@wrongstack/cli 1.0.19 → 1.0.24

package/dist/chunk-BBHWW6LR.js

@@ -0,0 +1,549 @@
+
+// src/subcommands/handlers/modeldiag-profiles.ts
+import { color } from "@wrongstack/core/utils";
+var MODEL_PROFILES = [
+  {
+    provider: "anthropic",
+    pattern: /claude-opus/i,
+    family: "Claude Opus",
+    strengths: ["reasoning", "planning"],
+    bestFor: ["planning", "security", "debugging"],
+    costTier: "premium",
+    speedTier: "slow"
+  },
+  {
+    provider: "anthropic",
+    pattern: /claude-haiku/i,
+    family: "Claude Haiku",
+    strengths: ["speed"],
+    bestFor: ["lightweight", "docs"],
+    avoidFor: ["planning"],
+    costTier: "budget",
+    speedTier: "fast"
+  },
+  {
+    provider: "openai",
+    pattern: /gpt-5|o3|o4/i,
+    family: "GPT-5/o3/o4",
+    strengths: ["reasoning", "coding"],
+    bestFor: ["planning", "coding", "debugging"],
+    costTier: "premium",
+    speedTier: "normal"
+  },
+  {
+    provider: "openai",
+    // Must precede /gpt-4/ — every gpt-4o-mini id also contains gpt-4.
+    pattern: /gpt-4o-mini/i,
+    family: "GPT-4o Mini",
+    strengths: ["speed"],
+    bestFor: ["lightweight", "docs"],
+    avoidFor: ["planning"],
+    costTier: "budget",
+    speedTier: "fast"
+  },
+  {
+    provider: "openai",
+    pattern: /gpt-4/i,
+    family: "GPT-4",
+    strengths: ["coding"],
+    bestFor: ["coding", "docs"],
+    costTier: "standard",
+    speedTier: "fast"
+  },
+  {
+    provider: "google",
+    // Must precede /gemini-(?:2\.5|3)/ — flash variants (gemini-2.5-flash,
+    // gemini-3-flash, …) are budget/fast models and need this profile.
+    pattern: /gemini.*flash/i,
+    family: "Gemini Flash",
+    strengths: ["speed"],
+    bestFor: ["lightweight", "docs"],
+    avoidFor: ["planning"],
+    costTier: "budget",
+    speedTier: "fast"
+  },
+  {
+    provider: "google",
+    pattern: /gemini-(?:2\.5|3)/i,
+    family: "Gemini 2.5/3",
+    strengths: ["context", "coding"],
+    bestFor: ["coding", "data"],
+    costTier: "standard",
+    speedTier: "normal"
+  },
+  {
+    provider: "deepseek",
+    pattern: /deepseek/i,
+    family: "DeepSeek",
+    strengths: ["coding", "cost-effective"],
+    bestFor: ["coding", "general"],
+    costTier: "standard",
+    speedTier: "normal"
+  }
+];
+function fmtTokens(n) {
+  if (n >= 1e6) return `${(n / 1e6).toFixed(1)}M`;
+  if (n >= 1e3) return `${(n / 1e3).toFixed(1)}k`;
+  return String(n);
+}
+function fmtMs(ms) {
+  if (ms >= 1e3) return `${(ms / 1e3).toFixed(1)}s`;
+  return `${ms}ms`;
+}
+function fmtPrice(usdPer1M) {
+  if (usdPer1M === void 0) return color.dim("?");
+  if (usdPer1M >= 10) return `$${usdPer1M.toFixed(1)}`;
+  return `$${usdPer1M.toFixed(2)}`;
+}
+function checkMark(ok) {
+  return ok ? color.green("\u2713") : color.red("\u2717");
+}
+function costLabel(tier) {
+  switch (tier) {
+    case "premium":
+      return color.red("$$$");
+    case "standard":
+      return color.amber("$$");
+    case "budget":
+      return color.green("$");
+    default:
+      return color.dim("?");
+  }
+}
+function speedLabel(tier) {
+  switch (tier) {
+    case "fast":
+      return color.green("\u26A1");
+    case "normal":
+      return color.amber("\u2192");
+    case "slow":
+      return color.red("\u{1F422}");
+    default:
+      return color.dim("?");
+  }
+}
+function scoreBar(score, max) {
+  const pct = Math.min(1, Math.max(0, score / max));
+  const filled = Math.round(pct * 10);
+  const bar = color.green("\u2588".repeat(filled)) + color.dim("\u2591".repeat(10 - filled));
+  return `${bar} ${score}/${max}`;
+}
+var ROLE_CATEGORY = {
+  "security-scanner": "security",
+  "security-reviewer": "security",
+  "bug-hunter": "debugging",
+  debugger: "debugging",
+  tracer: "debugging",
+  planner: "planning",
+  architect: "planning",
+  "refactor-planner": "planning",
+  verifier: "testing",
+  test: "testing",
+  e2e: "testing",
+  document: "docs",
+  simplifier: "docs",
+  "code-reviewer": "review",
+  reviewer: "review",
+  critic: "review",
+  executor: "coding",
+  refactor: "refactoring",
+  migration: "coding",
+  frontend: "frontend",
+  backend: "backend",
+  api: "backend",
+  auth: "backend",
+  designer: "frontend",
+  analyst: "data",
+  data: "data",
+  database: "data",
+  explore: "planning",
+  search: "planning",
+  researcher: "planning"
+};
+function findProfile(pid, mid) {
+  for (const p of MODEL_PROFILES) {
+    if (p.provider === pid && p.pattern.test(mid)) return p;
+  }
+  return void 0;
+}
+function scoreModel(pid, mid, category, ctxWindow) {
+  const profile = findProfile(pid, mid);
+  let score = 50;
+  if (profile) {
+    if (profile.bestFor.includes(category)) score += 35;
+    if (profile.avoidFor?.includes(category)) score -= 50;
+    if (category === "planning" && profile.costTier === "premium") score += 15;
+    if (profile.speedTier === "slow" && category === "planning") score += 10;
+    if (profile.costTier === "budget" && category !== "planning" && category !== "security")
+      score += 10;
+  }
+  if (ctxWindow > 2e5) score += 10;
+  else if (ctxWindow > 1e5) score += 5;
+  else if (ctxWindow > 32e3) score += 2;
+  return { score, profile };
+}
+function rankModels(providers, hasKey, category, limit) {
+  const candidates = [];
+  for (const prov of providers) {
+    if (!hasKey(prov.id)) continue;
+    for (const m of prov.models ?? []) {
+      const ctxWindow = m.capabilities?.contextWindow ?? 0;
+      const { score, profile } = scoreModel(prov.id, m.id, category, ctxWindow);
+      if (score > 0) {
+        candidates.push({
+          provider: prov.id,
+          model: m.id,
+          profile,
+          score,
+          ctxWindow,
+          maxOutput: m.capabilities?.maxOutputTokens ?? 0,
+          inputPrice: m.pricing?.input,
+          outputPrice: m.pricing?.output
+        });
+      }
+    }
+  }
+  candidates.sort((a, b) => b.score - a.score);
+  return candidates.slice(0, limit);
+}
+var EVAL_TASKS = {
+  coding: {
+    label: "Code Generation",
+    prompt: "Write a TypeScript function parseCSV(input: string): { headers: string[]; rows: string[][] } that handles quoted fields, escaped quotes, and empty lines. Return an error string on malformed input. Keep under 40 lines."
+  },
+  planning: {
+    label: "Architecture Planning",
+    prompt: "Design the folder structure and key interfaces for a monorepo CLI tool with slash commands, model routing, subagent spawning, and config persistence. List packages, their responsibilities, and the 5 most important TypeScript interfaces."
+  },
+  security: {
+    label: "Vulnerability Detection",
+    prompt: 'Review this code for security issues:\n```ts\napp.get("/api/user", (req, res) => {\n  const id = req.query.id;\n  const user = db.query("SELECT * FROM users WHERE id = " + id);\n  res.json(user);\n});\n\napp.post("/api/run", (req, res) => {\n  const { cmd } = req.body;\n  exec("echo " + cmd, (err, stdout) => res.send(stdout));\n});\n```\nList every vulnerability, its severity (critical/high/medium), and the exact fix.'
+  },
+  debugging: {
+    label: "Bug Diagnosis",
+    prompt: 'This async function has 2 bugs. Find and fix both:\n```ts\nasync function processBatch(items: string[]) {\n  const results = [];\n  for (const item of items) {\n    const result = await fetch("https://api.example.com/" + item);\n    results.push(result);\n  }\n  return results.map(r => r.json());\n}\n```\nExplain what each bug is, why it fails, and write the corrected version.'
+  },
+  testing: {
+    label: "Test Authoring",
+    prompt: 'Write vitest test cases for this deepMerge function:\n```ts\nfunction deepMerge(base: Record<string, unknown>, overrides: Record<string, unknown>): Record<string, unknown> {\n  const merged = { ...base };\n  for (const [key, val] of Object.entries(overrides)) {\n    if (val === null) { delete merged[key]; continue; }\n    if (typeof val === "object" && !Array.isArray(val) && typeof merged[key] === "object" && !Array.isArray(merged[key])) {\n      merged[key] = deepMerge(merged[key] as Record<string, unknown>, val as Record<string, unknown>);\n    } else { merged[key] = val; }\n  }\n  return merged;\n}\n```\nCover: happy path, edge cases, and error conditions.'
+  },
+  docs: {
+    label: "Documentation",
+    prompt: "Write TSDoc comments for this RateLimiter interface. Include @param, @returns, @throws, and @example for each method:\n```ts\ninterface RateLimiter {\n  tryAcquire(key: string, maxPerWindow: number, windowMs: number): Promise<boolean>;\n  getRemaining(key: string): Promise<number>;\n  reset(key: string): Promise<void>;\n}\n```"
+  },
+  review: {
+    label: "Code Review",
+    prompt: 'Review this PR change:\n```diff\n async function loadConfig(path: string) {\n-  const raw = await fs.readFile(path, "utf8");\n-  return JSON.parse(raw);\n+  const raw = await fs.readFile(path);\n+  const config = JSON.parse(raw);\n+  process.env.API_KEY = config.apiKey;\n+  return config;\n }\n```\nList issues by severity (blocking / should-fix / nit) and explain your reasoning.'
+  },
+  refactoring: {
+    label: "Refactoring",
+    prompt: 'Refactor this nested condition into a cleaner pattern:\n```ts\nfunction getDiscount(user: { type: string; years: number; coupon?: string }): number {\n  if (user.type === "premium") {\n    if (user.years > 5) {\n      if (user.coupon === "BLACKFRIDAY") return 0.5;\n      return 0.3;\n    }\n    return 0.2;\n  }\n  if (user.type === "standard") {\n    if (user.years > 3) return 0.15;\n    return 0.1;\n  }\n  return 0;\n}\n```\nShow your refactored code and explain why your approach is cleaner.'
+  }
+};
+var EVAL_CATEGORIES = Object.keys(EVAL_TASKS);
+function roleCat(role) {
+  return ROLE_CATEGORY[role] ?? "general";
+}
+
+// src/subcommands/handlers/modeldiag-eval.ts
+import { color as color2 } from "@wrongstack/core/utils";
+import { makeProviderFromConfig } from "@wrongstack/providers";
+function createProviderForId(providerId, cfg) {
+  const savedCfg = cfg.providers?.[providerId];
+  const cfgWithType = Object.assign(
+    { type: providerId },
+    savedCfg ?? { apiKey: cfg.apiKey, baseUrl: cfg.baseUrl }
+  );
+  try {
+    return makeProviderFromConfig(providerId, cfgWithType);
+  } catch {
+    return void 0;
+  }
+}
+async function rankResponses(provider, leaderModel, taskPrompt, responses) {
+  const labelToIdx = /* @__PURE__ */ new Map();
+  const responseBlock = responses.map((r, i) => {
+    const label = String.fromCharCode(65 + i);
+    labelToIdx.set(label, i);
+    return `=== Response ${label} ===
+${r.text.slice(0, 800)}`;
+  }).join("\n\n");
+  const rankingPrompt = `Rank these responses from BEST (1) to WORST.
+
+TASK:
+${taskPrompt.slice(0, 600)}
+
+RESPONSES:
+${responseBlock}
+
+Output ONLY a ranked list, one per line:
+1. Response X \u2014 brief reason
+2. Response Y \u2014 brief reason`;
+  try {
+    const resp = await provider.complete(
+      {
+        model: leaderModel,
+        system: [
+          {
+            type: "text",
+            text: "You are an expert evaluator. Rank responses concisely. Output ONLY the ranked list."
+          }
+        ],
+        messages: [{ role: "user", content: [{ type: "text", text: rankingPrompt }] }],
+        maxTokens: 400
+      },
+      { signal: AbortSignal.timeout(3e4) }
+    );
+    const text = resp.content[0] && "text" in resp.content[0] ? resp.content[0].text : "";
+    const rankings = [];
+    for (const line of text.split("\n")) {
+      const m = line.match(/^\s*(\d+)[.)]\s*Response\s+([A-Z])/i);
+      if (m) {
+        const label = m[2]?.toUpperCase();
+        const idx = label !== void 0 ? labelToIdx.get(label) : void 0;
+        if (idx !== void 0 && !rankings.includes(idx)) {
+          rankings.push(idx);
+        }
+      }
+    }
+    return rankings.length > 0 ? rankings : responses.map((_, i) => i);
+  } catch {
+    return responses.map((_, i) => i);
+  }
+}
+async function runModeldiagEval(args, deps, providers, config, hasKey) {
+  const writeLine = (line = "") => {
+    deps.renderer.write(`${line}
+`);
+  };
+  const evalArgs = args.slice(1);
+  const providersEq = evalArgs.find((a) => a.startsWith("--providers="));
+  const providersValue = providersEq?.replace("--providers=", "") ?? (typeof deps.flags?.["providers"] === "string" ? deps.flags["providers"] : typeof deps.flags?.["provider"] === "string" ? deps.flags["provider"] : void 0);
+  const providerFilter = providersValue ? providersValue.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+  const maxEq = evalArgs.find((a) => a.startsWith("--max="));
+  const maxValue = maxEq?.replace("--max=", "") ?? (typeof deps.flags?.["max"] === "string" ? deps.flags["max"] : void 0);
+  const maxModels = maxValue ? Math.max(1, parseInt(maxValue, 10) || 2) : 2;
+  const quick = evalArgs.includes("--quick") || deps.flags?.["quick"] === true || deps.flags?.["quick"] === "true";
+  const modelsPerCat = quick ? 1 : maxModels;
+  const roleFilter = evalArgs.find((a) => !a.startsWith("--"));
+  const targetCategories = roleFilter ? EVAL_CATEGORIES.includes(roleCat(roleFilter)) ? [roleCat(roleFilter)] : [] : EVAL_CATEGORIES;
+  if (targetCategories.length === 0 && roleFilter) {
+    writeLine(
+      `${color2.amber("Unknown role/category")}: "${roleFilter}". Try: ${EVAL_CATEGORIES.join(", ")}`
+    );
+    return 1;
+  }
+  const keyedProviderIds = providers.filter((p) => hasKey(p.id)).map((p) => p.id);
+  let targetProviderIds;
+  if (providerFilter && providerFilter.length > 0) {
+    const unknown = providerFilter.filter((pid) => !keyedProviderIds.includes(pid));
+    targetProviderIds = providerFilter.filter((pid) => keyedProviderIds.includes(pid));
+    if (targetProviderIds.length === 0) {
+      const noKeyMsg = unknown.length > 0 ? `None of the specified providers (${unknown.join(", ")}) have API keys. Add keys with wstack auth.` : "None of the specified providers have API keys configured.";
+      writeLine(`${color2.amber(noKeyMsg)}`);
+      return 0;
+    }
+  } else if (keyedProviderIds.length === 0) {
+    writeLine(`${color2.amber("No providers have API keys. Add keys with wstack auth.")}`);
+    return 0;
+  } else if (keyedProviderIds.length === 1) {
+    targetProviderIds = keyedProviderIds;
+  } else {
+    const providerList = keyedProviderIds.map((pid, i) => {
+      const info = providers.find((p) => p.id === pid);
+      return `  ${color2.cyan(String(i + 1))}) ${color2.bold(pid.padEnd(16))} ${color2.dim(info?.name ?? "")}`;
+    }).join("\n");
+    deps.renderer.write(
+      `
+${color2.bold("Select providers to evaluate")}
+
+${providerList}
+
+${color2.dim('Enter numbers or provider IDs (comma-separated, or "all"):')}
+`
+    );
+    const input = await deps.reader.readLine("  > ");
+    const selected = input.trim().toLowerCase();
+    if (selected === "" || selected === "all") {
+      targetProviderIds = keyedProviderIds;
+    } else {
+      targetProviderIds = [];
+      for (const part of selected.split(",").map((s) => s.trim())) {
+        const idx = parseInt(part, 10);
+        if (idx >= 1 && idx <= keyedProviderIds.length) {
+          const pid = keyedProviderIds[idx - 1];
+          if (!targetProviderIds.includes(pid)) targetProviderIds.push(pid);
+        } else if (keyedProviderIds.includes(part)) {
+          if (!targetProviderIds.includes(part)) targetProviderIds.push(part);
+        }
+      }
+    }
+    if (targetProviderIds.length === 0) {
+      writeLine(color2.dim("No providers selected."));
+      return 0;
+    }
+  }
+  const leaderModel = config.model ?? "unknown";
+  const unknownProviders = providerFilter ? providerFilter.filter((pid) => !keyedProviderIds.includes(pid)) : [];
+  const warningLine = unknownProviders.length > 0 ? `  ${color2.amber("\u26A0 skipped (no key):")} ${unknownProviders.join(", ")}
+` : "";
+  writeLine(`${color2.bold("Model Competency Evaluation")}`);
+  writeLine(
+    color2.dim(
+      `Providers: ${targetProviderIds.join(", ")}  |  ${targetCategories.length} cats  |  ${modelsPerCat} model(s)/cat/provider`
+    )
+  );
+  writeLine(warningLine);
+  writeLine(color2.dim(`Leader (ranker): ${config.provider}/${leaderModel}`));
+  writeLine();
+  const collected = /* @__PURE__ */ new Map();
+  let total = 0;
+  let ok = 0;
+  for (const pid of targetProviderIds) {
+    const prov = createProviderForId(pid, config);
+    if (!prov) {
+      writeLine(color2.dim(`  \u2298 ${pid}: provider unavailable, skipping`));
+      continue;
+    }
+    for (const cat of targetCategories) {
+      const task = EVAL_TASKS[cat];
+      if (!task) continue;
+      const candidates = rankModels(
+        providers,
+        (providerId) => providerId === pid && hasKey(providerId),
+        cat,
+        modelsPerCat
+      );
+      if (candidates.length === 0) continue;
+      if (!collected.has(cat)) collected.set(cat, /* @__PURE__ */ new Map());
+      for (const c of candidates) {
+        total++;
+        const modelKey = `${pid}/${c.model}`;
+        try {
+          const start = Date.now();
+          const resp = await prov.complete(
+            {
+              model: c.model,
+              system: [{ type: "text", text: "Be thorough and correct." }],
+              messages: [{ role: "user", content: [{ type: "text", text: task.prompt }] }],
+              maxTokens: 1024
+            },
+            { signal: AbortSignal.timeout(45e3) }
+          );
+          const respText = resp.content[0] && "text" in resp.content[0] ? resp.content[0].text : "";
+          const respUsage = resp.usage;
+          collected.get(cat)?.set(modelKey, {
+            model: modelKey,
+            latency: Date.now() - start,
+            tokens: (respUsage?.input ?? 0) + (respUsage?.output ?? 0),
+            text: respText
+          });
+          ok++;
+        } catch {
+          collected.get(cat)?.set(modelKey, {
+            model: modelKey,
+            latency: -1,
+            tokens: 0,
+            text: ""
+          });
+        }
+      }
+    }
+  }
+  writeLine(`${color2.dim(`Phase 1: ${ok}/${total} calls succeeded`)}`);
+  writeLine();
+  if (collected.size === 0) {
+    writeLine(color2.amber("No responses collected. Check provider configuration."));
+    return 0;
+  }
+  const leaderProvider = createProviderForId(config.provider, config);
+  if (leaderProvider) {
+    writeLine(`${color2.bold("Phase 2")} \u2014 ${color2.dim("leader ranks responses")}`);
+    writeLine();
+  }
+  const rankings = /* @__PURE__ */ new Map();
+  for (const [cat, responses] of collected) {
+    const valid = Array.from(responses.values()).filter((r) => r.latency >= 0);
+    if (valid.length < 2) {
+      if (valid.length === 1) {
+        const m = valid[0]?.model;
+        if (m !== void 0) {
+          if (!rankings.has(m)) rankings.set(m, /* @__PURE__ */ new Map());
+          rankings.get(m)?.set(cat, { rank: 1, total: 1 });
+        }
+      }
+      continue;
+    }
+    const task = EVAL_TASKS[cat];
+    if (leaderProvider) {
+      const ranked = await rankResponses(leaderProvider, leaderModel, task.prompt, valid);
+      for (let i = 0; i < valid.length; i++) {
+        const m = valid[ranked[i] ?? i]?.model;
+        if (m === void 0) continue;
+        if (!rankings.has(m)) rankings.set(m, /* @__PURE__ */ new Map());
+        rankings.get(m)?.set(cat, { rank: i + 1, total: valid.length });
+      }
+    } else {
+      for (const r of valid) {
+        if (!rankings.has(r.model)) rankings.set(r.model, /* @__PURE__ */ new Map());
+        rankings.get(r.model)?.set(cat, { rank: 1, total: valid.length });
+      }
+    }
+  }
+  writeLine(`${color2.bold("Competency Report")}`);
+  writeLine();
+  const allModels = [.../* @__PURE__ */ new Set([...rankings.keys()])].sort();
+  const catList = [...collected.keys()];
+  const modelColWidth = Math.max(24, ...allModels.map((m) => m.length)) + 2;
+  const cw = 12;
+  writeLine(
+    `  ${color2.dim("model".padEnd(modelColWidth))}` + catList.map((c) => color2.dim((EVAL_TASKS[c]?.label ?? c).slice(0, cw).padEnd(cw + 2))).join("")
+  );
+  writeLine(`  ${color2.dim("\u2500".repeat(modelColWidth + catList.length * (cw + 2)))}`);
+  for (const model of allModels) {
+    const mr = rankings.get(model);
+    const provFromModel = model.split("/")[0] ?? "";
+    const modelColor = provFromModel === config.provider ? color2.cyan : color2.green;
+    let row = `  ${modelColor(model.padEnd(modelColWidth))}`;
+    for (const cat of catList) {
+      const e = mr.get(cat);
+      if (e) {
+        const pct = Math.round((1 - (e.rank - 1) / Math.max(1, e.total - 1)) * 100);
+        const pc = pct >= 80 ? color2.green : pct >= 50 ? color2.amber : color2.red;
+        row += `${pc(`#${e.rank} ${pct}%`.padEnd(cw + 2))}`;
+      } else {
+        row += color2.dim("\u2014".padEnd(cw + 2));
+      }
+    }
+    writeLine(row);
+  }
+  writeLine();
+  writeLine(color2.dim("#1 100% = best in category. \u2014 = not tested."));
+  writeLine();
+  writeLine(color2.dim("Pin: wstack setmodel set <role> <provider>/<model>"));
+  writeLine(
+    color2.dim(
+      "Full: wstack modeldiag eval          Providers: wstack modeldiag eval --providers=id1,id2"
+    )
+  );
+  writeLine(
+    color2.dim("Max:  wstack modeldiag eval --max=3   Quick: wstack modeldiag eval --quick")
+  );
+  return 0;
+}
+
+export {
+  fmtTokens,
+  fmtMs,
+  fmtPrice,
+  checkMark,
+  costLabel,
+  speedLabel,
+  scoreBar,
+  findProfile,
+  rankModels,
+  roleCat,
+  createProviderForId,
+  runModeldiagEval
+};
+//# sourceMappingURL=chunk-BBHWW6LR.js.map

package/dist/{chunk-CJTBLTS4.js → chunk-BLD5DSVA.js}

@@ -1,6 +1,6 @@
 import {
   CLI_VERSION
-} from "./chunk-XJXDOF63.js";
+} from "./chunk-YBUCXXYZ.js";
 
 // src/hq-publisher.ts
 import { createHqPublisherFromEnv, resolveHqConfig } from "@wrongstack/core/hq";
@@ -10,6 +10,7 @@ import { WebSocket } from "ws";
 import {
   deriveHqProjectId,
   MAX_HQ_KANBAN_BOARD_BYTES,
+  MAX_HQ_KANBAN_BOARDS,
   redactHqEventPayload
 } from "@wrongstack/core/hq";
 import {
@@ -337,7 +338,7 @@ function chunkSnapshotPayload(projectId, generatedAt, boards, tombstones) {
         { code: "WRONGSTACK_HQ_KANBAN_OVERSIZED_RECORD" }
       );
     }
-    if ((currentBoards.length > 0 || currentTombstones.length > 0) && currentBytes + additionalBytes > MAX_KANBAN_SNAPSHOT_PAYLOAD_BYTES) {
+    if ((currentBoards.length > 0 || currentTombstones.length > 0) && (currentBytes + additionalBytes > MAX_KANBAN_SNAPSHOT_PAYLOAD_BYTES || itemCount >= MAX_HQ_KANBAN_BOARDS)) {
       pushCurrent();
     }
     if (kind === "boards") {
@@ -517,4 +518,4 @@ function startCliHqConnection(options) {
 export {
   startCliHqConnection
 };
-//# sourceMappingURL=chunk-CJTBLTS4.js.map
+//# sourceMappingURL=chunk-BLD5DSVA.js.map

package/dist/{chunk-KK2LB3ZS.js → chunk-DRM7PSW7.js}

@@ -641,6 +641,7 @@ import * as path6 from "node:path";
 import * as fs2 from "node:fs";
 import { createRequire } from "node:module";
 import * as path2 from "node:path";
+import { wrongstackPackageJsonPath } from "@wrongstack/core/utils";
 var requireFromHere = createRequire(import.meta.url);
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -660,7 +661,10 @@ var cachedDistDir;
 function resolveHqDistDir() {
   if (cachedDistDir !== void 0) return cachedDistDir;
   try {
-    const pkgJson = requireFromHere.resolve("@wrongstack/webui-hq/package.json");
+    const pkgJson = wrongstackPackageJsonPath(
+      "@wrongstack/webui-hq",
+      (id) => requireFromHere.resolve(id)
+    );
     const dist = path2.join(path2.dirname(pkgJson), "dist");
     if (fs2.existsSync(path2.join(dist, "index.html"))) {
       cachedDistDir = dist;
@@ -687,7 +691,7 @@ function resolveHqDistDir() {
 }
 function isInsideDist(filePath, distDir) {
   const rel = path2.relative(distDir, filePath);
-  return rel !== "" && !rel.startsWith("..") && !path2.isAbsolute(rel);
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path2.sep}`) && !path2.isAbsolute(rel);
 }
 function isMissingPath(error) {
   const code = error.code;
@@ -2843,8 +2847,8 @@ async function handleApiAgentMessages(req, res, match, agentMessages) {
 // src/hq-server/routes/system-handlers.ts
 async function handleApiSystemUpdate(res) {
   const [{ checkForUpdate }, { detectUpdatePackageName }] = await Promise.all([
-    import("./update-check-BS3DHTSI.js"),
-    import("./update-5DPB4YD4.js")
+    import("./update-check-2POMBHFB.js"),
+    import("./update-7XIOEXTD.js")
   ]);
   const packageName = detectUpdatePackageName();
   const info = await checkForUpdate({ packageName });
@@ -5146,4 +5150,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-KK2LB3ZS.js.map
+//# sourceMappingURL=chunk-DRM7PSW7.js.map

package/dist/{chunk-XJ7K67PP.js → chunk-JF2MULWF.js}

@@ -4,7 +4,7 @@ import {
 import {
   PLUGIN_AUDIT_ENTRIES,
   loadExternalPlugins
-} from "./chunk-SIS37L3W.js";
+} from "./chunk-L2RVEQWO.js";
 
 // src/wiring/plugins.ts
 import { join } from "node:path";
@@ -20,7 +20,21 @@ function createApi(ownerName, base) {
 // src/wiring/plugins.ts
 var DEPRECATED_PLUGIN_NAMES = {
   "web-search": "use the built-in `search` and `fetch` tools",
-  "json-path": "use the built-in `json` tool with action: query | validate | transform | merge"
+  "json-path": "use the built-in `json` tool with action: query | validate | transform | merge",
+  // Deleted in the 2026-09-17 catalog review. The first four produced
+  // findings that were noise by construction (each was run against this
+  // repo and mis-reported); the rest duplicated infrastructure the host
+  // already ships. Kept here so an existing config that still lists one
+  // warns and skips instead of failing to resolve the import.
+  "interface-contract-guard": "removed \u2014 it reported plain data interfaces as unimplemented",
+  "refactor-suggester": "removed \u2014 use `lint-gate` plus the built-in `grep` and `read` tools",
+  "feature-flag-tracker": "removed \u2014 use the built-in `grep` tool with your own flag pattern",
+  "dead-code-detector": "removed \u2014 use your linter / `tsc` and `duplicate-code-detector`",
+  "semantic-search-indexer": "use the built-in `grep` tool or the codebase-index MCP server",
+  "knowledge-graph": "use the built-in `remember` / `search_memory` / `find_related_memories`",
+  "todo-tracker": "use the built-in `todo` tool and the Kanban board",
+  "smart-rename": "use the built-in `replace` tool",
+  "code-metrics": "removed \u2014 it reported numbers nothing acted on"
 };
 var deprecatedWarningsEmitted = /* @__PURE__ */ new Set();
 var BUILTIN_PLUGIN_CONFIG_ALIASES = {
@@ -171,13 +185,6 @@ async function setupPlugins(params) {
   if (allPlugins.length === 0) return;
   const pluginOptions = buildPluginOptions(config, allPlugins);
   if (paths?.projectDir) {
-    if (pluginOptions["todo-tracker"] === void 0) {
-      pluginOptions["todo-tracker"] = {};
-    }
-    const todoTrackerOpts = pluginOptions["todo-tracker"];
-    if (typeof todoTrackerOpts["filePath"] !== "string" || todoTrackerOpts["filePath"] === "") {
-      todoTrackerOpts["filePath"] = join(paths.projectDir, "todo-tracker.json");
-    }
     const contextPinsOpts = pluginOptions["context-pins"] ?? {};
     pluginOptions["context-pins"] = contextPinsOpts;
     if (typeof contextPinsOpts["filePath"] !== "string" || contextPinsOpts["filePath"] === "") {
@@ -267,4 +274,4 @@ export {
   BUILTIN_PLUGIN_FACTORIES,
   setupPlugins
 };
-//# sourceMappingURL=chunk-XJ7K67PP.js.map
+//# sourceMappingURL=chunk-JF2MULWF.js.map