@wrongstack/cli 0.299.0 → 0.301.0

package/dist/auth-menu/openai-codex-oauth.d.ts

@@ -1,138 +1,51 @@
 /**
- * OpenAI Codex — "Sign in with ChatGPT" OAuth (Authorization Code + PKCE).
+ * OpenAI Codex — "Sign in with ChatGPT", terminal flow.
  *
- * This is the ONLY login flow that actually works for using a ChatGPT
- * Plus/Pro/Team subscription programmatically. It mirrors the real Codex CLI:
+ * This module is now only the *terminal* half of the login: the rendered
+ * instructions, the SIGINT / TUI-signal cancellation contract, the
+ * manual-paste prompt, and writing the resulting tokens into the encrypted
+ * profile config.
  *
- *   1. Generate a PKCE verifier/challenge (S256) + CSRF state.
- *   2. Start a loopback HTTP server on http://localhost:1455/auth/callback.
- *   3. Open the browser to https://auth.openai.com/oauth/authorize.
- *   4. The browser redirects back to the loopback with `?code=...&state=...`.
- *   5. Exchange the code at https://auth.openai.com/oauth/token for an
- *      access_token + refresh_token (and an id_token carrying the account id).
- *   6. Store the tokens in the vault as an `oauth` ProviderApiKey.
+ * The protocol itself — client id, endpoints, PKCE, the authorize URL, the
+ * token exchange and refresh, the JWT account-id claim, and model discovery —
+ * lives in `@wrongstack/providers/oauth`. It used to live here AND in
+ * `providers/src/oauth/chatgpt.ts` (the headless WebUI flow) AND in
+ * `providers/src/openai-codex.ts` (the runtime refresh path), whose header
+ * said outright that it was mirroring this file.
  *
- * The resulting access token is a JWT whose `https://api.openai.com/auth`
- * claim contains `chatgpt_account_id`. Requests then go to the ChatGPT
- * backend (`chatgpt.com/backend-api/codex/responses`) — NOT api.openai.com —
- * which is what the `openai-codex` wire family handles. The standard
- * API-key flow (`family: openai` → api.openai.com/chat/completions) is left
- * completely untouched.
+ * Three copies is what let the OAuth abort-listener leak sit in two of them
+ * while a third flow in this same directory was already correct — nothing
+ * forced them to agree, so a fix applied to one silently left the others
+ * broken. A rotated client id or a changed token-endpoint contract carries the
+ * same risk, with the failure being "one surface stops authenticating" rather
+ * than a compile error.
  *
- * NOTE: a ChatGPT web *session cookie* is NOT an API token. The old
- * device-code + cookie-scraping attempts could never produce a usable
- * credential; this module replaces them.
+ * The protocol constants live in `providers` (not here) because the dependency
+ * edge runs `cli → providers → core`: the runtime provider needs them to
+ * refresh a token and must never import from `cli`.
+ *
+ * Everything the protocol layer defines is re-exported below, so existing
+ * importers (`auth-menu/index.ts`, `wiring/provider.ts`, the CLI tests) keep
+ * working against this module unchanged.
  */
+import { buildCodexAuthorizeUrl, exchangeCodexAuthorizationCode, refreshCodexTokens } from '@wrongstack/providers/oauth';
 import { type LoopbackServer } from './loopback-server.js';
-import { type ModelsRegistry } from '@wrongstack/core/types';
 import type { AuthMenuDeps } from './types.js';
-/** Canonical provider id under which ChatGPT-login credentials are stored. */
-export declare const CODEX_PROVIDER_ID = "openai-codex";
-/** Default ChatGPT backend base. The wire family appends `/codex/responses`. */
-export declare const CODEX_BASE_URL = "https://chatgpt.com/backend-api";
-/**
- * Codex-specific compatibility wrapper retained for callers that imported the
- * helper from this module before the shared OAuth loopback server extraction.
- */
-export declare function startLoopbackServer(expectedState: string, signal?: AbortSignal): Promise<LoopbackServer>;
-/**
- * Fallback model list used when BOTH the live backend AND the models.dev
- * catalog are unreachable. This should never happen in practice — the
- * catalog is cached locally and the only scenario where both fail is a
- * fresh install with no network on first login.
- *
- * The primary resolution order in `resolveCodexModels()` is:
- *  1. Live backend (`GET /models`)
- *  2. models.dev catalog (`family: gpt-codex*` under `openai` provider)
- *  3. This inline fallback
- */
-export interface CodexTokens {
-    access: string;
-    refresh: string;
-    /** Absolute expiry in epoch milliseconds. */
-    expires: number;
-    idToken?: string | undefined;
-}
-export interface Pkce {
-    verifier: string;
-    challenge: string;
-}
-/** Generate a PKCE verifier + S256 challenge. */
-export declare function generatePkce(): Pkce;
-/** Build the full authorize URL with all Codex-required query params. */
-export declare function buildAuthorizeUrl(challenge: string, state: string, port?: number): string;
-/**
- * Extract `chatgpt_account_id` from an access/id token JWT. Returns null when
- * the token isn't a JWT or lacks the claim (the caller decides whether that
- * is fatal — for login it is; for a cached display value it isn't).
- */
-export declare function extractAccountId(token: string): string | null;
-/**
- * Recommended Codex models for ChatGPT sign-in. Live backend discovery
- * wins; these values are only used when the backend/catalog cannot
- * provide a list. Derived from `CODEX_MODELS` in core (the single source of
- * truth for Codex id/name/description) — used both by OAuth login
- * (resolveCodexModels → tier 3) and by the provider-boot synthesis
- * path (wiring/provider.ts when the catalog is unavailable).
- */
-export declare const FALLBACK_CODEX_MODELS: ReadonlyArray<{
-    id: string;
-    name: string;
-}>;
-/** Families in the models.dev catalog that indicate Codex / Responses API compatibility. */
-export declare const CODEX_CATALOG_FAMILIES: Set<string>;
-export declare function fallbackCodexModelIds(): string[];
-export declare function fallbackCodexProviderModels(): Array<{
-    id: string;
-    name: string;
-}>;
-/**
- * Filter a list of available model ids down to the ones that are still
- * current for ChatGPT sign-in (i.e. present in FALLBACK_CODEX_MODELS).
- * Used by both OAuth login (to drop deprecated ids from the live /models
- * response) and by the provider-boot synthesis (to pick current ids out
- * of the models.dev catalog).
- */
-export declare function filterCurrentCodexModelIds(ids: Iterable<string>): string[];
-export declare function isCodexCatalogModel(model: {
-    family?: string | undefined;
-}): boolean;
-/**
- * Resolve the list of available Codex models using a 3-tier fallback chain:
- *
- *  1. **Live backend** — `fetchCodexModels()` hits `GET <baseUrl>/models`
- *     and keeps only current Codex model ids.
- *  2. **models.dev catalog** — queries the `openai` provider in the cached
- *     models.dev registry and picks models whose `family` is `gpt-codex` or
- *     `gpt-codex-spark` and whose ids are current for ChatGPT sign-in.
- *  3. **Inline fallback** — a minimal list of documented mainstream models
- *     (`gpt-5.6-sol`, `gpt-5.5`, `gpt-5.6-terra`, `gpt-5.6-luna`,
- *     `gpt-5.4`, `gpt-5.4-mini`, `gpt-5.3-codex-spark`).
- *
- * The live/catalog tiers gate account availability, while the shared current
- * model list filters out deprecated ChatGPT sign-in ids before config is saved.
- */
-export declare function resolveCodexModels(modelsRegistry: ModelsRegistry, accessToken: Promise<string> | string, baseUrl?: string | undefined, signal?: AbortSignal): Promise<string[]>;
+export { CODEX_BASE_URL, CODEX_CATALOG_FAMILIES, CODEX_PROVIDER_ID, type CodexTokens, extractAccountId, FALLBACK_CODEX_MODELS, fallbackCodexModelIds, fallbackCodexProviderModels, fetchCodexModels, filterCurrentCodexModelIds, generatePkce, isCodexCatalogModel, parseAuthorizationInput, type Pkce, resolveCodexModels, } from '@wrongstack/providers/oauth';
+/** Build the Codex authorize URL. Alias kept for the historical local name. */
+export declare const buildAuthorizeUrl: typeof buildCodexAuthorizeUrl;
+/** Exchange an authorization code (+ PKCE verifier) for tokens. */
+export declare const exchangeAuthorizationCode: typeof exchangeCodexAuthorizationCode;
 /**
- * Fetch the account's available Codex model ids live from the ChatGPT backend.
- *
- * Hits `GET <baseUrl>/models` — the standard OpenAI-compatible model listing
- * endpoint, which the Codex backend may expose. Best-effort: returns an empty
- * array on any failure so login still succeeds with the hardcoded fallback.
+ * Refresh an expired access token. Alias kept for the historical local name;
+ * `wiring/provider.ts` and the CLI tests import it from here.
  */
-export declare function fetchCodexModels(accessToken: string, baseUrl?: string | undefined, signal?: AbortSignal): Promise<string[]>;
-/** Exchange an authorization code (+ PKCE verifier) for tokens. */
-export declare function exchangeAuthorizationCode(code: string, verifier: string, signal?: AbortSignal, port?: number): Promise<CodexTokens>;
+export declare const refreshCodexToken: typeof refreshCodexTokens;
 /**
- * Refresh an expired access token using the stored refresh token. Exported for
- * the `openai-codex` provider, which calls it transparently before requests.
+ * Codex-specific loopback wrapper. Stays CLI-side because this flow pairs it
+ * with {@link openBrowser}, which is terminal-only.
  */
-export declare function refreshCodexToken(refreshToken: string, signal?: AbortSignal): Promise<CodexTokens>;
-/** Parse a pasted authorization code or full redirect URL into { code, state }. */
-export declare function parseAuthorizationInput(input: string): {
-    code?: string | undefined;
-    state?: string | undefined;
-};
+export declare function startLoopbackServer(expectedState: string, signal?: AbortSignal): Promise<LoopbackServer>;
 export interface CodexLoginOptions {
     /** Storage provider id. Defaults to the canonical `openai-codex`. */
     providerId?: string;

package/dist/auto-discover-providers-DRW4OZHG.js

@@ -0,0 +1,8 @@
+import {
+  discoverAndMergeProviders
+} from "./chunk-4GVH7V3S.js";
+import "./chunk-7OCVIDC7.js";
+export {
+  discoverAndMergeProviders
+};
+//# sourceMappingURL=auto-discover-providers-DRW4OZHG.js.map

package/dist/boot/dispatch-webui.d.ts

@@ -22,6 +22,7 @@ import type { Config, MemoryPort, ModelsRegistry, ModeStore, SessionStore, Sessi
 import type { MCPRegistry } from '@wrongstack/mcp';
 import type { TerminalRenderer } from '../renderer.js';
 import type { AutonomyMode } from '../services/autonomy-mode.js';
+import type { CliWebUIOptions } from '../webui-server-options.js';
 export interface WebUIDispatchContext {
     agent: Agent;
     events: EventBus;
@@ -96,6 +97,8 @@ export interface WebUIDispatchContext {
             error?: string | undefined;
         }) => void | Promise<void>) | undefined;
     }) => Promise<string>) | undefined;
+    /** Live fleet budget for WebUI concurrency/spawn gauges (issue #323). */
+    getFleetBudget?: CliWebUIOptions['getFleetBudget'];
 }
 /**
  * Run the WebUI server and block until it shuts down.

package/dist/boot/launch-menu.d.ts

@@ -50,13 +50,11 @@ declare const DEFAULT_PORTS: Record<Exclude<LaunchMenuMode, 'tui-repl'>, number>
  *   - `--webui`, `--simpleui`, `--hq`, or `--desktop` flag is set
  *     (the user already chose a surface)
  *   - stdin is not a TTY (CI, pipes, redirects)
- *   - the first positional looks like a known subcommand (auth,
- *     init, mcp, plugin, doctor, version, help, …)
  *   - `--no-interactive` or `--skip` (existing "skip all prompts"
  *     contract from boot.ts)
  *   - a one-shot prompt (`--prompt <x>`) is supplied
- *   - any positional argument is present (treats it like the user
- *     is forwarding a one-shot query, not launching a surface)
+ *   - ANY positional argument is present — a subcommand or a one-shot
+ *     query. The user already said what they wanted.
  */
 export declare function shouldSkipMenu(argv: string[], flags: Record<string, string | boolean>, positional: string[]): boolean;
 interface RunLaunchMenuDeps {

package/dist/boot/tool-registry.d.ts

@@ -15,6 +15,9 @@ interface RegisterBuiltinToolsDeps {
             descriptionMode?: ToolDescriptionModeConfig | undefined;
             resultRenderMode?: ToolResultRenderModeConfig | undefined;
             disabledTools?: string[] | undefined;
+            nextsteps?: {
+                enabled?: boolean | undefined;
+            } | undefined;
             exec?: {
                 allow?: string[] | undefined;
                 deny?: string[] | undefined;

package/dist/chimera-reviewer-policy.d.ts

@@ -17,9 +17,10 @@ export declare function __resetReviewerRoundRobinCursor(value?: number): void;
 /**
  * Assign provider/model/fallbackModels for a Chimera reviewer spawn.
  *
- * Builds the pool from the configured primary + fallback chain, then picks
- * the next entry via round-robin. When the pool has <=1 usable entry the
- * original primary/fallbacks are returned unchanged.
+ * Builds the pool from the configured primary + fallback chain, then chooses
+ * either the next round-robin entry or a random starting entry. The injected
+ * random source keeps the random policy deterministic in tests. When the pool
+ * has <=1 usable entry the original primary/fallbacks are returned unchanged.
  *
  * When a {@link ProviderModelStatusTracker} is supplied, blocked entries
  * (waiting-room / token-reset-limit room) are filtered from both the pool
@@ -27,6 +28,12 @@ export declare function __resetReviewerRoundRobinCursor(value?: number): void;
  * a concurrent reviewer turn. Without the tracker, the legacy pre-waiting-
  * room behavior is preserved.
  */
+export declare function assignReviewerModels(provider: string, model: string, fallbackModels: readonly string[], selection?: 'round-robin' | 'random', statusTracker?: ProviderModelStatusTracker | undefined, random?: () => number): {
+    provider: string;
+    model: string;
+    fallbackModels: string[];
+};
+/** Backward-compatible round-robin entry point for existing callers. */
 export declare function assignReviewerModelsRoundRobin(provider: string, model: string, fallbackModels: readonly string[], statusTracker?: ProviderModelStatusTracker | undefined): {
     provider: string;
     model: string;

package/dist/chimera-work-registry.d.ts

@@ -0,0 +1,19 @@
+export interface ChimeraWorkRegistry {
+    /** Track one review/cascade promise until it settles. */
+    track(work: Promise<void>): boolean;
+    /** Snapshot currently pending work for parent-before-child ordering. */
+    pending(): Promise<void> | undefined;
+    /** Stop accepting new roots after draining all accepted work to a fixed point. */
+    drainAndClose(): Promise<void>;
+    readonly size: number;
+}
+/**
+ * Session-scoped registry for Chimera review and cascade work.
+ *
+ * A single Promise slot loses overlapping reviews. A single Promise.all snapshot
+ * can also miss cascades or re-reviews registered while an earlier batch is
+ * settling. This registry retains every accepted promise and drains repeatedly
+ * until no accepted work remains, then seals admission.
+ */
+export declare function createChimeraWorkRegistry(): ChimeraWorkRegistry;
+//# sourceMappingURL=chimera-work-registry.d.ts.map

package/dist/{chronicle-QQEQFSSE.js → chronicle-63MFCZN6.js}

@@ -2,8 +2,12 @@ import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/chronicle.ts
 import { statSync } from "node:fs";
+import path from "node:path";
 import {
-  createChronicleProjectAccess
+  chronicleProjectServerMetadataPath,
+  compactChronicleSqlite,
+  createChronicleProjectAccess,
+  resolveChronicleProjectServerOptions
 } from "@wrongstack/core/chronicle";
 var facets = /* @__PURE__ */ new Set([
   "eventType",
@@ -26,6 +30,22 @@ var chronicleCmd = async (args, deps) => {
   }
   let access;
   try {
+    if (operation === "compact") {
+      if (args.length !== 1) {
+        throw new Error("Usage: wstack chronicle compact (stop the Chronicle daemon first)");
+      }
+      const resolved = resolveChronicleProjectServerOptions({
+        projectRoot: deps.projectRoot,
+        userHome: deps.userHome
+      });
+      const result2 = compactChronicleSqlite({
+        dbPath: path.join(resolved.projectDir, "chronicle", "chronicle.sqlite"),
+        endpointMetadataPath: chronicleProjectServerMetadataPath(resolved.projectDir)
+      });
+      deps.renderer.write(`${JSON.stringify(result2, null, 2)}
+`);
+      return 0;
+    }
     access = createChronicleProjectAccess({
       projectRoot: deps.projectRoot,
       userHome: deps.userHome
@@ -60,9 +80,10 @@ var chronicleCmd = async (args, deps) => {
       return 0;
     }
     if (operation === "prune") {
-      const dryRun = args.includes("--dry-run") || args.includes("-n");
+      const flags = deps.flags ?? {};
+      const dryRun = args.includes("--dry-run") || args.includes("-n") || flags["dry-run"] === true || flags["dry-run"] === "true" || flags["n"] === true;
       const daysIndex = args.indexOf("--days");
-      const rawDays = daysIndex >= 0 && daysIndex + 1 < args.length ? args[daysIndex + 1] : void 0;
+      const rawDays = daysIndex >= 0 && daysIndex + 1 < args.length ? args[daysIndex + 1] : typeof flags["days"] === "string" ? flags["days"] : void 0;
       const days = rawDays ? parseInt(rawDays, 10) : 30;
       if (!Number.isFinite(days) || days < 1) {
         deps.renderer.writeError(
@@ -235,7 +256,7 @@ function parseValue(value) {
   }
 }
 function usage() {
-  return "Usage:\n  wstack chronicle query [field=value ...]\n  wstack chronicle status\n  wstack chronicle facet <field> [field=value ...]\n  wstack chronicle metrics [providers|tasks|files|summary] [field=value ...]\n  wstack chronicle prune [--days N] [--dry-run]\n\nExamples:\n  wstack chronicle status\n  wstack chronicle query path=src/app.ts line=42\n  wstack chronicle query providerId=openai outcome=failure\n  wstack chronicle query eventType=tool.executed sessionId=<id> limit=50\n  wstack chronicle query attr.tool.name=read\n  wstack chronicle facet modelId from=2026-07-01T00:00:00Z\n  wstack chronicle metrics providers from=2026-07-01\n  wstack chronicle metrics files path=src/app.ts\n  wstack chronicle metrics tasks limit=20\n  wstack chronicle prune --days 7 --dry-run\n  wstack chronicle prune --days 30\n";
+  return "Usage:\n  wstack chronicle query [field=value ...]\n  wstack chronicle status\n  wstack chronicle facet <field> [field=value ...]\n  wstack chronicle metrics [providers|tasks|files|summary] [field=value ...]\n  wstack chronicle prune [--days N] [--dry-run]\n  wstack chronicle compact\n\nExamples:\n  wstack chronicle status\n  wstack chronicle query path=src/app.ts line=42\n  wstack chronicle query providerId=openai outcome=failure\n  wstack chronicle query eventType=tool.executed sessionId=<id> limit=50\n  wstack chronicle query attr.tool.name=read\n  wstack chronicle facet modelId from=2026-07-01T00:00:00Z\n  wstack chronicle metrics providers from=2026-07-01\n  wstack chronicle metrics files path=src/app.ts\n  wstack chronicle metrics tasks limit=20\n  wstack chronicle prune --days 7 --dry-run\n  wstack chronicle prune --days 30\n  wstack chronicle compact\n";
 }
 function formatBytes(bytes) {
   if (bytes < 1024) return `${bytes} B`;
@@ -253,4 +274,4 @@ function tryStat(file) {
 export {
   chronicleCmd
 };
-//# sourceMappingURL=chronicle-QQEQFSSE.js.map
+//# sourceMappingURL=chronicle-63MFCZN6.js.map

package/dist/{chunk-YWUPHRGB.js → chunk-263G3FMB.js}

@@ -80,20 +80,40 @@ async function safeDelete(filePath) {
     }
   }
 }
+var REDACTED = "[REDACTED]";
+function maskValue(v) {
+  if (Array.isArray(v)) return v.map(maskValue);
+  if (typeof v === "object" && v !== null) return maskConfigSecrets(v);
+  return v;
+}
 function maskConfigSecrets(cfg) {
   if (typeof cfg !== "object" || cfg === null) return {};
   const out = {};
   for (const [k, v] of Object.entries(cfg)) {
     if (isSecretField(k)) {
-      out[k] = "[REDACTED]";
-    } else if (typeof v === "object" && v !== null && !Array.isArray(v)) {
-      out[k] = maskConfigSecrets(v);
+      out[k] = REDACTED;
     } else {
-      out[k] = v;
+      out[k] = maskValue(v);
     }
   }
   return out;
 }
+function reviveSecrets(masked, current) {
+  if (masked === REDACTED) return current;
+  if (Array.isArray(masked)) {
+    const cur = Array.isArray(current) ? current : [];
+    return masked.map((item, i) => reviveSecrets(item, cur[i]));
+  }
+  if (typeof masked !== "object" || masked === null) return masked;
+  const curObj = typeof current === "object" && current !== null && !Array.isArray(current) ? current : {};
+  const out = {};
+  for (const [k, v] of Object.entries(masked)) {
+    const revived = reviveSecrets(v, curObj[k]);
+    if (revived === void 0) continue;
+    out[k] = revived;
+  }
+  return out;
+}
 function diffSummary(oldCfg, newCfg) {
   const changes = [];
   const allKeys = /* @__PURE__ */ new Set([...Object.keys(oldCfg), ...Object.keys(newCfg)]);
@@ -199,7 +219,7 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
   }
   if (content !== void 0) {
     try {
-      await atomicWrite(last, content);
+      await atomicWrite(last, content, { mode: 384 });
     } catch (err) {
       writeErr(
         `[config-history] .last backup failed: ${toErrorMessage(err)}`
@@ -209,7 +229,7 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
   if (content !== void 0) {
     try {
       const bakPath = `${cfg}.${ts}.bak`;
-      await atomicWrite(bakPath, content);
+      await atomicWrite(bakPath, content, { mode: 384 });
     } catch (err) {
       writeErr(
         `[config-history] timestamped backup failed: ${toErrorMessage(err)}`
@@ -244,7 +264,7 @@ async function appendHistory(oldCfg, newCfg, description, homeFn = defaultHomeDi
     await fs.writeFile(
       path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
       JSON.stringify(entry, null, 2),
-      "utf8"
+      { encoding: "utf8", mode: 384 }
     );
   } catch (err) {
     throw new FsError({
@@ -292,14 +312,17 @@ async function restoreFromHistory(id, homeFn = defaultHomeDir, targetConfigPath)
     oldCfg = JSON.parse(raw);
   } catch {
   }
+  const restored = reviveSecrets(entry.snapshotMasked, oldCfg);
   try {
-    await atomicWrite(configPath(homeFn, targetConfigPath), JSON.stringify(entry.snapshotMasked, null, 2));
+    await atomicWrite(configPath(homeFn, targetConfigPath), JSON.stringify(restored, null, 2), {
+      mode: 384
+    });
   } catch (err) {
     return { ok: false, backupId: null, error: String(err) };
   }
   const backupId = await appendHistory(
     oldCfg,
-    entry.snapshotMasked,
+    restored,
     `Restored from history ${id}`,
     homeFn,
     targetConfigPath
@@ -343,4 +366,4 @@ export {
   restoreFromHistory,
   restoreLast
 };
-//# sourceMappingURL=chunk-YWUPHRGB.js.map
+//# sourceMappingURL=chunk-263G3FMB.js.map