@wrongstack/cli 1.0.1 → 1.0.3

package/dist/execute-deps.d.ts

@@ -149,6 +149,7 @@ interface SessionDeps {
 /** Provider/model registry, selection and switching. */
 interface ProviderDeps {
     statusTracker?: import('@wrongstack/core/coordination').ProviderModelStatusTracker | undefined;
+    providerAuthRegistry: import('@wrongstack/core/registry').ProviderAuthRegistry;
     modelsRegistry: ModelsRegistry;
     savedProviderCfg: ProviderConfig | undefined;
     resolvedProvider: ResolvedProvider | undefined;

package/dist/{execution-MIBWBYB6.js → execution-KH7WJNAX.js}

@@ -178,6 +178,7 @@ async function runWebUIDispatch(ctx) {
     globalConfigPath,
     projectSessionsDir,
     modelsRegistry,
+    providerAuthRegistry,
     mcpRegistry,
     brain,
     brainSettings,
@@ -211,7 +212,7 @@ async function runWebUIDispatch(ctx) {
   const isSimpleUi = !isSessionChild && flags["simpleui"] === true;
   agent.disableInteractiveConfirmation();
   renderer.setSilent(true);
-  const { runWebUI } = await import("./webui-server-5R35BHWZ.js");
+  const { runWebUI } = await import("./webui-server-QWBUT7BO.js");
   const flagValue = (names) => {
     for (const name of names) {
       if (!Object.hasOwn(flags, name)) continue;
@@ -305,6 +306,7 @@ async function runWebUIDispatch(ctx) {
     agentTranscripts,
     hqAllowExec: flagBoolean(["hq-allow-exec"]) ?? false,
     modelsRegistry,
+    providerAuthRegistry,
     globalConfigPath,
     profileConfigPath: ctx.profileConfigPath,
     mcpRegistry,
@@ -1923,6 +1925,7 @@ function createSettingsAdapter(ctx) {
       systemPromptVariant: cfg.systemPrompt?.variant === "lite" || cfg.systemPrompt?.variant === "pro" ? cfg.systemPrompt.variant : cfg.systemPrompt?.variant === "default" ? "default" : "pro",
       enhanceDelayMs: cfg.autonomy?.enhanceDelayMs ?? 15e3,
       enhanceEnabled: cfg.autonomy?.enhance ?? true,
+      preRefineSeconds: cfg.autonomy?.preRefineSeconds ?? 3,
       enhanceLanguage: cfg.autonomy?.enhanceLanguage === "english" ? "english" : cfg.autonomy?.enhanceLanguage === "original" ? "original" : "english",
       midRunSendPicker: cfg.autonomy?.midRunSendPicker ?? true,
       mouseMode: autonomy?.mouseMode ?? false,
@@ -1960,7 +1963,7 @@ function createSettingsAdapter(ctx) {
   }
   async function saveSettings(s) {
     try {
-      if (s.mode !== void 0 || s.delayMs !== void 0 || s.titleAnimation !== void 0 || s.yolo !== void 0 || s.fleetChatVerbosity !== void 0 || s.chime !== void 0 || s.confirmExit !== void 0 || s.mouseMode !== void 0 || s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || s.allowOutsideProjectRoot !== void 0 || s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0 || s.contextMode !== void 0 || s.maxConcurrent !== void 0 || s.logLevel !== void 0 || s.auditLevel !== void 0 || s.indexOnStart !== void 0 || s.maxIterations !== void 0 || s.multiDiffSummaryThreshold !== void 0 || s.nextStepsTool !== void 0 || s.restrictFsToRoot !== void 0 || s.nextPrediction !== void 0 || s.debugStream !== void 0 || s.shellBangWarningDontShowAgain !== void 0 || s.configScope !== void 0 || s.enhanceDelayMs !== void 0 || s.enhanceEnabled !== void 0 || s.enhanceLanguage !== void 0 || s.midRunSendPicker !== void 0 || s.statuslineMode !== void 0 || s.thinkingWord !== void 0 || s.animationStyle !== void 0 || s.autonomyNextPrompt !== void 0 || s.autoProceedMaxIterations !== void 0 || s.reasoningMode !== void 0 || s.reasoningEffort !== void 0 || s.reasoningPreserve !== void 0 || s.cacheTtl !== void 0 || s.breakerEnabled !== void 0 || s.breakerAutoKillResetMs !== void 0 || s.showModelReasoning !== void 0 || s.showAgentSwarmPanel !== void 0 || s.showSidebar !== void 0 || s.panelPositions !== void 0 || s.showSageMemoryInject !== void 0 || s.sageMemoryInjectThreshold !== void 0 || s.readSymbols !== void 0 || // WrongProxy / WrongTrace: gate the persisted-section write on
+      if (s.mode !== void 0 || s.delayMs !== void 0 || s.titleAnimation !== void 0 || s.yolo !== void 0 || s.fleetChatVerbosity !== void 0 || s.chime !== void 0 || s.confirmExit !== void 0 || s.mouseMode !== void 0 || s.featureMcp !== void 0 || s.featurePlugins !== void 0 || s.featureMemory !== void 0 || s.featureSkills !== void 0 || s.featureModelsRegistry !== void 0 || s.featureTokenSaving !== void 0 || s.allowOutsideProjectRoot !== void 0 || s.contextAutoCompact !== void 0 || s.contextStrategy !== void 0 || s.contextMode !== void 0 || s.maxConcurrent !== void 0 || s.logLevel !== void 0 || s.auditLevel !== void 0 || s.indexOnStart !== void 0 || s.maxIterations !== void 0 || s.multiDiffSummaryThreshold !== void 0 || s.nextStepsTool !== void 0 || s.restrictFsToRoot !== void 0 || s.nextPrediction !== void 0 || s.debugStream !== void 0 || s.shellBangWarningDontShowAgain !== void 0 || s.configScope !== void 0 || s.enhanceDelayMs !== void 0 || s.enhanceEnabled !== void 0 || s.preRefineSeconds !== void 0 || s.enhanceLanguage !== void 0 || s.midRunSendPicker !== void 0 || s.statuslineMode !== void 0 || s.thinkingWord !== void 0 || s.animationStyle !== void 0 || s.autonomyNextPrompt !== void 0 || s.autoProceedMaxIterations !== void 0 || s.reasoningMode !== void 0 || s.reasoningEffort !== void 0 || s.reasoningPreserve !== void 0 || s.cacheTtl !== void 0 || s.breakerEnabled !== void 0 || s.breakerAutoKillResetMs !== void 0 || s.showModelReasoning !== void 0 || s.showAgentSwarmPanel !== void 0 || s.showSidebar !== void 0 || s.panelPositions !== void 0 || s.showSageMemoryInject !== void 0 || s.sageMemoryInjectThreshold !== void 0 || s.readSymbols !== void 0 || // WrongProxy / WrongTrace: gate the persisted-section write on
       // either key being present in the live patch. Without this, a
       // picker toggle round-trip would silently no-op the persistence
       // layer (the runtime probe would never read the change).
@@ -2005,6 +2008,7 @@ function createSettingsAdapter(ctx) {
         if (s.mouseMode !== void 0) autonomy.mouseMode = s.mouseMode;
         if (s.enhanceDelayMs !== void 0) autonomy.enhanceDelayMs = s.enhanceDelayMs;
         if (s.enhanceEnabled !== void 0) autonomy.enhance = s.enhanceEnabled;
+        if (s.preRefineSeconds !== void 0) autonomy.preRefineSeconds = s.preRefineSeconds;
         if (s.enhanceLanguage !== void 0) autonomy.enhanceLanguage = s.enhanceLanguage;
         if (s.midRunSendPicker !== void 0) autonomy.midRunSendPicker = s.midRunSendPicker;
         if (s.shellBangWarningDontShowAgain !== void 0)
@@ -2570,6 +2574,7 @@ var CHIMERA_REVIEW_READ_ONLY_TOOLS = Object.freeze([
   "codebase-stats",
   "codebase-search",
   "codebase-skeleton",
+  "codebase-context",
   "codebase-repo-map",
   "codebase-incoming-calls",
   "codebase-outgoing-calls"
@@ -4445,7 +4450,7 @@ ${list}`);
 function parsePredictions(raw, max = 3) {
   const text = raw.trim();
   if (!text) return [];
-  if (/^none\.?\s*$/i.test(text) || /^no further steps/i.test(text)) return [];
+  if (/^none\.?\s*$/i.test(text) || /^no further steps(?: needed)?\.?\s*$/i.test(text)) return [];
   const out = [];
   for (const lineRaw of text.split("\n")) {
     const line = lineRaw.trim();
@@ -6091,6 +6096,7 @@ async function execute(deps) {
     },
     provider: {
       modelsRegistry,
+      providerAuthRegistry,
       savedProviderCfg,
       resolvedProvider,
       statusTracker,
@@ -6595,6 +6601,7 @@ async function execute(deps) {
         profileConfigPath: wpaths.profileConfig(profileName),
         projectSessionsDir: wpaths.projectSessions,
         modelsRegistry,
+        providerAuthRegistry,
         mcpRegistry,
         brain,
         brainSettings,
@@ -6741,4 +6748,4 @@ export {
   execute,
   resolveReviewerFallbackModels
 };
-//# sourceMappingURL=execution-MIBWBYB6.js.map
+//# sourceMappingURL=execution-KH7WJNAX.js.map

package/dist/index.js

@@ -16,14 +16,14 @@ async function main(argv) {
   applySessionShellDefault();
   const earlyFlags = parseArgs(argv).flags;
   if (earlyFlags["help"] === true || earlyFlags["version"] === true) {
-    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-UREFSYBL.js");
+    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-ZNZX44MC.js");
     const earlyExit = await handleHelpVersionShortCircuit(argv);
     if (earlyExit !== null) return earlyExit;
   }
-  const { initializeCli } = await import("./cli-context-7X3M6U73.js");
+  const { initializeCli } = await import("./cli-context-Q6QP534K.js");
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-53KG6HAV.js");
+  const { runInteractive } = await import("./cli-main-JQXCDZEA.js");
   return runInteractive(cliCtx);
 }
 

package/dist/live-settings-input.d.ts

@@ -39,6 +39,8 @@ export interface LiveSettingsInput {
     enhanceDelayMs?: number | undefined;
     enhanceEnabled?: boolean | undefined;
     enhanceLanguage?: string | undefined;
+    /** Pre-refine grace period (seconds) before the refiner LLM call starts. 0 = skip. Default: 3. */
+    preRefineSeconds?: number | undefined;
     /** Mid-run send-mode picker (queue/btw/steer) toggle. Default on. */
     midRunSendPicker?: boolean | undefined;
     /** Skip the confirmation prompt for the TUI `!<command>` shell shortcut. */

package/dist/{mailbox-serve-VUCWZ2SJ.js → mailbox-serve-X3CR6VFW.js}

@@ -114,8 +114,9 @@ or stop the conflicting process and retry.
     credentialStore,
     projectId,
     authorize: (request) => {
-      if (/^Credential\s+/i.test(request.headers.authorization ?? "")) {
-        return { allowed: true };
+      const header = request.headers.authorization;
+      if (typeof header === "string" && /^Credential\s+/i.test(header)) {
+        return void 0;
       }
       return authorizeMailboxBearerToken(request, tentative.token);
     },
@@ -359,4 +360,4 @@ function printHelp(deps) {
 export {
   mailboxServeCmd
 };
-//# sourceMappingURL=mailbox-serve-VUCWZ2SJ.js.map
+//# sourceMappingURL=mailbox-serve-X3CR6VFW.js.map

package/dist/{modeldiag-FMJT37SN.js → modeldiag-46CMWUNM.js}

@@ -1,6 +1,6 @@
 import {
   discoverAndMergeProviders
-} from "./chunk-52C7PD2H.js";
+} from "./chunk-D5GB5MHA.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
@@ -1081,30 +1081,37 @@ async function runModeldiagTest(args, deps, config) {
 // src/subcommands/handlers/modeldiag.ts
 async function readProviders(cachePath) {
   if (!cachePath) {
-    return `${color5.red("Models cache not available")}.`;
+    return { ok: false, message: `${color5.red("Models cache not available")}.`, hard: true };
   }
   try {
     const raw = await fs.readFile(cachePath, "utf8");
     const parsed = JSON.parse(raw);
     const payload = parsed.payload ?? parsed;
-    return Object.entries(payload).map(([id, p]) => ({
-      id: p.id ?? id,
-      name: p.name ?? id,
-      family: p.npm ?? id,
-      models: Object.values(p.models ?? {}).map(
-        (m) => ({
-          id: m.id,
-          name: m.name,
-          capabilities: {
-            contextWindow: m.limit?.context,
-            maxOutputTokens: m.limit?.output
-          },
-          pricing: m.cost
-        })
-      )
-    }));
+    return {
+      ok: true,
+      providers: Object.entries(payload).map(([id, p]) => ({
+        id: p.id ?? id,
+        name: p.name ?? id,
+        family: p.npm ?? id,
+        models: Object.values(p.models ?? {}).map(
+          (m) => ({
+            id: m.id,
+            name: m.name,
+            capabilities: {
+              contextWindow: m.limit?.context,
+              maxOutputTokens: m.limit?.output
+            },
+            pricing: m.cost
+          })
+        )
+      }))
+    };
   } catch {
-    return `${color5.amber("Models cache not available")}. Run wstack sync-models.`;
+    return {
+      ok: false,
+      message: `${color5.amber("Models cache not available")}. Run wstack sync-models.`,
+      hard: false
+    };
   }
 }
 function checkHasKey(pid, config) {
@@ -1118,12 +1125,12 @@ function checkHasKey(pid, config) {
 var modeldiagCmd = async (args, deps) => {
   const sub = args[0]?.toLowerCase() || "full";
   const cacheResult = await readProviders(deps.paths.modelsCache);
-  if (typeof cacheResult === "string") {
-    deps.renderer.write(`${cacheResult}
+  if (!cacheResult.ok) {
+    deps.renderer.write(`${cacheResult.message}
 `);
-    return cacheResult.includes(color5.red("")) ? 1 : 0;
+    return cacheResult.hard ? 1 : 0;
   }
-  const providers = cacheResult;
+  const providers = cacheResult.providers;
   const config = deps.config;
   const modelMatrix = config.modelMatrix ?? {};
   function hasKey(pid) {
@@ -1322,4 +1329,4 @@ var modeldiagCmd = async (args, deps) => {
 export {
   modeldiagCmd
 };
-//# sourceMappingURL=modeldiag-FMJT37SN.js.map
+//# sourceMappingURL=modeldiag-46CMWUNM.js.map

package/dist/{plugin-usage-HFBI3TFT.js → plugin-usage-M6KET4OZ.js}

@@ -1,6 +1,6 @@
 import {
   runPluginManagementCommand
-} from "./chunk-TEBMCYZN.js";
+} from "./chunk-SIS37L3W.js";
 import {
   restoreFlags
 } from "./chunk-CSAPOCBP.js";
@@ -40,4 +40,4 @@ export {
   pluginCmd,
   usageCmd
 };
-//# sourceMappingURL=plugin-usage-HFBI3TFT.js.map
+//# sourceMappingURL=plugin-usage-M6KET4OZ.js.map

package/dist/{plugins-PZ2VZL7V.js → plugins-U7KGQAUG.js}

@@ -6,9 +6,9 @@ import {
   pluginNameFromSpec,
   setupPlugins,
   warnIfDeprecatedPluginName
-} from "./chunk-5IA5337I.js";
+} from "./chunk-U6KCWRMC.js";
 import "./chunk-EWKESL4L.js";
-import "./chunk-TEBMCYZN.js";
+import "./chunk-SIS37L3W.js";
 export {
   BUILTIN_PLUGIN_FACTORIES,
   DEPRECATED_PLUGIN_NAMES,
@@ -18,4 +18,4 @@ export {
   setupPlugins,
   warnIfDeprecatedPluginName
 };
-//# sourceMappingURL=plugins-PZ2VZL7V.js.map
+//# sourceMappingURL=plugins-U7KGQAUG.js.map

package/dist/{providers-models-YVMVYWRS.js → providers-models-6MOGAOVK.js}

@@ -239,7 +239,7 @@ function aliasProviderId(configProviderId, cfg) {
 async function discoverProviderModels(deps, ids) {
   if (!("mergeOverlay" in deps.modelsRegistry)) return void 0;
   try {
-    const { discoverAndMergeProviders } = await import("./auto-discover-providers-VQU3IZMR.js");
+    const { discoverAndMergeProviders } = await import("./auto-discover-providers-DXR25GTG.js");
     await discoverAndMergeProviders({
       config: deps.config,
       registry: deps.modelsRegistry,
@@ -660,4 +660,4 @@ export {
   modelsCmd,
   providersCmd
 };
-//# sourceMappingURL=providers-models-YVMVYWRS.js.map
+//# sourceMappingURL=providers-models-6MOGAOVK.js.map

package/dist/{short-circuit-flags-UREFSYBL.js → short-circuit-flags-ZNZX44MC.js}

@@ -1,10 +1,10 @@
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-KHWDTNBZ.js";
+} from "./chunk-4NHD5OXJ.js";
 import "./chunk-FPIWTJ2G.js";
 import "./chunk-XJXDOF63.js";
 import "./chunk-E6RFXHWD.js";
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=short-circuit-flags-UREFSYBL.js.map
+//# sourceMappingURL=short-circuit-flags-ZNZX44MC.js.map

package/dist/slash-commands/codebase-map.d.ts

@@ -0,0 +1,11 @@
+import type { SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommandContext } from './command-context.js';
+/**
+ * `/codebase-map` — read and publish the centrality-ranked view of the index.
+ *
+ * Three jobs, one command, because they are three views of the same data:
+ * print the map, write the committable atlas projection, and report whether a
+ * previously written atlas still describes the current code.
+ */
+export declare function buildCodebaseMapCommand(opts: SlashCommandContext): SlashCommand;
+//# sourceMappingURL=codebase-map.d.ts.map

package/dist/slash-commands/command-context.d.ts

@@ -3,6 +3,7 @@ import type { EventBus } from '@wrongstack/core/kernel';
 import type { SlashCommandRegistry, ToolRegistry } from '@wrongstack/core/registry';
 import type { CompactReport, HealthRegistry, MemoryPort, MetricsRuntimeStatus, MetricsSink, ModeStore, Renderer, SessionStore, SkillLoader, TokenCounter } from '@wrongstack/core/types';
 import type { WstackPaths } from '@wrongstack/core/utils';
+import type { SummarizerPort } from '@wrongstack/tools';
 import type { VectorMemoryStore } from '@wrongstack/vector-memory';
 /** Host capabilities supplied to command adapters. */
 export interface SlashCommandContext {
@@ -41,6 +42,12 @@ export interface SlashCommandContext {
     cwd: string;
     /** Project root (typically resolved from cwd). */
     projectRoot: string;
+    /**
+     * Model port for the codebase index's concept layer. Present only when
+     * `indexing.concepts.enabled` is true — its absence is what `/codebase-map
+     * --enrich` reports instead of silently doing nothing.
+     */
+    codebaseConceptSummarizer?: SummarizerPort | undefined;
     metricsSink?: MetricsSink | undefined;
     healthRegistry?: HealthRegistry | undefined;
     metricsStatus?: MetricsRuntimeStatus | undefined;

package/dist/slash-commands/context.d.ts

@@ -1,4 +1,14 @@
 import type { SlashCommand } from '@wrongstack/core/types';
 import type { SlashCommandContext } from './command-context.js';
 export declare function buildContextCommand(opts: SlashCommandContext): SlashCommand;
+/**
+ * One line naming what the recent per-request ratios mean.
+ *
+ * Deliberately reports a SHAPE, not a threshold. "40%" is a healthy young
+ * session and a broken old one; what separates them is whether the number is
+ * climbing as the conversation grows. The first request of a session can never
+ * hit, so it is excluded from the judgement rather than allowed to drag the
+ * verdict down.
+ */
+export declare function cacheTrendVerdict(recent: readonly number[]): string;
 //# sourceMappingURL=context.d.ts.map

package/dist/slash-commands/openai-quota.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `/openai-quota` — how much of the ChatGPT (Codex) subscription this account
+ * has burned, and when the windows reset.
+ *
+ * A "Sign in with ChatGPT" account is metered on rolling windows — typically a
+ * 5-hour one and a weekly one — and the ChatGPT backend reports the burn on
+ * every `/codex/responses` response, in headers. Nothing about that reaches the
+ * SSE body, so before this existed the first visible sign of an exhausted plan
+ * was a 429 in the middle of a turn.
+ *
+ * The command is provider-scoped; the machinery underneath is not. It renders
+ * whatever `@wrongstack/core/quota` holds for one provider id, and the renderer
+ * below reads only the neutral shape. A second metered provider needs a
+ * reporter and a one-line command, not a second copy of this file.
+ *
+ * The reading is observational: it appears after the first request of the
+ * session, not before, and it is never fetched on its own — spending a request
+ * to ask "how much have I spent" is exactly the wrong trade on a metered plan.
+ *
+ * Usage:
+ *   /openai-quota     Show the latest reading for every metered window
+ */
+import { type ProviderQuotaSnapshot } from '@wrongstack/core/quota';
+import type { SlashCommand } from '@wrongstack/core/types';
+/**
+ * Render one meter. Provider-neutral by construction — everything it reads is
+ * on the shared snapshot shape.
+ */
+export declare function renderQuotaSnapshot(snapshot: ProviderQuotaSnapshot): string[];
+export declare function buildOpenAIQuotaCommand(): SlashCommand;
+//# sourceMappingURL=openai-quota.d.ts.map

package/dist/{subcommands-WJLBHVKC.js → subcommands-CUTGBDKP.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-D2VCUN7M.js";
+} from "./chunk-IUEKNHPT.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-WJLBHVKC.js.map
+//# sourceMappingURL=subcommands-CUTGBDKP.js.map

package/dist/{webui-server-5R35BHWZ.js → webui-server-QWBUT7BO.js}

@@ -46,6 +46,7 @@ import {
   toSessionHistoryEntries
 } from "@wrongstack/webui-server";
 import { WebSocketServer } from "ws";
+import { verifyClient as verifyWsClient2 } from "@wrongstack/webui-server/server/ws-auth";
 
 // src/webui-server/client-registration.ts
 import { mailboxSessionTag } from "@wrongstack/core/coordination";
@@ -1495,7 +1496,22 @@ async function runWebUI(opts) {
     ...opts.getVectorMemoryStore ? { getVectorMemoryStore: opts.getVectorMemoryStore } : {},
     ...opts.vectorMemoryModelCacheDir ? { vectorMemoryModelCacheDir: opts.vectorMemoryModelCacheDir } : {}
   });
-  const wss = httpServer ? new WebSocketServer({ server: httpServer.server, maxPayload: 20 * 1024 * 1024 }) : new WebSocketServer({ port: httpPort, host, maxPayload: 20 * 1024 * 1024 });
+  const verifyClient = (info) => verifyWsClient2({
+    origin: info.origin,
+    url: info.req.url ?? "",
+    hostHeader: info.req.headers.host,
+    remoteAddress: info.req.socket.remoteAddress,
+    cookieHeader: info.req.headers.cookie,
+    wsHost: host,
+    expectedToken: wsToken,
+    requireToken,
+    allowedHostnames: [publicUrl, publicWsUrl].filter(
+      (value) => Boolean(value)
+    ),
+    allowBrowserUrlToken: Boolean(publicWsUrl),
+    allowCrossPortLoopbackCookie: process.env["WRONGSTACK_WEBUI_DEV_CROSS_PORT_WS"] === "1"
+  });
+  const wss = httpServer ? new WebSocketServer({ server: httpServer.server, verifyClient, maxPayload: 20 * 1024 * 1024 }) : new WebSocketServer({ port: httpPort, host, verifyClient, maxPayload: 20 * 1024 * 1024 });
   wss.on("error", (err) => {
     console.error(
       JSON.stringify({
@@ -1625,6 +1641,7 @@ async function runWebUI(opts) {
       () => opts.appConfig?.providers ?? {}
     ),
     modelsRegistry: opts.modelsRegistry,
+    providerAuthRegistry: opts.providerAuthRegistry,
     send,
     broadcast,
     log: (m) => console.log(m)
@@ -1951,4 +1968,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-5R35BHWZ.js.map
+//# sourceMappingURL=webui-server-QWBUT7BO.js.map

package/dist/webui-server-options.d.ts

@@ -117,6 +117,7 @@ export interface CliWebUIOptions {
         webuiInstanceRegistered: boolean;
     }) => void;
     modelsRegistry?: ModelsRegistry | undefined;
+    providerAuthRegistry?: import('@wrongstack/core/registry').ProviderAuthRegistry | undefined;
     globalConfigPath?: string | undefined;
     /** Resolved profile config path: ~/.wrongstack/profiles/<activeProfile>/config.json */
     profileConfigPath: string;

package/dist/wiring/atlas-prompt-contributor.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Atlas boot-prompt contributor — the repository's shape, put in front of the
+ * agent instead of left to be rediscovered.
+ *
+ * Without this, every session begins the same way: a handful of searches to
+ * work out which packages exist, which files everything depends on, and where
+ * the entry points are. The index has known all of that since it was built.
+ * A few hundred tokens spends once what a dozen tool calls spend every time.
+ *
+ * Contract, matching `wrongtrace-prompt-contributor.ts`:
+ *   - **Fail-open.** No index, no ranks, a throw, a timeout → `[]`. Orientation
+ *     is a convenience; it must never be the reason a session cannot start.
+ *   - **Bounded.** The brief is read behind a deadline, because the store lives
+ *     on disk and a cold or busy index must not stall the first prompt.
+ *   - **Cached per process.** The brief only changes when the index does, and
+ *     rebuilding it on every prompt build would read SQLite on every turn.
+ *   - **Cache-safe.** Contributor blocks are tagged `'contributor'`, which
+ *     `EPOCH_VOLATILE_SOURCES` moves out of the wire `system` block and into
+ *     the live-context tail — so this does not invalidate the prompt cache
+ *     prefix the way a system-prompt edit would.
+ *
+ * It is deliberately *not* routed through SAGE. That pipeline is for episodic
+ * memory and gates on relevance thresholds a repository map would fail; the
+ * map is not a memory, it is a fact about the checkout.
+ */
+import type { SystemPromptContributor, TokenSavingTier } from '@wrongstack/core/types';
+import { type AtlasBrief } from '@wrongstack/tools';
+/** Default hard ceiling on the rendered block. */
+export declare const DEFAULT_BRIEF_MAX_TOKENS = 800;
+/**
+ * Render the brief, trimming from the bottom until it fits.
+ *
+ * The order of the sections is the order of their value to somebody who knows
+ * nothing about the repository: what it is made of, what everything depends
+ * on, and — last, because it is the least load-bearing — what each subsystem
+ * does in prose. Trimming from the bottom therefore degrades gracefully
+ * instead of losing the hubs.
+ */
+export declare function renderAtlasBrief(brief: AtlasBrief, maxTokens: number): string;
+export interface AtlasPromptContributorOptions {
+    projectRoot: string;
+    indexDir?: string | undefined;
+    /** `indexing.atlas.injectOnSessionStart`. Default true. */
+    enabled?: boolean | undefined;
+    /** `indexing.atlas.briefMaxTokens`. Default {@link DEFAULT_BRIEF_MAX_TOKENS}. */
+    maxTokens?: number | undefined;
+    tokenSavingMode?: TokenSavingTier | boolean | undefined;
+}
+/**
+ * Build the contributor. One instance per prompt-builder binding; the brief
+ * cache lives on the closure, so it is per process, like the builder.
+ */
+export declare function createAtlasPromptContributor(options: AtlasPromptContributorOptions): SystemPromptContributor;
+//# sourceMappingURL=atlas-prompt-contributor.d.ts.map

package/dist/wiring/cli-execute-builder.d.ts

@@ -73,6 +73,7 @@ export declare function runCliExecution(params: {
     agentMonitor?: X['fleet']['agentTranscripts'];
     vault: AUP['vault'];
     profileConfigPath: string;
+    providerAuthRegistry: NonNullable<AUP['providerAuthRegistry']>;
     onPanelOpen: X['fleet']['onPanelOpen'];
     interruptController: RC['interruptController'];
     enhanceController: RC['enhanceController'];

package/dist/wiring/codebase-embeddings.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Host-side wiring for the codebase index's semantic embeddings.
+ *
+ * The model is `packages/vector-memory`'s transformers-backed provider, which
+ * already emits 384-dimensional vectors — the width `file_vectors` stores. It
+ * arrives here rather than inside `packages/tools` for two reasons:
+ *
+ *  - `@huggingface/transformers` is an **optional** dependency. A repository
+ *    that never enables semantic search should not have to install a model
+ *    runtime, and `packages/tools` must stay importable without one.
+ *  - A function cannot cross the project daemon's IPC boundary. The daemon
+ *    compares vectors; the host produces them. That also keeps a ~90 MB model
+ *    out of every per-project daemon process.
+ *
+ * Everything here is best-effort. When the optional dependency is absent, the
+ * model cannot load, or the config leaves embeddings off, the port is simply
+ * `undefined` and retrieval stays lexical — which is the behaviour that
+ * shipped before embeddings existed.
+ */
+import type { IndexingEmbeddingsConfig } from '@wrongstack/core/types';
+import type { EmbeddingPort } from '@wrongstack/tools';
+/**
+ * Build the embedding port, or `undefined` when semantic search is off or
+ * unavailable.
+ *
+ * The dynamic import is what keeps `@huggingface/transformers` optional: a
+ * missing package throws here and is reported as "unavailable", never as a
+ * startup failure.
+ */
+export declare function createCodebaseEmbeddingPort(settings: IndexingEmbeddingsConfig | undefined): Promise<EmbeddingPort | undefined>;
+//# sourceMappingURL=codebase-embeddings.d.ts.map

package/dist/wiring/command-host-state.d.ts

@@ -77,6 +77,7 @@ export declare function setupCommandHostState(input: CommandHostStateInput): Pro
         project?: import("@wrongstack/core/statusline").StatuslineLine;
         prompt_variant?: import("@wrongstack/core/statusline").StatuslineLine;
         queue?: import("@wrongstack/core/statusline").StatuslineLine;
+        quota?: import("@wrongstack/core/statusline").StatuslineLine;
         sessions?: import("@wrongstack/core/statusline").StatuslineLine;
         side_effects?: import("@wrongstack/core/statusline").StatuslineLine;
         state?: import("@wrongstack/core/statusline").StatuslineLine;
@@ -122,6 +123,7 @@ export declare function setupCommandHostState(input: CommandHostStateInput): Pro
         project?: import("@wrongstack/core/statusline").StatuslineDensity;
         prompt_variant?: import("@wrongstack/core/statusline").StatuslineDensity;
         queue?: import("@wrongstack/core/statusline").StatuslineDensity;
+        quota?: import("@wrongstack/core/statusline").StatuslineDensity;
         sessions?: import("@wrongstack/core/statusline").StatuslineDensity;
         side_effects?: import("@wrongstack/core/statusline").StatuslineDensity;
         state?: import("@wrongstack/core/statusline").StatuslineDensity;

package/dist/wiring/concept-summarizer.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Host-side implementation of the codebase index's {@link SummarizerPort}.
+ *
+ * `packages/tools` defines what a summariser must answer; producing that answer
+ * needs a configured provider and the model-tier policy, both of which live
+ * here. The port is therefore injected rather than imported, the same way SAGE
+ * takes `getLlmCall` — a host that supplies nothing simply gets no concept
+ * layer, and the index carries on working without one.
+ *
+ * ## Cost shape
+ *
+ * One call per file, and only for files whose bytes changed since the last
+ * pass. Enrichment is the one part of the index that spends money, so the model
+ * is resolved through the tier layer at its cheapest configured level unless
+ * the caller pins one, and both the token ceiling and the timeout are small.
+ */
+import { OneShotOrchestrator } from '@wrongstack/core/execution';
+import type { Config } from '@wrongstack/core/types';
+import type { SummarizerPort } from '@wrongstack/tools';
+type OrchestratorOptions = ConstructorParameters<typeof OneShotOrchestrator>[0];
+export interface ConceptSummarizerDeps {
+    buildProvider: OrchestratorOptions['buildProvider'];
+    getConfig: () => Config;
+    fallbackProfileManager: OrchestratorOptions['fallbackProfileManager'];
+    statusTracker?: OrchestratorOptions['statusTracker'];
+    wrapProviderCall?: OrchestratorOptions['wrapProviderCall'];
+    /** Explicit model override; otherwise the configured budget tier decides. */
+    model?: string | undefined;
+}
+export declare function createConceptSummarizer(deps: ConceptSummarizerDeps): SummarizerPort;
+export {};
+//# sourceMappingURL=concept-summarizer.d.ts.map

package/dist/wiring/external-plugins.d.ts

@@ -64,5 +64,6 @@ interface LoadExternalPluginsContext {
     importModule?: ((url: string) => Promise<unknown>) | undefined;
 }
 export declare function loadExternalPlugins(ctx: LoadExternalPluginsContext, hooks: ExternalPluginHooks): Promise<Plugin[]>;
+export declare function hashPluginClosure(entryPath: string): Promise<string>;
 export {};
 //# sourceMappingURL=external-plugins.d.ts.map

package/dist/wiring/lifecycle-plugins.d.ts

@@ -1,7 +1,7 @@
 import { type RemoteMailbox } from '@wrongstack/core/coordination';
 import { HookRegistry, HookRunner } from '@wrongstack/core/hooks';
 import type { PluginHostHandle } from '@wrongstack/core/plugin';
-import { type ProviderRegistry, SlashCommandRegistry, type ToolRegistry } from '@wrongstack/core/registry';
+import { type ProviderAuthRegistry, type ProviderRegistry, SlashCommandRegistry, type ToolRegistry } from '@wrongstack/core/registry';
 import type { Config, HealthRegistry, Logger, MetricsRuntimeStatus, ModelsRegistry, PromptLoader, Provider, ProviderConfig, SecretVault, SessionWriter, SkillLoader } from '@wrongstack/core/types';
 import type { WstackPaths } from '@wrongstack/core/utils';
 import { MCPRegistry } from '@wrongstack/mcp';
@@ -27,6 +27,7 @@ interface LifecyclePluginsDeps {
     wpaths: WstackPaths;
     toolRegistry: ToolRegistry;
     providerRegistry: ProviderRegistry;
+    providerAuthRegistry: ProviderAuthRegistry;
     configStore: any;
     eventWiring: EventWiring;
     healthRegistry: HealthRegistry | undefined;

package/dist/wiring/plugins.d.ts

@@ -2,7 +2,7 @@ import type { AgentPipelines } from '@wrongstack/core/agent';
 import type { ExtensionRegistry } from '@wrongstack/core/extension';
 import type { Container, EventBus } from '@wrongstack/core/kernel';
 import type { PluginAPIInit, PluginHostHandle } from '@wrongstack/core/plugin';
-import type { ProviderRegistry, SlashCommandRegistry, ToolRegistry } from '@wrongstack/core/registry';
+import type { ProviderAuthRegistry, ProviderRegistry, SlashCommandRegistry, ToolRegistry } from '@wrongstack/core/registry';
 import type { Config, ConfigStore, HealthRegistry, Logger, MetricsRuntimeStatus, MetricsSinkView, ModelsRegistry, Plugin, PromptLoader, SessionWriter, SkillLoader } from '@wrongstack/core/types';
 import type { MCPRegistry } from '@wrongstack/mcp';
 export declare const DEPRECATED_PLUGIN_NAMES: Record<string, string>;
@@ -34,6 +34,7 @@ export interface PluginsWiringDeps {
     pipelines: AgentPipelines;
     toolRegistry: ToolRegistry;
     providerRegistry: ProviderRegistry;
+    providerAuthRegistry?: ProviderAuthRegistry | undefined;
     slashCommandRegistry: SlashCommandRegistry;
     mcpRegistry: MCPRegistry;
     log: Logger;