@wrongstack/cli 0.89.3 → 0.104.0

package/dist/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { color, writeErr, renderProgress, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, expectDefined, DefaultTaskStore, TaskTracker, renderTaskGraph, DefaultSecretScrubber, DefaultPathResolver, EventBus, TOKENS, mergeCustomModelDefs, DefaultSystemPromptBuilder, makeAutonomyPromptContributor, ToolRegistry, createContextManagerTool, resolveSessionLoggingConfig, createSessionEventBridge, HookRegistry, HookRunner, SlashCommandRegistry, SessionMemoryConsolidator, BrainDecisionQueue, ObservableBrainArbiter, HumanEscalatingBrainArbiter, DefaultBrainArbiter, createDelegateTool, FLEET_ROSTER, createMcpControlTool, SpecVersioning, atomicWrite, DefaultLogger, DefaultModelsRegistry, isStdinTTY, writeOut, runProviderWithRetry, ReplayLogStore, ReplayProviderRunner, ProviderRegistry, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, DEFAULT_SESSION_PRUNE_DAYS, RecoveryLock, DefaultAttachmentStore, QueueStore, Context, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, loadPlan, createDefaultPipelines, resolveContextWindowPolicy, resolveAuditLevel, AutoCompactionMiddleware, estimateRequestTokensCalibrated, Agent, loadPlugins, FleetManager, makeDirectorSessionFactory, Director, makeFleetEmitTool, makeFleetStatusTool, resolveModelMatrix, DEFAULT_SUBAGENT_BASELINE, AutoApprovePermissionPolicy, PhaseStore, AutoPhasePlanner, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, makeLLMClassifier, ParallelEternalEngine, EternalAutonomyEngine, allServers as allServers$1, decryptConfigSecrets as decryptConfigSecrets$1, encryptConfigSecrets as encryptConfigSecrets$1, bootConfig as bootConfig$1, setOutputLineGuard, setRawMode, DefaultSessionReader, resolveWstackPaths, ToolAuditLog, DefaultSessionRewinder, DefaultSessionStore, DefaultPluginAPI, ProviderError, makeAgentSubagentRunner, NULL_FLEET_BUS, buildChildEnv, formatContextWindowModeList, repairToolUseAdjacency, getContextWindowMode, AGENTS_BY_PHASE, dispatchAgent, formatTodosList, SessionRecovery, loadGoal, goalFilePath, summarizeUsage, saveGoal, emptyGoal, buildGoalPreamble, formatGoal, pendingBtwCount, setBtwNote, MATRIX_PHASE_KEYS, AGENT_CATALOG, matrixKeyKind, onResize, ERROR_CODES, InputBuilder, FsError } from '@wrongstack/core';
-import * as path8 from 'path';
-import { join } from 'path';
+import { color, writeErr, renderProgress, SpecStore, TaskGraphStore, analyzeCriticalPath, getTemplate, listTemplates, templateToMarkdown, SpecParser, renderSpecAnalysis, AISpecBuilder, expectDefined, DefaultTaskStore, TaskTracker, renderTaskGraph, DefaultSecretScrubber, DefaultPathResolver, EventBus, TOKENS, mergeCustomModelDefs, DefaultSystemPromptBuilder, makeAutonomyPromptContributor, ToolRegistry, createContextManagerTool, resolveSessionLoggingConfig, createSessionEventBridge, HookRegistry, HookRunner, SlashCommandRegistry, SessionMemoryConsolidator, BrainDecisionQueue, ObservableBrainArbiter, HumanEscalatingBrainArbiter, DefaultBrainArbiter, createDelegateTool, FLEET_ROSTER, createMcpControlTool, SpecVersioning, atomicWrite, DefaultLogger, DefaultModelsRegistry, isStdinTTY, writeOut, runProviderWithRetry, ReplayLogStore, ReplayProviderRunner, ProviderRegistry, InMemoryMetricsSink, wireMetricsToEvents, DefaultHealthRegistry, startMetricsServer, DEFAULT_SESSION_PRUNE_DAYS, RecoveryLock, DefaultAttachmentStore, QueueStore, Context, loadTodosCheckpoint, attachTodosCheckpoint, loadDirectorState, loadPlan, createDefaultPipelines, resolveContextWindowPolicy, resolveAuditLevel, AutoCompactionMiddleware, estimateRequestTokensCalibrated, Agent, loadPlugins, FleetManager, makeDirectorSessionFactory, Director, makeFleetEmitTool, makeFleetStatusTool, resolveModelMatrix, DEFAULT_SUBAGENT_BASELINE, AutoApprovePermissionPolicy, PhaseStore, AutoPhasePlanner, PhaseGraphBuilder, WorktreeManager, PhaseOrchestrator, makeLLMClassifier, ParallelEternalEngine, EternalAutonomyEngine, allServers as allServers$1, decryptConfigSecrets as decryptConfigSecrets$1, encryptConfigSecrets as encryptConfigSecrets$1, bootConfig as bootConfig$1, setOutputLineGuard, setRawMode, DefaultSessionReader, resolveWstackPaths, ToolAuditLog, DefaultSessionRewinder, DefaultSessionStore, DefaultPluginAPI, ProviderError, makeAgentSubagentRunner, NULL_FLEET_BUS, buildChildEnv, formatContextWindowModeList, repairToolUseAdjacency, getContextWindowMode, AGENTS_BY_PHASE, dispatchAgent, formatTodosList, loadTasks, emptyTaskFile, saveTasks, formatTaskProgress, formatTaskList, SessionRecovery, loadGoal, goalFilePath, summarizeUsage, saveGoal, formatGoal, emptyGoal, buildGoalPreamble, pendingBtwCount, setBtwNote, MATRIX_PHASE_KEYS, AGENT_CATALOG, matrixKeyKind, phaseForRole, onResize, ERROR_CODES, InputBuilder, FsError } from '@wrongstack/core';
 import * as fsp4 from 'fs/promises';
 import { DefaultSecretVault, decryptConfigSecrets, encryptConfigSecrets, isSecretField } from '@wrongstack/core/security';
+import * as path8 from 'path';
+import { join } from 'path';
 import { createRequire } from 'module';
 import * as os2 from 'os';
 import os2__default from 'os';
@@ -18,7 +18,7 @@ import { createDefaultContainer, routeImagesForModel, readClipboardImage } from
 import { builtinToolsPack, rememberTool, forgetTool, searchMemoryTool, relatedMemoryTool, runStartupIndex, isIndexableFile, enqueueReindex, cancelPendingReindexes } from '@wrongstack/tools';
 import { fileURLToPath } from 'url';
 import * as readline from 'readline';
-import * as fs12 from 'fs';
+import * as fs13 from 'fs';
 import { writeFileSync, existsSync, readFileSync } from 'fs';
 import { WrongStackACPServer } from '@wrongstack/acp/agent';
 import { ACP_AGENT_COMMANDS, makeACPSubagentRunner, makeACPSubagentRunnerWithStop } from '@wrongstack/acp';
@@ -36,6 +36,102 @@ var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
+function normalizeKeys(cfg) {
+  if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {
+    return cfg.apiKeys.map((k) => ({ ...k }));
+  }
+  if (typeof cfg.apiKey === "string" && cfg.apiKey.length > 0) {
+    return [{ label: "default", apiKey: cfg.apiKey, createdAt: "" }];
+  }
+  return [];
+}
+function writeKeysBack(cfg, keys) {
+  if (keys.length === 0) {
+    delete cfg.apiKeys;
+    delete cfg.apiKey;
+    delete cfg.activeKey;
+    return;
+  }
+  cfg.apiKeys = keys;
+  const active = keys.find((k) => k.label === cfg.activeKey) ?? expectDefined(keys[0]);
+  cfg.apiKey = active.apiKey;
+  if (!cfg.activeKey || !keys.some((k) => k.label === cfg.activeKey)) {
+    cfg.activeKey = active.label;
+  }
+}
+function activeLabel(cfg, keys) {
+  if (cfg.activeKey && keys.some((k) => k.label === cfg.activeKey)) return cfg.activeKey;
+  return keys[0]?.label;
+}
+function maskedKey(key) {
+  if (!key) return color.dim("\u2014");
+  if (key.length <= 8) return color.dim("\u2022".repeat(key.length));
+  const head = key.slice(0, 4);
+  const tail = key.slice(-4);
+  return `${color.dim(head + "\u2026")}${tail}`;
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+async function loadConfigProviders(configPath2, vault, opts) {
+  const warn = opts?.warn;
+  let raw;
+  try {
+    raw = await fsp4.readFile(configPath2, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      warn?.(`Could not read ${configPath2}: ${err.message}. Treating as empty.`);
+    }
+    return {};
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    warn?.(`Config at ${configPath2} is not valid JSON: ${err.message}`);
+    return {};
+  }
+  const decrypted = decryptConfigSecrets(parsed, vault);
+  return decrypted.providers ?? {};
+}
+async function mutateConfigProviders(configPath2, vault, mutator) {
+  let raw;
+  let fileExists = true;
+  try {
+    raw = await fsp4.readFile(configPath2, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      throw new Error(
+        `Refusing to mutate ${configPath2}: ${err.message}`,
+        { cause: err }
+      );
+    }
+    fileExists = false;
+    raw = "{}";
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    if (fileExists) {
+      throw new Error(
+        `Refusing to overwrite corrupt config at ${configPath2} (${err.message}). Fix or move the file aside before retrying.`,
+        { cause: err }
+      );
+    }
+    parsed = {};
+  }
+  const decrypted = decryptConfigSecrets(parsed, vault);
+  const providers = decrypted.providers ?? {};
+  mutator(providers);
+  decrypted.providers = providers;
+  const encrypted = encryptConfigSecrets(decrypted, vault);
+  await atomicWrite(configPath2, JSON.stringify(encrypted, null, 2), { mode: 384 });
+}
+var init_provider_config_utils = __esm({
+  "src/provider-config-utils.ts"() {
+  }
+});
 function getSessionState(ctx) {
   if (!ctx) return sddState;
   let state = ctx.meta[SDD_META_KEY];
@@ -1496,102 +1592,6 @@ var init_sdd = __esm({
     init_rendering();
   }
 });
-function normalizeKeys(cfg) {
-  if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {
-    return cfg.apiKeys.map((k) => ({ ...k }));
-  }
-  if (typeof cfg.apiKey === "string" && cfg.apiKey.length > 0) {
-    return [{ label: "default", apiKey: cfg.apiKey, createdAt: "" }];
-  }
-  return [];
-}
-function writeKeysBack(cfg, keys) {
-  if (keys.length === 0) {
-    delete cfg.apiKeys;
-    delete cfg.apiKey;
-    delete cfg.activeKey;
-    return;
-  }
-  cfg.apiKeys = keys;
-  const active = keys.find((k) => k.label === cfg.activeKey) ?? expectDefined(keys[0]);
-  cfg.apiKey = active.apiKey;
-  if (!cfg.activeKey || !keys.some((k) => k.label === cfg.activeKey)) {
-    cfg.activeKey = active.label;
-  }
-}
-function activeLabel(cfg, keys) {
-  if (cfg.activeKey && keys.some((k) => k.label === cfg.activeKey)) return cfg.activeKey;
-  return keys[0]?.label;
-}
-function maskedKey(key) {
-  if (!key) return color.dim("\u2014");
-  if (key.length <= 8) return color.dim("\u2022".repeat(key.length));
-  const head = key.slice(0, 4);
-  const tail = key.slice(-4);
-  return `${color.dim(head + "\u2026")}${tail}`;
-}
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
-async function loadConfigProviders(configPath2, vault, opts) {
-  const warn = opts?.warn;
-  let raw;
-  try {
-    raw = await fsp4.readFile(configPath2, "utf8");
-  } catch (err) {
-    if (err.code !== "ENOENT") {
-      warn?.(`Could not read ${configPath2}: ${err.message}. Treating as empty.`);
-    }
-    return {};
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    warn?.(`Config at ${configPath2} is not valid JSON: ${err.message}`);
-    return {};
-  }
-  const decrypted = decryptConfigSecrets(parsed, vault);
-  return decrypted.providers ?? {};
-}
-async function mutateConfigProviders(configPath2, vault, mutator) {
-  let raw;
-  let fileExists = true;
-  try {
-    raw = await fsp4.readFile(configPath2, "utf8");
-  } catch (err) {
-    if (err.code !== "ENOENT") {
-      throw new Error(
-        `Refusing to mutate ${configPath2}: ${err.message}`,
-        { cause: err }
-      );
-    }
-    fileExists = false;
-    raw = "{}";
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    if (fileExists) {
-      throw new Error(
-        `Refusing to overwrite corrupt config at ${configPath2} (${err.message}). Fix or move the file aside before retrying.`,
-        { cause: err }
-      );
-    }
-    parsed = {};
-  }
-  const decrypted = decryptConfigSecrets(parsed, vault);
-  const providers = decrypted.providers ?? {};
-  mutator(providers);
-  decrypted.providers = providers;
-  const encrypted = encryptConfigSecrets(decrypted, vault);
-  await atomicWrite(configPath2, JSON.stringify(encrypted, null, 2), { mode: 384 });
-}
-var init_provider_config_utils = __esm({
-  "src/provider-config-utils.ts"() {
-  }
-});
 
 // src/update-check.ts
 var update_check_exports = {};
@@ -2888,212 +2888,147 @@ function estimateTokens(messages) {
   }
   return total;
 }
-function buildAutonomyCommand(opts) {
+
+// src/slash-commands/auth.ts
+init_provider_config_utils();
+function buildAuthCommand(opts) {
+  const help = [
+    "Usage:",
+    "  /auth                      Show saved providers and key status",
+    "  /auth status <provider>    Show detail for one provider",
+    "  /auth open                 Show how to launch the interactive menu",
+    "",
+    "Run `wstack auth` for the full interactive key manager (add, edit, delete)."
+  ].join("\n");
   return {
-    name: "autonomy",
-    category: "Agent",
-    description: "Toggle or query autonomy mode (self-driving agent).",
-    help: [
-      "Usage:",
-      "  /autonomy            Show current autonomy status",
-      "  /autonomy off        Disabled \u2014 agent stops after each turn (default)",
-      "  /autonomy suggest    Show next-step suggestions after each turn",
-      "  /autonomy on         Auto-continue \u2014 agent picks next step and proceeds",
-      "  /autonomy eternal    Goal-driven loop \u2014 runs forever against /goal",
-      "                       (prompts to confirm an existing goal; `--keep` to skip prompt)",
-      "  /autonomy parallel   Parallel mode \u2014 4-8 agents per tick, fan-out parallelism",
-      "                       (prompts to confirm an existing goal; `--keep` to skip prompt)",
-      "  /autonomy stop       Stop eternal mode (no-op for other modes)",
-      "  /autonomy toggle     Cycle: off \u2192 suggest \u2192 auto \u2192 eternal \u2192 parallel \u2192 off",
-      "",
-      "Modes:",
-      "  off      \u2014 Normal interactive mode. Agent stops and waits.",
-      "  suggest  \u2014 After each turn, agent suggests next steps. You pick.",
-      "  auto     \u2014 After each turn, agent picks the best next step and continues.",
-      "             Runs indefinitely until you press Esc or Ctrl+C.",
-      "  eternal  \u2014 Goal-driven sense/decide/execute/reflect loop. Requires /goal.",
-      "             Force-enables regular YOLO; destructive-gated calls still use",
-      "             the permission flow. Runs until /autonomy stop or Ctrl+C twice.",
-      "  parallel \u2014 Fan-out 4\u20138 subagents per tick. Each tick decomposes the goal,",
-      "             spawns N agents, awaits results, aggregates. Requires /goal.",
-      "             Force-enables regular YOLO; destructive-gated calls still use",
-      "             the permission flow. Runs until /autonomy stop or Ctrl+C twice.",
-      "",
-      "Eternal stage flow: decide \u2192 execute \u2192 reflect \u2192 sleep | paused | stopped",
-      "Stage shown in real-time. Use /goal pause to pause, /goal resume to continue.",
-      "",
-      "In auto/eternal/parallel modes the agent works autonomously. Press Esc to redirect,",
-      "Ctrl+C to stop the active iteration. /autonomy stop ends the eternal loop."
-    ].join("\n"),
+    name: "auth",
+    category: "Config",
+    description: "View API key status. Run wstack auth for the full interactive key manager.",
+    help,
     async run(args) {
-      const parts = args.trim().toLowerCase().split(/\s+/).filter(Boolean);
-      const arg = parts[0] ?? "";
-      const modifiers = parts.slice(1);
-      if (!opts.onAutonomy) {
-        const msg2 = "Autonomy mode is not available in this session.";
-        opts.renderer.writeWarning(msg2);
-        return { message: msg2 };
+      const parts = args.trim().split(/\s+/).filter(Boolean);
+      const sub = (parts[0] ?? "").toLowerCase();
+      if (sub === "help" || sub === "--help") {
+        return { message: this.help ?? "" };
       }
-      if (!arg || arg === "status") {
-        const current = opts.onAutonomy();
-        const labels2 = {
-          off: `${color.green("OFF")} ${color.dim("(agent stops after each turn)")}`,
-          suggest: `${color.cyan("SUGGEST")} ${color.dim("(shows next-step suggestions)")}`,
-          auto: `${color.yellow("AUTO")} ${color.dim("(self-driving \u2014 Esc to redirect, Ctrl+C to stop)")}`,
-          eternal: `${color.red("ETERNAL")} ${color.dim("(goal-driven loop \u2014 YOLO, until /autonomy stop)")}`,
-          "eternal-parallel": `${color.magenta("PARALLEL")} ${color.dim("(4-8 subagents per tick \u2014 fan-out, until /autonomy stop)")}`
+      if (!opts.paths?.globalConfig) {
+        return { message: `${color.red("Error")} auth not available \u2014 config path missing.` };
+      }
+      if (sub === "open") {
+        return {
+          message: [
+            `${color.bold("API Key Manager")}`,
+            "",
+            `  Run ${color.bold("wstack auth")} in a separate terminal to manage API keys interactively:`,
+            "",
+            `    ${color.cyan("wstack auth")}                 Interactive menu`,
+            `    ${color.cyan("wstack auth <provider>")}      Add a key for <provider>`,
+            `    ${color.cyan("wstack auth <p> --label <l>")}  Add with custom label`,
+            "",
+            color.dim("  The interactive menu requires standard input (readline) which is not"),
+            color.dim("  available inside the WrongStack session REPL.")
+          ].join("\n")
         };
-        const lines = [`Autonomy mode: ${labels2[current] ?? current}`];
-        try {
-          const goal = await loadGoal(goalFilePath(opts.projectRoot));
-          if (goal) {
-            const u = summarizeUsage(goal);
-            lines.push(
-              color.dim(
-                `  Goal: ${goal.goal.length > 80 ? `${goal.goal.slice(0, 77)}\u2026` : goal.goal}`
-              )
-            );
-            lines.push(
-              color.dim(
-                `  Engine state: ${goal.engineState}  \xB7  iterations: ${goal.iterations}  \xB7  journal: ${goal.journal.length}`
-              )
-            );
-            if (u.iterationsWithUsage > 0) {
-              lines.push(
-                color.dim(
-                  `  Spent: $${u.totalCostUsd.toFixed(4)}  \xB7  ${u.totalInputTokens} in / ${u.totalOutputTokens} out tokens`
-                )
-              );
-            }
-            const recent = goal.journal.slice(-10);
-            const failed = recent.filter((e) => e.status === "failure").length;
-            if (failed > 0) {
-              lines.push(
-                color.amber(`  Recent failures: ${failed} of last ${recent.length} iterations`)
-              );
-            }
+      }
+      let providers;
+      try {
+        providers = await loadConfigProviders(
+          opts.paths.globalConfig,
+          // We don't have a full vault reference in slash commands;
+          // use a simple passthrough vault since keys won't decrypt anyway
+          // in this read-only view and the config may not have encrypted fields.
+          {
+            encrypt: (v) => v,
+            decrypt: (v) => v,
+            isEncrypted: () => false
           }
-        } catch {
-        }
-        const msg2 = lines.join("\n");
-        opts.renderer.write(msg2);
-        return { message: msg2 };
+        );
+      } catch {
+        return { message: `${color.red("Error")} could not read config file.` };
       }
-      if (arg === "stop" || arg === "halt" || arg === "kill") {
-        if (!opts.onEternalStop) {
-          const msg3 = "No eternal-mode controller wired in this session.";
-          opts.renderer.writeWarning(msg3);
-          return { message: msg3 };
+      if (sub === "status") {
+        const pid = parts[1];
+        if (!pid) {
+          return { message: `${color.amber("Usage:")} /auth status <provider>` };
         }
-        opts.getEternalEngine?.()?.stop();
-        opts.getParallelEngine?.()?.stop();
-        opts.onEternalStop();
-        opts.onAutonomy("off");
-        let summaryLine = "";
-        try {
-          const goal = await loadGoal(goalFilePath(opts.projectRoot));
-          if (goal) {
-            const u = summarizeUsage(goal);
-            if (u.iterationsWithUsage > 0) {
-              summaryLine = "\n" + color.dim(
-                `  Spent so far: $${u.totalCostUsd.toFixed(4)} \xB7 ${u.totalInputTokens} in / ${u.totalOutputTokens} out tokens \xB7 ${goal.iterations} total iterations.`
-              );
-            } else if (goal.iterations > 0) {
-              summaryLine = "\n" + color.dim(`  Total iterations: ${goal.iterations}.`);
-            }
-          }
-        } catch {
+        const cfg = providers[pid];
+        if (!cfg) {
+          return { message: `${color.yellow("Provider")} "${pid}" not found in saved config.` };
         }
-        const msg2 = `${color.amber("Eternal/parallel mode stop requested.")} In-flight eternal work is cancelled; parallel fan-out stops after the current tick cleans up.${summaryLine}`;
-        opts.renderer.write(msg2);
-        return { message: msg2 };
-      }
-      let newMode;
-      if (arg === "on" || arg === "enable" || arg === "true" || arg === "auto") {
-        newMode = "auto";
-      } else if (arg === "off" || arg === "disable" || arg === "false") {
-        newMode = "off";
-      } else if (arg === "suggest" || arg === "suggestions") {
-        newMode = "suggest";
-      } else if (arg === "eternal" || arg === "forever" || arg === "infinite" || arg === "sittinsene") {
-        newMode = "eternal";
-      } else if (arg === "parallel" || arg === "eternal-parallel" || arg === "fanout") {
-        newMode = "eternal-parallel";
-      } else if (arg === "toggle" || arg === "cycle") {
-        const current = opts.onAutonomy() ?? "off";
-        const cycle = ["off", "suggest", "auto", "eternal", "eternal-parallel"];
-        newMode = cycle[(cycle.indexOf(current) + 1) % cycle.length] ?? "off";
-      } else {
-        const msg2 = `Unknown argument: ${arg}. Use /autonomy on, off, suggest, eternal, parallel, stop, or toggle.`;
-        opts.renderer.writeWarning(msg2);
-        return { message: msg2 };
-      }
-      if (newMode === "eternal" || newMode === "eternal-parallel") {
-        const wantKeep = modifiers.includes("--keep") || modifiers.includes("keep");
-        const wantNew = modifiers.includes("--new") || modifiers.includes("new");
-        const goal = await loadGoal(goalFilePath(opts.projectRoot));
-        if (!goal) {
-          const msg3 = `${color.red("Eternal/parallel mode requires a goal.")} Run \`/goal set <mission>\` first.`;
-          opts.renderer.writeWarning(msg3);
-          return { message: msg3 };
+        const keys = cfg.apiKeys ?? [];
+        const active = keys.find(
+          (k) => cfg && cfg.activeKey === k.label
+        ) ?? keys[0];
+        const lines2 = [
+          `${color.bold(pid)} ${cfg.family ? color.dim(`[${cfg.family}]`) : color.amber("[no family]")}`,
+          "",
+          `  type:    ${color.cyan(cfg.type ?? pid)}`,
+          `  family:  ${cfg.family ? color.cyan(cfg.family) : color.dim("unset")}`,
+          `  baseUrl: ${cfg.baseUrl ? color.cyan(cfg.baseUrl) : color.dim("unset")}`
+        ];
+        if (cfg.models?.length) {
+          lines2.push(`  models:  ${color.cyan(cfg.models.join(", "))}`);
         }
-        if (wantNew) {
-          const msg3 = `${color.amber("New mission requested.")} Clear the current goal first: ${color.bold("/goal clear")}, then ${color.bold("/goal set <mission>")}, then re-run ${color.bold(`/autonomy ${newMode}`)}.`;
-          opts.renderer.writeWarning(msg3);
-          return { message: msg3 };
+        if (cfg.envVars?.length) {
+          lines2.push(`  envVars: ${color.cyan(cfg.envVars.join(", "))}`);
         }
-        const isStale = goal.iterations > 0 || goal.engineState === "running";
-        if (!wantKeep) {
-          if (opts.confirm) {
-            const goalPreview = goal.goal.length > 80 ? `${goal.goal.slice(0, 77)}\u2026` : goal.goal;
-            const detail = isStale ? `${color.amber("Stale goal")} (${goal.iterations} iterations, engineState: ${goal.engineState}): "${goalPreview}". Continue with this mission?` : `Existing goal: "${goalPreview}". Use this mission?`;
-            const defaultYes = !isStale;
-            const answer = await opts.confirm(detail, defaultYes);
-            if (answer === null) {
-              const msg3 = `${color.dim("Cancelled.")} Autonomy mode unchanged.`;
-              opts.renderer.write(msg3);
-              return { message: msg3 };
-            }
-            if (!answer) {
-              const msg3 = `${color.amber("Skipped.")} To start a new mission: ${color.bold("/goal clear")} \u2192 ${color.bold("/goal set <mission>")} \u2192 ${color.bold(`/autonomy ${newMode}`)}. To force the existing one: ${color.bold(`/autonomy ${newMode} --keep`)}.`;
-              opts.renderer.write(msg3);
-              return { message: msg3 };
-            }
-          } else if (isStale) {
-            const msg3 = `${color.amber("Stale goal detected.")} Previous mission has ${goal.iterations} iterations (engineState: ${goal.engineState}). Clear it first: ${color.bold("/goal clear")}, then set a new one: ${color.bold("/goal set <mission>")}.`;
-            opts.renderer.writeWarning(msg3);
-            return { message: msg3 };
+        lines2.push("");
+        if (keys.length === 0) {
+          lines2.push(color.dim("  (no keys saved)"));
+        } else {
+          lines2.push(`  ${color.dim("Keys:")}`);
+          for (const k of keys) {
+            const marker = k.label === active?.label ? color.green("\u25CF") : color.dim("\u25CB");
+            const masked = k.label === active?.label ? color.dim("(active \u2014 masked)") : color.dim("(masked)");
+            lines2.push(
+              `    ${marker} ${color.bold(k.label.padEnd(18))} ${masked}  ${color.dim(k.createdAt)}`
+            );
           }
         }
-        if (!opts.onEternalStart) {
-          const msg3 = "Eternal mode controller is not wired in this session.";
-          opts.renderer.writeWarning(msg3);
-          return { message: msg3 };
-        }
-        if (opts.onYolo) opts.onYolo(true);
-        opts.onAutonomy(newMode);
-        opts.onEternalStart(newMode);
-        const modeLabel = newMode === "eternal-parallel" ? `${color.magenta("PARALLEL")} mode` : `${color.red("ETERNAL")} mode`;
-        const msg2 = `Autonomy mode: ${modeLabel} \u2014 engine launching against goal: ${color.bold(goal.goal)}
-${color.dim("Regular YOLO enabled; destructive-gated calls still use the permission flow. Use /autonomy stop to end. Journal at /goal journal.")}`;
-        opts.renderer.write(msg2);
-        return { message: msg2 };
+        lines2.push("", color.dim(`  Manage: wstack auth \u2192 pick ${pid}`));
+        return { message: lines2.join("\n") };
       }
-      const previous = opts.onAutonomy();
-      if ((previous === "eternal" || previous === "eternal-parallel") && opts.onEternalStop) {
-        opts.onEternalStop();
+      const ids = Object.keys(providers).sort();
+      if (ids.length === 0) {
+        return {
+          message: [
+            `${color.bold("API Keys")} ${color.dim("\u2014 No providers configured")}`,
+            "",
+            color.dim("  Run `wstack auth` to add a provider with an API key."),
+            "",
+            color.dim("  Quick start:"),
+            `    ${color.cyan("wstack auth")}              Interactive menu`,
+            `    ${color.cyan("wstack auth anthropic")}    Direct add`,
+            "",
+            color.dim("  Or /auth help for more commands.")
+          ].join("\n")
+        };
       }
-      opts.onAutonomy(newMode);
-      const labels = {
-        off: `${color.green("OFF")} \u2014 agent stops after each turn`,
-        suggest: `${color.cyan("SUGGEST")} \u2014 shows next-step suggestions after each turn`,
-        auto: `${color.yellow("AUTO")} \u2014 self-driving, agent continues automatically`,
-        eternal: `${color.red("ETERNAL")} \u2014 goal-driven sittin-sene loop`,
-        "eternal-parallel": `${color.magenta("PARALLEL")} \u2014 fan-out 4-8 subagents per tick`
-      };
-      const msg = `Autonomy mode: ${labels[newMode]}`;
-      opts.renderer.write(msg);
-      return { message: msg };
+      const lines = [
+        `${color.bold("API Keys")} ${color.dim(`\u2014 ${ids.length} provider${ids.length === 1 ? "" : "s"}`)}`,
+        ""
+      ];
+      for (const id of ids) {
+        const cfg = providers[id];
+        if (!cfg) continue;
+        const keys = cfg.apiKeys ?? [];
+        const famTag = cfg.family ? color.dim(`[${cfg.family}]`) : "";
+        const aliasTag = cfg.type && cfg.type !== id ? color.dim(`\u2192 ${cfg.type}`) : "";
+        let status;
+        if (keys.length === 0) {
+          status = color.amber("no keys");
+        } else if (keys.length === 1) {
+          status = color.green(`1 key`);
+        } else {
+          status = color.green(`${keys.length} keys`);
+        }
+        lines.push(
+          `  ${color.bold(id.padEnd(22))} ${famTag} ${aliasTag} ${status}`
+        );
+      }
+      lines.push("");
+      lines.push(color.dim("  /auth status <id>  Detail    /auth open  Full menu"));
+      return { message: lines.join("\n") };
     }
   };
 }
@@ -3255,43 +3190,252 @@ function buildAutoPhaseCommand(opts) {
     }
   };
 }
-function buildBtwCommand(opts) {
+function buildAutonomyCommand(opts) {
   return {
-    name: "btw",
+    name: "autonomy",
     category: "Agent",
-    description: 'Drop a "by the way" note for the running agent without interrupting it \u2014 delivered at the next step',
-    argsHint: "<note>",
+    description: "Toggle or query autonomy mode (self-driving agent).",
     help: [
-      "/btw <note>   Stash a note; the agent reads it at the start of its next",
-      "              iteration (between tool calls) without restarting.",
-      "/btw          Show how many notes are pending.",
+      "Usage:",
+      "  /autonomy            Show current autonomy status",
+      "  /autonomy off        Disabled \u2014 agent stops after each turn (default)",
+      "  /autonomy suggest    Show next-step suggestions after each turn",
+      "  /autonomy on         Auto-continue \u2014 agent picks next step and proceeds",
+      "  /autonomy eternal    Goal-driven loop \u2014 runs forever against /goal",
+      "                       (prompts to confirm an existing goal; `--keep` to skip prompt)",
+      "  /autonomy parallel   Parallel mode \u2014 4-8 agents per tick, fan-out parallelism",
+      "                       (prompts to confirm an existing goal; `--keep` to skip prompt)",
+      "  /autonomy stop       Stop eternal mode (no-op for other modes)",
+      "  /autonomy toggle     Cycle: off \u2192 suggest \u2192 auto \u2192 eternal \u2192 parallel \u2192 off",
       "",
-      "Use `/steer` instead when you need to abort the current work immediately."
+      "Modes:",
+      "  off      \u2014 Normal interactive mode. Agent stops and waits.",
+      "  suggest  \u2014 After each turn, agent suggests next steps. You pick.",
+      "  auto     \u2014 After each turn, agent picks the best next step and continues.",
+      "             Runs indefinitely until you press Esc or Ctrl+C.",
+      "  eternal  \u2014 Goal-driven sense/decide/execute/reflect loop. Requires /goal.",
+      "             Force-enables regular YOLO; destructive-gated calls still use",
+      "             the permission flow. Runs until /autonomy stop or Ctrl+C twice.",
+      "  parallel \u2014 Fan-out 4\u20138 subagents per tick. Each tick decomposes the goal,",
+      "             spawns N agents, awaits results, aggregates. Requires /goal.",
+      "             Force-enables regular YOLO; destructive-gated calls still use",
+      "             the permission flow. Runs until /autonomy stop or Ctrl+C twice.",
+      "",
+      "Eternal stage flow: decide \u2192 execute \u2192 reflect \u2192 sleep | paused | stopped",
+      "Stage shown in real-time. Use /goal pause to pause, /goal resume to continue.",
+      "",
+      "In auto/eternal/parallel modes the agent works autonomously. Press Esc to redirect,",
+      "Ctrl+C to stop the active iteration. /autonomy stop ends the eternal loop."
     ].join("\n"),
     async run(args) {
-      const ctx = opts.context;
-      if (!ctx) {
-        return { message: "No active session \u2014 start a turn first, then use /btw to nudge it." };
+      const parts = args.trim().toLowerCase().split(/\s+/).filter(Boolean);
+      const arg = parts[0] ?? "";
+      const modifiers = parts.slice(1);
+      if (!opts.onAutonomy) {
+        const msg2 = "Autonomy mode is not available in this session.";
+        opts.renderer.writeWarning(msg2);
+        return { message: msg2 };
       }
-      const text = args.trim();
-      if (!text) {
-        const n = pendingBtwCount(ctx);
-        return {
-          message: n === 0 ? "No notes pending. Usage: /btw <note>" : `${n} note(s) pending \u2014 will reach the agent at its next step.`
+      if (!arg || arg === "status") {
+        const current = opts.onAutonomy();
+        const labels2 = {
+          off: `${color.green("OFF")} ${color.dim("(agent stops after each turn)")}`,
+          suggest: `${color.cyan("SUGGEST")} ${color.dim("(shows next-step suggestions)")}`,
+          auto: `${color.yellow("AUTO")} ${color.dim("(self-driving \u2014 Esc to redirect, Ctrl+C to stop)")}`,
+          eternal: `${color.red("ETERNAL")} ${color.dim("(goal-driven loop \u2014 YOLO, until /autonomy stop)")}`,
+          "eternal-parallel": `${color.magenta("PARALLEL")} ${color.dim("(4-8 subagents per tick \u2014 fan-out, until /autonomy stop)")}`
         };
-      }
-      const pending = setBtwNote(ctx, text);
-      return {
-        message: `\u21AF Noted (${pending} pending) \u2014 the agent will fold this in at its next step:
-  ${text}`
-      };
-    }
-  };
-}
-
-// src/slash-commands/clear.ts
-function buildClearCommand(opts) {
-  return {
+        const lines = [`Autonomy mode: ${labels2[current] ?? current}`];
+        try {
+          const goal = await loadGoal(goalFilePath(opts.projectRoot));
+          if (goal) {
+            const u = summarizeUsage(goal);
+            lines.push(
+              color.dim(
+                `  Goal: ${goal.goal.length > 80 ? `${goal.goal.slice(0, 77)}\u2026` : goal.goal}`
+              )
+            );
+            lines.push(
+              color.dim(
+                `  Engine state: ${goal.engineState}  \xB7  iterations: ${goal.iterations}  \xB7  journal: ${goal.journal.length}`
+              )
+            );
+            if (u.iterationsWithUsage > 0) {
+              lines.push(
+                color.dim(
+                  `  Spent: $${u.totalCostUsd.toFixed(4)}  \xB7  ${u.totalInputTokens} in / ${u.totalOutputTokens} out tokens`
+                )
+              );
+            }
+            const recent = goal.journal.slice(-10);
+            const failed = recent.filter((e) => e.status === "failure").length;
+            if (failed > 0) {
+              lines.push(
+                color.amber(`  Recent failures: ${failed} of last ${recent.length} iterations`)
+              );
+            }
+          }
+        } catch {
+        }
+        const msg2 = lines.join("\n");
+        opts.renderer.write(msg2);
+        return { message: msg2 };
+      }
+      if (arg === "stop" || arg === "halt" || arg === "kill") {
+        if (!opts.onEternalStop) {
+          const msg3 = "No eternal-mode controller wired in this session.";
+          opts.renderer.writeWarning(msg3);
+          return { message: msg3 };
+        }
+        opts.getEternalEngine?.()?.stop();
+        opts.getParallelEngine?.()?.stop();
+        opts.onEternalStop();
+        opts.onAutonomy("off");
+        let summaryLine = "";
+        try {
+          const goal = await loadGoal(goalFilePath(opts.projectRoot));
+          if (goal) {
+            const u = summarizeUsage(goal);
+            if (u.iterationsWithUsage > 0) {
+              summaryLine = "\n" + color.dim(
+                `  Spent so far: $${u.totalCostUsd.toFixed(4)} \xB7 ${u.totalInputTokens} in / ${u.totalOutputTokens} out tokens \xB7 ${goal.iterations} total iterations.`
+              );
+            } else if (goal.iterations > 0) {
+              summaryLine = "\n" + color.dim(`  Total iterations: ${goal.iterations}.`);
+            }
+          }
+        } catch {
+        }
+        const msg2 = `${color.amber("Eternal/parallel mode stop requested.")} In-flight eternal work is cancelled; parallel fan-out stops after the current tick cleans up.${summaryLine}`;
+        opts.renderer.write(msg2);
+        return { message: msg2 };
+      }
+      let newMode;
+      if (arg === "on" || arg === "enable" || arg === "true" || arg === "auto") {
+        newMode = "auto";
+      } else if (arg === "off" || arg === "disable" || arg === "false") {
+        newMode = "off";
+      } else if (arg === "suggest" || arg === "suggestions") {
+        newMode = "suggest";
+      } else if (arg === "eternal" || arg === "forever" || arg === "infinite" || arg === "sittinsene") {
+        newMode = "eternal";
+      } else if (arg === "parallel" || arg === "eternal-parallel" || arg === "fanout") {
+        newMode = "eternal-parallel";
+      } else if (arg === "toggle" || arg === "cycle") {
+        const current = opts.onAutonomy() ?? "off";
+        const cycle = ["off", "suggest", "auto", "eternal", "eternal-parallel"];
+        newMode = cycle[(cycle.indexOf(current) + 1) % cycle.length] ?? "off";
+      } else {
+        const msg2 = `Unknown argument: ${arg}. Use /autonomy on, off, suggest, eternal, parallel, stop, or toggle.`;
+        opts.renderer.writeWarning(msg2);
+        return { message: msg2 };
+      }
+      if (newMode === "eternal" || newMode === "eternal-parallel") {
+        const wantKeep = modifiers.includes("--keep") || modifiers.includes("keep");
+        const wantNew = modifiers.includes("--new") || modifiers.includes("new");
+        const goal = await loadGoal(goalFilePath(opts.projectRoot));
+        if (!goal) {
+          const msg3 = `${color.red("Eternal/parallel mode requires a goal.")} Run \`/goal set <mission>\` first.`;
+          opts.renderer.writeWarning(msg3);
+          return { message: msg3 };
+        }
+        if (wantNew) {
+          const msg3 = `${color.amber("New mission requested.")} Clear the current goal first: ${color.bold("/goal clear")}, then ${color.bold("/goal set <mission>")}, then re-run ${color.bold(`/autonomy ${newMode}`)}.`;
+          opts.renderer.writeWarning(msg3);
+          return { message: msg3 };
+        }
+        const isStale = goal.iterations > 0 || goal.engineState === "running";
+        if (!wantKeep) {
+          if (opts.confirm) {
+            const goalPreview = goal.goal.length > 80 ? `${goal.goal.slice(0, 77)}\u2026` : goal.goal;
+            const detail = isStale ? `${color.amber("Stale goal")} (${goal.iterations} iterations, engineState: ${goal.engineState}): "${goalPreview}". Continue with this mission?` : `Existing goal: "${goalPreview}". Use this mission?`;
+            const defaultYes = !isStale;
+            const answer = await opts.confirm(detail, defaultYes);
+            if (answer === null) {
+              const msg3 = `${color.dim("Cancelled.")} Autonomy mode unchanged.`;
+              opts.renderer.write(msg3);
+              return { message: msg3 };
+            }
+            if (!answer) {
+              const msg3 = `${color.amber("Skipped.")} To start a new mission: ${color.bold("/goal clear")} \u2192 ${color.bold("/goal set <mission>")} \u2192 ${color.bold(`/autonomy ${newMode}`)}. To force the existing one: ${color.bold(`/autonomy ${newMode} --keep`)}.`;
+              opts.renderer.write(msg3);
+              return { message: msg3 };
+            }
+          } else if (isStale) {
+            const msg3 = `${color.amber("Stale goal detected.")} Previous mission has ${goal.iterations} iterations (engineState: ${goal.engineState}). Clear it first: ${color.bold("/goal clear")}, then set a new one: ${color.bold("/goal set <mission>")}.`;
+            opts.renderer.writeWarning(msg3);
+            return { message: msg3 };
+          }
+        }
+        if (!opts.onEternalStart) {
+          const msg3 = "Eternal mode controller is not wired in this session.";
+          opts.renderer.writeWarning(msg3);
+          return { message: msg3 };
+        }
+        if (opts.onYolo) opts.onYolo(true);
+        opts.onAutonomy(newMode);
+        opts.onEternalStart(newMode);
+        const modeLabel = newMode === "eternal-parallel" ? `${color.magenta("PARALLEL")} mode` : `${color.red("ETERNAL")} mode`;
+        const msg2 = `Autonomy mode: ${modeLabel} \u2014 engine launching against goal: ${color.bold(goal.goal)}
+${color.dim("Regular YOLO enabled; destructive-gated calls still use the permission flow. Use /autonomy stop to end. Journal at /goal journal.")}`;
+        opts.renderer.write(msg2);
+        return { message: msg2 };
+      }
+      const previous = opts.onAutonomy();
+      if ((previous === "eternal" || previous === "eternal-parallel") && opts.onEternalStop) {
+        opts.onEternalStop();
+      }
+      opts.onAutonomy(newMode);
+      const labels = {
+        off: `${color.green("OFF")} \u2014 agent stops after each turn`,
+        suggest: `${color.cyan("SUGGEST")} \u2014 shows next-step suggestions after each turn`,
+        auto: `${color.yellow("AUTO")} \u2014 self-driving, agent continues automatically`,
+        eternal: `${color.red("ETERNAL")} \u2014 goal-driven sittin-sene loop`,
+        "eternal-parallel": `${color.magenta("PARALLEL")} \u2014 fan-out 4-8 subagents per tick`
+      };
+      const msg = `Autonomy mode: ${labels[newMode]}`;
+      opts.renderer.write(msg);
+      return { message: msg };
+    }
+  };
+}
+function buildBtwCommand(opts) {
+  return {
+    name: "btw",
+    category: "Agent",
+    description: 'Drop a "by the way" note for the running agent without interrupting it \u2014 delivered at the next step',
+    argsHint: "<note>",
+    help: [
+      "/btw <note>   Stash a note; the agent reads it at the start of its next",
+      "              iteration (between tool calls) without restarting.",
+      "/btw          Show how many notes are pending.",
+      "",
+      "Use `/steer` instead when you need to abort the current work immediately."
+    ].join("\n"),
+    async run(args) {
+      const ctx = opts.context;
+      if (!ctx) {
+        return { message: "No active session \u2014 start a turn first, then use /btw to nudge it." };
+      }
+      const text = args.trim();
+      if (!text) {
+        const n = pendingBtwCount(ctx);
+        return {
+          message: n === 0 ? "No notes pending. Usage: /btw <note>" : `${n} note(s) pending \u2014 will reach the agent at its next step.`
+        };
+      }
+      const pending = setBtwNote(ctx, text);
+      return {
+        message: `\u21AF Noted (${pending} pending) \u2014 the agent will fold this in at its next step:
+  ${text}`
+      };
+    }
+  };
+}
+
+// src/slash-commands/clear.ts
+function buildClearCommand(opts) {
+  return {
     name: "clear",
     category: "Session",
     description: "Reset the session and start a new one.",
@@ -5131,6 +5275,112 @@ function buildFleetCommand(opts) {
     }
   };
 }
+
+// src/slash-commands/goal-refiner.ts
+async function refineGoal(rawGoal, provider, model) {
+  const prompt = buildRefinementPrompt(rawGoal);
+  try {
+    const signal = AbortSignal.timeout(3e4);
+    const response = await provider.complete({
+      model,
+      system: [{ type: "text", text: prompt }],
+      messages: [{ role: "user", content: "Produce the refined goal." }],
+      maxTokens: 1e3
+    }, { signal });
+    const text = extractText(response);
+    if (!text) return null;
+    return parseRefinement(text, rawGoal);
+  } catch {
+    return null;
+  }
+}
+function buildRefinementPrompt(rawGoal) {
+  return [
+    "You are a goal refinement assistant. Your job is to take a user's raw",
+    "goal description and turn it into a clear, unambiguous, actionable mission",
+    "with concrete, verifiable deliverables.",
+    "",
+    "Rules:",
+    "- The refined goal must be self-contained \u2014 someone reading only the",
+    "  refined goal should understand exactly what to do without seeing the",
+    "  original.",
+    "- Each deliverable must be a single, checkable item. Prefer concrete",
+    '  artifacts: "file X exists at path Y", "test Z passes", "function A',
+    '  is refactored into module B". Avoid vague items like "improve code".',
+    "- Include acceptance criteria where helpful.",
+    "- If the goal is already clear and concrete, refine it minimally \u2014 do",
+    "  not add fluff.",
+    "",
+    "Output format (exact \u2014 use these markers):",
+    "",
+    "REFINED_GOAL:",
+    "<the refined goal text, 1-3 sentences>",
+    "",
+    "DELIVERABLES:",
+    "- <deliverable 1>",
+    "- <deliverable 2>",
+    "- ...",
+    "",
+    "---",
+    "",
+    `RAW GOAL: ${rawGoal}`,
+    "",
+    "---",
+    "",
+    "Now produce the refined version:"
+  ].join("\n");
+}
+function extractText(result) {
+  if (!result || typeof result !== "object") return null;
+  const r = result;
+  if (Array.isArray(r.content)) {
+    const texts = r.content.filter((b) => b.type === "text").map((b) => b.text ?? "");
+    return texts.join("") || null;
+  }
+  if (Array.isArray(r.choices)) {
+    const choice = r.choices[0];
+    return choice?.message?.content ?? null;
+  }
+  if (typeof r.text === "string") return r.text;
+  return null;
+}
+function parseRefinement(text, fallbackGoal) {
+  const refinedMatch = text.match(/REFINED_GOAL:\s*\n?([\s\S]*?)(?=\nDELIVERABLES:|$)/i);
+  const refinedGoal = refinedMatch?.[1]?.trim() || fallbackGoal;
+  const deliverablesMatch = text.match(/DELIVERABLES:\s*\n([\s\S]*?)$/i);
+  const deliverablesRaw = deliverablesMatch?.[1] ?? "";
+  const deliverables = deliverablesRaw.split("\n").map((line) => line.replace(/^[\s-]*[-*]\s*/, "").trim()).filter((line) => line.length > 0 && !line.startsWith("REFINED_GOAL"));
+  return {
+    refinedGoal,
+    deliverables: deliverables.length > 0 ? deliverables : []
+  };
+}
+function refineGoalHeuristic(rawGoal) {
+  const trimmed = rawGoal.trim();
+  return {
+    refinedGoal: trimmed,
+    deliverables: extractHeuristicDeliverables(trimmed)
+  };
+}
+function extractHeuristicDeliverables(goal) {
+  const deliverables = [];
+  const lines = goal.split(/[.;]\s*/);
+  for (const line of lines) {
+    const cleaned = line.trim();
+    if (!cleaned) continue;
+    if (/\b(add|build|create|fix|implement|refactor|write|remove|update|migrate|set up|configure|deploy|test|document)\b/i.test(
+      cleaned
+    )) {
+      deliverables.push(cleaned);
+    }
+  }
+  if (deliverables.length === 0) {
+    deliverables.push(goal.trim());
+  }
+  return deliverables;
+}
+
+// src/slash-commands/goal.ts
 var KNOWN_VERBS = /* @__PURE__ */ new Set([
   "",
   "show",
@@ -5142,25 +5392,31 @@ var KNOWN_VERBS = /* @__PURE__ */ new Set([
   "journal",
   "log",
   "pause",
-  "resume"
+  "resume",
+  "refine"
 ]);
 function buildGoalCommand(opts) {
   return {
     name: "goal",
     category: "Agent",
-    description: "Set, inspect, or clear the long-running autonomous mission used by /autonomy eternal.",
+    description: "Set, inspect, or clear the long-running autonomous mission. Auto-refines goals for clarity.",
     help: [
       "Usage:",
-      "  /goal                     Show current goal + recent journal",
-      "  /goal set <text>          Set a new goal (overwrites previous)",
+      "  /goal                     Show current goal + progress + recent journal",
+      "  /goal set <text>          Set a new goal (auto-refined for clarity)",
+      "  /goal refine              Re-refine the current goal",
       "  /goal clear               Clear the goal (stops eternal mode if running)",
-      "  /goal pause               Pause at end of current iteration (no-op if already paused)",
-      "  /goal resume              Resume a paused goal (no-op if not paused)",
-      "  /goal status              Same as /goal (alias)",
+      "  /goal pause               Pause at end of current iteration",
+      "  /goal resume              Resume a paused goal",
       "  /goal journal [N]         Show last N journal entries (default 25)",
       "",
+      "When a goal is set, WrongStack auto-refines it using the LLM to:",
+      "  \u2022 Make it unambiguous and concrete",
+      "  \u2022 Extract verifiable deliverables with acceptance criteria",
+      "  \u2022 Estimate completion progress (shown as a progress bar)",
+      "",
       "Stage flow: decide \u2192 execute \u2192 reflect \u2192 sleep | paused | stopped",
-      "Pausing stops after current iteration completes. Resume continues from next iteration.",
+      "The engine updates progress after each iteration toward the deliverable list.",
       "",
       "Goals live in ~/.wrongstack/projects/<hash>/goal.json and persist across sessions.",
       "A goal is the prerequisite for /autonomy eternal \u2014 the engine consults it on",
@@ -5196,24 +5452,93 @@ function buildGoalCommand(opts) {
             opts.renderer.writeWarning(msg2);
             return { message: msg2 };
           }
+          let refined = null;
+          if (opts.llmProvider && opts.llmModel) {
+            opts.renderer.write(color.dim("Refining goal with LLM\u2026"));
+            refined = await refineGoal(setText, opts.llmProvider, opts.llmModel);
+          }
+          if (!refined) {
+            refined = refineGoalHeuristic(setText);
+          }
           const existing = await loadGoal(goalPath);
-          const next = existing ? { ...existing, goal: setText, setAt: (/* @__PURE__ */ new Date()).toISOString(), lastActivityAt: (/* @__PURE__ */ new Date()).toISOString() } : emptyGoal(setText);
+          const now = (/* @__PURE__ */ new Date()).toISOString();
+          const next = existing ? {
+            ...existing,
+            goal: setText,
+            refinedGoal: refined.refinedGoal,
+            deliverables: refined.deliverables,
+            setAt: now,
+            lastActivityAt: now,
+            progress: void 0,
+            // reset progress
+            progressNote: void 0
+          } : {
+            ...emptyGoal(setText),
+            refinedGoal: refined.refinedGoal,
+            deliverables: refined.deliverables
+          };
           await saveGoal(goalPath, next);
-          const shortGoal = setText.length > 80 ? `${setText.slice(0, 80)}\u2026` : setText;
-          const msg = `\u{1F3AF} ${color.green("Goal locked:")} ${shortGoal}
-${color.dim(`Stored in ${goalPath} \u2014 Esc / /steer to redirect, Ctrl+C to stop.`)}`;
+          const lines = [];
+          lines.push(
+            `\u{1F3AF} ${color.green("Goal locked:")} ${color.bold(refined.refinedGoal)}`
+          );
+          if (refined.refinedGoal !== setText) {
+            lines.push(color.dim(`  (original: "${setText.length > 60 ? setText.slice(0, 60) + "\u2026" : setText}")`));
+          }
+          if (refined.deliverables.length > 0) {
+            lines.push("");
+            lines.push(`${color.bold("Deliverables")} (${refined.deliverables.length}):`);
+            for (const d of refined.deliverables) {
+              lines.push(`  ${color.dim("\u25CB")} ${d}`);
+            }
+          }
+          lines.push("");
+          lines.push(
+            color.dim(`Stored in ${goalPath} \u2014 progress tracked automatically.`)
+          );
+          const msg = lines.join("\n");
+          opts.renderer.write(msg);
+          return {
+            message: msg,
+            runText: buildGoalPreamble(refined.refinedGoal, refined.deliverables)
+          };
+        }
+        case "refine": {
+          const current = await loadGoal(goalPath);
+          if (!current) {
+            const msg2 = "No goal set to refine. Use /goal set <text> first.";
+            opts.renderer.writeWarning(msg2);
+            return { message: msg2 };
+          }
+          let refined = null;
+          if (opts.llmProvider && opts.llmModel) {
+            opts.renderer.write(color.dim("Re-refining goal with LLM\u2026"));
+            refined = await refineGoal(current.goal, opts.llmProvider, opts.llmModel);
+          }
+          if (!refined) {
+            refined = refineGoalHeuristic(current.goal);
+          }
+          const updated = {
+            ...current,
+            refinedGoal: refined.refinedGoal,
+            deliverables: refined.deliverables
+          };
+          await saveGoal(goalPath, updated);
+          const msg = `${color.green("\u2713")} Goal re-refined with ${refined.deliverables.length} deliverables.`;
           opts.renderer.write(msg);
-          return { message: msg, runText: buildGoalPreamble(setText) };
+          return { message: `${msg}
+
+${formatGoal(updated)}` };
         }
         case "clear":
         case "reset": {
-          const existing = await loadGoal(goalPath);
-          if (!existing) {
+          const current = await loadGoal(goalPath);
+          if (!current) {
             const msg2 = "No goal to clear.";
             opts.renderer.write(msg2);
             return { message: msg2 };
           }
-          const abandoned = { ...existing, goalState: "abandoned" };
+          const abandoned = { ...current, goalState: "abandoned" };
           await saveGoal(goalPath, abandoned);
           const { unlink: unlink4 } = await import('fs/promises');
           try {
@@ -5288,7 +5613,7 @@ ${lines.join("\n")}`;
           return { message: msg };
         }
         default: {
-          const msg = `Unknown subcommand "${verb}". Try: show | set <text> | clear | journal [N]`;
+          const msg = `Unknown subcommand "${verb}". Try: show | set <text> | refine | clear | journal [N]`;
           opts.renderer.writeWarning(msg);
           return { message: msg };
         }
@@ -6751,12 +7076,14 @@ async function patchGlobalConfig2(globalConfigPath, mutate) {
 function buildSetModelCommand(opts) {
   const help = [
     "Usage:",
-    "  /setmodel                              Show leader model + the task\u2192model matrix",
+    "  /setmodel                              Show leader model + matrix + resolution summary",
     "  /setmodel list                         List keyed providers, their models, and valid keys",
-    "  /setmodel leader <provider> <model>    Set the main (leader) model",
+    "  /setmodel leader <provider> <model>    Set the main (leader / brain) model",
     "  /setmodel set <key> <provider>/<model> Pin a role/phase/* to a model",
     "  /setmodel set <key> <model>            Pin to a model on the leader provider",
     "  /setmodel clear <key>                  Remove a matrix entry",
+    "  /setmodel resolve <role>              Walk the resolution chain for one role",
+    "  /setmodel doctor                       Validate matrix entries (orphans, typos, missing keys)",
     "",
     "Keys: a catalog role (e.g. security-scanner), a phase (" + MATRIX_PHASE_KEYS.join(", ") + "),",
     "or * for the fleet-wide default. Precedence at spawn: role \u2192 phase \u2192 * \u2192 leader.",
@@ -6770,24 +7097,57 @@ function buildSetModelCommand(opts) {
     const lines = [
       `${color.bold("WrongStack")} ${color.dim("\u2014 Models")}`,
       "",
-      `  leader: ${color.cyan(`${config.provider}/${config.model}`)}   ${color.dim("change: /setmodel leader <provider> <model>")}`,
-      "",
-      `  ${color.bold("task \u2192 model matrix")} ${color.dim("(role \u2192 phase \u2192 * \u2192 leader)")}`
+      `  ${color.bold("leader")}  ${color.cyan(`${config.provider}/${config.model}`)}   ${color.dim("/setmodel leader <provider> <model>")}`,
+      ""
     ];
     if (keys.length === 0) {
       lines.push(
-        `    ${color.dim("(empty)  set one: /setmodel set <role|phase|*> <provider>/<model>")}`
+        `  ${color.bold("matrix")} ${color.dim("(empty)")}`,
+        `    ${color.dim("pin a role: /setmodel set <role> <provider>/<model>")}`,
+        `    ${color.dim("set default: /setmodel set * <provider>/<model>")}`
       );
     } else {
+      lines.push(`  ${color.bold("matrix")} ${color.dim("(role \u2192 phase \u2192 * \u2192 leader)")}`);
       for (const k of keys.sort()) {
         const kind = matrixKeyKind(k);
         const tag = kind === "unknown" ? color.red("?") : color.dim(kind);
         lines.push(`    ${color.amber(k.padEnd(22))} \u2192 ${fmtEntry(expectDefined(matrix[k]))}   ${tag}`);
       }
     }
-    lines.push("", color.dim("  /setmodel list for valid keys \xB7 /setmodel help for usage"));
+    const summaryRoles = getSummaryRoles();
+    if (summaryRoles.length > 0) {
+      lines.push("");
+      lines.push(`  ${color.bold("resolution")} ${color.dim("(selected roles)")}`);
+      for (const role of summaryRoles) {
+        const entry = resolveModelMatrix(matrix, role);
+        const provider = entry?.provider ?? config.provider;
+        const model = entry?.model ?? config.model;
+        const source = resolutionSource(matrix, role);
+        lines.push(`    ${color.dim(role.padEnd(22))} \u2192 ${color.cyan(`${provider}/${model}`)}  ${color.dim(source)}`);
+      }
+    }
+    lines.push("", color.dim("  /setmodel list \xB7 resolve <role> \xB7 doctor \xB7 help"));
     return lines.join("\n");
   }
+  function getSummaryRoles() {
+    const picks = [];
+    for (const phase of MATRIX_PHASE_KEYS) {
+      const agents = AGENTS_BY_PHASE[phase];
+      if (agents && agents.length > 0) {
+        picks.push(agents[0].config.role);
+      }
+    }
+    picks.push("security-scanner", "bug-hunter");
+    return [...new Set(picks)].sort();
+  }
+  function resolutionSource(matrix, role) {
+    if (!matrix) return "leader";
+    if (matrix[role]) return "role";
+    const phase = phaseForRole(role);
+    if (phase && matrix[phase]) return `phase (${phase})`;
+    if (matrix["*"]) return "default (*)";
+    return "leader";
+  }
   return {
     name: "setmodel",
     category: "Config",
@@ -6804,6 +7164,7 @@ function buildSetModelCommand(opts) {
       const config = opts.configStore.get();
       const keyed = keyedProviderIds(config);
       const globalConfigPath = opts.paths.globalConfig;
+      const matrix = config.modelMatrix ?? {};
       if (sub === "list") {
         const provLines = keyed.map((id) => {
           const models = config.providers?.[id]?.models ?? [];
@@ -6824,6 +7185,119 @@ function buildSetModelCommand(opts) {
           ].join("\n")
         };
       }
+      if (sub === "resolve") {
+        const role = parts[1];
+        if (!role) {
+          return { message: `${color.amber("Usage:")} /setmodel resolve <role>` };
+        }
+        const kind = matrixKeyKind(role);
+        if (kind === "unknown" && role !== "*") {
+          return {
+            message: `${color.red("Unknown role")}: "${role}". Use ${color.dim("/setmodel list")} to see valid roles.`
+          };
+        }
+        const lines = [
+          `${color.bold("Resolution chain")} for ${color.amber(role)}`,
+          ""
+        ];
+        const phase = phaseForRole(role);
+        const resolved = resolveModelMatrix(matrix, role);
+        if (matrix[role]) {
+          lines.push(`  1. matrix["${role}"] \u2192 ${fmtEntry(expectDefined(matrix[role]))}  ${color.green("\u2713 exact role")}`);
+        } else {
+          lines.push(`  1. matrix["${role}"] \u2192 ${color.dim("not set")}`);
+        }
+        if (phase) {
+          if (matrix[phase]) {
+            lines.push(`  2. matrix["${phase}"] \u2192 ${fmtEntry(expectDefined(matrix[phase]))}  ${matrix[role] ? color.dim("(skipped \u2014 role matched)") : color.green("\u2713 phase match")}`);
+          } else {
+            lines.push(`  2. matrix["${phase}"] \u2192 ${color.dim("not set")}`);
+          }
+        }
+        if (matrix["*"]) {
+          const skipped = matrix[role] || phase && matrix[phase];
+          lines.push(`  3. matrix["*"] \u2192 ${fmtEntry(expectDefined(matrix["*"]))}  ${skipped ? color.dim("(skipped)") : color.green("\u2713 default")}`);
+        } else {
+          lines.push(`  3. matrix["*"] \u2192 ${color.dim("not set")}`);
+        }
+        const leaderSkipped = matrix[role] || phase && matrix[phase] || matrix["*"];
+        lines.push(`  4. ${color.dim("leader fallback")} \u2192 ${color.cyan(`${config.provider}/${config.model}`)}  ${leaderSkipped ? color.dim("(skipped)") : color.green("\u2713 used")}`);
+        lines.push("");
+        if (resolved) {
+          const rp = resolved.provider ?? config.provider;
+          lines.push(`${color.green("\u2713 Resolved")}: ${color.cyan(`${rp}/${resolved.model}`)}`);
+        } else {
+          lines.push(`${color.green("\u2713 Resolved")}: ${color.cyan(`${config.provider}/${config.model}`)} ${color.dim("(leader)")}`);
+        }
+        return { message: lines.join("\n") };
+      }
+      if (sub === "doctor") {
+        const issues = [];
+        const warnings = [];
+        for (const [key, entry] of Object.entries(matrix)) {
+          const kind = matrixKeyKind(key);
+          if (kind === "unknown") {
+            issues.push(
+              `${color.red("\u2717")} ${color.amber(key)}: not a valid role, phase, or * \u2014 ${color.dim("typo or stale entry?")}`
+            );
+          }
+          if (entry.provider) {
+            const provCfg2 = config.providers?.[entry.provider];
+            if (!provCfg2) {
+              issues.push(
+                `${color.red("\u2717")} ${color.amber(key)}: provider "${entry.provider}" is not configured`
+              );
+            } else if (!providerHasKey(provCfg2)) {
+              warnings.push(
+                `${color.amber("\u26A0")} ${color.amber(key)}: provider "${entry.provider}" has no API key`
+              );
+            }
+          }
+          const effectiveProvider = entry.provider ?? config.provider;
+          const provCfg = config.providers?.[effectiveProvider];
+          if (provCfg?.models && provCfg.models.length > 0) {
+            if (!provCfg.models.includes(entry.model)) {
+              warnings.push(
+                `${color.amber("\u26A0")} ${color.amber(key)}: model "${entry.model}" not in ${effectiveProvider}'s model list (${provCfg.models.join(", ")})`
+              );
+            }
+          }
+        }
+        if (Object.keys(matrix).length > 0 && !matrix["*"]) {
+          const covered = /* @__PURE__ */ new Set();
+          for (const [key] of Object.entries(matrix)) {
+            covered.add(key);
+          }
+          const phasesCovered = new Set(Object.keys(matrix).filter((k) => matrixKeyKind(k) === "phase"));
+          const unprotected = [];
+          for (const role of Object.keys(AGENT_CATALOG)) {
+            if (covered.has(role)) continue;
+            const ph = phaseForRole(role);
+            if (ph && phasesCovered.has(ph)) continue;
+            unprotected.push(role);
+          }
+          if (unprotected.length > 0) {
+            const sample = unprotected.slice(0, 10);
+            const suffix = unprotected.length > 10 ? ` +${unprotected.length - 10} more` : "";
+            warnings.push(
+              `${color.amber("\u26A0")} ${unprotected.length} role(s) have no matrix coverage and no * default: ${sample.join(", ")}${suffix}`
+            );
+          }
+        }
+        const header = [
+          `${color.bold("Matrix Doctor")} ${color.dim("\u2014 " + Object.keys(matrix).length + " entries")}`,
+          ""
+        ];
+        if (issues.length === 0 && warnings.length === 0) {
+          header.push(`${color.green("\u2713")} All matrix entries are valid. No issues found.`);
+        }
+        const allLines = [
+          ...header,
+          ...issues.length ? ["", `${color.bold("Issues")}:`, ...issues] : [],
+          ...warnings.length ? ["", `${color.bold("Warnings")}:`, ...warnings] : []
+        ];
+        return { message: allLines.join("\n") };
+      }
       try {
         if (sub === "leader") {
           const provider = parts[1];
@@ -6868,9 +7342,9 @@ function buildSetModelCommand(opts) {
             };
           }
           const decrypted = await patchGlobalConfig2(globalConfigPath, (cfg) => {
-            const matrix = { ...cfg.modelMatrix ?? {} };
-            matrix[key] = parsed.provider ? { provider: parsed.provider, model: parsed.model } : { model: parsed.model };
-            cfg.modelMatrix = matrix;
+            const matrix2 = { ...cfg.modelMatrix ?? {} };
+            matrix2[key] = parsed.provider ? { provider: parsed.provider, model: parsed.model } : { model: parsed.model };
+            cfg.modelMatrix = matrix2;
           });
           opts.configStore.update({
             modelMatrix: decrypted.modelMatrix
@@ -6885,9 +7359,9 @@ function buildSetModelCommand(opts) {
             return { message: `${color.amber("No matrix entry")} for "${key}".` };
           }
           const decrypted = await patchGlobalConfig2(globalConfigPath, (cfg) => {
-            const matrix = { ...cfg.modelMatrix ?? {} };
-            delete matrix[key];
-            cfg.modelMatrix = matrix;
+            const matrix2 = { ...cfg.modelMatrix ?? {} };
+            delete matrix2[key];
+            cfg.modelMatrix = matrix2;
           });
           opts.configStore.update({
             modelMatrix: decrypted.modelMatrix
@@ -7456,6 +7930,198 @@ function buildTodosCommand(opts) {
     }
   };
 }
+function findTask(tasks, query) {
+  const asIndex = Number.parseInt(query, 10);
+  if (!Number.isNaN(asIndex)) {
+    const idx = asIndex - 1;
+    const item = tasks[idx];
+    if (item) return { idx, item };
+  }
+  const byId = tasks.findIndex((t) => t.id === query);
+  if (byId >= 0) {
+    const item = tasks[byId];
+    if (item) return { idx: byId, item };
+  }
+  const q = query.toLowerCase();
+  const byTitle = tasks.findIndex((t) => t.title.toLowerCase().includes(q));
+  if (byTitle >= 0) {
+    const item = tasks[byTitle];
+    if (item) return { idx: byTitle, item };
+  }
+  return null;
+}
+function validateType(s) {
+  const valid = ["feature", "bugfix", "refactor", "docs", "test", "chore"];
+  return valid.includes(s) ? s : null;
+}
+function validatePriority(s) {
+  const valid = ["critical", "high", "medium", "low"];
+  return valid.includes(s) ? s : null;
+}
+function validateStatus(s) {
+  const valid = ["pending", "in_progress", "blocked", "failed", "review", "completed"];
+  return valid.includes(s) ? s : null;
+}
+function buildTasksCommand(_opts) {
+  return {
+    name: "tasks",
+    category: "Inspect",
+    description: "Manage structured tasks with dependencies, types, and priorities: /tasks [show|add <title>|start|done|fail|status <id> <status>|promote <id>|clear]",
+    help: [
+      "Usage:",
+      "  /tasks                            Show task progress + list",
+      "  /tasks show                       Same as no args",
+      "  /tasks add <title> [type] [prio]  Add a task",
+      "  /tasks start <id|index>           Mark task in-progress",
+      "  /tasks done <id|index>            Mark task completed",
+      "  /tasks fail <id|index>            Mark task failed",
+      "  /tasks status <id> <status>       Set exact status (pending|in_progress|blocked|review|completed|failed)",
+      "  /tasks depends <id> <depId...>    Set dependencies for a task",
+      "  /tasks assign <id> <agent>        Assign task to an agent/subagent",
+      "  /tasks promote <id>               Promote task to todo items",
+      "  /tasks clear                      Remove all tasks",
+      "",
+      "Types: feature, bugfix, refactor, docs, test, chore",
+      "Priorities: critical, high, medium, low"
+    ].join("\n"),
+    async run(args, ctx) {
+      const taskPath = ctx.meta?.["task.path"];
+      if (typeof taskPath !== "string" || !taskPath) {
+        return { message: "Task storage is not configured for this session." };
+      }
+      const sessionId = ctx.session?.id ?? "unknown";
+      const file = await loadTasks(taskPath) ?? emptyTaskFile(sessionId);
+      const [verb, ...rest] = args.trim().split(/\s+/);
+      const restJoined = rest.join(" ").trim();
+      switch (verb) {
+        case "":
+        case "show":
+        case "list":
+          return { message: formatTaskList(file.tasks) };
+        case "progress":
+        case "statusline":
+          return { message: formatTaskProgress(file.tasks) };
+        case "add": {
+          if (!restJoined) return { message: "Usage: /tasks add <title> [type] [priority]" };
+          const parts = restJoined.split(/\s+/);
+          const title = parts[0] ?? "";
+          const type = validateType(parts[1] ?? "") ?? "feature";
+          const priority = validatePriority(parts[2] ?? "") ?? "medium";
+          const now = (/* @__PURE__ */ new Date()).toISOString();
+          const task = {
+            id: `task_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            title,
+            type,
+            priority,
+            status: "pending",
+            createdAt: now,
+            updatedAt: now
+          };
+          file.tasks.push(task);
+          await saveTasks(taskPath, file);
+          return { message: `Added: ${task.title}
+
+${formatTaskProgress(file.tasks)}` };
+        }
+        case "start":
+        case "done":
+        case "fail": {
+          if (!restJoined) return { message: `Usage: /tasks ${verb} <id|index>` };
+          const found = findTask(file.tasks, restJoined);
+          if (!found) return { message: `No task matched "${restJoined}".` };
+          const statusMap = {
+            start: "in_progress",
+            done: "completed",
+            fail: "failed"
+          };
+          found.item.status = statusMap[verb] ?? "pending";
+          found.item.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+          await saveTasks(taskPath, file);
+          return { message: `Marked ${verb}: ${found.item.title}
+
+${formatTaskProgress(file.tasks)}` };
+        }
+        case "status": {
+          if (rest.length < 2) return { message: "Usage: /tasks status <id> <pending|in_progress|blocked|review|completed|failed>" };
+          const targetId = rest[0] ?? "";
+          const newStatus = validateStatus(rest[1] ?? "");
+          if (!newStatus) return { message: `Invalid status "${rest[1]}". Use: pending, in_progress, blocked, review, completed, failed.` };
+          const found = findTask(file.tasks, targetId);
+          if (!found) return { message: `No task matched "${targetId}".` };
+          found.item.status = newStatus;
+          found.item.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+          await saveTasks(taskPath, file);
+          return { message: `Status \u2192 ${newStatus}: ${found.item.title}
+
+${formatTaskProgress(file.tasks)}` };
+        }
+        case "depends":
+        case "deps": {
+          if (rest.length < 2) return { message: "Usage: /tasks depends <id> <depId1> [depId2 ...]" };
+          const targetId = rest[0] ?? "";
+          const depIds = rest.slice(1);
+          const found = findTask(file.tasks, targetId);
+          if (!found) return { message: `No task matched "${targetId}".` };
+          found.item.dependsOn = depIds;
+          found.item.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+          await saveTasks(taskPath, file);
+          return { message: `Dependencies set for "${found.item.title}": ${depIds.join(", ")}` };
+        }
+        case "assign": {
+          if (rest.length < 2) return { message: "Usage: /tasks assign <id> <agent>" };
+          const targetId = rest[0] ?? "";
+          const agent = rest.slice(1).join(" ");
+          const found = findTask(file.tasks, targetId);
+          if (!found) return { message: `No task matched "${targetId}".` };
+          found.item.assignee = agent;
+          found.item.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+          await saveTasks(taskPath, file);
+          return { message: `Assigned to ${agent}: "${found.item.title}"` };
+        }
+        case "promote": {
+          if (!restJoined) return { message: "Usage: /tasks promote <id|index>" };
+          const found = findTask(file.tasks, restJoined);
+          if (!found) return { message: `No task matched "${restJoined}".` };
+          found.item.status = "in_progress";
+          found.item.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+          const todos = [
+            {
+              id: `todo_${Date.now()}_task`,
+              content: found.item.title,
+              status: "in_progress",
+              activeForm: found.item.title
+            }
+          ];
+          if (found.item.description) {
+            todos.push({
+              id: `todo_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+              content: found.item.description.slice(0, 200),
+              status: "pending"
+            });
+          }
+          ctx.state.replaceTodos(todos);
+          await saveTasks(taskPath, file);
+          return {
+            message: `Promoted to ${todos.length} todo(s): "${found.item.title}"
+
+${formatTaskProgress(file.tasks)}`
+          };
+        }
+        case "clear": {
+          const n = file.tasks.length;
+          if (n === 0) return { message: "Tasks were already empty." };
+          file.tasks = [];
+          await saveTasks(taskPath, file);
+          return { message: `Cleared ${n} task${n === 1 ? "" : "s"}.` };
+        }
+        default:
+          return {
+            message: `Unknown subcommand "${verb}". Try: show | add <title> | start <id> | done <id> | fail <id> | status <id> <s> | depends <id> <deps> | assign <id> <agent> | promote <id> | clear`
+          };
+      }
+    }
+  };
+}
 function buildToolsCommand(opts) {
   return {
     name: "tools",
@@ -7583,6 +8249,7 @@ function buildBuiltinSlashCommands(opts) {
     buildPluginCommand(opts),
     buildPruneCommand(opts),
     buildMcpSlashCommand(opts),
+    buildAuthCommand(opts),
     buildDiagCommand(opts),
     buildStatsCommand(opts),
     buildSpawnCommand(opts),
@@ -7592,6 +8259,7 @@ function buildBuiltinSlashCommands(opts) {
     buildEnhanceCommand(opts),
     buildMemoryCommand(opts),
     buildTodosCommand(opts),
+    buildTasksCommand(),
     buildSddCommand(opts),
     buildSaveCommand(opts),
     buildLoadCommand(opts),
@@ -8769,12 +9437,12 @@ function pickGroupIndex(opts) {
     try {
       let current = 0;
       try {
-        const parsed = Number.parseInt(fs12.readFileSync(opts.cursorFile, "utf8").trim(), 10);
+        const parsed = Number.parseInt(fs13.readFileSync(opts.cursorFile, "utf8").trim(), 10);
         if (Number.isFinite(parsed)) current = wrap(parsed);
       } catch {
       }
-      fs12.mkdirSync(path8.dirname(opts.cursorFile), { recursive: true });
-      fs12.writeFileSync(opts.cursorFile, String(wrap(current + 1)));
+      fs13.mkdirSync(path8.dirname(opts.cursorFile), { recursive: true });
+      fs13.writeFileSync(opts.cursorFile, String(wrap(current + 1)));
       return current;
     } catch {
     }
@@ -9282,49 +9950,114 @@ async function spawnACPAgent(args, deps) {
   }
 }
 
-// src/auth-menu.ts
+// src/auth-menu/add-provider.ts
 init_provider_config_utils();
-async function runAuthMenu(deps) {
-  for (; ; ) {
-    const providers = await loadProviders(deps);
-    renderTopMenu(deps.renderer, providers);
-    const ids = Object.keys(providers).sort();
-    const choice = (await deps.reader.readLine(`
-${color.amber("?")} Pick: `)).trim().toLowerCase();
-    if (!choice || choice === "q" || choice === "quit" || choice === "exit") {
-      deps.renderer.write(color.dim("Done.\n"));
-      return 0;
-    }
-    if (choice === "a" || choice === "add") {
-      await addForNewProvider(deps);
-      continue;
-    }
-    if (choice === "c" || choice === "custom") {
-      await addCustomProvider(deps);
-      continue;
-    }
-    const idx = Number.parseInt(choice, 10);
-    if (!Number.isNaN(idx) && idx >= 1 && idx <= ids.length) {
-      const pid = expectDefined(ids[idx - 1]);
-      await manageProvider(pid, deps);
-      continue;
-    }
-    const byId = ids.find((id) => id.toLowerCase() === choice);
-    if (byId) {
-      await manageProvider(byId, deps);
-      continue;
+
+// src/auth-menu/helpers.ts
+init_provider_config_utils();
+async function loadProviders(deps) {
+  return loadConfigProviders(deps.globalConfigPath, deps.vault, {
+    warn: (msg) => deps.renderer.writeWarning(msg)
+  });
+}
+
+// src/auth-menu/shared.ts
+init_provider_config_utils();
+function renderProviderLine(renderer, id, cfg, idx) {
+  const keys = normalizeKeys(cfg);
+  const active = activeLabel(cfg, keys);
+  const firstKey = keys[0];
+  let summary;
+  if (keys.length === 0) {
+    summary = color.dim("(no keys)");
+  } else if (keys.length === 1) {
+    summary = maskedKey(firstKey?.apiKey ?? "");
+  } else {
+    const activeKeyObj = active != null ? keys.find((k) => k.label === active) : void 0;
+    summary = `${color.dim(`${keys.length} keys`)} ${color.dim("active:")} ${color.bold(active ?? "?")} ` + maskedKey(activeKeyObj?.apiKey ?? firstKey?.apiKey ?? "");
+  }
+  const fam = cfg.family ? color.dim(`[${cfg.family}]`) : "";
+  const aliasHint = cfg.type && cfg.type !== id ? color.dim(`\u2192 ${cfg.type}`) : "";
+  renderer.write(
+    `    ${color.dim(`${idx}.`.padStart(4))} ${id.padEnd(22)} ${fam} ${aliasHint} ${summary}
+`
+  );
+}
+function renderProviderHeader(renderer, providerId, cfg) {
+  const keys = normalizeKeys(cfg);
+  const active = activeLabel(cfg, keys);
+  renderer.write(
+    `
+${color.bold(providerId)} ${cfg.family ? color.dim(`[${cfg.family}]`) : color.amber("[no family]")}
+`
+  );
+  const details = [
+    color.dim(`  type:    ${cfg.type ?? providerId}`),
+    color.dim(
+      `  family:  ${cfg.family ?? "(unset \u2192 resolved from models.dev when type matches)"}`
+    ),
+    color.dim(`  baseUrl: ${cfg.baseUrl ?? "(unset \u2192 catalog default)"}`)
+  ];
+  if (cfg.envVars && cfg.envVars.length > 0) {
+    details.push(color.dim(`  envVars: ${cfg.envVars.join(", ")}`));
+  }
+  if (cfg.models && cfg.models.length > 0) {
+    details.push(color.dim(`  models:  ${cfg.models.join(", ")}`));
+  }
+  renderer.write(details.join("\n") + "\n");
+  if (keys.length === 0) {
+    renderer.write(color.dim("  (no keys saved)\n"));
+  } else {
+    for (let i = 0; i < keys.length; i++) {
+      renderKeyLine(renderer, keys[i], i + 1, active);
     }
-    deps.renderer.writeError(`Unknown selection: "${choice}"`);
   }
 }
-function renderTopMenu(renderer, providers) {
+function renderKeyLine(renderer, key, idx, active) {
+  const marker = key.label === active ? color.green("\u25CF") : color.dim("\u25CB");
+  renderer.write(
+    `  ${color.dim(`${idx}.`.padStart(4))} ${marker} ${key.label.padEnd(20)} ${maskedKey(key.apiKey)}  ${color.dim(key.createdAt)}
+`
+  );
+}
+function renderActions(renderer, keysLength) {
   renderer.write(`
-${color.bold("WrongStack")} ${color.dim("\u2014 API keys")}
-
+  ${color.dim("Actions:")}
+`);
+  renderer.write(`    ${color.bold("a")}        Add another key
+`);
+  if (keysLength > 0) {
+    renderer.write(`    ${color.bold("u")} <n>    Update key <n>
+`);
+    renderer.write(`    ${color.bold("d")} <n>    Delete key <n>
+`);
+    renderer.write(`    ${color.bold("s")} <n>    Set key <n> as active
+`);
+  }
+  renderer.write(`    ${color.bold("f")}        Edit family
+`);
+  renderer.write(`    ${color.bold("B")}        Edit baseUrl
 `);
+  renderer.write(`    ${color.bold("m")}        Edit visible model list
+`);
+  renderer.write(`    ${color.bold("x")}        Remove this provider entirely
+`);
+  renderer.write(`    ${color.bold("b")}        Back
+`);
+  renderer.write(`    ${color.bold("q")}        Quit
+`);
+}
+function renderTopMenu(renderer, providers) {
+  renderer.write(
+    `
+${color.bold("WrongStack")} ${color.dim("\u2014 API key manager")}
+
+`
+  );
   const ids = Object.keys(providers).sort();
   if (ids.length === 0) {
     renderer.write(color.dim("  No providers configured yet.\n"));
+    renderer.write(color.dim("  Use (a) to add one from the models.dev catalog, or (c) for a custom provider.\n"));
   } else {
     renderer.write(`  ${color.dim("Saved providers:")}
 `);
@@ -9332,306 +10065,116 @@ ${color.bold("WrongStack")} ${color.dim("\u2014 API keys")}
     for (const id of ids) {
       const cfg = providers[id];
       if (!cfg) continue;
-      const keys = normalizeKeys(cfg);
-      const active = activeLabel(cfg, keys);
-      const firstKey = keys[0];
-      const summary = keys.length === 0 ? color.dim("(no keys)") : keys.length === 1 ? maskedKey(firstKey?.apiKey ?? "") : `${color.dim(`${keys.length} keys`)} ${color.dim("active:")} ${color.bold(active ?? "?")} ${maskedKey(keys.find((k) => k.label === active)?.apiKey ?? firstKey?.apiKey ?? "")}`;
-      const fam = cfg.family ? color.dim(`[${cfg.family}]`) : "";
-      const aliasHint = cfg.type && cfg.type !== id ? color.dim(`\u2192 ${cfg.type}`) : "";
-      renderer.write(
-        `    ${color.dim(`${idx}.`.padStart(4))} ${id.padEnd(22)} ${fam} ${aliasHint} ${summary}
-`
-      );
+      renderProviderLine(renderer, id, cfg, idx);
       idx++;
     }
   }
   renderer.write(`
   ${color.dim("Actions:")}
 `);
-  renderer.write(`    ${color.bold("a")}  Add key for a new provider (from catalog)
+  renderer.write(`    ${color.bold("a")}  Add a provider (from catalog)
 `);
-  renderer.write(`    ${color.bold("c")}  Add custom provider (type + family + baseUrl)
+  renderer.write(`    ${color.bold("c")}  Add a custom provider
+`);
+  if (ids.length > 0) {
+    renderer.write(`    ${color.dim("1-")}${color.dim(String(ids.length))}  ${color.bold("Manage a provider")}
 `);
+  }
   renderer.write(`    ${color.bold("q")}  Quit
 `);
-  if (ids.length > 0) {
-    renderer.write(color.dim(`
-  Pick a number to manage that provider's keys.
-`));
+}
+async function readKeyInput(deps, intent) {
+  const key = (await deps.reader.readSecret(
+    `  ${color.amber("?")} ${intent} ${color.dim("(hidden, paste OK)")}: `
+  )).trim();
+  if (!key) {
+    deps.renderer.writeError("No key entered.");
+    return void 0;
   }
+  return key;
 }
-async function manageProvider(providerId, deps) {
-  for (; ; ) {
-    const providers = await loadProviders(deps);
-    const cfg = providers[providerId];
-    if (!cfg) {
-      deps.renderer.writeError(`Provider "${providerId}" no longer in config.`);
-      return;
-    }
-    const keys = normalizeKeys(cfg);
-    const active = activeLabel(cfg, keys);
-    deps.renderer.write(
-      `
-${color.bold(providerId)} ${cfg.family ? color.dim(`[${cfg.family}]`) : color.amber("[no family]")}
+async function confirm(deps, question) {
+  const answer = (await deps.reader.readLine(
+    `  ${color.amber("?")} ${question} ${color.dim("[y/N/q]")} `
+  )).trim().toLowerCase();
+  if (answer === "q" || answer === "quit") return null;
+  return answer === "y" || answer === "yes";
+}
+function suggestLabel(usedLabels) {
+  let candidate = "default";
+  if (!usedLabels.has(candidate)) return candidate;
+  let n = 2;
+  while (usedLabels.has(`key${n}`)) n++;
+  return `key${n}`;
+}
+function validateFamily(raw) {
+  const valid = ["anthropic", "openai", "openai-compatible", "google"];
+  return valid.includes(raw) ? raw : null;
+}
+
+// src/auth-menu/add-provider.ts
+async function addFromCatalog(deps) {
+  let catalog = [];
+  try {
+    catalog = (await deps.modelsRegistry.listProviders()).filter(
+      (p) => p.family !== "unsupported"
+    );
+  } catch {
+    deps.renderer.writeWarning(
+      "Catalog unavailable \u2014 falling back to manual entry.\n"
+    );
+  }
+  if (catalog.length === 0) {
+    return addManualEntry(deps);
+  }
+  const saved = new Set(Object.keys(await loadProviders(deps)));
+  deps.renderer.write(
+    color.dim(
+      `  Catalog: ${catalog.length} providers. Filter to narrow, "s" for unsaved-only, or enter to show all.
 `
+    )
+  );
+  const filterRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Filter ${color.dim('(substring / "s" / q to quit)')}: `
+  )).trim();
+  if (filterRaw === "q") return false;
+  const filterLc = filterRaw.toLowerCase();
+  const showUnsavedOnly = filterLc === "s" || filterLc === "unsaved";
+  function matches(p) {
+    if (showUnsavedOnly) return !saved.has(p.id);
+    if (!filterLc) return true;
+    return p.id.toLowerCase().includes(filterLc) || p.name.toLowerCase().includes(filterLc);
+  }
+  const byFamily = /* @__PURE__ */ new Map();
+  let filteredCount = 0;
+  for (const p of catalog) {
+    if (!matches(p)) continue;
+    filteredCount++;
+    const list = byFamily.get(p.family) ?? [];
+    list.push(p);
+    byFamily.set(p.family, list);
+  }
+  if (filteredCount === 0) {
+    deps.renderer.writeError(
+      `No providers match "${filterRaw}". Try a shorter substring or check \`wstack providers\`.`
     );
+    return false;
+  }
+  if (filterRaw && !showUnsavedOnly) {
     deps.renderer.write(
-      color.dim(`  type:    ${cfg.type ?? providerId}
-`) + color.dim(
-        `  family:  ${cfg.family ?? "(unset \u2192 resolved from models.dev when type matches)"}
+      color.dim(
+        `  ${filteredCount} match${filteredCount === 1 ? "" : "es"} for "${filterRaw}".
 `
-      ) + color.dim(`  baseUrl: ${cfg.baseUrl ?? "(unset \u2192 catalog default)"}
-`)
-    );
-    if (cfg.envVars && cfg.envVars.length > 0) {
-      deps.renderer.write(color.dim(`  envVars: ${cfg.envVars.join(", ")}
-`));
-    }
-    if (cfg.models && cfg.models.length > 0) {
-      deps.renderer.write(color.dim(`  models:  ${cfg.models.join(", ")}
-`));
-    }
-    if (keys.length === 0) {
-      deps.renderer.write(color.dim("  (no keys saved)\n"));
-    } else {
-      for (let i = 0; i < keys.length; i++) {
-        const k = expectDefined(keys[i]);
-        const marker = k.label === active ? color.green("\u25CF") : color.dim("\u25CB");
-        deps.renderer.write(
-          `  ${color.dim(`${i + 1}.`.padStart(4))} ${marker} ${k.label.padEnd(20)} ${maskedKey(k.apiKey)}  ${color.dim(k.createdAt)}
-`
-        );
-      }
-    }
-    deps.renderer.write(`
-  ${color.dim("Actions:")}
-`);
-    deps.renderer.write(`    ${color.bold("a")}        Add another key
-`);
-    if (keys.length > 0) {
-      deps.renderer.write(`    ${color.bold("u")} <n>    Update key <n>
-`);
-      deps.renderer.write(`    ${color.bold("d")} <n>    Delete key <n>
-`);
-      deps.renderer.write(`    ${color.bold("s")} <n>    Set key <n> as active
-`);
-    }
-    deps.renderer.write(`    ${color.bold("f")}        Edit family
-`);
-    deps.renderer.write(`    ${color.bold("B")}        Edit baseUrl
-`);
-    deps.renderer.write(`    ${color.bold("m")}        Edit visible model list
-`);
-    deps.renderer.write(`    ${color.bold("x")}        Remove this provider entirely
-`);
-    deps.renderer.write(`    ${color.bold("b")}        Back
-`);
-    deps.renderer.write(`    ${color.bold("q")}        Quit
-`);
-    const raw = (await deps.reader.readLine(`
-${color.amber("?")} ${providerId} > `)).trim();
-    if (!raw || raw === "b" || raw === "back" || raw === "q" || raw === "quit") return;
-    const [verb, argRaw] = raw.split(/\s+/, 2);
-    const arg = argRaw ? Number.parseInt(argRaw, 10) : Number.NaN;
-    if (verb === "a" || verb === "add") {
-      await addKeyForProvider(providerId, deps, cfg);
-      continue;
-    }
-    if (verb === "x" || verb === "remove") {
-      const confirm = (await deps.reader.readLine(
-        `  ${color.amber("?")} Remove provider "${providerId}" and ${keys.length} key(s)? ${color.dim("[y/N/q]")} `
-      )).trim().toLowerCase();
-      if (confirm === "q") continue;
-      if (confirm === "y" || confirm === "yes") {
-        await mutateProviders(deps, (all) => {
-          delete all[providerId];
-        });
-        deps.renderer.write(`  ${color.green("\u2713")} Removed ${providerId}.
-`);
-        return;
-      }
-      continue;
-    }
-    if (verb === "u" || verb === "update") {
-      if (!Number.isFinite(arg) || arg < 1 || arg > keys.length) {
-        deps.renderer.writeError(`Usage: u <1-${keys.length}>`);
-        continue;
-      }
-      const target = expectDefined(keys[arg - 1]);
-      const newKey = await readKeyInput(deps, `Updated key for ${target.label}`);
-      if (!newKey) continue;
-      await mutateProviders(deps, (all) => {
-        const p = all[providerId];
-        if (!p) return;
-        const list = normalizeKeys(p).map(
-          (k) => k.label === target.label ? { ...k, apiKey: newKey, createdAt: nowIso() } : k
-        );
-        writeKeysBack(p, list);
-      });
-      deps.renderer.write(`  ${color.green("\u2713")} Updated ${providerId}/${target.label}.
-`);
-      continue;
-    }
-    if (verb === "d" || verb === "delete" || verb === "rm") {
-      if (!Number.isFinite(arg) || arg < 1 || arg > keys.length) {
-        deps.renderer.writeError(`Usage: d <1-${keys.length}>`);
-        continue;
-      }
-      const target = expectDefined(keys[arg - 1]);
-      const confirm = (await deps.reader.readLine(
-        `  ${color.amber("?")} Delete key "${target.label}" (${maskedKey(target.apiKey)})? ${color.dim("[y/N/q]")} `
-      )).trim().toLowerCase();
-      if (confirm === "q") continue;
-      if (confirm !== "y" && confirm !== "yes") continue;
-      await mutateProviders(deps, (all) => {
-        const p = all[providerId];
-        if (!p) return;
-        const list = normalizeKeys(p).filter((k) => k.label !== target.label);
-        writeKeysBack(p, list);
-        if (p.activeKey === target.label) {
-          p.activeKey = list[0]?.label;
-        }
-      });
-      deps.renderer.write(`  ${color.green("\u2713")} Deleted ${providerId}/${target.label}.
-`);
-      continue;
-    }
-    if (verb === "f" || verb === "family") {
-      const current = cfg.family ?? "";
-      const ans = (await deps.reader.readLine(
-        `  ${color.amber("?")} Family ${color.dim(`(anthropic | openai | openai-compatible | google, empty = unset, current: ${current || "unset"})`)}: `
-      )).trim();
-      if (ans !== "" && !["anthropic", "openai", "openai-compatible", "google"].includes(ans)) {
-        deps.renderer.writeError(`Invalid family: "${ans}"`);
-        continue;
-      }
-      await mutateProviders(deps, (all) => {
-        const p = all[providerId];
-        if (!p) return;
-        if (ans === "") delete p.family;
-        else p.family = ans;
-      });
-      deps.renderer.write(`  ${color.green("\u2713")} family \u2192 ${ans || "(unset)"}
-`);
-      continue;
-    }
-    if (verb === "B" || verb === "baseurl" || verb === "base-url") {
-      const current = cfg.baseUrl ?? "";
-      const ans = (await deps.reader.readLine(
-        `  ${color.amber("?")} Base URL ${color.dim(`(empty = unset, current: ${current || "unset"})`)}: `
-      )).trim();
-      await mutateProviders(deps, (all) => {
-        const p = all[providerId];
-        if (!p) return;
-        if (ans === "") delete p.baseUrl;
-        else p.baseUrl = ans;
-      });
-      deps.renderer.write(`  ${color.green("\u2713")} baseUrl \u2192 ${ans || "(unset)"}
-`);
-      continue;
-    }
-    if (verb === "m" || verb === "models") {
-      const current = (cfg.models ?? []).join(", ");
-      const ans = (await deps.reader.readLine(
-        `  ${color.amber("?")} Model ids ${color.dim(`(comma-separated, empty = catalog default, current: ${current || "none"})`)}: `
-      )).trim();
-      const list = ans ? ans.split(",").map((s) => s.trim()).filter(Boolean) : [];
-      await mutateProviders(deps, (all) => {
-        const p = all[providerId];
-        if (!p) return;
-        if (list.length === 0) delete p.models;
-        else p.models = list;
-      });
-      deps.renderer.write(
-        `  ${color.green("\u2713")} models \u2192 ${list.length === 0 ? "(catalog default)" : list.join(", ")}
-`
-      );
-      continue;
-    }
-    if (verb === "s" || verb === "set" || verb === "active") {
-      if (!Number.isFinite(arg) || arg < 1 || arg > keys.length) {
-        deps.renderer.writeError(`Usage: s <1-${keys.length}>`);
-        continue;
-      }
-      const target = expectDefined(keys[arg - 1]);
-      await mutateProviders(deps, (all) => {
-        const p = all[providerId];
-        if (!p) return;
-        const list = normalizeKeys(p);
-        writeKeysBack(p, list);
-        p.activeKey = target.label;
-      });
-      deps.renderer.write(
-        `  ${color.green("\u2713")} Active key for ${providerId} \u2192 ${color.bold(target.label)}.
-`
-      );
-      continue;
-    }
-    deps.renderer.writeError(`Unknown action: "${raw}"`);
-  }
-}
-async function addForNewProvider(deps) {
-  let catalog = [];
-  try {
-    catalog = (await deps.modelsRegistry.listProviders()).filter((p) => p.family !== "unsupported");
-  } catch {
-    deps.renderer.writeWarning("Catalog unavailable \u2014 falling back to manual entry.");
-  }
-  if (catalog.length === 0) {
-    const pid = (await deps.reader.readLine(`  ${color.amber("?")} Provider id ${color.dim("[q to quit]")}: `)).trim();
-    if (!pid || pid === "q") return;
-    const fam = (await deps.reader.readLine(
-      `  ${color.amber("?")} Family (anthropic/openai/openai-compatible/google): `
-    )).trim();
-    const baseUrl2 = (await deps.reader.readLine(`  ${color.amber("?")} Base URL ${color.dim("(optional)")}: `)).trim();
-    await addKeyForProvider(pid, deps, {
-      type: pid,
-      family: fam || void 0,
-      ...baseUrl2 ? { baseUrl: baseUrl2 } : {}
-    });
-    return;
-  }
-  const saved = new Set(Object.keys(await loadProviders(deps)));
-  deps.renderer.write(
-    color.dim(
-      `  Catalog has ${catalog.length} providers. Filter by name to narrow, or "s" for unsaved-only.
-`
-    )
-  );
-  const filterRaw = (await deps.reader.readLine(
-    `  ${color.amber("?")} Filter ${color.dim('(substring, "s" for unsaved-only, q to quit)')}: `
-  )).trim();
-  if (filterRaw === "q") return;
-  const filterLc = filterRaw.toLowerCase();
-  const showUnsavedOnly = filterLc === "s" || filterLc === "unsaved";
-  const matches = (p) => {
-    if (showUnsavedOnly) return !saved.has(p.id);
-    if (!filterLc) return true;
-    return p.id.toLowerCase().includes(filterLc) || p.name.toLowerCase().includes(filterLc);
-  };
-  const byFamily = /* @__PURE__ */ new Map();
-  let filteredCount = 0;
-  for (const p of catalog) {
-    if (!matches(p)) continue;
-    filteredCount++;
-    const list = byFamily.get(p.family) ?? [];
-    list.push(p);
-    byFamily.set(p.family, list);
-  }
-  if (filteredCount === 0) {
-    deps.renderer.writeError(
-      `No providers match "${filterRaw}". Try a shorter substring or check \`wstack providers\` for valid ids.`
-    );
-    return;
-  }
-  if (filterRaw && !showUnsavedOnly) {
-    deps.renderer.write(
-      color.dim(`  ${filteredCount} match${filteredCount === 1 ? "" : "es"} for "${filterRaw}".
-`)
+      )
     );
   }
   const ordered = [];
-  const familyOrder = ["anthropic", "openai", "google", "openai-compatible"];
+  const familyOrder = [
+    "anthropic",
+    "openai",
+    "google",
+    "openai-compatible"
+  ];
   let idx = 1;
   deps.renderer.write("\n");
   for (const fam of familyOrder) {
@@ -9657,7 +10200,7 @@ async function addForNewProvider(deps) {
     `
 ${color.amber("?")} Pick (1-${ordered.length}) or type provider id ${color.dim("[q to quit]")}: `
   )).trim();
-  if (!answer || answer === "q") return;
+  if (!answer || answer === "q") return false;
   let chosen;
   const num = Number.parseInt(answer, 10);
   if (!Number.isNaN(num) && num >= 1 && num <= ordered.length) {
@@ -9667,29 +10210,35 @@ ${color.amber("?")} Pick (1-${ordered.length}) or type provider id ${color.dim("
   }
   if (!chosen) {
     deps.renderer.writeError(`No such provider: "${answer}"`);
-    return;
+    return false;
   }
+  return addKeyForCatalogProvider(deps, chosen);
+}
+async function addKeyForCatalogProvider(deps, chosen) {
   deps.renderer.write(
     color.dim(`
-  Defaults from models.dev \u2014 press Enter to keep, or type a new value.
+  Defaults from models.dev \u2014 press Enter to keep, or type overrides.
 `)
   );
-  const famRaw = (await deps.reader.readLine(`  ${color.amber("?")} Family ${color.dim(`[${chosen.family}]`)} ${color.dim("(q to quit)")}: `)).trim();
-  if (famRaw === "q") return;
+  const famRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Family ${color.dim(`[${chosen.family}]`)} ${color.dim("(q to quit)")}: `
+  )).trim();
+  if (famRaw === "q") return false;
   let family = chosen.family;
   if (famRaw) {
-    if (!["anthropic", "openai", "openai-compatible", "google"].includes(famRaw)) {
+    const validated = validateFamily(famRaw);
+    if (!validated) {
       deps.renderer.writeError(
-        `Invalid family: "${famRaw}" (must be anthropic | openai | openai-compatible | google).`
+        `Invalid family: "${famRaw}" (must be: anthropic, openai, openai-compatible, google).`
       );
-      return;
+      return false;
     }
-    family = famRaw;
+    family = validated;
   }
   const baseRaw = (await deps.reader.readLine(
     `  ${color.amber("?")} Base URL ${color.dim(`[${chosen.apiBase ?? "unset"}]`)} ${color.dim("(q to quit)")}: `
   )).trim();
-  if (baseRaw === "q") return;
+  if (baseRaw === "q") return false;
   const baseUrl = baseRaw || chosen.apiBase;
   const providersNow = await loadProviders(deps);
   let suggestedAlias = chosen.id;
@@ -9703,7 +10252,7 @@ ${color.amber("?")} Pick (1-${ordered.length}) or type provider id ${color.dim("
     suggestedAlias = candidate;
   }
   const aliasRaw = (await deps.reader.readLine(
-    `  ${color.amber("?")} Save under alias ${color.dim(`[${suggestedAlias}]`)} ${color.dim("(used as `--provider <alias>`)")}: `
+    `  ${color.amber("?")} Save as alias ${color.dim(`[${suggestedAlias}]`)} ${color.dim("(used with --provider <alias>)")}: `
   )).trim();
   const alias = aliasRaw || suggestedAlias;
   const existing = providersNow[alias];
@@ -9717,10 +10266,10 @@ ${color.amber("?")} Pick (1-${ordered.length}) or type provider id ${color.dim("
   New:      family=${family}, baseUrl=${baseUrl ?? "(unset)"}
   Pick a different alias to keep them separate.`
       );
-      return;
+      return false;
     }
   }
-  await addKeyForProvider(alias, deps, {
+  return addKeyForProvider(alias, deps, {
     type: chosen.id,
     family,
     baseUrl,
@@ -9730,39 +10279,41 @@ ${color.amber("?")} Pick (1-${ordered.length}) or type provider id ${color.dim("
 async function addCustomProvider(deps) {
   deps.renderer.write(
     `
-${color.bold("Custom provider")} ${color.dim("\u2014 for local models or proxies not in the models.dev catalog.")}
+${color.bold("Custom provider")} ${color.dim("\u2014 for local models or proxies not in the catalog.")}
 `
   );
   const type = (await deps.reader.readLine(
     `  ${color.amber("?")} Provider id ${color.dim('(e.g. "local-llama", "my-proxy", q to quit)')}: `
   )).trim();
-  if (!type || type === "q") return;
+  if (!type || type === "q") return false;
   const existing = (await loadProviders(deps))[type];
   if (existing) {
-    deps.renderer.writeWarning(`"${type}" already exists. Pick it from the main menu to edit.`);
-    return;
+    deps.renderer.writeWarning(
+      `"${type}" already exists. Pick it from the main menu to edit.`
+    );
+    return false;
   }
   const familyRaw = (await deps.reader.readLine(
     `  ${color.amber("?")} Wire family ${color.dim("(anthropic | openai | openai-compatible | google)")} ${color.dim("(q to quit)")}: `
   )).trim();
-  if (familyRaw === "q") return;
-  if (!["anthropic", "openai", "openai-compatible", "google"].includes(familyRaw)) {
+  if (familyRaw === "q") return false;
+  const family = validateFamily(familyRaw);
+  if (!family) {
     deps.renderer.writeError(`Invalid family: "${familyRaw}"`);
-    return;
+    return false;
   }
-  const family = familyRaw;
   const baseUrl = (await deps.reader.readLine(
-    `  ${color.amber("?")} Base URL ${color.dim("(e.g. http://localhost:11434/v1, leave empty if not needed)")}: `
+    `  ${color.amber("?")} Base URL ${color.dim("(e.g. http://localhost:11434/v1, optional)")}: `
   )).trim();
   const modelsRaw = (await deps.reader.readLine(
     `  ${color.amber("?")} Model ids ${color.dim("(comma-separated, optional)")}: `
   )).trim();
   const models = modelsRaw ? modelsRaw.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
   const envVarsRaw = (await deps.reader.readLine(
-    `  ${color.amber("?")} Env var names ${color.dim("(comma-separated, optional fallback for the key)")}: `
+    `  ${color.amber("?")} Env var names ${color.dim("(comma-separated, optional)")}: `
   )).trim();
   const envVars = envVarsRaw ? envVarsRaw.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
-  await addKeyForProvider(type, deps, {
+  return addKeyForProvider(type, deps, {
     type,
     family,
     ...baseUrl ? { baseUrl } : {},
@@ -9770,38 +10321,52 @@ ${color.bold("Custom provider")} ${color.dim("\u2014 for local models or proxies
     ...envVars ? { envVars } : {}
   });
 }
+async function addManualEntry(deps) {
+  const pid = (await deps.reader.readLine(
+    `  ${color.amber("?")} Provider id ${color.dim("[q to quit]")}: `
+  )).trim();
+  if (!pid || pid === "q") return false;
+  const famRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Family ${color.dim("(anthropic/openai/openai-compatible/google)")}: `
+  )).trim();
+  const family = validateFamily(famRaw);
+  if (!family) {
+    deps.renderer.writeError(`Invalid family: "${famRaw}"`);
+    return false;
+  }
+  const baseUrl = (await deps.reader.readLine(
+    `  ${color.amber("?")} Base URL ${color.dim("(optional)")}: `
+  )).trim();
+  return addKeyForProvider(pid, deps, {
+    type: pid,
+    family,
+    ...baseUrl ? { baseUrl } : {}
+  });
+}
 async function addKeyForProvider(providerId, deps, template) {
   const providers = await loadProviders(deps);
   const existing = providers[providerId];
   const existingKeys = existing ? normalizeKeys(existing) : [];
   const usedLabels = new Set(existingKeys.map((k) => k.label));
-  let defaultLabel = "default";
-  if (usedLabels.has(defaultLabel)) {
-    let n = 2;
-    while (usedLabels.has(`key${n}`)) n++;
-    defaultLabel = `key${n}`;
-  }
-  const labelRaw = (await deps.reader.readLine(
-    `  ${color.amber("?")} Label for this key ${color.dim(`[${defaultLabel}]`)}: `
-  )).trim();
-  const label = labelRaw || defaultLabel;
-  if (usedLabels.has(label)) {
-    deps.renderer.writeError(
-      `Label "${label}" already used for ${providerId}. Use update (u) instead.`
-    );
-    return;
-  }
+  const label = await promptForLabel(deps, usedLabels);
+  if (!label) return false;
   const apiKey = await readKeyInput(deps, `API key for ${providerId}/${label}`);
-  if (!apiKey) {
-    deps.renderer.writeError("No key entered. Nothing saved.");
-    return;
-  }
-  await mutateProviders(deps, (all) => {
-    const existingProv = all[providerId] ?? { type: providerId, ...template };
+  if (!apiKey) return false;
+  await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
+    const existingProv = all[providerId] ?? {
+      type: providerId,
+      ...template
+    };
     if (!existingProv.type) existingProv.type = providerId;
-    if (!existingProv.family && template.family) existingProv.family = template.family;
-    if (!existingProv.baseUrl && template.baseUrl) existingProv.baseUrl = template.baseUrl;
-    if (!existingProv.envVars && template.envVars) existingProv.envVars = template.envVars;
+    if (!existingProv.family && template.family) {
+      existingProv.family = template.family;
+    }
+    if (!existingProv.baseUrl && template.baseUrl) {
+      existingProv.baseUrl = template.baseUrl;
+    }
+    if (!existingProv.envVars && template.envVars) {
+      existingProv.envVars = template.envVars;
+    }
     const list = normalizeKeys(existingProv);
     list.push({ label, apiKey, createdAt: nowIso() });
     writeKeysBack(existingProv, list);
@@ -9809,10 +10374,242 @@ async function addKeyForProvider(providerId, deps, template) {
     all[providerId] = existingProv;
   });
   deps.renderer.write(
-    `  ${color.green("\u2713")} Saved ${color.bold(providerId)}/${color.bold(label)}. ${color.dim("Use `wstack --provider " + providerId + ' "<task>"` to launch.')}
+    `  ${color.green("\u2713")} Saved ${color.bold(providerId)}/${color.bold(label)}.
+`
+  );
+  deps.renderer.write(
+    color.dim(
+      `  Launch: wstack --provider ${providerId} "<task>"
 `
+    )
   );
+  return true;
+}
+async function promptForLabel(deps, usedLabels) {
+  const defaultLabel = suggestLabel(usedLabels);
+  const labelRaw = (await deps.reader.readLine(
+    `  ${color.amber("?")} Label for this key ${color.dim(`[${defaultLabel}]`)}: `
+  )).trim();
+  const label = labelRaw || defaultLabel;
+  if (usedLabels.has(label)) {
+    deps.renderer.writeError(
+      `Label "${label}" is already used. Use update (u) instead.`
+    );
+    return null;
+  }
+  return label;
+}
+
+// src/auth-menu/provider-menu.ts
+init_provider_config_utils();
+async function manageProvider(providerId, deps) {
+  for (; ; ) {
+    const providers = await loadProviders(deps);
+    const cfg = providers[providerId];
+    if (!cfg) {
+      deps.renderer.writeError(`Provider "${providerId}" no longer in config.`);
+      return;
+    }
+    const keys = normalizeKeys(cfg);
+    renderProviderHeader(deps.renderer, providerId, cfg);
+    renderActions(deps.renderer, keys.length);
+    const raw = (await deps.reader.readLine(
+      `
+${color.amber("?")} ${providerId} > `
+    )).trim();
+    if (!raw || raw === "b" || raw === "back" || raw === "q" || raw === "quit") {
+      return;
+    }
+    const [verb, argRaw] = raw.split(/\s+/, 2);
+    const arg = argRaw ? Number.parseInt(argRaw, 10) : Number.NaN;
+    const handled = await dispatchAction(verb, arg, providerId, keys, cfg, deps);
+    if (handled === "exit") return;
+    if (handled === "continue") continue;
+  }
+}
+async function dispatchAction(verb, arg, providerId, keys, cfg, deps) {
+  if (verb === "a" || verb === "add") {
+    await addKeyForProvider(providerId, deps, cfg);
+    return "continue";
+  }
+  if (verb === "x" || verb === "remove") {
+    const answer = await confirm(deps, `Remove provider "${providerId}" and ${keys.length} key(s)?`);
+    if (answer === null) return "continue";
+    if (answer) {
+      await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
+        delete all[providerId];
+      });
+      deps.renderer.write(`  ${color.green("\u2713")} Removed ${providerId}.
+`);
+      return "exit";
+    }
+    return "continue";
+  }
+  if (verb === "u" || verb === "update") {
+    if (!validKeyIndex(arg, keys.length, deps, "u")) return "continue";
+    const target = expectDefined(keys[arg - 1]);
+    const newKey = await readKeyInput(deps, `New key for ${target.label}`);
+    if (!newKey) return "continue";
+    await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
+      const p = all[providerId];
+      if (!p) return;
+      const list = normalizeKeys(p).map(
+        (k) => k.label === target.label ? { ...k, apiKey: newKey, createdAt: nowIso() } : k
+      );
+      writeKeysBack(p, list);
+    });
+    deps.renderer.write(`  ${color.green("\u2713")} Updated ${providerId}/${target.label}.
+`);
+    return "continue";
+  }
+  if (verb === "d" || verb === "delete" || verb === "rm") {
+    if (!validKeyIndex(arg, keys.length, deps, "d")) return "continue";
+    const target = expectDefined(keys[arg - 1]);
+    const answer = await confirm(
+      deps,
+      `Delete key "${target.label}" (${maskedKey(target.apiKey)})?`
+    );
+    if (answer === null) return "continue";
+    if (!answer) return "continue";
+    await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
+      const p = all[providerId];
+      if (!p) return;
+      const list = normalizeKeys(p).filter((k) => k.label !== target.label);
+      writeKeysBack(p, list);
+      if (p.activeKey === target.label) {
+        p.activeKey = list[0]?.label;
+      }
+    });
+    deps.renderer.write(`  ${color.green("\u2713")} Deleted ${providerId}/${target.label}.
+`);
+    return "continue";
+  }
+  if (verb === "s" || verb === "set" || verb === "active") {
+    if (!validKeyIndex(arg, keys.length, deps, "s")) return "continue";
+    const target = expectDefined(keys[arg - 1]);
+    await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
+      const p = all[providerId];
+      if (!p) return;
+      const list = normalizeKeys(p);
+      writeKeysBack(p, list);
+      p.activeKey = target.label;
+    });
+    deps.renderer.write(
+      `  ${color.green("\u2713")} Active key \u2192 ${color.bold(target.label)}.
+`
+    );
+    return "continue";
+  }
+  if (verb === "f" || verb === "family") {
+    const current = cfg.family ?? "";
+    const ans = (await deps.reader.readLine(
+      `  ${color.amber("?")} Family ${color.dim(`(anthropic | openai | openai-compatible | google, empty = unset, current: ${current || "unset"})`)}: `
+    )).trim();
+    if (ans !== "") {
+      const validated = validateFamily(ans);
+      if (!validated) {
+        deps.renderer.writeError(`Invalid family: "${ans}". Must be one of: anthropic, openai, openai-compatible, google.`);
+        return "continue";
+      }
+      await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
+        const p = all[providerId];
+        if (!p) return;
+        p.family = validated;
+      });
+      deps.renderer.write(`  ${color.green("\u2713")} family \u2192 ${validated}
+`);
+    } else {
+      await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
+        const p = all[providerId];
+        if (!p) return;
+        delete p.family;
+      });
+      deps.renderer.write(`  ${color.green("\u2713")} family \u2192 (unset)
+`);
+    }
+    return "continue";
+  }
+  if (verb === "B" || verb === "baseurl" || verb === "base-url") {
+    const current = cfg.baseUrl ?? "";
+    const ans = (await deps.reader.readLine(
+      `  ${color.amber("?")} Base URL ${color.dim(`(empty = unset, current: ${current || "unset"})`)}: `
+    )).trim();
+    await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
+      const p = all[providerId];
+      if (!p) return;
+      if (ans === "") delete p.baseUrl;
+      else p.baseUrl = ans;
+    });
+    deps.renderer.write(`  ${color.green("\u2713")} baseUrl \u2192 ${ans || "(unset)"}
+`);
+    return "continue";
+  }
+  if (verb === "m" || verb === "models") {
+    const current = (cfg.models ?? []).join(", ");
+    const ans = (await deps.reader.readLine(
+      `  ${color.amber("?")} Model ids ${color.dim(`(comma-separated, empty = catalog default, current: ${current || "none"})`)}: `
+    )).trim();
+    const list = ans ? ans.split(",").map((s) => s.trim()).filter(Boolean) : [];
+    await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
+      const p = all[providerId];
+      if (!p) return;
+      if (list.length === 0) delete p.models;
+      else p.models = list;
+    });
+    deps.renderer.write(
+      `  ${color.green("\u2713")} models \u2192 ${list.length === 0 ? "(catalog default)" : list.join(", ")}
+`
+    );
+    return "continue";
+  }
+  deps.renderer.writeError(`Unknown action: "${verb}". Type b for back or q to quit.`);
+  return "unknown";
+}
+function validKeyIndex(arg, max, deps, verb) {
+  if (!Number.isFinite(arg) || arg < 1 || arg > max) {
+    deps.renderer.writeError(`Usage: ${verb} <1-${max}>`);
+    return false;
+  }
+  return true;
 }
+
+// src/auth-menu/top-menu.ts
+async function runTopMenu(deps) {
+  for (; ; ) {
+    const providers = await loadProviders(deps);
+    renderTopMenu(deps.renderer, providers);
+    const ids = Object.keys(providers).sort();
+    const choice = (await deps.reader.readLine(`
+${color.amber("?")} Pick: `)).trim().toLowerCase();
+    if (!choice || choice === "q" || choice === "quit" || choice === "exit") {
+      deps.renderer.write(color.dim("Done.\n"));
+      return 0;
+    }
+    if (choice === "a" || choice === "add") {
+      await addFromCatalog(deps);
+      continue;
+    }
+    if (choice === "c" || choice === "custom") {
+      await addCustomProvider(deps);
+      continue;
+    }
+    const idx = Number.parseInt(choice, 10);
+    if (!Number.isNaN(idx) && idx >= 1 && idx <= ids.length) {
+      const pid = ids[idx - 1];
+      await manageProvider(pid, deps);
+      continue;
+    }
+    const byId = ids.find((id) => id.toLowerCase() === choice);
+    if (byId) {
+      await manageProvider(byId, deps);
+      continue;
+    }
+    deps.renderer.writeError(`Unknown selection: "${choice}"`);
+  }
+}
+
+// src/auth-menu/direct.ts
+init_provider_config_utils();
 async function runAuthDirect(deps, opts) {
   const { providerId } = opts;
   const providers = await loadProviders(deps);
@@ -9840,7 +10637,9 @@ async function runAuthDirect(deps, opts) {
     opts.baseUrl ??= knownBase;
     opts.envVars ??= knownEnv;
   }
-  const usedLabels = new Set(existing ? normalizeKeys(existing).map((k) => k.label) : []);
+  const usedLabels = new Set(
+    existing ? normalizeKeys(existing).map((k) => k.label) : []
+  );
   let label = opts.label ?? "default";
   if (usedLabels.has(label)) {
     let n = 2;
@@ -9850,7 +10649,7 @@ async function runAuthDirect(deps, opts) {
   }
   const apiKey = await readKeyInput(deps, `API key for ${providerId}/${label}`);
   if (!apiKey) return 1;
-  await mutateProviders(deps, (all) => {
+  await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
     const p = all[providerId] ?? { type: providerId };
     if (!p.type) p.type = providerId;
     if (!p.family && opts.family) p.family = opts.family;
@@ -9866,26 +10665,9 @@ async function runAuthDirect(deps, opts) {
   deps.renderer.writeInfo(`Use: wstack --provider ${providerId} "<task>"`);
   return 0;
 }
-async function readKeyInput(deps, intent) {
-  const key = (await deps.reader.readSecret(
-    `  ${color.amber("?")} ${intent} ${color.dim("(hidden, paste OK)")}: `
-  )).trim();
-  if (!key) {
-    deps.renderer.writeError("No key entered.");
-    return void 0;
-  }
-  return key;
-}
-function loadProviders(deps) {
-  return loadConfigProviders(deps.globalConfigPath, deps.vault, {
-    warn: (msg) => deps.renderer.writeWarning(msg)
-  });
-}
-function mutateProviders(deps, mutator) {
-  return mutateConfigProviders(deps.globalConfigPath, deps.vault, mutator);
-}
 
 // src/subcommands/handlers/auth.ts
+init_provider_config_utils();
 var authCmd = async (args, deps) => {
   const flags = parseAuthFlags(args);
   const menuDeps = {
@@ -9895,15 +10677,175 @@ var authCmd = async (args, deps) => {
     vault: deps.vault,
     globalConfigPath: deps.paths.globalConfig
   };
-  if (flags.positional.length === 0) return runAuthMenu(menuDeps);
+  if (flags.positional.length === 0) {
+    return runTopMenu(menuDeps);
+  }
+  const first = flags.positional[0];
+  if (first === "list" || first === "ls") {
+    return runAuthList(menuDeps);
+  }
+  if (first === "status") {
+    const pid = flags.positional[1];
+    if (!pid) {
+      deps.renderer.writeError("Usage: wstack auth status <provider>");
+      return 1;
+    }
+    return runAuthStatus(menuDeps, pid);
+  }
+  if (first === "remove" || first === "rm") {
+    const pid = flags.positional[1];
+    if (!pid) {
+      deps.renderer.writeError("Usage: wstack auth remove <provider> [--force]");
+      return 1;
+    }
+    return runAuthRemove(menuDeps, pid);
+  }
   return runAuthDirect(menuDeps, {
-    providerId: expectDefined(flags.positional[0]),
+    providerId: first,
     label: flags.label,
     family: flags.family,
     baseUrl: flags.baseUrl,
     envVars: flags.envVars
   });
 };
+async function runAuthList(deps) {
+  let providers;
+  try {
+    providers = await loadConfigProviders(deps.globalConfigPath, deps.vault);
+  } catch (err) {
+    deps.renderer.writeError(`Could not read config: ${err.message}`);
+    return 1;
+  }
+  const ids = Object.keys(providers).sort();
+  if (ids.length === 0) {
+    deps.renderer.write(
+      `${color.dim("No providers configured.")}
+${color.dim("Run")} ${color.bold("wstack auth")} ${color.dim("to add one.")}
+`
+    );
+    return 0;
+  }
+  deps.renderer.write(`
+${color.bold("Saved providers")} ${color.dim(`(${ids.length})`)}
+
+`);
+  for (const id of ids) {
+    const cfg = providers[id];
+    if (!cfg) continue;
+    const keys = normalizeKeys(cfg);
+    const active = cfg.activeKey ?? keys[0]?.label;
+    const famTag = cfg.family ? `${cfg.family}` : color.amber("no-family");
+    const aliasHint = cfg.type && cfg.type !== id ? color.dim(` (\u2192 ${cfg.type})`) : "";
+    const modelHint = cfg.models && cfg.models.length > 0 ? color.dim(` [${cfg.models.length} models]`) : "";
+    deps.renderer.write(`  ${color.bold(id)}${aliasHint}
+`);
+    deps.renderer.write(
+      `    family:  ${famTag}  baseUrl: ${cfg.baseUrl ?? color.dim("unset")}${modelHint}
+`
+    );
+    if (keys.length === 0) {
+      deps.renderer.write(`    ${color.amber("no keys")}
+`);
+    } else {
+      deps.renderer.write(`    ${color.dim(`${keys.length} key${keys.length === 1 ? "" : "s"}:`)}
+`);
+      for (const k of keys) {
+        const marker = k.label === active ? color.green("\u25CF") : color.dim("\u25CB");
+        deps.renderer.write(
+          `      ${marker} ${k.label.padEnd(18)} ${maskedKey(k.apiKey)}  ${color.dim(k.createdAt)}
+`
+        );
+      }
+    }
+    deps.renderer.write("\n");
+  }
+  deps.renderer.write(
+    color.dim(`Manage: wstack auth   Add key: wstack auth <provider>
+`)
+  );
+  return 0;
+}
+async function runAuthStatus(deps, providerId) {
+  let providers;
+  try {
+    providers = await loadConfigProviders(deps.globalConfigPath, deps.vault);
+  } catch (err) {
+    deps.renderer.writeError(`Could not read config: ${err.message}`);
+    return 1;
+  }
+  const cfg = providers[providerId];
+  if (!cfg) {
+    deps.renderer.writeError(`Provider "${providerId}" not found in config.`);
+    deps.renderer.write(
+      color.dim(`Run ${color.bold("wstack auth list")} to see saved providers.
+`)
+    );
+    return 1;
+  }
+  const keys = normalizeKeys(cfg);
+  const active = cfg.activeKey ?? keys[0]?.label;
+  const lines = [
+    `
+${color.bold(providerId)} ${cfg.family ? color.dim(`[${cfg.family}]`) : color.amber("[no family]")}`,
+    "",
+    `  type:    ${color.cyan(cfg.type ?? providerId)}`,
+    `  family:  ${cfg.family ? color.cyan(cfg.family) : color.dim("unset")}`,
+    `  baseUrl: ${cfg.baseUrl ? color.cyan(cfg.baseUrl) : color.dim("unset")}`
+  ];
+  if (cfg.models?.length) {
+    lines.push(`  models:  ${color.cyan(cfg.models.join(", "))}`);
+  }
+  if (cfg.envVars?.length) {
+    lines.push(`  envVars: ${color.cyan(cfg.envVars.join(", "))}`);
+  }
+  lines.push("");
+  if (keys.length === 0) {
+    lines.push(color.amber("  (no keys saved)"));
+  } else {
+    lines.push(`  ${color.dim("Keys:")}`);
+    for (const k of keys) {
+      const marker = k.label === active ? color.green("\u25CF") : color.dim("\u25CB");
+      lines.push(
+        `    ${marker} ${color.bold(k.label.padEnd(18))} ${maskedKey(k.apiKey)}  ${color.dim(k.createdAt)}`
+      );
+    }
+  }
+  lines.push("");
+  lines.push(color.dim(`Manage: wstack auth \u2192 pick ${providerId}`));
+  deps.renderer.write(lines.join("\n") + "\n");
+  return 0;
+}
+async function runAuthRemove(deps, providerId) {
+  const providers = await loadConfigProviders(deps.globalConfigPath, deps.vault);
+  if (!providers[providerId]) {
+    deps.renderer.writeError(`Provider "${providerId}" not found.`);
+    return 1;
+  }
+  deps.renderer.write(
+    `${color.amber("!")} This will remove "${providerId}" and all its saved keys.
+`
+  );
+  const answer = (await deps.reader.readLine(
+    `  ${color.amber("?")} Confirm removal? ${color.dim("[y/N]")} `
+  )).trim().toLowerCase();
+  if (answer !== "y" && answer !== "yes") {
+    deps.renderer.write(color.dim("Cancelled.\n"));
+    return 0;
+  }
+  try {
+    await mutateConfigProviders(deps.globalConfigPath, deps.vault, (all) => {
+      delete all[providerId];
+    });
+    deps.renderer.write(
+      `  ${color.green("\u2713")} Removed ${color.bold(providerId)}.
+`
+    );
+    return 0;
+  } catch (err) {
+    deps.renderer.writeError(`Failed to remove: ${err.message}`);
+    return 1;
+  }
+}
 
 // src/subcommands/handlers/update.ts
 init_update_check();
@@ -11726,6 +12668,10 @@ var helpCmd = async (_args, deps) => {
     "  wstack sessions              List recent sessions",
     "  wstack init                  Pick provider + model from models.dev",
     "  wstack auth                  Interactive key manager (list/add/update/delete)",
+    "  wstack auth list             Quick listing of saved providers and keys",
+    "  wstack auth status <id>      Detailed view of one provider",
+    "  wstack auth remove <id>      Delete a provider (asks for confirmation)",
+    "  wstack auth <provider>       Add a key for a provider (--label, --family, \u2026)",
     "  wstack config [show|edit]    Show or edit effective config",
     "  wstack tools                 List registered tools",
     "  wstack skills                List discovered skills",
@@ -11806,22 +12752,22 @@ function fmtDuration(ms) {
   const remMin = m - h * 60;
   return `${h}h${remMin}m`;
 }
-function fmtTaskResultLine(r, color51) {
+function fmtTaskResultLine(r, color56) {
   const stats = `${r.iterations}it ${r.toolCalls}tc ${fmtDuration(r.durationMs)}`;
   const errMsg = typeof r.error === "string" ? r.error : r.error?.message;
   const errKind = typeof r.error === "object" ? r.error?.kind : void 0;
   const errTail = errMsg ? ` \u2014 ${errMsg.replace(/\s+/g, " ").slice(0, 80)}${errMsg.length > 80 ? "\u2026" : ""}` : "";
-  const errKindChip = errKind ? color51.dim(` [${errKind}]`) : "";
-  const errSnip = errMsg || errKind ? `${errKindChip}${color51.dim(errTail)}` : "";
+  const errKindChip = errKind ? color56.dim(` [${errKind}]`) : "";
+  const errSnip = errMsg || errKind ? `${errKindChip}${color56.dim(errTail)}` : "";
   switch (r.status) {
     case "success":
-      return { mark: color51.green("\u2713"), stats, tail: "" };
+      return { mark: color56.green("\u2713"), stats, tail: "" };
     case "timeout":
-      return { mark: color51.yellow("\u23F1"), stats: `${color51.yellow("timeout")} ${stats}`, tail: errSnip };
+      return { mark: color56.yellow("\u23F1"), stats: `${color56.yellow("timeout")} ${stats}`, tail: errSnip };
     case "stopped":
-      return { mark: color51.dim("\u2298"), stats: `${color51.dim("stopped")} ${stats}`, tail: errSnip };
+      return { mark: color56.dim("\u2298"), stats: `${color56.dim("stopped")} ${stats}`, tail: errSnip };
     case "failed":
-      return { mark: color51.red("\u2717"), stats: `${color51.red("failed")} ${stats}`, tail: errSnip };
+      return { mark: color56.red("\u2717"), stats: `${color56.red("failed")} ${stats}`, tail: errSnip };
   }
 }
 
@@ -12430,7 +13376,7 @@ function parsePredictions(raw, max = 3) {
   }
   return out;
 }
-function extractText(content) {
+function extractText2(content) {
   if (Array.isArray(content)) {
     return content[0]?.text ?? "";
   }
@@ -12461,7 +13407,7 @@ async function predictNextTasks(input, opts) {
       },
       { signal: internal.signal }
     );
-    return parsePredictions(extractText(resp.content), max);
+    return parsePredictions(extractText2(resp.content), max);
   } catch {
     return [];
   } finally {
@@ -15250,7 +16196,7 @@ async function setupCodebaseIndexing(deps) {
   let watcher;
   if (idx.watchExternal) {
     try {
-      watcher = fs12.watch(projectRoot, { recursive: true }, (_event, filename) => {
+      watcher = fs13.watch(projectRoot, { recursive: true }, (_event, filename) => {
         if (!filename) return;
         const rel = filename.toString();
         if (isIgnored(rel)) return;
@@ -15578,6 +16524,8 @@ async function setupSession(params) {
   );
   const planPath = path8.join(wpaths.projectSessions, `${session?.id}.plan.json`);
   context.state.setMeta("plan.path", planPath);
+  const taskPath = path8.join(wpaths.projectSessions, `${session?.id}.tasks.json`);
+  context.state.setMeta("task.path", taskPath);
   let dirState;
   if (resumeId) {
     try {