@wrongstack/cli 1.0.19 → 1.0.26

package/dist/subcommands/handlers/permissions.d.ts

@@ -1,10 +1,16 @@
 import type { SubcommandHandler } from '../contracts.js';
 /**
+ * `wstack permissions rules [--json]`
  * `wstack permissions explain <tool> --input '<json>' [--json]`
  *
- * Side-effect-free permission decision explainer. Evaluates the same
- * rules as `DefaultPermissionPolicy.evaluate()` without prompting the
- * user, writing to trust files, or mutating session state.
+ * Side-effect-free views of the permission policy. Both build the policy the
+ * agent itself runs under (`createProjectPermissionPolicy`: directory rules,
+ * trust file, YOLO and `autonomy.yoloConfirm` from the config) for a fresh
+ * session, without prompting the user, writing to trust files, or mutating
+ * session state. `rules` lists every rule in the order they are checked;
+ * `explain` traces one call and names the rule that decided it. Inside a
+ * session, `/permissions` shows the same with that session's YOLO, answers
+ * and session rules.
  */
 export declare const permissionsCmd: SubcommandHandler;
 //# sourceMappingURL=permissions.d.ts.map

package/dist/subcommands/handlers/remote.d.ts

@@ -0,0 +1,6 @@
+import type { TerminalRenderer } from '../../renderer.js';
+import type { SubcommandHandler } from '../contracts.js';
+export declare function runRemoteCommand(args: string[], flags: Record<string, string | boolean>, renderer: Pick<TerminalRenderer, 'writeLine'>): Promise<number>;
+/** Registry entry; `boot()` normally dispatches `remote` before loading any config. */
+export declare const remoteCmd: SubcommandHandler;
+//# sourceMappingURL=remote.d.ts.map

package/dist/subcommands/handlers/skill-suggest.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `wstack skill-suggest` — inspect and tune the TypeSafe skill suggester.
+ *
+ * The suggester runs inside a turn and its output is one line of system prompt,
+ * which makes it almost impossible to observe in place: you see the agent load
+ * a skill, not why. Two modes make it inspectable:
+ *
+ *   wstack skill-suggest "<request>"        one request, both passes, all numbers
+ *   wstack skill-suggest --eval cases.jsonl labeled set, scored
+ *   wstack skill-suggest --eval cases.jsonl --sweep   …plus a threshold table
+ *
+ * Both work whether or not `skills.suggest.enabled` is on — previewing is how
+ * you decide whether to turn it on. Both need a TypeSafe API key, and both send
+ * request text to TypeSafe, so `--eval` prints what it is about to spend before
+ * it spends it.
+ */
+import { type LabeledRequest, type ScoredCase } from '@wrongstack/core/skills';
+import type { SubcommandHandler } from '../contracts.js';
+export declare const skillSuggestCmd: SubcommandHandler;
+export type { LabeledRequest, ScoredCase };
+//# sourceMappingURL=skill-suggest.d.ts.map

package/dist/subcommands/handlers/typesafe-brain-replay.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `wstack typesafe replay-brain-ledger` — calibrate the Brain's System One
+ * tier on decisions this project already made.
+ *
+ * The Brain ledger records every decision (question, chosen option, which tier
+ * or council settled it) and, for interventions, whether the same signal fired
+ * again afterwards. It does not record the option list or the full context —
+ * but the BrainMonitor signals (file churn, tool-failure streak, stall, error
+ * storm) always ask the same steer/continue question with a context the
+ * question text already carries, so those requests can be rebuilt exactly.
+ *
+ * Each rebuilt request goes through `probeSystemOneBrain` (the tier's real
+ * questions, no thresholds), and the report compares Jev's pick with the
+ * recorded one: overall agreement, how much the current thresholds would
+ * settle and how often those settled picks agree, a threshold sweep, and how
+ * often Jev said `continue` on a steer the ledger shows was futile (the same
+ * signal re-fired).
+ *
+ * The recorded pick is a reference, not ground truth: most were made by the
+ * council or a policy, and the outcome record only exists for steers. The
+ * decision digest the live tier sees is omitted — rebuilding it from the
+ * ledger would leak later outcomes into earlier decisions.
+ */
+import type { SubcommandDeps } from '../contracts.js';
+export declare function replayBrainLedger(deps: SubcommandDeps, write: (line: string) => void): Promise<number>;
+//# sourceMappingURL=typesafe-brain-replay.d.ts.map

package/dist/subcommands/handlers/typesafe-judgment-check.d.ts

@@ -0,0 +1,3 @@
+import type { SubcommandDeps } from '../contracts.js';
+export declare function checkJudgments(deps: SubcommandDeps, write: (line: string) => void): Promise<number>;
+//# sourceMappingURL=typesafe-judgment-check.d.ts.map

package/dist/subcommands/handlers/typesafe-topic-replay.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `wstack typesafe replay-topic-shift` — calibrate the topic-shift front on
+ * this project's own sessions.
+ *
+ * Session journals record every user prompt (`user_input`) and every message
+ * appended to the conversation, so the history the advisor saw at each prompt
+ * can be rebuilt. Each prompt is replayed through the real `TopicShiftAdvisor`
+ * twice — once with only the TypeSafe judge, once with only the configured
+ * provider (the path it has always had, with its production request) — and only
+ * prompts that pass the advisor's own local gate are counted, because the
+ * rest never reach a classifier in production either.
+ *
+ * Reported: how often each classifier answers at all, what it answers, and
+ * how the two agree where Jev is decisive. `--json` includes the prompt and
+ * the previous user prompt for hand-labelling. Nothing is written.
+ */
+import type { SubcommandDeps } from '../contracts.js';
+export declare function replayTopicShift(deps: SubcommandDeps, write: (line: string) => void): Promise<number>;
+//# sourceMappingURL=typesafe-topic-replay.d.ts.map

package/dist/subcommands/handlers/typesafe-triage-replay.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `wstack typesafe replay-memory-triage` — calibrate the triage front on this
+ * project's own memories.
+ *
+ * Opens the project's SAGE database READ-ONLY, runs the deterministic Phases
+ * 1–2 exactly as `/memory triage` does to find the gray zone, samples it, and
+ * asks both Jev (`probeMemoryValue`, raw distribution) and the configured LLM
+ * (the same prompt and parser `/memory triage` uses) for a 1–5 rating.
+ *
+ * The report compares them on the rating and — what actually matters — on the
+ * triage ACTION each rating would cause (keep / stale / propose archive),
+ * overall and for the subset the front would settle at each confidence
+ * threshold. The LLM is the reference, not ground truth; `--no-llm` skips it
+ * and reports Jev's distribution alone. Nothing is written anywhere.
+ */
+import type { SubcommandDeps } from '../contracts.js';
+export declare function replayMemoryTriage(deps: SubcommandDeps, write: (line: string) => void): Promise<number>;
+//# sourceMappingURL=typesafe-triage-replay.d.ts.map

package/dist/subcommands/handlers/typesafe.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `wstack typesafe` — the account surface for the System One features.
+ *
+ * TypeSafe is not a provider and deliberately does not appear in `wstack auth`:
+ * it answers typed questions rather than generating text, so putting it in the
+ * provider list would leak `jev-latest` into the model picker, the subagent
+ * lanes and the fallback chain, where selecting it would simply break a turn.
+ * But "not a provider" is not "not an account" — it has a credential, a host
+ * and a bill, and until this command existed the only way to configure any of
+ * that was to hand-edit a config file. Nothing in any UI mentioned it.
+ *
+ *   wstack typesafe                  what is configured (no network request)
+ *   wstack typesafe login            store a key (and pick a route)
+ *   wstack typesafe test             spend one cheap question proving it works
+ *
+ * `test` is the point of the whole command. Both consumers degrade silently by
+ * design, so a wrong or revoked key produces no error anywhere — it produces
+ * slightly worse routing and no skill suggestions, forever. This is the only
+ * place that asks the host directly and reports what it said.
+ */
+import type { SubcommandHandler } from '../contracts.js';
+export declare const typesafeCmd: SubcommandHandler;
+//# sourceMappingURL=typesafe.d.ts.map

package/dist/subcommands/handlers/version-help.d.ts

@@ -1,4 +1,9 @@
 import type { SubcommandHandler } from '../contracts.js';
 export declare const versionCmd: SubcommandHandler;
+/**
+ * Global help. Every row here must name something the CLI actually reads —
+ * `wstack <command> --help` carries the per-command detail, so this page
+ * groups by what the user is trying to do rather than listing everything.
+ */
 export declare const helpCmd: SubcommandHandler;
 //# sourceMappingURL=version-help.d.ts.map

package/dist/{subcommands-XSLXMIDP.js → subcommands-Q6ORSB2E.js}

@@ -1,9 +1,9 @@
 import {
   subcommandNames,
   subcommands
-} from "./chunk-2CZEORLV.js";
+} from "./chunk-BEHGRNOQ.js";
 export {
   subcommandNames,
   subcommands
 };
-//# sourceMappingURL=subcommands-XSLXMIDP.js.map
+//# sourceMappingURL=subcommands-Q6ORSB2E.js.map

package/dist/tui-resume-callback.d.ts

@@ -0,0 +1,18 @@
+import type { SessionLoadProgress } from '@wrongstack/core/types';
+export declare function createTuiResumeCallback({ state, agent, tokenCounter, switchProviderAndModel, events, }: {
+    state: import('./boot/tui-runtime-state.js').TuiRuntimeState;
+    agent: import('@wrongstack/core/agent').Agent;
+    tokenCounter: import('@wrongstack/core/types').TokenCounter;
+    switchProviderAndModel: (providerId: string, modelId: string) => string | Promise<string | null> | null;
+    events: import('@wrongstack/core/kernel').EventBus;
+}): (sessionId: string, onLoadProgress?: (progress: SessionLoadProgress) => void, onStage?: (stage: string) => void) => Promise<{
+    entries: unknown[];
+    nextId: number;
+    sessionId: string;
+    attached: boolean;
+    warnings: string[];
+    contextSnapshot?: import("@wrongstack/core/types").ContextSnapshot | undefined;
+    lastAssistantText?: string | undefined;
+    nextSteps: string[];
+}>;
+//# sourceMappingURL=tui-resume-callback.d.ts.map

package/dist/typesafe-U7YB2RRV.js

@@ -0,0 +1,316 @@
+import {
+  maskedKey,
+  mutateConfigProviders
+} from "./chunk-LUMETJFO.js";
+import {
+  activeProfileConfigPath
+} from "./chunk-YMXXOOFN.js";
+
+// src/subcommands/handlers/typesafe.ts
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import * as path from "node:path";
+import {
+  BUILT_IN_ROUTES,
+  BUILT_IN_SEMANTIC_LINT_RULES,
+  estimateTypeSafeCostUsd,
+  findSemanticLintCandidates,
+  isTypeSafeJudgmentEnabled,
+  isTypeSafeRoute,
+  judgeSemanticLintCandidates,
+  parseSemanticLintRules,
+  resolveTypeSafeAccount,
+  resolveTypeSafeJudge,
+  resolveTypeSafeRoute,
+  TYPESAFE_JUDGMENT_FEATURES,
+  TYPESAFE_ROUTES
+} from "@wrongstack/core/typesafe";
+import { buildChildEnv, color } from "@wrongstack/core/utils";
+var USAGE = [
+  "Usage:",
+  "  wstack typesafe [status]                 show account and feature configuration",
+  "  wstack typesafe login [--route <id>]     store an API key in the active profile",
+  "      [--endpoint <url>] [--model <id>]    configure a proxy or pin a model",
+  "  wstack typesafe test                     send one question and report the answer",
+  "  wstack typesafe lint-conventions         judge convention-rule hits in the diff",
+  "      [--staged | --base <ref>] [--threshold <0..1>] [--json]",
+  "      rules: built-in + .wrongstack/semantic-lint.json; exit 1 on findings",
+  "  wstack typesafe check-judgments          run every judgment on known cases (live)",
+  "  wstack typesafe replay-brain-ledger      compare Jev with past Brain decisions",
+  "      [--ledger <path>] [--limit <per kind>] [--kind <signal>] [--json]",
+  "  wstack typesafe replay-topic-shift       compare Jev with the provider on past session prompts",
+  "      [--sessions <dir>] [--limit <n>] [--max-context <n>] [--no-llm] [--json]",
+  "  wstack typesafe replay-memory-triage     compare Jev with the LLM on SAGE gray-zone memories",
+  "      [--limit <n>] [--provider <id>] [--model <id>] [--llm-max-tokens <n>]",
+  "      [--no-llm] [--json]",
+  "",
+  `Routes: ${BUILT_IN_ROUTES.map((r) => `${r} (${TYPESAFE_ROUTES[r].env})`).join(", ")}, custom (typesafe.endpoint)`,
+  "",
+  "TypeSafe is not a chat provider and is not listed by `wstack auth`."
+].join("\n");
+var typesafeCmd = async (args, deps) => {
+  const write = (line) => deps.renderer.write(`${line}
+`);
+  const flags = deps.flags ?? {};
+  if (flags["help"] === true || flags["h"] === true) {
+    write(USAGE);
+    return 0;
+  }
+  const sub = (args[0] ?? "status").toLowerCase();
+  switch (sub) {
+    case "status":
+      return showStatus(deps, write);
+    case "login":
+      return await login(deps, write);
+    case "test":
+      return await test(deps, write);
+    case "lint-conventions":
+      return await lintConventions(deps, write);
+    case "replay-topic-shift":
+      return await (await import("./typesafe-topic-replay-ZILIU3WS.js")).replayTopicShift(deps, write);
+    case "replay-memory-triage":
+      return await (await import("./typesafe-triage-replay-FGAW7QM7.js")).replayMemoryTriage(deps, write);
+    case "replay-brain-ledger":
+      return await (await import("./typesafe-brain-replay-C5276FVR.js")).replayBrainLedger(deps, write);
+    case "check-judgments":
+      return await (await import("./typesafe-judgment-check-GGYYV5UF.js")).checkJudgments(deps, write);
+    default:
+      write(`Unknown subcommand: ${sub}
+`);
+      write(USAGE);
+      return 1;
+  }
+};
+function requestedFeatures(deps) {
+  const requested = [];
+  if (deps.config.skills?.suggest?.enabled === true) requested.push("skills.suggest");
+  if (deps.config.fleet?.dispatch?.typesafeClassifier === true) {
+    requested.push("fleet.dispatch.typesafeClassifier");
+  }
+  return requested;
+}
+function showStatus(deps, write) {
+  const account = resolveTypeSafeAccount({ config: deps.config });
+  const route = resolveTypeSafeRoute(deps.config, process.env);
+  const features = requestedFeatures(deps);
+  write(color.bold("TypeSafe account"));
+  write(`  route      ${route}${route === "custom" ? color.dim(" (from typesafe.endpoint)") : ""}`);
+  if (account.status === "ready") {
+    write(`  endpoint   ${account.endpoint}`);
+    write(`  model      ${account.model}`);
+    write(
+      `  key        ${account.keySource === "config" ? `${maskedKey(deps.config.typesafe?.apiKey ?? "")} ${color.dim("(typesafe.apiKey)")}` : color.dim(`from $${account.keyEnv}`)}`
+    );
+    write("  connection not tested \u2014 run `wstack typesafe test` to verify");
+  } else {
+    write(`  key        ${color.dim("\u2014")}`);
+    write(`  ${color.amber("!")} ${account.reason}`);
+  }
+  write("");
+  write(
+    color.bold("Judgments") + color.dim("  (on with an account; typesafe.judgments.<id>: false turns one off)")
+  );
+  for (const feature of TYPESAFE_JUDGMENT_FEATURES) {
+    const on = isTypeSafeJudgmentEnabled(deps.config, feature);
+    write(
+      `  ${!on ? color.dim("off") : account.status === "ready" ? color.green("on ") : color.dim("idle")}  ${feature}`
+    );
+  }
+  write("");
+  write(color.bold("Features"));
+  if (features.length === 0) {
+    write(`  ${color.dim("none enabled")} \u2014 see docs/skills-suggestion.md`);
+  } else {
+    for (const feature of features) {
+      write(
+        account.status === "ready" ? `  ${color.green("on")}  ${feature}` : `  ${color.amber("on, but not running")}  ${feature}`
+      );
+    }
+  }
+  if (account.status !== "ready" && features.length > 0) {
+    write("");
+    write(`  ${color.amber("Run `wstack typesafe login` \u2014 these switches do nothing today.")}`);
+    return 1;
+  }
+  return 0;
+}
+async function login(deps, write) {
+  const flags = deps.flags ?? {};
+  for (const name of ["route", "endpoint", "model", "key"]) {
+    if (flags[name] !== void 0 && (typeof flags[name] !== "string" || !String(flags[name]).trim())) {
+      write(`--${name} requires a value.`);
+      return 1;
+    }
+  }
+  const requested = flags["route"];
+  let route;
+  if (typeof requested === "string") {
+    if (!isTypeSafeRoute(requested)) {
+      write(`Unknown route: ${requested}`);
+      write(USAGE);
+      return 1;
+    }
+    route = requested;
+  }
+  const endpoint = typeof flags["endpoint"] === "string" ? flags["endpoint"].trim() : void 0;
+  const model = typeof flags["model"] === "string" ? flags["model"].trim() : void 0;
+  if (endpoint && !route) route = "custom";
+  const update = (existing) => {
+    const next = { ...existing };
+    if (route && route !== resolveTypeSafeRoute({ typesafe: existing }, {})) {
+      delete next.endpoint;
+      delete next.model;
+    }
+    if (route) next.route = route;
+    if (endpoint) next.endpoint = endpoint;
+    if (model) next.model = model;
+    return next;
+  };
+  const settings = update(deps.config.typesafe ?? {});
+  const preview = resolveTypeSafeAccount({ config: { typesafe: settings }, env: {} });
+  if (preview.status === "unusable") {
+    write(`${preview.reason}. For a custom route, pass --endpoint <url>.`);
+    return 1;
+  }
+  const effectiveRoute = resolveTypeSafeRoute({ typesafe: settings }, {});
+  const label = effectiveRoute !== "custom" ? TYPESAFE_ROUTES[effectiveRoute].label : "TypeSafe (custom)";
+  const fromFlag = typeof flags["key"] === "string" ? flags["key"].trim() : "";
+  const key = fromFlag || await deps.reader.readSecret(`  ${color.amber("?")} ${label} API key: `);
+  if (!key.trim()) {
+    write("No key entered; nothing written.");
+    return 1;
+  }
+  const configPath = activeProfileConfigPath(deps.paths, deps.config);
+  await mutateConfigProviders(configPath, deps.vault, (_providers, config) => {
+    const existing = typeof config["typesafe"] === "object" && config["typesafe"] !== null ? config["typesafe"] : {};
+    config["typesafe"] = { ...update(existing), apiKey: key.trim() };
+  });
+  write(`${color.green("\u2713")} Key stored in ${configPath}`);
+  if (route) write(`  route set to ${route}`);
+  write(`  Verify it with ${color.bold("wstack typesafe test")}.`);
+  return 0;
+}
+async function test(deps, write) {
+  const account = resolveTypeSafeAccount({ config: deps.config, restGate: null });
+  if (account.status !== "ready") {
+    write(`${color.red("\u2717")} ${account.reason}`);
+    write("  Run `wstack typesafe login`.");
+    return 1;
+  }
+  write(`Asking ${account.endpoint} (${account.model})\u2026`);
+  const started = Date.now();
+  try {
+    const result = await account.client.systemOne({
+      state: { text: "The service returned this request successfully." },
+      questions: {
+        reachable: {
+          type: "noul",
+          instructions: "Is the text in the state written in English?"
+        }
+      }
+    });
+    const answer = result.answers["reachable"];
+    const elapsed = Date.now() - started;
+    if (answer?.type !== "noul") {
+      write(`${color.red("\u2717")} Reached the host but the answer was missing or malformed.`);
+      return 1;
+    }
+    write(`${color.green("\u2713")} ${account.route} route works \u2014 answered in ${elapsed}ms`);
+    write(`  model reported  ${result.model ?? color.dim("(none in response)")}`);
+    write(
+      `  cost            ${result.usage.inputTokens} input tokens ` + color.dim(`(~$${estimateTypeSafeCostUsd(result.usage.inputTokens).toFixed(6)})`)
+    );
+    if (result.model && deps.config.typesafe?.model && result.model !== deps.config.typesafe.model) {
+      write(
+        color.dim(`  note: asked for ${deps.config.typesafe.model}, answered by ${result.model}`)
+      );
+    }
+    return 0;
+  } catch (err) {
+    const status = err.status;
+    write(`${color.red("\u2717")} ${err instanceof Error ? err.message : String(err)}`);
+    if (status === 401 || status === 403) {
+      write("  The host rejected the key. Re-run `wstack typesafe login`.");
+    } else if (status === 429 || status === 529) {
+      write("  Rate limited or overloaded \u2014 the key is probably fine; try again shortly.");
+    } else if (status === 422) {
+      write("  The host rejected the request shape, not the key. This is a bug; please report it.");
+    }
+    return 1;
+  }
+}
+function runGit(cwd, args) {
+  return new Promise((resolve, reject) => {
+    execFile(
+      "git",
+      args,
+      {
+        cwd,
+        env: buildChildEnv(),
+        encoding: "utf8",
+        timeout: 3e4,
+        windowsHide: true,
+        maxBuffer: 32 * 1024 * 1024
+      },
+      (err, stdout) => err ? reject(err) : resolve(stdout)
+    );
+  });
+}
+async function lintConventions(deps, write) {
+  const flags = deps.flags ?? {};
+  const judge = resolveTypeSafeJudge({ config: deps.config, feature: "semanticLint" });
+  if (!judge) {
+    const account = resolveTypeSafeAccount({ config: deps.config });
+    write(
+      `${color.red("\u2717")} ${account.status === "ready" ? "typesafe.judgments.semanticLint is false." : `${account.reason}. Run \`wstack typesafe login\`.`}`
+    );
+    return 2;
+  }
+  const rules = [...BUILT_IN_SEMANTIC_LINT_RULES];
+  const rulesPath = path.join(deps.projectRoot, ".wrongstack", "semantic-lint.json");
+  try {
+    const parsed = parseSemanticLintRules(JSON.parse(await readFile(rulesPath, "utf8")));
+    for (const error of parsed.errors) write(color.amber(`! ${rulesPath}: ${error}`));
+    rules.push(...parsed.rules);
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      write(color.amber(`! ${rulesPath}: ${err instanceof Error ? err.message : String(err)}`));
+    }
+  }
+  const base = typeof flags["base"] === "string" ? flags["base"] : void 0;
+  const diffArgs = ["diff", "--no-color", "--no-ext-diff", "-U24"];
+  if (flags["staged"] === true) diffArgs.push("--cached");
+  else if (base) diffArgs.push(`${base}...HEAD`);
+  let diff;
+  try {
+    diff = await runGit(deps.projectRoot, diffArgs);
+  } catch (err) {
+    write(`${color.red("\u2717")} git diff failed: ${err instanceof Error ? err.message : String(err)}`);
+    return 2;
+  }
+  const candidates = findSemanticLintCandidates(diff, rules);
+  const thresholdFlag = Number(flags["threshold"]);
+  const threshold = Number.isFinite(thresholdFlag) && thresholdFlag > 0 && thresholdFlag <= 1 ? thresholdFlag : 0.7;
+  const result = candidates.length === 0 ? { findings: [], cleared: 0, unjudged: 0 } : await judgeSemanticLintCandidates(judge, rules, candidates, { threshold });
+  if (flags["json"] === true) {
+    write(JSON.stringify({ candidates: candidates.length, ...result }, null, 2));
+  } else {
+    for (const f of result.findings) {
+      write(
+        `${color.amber(`${f.file}:${f.line}`)}  ${color.bold(f.ruleId)}  ` + color.dim(`p=${f.probability.toFixed(2)}`)
+      );
+      write(`    ${f.text.slice(0, 160)}`);
+    }
+    write(
+      color.dim(
+        `${candidates.length} candidate(s) across ${rules.length} rule(s): ${result.findings.length} finding(s), ${result.cleared} cleared` + (result.unjudged ? `, ${result.unjudged} not judged (host unavailable)` : "")
+      )
+    );
+  }
+  if (result.findings.length > 0) return 1;
+  return result.unjudged > 0 ? 2 : 0;
+}
+export {
+  typesafeCmd
+};
+//# sourceMappingURL=typesafe-U7YB2RRV.js.map