@wrongstack/cli 0.298.0 → 0.298.2

package/data/README.md

@@ -75,3 +75,54 @@ pnpm run sync:models -- --diff                               # what we override
 Then edit `providers.json` and commit. Keep it **small and curated** — it is an override layer,
 not a mirror of models.dev. Once models.dev catches up, drop the now-redundant override (`--diff`
 flags those).
+
+## Overlay vs. per-user `customModels` — when to use which
+
+There are **two** override layers in WrongStack, for two different audiences:
+
+| Layer | Location | Audience | Purpose |
+|---|---|---|---|
+| **Curated overlay** | `packages/cli/data/providers.json` (this file) | **All users, repo-wide** | Fix upstream errors, add models/providers models.dev doesn't list, remove bad entries (`_removeProviders` / `_removeModels` magic keys). Ships with every release. |
+| **`customModels` config** | `~/.wrongstack/profiles/<name>/config.json` → `providers.<id>.customModels` | **One user, one profile** | Per-user model visibility + per-model metadata overrides (limits, cost, modalities, capability flags) via the WebUI ModelListEditor or TUI `/auth` panel. |
+
+**Decision rule:** if the fix benefits every user of the product (an upstream data error, a brand-new
+model id), it belongs in the **overlay** — commit it here. If it's personal tuning (my context limit,
+my custom endpoint's pricing), it belongs in the user's **`customModels`** config — never here.
+
+Both layers deep-merge one level into `limit` / `cost` / `modalities` objects, and both follow the
+same precedence contract at resolution time:
+
+```
+top-level config.models  >  providers.<id>.customModels  >  overlay  >  models.dev catalog  >  wire-family defaults
+```
+
+The top-level `config.models` record overrides provider-local entries for the same model id
+(`mergeCustomModelDefs` in `packages/core/src/utils/merge-custom-models.ts`). Inline
+models.dev-style objects inside `providers.<id>.models` are normalized into `customModels` at
+config load — they are not a separate runtime layer.
+
+## Catalog cache & boot refresh
+
+The live models.dev catalog is fetched at boot and cached:
+
+- **Cache:** `~/.wrongstack/cache/models.dev.json` (fetched at startup; `--no-models-refresh`
+  skips the network fetch and uses the stale cache).
+- **Overlay cache:** `~/.wrongstack/cache/models-overlay.json` (fetched from GitHub raw; the
+  bundled `providers.json` is the offline floor).
+- Resolution: `merged = mergeModelsPayload(cachedModelsDev, overlay)` — the overlay always wins.
+
+If models.dev is unreachable and no cache exists, a non-empty overlay still drives the catalog
+on its own. Users never edit the cache files — they are regenerated on boot.
+
+## Modalities format (important)
+
+`modalities.input` and `modalities.output` are **plain string arrays**, not objects:
+
+```jsonc
+"modalities": { "input": ["text", "image", "pdf"], "output": ["text"] }
+```
+
+So `modalities.input[0] === "text"` (a string). The known values are `"text" | "image" | "audio" |
+"video" | "pdf"` (see `MODELS_DEV_MODALITY_VALUES` in `packages/core/src/models/models-dev-schema.ts`).
+New upstream values are tolerated at parse time — the schema validates "array of non-empty strings",
+not a closed enum.

package/dist/{auth-NLLGEYQR.js → auth-G5YKKSRH.js}

@@ -13,10 +13,10 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-I2BM6FK6.js";
+} from "./chunk-L5CE52XW.js";
 import {
   parseAuthFlags
-} from "./chunk-JBSQ7ONN.js";
+} from "./chunk-ZNZJ34RF.js";
 import "./chunk-66T43Q4Y.js";
 import "./chunk-GO3TJICK.js";
 import {
@@ -501,4 +501,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-NLLGEYQR.js.map
+//# sourceMappingURL=auth-G5YKKSRH.js.map

package/dist/chimera-reviewer-policy.d.ts

@@ -1,3 +1,4 @@
+import type { ProviderModelStatusTracker } from '@wrongstack/core/coordination';
 import type { SubagentConfig, SubagentError, TaskResult } from '@wrongstack/core/types';
 /**
  * Resolve the fallback-model chain used when spawning the chimera-review
@@ -19,8 +20,14 @@ export declare function __resetReviewerRoundRobinCursor(value?: number): void;
  * Builds the pool from the configured primary + fallback chain, then picks
  * the next entry via round-robin. When the pool has <=1 usable entry the
  * original primary/fallbacks are returned unchanged.
+ *
+ * When a {@link ProviderModelStatusTracker} is supplied, blocked entries
+ * (waiting-room / token-reset-limit room) are filtered from both the pool
+ * and the round-robin pick so a 429-stricken model is never re-spawned on
+ * a concurrent reviewer turn. Without the tracker, the legacy pre-waiting-
+ * room behavior is preserved.
  */
-export declare function assignReviewerModelsRoundRobin(provider: string, model: string, fallbackModels: readonly string[]): {
+export declare function assignReviewerModelsRoundRobin(provider: string, model: string, fallbackModels: readonly string[], statusTracker?: ProviderModelStatusTracker | undefined): {
     provider: string;
     model: string;
     fallbackModels: string[];

package/dist/{chunk-QUNHS6O3.js → chunk-4U3DMA2Y.js}

@@ -1,6 +1,6 @@
 import {
   PLUGIN_AUDIT_ENTRIES
-} from "./chunk-XWEGWYDU.js";
+} from "./chunk-PEKUKUCH.js";
 import {
   patchConfig
 } from "./chunk-TYO2OVAD.js";
@@ -255,4 +255,4 @@ export {
   BUILTIN_PLUGIN_FACTORIES,
   setupPlugins
 };
-//# sourceMappingURL=chunk-QUNHS6O3.js.map
+//# sourceMappingURL=chunk-4U3DMA2Y.js.map

package/dist/{chunk-I2BM6FK6.js → chunk-L5CE52XW.js}

@@ -1,7 +1,7 @@
 import {
   LOCAL_LLM_PRESETS,
   runLiveProviderPicker
-} from "./chunk-JBSQ7ONN.js";
+} from "./chunk-ZNZJ34RF.js";
 import {
   openBrowser,
   runCodexOAuthLogin,
@@ -1327,4 +1327,4 @@ export {
   addKeyForProvider,
   runAuthLocal
 };
-//# sourceMappingURL=chunk-I2BM6FK6.js.map
+//# sourceMappingURL=chunk-L5CE52XW.js.map

package/dist/{chunk-XWEGWYDU.js → chunk-PEKUKUCH.js}

@@ -2,76 +2,9 @@
 // src/plugin-management.ts
 import * as fs from "node:fs/promises";
 import { atomicWrite } from "@wrongstack/core/utils";
-import { OFFICIAL_PLUGIN_AUDIT_ENTRIES } from "@wrongstack/plugins/audit";
-var HOST_PLUGIN_AUDIT_ENTRIES = [
-  {
-    name: "wstack-prompts",
-    risk: "medium",
-    summary: "Prompt library and prompt authoring commands.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "wstack-sync",
-    risk: "medium",
-    summary: "Cloud sync commands for prompts, skills, settings, memory, and history.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "wstack-git",
-    risk: "high",
-    summary: "Git commands for commit, status checks, and push.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "wstack-observability",
-    risk: "low",
-    summary: "Runtime metrics and health slash commands.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "wstack-chimera",
-    risk: "medium",
-    summary: "Spawns a post-session code review subagent when explicitly enabled.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "wstack-skills",
-    risk: "medium",
-    summary: "Skill library, authoring, install, update, and uninstall commands.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "wstack-plan",
-    risk: "medium",
-    summary: "Strategic plan board slash command.",
-    defaultState: "active",
-    canDisable: true
-  },
-  {
-    name: "@wrongstack/plug-lsp",
-    risk: "medium",
-    summary: "Language Server Protocol tools and slash commands.",
-    defaultState: "inactive",
-    canDisable: true
-  },
-  {
-    name: "telegram",
-    risk: "medium",
-    summary: "Telegram bridge for messages, approvals, and notifications.",
-    defaultState: "inactive",
-    canDisable: true
-  }
-];
-var PLUGIN_AUDIT_ENTRIES = Object.freeze([
-  ...HOST_PLUGIN_AUDIT_ENTRIES,
-  ...OFFICIAL_PLUGIN_AUDIT_ENTRIES
-]);
+import {
+  PLUGIN_AUDIT_ENTRIES
+} from "@wrongstack/plugins/plugin-audit-catalog";
 var OFFICIAL_PLUGINS = [
   {
     alias: "telegram",
@@ -557,4 +490,4 @@ export {
   PLUGIN_AUDIT_ENTRIES,
   runPluginManagementCommand
 };
-//# sourceMappingURL=chunk-XWEGWYDU.js.map
+//# sourceMappingURL=chunk-PEKUKUCH.js.map

package/dist/{chunk-JBSQ7ONN.js → chunk-ZNZJ34RF.js}

@@ -1020,4 +1020,4 @@ export {
   runLiveProviderPicker,
   runPicker
 };
-//# sourceMappingURL=chunk-JBSQ7ONN.js.map
+//# sourceMappingURL=chunk-ZNZJ34RF.js.map