@wrongstack/cli 0.318.0 → 0.319.0

package/data/providers.json

@@ -255,28 +255,7 @@
       }
     }
   },
-  "_removeProviders": [
-    "anthropic",
-    "google",
-    "mistral",
-    "openrouter",
-    "perplexity",
-    "groq",
-    "xai",
-    "cerebras",
-    "togetherai",
-    "deepinfra",
-    "fireworks",
-    "replicate",
-    "cohere",
-    "ai21",
-    "huggingface",
-    "together",
-    "novita",
-    "lepton",
-    "sambanova",
-    "watsonx"
-  ],
+  "_removeProviders": [],
   "_removeModels": {
     "openai": ["gpt-4o-mini", "gpt-4o", "gpt-4", "gpt-4-turbo", "o1", "o1-mini", "o3-mini"],
     "deepseek": ["deepseek-chat", "deepseek-reasoner", "deepseek-v3.2", "deepseek-v4-flash"]

package/dist/{acp-CEQINXWB.js → acp-5ANIAOZC.js}

@@ -3,9 +3,9 @@ import {
   loadCachedAcpRegistry,
   refreshAcpRegistry,
   setupProvider
-} from "./chunk-37SPPLUD.js";
-import "./chunk-QYIIOMLE.js";
-import "./chunk-BXFYBQKR.js";
+} from "./chunk-F5GA2QW2.js";
+import "./chunk-E4I2TF5S.js";
+import "./chunk-XPX432BZ.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/acp.ts
@@ -913,4 +913,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-CEQINXWB.js.map
+//# sourceMappingURL=acp-5ANIAOZC.js.map

package/dist/arg-parser.d.ts

@@ -35,6 +35,10 @@ interface SpawnFlags {
  *   --name=<label>  / -n <label> display name
  *   --tools=a,b,c               restrict the subagent's tool slice
  *
+ * All four value flags accept quoted values (`--model="gpt-4o"`); the
+ * surrounding quotes are stripped. Without this, a habitually quoted id
+ * flows into multiAgentHost.spawn() with the quote characters embedded.
+ *
  * Anything after the last flag is the task description.
  */
 export declare function parseSpawnFlags(input: string): SpawnFlags;

package/dist/{auth-3OSF6BMU.js → auth-KF5TAD7V.js}

@@ -13,23 +13,23 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-YX6KUIDF.js";
-import {
-  restoreFlags
-} from "./chunk-CSAPOCBP.js";
+} from "./chunk-XHIEA6LG.js";
 import {
   renderAuthLocalHelpToString,
   wantsLocalHelp
 } from "./chunk-2VMJ3E5Z.js";
-import {
-  parseAuthFlags
-} from "./chunk-L6ZNCTRJ.js";
 import "./chunk-B4JLSXZB.js";
 import "./chunk-VUVOMXWP.js";
+import {
+  restoreFlags
+} from "./chunk-CSAPOCBP.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
-import "./chunk-QYIIOMLE.js";
+import {
+  parseAuthFlags
+} from "./chunk-GGGUZSAU.js";
+import "./chunk-E4I2TF5S.js";
 import {
   loadConfigProviders,
   maskedKey,
@@ -37,7 +37,7 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-BXFYBQKR.js";
+} from "./chunk-XPX432BZ.js";
 import "./chunk-7OCVIDC7.js";
 
 // src/subcommands/handlers/auth.ts
@@ -596,4 +596,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-3OSF6BMU.js.map
+//# sourceMappingURL=auth-KF5TAD7V.js.map

package/dist/{chunk-GKHUHAIK.js → chunk-42JD25KU.js}

@@ -1,10 +1,10 @@
-import {
-  PLUGIN_AUDIT_ENTRIES,
-  loadExternalPlugins
-} from "./chunk-QC5I4VWZ.js";
 import {
   patchConfig
 } from "./chunk-TYO2OVAD.js";
+import {
+  PLUGIN_AUDIT_ENTRIES,
+  loadExternalPlugins
+} from "./chunk-H7GABTGS.js";
 
 // src/wiring/plugins.ts
 import { join } from "node:path";
@@ -261,4 +261,4 @@ export {
   BUILTIN_PLUGIN_FACTORIES,
   setupPlugins
 };
-//# sourceMappingURL=chunk-GKHUHAIK.js.map
+//# sourceMappingURL=chunk-42JD25KU.js.map

package/dist/{chunk-QYIIOMLE.js → chunk-E4I2TF5S.js}

@@ -3,7 +3,7 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-BXFYBQKR.js";
+} from "./chunk-XPX432BZ.js";
 
 // src/auth-menu/openai-codex-oauth.ts
 import { color } from "@wrongstack/core/utils";
@@ -259,4 +259,4 @@ export {
   filterCurrentCodexModelIds,
   isCodexCatalogModel
 };
-//# sourceMappingURL=chunk-QYIIOMLE.js.map
+//# sourceMappingURL=chunk-E4I2TF5S.js.map

package/dist/{chunk-37SPPLUD.js → chunk-F5GA2QW2.js}

@@ -2,7 +2,7 @@ import {
   fallbackCodexProviderModels,
   filterCurrentCodexModelIds,
   isCodexCatalogModel
-} from "./chunk-QYIIOMLE.js";
+} from "./chunk-E4I2TF5S.js";
 
 // src/acp-registry-cache.ts
 import * as fs from "node:fs/promises";
@@ -168,12 +168,24 @@ import { ConfigError } from "@wrongstack/core/types";
 import {
   buildProviderFactoriesFromRegistry,
   createAiGatewayProviderFactory,
+  createSetupProviderFactory,
   installCatalogModelOutputLimits,
+  isSetupProvider,
   makeProviderFromConfig as makeProviderFromConfig2,
+  setupProviderResolved,
   withCatalogCapabilities
 } from "@wrongstack/providers";
 async function setupProvider(params) {
   const { config, modelsRegistry, logger } = params;
+  if (isSetupProvider(config.provider)) {
+    const providerRegistry2 = new ProviderRegistry();
+    providerRegistry2.register(createSetupProviderFactory());
+    return {
+      resolvedProvider: setupProviderResolved(),
+      provider: providerRegistry2.create({ type: config.provider }),
+      providerRegistry: providerRegistry2
+    };
+  }
   const savedProviderCfg = config.providers?.[config.provider];
   let resolvedProvider = await modelsRegistry.getProvider(config.provider).catch(() => void 0);
   if (!resolvedProvider && savedProviderCfg?.type && savedProviderCfg.type !== config.provider) {
@@ -234,6 +246,7 @@ async function setupProvider(params) {
   }
   const providerRegistry = new ProviderRegistry();
   providerRegistry.register(createAiGatewayProviderFactory());
+  providerRegistry.register(createSetupProviderFactory());
   if (config.features.modelsRegistry) {
     try {
       const factories = await buildProviderFactoriesFromRegistry({
@@ -294,4 +307,4 @@ export {
   setupProvider,
   createGracefulShutdown
 };
-//# sourceMappingURL=chunk-37SPPLUD.js.map
+//# sourceMappingURL=chunk-F5GA2QW2.js.map

package/dist/chunk-GGGUZSAU.js

@@ -0,0 +1,235 @@
+
+// src/arg-parser.ts
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+  "yolo",
+  "no-yolo",
+  "yolo-destructive",
+  "confirm-destructive",
+  "force-all-yolo",
+  "verbose",
+  "trace",
+  "help",
+  "version",
+  "yes",
+  "no-banner",
+  "no-features",
+  "tui",
+  "no-tui",
+  // Recovery switches. `--recover` reopens the most recent session with no
+  // trailing `session_end` (see wiring/resume-candidate.ts); `--no-recovery`
+  // suppresses it, so a launch script that passes both still starts fresh.
+  // Both are boolean so they cannot swallow the next positional token.
+  "no-recovery",
+  "recover",
+  "output-json",
+  "prompt",
+  "metrics",
+  "webui",
+  "webui-session-child",
+  "simpleui",
+  "full-auto",
+  "desktop",
+  "open",
+  "webui-require-token",
+  "require-token",
+  "no-check",
+  "no-models-refresh",
+  // (removed: 'director' and 'no-director' — Director Mode is always on)
+  "no-autonomy",
+  "no-hints",
+  "hints",
+  "no-menu",
+  "no-hooks",
+  "skip",
+  "skip-index",
+  "mouse",
+  "no-interactive",
+  "token-saving-mode",
+  "system-lite",
+  "system-pro",
+  "hq",
+  "hq-allow-exec",
+  "tunnel",
+  // Opt-in to a non-loopback HQ bind with no token/password configured.
+  "insecure-open",
+  "strict-port",
+  "client",
+  // `wstack doctor` booleans. Without these, `--daemons --clear-stale` parses
+  // as `daemons="--clear-stale"` and the second flag disappears.
+  "daemons",
+  "clear-stale",
+  // `wstack update` booleans. Keeping these here prevents parseArgs from
+  // consuming a following positional token as an accidental flag value.
+  "check-only",
+  "allow-scripts",
+  "lifecycle-scripts",
+  "npm",
+  "pnpm",
+  "yarn",
+  "bun",
+  // `wstack acp` booleans. Without these, parseArgs treats the value after
+  // `--fs`/`--echo` as the flag's value and eats a following positional
+  // (e.g. the agent list in `acp bench --fs gemini-cli,codex-cli`).
+  "echo",
+  "fs",
+  // `wstack modeldiag test` booleans. Keep a following positional token from
+  // being consumed as the value of one of these switches.
+  "all-models",
+  "plan",
+  "json",
+  // Destructive-preview switch (`wstack chronicle prune --dry-run`). It is
+  // boolean at every call site, and leaving it out let it consume the next
+  // positional — on a command whose whole purpose is to NOT delete.
+  "dry-run",
+  // Subcommand booleans. A boolean flag missing from this set makes `parseArgs`
+  // swallow the FOLLOWING positional as its value (`rewind --all sess123` lost
+  // the session id, `export --no-tools out.md` lost the output path), on top of
+  // the handler never seeing the flag at all.
+  "all",
+  "list",
+  "latest",
+  "disabled",
+  "enable",
+  "no-tools",
+  "no-diagnostics",
+  "unsupported",
+  "ws",
+  "force",
+  "no-browser",
+  // `wstack auth local` booleans
+  "no-key",
+  "skip-key",
+  "no-probe",
+  "skip-probe",
+  "probe-only",
+  // `wstack models add` capability toggles
+  "tools",
+  "vision",
+  "no-vision",
+  "reasoning",
+  "no-reasoning",
+  "streaming",
+  "no-streaming",
+  "json-mode",
+  "no-json-mode"
+]);
+function parseArgs(argv) {
+  const flags = {};
+  const positional = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (!a) continue;
+    if (a === "--") {
+      positional.push(...argv.slice(i + 1));
+      break;
+    }
+    if (a.startsWith("--")) {
+      const eq = a.indexOf("=");
+      if (eq !== -1) {
+        flags[a.slice(2, eq)] = a.slice(eq + 1);
+        continue;
+      }
+      const name = a.slice(2);
+      if (BOOLEAN_FLAGS.has(name)) {
+        flags[name] = true;
+        continue;
+      }
+      if (i + 1 < argv.length && !(argv[i + 1] ?? "").startsWith("-")) {
+        flags[name] = argv[++i] ?? "";
+      } else {
+        flags[name] = true;
+      }
+    } else if (a.startsWith("-") && a.length === 2) {
+      const short = a.slice(1);
+      const expand = { v: "verbose", y: "yes", h: "help" };
+      flags[expand[short] ?? short] = true;
+    } else {
+      positional.push(a);
+    }
+  }
+  normalizeSurfaceAliases(flags, positional);
+  return { flags, positional };
+}
+function normalizeSurfaceAliases(flags, positional) {
+  if (flags["simpleui"]) flags["webui"] = true;
+  if (flags["webui-session-child"]) flags["webui"] = true;
+  const first = positional[0];
+  if (first === "simpleui") {
+    flags["simpleui"] = true;
+    flags["webui"] = true;
+    positional.splice(0, 1);
+    return;
+  }
+  if (first === "webui" || first === "desktop") {
+    flags[first] = true;
+    positional.splice(0, 1);
+    return;
+  }
+  if (first === "hq" && (positional.length === 1 || positional[1] === "serve") && flags["help"] !== true && flags["version"] !== true) {
+    flags["hq"] = true;
+    positional.splice(0, positional[1] === "serve" ? 2 : 1);
+  }
+}
+function parseAuthFlags(args) {
+  const out = { positional: [] };
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--label") {
+      const v = args[++i];
+      if (v) out.label = v;
+    } else if (a === "--family") {
+      const v = args[++i];
+      if (v) out.family = v;
+    } else if (a === "--base-url") {
+      const v = args[++i];
+      if (v) out.baseUrl = v;
+    } else if (a === "--env") {
+      const v = args[++i];
+      if (v)
+        out.envVars = v.split(",").map((s) => s.trim()).filter(Boolean);
+    } else if (a && !a.startsWith("--")) {
+      out.positional.push(a);
+    }
+  }
+  return out;
+}
+function parseSpawnFlags(input) {
+  const opts = {};
+  let rest = input;
+  const consume = (re) => {
+    const m = rest.match(re);
+    if (m) {
+      rest = rest.slice(m[0].length).replace(/^\s+/, "");
+      return m;
+    }
+    return null;
+  };
+  while (rest.length > 0) {
+    let m;
+    m = consume(/^(?:--provider|-p)[=\s]+(?:"([^"]+)"|'([^']+)'|(\S+))\s*/);
+    if (m) opts.provider = m[1] ?? m[2] ?? m[3];
+    else {
+      m = consume(/^(?:--model|-m)[=\s]+(?:"([^"]+)"|'([^']+)'|(\S+))\s*/);
+      if (m) opts.model = m[1] ?? m[2] ?? m[3];
+      else {
+        m = consume(/^(?:--name|-n)[=\s]+(?:"([^"]+)"|'([^']+)'|(\S+))\s*/);
+        if (m) opts.name = m[1] ?? m[2] ?? m[3];
+        else {
+          m = consume(/^(?:--tools|-t)[=\s]+(?:"([^"]+)"|'([^']+)'|(\S+))\s*/);
+          if (m) {
+            const rawTools = m[1] ?? m[2] ?? m[3] ?? "";
+            opts.tools = rawTools.split(",").map((t) => t.trim()).filter(Boolean);
+          } else break;
+        }
+      }
+    }
+  }
+  return { description: rest.trim(), opts };
+}
+
+export {
+  parseArgs,
+  parseAuthFlags,
+  parseSpawnFlags
+};
+//# sourceMappingURL=chunk-GGGUZSAU.js.map

package/dist/{chunk-QC5I4VWZ.js → chunk-H7GABTGS.js}

@@ -241,7 +241,7 @@ import {
   resolvePluginTarget as resolvePluginTarget2,
   unpinPluginTrust
 } from "@wrongstack/core/plugin";
-import { atomicWrite } from "@wrongstack/core/utils";
+import { atomicWrite, buildChildEnv } from "@wrongstack/core/utils";
 import {
   PLUGIN_AUDIT_ENTRIES
 } from "@wrongstack/plugins/plugin-audit-catalog";
@@ -909,6 +909,10 @@ function runPackageManagerInstall(pm, args, cwd) {
       invocation.args,
       {
         cwd,
+        // H-8 (security report VF-09): this runs npm/pnpm install — including
+        // untrusted package lifecycle scripts — with the full inherited
+        // environment. Strip credentials via the shared child env.
+        env: buildChildEnv(),
         timeout: 3e5,
         maxBuffer: 16 * 1024 * 1024,
         windowsHide: true,
@@ -992,4 +996,4 @@ export {
   PLUGIN_AUDIT_ENTRIES,
   runPluginManagementCommand
 };
-//# sourceMappingURL=chunk-QC5I4VWZ.js.map
+//# sourceMappingURL=chunk-H7GABTGS.js.map

package/dist/chunk-OZDE3OWD.js

@@ -0,0 +1,52 @@
+
+// src/subcommands/index.ts
+var loaders = {
+  acp: async () => (await import("./acp-5ANIAOZC.js")).acpCmd,
+  init: async () => (await import("./init-4JQSG66Q.js")).initCmd,
+  auth: async () => (await import("./auth-KF5TAD7V.js")).authCmd,
+  update: async () => (await import("./update-K45CS6SS.js")).updateCmd,
+  sessions: async () => (await import("./sessions-config-KAMEBVOX.js")).sessionsCmd,
+  config: async () => (await import("./sessions-config-KAMEBVOX.js")).configCmd,
+  rewind: async () => (await import("./rewind-2FFNOOKS.js")).rewindCmd,
+  replay: async () => (await import("./replay-RZXZKP2U.js")).replayCmd,
+  audit: async () => (await import("./audit-ZPCLCC3C.js")).auditCmd,
+  tools: async () => (await import("./tools-skills-Q4P27URS.js")).toolsCmd,
+  skills: async () => (await import("./tools-skills-Q4P27URS.js")).skillsCmd,
+  providers: async () => (await import("./providers-models-OKKQZIWU.js")).providersCmd,
+  models: async () => (await import("./providers-models-OKKQZIWU.js")).modelsCmd,
+  mcp: async () => (await import("./mcp-AQKSASHD.js")).mcpCmd,
+  plugin: async () => (await import("./plugin-usage-CYUORYM6.js")).pluginCmd,
+  plugins: async () => (await import("./plugin-usage-CYUORYM6.js")).pluginCmd,
+  diag: async () => (await import("./diag-doctor-LFCCBPMD.js")).diagCmd,
+  doctor: async () => (await import("./diag-doctor-LFCCBPMD.js")).doctorCmd,
+  "proxy-status": async () => (await import("./diag-doctor-LFCCBPMD.js")).proxyCmd,
+  export: async () => (await import("./export-ROG3DKTZ.js")).exportCmd,
+  usage: async () => (await import("./plugin-usage-CYUORYM6.js")).usageCmd,
+  version: async () => (await import("./version-help-WMPSEL4U.js")).versionCmd,
+  help: async () => (await import("./version-help-WMPSEL4U.js")).helpCmd,
+  projects: async () => (await import("./projects-5J727S4L.js")).projectsCmd,
+  modeldiag: async () => (await import("./modeldiag-5FRMT6FQ.js")).modeldiagCmd,
+  quick: async () => (await import("./quick-XLYLZX4B.js")).quickCmd,
+  bench: async () => (await import("./bench-XYG56AMO.js")).benchCmd,
+  chronicle: async () => (await import("./chronicle-6EPPMUC5.js")).chronicleCmd,
+  hq: async () => (await import("./hq-3GWBFLON.js")).hqCmd,
+  mailbox: async () => (await import("./mailbox-serve-VKQIRCCB.js")).mailboxServeCmd,
+  permissions: async () => (await import("./permissions-2PWBL4YU.js")).permissionsCmd,
+  project: async () => (await import("./project-BLQ3ALVL.js")).projectCmd,
+  governance: async () => (await import("./governance-JSGHHA2R.js")).governanceCmd
+};
+var subcommands = Object.fromEntries(
+  Object.entries(loaders).map(
+    ([name, load]) => [
+      name,
+      async (args, deps) => (await load())(args, deps)
+    ]
+  )
+);
+var subcommandNames = Object.keys(loaders);
+
+export {
+  subcommands,
+  subcommandNames
+};
+//# sourceMappingURL=chunk-OZDE3OWD.js.map