@wrongstack/cli 1.0.17 → 1.0.24

package/dist/skill-suggest-L2EVWB6R.js

@@ -0,0 +1,290 @@
+
+// src/subcommands/handlers/skill-suggest.ts
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import {
+  buildSuggesterFromConfig,
+  parseEvalJsonl,
+  scoreSuggestions,
+  sweepThresholds,
+  unknownGoldLabels
+} from "@wrongstack/core/skills";
+import { estimateTypeSafeCostUsd } from "@wrongstack/core/typesafe";
+import { color } from "@wrongstack/core/utils";
+var SWEEP_STEPS = [0.1, 0.2, 0.3, 0.4, 0.5, 0.6];
+var EVAL_WORKERS = 4;
+var USAGE = [
+  "Usage:",
+  '  wstack skill-suggest "<request>"              preview one request',
+  "  wstack skill-suggest --eval <file.jsonl>      score a labeled set",
+  "  wstack skill-suggest --eval <file.jsonl> --sweep   \u2026and sweep thresholds",
+  "",
+  "Eval file: one JSON object per line.",
+  '  {"text": "cut a release branch for 1.2.0", "gold": "git-flow"}',
+  '  {"text": "explain what a monad is"}            // nothing covers it',
+  "",
+  "Both modes send request text to the configured TypeSafe/OpenRouter route.",
+  "Configure its key with `wstack typesafe login` and verify with `wstack typesafe test`."
+].join("\n");
+var skillSuggestCmd = async (args, deps) => {
+  const write = (line) => deps.renderer.write(`${line}
+`);
+  const flags = deps.flags ?? {};
+  const evalFile = typeof flags["eval"] === "string" ? flags["eval"] : void 0;
+  const sweep = flags["sweep"] === true || flags["sweep"] === "true";
+  const positional = args.filter((a) => !a.startsWith("-"));
+  if (flags["help"] === true || flags["h"] === true) {
+    write(USAGE);
+    return 0;
+  }
+  if (!evalFile && positional.length === 0) {
+    write(USAGE);
+    return 1;
+  }
+  const built = buildSuggesterFromConfig({
+    config: deps.config,
+    skillLoader: deps.skillLoader
+  });
+  if ("error" in built) {
+    write(color.red(`skill-suggest: ${built.error}`));
+    return 1;
+  }
+  const { suggester } = built;
+  if (evalFile) {
+    return runEval({
+      file: path.resolve(deps.cwd, evalFile),
+      sweep,
+      suggester,
+      rosterNames: (await deps.skillLoader?.list())?.map((s) => s.name) ?? [],
+      write
+    });
+  }
+  const request = positional.join(" ").trim();
+  if (!request) {
+    write(color.red("skill-suggest: give a request to preview, or --eval <file>"));
+    return 1;
+  }
+  return runPreview({ request, suggester, write, config: deps.config });
+};
+async function runPreview(input) {
+  const { write } = input;
+  const gateThreshold = input.config.skills?.suggest?.gateThreshold ?? 0.3;
+  const fitsThreshold = input.config.skills?.suggest?.fitsThreshold ?? 0.3;
+  const started = Date.now();
+  const trace = await input.suggester.explain(input.request);
+  const elapsed = Date.now() - started;
+  write("");
+  write(color.dim(`  "${truncate(input.request, 72)}"`));
+  write("");
+  if (trace.stop === "error") {
+    write(color.red("  the suggester failed \u2014 no answer to show"));
+    write(color.dim("  check the API key, the endpoint, and network reachability"));
+    return 1;
+  }
+  if (trace.stop === "roster-too-small") {
+    write(color.yellow("  roster has fewer than 2 visible skills \u2014 nothing to choose between"));
+    return 0;
+  }
+  write(
+    `  ${label("gate")} ${bar(trace.gate)} ${pct(trace.gate)} ${verdictWord(trace.gate >= gateThreshold, gateThreshold)}`
+  );
+  for (const [key, value] of Object.entries(trace.gateValues)) {
+    const inverted = key === "prose_suffices";
+    write(
+      color.dim(`      ${key.padEnd(34)} ${pct(value)}${inverted ? " (counts inverted)" : ""}`)
+    );
+  }
+  write("");
+  if (trace.ranked.length > 0) {
+    write(`  ${label("pass 1 \u2014 ranked")}`);
+    for (const entry of trace.ranked.slice(0, 5)) {
+      const shortlisted = trace.shortlist.includes(entry.name);
+      const line = `      ${pct(entry.probability).padStart(4)}  ${entry.name}`;
+      write(shortlisted ? line : color.dim(line));
+    }
+    write("");
+  }
+  if (trace.shortlist.length > 0 && Object.keys(trace.fits).length > 0) {
+    write(`  ${label("pass 2 \u2014 fits")}`);
+    for (const name of trace.shortlist) {
+      const value = trace.fits[name];
+      const marker = name === trace.winner ? color.cyan(" \u2190 choice") : "";
+      write(`      ${(value === void 0 ? "\u2014" : pct(value)).padStart(4)}  ${name}${marker}`);
+    }
+    write("");
+  }
+  const suggestion = trace.suggestion;
+  if (suggestion) {
+    write(`  ${color.green("suggests")} ${suggestion.name}`);
+  } else {
+    write(
+      `  ${color.yellow("suggests nothing")} ${color.dim(`(${stopReason(trace, gateThreshold, fitsThreshold)})`)}`
+    );
+  }
+  write(
+    color.dim(
+      `  ${trace.requests} request(s), ${elapsed}ms, ${trace.inputTokens} input tokens (~$${estimateTypeSafeCostUsd(trace.inputTokens).toFixed(6)})` + (trace.models.length > 0 ? ` \xB7 answered by ${trace.models.join(", ")}` : "")
+    )
+  );
+  write("");
+  return 0;
+}
+function stopReason(trace, gateThreshold, fitsThreshold) {
+  switch (trace.stop) {
+    case "gate":
+      return `gate ${pct(trace.gate)} below ${pct(gateThreshold)}`;
+    case "fits": {
+      const best = Math.max(...Object.values(trace.fits), 0);
+      return `best fit ${pct(best)} below ${pct(fitsThreshold)}`;
+    }
+    case "wide-failed":
+    case "rerank-failed":
+      return "the model returned no usable answer for that pass";
+    default:
+      return trace.stop;
+  }
+}
+async function runEval(input) {
+  const { write } = input;
+  let source;
+  try {
+    source = await fs.readFile(input.file, "utf8");
+  } catch {
+    write(color.red(`skill-suggest: cannot read ${input.file}`));
+    return 1;
+  }
+  const { requests, errors } = parseEvalJsonl(source);
+  for (const error of errors) {
+    write(color.yellow(`  line ${error.line}: ${error.reason}`));
+  }
+  if (requests.length === 0) {
+    write(color.red("skill-suggest: no usable cases in that file"));
+    return 1;
+  }
+  const unknown = unknownGoldLabels(requests, input.rosterNames);
+  if (unknown.length > 0) {
+    write(color.yellow(`  gold labels not in this roster: ${unknown.join(", ")}`));
+    write(color.yellow("  those cases can never be scored correct \u2014 fix or remove them"));
+    write("");
+  }
+  const covered = requests.filter((r) => r.gold).length;
+  write(
+    color.dim(
+      `  ${requests.length} cases (${covered} covered, ${requests.length - covered} uncovered) \u2192 up to ${requests.length * 2} TypeSafe requests`
+    )
+  );
+  write("");
+  const traces = await mapWithConcurrency(requests, EVAL_WORKERS, async (request) => ({
+    request,
+    // A sweep has to know what pass 2 WOULD have said below the configured
+    // gate, and a trace that stopped at the gate cannot answer that.
+    trace: await input.suggester.explain(request.text, void 0, { alwaysRerank: input.sweep })
+  }));
+  const inputTokens = traces.reduce((sum, row) => sum + row.trace.inputTokens, 0);
+  const models = [...new Set(traces.flatMap((row) => row.trace.models))];
+  write(
+    color.dim(
+      `  spent ${inputTokens} input tokens (~$${estimateTypeSafeCostUsd(inputTokens).toFixed(4)})` + (models.length > 0 ? ` \xB7 answered by ${models.join(", ")}` : "")
+    )
+  );
+  if (models.length > 1) {
+    write(
+      color.yellow(
+        "  Two model versions answered this run \u2014 the alias moved mid-run; re-run before trusting the sweep."
+      )
+    );
+  }
+  write("");
+  const failed = traces.filter((row) => row.trace.stop === "error").length;
+  if (failed > 0) {
+    write(color.yellow(`  ${failed} case(s) failed outright and count as "suggested nothing"`));
+    write("");
+  }
+  const byText = new Map(traces.map((row) => [row.request.text, row.trace]));
+  const { score, cases } = scoreSuggestions(
+    requests,
+    (request) => byText.get(request.text)?.suggestion?.name
+  );
+  writeScore(write, score);
+  const misses = cases.filter((c) => c.outcome === "wrong" || c.outcome === "needless");
+  if (misses.length > 0) {
+    write("");
+    write(`  ${label("worst cases")}`);
+    for (const miss of misses.slice(0, 10)) {
+      const wanted = miss.request.gold ?? "(nothing)";
+      write(color.dim(`      "${truncate(miss.request.text, 52)}"`));
+      write(`        wanted ${wanted}, got ${color.red(miss.suggested ?? "(nothing)")}`);
+    }
+    if (misses.length > 10) write(color.dim(`      \u2026and ${misses.length - 10} more`));
+  }
+  if (input.sweep) {
+    write("");
+    write(`  ${label("threshold sweep")}`);
+    write(
+      color.dim("      gate  fits  correct   wrong  missed  needless    (of covered / uncovered)")
+    );
+    const rows = sweepThresholds(traces, SWEEP_STEPS, SWEEP_STEPS);
+    for (const row of rows) {
+      const s = row.score;
+      write(
+        `      ${row.gateThreshold.toFixed(1)}   ${row.fitsThreshold.toFixed(1)}   ${pct(s.correct).padStart(6)}  ${pct(s.wrongSuggestion).padStart(6)}  ${pct(s.missed).padStart(6)}  ${pct(s.needless).padStart(8)}`
+      );
+    }
+    write("");
+    write(
+      color.dim(
+        "      These score the SUGGESTER against your labels, not what the agent then loads."
+      )
+    );
+    write(
+      color.dim(
+        "      Raising gate cuts needless suggestions and adds misses. Pick the one that costs you more."
+      )
+    );
+  }
+  write("");
+  return 0;
+}
+function writeScore(write, score) {
+  write(`  ${label("covered")} ${color.dim(`(${score.covered} cases)`)}`);
+  write(`      correct            ${pct(score.correct)}`);
+  write(`      wrong suggestion   ${pct(score.wrongSuggestion)}`);
+  write(`      suggested nothing  ${pct(score.missed)}`);
+  write(`  ${label("uncovered")} ${color.dim(`(${score.uncovered} cases)`)}`);
+  write(`      needless           ${pct(score.needless)}`);
+}
+async function mapWithConcurrency(items, limit, fn) {
+  const results = new Array(items.length);
+  let cursor = 0;
+  const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+    for (; ; ) {
+      const index = cursor++;
+      const item = items[index];
+      if (item === void 0) return;
+      results[index] = await fn(item);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}
+function pct(value) {
+  return `${(value * 100).toFixed(0)}%`;
+}
+function bar(value) {
+  const filled = Math.round(value * 10);
+  return color.dim(`[${"#".repeat(filled)}${".".repeat(10 - filled)}]`);
+}
+function label(text) {
+  return color.bold(text);
+}
+function verdictWord(passed, threshold) {
+  return passed ? color.green(`\u2265 ${pct(threshold)} \u2014 continue`) : color.yellow(`< ${pct(threshold)} \u2014 stop here`);
+}
+function truncate(text, max) {
+  const flat = text.replace(/\s+/g, " ").trim();
+  return flat.length <= max ? flat : `${flat.slice(0, max - 1)}\u2026`;
+}
+export {
+  skillSuggestCmd
+};
+//# sourceMappingURL=skill-suggest-L2EVWB6R.js.map

package/dist/slash-commands/effort.d.ts

@@ -1,6 +1,6 @@
 import { type ReasoningEffort, type SlashCommand } from '@wrongstack/core/types';
-import type { SlashCommandContext } from './command-context.js';
 import type { WstackPaths } from '@wrongstack/core/utils';
+import type { SlashCommandContext } from './command-context.js';
 /**
  * `/effort` — view or set the SESSION-WIDE reasoning effort applied to the
  * active leader model. This is the quick, discoverable front-end for

package/dist/slash-commands/fallback.d.ts

@@ -1,4 +1,4 @@
-import { type SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommand } from '@wrongstack/core/types';
 import type { SlashCommandContext } from './command-context.js';
 /**
  * `/fallback` — view or change the cross-provider fallback chain that the

package/dist/slash-commands/gitid.d.ts

@@ -1,4 +1,4 @@
-import { type SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommand } from '@wrongstack/core/types';
 import type { SlashCommandContext } from './command-context.js';
 /**
  * `/gitid` — view or change the commit identity (author/committer name +

package/dist/slash-commands/jev.d.ts

@@ -0,0 +1,4 @@
+import type { SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommandContext } from './command-context.js';
+export declare function buildJevCommand(opts: SlashCommandContext): SlashCommand;
+//# sourceMappingURL=jev.d.ts.map

package/dist/slash-commands/openai-quota.d.ts

@@ -28,4 +28,19 @@ import type { SlashCommand } from '@wrongstack/core/types';
  */
 export declare function renderQuotaSnapshot(snapshot: ProviderQuotaSnapshot): string[];
 export declare function buildOpenAIQuotaCommand(): SlashCommand;
+/**
+ * `/provider-quota` — every metered subscription this session has heard from.
+ *
+ * The narrow `/openai-quota` above stays because it answers one question
+ * without making the user read past other providers; this one exists because
+ * the reporters are no longer Codex-only. Claude Pro/Max and GitHub Copilot
+ * report into the same store, and a session that is signed into two metered
+ * plans has no other way to see which one is about to run out.
+ *
+ * The name says `provider` on purpose. A bare `/quota` would read as "what
+ * this project costs" — an account-wide spend view that does not exist here —
+ * and would occupy the name if one is ever built. What this shows is exactly
+ * the provider plane's readings, so that is what it is called.
+ */
+export declare function buildProviderQuotaCommand(): SlashCommand;
 //# sourceMappingURL=openai-quota.d.ts.map

package/dist/slash-commands/sdd-task-mutations.d.ts

@@ -0,0 +1,4 @@
+export declare function executeSddTaskMutation(cmd: string, restJoined: string): {
+    message: string;
+};
+//# sourceMappingURL=sdd-task-mutations.d.ts.map

package/dist/slash-commands/settings-keys.d.ts

@@ -0,0 +1,2 @@
+export declare const ALL_SETTINGS_KEYS: string[];
+//# sourceMappingURL=settings-keys.d.ts.map

package/dist/slash-commands/settings-reset.d.ts

@@ -0,0 +1,6 @@
+import { persistConfigSetting } from '../settings-menu.js';
+import type { SlashCommandContext } from './command-context.js';
+export declare function executeSettingsReset(rest: string[], persistDeps: Parameters<typeof persistConfigSetting>[0], opts: SlashCommandContext, profileName: string): Promise<{
+    message: string;
+}>;
+//# sourceMappingURL=settings-reset.d.ts.map

package/dist/standalone-update-MW47J3AK.js

@@ -0,0 +1,164 @@
+import {
+  STANDALONE_TARGET
+} from "./chunk-YBUCXXYZ.js";
+
+// src/standalone-update.ts
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { FetchError } from "@wrongstack/core/types";
+
+// src/release-asset-download.ts
+async function downloadReleaseAsset(url, timeoutMs, maxBytes) {
+  const res = await fetch(url, {
+    signal: AbortSignal.timeout(timeoutMs),
+    headers: { "User-Agent": "wrongstack-cli" },
+    redirect: "follow"
+  });
+  if (!res.ok) throw new Error(`download ${url} responded ${res.status}`);
+  const declared = Number(res.headers.get("content-length") ?? "0");
+  if (declared > maxBytes) throw new Error(`download ${url} is too large`);
+  if (!res.body) return Buffer.alloc(0);
+  const chunks = [];
+  let received = 0;
+  const reader = res.body.getReader();
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      received += value.byteLength;
+      if (received > maxBytes) {
+        await reader.cancel();
+        throw new Error(`download ${url} is too large`);
+      }
+      chunks.push(Buffer.from(value.buffer, value.byteOffset, value.byteLength));
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, received);
+}
+
+// src/standalone-update.ts
+var RELEASES_REPO = "WrongStack/WrongStack";
+var API_LATEST = `https://api.github.com/repos/${RELEASES_REPO}/releases/latest`;
+var MAX_BINARY_BYTES = 512 * 1024 * 1024;
+var MAX_CHECKSUM_BYTES = 1024 * 1024;
+function standaloneAssetName(target) {
+  const name = `wstack-${target.replace(/^bun-/, "")}`;
+  return target.startsWith("bun-windows") ? `${name}.exe` : name;
+}
+async function fetchLatestRelease(timeoutMs, signal) {
+  const timeoutSignal = AbortSignal.timeout(timeoutMs);
+  const res = await fetch(API_LATEST, {
+    signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
+    headers: { Accept: "application/vnd.github+json", "User-Agent": "wrongstack-cli" }
+  });
+  if (!res.ok) {
+    throw new FetchError({
+      message: `GitHub releases responded ${res.status}`,
+      status: res.status,
+      context: { op: "checkForUpdate", registry: "github-releases", url: API_LATEST }
+    });
+  }
+  const data = await res.json();
+  if (typeof data.tag_name !== "string") throw new Error("Latest release has no tag");
+  const assets = Array.isArray(data.assets) ? data.assets.filter(
+    (a) => typeof a?.name === "string" && typeof a?.browser_download_url === "string"
+  ) : [];
+  return { version: data.tag_name.replace(/^v/, ""), assets };
+}
+async function fetchLatestStandaloneVersion(timeoutMs = 3e3, signal) {
+  return (await fetchLatestRelease(timeoutMs, signal)).version;
+}
+function parseSha256Sums(text) {
+  const sums = /* @__PURE__ */ new Map();
+  for (const line of text.split(/\r?\n/)) {
+    const match = line.trim().match(/^([0-9a-f]{64})\s+\*?(.+)$/i);
+    if (match?.[1] && match[2]) {
+      const name = match[2].trim();
+      if (sums.has(name)) throw new Error(`Duplicate SHA256SUMS entry: ${name}`);
+      sums.set(name, match[1].toLowerCase());
+    }
+  }
+  return sums;
+}
+function replaceExecutable(target, bytes, platform = process.platform) {
+  const staged = `${target}.new-${process.pid}`;
+  fs.writeFileSync(staged, bytes, { mode: 493 });
+  try {
+    if (platform === "win32") {
+      const aside = `${target}.old`;
+      fs.rmSync(aside, { force: true });
+      fs.renameSync(target, aside);
+      try {
+        fs.renameSync(staged, target);
+      } catch (error) {
+        fs.renameSync(aside, target);
+        throw error;
+      }
+    } else {
+      fs.renameSync(staged, target);
+    }
+  } finally {
+    fs.rmSync(staged, { force: true });
+  }
+}
+async function updateStandaloneBinary(options) {
+  const { renderer } = options;
+  if (!STANDALONE_TARGET) {
+    renderer.write("Update failed: this executable does not record its build target.\n");
+    return 1;
+  }
+  const assetName = standaloneAssetName(STANDALONE_TARGET);
+  try {
+    const release = await fetchLatestRelease(15e3);
+    const asset = release.assets.find((a) => a.name === assetName);
+    const sumsAsset = release.assets.find((a) => a.name === "SHA256SUMS");
+    if (!asset || !sumsAsset) {
+      renderer.write(`Update failed: release v${release.version} has no ${assetName} build.
+`);
+      return 1;
+    }
+    renderer.write(`Updating wrongstack from v${options.current} to v${release.version}...
+`);
+    renderer.write(`Downloading ${assetName}
+`);
+    const [bytes, sumsText] = await Promise.all([
+      downloadReleaseAsset(asset.browser_download_url, 6e5, MAX_BINARY_BYTES),
+      downloadReleaseAsset(sumsAsset.browser_download_url, 3e4, MAX_CHECKSUM_BYTES).then(
+        (b) => b.toString("utf8")
+      )
+    ]);
+    const expected = parseSha256Sums(sumsText).get(assetName);
+    const actual = createHash("sha256").update(bytes).digest("hex");
+    if (!expected || expected !== actual) {
+      renderer.write("Update failed: checksum does not match the release SHA256SUMS.\n");
+      return 1;
+    }
+    const executable = fs.realpathSync(process.execPath);
+    replaceExecutable(executable, bytes);
+    renderer.write(
+      `
+Updated ${path.basename(executable)} to v${release.version}. Restart wrongstack to use it.
+`
+    );
+    return 0;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const permission = /EACCES|EPERM/.test(msg) ? "\nThe executable is not writable by this user; rerun with the permissions it was installed with." : "";
+    renderer.write(`
+Update failed: ${msg}${permission}
+`);
+    return 1;
+  }
+}
+export {
+  RELEASES_REPO,
+  fetchLatestStandaloneVersion,
+  parseSha256Sums,
+  replaceExecutable,
+  standaloneAssetName,
+  updateStandaloneBinary
+};
+//# sourceMappingURL=standalone-update-MW47J3AK.js.map

package/dist/standalone-update.d.ts

@@ -0,0 +1,19 @@
+import type { TerminalRenderer } from './renderer.js';
+export declare const RELEASES_REPO = "WrongStack/WrongStack";
+/** Asset name a build target publishes under (mirrors build-binaries.mjs `outputName`). */
+export declare function standaloneAssetName(target: string): string;
+/** Latest released version, for the update check. */
+export declare function fetchLatestStandaloneVersion(timeoutMs?: number, signal?: AbortSignal): Promise<string>;
+/** `<sha256>  <name>` lines → map. */
+export declare function parseSha256Sums(text: string): Map<string, string>;
+/**
+ * Replace `target` with `bytes`. Staged next to the target so the final step
+ * is a same-filesystem rename.
+ */
+export declare function replaceExecutable(target: string, bytes: Buffer, platform?: NodeJS.Platform): void;
+/** `wstack update` for the standalone binary. Returns the process exit code. */
+export declare function updateStandaloneBinary(options: {
+    current: string;
+    renderer: Pick<TerminalRenderer, 'write'>;
+}): Promise<number>;
+//# sourceMappingURL=standalone-update.d.ts.map

package/dist/subcommands/handlers/hq-alerts.d.ts

@@ -0,0 +1,3 @@
+import type { SubcommandDeps } from '../contracts.js';
+export declare function hqAlertsCmd(args: string[], deps: SubcommandDeps): Promise<number>;
+//# sourceMappingURL=hq-alerts.d.ts.map

package/dist/subcommands/handlers/hq-audit.d.ts

@@ -0,0 +1,46 @@
+import type { SubcommandDeps } from '../contracts.js';
+/**
+ * `wstack hq audit verify` — re-derive the contentHash from the current
+ * on-disk `auth.json` and print it so an operator can compare against a
+ * `contentHash` field in an audit entry. This closes the forensic
+ * tie-back loop without requiring the operator to write a script: copy
+ * the hash from the audit log, run this command, eyeball (or `diff`)
+ * the two values.
+ *
+ * Prints:
+ *   - the resolved `auth.json` path (so the operator knows which file
+ *     was hashed)
+ *   - the SHA-256 contentHash, or `(unavailable)` if the file is
+ *     missing/unreadable
+ *   - the `auth-audit.jsonl` path (so the operator knows where to look
+ *     for entries to compare against)
+ *
+ * Exit codes:
+ *   0 — hash computed and printed
+ *   1 — `auth.json` missing or unreadable (hash unavailable); the
+ *       audit-log path is still printed so the operator can inspect
+ *       historical entries
+ */
+export declare function hqAuditCmd(args: string[], deps: SubcommandDeps): Promise<number>;
+/**
+ * Re-read the persisted `auth.json` and return a conditional
+ * `contentHash` field for embedding in an audit entry. This closes the
+ * forensic tie-back loop: an operator reviewing `auth-audit.jsonl` can
+ * compare the `contentHash` against the current on-disk file via
+ * `wstack hq audit verify`.
+ *
+ * Re-reads rather than hashing the in-memory post-mutation snapshot
+ * because `writeHqAuthFile` re-stamps `updatedAt` on the persisted
+ * payload — hashing the in-memory `next` would diverge from what
+ * `verify` computes. Matches the pattern established by the `first-run`
+ * and `expired-prune` emitters in `auth-store.ts` / `hq-server.ts`.
+ *
+ * Returns `{}` (no `contentHash` key) when the file is unreadable, so
+ * the audit entry still records the event without a tie-back — the
+ * absence itself is meaningful. Conditional spread preserves
+ * `exactOptionalPropertyTypes`.
+ */
+export declare function computeAuditHashField(dataDir: string, warn: (msg: string) => void): Promise<{
+    contentHash?: string;
+}>;
+//# sourceMappingURL=hq-audit.d.ts.map

package/dist/subcommands/handlers/hq-data-dir.d.ts

@@ -0,0 +1,13 @@
+import type { SubcommandDeps } from '../contracts.js';
+/**
+ * Build a free-form actor string for the auth audit log. Combines the OS
+ * username (best-effort) with the hostname so an operator reviewing the
+ * log can see "who minted this token" without parsing environment
+ * variables. Never includes the token string.
+ *
+ * Shared by the `wstack hq token` create/revoke handlers and by
+ * `startHqServer`'s first-run bootstrap so every audit entry point
+ * produces the same actor shape.
+ */
+export declare function resolveDataDir(deps: SubcommandDeps): string;
+//# sourceMappingURL=hq-data-dir.d.ts.map

package/dist/subcommands/handlers/skill-suggest.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `wstack skill-suggest` — inspect and tune the TypeSafe skill suggester.
+ *
+ * The suggester runs inside a turn and its output is one line of system prompt,
+ * which makes it almost impossible to observe in place: you see the agent load
+ * a skill, not why. Two modes make it inspectable:
+ *
+ *   wstack skill-suggest "<request>"        one request, both passes, all numbers
+ *   wstack skill-suggest --eval cases.jsonl labeled set, scored
+ *   wstack skill-suggest --eval cases.jsonl --sweep   …plus a threshold table
+ *
+ * Both work whether or not `skills.suggest.enabled` is on — previewing is how
+ * you decide whether to turn it on. Both need a TypeSafe API key, and both send
+ * request text to TypeSafe, so `--eval` prints what it is about to spend before
+ * it spends it.
+ */
+import { type LabeledRequest, type ScoredCase } from '@wrongstack/core/skills';
+import type { SubcommandHandler } from '../contracts.js';
+export declare const skillSuggestCmd: SubcommandHandler;
+export type { LabeledRequest, ScoredCase };
+//# sourceMappingURL=skill-suggest.d.ts.map

package/dist/subcommands/handlers/typesafe-brain-replay.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `wstack typesafe replay-brain-ledger` — calibrate the Brain's System One
+ * tier on decisions this project already made.
+ *
+ * The Brain ledger records every decision (question, chosen option, which tier
+ * or council settled it) and, for interventions, whether the same signal fired
+ * again afterwards. It does not record the option list or the full context —
+ * but the BrainMonitor signals (file churn, tool-failure streak, stall, error
+ * storm) always ask the same steer/continue question with a context the
+ * question text already carries, so those requests can be rebuilt exactly.
+ *
+ * Each rebuilt request goes through `probeSystemOneBrain` (the tier's real
+ * questions, no thresholds), and the report compares Jev's pick with the
+ * recorded one: overall agreement, how much the current thresholds would
+ * settle and how often those settled picks agree, a threshold sweep, and how
+ * often Jev said `continue` on a steer the ledger shows was futile (the same
+ * signal re-fired).
+ *
+ * The recorded pick is a reference, not ground truth: most were made by the
+ * council or a policy, and the outcome record only exists for steers. The
+ * decision digest the live tier sees is omitted — rebuilding it from the
+ * ledger would leak later outcomes into earlier decisions.
+ */
+import type { SubcommandDeps } from '../contracts.js';
+export declare function replayBrainLedger(deps: SubcommandDeps, write: (line: string) => void): Promise<number>;
+//# sourceMappingURL=typesafe-brain-replay.d.ts.map

package/dist/subcommands/handlers/typesafe-judgment-check.d.ts

@@ -0,0 +1,3 @@
+import type { SubcommandDeps } from '../contracts.js';
+export declare function checkJudgments(deps: SubcommandDeps, write: (line: string) => void): Promise<number>;
+//# sourceMappingURL=typesafe-judgment-check.d.ts.map