@wrongstack/cli 0.8.4 → 0.8.6

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import * as path25 from 'path';
 import { join } from 'path';
-import * as fsp2 from 'fs/promises';
+import * as fsp3 from 'fs/promises';
 import { readdir, readFile } from 'fs/promises';
-import { color, DefaultPathResolver, TOKENS, DefaultSystemPromptBuilder, makeAutonomyPromptContributor, ToolRegistry, createContextManagerTool, EventBus, SlashCommandRegistry, createDelegateTool, FLEET_ROSTER, createMcpControlTool, EternalAutonomyEngine, DefaultLogger, DefaultModelsRegistry, ProviderRegistry, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, RecoveryLock, DefaultAttachmentStore, QueueStore, Context, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, loadPlan, createDefaultPipelines, AutoCompactionMiddleware, estimateRequestTokens, Agent, loadPlugins, FleetManager, makeDirectorSessionFactory, Director, AutoApprovePermissionPolicy, makeLLMClassifier, resolveWstackPaths, DefaultSecretVault, migratePlaintextSecrets, DefaultConfigLoader, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, atomicWrite, DefaultPluginAPI, makeAgentSubagentRunner, NULL_FLEET_BUS, AutoPhaseRunner, formatContextWindowModeList, repairToolUseAdjacency, getContextWindowMode, resolveContextWindowPolicy, AGENTS_BY_PHASE, dispatchAgent, formatTodosList, emptyPlan, clearPlan, savePlan, formatPlanTemplates, getPlanTemplate, addPlanItem, formatPlan, deriveTodosFromPlanItem, removePlanItem, setPlanItemStatus, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, DefaultTaskStore, TaskTracker, renderProgress, renderTaskGraph, loadGoal, goalFilePath, summarizeUsage, saveGoal, emptyGoal, buildGoalPreamble, formatGoal, pendingBtwCount, setBtwNote, InputBuilder, FsError, ERROR_CODES, PhaseStore, projectHash, WrongStackError, defaultOrchestrator, decryptConfigSecrets, encryptConfigSecrets as encryptConfigSecrets$1, SpecVersioning, ParallelEternalEngine, allServers as allServers$1 } from '@wrongstack/core';
+import { color, DefaultPathResolver, TOKENS, DefaultSystemPromptBuilder, makeAutonomyPromptContributor, ToolRegistry, createContextManagerTool, EventBus, SlashCommandRegistry, createDelegateTool, FLEET_ROSTER, createMcpControlTool, EternalAutonomyEngine, DefaultLogger, DefaultModelsRegistry, ProviderRegistry, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, RecoveryLock, DefaultAttachmentStore, QueueStore, Context, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, loadPlan, createDefaultPipelines, AutoCompactionMiddleware, estimateRequestTokens, Agent, loadPlugins, FleetManager, makeDirectorSessionFactory, Director, AutoApprovePermissionPolicy, PhaseStore, AutoPhasePlanner, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, makeLLMClassifier, resolveWstackPaths, DefaultSecretVault, migratePlaintextSecrets, DefaultConfigLoader, DefaultSessionReader, DefaultSessionRewinder, DefaultSessionStore, atomicWrite, DefaultPluginAPI, makeAgentSubagentRunner, NULL_FLEET_BUS, buildChildEnv, formatContextWindowModeList, repairToolUseAdjacency, getContextWindowMode, resolveContextWindowPolicy, AGENTS_BY_PHASE, dispatchAgent, formatTodosList, emptyPlan, clearPlan, savePlan, formatPlanTemplates, getPlanTemplate, addPlanItem, formatPlan, deriveTodosFromPlanItem, removePlanItem, setPlanItemStatus, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, DefaultTaskStore, TaskTracker, renderProgress, renderTaskGraph, loadGoal, goalFilePath, summarizeUsage, saveGoal, emptyGoal, buildGoalPreamble, formatGoal, pendingBtwCount, setBtwNote, InputBuilder, FsError, ERROR_CODES, projectHash, WrongStackError, defaultOrchestrator, decryptConfigSecrets, encryptConfigSecrets as encryptConfigSecrets$1, SpecVersioning, ParallelEternalEngine, allServers as allServers$1 } from '@wrongstack/core';
 import { createRequire } from 'module';
-import * as os7 from 'os';
-import os7__default from 'os';
+import * as os6 from 'os';
+import os6__default from 'os';
 import * as crypto2 from 'crypto';
 import { randomUUID } from 'crypto';
 import { DefaultSecretVault as DefaultSecretVault$1, encryptConfigSecrets, isSecretField, decryptConfigSecrets as decryptConfigSecrets$1 } from '@wrongstack/core/security';
@@ -403,7 +403,7 @@ function buildSddCommand(opts) {
           if (!sessionState.getBuilder() && !forceFlag) {
             const sessionPath = opts.paths.projectSddSession;
             try {
-              await fsp2.access(sessionPath);
+              await fsp3.access(sessionPath);
               const projectContext2 = await gatherProjectContext(opts.context?.projectRoot ?? process.cwd());
               const tempBuilder = new AISpecBuilder({
                 store: specStore,
@@ -1054,16 +1054,16 @@ Start executing the tasks one by one.`
           const sessionPath = opts.paths.projectSddSession;
           let deletedFromDisk = false;
           try {
-            await fsp2.unlink(sessionPath);
+            await fsp3.unlink(sessionPath);
             deletedFromDisk = true;
           } catch {
           }
           try {
-            await fsp2.rm(opts.paths.projectSpecs, { recursive: true, force: true });
+            await fsp3.rm(opts.paths.projectSpecs, { recursive: true, force: true });
           } catch {
           }
           try {
-            await fsp2.rm(opts.paths.projectTaskGraphs, { recursive: true, force: true });
+            await fsp3.rm(opts.paths.projectTaskGraphs, { recursive: true, force: true });
           } catch {
           }
           const cancelBuilder = sddState.getBuilder();
@@ -1399,7 +1399,7 @@ async function gatherProjectContext(projectRoot) {
   const parts = [];
   try {
     const pkgPath = path25.join(projectRoot, "package.json");
-    const pkgRaw = await fsp2.readFile(pkgPath, "utf8");
+    const pkgRaw = await fsp3.readFile(pkgPath, "utf8");
     const pkg = JSON.parse(pkgRaw);
     parts.push(`Project: ${String(pkg.name ?? "unknown")}`);
     parts.push(`Description: ${String(pkg.description ?? "none")}`);
@@ -1415,13 +1415,13 @@ async function gatherProjectContext(projectRoot) {
   }
   try {
     const tsconfigPath = path25.join(projectRoot, "tsconfig.json");
-    await fsp2.access(tsconfigPath);
+    await fsp3.access(tsconfigPath);
     parts.push("Language: TypeScript");
   } catch {
   }
   try {
     const srcDir = path25.join(projectRoot, "src");
-    const entries = await fsp2.readdir(srcDir, { withFileTypes: true });
+    const entries = await fsp3.readdir(srcDir, { withFileTypes: true });
     const dirs = entries.filter((e) => e.isDirectory()).map((e) => e.name);
     if (dirs.length > 0) {
       parts.push(`Source structure: src/${dirs.join(", src/")}`);
@@ -1603,7 +1603,7 @@ function isNewer(a, b) {
 }
 async function readCache(homeFn = defaultHomeDir2) {
   try {
-    const raw = await fsp2.readFile(cachePath(homeFn), "utf8");
+    const raw = await fsp3.readFile(cachePath(homeFn), "utf8");
     const entry = JSON.parse(raw);
     if (Date.now() - entry.timestamp > CACHE_TTL_MS) return null;
     return entry;
@@ -1614,8 +1614,8 @@ async function readCache(homeFn = defaultHomeDir2) {
 async function writeCache(entry, homeFn = defaultHomeDir2) {
   try {
     const dir = path25.dirname(cachePath(homeFn));
-    await fsp2.mkdir(dir, { recursive: true });
-    await fsp2.writeFile(cachePath(homeFn), JSON.stringify(entry, null, 2), "utf8");
+    await fsp3.mkdir(dir, { recursive: true });
+    await fsp3.writeFile(cachePath(homeFn), JSON.stringify(entry, null, 2), "utf8");
   } catch {
   }
 }
@@ -1686,7 +1686,7 @@ async function getUpdateNotification(signal, homeFn) {
 var defaultHomeDir2, CACHE_TTL_MS;
 var init_update_check = __esm({
   "src/update-check.ts"() {
-    defaultHomeDir2 = () => os7.homedir();
+    defaultHomeDir2 = () => os6.homedir();
     CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
   }
 });
@@ -1823,10 +1823,27 @@ async function runWebUI(opts) {
     });
     wss.on("connection", (ws, req2) => {
       const isLoopback = (hostname) => hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+      const tokenMatches = (provided) => {
+        if (!provided) return false;
+        const a = Buffer.from(provided);
+        const b = Buffer.from(authToken);
+        return a.length === b.length && crypto2.timingSafeEqual(a, b);
+      };
       try {
         const url = new URL(req2.url ?? "/", `http://localhost:${port}`);
         const token = url.searchParams.get("token");
-        const tokenOk = token === authToken;
+        const tokenOk = tokenMatches(token);
+        const hostHeader = (req2.headers.host ?? "").trim();
+        let hostOk = false;
+        try {
+          hostOk = !!hostHeader && isLoopback(new URL(`http://${hostHeader}`).hostname);
+        } catch {
+          hostOk = false;
+        }
+        if (!hostOk) {
+          ws.close(4003, "Forbidden: non-loopback Host header");
+          return;
+        }
         const origin = req2.headers.origin;
         if (origin) {
           try {
@@ -2206,7 +2223,7 @@ async function runWebUI(opts) {
     if (!opts.globalConfigPath) return {};
     let raw;
     try {
-      raw = await fsp2.readFile(opts.globalConfigPath, "utf8");
+      raw = await fsp3.readFile(opts.globalConfigPath, "utf8");
     } catch {
       return {};
     }
@@ -2226,7 +2243,7 @@ async function runWebUI(opts) {
     let raw;
     let fileExists = true;
     try {
-      raw = await fsp2.readFile(opts.globalConfigPath, "utf8");
+      raw = await fsp3.readFile(opts.globalConfigPath, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         throw new Error(
@@ -2459,7 +2476,7 @@ function parseSpawnFlags(input) {
 }
 async function pathExists(file) {
   try {
-    await fsp2.access(file);
+    await fsp3.access(file);
     return true;
   } catch {
     return false;
@@ -2494,7 +2511,7 @@ function parseMakeTargets(makefile) {
 async function detectProjectFacts(root) {
   const facts = { hints: [] };
   try {
-    const pkg = JSON.parse(await fsp2.readFile(path25.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(await fsp3.readFile(path25.join(root, "package.json"), "utf8"));
     const scripts = pkg.scripts ?? {};
     const pm = await detectPackageManager(root, pkg.packageManager);
     if (hasUsableScript(scripts, "build")) facts.build = `${pm} run build`;
@@ -2532,7 +2549,7 @@ async function detectProjectFacts(root) {
   } catch {
   }
   try {
-    const makefile = await fsp2.readFile(path25.join(root, "Makefile"), "utf8");
+    const makefile = await fsp3.readFile(path25.join(root, "Makefile"), "utf8");
     const targets = parseMakeTargets(makefile);
     facts.build ??= targets.has("build") ? "make build" : "make";
     if (targets.has("test")) facts.test ??= "make test";
@@ -3428,8 +3445,8 @@ function buildInitCommand(opts) {
       const file = path25.join(dir, "AGENTS.md");
       const detected = await detectProjectFacts(ctx.projectRoot);
       const body = renderAgentsTemplate(detected);
-      await fsp2.mkdir(dir, { recursive: true });
-      await fsp2.writeFile(file, body, "utf8");
+      await fsp3.mkdir(dir, { recursive: true });
+      await fsp3.writeFile(file, body, "utf8");
       if (detected.hints.length > 0) {
         const msg2 = `Wrote ${file}
 Pre-filled: ${detected.hints.join(", ")}. Edit the file with project context and instructions the system prompt should carry.`;
@@ -3618,7 +3635,7 @@ function stateBadge(state) {
 }
 async function readConfig(path26) {
   try {
-    return JSON.parse(await fsp2.readFile(path26, "utf8"));
+    return JSON.parse(await fsp3.readFile(path26, "utf8"));
   } catch {
     return {};
   }
@@ -3626,8 +3643,8 @@ async function readConfig(path26) {
 async function writeConfig(path26, cfg) {
   const raw = JSON.stringify(cfg, null, 2);
   const tmp = path26 + ".tmp";
-  await fsp2.writeFile(tmp, raw, "utf8");
-  await fsp2.rename(tmp, path26);
+  await fsp3.writeFile(tmp, raw, "utf8");
+  await fsp3.rename(tmp, path26);
 }
 
 // src/slash-commands/mcp.ts
@@ -4899,7 +4916,7 @@ function resolveConfigPath() {
 async function loadStatuslineConfig() {
   const p = resolveConfigPath();
   try {
-    const raw = await fsp2.readFile(p, "utf8");
+    const raw = await fsp3.readFile(p, "utf8");
     return { ...DEFAULTS, ...JSON.parse(raw) };
   } catch {
     return { ...DEFAULTS };
@@ -4908,7 +4925,7 @@ async function loadStatuslineConfig() {
 async function saveStatuslineConfig(cfg) {
   const p = resolveConfigPath();
   try {
-    await fsp2.mkdir(path25.dirname(p), { recursive: true });
+    await fsp3.mkdir(path25.dirname(p), { recursive: true });
     await atomicWrite(p, JSON.stringify(cfg, null, 2));
   } catch (err) {
     throw new FsError({
@@ -5807,7 +5824,7 @@ When the error confidence is low (< 0.85) or the problem spans multiple files,
   };
 }
 function makeInstaller(opts, projectRoot, global) {
-  const globalRoot = path25.join(os7.homedir(), ".wrongstack");
+  const globalRoot = path25.join(os6.homedir(), ".wrongstack");
   return new SkillInstaller({
     manifestPath: path25.join(globalRoot, "installed-skills.json"),
     projectSkillsDir: path25.join(projectRoot, ".wrongstack", "skills"),
@@ -5967,229 +5984,207 @@ function buildSkillUninstallCommand(opts) {
     }
   };
 }
-var currentRunner = null;
-var currentGraph = null;
-var DEFAULT_PHASES = [
-  {
-    name: "Discovery",
-    description: "Requirements gathering and analysis",
-    priority: "high",
-    estimateHours: 2,
-    parallelizable: false
-  },
-  {
-    name: "Design",
-    description: "Architecture and design decisions",
-    priority: "critical",
-    estimateHours: 4,
-    parallelizable: false
-  },
-  {
-    name: "Implementation",
-    description: "Core feature development",
-    priority: "critical",
-    estimateHours: 12,
-    parallelizable: false
-  },
-  {
-    name: "Testing",
-    description: "Unit, integration, and e2e tests",
-    priority: "high",
-    estimateHours: 6,
-    parallelizable: true
-  },
-  {
-    name: "Deployment",
-    description: "Deploy to production",
-    priority: "medium",
-    estimateHours: 2,
-    parallelizable: false
-  }
-];
-function getStore() {
-  const baseDir = path25.join(os7.homedir(), ".wrongstack", "autophase");
-  return new PhaseStore({ baseDir });
+function getStore(opts) {
+  return new PhaseStore({ baseDir: opts.paths.projectAutophase });
 }
 function formatProgress(p) {
-  const bars = "\u2588".repeat(Math.floor(p.percentComplete / 5)) + "\u2591".repeat(20 - Math.floor(p.percentComplete / 5));
+  const filled = Math.floor(p.percentComplete / 5);
+  const bars = "\u2588".repeat(filled) + "\u2591".repeat(20 - filled);
   return [
     `
   \u{1F4CA} Progress: ${bars} ${p.percentComplete}%`,
     `  \u{1F4CB} Phases: ${p.completed}/${p.totalPhases} done, ${p.running} running, ${p.pending} pending`,
     `  \u2705 Tasks: ${p.completedTasks}/${p.totalTasks} completed`,
-    `  \u23F1\uFE0F  Est: ${p.estimatedHours.toFixed(1)}h | Actual: ${p.actualHours.toFixed(1)}h`
+    `  \u23F1  Est: ${p.estimatedHours.toFixed(1)}h | Actual: ${p.actualHours.toFixed(1)}h`
   ].join("\n");
 }
+var STATUS_EMOJI = {
+  pending: "\u23F3",
+  ready: "\u{1F51C}",
+  running: "\u{1F504}",
+  paused: "\u23F8",
+  completed: "\u2705",
+  failed: "\u274C",
+  skipped: "\u23ED"
+};
 function formatPhaseList(graph) {
   const phases = Array.from(graph.phases.values());
-  const statusEmoji = {
-    pending: "\u23F3",
-    ready: "\u{1F51C}",
-    running: "\u{1F504}",
-    paused: "\u23F8\uFE0F",
-    completed: "\u2705",
-    failed: "\u274C",
-    skipped: "\u23ED\uFE0F"
-  };
-  return phases.map((p, i) => {
-    const emoji = statusEmoji[p.status] ?? "\u26AA";
-    const progress = p.taskGraph.nodes.size > 0 ? `${Array.from(p.taskGraph.nodes.values()).filter((t) => t.status === "completed").length}/${p.taskGraph.nodes.size}` : "0/0";
-    return `  ${i + 1}. ${emoji} ${p.name} (${p.status}) \u2014 ${progress} tasks`;
-  }).join("\n");
+  return [
+    "",
+    "Phases:",
+    ...phases.map((p) => {
+      const total = p.taskGraph.nodes.size;
+      const done = Array.from(p.taskGraph.nodes.values()).filter((t) => t.status === "completed").length;
+      const tasks = total > 0 ? ` (${done}/${total} todos)` : "";
+      return `  ${STATUS_EMOJI[p.status] ?? "?"} ${p.name}: ${p.status}${tasks}`;
+    })
+  ].join("\n");
 }
-var autophaseCommand = {
-  name: "autophase",
-  description: "Otonom faz tabanl\u0131 i\u015F ak\u0131\u015F\u0131 \u2014 projeyi fazlara b\xF6l ve otonom \xE7al\u0131\u015Ft\u0131r",
-  argsHint: "[start|pause|resume|stop|status|list|load|save] [args...]",
-  async run(args, _ctx) {
-    const parts = args.trim().split(/\s+/).filter(Boolean);
-    const sub = parts[0] ?? "status";
-    const store = getStore();
-    switch (sub) {
-      case "start": {
-        const title = parts.slice(1).join(" ") || "Untitled Project";
-        const runLog = [];
-        const log = (line) => runLog.push(line);
-        log(`\u{1F680} AutoPhase ba\u015Flat\u0131l\u0131yor: ${title}`);
-        currentRunner = new AutoPhaseRunner({
-          title,
-          phases: DEFAULT_PHASES,
-          executeTask: async (task, phaseId) => {
-            log(`  [${phaseId}] Executing: ${task.title}`);
-            await new Promise((r) => setTimeout(r, 500));
-            log(`  [${phaseId}] \u2705 Completed: ${task.title}`);
-          },
-          onPhaseComplete: (phase) => {
-            log(`\u2705 Phase tamamland\u0131: ${phase.name} (${phase.actualDurationMs ? (phase.actualDurationMs / 6e4).toFixed(1) : 0}m)`);
-          },
-          onPhaseFail: (phase, error) => {
-            log(`\u274C Phase ba\u015Far\u0131s\u0131z: ${phase.name} \u2014 ${error.message}`);
-          },
-          onProgress: (progress) => {
-            if (progress.percentComplete % 10 === 0) {
-              log(formatProgress(progress));
-            }
-          },
-          onComplete: (graph) => {
-            log(`\u{1F389} T\xFCm fazlar tamamland\u0131! ${graph.title}`);
-          },
-          onFail: (_graph, phase, error) => {
-            log(`\u{1F4A5} AutoPhase durdu: ${phase.name} \u2014 ${error.message}`);
-          },
-          autonomous: true,
-          maxConcurrentPhases: 1,
-          maxConcurrentTasks: 2
-        });
-        currentGraph = await currentRunner.start();
-        await store.save(currentGraph);
-        return {
-          message: [
-            `AutoPhase ba\u015Flat\u0131ld\u0131: **${title}**`,
-            "",
-            formatPhaseList(currentGraph),
-            ...runLog.length > 0 ? ["", "---", ...runLog] : []
-          ].join("\n")
-        };
-      }
-      case "pause": {
-        if (!currentRunner) {
-          return { message: "\u274C Aktif AutoPhase yok. \xD6nce `/autophase start` \xE7al\u0131\u015Ft\u0131r\u0131n." };
+async function gatherProjectContext2(projectRoot) {
+  try {
+    const raw = await fsp3.readFile(path25.join(projectRoot, "package.json"), "utf8");
+    const pkg = JSON.parse(raw);
+    const parts = [
+      `Project: ${String(pkg.name ?? "unknown")}`,
+      pkg.description ? `Description: ${String(pkg.description)}` : ""
+    ].filter(Boolean);
+    return parts.join("\n") || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function buildAutoPhaseCommand(opts) {
+  return {
+    name: "autophase",
+    description: "Autonomous phase-based workflow \u2014 plans a project into phases of todos and builds it with the LLM.",
+    help: [
+      "Usage:",
+      "  /autophase                 Show current status",
+      "  /autophase start <goal>    Plan + start an autonomous phase build",
+      "  /autophase pause           Pause (in-flight tasks finish, no new ones start)",
+      "  /autophase resume          Resume a paused run",
+      "  /autophase stop            Stop and abort in-flight tasks",
+      "  /autophase save            Persist current graph to disk",
+      "  /autophase load [title]    Load a persisted graph (display only)",
+      "  /autophase list            List saved projects",
+      ""
+    ].join("\n"),
+    async run(args) {
+      const parts = args.trim().split(/\s+/).filter(Boolean);
+      const sub = parts[0] ?? "status";
+      const store = getStore(opts);
+      switch (sub) {
+        case "start": {
+          const goal = parts.slice(1).join(" ").trim();
+          if (!goal) {
+            return { message: "Usage: /autophase start <goal>  \u2014 describe what to build." };
+          }
+          if (!opts.onAutoPhaseStart) {
+            return { message: "\u274C AutoPhase is not available in this session (no LLM host wired)." };
+          }
+          const projectContext = await gatherProjectContext2(opts.projectRoot);
+          const result = await opts.onAutoPhaseStart({ goal, projectContext });
+          if (!result.ok) {
+            return { message: `\u274C ${result.error}` };
+          }
+          return {
+            message: [
+              `\u{1F680} AutoPhase started: **${result.graph.title}**`,
+              formatPhaseList(result.graph),
+              "",
+              "Building autonomously in the background \u2014 one subagent per todo.",
+              "Use `/autophase` for status, `/autophase pause` to hold, `/autophase stop` to abort."
+            ].join("\n"),
+            metadata: { autoPhaseInit: { title: result.graph.title } }
+          };
         }
-        currentRunner.pause();
-        return { message: "\u23F8\uFE0F AutoPhase duraklat\u0131ld\u0131. Devam etmek i\xE7in `/autophase resume`" };
-      }
-      case "resume": {
-        if (!currentRunner) {
-          return { message: "\u274C Aktif AutoPhase yok. \xD6nce `/autophase start` \xE7al\u0131\u015Ft\u0131r\u0131n." };
+        case "pause": {
+          if (!opts.onAutoPhasePause) return { message: "\u274C AutoPhase host not available." };
+          opts.onAutoPhasePause();
+          return { message: "\u23F8\uFE0F AutoPhase paused \u2014 running tasks will finish; no new ones will start." };
         }
-        currentRunner.resume();
-        return { message: "\u25B6\uFE0F AutoPhase devam ediyor." };
-      }
-      case "stop": {
-        if (!currentRunner) {
-          return { message: "\u274C Aktif AutoPhase yok." };
+        case "resume": {
+          if (!opts.onAutoPhaseResume) return { message: "\u274C AutoPhase host not available." };
+          opts.onAutoPhaseResume();
+          return { message: "\u25B6 AutoPhase resuming." };
         }
-        currentRunner.stop();
-        currentRunner = null;
-        return { message: "\u{1F6D1} AutoPhase durduruldu." };
-      }
-      case "status": {
-        if (!currentRunner || !currentGraph) {
+        case "stop": {
+          if (!opts.onAutoPhaseStop) return { message: "\u274C AutoPhase host not available." };
+          opts.onAutoPhaseStop();
+          return { message: "\u23F9 AutoPhase stopped \u2014 in-flight tasks aborted, progress saved." };
+        }
+        case "save": {
+          const view = opts.getAutoPhaseRunner?.();
+          if (!view) return { message: "\u274C No active AutoPhase to save." };
+          await store.save(view.graph);
+          return { message: `\u{1F4BE} AutoPhase saved: ${view.graph.title}` };
+        }
+        case "load": {
+          const title = parts.slice(1).join(" ").trim();
           const graphs = await store.list();
-          if (graphs.length === 0) {
-            return { message: "Aktif AutoPhase yok. Ba\u015Flatmak i\xE7in `/autophase start [title]`" };
-          }
-          const list = graphs.slice(0, 5).map((g) => `  \u2022 ${g.title} (${g.status})`).join("\n");
-          return { message: `Kay\u0131tl\u0131 AutoPhase projeleri:
-${list}` };
-        }
-        const progress = currentRunner.getProgress();
-        const phaseList = formatPhaseList(currentGraph);
-        return {
-          message: [
-            `**${currentGraph.title}**`,
-            progress ? formatProgress(progress) : "",
-            "",
-            "**Fazlar:**",
-            phaseList,
-            "",
-            currentRunner.isPaused() ? "\u23F8\uFE0F Duraklat\u0131ld\u0131" : currentRunner.isRunning() ? "\u{1F504} \xC7al\u0131\u015F\u0131yor" : "\u23F9\uFE0F Durdu"
-          ].join("\n")
-        };
-      }
-      case "list": {
-        const graphs = await store.list();
-        if (graphs.length === 0) {
-          return { message: "Kay\u0131tl\u0131 AutoPhase projesi yok." };
+          if (graphs.length === 0) return { message: "\u274C No saved projects." };
+          const entry = title ? graphs.find((g) => g.title.toLowerCase().includes(title.toLowerCase())) : graphs[0];
+          if (!entry) return { message: `\u274C No saved project matching "${title}".` };
+          const graph = await store.load(entry.id);
+          if (!graph) return { message: `\u274C Could not load project "${entry.title}".` };
+          return {
+            message: [`\u{1F4C2} Loaded (display only): **${graph.title}**`, formatPhaseList(graph)].join("\n")
+          };
         }
-        const list = graphs.map((g) => {
-          const statusEmoji = g.status === "completed" ? "\u2705" : g.status === "in_progress" ? "\u{1F504}" : "\u23F3";
-          return `  ${statusEmoji} ${g.title} (g\xFCncelleme: ${new Date(g.updatedAt).toLocaleDateString("tr-TR")})`;
-        }).join("\n");
-        return { message: `**Kay\u0131tl\u0131 Projeler:**
-${list}` };
-      }
-      case "load": {
-        const graphId = parts[1];
-        if (!graphId) {
-          return { message: "\u274C Graph ID gerekli. Kullan\u0131m: `/autophase load <id>`" };
+        case "list": {
+          const graphs = await store.list();
+          if (graphs.length === 0) return { message: "No saved projects." };
+          return {
+            message: [
+              "Saved AutoPhase projects:",
+              ...graphs.map((g) => `  \xB7 ${g.title} \u2014 ${g.status} (updated ${new Date(g.updatedAt).toLocaleString()})`)
+            ].join("\n")
+          };
         }
-        const graph = await store.load(graphId);
-        if (!graph) {
-          return { message: `\u274C Graph bulunamad\u0131: ${graphId}` };
+        case "default":
+        case "status": {
+          const view = opts.getAutoPhaseRunner?.();
+          if (!view) {
+            return { message: "No active AutoPhase. Run `/autophase start <goal>` to begin." };
+          }
+          const progress = view.getProgress();
+          return {
+            message: [
+              `**${view.graph.title}** ${view.isRunning() ? "\u{1F504} running" : "\u23F8 idle"}`,
+              formatPhaseList(view.graph),
+              ...progress ? [formatProgress(progress)] : []
+            ].join("\n")
+          };
         }
-        currentGraph = graph;
-        return {
-          message: `**${graph.title}** y\xFCklendi.
+      }
+    }
+  };
+}
 
-${formatPhaseList(graph)}`
-        };
+// src/slash-commands/worktree.ts
+function buildWorktreeCommand(opts) {
+  return {
+    name: "worktree",
+    aliases: ["wt"],
+    description: "Inspect/manage git worktrees used for AutoPhase per-phase isolation.",
+    argsHint: "[list | merge <branch> | prune | clean]",
+    help: [
+      "Usage: /worktree [subcommand]",
+      "",
+      "  list             List active worktrees (default).",
+      "  merge <branch>   Squash-merge <branch> into the current branch.",
+      "  prune            Remove stale worktree administrative entries.",
+      "  clean            Remove all wstack-managed worktrees and branches.",
+      "",
+      "AutoPhase allocates one worktree per phase under .wrongstack/worktrees/",
+      "so parallelizable phases run isolated, then merge back sequentially."
+    ].join("\n"),
+    async run(args) {
+      if (!opts.onWorktree) {
+        return { message: "\u26A0 No worktree manager active in this session." };
       }
-      case "save": {
-        if (!currentGraph) {
-          return { message: "\u274C Kaydedilecek aktif graph yok." };
-        }
-        await store.save(currentGraph);
-        return { message: `\u2705 **${currentGraph.title}** kaydedildi.` };
+      const parts = args.trim().split(/\s+/).filter(Boolean);
+      const sub = (parts[0] ?? "list").toLowerCase();
+      switch (sub) {
+        case "list":
+          return { message: await opts.onWorktree("list") };
+        case "merge": {
+          const branch = parts[1];
+          if (!branch) return { message: "Usage: /worktree merge <branch>" };
+          return { message: await opts.onWorktree("merge", branch) };
+        }
+        case "prune":
+          return { message: await opts.onWorktree("prune") };
+        case "clean":
+          return { message: await opts.onWorktree("clean") };
+        default:
+          return {
+            message: `Unknown subcommand "${sub}". Valid: list, merge <branch>, prune, clean.`
+          };
       }
-      default:
-        return {
-          message: [
-            "**AutoPhase Komutlar\u0131:**",
-            "",
-            "`/autophase start [title]` \u2014 Yeni proje ba\u015Flat",
-            "`/autophase pause` \u2014 Duraklat",
-            "`/autophase resume` \u2014 Devam et",
-            "`/autophase stop` \u2014 Durdur",
-            "`/autophase status` \u2014 Durum g\xF6ster",
-            "`/autophase list` \u2014 Kay\u0131tl\u0131 projeleri listele",
-            "`/autophase load <id>` \u2014 Projeyi y\xFCkle",
-            "`/autophase save` \u2014 Aktif projeyi kaydet"
-          ].join("\n")
-        };
     }
-  }
-};
+  };
+}
 
 // src/slash-commands/index.ts
 function buildBuiltinSlashCommands(opts) {
@@ -6232,7 +6227,8 @@ function buildBuiltinSlashCommands(opts) {
     buildPushCommand(),
     buildSecurityCommand(opts),
     buildFixCommand(opts),
-    autophaseCommand,
+    buildAutoPhaseCommand(opts),
+    buildWorktreeCommand(opts),
     buildStatuslineCommand({
       cwd: opts.cwd,
       hiddenItems: opts.statuslineHiddenItems ?? [],
@@ -6260,13 +6256,13 @@ var MANIFESTS = [
 ];
 async function detectProjectKind(projectRoot) {
   try {
-    await fsp2.access(path25.join(projectRoot, ".wrongstack", "AGENTS.md"));
+    await fsp3.access(path25.join(projectRoot, ".wrongstack", "AGENTS.md"));
     return "initialized";
   } catch {
   }
   for (const m of MANIFESTS) {
     try {
-      await fsp2.access(path25.join(projectRoot, m));
+      await fsp3.access(path25.join(projectRoot, m));
       return "project";
     } catch {
     }
@@ -6278,8 +6274,8 @@ async function scaffoldAgentsMd(projectRoot) {
   const file = path25.join(dir, "AGENTS.md");
   const facts = await detectProjectFacts(projectRoot);
   const body = renderAgentsTemplate(facts);
-  await fsp2.mkdir(dir, { recursive: true });
-  await fsp2.writeFile(file, body, "utf8");
+  await fsp3.mkdir(dir, { recursive: true });
+  await fsp3.writeFile(file, body, "utf8");
   return file;
 }
 async function runProjectCheck(opts) {
@@ -6322,7 +6318,7 @@ async function runProjectCheck(opts) {
   const gitDir = path25.join(projectRoot, ".git");
   let hasGit = false;
   try {
-    await fsp2.access(gitDir);
+    await fsp3.access(gitDir);
     hasGit = true;
   } catch {
   }
@@ -6341,9 +6337,9 @@ async function runProjectCheck(opts) {
     }
     if (answer2 === "y" || answer2 === "yes") {
       try {
-        const { spawn: spawn3 } = await import('child_process');
+        const { spawn: spawn4 } = await import('child_process');
         await new Promise((resolve4, reject) => {
-          const child = spawn3("git", ["init"], { cwd: projectRoot });
+          const child = spawn4("git", ["init"], { cwd: projectRoot });
           child.on("error", reject);
           child.on("close", (code) => code === 0 ? resolve4() : reject(new Error(`git init failed with ${code}`)));
         });
@@ -6447,7 +6443,7 @@ async function bootConfig(flags) {
   const cwd = typeof flags["cwd"] === "string" ? path25.resolve(flags["cwd"]) : process.cwd();
   const pathResolver = new DefaultPathResolver(cwd);
   const projectRoot = pathResolver.projectRoot;
-  const userHome = os7.homedir();
+  const userHome = os6.homedir();
   const wpaths = resolveWstackPaths({ projectRoot, userHome });
   await ensureProjectMeta(wpaths, projectRoot);
   const vault = new DefaultSecretVault({ keyFile: wpaths.secretsKey });
@@ -6495,13 +6491,13 @@ function flagsToConfigPatch(flags) {
 }
 async function ensureProjectMeta(paths, projectRoot) {
   try {
-    await fsp2.mkdir(paths.projectDir, { recursive: true });
+    await fsp3.mkdir(paths.projectDir, { recursive: true });
     const meta = {
       hash: paths.projectHash,
       root: projectRoot,
       lastSeen: (/* @__PURE__ */ new Date()).toISOString()
     };
-    await fsp2.writeFile(paths.projectMeta, JSON.stringify(meta, null, 2));
+    await fsp3.writeFile(paths.projectMeta, JSON.stringify(meta, null, 2));
   } catch {
   }
 }
@@ -6511,11 +6507,11 @@ var ReadlineInputReader = class {
   history = [];
   pending = false;
   constructor(opts = {}) {
-    this.historyFile = opts.historyFile ?? path25.join(os7.homedir(), ".wrongstack", "history");
+    this.historyFile = opts.historyFile ?? path25.join(os6.homedir(), ".wrongstack", "history");
   }
   async loadHistory() {
     try {
-      const raw = await fsp2.readFile(this.historyFile, "utf8");
+      const raw = await fsp3.readFile(this.historyFile, "utf8");
       this.history = raw.split("\n").filter(Boolean).slice(-1e3);
     } catch {
       this.history = [];
@@ -6523,8 +6519,8 @@ var ReadlineInputReader = class {
   }
   async saveHistory() {
     try {
-      await fsp2.mkdir(path25.dirname(this.historyFile), { recursive: true });
-      await fsp2.writeFile(this.historyFile, this.history.slice(-1e3).join("\n"));
+      await fsp3.mkdir(path25.dirname(this.historyFile), { recursive: true });
+      await fsp3.writeFile(this.historyFile, this.history.slice(-1e3).join("\n"));
     } catch {
     }
   }
@@ -6766,7 +6762,7 @@ async function safeDelete(filePath) {
   const filename = path25.basename(filePath);
   try {
     assertSafeToDelete(filename, dir);
-    await fsp2.unlink(filePath);
+    await fsp3.unlink(filePath);
   } catch (err) {
     if (err instanceof Error && err.message.startsWith("Refusing")) {
       process.stderr.write(`[config-history] SAFETY: ${err.message}
@@ -6806,7 +6802,7 @@ function diffSummary(oldCfg, newCfg) {
   }
   return changes.length > 0 ? changes.slice(0, 5).join(", ") : "no changes";
 }
-var defaultHomeDir = () => os7__default.homedir();
+var defaultHomeDir = () => os6__default.homedir();
 function historyDir(homeFn = defaultHomeDir) {
   return path25.join(homeFn(), ".wrongstack", "config.history", "entries");
 }
@@ -6824,7 +6820,7 @@ function entryId(ts) {
 }
 async function ensureHistoryDir(homeFn = defaultHomeDir) {
   try {
-    await fsp2.mkdir(historyDir(homeFn), { recursive: true });
+    await fsp3.mkdir(historyDir(homeFn), { recursive: true });
   } catch (err) {
     throw new FsError({
       message: err instanceof Error ? err.message : String(err),
@@ -6836,7 +6832,7 @@ async function ensureHistoryDir(homeFn = defaultHomeDir) {
 }
 async function readIndex(homeFn = defaultHomeDir) {
   try {
-    const raw = await fsp2.readFile(historyIndexPath(homeFn), "utf8");
+    const raw = await fsp3.readFile(historyIndexPath(homeFn), "utf8");
     return JSON.parse(raw);
   } catch {
     return { version: 1, entries: [] };
@@ -6861,7 +6857,7 @@ async function backupCurrent(homeFn = defaultHomeDir) {
   const ts = Date.now();
   let content;
   try {
-    content = await fsp2.readFile(cfg, "utf8");
+    content = await fsp3.readFile(cfg, "utf8");
   } catch {
   }
   if (content !== void 0) {
@@ -6879,7 +6875,7 @@ async function backupCurrent(homeFn = defaultHomeDir) {
   }
   try {
     const dir = path25.join(homeFn(), ".wrongstack");
-    const files = await fsp2.readdir(dir);
+    const files = await fsp3.readdir(dir);
     const baks = files.filter((f) => f.startsWith("config.json.") && f.endsWith(".bak")).sort().reverse();
     for (const f of baks.slice(10)) {
       await safeDelete(path25.join(dir, f));
@@ -6899,7 +6895,7 @@ async function appendHistory(oldCfg, newCfg, description, homeFn = defaultHomeDi
     diffSummary: diffSummary(oldCfg, newCfg)
   };
   try {
-    await fsp2.writeFile(
+    await fsp3.writeFile(
       path25.join(historyDir(homeFn), `${id}.json`),
       JSON.stringify(entry, null, 2),
       "utf8"
@@ -6923,7 +6919,7 @@ async function listHistory(homeFn = defaultHomeDir) {
 }
 async function getHistoryEntry(id, homeFn = defaultHomeDir) {
   try {
-    const raw = await fsp2.readFile(path25.join(historyDir(homeFn), `${id}.json`), "utf8");
+    const raw = await fsp3.readFile(path25.join(historyDir(homeFn), `${id}.json`), "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -6935,7 +6931,7 @@ async function restoreFromHistory(id, homeFn = defaultHomeDir) {
   await backupCurrent(homeFn);
   let oldCfg = {};
   try {
-    const raw = await fsp2.readFile(configPath(homeFn), "utf8");
+    const raw = await fsp3.readFile(configPath(homeFn), "utf8");
     oldCfg = JSON.parse(raw);
   } catch {
   }
@@ -6957,13 +6953,13 @@ async function restoreLast(homeFn = defaultHomeDir) {
   const cfg = configPath(homeFn);
   let oldCfg = {};
   try {
-    const raw = await fsp2.readFile(cfg, "utf8");
+    const raw = await fsp3.readFile(cfg, "utf8");
     oldCfg = JSON.parse(raw);
   } catch {
   }
   let lastCfg = {};
   try {
-    const raw = await fsp2.readFile(last, "utf8");
+    const raw = await fsp3.readFile(last, "utf8");
     lastCfg = JSON.parse(raw);
   } catch {
     return { ok: false, error: "No prior backup found" };
@@ -6994,7 +6990,7 @@ async function saveToGlobalConfig(configPath2, provider, model, homeFn = () => p
     existing.provider = provider;
     existing.model = model;
     await backupCurrent(homeFn);
-    await atomicWrite8(configPath2, JSON.stringify(existing, null, 2));
+    await atomicWrite8(configPath2, JSON.stringify(existing, null, 2), { mode: 384 });
     try {
       await appendHistory(
         oldCfg,
@@ -8424,7 +8420,7 @@ async function readKeyInput(deps, intent) {
 async function loadProviders(deps) {
   let raw;
   try {
-    raw = await fsp2.readFile(deps.globalConfigPath, "utf8");
+    raw = await fsp3.readFile(deps.globalConfigPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       deps.renderer.writeWarning(
@@ -8449,7 +8445,7 @@ async function mutateProviders(deps, mutator) {
   let raw;
   let fileExists = true;
   try {
-    raw = await fsp2.readFile(deps.globalConfigPath, "utf8");
+    raw = await fsp3.readFile(deps.globalConfigPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       throw new Error(
@@ -8595,7 +8591,7 @@ var diagCmd = async (_args, deps) => {
     `  modelsCache:   ${deps.paths.modelsCache}`,
     `  cacheAge:      ${isFinite(age) ? `${Math.round(age / 60)}m` : "never"}`,
     `  node:          ${process.version}`,
-    `  os:            ${os7.platform()} ${os7.release()}`,
+    `  os:            ${os6.platform()} ${os6.release()}`,
     `  provider:      ${cfg.provider ?? "<unset>"}`,
     `  model:         ${cfg.model ?? "<unset>"}`,
     `  tools:         ${deps.toolRegistry?.list().length ?? 0}`,
@@ -8663,7 +8659,7 @@ var doctorCmd = async (_args, deps) => {
     });
   }
   try {
-    await fsp2.access(deps.paths.secretsKey);
+    await fsp3.access(deps.paths.secretsKey);
     checks.push({ name: "secret vault", status: "ok", detail: deps.paths.secretsKey });
   } catch {
     checks.push({
@@ -8673,10 +8669,10 @@ var doctorCmd = async (_args, deps) => {
     });
   }
   try {
-    await fsp2.mkdir(deps.paths.projectSessions, { recursive: true });
+    await fsp3.mkdir(deps.paths.projectSessions, { recursive: true });
     const probe = path25.join(deps.paths.projectSessions, `.probe-${Date.now()}`);
-    await fsp2.writeFile(probe, "");
-    await fsp2.unlink(probe);
+    await fsp3.writeFile(probe, "");
+    await fsp3.unlink(probe);
     checks.push({ name: "sessions writable", status: "ok", detail: deps.paths.projectSessions });
   } catch (err) {
     checks.push({
@@ -8777,8 +8773,8 @@ var exportCmd = async (args, deps) => {
     return 1;
   }
   if (output) {
-    await fsp2.mkdir(path25.dirname(path25.resolve(deps.cwd, output)), { recursive: true });
-    await fsp2.writeFile(path25.resolve(deps.cwd, output), rendered, "utf8");
+    await fsp3.mkdir(path25.dirname(path25.resolve(deps.cwd, output)), { recursive: true });
+    await fsp3.writeFile(path25.resolve(deps.cwd, output), rendered, "utf8");
     deps.renderer.write(`Wrote ${rendered.length} bytes to ${output}
 `);
   } else {
@@ -8845,13 +8841,13 @@ var initCmd = async (_args, deps) => {
   } else {
     deps.renderer.writeInfo(`Found API key in env (${provider.envVars.join(" / ")}).`);
   }
-  await fsp2.mkdir(deps.paths.globalRoot, { recursive: true });
+  await fsp3.mkdir(deps.paths.globalRoot, { recursive: true });
   const config = { version: 1, provider: providerId, model: modelId };
   if (apiKey) config.apiKey = apiKey;
   const vault = new DefaultSecretVault$1({ keyFile: deps.paths.secretsKey });
   const encrypted = encryptConfigSecrets(config, vault);
-  await atomicWrite(deps.paths.globalConfig, JSON.stringify(encrypted, null, 2));
-  await fsp2.mkdir(path25.join(deps.projectRoot, ".wrongstack"), { recursive: true });
+  await atomicWrite(deps.paths.globalConfig, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  await fsp3.mkdir(path25.join(deps.projectRoot, ".wrongstack"), { recursive: true });
   const agentsFile = path25.join(deps.projectRoot, ".wrongstack", "AGENTS.md");
   const projectFacts = await detectProjectFacts(deps.projectRoot);
   await atomicWrite(agentsFile, renderAgentsTemplate(projectFacts));
@@ -8926,7 +8922,7 @@ async function addMcpServer(args, deps) {
   serverCfg.enabled = enable;
   let existing = {};
   try {
-    existing = JSON.parse(await fsp2.readFile(deps.paths.globalConfig, "utf8"));
+    existing = JSON.parse(await fsp3.readFile(deps.paths.globalConfig, "utf8"));
   } catch {
   }
   const mcpServers = existing.mcpServers ?? {};
@@ -8935,7 +8931,7 @@ async function addMcpServer(args, deps) {
 `);
   mcpServers[name] = serverCfg;
   existing.mcpServers = mcpServers;
-  await atomicWrite(deps.paths.globalConfig, JSON.stringify(existing, null, 2));
+  await atomicWrite(deps.paths.globalConfig, JSON.stringify(existing, null, 2), { mode: 384 });
   const verb = enable ? "Enabled" : "Added (disabled \u2014 set enabled:true to activate)";
   deps.renderer.writeInfo(
     `${verb} "${name}" (${serverCfg.transport}). Config written to ${deps.paths.globalConfig}.
@@ -8946,7 +8942,7 @@ async function addMcpServer(args, deps) {
 async function removeMcpServer(name, deps) {
   let existing = {};
   try {
-    existing = JSON.parse(await fsp2.readFile(deps.paths.globalConfig, "utf8"));
+    existing = JSON.parse(await fsp3.readFile(deps.paths.globalConfig, "utf8"));
   } catch {
     deps.renderer.writeError("No config file found.\n");
     return 1;
@@ -8959,7 +8955,7 @@ async function removeMcpServer(name, deps) {
   }
   delete mcpServers[name];
   existing.mcpServers = mcpServers;
-  await atomicWrite(deps.paths.globalConfig, JSON.stringify(existing, null, 2));
+  await atomicWrite(deps.paths.globalConfig, JSON.stringify(existing, null, 2), { mode: 384 });
   deps.renderer.writeInfo(`Removed "${name}" from config.
 `);
   return 0;
@@ -9067,7 +9063,7 @@ function renderConfiguredPlugins(config) {
 }
 async function readConfig2(file) {
   try {
-    return JSON.parse(await fsp2.readFile(file, "utf8"));
+    return JSON.parse(await fsp3.readFile(file, "utf8"));
   } catch {
     return {};
   }
@@ -9097,7 +9093,7 @@ async function upsertPlugin(spec, opts, deps, verb) {
   };
   existing.plugins = plugins;
   existing.features = features;
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2));
+  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
   return {
     code: 0,
     level: "info",
@@ -9114,7 +9110,7 @@ async function removePlugin(spec, deps) {
     return errorResult(`Plugin "${spec}" not in config.`);
   }
   existing.plugins = next;
-  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2));
+  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 384 });
   return {
     code: 0,
     level: "info",
@@ -9160,7 +9156,7 @@ var usageCmd = async (_args, deps) => {
 var projectsCmd = async (_args, deps) => {
   const projectsRoot = path25.join(deps.paths.globalRoot, "projects");
   try {
-    const entries = await fsp2.readdir(projectsRoot);
+    const entries = await fsp3.readdir(projectsRoot);
     if (entries.length === 0) {
       deps.renderer.write("No projects tracked.\n");
       return 0;
@@ -9168,7 +9164,7 @@ var projectsCmd = async (_args, deps) => {
     for (const hash of entries) {
       try {
         const meta = JSON.parse(
-          await fsp2.readFile(path25.join(projectsRoot, hash, "meta.json"), "utf8")
+          await fsp3.readFile(path25.join(projectsRoot, hash, "meta.json"), "utf8")
         );
         deps.renderer.write(
           `  ${color.dim(hash)}  ${color.dim(meta.lastSeen ?? "")}  ${meta.root ?? "?"}
@@ -9319,7 +9315,7 @@ var sessionsFleetCmd = async (args, deps) => {
 async function listFleetRuns(deps) {
   let entries = [];
   try {
-    entries = await fsp2.readdir(deps.paths.projectSessions);
+    entries = await fsp3.readdir(deps.paths.projectSessions);
   } catch {
     deps.renderer.writeError(`Cannot read projectSessions: ${deps.paths.projectSessions}
 `);
@@ -9330,7 +9326,7 @@ async function listFleetRuns(deps) {
     const runDir = path25.join(deps.paths.projectSessions, id);
     let stat3;
     try {
-      stat3 = await fsp2.stat(runDir);
+      stat3 = await fsp3.stat(runDir);
     } catch {
       continue;
     }
@@ -9340,18 +9336,18 @@ async function listFleetRuns(deps) {
     let subagentCount = 0;
     let subagentsDir;
     try {
-      await fsp2.access(path25.join(runDir, "fleet.json"));
+      await fsp3.access(path25.join(runDir, "fleet.json"));
       manifest = true;
     } catch {
     }
     try {
-      await fsp2.access(path25.join(runDir, "checkpoint.json"));
+      await fsp3.access(path25.join(runDir, "checkpoint.json"));
       checkpoint = true;
     } catch {
     }
     try {
       subagentsDir = path25.join(runDir, "subagents");
-      const files = await fsp2.readdir(subagentsDir);
+      const files = await fsp3.readdir(subagentsDir);
       subagentCount = files.filter((f) => f.endsWith(".jsonl")).length;
     } catch {
     }
@@ -9382,7 +9378,7 @@ async function showFleetRun(runId, deps) {
   const runDir = path25.join(deps.paths.projectSessions, runId);
   let stat3;
   try {
-    stat3 = await fsp2.stat(runDir);
+    stat3 = await fsp3.stat(runDir);
   } catch {
     deps.renderer.writeError(`Fleet run not found: ${runId}
 `);
@@ -9399,7 +9395,7 @@ Fleet Run: ${runId}
   const manifestPath = path25.join(runDir, "fleet.json");
   let manifestData = null;
   try {
-    manifestData = await fsp2.readFile(manifestPath, "utf8");
+    manifestData = await fsp3.readFile(manifestPath, "utf8");
     const manifest = JSON.parse(manifestData);
     const subagents = manifest.subagents ?? [];
     const tasks = manifest.tasks ?? [];
@@ -9415,12 +9411,12 @@ Fleet Run: ${runId}
   const checkpointPath = path25.join(runDir, "checkpoint.json");
   let checkpointData = null;
   try {
-    checkpointData = await fsp2.readFile(checkpointPath, "utf8");
+    checkpointData = await fsp3.readFile(checkpointPath, "utf8");
     const snap = JSON.parse(checkpointData);
     const lockPath = `${checkpointPath}.lock`;
     let lockStatus = color.dim("\u25CB no lock");
     try {
-      const lockRaw = await fsp2.readFile(lockPath, "utf8");
+      const lockRaw = await fsp3.readFile(lockPath, "utf8");
       const lock = JSON.parse(lockRaw);
       lockStatus = `${color.yellow("\u25B8")} lock held by pid ${lock.pid} on ${lock.hostname} (started ${lock.startedAt})`;
     } catch {
@@ -9462,7 +9458,7 @@ Fleet Run: ${runId}
   const subagentsDir = path25.join(runDir, "subagents");
   let subagentFiles = [];
   try {
-    subagentFiles = await fsp2.readdir(subagentsDir);
+    subagentFiles = await fsp3.readdir(subagentsDir);
     subagentFiles = subagentFiles.filter((f) => f.endsWith(".jsonl"));
   } catch {
   }
@@ -9474,7 +9470,7 @@ Fleet Run: ${runId}
       const filePath = path25.join(subagentsDir, f);
       let size;
       try {
-        const s = await fsp2.stat(filePath);
+        const s = await fsp3.stat(filePath);
         size = s.size;
       } catch {
         size = 0;
@@ -9490,7 +9486,7 @@ Fleet Run: ${runId}
   }
   const sharedDir = path25.join(runDir, "shared");
   try {
-    const files = await fsp2.readdir(sharedDir);
+    const files = await fsp3.readdir(sharedDir);
     deps.renderer.write(`
   Shared scratchpad: ${files.length} file(s)
 `);
@@ -9787,7 +9783,7 @@ var skillsCmd = async (_args, deps) => {
 };
 var versionCmd = async (_args, deps) => {
   deps.renderer.write(
-    `WrongStack ${CLI_VERSION} (apiVersion ${API_VERSION}, node ${process.version}, ${os7.platform()})
+    `WrongStack ${CLI_VERSION} (apiVersion ${API_VERSION}, node ${process.version}, ${os6.platform()})
 `
   );
   return 0;
@@ -10977,6 +10973,43 @@ async function execute(deps) {
       const banneredFamily = savedProviderCfg?.family ?? resolvedProvider?.family;
       const banneredKey = savedProviderCfg?.apiKey ?? config.apiKey ?? (resolvedProvider?.envVars ?? savedProviderCfg?.envVars ?? []).map((v) => process.env[v]).find((v) => !!v);
       const banneredKeyTail = banneredKey && banneredKey.length >= 3 ? banneredKey.slice(-3) : void 0;
+      const autoPhaseHandlers = /* @__PURE__ */ new Map();
+      const subscribeAutoPhase = (handler) => {
+        const registrations = [];
+        const autoPhaseEvents = [
+          "phase.started",
+          "phase.completed",
+          "phase.failed",
+          "phase.statusChange",
+          "phase.taskCompleted",
+          "phase.taskFailed",
+          "phase.taskRetrying",
+          "autonomous.tick",
+          "graph.completed",
+          "graph.failed",
+          "agent.assigned",
+          "agent.released",
+          // Git-worktree isolation lifecycle → TUI worktree panel/monitor.
+          "worktree.allocated",
+          "worktree.committed",
+          "worktree.merged",
+          "worktree.conflict",
+          "worktree.released",
+          "worktree.failed"
+        ];
+        const onUntyped = events.on.bind(events);
+        const offUntyped = events.off.bind(events);
+        for (const ev of autoPhaseEvents) {
+          const h = (p) => handler(ev, p);
+          autoPhaseHandlers.set(ev, h);
+          onUntyped(ev, h);
+          registrations.push(() => offUntyped(ev, h));
+        }
+        return () => {
+          for (const unregister of registrations) unregister();
+          autoPhaseHandlers.clear();
+        };
+      };
       try {
         code = await runTui({
           agent,
@@ -10995,6 +11028,7 @@ async function execute(deps) {
           getEternalEngine,
           subscribeEternalIteration,
           subscribeEternalStage,
+          subscribeAutoPhase,
           appVersion: CLI_VERSION,
           provider: config.provider,
           family: banneredFamily,
@@ -11279,8 +11313,9 @@ var MultiAgentHost = class {
     return async (subCfg) => {
       const events = new EventBus();
       const provider = await this.buildSubagentProvider(config, subCfg.provider);
+      const subCwd = subCfg.cwd ?? this.deps.cwd;
       const baseSystem = await this.deps.systemPromptBuilder.build({
-        cwd: this.deps.cwd,
+        cwd: subCwd,
         projectRoot: this.deps.projectRoot,
         tools: this.filterTools(subCfg.tools),
         model: subCfg.model ?? config.model,
@@ -11316,7 +11351,7 @@ var MultiAgentHost = class {
         session: subSession,
         signal: new AbortController().signal,
         tokenCounter: this.deps.tokenCounter,
-        cwd: this.deps.cwd,
+        cwd: subCwd,
         projectRoot: this.deps.projectRoot,
         model: subCfg.model ?? config.model,
         tools: this.filterTools(subCfg.tools)
@@ -11884,6 +11919,218 @@ function samplePaths(set) {
   if (arr.length <= 2) return arr.join(", ");
   return `${arr[0]}, \u2026 (+${arr.length - 1} more)`;
 }
+var WORKTREE_PHASE_CONCURRENCY = 4;
+function gitText(args, cwd) {
+  return new Promise((resolve4) => {
+    let out = "";
+    const child = spawn("git", args, { cwd, env: buildChildEnv(), stdio: ["ignore", "pipe", "pipe"] });
+    child.stdout?.on("data", (c) => {
+      out += c.toString();
+    });
+    child.stderr?.on("data", (c) => {
+      out += c.toString();
+    });
+    child.on("error", () => resolve4({ code: 1, out }));
+    child.on("close", (code) => resolve4({ code: code ?? 1, out: out.trim() }));
+  });
+}
+async function isGitRepo2(cwd) {
+  const { code, out } = await gitText(["rev-parse", "--is-inside-work-tree"], cwd);
+  return code === 0 && out.trim() === "true";
+}
+function createAutoPhaseHost(deps) {
+  const store = new PhaseStore({ baseDir: deps.storeDir });
+  let active = null;
+  const log = deps.log ?? (() => {
+  });
+  async function runOnce(prompt, label, signal, cwd) {
+    const factory = deps.multiAgentHost.makeSubagentFactory(deps.getConfig());
+    const built = await factory({ name: label, cwd });
+    try {
+      const result = await built.agent.run(prompt, { signal });
+      if (result.status !== "done") {
+        throw new Error(result.error?.message ?? `subagent ended with status "${result.status}"`);
+      }
+      return result.finalText ?? "";
+    } finally {
+      await built.dispose?.();
+    }
+  }
+  function buildTaskPrompt(task, phaseName, goal) {
+    return [
+      `You are executing one task inside an autonomous, phase-based build.`,
+      `Overall goal: ${goal}`,
+      `Current phase: ${phaseName}`,
+      "",
+      `TASK: ${task.title}`,
+      task.description ? `Details: ${task.description}` : "",
+      `Type: ${task.type} \xB7 Priority: ${task.priority}`,
+      "",
+      `Do the work now using your tools (read, edit, write, bash, \u2026). Make the`,
+      `change real \u2014 do not just describe it. When finished, end with a one-line`,
+      `summary of what you changed. If the task is impossible or already done,`,
+      `say so explicitly.`
+    ].filter(Boolean).join("\n");
+  }
+  async function persist(graph) {
+    try {
+      await store.save(graph);
+    } catch (err) {
+      log(`\u26A0 AutoPhase save failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return {
+    async onAutoPhaseStart({ goal, projectContext }) {
+      if (active?.orchestrator.isRunning()) {
+        return { ok: false, error: "An AutoPhase run is already in progress. Use /autophase stop first." };
+      }
+      const abort = new AbortController();
+      log(`\u{1F9E0} Planning phases for: ${goal}`);
+      let phases;
+      try {
+        const planner = new AutoPhasePlanner({
+          goal,
+          projectContext,
+          runOnce: (p) => runOnce(p, "autophase-planner", abort.signal)
+        });
+        const result = await planner.plan();
+        if (result.parseFailed || result.phases.length === 0) {
+          return { ok: false, error: "The planner did not produce a usable phase plan. Try a more specific goal." };
+        }
+        phases = result.phases;
+      } catch (err) {
+        return { ok: false, error: `Planning failed: ${err instanceof Error ? err.message : String(err)}` };
+      }
+      const todoCount = phases.reduce((n, p) => n + (p.taskTemplates?.length ?? 0), 0);
+      log(`\u{1F4CB} Plan ready: ${phases.length} phases, ${todoCount} todos.`);
+      const graph = await new PhaseGraphBuilder({
+        title: goal,
+        phases,
+        autonomous: true
+      }).build();
+      await persist(graph);
+      const worktreesEnabled = deps.worktrees !== false && process.env["WRONGSTACK_AUTOPHASE_WORKTREES"] !== "0";
+      let worktrees;
+      if (worktreesEnabled && await isGitRepo2(deps.projectRoot)) {
+        worktrees = new WorktreeManager({ projectRoot: deps.projectRoot, events: deps.events });
+        log(`\u{1F33F} Worktree isolation on \u2014 up to ${deps.maxConcurrentPhases ?? WORKTREE_PHASE_CONCURRENCY} phases run in parallel.`);
+      }
+      const orchestrator = new PhaseOrchestrator({
+        graph,
+        ctx: {
+          executeTask: async (task, phaseId, env) => {
+            const phase = graph.phases.get(phaseId);
+            const phaseName = phase?.name ?? phaseId;
+            return runOnce(
+              buildTaskPrompt(task, phaseName, goal),
+              `autophase-${phaseName}-${task.title}`.slice(0, 48),
+              abort.signal,
+              env?.cwd
+            );
+          },
+          onPhaseComplete: (phase) => {
+            log(`\u2705 Phase completed: ${phase.name}`);
+            void persist(graph);
+          },
+          onPhaseFail: (phase, error) => {
+            log(`\u274C Phase failed: ${phase.name} \u2014 ${error.message}`);
+            void persist(graph);
+          }
+        },
+        events: deps.events,
+        worktrees,
+        autonomous: true,
+        // With isolation, parallelizable phases run concurrently; without it,
+        // stay strictly sequential to protect the shared working tree.
+        maxConcurrentPhases: worktrees ? deps.maxConcurrentPhases ?? WORKTREE_PHASE_CONCURRENCY : 1,
+        // Sequential within a phase: each todo is a full-tool agent and todos in
+        // a phase typically build on one another (they share the phase worktree).
+        maxConcurrentTasks: 1
+      });
+      const onUntyped = deps.events.on;
+      const offUntyped = deps.events.off;
+      const onDone = () => {
+        log(`\u{1F389} AutoPhase complete: ${graph.title}`);
+        void persist(graph);
+      };
+      const onFailed = () => void persist(graph);
+      onUntyped("graph.completed", onDone);
+      onUntyped("graph.failed", onFailed);
+      const unsubscribe = () => {
+        offUntyped("graph.completed", onDone);
+        offUntyped("graph.failed", onFailed);
+      };
+      active = { graph, orchestrator, abort, unsubscribe };
+      void orchestrator.start().catch((err) => {
+        log(`\u{1F4A5} AutoPhase aborted: ${err instanceof Error ? err.message : String(err)}`);
+      });
+      return { ok: true, graph };
+    },
+    onAutoPhasePause() {
+      active?.orchestrator.pause();
+    },
+    onAutoPhaseResume() {
+      active?.orchestrator.resume();
+    },
+    onAutoPhaseStop() {
+      if (!active) return;
+      active.abort.abort();
+      active.orchestrator.stop();
+      active.unsubscribe();
+      void persist(active.graph);
+      active = null;
+    },
+    getAutoPhaseRunner() {
+      if (!active) return null;
+      const a = active;
+      return {
+        graph: a.graph,
+        getProgress: () => a.orchestrator.getProgress(),
+        isRunning: () => a.orchestrator.isRunning()
+      };
+    },
+    async onWorktree(action, target) {
+      const root = deps.projectRoot;
+      if (!await isGitRepo2(root)) return "\u26A0 Not a git repository \u2014 worktrees unavailable.";
+      switch (action) {
+        case "list": {
+          const { out } = await gitText(["worktree", "list"], root);
+          return out || "No worktrees.";
+        }
+        case "prune": {
+          await gitText(["worktree", "prune"], root);
+          const { out } = await gitText(["worktree", "list"], root);
+          return `Pruned stale worktree entries.
+${out}`;
+        }
+        case "merge": {
+          if (!target) return "Usage: /worktree merge <branch>";
+          if (target.startsWith("-")) return `Refusing unsafe branch name: ${target}`;
+          const base = (await gitText(["rev-parse", "--abbrev-ref", "HEAD"], root)).out || "HEAD";
+          await gitText(["merge", "--squash", target], root);
+          const commit = await gitText(["commit", "-m", `merge ${target} (squash)`], root);
+          if (commit.code !== 0 && !/nothing to commit/i.test(commit.out)) {
+            await gitText(["reset", "--hard", "HEAD"], root);
+            return `\u26A0 Merge of "${target}" into ${base} hit conflicts and was rolled back.
+${commit.out}`;
+          }
+          return `\u2713 Merged "${target}" into ${base} (squash).`;
+        }
+        case "clean": {
+          const list = (await gitText(["worktree", "list", "--porcelain"], root)).out;
+          const dirs = list.split("\n").filter((l) => l.startsWith("worktree ")).map((l) => l.slice("worktree ".length)).filter((d) => d.includes(".wrongstack") && d.includes("worktrees"));
+          for (const d of dirs) await gitText(["worktree", "remove", "--force", d], root);
+          await gitText(["worktree", "prune"], root);
+          const branches = (await gitText(["branch", "--list", "wstack/ap/*"], root)).out.split("\n").map((b) => b.replace(/^[*+]?\s*/, "").trim()).filter(Boolean);
+          for (const b of branches) await gitText(["branch", "-D", b], root);
+          return `\u{1F9F9} Removed ${dirs.length} worktree(s) and ${branches.length} branch(es).`;
+        }
+        default:
+          return `Unknown worktree action: ${action}`;
+      }
+    }
+  };
+}
 var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var FILLED2 = "\u2588";
 var EMPTY2 = "\u2591";
@@ -12051,7 +12298,7 @@ function setupMetrics(params) {
     name: "session-store",
     check: async () => {
       try {
-        await fsp2.access(wpaths.projectSessions);
+        await fsp3.access(wpaths.projectSessions);
         return { status: "healthy" };
       } catch (e) {
         return { status: "unhealthy", detail: e instanceof Error ? e.message : "access denied" };
@@ -12707,6 +12954,15 @@ async function main(argv) {
       this.visible = visible;
     }
   };
+  const autoPhaseHost = createAutoPhaseHost({
+    multiAgentHost,
+    getConfig: () => config,
+    events,
+    storeDir: wpaths.projectAutophase,
+    projectRoot,
+    log: (line) => renderer.write(`${line}
+`)
+  });
   const slashCmds = buildBuiltinSlashCommands({
     registry: slashRegistry,
     toolRegistry,
@@ -12716,6 +12972,7 @@ async function main(argv) {
     skillLoader,
     tokenCounter,
     renderer,
+    events,
     memoryStore,
     context,
     cwd,
@@ -12944,7 +13201,7 @@ async function main(argv) {
       const subagentsRoot = path25.join(fleetRootForPromotion, "subagents");
       let runDirs;
       try {
-        runDirs = await fsp2.readdir(subagentsRoot);
+        runDirs = await fsp3.readdir(subagentsRoot);
       } catch {
         return "No fleet transcripts on disk \u2014 no subagents have been spawned for this session.";
       }
@@ -12953,7 +13210,7 @@ async function main(argv) {
         const runDir = path25.join(subagentsRoot, runId);
         let files;
         try {
-          files = await fsp2.readdir(runDir);
+          files = await fsp3.readdir(runDir);
         } catch {
           continue;
         }
@@ -12961,7 +13218,7 @@ async function main(argv) {
           if (!f.endsWith(".jsonl")) continue;
           const full = path25.join(runDir, f);
           try {
-            const stat3 = await fsp2.stat(full);
+            const stat3 = await fsp3.stat(full);
             found.push({
               runId,
               subagentId: f.replace(/\.jsonl$/, ""),
@@ -13000,7 +13257,7 @@ async function main(argv) {
         ].join("\n");
       }
       const t = matches[0];
-      const raw = await fsp2.readFile(t.file, "utf8");
+      const raw = await fsp3.readFile(t.file, "utf8");
       if (mode === "raw") return raw;
       const lines = raw.split("\n").filter((l) => l.trim());
       const counts = {};
@@ -13226,10 +13483,10 @@ Restart WrongStack to load or unload plugin code in this session.`;
       void mcpRegistry.stopAll();
     },
     onBeforeExit: async () => {
-      const { spawn: spawn3 } = await import('child_process');
+      const { spawn: spawn4 } = await import('child_process');
       const cwd2 = projectRoot;
       const statusResult = await new Promise((resolve4, reject) => {
-        const child = spawn3("git", ["status", "--porcelain"], { cwd: cwd2, stdio: ["ignore", "pipe", "pipe"] });
+        const child = spawn4("git", ["status", "--porcelain"], { cwd: cwd2, stdio: ["ignore", "pipe", "pipe"] });
         let stdout = "";
         child.stdout?.on("data", (d) => {
           stdout += d;
@@ -13332,7 +13589,13 @@ Restart WrongStack to load or unload plugin code in this session.`;
     onSddParallelStop: () => {
       const run = globalThis.__sddParallelRun;
       run?.stop();
-    }
+    },
+    onAutoPhaseStart: autoPhaseHost.onAutoPhaseStart,
+    onAutoPhasePause: autoPhaseHost.onAutoPhasePause,
+    onAutoPhaseResume: autoPhaseHost.onAutoPhaseResume,
+    onAutoPhaseStop: autoPhaseHost.onAutoPhaseStop,
+    getAutoPhaseRunner: autoPhaseHost.getAutoPhaseRunner,
+    onWorktree: autoPhaseHost.onWorktree
   });
   for (const cmd of slashCmds) slashRegistry.register(cmd);
   const eternalFlag = typeof flags["eternal"] === "string" ? flags["eternal"].trim() : "";