@wrongstack/cli 1.0.19 → 1.0.24

package/dist/{per-subcommand-help-DHTYU524.js → per-subcommand-help-XE77MTGJ.js}

@@ -7,8 +7,8 @@ import {
   renderFocusedHelpToString,
   renderGenericHelp,
   subcommandsWithFocusedHelp
-} from "./chunk-JX6KL7OF.js";
-import "./chunk-2VMJ3E5Z.js";
+} from "./chunk-SKPDE62W.js";
+import "./chunk-YTEOAWOJ.js";
 export {
   deepSubcommandsWithFocusedHelp,
   renderBlockToString,
@@ -19,4 +19,4 @@ export {
   renderGenericHelp,
   subcommandsWithFocusedHelp
 };
-//# sourceMappingURL=per-subcommand-help-DHTYU524.js.map
+//# sourceMappingURL=per-subcommand-help-XE77MTGJ.js.map

package/dist/permission-prompt-mirror.d.ts

@@ -28,7 +28,7 @@
  */
 import type { ApprovalRegistry } from '@wrongstack/core/hq';
 import type { Tool } from '@wrongstack/core/types';
-type PromptDecision = 'yes' | 'no' | 'always' | 'deny';
+type PromptDecision = 'yes' | 'no' | 'always' | 'always-exact' | 'always-command' | 'always-tool' | 'deny';
 type PromptDelegate = (tool: Tool, input: unknown, suggestedPattern: string) => Promise<PromptDecision>;
 type AbortablePromptDelegate = (tool: Tool, input: unknown, suggestedPattern: string, signal: AbortSignal) => Promise<PromptDecision>;
 /**

package/dist/permission-prompt.d.ts

@@ -1,7 +1,7 @@
 import type { InputReader, Tool } from '@wrongstack/core/types';
-type PromptDecision = 'yes' | 'no' | 'always' | 'deny';
+type PromptDecision = 'yes' | 'no' | 'always' | 'always-exact' | 'always-command' | 'always-tool' | 'deny';
 /** Signature the Agent expects for confirming tool calls. */
-export type ConfirmAwaiter = (tool: Tool, input: unknown, toolUseId: string, suggestedPattern: string) => Promise<'yes' | 'no' | 'always' | 'deny'>;
+export type ConfirmAwaiter = (tool: Tool, input: unknown, toolUseId: string, suggestedPattern: string) => Promise<'yes' | 'no' | 'always' | 'always-exact' | 'always-command' | 'always-tool' | 'deny'>;
 /**
  * The terminal approval prompt.
  *

package/dist/plugin-config.d.ts

@@ -0,0 +1,12 @@
+import type { PluginConfig } from '@wrongstack/core/types';
+import type { PluginManagementDeps, PluginManagementResult } from './plugin-management-types.js';
+export declare function readConfig(file: string): Promise<Record<string, unknown>>;
+export declare function pluginName(p: string | PluginConfig): string;
+export declare function upsertPlugin(spec: string, opts: {
+    enabled: boolean;
+    path?: string;
+}, deps: PluginManagementDeps, verb: string): Promise<PluginManagementResult>;
+export declare function errorResult(message: string): PluginManagementResult;
+export declare function globalPluginsRoot(deps: PluginManagementDeps): string;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+//# sourceMappingURL=plugin-config.d.ts.map

package/dist/plugin-management-types.d.ts

@@ -0,0 +1,31 @@
+import type { Config, PluginConfig, PluginManagerConfig } from '@wrongstack/core/types';
+export interface PluginManagementDeps {
+    config: Config;
+    configPath: string;
+    /** Override `~/.wrongstack` for tests. Defaults to the real home dir. */
+    globalRoot?: string | undefined;
+    /** Injectable package-manager runner for tests. */
+    runPackageManager?: ((pm: string, args: readonly string[], cwd: string) => Promise<PackageManagerRunResult>) | undefined;
+}
+export interface PackageManagerRunResult {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+}
+export interface PluginManagementResult {
+    code: number;
+    level: 'output' | 'info' | 'error';
+    message: string;
+    patch?: {
+        plugins?: (string | PluginConfig)[] | undefined;
+        features?: Record<string, unknown>;
+        pluginManager?: PluginManagerConfig | undefined;
+        /**
+         * Full replacement `extensions` map (patchConfig is a SHALLOW merge,
+         * so per-plugin llm overrides must ship the whole merged object).
+         */
+        extensions?: Record<string, Record<string, unknown>> | undefined;
+    };
+    restartRequired?: boolean | undefined;
+}
+//# sourceMappingURL=plugin-management-types.d.ts.map

package/dist/plugin-management.d.ts

@@ -1,36 +1,8 @@
-import type { Config, PluginConfig, PluginManagerConfig } from '@wrongstack/core/types';
+import type { Config } from '@wrongstack/core/types';
 import { PLUGIN_AUDIT_ENTRIES, type PluginAuditEntry } from '@wrongstack/plugins/plugin-audit-catalog';
+import type { PluginManagementDeps, PluginManagementResult } from './plugin-management-types.js';
 export type { PluginAuditEntry };
 export { PLUGIN_AUDIT_ENTRIES };
-interface PluginManagementDeps {
-    config: Config;
-    configPath: string;
-    /** Override `~/.wrongstack` for tests. Defaults to the real home dir. */
-    globalRoot?: string | undefined;
-    /** Injectable package-manager runner for tests. */
-    runPackageManager?: ((pm: string, args: readonly string[], cwd: string) => Promise<PackageManagerRunResult>) | undefined;
-}
-interface PackageManagerRunResult {
-    code: number | null;
-    stdout: string;
-    stderr: string;
-}
-interface PluginManagementResult {
-    code: number;
-    level: 'output' | 'info' | 'error';
-    message: string;
-    patch?: {
-        plugins?: (string | PluginConfig)[] | undefined;
-        features?: Record<string, unknown>;
-        pluginManager?: PluginManagerConfig | undefined;
-        /**
-         * Full replacement `extensions` map (patchConfig is a SHALLOW merge,
-         * so per-plugin llm overrides must ship the whole merged object).
-         */
-        extensions?: Record<string, Record<string, unknown>> | undefined;
-    };
-    restartRequired?: boolean | undefined;
-}
 export declare function runPluginManagementCommand(args: string[], deps: PluginManagementDeps): Promise<PluginManagementResult>;
 export declare function renderConfiguredPlugins(config: Config): string;
 export declare function renderPluginAuditReport(config: Config): string;

package/dist/plugin-package-install.d.ts

@@ -0,0 +1,3 @@
+import type { PluginManagementDeps, PluginManagementResult } from './plugin-management-types.js';
+export declare function installPluginPackage(spec: string, args: string[], deps: PluginManagementDeps): Promise<PluginManagementResult>;
+//# sourceMappingURL=plugin-package-install.d.ts.map

package/dist/{plugin-usage-M6KET4OZ.js → plugin-usage-S5LVGMBW.js}

@@ -1,12 +1,13 @@
 import {
   runPluginManagementCommand
-} from "./chunk-SIS37L3W.js";
-import {
-  restoreFlags
-} from "./chunk-CSAPOCBP.js";
+} from "./chunk-L2RVEQWO.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
+import "./chunk-WSTVGC2C.js";
+import {
+  restoreFlags
+} from "./chunk-CSAPOCBP.js";
 
 // src/subcommands/handlers/plugin-usage.ts
 var pluginCmd = async (args, deps) => {
@@ -40,4 +41,4 @@ export {
   pluginCmd,
   usageCmd
 };
-//# sourceMappingURL=plugin-usage-M6KET4OZ.js.map
+//# sourceMappingURL=plugin-usage-S5LVGMBW.js.map

package/dist/{plugins-WJLW6ULV.js → plugins-RHBIVLI7.js}

@@ -6,9 +6,10 @@ import {
   pluginNameFromSpec,
   setupPlugins,
   warnIfDeprecatedPluginName
-} from "./chunk-XJ7K67PP.js";
+} from "./chunk-JF2MULWF.js";
 import "./chunk-EWKESL4L.js";
-import "./chunk-SIS37L3W.js";
+import "./chunk-L2RVEQWO.js";
+import "./chunk-WSTVGC2C.js";
 export {
   BUILTIN_PLUGIN_FACTORIES,
   DEPRECATED_PLUGIN_NAMES,
@@ -18,4 +19,4 @@ export {
   setupPlugins,
   warnIfDeprecatedPluginName
 };
-//# sourceMappingURL=plugins-WJLW6ULV.js.map
+//# sourceMappingURL=plugins-RHBIVLI7.js.map

package/dist/provider-config-utils.d.ts

@@ -1,6 +1,7 @@
 import { expectDefined } from '@wrongstack/core/utils';
 export { expectDefined };
 import type { ProviderApiKey, ProviderConfig, SecretVault } from '@wrongstack/core/types';
+export { clearStaleProviderDefaults } from '@wrongstack/providers';
 /**
  * Normalize a ProviderConfig to the canonical `apiKeys[]` form.
  * Migrates the legacy single-key `apiKey` field on the fly so every
@@ -26,12 +27,6 @@ export declare function writeKeysBack(cfg: ProviderConfig, keys: ProviderApiKey[
  * when present on a freshly-loaded config it may contain a masked value.
  */
 export declare function resolveActiveApiKey(cfg: ProviderConfig): string | undefined;
-/**
- * Clear top-level provider/model defaults when provider mutations make them
- * stale. This prevents a removed provider, deleted final key, or edited model
- * allowlist from being accepted on the next boot and crashing provider setup.
- */
-export declare function clearStaleProviderDefaults(config: Record<string, unknown>): void;
 /**
  * Return the label of the active key, or the first key's label if no
  * active is pinned. Returns `undefined` when there are no keys at all.

package/dist/{providers-models-LFNZ5WI7.js → providers-models-2CFG46RD.js}

@@ -6,15 +6,21 @@ import {
 } from "./chunk-YMXXOOFN.js";
 import {
   mutateConfigProviders
-} from "./chunk-DR2OXU46.js";
+} from "./chunk-LUMETJFO.js";
 
 // src/subcommands/handlers/providers-models.ts
 import * as fs from "node:fs/promises";
-import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
+import { decryptConfigSecretsForRewrite, encryptConfigSecrets } from "@wrongstack/core/security";
 import {
   ConfigError
 } from "@wrongstack/core/types";
-import { atomicWrite, color, expectDefined } from "@wrongstack/core/utils";
+import {
+  atomicWrite,
+  backupConfigFile,
+  color,
+  expectDefined,
+  withFileLock
+} from "@wrongstack/core/utils";
 var providersCmd = async (args, deps) => {
   const providerFlags = subcommandFlags(args, deps);
   const showAll = providerFlags["all"] === true || providerFlags["all"] === "true";
@@ -29,6 +35,7 @@ var providersCmd = async (args, deps) => {
       "openai-codex": [],
       "github-copilot": [],
       google: [],
+      "google-antigravity": [],
       unsupported: []
     };
     for (const p of all) byFamily[p.family].push(p);
@@ -508,34 +515,37 @@ async function modelsCaps(args, deps) {
 async function mutateModelsConfig(deps, mutator) {
   const vault = deps.vault;
   const configPath = activeProfileConfigPath(deps.paths, deps.config);
-  let fileExists = true;
-  let raw;
-  try {
-    raw = await fs.readFile(configPath, "utf8");
-  } catch (err) {
-    if (err.code !== "ENOENT") throw err;
-    fileExists = false;
-    raw = "{}";
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    if (fileExists) {
-      throw new ConfigError({
-        message: `Refusing to overwrite corrupt config at ${configPath} (${err.message}).`,
-        code: "CONFIG_PARSE_FAILED",
-        context: { filePath: configPath, operation: "mutateModelsConfig" }
-      });
+  await withFileLock(configPath, async () => {
+    let fileExists = true;
+    let raw;
+    try {
+      raw = await fs.readFile(configPath, "utf8");
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+      fileExists = false;
+      raw = "{}";
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (err) {
+      if (fileExists) {
+        throw new ConfigError({
+          message: `Refusing to overwrite corrupt config at ${configPath} (${err.message}).`,
+          code: "CONFIG_PARSE_FAILED",
+          context: { filePath: configPath, operation: "mutateModelsConfig" }
+        });
+      }
+      parsed = {};
     }
-    parsed = {};
-  }
-  const decrypted = decryptConfigSecrets(parsed, vault);
-  const models = decrypted.models ?? {};
-  mutator(models);
-  decrypted.models = models;
-  const encrypted = encryptConfigSecrets(decrypted, vault);
-  await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+    const decrypted = decryptConfigSecretsForRewrite(parsed, vault);
+    const models = decrypted.models ?? {};
+    mutator(models);
+    decrypted.models = models;
+    const encrypted = encryptConfigSecrets(decrypted, vault);
+    await backupConfigFile(configPath, { globalRoot: deps.paths.globalRoot });
+    await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  });
 }
 function parseSizeFlag(raw) {
   if (!raw) return void 0;
@@ -660,4 +670,4 @@ export {
   modelsCmd,
   providersCmd
 };
-//# sourceMappingURL=providers-models-LFNZ5WI7.js.map
+//# sourceMappingURL=providers-models-2CFG46RD.js.map

package/dist/release-asset-download.d.ts

@@ -0,0 +1,3 @@
+/** Download one release asset without buffering beyond its configured ceiling. */
+export declare function downloadReleaseAsset(url: string, timeoutMs: number, maxBytes: number): Promise<Buffer>;
+//# sourceMappingURL=release-asset-download.d.ts.map

package/dist/services/dispatch-classifier.d.ts

@@ -1,12 +1,46 @@
 /**
- * LLM-backed classifier for the smart agent dispatcher.
+ * Classifier for the smart agent dispatcher.
  *
- * Wraps the session provider in the `complete(prompt) => text` shape that
- * `makeLLMClassifier` expects, so `/fleet dispatch` can fall back to the model
- * when the heuristic router is ambiguous. Mirrors the one-shot completion
- * pattern used by `generateCommitMessageWithLLM`.
+ * Two implementations behind one seam:
+ *
+ *   - `makeTypeSafeDispatchClassifier` — one typed `Choice` over the candidate
+ *     roles plus a `Noul` that can decline. Used when `fleet.dispatch
+ *     .typesafeClassifier` is on and a `typesafe` account resolves.
+ *   - `makeLLMClassifier` — the historical path: render a prompt, ask the
+ *     session provider for prose, regex out the first `{...}`. Still the
+ *     default, and still the fallback when TypeSafe is unconfigured.
+ *
+ * Either way the dispatcher only reaches a classifier when its keyword
+ * heuristic is ambiguous, so this runs on a minority of dispatches.
  */
 import type { DispatchClassifier } from '@wrongstack/core/coordination';
+import type { Config } from '@wrongstack/core/types';
+import { type WarnSink } from '@wrongstack/core/typesafe';
 import type { CommitLLMProvider } from './commit-message.js';
+/**
+ * Wrap the session provider in the `complete(prompt) => text` shape
+ * `makeLLMClassifier` expects. Mirrors `generateCommitMessageWithLLM`.
+ */
 export declare function makeProviderClassifier(provider: CommitLLMProvider, model: string): DispatchClassifier;
+/**
+ * Pick the classifier this config asks for.
+ *
+ * Falls back to the provider classifier — never to nothing — when TypeSafe is
+ * requested but unconfigured. A missing API key is a setup problem, not a
+ * reason to lose the routing the user already had.
+ */
+export declare function makeDispatchClassifier(deps: {
+    config: Config;
+    provider: CommitLLMProvider;
+    model: string;
+    env?: NodeJS.ProcessEnv | undefined;
+    /**
+     * Where the one-time "you asked for this and it is not running" line goes.
+     * Only `warn` is required; `debug` carries per-request token accounting when
+     * the host has somewhere to put it.
+     */
+    logger?: (WarnSink & {
+        debug?(message: string): void;
+    }) | undefined;
+}): DispatchClassifier;
 //# sourceMappingURL=dispatch-classifier.d.ts.map

package/dist/{sessions-config-UL45XKX7.js → sessions-config-IQUH2GXT.js}

@@ -1,15 +1,16 @@
 import {
+  activeProfileConfigPath
+} from "./chunk-YMXXOOFN.js";
+import {
+  backupCurrent,
   getHistoryEntry,
   listHistory,
   restoreFromHistory,
   restoreLast
-} from "./chunk-B4JLSXZB.js";
+} from "./chunk-WSTVGC2C.js";
 import {
   restoreFlags
 } from "./chunk-CSAPOCBP.js";
-import {
-  activeProfileConfigPath
-} from "./chunk-YMXXOOFN.js";
 
 // src/subcommands/handlers/sessions-config.ts
 import { color as color2, expectDefined } from "@wrongstack/core/utils";
@@ -322,6 +323,13 @@ var configCmd = async (args, deps) => {
   if (sub === "edit") {
     const editor = process.env["EDITOR"] ?? "vi";
     deps.renderer.write(`Run: ${editor} ${activeProfileConfigPath(deps.paths, deps.config)}
+`);
+    return 0;
+  }
+  if (sub === "backup") {
+    const profileConfigPath = activeProfileConfigPath(deps.paths, deps.config);
+    await backupCurrent(void 0, profileConfigPath);
+    deps.renderer.write(`Backed up active profile config: ${profileConfigPath}.last
 `);
     return 0;
   }
@@ -418,4 +426,4 @@ export {
   configCmd,
   sessionsCmd
 };
-//# sourceMappingURL=sessions-config-UL45XKX7.js.map
+//# sourceMappingURL=sessions-config-IQUH2GXT.js.map

package/dist/settings-menu.d.ts

@@ -22,6 +22,8 @@ interface PersistSettingDeps {
      * from landing in the wrong profile when the mutator changes activeProfile.
      */
     resolveProfilePath?: ((profileName: string) => string) | undefined;
+    /** Skip the live ConfigStore mirror when a caller is persisting a secondary split target. */
+    updateStore?: boolean | undefined;
 }
 export declare function resolvePersistPath(deps: PersistSettingDeps): string;
 /**

package/dist/short-circuit-flags-SDT53OML.js

@@ -0,0 +1,10 @@
+import {
+  handleHelpVersionShortCircuit
+} from "./chunk-PGKJ2OQP.js";
+import "./chunk-2BKFWIER.js";
+import "./chunk-MHEBWVXL.js";
+import "./chunk-YBUCXXYZ.js";
+export {
+  handleHelpVersionShortCircuit
+};
+//# sourceMappingURL=short-circuit-flags-SDT53OML.js.map

package/dist/{simpleui-dist-CXSIDAXZ.js → simpleui-dist-7BQISSEP.js}

@@ -4,9 +4,13 @@ import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { createRequire } from "node:module";
 import * as path from "node:path";
+import { wrongstackPackageJsonPath } from "@wrongstack/core/utils";
+function resolveSimpleUiPackageJson(id, req) {
+  return wrongstackPackageJsonPath(id.replace(/\/package\.json$/u, ""), (x) => req.resolve(x));
+}
 function resolveSimpleUiDistDir(deps = {}) {
   const requireFromHere = createRequire(import.meta.url);
-  const resolvePackageJson = deps.resolvePackageJson ?? ((id) => requireFromHere.resolve(id));
+  const resolvePackageJson = deps.resolvePackageJson ?? ((id) => resolveSimpleUiPackageJson(id, requireFromHere));
   const exists = deps.exists ?? existsSync;
   let packageJson;
   try {
@@ -30,7 +34,7 @@ async function ensureSimpleUiDistDir(deps = {}) {
   } catch {
   }
   const requireFromHere = createRequire(import.meta.url);
-  const resolvePackageJson = deps.resolvePackageJson ?? ((id) => requireFromHere.resolve(id));
+  const resolvePackageJson = deps.resolvePackageJson ?? ((id) => resolveSimpleUiPackageJson(id, requireFromHere));
   let packageDir;
   try {
     packageDir = path.dirname(resolvePackageJson("@wrongstack/simpleui/package.json"));
@@ -96,4 +100,4 @@ export {
   ensureSimpleUiDistDir,
   resolveSimpleUiDistDir
 };
-//# sourceMappingURL=simpleui-dist-CXSIDAXZ.js.map
+//# sourceMappingURL=simpleui-dist-7BQISSEP.js.map