord"] = normalizeTuiThinkingWord(s.thinkingWord);
-          if (s.autonomyNextPrompt !== void 0) a["autonomyNextPrompt"] = s.autonomyNextPrompt;
-          if (s.autoProceedMaxIterations !== void 0)
-            a["autoProceedMaxIterations"] = s.autoProceedMaxIterations;
-        }
-      );
-      if (s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || s.allowOutsideProjectRoot !== void 0 || s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0 || s.logLevel !== void 0 || s.auditLevel !== void 0 || s.indexOnStart !== void 0 || s.maxIterations !== void 0 || s.restrictFsToRoot !== void 0 || s.nextPrediction !== void 0 || s.debugStream !== void 0 || s.configScope !== void 0 || s.enhanceDelayMs !== void 0) {
+      if (s.mode !== void 0 || s.delayMs !== void 0 || s.titleAnimation !== void 0 || s.yolo !== void 0 || s.streamFleet !== void 0 || s.chime !== void 0 || s.confirmExit !== void 0 || s.mouseMode !== void 0 || s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || s.allowOutsideProjectRoot !== void 0 || s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0 || s.contextMode !== void 0 || s.maxConcurrent !== void 0 || s.logLevel !== void 0 || s.auditLevel !== void 0 || s.indexOnStart !== void 0 || s.maxIterations !== void 0 || s.restrictFsToRoot !== void 0 || s.nextPrediction !== void 0 || s.debugStream !== void 0 || s.configScope !== void 0 || s.enhanceDelayMs !== void 0 || s.enhanceEnabled !== void 0 || s.enhanceLanguage !== void 0 || s.statuslineMode !== void 0 || s.thinkingWord !== void 0 || s.autonomyNextPrompt !== void 0 || s.autoProceedMaxIterations !== void 0 || s.reasoningMode !== void 0 || s.reasoningEffort !== void 0 || s.reasoningPreserve !== void 0 || s.cacheTtl !== void 0) {
         const configScope = s.configScope ?? configStore.get().configScope ?? "global";
         const targetPath = configScope === "project" && wpaths.inProjectConfig ? wpaths.inProjectConfig : wpaths.globalConfig;
         let raw;
         try {
           raw = await fs4.readFile(targetPath, "utf8");
         } catch (err) {
-          throw new Error(
-            `Failed to read config at ${targetPath}: ${err instanceof Error ? err.message : String(err)}`,
-            { cause: err }
-          );
+          if (err.code !== "ENOENT") {
+            throw new Error(
+              `Failed to read config at ${targetPath}: ${err instanceof Error ? err.message : String(err)}`,
+              { cause: err }
+            );
+          }
+          raw = "{}";
         }
         const parsed = JSON.parse(raw);
         const decrypted = decryptConfigSecrets$1(parsed, noOpVault);
+        const autonomy = decrypted.autonomy ?? {};
+        if (s.mode !== void 0) autonomy.defaultMode = s.mode;
+        if (s.delayMs !== void 0) autonomy.autoProceedDelayMs = s.delayMs;
+        if (s.titleAnimation !== void 0) autonomy.terminalTitleAnimation = s.titleAnimation;
+        if (s.yolo !== void 0) autonomy.yolo = s.yolo;
+        if (s.streamFleet !== void 0) autonomy.streamFleet = s.streamFleet;
+        if (s.chime !== void 0) autonomy.chime = s.chime;
+        if (s.confirmExit !== void 0) autonomy.confirmExit = s.confirmExit;
+        if (s.mouseMode !== void 0) autonomy.mouseMode = s.mouseMode;
+        if (s.enhanceDelayMs !== void 0) autonomy.enhanceDelayMs = s.enhanceDelayMs;
+        if (s.enhanceEnabled !== void 0) autonomy.enhance = s.enhanceEnabled;
+        if (s.enhanceLanguage !== void 0) autonomy.enhanceLanguage = s.enhanceLanguage;
+        if (s.statuslineMode !== void 0) autonomy.statuslineMode = s.statuslineMode;
+        if (s.thinkingWord !== void 0)
+          autonomy.thinkingWord = normalizeTuiThinkingWord(s.thinkingWord);
+        if (s.autonomyNextPrompt !== void 0) autonomy.autonomyNextPrompt = s.autonomyNextPrompt;
+        if (s.autoProceedMaxIterations !== void 0)
+          autonomy.autoProceedMaxIterations = s.autoProceedMaxIterations;
+        decrypted.autonomy = autonomy;
         if (s.nextPrediction !== void 0) decrypted.nextPrediction = s.nextPrediction;
-        if (s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || s.allowOutsideProjectRoot !== void 0) {
+        if (s.yolo !== void 0) decrypted.yolo = s.yolo;
+        const fsAccess = deriveFsAccess(s);
+        if (s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || fsAccess !== void 0) {
           const feats = decrypted.features ?? {};
           if (s.featureMcp !== void 0) feats.mcp = s.featureMcp;
           if (s.featurePlugins !== void 0) feats.plugins = s.featurePlugins;
@@ -29582,15 +29718,17 @@ function createSettingsAdapter(ctx) {
           if (s.featureSkills !== void 0) feats.skills = s.featureSkills;
           if (s.featureModelsRegistry !== void 0) feats.modelsRegistry = s.featureModelsRegistry;
           if (s.featureTokenSaving !== void 0) feats.tokenSavingMode = s.featureTokenSaving;
-          if (s.allowOutsideProjectRoot !== void 0) feats.allowOutsideProjectRoot = s.allowOutsideProjectRoot;
+          if (fsAccess !== void 0) feats.allowOutsideProjectRoot = fsAccess.allowOutsideProjectRoot;
           decrypted.features = feats;
         }
-        if (s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0) {
+        if (s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0 || s.contextMode !== void 0) {
           const c = decrypted.context ?? {};
           if (s.contextAutoCompact !== void 0) c.autoCompact = s.contextAutoCompact;
           if (s.contextStrategy !== void 0) c.strategy = s.contextStrategy;
+          if (s.contextMode !== void 0) c.mode = s.contextMode;
           decrypted.context = c;
         }
+        if (s.maxConcurrent !== void 0) decrypted.maxConcurrent = s.maxConcurrent;
         if (s.logLevel !== void 0) {
           const log = decrypted.log ?? {};
           log.level = s.logLevel;
@@ -29606,32 +29744,38 @@ function createSettingsAdapter(ctx) {
           idx.onSessionStart = s.indexOnStart;
           decrypted.indexing = idx;
         }
-        if (s.maxIterations !== void 0 || s.restrictFsToRoot !== void 0) {
+        if (s.maxIterations !== void 0 || fsAccess !== void 0) {
           const tools = decrypted.tools ?? {};
           if (s.maxIterations !== void 0) tools.maxIterations = s.maxIterations;
-          if (s.restrictFsToRoot !== void 0) tools.restrictToProjectRoot = s.restrictFsToRoot;
+          if (fsAccess !== void 0) tools.restrictToProjectRoot = fsAccess.restrictToProjectRoot;
           decrypted.tools = tools;
         }
-        if (s.restrictFsToRoot !== void 0) {
-          const features = decrypted.features ?? {};
-          features.allowOutsideProjectRoot = !s.restrictFsToRoot;
-          decrypted.features = features;
-        }
         if (s.debugStream !== void 0) {
           decrypted.debugStream = s.debugStream;
           const { setDebugStreamEnabled } = await import('@wrongstack/providers');
           setDebugStreamEnabled(s.debugStream);
         }
         if (s.configScope !== void 0) decrypted.configScope = s.configScope;
-        if (s.enhanceDelayMs !== void 0) {
-          const autonomy = decrypted.autonomy ?? {};
-          autonomy.enhanceDelayMs = s.enhanceDelayMs;
-          decrypted.autonomy = autonomy;
-        }
-        if (s.autoProceedMaxIterations !== void 0) {
-          const autonomy = decrypted.autonomy ?? {};
-          autonomy.autoProceedMaxIterations = s.autoProceedMaxIterations;
-          decrypted.autonomy = autonomy;
+        if (s.reasoningMode !== void 0 || s.reasoningEffort !== void 0 || s.reasoningPreserve !== void 0 || s.cacheTtl !== void 0) {
+          const modelRuntime = decrypted.modelRuntime ?? {};
+          if (s.reasoningMode !== void 0 || s.reasoningEffort !== void 0 || s.reasoningPreserve !== void 0) {
+            const reasoning = modelRuntime.reasoning ?? {};
+            if (s.reasoningMode !== void 0) reasoning.mode = s.reasoningMode;
+            if (s.reasoningEffort !== void 0) reasoning.effort = s.reasoningEffort;
+            if (s.reasoningPreserve !== void 0) reasoning.preserve = s.reasoningPreserve;
+            modelRuntime.reasoning = reasoning;
+          }
+          if (s.cacheTtl !== void 0) {
+            const cache = modelRuntime.cache ?? {};
+            if (s.cacheTtl === "default") {
+              delete cache.ttl;
+            } else {
+              cache.ttl = s.cacheTtl;
+            }
+            if (Object.keys(cache).length > 0) modelRuntime.cache = cache;
+            else delete modelRuntime.cache;
+          }
+          decrypted.modelRuntime = modelRuntime;
         }
         const toWrite = targetPath === wpaths.globalConfig ? decrypted : filterSafeForProject(decrypted);
         const encrypted = encryptConfigSecrets$1(toWrite, noOpVault);
@@ -29639,19 +29783,63 @@ function createSettingsAdapter(ctx) {
           await fs4.mkdir(path4.dirname(targetPath), { recursive: true });
         }
         await atomicWrite(targetPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+        const currentConfig = configStore.get();
+        const nextModelRuntime = {
+          ...currentConfig.modelRuntime,
+          ...decrypted.modelRuntime ?? {}
+        };
+        if (s.cacheTtl === "default") {
+          delete nextModelRuntime.cache;
+        }
         configStore.update({
           ...s.nextPrediction !== void 0 ? { nextPrediction: s.nextPrediction } : {},
-          ...s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 ? { features: decrypted.features } : {},
-          ...s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0 ? { context: decrypted.context } : {},
-          ...s.logLevel !== void 0 ? { log: decrypted.log } : {},
-          ...s.auditLevel !== void 0 ? { session: decrypted.session } : {},
-          ...s.indexOnStart !== void 0 ? { indexing: decrypted.indexing } : {},
-          ...s.maxIterations !== void 0 || s.restrictFsToRoot !== void 0 ? { tools: decrypted.tools } : {},
+          ...s.yolo !== void 0 ? { yolo: s.yolo } : {},
+          ...s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || fsAccess !== void 0 ? {
+            features: {
+              ...currentConfig.features,
+              ...decrypted.features ?? {}
+            }
+          } : {},
+          ...s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0 || s.contextMode !== void 0 ? {
+            context: {
+              ...currentConfig.context,
+              ...decrypted.context ?? {}
+            }
+          } : {},
+          ...s.maxConcurrent !== void 0 ? { maxConcurrent: s.maxConcurrent } : {},
+          ...s.logLevel !== void 0 ? {
+            log: {
+              ...currentConfig.log,
+              ...decrypted.log ?? {}
+            }
+          } : {},
+          ...s.auditLevel !== void 0 ? {
+            session: {
+              ...currentConfig.session,
+              ...decrypted.session ?? {}
+            }
+          } : {},
+          ...s.indexOnStart !== void 0 ? {
+            indexing: {
+              ...currentConfig.indexing,
+              ...decrypted.indexing ?? {}
+            }
+          } : {},
+          ...s.maxIterations !== void 0 || fsAccess !== void 0 ? {
+            tools: {
+              ...currentConfig.tools,
+              ...decrypted.tools ?? {}
+            }
+          } : {},
           ...s.debugStream !== void 0 ? { debugStream: s.debugStream } : {},
           ...s.configScope !== void 0 ? { configScope: s.configScope } : {},
-          ...s.enhanceDelayMs !== void 0 ? { autonomy: { ...configStore.get().autonomy ?? {}, enhanceDelayMs: s.enhanceDelayMs } } : {},
-          ...s.enhanceEnabled !== void 0 ? { autonomy: { ...configStore.get().autonomy ?? {}, enhance: s.enhanceEnabled } } : {},
-          ...s.enhanceLanguage !== void 0 ? { autonomy: { ...configStore.get().autonomy ?? {}, enhanceLanguage: s.enhanceLanguage } } : {}
+          autonomy: {
+            ...currentConfig.autonomy,
+            ...decrypted.autonomy ?? {}
+          },
+          ...s.reasoningMode !== void 0 || s.reasoningEffort !== void 0 || s.reasoningPreserve !== void 0 || s.cacheTtl !== void 0 ? {
+            modelRuntime: nextModelRuntime
+          } : {}
         });
       }
       if (s.streamFleet !== void 0) fleetStreamController?.setEnabled(s.streamFleet);
@@ -32069,12 +32257,22 @@ var MultiAgentHost = class _MultiAgentHost {
         };
       }
       const tools = subCfg.tools ? [...subCfg.tools] : void 0;
+      const subTokenCounter = new DefaultTokenCounter({
+        registry: this.deps.modelsRegistry,
+        providerId: effProvider,
+        events
+      });
       const ctx = new Context({
         systemPrompt: baseSystem,
         provider,
         session: subSession,
         signal: new AbortController().signal,
-        tokenCounter: this.deps.tokenCounter,
+        // Keep per-request context pressure isolated. The leader statusline
+        // reads currentRequestTokens() from the leader counter; sharing it with
+        // subagents lets the latest subagent provider call overwrite the ctx
+        // chip even though subagent ctx is reported separately as
+        // subagent.ctx_pct.
+        tokenCounter: subTokenCounter,
         cwd: subCwd,
         projectRoot: this.deps.projectRoot,
         // Subagents inherit the leader's filesystem-access scope.
@@ -32922,7 +33120,7 @@ async function setupCodebaseIndexing(deps) {
   let watcher;
   if (idx.watchExternal) {
     try {
-      watcher = fs3.watch(projectRoot, { recursive: true }, (_event, filename) => {
+      watcher = fs37.watch(projectRoot, { recursive: true }, (_event, filename) => {
         if (!filename) return;
         const rel = filename.toString();
         if (isIgnored(rel)) return;
@@ -33137,6 +33335,22 @@ function createAgent(params) {
     tracer: params.tracer
   });
 }
+function resolveProviderCfg(config, providerId) {
+  const savedCfg = config.providers?.[providerId];
+  const cfg = {
+    ...savedCfg,
+    apiKey: savedCfg?.apiKey ?? config.apiKey,
+    baseUrl: savedCfg?.baseUrl ?? config.baseUrl,
+    type: providerId
+  };
+  const factoryType = savedCfg?.type ?? providerId;
+  return { cfg, factoryType };
+}
+function buildProviderForId(args, providerId) {
+  const { cfg, factoryType } = resolveProviderCfg(args.config, providerId);
+  const useRegistry = !!args.config.features.modelsRegistry && args.providerRegistry.has(factoryType);
+  return useRegistry ? args.providerRegistry.create(cfg) : makeProviderFromConfig(providerId, cfg);
+}
 
 // src/cli-main.ts
 init_plugins();
@@ -33588,6 +33802,7 @@ function wireEventWiring(deps) {
 // src/cli-main.ts
 async function main(argv) {
   applyNodeEnvDefault();
+  applySessionShellDefault();
   const earlyFlags = parseArgs(argv).flags;
   const earlyExit = await handleHelpVersionShortCircuit(argv);
   if (earlyExit !== null) return earlyExit;
@@ -34135,27 +34350,16 @@ async function main(argv) {
   if (depWatcherDispose) {
     teardownHandlers.push(depWatcherDispose);
   }
-  const resolveProviderCfg = (providerId) => {
-    const savedCfg = config.providers?.[providerId];
-    const resolvedProviderId = savedCfg?.type ?? providerId;
-    const cfgWithType = {
-      ...savedCfg ?? { type: providerId, apiKey: config.apiKey, baseUrl: config.baseUrl },
-      type: resolvedProviderId
-    };
-    return { resolvedProviderId, cfgWithType };
-  };
-  const buildProviderForId = (providerId) => {
-    const { resolvedProviderId, cfgWithType } = resolveProviderCfg(providerId);
-    return config.features.modelsRegistry && providerRegistry.has(resolvedProviderId) ? providerRegistry.create(cfgWithType) : makeProviderFromConfig(resolvedProviderId, cfgWithType);
-  };
+  const resolveProviderCfg2 = (providerId) => resolveProviderCfg(config, providerId);
+  const buildProviderForId2 = (providerId) => buildProviderForId({ config, providerRegistry }, providerId);
   const refreshMaxContextFor = async (providerId, modelId) => {
-    const { resolvedProviderId, cfgWithType } = resolveProviderCfg(providerId);
-    await refreshMaxContext(resolvedProviderId, modelId, cfgWithType);
+    const { cfg } = resolveProviderCfg2(providerId);
+    await refreshMaxContext(providerId, modelId, cfg);
   };
   agent.extensions.register(
     createFallbackModelExtension({
       getConfig: () => config,
-      buildProvider: buildProviderForId,
+      buildProvider: buildProviderForId2,
       onModelSwitch: refreshMaxContextFor,
       events,
       logger
@@ -34170,11 +34374,12 @@ async function main(argv) {
   }
   const switchProviderAndModel = async (providerId, modelId) => {
     try {
-      context.provider = buildProviderForId(providerId);
+      context.provider = buildProviderForId2(providerId);
       context.model = modelId;
       config = patchConfig(config, { provider: providerId, model: modelId });
       configStore.update({ provider: providerId, model: modelId });
       await refreshMaxContextFor(providerId, modelId);
+      await refreshActiveReasoningConfig(providerId, modelId);
       return null;
     } catch (err) {
       return err instanceof Error ? err.message : String(err);
@@ -34544,10 +34749,9 @@ async function main(argv) {
     get: () => loadStatuslineConfig(),
     set: (cfg) => saveStatuslineConfig(cfg)
   };
-  const hiddenItemsFromConfig = await loadStatuslineConfig();
+  const hiddenItemsFromConfig = await ensureStatuslineConfig();
   const hiddenItemsList = [];
-  const ALL_ITEMS = ["todos", "plan", "tasks", "fleet", "git", "elapsed", "context", "cost"];
-  for (const k of ALL_ITEMS) {
+  for (const k of STATUSLINE_CONFIG_KEYS) {
     if (!hiddenItemsFromConfig[k]) hiddenItemsList.push(k);
   }
   const statuslineHiddenItems = hiddenItemsList;
@@ -34555,11 +34759,10 @@ async function main(argv) {
   const setStatuslineHiddenItems = (items) => {
     currentHiddenItems = items;
   };
-  const ALL_STATUSLINE_KEYS = ["todos", "plan", "tasks", "fleet", "git", "elapsed", "context", "cost", "working_dir"];
   const saveStatuslineHiddenItems = async (items) => {
     currentHiddenItems = items;
     const cfg = { ...DEFAULTS };
-    for (const k of ALL_STATUSLINE_KEYS) {
+    for (const k of STATUSLINE_CONFIG_KEYS) {
       cfg[k] = !items.includes(k);
     }
     await saveStatuslineConfig(cfg);
@@ -34610,7 +34813,7 @@ async function main(argv) {
     llmModel: config.model,
     createProvider: (pid) => {
       try {
-        return buildProviderForId(pid);
+        return buildProviderForId2(pid);
       } catch {
         return void 0;
       }
@@ -34870,29 +35073,36 @@ ${color.dim("\u2500".repeat(40))}` : "";
         return "No fleet transcripts on disk \u2014 no subagents have been spawned for this session.";
       }
       const found = [];
-      for (const runId of runDirs) {
-        const runDir = path4.join(subagentsRoot, runId);
-        let files;
-        try {
-          files = await fs4.readdir(runDir);
-        } catch {
-          continue;
-        }
-        for (const f of files) {
-          if (!f.endsWith(".jsonl")) continue;
-          const full = path4.join(runDir, f);
+      const runResults = await Promise.all(
+        runDirs.map(async (runId) => {
+          const runDir = path4.join(subagentsRoot, runId);
+          let files;
           try {
-            const stat8 = await fs4.stat(full);
-            found.push({
-              runId,
-              subagentId: f.replace(/\.jsonl$/, ""),
-              file: full,
-              size: stat8.size
-            });
+            files = await fs4.readdir(runDir);
           } catch {
+            return [];
           }
-        }
-      }
+          const jsonlFiles = files.filter((f) => f.endsWith(".jsonl"));
+          const fileResults = await Promise.all(
+            jsonlFiles.map(async (f) => {
+              const full = path4.join(runDir, f);
+              try {
+                const stat8 = await fs4.stat(full);
+                return {
+                  runId,
+                  subagentId: f.replace(/\.jsonl$/, ""),
+                  file: full,
+                  size: stat8.size
+                };
+              } catch {
+                return null;
+              }
+            })
+          );
+          return fileResults.filter((r) => r !== null);
+        })
+      );
+      for (const runResult of runResults) found.push(...runResult);
       if (found.length === 0) {
         return "No subagent transcripts found on disk.";
       }
@@ -35238,16 +35448,18 @@ Restart WrongStack to load or unload plugin code in this session.`;
         ...errorRing.map((e) => `  [${e.ts}] ${e.phase} ${e.code} \u2014 ${e.message}`)
       ];
       const liveCfg = configStore.get();
+      const liveFamily = liveCfg.providers?.[liveCfg.provider]?.family;
       return [
         `${color.bold("WrongStack diag")}`,
         `  provider:     ${liveCfg.provider} / ${context.model}`,
+        liveFamily ? `  family:       ${liveFamily}` : null,
         `  projectRoot:  ${projectRoot}`,
         `  tokens:       in ${u.input}  out ${u.output}  cacheR ${u.cacheRead ?? 0}`,
         `  cost:         $${cost.total.toFixed(4)}`,
         `  tools:        ${toolRegistry.list().length}`,
         `  mcpServers:   ${mcpRegistry.list().length}`,
         ...errSection
-      ].join("\n");
+      ].filter((line) => line !== null).join("\n");
     },
     onStats: () => stats.format(),
     generateCommitMessage: async (diff) => {
@@ -35282,12 +35494,28 @@ Restart WrongStack to load or unload plugin code in this session.`;
       const core = await import('@wrongstack/core');
       let worktrees;
       if (process.env["WRONGSTACK_SDD_WORKTREES"] !== "0") {
-        const { spawnSync } = await import('child_process');
-        const inGit = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], {
-          cwd: projectRoot,
-          encoding: "utf8",
-          windowsHide: true
-        }).stdout?.trim() === "true";
+        const inGit = await new Promise((resolve13) => {
+          let resolved = false;
+          const settle = (v) => {
+            if (resolved) return;
+            resolved = true;
+            resolve13(v);
+          };
+          try {
+            const child = spawn("git", ["rev-parse", "--is-inside-work-tree"], {
+              cwd: projectRoot,
+              env: process.env,
+              stdio: ["ignore", "pipe", "pipe"],
+              windowsHide: true
+            });
+            const chunks = [];
+            child.stdout?.on("data", (c) => chunks.push(c.toString()));
+            child.on("error", () => settle(false));
+            child.on("close", (code) => settle(code === 0 && chunks.join("").trim() === "true"));
+          } catch {
+            settle(false);
+          }
+        });
         if (inGit) worktrees = new core.WorktreeManager({ projectRoot, events });
       }
       const boardStore = new core.SddBoardStore({ baseDir: wpaths.projectSddBoards });
@@ -35529,12 +35757,26 @@ Restart WrongStack to load or unload plugin code in this session.`;
         if (s.contextAutoCompact !== void 0) {
           autoCompactor?.setEnabled(s.contextAutoCompact);
         }
-        if (s.restrictFsToRoot !== void 0) {
-          context.allowOutsideProjectRoot = !s.restrictFsToRoot;
-          config = patchConfig(config, {
-            features: { ...config.features, allowOutsideProjectRoot: !s.restrictFsToRoot },
-            tools: { ...config.tools, restrictToProjectRoot: s.restrictFsToRoot }
-          });
+        if (s.maxConcurrent !== void 0 && s.maxConcurrent > 0) {
+          multiAgentHost.setMaxConcurrent(s.maxConcurrent);
+          events.emit("concurrency.changed", { n: s.maxConcurrent });
+          config = patchConfig(config, { maxConcurrent: s.maxConcurrent });
+        }
+        if (s.restrictFsToRoot !== void 0 || s.allowOutsideProjectRoot !== void 0) {
+          const fsAccess = deriveFsAccessPair(s);
+          if (fsAccess) {
+            context.allowOutsideProjectRoot = fsAccess.allowOutsideProjectRoot;
+            config = patchConfig(config, {
+              features: {
+                ...config.features,
+                allowOutsideProjectRoot: fsAccess.allowOutsideProjectRoot
+              },
+              tools: {
+                ...config.tools,
+                restrictToProjectRoot: fsAccess.restrictToProjectRoot
+              }
+            });
+          }
         }
       } catch {
       }