@wrongstack/cli 1.0.13 → 1.0.15

package/dist/{chunk-TNZBQG45.js → chunk-DUF5FEWD.js}

@@ -22,7 +22,7 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-EJI7DBQS.js");
+      const { subcommandNames } = await import("./subcommands-3ILCNR2T.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-TNZBQG45.js.map
+//# sourceMappingURL=chunk-DUF5FEWD.js.map

package/dist/{chunk-YRC3I3LE.js → chunk-MZY6UDWC.js}

@@ -231,7 +231,7 @@ function hqAuthRequired(mutableAuth, requireBrowserAuth) {
   return (requireBrowserAuth ?? mutableAuth.requireBrowserAuth) === true || mutableAuth.requireAuthFloor === true || mutableAuth.browserTokens.size > 0 || mutableAuth.passwordHash !== void 0;
 }
 function hqClientAuthRequired(mutableAuth) {
-  return mutableAuth.requireAuthFloor === true || mutableAuth.clientTokens.size > 0;
+  return mutableAuth.clientTokens.size > 0 || hqAuthRequired(mutableAuth);
 }
 function extractBrowserToken(req, url) {
   const queryToken = url.searchParams.get("token");
@@ -4880,8 +4880,19 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
       bootstrapStore
     };
     const handleRequest = createHqRouter(routerDeps);
+    const closeSocketsOfRemovedSessions = (before) => {
+      for (const [browser, sessionId] of browserSocketSessions) {
+        if (!before.has(sessionId) || sessions.has(sessionId)) continue;
+        if (browser.readyState === WebSocket3.OPEN) {
+          browser.close(1008, "Browser session revoked");
+        }
+      }
+    };
     const httpServer = http.createServer((req, res) => {
-      void handleRequest(req, res);
+      const sessionsBefore = sessions.size > 0 ? new Set(sessions.keys()) : void 0;
+      void handleRequest(req, res).finally(() => {
+        if (sessionsBefore !== void 0) closeSocketsOfRemovedSessions(sessionsBefore);
+      });
     });
     const wss = new WebSocketServer({ noServer: true, maxPayload: 1 * 1024 * 1024 });
     const browserHeartbeatTimer = setInterval(() => {
@@ -5089,4 +5100,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-YRC3I3LE.js.map
+//# sourceMappingURL=chunk-MZY6UDWC.js.map

package/dist/{chunk-OJR7K3OI.js → chunk-U3PDQOYU.js}

@@ -31,7 +31,7 @@ var loaders = {
   quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
   bench: async () => (await import("./bench-YBU6BVQP.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-NO2NWGU4.js")).hqCmd,
+  hq: async () => (await import("./hq-O5BOP6UY.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-X3CR6VFW.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-CFDLXETM.js")).permissionsCmd,
   project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
@@ -51,4 +51,4 @@ export {
   subcommands,
   subcommandNames
 };
-//# sourceMappingURL=chunk-OJR7K3OI.js.map
+//# sourceMappingURL=chunk-U3PDQOYU.js.map

package/dist/{cli-context-5IF7ZYEY.js → cli-context-6MTVFJPO.js}

@@ -19,17 +19,17 @@ import {
 } from "./chunk-GPPRNAKW.js";
 import {
   subcommands
-} from "./chunk-OJR7K3OI.js";
+} from "./chunk-U3PDQOYU.js";
 import {
   renderDeepHelp,
   renderFocusedHelp
 } from "./chunk-JX6KL7OF.js";
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-TNZBQG45.js";
+} from "./chunk-DUF5FEWD.js";
 import {
   DEFAULT_PORT
-} from "./chunk-YRC3I3LE.js";
+} from "./chunk-MZY6UDWC.js";
 import "./chunk-HXJYHAR4.js";
 import {
   resolveHqPasswordInput
@@ -866,7 +866,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-KE5YDNGG.js");
+  const { startHqServer } = await import("./hq-server-YW4MJCKH.js");
   const tunnelRequested = flags["tunnel"] === true;
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
   let publicOrigin;
@@ -3303,4 +3303,4 @@ async function initializeCli(argv) {
 export {
   initializeCli
 };
-//# sourceMappingURL=cli-context-5IF7ZYEY.js.map
+//# sourceMappingURL=cli-context-6MTVFJPO.js.map

package/dist/{cli-main-6JWASRH2.js → cli-main-42SM33EG.js}

@@ -5822,6 +5822,9 @@ function createRuntimeControllerDeps(input) {
     statuslineDensities: input.statuslineDensities,
     setStatuslineDensities: input.setStatuslineDensities,
     saveStatuslineDensities: input.saveStatuslineDensities,
+    statuslineOrder: input.statuslineOrder,
+    setStatuslineOrder: input.setStatuslineOrder,
+    saveStatuslineOrder: input.saveStatuslineOrder,
     getYolo: input.getYolo,
     onYolo: input.onYolo,
     getAutonomy: input.getAutonomy,
@@ -6210,6 +6213,9 @@ async function runCliExecution(params) {
     statuslineDensities,
     setStatuslineDensities,
     saveStatuslineDensities,
+    statuslineOrder,
+    setStatuslineOrder,
+    saveStatuslineOrder,
     setYoloMode,
     autonomyMode,
     setAutonomyMode,
@@ -6238,7 +6244,7 @@ async function runCliExecution(params) {
     governanceHandle,
     setConfig
   } = params;
-  const { execute } = await import("./execution-EXDRBS4F.js");
+  const { execute } = await import("./execution-6KIOQUAG.js");
   return execute(
     toExecuteDeps({
       core: {
@@ -6360,6 +6366,9 @@ async function runCliExecution(params) {
         statuslineDensities,
         setStatuslineDensities,
         saveStatuslineDensities,
+        statuslineOrder,
+        setStatuslineOrder,
+        saveStatuslineOrder,
         getYolo: setYoloMode,
         onYolo: setYoloMode,
         getAutonomy: () => autonomyMode,
@@ -8840,13 +8849,14 @@ import * as path9 from "node:path";
 import {
   clampLine,
   defaultChipEnabledMap,
+  resolveStatuslineOrder,
   STATUSLINE_DENSITY_LEVELS,
   STATUSLINE_ITEMS
 } from "@wrongstack/core/statusline";
 import { ERROR_CODES, FsError } from "@wrongstack/core/types";
 import { atomicWrite, resolveWstackPaths, toErrorMessage as toErrorMessage4 } from "@wrongstack/core/utils";
 var CONFIG_ENV = "WRONGSTACK_STATUSLINE_CONFIG";
-var STATUSLINE_CONFIG_VERSION = 3;
+var STATUSLINE_CONFIG_VERSION = 4;
 var STATUSLINE_CONFIG_KEYS = STATUSLINE_ITEMS;
 var DEFAULTS = defaultChipEnabledMap();
 function emptyDocument() {
@@ -8854,7 +8864,8 @@ function emptyDocument() {
     version: STATUSLINE_CONFIG_VERSION,
     chips: { ...DEFAULTS },
     lines: {},
-    densities: {}
+    densities: {},
+    order: []
   };
 }
 function resolveConfigPath() {
@@ -8898,20 +8909,30 @@ function normalizeDensities(value) {
   }
   return densities;
 }
+function normalizeOrder(value) {
+  if (!Array.isArray(value)) return [];
+  const items = value.filter(
+    (item) => typeof item === "string" && STATUSLINE_CONFIG_KEYS.includes(item)
+  );
+  const resolved = resolveStatuslineOrder(items);
+  return resolved.every((item, index) => item === STATUSLINE_ITEMS[index]) ? [] : resolved;
+}
 function parseDocument(value) {
-  if (isRecord2(value) && (isRecord2(value["chips"]) || isRecord2(value["lines"]) || isRecord2(value["densities"]))) {
+  if (isRecord2(value) && (isRecord2(value["chips"]) || isRecord2(value["lines"]) || isRecord2(value["densities"]) || Array.isArray(value["order"]))) {
     return {
       version: STATUSLINE_CONFIG_VERSION,
       chips: normalizeChips(value["chips"]),
       lines: normalizeLines(value["lines"]),
-      densities: normalizeDensities(value["densities"])
+      densities: normalizeDensities(value["densities"]),
+      order: normalizeOrder(value["order"])
     };
   }
   return {
     version: STATUSLINE_CONFIG_VERSION,
     chips: normalizeChips(value),
     lines: {},
-    densities: {}
+    densities: {},
+    order: []
   };
 }
 function isMissingKnownChips(value) {
@@ -8921,8 +8942,9 @@ function needsRewrite(value) {
   if (isRecord2(value) && isRecord2(value["chips"])) {
     if (value["version"] !== STATUSLINE_CONFIG_VERSION) return true;
     if (isMissingKnownChips(value["chips"])) return true;
-    if (!isRecord2(value["lines"]) || !isRecord2(value["densities"])) return true;
-    return JSON.stringify(normalizeLines(value["lines"])) !== JSON.stringify(value["lines"]) || JSON.stringify(normalizeDensities(value["densities"])) !== JSON.stringify(value["densities"]);
+    if (!isRecord2(value["lines"]) || !isRecord2(value["densities"]) || !Array.isArray(value["order"]))
+      return true;
+    return JSON.stringify(normalizeLines(value["lines"])) !== JSON.stringify(value["lines"]) || JSON.stringify(normalizeDensities(value["densities"])) !== JSON.stringify(value["densities"]) || JSON.stringify(normalizeOrder(value["order"])) !== JSON.stringify(value["order"]);
   }
   return true;
 }
@@ -8980,7 +9002,8 @@ async function saveStatuslineConfig(config) {
           version: STATUSLINE_CONFIG_VERSION,
           chips: normalizeChips(config.chips),
           lines: normalizeLines(config.lines),
-          densities: normalizeDensities(config.densities)
+          densities: normalizeDensities(config.densities),
+          order: normalizeOrder(config.order)
         },
         null,
         2
@@ -9001,6 +9024,9 @@ async function loadStatuslineLines() {
 async function loadStatuslineDensities() {
   return (await loadStatuslineConfig()).densities;
 }
+async function loadStatuslineOrder() {
+  return (await loadStatuslineConfig()).order;
+}
 var docMutationChain = Promise.resolve();
 function queueDocMutation(mutate) {
   const run = docMutationChain.then(mutate, mutate);
@@ -9016,7 +9042,8 @@ async function saveStatuslineLayout(layout) {
     await saveStatuslineConfig({
       ...doc,
       lines: normalizeLines(layout.lines ?? doc.lines),
-      densities: normalizeDensities(layout.densities ?? doc.densities)
+      densities: normalizeDensities(layout.densities ?? doc.densities),
+      order: normalizeOrder(layout.order ?? doc.order)
     });
   });
 }
@@ -28524,6 +28551,11 @@ var ALL_SETTINGS_KEYS = [
   "context-strategy",
   "context-auto-compact",
   "token-saving",
+  "nextsteps-tool",
+  "autothin",
+  "autothin-idle",
+  "autothin-min",
+  "autothin-boot",
   "max-concurrent",
   "title-animation",
   "reasoning",
@@ -28547,6 +28579,10 @@ var ALL_SETTINGS_KEYS = [
   "statusline",
   "animation",
   "read-symbols",
+  "hq",
+  "hq-url",
+  "hq-token",
+  "hq-raw",
   "defaults",
   "reset"
 ];
@@ -30122,7 +30158,7 @@ function buildStatuslineCommand(deps) {
       }
       if (item === "layout") {
         if (action !== "reset") return { message: "Usage: /statusline layout reset" };
-        await deps.setConfig({ ...cfg, lines: {}, densities: {} });
+        await deps.setConfig({ ...cfg, lines: {}, densities: {}, order: [] });
         return { message: "StatusBar layout reset: default lines and densities restored." };
       }
       if (item === "all") {
@@ -31330,7 +31366,7 @@ function buildTelegramSettingsCommand(opts) {
     category: "Config",
     aliases: ["tg-settings"],
     description: "Toggle which agent events are reported to Telegram.",
-    argsHint: "[session-end|delegate|long-tool|poll|chat <value>]",
+    argsHint: "[session-end|delegate|long-tool|poll|chat <value>|all]",
     help: HELP2,
     async run(args) {
       const { cmd: sub, rest } = parseSubcommand(args);
@@ -31614,7 +31650,7 @@ function buildTodosCommand(opts) {
             return {
               message: unknownSubcommand(
                 cmd,
-                ["show", "clear", "add", "done", "done-all", "remove"],
+                ["show", "clear", "add", "done", "done-all", "remove", "rm"],
                 "todos"
               ) + "\n\nRelated: /plan (session-persistent roadmap) | /tasks (structured tasks with priorities)"
             };
@@ -33949,6 +33985,15 @@ async function setupCommandHostState(input) {
     currentDensities = { ...next };
     await saveStatuslineLayout({ densities: next });
   };
+  const statuslineOrder = await loadStatuslineOrder();
+  let currentOrder = [...statuslineOrder];
+  const setStatuslineOrder = (next) => {
+    currentOrder = [...next];
+  };
+  const saveStatuslineOrder = async (next) => {
+    currentOrder = [...next];
+    await saveStatuslineLayout({ order: next });
+  };
   const agentsMonitorController = createAgentsMonitorController();
   const onPanelOpen = { current: null };
   const goalHost = createGoalHost({
@@ -34026,6 +34071,10 @@ async function setupCommandHostState(input) {
     getCurrentStatuslineDensities: () => currentDensities,
     setStatuslineDensities,
     saveStatuslineDensities,
+    statuslineOrder: [...statuslineOrder],
+    getCurrentStatuslineOrder: () => currentOrder,
+    setStatuslineOrder,
+    saveStatuslineOrder,
     agentsMonitorController,
     onPanelOpen,
     goalHost,
@@ -38761,6 +38810,9 @@ async function runInteractive(cliCtx) {
     statuslineDensities,
     setStatuslineDensities,
     saveStatuslineDensities,
+    statuslineOrder,
+    setStatuslineOrder,
+    saveStatuslineOrder,
     agentsMonitorController,
     onPanelOpen,
     goalHost,
@@ -39014,6 +39066,9 @@ async function runInteractive(cliCtx) {
     statuslineDensities,
     setStatuslineDensities,
     saveStatuslineDensities,
+    statuslineOrder,
+    setStatuslineOrder,
+    saveStatuslineOrder,
     setYoloMode,
     autonomyMode,
     setAutonomyMode: (mode) => {
@@ -39055,4 +39110,4 @@ export {
   CLI_VERSION,
   runInteractive
 };
-//# sourceMappingURL=cli-main-6JWASRH2.js.map
+//# sourceMappingURL=cli-main-42SM33EG.js.map

package/dist/execute-deps.d.ts

@@ -14,7 +14,7 @@ import type { BrainAutoRisk } from '@wrongstack/core/execution';
 import type { JournalEntry } from '@wrongstack/core/goal';
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { SlashCommandRegistry } from '@wrongstack/core/registry';
-import type { StatuslineDensities, StatuslineLines } from '@wrongstack/core/statusline';
+import type { StatuslineDensities, StatuslineLines, StatuslineOrder } from '@wrongstack/core/statusline';
 import type { QueueStore } from '@wrongstack/core/storage';
 import type { AttachmentStore, AutonomyStage, Config, ConfigStore, MemoryPort, Message, ModelsRegistry, ModeStore, PromptLoader, ProviderConfig, ResolvedProvider, SessionEvent, SessionStore, SessionWriter, SkillLoader, TokenCounter } from '@wrongstack/core/types';
 import type { WstackPaths } from '@wrongstack/core/utils';
@@ -277,6 +277,10 @@ export interface ControllerDeps {
     statuslineDensities?: StatuslineDensities | undefined;
     setStatuslineDensities?: ((densities: StatuslineDensities) => void) | undefined;
     saveStatuslineDensities?: ((densities: StatuslineDensities) => Promise<void>) | undefined;
+    /** Custom left-to-right statusline order (schema v4). */
+    statuslineOrder?: StatuslineOrder | undefined;
+    setStatuslineOrder?: ((order: StatuslineOrder) => void) | undefined;
+    saveStatuslineOrder?: ((order: StatuslineOrder) => Promise<void>) | undefined;
     getYolo?: (() => boolean) | undefined;
     onYolo?: ((setTo?: boolean) => boolean) | undefined;
     getAutonomy?: (() => AutonomyMode) | undefined;

package/dist/{execution-EXDRBS4F.js → execution-6KIOQUAG.js}

@@ -6310,6 +6310,9 @@ async function execute(deps) {
       statuslineDensities,
       setStatuslineDensities,
       saveStatuslineDensities,
+      statuslineOrder,
+      setStatuslineOrder,
+      saveStatuslineOrder,
       getYolo,
       onYolo,
       getAutonomy,
@@ -6637,6 +6640,9 @@ async function execute(deps) {
           statuslineDensities,
           setStatuslineDensities,
           saveStatuslineDensities,
+          statuslineOrder,
+          setStatuslineOrder,
+          saveStatuslineOrder,
           getPluginItems,
           onPluginToggle,
           getMcpServers,
@@ -6953,4 +6959,4 @@ export {
   execute,
   resolveReviewerFallbackModels
 };
-//# sourceMappingURL=execution-EXDRBS4F.js.map
+//# sourceMappingURL=execution-6KIOQUAG.js.map

package/dist/{hq-NO2NWGU4.js → hq-O5BOP6UY.js}

@@ -68,7 +68,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-KE5YDNGG.js");
+  const { startHqServer } = await import("./hq-server-YW4MJCKH.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
@@ -538,6 +538,16 @@ async function tokenList(args, deps) {
   });
   const tokens = authFile[tokenField] ?? [];
   if (tokens.length === 0) {
+    const browserCredential = authFile.passwordHash !== void 0 || (authFile.browserTokens ?? []).length > 0;
+    if (scope === "client" && browserCredential) {
+      deps.renderer.write(
+        "No client tokens issued. HQ has a browser credential, so /ws/client REJECTS every publisher.\n"
+      );
+      deps.renderer.write(
+        "Run `wstack hq token create --client [label]` to let publishers connect.\n"
+      );
+      return 0;
+    }
     deps.renderer.write(
       `No ${scope} tokens issued. ${scope === "browser" ? "Browsers" : "Clients"} are in OPEN MODE.
 `
@@ -977,4 +987,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-NO2NWGU4.js.map
+//# sourceMappingURL=hq-O5BOP6UY.js.map

package/dist/hq-server/auth.d.ts

@@ -91,6 +91,16 @@ export declare function hqAuthRequired(mutableAuth: HqRouterMutableAuth, require
  * which are a separate set from the browser tokens, but the same fail-closed
  * floor applies: an all-expired client-token file must not mean "no auth
  * configured, let anyone register as a session".
+ *
+ * WS-2026-09-15-01: this used to be `requireAuthFloor || clientTokens.size > 0`.
+ * The floor only latches in true open mode (no password, no browser token), so
+ * a password-protected HQ on a network bind whose client tokens had all expired
+ * or been revoked accepted a tokenless `/ws/client` — and `client.hello` then
+ * granted every capability the socket declared, `control.approve` included.
+ * OPEN MODE is "no credential of any kind" (SECURITY.md); once HQ holds ANY
+ * browser credential, the publisher channel must present a client token too.
+ * A loopback exemption is deliberately absent: `--tunnel` and reverse proxies
+ * deliver remote traffic from 127.0.0.1.
  */
 export declare function hqClientAuthRequired(mutableAuth: HqRouterMutableAuth): boolean;
 /**

package/dist/{hq-server-KE5YDNGG.js → hq-server-YW4MJCKH.js}

@@ -10,7 +10,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-YRC3I3LE.js";
+} from "./chunk-MZY6UDWC.js";
 import "./chunk-HXJYHAR4.js";
 import "./chunk-5EA6OTLJ.js";
 import "./chunk-Q7E3BPDU.js";
@@ -27,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-KE5YDNGG.js.map
+//# sourceMappingURL=hq-server-YW4MJCKH.js.map

package/dist/index.js

@@ -16,14 +16,14 @@ async function main(argv) {
   applySessionShellDefault();
   const earlyFlags = parseArgs(argv).flags;
   if (earlyFlags["help"] === true || earlyFlags["version"] === true) {
-    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-72E77TJI.js");
+    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-T6EFG3W6.js");
     const earlyExit = await handleHelpVersionShortCircuit(argv);
     if (earlyExit !== null) return earlyExit;
   }
-  const { initializeCli } = await import("./cli-context-5IF7ZYEY.js");
+  const { initializeCli } = await import("./cli-context-6MTVFJPO.js");
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-6JWASRH2.js");
+  const { runInteractive } = await import("./cli-main-42SM33EG.js");
   return runInteractive(cliCtx);
 }
 
@@ -31,7 +31,12 @@ async function main(argv) {
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { scrubErrorText } from "@wrongstack/core/security";
-import { installCrashShield, runFatalSalvageSync, writeErr } from "@wrongstack/core/utils";
+import {
+  hardenWin32ExecutableSearch,
+  installCrashShield,
+  runFatalSalvageSync,
+  writeErr
+} from "@wrongstack/core/utils";
 var SQLITE_WARNING_RE = /sqlite is an experimental feature/i;
 function installSqliteWarningFilter() {
   const originalEmit = process.emitWarning.bind(process);
@@ -119,6 +124,7 @@ function runAsMain(mainFn) {
   if (!isMain) return;
   installBrokenPipeHandlers();
   installCrashShield();
+  hardenWin32ExecutableSearch();
   process.on("exit", () => {
     runFatalSalvageSync();
   });

package/dist/services/statusline-config.d.ts

@@ -1,11 +1,12 @@
-import { type StatuslineDensities, type StatuslineItem, type StatuslineLines } from '@wrongstack/core/statusline';
+import { type StatuslineDensities, type StatuslineItem, type StatuslineLines, type StatuslineOrder } from '@wrongstack/core/statusline';
 /**
  * On-disk schema version.
  *  v1 — flat boolean map.
  *  v2 — `{chips, lines}`.
  *  v3 — adds `densities` (per-chip full/short/micro pin).
+ *  v4 — adds `order` (custom left-to-right chip order).
  */
-export declare const STATUSLINE_CONFIG_VERSION = 3;
+export declare const STATUSLINE_CONFIG_VERSION = 4;
 /**
  * The persistence vocabulary IS the core contract — one list, so a new chip
  * cannot gain a default line without gaining a toggle (or vice versa). The
@@ -17,8 +18,8 @@ export type StatuslineConfig = {
     [K in StatuslineConfigKey]?: boolean | undefined;
 };
 /**
- * v3 statusline.json document: the chip on/off map, the sparse per-chip line
- * assignment, and the sparse per-chip density pin. Absent `lines` keys mean
+ * v4 statusline.json document: on/off map, sparse per-chip line assignment,
+ * sparse density pins, and optional custom left-to-right order. Absent `lines` keys mean
  * "render on the contract's default line" (`DEFAULT_LINES`); absent
  * `densities` keys mean "let the rail fitter choose".
  */
@@ -27,6 +28,7 @@ export interface StatuslineDocument {
     chips: StatuslineConfig;
     lines: StatuslineLines;
     densities: StatuslineDensities;
+    order: StatuslineOrder;
 }
 /**
  * Chip toggles for a brand-new config. Not every chip is on: the static
@@ -42,14 +44,17 @@ export declare function saveStatuslineConfig(config: StatuslineDocument): Promis
 export declare function loadStatuslineLines(): Promise<StatuslineLines>;
 /** Load just the per-chip density pins (defaults to {} when unpinned). */
 export declare function loadStatuslineDensities(): Promise<StatuslineDensities>;
+/** Load custom left-to-right chip order (empty means canonical order). */
+export declare function loadStatuslineOrder(): Promise<StatuslineOrder>;
 /**
- * Persist a new layout (lines and/or densities) while preserving the stored
+ * Persist a new layout (lines, densities and/or order) while preserving the stored
  * chip toggles. Values are re-normalized (unknown keys dropped, clamped) so a
  * malformed caller cannot write garbage to disk.
  */
 export declare function saveStatuslineLayout(layout: {
     lines?: StatuslineLines | undefined;
     densities?: StatuslineDensities | undefined;
+    order?: StatuslineOrder | undefined;
 }): Promise<void>;
 /**
  * Persist the chip on/off map while preserving the stored layout. Same RMW
@@ -60,4 +65,6 @@ export declare function saveStatuslineLayout(layout: {
 export declare function saveStatuslineChips(chips: StatuslineConfig): Promise<void>;
 /** Back-compat alias: persist only the line assignment. */
 export declare function saveStatuslineLines(lines: StatuslineLines): Promise<void>;
+/** Back-compat-sized helper: persist only the custom chip order. */
+export declare function saveStatuslineOrder(order: StatuslineOrder): Promise<void>;
 //# sourceMappingURL=statusline-config.d.ts.map

package/dist/{short-circuit-flags-72E77TJI.js → short-circuit-flags-T6EFG3W6.js}

@@ -1,10 +1,10 @@
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-TNZBQG45.js";
+} from "./chunk-DUF5FEWD.js";
 import "./chunk-6WRKAACA.js";
 import "./chunk-XJXDOF63.js";
 import "./chunk-C3Z4N6A6.js";
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=short-circuit-flags-72E77TJI.js.map
+//# sourceMappingURL=short-circuit-flags-T6EFG3W6.js.map

package/dist/{subcommands-EJI7DBQS.js → subcommands-3ILCNR2T.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-OJR7K3OI.js";
+} from "./chunk-U3PDQOYU.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-EJI7DBQS.js.map
+//# sourceMappingURL=subcommands-3ILCNR2T.js.map

package/dist/wiring/cli-execute-builder.d.ts

@@ -91,6 +91,9 @@ export declare function runCliExecution(params: {
     statuslineDensities?: RC['statuslineDensities'];
     setStatuslineDensities?: NonNullable<RC['setStatuslineDensities']>;
     saveStatuslineDensities?: NonNullable<RC['saveStatuslineDensities']>;
+    statuslineOrder?: RC['statuslineOrder'];
+    setStatuslineOrder?: NonNullable<RC['setStatuslineOrder']>;
+    saveStatuslineOrder?: NonNullable<RC['saveStatuslineOrder']>;
     setYoloMode: NonNullable<RC['getYolo']>;
     autonomyMode: ReturnType<RC['getAutonomy']>;
     setAutonomyMode: NonNullable<RC['setAutonomy']>;

package/dist/wiring/command-host-state.d.ts

@@ -2,7 +2,7 @@
 import { type BrainArbiter, type Director } from '@wrongstack/core/coordination';
 import type { EventBus } from '@wrongstack/core/kernel';
 import { type DestructiveKind } from '@wrongstack/core/security';
-import type { StatuslineDensities, StatuslineLines } from '@wrongstack/core/statusline';
+import type { StatuslineDensities, StatuslineLines, StatuslineOrder } from '@wrongstack/core/statusline';
 import { type Config, type SessionWriter } from '@wrongstack/core/types';
 import type { WstackPaths } from '@wrongstack/core/utils';
 import { SddRunRegistry } from '@wrongstack/sdd';
@@ -143,6 +143,10 @@ export declare function setupCommandHostState(input: CommandHostStateInput): Pro
     getCurrentStatuslineDensities: () => Partial<Record<import("@wrongstack/core/statusline").StatuslineItem, import("@wrongstack/core/statusline").StatuslineDensity>>;
     setStatuslineDensities: (next: StatuslineDensities) => void;
     saveStatuslineDensities: (next: StatuslineDensities) => Promise<void>;
+    statuslineOrder: import("@wrongstack/core/statusline").StatuslineItem[];
+    getCurrentStatuslineOrder: () => StatuslineOrder;
+    setStatuslineOrder: (next: StatuslineOrder) => void;
+    saveStatuslineOrder: (next: StatuslineOrder) => Promise<void>;
     agentsMonitorController: import("./controllers.js").AgentsMonitorController;
     onPanelOpen: {
         current: ((action: string) => boolean) | null;

package/dist/wiring/runtime-controller-deps.d.ts

@@ -25,6 +25,9 @@ interface RuntimeControllerDepsInput {
     statuslineDensities?: ControllerDeps['statuslineDensities'];
     setStatuslineDensities?: ControllerDeps['setStatuslineDensities'];
     saveStatuslineDensities?: ControllerDeps['saveStatuslineDensities'];
+    statuslineOrder?: ControllerDeps['statuslineOrder'];
+    setStatuslineOrder?: ControllerDeps['setStatuslineOrder'];
+    saveStatuslineOrder?: ControllerDeps['saveStatuslineOrder'];
     getYolo: NonNullable<ControllerDeps['getYolo']>;
     onYolo: NonNullable<ControllerDeps['onYolo']>;
     getAutonomy: () => AutonomyMode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -41,36 +41,36 @@
     "data"
   ],
   "dependencies": {
-    "@wrongstack/acp": "1.0.13",
-    "@wrongstack/bench": "1.0.13",
-    "@wrongstack/core": "1.0.13",
-    "@wrongstack/kanban": "1.0.13",
-    "@wrongstack/mcp": "1.0.13",
-    "@wrongstack/persistence": "1.0.13",
-    "@wrongstack/plug-lsp": "1.0.13",
-    "@wrongstack/plugins": "1.0.13",
-    "@wrongstack/primitives": "1.0.13",
-    "@wrongstack/providers": "1.0.13",
-    "@wrongstack/requirement-intake": "1.0.13",
-    "@wrongstack/runtime": "1.0.13",
-    "@wrongstack/sage": "1.0.13",
-    "@wrongstack/sdd": "1.0.13",
-    "@wrongstack/security-scanner": "1.0.13",
-    "@wrongstack/simpleui": "1.0.13",
-    "@wrongstack/techstack": "1.0.13",
-    "@wrongstack/telegram": "1.0.13",
-    "@wrongstack/tools": "1.0.13",
-    "@wrongstack/tui": "1.0.13",
-    "@wrongstack/vector-memory": "1.0.13",
-    "@wrongstack/webui": "1.0.13",
-    "@wrongstack/webui-hq": "1.0.13",
-    "@wrongstack/webui-protocol": "1.0.13",
-    "@wrongstack/webui-server": "1.0.13",
-    "@wrongstack/wrongtrace": "1.0.13",
+    "@wrongstack/acp": "1.0.15",
+    "@wrongstack/bench": "1.0.15",
+    "@wrongstack/core": "1.0.15",
+    "@wrongstack/kanban": "1.0.15",
+    "@wrongstack/mcp": "1.0.15",
+    "@wrongstack/persistence": "1.0.15",
+    "@wrongstack/plug-lsp": "1.0.15",
+    "@wrongstack/plugins": "1.0.15",
+    "@wrongstack/primitives": "1.0.15",
+    "@wrongstack/providers": "1.0.15",
+    "@wrongstack/requirement-intake": "1.0.15",
+    "@wrongstack/runtime": "1.0.15",
+    "@wrongstack/sage": "1.0.15",
+    "@wrongstack/sdd": "1.0.15",
+    "@wrongstack/security-scanner": "1.0.15",
+    "@wrongstack/simpleui": "1.0.15",
+    "@wrongstack/techstack": "1.0.15",
+    "@wrongstack/telegram": "1.0.15",
+    "@wrongstack/tools": "1.0.15",
+    "@wrongstack/tui": "1.0.15",
+    "@wrongstack/vector-memory": "1.0.15",
+    "@wrongstack/webui": "1.0.15",
+    "@wrongstack/webui-hq": "1.0.15",
+    "@wrongstack/webui-protocol": "1.0.15",
+    "@wrongstack/webui-server": "1.0.15",
+    "@wrongstack/wrongtrace": "1.0.15",
     "ws": "^8.21.3"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "1.0.13"
+    "@wrongstack/desktop": "1.0.15"
   },
   "devDependencies": {
     "@types/node": "^26.5.1",