@wrongstack/cli 0.3.3 → 0.3.7

package/dist/index.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 import { color, allServers, DefaultPathResolver, TOKENS, DefaultSystemPromptBuilder, ToolRegistry, createContextManagerTool, EventBus, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, SlashCommandRegistry, loadPlugins, createDelegateTool, FLEET_ROSTER, DefaultLogger, DefaultModelsRegistry, DefaultSessionStore, DefaultSkillLoader, ProviderRegistry, RecoveryLock, DefaultAttachmentStore, QueueStore, Context, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, loadPlan, createDefaultPipelines, AutoCompactionMiddleware, Agent, makeDirectorSessionFactory, Director, DefaultMultiAgentCoordinator, makeAgentSubagentRunner, resolveWstackPaths, DefaultSecretVault, migratePlaintextSecrets, DefaultConfigLoader, DefaultSessionReader, atomicWrite, AutoApprovePermissionPolicy, formatContextWindowModeList, repairToolUseAdjacency, getContextWindowMode, resolveContextWindowPolicy, formatTodosList, emptyPlan, clearPlan, savePlan, removePlanItem, formatPlan, setPlanItemStatus, addPlanItem, InputBuilder, decryptConfigSecrets, encryptConfigSecrets, DefaultPluginAPI } from '@wrongstack/core';
-import * as fs3 from 'fs/promises';
+import * as crypto from 'crypto';
+import { randomUUID } from 'crypto';
+import * as fs14 from 'fs/promises';
 import { WebSocketServer, WebSocket } from 'ws';
 import { writeFileSync } from 'fs';
 import { createRequire } from 'module';
@@ -8,11 +10,9 @@ import * as path14 from 'path';
 import { MCPRegistry } from '@wrongstack/mcp';
 import { buildProviderFactoriesFromRegistry, makeProviderFromConfig, capabilitiesFor } from '@wrongstack/providers';
 import { createDefaultContainer, routeImagesForModel, readClipboardImage } from '@wrongstack/runtime';
-import { rememberTool, forgetTool } from '@wrongstack/tools';
-import { builtinToolsPack } from '@wrongstack/tools/pack';
+import { builtinToolsPack, rememberTool, forgetTool } from '@wrongstack/tools';
 import * as os3 from 'os';
 import * as readline from 'readline';
-import { randomUUID } from 'crypto';
 import { createToolVisionAdapters } from '@wrongstack/runtime/vision';
 
 var __defProp = Object.defineProperty;
@@ -75,8 +75,10 @@ async function runWebUI(opts) {
   const port = opts.port ?? 3457;
   const clients = /* @__PURE__ */ new Map();
   let abortController = null;
+  const authToken = crypto.randomBytes(16).toString("hex");
   const wss = new WebSocketServer({ port, host: "127.0.0.1" });
   console.log(`[WebUI] WebSocket server starting on ws://localhost:${port}`);
+  console.log(`[WebUI] Auth token: ${authToken}`);
   const eventUnsubscribers = [];
   function setupEvents() {
     for (const unsub of eventUnsubscribers) unsub();
@@ -176,7 +178,32 @@ async function runWebUI(opts) {
       console.log(`[WebUI] WebSocket server running on ws://localhost:${port}`);
       setupEvents();
     });
-    wss.on("connection", (ws) => {
+    wss.on("connection", (ws, req2) => {
+      const isLoopback = (hostname) => hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+      try {
+        const url = new URL(req2.url ?? "/", `http://localhost:${port}`);
+        const token = url.searchParams.get("token");
+        const tokenOk = token === authToken;
+        const origin = req2.headers.origin;
+        if (origin) {
+          try {
+            const { hostname } = new URL(origin);
+            if (!isLoopback(hostname) && !tokenOk) {
+              ws.close(4003, "Forbidden: non-loopback origin requires auth token");
+              return;
+            }
+          } catch {
+            ws.close(4003, "Forbidden: invalid origin");
+            return;
+          }
+        } else {
+          if (!tokenOk) {
+          }
+        }
+      } catch {
+        ws.close(4001, "Unauthorized: malformed request");
+        return;
+      }
       const client = { ws, sessionId: opts.session.id };
       clients.set(ws, client);
       console.log("[WebUI] Client connected");
@@ -197,7 +224,8 @@ async function runWebUI(opts) {
         payload: {
           sessionId: opts.session.id,
           model: opts.agent.ctx.model,
-          provider: opts.agent.ctx.provider.id
+          provider: opts.agent.ctx.provider.id,
+          wsToken: authToken
         }
       });
     });
@@ -519,7 +547,7 @@ async function runWebUI(opts) {
     if (!opts.globalConfigPath) return {};
     let raw;
     try {
-      raw = await fs3.readFile(opts.globalConfigPath, "utf8");
+      raw = await fs14.readFile(opts.globalConfigPath, "utf8");
     } catch {
       return {};
     }
@@ -535,7 +563,7 @@ async function runWebUI(opts) {
     if (!opts.globalConfigPath) return;
     let raw;
     try {
-      raw = await fs3.readFile(opts.globalConfigPath, "utf8");
+      raw = await fs14.readFile(opts.globalConfigPath, "utf8");
     } catch {
       raw = "{}";
     }
@@ -570,216 +598,6 @@ var init_plugin_api_factory = __esm({
   "src/plugin-api-factory.ts"() {
   }
 });
-async function setupProvider(params) {
-  const { config, modelsRegistry, logger } = params;
-  const savedProviderCfg = config.providers?.[config.provider];
-  let resolvedProvider = await modelsRegistry.getProvider(config.provider).catch(() => void 0);
-  if (!resolvedProvider && savedProviderCfg?.type && savedProviderCfg.type !== config.provider) {
-    resolvedProvider = await modelsRegistry.getProvider(savedProviderCfg.type).catch(() => void 0);
-  }
-  if (!resolvedProvider) {
-    if (!savedProviderCfg?.family) {
-      logger.warn(
-        `Provider "${config.provider}" not found in models.dev. Continuing with raw config.`
-      );
-    }
-  } else if (resolvedProvider.family === "unsupported" && !savedProviderCfg?.family) {
-    throw Object.assign(
-      new Error(
-        `Provider "${config.provider}" uses an unsupported wire family (${resolvedProvider.npm}). Install a plugin to enable it, or pick a different provider.`
-      ),
-      { code: "UNSUPPORTED_PROVIDER" }
-    );
-  }
-  const providerRegistry = new ProviderRegistry();
-  if (config.features.modelsRegistry) {
-    try {
-      const factories = await buildProviderFactoriesFromRegistry({
-        registry: modelsRegistry,
-        log: logger
-      });
-      for (const f of factories) providerRegistry.register(f);
-    } catch (err) {
-      throw new Error(
-        `Failed to load models.dev registry: ${err instanceof Error ? err.message : err}
-Try \`wstack models refresh\` once you have network access, or run with --no-features.`
-      );
-    }
-  }
-  const providerConfig = config.providers?.[config.provider] ?? {
-    type: config.provider,
-    apiKey: config.apiKey,
-    baseUrl: config.baseUrl
-  };
-  let provider;
-  try {
-    const cfgWithType = { ...providerConfig, type: config.provider };
-    if (config.features.modelsRegistry && providerRegistry.has(config.provider)) {
-      provider = providerRegistry.create(cfgWithType);
-    } else {
-      provider = makeProviderFromConfig(config.provider, cfgWithType);
-    }
-  } catch (err) {
-    throw new Error(
-      `Failed to create provider: ${err instanceof Error ? err.message : err}`
-    );
-  }
-  return { resolvedProvider, provider, providerRegistry };
-}
-async function setupSession(params) {
-  const { config, wpaths, projectRoot, cwd, sessionStore, systemPrompt, provider, tokenCounter, renderer, flags, onRecovery } = params;
-  let resumeId = typeof flags["resume"] === "string" ? flags["resume"] : void 0;
-  const recoveryLock = new RecoveryLock({ dir: wpaths.projectSessions, sessionStore });
-  if (!resumeId && !flags["no-recovery"]) {
-    const abandoned = await recoveryLock.checkAbandoned();
-    if (abandoned && abandoned.messageCount > 0) {
-      const choice = await onRecovery(abandoned, !!flags["recover"]);
-      if (choice === "resume") resumeId = abandoned.sessionId;
-      else if (choice === "delete") {
-        await sessionStore.delete(abandoned.sessionId).catch(() => void 0);
-        await recoveryLock.clear();
-      } else await recoveryLock.clear();
-    } else if (abandoned) {
-      await sessionStore.delete(abandoned.sessionId).catch(() => void 0);
-      await recoveryLock.clear();
-    }
-  }
-  let session;
-  let restoredMessages = [];
-  if (resumeId) {
-    try {
-      const resumed = await sessionStore.resume(resumeId);
-      session = resumed.writer;
-      restoredMessages = resumed.data.messages;
-      renderer.writeInfo(`Resumed session ${resumed.data.metadata.id} \u2014 ${restoredMessages.length} messages, ${resumed.data.usage.input + resumed.data.usage.output} tokens used previously.`);
-    } catch (err) {
-      renderer.writeError(`Resume failed: ${err instanceof Error ? err.message : String(err)}`);
-      throw Object.assign(new Error("RESUME_FAILED"), { exitCode: 2 });
-    }
-  } else {
-    session = await sessionStore.create({ id: "", title: "", model: config.model, provider: config.provider });
-  }
-  const sessionRef = { current: session };
-  await recoveryLock.write(session.id).catch(() => void 0);
-  const attachments = new DefaultAttachmentStore({ spoolDir: path14.join(wpaths.projectSessions, session.id, "attachments") });
-  const queueStore = new QueueStore({ dir: path14.join(wpaths.projectSessions, session.id) });
-  const ctxSignal = new AbortController().signal;
-  const context = new Context({ systemPrompt, provider, session, signal: ctxSignal, tokenCounter, cwd, projectRoot, model: config.model });
-  if (restoredMessages.length > 0) context.state.replaceMessages(restoredMessages);
-  const todosCheckpointPath = path14.join(wpaths.projectSessions, `${session.id}.todos.json`);
-  if (resumeId) {
-    try {
-      const restoredTodos = await loadTodosCheckpoint(todosCheckpointPath);
-      if (restoredTodos && restoredTodos.length > 0) {
-        context.state.replaceTodos(restoredTodos);
-        renderer.writeInfo(`Restored ${restoredTodos.length} todo${restoredTodos.length === 1 ? "" : "s"} from previous run.`);
-      }
-    } catch {
-    }
-  }
-  const detachTodosCheckpoint = attachTodosCheckpoint(context.state, todosCheckpointPath, session.id);
-  const planPath = path14.join(wpaths.projectSessions, `${session.id}.plan.json`);
-  context.state.setMeta("plan.path", planPath);
-  if (resumeId) {
-    try {
-      const fleetRoot = path14.join(wpaths.projectSessions, session.id);
-      const dirState = await loadDirectorState(path14.join(fleetRoot, "director-state.json"));
-      if (dirState) {
-        const tCounts = {};
-        for (const t of dirState.tasks) tCounts[t.status] = (tCounts[t.status] ?? 0) + 1;
-        const summary = Object.entries(tCounts).map(([k, v]) => `${v} ${k}`).join(", ");
-        renderer.writeInfo(`Prior fleet state: ${dirState.subagents.length} subagent${dirState.subagents.length === 1 ? "" : "s"}, tasks ${summary || "(none)"}.`);
-      }
-    } catch {
-    }
-    try {
-      const plan = await loadPlan(planPath);
-      if (plan && plan.items.length > 0) {
-        const open = plan.items.filter((p) => p.status !== "done").length;
-        const done = plan.items.length - open;
-        renderer.writeInfo(`Plan: ${plan.items.length} item${plan.items.length === 1 ? "" : "s"} (${open} open, ${done} done). Use /plan to review.`);
-      }
-    } catch {
-    }
-  }
-  return { session, sessionRef, context, restoredMessages, attachments, recoveryLock, queueStore, planPath, detachTodosCheckpoint };
-}
-function setupPipelines(params) {
-  const { events, logger } = params;
-  const pipelines = createDefaultPipelines();
-  const installBoundary = (p) => {
-    p.setErrorHandler((ev) => {
-      const fromPlugin = !!ev.owner && ev.owner !== "core";
-      logger.error(
-        `Pipeline middleware "${ev.middleware}" crashed (owner=${ev.owner ?? "unknown"}); ${fromPlugin ? "swallowed" : "rethrown"}`,
-        ev.err
-      );
-      events.emit("error", {
-        err: ev.err instanceof Error ? ev.err : new Error(String(ev.err)),
-        phase: `pipeline:${ev.middleware}`
-      });
-      return fromPlugin ? "swallow" : "rethrow";
-    });
-  };
-  installBoundary(pipelines.request);
-  installBoundary(pipelines.response);
-  installBoundary(pipelines.toolCall);
-  installBoundary(pipelines.userInput);
-  installBoundary(pipelines.assistantOutput);
-  installBoundary(pipelines.contextWindow);
-  return pipelines;
-}
-async function setupCompaction(params) {
-  const { compactor, events, modelsRegistry, context, config, provider, pipelines } = params;
-  const resolvedCaps = await capabilitiesFor(modelsRegistry, provider.id, context.model).catch(() => void 0);
-  const effectiveMaxContext = config.context.effectiveMaxContext ?? resolvedCaps?.maxContext ?? provider.capabilities.maxContext;
-  if (config.context.autoCompact !== false) {
-    const autoCompactor = new AutoCompactionMiddleware(
-      compactor,
-      effectiveMaxContext,
-      (ctx) => {
-        let total = 0;
-        for (const m of ctx.messages) {
-          if (typeof m.content === "string") {
-            total += Math.ceil(m.content.length / 4);
-          } else if (Array.isArray(m.content)) {
-            for (const b of m.content) {
-              if (b.type === "text") {
-                total += Math.ceil(b.text.length / 4);
-              } else if (b.type === "tool_use" || b.type === "tool_result") {
-                total += Math.ceil(JSON.stringify(b).length / 4);
-              }
-            }
-          }
-        }
-        return total;
-      },
-      {
-        warn: config.context.warnThreshold,
-        soft: config.context.softThreshold,
-        hard: config.context.hardThreshold
-      },
-      { aggressiveOn: "soft", failureMode: "throw_on_hard", events }
-    );
-    pipelines.contextWindow.use({ name: "AutoCompaction", handler: autoCompactor.handler() });
-  }
-  return effectiveMaxContext;
-}
-function createAgent(params) {
-  return new Agent({
-    container: params.container,
-    tools: params.tools,
-    providers: params.providers,
-    events: params.events,
-    pipelines: params.pipelines,
-    context: params.context,
-    maxIterations: params.config.tools.maxIterations,
-    iterationTimeoutMs: params.config.tools.iterationTimeoutMs,
-    executionStrategy: params.config.tools.defaultExecutionStrategy,
-    perIterationOutputCapBytes: params.config.tools.perIterationOutputCapBytes,
-    confirmAwaiter: params.confirmAwaiter
-  });
-}
 
 // src/arg-parser.ts
 var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
@@ -956,13 +774,13 @@ function flagsToConfigPatch(flags) {
 }
 async function ensureProjectMeta(paths, projectRoot) {
   try {
-    await fs3.mkdir(paths.projectDir, { recursive: true });
+    await fs14.mkdir(paths.projectDir, { recursive: true });
     const meta = {
       hash: paths.projectHash,
       root: projectRoot,
       lastSeen: (/* @__PURE__ */ new Date()).toISOString()
     };
-    await fs3.writeFile(paths.projectMeta, JSON.stringify(meta, null, 2));
+    await fs14.writeFile(paths.projectMeta, JSON.stringify(meta, null, 2));
   } catch {
   }
 }
@@ -976,7 +794,7 @@ var ReadlineInputReader = class {
   }
   async loadHistory() {
     try {
-      const raw = await fs3.readFile(this.historyFile, "utf8");
+      const raw = await fs14.readFile(this.historyFile, "utf8");
       this.history = raw.split("\n").filter(Boolean).slice(-1e3);
     } catch {
       this.history = [];
@@ -984,8 +802,8 @@ var ReadlineInputReader = class {
   }
   async saveHistory() {
     try {
-      await fs3.mkdir(path14.dirname(this.historyFile), { recursive: true });
-      await fs3.writeFile(this.historyFile, this.history.slice(-1e3).join("\n"));
+      await fs14.mkdir(path14.dirname(this.historyFile), { recursive: true });
+      await fs14.writeFile(this.historyFile, this.history.slice(-1e3).join("\n"));
     } catch {
     }
   }
@@ -1008,12 +826,12 @@ var ReadlineInputReader = class {
     this.pending = true;
     try {
       const rl = this.ensure();
-      if (rl._flushed) {
+      if (rl.closed || rl._flushed) {
         rl.close();
         this.rl = void 0;
       }
       const fresh = this.ensure();
-      return new Promise((resolve3, reject) => {
+      return new Promise((resolve3) => {
         fresh.question(prompt ?? "> ", (line) => {
           if (line.trim()) {
             this.history.push(line);
@@ -1021,7 +839,11 @@ var ReadlineInputReader = class {
           }
           resolve3(line);
         });
-        fresh.once("close", () => reject(new Error("EOF")));
+        fresh.once("close", () => resolve3(""));
+      }).then((result) => {
+        this.rl?.close();
+        this.rl = void 0;
+        return result;
       });
     } finally {
       this.pending = false;
@@ -1037,6 +859,12 @@ var ReadlineInputReader = class {
       stdin.resume();
       const onData = (buf) => {
         const key = buf.toString();
+        if (key === "") {
+          cleanup();
+          process.stdout.write("\n");
+          resolve3("");
+          return;
+        }
         const opt = options.find(
           (o) => o.key.toLowerCase() === key.toLowerCase() || o.value === key
         );
@@ -1047,12 +875,18 @@ var ReadlineInputReader = class {
           resolve3(opt.value);
         }
       };
+      const onClose = () => {
+        cleanup();
+        resolve3("");
+      };
       const cleanup = () => {
         stdin.off("data", onData);
+        stdin.off("close", onClose);
         if (stdin.isTTY) stdin.setRawMode(wasRaw);
         if (wasPaused) stdin.pause();
       };
       stdin.on("data", onData);
+      stdin.on("close", onClose);
     });
   }
   /**
@@ -1421,61 +1255,104 @@ async function resolveModelSelection(answer, models, provider, _registry, render
 var theme = { primary: color.amber };
 async function saveToGlobalConfig(configPath, provider, model) {
   try {
-    const { atomicWrite: atomicWrite5 } = await import('@wrongstack/core');
-    const fs14 = await import('fs/promises');
+    const { atomicWrite: atomicWrite6 } = await import('@wrongstack/core');
+    const fs15 = await import('fs/promises');
     let existing = {};
     try {
-      const raw = await fs14.readFile(configPath, "utf8");
+      const raw = await fs15.readFile(configPath, "utf8");
       existing = JSON.parse(raw);
     } catch {
     }
     existing.provider = provider;
     existing.model = model;
-    await atomicWrite5(configPath, JSON.stringify(existing, null, 2));
+    await atomicWrite6(configPath, JSON.stringify(existing, null, 2));
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function pathExists(file) {
+  try {
+    await fs14.access(file);
     return true;
   } catch {
     return false;
   }
 }
+async function detectPackageManager(root, declared) {
+  if (declared) {
+    const name = declared.split("@")[0];
+    if (name) return name;
+  }
+  if (await pathExists(path14.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path14.join(root, "bun.lockb"))) return "bun";
+  if (await pathExists(path14.join(root, "bun.lock"))) return "bun";
+  if (await pathExists(path14.join(root, "yarn.lock"))) return "yarn";
+  return "npm";
+}
+function hasUsableScript(scripts, name) {
+  const script = scripts[name];
+  if (typeof script !== "string" || script.trim() === "") return false;
+  if (name === "test" && /no test specified/i.test(script)) return false;
+  return true;
+}
+function parseMakeTargets(makefile) {
+  const targets = /* @__PURE__ */ new Set();
+  for (const line of makefile.split(/\r?\n/)) {
+    if (line.startsWith("	") || line.trimStart().startsWith("#")) continue;
+    const match = /^([A-Za-z0-9_.-]+)\s*:(?![=])/.exec(line);
+    if (match?.[1]) targets.add(match[1]);
+  }
+  return targets;
+}
 async function detectProjectFacts(root) {
   const facts = { hints: [] };
   try {
-    const pkg = JSON.parse(await fs3.readFile(path14.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(await fs14.readFile(path14.join(root, "package.json"), "utf8"));
     const scripts = pkg.scripts ?? {};
-    const pm = (pkg.packageManager ?? "npm").split("@")[0] ?? "npm";
-    if (scripts["build"]) facts.build = `${pm} run build`;
-    if (scripts["test"]) facts.test = `${pm} test`;
-    if (scripts["lint"]) facts.lint = `${pm} run lint`;
-    if (scripts["dev"] ?? scripts["start"])
-      facts.run = `${pm} run ${scripts["dev"] ? "dev" : "start"}`;
-    facts.hints.push("package.json scripts");
+    const pm = await detectPackageManager(root, pkg.packageManager);
+    if (hasUsableScript(scripts, "build")) facts.build = `${pm} run build`;
+    if (hasUsableScript(scripts, "test")) facts.test = `${pm} test`;
+    if (hasUsableScript(scripts, "lint")) facts.lint = `${pm} run lint`;
+    const runScript = ["dev", "start", "serve", "preview"].find(
+      (name) => hasUsableScript(scripts, name)
+    );
+    if (runScript) facts.run = `${pm} run ${runScript}`;
+    facts.hints.push(Object.keys(scripts).length > 0 ? "package.json scripts" : "package.json");
   } catch {
   }
   try {
-    await fs3.access(path14.join(root, "pyproject.toml"));
+    if (!await pathExists(path14.join(root, "pyproject.toml"))) throw new Error("not python");
     facts.test ??= "pytest";
     facts.lint ??= "ruff check .";
     facts.hints.push("pyproject.toml");
   } catch {
   }
   try {
-    await fs3.access(path14.join(root, "go.mod"));
+    if (!await pathExists(path14.join(root, "go.mod"))) throw new Error("not go");
     facts.build ??= "go build ./...";
     facts.test ??= "go test ./...";
+    facts.run ??= "go run .";
     facts.hints.push("go.mod");
   } catch {
   }
   try {
-    await fs3.access(path14.join(root, "Cargo.toml"));
+    if (!await pathExists(path14.join(root, "Cargo.toml"))) throw new Error("not rust");
     facts.build ??= "cargo build";
     facts.test ??= "cargo test";
+    facts.lint ??= "cargo clippy";
+    facts.run ??= "cargo run";
     facts.hints.push("Cargo.toml");
   } catch {
   }
   try {
-    await fs3.access(path14.join(root, "Makefile"));
-    facts.build ??= "make";
-    facts.test ??= "make test";
+    const makefile = await fs14.readFile(path14.join(root, "Makefile"), "utf8");
+    const targets = parseMakeTargets(makefile);
+    facts.build ??= targets.has("build") ? "make build" : "make";
+    if (targets.has("test")) facts.test ??= "make test";
+    if (targets.has("lint")) facts.lint ??= "make lint";
+    const runTarget = ["run", "dev", "start", "serve"].find((name) => targets.has(name));
+    if (runTarget) facts.run ??= `make ${runTarget}`;
     facts.hints.push("Makefile");
   } catch {
   }
@@ -1485,35 +1362,49 @@ function renderAgentsTemplate(f) {
   const cmd = (s) => s ? `\`${s}\`` : "_TODO_";
   return `# AGENTS.md
 
-Project notes for WrongStack. Committed to the repo so every contributor
-(human or agent) starts with the same context. Edit freely.
+This file is loaded into WrongStack's system prompt as project context.
+Keep it concise, factual, and durable: write the information future agents
+need before they touch this codebase.
+
+## Project brief
+
+- **Purpose:** _What does this project do, and why does it exist?_
+- **Primary users:** _Who uses it: developers, operators, customers, internal systems?_
+- **Runtime/deployment:** _Where does it run: CLI, server, browser, worker, library, package?_
+- **Main entry points:** _Which files or commands should an agent inspect first?_
 
-## What this project is
+## How to work safely
 
-_One paragraph: what does this codebase do, who runs it, what's the
-deployment target?_
+- _Project-specific rules the agent should always follow._
+- _Files, generated artifacts, migrations, or config the agent should not edit without asking._
+- _Preferred style or architecture choices that are not obvious from the code._
 
-## How to work on it
+## Commands
 
 - **Build:** ${cmd(f.build)}
 - **Test:** ${cmd(f.test)}
 - **Lint:** ${cmd(f.lint)}
 - **Run locally:** ${cmd(f.run)}
 
-## Conventions
+## Architecture notes
 
-_What style choices matter here? Filenames, module layout, naming, error
-handling, log format. Anything a stranger would get wrong._
+_Summarize the important modules, data flow, boundaries, and ownership rules.
+Mention anything a newcomer might misread._
 
 ## Domain knowledge
 
-_Acronyms, business rules, foot-guns, "this looks weird but it's
-intentional because\u2026"._
+_Business rules, acronyms, invariants, external services, and notes where the
+code looks unusual but is intentional._
 
-## Pointers
+## Verification checklist
 
-_Where to look for: routing, database migrations, feature flags,
-on-call runbooks, dashboards._
+- _What should be run after code changes?_
+- _What manual smoke test proves the common path still works?_
+- _What failure modes deserve extra attention?_
+
+## Useful pointers
+
+- _Docs, dashboards, runbooks, issue trackers, design notes, or owner contacts._
 `;
 }
 function countTurnPairs(messages) {
@@ -1915,13 +1806,13 @@ function buildHelpCommand(opts) {
 function buildInitCommand(opts) {
   return {
     name: "init",
-    description: "Scaffold .wrongstack/AGENTS.md in the current project.",
+    description: "Create .wrongstack/AGENTS.md project context for the system prompt.",
     async run(args, ctx) {
       const force = args.trim() === "--force";
       const dir = path14.join(ctx.projectRoot, ".wrongstack");
       const file = path14.join(dir, "AGENTS.md");
       try {
-        await fs3.access(file);
+        await fs14.access(file);
         if (!force) {
           const msg2 = `AGENTS.md already exists at ${file}. Use "/init --force" to overwrite.`;
           opts.renderer.writeWarning(msg2);
@@ -1931,19 +1822,19 @@ function buildInitCommand(opts) {
       }
       const detected = await detectProjectFacts(ctx.projectRoot);
       const body = renderAgentsTemplate(detected);
-      await fs3.mkdir(dir, { recursive: true });
-      await fs3.writeFile(file, body, "utf8");
+      await fs14.mkdir(dir, { recursive: true });
+      await fs14.writeFile(file, body, "utf8");
       if (detected.hints.length > 0) {
         const msg2 = `Wrote ${file}
-Pre-filled: ${detected.hints.join(", ")}. Edit the file to add anything else worth remembering.`;
+Pre-filled: ${detected.hints.join(", ")}. Edit the file with project context and instructions the system prompt should carry.`;
         opts.renderer.writeInfo(`Wrote ${file}`);
         opts.renderer.writeInfo(
-          `Pre-filled: ${detected.hints.join(", ")}. Edit the file to add anything else worth remembering.`
+          `Pre-filled: ${detected.hints.join(", ")}. Edit the file with project context and instructions the system prompt should carry.`
         );
         return { message: msg2 };
       }
       const msg = `Wrote ${file}
-No project type auto-detected. Edit the file to add build/test commands and conventions.`;
+No project type auto-detected. Edit the file with project context and instructions the system prompt should carry.`;
       opts.renderer.writeInfo(`Wrote ${file}`);
       return { message: msg };
     }
@@ -2087,6 +1978,38 @@ ${formatPlan(updated)}` };
     }
   };
 }
+
+// src/slash-commands/plugin.ts
+function buildPluginCommand(opts) {
+  return {
+    name: "plugin",
+    aliases: ["plugins"],
+    description: "Manage plugins: /plugin [list|status|official|install <alias>|enable <name>|disable <name>|remove <name>]",
+    argsHint: "[list|status|official|install <alias>|enable <name>|disable <name>|remove <name>]",
+    help: [
+      "Usage:",
+      "  /plugin                         List configured plugins.",
+      "  /plugin status                  Alias for list.",
+      "  /plugin official                List official bundled plugins and aliases.",
+      "  /plugin install <alias|package> Add and enable a plugin.",
+      "  /plugin add <alias|package>     Alias for install.",
+      "  /plugin enable <alias|package>  Enable a configured plugin.",
+      "  /plugin disable <alias|package> Disable a configured plugin.",
+      "  /plugin remove <alias|package>  Remove a plugin from config.",
+      "",
+      "Examples:",
+      "  /plugin official",
+      "  /plugin install telegram",
+      "  /plugin disable lsp"
+    ].join("\n"),
+    async run(args) {
+      if (!opts.onPlugin) {
+        return { message: "Plugin management is not available in this session." };
+      }
+      return { message: await opts.onPlugin(args.trim()) };
+    }
+  };
+}
 function buildSaveCommand(opts) {
   return {
     name: "save",
@@ -2286,6 +2209,7 @@ function buildBuiltinSlashCommands(opts) {
     buildContextCommand(opts),
     buildToolsCommand(opts),
     buildSkillCommand(opts),
+    buildPluginCommand(opts),
     buildDiagCommand(opts),
     buildStatsCommand(opts),
     buildSpawnCommand(opts),
@@ -2318,13 +2242,13 @@ var MANIFESTS = [
 ];
 async function detectProjectKind(projectRoot) {
   try {
-    await fs3.access(path14.join(projectRoot, ".wrongstack", "AGENTS.md"));
+    await fs14.access(path14.join(projectRoot, ".wrongstack", "AGENTS.md"));
     return "initialized";
   } catch {
   }
   for (const m of MANIFESTS) {
     try {
-      await fs3.access(path14.join(projectRoot, m));
+      await fs14.access(path14.join(projectRoot, m));
       return "project";
     } catch {
     }
@@ -2336,8 +2260,8 @@ async function scaffoldAgentsMd(projectRoot) {
   const file = path14.join(dir, "AGENTS.md");
   const facts = await detectProjectFacts(projectRoot);
   const body = renderAgentsTemplate(facts);
-  await fs3.mkdir(dir, { recursive: true });
-  await fs3.writeFile(file, body, "utf8");
+  await fs14.mkdir(dir, { recursive: true });
+  await fs14.writeFile(file, body, "utf8");
   return file;
 }
 async function runProjectCheck(opts) {
@@ -3245,7 +3169,7 @@ async function readKeyInput(deps, intent) {
 async function loadProviders(deps) {
   let raw;
   try {
-    raw = await fs3.readFile(deps.globalConfigPath, "utf8");
+    raw = await fs14.readFile(deps.globalConfigPath, "utf8");
   } catch {
     return {};
   }
@@ -3261,7 +3185,7 @@ async function loadProviders(deps) {
 async function mutateProviders(deps, mutator) {
   let raw;
   try {
-    raw = await fs3.readFile(deps.globalConfigPath, "utf8");
+    raw = await fs14.readFile(deps.globalConfigPath, "utf8");
   } catch {
     raw = "{}";
   }
@@ -3401,7 +3325,7 @@ var doctorCmd = async (_args, deps) => {
     });
   }
   try {
-    await fs3.access(deps.paths.secretsKey);
+    await fs14.access(deps.paths.secretsKey);
     checks.push({ name: "secret vault", status: "ok", detail: deps.paths.secretsKey });
   } catch {
     checks.push({
@@ -3411,10 +3335,10 @@ var doctorCmd = async (_args, deps) => {
     });
   }
   try {
-    await fs3.mkdir(deps.paths.projectSessions, { recursive: true });
+    await fs14.mkdir(deps.paths.projectSessions, { recursive: true });
     const probe = path14.join(deps.paths.projectSessions, `.probe-${Date.now()}`);
-    await fs3.writeFile(probe, "");
-    await fs3.unlink(probe);
+    await fs14.writeFile(probe, "");
+    await fs14.unlink(probe);
     checks.push({ name: "sessions writable", status: "ok", detail: deps.paths.projectSessions });
   } catch (err) {
     checks.push({
@@ -3515,8 +3439,8 @@ var exportCmd = async (args, deps) => {
     return 1;
   }
   if (output) {
-    await fs3.mkdir(path14.dirname(path14.resolve(deps.cwd, output)), { recursive: true });
-    await fs3.writeFile(path14.resolve(deps.cwd, output), rendered, "utf8");
+    await fs14.mkdir(path14.dirname(path14.resolve(deps.cwd, output)), { recursive: true });
+    await fs14.writeFile(path14.resolve(deps.cwd, output), rendered, "utf8");
     deps.renderer.write(`Wrote ${rendered.length} bytes to ${output}
 `);
   } else {
@@ -3573,19 +3497,17 @@ var initCmd = async (_args, deps) => {
   } else {
     deps.renderer.writeInfo(`Found API key in env (${provider.envVars.join(" / ")}).`);
   }
-  await fs3.mkdir(deps.paths.globalRoot, { recursive: true });
+  await fs14.mkdir(deps.paths.globalRoot, { recursive: true });
   const config = { version: 1, provider: providerId, model: modelId };
   if (apiKey) config.apiKey = apiKey;
   await atomicWrite(deps.paths.globalConfig, JSON.stringify(config, null, 2));
-  await fs3.mkdir(path14.join(deps.projectRoot, ".wrongstack"), { recursive: true });
+  await fs14.mkdir(path14.join(deps.projectRoot, ".wrongstack"), { recursive: true });
   const agentsFile = path14.join(deps.projectRoot, ".wrongstack", "AGENTS.md");
   try {
-    await fs3.access(agentsFile);
+    await fs14.access(agentsFile);
   } catch {
-    await atomicWrite(
-      agentsFile,
-      "# Project notes for WrongStack\n\nWrite project-specific conventions, build commands,\nand domain knowledge here. This file is committed to git.\n"
-    );
+    const detected2 = await detectProjectFacts(deps.projectRoot);
+    await atomicWrite(agentsFile, renderAgentsTemplate(detected2));
   }
   deps.renderer.writeInfo(`Wrote ${deps.paths.globalConfig}`);
   deps.renderer.writeInfo(`Project state lives in ${deps.paths.projectDir}`);
@@ -3658,7 +3580,7 @@ async function addMcpServer(args, deps) {
   serverCfg.enabled = enable;
   let existing = {};
   try {
-    existing = JSON.parse(await fs3.readFile(deps.paths.globalConfig, "utf8"));
+    existing = JSON.parse(await fs14.readFile(deps.paths.globalConfig, "utf8"));
   } catch {
   }
   const mcpServers = existing.mcpServers ?? {};
@@ -3678,7 +3600,7 @@ async function addMcpServer(args, deps) {
 async function removeMcpServer(name, deps) {
   let existing = {};
   try {
-    existing = JSON.parse(await fs3.readFile(deps.paths.globalConfig, "utf8"));
+    existing = JSON.parse(await fs14.readFile(deps.paths.globalConfig, "utf8"));
   } catch {
     deps.renderer.writeError("No config file found.\n");
     return 1;
@@ -3696,26 +3618,189 @@ async function removeMcpServer(name, deps) {
 `);
   return 0;
 }
-
-// src/subcommands/handlers/plugin-usage.ts
-var pluginCmd = async (args, deps) => {
+var OFFICIAL_PLUGINS = [
+  {
+    alias: "telegram",
+    specifier: "@wrongstack/telegram",
+    description: "Telegram bridge for prompts, notifications, and slash commands."
+  },
+  {
+    alias: "lsp",
+    specifier: "@wrongstack/plug-lsp",
+    description: "Language Server Protocol tools for code intelligence."
+  }
+];
+var OFFICIAL_ALIASES = new Map(
+  OFFICIAL_PLUGINS.flatMap((p) => [
+    [p.alias, p.specifier],
+    [p.specifier, p.specifier]
+  ])
+);
+async function runPluginManagementCommand(args, deps) {
   const sub = args[0];
-  if (!sub || sub === "list") {
-    const plugins = deps.config.plugins ?? [];
-    if (plugins.length === 0) {
-      deps.renderer.write("No plugins configured.\n");
-      return 0;
+  if (!sub || sub === "list" || sub === "status") {
+    return {
+      code: 0,
+      level: "output",
+      message: renderConfiguredPlugins(deps.config)
+    };
+  }
+  if (sub === "official" || sub === "officials") {
+    return {
+      code: 0,
+      level: "output",
+      message: renderOfficialPlugins(deps.config)
+    };
+  }
+  if (sub === "add" || sub === "install") {
+    const spec = args[1];
+    if (!spec) {
+      return errorResult("Usage: wstack plugin add <specifier|official-alias> [--disabled]");
     }
-    for (const p of plugins) {
-      const name = typeof p === "string" ? p : p.name;
-      const enabled = typeof p === "object" && p.enabled === false ? "disabled" : "enabled";
-      deps.renderer.write(`  ${name}  ${enabled}
-`);
+    return upsertPlugin(
+      resolvePluginSpecifier(spec),
+      { enabled: !args.includes("--disabled") },
+      deps,
+      "Added"
+    );
+  }
+  if (sub === "remove" || sub === "rm" || sub === "uninstall") {
+    const spec = args[1];
+    if (!spec) {
+      return errorResult("Usage: wstack plugin remove <specifier|official-alias>");
     }
-    return 0;
+    return removePlugin(resolvePluginSpecifier(spec), deps);
   }
-  deps.renderer.writeWarning(`plugin ${sub} not implemented (edit config.plugins manually).`);
-  return 0;
+  if (sub === "enable" || sub === "disable") {
+    const spec = args[1];
+    if (!spec) {
+      return errorResult(`Usage: wstack plugin ${sub} <specifier|official-alias>`);
+    }
+    return upsertPlugin(
+      resolvePluginSpecifier(spec),
+      { enabled: sub === "enable" },
+      deps,
+      sub === "enable" ? "Enabled" : "Disabled"
+    );
+  }
+  return errorResult(
+    `Unknown plugin subcommand: ${sub}
+Usage: wstack plugin [list|status|official|add|install|remove|enable|disable]`
+  );
+}
+function resolvePluginSpecifier(input) {
+  return OFFICIAL_ALIASES.get(input.toLowerCase()) ?? input;
+}
+function renderOfficialPlugins(config) {
+  return [
+    "Official plugins:",
+    ...OFFICIAL_PLUGINS.map((p) => {
+      const state = config ? officialPluginState(config, p.specifier) : "";
+      const status = state ? `${state.padEnd(14)} ` : "";
+      return `  ${p.alias.padEnd(12)} ${status}${p.specifier.padEnd(24)} ${p.description}`;
+    }),
+    "",
+    "Use `wstack plugin add <alias>` or `/plugin install <alias>`."
+  ].join("\n");
+}
+function renderConfiguredPlugins(config) {
+  const plugins = config.plugins ?? [];
+  if (plugins.length === 0) {
+    return [
+      "No plugins configured.",
+      "Use `wstack plugin add <specifier>` or `/plugin install <official-alias>`."
+    ].join("\n");
+  }
+  return plugins.map((p) => {
+    const name = pluginName(p);
+    const enabled = typeof p === "object" && p.enabled === false ? "disabled" : "enabled";
+    const official = OFFICIAL_PLUGINS.find((entry) => entry.specifier === name);
+    const suffix = official ? ` (${official.alias})` : "";
+    return `  ${`${name}${suffix}`.padEnd(44)} ${enabled}`;
+  }).join("\n");
+}
+async function readConfig(file) {
+  try {
+    return JSON.parse(await fs14.readFile(file, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function pluginName(p) {
+  return typeof p === "string" ? p : p.name;
+}
+function pluginEntry(spec, enabled) {
+  return enabled ? spec : { name: spec, enabled: false };
+}
+function officialPluginState(config, spec) {
+  const match = (config.plugins ?? []).find((p) => pluginName(p) === spec);
+  if (!match) return "not configured";
+  return typeof match === "object" && match.enabled === false ? "disabled" : "enabled";
+}
+async function upsertPlugin(spec, opts, deps, verb) {
+  const existing = await readConfig(deps.configPath);
+  const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
+  const idx = plugins.findIndex((p) => pluginName(p) === spec);
+  const nextEntry = pluginEntry(spec, opts.enabled);
+  if (idx >= 0) plugins[idx] = nextEntry;
+  else plugins.push(nextEntry);
+  const features = {
+    ...isRecord(deps.config.features) ? deps.config.features : {},
+    ...isRecord(existing.features) ? existing.features : {},
+    plugins: true
+  };
+  existing.plugins = plugins;
+  existing.features = features;
+  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2));
+  return {
+    code: 0,
+    level: "info",
+    message: `${verb} "${spec}" (${opts.enabled ? "enabled" : "disabled"}). Config written to ${deps.configPath}.`,
+    patch: { plugins, features },
+    restartRequired: true
+  };
+}
+async function removePlugin(spec, deps) {
+  const existing = await readConfig(deps.configPath);
+  const plugins = Array.isArray(existing.plugins) ? existing.plugins : [];
+  const next = plugins.filter((p) => pluginName(p) !== spec);
+  if (next.length === plugins.length) {
+    return errorResult(`Plugin "${spec}" not in config.`);
+  }
+  existing.plugins = next;
+  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2));
+  return {
+    code: 0,
+    level: "info",
+    message: `Removed "${spec}" from config.`,
+    patch: { plugins: next },
+    restartRequired: true
+  };
+}
+function errorResult(message) {
+  return { code: 1, level: "error", message };
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/subcommands/handlers/plugin-usage.ts
+var pluginCmd = async (args, deps) => {
+  const result = await runPluginManagementCommand(args, {
+    config: deps.config,
+    configPath: deps.paths.globalConfig
+  });
+  if (result.level === "error") {
+    deps.renderer.writeError(`${result.message}
+`);
+  } else if (result.level === "info") {
+    deps.renderer.writeInfo(`${result.message}
+`);
+  } else {
+    deps.renderer.write(`${result.message}
+`);
+  }
+  return result.code;
 };
 var usageCmd = async (_args, deps) => {
   if (!deps.sessionStore) return 0;
@@ -3729,7 +3814,7 @@ var usageCmd = async (_args, deps) => {
 var projectsCmd = async (_args, deps) => {
   const projectsRoot = path14.join(deps.paths.globalRoot, "projects");
   try {
-    const entries = await fs3.readdir(projectsRoot);
+    const entries = await fs14.readdir(projectsRoot);
     if (entries.length === 0) {
       deps.renderer.write("No projects tracked.\n");
       return 0;
@@ -3737,7 +3822,7 @@ var projectsCmd = async (_args, deps) => {
     for (const hash of entries) {
       try {
         const meta = JSON.parse(
-          await fs3.readFile(path14.join(projectsRoot, hash, "meta.json"), "utf8")
+          await fs14.readFile(path14.join(projectsRoot, hash, "meta.json"), "utf8")
         );
         deps.renderer.write(
           `  ${color.dim(hash)}  ${color.dim(meta.lastSeen ?? "")}  ${meta.root ?? "?"}
@@ -3958,7 +4043,7 @@ var helpCmd = async (_args, deps) => {
     "  wstack models [<provider>]   List models",
     "  wstack models refresh        Force-refresh cache",
     "  wstack mcp [list]            List MCP servers",
-    "  wstack plugin [list]         List plugins",
+    "  wstack plugin [list|status|official|install|add|remove|enable|disable]  Manage plugins",
     "  wstack projects              List tracked projects",
     "  wstack diag                  Full diagnostics",
     "  wstack doctor                Health checks",
@@ -3982,6 +4067,7 @@ var subcommands = {
   models: modelsCmd,
   mcp: mcpCmd,
   plugin: pluginCmd,
+  plugins: pluginCmd,
   diag: diagCmd,
   doctor: doctorCmd,
   export: exportCmd,
@@ -4310,10 +4396,14 @@ async function readPossiblyMultiline(opts) {
   const first = await opts.reader.readLine(firstPrompt);
   if (first.trim() === '"""') {
     const parts = [];
-    for (; ; ) {
-      const next = await opts.reader.readLine(contPrompt);
-      if (next.trim() === '"""') break;
-      parts.push(next);
+    try {
+      for (; ; ) {
+        const next = await opts.reader.readLine(contPrompt);
+        if (next.trim() === '"""') break;
+        parts.push(next);
+      }
+    } catch {
+      return parts.join("\n");
     }
     return parts.join("\n");
   }
@@ -4467,6 +4557,7 @@ async function execute(deps) {
         );
       }
     } else if (flags.tui && !flags["no-tui"]) {
+      agent.disableInteractiveConfirmation();
       const { runTui } = await import('@wrongstack/tui');
       renderer.setSilent(true);
       const banneredFamily = savedProviderCfg?.family ?? resolvedProvider?.family;
@@ -4526,19 +4617,22 @@ async function execute(deps) {
         modelsRegistry,
         globalConfigPath: wpaths.globalConfig
       });
-      code = await runRepl({
-        agent,
-        renderer,
-        reader,
-        slashRegistry,
-        tokenCounter,
-        visionAdapters,
-        supportsVision,
-        attachments,
-        effectiveMaxContext,
-        projectName: path14.basename(projectRoot) || void 0
-      });
-      await webuiPromise;
+      try {
+        code = await runRepl({
+          agent,
+          renderer,
+          reader,
+          slashRegistry,
+          tokenCounter,
+          visionAdapters,
+          supportsVision,
+          attachments,
+          effectiveMaxContext,
+          projectName: path14.basename(projectRoot) || void 0
+        });
+      } finally {
+        await webuiPromise.catch(() => void 0);
+      }
     } else {
       code = await runRepl({
         agent,
@@ -4554,7 +4648,10 @@ async function execute(deps) {
       });
     }
   } finally {
-    stats.render(renderer);
+    try {
+      stats.render(renderer);
+    } catch (err) {
+    }
     await Promise.resolve(detachTodosCheckpoint?.()).catch(() => void 0);
     await mcpRegistry.stopAll();
     await session.append({
@@ -4696,7 +4793,7 @@ var MultiAgentHost = class {
       });
       let subSession;
       if (this.sessionFactory) {
-        const subagentName = subCfg.name ?? subCfg.id ?? `sub_${randomUUID().slice(0, 8)}`;
+        const subagentName = subCfg.id ?? subCfg.name ?? `sub_${randomUUID().slice(0, 8)}`;
         subSession = await this.sessionFactory.createSubagentSession({
           subagentId: subagentName,
           provider: subCfg.provider ?? config.provider,
@@ -5011,8 +5108,9 @@ var MultiAgentHost = class {
 };
 function makePromptDelegate(reader) {
   return async (tool, input, suggestedPattern) => {
+    process.stdout.write("\x07");
     process.stdout.write(`
-${theme2.primary("\u258D")} ${theme2.bold(tool.name)}
+${theme2.warn("\u26A0 APPROVAL REQUIRED")} ${theme2.primary("\u2502")} ${theme2.bold(tool.name)}
 `);
     process.stdout.write(`${color.dim(stringifyInput(input))}
 `);
@@ -5270,6 +5368,216 @@ function renderProgress2(ratio, width) {
   const capped = Math.min(width, filled);
   return FILLED2.repeat(capped) + EMPTY2.repeat(width - capped);
 }
+function setupPipelines(params) {
+  const { events, logger } = params;
+  const pipelines = createDefaultPipelines();
+  const installBoundary = (p) => {
+    p.setErrorHandler((ev) => {
+      const fromPlugin = !!ev.owner && ev.owner !== "core";
+      logger.error(
+        `Pipeline middleware "${ev.middleware}" crashed (owner=${ev.owner ?? "unknown"}); ${fromPlugin ? "swallowed" : "rethrown"}`,
+        ev.err
+      );
+      events.emit("error", {
+        err: ev.err instanceof Error ? ev.err : new Error(String(ev.err)),
+        phase: `pipeline:${ev.middleware}`
+      });
+      return fromPlugin ? "swallow" : "rethrow";
+    });
+  };
+  installBoundary(pipelines.request);
+  installBoundary(pipelines.response);
+  installBoundary(pipelines.toolCall);
+  installBoundary(pipelines.userInput);
+  installBoundary(pipelines.assistantOutput);
+  installBoundary(pipelines.contextWindow);
+  return pipelines;
+}
+async function setupCompaction(params) {
+  const { compactor, events, modelsRegistry, context, config, provider, pipelines } = params;
+  const resolvedCaps = await capabilitiesFor(modelsRegistry, provider.id, context.model).catch(() => void 0);
+  const effectiveMaxContext = config.context.effectiveMaxContext ?? resolvedCaps?.maxContext ?? provider.capabilities.maxContext;
+  if (config.context.autoCompact !== false) {
+    const autoCompactor = new AutoCompactionMiddleware(
+      compactor,
+      effectiveMaxContext,
+      (ctx) => {
+        let total = 0;
+        for (const m of ctx.messages) {
+          if (typeof m.content === "string") {
+            total += Math.ceil(m.content.length / 4);
+          } else if (Array.isArray(m.content)) {
+            for (const b of m.content) {
+              if (b.type === "text") {
+                total += Math.ceil(b.text.length / 4);
+              } else if (b.type === "tool_use" || b.type === "tool_result") {
+                total += Math.ceil(JSON.stringify(b).length / 4);
+              }
+            }
+          }
+        }
+        return total;
+      },
+      {
+        warn: config.context.warnThreshold,
+        soft: config.context.softThreshold,
+        hard: config.context.hardThreshold
+      },
+      { aggressiveOn: "soft", failureMode: "throw_on_hard", events }
+    );
+    pipelines.contextWindow.use({ name: "AutoCompaction", handler: autoCompactor.handler() });
+  }
+  return effectiveMaxContext;
+}
+function createAgent(params) {
+  return new Agent({
+    container: params.container,
+    tools: params.tools,
+    providers: params.providers,
+    events: params.events,
+    pipelines: params.pipelines,
+    context: params.context,
+    maxIterations: params.config.tools.maxIterations,
+    iterationTimeoutMs: params.config.tools.iterationTimeoutMs,
+    executionStrategy: params.config.tools.defaultExecutionStrategy,
+    perIterationOutputCapBytes: params.config.tools.perIterationOutputCapBytes,
+    confirmAwaiter: params.confirmAwaiter
+  });
+}
+async function setupProvider(params) {
+  const { config, modelsRegistry, logger } = params;
+  const savedProviderCfg = config.providers?.[config.provider];
+  let resolvedProvider = await modelsRegistry.getProvider(config.provider).catch(() => void 0);
+  if (!resolvedProvider && savedProviderCfg?.type && savedProviderCfg.type !== config.provider) {
+    resolvedProvider = await modelsRegistry.getProvider(savedProviderCfg.type).catch(() => void 0);
+  }
+  if (!resolvedProvider) {
+    if (!savedProviderCfg?.family) {
+      logger.warn(
+        `Provider "${config.provider}" not found in models.dev. Continuing with raw config.`
+      );
+    }
+  } else if (resolvedProvider.family === "unsupported" && !savedProviderCfg?.family) {
+    throw Object.assign(
+      new Error(
+        `Provider "${config.provider}" uses an unsupported wire family (${resolvedProvider.npm}). Install a plugin to enable it, or pick a different provider.`
+      ),
+      { code: "UNSUPPORTED_PROVIDER" }
+    );
+  }
+  const providerRegistry = new ProviderRegistry();
+  if (config.features.modelsRegistry) {
+    try {
+      const factories = await buildProviderFactoriesFromRegistry({
+        registry: modelsRegistry,
+        log: logger
+      });
+      for (const f of factories) providerRegistry.register(f);
+    } catch (err) {
+      throw new Error(
+        `Failed to load models.dev registry: ${err instanceof Error ? err.message : err}
+Try \`wstack models refresh\` once you have network access, or run with --no-features.`
+      );
+    }
+  }
+  const providerConfig = config.providers?.[config.provider] ?? {
+    type: config.provider,
+    apiKey: config.apiKey,
+    baseUrl: config.baseUrl
+  };
+  let provider;
+  try {
+    const cfgWithType = { ...providerConfig, type: config.provider };
+    if (config.features.modelsRegistry && providerRegistry.has(config.provider)) {
+      provider = providerRegistry.create(cfgWithType);
+    } else {
+      provider = makeProviderFromConfig(config.provider, cfgWithType);
+    }
+  } catch (err) {
+    throw new Error(
+      `Failed to create provider: ${err instanceof Error ? err.message : err}`
+    );
+  }
+  return { resolvedProvider, provider, providerRegistry };
+}
+async function setupSession(params) {
+  const { config, wpaths, projectRoot, cwd, sessionStore, systemPrompt, provider, tokenCounter, renderer, flags, onRecovery } = params;
+  let resumeId = typeof flags["resume"] === "string" ? flags["resume"] : void 0;
+  const recoveryLock = new RecoveryLock({ dir: wpaths.projectSessions, sessionStore });
+  if (!resumeId && !flags["no-recovery"]) {
+    const abandoned = await recoveryLock.checkAbandoned();
+    if (abandoned && abandoned.messageCount > 0) {
+      const choice = await onRecovery(abandoned, !!flags["recover"]);
+      if (choice === "resume") resumeId = abandoned.sessionId;
+      else if (choice === "delete") {
+        await sessionStore.delete(abandoned.sessionId).catch(() => void 0);
+        await recoveryLock.clear();
+      } else await recoveryLock.clear();
+    } else if (abandoned) {
+      await sessionStore.delete(abandoned.sessionId).catch(() => void 0);
+      await recoveryLock.clear();
+    }
+  }
+  let session;
+  let restoredMessages = [];
+  if (resumeId) {
+    try {
+      const resumed = await sessionStore.resume(resumeId);
+      session = resumed.writer;
+      restoredMessages = resumed.data.messages;
+      renderer.writeInfo(`Resumed session ${resumed.data.metadata.id} \u2014 ${restoredMessages.length} messages, ${resumed.data.usage.input + resumed.data.usage.output} tokens used previously.`);
+    } catch (err) {
+      renderer.writeError(`Resume failed: ${err instanceof Error ? err.message : String(err)}`);
+      throw Object.assign(new Error("RESUME_FAILED"), { exitCode: 2 });
+    }
+  } else {
+    session = await sessionStore.create({ id: "", title: "", model: config.model, provider: config.provider });
+  }
+  const sessionRef = { current: session };
+  await recoveryLock.write(session.id).catch(() => void 0);
+  const attachments = new DefaultAttachmentStore({ spoolDir: path14.join(wpaths.projectSessions, session.id, "attachments") });
+  const queueStore = new QueueStore({ dir: path14.join(wpaths.projectSessions, session.id) });
+  const ctxSignal = new AbortController().signal;
+  const context = new Context({ systemPrompt, provider, session, signal: ctxSignal, tokenCounter, cwd, projectRoot, model: config.model });
+  if (restoredMessages.length > 0) context.state.replaceMessages(restoredMessages);
+  const todosCheckpointPath = path14.join(wpaths.projectSessions, `${session.id}.todos.json`);
+  if (resumeId) {
+    try {
+      const restoredTodos = await loadTodosCheckpoint(todosCheckpointPath);
+      if (restoredTodos && restoredTodos.length > 0) {
+        context.state.replaceTodos(restoredTodos);
+        renderer.writeInfo(`Restored ${restoredTodos.length} todo${restoredTodos.length === 1 ? "" : "s"} from previous run.`);
+      }
+    } catch {
+    }
+  }
+  const detachTodosCheckpoint = attachTodosCheckpoint(context.state, todosCheckpointPath, session.id);
+  const planPath = path14.join(wpaths.projectSessions, `${session.id}.plan.json`);
+  context.state.setMeta("plan.path", planPath);
+  if (resumeId) {
+    try {
+      const fleetRoot = path14.join(wpaths.projectSessions, session.id);
+      const dirState = await loadDirectorState(path14.join(fleetRoot, "director-state.json"));
+      if (dirState) {
+        const tCounts = {};
+        for (const t of dirState.tasks) tCounts[t.status] = (tCounts[t.status] ?? 0) + 1;
+        const summary = Object.entries(tCounts).map(([k, v]) => `${v} ${k}`).join(", ");
+        renderer.writeInfo(`Prior fleet state: ${dirState.subagents.length} subagent${dirState.subagents.length === 1 ? "" : "s"}, tasks ${summary || "(none)"}.`);
+      }
+    } catch {
+    }
+    try {
+      const plan = await loadPlan(planPath);
+      if (plan && plan.items.length > 0) {
+        const open = plan.items.filter((p) => p.status !== "done").length;
+        const done = plan.items.length - open;
+        renderer.writeInfo(`Plan: ${plan.items.length} item${plan.items.length === 1 ? "" : "s"} (${open} open, ${done} done). Use /plan to review.`);
+      }
+    } catch {
+    }
+  }
+  return { session, sessionRef, context, restoredMessages, attachments, recoveryLock, queueStore, planPath, detachTodosCheckpoint };
+}
 
 // src/index.ts
 function resolveBundledSkillsDir2() {
@@ -5281,6 +5589,17 @@ function resolveBundledSkillsDir2() {
     return void 0;
   }
 }
+function buildPluginOptions(config) {
+  const options = {};
+  for (const entry of config.plugins ?? []) {
+    if (typeof entry !== "object") continue;
+    if (entry.options) options[entry.name] = { ...entry.options };
+  }
+  for (const [name, value] of Object.entries(config.extensions ?? {})) {
+    options[name] = { ...options[name] ?? {}, ...value };
+  }
+  return options;
+}
 async function main(argv) {
   const ctx = await boot(argv);
   if (typeof ctx === "number") return ctx;
@@ -5304,7 +5623,10 @@ async function main(argv) {
     wpaths,
     logger,
     modelsRegistry,
-    permission: { yolo: config.yolo, promptDelegate: makePromptDelegate(reader) },
+    permission: {
+      yolo: config.yolo,
+      promptDelegate: makePromptDelegate(reader)
+    },
     compactor: { preserveK: config.context.preserveK, eliseThreshold: config.context.eliseThreshold },
     bundledSkillsDir: config.features.skills ? resolveBundledSkillsDir2() : void 0
   });
@@ -5377,7 +5699,7 @@ async function main(argv) {
       name: "session-store",
       check: async () => {
         try {
-          await fs3.access(wpaths.projectSessions);
+          await fs14.access(wpaths.projectSessions);
           return { status: "healthy" };
         } catch (e) {
           return { status: "unhealthy", detail: e instanceof Error ? e.message : "access denied" };
@@ -5543,6 +5865,7 @@ async function main(argv) {
   if (config.features.plugins && config.plugins && config.plugins.length > 0) {
     const resolvedPlugins = [];
     for (const p of config.plugins) {
+      if (typeof p === "object" && p.enabled === false) continue;
       const spec = typeof p === "string" ? p : p.name;
       try {
         const mod = await import(spec);
@@ -5553,13 +5876,14 @@ async function main(argv) {
     }
     if (resolvedPlugins.length > 0) {
       const { default: createApi2 } = await Promise.resolve().then(() => (init_plugin_api_factory(), plugin_api_factory_exports));
+      const pluginOptions = buildPluginOptions(config);
+      const pluginConfig = Object.keys(pluginOptions).length > 0 ? patchConfig(config, { extensions: pluginOptions }) : config;
       await loadPlugins(resolvedPlugins, {
         log: logger,
-        // Each plugin's `configSchema` is validated against the matching
-        // `Config.extensions[name]` subtree before its `setup()` runs.
-        // The plugin then reads the same data through `api.config.extensions`
-        // (or, once L1-B lands, via `ConfigStore.getExtension(name)`).
-        pluginOptions: config.extensions ?? {},
+        // Each plugin's `configSchema` is validated against merged
+        // options from `plugins[].options` and `extensions[name]`.
+        // The merged view is also exposed as `api.config.extensions`.
+        pluginOptions,
         apiFactory: (plugin) => createApi2(plugin.name, {
           container,
           events,
@@ -5568,7 +5892,7 @@ async function main(argv) {
           providerRegistry,
           slashCommandRegistry: slashRegistry,
           mcpRegistry,
-          config,
+          config: pluginConfig,
           log: logger,
           extensions: agent.extensions,
           sessionWriter: {
@@ -5761,7 +6085,7 @@ async function main(argv) {
       const subagentsRoot = path14.join(fleetRootForPromotion, "subagents");
       let runDirs;
       try {
-        runDirs = await fs3.readdir(subagentsRoot);
+        runDirs = await fs14.readdir(subagentsRoot);
       } catch {
         return "No fleet transcripts on disk \u2014 no subagents have been spawned for this session.";
       }
@@ -5770,7 +6094,7 @@ async function main(argv) {
         const runDir = path14.join(subagentsRoot, runId);
         let files;
         try {
-          files = await fs3.readdir(runDir);
+          files = await fs14.readdir(runDir);
         } catch {
           continue;
         }
@@ -5778,7 +6102,7 @@ async function main(argv) {
           if (!f.endsWith(".jsonl")) continue;
           const full = path14.join(runDir, f);
           try {
-            const stat2 = await fs3.stat(full);
+            const stat2 = await fs14.stat(full);
             found.push({
               runId,
               subagentId: f.replace(/\.jsonl$/, ""),
@@ -5817,7 +6141,7 @@ async function main(argv) {
         ].join("\n");
       }
       const t = matches[0];
-      const raw = await fs3.readFile(t.file, "utf8");
+      const raw = await fs14.readFile(t.file, "utf8");
       if (mode === "raw") return raw;
       const lines = raw.split("\n").filter((l) => l.trim());
       const counts = {};
@@ -5956,6 +6280,23 @@ async function main(argv) {
       ];
       return lines.join("\n");
     },
+    onPlugin: async (args) => {
+      const parsed = args.length === 0 ? [] : args.split(/\s+/).filter(Boolean);
+      const result = await runPluginManagementCommand(parsed, {
+        config,
+        configPath: wpaths.globalConfig
+      });
+      if (result.patch) {
+        const patch = result.patch;
+        config = patchConfig(config, patch);
+        configStore.update(patch);
+      }
+      if (result.restartRequired && result.code === 0) {
+        return `${result.message}
+Restart WrongStack to load or unload plugin code in this session.`;
+      }
+      return result.message;
+    },
     onExit: () => {
       void mcpRegistry.stopAll();
     },