@wrongstack/cli 0.309.0 → 0.310.0

package/dist/hq-server/login-attempt-store.d.ts

@@ -32,6 +32,11 @@ export declare class LoginAttemptStore {
     /**
      * Load persisted state from disk and prune stale entries.
      * Safe to call once at startup; subsequent calls reload from disk.
+     *
+     * SEC-001: legacy `cred:` entries (per-password hashes persisted by the
+     * pre-fix version) are skipped here, not just on write — re-seeding them
+     * would keep the hashes in memory and on disk. When any are found, a
+     * debounced rewrite scrubs them from the file.
      */
     load(): Promise<void>;
     get(key: string): LoginAttemptEntry | undefined;

package/dist/{hq-server-PBRU275L.js → hq-server-GZGM4BHA.js}

@@ -15,7 +15,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-CB35UVXO.js";
+} from "./chunk-KQNYSZG2.js";
 import "./chunk-KE7E7DPX.js";
 import "./chunk-Q5GTM25S.js";
 import "./chunk-7OCVIDC7.js";
@@ -37,4 +37,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-PBRU275L.js.map
+//# sourceMappingURL=hq-server-GZGM4BHA.js.map

package/dist/hq-server.d.ts

@@ -42,25 +42,7 @@ export interface HqServerOptions {
     tokenTtlMs?: number;
     trustedProxyHops?: number;
 }
-export interface HqStartupConnectionInfo {
-    dataDir: string;
-    browserUrl: string;
-    clientUrl: string;
-    clientEnv: {
-        WRONGSTACK_HQ_URL: string;
-        WRONGSTACK_HQ_TOKEN?: string;
-    };
-    createdAuth: boolean;
-    browserTokenMode: boolean;
-    passwordMode: boolean;
-}
-export type HqFirstRunSetup = HqStartupConnectionInfo;
-export interface HqServerHandle {
-    host: string;
-    port: number;
-    firstRunSetup?: HqFirstRunSetup;
-    trustPublicOrigin(origin: string): void;
-    close(): Promise<void>;
-}
+import type { HqServerHandle } from './hq-server/handle-types.js';
+export type { HqFirstRunSetup, HqServerHandle, HqStartupConnectionInfo, } from './hq-server/handle-types.js';
 export declare function startHqServer(options?: HqServerOptions): Promise<HqServerHandle>;
 //# sourceMappingURL=hq-server.d.ts.map

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   makePromptDelegate,
   renderAgentsTemplate,
   renderDiff
-} from "./chunk-DOJLAULS.js";
+} from "./chunk-WOTGMHAH.js";
 import {
   theme
 } from "./chunk-QD544J2B.js";
@@ -23,18 +23,18 @@ import {
 } from "./chunk-52C7PD2H.js";
 import {
   runUpdateCommand
-} from "./chunk-53STH6CX.js";
+} from "./chunk-63GFD62R.js";
 import "./chunk-U3SS4NRH.js";
 import "./chunk-NUIHRGPY.js";
 import {
   DEFAULT_PORT
-} from "./chunk-CB35UVXO.js";
+} from "./chunk-KQNYSZG2.js";
 import "./chunk-KE7E7DPX.js";
 import "./chunk-Q5GTM25S.js";
 import {
   helpCmd,
   versionCmd
-} from "./chunk-XSG33WHN.js";
+} from "./chunk-QAC263FZ.js";
 import {
   CLI_VERSION
 } from "./chunk-XJXDOF63.js";
@@ -59,7 +59,7 @@ import {
   normalizeKeys,
   resolveActiveApiKey,
   writeKeysBack
-} from "./chunk-SZ42FYPT.js";
+} from "./chunk-BXFYBQKR.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/cli-context.ts
@@ -386,7 +386,7 @@ async function promptModeArrow(deps) {
   const { renderer } = deps;
   const stdin = process.stdin;
   const out = (s) => renderer.write(s);
-  return await new Promise((resolve2) => {
+  return await new Promise((resolve3) => {
     let index = 0;
     let drawn = 0;
     let remaining = Math.round(MENU_TIMEOUT_MS / 1e3);
@@ -441,7 +441,7 @@ async function promptModeArrow(deps) {
       out("\x1B[0J");
       out(finalLine);
       out("\x1B[?25h");
-      resolve2(result);
+      resolve3(result);
     };
     const pick = () => {
       const opt = MODE_OPTIONS[index];
@@ -500,7 +500,7 @@ async function promptModeArrow(deps) {
       setRawMode(stdin, true);
       stdin.resume();
     } catch {
-      resolve2(null);
+      resolve3(null);
       return;
     }
     out("\x1B[?25l");
@@ -712,7 +712,7 @@ async function launchDesktop(args) {
     );
     return 1;
   }
-  return await new Promise((resolve2) => {
+  return await new Promise((resolve3) => {
     const child = spawn(process.execPath, [launcherPath, ...args], {
       stdio: "inherit",
       env: process.env,
@@ -723,11 +723,11 @@ async function launchDesktop(args) {
         `${color2.red("\u2717 Failed to start WrongStack Desktop:")} ${err.message}
 `
       );
-      resolve2(1);
+      resolve3(1);
     });
     child.once("exit", (code, signal) => {
-      if (typeof code === "number") resolve2(code);
-      else resolve2(signal ? 1 : 0);
+      if (typeof code === "number") resolve3(code);
+      else resolve3(signal ? 1 : 0);
     });
   });
 }
@@ -1660,7 +1660,10 @@ var helpTable = {
       { name: "list", description: "List available ACP agents from the cache." },
       { name: "sync", description: "Sync the official ACP agent registry into local cache." },
       { name: "spawn <id> <task>", description: "Spawn an ACP agent and wait for results." },
-      { name: "parallel <csv> <task>", description: "Fan a task out to multiple ACP agents in parallel." },
+      {
+        name: "parallel <csv> <task>",
+        description: "Fan a task out to multiple ACP agents in parallel."
+      },
       { name: "probe [csv]", description: "Handshake-test installed ACP agents." },
       { name: "bench [csv] [--fs]", description: "End-to-end benchmark and grade ACP agents." }
     ],
@@ -1732,7 +1735,10 @@ var helpTable = {
     usage: "wstack hq [serve] [--port <n>] [--password <secret>] [--tunnel] [--open] | wstack hq token [create|list|revoke]",
     subcommands: [
       { name: "serve", description: "Start the HQ dashboard server (default)." },
-      { name: "token create [label]", description: "Mint a browser or client authentication token." },
+      {
+        name: "token create [label]",
+        description: "Mint a browser or client authentication token."
+      },
       { name: "token list", description: "List active HQ authentication tokens." },
       { name: "token revoke <id>", description: "Revoke an issued HQ authentication token." }
     ],
@@ -1792,8 +1798,14 @@ var helpTable = {
       { name: "query [field=value ...]", description: "Query recorded provenance events." },
       { name: "status", description: "Check the Chronicle daemon and pipeline status." },
       { name: "facet <field>", description: "Group and count events across a facet." },
-      { name: "metrics [providers|tasks|files|summary]", description: "Query aggregated metrics from metrics.db." },
-      { name: "prune [--days N] [--dry-run]", description: "Purge journal entries older than N days." },
+      {
+        name: "metrics [providers|tasks|files|summary]",
+        description: "Query aggregated metrics from metrics.db."
+      },
+      {
+        name: "prune [--days N] [--dry-run]",
+        description: "Purge journal entries older than N days."
+      },
       { name: "compact", description: "Defragment and compact SQLite ledger." }
     ],
     seeAlso: "wstack audit (per-session audit log); wstack usage (cost summary)"
@@ -1849,44 +1861,46 @@ var subcommandsWithFocusedHelp = Object.keys(helpTable);
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-5ZLGFHWP.js")).acpCmd,
-  init: async () => (await import("./init-E2NDDOHI.js")).initCmd,
-  auth: async () => (await import("./auth-WOKC2RVG.js")).authCmd,
-  update: async () => (await import("./update-VZSOZGYC.js")).updateCmd,
-  sessions: async () => (await import("./sessions-config-YX2ZPAFM.js")).sessionsCmd,
-  config: async () => (await import("./sessions-config-YX2ZPAFM.js")).configCmd,
-  rewind: async () => (await import("./rewind-7RE6ONIC.js")).rewindCmd,
-  replay: async () => (await import("./replay-WBRMEWQ5.js")).replayCmd,
-  audit: async () => (await import("./audit-BBR22QH3.js")).auditCmd,
-  tools: async () => (await import("./tools-skills-UNKLOB7M.js")).toolsCmd,
-  skills: async () => (await import("./tools-skills-UNKLOB7M.js")).skillsCmd,
-  providers: async () => (await import("./providers-models-D23WUD74.js")).providersCmd,
-  models: async () => (await import("./providers-models-D23WUD74.js")).modelsCmd,
-  mcp: async () => (await import("./mcp-CMLFHRG2.js")).mcpCmd,
-  plugin: async () => (await import("./plugin-usage-26LIIW3P.js")).pluginCmd,
-  plugins: async () => (await import("./plugin-usage-26LIIW3P.js")).pluginCmd,
-  diag: async () => (await import("./diag-doctor-WTBHPOMB.js")).diagCmd,
-  doctor: async () => (await import("./diag-doctor-WTBHPOMB.js")).doctorCmd,
-  export: async () => (await import("./export-CCUXRJOU.js")).exportCmd,
-  usage: async () => (await import("./plugin-usage-26LIIW3P.js")).usageCmd,
-  version: async () => (await import("./version-help-TFD6VPF3.js")).versionCmd,
-  help: async () => (await import("./version-help-TFD6VPF3.js")).helpCmd,
-  projects: async () => (await import("./projects-XE76NFNZ.js")).projectsCmd,
-  modeldiag: async () => (await import("./modeldiag-ICMPHT5L.js")).modeldiagCmd,
-  quick: async () => (await import("./quick-VIO2BEHS.js")).quickCmd,
-  bench: async () => (await import("./bench-XNDUJOSZ.js")).benchCmd,
-  chronicle: async () => (await import("./chronicle-63MFCZN6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-PA6RH2UW.js")).hqCmd,
-  mailbox: async () => (await import("./mailbox-serve-V3QIJBDH.js")).mailboxServeCmd,
+  acp: async () => (await import("./acp-EA57GUFB.js")).acpCmd,
+  init: async () => (await import("./init-4JQSG66Q.js")).initCmd,
+  auth: async () => (await import("./auth-VQMSZGKE.js")).authCmd,
+  update: async () => (await import("./update-RATFF63M.js")).updateCmd,
+  sessions: async () => (await import("./sessions-config-7Q7QJBKJ.js")).sessionsCmd,
+  config: async () => (await import("./sessions-config-7Q7QJBKJ.js")).configCmd,
+  rewind: async () => (await import("./rewind-2FFNOOKS.js")).rewindCmd,
+  replay: async () => (await import("./replay-RZXZKP2U.js")).replayCmd,
+  audit: async () => (await import("./audit-ZPCLCC3C.js")).auditCmd,
+  tools: async () => (await import("./tools-skills-Q4P27URS.js")).toolsCmd,
+  skills: async () => (await import("./tools-skills-Q4P27URS.js")).skillsCmd,
+  providers: async () => (await import("./providers-models-663NDPRQ.js")).providersCmd,
+  models: async () => (await import("./providers-models-663NDPRQ.js")).modelsCmd,
+  mcp: async () => (await import("./mcp-RRPKNRSN.js")).mcpCmd,
+  plugin: async () => (await import("./plugin-usage-GCTYOZPH.js")).pluginCmd,
+  plugins: async () => (await import("./plugin-usage-GCTYOZPH.js")).pluginCmd,
+  diag: async () => (await import("./diag-doctor-HJKFUY6B.js")).diagCmd,
+  doctor: async () => (await import("./diag-doctor-HJKFUY6B.js")).doctorCmd,
+  export: async () => (await import("./export-ROG3DKTZ.js")).exportCmd,
+  usage: async () => (await import("./plugin-usage-GCTYOZPH.js")).usageCmd,
+  version: async () => (await import("./version-help-WMPSEL4U.js")).versionCmd,
+  help: async () => (await import("./version-help-WMPSEL4U.js")).helpCmd,
+  projects: async () => (await import("./projects-5J727S4L.js")).projectsCmd,
+  modeldiag: async () => (await import("./modeldiag-H6DKWJ2N.js")).modeldiagCmd,
+  quick: async () => (await import("./quick-XLYLZX4B.js")).quickCmd,
+  bench: async () => (await import("./bench-XYG56AMO.js")).benchCmd,
+  chronicle: async () => (await import("./chronicle-6EPPMUC5.js")).chronicleCmd,
+  hq: async () => (await import("./hq-AG4VW4XO.js")).hqCmd,
+  mailbox: async () => (await import("./mailbox-serve-5S3PHG5D.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-2PWBL4YU.js")).permissionsCmd,
   project: async () => (await import("./project-BLQ3ALVL.js")).projectCmd,
   governance: async () => (await import("./governance-V2Z42RBE.js")).governanceCmd
 };
 var subcommands = Object.fromEntries(
-  Object.entries(loaders).map(([name, load]) => [
-    name,
-    async (args, deps) => (await load())(args, deps)
-  ])
+  Object.entries(loaders).map(
+    ([name, load]) => [
+      name,
+      async (args, deps) => (await load())(args, deps)
+    ]
+  )
 );
 var subcommandNames = Object.keys(loaders);
 
@@ -1936,24 +1950,24 @@ async function isHqAlreadyRunning(dataDir) {
   return null;
 }
 async function isPortInUse(host, port) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const server = net.createServer();
     server.once("error", (err) => {
       if (err.code === "EADDRINUSE") {
-        resolve2(true);
+        resolve3(true);
       } else {
-        resolve2(false);
+        resolve3(false);
       }
     });
     server.once("listening", () => {
-      server.close(() => resolve2(false));
+      server.close(() => resolve3(false));
     });
     server.listen(port, host);
   });
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-PBRU275L.js");
+  const { startHqServer } = await import("./hq-server-GZGM4BHA.js");
   const tunnelRequested = flags["tunnel"] === true;
   const host = typeof flags["host"] === "string" ? flags["host"] : tunnelRequested ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST2;
   if (tunnelRequested && !isLoopbackHost(host)) {
@@ -2084,7 +2098,7 @@ ${color6.green("Cloudflare Quick Tunnel ready:")} ${browserUrl}
     } catch {
     }
   }
-  await new Promise((resolve2) => {
+  await new Promise((resolve3) => {
     const shutdown = async () => {
       const results = await Promise.allSettled([
         ...tunnel ? [tunnel.close()] : [],
@@ -2103,7 +2117,7 @@ ${color6.green("Cloudflare Quick Tunnel ready:")} ${browserUrl}
           })
         );
       }
-      resolve2();
+      resolve3();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -2491,7 +2505,7 @@ async function runProjectCheck(opts) {
     if (answer2 === "y" || answer2 === "yes") {
       try {
         const { spawn: spawn2 } = await import("node:child_process");
-        await new Promise((resolve2, reject) => {
+        await new Promise((resolve3, reject) => {
           const child = spawn2("git", ["init"], {
             cwd,
             signal: AbortSignal.timeout(1e4),
@@ -2500,7 +2514,7 @@ async function runProjectCheck(opts) {
           child.on("error", reject);
           child.on(
             "close",
-            (code) => code === 0 ? resolve2() : reject(new Error(`git init failed with ${code}`))
+            (code) => code === 0 ? resolve3() : reject(new Error(`git init failed with ${code}`))
           );
         });
         renderer.write(`  ${color9.green("\u2713")} Git repository initialized
@@ -2744,25 +2758,25 @@ var ReadlineInputReader = class {
   async readLine(prompt, timeoutOpts) {
     if (this.history.length === 0) await this.loadHistory();
     while (this.pending) {
-      await new Promise((resolve2) => setTimeout(resolve2, 50));
+      await new Promise((resolve3) => setTimeout(resolve3, 50));
     }
     this.pending = true;
     try {
       if (this.rl) {
         const old = this.rl;
         this.rl = void 0;
-        await new Promise((resolve2) => {
+        await new Promise((resolve3) => {
           if (old.closed) {
-            resolve2();
+            resolve3();
           } else {
-            old.once("close", resolve2);
+            old.once("close", resolve3);
             old.close();
           }
         });
       }
       const fresh = this.ensure();
       this.installPromptGuard(fresh);
-      const line = await new Promise((resolve2) => {
+      const line = await new Promise((resolve3) => {
         let settled = false;
         let timeoutHandle;
         const settle = (line2) => {
@@ -2770,7 +2784,7 @@ var ReadlineInputReader = class {
           settled = true;
           if (timeoutHandle) clearTimeout(timeoutHandle);
           setOutputLineGuard(null);
-          resolve2(line2);
+          resolve3(line2);
         };
         if (timeoutOpts) {
           timeoutHandle = setTimeout(() => {
@@ -2835,7 +2849,7 @@ var ReadlineInputReader = class {
   async readKey(prompt, options) {
     setOutputLineGuard(null);
     writeOut(prompt);
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const stdin = process.stdin;
       const wasRaw = stdin.isRaw;
       const wasPaused = stdin.isPaused();
@@ -2846,7 +2860,7 @@ var ReadlineInputReader = class {
         if (key === "") {
           cleanup();
           writeOut("\n");
-          resolve2("");
+          resolve3("");
           return;
         }
         const opt = options.find(
@@ -2856,12 +2870,12 @@ var ReadlineInputReader = class {
           cleanup();
           writeOut(`${opt.key}
 `);
-          resolve2(opt.value);
+          resolve3(opt.value);
         }
       };
       const onClose = () => {
         cleanup();
-        resolve2("");
+        resolve3("");
       };
       const cleanup = () => {
         stdin.off("data", onData);
@@ -2893,7 +2907,7 @@ var ReadlineInputReader = class {
     this.rl?.close();
     this.rl = void 0;
     writeOut(prompt);
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       let buf = "";
       const wasRaw = stdin.isRaw;
       const cleanup = () => {
@@ -2922,13 +2936,13 @@ var ReadlineInputReader = class {
             cleanup();
             writeOut(`  ${dim(`[${buf.length} chars]`)}
 `);
-            resolve2(buf);
+            resolve3(buf);
             return;
           }
           if (ch === "") {
             cleanup();
             writeOut("\n");
-            resolve2("");
+            resolve3("");
             return;
           }
           if (ch === "") {
@@ -4197,7 +4211,7 @@ async function checkGitInCwd(opts) {
     if (answer === "y" || answer === "yes") {
       try {
         const { spawn: spawn2 } = await import("node:child_process");
-        await new Promise((resolve2, reject) => {
+        await new Promise((resolve3, reject) => {
           const child = spawn2("git", ["init"], {
             cwd,
             signal: AbortSignal.timeout(1e4),
@@ -4206,7 +4220,7 @@ async function checkGitInCwd(opts) {
           child.on("error", reject);
           child.on(
             "close",
-            (code) => code === 0 ? resolve2() : reject(new Error(`git init failed with ${code}`))
+            (code) => code === 0 ? resolve3() : reject(new Error(`git init failed with ${code}`))
           );
         });
         renderer.write(`  ${color13.green("\u2713")} Git repository initialized
@@ -4466,12 +4480,14 @@ async function initializeCli(argv) {
 async function main(argv) {
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-RG2PTQ6S.js");
+  const { runInteractive } = await import("./cli-main-RFEZAJ4U.js");
   return runInteractive(cliCtx);
 }
 
 // src/cli-entry-point.ts
-import { installCrashShield, writeErr as writeErr4 } from "@wrongstack/core/utils";
+import { resolve as resolve2 } from "node:path";
+import { pathToFileURL } from "node:url";
+import { installCrashShield, runFatalSalvageSync, writeErr as writeErr4 } from "@wrongstack/core/utils";
 var SQLITE_WARNING_RE = /sqlite is an experimental feature/i;
 function installSqliteWarningFilter() {
   const originalEmit = process.emitWarning.bind(process);
@@ -4485,7 +4501,15 @@ function installSqliteWarningFilter() {
   });
 }
 installSqliteWarningFilter();
-var isMain = import.meta.url === `file://${process.argv[1]?.replace(/\\/g, "/")}` || process.argv[1]?.endsWith("/cli/dist/index.js") || process.argv[1]?.endsWith("\\cli\\dist\\index.js");
+function isCliMain(moduleUrl, argvEntry = process.argv[1]) {
+  if (!argvEntry) return false;
+  try {
+    if (moduleUrl === pathToFileURL(resolve2(argvEntry)).href) return true;
+  } catch {
+  }
+  return argvEntry.endsWith("/cli/dist/index.js") || argvEntry.endsWith("\\cli\\dist\\index.js");
+}
+var isMain = isCliMain(import.meta.url);
 function isBrokenOutputConsumer(error) {
   if (typeof error !== "object" || error === null || !("code" in error)) return false;
   return error.code === "EPIPE" || error.code === "ECONNRESET" || error.code === "ECONNABORTED";
@@ -4498,6 +4522,7 @@ function installBrokenPipeHandlers(options = {}) {
     if (!isBrokenOutputConsumer(error)) throw error;
     if (handled) return;
     handled = true;
+    runFatalSalvageSync();
     exit(0);
   };
   for (const stream of streams) stream.on("error", onError);
@@ -4509,12 +4534,16 @@ function runAsMain(mainFn) {
   if (!isMain) return;
   installBrokenPipeHandlers();
   installCrashShield();
+  process.on("exit", () => {
+    runFatalSalvageSync();
+  });
   mainFn(process.argv.slice(2)).then(
     (c) => {
       process.exitCode = c;
       setTimeout(() => process.exit(c), 500).unref();
     },
     (err) => {
+      runFatalSalvageSync();
       writeErr4((err instanceof Error ? err.stack : String(err)) + "\n");
       process.exitCode = 1;
       setTimeout(() => process.exit(1), 500).unref();

package/dist/{init-E2NDDOHI.js → init-4JQSG66Q.js}

@@ -24,4 +24,4 @@ var initCmd = async (_args, deps) => {
 export {
   initCmd
 };
-//# sourceMappingURL=init-E2NDDOHI.js.map
+//# sourceMappingURL=init-4JQSG66Q.js.map

package/dist/{mailbox-serve-V3QIJBDH.js → mailbox-serve-5S3PHG5D.js}

@@ -341,4 +341,4 @@ function printHelp(deps) {
 export {
   mailboxServeCmd
 };
-//# sourceMappingURL=mailbox-serve-V3QIJBDH.js.map
+//# sourceMappingURL=mailbox-serve-5S3PHG5D.js.map

package/dist/{mcp-CMLFHRG2.js → mcp-RRPKNRSN.js}

@@ -33,6 +33,7 @@ import {
   serveStdio
 } from "@wrongstack/mcp";
 import { registerBuiltinToolTier } from "@wrongstack/tools/tool-tier";
+import { wireKanbanPorts } from "@wrongstack/runtime";
 var AllowAllPermissionPolicy = class extends AutoApprovePermissionPolicy {
   async evaluate() {
     return { permission: "auto", source: "default" };
@@ -210,6 +211,7 @@ async function serveMcpStdio(deps, positional) {
     log(`wrongstack MCP server: ${err instanceof Error ? err.message : String(err)}`);
     return 1;
   }
+  wireKanbanPorts();
   let registry = deps.toolRegistry;
   if (!registry) {
     registry = new ToolRegistry();
@@ -439,4 +441,4 @@ function isRecord(value) {
 export {
   mcpCmd
 };
-//# sourceMappingURL=mcp-CMLFHRG2.js.map
+//# sourceMappingURL=mcp-RRPKNRSN.js.map

package/dist/mcp-serve.d.ts

@@ -2,7 +2,7 @@ import { Context } from '@wrongstack/core/agent';
 import { ToolRegistry } from '@wrongstack/core/registry';
 import type { PermissionPolicy, Tool } from '@wrongstack/core/types';
 import { type MCPServerPrompt, type MCPServerResource } from '@wrongstack/mcp';
-import type { SubcommandDeps } from './subcommands/index.js';
+import type { SubcommandDeps } from './subcommands/contracts.js';
 /**
  * Resolve the `--tools` whitelist for `mcp serve`.
  *

package/dist/{modeldiag-ICMPHT5L.js → modeldiag-H6DKWJ2N.js}

@@ -8,7 +8,7 @@ import {
   mutateConfigProviders,
   normalizeKeys,
   writeKeysBack
-} from "./chunk-SZ42FYPT.js";
+} from "./chunk-BXFYBQKR.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/modeldiag.ts
@@ -19,8 +19,8 @@ import { color as color5 } from "@wrongstack/core/utils";
 import { color as color3, toErrorMessage } from "@wrongstack/core/utils";
 
 // src/subcommands/handlers/modeldiag-eval.ts
-import { makeProviderFromConfig } from "@wrongstack/providers";
 import { color as color2 } from "@wrongstack/core/utils";
+import { makeProviderFromConfig } from "@wrongstack/providers";
 
 // src/subcommands/handlers/modeldiag-profiles.ts
 import { color } from "@wrongstack/core/utils";
@@ -443,9 +443,7 @@ ${color2.dim('Enter numbers or provider IDs (comma-separated, or "all"):')}
             {
               model: c.model,
               system: [{ type: "text", text: "Be thorough and correct." }],
-              messages: [
-                { role: "user", content: [{ type: "text", text: task.prompt }] }
-              ],
+              messages: [{ role: "user", content: [{ type: "text", text: task.prompt }] }],
               maxTokens: 1024
             },
             { signal: AbortSignal.timeout(45e3) }
@@ -938,9 +936,7 @@ async function runModeldiagTest(args, deps, config) {
       }
       writeLine();
       writeLine(
-        color4.dim(
-          `${targets.length} request(s) would run sequentially. Remove --plan to execute.`
-        )
+        color4.dim(`${targets.length} request(s) would run sequentially. Remove --plan to execute.`)
       );
     }
     return targets.length > 0 ? 0 : 2;
@@ -948,9 +944,7 @@ async function runModeldiagTest(args, deps, config) {
   if (targets.length === 0) {
     const message = "No provider/model targets matched. Check the active profile or remove filters.";
     if (smokeOptions.json) {
-      writeLine(
-        JSON.stringify({ results: [], summary: { passed: 0, failed: 0 }, error: message })
-      );
+      writeLine(JSON.stringify({ results: [], summary: { passed: 0, failed: 0 }, error: message }));
     } else {
       writeLine(color4.amber(message));
     }
@@ -1329,4 +1323,4 @@ var modeldiagCmd = async (args, deps) => {
 export {
   modeldiagCmd
 };
-//# sourceMappingURL=modeldiag-ICMPHT5L.js.map
+//# sourceMappingURL=modeldiag-H6DKWJ2N.js.map

package/dist/{plugin-usage-26LIIW3P.js → plugin-usage-GCTYOZPH.js}

@@ -41,4 +41,4 @@ export {
   pluginCmd,
   usageCmd
 };
-//# sourceMappingURL=plugin-usage-26LIIW3P.js.map
+//# sourceMappingURL=plugin-usage-GCTYOZPH.js.map

package/dist/{projects-XE76NFNZ.js → projects-5J727S4L.js}

@@ -35,4 +35,4 @@ var projectsCmd = async (_args, deps) => {
 export {
   projectsCmd
 };
-//# sourceMappingURL=projects-XE76NFNZ.js.map
+//# sourceMappingURL=projects-5J727S4L.js.map

package/dist/provider-config-utils.d.ts

@@ -39,8 +39,7 @@ export declare function clearStaleProviderDefaults(config: Record<string, unknow
 export declare function activeLabel(cfg: ProviderConfig, keys: ProviderApiKey[]): string | undefined;
 /** Mask an API key for display: show first 4 + last 4 chars. */
 export declare function maskedKey(key: string): string;
-/** ISO-8601 timestamp for key `createdAt` fields. */
-export declare function nowIso(): string;
+export { nowIso } from '@wrongstack/primitives';
 /**
  * Read the on-disk config file and return its `providers` map, fully
  * decrypted. Returns `{}` on ENOENT or corrupt JSON (surfacing the error

package/dist/{providers-models-D23WUD74.js → providers-models-663NDPRQ.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-YMXXOOFN.js";
 import {
   mutateConfigProviders
-} from "./chunk-SZ42FYPT.js";
+} from "./chunk-BXFYBQKR.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/providers-models.ts
@@ -661,4 +661,4 @@ export {
   modelsCmd,
   providersCmd
 };
-//# sourceMappingURL=providers-models-D23WUD74.js.map
+//# sourceMappingURL=providers-models-663NDPRQ.js.map

package/dist/{quick-VIO2BEHS.js → quick-XLYLZX4B.js}

@@ -7,4 +7,4 @@ var quickCmd = (_args, _deps) => {
 export {
   quickCmd
 };
-//# sourceMappingURL=quick-VIO2BEHS.js.map
+//# sourceMappingURL=quick-XLYLZX4B.js.map

package/dist/{replay-WBRMEWQ5.js → replay-RZXZKP2U.js}

@@ -76,4 +76,4 @@ Run a session with --record first, then --replay to re-execute it.`
 export {
   replayCmd
 };
-//# sourceMappingURL=replay-WBRMEWQ5.js.map
+//# sourceMappingURL=replay-RZXZKP2U.js.map