@wrongstack/cli 0.282.0 → 0.282.2

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { CODEX_MODELS, color, ToolCapabilities, PHASE_EVENT_NAMES, readBundledInstructionText, writeErr, loadPlugins, renderProgress, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, expectDefined, DefaultTaskStore, TaskTracker, renderTaskGraph, withFileLock, ConfigError, resolveHqDataDir, ensureHqFirstRunAuthFile, DEFAULT_HQ_REDACTION_POLICY, createHqPersistence, HqCommandAuditLog, HqAlertEngine, toAlertMessage, validateHqCommand, watchHqAuthFile, parseHqFrame, HQ_PROTOCOL_VERSION, parseHqEventPayload, scrubAndTruncateHqPreview, FetchError, removeColumn, addColumn, getTask, removeTask, getBoard, assignTask, updateTaskAssignment, listBoards, copyTaskToBoard, transferTaskToBoard, moveTask, updateTask, addTask, generateBoardFromDescription, createBoard, parseLinesIntoTasks, removeBoard, duplicateBoard, updateBoard, wstackGlobalRoot, DefaultSecretScrubber, resolveWstackPaths, watchProviderConfig, PromptUsageStore, TOKENS, ToolRegistry, GlobalMailbox, resolveSessionLoggingConfig, createSessionEventBridge, HookRegistry, HookRunner, shellHooksEqual, countShellHooks, normalizeTokenSavingTier, SlashCommandRegistry, attachDepWatcherBridge, createFallbackModelExtension, SessionMemoryConsolidator, BrainDecisionQueue, ObservableBrainArbiter, HumanEscalatingBrainArbiter, createTieredBrainArbiter, DefaultBrainArbiter, BrainMonitor, mailboxSessionTag, createDelegateTool, FLEET_ROSTER, createMcpControlTool, startTechStackConsumer, startPackageOutdatedWatcher, SddRunRegistry, recordFileAction, createAutonomyBrain, DefaultPluginAPI, SpecVersioning, buildTranscriptFromEvents, DefaultLogger, DefaultModelsRegistry, isStdinTTY, FsError, atomicWrite, EventBus, runProviderWithRetry, ReplayLogStore, ReplayProviderRunner, mergeCustomModelDefs, DefaultSystemPromptBuilder, makeAutonomyPromptContributor, sessionScopedPath as sessionScopedPath$1, createContextManagerTool, makeMailboxTool, makeMailSendTool, makeMailInboxTool, makeFleetStatusTool, applyToolDescriptionModes, applyToolResultRenderModes, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, createHqPublisherFromEnv, DEFAULT_SESSION_PRUNE_DAYS, RecoveryLock, DefaultAttachmentStore, Context, QueueStore, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, loadPlan, createDefaultPipelines, applyModelRuntime, installDesignStudioMiddleware, resolveContextWindowPolicy, resolveAuditLevel, AutoCompactionMiddleware, estimateRequestTokensCalibrated, Agent, FleetManager, makeDirectorSessionFactory, WorktreeManager, Director, makeFleetEmitTool, AdaptiveConcurrencyController, resolveSubagentModelTarget, DEFAULT_SUBAGENT_BASELINE, AutoApprovePermissionPolicy, mergeModelRuntime, ToolValidationError, WIDE_SUBAGENT_CAPABILITIES, resolveProjectDir, FleetSupervisor, AgentError, PhaseStore, PhaseOrchestrator, assignNickname, AutoPhasePlanner, PhaseGraphBuilder, makeLLMClassifier, writeOut, ParallelEternalEngine, EternalAutonomyEngine, allServers as allServers$1, CHIMERA_REVIEW_PROMPT, setQueuedMessagesSnapshot, bootConfig as bootConfig$1, setOutputLineGuard, setRawMode, DefaultSessionReader, ToolAuditLog, DefaultSessionRewinder, DefaultSessionStore, ProviderRegistry, makePreferSideConflictResolver, makeAgentSubagentRunner, NULL_FLEET_BUS, ERROR_CODES, buildChildEnv, exportBoardAsMarkdown, formatContextWindowModeList, repairToolUseAdjacency, getContextWindowMode, AGENT_CATALOG, dispatchAgent, normalizeToolDescriptionMode, getToolDescriptionMode, noOpVault, formatTodosList, loadTasks, formatTaskList, formatTaskProgress, mutateTasks, emptyPlan, addPlanItem, savePlan, formatPlan, recordCompletedWorkEvidence, saveCompletedWorkCheckpoint, SessionRecovery, loadGoal, goalFilePath, summarizeUsage, saveGoal, formatGoal, emptyGoal, buildGoalPreamble, pendingBtwCount, setBtwNote, getDesignKitLoader, getDesignState, clearActiveKit, clearPersistedActiveKit, recordOverrides, setDesignOverrides, loadActiveKit, isDesignStack, applyTokenOverrides, materializeTokens, setActiveKit, readHqRuntimeFileSync, resolveHqConfig, MATRIX_PHASE_KEYS, matrixKeyKind, phaseForRole, resolveModelMatrix, resolveModelTargetFromEntry, fallbackProfileChain, parseModelRef, normalizeModelRef, onResize, hasOpenTodos, InputBuilder, DefaultSecretVault as DefaultSecretVault$1, decryptConfigSecrets as decryptConfigSecrets$1, encryptConfigSecrets as encryptConfigSecrets$1, DEFAULT_CONTEXT_WINDOW_MODE_ID, HQ_AUTH_FILE_VERSION, truncate, addDependency, addNoteToTask, addCheckToTask, estimateMessageTokens, AGENTS_BY_PHASE, validateAgainstSchema, normalizeToolResultRenderMode, getToolResultRenderMode, setToolResultRenderMode, resolveMailboxIdentity, smartDefaultFallbackChain, AutonomousCoordinator, mutateHqAuthFile, mintHqToken, readHqAuthFile, areDependenciesMet, findBlockedTasks, renderInstructionTemplate, recentTextTurns, gatedEnhancerReasoning, enhanceUserPrompt, mutatePlan, setPlanItemStatus, getPlanTemplate, resolveProviderModelList, ParseError, startSessionTelemetryBridge, startFleetTelemetryBridge, startBrainTelemetryBridge, startWorktreeTelemetryBridge, startToolTelemetryBridge, startCostTelemetryBridge } from '@wrongstack/core';
+import { CODEX_MODELS, color, ToolCapabilities, PHASE_EVENT_NAMES, readBundledInstructionText, writeErr, loadPlugins, renderProgress, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, expectDefined, DefaultTaskStore, TaskTracker, renderTaskGraph, withFileLock, ConfigError, resolveHqDataDir, ensureHqFirstRunAuthFile, DEFAULT_HQ_REDACTION_POLICY, createHqPersistence, HqCommandAuditLog, HqAlertEngine, toAlertMessage, validateHqCommand, watchHqAuthFile, parseHqFrame, HQ_PROTOCOL_VERSION, parseHqEventPayload, scrubAndTruncateHqPreview, FetchError, removeColumn, addColumn, getTask, removeTask, getBoard, assignTask, updateTaskAssignment, listBoards, updateGoalMetricOnTask, addGoalMetricToTask, releaseTaskClaim, claimReadyTask, getTaskChain, setTaskChain, copyTaskToBoard, transferTaskToBoard, moveTask, updateTask, mergeTasks, splitTask, addTask, syncBoardFromTaskGraph, deserializeTaskGraph, exportBoardToTaskGraph, serializeTaskGraph, getKanbanOrchestrationSnapshot, listReadyTasks, generateBoardFromDescription, createBoard, parseLinesIntoTasks, removeBoard, duplicateBoard, updateBoard, wstackGlobalRoot, DefaultSecretScrubber, resolveWstackPaths, watchProviderConfig, TOKENS, PromptUsageStore, ToolRegistry, GlobalMailbox, resolveSessionLoggingConfig, createSessionEventBridge, HookRegistry, HookRunner, shellHooksEqual, countShellHooks, normalizeTokenSavingTier, allServers as allServers$1, SlashCommandRegistry, attachDepWatcherBridge, createFallbackModelExtension, SessionMemoryConsolidator, BrainDecisionQueue, ObservableBrainArbiter, HumanEscalatingBrainArbiter, createTieredBrainArbiter, DefaultBrainArbiter, BrainMonitor, mailboxSessionTag, createDelegateTool, FLEET_ROSTER, createMcpControlTool, startTechStackConsumer, startPackageOutdatedWatcher, SddRunRegistry, recordFileAction, createAutonomyBrain, DefaultPluginAPI, SpecVersioning, buildTranscriptFromEvents, DefaultLogger, DefaultModelsRegistry, isStdinTTY, FsError, atomicWrite, EventBus, runProviderWithRetry, ReplayLogStore, ReplayProviderRunner, mergeCustomModelDefs, DefaultSystemPromptBuilder, makeAutonomyPromptContributor, sessionScopedPath as sessionScopedPath$1, createContextManagerTool, makeMailboxTool, makeMailSendTool, makeMailInboxTool, makeFleetStatusTool, applyToolDescriptionModes, applyToolResultRenderModes, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, createHqPublisherFromEnv, DEFAULT_SESSION_PRUNE_DAYS, RecoveryLock, DefaultAttachmentStore, Context, QueueStore, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, loadPlan, createDefaultPipelines, applyModelRuntime, installDesignStudioMiddleware, resolveContextWindowPolicy, resolveAuditLevel, AutoCompactionMiddleware, estimateRequestTokensCalibrated, Agent, FleetManager, makeDirectorSessionFactory, WorktreeManager, Director, makeFleetEmitTool, AdaptiveConcurrencyController, resolveSubagentModelTarget, DEFAULT_SUBAGENT_BASELINE, AutoApprovePermissionPolicy, mergeModelRuntime, ToolValidationError, WIDE_SUBAGENT_CAPABILITIES, resolveProjectDir, FleetSupervisor, AgentError, PhaseStore, PhaseOrchestrator, assignNickname, AutoPhasePlanner, PhaseGraphBuilder, makeLLMClassifier, writeOut, ParallelEternalEngine, EternalAutonomyEngine, CHIMERA_REVIEW_PROMPT, setQueuedMessagesSnapshot, bootConfig as bootConfig$1, setOutputLineGuard, setRawMode, DefaultSessionReader, ToolAuditLog, DefaultSessionRewinder, DefaultSessionStore, ProviderRegistry, makePreferSideConflictResolver, makeAgentSubagentRunner, NULL_FLEET_BUS, ERROR_CODES, buildChildEnv, exportBoardAsMarkdown, formatContextWindowModeList, repairToolUseAdjacency, getContextWindowMode, AGENT_CATALOG, dispatchAgent, normalizeToolDescriptionMode, getToolDescriptionMode, noOpVault, formatTodosList, loadTasks, formatTaskList, formatTaskProgress, mutateTasks, emptyPlan, addPlanItem, savePlan, formatPlan, recordCompletedWorkEvidence, saveCompletedWorkCheckpoint, SessionRecovery, loadGoal, goalFilePath, summarizeUsage, saveGoal, formatGoal, emptyGoal, buildGoalPreamble, pendingBtwCount, setBtwNote, getDesignKitLoader, getDesignState, clearActiveKit, clearPersistedActiveKit, recordOverrides, setDesignOverrides, loadActiveKit, isDesignStack, applyTokenOverrides, materializeTokens, setActiveKit, readHqRuntimeFileSync, resolveHqConfig, MATRIX_PHASE_KEYS, matrixKeyKind, phaseForRole, resolveModelMatrix, resolveModelTargetFromEntry, fallbackProfileChain, parseModelRef, normalizeModelRef, onResize, hasOpenTodos, InputBuilder, DefaultSecretVault as DefaultSecretVault$1, decryptConfigSecrets as decryptConfigSecrets$1, encryptConfigSecrets as encryptConfigSecrets$1, DEFAULT_CONTEXT_WINDOW_MODE_ID, HQ_AUTH_FILE_VERSION, truncate, createBoardFromTaskGraph, addDependency, addNoteToTask, addCheckToTask, estimateMessageTokens, AGENTS_BY_PHASE, validateAgainstSchema, normalizeToolResultRenderMode, getToolResultRenderMode, setToolResultRenderMode, resolveMailboxIdentity, smartDefaultFallbackChain, AutonomousCoordinator, mutateHqAuthFile, mintHqToken, readHqAuthFile, areDependenciesMet, findBlockedTasks, renderInstructionTemplate, recentTextTurns, gatedEnhancerReasoning, enhanceUserPrompt, mutatePlan, setPlanItemStatus, getPlanTemplate, resolveProviderModelList, ParseError, startSessionTelemetryBridge, startFleetTelemetryBridge, startBrainTelemetryBridge, startWorktreeTelemetryBridge, startToolTelemetryBridge, startCostTelemetryBridge } from '@wrongstack/core';
 import * as fs2 from 'fs/promises';
 import { access, readFile } from 'fs/promises';
 import { DefaultSecretVault, decryptConfigSecrets, encryptConfigSecrets, isSecretField } from '@wrongstack/core/security';
@@ -8,7 +8,7 @@ import { join } from 'path';
 import * as crypto from 'crypto';
 import { createHash, randomUUID, randomBytes, timingSafeEqual } from 'crypto';
 import { createRequire } from 'module';
-import * as fs27 from 'fs';
+import * as fs28 from 'fs';
 import { watch, writeFileSync, existsSync, realpathSync } from 'fs';
 import * as http from 'http';
 import { createServer } from 'http';
@@ -34,7 +34,7 @@ import { parseNextSteps } from '@wrongstack/tui';
 import { WrongStackACPServer, makeACPServerAgentTurn, ACPSessionStore, WsBridgeTransport, ACPProtocolHandler } from '@wrongstack/acp/agent';
 import { allServers, DefaultPathResolver, DefaultTokenCounter } from '@wrongstack/core/infrastructure';
 import { ToolExecutor } from '@wrongstack/core/execution';
-import { loadBenchConfig, reportHeaderLine, readSummary, renderMarkdownReport, createPolyglotSuite, createSwebenchSuite, runBenchmark, writeJsonArtifacts, collectCellPredictions, writePredictionsJsonl, gradePolyglot, gradeSwebench } from '@wrongstack/bench';
+import { loadBenchConfig, reportHeaderLine, computeToolManifestHash, readSummary, renderMarkdownReport, createPolyglotSuite, createSwebenchSuite, createLocalManifestSuite, runBenchmark, writeJsonArtifacts, collectCellPredictions, writePredictionsJsonl, gradePolyglot, gradeSwebench, gradeLocalManifest } from '@wrongstack/bench';
 import { createAgentMonitorService, acquireOrJoin, release, finalize, readLiveLock } from '@wrongstack/core/coordination';
 import * as net from 'net';
 import { createToolVisionAdapters } from '@wrongstack/runtime/vision';
@@ -639,6 +639,956 @@ var init_helpers = __esm({
     ENTRY_BASENAMES = /* @__PURE__ */ new Set(["main", "index", "app", "cli", "server", "__main__"]);
   }
 });
+async function runPluginManagementCommand(args, deps) {
+  const sub = args[0];
+  if (!sub || sub === "list" || sub === "status") {
+    return {
+      code: 0,
+      level: "output",
+      message: renderConfiguredPlugins(deps.config)
+    };
+  }
+  if (sub === "official" || sub === "officials") {
+    return {
+      code: 0,
+      level: "output",
+      message: renderOfficialPlugins(deps.config)
+    };
+  }
+  if (sub === "report" || sub === "audit" || sub === "menu") {
+    return {
+      code: 0,
+      level: "output",
+      message: renderPluginAuditReport(deps.config)
+    };
+  }
+  if (sub === "add" || sub === "install") {
+    const spec = args[1];
+    if (!spec) {
+      return errorResult("Usage: wstack plugin add <specifier|official-alias> [--disabled]");
+    }
+    return upsertPlugin(
+      resolvePluginSpecifier(spec),
+      { enabled: !args.includes("--disabled") },
+      deps,
+      "Added"
+    );
+  }
+  if (sub === "remove" || sub === "rm" || sub === "uninstall") {
+    const spec = args[1];
+    if (!spec) {
+      return errorResult("Usage: wstack plugin remove <specifier|official-alias>");
+    }
+    return removePlugin(resolvePluginSpecifier(spec), deps);
+  }
+  if (sub === "enable" || sub === "disable") {
+    const spec = args[1];
+    if (!spec) {
+      return errorResult(`Usage: wstack plugin ${sub} <specifier|official-alias>`);
+    }
+    return upsertPlugin(
+      resolvePluginSpecifier(spec),
+      { enabled: sub === "enable" },
+      deps,
+      sub === "enable" ? "Enabled" : "Disabled"
+    );
+  }
+  if (sub === "toggle") {
+    const spec = args[1];
+    if (!spec) {
+      return errorResult("Usage: wstack plugin toggle <plugin-name|official-alias>");
+    }
+    return togglePlugin(resolvePluginToggleSpecifier(spec), deps);
+  }
+  if (sub === "llm") {
+    return runPluginLlmCommand(args.slice(1), deps);
+  }
+  return errorResult(
+    `Unknown plugin subcommand: ${sub}
+Usage: wstack plugin [list|status|report|menu|official|add|install|remove|enable|disable|toggle|llm]`
+  );
+}
+function renderPluginLlmOverviews(config, sessionDefault) {
+  const rows = [];
+  for (const [pluginName2, ext] of Object.entries(config.extensions ?? {})) {
+    const llm = ext?.["llm"];
+    if (llm && typeof llm === "object") {
+      const o = llm;
+      rows.push({
+        name: pluginName2,
+        provider: o.provider ?? "(session)",
+        model: o.model ?? "(session)"
+      });
+    }
+  }
+  const lines = [`Per-plugin LLM routing (session default: ${sessionDefault}):`];
+  if (rows.length === 0) {
+    lines.push(
+      "  No plugin overrides \u2014 every plugin follows the session default.",
+      "  Set one with: wstack plugin llm <plugin> <provider> [model]"
+    );
+  } else {
+    rows.sort((a, b) => a.name.localeCompare(b.name));
+    for (const r of rows) {
+      lines.push(`  ${r.name.padEnd(24)} provider=${r.provider.padEnd(16)} model=${r.model}`);
+    }
+    lines.push("", "Clear one with: wstack plugin llm <plugin> --clear");
+  }
+  return lines.join("\n");
+}
+async function runPluginLlmCommand(args, deps) {
+  const sessionDefault = `${deps.config.provider ?? "?"} / ${deps.config.model ?? "?"}`;
+  if (args.length === 0 || args[0] === "list") {
+    return {
+      code: 0,
+      level: "output",
+      message: renderPluginLlmOverviews(deps.config, sessionDefault)
+    };
+  }
+  const name = args[0];
+  if (!name || name.startsWith("-")) return errorResult(PLUGIN_LLM_USAGE);
+  const currentOverride = deps.config.extensions?.[name]?.["llm"];
+  if (args.length === 1) {
+    const lines = [`LLM routing for plugin "${name}":`];
+    if (currentOverride && typeof currentOverride === "object") {
+      const o = currentOverride;
+      lines.push(
+        `  override: provider=${o.provider ?? "(session)"} model=${o.model ?? "(session)"}`,
+        `  session default: ${sessionDefault}`
+      );
+    } else {
+      lines.push(
+        `  no override \u2014 follows the session default (${sessionDefault}).`,
+        `  Set one with: wstack plugin llm ${name} <provider> [model]`
+      );
+    }
+    return { code: 0, level: "output", message: lines.join("\n") };
+  }
+  const existing = await readConfig(deps.configPath);
+  const fileExtensions = isRecord(existing.extensions) ? existing.extensions : {};
+  const pluginExt = isRecord(fileExtensions[name]) ? { ...fileExtensions[name] } : {};
+  if (args[1] === "--clear" || args[1] === "clear") {
+    if (!("llm" in pluginExt) && !currentOverride) {
+      return { code: 0, level: "info", message: `Plugin "${name}" has no LLM override.` };
+    }
+    delete pluginExt["llm"];
+    if (Object.keys(pluginExt).length === 0) delete fileExtensions[name];
+    else fileExtensions[name] = pluginExt;
+    existing.extensions = fileExtensions;
+    await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+    const merged2 = mergeExtensionsForPatch(deps.config, fileExtensions);
+    const mergedEntry = merged2[name];
+    if (mergedEntry) {
+      delete mergedEntry["llm"];
+      if (Object.keys(mergedEntry).length === 0) delete merged2[name];
+    }
+    return {
+      code: 0,
+      level: "info",
+      message: `Cleared LLM override for "${name}" \u2014 it now follows the session default (${sessionDefault}). Takes effect immediately for api.llm calls.`,
+      patch: { extensions: merged2 }
+    };
+  }
+  const providerArg = args[1];
+  const modelArg = args[2];
+  if (!providerArg || providerArg.startsWith("--")) return errorResult(PLUGIN_LLM_USAGE);
+  const provider = providerArg === "-" ? void 0 : providerArg;
+  const model = modelArg && modelArg !== "-" ? modelArg : void 0;
+  if (!provider && !model) return errorResult(PLUGIN_LLM_USAGE);
+  const llm = {};
+  if (provider) llm["provider"] = provider;
+  if (model) llm["model"] = model;
+  pluginExt["llm"] = llm;
+  fileExtensions[name] = pluginExt;
+  existing.extensions = fileExtensions;
+  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+  const configured = Object.keys(deps.config.providers ?? {});
+  const note = provider && configured.length > 0 && !configured.includes(provider) ? `
+Note: "${provider}" is not in config.providers (configured: ${configured.join(", ")}). Catalog providers (anthropic, openai, \u2026) still resolve if credentials are available.` : "";
+  const merged = mergeExtensionsForPatch(deps.config, fileExtensions);
+  return {
+    code: 0,
+    level: "info",
+    message: `Plugin "${name}" now routes api.llm calls via provider=${provider ?? "(session)"} model=${model ?? "(session)"}. Session default stays ${sessionDefault}. Takes effect immediately for api.llm calls.${note}`,
+    patch: { extensions: merged }
+  };
+}
+function mergeExtensionsForPatch(config, fileExtensions) {
+  const merged = {};
+  for (const [k, v] of Object.entries(config.extensions ?? {})) {
+    merged[k] = { ...v };
+  }
+  for (const [k, v] of Object.entries(fileExtensions)) {
+    if (isRecord(v)) merged[k] = { ...merged[k] ?? {}, ...v };
+  }
+  for (const k of Object.keys(merged)) {
+    if (!(k in fileExtensions) && !(k in (config.extensions ?? {}))) delete merged[k];
+  }
+  return merged;
+}
+function resolvePluginSpecifier(input) {
+  return OFFICIAL_ALIASES.get(input.toLowerCase()) ?? input;
+}
+function resolvePluginToggleSpecifier(input) {
+  if (input.toLowerCase() === "@wrongstack/telegram") return "telegram";
+  if (auditEntryFor(input)) return input;
+  return resolvePluginSpecifier(input);
+}
+function renderOfficialPlugins(config) {
+  return [
+    "Official plugins:",
+    ...OFFICIAL_PLUGINS.map((p) => {
+      const state = config ? officialPluginState(config, p.specifier) : "";
+      const status = state ? `${state.padEnd(14)} ` : "";
+      return `  ${p.alias.padEnd(12)} ${status}${p.specifier.padEnd(24)} ${p.description}`;
+    }),
+    "",
+    "Use `wstack plugin add <alias>` or `/plugin install <alias>`."
+  ].join("\n");
+}
+function renderConfiguredPlugins(config) {
+  const plugins = config.plugins ?? [];
+  if (plugins.length === 0) {
+    return [
+      "No plugins configured.",
+      "Use `wstack plugin add <specifier>` or `/plugin install <official-alias>`."
+    ].join("\n");
+  }
+  return plugins.map((p) => {
+    const name = pluginName(p);
+    const enabled = typeof p === "object" && p.enabled === false ? "disabled" : "enabled";
+    const official = OFFICIAL_PLUGINS.find((entry) => entry.specifier === name);
+    const suffix = official ? ` (${official.alias})` : "";
+    return `  ${`${name}${suffix}`.padEnd(44)} ${enabled}`;
+  }).join("\n");
+}
+function renderPluginAuditReport(config) {
+  const configured = config.plugins ?? [];
+  const lines = [
+    "Plugin audit report:",
+    "  State shows the effective boot state. Default-active plugins run unless disabled in config.",
+    "  Built-in audit rows are toggleable unless a future row explicitly marks itself locked.",
+    "",
+    "  Built-in audit entries:"
+  ];
+  for (const entry of PLUGIN_AUDIT_ENTRIES) {
+    const { state, source } = effectiveAuditState(config, entry);
+    const policy = entry.canDisable ? "toggleable" : lockedReason(entry);
+    lines.push(
+      `  ${entry.name.padEnd(24)} ${state.padEnd(8)} ${source.padEnd(8)} risk=${entry.risk.padEnd(6)} ${policy.padEnd(24)} ${entry.summary}`
+    );
+  }
+  const extra = configured.filter(
+    (plugin) => !PLUGIN_AUDIT_ENTRIES.some((entry) => pluginMatchesToggleSpec(plugin, entry.name))
+  );
+  if (extra.length > 0) {
+    lines.push("", "  Configured plugins outside the audit list:");
+    for (const plugin of extra) {
+      const name = pluginName(plugin);
+      const state = typeof plugin === "object" && plugin.enabled === false ? "disabled" : "enabled";
+      lines.push(
+        `  ${name.padEnd(24)} ${state.padEnd(8)} config   risk=custom user-configured plugin`
+      );
+    }
+  }
+  lines.push(
+    "",
+    "Use `/plugin menu` in the TUI, or `wstack plugin toggle <name>` for toggleable rows."
+  );
+  return lines.join("\n");
+}
+async function readConfig(file) {
+  try {
+    return JSON.parse(await fs2.readFile(file, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function pluginName(p) {
+  return typeof p === "string" ? p : p.name;
+}
+function pluginEntry(spec, enabled) {
+  return enabled ? spec : { name: spec, enabled: false };
+}
+function pluginMatchesToggleSpec(p, spec) {
+  const name = pluginName(p);
+  if (spec === "telegram") return name === "telegram" || name === "@wrongstack/telegram";
+  return name === spec;
+}
+function effectiveAuditState(config, entry) {
+  const configured = (config.plugins ?? []).find(
+    (plugin) => pluginMatchesToggleSpec(plugin, entry.name)
+  );
+  if (configured) {
+    return {
+      state: typeof configured === "object" && configured.enabled === false ? "disabled" : "enabled",
+      source: "config"
+    };
+  }
+  return {
+    state: entry.defaultState === "active" ? "enabled" : "disabled",
+    source: "default"
+  };
+}
+function lockedReason(entry) {
+  if (entry.canDisable) return "toggleable";
+  if (entry.name === "secret-scanner") {
+    return "locked: safety guard";
+  }
+  return "locked: core surface";
+}
+function auditEntryFor(spec) {
+  return PLUGIN_AUDIT_ENTRIES.find((entry) => entry.name === spec);
+}
+function officialPluginState(config, spec) {
+  const match = (config.plugins ?? []).find((p) => pluginName(p) === spec);
+  if (!match) return "not configured";
+  return typeof match === "object" && match.enabled === false ? "disabled" : "enabled";
+}
+async function togglePlugin(spec, deps) {
+  const auditEntry = auditEntryFor(spec);
+  if (auditEntry?.canDisable === false) {
+    return errorResult(`Plugin "${spec}" is locked and cannot be toggled from the plugin menu.`);
+  }
+  const existing = await readConfig(deps.configPath);
+  const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
+  const idx = plugins.findIndex((p) => pluginMatchesToggleSpec(p, spec));
+  const configured = idx >= 0 ? plugins[idx] : void 0;
+  const enabled = configured ? !(typeof configured === "object" && configured.enabled === false) : auditEntry?.defaultState === "active";
+  if (!configured && !auditEntry) {
+    return errorResult(
+      `Plugin "${spec}" is not configured. Use "wstack plugin add ${spec}" first.`
+    );
+  }
+  let nextPlugins;
+  let nextEnabled;
+  if (enabled) {
+    nextEnabled = false;
+    nextPlugins = plugins.filter((p) => !pluginMatchesToggleSpec(p, spec));
+    if (auditEntry?.defaultState !== "inactive") {
+      nextPlugins.push({ name: spec, enabled: false });
+    }
+  } else {
+    nextEnabled = true;
+    if (auditEntry?.defaultState === "active") {
+      nextPlugins = plugins.filter((p) => !pluginMatchesToggleSpec(p, spec));
+    } else {
+      nextPlugins = plugins.filter((p) => !pluginMatchesToggleSpec(p, spec));
+      nextPlugins.push(spec);
+    }
+  }
+  const features = {
+    ...isRecord(deps.config.features) ? deps.config.features : {},
+    ...isRecord(existing.features) ? existing.features : {},
+    plugins: true
+  };
+  existing.plugins = nextPlugins;
+  existing.features = features;
+  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+  const restartRequired = spec === "branch-guard" && !nextEnabled ? void 0 : true;
+  return {
+    code: 0,
+    level: "info",
+    message: `${nextEnabled ? "Enabled" : "Disabled"} "${spec}". Config written to ${deps.configPath}.` + (spec === "branch-guard" && !nextEnabled ? " The running branch-guard hook will disable itself on config update." : ""),
+    patch: { plugins: nextPlugins, features },
+    restartRequired
+  };
+}
+async function upsertPlugin(spec, opts, deps, verb) {
+  const existing = await readConfig(deps.configPath);
+  const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
+  const idx = plugins.findIndex((p) => pluginName(p) === spec);
+  const nextEntry = pluginEntry(spec, opts.enabled);
+  if (idx >= 0) plugins[idx] = nextEntry;
+  else plugins.push(nextEntry);
+  const features = {
+    ...isRecord(deps.config.features) ? deps.config.features : {},
+    ...isRecord(existing.features) ? existing.features : {},
+    plugins: true
+  };
+  existing.plugins = plugins;
+  existing.features = features;
+  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+  const restartRequired = spec === "branch-guard" && !opts.enabled ? void 0 : true;
+  return {
+    code: 0,
+    level: "info",
+    message: `${verb} "${spec}" (${opts.enabled ? "enabled" : "disabled"}). Config written to ${deps.configPath}.` + (spec === "branch-guard" && !opts.enabled ? " The running branch-guard hook will disable itself on config update." : ""),
+    patch: { plugins, features },
+    restartRequired
+  };
+}
+async function removePlugin(spec, deps) {
+  const existing = await readConfig(deps.configPath);
+  const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
+  const next = plugins.filter((p) => pluginName(p) !== spec);
+  if (next.length === plugins.length) {
+    return errorResult(`Plugin "${spec}" not in config.`);
+  }
+  existing.plugins = next;
+  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+  return {
+    code: 0,
+    level: "info",
+    message: `Removed "${spec}" from config.`,
+    patch: { plugins: next },
+    restartRequired: true
+  };
+}
+function errorResult(message) {
+  return { code: 1, level: "error", message };
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+var OFFICIAL_PLUGINS, PLUGIN_AUDIT_ENTRIES, OFFICIAL_ALIASES, PLUGIN_LLM_USAGE;
+var init_plugin_management = __esm({
+  "src/plugin-management.ts"() {
+    OFFICIAL_PLUGINS = [
+      {
+        alias: "telegram",
+        specifier: "@wrongstack/telegram",
+        description: "Telegram bridge for prompts, notifications, and slash commands."
+      },
+      {
+        alias: "lsp",
+        specifier: "@wrongstack/plug-lsp",
+        description: "Language Server Protocol tools for code intelligence."
+      }
+    ];
+    PLUGIN_AUDIT_ENTRIES = [
+      {
+        name: "wstack-prompts",
+        risk: "medium",
+        summary: "Prompt library and prompt authoring commands.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "wstack-sync",
+        risk: "medium",
+        summary: "Cloud sync commands for prompts, skills, settings, memory, and history.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "wstack-git",
+        risk: "high",
+        summary: "Git commands for commit, status checks, and push.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "wstack-observability",
+        risk: "low",
+        summary: "Runtime metrics and health slash commands.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "wstack-security",
+        risk: "high",
+        summary: "Security scanning backend used by first-party security flows.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "wstack-chimera",
+        risk: "medium",
+        summary: "Post-session code quality review agent.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "wstack-skills",
+        risk: "medium",
+        summary: "Skill library, authoring, install, update, and uninstall commands.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "wstack-plan",
+        risk: "medium",
+        summary: "Strategic plan board slash command.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "agent-handoff",
+        risk: "medium",
+        summary: "Mailbox-backed handoff notes and task transfer helpers.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "auto-doc",
+        risk: "medium",
+        summary: "Generates JSDoc/TSDoc comments for source files.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "auto-i18n-extractor",
+        risk: "low",
+        summary: "Finds hardcoded user-facing UI strings and suggests i18n keys when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "accessibility-auditor",
+        risk: "medium",
+        summary: "Scans UI files for common accessibility issues when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "git-autocommit",
+        risk: "high",
+        summary: "Stages files and creates AI-generated conventional commits.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "shell-check",
+        risk: "low",
+        summary: "Runs shellcheck on shell scripts.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "cost-tracker",
+        risk: "low",
+        summary: "Tracks token usage and estimated session cost.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "file-watcher",
+        risk: "medium",
+        summary: "Watches project files and emits change events.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "cron",
+        risk: "medium",
+        summary: "Schedules recurring in-session tasks.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "template-engine",
+        risk: "medium",
+        summary: "Expands and writes file templates.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "semver-bump",
+        risk: "high",
+        summary: "Computes version bumps, changelogs, and tags.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "secret-scanner",
+        risk: "high",
+        summary: "Blocks or redacts credential leaks in tool input and output.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "todo-tracker",
+        risk: "low",
+        summary: "Persistent project-scoped todo backlog.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "token-budget",
+        risk: "medium",
+        summary: "Warns or stops when token budgets are exceeded.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "lint-gate",
+        risk: "medium",
+        summary: "Runs lint checks before write/edit commits.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "branch-guard",
+        risk: "high",
+        summary: "Blocks commits, pushes, and merges on protected branches.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "diff-summary",
+        risk: "low",
+        summary: "Injects compact git diff context after edits.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "commit-validator",
+        risk: "medium",
+        summary: "Validates conventional commit format before commits.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "format-on-save",
+        risk: "medium",
+        summary: "Runs formatter after write/edit tool calls.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "test-runner-gate",
+        risk: "medium",
+        summary: "Runs relevant tests after source edits when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "import-organizer",
+        risk: "medium",
+        summary: "Sorts imports and applies safe linter fixes after edits.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "knowledge-graph",
+        risk: "low",
+        summary: "Stores and queries durable project knowledge graph facts.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "todo-listener",
+        risk: "low",
+        summary: "Broadcasts todo tool updates to the project mailbox when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "session-recap",
+        risk: "low",
+        summary: "Posts a session recap to the project mailbox on stop.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "spec-linker",
+        risk: "low",
+        summary: "Finds unlinked plugin references in markdown edits.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "doc-sync-guard",
+        risk: "low",
+        summary: "Warns when docs drift from recently changed public source files when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "loop-breaker",
+        risk: "low",
+        summary: "Detects runaway tool-call loops; warns, then blocks repeats.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "path-guard",
+        risk: "medium",
+        summary: "Blocks writes and destructive commands on protected paths.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "context-pins",
+        risk: "low",
+        summary: "Pins durable facts into the system prompt across compactions.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "checkpoint",
+        risk: "medium",
+        summary: "Snapshots files before edits and restores pre-edit states.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "error-lens",
+        risk: "low",
+        summary: "Distills failed command output into compact error digests.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "dep-guard",
+        risk: "medium",
+        summary: "Supervises dependency installs: deny list and typosquat warnings.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "dependency-vulnerability-gate",
+        risk: "high",
+        summary: "Audits installed dependencies and blocks vulnerable installs.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "license-audit-gate",
+        risk: "high",
+        summary: "Audits dependency licenses after package installs.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "security-hotspot-scanner",
+        risk: "high",
+        summary: "Scans source files for common security anti-patterns on demand or when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "api-compatibility-gate",
+        risk: "medium",
+        summary: "Warns when public entry-point exports are removed when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "dead-code-detector",
+        risk: "low",
+        summary: "Scans for suspicious exported symbols that appear unused on demand or when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "migration-planner",
+        risk: "low",
+        summary: "Builds dependency or framework migration checklists.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "schema-evolution-guard",
+        risk: "high",
+        summary: "Warns on destructive database or API schema changes.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "semantic-search-indexer",
+        risk: "low",
+        summary: "Builds an in-memory keyword index for project source search.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "config-validator",
+        risk: "low",
+        summary: "Validates JSON/YAML/TOML files right after write/edit.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "notify-hub",
+        risk: "medium",
+        summary: "Sends session events and ad-hoc notifications to a webhook.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "changelog-writer",
+        risk: "low",
+        summary: "Collects session work and writes Keep-a-Changelog entries.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "injection-shield",
+        risk: "low",
+        summary: "Flags prompt-injection patterns in tool output.",
+        defaultState: "active",
+        canDisable: true
+      },
+      {
+        name: "llm-cache",
+        risk: "medium",
+        summary: "Caches identical provider requests (opt-in; wraps every LLM call).",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "model-router",
+        risk: "medium",
+        summary: "Routes each LLM call to a different model by size/tool rules (opt-in).",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "pr-drafter",
+        risk: "low",
+        summary: "Generates session pull request draft markdown.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "prompt-firewall",
+        risk: "high",
+        summary: "Detects/redacts credential leaks on the provider wire (opt-in).",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "auto-escalate",
+        risk: "medium",
+        summary: "Retries with an escalated model on transient provider errors (opt-in).",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "token-throttle",
+        risk: "medium",
+        summary: "Rolling-window tokens/min rate limiting via provider-call delays (opt-in).",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "plugin-stack-observer",
+        risk: "low",
+        summary: "Reports provider wrapper stack order and health.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "test-coverage-gate",
+        risk: "medium",
+        summary: "Checks coverage thresholds after test runs.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "test-flake-detector",
+        risk: "medium",
+        summary: "Runs tests repeatedly to identify flaky failures.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "performance-regression-gate",
+        risk: "medium",
+        summary: "Compares benchmark results and reports performance regressions.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "type-gate",
+        risk: "medium",
+        summary: "Runs TypeScript type checks after relevant edits when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "code-metrics",
+        risk: "low",
+        summary: "Computes LOC, comment ratio, function count, and approximate cyclomatic complexity on demand or when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "duplicate-code-detector",
+        risk: "low",
+        summary: "Detects duplicate or similar code blocks across source files on demand or when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "feature-flag-tracker",
+        risk: "low",
+        summary: "Scans source files for feature-flag usage and reports flag inventory on demand or when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "interface-contract-guard",
+        risk: "medium",
+        summary: "Warns when TypeScript interfaces change or lack implementers when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "refactor-suggester",
+        risk: "low",
+        summary: "Flags long functions, deep nesting, many parameters, magic numbers, and console.log on demand or when explicitly enabled.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "release-notes-generator",
+        risk: "low",
+        summary: "Groups conventional commits into a release-notes markdown draft.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "smart-rename",
+        risk: "medium",
+        summary: "Whole-word symbol rename with preview and optional apply.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "test-generator",
+        risk: "low",
+        summary: "Generates a unit-test skeleton from exported functions/classes.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "@wrongstack/plug-lsp",
+        risk: "medium",
+        summary: "Language Server Protocol tools and slash commands.",
+        defaultState: "inactive",
+        canDisable: true
+      },
+      {
+        name: "telegram",
+        risk: "medium",
+        summary: "Telegram bridge for messages, approvals, and notifications.",
+        defaultState: "inactive",
+        canDisable: true
+      }
+    ];
+    OFFICIAL_ALIASES = new Map(
+      OFFICIAL_PLUGINS.flatMap((p) => [
+        [p.alias, p.specifier],
+        [p.specifier, p.specifier]
+      ])
+    );
+    PLUGIN_LLM_USAGE = [
+      "Usage:",
+      "  wstack plugin llm                               List every per-plugin LLM override.",
+      "  wstack plugin llm <plugin>                      Show one plugin's LLM override.",
+      "  wstack plugin llm <plugin> <provider> [model]   Route this plugin through a provider (and model).",
+      "  wstack plugin llm <plugin> - <model>            Keep the session provider, override only the model.",
+      "  wstack plugin llm <plugin> --clear              Remove the override (back to the session default).",
+      "",
+      "The override is stored as config.extensions.<plugin>.llm and is used by",
+      "every api.llm call the plugin makes. Without an override, plugins follow",
+      "the active session provider/model (the chat leader)."
+    ].join("\n");
+  }
+});
 function createApi(ownerName, base) {
   return new DefaultPluginAPI({ ownerName, ...base });
 }
@@ -697,9 +1647,11 @@ var init_utils = __esm({
 // src/wiring/plugins.ts
 var plugins_exports = {};
 __export(plugins_exports, {
+  BUILTIN_PLUGIN_CONFIG_NAMES: () => BUILTIN_PLUGIN_CONFIG_NAMES,
   BUILTIN_PLUGIN_FACTORIES: () => BUILTIN_PLUGIN_FACTORIES,
   DEPRECATED_PLUGIN_NAMES: () => DEPRECATED_PLUGIN_NAMES,
   _resetDeprecatedWarningsForTests: () => _resetDeprecatedWarningsForTests,
+  builtinPluginNameFromSpec: () => builtinPluginNameFromSpec,
   pluginNameFromSpec: () => pluginNameFromSpec,
   setupPlugins: () => setupPlugins,
   warnIfDeprecatedPluginName: () => warnIfDeprecatedPluginName
@@ -724,6 +1676,13 @@ function pluginNameFromSpec(spec) {
   if (!last) return null;
   return last.split("?")[0] ?? null;
 }
+function builtinPluginNameFromSpec(spec) {
+  if (BUILTIN_PLUGIN_CONFIG_ALIASES[spec]) return BUILTIN_PLUGIN_CONFIG_ALIASES[spec];
+  const bareName = pluginNameFromSpec(spec);
+  if (BUILTIN_PLUGIN_CONFIG_NAMES.has(spec)) return bareName ?? spec;
+  if (bareName && BUILTIN_PLUGIN_CONFIG_NAMES.has(bareName)) return bareName;
+  return null;
+}
 async function setupPlugins(params) {
   const {
     config,
@@ -751,13 +1710,25 @@ async function setupPlugins(params) {
   const disabledBuiltins = new Set(
     (config.plugins ?? []).filter(
       (p) => typeof p === "object" && p.enabled === false
-    ).map((p) => p.name)
+    ).flatMap((p) => {
+      const builtinName = builtinPluginNameFromSpec(p.name);
+      return builtinName && builtinName !== p.name ? [p.name, builtinName] : [p.name];
+    })
   );
   if (paths && config.features?.plugins !== false) {
     for (const factory of BUILTIN_PLUGIN_FACTORIES) {
       try {
         const plugin = await factory();
         if (!plugin) continue;
+        const auditEntry = PLUGIN_AUDIT_ENTRIES.find((entry) => entry.name === plugin.name);
+        const explicitlyEnabled = (config.plugins ?? []).some((entry) => {
+          const spec = typeof entry === "string" ? entry : entry.name;
+          if (typeof entry === "object" && entry.enabled === false) return false;
+          return (builtinPluginNameFromSpec(spec) ?? spec) === plugin.name;
+        });
+        if (auditEntry?.defaultState === "inactive" && !explicitlyEnabled) {
+          continue;
+        }
         if (disabledBuiltins.has(plugin.name)) {
           log.info(`[setupPlugins] built-in plugin "${plugin.name}" disabled by config`);
           continue;
@@ -778,6 +1749,9 @@ async function setupPlugins(params) {
       if (bareName && warnIfDeprecatedPluginName(bareName, log)) {
         continue;
       }
+      if (builtinPluginNameFromSpec(spec)) {
+        continue;
+      }
       try {
         const mod = await import(spec);
         if (mod.default) userPlugins.push(mod.default);
@@ -857,9 +1831,10 @@ function buildPluginOptions(config) {
   }
   return options;
 }
-var DEPRECATED_PLUGIN_NAMES, deprecatedWarningsEmitted, BUILTIN_PLUGIN_FACTORIES;
+var DEPRECATED_PLUGIN_NAMES, deprecatedWarningsEmitted, BUILTIN_PLUGIN_CONFIG_ALIASES, BUILTIN_PLUGIN_CONFIG_NAMES, BUILTIN_PLUGIN_FACTORIES;
 var init_plugins = __esm({
   "src/wiring/plugins.ts"() {
+    init_plugin_management();
     init_plugin_api_factory();
     init_utils();
     DEPRECATED_PLUGIN_NAMES = {
@@ -867,6 +1842,15 @@ var init_plugins = __esm({
       "json-path": "use the built-in `json` tool with action: query | validate | transform | merge"
     };
     deprecatedWarningsEmitted = /* @__PURE__ */ new Set();
+    BUILTIN_PLUGIN_CONFIG_ALIASES = {
+      lsp: "@wrongstack/plug-lsp",
+      "@wrongstack/telegram": "telegram"
+    };
+    BUILTIN_PLUGIN_CONFIG_NAMES = /* @__PURE__ */ new Set([
+      ...PLUGIN_AUDIT_ENTRIES.map((entry) => entry.name),
+      ...PLUGIN_AUDIT_ENTRIES.map((entry) => `@wrongstack/plugins/${entry.name}`),
+      ...Object.keys(BUILTIN_PLUGIN_CONFIG_ALIASES)
+    ]);
     BUILTIN_PLUGIN_FACTORIES = [
       async () => {
         const { createPromptsPlugin } = await import('@wrongstack/core');
@@ -3664,7 +4648,7 @@ async function boot(){
     dagre = dmod && dmod.default && dmod.default.graphlib ? dmod.default : dmod;
     if(!React || !createRoot || !RF){ throw new Error('cdn-incomplete'); }
   } catch(e){
-    try { console.error('HQ: CDN load failed, using offline fallback \u2014', e && e.message); } catch(_e){}
+    try { console.error(e); } catch(_e){}
     renderFallback();
     connectWs();
     primeSnapshot();
@@ -4230,12 +5214,12 @@ function resolveHqDistDir() {
   try {
     const entry = requireFromHere.resolve("@wrongstack/webui-hq");
     const dir = path5.dirname(entry);
-    if (fs27.existsSync(path5.join(dir, "index.html"))) {
+    if (fs28.existsSync(path5.join(dir, "index.html"))) {
       cachedDistDir = dir;
       return dir;
     }
     const distSub = path5.join(path5.dirname(entry), "dist");
-    if (fs27.existsSync(path5.join(distSub, "index.html"))) {
+    if (fs28.existsSync(path5.join(distSub, "index.html"))) {
       cachedDistDir = distSub;
       return distSub;
     }
@@ -4254,10 +5238,10 @@ function serveHqStatic(_req, res, urlPath, distDir) {
   if (!isInsideDist(filePath, distDir)) {
     return { handled: false };
   }
-  if (!fs27.existsSync(filePath) || fs27.statSync(filePath).isDirectory()) {
+  if (!fs28.existsSync(filePath) || fs28.statSync(filePath).isDirectory()) {
     const indexPath = path5.join(distDir, "index.html");
-    if (fs27.existsSync(indexPath)) {
-      const html = fs27.readFileSync(indexPath, "utf8");
+    if (fs28.existsSync(indexPath)) {
+      const html = fs28.readFileSync(indexPath, "utf8");
       res.writeHead(200, { "Content-Type": MIME[".html"] });
       res.end(html);
       return { handled: true };
@@ -4266,7 +5250,7 @@ function serveHqStatic(_req, res, urlPath, distDir) {
   }
   const ext = path5.extname(filePath).toLowerCase();
   const mime = MIME[ext] ?? "application/octet-stream";
-  const data = fs27.readFileSync(filePath);
+  const data = fs28.readFileSync(filePath);
   res.writeHead(200, { "Content-Type": mime });
   res.end(data);
   return { handled: true };
@@ -6404,6 +7388,29 @@ var init_cost_helpers = __esm({
 function currentSessionId2(ctx) {
   return ctx.agent.ctx.session?.id ?? ctx.sessionId;
 }
+function toolEntries(ctx) {
+  const registry = ctx.agent.tools;
+  if (typeof registry.listWithOwner === "function") {
+    return [
+      ...registry.listWithOwner(),
+      ...typeof registry.listDisabled === "function" ? registry.listDisabled() : []
+    ];
+  }
+  return (registry.list?.() ?? []).map((tool) => ({ tool, owner: "core" }));
+}
+function persistDisabledTool(ctx, name, disabled) {
+  const configStore = ctx.configStore;
+  if (!configStore) return;
+  const currentTools = configStore.get().tools ?? {};
+  const disabledTools = new Set(currentTools.disabledTools ?? []);
+  if (disabled) disabledTools.add(name);
+  else disabledTools.delete(name);
+  configStore.update({ tools: { ...currentTools, disabledTools: Array.from(disabledTools) } });
+}
+function toolNameFromPayload(payload) {
+  const name = payload?.name;
+  return typeof name === "string" && name.trim().length > 0 ? name.trim() : void 0;
+}
 async function handleSkillsList(ctx, ws) {
   if (!ctx.skillLoader) {
     ctx.send(ws, { type: "skills.list", payload: { skills: [], enabled: false } });
@@ -6440,17 +7447,42 @@ async function handleSkillsList(ctx, ws) {
   }
 }
 function handleToolsList(ctx, ws) {
-  const list = ctx.agent.tools.list().map((t) => {
-    const schema = t.inputSchema ?? {};
+  const registry = ctx.agent.tools;
+  const list = toolEntries(ctx).map(({ tool, owner }) => {
+    const schema = tool.inputSchema ?? {};
     const params = schema.properties ? Object.keys(schema.properties) : [];
     return {
-      name: t.name,
-      description: t.description ?? "",
-      params
+      name: tool.name,
+      owner,
+      description: tool.description ?? "",
+      params,
+      disabled: registry.isDisabled?.(tool.name) ?? false,
+      mutating: !!tool.mutating,
+      permission: tool.permission ?? "auto"
     };
   });
   ctx.send(ws, { type: "tools.list", payload: { tools: list } });
 }
+function handleToolDisable(ctx, ws, payload) {
+  const name = toolNameFromPayload(payload);
+  if (!name) {
+    ctx.send(ws, { type: "error", payload: { message: "tool.disable requires a name" } });
+    return;
+  }
+  const ok2 = ctx.agent.tools.disable(name);
+  if (ok2) persistDisabledTool(ctx, name, true);
+  ctx.send(ws, { type: "tool.disabled", payload: { name, ok: ok2 } });
+}
+function handleToolEnable(ctx, ws, payload) {
+  const name = toolNameFromPayload(payload);
+  if (!name) {
+    ctx.send(ws, { type: "error", payload: { message: "tool.enable requires a name" } });
+    return;
+  }
+  const ok2 = ctx.agent.tools.enable(name);
+  if (ok2) persistDisabledTool(ctx, name, false);
+  ctx.send(ws, { type: "tool.enabled", payload: { name, ok: ok2 } });
+}
 function handleDiagGet(ctx, ws) {
   const actx = ctx.agent.ctx;
   const tools = ctx.agent.tools.list();
@@ -7982,8 +9014,9 @@ async function handleKanbanMessage(ctx, ws, msg) {
           fail(ctx, ws, type, "boardId required");
           return;
         }
-        const removed = await removeBoard(projectRoot, id);
-        ok(ctx, ws, "kanban.delete", { removed });
+        const board = await getBoard(projectRoot, id);
+        const removed = board ? await removeBoard(projectRoot, board.id) : false;
+        ok(ctx, ws, "kanban.delete", { removed, boardId: board?.id ?? id });
         return;
       }
       // ── Board generate ──
@@ -8007,6 +9040,88 @@ async function handleKanbanMessage(ctx, ws, msg) {
         ok(ctx, ws, "kanban.generate", fresh ?? board);
         return;
       }
+      // ── Ready tasks ──
+      case "kanban.task.ready": {
+        const tasks = await listReadyTasks(projectRoot, {
+          ...payload?.boardId ? { boardId: payload.boardId } : {},
+          ...payload?.query ? { query: payload.query } : {},
+          ...payload?.assignedAgent ? { assignedAgent: payload.assignedAgent } : {},
+          ...payload?.priority ? { priority: payload.priority } : {},
+          ...payload?.label ? { label: payload.label } : {},
+          ...payload?.chainId ? { chainId: payload.chainId } : {},
+          ...typeof payload?.limit === "number" ? { limit: payload.limit } : {}
+        });
+        ok(ctx, ws, type, tasks);
+        return;
+      }
+      case "kanban.snapshot": {
+        const snapshot = await getKanbanOrchestrationSnapshot(projectRoot, {
+          ...payload?.boardId ? { boardId: payload.boardId } : {},
+          ...payload?.query ? { query: payload.query } : {},
+          ...payload?.assignedAgent ? { assignedAgent: payload.assignedAgent } : {},
+          ...payload?.priority ? { priority: payload.priority } : {},
+          ...payload?.status ? { status: payload.status } : {},
+          ...payload?.label ? { label: payload.label } : {},
+          ...payload?.chainId ? { chainId: payload.chainId } : {}
+        });
+        ok(ctx, ws, type, snapshot);
+        return;
+      }
+      case "kanban.taskgraph.export": {
+        const boardId = payload?.boardId;
+        if (!boardId) {
+          fail(ctx, ws, type, "boardId required");
+          return;
+        }
+        const exported = await exportBoardToTaskGraph(projectRoot, boardId, {
+          ...payload?.graphId ? { graphId: payload.graphId } : {},
+          ...payload?.specId ? { specId: payload.specId } : {},
+          ...payload?.title ? { title: payload.title } : {},
+          ...typeof payload?.preserveOriginTaskIds === "boolean" ? { preserveOriginTaskIds: payload.preserveOriginTaskIds } : {},
+          ...typeof payload?.includeArchived === "boolean" ? { includeArchived: payload.includeArchived } : {}
+        });
+        if (!exported) {
+          fail(ctx, ws, type, `Board not found: ${boardId}`);
+          return;
+        }
+        ok(ctx, ws, type, {
+          board: exported.board,
+          taskGraph: serializeTaskGraph(exported.graph)
+        });
+        return;
+      }
+      case "kanban.taskgraph.sync": {
+        const boardId = payload?.boardId;
+        const taskGraph = payload?.taskGraph;
+        if (!boardId || !taskGraph) {
+          fail(ctx, ws, type, "boardId and taskGraph required");
+          return;
+        }
+        const result = await syncBoardFromTaskGraph(
+          projectRoot,
+          boardId,
+          deserializeTaskGraph(taskGraph),
+          {
+            ...payload?.title ? { title: payload.title } : {},
+            ...payload?.description ? { description: payload.description } : {},
+            ...payload?.tags ? { tags: payload.tags } : {},
+            ...payload?.generatedBy ? { generatedBy: payload.generatedBy } : {},
+            ...payload?.sourceSystem ? { sourceSystem: payload.sourceSystem } : {},
+            ...payload?.phaseId ? { phaseId: payload.phaseId } : {},
+            ...typeof payload?.includeCompletedTasks === "boolean" ? { includeCompletedTasks: payload.includeCompletedTasks } : {},
+            ...typeof payload?.archiveMissingTasks === "boolean" ? { archiveMissingTasks: payload.archiveMissingTasks } : {},
+            ...typeof payload?.preserveManualDependencies === "boolean" ? { preserveManualDependencies: payload.preserveManualDependencies } : {}
+          }
+        );
+        result ? ok(ctx, ws, type, {
+          board: result.board,
+          taskIdMap: Object.fromEntries(result.taskIdMap),
+          createdTaskIds: result.createdTaskIds,
+          updatedTaskIds: result.updatedTaskIds,
+          archivedTaskIds: result.archivedTaskIds
+        }) : fail(ctx, ws, type, `Board not found: ${boardId}`);
+        return;
+      }
       // ── Task add ──
       case "kanban.task.add": {
         const boardId = payload?.boardId;
@@ -8031,6 +9146,65 @@ async function handleKanbanMessage(ctx, ws, msg) {
         ok(ctx, ws, "kanban.task.add", result.task);
         return;
       }
+      // ── Task split ──
+      case "kanban.task.split": {
+        const boardId = payload?.boardId;
+        const taskId = payload?.taskId;
+        const childTitles = payload?.childTitles;
+        if (!boardId || !taskId || !childTitles?.length) {
+          fail(ctx, ws, type, "boardId, taskId, and childTitles required");
+          return;
+        }
+        const result = await splitTask(projectRoot, boardId, taskId, {
+          titles: childTitles,
+          ...payload?.targetColumnId ? { columnId: payload.targetColumnId } : {},
+          ...typeof payload?.inheritAssignment === "boolean" ? { inheritAssignment: payload.inheritAssignment } : {},
+          ...typeof payload?.inheritLabels === "boolean" ? { inheritLabels: payload.inheritLabels } : {},
+          ...typeof payload?.inheritSuccessCriteria === "boolean" ? { inheritSuccessCriteria: payload.inheritSuccessCriteria } : {},
+          ...typeof payload?.inheritGoalMetrics === "boolean" ? { inheritGoalMetrics: payload.inheritGoalMetrics } : {},
+          ...typeof payload?.inheritDependencies === "boolean" ? { inheritDependencies: payload.inheritDependencies } : {},
+          ...typeof payload?.chainChildren === "boolean" ? { chainChildren: payload.chainChildren } : {},
+          ...typeof payload?.rewireDependents === "boolean" ? { rewireDependents: payload.rewireDependents } : {}
+        });
+        if (!result) {
+          fail(ctx, ws, type, "Board or task not found");
+          return;
+        }
+        ok(ctx, ws, type, {
+          board: result.board,
+          parent: result.parent,
+          children: result.children
+        });
+        return;
+      }
+      // ── Task merge ──
+      case "kanban.task.merge": {
+        const boardId = payload?.boardId;
+        const taskIds = payload?.taskIds;
+        const title = payload?.title;
+        if (!boardId || !taskIds?.length || !title) {
+          fail(ctx, ws, type, "boardId, taskIds, and title required");
+          return;
+        }
+        const result = await mergeTasks(projectRoot, boardId, {
+          taskIds,
+          title,
+          ...payload?.description ? { description: payload.description } : {},
+          ...payload?.targetColumnId ? { targetColumnId: payload.targetColumnId } : {},
+          ...typeof payload?.preserveAssignment === "boolean" ? { preserveAssignment: payload.preserveAssignment } : {},
+          ...typeof payload?.closeSourceTasks === "boolean" ? { closeSourceTasks: payload.closeSourceTasks } : {}
+        });
+        if (!result) {
+          fail(ctx, ws, type, "Board or task not found");
+          return;
+        }
+        ok(ctx, ws, type, {
+          board: result.board,
+          task: result.task,
+          sourceTasks: result.sourceTasks
+        });
+        return;
+      }
       // ── Task update ──
       case "kanban.task.update": {
         const boardId = payload?.boardId;
@@ -8105,6 +9279,123 @@ async function handleKanbanMessage(ctx, ws, msg) {
         ok(ctx, ws, type, result.targetBoard);
         return;
       }
+      // ── Task chain ──
+      case "kanban.task.chain": {
+        const boardId = payload?.boardId;
+        const taskIds = payload?.taskIds;
+        if (!boardId || !taskIds?.length) {
+          fail(ctx, ws, type, "boardId and taskIds required");
+          return;
+        }
+        const result = await setTaskChain(projectRoot, boardId, {
+          taskIds,
+          ...payload?.chainId ? { chainId: payload.chainId } : {},
+          ...typeof payload?.enforceDependencies === "boolean" ? { enforceDependencies: payload.enforceDependencies } : {}
+        });
+        if (!result) {
+          fail(ctx, ws, type, "Board or task not found");
+          return;
+        }
+        ok(ctx, ws, type, {
+          board: result.board,
+          chainId: result.chainId,
+          tasks: result.tasks
+        });
+        return;
+      }
+      case "kanban.task.chain.get": {
+        const boardId = payload?.boardId;
+        const taskOrChainId = payload?.taskId ?? payload?.chainId;
+        if (!boardId || !taskOrChainId) {
+          fail(ctx, ws, type, "boardId and taskId or chainId required");
+          return;
+        }
+        const result = await getTaskChain(projectRoot, boardId, taskOrChainId);
+        if (!result) {
+          fail(ctx, ws, type, "Chain not found");
+          return;
+        }
+        ok(ctx, ws, type, {
+          board: result.board,
+          chainId: result.chainId,
+          tasks: result.tasks
+        });
+        return;
+      }
+      // ── Task claim/release ──
+      case "kanban.task.claim": {
+        const result = await claimReadyTask(projectRoot, {
+          ...payload?.boardId ? { boardId: payload.boardId } : {},
+          ...payload?.taskId ? { taskId: payload.taskId } : {},
+          ...payload?.agentId ? { agentId: payload.agentId } : {},
+          ...payload?.name ? { name: payload.name } : {},
+          ...payload?.role ? { role: payload.role } : {},
+          ...payload?.provider ? { provider: payload.provider } : {},
+          ...payload?.model ? { model: payload.model } : {},
+          ...payload?.fallbackProfile ? { fallbackProfile: payload.fallbackProfile } : {},
+          ...payload?.fallbackModels ? { fallbackModels: payload.fallbackModels } : {},
+          ...payload?.tools ? { tools: payload.tools } : {},
+          ...payload?.allowedCapabilities ? { allowedCapabilities: payload.allowedCapabilities } : {},
+          ...payload?.assignee ? { assignee: payload.assignee } : {},
+          status: payload?.assignmentStatus ?? "queued"
+        });
+        result ? ok(ctx, ws, type, { board: result.board, task: result.task }) : fail(ctx, ws, type, "No ready kanban task matched the claim");
+        return;
+      }
+      case "kanban.task.release": {
+        const boardId = payload?.boardId;
+        const taskId = payload?.taskId;
+        if (!boardId || !taskId) {
+          fail(ctx, ws, type, "boardId and taskId required");
+          return;
+        }
+        const board = await releaseTaskClaim(projectRoot, boardId, taskId, {
+          ...payload?.status ? { status: payload.status } : {},
+          ...payload?.reason ? { reason: payload.reason } : {},
+          ...typeof payload?.clearAssignee === "boolean" ? { clearAssignee: payload.clearAssignee } : {}
+        });
+        board ? ok(ctx, ws, type, board) : fail(ctx, ws, type, "Board or task not found");
+        return;
+      }
+      // ── Goal metrics ──
+      case "kanban.task.metric.add": {
+        const boardId = payload?.boardId;
+        const taskId = payload?.taskId;
+        const name = payload?.name;
+        if (!boardId || !taskId || !name) {
+          fail(ctx, ws, type, "boardId, taskId, and name required");
+          return;
+        }
+        const board = await addGoalMetricToTask(projectRoot, boardId, taskId, {
+          name,
+          ...payload?.status ? { status: payload.status } : {},
+          ...payload?.target !== void 0 ? { target: payload.target } : {},
+          ...payload?.current !== void 0 ? { current: payload.current } : {},
+          ...payload?.unit ? { unit: payload.unit } : {},
+          ...payload?.notes ? { notes: payload.notes } : {}
+        });
+        board ? ok(ctx, ws, type, board) : fail(ctx, ws, type, "Board or task not found");
+        return;
+      }
+      case "kanban.task.metric.update": {
+        const boardId = payload?.boardId;
+        const taskId = payload?.taskId;
+        const metricId = payload?.metricId;
+        if (!boardId || !taskId || !metricId) {
+          fail(ctx, ws, type, "boardId, taskId, and metricId required");
+          return;
+        }
+        const board = await updateGoalMetricOnTask(projectRoot, boardId, taskId, metricId, {
+          ...payload?.name ? { name: payload.name } : {},
+          ...payload?.status ? { status: payload.status } : {},
+          ...payload?.target !== void 0 ? { target: payload.target } : {},
+          ...payload?.current !== void 0 ? { current: payload.current } : {},
+          ...payload?.unit ? { unit: payload.unit } : {},
+          ...payload?.notes ? { notes: payload.notes } : {}
+        });
+        board ? ok(ctx, ws, type, board) : fail(ctx, ws, type, "Metric not found");
+        return;
+      }
       // ── Task assign ──
       case "kanban.task.assign": {
         const bId = payload?.boardId;
@@ -8183,7 +9474,7 @@ async function handleKanbanMessage(ctx, ws, msg) {
               const completedTask = completed?.tasks.find((candidate) => candidate.id === task.id) ?? task;
               ctx.broadcast({
                 type: "kanban.task.update",
-                payload: { success: true, data: completedTask }
+                payload: { success: true, data: { boardId: board.id, task: completedTask } }
               });
               ctx.broadcast({
                 type: "kanban.list",
@@ -8199,6 +9490,7 @@ async function handleKanbanMessage(ctx, ws, msg) {
             lastResult: summary
           });
           ok(ctx, ws, "kanban.task.dispatch", {
+            boardId: board.id,
             task: updated?.tasks.find((candidate) => candidate.id === task.id) ?? task,
             summary
           });
@@ -8221,12 +9513,22 @@ async function handleKanbanMessage(ctx, ws, msg) {
           fail(ctx, ws, type, "boardId and taskId required");
           return;
         }
+        const task = await getTask(projectRoot, rmBoardId, rmTaskId);
+        if (!task) {
+          fail(ctx, ws, type, "Board or task not found");
+          return;
+        }
         const board = await removeTask(projectRoot, rmBoardId, rmTaskId);
         if (!board) {
           fail(ctx, ws, type, "Board or task not found");
           return;
         }
-        ok(ctx, ws, "kanban.task.remove", { removed: true });
+        ok(ctx, ws, "kanban.task.remove", {
+          removed: true,
+          boardId: board.id,
+          taskId: task.id,
+          board
+        });
         return;
       }
       // ── Task get ──
@@ -8281,7 +9583,12 @@ async function handleKanbanMessage(ctx, ws, msg) {
           fail(ctx, ws, type, `Column not found: ${rmColId}`);
           return;
         }
-        ok(ctx, ws, "kanban.column.remove", { removed: true });
+        ok(ctx, ws, "kanban.column.remove", {
+          removed: true,
+          boardId: updated.id,
+          columnId: rmColId,
+          board: updated
+        });
         return;
       }
       default:
@@ -8296,6 +9603,15 @@ async function handleKanbanMessage(ctx, ws, msg) {
 function buildKanbanAgentPrompt2(board, task, assignment) {
   const dependencies = (task.dependsOn ?? []).map((depId) => board.tasks.find((candidate) => candidate.id === depId)).filter((dep) => Boolean(dep)).map((dep) => `- ${dep.title} [${dep.status}] (${dep.id})`);
   const checks = task.successCriteria?.map((check) => `- ${check.description}`).join("\n");
+  const metrics = task.goalMetrics?.map(
+    (metric) => `- ${metric.name}: ${metric.current ?? "n/a"}${metric.target !== void 0 ? ` / ${metric.target}` : ""}${metric.unit ? ` ${metric.unit}` : ""} [${metric.status}]`
+  ).join("\n");
+  const chain = task.chain ? [
+    `chainId: ${task.chain.chainId}`,
+    `order: ${task.chain.order}`,
+    task.chain.previousTaskId ? `previous: ${task.chain.previousTaskId}` : "",
+    task.chain.nextTaskId ? `next: ${task.chain.nextTaskId}` : ""
+  ].filter(Boolean).join("\n") : "";
   const routing = [
     assignment?.role ? `role: ${assignment.role}` : "",
     assignment?.provider ? `provider: ${assignment.provider}` : "",
@@ -8314,10 +9630,14 @@ function buildKanbanAgentPrompt2(board, task, assignment) {
 ${task.description}` : "",
     routing.length ? `Routing hints:
 ${routing.join("\n")}` : "",
+    chain ? `Task chain:
+${chain}` : "",
     dependencies.length ? `Dependencies:
 ${dependencies.join("\n")}` : "",
     checks ? `Success criteria:
 ${checks}` : "",
+    metrics ? `Goal metrics:
+${metrics}` : "",
     task.labels?.length ? `Labels: ${task.labels.join(", ")}` : "",
     "",
     "Work the task end-to-end. Use the kanban tool, not direct file edits, to update this task.",
@@ -8629,6 +9949,8 @@ function createMessageRouter(deps) {
       });
     },
     "tools.list": (_msg, ws) => handleToolsList(introspectionCtx, ws),
+    "tool.disable": (msg, ws) => handleToolDisable(introspectionCtx, ws, msg.payload),
+    "tool.enable": (msg, ws) => handleToolEnable(introspectionCtx, ws, msg.payload),
     // ── Autonomy ──
     "autonomy.switch": (msg, ws) => handleAutonomySwitch(prefsCtx, ws, msg.payload.mode),
     // ── Brain ──
@@ -10251,7 +11573,16 @@ async function runWebUI(opts) {
           );
         }
       },
-      { warn: (m) => console.warn(`[WebUI] Config watcher: ${m}`) }
+      {
+        warn: (m) => console.warn(
+          JSON.stringify({
+            level: "warn",
+            event: "webui.config_watcher",
+            message: m,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          })
+        )
+      }
     );
     credentialWatcherClose = watcher.close;
   }
@@ -10273,6 +11604,7 @@ async function runWebUI(opts) {
     projectRoot: opts.projectRoot,
     sessionId: opts.session.id,
     sessionStartedAt,
+    configStore: opts.agent.container?.safeResolve?.(TOKENS.ConfigStore),
     send: send2,
     broadcast,
     log: (m) => console.log(m)
@@ -10846,11 +12178,12 @@ async function runClaudeOAuthLogin(deps, opts = {}) {
     const saved = await saveClaudeTokens(deps, providerId, tokens, models);
     if (!saved) return 1;
     deps.renderer.write(color.green("\n  \u2713 Signed in with Claude!\n"));
-    const modelHint = models.find((m) => m.includes("sonnet")) ?? models[0] ?? "claude-sonnet-4-6";
+    const modelHint = models[0];
     deps.renderer.writeInfo(
       `  Saved as provider ${color.bold(providerId)}${models.length ? ` (${models.length} models)` : ""}.
-  Use: ${color.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
-` + color.dim("  Tokens refresh automatically before they expire.\n")
+` + (modelHint ? `  Use: ${color.bold(`wstack --provider ${providerId} --model ${modelHint}`)} "<task>"
+` : `  No model list was discovered; choose a model before starting a run.
+`) + color.dim("  Tokens refresh automatically before they expire.\n")
     );
     return 0;
   } catch (err) {
@@ -10880,8 +12213,6 @@ async function saveClaudeTokens(deps, providerId, tokens, models) {
       p.family = "anthropic-oauth";
       if (!p.baseUrl) p.baseUrl = CLAUDE_BASE_URL;
       if (models.length > 0) p.models = models;
-      else if (!p.models || p.models.length === 0)
-        p.models = ["claude-sonnet-4-6", "claude-opus-4-8"];
       const keys = normalizeKeys(p).filter((k) => k.label !== entry.label);
       keys.push(entry);
       writeKeysBack(p, keys);
@@ -15863,6 +17194,10 @@ function buildBrainCommand(opts) {
       const trimmed = args.trim();
       const [sub, ...rest] = trimmed.split(/\s+/);
       const subcommand = (sub ?? "").toLowerCase();
+      if ((subcommand === "" || subcommand === "status") && opts.onPanelOpen?.current) {
+        const opened = opts.onPanelOpen.current("brainOpen");
+        if (opened) return { message: "" };
+      }
       if (subcommand === "risk") {
         if (!opts.brainSettings) {
           const msg3 = "Brain settings are not available in this session.";
@@ -16669,6 +18004,10 @@ ${description}`
         return { message: `Task ${taskId.slice(0, 8)} marked failed: ${reason}` };
       }
       if (verb === "status") {
+        if (opts.onPanelOpen?.current) {
+          const opened = opts.onPanelOpen.current("toggleCoordinatorMonitor");
+          if (opened) return { message: "" };
+        }
         const statusFn = getStatus();
         if (statusFn) {
           const stats = await statusFn();
@@ -19848,6 +21187,10 @@ function buildGoalCommand(opts) {
       "every iteration to decide what to do next."
     ].join("\n"),
     async run(args) {
+      if (!args.trim() && opts.onPanelOpen?.current) {
+        const opened = opts.onPanelOpen.current("toggleGoalPanel");
+        if (opened) return { message: "" };
+      }
       const trimmed = args.trim();
       const [verbRaw, ...rest] = trimmed.split(/\s+/);
       const verb = (verbRaw ?? "").toLowerCase();
@@ -20066,6 +21409,10 @@ function buildHelpCommand(opts) {
     ].join("\n"),
     async run(args) {
       const query = args.trim();
+      if (!query && opts.onPanelOpen?.current) {
+        opts.onPanelOpen.current("helpOpen");
+        return { message: "" };
+      }
       if (query) {
         const needle = query.startsWith("/") ? query.slice(1) : query;
         let match;
@@ -20286,15 +21633,16 @@ function formatBoardDetail(board) {
     } else {
       for (const task of colTasks) {
         const depMarker = task.dependsOn?.length ? DIM(` \u26D3\uFE0F${task.dependsOn.length}`) : "";
+        const chainMarker = task.chain ? DIM(` #${task.chain.order + 1}`) : "";
         const agentMarker = task.assignedAgent ? DIM(` \u{1F464}${task.assignedAgent}`) : "";
         if (task.status === "completed") {
-          lines.push(`   \u2705 ${task.title}${agentMarker}${depMarker}`);
+          lines.push(`   \u2705 ${task.title}${agentMarker}${depMarker}${chainMarker}`);
         } else if (task.status === "blocked") {
-          lines.push(`   \u{1F6AB} ${task.title}${agentMarker}${depMarker}`);
+          lines.push(`   \u{1F6AB} ${task.title}${agentMarker}${depMarker}${chainMarker}`);
         } else if (task.status === "in_progress") {
-          lines.push(`   \u{1F504} ${task.title}${agentMarker}${depMarker}`);
+          lines.push(`   \u{1F504} ${task.title}${agentMarker}${depMarker}${chainMarker}`);
         } else {
-          lines.push(`   \u25CB ${task.title}${agentMarker}${depMarker}`);
+          lines.push(`   \u25CB ${task.title}${agentMarker}${depMarker}${chainMarker}`);
         }
         lines.push(
           `      ${DIM(task.id.slice(0, 8))} ${fmtPriority(task.priority)} ${fmtStatus(task.status)}`
@@ -20316,6 +21664,19 @@ function formatTaskDetail(board, task) {
   lines.push(`  ${LABEL("Column")}:   ${col?.title ?? task.columnId}`);
   if (task.assignedAgent) lines.push(`  ${LABEL("Agent")}:    ${task.assignedAgent}`);
   if (task.assignee) lines.push(`  ${LABEL("Assignee")}: ${task.assignee}`);
+  if (task.chain) {
+    lines.push(`  ${LABEL("Chain")}:   ${task.chain.chainId} #${task.chain.order + 1}`);
+    if (task.chain.previousTaskId)
+      lines.push(`  ${LABEL("Prev")}:    ${task.chain.previousTaskId}`);
+    if (task.chain.nextTaskId) lines.push(`  ${LABEL("Next")}:    ${task.chain.nextTaskId}`);
+  }
+  if (task.parentTaskId) lines.push(`  ${LABEL("Parent")}:  ${task.parentTaskId}`);
+  if (task.childTaskIds?.length)
+    lines.push(`  ${LABEL("Children")}: ${task.childTaskIds.join(", ")}`);
+  if (task.mergedIntoTaskId) lines.push(`  ${LABEL("Merged into")}: ${task.mergedIntoTaskId}`);
+  if (task.mergedFromTaskIds?.length) {
+    lines.push(`  ${LABEL("Merged from")}: ${task.mergedFromTaskIds.join(", ")}`);
+  }
   if (task.dependsOn?.length) {
     const depNames = task.dependsOn.map((depId) => {
       const dep = board.tasks.find((t) => t.id === depId);
@@ -20342,6 +21703,15 @@ function formatTaskDetail(board, task) {
         );
     }
   }
+  if (task.goalMetrics?.length) {
+    lines.push("");
+    lines.push(HEADING("  Goal Metrics:"));
+    for (const metric of task.goalMetrics) {
+      const target = metric.target !== void 0 ? ` / ${metric.target}${metric.unit ? ` ${metric.unit}` : ""}` : "";
+      lines.push(`   ${metric.name}: ${metric.current ?? "\u2014"}${target} ${DIM(metric.status)}`);
+      if (metric.notes) lines.push(`      ${DIM(metric.notes)}`);
+    }
+  }
   if (task.estimatedHours || task.actualHours) {
     lines.push("");
     lines.push(
@@ -20380,6 +21750,53 @@ function formatDependencyChain(board, taskId, depth = 0) {
   }
   return lines.join("\n");
 }
+function formatReadyTasks(results) {
+  if (!results.length) return DIM("No ready kanban tasks.");
+  const lines = [HEADING(`Ready Tasks (${results.length})`), ""];
+  for (const result of results) {
+    const task = result.task;
+    const routing = task.assignment?.provider || task.assignment?.model ? ` ${DIM(`[${[task.assignment?.provider, task.assignment?.model].filter(Boolean).join("/")}]`)}` : "";
+    const chain = task.chain ? ` ${DIM(`#${task.chain.order + 1}`)}` : "";
+    lines.push(
+      `  ${LABEL(result.board.id.slice(0, 8))}:${DIM(task.id.slice(0, 8))} ${task.title}${routing}${chain}`
+    );
+  }
+  return lines.join("\n");
+}
+function formatKanbanSnapshot(snapshot) {
+  const lines = [
+    HEADING("Kanban Snapshot"),
+    "",
+    `  ${LABEL("Boards")}:    ${snapshot.boards.length}`,
+    `  ${LABEL("Ready")}:     ${snapshot.ready.length}`,
+    `  ${LABEL("Queued")}:    ${snapshot.queued.length}`,
+    `  ${LABEL("Running")}:   ${snapshot.running.length}`,
+    `  ${LABEL("Blocked")}:   ${snapshot.blocked.length}`,
+    `  ${LABEL("Review")}:    ${snapshot.review.length}`,
+    `  ${LABEL("Failed")}:    ${snapshot.failed.length}`,
+    `  ${LABEL("Completed")}: ${snapshot.completed.length}`
+  ];
+  if (snapshot.ready.length) {
+    lines.push("", HEADING("Next Ready:"));
+    for (const result of snapshot.ready.slice(0, 8)) {
+      lines.push(
+        `  ${result.board.id.slice(0, 8)}:${result.task.id.slice(0, 8)} ${result.task.title}`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+function formatTaskChain(tasks) {
+  if (!tasks.length) return DIM("No tasks in chain.");
+  return [
+    HEADING(`Task Chain (${tasks[0]?.chain?.chainId ?? "unknown"})`),
+    "",
+    ...tasks.map((task, index) => {
+      const dep = task.dependsOn?.includes(tasks[index - 1]?.id ?? "") ? DIM(" dep") : "";
+      return `  ${index + 1}. ${task.title} ${DIM(task.id.slice(0, 8))} ${fmtStatus(task.status)}${dep}`;
+    })
+  ].join("\n");
+}
 function buildKanbanCommand(opts) {
   const { projectRoot } = opts;
   return {
@@ -20396,14 +21813,21 @@ function buildKanbanCommand(opts) {
       "  /kanban show <boardId>         Show board details (columns + tasks)",
       "  /kanban delete <boardId>       Delete a board",
       "  /kanban rename <boardId> <t>   Rename a board",
+      "  /kanban snapshot [boardId]     Show agent queue snapshot",
       "",
       "  /kanban task add <boardId> <title>          Add a task to board",
       "  /kanban task <boardId>                     List tasks on a board",
+      "  /kanban task ready [boardId]               List dependency-ready tasks",
+      "  /kanban task claim [boardId] <agent>       Atomically claim next ready task",
+      "  /kanban task release <boardId> <taskId>    Release a queued/running claim",
       "  /kanban task show <boardId> <taskId>       Show task details",
       "  /kanban task move <boardId> <taskId> <col>  Move task to column",
       "  /kanban task done <boardId> <taskId>        Mark task completed",
       "  /kanban task block <boardId> <taskId>       Mark task blocked",
       "  /kanban task remove <boardId> <taskId>      Delete a task",
+      "  /kanban task split <boardId> <taskId> <a> | <b>  Split task into children",
+      "  /kanban task merge <boardId> <taskA,taskB> <title> Merge tasks",
+      "  /kanban task chain <boardId> <taskA> <taskB> [...] Ordered task chain",
       "  /kanban task copy <fromBoard> <taskId> <toBoard> [columnId]",
       "  /kanban task transfer <fromBoard> <taskId> <toBoard> [columnId]",
       "",
@@ -20411,6 +21835,8 @@ function buildKanbanCommand(opts) {
       "  /kanban task assign <boardId> <taskId> <agent> [--provider=p --model=m --fallback=f]",
       "  /kanban task dispatch <boardId> <taskId> [--provider=p --model=m --name=n]",
       "  /kanban task depend <boardId> <taskId> <depId>  Add dependency",
+      "  /kanban task metric add <boardId> <taskId> <name> [target] [unit]",
+      "  /kanban task metric set <boardId> <taskId> <metricId> <current> [met|missed|waived|pending]",
       "  /kanban task note <boardId> <taskId> <text>      Add task note",
       "",
       "  /kanban task check add <boardId> <taskId> <desc>  Add success check",
@@ -20420,6 +21846,9 @@ function buildKanbanCommand(opts) {
       "",
       "  /kanban generate <description>     Auto-generate board from text",
       "  /kanban export <boardId>           Export board as markdown",
+      "  /kanban graph export <boardId> [graphId]  Save board as SDD TaskGraph",
+      "  /kanban graph import <graphId>           Create board from SDD TaskGraph",
+      "  /kanban graph sync <boardId> <graphId>   Sync board from SDD TaskGraph",
       "  /kanban deps <boardId> <taskId>    Show dependency chain"
     ].join("\n"),
     async run(args) {
@@ -20495,12 +21924,21 @@ function buildKanbanCommand(opts) {
   ${board.tasks.length + tasks.length} tasks created`
         };
       }
+      if (cmd === "snapshot" || cmd === "queue") {
+        const snapshot = await getKanbanOrchestrationSnapshot(projectRoot, {
+          ...rest[0] ? { boardId: rest[0] } : {}
+        });
+        return { message: formatKanbanSnapshot(snapshot) };
+      }
       if (cmd === "export") {
         if (!rest[0]) return { message: color.red("Usage: /kanban export <boardId>") };
         const board = await getBoard(projectRoot, rest[0]);
         if (!board) return { message: color.red(`Board not found: ${rest[0]}`) };
         return { message: exportBoardAsMarkdown(board) };
       }
+      if (cmd === "graph" || cmd === "taskgraph") {
+        return handleGraphSubcommand(opts, projectRoot, rest, showHelp);
+      }
       if (cmd === "deps" || cmd === "dependencies") {
         if (rest.length < 2)
           return { message: color.red("Usage: /kanban deps <boardId> <taskId>") };
@@ -20525,7 +21963,9 @@ function buildKanbanCommand(opts) {
             "delete",
             "rename",
             "generate",
+            "snapshot",
             "export",
+            "graph",
             "deps",
             "task",
             "column"
@@ -20536,11 +21976,93 @@ function buildKanbanCommand(opts) {
     }
   };
 }
+async function handleGraphSubcommand(opts, projectRoot, args, showHelp) {
+  const [sub, first, second] = args;
+  if (!sub) return showHelp();
+  if (!opts.paths?.projectTaskGraphs) {
+    return { message: color.red("TaskGraph store path is not available in this session.") };
+  }
+  const store = new TaskGraphStore({ baseDir: opts.paths.projectTaskGraphs });
+  if (sub === "export") {
+    const boardId = first;
+    const graphId = second;
+    if (!boardId) {
+      return { message: color.red("Usage: /kanban graph export <boardId> [graphId]") };
+    }
+    const exported = await exportBoardToTaskGraph(projectRoot, boardId, {
+      ...graphId ? { graphId } : {}
+    });
+    if (!exported) return { message: color.red(`Board not found: ${boardId}`) };
+    await store.save(exported.graph);
+    return {
+      message: `${color.green("\u2705 TaskGraph exported:")} ${exported.graph.id}
+  ${exported.graph.nodes.size} node(s) saved from ${exported.board.title}`
+    };
+  }
+  if (sub === "import") {
+    const graphId = first;
+    if (!graphId) return { message: color.red("Usage: /kanban graph import <graphId>") };
+    const graph = await store.load(graphId);
+    if (!graph) return { message: color.red(`TaskGraph not found: ${graphId}`) };
+    const imported = await createBoardFromTaskGraph(projectRoot, graph, {
+      sourceSystem: "sdd",
+      includeCompletedTasks: true
+    });
+    return {
+      message: `${color.green("\u2705 Kanban board imported:")} ${imported.board.title}
+  ${color.dim(imported.board.id)} \xB7 ${imported.board.tasks.length} task(s)`
+    };
+  }
+  if (sub === "sync") {
+    const boardId = first;
+    const graphId = second;
+    if (!boardId || !graphId) {
+      return { message: color.red("Usage: /kanban graph sync <boardId> <graphId>") };
+    }
+    const graph = await store.load(graphId);
+    if (!graph) return { message: color.red(`TaskGraph not found: ${graphId}`) };
+    const result = await syncBoardFromTaskGraph(projectRoot, boardId, graph, {
+      sourceSystem: "sdd",
+      includeCompletedTasks: true
+    });
+    if (!result) return { message: color.red(`Board not found: ${boardId}`) };
+    return {
+      message: `${color.green("\u2705 Kanban board synced:")} ${result.board.title}
+  ${result.createdTaskIds.length} created \xB7 ${result.updatedTaskIds.length} updated \xB7 ${result.archivedTaskIds.length} archived`
+    };
+  }
+  return { message: color.red("Usage: /kanban graph export|import|sync ...") };
+}
 async function handleTaskSubcommand(opts, projectRoot, args, showHelp) {
   const [sub, boardId, ...rest] = args;
-  if (!sub || !boardId) {
+  if (!sub) {
     return showHelp();
   }
+  if (sub === "ready") {
+    const results = await listReadyTasks(projectRoot, {
+      ...boardId ? { boardId } : {},
+      limit: 50
+    });
+    return { message: formatReadyTasks(results) };
+  }
+  if (sub === "claim") {
+    const scopedBoardId = rest.length > 0 ? boardId : void 0;
+    const agentId = rest.length > 0 ? rest[0] : boardId;
+    if (!agentId) {
+      return { message: color.red("Usage: /kanban task claim [boardId] <agentId>") };
+    }
+    const result = await claimReadyTask(projectRoot, {
+      ...scopedBoardId ? { boardId: scopedBoardId } : {},
+      agentId,
+      status: "queued"
+    });
+    if (!result) return { message: color.yellow("No ready kanban task matched the claim.") };
+    return {
+      message: `${color.green("\u2705 Task claimed:")} ${result.task.title}
+  ${color.dim(`${result.board.id}:${result.task.id}`)}`
+    };
+  }
+  if (!boardId) return showHelp();
   if (sub === "list" || sub === "ls" || sub === "") {
     const board2 = await getBoard(projectRoot, boardId);
     if (!board2) return { message: color.red(`Board not found: ${boardId}`) };
@@ -20606,6 +22128,83 @@ async function handleTaskSubcommand(opts, projectRoot, args, showHelp) {
     if (!updated) return { message: color.red("Task not found") };
     return { message: color.green("\u2705 Task removed.") };
   }
+  if (sub === "release") {
+    const taskId = rest[0];
+    if (!taskId) return { message: color.red("Usage: /kanban task release <boardId> <taskId>") };
+    const updated = await releaseTaskClaim(projectRoot, boardId, taskId, {
+      reason: rest.slice(1).join(" ") || "released from slash command"
+    });
+    if (!updated) return { message: color.red("Task not found") };
+    return { message: color.green("\u2705 Task claim released.") };
+  }
+  if (sub === "split") {
+    const taskId = rest[0];
+    const titleText = rest.slice(1).join(" ");
+    const titles = titleText.split("|").map((title) => title.trim()).filter(Boolean);
+    if (!taskId || titles.length === 0) {
+      return {
+        message: color.red(
+          "Usage: /kanban task split <boardId> <taskId> <child title> | <child title>"
+        )
+      };
+    }
+    const result = await splitTask(projectRoot, boardId, taskId, {
+      titles,
+      chainChildren: true,
+      rewireDependents: true
+    });
+    if (!result) return { message: color.red("Board or task not found") };
+    return {
+      message: `${color.green("\u2705 Task split into children:")}
+${result.children.map((task, index) => `  ${index + 1}. ${task.title} ${color.dim(task.id.slice(0, 8))}`).join("\n")}`
+    };
+  }
+  if (sub === "merge") {
+    const taskIds = splitCsv(rest[0] ?? "");
+    const title = rest.slice(1).join(" ");
+    if (taskIds.length < 2 || !title) {
+      return {
+        message: color.red("Usage: /kanban task merge <boardId> <taskA,taskB> <merged title>")
+      };
+    }
+    const result = await mergeTasks(projectRoot, boardId, {
+      taskIds,
+      title,
+      closeSourceTasks: true
+    });
+    if (!result) return { message: color.red("Board or task not found") };
+    return {
+      message: `${color.green("\u2705 Tasks merged:")} ${result.task.title}
+  ${color.dim(result.task.id)}`
+    };
+  }
+  if (sub === "chain") {
+    const chainSub = rest[0];
+    if (chainSub === "show") {
+      const taskOrChainId = rest[1];
+      if (!taskOrChainId) {
+        return { message: color.red("Usage: /kanban task chain <boardId> show <taskId|chainId>") };
+      }
+      const result2 = await getTaskChain(projectRoot, boardId, taskOrChainId);
+      if (!result2) return { message: color.red("Chain not found") };
+      return { message: formatTaskChain(result2.tasks) };
+    }
+    const taskIds = rest;
+    if (taskIds.length < 2) {
+      return {
+        message: color.red("Usage: /kanban task chain <boardId> <taskA> <taskB> [...]")
+      };
+    }
+    const result = await setTaskChain(projectRoot, boardId, {
+      taskIds,
+      enforceDependencies: true
+    });
+    if (!result) return { message: color.red("Board or task not found") };
+    return {
+      message: `${color.green("\u2705 Chain set:")} ${result.chainId}
+${formatTaskChain(result.tasks)}`
+    };
+  }
   if (sub === "copy" || sub === "transfer" || sub === "move-board") {
     const taskId = rest[0];
     const targetBoardId = rest[1];
@@ -20750,6 +22349,54 @@ ${summary}` };
     if (!updated) return { message: color.red("Failed to add dependency") };
     return { message: color.green(`\u2705 Dependency added: ${task.title} \u2192 ${depId}`) };
   }
+  if (sub === "metric") {
+    const metricSub = rest[0];
+    const taskId = rest[1];
+    if (metricSub === "add") {
+      const name = rest[2];
+      const target = rest[3];
+      const unit = rest[4];
+      if (!taskId || !name) {
+        return {
+          message: color.red(
+            "Usage: /kanban task metric add <boardId> <taskId> <name> [target] [unit]"
+          )
+        };
+      }
+      const updated = await addGoalMetricToTask(projectRoot, boardId, taskId, {
+        name,
+        ...target !== void 0 ? { target } : {},
+        ...unit !== void 0 ? { unit } : {}
+      });
+      if (!updated) return { message: color.red("Task not found") };
+      return { message: color.green(`\u2705 Metric added: ${name}`) };
+    }
+    if (metricSub === "set" || metricSub === "update") {
+      const metricId = rest[2];
+      const current = rest[3];
+      const status = rest[4];
+      const validStatuses = ["pending", "met", "missed", "waived"];
+      if (!taskId || !metricId || current === void 0) {
+        return {
+          message: color.red(
+            "Usage: /kanban task metric set <boardId> <taskId> <metricId> <current> [met|missed|waived|pending]"
+          )
+        };
+      }
+      if (status && !validStatuses.includes(status)) {
+        return { message: color.red(`Invalid metric status. Valid: ${validStatuses.join(", ")}`) };
+      }
+      const updated = await updateGoalMetricOnTask(projectRoot, boardId, taskId, metricId, {
+        current,
+        ...status ? { status } : {}
+      });
+      if (!updated) return { message: color.red("Metric not found") };
+      return { message: color.green("\u2705 Metric updated.") };
+    }
+    return {
+      message: color.red("Usage: /kanban task metric add|set <boardId> <taskId> ...")
+    };
+  }
   if (sub === "note") {
     const taskId = rest[0];
     const content = rest.slice(1).join(" ");
@@ -20852,6 +22499,15 @@ function parseKanbanAgentFlags(args) {
 function buildKanbanAgentPrompt(board, task, assignment) {
   const dependencyLines = (task.dependsOn ?? []).map((depId) => board.tasks.find((candidate) => candidate.id === depId)).filter((dep) => Boolean(dep)).map((dep) => `- ${dep.title} [${dep.status}] (${dep.id})`);
   const checks = task.successCriteria?.map((check) => `- ${check.description}`).join("\n");
+  const metrics = task.goalMetrics?.map(
+    (metric) => `- ${metric.name}: ${metric.current ?? "n/a"}${metric.target !== void 0 ? ` / ${metric.target}` : ""}${metric.unit ? ` ${metric.unit}` : ""} [${metric.status}]`
+  ).join("\n");
+  const chain = task.chain ? [
+    `chainId: ${task.chain.chainId}`,
+    `order: ${task.chain.order}`,
+    task.chain.previousTaskId ? `previous: ${task.chain.previousTaskId}` : "",
+    task.chain.nextTaskId ? `next: ${task.chain.nextTaskId}` : ""
+  ].filter(Boolean).join("\n") : "";
   const routing = [
     assignment?.role ? `role: ${assignment.role}` : "",
     assignment?.provider ? `provider: ${assignment.provider}` : "",
@@ -20870,10 +22526,14 @@ function buildKanbanAgentPrompt(board, task, assignment) {
 ${task.description}` : "",
     routing.length ? `Routing hints:
 ${routing.join("\n")}` : "",
+    chain ? `Task chain:
+${chain}` : "",
     dependencyLines.length ? `Dependencies:
 ${dependencyLines.join("\n")}` : "",
     checks ? `Success criteria:
 ${checks}` : "",
+    metrics ? `Goal metrics:
+${metrics}` : "",
     task.labels?.length ? `Labels: ${task.labels.join(", ")}` : "",
     "",
     "Work the task end-to-end. Use the kanban tool, not direct file edits, to update this task.",
@@ -21750,7 +23410,7 @@ function buildMcpSlashCommand(opts) {
     argsHint: "[list|add <name>|remove <name>|enable <name>|disable <name>|restart <name>]",
     help: [
       "Usage:",
-      "  /mcp                      List available and configured servers.",
+      "  /mcp                      Open interactive server picker (TUI) or list servers.",
       "  /mcp list                 Same.",
       "  /mcp add <name>           Add server preset to config (disabled).",
       "  /mcp add <name> --enable  Add and immediately enable.",
@@ -21766,10 +23426,15 @@ function buildMcpSlashCommand(opts) {
       "  /mcp restart brave-search"
     ].join("\n"),
     async run(args) {
+      const trimmed = args.trim();
+      if ((trimmed === "" || trimmed === "list") && opts.onPanelOpen?.current) {
+        const opened = opts.onPanelOpen.current("mcpPickerOpen");
+        if (opened) return { message: "" };
+      }
       if (!opts.onMcp) {
         return { message: "MCP management is not available in this session." };
       }
-      const result = await opts.onMcp(args.trim());
+      const result = await opts.onMcp(trimmed);
       return { message: result };
     }
   };
@@ -22717,6 +24382,7 @@ function clearSuggestions() {
 function buildNextCommand(opts) {
   return {
     name: "next",
+    aliases: ["enxt"],
     category: "Agent",
     description: "Show or select next-step suggestions. /next 1 to execute, /next list to view.",
     argsHint: "[on|off|toggle|list|clear|1 2 3...]",
@@ -22800,7 +24466,7 @@ function handleSelection(input, opts) {
   if (suggestions.length === 0) {
     return {
       message: color.amber(
-        "No suggestions available. Run /suggest to generate, or finish any open todos first \u2014 <next_steps> is suppressed while todos are pending."
+        "No suggestions available. Run /suggest to generate, or finish any open todos first \u2014 <nextsteps> is suppressed while todos are pending."
       )
     };
   }
@@ -24203,6 +25869,10 @@ function buildAgentsCommand(opts) {
     category: "Agent",
     description: "Monitor subagent activity: /agents [stream on|off|status|list|show <id>]",
     async run(args) {
+      if ((!args.trim() || args.trim() === "list") && opts.onPanelOpen?.current) {
+        const opened = opts.onPanelOpen.current("toggleAgentsMonitor");
+        if (opened) return { message: "" };
+      }
       const monitor = opts.agentMonitor;
       const { cmd, rest } = parseSubcommand(args);
       const restJoined = rest.join(" ").trim();
@@ -25843,7 +27513,6 @@ function buildSettingsCommand(opts) {
     }
   };
 }
-var DEFAULT_SHADOW_PROVIDER = "anthropic";
 var DEFAULT_SHADOW_INTERVAL_MS = 3e4;
 var MIN_SHADOW_INTERVAL_MS = 5e3;
 function buildShadowCommand(opts) {
@@ -25876,12 +27545,12 @@ function buildShadowCommand(opts) {
       "  \u2022 Uses deterministic host rules first; LLM only for manual/problem cases",
       "  \u2022 Does not post routine healthy reports",
       "",
-      "Model must be specified as provider/model, e.g. anthropic/claude-3-5-sonnet",
+      "Model must be specified as provider/model, e.g. provider/configured-model",
       "When omitted, Shadow uses the current leader provider/model.",
       "",
       "Examples:",
       "  /shadow start",
-      "  /shadow start --model=anthropic/claude-3-5-sonnet",
+      "  /shadow start --model=provider/configured-model",
       "  /shadow status                       Show all agent activity",
       "  /shadow hoop subagent-abc123        Stop agent and notify",
       "  /shadow hoop subagent-abc --reason=looping  Stop with reason"
@@ -25889,6 +27558,13 @@ function buildShadowCommand(opts) {
     async run(args, _ctx) {
       const [action, ...rest] = args.trim().split(/\s+/);
       switch (action) {
+        case void 0:
+        case "":
+          if (opts.onPanelOpen?.current) {
+            const opened = opts.onPanelOpen.current("shadowOpen");
+            if (opened) return { message: "" };
+          }
+          return { message: this.help ?? "/shadow \u2014 use /shadow help for usage" };
         case "start": {
           if (!opts.onSpawn) {
             return { message: "/shadow requires a running director with subagent support." };
@@ -25903,6 +27579,16 @@ function buildShadowCommand(opts) {
           } catch (e) {
             return { message: `/shadow start: ${e.message}` };
           }
+          if (opts.shadowController?.activeId != null) {
+            return {
+              message: [
+                `${color.yellow("\u26A0")} A Shadow Agent is already running (${opts.shadowController.activeId.slice(0, 8)}).`,
+                "",
+                "Only one Shadow Agent instance is allowed per session.",
+                "Use /shadow status to view the current instance."
+              ].join("\n")
+            };
+          }
           const defaultModelRef = getDefaultModelRef(opts);
           let modelRef;
           const modelRaw = flags["model"];
@@ -25914,14 +27600,9 @@ function buildShadowCommand(opts) {
           } catch (e) {
             return { message: `/shadow start: ${e.message}` };
           }
-          if (opts.shadowController?.activeId != null) {
+          if (!modelRef.provider || !modelRef.model) {
             return {
-              message: [
-                `${color.yellow("\u26A0")} A Shadow Agent is already running (${opts.shadowController.activeId.slice(0, 8)}).`,
-                "",
-                "Only one Shadow Agent instance is allowed per session.",
-                "Use /shadow status to view the current instance."
-              ].join("\n")
+              message: "/shadow start: no leader provider/model is configured; pass --model=provider/model"
             };
           }
           const spawnId = await opts.onSpawn(
@@ -26058,7 +27739,7 @@ ${color.dim("Interval will be applied on next /shadow start")}` };
 function getDefaultModelRef(opts) {
   const shadowDefaults = opts.shadowController?.getDefaults?.();
   const liveConfig = opts.configStore?.get?.();
-  const provider = shadowDefaults?.provider?.trim() || liveConfig?.provider?.trim() || opts.llmProvider?.id?.trim() || DEFAULT_SHADOW_PROVIDER;
+  const provider = shadowDefaults?.provider?.trim() || liveConfig?.provider?.trim() || opts.llmProvider?.id?.trim() || "";
   const model = shadowDefaults?.model?.trim() || liveConfig?.model?.trim() || opts.llmModel?.trim() || "";
   return {
     provider,
@@ -26073,7 +27754,7 @@ function parseProviderModelRef(model, defaultRef) {
   const slash = model.indexOf("/");
   if (slash <= 0 || slash === model.length - 1) {
     throw new ToolValidationError({
-      message: `Model must be in provider/model format (e.g. anthropic/claude-3-5-sonnet), got: "${model}"`,
+      message: `Model must be in provider/model format (e.g. provider/configured-model), got: "${model}"`,
       field: "model",
       context: { received: model }
     });
@@ -26260,12 +27941,12 @@ var STATUSLINE_CONFIG_KEYS = [
 function resolveConfigPath() {
   return process.env[CONFIG_ENV] ?? path5.join(process.env.HOME ?? os9.homedir(), ".wrongstack", "statusline.json");
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function normalizeStatuslineConfig(value) {
   const cfg = { ...DEFAULTS };
-  if (!isRecord(value)) return cfg;
+  if (!isRecord2(value)) return cfg;
   for (const key of STATUSLINE_CONFIG_KEYS) {
     const raw = value[key];
     if (typeof raw === "boolean") cfg[key] = raw;
@@ -26273,11 +27954,11 @@ function normalizeStatuslineConfig(value) {
   return cfg;
 }
 function isMissingKnownStatuslineKeys(value) {
-  if (!isRecord(value)) return true;
+  if (!isRecord2(value)) return true;
   return STATUSLINE_CONFIG_KEYS.some((key) => typeof value[key] !== "boolean");
 }
 function hasFsCode(err, code) {
-  return isRecord(err) && err["code"] === code;
+  return isRecord2(err) && err["code"] === code;
 }
 async function loadStatuslineConfig() {
   const p = resolveConfigPath();
@@ -27863,6 +29544,10 @@ function buildToolsCommand(opts) {
         ({ tool, owner }) => tool.name.toLowerCase().includes(filter) || owner.toLowerCase().includes(filter)
       ) : allTools;
       const disabled = reg.listDisabled();
+      if (opts.onPanelOpen?.current) {
+        const opened = opts.onPanelOpen.current("toolsPickerOpen");
+        if (opened) return { message: "" };
+      }
       if (filter && all.length === 0) {
         const msg2 = `${color.bold("Tools")} \u2014 no tool name or owner matched "${filter}".`;
         opts.renderer.write(msg2);
@@ -29270,6 +30955,7 @@ function buildAcpServerAgentFactory(deps, options = {}) {
       events,
       confirmAwaiter: void 0,
       iterationTimeoutMs: config.tools?.iterationTimeoutMs ?? 12e4,
+      maxToolTimeoutMs: config.tools?.maxToolTimeoutMs ?? 3e5,
       perIterationOutputCapBytes: config.tools?.perIterationOutputCapBytes ?? 1e5,
       tracer: void 0
     });
@@ -30475,6 +32161,9 @@ function printUsage(deps) {
       color.dim(
         "  wstack bench run --suite polyglot --polyglot-dir ./polyglot --models bench.config.json --limit 5"
       ),
+      color.dim(
+        "  wstack bench run --suite local --suite-dir ./evals --models bench.config.json"
+      ),
       color.dim("  wstack bench report ./bench-results/2026-06-14T10-00-00"),
       ""
     ].join("\n") + "\n"
@@ -30542,11 +32231,26 @@ async function benchRun(_args, deps) {
       docker
     });
     grade = (a) => gradeSwebench({ ...a, predictionsDir });
+  } else if (suiteId === "local" || suiteId === "manifest") {
+    const suiteDirRaw = flagStr(deps, "suite-dir");
+    const manifestRaw = flagStr(deps, "manifest");
+    if (!suiteDirRaw && !manifestRaw) {
+      deps.renderer.writeError(
+        "--suite-dir <path> or --manifest <file> is required for the local suite."
+      );
+      return 1;
+    }
+    const manifestFile = manifestRaw ? path5.resolve(deps.cwd, manifestRaw) : void 0;
+    const suiteDir = suiteDirRaw ? path5.resolve(deps.cwd, suiteDirRaw) : path5.dirname(manifestFile);
+    suite = createLocalManifestSuite({ suiteDir, manifestFile });
+    grade = (a) => gradeLocalManifest(a);
   } else {
-    deps.renderer.writeError(`unknown suite "${suiteId}" (expected: polyglot | swebench)`);
+    deps.renderer.writeError(`unknown suite "${suiteId}" (expected: polyglot | swebench | local)`);
     return 1;
   }
-  const toolNames = deps.toolRegistry?.list().map((t) => t.name) ?? [];
+  const tools = deps.toolRegistry?.list() ?? [];
+  const toolNames = tools.map((t) => t.name);
+  const toolManifestHash = computeToolManifestHash(tools);
   const wstackEntry = await resolveWstackEntry();
   deps.renderer.writeInfo(`Running ${suiteId} across ${config.cells.length} model(s)\u2026`);
   let report;
@@ -30557,6 +32261,7 @@ async function benchRun(_args, deps) {
       config,
       cliVersion: CLI_VERSION,
       toolNames,
+      toolManifestHash,
       nodeBin: process.execPath,
       wstackEntry,
       limit,
@@ -30613,6 +32318,9 @@ async function benchList(_args, deps) {
   deps.renderer.write(
     "  swebench  " + color.dim("SWE-bench Verified (end-to-end) \u2014 Phase 2, Docker-gated\n")
   );
+  deps.renderer.write(
+    "  local     " + color.dim("Project-defined manifest tasks with command/file graders\n")
+  );
   const modelsPath = flagStr(deps, "models");
   if (modelsPath) {
     try {
@@ -30624,12 +32332,14 @@ async function benchList(_args, deps) {
 `
         );
       }
+      const tools = deps.toolRegistry?.list() ?? [];
       const fp = reportHeaderLine({
         cliVersion: CLI_VERSION,
-        toolNames: deps.toolRegistry?.list().map((t) => t.name) ?? [],
+        toolNames: tools.map((t) => t.name),
         maxIterations: config.maxIterations,
         yolo: true,
         subsetId: "(computed at run time)",
+        toolManifestHash: computeToolManifestHash(tools),
         hash: "(computed at run time)"
       });
       deps.renderer.write("\n" + color.dim(`Harness: ${fp}`) + "\n");
@@ -31734,6 +33444,7 @@ async function serveMcpStdio(deps) {
   const executor = new ToolExecutor(registry, {
     permissionPolicy,
     secretScrubber: new DefaultSecretScrubber(),
+    maxToolTimeoutMs: deps.config.tools?.maxToolTimeoutMs ?? 3e5,
     perIterationOutputCapBytes: 1e6
   });
   const allowed = await selectExposedTools(registry, ctx, permissionPolicy, whitelist);
@@ -31882,7 +33593,7 @@ async function addMcpServer(args, deps) {
   const serverCfg = { ...factory };
   serverCfg.enabled = enable;
   const existing = await readJsonObjectFile(deps.paths.globalConfig);
-  const mcpServers = isRecord2(existing.mcpServers) ? existing.mcpServers : {};
+  const mcpServers = isRecord3(existing.mcpServers) ? existing.mcpServers : {};
   if (mcpServers[name])
     deps.renderer.writeWarning(`Server "${name}" already in config. Updating.
 `);
@@ -31902,7 +33613,7 @@ async function removeMcpServer(name, deps) {
     return 1;
   }
   const existing = await readJsonObjectFile(deps.paths.globalConfig);
-  const mcpServers = isRecord2(existing.mcpServers) ? existing.mcpServers : {};
+  const mcpServers = isRecord3(existing.mcpServers) ? existing.mcpServers : {};
   if (!mcpServers[name]) {
     deps.renderer.writeError(`Server "${name}" not in config.
 `);
@@ -31915,7 +33626,7 @@ async function removeMcpServer(name, deps) {
 `);
   return 0;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var MODEL_PROFILES = [
@@ -31928,15 +33639,6 @@ var MODEL_PROFILES = [
     costTier: "premium",
     speedTier: "slow"
   },
-  {
-    provider: "anthropic",
-    pattern: /claude-sonnet/i,
-    family: "Claude Sonnet",
-    strengths: ["coding", "balanced"],
-    bestFor: ["coding", "general"],
-    costTier: "standard",
-    speedTier: "fast"
-  },
   {
     provider: "anthropic",
     pattern: /claude-haiku/i,
@@ -32628,1146 +34330,206 @@ ${color.dim('Enter numbers or provider IDs (comma-separated, or "all"):')}
         writeLine(color.dim("No providers selected."));
         return 0;
       }
-    }
-    const leaderModel = config.model ?? "unknown";
-    const unknownProviders = providerFilter ? providerFilter.filter((pid) => !keyedProviderIds2.includes(pid)) : [];
-    const warningLine = unknownProviders.length > 0 ? `  ${color.amber("\u26A0 skipped (no key):")} ${unknownProviders.join(", ")}
-` : "";
-    writeLine(`${color.bold("Model Competency Evaluation")}`);
-    writeLine(
-      color.dim(
-        `Providers: ${targetProviderIds.join(", ")}  |  ${targetCategories.length} cats  |  ${modelsPerCat} model(s)/cat/provider`
-      )
-    );
-    writeLine(warningLine);
-    writeLine(color.dim(`Leader (ranker): ${config.provider}/${leaderModel}`));
-    writeLine();
-    const collected = /* @__PURE__ */ new Map();
-    let total = 0;
-    let ok2 = 0;
-    for (const pid of targetProviderIds) {
-      const prov = createProviderForId(pid, config);
-      if (!prov) {
-        writeLine(color.dim(`  \u2298 ${pid}: provider unavailable, skipping`));
-        continue;
-      }
-      for (const cat of targetCategories) {
-        const task = EVAL_TASKS[cat];
-        if (!task) continue;
-        const candidates = rankModels(providers, hasKey, cat, modelsPerCat).filter(
-          (c) => c.provider === pid
-        );
-        if (candidates.length === 0) continue;
-        if (!collected.has(cat)) collected.set(cat, /* @__PURE__ */ new Map());
-        for (const c of candidates) {
-          total++;
-          const modelKey = `${pid}/${c.model}`;
-          try {
-            const start = Date.now();
-            const resp = await prov.complete(
-              {
-                model: c.model,
-                system: [{ type: "text", text: "Be thorough and correct." }],
-                messages: [
-                  { role: "user", content: [{ type: "text", text: task.prompt }] }
-                ],
-                maxTokens: 1024
-              },
-              { signal: AbortSignal.timeout(45e3) }
-            );
-            const respText = resp.content[0] && "text" in resp.content[0] ? resp.content[0].text : "";
-            const respUsage = resp.usage;
-            collected.get(cat)?.set(modelKey, {
-              model: modelKey,
-              latency: Date.now() - start,
-              tokens: (respUsage?.input ?? 0) + (respUsage?.output ?? 0),
-              text: respText
-            });
-            ok2++;
-          } catch {
-            collected.get(cat)?.set(modelKey, {
-              model: modelKey,
-              latency: -1,
-              tokens: 0,
-              text: ""
-            });
-          }
-        }
-      }
-    }
-    writeLine(`${color.dim(`Phase 1: ${ok2}/${total} calls succeeded`)}`);
-    writeLine();
-    if (collected.size === 0) {
-      writeLine(color.amber("No responses collected. Check provider configuration."));
-      return 0;
-    }
-    const leaderProvider = createProviderForId(config.provider, config);
-    if (leaderProvider) {
-      writeLine(`${color.bold("Phase 2")} \u2014 ${color.dim("leader ranks responses")}`);
-      writeLine();
-    }
-    const rankings = /* @__PURE__ */ new Map();
-    for (const [cat, responses] of collected) {
-      const valid = Array.from(responses.values()).filter((r) => r.latency >= 0);
-      if (valid.length < 2) {
-        if (valid.length === 1) {
-          const m = valid[0]?.model;
-          if (m !== void 0) {
-            if (!rankings.has(m)) rankings.set(m, /* @__PURE__ */ new Map());
-            rankings.get(m)?.set(cat, { rank: 1, total: 1 });
-          }
-        }
-        continue;
-      }
-      const task = EVAL_TASKS[cat];
-      if (leaderProvider) {
-        const ranked = await rankResponses(leaderProvider, leaderModel, task.prompt, valid);
-        for (let i = 0; i < valid.length; i++) {
-          const m = valid[ranked[i] ?? i]?.model;
-          if (m === void 0) continue;
-          if (!rankings.has(m)) rankings.set(m, /* @__PURE__ */ new Map());
-          rankings.get(m)?.set(cat, { rank: i + 1, total: valid.length });
-        }
-      } else {
-        for (const r of valid) {
-          if (!rankings.has(r.model)) rankings.set(r.model, /* @__PURE__ */ new Map());
-          rankings.get(r.model)?.set(cat, { rank: 1, total: valid.length });
-        }
-      }
-    }
-    writeLine(`${color.bold("Competency Report")}`);
-    writeLine();
-    const allModels = [.../* @__PURE__ */ new Set([...rankings.keys()])].sort();
-    const catList = [...collected.keys()];
-    const modelColWidth = Math.max(24, ...allModels.map((m) => m.length)) + 2;
-    const cw = 12;
-    writeLine(
-      `  ${color.dim("model".padEnd(modelColWidth))}` + catList.map((c) => color.dim((EVAL_TASKS[c]?.label ?? c).slice(0, cw).padEnd(cw + 2))).join("")
-    );
-    writeLine(`  ${color.dim("\u2500".repeat(modelColWidth + catList.length * (cw + 2)))}`);
-    for (const model of allModels) {
-      const mr = rankings.get(model);
-      const provFromModel = model.split("/")[0] ?? "";
-      const modelColor = provFromModel === config.provider ? color.cyan : color.green;
-      let row = `  ${modelColor(model.padEnd(modelColWidth))}`;
-      for (const cat of catList) {
-        const e = mr.get(cat);
-        if (e) {
-          const pct2 = Math.round((1 - (e.rank - 1) / Math.max(1, e.total - 1)) * 100);
-          const pc = pct2 >= 80 ? color.green : pct2 >= 50 ? color.amber : color.red;
-          row += `${pc(`#${e.rank} ${pct2}%`.padEnd(cw + 2))}`;
-        } else {
-          row += color.dim("\u2014".padEnd(cw + 2));
-        }
-      }
-      writeLine(row);
-    }
-    writeLine();
-    writeLine(color.dim("#1 100% = best in category. \u2014 = not tested."));
-    writeLine();
-    writeLine(color.dim("Pin: wstack setmodel set <role> <provider>/<model>"));
-    writeLine(
-      color.dim(
-        "Full: wstack modeldiag eval          Providers: wstack modeldiag eval --providers=id1,id2"
-      )
-    );
-    writeLine(
-      color.dim("Max:  wstack modeldiag eval --max=3   Quick: wstack modeldiag eval --quick")
-    );
-    return 0;
-  }
-  writeLine(`${color.bold("API Key Status")}`);
-  writeLine();
-  for (const prov of providers) {
-    const k = hasKey(prov.id);
-    writeLine(`  ${checkMark(k)} ${color.bold(prov.id.padEnd(18))} ${color.dim(prov.name)}`);
-  }
-  writeLine();
-  writeLine(`${color.dim(`Leader: ${config.provider}/${config.model}`)}`);
-  writeLine();
-  writeLine(`${color.bold("Model Capabilities")} ${color.dim("\u2014 matched to known profiles")}`);
-  writeLine();
-  for (const prov of providers) {
-    if (!hasKey(prov.id)) continue;
-    writeLine(`  ${color.bold(prov.id)} ${color.dim(`(${prov.name})`)}`);
-    const tiers = {
-      premium: [],
-      standard: [],
-      budget: [],
-      unknown: []
-    };
-    for (const m of prov.models ?? []) {
-      const profile = findProfile(prov.id, m.id);
-      tiers[profile?.costTier ?? "unknown"]?.push(m);
-    }
-    for (const tier of ["premium", "standard", "budget", "unknown"]) {
-      const tierModels = tiers[tier];
-      if (tierModels.length === 0) continue;
-      const label = tier === "unknown" ? color.dim("unmatched") : `${costLabel(tier)} ${tier}`;
-      writeLine(`    ${label}`);
-      for (const m of tierModels) {
-        const cap = m.capabilities;
-        const ctx = cap?.contextWindow ?? 0;
-        const maxOut = cap?.maxOutputTokens ?? 0;
-        const profile = findProfile(prov.id, m.id);
-        const family = profile ? `${speedLabel(profile.speedTier)} ${color.green(profile.family)}` : color.dim("no profile match");
-        const pricing = m.pricing ? `${color.dim("in")}${fmtPrice2(m.pricing.input)} ${color.dim("out")}${fmtPrice2(m.pricing.output)}` : color.dim("pricing ?");
-        writeLine(
-          `      ${color.cyan(m.id.padEnd(34))}${ctx > 0 ? `ctx ${fmtTokens2(ctx).padEnd(6)}` : color.dim("ctx ?  ")}${maxOut > 0 ? `out ${fmtTokens2(maxOut).padEnd(6)}` : "        "}${family}   ${pricing}`
-        );
-      }
-    }
-    writeLine();
-  }
-  await renderSuggest();
-  writeLine();
-  writeLine(color.dim("Pin a suggestion:  wstack setmodel set <role> <provider>/<model>"));
-  writeLine(color.dim('Test candidates:   wstack modeldiag bench <role> "<test prompt>"'));
-  return 0;
-};
-var OFFICIAL_PLUGINS = [
-  {
-    alias: "telegram",
-    specifier: "@wrongstack/telegram",
-    description: "Telegram bridge for prompts, notifications, and slash commands."
-  },
-  {
-    alias: "lsp",
-    specifier: "@wrongstack/plug-lsp",
-    description: "Language Server Protocol tools for code intelligence."
-  }
-];
-var PLUGIN_AUDIT_ENTRIES = [
-  {
-    name: "wstack-prompts",
-    risk: "medium",
-    summary: "Prompt library and prompt authoring commands.",
-    defaultState: "active",
-    canDisable: false
-  },
-  {
-    name: "wstack-sync",
-    risk: "medium",
-    summary: "Cloud sync commands for prompts, skills, settings, memory, and history.",
-    defaultState: "active",
-    canDisable: false
-  },
-  {
-    name: "wstack-git",
-    risk: "high",
-    summary: "Git commands for commit, status checks, and push.",
-    defaultState: "active",
-    canDisable: false
-  },
-  {
-    name: "wstack-observability",
-    risk: "low",
-    summary: "Runtime metrics and health slash commands.",
-    defaultState: "active",
-    canDisable: false
-  },
-  {
-    name: "wstack-security",
-    risk: "high",
-    summary: "Security scanning backend used by first-party security flows.",
-    defaultState: "active",
-    canDisable: false
-  },
-  {
-    name: "wstack-chimera",
-    risk: "medium",
-    summary: "Post-session code quality review agent.",
-    defaultState: "active",
-    canDisable: false
-  },
-  {
-    name: "wstack-skills",
-    risk: "medium",
-    summary: "Skill library, authoring, install, update, and uninstall commands.",
-    defaultState: "active",
-    canDisable: false
-  },
-  {
-    name: "wstack-plan",
-    risk: "medium",
-    summary: "Strategic plan board slash command.",
-    defaultState: "active",
-    canDisable: false
-  },
-  {
-    name: "agent-handoff",
-    risk: "medium",
-    summary: "Mailbox-backed handoff notes and task transfer helpers.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "auto-doc",
-    risk: "medium",
-    summary: "Generates JSDoc/TSDoc comments for source files.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "auto-i18n-extractor",
-    risk: "low",
-    summary: "Finds hardcoded user-facing UI strings and suggests i18n keys when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "accessibility-auditor",
-    risk: "medium",
-    summary: "Scans UI files for common accessibility issues when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "git-autocommit",
-    risk: "high",
-    summary: "Stages files and creates AI-generated conventional commits.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "shell-check",
-    risk: "low",
-    summary: "Runs shellcheck on shell scripts.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "cost-tracker",
-    risk: "low",
-    summary: "Tracks token usage and estimated session cost.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "file-watcher",
-    risk: "medium",
-    summary: "Watches project files and emits change events.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "cron",
-    risk: "medium",
-    summary: "Schedules recurring in-session tasks.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "template-engine",
-    risk: "medium",
-    summary: "Expands and writes file templates.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "semver-bump",
-    risk: "high",
-    summary: "Computes version bumps, changelogs, and tags.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "secret-scanner",
-    risk: "high",
-    summary: "Blocks or redacts credential leaks in tool input and output.",
-    defaultState: "active",
-    canDisable: false
-  },
-  {
-    name: "todo-tracker",
-    risk: "low",
-    summary: "Persistent project-scoped todo backlog.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "token-budget",
-    risk: "medium",
-    summary: "Warns or stops when token budgets are exceeded.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "lint-gate",
-    risk: "medium",
-    summary: "Runs lint checks before write/edit commits.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "branch-guard",
-    risk: "high",
-    summary: "Blocks commits, pushes, and merges on protected branches.",
-    defaultState: "active",
-    canDisable: false
-  },
-  {
-    name: "diff-summary",
-    risk: "low",
-    summary: "Injects compact git diff context after edits.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "commit-validator",
-    risk: "medium",
-    summary: "Validates conventional commit format before commits.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "format-on-save",
-    risk: "medium",
-    summary: "Runs formatter after write/edit tool calls.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "test-runner-gate",
-    risk: "medium",
-    summary: "Runs relevant tests after source edits when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "import-organizer",
-    risk: "medium",
-    summary: "Sorts imports and applies safe linter fixes after edits.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "knowledge-graph",
-    risk: "low",
-    summary: "Stores and queries durable project knowledge graph facts.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "todo-listener",
-    risk: "low",
-    summary: "Broadcasts todo tool updates to the project mailbox when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "session-recap",
-    risk: "low",
-    summary: "Posts a session recap to the project mailbox on stop.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "spec-linker",
-    risk: "low",
-    summary: "Finds unlinked plugin references in markdown edits.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "doc-sync-guard",
-    risk: "low",
-    summary: "Warns when docs drift from recently changed public source files when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "loop-breaker",
-    risk: "low",
-    summary: "Detects runaway tool-call loops; warns, then blocks repeats.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "path-guard",
-    risk: "medium",
-    summary: "Blocks writes and destructive commands on protected paths.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "context-pins",
-    risk: "low",
-    summary: "Pins durable facts into the system prompt across compactions.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "checkpoint",
-    risk: "medium",
-    summary: "Snapshots files before edits and restores pre-edit states.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "error-lens",
-    risk: "low",
-    summary: "Distills failed command output into compact error digests.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "dep-guard",
-    risk: "medium",
-    summary: "Supervises dependency installs: deny list and typosquat warnings.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "dependency-vulnerability-gate",
-    risk: "high",
-    summary: "Audits installed dependencies and blocks vulnerable installs.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "license-audit-gate",
-    risk: "high",
-    summary: "Audits dependency licenses after package installs.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "security-hotspot-scanner",
-    risk: "high",
-    summary: "Scans source files for common security anti-patterns on demand or when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "api-compatibility-gate",
-    risk: "medium",
-    summary: "Warns when public entry-point exports are removed when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "dead-code-detector",
-    risk: "low",
-    summary: "Scans for suspicious exported symbols that appear unused on demand or when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "migration-planner",
-    risk: "low",
-    summary: "Builds dependency or framework migration checklists.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "schema-evolution-guard",
-    risk: "high",
-    summary: "Warns on destructive database or API schema changes.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "semantic-search-indexer",
-    risk: "low",
-    summary: "Builds an in-memory keyword index for project source search.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "config-validator",
-    risk: "low",
-    summary: "Validates JSON/YAML/TOML files right after write/edit.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "notify-hub",
-    risk: "medium",
-    summary: "Sends session events and ad-hoc notifications to a webhook.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "changelog-writer",
-    risk: "low",
-    summary: "Collects session work and writes Keep-a-Changelog entries.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "injection-shield",
-    risk: "low",
-    summary: "Flags prompt-injection patterns in tool output.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "llm-cache",
-    risk: "medium",
-    summary: "Caches identical provider requests (opt-in; wraps every LLM call).",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "model-router",
-    risk: "medium",
-    summary: "Routes each LLM call to a different model by size/tool rules (opt-in).",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "pr-drafter",
-    risk: "low",
-    summary: "Generates session pull request draft markdown.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "prompt-firewall",
-    risk: "high",
-    summary: "Detects/redacts credential leaks on the provider wire (opt-in).",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "auto-escalate",
-    risk: "medium",
-    summary: "Retries with an escalated model on transient provider errors (opt-in).",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "token-throttle",
-    risk: "medium",
-    summary: "Rolling-window tokens/min rate limiting via provider-call delays (opt-in).",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "plugin-stack-observer",
-    risk: "low",
-    summary: "Reports provider wrapper stack order and health.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "test-coverage-gate",
-    risk: "medium",
-    summary: "Checks coverage thresholds after test runs.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "test-flake-detector",
-    risk: "medium",
-    summary: "Runs tests repeatedly to identify flaky failures.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "performance-regression-gate",
-    risk: "medium",
-    summary: "Compares benchmark results and reports performance regressions.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "type-gate",
-    risk: "medium",
-    summary: "Runs TypeScript type checks after relevant edits when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "code-metrics",
-    risk: "low",
-    summary: "Computes LOC, comment ratio, function count, and approximate cyclomatic complexity on demand or when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "duplicate-code-detector",
-    risk: "low",
-    summary: "Detects duplicate or similar code blocks across source files on demand or when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "feature-flag-tracker",
-    risk: "low",
-    summary: "Scans source files for feature-flag usage and reports flag inventory on demand or when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "interface-contract-guard",
-    risk: "medium",
-    summary: "Warns when TypeScript interfaces change or lack implementers when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "refactor-suggester",
-    risk: "low",
-    summary: "Flags long functions, deep nesting, many parameters, magic numbers, and console.log on demand or when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "release-notes-generator",
-    risk: "low",
-    summary: "Groups conventional commits into a release-notes markdown draft.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "smart-rename",
-    risk: "medium",
-    summary: "Whole-word symbol rename with preview and optional apply.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "test-generator",
-    risk: "low",
-    summary: "Generates a unit-test skeleton from exported functions/classes.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "@wrongstack/plug-lsp",
-    risk: "medium",
-    summary: "Language Server Protocol tools and slash commands.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "telegram",
-    risk: "medium",
-    summary: "Telegram bridge for messages, approvals, and notifications.",
-    defaultState: "active",
-    canDisable: true
-  }
-];
-var OFFICIAL_ALIASES = new Map(
-  OFFICIAL_PLUGINS.flatMap((p) => [
-    [p.alias, p.specifier],
-    [p.specifier, p.specifier]
-  ])
-);
-async function runPluginManagementCommand(args, deps) {
-  const sub = args[0];
-  if (!sub || sub === "list" || sub === "status") {
-    return {
-      code: 0,
-      level: "output",
-      message: renderConfiguredPlugins(deps.config)
-    };
-  }
-  if (sub === "official" || sub === "officials") {
-    return {
-      code: 0,
-      level: "output",
-      message: renderOfficialPlugins(deps.config)
-    };
-  }
-  if (sub === "report" || sub === "audit" || sub === "menu") {
-    return {
-      code: 0,
-      level: "output",
-      message: renderPluginAuditReport(deps.config)
-    };
-  }
-  if (sub === "add" || sub === "install") {
-    const spec = args[1];
-    if (!spec) {
-      return errorResult("Usage: wstack plugin add <specifier|official-alias> [--disabled]");
-    }
-    return upsertPlugin(
-      resolvePluginSpecifier(spec),
-      { enabled: !args.includes("--disabled") },
-      deps,
-      "Added"
-    );
-  }
-  if (sub === "remove" || sub === "rm" || sub === "uninstall") {
-    const spec = args[1];
-    if (!spec) {
-      return errorResult("Usage: wstack plugin remove <specifier|official-alias>");
-    }
-    return removePlugin(resolvePluginSpecifier(spec), deps);
-  }
-  if (sub === "enable" || sub === "disable") {
-    const spec = args[1];
-    if (!spec) {
-      return errorResult(`Usage: wstack plugin ${sub} <specifier|official-alias>`);
-    }
-    return upsertPlugin(
-      resolvePluginSpecifier(spec),
-      { enabled: sub === "enable" },
-      deps,
-      sub === "enable" ? "Enabled" : "Disabled"
-    );
-  }
-  if (sub === "toggle") {
-    const spec = args[1];
-    if (!spec) {
-      return errorResult("Usage: wstack plugin toggle <plugin-name|official-alias>");
-    }
-    return togglePlugin(resolvePluginToggleSpecifier(spec), deps);
-  }
-  if (sub === "llm") {
-    return runPluginLlmCommand(args.slice(1), deps);
-  }
-  return errorResult(
-    `Unknown plugin subcommand: ${sub}
-Usage: wstack plugin [list|status|report|menu|official|add|install|remove|enable|disable|toggle|llm]`
-  );
-}
-var PLUGIN_LLM_USAGE = [
-  "Usage:",
-  "  wstack plugin llm                               List every per-plugin LLM override.",
-  "  wstack plugin llm <plugin>                      Show one plugin's LLM override.",
-  "  wstack plugin llm <plugin> <provider> [model]   Route this plugin through a provider (and model).",
-  "  wstack plugin llm <plugin> - <model>            Keep the session provider, override only the model.",
-  "  wstack plugin llm <plugin> --clear              Remove the override (back to the session default).",
-  "",
-  "The override is stored as config.extensions.<plugin>.llm and is used by",
-  "every api.llm call the plugin makes. Without an override, plugins follow",
-  "the active session provider/model (the chat leader)."
-].join("\n");
-function renderPluginLlmOverviews(config, sessionDefault) {
-  const rows = [];
-  for (const [pluginName2, ext] of Object.entries(config.extensions ?? {})) {
-    const llm = ext?.["llm"];
-    if (llm && typeof llm === "object") {
-      const o = llm;
-      rows.push({
-        name: pluginName2,
-        provider: o.provider ?? "(session)",
-        model: o.model ?? "(session)"
-      });
-    }
-  }
-  const lines = [`Per-plugin LLM routing (session default: ${sessionDefault}):`];
-  if (rows.length === 0) {
-    lines.push(
-      "  No plugin overrides \u2014 every plugin follows the session default.",
-      "  Set one with: wstack plugin llm <plugin> <provider> [model]"
+    }
+    const leaderModel = config.model ?? "unknown";
+    const unknownProviders = providerFilter ? providerFilter.filter((pid) => !keyedProviderIds2.includes(pid)) : [];
+    const warningLine = unknownProviders.length > 0 ? `  ${color.amber("\u26A0 skipped (no key):")} ${unknownProviders.join(", ")}
+` : "";
+    writeLine(`${color.bold("Model Competency Evaluation")}`);
+    writeLine(
+      color.dim(
+        `Providers: ${targetProviderIds.join(", ")}  |  ${targetCategories.length} cats  |  ${modelsPerCat} model(s)/cat/provider`
+      )
     );
-  } else {
-    rows.sort((a, b) => a.name.localeCompare(b.name));
-    for (const r of rows) {
-      lines.push(`  ${r.name.padEnd(24)} provider=${r.provider.padEnd(16)} model=${r.model}`);
+    writeLine(warningLine);
+    writeLine(color.dim(`Leader (ranker): ${config.provider}/${leaderModel}`));
+    writeLine();
+    const collected = /* @__PURE__ */ new Map();
+    let total = 0;
+    let ok2 = 0;
+    for (const pid of targetProviderIds) {
+      const prov = createProviderForId(pid, config);
+      if (!prov) {
+        writeLine(color.dim(`  \u2298 ${pid}: provider unavailable, skipping`));
+        continue;
+      }
+      for (const cat of targetCategories) {
+        const task = EVAL_TASKS[cat];
+        if (!task) continue;
+        const candidates = rankModels(providers, hasKey, cat, modelsPerCat).filter(
+          (c) => c.provider === pid
+        );
+        if (candidates.length === 0) continue;
+        if (!collected.has(cat)) collected.set(cat, /* @__PURE__ */ new Map());
+        for (const c of candidates) {
+          total++;
+          const modelKey = `${pid}/${c.model}`;
+          try {
+            const start = Date.now();
+            const resp = await prov.complete(
+              {
+                model: c.model,
+                system: [{ type: "text", text: "Be thorough and correct." }],
+                messages: [
+                  { role: "user", content: [{ type: "text", text: task.prompt }] }
+                ],
+                maxTokens: 1024
+              },
+              { signal: AbortSignal.timeout(45e3) }
+            );
+            const respText = resp.content[0] && "text" in resp.content[0] ? resp.content[0].text : "";
+            const respUsage = resp.usage;
+            collected.get(cat)?.set(modelKey, {
+              model: modelKey,
+              latency: Date.now() - start,
+              tokens: (respUsage?.input ?? 0) + (respUsage?.output ?? 0),
+              text: respText
+            });
+            ok2++;
+          } catch {
+            collected.get(cat)?.set(modelKey, {
+              model: modelKey,
+              latency: -1,
+              tokens: 0,
+              text: ""
+            });
+          }
+        }
+      }
     }
-    lines.push("", "Clear one with: wstack plugin llm <plugin> --clear");
-  }
-  return lines.join("\n");
-}
-async function runPluginLlmCommand(args, deps) {
-  const sessionDefault = `${deps.config.provider ?? "?"} / ${deps.config.model ?? "?"}`;
-  if (args.length === 0 || args[0] === "list") {
-    return {
-      code: 0,
-      level: "output",
-      message: renderPluginLlmOverviews(deps.config, sessionDefault)
-    };
-  }
-  const name = args[0];
-  if (!name || name.startsWith("-")) return errorResult(PLUGIN_LLM_USAGE);
-  const currentOverride = deps.config.extensions?.[name]?.["llm"];
-  if (args.length === 1) {
-    const lines = [`LLM routing for plugin "${name}":`];
-    if (currentOverride && typeof currentOverride === "object") {
-      const o = currentOverride;
-      lines.push(
-        `  override: provider=${o.provider ?? "(session)"} model=${o.model ?? "(session)"}`,
-        `  session default: ${sessionDefault}`
-      );
-    } else {
-      lines.push(
-        `  no override \u2014 follows the session default (${sessionDefault}).`,
-        `  Set one with: wstack plugin llm ${name} <provider> [model]`
-      );
+    writeLine(`${color.dim(`Phase 1: ${ok2}/${total} calls succeeded`)}`);
+    writeLine();
+    if (collected.size === 0) {
+      writeLine(color.amber("No responses collected. Check provider configuration."));
+      return 0;
     }
-    return { code: 0, level: "output", message: lines.join("\n") };
-  }
-  const existing = await readConfig(deps.configPath);
-  const fileExtensions = isRecord3(existing.extensions) ? existing.extensions : {};
-  const pluginExt = isRecord3(fileExtensions[name]) ? { ...fileExtensions[name] } : {};
-  if (args[1] === "--clear" || args[1] === "clear") {
-    if (!("llm" in pluginExt) && !currentOverride) {
-      return { code: 0, level: "info", message: `Plugin "${name}" has no LLM override.` };
+    const leaderProvider = createProviderForId(config.provider, config);
+    if (leaderProvider) {
+      writeLine(`${color.bold("Phase 2")} \u2014 ${color.dim("leader ranks responses")}`);
+      writeLine();
     }
-    delete pluginExt["llm"];
-    if (Object.keys(pluginExt).length === 0) delete fileExtensions[name];
-    else fileExtensions[name] = pluginExt;
-    existing.extensions = fileExtensions;
-    await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
-    const merged2 = mergeExtensionsForPatch(deps.config, fileExtensions);
-    const mergedEntry = merged2[name];
-    if (mergedEntry) {
-      delete mergedEntry["llm"];
-      if (Object.keys(mergedEntry).length === 0) delete merged2[name];
+    const rankings = /* @__PURE__ */ new Map();
+    for (const [cat, responses] of collected) {
+      const valid = Array.from(responses.values()).filter((r) => r.latency >= 0);
+      if (valid.length < 2) {
+        if (valid.length === 1) {
+          const m = valid[0]?.model;
+          if (m !== void 0) {
+            if (!rankings.has(m)) rankings.set(m, /* @__PURE__ */ new Map());
+            rankings.get(m)?.set(cat, { rank: 1, total: 1 });
+          }
+        }
+        continue;
+      }
+      const task = EVAL_TASKS[cat];
+      if (leaderProvider) {
+        const ranked = await rankResponses(leaderProvider, leaderModel, task.prompt, valid);
+        for (let i = 0; i < valid.length; i++) {
+          const m = valid[ranked[i] ?? i]?.model;
+          if (m === void 0) continue;
+          if (!rankings.has(m)) rankings.set(m, /* @__PURE__ */ new Map());
+          rankings.get(m)?.set(cat, { rank: i + 1, total: valid.length });
+        }
+      } else {
+        for (const r of valid) {
+          if (!rankings.has(r.model)) rankings.set(r.model, /* @__PURE__ */ new Map());
+          rankings.get(r.model)?.set(cat, { rank: 1, total: valid.length });
+        }
+      }
     }
-    return {
-      code: 0,
-      level: "info",
-      message: `Cleared LLM override for "${name}" \u2014 it now follows the session default (${sessionDefault}). Takes effect immediately for api.llm calls.`,
-      patch: { extensions: merged2 }
-    };
-  }
-  const providerArg = args[1];
-  const modelArg = args[2];
-  if (!providerArg || providerArg.startsWith("--")) return errorResult(PLUGIN_LLM_USAGE);
-  const provider = providerArg === "-" ? void 0 : providerArg;
-  const model = modelArg && modelArg !== "-" ? modelArg : void 0;
-  if (!provider && !model) return errorResult(PLUGIN_LLM_USAGE);
-  const llm = {};
-  if (provider) llm["provider"] = provider;
-  if (model) llm["model"] = model;
-  pluginExt["llm"] = llm;
-  fileExtensions[name] = pluginExt;
-  existing.extensions = fileExtensions;
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
-  const configured = Object.keys(deps.config.providers ?? {});
-  const note = provider && configured.length > 0 && !configured.includes(provider) ? `
-Note: "${provider}" is not in config.providers (configured: ${configured.join(", ")}). Catalog providers (anthropic, openai, \u2026) still resolve if credentials are available.` : "";
-  const merged = mergeExtensionsForPatch(deps.config, fileExtensions);
-  return {
-    code: 0,
-    level: "info",
-    message: `Plugin "${name}" now routes api.llm calls via provider=${provider ?? "(session)"} model=${model ?? "(session)"}. Session default stays ${sessionDefault}. Takes effect immediately for api.llm calls.${note}`,
-    patch: { extensions: merged }
-  };
-}
-function mergeExtensionsForPatch(config, fileExtensions) {
-  const merged = {};
-  for (const [k, v] of Object.entries(config.extensions ?? {})) {
-    merged[k] = { ...v };
-  }
-  for (const [k, v] of Object.entries(fileExtensions)) {
-    if (isRecord3(v)) merged[k] = { ...merged[k] ?? {}, ...v };
-  }
-  for (const k of Object.keys(merged)) {
-    if (!(k in fileExtensions) && !(k in (config.extensions ?? {}))) delete merged[k];
-  }
-  return merged;
-}
-function resolvePluginSpecifier(input) {
-  return OFFICIAL_ALIASES.get(input.toLowerCase()) ?? input;
-}
-function resolvePluginToggleSpecifier(input) {
-  if (input.toLowerCase() === "@wrongstack/telegram") return "telegram";
-  if (auditEntryFor(input)) return input;
-  return resolvePluginSpecifier(input);
-}
-function renderOfficialPlugins(config) {
-  return [
-    "Official plugins:",
-    ...OFFICIAL_PLUGINS.map((p) => {
-      const state = config ? officialPluginState(config, p.specifier) : "";
-      const status = state ? `${state.padEnd(14)} ` : "";
-      return `  ${p.alias.padEnd(12)} ${status}${p.specifier.padEnd(24)} ${p.description}`;
-    }),
-    "",
-    "Use `wstack plugin add <alias>` or `/plugin install <alias>`."
-  ].join("\n");
-}
-function renderConfiguredPlugins(config) {
-  const plugins = config.plugins ?? [];
-  if (plugins.length === 0) {
-    return [
-      "No plugins configured.",
-      "Use `wstack plugin add <specifier>` or `/plugin install <official-alias>`."
-    ].join("\n");
-  }
-  return plugins.map((p) => {
-    const name = pluginName(p);
-    const enabled = typeof p === "object" && p.enabled === false ? "disabled" : "enabled";
-    const official = OFFICIAL_PLUGINS.find((entry) => entry.specifier === name);
-    const suffix = official ? ` (${official.alias})` : "";
-    return `  ${`${name}${suffix}`.padEnd(44)} ${enabled}`;
-  }).join("\n");
-}
-function renderPluginAuditReport(config) {
-  const configured = config.plugins ?? [];
-  const lines = [
-    "Plugin audit report:",
-    "  State shows the effective boot state. Default-active plugins run unless disabled in config.",
-    "  Locked rows are visible in the menu but cannot be toggled there.",
-    "",
-    "  Built-in audit entries:"
-  ];
-  for (const entry of PLUGIN_AUDIT_ENTRIES) {
-    const { state, source } = effectiveAuditState(config, entry);
-    const policy = entry.canDisable ? "toggleable" : lockedReason(entry);
-    lines.push(
-      `  ${entry.name.padEnd(24)} ${state.padEnd(8)} ${source.padEnd(8)} risk=${entry.risk.padEnd(6)} ${policy.padEnd(24)} ${entry.summary}`
+    writeLine(`${color.bold("Competency Report")}`);
+    writeLine();
+    const allModels = [.../* @__PURE__ */ new Set([...rankings.keys()])].sort();
+    const catList = [...collected.keys()];
+    const modelColWidth = Math.max(24, ...allModels.map((m) => m.length)) + 2;
+    const cw = 12;
+    writeLine(
+      `  ${color.dim("model".padEnd(modelColWidth))}` + catList.map((c) => color.dim((EVAL_TASKS[c]?.label ?? c).slice(0, cw).padEnd(cw + 2))).join("")
     );
-  }
-  const extra = configured.filter(
-    (plugin) => !PLUGIN_AUDIT_ENTRIES.some((entry) => pluginMatchesToggleSpec(plugin, entry.name))
-  );
-  if (extra.length > 0) {
-    lines.push("", "  Configured plugins outside the audit list:");
-    for (const plugin of extra) {
-      const name = pluginName(plugin);
-      const state = typeof plugin === "object" && plugin.enabled === false ? "disabled" : "enabled";
-      lines.push(
-        `  ${name.padEnd(24)} ${state.padEnd(8)} config   risk=custom user-configured plugin`
-      );
+    writeLine(`  ${color.dim("\u2500".repeat(modelColWidth + catList.length * (cw + 2)))}`);
+    for (const model of allModels) {
+      const mr = rankings.get(model);
+      const provFromModel = model.split("/")[0] ?? "";
+      const modelColor = provFromModel === config.provider ? color.cyan : color.green;
+      let row = `  ${modelColor(model.padEnd(modelColWidth))}`;
+      for (const cat of catList) {
+        const e = mr.get(cat);
+        if (e) {
+          const pct2 = Math.round((1 - (e.rank - 1) / Math.max(1, e.total - 1)) * 100);
+          const pc = pct2 >= 80 ? color.green : pct2 >= 50 ? color.amber : color.red;
+          row += `${pc(`#${e.rank} ${pct2}%`.padEnd(cw + 2))}`;
+        } else {
+          row += color.dim("\u2014".padEnd(cw + 2));
+        }
+      }
+      writeLine(row);
     }
+    writeLine();
+    writeLine(color.dim("#1 100% = best in category. \u2014 = not tested."));
+    writeLine();
+    writeLine(color.dim("Pin: wstack setmodel set <role> <provider>/<model>"));
+    writeLine(
+      color.dim(
+        "Full: wstack modeldiag eval          Providers: wstack modeldiag eval --providers=id1,id2"
+      )
+    );
+    writeLine(
+      color.dim("Max:  wstack modeldiag eval --max=3   Quick: wstack modeldiag eval --quick")
+    );
+    return 0;
   }
-  lines.push(
-    "",
-    "Use `/plugin menu` in the TUI, or `wstack plugin toggle <name>` for toggleable rows."
-  );
-  return lines.join("\n");
-}
-async function readConfig(file) {
-  try {
-    return JSON.parse(await fs2.readFile(file, "utf8"));
-  } catch {
-    return {};
+  writeLine(`${color.bold("API Key Status")}`);
+  writeLine();
+  for (const prov of providers) {
+    const k = hasKey(prov.id);
+    writeLine(`  ${checkMark(k)} ${color.bold(prov.id.padEnd(18))} ${color.dim(prov.name)}`);
   }
-}
-function pluginName(p) {
-  return typeof p === "string" ? p : p.name;
-}
-function pluginEntry(spec, enabled) {
-  return enabled ? spec : { name: spec, enabled: false };
-}
-function pluginMatchesToggleSpec(p, spec) {
-  const name = pluginName(p);
-  if (spec === "telegram") return name === "telegram" || name === "@wrongstack/telegram";
-  return name === spec;
-}
-function effectiveAuditState(config, entry) {
-  const configured = (config.plugins ?? []).find(
-    (plugin) => pluginMatchesToggleSpec(plugin, entry.name)
-  );
-  if (configured) {
-    return {
-      state: typeof configured === "object" && configured.enabled === false ? "disabled" : "enabled",
-      source: "config"
+  writeLine();
+  writeLine(`${color.dim(`Leader: ${config.provider}/${config.model}`)}`);
+  writeLine();
+  writeLine(`${color.bold("Model Capabilities")} ${color.dim("\u2014 matched to known profiles")}`);
+  writeLine();
+  for (const prov of providers) {
+    if (!hasKey(prov.id)) continue;
+    writeLine(`  ${color.bold(prov.id)} ${color.dim(`(${prov.name})`)}`);
+    const tiers = {
+      premium: [],
+      standard: [],
+      budget: [],
+      unknown: []
     };
-  }
-  return {
-    state: entry.defaultState === "active" ? "enabled" : "disabled",
-    source: "default"
-  };
-}
-function lockedReason(entry) {
-  if (entry.canDisable) return "toggleable";
-  if (entry.name === "secret-scanner" || entry.name === "branch-guard") {
-    return "locked: safety guard";
-  }
-  return "locked: core surface";
-}
-function auditEntryFor(spec) {
-  return PLUGIN_AUDIT_ENTRIES.find((entry) => entry.name === spec);
-}
-function officialPluginState(config, spec) {
-  const match = (config.plugins ?? []).find((p) => pluginName(p) === spec);
-  if (!match) return "not configured";
-  return typeof match === "object" && match.enabled === false ? "disabled" : "enabled";
-}
-async function togglePlugin(spec, deps) {
-  const auditEntry = auditEntryFor(spec);
-  if (auditEntry?.canDisable === false) {
-    return errorResult(`Plugin "${spec}" is locked and cannot be toggled from the plugin menu.`);
-  }
-  const existing = await readConfig(deps.configPath);
-  const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
-  const idx = plugins.findIndex((p) => pluginMatchesToggleSpec(p, spec));
-  const configured = idx >= 0 ? plugins[idx] : void 0;
-  const enabled = configured ? !(typeof configured === "object" && configured.enabled === false) : auditEntry?.defaultState === "active";
-  if (!configured && !auditEntry) {
-    return errorResult(
-      `Plugin "${spec}" is not configured. Use "wstack plugin add ${spec}" first.`
-    );
-  }
-  let nextPlugins;
-  let nextEnabled;
-  if (enabled) {
-    nextEnabled = false;
-    nextPlugins = plugins.filter((p) => !pluginMatchesToggleSpec(p, spec));
-    nextPlugins.push({ name: spec, enabled: false });
-  } else {
-    nextEnabled = true;
-    if (auditEntry?.defaultState === "active") {
-      nextPlugins = plugins.filter((p) => !pluginMatchesToggleSpec(p, spec));
-    } else {
-      nextPlugins = plugins.filter((p) => !pluginMatchesToggleSpec(p, spec));
-      nextPlugins.push(spec);
+    for (const m of prov.models ?? []) {
+      const profile = findProfile(prov.id, m.id);
+      tiers[profile?.costTier ?? "unknown"]?.push(m);
     }
+    for (const tier of ["premium", "standard", "budget", "unknown"]) {
+      const tierModels = tiers[tier];
+      if (tierModels.length === 0) continue;
+      const label = tier === "unknown" ? color.dim("unmatched") : `${costLabel(tier)} ${tier}`;
+      writeLine(`    ${label}`);
+      for (const m of tierModels) {
+        const cap = m.capabilities;
+        const ctx = cap?.contextWindow ?? 0;
+        const maxOut = cap?.maxOutputTokens ?? 0;
+        const profile = findProfile(prov.id, m.id);
+        const family = profile ? `${speedLabel(profile.speedTier)} ${color.green(profile.family)}` : color.dim("no profile match");
+        const pricing = m.pricing ? `${color.dim("in")}${fmtPrice2(m.pricing.input)} ${color.dim("out")}${fmtPrice2(m.pricing.output)}` : color.dim("pricing ?");
+        writeLine(
+          `      ${color.cyan(m.id.padEnd(34))}${ctx > 0 ? `ctx ${fmtTokens2(ctx).padEnd(6)}` : color.dim("ctx ?  ")}${maxOut > 0 ? `out ${fmtTokens2(maxOut).padEnd(6)}` : "        "}${family}   ${pricing}`
+        );
+      }
+    }
+    writeLine();
   }
-  const features = {
-    ...isRecord3(deps.config.features) ? deps.config.features : {},
-    ...isRecord3(existing.features) ? existing.features : {},
-    plugins: true
-  };
-  existing.plugins = nextPlugins;
-  existing.features = features;
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
-  return {
-    code: 0,
-    level: "info",
-    message: `${nextEnabled ? "Enabled" : "Disabled"} "${spec}". Config written to ${deps.configPath}.`,
-    patch: { plugins: nextPlugins, features },
-    restartRequired: true
-  };
-}
-async function upsertPlugin(spec, opts, deps, verb) {
-  const existing = await readConfig(deps.configPath);
-  const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
-  const idx = plugins.findIndex((p) => pluginName(p) === spec);
-  const nextEntry = pluginEntry(spec, opts.enabled);
-  if (idx >= 0) plugins[idx] = nextEntry;
-  else plugins.push(nextEntry);
-  const features = {
-    ...isRecord3(deps.config.features) ? deps.config.features : {},
-    ...isRecord3(existing.features) ? existing.features : {},
-    plugins: true
-  };
-  existing.plugins = plugins;
-  existing.features = features;
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
-  return {
-    code: 0,
-    level: "info",
-    message: `${verb} "${spec}" (${opts.enabled ? "enabled" : "disabled"}). Config written to ${deps.configPath}.`,
-    patch: { plugins, features },
-    restartRequired: true
-  };
-}
-async function removePlugin(spec, deps) {
-  const existing = await readConfig(deps.configPath);
-  const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
-  const next = plugins.filter((p) => pluginName(p) !== spec);
-  if (next.length === plugins.length) {
-    return errorResult(`Plugin "${spec}" not in config.`);
-  }
-  existing.plugins = next;
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
-  return {
-    code: 0,
-    level: "info",
-    message: `Removed "${spec}" from config.`,
-    patch: { plugins: next },
-    restartRequired: true
-  };
-}
-function errorResult(message) {
-  return { code: 1, level: "error", message };
-}
-function isRecord3(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
+  await renderSuggest();
+  writeLine();
+  writeLine(color.dim("Pin a suggestion:  wstack setmodel set <role> <provider>/<model>"));
+  writeLine(color.dim('Test candidates:   wstack modeldiag bench <role> "<test prompt>"'));
+  return 0;
+};
 
 // src/subcommands/handlers/plugin-usage.ts
+init_plugin_management();
 var pluginCmd = async (args, deps) => {
   const result = await runPluginManagementCommand(args, {
     config: deps.config,
@@ -36240,7 +37002,14 @@ async function handleHqShortCircuit(flags) {
       try {
         await handle2.close();
       } catch (err) {
-        console.error(`HQ server close error: ${String(err)}`);
+        console.error(
+          JSON.stringify({
+            level: "error",
+            event: "hq.server_close_failed",
+            message: String(err),
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          })
+        );
       }
       resolve13();
     };
@@ -36698,7 +37467,16 @@ Reply with ONLY the JSON object.`
       coordinatorController["onCoordinatorStart"] = (goal) => {
         const coordinator = state.autonomousCoordinator;
         if (!coordinator) return;
-        coordinator.run({ goal: goal ?? "Improve the codebase", runUntilComplete: true }).then(() => void 0).catch((err) => console.error("[coordinator] run() failed:", err));
+        coordinator.run({ goal: goal ?? "Improve the codebase", runUntilComplete: true }).then(() => void 0).catch(
+          (err) => console.error(
+            JSON.stringify({
+              level: "error",
+              event: "coordinator.run_failed",
+              message: err instanceof Error ? err.message : String(err),
+              timestamp: (/* @__PURE__ */ new Date()).toISOString()
+            })
+          )
+        );
       };
       coordinatorController["onCoordinatorStop"] = () => state.autonomousCoordinator?.stop();
       coordinatorController["onCoordinatorTasks"] = async () => {
@@ -38312,7 +39090,7 @@ ${color.dim(
               activeCtrl = void 0;
             }
           } else if (autonomy === "suggest" && !hasOpenTodos(opts.agent.ctx.todos)) {
-            const suggestPrompt = 'Based on what you just did, suggest 3 concrete next steps. Format: numbered list, one line each, no explanation. If there is nothing meaningful left, say "No further steps needed."';
+            const suggestPrompt = 'Based on what you just did, suggest 3 concrete next steps. If you include suggestions, wrap them in a balanced <nextsteps>...</nextsteps> block, with one numbered prompt per line and no explanation. If there is nothing meaningful left, say "No further steps needed."';
             const suggestBlocks = [{ type: "text", text: suggestPrompt }];
             const suggestCtrl = new AbortController();
             activeCtrl = suggestCtrl;
@@ -38680,6 +39458,16 @@ async function execute(deps) {
     saveStatuslineHiddenItems,
     getPluginItems,
     onPluginToggle,
+    getMcpServers,
+    onMcpToggle,
+    onMcpRestart,
+    getToolsItems,
+    onToolToggle,
+    getBrainData,
+    onBrainRiskLevel,
+    getShadowData,
+    onShadowStart,
+    onShadowStop,
     authHost,
     agentsMonitorController,
     onPanelOpen,
@@ -38977,7 +39765,7 @@ async function execute(deps) {
           // shared suggestion store so `/next 1`, `/next 1 2 3` work without
           // requiring `/suggest` first. Called unconditionally on every done
           // turn. The live todo list is passed through so we suppress
-          // <next_steps> while the in-flight todo loop is still in progress
+          // <nextsteps> while the in-flight todo loop is still in progress
           // — finishing the open todos comes before offering new prompt
           // options.
           onSuggestionsParsed: (finalText) => {
@@ -39034,12 +39822,26 @@ async function execute(deps) {
           onCoordinatorStart: (goal) => {
             const coordinator = ensureAutonomousCoordinator();
             if (!coordinator) {
-              console.error("[coordinator] not ready \u2014 no director available");
+              console.error(
+                JSON.stringify({
+                  level: "error",
+                  event: "coordinator.not_ready",
+                  message: "no director available",
+                  timestamp: (/* @__PURE__ */ new Date()).toISOString()
+                })
+              );
               return;
             }
             if (state.coordinatorRun) return;
             state.coordinatorRun = coordinator.run({ goal: goal ?? "Improve the codebase", runUntilComplete: true }).then(() => void 0).catch((err) => {
-              console.error("[coordinator] run() failed:", err);
+              console.error(
+                JSON.stringify({
+                  level: "error",
+                  event: "coordinator.run_failed",
+                  message: err instanceof Error ? err.message : String(err),
+                  timestamp: (/* @__PURE__ */ new Date()).toISOString()
+                })
+              );
             }).finally(() => {
               state.coordinatorRun = null;
             });
@@ -39152,6 +39954,16 @@ async function execute(deps) {
           saveStatuslineHiddenItems,
           getPluginItems,
           onPluginToggle,
+          getMcpServers,
+          onMcpToggle,
+          onMcpRestart,
+          getToolsItems,
+          onToolToggle,
+          getBrainData,
+          onBrainRiskLevel,
+          getShadowData,
+          onShadowStart,
+          onShadowStop,
           authHost,
           agentsMonitorController,
           getLiveSessions: () => getLiveSessions({ state }),
@@ -39709,6 +40521,7 @@ var DEFAULT_SUBAGENT_HIDDEN_TOOLS = /* @__PURE__ */ new Set([
   "delegate",
   "spawn_subagent",
   "assign_task",
+  "kanban_queue",
   "await_tasks",
   "ask_subagent",
   "ask_result",
@@ -40331,6 +41144,7 @@ var MultiAgentHost = class _MultiAgentHost {
         events,
         confirmAwaiter: void 0,
         iterationTimeoutMs: config.tools?.iterationTimeoutMs ?? 12e4,
+        maxToolTimeoutMs: config.tools?.maxToolTimeoutMs ?? 3e5,
         perIterationOutputCapBytes: config.tools?.perIterationOutputCapBytes ?? 1e5,
         tracer: void 0
       });
@@ -41047,6 +41861,7 @@ var MultiAgentHost = class _MultiAgentHost {
     }
   }
 };
+init_plugin_management();
 
 // src/session-stats.ts
 init_utils();
@@ -41333,7 +42148,7 @@ async function setupCodebaseIndexing(deps) {
   let watcher;
   if (idx.watchExternal) {
     try {
-      watcher = fs27.watch(projectRoot, { recursive: true }, (_event, filename) => {
+      watcher = fs28.watch(projectRoot, { recursive: true }, (_event, filename) => {
         if (!filename) return;
         const rel = filename.toString();
         if (isIgnored(rel)) return;
@@ -41677,6 +42492,7 @@ function createAgent(params) {
     events: params.events,
     confirmAwaiter: params.confirmAwaiter,
     iterationTimeoutMs: params.config.tools.iterationTimeoutMs,
+    maxToolTimeoutMs: params.config.tools.maxToolTimeoutMs ?? 3e5,
     perIterationOutputCapBytes: params.config.tools.perIterationOutputCapBytes,
     tracer: params.tracer,
     logger,
@@ -42726,9 +43542,12 @@ async function main(argv) {
     cacheDir: wpaths.cacheDir
   });
   if (config.features.mcp) {
+    const presets = allServers$1();
     for (const cfg of Object.values(config.mcpServers ?? {})) {
+      const preset = presets[cfg.name];
+      const merged = preset ? { ...preset, ...cfg } : cfg;
       try {
-        await mcpRegistry.start(cfg);
+        await mcpRegistry.start(merged);
       } catch (err) {
         logger.warn(`MCP server "${cfg.name}" failed to start`, err);
       }
@@ -44357,6 +45176,114 @@ Restart WrongStack to load or unload plugin code in this session.`;
     saveStatuslineHiddenItems,
     getPluginItems: getPluginPickerItems,
     onPluginToggle: togglePluginFromPicker,
+    getMcpServers: () => {
+      const servers = config.mcpServers ?? {};
+      const liveStatus = mcpRegistry.list();
+      const liveMap = new Map(liveStatus.map((s) => [s.name, s]));
+      return Object.entries(servers).map(([name, cfg]) => {
+        const live = liveMap.get(name);
+        return {
+          name,
+          enabled: cfg.enabled !== false,
+          status: live ? live.state : "stopped",
+          transport: cfg.transport ?? "stdio",
+          description: cfg.description,
+          toolCount: live?.toolCount ?? 0,
+          lazy: cfg.lazy
+        };
+      });
+    },
+    onMcpToggle: async (name) => {
+      const { enableMcp, disableMcp, listMcp } = await import('@wrongstack/mcp');
+      const deps = { configPath: wpaths.globalConfig, registry: mcpRegistry, presets: allServers$1() };
+      const live = mcpRegistry.list().find((s) => s.name === name);
+      const isCurrentlyEnabled = live !== void 0 && live.state !== "idle";
+      const result = isCurrentlyEnabled ? await disableMcp(name, deps) : await enableMcp(name, deps);
+      const items = await listMcp(deps);
+      return {
+        items: items.map((s) => ({ name: s.name, enabled: s.enabled, status: s.status, transport: s.transport, description: s.description, toolCount: s.tools.length, lazy: s.lazy })),
+        message: result.ok ? result.server ? `${result.server.status === "connected" ? "\u25CF" : "\u25CB"} ${name}` : result.message : void 0,
+        error: result.ok ? void 0 : result.message
+      };
+    },
+    onMcpRestart: async (name) => {
+      const { listMcp } = await import('@wrongstack/mcp');
+      const deps = { configPath: wpaths.globalConfig, registry: mcpRegistry, presets: allServers$1() };
+      try {
+        await mcpRegistry.restart(name);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const items2 = await listMcp(deps);
+        return { items: items2.map((s) => ({ name: s.name, enabled: s.enabled, status: s.status, transport: s.transport, description: s.description, toolCount: s.tools.length, lazy: s.lazy })), message: void 0, error: message };
+      }
+      const items = await listMcp(deps);
+      return { items: items.map((s) => ({ name: s.name, enabled: s.enabled, status: s.status, transport: s.transport, description: s.description, toolCount: s.tools.length, lazy: s.lazy })), message: `Restarted "${name}".`, error: void 0 };
+    },
+    getToolsItems: () => {
+      const all = toolRegistry.listWithOwner().map(({ tool, owner }) => {
+        const descMode = getToolDescriptionMode(toolRegistry, tool.name);
+        return {
+          name: tool.name,
+          owner,
+          category: tool.category ?? "Other",
+          enabled: !toolRegistry.isDisabled(tool.name),
+          mutating: tool.mutating,
+          permission: tool.permission,
+          descMode,
+          description: tool.description
+        };
+      });
+      return all;
+    },
+    onToolToggle: async (name) => {
+      const disabled = new Set(config.tools?.disabledTools ?? []);
+      const isCurrentlyDisabled = toolRegistry.isDisabled(name);
+      if (isCurrentlyDisabled) {
+        toolRegistry.enable(name);
+        disabled.delete(name);
+      } else {
+        toolRegistry.disable(name);
+        disabled.add(name);
+      }
+      const nextTools = { ...config.tools ?? {}, disabledTools: Array.from(disabled) };
+      config = patchConfig(config, { tools: nextTools });
+      configStore.update({ tools: nextTools });
+      const items = toolRegistry.listWithOwner().map(({ tool, owner }) => ({
+        name: tool.name,
+        owner,
+        category: tool.category ?? "Other",
+        enabled: !toolRegistry.isDisabled(tool.name),
+        mutating: tool.mutating,
+        permission: tool.permission,
+        descMode: getToolDescriptionMode(toolRegistry, tool.name),
+        description: tool.description
+      }));
+      return {
+        items,
+        message: isCurrentlyDisabled ? `Enabled "${name}".` : `Disabled "${name}".`,
+        error: void 0
+      };
+    },
+    getBrainData: () => {
+      const ceiling = brainSettings?.maxAutoRisk ?? "medium";
+      const log = brainLog.slice(-20).map((entry) => ({
+        kind: entry.kind,
+        question: entry.question,
+        outcome: entry.outcome,
+        age: typeof entry.at === "number" ? (() => {
+          const s = Math.max(0, Math.round((Date.now() - entry.at) / 1e3));
+          if (s < 60) return `${s}s`;
+          if (s < 3600) return `${Math.round(s / 60)}m`;
+          return `${Math.round(s / 3600)}h`;
+        })() : ""
+      }));
+      return { riskLevel: ceiling, log };
+    },
+    onBrainRiskLevel: (level) => {
+      if (!brainSettings) return "Brain settings not available.";
+      brainSettings.maxAutoRisk = level;
+      return void 0;
+    },
     // Interactive /auth panel host — provider/key CRUD, catalog/local adds
     // and OAuth sign-in, all executed CLI-side against the encrypted config
     // (secrets never enter the TUI; key values arrive pre-masked).