@wrongstack/cli 0.310.0 → 0.313.0

package/dist/{execution-WA2UCXNM.js → execution-TOBPK6MD.js}

@@ -9,9 +9,6 @@ import {
   setAutoSuggestions,
   setSuggestions
 } from "./chunk-X3N5TS2S.js";
-import {
-  startCliHqConnection
-} from "./chunk-FKWHSFX4.js";
 import "./chunk-WHOIR577.js";
 import {
   advanceToNextTask,
@@ -26,17 +23,20 @@ import {
   trySaveSpecFromAIOutput,
   trySaveTasksFromAIOutput
 } from "./chunk-DGXNL7OT.js";
+import {
+  startCliHqConnection
+} from "./chunk-FKWHSFX4.js";
 import {
   theme
 } from "./chunk-QD544J2B.js";
+import {
+  fmtTok
+} from "./chunk-TYO2OVAD.js";
 import {
   WEBUI_SESSION_CHILD_CAPABILITIES,
   writeWebuiSessionChildError,
   writeWebuiSessionChildReady
 } from "./chunk-3JPTNADJ.js";
-import {
-  fmtTok
-} from "./chunk-TYO2OVAD.js";
 import {
   terminalLink,
   terminalText
@@ -207,7 +207,7 @@ async function runWebUIDispatch(ctx) {
   const isSimpleUi = !isSessionChild && flags["simpleui"] === true;
   agent.disableInteractiveConfirmation();
   renderer.setSilent(true);
-  const { runWebUI } = await import("./webui-server-3DU6BVTB.js");
+  const { runWebUI } = await import("./webui-server-I53IYBW4.js");
   const flagValue = (names) => {
     for (const name of names) {
       if (!Object.hasOwn(flags, name)) continue;
@@ -404,6 +404,11 @@ async function runWebUIDispatch(ctx) {
     },
     onYoloSwitch: (enabled) => {
       applyLiveSettings?.({ yolo: enabled });
+    },
+    onWrongProxyPrefsChange: (payload) => {
+      void import("./proxy-wiring-G26YGP7S.js").then(
+        ({ applyWrongProxyPrefs }) => applyWrongProxyPrefs(payload)
+      );
     }
   });
   const webuiExit = new Promise((resolve4) => {
@@ -1633,7 +1638,7 @@ function coerceAgentSwarmMode(v) {
   if (typeof v === "string" && (v === "bottom" || v === "sidebar" || v === "off")) return v;
   return "bottom";
 }
-var ANIMATION_STYLES = ["rainbow", "wave", "pulse", "dots", "breathe", "cycle"];
+var ANIMATION_STYLES = ["rainbow", "wave", "pulse", "dots", "breathe", "static", "cycle"];
 function normalizeAnimationStyle(raw) {
   return typeof raw === "string" && ANIMATION_STYLES.includes(raw) ? raw : "rainbow";
 }
@@ -1716,12 +1721,23 @@ function createSettingsAdapter(ctx) {
       }),
       showSageMemoryInject: autonomy?.showSageMemoryInject ?? false,
       readSymbols: autonomy?.readAdvancedMode ?? false,
-      sageMemoryInjectThreshold: cfg.Sage?.inject ? cfg.Sage.inject?.relationFloor : void 0
+      sageMemoryInjectThreshold: cfg.Sage?.inject ? cfg.Sage.inject?.relationFloor : void 0,
+      // WrongProxy / WrongTrace: read from `tools.wrongProxy.{enabled,url}`
+      // so the persistence shape mirrors the WebUI `LocalPrefs` shape
+      // (single object with two fields, not two top-level keys). The
+      // canonical type is `ToolsConfig.wrongProxy?: WrongProxyToolConfig`
+      // — no index-signature widening cast needed.
+      wrongProxyEnabled: cfg.tools?.wrongProxy?.enabled === true,
+      wrongProxyUrl: cfg.tools?.wrongProxy?.url
     };
   }
   async function saveSettings(s) {
     try {
-      if (s.mode !== void 0 || s.delayMs !== void 0 || s.titleAnimation !== void 0 || s.yolo !== void 0 || s.fleetChatVerbosity !== void 0 || s.chime !== void 0 || s.confirmExit !== void 0 || s.mouseMode !== void 0 || s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || s.allowOutsideProjectRoot !== void 0 || s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0 || s.contextMode !== void 0 || s.maxConcurrent !== void 0 || s.logLevel !== void 0 || s.auditLevel !== void 0 || s.indexOnStart !== void 0 || s.maxIterations !== void 0 || s.nextStepsTool !== void 0 || s.restrictFsToRoot !== void 0 || s.nextPrediction !== void 0 || s.debugStream !== void 0 || s.shellBangWarningDontShowAgain !== void 0 || s.configScope !== void 0 || s.enhanceDelayMs !== void 0 || s.enhanceEnabled !== void 0 || s.enhanceLanguage !== void 0 || s.midRunSendPicker !== void 0 || s.statuslineMode !== void 0 || s.thinkingWord !== void 0 || s.animationStyle !== void 0 || s.autonomyNextPrompt !== void 0 || s.autoProceedMaxIterations !== void 0 || s.reasoningMode !== void 0 || s.reasoningEffort !== void 0 || s.reasoningPreserve !== void 0 || s.cacheTtl !== void 0 || s.breakerEnabled !== void 0 || s.breakerAutoKillResetMs !== void 0 || s.showModelReasoning !== void 0 || s.showAgentSwarmPanel !== void 0 || s.panelPositions !== void 0 || s.showSageMemoryInject !== void 0 || s.sageMemoryInjectThreshold !== void 0 || s.readSymbols !== void 0) {
+      if (s.mode !== void 0 || s.delayMs !== void 0 || s.titleAnimation !== void 0 || s.yolo !== void 0 || s.fleetChatVerbosity !== void 0 || s.chime !== void 0 || s.confirmExit !== void 0 || s.mouseMode !== void 0 || s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || s.allowOutsideProjectRoot !== void 0 || s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0 || s.contextMode !== void 0 || s.maxConcurrent !== void 0 || s.logLevel !== void 0 || s.auditLevel !== void 0 || s.indexOnStart !== void 0 || s.maxIterations !== void 0 || s.nextStepsTool !== void 0 || s.restrictFsToRoot !== void 0 || s.nextPrediction !== void 0 || s.debugStream !== void 0 || s.shellBangWarningDontShowAgain !== void 0 || s.configScope !== void 0 || s.enhanceDelayMs !== void 0 || s.enhanceEnabled !== void 0 || s.enhanceLanguage !== void 0 || s.midRunSendPicker !== void 0 || s.statuslineMode !== void 0 || s.thinkingWord !== void 0 || s.animationStyle !== void 0 || s.autonomyNextPrompt !== void 0 || s.autoProceedMaxIterations !== void 0 || s.reasoningMode !== void 0 || s.reasoningEffort !== void 0 || s.reasoningPreserve !== void 0 || s.cacheTtl !== void 0 || s.breakerEnabled !== void 0 || s.breakerAutoKillResetMs !== void 0 || s.showModelReasoning !== void 0 || s.showAgentSwarmPanel !== void 0 || s.panelPositions !== void 0 || s.showSageMemoryInject !== void 0 || s.sageMemoryInjectThreshold !== void 0 || s.readSymbols !== void 0 || // WrongProxy / WrongTrace: gate the persisted-section write on
+      // either key being present in the live patch. Without this, a
+      // picker toggle round-trip would silently no-op the persistence
+      // layer (the runtime probe would never read the change).
+      s.wrongProxyEnabled !== void 0 || s.wrongProxyUrl !== void 0) {
         const cfg = configStore.get();
         const persistDeps = {
           configStore,
@@ -1819,11 +1835,21 @@ function createSettingsAdapter(ctx) {
           idx.onSessionStart = s.indexOnStart;
           decrypted.indexing = idx;
         }
-        if (s.maxIterations !== void 0 || s.nextStepsTool !== void 0 || fsAccess !== void 0) {
+        if (s.maxIterations !== void 0 || s.nextStepsTool !== void 0 || fsAccess !== void 0 || // WrongProxy / WrongTrace: include either key in the tools-section
+        // write guard so a picker toggle round-trip actually persists to
+        // `tools.wrongProxy.{enabled,url}`. Without this, the gate at
+        // line 279 would short-circuit and skip the whole section write.
+        s.wrongProxyEnabled !== void 0 || s.wrongProxyUrl !== void 0) {
           const tools = decrypted.tools ?? {};
           if (s.maxIterations !== void 0) tools.maxIterations = s.maxIterations;
           if (s.nextStepsTool !== void 0) tools.nextsteps = { enabled: s.nextStepsTool };
           if (fsAccess !== void 0) tools.restrictToProjectRoot = fsAccess.restrictToProjectRoot;
+          if (s.wrongProxyEnabled !== void 0 || s.wrongProxyUrl !== void 0) {
+            const wp = tools.wrongProxy ?? {};
+            if (s.wrongProxyEnabled !== void 0) wp.enabled = s.wrongProxyEnabled;
+            if (s.wrongProxyUrl !== void 0) wp.url = s.wrongProxyUrl;
+            tools.wrongProxy = wp;
+          }
           decrypted.tools = tools;
         }
         if (s.debugStream !== void 0) {
@@ -1934,7 +1960,11 @@ function createSettingsAdapter(ctx) {
               ...decrypted.indexing ?? {}
             }
           } : {},
-          ...s.maxIterations !== void 0 || s.nextStepsTool !== void 0 || fsAccess !== void 0 ? {
+          ...s.maxIterations !== void 0 || s.nextStepsTool !== void 0 || fsAccess !== void 0 || // WrongProxy / WrongTrace: must be in the tools guard or the
+          // in-memory ConfigStore never sees the freshly-saved values,
+          // and the next picker open in the same process would overwrite
+          // the on-disk selection with stale state. See Chimera review.
+          s.wrongProxyEnabled !== void 0 || s.wrongProxyUrl !== void 0 ? {
             tools: {
               ...currentConfig.tools,
               ...decrypted.tools ?? {}
@@ -2407,6 +2437,53 @@ async function finalizeExecutionCleanup(input) {
       sessionEndProducers.add(tracked);
     }
   });
+  try {
+    const model = agent.ctx.model;
+    if (!model) {
+      console.warn(
+        JSON.stringify({
+          level: "warn",
+          event: "shutdown.wrongtrace_telemetry_skipped",
+          message: "Skipping WrongTrace telemetry: agent model unknown at session end",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
+    } else {
+      const { reportWrongTraceSessionTelemetry } = await import("./wrongtrace-telemetry-6M2CCBX5.js");
+      const usage = tokenCounter.total();
+      const report = reportWrongTraceSessionTelemetry({
+        sessionId: activeSession.id,
+        agentName: "wrongstack-cli",
+        model,
+        provider: agent.ctx.provider?.id ?? "",
+        usage: {
+          input: usage.input,
+          output: usage.output,
+          cacheRead: usage.cacheRead,
+          cacheWrite: usage.cacheWrite
+        },
+        costUsd: tokenCounter.estimateCost().total
+      });
+      const deadline = new Promise((resolve4) => {
+        const t = setTimeout(resolve4, 5e3);
+        t.unref?.();
+      });
+      const tracked = Promise.race([report, deadline]).finally(
+        () => sessionEndProducers.delete(tracked)
+      );
+      void tracked.catch(() => void 0);
+      sessionEndProducers.add(tracked);
+    }
+  } catch {
+  }
+  try {
+    const { snapshotGateDecisions, persistWrongTraceGateCounters } = await import("./wrongtrace-gate-counters-P5BCBXQN.js");
+    const projectRoot = agent.ctx.projectRoot;
+    if (projectRoot) {
+      await persistWrongTraceGateCounters(projectRoot, snapshotGateDecisions());
+    }
+  } catch {
+  }
   if (director) {
     try {
       director.requestFinish("leader session ended \u2014 finish your review now");
@@ -3334,9 +3411,10 @@ function installChimeraCascadeHandler({
   trackWork,
   buildLadder,
   verifyEvidence = verifyCascadeEvidence,
-  persistEvidence
+  persistEvidence,
+  teardownHandlers
 }) {
-  events.onPattern("chimera.cascade_needed", (_event, payload) => {
+  const off = events.onPattern("chimera.cascade_needed", (_event, payload) => {
     const p = payload;
     const dir = director;
     if (!dir) return;
@@ -3451,7 +3529,8 @@ function installChimeraCascadeHandler({
       });
     })();
     trackWork(pendingWork);
-  });
+  }, "chimera-cascade");
+  if (off) teardownHandlers?.push(off);
 }
 async function maybeReReviewCascade({
   events,
@@ -3626,9 +3705,10 @@ function installChimeraReviewHandler({
   projectDir,
   statusTracker,
   persistReview = persistChimeraReview,
-  trackWork
+  trackWork,
+  teardownHandlers
 }) {
-  events.onPattern("chimera.review_needed", (_event, payload) => {
+  const off = events.onPattern("chimera.review_needed", (_event, payload) => {
     const p = payload;
     const reviewSessionId = agent.ctx.activeRunSessionId ?? agent.ctx.session?.id ?? session.id;
     const dir = director;
@@ -3989,7 +4069,8 @@ ${reviewBody}`;
         }
       })()
     );
-  });
+  }, "chimera-review");
+  if (off) teardownHandlers?.push(off);
 }
 async function persistChimeraReview(payload, projectDir) {
   const reportId = payload.reportId;
@@ -5732,6 +5813,7 @@ async function execute(deps) {
   const bootUpdateInfo = initialUpdateInfo;
   const offStorageObservability = installStorageObservability(events, context.traceId);
   const chimeraWork = createChimeraWorkRegistry();
+  const chimeraTeardowns = [];
   installChimeraReviewHandler({
     events,
     director,
@@ -5740,6 +5822,7 @@ async function execute(deps) {
     agent,
     config,
     projectDir: wpaths.projectDir,
+    teardownHandlers: chimeraTeardowns,
     // Thread the shared tracker so the round-robin Chimera reviewer picks
     // skip (provider, model) pairs currently in the waiting room. Without
     // this, a 429-stricken model is re-spawned on every concurrent reviewer
@@ -5753,6 +5836,7 @@ async function execute(deps) {
     events,
     director,
     session,
+    teardownHandlers: chimeraTeardowns,
     buildLadder: () => buildMutatingAgentLadder({
       profileChain: effectiveFallbackChain2(config),
       session: { provider: config.provider, model: config.model }
@@ -6185,6 +6269,12 @@ async function execute(deps) {
       }
     }
   } finally {
+    for (const off of chimeraTeardowns.splice(0)) {
+      try {
+        off();
+      } catch {
+      }
+    }
     await finalizeExecutionCleanup({
       offStorageObservability,
       fleetStatusLine,
@@ -6213,4 +6303,4 @@ export {
   execute,
   resolveReviewerFallbackModels
 };
-//# sourceMappingURL=execution-WA2UCXNM.js.map
+//# sourceMappingURL=execution-TOBPK6MD.js.map

package/dist/execution-chimera-cascade.d.ts

@@ -18,9 +18,12 @@ export type InstallChimeraCascadeHandlerOptions = {
     buildLadder?: (() => ReviewerAttempt[]) | undefined;
     /** Test seam; production defaults to the real safe command verifier. */
     verifyEvidence?: typeof verifyCascadeEvidence | undefined;
+    /** Optional session-teardown chain — the wildcard listener disposer is
+     *  pushed here so the registration is released when the session ends. */
+    teardownHandlers?: Array<() => void> | undefined;
     /** Persist every evidence verdict on the source report, even when re-review stops. */
     persistEvidence?: ((reportId: string, status: CascadeEvidenceStatus, checks: CascadeEvidenceCheckResult[]) => Promise<void>) | undefined;
 };
-export declare function installChimeraCascadeHandler({ events, director, session, getPendingWork, trackWork, buildLadder, verifyEvidence, persistEvidence, }: InstallChimeraCascadeHandlerOptions): void;
+export declare function installChimeraCascadeHandler({ events, director, session, getPendingWork, trackWork, buildLadder, verifyEvidence, persistEvidence, teardownHandlers, }: InstallChimeraCascadeHandlerOptions): void;
 export {};
 //# sourceMappingURL=execution-chimera-cascade.d.ts.map

package/dist/execution-chimera-review.d.ts

@@ -38,7 +38,10 @@ export type InstallChimeraReviewHandlerOptions = {
     statusTracker?: ProviderModelStatusTracker | undefined;
     persistReview?: ((payload: ChimeraReviewCompletePayload, projectDir: string) => Promise<void>) | undefined;
     trackWork: (work: Promise<void>) => void;
+    /** Optional session-teardown chain — the wildcard listener disposer is
+     *  pushed here so the registration is released when the session ends. */
+    teardownHandlers?: Array<() => void> | undefined;
 };
-export declare function installChimeraReviewHandler({ events, director, session, mailbox, agent, config, projectDir, statusTracker, persistReview, trackWork, }: InstallChimeraReviewHandlerOptions): void;
+export declare function installChimeraReviewHandler({ events, director, session, mailbox, agent, config, projectDir, statusTracker, persistReview, trackWork, teardownHandlers, }: InstallChimeraReviewHandlerOptions): void;
 export {};
 //# sourceMappingURL=execution-chimera-review.d.ts.map

package/dist/fleet/host-types.d.ts

@@ -1,5 +1,6 @@
 import type { AgentPipelines, FallbackProfileManager } from '@wrongstack/core/agent';
 import type { BrainArbiter, ProviderModelStatusTracker } from '@wrongstack/core/coordination';
+import type { HookRunner } from '@wrongstack/core/hooks';
 import type { Container, EventBus } from '@wrongstack/core/kernel';
 import type { ProviderRegistry, ToolRegistry } from '@wrongstack/core/registry';
 import type { ConfigStore, ModelsRegistry, Renderer, SecretScrubber, SessionWriter, SkillLoader, SystemPromptBuilder, TokenCounter } from '@wrongstack/core/types';
@@ -32,6 +33,14 @@ export interface MultiAgentDeps {
      * subagent pipeline. This is host wiring, never a model-visible capability.
      */
     installToolBoundary?: ((pipelines: AgentPipelines) => void) | undefined;
+    /**
+     * Optional hook runner applied to every spawned subagent's ToolExecutor.
+     * The CLI wires a dedicated WrongTrace-only runner here so worker edits
+     * pass the same lock gate as the leader. Deliberately NOT the leader's
+     * own HookRegistry: shell hooks from `config.hooks` are a leader-session
+     * automation surface and must not silently replay on workers.
+     */
+    hookRunner?: HookRunner | undefined;
 }
 /**
  * Per-session options for the multi-agent host. Director Mode is always

package/dist/fleet/subagent-hook-runner.d.ts

@@ -0,0 +1,22 @@
+import { HookRunner } from '@wrongstack/core/hooks';
+/**
+ * Dedicated WrongTrace-only HookRunner for fleet subagents.
+ *
+ * Why not hand subagents the leader's own HookRunner: the leader's
+ * HookRegistry also carries shell hooks loaded from `config.hooks`, and
+ * those are a leader-session automation surface — replaying them on every
+ * worker tool call would be a silent behavior change beyond WrongTrace.
+ * This runner registers ONLY the fail-open lock-gate hooks, so a worker's
+ * `edit`/`write`/`replace`/`patch`/`codebase-ast-replace` call honors
+ * peer locks exactly like the leader does while nothing else changes.
+ *
+ * Lock claims are stamped `wrongstack:<leaderSessionId>` — one process,
+ * one lock-owner identity; per-worker ids would fragment the TTL picture
+ * without adding safety (the daemon lock is advisory coordination).
+ *
+ * Mirrors the registration contract in lifecycle-plugins.ts (same events,
+ * same matcher, same owner id). If production drifts, update both.
+ * `emit` (optional) forwards typed gate-decision events to the host bus.
+ */
+export declare function createSubagentWrongTraceHookRunner(sessionId: () => string, emit?: (event: import('@wrongstack/wrongtrace').WrongTraceGateDecisionEvent) => void): HookRunner;
+//# sourceMappingURL=subagent-hook-runner.d.ts.map

package/dist/{hq-AG4VW4XO.js → hq-2XIXGAER.js}

@@ -51,7 +51,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-GZGM4BHA.js");
+  const { startHqServer } = await import("./hq-server-DBT3OOYD.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const host = typeof flags["host"] === "string" ? flags["host"] : HQ_CLI_DEFAULT_HOST;
@@ -709,4 +709,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-AG4VW4XO.js.map
+//# sourceMappingURL=hq-2XIXGAER.js.map

package/dist/{hq-server-GZGM4BHA.js → hq-server-DBT3OOYD.js}

@@ -15,7 +15,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-KQNYSZG2.js";
+} from "./chunk-E3X4KM7T.js";
 import "./chunk-KE7E7DPX.js";
 import "./chunk-Q5GTM25S.js";
 import "./chunk-7OCVIDC7.js";
@@ -37,4 +37,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-GZGM4BHA.js.map
+//# sourceMappingURL=hq-server-DBT3OOYD.js.map

package/dist/index.js

@@ -10,25 +10,25 @@ import {
 import {
   theme
 } from "./chunk-QD544J2B.js";
-import {
-  parseWebuiSessionChildOptions,
-  writeWebuiSessionChildError
-} from "./chunk-3JPTNADJ.js";
 import {
   fmtTok,
   patchConfig
 } from "./chunk-TYO2OVAD.js";
+import {
+  parseWebuiSessionChildOptions,
+  writeWebuiSessionChildError
+} from "./chunk-3JPTNADJ.js";
 import {
   discoverAndMergeProviders
 } from "./chunk-52C7PD2H.js";
 import {
   runUpdateCommand
-} from "./chunk-63GFD62R.js";
+} from "./chunk-4S52MIIM.js";
 import "./chunk-U3SS4NRH.js";
 import "./chunk-NUIHRGPY.js";
 import {
   DEFAULT_PORT
-} from "./chunk-KQNYSZG2.js";
+} from "./chunk-E3X4KM7T.js";
 import "./chunk-KE7E7DPX.js";
 import "./chunk-Q5GTM25S.js";
 import {
@@ -1645,8 +1645,8 @@ var helpTable = {
   update: {
     name: "update",
     title: "wstack update \u2014 self-update the CLI",
-    description: "Check the latest npm version and update the globally-installed `wrongstack` package. Use `--check-only` to just print the current/latest without installing. The update is global; run from any project root.",
-    usage: "wstack update [--check-only]",
+    description: "Check the latest npm version and update the globally-installed `wrongstack` package. Use `--check-only` to just print the current/latest without installing. Pass `--pm <manager>` (or its shorthand `--npm`, `--pnpm`, `--yarn`, `--bun`) to force a specific package manager; pass `--allow-scripts` (alias `--lifecycle-scripts`) to opt into package lifecycle scripts during the update (off by default). The update is global; run from any project root.",
+    usage: "wstack update [--check-only] [--pm <manager>] [--allow-scripts (alias: --lifecycle-scripts)]",
     seeAlso: "wstack version (read-only version info)"
   },
   // -- ACP (Agent Client Protocol) --------------------------------------
@@ -1861,10 +1861,10 @@ var subcommandsWithFocusedHelp = Object.keys(helpTable);
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-EA57GUFB.js")).acpCmd,
+  acp: async () => (await import("./acp-LQMSMV32.js")).acpCmd,
   init: async () => (await import("./init-4JQSG66Q.js")).initCmd,
   auth: async () => (await import("./auth-VQMSZGKE.js")).authCmd,
-  update: async () => (await import("./update-RATFF63M.js")).updateCmd,
+  update: async () => (await import("./update-ZXNC6I6G.js")).updateCmd,
   sessions: async () => (await import("./sessions-config-7Q7QJBKJ.js")).sessionsCmd,
   config: async () => (await import("./sessions-config-7Q7QJBKJ.js")).configCmd,
   rewind: async () => (await import("./rewind-2FFNOOKS.js")).rewindCmd,
@@ -1877,8 +1877,9 @@ var loaders = {
   mcp: async () => (await import("./mcp-RRPKNRSN.js")).mcpCmd,
   plugin: async () => (await import("./plugin-usage-GCTYOZPH.js")).pluginCmd,
   plugins: async () => (await import("./plugin-usage-GCTYOZPH.js")).pluginCmd,
-  diag: async () => (await import("./diag-doctor-HJKFUY6B.js")).diagCmd,
-  doctor: async () => (await import("./diag-doctor-HJKFUY6B.js")).doctorCmd,
+  diag: async () => (await import("./diag-doctor-OPTB2NWY.js")).diagCmd,
+  doctor: async () => (await import("./diag-doctor-OPTB2NWY.js")).doctorCmd,
+  "proxy-status": async () => (await import("./diag-doctor-OPTB2NWY.js")).proxyCmd,
   export: async () => (await import("./export-ROG3DKTZ.js")).exportCmd,
   usage: async () => (await import("./plugin-usage-GCTYOZPH.js")).usageCmd,
   version: async () => (await import("./version-help-WMPSEL4U.js")).versionCmd,
@@ -1888,7 +1889,7 @@ var loaders = {
   quick: async () => (await import("./quick-XLYLZX4B.js")).quickCmd,
   bench: async () => (await import("./bench-XYG56AMO.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-6EPPMUC5.js")).chronicleCmd,
-  hq: async () => (await import("./hq-AG4VW4XO.js")).hqCmd,
+  hq: async () => (await import("./hq-2XIXGAER.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-5S3PHG5D.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-2PWBL4YU.js")).permissionsCmd,
   project: async () => (await import("./project-BLQ3ALVL.js")).projectCmd,
@@ -1967,7 +1968,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-GZGM4BHA.js");
+  const { startHqServer } = await import("./hq-server-DBT3OOYD.js");
   const tunnelRequested = flags["tunnel"] === true;
   const host = typeof flags["host"] === "string" ? flags["host"] : tunnelRequested ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST2;
   if (tunnelRequested && !isLoopbackHost(host)) {
@@ -4480,7 +4481,7 @@ async function initializeCli(argv) {
 async function main(argv) {
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-RFEZAJ4U.js");
+  const { runInteractive } = await import("./cli-main-BFUSCWXE.js");
   return runInteractive(cliCtx);
 }
 

package/dist/live-settings-input.d.ts

@@ -52,7 +52,7 @@ export interface LiveSettingsInput {
     /** Single word shown in the TUI rainbow working-state chip. */
     thinkingWord?: string | undefined;
     /** Animation style for the TUI working-state chip. */
-    animationStyle?: 'rainbow' | 'wave' | 'pulse' | 'dots' | 'breathe' | 'cycle' | undefined;
+    animationStyle?: 'rainbow' | 'wave' | 'pulse' | 'dots' | 'breathe' | 'static' | 'cycle' | undefined;
     /** Provider-runtime reasoning mode. */
     reasoningMode?: 'auto' | 'on' | 'off' | undefined;
     /** Provider-runtime reasoning effort. */
@@ -88,5 +88,19 @@ export interface LiveSettingsInput {
     nextStepsTool?: boolean | undefined;
     /** Minimum relation strength for SAGE memory injection. Default: 0.85. */
     sageMemoryInjectThreshold?: number | undefined;
+    /**
+     * WrongProxy / WrongTrace: master switch. When true AND the daemon at
+     * `wrongProxyUrl` is reachable, every provider's base URL is rewritten
+     * through `${wrongProxyUrl}/proxy/<host><path>`. openai-codex is
+     * excluded by spec. Persisted to `tools.wrongProxy.enabled` (read at
+     * boot, applied mid-session by `applyLiveSettings`).
+     */
+    wrongProxyEnabled?: boolean | undefined;
+    /**
+     * WrongProxy / WrongTrace URL. Default `http://localhost:3444`. The
+     * CLI's periodic probe targets `<wrongProxyUrl>/api/health`; a 2xx
+     * response flips the runtime's `active` flag.
+     */
+    wrongProxyUrl?: string | undefined;
 }
 //# sourceMappingURL=live-settings-input.d.ts.map

package/dist/proxy-wiring-G26YGP7S.js

@@ -0,0 +1,15 @@
+import {
+  applyWrongProxyPrefs,
+  awaitFirstWrongProxyProbe,
+  bootstrapWrongProxy,
+  shutdownWrongProxy
+} from "./chunk-AOAIPYFB.js";
+import "./chunk-GWVLRUVH.js";
+import "./chunk-7OCVIDC7.js";
+export {
+  applyWrongProxyPrefs,
+  awaitFirstWrongProxyProbe,
+  bootstrapWrongProxy,
+  shutdownWrongProxy
+};
+//# sourceMappingURL=proxy-wiring-G26YGP7S.js.map

package/dist/subcommands/contracts.d.ts

@@ -19,5 +19,12 @@ export interface SubcommandDeps {
     userHome: string;
     /** Parsed top-level flags after they have been removed from positional args. */
     flags?: Record<string, string | boolean>;
+    /**
+     * Live EventBus when a subcommand is invoked from a host that holds one
+     * (e.g. an in-process diagnostics surface). Standalone `wstack doctor`
+     * runs in a fresh process and has none — the handler then omits the
+     * listener-pressure line instead of fabricating counts.
+     */
+    events?: import('@wrongstack/core/kernel').EventBus | undefined;
 }
 //# sourceMappingURL=contracts.d.ts.map

package/dist/subcommands/handlers/diag-doctor.d.ts

@@ -1,4 +1,18 @@
 import type { SubcommandHandler } from '../contracts.js';
 export declare const diagCmd: SubcommandHandler;
+/**
+ * `wstack proxy-status` — print the live in-process `ProxyConfig` singleton.
+ *
+ * A fresh `wstack` invocation has never booted the WS prefs pipeline that
+ * the long-running session uses to populate the singleton, so reading
+ * `getProxyConfig()` raw here would always return the module default
+ * (`enabled=false, url='', active=false`) regardless of what's on disk
+ * or whether the daemon is reachable. To answer "did the probe flip
+ * active=true?" we seed the singleton from persisted prefs (`config.tools
+ * .wrongProxy`), start a one-shot probe, await its first poke, and only
+ * then read state. `startProxyProbe()` is idempotent so this is safe to
+ * call from a subcommand that has no other runtime side-effects.
+ */
+export declare const proxyCmd: SubcommandHandler;
 export declare const doctorCmd: SubcommandHandler;
 //# sourceMappingURL=diag-doctor.d.ts.map

package/dist/{update-RATFF63M.js → update-ZXNC6I6G.js}

@@ -3,7 +3,7 @@ import {
   detectUpdatePackageName,
   runUpdateCommand,
   updateCmd
-} from "./chunk-63GFD62R.js";
+} from "./chunk-4S52MIIM.js";
 import "./chunk-U3SS4NRH.js";
 import "./chunk-NUIHRGPY.js";
 import "./chunk-7OCVIDC7.js";
@@ -13,4 +13,4 @@ export {
   runUpdateCommand,
   updateCmd
 };
-//# sourceMappingURL=update-RATFF63M.js.map
+//# sourceMappingURL=update-ZXNC6I6G.js.map

package/dist/webui-server/prefs-seeding.d.ts

@@ -18,6 +18,10 @@ interface CliWebUIOptions {
         fallbackAuto?: boolean | undefined;
         modelMatrix?: Config['modelMatrix'] | undefined;
         uiLocale?: string | undefined;
+        /** WrongProxy / WrongTrace toggle. */
+        wrongProxyEnabled?: boolean | undefined;
+        /** WrongProxy / WrongTrace URL. Default: 'http://localhost:3444'. */
+        wrongProxyUrl?: string | undefined;
     } | undefined;
 }
 type PrefSnapshot = Record<string, unknown>;

package/dist/{webui-server-3DU6BVTB.js → webui-server-I53IYBW4.js}

@@ -746,6 +746,12 @@ function createPrefsSeeding(opts) {
     if (typeof payload["uiLocale"] === "string") {
       patchLiveAppConfig({ uiLocale: payload["uiLocale"] });
     }
+    if (typeof payload["wrongProxyEnabled"] === "boolean") {
+      patchLiveAppConfig({ wrongProxyEnabled: payload["wrongProxyEnabled"] });
+    }
+    if (typeof payload["wrongProxyUrl"] === "string") {
+      patchLiveAppConfig({ wrongProxyUrl: payload["wrongProxyUrl"] });
+    }
     if (payload["modelMatrix"] && typeof payload["modelMatrix"] === "object" && !Array.isArray(payload["modelMatrix"])) {
       patchLiveAppConfig({ modelMatrix: payload["modelMatrix"] });
     }
@@ -881,6 +887,7 @@ function createWebuiRouteContexts({
     persist: persistPrefs,
     setYolo: opts.onYoloSwitch,
     setAutonomy: opts.onAutonomySwitch,
+    applyWrongProxyPrefs: opts.onWrongProxyPrefsChange,
     pendingConfirms,
     configStore: opts.agent.container?.safeResolve?.(TOKENS2.ConfigStore),
     send,
@@ -1686,4 +1693,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-3DU6BVTB.js.map
+//# sourceMappingURL=webui-server-I53IYBW4.js.map

package/dist/webui-server-options.d.ts

@@ -205,6 +205,14 @@ export interface CliWebUIOptions {
     onAutonomySwitch?: ((mode: string) => void) | undefined;
     /** Forward browser YOLO changes to the host's live permission policy. */
     onYoloSwitch?: ((enabled: boolean) => void) | undefined;
+    /**
+     * Forward `wrongProxyEnabled` / `wrongProxyUrl` changes from the
+     * browser to the runtime probe (`@wrongstack/cli/wiring/proxy-wiring`).
+     * Mirrors the `onAutonomySwitch` / `onYoloSwitch` pattern: the WS
+     * server stays package-agnostic and the boot site provides the
+     * host-side effect.
+     */
+    onWrongProxyPrefsChange?: ((payload: Record<string, unknown>) => void) | undefined;
     /**
      * Pre-computed update info from the CLI's preflight version check.
      * When present, the session.start payload includes appVersion,

package/dist/wiring/provider-runtime.d.ts

@@ -42,6 +42,31 @@ export interface ResolvedProviderCfg {
     factoryType: string;
 }
 export declare function resolveProviderCfg(config: Pick<Config, 'providers' | 'apiKey' | 'baseUrl'>, providerId: string): ResolvedProviderCfg;
+/**
+ * Shared proxy-aware provider-config resolver.
+ *
+ * Three sites in this monorepo merge a saved provider config with the
+ * top-level Config and hand the result to a provider factory:
+ *
+ *   1. `packages/cli/src/wiring/provider-runtime.ts` `resolveProviderCfg()`
+ *      — used by `/model`, the fallback extension, and any other runtime
+ *        path that rebuilds a Provider from a saved-config alias.
+ *   2. `packages/cli/src/wiring/provider.ts` `setupProvider()` — the
+ *      boot-time setup path for the active session provider.
+ *   3. `packages/runtime/src/fleet/light-subagent-factory.ts` `buildProvider()`
+ *      — subagent provider construction for SDD runs.
+ *
+ * Each of those had to apply the same proxy rewrite. The duplication
+ * drifted: `provider.ts:154` was force-setting `type: config.provider`
+ * before the `factoryType` read at line 158, silently destroying any
+ * saved-alias `type` field (e.g. `minimax-coding-plan` mapped to
+ * `type: 'anthropic'`). The drift was caught by Chimera review; this
+ * helper is the single source of truth that prevents it from recurring.
+ *
+ * Inputs are intentionally `Pick<Config, ...>` (not the full Config) so
+ * this helper stays free of disk I/O and can be called from any layer.
+ */
+export declare function resolveProviderCfgWithProxy(config: Pick<Config, 'providers' | 'apiKey' | 'baseUrl'>, providerId: string): ResolvedProviderCfg;
 /**
  * Construct a credential-resolved Provider for a provider id, WITHOUT
  * persisting anything. Shared by the `/model` switch and the fallback