@wrongstack/cli 1.0.19 → 1.0.24

package/dist/chunk-S4FFHDJG.js

@@ -0,0 +1,93 @@
+
+// src/wiring/provider-runtime.ts
+import {
+  getProxyConfig,
+  isProxyEligible,
+  rewriteBaseUrl,
+  sanitizeUrlForLog,
+  shouldRewriteFor
+} from "@wrongstack/core/wiring/proxy-rewrite";
+import { makeProviderFromConfig } from "@wrongstack/providers";
+function resolveRawProviderConnection(config, providerId) {
+  const savedCfg = config.providers?.[providerId];
+  const isAccountAlias = savedCfg?.type !== void 0 && savedCfg.type !== providerId;
+  const inheritsPrimary = !isAccountAlias && (config.provider === void 0 || config.provider === providerId);
+  return {
+    apiKey: savedCfg?.apiKey ?? (inheritsPrimary ? config.apiKey : void 0),
+    baseUrl: savedCfg?.baseUrl ?? (inheritsPrimary ? config.baseUrl : void 0)
+  };
+}
+function resolveProviderCfg(config, providerId, opts) {
+  const savedCfg = config.providers?.[providerId];
+  const proxyProviderType = savedCfg?.family === "openai-codex" ? "openai-codex" : savedCfg?.type ?? providerId;
+  const connection = resolveRawProviderConnection(config, providerId);
+  const rawBaseUrl = connection.baseUrl;
+  let rewriteReason = "no-base-url";
+  let baseUrl = rawBaseUrl;
+  if (rawBaseUrl && shouldRewriteFor(proxyProviderType)) {
+    const rewritten = rewriteBaseUrl(rawBaseUrl, currentProxyBaseUrl());
+    if (rewritten !== rawBaseUrl) {
+      rewriteReason = "applied";
+      baseUrl = rewritten;
+    } else {
+      rewriteReason = passthroughReason(rawBaseUrl);
+    }
+  } else if (rawBaseUrl) {
+    rewriteReason = proxySkipReason(proxyProviderType);
+  }
+  opts?.logger?.info(
+    `WrongProxy rewrite ${rewriteReason} for provider '${providerId}': ${sanitizeUrlForLog(rawBaseUrl) || "<none>"} -> ${sanitizeUrlForLog(baseUrl) || "<none>"}`
+  );
+  const cfg = {
+    ...savedCfg,
+    apiKey: connection.apiKey,
+    baseUrl,
+    type: providerId
+  };
+  const factoryType = savedCfg?.type ?? providerId;
+  return { cfg, factoryType };
+}
+function passthroughReason(rawBaseUrl) {
+  if (!rawBaseUrl.includes("://")) return "no-scheme";
+  const proxyRoot = currentProxyBaseUrl().replace(/\/+$/, "");
+  if (proxyRoot && rawBaseUrl.startsWith(`${proxyRoot}/proxy/`)) {
+    return "already-rewritten";
+  }
+  try {
+    const parsed = new URL(rawBaseUrl);
+    const host = parsed.hostname;
+    const isLoopback = host === "localhost" || host === "127.0.0.1" || host === "[::1]";
+    if (isLoopback && parsed.port !== "") return "loopback";
+  } catch {
+  }
+  return "ineligible";
+}
+function proxySkipReason(providerId) {
+  const cfg = getProxyConfig();
+  if (!cfg.enabled) return "disabled";
+  if (!cfg.url) return "no-proxy-url";
+  if (!cfg.active) return "inactive";
+  if (!isProxyEligible(providerId)) return "excluded";
+  return "unknown";
+}
+function currentProxyBaseUrl() {
+  return getProxyConfig().url;
+}
+function resolveProviderCfgWithProxy(config, providerId, opts) {
+  return resolveProviderCfg(config, providerId, opts);
+}
+function buildProviderForId(args, providerId) {
+  const { cfg, factoryType } = resolveProviderCfg(args.config, providerId, {
+    logger: args.logger
+  });
+  const useRegistry = !!args.config.features.modelsRegistry && args.providerRegistry.has(factoryType);
+  return useRegistry ? args.providerRegistry.create(cfg, factoryType) : makeProviderFromConfig(providerId, { ...cfg, type: factoryType });
+}
+
+export {
+  resolveRawProviderConnection,
+  resolveProviderCfg,
+  resolveProviderCfgWithProxy,
+  buildProviderForId
+};
+//# sourceMappingURL=chunk-S4FFHDJG.js.map

package/dist/chunk-SFBFYIOW.js

@@ -0,0 +1,271 @@
+import {
+  appendHistory,
+  backupCurrent
+} from "./chunk-WSTVGC2C.js";
+
+// src/settings-menu.ts
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { decryptConfigSecretsForRewrite, encryptConfigSecrets } from "@wrongstack/core/security";
+import { ConfigError, ERROR_CODES, FsError } from "@wrongstack/core/types";
+import { atomicWrite, deepMerge, withFileLock } from "@wrongstack/core/utils";
+function resolvePersistPath(deps) {
+  if (deps.forceGlobal) return deps.profileConfigPath;
+  const scope = deps.configStore.get().configScope;
+  if (scope === "project" && deps.inProjectConfigPath) {
+    return deps.inProjectConfigPath;
+  }
+  return deps.profileConfigPath;
+}
+function resolveActualTarget(deps, decrypted, fallbackPath) {
+  if (deps.forceGlobal) return deps.profileConfigPath;
+  const newScope = decrypted.configScope;
+  const newProfileName = decrypted.activeProfile;
+  const effectiveProfilePath = newProfileName && deps.resolveProfilePath ? deps.resolveProfilePath(newProfileName) : deps.profileConfigPath;
+  if (newScope === "project" && deps.inProjectConfigPath) {
+    return deps.inProjectConfigPath;
+  }
+  if (newScope === "global") {
+    return effectiveProfilePath;
+  }
+  return fallbackPath;
+}
+function isProfileOrGlobalTarget(actualTarget, deps) {
+  return !deps.inProjectConfigPath || path.resolve(actualTarget) !== path.resolve(deps.inProjectConfigPath);
+}
+async function ensureProjectDir(filePath) {
+  const dir = path.dirname(filePath);
+  try {
+    await fs.mkdir(dir, { recursive: true });
+  } catch {
+  }
+}
+var PROJECT_SAFE_FIELDS = /* @__PURE__ */ new Set([
+  "version",
+  "model",
+  "cwd",
+  "fallbackModels",
+  "fallbackBridge",
+  // Kept in sync with core's IN_PROJECT_ALLOWED_KEYS (config-loader.ts): these
+  // model-routing prefs are explicitly safe to READ from a per-project config,
+  // so the writer must not strip them — otherwise a scope=project /fallback
+  // profile/fav write (or a TUI full-config write under project scope) would be
+  // silently dropped while the loader would happily accept them on next boot.
+  "fallbackProfiles",
+  "fallbackProfile",
+  "favoriteModels",
+  "disabledModels",
+  "favoriteModelsOnly",
+  "modelAvailabilitySchedule",
+  "fallbackAuto",
+  "fallbackStickiness",
+  "fallbackGateSeconds",
+  "models",
+  "modelMatrix",
+  "modelTiers",
+  "maxConcurrent",
+  "autonomy",
+  "hints",
+  "nextPrediction",
+  "debugStream",
+  "configScope",
+  "features",
+  "context",
+  "log",
+  "session",
+  "indexing",
+  "tools",
+  "launch",
+  "circuitBreaker",
+  "adaptiveConcurrency",
+  "modelRuntime",
+  "Sage",
+  "skills",
+  "chronicle",
+  "uiLocale",
+  "themePreset"
+]);
+var PROJECT_DENIED_PATHS = [
+  "tools.exec.allow",
+  "tools.exec.danger",
+  "tools.council",
+  "skills.extraDirs",
+  "skills.registryUrl",
+  "skills.suggest",
+  "Sage.storage.directory",
+  "autonomy.yolo",
+  "autonomy.defaultMode",
+  "autonomy.yoloConfirm",
+  "launch.autonomy",
+  "features.allowOutsideProjectRoot",
+  "tools.restrictToProjectRoot",
+  "tools.loopDetection",
+  "tools.maxIterations",
+  "tools.autoExtendLimit",
+  "tools.maxAutoExtensions",
+  "tools.kanbanGovernance",
+  "tools.autoThin",
+  "tools.disabledToolMeta",
+  "tools.wrongProxy",
+  "features.mailboxBridge",
+  "features.pluginsTrust"
+];
+function deleteProjectDeniedPath(target, dotted) {
+  const parts = dotted.split(".");
+  const leaf = parts.pop();
+  if (!leaf) return;
+  let cursor = target;
+  for (const part of parts) {
+    const next = cursor[part];
+    if (!next || typeof next !== "object" || Array.isArray(next)) return;
+    cursor = next;
+  }
+  delete cursor[leaf];
+}
+function filterSafeForProject(cfg) {
+  const out = {};
+  for (const [key, value] of Object.entries(cfg)) {
+    if (PROJECT_SAFE_FIELDS.has(key)) {
+      out[key] = structuredClone(value);
+    }
+  }
+  for (const denied of PROJECT_DENIED_PATHS) deleteProjectDeniedPath(out, denied);
+  return out;
+}
+async function readConfigForRewrite(filePath, vault) {
+  let raw;
+  let fileExists = true;
+  try {
+    raw = await fs.readFile(filePath, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      throw new FsError({
+        message: `Could not read ${filePath}`,
+        code: ERROR_CODES.FS_READ_FAILED,
+        path: filePath,
+        cause: err
+      });
+    }
+    fileExists = false;
+    raw = "{}";
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    return decryptConfigSecretsForRewrite(parsed, vault);
+  } catch (err) {
+    if (fileExists) {
+      throw new ConfigError({
+        message: `Config at ${filePath} is not valid JSON`,
+        code: ERROR_CODES.CONFIG_PARSE_FAILED,
+        context: { path: filePath },
+        cause: err
+      });
+    }
+    return {};
+  }
+}
+async function writeConfigMutation(deps, mutator) {
+  const sourcePath = resolvePersistPath(deps);
+  await ensureProjectDir(sourcePath);
+  let mutated = {};
+  let sourceBefore = {};
+  let actualTarget = sourcePath;
+  let wroteSource = false;
+  await withFileLock(sourcePath, async () => {
+    mutated = await readConfigForRewrite(sourcePath, deps.vault);
+    sourceBefore = structuredClone(mutated);
+    mutator(mutated);
+    actualTarget = resolveActualTarget(deps, mutated, sourcePath);
+    if (actualTarget !== sourcePath) return;
+    const toWrite = isProfileOrGlobalTarget(actualTarget, deps) ? mutated : filterSafeForProject(mutated);
+    await backupCurrent(void 0, actualTarget);
+    await atomicWrite(
+      actualTarget,
+      JSON.stringify(encryptConfigSecrets(toWrite, deps.vault), null, 2),
+      { mode: 384 }
+    );
+    try {
+      await appendHistory(sourceBefore, toWrite, "Settings updated", void 0, actualTarget);
+    } catch {
+    }
+    wroteSource = true;
+  });
+  if (!wroteSource) {
+    await ensureProjectDir(actualTarget);
+    await withFileLock(actualTarget, async () => {
+      const destinationBefore = await readConfigForRewrite(actualTarget, deps.vault);
+      const effectiveConfig = deepMerge(destinationBefore, mutated);
+      const toWrite = isProfileOrGlobalTarget(actualTarget, deps) ? effectiveConfig : filterSafeForProject(effectiveConfig);
+      await backupCurrent(void 0, actualTarget);
+      await atomicWrite(
+        actualTarget,
+        JSON.stringify(encryptConfigSecrets(toWrite, deps.vault), null, 2),
+        { mode: 384 }
+      );
+      try {
+        await appendHistory(
+          destinationBefore,
+          toWrite,
+          "Settings scope changed and settings were updated",
+          void 0,
+          actualTarget
+        );
+      } catch {
+      }
+    });
+  }
+  return mutated;
+}
+async function persistAutonomySetting(deps, mutator) {
+  const decrypted = await writeConfigMutation(deps, (config) => {
+    const autonomy = config.autonomy ?? {};
+    mutator(
+      autonomy
+    );
+    config.autonomy = autonomy;
+  });
+  if (deps.updateStore !== false) {
+    deps.configStore.update({
+      autonomy: decrypted.autonomy
+    });
+  }
+}
+async function persistConfigSetting(deps, mutator) {
+  const decrypted = await writeConfigMutation(deps, mutator);
+  if (deps.updateStore !== false) {
+    deps.configStore.update(decrypted);
+  }
+}
+async function persistTelegramConfig(deps, mutator) {
+  const decrypted = await writeConfigMutation({ ...deps, forceGlobal: true }, (config) => {
+    const extensions = config.extensions ?? {};
+    const telegram = extensions.telegram ?? {};
+    mutator(telegram);
+    extensions.telegram = telegram;
+    config.extensions = extensions;
+  });
+  await deps.vault.flushHardening?.();
+  deps.configStore.update({
+    extensions: decrypted.extensions
+  });
+}
+function deriveFsAccessPair(input) {
+  if (input.allowOutsideProjectRoot !== void 0) {
+    const allow = input.allowOutsideProjectRoot;
+    return { allowOutsideProjectRoot: allow, restrictToProjectRoot: !allow };
+  }
+  if (input.restrictFsToRoot !== void 0) {
+    const restrict = input.restrictFsToRoot;
+    return { allowOutsideProjectRoot: !restrict, restrictToProjectRoot: restrict };
+  }
+  return void 0;
+}
+
+export {
+  filterSafeForProject,
+  persistAutonomySetting,
+  persistConfigSetting,
+  persistTelegramConfig,
+  deriveFsAccessPair
+};
+//# sourceMappingURL=chunk-SFBFYIOW.js.map

package/dist/{chunk-JX6KL7OF.js → chunk-SKPDE62W.js}

@@ -1,6 +1,6 @@
 import {
   renderAuthLocalHelpToString
-} from "./chunk-2VMJ3E5Z.js";
+} from "./chunk-YTEOAWOJ.js";
 
 // src/subcommands/handlers/per-subcommand-help.ts
 import { color as color3 } from "@wrongstack/core/utils";
@@ -780,10 +780,11 @@ var helpTable = {
     name: "config",
     title: "wstack config \u2014 show or edit effective config",
     description: "Print the resolved config (with the on-disk overrides merged on top), or open the active profile config in $EDITOR for interactive edits. Also exposes a small audit log of recent config-history changes for diagnostics.",
-    usage: "wstack config [show|edit|history|restore] [...]",
+    usage: "wstack config [show|edit|backup|history|restore] [...]",
     subcommands: [
       { name: "show", description: "Print the resolved config to stdout (default)." },
       { name: "edit", description: "Open the active profile config in $EDITOR." },
+      { name: "backup", description: "Create a recoverable snapshot of the active profile." },
       { name: "history", description: "List recent config-history entries." },
       { name: "restore <id>", description: "Restore a previous config-history entry." }
     ],
@@ -1212,4 +1213,4 @@ export {
   subcommandsWithFocusedHelp,
   renderGenericHelp
 };
-//# sourceMappingURL=chunk-JX6KL7OF.js.map
+//# sourceMappingURL=chunk-SKPDE62W.js.map

package/dist/{chunk-RMQNCHGO.js → chunk-U46QR4WR.js}

@@ -17,7 +17,6 @@ function renderDiff(diff) {
 }
 
 // src/permission-prompt.ts
-import { alwaysAllowUnavailableReason } from "@wrongstack/core/security";
 import {
   color as color2,
   sanitizeTerminalPreview,
@@ -41,18 +40,15 @@ ${theme.warn("\u26A0 APPROVAL REQUIRED")} ${theme.primary("\u2502")} ${theme.bol
     if (preview) writeOut(`${preview}
 `);
     writeOut(color2.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n"));
-    const noAlwaysReason = alwaysAllowUnavailableReason(tool, input);
-    if (noAlwaysReason) {
-      writeOut(`${color2.dim(`(no "always" for this call \u2014 ${noAlwaysReason})`)}
-`);
-    }
     const options = [
       { key: "y", label: "yes", value: "yes" },
       { key: "n", label: "no", value: "no" },
-      ...noAlwaysReason ? [] : [{ key: "a", label: "always", value: "always" }],
+      { key: "a", label: "remember same input/args", value: "always-exact" },
+      ...tool.name === "exec" ? [{ key: "c", label: "remember executable with any args", value: "always-command" }] : [],
+      { key: "t", label: "remember tool with any input", value: "always-tool" },
       { key: "d", label: "deny", value: "deny" }
     ];
-    const alwaysHint = noAlwaysReason ? "" : `  ${theme.bold("[a]")}lways allow (${sanitizeTerminalText2(suggestedPattern)})`;
+    const alwaysHint = `  ${theme.bold("[a]")} same input (${sanitizeTerminalText2(suggestedPattern)})${tool.name === "exec" ? "  [c] command, any args" : ""}  [t] tool, any input`;
     const answer = await reader.readKey(
       `${theme.bold("[y]")}es  ${theme.bold("[n]")}o${alwaysHint}  ${theme.bold("[d]")}eny: `,
       options,
@@ -482,4 +478,4 @@ export {
   detectProjectFacts,
   renderAgentsTemplate
 };
-//# sourceMappingURL=chunk-RMQNCHGO.js.map
+//# sourceMappingURL=chunk-U46QR4WR.js.map

package/dist/{chunk-B4JLSXZB.js → chunk-WSTVGC2C.js}

@@ -6,7 +6,13 @@ import os from "node:os";
 import * as path from "node:path";
 import { isSecretField } from "@wrongstack/core/security";
 import { ERROR_CODES, FsError } from "@wrongstack/core/types";
-import { atomicWrite, resolveWstackPaths, toErrorMessage, writeErr } from "@wrongstack/core/utils";
+import {
+  atomicWrite,
+  resolveWstackPaths,
+  toErrorMessage,
+  withFileLock,
+  writeErr
+} from "@wrongstack/core/utils";
 var defaultUidFn = () => os.userInfo().uid;
 async function getFileUid(filePath) {
   try {
@@ -89,7 +95,11 @@ function maskConfigSecrets(cfg) {
   if (typeof cfg !== "object" || cfg === null) return {};
   const out = {};
   for (const [k, v] of Object.entries(cfg)) {
-    if (isSecretField(k)) {
+    if (k.toLowerCase() === "apikeys" && Array.isArray(v) && v.every(
+      (entry) => entry !== null && typeof entry === "object" && !Array.isArray(entry) && ("label" in entry || "id" in entry) && "apiKey" in entry
+    )) {
+      out[k] = maskValue(v);
+    } else if (isSecretField(k)) {
       out[k] = REDACTED;
     } else {
       out[k] = maskValue(v);
@@ -101,7 +111,14 @@ function reviveSecrets(masked, current) {
   if (masked === REDACTED) return current;
   if (Array.isArray(masked)) {
     const cur = Array.isArray(current) ? current : [];
-    return masked.map((item, i) => reviveSecrets(item, cur[i]));
+    return masked.map((item, i) => {
+      const record = item && typeof item === "object" && !Array.isArray(item) ? item : void 0;
+      const identityKey = typeof record?.["label"] === "string" ? "label" : typeof record?.["id"] === "string" ? "id" : void 0;
+      const matched = identityKey ? cur.find(
+        (candidate) => candidate && typeof candidate === "object" && !Array.isArray(candidate) && candidate[identityKey] === record?.[identityKey]
+      ) : cur[i];
+      return reviveSecrets(item, matched);
+    });
   }
   if (typeof masked !== "object" || masked === null) return masked;
   const curObj = typeof current === "object" && current !== null && !Array.isArray(current) ? current : {};
@@ -271,10 +288,12 @@ async function appendHistory(oldCfg, newCfg, description, homeFn = defaultHomeDi
       cause: err
     });
   }
-  const idx = await readIndex(homeFn, targetConfigPath);
-  idx.entries.unshift({ id, timestamp, description });
-  await pruneHistoryEntries(idx, homeFn, targetConfigPath);
-  await writeIndex(idx, homeFn, targetConfigPath);
+  await withFileLock(historyIndexPath(homeFn, targetConfigPath), async () => {
+    const idx = await readIndex(homeFn, targetConfigPath);
+    idx.entries.unshift({ id, timestamp, description });
+    await pruneHistoryEntries(idx, homeFn, targetConfigPath);
+    await writeIndex(idx, homeFn, targetConfigPath);
+  });
   return id;
 }
 async function listHistory(homeFn = defaultHomeDir, targetConfigPath) {
@@ -302,39 +321,34 @@ async function restoreFromHistory(id, homeFn = defaultHomeDir, targetConfigPath)
       error: "Operation denied: config file is not owned by current user"
     };
   }
-  await backupCurrent(homeFn, targetConfigPath);
-  let oldCfg = {};
-  try {
-    const raw = await fs.readFile(configPath(homeFn, targetConfigPath), "utf8");
-    oldCfg = JSON.parse(raw);
-  } catch {
-  }
-  const restored = reviveSecrets(entry.snapshotMasked, oldCfg);
-  try {
-    await atomicWrite(configPath(homeFn, targetConfigPath), JSON.stringify(restored, null, 2), {
-      mode: 384
-    });
-  } catch (err) {
-    return { ok: false, backupId: null, error: String(err) };
-  }
-  const backupId = await appendHistory(
-    oldCfg,
-    restored,
-    `Restored from history ${id}`,
-    homeFn,
-    targetConfigPath
-  );
-  return { ok: true, backupId };
+  const cfg = configPath(homeFn, targetConfigPath);
+  return withFileLock(cfg, async () => {
+    await backupCurrent(homeFn, targetConfigPath);
+    let oldCfg = {};
+    try {
+      const raw = await fs.readFile(cfg, "utf8");
+      oldCfg = JSON.parse(raw);
+    } catch {
+    }
+    const restored = reviveSecrets(entry.snapshotMasked, oldCfg);
+    try {
+      await atomicWrite(cfg, JSON.stringify(restored, null, 2), { mode: 384 });
+    } catch (err) {
+      return { ok: false, backupId: null, error: String(err) };
+    }
+    const backupId = await appendHistory(
+      oldCfg,
+      restored,
+      `Restored from history ${id}`,
+      homeFn,
+      targetConfigPath
+    );
+    return { ok: true, backupId };
+  });
 }
 async function restoreLast(homeFn = defaultHomeDir, targetConfigPath) {
   const last = backupLastPath(homeFn, targetConfigPath);
   const cfg = configPath(homeFn, targetConfigPath);
-  let oldCfg = {};
-  try {
-    const raw = await fs.readFile(cfg, "utf8");
-    oldCfg = JSON.parse(raw);
-  } catch {
-  }
   let lastCfg = {};
   try {
     const raw = await fs.readFile(last, "utf8");
@@ -345,14 +359,28 @@ async function restoreLast(homeFn = defaultHomeDir, targetConfigPath) {
   if (!await checkConfigOwnership(homeFn, defaultUidFn, targetConfigPath)) {
     return { ok: false, error: "Operation denied: config file is not owned by current user" };
   }
-  await backupCurrent(homeFn, targetConfigPath);
-  try {
-    await atomicWrite(cfg, JSON.stringify(lastCfg, null, 2));
-  } catch (err) {
-    return { ok: false, error: String(err) };
-  }
-  await appendHistory(oldCfg, lastCfg, "Restored from config.json.last", homeFn, targetConfigPath);
-  return { ok: true };
+  return withFileLock(cfg, async () => {
+    let oldCfg = {};
+    try {
+      const raw = await fs.readFile(cfg, "utf8");
+      oldCfg = JSON.parse(raw);
+    } catch {
+    }
+    await backupCurrent(homeFn, targetConfigPath);
+    try {
+      await atomicWrite(cfg, JSON.stringify(lastCfg, null, 2), { mode: 384 });
+    } catch (err) {
+      return { ok: false, error: String(err) };
+    }
+    await appendHistory(
+      oldCfg,
+      lastCfg,
+      "Restored from config.json.last",
+      homeFn,
+      targetConfigPath
+    );
+    return { ok: true };
+  });
 }
 
 export {
@@ -363,4 +391,4 @@ export {
   restoreFromHistory,
   restoreLast
 };
-//# sourceMappingURL=chunk-B4JLSXZB.js.map
+//# sourceMappingURL=chunk-WSTVGC2C.js.map

package/dist/chunk-YBUCXXYZ.js

@@ -0,0 +1,36 @@
+
+// src/version.ts
+import { createRequire } from "node:module";
+var req = createRequire(import.meta.url);
+var standaloneBuild = globalThis[/* @__PURE__ */ Symbol.for("wrongstack.standalone-build")];
+function readOwnVersion() {
+  if (standaloneBuild?.version) return standaloneBuild.version;
+  const candidates = ["../package.json", "../../package.json"];
+  for (const rel of candidates) {
+    try {
+      const pkg = req(rel);
+      if (typeof pkg.version === "string" && pkg.version.length > 0) return pkg.version;
+    } catch {
+    }
+  }
+  return "dev";
+}
+var CLI_VERSION = readOwnVersion();
+function readApiVersion() {
+  if (standaloneBuild?.apiVersion) return standaloneBuild.apiVersion;
+  try {
+    const corePkg = req("@wrongstack/core/package.json");
+    if (corePkg.wrongstackApiVersion) return corePkg.wrongstackApiVersion;
+  } catch {
+  }
+  return "0.0.0";
+}
+var API_VERSION = readApiVersion();
+var STANDALONE_TARGET = standaloneBuild?.target;
+
+export {
+  CLI_VERSION,
+  API_VERSION,
+  STANDALONE_TARGET
+};
+//# sourceMappingURL=chunk-YBUCXXYZ.js.map

package/dist/{chunk-2VMJ3E5Z.js → chunk-YTEOAWOJ.js}

@@ -2,6 +2,10 @@
 // src/subcommands/handlers/auth-local-help.ts
 import { color } from "@wrongstack/core/utils";
 var LOCAL_AUTH_FLAGS = [
+  {
+    flag: "--alias <account>",
+    description: "Create a separate auth profile for this preset; the alias selects the endpoint, credential, and models in fallback references."
+  },
   {
     flag: "--name <ollama|vllm|lmstudio>",
     description: "Pick a preset (skip the interactive picker). Defaults to the first run; set this for scripting."
@@ -32,7 +36,7 @@ var LOCAL_AUTH_FLAGS = [
   }
 ];
 var LOCAL_FLAG_COLUMN_WIDTH = 38;
-var LOCAL_AUTH_HELP_USAGE = "wstack auth local [--name <id>] [--base-url <url>] [--no-key] [--no-probe|--probe-only] [--model <spec>] [--audit [target]]";
+var LOCAL_AUTH_HELP_USAGE = "wstack auth local [--name <id>] [--alias <account>] [--base-url <url>] [--no-key] [--no-probe|--probe-only] [--model <spec>] [--audit [target]]";
 function wantsLocalHelp(args) {
   return args.includes("--help") || args.includes("-h");
 }
@@ -68,4 +72,4 @@ export {
   wantsLocalHelp,
   renderAuthLocalHelpToString
 };
-//# sourceMappingURL=chunk-2VMJ3E5Z.js.map
+//# sourceMappingURL=chunk-YTEOAWOJ.js.map

package/dist/{chunk-GPPRNAKW.js → chunk-ZMX5HRLI.js}

@@ -60,7 +60,7 @@ function parseWebuiSessionChildOptions(flags) {
   const projectRoot = requireAbsolutePath(flagValue(flags, ["project-root"]), "--project-root");
   const workingDir = requireAbsolutePath(flagValue(flags, ["working-dir"]), "--working-dir");
   const relativeWorkingDir = path.relative(projectRoot, workingDir);
-  if (relativeWorkingDir.startsWith("..") || path.isAbsolute(relativeWorkingDir)) {
+  if (relativeWorkingDir === ".." || relativeWorkingDir.startsWith(`..${path.sep}`) || path.isAbsolute(relativeWorkingDir)) {
     throw new Error("--working-dir must be inside --project-root");
   }
   const sessionId = flagValue(flags, ["session-id"]);
@@ -125,4 +125,4 @@ export {
   writeWebuiSessionChildReady,
   writeWebuiSessionChildError
 };
-//# sourceMappingURL=chunk-GPPRNAKW.js.map
+//# sourceMappingURL=chunk-ZMX5HRLI.js.map