@wrongstack/cli 1.0.19 → 1.0.26

package/dist/{per-subcommand-help-DHTYU524.js → per-subcommand-help-QDAQASPZ.js}

@@ -7,8 +7,8 @@ import {
   renderFocusedHelpToString,
   renderGenericHelp,
   subcommandsWithFocusedHelp
-} from "./chunk-JX6KL7OF.js";
-import "./chunk-2VMJ3E5Z.js";
+} from "./chunk-EPR42SWM.js";
+import "./chunk-YTEOAWOJ.js";
 export {
   deepSubcommandsWithFocusedHelp,
   renderBlockToString,
@@ -19,4 +19,4 @@ export {
   renderGenericHelp,
   subcommandsWithFocusedHelp
 };
-//# sourceMappingURL=per-subcommand-help-DHTYU524.js.map
+//# sourceMappingURL=per-subcommand-help-QDAQASPZ.js.map

package/dist/permission-prompt-mirror.d.ts

@@ -28,7 +28,7 @@
  */
 import type { ApprovalRegistry } from '@wrongstack/core/hq';
 import type { Tool } from '@wrongstack/core/types';
-type PromptDecision = 'yes' | 'no' | 'always' | 'deny';
+type PromptDecision = 'yes' | 'no' | 'always' | 'always-exact' | 'always-command' | 'always-tool' | 'deny';
 type PromptDelegate = (tool: Tool, input: unknown, suggestedPattern: string) => Promise<PromptDecision>;
 type AbortablePromptDelegate = (tool: Tool, input: unknown, suggestedPattern: string, signal: AbortSignal) => Promise<PromptDecision>;
 /**

package/dist/permission-prompt.d.ts

@@ -1,7 +1,15 @@
 import type { InputReader, Tool } from '@wrongstack/core/types';
-type PromptDecision = 'yes' | 'no' | 'always' | 'deny';
+type PromptDecision = 'yes' | 'no' | 'always' | 'always-exact' | 'always-command' | 'always-tool' | 'deny';
 /** Signature the Agent expects for confirming tool calls. */
-export type ConfirmAwaiter = (tool: Tool, input: unknown, toolUseId: string, suggestedPattern: string) => Promise<'yes' | 'no' | 'always' | 'deny'>;
+export type ConfirmAwaiter = (tool: Tool, input: unknown, toolUseId: string, suggestedPattern: string) => Promise<'yes' | 'no' | 'always' | 'always-exact' | 'always-command' | 'always-tool' | 'deny'>;
+/**
+ * Approval "prompt" for a process with no terminal on stdin — a script, CI,
+ * `wstack "task" < /dev/null`, piped input. Nobody can answer, and the
+ * terminal prompt used to wait for a key that never came, so the run hung
+ * until it was killed. Refuse instead, and say on stderr (stdout may be a
+ * JSON payload) how to grant it up front.
+ */
+export declare function makeHeadlessPromptDelegate(write?: (text: string) => void): (tool: Tool) => Promise<PromptDecision>;
 /**
  * The terminal approval prompt.
  *
@@ -16,6 +24,12 @@ export declare function makePromptDelegate(reader: InputReader): (tool: Tool, in
  * Create a ConfirmAwaiter for the CLI path. Wraps makePromptDelegate
  * with the ConfirmAwaiter type signature expected by the Agent.
  */
+/**
+ * The terminal prompt when stdin is a terminal, the headless refusal
+ * otherwise. Both approval paths (policy prompt and executor confirm) go
+ * through this, so neither can wait on a keypress nobody can make.
+ */
+export declare function makeStdinPromptDelegate(reader: InputReader, stdinIsTTY?: boolean): ReturnType<typeof makePromptDelegate>;
 export declare function makeConfirmAwaiter(reader: InputReader): ConfirmAwaiter;
 export {};
 //# sourceMappingURL=permission-prompt.d.ts.map

package/dist/permission-rules-view.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Text views of the permission rule list and of one explained call, shared by
+ * `wstack permissions` and the in-session `/permissions` command.
+ */
+import type { Context } from '@wrongstack/core/agent';
+import type { PermissionPolicy, PermissionRule, PermissionTrace, Tool } from '@wrongstack/core/types';
+export interface ExplainedCall {
+    trace: PermissionTrace;
+    rules: PermissionRule[];
+    /** The rule that decided the call. */
+    rule: PermissionRule | undefined;
+}
+/** Trace one call through the policy and the executor's gate, and name its rule. */
+export declare function explainCall(policy: Pick<PermissionPolicy, 'explain' | 'listRules'>, tool: Tool, input: unknown, ctx: Context, yolo: boolean): Promise<ExplainedCall>;
+export declare function describePermissionRule(rule: PermissionRule): string;
+export declare function formatPermissionRules(rules: readonly PermissionRule[]): string;
+export declare function formatExplainedCall({ trace, rule }: ExplainedCall): string;
+//# sourceMappingURL=permission-rules-view.d.ts.map

package/dist/{permissions-CFDLXETM.js → permissions-PL27UHYD.js}

@@ -1,23 +1,45 @@
+import {
+  explainCall,
+  formatExplainedCall,
+  formatPermissionRules
+} from "./chunk-4TVYGG6G.js";
 
 // src/subcommands/handlers/permissions.ts
-import { DefaultPermissionPolicy } from "@wrongstack/core/security";
+import { compilePermissionRules } from "@wrongstack/core/security";
 import { resolveWstackPaths } from "@wrongstack/core/utils";
+import { createProjectPermissionPolicy } from "@wrongstack/runtime";
 var permissionsCmd = async (args, deps) => {
   const subCmd = args[0];
   if (subCmd === "help" || subCmd === "--help" || subCmd === "-h" || !subCmd || subCmd === "explain" && !args[1]) {
-    if (subCmd !== "explain" && subCmd !== "help" && subCmd !== void 0) {
-      deps.renderer.writeError(`Unknown permissions subcommand: ${subCmd}
-`);
-    }
     deps.renderer.write(usage());
-    return subCmd && subCmd !== "explain" && subCmd !== "help" && subCmd !== void 0 ? 1 : 0;
+    return 0;
   }
-  if (subCmd !== "explain") {
+  if (subCmd !== "explain" && subCmd !== "rules") {
     deps.renderer.writeError(`Unknown permissions subcommand: ${subCmd}
 `);
     deps.renderer.write(usage());
     return 1;
   }
+  const jsonOutput = deps.flags?.["json"] === true || args.includes("--json");
+  const built = buildPolicy(deps);
+  if (typeof built === "string") {
+    deps.renderer.writeError(`${built}
+`);
+    return 1;
+  }
+  const { policy, ctx, yolo, yoloSource } = built;
+  if (subCmd === "rules") {
+    const rules = await compilePermissionRules(policy, ctx, { yolo });
+    if (jsonOutput) deps.renderer.write(`${JSON.stringify(rules, null, 2)}
+`);
+    else
+      deps.renderer.writeLine(
+        `YOLO: ${yolo ? "on" : "off"} (${yoloSource})
+
+${formatPermissionRules(rules)}`
+      );
+    return 0;
+  }
   const toolName = args[1];
   if (!toolName) {
     deps.renderer.writeError("Missing tool name.\n");
@@ -27,7 +49,6 @@ var permissionsCmd = async (args, deps) => {
   const inputIdx = args.indexOf("--input");
   const flagInput = deps.flags?.["input"];
   const rawInput = typeof flagInput === "string" ? flagInput : inputIdx >= 0 && inputIdx + 1 < args.length ? args[inputIdx + 1] : void 0;
-  const jsonOutput = deps.flags?.["json"] === true || args.includes("--json");
   let input = {};
   if (rawInput) {
     try {
@@ -50,67 +71,68 @@ var permissionsCmd = async (args, deps) => {
     );
     return 1;
   }
+  const explained = await explainCall(policy, tool, input, ctx, yolo);
+  if (jsonOutput) {
+    deps.renderer.write(
+      `${JSON.stringify({ ...explained.trace, rule: explained.rule }, null, 2)}
+`
+    );
+  } else {
+    deps.renderer.writeLine(
+      `YOLO: ${yolo ? "on" : "off"} (${yoloSource})
+
+${formatExplainedCall(explained)}`
+    );
+  }
+  return 0;
+};
+function buildPolicy(deps) {
   const paths = resolveWstackPaths({ projectRoot: deps.projectRoot, userHome: deps.userHome });
-  const trustFile = paths.projectTrust;
   const readSubjects = /* @__PURE__ */ new Set();
   const ctx = {
     projectRoot: deps.projectRoot,
     cwd: deps.cwd,
+    workingDir: deps.cwd,
+    meta: {},
+    provider: { id: deps.config.provider },
     hasRead(subject) {
       return readSubjects.has(subject);
     }
   };
-  const policy = new DefaultPermissionPolicy({
-    trustFile,
-    yolo: deps.flags?.["yolo"] ?? false
-  });
-  await policy.reload();
-  const trace = await policy.explain(tool, input, ctx);
-  if (jsonOutput) {
-    deps.renderer.write(JSON.stringify(trace, null, 2) + "\n");
-  } else {
-    deps.renderer.write(formatTrace(trace) + "\n");
+  const yoloFlag = deps.flags?.["yolo"];
+  const yolo = typeof yoloFlag === "boolean" ? yoloFlag : deps.config.yolo === true;
+  try {
+    const policy = createProjectPermissionPolicy({
+      projectRoot: deps.projectRoot,
+      trustFile: paths.projectTrust,
+      config: deps.config,
+      permission: { yolo }
+    })();
+    return { policy, ctx, yolo, yoloSource: typeof yoloFlag === "boolean" ? "--yolo" : "config" };
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
   }
-  return 0;
-};
-function formatTrace(trace) {
-  const lines = [];
-  lines.push(`Permission trace for "${trace.toolName}"`);
-  lines.push(`Subject: ${trace.subject ?? "(none)"}`);
-  lines.push("");
-  for (let i = 0; i < trace.steps.length; i++) {
-    const step = trace.steps[i];
-    const winner = i === trace.winnerIndex ? " \u2190 WINNER" : "";
-    const matched = step.matched ? "\u2713" : " ";
-    lines.push(`  ${matched} [${i}] ${step.rule}${winner}`);
-    lines.push(`        decision: ${step.decision}  source: ${step.source}`);
-    lines.push(`        ${step.detail}`);
-    if (i < trace.steps.length - 1) lines.push("");
-  }
-  lines.push("");
-  lines.push(`Effective: ${trace.decision.permission} (source: ${trace.decision.source})`);
-  if (trace.decision.reason) {
-    lines.push(`Reason: ${trace.decision.reason}`);
-  }
-  if (trace.decision.riskTier) {
-    lines.push(`Risk tier: ${trace.decision.riskTier}`);
-  }
-  return lines.join("\n");
 }
 function usage() {
   return `Usage:
+  wstack permissions rules [--json]
   wstack permissions explain <tool> --input '<json>' [--json]
 
 Examples:
+  wstack permissions rules
   wstack permissions explain bash --input '{"command":"rm -rf /"}'
   wstack permissions explain read --input '{"path":".env"}' --json
 
 Flags:
   --input <json>   Tool input arguments as a JSON object
   --json           Output as structured JSON instead of human-readable text
+  --yolo           Show the rules as they apply with YOLO on
+
+Inside a session, /permissions shows the same with that session\u2019s YOLO,
+answers and /permissions allow|deny rules.
 `;
 }
 export {
   permissionsCmd
 };
-//# sourceMappingURL=permissions-CFDLXETM.js.map
+//# sourceMappingURL=permissions-PL27UHYD.js.map

package/dist/plugin-config.d.ts

@@ -0,0 +1,12 @@
+import type { PluginConfig } from '@wrongstack/core/types';
+import type { PluginManagementDeps, PluginManagementResult } from './plugin-management-types.js';
+export declare function readConfig(file: string): Promise<Record<string, unknown>>;
+export declare function pluginName(p: string | PluginConfig): string;
+export declare function upsertPlugin(spec: string, opts: {
+    enabled: boolean;
+    path?: string;
+}, deps: PluginManagementDeps, verb: string): Promise<PluginManagementResult>;
+export declare function errorResult(message: string): PluginManagementResult;
+export declare function globalPluginsRoot(deps: PluginManagementDeps): string;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+//# sourceMappingURL=plugin-config.d.ts.map

package/dist/plugin-management-types.d.ts

@@ -0,0 +1,31 @@
+import type { Config, PluginConfig, PluginManagerConfig } from '@wrongstack/core/types';
+export interface PluginManagementDeps {
+    config: Config;
+    configPath: string;
+    /** Override `~/.wrongstack` for tests. Defaults to the real home dir. */
+    globalRoot?: string | undefined;
+    /** Injectable package-manager runner for tests. */
+    runPackageManager?: ((pm: string, args: readonly string[], cwd: string) => Promise<PackageManagerRunResult>) | undefined;
+}
+export interface PackageManagerRunResult {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+}
+export interface PluginManagementResult {
+    code: number;
+    level: 'output' | 'info' | 'error';
+    message: string;
+    patch?: {
+        plugins?: (string | PluginConfig)[] | undefined;
+        features?: Record<string, unknown>;
+        pluginManager?: PluginManagerConfig | undefined;
+        /**
+         * Full replacement `extensions` map (patchConfig is a SHALLOW merge,
+         * so per-plugin llm overrides must ship the whole merged object).
+         */
+        extensions?: Record<string, Record<string, unknown>> | undefined;
+    };
+    restartRequired?: boolean | undefined;
+}
+//# sourceMappingURL=plugin-management-types.d.ts.map

package/dist/plugin-management.d.ts

@@ -1,36 +1,8 @@
-import type { Config, PluginConfig, PluginManagerConfig } from '@wrongstack/core/types';
+import type { Config } from '@wrongstack/core/types';
 import { PLUGIN_AUDIT_ENTRIES, type PluginAuditEntry } from '@wrongstack/plugins/plugin-audit-catalog';
+import type { PluginManagementDeps, PluginManagementResult } from './plugin-management-types.js';
 export type { PluginAuditEntry };
 export { PLUGIN_AUDIT_ENTRIES };
-interface PluginManagementDeps {
-    config: Config;
-    configPath: string;
-    /** Override `~/.wrongstack` for tests. Defaults to the real home dir. */
-    globalRoot?: string | undefined;
-    /** Injectable package-manager runner for tests. */
-    runPackageManager?: ((pm: string, args: readonly string[], cwd: string) => Promise<PackageManagerRunResult>) | undefined;
-}
-interface PackageManagerRunResult {
-    code: number | null;
-    stdout: string;
-    stderr: string;
-}
-interface PluginManagementResult {
-    code: number;
-    level: 'output' | 'info' | 'error';
-    message: string;
-    patch?: {
-        plugins?: (string | PluginConfig)[] | undefined;
-        features?: Record<string, unknown>;
-        pluginManager?: PluginManagerConfig | undefined;
-        /**
-         * Full replacement `extensions` map (patchConfig is a SHALLOW merge,
-         * so per-plugin llm overrides must ship the whole merged object).
-         */
-        extensions?: Record<string, Record<string, unknown>> | undefined;
-    };
-    restartRequired?: boolean | undefined;
-}
 export declare function runPluginManagementCommand(args: string[], deps: PluginManagementDeps): Promise<PluginManagementResult>;
 export declare function renderConfiguredPlugins(config: Config): string;
 export declare function renderPluginAuditReport(config: Config): string;

package/dist/plugin-package-install.d.ts

@@ -0,0 +1,3 @@
+import type { PluginManagementDeps, PluginManagementResult } from './plugin-management-types.js';
+export declare function installPluginPackage(spec: string, args: string[], deps: PluginManagementDeps): Promise<PluginManagementResult>;
+//# sourceMappingURL=plugin-package-install.d.ts.map

package/dist/{plugin-usage-M6KET4OZ.js → plugin-usage-CIGOOTX3.js}

@@ -1,12 +1,13 @@
 import {
   runPluginManagementCommand
-} from "./chunk-SIS37L3W.js";
-import {
-  restoreFlags
-} from "./chunk-CSAPOCBP.js";
+} from "./chunk-L2RVEQWO.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
+import {
+  restoreFlags
+} from "./chunk-CSAPOCBP.js";
+import "./chunk-WSTVGC2C.js";
 
 // src/subcommands/handlers/plugin-usage.ts
 var pluginCmd = async (args, deps) => {
@@ -40,4 +41,4 @@ export {
   pluginCmd,
   usageCmd
 };
-//# sourceMappingURL=plugin-usage-M6KET4OZ.js.map
+//# sourceMappingURL=plugin-usage-CIGOOTX3.js.map

package/dist/{plugins-WJLW6ULV.js → plugins-HQTXUD6A.js}

@@ -1,16 +1,19 @@
 import {
   BUILTIN_PLUGIN_FACTORIES,
+  BUILTIN_PLUGIN_NAME_HINTS,
   DEPRECATED_PLUGIN_NAMES,
   _resetDeprecatedWarningsForTests,
   builtinPluginNameFromSpec,
   pluginNameFromSpec,
   setupPlugins,
   warnIfDeprecatedPluginName
-} from "./chunk-XJ7K67PP.js";
+} from "./chunk-YHYINL47.js";
 import "./chunk-EWKESL4L.js";
-import "./chunk-SIS37L3W.js";
+import "./chunk-L2RVEQWO.js";
+import "./chunk-WSTVGC2C.js";
 export {
   BUILTIN_PLUGIN_FACTORIES,
+  BUILTIN_PLUGIN_NAME_HINTS,
   DEPRECATED_PLUGIN_NAMES,
   _resetDeprecatedWarningsForTests,
   builtinPluginNameFromSpec,
@@ -18,4 +21,4 @@ export {
   setupPlugins,
   warnIfDeprecatedPluginName
 };
-//# sourceMappingURL=plugins-WJLW6ULV.js.map
+//# sourceMappingURL=plugins-HQTXUD6A.js.map

package/dist/preflight.d.ts

@@ -39,7 +39,7 @@ export declare function applySessionShellDefault(): void;
  * callers get back the (possibly refreshed) `UpdateInfo`
  * so version-aware UI can render without re-fetching.
  */
-export declare function applyPrintUpdateNotice(initialUpdateInfo: UpdateInfo | undefined): Promise<UpdateInfo | undefined>;
+export declare function applyPrintUpdateNotice(initialUpdateInfo: UpdateInfo | undefined, config?: Config | undefined): Promise<UpdateInfo | undefined>;
 /**
  * Seed the stream-debug singleton from persisted config so
  * `WireAdapter` picks it up on construction. Runtime toggles

package/dist/{projects-LMNAGGEU.js → projects-T4CZCA25.js}

@@ -1,8 +1,8 @@
 
 // src/subcommands/handlers/projects.ts
+import { color } from "@wrongstack/core/utils";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { color } from "@wrongstack/core/utils";
 var projectsCmd = async (_args, deps) => {
   const manifestPath = path.join(deps.paths.globalRoot, "projects.json");
   let entries;
@@ -18,10 +18,7 @@ var projectsCmd = async (_args, deps) => {
     return 0;
   }
   const sorted = [...entries].sort((a, b) => (b.lastSeen ?? "").localeCompare(a.lastSeen ?? ""));
-  const slugWidth = Math.min(
-    Math.max(...sorted.map((entry) => (entry.slug ?? "").length), 4),
-    40
-  );
+  const slugWidth = Math.min(Math.max(...sorted.map((entry) => (entry.slug ?? "").length), 4), 40);
   for (const entry of sorted) {
     const slug = (entry.slug ?? "?").padEnd(slugWidth);
     const seen = entry.lastSeen ?? "";
@@ -33,4 +30,4 @@ var projectsCmd = async (_args, deps) => {
 export {
   projectsCmd
 };
-//# sourceMappingURL=projects-LMNAGGEU.js.map
+//# sourceMappingURL=projects-T4CZCA25.js.map

package/dist/provider-config-utils.d.ts

@@ -1,6 +1,7 @@
 import { expectDefined } from '@wrongstack/core/utils';
 export { expectDefined };
 import type { ProviderApiKey, ProviderConfig, SecretVault } from '@wrongstack/core/types';
+export { clearStaleProviderDefaults } from '@wrongstack/providers';
 /**
  * Normalize a ProviderConfig to the canonical `apiKeys[]` form.
  * Migrates the legacy single-key `apiKey` field on the fly so every
@@ -26,12 +27,6 @@ export declare function writeKeysBack(cfg: ProviderConfig, keys: ProviderApiKey[
  * when present on a freshly-loaded config it may contain a masked value.
  */
 export declare function resolveActiveApiKey(cfg: ProviderConfig): string | undefined;
-/**
- * Clear top-level provider/model defaults when provider mutations make them
- * stale. This prevents a removed provider, deleted final key, or edited model
- * allowlist from being accepted on the next boot and crashing provider setup.
- */
-export declare function clearStaleProviderDefaults(config: Record<string, unknown>): void;
 /**
  * Return the label of the active key, or the first key's label if no
  * active is pinned. Returns `undefined` when there are no keys at all.

package/dist/provider-helpers.d.ts

@@ -1,4 +1,11 @@
+/**
+ * Shared provider-config helpers used by the picker, main boot sequence,
+ * and subcommands. Keeps provider key detection and alias resolution in
+ * one place so the logic doesn't drift between call sites.
+ */
+import { isKeylessLocalProvider } from '@wrongstack/core/models';
 import type { Config, ModelsRegistry, ProviderConfig, ResolvedProvider } from '@wrongstack/core/types';
+export { isKeylessLocalProvider };
 /** Return the provider's visible model ids: models.dev plus anything the saved
  * config names that the catalog does not carry.
  *
@@ -23,17 +30,6 @@ import type { Config, ModelsRegistry, ProviderConfig, ResolvedProvider } from '@
  * request time rather than being silently unselectable, which is the better
  * failure: visible and actionable. */
 export declare function visibleModelIds(providerId: string, config: Config, catalogModelIds: string[], cfg?: ProviderConfig | undefined): string[];
-/**
- * Is this a keyless local gateway — a server on a loopback address that
- * declares no API-key env vars (omniroute, LiteLLM/vLLM/LM Studio/Ollama
- * running locally, …)? These need no credential, so they belong in the
- * picker even though `hasApiKey` returns false for them. Accepts the
- * minimal shape both call sites can supply.
- */
-export declare function isKeylessLocalProvider(provider: {
-    apiBase?: string | undefined;
-    envVars?: string[] | undefined;
-}): boolean;
 /**
  * Does this provider have an API key available — either in the
  * environment (via one of its known env vars) or stored in config

package/dist/{providers-models-LFNZ5WI7.js → providers-models-5Z2PJTEW.js}

@@ -1,20 +1,26 @@
 import {
   visibleModelIds
-} from "./chunk-3VXYY5JC.js";
+} from "./chunk-5UZBUV2H.js";
+import {
+  mutateConfigProviders
+} from "./chunk-LUMETJFO.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
-import {
-  mutateConfigProviders
-} from "./chunk-DR2OXU46.js";
 
 // src/subcommands/handlers/providers-models.ts
 import * as fs from "node:fs/promises";
-import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
+import { decryptConfigSecretsForRewrite, encryptConfigSecrets } from "@wrongstack/core/security";
 import {
   ConfigError
 } from "@wrongstack/core/types";
-import { atomicWrite, color, expectDefined } from "@wrongstack/core/utils";
+import {
+  atomicWrite,
+  backupConfigFile,
+  color,
+  expectDefined,
+  withFileLock
+} from "@wrongstack/core/utils";
 var providersCmd = async (args, deps) => {
   const providerFlags = subcommandFlags(args, deps);
   const showAll = providerFlags["all"] === true || providerFlags["all"] === "true";
@@ -29,6 +35,7 @@ var providersCmd = async (args, deps) => {
       "openai-codex": [],
       "github-copilot": [],
       google: [],
+      "google-antigravity": [],
       unsupported: []
     };
     for (const p of all) byFamily[p.family].push(p);
@@ -508,34 +515,37 @@ async function modelsCaps(args, deps) {
 async function mutateModelsConfig(deps, mutator) {
   const vault = deps.vault;
   const configPath = activeProfileConfigPath(deps.paths, deps.config);
-  let fileExists = true;
-  let raw;
-  try {
-    raw = await fs.readFile(configPath, "utf8");
-  } catch (err) {
-    if (err.code !== "ENOENT") throw err;
-    fileExists = false;
-    raw = "{}";
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    if (fileExists) {
-      throw new ConfigError({
-        message: `Refusing to overwrite corrupt config at ${configPath} (${err.message}).`,
-        code: "CONFIG_PARSE_FAILED",
-        context: { filePath: configPath, operation: "mutateModelsConfig" }
-      });
+  await withFileLock(configPath, async () => {
+    let fileExists = true;
+    let raw;
+    try {
+      raw = await fs.readFile(configPath, "utf8");
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+      fileExists = false;
+      raw = "{}";
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (err) {
+      if (fileExists) {
+        throw new ConfigError({
+          message: `Refusing to overwrite corrupt config at ${configPath} (${err.message}).`,
+          code: "CONFIG_PARSE_FAILED",
+          context: { filePath: configPath, operation: "mutateModelsConfig" }
+        });
+      }
+      parsed = {};
     }
-    parsed = {};
-  }
-  const decrypted = decryptConfigSecrets(parsed, vault);
-  const models = decrypted.models ?? {};
-  mutator(models);
-  decrypted.models = models;
-  const encrypted = encryptConfigSecrets(decrypted, vault);
-  await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+    const decrypted = decryptConfigSecretsForRewrite(parsed, vault);
+    const models = decrypted.models ?? {};
+    mutator(models);
+    decrypted.models = models;
+    const encrypted = encryptConfigSecrets(decrypted, vault);
+    await backupConfigFile(configPath, { globalRoot: deps.paths.globalRoot });
+    await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  });
 }
 function parseSizeFlag(raw) {
   if (!raw) return void 0;
@@ -660,4 +670,4 @@ export {
   modelsCmd,
   providersCmd
 };
-//# sourceMappingURL=providers-models-LFNZ5WI7.js.map
+//# sourceMappingURL=providers-models-5Z2PJTEW.js.map

package/dist/release-asset-download.d.ts

@@ -0,0 +1,13 @@
+/** Download one release asset without buffering beyond its configured ceiling. */
+export declare function downloadReleaseAsset(url: string, timeoutMs: number, maxBytes: number): Promise<Buffer>;
+/**
+ * Stream one release asset into `file` (created exclusively) and return its
+ * SHA-256. The background self-update uses this so a 100+ MB executable never
+ * sits in the session's heap. `file` is removed when the download fails.
+ */
+export declare function downloadReleaseAssetToFile(url: string, file: string, options: {
+    timeoutMs: number;
+    maxBytes: number;
+    signal?: AbortSignal | undefined;
+}): Promise<string>;
+//# sourceMappingURL=release-asset-download.d.ts.map

package/dist/release-attestation.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Build-provenance check for a downloaded standalone executable.
+ *
+ * SHA256SUMS comes from the same release as the binary, so it catches a
+ * corrupted download but not a forged one: whoever can upload the binary can
+ * upload a matching SHA256SUMS. The release workflow also attests every
+ * binary (`actions/attest-build-provenance`), and GitHub serves those
+ * attestations by digest. A binary is accepted only if one of them says this
+ * exact digest was built by `binaries.yml`, called from `release.yml`, for the
+ * push of the tag `v<version>` in this repository, on a GitHub-hosted runner.
+ * A build from a branch or a manual run is not a release and does not count.
+ *
+ * The Sigstore signature over the statement is not verified here: the
+ * statement is trusted as served by GitHub's API over TLS.
+ */
+/** GitHub repository the standalone executables are released from. */
+export declare const RELEASES_REPO = "WrongStack/WrongStack";
+export interface AttestationSubject {
+    /** Release asset name, e.g. `wstack-windows-x64.exe`. */
+    assetName: string;
+    /** Lowercase hex SHA-256 of the downloaded bytes. */
+    sha256: string;
+    /** Release version without the `v`, e.g. `1.0.25`. */
+    version: string;
+}
+/** Throws unless GitHub holds a release attestation for `subject`. */
+export declare function verifyReleaseAttestation(subject: AttestationSubject, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=release-attestation.d.ts.map