@wrongstack/cli 0.300.0 → 0.302.0

package/dist/{acp-IDNS2YVE.js → acp-DATHHPNT.js}

@@ -32,13 +32,14 @@ import { WebSocketServer } from "ws";
 
 // src/acp-server-agent.ts
 import { Agent, Context, createDefaultPipelines } from "@wrongstack/core/agent";
-import { AutoApprovePermissionPolicy, ToolCapabilities } from "@wrongstack/core/security";
-import { DefaultLogger } from "@wrongstack/core/infrastructure";
+import { ToolExecutor } from "@wrongstack/core/execution";
+import { DefaultLogger, DefaultTokenCounter } from "@wrongstack/core/infrastructure";
 import { EventBus, TOKENS } from "@wrongstack/core/kernel";
-import { ToolValidationError } from "@wrongstack/core/types";
 import { ToolRegistry } from "@wrongstack/core/registry";
-import { DefaultTokenCounter } from "@wrongstack/core/infrastructure";
-import { ToolExecutor } from "@wrongstack/core/execution";
+import { AutoApprovePermissionPolicy, ToolCapabilities } from "@wrongstack/core/security";
+import {
+  ToolValidationError
+} from "@wrongstack/core/types";
 import { createDefaultContainer } from "@wrongstack/runtime";
 var AcpServerConfigError = class extends Error {
   constructor(message) {
@@ -123,7 +124,8 @@ function makeAcpRead(base, api) {
     mutating: false,
     execute: async (input) => {
       const i = input ?? {};
-      if (!i.path) throw new ToolValidationError({ message: "read: path is required", field: "path" });
+      if (!i.path)
+        throw new ToolValidationError({ message: "read: path is required", field: "path" });
       const content = await api.readTextFile({
         path: i.path,
         ...typeof i.offset === "number" ? { line: i.offset } : {},
@@ -142,7 +144,8 @@ function makeAcpWrite(base, api) {
     ...base,
     execute: async (input) => {
       const i = input ?? {};
-      if (!i.path) throw new ToolValidationError({ message: "write: path is required", field: "path" });
+      if (!i.path)
+        throw new ToolValidationError({ message: "write: path is required", field: "path" });
       await api.writeTextFile({ path: i.path, content: i.content ?? "" });
       return { path: i.path, ok: true };
     }
@@ -153,8 +156,13 @@ function makeAcpEdit(base, api) {
     ...base,
     execute: async (input) => {
       const i = input ?? {};
-      if (!i.path) throw new ToolValidationError({ message: "edit: path is required", field: "path" });
-      if (!i.old_string) throw new ToolValidationError({ message: "edit: old_string is required", field: "old_string" });
+      if (!i.path)
+        throw new ToolValidationError({ message: "edit: path is required", field: "path" });
+      if (!i.old_string)
+        throw new ToolValidationError({
+          message: "edit: old_string is required",
+          field: "old_string"
+        });
       const before = await api.readTextFile({ path: i.path });
       const occurrences = before.split(i.old_string).length - 1;
       if (occurrences === 0) {
@@ -182,7 +190,8 @@ function makeAcpBash(base, api) {
     ...base,
     execute: async (input) => {
       const i = input ?? {};
-      if (!i.command) throw new ToolValidationError({ message: "bash: command is required", field: "command" });
+      if (!i.command)
+        throw new ToolValidationError({ message: "bash: command is required", field: "command" });
       const { output, exitCode } = await api.runTerminal({
         command: "sh",
         args: ["-c", i.command],
@@ -219,8 +228,7 @@ function buildAcpServerAgentFactory(deps, options = {}) {
     const { provider, providerRegistry } = await bootProvider();
     const events = new EventBus();
     const source = deps.toolRegistry ?? new ToolRegistry();
-    const tools = new ToolRegistry();
-    for (const t of source.list()) tools.register(t);
+    const tools = source.clone();
     if (api) {
       wireClientBackedTools(tools, api);
     }
@@ -242,7 +250,7 @@ function buildAcpServerAgentFactory(deps, options = {}) {
       projectRoot: cwd,
       allowOutsideProjectRoot: config.features?.allowOutsideProjectRoot ?? false,
       model: config.model,
-      tools: [...tools.list()],
+      tools: [...tools.listForProvider()],
       agentId: "acp-server",
       agentName: "wrongstack-acp"
     });
@@ -481,7 +489,12 @@ async function runACPWebSocketServer(deps, port) {
         return;
       }
       transport.receive(msg);
-      void handler.handleMessage(msg);
+      void handler.handleMessage(msg).catch((err) => {
+        deps.renderer.writeWarning(
+          `ACP: failed to handle message: ${err instanceof Error ? err.message : String(err)}
+`
+        );
+      });
     });
     const teardown = () => {
       handler.close();
@@ -499,6 +512,12 @@ async function runACPWebSocketServer(deps, port) {
   await new Promise((resolve) => {
     const shutdown = () => {
       deps.renderer.writeWarning("\nShutting down ACP WebSocket server...");
+      for (const client of wss.clients) {
+        try {
+          client.terminate();
+        } catch {
+        }
+      }
       wss.close();
       resolve();
     };
@@ -889,4 +908,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-IDNS2YVE.js.map
+//# sourceMappingURL=acp-DATHHPNT.js.map

package/dist/acp-server-agent.d.ts

@@ -13,9 +13,9 @@
  * belong in the interactive host. The ACP server is a headless single-turn
  * surface; a future PR can layer richer session behaviour if needed.
  */
+import type { RunTurnApi } from '@wrongstack/acp/agent';
 import { Agent } from '@wrongstack/core/agent';
 import { type Logger, type PermissionDecision, type PermissionPolicy, type Tool } from '@wrongstack/core/types';
-import type { RunTurnApi } from '@wrongstack/acp/agent';
 import type { SubcommandDeps } from './subcommands/index.js';
 /**
  * Error thrown when the server cannot start because no model provider is

package/dist/{audit-2ZSFGNIF.js → audit-QRCLEHHW.js}

@@ -1,9 +1,13 @@
+import {
+  restoreFlags
+} from "./chunk-CSAPOCBP.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/audit.ts
 import { color, resolveWstackPaths } from "@wrongstack/core/utils";
 import { ToolAuditLog } from "@wrongstack/core/storage";
 var auditCmd = async (args, deps) => {
+  args = restoreFlags(args, deps, ["list", "l"]);
   const wpaths = resolveWstackPaths({
     projectRoot: deps.projectRoot,
     userHome: deps.userHome
@@ -99,4 +103,4 @@ async function listAudits(log, dir, deps) {
 export {
   auditCmd
 };
-//# sourceMappingURL=audit-2ZSFGNIF.js.map
+//# sourceMappingURL=audit-QRCLEHHW.js.map

package/dist/{auth-6T6ZOT2R.js → auth-PJD3JRH2.js}

@@ -13,11 +13,11 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-V76R7DC5.js";
+} from "./chunk-3MOUBRKZ.js";
 import {
   parseAuthFlags
-} from "./chunk-PEMN4T5O.js";
-import "./chunk-N7ULWBO5.js";
+} from "./chunk-MT6FGXO3.js";
+import "./chunk-ETOEGL3V.js";
 import "./chunk-PYTFS4MC.js";
 import {
   loadConfigProviders,
@@ -27,14 +27,17 @@ import {
   nowIso,
   writeKeysBack
 } from "./chunk-PJHET45A.js";
-import "./chunk-YWUPHRGB.js";
+import {
+  restoreFlags
+} from "./chunk-CSAPOCBP.js";
+import "./chunk-263G3FMB.js";
 import {
   activeProfileConfigPath
-} from "./chunk-DPJZQCVP.js";
+} from "./chunk-YMXXOOFN.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/auth.ts
-import { color as color3 } from "@wrongstack/core/utils";
+import { color as color4 } from "@wrongstack/core/utils";
 
 // src/auth-menu/direct.ts
 async function runAuthDirect(deps, opts) {
@@ -311,8 +314,94 @@ ${color2.amber("?")} Pick: `)).trim().toLowerCase();
   }
 }
 
+// src/subcommands/handlers/auth-local-help.ts
+import { color as color3 } from "@wrongstack/core/utils";
+var LOCAL_AUTH_FLAGS = [
+  {
+    flag: "--name <ollama|vllm|lmstudio>",
+    description: "Pick a preset (skip the interactive picker). Defaults to the first run; set this for scripting."
+  },
+  {
+    flag: "--base-url <url>",
+    description: "Override the preset default (e.g. `http://gpu-host:8000/v1` for a remote vLLM). Empty falls back to the preset."
+  },
+  {
+    flag: "--no-key / --skip-key",
+    description: "Skip the API-key prompt even for presets that accept one. Use for non-TTY scripted setups."
+  },
+  {
+    flag: "--no-probe / --skip-probe",
+    description: "Skip the health probe. Use when the local server is not running yet but the config must be persisted."
+  },
+  {
+    flag: "--probe-only",
+    description: "Run the probe and report, do not save. Use to re-check a previously-saved provider."
+  },
+  {
+    flag: "--model <spec> / -m <spec>",
+    description: "Pre-populate the saved `models` allowlist. `--model first` / `<N>` consume the probe; `<csv>` is a literal list; bare `--model` clears the allowlist."
+  },
+  {
+    flag: "--audit [target]",
+    description: "Emit JSONL audit events for the save lifecycle. Bare / `stdout` \u2192 stdout; `stderr` \u2192 stderr; `<path>` \u2192 file. Default is silent."
+  }
+];
+var LOCAL_FLAG_COLUMN_WIDTH = 38;
+var LOCAL_AUTH_HELP_USAGE = "wstack auth local [--name <id>] [--base-url <url>] [--no-key] [--no-probe|--probe-only] [--model <spec>] [--audit [target]]";
+function wantsLocalHelp(args) {
+  return args.includes("--help") || args.includes("-h");
+}
+function renderAuthLocalHelpToString() {
+  const lines = [
+    color3.bold("wstack auth local \u2014 quick-add Ollama / vLLM / LM Studio"),
+    color3.dim("  Pre-fills the base URL, runs a health probe (`GET /v1/models`),"),
+    color3.dim("  and persists the allowlist so you can `wstack --provider <id>`"),
+    color3.dim("  right away. Use `--no-probe` to skip when the local server is not"),
+    color3.dim("  running yet; use `--audit <file>` to capture the save lifecycle."),
+    "",
+    color3.bold("Usage"),
+    `  ${LOCAL_AUTH_HELP_USAGE}`,
+    "",
+    color3.bold("Flags")
+  ];
+  for (const { flag, description } of LOCAL_AUTH_FLAGS) {
+    const padded = flag.padEnd(LOCAL_FLAG_COLUMN_WIDTH, " ");
+    lines.push(`  ${color3.cyan(padded)}${description}`);
+  }
+  lines.push("");
+  lines.push(color3.dim("  See also: `wstack --help` for the top-level command list."));
+  lines.push(
+    color3.dim(
+      "  Examples: `wstack auth local --name ollama --no-probe --model 'llama3.1:8b'`"
+    )
+  );
+  lines.push(
+    color3.dim(
+      "            `wstack auth local --name ollama --audit /var/log/wstack-auth.jsonl`"
+    )
+  );
+  return lines.join("\n") + "\n";
+}
+
 // src/subcommands/handlers/auth.ts
 var authCmd = async (args, deps) => {
+  args = restoreFlags(args, deps, [
+    "label",
+    "family",
+    "base-url",
+    "env",
+    // `auth local` flags — see the `local` branch below.
+    "name",
+    "no-key",
+    "skip-key",
+    "no-probe",
+    "skip-probe",
+    "probe-only",
+    "model",
+    "m",
+    "help",
+    "h"
+  ]);
   const flags = parseAuthFlags(args);
   const profileConfigPath = activeProfileConfigPath(deps.paths, deps.config);
   const menuDeps = {
@@ -329,6 +418,30 @@ var authCmd = async (args, deps) => {
   if (first === "list" || first === "ls") {
     return runAuthList(menuDeps);
   }
+  if (first === "local") {
+    if (wantsLocalHelp(args)) {
+      deps.renderer.write(`${renderAuthLocalHelpToString()}
+`);
+      return 0;
+    }
+    const value = (name) => {
+      const i = args.indexOf(`--${name}`);
+      return i >= 0 ? args[i + 1] : void 0;
+    };
+    const has = (...names) => names.some((n) => args.includes(`--${n}`));
+    const modelIdx = args.indexOf("--model") >= 0 ? args.indexOf("--model") : args.indexOf("-m");
+    return runAuthLocal(menuDeps, {
+      name: flags.positional[1] ?? value("name"),
+      baseUrl: flags.baseUrl ?? value("base-url"),
+      label: flags.label,
+      skipKey: has("no-key", "skip-key"),
+      noProbe: has("no-probe", "skip-probe"),
+      probeOnly: has("probe-only"),
+      // Bare `--model` (no value, or followed by another flag) clears the
+      // allowlist, which is why an empty string is meaningful here.
+      ...modelIdx >= 0 ? { models: args[modelIdx + 1]?.startsWith("-") ? "" : args[modelIdx + 1] ?? "" } : {}
+    });
+  }
   if (first === "status") {
     const pid = flags.positional[1];
     if (!pid) {
@@ -352,7 +465,7 @@ var authCmd = async (args, deps) => {
     if (kind) return runOAuthLoginKind(menuDeps, kind);
     deps.renderer.writeError("OAuth login is only supported for ChatGPT, Claude, and GitHub Copilot.");
     deps.renderer.write(
-      color3.dim("  Sign in with ChatGPT: ") + color3.bold("wstack auth login chatgpt") + "\n" + color3.dim("  Sign in with Claude:  ") + color3.bold("wstack auth login claude") + "\n" + color3.dim("  Sign in with Copilot: ") + color3.bold("wstack auth login copilot") + "\n" + color3.dim("  For an API key instead: ") + color3.bold(`wstack auth ${pid}`) + "\n"
+      color4.dim("  Sign in with ChatGPT: ") + color4.bold("wstack auth login chatgpt") + "\n" + color4.dim("  Sign in with Claude:  ") + color4.bold("wstack auth login claude") + "\n" + color4.dim("  Sign in with Copilot: ") + color4.bold("wstack auth login copilot") + "\n" + color4.dim("  For an API key instead: ") + color4.bold(`wstack auth ${pid}`) + "\n"
     );
     return 1;
   }
@@ -375,14 +488,14 @@ async function runAuthList(deps) {
   const ids = Object.keys(providers).sort();
   if (ids.length === 0) {
     deps.renderer.write(
-      `${color3.dim("No providers configured.")}
-${color3.dim("Run")} ${color3.bold("wstack auth")} ${color3.dim("to add one.")}
+      `${color4.dim("No providers configured.")}
+${color4.dim("Run")} ${color4.bold("wstack auth")} ${color4.dim("to add one.")}
 `
     );
     return 0;
   }
   deps.renderer.write(`
-${color3.bold("Saved providers")} ${color3.dim(`(${ids.length})`)}
+${color4.bold("Saved providers")} ${color4.dim(`(${ids.length})`)}
 
 `);
   for (const id of ids) {
@@ -390,34 +503,34 @@ ${color3.bold("Saved providers")} ${color3.dim(`(${ids.length})`)}
     if (!cfg) continue;
     const keys = normalizeKeys(cfg);
     const active = cfg.activeKey ?? keys[0]?.label;
-    const famTag = cfg.family ? `${cfg.family}` : color3.amber("no-family");
-    const aliasHint = cfg.type && cfg.type !== id ? color3.dim(` (\u2192 ${cfg.type})`) : "";
-    const modelHint = cfg.models && cfg.models.length > 0 ? color3.dim(` [${cfg.models.length} models]`) : "";
-    deps.renderer.write(`  ${color3.bold(id)}${aliasHint}
+    const famTag = cfg.family ? `${cfg.family}` : color4.amber("no-family");
+    const aliasHint = cfg.type && cfg.type !== id ? color4.dim(` (\u2192 ${cfg.type})`) : "";
+    const modelHint = cfg.models && cfg.models.length > 0 ? color4.dim(` [${cfg.models.length} models]`) : "";
+    deps.renderer.write(`  ${color4.bold(id)}${aliasHint}
 `);
     deps.renderer.write(
-      `    family:  ${famTag}  baseUrl: ${cfg.baseUrl ?? color3.dim("unset")}${modelHint}
+      `    family:  ${famTag}  baseUrl: ${cfg.baseUrl ?? color4.dim("unset")}${modelHint}
 `
     );
     if (keys.length === 0) {
-      deps.renderer.write(`    ${color3.amber("no keys")}
+      deps.renderer.write(`    ${color4.amber("no keys")}
 `);
     } else {
       deps.renderer.write(
-        `    ${color3.dim(`${keys.length} key${keys.length === 1 ? "" : "s"}:`)}
+        `    ${color4.dim(`${keys.length} key${keys.length === 1 ? "" : "s"}:`)}
 `
       );
       for (const k of keys) {
-        const marker = k.label === active ? color3.green("\u25CF") : color3.dim("\u25CB");
+        const marker = k.label === active ? color4.green("\u25CF") : color4.dim("\u25CB");
         deps.renderer.write(
-          `      ${marker} ${k.label.padEnd(18)} ${maskedKey(k.apiKey)}  ${color3.dim(k.createdAt)}
+          `      ${marker} ${k.label.padEnd(18)} ${maskedKey(k.apiKey)}  ${color4.dim(k.createdAt)}
 `
         );
       }
     }
     deps.renderer.write("\n");
   }
-  deps.renderer.write(color3.dim(`Manage: wstack auth   Add key: wstack auth <provider>
+  deps.renderer.write(color4.dim(`Manage: wstack auth   Add key: wstack auth <provider>
 `));
   return 0;
 }
@@ -433,7 +546,7 @@ async function runAuthStatus(deps, providerId) {
   if (!cfg) {
     deps.renderer.writeError(`Provider "${providerId}" not found in config.`);
     deps.renderer.write(
-      color3.dim(`Run ${color3.bold("wstack auth list")} to see saved providers.
+      color4.dim(`Run ${color4.bold("wstack auth list")} to see saved providers.
 `)
     );
     return 1;
@@ -442,32 +555,32 @@ async function runAuthStatus(deps, providerId) {
   const active = cfg.activeKey ?? keys[0]?.label;
   const lines = [
     `
-${color3.bold(providerId)} ${cfg.family ? color3.dim(`[${cfg.family}]`) : color3.amber("[no family]")}`,
+${color4.bold(providerId)} ${cfg.family ? color4.dim(`[${cfg.family}]`) : color4.amber("[no family]")}`,
     "",
-    `  type:    ${color3.cyan(cfg.type ?? providerId)}`,
-    `  family:  ${cfg.family ? color3.cyan(cfg.family) : color3.dim("unset")}`,
-    `  baseUrl: ${cfg.baseUrl ? color3.cyan(cfg.baseUrl) : color3.dim("unset")}`
+    `  type:    ${color4.cyan(cfg.type ?? providerId)}`,
+    `  family:  ${cfg.family ? color4.cyan(cfg.family) : color4.dim("unset")}`,
+    `  baseUrl: ${cfg.baseUrl ? color4.cyan(cfg.baseUrl) : color4.dim("unset")}`
   ];
   if (cfg.models?.length) {
-    lines.push(`  models:  ${color3.cyan(cfg.models.join(", "))}`);
+    lines.push(`  models:  ${color4.cyan(cfg.models.join(", "))}`);
   }
   if (cfg.envVars?.length) {
-    lines.push(`  envVars: ${color3.cyan(cfg.envVars.join(", "))}`);
+    lines.push(`  envVars: ${color4.cyan(cfg.envVars.join(", "))}`);
   }
   lines.push("");
   if (keys.length === 0) {
-    lines.push(color3.amber("  (no keys saved)"));
+    lines.push(color4.amber("  (no keys saved)"));
   } else {
-    lines.push(`  ${color3.dim("Keys:")}`);
+    lines.push(`  ${color4.dim("Keys:")}`);
     for (const k of keys) {
-      const marker = k.label === active ? color3.green("\u25CF") : color3.dim("\u25CB");
+      const marker = k.label === active ? color4.green("\u25CF") : color4.dim("\u25CB");
       lines.push(
-        `    ${marker} ${color3.bold(k.label.padEnd(18))} ${maskedKey(k.apiKey)}  ${color3.dim(k.createdAt)}`
+        `    ${marker} ${color4.bold(k.label.padEnd(18))} ${maskedKey(k.apiKey)}  ${color4.dim(k.createdAt)}`
       );
     }
   }
   lines.push("");
-  lines.push(color3.dim(`Manage: wstack auth \u2192 pick ${providerId}`));
+  lines.push(color4.dim(`Manage: wstack auth \u2192 pick ${providerId}`));
   deps.renderer.write(lines.join("\n") + "\n");
   return 0;
 }
@@ -478,19 +591,19 @@ async function runAuthRemove(deps, providerId) {
     return 1;
   }
   deps.renderer.write(
-    `${color3.amber("!")} This will remove "${providerId}" and all its saved keys.
+    `${color4.amber("!")} This will remove "${providerId}" and all its saved keys.
 `
   );
-  const answer = (await deps.reader.readLine(`  ${color3.amber("?")} Confirm removal? ${color3.dim("[y/N]")} `)).trim().toLowerCase();
+  const answer = (await deps.reader.readLine(`  ${color4.amber("?")} Confirm removal? ${color4.dim("[y/N]")} `)).trim().toLowerCase();
   if (answer !== "y" && answer !== "yes") {
-    deps.renderer.write(color3.dim("Cancelled.\n"));
+    deps.renderer.write(color4.dim("Cancelled.\n"));
     return 0;
   }
   try {
     await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
       delete all[providerId];
     });
-    deps.renderer.write(`  ${color3.green("\u2713")} Removed ${color3.bold(providerId)}.
+    deps.renderer.write(`  ${color4.green("\u2713")} Removed ${color4.bold(providerId)}.
 `);
     return 0;
   } catch (err) {
@@ -501,4 +614,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-6T6ZOT2R.js.map
+//# sourceMappingURL=auth-PJD3JRH2.js.map

package/dist/boot/dispatch-webui.d.ts

@@ -1,19 +1,4 @@
-/**
- * WebUI dispatch — extracted from the tail of `execute()`.
- *
- * PR 6 of Issue #29 (partial). The TUI-vs-REPL-vs-WebUI fork at the
- * end of `execute()` is a ~1,600-line `if/else if/else if/else`
- * chain. The WebUI branch is the most self-contained of the four: it
- * constructs a `runWebUI` options object from already-available deps,
- * wires SIGINT handling, and returns an exit code. Extracting it
- * first lets `execute()` shrink by ~100 lines and isolates the
- * WebUI-specific wiring (port resolution, browser banner and autonomy
- * forwarding) in a single named module.
- *
- * The TUI branch (~1,388 lines) and the single-shot branch are left
- * inline — they are too deeply coupled to local mutable state for a
- * single-PR extraction.
- */
+import { type WebuiSessionChildOptions } from './webui-session-child.js';
 import type { Agent } from '@wrongstack/core/agent';
 import type { BrainArbiter } from '@wrongstack/core/coordination';
 import type { JournalEntry } from '@wrongstack/core/goal';
@@ -99,6 +84,8 @@ export interface WebUIDispatchContext {
     }) => Promise<string>) | undefined;
     /** Live fleet budget for WebUI concurrency/spawn gauges (issue #323). */
     getFleetBudget?: CliWebUIOptions['getFleetBudget'];
+    /** Internal one-session child launch metadata, when --webui-session-child is active. */
+    webuiSessionChild?: WebuiSessionChildOptions | undefined;
 }
 /**
  * Run the WebUI server and block until it shuts down.

package/dist/boot/launch-menu.d.ts

@@ -50,13 +50,11 @@ declare const DEFAULT_PORTS: Record<Exclude<LaunchMenuMode, 'tui-repl'>, number>
  *   - `--webui`, `--simpleui`, `--hq`, or `--desktop` flag is set
  *     (the user already chose a surface)
  *   - stdin is not a TTY (CI, pipes, redirects)
- *   - the first positional looks like a known subcommand (auth,
- *     init, mcp, plugin, doctor, version, help, …)
  *   - `--no-interactive` or `--skip` (existing "skip all prompts"
  *     contract from boot.ts)
  *   - a one-shot prompt (`--prompt <x>`) is supplied
- *   - any positional argument is present (treats it like the user
- *     is forwarding a one-shot query, not launching a surface)
+ *   - ANY positional argument is present — a subcommand or a one-shot
+ *     query. The user already said what they wanted.
  */
 export declare function shouldSkipMenu(argv: string[], flags: Record<string, string | boolean>, positional: string[]): boolean;
 interface RunLaunchMenuDeps {

package/dist/boot/tool-registry.d.ts

@@ -15,6 +15,9 @@ interface RegisterBuiltinToolsDeps {
             descriptionMode?: ToolDescriptionModeConfig | undefined;
             resultRenderMode?: ToolResultRenderModeConfig | undefined;
             disabledTools?: string[] | undefined;
+            nextsteps?: {
+                enabled?: boolean | undefined;
+            } | undefined;
             exec?: {
                 allow?: string[] | undefined;
                 deny?: string[] | undefined;

package/dist/boot/webui-session-child.d.ts

@@ -0,0 +1,91 @@
+export declare const WEBUI_SESSION_CHILD_PROTOCOL_VERSION = 1;
+export declare const WEBUI_SESSION_CHILD_CAPABILITIES: readonly ['multi-session-child', 'single-port-http-ws', 'session-affinity', 'graceful-shutdown'];
+export type WebuiSessionChildPhase = 'validate_args' | 'boot_config' | 'claim_session' | 'create_session' | 'resume_session' | 'bind_port' | 'register_instance' | 'register_session' | 'start_server' | 'unknown';
+export interface WebuiSessionChildOptions {
+    enabled: boolean;
+    projectRoot: string;
+    workingDir: string;
+    sessionId?: string | undefined;
+    resume: boolean;
+    host?: string | undefined;
+    port?: number | undefined;
+    token?: string | undefined;
+    publicUrl?: string | undefined;
+    publicWsUrl?: string | undefined;
+    requireToken?: boolean | undefined;
+    strictPort: boolean;
+    parentPid: number;
+    parentShellId: string;
+    runtimeId: string;
+    readyFile: string;
+    attachable: boolean;
+    protocolVersion: number;
+}
+export interface WebuiSessionChildReadyPayload {
+    type: 'webui.session_child.ready';
+    protocolVersion: number;
+    runtime: {
+        role: 'session-child';
+        runtimeId: string;
+        pid: number;
+        parentPid: number;
+        parentShellId: string;
+        startedAt: string;
+    };
+    project: {
+        projectRoot: string;
+        workingDir: string;
+        projectSlug: string;
+        projectName: string;
+    };
+    session: {
+        sessionId: string;
+        created: boolean;
+        resumed: boolean;
+        title?: string | undefined;
+        provider?: string | undefined;
+        model?: string | undefined;
+    };
+    endpoint: {
+        surface: 'webui';
+        host: string;
+        httpPort: number;
+        url: string;
+        publicUrl?: string | undefined;
+        publicWsUrl?: string | undefined;
+        requireToken: boolean;
+        auth: {
+            scheme: 'registry-token' | 'cookie-bootstrap' | 'none';
+            tokenPresent: boolean;
+            token?: string | undefined;
+        };
+    };
+    registry: {
+        webuiInstanceRegistered: boolean;
+        sessionRegistered: boolean;
+    };
+    capabilities: string[];
+}
+export interface WebuiSessionChildErrorPayload {
+    type: 'webui.session_child.error';
+    protocolVersion: number;
+    runtimeId?: string | undefined;
+    parentShellId?: string | undefined;
+    pid: number;
+    phase: WebuiSessionChildPhase;
+    recoverable: boolean;
+    message: string;
+    details?: Record<string, unknown> | undefined;
+}
+export declare function parseWebuiSessionChildOptions(flags: Record<string, string | boolean>): WebuiSessionChildOptions | null;
+export declare function writeWebuiSessionChildReady(readyFile: string, payload: WebuiSessionChildReadyPayload): Promise<void>;
+export declare function writeWebuiSessionChildError(readyFile: string, input: {
+    protocolVersion?: number | undefined;
+    runtimeId?: string | undefined;
+    parentShellId?: string | undefined;
+    phase: WebuiSessionChildPhase;
+    recoverable: boolean;
+    error: unknown;
+    details?: Record<string, unknown> | undefined;
+}): Promise<void>;
+//# sourceMappingURL=webui-session-child.d.ts.map

package/dist/chimera-reviewer-policy.d.ts

@@ -17,9 +17,10 @@ export declare function __resetReviewerRoundRobinCursor(value?: number): void;
 /**
  * Assign provider/model/fallbackModels for a Chimera reviewer spawn.
  *
- * Builds the pool from the configured primary + fallback chain, then picks
- * the next entry via round-robin. When the pool has <=1 usable entry the
- * original primary/fallbacks are returned unchanged.
+ * Builds the pool from the configured primary + fallback chain, then chooses
+ * either the next round-robin entry or a random starting entry. The injected
+ * random source keeps the random policy deterministic in tests. When the pool
+ * has <=1 usable entry the original primary/fallbacks are returned unchanged.
  *
  * When a {@link ProviderModelStatusTracker} is supplied, blocked entries
  * (waiting-room / token-reset-limit room) are filtered from both the pool
@@ -27,6 +28,12 @@ export declare function __resetReviewerRoundRobinCursor(value?: number): void;
  * a concurrent reviewer turn. Without the tracker, the legacy pre-waiting-
  * room behavior is preserved.
  */
+export declare function assignReviewerModels(provider: string, model: string, fallbackModels: readonly string[], selection?: 'round-robin' | 'random', statusTracker?: ProviderModelStatusTracker | undefined, random?: () => number): {
+    provider: string;
+    model: string;
+    fallbackModels: string[];
+};
+/** Backward-compatible round-robin entry point for existing callers. */
 export declare function assignReviewerModelsRoundRobin(provider: string, model: string, fallbackModels: readonly string[], statusTracker?: ProviderModelStatusTracker | undefined): {
     provider: string;
     model: string;

package/dist/chimera-work-registry.d.ts

@@ -0,0 +1,19 @@
+export interface ChimeraWorkRegistry {
+    /** Track one review/cascade promise until it settles. */
+    track(work: Promise<void>): boolean;
+    /** Snapshot currently pending work for parent-before-child ordering. */
+    pending(): Promise<void> | undefined;
+    /** Stop accepting new roots after draining all accepted work to a fixed point. */
+    drainAndClose(): Promise<void>;
+    readonly size: number;
+}
+/**
+ * Session-scoped registry for Chimera review and cascade work.
+ *
+ * A single Promise slot loses overlapping reviews. A single Promise.all snapshot
+ * can also miss cascades or re-reviews registered while an earlier batch is
+ * settling. This registry retains every accepted promise and drains repeatedly
+ * until no accepted work remains, then seals admission.
+ */
+export declare function createChimeraWorkRegistry(): ChimeraWorkRegistry;
+//# sourceMappingURL=chimera-work-registry.d.ts.map