@wrongstack/cli 1.0.1 → 1.0.4

package/dist/index.js

@@ -8,7 +8,7 @@ import {
 } from "./chunk-XJXDOF63.js";
 import {
   parseArgs
-} from "./chunk-E6RFXHWD.js";
+} from "./chunk-EK2P53GL.js";
 
 // src/cli-entry-main.ts
 async function main(argv) {
@@ -16,14 +16,14 @@ async function main(argv) {
   applySessionShellDefault();
   const earlyFlags = parseArgs(argv).flags;
   if (earlyFlags["help"] === true || earlyFlags["version"] === true) {
-    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-UREFSYBL.js");
+    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-YDMLAQ5R.js");
     const earlyExit = await handleHelpVersionShortCircuit(argv);
     if (earlyExit !== null) return earlyExit;
   }
-  const { initializeCli } = await import("./cli-context-7X3M6U73.js");
+  const { initializeCli } = await import("./cli-context-WFC3BNGM.js");
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-53KG6HAV.js");
+  const { runInteractive } = await import("./cli-main-GU3YZLMO.js");
   return runInteractive(cliCtx);
 }
 

package/dist/ip-allowlist-NHXO6AKJ.js

@@ -0,0 +1,9 @@
+import {
+  createHqIpAllowlist,
+  parseHqIpAllowlist
+} from "./chunk-Q7E3BPDU.js";
+export {
+  createHqIpAllowlist,
+  parseHqIpAllowlist
+};
+//# sourceMappingURL=ip-allowlist-NHXO6AKJ.js.map

package/dist/live-settings-input.d.ts

@@ -39,6 +39,8 @@ export interface LiveSettingsInput {
     enhanceDelayMs?: number | undefined;
     enhanceEnabled?: boolean | undefined;
     enhanceLanguage?: string | undefined;
+    /** Pre-refine grace period (seconds) before the refiner LLM call starts. 0 = skip. Default: 3. */
+    preRefineSeconds?: number | undefined;
     /** Mid-run send-mode picker (queue/btw/steer) toggle. Default on. */
     midRunSendPicker?: boolean | undefined;
     /** Skip the confirmation prompt for the TUI `!<command>` shell shortcut. */
@@ -65,6 +67,8 @@ export interface LiveSettingsInput {
     cacheTtl?: 'default' | '5m' | '1h' | undefined;
     /** Show "Model Reasoning" blocks in chat history. Default: true. */
     showModelReasoning?: boolean | undefined;
+    /** Default presentation density for committed TUI tool results. */
+    toolResultViewMode?: 'minimal' | 'normal' | 'full' | undefined;
     /** Agent swarm panel placement: 'bottom' (lower region), 'sidebar' (right sidebar), or 'off' (hidden).
      * Backward-compat: legacy boolean values are coerced by the TUI settings adapter. Default: 'bottom'. */
     showAgentSwarmPanel?: 'bottom' | 'sidebar' | 'off' | boolean | undefined;

package/dist/{mailbox-serve-VUCWZ2SJ.js → mailbox-serve-X3CR6VFW.js}

@@ -114,8 +114,9 @@ or stop the conflicting process and retry.
     credentialStore,
     projectId,
     authorize: (request) => {
-      if (/^Credential\s+/i.test(request.headers.authorization ?? "")) {
-        return { allowed: true };
+      const header = request.headers.authorization;
+      if (typeof header === "string" && /^Credential\s+/i.test(header)) {
+        return void 0;
       }
       return authorizeMailboxBearerToken(request, tentative.token);
     },
@@ -359,4 +360,4 @@ function printHelp(deps) {
 export {
   mailboxServeCmd
 };
-//# sourceMappingURL=mailbox-serve-VUCWZ2SJ.js.map
+//# sourceMappingURL=mailbox-serve-X3CR6VFW.js.map

package/dist/{modeldiag-FMJT37SN.js → modeldiag-46CMWUNM.js}

@@ -1,6 +1,6 @@
 import {
   discoverAndMergeProviders
-} from "./chunk-52C7PD2H.js";
+} from "./chunk-D5GB5MHA.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
@@ -1081,30 +1081,37 @@ async function runModeldiagTest(args, deps, config) {
 // src/subcommands/handlers/modeldiag.ts
 async function readProviders(cachePath) {
   if (!cachePath) {
-    return `${color5.red("Models cache not available")}.`;
+    return { ok: false, message: `${color5.red("Models cache not available")}.`, hard: true };
   }
   try {
     const raw = await fs.readFile(cachePath, "utf8");
     const parsed = JSON.parse(raw);
     const payload = parsed.payload ?? parsed;
-    return Object.entries(payload).map(([id, p]) => ({
-      id: p.id ?? id,
-      name: p.name ?? id,
-      family: p.npm ?? id,
-      models: Object.values(p.models ?? {}).map(
-        (m) => ({
-          id: m.id,
-          name: m.name,
-          capabilities: {
-            contextWindow: m.limit?.context,
-            maxOutputTokens: m.limit?.output
-          },
-          pricing: m.cost
-        })
-      )
-    }));
+    return {
+      ok: true,
+      providers: Object.entries(payload).map(([id, p]) => ({
+        id: p.id ?? id,
+        name: p.name ?? id,
+        family: p.npm ?? id,
+        models: Object.values(p.models ?? {}).map(
+          (m) => ({
+            id: m.id,
+            name: m.name,
+            capabilities: {
+              contextWindow: m.limit?.context,
+              maxOutputTokens: m.limit?.output
+            },
+            pricing: m.cost
+          })
+        )
+      }))
+    };
   } catch {
-    return `${color5.amber("Models cache not available")}. Run wstack sync-models.`;
+    return {
+      ok: false,
+      message: `${color5.amber("Models cache not available")}. Run wstack sync-models.`,
+      hard: false
+    };
   }
 }
 function checkHasKey(pid, config) {
@@ -1118,12 +1125,12 @@ function checkHasKey(pid, config) {
 var modeldiagCmd = async (args, deps) => {
   const sub = args[0]?.toLowerCase() || "full";
   const cacheResult = await readProviders(deps.paths.modelsCache);
-  if (typeof cacheResult === "string") {
-    deps.renderer.write(`${cacheResult}
+  if (!cacheResult.ok) {
+    deps.renderer.write(`${cacheResult.message}
 `);
-    return cacheResult.includes(color5.red("")) ? 1 : 0;
+    return cacheResult.hard ? 1 : 0;
   }
-  const providers = cacheResult;
+  const providers = cacheResult.providers;
   const config = deps.config;
   const modelMatrix = config.modelMatrix ?? {};
   function hasKey(pid) {
@@ -1322,4 +1329,4 @@ var modeldiagCmd = async (args, deps) => {
 export {
   modeldiagCmd
 };
-//# sourceMappingURL=modeldiag-FMJT37SN.js.map
+//# sourceMappingURL=modeldiag-46CMWUNM.js.map

package/dist/{per-subcommand-help-BWBHYVJO.js → per-subcommand-help-DHTYU524.js}

@@ -7,7 +7,7 @@ import {
   renderFocusedHelpToString,
   renderGenericHelp,
   subcommandsWithFocusedHelp
-} from "./chunk-MXEJEYT7.js";
+} from "./chunk-JX6KL7OF.js";
 import "./chunk-2VMJ3E5Z.js";
 export {
   deepSubcommandsWithFocusedHelp,
@@ -19,4 +19,4 @@ export {
   renderGenericHelp,
   subcommandsWithFocusedHelp
 };
-//# sourceMappingURL=per-subcommand-help-BWBHYVJO.js.map
+//# sourceMappingURL=per-subcommand-help-DHTYU524.js.map

package/dist/{plugin-usage-HFBI3TFT.js → plugin-usage-M6KET4OZ.js}

@@ -1,6 +1,6 @@
 import {
   runPluginManagementCommand
-} from "./chunk-TEBMCYZN.js";
+} from "./chunk-SIS37L3W.js";
 import {
   restoreFlags
 } from "./chunk-CSAPOCBP.js";
@@ -40,4 +40,4 @@ export {
   pluginCmd,
   usageCmd
 };
-//# sourceMappingURL=plugin-usage-HFBI3TFT.js.map
+//# sourceMappingURL=plugin-usage-M6KET4OZ.js.map

package/dist/{plugins-PZ2VZL7V.js → plugins-WJLW6ULV.js}

@@ -6,9 +6,9 @@ import {
   pluginNameFromSpec,
   setupPlugins,
   warnIfDeprecatedPluginName
-} from "./chunk-5IA5337I.js";
+} from "./chunk-XJ7K67PP.js";
 import "./chunk-EWKESL4L.js";
-import "./chunk-TEBMCYZN.js";
+import "./chunk-SIS37L3W.js";
 export {
   BUILTIN_PLUGIN_FACTORIES,
   DEPRECATED_PLUGIN_NAMES,
@@ -18,4 +18,4 @@ export {
   setupPlugins,
   warnIfDeprecatedPluginName
 };
-//# sourceMappingURL=plugins-PZ2VZL7V.js.map
+//# sourceMappingURL=plugins-WJLW6ULV.js.map

package/dist/projects-LMNAGGEU.js

@@ -0,0 +1,36 @@
+
+// src/subcommands/handlers/projects.ts
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { color } from "@wrongstack/core/utils";
+var projectsCmd = async (_args, deps) => {
+  const manifestPath = path.join(deps.paths.globalRoot, "projects.json");
+  let entries;
+  try {
+    const parsed = JSON.parse(await fs.readFile(manifestPath, "utf8"));
+    entries = Array.isArray(parsed.projects) ? parsed.projects : [];
+  } catch {
+    deps.renderer.write("No projects tracked yet.\n");
+    return 0;
+  }
+  if (entries.length === 0) {
+    deps.renderer.write("No projects tracked yet.\n");
+    return 0;
+  }
+  const sorted = [...entries].sort((a, b) => (b.lastSeen ?? "").localeCompare(a.lastSeen ?? ""));
+  const slugWidth = Math.min(
+    Math.max(...sorted.map((entry) => (entry.slug ?? "").length), 4),
+    40
+  );
+  for (const entry of sorted) {
+    const slug = (entry.slug ?? "?").padEnd(slugWidth);
+    const seen = entry.lastSeen ?? "";
+    deps.renderer.write(`  ${color.dim(slug)}  ${color.dim(seen)}  ${entry.root ?? "?"}
+`);
+  }
+  return 0;
+};
+export {
+  projectsCmd
+};
+//# sourceMappingURL=projects-LMNAGGEU.js.map

package/dist/{providers-models-YVMVYWRS.js → providers-models-6MOGAOVK.js}

@@ -239,7 +239,7 @@ function aliasProviderId(configProviderId, cfg) {
 async function discoverProviderModels(deps, ids) {
   if (!("mergeOverlay" in deps.modelsRegistry)) return void 0;
   try {
-    const { discoverAndMergeProviders } = await import("./auto-discover-providers-VQU3IZMR.js");
+    const { discoverAndMergeProviders } = await import("./auto-discover-providers-DXR25GTG.js");
     await discoverAndMergeProviders({
       config: deps.config,
       registry: deps.modelsRegistry,
@@ -660,4 +660,4 @@ export {
   modelsCmd,
   providersCmd
 };
-//# sourceMappingURL=providers-models-YVMVYWRS.js.map
+//# sourceMappingURL=providers-models-6MOGAOVK.js.map

package/dist/{proxy-wiring-MGRSKZZB.js → proxy-wiring-K2DORFFL.js}

@@ -3,12 +3,12 @@ import {
   awaitFirstWrongProxyProbe,
   bootstrapWrongProxy,
   shutdownWrongProxy
-} from "./chunk-VOTTENR5.js";
-import "./chunk-JHPXJRRI.js";
+} from "./chunk-CDY4D5QK.js";
+import "./chunk-4XCBEUBX.js";
 export {
   applyWrongProxyPrefs,
   awaitFirstWrongProxyProbe,
   bootstrapWrongProxy,
   shutdownWrongProxy
 };
-//# sourceMappingURL=proxy-wiring-MGRSKZZB.js.map
+//# sourceMappingURL=proxy-wiring-K2DORFFL.js.map

package/dist/short-circuit-flags-YDMLAQ5R.js

@@ -0,0 +1,10 @@
+import {
+  handleHelpVersionShortCircuit
+} from "./chunk-U6PGWDMZ.js";
+import "./chunk-6WRKAACA.js";
+import "./chunk-XJXDOF63.js";
+import "./chunk-EK2P53GL.js";
+export {
+  handleHelpVersionShortCircuit
+};
+//# sourceMappingURL=short-circuit-flags-YDMLAQ5R.js.map

package/dist/slash-commands/acp.d.ts

@@ -10,6 +10,9 @@ import type { SlashCommandContext } from './command-context.js';
  *   /acp <agent-id> <task>       run a task on one agent (inline, streamed)
  *   /acp <agent-id> --bg <task>  run it as a background fleet subagent
  *   /acp parallel <csv> <task>   fan a task out to several agents at once
+ *   /acp parallel <csv> --bg <task>  same, but each agent runs as a background
+ *                             fleet subagent — live progress shows in /agents,
+ *                             the TUI fleet panel and the WebUI Agents panel
  *   /acp probe [csv]             handshake-test agents (what actually works)
  *   /acp bench [csv] [--fs]      end-to-end verify each agent + graded report
  *   /acp sync                    pull the official agentclientprotocol/registry

package/dist/slash-commands/codebase-map.d.ts

@@ -0,0 +1,11 @@
+import type { SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommandContext } from './command-context.js';
+/**
+ * `/codebase-map` — read and publish the centrality-ranked view of the index.
+ *
+ * Three jobs, one command, because they are three views of the same data:
+ * print the map, write the committable atlas projection, and report whether a
+ * previously written atlas still describes the current code.
+ */
+export declare function buildCodebaseMapCommand(opts: SlashCommandContext): SlashCommand;
+//# sourceMappingURL=codebase-map.d.ts.map

package/dist/slash-commands/command-context.d.ts

@@ -3,6 +3,7 @@ import type { EventBus } from '@wrongstack/core/kernel';
 import type { SlashCommandRegistry, ToolRegistry } from '@wrongstack/core/registry';
 import type { CompactReport, HealthRegistry, MemoryPort, MetricsRuntimeStatus, MetricsSink, ModeStore, Renderer, SessionStore, SkillLoader, TokenCounter } from '@wrongstack/core/types';
 import type { WstackPaths } from '@wrongstack/core/utils';
+import type { SummarizerPort } from '@wrongstack/tools';
 import type { VectorMemoryStore } from '@wrongstack/vector-memory';
 /** Host capabilities supplied to command adapters. */
 export interface SlashCommandContext {
@@ -41,6 +42,12 @@ export interface SlashCommandContext {
     cwd: string;
     /** Project root (typically resolved from cwd). */
     projectRoot: string;
+    /**
+     * Model port for the codebase index's concept layer. Present only when
+     * `indexing.concepts.enabled` is true — its absence is what `/codebase-map
+     * --enrich` reports instead of silently doing nothing.
+     */
+    codebaseConceptSummarizer?: SummarizerPort | undefined;
     metricsSink?: MetricsSink | undefined;
     healthRegistry?: HealthRegistry | undefined;
     metricsStatus?: MetricsRuntimeStatus | undefined;
@@ -252,6 +259,16 @@ export interface SlashCommandContext {
     onContextLimit?: ((tokens?: number) => number) | undefined;
     /** Toggle or query YOLO mode at runtime. Pass undefined to query, boolean to set. */
     onYolo?: ((setTo?: boolean) => boolean) | undefined;
+    /**
+     * Read, or set, which kinds of damage still prompt while YOLO is on.
+     *
+     * Returns the EFFECTIVE map after any update — the locked kinds report `true`
+     * whatever was asked, so a caller can tell an ignored "off" from a real one.
+     */
+    onYoloConfirm?: ((update?: {
+        kind: import('@wrongstack/core/security').DestructiveKind;
+        confirm: boolean;
+    }) => Record<string, boolean>) | undefined;
     /** Toggle or query next-task prediction. Pass undefined to query, boolean to set. */
     onNextPredict?: ((setTo?: boolean) => boolean) | undefined;
     /**
@@ -589,6 +606,18 @@ export interface SlashCommandContext {
     brainTierStats?: (() => import('@wrongstack/core/coordination').BrainTierStats) | undefined;
     /** Config store for reading/writing config sections at runtime (e.g. settings menu). */
     configStore: import('@wrongstack/core/types').ConfigStore;
+    /**
+     * Host hook that adopts the store's new merged config after an in-process
+     * selection change (today only `/profile switch`). The host's own `config`
+     * object is a distinct snapshot from the store's, so a command that mutates
+     * the store must hand the result back or the host keeps reading the values
+     * it booted with.
+     *
+     * Optional by design: only the interactive CLI has a live merged config to
+     * keep in step. Surfaces that leave it unset still persist the selection to
+     * the bootstrap and pick it up on their next start.
+     */
+    onActiveProfileChange?: ((next: import('@wrongstack/core/types').Config) => void) | undefined;
     /**
      * Optional accessor for the Chronicle metrics store. When wired, the
      * `/tool autothin candidates` and `apply` commands can read the

package/dist/slash-commands/context.d.ts

@@ -1,4 +1,14 @@
 import type { SlashCommand } from '@wrongstack/core/types';
 import type { SlashCommandContext } from './command-context.js';
 export declare function buildContextCommand(opts: SlashCommandContext): SlashCommand;
+/**
+ * One line naming what the recent per-request ratios mean.
+ *
+ * Deliberately reports a SHAPE, not a threshold. "40%" is a healthy young
+ * session and a broken old one; what separates them is whether the number is
+ * climbing as the conversation grows. The first request of a session can never
+ * hit, so it is excluded from the judgement rather than allowed to drag the
+ * verdict down.
+ */
+export declare function cacheTrendVerdict(recent: readonly number[]): string;
 //# sourceMappingURL=context.d.ts.map

package/dist/slash-commands/ensemble.d.ts

@@ -13,5 +13,5 @@ import type { SlashCommandContext } from './command-context.js';
  *
  * Run /ensemble (no args) to see usage and the list of available agents.
  */
-export declare function buildEnsembleCommand(_opts: SlashCommandContext): SlashCommand;
+export declare function buildEnsembleCommand(opts: SlashCommandContext): SlashCommand;
 //# sourceMappingURL=ensemble.d.ts.map

package/dist/slash-commands/openai-quota.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `/openai-quota` — how much of the ChatGPT (Codex) subscription this account
+ * has burned, and when the windows reset.
+ *
+ * A "Sign in with ChatGPT" account is metered on rolling windows — typically a
+ * 5-hour one and a weekly one — and the ChatGPT backend reports the burn on
+ * every `/codex/responses` response, in headers. Nothing about that reaches the
+ * SSE body, so before this existed the first visible sign of an exhausted plan
+ * was a 429 in the middle of a turn.
+ *
+ * The command is provider-scoped; the machinery underneath is not. It renders
+ * whatever `@wrongstack/core/quota` holds for one provider id, and the renderer
+ * below reads only the neutral shape. A second metered provider needs a
+ * reporter and a one-line command, not a second copy of this file.
+ *
+ * The reading is observational: it appears after the first request of the
+ * session, not before, and it is never fetched on its own — spending a request
+ * to ask "how much have I spent" is exactly the wrong trade on a metered plan.
+ *
+ * Usage:
+ *   /openai-quota     Show the latest reading for every metered window
+ */
+import { type ProviderQuotaSnapshot } from '@wrongstack/core/quota';
+import type { SlashCommand } from '@wrongstack/core/types';
+/**
+ * Render one meter. Provider-neutral by construction — everything it reads is
+ * on the shared snapshot shape.
+ */
+export declare function renderQuotaSnapshot(snapshot: ProviderQuotaSnapshot): string[];
+export declare function buildOpenAIQuotaCommand(): SlashCommand;
+//# sourceMappingURL=openai-quota.d.ts.map

package/dist/slash-commands/profile.d.ts

@@ -10,6 +10,13 @@ import type { SlashCommandContext } from './command-context.js';
  *   /profile list                  Show available profiles (● = active)
  *   /profile switch <name>         Switch to an existing profile
  *   /profile copy <name>           Copy the active profile's settings to a new profile
+ *
+ * `switch` writes the bootstrap (the durable selection read at next boot) and
+ * then pushes `activeProfile` through the live ConfigStore, which is the only
+ * event source the provider-runtime rebind watcher observes. `syncConfig` is
+ * the host's own copy of the merged config; it is a separate object from the
+ * store, so it has to be told too or the host keeps routing against the
+ * profile that was active when it booted.
  */
 export declare function buildProfileCommand(opts: SlashCommandContext): SlashCommand;
 //# sourceMappingURL=profile.d.ts.map

package/dist/subcommands/handlers/hq.d.ts

@@ -11,6 +11,7 @@
  *   wstack hq token list --client   → list issued client tokens
  *   wstack hq token revoke <id>    → revoke a browser token (prefix match)
  *   wstack hq token revoke --client <id> → revoke a client token
+ *   wstack hq service install|status|update|uninstall → Ubuntu systemd lifecycle
  *
  * All subcommands accept `--data-dir <path>` to override the HQ data
  * directory (default `~/.wrongstack/hq`, honors `WRONGSTACK_HOME` /

package/dist/subcommands/handlers/projects.d.ts

@@ -1,3 +1,17 @@
 import type { SubcommandHandler } from '../contracts.js';
+/**
+ * List the projects WrongStack has actually been used in.
+ *
+ * The source is `~/.wrongstack/projects.json`, the manifest `boot.ts` writes
+ * on every start and the one `/project` already reads.
+ *
+ * This used to enumerate the `~/.wrongstack/projects/` DIRECTORY instead, which
+ * is not the same thing: that directory also holds per-run scratch state for
+ * ephemeral roots — Chimera review worktrees and the like — which are created
+ * by the hundred and carry no `meta.json`. On a working machine the listing was
+ * 1,495 rows of which 1,461 printed `(no meta)` and 262 were single-use
+ * `chimera-*` scratch dirs, against 30 real entries in the manifest. The
+ * command was unusable for the one question it answers.
+ */
 export declare const projectsCmd: SubcommandHandler;
 //# sourceMappingURL=projects.d.ts.map

package/dist/{subcommands-WJLBHVKC.js → subcommands-7N4RIK6H.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-D2VCUN7M.js";
+} from "./chunk-BIWE22O5.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-WJLBHVKC.js.map
+//# sourceMappingURL=subcommands-7N4RIK6H.js.map

package/dist/{version-help-MYKF724O.js → version-help-WXI42PZ3.js}

@@ -1,10 +1,10 @@
 import {
   helpCmd,
   versionCmd
-} from "./chunk-FPIWTJ2G.js";
+} from "./chunk-6WRKAACA.js";
 import "./chunk-XJXDOF63.js";
 export {
   helpCmd,
   versionCmd
 };
-//# sourceMappingURL=version-help-MYKF724O.js.map
+//# sourceMappingURL=version-help-WXI42PZ3.js.map

package/dist/{webui-server-5R35BHWZ.js → webui-server-OBV5JYJV.js}

@@ -1,6 +1,8 @@
 import {
-  createHqCommandDispatcher
-} from "./chunk-IMWXXF4J.js";
+  createHqCommandDispatcher,
+  createProjectKanbanAssignHandler,
+  createProjectKanbanTransitionHandler
+} from "./chunk-KNMIBKLV.js";
 import {
   createKanbanRunMirror
 } from "./chunk-VCYZ3WZV.js";
@@ -46,6 +48,7 @@ import {
   toSessionHistoryEntries
 } from "@wrongstack/webui-server";
 import { WebSocketServer } from "ws";
+import { verifyClient as verifyWsClient2 } from "@wrongstack/webui-server/server/ws-auth";
 
 // src/webui-server/client-registration.ts
 import { mailboxSessionTag } from "@wrongstack/core/coordination";
@@ -70,6 +73,10 @@ function createWebuiClientRegistration(deps) {
         steerMailbox: mailbox,
         interruptLeader: control.interruptLeader,
         allowRunCommand: control.allowRunCommand,
+        ...deps.projectRoot ? {
+          kanbanTransition: createProjectKanbanTransitionHandler(deps.projectRoot),
+          kanbanAssign: createProjectKanbanAssignHandler(deps.projectRoot)
+        } : {},
         // The session HQ actually SHOWS for this client — the boot
         // session the telemetry bridge publishes under and the only one
         // `interruptLeader` speaks for. `getSessionId` follows whichever
@@ -1495,7 +1502,22 @@ async function runWebUI(opts) {
     ...opts.getVectorMemoryStore ? { getVectorMemoryStore: opts.getVectorMemoryStore } : {},
     ...opts.vectorMemoryModelCacheDir ? { vectorMemoryModelCacheDir: opts.vectorMemoryModelCacheDir } : {}
   });
-  const wss = httpServer ? new WebSocketServer({ server: httpServer.server, maxPayload: 20 * 1024 * 1024 }) : new WebSocketServer({ port: httpPort, host, maxPayload: 20 * 1024 * 1024 });
+  const verifyClient = (info) => verifyWsClient2({
+    origin: info.origin,
+    url: info.req.url ?? "",
+    hostHeader: info.req.headers.host,
+    remoteAddress: info.req.socket.remoteAddress,
+    cookieHeader: info.req.headers.cookie,
+    wsHost: host,
+    expectedToken: wsToken,
+    requireToken,
+    allowedHostnames: [publicUrl, publicWsUrl].filter(
+      (value) => Boolean(value)
+    ),
+    allowBrowserUrlToken: Boolean(publicWsUrl),
+    allowCrossPortLoopbackCookie: process.env["WRONGSTACK_WEBUI_DEV_CROSS_PORT_WS"] === "1"
+  });
+  const wss = httpServer ? new WebSocketServer({ server: httpServer.server, verifyClient, maxPayload: 20 * 1024 * 1024 }) : new WebSocketServer({ port: httpPort, host, verifyClient, maxPayload: 20 * 1024 * 1024 });
   wss.on("error", (err) => {
     console.error(
       JSON.stringify({
@@ -1625,6 +1647,7 @@ async function runWebUI(opts) {
       () => opts.appConfig?.providers ?? {}
     ),
     modelsRegistry: opts.modelsRegistry,
+    providerAuthRegistry: opts.providerAuthRegistry,
     send,
     broadcast,
     log: (m) => console.log(m)
@@ -1951,4 +1974,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-5R35BHWZ.js.map
+//# sourceMappingURL=webui-server-OBV5JYJV.js.map

package/dist/webui-server-options.d.ts

@@ -117,6 +117,7 @@ export interface CliWebUIOptions {
         webuiInstanceRegistered: boolean;
     }) => void;
     modelsRegistry?: ModelsRegistry | undefined;
+    providerAuthRegistry?: import('@wrongstack/core/registry').ProviderAuthRegistry | undefined;
     globalConfigPath?: string | undefined;
     /** Resolved profile config path: ~/.wrongstack/profiles/<activeProfile>/config.json */
     profileConfigPath: string;

package/dist/wiring/atlas-prompt-contributor.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Atlas boot-prompt contributor — the repository's shape, put in front of the
+ * agent instead of left to be rediscovered.
+ *
+ * Without this, every session begins the same way: a handful of searches to
+ * work out which packages exist, which files everything depends on, and where
+ * the entry points are. The index has known all of that since it was built.
+ * A few hundred tokens spends once what a dozen tool calls spend every time.
+ *
+ * Contract, matching `wrongtrace-prompt-contributor.ts`:
+ *   - **Fail-open.** No index, no ranks, a throw, a timeout → `[]`. Orientation
+ *     is a convenience; it must never be the reason a session cannot start.
+ *   - **Bounded.** The brief is read behind a deadline, because the store lives
+ *     on disk and a cold or busy index must not stall the first prompt.
+ *   - **Cached per process.** The brief only changes when the index does, and
+ *     rebuilding it on every prompt build would read SQLite on every turn.
+ *   - **Cache-safe.** Contributor blocks are tagged `'contributor'`, which
+ *     `EPOCH_VOLATILE_SOURCES` moves out of the wire `system` block and into
+ *     the live-context tail — so this does not invalidate the prompt cache
+ *     prefix the way a system-prompt edit would.
+ *
+ * It is deliberately *not* routed through SAGE. That pipeline is for episodic
+ * memory and gates on relevance thresholds a repository map would fail; the
+ * map is not a memory, it is a fact about the checkout.
+ */
+import type { SystemPromptContributor, TokenSavingTier } from '@wrongstack/core/types';
+import { type AtlasBrief } from '@wrongstack/tools';
+/** Default hard ceiling on the rendered block. */
+export declare const DEFAULT_BRIEF_MAX_TOKENS = 800;
+/**
+ * Render the brief, trimming from the bottom until it fits.
+ *
+ * The order of the sections is the order of their value to somebody who knows
+ * nothing about the repository: what it is made of, what everything depends
+ * on, and — last, because it is the least load-bearing — what each subsystem
+ * does in prose. Trimming from the bottom therefore degrades gracefully
+ * instead of losing the hubs.
+ */
+export declare function renderAtlasBrief(brief: AtlasBrief, maxTokens: number): string;
+export interface AtlasPromptContributorOptions {
+    projectRoot: string;
+    indexDir?: string | undefined;
+    /** `indexing.atlas.injectOnSessionStart`. Default true. */
+    enabled?: boolean | undefined;
+    /** `indexing.atlas.briefMaxTokens`. Default {@link DEFAULT_BRIEF_MAX_TOKENS}. */
+    maxTokens?: number | undefined;
+    tokenSavingMode?: TokenSavingTier | boolean | undefined;
+}
+/**
+ * Build the contributor. One instance per prompt-builder binding; the brief
+ * cache lives on the closure, so it is per process, like the builder.
+ */
+export declare function createAtlasPromptContributor(options: AtlasPromptContributorOptions): SystemPromptContributor;
+//# sourceMappingURL=atlas-prompt-contributor.d.ts.map

package/dist/wiring/cli-execute-builder.d.ts

@@ -73,6 +73,7 @@ export declare function runCliExecution(params: {
     agentMonitor?: X['fleet']['agentTranscripts'];
     vault: AUP['vault'];
     profileConfigPath: string;
+    providerAuthRegistry: NonNullable<AUP['providerAuthRegistry']>;
     onPanelOpen: X['fleet']['onPanelOpen'];
     interruptController: RC['interruptController'];
     enhanceController: RC['enhanceController'];