@wrongstack/cli 0.302.2 → 0.305.0

package/dist/index.js

@@ -1,8 +1,4 @@
 #!/usr/bin/env node
-import {
-  parseWebuiSessionChildOptions,
-  writeWebuiSessionChildError
-} from "./chunk-3JPTNADJ.js";
 import {
   applySimpleUiFullAutoProfile,
   detectProjectFacts,
@@ -17,6 +13,10 @@ import {
 import {
   patchConfig
 } from "./chunk-TYO2OVAD.js";
+import {
+  parseWebuiSessionChildOptions,
+  writeWebuiSessionChildError
+} from "./chunk-3JPTNADJ.js";
 import {
   parseArgs,
   runPicker,
@@ -38,12 +38,12 @@ import {
 } from "./chunk-YMXXOOFN.js";
 import {
   runUpdateCommand
-} from "./chunk-BXQG3H2Y.js";
+} from "./chunk-53STH6CX.js";
 import "./chunk-U3SS4NRH.js";
 import "./chunk-NUIHRGPY.js";
 import {
   DEFAULT_PORT
-} from "./chunk-WOXUE2CN.js";
+} from "./chunk-RHLQT3EV.js";
 import "./chunk-KE7E7DPX.js";
 import "./chunk-Q5GTM25S.js";
 import {
@@ -59,7 +59,7 @@ import {
 import "./chunk-7OCVIDC7.js";
 
 // src/cli-context.ts
-import { TOKENS as TOKENS4 } from "@wrongstack/core/kernel";
+import { TOKENS as TOKENS3 } from "@wrongstack/core/kernel";
 import { writeErr as writeErr3 } from "@wrongstack/core/utils";
 import { setOAuthTokenPersister } from "@wrongstack/providers";
 
@@ -761,7 +761,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-KU2Z54QU.js");
+  const { startHqServer } = await import("./hq-server-IVZLVCFV.js");
   const tunnelRequested = flags["tunnel"] === true;
   const host = typeof flags["host"] === "string" ? flags["host"] : tunnelRequested ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST2;
   if (tunnelRequested && !isLoopbackHost(host)) {
@@ -2306,10 +2306,10 @@ function compactSingleLine(text) {
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-XCE4JJF3.js")).acpCmd,
+  acp: async () => (await import("./acp-5ZLGFHWP.js")).acpCmd,
   init: async () => (await import("./init-E2NDDOHI.js")).initCmd,
   auth: async () => (await import("./auth-K7CYVVKH.js")).authCmd,
-  update: async () => (await import("./update-LTDJGAFU.js")).updateCmd,
+  update: async () => (await import("./update-VZSOZGYC.js")).updateCmd,
   sessions: async () => (await import("./sessions-config-YX2ZPAFM.js")).sessionsCmd,
   config: async () => (await import("./sessions-config-YX2ZPAFM.js")).configCmd,
   rewind: async () => (await import("./rewind-7RE6ONIC.js")).rewindCmd,
@@ -2319,7 +2319,7 @@ var loaders = {
   skills: async () => (await import("./tools-skills-UNKLOB7M.js")).skillsCmd,
   providers: async () => (await import("./providers-models-VV74TRQ2.js")).providersCmd,
   models: async () => (await import("./providers-models-VV74TRQ2.js")).modelsCmd,
-  mcp: async () => (await import("./mcp-E5EBGOHF.js")).mcpCmd,
+  mcp: async () => (await import("./mcp-MSARYOPN.js")).mcpCmd,
   plugin: async () => (await import("./plugin-usage-PTEETL3J.js")).pluginCmd,
   plugins: async () => (await import("./plugin-usage-PTEETL3J.js")).pluginCmd,
   diag: async () => (await import("./diag-doctor-ZF5BF2MK.js")).diagCmd,
@@ -2333,8 +2333,8 @@ var loaders = {
   quick: async () => (await import("./quick-VIO2BEHS.js")).quickCmd,
   bench: async () => (await import("./bench-XNDUJOSZ.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-63MFCZN6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-AHPAE7EN.js")).hqCmd,
-  mailbox: async () => (await import("./mailbox-serve-DBOOOOWZ.js")).mailboxServeCmd,
+  hq: async () => (await import("./hq-5G6D5YIU.js")).hqCmd,
+  mailbox: async () => (await import("./mailbox-serve-V3QIJBDH.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-2PWBL4YU.js")).permissionsCmd,
   project: async () => (await import("./project-BLQ3ALVL.js")).projectCmd,
   governance: async () => (await import("./governance-V2Z42RBE.js")).governanceCmd
@@ -2916,35 +2916,6 @@ async function runPreflight(config, initialUpdateInfo) {
   };
 }
 
-// src/wiring/replay.ts
-import { runProviderWithRetry } from "@wrongstack/core/agent";
-import { TOKENS as TOKENS3 } from "@wrongstack/core/kernel";
-import { ReplayProviderRunner } from "@wrongstack/core/replay";
-import { ReplayLogStore } from "@wrongstack/core/storage";
-function bindReplayToContainer(opts) {
-  const { container, wpaths, sessionId, mode, logger } = opts;
-  if (!opts.container.has(TOKENS3.ProviderRunner)) {
-    container.bind(
-      TOKENS3.ProviderRunner,
-      () => ({
-        run: (o) => runProviderWithRetry(o)
-      })
-    );
-  }
-  const inner = container.resolve(TOKENS3.ProviderRunner);
-  const log = new ReplayLogStore({ dir: wpaths.projectSessions });
-  const wrapped = new ReplayProviderRunner(inner, {
-    log,
-    sessionId,
-    mode,
-    logger: logger ? {
-      debug: (m) => logger.debug?.(m),
-      warn: (m) => logger.warn?.(m)
-    } : void 0
-  });
-  container.bind(TOKENS3.ProviderRunner, () => wrapped);
-}
-
 // src/cli-context.ts
 async function initializeCli(argv) {
   applyNodeEnvDefault();
@@ -3103,21 +3074,7 @@ async function initializeCli(argv) {
     renderer,
     modelsRegistry
   });
-  const replayFlag = ctx.flags["replay"];
-  const recordFlag = ctx.flags["record"];
-  if (typeof replayFlag === "string" || recordFlag === true) {
-    const sessionId = typeof replayFlag === "string" ? replayFlag : `record-${Date.now()}`;
-    const mode = recordFlag === true ? "record" : "replay";
-    bindReplayToContainer({
-      container,
-      wpaths,
-      sessionId,
-      mode,
-      logger
-    });
-    logger.info(`replay: ProviderRunner bound in '${mode}' mode for session ${sessionId}`);
-  }
-  const configStore = container.resolve(TOKENS4.ConfigStore);
+  const configStore = container.resolve(TOKENS3.ConfigStore);
   return {
     ...ctx,
     updateInfo: refreshedUpdateInfo,
@@ -3132,7 +3089,7 @@ async function initializeCli(argv) {
 async function main(argv) {
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-PJMDZHDK.js");
+  const { runInteractive } = await import("./cli-main-W3T56YCY.js");
   return runInteractive(cliCtx);
 }
 

package/dist/{mailbox-serve-DBOOOOWZ.js → mailbox-serve-V3QIJBDH.js}

@@ -1,6 +1,6 @@
 import {
   startCliHqConnection
-} from "./chunk-JW75HY4F.js";
+} from "./chunk-FKWHSFX4.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/mailbox-serve.ts
@@ -341,4 +341,4 @@ function printHelp(deps) {
 export {
   mailboxServeCmd
 };
-//# sourceMappingURL=mailbox-serve-DBOOOOWZ.js.map
+//# sourceMappingURL=mailbox-serve-V3QIJBDH.js.map

package/dist/{mcp-E5EBGOHF.js → mcp-MSARYOPN.js}

@@ -220,7 +220,10 @@ async function serveMcpStdio(deps) {
     permissionPolicy,
     secretScrubber: new DefaultSecretScrubber(),
     maxToolTimeoutMs: deps.config.tools?.maxToolTimeoutMs ?? 3e5,
-    perIterationOutputCapBytes: 1e6
+    perIterationOutputCapBytes: 1e6,
+    // Kanban tracks work; it does not gate it. Off unless the operator opts in.
+    // See wiring/pipeline.ts for why all four hosts must agree.
+    requireKanbanGovernance: deps.config.tools?.kanbanGovernance ?? false
   });
   const allowed = await selectExposedTools(registry, ctx, permissionPolicy, whitelist);
   const allowedNames = new Set(allowed.map((t) => t.name));
@@ -414,4 +417,4 @@ function isRecord(value) {
 export {
   mcpCmd
 };
-//# sourceMappingURL=mcp-E5EBGOHF.js.map
+//# sourceMappingURL=mcp-MSARYOPN.js.map

package/dist/replay-XU6ZD7GM.js

@@ -0,0 +1,34 @@
+import "./chunk-7OCVIDC7.js";
+
+// src/wiring/replay.ts
+import { runProviderWithRetry } from "@wrongstack/core/agent";
+import { TOKENS } from "@wrongstack/core/kernel";
+import { ReplayProviderRunner } from "@wrongstack/core/replay";
+import { ReplayLogStore } from "@wrongstack/core/storage";
+function bindReplayToContainer(opts) {
+  const { container, wpaths, sessionId, mode, logger } = opts;
+  if (!opts.container.has(TOKENS.ProviderRunner)) {
+    container.bind(
+      TOKENS.ProviderRunner,
+      () => ({
+        run: (o) => runProviderWithRetry(o)
+      })
+    );
+  }
+  const inner = container.resolve(TOKENS.ProviderRunner);
+  const log = new ReplayLogStore({ dir: wpaths.projectSessions });
+  const wrapped = new ReplayProviderRunner(inner, {
+    log,
+    sessionId,
+    mode,
+    logger: logger ? {
+      debug: (m) => logger.debug?.(m),
+      warn: (m) => logger.warn?.(m)
+    } : void 0
+  });
+  container.bind(TOKENS.ProviderRunner, () => wrapped);
+}
+export {
+  bindReplayToContainer
+};
+//# sourceMappingURL=replay-XU6ZD7GM.js.map

package/dist/slash-commands/agent-improve.d.ts

@@ -7,7 +7,10 @@ import type { SlashCommandContext } from './command-context.js';
  *   show         — display current customization for one or all roles
  *   update       — write new identity/learned content (prompts for content)
  *   refresh     — reset identity.md + learned.md to empty templates (keep config/knowledge)
- *   consolidate  — optimize raw learned entries into a reviewed, consolidated document
+ *   capture      — re-scan the last turn for ## LEARNED blocks
+ *   optimize     — distil captures into per-skill addenda + a consolidated document
+ *                  (alias: consolidate)
+ *   skills       — list skills with project affinity; show or pin one
  *   reset        — delete ALL project customizations for a role (rm -rf the dir)
  *   reset-all    — delete customizations for EVERY role
  */

package/dist/slash-commands/memory-triage.d.ts

@@ -19,29 +19,16 @@
  * `/memory compact`. Falls back to a no-op LLM if the provider is absent
  * (Phase 3 and 4 will degrade to skip-only; report is still useful).
  */
-import type { CreateCandidateInput, SageSurface } from '@wrongstack/sage';
+import type { SageSurface } from '@wrongstack/sage';
 import { type TriageReport } from '@wrongstack/sage';
 import type { SlashCommandContext } from './command-context.js';
 export declare function runTriageCommand(opts: SlashCommandContext, args: string[]): Promise<{
     message: string;
 }>;
-export interface ProposalFileResult {
-    filed: number;
-    failed: number;
-    total: number;
-    failures: Array<{
-        memoryId: string;
-        error: string;
-    }>;
-    /** All inputs that were submitted to Sage.createCandidate, for test verification. */
-    inputs: CreateCandidateInput[];
-}
+export type { ProposalFileResult } from '@wrongstack/sage';
 /**
  * File triage proposals as MemoryCandidates via the Sage surface.
- *
- * Exported for unit testing — the round-trip path through
- * Sage.createCandidate is the key contract: every proposal must
- * surface in `/memory candidates` for human review.
+ * Implementation lives in `@wrongstack/sage` (shared with daily dry-run).
  */
-export declare function fileProposals(Sage: SageSurface, proposals: TriageReport['dispatch']['proposals']): Promise<ProposalFileResult>;
+export declare function fileProposals(Sage: SageSurface, proposals: TriageReport['dispatch']['proposals']): Promise<import('@wrongstack/sage').ProposalFileResult>;
 //# sourceMappingURL=memory-triage.d.ts.map

package/dist/slash-commands/theme.d.ts

@@ -0,0 +1,6 @@
+import type { InputReader, SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommandContext } from './command-context.js';
+export declare function buildThemeCommand(opts: SlashCommandContext & {
+    inputReader?: InputReader | undefined;
+}): SlashCommand;
+//# sourceMappingURL=theme.d.ts.map

package/dist/subcommands/handlers/update.d.ts

@@ -7,6 +7,8 @@ export interface UpdateCommandDeps {
     userHome: string;
     renderer: Pick<TerminalRenderer, 'write'>;
     flags?: SubcommandDeps['flags'] | undefined;
+    /** Test seam for a Windows PATH lookup; production uses process.env. */
+    environment?: NodeJS.ProcessEnv | undefined;
 }
 /** `wrongstack update` — Update the CLI via the detected global package manager. */
 export declare function runUpdateCommand(args: string[], deps: UpdateCommandDeps): Promise<number>;

package/dist/{update-LTDJGAFU.js → update-VZSOZGYC.js}

@@ -3,7 +3,7 @@ import {
   detectUpdatePackageName,
   runUpdateCommand,
   updateCmd
-} from "./chunk-BXQG3H2Y.js";
+} from "./chunk-53STH6CX.js";
 import "./chunk-U3SS4NRH.js";
 import "./chunk-NUIHRGPY.js";
 import "./chunk-7OCVIDC7.js";
@@ -13,4 +13,4 @@ export {
   runUpdateCommand,
   updateCmd
 };
-//# sourceMappingURL=update-LTDJGAFU.js.map
+//# sourceMappingURL=update-VZSOZGYC.js.map

package/dist/{webui-server-E3OPEKU5.js → webui-server-FTG7JAZU.js}

@@ -1,12 +1,12 @@
-import {
-  createKanbanRunMirror
-} from "./chunk-VCYZ3WZV.js";
 import {
   createHqCommandDispatcher
 } from "./chunk-7YLN7YUA.js";
+import {
+  createKanbanRunMirror
+} from "./chunk-VCYZ3WZV.js";
 import {
   startCliHqConnection
-} from "./chunk-JW75HY4F.js";
+} from "./chunk-FKWHSFX4.js";
 import {
   WEBUI_SESSION_CHILD_CAPABILITIES
 } from "./chunk-3JPTNADJ.js";
@@ -1591,4 +1591,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-E3OPEKU5.js.map
+//# sourceMappingURL=webui-server-FTG7JAZU.js.map

package/dist/wiring/domain-glossary.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Narrow adapter that bridges the resolved SAGE `MemoryPort` to the
+ * `DomainGlossary` shape the prompt builder consumes.
+ *
+ * Background
+ * ----------
+ * The agent system prompt wants a compact `[Project Jargon Dictionary]`
+ * block listing only the project's `domain-term`-tagged memories. The
+ * block must come from SAGE so the same single-owner-of-SQLite invariant
+ * holds (per `packages/sage/docs/direct-icp-usage.md`). But the prompt
+ * builder runs **before** any per-turn SAGE middleware has filtered the
+ * corpus — so we can't simply hand it the legacy `MemoryStore` and ask
+ * it to call `list()`. That would scan every memory on every prompt
+ * build, which is exactly what the glossary block was supposed to
+ * avoid.
+ *
+ * Instead, we ask SAGE for only the `domain-term`-tagged subset using
+ * the typed `SageServiceLike.searchSage({ query: 'domain-term', limit })`
+ * op (which performs the tag/keyword filter at the SQL layer), then map
+ * the resulting `Sage[]` into the canonical `MemoryEntry` shape that
+ * `renderDomainGlossary` in `packages/core/src/core/system-prompt-glossary.ts`
+ * is typed against.
+ *
+ * Architectural rule
+ * ------------------
+ * This module imports from `@wrongstack/sage` directly — **never** from
+ * `@wrongstack/sage-mcp`. The CLI is an in-process consumer; the MCP
+ * surface is reserved for out-of-process clients (Claude Desktop, other
+ * agent runtimes).
+ */
+import type { MemoryEntry, MemoryPort } from '@wrongstack/core/types';
+/**
+ * Narrow `MemoryEntry`-shaped list provider for the `[Project Jargon Dictionary]`
+ * block. Returns only `domain-term`-tagged SAGE memories, mapped to the
+ * canonical `MemoryEntry` shape `renderDomainGlossary` is typed against.
+ *
+ * Robustness contract:
+ * - If the port is the legacy `LegacyMemoryPortAdapter` (no SAGE
+ *   capability), the helper returns an empty glossary rather than
+ *   throwing — the prompt must still assemble.
+ * - If `searchSage` rejects, the wrapper returns an empty glossary
+ *   for this prompt build; SAGE itself remains the source of truth and
+ *   the next prompt retry can succeed.
+ */
+export interface DomainGlossaryListProvider {
+    list(scope: 'project-memory', limit?: number): Promise<ReadonlyArray<MemoryEntry>>;
+}
+/**
+ * Build a `DomainGlossaryListProvider` over a SAGE-aware `MemoryPort`.
+ *
+ * The mapping is honest: every `MemoryEntry` field that core will read
+ * (`text`, `tags`, `confidence`, `ts`, `priority`) is populated from the
+ * corresponding `Sage` field. `text` is preserved verbatim because
+ * `SageDomainTermExtractor` writes the canonical `"Term — Definition"`
+ * format that `parseTermEntry` in core splits back apart.
+ */
+export declare function createDomainGlossaryAdapter(memoryStore: MemoryPort): DomainGlossaryListProvider;
+//# sourceMappingURL=domain-glossary.d.ts.map

package/dist/wiring/domain-terms-mirror.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Refresh the `.wrongstack/domain-terms.md` mirror file from the
+ * resolved SAGE `MemoryPort` at CLI boot.
+ *
+ * Background
+ * ----------
+ * The Project Jargon Dictionary feature splits ownership between two
+ * storage backends (per `packages/sage/docs/direct-icp-usage.md`):
+ *   - SAGE's SQLite store is the authoritative source of truth.
+ *   - `.wrongstack/domain-terms.md` is a *derived* view of the same
+ *     data, kept on disk so humans (and ProjectRoot sandboxes) can
+ *     read the glossary without going through the IPC client.
+ *
+ * `SageDomainTermExtractor.writeDomainTermsFile` already knows how to
+ * regenerate the file from the canonical SAGE state. What it lacks
+ * is a runtime host caller — the helper exists only in tests. This
+ * module closes that gap for the CLI host.
+ *
+ * Behaviour
+ * ---------
+ * - **Fire and forget at boot.** The mirror is a derived artefact;
+ *   a failure to refresh at startup must not abort the CLI. The
+ *   helper logs via `writeErr` and returns `null` on failure.
+ * - **Idempotent.** Calling this on every boot is safe: the file is
+ *   regenerated atomically by `writeDomainTermsFile`, and the content
+ *   is fully derived from SAGE state.
+ * - **Honest about scope.** Only the CLI host invokes this. TUI and
+ *   WebUI hosts share the same SAGE port and read the same file; the
+ *   CLI boot path is the canonical place to refresh the mirror.
+ */
+import type { MemoryPort } from '@wrongstack/core/types';
+export interface RefreshDomainTermsMirrorOptions {
+    /** Absolute project root whose `.wrongstack/domain-terms.md` should be refreshed. */
+    projectRoot: string;
+    /**
+     * Resolved SAGE `MemoryPort`. The extractor reads the `domain-term`
+     * tagged subset from this port.
+     */
+    memoryStore: MemoryPort;
+}
+/**
+ * Regenerate the mirror file from the current SAGE state.
+ *
+ * Returns the absolute path of the written file, or `null` when the
+ * refresh failed (the CLI logs the underlying reason to stderr and
+ * continues — the SAGE corpus remains authoritative).
+ *
+ * Never throws — callers are guaranteed to receive a `string | null`
+ * outcome.
+ */
+export declare function refreshDomainTermsMirror(options: RefreshDomainTermsMirrorOptions): Promise<string | null>;
+//# sourceMappingURL=domain-terms-mirror.d.ts.map

package/dist/wiring/pipeline.d.ts

@@ -79,6 +79,8 @@ export declare function createAgent(params: {
             maxToolTimeoutMs?: number | undefined;
             defaultExecutionStrategy: 'parallel' | 'sequential' | 'smart';
             perIterationOutputCapBytes: number;
+            /** Opt-in Kanban governance gate; see ToolsConfig.kanbanGovernance. */
+            kanbanGovernance?: boolean | undefined;
             loopDetection?: import('@wrongstack/core/types').LoopDetectionConfig | undefined;
         };
     };

package/dist/wiring/replay.d.ts

@@ -23,11 +23,21 @@ import type { WstackPaths } from '@wrongstack/core/utils';
  * The log lives next to the session JSONL via
  * `sessionScopedPath(projectSessions, sessionId, '.replay.jsonl')`,
  * colocated with annotations and audit sidecars.
+ *
+ * Call this AFTER the session exists. `TOKENS.ProviderRunner` is resolved per
+ * request inside the agent loop, not at agent construction, so the binding only
+ * has to be in place before the first `run()` — which is what lets `--record`
+ * name the real session instead of inventing one.
  */
 export interface BindReplayOptions {
     container: Container;
     wpaths: WstackPaths;
-    sessionId: string;
+    /**
+     * Explicit id for `--replay <id>`, or a resolver for `--record` so the log
+     * lands beside the live session's transcript instead of under a synthetic
+     * name. See {@link ReplayProviderRunnerOptions.sessionId}.
+     */
+    sessionId: string | (() => string);
     mode: ReplayMode;
     logger?: Logger | undefined;
 }

package/dist/wiring/sage.d.ts

@@ -1,19 +1,7 @@
-import type { AgentPipelines } from '@wrongstack/core/agent';
-import type { EventBus } from '@wrongstack/core/kernel';
-import type { Config, Logger, MemoryPort } from '@wrongstack/core/types';
-export interface SageWiringDeps {
-    config: Config;
-    pipelines: AgentPipelines;
-    memoryStore: MemoryPort | undefined;
-    logger: Logger;
-    events: EventBus;
-    getSessionId?: (() => string | undefined) | undefined;
-}
 /**
- * Test-only: reset the auto-hygiene throttle so the next teardown always
- * runs hygiene. Used by the regression test to verify the throttle skips
- * on the second call within the interval.
+ * CLI host adapter for shared SAGE wiring.
+ *
+ * Implementation lives in `@wrongstack/sage` so CLI and WebUI cannot drift.
  */
-export declare function _resetAutoHygieneThrottleForTesting(): void;
-export declare function setupSage(deps: SageWiringDeps): () => Promise<void>;
+export { AUTO_HYGIENE_INTERVAL_MS, _resetAutoHygieneThrottleForTesting, sageHygieneOptionsFromConfig, setupSage, type SageHostWiringDeps as SageWiringDeps, } from '@wrongstack/sage';
 //# sourceMappingURL=sage.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "0.302.2",
+  "version": "0.305.0",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -42,30 +42,30 @@
   ],
   "dependencies": {
     "ws": "^8.21.1",
-    "@wrongstack/core": "0.302.2",
-    "@wrongstack/kanban": "0.302.2",
-    "@wrongstack/mcp": "0.302.2",
-    "@wrongstack/acp": "0.302.2",
-    "@wrongstack/plug-lsp": "0.302.2",
-    "@wrongstack/runtime": "0.302.2",
-    "@wrongstack/requirement-intake": "0.302.2",
-    "@wrongstack/plugins": "0.302.2",
-    "@wrongstack/sdd": "0.302.2",
-    "@wrongstack/bench": "0.302.2",
-    "@wrongstack/security-scanner": "0.302.2",
-    "@wrongstack/providers": "0.302.2",
-    "@wrongstack/simpleui": "0.302.2",
-    "@wrongstack/sage": "0.302.2",
-    "@wrongstack/techstack": "0.302.2",
-    "@wrongstack/telegram": "0.302.2",
-    "@wrongstack/tui": "0.302.2",
-    "@wrongstack/tools": "0.302.2",
-    "@wrongstack/webui-server": "0.302.2",
-    "@wrongstack/webui": "0.302.2",
-    "@wrongstack/webui-hq": "0.302.2"
+    "@wrongstack/bench": "0.305.0",
+    "@wrongstack/core": "0.305.0",
+    "@wrongstack/acp": "0.305.0",
+    "@wrongstack/kanban": "0.305.0",
+    "@wrongstack/plug-lsp": "0.305.0",
+    "@wrongstack/mcp": "0.305.0",
+    "@wrongstack/requirement-intake": "0.305.0",
+    "@wrongstack/sdd": "0.305.0",
+    "@wrongstack/sage": "0.305.0",
+    "@wrongstack/providers": "0.305.0",
+    "@wrongstack/runtime": "0.305.0",
+    "@wrongstack/plugins": "0.305.0",
+    "@wrongstack/security-scanner": "0.305.0",
+    "@wrongstack/techstack": "0.305.0",
+    "@wrongstack/simpleui": "0.305.0",
+    "@wrongstack/tools": "0.305.0",
+    "@wrongstack/telegram": "0.305.0",
+    "@wrongstack/webui-hq": "0.305.0",
+    "@wrongstack/webui": "0.305.0",
+    "@wrongstack/tui": "0.305.0",
+    "@wrongstack/webui-server": "0.305.0"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "0.302.2"
+    "@wrongstack/desktop": "0.305.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",