@wrongstack/cli 1.0.19 → 1.0.26

package/dist/boot/stream-json.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `--output-format stream-json`: single-shot progress as JSON Lines on stdout.
+ *
+ * One object per line, each with a `type`:
+ *   init         session id, provider/model, cwd, tool names — first line
+ *   text_delta   streamed answer text (only with --include-partial-messages)
+ *   assistant    one model response: text and tool_use blocks, stop reason, usage
+ *   tool_result  one finished tool call: id, name, ok, duration, output preview
+ *   result       the `--output-json` payload — always the last line
+ *
+ * Only the leader's own activity is streamed. Subagents report through their
+ * `subagent.*` events; the ones that reach the host bus under the plain names
+ * carry a non-leader `agentId` and are dropped, so a delegating run does not
+ * interleave several conversations on one stream.
+ */
+import type { EventBus } from '@wrongstack/core/kernel';
+export type OutputFormat = 'text' | 'json' | 'stream-json';
+/** `undefined` when the flag is absent. Throws on an unknown format. */
+export declare function parseOutputFormat(value: string | boolean | undefined): OutputFormat | undefined;
+export interface StreamJsonOptions {
+    events: Pick<EventBus, 'on'>;
+    /** Writes one line (the caller adds nothing; this function appends `\n`). */
+    write: (line: string) => void;
+    includePartialMessages: boolean;
+}
+/** Subscribe and start writing. Returns the unsubscribe function. */
+export declare function startStreamJson(opts: StreamJsonOptions): () => void;
+/** The first line of the stream. */
+export declare function streamJsonInit(info: {
+    sessionId: string | null;
+    provider: string | null;
+    model: string | null;
+    cwd: string;
+    tools: readonly string[];
+}): string;
+//# sourceMappingURL=stream-json.d.ts.map

package/dist/boot/structured-output.d.ts

@@ -0,0 +1,16 @@
+import type { JSONSchema } from '@wrongstack/core/types';
+/** Inline JSON when the value starts with `{`, otherwise a path relative to `cwd`. */
+export declare function resolveJsonSchemaFlag(value: string | boolean | undefined, cwd: string): Promise<JSONSchema | undefined>;
+/** Appended to the user's task. The task stays first: it is the instruction. */
+export declare function withSchemaInstruction(query: string, schema: JSONSchema): string;
+export type StructuredCheck = {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    errors: string[];
+};
+/** Parse and validate a final answer. */
+export declare function checkStructuredAnswer(text: string | undefined, schema: JSONSchema): StructuredCheck;
+export declare function repairPrompt(errors: readonly string[]): string;
+//# sourceMappingURL=structured-output.d.ts.map

package/dist/boot/system-prompt-builder.d.ts

@@ -86,6 +86,8 @@ interface BindSystemPromptBuilderDeps {
     tokenSavingMode?: TokenSavingTier | boolean | undefined;
     /** `config.systemPrompt.variant` — selects system.md, system-lite.md, or system-pro.md. */
     systemPromptVariant?: SystemInstructionVariant | undefined;
+    /** `--append-system-prompt[-file]` text; appended to the host prompt only. */
+    appendedInstructions?: string | undefined;
     paths: SystemPromptBuilderPaths;
     /** Project root, for the Atlas brief. Omit to leave the brief out entirely. */
     projectRoot?: string | undefined;

package/dist/boot/tool-restriction-flags.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `--only-tools <names>` and `--disallowed-tools <names>`: a launch-time tool
+ * restriction applied to the tool registry (see `ToolRegistry.setSessionRestriction`).
+ *
+ * `--only-tools` rather than Claude Code's `--tools`: `--tools` is already a
+ * boolean of `wstack models add` and the CSV of `wstack mcp serve`, so a value
+ * form here would swallow the prompt in `wstack --tools read "task"`.
+ *
+ * Names are comma- or space-separated; a trailing `*` matches a prefix
+ * (`mcp__github__*`). Claude Code's scoped rules (`Bash(git *)`) are refused
+ * instead of ignored: dropping a deny rule silently would leave the operator
+ * believing a command is blocked when it is not.
+ */
+export interface ToolRestriction {
+    only?: string[] | undefined;
+    deny: string[];
+    /** Set by `--restricted` only (see restricted-mode.ts). */
+    denyCapabilities?: readonly string[] | undefined;
+    requireDeclaredCapabilities?: boolean | undefined;
+}
+/**
+ * `--allowed-tools <names>`: pre-approve tools (no permission prompt) for this
+ * process. Same list syntax and the same refusal of scoped rules — a scoped
+ * allow like `Bash(git *)` widened to all of `bash` would approve far more
+ * than the operator asked for.
+ */
+export declare function resolveLaunchAllowedTools(flags: Readonly<Record<string, string | boolean>>): string[] | undefined;
+/** `undefined` when neither flag is set. Throws on an unusable value. */
+export declare function resolveToolRestriction(flags: Readonly<Record<string, string | boolean>>): ToolRestriction | undefined;
+/**
+ * Names in the restriction that match no registered tool — most likely typos.
+ * Globs and MCP-style names (`server__tool`) are skipped: MCP servers
+ * register after boot, so their absence here proves nothing.
+ */
+export declare function unknownRestrictedToolNames(restriction: ToolRestriction, isRegistered: (name: string) => boolean): string[];
+//# sourceMappingURL=tool-restriction-flags.d.ts.map

package/dist/boot/tui-project-picker-callback.d.ts

@@ -26,5 +26,5 @@ export declare function getProjectPickerItems(ctx: ProjectPickerContext): Promis
  * per-project session writer, rebuilt system prompt, and no spawned
  * replacement process.
  */
-export declare function onProjectSelect(ctx: ProjectPickerContext, slug: string, kind: 'project' | 'action'): Promise<void>;
+export declare function onProjectSelect(ctx: ProjectPickerContext, slug: string, kind: 'project' | 'action'): Promise<string | null>;
 //# sourceMappingURL=tui-project-picker-callback.d.ts.map

package/dist/boot/tui-settings-adapter.d.ts

@@ -1,9 +1,22 @@
-import type { ConfigStore, FleetChatVerbosity } from '@wrongstack/core/types';
-import { type WstackPaths } from '@wrongstack/core/utils';
+/**
+ * TUI Settings adapter — extracted from the runTui() options literal.
+ *
+ * Phase C step 1. The getSettings/saveSettings pair (~337 lines) reads
+ * config from the ConfigStore and persists changes to disk. This module
+ * owns both functions, receiving its dependencies through a typed context.
+ *
+ * `getSettings()` maps the full Config into the flat LiveSettingsInput
+ * shape the TUI SettingsPicker consumes. `saveSettings()` does the
+ * reverse: read → modify → encrypt → atomic-write for every section,
+ * then syncs the in-memory store and applies live runtime effects.
+ */
+import type { ConfigStore, FleetChatVerbosity, SecretVault } from '@wrongstack/core/types';
+import type { WstackPaths } from '@wrongstack/core/utils';
 import type { LiveSettingsInput } from '../live-settings-input.js';
 interface SettingsAdapterContext {
     configStore: ConfigStore;
     wpaths: WstackPaths;
+    vault: SecretVault;
     fleetStreamController: {
         setMode?: ((mode: FleetChatVerbosity) => void) | undefined;
     } | undefined;

package/dist/boot/worktree-sessions.d.ts

@@ -0,0 +1,21 @@
+import type { SessionSummary } from '@wrongstack/core/types';
+import type { GitWorktreeEntry } from '@wrongstack/core/worktree';
+export interface WorktreeRef {
+    root: string;
+    name: string;
+    branch?: string | undefined;
+}
+/**
+ * The other worktree a session belongs to, or undefined when it ran in the
+ * current checkout, in a checkout git no longer lists (resuming it here is
+ * the only option left), or before checkouts were recorded.
+ */
+export declare function worktreeOfSession(summary: Pick<SessionSummary, 'checkout'>, worktrees: readonly GitWorktreeEntry[]): WorktreeRef | undefined;
+/**
+ * Wrap the resume callback: a session that belongs to another worktree
+ * (per `lookup`, filled from the last listing) first switches the TUI to that
+ * worktree, then resumes there. A failed switch rejects, which the picker
+ * shows, and leaves the current project untouched.
+ */
+export declare function withWorktreeSwitch<A extends unknown[], R>(resume: (sessionId: string, ...rest: A) => Promise<R>, lookup: (sessionId: string) => WorktreeRef | undefined, switchProject: (root: string, name: string) => Promise<string | null>): (sessionId: string, ...rest: A) => Promise<R>;
+//# sourceMappingURL=worktree-sessions.d.ts.map

package/dist/{boot-auto-thin-MANHOYHE.js → boot-auto-thin-6Q56FY3F.js}

@@ -1,9 +1,10 @@
 import {
   persistConfigSetting
-} from "./chunk-JACOMTIH.js";
+} from "./chunk-SFBFYIOW.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
+import "./chunk-WSTVGC2C.js";
 
 // src/boot/boot-auto-thin.ts
 import {
@@ -98,4 +99,4 @@ async function runBootAutoThin(deps) {
 export {
   runBootAutoThin
 };
-//# sourceMappingURL=boot-auto-thin-MANHOYHE.js.map
+//# sourceMappingURL=boot-auto-thin-6Q56FY3F.js.map

package/dist/boot-provider-selection.d.ts

@@ -0,0 +1,67 @@
+import type { Config, ModelsRegistry } from '@wrongstack/core/types';
+import type { ReadlineInputReader } from './input-reader.js';
+import type { TerminalRenderer } from './renderer.js';
+/**
+ * Resolve the bundled overlay `providers.json`. It ships at `<pkg>/data/` —
+ * a sibling of both `src/` (dev) and `dist/` (published) — so `../data/…`
+ * relative to this module resolves in both. Returns undefined if anything
+ * about the resolution looks off (the overlay is optional).
+ */
+export declare function resolveBundledOverlayFile(): string | undefined;
+export interface SavedDefaultStatus {
+    ok: boolean;
+    reason?: string;
+}
+export declare function validateSavedProviderModel(config: Config, modelsRegistry: ModelsRegistry): Promise<SavedDefaultStatus>;
+/**
+ * Resolve a usable `{ provider, model }` from saved config when the active
+ * pointers are unset — the non-interactive (WebUI / --no-interactive) analogue
+ * of the TUI's interactive picker. Mirrors the standalone WebUI's auto-select
+ * (packages/webui-server start-webui.ts) so a config whose only entry is a
+ * custom provider still boots instead of erroring out. Prefers an already-set
+ * `config.provider`, otherwise the first saved provider; the model comes from
+ * the provider's saved `models` allowlist, falling back to the catalog's first
+ * model. Returns undefined when no provider yields a concrete model.
+ */
+export declare function autoSelectSavedProvider(config: Config, modelsRegistry: ModelsRegistry): Promise<{
+    provider: string;
+    model: string;
+} | undefined>;
+export declare function resolveBundledSkillsDir(): string | undefined;
+export declare function resolveBundledPromptsDir(): string | undefined;
+/**
+ * Determine whether a directory is the user's home directory. Used by the
+ * startup guard to refuse launching wstack in `~` — where it would risk
+ * creating a `.git` repo at the top of the user's filesystem.
+ *
+ * Resolves both paths so trailing slashes and relative segments are
+ * normalized before the comparison. Case is compared as-is (matches
+ * `os.homedir()` and `process.cwd()` output on every platform). Symlinks
+ * are NOT followed: the common case (`cwd === os.homedir()` literally) is
+ * what this guard targets.
+ *
+ * Exported for testing — the call site in {@link boot} performs the actual
+ * warning + exit.
+ */
+export declare function isHomeDirectory(cwd: string, userHome: string): boolean;
+/**
+ * Determine whether the first-run YOLO disclosure notice should be printed
+ * to stderr. Exported for testing.
+ *
+ * @param lastChoices  Saved launch preferences from config (undefined = first run)
+ * @param yoloPinned   Explicit --yolo/--no-yolo flag (undefined = not provided)
+ * @param yolo         Resolved YOLO state
+ */
+export declare function shouldPrintYoloNotice(lastChoices: unknown, yoloPinned: boolean | undefined, yolo: boolean): boolean;
+/**
+ * Check whether the current working directory has a `.git` repository.
+ * If not, prompt the user before the path resolver walks up to a parent.
+ * When the parent directory contains a `.git`, also inform the user so
+ * they know why the project root was resolved to a different directory.
+ */
+export declare function checkGitInCwd(opts: {
+    cwd: string;
+    renderer: TerminalRenderer;
+    reader: ReadlineInputReader;
+}): Promise<void>;
+//# sourceMappingURL=boot-provider-selection.d.ts.map

package/dist/boot.d.ts

@@ -1,23 +1,10 @@
+export { autoSelectSavedProvider, isHomeDirectory, shouldPrintYoloNotice, } from './boot-provider-selection.js';
 import { DefaultLogger } from '@wrongstack/core/infrastructure';
 import type { Config, ModelsRegistry, SecretVault } from '@wrongstack/core/types';
 import { type WstackPaths } from '@wrongstack/core/utils';
 import { ReadlineInputReader } from './input-reader.js';
 import { TerminalRenderer } from './renderer.js';
 import type { UpdateInfo } from './update-check.js';
-/**
- * Resolve a usable `{ provider, model }` from saved config when the active
- * pointers are unset — the non-interactive (WebUI / --no-interactive) analogue
- * of the TUI's interactive picker. Mirrors the standalone WebUI's auto-select
- * (packages/webui-server start-webui.ts) so a config whose only entry is a
- * custom provider still boots instead of erroring out. Prefers an already-set
- * `config.provider`, otherwise the first saved provider; the model comes from
- * the provider's saved `models` allowlist, falling back to the catalog's first
- * model. Returns undefined when no provider yields a concrete model.
- */
-export declare function autoSelectSavedProvider(config: Config, modelsRegistry: ModelsRegistry): Promise<{
-    provider: string;
-    model: string;
-} | undefined>;
 export interface BootContext {
     config: Config;
     vault: SecretVault;
@@ -36,30 +23,6 @@ export interface BootContext {
     /** True when running in --webui/--no-interactive mode but provider/model not configured */
     needsSetup?: boolean | undefined;
 }
-/**
- * Determine whether a directory is the user's home directory. Used by the
- * startup guard to refuse launching wstack in `~` — where it would risk
- * creating a `.git` repo at the top of the user's filesystem.
- *
- * Resolves both paths so trailing slashes and relative segments are
- * normalized before the comparison. Case is compared as-is (matches
- * `os.homedir()` and `process.cwd()` output on every platform). Symlinks
- * are NOT followed: the common case (`cwd === os.homedir()` literally) is
- * what this guard targets.
- *
- * Exported for testing — the call site in {@link boot} performs the actual
- * warning + exit.
- */
-export declare function isHomeDirectory(cwd: string, userHome: string): boolean;
-/**
- * Determine whether the first-run YOLO disclosure notice should be printed
- * to stderr. Exported for testing.
- *
- * @param lastChoices  Saved launch preferences from config (undefined = first run)
- * @param yoloPinned   Explicit --yolo/--no-yolo flag (undefined = not provided)
- * @param yolo         Resolved YOLO state
- */
-export declare function shouldPrintYoloNotice(lastChoices: unknown, yoloPinned: boolean | undefined, yolo: boolean): boolean;
 /**
  * Boot the CLI: parse args, load config, handle subcommand dispatch
  * (early exit), run interactive prompts (project check, provider picker,

package/dist/{chunk-JY52HWL6.js → chunk-2EBVTYJR.js}

@@ -246,7 +246,7 @@ async function dispatch(controller, commandId, type, payload) {
       }
       const toolUseId = typeof payload["toolUseId"] === "string" ? payload["toolUseId"] : "";
       const decision = payload["decision"];
-      if (toolUseId.length === 0 || decision !== "yes" && decision !== "no" && decision !== "always" && decision !== "deny") {
+      if (toolUseId.length === 0 || decision !== "yes" && decision !== "no" && decision !== "always" && decision !== "always-exact" && decision !== "always-command" && decision !== "always-tool" && decision !== "deny") {
         return { commandId, status: "rejected", message: "malformed approve command" };
       }
       const applied = resolveApproval(toolUseId, decision, sessionId);
@@ -320,4 +320,4 @@ export {
   createProjectKanbanAssignHandler,
   createHqCommandDispatcher
 };
-//# sourceMappingURL=chunk-JY52HWL6.js.map
+//# sourceMappingURL=chunk-2EBVTYJR.js.map

package/dist/{chunk-RDHFXOJM.js → chunk-2ERX3RPN.js}

@@ -1,15 +1,8 @@
-import {
-  appendHistory,
-  backupCurrent
-} from "./chunk-B4JLSXZB.js";
 import {
   hasApiKey,
   isKeylessLocalProvider,
   visibleModelIds
-} from "./chunk-3VXYY5JC.js";
-import {
-  openBrowser
-} from "./chunk-DAKVBMD4.js";
+} from "./chunk-5UZBUV2H.js";
 import {
   activeLabel,
   loadConfigProviders,
@@ -17,8 +10,16 @@ import {
   mutateConfigProviders,
   normalizeKeys,
   nowIso,
+  resolveActiveApiKey,
   writeKeysBack
-} from "./chunk-DR2OXU46.js";
+} from "./chunk-LUMETJFO.js";
+import {
+  openBrowser
+} from "./chunk-DAKVBMD4.js";
+import {
+  appendHistory,
+  backupCurrent
+} from "./chunk-WSTVGC2C.js";
 
 // src/auth-menu/auth-menu-audit.ts
 import { appendFileSync } from "node:fs";
@@ -260,10 +261,12 @@ async function runProviderAuthLogin(deps, strategyId, opts = {}) {
       deps.renderer.write(color.dim("  Sign-in cancelled or timed out.\n"));
       return 1;
     }
+    controller.signal.throwIfAborted();
     await mutateConfigProviders(
       deps.profileConfigPath,
       deps.vault,
       (providers) => {
+        controller.signal.throwIfAborted();
         applyProviderAuthOutcome(providers, outcome, { targetProviderId: opts.providerId });
       },
       deps.profileConfigPath
@@ -287,6 +290,7 @@ async function runProviderAuthLogin(deps, strategyId, opts = {}) {
 // src/auth-menu/local.ts
 import { DefaultSecretScrubber as DefaultSecretScrubber2 } from "@wrongstack/core/security";
 import { color as color3 } from "@wrongstack/core/utils";
+import { authProfileAliasError } from "@wrongstack/providers";
 import { probeLocalLlm } from "@wrongstack/runtime/probe";
 
 // src/auth-menu/helpers.ts
@@ -423,10 +427,8 @@ ${color2.bold("WrongStack")} ${color2.dim("\u2014 API key manager")}
   );
   renderer.write(`    ${color2.bold("c")}  Add a custom provider
 `);
-  renderer.write(
-    `    ${color2.bold("s")}  Login with provider OAuth
-`
-  );
+  renderer.write(`    ${color2.bold("s")}  Login with provider OAuth
+`);
   if (ids.length > 0) {
     renderer.write(
       `    ${color2.dim("1-")}${color2.dim(String(ids.length))}  ${color2.bold("Manage a provider")}
@@ -479,10 +481,27 @@ async function runAuthLocal(deps, opts = {}) {
   if (!chosen) {
     return 0;
   }
-  const baseUrl = opts.baseUrl?.trim() || chosen.defaultBaseUrl;
+  const profileId = opts.alias?.trim() || chosen.id;
+  const aliasError = authProfileAliasError(
+    opts.alias !== void 0 ? opts.alias.trim() : profileId
+  );
+  if (aliasError) {
+    deps.renderer.writeError(aliasError);
+    return 1;
+  }
+  const aliasedProfile = opts.alias !== void 0 ? (await loadProviders(deps))[profileId] : void 0;
+  if (aliasedProfile && !opts.probeOnly) {
+    deps.renderer.writeError(
+      `Auth profile "${profileId}" already exists. Choose another alias or manage its keys explicitly.`
+    );
+    return 1;
+  }
+  const baseUrl = opts.baseUrl?.trim() || (opts.probeOnly ? aliasedProfile?.baseUrl : void 0) || chosen.defaultBaseUrl;
   let apiKey;
   if (opts.apiKey !== void 0) {
     apiKey = opts.apiKey.trim() || void 0;
+  } else if (opts.probeOnly && aliasedProfile) {
+    apiKey = resolveActiveApiKey(aliasedProfile);
   } else if (chosen.noAuth) {
     apiKey = void 0;
   } else if (opts.skipKey) {
@@ -528,7 +547,7 @@ async function runAuthLocal(deps, opts = {}) {
   const resolvedModels = resolveModelList(opts.models, probe, scrubber);
   const label = opts.label?.trim() || "default";
   const providers = await loadProviders(deps);
-  const existing = providers[chosen.id];
+  const existing = providers[profileId];
   const previousModels = existing?.models ? [...existing.models] : existing?.models === void 0 ? void 0 : [...existing.models];
   const usedLabels = new Set(existing ? normalizeKeys(existing).map((k) => k.label) : []);
   let finalLabel = label;
@@ -543,7 +562,9 @@ async function runAuthLocal(deps, opts = {}) {
       deps.profileConfigPath,
       deps.vault,
       (all) => {
-        const p = all[chosen.id] ?? { type: chosen.id };
+        if (opts.alias !== void 0 && all[profileId])
+          throw new Error(`Auth profile "${profileId}" already exists.`);
+        const p = all[profileId] ?? { type: chosen.id };
         if (!p.type) p.type = chosen.id;
         if (!p.family) p.family = "openai-compatible";
         if (!p.baseUrl) p.baseUrl = baseUrl;
@@ -557,16 +578,16 @@ async function runAuthLocal(deps, opts = {}) {
           writeKeysBack(p, list);
           if (!p.activeKey) p.activeKey = finalLabel;
         }
-        all[chosen.id] = p;
+        all[profileId] = p;
       },
       deps.profileConfigPath
     );
   } catch (err) {
-    deps.renderer.writeError(`Failed to save ${chosen.id}: ${err.message}`);
+    deps.renderer.writeError(`Failed to save ${profileId}: ${err.message}`);
     return 1;
   }
   const events = decideAuthLocalEvents({
-    providerId: chosen.id,
+    providerId: profileId,
     baseUrl,
     previousModels,
     newModels: resolvedModels,
@@ -581,19 +602,19 @@ async function runAuthLocal(deps, opts = {}) {
   }
   if (apiKey) {
     deps.renderer.write(
-      `  ${color3.green("\u2713")} Saved ${color3.bold(chosen.id)}/${color3.bold(finalLabel)} \u2192 ${color3.cyan(baseUrl)}
+      `  ${color3.green("\u2713")} Saved ${color3.bold(profileId)}/${color3.bold(finalLabel)} \u2192 ${color3.cyan(baseUrl)}
 `
     );
   } else {
     deps.renderer.write(
-      `  ${color3.green("\u2713")} Saved ${color3.bold(chosen.id)} (no key) \u2192 ${color3.cyan(baseUrl)}
+      `  ${color3.green("\u2713")} Saved ${color3.bold(profileId)} (no key) \u2192 ${color3.cyan(baseUrl)}
 `
     );
   }
   const firstModel = resolvedModels && resolvedModels.length > 0 ? resolvedModels[0] : null;
   const modelHint = firstModel ? color3.cyan(firstModel) : color3.dim("<model-id>");
   deps.renderer.write(
-    color3.dim(`  Launch: wstack --provider ${chosen.id} --model ${modelHint} "<task>"
+    color3.dim(`  Launch: wstack --provider ${profileId} --model ${modelHint} "<task>"
 `)
   );
   return 0;
@@ -746,11 +767,19 @@ function resolveOAuthKind(choice, opts = {}) {
 async function runOAuthLoginChoice(deps, choice, opts = {}) {
   const kind = resolveOAuthKind(choice, { ...opts, deps });
   if (!kind) return false;
-  await runOAuthLoginKind(deps, kind);
+  const sourceId = providerAuthRegistryFor(deps).get(kind)?.providerId ?? kind;
+  const profiles = await loadProviders(deps);
+  let suggestedAlias = sourceId;
+  for (let n = 2; profiles[suggestedAlias]; n++) suggestedAlias = `${sourceId}-${n}`;
+  const alias = (await deps.reader.readLine(
+    `  Auth profile alias [${suggestedAlias}] (existing alias re-authenticates; q cancels): `
+  )).trim();
+  if (alias.toLowerCase() !== "q")
+    await runOAuthLoginKind(deps, kind, { providerId: alias || suggestedAlias });
   return true;
 }
-async function runOAuthLoginKind(deps, kind) {
-  return runProviderAuthLogin(deps, kind);
+async function runOAuthLoginKind(deps, kind, opts) {
+  return opts ? runProviderAuthLogin(deps, kind, opts) : runProviderAuthLogin(deps, kind);
 }
 async function runOAuthLoginMenu(deps) {
   const entries = providerAuthRegistryFor(deps).list();
@@ -777,6 +806,7 @@ import {
   setRawMode as setRawMode2,
   stripAnsi as stripAnsi2,
   toErrorMessage,
+  withFileLock,
   writeOut as writeOut2
 } from "@wrongstack/core/utils";
 
@@ -1053,6 +1083,7 @@ var PROVIDER_FAMILY_PREFERRED_ORDER = [
   "openai-codex",
   "github-copilot",
   "google",
+  "google-antigravity",
   "openai-compatible"
 ];
 function orderProvidersForDisplay(filtered) {
@@ -1129,41 +1160,44 @@ function renderLiveProviderList(query, filtered, selectedIdx, savedSet) {
 }
 async function saveToGlobalConfig(configPath, provider, model, homeFn = () => process.env.HOME ?? os.homedir()) {
   try {
-    const { atomicWrite } = await import("@wrongstack/core/utils");
-    const fs = await import("node:fs/promises");
-    let existing = {};
-    try {
-      const raw = await fs.readFile(configPath, "utf8");
-      existing = JSON.parse(raw);
-    } catch {
-    }
-    const oldCfg = { ...existing };
-    existing.provider = provider;
-    existing.model = model;
-    try {
-      await backupCurrent(homeFn, configPath);
-    } catch (err) {
-      console.warn(
-        JSON.stringify({
-          level: "warn",
-          event: "picker.backup_failed",
-          message: toErrorMessage(err),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        })
-      );
-    }
-    await atomicWrite(configPath, JSON.stringify(existing, null, 2), { mode: 384 });
-    try {
-      await appendHistory(
-        oldCfg,
-        existing,
-        `Provider/model changed: ${oldCfg.provider ?? "(none)"} \u2192 ${provider}, ${oldCfg.model ?? "(none)"} \u2192 ${model}`,
-        homeFn,
-        configPath
-      );
-    } catch {
-    }
-    return true;
+    return await withFileLock(configPath, async () => {
+      const { atomicWrite } = await import("@wrongstack/core/utils");
+      const fs = await import("node:fs/promises");
+      let existing = {};
+      try {
+        const raw = await fs.readFile(configPath, "utf8");
+        existing = JSON.parse(raw);
+      } catch (err) {
+        if (err.code !== "ENOENT") throw err;
+      }
+      const oldCfg = { ...existing };
+      existing.provider = provider;
+      existing.model = model;
+      try {
+        await backupCurrent(homeFn, configPath);
+      } catch (err) {
+        console.warn(
+          JSON.stringify({
+            level: "warn",
+            event: "picker.backup_failed",
+            message: toErrorMessage(err),
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          })
+        );
+      }
+      await atomicWrite(configPath, JSON.stringify(existing, null, 2), { mode: 384 });
+      try {
+        await appendHistory(
+          oldCfg,
+          existing,
+          `Provider/model changed: ${oldCfg.provider ?? "(none)"} \u2192 ${provider}, ${oldCfg.model ?? "(none)"} \u2192 ${model}`,
+          homeFn,
+          configPath
+        );
+      } catch {
+      }
+      return true;
+    });
   } catch (err) {
     console.warn(
       JSON.stringify({
@@ -1357,6 +1391,7 @@ ${theme.accent(color7.bold("\u258C WrongStack"))}  ${color7.dim("Provider & Mode
     "openai-codex",
     "github-copilot",
     "google",
+    "google-antigravity",
     "openai-compatible"
   ];
   const familyOrder = [
@@ -1585,7 +1620,11 @@ async function resolveModelSelection(answer, models, provider, _registry, render
 
 // src/auth-menu/add-provider.ts
 import { color as color8 } from "@wrongstack/core/utils";
-import { catalogProviderIdFor, PROVIDER_DEFINITIONS } from "@wrongstack/providers";
+import {
+  authProfileAliasError as authProfileAliasError2,
+  catalogProviderIdFor,
+  PROVIDER_DEFINITIONS
+} from "@wrongstack/providers";
 
 // src/provider-id.ts
 function nextCustomProviderId(existing) {
@@ -1640,9 +1679,7 @@ async function addFromCatalog(deps) {
   ${color8.dim("OAuth login options: enter a registered strategy name, or q to quit.")}
 `
     );
-    const answer = (await deps.reader.readLine(
-      `  ${color8.amber("?")} OAuth strategy ${color8.dim("(or q)")}: `
-    )).trim();
+    const answer = (await deps.reader.readLine(`  ${color8.amber("?")} OAuth strategy ${color8.dim("(or q)")}: `)).trim();
     if (answer && await runOAuthLoginChoice(deps, answer, { allowNumeric: false })) {
       return true;
     }
@@ -1678,6 +1715,7 @@ async function addKeyForCatalogProvider(deps, chosen) {
   const baseUrl = baseRaw || chosen.apiBase;
   const providersNow = await loadProviders(deps);
   let suggestedAlias = chosen.id;
+  for (let n = 2; providersNow[suggestedAlias]; n++) suggestedAlias = `${chosen.id}-${n}`;
   if (family !== chosen.family) {
     let candidate = `${chosen.id}-${family}`;
     let n = 2;
@@ -1691,6 +1729,11 @@ async function addKeyForCatalogProvider(deps, chosen) {
     `  ${color8.amber("?")} Save as alias ${color8.dim(`[${suggestedAlias}]`)} ${color8.dim("(used with --provider <alias>)")}: `
   )).trim();
   const alias = aliasRaw || suggestedAlias;
+  const aliasError = authProfileAliasError2(alias);
+  if (aliasError) {
+    deps.renderer.writeError(aliasError);
+    return false;
+  }
   const existing = providersNow[alias];
   if (existing) {
     const sameFamily = (existing.family ?? chosen.family) === family;
@@ -1704,6 +1747,10 @@ async function addKeyForCatalogProvider(deps, chosen) {
       );
       return false;
     }
+    deps.renderer.writeError(
+      `Auth profile "${alias}" already exists. Choose another alias or manage its keys explicitly.`
+    );
+    return false;
   }
   return addKeyForProvider(alias, deps, {
     type: chosen.id,
@@ -1897,4 +1944,4 @@ export {
   addCustomProvider,
   addKeyForProvider
 };
-//# sourceMappingURL=chunk-RDHFXOJM.js.map
+//# sourceMappingURL=chunk-2ERX3RPN.js.map