@wrongstack/cli 1.0.0 → 1.0.3

package/dist/{webui-server-T6AMOXJJ.js → webui-server-QWBUT7BO.js}

@@ -1,12 +1,12 @@
 import {
   createHqCommandDispatcher
 } from "./chunk-IMWXXF4J.js";
-import {
-  WEBUI_SESSION_CHILD_CAPABILITIES
-} from "./chunk-GPPRNAKW.js";
 import {
   createKanbanRunMirror
 } from "./chunk-VCYZ3WZV.js";
+import {
+  WEBUI_SESSION_CHILD_CAPABILITIES
+} from "./chunk-GPPRNAKW.js";
 import {
   startCliHqConnection
 } from "./chunk-TE3Q32JP.js";
@@ -46,6 +46,7 @@ import {
   toSessionHistoryEntries
 } from "@wrongstack/webui-server";
 import { WebSocketServer } from "ws";
+import { verifyClient as verifyWsClient2 } from "@wrongstack/webui-server/server/ws-auth";
 
 // src/webui-server/client-registration.ts
 import { mailboxSessionTag } from "@wrongstack/core/coordination";
@@ -1495,7 +1496,22 @@ async function runWebUI(opts) {
     ...opts.getVectorMemoryStore ? { getVectorMemoryStore: opts.getVectorMemoryStore } : {},
     ...opts.vectorMemoryModelCacheDir ? { vectorMemoryModelCacheDir: opts.vectorMemoryModelCacheDir } : {}
   });
-  const wss = httpServer ? new WebSocketServer({ server: httpServer.server, maxPayload: 20 * 1024 * 1024 }) : new WebSocketServer({ port: httpPort, host, maxPayload: 20 * 1024 * 1024 });
+  const verifyClient = (info) => verifyWsClient2({
+    origin: info.origin,
+    url: info.req.url ?? "",
+    hostHeader: info.req.headers.host,
+    remoteAddress: info.req.socket.remoteAddress,
+    cookieHeader: info.req.headers.cookie,
+    wsHost: host,
+    expectedToken: wsToken,
+    requireToken,
+    allowedHostnames: [publicUrl, publicWsUrl].filter(
+      (value) => Boolean(value)
+    ),
+    allowBrowserUrlToken: Boolean(publicWsUrl),
+    allowCrossPortLoopbackCookie: process.env["WRONGSTACK_WEBUI_DEV_CROSS_PORT_WS"] === "1"
+  });
+  const wss = httpServer ? new WebSocketServer({ server: httpServer.server, verifyClient, maxPayload: 20 * 1024 * 1024 }) : new WebSocketServer({ port: httpPort, host, verifyClient, maxPayload: 20 * 1024 * 1024 });
   wss.on("error", (err) => {
     console.error(
       JSON.stringify({
@@ -1625,6 +1641,7 @@ async function runWebUI(opts) {
       () => opts.appConfig?.providers ?? {}
     ),
     modelsRegistry: opts.modelsRegistry,
+    providerAuthRegistry: opts.providerAuthRegistry,
     send,
     broadcast,
     log: (m) => console.log(m)
@@ -1951,4 +1968,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-T6AMOXJJ.js.map
+//# sourceMappingURL=webui-server-QWBUT7BO.js.map

package/dist/webui-server-options.d.ts

@@ -117,6 +117,7 @@ export interface CliWebUIOptions {
         webuiInstanceRegistered: boolean;
     }) => void;
     modelsRegistry?: ModelsRegistry | undefined;
+    providerAuthRegistry?: import('@wrongstack/core/registry').ProviderAuthRegistry | undefined;
     globalConfigPath?: string | undefined;
     /** Resolved profile config path: ~/.wrongstack/profiles/<activeProfile>/config.json */
     profileConfigPath: string;

package/dist/wiring/atlas-prompt-contributor.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Atlas boot-prompt contributor — the repository's shape, put in front of the
+ * agent instead of left to be rediscovered.
+ *
+ * Without this, every session begins the same way: a handful of searches to
+ * work out which packages exist, which files everything depends on, and where
+ * the entry points are. The index has known all of that since it was built.
+ * A few hundred tokens spends once what a dozen tool calls spend every time.
+ *
+ * Contract, matching `wrongtrace-prompt-contributor.ts`:
+ *   - **Fail-open.** No index, no ranks, a throw, a timeout → `[]`. Orientation
+ *     is a convenience; it must never be the reason a session cannot start.
+ *   - **Bounded.** The brief is read behind a deadline, because the store lives
+ *     on disk and a cold or busy index must not stall the first prompt.
+ *   - **Cached per process.** The brief only changes when the index does, and
+ *     rebuilding it on every prompt build would read SQLite on every turn.
+ *   - **Cache-safe.** Contributor blocks are tagged `'contributor'`, which
+ *     `EPOCH_VOLATILE_SOURCES` moves out of the wire `system` block and into
+ *     the live-context tail — so this does not invalidate the prompt cache
+ *     prefix the way a system-prompt edit would.
+ *
+ * It is deliberately *not* routed through SAGE. That pipeline is for episodic
+ * memory and gates on relevance thresholds a repository map would fail; the
+ * map is not a memory, it is a fact about the checkout.
+ */
+import type { SystemPromptContributor, TokenSavingTier } from '@wrongstack/core/types';
+import { type AtlasBrief } from '@wrongstack/tools';
+/** Default hard ceiling on the rendered block. */
+export declare const DEFAULT_BRIEF_MAX_TOKENS = 800;
+/**
+ * Render the brief, trimming from the bottom until it fits.
+ *
+ * The order of the sections is the order of their value to somebody who knows
+ * nothing about the repository: what it is made of, what everything depends
+ * on, and — last, because it is the least load-bearing — what each subsystem
+ * does in prose. Trimming from the bottom therefore degrades gracefully
+ * instead of losing the hubs.
+ */
+export declare function renderAtlasBrief(brief: AtlasBrief, maxTokens: number): string;
+export interface AtlasPromptContributorOptions {
+    projectRoot: string;
+    indexDir?: string | undefined;
+    /** `indexing.atlas.injectOnSessionStart`. Default true. */
+    enabled?: boolean | undefined;
+    /** `indexing.atlas.briefMaxTokens`. Default {@link DEFAULT_BRIEF_MAX_TOKENS}. */
+    maxTokens?: number | undefined;
+    tokenSavingMode?: TokenSavingTier | boolean | undefined;
+}
+/**
+ * Build the contributor. One instance per prompt-builder binding; the brief
+ * cache lives on the closure, so it is per process, like the builder.
+ */
+export declare function createAtlasPromptContributor(options: AtlasPromptContributorOptions): SystemPromptContributor;
+//# sourceMappingURL=atlas-prompt-contributor.d.ts.map

package/dist/wiring/cli-execute-builder.d.ts

@@ -73,6 +73,7 @@ export declare function runCliExecution(params: {
     agentMonitor?: X['fleet']['agentTranscripts'];
     vault: AUP['vault'];
     profileConfigPath: string;
+    providerAuthRegistry: NonNullable<AUP['providerAuthRegistry']>;
     onPanelOpen: X['fleet']['onPanelOpen'];
     interruptController: RC['interruptController'];
     enhanceController: RC['enhanceController'];

package/dist/wiring/codebase-embeddings.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Host-side wiring for the codebase index's semantic embeddings.
+ *
+ * The model is `packages/vector-memory`'s transformers-backed provider, which
+ * already emits 384-dimensional vectors — the width `file_vectors` stores. It
+ * arrives here rather than inside `packages/tools` for two reasons:
+ *
+ *  - `@huggingface/transformers` is an **optional** dependency. A repository
+ *    that never enables semantic search should not have to install a model
+ *    runtime, and `packages/tools` must stay importable without one.
+ *  - A function cannot cross the project daemon's IPC boundary. The daemon
+ *    compares vectors; the host produces them. That also keeps a ~90 MB model
+ *    out of every per-project daemon process.
+ *
+ * Everything here is best-effort. When the optional dependency is absent, the
+ * model cannot load, or the config leaves embeddings off, the port is simply
+ * `undefined` and retrieval stays lexical — which is the behaviour that
+ * shipped before embeddings existed.
+ */
+import type { IndexingEmbeddingsConfig } from '@wrongstack/core/types';
+import type { EmbeddingPort } from '@wrongstack/tools';
+/**
+ * Build the embedding port, or `undefined` when semantic search is off or
+ * unavailable.
+ *
+ * The dynamic import is what keeps `@huggingface/transformers` optional: a
+ * missing package throws here and is reported as "unavailable", never as a
+ * startup failure.
+ */
+export declare function createCodebaseEmbeddingPort(settings: IndexingEmbeddingsConfig | undefined): Promise<EmbeddingPort | undefined>;
+//# sourceMappingURL=codebase-embeddings.d.ts.map

package/dist/wiring/command-host-state.d.ts

@@ -77,6 +77,7 @@ export declare function setupCommandHostState(input: CommandHostStateInput): Pro
         project?: import("@wrongstack/core/statusline").StatuslineLine;
         prompt_variant?: import("@wrongstack/core/statusline").StatuslineLine;
         queue?: import("@wrongstack/core/statusline").StatuslineLine;
+        quota?: import("@wrongstack/core/statusline").StatuslineLine;
         sessions?: import("@wrongstack/core/statusline").StatuslineLine;
         side_effects?: import("@wrongstack/core/statusline").StatuslineLine;
         state?: import("@wrongstack/core/statusline").StatuslineLine;
@@ -122,6 +123,7 @@ export declare function setupCommandHostState(input: CommandHostStateInput): Pro
         project?: import("@wrongstack/core/statusline").StatuslineDensity;
         prompt_variant?: import("@wrongstack/core/statusline").StatuslineDensity;
         queue?: import("@wrongstack/core/statusline").StatuslineDensity;
+        quota?: import("@wrongstack/core/statusline").StatuslineDensity;
         sessions?: import("@wrongstack/core/statusline").StatuslineDensity;
         side_effects?: import("@wrongstack/core/statusline").StatuslineDensity;
         state?: import("@wrongstack/core/statusline").StatuslineDensity;

package/dist/wiring/concept-summarizer.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Host-side implementation of the codebase index's {@link SummarizerPort}.
+ *
+ * `packages/tools` defines what a summariser must answer; producing that answer
+ * needs a configured provider and the model-tier policy, both of which live
+ * here. The port is therefore injected rather than imported, the same way SAGE
+ * takes `getLlmCall` — a host that supplies nothing simply gets no concept
+ * layer, and the index carries on working without one.
+ *
+ * ## Cost shape
+ *
+ * One call per file, and only for files whose bytes changed since the last
+ * pass. Enrichment is the one part of the index that spends money, so the model
+ * is resolved through the tier layer at its cheapest configured level unless
+ * the caller pins one, and both the token ceiling and the timeout are small.
+ */
+import { OneShotOrchestrator } from '@wrongstack/core/execution';
+import type { Config } from '@wrongstack/core/types';
+import type { SummarizerPort } from '@wrongstack/tools';
+type OrchestratorOptions = ConstructorParameters<typeof OneShotOrchestrator>[0];
+export interface ConceptSummarizerDeps {
+    buildProvider: OrchestratorOptions['buildProvider'];
+    getConfig: () => Config;
+    fallbackProfileManager: OrchestratorOptions['fallbackProfileManager'];
+    statusTracker?: OrchestratorOptions['statusTracker'];
+    wrapProviderCall?: OrchestratorOptions['wrapProviderCall'];
+    /** Explicit model override; otherwise the configured budget tier decides. */
+    model?: string | undefined;
+}
+export declare function createConceptSummarizer(deps: ConceptSummarizerDeps): SummarizerPort;
+export {};
+//# sourceMappingURL=concept-summarizer.d.ts.map

package/dist/wiring/external-plugins.d.ts

@@ -64,5 +64,6 @@ interface LoadExternalPluginsContext {
     importModule?: ((url: string) => Promise<unknown>) | undefined;
 }
 export declare function loadExternalPlugins(ctx: LoadExternalPluginsContext, hooks: ExternalPluginHooks): Promise<Plugin[]>;
+export declare function hashPluginClosure(entryPath: string): Promise<string>;
 export {};
 //# sourceMappingURL=external-plugins.d.ts.map

package/dist/wiring/lifecycle-plugins.d.ts

@@ -1,7 +1,7 @@
 import { type RemoteMailbox } from '@wrongstack/core/coordination';
 import { HookRegistry, HookRunner } from '@wrongstack/core/hooks';
 import type { PluginHostHandle } from '@wrongstack/core/plugin';
-import { type ProviderRegistry, SlashCommandRegistry, type ToolRegistry } from '@wrongstack/core/registry';
+import { type ProviderAuthRegistry, type ProviderRegistry, SlashCommandRegistry, type ToolRegistry } from '@wrongstack/core/registry';
 import type { Config, HealthRegistry, Logger, MetricsRuntimeStatus, ModelsRegistry, PromptLoader, Provider, ProviderConfig, SecretVault, SessionWriter, SkillLoader } from '@wrongstack/core/types';
 import type { WstackPaths } from '@wrongstack/core/utils';
 import { MCPRegistry } from '@wrongstack/mcp';
@@ -27,6 +27,7 @@ interface LifecyclePluginsDeps {
     wpaths: WstackPaths;
     toolRegistry: ToolRegistry;
     providerRegistry: ProviderRegistry;
+    providerAuthRegistry: ProviderAuthRegistry;
     configStore: any;
     eventWiring: EventWiring;
     healthRegistry: HealthRegistry | undefined;

package/dist/wiring/plugins.d.ts

@@ -2,7 +2,7 @@ import type { AgentPipelines } from '@wrongstack/core/agent';
 import type { ExtensionRegistry } from '@wrongstack/core/extension';
 import type { Container, EventBus } from '@wrongstack/core/kernel';
 import type { PluginAPIInit, PluginHostHandle } from '@wrongstack/core/plugin';
-import type { ProviderRegistry, SlashCommandRegistry, ToolRegistry } from '@wrongstack/core/registry';
+import type { ProviderAuthRegistry, ProviderRegistry, SlashCommandRegistry, ToolRegistry } from '@wrongstack/core/registry';
 import type { Config, ConfigStore, HealthRegistry, Logger, MetricsRuntimeStatus, MetricsSinkView, ModelsRegistry, Plugin, PromptLoader, SessionWriter, SkillLoader } from '@wrongstack/core/types';
 import type { MCPRegistry } from '@wrongstack/mcp';
 export declare const DEPRECATED_PLUGIN_NAMES: Record<string, string>;
@@ -34,6 +34,7 @@ export interface PluginsWiringDeps {
     pipelines: AgentPipelines;
     toolRegistry: ToolRegistry;
     providerRegistry: ProviderRegistry;
+    providerAuthRegistry?: ProviderAuthRegistry | undefined;
     slashCommandRegistry: SlashCommandRegistry;
     mcpRegistry: MCPRegistry;
     log: Logger;

package/dist/wiring/provider.d.ts

@@ -1,10 +1,11 @@
-import { ProviderRegistry } from '@wrongstack/core/registry';
+import { ProviderAuthRegistry, ProviderRegistry } from '@wrongstack/core/registry';
 import type { ResolvedProvider } from '@wrongstack/core/types';
 import { type Config, type Logger, type ModelsRegistry } from '@wrongstack/core/types';
 interface ProviderSetupResult {
     resolvedProvider: ResolvedProvider | undefined;
     provider: ReturnType<ProviderRegistry['create']>;
     providerRegistry: ProviderRegistry;
+    providerAuthRegistry: ProviderAuthRegistry;
 }
 export declare function setupProvider(params: {
     config: Config;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -41,36 +41,36 @@
     "data"
   ],
   "dependencies": {
-    "@wrongstack/acp": "1.0.0",
-    "@wrongstack/bench": "1.0.0",
-    "@wrongstack/core": "1.0.0",
-    "@wrongstack/primitives": "1.0.0",
-    "@wrongstack/kanban": "1.0.0",
-    "@wrongstack/mcp": "1.0.0",
-    "@wrongstack/persistence": "1.0.0",
-    "@wrongstack/plug-lsp": "1.0.0",
-    "@wrongstack/plugins": "1.0.0",
-    "@wrongstack/providers": "1.0.0",
-    "@wrongstack/requirement-intake": "1.0.0",
-    "@wrongstack/runtime": "1.0.0",
-    "@wrongstack/sage": "1.0.0",
-    "@wrongstack/sdd": "1.0.0",
-    "@wrongstack/security-scanner": "1.0.0",
-    "@wrongstack/simpleui": "1.0.0",
-    "@wrongstack/techstack": "1.0.0",
-    "@wrongstack/telegram": "1.0.0",
-    "@wrongstack/tools": "1.0.0",
-    "@wrongstack/tui": "1.0.0",
-    "@wrongstack/vector-memory": "1.0.0",
-    "@wrongstack/webui": "1.0.0",
-    "@wrongstack/webui-hq": "1.0.0",
-    "@wrongstack/webui-protocol": "1.0.0",
-    "@wrongstack/wrongtrace": "1.0.0",
-    "@wrongstack/webui-server": "1.0.0",
+    "@wrongstack/acp": "1.0.3",
+    "@wrongstack/bench": "1.0.3",
+    "@wrongstack/core": "1.0.3",
+    "@wrongstack/primitives": "1.0.3",
+    "@wrongstack/kanban": "1.0.3",
+    "@wrongstack/mcp": "1.0.3",
+    "@wrongstack/persistence": "1.0.3",
+    "@wrongstack/plug-lsp": "1.0.3",
+    "@wrongstack/plugins": "1.0.3",
+    "@wrongstack/providers": "1.0.3",
+    "@wrongstack/requirement-intake": "1.0.3",
+    "@wrongstack/runtime": "1.0.3",
+    "@wrongstack/sage": "1.0.3",
+    "@wrongstack/sdd": "1.0.3",
+    "@wrongstack/security-scanner": "1.0.3",
+    "@wrongstack/simpleui": "1.0.3",
+    "@wrongstack/techstack": "1.0.3",
+    "@wrongstack/telegram": "1.0.3",
+    "@wrongstack/tools": "1.0.3",
+    "@wrongstack/tui": "1.0.3",
+    "@wrongstack/vector-memory": "1.0.3",
+    "@wrongstack/webui": "1.0.3",
+    "@wrongstack/webui-hq": "1.0.3",
+    "@wrongstack/webui-protocol": "1.0.3",
+    "@wrongstack/wrongtrace": "1.0.3",
+    "@wrongstack/webui-server": "1.0.3",
     "ws": "^8.21.3"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "1.0.0"
+    "@wrongstack/desktop": "1.0.3"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
@@ -83,7 +83,7 @@
   },
   "scripts": {
     "build": "node ../../scripts/build-package.mjs",
-    "typecheck": "pnpm --filter @wrongstack/tools run build && pnpm --filter @wrongstack/tui run build && tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
+    "typecheck": "pnpm --filter @wrongstack/tools run build && pnpm --filter @wrongstack/tui run build && pnpm --filter @wrongstack/webui-server run build && tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
     "test": "vitest run",
     "test:hqdash": "vitest run --config vitest.hqdash.config.ts",
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""

package/dist/auto-discover-providers-VQU3IZMR.js

@@ -1,7 +0,0 @@
-import {
-  discoverAndMergeProviders
-} from "./chunk-52C7PD2H.js";
-export {
-  discoverAndMergeProviders
-};
-//# sourceMappingURL=auto-discover-providers-VQU3IZMR.js.map

package/dist/chunk-52C7PD2H.js

@@ -1,61 +0,0 @@
-
-// src/boot/auto-discover-providers.ts
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-import { discoverOpenAICompatibleModels, resolveDiscoveryTargets } from "@wrongstack/providers";
-async function readCache(file) {
-  try {
-    return JSON.parse(await fs.readFile(file, "utf8"));
-  } catch {
-    return {};
-  }
-}
-async function discoverAndMergeProviders(opts) {
-  const targets = resolveDiscoveryTargets(opts.config);
-  if (targets.length === 0) return;
-  const cacheFile = path.join(opts.cacheDir, "discovered-models-cache.json");
-  const cache = await readCache(cacheFile);
-  let cacheDirty = false;
-  await Promise.all(
-    targets.map(async ({ id, cfg, baseUrl, apiKey, cacheKey }) => {
-      const provider = await discoverOpenAICompatibleModels(id, {
-        baseUrl,
-        apiKey,
-        headers: cfg.headers,
-        providerName: id,
-        fetchImpl: opts.fetchImpl
-      });
-      if (provider) {
-        cache[cacheKey] = { fetchedAt: (/* @__PURE__ */ new Date()).toISOString(), provider };
-        cacheDirty = true;
-        opts.registry.mergeOverlay({ [id]: provider });
-        opts.logger?.info(
-          `auto-discovered ${Object.keys(provider.models).length} models for "${id}" from ${baseUrl}`
-        );
-        return;
-      }
-      const cached = cache[cacheKey];
-      if (cached) {
-        opts.registry.mergeOverlay({ [id]: cached.provider });
-        opts.logger?.warn(
-          `auto-discovery for "${id}" failed; using ${Object.keys(cached.provider.models).length} cached models from ${cached.fetchedAt}`
-        );
-      } else {
-        opts.logger?.warn(
-          `auto-discovery for "${id}" failed and no cache available (server at ${baseUrl} unreachable?)`
-        );
-      }
-    })
-  );
-  if (cacheDirty) {
-    try {
-      await fs.writeFile(cacheFile, JSON.stringify(cache), "utf8");
-    } catch {
-    }
-  }
-}
-
-export {
-  discoverAndMergeProviders
-};
-//# sourceMappingURL=chunk-52C7PD2H.js.map