@wrongstack/cli 1.0.16 → 1.0.19

package/dist/{acp-IJ55NBMJ.js → acp-INCNOH42.js}

@@ -10,7 +10,8 @@ import {
 } from "./chunk-JY52HWL6.js";
 import {
   startCliHqConnection
-} from "./chunk-TE3Q32JP.js";
+} from "./chunk-CJTBLTS4.js";
+import "./chunk-XJXDOF63.js";
 import "./chunk-SIGUWXAA.js";
 import "./chunk-DAKVBMD4.js";
 import "./chunk-DR2OXU46.js";
@@ -1167,4 +1168,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-IJ55NBMJ.js.map
+//# sourceMappingURL=acp-INCNOH42.js.map

package/dist/boot/tool-registry.d.ts

@@ -1,7 +1,7 @@
 /** CLI boot adapter for canonical runtime tool registration and host policies. */
 import type { EventBus } from '@wrongstack/core/kernel';
 import type { ToolRegistry } from '@wrongstack/core/registry';
-import type { AutoThinConfig, ConcreteTokenSavingTier, DisabledToolMeta, MemoryPort, TokenSavingTier, ToolDescriptionModeConfig, ToolResultRenderModeConfig } from '@wrongstack/core/types';
+import type { AutoThinConfig, ConcreteTokenSavingTier, DisabledToolMeta, MemoryPort, SkillLoader, TokenSavingTier, ToolDescriptionModeConfig, ToolResultRenderModeConfig } from '@wrongstack/core/types';
 import type { WstackPaths } from '@wrongstack/core/utils';
 import type { VectorMemoryStore } from '@wrongstack/vector-memory';
 interface RegisterBuiltinToolsDeps {
@@ -61,6 +61,8 @@ interface RegisterBuiltinToolsDeps {
      * Omit (or pass `undefined`) to keep the CLI on the SAGE-only surface.
      */
     vectorMemoryStore?: VectorMemoryStore | undefined;
+    /** Registers the `skill` tool the progressive skill manifest points at. Omit when skills are off. */
+    skillLoader?: SkillLoader | undefined;
     events: EventBus;
     wpaths: Pick<WstackPaths, 'projectDir'>;
 }

package/dist/{chunk-U3PDQOYU.js → chunk-2CZEORLV.js}

@@ -1,7 +1,7 @@
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-IJ55NBMJ.js")).acpCmd,
+  acp: async () => (await import("./acp-INCNOH42.js")).acpCmd,
   init: async () => (await import("./init-DRMMFG2G.js")).initCmd,
   auth: async () => (await import("./auth-YXK3EDUL.js")).authCmd,
   update: async () => (await import("./update-5DPB4YD4.js")).updateCmd,
@@ -31,8 +31,8 @@ var loaders = {
   quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
   bench: async () => (await import("./bench-YBU6BVQP.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-O5BOP6UY.js")).hqCmd,
-  mailbox: async () => (await import("./mailbox-serve-X3CR6VFW.js")).mailboxServeCmd,
+  hq: async () => (await import("./hq-XQWQTRDA.js")).hqCmd,
+  mailbox: async () => (await import("./mailbox-serve-3GFOK2I7.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-CFDLXETM.js")).permissionsCmd,
   project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
   governance: async () => (await import("./governance-RYSHV675.js")).governanceCmd
@@ -51,4 +51,4 @@ export {
   subcommands,
   subcommandNames
 };
-//# sourceMappingURL=chunk-U3PDQOYU.js.map
+//# sourceMappingURL=chunk-2CZEORLV.js.map

package/dist/{chunk-DUF5FEWD.js → chunk-2ENZU66X.js}

@@ -22,7 +22,7 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-3ILCNR2T.js");
+      const { subcommandNames } = await import("./subcommands-XSLXMIDP.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-DUF5FEWD.js.map
+//# sourceMappingURL=chunk-2ENZU66X.js.map

package/dist/{chunk-TE3Q32JP.js → chunk-CJTBLTS4.js}

@@ -1,3 +1,6 @@
+import {
+  CLI_VERSION
+} from "./chunk-XJXDOF63.js";
 
 // src/hq-publisher.ts
 import { createHqPublisherFromEnv, resolveHqConfig } from "@wrongstack/core/hq";
@@ -429,6 +432,7 @@ function nodeWsSocketFactory(url) {
 }
 function createCliHqPublisher(options) {
   return createHqPublisherFromEnv({
+    clientVersion: options.clientVersion ?? options.version ?? CLI_VERSION,
     ...options,
     socketFactory: options.socketFactory ?? nodeWsSocketFactory
   });
@@ -513,4 +517,4 @@ function startCliHqConnection(options) {
 export {
   startCliHqConnection
 };
-//# sourceMappingURL=chunk-TE3Q32JP.js.map
+//# sourceMappingURL=chunk-CJTBLTS4.js.map

package/dist/{chunk-MZY6UDWC.js → chunk-KK2LB3ZS.js}

@@ -33,7 +33,7 @@ import {
 import { randomUUID as randomUUID6 } from "node:crypto";
 import * as fs4 from "node:fs/promises";
 import * as http from "node:http";
-import * as path7 from "node:path";
+import * as path8 from "node:path";
 import { getSharedProjectMailbox } from "@wrongstack/core/coordination";
 import {
   assessHqExposure as assessHqExposure2,
@@ -635,7 +635,7 @@ import {
   MailboxEventEmitter,
   MailboxHttpRateLimiter
 } from "@wrongstack/core/coordination";
-import * as path5 from "node:path";
+import * as path6 from "node:path";
 
 // src/hq-static-serve.ts
 import * as fs2 from "node:fs";
@@ -1768,9 +1768,11 @@ function buildSnapshot(clients, options) {
       project.governance = governance;
     }
     for (const tracked of client.sessions.values()) {
+      const clientVersion = tracked.payload.clientVersion ?? client.version;
       sessionById.set(tracked.payload.sessionId, {
         ...tracked.payload,
-        clientId: client.clientId
+        clientId: client.clientId,
+        ...clientVersion !== void 0 ? { clientVersion } : {}
       });
     }
     for (const snapshot of client.mailboxes.values()) {
@@ -1911,12 +1913,14 @@ function buildSnapshot(clients, options) {
       if (typeof agent.costUsd === "number") sessionCost += agent.costUsd;
     }
     const provider = s.agents.find((a) => a.model !== void 0)?.model;
+    const clientVersion = s.clientVersion ?? (s.clientId ? clientRecordById.get(s.clientId)?.version : void 0);
     return {
       sessionId: s.sessionId,
       projectId: s.projectId,
       clientId: s.clientId ?? `${s.machineId}:${s.clientKind}`,
       status: s.status === "active" ? "running" : "idle",
       ...provider !== void 0 ? { model: provider } : {},
+      ...clientVersion !== void 0 ? { clientVersion } : {},
       startedAt: s.startedAt,
       lastActivityAt: s.lastActivityAt,
       ...sessionCost > 0 ? { costUsd: sessionCost } : {}
@@ -2161,11 +2165,24 @@ async function authorizeHqCommand(input) {
 }
 
 // src/hq-server/routes/mailbox-handlers.ts
-import * as path3 from "node:path";
+import * as path4 from "node:path";
 import { resolveProjectDir } from "@wrongstack/core/coordination";
 
 // src/hq-server/project-root.ts
+import * as fsp from "node:fs/promises";
+import * as path3 from "node:path";
 import { deriveHqProjectId } from "@wrongstack/core/hq";
+function isPlainSegment(value) {
+  return value.length > 0 && value !== "." && value !== ".." && !value.includes("/") && !value.includes("\\") && !path3.isAbsolute(value);
+}
+async function projectDirectoryExists(globalRoot, projectId) {
+  if (!isPlainSegment(projectId)) return false;
+  try {
+    return (await fsp.stat(path3.join(globalRoot, "projects", projectId))).isDirectory();
+  } catch {
+    return false;
+  }
+}
 function resolveHqProjectRoot(globalRoot, ids) {
   const fn = async () => {
     const { getSessionRegistry } = await import("@wrongstack/core/storage");
@@ -2173,7 +2190,7 @@ function resolveHqProjectRoot(globalRoot, ids) {
       const registry = getSessionRegistry(globalRoot);
       if (typeof ids.sessionId === "string") {
         const entry = await registry.get(ids.sessionId).catch(() => null);
-        if (entry?.projectRoot) return entry.projectRoot;
+        if (entry?.projectRoot) return { status: "found", projectRoot: entry.projectRoot };
       }
       if (typeof ids.projectId === "string") {
         const { createHash: createHash2 } = await import("node:crypto");
@@ -2189,11 +2206,15 @@ function resolveHqProjectRoot(globalRoot, ids) {
         const match = all.find(
           (e) => e.projectSlug === ids.projectId || projectIdForRoot(e.projectRoot) === ids.projectId || createHash2("sha256").update(e.projectRoot).digest("hex").slice(0, 12) === ids.projectId
         );
-        if (match) return match.projectRoot;
+        if (match) return { status: "found", projectRoot: match.projectRoot };
+        if (await projectDirectoryExists(globalRoot, ids.projectId)) {
+          return { status: "unavailable" };
+        }
       }
     } catch {
+      return { status: "unavailable" };
     }
-    return void 0;
+    return { status: "unknown" };
   };
   return fn();
 }
@@ -2217,7 +2238,7 @@ async function handleMailboxGateway(_req, res, match, authorizeMailboxGateway, g
     );
     return;
   }
-  const gatewayGlobalRoot = path3.dirname(dataDir);
+  const gatewayGlobalRoot = path4.dirname(dataDir);
   const preliminaryAccess = authorizeMailboxGateway(_req, `project:${projectId}`);
   if (!preliminaryAccess.allowed) {
     res.writeHead(preliminaryAccess.status ?? 401, {
@@ -2227,14 +2248,27 @@ async function handleMailboxGateway(_req, res, match, authorizeMailboxGateway, g
     res.end(JSON.stringify(preliminaryAccess.body));
     return;
   }
-  const projectRoot = await resolveHqProjectRoot(gatewayGlobalRoot, { projectId });
-  if (!projectRoot) {
+  const resolution = await resolveHqProjectRoot(gatewayGlobalRoot, { projectId });
+  if (resolution.status === "unavailable") {
+    res.writeHead(503, { "Content-Type": "application/json", "Retry-After": "1" });
+    res.end(
+      JSON.stringify({
+        error: {
+          code: "UNAVAILABLE",
+          message: `Project ${projectId} is not reachable right now; retry shortly.`
+        }
+      })
+    );
+    return;
+  }
+  if (resolution.status !== "found") {
     res.writeHead(404, { "Content-Type": "application/json" });
     res.end(
       JSON.stringify({ error: { code: "NOT_FOUND", message: `Unknown project: ${projectId}` } })
     );
     return;
   }
+  const projectRoot = resolution.projectRoot;
   const suffix = match[2];
   const rawUrl = _req.url ?? "";
   const queryIndex = rawUrl.indexOf("?");
@@ -2283,16 +2317,22 @@ async function handleApiMailboxSend(_req, res, mutableAuth, sessions, dataDir, g
     res.end(JSON.stringify({ error: "audience must be all or leaders" }));
     return;
   }
-  const mbGlobalRoot = path3.dirname(dataDir);
-  const projectRoot = await resolveHqProjectRoot(mbGlobalRoot, {
+  const mbGlobalRoot = path4.dirname(dataDir);
+  const mbResolution = await resolveHqProjectRoot(mbGlobalRoot, {
     sessionId: mbody.sessionId,
     projectId: mbody.projectId
   });
-  if (typeof projectRoot !== "string" || projectRoot.length === 0) {
+  if (mbResolution.status === "unavailable") {
+    res.writeHead(503, { "Content-Type": "application/json", "Retry-After": "1" });
+    res.end(JSON.stringify({ error: "target project mailbox is not reachable right now" }));
+    return;
+  }
+  if (mbResolution.status !== "found" || mbResolution.projectRoot.length === 0) {
     res.writeHead(404, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: "could not resolve target project mailbox" }));
     return;
   }
+  const projectRoot = mbResolution.projectRoot;
   const to = typeof mbody.to === "string" ? mbody.to : "leader";
   const subject = typeof mbody.subject === "string" ? mbody.subject : "HQ prompt";
   const priority = mbody.priority === "high" ? "high" : mbody.priority === "low" ? "low" : "normal";
@@ -2403,16 +2443,22 @@ async function handleMailboxAction(_req, res, match, mutableAuth, sessions, data
     res.end(JSON.stringify({ error: "missing sessionId or projectId" }));
     return;
   }
-  const actGlobalRoot = path3.dirname(dataDir);
-  const projectRoot = await resolveHqProjectRoot(actGlobalRoot, {
+  const actGlobalRoot = path4.dirname(dataDir);
+  const actResolution = await resolveHqProjectRoot(actGlobalRoot, {
     sessionId: abody.sessionId,
     projectId: abody.projectId
   });
-  if (typeof projectRoot !== "string" || projectRoot.length === 0) {
+  if (actResolution.status === "unavailable") {
+    res.writeHead(503, { "Content-Type": "application/json", "Retry-After": "1" });
+    res.end(JSON.stringify({ error: "target project mailbox is not reachable right now" }));
+    return;
+  }
+  if (actResolution.status !== "found" || actResolution.projectRoot.length === 0) {
     res.writeHead(404, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: "could not resolve target project mailbox" }));
     return;
   }
+  const projectRoot = actResolution.projectRoot;
   try {
     const { actionToAckInput } = await import("@wrongstack/core/coordination");
     const projectDir = resolveProjectDir(projectRoot, actGlobalRoot);
@@ -2643,14 +2689,14 @@ async function handleApiTrendsCost(req, res, persistence) {
 }
 
 // src/hq-server/routes/session-handlers.ts
-import * as path4 from "node:path";
+import * as path5 from "node:path";
 import {
   buildTranscriptFromEvents,
   resolveHqDataDir
 } from "@wrongstack/core/hq";
 async function handleApiSessions(res) {
   const { getSessionRegistry } = await import("@wrongstack/core/storage");
-  const globalRoot = path4.dirname(resolveHqDataDir());
+  const globalRoot = path5.dirname(resolveHqDataDir());
   try {
     const registry = getSessionRegistry(globalRoot);
     const sessions = await registry.list();
@@ -2695,7 +2741,7 @@ async function handleApiSessionEvents(req, res, match, transcripts) {
     res.end(JSON.stringify({ error: "invalid sessionId encoding" }));
     return;
   }
-  const globalRoot = path4.dirname(resolveHqDataDir());
+  const globalRoot = path5.dirname(resolveHqDataDir());
   try {
     const registry = getSessionRegistry(globalRoot);
     const entry = await registry.get(sessionId).catch(() => null);
@@ -3426,7 +3472,7 @@ var MailboxGatewayManager = class {
       const lastUsed = this.mailboxGatewayLastUsed.get(projectDir);
       gateways.push({
         // projectId = basename(projectDir) — matches the credential contract.
-        projectId: path5.basename(projectDir),
+        projectId: path6.basename(projectDir),
         projectRoot: projectDir,
         hasActiveStreams: gateway.router.hasActiveStreams(),
         lastUsedAt: typeof lastUsed === "number" ? lastUsed : null,
@@ -3516,7 +3562,7 @@ async function prepareHqServerStart(options, defaults) {
 
 // src/hq-server/startup.ts
 import * as fs3 from "node:fs/promises";
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 import { writeHqRuntimeFile } from "@wrongstack/core/hq";
 var hqRuntimeMarkerPath2 = hqRuntimeMarkerPath;
 async function writeHqRuntimeMarker(dataDir, url) {
@@ -3597,7 +3643,7 @@ HQ auth loaded from ${startup.dataDir}
   if (startup.clientEnv.WRONGSTACK_HQ_TOKEN) {
     write(`  WRONGSTACK_HQ_TOKEN=${startup.clientEnv.WRONGSTACK_HQ_TOKEN}
 `);
-    write(`Credentials are stored in ${path6.join(startup.dataDir, "auth.json")}
+    write(`Credentials are stored in ${path7.join(startup.dataDir, "auth.json")}
 `);
   }
   writeHqLanEndpoints(write, handle, void 0);
@@ -4727,12 +4773,12 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     const persistence = createHqPersistence(dataDir);
     const auditLog = new HqCommandAuditLog(1e3, (entry) => persistence.commandLog.append(entry));
     void (async () => {
-      const projectsDir = path7.join(path7.dirname(dataDir), "projects");
+      const projectsDir = path8.join(path8.dirname(dataDir), "projects");
       const entries = await fs4.readdir(projectsDir, { withFileTypes: true }).catch(() => []);
       await Promise.all(
         entries.filter((entry) => entry.isDirectory()).map(async (entry) => {
-          const projectDir = path7.join(projectsDir, entry.name);
-          const metadataPath = path7.join(projectDir, ".mailbox-server.json");
+          const projectDir = path8.join(projectsDir, entry.name);
+          const metadataPath = path8.join(projectDir, ".mailbox-server.json");
           const ownerPid = await fs4.readFile(metadataPath, "utf8").then((raw) => JSON.parse(raw).pid).catch(() => void 0);
           if (ownerPid === void 0) return;
           let ownerAlive = false;
@@ -5100,4 +5146,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-MZY6UDWC.js.map
+//# sourceMappingURL=chunk-KK2LB3ZS.js.map

package/dist/{cli-context-6MTVFJPO.js → cli-context-33F74CSZ.js}

@@ -19,17 +19,17 @@ import {
 } from "./chunk-GPPRNAKW.js";
 import {
   subcommands
-} from "./chunk-U3PDQOYU.js";
+} from "./chunk-2CZEORLV.js";
 import {
   renderDeepHelp,
   renderFocusedHelp
 } from "./chunk-JX6KL7OF.js";
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-DUF5FEWD.js";
+} from "./chunk-2ENZU66X.js";
 import {
   DEFAULT_PORT
-} from "./chunk-MZY6UDWC.js";
+} from "./chunk-KK2LB3ZS.js";
 import "./chunk-HXJYHAR4.js";
 import {
   resolveHqPasswordInput
@@ -866,7 +866,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-YW4MJCKH.js");
+  const { startHqServer } = await import("./hq-server-IIBZQZU4.js");
   const tunnelRequested = flags["tunnel"] === true;
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
   let publicOrigin;
@@ -3303,4 +3303,4 @@ async function initializeCli(argv) {
 export {
   initializeCli
 };
-//# sourceMappingURL=cli-context-6MTVFJPO.js.map
+//# sourceMappingURL=cli-context-33F74CSZ.js.map

package/dist/{cli-main-42SM33EG.js → cli-main-FNGMKPBA.js}

@@ -5,6 +5,7 @@ import {
   normalizeTuiThinkingWord,
   removeSuggestions,
   runGit,
+  setAutoSuggestions,
   setSuggestions
 } from "./chunk-OWNC7LMD.js";
 import {
@@ -71,9 +72,6 @@ import {
 import {
   BEHAVIOR_SECTION_KEYS
 } from "./chunk-UQUYBDMG.js";
-import {
-  CLI_VERSION
-} from "./chunk-XJXDOF63.js";
 import {
   buildProviderForId,
   createGracefulShutdown,
@@ -90,7 +88,10 @@ import {
 } from "./chunk-JY52HWL6.js";
 import {
   startCliHqConnection
-} from "./chunk-TE3Q32JP.js";
+} from "./chunk-CJTBLTS4.js";
+import {
+  CLI_VERSION
+} from "./chunk-XJXDOF63.js";
 import {
   LOCAL_LLM_PRESETS,
   addCustomProvider,
@@ -6133,7 +6134,7 @@ function createRuntimePickerDeps(input) {
 function formatAge(at) {
   const seconds = Math.max(0, Math.round((Date.now() - at) / 1e3));
   if (seconds < 60) return `${seconds}s`;
-  if (seconds < 3600) return `${Math.round(seconds / 60)}m`;
+  if (seconds < 3600) return `${Math.floor(seconds / 60)}m`;
   return `${Math.round(seconds / 3600)}h`;
 }
 
@@ -6244,7 +6245,7 @@ async function runCliExecution(params) {
     governanceHandle,
     setConfig
   } = params;
-  const { execute } = await import("./execution-6KIOQUAG.js");
+  const { execute } = await import("./execution-A6WJLSOC.js");
   return execute(
     toExecuteDeps({
       core: {
@@ -7360,6 +7361,7 @@ function registerBuiltinTools(deps) {
     memory: { enabled: deps.config.features.memory, store: deps.memoryStore },
     vectorMemory: deps.vectorMemoryStore ? { store: deps.vectorMemoryStore } : void 0,
     nextSteps: { enabled: deps.config.tools?.nextsteps?.enabled === true },
+    skillLoader: deps.skillLoader,
     coordinationTools: [
       makeMailboxTool({ projectDir: deps.wpaths.projectDir, events: deps.events }),
       makeMailSendTool({ projectDir: deps.wpaths.projectDir, events: deps.events }),
@@ -7490,6 +7492,9 @@ async function setupCliPromptAndTools(params) {
     tier,
     memoryStore,
     vectorMemoryStore,
+    // Same gate the prompt builder uses (`skillsEnabled`), so the manifest and
+    // the tool that loads its entries are present or absent together.
+    skillLoader: config.features.skills ? skillLoader : void 0,
     events,
     wpaths
   });
@@ -26385,9 +26390,14 @@ function buildSuggestPrompt(contextText) {
     "Based on the current project state below, generate 3-5 exact natural-language",
     "prompt messages that the user could submit back to the coding agent through the",
     "TUI or WebUI. Each prompt must ask the agent to perform useful work immediately.",
+    "Generate prompt messages only; do not execute the proposed work in this request.",
     "Agent-directed imperatives are valid and do not need to be shell commands.",
     "Never output a human-only chore or an instruction that expects the user to do",
     "the work after selecting it. Be specific \u2014 mention relevant files or tools.",
+    "The recipient is the LLM, not the user. Each item is submitted verbatim as",
+    "the next user prompt: name the target, action, and useful verification or output.",
+    "Omit approval requests, questions for the user, and mixed agent/human checklists.",
+    "Use the user's language when it is known from the supplied context.",
     "Do NOT include preamble, explanation, or wrap the output in code blocks.",
     "",
     "Rules:",
@@ -26405,8 +26415,9 @@ function buildSuggestPrompt(contextText) {
   ].join("\n");
 }
 var SUGGEST_CACHE_TTL_MS = 6e4;
-var suggestCache = null;
 function buildSuggestCommand(opts) {
+  let suggestCache;
+  let requestVersion = 0;
   return {
     name: "suggest",
     aliases: ["next-steps", "what-next"],
@@ -26425,25 +26436,37 @@ function buildSuggestCommand(opts) {
       "",
       "Use `/next list` to see the current suggestions at any time."
     ].join("\n"),
-    async run(args, _ctx) {
-      const trimmed = args.trim().toLowerCase();
-      const fast = /\b(--fast|-f)\b/.test(trimmed);
-      const fresh = /--fresh\b/.test(trimmed);
+    async run(args, ctx) {
+      const flags = new Set(args.trim().toLowerCase().split(/\s+/));
+      const fast = flags.has("--fast") || flags.has("-f");
+      const fresh = flags.has("--fresh");
+      const context = ctx ?? opts.context;
+      const currentScope = () => JSON.stringify([opts.projectRoot, opts.cwd, context?.session?.id]);
+      const scope = currentScope();
+      const lastMessage = context?.messages?.at(-1);
+      const version = ++requestVersion;
+      const isCurrent = () => version === requestVersion && scope === currentScope() && lastMessage === context?.messages?.at(-1);
+      const superseded = () => ({ message: color52.dim("Discarded stale suggestion result.") });
+      setAutoSuggestions([]);
       if (fast) {
+        suggestCache = void 0;
         const suggestions = await generateHeuristicSuggestions(opts);
+        if (!isCurrent()) return superseded();
         setSuggestions(suggestions);
         opts.onSuggestions?.(suggestions);
         const display = formatSuggestions(suggestions);
         return { message: display };
       }
       if (!opts.onSpawnAndWait) {
+        suggestCache = void 0;
         const suggestions = await generateHeuristicSuggestions(opts);
+        if (!isCurrent()) return superseded();
         setSuggestions(suggestions);
         opts.onSuggestions?.(suggestions);
         const display = formatSuggestions(suggestions) + "\n" + color52.dim("(Heuristic fallback \u2014 multi-agent not enabled)");
         return { message: display };
       }
-      if (!fresh && suggestCache && Date.now() - suggestCache.at < SUGGEST_CACHE_TTL_MS) {
+      if (!fresh && suggestCache?.context === context && suggestCache?.scope === scope && suggestCache?.lastMessage === lastMessage && Date.now() - suggestCache.at < SUGGEST_CACHE_TTL_MS) {
         setSuggestions(suggestCache.suggestions);
         opts.onSuggestions?.(suggestCache.suggestions);
         const ageSec = Math.round((Date.now() - suggestCache.at) / 1e3);
@@ -26451,28 +26474,26 @@ function buildSuggestCommand(opts) {
           message: formatSuggestions(suggestCache.suggestions) + "\n" + color52.dim(`(cached ${ageSec}s ago \u2014 /suggest --fresh to regenerate)`)
         };
       }
+      suggestCache = void 0;
       const contextText = await collectContext({
         cwd: opts.cwd,
         projectRoot: opts.projectRoot
       });
+      if (!isCurrent()) return superseded();
       const task = buildSuggestPrompt(contextText);
       opts.renderer.write(color52.dim("Generating suggestions..."));
       try {
         const raw = await opts.onSpawnAndWait(task, {
           name: "suggest"
         });
+        if (!isCurrent()) return superseded();
         const suggestions = parseSuggestions(raw);
-        if (suggestions.length === 0) {
-          const fallback = [];
-          setSuggestions(fallback);
-          opts.onSuggestions?.(fallback);
-          return { message: formatSuggestions(fallback) };
-        }
         setSuggestions(suggestions);
         opts.onSuggestions?.(suggestions);
-        suggestCache = { suggestions, at: Date.now() };
+        suggestCache = { suggestions, at: Date.now(), context, scope, lastMessage };
         return { message: formatSuggestions(suggestions) };
       } catch (err) {
+        if (!isCurrent()) return superseded();
         const msg = `Suggestion generation failed: ${toErrorMessage24(err)}`;
         opts.renderer.writeWarning(msg);
         return { message: msg };
@@ -26482,12 +26503,10 @@ function buildSuggestCommand(opts) {
 }
 function parseSuggestions(raw) {
   const trimmed = raw.trim();
-  if (/^none\b/i.test(trimmed) || /no (?:pending actions|further steps)/i.test(trimmed)) {
+  if (/^none[.!]?$/i.test(trimmed)) {
     return [];
   }
-  const { texts } = parseNextSteps(raw, false);
-  if (texts.length > 0) return texts;
-  return raw.split("\n").map((l) => l.trim()).filter((l) => l.length > 10 && !l.startsWith("#") && !l.startsWith("```")).slice(0, 5);
+  return parseNextSteps(raw, false).texts.slice(0, 5);
 }
 async function pathExists2(filePath) {
   try {
@@ -32927,7 +32946,7 @@ function parseArgs(args) {
 }
 async function gatherInput(opts, power) {
   const config = opts.configStore.get();
-  const skillMode = config.skills?.mode ?? "eager";
+  const skillMode = config.skills?.mode ?? "progressive";
   const eagerMaxChars = config.skills?.eagerMaxChars ?? DEFAULT_EAGER_MAX_CHARS;
   const [skills, memoryFiles, update, trust, configIssues, sessionBytes] = await Promise.all([
     gatherSkills(opts, skillMode),
@@ -39110,4 +39129,4 @@ export {
   CLI_VERSION,
   runInteractive
 };
-//# sourceMappingURL=cli-main-42SM33EG.js.map
+//# sourceMappingURL=cli-main-FNGMKPBA.js.map

package/dist/{execution-6KIOQUAG.js → execution-A6WJLSOC.js}

@@ -40,12 +40,12 @@ import {
   terminalLink,
   terminalText
 } from "./chunk-HXJYHAR4.js";
+import {
+  startCliHqConnection
+} from "./chunk-CJTBLTS4.js";
 import {
   CLI_VERSION
 } from "./chunk-XJXDOF63.js";
-import {
-  startCliHqConnection
-} from "./chunk-TE3Q32JP.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
@@ -214,7 +214,7 @@ async function runWebUIDispatch(ctx) {
   const isSimpleUi = !isSessionChild && flags["simpleui"] === true;
   agent.disableInteractiveConfirmation();
   renderer.setSilent(true);
-  const { runWebUI } = await import("./webui-server-FRVJWLZA.js");
+  const { runWebUI } = await import("./webui-server-MRPGTTKL.js");
   const flagValue = (names) => {
     for (const name of names) {
       if (!Object.hasOwn(flags, name)) continue;
@@ -6959,4 +6959,4 @@ export {
   execute,
   resolveReviewerFallbackModels
 };
-//# sourceMappingURL=execution-6KIOQUAG.js.map
+//# sourceMappingURL=execution-A6WJLSOC.js.map

package/dist/{hq-O5BOP6UY.js → hq-XQWQTRDA.js}

@@ -68,7 +68,7 @@ var hqCmd = async (args, deps) => {
   return 1;
 };
 async function startServer(deps) {
-  const { startHqServer } = await import("./hq-server-YW4MJCKH.js");
+  const { startHqServer } = await import("./hq-server-IIBZQZU4.js");
   const dataDir = resolveDataDir(deps);
   const flags = deps.flags ?? {};
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
@@ -987,4 +987,4 @@ export {
   hqCmd,
   resolveAuditActor
 };
-//# sourceMappingURL=hq-O5BOP6UY.js.map
+//# sourceMappingURL=hq-XQWQTRDA.js.map

package/dist/hq-server/project-root.d.ts

@@ -1,5 +1,39 @@
+/**
+ * Why this is not just `string | undefined`.
+ *
+ * Resolution walks `ProjectSessionRegistry.list()`, which probes each known
+ * project's session-catalog daemon with `callExisting` — a path that must never
+ * spawn — and turns EVERY per-project failure into an empty result: metadata not
+ * yet written, the daemon gone, the IPC connect refused, a timeout. The gateway
+ * then reported that as `404 Unknown project`, which is indistinguishable from
+ * "this project does not exist".
+ *
+ * That conflation is observable: a session lease lives 30s and is renewed every
+ * 5s, so under heavy load a live project's daemon can lapse and exit, and a
+ * perfectly real project answers 404 for a moment. The caller cannot tell a
+ * permanent negative from a blip, so it cannot know whether retrying is
+ * sensible.
+ *
+ * The on-disk project directory is the discriminator: it is created when the
+ * project first gets a daemon and it outlives that daemon (only the metadata
+ * file is removed on exit). A directory therefore means "this machine knows
+ * this project, it just is not answering right now" — transient. No directory
+ * means genuinely unknown.
+ */
+export type HqProjectResolution = {
+    status: 'found';
+    projectRoot: string;
+}
+/** No such project on this machine. A retry will not help. */
+ | {
+    status: 'unknown';
+}
+/** The project is known but could not be resolved right now; retry may help. */
+ | {
+    status: 'unavailable';
+};
 export declare function resolveHqProjectRoot(globalRoot: string, ids: {
     sessionId?: string | undefined;
     projectId?: string | undefined;
-}): Promise<string | undefined>;
+}): Promise<HqProjectResolution>;
 //# sourceMappingURL=project-root.d.ts.map

package/dist/{hq-server-YW4MJCKH.js → hq-server-IIBZQZU4.js}

@@ -10,7 +10,7 @@ import {
   readLocalSubagentTranscript,
   sanitizeApiError,
   startHqServer
-} from "./chunk-MZY6UDWC.js";
+} from "./chunk-KK2LB3ZS.js";
 import "./chunk-HXJYHAR4.js";
 import "./chunk-5EA6OTLJ.js";
 import "./chunk-Q7E3BPDU.js";
@@ -27,4 +27,4 @@ export {
   sanitizeApiError,
   startHqServer
 };
-//# sourceMappingURL=hq-server-YW4MJCKH.js.map
+//# sourceMappingURL=hq-server-IIBZQZU4.js.map

package/dist/index.js

@@ -16,14 +16,14 @@ async function main(argv) {
   applySessionShellDefault();
   const earlyFlags = parseArgs(argv).flags;
   if (earlyFlags["help"] === true || earlyFlags["version"] === true) {
-    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-T6EFG3W6.js");
+    const { handleHelpVersionShortCircuit } = await import("./short-circuit-flags-7GQIGMVD.js");
     const earlyExit = await handleHelpVersionShortCircuit(argv);
     if (earlyExit !== null) return earlyExit;
   }
-  const { initializeCli } = await import("./cli-context-6MTVFJPO.js");
+  const { initializeCli } = await import("./cli-context-33F74CSZ.js");
   const cliCtx = await initializeCli(argv);
   if (typeof cliCtx === "number") return cliCtx;
-  const { runInteractive } = await import("./cli-main-42SM33EG.js");
+  const { runInteractive } = await import("./cli-main-FNGMKPBA.js");
   return runInteractive(cliCtx);
 }
 

package/dist/{mailbox-serve-X3CR6VFW.js → mailbox-serve-3GFOK2I7.js}

@@ -1,6 +1,7 @@
 import {
   startCliHqConnection
-} from "./chunk-TE3Q32JP.js";
+} from "./chunk-CJTBLTS4.js";
+import "./chunk-XJXDOF63.js";
 
 // src/subcommands/handlers/mailbox-serve.ts
 import { createServer } from "node:http";
@@ -360,4 +361,4 @@ function printHelp(deps) {
 export {
   mailboxServeCmd
 };
-//# sourceMappingURL=mailbox-serve-X3CR6VFW.js.map
+//# sourceMappingURL=mailbox-serve-3GFOK2I7.js.map

package/dist/{short-circuit-flags-T6EFG3W6.js → short-circuit-flags-7GQIGMVD.js}

@@ -1,10 +1,10 @@
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-DUF5FEWD.js";
+} from "./chunk-2ENZU66X.js";
 import "./chunk-6WRKAACA.js";
 import "./chunk-XJXDOF63.js";
 import "./chunk-C3Z4N6A6.js";
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=short-circuit-flags-T6EFG3W6.js.map
+//# sourceMappingURL=short-circuit-flags-7GQIGMVD.js.map

package/dist/{subcommands-3ILCNR2T.js → subcommands-XSLXMIDP.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-U3PDQOYU.js";
+} from "./chunk-2CZEORLV.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-3ILCNR2T.js.map
+//# sourceMappingURL=subcommands-XSLXMIDP.js.map

package/dist/{webui-server-FRVJWLZA.js → webui-server-MRPGTTKL.js}

@@ -11,7 +11,10 @@ import {
 } from "./chunk-JY52HWL6.js";
 import {
   startCliHqConnection
-} from "./chunk-TE3Q32JP.js";
+} from "./chunk-CJTBLTS4.js";
+import {
+  CLI_VERSION
+} from "./chunk-XJXDOF63.js";
 import {
   loadConfigProviders,
   mutateConfigProviders
@@ -38,7 +41,6 @@ import {
   envFlag,
   findFreePort,
   findInstalledPackageJson,
-  integrationConnectSources,
   isStrictPort,
   resolveAuthToken,
   resolvePendingConfirmsForSession,
@@ -63,6 +65,7 @@ function createWebuiClientRegistration(deps) {
     events: deps.events,
     hqSessionId: deps.hqSessionId,
     getSessionId: deps.getSessionId,
+    clientVersion: CLI_VERSION,
     ...deps.listSessions ? { listSessions: deps.listSessions } : {},
     ...deps.isSessionOwnedElsewhere ? { isSessionOwnedElsewhere: deps.isSessionOwnedElsewhere } : {},
     ...deps.getSessionWriter ? { getSessionWriter: deps.getSessionWriter } : {},
@@ -1526,10 +1529,14 @@ async function runWebUI(opts) {
     requireToken,
     deferListen: surface === "simpleui",
     strictPort,
-    // HQ / WrongProxy status chips fetch those endpoints straight from the
-    // browser; without their origins in `connect-src` the page's own CSP
-    // blocks the probe and both chips report a healthy server as down.
-    getExtraConnectSrc: () => integrationConnectSources(opts.appConfig),
+    // Resolve the same-origin health probes from live preferences, including
+    // changes made after boot, just like the standalone WebUI host.
+    getIntegrationTarget: (kind) => {
+      const meta = opts.agent.ctx.meta;
+      const enabledKey = kind === "hq" ? "hqEnabled" : "wrongProxyEnabled";
+      const urlKey = kind === "hq" ? "hqUrl" : "wrongProxyUrl";
+      return meta[enabledKey] === true && typeof meta[urlKey] === "string" ? meta[urlKey] : void 0;
+    },
     ...opts.getVectorMemoryStore ? { getVectorMemoryStore: opts.getVectorMemoryStore } : {},
     ...opts.vectorMemoryModelCacheDir ? { vectorMemoryModelCacheDir: opts.vectorMemoryModelCacheDir } : {}
   });
@@ -2023,4 +2030,4 @@ async function runWebUI(opts) {
 export {
   runWebUI
 };
-//# sourceMappingURL=webui-server-FRVJWLZA.js.map
+//# sourceMappingURL=webui-server-MRPGTTKL.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/cli",
-  "version": "1.0.16",
+  "version": "1.0.19",
   "license": "MIT",
   "description": "WrongStack CLI — terminal AI coding agent with provider catalog from models.dev. Provides `wrongstack` and `wstack` binaries.",
   "keywords": [
@@ -41,36 +41,36 @@
     "data"
   ],
   "dependencies": {
-    "@wrongstack/acp": "1.0.16",
-    "@wrongstack/bench": "1.0.16",
-    "@wrongstack/core": "1.0.16",
-    "@wrongstack/kanban": "1.0.16",
-    "@wrongstack/mcp": "1.0.16",
-    "@wrongstack/persistence": "1.0.16",
-    "@wrongstack/plug-lsp": "1.0.16",
-    "@wrongstack/plugins": "1.0.16",
-    "@wrongstack/primitives": "1.0.16",
-    "@wrongstack/providers": "1.0.16",
-    "@wrongstack/requirement-intake": "1.0.16",
-    "@wrongstack/runtime": "1.0.16",
-    "@wrongstack/sage": "1.0.16",
-    "@wrongstack/sdd": "1.0.16",
-    "@wrongstack/security-scanner": "1.0.16",
-    "@wrongstack/simpleui": "1.0.16",
-    "@wrongstack/techstack": "1.0.16",
-    "@wrongstack/telegram": "1.0.16",
-    "@wrongstack/tools": "1.0.16",
-    "@wrongstack/tui": "1.0.16",
-    "@wrongstack/vector-memory": "1.0.16",
-    "@wrongstack/webui": "1.0.16",
-    "@wrongstack/webui-hq": "1.0.16",
-    "@wrongstack/webui-protocol": "1.0.16",
-    "@wrongstack/webui-server": "1.0.16",
-    "@wrongstack/wrongtrace": "1.0.16",
+    "@wrongstack/acp": "1.0.19",
+    "@wrongstack/bench": "1.0.19",
+    "@wrongstack/core": "1.0.19",
+    "@wrongstack/kanban": "1.0.19",
+    "@wrongstack/mcp": "1.0.19",
+    "@wrongstack/persistence": "1.0.19",
+    "@wrongstack/plug-lsp": "1.0.19",
+    "@wrongstack/plugins": "1.0.19",
+    "@wrongstack/primitives": "1.0.19",
+    "@wrongstack/providers": "1.0.19",
+    "@wrongstack/requirement-intake": "1.0.19",
+    "@wrongstack/runtime": "1.0.19",
+    "@wrongstack/sage": "1.0.19",
+    "@wrongstack/sdd": "1.0.19",
+    "@wrongstack/security-scanner": "1.0.19",
+    "@wrongstack/simpleui": "1.0.19",
+    "@wrongstack/techstack": "1.0.19",
+    "@wrongstack/telegram": "1.0.19",
+    "@wrongstack/tools": "1.0.19",
+    "@wrongstack/tui": "1.0.19",
+    "@wrongstack/vector-memory": "1.0.19",
+    "@wrongstack/webui": "1.0.19",
+    "@wrongstack/webui-hq": "1.0.19",
+    "@wrongstack/webui-protocol": "1.0.19",
+    "@wrongstack/webui-server": "1.0.19",
+    "@wrongstack/wrongtrace": "1.0.19",
     "ws": "^8.21.3"
   },
   "optionalDependencies": {
-    "@wrongstack/desktop": "1.0.16"
+    "@wrongstack/desktop": "1.0.19"
   },
   "devDependencies": {
     "@types/node": "^26.5.1",