@wrongstack/cli 0.296.4 → 0.298.0

package/dist/{webui-server-ZF5KVGC5.js → webui-server-PCLSXX6L.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-OP47B3IX.js";
 import {
   startCliHqConnection
-} from "./chunk-WY7KKOUK.js";
+} from "./chunk-JW75HY4F.js";
 import {
   loadConfigProviders,
   mutateConfigProviders
@@ -17,12 +17,15 @@ import "./chunk-7OCVIDC7.js";
 import { findPackageJSON } from "node:module";
 import * as os from "node:os";
 import * as path5 from "node:path";
-import { DefaultSecretScrubber } from "@wrongstack/core/security";
-import { PromptUsageStore, watchProviderConfig } from "@wrongstack/core/storage";
-import { resolveWstackPaths as resolveWstackPaths2, wstackGlobalRoot } from "@wrongstack/core/utils";
 import { TOKENS } from "@wrongstack/core/kernel";
-import { createCompatibilityTrustBoundary } from "@wrongstack/core/security";
+import { createCompatibilityTrustBoundary, DefaultSecretScrubber } from "@wrongstack/core/security";
 import { SkillInstaller } from "@wrongstack/core/skills";
+import { PromptUsageStore, watchProviderConfig } from "@wrongstack/core/storage";
+import {
+  resolveWstackPaths as resolveWstackPaths2,
+  startSharedHeapWatchdog,
+  wstackGlobalRoot
+} from "@wrongstack/core/utils";
 import { toErrorMessage } from "@wrongstack/core/utils/error";
 import { makeProviderFromConfig } from "@wrongstack/providers";
 import {
@@ -172,6 +175,7 @@ function createConnectionHandler(deps) {
 import { PhaseGraphBuilder } from "@wrongstack/core/goal";
 import { resolveWstackPaths } from "@wrongstack/core/utils";
 import { exportBoardToTaskGraph } from "@wrongstack/kanban";
+import { TaskGraphStore } from "@wrongstack/sdd";
 import {
   startSddRunFromGraph
 } from "@wrongstack/webui-server";
@@ -301,6 +305,8 @@ function createCliKanbanHostRoutes(deps) {
           return failRun("SDD runs need the multi-agent host, which is not available here.");
         }
         const paths = resolveWstackPaths({ projectRoot });
+        const taskStore = new TaskGraphStore({ baseDir: paths.projectTaskGraphs });
+        await taskStore.save(exported.graph);
         const handle = await startSddRunFromGraph(
           exported.graph,
           {
@@ -309,6 +315,7 @@ function createCliKanbanHostRoutes(deps) {
             projectRoot,
             subagentFactory: opts.sddSubagentFactory,
             projectSddBoards: paths.projectSddBoards,
+            taskStore,
             ...opts.brain ? { brain: opts.brain } : {},
             ...runIsolatedTurn ? { runIsolatedTurn } : {}
           },
@@ -347,6 +354,52 @@ import {
   registerWebuiSignalHandlers
 } from "@wrongstack/webui-server";
 
+// src/webui-server/listen-helpers.ts
+import * as http from "node:http";
+async function startDeferredHttpListen(args) {
+  const { server, host, httpPort, logger } = args;
+  await new Promise((resolveListen, rejectListen) => {
+    server.listen(httpPort, host, () => resolveListen());
+    server.once("error", rejectListen);
+  });
+  server.on("error", (err) => {
+    logger.error("http_server_error", {
+      message: err.message,
+      port: httpPort
+    });
+  });
+}
+async function startIpv6LoopbackProxy(args) {
+  const { primary, httpPort, logger } = args;
+  const v6 = http.createServer();
+  v6.on("request", (req, res) => primary.emit("request", req, res));
+  v6.on("upgrade", (req, socket, head) => primary.emit("upgrade", req, socket, head));
+  const logIpv6Error = (err) => {
+    if (err.code === "EAFNOSUPPORT" || err.code === "EADDRNOTAVAIL" || err.code === "EADDRINUSE") {
+      logger.warn("ipv6_loopback_unavailable", { code: err.code, port: httpPort });
+      return;
+    }
+    logger.error("http_server_error", { message: err.message, port: httpPort });
+  };
+  v6.on("error", logIpv6Error);
+  const ipv6Listening = await new Promise((resolveListen) => {
+    const onListening = () => {
+      v6.off("error", onInitialError);
+      resolveListen(true);
+    };
+    const onInitialError = () => {
+      v6.off("listening", onListening);
+      resolveListen(false);
+    };
+    v6.once("listening", onListening);
+    v6.once("error", onInitialError);
+    v6.listen(httpPort, "::1");
+  });
+  if (!ipv6Listening) return null;
+  console.log(`[WebUI] Also listening on http://[::1]:${httpPort}`);
+  return v6;
+}
+
 // src/webui-server/logger-shim.ts
 var structuredLine = (level, message) => JSON.stringify({
   level,
@@ -376,9 +429,63 @@ var consoleLogger = {
   }
 };
 
+// src/webui-server/node-pty-loader.ts
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+function createNodePtyLoader(importMetaUrl, logger) {
+  const requireFromCli = createRequire(importMetaUrl);
+  let cachedNodePty;
+  return () => {
+    if (cachedNodePty !== void 0) return cachedNodePty;
+    try {
+      const webuiEntry = requireFromCli.resolve("@wrongstack/webui");
+      const webuiDir = webuiEntry.replace(/[\\/]dist.*$/, "");
+      const webuiPkgJson = path.join(webuiDir, "package.json");
+      cachedNodePty = createRequire(webuiPkgJson)("node-pty");
+      if (cachedNodePty) {
+        logger.debug?.(`[terminal] node-pty loaded via webui package (${webuiDir})`);
+        return cachedNodePty;
+      }
+    } catch (err) {
+      logger.debug?.(`[terminal] webui-route failed: ${err.message}`);
+    }
+    try {
+      cachedNodePty = requireFromCli("node-pty");
+      logger.debug?.("[terminal] node-pty loaded via direct requireFromCli");
+      return cachedNodePty;
+    } catch (err) {
+      logger.debug?.(`[terminal] direct require failed: ${err.message}`);
+    }
+    try {
+      const cliPkgJson = path.join(path.dirname(fileURLToPath(importMetaUrl)), "..", "package.json");
+      let dir = path.dirname(cliPkgJson);
+      for (let i = 0; i < 6; i++) {
+        const candidate = path.join(dir, "node_modules", "node-pty");
+        if (existsSync(candidate)) {
+          cachedNodePty = createRequire(candidate)("node-pty");
+          if (cachedNodePty) {
+            logger.debug?.(`[terminal] node-pty loaded via workspace root (${candidate})`);
+            return cachedNodePty;
+          }
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir) break;
+        dir = parent;
+      }
+    } catch (err) {
+      logger.debug?.(`[terminal] workspace-root walk failed: ${err.message}`);
+    }
+    cachedNodePty = null;
+    logger.debug?.('[terminal] node-pty resolution failed; terminal panel will report "unavailable"');
+    return cachedNodePty;
+  };
+}
+
 // src/webui-server/prefs-seeding.ts
 import * as fs from "node:fs/promises";
-import * as path from "node:path";
+import * as path2 from "node:path";
 import { DefaultSecretVault } from "@wrongstack/core/security";
 import {
   PREF_KEYS,
@@ -434,8 +541,8 @@ function createPrefsSeeding(opts) {
       patchLiveAppConfig({ modelMatrix: payload["modelMatrix"] });
     }
     if (!opts.profileConfigPath) return;
-    const globalRoot = opts.globalConfigPath ? path.dirname(opts.globalConfigPath) : path.dirname(opts.profileConfigPath);
-    const vault = new DefaultSecretVault({ keyFile: path.join(globalRoot, ".key") });
+    const globalRoot = opts.globalConfigPath ? path2.dirname(opts.globalConfigPath) : path2.dirname(opts.profileConfigPath);
+    const vault = new DefaultSecretVault({ keyFile: path2.join(globalRoot, ".key") });
     await persistPrefsToConfig(
       {
         profileConfigPath: opts.profileConfigPath,
@@ -464,13 +571,13 @@ function createPrefsSeeding(opts) {
 }
 
 // src/webui-server/provider-config.ts
-import * as path2 from "node:path";
+import * as path3 from "node:path";
 import { DefaultSecretVault as DefaultSecretVault2 } from "@wrongstack/core/security";
 function getVault(globalConfigPath) {
-  const configDir = path2.dirname(globalConfigPath ?? "");
-  const parentDir = path2.dirname(configDir);
-  const globalRoot = path2.basename(parentDir) === "profiles" ? path2.dirname(parentDir) : configDir;
-  const keyFile = path2.join(globalRoot, ".key");
+  const configDir = path3.dirname(globalConfigPath ?? "");
+  const parentDir = path3.dirname(configDir);
+  const globalRoot = path3.basename(parentDir) === "profiles" ? path3.dirname(parentDir) : configDir;
+  const keyFile = path3.join(globalRoot, ".key");
   return new DefaultSecretVault2({ keyFile });
 }
 async function loadSavedProviders(globalConfigPath) {
@@ -496,7 +603,7 @@ function createProviderConfigStore(globalConfigPath, configProvidersRef) {
 }
 
 // src/webui-server/session-start-payload.ts
-import * as path3 from "node:path";
+import * as path4 from "node:path";
 import { DEFAULT_CONTEXT_WINDOW_MODE_ID } from "@wrongstack/core/types";
 import { protocolAdvertisement } from "@wrongstack/webui-server/protocol";
 
@@ -513,6 +620,7 @@ function createSessionStartPayloadBuilder(deps) {
     let inputCost = 0;
     let outputCost = 0;
     let cacheReadCost = 0;
+    const updateInfo = deps.updateInfo;
     try {
       if (deps.modelsRegistry) {
         const m = await deps.modelsRegistry.getModel(
@@ -536,7 +644,7 @@ function createSessionStartPayloadBuilder(deps) {
       model: deps.agent.ctx.model,
       provider: deps.agent.ctx.provider.id,
       mode: deps.modeId ?? "default",
-      projectName: deps.projectRoot ? path3.basename(deps.projectRoot) : void 0,
+      projectName: deps.projectRoot ? path4.basename(deps.projectRoot) : void 0,
       // Frontend reads `projectRoot` from session.start (ws-handlers setEnv) —
       // omitting it left the store's projectRoot empty after a project switch.
       projectRoot: deps.projectRoot ?? deps.agent.ctx.projectRoot ?? "",
@@ -552,6 +660,10 @@ function createSessionStartPayloadBuilder(deps) {
       cacheReadCost,
       lastInputTokens,
       providerStatuses: deps.statusTracker?.getAllStatuses() ?? [],
+      appVersion: updateInfo?.current,
+      latestVersion: updateInfo?.latest,
+      updateAvailable: updateInfo?.outdated ?? false,
+      updateCheckFailed: updateInfo?.checkFailed ?? false,
       ...protocolAdvertisement(),
       ...overrides
     };
@@ -711,106 +823,6 @@ function startBoundedTerminalLogView(options = {}) {
   };
 }
 
-// src/webui-server/node-pty-loader.ts
-import { existsSync } from "node:fs";
-import { createRequire } from "node:module";
-import * as path4 from "node:path";
-import { fileURLToPath } from "node:url";
-function createNodePtyLoader(importMetaUrl, logger) {
-  const requireFromCli = createRequire(importMetaUrl);
-  let cachedNodePty;
-  return () => {
-    if (cachedNodePty !== void 0) return cachedNodePty;
-    try {
-      const webuiEntry = requireFromCli.resolve("@wrongstack/webui");
-      const webuiDir = webuiEntry.replace(/[\\/]dist.*$/, "");
-      const webuiPkgJson = path4.join(webuiDir, "package.json");
-      cachedNodePty = createRequire(webuiPkgJson)("node-pty");
-      if (cachedNodePty) {
-        logger.debug?.(`[terminal] node-pty loaded via webui package (${webuiDir})`);
-        return cachedNodePty;
-      }
-    } catch (err) {
-      logger.debug?.(`[terminal] webui-route failed: ${err.message}`);
-    }
-    try {
-      cachedNodePty = requireFromCli("node-pty");
-      logger.debug?.("[terminal] node-pty loaded via direct requireFromCli");
-      return cachedNodePty;
-    } catch (err) {
-      logger.debug?.(`[terminal] direct require failed: ${err.message}`);
-    }
-    try {
-      const cliPkgJson = path4.join(path4.dirname(fileURLToPath(importMetaUrl)), "..", "package.json");
-      let dir = path4.dirname(cliPkgJson);
-      for (let i = 0; i < 6; i++) {
-        const candidate = path4.join(dir, "node_modules", "node-pty");
-        if (existsSync(candidate)) {
-          cachedNodePty = createRequire(candidate)("node-pty");
-          if (cachedNodePty) {
-            logger.debug?.(`[terminal] node-pty loaded via workspace root (${candidate})`);
-            return cachedNodePty;
-          }
-        }
-        const parent = path4.dirname(dir);
-        if (parent === dir) break;
-        dir = parent;
-      }
-    } catch (err) {
-      logger.debug?.(`[terminal] workspace-root walk failed: ${err.message}`);
-    }
-    cachedNodePty = null;
-    logger.debug?.('[terminal] node-pty resolution failed; terminal panel will report "unavailable"');
-    return cachedNodePty;
-  };
-}
-
-// src/webui-server/listen-helpers.ts
-import * as http from "node:http";
-async function startDeferredHttpListen(args) {
-  const { server, host, httpPort, logger } = args;
-  await new Promise((resolveListen, rejectListen) => {
-    server.listen(httpPort, host, () => resolveListen());
-    server.once("error", rejectListen);
-  });
-  server.on("error", (err) => {
-    logger.error("http_server_error", {
-      message: err.message,
-      port: httpPort
-    });
-  });
-}
-async function startIpv6LoopbackProxy(args) {
-  const { primary, httpPort, logger } = args;
-  const v6 = http.createServer();
-  v6.on("request", (req, res) => primary.emit("request", req, res));
-  v6.on("upgrade", (req, socket, head) => primary.emit("upgrade", req, socket, head));
-  const logIpv6Error = (err) => {
-    if (err.code === "EAFNOSUPPORT" || err.code === "EADDRNOTAVAIL" || err.code === "EADDRINUSE") {
-      logger.warn("ipv6_loopback_unavailable", { code: err.code, port: httpPort });
-      return;
-    }
-    logger.error("http_server_error", { message: err.message, port: httpPort });
-  };
-  v6.on("error", logIpv6Error);
-  const ipv6Listening = await new Promise((resolveListen) => {
-    const onListening = () => {
-      v6.off("error", onInitialError);
-      resolveListen(true);
-    };
-    const onInitialError = () => {
-      v6.off("listening", onListening);
-      resolveListen(false);
-    };
-    v6.once("listening", onListening);
-    v6.once("error", onInitialError);
-    v6.listen(httpPort, "::1");
-  });
-  if (!ipv6Listening) return null;
-  console.log(`[WebUI] Also listening on http://[::1]:${httpPort}`);
-  return v6;
-}
-
 // src/webui-server.ts
 async function runWebUI(opts) {
   const trustBoundary = opts.trustBoundary ?? createCompatibilityTrustBoundary({ policyId: "cli-webui-trusted-host-compat-v1" });
@@ -829,7 +841,7 @@ async function runWebUI(opts) {
   const wsPort = httpPort;
   const globalRoot = opts.globalConfigPath ? path5.dirname(opts.globalConfigPath) : wstackGlobalRoot();
   const profileConfigPath = opts.profileConfigPath ?? opts.globalConfigPath ?? path5.join(globalRoot, "config.json");
-  const rateLimitMax = Number.parseInt(process.env["WEBUI_RATE_LIMIT"] ?? "0", 10);
+  const rateLimitMax = Number.parseInt(process.env["WEBUI_RATE_LIMIT"] ?? "600", 10);
   const clients = /* @__PURE__ */ new Map();
   const pendingConfirms = /* @__PURE__ */ new Map();
   const secretScrubber = new DefaultSecretScrubber();
@@ -858,6 +870,17 @@ async function runWebUI(opts) {
     ...opts.onKanbanDispatch ? { dispatchTask: opts.onKanbanDispatch } : {},
     log: (message) => consoleLogger.info(message)
   }) : null;
+  const stopKanbanSupervisorMemoryStats = kanbanSupervisor ? startSharedHeapWatchdog({
+    collectStats: () => {
+      const stats = kanbanSupervisor.getStats();
+      return {
+        kanbanSupervisorSnapshots: stats.snapshots,
+        kanbanSupervisorScheduledBoards: stats.scheduledBoards,
+        kanbanSupervisorAgentCooldowns: stats.agentCooldowns,
+        kanbanSupervisorRunningAgents: stats.runningAgents
+      };
+    }
+  }) : void 0;
   const goalHandler = new GoalWebSocketHandler(
     opts.agent,
     opts.agent.ctx,
@@ -1104,18 +1127,25 @@ async function runWebUI(opts) {
       // not inside the profile directory — resolve via global root to stay correct.
       getVault(opts.globalConfigPath),
       (snapshot) => {
+        const hadFallbackBridge = Boolean(opts.appConfig?.fallbackBridge?.trim());
         try {
           if (opts.appConfig && !Object.isFrozen(opts.appConfig)) {
             opts.appConfig.providers = snapshot.providers;
             if (snapshot.uiLocale) opts.appConfig.uiLocale = snapshot.uiLocale;
+            if (snapshot.fallbackBridge !== void 0) {
+              opts.appConfig.fallbackBridge = snapshot.fallbackBridge;
+            } else {
+              delete opts.appConfig.fallbackBridge;
+            }
           }
         } catch {
         }
-        const routingChanged = snapshot.fallbackModels !== void 0 || snapshot.fallbackProfiles !== void 0 || snapshot.favoriteModels !== void 0 || snapshot.favoriteModelsOnly !== void 0 || snapshot.modelMatrix !== void 0 || snapshot.fallbackAuto !== void 0;
+        const routingChanged = snapshot.fallbackModels !== void 0 || snapshot.fallbackBridge !== void 0 || hadFallbackBridge || snapshot.fallbackProfiles !== void 0 || snapshot.favoriteModels !== void 0 || snapshot.favoriteModelsOnly !== void 0 || snapshot.modelMatrix !== void 0 || snapshot.fallbackAuto !== void 0;
         if (routingChanged) {
           const configStore = opts.agent.container?.safeResolve?.(TOKENS.ConfigStore);
           configStore?.update({
             ...snapshot.fallbackModels !== void 0 ? { fallbackModels: snapshot.fallbackModels } : {},
+            fallbackBridge: snapshot.fallbackBridge ?? "",
             ...snapshot.fallbackProfiles !== void 0 ? { fallbackProfiles: snapshot.fallbackProfiles } : {},
             ...snapshot.favoriteModels !== void 0 ? { favoriteModels: snapshot.favoriteModels } : {},
             ...snapshot.favoriteModelsOnly !== void 0 ? { favoriteModelsOnly: snapshot.favoriteModelsOnly } : {},
@@ -1290,6 +1320,8 @@ async function runWebUI(opts) {
     ...kanbanSupervisor ? { kanbanSupervisor } : {},
     ...kanbanRunMirror ? { kanbanRunMirror } : {}
   });
+  let signalShutdown;
+  const shutdown = () => signalShutdown?.();
   const handleMessage = createEmbeddedMessageRouter({
     trustBoundary,
     opts,
@@ -1386,7 +1418,7 @@ async function runWebUI(opts) {
         })
       );
     });
-    const signalShutdown = createWebuiShutdown({
+    signalShutdown = createWebuiShutdown({
       abortInFlight: () => {
         if (abortController) {
           abortController.abort();
@@ -1399,6 +1431,18 @@ async function runWebUI(opts) {
         flushAllStreamBuffers();
         for (const unsub of eventUnsubscribers) unsub();
       },
+      disposeResources: () => {
+        credentialWatcherClose?.();
+        credentialWatcherClose = void 0;
+        goalHandler.dispose();
+        sddBoardHandler.dispose();
+        worktreeHandler.dispose();
+        terminalHandler.dispose();
+        kanbanRunMirror?.dispose();
+        kanbanSupervisor?.dispose();
+        void stopKanbanSupervisorMemoryStats?.();
+        unregisterWebuiClient();
+      },
       closeClients: () => {
         for (const [ws] of clients) ws.close();
         clients.clear();
@@ -1413,6 +1457,7 @@ async function runWebUI(opts) {
       onStopped: () => {
         terminalLogView.redraw();
         terminalLogView.stop();
+        opts.onExit?.();
         resolve();
       }
     });
@@ -1423,21 +1468,6 @@ async function runWebUI(opts) {
       ws.send(JSON.stringify(msg));
     }
   }
-  function shutdown() {
-    console.log("[WebUI] Shutting down...");
-    terminalLogView.redraw();
-    terminalLogView.stop();
-    credentialWatcherClose?.();
-    flushAllStreamBuffers();
-    worktreeHandler.dispose();
-    terminalHandler.dispose();
-    kanbanRunMirror?.dispose();
-    kanbanSupervisor?.dispose();
-    unregisterWebuiClient();
-    ipv6LoopbackServer?.close();
-    httpServer?.server.close();
-    opts.onExit?.();
-  }
   function broadcast(msg) {
     const data = JSON.stringify(msg);
     for (const [ws] of clients) {
@@ -1457,4 +1487,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-ZF5KVGC5.js.map
+//# sourceMappingURL=webui-server-PCLSXX6L.js.map

package/dist/webui-server-options.d.ts

@@ -171,6 +171,13 @@ export interface CliWebUIOptions {
     onAutonomySwitch?: ((mode: string) => void) | undefined;
     /** Forward browser YOLO changes to the host's live permission policy. */
     onYoloSwitch?: ((enabled: boolean) => void) | undefined;
+    /**
+     * Pre-computed update info from the CLI's preflight version check.
+     * When present, the session.start payload includes appVersion,
+     * latestVersion, and updateAvailable so all surfaces (WebUI, SimpleUI)
+     * can display an "update available" warning.
+     */
+    updateInfo?: import('./webui-server/session-start-payload.js').BootUpdateInfo | undefined;
     /** Optional kanban task dispatch hook, backed by the CLI multi-agent host. */
     onKanbanDispatch?: ((description: string, opts?: {
         provider?: string | undefined;

package/dist/wiring/brain-and-orchestration.d.ts

@@ -58,6 +58,8 @@ export interface BrainOrchestrationDeps {
     modeId?: string | undefined;
     /** Shared provider/model status tracker for the Director. */
     statusTracker?: import('@wrongstack/core/coordination').ProviderModelStatusTracker | undefined;
+    /** Trusted governance hook for in-process Fleet tool pipelines. */
+    installToolBoundary?: ((pipelines: import('@wrongstack/core/agent').AgentPipelines) => void) | undefined;
 }
 export interface BrainOrchestrationResult {
     brain: ObservableBrainArbiter;

package/dist/wiring/hq-telemetry.d.ts

@@ -1,10 +1,10 @@
-import type { Config, SessionWriter } from '@wrongstack/core/types';
+import type { AgentMonitorService, RemoteMailbox } from '@wrongstack/core/coordination';
 import type { HqPublisher } from '@wrongstack/core/hq';
 import type { EventBus } from '@wrongstack/core/kernel';
-import type { RemoteMailbox } from '@wrongstack/core/coordination';
-import type { AgentMonitorService } from '@wrongstack/core/coordination';
+import type { Config, SessionWriter } from '@wrongstack/core/types';
 import type { MCPRegistry } from '@wrongstack/mcp';
 import { createHqCommandDispatcher, type HqCommandController } from '../hq-command-controller.js';
+import type { KanbanHqSyncStats } from '../kanban-hq-sync.js';
 /**
  * Mutable holder for the HQ publisher reference. The ref is created in
  * cli-main.ts before `brainMailbox` (which captures it via closure) and
@@ -12,6 +12,7 @@ import { createHqCommandDispatcher, type HqCommandController } from '../hq-comma
  */
 export interface HqPublisherRef {
     current: HqPublisher | undefined;
+    getKanbanSyncStats?: (() => KanbanHqSyncStats | undefined) | undefined;
 }
 export interface SetupHqTelemetryDeps {
     events: EventBus;

package/dist/wiring/lifecycle-plugins.d.ts

@@ -1,14 +1,13 @@
-import type { Config, Logger, MetricsRuntimeStatus, ModelsRegistry, PromptLoader, Provider, ProviderConfig, SecretVault, SessionWriter, SkillLoader } from '@wrongstack/core/types';
-import type { HqPublisher } from '@wrongstack/core/hq';
-import { HookRegistry, HookRunner } from '@wrongstack/core/hooks';
 import { type RemoteMailbox } from '@wrongstack/core/coordination';
-import type { HealthRegistry } from '@wrongstack/core/types';
-import type { WstackPaths } from '@wrongstack/core/utils';
+import { HookRegistry, HookRunner } from '@wrongstack/core/hooks';
 import type { PluginHostHandle } from '@wrongstack/core/plugin';
 import { type ProviderRegistry, SlashCommandRegistry, type ToolRegistry } from '@wrongstack/core/registry';
+import type { Config, HealthRegistry, Logger, MetricsRuntimeStatus, ModelsRegistry, PromptLoader, Provider, ProviderConfig, SecretVault, SessionWriter, SkillLoader } from '@wrongstack/core/types';
+import type { WstackPaths } from '@wrongstack/core/utils';
 import { MCPRegistry } from '@wrongstack/mcp';
 import type { EventWiring } from '../boot/event-wiring.js';
 import type { MaxContextBranch } from '../context-limit.js';
+import type { HqPublisherRef } from './hq-telemetry.js';
 import { setupCompaction } from './pipeline.js';
 type AnyRecord = Record<string, any>;
 export interface LifecyclePluginsDeps {
@@ -51,9 +50,7 @@ export interface LifecyclePluginsResult {
     agent: any;
     mcpRegistry: MCPRegistry;
     slashRegistry: SlashCommandRegistry;
-    hqPublisherRef: {
-        current: HqPublisher | undefined;
-    };
+    hqPublisherRef: HqPublisherRef;
     brainMailbox: RemoteMailbox;
     pluginHost: PluginHostHandle | undefined;
 }

package/dist/wiring/metrics.d.ts

@@ -1,5 +1,5 @@
-import { type MetricsServerHandle } from '@wrongstack/core/observability';
 import type { EventBus } from '@wrongstack/core/kernel';
+import { type MetricsServerHandle } from '@wrongstack/core/observability';
 import type { HealthRegistry, MetricsRuntimeStatus, MetricsSink } from '@wrongstack/core/types';
 import { type WstackPaths } from '@wrongstack/core/utils';
 import type { MCPRegistry, MCPServerOperationalHealth } from '@wrongstack/mcp';

package/dist/wiring/provider-runtime-setup.d.ts

@@ -1,8 +1,8 @@
-import type { Config, Logger, ModelsRegistry, Provider, ProviderConfig, SecretVault } from '@wrongstack/core/types';
 import { type FallbackProfileManager } from '@wrongstack/core/agent';
-import type { EventBus } from '@wrongstack/core/kernel';
 import type { ProviderModelStatusTracker } from '@wrongstack/core/coordination';
+import type { EventBus } from '@wrongstack/core/kernel';
 import type { ProviderRegistry } from '@wrongstack/core/registry';
+import type { Config, Logger, ModelsRegistry, Provider, ProviderConfig, SecretVault } from '@wrongstack/core/types';
 import type { WstackPaths } from '@wrongstack/core/utils';
 export declare function serializeProviderRuntimeSnapshot(snapshot: unknown): string;
 type AnyObj = any;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "0.296.4",
+  "version": "0.298.0",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -37,33 +37,34 @@
   },
   "files": [
     "dist",
+    "!dist/**/*.map",
     "data"
   ],
   "dependencies": {
     "ws": "^8.21.1",
-    "@wrongstack/acp": "0.296.4",
-    "@wrongstack/mcp": "0.296.4",
-    "@wrongstack/runtime": "0.296.4",
-    "@wrongstack/plugins": "0.296.4",
-    "@wrongstack/core": "0.296.4",
-    "@wrongstack/plug-lsp": "0.296.4",
-    "@wrongstack/bench": "0.296.4",
-    "@wrongstack/providers": "0.296.4",
-    "@wrongstack/kanban": "0.296.4",
-    "@wrongstack/simpleui": "0.296.4",
-    "@wrongstack/sdd": "0.296.4",
-    "@wrongstack/security-scanner": "0.296.4",
-    "@wrongstack/sage": "0.296.4",
-    "@wrongstack/telegram": "0.296.4",
-    "@wrongstack/techstack": "0.296.4",
-    "@wrongstack/tools": "0.296.4",
-    "@wrongstack/tui": "0.296.4",
-    "@wrongstack/webui": "0.296.4",
-    "@wrongstack/webui-hq": "0.296.4",
-    "@wrongstack/webui-server": "0.296.4"
+    "@wrongstack/mcp": "0.298.0",
+    "@wrongstack/bench": "0.298.0",
+    "@wrongstack/core": "0.298.0",
+    "@wrongstack/acp": "0.298.0",
+    "@wrongstack/providers": "0.298.0",
+    "@wrongstack/plug-lsp": "0.298.0",
+    "@wrongstack/kanban": "0.298.0",
+    "@wrongstack/runtime": "0.298.0",
+    "@wrongstack/security-scanner": "0.298.0",
+    "@wrongstack/sdd": "0.298.0",
+    "@wrongstack/simpleui": "0.298.0",
+    "@wrongstack/techstack": "0.298.0",
+    "@wrongstack/tui": "0.298.0",
+    "@wrongstack/webui": "0.298.0",
+    "@wrongstack/telegram": "0.298.0",
+    "@wrongstack/plugins": "0.298.0",
+    "@wrongstack/tools": "0.298.0",
+    "@wrongstack/webui-hq": "0.298.0",
+    "@wrongstack/sage": "0.298.0",
+    "@wrongstack/webui-server": "0.298.0"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "0.296.4"
+    "@wrongstack/desktop": "0.298.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",