@wrongstack/cli 0.319.0 → 1.0.0

package/dist/{chunk-P2OKBDCH.js → chunk-MXEJEYT7.js}

@@ -12,18 +12,17 @@ var BENCH_RUN_FLAGS = [
   {
     name: "suite",
     flag: "--suite <id>",
-    description: "Benchmark suite id (`polyglot` or `swebench`).",
+    description: "Benchmark suite id (`core`, `smoke`, `local`, `polyglot`, or `swebench`).",
     group: "suite",
     kind: "value",
-    defaultValue: "polyglot"
+    defaultValue: "core"
   },
   {
     name: "polyglot-dir",
     flag: "--polyglot-dir <path>",
     description: "Path to the Aider polyglot dataset (required when --suite polyglot).",
     group: "suite",
-    kind: "value",
-    required: true
+    kind: "value"
   },
   {
     name: "languages",
@@ -46,15 +45,36 @@ var BENCH_RUN_FLAGS = [
     group: "suite",
     kind: "boolean"
   },
+  {
+    name: "suite-dir",
+    flag: "--suite-dir <path>",
+    description: "Directory containing bench.local.json (required when --suite local).",
+    group: "suite",
+    kind: "value"
+  },
+  {
+    name: "manifest",
+    flag: "--manifest <file>",
+    description: "Explicit local-manifest path (alternative to --suite-dir).",
+    group: "suite",
+    kind: "value"
+  },
   // -- Model matrix ---------------------------------------------------
   {
     name: "models",
     flag: "--models <config>",
-    description: "Path to the model-cells config (JSON).",
+    description: "Path to the model-cells config (JSON). Optional when --cell or a saved model is set.",
     group: "models",
     kind: "value",
     defaultValue: "bench.config.json"
   },
+  {
+    name: "cell",
+    flag: "--cell <spec>",
+    description: "Comma-separated model cells (`provider/model` or `label=provider/model`). Skips the config file.",
+    group: "models",
+    kind: "value"
+  },
   // -- Run control ----------------------------------------------------
   {
     name: "limit",
@@ -77,6 +97,21 @@ var BENCH_RUN_FLAGS = [
     description: "Override the per-cell concurrency from the model config.",
     group: "control",
     kind: "value"
+  },
+  {
+    name: "repeats",
+    flag: "--repeats <N>",
+    description: "Attempts per (task x model). >1 adds pass@k and a flakiness count so run-to-run noise is visible.",
+    group: "control",
+    kind: "value",
+    defaultValue: "1"
+  },
+  {
+    name: "keep-sandbox",
+    flag: "--keep-sandbox",
+    description: "Keep the temporary sandbox (workdirs + isolated home) on disk for debugging.",
+    group: "control",
+    kind: "boolean"
   }
 ];
 var BENCH_RUN_BOOLEAN_FLAG_NAMES = BENCH_RUN_FLAGS.filter(
@@ -89,10 +124,10 @@ var BENCH_RUN_FLAG_COLUMN_WIDTH = 28;
 function renderBenchRunHelpToString() {
   const lines = [
     color.bold("wstack bench run \u2014 execute a benchmark suite across a model matrix"),
-    color.dim("  Runs a benchmark suite (polyglot or swebench) across every model cell"),
-    color.dim("  in the config. Output is a per-run directory with `report.md`, JSON"),
-    color.dim("  artifacts, and (for swebench) per-cell predictions for the official"),
-    color.dim("  harness."),
+    color.dim("  Default suite is bundled core (6 agent-edit tasks with tests). Pass --cell"),
+    color.dim("  provider/model to start immediately. Output is a per-run directory"),
+    color.dim("  with `report.md` (leaderboard + per-task matrix), JSON artifacts,"),
+    color.dim("  and (for swebench) per-cell predictions for the official harness."),
     "",
     color.bold("Usage"),
     `  ${buildUsageLine()}`,
@@ -101,7 +136,7 @@ function renderBenchRunHelpToString() {
     ...buildFlagBlock(),
     "",
     color.dim(
-      "See also: wstack bench list (show available suites + cells); wstack bench report <dir>"
+      "See also: wstack bench list; wstack bench report <dir>; wstack bench compare <a> <b>"
     )
   ];
   return lines.join("\n") + "\n";
@@ -969,10 +1004,14 @@ var helpTable = {
   bench: {
     name: "bench",
     title: "wstack bench \u2014 run model-independent agentic benchmarks",
-    description: "Run WrongStack against the Aider polyglot or SWE-bench Verified suites with deterministic graders. Used internally to compare model quality across releases; also useful for evaluating a new model before adopting it.",
-    usage: "wstack bench [run|report|list] [...]",
+    description: "Run WrongStack against the bundled smoke suite, a local manifest, Aider polyglot, or SWE-bench Verified with deterministic graders. Default `bench run` is the bundled core edit-eval; pass --cell provider/model (or a saved model).",
+    usage: "wstack bench [run|compare|report|list] [...]",
     subcommands: [
-      { name: "run", description: "Run a benchmark suite (--suite <id> --models <config>)." },
+      { name: "run", description: "Run a suite. Default: bundled smoke + --cell or saved model." },
+      {
+        name: "compare <a> <b>",
+        description: "Diff two finished run directories (fingerprint-aware)."
+      },
       { name: "report <dir>", description: "Render the Markdown report for a prior run." },
       { name: "list", description: "List available suites and the model configs in the catalog." }
     ],
@@ -1163,4 +1202,4 @@ export {
   subcommandsWithFocusedHelp,
   renderGenericHelp
 };
-//# sourceMappingURL=chunk-P2OKBDCH.js.map
+//# sourceMappingURL=chunk-MXEJEYT7.js.map

package/dist/{chunk-PCBJSXYV.js → chunk-O4A3HHKD.js}

@@ -14,7 +14,7 @@ async function printUpdateNotice(initialUpdateInfo) {
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), 2e3);
     try {
-      const { checkForUpdate } = await import("./update-check-PKSMSMD6.js");
+      const { checkForUpdate } = await import("./update-check-BS3DHTSI.js");
       info = await checkForUpdate(ac.signal);
     } catch {
     } finally {
@@ -62,4 +62,4 @@ export {
   applySessionShellDefault,
   runPreflight
 };
-//# sourceMappingURL=chunk-PCBJSXYV.js.map
+//# sourceMappingURL=chunk-O4A3HHKD.js.map

package/dist/{chunk-XYKYXFEE.js → chunk-TE3Q32JP.js}

@@ -423,6 +423,7 @@ async function writeState(projectRoot, state) {
 }
 
 // src/hq-publisher.ts
+var HQ_DISCOVERY_CONNECTION_KEY = "<discover>";
 function nodeWsSocketFactory(url) {
   return new WebSocket(url);
 }
@@ -440,11 +441,13 @@ function hqExplicitlyDisabled(options) {
 }
 function resolvedHqConnectionKey(options) {
   if (options.config !== void 0) {
-    return options.config.enabled === false ? void 0 : `${options.config.url}
+    if (options.config.enabled === false) return void 0;
+    return options.config.discover === true ? HQ_DISCOVERY_CONNECTION_KEY : `${options.config.url}
 ${options.config.token ?? ""}`;
   }
   const config = resolveHqConfig({ config: options.appConfig?.hq });
-  return config === void 0 ? void 0 : `${config.url}
+  if (config === void 0) return void 0;
+  return config.discover === true ? HQ_DISCOVERY_CONNECTION_KEY : `${config.url}
 ${config.token ?? ""}`;
 }
 function startCliHqConnection(options) {
@@ -460,7 +463,10 @@ function startCliHqConnection(options) {
   const tryConnect = () => {
     const nextKey = resolvedHqConnectionKey(options);
     if (nextKey === void 0) return;
-    if (publisher !== void 0 && publisherKey === nextKey) return;
+    if (publisher !== void 0 && publisherKey === nextKey) {
+      if (nextKey === HQ_DISCOVERY_CONNECTION_KEY) publisher.refreshEndpoint();
+      return;
+    }
     publisher?.close();
     publisher = void 0;
     publisherKey = void 0;
@@ -507,4 +513,4 @@ function startCliHqConnection(options) {
 export {
   startCliHqConnection
 };
-//# sourceMappingURL=chunk-XYKYXFEE.js.map
+//# sourceMappingURL=chunk-TE3Q32JP.js.map

package/dist/{chunk-H7GABTGS.js → chunk-TEBMCYZN.js}

@@ -1,7 +1,7 @@
 
 // src/wiring/external-plugins.ts
-import { fileURLToPath, pathToFileURL } from "node:url";
 import { isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import {
   defaultPluginTrustPath,
   discoverExternalPlugins,
@@ -13,6 +13,12 @@ import {
   resolvePluginTarget,
   verifyPluginTrust
 } from "@wrongstack/core/plugin";
+function resolveExternalPluginTrustMode(raw) {
+  if (raw === false) return "off";
+  if (raw === "required") return "required";
+  if (raw === "advisory") return "advisory";
+  return "tofu";
+}
 function normalizeConfigPath(raw, projectRoot) {
   if (raw.startsWith("file:")) return fileURLToPath(raw);
   return isAbsolute(raw) ? raw : resolve(projectRoot, raw);
@@ -50,15 +56,36 @@ async function loadExternalPlugins(ctx, hooks) {
   const { config, log } = ctx;
   if (config.features?.plugins === false) return [];
   const importModule = ctx.importModule ?? ((url) => import(url));
-  const trustEnabled = config.features?.pluginsTrust !== false && (ctx.globalRoot !== void 0 || ctx.trustStorePath !== void 0);
+  const trustMode = resolveExternalPluginTrustMode(config.features?.pluginsTrust);
+  if (trustMode === "required" && ctx.globalRoot === void 0 && ctx.trustStorePath === void 0) {
+    log.error(
+      '[plugins] features.pluginsTrust is "required" but no trust store location is available (no globalRoot) \u2014 refusing all external plugins. Configure a global root, or set features.pluginsTrust to "tofu"/"advisory".'
+    );
+    return [];
+  }
+  const trustEnabled = trustMode !== "off";
   const trustStorePath = ctx.trustStorePath ?? (ctx.globalRoot !== void 0 ? defaultPluginTrustPath(ctx.globalRoot) : void 0);
   let trustStore;
-  if (trustEnabled && trustStorePath !== void 0) {
+  let trustUsable = trustEnabled && trustStorePath !== void 0;
+  if (trustEnabled && !trustUsable) {
+    log.warn(
+      "[plugins] features.pluginsTrust is enabled but no trust store location is available (no globalRoot) \u2014 external plugins load WITHOUT integrity checks. Configure a global root to enable trust-on-first-use."
+    );
+  }
+  if (trustUsable && trustStorePath !== void 0) {
     try {
       trustStore = await readPluginTrustStore(trustStorePath);
     } catch (err) {
-      log.error(`[plugins] ${err instanceof Error ? err.message : String(err)}`);
-      return [];
+      const message = err instanceof Error ? err.message : String(err);
+      if (trustMode === "advisory") {
+        log.warn(
+          `[plugins] trust store unreadable (${message}) \u2014 features.pluginsTrust is 'advisory', loading external plugins WITHOUT integrity checks`
+        );
+        trustUsable = false;
+      } else {
+        log.error(`[plugins] ${message}`);
+        return [];
+      }
     }
   }
   const sources = [];
@@ -120,9 +147,7 @@ async function loadExternalPlugins(ctx, hooks) {
     });
     if (!enabled) {
       if (enablementSource !== "default") {
-        log.info(
-          `[plugins] discovered plugin "${candidate.name}" disabled by ${enablementSource}`
-        );
+        log.info(`[plugins] discovered plugin "${candidate.name}" disabled by ${enablementSource}`);
       }
       continue;
     }
@@ -143,18 +168,25 @@ async function loadExternalPlugins(ctx, hooks) {
   const seenNames = /* @__PURE__ */ new Set();
   for (const source of sources) {
     const entryPath = source.kind === "spec" ? resolveSpecifierEntry(source.spec) : source.entryPath;
-    if (trustEnabled && trustStorePath !== void 0 && entryPath !== void 0) {
+    if (trustUsable && trustStorePath !== void 0 && entryPath !== void 0) {
       const gate = await gateExternalPluginTrust({
         entryPath,
         spec: source.spec,
         label: source.label,
         store: trustStore,
         storePath: trustStorePath,
+        mode: trustMode,
         log
       });
       if (!gate.ok) continue;
       if (gate.pinned) trustStore = gate.store;
-    } else if (trustEnabled && trustStorePath !== void 0 && entryPath === void 0) {
+    } else if (trustUsable && entryPath === void 0) {
+      if (trustMode === "required") {
+        log.error(
+          `[plugins] REFUSING external plugin "${source.label}" \u2014 features.pluginsTrust is 'required' and its entry file could not be resolved pre-import (spec "${source.spec}"). Install it so its entry file resolves, or load it by explicit path.`
+        );
+        continue;
+      }
       log.warn(
         `[plugins] trust check skipped for "${source.label}" \u2014 entry file could not be resolved pre-import`
       );
@@ -191,16 +223,21 @@ async function loadExternalPlugins(ctx, hooks) {
   return loaded;
 }
 async function gateExternalPluginTrust(args) {
-  const { spec, label, store, storePath, log } = args;
+  const { spec, label, store, storePath, mode, log } = args;
   const entryPath = normalizeTrustKey(args.entryPath);
   if (!store) return { ok: true, pinned: false };
   let integrity;
   try {
     integrity = await hashFileContents(entryPath);
   } catch (err) {
-    log.warn(
-      `[plugins] trust check skipped for "${label}" \u2014 entry could not be read (${err instanceof Error ? err.message : String(err)})`
-    );
+    const message = err instanceof Error ? err.message : String(err);
+    if (mode === "required") {
+      log.error(
+        `[plugins] REFUSING external plugin "${label}" \u2014 features.pluginsTrust is 'required' and its entry file could not be read (${message})`
+      );
+      return { ok: false, pinned: false };
+    }
+    log.warn(`[plugins] trust check skipped for "${label}" \u2014 entry could not be read (${message})`);
     return { ok: true, pinned: false };
   }
   const verification = verifyPluginTrust(entryPath, integrity, store);
@@ -213,15 +250,25 @@ async function gateExternalPluginTrust(args) {
       );
       return { ok: true, pinned: true, store: next };
     } catch (err) {
-      log.warn(
-        `[plugins] could not persist trust pin for "${label}" (${err instanceof Error ? err.message : String(err)})`
-      );
+      const message = err instanceof Error ? err.message : String(err);
+      if (mode === "required") {
+        log.error(
+          `[plugins] REFUSING external plugin "${label}" \u2014 features.pluginsTrust is 'required' and its first-use pin could not be persisted (${message})`
+        );
+        return { ok: false, pinned: false };
+      }
+      log.warn(`[plugins] could not persist trust pin for "${label}" (${message})`);
       return { ok: true, pinned: false };
     }
   }
-  log.error(
-    `[plugins] REFUSING external plugin "${label}" \u2014 its entry file changed since it was first trusted (pinned ${verification.pinnedAt}). If you expected this update, re-pin it: wstack plugin trust ${label}`
-  );
+  const changedMessage = `its entry file changed since it was first trusted (pinned ${verification.pinnedAt}). If you expected this update, re-pin it: wstack plugin trust ${label}`;
+  if (mode === "advisory") {
+    log.warn(
+      `[plugins] external plugin "${label}" \u2014 ${changedMessage} features.pluginsTrust is 'advisory', loading anyway WITHOUT integrity enforcement`
+    );
+    return { ok: true, pinned: false };
+  }
+  log.error(`[plugins] REFUSING external plugin "${label}" \u2014 ${changedMessage}`);
   return { ok: false, pinned: false };
 }
 
@@ -880,15 +927,7 @@ function buildInstallArgs(pm, targetDir, runScripts, spec) {
     case "bun":
       return ["add", "--cwd", targetDir, ...ignoreScripts, spec];
     default:
-      return [
-        "install",
-        "--prefix",
-        targetDir,
-        "--no-audit",
-        "--no-fund",
-        ...ignoreScripts,
-        spec
-      ];
+      return ["install", "--prefix", targetDir, "--no-audit", "--no-fund", ...ignoreScripts, spec];
   }
 }
 function runPackageManagerInstall(pm, args, cwd) {
@@ -996,4 +1035,4 @@ export {
   PLUGIN_AUDIT_ENTRIES,
   runPluginManagementCommand
 };
-//# sourceMappingURL=chunk-H7GABTGS.js.map
+//# sourceMappingURL=chunk-TEBMCYZN.js.map

package/dist/{chunk-E4I2TF5S.js → chunk-TNK6237M.js}

@@ -3,7 +3,7 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-XPX432BZ.js";
+} from "./chunk-DR2OXU46.js";
 
 // src/auth-menu/openai-codex-oauth.ts
 import { color } from "@wrongstack/core/utils";
@@ -259,4 +259,4 @@ export {
   filterCurrentCodexModelIds,
   isCodexCatalogModel
 };
-//# sourceMappingURL=chunk-E4I2TF5S.js.map
+//# sourceMappingURL=chunk-TNK6237M.js.map

package/dist/{chunk-SYIBTG3X.js → chunk-VOTTENR5.js}

@@ -1,11 +1,9 @@
 import {
   startProxyProbe
-} from "./chunk-G3IMKQRH.js";
+} from "./chunk-JHPXJRRI.js";
 
 // src/wiring/proxy-wiring.ts
-import {
-  applyProxyConfig
-} from "@wrongstack/core/wiring/proxy-rewrite";
+import { applyProxyConfig } from "@wrongstack/core/wiring/proxy-rewrite";
 var probeRunner;
 function applyWrongProxyPrefs(payload) {
   const patch = {};
@@ -55,4 +53,4 @@ export {
   bootstrapWrongProxy,
   shutdownWrongProxy
 };
-//# sourceMappingURL=chunk-SYIBTG3X.js.map
+//# sourceMappingURL=chunk-VOTTENR5.js.map

package/dist/chunk-WHOIR577.js

@@ -0,0 +1 @@
+//# sourceMappingURL=chunk-WHOIR577.js.map

package/dist/{chunk-2ZNBRZ4W.js → chunk-WQZW3RDP.js}

@@ -1,6 +1,6 @@
 import {
   loadManifest
-} from "./chunk-G7337TTK.js";
+} from "./chunk-IS2PPBQV.js";
 
 // src/project-picker.ts
 import { color } from "@wrongstack/core/utils";
@@ -415,4 +415,4 @@ export {
   skipDivider,
   runProjectPicker
 };
-//# sourceMappingURL=chunk-2ZNBRZ4W.js.map
+//# sourceMappingURL=chunk-WQZW3RDP.js.map

package/dist/{chunk-GGGUZSAU.js → chunk-Z7A5MXKJ.js}

@@ -36,8 +36,6 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "no-models-refresh",
   // (removed: 'director' and 'no-director' — Director Mode is always on)
   "no-autonomy",
-  "no-hints",
-  "hints",
   "no-menu",
   "no-hooks",
   "skip",
@@ -174,20 +172,28 @@ function parseAuthFlags(args) {
   const out = { positional: [] };
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
-    if (a === "--label") {
-      const v = args[++i];
+    if (!a) continue;
+    let key = a;
+    let inlineVal;
+    const eq = a.indexOf("=");
+    if (a.startsWith("--") && eq !== -1) {
+      key = a.slice(0, eq);
+      inlineVal = a.slice(eq + 1);
+    }
+    if (key === "--label") {
+      const v = inlineVal !== void 0 ? inlineVal : args[++i];
       if (v) out.label = v;
-    } else if (a === "--family") {
-      const v = args[++i];
+    } else if (key === "--family") {
+      const v = inlineVal !== void 0 ? inlineVal : args[++i];
       if (v) out.family = v;
-    } else if (a === "--base-url") {
-      const v = args[++i];
+    } else if (key === "--base-url") {
+      const v = inlineVal !== void 0 ? inlineVal : args[++i];
       if (v) out.baseUrl = v;
-    } else if (a === "--env") {
-      const v = args[++i];
+    } else if (key === "--env") {
+      const v = inlineVal !== void 0 ? inlineVal : args[++i];
       if (v)
         out.envVars = v.split(",").map((s) => s.trim()).filter(Boolean);
-    } else if (a && !a.startsWith("--")) {
+    } else if (!a.startsWith("--")) {
       out.positional.push(a);
     }
   }
@@ -232,4 +238,4 @@ export {
   parseAuthFlags,
   parseSpawnFlags
 };
-//# sourceMappingURL=chunk-GGGUZSAU.js.map
+//# sourceMappingURL=chunk-Z7A5MXKJ.js.map

package/dist/{chunk-F5GA2QW2.js → chunk-ZSZ3EYWH.js}

@@ -2,7 +2,7 @@ import {
   fallbackCodexProviderModels,
   filterCurrentCodexModelIds,
   isCodexCatalogModel
-} from "./chunk-E4I2TF5S.js";
+} from "./chunk-TNK6237M.js";
 
 // src/acp-registry-cache.ts
 import * as fs from "node:fs/promises";
@@ -307,4 +307,4 @@ export {
   setupProvider,
   createGracefulShutdown
 };
-//# sourceMappingURL=chunk-F5GA2QW2.js.map
+//# sourceMappingURL=chunk-ZSZ3EYWH.js.map