@wrongstack/cli 0.273.1 → 0.274.0

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
-import { color, writeErr, loadPlugins, renderProgress, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, expectDefined, DefaultTaskStore, TaskTracker, renderTaskGraph, withFileLock, resolveHqDataDir, ensureHqFirstRunAuthFile, DEFAULT_HQ_REDACTION_POLICY, watchHqAuthFile, parseHqFrame, HQ_PROTOCOL_VERSION, parseHqEventPayload, scrubAndTruncateHqPreview, DefaultSecretScrubber, resolveWstackPaths, projectHash, wstackGlobalRoot, TOKENS, ToolRegistry, GlobalMailbox, resolveSessionLoggingConfig, createSessionEventBridge, HookRegistry, HookRunner, normalizeTokenSavingTier, SlashCommandRegistry, attachDepWatcherBridge, createFallbackModelExtension, SessionMemoryConsolidator, BrainDecisionQueue, ObservableBrainArbiter, HumanEscalatingBrainArbiter, createTieredBrainArbiter, DefaultBrainArbiter, BrainMonitor, mailboxSessionTag, createDelegateTool, FLEET_ROSTER, createMcpControlTool, startTechStackConsumer, startPackageOutdatedWatcher, SddRunRegistry, recordFileAction, createAutonomyBrain, DefaultPluginAPI, SpecVersioning, buildTranscriptFromEvents, DEFAULT_CONTEXT_WINDOW_MODE_ID, resolveProjectDir, DefaultLogger, DefaultModelsRegistry, isStdinTTY, atomicWrite, DefaultPathResolver, EventBus, runProviderWithRetry, ReplayLogStore, ReplayProviderRunner, mergeCustomModelDefs, DefaultSystemPromptBuilder, makeAutonomyPromptContributor, createContextManagerTool, makeMailboxTool, makeMailSendTool, makeMailInboxTool, applyToolDescriptionModes, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, createHqPublisherFromEnv, DEFAULT_SESSION_PRUNE_DAYS, RecoveryLock, DefaultAttachmentStore, Context, QueueStore, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, loadPlan, createDefaultPipelines, applyModelRuntime, resolveContextWindowPolicy, resolveAuditLevel, AutoCompactionMiddleware, estimateRequestTokensCalibrated, Agent, FleetManager, makeDirectorSessionFactory, Director, makeFleetEmitTool, AdaptiveConcurrencyController, resolveModelMatrix, DEFAULT_SUBAGENT_BASELINE, DefaultTokenCounter, AutoApprovePermissionPolicy, WIDE_SUBAGENT_CAPABILITIES, PhaseStore, AutoPhasePlanner, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, assignNickname, makeLLMClassifier, writeOut, ParallelEternalEngine, EternalAutonomyEngine, allServers as allServers$1, CHIMERA_REVIEW_PROMPT, setQueuedMessagesSnapshot, projectSlug, recentTextTurns, gatedEnhancerReasoning, enhanceUserPrompt, repairToolUseAdjacency, mutateTasks, loadTasks, mutatePlan, setPlanItemStatus, getPlanTemplate, emptyPlan, addPlanItem, savePlan, resolveProviderModelList, bootConfig as bootConfig$1, setOutputLineGuard, setRawMode, DefaultSessionReader, ToolAuditLog, DefaultSessionRewinder, DefaultSessionStore as DefaultSessionStore$1, ProviderRegistry, makeAgentSubagentRunner, NULL_FLEET_BUS, FsError, ERROR_CODES, buildChildEnv, formatContextWindowModeList, getContextWindowMode, AGENT_CATALOG, dispatchAgent, normalizeToolDescriptionMode, setToolDescriptionMode, getToolDescriptionMode, noOpVault, formatTodosList, formatTaskList, formatTaskProgress, formatPlan, SessionRecovery, loadGoal, goalFilePath, summarizeUsage, saveGoal, formatGoal, emptyGoal, buildGoalPreamble, pendingBtwCount, setBtwNote, readHqRuntimeFileSync, resolveHqConfig, MATRIX_PHASE_KEYS, matrixKeyKind, phaseForRole, onResize, InputBuilder, DefaultSecretVault, decryptConfigSecrets as decryptConfigSecrets$1, encryptConfigSecrets as encryptConfigSecrets$1, HQ_AUTH_FILE_VERSION, truncate, estimateMessageTokens, AGENTS_BY_PHASE, validateAgainstSchema, ConfigError, resolveMailboxIdentity, smartDefaultFallbackChain, AutonomousCoordinator, mutateHqAuthFile, mintHqToken, readHqAuthFile, isSecretField as isSecretField$1, startSessionTelemetryBridge } from '@wrongstack/core';
+import { color, CODEX_MODELS, writeErr, loadPlugins, renderProgress, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, expectDefined, DefaultTaskStore, TaskTracker, renderTaskGraph, withFileLock, resolveHqDataDir, ensureHqFirstRunAuthFile, DEFAULT_HQ_REDACTION_POLICY, watchHqAuthFile, parseHqFrame, HQ_PROTOCOL_VERSION, parseHqEventPayload, scrubAndTruncateHqPreview, DefaultSecretScrubber, resolveWstackPaths, projectHash, wstackGlobalRoot, TOKENS, ToolRegistry, GlobalMailbox, resolveSessionLoggingConfig, createSessionEventBridge, HookRegistry, HookRunner, normalizeTokenSavingTier, SlashCommandRegistry, attachDepWatcherBridge, createFallbackModelExtension, SessionMemoryConsolidator, BrainDecisionQueue, ObservableBrainArbiter, HumanEscalatingBrainArbiter, createTieredBrainArbiter, DefaultBrainArbiter, BrainMonitor, mailboxSessionTag, createDelegateTool, FLEET_ROSTER, createMcpControlTool, startTechStackConsumer, startPackageOutdatedWatcher, SddRunRegistry, recordFileAction, createAutonomyBrain, DefaultPluginAPI, SpecVersioning, buildTranscriptFromEvents, DEFAULT_CONTEXT_WINDOW_MODE_ID, resolveProjectDir, DefaultLogger, DefaultModelsRegistry, isStdinTTY, atomicWrite, DefaultPathResolver, EventBus, runProviderWithRetry, ReplayLogStore, ReplayProviderRunner, mergeCustomModelDefs, DefaultSystemPromptBuilder, makeAutonomyPromptContributor, createContextManagerTool, makeMailboxTool, makeMailSendTool, makeMailInboxTool, applyToolDescriptionModes, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, createHqPublisherFromEnv, DEFAULT_SESSION_PRUNE_DAYS, RecoveryLock, DefaultAttachmentStore, Context, QueueStore, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, loadPlan, createDefaultPipelines, applyModelRuntime, resolveContextWindowPolicy, resolveAuditLevel, AutoCompactionMiddleware, estimateRequestTokensCalibrated, Agent, FleetManager, makeDirectorSessionFactory, Director, makeFleetEmitTool, AdaptiveConcurrencyController, resolveModelMatrix, DEFAULT_SUBAGENT_BASELINE, DefaultTokenCounter, AutoApprovePermissionPolicy, WIDE_SUBAGENT_CAPABILITIES, PhaseStore, AutoPhasePlanner, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, assignNickname, makeLLMClassifier, writeOut, ParallelEternalEngine, EternalAutonomyEngine, allServers as allServers$1, CHIMERA_REVIEW_PROMPT, setQueuedMessagesSnapshot, projectSlug, recentTextTurns, gatedEnhancerReasoning, enhanceUserPrompt, repairToolUseAdjacency, mutateTasks, loadTasks, mutatePlan, setPlanItemStatus, getPlanTemplate, emptyPlan, addPlanItem, savePlan, resolveProviderModelList, bootConfig as bootConfig$1, setOutputLineGuard, setRawMode, DefaultSessionReader, ToolAuditLog, DefaultSessionRewinder, DefaultSessionStore as DefaultSessionStore$1, ProviderRegistry, makeAgentSubagentRunner, NULL_FLEET_BUS, FsError, ERROR_CODES, buildChildEnv, formatContextWindowModeList, getContextWindowMode, AGENT_CATALOG, dispatchAgent, normalizeToolDescriptionMode, setToolDescriptionMode, getToolDescriptionMode, noOpVault, formatTodosList, formatTaskList, formatTaskProgress, formatPlan, SessionRecovery, loadGoal, goalFilePath, summarizeUsage, saveGoal, formatGoal, emptyGoal, buildGoalPreamble, pendingBtwCount, setBtwNote, readHqRuntimeFileSync, resolveHqConfig, MATRIX_PHASE_KEYS, matrixKeyKind, phaseForRole, onResize, InputBuilder, DefaultSecretVault, decryptConfigSecrets as decryptConfigSecrets$1, encryptConfigSecrets as encryptConfigSecrets$1, HQ_AUTH_FILE_VERSION, truncate, estimateMessageTokens, AGENTS_BY_PHASE, validateAgainstSchema, ConfigError, resolveMailboxIdentity, smartDefaultFallbackChain, AutonomousCoordinator, mutateHqAuthFile, mintHqToken, readHqAuthFile, isSecretField as isSecretField$1, startSessionTelemetryBridge } from '@wrongstack/core';
 import * as fs4 from 'fs/promises';
+import { access, readFile } from 'fs/promises';
 import { decryptConfigSecrets, encryptConfigSecrets, DefaultSecretVault as DefaultSecretVault$1, isSecretField } from '@wrongstack/core/security';
 import * as path4 from 'path';
 import { join } from 'path';
@@ -12,14 +13,14 @@ import * as os7 from 'os';
 import os7__default from 'os';
 import { WebSocketServer, WebSocket } from 'ws';
 import { createRequire } from 'module';
-import { findFreePort, AutoPhaseWebSocketHandler, WorktreeWebSocketHandler, SpecsWebSocketHandler, SddBoardWebSocketHandler, SddWizardWebSocketHandler, buildSddWizardDeps, generateAuthToken, verifyClient, createEternalSubscription, handleShellOpen, handleGitInfo, handleGitDiff, handleGitChanges, handleSkillsExport, handleSkillsEdit, handleSkillsCreate, handleSkillsUpdate, handleSkillsUninstall, handleSkillsInstall, handleSkillsContent, handleMcpRestart, handleMcpDisable, handleMcpEnable, handleMcpDiscover, handleMcpSleep, handleMcpWake, handleMcpUpdate, handleMcpRemove, handleMcpAdd, handleMcpList, handleMemoryForget, handleMemoryRemember, handleMemoryList, handleCompletionRequest, createToolLspCompletionSource, handleFilesWrite, handleFilesRead, handleFilesTree, handleFilesList, createHttpServer, registerInstance, openBrowser as openBrowser$1, unregisterInstance, estimateTokens as estimateTokens$1, stringifyContent, messagePreview, messageTokens, createCustomModeStore } from '@wrongstack/webui/server';
+import { envFlag, findFreePort, AutoPhaseWebSocketHandler, WorktreeWebSocketHandler, SpecsWebSocketHandler, SddBoardWebSocketHandler, SddWizardWebSocketHandler, buildSddWizardDeps, resolveAuthToken, buildWebUIAccessUrl, verifyClient, createEternalSubscription, handleShellOpen, handleGitInfo, handleGitDiff, handleGitChanges, handleSkillsExport, handleSkillsEdit, handleSkillsCreate, handleSkillsUpdate, handleSkillsUninstall, handleSkillsInstall, handleSkillsContent, handleMcpRestart, handleMcpDisable, handleMcpEnable, handleMcpDiscover, handleMcpSleep, handleMcpWake, handleMcpUpdate, handleMcpRemove, handleMcpAdd, handleMcpList, handleMemoryForget, handleMemoryRemember, handleMemoryList, handleCompletionRequest, createToolLspCompletionSource, handleFilesWrite, handleFilesRead, handleFilesTree, handleFilesList, createHttpServer, registerInstance, openBrowser as openBrowser$1, unregisterInstance, estimateTokens as estimateTokens$1, stringifyContent, messagePreview, messageTokens, createCustomModeStore } from '@wrongstack/webui/server';
 import { toErrorMessage, readJsonObjectFile, updateJsonObjectFile, setJsonPath, jsonObjectFileExists, removeJsonPath } from '@wrongstack/core/utils';
-import { setOAuthTokenPersister, capabilitiesFor, makeProviderFromConfig, buildProviderFactoriesFromRegistry, refreshCopilotToken, copilotBaseUrlFromToken } from '@wrongstack/providers';
+import { setOAuthTokenPersister, capabilitiesFor, makeProviderFromConfig, buildProviderFactoriesFromRegistry, withCatalogCapabilities, refreshCopilotToken, copilotBaseUrlFromToken } from '@wrongstack/providers';
 import { ensureSessionShell, builtinToolsPack, rememberTool, forgetTool, searchMemoryTool, relatedMemoryTool, configureExecPolicy, runStartupIndex, isIndexableFile, enqueueReindex, cancelPendingReindexes, shutdownCodebaseIndexHost, getProcessRegistry, TIER2_TOOLS, TIER3_TOOLS, TIER1_TOOLS, resetIndexCircuitBreaker } from '@wrongstack/tools';
 import { DefaultSessionStore } from '@wrongstack/core/storage';
 import { probeLocalLlm } from '@wrongstack/runtime/probe';
-import * as fs3 from 'fs';
-import { watch, writeFileSync, existsSync, realpathSync, readFileSync } from 'fs';
+import * as fs37 from 'fs';
+import { watch, writeFileSync, existsSync, realpathSync } from 'fs';
 import { SkillInstaller } from '@wrongstack/core/skills';
 import { spawn, execFile, execFileSync } from 'child_process';
 import { MCPRegistry, MCPServer, serveHttp, serveStdio } from '@wrongstack/mcp';
@@ -166,7 +167,7 @@ function unknownSubcommand(cmd, valid, name) {
   const list = valid.join(", ");
   return name ? `Unknown subcommand "${cmd}" for /${name}. Valid: ${list}.` : `Unknown subcommand "${cmd}". Valid: ${list}.`;
 }
-async function pathExists(file) {
+async function pathExists2(file) {
   try {
     await fs4.access(file);
     return true;
@@ -221,10 +222,10 @@ async function detectPackageManager2(root, declared) {
     const name = declared.split("@")[0];
     if (name) return name;
   }
-  if (await pathExists(path4.join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (await pathExists(path4.join(root, "bun.lockb"))) return "bun";
-  if (await pathExists(path4.join(root, "bun.lock"))) return "bun";
-  if (await pathExists(path4.join(root, "yarn.lock"))) return "yarn";
+  if (await pathExists2(path4.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists2(path4.join(root, "bun.lockb"))) return "bun";
+  if (await pathExists2(path4.join(root, "bun.lock"))) return "bun";
+  if (await pathExists2(path4.join(root, "yarn.lock"))) return "yarn";
   return "npm";
 }
 function hasUsableScript(scripts, name) {
@@ -299,14 +300,14 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "pyproject.toml"))) throw new Error("not python");
+    if (!await pathExists2(path4.join(root, "pyproject.toml"))) throw new Error("not python");
     facts.test ??= "pytest";
     facts.lint ??= "ruff check .";
     facts.hints.push("pyproject.toml");
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "go.mod"))) throw new Error("not go");
+    if (!await pathExists2(path4.join(root, "go.mod"))) throw new Error("not go");
     facts.build ??= "go build ./...";
     facts.test ??= "go test ./...";
     facts.run ??= "go run .";
@@ -314,7 +315,7 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "Cargo.toml"))) throw new Error("not rust");
+    if (!await pathExists2(path4.join(root, "Cargo.toml"))) throw new Error("not rust");
     facts.build ??= "cargo build";
     facts.test ??= "cargo test";
     facts.lint ??= "cargo clippy";
@@ -342,23 +343,23 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "pom.xml"))) throw new Error("not maven");
+    if (!await pathExists2(path4.join(root, "pom.xml"))) throw new Error("not maven");
     facts.build ??= "mvn package";
     facts.test ??= "mvn test";
     facts.hints.push("pom.xml");
   } catch {
   }
   try {
-    const hasGradle = await pathExists(path4.join(root, "build.gradle")) || await pathExists(path4.join(root, "build.gradle.kts"));
+    const hasGradle = await pathExists2(path4.join(root, "build.gradle")) || await pathExists2(path4.join(root, "build.gradle.kts"));
     if (!hasGradle) throw new Error("not gradle");
-    const g = await pathExists(path4.join(root, "gradlew")) ? "./gradlew" : "gradle";
+    const g = await pathExists2(path4.join(root, "gradlew")) ? "./gradlew" : "gradle";
     facts.build ??= `${g} build`;
     facts.test ??= `${g} test`;
     facts.hints.push("Gradle");
   } catch {
   }
   try {
-    const hasDotnet = await pathExists(path4.join(root, "global.json")) || await hasRootFileWithSuffix(root, [".csproj", ".fsproj", ".sln"]);
+    const hasDotnet = await pathExists2(path4.join(root, "global.json")) || await hasRootFileWithSuffix(root, [".csproj", ".fsproj", ".sln"]);
     if (!hasDotnet) throw new Error("not dotnet");
     facts.build ??= "dotnet build";
     facts.test ??= "dotnet test";
@@ -367,7 +368,7 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "mix.exs"))) throw new Error("not elixir");
+    if (!await pathExists2(path4.join(root, "mix.exs"))) throw new Error("not elixir");
     facts.build ??= "mix compile";
     facts.test ??= "mix test";
     facts.lint ??= "mix format --check-formatted";
@@ -376,14 +377,14 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "pubspec.yaml"))) throw new Error("not dart");
+    if (!await pathExists2(path4.join(root, "pubspec.yaml"))) throw new Error("not dart");
     facts.test ??= "dart test";
     facts.lint ??= "dart analyze";
     facts.hints.push("pubspec.yaml");
   } catch {
   }
   try {
-    const hasDeno = await pathExists(path4.join(root, "deno.json")) || await pathExists(path4.join(root, "deno.jsonc"));
+    const hasDeno = await pathExists2(path4.join(root, "deno.json")) || await pathExists2(path4.join(root, "deno.jsonc"));
     if (!hasDeno) throw new Error("not deno");
     facts.test ??= "deno test";
     facts.lint ??= "deno lint";
@@ -391,7 +392,7 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "Package.swift"))) throw new Error("not swift");
+    if (!await pathExists2(path4.join(root, "Package.swift"))) throw new Error("not swift");
     facts.build ??= "swift build";
     facts.test ??= "swift test";
     facts.run ??= "swift run";
@@ -399,20 +400,20 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "Gemfile"))) throw new Error("not ruby");
-    if (await pathExists(path4.join(root, "Rakefile"))) facts.test ??= "bundle exec rake test";
+    if (!await pathExists2(path4.join(root, "Gemfile"))) throw new Error("not ruby");
+    if (await pathExists2(path4.join(root, "Rakefile"))) facts.test ??= "bundle exec rake test";
     facts.hints.push("Gemfile");
   } catch {
   }
   try {
-    if (!await pathExists(path4.join(root, "CMakeLists.txt"))) throw new Error("not cmake");
+    if (!await pathExists2(path4.join(root, "CMakeLists.txt"))) throw new Error("not cmake");
     facts.build ??= "cmake -B build && cmake --build build";
     facts.test ??= "ctest --test-dir build";
     facts.hints.push("CMakeLists.txt");
   } catch {
   }
   try {
-    const hasPip = await pathExists(path4.join(root, "requirements.txt")) || await pathExists(path4.join(root, "setup.py")) || await pathExists(path4.join(root, "setup.cfg"));
+    const hasPip = await pathExists2(path4.join(root, "requirements.txt")) || await pathExists2(path4.join(root, "setup.py")) || await pathExists2(path4.join(root, "setup.cfg"));
     if (!hasPip) throw new Error("not pip");
     facts.test ??= "pytest";
     facts.hints.push("requirements.txt");
@@ -5521,7 +5522,11 @@ function registerWebuiInstance(p, deps = {}) {
       projectRoot: p.projectRoot,
       projectName: path4.basename(p.projectRoot) || p.projectRoot,
       startedAt: p.startedAt,
-      url: `http://${p.host}:${p.httpPort}`
+      url: buildWebUIAccessUrl({
+        host: p.host,
+        port: p.httpPort,
+        publicUrl: p.publicUrl
+      })
     },
     p.registryBaseDir
   ).catch(() => {
@@ -5530,7 +5535,12 @@ function registerWebuiInstance(p, deps = {}) {
 function announceWebuiReady(p) {
   const log = p.log ?? ((m) => console.log(m));
   const launch = p.openBrowserFn ?? openBrowser$1;
-  const openUrl = p.wsToken ? `http://${p.host}:${p.httpPort}?token=${encodeURIComponent(p.wsToken)}` : `http://${p.host}:${p.httpPort}`;
+  const openUrl = buildWebUIAccessUrl({
+    host: p.host,
+    port: p.httpPort,
+    token: p.wsToken,
+    publicUrl: p.publicUrl
+  });
   p.server.on("listening", () => {
     log(
       `
@@ -5667,7 +5677,9 @@ function startStaticServe(opts, deps = {}) {
     wsPort: opts.wsPort,
     globalRoot: opts.globalRoot,
     onFleetPing: opts.onFleetPing,
-    apiToken: opts.apiToken
+    publicWsUrl: opts.publicWsUrl,
+    apiToken: opts.apiToken,
+    requireToken: opts.requireToken
   });
   server.listen(opts.httpPort, opts.host);
   return { server, port: opts.httpPort };
@@ -7298,7 +7310,10 @@ __export(webui_server_exports, {
   runWebUI: () => runWebUI
 });
 async function runWebUI(opts) {
-  const host = "127.0.0.1";
+  const host = opts.host ?? process.env["WEBUI_HOST"] ?? process.env["WS_HOST"] ?? "127.0.0.1";
+  const publicUrl = opts.publicUrl ?? process.env["WEBUI_PUBLIC_URL"];
+  const publicWsUrl = opts.publicWsUrl ?? process.env["WEBUI_PUBLIC_WS_URL"];
+  const requireToken = opts.requireToken ?? envFlag("WEBUI_REQUIRE_TOKEN");
   const requestedWsPort = opts.port ?? 3457;
   const requestedHttpPort = opts.httpPort ?? 3456;
   const strictPort = process.env["WEBUI_STRICT_PORT"] === "1" || process.env["WEBUI_STRICT_PORT"] === "true";
@@ -7472,7 +7487,21 @@ async function runWebUI(opts) {
     webuiHqConnection = void 0;
   };
   registerWebuiClient();
-  const wsToken = generateAuthToken();
+  const wsToken = resolveAuthToken(opts.accessToken);
+  const publicHostnames = [publicUrl, publicWsUrl].map((value) => {
+    if (!value) return void 0;
+    try {
+      return new URL(value).hostname;
+    } catch {
+      return void 0;
+    }
+  }).filter((value) => Boolean(value));
+  const accessUrl = buildWebUIAccessUrl({
+    host,
+    port: httpPort,
+    token: wsToken,
+    publicUrl
+  });
   const wss = new WebSocketServer({ port, host, maxPayload: 1 * 1024 * 1024 });
   console.log(`[WebUI] WebSocket server starting on ws://${host}:${port}`);
   let fleetBroadcastCli = null;
@@ -7484,7 +7513,9 @@ async function runWebUI(opts) {
     onFleetPing: () => {
       void fleetBroadcastCli?.();
     },
-    apiToken: wsToken
+    publicWsUrl,
+    apiToken: wsToken,
+    requireToken
   });
   if (httpServer) {
     announceWebuiReady({
@@ -7493,7 +7524,8 @@ async function runWebUI(opts) {
       httpPort,
       wsPort,
       open: !!opts.open,
-      wsToken
+      wsToken,
+      publicUrl
     });
   } else {
     console.warn(
@@ -7507,6 +7539,7 @@ async function runWebUI(opts) {
       host,
       httpPort,
       wsPort,
+      publicUrl,
       projectRoot: opts.projectRoot,
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
       registryBaseDir
@@ -8278,7 +8311,7 @@ ${text}` : text;
     wss.on("listening", () => {
       console.log(`[WebUI] WebSocket server running on ws://${host}:${port}`);
       setupEvents();
-      opts.onListening?.({ httpPort, wsPort, host });
+      opts.onListening?.({ httpPort, wsPort, host, url: accessUrl });
       const globalRoot = opts.globalConfigPath ? path4.dirname(opts.globalConfigPath) : void 0;
       if (globalRoot) {
         const broadcastSessions = async () => {
@@ -8348,7 +8381,10 @@ ${text}` : text;
         remoteAddress: req2.socket.remoteAddress,
         cookieHeader: req2.headers.cookie,
         wsHost: host,
-        expectedToken: wsToken
+        expectedToken: wsToken,
+        requireToken,
+        allowedHostnames: publicHostnames,
+        allowBrowserUrlToken: Boolean(publicWsUrl)
       });
       if (!ok) {
         ws.close(4003, "Forbidden");
@@ -8794,6 +8830,14 @@ var init_webui_server = __esm({
 
 // src/cli-main.ts
 init_provider_config_utils();
+async function pathExists(p) {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
 var DEFAULT_TASK_CONCURRENCY = 2;
 function resolveTaskConcurrency() {
   const raw = Number.parseInt(process.env["WRONGSTACK_AUTOPHASE_TASK_CONCURRENCY"] ?? "", 10);
@@ -8909,15 +8953,21 @@ function runCmd(cmd, args, cwd, shell = false) {
     });
   });
 }
-function detectPackageManager(root) {
-  if (existsSync(join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync(join(root, "yarn.lock"))) return "yarn";
-  if (existsSync(join(root, "bun.lockb"))) return "bun";
+async function detectPackageManager(root) {
+  const [pnpm, yarn, bun] = await Promise.all([
+    pathExists(join(root, "pnpm-lock.yaml")),
+    pathExists(join(root, "yarn.lock")),
+    pathExists(join(root, "bun.lockb"))
+  ]);
+  if (pnpm) return "pnpm";
+  if (yarn) return "yarn";
+  if (bun) return "bun";
   return "npm";
 }
-function readScripts(cwd) {
+async function readScripts(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+    const raw = await readFile(join(cwd, "package.json"), "utf8");
+    const pkg = JSON.parse(raw);
     return pkg.scripts ?? {};
   } catch {
     return {};
@@ -8993,7 +9043,7 @@ function createAutoPhaseHost(deps) {
     ].join("\n");
   }
   async function runVerify(cwd) {
-    if (!existsSync(join(cwd, "node_modules")) && !existsSync(join(deps.projectRoot, "node_modules"))) {
+    if (!await pathExists(join(cwd, "node_modules")) && !await pathExists(join(deps.projectRoot, "node_modules"))) {
       return { ok: true, output: "verify skipped: node_modules not found" };
     }
     const custom = process.env["WRONGSTACK_AUTOPHASE_VERIFY_CMD"]?.trim();
@@ -9002,8 +9052,8 @@ function createAutoPhaseHost(deps) {
       return res.code === 0 ? { ok: true } : { ok: false, output: `[verify] exited ${res.code}
 ${res.out}` };
     }
-    const pm = detectPackageManager(deps.projectRoot);
-    const scripts = readScripts(cwd);
+    const pm = await detectPackageManager(deps.projectRoot);
+    const scripts = await readScripts(cwd);
     const steps = ["typecheck", "lint"].filter((s) => typeof scripts[s] === "string");
     if (steps.length === 0) return { ok: true, output: "verify skipped: no typecheck/lint script" };
     for (const step of steps) {
@@ -9283,6 +9333,8 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "metrics",
   "webui",
   "open",
+  "webui-require-token",
+  "require-token",
   "no-check",
   "no-models-refresh",
   "director",
@@ -9751,27 +9803,28 @@ function shouldSuppress(flags) {
   return false;
 }
 var wrap = (n) => (n % GROUPS.length + GROUPS.length) % GROUPS.length;
-function pickGroupIndex(opts) {
+async function pickGroupIndex(opts) {
   if (typeof opts.groupIndex === "number") return wrap(opts.groupIndex);
   if (opts.cursorFile) {
     try {
       let current = 0;
       try {
-        const parsed = Number.parseInt(fs3.readFileSync(opts.cursorFile, "utf8").trim(), 10);
+        const raw = await fs4.readFile(opts.cursorFile, "utf8");
+        const parsed = Number.parseInt(raw.trim(), 10);
         if (Number.isFinite(parsed)) current = wrap(parsed);
       } catch {
       }
-      fs3.mkdirSync(path4.dirname(opts.cursorFile), { recursive: true });
-      fs3.writeFileSync(opts.cursorFile, String(wrap(current + 1)));
+      await fs4.mkdir(path4.dirname(opts.cursorFile), { recursive: true });
+      await fs4.writeFile(opts.cursorFile, String(wrap(current + 1)));
       return current;
     } catch {
     }
   }
   return Math.floor(Math.random() * GROUPS.length);
 }
-function printLaunchHints(renderer, flags, opts = {}) {
+async function printLaunchHints(renderer, flags, opts = {}) {
   if (shouldSuppress(flags)) return;
-  const idx = pickGroupIndex(opts);
+  const idx = await pickGroupIndex(opts);
   const group = GROUPS[idx];
   if (!group) return;
   const lines = [];
@@ -21861,12 +21914,9 @@ function extractAccountId(token) {
   const id = auth?.chatgpt_account_id;
   return typeof id === "string" && id.length > 0 ? id : null;
 }
-var FALLBACK_CODEX_MODELS = [
-  { id: "gpt-5.5", name: "gpt-5.5" },
-  { id: "gpt-5.4", name: "gpt-5.4" },
-  { id: "gpt-5.4-mini", name: "gpt-5.4-mini" },
-  { id: "gpt-5.3-codex-spark", name: "gpt-5.3-codex-spark" }
-];
+var FALLBACK_CODEX_MODELS = CODEX_MODELS.map(
+  (m) => ({ id: m.id, name: m.name })
+);
 var CODEX_CATALOG_FAMILIES = /* @__PURE__ */ new Set(["gpt-codex", "gpt-codex-spark"]);
 function fallbackCodexModelIds() {
   return FALLBACK_CODEX_MODELS.map((m) => m.id);
@@ -22274,6 +22324,15 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
   } catch (err) {
     throw new Error(`Failed to create provider: ${err instanceof Error ? err.message : err}`);
   }
+  if (config.features.modelsRegistry) {
+    provider = await withCatalogCapabilities(
+      modelsRegistry,
+      config.provider,
+      provider,
+      { ...providerConfig, type: config.provider, model: config.model },
+      logger
+    );
+  }
   return { resolvedProvider, provider, providerRegistry };
 }
 
@@ -27124,37 +27183,38 @@ async function listFleetRuns(deps) {
     return 1;
   }
   const runs = [];
-  for (const id of entries) {
-    const runDir = path4.join(deps.paths.projectSessions, id);
-    let stat8;
-    try {
-      stat8 = await fs4.stat(runDir);
-    } catch {
-      continue;
-    }
-    if (!stat8.isDirectory()) continue;
-    let manifest = false;
-    let checkpoint = false;
-    let subagentCount = 0;
-    let subagentsDir;
-    try {
-      await fs4.access(path4.join(runDir, "fleet.json"));
-      manifest = true;
-    } catch {
-    }
-    try {
-      await fs4.access(path4.join(runDir, "checkpoint.json"));
-      checkpoint = true;
-    } catch {
-    }
-    try {
-      subagentsDir = path4.join(runDir, "subagents");
-      const files = await fs4.readdir(subagentsDir);
-      subagentCount = files.filter((f) => f.endsWith(".jsonl")).length;
-    } catch {
-    }
-    runs.push({ id, manifest, checkpoint, subagents: subagentCount });
-  }
+  const perEntry = await Promise.all(
+    entries.map(async (id) => {
+      const runDir = path4.join(deps.paths.projectSessions, id);
+      try {
+        const stat8 = await fs4.stat(runDir);
+        if (!stat8.isDirectory()) return null;
+      } catch {
+        return null;
+      }
+      const [manifestResult, checkpointResult, subagentFilesResult] = await Promise.all([
+        fs4.access(path4.join(runDir, "fleet.json")).then(
+          () => true,
+          () => false
+        ),
+        fs4.access(path4.join(runDir, "checkpoint.json")).then(
+          () => true,
+          () => false
+        ),
+        fs4.readdir(path4.join(runDir, "subagents")).then(
+          (files) => files.filter((f) => f.endsWith(".jsonl")).length,
+          () => 0
+        )
+      ]);
+      return {
+        id,
+        manifest: manifestResult,
+        checkpoint: checkpointResult,
+        subagents: subagentFilesResult
+      };
+    })
+  );
+  for (const r of perEntry) if (r) runs.push(r);
   if (runs.length === 0) {
     deps.renderer.write("No fleet runs found.\n");
     return 0;
@@ -27268,17 +27328,22 @@ Fleet Run: ${runId}
     deps.renderer.write(`
   Subagent transcripts (${subagentFiles.length}):
 `);
-    for (const f of subagentFiles.sort()) {
-      const filePath = path4.join(subagentsDir, f);
-      let size;
-      try {
-        const s = await fs4.stat(filePath);
-        size = s.size;
-      } catch {
-        size = 0;
-      }
+    const sortedFiles = subagentFiles.sort();
+    const sizes = await Promise.all(
+      sortedFiles.map(async (f) => {
+        const filePath = path4.join(subagentsDir, f);
+        try {
+          const s = await fs4.stat(filePath);
+          return s.size;
+        } catch {
+          return 0;
+        }
+      })
+    );
+    for (let i = 0; i < sortedFiles.length; i++) {
+      const size = sizes[i] ?? 0;
       const sizeStr = size > 1024 * 1024 ? `${(size / 1024 / 1024).toFixed(1)}MB` : `${(size / 1024).toFixed(0)}KB`;
-      deps.renderer.write(`    ${color.dim(f)}  ${color.dim(sizeStr)}
+      deps.renderer.write(`    ${color.dim(sortedFiles[i] ?? "")}  ${color.dim(sizeStr)}
 `);
     }
   } else {
@@ -27682,9 +27747,10 @@ var helpCmd = async (_args, deps) => {
     "  --yolo-destructive            Deprecated \u2014 YOLO now auto-approves everything by default",
     "  --tui / --no-tui             Force or disable TUI mode",
     "  --mouse                      Full mouse mode in the TUI (in-app scroll + clickable UI)",
-    "  --webui [--port <n>] [--open] Serve the browser UI + WS bridge (prints a URL,",
-    "                               --open pops the browser; shares this terminal's",
-    "                               agent; auto-picks free ports)",
+    "  --webui [--host <h>] [--webui-port <n>] [--ws-port <n>] [--webui-token <t>] [--open]",
+    "          [--webui-public-url <url>] [--webui-public-ws-url <url>] [--webui-require-token]",
+    "                               Serve the browser UI + WS bridge (prints a token URL,",
+    "                               --open pops the browser; shares this terminal's agent)",
     '  --eternal "<mission>"        Start an eternal-autonomy loop',
     "  --no-hints                   Hide launch hints",
     "  --skip-index                 Skip codebase indexing and the large-codebase prompt"
@@ -28039,7 +28105,7 @@ async function boot(argv) {
       await persistLaunchChoices(wpaths.globalConfig, toPersist);
     } catch {
     }
-    printLaunchHints(renderer, flags, {
+    await printLaunchHints(renderer, flags, {
       cursorFile: path4.join(wpaths.cacheDir, "hint-cursor")
     });
   } else {
@@ -28785,11 +28851,79 @@ async function runWebUIDispatch(ctx) {
   agent.disableInteractiveConfirmation();
   renderer.setSilent(true);
   const { runWebUI: runWebUI2 } = await Promise.resolve().then(() => (init_webui_server(), webui_server_exports));
+  const flagValue = (names) => {
+    for (const name of names) {
+      if (!Object.prototype.hasOwnProperty.call(flags, name)) continue;
+      const value = flags[name];
+      if (typeof value === "string" && value.trim() !== "") return value.trim();
+      throw new Error(`--${name} requires a value`);
+    }
+    return void 0;
+  };
+  const flagBoolean = (names) => {
+    for (const name of names) {
+      if (!Object.prototype.hasOwnProperty.call(flags, name)) continue;
+      const value = flags[name];
+      if (value === void 0) continue;
+      if (typeof value === "boolean") return value;
+      const normalized = value.trim().toLowerCase();
+      if (["1", "true", "yes", "on"].includes(normalized)) return true;
+      if (["0", "false", "no", "off"].includes(normalized)) return false;
+      throw new Error(`--${name} must be a boolean value`);
+    }
+    return void 0;
+  };
+  const envFlag2 = (name) => {
+    const value = process.env[name]?.trim().toLowerCase();
+    return value === "1" || value === "true" || value === "yes" || value === "on";
+  };
+  const parsePort = (value, fallback, label) => {
+    if (value === void 0) return fallback;
+    const parsed = Number.parseInt(value, 10);
+    if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
+      throw new Error(`${label} must be a port between 1 and 65535`);
+    }
+    return parsed;
+  };
+  let webuiHost;
+  let webuiHttpPort;
+  let webuiWsPort;
+  let webuiAccessToken;
+  let webuiPublicUrl;
+  let webuiPublicWsUrl;
+  let webuiRequireToken;
+  try {
+    webuiHost = flagValue(["webui-host", "host"]) ?? process.env["WEBUI_HOST"] ?? process.env["WS_HOST"] ?? "127.0.0.1";
+    webuiHttpPort = parsePort(
+      flagValue(["webui-port", "http-port"]) ?? process.env["WEBUI_PORT"] ?? process.env["PORT"],
+      3456,
+      "--webui-port"
+    );
+    webuiWsPort = parsePort(
+      flagValue(["ws-port"]) ?? flagValue(["port"]) ?? process.env["WS_PORT"],
+      3457,
+      "--ws-port"
+    );
+    webuiAccessToken = flagValue(["webui-token"]) ?? process.env["WEBUI_TOKEN"] ?? process.env["WEBUI_AUTH_TOKEN"];
+    webuiPublicUrl = flagValue(["webui-public-url", "public-url"]) ?? process.env["WEBUI_PUBLIC_URL"];
+    webuiPublicWsUrl = flagValue(["webui-public-ws-url", "public-ws-url"]) ?? process.env["WEBUI_PUBLIC_WS_URL"];
+    webuiRequireToken = flagBoolean(["webui-require-token", "require-token"]) ?? envFlag2("WEBUI_REQUIRE_TOKEN");
+  } catch (err) {
+    renderer.setSilent(false);
+    renderer.writeInfo(color.red(`  ${err instanceof Error ? err.message : String(err)}`));
+    return 1;
+  }
   const webuiPromise = runWebUI2({
     agent,
     events,
     session,
-    port: Number.parseInt(String(flags.port ?? "3457"), 10),
+    host: webuiHost,
+    port: webuiWsPort,
+    httpPort: webuiHttpPort,
+    accessToken: webuiAccessToken,
+    publicUrl: webuiPublicUrl,
+    publicWsUrl: webuiPublicWsUrl,
+    requireToken: webuiRequireToken,
     projectRoot,
     appConfig: config,
     open: !!flags.open,
@@ -28813,16 +28947,13 @@ async function runWebUIDispatch(ctx) {
     needsSetup,
     sddSubagentFactory,
     // Print the "open this" banner only once the server is actually
-    // listening, using the RESOLVED ports. The requested port
-    // (flags.port) auto-advances past busy ports inside runWebUI, so a
-    // banner printed up-front with flags.port lies whenever 3456/3457 are
-    // taken (a second instance, leftover sockets). Bind is 127.0.0.1-only,
-    // so the host must be the literal IPv4 loopback — `localhost` resolves
-    // to `::1` first on Windows and never reaches the server.
-    onListening: ({ httpPort: boundHttpPort }) => {
+    // listening, using the RESOLVED ports. Requested ports auto-advance past
+    // busy ports inside runWebUI, so a banner printed up-front lies whenever
+    // 3456/3457 are taken (a second instance, leftover sockets).
+    onListening: ({ url }) => {
       renderer.writeInfo(
         color.green(
-          `  \u2726 WebUI running \u2192 ${color.bold(`http://127.0.0.1:${boundHttpPort}`)}`
+          `  \u2726 WebUI running \u2192 ${color.bold(url)}`
         )
       );
       renderer.writeInfo(
@@ -32989,7 +33120,7 @@ async function setupCodebaseIndexing(deps) {
   let watcher;
   if (idx.watchExternal) {
     try {
-      watcher = fs3.watch(projectRoot, { recursive: true }, (_event, filename) => {
+      watcher = fs37.watch(projectRoot, { recursive: true }, (_event, filename) => {
         if (!filename) return;
         const rel = filename.toString();
         if (isIgnored(rel)) return;
@@ -34248,6 +34379,7 @@ async function main(argv) {
       config = patchConfig(config, { provider: providerId, model: modelId });
       configStore.update({ provider: providerId, model: modelId });
       await refreshMaxContextFor(providerId, modelId);
+      await refreshActiveReasoningConfig(providerId, modelId);
       return null;
     } catch (err) {
       return err instanceof Error ? err.message : String(err);
@@ -34941,29 +35073,36 @@ ${color.dim("\u2500".repeat(40))}` : "";
         return "No fleet transcripts on disk \u2014 no subagents have been spawned for this session.";
       }
       const found = [];
-      for (const runId of runDirs) {
-        const runDir = path4.join(subagentsRoot, runId);
-        let files;
-        try {
-          files = await fs4.readdir(runDir);
-        } catch {
-          continue;
-        }
-        for (const f of files) {
-          if (!f.endsWith(".jsonl")) continue;
-          const full = path4.join(runDir, f);
+      const runResults = await Promise.all(
+        runDirs.map(async (runId) => {
+          const runDir = path4.join(subagentsRoot, runId);
+          let files;
           try {
-            const stat8 = await fs4.stat(full);
-            found.push({
-              runId,
-              subagentId: f.replace(/\.jsonl$/, ""),
-              file: full,
-              size: stat8.size
-            });
+            files = await fs4.readdir(runDir);
           } catch {
+            return [];
           }
-        }
-      }
+          const jsonlFiles = files.filter((f) => f.endsWith(".jsonl"));
+          const fileResults = await Promise.all(
+            jsonlFiles.map(async (f) => {
+              const full = path4.join(runDir, f);
+              try {
+                const stat8 = await fs4.stat(full);
+                return {
+                  runId,
+                  subagentId: f.replace(/\.jsonl$/, ""),
+                  file: full,
+                  size: stat8.size
+                };
+              } catch {
+                return null;
+              }
+            })
+          );
+          return fileResults.filter((r) => r !== null);
+        })
+      );
+      for (const runResult of runResults) found.push(...runResult);
       if (found.length === 0) {
         return "No subagent transcripts found on disk.";
       }
@@ -35355,12 +35494,28 @@ Restart WrongStack to load or unload plugin code in this session.`;
       const core = await import('@wrongstack/core');
       let worktrees;
       if (process.env["WRONGSTACK_SDD_WORKTREES"] !== "0") {
-        const { spawnSync } = await import('child_process');
-        const inGit = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], {
-          cwd: projectRoot,
-          encoding: "utf8",
-          windowsHide: true
-        }).stdout?.trim() === "true";
+        const inGit = await new Promise((resolve13) => {
+          let resolved = false;
+          const settle = (v) => {
+            if (resolved) return;
+            resolved = true;
+            resolve13(v);
+          };
+          try {
+            const child = spawn("git", ["rev-parse", "--is-inside-work-tree"], {
+              cwd: projectRoot,
+              env: process.env,
+              stdio: ["ignore", "pipe", "pipe"],
+              windowsHide: true
+            });
+            const chunks = [];
+            child.stdout?.on("data", (c) => chunks.push(c.toString()));
+            child.on("error", () => settle(false));
+            child.on("close", (code) => settle(code === 0 && chunks.join("").trim() === "true"));
+          } catch {
+            settle(false);
+          }
+        });
         if (inGit) worktrees = new core.WorktreeManager({ projectRoot, events });
       }
       const boardStore = new core.SddBoardStore({ baseDir: wpaths.projectSddBoards });