@wrongstack/cli 0.295.1 → 0.296.2

package/dist/chunk-OP47B3IX.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/hq-command-controller.ts"],
+  "sourcesContent": ["/**\n * HQ command controller \u2014 the client-side dispatch surface for Phase 4 of the\n * HQ command center. A mutable holder (mirroring the established\n * `interruptController` pattern in cli-main.ts) that the `onCommand` handler\n * on the HQ publisher reads lazily, because several of its targets\n * (`director`, the rebound `interruptLeader`) are not yet defined at HQ-connect\n * time.\n *\n * The five command types route through the agent's own decision loop or the\n * project mailbox, so they inherit existing guardrails. `run-command` (raw\n * shell) is deliberately NOT wired here \u2014 it requires a separately-audited\n * escalation policy (operator flag + per-token `control.execute` + allowlist)\n * and is left as a stub that rejects until that policy exists.\n *\n * @module hq-command-controller\n */\nimport type { HqPublisherCommandResult } from '@wrongstack/core/hq';\nimport type { RemoteMailbox } from '@wrongstack/core/coordination';\nimport type { HqCommand } from '@wrongstack/core/hq';\n\n/**\n * Mutable holder for the command dispatch targets. Each field is populated\n * lazily as the corresponding subsystem comes online (director on\n * `onDirectorReady`, interruptLeader rebound by the REPL/TUI, \u2026). The\n * `onCommand` handler reads these at dispatch time, not at construction.\n */\nexport interface HqCommandController {\n  /** Project mailbox used to deliver steer/broadcast messages. */\n  steerMailbox?: RemoteMailbox | undefined;\n  /** Abort the session leader's running Agent.run(). Returns true if a run was aborted. */\n  interruptLeader: () => boolean;\n  /** Terminate a specific subagent by id. Returns true if terminated. */\n  terminateAgent?: (subagentId: string) => boolean | Promise<boolean>;\n  /** Stop the entire fleet (all running/idle subagents). Returns kill count. */\n  killFleet?: () => number | Promise<number>;\n  /** Spawn a subagent of the given role. Returns the new subagentId. */\n  spawnAgent?: (role: string, task?: string, maxIterations?: number) => Promise<string>;\n  /** Derive the session-unique mailbox tag for addressing (e.g. `leader@<tag>`). */\n  sessionTag: () => string;\n  /** Whether raw shell execution is explicitly opted-in by the operator. */\n  allowRunCommand: () => boolean;\n}\n\n/**\n * Build the `onCommand` handler for an HQ publisher. The handler validates\n * the command, dispatches through the controller, and returns an ack result\n * (or throws to produce a `failed` ack \u2014 the publisher's `handleCommandBatch`\n * wraps it). Best-effort: a dispatch failure never breaks the host.\n */\nexport function createHqCommandDispatcher(\n  controller: HqCommandController,\n): (command: { commandId: string; type: string; payload: unknown }) => Promise<HqPublisherCommandResult> {\n  return async (command) => {\n    const cmd = command as { commandId: string; type: string; payload: Record<string, unknown> };\n    try {\n      const result = await dispatch(controller, cmd.commandId, cmd.type as HqCommand['type'], cmd.payload);\n      return result;\n    } catch (err) {\n      return {\n        commandId: command.commandId,\n        status: 'failed',\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  };\n}\n\nasync function dispatch(\n  controller: HqCommandController,\n  commandId: string,\n  type: HqCommand['type'],\n  payload: Record<string, unknown>,\n): Promise<HqPublisherCommandResult> {\n  switch (type) {\n    case 'steer': {\n      const mailbox = controller.steerMailbox;\n      if (mailbox === undefined) {\n        return { commandId, status: 'rejected', message: 'no mailbox available' };\n      }\n      const to = typeof payload['to'] === 'string' ? payload['to'] : 'leader';\n      const subject = typeof payload['subject'] === 'string' ? payload['subject'] : 'HQ steer';\n      const body = typeof payload['body'] === 'string' ? payload['body'] : '';\n      const priority = payload['priority'] === 'high' ? 'high' : payload['priority'] === 'low' ? 'low' : 'normal';\n      const from = `hq@${controller.sessionTag()}`;\n      await mailbox.send({ from, to, type: 'steer', subject, body, priority });\n      return { commandId, status: 'accepted', message: `steered ${to}` };\n    }\n\n    case 'btw': {\n      // Non-urgent FYI. Same targeting as steer, but delivered as a `btw`\n      // mailbox message so the receiving agent absorbs it as context instead\n      // of treating it as a course-correction. Lands in the mailbox file\n      // regardless of whether a loop is currently running.\n      const mailbox = controller.steerMailbox;\n      if (mailbox === undefined) {\n        return { commandId, status: 'rejected', message: 'no mailbox available' };\n      }\n      const to = typeof payload['to'] === 'string' ? payload['to'] : 'leader';\n      const subject = typeof payload['subject'] === 'string' ? payload['subject'] : 'HQ note';\n      const body = typeof payload['body'] === 'string' ? payload['body'] : '';\n      const priority = payload['priority'] === 'high' ? 'high' : payload['priority'] === 'low' ? 'low' : 'normal';\n      const from = `hq@${controller.sessionTag()}`;\n      await mailbox.send({ from, to, type: 'btw', subject, body, priority });\n      return { commandId, status: 'accepted', message: `noted ${to}` };\n    }\n\n    case 'queue': {\n      // Queue a prompt/note for the target. Delivered as a plain `note` the\n      // agent picks up before its next step \u2014 used when the prompt should\n      // wait its turn rather than steer the current operation. Like steer/btw,\n      // this only writes to the mailbox; no live loop is required.\n      const mailbox = controller.steerMailbox;\n      if (mailbox === undefined) {\n        return { commandId, status: 'rejected', message: 'no mailbox available' };\n      }\n      const to = typeof payload['to'] === 'string' ? payload['to'] : 'leader';\n      const subject = typeof payload['subject'] === 'string' ? payload['subject'] : 'HQ prompt';\n      const body = typeof payload['body'] === 'string' ? payload['body'] : '';\n      const priority = payload['priority'] === 'high' ? 'high' : payload['priority'] === 'low' ? 'low' : 'normal';\n      const from = `hq@${controller.sessionTag()}`;\n      await mailbox.send({ from, to, type: 'note', subject, body, priority });\n      return { commandId, status: 'accepted', message: `queued for ${to}` };\n    }\n\n    case 'broadcast': {\n      const mailbox = controller.steerMailbox;\n      if (mailbox === undefined) {\n        return { commandId, status: 'rejected', message: 'no mailbox available' };\n      }\n      const subject = typeof payload['subject'] === 'string' ? payload['subject'] : 'HQ broadcast';\n      const body = typeof payload['body'] === 'string' ? payload['body'] : '';\n      const priority = payload['priority'] === 'high' ? 'high' : payload['priority'] === 'low' ? 'low' : 'normal';\n      const from = `hq@${controller.sessionTag()}`;\n      await mailbox.send({ from, to: 'all', type: 'broadcast', subject, body, priority });\n      return { commandId, status: 'accepted', message: 'broadcast sent' };\n    }\n\n    case 'abort': {\n      const target = typeof payload['target'] === 'string' ? payload['target'] : 'leader';\n      if (target === 'leader') {\n        const aborted = controller.interruptLeader();\n        return {\n          commandId,\n          status: aborted ? 'completed' : 'accepted',\n          message: aborted ? 'leader aborted' : 'no active leader run',\n        };\n      }\n      if (target === 'fleet') {\n        const killed = (await controller.killFleet?.()) ?? 0;\n        return {\n          commandId,\n          status: 'completed',\n          message: `fleet stopped (${killed} agents)`,\n        };\n      }\n      // Specific subagent id.\n      const terminated = (await controller.terminateAgent?.(target)) ?? false;\n      return {\n        commandId,\n        status: terminated ? 'completed' : 'rejected',\n        message: terminated ? `agent ${target} terminated` : `agent ${target} not found`,\n      };\n    }\n\n    case 'spawn': {\n      const role = typeof payload['role'] === 'string' ? payload['role'] : '';\n      const task = typeof payload['task'] === 'string' ? payload['task'] : undefined;\n      const maxIterations = typeof payload['maxIterations'] === 'number' ? payload['maxIterations'] : undefined;\n      if (controller.spawnAgent === undefined) {\n        return { commandId, status: 'rejected', message: 'no director active' };\n      }\n      const subagentId = await controller.spawnAgent(role, task, maxIterations);\n      return { commandId, status: 'completed', message: `spawned ${subagentId}` };\n    }\n\n    case 'run-command': {\n      // RCE gate: require explicit operator opt-in. Without it, reject every\n      // run-command so a stolen client token can never gain shell access.\n      if (!controller.allowRunCommand()) {\n        return {\n          commandId,\n          status: 'rejected',\n          message: 'run-command requires operator opt-in (--hq-allow-exec)',\n        };\n      }\n      // Even with opt-in, we do NOT exec shell directly \u2014 we route through the\n      // agent as a steer so the agent's own permission policy still applies.\n      // A full direct-exec path is deferred until a separately-audited\n      // escalation policy + allowlist exists.\n      const mailbox = controller.steerMailbox;\n      const command = typeof payload['command'] === 'string' ? payload['command'] : '';\n      if (mailbox !== undefined && command.length > 0) {\n        const from = `hq@${controller.sessionTag()}`;\n        await mailbox.send({\n          from,\n          to: 'leader',\n          type: 'steer',\n          subject: 'Run command (HQ)',\n          body: `Run the following shell command:\\n\\n\\`\\`\\`\\n${command}\\n\\`\\`\\``,\n          priority: 'high',\n        });\n        return { commandId, status: 'accepted', message: 'run-command routed to leader as steer' };\n      }\n      return { commandId, status: 'rejected', message: 'cannot route run-command (no mailbox)' };\n    }\n\n    default:\n      return { commandId, status: 'rejected', message: `unknown command type: ${type}` };\n  }\n}\n"],
+  "mappings": ";;;AAiDO,SAAS,0BACd,YACuG;AACvG,SAAO,OAAO,YAAY;AACxB,UAAM,MAAM;AACZ,QAAI;AACF,YAAM,SAAS,MAAM,SAAS,YAAY,IAAI,WAAW,IAAI,MAA2B,IAAI,OAAO;AACnG,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,WAAW,QAAQ;AAAA,QACnB,QAAQ;AAAA,QACR,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,SACb,YACA,WACA,MACA,SACmC;AACnC,UAAQ,MAAM;AAAA,IACZ,KAAK,SAAS;AACZ,YAAM,UAAU,WAAW;AAC3B,UAAI,YAAY,QAAW;AACzB,eAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,uBAAuB;AAAA,MAC1E;AACA,YAAM,KAAK,OAAO,QAAQ,IAAI,MAAM,WAAW,QAAQ,IAAI,IAAI;AAC/D,YAAM,UAAU,OAAO,QAAQ,SAAS,MAAM,WAAW,QAAQ,SAAS,IAAI;AAC9E,YAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,WAAW,QAAQ,MAAM,IAAI;AACrE,YAAM,WAAW,QAAQ,UAAU,MAAM,SAAS,SAAS,QAAQ,UAAU,MAAM,QAAQ,QAAQ;AACnG,YAAM,OAAO,MAAM,WAAW,WAAW,CAAC;AAC1C,YAAM,QAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,SAAS,SAAS,MAAM,SAAS,CAAC;AACvE,aAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,WAAW,EAAE,GAAG;AAAA,IACnE;AAAA,IAEA,KAAK,OAAO;AAKV,YAAM,UAAU,WAAW;AAC3B,UAAI,YAAY,QAAW;AACzB,eAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,uBAAuB;AAAA,MAC1E;AACA,YAAM,KAAK,OAAO,QAAQ,IAAI,MAAM,WAAW,QAAQ,IAAI,IAAI;AAC/D,YAAM,UAAU,OAAO,QAAQ,SAAS,MAAM,WAAW,QAAQ,SAAS,IAAI;AAC9E,YAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,WAAW,QAAQ,MAAM,IAAI;AACrE,YAAM,WAAW,QAAQ,UAAU,MAAM,SAAS,SAAS,QAAQ,UAAU,MAAM,QAAQ,QAAQ;AACnG,YAAM,OAAO,MAAM,WAAW,WAAW,CAAC;AAC1C,YAAM,QAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,OAAO,SAAS,MAAM,SAAS,CAAC;AACrE,aAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,SAAS,EAAE,GAAG;AAAA,IACjE;AAAA,IAEA,KAAK,SAAS;AAKZ,YAAM,UAAU,WAAW;AAC3B,UAAI,YAAY,QAAW;AACzB,eAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,uBAAuB;AAAA,MAC1E;AACA,YAAM,KAAK,OAAO,QAAQ,IAAI,MAAM,WAAW,QAAQ,IAAI,IAAI;AAC/D,YAAM,UAAU,OAAO,QAAQ,SAAS,MAAM,WAAW,QAAQ,SAAS,IAAI;AAC9E,YAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,WAAW,QAAQ,MAAM,IAAI;AACrE,YAAM,WAAW,QAAQ,UAAU,MAAM,SAAS,SAAS,QAAQ,UAAU,MAAM,QAAQ,QAAQ;AACnG,YAAM,OAAO,MAAM,WAAW,WAAW,CAAC;AAC1C,YAAM,QAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,QAAQ,SAAS,MAAM,SAAS,CAAC;AACtE,aAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,cAAc,EAAE,GAAG;AAAA,IACtE;AAAA,IAEA,KAAK,aAAa;AAChB,YAAM,UAAU,WAAW;AAC3B,UAAI,YAAY,QAAW;AACzB,eAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,uBAAuB;AAAA,MAC1E;AACA,YAAM,UAAU,OAAO,QAAQ,SAAS,MAAM,WAAW,QAAQ,SAAS,IAAI;AAC9E,YAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,WAAW,QAAQ,MAAM,IAAI;AACrE,YAAM,WAAW,QAAQ,UAAU,MAAM,SAAS,SAAS,QAAQ,UAAU,MAAM,QAAQ,QAAQ;AACnG,YAAM,OAAO,MAAM,WAAW,WAAW,CAAC;AAC1C,YAAM,QAAQ,KAAK,EAAE,MAAM,IAAI,OAAO,MAAM,aAAa,SAAS,MAAM,SAAS,CAAC;AAClF,aAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,iBAAiB;AAAA,IACpE;AAAA,IAEA,KAAK,SAAS;AACZ,YAAM,SAAS,OAAO,QAAQ,QAAQ,MAAM,WAAW,QAAQ,QAAQ,IAAI;AAC3E,UAAI,WAAW,UAAU;AACvB,cAAM,UAAU,WAAW,gBAAgB;AAC3C,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,UAAU,cAAc;AAAA,UAChC,SAAS,UAAU,mBAAmB;AAAA,QACxC;AAAA,MACF;AACA,UAAI,WAAW,SAAS;AACtB,cAAM,SAAU,MAAM,WAAW,YAAY,KAAM;AACnD,eAAO;AAAA,UACL;AAAA,UACA,QAAQ;AAAA,UACR,SAAS,kBAAkB,MAAM;AAAA,QACnC;AAAA,MACF;AAEA,YAAM,aAAc,MAAM,WAAW,iBAAiB,MAAM,KAAM;AAClE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ,aAAa,cAAc;AAAA,QACnC,SAAS,aAAa,SAAS,MAAM,gBAAgB,SAAS,MAAM;AAAA,MACtE;AAAA,IACF;AAAA,IAEA,KAAK,SAAS;AACZ,YAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,WAAW,QAAQ,MAAM,IAAI;AACrE,YAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,WAAW,QAAQ,MAAM,IAAI;AACrE,YAAM,gBAAgB,OAAO,QAAQ,eAAe,MAAM,WAAW,QAAQ,eAAe,IAAI;AAChG,UAAI,WAAW,eAAe,QAAW;AACvC,eAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,qBAAqB;AAAA,MACxE;AACA,YAAM,aAAa,MAAM,WAAW,WAAW,MAAM,MAAM,aAAa;AACxE,aAAO,EAAE,WAAW,QAAQ,aAAa,SAAS,WAAW,UAAU,GAAG;AAAA,IAC5E;AAAA,IAEA,KAAK,eAAe;AAGlB,UAAI,CAAC,WAAW,gBAAgB,GAAG;AACjC,eAAO;AAAA,UACL;AAAA,UACA,QAAQ;AAAA,UACR,SAAS;AAAA,QACX;AAAA,MACF;AAKA,YAAM,UAAU,WAAW;AAC3B,YAAM,UAAU,OAAO,QAAQ,SAAS,MAAM,WAAW,QAAQ,SAAS,IAAI;AAC9E,UAAI,YAAY,UAAa,QAAQ,SAAS,GAAG;AAC/C,cAAM,OAAO,MAAM,WAAW,WAAW,CAAC;AAC1C,cAAM,QAAQ,KAAK;AAAA,UACjB;AAAA,UACA,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA;AAAA;AAAA,EAA+C,OAAO;AAAA;AAAA,UAC5D,UAAU;AAAA,QACZ,CAAC;AACD,eAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,wCAAwC;AAAA,MAC3F;AACA,aAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,wCAAwC;AAAA,IAC3F;AAAA,IAEA;AACE,aAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,yBAAyB,IAAI,GAAG;AAAA,EACrF;AACF;",
+  "names": []
+}

package/dist/chunk-PJHET45A.js

@@ -0,0 +1,158 @@
+
+// src/provider-config-utils.ts
+import { expectDefined } from "@wrongstack/core/utils";
+import { FsError } from "@wrongstack/core/types";
+import * as fs from "node:fs/promises";
+import { atomicWrite, color } from "@wrongstack/core/utils";
+import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
+function normalizeKeys(cfg) {
+  if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {
+    return cfg.apiKeys.map((k) => ({ ...k }));
+  }
+  if (typeof cfg.apiKey === "string" && cfg.apiKey.length > 0) {
+    return [{ label: "default", apiKey: cfg.apiKey, createdAt: "" }];
+  }
+  return [];
+}
+function writeKeysBack(cfg, keys) {
+  if (keys.length === 0) {
+    delete cfg.apiKeys;
+    delete cfg.apiKey;
+    delete cfg.activeKey;
+    return;
+  }
+  cfg.apiKeys = keys;
+  const active = keys.find((k) => k.label === cfg.activeKey) ?? expectDefined(keys[0]);
+  delete cfg.apiKey;
+  if (!cfg.activeKey || !keys.some((k) => k.label === cfg.activeKey)) {
+    cfg.activeKey = active.label;
+  }
+}
+function resolveActiveApiKey(cfg) {
+  if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {
+    const active = cfg.activeKey ? cfg.apiKeys.find((k) => k.label === cfg.activeKey) : void 0;
+    return (active ?? cfg.apiKeys[0])?.apiKey;
+  }
+  return cfg.apiKey && cfg.apiKey.length > 0 ? cfg.apiKey : void 0;
+}
+function isLoopbackBaseUrl(baseUrl) {
+  if (!baseUrl) return false;
+  try {
+    let host = new URL(baseUrl).hostname.toLowerCase();
+    host = host.replace(/^\[|\]$/g, "");
+    return host === "localhost" || host === "::1" || host === "0.0.0.0" || /^127\./.test(host);
+  } catch {
+    return false;
+  }
+}
+function providerCanRunWithoutSavedKey(cfg) {
+  return isLoopbackBaseUrl(cfg.baseUrl) && (!cfg.envVars || cfg.envVars.length === 0);
+}
+function hasUsableSavedProvider(cfg) {
+  return resolveActiveApiKey(cfg) !== void 0 || providerCanRunWithoutSavedKey(cfg);
+}
+function clearStaleProviderDefaults(config) {
+  const providerId = typeof config["provider"] === "string" ? config["provider"] : void 0;
+  if (!providerId) return;
+  const providers = config["providers"];
+  const provider = providers?.[providerId];
+  if (!provider || !hasUsableSavedProvider(provider)) {
+    delete config["provider"];
+    delete config["model"];
+    return;
+  }
+  const modelId = typeof config["model"] === "string" ? config["model"] : void 0;
+  if (modelId && Array.isArray(provider.models) && provider.models.length > 0 && !provider.models.includes(modelId)) {
+    delete config["model"];
+  }
+}
+function activeLabel(cfg, keys) {
+  if (cfg.activeKey && keys.some((k) => k.label === cfg.activeKey)) return cfg.activeKey;
+  return keys[0]?.label;
+}
+function maskedKey(key) {
+  if (!key) return color.dim("\u2014");
+  if (key.length <= 8) return color.dim("\u2022".repeat(key.length));
+  const head = key.slice(0, 4);
+  const tail = key.slice(-4);
+  return `${color.dim(head + "\u2026")}${tail}`;
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+async function loadConfigProviders(configPath, vault, opts) {
+  const warn = opts?.warn;
+  const targetPath = opts?.profileConfigPath ?? configPath;
+  let raw;
+  try {
+    raw = await fs.readFile(targetPath, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      warn?.(`Could not read ${targetPath}: ${err.message}. Treating as empty.`);
+    }
+    return {};
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    warn?.(`Config at ${targetPath} is not valid JSON: ${err.message}`);
+    return {};
+  }
+  const decrypted = decryptConfigSecrets(parsed, vault);
+  return decrypted.providers ?? {};
+}
+async function mutateConfigProviders(configPath, vault, mutator, profileConfigPath) {
+  const targetPath = profileConfigPath ?? configPath;
+  let raw;
+  let fileExists = true;
+  try {
+    raw = await fs.readFile(targetPath, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      throw new FsError({
+        message: `Refusing to mutate ${configPath}: ${err.message}`,
+        code: "FS_READ_FAILED",
+        path: targetPath,
+        context: { operation: "mutateConfigProviders", phase: "read" },
+        cause: err
+      });
+    }
+    fileExists = false;
+    raw = "{}";
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    if (fileExists) {
+      throw new FsError({
+        message: `Refusing to overwrite corrupt config at ${targetPath} (${err.message}). Fix or move the file aside before retrying.`,
+        code: "FS_READ_FAILED",
+        path: targetPath,
+        context: { operation: "mutateConfigProviders", phase: "parse" },
+        cause: err
+      });
+    }
+    parsed = {};
+  }
+  const decrypted = decryptConfigSecrets(parsed, vault);
+  const providers = decrypted.providers ?? {};
+  mutator(providers);
+  decrypted.providers = providers;
+  clearStaleProviderDefaults(decrypted);
+  const encrypted = encryptConfigSecrets(decrypted, vault);
+  await atomicWrite(targetPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+}
+
+export {
+  normalizeKeys,
+  writeKeysBack,
+  resolveActiveApiKey,
+  activeLabel,
+  maskedKey,
+  nowIso,
+  loadConfigProviders,
+  mutateConfigProviders
+};
+//# sourceMappingURL=chunk-PJHET45A.js.map

package/dist/chunk-PJHET45A.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/provider-config-utils.ts"],
+  "sourcesContent": ["import { expectDefined } from '@wrongstack/core/utils';\nimport { FsError } from '@wrongstack/core/types';\n\nexport { expectDefined };\n\n/**\n * Pure helpers for ProviderConfig shape normalisation, key masking, and\n * timestamp generation \u2014 plus config file I/O (load/mutate providers).\n * Shared between auth-menu.ts, webui-server.ts, and any future code that\n * touches the config `providers` map.\n */\nimport * as fs from 'node:fs/promises';\nimport type { ProviderApiKey, ProviderConfig, SecretVault } from '@wrongstack/core/types';\nimport { atomicWrite, color } from '@wrongstack/core/utils';\nimport { decryptConfigSecrets, encryptConfigSecrets } from '@wrongstack/core/security';\n/**\n * Normalize a ProviderConfig to the canonical `apiKeys[]` form.\n * Migrates the legacy single-key `apiKey` field on the fly so every\n * consumer sees a uniform shape. Does NOT mutate the input.\n */\nexport function normalizeKeys(cfg: ProviderConfig): ProviderApiKey[] {\n  if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {\n    return cfg.apiKeys.map((k) => ({ ...k }));\n  }\n  if (typeof cfg.apiKey === 'string' && cfg.apiKey.length > 0) {\n    return [{ label: 'default', apiKey: cfg.apiKey, createdAt: '' }];\n  }\n  return [];\n}\n\n/**\n * Write a normalized key list back into a ProviderConfig. Does NOT mirror\n * the plaintext key to the legacy `apiKey` field \u2014 that would leak the\n * secret on any accidental JSON.stringify of the config. Consumers that\n * need the real key must call {@link resolveActiveApiKey}.\n */\nexport function writeKeysBack(cfg: ProviderConfig, keys: ProviderApiKey[]): void {\n  if (keys.length === 0) {\n    delete cfg.apiKeys;\n    delete cfg.apiKey;\n    delete cfg.activeKey;\n    return;\n  }\n  cfg.apiKeys = keys;\n  const active = keys.find((k) => k.label === cfg.activeKey) ?? expectDefined(keys[0]);\n  // Do NOT mirror plaintext to cfg.apiKey \u2014 the legacy field is cleared so\n  // that accidental serialization (logging, error messages, WS payloads)\n  // cannot leak the active key. Use resolveActiveApiKey() to read the real key.\n  delete cfg.apiKey;\n  if (!cfg.activeKey || !keys.some((k) => k.label === cfg.activeKey)) {\n    cfg.activeKey = active.label;\n  }\n}\n\n/**\n * Extract the active (decrypted) API key from a ProviderConfig.\n *\n * Resolution order:\n *   1. `apiKeys[]` \u2014 pick the entry matching `activeKey`, or the first one\n *   2. Legacy `apiKey` field \u2014 only for configs not yet migrated to multi-key\n *\n * This is the **preferred** way to read the API key. Never read `cfg.apiKey`\n * directly in new code \u2014 after {@link writeKeysBack} it is cleared, and even\n * when present on a freshly-loaded config it may contain a masked value.\n */\nexport function resolveActiveApiKey(cfg: ProviderConfig): string | undefined {\n  if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {\n    const active = cfg.activeKey\n      ? cfg.apiKeys.find((k) => k.label === cfg.activeKey)\n      : undefined;\n    return (active ?? cfg.apiKeys[0])?.apiKey;\n  }\n  return cfg.apiKey && cfg.apiKey.length > 0 ? cfg.apiKey : undefined;\n}\n\nfunction isLoopbackBaseUrl(baseUrl: string | undefined): boolean {\n  if (!baseUrl) return false;\n  try {\n    let host = new URL(baseUrl).hostname.toLowerCase();\n    host = host.replace(/^\\[|\\]$/g, '');\n    return host === 'localhost' || host === '::1' || host === '0.0.0.0' || /^127\\./.test(host);\n  } catch {\n    return false;\n  }\n}\n\nfunction providerCanRunWithoutSavedKey(cfg: ProviderConfig): boolean {\n  return isLoopbackBaseUrl(cfg.baseUrl) && (!cfg.envVars || cfg.envVars.length === 0);\n}\n\nfunction hasUsableSavedProvider(cfg: ProviderConfig): boolean {\n  return resolveActiveApiKey(cfg) !== undefined || providerCanRunWithoutSavedKey(cfg);\n}\n\n/**\n * Clear top-level provider/model defaults when provider mutations make them\n * stale. This prevents a removed provider, deleted final key, or edited model\n * allowlist from being accepted on the next boot and crashing provider setup.\n */\nexport function clearStaleProviderDefaults(config: Record<string, unknown>): void {\n  const providerId = typeof config['provider'] === 'string' ? config['provider'] : undefined;\n  if (!providerId) return;\n  const providers = config['providers'] as Record<string, ProviderConfig> | undefined;\n  const provider = providers?.[providerId];\n  if (!provider || !hasUsableSavedProvider(provider)) {\n    delete config['provider'];\n    delete config['model'];\n    return;\n  }\n  const modelId = typeof config['model'] === 'string' ? config['model'] : undefined;\n  if (modelId && Array.isArray(provider.models) && provider.models.length > 0 && !provider.models.includes(modelId)) {\n    delete config['model'];\n  }\n}\n\n/**\n * Return the label of the active key, or the first key's label if no\n * active is pinned. Returns `undefined` when there are no keys at all.\n */\nexport function activeLabel(cfg: ProviderConfig, keys: ProviderApiKey[]): string | undefined {\n  if (cfg.activeKey && keys.some((k) => k.label === cfg.activeKey)) return cfg.activeKey;\n  return keys[0]?.label;\n}\n\n/** Mask an API key for display: show first 4 + last 4 chars. */\nexport function maskedKey(key: string): string {\n  if (!key) return color.dim('\u2014');\n  if (key.length <= 8) return color.dim('\u2022'.repeat(key.length));\n  const head = key.slice(0, 4);\n  const tail = key.slice(-4);\n  return `${color.dim(head + '\u2026')}${tail}`;\n}\n\n/** ISO-8601 timestamp for key `createdAt` fields. */\nexport function nowIso(): string {\n  return new Date().toISOString();\n}\n\n/* ------------------------------------------------------------------ */\n/*  Config file I/O \u2014 load / mutate `providers` atomically            */\n/* ------------------------------------------------------------------ */\n\n/**\n * Read the on-disk config file and return its `providers` map, fully\n * decrypted. Returns `{}` on ENOENT or corrupt JSON (surfacing the error\n * via the optional `warn` callback when provided).\n */\nexport async function loadConfigProviders(\n  configPath: string,\n  vault: SecretVault,\n  opts?: { warn?: (msg: string) => void; profileConfigPath?: string },\n): Promise<Record<string, ProviderConfig>> {\n  const warn = opts?.warn;\n  const targetPath = opts?.profileConfigPath ?? configPath;\n  let raw: string;\n  try {\n    raw = await fs.readFile(targetPath, 'utf8');\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') {\n      warn?.(`Could not read ${targetPath}: ${(err as Error).message}. Treating as empty.`);\n    }\n    return {};\n  }\n  let parsed: Record<string, unknown>;\n  try {\n    parsed = JSON.parse(raw) as Record<string, unknown>;\n  } catch (err) {\n    warn?.(`Config at ${targetPath} is not valid JSON: ${(err as Error).message}`);\n    return {};\n  }\n  const decrypted = decryptConfigSecrets(parsed, vault);\n  return (decrypted as { providers?: Record<string, ProviderConfig> }).providers ?? {};\n}\n\n/**\n * Load \u2192 mutate \u2192 encrypt \u2192 atomic-write. Operates on the FULL config file\n * so non-provider keys are preserved. Refuses to overwrite a corrupt-but-\n * existing config (the user may still have salvageable data).\n */\nexport async function mutateConfigProviders(\n  configPath: string,\n  vault: SecretVault,\n  mutator: (providers: Record<string, ProviderConfig>) => void,\n  profileConfigPath?: string,\n): Promise<void> {\n  const targetPath = profileConfigPath ?? configPath;\n  let raw: string;\n  let fileExists = true;\n  try {\n    raw = await fs.readFile(targetPath, 'utf8');\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') {\n      throw new FsError({\n        message: `Refusing to mutate ${configPath}: ${(err as Error).message}`,\n        code: 'FS_READ_FAILED',\n        path: targetPath,\n        context: { operation: 'mutateConfigProviders', phase: 'read' },\n        cause: err,\n      });\n    }\n    fileExists = false;\n    raw = '{}';\n  }\n  let parsed: Record<string, unknown>;\n  try {\n    parsed = JSON.parse(raw) as Record<string, unknown>;\n  } catch (err) {\n    if (fileExists) {\n      throw new FsError({\n        message:\n          `Refusing to overwrite corrupt config at ${targetPath} ` +\n          `(${(err as Error).message}). Fix or move the file aside before retrying.`,\n        code: 'FS_READ_FAILED',\n        path: targetPath,\n        context: { operation: 'mutateConfigProviders', phase: 'parse' },\n        cause: err,\n      });\n    }\n    parsed = {};\n  }\n  const decrypted = decryptConfigSecrets(parsed, vault) as Record<string, unknown>;\n  const providers = (decrypted.providers as Record<string, ProviderConfig>) ?? {};\n  mutator(providers);\n  decrypted.providers = providers;\n  clearStaleProviderDefaults(decrypted);\n  const encrypted = encryptConfigSecrets(decrypted, vault);\n  await atomicWrite(targetPath, JSON.stringify(encrypted, null, 2), { mode: 0o600 });\n}\n"],
+  "mappings": ";;;AAAA,SAAS,qBAAqB;AAC9B,SAAS,eAAe;AAUxB,YAAY,QAAQ;AAEpB,SAAS,aAAa,aAAa;AACnC,SAAS,sBAAsB,4BAA4B;AAMpD,SAAS,cAAc,KAAuC;AACnE,MAAI,MAAM,QAAQ,IAAI,OAAO,KAAK,IAAI,QAAQ,SAAS,GAAG;AACxD,WAAO,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;AAAA,EAC1C;AACA,MAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,SAAS,GAAG;AAC3D,WAAO,CAAC,EAAE,OAAO,WAAW,QAAQ,IAAI,QAAQ,WAAW,GAAG,CAAC;AAAA,EACjE;AACA,SAAO,CAAC;AACV;AAQO,SAAS,cAAc,KAAqB,MAA8B;AAC/E,MAAI,KAAK,WAAW,GAAG;AACrB,WAAO,IAAI;AACX,WAAO,IAAI;AACX,WAAO,IAAI;AACX;AAAA,EACF;AACA,MAAI,UAAU;AACd,QAAM,SAAS,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,SAAS,KAAK,cAAc,KAAK,CAAC,CAAC;AAInF,SAAO,IAAI;AACX,MAAI,CAAC,IAAI,aAAa,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,SAAS,GAAG;AAClE,QAAI,YAAY,OAAO;AAAA,EACzB;AACF;AAaO,SAAS,oBAAoB,KAAyC;AAC3E,MAAI,MAAM,QAAQ,IAAI,OAAO,KAAK,IAAI,QAAQ,SAAS,GAAG;AACxD,UAAM,SAAS,IAAI,YACf,IAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,SAAS,IACjD;AACJ,YAAQ,UAAU,IAAI,QAAQ,CAAC,IAAI;AAAA,EACrC;AACA,SAAO,IAAI,UAAU,IAAI,OAAO,SAAS,IAAI,IAAI,SAAS;AAC5D;AAEA,SAAS,kBAAkB,SAAsC;AAC/D,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,QAAI,OAAO,IAAI,IAAI,OAAO,EAAE,SAAS,YAAY;AACjD,WAAO,KAAK,QAAQ,YAAY,EAAE;AAClC,WAAO,SAAS,eAAe,SAAS,SAAS,SAAS,aAAa,SAAS,KAAK,IAAI;AAAA,EAC3F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,8BAA8B,KAA8B;AACnE,SAAO,kBAAkB,IAAI,OAAO,MAAM,CAAC,IAAI,WAAW,IAAI,QAAQ,WAAW;AACnF;AAEA,SAAS,uBAAuB,KAA8B;AAC5D,SAAO,oBAAoB,GAAG,MAAM,UAAa,8BAA8B,GAAG;AACpF;AAOO,SAAS,2BAA2B,QAAuC;AAChF,QAAM,aAAa,OAAO,OAAO,UAAU,MAAM,WAAW,OAAO,UAAU,IAAI;AACjF,MAAI,CAAC,WAAY;AACjB,QAAM,YAAY,OAAO,WAAW;AACpC,QAAM,WAAW,YAAY,UAAU;AACvC,MAAI,CAAC,YAAY,CAAC,uBAAuB,QAAQ,GAAG;AAClD,WAAO,OAAO,UAAU;AACxB,WAAO,OAAO,OAAO;AACrB;AAAA,EACF;AACA,QAAM,UAAU,OAAO,OAAO,OAAO,MAAM,WAAW,OAAO,OAAO,IAAI;AACxE,MAAI,WAAW,MAAM,QAAQ,SAAS,MAAM,KAAK,SAAS,OAAO,SAAS,KAAK,CAAC,SAAS,OAAO,SAAS,OAAO,GAAG;AACjH,WAAO,OAAO,OAAO;AAAA,EACvB;AACF;AAMO,SAAS,YAAY,KAAqB,MAA4C;AAC3F,MAAI,IAAI,aAAa,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,SAAS,EAAG,QAAO,IAAI;AAC7E,SAAO,KAAK,CAAC,GAAG;AAClB;AAGO,SAAS,UAAU,KAAqB;AAC7C,MAAI,CAAC,IAAK,QAAO,MAAM,IAAI,QAAG;AAC9B,MAAI,IAAI,UAAU,EAAG,QAAO,MAAM,IAAI,SAAI,OAAO,IAAI,MAAM,CAAC;AAC5D,QAAM,OAAO,IAAI,MAAM,GAAG,CAAC;AAC3B,QAAM,OAAO,IAAI,MAAM,EAAE;AACzB,SAAO,GAAG,MAAM,IAAI,OAAO,QAAG,CAAC,GAAG,IAAI;AACxC;AAGO,SAAS,SAAiB;AAC/B,UAAO,oBAAI,KAAK,GAAE,YAAY;AAChC;AAWA,eAAsB,oBACpB,YACA,OACA,MACyC;AACzC,QAAM,OAAO,MAAM;AACnB,QAAM,aAAa,MAAM,qBAAqB;AAC9C,MAAI;AACJ,MAAI;AACF,UAAM,MAAS,YAAS,YAAY,MAAM;AAAA,EAC5C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,UAAU;AACpD,aAAO,kBAAkB,UAAU,KAAM,IAAc,OAAO,sBAAsB;AAAA,IACtF;AACA,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,WAAO,aAAa,UAAU,uBAAwB,IAAc,OAAO,EAAE;AAC7E,WAAO,CAAC;AAAA,EACV;AACA,QAAM,YAAY,qBAAqB,QAAQ,KAAK;AACpD,SAAQ,UAA6D,aAAa,CAAC;AACrF;AAOA,eAAsB,sBACpB,YACA,OACA,SACA,mBACe;AACf,QAAM,aAAa,qBAAqB;AACxC,MAAI;AACJ,MAAI,aAAa;AACjB,MAAI;AACF,UAAM,MAAS,YAAS,YAAY,MAAM;AAAA,EAC5C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,UAAU;AACpD,YAAM,IAAI,QAAQ;AAAA,QAChB,SAAS,sBAAsB,UAAU,KAAM,IAAc,OAAO;AAAA,QACpE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,EAAE,WAAW,yBAAyB,OAAO,OAAO;AAAA,QAC7D,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,iBAAa;AACb,UAAM;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,QAAI,YAAY;AACd,YAAM,IAAI,QAAQ;AAAA,QAChB,SACE,2CAA2C,UAAU,KAChD,IAAc,OAAO;AAAA,QAC5B,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,EAAE,WAAW,yBAAyB,OAAO,QAAQ;AAAA,QAC9D,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,aAAS,CAAC;AAAA,EACZ;AACA,QAAM,YAAY,qBAAqB,QAAQ,KAAK;AACpD,QAAM,YAAa,UAAU,aAAgD,CAAC;AAC9E,UAAQ,SAAS;AACjB,YAAU,YAAY;AACtB,6BAA2B,SAAS;AACpC,QAAM,YAAY,qBAAqB,WAAW,KAAK;AACvD,QAAM,YAAY,YAAY,KAAK,UAAU,WAAW,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACnF;",
+  "names": []
+}

package/dist/chunk-Q5GTM25S.js

@@ -0,0 +1,17 @@
+
+// src/hq-server/audit-actor.ts
+import * as os from "node:os";
+function resolveAuditActor() {
+  const user = (process.env.USERNAME ?? process.env.USER ?? "").toString();
+  try {
+    const host = os.hostname();
+    return user ? `${user}@${host}` : `cli@${host}`;
+  } catch {
+    return user ? `${user}@unknown` : "cli";
+  }
+}
+
+export {
+  resolveAuditActor
+};
+//# sourceMappingURL=chunk-Q5GTM25S.js.map

package/dist/chunk-Q5GTM25S.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/hq-server/audit-actor.ts"],
+  "sourcesContent": ["import * as os from 'node:os';\n\n/** Build the non-secret actor label used by HQ authentication audit entries. */\nexport function resolveAuditActor(): string {\n  const user = (process.env.USERNAME ?? process.env.USER ?? '').toString();\n  try {\n    const host = os.hostname();\n    return user ? `${user}@${host}` : `cli@${host}`;\n  } catch {\n    return user ? `${user}@unknown` : 'cli';\n  }\n}\n"],
+  "mappings": ";;;AAAA,YAAY,QAAQ;AAGb,SAAS,oBAA4B;AAC1C,QAAM,QAAQ,QAAQ,IAAI,YAAY,QAAQ,IAAI,QAAQ,IAAI,SAAS;AACvE,MAAI;AACF,UAAM,OAAU,YAAS;AACzB,WAAO,OAAO,GAAG,IAAI,IAAI,IAAI,KAAK,OAAO,IAAI;AAAA,EAC/C,QAAQ;AACN,WAAO,OAAO,GAAG,IAAI,aAAa;AAAA,EACpC;AACF;",
+  "names": []
+}

package/dist/chunk-QD544J2B.js

@@ -0,0 +1,19 @@
+
+// src/theme.ts
+import { color } from "@wrongstack/core/utils";
+var theme = {
+  primary: color.amber,
+  accent: color.pink,
+  muted: color.dim,
+  success: color.green,
+  warn: color.yellow,
+  error: color.red,
+  info: color.cyan,
+  bold: color.bold,
+  underline: color.underline
+};
+
+export {
+  theme
+};
+//# sourceMappingURL=chunk-QD544J2B.js.map

package/dist/chunk-QD544J2B.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/theme.ts"],
+  "sourcesContent": ["import { color } from '@wrongstack/core/utils';\n\nexport const theme = {\n  primary: color.amber,\n  accent: color.pink,\n  muted: color.dim,\n  success: color.green,\n  warn: color.yellow,\n  error: color.red,\n  info: color.cyan,\n  bold: color.bold,\n  underline: color.underline,\n};\n"],
+  "mappings": ";;;AAAA,SAAS,aAAa;AAEf,IAAM,QAAQ;AAAA,EACnB,SAAS,MAAM;AAAA,EACf,QAAQ,MAAM;AAAA,EACd,OAAO,MAAM;AAAA,EACb,SAAS,MAAM;AAAA,EACf,MAAM,MAAM;AAAA,EACZ,OAAO,MAAM;AAAA,EACb,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,EACZ,WAAW,MAAM;AACnB;",
+  "names": []
+}

package/dist/chunk-QUNHS6O3.js

@@ -0,0 +1,258 @@
+import {
+  PLUGIN_AUDIT_ENTRIES
+} from "./chunk-XWEGWYDU.js";
+import {
+  patchConfig
+} from "./chunk-TYO2OVAD.js";
+
+// src/wiring/plugins.ts
+import { join } from "node:path";
+import { loadPlugins, resolvePluginConfig } from "@wrongstack/core/plugin";
+import { OFFICIAL_PLUGIN_FACTORIES } from "@wrongstack/plugins/factories";
+
+// src/plugin-api-factory.ts
+import { DefaultPluginAPI } from "@wrongstack/core/plugin";
+function createApi(ownerName, base) {
+  return new DefaultPluginAPI({ ownerName, ...base });
+}
+
+// src/wiring/plugins.ts
+var DEPRECATED_PLUGIN_NAMES = {
+  "web-search": "use the built-in `search` and `fetch` tools",
+  "json-path": "use the built-in `json` tool with action: query | validate | transform | merge"
+};
+var deprecatedWarningsEmitted = /* @__PURE__ */ new Set();
+var BUILTIN_PLUGIN_CONFIG_ALIASES = {
+  lsp: "@wrongstack/plug-lsp",
+  "@wrongstack/telegram": "telegram"
+};
+var BUILTIN_PLUGIN_CONFIG_NAMES = /* @__PURE__ */ new Set([
+  ...PLUGIN_AUDIT_ENTRIES.map((entry) => entry.name),
+  ...PLUGIN_AUDIT_ENTRIES.map((entry) => `@wrongstack/plugins/${entry.name}`),
+  ...Object.keys(BUILTIN_PLUGIN_CONFIG_ALIASES)
+]);
+function _resetDeprecatedWarningsForTests() {
+  deprecatedWarningsEmitted.clear();
+}
+function warnIfDeprecatedPluginName(name, log) {
+  const replacement = DEPRECATED_PLUGIN_NAMES[name];
+  if (!replacement) return false;
+  if (deprecatedWarningsEmitted.has(name)) return true;
+  deprecatedWarningsEmitted.add(name);
+  log.warn(`[setupPlugins] plugin "${name}" is deprecated and no longer loaded \u2014 ${replacement}`);
+  return true;
+}
+function pluginNameFromSpec(spec) {
+  if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("file:")) {
+    return null;
+  }
+  const parts = spec.split("/");
+  const last = parts[parts.length - 1];
+  if (!last) return null;
+  return last.split("?")[0] ?? null;
+}
+function builtinPluginNameFromSpec(spec) {
+  if (BUILTIN_PLUGIN_CONFIG_ALIASES[spec]) return BUILTIN_PLUGIN_CONFIG_ALIASES[spec];
+  const bareName = pluginNameFromSpec(spec);
+  if (BUILTIN_PLUGIN_CONFIG_NAMES.has(spec)) return bareName ?? spec;
+  if (bareName && BUILTIN_PLUGIN_CONFIG_NAMES.has(bareName)) return bareName;
+  return null;
+}
+var BUILTIN_PLUGIN_FACTORIES = [
+  async () => {
+    const { createPromptsPlugin } = await import("@wrongstack/core/plugin");
+    return createPromptsPlugin();
+  },
+  async () => {
+    const { createSyncPlugin } = await import("@wrongstack/core/plugin");
+    return createSyncPlugin();
+  },
+  async () => {
+    const { createChimeraPlugin } = await import("@wrongstack/core/plugin");
+    return createChimeraPlugin();
+  },
+  async () => {
+    const { createAutoReviewPlugin } = await import("@wrongstack/core/plugin");
+    return createAutoReviewPlugin();
+  },
+  async () => {
+    const { createSkillsPlugin } = await import("@wrongstack/core/plugin");
+    return createSkillsPlugin();
+  },
+  // ── Workspace plugins (@wrongstack/plugins subpath exports) ──────────
+  ...OFFICIAL_PLUGIN_FACTORIES,
+  // ── LSP plugin ──────────────────────────────────────────────────────
+  async () => (await import("@wrongstack/plug-lsp")).default,
+  // ── Telegram plugin ─────────────────────────────────────────────────
+  async () => (await import("@wrongstack/telegram")).default
+];
+async function setupPlugins(params) {
+  const {
+    config,
+    container,
+    events,
+    toolRegistry,
+    providerRegistry,
+    slashCommandRegistry,
+    mcpRegistry,
+    log,
+    agent,
+    sessionWriter,
+    metricsSink,
+    metricsStatus,
+    modelsRegistry,
+    mailbox,
+    healthRegistry,
+    skillLoader,
+    promptLoader,
+    configStore,
+    vault,
+    pipelines,
+    paths,
+    hookRegistry
+  } = params;
+  const builtinPlugins = [];
+  const disabledBuiltins = new Set(
+    (config.plugins ?? []).filter(
+      (p) => typeof p === "object" && p.enabled === false
+    ).flatMap((p) => {
+      const builtinName = builtinPluginNameFromSpec(p.name);
+      return builtinName && builtinName !== p.name ? [p.name, builtinName] : [p.name];
+    })
+  );
+  if (paths && config.features?.plugins !== false) {
+    for (const factory of BUILTIN_PLUGIN_FACTORIES) {
+      try {
+        const plugin = await factory();
+        if (!plugin) continue;
+        const auditEntry = PLUGIN_AUDIT_ENTRIES.find((entry) => entry.name === plugin.name);
+        const explicitlyEnabled = (config.plugins ?? []).some((entry) => {
+          const spec = typeof entry === "string" ? entry : entry.name;
+          if (typeof entry === "object" && entry.enabled === false) return false;
+          return (builtinPluginNameFromSpec(spec) ?? spec) === plugin.name;
+        });
+        if (auditEntry?.defaultState === "inactive" && !explicitlyEnabled) {
+          continue;
+        }
+        if (disabledBuiltins.has(plugin.name)) {
+          log.info(`[setupPlugins] built-in plugin "${plugin.name}" disabled by config`);
+          continue;
+        }
+        if (warnIfDeprecatedPluginName(plugin.name, log)) continue;
+        builtinPlugins.push(plugin);
+      } catch (err) {
+        log.warn("[setupPlugins] builtin plugin failed to load:", err);
+      }
+    }
+  }
+  const userPlugins = [];
+  if (config.features?.plugins !== false) {
+    for (const p of config.plugins ?? []) {
+      if (typeof p === "object" && p.enabled === false) continue;
+      const spec = typeof p === "string" ? p : p.name;
+      const bareName = pluginNameFromSpec(spec);
+      if (bareName && warnIfDeprecatedPluginName(bareName, log)) {
+        continue;
+      }
+      if (builtinPluginNameFromSpec(spec)) {
+        continue;
+      }
+      try {
+        const mod = await import(spec);
+        if (mod.default) userPlugins.push(mod.default);
+      } catch (err) {
+        log.warn(`Plugin "${spec}" failed to load`, err);
+      }
+    }
+  }
+  const allPlugins = [...builtinPlugins, ...userPlugins];
+  if (allPlugins.length === 0) return;
+  const pluginOptions = buildPluginOptions(config, allPlugins);
+  if (paths?.projectDir) {
+    if (pluginOptions["todo-tracker"] === void 0) {
+      pluginOptions["todo-tracker"] = {};
+    }
+    const todoTrackerOpts = pluginOptions["todo-tracker"];
+    if (typeof todoTrackerOpts["filePath"] !== "string" || todoTrackerOpts["filePath"] === "") {
+      todoTrackerOpts["filePath"] = join(paths.projectDir, "todo-tracker.json");
+    }
+    const contextPinsOpts = pluginOptions["context-pins"] ?? {};
+    pluginOptions["context-pins"] = contextPinsOpts;
+    if (typeof contextPinsOpts["filePath"] !== "string" || contextPinsOpts["filePath"] === "") {
+      contextPinsOpts["filePath"] = join(paths.projectDir, "context-pins.json");
+    }
+  }
+  const pluginConfig = patchConfig(config, {
+    extensions: pluginOptions,
+    paths,
+    configStore,
+    vault,
+    metricsSink,
+    metricsStatus,
+    healthRegistry,
+    skillLoader,
+    promptLoader
+  });
+  const pluginHost = await loadPlugins(allPlugins, {
+    log,
+    pluginOptions,
+    apiFactory: (plugin) => createApi(plugin.name, {
+      // First-party plugins come from BUILTIN_PLUGIN_FACTORIES — trust them
+      // ("official") so they can claim bare slash command names (/prompts,
+      // /sync) and override built-ins. User plugins stay namespaced.
+      official: builtinPlugins.includes(plugin),
+      container,
+      events,
+      pipelines,
+      toolRegistry,
+      providerRegistry,
+      slashCommandRegistry,
+      mcpRegistry,
+      config: pluginConfig,
+      log,
+      extensions: agent.extensions,
+      hookRegistry,
+      modelsRegistry,
+      mailbox,
+      notifier: params.notifier,
+      llm: params.llm,
+      sessionWriter: {
+        transcriptPath: sessionWriter.transcriptPath,
+        append: (e) => sessionWriter.append(e)
+      },
+      metricsSink,
+      configStore
+    })
+  });
+  log.info(
+    `[setupPlugins] loaded ${builtinPlugins.length} built-in, ${userPlugins.length} user plugin(s)`
+  );
+  return pluginHost;
+}
+function buildPluginOptions(config, plugins) {
+  const options = {};
+  for (const [name, value] of Object.entries(config.extensions ?? {})) {
+    options[name] = { ...value };
+  }
+  for (const plugin of plugins) {
+    const resolved = resolvePluginConfig({
+      name: plugin.name,
+      aliases: plugin.configAliases,
+      config
+    });
+    if (resolved.configured) options[plugin.name] = resolved.options;
+  }
+  return options;
+}
+
+export {
+  DEPRECATED_PLUGIN_NAMES,
+  BUILTIN_PLUGIN_CONFIG_NAMES,
+  _resetDeprecatedWarningsForTests,
+  warnIfDeprecatedPluginName,
+  pluginNameFromSpec,
+  builtinPluginNameFromSpec,
+  BUILTIN_PLUGIN_FACTORIES,
+  setupPlugins
+};
+//# sourceMappingURL=chunk-QUNHS6O3.js.map

package/dist/chunk-QUNHS6O3.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/wiring/plugins.ts", "../src/plugin-api-factory.ts"],
+  "sourcesContent": ["import { join } from 'node:path';\nimport type { AgentPipelines } from '@wrongstack/core/agent';\nimport type { Config, HealthRegistry, Logger, MetricsRuntimeStatus, MetricsSinkView, ModelsRegistry, Plugin, PromptLoader, SkillLoader } from '@wrongstack/core/types';\nimport type { ExtensionRegistry } from '@wrongstack/core/extension';\nimport type { PluginHostHandle } from '@wrongstack/core/plugin';\nimport type { ConfigStore, SessionWriter } from '@wrongstack/core/types';\nimport type { Container, EventBus } from '@wrongstack/core/kernel';\nimport type { ProviderRegistry, SlashCommandRegistry, ToolRegistry } from '@wrongstack/core/registry';\nimport { loadPlugins, resolvePluginConfig } from '@wrongstack/core/plugin';\nimport type { MCPRegistry } from '@wrongstack/mcp';\nimport { OFFICIAL_PLUGIN_FACTORIES } from '@wrongstack/plugins/factories';\nimport createApi from '../plugin-api-factory.js';\nimport { PLUGIN_AUDIT_ENTRIES } from '../plugin-management.js';\nimport { patchConfig } from '../utils.js';\n\n// ---------------------------------------------------------------------------\n// Deprecated plugin names \u2014 built-ins that have been merged into core\n// tools and no longer ship as separate plugins. We no longer auto-import\n// these factories, and if a user references one of these names in their\n// `config.plugins` we warn once and skip. Removal is split into two\n// phases:\n//   1. Remove the factory from BUILTIN_PLUGIN_FACTORIES (today).\n//   2. Drop the source files + subpath exports + tests from\n//      @wrongstack/plugins in a follow-up commit.\n// Keeping the source files temporarily (phase 2) means user configs\n// that hard-code `@wrongstack/plugins/web-search` as a string spec\n// still resolve at runtime \u2014 the loader receives a no-op stub plugin\n// instead of an import error. Once the user removes the entry from\n// their config, the source can be safely deleted.\n// ---------------------------------------------------------------------------\nexport const DEPRECATED_PLUGIN_NAMES: Record<string, string> = {\n  'web-search': 'use the built-in `search` and `fetch` tools',\n  'json-path': 'use the built-in `json` tool with action: query | validate | transform | merge',\n};\n\n// Per-process dedupe so we don't spam the log if a user lists the\n// same deprecated name across multiple config entries (object form\n// + string form, etc.). Cleared on process restart by design \u2014\n// startup noise is fine, mid-session noise is not.\nconst deprecatedWarningsEmitted = new Set<string>();\n\nconst BUILTIN_PLUGIN_CONFIG_ALIASES: Record<string, string> = {\n  lsp: '@wrongstack/plug-lsp',\n  '@wrongstack/telegram': 'telegram',\n};\n\nexport const BUILTIN_PLUGIN_CONFIG_NAMES = new Set<string>([\n  ...PLUGIN_AUDIT_ENTRIES.map((entry) => entry.name),\n  ...PLUGIN_AUDIT_ENTRIES.map((entry) => `@wrongstack/plugins/${entry.name}`),\n  ...Object.keys(BUILTIN_PLUGIN_CONFIG_ALIASES),\n]);\n\n/** Test helper: reset the dedupe set between test cases. */\nexport function _resetDeprecatedWarningsForTests(): void {\n  deprecatedWarningsEmitted.clear();\n}\n\n/**\n * If `name` is in `DEPRECATED_PLUGIN_NAMES`, log a one-shot `warn`\n * describing the migration target and return true (caller should\n * skip the plugin). If the name is deprecated but already warned\n * about, return true WITHOUT logging again \u2014 the caller still needs\n * to know to skip the plugin. For unknown names, return false.\n */\nexport function warnIfDeprecatedPluginName(name: string, log: Logger): boolean {\n  const replacement = DEPRECATED_PLUGIN_NAMES[name];\n  if (!replacement) return false;\n  if (deprecatedWarningsEmitted.has(name)) return true;\n  deprecatedWarningsEmitted.add(name);\n  log.warn(`[setupPlugins] plugin \"${name}\" is deprecated and no longer loaded \u2014 ${replacement}`);\n  return true;\n}\n\n/**\n * Normalize a plugin spec (either a short name like `'web-search'` or a\n * fully-qualified import path like `'@wrongstack/plugins/web-search'`)\n * to its bare plugin name. Used to look the spec up in\n * `DEPRECATED_PLUGIN_NAMES` regardless of how the user spelled it.\n *\n * Returns null if the spec is not a string we can normalize (e.g.\n * relative paths, file URLs).\n */\nexport function pluginNameFromSpec(spec: string): string | null {\n  if (spec.startsWith('.') || spec.startsWith('/') || spec.startsWith('file:')) {\n    return null;\n  }\n  // `@scope/name/sub` \u2192 'name'; `@scope/name` \u2192 'name'; `name/sub` \u2192 'name'.\n  const parts = spec.split('/');\n  const last = parts[parts.length - 1];\n  if (!last) return null;\n  return last.split('?')[0] ?? null;\n}\n\nexport function builtinPluginNameFromSpec(spec: string): string | null {\n  if (BUILTIN_PLUGIN_CONFIG_ALIASES[spec]) return BUILTIN_PLUGIN_CONFIG_ALIASES[spec];\n  const bareName = pluginNameFromSpec(spec);\n  if (BUILTIN_PLUGIN_CONFIG_NAMES.has(spec)) return bareName ?? spec;\n  if (bareName && BUILTIN_PLUGIN_CONFIG_NAMES.has(bareName)) return bareName;\n  return null;\n}\n\nexport interface PluginsWiringDeps {\n  config: Config;\n  container: Container;\n  events: EventBus;\n  pipelines: AgentPipelines;\n  toolRegistry: ToolRegistry;\n  providerRegistry: ProviderRegistry;\n  slashCommandRegistry: SlashCommandRegistry;\n  mcpRegistry: MCPRegistry;\n  log: Logger;\n  agent: { extensions?: ExtensionRegistry | undefined };\n  /** Lifecycle hook registry \u2014 injected so plugins can register in-process hooks. */\n  hookRegistry?: import('@wrongstack/core/hooks').HookRegistry | undefined;\n  sessionWriter: SessionWriter;\n  metricsSink?: MetricsSinkView | undefined;\n  metricsStatus?: MetricsRuntimeStatus | undefined;\n  /**\n   * Models registry (models.dev-backed catalog of providers, models, and\n   * per-token pricing). Forwarded to plugins that need model metadata\n   * (cost-tracker, billing reports). Optional \u2014 minimal hosts may omit.\n   */\n  modelsRegistry?: ModelsRegistry | undefined;\n  /**\n   * Project-level mailbox (server-backed). Forwarded to plugins that\n   * publish to other agents (todo-listener, session-recap). Optional \u2014\n   * minimal hosts (tests, the LSP server) may omit.\n   */\n  mailbox?: import('@wrongstack/core/coordination').Mailbox | undefined;\n  /**\n   * Notification router \u2014 instantiated as a `NotifierImpl` by the host.\n   * Plugins that deliver one-way notifications (Telegram, Slack, webhook)\n   * register their `NotificationChannel` with this notifier during setup().\n   * Optional \u2014 minimal hosts may omit.\n   */\n  notifier?: import('@wrongstack/core/notifications').Notifier | undefined;\n  /**\n   * LLM wiring for `api.llm` \u2014 the host session's live provider, its\n   * default model, and a factory for named-provider overrides. Optional \u2014\n   * minimal hosts omit it and plugins see `api.llm === undefined`.\n   */\n  llm?:\n    | {\n        provider: import('@wrongstack/core/types').Provider;\n        model: string;\n        getProvider?: (() => import('@wrongstack/core/types').Provider) | undefined;\n        getModel?: (() => string) | undefined;\n        createProvider?:\n          | ((name: string, model?: string) => import('@wrongstack/core/types').Provider)\n          | undefined;\n      }\n    | undefined;\n  /** Health registry \u2014 injected so the observability built-in can run /health. */\n  healthRegistry?: HealthRegistry | undefined;\n  /** Skill loader \u2014 injected so the skills built-in can list/read skills. */\n  skillLoader?: SkillLoader | undefined;\n  /** Prompt loader \u2014 injected so the prompts built-in can list/search/save prompts. */\n  promptLoader?: PromptLoader | undefined;\n  configStore: ConfigStore;\n  /** Secret vault \u2014 injected so sync plugin can encrypt the GitHub token. */\n  vault?: { encrypt(plaintext: string): string; decrypt?(value: string): string };\n  /** Resolved WstackPaths \u2014 injected so built-in plugins can init stores. */\n  paths?: {\n    globalRoot: string;\n    globalConfig: string;\n    globalSkills: string;\n    globalPrompts: string;\n    globalMemory: string;\n    historyFile: string;\n    syncConfig: string;\n    /** ~/.wrongstack/profiles/<activeProfile> \u2014 used by sync plugin for its state path. */\n    configDir: string;\n    /**\n     * Per-project root (`~/.wrongstack/projects/<slug>/`). Plugins that\n     * need project-scoped state (todo-tracker, etc.) should put their\n     * files here so they follow the same lifecycle as goals/SDD\n     * boards/tasks.\n     */\n    projectDir?: string;\n    /** Per-project goal.json path. Useful as a sibling anchor. */\n    projectGoal?: string;\n  };\n}\n\n/**\n * Built-in plugins loaded automatically for every WrongStack session.\n * Lazy (dynamic import) so they don't bloat consumers who never use them.\n *\n * Disable a built-in by adding `{ name: 'wstack-prompts', enabled: false }`\n * to config.plugins.\n *\n * Override for tests by mocking this module's `BUILTIN_PLUGIN_FACTORIES`.\n */\nexport const BUILTIN_PLUGIN_FACTORIES: (() => Promise<Plugin>)[] = [\n  async () => {\n    const { createPromptsPlugin } = await import('@wrongstack/core/plugin');\n    return createPromptsPlugin();\n  },\n  async () => {\n    const { createSyncPlugin } = await import('@wrongstack/core/plugin');\n    return createSyncPlugin();\n  },\n  async () => {\n    const { createChimeraPlugin } = await import('@wrongstack/core/plugin');\n    return createChimeraPlugin();\n  },\n  async () => {\n    const { createAutoReviewPlugin } = await import('@wrongstack/core/plugin');\n    return createAutoReviewPlugin();\n  },\n  async () => {\n    const { createSkillsPlugin } = await import('@wrongstack/core/plugin');\n    return createSkillsPlugin();\n  },\n  // \u2500\u2500 Workspace plugins (@wrongstack/plugins subpath exports) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  ...OFFICIAL_PLUGIN_FACTORIES,\n  // \u2500\u2500 LSP plugin \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  async () => (await import('@wrongstack/plug-lsp')).default,\n  // \u2500\u2500 Telegram plugin \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  async () => (await import('@wrongstack/telegram')).default,\n];\n\nexport async function setupPlugins(\n  params: PluginsWiringDeps,\n): Promise<PluginHostHandle | undefined> {\n  const {\n    config,\n    container,\n    events,\n    toolRegistry,\n    providerRegistry,\n    slashCommandRegistry,\n    mcpRegistry,\n    log,\n    agent,\n    sessionWriter,\n    metricsSink,\n    metricsStatus,\n    modelsRegistry,\n    mailbox,\n    healthRegistry,\n    skillLoader,\n    promptLoader,\n    configStore,\n    vault,\n    pipelines,\n    paths,\n    hookRegistry,\n  } = params;\n\n  // \u2500\u2500 1. Load built-in plugins (prompts, sync, git, \u2026) only when paths are\n  // available \u2014 they need WstackPaths to initialise their stores.\n  //\n  // Built-ins are ENABLED BY DEFAULT. A user can opt a specific one out by\n  // adding `{ name: 'wstack-git', enabled: false }` to `config.plugins`\n  // (or disable all plugins with `config.features.plugins === false`).\n  const builtinPlugins: Plugin[] = [];\n  const disabledBuiltins = new Set(\n    (config.plugins ?? [])\n      .filter(\n        (p): p is { name: string; enabled?: boolean | undefined } =>\n          typeof p === 'object' && p.enabled === false,\n      )\n      .flatMap((p) => {\n        const builtinName = builtinPluginNameFromSpec(p.name);\n        return builtinName && builtinName !== p.name ? [p.name, builtinName] : [p.name];\n      }),\n  );\n  if (paths && config.features?.plugins !== false) {\n    for (const factory of BUILTIN_PLUGIN_FACTORIES) {\n      try {\n        const plugin = await factory();\n        if (!plugin) continue;\n        const auditEntry = PLUGIN_AUDIT_ENTRIES.find((entry) => entry.name === plugin.name);\n        const explicitlyEnabled = (config.plugins ?? []).some((entry) => {\n          const spec = typeof entry === 'string' ? entry : entry.name;\n          if (typeof entry === 'object' && entry.enabled === false) return false;\n          return (builtinPluginNameFromSpec(spec) ?? spec) === plugin.name;\n        });\n        if (auditEntry?.defaultState === 'inactive' && !explicitlyEnabled) {\n          continue;\n        }\n        if (disabledBuiltins.has(plugin.name)) {\n          log.info(`[setupPlugins] built-in plugin \"${plugin.name}\" disabled by config`);\n          continue;\n        }\n        // Defensive: if a future PR leaves a deprecated factory in\n        // BUILTIN_PLUGIN_FACTORIES, the loader-level deprecation policy\n        // still skips it (and warns once per name). Today this branch\n        // is unreachable because we removed those factories \u2014 but the\n        // check stays so a sloppy re-add doesn't silently re-enable a\n        // retired plugin.\n        if (warnIfDeprecatedPluginName(plugin.name, log)) continue;\n        builtinPlugins.push(plugin);\n      } catch (err) {\n        log.warn('[setupPlugins] builtin plugin failed to load:', err);\n      }\n    }\n  }\n\n  // \u2500\u2500 2. Load user plugins from config.plugins \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const userPlugins: Plugin[] = [];\n  if (config.features?.plugins !== false) {\n    for (const p of config.plugins ?? []) {\n      if (typeof p === 'object' && p.enabled === false) continue;\n      const spec = typeof p === 'string' ? p : p.name;\n      // Deprecation policy: if the spec resolves to a deprecated plugin\n      // name (either as `'web-search'` or `'@wrongstack/plugins/web-search'`),\n      // warn once and skip the dynamic import. Today this means\n      // web-search/json-path stub plugins silently load \u2014 after the\n      // source files are deleted (phase 2), this branch becomes the\n      // only line of defense.\n      const bareName = pluginNameFromSpec(spec);\n      if (bareName && warnIfDeprecatedPluginName(bareName, log)) {\n        continue;\n      }\n      if (builtinPluginNameFromSpec(spec)) {\n        continue;\n      }\n      try {\n        const mod = (await import(spec)) as { default?: Plugin | undefined };\n        if (mod.default) userPlugins.push(mod.default);\n      } catch (err) {\n        log.warn(`Plugin \"${spec}\" failed to load`, err);\n      }\n    }\n  }\n\n  // \u2500\u2500 3. Merge: builtins first (they set up infrastructure), then user plugins\n  const allPlugins = [...builtinPlugins, ...userPlugins];\n  if (allPlugins.length === 0) return;\n\n  const pluginOptions = buildPluginOptions(config, allPlugins);\n\n  // Workspace plugins that persist project-scoped state read ONLY their own\n  // namespaced `config.extensions[name]` options \u2014 they never see the\n  // top-level `paths` injected below. Bridge that gap for todo-tracker by\n  // seeding a default `filePath` derived from `paths.projectDir` when the\n  // user hasn't set one explicitly. This mirrors how goals/SDD boards/tasks\n  // live under `~/.wrongstack/projects/<slug>/` and follows the intent\n  // documented on `PluginsWiringDeps.paths.projectDir`.\n  if (paths?.projectDir) {\n    if (pluginOptions['todo-tracker'] === undefined) {\n      pluginOptions['todo-tracker'] = {};\n    }\n    const todoTrackerOpts = pluginOptions['todo-tracker'];\n    if (typeof todoTrackerOpts['filePath'] !== 'string' || todoTrackerOpts['filePath'] === '') {\n      todoTrackerOpts['filePath'] = join(paths.projectDir, 'todo-tracker.json');\n    }\n    // context-pins persists pinned facts the same way \u2014 project-scoped,\n    // next to goals/SDD boards/todo-tracker.\n    const contextPinsOpts = pluginOptions['context-pins'] ?? {};\n    pluginOptions['context-pins'] = contextPinsOpts;\n    if (typeof contextPinsOpts['filePath'] !== 'string' || contextPinsOpts['filePath'] === '') {\n      contextPinsOpts['filePath'] = join(paths.projectDir, 'context-pins.json');\n    }\n  }\n\n  // Built-in plugins read their host dependencies off the TOP LEVEL of the\n  // config object they receive (e.g. prompts/sync use `config.paths` /\n  // `config.configStore`, observability uses `config.metricsSink` /\n  // `config.healthRegistry`). Inject them here so each can wire up its store or\n  // view without a circular import. User plugins never see these \u2014 they only\n  // read their own namespaced `config.extensions[name]` options.\n  const pluginConfig = patchConfig(config, {\n    extensions: pluginOptions,\n    paths,\n    configStore,\n    vault,\n    metricsSink,\n    metricsStatus,\n    healthRegistry,\n    skillLoader,\n    promptLoader,\n  } as Partial<Config>);\n\n  const pluginHost = await loadPlugins(allPlugins, {\n    log,\n    pluginOptions,\n    apiFactory: (plugin) =>\n      createApi(plugin.name, {\n        // First-party plugins come from BUILTIN_PLUGIN_FACTORIES \u2014 trust them\n        // (\"official\") so they can claim bare slash command names (/prompts,\n        // /sync) and override built-ins. User plugins stay namespaced.\n        official: builtinPlugins.includes(plugin),\n        container,\n        events,\n        pipelines: pipelines as never as Parameters<typeof createApi>[1]['pipelines'],\n        toolRegistry,\n        providerRegistry,\n        slashCommandRegistry,\n        mcpRegistry,\n        config: pluginConfig,\n        log,\n        extensions: agent.extensions,\n        hookRegistry,\n        modelsRegistry,\n        mailbox,\n        notifier: params.notifier,\n        llm: params.llm,\n        sessionWriter: {\n          transcriptPath: sessionWriter.transcriptPath,\n          append: (e: Record<string, unknown> & { type: string; ts: string }) =>\n            sessionWriter.append(e as Parameters<typeof sessionWriter.append>[0]),\n        },\n        metricsSink,\n        configStore,\n      }),\n  });\n\n  log.info(\n    `[setupPlugins] loaded ${builtinPlugins.length} built-in, ${userPlugins.length} user plugin(s)`,\n  );\n  return pluginHost;\n}\n\nfunction buildPluginOptions(\n  config: Config,\n  plugins: readonly Plugin[],\n): Record<string, Record<string, unknown>> {\n  const options: Record<string, Record<string, unknown>> = {};\n  for (const [name, value] of Object.entries(config.extensions ?? {})) {\n    options[name] = { ...value };\n  }\n  for (const plugin of plugins) {\n    const resolved = resolvePluginConfig({\n      name: plugin.name,\n      aliases: plugin.configAliases,\n      config,\n    });\n    if (resolved.configured) options[plugin.name] = resolved.options;\n  }\n  return options;\n}\n", "import { DefaultPluginAPI, type PluginAPI, type PluginAPIInit } from '@wrongstack/core/plugin';\n\nexport default function createApi(\n  ownerName: string,\n  base: Omit<PluginAPIInit, 'ownerName'>,\n): PluginAPI {\n  return new DefaultPluginAPI({ ownerName, ...base });\n}\n"],
+  "mappings": ";;;;;;;;;AAAA,SAAS,YAAY;AAQrB,SAAS,aAAa,2BAA2B;AAEjD,SAAS,iCAAiC;;;ACV1C,SAAS,wBAA4D;AAEtD,SAAR,UACL,WACA,MACW;AACX,SAAO,IAAI,iBAAiB,EAAE,WAAW,GAAG,KAAK,CAAC;AACpD;;;ADuBO,IAAM,0BAAkD;AAAA,EAC7D,cAAc;AAAA,EACd,aAAa;AACf;AAMA,IAAM,4BAA4B,oBAAI,IAAY;AAElD,IAAM,gCAAwD;AAAA,EAC5D,KAAK;AAAA,EACL,wBAAwB;AAC1B;AAEO,IAAM,8BAA8B,oBAAI,IAAY;AAAA,EACzD,GAAG,qBAAqB,IAAI,CAAC,UAAU,MAAM,IAAI;AAAA,EACjD,GAAG,qBAAqB,IAAI,CAAC,UAAU,uBAAuB,MAAM,IAAI,EAAE;AAAA,EAC1E,GAAG,OAAO,KAAK,6BAA6B;AAC9C,CAAC;AAGM,SAAS,mCAAyC;AACvD,4BAA0B,MAAM;AAClC;AASO,SAAS,2BAA2B,MAAc,KAAsB;AAC7E,QAAM,cAAc,wBAAwB,IAAI;AAChD,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI,0BAA0B,IAAI,IAAI,EAAG,QAAO;AAChD,4BAA0B,IAAI,IAAI;AAClC,MAAI,KAAK,0BAA0B,IAAI,+CAA0C,WAAW,EAAE;AAC9F,SAAO;AACT;AAWO,SAAS,mBAAmB,MAA6B;AAC9D,MAAI,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,OAAO,GAAG;AAC5E,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,QAAM,OAAO,MAAM,MAAM,SAAS,CAAC;AACnC,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,MAAM,GAAG,EAAE,CAAC,KAAK;AAC/B;AAEO,SAAS,0BAA0B,MAA6B;AACrE,MAAI,8BAA8B,IAAI,EAAG,QAAO,8BAA8B,IAAI;AAClF,QAAM,WAAW,mBAAmB,IAAI;AACxC,MAAI,4BAA4B,IAAI,IAAI,EAAG,QAAO,YAAY;AAC9D,MAAI,YAAY,4BAA4B,IAAI,QAAQ,EAAG,QAAO;AAClE,SAAO;AACT;AA8FO,IAAM,2BAAsD;AAAA,EACjE,YAAY;AACV,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,yBAAyB;AACtE,WAAO,oBAAoB;AAAA,EAC7B;AAAA,EACA,YAAY;AACV,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,yBAAyB;AACnE,WAAO,iBAAiB;AAAA,EAC1B;AAAA,EACA,YAAY;AACV,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,yBAAyB;AACtE,WAAO,oBAAoB;AAAA,EAC7B;AAAA,EACA,YAAY;AACV,UAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,yBAAyB;AACzE,WAAO,uBAAuB;AAAA,EAChC;AAAA,EACA,YAAY;AACV,UAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,yBAAyB;AACrE,WAAO,mBAAmB;AAAA,EAC5B;AAAA;AAAA,EAEA,GAAG;AAAA;AAAA,EAEH,aAAa,MAAM,OAAO,sBAAsB,GAAG;AAAA;AAAA,EAEnD,aAAa,MAAM,OAAO,sBAAsB,GAAG;AACrD;AAEA,eAAsB,aACpB,QACuC;AACvC,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAQJ,QAAM,iBAA2B,CAAC;AAClC,QAAM,mBAAmB,IAAI;AAAA,KAC1B,OAAO,WAAW,CAAC,GACjB;AAAA,MACC,CAAC,MACC,OAAO,MAAM,YAAY,EAAE,YAAY;AAAA,IAC3C,EACC,QAAQ,CAAC,MAAM;AACd,YAAM,cAAc,0BAA0B,EAAE,IAAI;AACpD,aAAO,eAAe,gBAAgB,EAAE,OAAO,CAAC,EAAE,MAAM,WAAW,IAAI,CAAC,EAAE,IAAI;AAAA,IAChF,CAAC;AAAA,EACL;AACA,MAAI,SAAS,OAAO,UAAU,YAAY,OAAO;AAC/C,eAAW,WAAW,0BAA0B;AAC9C,UAAI;AACF,cAAM,SAAS,MAAM,QAAQ;AAC7B,YAAI,CAAC,OAAQ;AACb,cAAM,aAAa,qBAAqB,KAAK,CAAC,UAAU,MAAM,SAAS,OAAO,IAAI;AAClF,cAAM,qBAAqB,OAAO,WAAW,CAAC,GAAG,KAAK,CAAC,UAAU;AAC/D,gBAAM,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAM;AACvD,cAAI,OAAO,UAAU,YAAY,MAAM,YAAY,MAAO,QAAO;AACjE,kBAAQ,0BAA0B,IAAI,KAAK,UAAU,OAAO;AAAA,QAC9D,CAAC;AACD,YAAI,YAAY,iBAAiB,cAAc,CAAC,mBAAmB;AACjE;AAAA,QACF;AACA,YAAI,iBAAiB,IAAI,OAAO,IAAI,GAAG;AACrC,cAAI,KAAK,mCAAmC,OAAO,IAAI,sBAAsB;AAC7E;AAAA,QACF;AAOA,YAAI,2BAA2B,OAAO,MAAM,GAAG,EAAG;AAClD,uBAAe,KAAK,MAAM;AAAA,MAC5B,SAAS,KAAK;AACZ,YAAI,KAAK,iDAAiD,GAAG;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AAGA,QAAM,cAAwB,CAAC;AAC/B,MAAI,OAAO,UAAU,YAAY,OAAO;AACtC,eAAW,KAAK,OAAO,WAAW,CAAC,GAAG;AACpC,UAAI,OAAO,MAAM,YAAY,EAAE,YAAY,MAAO;AAClD,YAAM,OAAO,OAAO,MAAM,WAAW,IAAI,EAAE;AAO3C,YAAM,WAAW,mBAAmB,IAAI;AACxC,UAAI,YAAY,2BAA2B,UAAU,GAAG,GAAG;AACzD;AAAA,MACF;AACA,UAAI,0BAA0B,IAAI,GAAG;AACnC;AAAA,MACF;AACA,UAAI;AACF,cAAM,MAAO,MAAM,OAAO;AAC1B,YAAI,IAAI,QAAS,aAAY,KAAK,IAAI,OAAO;AAAA,MAC/C,SAAS,KAAK;AACZ,YAAI,KAAK,WAAW,IAAI,oBAAoB,GAAG;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AAGA,QAAM,aAAa,CAAC,GAAG,gBAAgB,GAAG,WAAW;AACrD,MAAI,WAAW,WAAW,EAAG;AAE7B,QAAM,gBAAgB,mBAAmB,QAAQ,UAAU;AAS3D,MAAI,OAAO,YAAY;AACrB,QAAI,cAAc,cAAc,MAAM,QAAW;AAC/C,oBAAc,cAAc,IAAI,CAAC;AAAA,IACnC;AACA,UAAM,kBAAkB,cAAc,cAAc;AACpD,QAAI,OAAO,gBAAgB,UAAU,MAAM,YAAY,gBAAgB,UAAU,MAAM,IAAI;AACzF,sBAAgB,UAAU,IAAI,KAAK,MAAM,YAAY,mBAAmB;AAAA,IAC1E;AAGA,UAAM,kBAAkB,cAAc,cAAc,KAAK,CAAC;AAC1D,kBAAc,cAAc,IAAI;AAChC,QAAI,OAAO,gBAAgB,UAAU,MAAM,YAAY,gBAAgB,UAAU,MAAM,IAAI;AACzF,sBAAgB,UAAU,IAAI,KAAK,MAAM,YAAY,mBAAmB;AAAA,IAC1E;AAAA,EACF;AAQA,QAAM,eAAe,YAAY,QAAQ;AAAA,IACvC,YAAY;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAoB;AAEpB,QAAM,aAAa,MAAM,YAAY,YAAY;AAAA,IAC/C;AAAA,IACA;AAAA,IACA,YAAY,CAAC,WACX,UAAU,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA,MAIrB,UAAU,eAAe,SAAS,MAAM;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA,YAAY,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,KAAK,OAAO;AAAA,MACZ,eAAe;AAAA,QACb,gBAAgB,cAAc;AAAA,QAC9B,QAAQ,CAAC,MACP,cAAc,OAAO,CAA+C;AAAA,MACxE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AAED,MAAI;AAAA,IACF,yBAAyB,eAAe,MAAM,cAAc,YAAY,MAAM;AAAA,EAChF;AACA,SAAO;AACT;AAEA,SAAS,mBACP,QACA,SACyC;AACzC,QAAM,UAAmD,CAAC;AAC1D,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,cAAc,CAAC,CAAC,GAAG;AACnE,YAAQ,IAAI,IAAI,EAAE,GAAG,MAAM;AAAA,EAC7B;AACA,aAAW,UAAU,SAAS;AAC5B,UAAM,WAAW,oBAAoB;AAAA,MACnC,MAAM,OAAO;AAAA,MACb,SAAS,OAAO;AAAA,MAChB;AAAA,IACF,CAAC;AACD,QAAI,SAAS,WAAY,SAAQ,OAAO,IAAI,IAAI,SAAS;AAAA,EAC3D;AACA,SAAO;AACT;",
+  "names": []
+}