@wrongstack/cli 0.302.0 → 0.303.0

package/dist/auth-menu/index.d.ts

@@ -1,9 +1,9 @@
+export { CLAUDE_PROVIDER_ID, type ClaudeLoginOptions, type ClaudeTokens, runClaudeOAuthLogin, } from './anthropic-oauth.js';
 export { runAuthDirect } from './direct.js';
+export { COPILOT_PROVIDER_ID, type CopilotLoginOptions, runCopilotOAuthLogin, } from './github-copilot-oauth.js';
+export { LOCAL_LLM_PRESETS, type LocalLlmPresetEntry, type ProbeOptions, type ProbeResult, probeLocalLlm, type RunAuthLocalOptions, resolveModelList, runAuthLocal, } from './local.js';
+export { type OAuthMenuKind, resolveOAuthKind, runOAuthLoginChoice, runOAuthLoginKind, runOAuthLoginMenu, } from './oauth-menu.js';
+export { CODEX_BASE_URL, CODEX_CATALOG_FAMILIES, CODEX_PROVIDER_ID, type CodexLoginOptions, type CodexTokens, extractAccountId, FALLBACK_CODEX_MODELS, fallbackCodexModelIds, fallbackCodexProviderModels, fetchCodexModels, filterCurrentCodexModelIds, isCodexCatalogModel, refreshCodexToken, resolveCodexModels, runCodexOAuthLogin, } from './openai-codex-oauth.js';
 export { runTopMenu as runAuthMenu } from './top-menu.js';
 export type { AuthMenuDeps } from './types.js';
-export { resolveOAuthKind, runOAuthLoginChoice, runOAuthLoginKind, runOAuthLoginMenu, type OAuthMenuKind, } from './oauth-menu.js';
-export { runCodexOAuthLogin, refreshCodexToken, extractAccountId, fetchCodexModels, resolveCodexModels, FALLBACK_CODEX_MODELS, CODEX_CATALOG_FAMILIES, fallbackCodexModelIds, fallbackCodexProviderModels, filterCurrentCodexModelIds, isCodexCatalogModel, CODEX_PROVIDER_ID, CODEX_BASE_URL, type CodexLoginOptions, type CodexTokens, } from './openai-codex-oauth.js';
-export { runClaudeOAuthLogin, CLAUDE_PROVIDER_ID, type ClaudeLoginOptions, type ClaudeTokens, } from './anthropic-oauth.js';
-export { runCopilotOAuthLogin, COPILOT_PROVIDER_ID, type CopilotLoginOptions, } from './github-copilot-oauth.js';
-export { runAuthLocal, resolveModelList, probeLocalLlm, LOCAL_LLM_PRESETS, type RunAuthLocalOptions, type LocalLlmPresetEntry, type ProbeOptions, type ProbeResult, } from './local.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth-menu/local.d.ts

@@ -25,14 +25,13 @@
  * in plaintext.
  */
 import type { SecretScrubber } from '@wrongstack/core/types';
+import type { ProbeOptions, ProbeResult } from '@wrongstack/runtime/probe';
+import { probeLocalLlm } from '@wrongstack/runtime/probe';
+import { type AuthAuditLogger } from './auth-menu-audit.js';
 import { LOCAL_LLM_PRESETS, type LocalLlmPresetEntry } from './local-presets.js';
 import { suggestLabel } from './shared.js';
 import type { AuthMenuDeps } from './types.js';
-import { probeLocalLlm } from '@wrongstack/runtime/probe';
-import type { ProbeOptions, ProbeResult } from '@wrongstack/runtime/probe';
-import { type AuthAuditLogger } from './auth-menu-audit.js';
-export { probeLocalLlm, type ProbeOptions, type ProbeResult };
-export { LOCAL_LLM_PRESETS, type LocalLlmPresetEntry };
+export { LOCAL_LLM_PRESETS, type LocalLlmPresetEntry, type ProbeOptions, type ProbeResult, probeLocalLlm, };
 export interface RunAuthLocalOptions {
     /**
      * Direct pick: skip the interactive menu and configure this preset.

package/dist/auth-menu/openai-codex-oauth.d.ts

@@ -31,7 +31,7 @@
 import { buildCodexAuthorizeUrl, exchangeCodexAuthorizationCode, refreshCodexTokens } from '@wrongstack/providers/oauth';
 import { type LoopbackServer } from './loopback-server.js';
 import type { AuthMenuDeps } from './types.js';
-export { CODEX_BASE_URL, CODEX_CATALOG_FAMILIES, CODEX_PROVIDER_ID, type CodexTokens, extractAccountId, FALLBACK_CODEX_MODELS, fallbackCodexModelIds, fallbackCodexProviderModels, fetchCodexModels, filterCurrentCodexModelIds, generatePkce, isCodexCatalogModel, parseAuthorizationInput, type Pkce, resolveCodexModels, } from '@wrongstack/providers/oauth';
+export { CODEX_BASE_URL, CODEX_CATALOG_FAMILIES, CODEX_PROVIDER_ID, type CodexTokens, extractAccountId, FALLBACK_CODEX_MODELS, fallbackCodexModelIds, fallbackCodexProviderModels, fetchCodexModels, filterCurrentCodexModelIds, generatePkce, isCodexCatalogModel, type Pkce, parseAuthorizationInput, resolveCodexModels, } from '@wrongstack/providers/oauth';
 /** Build the Codex authorize URL. Alias kept for the historical local name. */
 export declare const buildAuthorizeUrl: typeof buildCodexAuthorizeUrl;
 /** Exchange an authorization code (+ PKCE verifier) for tokens. */

package/dist/{auto-discover-providers-DRW4OZHG.js → auto-discover-providers-MHFLDSD3.js}

@@ -1,8 +1,8 @@
 import {
   discoverAndMergeProviders
-} from "./chunk-4GVH7V3S.js";
+} from "./chunk-52C7PD2H.js";
 import "./chunk-7OCVIDC7.js";
 export {
   discoverAndMergeProviders
 };
-//# sourceMappingURL=auto-discover-providers-DRW4OZHG.js.map
+//# sourceMappingURL=auto-discover-providers-MHFLDSD3.js.map

package/dist/{bench-7ZDWSNEF.js → bench-XNDUJOSZ.js}

@@ -7,7 +7,6 @@ import "./chunk-7OCVIDC7.js";
 import * as fs from "node:fs/promises";
 import { createRequire } from "node:module";
 import * as path from "node:path";
-import { toErrorMessage } from "@wrongstack/core/utils";
 import {
   collectCellPredictions,
   computeToolManifestHash,
@@ -26,7 +25,7 @@ import {
   writeJsonArtifacts,
   writePredictionsJsonl
 } from "@wrongstack/bench";
-import { color } from "@wrongstack/core/utils";
+import { color, toErrorMessage } from "@wrongstack/core/utils";
 var benchCmd = async (args, deps) => {
   const sub = args[0];
   const rest = args.slice(1);
@@ -58,9 +57,7 @@ function printUsage(deps) {
       color.dim(
         "  wstack bench run --suite polyglot --polyglot-dir ./polyglot --models bench.config.json --limit 5"
       ),
-      color.dim(
-        "  wstack bench run --suite local --suite-dir ./evals --models bench.config.json"
-      ),
+      color.dim("  wstack bench run --suite local --suite-dir ./evals --models bench.config.json"),
       color.dim("  wstack bench mine --transcript ./session.jsonl --out ./evals"),
       color.dim("  wstack bench report ./bench-results/2026-06-14T10-00-00"),
       ""
@@ -198,9 +195,7 @@ async function benchReport(args, deps) {
   try {
     summary = await readSummary(outDir);
   } catch (err) {
-    deps.renderer.writeError(
-      `cannot read summary.json in ${outDir}: ${toErrorMessage(err)}`
-    );
+    deps.renderer.writeError(`cannot read summary.json in ${outDir}: ${toErrorMessage(err)}`);
     return 1;
   }
   const md = renderMarkdownReport(summary);
@@ -211,7 +206,9 @@ async function benchReport(args, deps) {
 async function benchMine(args, deps) {
   const transcriptRaw = flagStr(deps, "transcript") ?? args.find((arg) => !arg.startsWith("-"));
   if (!transcriptRaw) {
-    deps.renderer.writeError("Usage: wstack bench mine --transcript <session.jsonl> [--out <eval-dir>]");
+    deps.renderer.writeError(
+      "Usage: wstack bench mine --transcript <session.jsonl> [--out <eval-dir>]"
+    );
     return 1;
   }
   const outRaw = flagStr(deps, "out") ?? "evals";
@@ -220,7 +217,9 @@ async function benchMine(args, deps) {
       transcriptPath: path.resolve(deps.cwd, transcriptRaw),
       outDir: path.resolve(deps.cwd, outRaw)
     });
-    deps.renderer.writeInfo(`Mined ${mined.candidates.length} edit attempt(s) from ${mined.sessionId}.`);
+    deps.renderer.writeInfo(
+      `Mined ${mined.candidates.length} edit attempt(s) from ${mined.sessionId}.`
+    );
     deps.renderer.writeInfo(`Pinned transcript \u2192 ${mined.copiedTranscriptPath}`);
     deps.renderer.writeInfo(`Curator drafts \u2192 ${mined.draftsPath}`);
     deps.renderer.writeInfo(
@@ -275,4 +274,4 @@ async function benchList(_args, deps) {
 export {
   benchCmd
 };
-//# sourceMappingURL=bench-7ZDWSNEF.js.map
+//# sourceMappingURL=bench-XNDUJOSZ.js.map

package/dist/boot/auto-discover-providers.d.ts

@@ -1,5 +1,5 @@
-import type { Config, Logger } from '@wrongstack/core/types';
 import type { DefaultModelsRegistry } from '@wrongstack/core/models';
+import type { Config, Logger } from '@wrongstack/core/types';
 /**
  * Fetch model lists for every auto-discovery provider in the config and merge
  * them into the catalog. Best-effort end to end: a down server or missing key

package/dist/boot/container-wiring.d.ts

@@ -1,7 +1,7 @@
-import type { Config, Logger, Renderer, ModelsRegistry } from '@wrongstack/core/types';
-import type { WstackPaths } from '@wrongstack/core/utils';
-import type { EventBus } from '@wrongstack/core/kernel';
 import { DefaultPathResolver } from '@wrongstack/core/infrastructure';
+import type { EventBus } from '@wrongstack/core/kernel';
+import type { Config, Logger, ModelsRegistry, Renderer } from '@wrongstack/core/types';
+import type { WstackPaths } from '@wrongstack/core/utils';
 import { createDefaultContainer } from '@wrongstack/runtime';
 import { makePromptDelegate } from '../permission-prompt.js';
 interface WireContainerDeps {

package/dist/boot/dispatch-webui.d.ts

@@ -1,4 +1,3 @@
-import { type WebuiSessionChildOptions } from './webui-session-child.js';
 import type { Agent } from '@wrongstack/core/agent';
 import type { BrainArbiter } from '@wrongstack/core/coordination';
 import type { JournalEntry } from '@wrongstack/core/goal';
@@ -8,6 +7,7 @@ import type { MCPRegistry } from '@wrongstack/mcp';
 import type { TerminalRenderer } from '../renderer.js';
 import type { AutonomyMode } from '../services/autonomy-mode.js';
 import type { CliWebUIOptions } from '../webui-server-options.js';
+import { type WebuiSessionChildOptions } from './webui-session-child.js';
 export interface WebUIDispatchContext {
     agent: Agent;
     events: EventBus;

package/dist/boot/system-prompt.d.ts

@@ -1,6 +1,5 @@
-import type { Config, Logger, ModelsRegistry } from '@wrongstack/core/types';
 import type { ProviderRegistry } from '@wrongstack/core/registry';
-import type { ResolvedProvider } from '@wrongstack/core/types';
+import type { Config, Logger, ModelsRegistry, ResolvedProvider } from '@wrongstack/core/types';
 export type ModeId = string;
 export type ModePrompt = string;
 export interface ModelCapabilities {

package/dist/boot/tool-registry.d.ts

@@ -1,8 +1,8 @@
 /** CLI boot adapter for canonical runtime tool registration and host policies. */
 import type { EventBus } from '@wrongstack/core/kernel';
+import type { ToolRegistry } from '@wrongstack/core/registry';
 import type { MemoryPort, TokenSavingTier, ToolDescriptionModeConfig, ToolResultRenderModeConfig } from '@wrongstack/core/types';
 import type { WstackPaths } from '@wrongstack/core/utils';
-import type { ToolRegistry } from '@wrongstack/core/registry';
 interface RegisterBuiltinToolsDeps {
     toolRegistry: ToolRegistry;
     compactor: unknown;

package/dist/boot/tui-coordinator-setup.d.ts

@@ -1,5 +1,5 @@
-import { AutonomousCoordinator, type Director } from '@wrongstack/core/coordination';
 import type { Context } from '@wrongstack/core/agent';
+import { AutonomousCoordinator, type Director } from '@wrongstack/core/coordination';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { WstackPaths } from '@wrongstack/core/utils';
 import type { TuiRuntimeState } from './tui-runtime-state.js';

package/dist/boot/tui-project-picker-callback.d.ts

@@ -1,7 +1,7 @@
 import type { Director } from '@wrongstack/core/coordination';
 import type { TerminalRenderer } from '../renderer.js';
-import type { TuiRuntimeState } from './tui-runtime-state.js';
 import type { ProjectSwitchContext } from './tui-project-switch.js';
+import type { TuiRuntimeState } from './tui-runtime-state.js';
 export interface ProjectPickerContext {
     state: TuiRuntimeState;
     renderer: TerminalRenderer;

package/dist/boot/tui-theme-adapter.d.ts

@@ -0,0 +1,33 @@
+/**
+ * TUI Theme adapter — extracts the getThemePreset/saveThemePreset pair from
+ * the runTui() options literal.
+ *
+ * Mirrors the `createSettingsAdapter` shape (see `./tui-settings-adapter.ts`)
+ * but is much narrower: theme is a single enum-valued key, so there's no
+ * section merge, no schema fan-out, and no encrypted-secret dance (the
+ * value is a plain preset name, not a credential).
+ *
+ * The disk write goes to the active profile's config file (same target
+ * `createSettingsAdapter` writes) so both layers share the same source of
+ * truth: future TUI boots read `themePreset` from the same JSON file the
+ * CLI writes via `/theme` and the WebUI flips via Settings.
+ */
+import type { ConfigStore, ThemePresetId } from '@wrongstack/core/types';
+import { type WstackPaths } from '@wrongstack/core/utils';
+export interface ThemeAdapterDeps {
+    configStore: ConfigStore;
+    wpaths: Pick<WstackPaths, 'profileConfig'>;
+}
+export interface ThemeAdapter {
+    /** Read the live preset (memory-backed). Returns undefined when unset. */
+    getThemePreset: () => ThemePresetId | undefined;
+    /**
+     * Persist a new preset to BOTH the in-memory configStore (so the running
+     * session sees it immediately) and the active profile's config file on
+     * disk (so the next boot starts with this preset applied). Unknown ids
+     * are rejected without writing.
+     */
+    saveThemePreset: (preset: ThemePresetId) => Promise<void>;
+}
+export declare function createThemeAdapter({ configStore, wpaths }: ThemeAdapterDeps): ThemeAdapter;
+//# sourceMappingURL=tui-theme-adapter.d.ts.map

package/dist/boot-config.d.ts

@@ -1,7 +1,7 @@
-import type { Config } from '@wrongstack/core/types';
+import type { DefaultPathResolver } from '@wrongstack/core/infrastructure';
 import { bootConfig as coreBootConfig } from '@wrongstack/core/infrastructure';
+import type { Config } from '@wrongstack/core/types';
 import type { WstackPaths } from '@wrongstack/core/utils';
-import type { DefaultPathResolver } from '@wrongstack/core/infrastructure';
 export interface BootPaths {
     cwd: string;
     projectRoot: string;

package/dist/boot.d.ts

@@ -1,6 +1,6 @@
+import { DefaultLogger } from '@wrongstack/core/infrastructure';
 import type { Config, ModelsRegistry, SecretVault } from '@wrongstack/core/types';
 import { type WstackPaths } from '@wrongstack/core/utils';
-import { DefaultLogger } from '@wrongstack/core/infrastructure';
 import { ReadlineInputReader } from './input-reader.js';
 import { TerminalRenderer } from './renderer.js';
 import type { UpdateInfo } from './update-check.js';

package/dist/{chunk-ETOEGL3V.js → chunk-3IC4IEZC.js}

@@ -66,7 +66,12 @@ async function buildPickableProviders(modelsRegistry, config) {
     const inherited = catalogById.get(catalogType) ?? catalogById.get(cfg.type ?? id);
     const family = cfg.family ?? inherited?.family ?? "unsupported";
     if (family === "unsupported") continue;
-    const models = visibleModelIds(id, config, (inherited?.models ?? []).map((m) => m.id), cfg);
+    const models = visibleModelIds(
+      id,
+      config,
+      (inherited?.models ?? []).map((m) => m.id),
+      cfg
+    );
     out.push({ id, family, models });
   }
   for (const p of catalog) {
@@ -84,4 +89,4 @@ export {
   hasApiKey,
   buildPickableProviders
 };
-//# sourceMappingURL=chunk-ETOEGL3V.js.map
+//# sourceMappingURL=chunk-3IC4IEZC.js.map

package/dist/{chunk-PFVVUH5B.js → chunk-3JPTNADJ.js}

@@ -34,7 +34,8 @@ function boolFlag(flags, names) {
 function parsePositiveInteger(value, label) {
   if (value === void 0) throw new Error(`${label} is required`);
   const parsed = Number.parseInt(value, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) throw new Error(`${label} must be a positive integer`);
+  if (!Number.isInteger(parsed) || parsed <= 0)
+    throw new Error(`${label} must be a positive integer`);
   return parsed;
 }
 function parsePort(value) {
@@ -124,4 +125,4 @@ export {
   writeWebuiSessionChildReady,
   writeWebuiSessionChildError
 };
-//# sourceMappingURL=chunk-PFVVUH5B.js.map
+//# sourceMappingURL=chunk-3JPTNADJ.js.map

package/dist/{chunk-4GVH7V3S.js → chunk-52C7PD2H.js}

@@ -58,4 +58,4 @@ async function discoverAndMergeProviders(opts) {
 export {
   discoverAndMergeProviders
 };
-//# sourceMappingURL=chunk-4GVH7V3S.js.map
+//# sourceMappingURL=chunk-52C7PD2H.js.map

package/dist/{chunk-I5MEUFDI.js → chunk-53STH6CX.js}

@@ -3,11 +3,12 @@ import {
 } from "./chunk-U3SS4NRH.js";
 import {
   checkForUpdate
-} from "./chunk-F4PEGAJZ.js";
+} from "./chunk-NUIHRGPY.js";
 
 // src/subcommands/handlers/update.ts
 import { spawn } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
+import * as path from "node:path";
 var MAX_UPDATE_OUTPUT_CHARS = 256 * 1024;
 async function runUpdateCommand(args, deps) {
   const cwd = deps.cwd;
@@ -75,9 +76,20 @@ async function runUpdateCommand(args, deps) {
     return 0;
   }
   const packageManager = parsed.packageManager ?? detectUpdatePackageManager();
-  const updateCommand = buildUpdateCommand(packageManager, packageName, info.latest, {
-    allowScripts: parsed.allowScripts
-  });
+  let updateCommand;
+  try {
+    updateCommand = buildUpdateCommand(packageManager, packageName, info.latest, {
+      allowScripts: parsed.allowScripts,
+      cwd,
+      env: deps.environment
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    deps.renderer.write(`
+Update failed: ${msg}
+`);
+    return 1;
+  }
   deps.renderer.write(`Updating wrongstack from v${info.current} to v${info.latest}...
 `);
   deps.renderer.write(`Running: ${updateCommand.display}
@@ -122,6 +134,10 @@ Update ${termination}.
 ${result.stdout}`.trim();
       if (detail) deps.renderer.write(`
 ${detail}
+`);
+      const lockedFilesGuidance = windowsLockedFilesGuidance(detail);
+      if (lockedFilesGuidance) deps.renderer.write(`
+${lockedFilesGuidance}
 `);
       deps.renderer.write(
         `
@@ -197,7 +213,12 @@ function parseUpdateArgs(args) {
     if (pmEq) {
       const pm = parsePackageManager(pmEq);
       if (!pm)
-        return { checkOnly, packageManager, allowScripts, error: `Invalid package manager: ${pmEq}` };
+        return {
+          checkOnly,
+          packageManager,
+          allowScripts,
+          error: `Invalid package manager: ${pmEq}`
+        };
       packageManager = pm;
       continue;
     }
@@ -242,36 +263,53 @@ function detectUpdatePackageName(argv = process.argv) {
   const entry = (argv[1] ?? "").replace(/\\/g, "/").toLowerCase();
   return entry.includes("/node_modules/@wrongstack/cli/") || entry.includes("/packages/cli/dist/") ? "@wrongstack/cli" : "wrongstack";
 }
-function buildUpdateCommand(packageManager, packageName, version, opts = { allowScripts: false }) {
+function buildUpdateCommand(packageManager, packageName, version, opts = {
+  allowScripts: false
+}) {
   const ignoreScripts = !opts.allowScripts;
   const target = `${packageName}@${version}`;
   switch (packageManager) {
     case "pnpm":
       return command(
         packageManager,
-        ignoreScripts ? ["add", "-g", "--ignore-scripts", target] : ["add", "-g", target]
+        ignoreScripts ? ["add", "-g", "--ignore-scripts", target] : ["add", "-g", target],
+        opts.cwd,
+        opts.env
       );
     case "yarn":
       return command(
         packageManager,
-        ignoreScripts ? ["global", "add", "--ignore-scripts", target] : ["global", "add", target]
+        ignoreScripts ? ["global", "add", "--ignore-scripts", target] : ["global", "add", target],
+        opts.cwd,
+        opts.env
       );
     case "bun":
       return command(
         packageManager,
-        ignoreScripts ? ["add", "-g", "--ignore-scripts", target] : ["add", "-g", target]
+        ignoreScripts ? ["add", "-g", "--ignore-scripts", target] : ["add", "-g", target],
+        opts.cwd,
+        opts.env
       );
     case "npm":
       return command(
         packageManager,
-        ignoreScripts ? ["install", "-g", "--ignore-scripts", target] : ["install", "-g", target]
+        ignoreScripts ? ["install", "-g", "--ignore-scripts", target] : ["install", "-g", target],
+        opts.cwd,
+        opts.env
       );
   }
 }
-function command(pm, args) {
+function command(pm, args, cwd, env = process.env) {
   const display = `${pm} ${args.join(" ")}`;
-  if (process.platform === "win32" && pm !== "bun") {
-    const shim = buildWin32CmdShimInvocation(pm, args);
+  const resolvedExecutable = cwd ? resolveWin32PackageManagerPath(pm, cwd, env) : void 0;
+  if (process.platform === "win32" && cwd && !resolvedExecutable) {
+    throw new Error(
+      `Could not find ${pm} outside the current project directory. Install ${pm} globally or put its global executable directory on PATH.`
+    );
+  }
+  const executable = resolvedExecutable ?? pm;
+  if (process.platform === "win32" && (pm !== "bun" || /\.(?:cmd|bat)$/i.test(executable))) {
+    const shim = buildWin32CmdShimInvocation(executable, args);
     return {
       executable: shim.command,
       args: shim.args,
@@ -279,7 +317,39 @@ function command(pm, args) {
       windowsVerbatimArguments: shim.windowsVerbatimArguments
     };
   }
-  return { executable: pm, args, display };
+  return { executable, args, display };
+}
+function resolveWin32PackageManagerPath(packageManager, cwd, env = process.env, pathExists = existsSync) {
+  if (process.platform !== "win32") return void 0;
+  const pathValue = environmentValue(env, "PATH");
+  if (!pathValue) return void 0;
+  const cwdPath = path.win32.resolve(cwd).toLowerCase();
+  const extensions = packageManager.includes(".") ? [""] : environmentValue(env, "PATHEXT")?.split(";").filter(Boolean) ?? [
+    ".COM",
+    ".EXE",
+    ".BAT",
+    ".CMD"
+  ];
+  for (const rawEntry of pathValue.split(";")) {
+    const entry = rawEntry.trim().replace(/^"|"$/g, "");
+    if (!entry || !path.win32.isAbsolute(entry)) continue;
+    const directory = path.win32.resolve(entry);
+    if (isPathInsideWin32(directory, cwdPath)) continue;
+    for (const extension of extensions) {
+      const candidate = path.win32.join(directory, `${packageManager}${extension}`);
+      if (pathExists(candidate)) return candidate;
+    }
+  }
+  return void 0;
+}
+function environmentValue(env, key) {
+  const match = Object.entries(env).find(([name]) => name.toUpperCase() === key);
+  return typeof match?.[1] === "string" ? match[1] : void 0;
+}
+function isPathInsideWin32(candidate, parent) {
+  const normalizedCandidate = path.win32.resolve(candidate).toLowerCase();
+  const relative = path.win32.relative(parent, normalizedCandidate);
+  return relative === "" || !relative.startsWith("..\\") && relative !== ".." && !path.win32.isAbsolute(relative);
 }
 function otherManagerCommands(selected, packageName, version, opts = { allowScripts: false }) {
   const commands = ["npm", "pnpm", "yarn", "bun"].filter((pm) => pm !== selected).map((pm) => `  ${buildUpdateCommand(pm, packageName, version, opts).display}`);
@@ -296,6 +366,15 @@ function installWarningSummary(output) {
   if (!/allow-scripts|allowScripts/i.test(output)) return null;
   return "Install completed, but npm reported blocked lifecycle scripts. If a native optional feature is missing, rerun the update with npm script approval for the named package.";
 }
+function windowsLockedFilesGuidance(output) {
+  if (process.platform !== "win32") return null;
+  const hasLockError = /\b(?:EBUSY|EPERM|EACCES|ENOTEMPTY)\b/i.test(output);
+  const isWrongStackNativeFile = /(?:\.wrongstack-|wrongstack[\\/]node_modules|electron\.exe|dd_pprof\.node|node-pty)/i.test(
+    output
+  );
+  if (!hasLockError || !isWrongStackNativeFile) return null;
+  return "Windows could not replace a native file held by a running WrongStack process. Stop any WrongStack WebUI, Desktop, or background process, then rerun the same update command. Do not remove npm\u2019s .wrongstack-* staging directory until those processes have stopped.";
+}
 
 export {
   runUpdateCommand,
@@ -303,4 +382,4 @@ export {
   detectUpdatePackageManager,
   detectUpdatePackageName
 };
-//# sourceMappingURL=chunk-I5MEUFDI.js.map
+//# sourceMappingURL=chunk-53STH6CX.js.map

package/dist/{chunk-OP47B3IX.js → chunk-7YLN7YUA.js}

@@ -4,7 +4,12 @@ function createHqCommandDispatcher(controller) {
   return async (command) => {
     const cmd = command;
     try {
-      const result = await dispatch(controller, cmd.commandId, cmd.type, cmd.payload);
+      const result = await dispatch(
+        controller,
+        cmd.commandId,
+        cmd.type,
+        cmd.payload
+      );
       return result;
     } catch (err) {
       return {
@@ -139,4 +144,4 @@ ${command}
 export {
   createHqCommandDispatcher
 };
-//# sourceMappingURL=chunk-OP47B3IX.js.map
+//# sourceMappingURL=chunk-7YLN7YUA.js.map

package/dist/{chunk-263G3FMB.js → chunk-B4JLSXZB.js}

@@ -4,10 +4,9 @@ import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import os from "node:os";
 import * as path from "node:path";
-import { atomicWrite, resolveWstackPaths, writeErr } from "@wrongstack/core/utils";
-import { ERROR_CODES, FsError } from "@wrongstack/core/types";
 import { isSecretField } from "@wrongstack/core/security";
-import { toErrorMessage } from "@wrongstack/core/utils";
+import { ERROR_CODES, FsError } from "@wrongstack/core/types";
+import { atomicWrite, resolveWstackPaths, toErrorMessage, writeErr } from "@wrongstack/core/utils";
 var defaultUidFn = () => os.userInfo().uid;
 async function getFileUid(filePath) {
   try {
@@ -141,7 +140,11 @@ function historyDir(homeFn = defaultHomeDir, targetConfigPath) {
   return path.join(path.dirname(configPath(homeFn, targetConfigPath)), "config.history", "entries");
 }
 function historyIndexPath(homeFn = defaultHomeDir, targetConfigPath) {
-  return path.join(path.dirname(configPath(homeFn, targetConfigPath)), "config.history", "index.json");
+  return path.join(
+    path.dirname(configPath(homeFn, targetConfigPath)),
+    "config.history",
+    "index.json"
+  );
 }
 function configPath(homeFn = defaultHomeDir, targetConfigPath) {
   return targetConfigPath ?? activeProfileConfigPath(homeFn);
@@ -221,9 +224,7 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
     try {
       await atomicWrite(last, content, { mode: 384 });
     } catch (err) {
-      writeErr(
-        `[config-history] .last backup failed: ${toErrorMessage(err)}`
-      );
+      writeErr(`[config-history] .last backup failed: ${toErrorMessage(err)}`);
     }
   }
   if (content !== void 0) {
@@ -231,9 +232,7 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
       const bakPath = `${cfg}.${ts}.bak`;
       await atomicWrite(bakPath, content, { mode: 384 });
     } catch (err) {
-      writeErr(
-        `[config-history] timestamped backup failed: ${toErrorMessage(err)}`
-      );
+      writeErr(`[config-history] timestamped backup failed: ${toErrorMessage(err)}`);
     }
   }
   try {
@@ -244,9 +243,7 @@ async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
       await safeDelete(path.join(dir, f));
     }
   } catch (err) {
-    writeErr(
-      `[config-history] backup prune failed: ${toErrorMessage(err)}`
-    );
+    writeErr(`[config-history] backup prune failed: ${toErrorMessage(err)}`);
   }
 }
 async function appendHistory(oldCfg, newCfg, description, homeFn = defaultHomeDir, targetConfigPath) {
@@ -366,4 +363,4 @@ export {
   restoreFromHistory,
   restoreLast
 };
-//# sourceMappingURL=chunk-263G3FMB.js.map
+//# sourceMappingURL=chunk-B4JLSXZB.js.map

package/dist/{chunk-MT6FGXO3.js → chunk-C5NXM2SI.js}

@@ -2,11 +2,11 @@ import {
   hasApiKey,
   isKeylessLocalProvider,
   visibleModelIds
-} from "./chunk-ETOEGL3V.js";
+} from "./chunk-3IC4IEZC.js";
 import {
   appendHistory,
   backupCurrent
-} from "./chunk-263G3FMB.js";
+} from "./chunk-B4JLSXZB.js";
 
 // src/arg-parser.ts
 var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
@@ -230,8 +230,15 @@ var LOCAL_LLM_PRESETS = projectLocalProviderPresets();
 
 // src/picker.ts
 import os from "node:os";
-import { color as color3, expectDefined as expectDefined2, setOutputLineGuard as setOutputLineGuard2, setRawMode as setRawMode2, stripAnsi as stripAnsi2, writeOut as writeOut2 } from "@wrongstack/core/utils";
-import { toErrorMessage } from "@wrongstack/core/utils";
+import {
+  color as color3,
+  expectDefined as expectDefined2,
+  setOutputLineGuard as setOutputLineGuard2,
+  setRawMode as setRawMode2,
+  stripAnsi as stripAnsi2,
+  toErrorMessage,
+  writeOut as writeOut2
+} from "@wrongstack/core/utils";
 
 // src/picker-key-state.ts
 function applyPickerKey(state, chunk, matchCount) {
@@ -267,7 +274,13 @@ function applyPickerKey(state, chunk, matchCount) {
 }
 
 // src/picker-model-picker.ts
-import { color as color2, expectDefined, setOutputLineGuard, setRawMode, writeOut } from "@wrongstack/core/utils";
+import {
+  color as color2,
+  expectDefined,
+  setOutputLineGuard,
+  setRawMode,
+  writeOut
+} from "@wrongstack/core/utils";
 
 // src/picker-ui.ts
 import { color, stripAnsi } from "@wrongstack/core/utils";
@@ -1039,4 +1052,4 @@ export {
   runLiveProviderPicker,
   runPicker
 };
-//# sourceMappingURL=chunk-MT6FGXO3.js.map
+//# sourceMappingURL=chunk-C5NXM2SI.js.map

package/dist/{chunk-XTIXVJXP.js → chunk-DGXNL7OT.js}

@@ -435,4 +435,4 @@ export {
   getTaskGraphId,
   getTaskTrackerExport
 };
-//# sourceMappingURL=chunk-XTIXVJXP.js.map
+//# sourceMappingURL=chunk-DGXNL7OT.js.map