@wrongstack/cli 1.0.17 → 1.0.24

package/dist/{acp-INCNOH42.js → acp-AJWSKWE5.js}

@@ -4,17 +4,18 @@ import {
   loadCachedAcpRegistry,
   refreshAcpRegistry,
   setupProvider
-} from "./chunk-KEPABQYT.js";
+} from "./chunk-5SEYGOCH.js";
 import {
   createHqCommandDispatcher
-} from "./chunk-JY52HWL6.js";
+} from "./chunk-2EBVTYJR.js";
 import {
   startCliHqConnection
-} from "./chunk-CJTBLTS4.js";
-import "./chunk-XJXDOF63.js";
+} from "./chunk-BLD5DSVA.js";
+import "./chunk-S4FFHDJG.js";
 import "./chunk-SIGUWXAA.js";
 import "./chunk-DAKVBMD4.js";
-import "./chunk-DR2OXU46.js";
+import "./chunk-LUMETJFO.js";
+import "./chunk-YBUCXXYZ.js";
 
 // src/subcommands/handlers/acp.ts
 import { randomBytes } from "node:crypto";
@@ -589,6 +590,11 @@ async function loadLive(deps) {
 }
 var acpCmd = async (args, deps) => {
   const sub = args[0];
+  const loginIndex = sub === "auth" ? 0 : (sub === "server" || sub === "serve") && args[1] === "auth" ? 1 : -1;
+  if (loginIndex >= 0) {
+    const { authCmd } = await import("./auth-GRBZ7Y3D.js");
+    return authCmd(args.slice(loginIndex + 1), deps);
+  }
   if (!sub || sub === "server" || sub === "serve") {
     return runACPServer(deps);
   }
@@ -803,6 +809,12 @@ async function runACPServer(deps) {
     return runACPWebSocketServer(deps, wsPort);
   }
   const echo = deps.flags?.echo === true || deps.flags?.echo === "true";
+  if (!echo && (!deps.config.provider || !deps.config.model)) {
+    deps.renderer.writeError(
+      "No model provider configured. Run `wstack auth` before starting ACP, or use `--echo` for a connectivity test.\n"
+    );
+    return 1;
+  }
   let stdioHqTelemetry;
   const server = new WrongStackACPServer(
     echo ? {} : (() => {
@@ -813,7 +825,6 @@ async function runACPServer(deps) {
         if (err instanceof AcpServerConfigError) {
           deps.renderer.writeError(`${err.message}
 `);
-          return {};
         }
         throw err;
       }
@@ -1168,4 +1179,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-INCNOH42.js.map
+//# sourceMappingURL=acp-AJWSKWE5.js.map

package/dist/arg-parser.d.ts

@@ -12,6 +12,7 @@ export interface ParsedArgs {
 export declare function parseArgs(argv: string[]): ParsedArgs;
 export interface AuthFlags {
     positional: string[];
+    alias?: string | undefined;
     label?: string | undefined;
     family?: import('@wrongstack/core/types').WireFamily | undefined;
     baseUrl?: string | undefined;

package/dist/{auth-YXK3EDUL.js → auth-GRBZ7Y3D.js}

@@ -16,22 +16,22 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-RDHFXOJM.js";
+} from "./chunk-LFMVHT3R.js";
 import {
   renderAuthLocalHelpToString,
   wantsLocalHelp
-} from "./chunk-2VMJ3E5Z.js";
-import "./chunk-B4JLSXZB.js";
-import {
-  restoreFlags
-} from "./chunk-CSAPOCBP.js";
+} from "./chunk-YTEOAWOJ.js";
 import "./chunk-3VXYY5JC.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
+import "./chunk-WSTVGC2C.js";
+import {
+  restoreFlags
+} from "./chunk-CSAPOCBP.js";
 import {
   parseAuthFlags
-} from "./chunk-C3Z4N6A6.js";
+} from "./chunk-MHEBWVXL.js";
 import "./chunk-SIGUWXAA.js";
 import "./chunk-DAKVBMD4.js";
 import {
@@ -41,10 +41,11 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-DR2OXU46.js";
+} from "./chunk-LUMETJFO.js";
 
 // src/subcommands/handlers/auth.ts
 import { color as color5 } from "@wrongstack/core/utils";
+import { authProfileAliasError as authProfileAliasError2 } from "@wrongstack/providers";
 
 // src/auth-menu/anthropic-oauth.ts
 import {
@@ -57,16 +58,31 @@ var REDIRECT_PATH = "/callback";
 var REDIRECT_URI = `http://localhost:${REDIRECT_PORT}${REDIRECT_PATH}`;
 
 // src/auth-menu/direct.ts
+import { authProfileAliasError } from "@wrongstack/providers";
 async function runAuthDirect(deps, opts) {
-  const { providerId } = opts;
+  const sourceId = opts.providerId;
+  const providerId = opts.alias?.trim() || sourceId;
+  const aliasError = authProfileAliasError(
+    opts.alias !== void 0 ? opts.alias.trim() : providerId
+  );
+  if (aliasError) {
+    deps.renderer.writeError(aliasError);
+    return 1;
+  }
   const providers = await loadProviders(deps);
   const existing = providers[providerId];
+  if (opts.alias && existing) {
+    deps.renderer.writeError(
+      `Auth profile "${providerId}" already exists. Choose another alias or manage its keys explicitly.`
+    );
+    return 1;
+  }
   if (!existing && !opts.family) {
     let knownFamily;
     let knownBase;
     let knownEnv;
     try {
-      const k = await deps.modelsRegistry.getProvider(providerId);
+      const k = await deps.modelsRegistry.getProvider(sourceId);
       if (k) {
         knownFamily = k.family;
         knownBase = k.apiBase;
@@ -98,8 +114,12 @@ async function runAuthDirect(deps, opts) {
     deps.profileConfigPath,
     deps.vault,
     (all) => {
-      const p = all[providerId] ?? { type: providerId };
-      if (!p.type) p.type = providerId;
+      if (opts.alias && all[providerId])
+        throw new Error(
+          `Auth profile "${providerId}" already exists. Choose another alias or manage its keys explicitly.`
+        );
+      const p = all[providerId] ?? { type: sourceId };
+      if (!p.type) p.type = sourceId;
       if (!p.family && opts.family) p.family = opts.family;
       if (!p.baseUrl && opts.baseUrl) p.baseUrl = opts.baseUrl;
       if (!p.envVars && opts.envVars) p.envVars = opts.envVars;
@@ -388,6 +408,7 @@ ${color4.amber("?")} Pick: `)).trim().toLowerCase();
 var authCmd = async (args, deps) => {
   args = restoreFlags(args, deps, [
     "label",
+    "alias",
     "family",
     "base-url",
     "env",
@@ -413,6 +434,29 @@ var authCmd = async (args, deps) => {
     vault: deps.vault,
     profileConfigPath
   };
+  if (flags.positional[0] !== "local" && (args.includes("--help") || args.includes("-h"))) {
+    deps.renderer.write(
+      [
+        "Usage: wstack auth",
+        "  wstack auth <provider-type> --alias <account>  Create a separately keyed auth profile",
+        "  wstack auth login <strategy> --alias <account>  Sign in to an auth profile",
+        "  wstack auth <saved-alias> --label <key-label>  Add a key inside an existing profile",
+        "  wstack auth list | status <alias> | remove <alias>",
+        "",
+        "Fallback targets are <auth-profile-alias>/<model-id>; provider type chooses the transport.",
+        "Direct flags: --alias, --label, --family, --base-url, --env",
+        ""
+      ].join("\n")
+    );
+    return 0;
+  }
+  if (flags.alias !== void 0) {
+    const invalid = authProfileAliasError2(flags.alias.trim());
+    if (invalid) {
+      deps.renderer.writeError(invalid);
+      return 1;
+    }
+  }
   if (flags.positional.length === 0) {
     return runTopMenu(menuDeps);
   }
@@ -434,6 +478,7 @@ var authCmd = async (args, deps) => {
     const modelIdx = args.indexOf("--model") >= 0 ? args.indexOf("--model") : args.indexOf("-m");
     return runAuthLocal(menuDeps, {
       name: flags.positional[1] ?? value("name"),
+      alias: flags.alias,
       baseUrl: flags.baseUrl ?? value("base-url"),
       label: flags.label,
       skipKey: has("no-key", "skip-key"),
@@ -465,9 +510,9 @@ var authCmd = async (args, deps) => {
   }
   if (first === "login") {
     const pid = (flags.positional[1] ?? "").toLowerCase();
-    if (!pid) return runOAuthLoginKind(menuDeps, "chatgpt");
+    if (!pid) return runOAuthLoginKind(menuDeps, "chatgpt", { providerId: flags.alias });
     const kind = resolveOAuthKind(pid, { allowNumeric: false, deps: menuDeps });
-    if (kind) return runOAuthLoginKind(menuDeps, kind);
+    if (kind) return runOAuthLoginKind(menuDeps, kind, { providerId: flags.alias });
     const available = providerAuthStrategiesFor(menuDeps);
     deps.renderer.writeError(`Unknown OAuth login strategy "${pid}".`);
     for (const strategy of available) {
@@ -482,6 +527,7 @@ var authCmd = async (args, deps) => {
   }
   return runAuthDirect(menuDeps, {
     providerId: first,
+    alias: flags.alias,
     label: flags.label,
     family: flags.family,
     baseUrl: flags.baseUrl,
@@ -625,4 +671,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-YXK3EDUL.js.map
+//# sourceMappingURL=auth-GRBZ7Y3D.js.map

package/dist/auth-menu/direct.d.ts

@@ -7,6 +7,7 @@ import type { AuthMenuDeps } from './types.js';
  */
 export declare function runAuthDirect(deps: AuthMenuDeps, opts: {
     providerId: string;
+    alias?: string | undefined;
     label?: string | undefined;
     family?: WireFamily | undefined;
     baseUrl?: string | undefined;

package/dist/auth-menu/local.d.ts

@@ -34,6 +34,8 @@ import { suggestLabel } from './shared.js';
 import type { AuthMenuDeps } from './types.js';
 export { LOCAL_LLM_PRESETS, type ProbeOptions, type ProbeResult, probeLocalLlm };
 export interface RunAuthLocalOptions {
+    /** Create a separately routed auth profile for this local provider preset. */
+    alias?: string | undefined;
     /**
      * Direct pick: skip the interactive menu and configure this preset.
      * `wstack auth local --name ollama` maps to `{ name: 'ollama' }`.

package/dist/auth-menu/oauth-menu.d.ts

@@ -17,7 +17,9 @@ export declare function runOAuthLoginChoice(deps: AuthMenuDeps, choice: string,
     allowNumeric?: boolean;
 }): Promise<boolean>;
 /** Run the OAuth login flow for an already-resolved kind. */
-export declare function runOAuthLoginKind(deps: AuthMenuDeps, kind: OAuthMenuKind): Promise<number>;
+export declare function runOAuthLoginKind(deps: AuthMenuDeps, kind: OAuthMenuKind, opts?: {
+    providerId?: string | undefined;
+}): Promise<number>;
 /** Sub-menu: pick a subscription to sign in with (OAuth). */
 export declare function runOAuthLoginMenu(deps: AuthMenuDeps): Promise<void>;
 //# sourceMappingURL=oauth-menu.d.ts.map

package/dist/auth-menu/panel-service.d.ts

@@ -1,3 +1,23 @@
+/**
+ * TUI auth-panel host — the structured, UI-agnostic surface behind the
+ * interactive `/auth` panel in the Ink TUI.
+ *
+ * Two kinds of operations:
+ *
+ *   - **Direct mutations** (set active key, delete key, remove provider):
+ *     plain async methods that mutate the config atomically and return an
+ *     error string or `null`.
+ *
+ *   - **Flows** (add key, add from catalog, add custom, add local, OAuth
+ *     sign-in, field edits): the existing battle-tested readline flows from
+ *     this package, driven through an {@link AuthFlowIo} bridge. The bridge
+ *     adapts `renderer.write*` → panel log lines (ANSI-stripped) and
+ *     `reader.readLine/readSecret` → the panel's modal prompt. A rejected
+ *     prompt (TUI Esc) aborts the flow before anything is saved.
+ *
+ * Secrets never cross into the TUI: key values are masked here, and the
+ * modal prompt sends the plaintext only INTO the flow (never back out).
+ */
 import type { ModelsRegistry, SecretScrubber, SecretVault } from '@wrongstack/core/types';
 import type { AuthPanelHost } from '@wrongstack/tui';
 import type { AuthMenuDeps } from './types.js';

package/dist/{bench-YBU6BVQP.js → bench-N5K7Z5O3.js}

@@ -1,6 +1,6 @@
 import {
   CLI_VERSION
-} from "./chunk-XJXDOF63.js";
+} from "./chunk-YBUCXXYZ.js";
 
 // src/subcommands/handlers/bench.ts
 import * as fs from "node:fs/promises";
@@ -414,4 +414,4 @@ async function benchList(_args, deps) {
 export {
   benchCmd
 };
-//# sourceMappingURL=bench-YBU6BVQP.js.map
+//# sourceMappingURL=bench-N5K7Z5O3.js.map

package/dist/boot/config-backup-recovery.d.ts

@@ -18,11 +18,12 @@ export declare function defaultProfileProvidersAreEmpty(profilePath: string): Pr
  * providers. Profile config history uses names such as
  * `profiles-default-config-2026-07-19T12-34-56-789.json`.
  */
-export declare function findLatestProviderBackup(globalRoot: string): Promise<ProviderConfigBackup | undefined>;
+export declare function findLatestProviderBackup(globalRoot: string, profileName?: string): Promise<ProviderConfigBackup | undefined>;
 /** Prompt once during an ordinary interactive boot. Enter accepts recovery. */
 export declare function maybeRestoreDefaultProfileFromBackup(opts: {
     globalRoot: string;
     profilePath: string;
+    profileName?: string | undefined;
     renderer: TerminalRenderer;
     reader: ReadlineInputReader;
 }): Promise<boolean>;

package/dist/boot/dispatch-webui.d.ts

@@ -88,6 +88,17 @@ export interface WebUIDispatchContext {
         role?: string | undefined;
         skills?: string[] | undefined;
         tools?: string[] | undefined;
+        signal?: AbortSignal | undefined;
+        context?: {
+            sessionId?: string;
+            kanban?: {
+                boardId?: string;
+                taskId?: string;
+                projectRoot?: string;
+                leaseId?: string;
+                managementToken?: string;
+            };
+        } | undefined;
         name?: string | undefined;
         allowedCapabilities?: readonly string[] | undefined;
         onDone?: ((result: {

package/dist/boot/short-circuit-desktop.d.ts

@@ -1,3 +1,4 @@
+export declare function desktopExecutableCandidates(platform: string, home: string, env: NodeJS.ProcessEnv): string[];
 export declare function stripDesktopLauncherArgs(argv: string[]): string[];
 export declare function selectDesktopLauncherExecutable(execPath: string, runningUnderBun: boolean, nodeOverride?: string): string;
 export declare function handleDesktopShortCircuit(flags: Record<string, string | boolean>, argv: string[]): Promise<number | null>;

package/dist/boot/tui-project-picker-callback.d.ts

@@ -26,5 +26,5 @@ export declare function getProjectPickerItems(ctx: ProjectPickerContext): Promis
  * per-project session writer, rebuilt system prompt, and no spawned
  * replacement process.
  */
-export declare function onProjectSelect(ctx: ProjectPickerContext, slug: string, kind: 'project' | 'action'): Promise<void>;
+export declare function onProjectSelect(ctx: ProjectPickerContext, slug: string, kind: 'project' | 'action'): Promise<string | null>;
 //# sourceMappingURL=tui-project-picker-callback.d.ts.map

package/dist/boot/tui-settings-adapter.d.ts

@@ -1,9 +1,22 @@
-import type { ConfigStore, FleetChatVerbosity } from '@wrongstack/core/types';
-import { type WstackPaths } from '@wrongstack/core/utils';
+/**
+ * TUI Settings adapter — extracted from the runTui() options literal.
+ *
+ * Phase C step 1. The getSettings/saveSettings pair (~337 lines) reads
+ * config from the ConfigStore and persists changes to disk. This module
+ * owns both functions, receiving its dependencies through a typed context.
+ *
+ * `getSettings()` maps the full Config into the flat LiveSettingsInput
+ * shape the TUI SettingsPicker consumes. `saveSettings()` does the
+ * reverse: read → modify → encrypt → atomic-write for every section,
+ * then syncs the in-memory store and applies live runtime effects.
+ */
+import type { ConfigStore, FleetChatVerbosity, SecretVault } from '@wrongstack/core/types';
+import type { WstackPaths } from '@wrongstack/core/utils';
 import type { LiveSettingsInput } from '../live-settings-input.js';
 interface SettingsAdapterContext {
     configStore: ConfigStore;
     wpaths: WstackPaths;
+    vault: SecretVault;
     fleetStreamController: {
         setMode?: ((mode: FleetChatVerbosity) => void) | undefined;
     } | undefined;

package/dist/{boot-auto-thin-MANHOYHE.js → boot-auto-thin-6Q56FY3F.js}

@@ -1,9 +1,10 @@
 import {
   persistConfigSetting
-} from "./chunk-JACOMTIH.js";
+} from "./chunk-SFBFYIOW.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
+import "./chunk-WSTVGC2C.js";
 
 // src/boot/boot-auto-thin.ts
 import {
@@ -98,4 +99,4 @@ async function runBootAutoThin(deps) {
 export {
   runBootAutoThin
 };
-//# sourceMappingURL=boot-auto-thin-MANHOYHE.js.map
+//# sourceMappingURL=boot-auto-thin-6Q56FY3F.js.map

package/dist/{chunk-6WRKAACA.js → chunk-2BKFWIER.js}

@@ -1,7 +1,7 @@
 import {
   API_VERSION,
   CLI_VERSION
-} from "./chunk-XJXDOF63.js";
+} from "./chunk-YBUCXXYZ.js";
 
 // src/subcommands/handlers/version-help.ts
 import * as os from "node:os";
@@ -37,6 +37,8 @@ var helpCmd = async (_args, deps) => {
     "  wstack config [show|edit]    Show or edit effective config",
     "  wstack tools                 List registered tools",
     "  wstack skills                List discovered skills",
+    "  wstack typesafe              TypeSafe account: status, login, test, lint-conventions",
+    "  wstack skill-suggest         Preview/tune the TypeSafe skill suggester",
     "  wstack providers [--all]     List providers from models.dev",
     "  wstack models [<provider>]   List models",
     "  wstack models refresh        Force-refresh cache",
@@ -93,4 +95,4 @@ export {
   versionCmd,
   helpCmd
 };
-//# sourceMappingURL=chunk-6WRKAACA.js.map
+//# sourceMappingURL=chunk-2BKFWIER.js.map

package/dist/{chunk-JY52HWL6.js → chunk-2EBVTYJR.js}

@@ -246,7 +246,7 @@ async function dispatch(controller, commandId, type, payload) {
       }
       const toolUseId = typeof payload["toolUseId"] === "string" ? payload["toolUseId"] : "";
       const decision = payload["decision"];
-      if (toolUseId.length === 0 || decision !== "yes" && decision !== "no" && decision !== "always" && decision !== "deny") {
+      if (toolUseId.length === 0 || decision !== "yes" && decision !== "no" && decision !== "always" && decision !== "always-exact" && decision !== "always-command" && decision !== "always-tool" && decision !== "deny") {
         return { commandId, status: "rejected", message: "malformed approve command" };
       }
       const applied = resolveApproval(toolUseId, decision, sessionId);
@@ -320,4 +320,4 @@ export {
   createProjectKanbanAssignHandler,
   createHqCommandDispatcher
 };
-//# sourceMappingURL=chunk-JY52HWL6.js.map
+//# sourceMappingURL=chunk-2EBVTYJR.js.map

package/dist/chunk-3OCUS3VN.js

@@ -0,0 +1,46 @@
+import {
+  activeProfileConfigPath
+} from "./chunk-YMXXOOFN.js";
+import {
+  mutateConfigProviders
+} from "./chunk-LUMETJFO.js";
+
+// src/wiring/provider-persisters.ts
+import {
+  applyProviderOAuthRefresh,
+  matchesActiveProviderCredential,
+  setOAuthTokenPersister,
+  setProviderModelPersister
+} from "@wrongstack/providers";
+import { applyProviderOAuthRefresh as applyProviderOAuthRefresh2 } from "@wrongstack/providers";
+function installProviderPersisters(args) {
+  const profileConfigPath = activeProfileConfigPath(args.paths, args.config);
+  setOAuthTokenPersister((providerId, creds, source) => {
+    void mutateConfigProviders(profileConfigPath, args.vault, (all) => {
+      const p = all[providerId];
+      if (!p) return;
+      applyProviderOAuthRefresh(p, creds, source);
+    }).catch(
+      () => args.logger?.warn(
+        `OAuth token refresh for "${providerId}" could not be saved. Sign-in may be required next session.`
+      )
+    );
+  });
+  setProviderModelPersister((providerId, models, source) => {
+    if (models.length === 0) return;
+    void mutateConfigProviders(profileConfigPath, args.vault, (all) => {
+      const p = all[providerId];
+      if (!p) return;
+      if (source && !matchesActiveProviderCredential(p, source)) return;
+      const live = models.map((m) => m.id);
+      if (p.models?.length === live.length && p.models.every((id, i) => id === live[i])) return;
+      p.models = live;
+    }).catch(() => args.logger?.warn(`Model discovery for "${providerId}" could not be saved.`));
+  });
+}
+
+export {
+  installProviderPersisters,
+  applyProviderOAuthRefresh2 as applyProviderOAuthRefresh
+};
+//# sourceMappingURL=chunk-3OCUS3VN.js.map

package/dist/chunk-424ORSE7.js

@@ -0,0 +1,56 @@
+
+// src/subcommands/index.ts
+var loaders = {
+  acp: async () => (await import("./acp-AJWSKWE5.js")).acpCmd,
+  init: async () => (await import("./init-DRMMFG2G.js")).initCmd,
+  auth: async () => (await import("./auth-GRBZ7Y3D.js")).authCmd,
+  update: async () => (await import("./update-7XIOEXTD.js")).updateCmd,
+  sessions: async () => (await import("./sessions-config-IQUH2GXT.js")).sessionsCmd,
+  config: async () => (await import("./sessions-config-IQUH2GXT.js")).configCmd,
+  "config-export": async () => (await import("./config-transfer-RUWLDCNK.js")).configExportCmd,
+  "config-import": async () => (await import("./config-transfer-RUWLDCNK.js")).configImportCmd,
+  rewind: async () => (await import("./rewind-JA3ZLCNM.js")).rewindCmd,
+  replay: async () => (await import("./replay-JJ2NOWD6.js")).replayCmd,
+  audit: async () => (await import("./audit-46YK5DSC.js")).auditCmd,
+  tools: async () => (await import("./tools-skills-GH24UCBY.js")).toolsCmd,
+  skills: async () => (await import("./tools-skills-GH24UCBY.js")).skillsCmd,
+  "skill-suggest": async () => (await import("./skill-suggest-L2EVWB6R.js")).skillSuggestCmd,
+  typesafe: async () => (await import("./typesafe-HVEVPA6R.js")).typesafeCmd,
+  providers: async () => (await import("./providers-models-2CFG46RD.js")).providersCmd,
+  models: async () => (await import("./providers-models-2CFG46RD.js")).modelsCmd,
+  mcp: async () => (await import("./mcp-LBS45HWZ.js")).mcpCmd,
+  plugin: async () => (await import("./plugin-usage-S5LVGMBW.js")).pluginCmd,
+  plugins: async () => (await import("./plugin-usage-S5LVGMBW.js")).pluginCmd,
+  diag: async () => (await import("./diag-doctor-WIFJH3XH.js")).diagCmd,
+  doctor: async () => (await import("./diag-doctor-WIFJH3XH.js")).doctorCmd,
+  "proxy-status": async () => (await import("./diag-doctor-WIFJH3XH.js")).proxyCmd,
+  export: async () => (await import("./export-VVRIOWFV.js")).exportCmd,
+  usage: async () => (await import("./plugin-usage-S5LVGMBW.js")).usageCmd,
+  version: async () => (await import("./version-help-WZ623NWM.js")).versionCmd,
+  help: async () => (await import("./version-help-WZ623NWM.js")).helpCmd,
+  projects: async () => (await import("./projects-LMNAGGEU.js")).projectsCmd,
+  modeldiag: async () => (await import("./modeldiag-36OGAL5C.js")).modeldiagCmd,
+  quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
+  bench: async () => (await import("./bench-N5K7Z5O3.js")).benchCmd,
+  chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
+  hq: async () => (await import("./hq-JTUTFI4L.js")).hqCmd,
+  mailbox: async () => (await import("./mailbox-serve-WDOCH6KR.js")).mailboxServeCmd,
+  permissions: async () => (await import("./permissions-CFDLXETM.js")).permissionsCmd,
+  project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
+  governance: async () => (await import("./governance-RYSHV675.js")).governanceCmd
+};
+var subcommands = Object.fromEntries(
+  Object.entries(loaders).map(
+    ([name, load]) => [
+      name,
+      async (args, deps) => (await load())(args, deps)
+    ]
+  )
+);
+var subcommandNames = Object.keys(loaders);
+
+export {
+  subcommands,
+  subcommandNames
+};
+//# sourceMappingURL=chunk-424ORSE7.js.map

package/dist/{chunk-KEPABQYT.js → chunk-5SEYGOCH.js}

@@ -1,3 +1,6 @@
+import {
+  resolveProviderCfgWithProxy
+} from "./chunk-S4FFHDJG.js";
 import {
   fallbackCodexProviderModels,
   filterCurrentCodexModelIds,
@@ -140,83 +143,6 @@ async function refreshAcpRegistry(paths, opts) {
   return { count: result.agents.length, location, fetchedAt: result.fetchedAt };
 }
 
-// src/wiring/provider-runtime.ts
-import { makeProviderFromConfig } from "@wrongstack/providers";
-import {
-  getProxyConfig,
-  isProxyEligible,
-  rewriteBaseUrl,
-  sanitizeUrlForLog,
-  shouldRewriteFor
-} from "@wrongstack/core/wiring/proxy-rewrite";
-function resolveProviderCfg(config, providerId, opts) {
-  const savedCfg = config.providers?.[providerId];
-  const rawBaseUrl = savedCfg?.baseUrl ?? config.baseUrl;
-  let rewriteReason = "no-base-url";
-  let baseUrl = rawBaseUrl;
-  if (rawBaseUrl && shouldRewriteFor(providerId)) {
-    const rewritten = rewriteBaseUrl(rawBaseUrl, currentProxyBaseUrl());
-    if (rewritten !== rawBaseUrl) {
-      rewriteReason = "applied";
-      baseUrl = rewritten;
-    } else {
-      rewriteReason = passthroughReason(rawBaseUrl);
-    }
-  } else if (rawBaseUrl) {
-    rewriteReason = proxySkipReason(providerId);
-  }
-  opts?.logger?.info(
-    `WrongProxy rewrite ${rewriteReason} for provider '${providerId}': ${sanitizeUrlForLog(rawBaseUrl) || "<none>"} -> ${sanitizeUrlForLog(baseUrl) || "<none>"}`
-  );
-  const cfg = {
-    ...savedCfg,
-    apiKey: savedCfg?.apiKey ?? config.apiKey,
-    baseUrl,
-    type: providerId
-  };
-  const factoryType = savedCfg?.type ?? providerId;
-  return { cfg, factoryType };
-}
-function passthroughReason(rawBaseUrl) {
-  if (!rawBaseUrl.includes("://")) return "no-scheme";
-  const proxyRoot = currentProxyBaseUrl().replace(/\/+$/, "");
-  if (proxyRoot && rawBaseUrl.startsWith(`${proxyRoot}/proxy/`)) {
-    return "already-rewritten";
-  }
-  try {
-    const parsed = new URL(rawBaseUrl);
-    const host = parsed.hostname;
-    const isLoopback = host === "localhost" || host === "127.0.0.1" || host === "[::1]";
-    if (isLoopback && parsed.port !== "") return "loopback";
-  } catch {
-  }
-  return "ineligible";
-}
-function proxySkipReason(providerId) {
-  const cfg = getProxyConfig();
-  if (!cfg.enabled) return "disabled";
-  if (!cfg.url) return "no-proxy-url";
-  if (!cfg.active) return "inactive";
-  if (!isProxyEligible(providerId)) return "excluded";
-  return "unknown";
-}
-function currentProxyBaseUrl() {
-  return getProxyConfig().url;
-}
-function resolveProviderCfgWithProxy(config, providerId, opts) {
-  return resolveProviderCfg(config, providerId, opts);
-}
-function buildProviderForId(args, providerId) {
-  const { cfg, factoryType } = resolveProviderCfg(args.config, providerId, {
-    logger: args.logger
-  });
-  const useRegistry = !!args.config.features.modelsRegistry && args.providerRegistry.has(factoryType);
-  return useRegistry ? args.providerRegistry.create(cfg, factoryType) : makeProviderFromConfig(
-    providerId,
-    factoryType === "ai-gateway" ? { ...cfg, type: factoryType } : cfg
-  );
-}
-
 // src/shutdown-cleanup.ts
 function createGracefulShutdown(cleanup) {
   const exitCode = cleanup.exitCode ?? 0;
@@ -269,7 +195,8 @@ import {
   createSetupProviderFactory,
   installCatalogModelOutputLimits,
   isSetupProvider,
-  makeProviderFromConfig as makeProviderFromConfig2,
+  makeProviderFromConfig,
+  setStreamTimeoutDefaults,
   setupProviderResolved,
   withCatalogCapabilities
 } from "@wrongstack/providers";
@@ -339,6 +266,7 @@ async function setupProvider(params) {
       context: { provider: config.provider, family: resolvedProvider.npm, kind: "unsupported" }
     });
   }
+  setStreamTimeoutDefaults(config.modelRuntime?.streaming);
   if (config.features.modelsRegistry) {
     await installCatalogModelOutputLimits({
       registry: modelsRegistry,
@@ -379,7 +307,7 @@ Try \`wstack models refresh\` once you have network access.`,
     if (providerRegistry.has(factoryType)) {
       provider = providerRegistry.create(cfgWithType, factoryType);
     } else {
-      provider = makeProviderFromConfig2(config.provider, { ...cfgWithType, type: factoryType });
+      provider = makeProviderFromConfig(config.provider, { ...cfgWithType, type: factoryType });
     }
   } catch (err) {
     throw new ConfigError({
@@ -405,9 +333,7 @@ export {
   formatAcpAgentList,
   loadCachedAcpRegistry,
   refreshAcpRegistry,
-  resolveProviderCfg,
-  buildProviderForId,
   setupProvider,
   createGracefulShutdown
 };
-//# sourceMappingURL=chunk-KEPABQYT.js.map
+//# sourceMappingURL=chunk-5SEYGOCH.js.map