@wrongstack/cli 0.319.0 → 1.0.0

package/dist/{chunk-7JBKXVMK.js → chunk-C2E24IXZ.js}

@@ -1775,10 +1775,7 @@ function handleApiAuthAudit(_req, res, dataDir) {
 
 // src/hq-server/routes/command-handlers.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import {
-  tokenHasCapability,
-  validateHqCommand
-} from "@wrongstack/core/hq";
+import { tokenHasCapability, validateHqCommand } from "@wrongstack/core/hq";
 
 // src/hq-server/snapshot.ts
 import { WebSocket } from "ws";
@@ -1872,17 +1869,9 @@ function buildSnapshot(clients, options) {
       project.governance = governance;
     }
     for (const tracked of client.sessions.values()) {
-      const cutoff = Date.now() - 5 * 6e4;
-      const agents = tracked.payload.agents.filter((agent) => {
-        if (agent.id === "leader") return true;
-        const lastActivityAt = Date.parse(agent.lastActivityAt);
-        return Number.isFinite(lastActivityAt) && lastActivityAt >= cutoff;
-      });
       sessionById.set(tracked.payload.sessionId, {
         ...tracked.payload,
-        clientId: client.clientId,
-        agents,
-        agentCount: agents.length
+        clientId: client.clientId
       });
     }
     for (const snapshot of client.mailboxes.values()) {
@@ -2267,9 +2256,7 @@ async function authorizeHqCommand(input) {
 
 // src/hq-server/routes/mailbox-handlers.ts
 import * as path4 from "node:path";
-import {
-  resolveProjectDir
-} from "@wrongstack/core/coordination";
+import { resolveProjectDir } from "@wrongstack/core/coordination";
 
 // src/hq-server/project-root.ts
 import { deriveHqProjectId } from "@wrongstack/core/hq";
@@ -2435,6 +2422,7 @@ async function handleApiMailboxSend(_req, res, mutableAuth, sessions, dataDir, g
     const mailbox = getMailboxGateway(projectDir).mailbox;
     const from = `hq@${hqSessionTag}`;
     const deliveryTo = mailboxType === "broadcast" ? "all" : to;
+    const scopeSessionId = typeof mbody.sessionId === "string" && mbody.sessionId.length > 0 && deliveryTo.trim().toLowerCase() === "leader" ? mbody.sessionId : void 0;
     const sent = await mailbox.send({
       from,
       to: deliveryTo,
@@ -2442,7 +2430,8 @@ async function handleApiMailboxSend(_req, res, mutableAuth, sessions, dataDir, g
       subject,
       body: mbody.body,
       priority,
-      audience
+      audience,
+      ...scopeSessionId !== void 0 ? { sessionAffinity: { sessionId: scopeSessionId } } : {}
     });
     res.writeHead(202, { "Content-Type": "application/json" });
     res.end(
@@ -2843,8 +2832,8 @@ async function handleApiAgentMessages(req, res, match, agentMessages) {
 // src/hq-server/routes/system-handlers.ts
 async function handleApiSystemUpdate(res) {
   const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
-    import("./update-check-PKSMSMD6.js"),
-    import("./update-K45CS6SS.js")
+    import("./update-check-BS3DHTSI.js"),
+    import("./update-5DPB4YD4.js")
   ]);
   const packageName = detectUpdatePackageName();
   const info = await checkForUpdate({ packageName });
@@ -3316,7 +3305,12 @@ var MailboxGatewayManager = class {
   MAILBOX_GATEWAY_SWEEP_INTERVAL_MS = 6e4;
   authorizeMailboxGateway(req, projectDir) {
     const requestUrl = new URL(req.url ?? "/", `http://${this.deps.host}:${this.deps.port}`);
-    const auth = authenticateBrowserRequest2(req, requestUrl, this.deps.mutableAuth, this.deps.sessions);
+    const auth = authenticateBrowserRequest2(
+      req,
+      requestUrl,
+      this.deps.mutableAuth,
+      this.deps.sessions
+    );
     const tokenMode = this.deps.mutableAuth.browserTokens.size > 0;
     if (hqAuthRequired(this.deps.mutableAuth) && auth === void 0) {
       return {
@@ -3638,10 +3632,7 @@ function handleIncomingClientEvent(ws, incomingEvent, clients, browsers, auth, s
   const event = redactHqEvent(
     { ...incomingEvent, payload: parsedPayload.payload },
     {
-      policy: tightenHqRedactionPolicy(
-        client.declaredRedactionPolicy,
-        auth.getOperatorPolicy()
-      ),
+      policy: tightenHqRedactionPolicy(client.declaredRedactionPolicy, auth.getOperatorPolicy()),
       projectRoot: client.project.projectRoot,
       // Chat-transcript events carry full turns — the generic 500-char
       // summary cap would truncate them a second time after the
@@ -3807,10 +3798,7 @@ function handleIncomingClientEvent(ws, incomingEvent, clients, browsers, auth, s
 }
 
 // src/hq-server/ws-leader.ts
-import {
-  HQ_BROWSER_PEER_RESUME_CLIENT_ID,
-  HQ_PROTOCOL_VERSION
-} from "@wrongstack/core/hq";
+import { HQ_BROWSER_PEER_RESUME_CLIENT_ID, HQ_PROTOCOL_VERSION } from "@wrongstack/core/hq";
 var MAX_EVENT_LOG = 5e3;
 var PEER_DEDUP_WINDOW_MS = 60 * 60 * 1e3;
 var peerDedupMap = /* @__PURE__ */ new Map();
@@ -3998,13 +3986,17 @@ function handleClientResume(ws, clients, eventLog, frame, snapshotBroadcaster) {
   const now = Date.now();
   const recent = [];
   let cursorTimestamp;
+  let cursorAnchorSeq = -1;
   const skipPeerEnvelopes = client.clientId !== HQ_BROWSER_PEER_RESUME_CLIENT_ID2;
   for (const env of eventLog) {
     if (env.clientId !== client.clientId) continue;
     if (skipPeerEnvelopes && (env.type === "peer.rehydrate" || env.type === "peer.lost")) {
       continue;
     }
-    if (env.seq === cursor) cursorTimestamp = env.timestamp;
+    if (env.seq <= cursor && env.seq > cursorAnchorSeq) {
+      cursorAnchorSeq = env.seq;
+      cursorTimestamp = env.timestamp;
+    }
     if (env.seq > cursor) {
       recent.push(env);
     }
@@ -4125,6 +4117,22 @@ function handleBrowser(ws, snapshotBroadcaster, browsers, eventLog) {
     browsers.delete(ws);
   });
 }
+function failUndeliveredCommands(lostClient, browsers, auditLog) {
+  if (auditLog === void 0 || lostClient.commandQueue.length === 0) return;
+  const disconnectedAt = (/* @__PURE__ */ new Date()).toISOString();
+  for (const queued of lostClient.commandQueue) {
+    if (auditLog.get(queued.commandId)?.status !== "queued") continue;
+    const updated = auditLog.updateForClient(queued.commandId, lostClient.clientId, {
+      status: "acked",
+      ackStatus: "failed",
+      ackMessage: "client disconnected before the command was delivered",
+      ackedAt: disconnectedAt
+    });
+    if (!updated) continue;
+    const entry = auditLog.get(queued.commandId);
+    if (entry !== void 0) broadcastCommandStatus(entry, browsers);
+  }
+}
 function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster, transcripts, agentMessages, persistence, auditLog) {
   let registered = false;
   function persistEvent(event) {
@@ -4171,9 +4179,10 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
       const declaredRedactionPolicy = resolveHqRedactionPolicy(payload.redactionPolicy);
       const supersededLeaders = [];
       let inheritedLeader = false;
+      const isSessionSurface = acceptedCapabilities.includes("session.summary");
       for (const [otherWs, otherClient] of clients) {
         const sameClientId = otherClient.clientId === payload.client.clientId;
-        const samePublisher = otherClient.projectId === payload.project.projectId && otherClient.kind === payload.client.kind && otherClient.pid !== void 0 && payload.client.pid !== void 0 && otherClient.pid === payload.client.pid && (otherClient.machineId || otherClient.project.machineId) === (payload.client.machineId || payload.project.machineId);
+        const samePublisher = otherClient.projectId === payload.project.projectId && otherClient.kind === payload.client.kind && otherClient.pid !== void 0 && payload.client.pid !== void 0 && otherClient.pid === payload.client.pid && (otherClient.machineId || otherClient.project.machineId) === (payload.client.machineId || payload.project.machineId) && isSessionSurface === otherClient.capabilities.includes("session.summary");
         if (otherWs !== ws && (sameClientId || samePublisher && otherClient.sessions.size === 0)) {
           if (otherClient.isLeader) {
             if (sameClientId) inheritedLeader = true;
@@ -4321,6 +4330,7 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
     const lostClient = clients.get(ws);
     clients.delete(ws);
     if (lostClient) {
+      failUndeliveredCommands(lostClient, browsers, auditLog);
       detectLeaderLoss(lostClient, clients, browsers, "graceful", { eventLog, persistence });
     }
     snapshotBroadcaster.broadcast();
@@ -4418,7 +4428,9 @@ function handleHqConnection(ws, req, pathname, deps) {
   if (pathname === "/ws/browser") {
     handleBrowser(ws, deps.snapshotBroadcaster, deps.browsers, deps.eventLog);
   } else {
-    const token = new URL(req.url ?? "/", `http://${deps.host}:${deps.port}`).searchParams.get("token");
+    const token = new URL(req.url ?? "/", `http://${deps.host}:${deps.port}`).searchParams.get(
+      "token"
+    );
     const authToken = token ? deps.mutableAuth.clientTokenObjs.get(hqTokenVerifier2(token)) : void 0;
     deps.clientSocketTokens.set(ws, authToken);
     ws.once("close", () => deps.clientSocketTokens.delete(ws));
@@ -4914,4 +4926,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-7JBKXVMK.js.map
+//# sourceMappingURL=chunk-C2E24IXZ.js.map

package/dist/{chunk-7CECQDNH.js → chunk-D3K4NYQL.js}

@@ -21,4 +21,4 @@ export {
   resetGateDecisions,
   snapshotGateDecisions
 };
-//# sourceMappingURL=chunk-7CECQDNH.js.map
+//# sourceMappingURL=chunk-D3K4NYQL.js.map

package/dist/{chunk-XPX432BZ.js → chunk-DR2OXU46.js}

@@ -107,47 +107,58 @@ async function loadConfigProviders(configPath, vault, opts) {
   const decrypted = decryptConfigSecrets(parsed, vault);
   return decrypted.providers ?? {};
 }
+var configMutationChain = Promise.resolve();
+function queueConfigMutation(mutate) {
+  const run = configMutationChain.then(mutate, mutate);
+  configMutationChain = run.then(
+    () => void 0,
+    () => void 0
+  );
+  return run;
+}
 async function mutateConfigProviders(configPath, vault, mutator, profileConfigPath) {
-  const targetPath = profileConfigPath ?? configPath;
-  let raw;
-  let fileExists = true;
-  try {
-    raw = await fs.readFile(targetPath, "utf8");
-  } catch (err) {
-    if (err.code !== "ENOENT") {
-      throw new FsError({
-        message: `Refusing to mutate ${configPath}: ${err.message}`,
-        code: "FS_READ_FAILED",
-        path: targetPath,
-        context: { operation: "mutateConfigProviders", phase: "read" },
-        cause: err
-      });
+  await queueConfigMutation(async () => {
+    const targetPath = profileConfigPath ?? configPath;
+    let raw;
+    let fileExists = true;
+    try {
+      raw = await fs.readFile(targetPath, "utf8");
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        throw new FsError({
+          message: `Refusing to mutate ${configPath}: ${err.message}`,
+          code: "FS_READ_FAILED",
+          path: targetPath,
+          context: { operation: "mutateConfigProviders", phase: "read" },
+          cause: err
+        });
+      }
+      fileExists = false;
+      raw = "{}";
     }
-    fileExists = false;
-    raw = "{}";
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    if (fileExists) {
-      throw new FsError({
-        message: `Refusing to overwrite corrupt config at ${targetPath} (${err.message}). Fix or move the file aside before retrying.`,
-        code: "FS_READ_FAILED",
-        path: targetPath,
-        context: { operation: "mutateConfigProviders", phase: "parse" },
-        cause: err
-      });
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (err) {
+      if (fileExists) {
+        throw new FsError({
+          message: `Refusing to overwrite corrupt config at ${targetPath} (${err.message}). Fix or move the file aside before retrying.`,
+          code: "FS_READ_FAILED",
+          path: targetPath,
+          context: { operation: "mutateConfigProviders", phase: "parse" },
+          cause: err
+        });
+      }
+      parsed = {};
     }
-    parsed = {};
-  }
-  const decrypted = decryptConfigSecrets(parsed, vault);
-  const providers = decrypted.providers ?? {};
-  mutator(providers);
-  decrypted.providers = providers;
-  clearStaleProviderDefaults(decrypted);
-  const encrypted = encryptConfigSecrets(decrypted, vault);
-  await atomicWrite(targetPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+    const decrypted = decryptConfigSecrets(parsed, vault);
+    const providers = decrypted.providers ?? {};
+    mutator(providers, decrypted);
+    decrypted.providers = providers;
+    clearStaleProviderDefaults(decrypted);
+    const encrypted = encryptConfigSecrets(decrypted, vault);
+    await atomicWrite(targetPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  });
 }
 
 export {
@@ -160,4 +171,4 @@ export {
   mutateConfigProviders,
   nowIso
 };
-//# sourceMappingURL=chunk-XPX432BZ.js.map
+//# sourceMappingURL=chunk-DR2OXU46.js.map

package/dist/{chunk-4JRIWVJ4.js → chunk-ERX4BLKP.js}

@@ -10,4 +10,4 @@ import {
 export {
   getWrongTrace
 };
-//# sourceMappingURL=chunk-4JRIWVJ4.js.map
+//# sourceMappingURL=chunk-ERX4BLKP.js.map

package/dist/chunk-ETYHZPXP.js

@@ -0,0 +1,52 @@
+
+// src/subcommands/index.ts
+var loaders = {
+  acp: async () => (await import("./acp-3LARESEO.js")).acpCmd,
+  init: async () => (await import("./init-DRMMFG2G.js")).initCmd,
+  auth: async () => (await import("./auth-KIBJZZIE.js")).authCmd,
+  update: async () => (await import("./update-5DPB4YD4.js")).updateCmd,
+  sessions: async () => (await import("./sessions-config-UL45XKX7.js")).sessionsCmd,
+  config: async () => (await import("./sessions-config-UL45XKX7.js")).configCmd,
+  rewind: async () => (await import("./rewind-JA3ZLCNM.js")).rewindCmd,
+  replay: async () => (await import("./replay-JJ2NOWD6.js")).replayCmd,
+  audit: async () => (await import("./audit-46YK5DSC.js")).auditCmd,
+  tools: async () => (await import("./tools-skills-GH24UCBY.js")).toolsCmd,
+  skills: async () => (await import("./tools-skills-GH24UCBY.js")).skillsCmd,
+  providers: async () => (await import("./providers-models-YVMVYWRS.js")).providersCmd,
+  models: async () => (await import("./providers-models-YVMVYWRS.js")).modelsCmd,
+  mcp: async () => (await import("./mcp-HOMLC4WE.js")).mcpCmd,
+  plugin: async () => (await import("./plugin-usage-HFBI3TFT.js")).pluginCmd,
+  plugins: async () => (await import("./plugin-usage-HFBI3TFT.js")).pluginCmd,
+  diag: async () => (await import("./diag-doctor-7LYUYU35.js")).diagCmd,
+  doctor: async () => (await import("./diag-doctor-7LYUYU35.js")).doctorCmd,
+  "proxy-status": async () => (await import("./diag-doctor-7LYUYU35.js")).proxyCmd,
+  export: async () => (await import("./export-VVRIOWFV.js")).exportCmd,
+  usage: async () => (await import("./plugin-usage-HFBI3TFT.js")).usageCmd,
+  version: async () => (await import("./version-help-MYKF724O.js")).versionCmd,
+  help: async () => (await import("./version-help-MYKF724O.js")).helpCmd,
+  projects: async () => (await import("./projects-L6C6XLDY.js")).projectsCmd,
+  modeldiag: async () => (await import("./modeldiag-FMJT37SN.js")).modeldiagCmd,
+  quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
+  bench: async () => (await import("./bench-YBU6BVQP.js")).benchCmd,
+  chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
+  hq: async () => (await import("./hq-IG3YRGCO.js")).hqCmd,
+  mailbox: async () => (await import("./mailbox-serve-VUCWZ2SJ.js")).mailboxServeCmd,
+  permissions: async () => (await import("./permissions-CFDLXETM.js")).permissionsCmd,
+  project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
+  governance: async () => (await import("./governance-RYSHV675.js")).governanceCmd
+};
+var subcommands = Object.fromEntries(
+  Object.entries(loaders).map(
+    ([name, load]) => [
+      name,
+      async (args, deps) => (await load())(args, deps)
+    ]
+  )
+);
+var subcommandNames = Object.keys(loaders);
+
+export {
+  subcommands,
+  subcommandNames
+};
+//# sourceMappingURL=chunk-ETYHZPXP.js.map

package/dist/{chunk-TYO2OVAD.js → chunk-EWKESL4L.js}

@@ -11,9 +11,13 @@ function patchConfig(base, patch) {
 function fmtDuration(ms) {
   if (ms < 1e3) return `${ms}ms`;
   const s = ms / 1e3;
-  if (s < 60) return `${s.toFixed(s < 10 ? 1 : 0)}s`;
-  const m = Math.floor(s / 60);
-  const remSec = Math.round(s - m * 60);
+  if (s < 59.5) return `${s.toFixed(s < 10 ? 1 : 0)}s`;
+  let m = Math.floor(s / 60);
+  let remSec = Math.round(s - m * 60);
+  if (remSec === 60) {
+    remSec = 0;
+    m++;
+  }
   if (m < 60) return remSec === 0 ? `${m}m` : `${m}m${remSec}s`;
   const h = Math.floor(m / 60);
   const remMin = m - h * 60;
@@ -47,4 +51,4 @@ export {
   patchConfig,
   fmtTaskResultLine
 };
-//# sourceMappingURL=chunk-TYO2OVAD.js.map
+//# sourceMappingURL=chunk-EWKESL4L.js.map

package/dist/{chunk-QAC263FZ.js → chunk-FPIWTJ2G.js}

@@ -55,7 +55,7 @@ var helpCmd = async (_args, deps) => {
     "  wstack mailbox serve [opts]  Start external-agent mailbox HTTP bridge",
     "  wstack permissions explain   Explain tool permission policy decisions",
     "  wstack modeldiag [test]      Model benchmarks and capability diagnostics",
-    "  wstack bench [run|list]      Agentic benchmarks against standard suites",
+    "  wstack bench [run|compare]   Agentic benchmarks against standard suites",
     "  wstack acp [serve]           Agent Client Protocol (ACP) server",
     "  wstack update [--check-only] Self-update the CLI",
     "  wstack diag                  Full diagnostics",
@@ -81,7 +81,6 @@ var helpCmd = async (_args, deps) => {
     "                               Serve the independent minimal chat UI",
     "  --full-auto                   SimpleUI: runtime-only YOLO + Director + autonomy override",
     '  --eternal "<mission>"        Start an eternal-autonomy loop',
-    "  --no-hints                   Hide launch hints",
     "  --skip-index                 Skip codebase indexing on startup",
     "  --chimera-auto-fix off|ask|auto",
     "                               How to handle Chimera review findings (default: config value)"
@@ -94,4 +93,4 @@ export {
   versionCmd,
   helpCmd
 };
-//# sourceMappingURL=chunk-QAC263FZ.js.map
+//# sourceMappingURL=chunk-FPIWTJ2G.js.map

package/dist/{chunk-7YLN7YUA.js → chunk-IMWXXF4J.js}

@@ -20,7 +20,34 @@ function createHqCommandDispatcher(controller) {
     }
   };
 }
+function resolveCommandSessionId(controller, payload) {
+  const named = payload["sessionId"];
+  if (typeof named === "string" && named.length > 0) return named;
+  return controller.sessionId?.();
+}
+function rejectUnknownSession(controller, commandId, sessionId) {
+  const named = sessionId;
+  if (named === void 0) return null;
+  const owns = controller.ownsSession?.(named) ?? (controller.sessionId === void 0 ? true : controller.sessionId() === named);
+  if (owns) return null;
+  return {
+    commandId,
+    status: "rejected",
+    message: `session ${named} is not active on this client`
+  };
+}
+function leaderSessionAffinity(to, sessionId) {
+  if (to.trim().toLowerCase() !== "leader") return {};
+  if (typeof sessionId !== "string" || sessionId.length === 0) return {};
+  return { sessionAffinity: { sessionId } };
+}
 async function dispatch(controller, commandId, type, payload) {
+  const sessionId = resolveCommandSessionId(controller, payload);
+  const namedSession = typeof payload["sessionId"] === "string" ? payload["sessionId"] : void 0;
+  if (type !== "broadcast") {
+    const rejected = rejectUnknownSession(controller, commandId, namedSession);
+    if (rejected !== null) return rejected;
+  }
   switch (type) {
     case "steer": {
       const mailbox = controller.steerMailbox;
@@ -32,7 +59,15 @@ async function dispatch(controller, commandId, type, payload) {
       const body = typeof payload["body"] === "string" ? payload["body"] : "";
       const priority = payload["priority"] === "high" ? "high" : payload["priority"] === "low" ? "low" : "normal";
       const from = `hq@${controller.sessionTag()}`;
-      await mailbox.send({ from, to, type: "steer", subject, body, priority });
+      await mailbox.send({
+        from,
+        to,
+        type: "steer",
+        subject,
+        body,
+        priority,
+        ...leaderSessionAffinity(to, sessionId)
+      });
       return { commandId, status: "accepted", message: `steered ${to}` };
     }
     case "btw": {
@@ -45,7 +80,15 @@ async function dispatch(controller, commandId, type, payload) {
       const body = typeof payload["body"] === "string" ? payload["body"] : "";
       const priority = payload["priority"] === "high" ? "high" : payload["priority"] === "low" ? "low" : "normal";
       const from = `hq@${controller.sessionTag()}`;
-      await mailbox.send({ from, to, type: "btw", subject, body, priority });
+      await mailbox.send({
+        from,
+        to,
+        type: "btw",
+        subject,
+        body,
+        priority,
+        ...leaderSessionAffinity(to, sessionId)
+      });
       return { commandId, status: "accepted", message: `noted ${to}` };
     }
     case "queue": {
@@ -58,7 +101,15 @@ async function dispatch(controller, commandId, type, payload) {
       const body = typeof payload["body"] === "string" ? payload["body"] : "";
       const priority = payload["priority"] === "high" ? "high" : payload["priority"] === "low" ? "low" : "normal";
       const from = `hq@${controller.sessionTag()}`;
-      await mailbox.send({ from, to, type: "note", subject, body, priority });
+      await mailbox.send({
+        from,
+        to,
+        type: "note",
+        subject,
+        body,
+        priority,
+        ...leaderSessionAffinity(to, sessionId)
+      });
       return { commandId, status: "accepted", message: `queued for ${to}` };
     }
     case "broadcast": {
@@ -76,7 +127,7 @@ async function dispatch(controller, commandId, type, payload) {
     case "abort": {
       const target = typeof payload["target"] === "string" ? payload["target"] : "leader";
       if (target === "leader") {
-        const aborted = controller.interruptLeader();
+        const aborted = controller.interruptLeader(sessionId);
         return {
           commandId,
           status: aborted ? "completed" : "accepted",
@@ -84,14 +135,14 @@ async function dispatch(controller, commandId, type, payload) {
         };
       }
       if (target === "fleet") {
-        const killed = await controller.killFleet?.() ?? 0;
+        const killed = await controller.killFleet?.(sessionId) ?? 0;
         return {
           commandId,
           status: "completed",
           message: `fleet stopped (${killed} agents)`
         };
       }
-      const terminated = await controller.terminateAgent?.(target) ?? false;
+      const terminated = await controller.terminateAgent?.(target, sessionId) ?? false;
       return {
         commandId,
         status: terminated ? "completed" : "rejected",
@@ -105,7 +156,7 @@ async function dispatch(controller, commandId, type, payload) {
       if (controller.spawnAgent === void 0) {
         return { commandId, status: "rejected", message: "no director active" };
       }
-      const subagentId = await controller.spawnAgent(role, task, maxIterations);
+      const subagentId = await controller.spawnAgent(role, task, maxIterations, sessionId);
       return { commandId, status: "completed", message: `spawned ${subagentId}` };
     }
     case "run-command": {
@@ -130,7 +181,8 @@ async function dispatch(controller, commandId, type, payload) {
 \`\`\`
 ${command}
 \`\`\``,
-          priority: "high"
+          priority: "high",
+          ...leaderSessionAffinity("leader", sessionId)
         });
         return { commandId, status: "accepted", message: "run-command routed to leader as steer" };
       }
@@ -144,4 +196,4 @@ ${command}
 export {
   createHqCommandDispatcher
 };
-//# sourceMappingURL=chunk-7YLN7YUA.js.map
+//# sourceMappingURL=chunk-IMWXXF4J.js.map

package/dist/{chunk-G7337TTK.js → chunk-IS2PPBQV.js}

@@ -116,4 +116,4 @@ export {
   ensureProjectDataDir,
   touchProjectInManifest
 };
-//# sourceMappingURL=chunk-G7337TTK.js.map
+//# sourceMappingURL=chunk-IS2PPBQV.js.map

package/dist/{chunk-G3IMKQRH.js → chunk-JHPXJRRI.js}

@@ -136,4 +136,4 @@ function buildHealthUrl(rawBase) {
 export {
   startProxyProbe
 };
-//# sourceMappingURL=chunk-G3IMKQRH.js.map
+//# sourceMappingURL=chunk-JHPXJRRI.js.map

package/dist/{chunk-XHIEA6LG.js → chunk-MNQQ4ZNF.js}

@@ -11,7 +11,7 @@ import {
   openBrowser,
   runCodexOAuthLogin,
   startLoopbackServer
-} from "./chunk-E4I2TF5S.js";
+} from "./chunk-TNK6237M.js";
 import {
   activeLabel,
   loadConfigProviders,
@@ -20,7 +20,7 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-XPX432BZ.js";
+} from "./chunk-DR2OXU46.js";
 
 // src/auth-menu/local.ts
 import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core/security";
@@ -1444,11 +1444,11 @@ function renderLiveProviderList(query, filtered, selectedIdx, savedSet) {
 }
 async function saveToGlobalConfig(configPath, provider, model, homeFn = () => process.env.HOME ?? os.homedir()) {
   try {
-    const { atomicWrite: atomicWrite2 } = await import("@wrongstack/core/utils");
-    const fs2 = await import("node:fs/promises");
+    const { atomicWrite } = await import("@wrongstack/core/utils");
+    const fs = await import("node:fs/promises");
     let existing = {};
     try {
-      const raw = await fs2.readFile(configPath, "utf8");
+      const raw = await fs.readFile(configPath, "utf8");
       existing = JSON.parse(raw);
     } catch {
     }
@@ -1467,7 +1467,7 @@ async function saveToGlobalConfig(configPath, provider, model, homeFn = () => pr
         })
       );
     }
-    await atomicWrite2(configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+    await atomicWrite(configPath, JSON.stringify(existing, null, 2), { mode: 384 });
     try {
       await appendHistory(
         oldCfg,
@@ -1899,8 +1899,7 @@ async function resolveModelSelection(answer, models, provider, _registry, render
 }
 
 // src/auth-menu/add-provider.ts
-import * as fs from "node:fs/promises";
-import { atomicWrite, color as color9 } from "@wrongstack/core/utils";
+import { color as color9 } from "@wrongstack/core/utils";
 import { catalogProviderIdFor, PROVIDER_DEFINITIONS } from "@wrongstack/providers";
 
 // src/provider-id.ts
@@ -2148,22 +2147,26 @@ async function resolveDefaultModelId(deps, providerId, template) {
   return provider?.models?.[0]?.id;
 }
 async function adoptAsDefaultIfUnset(deps, providerId, template) {
-  const targetPath = deps.profileConfigPath;
-  let cfg = {};
-  try {
-    cfg = JSON.parse(await fs.readFile(targetPath, "utf8"));
-  } catch {
-  }
-  if (cfg["provider"] && cfg["model"]) return;
   const modelId = await resolveDefaultModelId(deps, providerId, template);
   if (!modelId) return;
-  cfg["provider"] = providerId;
-  cfg["model"] = modelId;
-  await atomicWrite(targetPath, JSON.stringify(cfg, null, 2), { mode: 384 });
-  deps.renderer.write(
-    `  ${color9.green("\u2713")} Set ${color9.bold(providerId)}/${color9.bold(modelId)} as the default.
-`
+  let adopted = false;
+  await mutateConfigProviders(
+    deps.profileConfigPath,
+    deps.vault,
+    (_providers, config) => {
+      if (config["provider"] && config["model"]) return;
+      config["provider"] = providerId;
+      config["model"] = modelId;
+      adopted = true;
+    },
+    deps.profileConfigPath
   );
+  if (adopted) {
+    deps.renderer.write(
+      `  ${color9.green("\u2713")} Set ${color9.bold(providerId)}/${color9.bold(modelId)} as the default.
+`
+    );
+  }
 }
 async function promptForLabel(deps, usedLabels) {
   const defaultLabel = suggestLabel(usedLabels);
@@ -2201,9 +2204,10 @@ export {
   saveToGlobalConfig,
   runPicker,
   nextCustomProviderId,
+  ownDefinitionsAsCatalog,
   addFromCatalog,
   addKeyForCatalogProvider,
   addCustomProvider,
   addKeyForProvider
 };
-//# sourceMappingURL=chunk-XHIEA6LG.js.map
+//# sourceMappingURL=chunk-MNQQ4ZNF.js.map