@wrongstack/cli 0.310.0 → 0.310.1

package/dist/{acp-EA57GUFB.js → acp-GZIASCLH.js}

@@ -3,7 +3,7 @@ import {
   loadCachedAcpRegistry,
   refreshAcpRegistry,
   setupProvider
-} from "./chunk-CHZZEEIP.js";
+} from "./chunk-J4QSP6T2.js";
 import "./chunk-QYIIOMLE.js";
 import "./chunk-BXFYBQKR.js";
 import "./chunk-7OCVIDC7.js";
@@ -913,4 +913,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-EA57GUFB.js.map
+//# sourceMappingURL=acp-GZIASCLH.js.map

package/dist/chunk-3FHFGIIN.js

@@ -0,0 +1,58 @@
+import {
+  startProxyProbe
+} from "./chunk-3MAUU765.js";
+
+// src/wiring/proxy-wiring.ts
+import {
+  applyProxyConfig
+} from "@wrongstack/core/wiring/proxy-rewrite";
+var probeRunner;
+function applyWrongProxyPrefs(payload) {
+  const patch = {};
+  if (typeof payload["wrongProxyEnabled"] === "boolean") {
+    patch.enabled = payload["wrongProxyEnabled"];
+  }
+  if (typeof payload["wrongProxyUrl"] === "string") {
+    patch.url = payload["wrongProxyUrl"];
+  }
+  if (Object.keys(patch).length === 0) return;
+  applyProxyConfig(patch);
+  if (!probeRunner) {
+    probeRunner = startProxyProbe();
+  } else {
+    void probeRunner.poke();
+  }
+}
+async function awaitFirstWrongProxyProbe() {
+  if (!probeRunner) return;
+  await probeRunner.poke();
+}
+function bootstrapWrongProxy(snapshot) {
+  if (!snapshot) {
+    applyWrongProxyPrefs({});
+    return;
+  }
+  const enabled = snapshot.enabled;
+  const url = snapshot.url;
+  if (typeof enabled === "boolean" || typeof url === "string") {
+    const payload = {};
+    if (typeof enabled === "boolean") payload["wrongProxyEnabled"] = enabled;
+    if (typeof url === "string") payload["wrongProxyUrl"] = url;
+    applyWrongProxyPrefs(payload);
+    return;
+  }
+  applyWrongProxyPrefs(snapshot);
+}
+function shutdownWrongProxy() {
+  if (probeRunner) probeRunner.stop();
+  probeRunner = void 0;
+  applyProxyConfig({ enabled: false, url: "", active: false });
+}
+
+export {
+  applyWrongProxyPrefs,
+  awaitFirstWrongProxyProbe,
+  bootstrapWrongProxy,
+  shutdownWrongProxy
+};
+//# sourceMappingURL=chunk-3FHFGIIN.js.map

package/dist/chunk-3MAUU765.js

@@ -0,0 +1,120 @@
+
+// src/wiring/proxy-probe.ts
+import { applyProxyConfig, getProxyConfig } from "@wrongstack/core/wiring/proxy-rewrite";
+var DEFAULT_INTERVAL_MS = 3e4;
+var DEFAULT_TIMEOUT_MS = 2e3;
+var HEALTH_PATH = "/api/health";
+var DEFAULT_DEACTIVATE_AFTER_FAILURES = 2;
+var activeRunner;
+function startProxyProbe(opts = {}) {
+  if (activeRunner) {
+    scheduleImmediateProbe(activeRunner);
+    return activeRunner;
+  }
+  const intervalMs = opts.intervalMs ?? DEFAULT_INTERVAL_MS;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  const setIntervalImpl = opts.setIntervalImpl ?? setInterval;
+  const clearIntervalImpl = opts.clearIntervalImpl ?? clearInterval;
+  const deactivateAfterFailures = typeof opts.deactivateAfterFailures === "number" && Number.isFinite(opts.deactivateAfterFailures) ? Math.max(1, Math.trunc(opts.deactivateAfterFailures)) : DEFAULT_DEACTIVATE_AFTER_FAILURES;
+  const state = {
+    currentAbort: void 0,
+    timer: void 0,
+    // Consecutive failed probes. Reset on every success; `active` flips to
+    // false only once this reaches `deactivateAfterFailures`. A single
+    // transient failure is a soft signal and must not disable rewrites.
+    consecutiveFailures: 0
+  };
+  const runOnce = async () => {
+    const cfg = getProxyConfig();
+    if (!cfg.enabled || !cfg.url) {
+      state.consecutiveFailures = 0;
+      if (state.currentAbort) state.currentAbort.abort();
+      state.currentAbort = void 0;
+      applyProxyConfig({ active: false });
+      return false;
+    }
+    if (state.currentAbort) state.currentAbort.abort();
+    const abort = new AbortController();
+    state.currentAbort = abort;
+    let timedOut = false;
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      abort.abort();
+    }, timeoutMs);
+    if (typeof timeout.unref === "function") {
+      timeout.unref();
+    }
+    try {
+      const healthUrl = buildHealthUrl(cfg.url);
+      const res = await fetchImpl(healthUrl, {
+        method: "GET",
+        signal: abort.signal,
+        headers: { accept: "application/json" }
+      });
+      const ok = res.ok && res.status >= 200 && res.status < 300;
+      const live = getProxyConfig();
+      const stillRelevant = live.enabled && live.url === cfg.url;
+      if (stillRelevant) {
+        if (ok) {
+          state.consecutiveFailures = 0;
+          applyProxyConfig({ active: true });
+        } else {
+          state.consecutiveFailures += 1;
+          if (state.consecutiveFailures >= deactivateAfterFailures) {
+            applyProxyConfig({ active: false });
+          }
+        }
+      }
+      return ok;
+    } catch {
+      const live = getProxyConfig();
+      const stillRelevant = live.enabled && live.url === cfg.url;
+      if (stillRelevant && (timedOut || !abort.signal.aborted)) {
+        state.consecutiveFailures += 1;
+        if (state.consecutiveFailures >= deactivateAfterFailures) {
+          applyProxyConfig({ active: false });
+        }
+      }
+      return false;
+    } finally {
+      clearTimeout(timeout);
+      if (state.currentAbort === abort) state.currentAbort = void 0;
+    }
+  };
+  const runner = {
+    stop() {
+      if (state.timer !== void 0) {
+        clearIntervalImpl(state.timer);
+        state.timer = void 0;
+      }
+      if (state.currentAbort) {
+        state.currentAbort.abort();
+        state.currentAbort = void 0;
+      }
+      activeRunner = void 0;
+    },
+    poke: runOnce
+  };
+  scheduleImmediateProbe(runner);
+  state.timer = setIntervalImpl(() => {
+    void runOnce();
+  }, intervalMs);
+  if (state.timer && typeof state.timer.unref === "function") {
+    state.timer.unref();
+  }
+  activeRunner = runner;
+  return runner;
+}
+function scheduleImmediateProbe(runner) {
+  void runner.poke();
+}
+function buildHealthUrl(rawBase) {
+  const trimmed = rawBase.trim().replace(/\/+$/, "");
+  return `${trimmed}${HEALTH_PATH}`;
+}
+
+export {
+  startProxyProbe
+};
+//# sourceMappingURL=chunk-3MAUU765.js.map

package/dist/{chunk-63GFD62R.js → chunk-4S52MIIM.js}

@@ -166,7 +166,7 @@ Update failed: ${msg}
 var updateCmd = async (args, deps) => runUpdateCommand(args, deps);
 function writeUpdateUsage(renderer) {
   renderer.write(
-    "Usage: wrongstack update [--check-only] [--pm npm|pnpm|yarn|bun] [--allow-scripts]\n"
+    "Usage: wstack update [--check-only] [--pm <manager>] [--allow-scripts (alias: --lifecycle-scripts)]\n"
   );
 }
 function mergeUpdateArgs(args, flags) {
@@ -383,4 +383,4 @@ export {
   detectUpdatePackageManager,
   detectUpdatePackageName
 };
-//# sourceMappingURL=chunk-63GFD62R.js.map
+//# sourceMappingURL=chunk-4S52MIIM.js.map

package/dist/{chunk-KQNYSZG2.js → chunk-J3XBHGEO.js}

@@ -2841,7 +2841,7 @@ async function handleApiAgentMessages(req, res, match, agentMessages) {
 async function handleApiSystemUpdate(res) {
   const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
     import("./update-check-WARHSVZA.js"),
-    import("./update-RATFF63M.js")
+    import("./update-ZXNC6I6G.js")
   ]);
   const packageName = detectUpdatePackageName();
   const info = await checkForUpdate({ packageName });
@@ -4916,4 +4916,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-KQNYSZG2.js.map
+//# sourceMappingURL=chunk-J3XBHGEO.js.map

package/dist/{chunk-CHZZEEIP.js → chunk-J4QSP6T2.js}

@@ -42,6 +42,37 @@ async function refreshAcpRegistry(paths, opts) {
   return { count: result.agents.length, location, fetchedAt: result.fetchedAt };
 }
 
+// src/wiring/provider-runtime.ts
+import { makeProviderFromConfig } from "@wrongstack/providers";
+import { getProxyConfig, rewriteBaseUrl, shouldRewriteFor } from "@wrongstack/core/wiring/proxy-rewrite";
+function resolveProviderCfg(config, providerId) {
+  const savedCfg = config.providers?.[providerId];
+  const rawBaseUrl = savedCfg?.baseUrl ?? config.baseUrl;
+  const baseUrl = rawBaseUrl && shouldRewriteFor(providerId) ? rewriteBaseUrl(rawBaseUrl, currentProxyBaseUrl()) : rawBaseUrl;
+  const cfg = {
+    ...savedCfg,
+    apiKey: savedCfg?.apiKey ?? config.apiKey,
+    baseUrl,
+    type: providerId
+  };
+  const factoryType = savedCfg?.type ?? providerId;
+  return { cfg, factoryType };
+}
+function currentProxyBaseUrl() {
+  return getProxyConfig().url;
+}
+function resolveProviderCfgWithProxy(config, providerId) {
+  return resolveProviderCfg(config, providerId);
+}
+function buildProviderForId(args, providerId) {
+  const { cfg, factoryType } = resolveProviderCfg(args.config, providerId);
+  const useRegistry = !!args.config.features.modelsRegistry && args.providerRegistry.has(factoryType);
+  return useRegistry ? args.providerRegistry.create(cfg, factoryType) : makeProviderFromConfig(
+    providerId,
+    factoryType === "ai-gateway" ? { ...cfg, type: factoryType } : cfg
+  );
+}
+
 // src/shutdown-cleanup.ts
 function createGracefulShutdown(cleanup) {
   const exitCode = cleanup.exitCode ?? 0;
@@ -92,7 +123,7 @@ import {
   buildProviderFactoriesFromRegistry,
   createAiGatewayProviderFactory,
   installCatalogModelOutputLimits,
-  makeProviderFromConfig,
+  makeProviderFromConfig as makeProviderFromConfig2,
   withCatalogCapabilities
 } from "@wrongstack/providers";
 async function setupProvider(params) {
@@ -174,19 +205,17 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
       });
     }
   }
-  const providerConfig = config.providers?.[config.provider] ?? {
-    type: config.provider,
-    apiKey: config.apiKey,
-    baseUrl: config.baseUrl
-  };
+  const { cfg: providerConfig, factoryType } = resolveProviderCfgWithProxy(
+    config,
+    config.provider
+  );
   let provider;
   try {
-    const factoryType = providerConfig.type ?? config.provider;
     const cfgWithType = { ...providerConfig, type: config.provider };
     if (providerRegistry.has(factoryType)) {
       provider = providerRegistry.create(cfgWithType, factoryType);
     } else {
-      provider = makeProviderFromConfig(config.provider, { ...cfgWithType, type: factoryType });
+      provider = makeProviderFromConfig2(config.provider, { ...cfgWithType, type: factoryType });
     }
   } catch (err) {
     throw new ConfigError({
@@ -211,7 +240,9 @@ Try \`wstack models refresh\` once you have network access, or run with --no-fea
 export {
   loadCachedAcpRegistry,
   refreshAcpRegistry,
+  resolveProviderCfg,
+  buildProviderForId,
   setupProvider,
   createGracefulShutdown
 };
-//# sourceMappingURL=chunk-CHZZEEIP.js.map
+//# sourceMappingURL=chunk-J4QSP6T2.js.map

package/dist/{cli-main-RFEZAJ4U.js → cli-main-UDWMWX55.js}

@@ -25,12 +25,6 @@ import {
   runGit,
   setSuggestions
 } from "./chunk-X3N5TS2S.js";
-import {
-  setupPlugins
-} from "./chunk-BZJ4MP32.js";
-import {
-  startCliHqConnection
-} from "./chunk-FKWHSFX4.js";
 import {
   advanceToNextTask,
   findSpec,
@@ -41,10 +35,21 @@ import {
   matchTaskNode,
   sddState
 } from "./chunk-DGXNL7OT.js";
+import {
+  setupPlugins
+} from "./chunk-BZJ4MP32.js";
+import {
+  startCliHqConnection
+} from "./chunk-FKWHSFX4.js";
+import {
+  awaitFirstWrongProxyProbe,
+  bootstrapWrongProxy
+} from "./chunk-3FHFGIIN.js";
 import {
   PLUGIN_AUDIT_ENTRIES,
   runPluginManagementCommand
 } from "./chunk-H6C7SO5H.js";
+import "./chunk-3MAUU765.js";
 import {
   configureSimpleUiRuntimeContext,
   detectProjectFacts,
@@ -67,11 +72,13 @@ import {
   CLI_VERSION
 } from "./chunk-XJXDOF63.js";
 import {
+  buildProviderForId,
   createGracefulShutdown,
   loadCachedAcpRegistry,
   refreshAcpRegistry,
+  resolveProviderCfg,
   setupProvider
-} from "./chunk-CHZZEEIP.js";
+} from "./chunk-J4QSP6T2.js";
 import {
   addCustomProvider,
   addKeyForCatalogProvider,
@@ -354,6 +361,8 @@ async function resolveModeAndCapabilities(deps) {
   let providerRegistry;
   let provider;
   try {
+    bootstrapWrongProxy(deps.config.tools?.wrongProxy);
+    await awaitFirstWrongProxyProbe();
     const result = await setupProvider({
       config: deps.config,
       modelsRegistry: deps.modelsRegistry,
@@ -1944,6 +1953,11 @@ function makeProviderClassifier(provider, model) {
 
 // src/fleet/host-provider.ts
 import { makeProviderFromConfig, withCatalogCapabilities } from "@wrongstack/providers";
+import {
+  getProxyConfig,
+  rewriteBaseUrl,
+  shouldRewriteFor
+} from "@wrongstack/core/wiring/proxy-rewrite";
 async function buildHostSubagentProvider(deps, config, overrideId, model) {
   const requestedProviderId = overrideId ?? config.provider;
   const providerId = requestedProviderId === config.provider || config.providers?.[requestedProviderId] !== void 0 || deps.providerRegistry.has(requestedProviderId) ? requestedProviderId : config.provider;
@@ -1952,9 +1966,13 @@ async function buildHostSubagentProvider(deps, config, overrideId, model) {
     apiKey: config.apiKey,
     baseUrl: config.baseUrl
   };
+  const factoryType = newCfg.type ?? providerId;
+  const rawBaseUrl = newCfg.baseUrl ?? config.baseUrl;
+  const baseUrl = rawBaseUrl && shouldRewriteFor(factoryType) ? rewriteBaseUrl(rawBaseUrl, getProxyConfig().url) : rawBaseUrl;
   const cfgWithType = {
     ...newCfg,
     type: providerId,
+    ...baseUrl !== newCfg.baseUrl ? { baseUrl } : {},
     ...model ? { model } : {}
   };
   let provider = deps.providerRegistry.has(providerId) ? deps.providerRegistry.create(cfgWithType) : makeProviderFromConfig(providerId, cfgWithType);
@@ -3927,28 +3945,6 @@ var MultiAgentHost = class {
   }
 };
 
-// src/wiring/provider-runtime.ts
-import { makeProviderFromConfig as makeProviderFromConfig2 } from "@wrongstack/providers";
-function resolveProviderCfg(config, providerId) {
-  const savedCfg = config.providers?.[providerId];
-  const cfg = {
-    ...savedCfg,
-    apiKey: savedCfg?.apiKey ?? config.apiKey,
-    baseUrl: savedCfg?.baseUrl ?? config.baseUrl,
-    type: providerId
-  };
-  const factoryType = savedCfg?.type ?? providerId;
-  return { cfg, factoryType };
-}
-function buildProviderForId(args, providerId) {
-  const { cfg, factoryType } = resolveProviderCfg(args.config, providerId);
-  const useRegistry = !!args.config.features.modelsRegistry && args.providerRegistry.has(factoryType);
-  return useRegistry ? args.providerRegistry.create(cfg, factoryType) : makeProviderFromConfig2(
-    providerId,
-    factoryType === "ai-gateway" ? { ...cfg, type: factoryType } : cfg
-  );
-}
-
 // src/wiring/brain-and-orchestration.ts
 function setupBrainAndOrchestration(deps) {
   const {
@@ -4812,6 +4808,26 @@ function applyLiveSettings(input, settings) {
         });
       }
     }
+    if (settings.wrongProxyEnabled !== void 0 || settings.wrongProxyUrl !== void 0) {
+      const prev = config.tools?.wrongProxy;
+      const next = {
+        ...prev ?? {},
+        ...settings.wrongProxyEnabled !== void 0 ? { enabled: settings.wrongProxyEnabled } : {},
+        ...settings.wrongProxyUrl !== void 0 ? { url: settings.wrongProxyUrl } : {}
+      };
+      config = patchConfig(config, {
+        tools: {
+          ...config.tools,
+          wrongProxy: next
+        }
+      });
+      if (settings.wrongProxyEnabled !== void 0) {
+        input.context.meta["wrongProxyEnabled"] = settings.wrongProxyEnabled;
+      }
+      if (settings.wrongProxyUrl !== void 0) {
+        input.context.meta["wrongProxyUrl"] = settings.wrongProxyUrl;
+      }
+    }
     input.setConfig(config);
   } catch {
   }
@@ -5131,7 +5147,7 @@ async function runCliExecution(params) {
     governanceHandle,
     setConfig
   } = params;
-  const { execute } = await import("./execution-WA2UCXNM.js");
+  const { execute } = await import("./execution-ZEHK4II6.js");
   return execute(
     toExecuteDeps({
       core: {
@@ -33933,6 +33949,8 @@ async function runInteractive(cliCtx) {
     logger,
     teardownHandlers
   });
+  bootstrapWrongProxy(config.tools?.wrongProxy);
+  await awaitFirstWrongProxyProbe();
   const { buildProviderForId: buildProviderForId2, buildProviderForModel, switchProviderAndModel } = setupProviderRuntime({
     config,
     onConfigUpdate: (newConfig) => {
@@ -34367,4 +34385,4 @@ export {
   CLI_VERSION,
   runInteractive
 };
-//# sourceMappingURL=cli-main-RFEZAJ4U.js.map
+//# sourceMappingURL=cli-main-UDWMWX55.js.map

package/dist/{diag-doctor-HJKFUY6B.js → diag-doctor-Z6JDXBVX.js}

@@ -1,3 +1,6 @@
+import {
+  startProxyProbe
+} from "./chunk-3MAUU765.js";
 import {
   API_VERSION
 } from "./chunk-XJXDOF63.js";
@@ -8,6 +11,11 @@ import * as fs2 from "node:fs/promises";
 import * as os from "node:os";
 import * as path2 from "node:path";
 import { color, toErrorMessage } from "@wrongstack/core/utils";
+import {
+  applyProxyConfig,
+  getProxyConfig,
+  shouldRewriteFor
+} from "@wrongstack/core/wiring/proxy-rewrite";
 
 // src/subcommands/handlers/daemon-inventory.ts
 import * as fs from "node:fs/promises";
@@ -138,6 +146,43 @@ var diagCmd = async (_args, deps) => {
   deps.renderer.write(lines.join("\n") + "\n");
   return 0;
 };
+var proxyCmd = async (_args, deps) => {
+  const persisted = deps.config.tools?.wrongProxy;
+  if (persisted) {
+    applyProxyConfig({
+      enabled: persisted.enabled === true,
+      url: typeof persisted.url === "string" ? persisted.url : ""
+    });
+  }
+  if (persisted?.enabled === true && persisted.url) {
+    const runner = startProxyProbe({ intervalMs: 6e4, timeoutMs: 2e3 });
+    await runner.poke();
+  }
+  const cfg = getProxyConfig();
+  const gate = shouldRewriteFor("openai");
+  const enabled = cfg.enabled;
+  const url = cfg.url || "<unset>";
+  const active = cfg.active;
+  const status = () => {
+    if (enabled && active && cfg.url) return { glyph: "\u2713", label: "live", color: color.green };
+    if (enabled && !active)
+      return { glyph: "\u25CF", label: "enabled, probe not yet active", color: color.amber };
+    if (!enabled && cfg.url)
+      return { glyph: "\u25CB", label: "url set, toggle off", color: color.dim };
+    return { glyph: "\xB7", label: "unconfigured", color: color.dim };
+  };
+  const s = status();
+  const rewriteGateLabel = (open) => open ? color.green("rewrites applied") : color.dim("rewrites bypassed");
+  const lines = [
+    color.bold("WrongProxy / WrongTrace status"),
+    `  enabled:      ${enabled}`,
+    `  url:          ${url}`,
+    `  active:       ${active}    ${s.color(`(${s.label})`)}`,
+    `  shouldRewrite:${gate}  ${rewriteGateLabel(gate)}`
+  ];
+  deps.renderer.write(lines.join("\n") + "\n");
+  return 0;
+};
 async function reportDaemons(deps, opts) {
   const inventory = { projectRoot: deps.projectRoot, projectDir: deps.paths.projectDir };
   let reports = await collectDaemonReports(inventory);
@@ -324,6 +369,7 @@ var doctorCmd = async (args, deps) => {
 };
 export {
   diagCmd,
-  doctorCmd
+  doctorCmd,
+  proxyCmd
 };
-//# sourceMappingURL=diag-doctor-HJKFUY6B.js.map
+//# sourceMappingURL=diag-doctor-Z6JDXBVX.js.map

package/dist/{execution-WA2UCXNM.js → execution-ZEHK4II6.js}

@@ -9,9 +9,6 @@ import {
   setAutoSuggestions,
   setSuggestions
 } from "./chunk-X3N5TS2S.js";
-import {
-  startCliHqConnection
-} from "./chunk-FKWHSFX4.js";
 import "./chunk-WHOIR577.js";
 import {
   advanceToNextTask,
@@ -26,6 +23,9 @@ import {
   trySaveSpecFromAIOutput,
   trySaveTasksFromAIOutput
 } from "./chunk-DGXNL7OT.js";
+import {
+  startCliHqConnection
+} from "./chunk-FKWHSFX4.js";
 import {
   theme
 } from "./chunk-QD544J2B.js";
@@ -207,7 +207,7 @@ async function runWebUIDispatch(ctx) {
   const isSimpleUi = !isSessionChild && flags["simpleui"] === true;
   agent.disableInteractiveConfirmation();
   renderer.setSilent(true);
-  const { runWebUI } = await import("./webui-server-3DU6BVTB.js");
+  const { runWebUI } = await import("./webui-server-UB75UHWX.js");
   const flagValue = (names) => {
     for (const name of names) {
       if (!Object.hasOwn(flags, name)) continue;
@@ -404,6 +404,11 @@ async function runWebUIDispatch(ctx) {
     },
     onYoloSwitch: (enabled) => {
       applyLiveSettings?.({ yolo: enabled });
+    },
+    onWrongProxyPrefsChange: (payload) => {
+      void import("./proxy-wiring-7RPGBHZP.js").then(
+        ({ applyWrongProxyPrefs }) => applyWrongProxyPrefs(payload)
+      );
     }
   });
   const webuiExit = new Promise((resolve4) => {
@@ -1716,12 +1721,23 @@ function createSettingsAdapter(ctx) {
       }),
       showSageMemoryInject: autonomy?.showSageMemoryInject ?? false,
       readSymbols: autonomy?.readAdvancedMode ?? false,
-      sageMemoryInjectThreshold: cfg.Sage?.inject ? cfg.Sage.inject?.relationFloor : void 0
+      sageMemoryInjectThreshold: cfg.Sage?.inject ? cfg.Sage.inject?.relationFloor : void 0,
+      // WrongProxy / WrongTrace: read from `tools.wrongProxy.{enabled,url}`
+      // so the persistence shape mirrors the WebUI `LocalPrefs` shape
+      // (single object with two fields, not two top-level keys). The
+      // canonical type is `ToolsConfig.wrongProxy?: WrongProxyToolConfig`
+      // — no index-signature widening cast needed.
+      wrongProxyEnabled: cfg.tools?.wrongProxy?.enabled === true,
+      wrongProxyUrl: cfg.tools?.wrongProxy?.url
     };
   }
   async function saveSettings(s) {
     try {
-      if (s.mode !== void 0 || s.delayMs !== void 0 || s.titleAnimation !== void 0 || s.yolo !== void 0 || s.fleetChatVerbosity !== void 0 || s.chime !== void 0 || s.confirmExit !== void 0 || s.mouseMode !== void 0 || s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || s.allowOutsideProjectRoot !== void 0 || s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0 || s.contextMode !== void 0 || s.maxConcurrent !== void 0 || s.logLevel !== void 0 || s.auditLevel !== void 0 || s.indexOnStart !== void 0 || s.maxIterations !== void 0 || s.nextStepsTool !== void 0 || s.restrictFsToRoot !== void 0 || s.nextPrediction !== void 0 || s.debugStream !== void 0 || s.shellBangWarningDontShowAgain !== void 0 || s.configScope !== void 0 || s.enhanceDelayMs !== void 0 || s.enhanceEnabled !== void 0 || s.enhanceLanguage !== void 0 || s.midRunSendPicker !== void 0 || s.statuslineMode !== void 0 || s.thinkingWord !== void 0 || s.animationStyle !== void 0 || s.autonomyNextPrompt !== void 0 || s.autoProceedMaxIterations !== void 0 || s.reasoningMode !== void 0 || s.reasoningEffort !== void 0 || s.reasoningPreserve !== void 0 || s.cacheTtl !== void 0 || s.breakerEnabled !== void 0 || s.breakerAutoKillResetMs !== void 0 || s.showModelReasoning !== void 0 || s.showAgentSwarmPanel !== void 0 || s.panelPositions !== void 0 || s.showSageMemoryInject !== void 0 || s.sageMemoryInjectThreshold !== void 0 || s.readSymbols !== void 0) {
+      if (s.mode !== void 0 || s.delayMs !== void 0 || s.titleAnimation !== void 0 || s.yolo !== void 0 || s.fleetChatVerbosity !== void 0 || s.chime !== void 0 || s.confirmExit !== void 0 || s.mouseMode !== void 0 || s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || s.allowOutsideProjectRoot !== void 0 || s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0 || s.contextMode !== void 0 || s.maxConcurrent !== void 0 || s.logLevel !== void 0 || s.auditLevel !== void 0 || s.indexOnStart !== void 0 || s.maxIterations !== void 0 || s.nextStepsTool !== void 0 || s.restrictFsToRoot !== void 0 || s.nextPrediction !== void 0 || s.debugStream !== void 0 || s.shellBangWarningDontShowAgain !== void 0 || s.configScope !== void 0 || s.enhanceDelayMs !== void 0 || s.enhanceEnabled !== void 0 || s.enhanceLanguage !== void 0 || s.midRunSendPicker !== void 0 || s.statuslineMode !== void 0 || s.thinkingWord !== void 0 || s.animationStyle !== void 0 || s.autonomyNextPrompt !== void 0 || s.autoProceedMaxIterations !== void 0 || s.reasoningMode !== void 0 || s.reasoningEffort !== void 0 || s.reasoningPreserve !== void 0 || s.cacheTtl !== void 0 || s.breakerEnabled !== void 0 || s.breakerAutoKillResetMs !== void 0 || s.showModelReasoning !== void 0 || s.showAgentSwarmPanel !== void 0 || s.panelPositions !== void 0 || s.showSageMemoryInject !== void 0 || s.sageMemoryInjectThreshold !== void 0 || s.readSymbols !== void 0 || // WrongProxy / WrongTrace: gate the persisted-section write on
+      // either key being present in the live patch. Without this, a
+      // picker toggle round-trip would silently no-op the persistence
+      // layer (the runtime probe would never read the change).
+      s.wrongProxyEnabled !== void 0 || s.wrongProxyUrl !== void 0) {
         const cfg = configStore.get();
         const persistDeps = {
           configStore,
@@ -1819,11 +1835,21 @@ function createSettingsAdapter(ctx) {
           idx.onSessionStart = s.indexOnStart;
           decrypted.indexing = idx;
         }
-        if (s.maxIterations !== void 0 || s.nextStepsTool !== void 0 || fsAccess !== void 0) {
+        if (s.maxIterations !== void 0 || s.nextStepsTool !== void 0 || fsAccess !== void 0 || // WrongProxy / WrongTrace: include either key in the tools-section
+        // write guard so a picker toggle round-trip actually persists to
+        // `tools.wrongProxy.{enabled,url}`. Without this, the gate at
+        // line 279 would short-circuit and skip the whole section write.
+        s.wrongProxyEnabled !== void 0 || s.wrongProxyUrl !== void 0) {
           const tools = decrypted.tools ?? {};
           if (s.maxIterations !== void 0) tools.maxIterations = s.maxIterations;
           if (s.nextStepsTool !== void 0) tools.nextsteps = { enabled: s.nextStepsTool };
           if (fsAccess !== void 0) tools.restrictToProjectRoot = fsAccess.restrictToProjectRoot;
+          if (s.wrongProxyEnabled !== void 0 || s.wrongProxyUrl !== void 0) {
+            const wp = tools.wrongProxy ?? {};
+            if (s.wrongProxyEnabled !== void 0) wp.enabled = s.wrongProxyEnabled;
+            if (s.wrongProxyUrl !== void 0) wp.url = s.wrongProxyUrl;
+            tools.wrongProxy = wp;
+          }
           decrypted.tools = tools;
         }
         if (s.debugStream !== void 0) {
@@ -1934,7 +1960,11 @@ function createSettingsAdapter(ctx) {
               ...decrypted.indexing ?? {}
             }
           } : {},
-          ...s.maxIterations !== void 0 || s.nextStepsTool !== void 0 || fsAccess !== void 0 ? {
+          ...s.maxIterations !== void 0 || s.nextStepsTool !== void 0 || fsAccess !== void 0 || // WrongProxy / WrongTrace: must be in the tools guard or the
+          // in-memory ConfigStore never sees the freshly-saved values,
+          // and the next picker open in the same process would overwrite
+          // the on-disk selection with stale state. See Chimera review.
+          s.wrongProxyEnabled !== void 0 || s.wrongProxyUrl !== void 0 ? {
             tools: {
               ...currentConfig.tools,
               ...decrypted.tools ?? {}
@@ -6213,4 +6243,4 @@ export {
   execute,
   resolveReviewerFallbackModels
 };
-//# sourceMappingURL=execution-WA2UCXNM.js.map
+//# sourceMappingURL=execution-ZEHK4II6.js.map

package/dist/{hq-AG4VW4XO.js → hq-3BEUEXJQ.js}

@@ -51,7 +51,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-GZGM4BHA.js");
+  const { startHqServer } = await import("./hq-server-4MIW3S4J.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const host = typeof flags["host"] === "string" ? flags["host"] : HQ_CLI_DEFAULT_HOST;
@@ -709,4 +709,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-AG4VW4XO.js.map
+//# sourceMappingURL=hq-3BEUEXJQ.js.map

package/dist/{hq-server-GZGM4BHA.js → hq-server-4MIW3S4J.js}

@@ -15,7 +15,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-KQNYSZG2.js";
+} from "./chunk-J3XBHGEO.js";
 import "./chunk-KE7E7DPX.js";
 import "./chunk-Q5GTM25S.js";
 import "./chunk-7OCVIDC7.js";
@@ -37,4 +37,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-GZGM4BHA.js.map
+//# sourceMappingURL=hq-server-4MIW3S4J.js.map

package/dist/index.js

@@ -23,12 +23,12 @@ import {
 } from "./chunk-52C7PD2H.js";
 import {
   runUpdateCommand
-} from "./chunk-63GFD62R.js";
+} from "./chunk-4S52MIIM.js";
 import "./chunk-U3SS4NRH.js";
 import "./chunk-NUIHRGPY.js";
 import {
   DEFAULT_PORT
-} from "./chunk-KQNYSZG2.js";
+} from "./chunk-J3XBHGEO.js";
 import "./chunk-KE7E7DPX.js";
 import "./chunk-Q5GTM25S.js";
 import {
@@ -1645,8 +1645,8 @@ var helpTable = {
   update: {
     name: "update",
     title: "wstack update \u2014 self-update the CLI",
-    description: "Check the latest npm version and update the globally-installed `wrongstack` package. Use `--check-only` to just print the current/latest without installing. The update is global; run from any project root.",
-    usage: "wstack update [--check-only]",
+    description: "Check the latest npm version and update the globally-installed `wrongstack` package. Use `--check-only` to just print the current/latest without installing. Pass `--pm <manager>` (or its shorthand `--npm`, `--pnpm`, `--yarn`, `--bun`) to force a specific package manager; pass `--allow-scripts` (alias `--lifecycle-scripts`) to opt into package lifecycle scripts during the update (off by default). The update is global; run from any project root.",
+    usage: "wstack update [--check-only] [--pm <manager>] [--allow-scripts (alias: --lifecycle-scripts)]",
     seeAlso: "wstack version (read-only version info)"
   },
   // -- ACP (Agent Client Protocol) --------------------------------------
@@ -1861,10 +1861,10 @@ var subcommandsWithFocusedHelp = Object.keys(helpTable);
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-EA57GUFB.js")).acpCmd,
+  acp: async () => (await import("./acp-GZIASCLH.js")).acpCmd,
   init: async () => (await import("./init-4JQSG66Q.js")).initCmd,
   auth: async () => (await import("./auth-VQMSZGKE.js")).authCmd,
-  update: async () => (await import("./update-RATFF63M.js")).updateCmd,
+  update: async () => (await import("./update-ZXNC6I6G.js")).updateCmd,
   sessions: async () => (await import("./sessions-config-7Q7QJBKJ.js")).sessionsCmd,
   config: async () => (await import("./sessions-config-7Q7QJBKJ.js")).configCmd,
   rewind: async () => (await import("./rewind-2FFNOOKS.js")).rewindCmd,
@@ -1877,8 +1877,9 @@ var loaders = {
   mcp: async () => (await import("./mcp-RRPKNRSN.js")).mcpCmd,
   plugin: async () => (await import("./plugin-usage-GCTYOZPH.js")).pluginCmd,
   plugins: async () => (await import("./plugin-usage-GCTYOZPH.js")).pluginCmd,
-  diag: async () => (await import("./diag-doctor-HJKFUY6B.js")).diagCmd,
-  doctor: async () => (await import("./diag-doctor-HJKFUY6B.js")).doctorCmd,
+  diag: async () => (await import("./diag-doctor-Z6JDXBVX.js")).diagCmd,
+  doctor: async () => (await import("./diag-doctor-Z6JDXBVX.js")).doctorCmd,
+  "proxy-status": async () => (await import("./diag-doctor-Z6JDXBVX.js")).proxyCmd,
   export: async () => (await import("./export-ROG3DKTZ.js")).exportCmd,
   usage: async () => (await import("./plugin-usage-GCTYOZPH.js")).usageCmd,
   version: async () => (await import("./version-help-WMPSEL4U.js")).versionCmd,
@@ -1888,7 +1889,7 @@ var loaders = {
   quick: async () => (await import("./quick-XLYLZX4B.js")).quickCmd,
   bench: async () => (await import("./bench-XYG56AMO.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-6EPPMUC5.js")).chronicleCmd,
-  hq: async () => (await import("./hq-AG4VW4XO.js")).hqCmd,
+  hq: async () => (await import("./hq-3BEUEXJQ.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-5S3PHG5D.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-2PWBL4YU.js")).permissionsCmd,
   project: async () => (await import("./project-BLQ3ALVL.js")).projectCmd,
@@ -1967,7 +1968,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-GZGM4BHA.js");
+  const { startHqServer } = await import("./hq-server-4MIW3S4J.js");
   const tunnelRequested = flags["tunnel"] === true;
   const host = typeof flags["host"] === "string" ? flags["host"] : tunnelRequested ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST2;
   if (tunnelRequested && !isLoopbackHost(host)) {
@@ -4480,7 +4481,7 @@ async function initializeCli(argv) {
 async function main(argv) {
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-RFEZAJ4U.js");
+  const { runInteractive } = await import("./cli-main-UDWMWX55.js");
   return runInteractive(cliCtx);
 }
 

package/dist/live-settings-input.d.ts

@@ -88,5 +88,19 @@ export interface LiveSettingsInput {
     nextStepsTool?: boolean | undefined;
     /** Minimum relation strength for SAGE memory injection. Default: 0.85. */
     sageMemoryInjectThreshold?: number | undefined;
+    /**
+     * WrongProxy / WrongTrace: master switch. When true AND the daemon at
+     * `wrongProxyUrl` is reachable, every provider's base URL is rewritten
+     * through `${wrongProxyUrl}/proxy/<host><path>`. openai-codex is
+     * excluded by spec. Persisted to `tools.wrongProxy.enabled` (read at
+     * boot, applied mid-session by `applyLiveSettings`).
+     */
+    wrongProxyEnabled?: boolean | undefined;
+    /**
+     * WrongProxy / WrongTrace URL. Default `http://localhost:8000`. The
+     * CLI's periodic probe targets `<wrongProxyUrl>/api/health`; a 2xx
+     * response flips the runtime's `active` flag.
+     */
+    wrongProxyUrl?: string | undefined;
 }
 //# sourceMappingURL=live-settings-input.d.ts.map

package/dist/proxy-wiring-7RPGBHZP.js

@@ -0,0 +1,15 @@
+import {
+  applyWrongProxyPrefs,
+  awaitFirstWrongProxyProbe,
+  bootstrapWrongProxy,
+  shutdownWrongProxy
+} from "./chunk-3FHFGIIN.js";
+import "./chunk-3MAUU765.js";
+import "./chunk-7OCVIDC7.js";
+export {
+  applyWrongProxyPrefs,
+  awaitFirstWrongProxyProbe,
+  bootstrapWrongProxy,
+  shutdownWrongProxy
+};
+//# sourceMappingURL=proxy-wiring-7RPGBHZP.js.map

package/dist/subcommands/handlers/diag-doctor.d.ts

@@ -1,4 +1,18 @@
 import type { SubcommandHandler } from '../contracts.js';
 export declare const diagCmd: SubcommandHandler;
+/**
+ * `wstack proxy-status` — print the live in-process `ProxyConfig` singleton.
+ *
+ * A fresh `wstack` invocation has never booted the WS prefs pipeline that
+ * the long-running session uses to populate the singleton, so reading
+ * `getProxyConfig()` raw here would always return the module default
+ * (`enabled=false, url='', active=false`) regardless of what's on disk
+ * or whether the daemon is reachable. To answer "did the probe flip
+ * active=true?" we seed the singleton from persisted prefs (`config.tools
+ * .wrongProxy`), start a one-shot probe, await its first poke, and only
+ * then read state. `startProxyProbe()` is idempotent so this is safe to
+ * call from a subcommand that has no other runtime side-effects.
+ */
+export declare const proxyCmd: SubcommandHandler;
 export declare const doctorCmd: SubcommandHandler;
 //# sourceMappingURL=diag-doctor.d.ts.map

package/dist/{update-RATFF63M.js → update-ZXNC6I6G.js}

@@ -3,7 +3,7 @@ import {
   detectUpdatePackageName,
   runUpdateCommand,
   updateCmd
-} from "./chunk-63GFD62R.js";
+} from "./chunk-4S52MIIM.js";
 import "./chunk-U3SS4NRH.js";
 import "./chunk-NUIHRGPY.js";
 import "./chunk-7OCVIDC7.js";
@@ -13,4 +13,4 @@ export {
   runUpdateCommand,
   updateCmd
 };
-//# sourceMappingURL=update-RATFF63M.js.map
+//# sourceMappingURL=update-ZXNC6I6G.js.map

package/dist/webui-server/prefs-seeding.d.ts

@@ -18,6 +18,10 @@ interface CliWebUIOptions {
         fallbackAuto?: boolean | undefined;
         modelMatrix?: Config['modelMatrix'] | undefined;
         uiLocale?: string | undefined;
+        /** WrongProxy / WrongTrace toggle. */
+        wrongProxyEnabled?: boolean | undefined;
+        /** WrongProxy / WrongTrace URL. Default: 'http://localhost:8000'. */
+        wrongProxyUrl?: string | undefined;
     } | undefined;
 }
 type PrefSnapshot = Record<string, unknown>;

package/dist/{webui-server-3DU6BVTB.js → webui-server-UB75UHWX.js}

@@ -746,6 +746,12 @@ function createPrefsSeeding(opts) {
     if (typeof payload["uiLocale"] === "string") {
       patchLiveAppConfig({ uiLocale: payload["uiLocale"] });
     }
+    if (typeof payload["wrongProxyEnabled"] === "boolean") {
+      patchLiveAppConfig({ wrongProxyEnabled: payload["wrongProxyEnabled"] });
+    }
+    if (typeof payload["wrongProxyUrl"] === "string") {
+      patchLiveAppConfig({ wrongProxyUrl: payload["wrongProxyUrl"] });
+    }
     if (payload["modelMatrix"] && typeof payload["modelMatrix"] === "object" && !Array.isArray(payload["modelMatrix"])) {
       patchLiveAppConfig({ modelMatrix: payload["modelMatrix"] });
     }
@@ -881,6 +887,7 @@ function createWebuiRouteContexts({
     persist: persistPrefs,
     setYolo: opts.onYoloSwitch,
     setAutonomy: opts.onAutonomySwitch,
+    applyWrongProxyPrefs: opts.onWrongProxyPrefsChange,
     pendingConfirms,
     configStore: opts.agent.container?.safeResolve?.(TOKENS2.ConfigStore),
     send,
@@ -1686,4 +1693,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-3DU6BVTB.js.map
+//# sourceMappingURL=webui-server-UB75UHWX.js.map

package/dist/webui-server-options.d.ts

@@ -205,6 +205,14 @@ export interface CliWebUIOptions {
     onAutonomySwitch?: ((mode: string) => void) | undefined;
     /** Forward browser YOLO changes to the host's live permission policy. */
     onYoloSwitch?: ((enabled: boolean) => void) | undefined;
+    /**
+     * Forward `wrongProxyEnabled` / `wrongProxyUrl` changes from the
+     * browser to the runtime probe (`@wrongstack/cli/wiring/proxy-wiring`).
+     * Mirrors the `onAutonomySwitch` / `onYoloSwitch` pattern: the WS
+     * server stays package-agnostic and the boot site provides the
+     * host-side effect.
+     */
+    onWrongProxyPrefsChange?: ((payload: Record<string, unknown>) => void) | undefined;
     /**
      * Pre-computed update info from the CLI's preflight version check.
      * When present, the session.start payload includes appVersion,

package/dist/wiring/provider-runtime.d.ts

@@ -42,6 +42,31 @@ export interface ResolvedProviderCfg {
     factoryType: string;
 }
 export declare function resolveProviderCfg(config: Pick<Config, 'providers' | 'apiKey' | 'baseUrl'>, providerId: string): ResolvedProviderCfg;
+/**
+ * Shared proxy-aware provider-config resolver.
+ *
+ * Three sites in this monorepo merge a saved provider config with the
+ * top-level Config and hand the result to a provider factory:
+ *
+ *   1. `packages/cli/src/wiring/provider-runtime.ts` `resolveProviderCfg()`
+ *      — used by `/model`, the fallback extension, and any other runtime
+ *        path that rebuilds a Provider from a saved-config alias.
+ *   2. `packages/cli/src/wiring/provider.ts` `setupProvider()` — the
+ *      boot-time setup path for the active session provider.
+ *   3. `packages/runtime/src/fleet/light-subagent-factory.ts` `buildProvider()`
+ *      — subagent provider construction for SDD runs.
+ *
+ * Each of those had to apply the same proxy rewrite. The duplication
+ * drifted: `provider.ts:154` was force-setting `type: config.provider`
+ * before the `factoryType` read at line 158, silently destroying any
+ * saved-alias `type` field (e.g. `minimax-coding-plan` mapped to
+ * `type: 'anthropic'`). The drift was caught by Chimera review; this
+ * helper is the single source of truth that prevents it from recurring.
+ *
+ * Inputs are intentionally `Pick<Config, ...>` (not the full Config) so
+ * this helper stays free of disk I/O and can be called from any layer.
+ */
+export declare function resolveProviderCfgWithProxy(config: Pick<Config, 'providers' | 'apiKey' | 'baseUrl'>, providerId: string): ResolvedProviderCfg;
 /**
  * Construct a credential-resolved Provider for a provider id, WITHOUT
  * persisting anything. Shared by the `/model` switch and the fallback

package/dist/wiring/proxy-probe.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Periodic health probe for the local WrongProxy / WrongTrace daemon.
+ *
+ * The daemon exposes `GET <base>/api/health` returning JSON like:
+ *   { "repo": "WrongTrace", "status": "ok", "timestamp": "...", ... }
+ *
+ * The probe:
+ *  1. Runs once on boot so the first request doesn't hit a dead proxy.
+ *  2. Re-runs every `intervalMs` (default 30s) while the toggle is on.
+ *  3. Aborts in-flight probes on every state change so we never accumulate
+ *     a backlog when the user toggles the proxy on/off rapidly.
+ *  4. Uses a small per-call AbortController + timeout (2s) so a hung
+ *     `localhost:8000` cannot stall the loop.
+ *
+ * The probe is intentionally minimal: the daemon's `/api/health` response
+ * shape is small and stable, so we don't try to parse it — a 2xx is
+ * enough to mark the proxy active. Failures (timeout, non-2xx, ECONNREFUSED)
+ * are treated as SOFT signals: a single transient failure (daemon mid-
+ * restart, one dropped 2xx) must not flip `active` to false and silently
+ * disable rewrites for every subsequent request. `active` flips to false
+ * only after `deactivateAfterFailures` consecutive failures; the periodic
+ * loop keeps retrying, so a recovered daemon re-activates on the next
+ * successful probe. Toggle-off (`enabled: false` / no URL) still deactivates
+ * immediately.
+ */
+interface ProbeRunnerOptions {
+    /** Override the default interval (30s). Useful for tests. */
+    intervalMs?: number;
+    /** Override the default per-request timeout (2s). Useful for tests. */
+    timeoutMs?: number;
+    /** Override `fetch` for tests. */
+    fetchImpl?: typeof fetch;
+    /** Override `setInterval` / `clearInterval` for tests. */
+    setIntervalImpl?: typeof setInterval;
+    clearIntervalImpl?: typeof clearInterval;
+    /**
+     * Number of CONSECUTIVE failed probes required before `active` flips to
+     * false. A single transient failure is a soft signal and leaves `active`
+     * untouched. Defaults to 2. Useful for tests wanting to exercise the
+     * threshold without waiting two ticks.
+     */
+    deactivateAfterFailures?: number;
+}
+export interface ProbeRunner {
+    /** Stop the periodic probe and abort any in-flight request. */
+    stop(): void;
+    /** Force an immediate probe (next tick). Resolves with whether the health check succeeded. */
+    poke(): Promise<boolean>;
+}
+/**
+ * Start the probe loop. Idempotent — repeated calls reuse the existing
+ * runner unless `stop()` was called in between.
+ */
+export declare function startProxyProbe(opts?: ProbeRunnerOptions): ProbeRunner;
+/**
+ * Stop any running probe. Safe to call when nothing is running.
+ */
+export declare function stopProxyProbe(): void;
+/** Test-only: clear module state without touching timers. */
+export declare function __resetProxyProbeForTests(): void;
+export {};
+//# sourceMappingURL=proxy-probe.d.ts.map

package/dist/wiring/proxy-wiring.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Bridge between the WS prefs pipeline and the proxy-rewrite runtime.
+ *
+ * Lives in `@wrongstack/cli/wiring/proxy-wiring.ts` because it owns the
+ * side-effectful boot of the probe loop — `proxy-rewrite` is pure logic
+ * and `proxy-probe` is the periodic side-effect loop, but neither knows
+ * about WS prefs. This module is the single owner of:
+ *
+ *   - the singleton probe runner
+ *   - pushing user prefs into the proxy-rewrite config
+ *   - kicking off the periodic /api/health probe when the toggle goes on
+ *
+ * Re-exported so `handlePrefsUpdate` in `@wrongstack/webui-server` can
+ * call `applyWrongProxyPrefs(payload)` without taking a direct dependency
+ * on `proxy-probe` (the WS server is intentionally provider-agnostic).
+ */
+/**
+ * Apply the `wrongProxyEnabled` + `wrongProxyUrl` portion of a prefs
+ * payload. Idempotent — safe to call on every `prefs.update`. Boots the
+ * probe on first call so the rewrite can be marked active before the
+ * next request hits the provider factory.
+ */
+export declare function applyWrongProxyPrefs(payload: Record<string, unknown>): void;
+/**
+ * Await one probe pass so the `ProxyConfig` singleton's `active` flag is
+ * settled before the caller reads it. Returns immediately when no probe
+ * runner exists (toggle never enabled). Each call triggers a fresh
+ * `runOnce()` probe — there is no memoization — so call it once per
+ * decision point, not per request.
+ *
+ * This closes the cli-main boot race: `bootstrapWrongProxy()` seeds
+ * `enabled` / `url` synchronously, but `startProxyProbe()` only schedules
+ * a 30 s `setInterval` and the first `poke()` resolves on the next
+ * macrotask. `setupProviderRuntime()` runs synchronously on the very
+ * next line, so without this gate providers are constructed with the raw
+ * base URL even when the toggle is on.
+ */
+export declare function awaitFirstWrongProxyProbe(): Promise<void>;
+/**
+ * Apply the initial prefs snapshot at boot. Same as `applyWrongProxyPrefs`
+ * but explicitly named for the boot site so future readers can find it.
+ *
+ * Accepts the canonical persisted shape (`config.tools.wrongProxy` —
+ * `{ enabled?, url? }`) directly. The `enabled` / `url` keys are mapped
+ * to the flat `wrongProxyEnabled` / `wrongProxyUrl` keys the proxy
+ * rewriter reads; any other keys in the snapshot are ignored. Callers
+ * that hold a `WrongProxyToolConfig` (the typed schema in
+ * `@wrongstack/core/types/config/tools.ts`) can pass it through without
+ * casting — the function never reads anything beyond `enabled` / `url`.
+ */
+export declare function bootstrapWrongProxy(snapshot: {
+    enabled?: boolean | undefined;
+    url?: string | undefined;
+} | Record<string, unknown> | undefined): void;
+/**
+ * Stop the probe. Intended for graceful shutdown / test cleanup.
+ */
+export declare function shutdownWrongProxy(): void;
+//# sourceMappingURL=proxy-wiring.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "0.310.0",
+  "version": "0.310.1",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -42,34 +42,34 @@
   ],
   "dependencies": {
     "ws": "^8.21.3",
-    "@wrongstack/acp": "0.310.0",
-    "@wrongstack/bench": "0.310.0",
-    "@wrongstack/core": "0.310.0",
-    "@wrongstack/persistence": "0.310.0",
-    "@wrongstack/kanban": "0.310.0",
-    "@wrongstack/plugins": "0.310.0",
-    "@wrongstack/plug-lsp": "0.310.0",
-    "@wrongstack/primitives": "0.310.0",
-    "@wrongstack/providers": "0.310.0",
-    "@wrongstack/runtime": "0.310.0",
-    "@wrongstack/sdd": "0.310.0",
-    "@wrongstack/mcp": "0.310.0",
-    "@wrongstack/requirement-intake": "0.310.0",
-    "@wrongstack/sage": "0.310.0",
-    "@wrongstack/security-scanner": "0.310.0",
-    "@wrongstack/techstack": "0.310.0",
-    "@wrongstack/telegram": "0.310.0",
-    "@wrongstack/simpleui": "0.310.0",
-    "@wrongstack/vector-memory": "0.310.0",
-    "@wrongstack/tools": "0.310.0",
-    "@wrongstack/webui": "0.310.0",
-    "@wrongstack/webui-server": "0.310.0",
-    "@wrongstack/webui-hq": "0.310.0",
-    "@wrongstack/tui": "0.310.0",
-    "@wrongstack/webui-protocol": "0.310.0"
+    "@wrongstack/core": "0.310.1",
+    "@wrongstack/acp": "0.310.1",
+    "@wrongstack/bench": "0.310.1",
+    "@wrongstack/mcp": "0.310.1",
+    "@wrongstack/primitives": "0.310.1",
+    "@wrongstack/plug-lsp": "0.310.1",
+    "@wrongstack/persistence": "0.310.1",
+    "@wrongstack/kanban": "0.310.1",
+    "@wrongstack/runtime": "0.310.1",
+    "@wrongstack/requirement-intake": "0.310.1",
+    "@wrongstack/sage": "0.310.1",
+    "@wrongstack/sdd": "0.310.1",
+    "@wrongstack/simpleui": "0.310.1",
+    "@wrongstack/tools": "0.310.1",
+    "@wrongstack/security-scanner": "0.310.1",
+    "@wrongstack/telegram": "0.310.1",
+    "@wrongstack/vector-memory": "0.310.1",
+    "@wrongstack/providers": "0.310.1",
+    "@wrongstack/webui": "0.310.1",
+    "@wrongstack/plugins": "0.310.1",
+    "@wrongstack/webui-hq": "0.310.1",
+    "@wrongstack/techstack": "0.310.1",
+    "@wrongstack/webui-protocol": "0.310.1",
+    "@wrongstack/tui": "0.310.1",
+    "@wrongstack/webui-server": "0.310.1"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "0.310.0"
+    "@wrongstack/desktop": "0.310.1"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",