@wrongstack/cli 0.316.2 → 0.317.2

package/dist/{auth-GZ5A5OF5.js → auth-3OSF6BMU.js}

@@ -13,7 +13,7 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-32MTOI2I.js";
+} from "./chunk-YX6KUIDF.js";
 import {
   restoreFlags
 } from "./chunk-CSAPOCBP.js";
@@ -23,7 +23,7 @@ import {
 } from "./chunk-2VMJ3E5Z.js";
 import {
   parseAuthFlags
-} from "./chunk-T642Q732.js";
+} from "./chunk-L6ZNCTRJ.js";
 import "./chunk-B4JLSXZB.js";
 import "./chunk-VUVOMXWP.js";
 import {
@@ -596,4 +596,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-GZ5A5OF5.js.map
+//# sourceMappingURL=auth-3OSF6BMU.js.map

package/dist/{chunk-NZZOYLQ7.js → chunk-7JBKXVMK.js}

@@ -2843,8 +2843,8 @@ async function handleApiAgentMessages(req, res, match, agentMessages) {
 // src/hq-server/routes/system-handlers.ts
 async function handleApiSystemUpdate(res) {
   const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
-    import("./update-check-LICQNYFK.js"),
-    import("./update-XKARO3CY.js")
+    import("./update-check-PKSMSMD6.js"),
+    import("./update-K45CS6SS.js")
   ]);
   const packageName = detectUpdatePackageName();
   const info = await checkForUpdate({ packageName });
@@ -4914,4 +4914,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-NZZOYLQ7.js.map
+//# sourceMappingURL=chunk-7JBKXVMK.js.map

package/dist/{chunk-VXCCBI2W.js → chunk-DE7BZDNK.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-U3SS4NRH.js";
 import {
   checkForUpdate
-} from "./chunk-NV3JDK4F.js";
+} from "./chunk-YLQEGYV4.js";
 
 // src/subcommands/handlers/update.ts
 import { spawn } from "node:child_process";
@@ -383,4 +383,4 @@ export {
   detectUpdatePackageManager,
   detectUpdatePackageName
 };
-//# sourceMappingURL=chunk-VXCCBI2W.js.map
+//# sourceMappingURL=chunk-DE7BZDNK.js.map

package/dist/{chunk-T642Q732.js → chunk-L6ZNCTRJ.js}

@@ -215,31 +215,20 @@ function parseSpawnFlags(input) {
   };
   while (rest.length > 0) {
     let m;
-    m = consume(/^--provider=(\S+)\s*/);
+    m = consume(/^(?:--provider|-p)[=\s]+(\S+)\s*/);
     if (m) opts.provider = m[1];
     else {
-      m = consume(/^--model=(\S+)\s*/);
+      m = consume(/^(?:--model|-m)[=\s]+(\S+)\s*/);
       if (m) opts.model = m[1];
       else {
-        m = consume(/^--name=("([^"]+)"|(\S+))\s*/);
-        if (m) opts.name = m[2] ?? m[3];
+        m = consume(/^(?:--name|-n)[=\s]+(?:"([^"]+)"|'([^']+)'|(\S+))\s*/);
+        if (m) opts.name = m[1] ?? m[2] ?? m[3];
         else {
-          m = consume(/^--tools=(\S+)\s*/);
-          if (m)
-            opts.tools = m[1]?.split(",").map((t) => t.trim()).filter(Boolean);
-          else {
-            m = consume(/^-p\s+(\S+)\s*/);
-            if (m) opts.provider = m[1];
-            else {
-              m = consume(/^-m\s+(\S+)\s*/);
-              if (m) opts.model = m[1];
-              else {
-                m = consume(/^-n\s+("([^"]+)"|(\S+))\s*/);
-                if (m) opts.name = m[2] ?? m[3];
-                else break;
-              }
-            }
-          }
+          m = consume(/^(?:--tools|-t)[=\s]+(?:"([^"]+)"|'([^']+)'|(\S+))\s*/);
+          if (m) {
+            const rawTools = m[1] ?? m[2] ?? m[3] ?? "";
+            opts.tools = rawTools.split(",").map((t) => t.trim()).filter(Boolean);
+          } else break;
         }
       }
     }
@@ -1075,4 +1064,4 @@ export {
   runLiveProviderPicker,
   runPicker
 };
-//# sourceMappingURL=chunk-T642Q732.js.map
+//# sourceMappingURL=chunk-L6ZNCTRJ.js.map

package/dist/{chunk-NV3JDK4F.js → chunk-YLQEGYV4.js}

@@ -5,7 +5,7 @@ import { createRequire } from "node:module";
 import * as os from "node:os";
 import * as path from "node:path";
 import { FetchError } from "@wrongstack/core/types";
-import { resolveWstackPaths } from "@wrongstack/core/utils";
+import { atomicWrite, ensureDir, resolveWstackPaths } from "@wrongstack/core/utils";
 var defaultHomeDir = () => os.homedir();
 function npmRegistryUrl(packageName) {
   return `https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`;
@@ -87,9 +87,9 @@ async function readCache(homeFn = defaultHomeDir, packageName = "wrongstack") {
 }
 async function writeCache(entry, homeFn = defaultHomeDir) {
   try {
-    const dir = path.dirname(cachePath(homeFn));
-    await fs.mkdir(dir, { recursive: true });
-    await fs.writeFile(cachePath(homeFn), JSON.stringify(entry, null, 2), "utf8");
+    const file = cachePath(homeFn);
+    await ensureDir(path.dirname(file));
+    await atomicWrite(file, JSON.stringify(entry, null, 2));
   } catch {
   }
 }
@@ -173,4 +173,4 @@ export {
   checkForUpdate,
   getUpdateNotification
 };
-//# sourceMappingURL=chunk-NV3JDK4F.js.map
+//# sourceMappingURL=chunk-YLQEGYV4.js.map

package/dist/{chunk-32MTOI2I.js → chunk-YX6KUIDF.js}

@@ -1,7 +1,7 @@
 import {
   LOCAL_LLM_PRESETS,
   runLiveProviderPicker
-} from "./chunk-T642Q732.js";
+} from "./chunk-L6ZNCTRJ.js";
 import {
   openBrowser,
   runCodexOAuthLogin,
@@ -1374,4 +1374,4 @@ export {
   addCustomProvider,
   addKeyForProvider
 };
-//# sourceMappingURL=chunk-32MTOI2I.js.map
+//# sourceMappingURL=chunk-YX6KUIDF.js.map

package/dist/{cli-main-IEAM6SK7.js → cli-main-ILRTNPDP.js}

@@ -75,7 +75,7 @@ import {
 } from "./chunk-U3SS4NRH.js";
 import {
   checkForUpdate
-} from "./chunk-NV3JDK4F.js";
+} from "./chunk-YLQEGYV4.js";
 import {
   CLI_VERSION
 } from "./chunk-XJXDOF63.js";
@@ -96,11 +96,11 @@ import {
   runClaudeOAuthLogin,
   runCopilotOAuthLogin,
   validateFamily
-} from "./chunk-32MTOI2I.js";
+} from "./chunk-YX6KUIDF.js";
 import {
   LOCAL_LLM_PRESETS,
   parseSpawnFlags
-} from "./chunk-T642Q732.js";
+} from "./chunk-L6ZNCTRJ.js";
 import {
   appendHistory
 } from "./chunk-B4JLSXZB.js";
@@ -1241,6 +1241,7 @@ import {
 } from "@wrongstack/core/agent-catalog";
 import {
   AdaptiveConcurrencyController,
+  areSubagentsAllowedForSession as areSubagentsAllowedForSession2,
   DEFAULT_MAX_FLEET_SPAWNS as DEFAULT_MAX_FLEET_SPAWNS2,
   Director,
   FLEET_ROSTER as FLEET_ROSTER2,
@@ -1979,6 +1980,9 @@ function createHostExploreCompanion(input) {
   const template = roster[DEFAULT_EXPLORE_COMPANION_AGENT_ID];
   let residentId;
   const ensureResident = async () => {
+    if (input.subagentsAllowed?.() === false) {
+      throw new Error("Subagents are disabled for this session.");
+    }
     if (residentId) {
       const alive = director.status().subagents.some((s) => s.id === residentId);
       if (alive) return residentId;
@@ -2378,6 +2382,9 @@ function applyFleetRootDefaults(opts) {
   }
 }
 
+// src/fleet/host-shadow-manager.ts
+import { areSubagentsAllowedForSession } from "@wrongstack/core/coordination";
+
 // src/fleet/host-shadow-pass.ts
 async function runHostShadowPass(ctx, reason) {
   try {
@@ -2652,6 +2659,7 @@ var HostShadowManager = class {
     const director = this.ctx.getDirector();
     if (!director) return;
     const id = this.resolve(sessionId);
+    if (!areSubagentsAllowedForSession(id)) return;
     const state = this.stateFor(id);
     if (state.passInFlight || state.agentId && this.isActiveSubagent(state.agentId)) {
       state.queuedProblem = state.queuedProblem ? `${state.queuedProblem}; ${reason}` : reason;
@@ -3710,6 +3718,10 @@ function createHostFleetSupervisor(input) {
       retargetPendingTask: (taskId, subagentId) => director.retargetPendingTask(taskId, subagentId),
       spawnHelper: async ({ reason, task }) => {
         try {
+          const originSessionId = sessionOf(task?.subagentId);
+          if (input.subagentsAllowed?.(originSessionId) === false) {
+            return { error: "Subagents are disabled for this session." };
+          }
           const routed = await dispatchAgent(task?.description ?? reason, {
             classifier: director.dispatchClassifier
           });
@@ -3726,7 +3738,7 @@ function createHostFleetSupervisor(input) {
             systemPromptOverride: helperPrompt,
             // The helper drains a specific backlog, so it belongs to whoever
             // owns that work — not to the tab this host booted with.
-            originSessionId: sessionOf(task?.subagentId)
+            originSessionId
           });
           return { subagentId };
         } catch (err) {
@@ -3946,6 +3958,7 @@ var MultiAgentHost = class {
    * means the host's own session, which is the only one a CLI or TUI has.
    */
   async runShadowPass(reason, sessionId) {
+    if (!areSubagentsAllowedForSession2(sessionId ?? this.deps.session.id)) return;
     return this.shadowManager.runShadowPass(reason, sessionId);
   }
   async ensureCoordinator(_config) {
@@ -4038,12 +4051,15 @@ var MultiAgentHost = class {
         sessionId,
         mailboxProjectDir: this.mailboxProjectDir(),
         roster: this.roster,
-        config: config.fleet?.exploreCompanion
+        config: config.fleet?.exploreCompanion,
+        subagentsAllowed: () => areSubagentsAllowedForSession2(sessionId)
       }) : null
     });
     this.exploreCompanions.ensure(this.deps.session.id);
     this.exploreCompanionOff = this.deps.events.on("agent.run.started", (e) => {
-      if (e.sessionId) this.exploreCompanions?.ensure(e.sessionId);
+      if (e.sessionId && areSubagentsAllowedForSession2(e.sessionId)) {
+        this.exploreCompanions?.ensure(e.sessionId);
+      }
     });
     this.directorOffHandles.push(
       ...registerDirectorBudgetAndContextBridges({
@@ -4179,7 +4195,8 @@ var MultiAgentHost = class {
       sessionFor: (subagentId) => this.sessionForSubagent(subagentId),
       mailboxProjectDir: this.mailboxProjectDir(),
       roster: this.roster,
-      getLeaderMailboxId: this.opts.getLeaderMailboxId
+      getLeaderMailboxId: this.opts.getLeaderMailboxId,
+      subagentsAllowed: areSubagentsAllowedForSession2
     });
   }
   async reportTaskResultToLeader(n) {
@@ -4204,6 +4221,13 @@ var MultiAgentHost = class {
   async spawn(description, opts) {
     const isShadowSpawn = opts?.name === "shadow";
     const originSessionId = opts?.originSessionId ?? this.deps.session.id;
+    if (!areSubagentsAllowedForSession2(originSessionId)) {
+      throw new AgentError({
+        message: "Subagents are disabled for this session.",
+        code: "AGENT_RUN_FAILED",
+        context: { sessionId: originSessionId, phase: "subagentPolicy" }
+      });
+    }
     if (isShadowSpawn) this.shadowManager.enterShadowSpawn(originSessionId);
     try {
       await this.buildDirector();
@@ -4258,6 +4282,14 @@ var MultiAgentHost = class {
     return result;
   }
   async _spawnAndAssign(subagentConfig, description = "", opts) {
+    const originSessionId = subagentConfig.originSessionId ?? this.deps.session.id;
+    if (!areSubagentsAllowedForSession2(originSessionId)) {
+      throw new AgentError({
+        message: "Subagents are disabled for this session.",
+        code: "AGENT_RUN_FAILED",
+        context: { sessionId: originSessionId, phase: "subagentPolicy" }
+      });
+    }
     const taskId = randomUUID5();
     if (!this.director)
       throw new AgentError({
@@ -5678,7 +5710,7 @@ async function runCliExecution(params) {
     governanceHandle,
     setConfig
   } = params;
-  const { execute } = await import("./execution-TZUGCKFU.js");
+  const { execute } = await import("./execution-BN4QIFH6.js");
   return execute(
     toExecuteDeps({
       core: {
@@ -6902,7 +6934,10 @@ import { createReadStream } from "node:fs";
 import * as fs2 from "node:fs/promises";
 import * as path8 from "node:path";
 import { createInterface } from "node:readline";
-import { FLEET_ROSTER as FLEET_ROSTER4 } from "@wrongstack/core/coordination";
+import {
+  areSubagentsAllowedForSession as areSubagentsAllowedForSession3,
+  FLEET_ROSTER as FLEET_ROSTER4
+} from "@wrongstack/core/coordination";
 import { loadDirectorState } from "@wrongstack/core/storage";
 import { AgentError as AgentError2 } from "@wrongstack/core/types";
 import { color as color5, expectDefined as expectDefined2 } from "@wrongstack/core/utils";
@@ -6954,6 +6989,10 @@ ${color5.dim("\u2500".repeat(40))}` : "";
       }
     },
     onFleetSpawn: async (role) => {
+      const originSessionId = input.getSessionId();
+      if (!areSubagentsAllowedForSession3(originSessionId)) {
+        throw new Error("Subagents are disabled for this session.");
+      }
       const director = input.getDirector();
       if (!director) {
         throw new AgentError2({
@@ -6962,14 +7001,15 @@ ${color5.dim("\u2500".repeat(40))}` : "";
           context: { phase: "fleet-spawn", role }
         });
       }
-      return director.spawn(
-        FLEET_ROSTER4[role] ?? {
+      return director.spawn({
+        ...FLEET_ROSTER4[role] ?? {
           id: `manual-${Date.now()}`,
           name: role,
           maxIterations: 50,
           maxToolCalls: 200
-        }
-      );
+        },
+        originSessionId
+      });
     },
     onFleetLog: (subagentId, mode) => readFleetLog(input.fleetRoot, subagentId, mode),
     onFleetRetry: (taskId) => retryInterruptedTasks(input, taskId),
@@ -7296,6 +7336,10 @@ async function retryInterruptedTasks(input, taskId) {
   const targets = taskId === "all" ? interrupted : interrupted.filter((task) => task.taskId === taskId || task.taskId.startsWith(taskId));
   if (targets.length === 0) return `No interrupted task matched "${taskId}".`;
   const results = [];
+  const originSessionId = input.getSessionId();
+  if (!areSubagentsAllowedForSession3(originSessionId)) {
+    return "Subagents are disabled for this session.";
+  }
   for (const task of targets) {
     const owner = task.subagentId ? prior.subagents.find((subagent) => subagent.id === task.subagentId) : void 0;
     if (!owner) {
@@ -7310,7 +7354,7 @@ async function retryInterruptedTasks(input, taskId) {
       model: owner.model
     };
     try {
-      const subagentId = await director.spawn(config);
+      const subagentId = await director.spawn({ ...config, originSessionId });
       const newTaskId = await director.assign({
         id: "",
         description: task.description ?? "(no description)",
@@ -31658,7 +31702,10 @@ function setupCliSlashCommands(params) {
 }
 
 // src/wiring/command-host-state.ts
-import { FLEET_ROSTER as FLEET_ROSTER5 } from "@wrongstack/core/coordination";
+import {
+  areSubagentsAllowedForSession as areSubagentsAllowedForSession4,
+  FLEET_ROSTER as FLEET_ROSTER5
+} from "@wrongstack/core/coordination";
 import {
   AgentError as AgentError3,
   resolveFleetChatVerbosity as resolveFleetChatVerbosity2
@@ -31735,7 +31782,7 @@ async function setupCommandHostState(input) {
   input.hqCommandController.interruptLeader = () => interruptController.abortLeader();
   input.hqCommandController.killFleet = () => killFleet2(input.getDirector());
   input.hqCommandController.terminateAgent = (subagentId) => terminateAgent(input.getDirector(), subagentId);
-  input.hqCommandController.spawnAgent = (role, task, maxIterations) => spawnAgent2(input.getDirector(), role, task, maxIterations);
+  input.hqCommandController.spawnAgent = (role, task, maxIterations) => spawnAgent2(input.getDirector(), input.sessionRef.current?.id ?? input.session.id, role, task, maxIterations);
   const enhanceController = createEnhanceController(input.getConfig());
   const statuslineConfigDeps = createStatuslineConfigDeps();
   const hidden = await loadStatuslineHiddenItems();
@@ -31836,7 +31883,7 @@ async function terminateAgent(director, subagentId) {
     return false;
   }
 }
-async function spawnAgent2(director, role, task, maxIterations) {
+async function spawnAgent2(director, sessionId, role, task, maxIterations) {
   if (!director) {
     throw new AgentError3({
       message: "Director is not available.",
@@ -31844,6 +31891,9 @@ async function spawnAgent2(director, role, task, maxIterations) {
       context: { phase: "hq-spawn", role }
     });
   }
+  if (!areSubagentsAllowedForSession4(sessionId)) {
+    throw new Error("Subagents are disabled for this session.");
+  }
   const base = FLEET_ROSTER5[role] ?? {
     id: `manual-${Date.now()}`,
     name: role,
@@ -31851,7 +31901,7 @@ async function spawnAgent2(director, role, task, maxIterations) {
     maxToolCalls: 200
   };
   const config = task !== void 0 ? { ...base, task } : base;
-  return director.spawn(config);
+  return director.spawn({ ...config, originSessionId: sessionId });
 }
 
 // src/wiring/dep-watcher.ts
@@ -34609,6 +34659,10 @@ import { addFatalSalvageHook } from "@wrongstack/core/utils";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import * as path30 from "node:path";
 import { Context as Context2 } from "@wrongstack/core/agent";
+import {
+  restoreSessionSubagentPolicy,
+  seedSessionSubagentPolicy
+} from "@wrongstack/core/coordination";
 import { ProviderCacheLedger } from "@wrongstack/core/infrastructure";
 import {
   attachTodosCheckpoint,
@@ -34743,6 +34797,7 @@ async function setupSession(params) {
   let restoredMessages = [];
   let restoredToolCalls = [];
   let restoredEvents = [];
+  let restoredSubagentsAllowed;
   let resumedModel;
   let resumedProvider;
   if (resumeId) {
@@ -34762,6 +34817,7 @@ async function setupSession(params) {
       restoredMessages = resumed.data.messages;
       restoredToolCalls = resumed.data.toolCallEnds ?? [];
       restoredEvents = resumed.data.events ?? [];
+      restoredSubagentsAllowed = resumed.data.subagentsAllowed;
       resumedModel = resumed.data.metadata.model;
       resumedProvider = resumed.data.metadata.provider;
       if (resumed.data.usage) {
@@ -34826,6 +34882,9 @@ async function setupSession(params) {
     context.state.replaceMessages(restoredMessages);
     await context.flushConversationJournal();
   }
+  if (restoredEvents.length > 0 || restoredSubagentsAllowed !== void 0) {
+    restoreSessionSubagentPolicy(context, restoredEvents, restoredSubagentsAllowed);
+  } else seedSessionSubagentPolicy(context);
   const queueStore = new QueueStore({
     dir: sessionDir,
     ...eventsBus ? { events: eventsBus } : {},
@@ -36618,4 +36677,4 @@ export {
   CLI_VERSION,
   runInteractive
 };
-//# sourceMappingURL=cli-main-IEAM6SK7.js.map
+//# sourceMappingURL=cli-main-ILRTNPDP.js.map

package/dist/{execution-TZUGCKFU.js → execution-BN4QIFH6.js}

@@ -212,7 +212,7 @@ async function runWebUIDispatch(ctx) {
   const isSimpleUi = !isSessionChild && flags["simpleui"] === true;
   agent.disableInteractiveConfirmation();
   renderer.setSilent(true);
-  const { runWebUI } = await import("./webui-server-LZOEH7O6.js");
+  const { runWebUI } = await import("./webui-server-OJLLM6PE.js");
   const flagValue = (names) => {
     for (const name of names) {
       if (!Object.hasOwn(flags, name)) continue;
@@ -1010,6 +1010,7 @@ import {
   DefaultSystemPromptBuilder,
   setQueuedMessagesSnapshot
 } from "@wrongstack/core/agent";
+import { resetSessionSubagentPolicy } from "@wrongstack/core/coordination";
 import { TOKENS } from "@wrongstack/core/kernel";
 import { DefaultSessionStore } from "@wrongstack/core/storage";
 import {
@@ -1120,6 +1121,7 @@ async function switchProjectInPlace(ctx, targetRoot, displayName) {
   context.workingDir = resolved;
   context.session = nextWriter;
   context.state.replaceMessages([]);
+  resetSessionSubagentPolicy(context);
   context.state.replaceTodos([]);
   context.clearFileTracking();
   context.clearMemoryEvidence?.();
@@ -1252,6 +1254,7 @@ async function onSDDOutput(output) {
 
 // src/boot/tui-session-resume.ts
 import * as path7 from "node:path";
+import { restoreSessionSubagentPolicy } from "@wrongstack/core/coordination";
 import { attachTodosCheckpoint, loadTodosCheckpoint } from "@wrongstack/core/storage";
 import { projectLastRequestTokens } from "@wrongstack/core/types/session-timeline";
 import { sessionScopedPath as sessionScopedPath2 } from "@wrongstack/core/utils";
@@ -1420,6 +1423,7 @@ async function resumeSession(ctx, sessionId) {
     agent.ctx.session = resumed.writer;
     try {
       agent.ctx.state.replaceMessages(resumed.data.messages);
+      restoreSessionSubagentPolicy(agent.ctx, resumed.data.events, resumed.data.subagentsAllowed);
     } catch (err) {
       agent.ctx.session = oldWriter;
       agent.ctx.state.replaceMessages(oldMessages);
@@ -3911,6 +3915,9 @@ function errorText2(error) {
 import { randomUUID as randomUUID3 } from "node:crypto";
 import path12 from "node:path";
 import { effectiveFallbackChain, fallbackProfileChain as fallbackProfileChain2 } from "@wrongstack/core/agent";
+import {
+  areSubagentsAllowedForSession
+} from "@wrongstack/core/coordination";
 import {
   CHIMERA_REVIEW_PROMPT,
   classifyChimeraReviewSource,
@@ -3944,6 +3951,10 @@ function installChimeraReviewHandler({
   const off = events.onPattern("chimera.review_needed", (_event, payload) => {
     const p = payload;
     const reviewSessionId = agent.ctx.activeRunSessionId ?? agent.ctx.session?.id ?? session.id;
+    if (!areSubagentsAllowedForSession(reviewSessionId)) {
+      void recordCompletedReview(events, { bundle: p }).catch(() => void 0);
+      return;
+    }
     const dir = director;
     if (!dir) {
       void recordCompletedReview(events, { bundle: p }).catch(() => void 0);
@@ -6687,4 +6698,4 @@ export {
   execute,
   resolveReviewerFallbackModels
 };
-//# sourceMappingURL=execution-TZUGCKFU.js.map
+//# sourceMappingURL=execution-BN4QIFH6.js.map

package/dist/execution-chimera-review.d.ts

@@ -1,4 +1,4 @@
-import type { ProviderModelStatusTracker } from '@wrongstack/core/coordination';
+import { type ProviderModelStatusTracker } from '@wrongstack/core/coordination';
 import { type ChimeraReviewCompletePayload } from '@wrongstack/core/plugin';
 import type { ExecuteDeps } from './execute-deps.js';
 type Director = NonNullable<ExecuteDeps['fleet']['director']>;

package/dist/fleet/host-explore-companion.d.ts

@@ -41,6 +41,7 @@ interface HostExploreCompanionInput {
     mailboxProjectDir: string;
     roster: Record<string, SubagentConfig>;
     config?: HostExploreCompanionConfig | undefined;
+    subagentsAllowed?: (() => boolean) | undefined;
 }
 export declare function createHostExploreCompanion(input: HostExploreCompanionInput): ExploreCompanion | null;
 export {};

package/dist/fleet/host-shadow-manager.d.ts

@@ -38,7 +38,7 @@
  * @module fleet/host-shadow-manager
  */
 import type { SubagentConfig } from '@wrongstack/core/types';
-import type { Director } from '@wrongstack/core/coordination';
+import { type Director } from '@wrongstack/core/coordination';
 import type { MultiAgentDeps, MultiAgentHostOptions } from './host-types.js';
 interface HostShadowManagerContext {
     deps: MultiAgentDeps;

package/dist/fleet/host-supervisor.d.ts

@@ -20,6 +20,7 @@ interface HostFleetSupervisorInput {
     mailboxProjectDir: string;
     roster: Record<string, SubagentConfig>;
     getLeaderMailboxId?: (() => string | undefined) | undefined;
+    subagentsAllowed?: ((sessionId: string) => boolean) | undefined;
 }
 export declare function createHostFleetSupervisor(input: HostFleetSupervisorInput): FleetSupervisor | null;
 export {};

package/dist/{hq-NDTJRRX3.js → hq-3GWBFLON.js}

@@ -51,7 +51,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-OH3SPSE2.js");
+  const { startHqServer } = await import("./hq-server-OARPUSQJ.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const host = typeof flags["host"] === "string" ? flags["host"] : HQ_CLI_DEFAULT_HOST;
@@ -709,4 +709,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-NDTJRRX3.js.map
+//# sourceMappingURL=hq-3GWBFLON.js.map

package/dist/{hq-server-OH3SPSE2.js → hq-server-OARPUSQJ.js}

@@ -10,7 +10,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-NZZOYLQ7.js";
+} from "./chunk-7JBKXVMK.js";
 import "./chunk-HXJYHAR4.js";
 import "./chunk-Q5GTM25S.js";
 import "./chunk-7OCVIDC7.js";
@@ -27,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-OH3SPSE2.js.map
+//# sourceMappingURL=hq-server-OARPUSQJ.js.map

package/dist/index.js

@@ -23,12 +23,12 @@ import {
 } from "./chunk-52C7PD2H.js";
 import {
   runUpdateCommand
-} from "./chunk-VXCCBI2W.js";
+} from "./chunk-DE7BZDNK.js";
 import "./chunk-U3SS4NRH.js";
-import "./chunk-NV3JDK4F.js";
+import "./chunk-YLQEGYV4.js";
 import {
   DEFAULT_PORT
-} from "./chunk-NZZOYLQ7.js";
+} from "./chunk-7JBKXVMK.js";
 import "./chunk-HXJYHAR4.js";
 import "./chunk-Q5GTM25S.js";
 import {
@@ -45,7 +45,7 @@ import {
   parseArgs,
   runPicker,
   saveToGlobalConfig
-} from "./chunk-T642Q732.js";
+} from "./chunk-L6ZNCTRJ.js";
 import "./chunk-B4JLSXZB.js";
 import {
   isKeylessLocalProvider,
@@ -1867,8 +1867,8 @@ var subcommandsWithFocusedHelp = Object.keys(helpTable);
 var loaders = {
   acp: async () => (await import("./acp-CEQINXWB.js")).acpCmd,
   init: async () => (await import("./init-4JQSG66Q.js")).initCmd,
-  auth: async () => (await import("./auth-GZ5A5OF5.js")).authCmd,
-  update: async () => (await import("./update-XKARO3CY.js")).updateCmd,
+  auth: async () => (await import("./auth-3OSF6BMU.js")).authCmd,
+  update: async () => (await import("./update-K45CS6SS.js")).updateCmd,
   sessions: async () => (await import("./sessions-config-P2LK2L32.js")).sessionsCmd,
   config: async () => (await import("./sessions-config-P2LK2L32.js")).configCmd,
   rewind: async () => (await import("./rewind-2FFNOOKS.js")).rewindCmd,
@@ -1893,7 +1893,7 @@ var loaders = {
   quick: async () => (await import("./quick-XLYLZX4B.js")).quickCmd,
   bench: async () => (await import("./bench-XYG56AMO.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-6EPPMUC5.js")).chronicleCmd,
-  hq: async () => (await import("./hq-NDTJRRX3.js")).hqCmd,
+  hq: async () => (await import("./hq-3GWBFLON.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-VKQIRCCB.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-2PWBL4YU.js")).permissionsCmd,
   project: async () => (await import("./project-BLQ3ALVL.js")).projectCmd,
@@ -1972,7 +1972,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-OH3SPSE2.js");
+  const { startHqServer } = await import("./hq-server-OARPUSQJ.js");
   const tunnelRequested = flags["tunnel"] === true;
   const host = typeof flags["host"] === "string" ? flags["host"] : tunnelRequested ? "127.0.0.1" : HQ_CLI_DEFAULT_HOST2;
   if (tunnelRequested && !isLoopbackHost(host)) {
@@ -4224,7 +4224,7 @@ async function printUpdateNotice(initialUpdateInfo) {
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), 2e3);
     try {
-      const { checkForUpdate } = await import("./update-check-LICQNYFK.js");
+      const { checkForUpdate } = await import("./update-check-PKSMSMD6.js");
       info = await checkForUpdate(ac.signal);
     } catch {
     } finally {
@@ -4444,7 +4444,7 @@ async function initializeCli(argv) {
 async function main(argv) {
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-IEAM6SK7.js");
+  const { runInteractive } = await import("./cli-main-ILRTNPDP.js");
   return runInteractive(cliCtx);
 }
 

package/dist/{update-XKARO3CY.js → update-K45CS6SS.js}

@@ -3,9 +3,9 @@ import {
   detectUpdatePackageName,
   runUpdateCommand,
   updateCmd
-} from "./chunk-VXCCBI2W.js";
+} from "./chunk-DE7BZDNK.js";
 import "./chunk-U3SS4NRH.js";
-import "./chunk-NV3JDK4F.js";
+import "./chunk-YLQEGYV4.js";
 import "./chunk-7OCVIDC7.js";
 export {
   detectUpdatePackageManager,
@@ -13,4 +13,4 @@ export {
   runUpdateCommand,
   updateCmd
 };
-//# sourceMappingURL=update-XKARO3CY.js.map
+//# sourceMappingURL=update-K45CS6SS.js.map

package/dist/{update-check-LICQNYFK.js → update-check-PKSMSMD6.js}

@@ -5,7 +5,7 @@ import {
   fetchLatestFromNpm,
   getUpdateNotification,
   isNewer
-} from "./chunk-NV3JDK4F.js";
+} from "./chunk-YLQEGYV4.js";
 import "./chunk-7OCVIDC7.js";
 export {
   cachePath,
@@ -15,4 +15,4 @@ export {
   getUpdateNotification,
   isNewer
 };
-//# sourceMappingURL=update-check-LICQNYFK.js.map
+//# sourceMappingURL=update-check-PKSMSMD6.js.map

package/dist/{webui-server-LZOEH7O6.js → webui-server-OJLLM6PE.js}

@@ -830,6 +830,10 @@ function createPrefsSeeding(opts) {
 
 // src/webui-server/route-contexts.ts
 import * as path5 from "node:path";
+import {
+  seedSessionSubagentPolicy,
+  setSessionSubagentsAllowed
+} from "@wrongstack/core/coordination";
 import { TOKENS as TOKENS2 } from "@wrongstack/core/kernel";
 import { SkillInstaller } from "@wrongstack/core/skills";
 import { PromptUsageStore } from "@wrongstack/core/storage";
@@ -946,7 +950,15 @@ function createWebuiRouteContexts({
   const prefsCtx = {
     meta: opts.agent.ctx.meta,
     metaFor: metaForSession,
-    snapshot: (sessionId) => prefSnapshot(sessionId ? metaForSession(sessionId) : void 0),
+    snapshot: (sessionId) => {
+      const target = sessionId ? getSessionAgent(sessionId).ctx : opts.agent.ctx;
+      seedSessionSubagentPolicy(target);
+      return prefSnapshot(target.meta);
+    },
+    setSubagentsAllowed: (allowed, sessionId) => setSessionSubagentsAllowed(
+      sessionId ? getSessionAgent(sessionId).ctx : opts.agent.ctx,
+      allowed
+    ),
     persist: persistPrefs,
     setYolo: opts.onYoloSwitch,
     setAutonomy: opts.onAutonomySwitch,
@@ -1898,4 +1910,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-LZOEH7O6.js.map
+//# sourceMappingURL=webui-server-OJLLM6PE.js.map

package/dist/wiring/command-host-state.d.ts

@@ -1,5 +1,5 @@
 /** Mutable command-host state created after the runtime fleet is available. */
-import type { BrainArbiter, Director } from '@wrongstack/core/coordination';
+import { type BrainArbiter, type Director } from '@wrongstack/core/coordination';
 import type { EventBus } from '@wrongstack/core/kernel';
 import { type Config, type SessionWriter } from '@wrongstack/core/types';
 import type { WstackPaths } from '@wrongstack/core/utils';

package/dist/wiring/fleet-command-handlers.d.ts

@@ -1,4 +1,4 @@
-import type { Director } from '@wrongstack/core/coordination';
+import { type Director } from '@wrongstack/core/coordination';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { MultiAgentHost } from '../multi-agent.js';
 import type { BuiltinSlashCommandDeps } from './slash-commands.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "0.316.2",
+  "version": "0.317.2",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -41,36 +41,36 @@
     "data"
   ],
   "dependencies": {
-    "@wrongstack/acp": "0.316.2",
-    "@wrongstack/bench": "0.316.2",
-    "@wrongstack/core": "0.316.2",
-    "@wrongstack/primitives": "0.316.2",
-    "@wrongstack/kanban": "0.316.2",
-    "@wrongstack/mcp": "0.316.2",
-    "@wrongstack/persistence": "0.316.2",
-    "@wrongstack/plug-lsp": "0.316.2",
-    "@wrongstack/plugins": "0.316.2",
-    "@wrongstack/providers": "0.316.2",
-    "@wrongstack/requirement-intake": "0.316.2",
-    "@wrongstack/runtime": "0.316.2",
-    "@wrongstack/sage": "0.316.2",
-    "@wrongstack/sdd": "0.316.2",
-    "@wrongstack/security-scanner": "0.316.2",
-    "@wrongstack/simpleui": "0.316.2",
-    "@wrongstack/techstack": "0.316.2",
-    "@wrongstack/telegram": "0.316.2",
-    "@wrongstack/tools": "0.316.2",
-    "@wrongstack/tui": "0.316.2",
-    "@wrongstack/vector-memory": "0.316.2",
-    "@wrongstack/webui": "0.316.2",
-    "@wrongstack/webui-hq": "0.316.2",
-    "@wrongstack/webui-protocol": "0.316.2",
-    "@wrongstack/wrongtrace": "0.316.2",
-    "@wrongstack/webui-server": "0.316.2",
+    "@wrongstack/acp": "0.317.2",
+    "@wrongstack/bench": "0.317.2",
+    "@wrongstack/core": "0.317.2",
+    "@wrongstack/primitives": "0.317.2",
+    "@wrongstack/kanban": "0.317.2",
+    "@wrongstack/mcp": "0.317.2",
+    "@wrongstack/persistence": "0.317.2",
+    "@wrongstack/plug-lsp": "0.317.2",
+    "@wrongstack/plugins": "0.317.2",
+    "@wrongstack/providers": "0.317.2",
+    "@wrongstack/requirement-intake": "0.317.2",
+    "@wrongstack/runtime": "0.317.2",
+    "@wrongstack/sage": "0.317.2",
+    "@wrongstack/sdd": "0.317.2",
+    "@wrongstack/security-scanner": "0.317.2",
+    "@wrongstack/simpleui": "0.317.2",
+    "@wrongstack/techstack": "0.317.2",
+    "@wrongstack/telegram": "0.317.2",
+    "@wrongstack/tools": "0.317.2",
+    "@wrongstack/tui": "0.317.2",
+    "@wrongstack/vector-memory": "0.317.2",
+    "@wrongstack/webui": "0.317.2",
+    "@wrongstack/webui-hq": "0.317.2",
+    "@wrongstack/webui-protocol": "0.317.2",
+    "@wrongstack/wrongtrace": "0.317.2",
+    "@wrongstack/webui-server": "0.317.2",
     "ws": "^8.21.3"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "0.316.2"
+    "@wrongstack/desktop": "0.317.2"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",