@wrongstack/cli 0.5.2 → 0.5.3

package/dist/index.js

@@ -1,18 +1,19 @@
 #!/usr/bin/env node
-import * as path18 from 'path';
+import * as path20 from 'path';
 import { color, allServers, DefaultPathResolver, TOKENS, DefaultSystemPromptBuilder, ToolRegistry, createContextManagerTool, EventBus, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, SlashCommandRegistry, loadPlugins, createDelegateTool, FLEET_ROSTER, DefaultLogger, DefaultModelsRegistry, ProviderRegistry, RecoveryLock, DefaultAttachmentStore, QueueStore, Context, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, loadPlan, createDefaultPipelines, AutoCompactionMiddleware, estimateRequestTokens, Agent, makeDirectorSessionFactory, Director, DefaultMultiAgentCoordinator, makeAgentSubagentRunner, resolveWstackPaths, DefaultSecretVault, migratePlaintextSecrets, DefaultConfigLoader, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, atomicWrite, AutoApprovePermissionPolicy, formatContextWindowModeList, repairToolUseAdjacency, getContextWindowMode, resolveContextWindowPolicy, formatTodosList, emptyPlan, clearPlan, savePlan, removePlanItem, formatPlan, setPlanItemStatus, addPlanItem, SpecStore, TaskGraphStore, SpecVersioning, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, DefaultTaskStore, TaskTracker, InputBuilder, projectHash, decryptConfigSecrets, encryptConfigSecrets as encryptConfigSecrets$1, DefaultPluginAPI } from '@wrongstack/core';
+import { createRequire } from 'module';
+import * as fs3 from 'fs/promises';
+import * as os6 from 'os';
+import os6__default from 'os';
 import * as crypto from 'crypto';
 import { randomUUID } from 'crypto';
-import * as fs5 from 'fs/promises';
 import { DefaultSecretVault as DefaultSecretVault$1, encryptConfigSecrets, decryptConfigSecrets as decryptConfigSecrets$1 } from '@wrongstack/core/security';
 import { WebSocketServer, WebSocket } from 'ws';
 import { writeFileSync } from 'fs';
-import { createRequire } from 'module';
 import { MCPRegistry } from '@wrongstack/mcp';
 import { buildProviderFactoriesFromRegistry, makeProviderFromConfig, capabilitiesFor } from '@wrongstack/providers';
 import { createDefaultContainer, routeImagesForModel, readClipboardImage } from '@wrongstack/runtime';
 import { builtinToolsPack, rememberTool, forgetTool } from '@wrongstack/tools';
-import * as os4 from 'os';
 import * as readline from 'readline';
 import { spawn } from 'child_process';
 import { SkillInstaller } from '@wrongstack/core/skills';
@@ -22,6 +23,12 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -237,8 +244,8 @@ function buildSddCommand(opts) {
     async run(args) {
       const ctx = opts.context;
       const projectRoot = ctx?.projectRoot ?? process.cwd();
-      const specsDir = path18.join(projectRoot, ".wrongstack", "specs");
-      const graphsDir = path18.join(projectRoot, ".wrongstack", "task-graphs");
+      const specsDir = path20.join(projectRoot, ".wrongstack", "specs");
+      const graphsDir = path20.join(projectRoot, ".wrongstack", "task-graphs");
       const specStore = new SpecStore({ baseDir: specsDir });
       new TaskGraphStore({ baseDir: graphsDir });
       const versioning = new SpecVersioning();
@@ -254,7 +261,7 @@ function buildSddCommand(opts) {
           const forceFlag = rest.includes("--force") || rest.includes("-f");
           const title = rest.filter((a) => !a.startsWith("-")).join(" ").trim() || "Untitled Feature";
           if (!activeBuilder && !forceFlag) {
-            const sessionPath = path18.join(projectRoot, ".wrongstack", "sdd-session.json");
+            const sessionPath = path20.join(projectRoot, ".wrongstack", "sdd-session.json");
             try {
               const fsp = await import('fs/promises');
               await fsp.access(sessionPath);
@@ -292,7 +299,7 @@ function buildSddCommand(opts) {
             projectContext,
             minQuestions: 2,
             maxQuestions: 10,
-            sessionPath: path18.join(projectRoot, ".wrongstack", "sdd-session.json")
+            sessionPath: path20.join(projectRoot, ".wrongstack", "sdd-session.json")
           });
           activeBuilder.startSession(title);
           const aiPrompt = activeBuilder.getAIPrompt();
@@ -552,7 +559,7 @@ Start executing the tasks one by one.`
           };
         }
         case "cancel": {
-          const sessionPath = path18.join(projectRoot, ".wrongstack", "sdd-session.json");
+          const sessionPath = path20.join(projectRoot, ".wrongstack", "sdd-session.json");
           let deletedFromDisk = false;
           try {
             const fsp = await import('fs/promises');
@@ -578,7 +585,7 @@ Start executing the tasks one by one.`
           if (activeBuilder) {
             return { message: "An SDD session is already active. Use /sdd cancel first." };
           }
-          const sessionPath = path18.join(projectRoot, ".wrongstack", "sdd-session.json");
+          const sessionPath = path20.join(projectRoot, ".wrongstack", "sdd-session.json");
           const projectContext = await gatherProjectContext(projectRoot);
           activeBuilder = new AISpecBuilder({
             store: specStore,
@@ -804,7 +811,7 @@ async function gatherProjectContext(projectRoot) {
   const parts = [];
   try {
     const fsp = await import('fs/promises');
-    const pkgPath = path18.join(projectRoot, "package.json");
+    const pkgPath = path20.join(projectRoot, "package.json");
     const pkgRaw = await fsp.readFile(pkgPath, "utf8");
     const pkg = JSON.parse(pkgRaw);
     parts.push(`Project: ${String(pkg.name ?? "unknown")}`);
@@ -821,14 +828,14 @@ async function gatherProjectContext(projectRoot) {
   }
   try {
     const fsp = await import('fs/promises');
-    const tsconfigPath = path18.join(projectRoot, "tsconfig.json");
+    const tsconfigPath = path20.join(projectRoot, "tsconfig.json");
     await fsp.access(tsconfigPath);
     parts.push("Language: TypeScript");
   } catch {
   }
   try {
     const fsp = await import('fs/promises');
-    const srcDir = path18.join(projectRoot, "src");
+    const srcDir = path20.join(projectRoot, "src");
     const entries = await fsp.readdir(srcDir, { withFileTypes: true });
     const dirs = entries.filter((e) => e.isDirectory()).map((e) => e.name);
     if (dirs.length > 0) {
@@ -900,6 +907,130 @@ var init_provider_config_utils = __esm({
   }
 });
 
+// src/update-check.ts
+var update_check_exports = {};
+__export(update_check_exports, {
+  cachePath: () => cachePath,
+  checkForUpdate: () => checkForUpdate,
+  currentVersion: () => currentVersion,
+  getUpdateNotification: () => getUpdateNotification
+});
+function cachePath(homeFn = defaultHomeDir2) {
+  return path20.join(homeFn(), ".wrongstack", "update-cache.json");
+}
+function currentVersion() {
+  const req2 = createRequire(import.meta.url);
+  const candidates = ["../package.json", "../../package.json"];
+  for (const rel of candidates) {
+    try {
+      const pkg = req2(rel);
+      if (typeof pkg.version === "string" && pkg.version.length > 0) return pkg.version;
+    } catch {
+    }
+  }
+  return "dev";
+}
+function isNewer(a, b) {
+  const parse = (v) => v.replace(/^v/i, "").split(".").map((p) => parseInt(p, 10) || 0);
+  const [ap, bp] = [parse(a), parse(b)];
+  for (let i = 0; i < Math.max(ap.length, bp.length); i++) {
+    const ai = ap[i] ?? 0;
+    const bi = bp[i] ?? 0;
+    if (ai > bi) return true;
+    if (ai < bi) return false;
+  }
+  return false;
+}
+async function readCache(homeFn = defaultHomeDir2) {
+  try {
+    const raw = await fs3.readFile(cachePath(homeFn), "utf8");
+    const entry = JSON.parse(raw);
+    if (Date.now() - entry.timestamp > CACHE_TTL_MS) return null;
+    return entry;
+  } catch {
+    return null;
+  }
+}
+async function writeCache(entry, homeFn = defaultHomeDir2) {
+  try {
+    const dir = path20.dirname(cachePath(homeFn));
+    await fs3.mkdir(dir, { recursive: true });
+    await fs3.writeFile(cachePath(homeFn), JSON.stringify(entry, null, 2), "utf8");
+  } catch {
+  }
+}
+async function fetchLatestFromNpm(timeoutMs = 3e3) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch("https://registry.npmjs.org/wrongstack/latest", {
+      signal: controller.signal,
+      headers: { "Accept": "application/json" }
+    });
+    clearTimeout(timer);
+    if (!res.ok) throw new Error(`npm registry responded ${res.status}`);
+    const data = await res.json();
+    if (typeof data.version === "string") return data.version;
+    throw new Error("No version field in npm response");
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkForUpdate(signal, homeFn) {
+  const current = currentVersion();
+  const aborted = () => signal?.aborted ?? false;
+  const hf = homeFn ?? defaultHomeDir2;
+  if (aborted()) {
+    return { current, latest: current, outdated: false, checkFailed: true };
+  }
+  const cached = await readCache(hf);
+  if (cached && !cached.error) {
+    return {
+      current,
+      latest: cached.latestVersion,
+      outdated: isNewer(cached.latestVersion, current),
+      checkFailed: false
+    };
+  }
+  try {
+    const latest = await fetchLatestFromNpm();
+    await writeCache({ timestamp: Date.now(), latestVersion: latest }, hf);
+    return {
+      current,
+      latest,
+      outdated: isNewer(latest, current),
+      checkFailed: false
+    };
+  } catch (err) {
+    if (aborted()) {
+      return { current, latest: current, outdated: false, checkFailed: true };
+    }
+    if (cached?.latestVersion) {
+      return {
+        current,
+        latest: cached.latestVersion,
+        outdated: isNewer(cached.latestVersion, current),
+        checkFailed: true
+      };
+    }
+    return { current, latest: current, outdated: false, checkFailed: true };
+  }
+}
+async function getUpdateNotification(signal, homeFn) {
+  const info = await checkForUpdate(signal, homeFn);
+  if (info.outdated) {
+    return `Update available: v${info.current} \u2192 v${info.latest}`;
+  }
+  return null;
+}
+var defaultHomeDir2, CACHE_TTL_MS;
+var init_update_check = __esm({
+  "src/update-check.ts"() {
+    defaultHomeDir2 = () => os6.homedir();
+    CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+  }
+});
+
 // src/webui-server.ts
 var webui_server_exports = {};
 __export(webui_server_exports, {
@@ -1006,7 +1137,7 @@ async function runWebUI(opts) {
       })
     );
   }
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     wss.on("listening", () => {
       console.log(`[WebUI] WebSocket server running on ws://localhost:${port}`);
       setupEvents();
@@ -1076,7 +1207,7 @@ async function runWebUI(opts) {
       clients.clear();
       wss.close(() => {
         console.log("[WebUI] Server stopped");
-        resolve3();
+        resolve4();
       });
     }
     process.on("SIGINT", shutdown);
@@ -1382,7 +1513,7 @@ async function runWebUI(opts) {
     if (!opts.globalConfigPath) return {};
     let raw;
     try {
-      raw = await fs5.readFile(opts.globalConfigPath, "utf8");
+      raw = await fs3.readFile(opts.globalConfigPath, "utf8");
     } catch {
       return {};
     }
@@ -1393,7 +1524,7 @@ async function runWebUI(opts) {
       return {};
     }
     if (!parsed.providers) return {};
-    const keyFile = path18.join(path18.dirname(opts.globalConfigPath), ".key");
+    const keyFile = path20.join(path20.dirname(opts.globalConfigPath), ".key");
     const vault = new DefaultSecretVault$1({ keyFile });
     return decryptConfigSecrets$1(parsed.providers, vault);
   }
@@ -1401,7 +1532,7 @@ async function runWebUI(opts) {
     if (!opts.globalConfigPath) return;
     let raw;
     try {
-      raw = await fs5.readFile(opts.globalConfigPath, "utf8");
+      raw = await fs3.readFile(opts.globalConfigPath, "utf8");
     } catch {
       raw = "{}";
     }
@@ -1412,7 +1543,7 @@ async function runWebUI(opts) {
       parsed = {};
     }
     parsed.providers = providers;
-    const keyFile = path18.join(path18.dirname(opts.globalConfigPath), ".key");
+    const keyFile = path20.join(path20.dirname(opts.globalConfigPath), ".key");
     const vault = new DefaultSecretVault$1({ keyFile });
     const encrypted = encryptConfigSecrets(parsed, vault);
     await atomicWrite(opts.globalConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
@@ -1440,6 +1571,37 @@ var init_plugin_api_factory = __esm({
   }
 });
 
+// src/slash-commands/commit-llm.ts
+async function generateCommitMessageWithLLM(diff, opts) {
+  const systemPrompt = "You are a helpful assistant that generates concise, conventional-commit-formatted git commit messages. Analyze the provided diff and output ONLY the commit message (no explanation, no quotes). Format: <type>(<scope>): <short description> \u2014 <type> is one of: feat, fix, docs, style, refactor, test, chore, perf, ci, build, temp. If the diff contains multiple unrelated changes, pick the most important one. Keep the description under 72 characters. Example: feat(cli): add /commit LLM integration";
+  const userPrompt = `Here is the git diff:
+
+${diff}`;
+  try {
+    const signal = new AbortController();
+    const timeout = setTimeout(() => signal.abort(), 15e3);
+    const resp = await opts.provider.complete(
+      {
+        model: opts.model,
+        system: [{ type: "text", text: systemPrompt }],
+        messages: [{ role: "user", content: [{ type: "text", text: userPrompt }] }],
+        maxTokens: 80,
+        temperature: 0.3
+      },
+      { signal: signal.signal }
+    );
+    clearTimeout(timeout);
+    const rawContent = resp.content;
+    const text = Array.isArray(rawContent) ? rawContent[0]?.text ?? "" : typeof rawContent === "object" && rawContent !== null ? rawContent.text ?? "" : String(rawContent);
+    const message = text.trim().split("\n")[0];
+    if (message.length > 0 && message.length < 200) {
+      return message;
+    }
+  } catch {
+  }
+  return "chore: update";
+}
+
 // src/arg-parser.ts
 var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "yolo",
@@ -1458,7 +1620,8 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "output-json",
   "prompt",
   "metrics",
-  "webui"
+  "webui",
+  "no-check"
 ]);
 function parseArgs(argv) {
   const flags = {};
@@ -1564,10 +1727,10 @@ function parseSpawnFlags(input) {
   return { description: rest.trim(), opts };
 }
 async function bootConfig(flags) {
-  const cwd = typeof flags["cwd"] === "string" ? path18.resolve(flags["cwd"]) : process.cwd();
+  const cwd = typeof flags["cwd"] === "string" ? path20.resolve(flags["cwd"]) : process.cwd();
   const pathResolver = new DefaultPathResolver(cwd);
   const projectRoot = pathResolver.projectRoot;
-  const userHome = os4.homedir();
+  const userHome = os6.homedir();
   const wpaths = resolveWstackPaths({ projectRoot, userHome });
   await ensureProjectMeta(wpaths, projectRoot);
   const vault = new DefaultSecretVault({ keyFile: wpaths.secretsKey });
@@ -1615,13 +1778,13 @@ function flagsToConfigPatch(flags) {
 }
 async function ensureProjectMeta(paths, projectRoot) {
   try {
-    await fs5.mkdir(paths.projectDir, { recursive: true });
+    await fs3.mkdir(paths.projectDir, { recursive: true });
     const meta = {
       hash: paths.projectHash,
       root: projectRoot,
       lastSeen: (/* @__PURE__ */ new Date()).toISOString()
     };
-    await fs5.writeFile(paths.projectMeta, JSON.stringify(meta, null, 2));
+    await fs3.writeFile(paths.projectMeta, JSON.stringify(meta, null, 2));
   } catch {
   }
 }
@@ -1631,11 +1794,11 @@ var ReadlineInputReader = class {
   history = [];
   pending = false;
   constructor(opts = {}) {
-    this.historyFile = opts.historyFile ?? path18.join(os4.homedir(), ".wrongstack", "history");
+    this.historyFile = opts.historyFile ?? path20.join(os6.homedir(), ".wrongstack", "history");
   }
   async loadHistory() {
     try {
-      const raw = await fs5.readFile(this.historyFile, "utf8");
+      const raw = await fs3.readFile(this.historyFile, "utf8");
       this.history = raw.split("\n").filter(Boolean).slice(-1e3);
     } catch {
       this.history = [];
@@ -1643,8 +1806,8 @@ var ReadlineInputReader = class {
   }
   async saveHistory() {
     try {
-      await fs5.mkdir(path18.dirname(this.historyFile), { recursive: true });
-      await fs5.writeFile(this.historyFile, this.history.slice(-1e3).join("\n"));
+      await fs3.mkdir(path20.dirname(this.historyFile), { recursive: true });
+      await fs3.writeFile(this.historyFile, this.history.slice(-1e3).join("\n"));
     } catch {
     }
   }
@@ -1662,7 +1825,7 @@ var ReadlineInputReader = class {
   async readLine(prompt) {
     if (this.history.length === 0) await this.loadHistory();
     while (this.pending) {
-      await new Promise((resolve3) => setTimeout(resolve3, 50));
+      await new Promise((resolve4) => setTimeout(resolve4, 50));
     }
     this.pending = true;
     try {
@@ -1672,15 +1835,15 @@ var ReadlineInputReader = class {
         this.rl = void 0;
       }
       const fresh = this.ensure();
-      return new Promise((resolve3) => {
+      return new Promise((resolve4) => {
         fresh.question(prompt ?? "> ", (line) => {
           if (line.trim()) {
             this.history.push(line);
             void this.saveHistory();
           }
-          resolve3(line);
+          resolve4(line);
         });
-        fresh.once("close", () => resolve3(""));
+        fresh.once("close", () => resolve4(""));
       }).then((result) => {
         this.rl?.close();
         this.rl = void 0;
@@ -1692,7 +1855,7 @@ var ReadlineInputReader = class {
   }
   async readKey(prompt, options) {
     process.stdout.write(prompt);
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       const stdin = process.stdin;
       const wasRaw = stdin.isRaw;
       const wasPaused = stdin.isPaused();
@@ -1703,7 +1866,7 @@ var ReadlineInputReader = class {
         if (key === "") {
           cleanup();
           process.stdout.write("\n");
-          resolve3("");
+          resolve4("");
           return;
         }
         const opt = options.find(
@@ -1713,12 +1876,12 @@ var ReadlineInputReader = class {
           cleanup();
           process.stdout.write(`${opt.key}
 `);
-          resolve3(opt.value);
+          resolve4(opt.value);
         }
       };
       const onClose = () => {
         cleanup();
-        resolve3("");
+        resolve4("");
       };
       const cleanup = () => {
         stdin.off("data", onData);
@@ -1746,7 +1909,7 @@ var ReadlineInputReader = class {
     this.rl?.close();
     this.rl = void 0;
     process.stdout.write(prompt);
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       let buf = "";
       const wasRaw = stdin.isRaw;
       stdin.setRawMode(true);
@@ -1764,7 +1927,7 @@ var ReadlineInputReader = class {
             cleanup();
             process.stdout.write(`  ${dim(`[${buf.length} chars]`)}
 `);
-            resolve3(buf);
+            resolve4(buf);
             return;
           }
           if (ch === "") {
@@ -1861,8 +2024,247 @@ async function buildPickableProviders(modelsRegistry, config) {
   }
   return out;
 }
+var PROTECTED_BASENAMES = /* @__PURE__ */ new Set([
+  "config.json",
+  ".key",
+  "index.json"
+]);
+function assertSafeToDelete(filename, parentDir) {
+  if (PROTECTED_BASENAMES.has(filename)) {
+    throw new Error(`Refusing to delete protected file: ${filename}`);
+  }
+  if (filename !== path20.basename(filename)) {
+    throw new Error(`Refusing to delete path with traversal: ${filename}`);
+  }
+  if (!filename.startsWith("config.json.") || !filename.endsWith(".bak")) {
+    throw new Error(`Refusing to delete unknown file: ${filename}`);
+  }
+  const resolvedParent = path20.resolve(parentDir);
+  if (!resolvedParent.endsWith(".wrongstack")) {
+    throw new Error(`Unexpected parent directory for bak prune: ${resolvedParent}`);
+  }
+}
+async function safeDelete(filePath) {
+  const dir = path20.dirname(filePath);
+  const filename = path20.basename(filePath);
+  try {
+    assertSafeToDelete(filename, dir);
+    await fs3.unlink(filePath);
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("Refusing")) {
+      process.stderr.write(`[config-history] SAFETY: ${err.message}
+`);
+    }
+  }
+}
+function maskConfigSecrets(cfg) {
+  if (typeof cfg !== "object" || cfg === null) return {};
+  const out = {};
+  for (const [k, v] of Object.entries(cfg)) {
+    if (k === "apiKey" || k === "apiKeys" || k === "secret" || k === "secrets") {
+      out[k] = "[REDACTED]";
+    } else if (typeof v === "object" && v !== null && !Array.isArray(v)) {
+      out[k] = maskConfigSecrets(v);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+function diffSummary(oldCfg, newCfg) {
+  const changes = [];
+  const allKeys = /* @__PURE__ */ new Set([...Object.keys(oldCfg), ...Object.keys(newCfg)]);
+  for (const k of allKeys) {
+    const o = JSON.stringify(oldCfg[k]);
+    const n = JSON.stringify(newCfg[k]);
+    if (o !== n) {
+      if (k === "apiKey" || k === "apiKeys" || k === "secret") {
+        changes.push(`${k}: [CHANGED]`);
+      } else if (typeof newCfg[k] !== "object") {
+        changes.push(`${k}: ${oldCfg[k] ?? "(unset)"} \u2192 ${newCfg[k]}`);
+      } else {
+        changes.push(`${k}: [CHANGED]`);
+      }
+    }
+  }
+  return changes.length > 0 ? changes.slice(0, 5).join(", ") : "no changes";
+}
+var defaultHomeDir = () => os6__default.homedir();
+function historyDir(homeFn = defaultHomeDir) {
+  return path20.join(homeFn(), ".wrongstack", "config.history", "entries");
+}
+function historyIndexPath(homeFn = defaultHomeDir) {
+  return path20.join(homeFn(), ".wrongstack", "config.history", "index.json");
+}
+function configPath(homeFn = defaultHomeDir) {
+  return path20.join(homeFn(), ".wrongstack", "config.json");
+}
+function backupLastPath(homeFn = defaultHomeDir) {
+  return path20.join(homeFn(), ".wrongstack", "config.json.last");
+}
+function entryId(ts) {
+  return ts.replace(/[:.]/g, "-").slice(0, 19);
+}
+async function ensureHistoryDir(homeFn = defaultHomeDir) {
+  await fs3.mkdir(historyDir(homeFn), { recursive: true });
+}
+async function readIndex(homeFn = defaultHomeDir) {
+  try {
+    const raw = await fs3.readFile(historyIndexPath(homeFn), "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return { version: 1, entries: [] };
+  }
+}
+async function writeIndex(idx, homeFn = defaultHomeDir) {
+  await ensureHistoryDir(homeFn);
+  await fs3.writeFile(historyIndexPath(homeFn), JSON.stringify(idx, null, 2), "utf8");
+}
+async function backupCurrent(homeFn = defaultHomeDir) {
+  const cfg = configPath(homeFn);
+  const last = backupLastPath(homeFn);
+  const ts = Date.now();
+  let content;
+  try {
+    content = await fs3.readFile(cfg, "utf8");
+  } catch {
+  }
+  if (content !== void 0) {
+    try {
+      await atomicWrite(last, content);
+    } catch {
+    }
+  }
+  if (content !== void 0) {
+    try {
+      const bakPath = path20.join(homeFn(), ".wrongstack", `config.json.${ts}.bak`);
+      await atomicWrite(bakPath, content);
+    } catch {
+    }
+  }
+  try {
+    const dir = path20.join(homeFn(), ".wrongstack");
+    const files = await fs3.readdir(dir);
+    const baks = files.filter((f) => f.startsWith("config.json.") && f.endsWith(".bak")).sort().reverse();
+    for (const f of baks.slice(10)) {
+      await safeDelete(path20.join(dir, f));
+    }
+  } catch {
+  }
+}
+async function appendHistory(oldCfg, newCfg, description, homeFn = defaultHomeDir) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  const id = entryId(timestamp);
+  await ensureHistoryDir(homeFn);
+  const entry = {
+    id,
+    timestamp,
+    description,
+    snapshotMasked: maskConfigSecrets(newCfg),
+    diffSummary: diffSummary(oldCfg, newCfg)
+  };
+  await fs3.writeFile(
+    path20.join(historyDir(homeFn), `${id}.json`),
+    JSON.stringify(entry, null, 2),
+    "utf8"
+  );
+  const idx = await readIndex(homeFn);
+  idx.entries.unshift({ id, timestamp, description });
+  await writeIndex(idx, homeFn);
+  return id;
+}
+async function listHistory(homeFn = defaultHomeDir) {
+  const idx = await readIndex(homeFn);
+  return idx.entries;
+}
+async function getHistoryEntry(id, homeFn = defaultHomeDir) {
+  try {
+    const raw = await fs3.readFile(path20.join(historyDir(homeFn), `${id}.json`), "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function restoreFromHistory(id, homeFn = defaultHomeDir) {
+  const entry = await getHistoryEntry(id, homeFn);
+  if (!entry) return { ok: false, backupId: null, error: "History entry not found" };
+  await backupCurrent(homeFn);
+  let oldCfg = {};
+  try {
+    const raw = await fs3.readFile(configPath(homeFn), "utf8");
+    oldCfg = JSON.parse(raw);
+  } catch {
+  }
+  try {
+    await atomicWrite(configPath(homeFn), JSON.stringify(entry.snapshotMasked, null, 2));
+  } catch (err) {
+    return { ok: false, backupId: null, error: String(err) };
+  }
+  const backupId = await appendHistory(
+    oldCfg,
+    entry.snapshotMasked,
+    `Restored from history ${id}`,
+    homeFn
+  );
+  return { ok: true, backupId };
+}
+async function restoreLast(homeFn = defaultHomeDir) {
+  const last = backupLastPath(homeFn);
+  const cfg = configPath(homeFn);
+  let oldCfg = {};
+  try {
+    const raw = await fs3.readFile(cfg, "utf8");
+    oldCfg = JSON.parse(raw);
+  } catch {
+  }
+  let lastCfg = {};
+  try {
+    const raw = await fs3.readFile(last, "utf8");
+    lastCfg = JSON.parse(raw);
+  } catch {
+    return { ok: false, error: "No prior backup found" };
+  }
+  await backupCurrent(homeFn);
+  try {
+    await atomicWrite(cfg, JSON.stringify(lastCfg, null, 2));
+  } catch (err) {
+    return { ok: false, error: String(err) };
+  }
+  await appendHistory(oldCfg, lastCfg, "Restored from config.json.last", homeFn);
+  return { ok: true };
+}
 
 // src/picker.ts
+var theme = { primary: color.amber };
+async function saveToGlobalConfig(configPath2, provider, model, homeFn = () => process.env.HOME ?? __require("os").homedir()) {
+  try {
+    const { atomicWrite: atomicWrite7 } = await import('@wrongstack/core');
+    const fs17 = await import('fs/promises');
+    let existing = {};
+    try {
+      const raw = await fs17.readFile(configPath2, "utf8");
+      existing = JSON.parse(raw);
+    } catch {
+    }
+    const oldCfg = { ...existing };
+    existing.provider = provider;
+    existing.model = model;
+    await backupCurrent(homeFn);
+    await atomicWrite7(configPath2, JSON.stringify(existing, null, 2));
+    try {
+      await appendHistory(
+        oldCfg,
+        existing,
+        `Provider/model changed: ${oldCfg.provider ?? "(none)"} \u2192 ${provider}, ${oldCfg.model ?? "(none)"} \u2192 ${model}`,
+        homeFn
+      );
+    } catch {
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function runPicker(deps) {
   const { modelsRegistry, renderer, reader, config, defaultProvider, defaultModel } = deps;
   renderer.write(
@@ -2093,28 +2495,9 @@ async function resolveModelSelection(answer, models, provider, _registry, render
 `);
   return { provider: provider.id, model: modelId };
 }
-var theme = { primary: color.amber };
-async function saveToGlobalConfig(configPath, provider, model) {
-  try {
-    const { atomicWrite: atomicWrite6 } = await import('@wrongstack/core');
-    const fs15 = await import('fs/promises');
-    let existing = {};
-    try {
-      const raw = await fs15.readFile(configPath, "utf8");
-      existing = JSON.parse(raw);
-    } catch {
-    }
-    existing.provider = provider;
-    existing.model = model;
-    await atomicWrite6(configPath, JSON.stringify(existing, null, 2));
-    return true;
-  } catch {
-    return false;
-  }
-}
 async function pathExists(file) {
   try {
-    await fs5.access(file);
+    await fs3.access(file);
     return true;
   } catch {
     return false;
@@ -2125,10 +2508,10 @@ async function detectPackageManager(root, declared) {
     const name = declared.split("@")[0];
     if (name) return name;
   }
-  if (await pathExists(path18.join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (await pathExists(path18.join(root, "bun.lockb"))) return "bun";
-  if (await pathExists(path18.join(root, "bun.lock"))) return "bun";
-  if (await pathExists(path18.join(root, "yarn.lock"))) return "yarn";
+  if (await pathExists(path20.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path20.join(root, "bun.lockb"))) return "bun";
+  if (await pathExists(path20.join(root, "bun.lock"))) return "bun";
+  if (await pathExists(path20.join(root, "yarn.lock"))) return "yarn";
   return "npm";
 }
 function hasUsableScript(scripts, name) {
@@ -2149,7 +2532,7 @@ function parseMakeTargets(makefile) {
 async function detectProjectFacts(root) {
   const facts = { hints: [] };
   try {
-    const pkg = JSON.parse(await fs5.readFile(path18.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(await fs3.readFile(path20.join(root, "package.json"), "utf8"));
     const scripts = pkg.scripts ?? {};
     const pm = await detectPackageManager(root, pkg.packageManager);
     if (hasUsableScript(scripts, "build")) facts.build = `${pm} run build`;
@@ -2163,14 +2546,14 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path18.join(root, "pyproject.toml"))) throw new Error("not python");
+    if (!await pathExists(path20.join(root, "pyproject.toml"))) throw new Error("not python");
     facts.test ??= "pytest";
     facts.lint ??= "ruff check .";
     facts.hints.push("pyproject.toml");
   } catch {
   }
   try {
-    if (!await pathExists(path18.join(root, "go.mod"))) throw new Error("not go");
+    if (!await pathExists(path20.join(root, "go.mod"))) throw new Error("not go");
     facts.build ??= "go build ./...";
     facts.test ??= "go test ./...";
     facts.run ??= "go run .";
@@ -2178,7 +2561,7 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    if (!await pathExists(path18.join(root, "Cargo.toml"))) throw new Error("not rust");
+    if (!await pathExists(path20.join(root, "Cargo.toml"))) throw new Error("not rust");
     facts.build ??= "cargo build";
     facts.test ??= "cargo test";
     facts.lint ??= "cargo clippy";
@@ -2187,7 +2570,7 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    const makefile = await fs5.readFile(path18.join(root, "Makefile"), "utf8");
+    const makefile = await fs3.readFile(path20.join(root, "Makefile"), "utf8");
     const targets = parseMakeTargets(makefile);
     facts.build ??= targets.has("build") ? "make build" : "make";
     if (targets.has("test")) facts.test ??= "make test";
@@ -2322,7 +2705,7 @@ function buildClearCommand(opts) {
   };
 }
 async function runGit(args, cwd) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const child = spawn("git", args, {
       cwd,
       stdio: ["ignore", "pipe", "pipe"]
@@ -2331,7 +2714,7 @@ async function runGit(args, cwd) {
     let stderr = "";
     child.stdout?.on("data", (d) => stdout += d);
     child.stderr?.on("data", (d) => stderr += d);
-    child.on("close", (code) => resolve3({ stdout, stderr, code: code ?? 0 }));
+    child.on("close", (code) => resolve4({ stdout, stderr, code: code ?? 0 }));
   });
 }
 function detectCommitType(stats) {
@@ -2350,7 +2733,7 @@ function detectCommitType(stats) {
   if (hasConfig) return "chore";
   return "feat";
 }
-async function generateCommitMessage(cwd) {
+async function generateCommitMessageHeuristics(cwd) {
   const statsResult = await runGit(["diff", "--stat"], cwd);
   if (statsResult.code !== 0) return "chore: update";
   const nameResult = await runGit(["diff", "--name-only"], cwd);
@@ -2381,7 +2764,7 @@ async function isGitRepo(cwd) {
   const result = await runGit(["rev-parse", "--git-dir"], cwd);
   return result.code === 0;
 }
-function buildCommitCommand(_opts) {
+function buildCommitCommand(_opts, generateCommitMessage) {
   return {
     name: "commit",
     description: "Stage all changes and commit with auto-generated message.",
@@ -2395,7 +2778,11 @@ function buildCommitCommand(_opts) {
         return { message: "Nothing to commit (working tree clean)." };
       }
       const dryRun = args.includes("--dry-run") || args.includes("-n");
-      const message = await generateCommitMessage(cwd);
+      args.includes("--no-llm");
+      let message;
+      {
+        message = await generateCommitMessageHeuristics(cwd);
+      }
       if (dryRun) {
         return {
           message: `Would commit:
@@ -2819,10 +3206,10 @@ function buildInitCommand(opts) {
     description: "Create .wrongstack/AGENTS.md project context for the system prompt.",
     async run(args, ctx) {
       const force = args.trim() === "--force";
-      const dir = path18.join(ctx.projectRoot, ".wrongstack");
-      const file = path18.join(dir, "AGENTS.md");
+      const dir = path20.join(ctx.projectRoot, ".wrongstack");
+      const file = path20.join(dir, "AGENTS.md");
       try {
-        await fs5.access(file);
+        await fs3.access(file);
         if (!force) {
           const msg2 = `AGENTS.md already exists at ${file}. Use "/init --force" to overwrite.`;
           opts.renderer.writeWarning(msg2);
@@ -2832,8 +3219,8 @@ function buildInitCommand(opts) {
       }
       const detected = await detectProjectFacts(ctx.projectRoot);
       const body = renderAgentsTemplate(detected);
-      await fs5.mkdir(dir, { recursive: true });
-      await fs5.writeFile(file, body, "utf8");
+      await fs3.mkdir(dir, { recursive: true });
+      await fs3.writeFile(file, body, "utf8");
       if (detected.hints.length > 0) {
         const msg2 = `Wrote ${file}
 Pre-filled: ${detected.hints.join(", ")}. Edit the file with project context and instructions the system prompt should carry.`;
@@ -3441,11 +3828,11 @@ ${lines.join("\n\n")}
   };
 }
 function makeInstaller(opts, projectRoot, global) {
-  const globalRoot = path18.join(os4.homedir(), ".wrongstack");
+  const globalRoot = path20.join(os6.homedir(), ".wrongstack");
   return new SkillInstaller({
-    manifestPath: path18.join(globalRoot, "installed-skills.json"),
-    projectSkillsDir: path18.join(projectRoot, ".wrongstack", "skills"),
-    globalSkillsDir: path18.join(globalRoot, "skills"),
+    manifestPath: path20.join(globalRoot, "installed-skills.json"),
+    projectSkillsDir: path20.join(projectRoot, ".wrongstack", "skills"),
+    globalSkillsDir: path20.join(globalRoot, "skills"),
     projectHash: projectHash(projectRoot),
     skillLoader: opts.skillLoader
   });
@@ -3656,13 +4043,13 @@ var MANIFESTS = [
 ];
 async function detectProjectKind(projectRoot) {
   try {
-    await fs5.access(path18.join(projectRoot, ".wrongstack", "AGENTS.md"));
+    await fs3.access(path20.join(projectRoot, ".wrongstack", "AGENTS.md"));
     return "initialized";
   } catch {
   }
   for (const m of MANIFESTS) {
     try {
-      await fs5.access(path18.join(projectRoot, m));
+      await fs3.access(path20.join(projectRoot, m));
       return "project";
     } catch {
     }
@@ -3670,12 +4057,12 @@ async function detectProjectKind(projectRoot) {
   return "empty";
 }
 async function scaffoldAgentsMd(projectRoot) {
-  const dir = path18.join(projectRoot, ".wrongstack");
-  const file = path18.join(dir, "AGENTS.md");
+  const dir = path20.join(projectRoot, ".wrongstack");
+  const file = path20.join(dir, "AGENTS.md");
   const facts = await detectProjectFacts(projectRoot);
   const body = renderAgentsTemplate(facts);
-  await fs5.mkdir(dir, { recursive: true });
-  await fs5.writeFile(file, body, "utf8");
+  await fs3.mkdir(dir, { recursive: true });
+  await fs3.writeFile(file, body, "utf8");
   return file;
 }
 async function runProjectCheck(opts) {
@@ -3684,7 +4071,7 @@ async function runProjectCheck(opts) {
   if (kind === "initialized") {
     renderer.write(
       `
-  ${color.green("\u2713")} Project initialized ${color.dim(`(${path18.join(projectRoot, ".wrongstack", "AGENTS.md")})`)}
+  ${color.green("\u2713")} Project initialized ${color.dim(`(${path20.join(projectRoot, ".wrongstack", "AGENTS.md")})`)}
 `
     );
     return true;
@@ -3711,10 +4098,10 @@ async function runProjectCheck(opts) {
     }
     return true;
   }
-  const gitDir = path18.join(projectRoot, ".git");
+  const gitDir = path20.join(projectRoot, ".git");
   let hasGit = false;
   try {
-    await fs5.access(gitDir);
+    await fs3.access(gitDir);
     hasGit = true;
   } catch {
   }
@@ -3729,10 +4116,10 @@ async function runProjectCheck(opts) {
     )).trim().toLowerCase();
     if (answer2 === "y" || answer2 === "yes") {
       try {
-        const { spawn: spawn2 } = await import('child_process');
-        await new Promise((resolve3, reject) => {
-          const child = spawn2("git", ["init"], { cwd: projectRoot });
-          child.on("close", (code) => code === 0 ? resolve3() : reject(new Error(`git init failed with ${code}`)));
+        const { spawn: spawn3 } = await import('child_process');
+        await new Promise((resolve4, reject) => {
+          const child = spawn3("git", ["init"], { cwd: projectRoot });
+          child.on("close", (code) => code === 0 ? resolve4() : reject(new Error(`git init failed with ${code}`)));
         });
         renderer.write(`  ${color.green("\u2713")} Git repository initialized
 `);
@@ -4012,14 +4399,14 @@ function summarize(value, name) {
   if (typeof v === "object" && v !== null) {
     const o = v;
     if (name === "edit") {
-      const path19 = typeof o["path"] === "string" ? o["path"] : "";
+      const path21 = typeof o["path"] === "string" ? o["path"] : "";
       const reps = typeof o["replacements"] === "number" ? o["replacements"] : 0;
-      return `${path19}  ${reps} replacement${reps === 1 ? "" : "s"}`.trim();
+      return `${path21}  ${reps} replacement${reps === 1 ? "" : "s"}`.trim();
     }
     if (name === "write") {
-      const path19 = typeof o["path"] === "string" ? o["path"] : "";
+      const path21 = typeof o["path"] === "string" ? o["path"] : "";
       const bytes = typeof o["bytes"] === "number" ? o["bytes"] : void 0;
-      return bytes !== void 0 ? `${path19}  ${bytes}B` : path19;
+      return bytes !== void 0 ? `${path21}  ${bytes}B` : path21;
     }
     if (typeof o["count"] === "number") {
       return `${o["count"]} match${o["count"] === 1 ? "" : "es"}`;
@@ -4615,7 +5002,7 @@ async function readKeyInput(deps, intent) {
 async function loadProviders(deps) {
   let raw;
   try {
-    raw = await fs5.readFile(deps.globalConfigPath, "utf8");
+    raw = await fs3.readFile(deps.globalConfigPath, "utf8");
   } catch {
     return {};
   }
@@ -4631,7 +5018,7 @@ async function loadProviders(deps) {
 async function mutateProviders(deps, mutator) {
   let raw;
   try {
-    raw = await fs5.readFile(deps.globalConfigPath, "utf8");
+    raw = await fs3.readFile(deps.globalConfigPath, "utf8");
   } catch {
     raw = "{}";
   }
@@ -4668,6 +5055,66 @@ var authCmd = async (args, deps) => {
     envVars: flags.envVars
   });
 };
+
+// src/subcommands/handlers/update.ts
+init_update_check();
+var updateCmd = async (args, deps) => {
+  const cwd = deps.cwd;
+  const checkOnly = args.includes("--check-only") || args.includes("-c");
+  const info = await checkForUpdate();
+  if (checkOnly) {
+    if (info.outdated) {
+      deps.renderer.write(`Update available: v${info.current} \u2192 v${info.latest}
+`);
+    } else {
+      deps.renderer.write(`You are on the latest version: v${info.current}
+`);
+    }
+    return 0;
+  }
+  if (!info.outdated) {
+    deps.renderer.write(`You are already on the latest version: v${info.current}
+`);
+    return 0;
+  }
+  deps.renderer.write(`Updating wrongstack from v${info.current} to v${info.latest}...
+`);
+  try {
+    const result = await new Promise((resolve4) => {
+      const child = spawn("npm", ["install", "-g", "wrongstack@latest"], {
+        cwd,
+        stdio: "pipe"
+      });
+      let stderr = "";
+      child.stderr?.on("data", (d) => {
+        stderr += d;
+      });
+      child.on("close", (code) => resolve4({ code: code ?? 0 }));
+    });
+    if (result.code === 0) {
+      deps.renderer.write(`
+Updated to v${info.latest}. Restart wrongstack to use the new version.
+`);
+    } else {
+      deps.renderer.write(`
+Update failed with exit code ${result.code}.
+`);
+    }
+    return result.code;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("ENOENT")) {
+      deps.renderer.write(`
+Update failed: npm not found in PATH.
+`);
+      return 1;
+    }
+    deps.renderer.write(`
+Update failed: ${msg}
+`);
+    return 1;
+  }
+};
 var req = createRequire(import.meta.url);
 function readOwnVersion() {
   const candidates = ["../package.json", "../../package.json"];
@@ -4703,7 +5150,7 @@ var diagCmd = async (_args, deps) => {
     `  modelsCache:   ${deps.paths.modelsCache}`,
     `  cacheAge:      ${isFinite(age) ? `${Math.round(age / 60)}m` : "never"}`,
     `  node:          ${process.version}`,
-    `  os:            ${os4.platform()} ${os4.release()}`,
+    `  os:            ${os6.platform()} ${os6.release()}`,
     `  provider:      ${cfg.provider ?? "<unset>"}`,
     `  model:         ${cfg.model ?? "<unset>"}`,
     `  tools:         ${deps.toolRegistry?.list().length ?? 0}`,
@@ -4771,7 +5218,7 @@ var doctorCmd = async (_args, deps) => {
     });
   }
   try {
-    await fs5.access(deps.paths.secretsKey);
+    await fs3.access(deps.paths.secretsKey);
     checks.push({ name: "secret vault", status: "ok", detail: deps.paths.secretsKey });
   } catch {
     checks.push({
@@ -4781,10 +5228,10 @@ var doctorCmd = async (_args, deps) => {
     });
   }
   try {
-    await fs5.mkdir(deps.paths.projectSessions, { recursive: true });
-    const probe = path18.join(deps.paths.projectSessions, `.probe-${Date.now()}`);
-    await fs5.writeFile(probe, "");
-    await fs5.unlink(probe);
+    await fs3.mkdir(deps.paths.projectSessions, { recursive: true });
+    const probe = path20.join(deps.paths.projectSessions, `.probe-${Date.now()}`);
+    await fs3.writeFile(probe, "");
+    await fs3.unlink(probe);
     checks.push({ name: "sessions writable", status: "ok", detail: deps.paths.projectSessions });
   } catch (err) {
     checks.push({
@@ -4885,8 +5332,8 @@ var exportCmd = async (args, deps) => {
     return 1;
   }
   if (output) {
-    await fs5.mkdir(path18.dirname(path18.resolve(deps.cwd, output)), { recursive: true });
-    await fs5.writeFile(path18.resolve(deps.cwd, output), rendered, "utf8");
+    await fs3.mkdir(path20.dirname(path20.resolve(deps.cwd, output)), { recursive: true });
+    await fs3.writeFile(path20.resolve(deps.cwd, output), rendered, "utf8");
     deps.renderer.write(`Wrote ${rendered.length} bytes to ${output}
 `);
   } else {
@@ -4943,17 +5390,17 @@ var initCmd = async (_args, deps) => {
   } else {
     deps.renderer.writeInfo(`Found API key in env (${provider.envVars.join(" / ")}).`);
   }
-  await fs5.mkdir(deps.paths.globalRoot, { recursive: true });
+  await fs3.mkdir(deps.paths.globalRoot, { recursive: true });
   const config = { version: 1, provider: providerId, model: modelId };
   if (apiKey) config.apiKey = apiKey;
-  const keyFile = path18.join(path18.dirname(deps.paths.globalConfig), ".key");
+  const keyFile = path20.join(path20.dirname(deps.paths.globalConfig), ".key");
   const vault = new DefaultSecretVault$1({ keyFile });
   const encrypted = encryptConfigSecrets(config, vault);
   await atomicWrite(deps.paths.globalConfig, JSON.stringify(encrypted, null, 2));
-  await fs5.mkdir(path18.join(deps.projectRoot, ".wrongstack"), { recursive: true });
-  const agentsFile = path18.join(deps.projectRoot, ".wrongstack", "AGENTS.md");
+  await fs3.mkdir(path20.join(deps.projectRoot, ".wrongstack"), { recursive: true });
+  const agentsFile = path20.join(deps.projectRoot, ".wrongstack", "AGENTS.md");
   try {
-    await fs5.access(agentsFile);
+    await fs3.access(agentsFile);
   } catch {
     const detected2 = await detectProjectFacts(deps.projectRoot);
     await atomicWrite(agentsFile, renderAgentsTemplate(detected2));
@@ -5029,7 +5476,7 @@ async function addMcpServer(args, deps) {
   serverCfg.enabled = enable;
   let existing = {};
   try {
-    existing = JSON.parse(await fs5.readFile(deps.paths.globalConfig, "utf8"));
+    existing = JSON.parse(await fs3.readFile(deps.paths.globalConfig, "utf8"));
   } catch {
   }
   const mcpServers = existing.mcpServers ?? {};
@@ -5049,7 +5496,7 @@ async function addMcpServer(args, deps) {
 async function removeMcpServer(name, deps) {
   let existing = {};
   try {
-    existing = JSON.parse(await fs5.readFile(deps.paths.globalConfig, "utf8"));
+    existing = JSON.parse(await fs3.readFile(deps.paths.globalConfig, "utf8"));
   } catch {
     deps.renderer.writeError("No config file found.\n");
     return 1;
@@ -5170,7 +5617,7 @@ function renderConfiguredPlugins(config) {
 }
 async function readConfig(file) {
   try {
-    return JSON.parse(await fs5.readFile(file, "utf8"));
+    return JSON.parse(await fs3.readFile(file, "utf8"));
   } catch {
     return {};
   }
@@ -5261,9 +5708,9 @@ var usageCmd = async (_args, deps) => {
   return 0;
 };
 var projectsCmd = async (_args, deps) => {
-  const projectsRoot = path18.join(deps.paths.globalRoot, "projects");
+  const projectsRoot = path20.join(deps.paths.globalRoot, "projects");
   try {
-    const entries = await fs5.readdir(projectsRoot);
+    const entries = await fs3.readdir(projectsRoot);
     if (entries.length === 0) {
       deps.renderer.write("No projects tracked.\n");
       return 0;
@@ -5271,7 +5718,7 @@ var projectsCmd = async (_args, deps) => {
     for (const hash of entries) {
       try {
         const meta = JSON.parse(
-          await fs5.readFile(path18.join(projectsRoot, hash, "meta.json"), "utf8")
+          await fs3.readFile(path20.join(projectsRoot, hash, "meta.json"), "utf8")
         );
         deps.renderer.write(
           `  ${color.dim(hash)}  ${color.dim(meta.lastSeen ?? "")}  ${meta.root ?? "?"}
@@ -5445,9 +5892,94 @@ var configCmd = async (args, deps) => {
 `);
     return 0;
   }
-  deps.renderer.writeError(`Unknown config subcommand: ${sub}`);
+  if (sub === "history") {
+    return runHistory(args.slice(1), deps);
+  }
+  if (sub === "restore") {
+    return runRestore(args.slice(1), deps);
+  }
+  deps.renderer.writeError(`Unknown config subcommand: ${sub}
+`);
   return 1;
 };
+function extractArg(args, key) {
+  const idx = args.indexOf(key);
+  if (idx !== -1 && args[idx + 1] !== void 0) return args[idx + 1];
+  const eq = key.startsWith("--") ? args.find((a) => a.startsWith(`${key}=`)) : null;
+  if (eq) return eq.slice(eq.indexOf("=") + 1);
+  return null;
+}
+async function runHistory(args, deps) {
+  const idFlag = extractArg(args, "--id");
+  if (idFlag) {
+    const entry = await getHistoryEntry(idFlag);
+    if (!entry) {
+      deps.renderer.writeError(`History entry '${idFlag}' not found.
+`);
+      return 1;
+    }
+    deps.renderer.write(
+      [
+        `ID:      ${entry.id}`,
+        `Time:    ${new Date(entry.timestamp).toLocaleString()}`,
+        `Change:  ${entry.description}`,
+        `Diff:    ${entry.diffSummary}`,
+        "",
+        "Snapshot (secrets masked):",
+        JSON.stringify(entry.snapshotMasked, null, 2)
+      ].join("\n") + "\n"
+    );
+    return 0;
+  }
+  const entries = await listHistory();
+  if (entries.length === 0) {
+    deps.renderer.write("No config history yet.\n");
+    return 0;
+  }
+  deps.renderer.write(
+    [
+      color.bold("Config History"),
+      "",
+      ...entries.map((e, i) => {
+        const ts = new Date(e.timestamp).toLocaleString();
+        const desc = e.description.length > 60 ? e.description.slice(0, 60) + "\u2026" : e.description;
+        return `  [${i + 1}] ${e.id}  ${color.dim(ts)}
+     ${desc}`;
+      }),
+      "",
+      "  Run `wrongstack config history --id <id>` for details.",
+      "  Run `wrongstack config restore <id>` to restore."
+    ].join("\n") + "\n"
+  );
+  return 0;
+}
+async function runRestore(args, deps) {
+  const latest = args.includes("--latest") || args.includes("-l");
+  const id = extractArg(args, "--id") ?? (args[0] && !args[0].startsWith("-") ? args[0] : null);
+  if (latest) {
+    const result2 = await restoreLast();
+    if (!result2.ok) {
+      deps.renderer.writeError(`Restore failed: ${result2.error}
+`);
+      return 1;
+    }
+    deps.renderer.write("Restored from config.json.last.\n");
+    return 0;
+  }
+  if (!id) {
+    deps.renderer.write("Usage: wrongstack config restore <id> | --latest\n");
+    return 1;
+  }
+  const result = await restoreFromHistory(id);
+  if (!result.ok) {
+    deps.renderer.writeError(`Restore failed: ${result.error}
+`);
+    return 1;
+  }
+  deps.renderer.write(`Restored to history entry '${id}'. Backup created.
+`);
+  return 0;
+}
 function parseRewindFlags(args) {
   const flags = {};
   for (let i = 0; i < args.length; i++) {
@@ -5463,7 +5995,7 @@ function parseRewindFlags(args) {
 var rewindCmd = async (args, deps) => {
   const flags = parseRewindFlags(args);
   const wpaths = resolveWstackPaths({ projectRoot: deps.projectRoot });
-  const sessionsDir = path18.join(wpaths.globalRoot, "sessions");
+  const sessionsDir = path20.join(wpaths.globalRoot, "sessions");
   const rewind = new DefaultSessionRewinder(sessionsDir);
   let sessionId = args.find((a) => !a.startsWith("--"));
   if (!sessionId) {
@@ -5595,7 +6127,7 @@ var skillsCmd = async (_args, deps) => {
 };
 var versionCmd = async (_args, deps) => {
   deps.renderer.write(
-    `WrongStack ${CLI_VERSION} (apiVersion ${API_VERSION}, node ${process.version}, ${os4.platform()})
+    `WrongStack ${CLI_VERSION} (apiVersion ${API_VERSION}, node ${process.version}, ${os6.platform()})
 `
   );
   return 0;
@@ -5633,6 +6165,7 @@ var helpCmd = async (_args, deps) => {
 var subcommands = {
   init: initCmd,
   auth: authCmd,
+  update: updateCmd,
   sessions: sessionsCmd,
   config: configCmd,
   rewind: rewindCmd,
@@ -5690,11 +6223,14 @@ function fmtTaskResultLine(r, color32) {
       return { mark: color32.red("\u2717"), stats: `${color32.red("failed")} ${stats}`, tail: errSnip };
   }
 }
+
+// src/boot.ts
+init_update_check();
 function resolveBundledSkillsDir() {
   try {
     const req2 = createRequire(import.meta.url);
     const corePkg = req2.resolve("@wrongstack/core/package.json");
-    return path18.join(path18.dirname(corePkg), "skills");
+    return path20.join(path20.dirname(corePkg), "skills");
   } catch {
     return void 0;
   }
@@ -5723,6 +6259,13 @@ async function boot(argv) {
     cacheFile: wpaths.modelsCache,
     ttlSeconds: 24 * 3600
   });
+  let updateInfo;
+  if (!flags["no-check"] && !process.env["WRONGSTACK_NO_CHECK"]) {
+    checkForUpdate().then((info) => {
+      updateInfo = info;
+    }).catch(() => {
+    });
+  }
   const first = positional[0];
   if (first && subcommands[first]) {
     const container = createDefaultContainer({
@@ -5831,7 +6374,8 @@ async function boot(argv) {
     modelsRegistry,
     renderer,
     reader,
-    logger
+    logger,
+    updateInfo
   };
 }
 
@@ -6412,7 +6956,7 @@ async function execute(deps) {
           supportsVision,
           attachments,
           effectiveMaxContext,
-          projectName: path18.basename(projectRoot) || void 0,
+          projectName: path20.basename(projectRoot) || void 0,
           getAutonomy,
           skillLoader
         });
@@ -6430,7 +6974,7 @@ async function execute(deps) {
         supportsVision,
         attachments,
         effectiveMaxContext,
-        projectName: path18.basename(projectRoot) || void 0,
+        projectName: path20.basename(projectRoot) || void 0,
         getAutonomy,
         skillLoader
       });
@@ -6702,7 +7246,7 @@ var MultiAgentHost = class {
       model: opts?.model,
       tools: opts?.tools
     };
-    const transcriptPath = this.sessionFactory ? path18.join(this.sessionFactory.dir, `${subagentConfig.name}.jsonl`) : void 0;
+    const transcriptPath = this.sessionFactory ? path20.join(this.sessionFactory.dir, `${subagentConfig.name}.jsonl`) : void 0;
     if (this.director) {
       const subagentId = await this.director.spawn(subagentConfig);
       const taskId2 = randomUUID();
@@ -6862,16 +7406,16 @@ var MultiAgentHost = class {
     }
     this.opts.directorMode = true;
     if (this.opts.fleetRoot && !this.opts.manifestPath) {
-      this.opts.manifestPath = path18.join(this.opts.fleetRoot, "fleet.json");
+      this.opts.manifestPath = path20.join(this.opts.fleetRoot, "fleet.json");
     }
     if (this.opts.fleetRoot && !this.opts.sharedScratchpadPath) {
-      this.opts.sharedScratchpadPath = path18.join(this.opts.fleetRoot, "shared");
+      this.opts.sharedScratchpadPath = path20.join(this.opts.fleetRoot, "shared");
     }
     if (this.opts.fleetRoot && !this.opts.sessionsRoot) {
-      this.opts.sessionsRoot = path18.join(this.opts.fleetRoot, "subagents");
+      this.opts.sessionsRoot = path20.join(this.opts.fleetRoot, "subagents");
     }
     if (this.opts.fleetRoot && !this.opts.stateCheckpointPath) {
-      this.opts.stateCheckpointPath = path18.join(this.opts.fleetRoot, "director-state.json");
+      this.opts.stateCheckpointPath = path20.join(this.opts.fleetRoot, "director-state.json");
     }
     await this.ensureDirector();
     return this.director ?? null;
@@ -6992,11 +7536,11 @@ var SessionStats = class {
       if (e.name === "bash") this.bashCommands++;
       else if (e.name === "fetch") this.fetches++;
       if (!e.ok) return;
-      const path19 = typeof input?.path === "string" ? input.path : void 0;
-      if (e.name === "read" && path19) this.readPaths.add(path19);
-      else if (e.name === "edit" && path19) this.editedPaths.add(path19);
-      else if (e.name === "write" && path19) {
-        this.writtenPaths.add(path19);
+      const path21 = typeof input?.path === "string" ? input.path : void 0;
+      if (e.name === "read" && path21) this.readPaths.add(path21);
+      else if (e.name === "edit" && path21) this.editedPaths.add(path21);
+      else if (e.name === "write" && path21) {
+        this.writtenPaths.add(path21);
         const content = typeof input?.content === "string" ? input.content : "";
         this.bytesWritten += Buffer.byteLength(content, "utf8");
       }
@@ -7327,12 +7871,12 @@ async function setupSession(params) {
   }
   const sessionRef = { current: session };
   await recoveryLock.write(session.id).catch(() => void 0);
-  const attachments = new DefaultAttachmentStore({ spoolDir: path18.join(wpaths.projectSessions, session.id, "attachments") });
-  const queueStore = new QueueStore({ dir: path18.join(wpaths.projectSessions, session.id) });
+  const attachments = new DefaultAttachmentStore({ spoolDir: path20.join(wpaths.projectSessions, session.id, "attachments") });
+  const queueStore = new QueueStore({ dir: path20.join(wpaths.projectSessions, session.id) });
   const ctxSignal = new AbortController().signal;
   const context = new Context({ systemPrompt, provider, session, signal: ctxSignal, tokenCounter, cwd, projectRoot, model: config.model });
   if (restoredMessages.length > 0) context.state.replaceMessages(restoredMessages);
-  const todosCheckpointPath = path18.join(wpaths.projectSessions, `${session.id}.todos.json`);
+  const todosCheckpointPath = path20.join(wpaths.projectSessions, `${session.id}.todos.json`);
   if (resumeId) {
     try {
       const restoredTodos = await loadTodosCheckpoint(todosCheckpointPath);
@@ -7344,12 +7888,12 @@ async function setupSession(params) {
     }
   }
   const detachTodosCheckpoint = attachTodosCheckpoint(context.state, todosCheckpointPath, session.id);
-  const planPath = path18.join(wpaths.projectSessions, `${session.id}.plan.json`);
+  const planPath = path20.join(wpaths.projectSessions, `${session.id}.plan.json`);
   context.state.setMeta("plan.path", planPath);
   if (resumeId) {
     try {
-      const fleetRoot = path18.join(wpaths.projectSessions, session.id);
-      const dirState = await loadDirectorState(path18.join(fleetRoot, "director-state.json"));
+      const fleetRoot = path20.join(wpaths.projectSessions, session.id);
+      const dirState = await loadDirectorState(path20.join(fleetRoot, "director-state.json"));
       if (dirState) {
         const tCounts = {};
         for (const t of dirState.tasks) tCounts[t.status] = (tCounts[t.status] ?? 0) + 1;
@@ -7376,7 +7920,7 @@ function resolveBundledSkillsDir2() {
   try {
     const req2 = createRequire(import.meta.url);
     const corePkg = req2.resolve("@wrongstack/core/package.json");
-    return path18.join(path18.dirname(corePkg), "skills");
+    return path20.join(path20.dirname(corePkg), "skills");
   } catch {
     return void 0;
   }
@@ -7407,8 +7951,28 @@ async function main(argv) {
     modelsRegistry,
     renderer,
     reader,
-    logger
+    logger,
+    updateInfo
   } = ctx;
+  if (!updateInfo?.outdated) {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), 2e3);
+    try {
+      const { checkForUpdate: checkForUpdate2 } = await Promise.resolve().then(() => (init_update_check(), update_check_exports));
+      updateInfo = await checkForUpdate2(ac.signal);
+    } catch {
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  if (updateInfo?.outdated) {
+    process.stderr.write(
+      `
+  \x1B[33m\u2191 Update available: v${updateInfo.current} \u2192 v${updateInfo.latest}\x1B[0m  Run \`wrongstack update\` to upgrade.
+
+`
+    );
+  }
   const pathResolver = new DefaultPathResolver(cwd);
   const container = createDefaultContainer({
     config,
@@ -7463,7 +8027,7 @@ async function main(argv) {
       modeId,
       modePrompt,
       modelCapabilities,
-      planPath: () => sessionRef.current ? path18.join(wpaths.projectSessions, `${sessionRef.current.id}.plan.json`) : void 0
+      planPath: () => sessionRef.current ? path20.join(wpaths.projectSessions, `${sessionRef.current.id}.plan.json`) : void 0
     })
   );
   const toolRegistry = new ToolRegistry();
@@ -7491,7 +8055,7 @@ async function main(argv) {
       name: "session-store",
       check: async () => {
         try {
-          await fs5.access(wpaths.projectSessions);
+          await fs3.access(wpaths.projectSessions);
           return { status: "healthy" };
         } catch (e) {
           return { status: "unhealthy", detail: e instanceof Error ? e.message : "access denied" };
@@ -7508,7 +8072,7 @@ async function main(argv) {
     const dumpMetrics = () => {
       if (!metricsSink) return;
       try {
-        const out = path18.join(wpaths.projectSessions, "metrics.json");
+        const out = path20.join(wpaths.projectSessions, "metrics.json");
         const snap = metricsSink.snapshot();
         writeFileSync(out, JSON.stringify(snap, null, 2));
       } catch {
@@ -7727,12 +8291,12 @@ async function main(argv) {
   const directorMode = flags["director"] === true;
   let director = null;
   let autonomyMode = "off";
-  const fleetRoot = directorMode ? path18.join(wpaths.projectSessions, session.id) : void 0;
-  const manifestPath = directorMode ? typeof process.env["WRONGSTACK_FLEET_MANIFEST"] === "string" ? process.env["WRONGSTACK_FLEET_MANIFEST"] : path18.join(fleetRoot, "fleet.json") : void 0;
-  const sharedScratchpadPath = directorMode ? path18.join(fleetRoot, "shared") : void 0;
-  const subagentSessionsRoot = directorMode ? path18.join(fleetRoot, "subagents") : void 0;
-  const stateCheckpointPath = directorMode ? path18.join(fleetRoot, "director-state.json") : void 0;
-  const fleetRootForPromotion = path18.join(wpaths.projectSessions, session.id);
+  const fleetRoot = directorMode ? path20.join(wpaths.projectSessions, session.id) : void 0;
+  const manifestPath = directorMode ? typeof process.env["WRONGSTACK_FLEET_MANIFEST"] === "string" ? process.env["WRONGSTACK_FLEET_MANIFEST"] : path20.join(fleetRoot, "fleet.json") : void 0;
+  const sharedScratchpadPath = directorMode ? path20.join(fleetRoot, "shared") : void 0;
+  const subagentSessionsRoot = directorMode ? path20.join(fleetRoot, "subagents") : void 0;
+  const stateCheckpointPath = directorMode ? path20.join(fleetRoot, "director-state.json") : void 0;
+  const fleetRootForPromotion = path20.join(wpaths.projectSessions, session.id);
   const multiAgentHost = new MultiAgentHost(
     {
       container,
@@ -7911,27 +8475,27 @@ async function main(argv) {
       return `Unknown fleet action: ${action}`;
     },
     onFleetLog: async (subagentId, mode) => {
-      const subagentsRoot = path18.join(fleetRootForPromotion, "subagents");
+      const subagentsRoot = path20.join(fleetRootForPromotion, "subagents");
       let runDirs;
       try {
-        runDirs = await fs5.readdir(subagentsRoot);
+        runDirs = await fs3.readdir(subagentsRoot);
       } catch {
         return "No fleet transcripts on disk \u2014 no subagents have been spawned for this session.";
       }
       const found = [];
       for (const runId of runDirs) {
-        const runDir = path18.join(subagentsRoot, runId);
+        const runDir = path20.join(subagentsRoot, runId);
         let files;
         try {
-          files = await fs5.readdir(runDir);
+          files = await fs3.readdir(runDir);
         } catch {
           continue;
         }
         for (const f of files) {
           if (!f.endsWith(".jsonl")) continue;
-          const full = path18.join(runDir, f);
+          const full = path20.join(runDir, f);
           try {
-            const stat2 = await fs5.stat(full);
+            const stat2 = await fs3.stat(full);
             found.push({
               runId,
               subagentId: f.replace(/\.jsonl$/, ""),
@@ -7970,7 +8534,7 @@ async function main(argv) {
         ].join("\n");
       }
       const t = matches[0];
-      const raw = await fs5.readFile(t.file, "utf8");
+      const raw = await fs3.readFile(t.file, "utf8");
       if (mode === "raw") return raw;
       const lines = raw.split("\n").filter((l) => l.trim());
       const counts = {};
@@ -8026,7 +8590,7 @@ async function main(argv) {
       }
       const dir = await multiAgentHost.ensureDirector();
       if (!dir) return "Director is not available.";
-      const dirStatePath = path18.join(fleetRootForPromotion, "director-state.json");
+      const dirStatePath = path20.join(fleetRootForPromotion, "director-state.json");
       const prior = await loadDirectorState(dirStatePath);
       if (!prior) {
         return "No prior director-state.json found \u2014 nothing to retry.";
@@ -8097,9 +8661,9 @@ async function main(argv) {
       for (const tool of director2.tools(FLEET_ROSTER)) {
         toolRegistry.register(tool);
       }
-      const mp = path18.join(fleetRootForPromotion, "fleet.json");
-      const sp = path18.join(fleetRootForPromotion, "shared");
-      const ss = path18.join(fleetRootForPromotion, "subagents");
+      const mp = path20.join(fleetRootForPromotion, "fleet.json");
+      const sp = path20.join(fleetRootForPromotion, "shared");
+      const ss = path20.join(fleetRootForPromotion, "subagents");
       const lines = [
         `${color.green("\u2713")} Promoted to director mode.`,
         `  Roster: ${Object.keys(FLEET_ROSTER).join(", ")}`,
@@ -8146,13 +8710,13 @@ Restart WrongStack to load or unload plugin code in this session.`;
       void mcpRegistry.stopAll();
     },
     onBeforeExit: async () => {
-      const { spawn: spawn2 } = await import('child_process');
+      const { spawn: spawn3 } = await import('child_process');
       const cwd2 = projectRoot;
-      const statusResult = await new Promise((resolve3) => {
-        const child = spawn2("git", ["status", "--porcelain"], { cwd: cwd2, stdio: ["ignore", "pipe", "pipe"] });
+      const statusResult = await new Promise((resolve4) => {
+        const child = spawn3("git", ["status", "--porcelain"], { cwd: cwd2, stdio: ["ignore", "pipe", "pipe"] });
         let stdout = "";
         child.stdout?.on("data", (d) => stdout += d);
-        child.on("close", (code) => resolve3({ stdout, code: code ?? 0 }));
+        child.on("close", (code) => resolve4({ stdout, code: code ?? 0 }));
       });
       if (statusResult.stdout.trim().length > 0) {
         const lines = statusResult.stdout.split("\n").filter(Boolean);
@@ -8190,7 +8754,13 @@ Restart WrongStack to load or unload plugin code in this session.`;
         ...errSection
       ].join("\n");
     },
-    onStats: () => stats.format()
+    onStats: () => stats.format(),
+    generateCommitMessage: async (diff) => {
+      return generateCommitMessageWithLLM(diff, {
+        provider: context.provider,
+        model: context.model
+      });
+    }
   });
   for (const cmd of slashCmds) slashRegistry.register(cmd);
   const savedProviderCfg = config.providers?.[config.provider];